- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] ice: fix memory leak in aRFS after reset
by Yin Tirui 07 May '25

07 May '25

From: Grzegorz Nitka <grzegorz.nitka(a)intel.com> mainline inclusion from mainline-v6.14-rc7 commit 23d97f18901ef5e4e264e3b1777fe65c760186b5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBY42R CVE: CVE-2025-21981 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Fix aRFS (accelerated Receive Flow Steering) structures memory leak by adding a checker to verify if aRFS memory is already allocated while configuring VSI. aRFS objects are allocated in two cases: - as part of VSI initialization (at probe), and - as part of reset handling However, VSI reconfiguration executed during reset involves memory allocation one more time, without prior releasing already allocated resources. This led to the memory leak with the following signature: [root@os-delivery ~]# cat /sys/kernel/debug/kmemleak unreferenced object 0xff3c1ca7252e6000 (size 8192): comm "kworker/0:0", pid 8, jiffies 4296833052 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc 0): [<ffffffff991ec485>] __kmalloc_cache_noprof+0x275/0x340 [<ffffffffc0a6e06a>] ice_init_arfs+0x3a/0xe0 [ice] [<ffffffffc09f1027>] ice_vsi_cfg_def+0x607/0x850 [ice] [<ffffffffc09f244b>] ice_vsi_setup+0x5b/0x130 [ice] [<ffffffffc09c2131>] ice_init+0x1c1/0x460 [ice] [<ffffffffc09c64af>] ice_probe+0x2af/0x520 [ice] [<ffffffff994fbcd3>] local_pci_probe+0x43/0xa0 [<ffffffff98f07103>] work_for_cpu_fn+0x13/0x20 [<ffffffff98f0b6d9>] process_one_work+0x179/0x390 [<ffffffff98f0c1e9>] worker_thread+0x239/0x340 [<ffffffff98f14abc>] kthread+0xcc/0x100 [<ffffffff98e45a6d>] ret_from_fork+0x2d/0x50 [<ffffffff98e083ba>] ret_from_fork_asm+0x1a/0x30 ... Fixes: 28bf26724fdb ("ice: Implement aRFS") Reviewed-by: Michal Swiatkowski <michal.swiatkowski(a)linux.intel.com> Signed-off-by: Grzegorz Nitka <grzegorz.nitka(a)intel.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Tested-by: Rinitha S <sx.rinitha(a)intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com> Conflicts: drivers/net/ethernet/intel/ice/ice_arfs.c [context conflict] Signed-off-by: Tirui Yin <yintirui(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> --- drivers/net/ethernet/intel/ice/ice_arfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/intel/ice/ice_arfs.c b/drivers/net/ethernet/intel/ice/ice_arfs.c index eca2ba2eea8c..085b1a0d67c5 100644 --- a/drivers/net/ethernet/intel/ice/ice_arfs.c +++ b/drivers/net/ethernet/intel/ice/ice_arfs.c @@ -510,7 +510,7 @@ void ice_init_arfs(struct ice_vsi *vsi) struct hlist_head *arfs_fltr_list; unsigned int i; - if (!vsi || vsi->type != ICE_VSI_PF) + if (!vsi || vsi->type != ICE_VSI_PF || ice_is_arfs_active(vsi)) return; arfs_fltr_list = kzalloc(sizeof(*arfs_fltr_list) * ICE_MAX_ARFS_LIST, -- 2.22.0

2 1

[PATCH OLK-6.6] vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint
by Yin Tirui 07 May '25

07 May '25

From: Mike Christie <michael.christie(a)oracle.com> stable inclusion from stable-v6.6.87 commit 2b34bdc42df047794542f3e220fe989124e4499a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP35K CVE: CVE-2025-22083 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5dd639a1646ef5fe8f4bf270fad47c5c3755b9b6 ] If vhost_scsi_set_endpoint is called multiple times without a vhost_scsi_clear_endpoint between them, we can hit multiple bugs found by Haoran Zhang: 1. Use-after-free when no tpgs are found: This fixes a use after free that occurs when vhost_scsi_set_endpoint is called more than once and calls after the first call do not find any tpgs to add to the vs_tpg. When vhost_scsi_set_endpoint first finds tpgs to add to the vs_tpg array match=true, so we will do: vhost_vq_set_backend(vq, vs_tpg); ... kfree(vs->vs_tpg); vs->vs_tpg = vs_tpg; If vhost_scsi_set_endpoint is called again and no tpgs are found match=false so we skip the vhost_vq_set_backend call leaving the pointer to the vs_tpg we then free via: kfree(vs->vs_tpg); vs->vs_tpg = vs_tpg; If a scsi request is then sent we do: vhost_scsi_handle_vq -> vhost_scsi_get_req -> vhost_vq_get_backend which sees the vs_tpg we just did a kfree on. 2. Tpg dir removal hang: This patch fixes an issue where we cannot remove a LIO/target layer tpg (and structs above it like the target) dir due to the refcount dropping to -1. The problem is that if vhost_scsi_set_endpoint detects a tpg is already in the vs->vs_tpg array or if the tpg has been removed so target_depend_item fails, the undepend goto handler will do target_undepend_item on all tpgs in the vs_tpg array dropping their refcount to 0. At this time vs_tpg contains both the tpgs we have added in the current vhost_scsi_set_endpoint call as well as tpgs we added in previous calls which are also in vs->vs_tpg. Later, when vhost_scsi_clear_endpoint runs it will do target_undepend_item on all the tpgs in the vs->vs_tpg which will drop their refcount to -1. Userspace will then not be able to remove the tpg and will hang when it tries to do rmdir on the tpg dir. 3. Tpg leak: This fixes a bug where we can leak tpgs and cause them to be un-removable because the target name is overwritten when vhost_scsi_set_endpoint is called multiple times but with different target names. The bug occurs if a user has called VHOST_SCSI_SET_ENDPOINT and setup a vhost-scsi device to target/tpg mapping, then calls VHOST_SCSI_SET_ENDPOINT again with a new target name that has tpgs we haven't seen before (target1 has tpg1 but target2 has tpg2). When this happens we don't teardown the old target tpg mapping and just overwrite the target name and the vs->vs_tpg array. Later when we do vhost_scsi_clear_endpoint, we are passed in either target1 or target2's name and we will only match that target's tpgs when we loop over the vs->vs_tpg. We will then return from the function without doing target_undepend_item on the tpgs. Because of all these bugs, it looks like being able to call vhost_scsi_set_endpoint multiple times was never supported. The major user, QEMU, already has checks to prevent this use case. So to fix the issues, this patch prevents vhost_scsi_set_endpoint from being called if it's already successfully added tpgs. To add, remove or change the tpg config or target name, you must do a vhost_scsi_clear_endpoint first. Fixes: 25b98b64e284 ("vhost scsi: alloc cmds per vq instead of session") Fixes: 4f7f46d32c98 ("tcm_vhost: Use vq->private_data to indicate if the endpoint is setup") Reported-by: Haoran Zhang <wh1sper(a)zju.edu.cn> Closes: https://lore.kernel.org/virtualization/e418a5ee-45ca-4d18-9b5d-6f8b6b1add8e… Signed-off-by: Mike Christie <michael.christie(a)oracle.com> Reviewed-by: Stefan Hajnoczi <stefanha(a)redhat.com> Message-Id: <20250129210922.121533-1-michael.christie(a)oracle.com> Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Acked-by: Stefano Garzarella <sgarzare(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yin Tirui <yintirui(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> --- drivers/vhost/scsi.c | 25 +++++++++++++------------ 1 file changed, 13 insertions(+), 12 deletions(-) diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c index 99813232c25e..8d8a22504d71 100644 --- a/drivers/vhost/scsi.c +++ b/drivers/vhost/scsi.c @@ -1688,14 +1688,19 @@ vhost_scsi_set_endpoint(struct vhost_scsi *vs, } } + if (vs->vs_tpg) { + pr_err("vhost-scsi endpoint already set for %s.\n", + vs->vs_vhost_wwpn); + ret = -EEXIST; + goto out; + } + len = sizeof(vs_tpg[0]) * VHOST_SCSI_MAX_TARGET; vs_tpg = kzalloc(len, GFP_KERNEL); if (!vs_tpg) { ret = -ENOMEM; goto out; } - if (vs->vs_tpg) - memcpy(vs_tpg, vs->vs_tpg, len); mutex_lock(&vhost_scsi_mutex); list_for_each_entry(tpg, &vhost_scsi_list, tv_tpg_list) { @@ -1711,12 +1716,6 @@ vhost_scsi_set_endpoint(struct vhost_scsi *vs, tv_tport = tpg->tport; if (!strcmp(tv_tport->tport_name, t->vhost_wwpn)) { - if (vs->vs_tpg && vs->vs_tpg[tpg->tport_tpgt]) { - mutex_unlock(&tpg->tv_tpg_mutex); - mutex_unlock(&vhost_scsi_mutex); - ret = -EEXIST; - goto undepend; - } /* * In order to ensure individual vhost-scsi configfs * groups cannot be removed while in use by vhost ioctl, @@ -1763,15 +1762,15 @@ vhost_scsi_set_endpoint(struct vhost_scsi *vs, } ret = 0; } else { - ret = -EEXIST; + ret = -ENODEV; + goto free_tpg; } /* - * Act as synchronize_rcu to make sure access to - * old vs->vs_tpg is finished. + * Act as synchronize_rcu to make sure requests after this point + * see a fully setup device. */ vhost_scsi_flush(vs); - kfree(vs->vs_tpg); vs->vs_tpg = vs_tpg; goto out; @@ -1791,6 +1790,7 @@ vhost_scsi_set_endpoint(struct vhost_scsi *vs, target_undepend_item(&tpg->se_tpg.tpg_group.cg_item); } } +free_tpg: kfree(vs_tpg); out: mutex_unlock(&vs->dev.mutex); @@ -1893,6 +1893,7 @@ vhost_scsi_clear_endpoint(struct vhost_scsi *vs, vhost_scsi_flush(vs); kfree(vs->vs_tpg); vs->vs_tpg = NULL; + memset(vs->vs_vhost_wwpn, 0, sizeof(vs->vs_vhost_wwpn)); WARN_ON(vs->vs_events_nr); mutex_unlock(&vs->dev.mutex); return 0; -- 2.22.0

2 1

[PATCH OLK-6.6] ice: fix memory leak in aRFS after reset
by Yin Tirui 07 May '25

07 May '25

From: Grzegorz Nitka <grzegorz.nitka(a)intel.com> stable inclusion from stable-v6.6.84 commit 5d30d256661fc11b6e73fac6c3783a702e1006a3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBY42R CVE: CVE-2025-21981 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 23d97f18901ef5e4e264e3b1777fe65c760186b5 ] Fix aRFS (accelerated Receive Flow Steering) structures memory leak by adding a checker to verify if aRFS memory is already allocated while configuring VSI. aRFS objects are allocated in two cases: - as part of VSI initialization (at probe), and - as part of reset handling However, VSI reconfiguration executed during reset involves memory allocation one more time, without prior releasing already allocated resources. This led to the memory leak with the following signature: [root@os-delivery ~]# cat /sys/kernel/debug/kmemleak unreferenced object 0xff3c1ca7252e6000 (size 8192): comm "kworker/0:0", pid 8, jiffies 4296833052 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc 0): [<ffffffff991ec485>] __kmalloc_cache_noprof+0x275/0x340 [<ffffffffc0a6e06a>] ice_init_arfs+0x3a/0xe0 [ice] [<ffffffffc09f1027>] ice_vsi_cfg_def+0x607/0x850 [ice] [<ffffffffc09f244b>] ice_vsi_setup+0x5b/0x130 [ice] [<ffffffffc09c2131>] ice_init+0x1c1/0x460 [ice] [<ffffffffc09c64af>] ice_probe+0x2af/0x520 [ice] [<ffffffff994fbcd3>] local_pci_probe+0x43/0xa0 [<ffffffff98f07103>] work_for_cpu_fn+0x13/0x20 [<ffffffff98f0b6d9>] process_one_work+0x179/0x390 [<ffffffff98f0c1e9>] worker_thread+0x239/0x340 [<ffffffff98f14abc>] kthread+0xcc/0x100 [<ffffffff98e45a6d>] ret_from_fork+0x2d/0x50 [<ffffffff98e083ba>] ret_from_fork_asm+0x1a/0x30 ... Fixes: 28bf26724fdb ("ice: Implement aRFS") Reviewed-by: Michal Swiatkowski <michal.swiatkowski(a)linux.intel.com> Signed-off-by: Grzegorz Nitka <grzegorz.nitka(a)intel.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Tested-by: Rinitha S <sx.rinitha(a)intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yin Tirui <yintirui(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> --- drivers/net/ethernet/intel/ice/ice_arfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/intel/ice/ice_arfs.c b/drivers/net/ethernet/intel/ice/ice_arfs.c index cca0e753f38f..d7e0116f6773 100644 --- a/drivers/net/ethernet/intel/ice/ice_arfs.c +++ b/drivers/net/ethernet/intel/ice/ice_arfs.c @@ -510,7 +510,7 @@ void ice_init_arfs(struct ice_vsi *vsi) struct hlist_head *arfs_fltr_list; unsigned int i; - if (!vsi || vsi->type != ICE_VSI_PF) + if (!vsi || vsi->type != ICE_VSI_PF || ice_is_arfs_active(vsi)) return; arfs_fltr_list = kcalloc(ICE_MAX_ARFS_LIST, sizeof(*arfs_fltr_list), -- 2.22.0

2 1

[PATCH OLK-6.6] watch_queue: fix pipe accounting mismatch
by Yin Tirui 07 May '25

07 May '25

From: Eric Sandeen <sandeen(a)redhat.com> stable inclusion from stable-v6.6.87 commit 6dafa27764183738dc5368b669b71e3d0d154f12 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QS8 CVE: CVE-2025-23138 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f13abc1e8e1a3b7455511c4e122750127f6bc9b0 ] Currently, watch_queue_set_size() modifies the pipe buffers charged to user->pipe_bufs without updating the pipe->nr_accounted on the pipe itself, due to the if (!pipe_has_watch_queue()) test in pipe_resize_ring(). This means that when the pipe is ultimately freed, we decrement user->pipe_bufs by something other than what than we had charged to it, potentially leading to an underflow. This in turn can cause subsequent too_many_pipe_buffers_soft() tests to fail with -EPERM. To remedy this, explicitly account for the pipe usage in watch_queue_set_size() to match the number set via account_pipe_buffers() (It's unclear why watch_queue_set_size() does not update nr_accounted; it may be due to intentional overprovisioning in watch_queue_set_size()?) Fixes: e95aada4cb93d ("pipe: wakeup wr_wait after setting max_usage") Signed-off-by: Eric Sandeen <sandeen(a)redhat.com> Link: https://lore.kernel.org/r/206682a8-0604-49e5-8224-fdbe0c12b460@redhat.com Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yin Tirui <yintirui(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> --- kernel/watch_queue.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/kernel/watch_queue.c b/kernel/watch_queue.c index 778b4056700f..17254597accd 100644 --- a/kernel/watch_queue.c +++ b/kernel/watch_queue.c @@ -269,6 +269,15 @@ long watch_queue_set_size(struct pipe_inode_info *pipe, unsigned int nr_notes) if (ret < 0) goto error; + /* + * pipe_resize_ring() does not update nr_accounted for watch_queue + * pipes, because the above vastly overprovisions. Set nr_accounted on + * and max_usage this pipe to the number that was actually charged to + * the user above via account_pipe_buffers. + */ + pipe->max_usage = nr_pages; + pipe->nr_accounted = nr_pages; + ret = -ENOMEM; pages = kcalloc(sizeof(struct page *), nr_pages, GFP_KERNEL); if (!pages) -- 2.22.0

2 1

[PATCH OLK-5.10] watch_queue: fix pipe accounting mismatch
by Yin Tirui 07 May '25

07 May '25

From: Eric Sandeen <sandeen(a)redhat.com> stable inclusion from stable-v5.10.236 commit 8658c75343ed00e5e154ebbe24335f51ba8db547 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QS8 CVE: CVE-2025-23138 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f13abc1e8e1a3b7455511c4e122750127f6bc9b0 ] Currently, watch_queue_set_size() modifies the pipe buffers charged to user->pipe_bufs without updating the pipe->nr_accounted on the pipe itself, due to the if (!pipe_has_watch_queue()) test in pipe_resize_ring(). This means that when the pipe is ultimately freed, we decrement user->pipe_bufs by something other than what than we had charged to it, potentially leading to an underflow. This in turn can cause subsequent too_many_pipe_buffers_soft() tests to fail with -EPERM. To remedy this, explicitly account for the pipe usage in watch_queue_set_size() to match the number set via account_pipe_buffers() (It's unclear why watch_queue_set_size() does not update nr_accounted; it may be due to intentional overprovisioning in watch_queue_set_size()?) Fixes: e95aada4cb93d ("pipe: wakeup wr_wait after setting max_usage") Signed-off-by: Eric Sandeen <sandeen(a)redhat.com> Link: https://lore.kernel.org/r/206682a8-0604-49e5-8224-fdbe0c12b460@redhat.com Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yin Tirui <yintirui(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> --- kernel/watch_queue.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/kernel/watch_queue.c b/kernel/watch_queue.c index 73717917d816..37da8647b4ec 100644 --- a/kernel/watch_queue.c +++ b/kernel/watch_queue.c @@ -274,6 +274,15 @@ long watch_queue_set_size(struct pipe_inode_info *pipe, unsigned int nr_notes) if (ret < 0) goto error; + /* + * pipe_resize_ring() does not update nr_accounted for watch_queue + * pipes, because the above vastly overprovisions. Set nr_accounted on + * and max_usage this pipe to the number that was actually charged to + * the user above via account_pipe_buffers. + */ + pipe->max_usage = nr_pages; + pipe->nr_accounted = nr_pages; + ret = -ENOMEM; pages = kcalloc(sizeof(struct page *), nr_pages, GFP_KERNEL); if (!pages) -- 2.22.0

2 1

[PATCH OLK-6.6 V2 00/63] Add FUSE Passthrough Support
by Yifan Qiao 07 May '25

07 May '25

V2: Set CONFIG_FUSE_PASSTHROUGH=y in openeuler_defconfig. Amir Goldstein (57): fs: rename __mnt_{want,drop}_write*() helpers fs: export mnt_{get,put}_write_access() to modules fuse: factor out helper fuse_truncate_update_attr() fuse: allocate ff->release_args only if release is needed fuse: break up fuse_open_common() fuse: prepare for failing open response fuse: introduce inode io modes fuse: allow parallel dio writes with FUSE_DIRECT_IO_ALLOW_MMAP ovl: use simpler function to convert iocb to rw flags ovl: propagate IOCB_APPEND flag on writes to realfile ovl: punt write aio completion to workqueue ovl: protect copying of realinode attributes to ovl inode fs: get mnt_writers count for an open backing file's real path fs: create helper file_user_path() for user displayed mapped file path fs: store real path instead of fake path in backing file f_path ovl: add helper ovl_file_modified() ovl: split ovl_want_write() into two helpers ovl: reorder ovl_want_write() after ovl_inode_lock() ovl: do not open/llseek lower file with upper sb_writers held ovl: do not encode lower fh with upper sb_writers held ovl: add permission hooks outside of do_splice_direct() splice: remove permission hook from do_splice_direct() splice: move permission hook out of splice_direct_to_actor() splice: move permission hook out of splice_file_to_pipe() splice: remove permission hook from iter_file_splice_write() remap_range: move permission hooks out of do_clone_file_range() remap_range: move file_start_write() to after permission hook btrfs: move file_start_write() to after permission hook coda: change locking order in coda_file_write_iter() fs: move file_start_write() into vfs_iter_write() fs: move permission hook out of do_iter_write() fs: move permission hook out of do_iter_read() fs: move kiocb_start_write() into vfs_iocb_iter_write() fs: create __sb_write_started() helper fs: create file_write_started() helper fs: create {sb,file}_write_not_started() helpers fs: prepare for stackable filesystems backing file helpers fs: factor out backing_file_{read,write}_iter() helpers fs: factor out backing_file_splice_{read,write}() helpers fs: factor out backing_file_mmap() helper fuse: factor out helper for FUSE_DEV_IOC_CLONE fuse: introduce FUSE_PASSTHROUGH capability fuse: implement ioctls to manage backing files fuse: prepare for opening file in passthrough mode fuse: implement open in passthrough mode fuse: implement read/write passthrough fuse: implement splice read/write passthrough fuse: implement passthrough for mmap fuse: fix wrong ff->iomode state changes from parallel dio write fuse: fix parallel dio write on file open in passthrough mode fuse: verify zero padding in fuse_backing_map fuse: respect FOPEN_KEEP_CACHE on opendir ovl: fix dentry reference leak after changes to underlying layers ovl: relax WARN_ON in ovl_verify_area() remap_range: merge do_clone_file_range() into vfs_clone_file_range() fs: pass offset and result to backing_file end_write() callback fuse: update inode size after extending passthrough write Bernd Schubert (3): fuse: create helper function if DIO write needs exclusive lock fuse: add fuse_dio_lock/unlock helper functions fuse: disable the combination of passthrough and writeback cache Ed Tsai (1): backing-file: convert to using fops->splice_write Vegard Nossum (1): fs: fix __sb_write_started() kerneldoc formatting yangyun (1): fuse: use exclusive lock when FUSE_I_CACHE_IO_MODE is set fs/fuse/fuse_i.h | 151 +++++++++++-- fs/internal.h | 21 +- fs/overlayfs/overlayfs.h | 38 +++- include/linux/backing-file.h | 42 ++++ include/linux/fs.h | 89 ++++++-- include/linux/fsnotify.h | 3 +- include/linux/mount.h | 4 +- include/uapi/linux/fuse.h | 23 +- arch/arc/kernel/troubleshoot.c | 6 +- drivers/block/loop.c | 2 - drivers/target/target_core_file.c | 10 +- fs/backing-file.c | 339 ++++++++++++++++++++++++++++ fs/btrfs/ioctl.c | 12 +- fs/cachefiles/io.c | 5 +- fs/coda/file.c | 2 - fs/file_table.c | 12 +- fs/fuse/dev.c | 98 +++++--- fs/fuse/dir.c | 49 +++- fs/fuse/file.c | 362 ++++++++++++++++++++---------- fs/fuse/inode.c | 37 +++ fs/fuse/iomode.c | 276 +++++++++++++++++++++++ fs/fuse/passthrough.c | 355 +++++++++++++++++++++++++++++ fs/inode.c | 8 +- fs/namespace.c | 36 +-- fs/nfsd/vfs.c | 7 +- fs/open.c | 70 +++--- fs/overlayfs/copy_up.c | 168 +++++++++----- fs/overlayfs/dir.c | 60 +++-- fs/overlayfs/export.c | 7 +- fs/overlayfs/file.c | 230 ++++--------------- fs/overlayfs/inode.c | 57 +++-- fs/overlayfs/namei.c | 37 ++- fs/overlayfs/super.c | 47 ++-- fs/overlayfs/util.c | 75 ++++++- fs/proc/base.c | 2 +- fs/proc/nommu.c | 2 +- fs/proc/task_mmu.c | 4 +- fs/proc/task_nommu.c | 2 +- fs/read_write.c | 156 ++++++++----- fs/remap_range.c | 44 ++-- fs/splice.c | 82 ++++--- fs/super.c | 1 + kernel/acct.c | 4 +- kernel/trace/trace_output.c | 2 +- MAINTAINERS | 9 + fs/Kconfig | 4 + fs/Makefile | 1 + fs/fuse/Kconfig | 11 + fs/fuse/Makefile | 2 + fs/overlayfs/Kconfig | 1 + 50 files changed, 2290 insertions(+), 775 deletions(-) create mode 100644 include/linux/backing-file.h create mode 100644 fs/backing-file.c create mode 100644 fs/fuse/iomode.c create mode 100644 fs/fuse/passthrough.c -- 2.39.2

2 64

[openeuler:openEuler-1.0-LTS 1614/1614] include/trace/trace_events.h:26:23: warning: 'str__fs__trace_system_name' defined but not used
by kernel test robot 07 May '25

07 May '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: ac2dbcb2630a54db6d68c792a6cfff34c6bd5232 commit: a4f256bae217c9679528b4957b6dc68e52cd4782 [1614/1614] vfs: add bare tracepoints for vfs read and release config: arm64-randconfig-001-20250506 (https://download.01.org/0day-ci/archive/20250507/202505070314.0zdCBK7T-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250507/202505070314.0zdCBK7T-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202505070314.0zdCBK7T-lkp@intel.com/ All warnings (new ones prefixed by >>): fs/read_write.c:483:9: warning: no previous prototype for '__vfs_write' [-Wmissing-prototypes] 483 | ssize_t __vfs_write(struct file *file, const char __user *p, size_t count, | ^~~~~~~~~~~ In file included from include/trace/define_trace.h:96, from include/trace/events/fs.h:33, from fs/read_write.c:28: >> include/trace/trace_events.h:26:23: warning: 'str__fs__trace_system_name' defined but not used [-Wunused-const-variable=] 26 | #define __app__(x, y) str__##x##y | ^~~~~ include/trace/trace_events.h:27:21: note: in expansion of macro '__app__' 27 | #define __app(x, y) __app__(x, y) | ^~~~~~~ include/trace/trace_events.h:29:29: note: in expansion of macro '__app' 29 | #define TRACE_SYSTEM_STRING __app(TRACE_SYSTEM_VAR,__trace_system_name) | ^~~~~ include/trace/trace_events.h:32:27: note: in expansion of macro 'TRACE_SYSTEM_STRING' 32 | static const char TRACE_SYSTEM_STRING[] = \ | ^~~~~~~~~~~~~~~~~~~ include/trace/trace_events.h:35:1: note: in expansion of macro 'TRACE_MAKE_SYSTEM_STR' 35 | TRACE_MAKE_SYSTEM_STR(); | ^~~~~~~~~~~~~~~~~~~~~ fs/read_write.c:90: warning: Function parameter or member 'maxsize' not described in 'generic_file_llseek_size' fs/read_write.c:90: warning: Excess function parameter 'size' description in 'generic_file_llseek_size' vim +/str__fs__trace_system_name +26 include/trace/trace_events.h acd388fd3af350 include/trace/ftrace.h Steven Rostedt (Red Hat 2015-03-31 25) acd388fd3af350 include/trace/ftrace.h Steven Rostedt (Red Hat 2015-03-31 @26) #define __app__(x, y) str__##x##y acd388fd3af350 include/trace/ftrace.h Steven Rostedt (Red Hat 2015-03-31 27) #define __app(x, y) __app__(x, y) acd388fd3af350 include/trace/ftrace.h Steven Rostedt (Red Hat 2015-03-31 28) :::::: The code at line 26 was first introduced by commit :::::: acd388fd3af350ab24c6ab6f19b83fc4a4f3aa60 tracing: Give system name a pointer :::::: TO: Steven Rostedt (Red Hat) <rostedt(a)goodmis.org> :::::: CC: Steven Rostedt <rostedt(a)goodmis.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2200/2200] drivers/vhost/vdpa.c:589:23: error: implicit declaration of function 'iommufd_ctx_from_fd'; did you mean 'iommufd_ctx_from_file'?
by kernel test robot 07 May '25

07 May '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 9af1041f05d76435457d805d2d60c2aea1dc71f2 commit: 6a58b8be556fb7de52ae0272a994a1c73fffc903 [2200/2200] vhost/vdpa: Add support to bind and attach iommufd config: x86_64-buildonly-randconfig-006-20250506 (https://download.01.org/0day-ci/archive/20250507/202505070025.y1C68ZCV-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250507/202505070025.y1C68ZCV-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202505070025.y1C68ZCV-lkp@intel.com/ All error/warnings (new ones prefixed by >>): drivers/vhost/vdpa.c: In function 'vhost_vdpa_bind_iommufd': >> drivers/vhost/vdpa.c:589:23: error: implicit declaration of function 'iommufd_ctx_from_fd'; did you mean 'iommufd_ctx_from_file'? [-Werror=implicit-function-declaration] 589 | iommufd_ctx = iommufd_ctx_from_fd(bind.iommufd); | ^~~~~~~~~~~~~~~~~~~ | iommufd_ctx_from_file >> drivers/vhost/vdpa.c:589:21: warning: assignment to 'struct iommufd_ctx *' from 'int' makes pointer from integer without a cast [-Wint-conversion] 589 | iommufd_ctx = iommufd_ctx_from_fd(bind.iommufd); | ^ cc1: some warnings being treated as errors Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PTP_1588_CLOCK Depends on [n]: NET [=y] && POSIX_TIMERS [=n] Selected by [y]: - SXE [=y] && NETDEVICES [=y] && ETHERNET [=y] && NET_VENDOR_LINKDATA [=y] && (X86 [=y] || ARM64) && PCI [=y] - SXE_VF [=y] && NETDEVICES [=y] && ETHERNET [=y] && NET_VENDOR_LINKDATA [=y] && (X86 [=y] || ARM64) && PCI [=y] vim +589 drivers/vhost/vdpa.c 576 577 static long vhost_vdpa_bind_iommufd(struct vhost_vdpa *v, int __user *argp) 578 { 579 struct vhost_vdpa_bind_iommufd bind; 580 struct iommufd_ctx *iommufd_ctx; 581 struct iommufd_device *idev; 582 struct device *dma_dev = vdpa_get_dma_dev(v->vdpa); 583 struct iommu_group *iommu_group = iommu_group_get(dma_dev); 584 int ret = 0; 585 586 if (copy_from_user(&bind, argp, sizeof(bind))) 587 return -EFAULT; 588 > 589 iommufd_ctx = iommufd_ctx_from_fd(bind.iommufd); 590 if (IS_ERR(iommufd_ctx)) 591 return PTR_ERR(iommufd_ctx); 592 593 if (v->domain) { 594 iommu_detach_device(v->domain, dma_dev); 595 iommu_domain_free(v->domain); 596 v->domain = NULL; 597 } 598 599 /** 600 * Default iommu domain is created when vdpa device driver probes. 601 * Unuse default domain first to avoid failure when claiming dma owner. 602 */ 603 if (dma_dev->bus && dma_dev->bus->dma_cleanup) 604 dma_dev->bus->dma_cleanup(dma_dev); 605 ret = iommu_group_claim_dma_owner(iommu_group, iommufd_ctx); 606 if (ret) 607 goto dma_configure; 608 609 idev = iommufd_device_bind(iommufd_ctx, dma_dev, &bind.out_devid); 610 if (IS_ERR(idev)) { 611 ret = PTR_ERR(idev); 612 goto release_owner; 613 } 614 v->iommufd_dev = idev; 615 616 if (copy_to_user(argp, &bind, sizeof(bind))) { 617 ret = -EFAULT; 618 goto unbind; 619 } 620 621 goto out; 622 623 unbind: 624 iommufd_device_unbind(v->iommufd_dev); 625 v->iommufd_dev = NULL; 626 release_owner: 627 iommu_group_release_dma_owner(iommu_group); 628 dma_configure: 629 if (dma_dev->bus && dma_dev->bus->dma_configure) 630 dma_dev->bus->dma_configure(dma_dev); 631 out: 632 iommufd_ctx_put(iommufd_ctx); 633 return ret; 634 } 635 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2888/2888] include/linux/minmax.h:20:35: warning: comparison of distinct pointer types lacks a cast
by kernel test robot 06 May '25

06 May '25

Hi SeongJae, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: f5912cbd669a2722f81f0f054fb8aec1525da8ee commit: 83b931be40b2829e20f38356509d8706ea6b6238 [2888/2888] mm/damon/core-test: test damon_set_regions config: x86_64-buildonly-randconfig-006-20250506 (https://download.01.org/0day-ci/archive/20250506/202505062356.u2rMcCQF-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250506/202505062356.u2rMcCQF-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202505062356.u2rMcCQF-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from include/linux/kernel.h:14, from arch/x86/include/asm/percpu.h:27, from arch/x86/include/asm/current.h:6, from include/linux/mutex.h:14, from include/linux/damon.h:11, from mm/damon/core.c:10: mm/damon/core-test.h: In function 'damon_test_set_regions': >> include/linux/minmax.h:20:35: warning: comparison of distinct pointer types lacks a cast 20 | (!!(sizeof((typeof(x) *)1 == (typeof(y) *)1))) | ^~ include/kunit/test.h:748:16: note: in expansion of macro '__typecheck' 748 | ((void)__typecheck(__left, __right)); \ | ^~~~~~~~~~~ include/kunit/test.h:772:9: note: in expansion of macro 'KUNIT_BASE_BINARY_ASSERTION' 772 | KUNIT_BASE_BINARY_ASSERTION(test, \ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ include/kunit/test.h:861:9: note: in expansion of macro 'KUNIT_BASE_EQ_MSG_ASSERTION' 861 | KUNIT_BASE_EQ_MSG_ASSERTION(test, \ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ include/kunit/test.h:871:9: note: in expansion of macro 'KUNIT_BINARY_EQ_MSG_ASSERTION' 871 | KUNIT_BINARY_EQ_MSG_ASSERTION(test, \ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/kunit/test.h:1234:9: note: in expansion of macro 'KUNIT_BINARY_EQ_ASSERTION' 1234 | KUNIT_BINARY_EQ_ASSERTION(test, KUNIT_EXPECTATION, left, right) | ^~~~~~~~~~~~~~~~~~~~~~~~~ mm/damon/core-test.h:284:9: note: in expansion of macro 'KUNIT_EXPECT_EQ' 284 | KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 3); | ^~~~~~~~~~~~~~~ vim +20 include/linux/minmax.h cffb222bc2e032 Rikard Falkeborn 2021-06-07 6 b296a6d53339a7 Andy Shevchenko 2020-10-15 7 /* b296a6d53339a7 Andy Shevchenko 2020-10-15 8 * min()/max()/clamp() macros must accomplish three things: b296a6d53339a7 Andy Shevchenko 2020-10-15 9 * b296a6d53339a7 Andy Shevchenko 2020-10-15 10 * - avoid multiple evaluations of the arguments (so side-effects like b296a6d53339a7 Andy Shevchenko 2020-10-15 11 * "x++" happen only once) when non-constant. b296a6d53339a7 Andy Shevchenko 2020-10-15 12 * - perform strict type-checking (to generate warnings instead of b296a6d53339a7 Andy Shevchenko 2020-10-15 13 * nasty runtime surprises). See the "unnecessary" pointer comparison b296a6d53339a7 Andy Shevchenko 2020-10-15 14 * in __typecheck(). b296a6d53339a7 Andy Shevchenko 2020-10-15 15 * - retain result as a constant expressions when called with only b296a6d53339a7 Andy Shevchenko 2020-10-15 16 * constant expressions (to avoid tripping VLA warnings in stack b296a6d53339a7 Andy Shevchenko 2020-10-15 17 * allocation usage). b296a6d53339a7 Andy Shevchenko 2020-10-15 18 */ b296a6d53339a7 Andy Shevchenko 2020-10-15 19 #define __typecheck(x, y) \ b296a6d53339a7 Andy Shevchenko 2020-10-15 @20 (!!(sizeof((typeof(x) *)1 == (typeof(y) *)1))) b296a6d53339a7 Andy Shevchenko 2020-10-15 21 :::::: The code at line 20 was first introduced by commit :::::: b296a6d53339a79082c1d2c1761e948e8b3def69 kernel.h: split out min()/max() et al. helpers :::::: TO: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> :::::: CC: Linus Torvalds <torvalds(a)linux-foundation.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] driver: base: fix UAF when driver_attach failed
by Yin Tirui 06 May '25

06 May '25

From: Schspa Shi <schspa(a)gmail.com> mainline inclusion from mainline-v5.19-rc1 commit 310862e574001a97ad02272bac0fd13f75f42a27 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP35K CVE: CVE-2022-49385 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- When driver_attach(drv); failed, the driver_private will be freed. But it has been added to the bus, which caused a UAF. To fix it, we need to delete it from the bus when failed. Fixes: 190888ac01d0 ("driver core: fix possible missing of device probe") Signed-off-by: Schspa Shi <schspa(a)gmail.com> Link: https://lore.kernel.org/r/20220513112444.45112-1-schspa@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/base/bus.c [Fixing conflicts] Signed-off-by: Tirui Yin <yintirui(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> --- drivers/base/bus.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/base/bus.c b/drivers/base/bus.c index 5f1966081c42..f45506c56c33 100644 --- a/drivers/base/bus.c +++ b/drivers/base/bus.c @@ -661,7 +661,7 @@ int bus_add_driver(struct device_driver *drv) } else { error = driver_attach(drv); if (error) - goto out_unregister; + goto out_del_list; } } module_add_driver(drv->owner, drv); @@ -689,6 +689,8 @@ int bus_add_driver(struct device_driver *drv) return 0; +out_del_list: + klist_del(&priv->knode_bus); out_unregister: kobject_put(&priv->kobj); /* drv->p is freed in driver_release() */ -- 2.22.0

2 1

[PATCH openEuler-1.0-LTS] [Backport] scsi: pm8001: Fix abort all task initialization
by Lin Ruifeng 06 May '25

06 May '25

From: Damien Le Moal <damien.lemoal(a)opensource.wdc.com> stable inclusion from stable-v4.19.238 commit 1824a21b2cedc5774a5adfa74f5f7b90472d8677 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP73H CVE: CVE-2022-49217 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 7f12845c8389855dbcc67baa068b6832dc4a396e ] In pm80xx_send_abort_all(), the n_elem field of the ccb used is not initialized to 0. This missing initialization sometimes lead to the task completion path seeing the ccb with a non-zero n_elem resulting in the execution of invalid dma_unmap_sg() calls in pm8001_ccb_task_free(), causing a crash such as: [ 197.676341] RIP: 0010:iommu_dma_unmap_sg+0x6d/0x280 [ 197.700204] RSP: 0018:ffff889bbcf89c88 EFLAGS: 00010012 [ 197.705485] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff83d0bda0 [ 197.712687] RDX: 0000000000000002 RSI: 0000000000000000 RDI: ffff88810dffc0d0 [ 197.719887] RBP: 0000000000000000 R08: 0000000000000000 R09: ffff8881c790098b [ 197.727089] R10: ffffed1038f20131 R11: 0000000000000001 R12: 0000000000000000 [ 197.734296] R13: ffff88810dffc0d0 R14: 0000000000000010 R15: 0000000000000000 [ 197.741493] FS: 0000000000000000(0000) GS:ffff889bbcf80000(0000) knlGS:0000000000000000 [ 197.749659] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 197.755459] CR2: 00007f16c1b42734 CR3: 0000000004814000 CR4: 0000000000350ee0 [ 197.762656] Call Trace: [ 197.765127] <IRQ> [ 197.767162] pm8001_ccb_task_free+0x5f1/0x820 [pm80xx] [ 197.772364] ? do_raw_spin_unlock+0x54/0x220 [ 197.776680] pm8001_mpi_task_abort_resp+0x2ce/0x4f0 [pm80xx] [ 197.782406] process_oq+0xe85/0x7890 [pm80xx] [ 197.786817] ? lock_acquire+0x194/0x490 [ 197.790697] ? handle_irq_event+0x10e/0x1b0 [ 197.794920] ? mpi_sata_completion+0x2d70/0x2d70 [pm80xx] [ 197.800378] ? __wake_up_bit+0x100/0x100 [ 197.804340] ? lock_is_held_type+0x98/0x110 [ 197.808565] pm80xx_chip_isr+0x94/0x130 [pm80xx] [ 197.813243] tasklet_action_common.constprop.0+0x24b/0x2f0 [ 197.818785] __do_softirq+0x1b5/0x82d [ 197.822485] ? do_raw_spin_unlock+0x54/0x220 [ 197.826799] __irq_exit_rcu+0x17e/0x1e0 [ 197.830678] irq_exit_rcu+0xa/0x20 [ 197.834114] common_interrupt+0x78/0x90 [ 197.840051] </IRQ> [ 197.844236] <TASK> [ 197.848397] asm_common_interrupt+0x1e/0x40 Avoid this issue by always initializing the ccb n_elem field to 0 in pm8001_send_abort_all(), pm8001_send_read_log() and pm80xx_send_abort_all(). Link: https://lore.kernel.org/r/20220220031810.738362-17-damien.lemoal@opensource… Fixes: c6b9ef5779c3 ("[SCSI] pm80xx: NCQ error handling changes") Reviewed-by: Jack Wang <jinpu.wang(a)ionos.com> Signed-off-by: Damien Le Moal <damien.lemoal(a)opensource.wdc.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/scsi/pm8001/pm8001_hwi.c | 2 ++ drivers/scsi/pm8001/pm80xx_hwi.c | 1 + 2 files changed, 3 insertions(+) diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c index 3e814c0469fb..0c943189b3ba 100644 --- a/drivers/scsi/pm8001/pm8001_hwi.c +++ b/drivers/scsi/pm8001/pm8001_hwi.c @@ -1748,6 +1748,7 @@ static void pm8001_send_abort_all(struct pm8001_hba_info *pm8001_ha, ccb->device = pm8001_ha_dev; ccb->ccb_tag = ccb_tag; ccb->task = task; + ccb->n_elem = 0; circularQ = &pm8001_ha->inbnd_q_tbl[0]; @@ -1810,6 +1811,7 @@ static void pm8001_send_read_log(struct pm8001_hba_info *pm8001_ha, ccb->device = pm8001_ha_dev; ccb->ccb_tag = ccb_tag; ccb->task = task; + ccb->n_elem = 0; pm8001_ha_dev->id |= NCQ_READ_LOG_FLAG; pm8001_ha_dev->id |= NCQ_2ND_RLE_FLAG; diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c index 327992fbb553..1bc13452276d 100644 --- a/drivers/scsi/pm8001/pm80xx_hwi.c +++ b/drivers/scsi/pm8001/pm80xx_hwi.c @@ -1435,6 +1435,7 @@ static void pm80xx_send_abort_all(struct pm8001_hba_info *pm8001_ha, ccb->device = pm8001_ha_dev; ccb->ccb_tag = ccb_tag; ccb->task = task; + ccb->n_elem = 0; circularQ = &pm8001_ha->inbnd_q_tbl[0]; -- 2.22.0

2 1

[PATCH openEuler-1.0-LTS] [Backport] video: fbdev: cirrusfb: check pixclock to avoid divide by zero
by Lin Ruifeng 06 May '25

06 May '25

From: George Kennedy <george.kennedy(a)oracle.com> stable inclusion from stable-v4.19.238 commit 40b13e3d85744210db13457785646634e2d056bd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6SB CVE: CVE-2021-47641 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5c6f402bdcf9e7239c6bc7087eda71ac99b31379 ] Do a sanity check on pixclock value to avoid divide by zero. If the pixclock value is zero, the cirrusfb driver will round up pixclock to get the derived frequency as close to maxclock as possible. Syzkaller reported a divide error in cirrusfb_check_pixclock. divide error: 0000 [#1] SMP KASAN PTI CPU: 0 PID: 14938 Comm: cirrusfb_test Not tainted 5.15.0-rc6 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2 RIP: 0010:cirrusfb_check_var+0x6f1/0x1260 Call Trace: fb_set_var+0x398/0xf90 do_fb_ioctl+0x4b8/0x6f0 fb_ioctl+0xeb/0x130 __x64_sys_ioctl+0x19d/0x220 do_syscall_64+0x3a/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae Signed-off-by: George Kennedy <george.kennedy(a)oracle.com> Reviewed-by: Geert Uytterhoeven <geert(a)linux-m68k.org> Signed-off-by: Helge Deller <deller(a)gmx.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/video/fbdev/cirrusfb.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/drivers/video/fbdev/cirrusfb.c b/drivers/video/fbdev/cirrusfb.c index b3be06dd2908..72358d187023 100644 --- a/drivers/video/fbdev/cirrusfb.c +++ b/drivers/video/fbdev/cirrusfb.c @@ -470,7 +470,7 @@ static int cirrusfb_check_mclk(struct fb_info *info, long freq) return 0; } -static int cirrusfb_check_pixclock(const struct fb_var_screeninfo *var, +static int cirrusfb_check_pixclock(struct fb_var_screeninfo *var, struct fb_info *info) { long freq; @@ -479,9 +479,7 @@ static int cirrusfb_check_pixclock(const struct fb_var_screeninfo *var, unsigned maxclockidx = var->bits_per_pixel >> 3; /* convert from ps to kHz */ - freq = PICOS2KHZ(var->pixclock); - - dev_dbg(info->device, "desired pixclock: %ld kHz\n", freq); + freq = PICOS2KHZ(var->pixclock ? : 1); maxclock = cirrusfb_board_info[cinfo->btype].maxclock[maxclockidx]; cinfo->multiplexing = 0; @@ -489,11 +487,13 @@ static int cirrusfb_check_pixclock(const struct fb_var_screeninfo *var, /* If the frequency is greater than we can support, we might be able * to use multiplexing for the video mode */ if (freq > maxclock) { - dev_err(info->device, - "Frequency greater than maxclock (%ld kHz)\n", - maxclock); - return -EINVAL; + var->pixclock = KHZ2PICOS(maxclock); + + while ((freq = PICOS2KHZ(var->pixclock)) > maxclock) + var->pixclock++; } + dev_dbg(info->device, "desired pixclock: %ld kHz\n", freq); + /* * Additional constraint: 8bpp uses DAC clock doubling to allow maximum * pixel clock -- 2.22.0

2 1

[PATCH openEuler-1.0-LTS] can: peak_usb: fix use after free bugs
by Zhang Changzhong 06 May '25

06 May '25

From: Vincent Mailhol <mailhol.vincent(a)wanadoo.fr> stable inclusion from stable-v4.19.171 commit 5408824636fa0dfedb9ecb0d94abd573131bfbbe category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC21UY CVE: CVE-2021-47670 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 50aca891d7a554db0901b245167cd653d73aaa71 ] After calling peak_usb_netif_rx_ni(skb), dereferencing skb is unsafe. Especially, the can_frame cf which aliases skb memory is accessed after the peak_usb_netif_rx_ni(). Reordering the lines solves the issue. Fixes: 0a25e1f4f185 ("can: peak_usb: add support for PEAK new CANFD USB adapters") Link: https://lore.kernel.org/r/20210120114137.200019-4-mailhol.vincent@wanadoo.fr Signed-off-by: Vincent Mailhol <mailhol.vincent(a)wanadoo.fr> Signed-off-by: Marc Kleine-Budde <mkl(a)pengutronix.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c index 4198835..87574ce 100644 --- a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c +++ b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c @@ -514,11 +514,11 @@ static int pcan_usb_fd_decode_canmsg(struct pcan_usb_fd_if *usb_if, else memcpy(cfd->data, rm->d, cfd->len); - peak_usb_netif_rx(skb, &usb_if->time_ref, le32_to_cpu(rm->ts_low)); - netdev->stats.rx_packets++; netdev->stats.rx_bytes += cfd->len; + peak_usb_netif_rx(skb, &usb_if->time_ref, le32_to_cpu(rm->ts_low)); + return 0; } @@ -574,11 +574,11 @@ static int pcan_usb_fd_decode_status(struct pcan_usb_fd_if *usb_if, if (!skb) return -ENOMEM; - peak_usb_netif_rx(skb, &usb_if->time_ref, le32_to_cpu(sm->ts_low)); - netdev->stats.rx_packets++; netdev->stats.rx_bytes += cf->can_dlc; + peak_usb_netif_rx(skb, &usb_if->time_ref, le32_to_cpu(sm->ts_low)); + return 0; } -- 2.9.5

2 1

[PATCH] driver: base: fix UAF when driver_attach failed
by Yin Tirui 06 May '25

06 May '25

From: Schspa Shi <schspa(a)gmail.com> mainline inclusion from mainline-v5.19-rc1 commit 310862e574001a97ad02272bac0fd13f75f42a27 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP35K CVE: CVE-2022-49385 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- When driver_attach(drv); failed, the driver_private will be freed. But it has been added to the bus, which caused a UAF. To fix it, we need to delete it from the bus when failed. Fixes: 190888ac01d0 ("driver core: fix possible missing of device probe") Signed-off-by: Schspa Shi <schspa(a)gmail.com> Link: https://lore.kernel.org/r/20220513112444.45112-1-schspa@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yin Tirui <yintirui(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> --- drivers/base/bus.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/base/bus.c b/drivers/base/bus.c index 5f1966081c42..f45506c56c33 100644 --- a/drivers/base/bus.c +++ b/drivers/base/bus.c @@ -661,7 +661,7 @@ int bus_add_driver(struct device_driver *drv) } else { error = driver_attach(drv); if (error) - goto out_unregister; + goto out_del_list; } } module_add_driver(drv->owner, drv); @@ -689,6 +689,8 @@ int bus_add_driver(struct device_driver *drv) return 0; +out_del_list: + klist_del(&priv->knode_bus); out_unregister: kobject_put(&priv->kobj); /* drv->p is freed in driver_release() */ -- 2.22.0

1 0

[PATCH OLK-5.10 v2] ipv6: mcast: extend RCU protection in igmp6_send()
by Dong Chenchen 06 May '25

06 May '25

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.14-rc3 commit 087c1faa594fa07a66933d750c0b2610aa1a2946 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC5R CVE: CVE-2025-21759 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- igmp6_send() can be called without RTNL or RCU being held. Extend RCU protection so that we can safely fetch the net pointer and avoid a potential UAF. Note that we no longer can use sock_alloc_send_skb() because ipv6.igmp_sk uses GFP_KERNEL allocations which can sleep. Instead use alloc_skb() and charge the net->ipv6.igmp_sk socket under RCU protection. Fixes: b8ad0cbc58f7 ("[NETNS][IPV6] mcast - handle several network namespace") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Link: https://patch.msgid.link/20250207135841.1948589-9-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv6/mcast.c [commit b4a11b2033b7 separates OUTREQUESTS stastic from MIB_OUT, which not merged lead to context conflicts. commit 2e7ef287f07c convert from timer to delayed work. Because this patch was not merged, we use GFP_ATOMIC flag] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ipv6/mcast.c | 33 +++++++++++++++------------------ 1 file changed, 15 insertions(+), 18 deletions(-) diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c index 9fb5077f8e9a..e0d5125de202 100644 --- a/net/ipv6/mcast.c +++ b/net/ipv6/mcast.c @@ -1974,21 +1974,21 @@ static void mld_send_cr(struct inet6_dev *idev) static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type) { - struct net *net = dev_net(dev); - struct sock *sk = net->ipv6.igmp_sk; + const struct in6_addr *snd_addr, *saddr; + int err, len, payload_len, full_len; + struct in6_addr addr_buf; struct inet6_dev *idev; struct sk_buff *skb; struct mld_msg *hdr; - const struct in6_addr *snd_addr, *saddr; - struct in6_addr addr_buf; int hlen = LL_RESERVED_SPACE(dev); int tlen = dev->needed_tailroom; - int err, len, payload_len, full_len; u8 ra[8] = { IPPROTO_ICMPV6, 0, IPV6_TLV_ROUTERALERT, 2, 0, 0, IPV6_TLV_PADN, 0 }; - struct flowi6 fl6; struct dst_entry *dst; + struct flowi6 fl6; + struct net *net; + struct sock *sk; if (type == ICMPV6_MGM_REDUCTION) snd_addr = &in6addr_linklocal_allrouters; @@ -1999,20 +1999,20 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type) payload_len = len + sizeof(ra); full_len = sizeof(struct ipv6hdr) + payload_len; - rcu_read_lock(); - IP6_UPD_PO_STATS(net, __in6_dev_get(dev), - IPSTATS_MIB_OUT, full_len); - rcu_read_unlock(); - - skb = sock_alloc_send_skb(sk, hlen + tlen + full_len, 1, &err); + skb = alloc_skb(hlen + tlen + full_len, GFP_ATOMIC); + rcu_read_lock(); + net = dev_net_rcu(dev); + idev = __in6_dev_get(dev); + IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, full_len); if (!skb) { - rcu_read_lock(); - IP6_INC_STATS(net, __in6_dev_get(dev), - IPSTATS_MIB_OUTDISCARDS); + IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS); rcu_read_unlock(); return; } + sk = net->ipv6.igmp_sk; + skb_set_owner_w(skb, sk); + skb->priority = TC_PRIO_CONTROL; skb_reserve(skb, hlen); @@ -2037,9 +2037,6 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type) IPPROTO_ICMPV6, csum_partial(hdr, len, 0)); - rcu_read_lock(); - idev = __in6_dev_get(skb->dev); - icmpv6_flow_init(sk, &fl6, type, &ipv6_hdr(skb)->saddr, &ipv6_hdr(skb)->daddr, skb->dev->ifindex); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS v2] ipv6: mcast: extend RCU protection in igmp6_send()
by Dong Chenchen 06 May '25

06 May '25

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.14-rc3 commit 087c1faa594fa07a66933d750c0b2610aa1a2946 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC5R CVE: CVE-2025-21759 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- igmp6_send() can be called without RTNL or RCU being held. Extend RCU protection so that we can safely fetch the net pointer and avoid a potential UAF. Note that we no longer can use sock_alloc_send_skb() because ipv6.igmp_sk uses GFP_KERNEL allocations which can sleep. Instead use alloc_skb() and charge the net->ipv6.igmp_sk socket under RCU protection. Fixes: b8ad0cbc58f7 ("[NETNS][IPV6] mcast - handle several network namespace") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Link: https://patch.msgid.link/20250207135841.1948589-9-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv6/mcast.c [commit b4a11b2033b7 separates OUTREQUESTS stastic from MIB_OUT, which not merged lead to context conflicts. commit 2e7ef287f07c convert from timer to delayed work. Because this patch was not merged, we use GFP_ATOMIC flag] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ipv6/mcast.c | 33 +++++++++++++++------------------ 1 file changed, 15 insertions(+), 18 deletions(-) diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c index 3d048401141f..bb484fe27e13 100644 --- a/net/ipv6/mcast.c +++ b/net/ipv6/mcast.c @@ -1979,21 +1979,21 @@ static void mld_send_cr(struct inet6_dev *idev) static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type) { - struct net *net = dev_net(dev); - struct sock *sk = net->ipv6.igmp_sk; + const struct in6_addr *snd_addr, *saddr; + int err, len, payload_len, full_len; + struct in6_addr addr_buf; struct inet6_dev *idev; struct sk_buff *skb; struct mld_msg *hdr; - const struct in6_addr *snd_addr, *saddr; - struct in6_addr addr_buf; int hlen = LL_RESERVED_SPACE(dev); int tlen = dev->needed_tailroom; - int err, len, payload_len, full_len; u8 ra[8] = { IPPROTO_ICMPV6, 0, IPV6_TLV_ROUTERALERT, 2, 0, 0, IPV6_TLV_PADN, 0 }; - struct flowi6 fl6; struct dst_entry *dst; + struct flowi6 fl6; + struct net *net; + struct sock *sk; if (type == ICMPV6_MGM_REDUCTION) snd_addr = &in6addr_linklocal_allrouters; @@ -2004,20 +2004,20 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type) payload_len = len + sizeof(ra); full_len = sizeof(struct ipv6hdr) + payload_len; - rcu_read_lock(); - IP6_UPD_PO_STATS(net, __in6_dev_get(dev), - IPSTATS_MIB_OUT, full_len); - rcu_read_unlock(); - - skb = sock_alloc_send_skb(sk, hlen + tlen + full_len, 1, &err); + skb = alloc_skb(hlen + tlen + full_len, GFP_ATOMIC); + rcu_read_lock(); + net = dev_net_rcu(dev); + idev = __in6_dev_get(dev); + IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, full_len); if (!skb) { - rcu_read_lock(); - IP6_INC_STATS(net, __in6_dev_get(dev), - IPSTATS_MIB_OUTDISCARDS); + IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS); rcu_read_unlock(); return; } + sk = net->ipv6.igmp_sk; + skb_set_owner_w(skb, sk); + skb->priority = TC_PRIO_CONTROL; skb_reserve(skb, hlen); @@ -2042,9 +2042,6 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type) IPPROTO_ICMPV6, csum_partial(hdr, len, 0)); - rcu_read_lock(); - idev = __in6_dev_get(skb->dev); - icmpv6_flow_init(sk, &fl6, type, &ipv6_hdr(skb)->saddr, &ipv6_hdr(skb)->daddr, skb->dev->ifindex); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/7] driver: base: fix UAF when driver_attach failed
by Yin Tirui 06 May '25

06 May '25

The following series contains seven patches that fix UAF when driver_attach failed: Alexander Duyck (3): driver core: Probe devices asynchronously instead of the driver async: Add support for queueing on specific NUMA node driver core: Attach devices on CPU local to device node Jason Gunthorpe (1): driver core: Pull required checks into driver_probe_device() Mark-PK Tsai (1): driver core: Prevent overriding async driver of a device before it probe Schspa Shi (1): driver: base: fix UAF when driver_attach failed Zhang Wensheng (1): driver core: fix potential deadlock in __driver_attach drivers/base/base.h | 2 ++ drivers/base/bus.c | 27 ++++---------- drivers/base/dd.c | 59 ++++++++++++++++++++++++------- include/linux/async.h | 82 +++++++++++++++++++++++++++++++++++++++++-- kernel/async.c | 53 +++++++++++++++------------- 5 files changed, 163 insertions(+), 60 deletions(-) -- 2.22.0

2 8

[PATCH openEuler-1.0-LTS 0/3] CVE-2022-49755
by Guo Mengqi 06 May '25

06 May '25

CVE-2022-49755 Udipto Goswami (2): usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait usb: gadget: f_fs: Fix unbalanced spinlock in __ffs_ep0_queue_wait Uttkarsh Aggarwal (1): usb: gadget: f_fs: Add unbind event before functionfs_unbind drivers/usb/gadget/function/f_fs.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) -- 2.22.0

2 4

[PATCH OLK-6.6] Revert "tmpfs: fault in smaller chunks if large folio allocation not allowed"
by Tong Tiangen 06 May '25

06 May '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IC5K6D -------------------------------- This reverts commit 7944c724e4b6bbc86dc7b8ce1f370584fc01fc1e. Use the upstream community solution to fix the problem: ede039b6e20f ("tmpfs: don't enable large folios if not supported") Fixes: ede039b6e20f ("tmpfs: don't enable large folios if not supported") Fixes: 7944c724e4b6 ("tmpfs: fault in smaller chunks if large folio allocation not allowed") Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> --- include/linux/fs.h | 2 -- mm/filemap.c | 7 +------ mm/shmem.c | 5 ----- 3 files changed, 1 insertion(+), 13 deletions(-) diff --git a/include/linux/fs.h b/include/linux/fs.h index 493c13cf7cd6..5e7aeb5ff463 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -373,8 +373,6 @@ enum rw_hint { #define IOCB_DIO_CALLER_COMP (1 << 22) /* kiocb is a read or write operation submitted by fs/aio.c. */ #define IOCB_AIO_RW (1 << 23) -/* fault int small chunks(PAGE_SIZE) from userspace */ -#define IOCB_NO_LARGE_CHUNK (1 << 24) /* for use in trace events */ #define TRACE_IOCB_STRINGS \ diff --git a/mm/filemap.c b/mm/filemap.c index 63b8ef7f31b1..905ebca8670e 100644 --- a/mm/filemap.c +++ b/mm/filemap.c @@ -4050,14 +4050,9 @@ ssize_t generic_perform_write(struct kiocb *iocb, struct iov_iter *i) loff_t pos = iocb->ki_pos; struct address_space *mapping = file->f_mapping; const struct address_space_operations *a_ops = mapping->a_ops; + size_t chunk = mapping_max_folio_size(mapping); long status = 0; ssize_t written = 0; - size_t chunk; - - if (iocb->ki_flags & IOCB_NO_LARGE_CHUNK) - chunk = PAGE_SIZE; - else - chunk = mapping_max_folio_size(mapping); do { struct page *page; diff --git a/mm/shmem.c b/mm/shmem.c index 6fdc7144ca91..aa50cd285ee9 100644 --- a/mm/shmem.c +++ b/mm/shmem.c @@ -3269,7 +3269,6 @@ static ssize_t shmem_file_write_iter(struct kiocb *iocb, struct iov_iter *from) { struct file *file = iocb->ki_filp; struct inode *inode = file->f_mapping->host; - pgoff_t index = iocb->ki_pos >> PAGE_SHIFT; ssize_t ret; inode_lock(inode); @@ -3282,10 +3281,6 @@ static ssize_t shmem_file_write_iter(struct kiocb *iocb, struct iov_iter *from) ret = file_update_time(file); if (ret) goto unlock; - - if (!shmem_allowable_huge_orders(inode, NULL, index, 0, false)) - iocb->ki_flags |= IOCB_NO_LARGE_CHUNK; - ret = generic_perform_write(iocb, from); unlock: inode_unlock(inode); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/1] CVE-2023-53023
by Yongqiang Liu 06 May '25

06 May '25

Jisoo Jang (1): net: nfc: Fix use-after-free in local_cleanup() net/nfc/llcp_core.c | 1 + 1 file changed, 1 insertion(+) -- 2.34.1

2 2

[PATCH OLK-6.6] fs/resctrl: Add prefetch option
by Zeng Heng 06 May '25

06 May '25

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IC30P1 -------------------------------- Add cpu prefetch option under the resctrl fs. Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/arm64/include/asm/mpam.h | 15 +++++ arch/arm64/include/asm/thread_info.h | 4 ++ fs/resctrl/internal.h | 1 + fs/resctrl/rdtgroup.c | 84 ++++++++++++++++++++++++++++ 4 files changed, 104 insertions(+) diff --git a/arch/arm64/include/asm/mpam.h b/arch/arm64/include/asm/mpam.h index 9abe1fe58c34..ac7b6250250c 100644 --- a/arch/arm64/include/asm/mpam.h +++ b/arch/arm64/include/asm/mpam.h @@ -143,16 +143,31 @@ static inline void resctrl_arch_set_rmid(struct task_struct *tsk, u32 rmid) #endif } +#define setbit(x, y) (x |= (1<<y)) +#define clrbit(x, y) (x &= ~(1<<y)) + static inline void mpam_thread_switch(struct task_struct *tsk) { u64 oldregval; int cpu = smp_processor_id(); u64 regval = mpam_get_regval(tsk); + u64 val, val1; if (!IS_ENABLED(CONFIG_ARM64_MPAM) || !static_branch_likely(&mpam_enabled)) return; + asm volatile("mrs %0, S3_1_c15_c6_4" : "=r" (val)); + val1 = val; + + if (task_thread_info(tsk)->prefetch_dis) + setbit(val1, 0); + else + clrbit(val1, 0); + + if (val1 != val) + asm volatile("msr S3_1_c15_c6_4, %0" : : "r"(val1)); + if (regval == READ_ONCE(mpam_resctrl_default_group)) regval = READ_ONCE(per_cpu(arm64_mpam_default, cpu)); diff --git a/arch/arm64/include/asm/thread_info.h b/arch/arm64/include/asm/thread_info.h index 379d24059f5b..a996caebb08e 100644 --- a/arch/arm64/include/asm/thread_info.h +++ b/arch/arm64/include/asm/thread_info.h @@ -48,7 +48,11 @@ struct thread_info { #endif u32 cpu; +#ifdef CONFIG_ARM64_MPAM + KABI_USE(1, u32 prefetch_dis) +#else KABI_RESERVE(1) +#endif KABI_RESERVE(2) }; diff --git a/fs/resctrl/internal.h b/fs/resctrl/internal.h index 839fbcf51ed2..b81edf76263d 100644 --- a/fs/resctrl/internal.h +++ b/fs/resctrl/internal.h @@ -173,6 +173,7 @@ struct rdtgroup { struct mongroup mon; enum rdtgrp_mode mode; struct pseudo_lock_region *plr; + u32 prefetch_dis; }; /* List of all resource groups */ diff --git a/fs/resctrl/rdtgroup.c b/fs/resctrl/rdtgroup.c index b1f127432b42..79334b36798f 100644 --- a/fs/resctrl/rdtgroup.c +++ b/fs/resctrl/rdtgroup.c @@ -975,6 +975,80 @@ static int rdtgroup_tasks_show(struct kernfs_open_file *of, return ret; } +#ifdef CONFIG_ARM64_MPAM +static void update_prefetch_tasks(struct rdtgroup *r, u32 prefetch_dis) +{ + struct task_struct *p, *t; + + rcu_read_lock(); + + for_each_process_thread(p, t) { + if (is_closid_match(t, r) || is_rmid_match(t, r)) { + WRITE_ONCE(task_thread_info(t)->prefetch_dis, prefetch_dis); + /* Update task_struct and will send IPI to target cpu */ + smp_mb(); + update_task_closid_rmid(t); + } + } + + rcu_read_unlock(); +} + +static ssize_t rdtgroup_prefetch_write(struct kernfs_open_file *of, + char *buf, size_t nbytes, loff_t off) +{ + struct rdtgroup *rdtgrp; + int ret = 0; + u32 prefetch_dis; + + rdtgrp = rdtgroup_kn_lock_live(of->kn); + if (!rdtgrp) { + rdtgroup_kn_unlock(of->kn); + return -ENOENT; + } + rdt_last_cmd_clear(); + + if (rdtgrp->mode == RDT_MODE_PSEUDO_LOCKED || + rdtgrp->mode == RDT_MODE_PSEUDO_LOCKSETUP) { + ret = -EINVAL; + rdt_last_cmd_puts("Pseudo-locking in progress\n"); + goto unlock; + } + + if (kstrtou32(buf, 0, &prefetch_dis)) { + rdt_last_cmd_printf("Task list parsing error prefetch %s\n", buf); + ret = -EINVAL; + goto unlock; + } + + if (rdtgrp->prefetch_dis != prefetch_dis) { + rdtgrp->prefetch_dis = prefetch_dis; + update_prefetch_tasks(rdtgrp, prefetch_dis); + } + +unlock: + rdtgroup_kn_unlock(of->kn); + + return ret ?: nbytes; +} + +static int rdtgroup_prefetch_show(struct kernfs_open_file *of, + struct seq_file *s, void *v) +{ + struct rdtgroup *rdtgrp; + int ret = 0; + + rdtgrp = rdtgroup_kn_lock_live(of->kn); + if (rdtgrp) + seq_printf(s, "%u\n", rdtgrp->prefetch_dis); + else + ret = -ENOENT; + rdtgroup_kn_unlock(of->kn); + + return ret; +} +#endif + static int rdtgroup_closid_show(struct kernfs_open_file *of, struct seq_file *s, void *v) { @@ -2044,6 +2118,16 @@ static struct rftype res_common_files[] = { .seq_show = rdtgroup_tasks_show, .fflags = RFTYPE_BASE, }, +#ifdef CONFIG_ARM64_MPAM + { + .name = "prefetch_dis", + .mode = 0644, + .kf_ops = &rdtgroup_kf_single_ops, + .write = rdtgroup_prefetch_write, + .seq_show = rdtgroup_prefetch_show, + .fflags = RFTYPE_BASE, + }, +#endif { .name = "mon_hw_id", .mode = 0444, -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] NFC: NULL out the dev->rfkill to prevent UAF
by Guo Mengqi 06 May '25

06 May '25

From: Lin Ma <linma(a)zju.edu.cn> stable inclusion from stable-v4.19.247 commit 6abfaca8711803d0d7cc8c0fac1070a88509d463 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP3YN CVE: CVE-2022-49505 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1b0e81416a24d6e9b8c2341e22e8bf48f8b8bfc9 ] Commit 3e3b5dfcd16a ("NFC: reorder the logic in nfc_{un,}register_device") assumes the device_is_registered() in function nfc_dev_up() will help to check when the rfkill is unregistered. However, this check only take effect when device_del(&dev->dev) is done in nfc_unregister_device(). Hence, the rfkill object is still possible be dereferenced. The crash trace in latest kernel (5.18-rc2): [ 68.760105] ================================================================== [ 68.760330] BUG: KASAN: use-after-free in __lock_acquire+0x3ec1/0x6750 [ 68.760756] Read of size 8 at addr ffff888009c93018 by task fuzz/313 [ 68.760756] [ 68.760756] CPU: 0 PID: 313 Comm: fuzz Not tainted 5.18.0-rc2 #4 [ 68.760756] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 68.760756] Call Trace: [ 68.760756] <TASK> [ 68.760756] dump_stack_lvl+0x57/0x7d [ 68.760756] print_report.cold+0x5e/0x5db [ 68.760756] ? __lock_acquire+0x3ec1/0x6750 [ 68.760756] kasan_report+0xbe/0x1c0 [ 68.760756] ? __lock_acquire+0x3ec1/0x6750 [ 68.760756] __lock_acquire+0x3ec1/0x6750 [ 68.760756] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 68.760756] ? register_lock_class+0x18d0/0x18d0 [ 68.760756] lock_acquire+0x1ac/0x4f0 [ 68.760756] ? rfkill_blocked+0xe/0x60 [ 68.760756] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 68.760756] ? mutex_lock_io_nested+0x12c0/0x12c0 [ 68.760756] ? nla_get_range_signed+0x540/0x540 [ 68.760756] ? _raw_spin_lock_irqsave+0x4e/0x50 [ 68.760756] _raw_spin_lock_irqsave+0x39/0x50 [ 68.760756] ? rfkill_blocked+0xe/0x60 [ 68.760756] rfkill_blocked+0xe/0x60 [ 68.760756] nfc_dev_up+0x84/0x260 [ 68.760756] nfc_genl_dev_up+0x90/0xe0 [ 68.760756] genl_family_rcv_msg_doit+0x1f4/0x2f0 [ 68.760756] ? genl_family_rcv_msg_attrs_parse.constprop.0+0x230/0x230 [ 68.760756] ? security_capable+0x51/0x90 [ 68.760756] genl_rcv_msg+0x280/0x500 [ 68.760756] ? genl_get_cmd+0x3c0/0x3c0 [ 68.760756] ? lock_acquire+0x1ac/0x4f0 [ 68.760756] ? nfc_genl_dev_down+0xe0/0xe0 [ 68.760756] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 68.760756] netlink_rcv_skb+0x11b/0x340 [ 68.760756] ? genl_get_cmd+0x3c0/0x3c0 [ 68.760756] ? netlink_ack+0x9c0/0x9c0 [ 68.760756] ? netlink_deliver_tap+0x136/0xb00 [ 68.760756] genl_rcv+0x1f/0x30 [ 68.760756] netlink_unicast+0x430/0x710 [ 68.760756] ? memset+0x20/0x40 [ 68.760756] ? netlink_attachskb+0x740/0x740 [ 68.760756] ? __build_skb_around+0x1f4/0x2a0 [ 68.760756] netlink_sendmsg+0x75d/0xc00 [ 68.760756] ? netlink_unicast+0x710/0x710 [ 68.760756] ? netlink_unicast+0x710/0x710 [ 68.760756] sock_sendmsg+0xdf/0x110 [ 68.760756] __sys_sendto+0x19e/0x270 [ 68.760756] ? __ia32_sys_getpeername+0xa0/0xa0 [ 68.760756] ? fd_install+0x178/0x4c0 [ 68.760756] ? fd_install+0x195/0x4c0 [ 68.760756] ? kernel_fpu_begin_mask+0x1c0/0x1c0 [ 68.760756] __x64_sys_sendto+0xd8/0x1b0 [ 68.760756] ? lockdep_hardirqs_on+0xbf/0x130 [ 68.760756] ? syscall_enter_from_user_mode+0x1d/0x50 [ 68.760756] do_syscall_64+0x3b/0x90 [ 68.760756] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 68.760756] RIP: 0033:0x7f67fb50e6b3 ... [ 68.760756] RSP: 002b:00007f67fa91fe90 EFLAGS: 00000293 ORIG_RAX: 000000000000002c [ 68.760756] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f67fb50e6b3 [ 68.760756] RDX: 000000000000001c RSI: 0000559354603090 RDI: 0000000000000003 [ 68.760756] RBP: 00007f67fa91ff00 R08: 00007f67fa91fedc R09: 000000000000000c [ 68.760756] R10: 0000000000000000 R11: 0000000000000293 R12: 00007ffe824d496e [ 68.760756] R13: 00007ffe824d496f R14: 00007f67fa120000 R15: 0000000000000003 [ 68.760756] </TASK> [ 68.760756] [ 68.760756] Allocated by task 279: [ 68.760756] kasan_save_stack+0x1e/0x40 [ 68.760756] __kasan_kmalloc+0x81/0xa0 [ 68.760756] rfkill_alloc+0x7f/0x280 [ 68.760756] nfc_register_device+0xa3/0x1a0 [ 68.760756] nci_register_device+0x77a/0xad0 [ 68.760756] nfcmrvl_nci_register_dev+0x20b/0x2c0 [ 68.760756] nfcmrvl_nci_uart_open+0xf2/0x1dd [ 68.760756] nci_uart_tty_ioctl+0x2c3/0x4a0 [ 68.760756] tty_ioctl+0x764/0x1310 [ 68.760756] __x64_sys_ioctl+0x122/0x190 [ 68.760756] do_syscall_64+0x3b/0x90 [ 68.760756] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 68.760756] [ 68.760756] Freed by task 314: [ 68.760756] kasan_save_stack+0x1e/0x40 [ 68.760756] kasan_set_track+0x21/0x30 [ 68.760756] kasan_set_free_info+0x20/0x30 [ 68.760756] __kasan_slab_free+0x108/0x170 [ 68.760756] kfree+0xb0/0x330 [ 68.760756] device_release+0x96/0x200 [ 68.760756] kobject_put+0xf9/0x1d0 [ 68.760756] nfc_unregister_device+0x77/0x190 [ 68.760756] nfcmrvl_nci_unregister_dev+0x88/0xd0 [ 68.760756] nci_uart_tty_close+0xdf/0x180 [ 68.760756] tty_ldisc_kill+0x73/0x110 [ 68.760756] tty_ldisc_hangup+0x281/0x5b0 [ 68.760756] __tty_hangup.part.0+0x431/0x890 [ 68.760756] tty_release+0x3a8/0xc80 [ 68.760756] __fput+0x1f0/0x8c0 [ 68.760756] task_work_run+0xc9/0x170 [ 68.760756] exit_to_user_mode_prepare+0x194/0x1a0 [ 68.760756] syscall_exit_to_user_mode+0x19/0x50 [ 68.760756] do_syscall_64+0x48/0x90 [ 68.760756] entry_SYSCALL_64_after_hwframe+0x44/0xae This patch just add the null out of dev->rfkill to make sure such dereference cannot happen. This is safe since the device_lock() already protect the check/write from data race. Fixes: 3e3b5dfcd16a ("NFC: reorder the logic in nfc_{un,}register_device") Signed-off-by: Lin Ma <linma(a)zju.edu.cn> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- net/nfc/core.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/nfc/core.c b/net/nfc/core.c index a91c6b94e153..dd12ee46ac73 100644 --- a/net/nfc/core.c +++ b/net/nfc/core.c @@ -1171,6 +1171,7 @@ void nfc_unregister_device(struct nfc_dev *dev) if (dev->rfkill) { rfkill_unregister(dev->rfkill); rfkill_destroy(dev->rfkill); + dev->rfkill = NULL; } dev->shutting_down = true; device_unlock(&dev->dev); -- 2.22.0

2 1

[PATCH openEuler-1.0-LTS] Bluetooth: Fix use after free in hci_send_acl
by Guo Mengqi 06 May '25

06 May '25

From: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> stable inclusion from stable-v4.19.238 commit 684e505406abaeabe0058e9776f9210bf2747953 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBW9W8 CVE: CVE-2022-49111 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f63d24baff787e13b723d86fe036f84bdbc35045 ] This fixes the following trace caused by receiving HCI_EV_DISCONN_PHY_LINK_COMPLETE which does call hci_conn_del without first checking if conn->type is in fact AMP_LINK and in case it is do properly cleanup upper layers with hci_disconn_cfm: ================================================================== BUG: KASAN: use-after-free in hci_send_acl+0xaba/0xc50 Read of size 8 at addr ffff88800e404818 by task bluetoothd/142 CPU: 0 PID: 142 Comm: bluetoothd Not tainted 5.17.0-rc5-00006-gda4022eeac1a #7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x45/0x59 print_address_description.constprop.0+0x1f/0x150 kasan_report.cold+0x7f/0x11b hci_send_acl+0xaba/0xc50 l2cap_do_send+0x23f/0x3d0 l2cap_chan_send+0xc06/0x2cc0 l2cap_sock_sendmsg+0x201/0x2b0 sock_sendmsg+0xdc/0x110 sock_write_iter+0x20f/0x370 do_iter_readv_writev+0x343/0x690 do_iter_write+0x132/0x640 vfs_writev+0x198/0x570 do_writev+0x202/0x280 do_syscall_64+0x38/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae RSP: 002b:00007ffce8a099b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 Code: 0f 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 14 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 RDX: 0000000000000001 RSI: 00007ffce8a099e0 RDI: 0000000000000015 RAX: ffffffffffffffda RBX: 00007ffce8a099e0 RCX: 00007f788fc3cf77 R10: 00007ffce8af7080 R11: 0000000000000246 R12: 000055e4ccf75580 RBP: 0000000000000015 R08: 0000000000000002 R09: 0000000000000001 </TASK> R13: 000055e4ccf754a0 R14: 000055e4ccf75cd0 R15: 000055e4ccf4a6b0 Allocated by task 45: kasan_save_stack+0x1e/0x40 __kasan_kmalloc+0x81/0xa0 hci_chan_create+0x9a/0x2f0 l2cap_conn_add.part.0+0x1a/0xdc0 l2cap_connect_cfm+0x236/0x1000 le_conn_complete_evt+0x15a7/0x1db0 hci_le_conn_complete_evt+0x226/0x2c0 hci_le_meta_evt+0x247/0x450 hci_event_packet+0x61b/0xe90 hci_rx_work+0x4d5/0xc50 process_one_work+0x8fb/0x15a0 worker_thread+0x576/0x1240 kthread+0x29d/0x340 ret_from_fork+0x1f/0x30 Freed by task 45: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_set_free_info+0x20/0x30 __kasan_slab_free+0xfb/0x130 kfree+0xac/0x350 hci_conn_cleanup+0x101/0x6a0 hci_conn_del+0x27e/0x6c0 hci_disconn_phylink_complete_evt+0xe0/0x120 hci_event_packet+0x812/0xe90 hci_rx_work+0x4d5/0xc50 process_one_work+0x8fb/0x15a0 worker_thread+0x576/0x1240 kthread+0x29d/0x340 ret_from_fork+0x1f/0x30 The buggy address belongs to the object at ffff88800c0f0500 The buggy address is located 24 bytes inside of which belongs to the cache kmalloc-128 of size 128 The buggy address belongs to the page: 128-byte region [ffff88800c0f0500, ffff88800c0f0580) flags: 0x100000000000200(slab|node=0|zone=1) page:00000000fe45cd86 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xc0f0 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 raw: 0100000000000200 ffffea00003a2c80 dead000000000004 ffff8880078418c0 page dumped because: kasan: bad access detected ffff88800c0f0400: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc Memory state around the buggy address: >ffff88800c0f0500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88800c0f0480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88800c0f0580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ================================================================== ffff88800c0f0600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb Reported-by: Sönke Huster <soenke.huster(a)eknoes.de> Tested-by: Sönke Huster <soenke.huster(a)eknoes.de> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Marcel Holtmann <marcel(a)holtmann.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> --- net/bluetooth/hci_event.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c index 0067197535dd..3ed83b06c726 100644 --- a/net/bluetooth/hci_event.c +++ b/net/bluetooth/hci_event.c @@ -4775,8 +4775,9 @@ static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev, hci_dev_lock(hdev); hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle); - if (hcon) { + if (hcon && hcon->type == AMP_LINK) { hcon->state = BT_CLOSED; + hci_disconn_cfm(hcon, ev->reason); hci_conn_del(hcon); } -- 2.22.0

2 1

[PATCH OLK-6.6 00/63] Add FUSE Passthrough Support
by Yifan Qiao 06 May '25

06 May '25

Amir Goldstein (57): fs: rename __mnt_{want,drop}_write*() helpers fs: export mnt_{get,put}_write_access() to modules fuse: factor out helper fuse_truncate_update_attr() fuse: allocate ff->release_args only if release is needed fuse: break up fuse_open_common() fuse: prepare for failing open response fuse: introduce inode io modes fuse: allow parallel dio writes with FUSE_DIRECT_IO_ALLOW_MMAP ovl: use simpler function to convert iocb to rw flags ovl: propagate IOCB_APPEND flag on writes to realfile ovl: punt write aio completion to workqueue ovl: protect copying of realinode attributes to ovl inode fs: get mnt_writers count for an open backing file's real path fs: create helper file_user_path() for user displayed mapped file path fs: store real path instead of fake path in backing file f_path ovl: add helper ovl_file_modified() ovl: split ovl_want_write() into two helpers ovl: reorder ovl_want_write() after ovl_inode_lock() ovl: do not open/llseek lower file with upper sb_writers held ovl: do not encode lower fh with upper sb_writers held ovl: add permission hooks outside of do_splice_direct() splice: remove permission hook from do_splice_direct() splice: move permission hook out of splice_direct_to_actor() splice: move permission hook out of splice_file_to_pipe() splice: remove permission hook from iter_file_splice_write() remap_range: move permission hooks out of do_clone_file_range() remap_range: move file_start_write() to after permission hook btrfs: move file_start_write() to after permission hook coda: change locking order in coda_file_write_iter() fs: move file_start_write() into vfs_iter_write() fs: move permission hook out of do_iter_write() fs: move permission hook out of do_iter_read() fs: move kiocb_start_write() into vfs_iocb_iter_write() fs: create __sb_write_started() helper fs: create file_write_started() helper fs: create {sb,file}_write_not_started() helpers fs: prepare for stackable filesystems backing file helpers fs: factor out backing_file_{read,write}_iter() helpers fs: factor out backing_file_splice_{read,write}() helpers fs: factor out backing_file_mmap() helper fuse: factor out helper for FUSE_DEV_IOC_CLONE fuse: introduce FUSE_PASSTHROUGH capability fuse: implement ioctls to manage backing files fuse: prepare for opening file in passthrough mode fuse: implement open in passthrough mode fuse: implement read/write passthrough fuse: implement splice read/write passthrough fuse: implement passthrough for mmap fuse: fix wrong ff->iomode state changes from parallel dio write fuse: fix parallel dio write on file open in passthrough mode fuse: verify zero padding in fuse_backing_map fuse: respect FOPEN_KEEP_CACHE on opendir ovl: fix dentry reference leak after changes to underlying layers ovl: relax WARN_ON in ovl_verify_area() remap_range: merge do_clone_file_range() into vfs_clone_file_range() fs: pass offset and result to backing_file end_write() callback fuse: update inode size after extending passthrough write Bernd Schubert (3): fuse: create helper function if DIO write needs exclusive lock fuse: add fuse_dio_lock/unlock helper functions fuse: disable the combination of passthrough and writeback cache Ed Tsai (1): backing-file: convert to using fops->splice_write Vegard Nossum (1): fs: fix __sb_write_started() kerneldoc formatting yangyun (1): fuse: use exclusive lock when FUSE_I_CACHE_IO_MODE is set fs/fuse/fuse_i.h | 151 +++++++++++-- fs/internal.h | 21 +- fs/overlayfs/overlayfs.h | 38 +++- include/linux/backing-file.h | 42 ++++ include/linux/fs.h | 89 ++++++-- include/linux/fsnotify.h | 3 +- include/linux/mount.h | 4 +- include/uapi/linux/fuse.h | 23 +- arch/arc/kernel/troubleshoot.c | 6 +- drivers/block/loop.c | 2 - drivers/target/target_core_file.c | 10 +- fs/backing-file.c | 339 ++++++++++++++++++++++++++++ fs/btrfs/ioctl.c | 12 +- fs/cachefiles/io.c | 5 +- fs/coda/file.c | 2 - fs/file_table.c | 12 +- fs/fuse/dev.c | 98 +++++--- fs/fuse/dir.c | 49 +++- fs/fuse/file.c | 362 ++++++++++++++++++++---------- fs/fuse/inode.c | 37 +++ fs/fuse/iomode.c | 276 +++++++++++++++++++++++ fs/fuse/passthrough.c | 355 +++++++++++++++++++++++++++++ fs/inode.c | 8 +- fs/namespace.c | 36 +-- fs/nfsd/vfs.c | 7 +- fs/open.c | 70 +++--- fs/overlayfs/copy_up.c | 168 +++++++++----- fs/overlayfs/dir.c | 60 +++-- fs/overlayfs/export.c | 7 +- fs/overlayfs/file.c | 230 ++++--------------- fs/overlayfs/inode.c | 57 +++-- fs/overlayfs/namei.c | 37 ++- fs/overlayfs/super.c | 47 ++-- fs/overlayfs/util.c | 75 ++++++- fs/proc/base.c | 2 +- fs/proc/nommu.c | 2 +- fs/proc/task_mmu.c | 4 +- fs/proc/task_nommu.c | 2 +- fs/read_write.c | 156 ++++++++----- fs/remap_range.c | 44 ++-- fs/splice.c | 82 ++++--- fs/super.c | 1 + kernel/acct.c | 4 +- kernel/trace/trace_output.c | 2 +- MAINTAINERS | 9 + fs/Kconfig | 4 + fs/Makefile | 1 + fs/fuse/Kconfig | 11 + fs/fuse/Makefile | 2 + fs/overlayfs/Kconfig | 1 + 50 files changed, 2290 insertions(+), 775 deletions(-) create mode 100644 include/linux/backing-file.h create mode 100644 fs/backing-file.c create mode 100644 fs/fuse/iomode.c create mode 100644 fs/fuse/passthrough.c -- 2.39.2

2 64

[PATCH OLK-6.6 00/63] Add FUSE Passthrough Support
by Yifan Qiao 06 May '25

06 May '25

Amir Goldstein (57): fs: rename __mnt_{want,drop}_write*() helpers fs: export mnt_{get,put}_write_access() to modules fuse: factor out helper fuse_truncate_update_attr() fuse: allocate ff->release_args only if release is needed fuse: break up fuse_open_common() fuse: prepare for failing open response fuse: introduce inode io modes fuse: allow parallel dio writes with FUSE_DIRECT_IO_ALLOW_MMAP ovl: use simpler function to convert iocb to rw flags ovl: propagate IOCB_APPEND flag on writes to realfile ovl: punt write aio completion to workqueue ovl: protect copying of realinode attributes to ovl inode fs: get mnt_writers count for an open backing file's real path fs: create helper file_user_path() for user displayed mapped file path fs: store real path instead of fake path in backing file f_path ovl: add helper ovl_file_modified() ovl: split ovl_want_write() into two helpers ovl: reorder ovl_want_write() after ovl_inode_lock() ovl: do not open/llseek lower file with upper sb_writers held ovl: do not encode lower fh with upper sb_writers held ovl: add permission hooks outside of do_splice_direct() splice: remove permission hook from do_splice_direct() splice: move permission hook out of splice_direct_to_actor() splice: move permission hook out of splice_file_to_pipe() splice: remove permission hook from iter_file_splice_write() remap_range: move permission hooks out of do_clone_file_range() remap_range: move file_start_write() to after permission hook btrfs: move file_start_write() to after permission hook coda: change locking order in coda_file_write_iter() fs: move file_start_write() into vfs_iter_write() fs: move permission hook out of do_iter_write() fs: move permission hook out of do_iter_read() fs: move kiocb_start_write() into vfs_iocb_iter_write() fs: create __sb_write_started() helper fs: create file_write_started() helper fs: create {sb,file}_write_not_started() helpers fs: prepare for stackable filesystems backing file helpers fs: factor out backing_file_{read,write}_iter() helpers fs: factor out backing_file_splice_{read,write}() helpers fs: factor out backing_file_mmap() helper fuse: factor out helper for FUSE_DEV_IOC_CLONE fuse: introduce FUSE_PASSTHROUGH capability fuse: implement ioctls to manage backing files fuse: prepare for opening file in passthrough mode fuse: implement open in passthrough mode fuse: implement read/write passthrough fuse: implement splice read/write passthrough fuse: implement passthrough for mmap fuse: fix wrong ff->iomode state changes from parallel dio write fuse: fix parallel dio write on file open in passthrough mode fuse: verify zero padding in fuse_backing_map fuse: respect FOPEN_KEEP_CACHE on opendir ovl: fix dentry reference leak after changes to underlying layers ovl: relax WARN_ON in ovl_verify_area() remap_range: merge do_clone_file_range() into vfs_clone_file_range() fs: pass offset and result to backing_file end_write() callback fuse: update inode size after extending passthrough write Bernd Schubert (3): fuse: create helper function if DIO write needs exclusive lock fuse: add fuse_dio_lock/unlock helper functions fuse: disable the combination of passthrough and writeback cache Ed Tsai (1): backing-file: convert to using fops->splice_write Vegard Nossum (1): fs: fix __sb_write_started() kerneldoc formatting yangyun (1): fuse: use exclusive lock when FUSE_I_CACHE_IO_MODE is set fs/fuse/fuse_i.h | 151 +++++++++++-- fs/internal.h | 21 +- fs/overlayfs/overlayfs.h | 38 +++- include/linux/backing-file.h | 42 ++++ include/linux/fs.h | 89 ++++++-- include/linux/fsnotify.h | 3 +- include/linux/mount.h | 4 +- include/uapi/linux/fuse.h | 23 +- arch/arc/kernel/troubleshoot.c | 6 +- drivers/block/loop.c | 2 - drivers/target/target_core_file.c | 10 +- fs/backing-file.c | 339 ++++++++++++++++++++++++++++ fs/btrfs/ioctl.c | 12 +- fs/cachefiles/io.c | 5 +- fs/coda/file.c | 2 - fs/file_table.c | 12 +- fs/fuse/dev.c | 98 +++++--- fs/fuse/dir.c | 49 +++- fs/fuse/file.c | 362 ++++++++++++++++++++---------- fs/fuse/inode.c | 37 +++ fs/fuse/iomode.c | 276 +++++++++++++++++++++++ fs/fuse/passthrough.c | 355 +++++++++++++++++++++++++++++ fs/inode.c | 8 +- fs/namespace.c | 36 +-- fs/nfsd/vfs.c | 7 +- fs/open.c | 70 +++--- fs/overlayfs/copy_up.c | 168 +++++++++----- fs/overlayfs/dir.c | 60 +++-- fs/overlayfs/export.c | 7 +- fs/overlayfs/file.c | 230 ++++--------------- fs/overlayfs/inode.c | 57 +++-- fs/overlayfs/namei.c | 37 ++- fs/overlayfs/super.c | 47 ++-- fs/overlayfs/util.c | 75 ++++++- fs/proc/base.c | 2 +- fs/proc/nommu.c | 2 +- fs/proc/task_mmu.c | 4 +- fs/proc/task_nommu.c | 2 +- fs/read_write.c | 156 ++++++++----- fs/remap_range.c | 44 ++-- fs/splice.c | 82 ++++--- fs/super.c | 1 + kernel/acct.c | 4 +- kernel/trace/trace_output.c | 2 +- MAINTAINERS | 9 + fs/Kconfig | 4 + fs/Makefile | 1 + fs/fuse/Kconfig | 11 + fs/fuse/Makefile | 2 + fs/overlayfs/Kconfig | 1 + 50 files changed, 2290 insertions(+), 775 deletions(-) create mode 100644 include/linux/backing-file.h create mode 100644 fs/backing-file.c create mode 100644 fs/fuse/iomode.c create mode 100644 fs/fuse/passthrough.c -- 2.39.2

2 64

[openeuler:openEuler-1.0-LTS 1365/1365] drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed.
by kernel test robot 05 May '25

05 May '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: a48a35466505c8a52da57596944bd0b4485e825f commit: b8815fbbe89b0d15fa3296c3e57d2197a92f5bc0 [1365/1365] ACPI: CPPC: Fix cppc_cpufreq_init failed in CPU Hotplug situation config: x86_64-randconfig-102-20250103 (https://download.01.org/0day-ci/archive/20250505/202505052008.Vj0WP8gn-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202505052008.Vj0WP8gn-lkp@intel.com/ cocci warnings: (new ones prefixed by >>) >> drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed. vim +614 drivers/acpi/cppc_acpi.c 576 577 int acpi_get_psd_map(struct cppc_cpudata **all_cpu_data) 578 { 579 struct cpc_desc **cpc_pptr, *cpc_ptr; 580 int parsed_core_num = 0; 581 int i, ret; 582 583 cpc_pptr = kcalloc(num_possible_cpus(), sizeof(void *), GFP_KERNEL); 584 if (!cpc_pptr) 585 return -ENOMEM; 586 for_each_possible_cpu(i) { 587 cpc_pptr[i] = kzalloc(sizeof(struct cpc_desc), GFP_KERNEL); 588 if (!cpc_pptr[i]) { 589 ret = -ENOMEM; 590 goto out; 591 } 592 } 593 594 /* 595 * We can not use acpi_get_devices() to walk the processor devices 596 * because some processor device is not present. 597 */ 598 ret = acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_ROOT_OBJECT, 599 ACPI_UINT32_MAX, acpi_parse_cpc, NULL, 600 cpc_pptr, (void **)&parsed_core_num); 601 if (ret) 602 goto out; 603 if (parsed_core_num != num_possible_cpus()) { 604 ret = -EINVAL; 605 goto out; 606 } 607 608 ret = __acpi_get_psd_map(all_cpu_data, cpc_pptr); 609 610 out: 611 for_each_possible_cpu(i) { 612 cpc_ptr = cpc_pptr[i]; 613 if (cpc_ptr) > 614 kfree(cpc_ptr); 615 } 616 kfree(cpc_pptr); 617 618 return ret; 619 } 620 EXPORT_SYMBOL_GPL(acpi_get_psd_map); 621 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] can: peak_usb: fix use after free bugs
by Zhang Changzhong 04 May '25

04 May '25

From: Vincent Mailhol <mailhol.vincent(a)wanadoo.fr> stable inclusion from stable-v5.11-rc5 commit 50aca891d7a554db0901b245167cd653d73aaa71 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC21UY CVE: CVE-2021-47670 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- After calling peak_usb_netif_rx_ni(skb), dereferencing skb is unsafe. Especially, the can_frame cf which aliases skb memory is accessed after the peak_usb_netif_rx_ni(). Reordering the lines solves the issue. Fixes: 0a25e1f4f185 ("can: peak_usb: add support for PEAK new CANFD USB adapters") Link: https://lore.kernel.org/r/20210120114137.200019-4-mailhol.vincent@wanadoo.fr Signed-off-by: Vincent Mailhol <mailhol.vincent(a)wanadoo.fr> Signed-off-by: Marc Kleine-Budde <mkl(a)pengutronix.de> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c index 4198835..87574ce 100644 --- a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c +++ b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c @@ -514,11 +514,11 @@ static int pcan_usb_fd_decode_canmsg(struct pcan_usb_fd_if *usb_if, else memcpy(cfd->data, rm->d, cfd->len); - peak_usb_netif_rx(skb, &usb_if->time_ref, le32_to_cpu(rm->ts_low)); - netdev->stats.rx_packets++; netdev->stats.rx_bytes += cfd->len; + peak_usb_netif_rx(skb, &usb_if->time_ref, le32_to_cpu(rm->ts_low)); + return 0; } @@ -574,11 +574,11 @@ static int pcan_usb_fd_decode_status(struct pcan_usb_fd_if *usb_if, if (!skb) return -ENOMEM; - peak_usb_netif_rx(skb, &usb_if->time_ref, le32_to_cpu(sm->ts_low)); - netdev->stats.rx_packets++; netdev->stats.rx_bytes += cf->can_dlc; + peak_usb_netif_rx(skb, &usb_if->time_ref, le32_to_cpu(sm->ts_low)); + return 0; } -- 2.9.5

2 1

[PATCH openEuler-1.0-LTS] net: mdio: validate parameter addr in mdiobus_get_phy()
by Zhang Changzhong 04 May '25

04 May '25

From: Heiner Kallweit <hkallweit1(a)gmail.com> stable inclusion from stable-v4.19.272 commit c431a3d642593bbdb99e8a9e3eed608b730db6f8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVY6 CVE: CVE-2023-53019 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 867dbe784c5010a466f00a7d1467c1c5ea569c75 ] The caller may pass any value as addr, what may result in an out-of-bounds access to array mdio_map. One existing case is stmmac_init_phy() that may pass -1 as addr. Therefore validate addr before using it. Fixes: 7f854420fbfe ("phy: Add API for {un}registering an mdio device to a bus.") Signed-off-by: Heiner Kallweit <hkallweit1(a)gmail.com> Reviewed-by: Andrew Lunn <andrew(a)lunn.ch> Link: https://lore.kernel.org/r/cdf664ea-3312-e915-73f8-021678d08887@gmail.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/net/phy/mdio_bus.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c index 3593717..60c732d 100644 --- a/drivers/net/phy/mdio_bus.c +++ b/drivers/net/phy/mdio_bus.c @@ -102,7 +102,12 @@ EXPORT_SYMBOL(mdiobus_unregister_device); struct phy_device *mdiobus_get_phy(struct mii_bus *bus, int addr) { - struct mdio_device *mdiodev = bus->mdio_map[addr]; + struct mdio_device *mdiodev; + + if (addr < 0 || addr >= ARRAY_SIZE(bus->mdio_map)) + return NULL; + + mdiodev = bus->mdio_map[addr]; if (!mdiodev) return NULL; -- 2.9.5

2 1

[openeuler:OLK-5.10 2882/2882] ld.lld: error: undefined symbol: sk_msg_alloc
by kernel test robot 02 May '25

02 May '25

Hi Wei, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 46abe407b020831448331eea487e07c883e95836 commit: e9ce37bbceb2779c0015fcac54cc8df7a2ec8b76 [2882/2882] tcp_comp: implement sendmsg for tcp compression config: x86_64-randconfig-102-20250502 (https://download.01.org/0day-ci/archive/20250502/202505021845.WkxnVSOV-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250502/202505021845.WkxnVSOV-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202505021845.WkxnVSOV-lkp@intel.com/ All errors (new ones prefixed by >>): >> ld.lld: error: undefined symbol: sk_msg_alloc >>> referenced by tcp_comp.c:148 (net/ipv4/tcp_comp.c:148) >>> ipv4/tcp_comp.o:(tcp_comp_sendmsg) in archive net/built-in.a -- >> ld.lld: error: undefined symbol: sk_msg_trim >>> referenced by tcp_comp.c:236 (net/ipv4/tcp_comp.c:236) >>> ipv4/tcp_comp.o:(tcp_comp_sendmsg) in archive net/built-in.a -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2882/2882] drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_monitor.o: warning: objtool: sxevf_work_cb()+0x108b: can't find switch jump table
by kernel test robot 02 May '25

02 May '25

Hi liujie_answer, First bad commit (maybe != root cause): tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 46abe407b020831448331eea487e07c883e95836 commit: 8cee206b5558245197158bd20895f95cc28d8468 [2882/2882] Ethernet: Linkdata: Supports Linkdata ethernet Controllers config: x86_64-randconfig-101-20250502 (https://download.01.org/0day-ci/archive/20250502/202505021622.Vo53IuHc-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250502/202505021622.Vo53IuHc-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202505021622.Vo53IuHc-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_monitor.o: warning: objtool: sxevf_work_cb()+0x108b: can't find switch jump table Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PGP_KEY_PARSER Depends on [m]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] && ASYMMETRIC_PUBLIC_KEY_SUBTYPE [=m] Selected by [y]: - PGP_PRELOAD [=y] && CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2195/2195] include/linux/pgplib.h:36:23: error: field has incomplete type 'enum pgp_key_version'
by kernel test robot 02 May '25

02 May '25

Hi David, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 241523b7d82e629fd115303840c385702bf2ea5e commit: 43d4042e06d2bf96adf67d25e8d91653507a4cf9 [2195/2195] KEYS: Provide a function to load keys from a PGP keyring blob config: x86_64-randconfig-101-20250502 (https://download.01.org/0day-ci/archive/20250502/202505021617.FheAIoZW-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250502/202505021617.FheAIoZW-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202505021617.FheAIoZW-lkp@intel.com/ All error/warnings (new ones prefixed by >>): In file included from crypto/asymmetric_keys/pgp_preload.c:19: >> include/linux/pgplib.h:26:15: warning: declaration of 'enum pgp_packet_tag' will not be visible outside of this function [-Wvisibility] 26 | enum pgp_packet_tag type, | ^ >> include/linux/pgplib.h:36:23: error: field has incomplete type 'enum pgp_key_version' 36 | enum pgp_key_version version : 8; | ^ include/linux/pgplib.h:36:7: note: forward declaration of 'enum pgp_key_version' 36 | enum pgp_key_version version : 8; | ^ >> include/linux/pgplib.h:37:23: error: field has incomplete type 'enum pgp_pubkey_algo' 37 | enum pgp_pubkey_algo pubkey_algo : 8; | ^ include/linux/pgplib.h:37:7: note: forward declaration of 'enum pgp_pubkey_algo' 37 | enum pgp_pubkey_algo pubkey_algo : 8; | ^ >> crypto/asymmetric_keys/pgp_preload.c:63:10: warning: declaration of 'enum pgp_packet_tag' will not be visible outside of this function [-Wvisibility] 63 | enum pgp_packet_tag type, u8 headerlen, | ^ >> crypto/asymmetric_keys/pgp_preload.c:63:25: error: variable has incomplete type 'enum pgp_packet_tag' 63 | enum pgp_packet_tag type, u8 headerlen, | ^ crypto/asymmetric_keys/pgp_preload.c:63:10: note: forward declaration of 'enum pgp_packet_tag' 63 | enum pgp_packet_tag type, u8 headerlen, | ^ >> crypto/asymmetric_keys/pgp_preload.c:107:36: error: use of undeclared identifier 'PGP_PKT_PUBLIC_KEY' 107 | ctx.pgp.types_of_interest = (1 << PGP_PKT_PUBLIC_KEY); | ^ >> crypto/asymmetric_keys/pgp_preload.c:108:25: error: incompatible function pointer types assigning to 'int (*)(struct pgp_parse_context *, enum pgp_packet_tag, u8, const u8 *, size_t)' (aka 'int (*)(struct pgp_parse_context *, enum pgp_packet_tag, unsigned char, const unsigned char *, unsigned long)') from 'int (struct pgp_parse_context *, enum pgp_packet_tag, u8, const u8 *, size_t)' (aka 'int (struct pgp_parse_context *, enum pgp_packet_tag, unsigned char, const unsigned char *, unsigned long)') [-Wincompatible-function-pointer-types] 108 | ctx.pgp.process_packet = found_pgp_key; | ^ ~~~~~~~~~~~~~ >> crypto/asymmetric_keys/pgp_preload.c:101:12: warning: no previous prototype for function 'preload_pgp_keys' [-Wmissing-prototypes] 101 | int __init preload_pgp_keys(const u8 *pgpdata, size_t pgpdatalen, | ^ crypto/asymmetric_keys/pgp_preload.c:101:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 101 | int __init preload_pgp_keys(const u8 *pgpdata, size_t pgpdatalen, | ^ | static 3 warnings and 5 errors generated. -- In file included from crypto/asymmetric_keys/pgp_public_key.c:19: In file included from include/linux/mpi.h:21: In file included from include/linux/scatterlist.h:8: In file included from include/linux/mm.h:2193: include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ In file included from crypto/asymmetric_keys/pgp_public_key.c:20: >> include/linux/pgplib.h:26:15: warning: declaration of 'enum pgp_packet_tag' will not be visible outside of this function [-Wvisibility] 26 | enum pgp_packet_tag type, | ^ >> include/linux/pgplib.h:36:23: error: field has incomplete type 'enum pgp_key_version' 36 | enum pgp_key_version version : 8; | ^ include/linux/pgplib.h:36:7: note: forward declaration of 'enum pgp_key_version' 36 | enum pgp_key_version version : 8; | ^ >> include/linux/pgplib.h:37:23: error: field has incomplete type 'enum pgp_pubkey_algo' 37 | enum pgp_pubkey_algo pubkey_algo : 8; | ^ include/linux/pgplib.h:37:7: note: forward declaration of 'enum pgp_pubkey_algo' 37 | enum pgp_pubkey_algo pubkey_algo : 8; | ^ >> crypto/asymmetric_keys/pgp_public_key.c:63:2: error: call to undeclared function 'kenter'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 63 | kenter(""); | ^ >> crypto/asymmetric_keys/pgp_public_key.c:65:22: error: use of undeclared identifier 'PGP_KEY_VERSION_4' 65 | n = (pgp->version < PGP_KEY_VERSION_4) ? 8 : 6; | ^ >> crypto/asymmetric_keys/pgp_public_key.c:67:9: error: call to undeclared function 'mpi_key_length'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 67 | ret = mpi_key_length(key_ptr, keylen, nb + i, nn + i); | ^ crypto/asymmetric_keys/pgp_public_key.c:95:21: error: use of undeclared identifier 'PGP_KEY_VERSION_4' 95 | if (pgp->version < PGP_KEY_VERSION_4) { | ^ >> crypto/asymmetric_keys/pgp_public_key.c:115:2: error: call to undeclared function 'kleave'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 115 | kleave(" = %d", ret); | ^ crypto/asymmetric_keys/pgp_public_key.c:134:42: error: use of undeclared identifier 'PGP_KEY_VERSION_4' 134 | tfm = crypto_alloc_shash(pgp->version < PGP_KEY_VERSION_4 ? | ^ crypto/asymmetric_keys/pgp_public_key.c:191:2: error: call to undeclared function 'kleave'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 191 | kleave(" = %d", ret); | ^ >> crypto/asymmetric_keys/pgp_public_key.c:199:12: warning: declaration of 'enum pgp_packet_tag' will not be visible outside of this function [-Wvisibility] 199 | enum pgp_packet_tag type, | ^ >> crypto/asymmetric_keys/pgp_public_key.c:199:27: error: variable has incomplete type 'enum pgp_packet_tag' 199 | enum pgp_packet_tag type, | ^ crypto/asymmetric_keys/pgp_public_key.c:199:12: note: forward declaration of 'enum pgp_packet_tag' 199 | enum pgp_packet_tag type, | ^ crypto/asymmetric_keys/pgp_public_key.c:211:2: error: call to undeclared function 'kenter'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 211 | kenter(",%u,%u,,%zu", type, headerlen, datalen); | ^ >> crypto/asymmetric_keys/pgp_public_key.c:213:14: error: use of undeclared identifier 'PGP_PKT_USER_ID' 213 | if (type == PGP_PKT_USER_ID) { | ^ crypto/asymmetric_keys/pgp_public_key.c:216:3: error: call to undeclared function 'kleave'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 216 | kleave(" = 0 [user ID]"); | ^ crypto/asymmetric_keys/pgp_public_key.c:221:3: error: call to undeclared function 'kleave'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 221 | kleave(" = -ENOKEY [already]"); | ^ >> crypto/asymmetric_keys/pgp_public_key.c:234:25: error: use of undeclared identifier 'PGP_PUBKEY__LAST' 234 | if (pgp.pubkey_algo >= PGP_PUBKEY__LAST) | ^ >> crypto/asymmetric_keys/pgp_public_key.c:236:9: error: use of undeclared identifier 'pgp_to_public_key_algo' 236 | algo = pgp_to_public_key_algo[pgp.pubkey_algo]; | ^ crypto/asymmetric_keys/pgp_public_key.c:252:2: error: call to undeclared function 'kleave'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 252 | kleave(" = 0 [use]"); | ^ crypto/asymmetric_keys/pgp_public_key.c:310:2: error: call to undeclared function 'kenter'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 310 | kenter(""); | ^ >> crypto/asymmetric_keys/pgp_public_key.c:313:36: error: use of undeclared identifier 'PGP_PKT_PUBLIC_KEY' 313 | ctx.pgp.types_of_interest = (1 << PGP_PKT_PUBLIC_KEY) | | ^ fatal error: too many errors emitted, stopping now [-ferror-limit=] 3 warnings and 20 errors generated. Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PGP_KEY_PARSER Depends on [m]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] && ASYMMETRIC_PUBLIC_KEY_SUBTYPE [=m] Selected by [y]: - PGP_PRELOAD [=y] && CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] vim +36 include/linux/pgplib.h b78af6579e15dc David Howells 2023-09-12 19 b78af6579e15dc David Howells 2023-09-12 20 /* b78af6579e15dc David Howells 2023-09-12 21 * PGP library packet parser b78af6579e15dc David Howells 2023-09-12 22 */ b78af6579e15dc David Howells 2023-09-12 23 struct pgp_parse_context { b78af6579e15dc David Howells 2023-09-12 24 u64 types_of_interest; b78af6579e15dc David Howells 2023-09-12 25 int (*process_packet)(struct pgp_parse_context *context, b78af6579e15dc David Howells 2023-09-12 @26 enum pgp_packet_tag type, b78af6579e15dc David Howells 2023-09-12 27 u8 headerlen, b78af6579e15dc David Howells 2023-09-12 28 const u8 *data, b78af6579e15dc David Howells 2023-09-12 29 size_t datalen); b78af6579e15dc David Howells 2023-09-12 30 }; b78af6579e15dc David Howells 2023-09-12 31 b78af6579e15dc David Howells 2023-09-12 32 extern int pgp_parse_packets(const u8 *data, size_t datalen, b78af6579e15dc David Howells 2023-09-12 33 struct pgp_parse_context *ctx); b78af6579e15dc David Howells 2023-09-12 34 b78af6579e15dc David Howells 2023-09-12 35 struct pgp_parse_pubkey { b78af6579e15dc David Howells 2023-09-12 @36 enum pgp_key_version version : 8; b78af6579e15dc David Howells 2023-09-12 @37 enum pgp_pubkey_algo pubkey_algo : 8; b78af6579e15dc David Howells 2023-09-12 38 __kernel_old_time_t creation_time; b78af6579e15dc David Howells 2023-09-12 39 __kernel_old_time_t expires_at; b78af6579e15dc David Howells 2023-09-12 40 }; b78af6579e15dc David Howells 2023-09-12 41 :::::: The code at line 36 was first introduced by commit :::::: b78af6579e15dcdff86504da90af77f3e890270e PGPLIB: Basic packet parser :::::: TO: David Howells <dhowells(a)redhat.com> :::::: CC: zgzxx <zhangguangzhi3(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2882/2882] drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:134:36: sparse: sparse: invalid assignment: |=
by kernel test robot 02 May '25

02 May '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 46abe407b020831448331eea487e07c883e95836 commit: 8cee206b5558245197158bd20895f95cc28d8468 [2882/2882] Ethernet: Linkdata: Supports Linkdata ethernet Controllers config: x86_64-randconfig-122-20250502 (https://download.01.org/0day-ci/archive/20250502/202505021153.ilI6N3GY-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250502/202505021153.ilI6N3GY-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202505021153.ilI6N3GY-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) drivers/net/ethernet/linkdata/sxe/sxepf/sxe_csum.c: note: in included file: >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:134:36: sparse: sparse: invalid assignment: |= drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:134:36: sparse: left side has type restricted __le32 drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:134:36: sparse: right side has type unsigned int drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:115:36: sparse: sparse: invalid assignment: |= drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:115:36: sparse: left side has type restricted __le32 drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:115:36: sparse: right side has type unsigned int drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:121:36: sparse: sparse: invalid assignment: &= drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:121:36: sparse: left side has type restricted __le32 drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:121:36: sparse: right side has type int drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:122:36: sparse: sparse: invalid assignment: |= drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:122:36: sparse: left side has type restricted __le32 drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:122:36: sparse: right side has type unsigned int -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_host_cli.c:174:30: sparse: sparse: symbol 'sxe_cdev_fops' was not declared. Should it be static? -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_host_hdc.c:42:1: sparse: sparse: symbol 'g_hdc_sema' was not declared. Should it be static? -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.c:505:36: sparse: sparse: invalid assignment: |= drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.c:505:36: sparse: left side has type restricted __le32 drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.c:505:36: sparse: right side has type int >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.c:507:41: sparse: sparse: cast from restricted __le32 drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.c:508:32: sparse: sparse: cast from restricted __le32 drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.c:509:41: sparse: sparse: cast from restricted __le32 drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.c:510:39: sparse: sparse: cast from restricted __le32 drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.c: note: in included file: drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:115:36: sparse: sparse: invalid assignment: |= drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:115:36: sparse: left side has type restricted __le32 drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:115:36: sparse: right side has type unsigned int drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:121:36: sparse: sparse: invalid assignment: &= drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:121:36: sparse: left side has type restricted __le32 drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:121:36: sparse: right side has type int drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:122:36: sparse: sparse: invalid assignment: |= drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:122:36: sparse: left side has type restricted __le32 drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:122:36: sparse: right side has type unsigned int >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:134:36: sparse: sparse: invalid assignment: |= drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:134:36: sparse: left side has type restricted __le32 drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:134:36: sparse: right side has type unsigned int >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:147:34: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 [usertype] mss_l4len_idx @@ got unsigned int [usertype] mss_l4len @@ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:147:34: sparse: expected restricted __le32 [usertype] mss_l4len_idx drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:147:34: sparse: got unsigned int [usertype] mss_l4len drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:128:36: sparse: sparse: invalid assignment: |= drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:128:36: sparse: left side has type restricted __le32 drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:128:36: sparse: right side has type unsigned int drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:121:36: sparse: sparse: invalid assignment: &= drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:121:36: sparse: left side has type restricted __le32 drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:121:36: sparse: right side has type int drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:122:36: sparse: sparse: invalid assignment: |= drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:122:36: sparse: left side has type restricted __le32 drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:122:36: sparse: right side has type unsigned int -- drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_csum.c: note: in included file: >> drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_tx_proc.h:103:36: sparse: sparse: invalid assignment: |= drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_tx_proc.h:103:36: sparse: left side has type restricted __le32 drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_tx_proc.h:103:36: sparse: right side has type unsigned int drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_tx_proc.h:77:36: sparse: sparse: invalid assignment: |= drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_tx_proc.h:77:36: sparse: left side has type restricted __le32 drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_tx_proc.h:77:36: sparse: right side has type unsigned int drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_tx_proc.h:83:36: sparse: sparse: invalid assignment: &= drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_tx_proc.h:83:36: sparse: left side has type restricted __le32 drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_tx_proc.h:83:36: sparse: right side has type int drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_tx_proc.h:84:36: sparse: sparse: invalid assignment: |= drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_tx_proc.h:84:36: sparse: left side has type restricted __le32 drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_tx_proc.h:84:36: sparse: right side has type unsigned int vim +134 drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h 130 131 static inline void 132 sxe_ctxt_desc_tucmd_set(struct sxe_tx_context_desc *ctxt_desc, u32 tucmd) 133 { > 134 ctxt_desc->type_tucmd_mlhl |= tucmd; 135 } 136 137 static inline void 138 sxe_ctxt_desc_sa_idx_set(struct sxe_tx_context_desc *ctxt_desc, u32 sa_idx) 139 { 140 ctxt_desc->sa_idx = sa_idx; 141 } 142 143 static inline void 144 sxe_ctxt_desc_mss_l4len_set(struct sxe_tx_context_desc *ctxt_desc, 145 u32 mss_l4len) 146 { > 147 ctxt_desc->mss_l4len_idx = mss_l4len; 148 } 149 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2882/2882] drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_main.c:32:19: sparse: sparse: symbol 'g_netdev' was not declared. Should it be static?
by kernel test robot 02 May '25

02 May '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 46abe407b020831448331eea487e07c883e95836 commit: 8cee206b5558245197158bd20895f95cc28d8468 [2882/2882] Ethernet: Linkdata: Supports Linkdata ethernet Controllers config: x86_64-randconfig-123-20250502 (https://download.01.org/0day-ci/archive/20250502/202505021040.redoLH7C-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250502/202505021040.redoLH7C-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202505021040.redoLH7C-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_main.c:32:19: sparse: sparse: symbol 'g_netdev' was not declared. Should it be static? >> drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_main.c:262:22: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void const *reg @@ drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_main.c:262:22: sparse: expected void const volatile [noderef] __iomem *addr drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_main.c:262:22: sparse: got void const *reg >> drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_main.c:267:23: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void *reg @@ drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_main.c:267:23: sparse: expected void volatile [noderef] __iomem *addr drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_main.c:267:23: sparse: got void *reg vim +/g_netdev +32 drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_main.c 30 31 static struct workqueue_struct *sxevf_wq; > 32 struct net_device *g_netdev; 33 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2882/2882] drivers/net/ethernet/linkdata/sxe/sxepf/sxe_main.c:1071:12: error: 'sxe_resume' defined but not used
by kernel test robot 02 May '25

02 May '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 46abe407b020831448331eea487e07c883e95836 commit: 8cee206b5558245197158bd20895f95cc28d8468 [2882/2882] Ethernet: Linkdata: Supports Linkdata ethernet Controllers config: x86_64-randconfig-122-20250502 (https://download.01.org/0day-ci/archive/20250502/202505020850.kZitpRTl-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250502/202505020850.kZitpRTl-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202505020850.kZitpRTl-lkp@intel.com/ All errors (new ones prefixed by >>): drivers/net/ethernet/linkdata/sxe/sxepf/sxe_main.c:70:6: error: no previous prototype for 'sxe_allow_inval_mac' [-Werror=missing-prototypes] 70 | bool sxe_allow_inval_mac(void) | ^~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_main.c:1071:12: error: 'sxe_resume' defined but not used [-Werror=unused-function] 1071 | static int sxe_resume(struct device *dev) | ^~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_main.c:1038:12: error: 'sxe_suspend' defined but not used [-Werror=unused-function] 1038 | static int sxe_suspend(struct device *dev) | ^~~~~~~~~~~ cc1: all warnings being treated as errors -- >> drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_main.c:543:12: error: 'sxevf_resume' defined but not used [-Werror=unused-function] 543 | static s32 sxevf_resume(struct device *dev) | ^~~~~~~~~~~~ cc1: all warnings being treated as errors vim +/sxe_resume +1071 drivers/net/ethernet/linkdata/sxe/sxepf/sxe_main.c 1036 1037 #ifdef CONFIG_PM > 1038 static int sxe_suspend(struct device *dev) 1039 { 1040 struct pci_dev *pdev = to_pci_dev(dev); 1041 int ret; 1042 bool wol_enable; 1043 struct sxe_adapter *adapter = pci_get_drvdata(pdev); 1044 struct sxe_hw *hw = &adapter->hw; 1045 1046 ret = __sxe_shutdown(pdev, &wol_enable); 1047 1048 cancel_work_sync(&adapter->monitor_ctxt.work); 1049 cancel_work_sync(&adapter->hdc_ctxt.time_sync_work); 1050 1051 sxe_hdc_channel_destroy(hw); 1052 if (ret) { 1053 LOG_ERROR_BDF("driver shutdown err:%d\n", ret); 1054 goto l_ret; 1055 } 1056 1057 LOG_DEBUG_BDF("pci dev[%p], wol_enable:%s\n", pdev, 1058 wol_enable ? "yes" : "no"); 1059 1060 if (wol_enable) { 1061 pci_prepare_to_sleep(pdev); 1062 } else { 1063 pci_wake_from_d3(pdev, false); 1064 pci_set_power_state(pdev, PCI_D3hot); 1065 } 1066 1067 l_ret: 1068 return ret; 1069 } 1070 > 1071 static int sxe_resume(struct device *dev) 1072 { 1073 struct pci_dev *pdev = to_pci_dev(dev); 1074 struct sxe_adapter *adapter = pci_get_drvdata(pdev); 1075 struct net_device *netdev = adapter->netdev; 1076 s32 ret; 1077 #ifdef SXE_WOL_CONFIGURE 1078 struct sxe_hw *hw = &adapter->hw; 1079 #endif 1080 1081 pci_set_power_state(pdev, PCI_D0); 1082 pci_restore_state(pdev); 1083 1084 pci_save_state(pdev); 1085 1086 ret = pci_enable_device_mem(pdev); 1087 if (ret) { 1088 LOG_DEV_ERR("cannot enable pci device from suspend\n"); 1089 goto l_ret; 1090 } 1091 1092 /* in order to force CPU ordering */ 1093 smp_mb__before_atomic(); 1094 clear_bit(SXE_DISABLED, &adapter->state); 1095 pci_set_master(pdev); 1096 1097 pci_wake_from_d3(pdev, false); 1098 1099 sxe_hdc_available_set(1); 1100 1101 sxe_reset(adapter); 1102 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2882/2882] drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c:2327:6: sparse: sparse: symbol 'mcp251xfd_tx_obj_write_sync' was not declared. Should it be static?
by kernel test robot 02 May '25

02 May '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 46abe407b020831448331eea487e07c883e95836 commit: b4eaf3e808dc2abcab55bc72df3b0d15961f33f0 [2882/2882] can: mcp251xfd: fix infinite loop when xmit fails config: x86_64-randconfig-123-20250502 (https://download.01.org/0day-ci/archive/20250502/202505020705.McaLXQv7-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250502/202505020705.McaLXQv7-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202505020705.McaLXQv7-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c:2327:6: sparse: sparse: symbol 'mcp251xfd_tx_obj_write_sync' was not declared. Should it be static? vim +/mcp251xfd_tx_obj_write_sync +2327 drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c 2326 > 2327 void mcp251xfd_tx_obj_write_sync(struct work_struct *work) 2328 { 2329 struct mcp251xfd_priv *priv = container_of(work, struct mcp251xfd_priv, 2330 tx_work); 2331 struct mcp251xfd_tx_obj *tx_obj = priv->tx_work_obj; 2332 struct mcp251xfd_tx_ring *tx_ring = priv->tx; 2333 int err; 2334 2335 err = spi_sync(priv->spi, &tx_obj->msg); 2336 if (err) 2337 mcp251xfd_tx_failure_drop(priv, tx_ring, err); 2338 } 2339 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1365/1365] drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed.
by kernel test robot 01 May '25

01 May '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: a48a35466505c8a52da57596944bd0b4485e825f commit: b8815fbbe89b0d15fa3296c3e57d2197a92f5bc0 [1365/1365] ACPI: CPPC: Fix cppc_cpufreq_init failed in CPU Hotplug situation config: x86_64-randconfig-102-20250103 (https://download.01.org/0day-ci/archive/20250501/202505010210.KOXBibOl-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202505010210.KOXBibOl-lkp@intel.com/ cocci warnings: (new ones prefixed by >>) >> drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed. vim +614 drivers/acpi/cppc_acpi.c 576 577 int acpi_get_psd_map(struct cppc_cpudata **all_cpu_data) 578 { 579 struct cpc_desc **cpc_pptr, *cpc_ptr; 580 int parsed_core_num = 0; 581 int i, ret; 582 583 cpc_pptr = kcalloc(num_possible_cpus(), sizeof(void *), GFP_KERNEL); 584 if (!cpc_pptr) 585 return -ENOMEM; 586 for_each_possible_cpu(i) { 587 cpc_pptr[i] = kzalloc(sizeof(struct cpc_desc), GFP_KERNEL); 588 if (!cpc_pptr[i]) { 589 ret = -ENOMEM; 590 goto out; 591 } 592 } 593 594 /* 595 * We can not use acpi_get_devices() to walk the processor devices 596 * because some processor device is not present. 597 */ 598 ret = acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_ROOT_OBJECT, 599 ACPI_UINT32_MAX, acpi_parse_cpc, NULL, 600 cpc_pptr, (void **)&parsed_core_num); 601 if (ret) 602 goto out; 603 if (parsed_core_num != num_possible_cpus()) { 604 ret = -EINVAL; 605 goto out; 606 } 607 608 ret = __acpi_get_psd_map(all_cpu_data, cpc_pptr); 609 610 out: 611 for_each_possible_cpu(i) { 612 cpc_ptr = cpc_pptr[i]; 613 if (cpc_ptr) > 614 kfree(cpc_ptr); 615 } 616 kfree(cpc_pptr); 617 618 return ret; 619 } 620 EXPORT_SYMBOL_GPL(acpi_get_psd_map); 621 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2195/2195] drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:66: warning: Cannot understand * @force_free:
by kernel test robot 01 May '25

01 May '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 241523b7d82e629fd115303840c385702bf2ea5e commit: 2e6ffd454acd9b4432dfee6868f3c00be7df0b6c [2195/2195] RNP: NET: Fix rnp errors dmesg show in hygon config: loongarch-allmodconfig (https://download.01.org/0day-ci/archive/20250501/202505010014.X9c71jEV-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250501/202505010014.X9c71jEV-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202505010014.X9c71jEV-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:66: warning: Cannot understand * @force_free: on line 66 - I thought it was a doc line vim +66 drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c 64 65 /** > 66 * @force_free: 67 * true: no other reference to this cookie, it is save to mark cookie reusable 68 * false: cookie may used by other(firmware), only available after 2min 69 **/ 70 static void mbx_free_cookie(struct mbx_req_cookie *cookie, bool force_free) 71 { 72 if (!cookie) 73 return; 74 75 if (force_free) { 76 cookie->stat = COOKIE_FREE; 77 } else { 78 cookie->stat = COOKIE_FREE_WAIT_TIMEOUT; 79 } 80 } 81 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1605/1605] block/blk-core.c:158:18: sparse: sparse: incorrect type in initializer (different address spaces)
by kernel test robot 30 Apr '25

30 Apr '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: a48a35466505c8a52da57596944bd0b4485e825f commit: f39ebff66fab7eee91421258aa7254ee0bbac778 [1605/1605] block: support to dispatch bio asynchronously config: x86_64-randconfig-r112-20250430 (https://download.01.org/0day-ci/archive/20250430/202504302251.rkbjGYqc-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250430/202504302251.rkbjGYqc-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504302251.rkbjGYqc-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> block/blk-core.c:158:18: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected void const [noderef] __percpu *__vpp_verify @@ got struct bio_dispatch_async_ctl [noderef] __percpu ** @@ block/blk-core.c:158:18: sparse: expected void const [noderef] __percpu *__vpp_verify block/blk-core.c:158:18: sparse: got struct bio_dispatch_async_ctl [noderef] __percpu ** >> block/blk-core.c:158:17: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct bio_dispatch_async_ctl *ctl @@ got struct bio_dispatch_async_ctl [noderef] __percpu * @@ block/blk-core.c:158:17: sparse: expected struct bio_dispatch_async_ctl *ctl block/blk-core.c:158:17: sparse: got struct bio_dispatch_async_ctl [noderef] __percpu * block/blk-core.c:222:18: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected void const [noderef] __percpu *__vpp_verify @@ got struct bio_dispatch_async_ctl [noderef] __percpu ** @@ block/blk-core.c:222:18: sparse: expected void const [noderef] __percpu *__vpp_verify block/blk-core.c:222:18: sparse: got struct bio_dispatch_async_ctl [noderef] __percpu ** block/blk-core.c:222:17: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct bio_dispatch_async_ctl *ctl @@ got struct bio_dispatch_async_ctl [noderef] __percpu * @@ block/blk-core.c:222:17: sparse: expected struct bio_dispatch_async_ctl *ctl block/blk-core.c:222:17: sparse: got struct bio_dispatch_async_ctl [noderef] __percpu * >> block/blk-core.c:259:32: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct bio_dispatch_async_ctl [noderef] __percpu **static [toplevel] bio_dispatch_async_ctl @@ got struct bio_dispatch_async_ctl *[noderef] __percpu * @@ block/blk-core.c:259:32: sparse: expected struct bio_dispatch_async_ctl [noderef] __percpu **static [toplevel] bio_dispatch_async_ctl block/blk-core.c:259:32: sparse: got struct bio_dispatch_async_ctl *[noderef] __percpu * block/blk-core.c:269:18: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected void const [noderef] __percpu *__vpp_verify @@ got struct bio_dispatch_async_ctl [noderef] __percpu ** @@ block/blk-core.c:269:18: sparse: expected void const [noderef] __percpu *__vpp_verify block/blk-core.c:269:18: sparse: got struct bio_dispatch_async_ctl [noderef] __percpu ** >> block/blk-core.c:269:59: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct bio_dispatch_async_ctl [noderef] __percpu * @@ got struct bio_dispatch_async_ctl *ctl @@ block/blk-core.c:269:59: sparse: expected struct bio_dispatch_async_ctl [noderef] __percpu * block/blk-core.c:269:59: sparse: got struct bio_dispatch_async_ctl *ctl block/blk-core.c: note: in included file: include/linux/backing-dev.h:511:19: sparse: sparse: incompatible types in comparison expression (different address spaces): include/linux/backing-dev.h:511:19: sparse: struct rcu_device [noderef] __rcu * include/linux/backing-dev.h:511:19: sparse: struct rcu_device * block/blk-core.c: In function 'blk_account_io_completion': block/blk-core.c:2999:21: warning: variable 'cpu' set but not used [-Wunused-but-set-variable] 2999 | int cpu; | ^~~ vim +158 block/blk-core.c 152 153 static int bio_dispatch_work(void *data) 154 { 155 int loop_count = 0; 156 int cpu = smp_processor_id(); 157 struct bio_dispatch_async_ctl *ctl = > 158 *per_cpu_ptr(bio_dispatch_async_ctl, cpu); 159 160 for (;; loop_count++) { 161 struct bio_list bio_list_on_stack; 162 struct blk_plug plug; 163 struct bio *bio; 164 int count; 165 166 bio_list_init(&bio_list_on_stack); 167 count = collect_bio(ctl, &bio_list_on_stack); 168 169 if (!count) { 170 DEFINE_WAIT(wait); 171 172 for (;;) { 173 prepare_to_wait(&ctl->wait, &wait, 174 TASK_INTERRUPTIBLE); 175 count = collect_bio(ctl, &bio_list_on_stack); 176 if (count) 177 break; 178 schedule(); 179 loop_count = 0; 180 } 181 finish_wait(&ctl->wait, &wait); 182 183 } 184 185 blk_start_plug(&plug); 186 while ((bio = bio_list_pop(&bio_list_on_stack))) { 187 struct request_queue *q = bio->bi_disk->queue; 188 189 q->make_request_fn(q, bio); 190 } 191 blk_finish_plug(&plug); 192 193 /* prevent soft lockup */ 194 if (loop_count >= BIO_DISPATCH_MAX_LOOP) { 195 loop_count = 0; 196 cond_resched(); 197 } 198 } 199 200 return 0; 201 } 202 203 static int get_dispatch_cpu(struct request_queue *q, int cpu) 204 { 205 int *last_dispatch_cpu = per_cpu_ptr(q->last_dispatch_cpu, cpu); 206 207 cpu = cpumask_next(*last_dispatch_cpu, &q->dispatch_async_cpus); 208 if (cpu >= nr_cpu_ids) 209 cpu = cpumask_first(&q->dispatch_async_cpus); 210 211 *last_dispatch_cpu = cpu; 212 213 return cpu; 214 } 215 216 static void blk_queue_make_request_async(struct bio *bio) 217 { 218 struct request_queue *q = bio->bi_disk->queue; 219 int cpu = smp_processor_id(); 220 int dispatch_cpu = get_dispatch_cpu(q, cpu); 221 struct bio_dispatch_async_ctl *ctl = 222 *per_cpu_ptr(bio_dispatch_async_ctl, dispatch_cpu); 223 224 spin_lock_irq(bio_async_lock(ctl, cpu)); 225 bio_list_add(bio_async_list(ctl, cpu), bio); 226 spin_unlock_irq(bio_async_lock(ctl, cpu)); 227 228 if (wq_has_sleeper(&ctl->wait)) 229 wake_up(&ctl->wait); 230 } 231 232 static blk_qc_t blk_queue_do_make_request(struct bio *bio) 233 { 234 struct request_queue *q = bio->bi_disk->queue; 235 int cpu = smp_processor_id(); 236 237 /* 238 * Don't dispatch bio asynchronously in following cases: 239 * 240 * 1) QUEUE_FLAG_DISPATCH_ASYNC is not set; 241 * 2) current cpu is the target cpu; 242 * 3) bio is flagged no wait; 243 * 4) TODO: return value of submit_bio() will be used in io polling. 244 */ 245 if (!test_bit(QUEUE_FLAG_DISPATCH_ASYNC, &q->queue_flags) || 246 cpumask_test_cpu(cpu, &q->dispatch_async_cpus) || 247 bio->bi_opf & REQ_NOWAIT) 248 return q->make_request_fn(q, bio); 249 250 /* return value is not concerned */ 251 blk_queue_make_request_async(bio); 252 return BLK_QC_T_NONE; 253 } 254 255 static void init_blk_queue_async_dispatch(void) 256 { 257 int cpu; 258 > 259 bio_dispatch_async_ctl = alloc_percpu(struct bio_dispatch_async_ctl *); 260 if (!bio_dispatch_async_ctl) 261 panic("Failed to alloc bio_dispatch_async_ctl\n"); 262 263 for_each_possible_cpu(cpu) { 264 int i; 265 struct bio_dispatch_async_ctl *ctl = 266 kmalloc(sizeof(struct bio_dispatch_async_ctl), 267 GFP_KERNEL | __GFP_NOFAIL); 268 > 269 *per_cpu_ptr(bio_dispatch_async_ctl, cpu) = ctl; 270 271 ctl->thread = 272 kthread_create_on_cpu(bio_dispatch_work, NULL, cpu, 273 "bio_dispatch_work_%u"); 274 if (IS_ERR_OR_NULL(ctl->thread)) 275 panic("Failed to create bio dispatch thread\n"); 276 277 ctl->list = kmalloc_array(nr_cpu_ids, 278 sizeof(struct bio_list) << BIO_ASYNC_LIST_SHIFT, 279 GFP_KERNEL | __GFP_NOFAIL); 280 ctl->lock = kmalloc_array(nr_cpu_ids, 281 sizeof(spinlock_t) << BIO_ASYNC_LOCK_SHIFT, 282 GFP_KERNEL | __GFP_NOFAIL); 283 for (i = 0; i < nr_cpu_ids; ++i) { 284 bio_list_init(bio_async_list(ctl, i)); 285 spin_lock_init(bio_async_lock(ctl, i)); 286 } 287 288 wake_up_process(ctl->thread); 289 init_waitqueue_head(&ctl->wait); 290 } 291 } 292 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2880/2880] drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf.h: sxe_errno.h is included more than once.
by kernel test robot 30 Apr '25

30 Apr '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 46abe407b020831448331eea487e07c883e95836 commit: 8cee206b5558245197158bd20895f95cc28d8468 [2880/2880] Ethernet: Linkdata: Supports Linkdata ethernet Controllers compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504302232.oeU1VyOU-lkp@intel.com/ includecheck warnings: (new ones prefixed by >>) >> drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf.h: sxe_errno.h is included more than once. -- >> drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c: sxevf_hw.h is included more than once. >> drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c: sxevf.h is included more than once. -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_netdev.c: sxe_netdev.h is included more than once. -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_sriov.c: sxe_ipsec.h is included more than once. -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_main.c: linux/moduleparam.h is included more than once. -- >> drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_netdev.c: sxevf_hw.h is included more than once. vim +25 drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf.h 18 19 #include "sxe_log.h" 20 #include "sxevf_hw.h" 21 #include "sxevf_ring.h" 22 #include "sxevf_irq.h" 23 #include "sxevf_monitor.h" 24 #include "sxevf_ipsec.h" > 25 #include "sxe_errno.h" 26 #include "sxe_compat.h" > 27 #include "sxe_errno.h" 28 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] arp: use RCU protection in arp_xmit()
by Dong Chenchen 30 Apr '25

30 Apr '25

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.14-rc3 commit a42b69f692165ec39db42d595f4f65a4c8f42e44 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC8P CVE: CVE-2025-21762 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- arp_xmit() can be called without RTNL or RCU protection. Use RCU protection to avoid potential UAF. Fixes: 29a26a568038 ("netfilter: Pass struct net into the netfilter hooks") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Link: https://patch.msgid.link/20250207135841.1948589-5-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ipv4/arp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c index 6185e50c1972..74e27a60ace9 100644 --- a/net/ipv4/arp.c +++ b/net/ipv4/arp.c @@ -637,10 +637,12 @@ static int arp_xmit_finish(struct net *net, struct sock *sk, struct sk_buff *skb */ void arp_xmit(struct sk_buff *skb) { + rcu_read_lock(); /* Send it off, maybe filter it using firewalling first. */ NF_HOOK(NFPROTO_ARP, NF_ARP_OUT, - dev_net(skb->dev), NULL, skb, NULL, skb->dev, + dev_net_rcu(skb->dev), NULL, skb, NULL, skb->dev, arp_xmit_finish); + rcu_read_unlock(); } EXPORT_SYMBOL(arp_xmit); -- 2.25.1

2 1

[PATCH OLK-5.10] openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
by Dong Chenchen 30 Apr '25

30 Apr '25

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.14-rc3 commit 90b2f49a502fa71090d9f4fe29a2f51fe5dff76d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC5W CVE: CVE-2025-21761 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ovs_vport_cmd_fill_info() can be called without RTNL or RCU. Use RCU protection and dev_net_rcu() to avoid potential UAF. Fixes: 9354d4520342 ("openvswitch: reliable interface indentification in port dumps") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Link: https://patch.msgid.link/20250207135841.1948589-6-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/openvswitch/datapath.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c index b625ab5e9a43..b493931433e9 100644 --- a/net/openvswitch/datapath.c +++ b/net/openvswitch/datapath.c @@ -1980,6 +1980,7 @@ static int ovs_vport_cmd_fill_info(struct vport *vport, struct sk_buff *skb, { struct ovs_header *ovs_header; struct ovs_vport_stats vport_stats; + struct net *net_vport; int err; ovs_header = genlmsg_put(skb, portid, seq, &dp_vport_genl_family, @@ -1996,12 +1997,15 @@ static int ovs_vport_cmd_fill_info(struct vport *vport, struct sk_buff *skb, nla_put_u32(skb, OVS_VPORT_ATTR_IFINDEX, vport->dev->ifindex)) goto nla_put_failure; - if (!net_eq(net, dev_net(vport->dev))) { - int id = peernet2id_alloc(net, dev_net(vport->dev), gfp); + rcu_read_lock(); + net_vport = dev_net_rcu(vport->dev); + if (!net_eq(net, net_vport)) { + int id = peernet2id_alloc(net, net_vport, GFP_ATOMIC); if (nla_put_s32(skb, OVS_VPORT_ATTR_NETNSID, id)) - goto nla_put_failure; + goto nla_put_failure_unlock; } + rcu_read_unlock(); ovs_vport_get_stats(vport, &vport_stats); if (nla_put_64bit(skb, OVS_VPORT_ATTR_STATS, @@ -2019,6 +2023,8 @@ static int ovs_vport_cmd_fill_info(struct vport *vport, struct sk_buff *skb, genlmsg_end(skb, ovs_header); return 0; +nla_put_failure_unlock: + rcu_read_unlock(); nla_put_failure: err = -EMSGSIZE; error: -- 2.25.1

2 1

[PATCH OLK-5.10 0/2] net: Fix CVE-2025-21763
by Dong Chenchen 30 Apr '25

30 Apr '25

Fix CVE-2025-21763 Eric Dumazet (1): neighbour: use RCU protection in __neigh_notify() Li Zetao (1): neighbour: delete redundant judgment statements net/core/neighbour.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS] net: openvswitch: fix leak of nested actions
by Dong Chenchen 30 Apr '25

30 Apr '25

From: Ilya Maximets <i.maximets(a)ovn.org> stable inclusion from stable-4.19.249 commit 7438dc55c0709819b813f4778aec2c48b782990b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP3FB CVE: CVE-2022-49086 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 1f30fb9166d4f15a1aa19449b9da871fe0ed4796 upstream. While parsing user-provided actions, openvswitch module may dynamically allocate memory and store pointers in the internal copy of the actions. So this memory has to be freed while destroying the actions. Currently there are only two such actions: ct() and set(). However, there are many actions that can hold nested lists of actions and ovs_nla_free_flow_actions() just jumps over them leaking the memory. For example, removal of the flow with the following actions will lead to a leak of the memory allocated by nf_ct_tmpl_alloc(): actions:clone(ct(commit),0) Non-freed set() action may also leak the 'dst' structure for the tunnel info including device references. Under certain conditions with a high rate of flow rotation that may cause significant memory leak problem (2MB per second in reporter's case). The problem is also hard to mitigate, because the user doesn't have direct control over the datapath flows generated by OVS. Fix that by iterating over all the nested actions and freeing everything that needs to be freed recursively. New build time assertion should protect us from this problem if new actions will be added in the future. Unfortunately, openvswitch module doesn't use NLA_F_NESTED, so all attributes has to be explicitly checked. sample() and clone() actions are mixing extra attributes into the user-provided action list. That prevents some code generalization too. Fixes: 34ae932a4036 ("openvswitch: Make tunnel set action attach a metadata dst") Link: https://mail.openvswitch.org/pipermail/ovs-dev/2022-March/392922.html Reported-by: Stéphane Graber <stgraber(a)ubuntu.com> Signed-off-by: Ilya Maximets <i.maximets(a)ovn.org> Acked-by: Aaron Conole <aconole(a)redhat.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> [Backport for 4.19: Removed handling of OVS_ACTION_ATTR_DEC_TTL and OVS_ACTION_ATTR_CHECK_PKT_LEN as these actions do not exist in this version. BUILD_BUG_ON condition adjusted accordingly.] Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/openvswitch/flow_netlink.c | 61 +++++++++++++++++++++++++++++++--- 1 file changed, 56 insertions(+), 5 deletions(-) diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c index 45acc612c73b..37bbe70893eb 100644 --- a/net/openvswitch/flow_netlink.c +++ b/net/openvswitch/flow_netlink.c @@ -2254,6 +2254,36 @@ static struct sw_flow_actions *nla_alloc_flow_actions(int size) return sfa; } +static void ovs_nla_free_nested_actions(const struct nlattr *actions, int len); + +static void ovs_nla_free_clone_action(const struct nlattr *action) +{ + const struct nlattr *a = nla_data(action); + int rem = nla_len(action); + + switch (nla_type(a)) { + case OVS_CLONE_ATTR_EXEC: + /* The real list of actions follows this attribute. */ + a = nla_next(a, &rem); + ovs_nla_free_nested_actions(a, rem); + break; + } +} + +static void ovs_nla_free_sample_action(const struct nlattr *action) +{ + const struct nlattr *a = nla_data(action); + int rem = nla_len(action); + + switch (nla_type(a)) { + case OVS_SAMPLE_ATTR_ARG: + /* The real list of actions follows this attribute. */ + a = nla_next(a, &rem); + ovs_nla_free_nested_actions(a, rem); + break; + } +} + static void ovs_nla_free_set_action(const struct nlattr *a) { const struct nlattr *ovs_key = nla_data(a); @@ -2267,25 +2297,46 @@ static void ovs_nla_free_set_action(const struct nlattr *a) } } -void ovs_nla_free_flow_actions(struct sw_flow_actions *sf_acts) +static void ovs_nla_free_nested_actions(const struct nlattr *actions, int len) { const struct nlattr *a; int rem; - if (!sf_acts) + /* Whenever new actions are added, the need to update this + * function should be considered. + */ + BUILD_BUG_ON(OVS_ACTION_ATTR_MAX != 20); + + if (!actions) return; - nla_for_each_attr(a, sf_acts->actions, sf_acts->actions_len, rem) { + nla_for_each_attr(a, actions, len, rem) { switch (nla_type(a)) { - case OVS_ACTION_ATTR_SET: - ovs_nla_free_set_action(a); + case OVS_ACTION_ATTR_CLONE: + ovs_nla_free_clone_action(a); break; + case OVS_ACTION_ATTR_CT: ovs_ct_free_action(a); break; + + case OVS_ACTION_ATTR_SAMPLE: + ovs_nla_free_sample_action(a); + break; + + case OVS_ACTION_ATTR_SET: + ovs_nla_free_set_action(a); + break; } } +} + +void ovs_nla_free_flow_actions(struct sw_flow_actions *sf_acts) +{ + if (!sf_acts) + return; + ovs_nla_free_nested_actions(sf_acts->actions, sf_acts->actions_len); kfree(sf_acts); } -- 2.25.1

2 1

[PATCH OLK-5.10] ndisc: extend RCU protection in ndisc_send_skb()
by Dong Chenchen 30 Apr '25

30 Apr '25

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.14-rc3 commit ed6ae1f325d3c43966ec1b62ac1459e2b8e45640 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC4V CVE: CVE-2025-21760 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ndisc_send_skb() can be called without RTNL or RCU held. Acquire rcu_read_lock() earlier, so that we can use dev_net_rcu() and avoid a potential UAF. Fixes: 1762f7e88eb3 ("[NETNS][IPV6] ndisc - make socket control per namespace") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Link: https://patch.msgid.link/20250207135841.1948589-8-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv6/ndisc.c [commit 696c65444120 modify param format of ndisc_send_skb(), which not merged lead to context confict] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ipv6/ndisc.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c index 5134fa7f2888..8155fdb7b0f4 100644 --- a/net/ipv6/ndisc.c +++ b/net/ipv6/ndisc.c @@ -469,16 +469,20 @@ static void ndisc_send_skb(struct sk_buff *skb, const struct in6_addr *daddr, const struct in6_addr *saddr) { + struct icmp6hdr *icmp6h = icmp6_hdr(skb); struct dst_entry *dst = skb_dst(skb); - struct net *net = dev_net(skb->dev); - struct sock *sk = net->ipv6.ndisc_sk; struct inet6_dev *idev; + struct net *net; + struct sock *sk; int err; - struct icmp6hdr *icmp6h = icmp6_hdr(skb); u8 type; type = icmp6h->icmp6_type; + rcu_read_lock(); + + net = dev_net_rcu(skb->dev); + sk = net->ipv6.ndisc_sk; if (!dst) { struct flowi6 fl6; int oif = skb->dev->ifindex; @@ -486,6 +490,7 @@ static void ndisc_send_skb(struct sk_buff *skb, icmpv6_flow_init(sk, &fl6, type, saddr, daddr, oif); dst = icmp6_dst_alloc(skb->dev, &fl6); if (IS_ERR(dst)) { + rcu_read_unlock(); kfree_skb(skb); return; } @@ -500,7 +505,6 @@ static void ndisc_send_skb(struct sk_buff *skb, ip6_nd_hdr(skb, saddr, daddr, inet6_sk(sk)->hop_limit, skb->len); - rcu_read_lock(); idev = __in6_dev_get(dst->dev); IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, skb->len); -- 2.25.1

2 1

[PATCH OLK-5.10] ipv6: mcast: extend RCU protection in igmp6_send()
by Dong Chenchen 30 Apr '25

30 Apr '25

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.14-rc3 commit 087c1faa594fa07a66933d750c0b2610aa1a2946 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC5R CVE: CVE-2025-21759 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- igmp6_send() can be called without RTNL or RCU being held. Extend RCU protection so that we can safely fetch the net pointer and avoid a potential UAF. Note that we no longer can use sock_alloc_send_skb() because ipv6.igmp_sk uses GFP_KERNEL allocations which can sleep. Instead use alloc_skb() and charge the net->ipv6.igmp_sk socket under RCU protection. Fixes: b8ad0cbc58f7 ("[NETNS][IPV6] mcast - handle several network namespace") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Link: https://patch.msgid.link/20250207135841.1948589-9-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv6/mcast.c [commit b4a11b2033b7 separates OUTREQUESTS stastic from MIB_OUT, which not merged lead to context conflicts] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ipv6/mcast.c | 33 +++++++++++++++------------------ 1 file changed, 15 insertions(+), 18 deletions(-) diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c index 9fb5077f8e9a..95b7f3216491 100644 --- a/net/ipv6/mcast.c +++ b/net/ipv6/mcast.c @@ -1974,21 +1974,21 @@ static void mld_send_cr(struct inet6_dev *idev) static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type) { - struct net *net = dev_net(dev); - struct sock *sk = net->ipv6.igmp_sk; + const struct in6_addr *snd_addr, *saddr; + int err, len, payload_len, full_len; + struct in6_addr addr_buf; struct inet6_dev *idev; struct sk_buff *skb; struct mld_msg *hdr; - const struct in6_addr *snd_addr, *saddr; - struct in6_addr addr_buf; int hlen = LL_RESERVED_SPACE(dev); int tlen = dev->needed_tailroom; - int err, len, payload_len, full_len; u8 ra[8] = { IPPROTO_ICMPV6, 0, IPV6_TLV_ROUTERALERT, 2, 0, 0, IPV6_TLV_PADN, 0 }; - struct flowi6 fl6; struct dst_entry *dst; + struct flowi6 fl6; + struct net *net; + struct sock *sk; if (type == ICMPV6_MGM_REDUCTION) snd_addr = &in6addr_linklocal_allrouters; @@ -1999,20 +1999,20 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type) payload_len = len + sizeof(ra); full_len = sizeof(struct ipv6hdr) + payload_len; - rcu_read_lock(); - IP6_UPD_PO_STATS(net, __in6_dev_get(dev), - IPSTATS_MIB_OUT, full_len); - rcu_read_unlock(); - - skb = sock_alloc_send_skb(sk, hlen + tlen + full_len, 1, &err); + skb = alloc_skb(hlen + tlen + full_len, GFP_KERNEL); + rcu_read_lock(); + net = dev_net_rcu(dev); + idev = __in6_dev_get(dev); + IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, full_len); if (!skb) { - rcu_read_lock(); - IP6_INC_STATS(net, __in6_dev_get(dev), - IPSTATS_MIB_OUTDISCARDS); + IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS); rcu_read_unlock(); return; } + sk = net->ipv6.igmp_sk; + skb_set_owner_w(skb, sk); + skb->priority = TC_PRIO_CONTROL; skb_reserve(skb, hlen); @@ -2037,9 +2037,6 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type) IPPROTO_ICMPV6, csum_partial(hdr, len, 0)); - rcu_read_lock(); - idev = __in6_dev_get(skb->dev); - icmpv6_flow_init(sk, &fl6, type, &ipv6_hdr(skb)->saddr, &ipv6_hdr(skb)->daddr, skb->dev->ifindex); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
by Dong Chenchen 30 Apr '25

30 Apr '25

From: Gavrilov Ilia <Ilia.Gavrilov(a)infotecs.ru> stable inclusion from stable-v4.19.270 commit dfd834ccc1b88bbbab81b9046a3a539dd0c2d14f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVWD CVE: CVE-2023-53032 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 9ea4b476cea1b7d461d16dda25ca3c7e616e2d15 upstream. When first_ip is 0, last_ip is 0xFFFFFFFF, and netmask is 31, the value of an arithmetic expression 2 << (netmask - mask_bits - 1) is subject to overflow due to a failure casting operands to a larger data type before performing the arithmetic. Note that it's harmless since the value will be checked at the next step. Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with SVACE. Fixes: b9fed748185a ("netfilter: ipset: Check and reject crazy /0 input parameters") Signed-off-by: Ilia.Gavrilov <Ilia.Gavrilov(a)infotecs.ru> Reviewed-by: Simon Horman <simon.horman(a)corigine.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/ipset/ip_set_bitmap_ip.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/netfilter/ipset/ip_set_bitmap_ip.c b/net/netfilter/ipset/ip_set_bitmap_ip.c index 49a6eec6f12f..b3ca8e87f629 100644 --- a/net/netfilter/ipset/ip_set_bitmap_ip.c +++ b/net/netfilter/ipset/ip_set_bitmap_ip.c @@ -296,8 +296,8 @@ bitmap_ip_create(struct net *net, struct ip_set *set, struct nlattr *tb[], return -IPSET_ERR_BITMAP_RANGE; pr_debug("mask_bits %u, netmask %u\n", mask_bits, netmask); - hosts = 2 << (32 - netmask - 1); - elements = 2 << (netmask - mask_bits - 1); + hosts = 2U << (32 - netmask - 1); + elements = 2UL << (netmask - mask_bits - 1); } if (elements > IPSET_BITMAP_MAX_RANGE + 1) return -IPSET_ERR_BITMAP_RANGE_SIZE; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] ndisc: extend RCU protection in ndisc_send_skb()
by Dong Chenchen 30 Apr '25

30 Apr '25

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.14-rc3 commit ed6ae1f325d3c43966ec1b62ac1459e2b8e45640 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC4V CVE: CVE-2025-21760 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ndisc_send_skb() can be called without RTNL or RCU held. Acquire rcu_read_lock() earlier, so that we can use dev_net_rcu() and avoid a potential UAF. Fixes: 1762f7e88eb3 ("[NETNS][IPV6] ndisc - make socket control per namespace") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Link: https://patch.msgid.link/20250207135841.1948589-8-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv6/ndisc.c [commit 696c65444120 modify param format of ndisc_send_skb(), which not merged lead to context confict] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ipv6/ndisc.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c index 5c1d092711aa..bd3153f5a63a 100644 --- a/net/ipv6/ndisc.c +++ b/net/ipv6/ndisc.c @@ -451,16 +451,20 @@ static void ndisc_send_skb(struct sk_buff *skb, const struct in6_addr *daddr, const struct in6_addr *saddr) { + struct icmp6hdr *icmp6h = icmp6_hdr(skb); struct dst_entry *dst = skb_dst(skb); - struct net *net = dev_net(skb->dev); - struct sock *sk = net->ipv6.ndisc_sk; struct inet6_dev *idev; + struct net *net; + struct sock *sk; int err; - struct icmp6hdr *icmp6h = icmp6_hdr(skb); u8 type; type = icmp6h->icmp6_type; + rcu_read_lock(); + + net = dev_net_rcu(skb->dev); + sk = net->ipv6.ndisc_sk; if (!dst) { struct flowi6 fl6; int oif = skb->dev->ifindex; @@ -468,6 +472,7 @@ static void ndisc_send_skb(struct sk_buff *skb, icmpv6_flow_init(sk, &fl6, type, saddr, daddr, oif); dst = icmp6_dst_alloc(skb->dev, &fl6); if (IS_ERR(dst)) { + rcu_read_unlock(); kfree_skb(skb); return; } @@ -482,7 +487,6 @@ static void ndisc_send_skb(struct sk_buff *skb, ip6_nd_hdr(skb, saddr, daddr, inet6_sk(sk)->hop_limit, skb->len); - rcu_read_lock(); idev = __in6_dev_get(dst->dev); IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, skb->len); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] ipv6: mcast: extend RCU protection in igmp6_send()
by Dong Chenchen 30 Apr '25

30 Apr '25

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.14-rc3 commit 087c1faa594fa07a66933d750c0b2610aa1a2946 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC5R CVE: CVE-2025-21759 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- igmp6_send() can be called without RTNL or RCU being held. Extend RCU protection so that we can safely fetch the net pointer and avoid a potential UAF. Note that we no longer can use sock_alloc_send_skb() because ipv6.igmp_sk uses GFP_KERNEL allocations which can sleep. Instead use alloc_skb() and charge the net->ipv6.igmp_sk socket under RCU protection. Fixes: b8ad0cbc58f7 ("[NETNS][IPV6] mcast - handle several network namespace") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Link: https://patch.msgid.link/20250207135841.1948589-9-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv6/mcast.c [commit b4a11b2033b7 separates OUTREQUESTS stastic from MIB_OUT, which not merged lead to context conflicts] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ipv6/mcast.c | 33 +++++++++++++++------------------ 1 file changed, 15 insertions(+), 18 deletions(-) diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c index 3d048401141f..d2b39d9af0a3 100644 --- a/net/ipv6/mcast.c +++ b/net/ipv6/mcast.c @@ -1979,21 +1979,21 @@ static void mld_send_cr(struct inet6_dev *idev) static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type) { - struct net *net = dev_net(dev); - struct sock *sk = net->ipv6.igmp_sk; + const struct in6_addr *snd_addr, *saddr; + int err, len, payload_len, full_len; + struct in6_addr addr_buf; struct inet6_dev *idev; struct sk_buff *skb; struct mld_msg *hdr; - const struct in6_addr *snd_addr, *saddr; - struct in6_addr addr_buf; int hlen = LL_RESERVED_SPACE(dev); int tlen = dev->needed_tailroom; - int err, len, payload_len, full_len; u8 ra[8] = { IPPROTO_ICMPV6, 0, IPV6_TLV_ROUTERALERT, 2, 0, 0, IPV6_TLV_PADN, 0 }; - struct flowi6 fl6; struct dst_entry *dst; + struct flowi6 fl6; + struct net *net; + struct sock *sk; if (type == ICMPV6_MGM_REDUCTION) snd_addr = &in6addr_linklocal_allrouters; @@ -2004,20 +2004,20 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type) payload_len = len + sizeof(ra); full_len = sizeof(struct ipv6hdr) + payload_len; - rcu_read_lock(); - IP6_UPD_PO_STATS(net, __in6_dev_get(dev), - IPSTATS_MIB_OUT, full_len); - rcu_read_unlock(); - - skb = sock_alloc_send_skb(sk, hlen + tlen + full_len, 1, &err); + skb = alloc_skb(hlen + tlen + full_len, GFP_KERNEL); + rcu_read_lock(); + net = dev_net_rcu(dev); + idev = __in6_dev_get(dev); + IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, full_len); if (!skb) { - rcu_read_lock(); - IP6_INC_STATS(net, __in6_dev_get(dev), - IPSTATS_MIB_OUTDISCARDS); + IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS); rcu_read_unlock(); return; } + sk = net->ipv6.igmp_sk; + skb_set_owner_w(skb, sk); + skb->priority = TC_PRIO_CONTROL; skb_reserve(skb, hlen); @@ -2042,9 +2042,6 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type) IPPROTO_ICMPV6, csum_partial(hdr, len, 0)); - rcu_read_lock(); - idev = __in6_dev_get(skb->dev); - icmpv6_flow_init(sk, &fl6, type, &ipv6_hdr(skb)->saddr, &ipv6_hdr(skb)->daddr, skb->dev->ifindex); -- 2.25.1

2 1

[PATCH OLK-5.10 0/2] fuse: support fastpath
by chenrenhui 30 Apr '25

30 Apr '25

Support fuse fastpath by using the newly added kernel_ipc module. chenrenhui (2): ipc: add kernel_ipc module to enable fast process switching fuse: support fastpath via kernel_ipc Kconfig | 2 + arch/arm64/configs/openeuler_defconfig | 2 + arch/x86/configs/openeuler_defconfig | 2 + fs/fuse/Kconfig | 9 + fs/fuse/dev.c | 744 +++++++++++++++++++++++++ fs/fuse/dir.c | 87 ++- fs/fuse/file.c | 235 +++++++- fs/fuse/fuse_i.h | 55 ++ fs/fuse/inode.c | 112 ++++ fs/fuse/readdir.c | 8 + include/linux/kernel_ipc.h | 48 ++ include/uapi/linux/fuse.h | 15 +- ipc/Kconfig | 5 + ipc/Makefile | 2 +- ipc/kernel_ipc.c | 301 ++++++++++ 15 files changed, 1599 insertions(+), 28 deletions(-) create mode 100644 include/linux/kernel_ipc.h create mode 100644 ipc/Kconfig create mode 100644 ipc/kernel_ipc.c -- 2.33.0

2 3

[PATCH openEuler-1.0-LTS 0/6] driver: base: fix UAF when driver_attach failed
by Yin Tirui 30 Apr '25

30 Apr '25

The following series contains six patches that fix UAF when driver_attach failed: Alexander Duyck (2): driver core: Probe devices asynchronously instead of the driver driver core: Attach devices on CPU local to device node Jason Gunthorpe (1): driver core: Pull required checks into driver_probe_device() Mark-PK Tsai (1): driver core: Prevent overriding async driver of a device before it probe Schspa Shi (1): driver: base: fix UAF when driver_attach failed Zhang Wensheng (1): driver core: fix potential deadlock in __driver_attach drivers/base/base.h | 2 ++ drivers/base/bus.c | 27 +++++---------------- drivers/base/dd.c | 59 ++++++++++++++++++++++++++++++++++++--------- 3 files changed, 55 insertions(+), 33 deletions(-) -- 2.22.0

2 7