- Kernel - mailweb.openeuler.org

[openeuler:OLK-6.6 3098/3098] arch/x86/kernel/cpu/bpf-rvi.c:129:25: warning: no previous prototype for 'bpf_arch_flags'
by kernel test robot 04 Nov '25

04 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: a29fc03bd0ddaf7388cf31604ef5bd9807585109 commit: c7103b690d364f20ccabd4acc558fa4a4b293364 [3098/3098] bpf: Add bpf_arch_flags kunc for x86 config: x86_64-randconfig-001-20251104 (https://download.01.org/0day-ci/archive/20251104/202511040644.p8pfMDIP-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251104/202511040644.p8pfMDIP-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511040644.p8pfMDIP-lkp@intel.com/ All warnings (new ones prefixed by >>): >> arch/x86/kernel/cpu/bpf-rvi.c:129:25: warning: no previous prototype for 'bpf_arch_flags' [-Wmissing-prototypes] 129 | __bpf_kfunc const char *bpf_arch_flags(enum arch_flags_type t, int i) | ^~~~~~~~~~~~~~ vim +/bpf_arch_flags +129 arch/x86/kernel/cpu/bpf-rvi.c 128 > 129 __bpf_kfunc const char *bpf_arch_flags(enum arch_flags_type t, int i) 130 { 131 switch (t) { 132 case X86_CAP: 133 return x86_cap_flags[i]; 134 case X86_BUG: 135 return x86_bug_flags[i]; 136 case X86_POWER: 137 return x86_power_flags[i]; 138 case X86_POWER_SIZE: 139 return (void *)ARRAY_SIZE(x86_power_flags); 140 default: 141 return NULL; 142 } 143 } 144 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3098/3098] drivers/iommu/hisilicon/ummu-core/core_iova.c:252:19: warning: no previous prototype for function 'dma_alloc_iova'
by kernel test robot 04 Nov '25

04 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: a29fc03bd0ddaf7388cf31604ef5bd9807585109 commit: 80e4e47da66d941f2265d9d6c449880553254119 [3098/3098] iommu/ummu-core: support IOVA on demand mapping config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20251104/202511040647.7fLTNmOG-lkp@…) compiler: clang version 19.1.7 (https://github.com/llvm/llvm-project cd708029e0b2869e80abe31ddb175f7c35361f90) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251104/202511040647.7fLTNmOG-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511040647.7fLTNmOG-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/iommu/hisilicon/ummu-core/core_iova.c:252:19: warning: no previous prototype for function 'dma_alloc_iova' [-Wmissing-prototypes] 252 | struct iova_slot *dma_alloc_iova(struct device *dev, size_t size, | ^ drivers/iommu/hisilicon/ummu-core/core_iova.c:252:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 252 | struct iova_slot *dma_alloc_iova(struct device *dev, size_t size, | ^ | static >> drivers/iommu/hisilicon/ummu-core/core_iova.c:290:6: warning: no previous prototype for function 'dma_free_iova' [-Wmissing-prototypes] 290 | void dma_free_iova(struct iova_slot *slot) | ^ drivers/iommu/hisilicon/ummu-core/core_iova.c:290:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 290 | void dma_free_iova(struct iova_slot *slot) | ^ | static >> drivers/iommu/hisilicon/ummu-core/core_iova.c:298:5: warning: no previous prototype for function 'ummu_fill_pages' [-Wmissing-prototypes] 298 | int ummu_fill_pages(struct iova_slot *slot, dma_addr_t iova, unsigned long nr_pages) | ^ drivers/iommu/hisilicon/ummu-core/core_iova.c:298:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 298 | int ummu_fill_pages(struct iova_slot *slot, dma_addr_t iova, unsigned long nr_pages) | ^ | static >> drivers/iommu/hisilicon/ummu-core/core_iova.c:333:5: warning: no previous prototype for function 'ummu_drain_pages' [-Wmissing-prototypes] 333 | int ummu_drain_pages(struct iova_slot *slot, dma_addr_t iova, unsigned long nr_pages) | ^ drivers/iommu/hisilicon/ummu-core/core_iova.c:333:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 333 | int ummu_drain_pages(struct iova_slot *slot, dma_addr_t iova, unsigned long nr_pages) | ^ | static 4 warnings generated. vim +/dma_alloc_iova +252 drivers/iommu/hisilicon/ummu-core/core_iova.c 251 > 252 struct iova_slot *dma_alloc_iova(struct device *dev, size_t size, 253 unsigned long attrs, dma_addr_t *iovap, 254 size_t *sizep) 255 { 256 struct iommu_domain *domain; 257 struct iova_slot *slot; 258 dma_addr_t iova; 259 int ret; 260 261 size = PAGE_ALIGN(size); 262 domain = iommu_get_domain_for_dev(dev); 263 if (!domain || !iommu_is_dma_domain(domain)) { 264 ret = -ENODEV; 265 goto err_out; 266 } 267 iova = domain_alloc_iova(domain, size, dev->coherent_dma_mask, dev); 268 if (!iova) { 269 ret = -EFAULT; 270 goto err_out; 271 } 272 273 slot = alloc_iova_slot(dev, iova, size, attrs); 274 if (!slot) { 275 ret = -ENOMEM; 276 goto err_free_iova; 277 } 278 279 *iovap = iova; 280 *sizep = size; 281 return slot; 282 283 err_free_iova: 284 domain_free_iova(domain, iova, size); 285 err_out: 286 return ERR_PTR(ret); 287 } 288 EXPORT_SYMBOL_GPL(dma_alloc_iova); 289 > 290 void dma_free_iova(struct iova_slot *slot) 291 { 292 drain_pages(slot, slot->iova, slot->nr_pages); 293 domain_free_iova(slot->domain, slot->iova, slot->nr_pages << PAGE_SHIFT); 294 free_iova_slot(slot); 295 } 296 EXPORT_SYMBOL_GPL(dma_free_iova); 297 > 298 int ummu_fill_pages(struct iova_slot *slot, dma_addr_t iova, unsigned long nr_pages) 299 { 300 struct page **pages; 301 unsigned long i; 302 int ret; 303 304 if (!IS_ALIGNED(iova, PAGE_SIZE) || !nr_pages) 305 return -EINVAL; 306 307 if (!check_iova_range(slot, iova, nr_pages)) 308 return -EINVAL; 309 310 if (!check_iova_bitmap_region(slot, iova_bitmap_offset(slot, iova), nr_pages, true)) 311 return -EEXIST; 312 313 pages = allocate_pages(slot->dev, nr_pages, GFP_KERNEL | __GFP_ZERO); 314 if (!pages) 315 return -ENOMEM; 316 317 ret = map_pages(slot, iova, nr_pages, pages); 318 if (ret != 0) 319 goto err_free_pages; 320 321 bitmap_set(slot->bitmap, iova_bitmap_offset(slot, iova), nr_pages); 322 kvfree(pages); 323 return 0; 324 325 err_free_pages: 326 for (i = 0; i < nr_pages; i++) 327 __free_page(pages[i]); 328 kvfree(pages); 329 return ret; 330 } 331 EXPORT_SYMBOL_GPL(ummu_fill_pages); 332 > 333 int ummu_drain_pages(struct iova_slot *slot, dma_addr_t iova, unsigned long nr_pages) -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3098/3098] mm/vmscan.o: warning: objtool: shrink_lruvec+0xbca: sibling call from callable instruction with modified stack frame
by kernel test robot 04 Nov '25

04 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: a29fc03bd0ddaf7388cf31604ef5bd9807585109 commit: 241ad43fe7e9c24d5ba4cdd1ec22e731cdd22d14 [3098/3098] Compiler: Add clang's PGO support for kernel. config: x86_64-randconfig-004-20251104 (https://download.01.org/0day-ci/archive/20251104/202511040559.zWQ5UJQg-lkp@…) compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251104/202511040559.zWQ5UJQg-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511040559.zWQ5UJQg-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from mm/vmscan.c:15: In file included from include/linux/mm.h:2235: include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ In file included from mm/vmscan.c:30: include/linux/mm_inline.h:47:41: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 47 | __mod_lruvec_state(lruvec, NR_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~ ^ ~~~ include/linux/mm_inline.h:49:22: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 49 | NR_ZONE_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~~~~~~ ^ ~~~ mm/vmscan.c:673:51: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 673 | size += zone_page_state(zone, NR_ZONE_LRU_BASE + lru); | ~~~~~~~~~~~~~~~~ ^ ~~~ mm/vmscan.c:2411:4: warning: arithmetic between different enumeration types ('enum vm_event_item' and 'enum zone_type') [-Wenum-enum-conversion] 2411 | __count_zid_vm_events(PGSCAN_SKIP, zid, nr_skipped[zid]); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:135:34: note: expanded from macro '__count_zid_vm_events' 135 | __count_vm_events(item##_NORMAL - ZONE_NORMAL + zid, delta) | ~~~~~~~~~~~~~ ^ ~~~~~~~~~~~ mm/vmscan.c:2919:51: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 2919 | inactive = lruvec_page_state(lruvec, NR_LRU_BASE + inactive_lru); | ~~~~~~~~~~~ ^ ~~~~~~~~~~~~ mm/vmscan.c:2920:49: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 2920 | active = lruvec_page_state(lruvec, NR_LRU_BASE + active_lru); | ~~~~~~~~~~~ ^ ~~~~~~~~~~ mm/vmscan.c:6914:3: warning: arithmetic between different enumeration types ('enum vm_event_item' and 'enum zone_type') [-Wenum-enum-conversion] 6914 | __count_zid_vm_events(ALLOCSTALL, sc->reclaim_idx, 1); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:135:34: note: expanded from macro '__count_zid_vm_events' 135 | __count_vm_events(item##_NORMAL - ZONE_NORMAL + zid, delta) | ~~~~~~~~~~~~~ ^ ~~~~~~~~~~~ 12 warnings generated. >> mm/vmscan.o: warning: objtool: shrink_lruvec+0xbca: sibling call from callable instruction with modified stack frame -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3098/3098] net/oenetcls/oenetcls_main.c:990:13: warning: 'set_netdev_xps_queue' defined but not used
by kernel test robot 04 Nov '25

04 Nov '25

Hi Wang, First bad commit (maybe != root cause): tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: a29fc03bd0ddaf7388cf31604ef5bd9807585109 commit: 22d4075bf5ef29ba4b329f954ac28a7de1d69a65 [3098/3098] net/oenetcls: remove oenetcls trace hook config: x86_64-randconfig-121-20251104 (https://download.01.org/0day-ci/archive/20251104/202511040552.16dcWFcA-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251104/202511040552.16dcWFcA-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511040552.16dcWFcA-lkp@intel.com/ All warnings (new ones prefixed by >>): >> net/oenetcls/oenetcls_main.c:990:13: warning: 'set_netdev_xps_queue' defined but not used [-Wunused-function] 990 | static void set_netdev_xps_queue(bool enable) | ^~~~~~~~~~~~~~~~~~~~ In file included from include/linux/string.h:294, from include/linux/bitmap.h:11, from include/linux/cpumask.h:12, from arch/x86/include/asm/cpumask.h:5, from arch/x86/include/asm/msr.h:11, from arch/x86/include/asm/processor.h:23, from arch/x86/include/asm/timex.h:5, from include/linux/timex.h:67, from include/linux/time32.h:13, from include/linux/time.h:60, from include/linux/stat.h:19, from include/linux/module.h:13, from net/oenetcls/oenetcls_main.c:2: In function 'strncpy', inlined from 'oecls_filter_restore' at net/oenetcls/oenetcls_main.c:459:2: include/linux/fortify-string.h:81:33: warning: '__builtin_strncpy' specified bound 16 equals destination size [-Wstringop-truncation] 81 | #define __underlying_strncpy __builtin_strncpy | ^ include/linux/fortify-string.h:165:16: note: in expansion of macro '__underlying_strncpy' 165 | return __underlying_strncpy(p, q, size); | ^~~~~~~~~~~~~~~~~~~~ In function 'strncpy', inlined from 'oecls_filter_enable.constprop' at net/oenetcls/oenetcls_main.c:413:2: include/linux/fortify-string.h:81:33: warning: '__builtin_strncpy' specified bound 16 equals destination size [-Wstringop-truncation] 81 | #define __underlying_strncpy __builtin_strncpy | ^ include/linux/fortify-string.h:165:16: note: in expansion of macro '__underlying_strncpy' 165 | return __underlying_strncpy(p, q, size); | ^~~~~~~~~~~~~~~~~~~~ Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PTP_1588_CLOCK Depends on [n]: NET [=y] && POSIX_TIMERS [=n] Selected by [m]: - SXE [=m] && NETDEVICES [=y] && ETHERNET [=y] && NET_VENDOR_LINKDATA [=y] && (X86 [=y] || ARM64) && PCI [=y] - SXE_VF [=m] && NETDEVICES [=y] && ETHERNET [=y] && NET_VENDOR_LINKDATA [=y] && (X86 [=y] || ARM64) && PCI [=y] vim +/set_netdev_xps_queue +990 net/oenetcls/oenetcls_main.c 4bed6ba0e88f50 Wang Liang 2025-08-26 989 4bed6ba0e88f50 Wang Liang 2025-08-26 @990 static void set_netdev_xps_queue(bool enable) 4bed6ba0e88f50 Wang Liang 2025-08-26 991 { 4bed6ba0e88f50 Wang Liang 2025-08-26 992 const struct cpumask clear_mask = { 0 }; 4bed6ba0e88f50 Wang Liang 2025-08-26 993 struct oecls_netdev_info *oecls_dev; 4bed6ba0e88f50 Wang Liang 2025-08-26 994 const struct cpumask *cpu_mask; 4bed6ba0e88f50 Wang Liang 2025-08-26 995 int rxq_id, devid, cpu, nid; 4bed6ba0e88f50 Wang Liang 2025-08-26 996 4bed6ba0e88f50 Wang Liang 2025-08-26 997 for_each_oecls_netdev(devid, oecls_dev) { 4bed6ba0e88f50 Wang Liang 2025-08-26 998 for (rxq_id = 0; rxq_id < oecls_dev->rxq_num; rxq_id++) { 4bed6ba0e88f50 Wang Liang 2025-08-26 999 cpu = oecls_dev->rxq[rxq_id].affinity_cpu; 4bed6ba0e88f50 Wang Liang 2025-08-26 1000 nid = cpu_to_node(cpu); 4bed6ba0e88f50 Wang Liang 2025-08-26 1001 if (enable) 4bed6ba0e88f50 Wang Liang 2025-08-26 1002 cpu_mask = cpumask_of_node(nid); 4bed6ba0e88f50 Wang Liang 2025-08-26 1003 else 4bed6ba0e88f50 Wang Liang 2025-08-26 1004 cpu_mask = &clear_mask; 4bed6ba0e88f50 Wang Liang 2025-08-26 1005 4bed6ba0e88f50 Wang Liang 2025-08-26 1006 netif_set_xps_queue_wrapper(oecls_dev->netdev, rxq_id, cpu_mask); 4bed6ba0e88f50 Wang Liang 2025-08-26 1007 } 4bed6ba0e88f50 Wang Liang 2025-08-26 1008 } 4bed6ba0e88f50 Wang Liang 2025-08-26 1009 } 4bed6ba0e88f50 Wang Liang 2025-08-26 1010 :::::: The code at line 990 was first introduced by commit :::::: 4bed6ba0e88f50484fd5fb06bd993727b981b718 net/oenetcls: introduce oenetcls for network optimization :::::: TO: Wang Liang <wangliang74(a)huawei.com> :::::: CC: Wang Liang <wangliang74(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3098/3098] crypto/asymmetric_keys/pgp_preload.c:63:38: warning: 'enum pgp_packet_tag' declared inside parameter list will not be visible outside of this definition or declaration
by kernel test robot 04 Nov '25

04 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: a29fc03bd0ddaf7388cf31604ef5bd9807585109 commit: 43d4042e06d2bf96adf67d25e8d91653507a4cf9 [3098/3098] KEYS: Provide a function to load keys from a PGP keyring blob config: x86_64-randconfig-003-20251104 (https://download.01.org/0day-ci/archive/20251104/202511040423.NnaZjkS6-lkp@…) compiler: gcc-13 (Debian 13.3.0-16) 13.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251104/202511040423.NnaZjkS6-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511040423.NnaZjkS6-lkp@intel.com/ All warnings (new ones prefixed by >>): crypto/asymmetric_keys/pgp_preload.c:25:34: error: field 'pgp' has incomplete type 25 | struct pgp_parse_context pgp; | ^~~ >> crypto/asymmetric_keys/pgp_preload.c:63:38: warning: 'enum pgp_packet_tag' declared inside parameter list will not be visible outside of this definition or declaration 63 | enum pgp_packet_tag type, u8 headerlen, | ^~~~~~~~~~~~~~ crypto/asymmetric_keys/pgp_preload.c:63:53: error: parameter 2 ('type') has incomplete type 63 | enum pgp_packet_tag type, u8 headerlen, | ~~~~~~~~~~~~~~~~~~~~^~~~ crypto/asymmetric_keys/pgp_preload.c:62:19: error: function declaration isn't a prototype [-Werror=strict-prototypes] 62 | static int __init found_pgp_key(struct pgp_parse_context *context, | ^~~~~~~~~~~~~ In file included from include/linux/container_of.h:5, from include/linux/list.h:5, from include/linux/module.h:12, from crypto/asymmetric_keys/pgp_preload.c:17: crypto/asymmetric_keys/pgp_preload.c: In function 'found_pgp_key': include/linux/compiler_types.h:374:27: error: expression in static assertion is not an integer 374 | #define __same_type(a, b) __builtin_types_compatible_p(typeof(a), typeof(b)) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/build_bug.h:78:56: note: in definition of macro '__static_assert' 78 | #define __static_assert(expr, msg, ...) _Static_assert(expr, msg) | ^~~~ include/linux/container_of.h:20:9: note: in expansion of macro 'static_assert' 20 | static_assert(__same_type(*(ptr), ((type *)0)->member) || \ | ^~~~~~~~~~~~~ include/linux/container_of.h:20:23: note: in expansion of macro '__same_type' 20 | static_assert(__same_type(*(ptr), ((type *)0)->member) || \ | ^~~~~~~~~~~ crypto/asymmetric_keys/pgp_preload.c:67:17: note: in expansion of macro 'container_of' 67 | container_of(context, struct preload_pgp_keys_context, pgp); | ^~~~~~~~~~~~ crypto/asymmetric_keys/pgp_preload.c: At top level: >> crypto/asymmetric_keys/pgp_preload.c:101:12: warning: no previous prototype for 'preload_pgp_keys' [-Wmissing-prototypes] 101 | int __init preload_pgp_keys(const u8 *pgpdata, size_t pgpdatalen, | ^~~~~~~~~~~~~~~~ crypto/asymmetric_keys/pgp_preload.c: In function 'preload_pgp_keys': crypto/asymmetric_keys/pgp_preload.c:107:43: error: 'PGP_PKT_PUBLIC_KEY' undeclared (first use in this function) 107 | ctx.pgp.types_of_interest = (1 << PGP_PKT_PUBLIC_KEY); | ^~~~~~~~~~~~~~~~~~ crypto/asymmetric_keys/pgp_preload.c:107:43: note: each undeclared identifier is reported only once for each function it appears in crypto/asymmetric_keys/pgp_preload.c:112:15: error: implicit declaration of function 'pgp_parse_packets' [-Werror=implicit-function-declaration] 112 | ret = pgp_parse_packets(pgpdata, pgpdatalen, &ctx.pgp); | ^~~~~~~~~~~~~~~~~ cc1: some warnings being treated as errors -- crypto/asymmetric_keys/pgp_public_key.c:37:34: error: field 'pgp' has incomplete type 37 | struct pgp_parse_context pgp; | ^~~ >> crypto/asymmetric_keys/pgp_public_key.c:50:39: warning: 'struct pgp_parse_pubkey' declared inside parameter list will not be visible outside of this definition or declaration 50 | struct pgp_parse_pubkey *pgp, | ^~~~~~~~~~~~~~~~ crypto/asymmetric_keys/pgp_public_key.c: In function 'pgp_calc_pkey_keyid': crypto/asymmetric_keys/pgp_public_key.c:63:9: error: implicit declaration of function 'kenter' [-Werror=implicit-function-declaration] 63 | kenter(""); | ^~~~~~ crypto/asymmetric_keys/pgp_public_key.c:65:17: error: invalid use of undefined type 'struct pgp_parse_pubkey' 65 | n = (pgp->version < PGP_KEY_VERSION_4) ? 8 : 6; | ^~ crypto/asymmetric_keys/pgp_public_key.c:65:29: error: 'PGP_KEY_VERSION_4' undeclared (first use in this function) 65 | n = (pgp->version < PGP_KEY_VERSION_4) ? 8 : 6; | ^~~~~~~~~~~~~~~~~ crypto/asymmetric_keys/pgp_public_key.c:65:29: note: each undeclared identifier is reported only once for each function it appears in crypto/asymmetric_keys/pgp_public_key.c:67:23: error: implicit declaration of function 'mpi_key_length' [-Werror=implicit-function-declaration] 67 | ret = mpi_key_length(key_ptr, keylen, nb + i, nn + i); | ^~~~~~~~~~~~~~ crypto/asymmetric_keys/pgp_public_key.c:87:32: error: invalid use of undefined type 'struct pgp_parse_pubkey' 87 | digest_putc(digest, pgp->version); | ^~ crypto/asymmetric_keys/pgp_public_key.c:89:18: error: invalid use of undefined type 'struct pgp_parse_pubkey' 89 | a32 = pgp->creation_time; | ^~ crypto/asymmetric_keys/pgp_public_key.c:95:16: error: invalid use of undefined type 'struct pgp_parse_pubkey' 95 | if (pgp->version < PGP_KEY_VERSION_4) { | ^~ crypto/asymmetric_keys/pgp_public_key.c:98:24: error: invalid use of undefined type 'struct pgp_parse_pubkey' 98 | if (pgp->expires_at) | ^~ crypto/asymmetric_keys/pgp_public_key.c:99:35: error: invalid use of undefined type 'struct pgp_parse_pubkey' 99 | a16 = (pgp->expires_at - pgp->creation_time) / 86400UL; | ^~ crypto/asymmetric_keys/pgp_public_key.c:99:53: error: invalid use of undefined type 'struct pgp_parse_pubkey' 99 | a16 = (pgp->expires_at - pgp->creation_time) / 86400UL; | ^~ crypto/asymmetric_keys/pgp_public_key.c:106:32: error: invalid use of undefined type 'struct pgp_parse_pubkey' 106 | digest_putc(digest, pgp->pubkey_algo); | ^~ crypto/asymmetric_keys/pgp_public_key.c:115:9: error: implicit declaration of function 'kleave' [-Werror=implicit-function-declaration] 115 | kleave(" = %d", ret); | ^~~~~~ crypto/asymmetric_keys/pgp_public_key.c: At top level: crypto/asymmetric_keys/pgp_public_key.c:123:44: warning: 'struct pgp_parse_pubkey' declared inside parameter list will not be visible outside of this definition or declaration 123 | struct pgp_parse_pubkey *pgp, | ^~~~~~~~~~~~~~~~ crypto/asymmetric_keys/pgp_public_key.c: In function 'pgp_generate_fingerprint': crypto/asymmetric_keys/pgp_public_key.c:134:37: error: invalid use of undefined type 'struct pgp_parse_pubkey' 134 | tfm = crypto_alloc_shash(pgp->version < PGP_KEY_VERSION_4 ? | ^~ crypto/asymmetric_keys/pgp_public_key.c:134:49: error: 'PGP_KEY_VERSION_4' undeclared (first use in this function) 134 | tfm = crypto_alloc_shash(pgp->version < PGP_KEY_VERSION_4 ? | ^~~~~~~~~~~~~~~~~ crypto/asymmetric_keys/pgp_public_key.c:150:43: error: passing argument 2 of 'pgp_calc_pkey_keyid' from incompatible pointer type [-Werror=incompatible-pointer-types] 150 | ret = pgp_calc_pkey_keyid(digest, pgp, pub); | ^~~ | | | struct pgp_parse_pubkey * crypto/asymmetric_keys/pgp_public_key.c:50:57: note: expected 'struct pgp_parse_pubkey *' but argument is of type 'struct pgp_parse_pubkey *' 50 | struct pgp_parse_pubkey *pgp, | ~~~~~~~~~~~~~~~~~~~~~~~~~^~~ crypto/asymmetric_keys/pgp_public_key.c: At top level: >> crypto/asymmetric_keys/pgp_public_key.c:199:40: warning: 'enum pgp_packet_tag' declared inside parameter list will not be visible outside of this definition or declaration 199 | enum pgp_packet_tag type, | ^~~~~~~~~~~~~~ crypto/asymmetric_keys/pgp_public_key.c:199:55: error: parameter 2 ('type') has incomplete type 199 | enum pgp_packet_tag type, | ~~~~~~~~~~~~~~~~~~~~^~~~ crypto/asymmetric_keys/pgp_public_key.c:198:12: error: function declaration isn't a prototype [-Werror=strict-prototypes] 198 | static int pgp_process_public_key(struct pgp_parse_context *context, | ^~~~~~~~~~~~~~~~~~~~~~ In file included from include/linux/container_of.h:5, from include/linux/list.h:5, from include/linux/module.h:12, from crypto/asymmetric_keys/pgp_public_key.c:16: crypto/asymmetric_keys/pgp_public_key.c: In function 'pgp_process_public_key': include/linux/compiler_types.h:374:27: error: expression in static assertion is not an integer 374 | #define __same_type(a, b) __builtin_types_compatible_p(typeof(a), typeof(b)) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/build_bug.h:78:56: note: in definition of macro '__static_assert' 78 | #define __static_assert(expr, msg, ...) _Static_assert(expr, msg) | ^~~~ include/linux/container_of.h:20:9: note: in expansion of macro 'static_assert' 20 | static_assert(__same_type(*(ptr), ((type *)0)->member) || \ | ^~~~~~~~~~~~~ include/linux/container_of.h:20:23: note: in expansion of macro '__same_type' 20 | static_assert(__same_type(*(ptr), ((type *)0)->member) || \ | ^~~~~~~~~~~ crypto/asymmetric_keys/pgp_public_key.c:206:17: note: in expansion of macro 'container_of' 206 | container_of(context, struct pgp_key_data_parse_context, pgp); | ^~~~~~~~~~~~ crypto/asymmetric_keys/pgp_public_key.c:207:33: error: storage size of 'pgp' isn't known 207 | struct pgp_parse_pubkey pgp; | ^~~ crypto/asymmetric_keys/pgp_public_key.c:213:21: error: 'PGP_PKT_USER_ID' undeclared (first use in this function) 213 | if (type == PGP_PKT_USER_ID) { | ^~~~~~~~~~~~~~~ crypto/asymmetric_keys/pgp_public_key.c:230:15: error: implicit declaration of function 'pgp_parse_public_key'; did you mean 'pgp_process_public_key'? [-Werror=implicit-function-declaration] 230 | ret = pgp_parse_public_key(&data, &datalen, &pgp); | ^~~~~~~~~~~~~~~~~~~~ | pgp_process_public_key crypto/asymmetric_keys/pgp_public_key.c:234:32: error: 'PGP_PUBKEY__LAST' undeclared (first use in this function) 234 | if (pgp.pubkey_algo >= PGP_PUBKEY__LAST) | ^~~~~~~~~~~~~~~~ crypto/asymmetric_keys/pgp_public_key.c:236:16: error: 'pgp_to_public_key_algo' undeclared (first use in this function) 236 | algo = pgp_to_public_key_algo[pgp.pubkey_algo]; | ^~~~~~~~~~~~~~~~~~~~~~ >> crypto/asymmetric_keys/pgp_public_key.c:207:33: warning: unused variable 'pgp' [-Wunused-variable] 207 | struct pgp_parse_pubkey pgp; | ^~~ crypto/asymmetric_keys/pgp_public_key.c: In function 'pgp_key_parse': crypto/asymmetric_keys/pgp_public_key.c:313:43: error: 'PGP_PKT_PUBLIC_KEY' undeclared (first use in this function) 313 | ctx.pgp.types_of_interest = (1 << PGP_PKT_PUBLIC_KEY) | | ^~~~~~~~~~~~~~~~~~ crypto/asymmetric_keys/pgp_public_key.c:314:43: error: 'PGP_PKT_USER_ID' undeclared (first use in this function) 314 | (1 << PGP_PKT_USER_ID); | ^~~~~~~~~~~~~~~ crypto/asymmetric_keys/pgp_public_key.c:317:15: error: implicit declaration of function 'pgp_parse_packets' [-Werror=implicit-function-declaration] 317 | ret = pgp_parse_packets(prep->data, prep->datalen, &ctx.pgp); | ^~~~~~~~~~~~~~~~~ cc1: some warnings being treated as errors Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PGP_KEY_PARSER Depends on [n]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] && ASYMMETRIC_PUBLIC_KEY_SUBTYPE [=n] Selected by [y]: - PGP_PRELOAD [=y] && CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] vim +63 crypto/asymmetric_keys/pgp_preload.c 58 59 /* 60 * Extract a public key or subkey from the PGP stream. 61 */ 62 static int __init found_pgp_key(struct pgp_parse_context *context, > 63 enum pgp_packet_tag type, u8 headerlen, 64 const u8 *data, size_t datalen) 65 { 66 struct preload_pgp_keys_context *ctx = 67 container_of(context, struct preload_pgp_keys_context, pgp); 68 int ret; 69 70 if (ctx->found_key) { 71 ctx->key_end = data - headerlen; 72 ret = create_pgp_key(ctx); 73 if (ret < 0) 74 return ret; 75 } 76 77 ctx->key_start = data - headerlen; 78 ctx->found_key = true; 79 return 0; 80 } 81 82 /** 83 * preload_pgp_keys - Load keys from a PGP keyring blob 84 * @pgpdata: The PGP keyring blob containing the keys. 85 * @pgpdatalen: The size of the @pgpdata blob. 86 * @keyring: The keyring to add the new keys to. 87 * 88 * Preload a pack of keys from a PGP keyring blob. 89 * 90 * The keys have their descriptions generated from the user ID and fingerprint 91 * in the PGP stream. Since keys can be matched on their key IDs independently 92 * of the key description, the description is mostly irrelevant apart from the 93 * fact that keys of the same description displace one another from a keyring. 94 * 95 * The caller should override the current creds if they want the keys to be 96 * owned by someone other than the current process's owner. Keys will not be 97 * accounted towards the owner's quota. 98 * 99 * This function may only be called whilst the kernel is booting. 100 */ > 101 int __init preload_pgp_keys(const u8 *pgpdata, size_t pgpdatalen, 102 struct key *keyring) 103 { 104 struct preload_pgp_keys_context ctx; 105 int ret; 106 107 ctx.pgp.types_of_interest = (1 << PGP_PKT_PUBLIC_KEY); 108 ctx.pgp.process_packet = found_pgp_key; 109 ctx.keyring = make_key_ref(keyring, 1); 110 ctx.found_key = false; 111 112 ret = pgp_parse_packets(pgpdata, pgpdatalen, &ctx.pgp); 113 if (ret < 0) 114 return ret; 115 116 if (ctx.found_key) { 117 ctx.key_end = pgpdata + pgpdatalen; 118 return create_pgp_key(&ctx); 119 } 120 return 0; 121 } 122 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3098/3098] drivers/tty/n_gsm.c:4171: warning: Function parameter or member 'dlci' not described in 'gsm_modem_send_initial_msc'
by kernel test robot 04 Nov '25

04 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: a29fc03bd0ddaf7388cf31604ef5bd9807585109 commit: 0c1413eee50d3f2b8928d788d0df337a3ce85e42 [3098/3098] tty: n_gsm: Don't block input queue by waiting MSC config: arm64-randconfig-001-20251103 (https://download.01.org/0day-ci/archive/20251104/202511040133.5KcpYIBK-lkp@…) compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project d2625a438020ad35330cda29c3def102c1687b1b) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251104/202511040133.5KcpYIBK-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511040133.5KcpYIBK-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/tty/n_gsm.c:4171: warning: Function parameter or member 'dlci' not described in 'gsm_modem_send_initial_msc' vim +4171 drivers/tty/n_gsm.c 4159 4160 /** 4161 * gsm_modem_send_initial_msc - Send initial modem status message 4162 * 4163 * @dlci channel 4164 * 4165 * Send an initial MSC message after DLCI open to set the initial 4166 * modem status lines. This is only done for basic mode. 4167 * Does not wait for a response as we cannot block the input queue 4168 * processing. 4169 */ 4170 static int gsm_modem_send_initial_msc(struct gsm_dlci *dlci) > 4171 { 4172 u8 modembits[2]; 4173 4174 if (dlci->adaption != 1 || dlci->gsm->encoding != GSM_BASIC_OPT) 4175 return 0; 4176 4177 modembits[0] = (dlci->addr << 2) | 2 | EA; /* DLCI, Valid, EA */ 4178 modembits[1] = (gsm_encode_modem(dlci) << 1) | EA; 4179 return gsm_control_command(dlci->gsm, CMD_MSC, (const u8 *)&modembits, 2); 4180 } 4181 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3098/3098] include/linux/iommu.h:2001:40: warning: 'struct iommu_plb_gather' declared inside parameter list will not be visible outside of this definition or declaration
by kernel test robot 04 Nov '25

04 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: a29fc03bd0ddaf7388cf31604ef5bd9807585109 commit: d46a4bd5bdfd7f1d6e2fa159398df4c54345070c [3098/3098] iommu/ummu-core: introduce iommu sva permission operation config: arm64-allnoconfig (https://download.01.org/0day-ci/archive/20251104/202511040032.5Xz72vRE-lkp@…) compiler: aarch64-linux-gcc (GCC) 15.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251104/202511040032.5Xz72vRE-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511040032.5Xz72vRE-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from kernel/fork.c:101: >> include/linux/iommu.h:2001:40: warning: 'struct iommu_plb_gather' declared inside parameter list will not be visible outside of this definition or declaration 2001 | struct iommu_plb_gather *plb_gather) {} | ^~~~~~~~~~~~~~~~ Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for ARCH_SUPPORTS_SCHED_SOFT_QUOTA Depends on [n]: CGROUPS [=n] Selected by [y]: - ARM64 [=y] WARNING: unmet direct dependencies detected for HALTPOLL_CPUIDLE Depends on [n]: CPU_IDLE [=n] && ARCH_CPUIDLE_HALTPOLL [=y] && ARCH_HAS_OPTIMIZED_POLL [=y] Selected by [y]: - ARM64 [=y] vim +2001 include/linux/iommu.h 1993 1994 static inline int iommu_sva_ungrant(struct iommu_sva *sva, void *va, 1995 size_t size, void *cookie) 1996 { 1997 return -EOPNOTSUPP; 1998 } 1999 static inline void iommu_plb_sync_all(struct iommu_domain *domain) {} 2000 static inline void iommu_plb_sync(struct iommu_domain *domain, > 2001 struct iommu_plb_gather *plb_gather) {} -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] tty: vt: Fix vc_origin buffer copy overflow in fbcon_prepare_logo()
by Chen Jun 03 Nov '25

03 Nov '25

From: Wang ShaoBo <bobo.shaobowang(a)huawei.com> Offering: HULK hulk inclusion category: bugfix bugzilla: NA CVE: NA ---------------------------------------------------------------------- I got some KASAN report as below: BUG: KASAN: slab-use-after-free in fbcon_prepare_logo+0x61e/0xc90 Read of size 14 at addr ffff88812c9a4c38 by task syz.0.3549/19016 CPU: 0 PID: 19016 Comm: syz.0.3549 Not tainted 6.6.0+ #80 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x72/0xa0 print_address_description.constprop.0+0x6b/0x3d0 ? fbcon_prepare_logo+0x61e/0xc90 print_report+0xba/0x280 ? fbcon_prepare_logo+0x61e/0xc90 ? kasan_addr_to_slab+0xd/0xa0 ? fbcon_prepare_logo+0x61e/0xc90 kasan_report+0xaf/0xe0 ? fbcon_prepare_logo+0x61e/0xc90 kasan_check_range+0x100/0x1c0 __asan_memcpy+0x23/0x60 fbcon_prepare_logo+0x61e/0xc90 fbcon_init+0xeb9/0x1db0 ? __pfx_drm_fb_helper_set_par+0x10/0x10 visual_init+0x310/0x5c0 do_bind_con_driver.isra.0+0x627/0xbd0 store_bind+0x60b/0x710 ? __pfx_store_bind+0x10/0x10 dev_attr_store+0x5a/0x90 ? __pfx_dev_attr_store+0x10/0x10 sysfs_kf_write+0x145/0x1b0 kernfs_fop_write_iter+0x367/0x580 ? __pfx_sysfs_kf_write+0x10/0x10 new_sync_write+0x1b1/0x2d0 ? __pfx_new_sync_write+0x10/0x10 ? rb_commit+0x121/0x910 ? avc_policy_seqno+0xe/0x20 ? selinux_file_permission+0x129/0x5d0 ? security_file_permission+0xa8/0x700 vfs_write+0x71a/0x960 ksys_write+0x12e/0x260 fbcon_init() -> vc_resize() //success resize vc_origin buffer size=224=7(cols)*2*16(rows) -> bcon_prepare_logo(vc, info, old_cols, old_rows, new_cols, new_rows) //old_cols=256，old_rows=4，new_cols=7，new_rows=16 There happened to be a vc_origin buffer copy overflow error in fbcon_prepare_logo(), scrolling screen down when using old cols after vc resize would trigger out of lower bound of vc_origin buffer. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Wang ShaoBo <bobo.shaobowang(a)huawei.com> Acked-by: Thomas Zimmermann <tzimmermann(a)suse.de> --- drivers/video/fbdev/core/fbcon.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c index f5178eefec64..83a4949e2497 100644 --- a/drivers/video/fbdev/core/fbcon.c +++ b/drivers/video/fbdev/core/fbcon.c @@ -592,6 +592,8 @@ static void fbcon_prepare_logo(struct vc_data *vc, struct fb_info *info, /* We can scroll screen down */ r = q - step - cols; for (cnt = rows - logo_lines; cnt > 0; cnt--) { + if (r < (unsigned short *) vc->vc_origin) + break; scr_memcpyw(r + step, r, vc->vc_size_row); r -= cols; } -- 2.22.0

2 1

[PATCH OLK-6.6 0/5] blk-ioinf: introduce inflight-based IO QoS controller
by Baokun Li 03 Nov '25

03 Nov '25

Baokun Li (5): blk-ioinf: introduce inflight-based IO QoS controller blk-ioinf: add rqos/inflight/stat debufs interface blk-ioinf: dynamically adjust inflight limit to balance workloads blk-ioinf: support percentile latency QoS for oneline workloads openeuler_defconfig: Enable CONFIG_BLK_CGROUP_IOINFLIGHT arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + block/Kconfig | 10 + block/Makefile | 1 + block/blk-ioinf.c | 1315 ++++++++++++++++++++++++ block/blk-mq-debugfs.c | 2 + block/blk-rq-qos.h | 1 + include/linux/blk-mq.h | 3 + 8 files changed, 1334 insertions(+) create mode 100644 block/blk-ioinf.c -- 2.46.1

2 6

[PATCH openEuler-1.0-LTS] mainline patch backport
by Xinyu Zheng 03 Nov '25

03 Nov '25

Huisong Li (1): ACPI: processor: idle: Fix memory leak when register cpuidle device failed Rafael J. Wysocki (1): PM: sleep: core: Clear power.must_resume in noirq suspend error path Sean Christopherson (2): x86/umip: Check that the instruction opcode is at least two bytes x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) arch/x86/kernel/umip.c | 15 +++++++++++++-- drivers/acpi/processor_idle.c | 3 +++ drivers/base/power/main.c | 14 +++++++++++++- 3 files changed, 29 insertions(+), 3 deletions(-) -- 2.34.1

2 8

[PATCH OLK-6.6 0/3] CVE-2025-38501
by Yongjian Sun 03 Nov '25

03 Nov '25

Namjae Jeon (3): ksmbd: limit repeated connections from clients with the same IP ksmbd: extend the connection limiting mechanism to support IPv6 ksmbd: add max ip connections parameter fs/smb/server/connection.h | 6 +++++ fs/smb/server/ksmbd_netlink.h | 5 ++-- fs/smb/server/server.h | 1 + fs/smb/server/transport_ipc.c | 3 +++ fs/smb/server/transport_tcp.c | 43 +++++++++++++++++++++++++++++++++++ 5 files changed, 56 insertions(+), 2 deletions(-) -- 2.39.2

2 4

[PATCH openEuler-1.0-LTS] wifi: ath9k: hif_usb: fix memory leak of remain_skbs
by Ziming Du 03 Nov '25

03 Nov '25

From: Fedor Pchelkin <pchelkin(a)ispras.ru> stable inclusion from stable-v4.19.283 commit 6719e3797ec52cd144c8a5ba8aaab36674800585 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID0VHF CVE: CVE-2023-53641 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 7654cc03eb699297130b693ec34e25f77b17c947 ] hif_dev->remain_skb is allocated and used exclusively in ath9k_hif_usb_rx_stream(). It is implied that an allocated remain_skb is processed and subsequently freed (in error paths) only during the next call of ath9k_hif_usb_rx_stream(). So, if the urbs are deallocated between those two calls due to the device deinitialization or suspend, it is possible that ath9k_hif_usb_rx_stream() is not called next time and the allocated remain_skb is leaked. Our local Syzkaller instance was able to trigger that. remain_skb makes sense when receiving two consecutive urbs which are logically linked together, i.e. a specific data field from the first skb indicates a cached skb to be allocated, memcpy'd with some data and subsequently processed in the next call to ath9k_hif_usb_rx_stream(). Urbs deallocation supposedly makes that link irrelevant so we need to free the cached skb in those cases. Fix the leak by introducing a function to explicitly free remain_skb (if it is not NULL) when the rx urbs have been deallocated. remain_skb is NULL when it has not been allocated at all (hif_dev struct is kzalloced) or when it has been processed in next call to ath9k_hif_usb_rx_stream(). Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.") Signed-off-by: Fedor Pchelkin <pchelkin(a)ispras.ru> Signed-off-by: Alexey Khoroshilov <khoroshilov(a)ispras.ru> Acked-by: Toke Høiland-Jørgensen <toke(a)toke.dk> Signed-off-by: Kalle Valo <quic_kvalo(a)quicinc.com> Link: https://lore.kernel.org/r/20230216192301.171225-1-pchelkin@ispras.ru Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ziming Du <duziming2(a)huawei.com> --- drivers/net/wireless/ath/ath9k/hif_usb.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c index 32672964e87e8..1688042f62362 100644 --- a/drivers/net/wireless/ath/ath9k/hif_usb.c +++ b/drivers/net/wireless/ath/ath9k/hif_usb.c @@ -525,6 +525,24 @@ static struct ath9k_htc_hif hif_usb = { .send = hif_usb_send, }; +/* Need to free remain_skb allocated in ath9k_hif_usb_rx_stream + * in case ath9k_hif_usb_rx_stream wasn't called next time to + * process the buffer and subsequently free it. + */ +static void ath9k_hif_usb_free_rx_remain_skb(struct hif_device_usb *hif_dev) +{ + unsigned long flags; + + spin_lock_irqsave(&hif_dev->rx_lock, flags); + if (hif_dev->remain_skb) { + dev_kfree_skb_any(hif_dev->remain_skb); + hif_dev->remain_skb = NULL; + hif_dev->rx_remain_len = 0; + RX_STAT_INC(hif_dev, skb_dropped); + } + spin_unlock_irqrestore(&hif_dev->rx_lock, flags); +} + static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev, struct sk_buff *skb) { @@ -842,6 +860,7 @@ static int ath9k_hif_usb_alloc_tx_urbs(struct hif_device_usb *hif_dev) static void ath9k_hif_usb_dealloc_rx_urbs(struct hif_device_usb *hif_dev) { usb_kill_anchored_urbs(&hif_dev->rx_submitted); + ath9k_hif_usb_free_rx_remain_skb(hif_dev); } static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev) -- 2.43.0

2 1

[PATCH OLK-6.6] nbd: restrict sockets to TCP and UDP
by Zheng Qixing 03 Nov '25

03 Nov '25

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v6.6.112 commit 4f9e6ff6319dbcebea64b50af0304cf0ad7e97e7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID3WIC CVE: CVE-2025-40080 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------ [ Upstream commit 9f7c02e031570e8291a63162c6c046dc15ff85b0 ] Recently, syzbot started to abuse NBD with all kinds of sockets. Commit cf1b2326b734 ("nbd: verify socket is supported during setup") made sure the socket supported a shutdown() method. Explicitely accept TCP and UNIX stream sockets. Fixes: cf1b2326b734 ("nbd: verify socket is supported during setup") Reported-by: syzbot+e1cd6bd8493060bd701d(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/CANn89iJ+76eE3A_8S_zTpSyW5hvPRn6V57458hCZGY5… Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Mike Christie <mchristi(a)redhat.com> Cc: Richard W.M. Jones <rjones(a)redhat.com> Cc: Jens Axboe <axboe(a)kernel.dk> Cc: Yu Kuai <yukuai1(a)huaweicloud.com> Cc: linux-block(a)vger.kernel.org Cc: nbd(a)other.debian.org Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/block/nbd.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index 7eeb4b6de6de..26e1cf7f666c 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -1128,6 +1128,14 @@ static struct socket *nbd_get_socket(struct nbd_device *nbd, unsigned long fd, if (!sock) return NULL; + if (!sk_is_tcp(sock->sk) && + !sk_is_stream_unix(sock->sk)) { + dev_err(disk_to_dev(nbd->disk), "Unsupported socket: should be TCP or UNIX.\n"); + *err = -EINVAL; + sockfd_put(sock); + return NULL; + } + if (sock->ops->shutdown == sock_no_shutdown) { dev_err(disk_to_dev(nbd->disk), "Unsupported socket: shutdown callout must be supported.\n"); *err = -EINVAL; -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS 0/2] fix CVE-2023-53675
by Zheng Qixing 03 Nov '25

03 Nov '25

fix CVE-2023-53675 Tomas Henzl (1): scsi: ses: Fix possible desc_ptr out-of-bounds accesses Zheng Qixing (1): Revert "scsi: ses: fix slab-out-of-bounds in ses_enclosure_data_process" drivers/scsi/ses.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) -- 2.39.2

2 3

[PATCH openEuler-1.0-LTS 0/2] *** CVE-2023-53454 ***
by Lin Ruifeng 03 Nov '25

03 Nov '25

*** CVE-2023-53454 *** Charles Han (1): HID: multitouch: Add NULL check in mt_input_configured Rahul Rameshbabu (1): HID: multitouch: Correct devm device reference for hidinput input_dev name drivers/hid/hid-multitouch.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) -- 2.22.0

2 3

[PATCH openEuler-1.0-LTS 0/2] fix CVE-2023-53675
by Zheng Qixing 03 Nov '25

03 Nov '25

fix CVE-2023-53675 Tomas Henzl (1): scsi: ses: Fix possible desc_ptr out-of-bounds accesses Zheng Qixing (1): Revert "scsi: ses: fix slab-out-of-bounds in ses_enclosure_data_process" drivers/scsi/ses.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) -- 2.39.2

2 3

[PATCH openEuler-1.0-LTS] scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show()
by Zheng Qixing 03 Nov '25

03 Nov '25

From: Konstantin Shelekhin <k.shelekhin(a)yadro.com> stable inclusion from stable-v4.19.295 commit 114b44dddea1f8f99576de3c0e6e9059012002fc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID0VIW CVE: CVE-2023-53676 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------ [ Upstream commit 801f287c93ff95582b0a2d2163f12870a2f076d4 ] The function lio_target_nacl_info_show() uses sprintf() in a loop to print details for every iSCSI connection in a session without checking for the buffer length. With enough iSCSI connections it's possible to overflow the buffer provided by configfs and corrupt the memory. This patch replaces sprintf() with sysfs_emit_at() that checks for buffer boundries. Signed-off-by: Konstantin Shelekhin <k.shelekhin(a)yadro.com> Link: https://lore.kernel.org/r/20230722152657.168859-2-k.shelekhin@yadro.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/target/iscsi/iscsi_target_configfs.c | 54 ++++++++++---------- 1 file changed, 27 insertions(+), 27 deletions(-) diff --git a/drivers/target/iscsi/iscsi_target_configfs.c b/drivers/target/iscsi/iscsi_target_configfs.c index d25cadc4f4f1..ac071abae7e9 100644 --- a/drivers/target/iscsi/iscsi_target_configfs.c +++ b/drivers/target/iscsi/iscsi_target_configfs.c @@ -516,102 +516,102 @@ static ssize_t lio_target_nacl_info_show(struct config_item *item, char *page) spin_lock_bh(&se_nacl->nacl_sess_lock); se_sess = se_nacl->nacl_sess; if (!se_sess) { - rb += sprintf(page+rb, "No active iSCSI Session for Initiator" + rb += sysfs_emit_at(page, rb, "No active iSCSI Session for Initiator" " Endpoint: %s\n", se_nacl->initiatorname); } else { sess = se_sess->fabric_sess_ptr; - rb += sprintf(page+rb, "InitiatorName: %s\n", + rb += sysfs_emit_at(page, rb, "InitiatorName: %s\n", sess->sess_ops->InitiatorName); - rb += sprintf(page+rb, "InitiatorAlias: %s\n", + rb += sysfs_emit_at(page, rb, "InitiatorAlias: %s\n", sess->sess_ops->InitiatorAlias); - rb += sprintf(page+rb, + rb += sysfs_emit_at(page, rb, "LIO Session ID: %u ISID: 0x%6ph TSIH: %hu ", sess->sid, sess->isid, sess->tsih); - rb += sprintf(page+rb, "SessionType: %s\n", + rb += sysfs_emit_at(page, rb, "SessionType: %s\n", (sess->sess_ops->SessionType) ? "Discovery" : "Normal"); - rb += sprintf(page+rb, "Session State: "); + rb += sysfs_emit_at(page, rb, "Session State: "); switch (sess->session_state) { case TARG_SESS_STATE_FREE: - rb += sprintf(page+rb, "TARG_SESS_FREE\n"); + rb += sysfs_emit_at(page, rb, "TARG_SESS_FREE\n"); break; case TARG_SESS_STATE_ACTIVE: - rb += sprintf(page+rb, "TARG_SESS_STATE_ACTIVE\n"); + rb += sysfs_emit_at(page, rb, "TARG_SESS_STATE_ACTIVE\n"); break; case TARG_SESS_STATE_LOGGED_IN: - rb += sprintf(page+rb, "TARG_SESS_STATE_LOGGED_IN\n"); + rb += sysfs_emit_at(page, rb, "TARG_SESS_STATE_LOGGED_IN\n"); break; case TARG_SESS_STATE_FAILED: - rb += sprintf(page+rb, "TARG_SESS_STATE_FAILED\n"); + rb += sysfs_emit_at(page, rb, "TARG_SESS_STATE_FAILED\n"); break; case TARG_SESS_STATE_IN_CONTINUE: - rb += sprintf(page+rb, "TARG_SESS_STATE_IN_CONTINUE\n"); + rb += sysfs_emit_at(page, rb, "TARG_SESS_STATE_IN_CONTINUE\n"); break; default: - rb += sprintf(page+rb, "ERROR: Unknown Session" + rb += sysfs_emit_at(page, rb, "ERROR: Unknown Session" " State!\n"); break; } - rb += sprintf(page+rb, "---------------------[iSCSI Session" + rb += sysfs_emit_at(page, rb, "---------------------[iSCSI Session" " Values]-----------------------\n"); - rb += sprintf(page+rb, " CmdSN/WR : CmdSN/WC : ExpCmdSN" + rb += sysfs_emit_at(page, rb, " CmdSN/WR : CmdSN/WC : ExpCmdSN" " : MaxCmdSN : ITT : TTT\n"); max_cmd_sn = (u32) atomic_read(&sess->max_cmd_sn); - rb += sprintf(page+rb, " 0x%08x 0x%08x 0x%08x 0x%08x" + rb += sysfs_emit_at(page, rb, " 0x%08x 0x%08x 0x%08x 0x%08x" " 0x%08x 0x%08x\n", sess->cmdsn_window, (max_cmd_sn - sess->exp_cmd_sn) + 1, sess->exp_cmd_sn, max_cmd_sn, sess->init_task_tag, sess->targ_xfer_tag); - rb += sprintf(page+rb, "----------------------[iSCSI" + rb += sysfs_emit_at(page, rb, "----------------------[iSCSI" " Connections]-------------------------\n"); spin_lock(&sess->conn_lock); list_for_each_entry(conn, &sess->sess_conn_list, conn_list) { - rb += sprintf(page+rb, "CID: %hu Connection" + rb += sysfs_emit_at(page, rb, "CID: %hu Connection" " State: ", conn->cid); switch (conn->conn_state) { case TARG_CONN_STATE_FREE: - rb += sprintf(page+rb, + rb += sysfs_emit_at(page, rb, "TARG_CONN_STATE_FREE\n"); break; case TARG_CONN_STATE_XPT_UP: - rb += sprintf(page+rb, + rb += sysfs_emit_at(page, rb, "TARG_CONN_STATE_XPT_UP\n"); break; case TARG_CONN_STATE_IN_LOGIN: - rb += sprintf(page+rb, + rb += sysfs_emit_at(page, rb, "TARG_CONN_STATE_IN_LOGIN\n"); break; case TARG_CONN_STATE_LOGGED_IN: - rb += sprintf(page+rb, + rb += sysfs_emit_at(page, rb, "TARG_CONN_STATE_LOGGED_IN\n"); break; case TARG_CONN_STATE_IN_LOGOUT: - rb += sprintf(page+rb, + rb += sysfs_emit_at(page, rb, "TARG_CONN_STATE_IN_LOGOUT\n"); break; case TARG_CONN_STATE_LOGOUT_REQUESTED: - rb += sprintf(page+rb, + rb += sysfs_emit_at(page, rb, "TARG_CONN_STATE_LOGOUT_REQUESTED\n"); break; case TARG_CONN_STATE_CLEANUP_WAIT: - rb += sprintf(page+rb, + rb += sysfs_emit_at(page, rb, "TARG_CONN_STATE_CLEANUP_WAIT\n"); break; default: - rb += sprintf(page+rb, + rb += sysfs_emit_at(page, rb, "ERROR: Unknown Connection State!\n"); break; } - rb += sprintf(page+rb, " Address %pISc %s", &conn->login_sockaddr, + rb += sysfs_emit_at(page, rb, " Address %pISc %s", &conn->login_sockaddr, (conn->network_transport == ISCSI_TCP) ? "TCP" : "SCTP"); - rb += sprintf(page+rb, " StatSN: 0x%08x\n", + rb += sysfs_emit_at(page, rb, " StatSN: 0x%08x\n", conn->stat_sn); } spin_unlock(&sess->conn_lock); -- 2.39.2

2 1

[openeuler:OLK-6.6 3098/3098] include/linux/iommu.h:2001:12: warning: declaration of 'struct iommu_plb_gather' will not be visible outside of this function
by kernel test robot 03 Nov '25

03 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: a29fc03bd0ddaf7388cf31604ef5bd9807585109 commit: d46a4bd5bdfd7f1d6e2fa159398df4c54345070c [3098/3098] iommu/ummu-core: introduce iommu sva permission operation config: loongarch-allnoconfig (https://download.01.org/0day-ci/archive/20251103/202511031912.GYyUucHm-lkp@…) compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project d2625a438020ad35330cda29c3def102c1687b1b) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251103/202511031912.GYyUucHm-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511031912.GYyUucHm-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from kernel/fork.c:101: >> include/linux/iommu.h:2001:12: warning: declaration of 'struct iommu_plb_gather' will not be visible outside of this function [-Wvisibility] 2001 | struct iommu_plb_gather *plb_gather) {} | ^ 1 warning generated. vim +2001 include/linux/iommu.h 1993 1994 static inline int iommu_sva_ungrant(struct iommu_sva *sva, void *va, 1995 size_t size, void *cookie) 1996 { 1997 return -EOPNOTSUPP; 1998 } 1999 static inline void iommu_plb_sync_all(struct iommu_domain *domain) {} 2000 static inline void iommu_plb_sync(struct iommu_domain *domain, > 2001 struct iommu_plb_gather *plb_gather) {} -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3075/3075] drivers/ub/ubus/resource.c:98:5: warning: no previous prototype for function 'ub_assign_resource'
by kernel test robot 03 Nov '25

03 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: a29fc03bd0ddaf7388cf31604ef5bd9807585109 commit: f94773e30426af02371bc80aa047d1144f7b4291 [3075/3075] ub:ubus: Add UBUS resource space basic functions config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20251103/202511031846.WZN8QTuN-lkp@…) compiler: clang version 19.1.7 (https://github.com/llvm/llvm-project cd708029e0b2869e80abe31ddb175f7c35361f90) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251103/202511031846.WZN8QTuN-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511031846.WZN8QTuN-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/ub/ubus/resource.c:98:5: warning: no previous prototype for function 'ub_assign_resource' [-Wmissing-prototypes] 98 | int ub_assign_resource(struct ub_entity *uent, int idx) | ^ drivers/ub/ubus/resource.c:98:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 98 | int ub_assign_resource(struct ub_entity *uent, int idx) | ^ | static >> drivers/ub/ubus/resource.c:124:6: warning: no previous prototype for function 'ub_release_resource' [-Wmissing-prototypes] 124 | void ub_release_resource(struct ub_entity *uent, int idx) | ^ drivers/ub/ubus/resource.c:124:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 124 | void ub_release_resource(struct ub_entity *uent, int idx) | ^ | static >> drivers/ub/ubus/resource.c:293:5: warning: no previous prototype for function 'ub_entity_alloc_mmio_idx' [-Wmissing-prototypes] 293 | int ub_entity_alloc_mmio_idx(struct ub_entity *dev, int idx) | ^ drivers/ub/ubus/resource.c:293:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 293 | int ub_entity_alloc_mmio_idx(struct ub_entity *dev, int idx) | ^ | static 3 warnings generated. vim +/ub_assign_resource +98 drivers/ub/ubus/resource.c 97 > 98 int ub_assign_resource(struct ub_entity *uent, int idx) 99 { 100 struct resource *res = &uent->zone[idx].res; 101 resource_size_t size; 102 resource_size_t page_size = PAGE_SIZE; 103 /* decoder mapped address unit 1M */ 104 resource_size_t align = page_size > SZ_1M ? page_size : SZ_1M; 105 int ret; 106 107 res->name = ub_name(uent); 108 res->flags |= IORESOURCE_UNSET | IORESOURCE_SIZEALIGN; 109 size = uent->zone[idx].region.size; 110 ret = _ub_assign_resource(uent, idx, size, align); 111 if (ret < 0) { 112 ub_err(uent, "RESOURCE %d: failed to assign, size=%#llx\n", 113 idx, size); 114 return ret; 115 } 116 117 res->flags &= ~IORESOURCE_UNSET; 118 res->flags &= ~IORESOURCE_STARTALIGN; 119 ub_info(uent, "RESOURCE %d: assigned %pR\n", idx, res); 120 121 return 0; 122 } 123 > 124 void ub_release_resource(struct ub_entity *uent, int idx) 125 { 126 int ret; 127 128 if (uent->zone[idx].res.parent) { 129 ret = release_resource(&uent->zone[idx].res); 130 if (ret) 131 ub_err(uent, "resource release failed, ret=%d.\n", ret); 132 } 133 } 134 135 static void __iomem *ub_iomap_range(struct ub_entity *uent, int res_id, 136 unsigned long offset, unsigned long maxlen, 137 bool is_wc) 138 { 139 resource_size_t start = ub_resource_start(uent, res_id); 140 resource_size_t len = ub_resource_len(uent, res_id); 141 unsigned long flags = ub_resource_flags(uent, res_id); 142 143 if (len <= offset || !start) 144 return NULL; 145 len -= offset; 146 start += offset; 147 if (maxlen && len > maxlen) 148 len = maxlen; 149 if (!(flags & IORESOURCE_MEM)) 150 return NULL; 151 152 if (is_wc) 153 return ioremap_wc(start, len); 154 else 155 return ioremap(start, len); 156 } 157 158 void __iomem *ub_iomap(struct ub_entity *uent, int res_id, unsigned long maxlen) 159 { 160 if (res_id >= MAX_UB_RES_NUM || !uent) 161 return NULL; 162 163 return ub_iomap_range(uent, res_id, 0, maxlen, false); 164 } 165 EXPORT_SYMBOL_GPL(ub_iomap); 166 167 void __iomem *ub_iomap_wc(struct ub_entity *uent, int res_id, unsigned long maxlen) 168 { 169 if (res_id >= MAX_UB_RES_NUM || !uent) 170 return NULL; 171 172 return ub_iomap_range(uent, res_id, 0, maxlen, true); 173 } 174 EXPORT_SYMBOL_GPL(ub_iomap_wc); 175 176 void ub_iounmap(void __iomem *addr) 177 { 178 iounmap(addr); 179 } 180 EXPORT_SYMBOL_GPL(ub_iounmap); 181 182 static int ub_read_ubba_reg(struct ub_entity *uent, size_t pg_size, int idx) 183 { 184 u32 addr_l_reg[MAX_UB_RES_NUM] = { UB_ERS0_UBBA_L, UB_ERS1_UBBA_L, 185 UB_ERS2_UBBA_L }; 186 u32 addr_h_reg[MAX_UB_RES_NUM] = { UB_ERS0_UBBA_H, UB_ERS1_UBBA_H, 187 UB_ERS2_UBBA_H }; 188 u32 ss_reg[MAX_UB_RES_NUM] = { UB_ERS0_SS, UB_ERS1_SS, UB_ERS2_SS }; 189 u32 hpa_l = 0, hpa_h = 0, size = 0; 190 int ret; 191 192 ret = ub_cfg_read_dword(uent, addr_l_reg[idx], &hpa_l); 193 ret |= ub_cfg_read_dword(uent, addr_h_reg[idx], &hpa_h); 194 ret |= ub_cfg_read_dword(uent, ss_reg[idx], &size); 195 if (ret) { 196 ub_err(uent, "read reg failed when request HPA resource\n"); 197 return -EINVAL; 198 } else if (size == 0) { 199 ub_err(uent, "size is 0 when request HPA resource\n"); 200 return -EINVAL; 201 } 202 203 uent->zone[idx].res.start = ubba_gen(hpa_h, hpa_l); 204 uent->zone[idx].res.end = 205 uent->zone[idx].res.start + ((u64)size * pg_size - 1); 206 207 uent->zone[idx].res.flags = IORESOURCE_MEM; 208 uent->zone[idx].res.name = ub_name(uent); 209 uent->zone[idx].ubba_used = 1; 210 211 ub_info(uent, "mmio idx %d, %pR\n", idx, &uent->zone[idx].res); 212 return 0; 213 } 214 215 static int ub_read_sa_reg(struct ub_entity *uent, size_t pg_size, int idx) 216 { 217 u32 sa_l_reg[MAX_UB_RES_NUM] = { UB_ERS0_SA_L, UB_ERS1_SA_L, 218 UB_ERS2_SA_L }; 219 u32 sa_h_reg[MAX_UB_RES_NUM] = { UB_ERS0_SA_H, UB_ERS1_SA_H, 220 UB_ERS2_SA_H }; 221 u32 ss_reg[MAX_UB_RES_NUM] = { UB_ERS0_SS, UB_ERS1_SS, UB_ERS2_SS }; 222 u32 sa_l = 0, sa_h = 0, size = 0; 223 int ret; 224 225 ret = ub_cfg_read_dword(uent, sa_l_reg[idx], &sa_l); 226 ret |= ub_cfg_read_dword(uent, sa_h_reg[idx], &sa_h); 227 ret |= ub_cfg_read_dword(uent, ss_reg[idx], &size); 228 if (ret) { 229 ub_err(uent, "read reg failed when request SA resource\n"); 230 return -EINVAL; 231 } else if (size == 0) { 232 ub_err(uent, "size is 0 when request SA resource\n"); 233 return -EINVAL; 234 } 235 236 /* Shift left 32 bits to get upper-bit address */ 237 uent->zone[idx].region.start = ((u64)sa_h << 32) | sa_l; 238 uent->zone[idx].region.size = size * pg_size; 239 uent->zone[idx].res.flags = IORESOURCE_MEM; 240 uent->zone[idx].sa_used = 1; 241 242 return 0; 243 } 244 245 static int ub_entity_read_mmio_idx(struct ub_entity *uent, int idx) 246 { 247 struct ub_entity *pue; 248 size_t pg_size = 0; 249 250 /* ue to its mue, mue to Entity0, Entity0 use itself */ 251 pue = uent->pue; 252 if (pue->entity_idx) /* to ensure Entity0 uent */ 253 pue = pue->pue; 254 255 (void)ub_cfg_read_byte(uent, UB_SYS_PGS, (u8 *)&pg_size); 256 if ((u8)pg_size & UB_SYS_PGS_SIZE) 257 pg_size = SZ_64K; 258 else 259 pg_size = SZ_4K; 260 261 if (pue->zone[idx].ubba_used) 262 return ub_read_ubba_reg(uent, pg_size, idx); 263 264 if (pue->zone[idx].sa_used) 265 return ub_read_sa_reg(uent, pg_size, idx); 266 267 return -EPERM; 268 } 269 270 int ub_insert_resource(struct ub_entity *dev, int idx) 271 { 272 struct resource *res, *root = NULL; 273 int ret; 274 275 if (idx >= MAX_UB_RES_NUM) 276 return -EINVAL; 277 278 res = &dev->zone[idx].res; 279 if (!(res->flags & IORESOURCE_MEM)) 280 return -EINVAL; 281 282 root = &iomem_resource; 283 284 ret = insert_resource(root, res); 285 if (ret) { 286 ub_warn(dev, "failed to claim uent resource %pR\n", res); 287 return -ENOMEM; 288 } 289 290 return 0; 291 } 292 > 293 int ub_entity_alloc_mmio_idx(struct ub_entity *dev, int idx) 294 { 295 if (is_ibus_controller(dev) || is_idev(dev)) 296 return ub_insert_resource(dev, idx); 297 return ub_assign_resource(dev, idx); 298 } 299 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openEuler-1.0-LTS 0/2] *** Fix CVE-2023-53454 ***
by Lin Ruifeng 03 Nov '25

03 Nov '25

*** Fix CVE-2023-53454 *** Charles Han (1): HID: multitouch: Add NULL check in mt_input_configured Rahul Rameshbabu (1): HID: multitouch: Correct devm device reference for hidinput input_dev name drivers/hid/hid-multitouch.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) -- 2.22.0

1 2

[PATCH OLK-6.6 0/2] CVE-2025-38501
by Yongjian Sun 03 Nov '25

03 Nov '25

Namjae Jeon (2): ksmbd: limit repeated connections from clients with the same IP ksmbd: extend the connection limiting mechanism to support IPv6 fs/smb/server/connection.h | 6 ++++++ fs/smb/server/transport_tcp.c | 37 +++++++++++++++++++++++++++++++++++ 2 files changed, 43 insertions(+) -- 2.39.2

2 3

[openEuler-1.0-LTS 0/2] *** Fix CVE-2023-53454 ***
by Lin Ruifeng 03 Nov '25

03 Nov '25

*** Fix CVE-2023-53454 *** Charles Han (1): HID: multitouch: Add NULL check in mt_input_configured Rahul Rameshbabu (1): HID: multitouch: Correct devm device reference for hidinput input_dev name drivers/hid/hid-multitouch.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) -- 2.22.0

1 2

[PATCH openEuler-1.0-LTS] wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex
by Jiacheng Yu 03 Nov '25

03 Nov '25

From: Hector Martin <marcan(a)marcan.st> stable inclusion from stable-v4.19.284 commit 2bc34facb90ceeff6f8c17d2006575a6d07c3825 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID33EM CVE: CVE-2023-53715 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 89b89e52153fda2733562776c7c9d9d3ebf8dd6d ] Apparently the hex passphrase mechanism does not work on newer chips/firmware (e.g. BCM4387). It seems there was a simple way of passing it in binary all along, so use that and avoid the hexification. OpenBSD has been doing it like this from the beginning, so this should work on all chips. Also clear the structure before setting the PMK. This was leaking uninitialized stack contents to the device. Reviewed-by: Linus Walleij <linus.walleij(a)linaro.org> Reviewed-by: Arend van Spriel <arend.vanspriel(a)broadcom.com> Signed-off-by: Hector Martin <marcan(a)marcan.st> Signed-off-by: Kalle Valo <kvalo(a)kernel.org> Link: https://lore.kernel.org/r/20230214092423.15175-6-marcan@marcan.st Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jiacheng Yu <yujiacheng3(a)huawei.com> --- .../wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c index e6ff4c64738e..454312ef960a 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c @@ -1240,13 +1240,14 @@ static u16 brcmf_map_fw_linkdown_reason(const struct brcmf_event_msg *e) static int brcmf_set_pmk(struct brcmf_if *ifp, const u8 *pmk_data, u16 pmk_len) { struct brcmf_wsec_pmk_le pmk; - int i, err; + int err; + + memset(&pmk, 0, sizeof(pmk)); - /* convert to firmware key format */ - pmk.key_len = cpu_to_le16(pmk_len << 1); - pmk.flags = cpu_to_le16(BRCMF_WSEC_PASSPHRASE); - for (i = 0; i < pmk_len; i++) - snprintf(&pmk.key[2 * i], 3, "%02x", pmk_data[i]); + /* pass pmk directly */ + pmk.key_len = cpu_to_le16(pmk_len); + pmk.flags = cpu_to_le16(0); + memcpy(pmk.key, pmk_data, pmk_len); /* store psk in firmware */ err = brcmf_fil_cmd_data_set(ifp, BRCMF_C_SET_WSEC_PMK, -- 2.43.0

2 1

[openEuler-1.0-LTS 0/2] *** Fix CVE-2023-53454 ***
by Lin Ruifeng 03 Nov '25

03 Nov '25

*** Fix CVE-2023-53454 *** Charles Han (1): HID: multitouch: Add NULL check in mt_input_configured Rahul Rameshbabu (1): HID: multitouch: Correct devm device reference for hidinput input_dev name drivers/hid/hid-multitouch.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) -- 2.22.0

1 2

[PATCH OLK-5.10 0/5] mainline patch backport
by Xinyu Zheng 03 Nov '25

03 Nov '25

Daniel Tang (1): ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT Huisong Li (1): ACPI: processor: idle: Fix memory leak when register cpuidle device failed Rafael J. Wysocki (1): PM: sleep: core: Clear power.must_resume in noirq suspend error path Sean Christopherson (2): x86/umip: Check that the instruction opcode is at least two bytes x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) arch/x86/kernel/umip.c | 15 +++++++++++++-- drivers/acpi/acpi_tad.c | 3 +++ drivers/acpi/processor_idle.c | 3 +++ drivers/base/power/main.c | 14 +++++++++++++- 4 files changed, 32 insertions(+), 3 deletions(-) -- 2.34.1

2 6

[PATCH] [Backport] ext4: factor out ext4_fc_get_tl()
by Yongjian Sun 03 Nov '25

03 Nov '25

From: Ye Bin <yebin10(a)huawei.com> mainline inclusion from mainline-v6.1-rc1 commit dcc5827484d6e53ccda12334f8bbfafcc593ceda category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICY4BC CVE: CVE-2022-50306 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Factor out ext4_fc_get_tl() to fill 'tl' with host byte order. Signed-off-by: Ye Bin <yebin10(a)huawei.com> Link: https://lore.kernel.org/r/20220924075233.2315259-3-yebin10@huawei.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Conflicts: fs/ext4/fast_commit.c [4978c659e7b5 not applied] Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/ext4/fast_commit.c | 46 +++++++++++++++++++++++-------------------- 1 file changed, 25 insertions(+), 21 deletions(-) diff --git a/fs/ext4/fast_commit.c b/fs/ext4/fast_commit.c index affa7a19ea61..c33482c65ebe 100644 --- a/fs/ext4/fast_commit.c +++ b/fs/ext4/fast_commit.c @@ -1256,7 +1256,7 @@ struct dentry_info_args { }; static inline void tl_to_darg(struct dentry_info_args *darg, - struct ext4_fc_tl *tl, u8 *val) + struct ext4_fc_tl *tl, u8 *val) { struct ext4_fc_dentry_info fcd; @@ -1265,8 +1265,14 @@ static inline void tl_to_darg(struct dentry_info_args *darg, darg->parent_ino = le32_to_cpu(fcd.fc_parent_ino); darg->ino = le32_to_cpu(fcd.fc_ino); darg->dname = val + offsetof(struct ext4_fc_dentry_info, fc_dname); - darg->dname_len = le16_to_cpu(tl->fc_len) - - sizeof(struct ext4_fc_dentry_info); + darg->dname_len = tl->fc_len - sizeof(struct ext4_fc_dentry_info); +} + +static inline void ext4_fc_get_tl(struct ext4_fc_tl *tl, u8 *val) +{ + memcpy(tl, val, EXT4_FC_TAG_BASE_LEN); + tl->fc_len = le16_to_cpu(tl->fc_len); + tl->fc_tag = le16_to_cpu(tl->fc_tag); } /* Unlink replay function */ @@ -1431,7 +1437,7 @@ static int ext4_fc_replay_inode(struct super_block *sb, struct ext4_fc_tl *tl, struct ext4_inode *raw_fc_inode; struct inode *inode = NULL; struct ext4_iloc iloc; - int inode_len, ino, ret, tag = le16_to_cpu(tl->fc_tag); + int inode_len, ino, ret, tag = tl->fc_tag; struct ext4_extent_header *eh; memcpy(&fc_inode, val, sizeof(fc_inode)); @@ -1456,7 +1462,7 @@ static int ext4_fc_replay_inode(struct super_block *sb, struct ext4_fc_tl *tl, if (ret) goto out; - inode_len = le16_to_cpu(tl->fc_len) - sizeof(struct ext4_fc_inode); + inode_len = tl->fc_len - sizeof(struct ext4_fc_inode); raw_inode = ext4_raw_inode(&iloc); memcpy(raw_inode, raw_fc_inode, offsetof(struct ext4_inode, i_block)); @@ -1969,12 +1975,12 @@ static int ext4_fc_replay_scan(journal_t *journal, state->fc_replay_expected_off++; for (cur = start; cur < end; - cur = cur + EXT4_FC_TAG_BASE_LEN + le16_to_cpu(tl.fc_len)) { - memcpy(&tl, cur, EXT4_FC_TAG_BASE_LEN); + cur = cur + EXT4_FC_TAG_BASE_LEN + tl.fc_len) { + ext4_fc_get_tl(&tl, cur); val = cur + EXT4_FC_TAG_BASE_LEN; jbd_debug(3, "Scan phase, tag:%s, blk %lld\n", - tag2str(le16_to_cpu(tl.fc_tag)), bh->b_blocknr); - switch (le16_to_cpu(tl.fc_tag)) { + tag2str(tl.fc_tag), bh->b_blocknr); + switch (tl.fc_tag) { case EXT4_FC_TAG_ADD_RANGE: memcpy(&ext, val, sizeof(ext)); ex = (struct ext4_extent *)&ext.fc_ex; @@ -1994,7 +2000,7 @@ static int ext4_fc_replay_scan(journal_t *journal, case EXT4_FC_TAG_PAD: state->fc_cur_tag++; state->fc_crc = ext4_chksum(sbi, state->fc_crc, cur, - EXT4_FC_TAG_BASE_LEN + le16_to_cpu(tl.fc_len)); + EXT4_FC_TAG_BASE_LEN + tl.fc_len); break; case EXT4_FC_TAG_TAIL: state->fc_cur_tag++; @@ -2027,7 +2033,7 @@ static int ext4_fc_replay_scan(journal_t *journal, } state->fc_cur_tag++; state->fc_crc = ext4_chksum(sbi, state->fc_crc, cur, - EXT4_FC_TAG_BASE_LEN + le16_to_cpu(tl.fc_len)); + EXT4_FC_TAG_BASE_LEN + tl.fc_len); break; default: ret = state->fc_replay_num_tags ? @@ -2083,8 +2089,8 @@ static int ext4_fc_replay(journal_t *journal, struct buffer_head *bh, end = (__u8 *)bh->b_data + journal->j_blocksize - 1; for (cur = start; cur < end; - cur = cur + EXT4_FC_TAG_BASE_LEN + le16_to_cpu(tl.fc_len)) { - memcpy(&tl, cur, EXT4_FC_TAG_BASE_LEN); + cur = cur + EXT4_FC_TAG_BASE_LEN + tl.fc_len) { + ext4_fc_get_tl(&tl, cur); val = cur + EXT4_FC_TAG_BASE_LEN; if (state->fc_replay_num_tags == 0) { @@ -2092,10 +2098,9 @@ static int ext4_fc_replay(journal_t *journal, struct buffer_head *bh, ext4_fc_set_bitmaps_and_counters(sb); break; } - jbd_debug(3, "Replay phase, tag:%s\n", - tag2str(le16_to_cpu(tl.fc_tag))); + ext4_debug("Replay phase, tag:%s\n", tag2str(tl.fc_tag)); state->fc_replay_num_tags--; - switch (le16_to_cpu(tl.fc_tag)) { + switch (tl.fc_tag) { case EXT4_FC_TAG_LINK: ret = ext4_fc_replay_link(sb, &tl, val); break; @@ -2116,19 +2121,18 @@ static int ext4_fc_replay(journal_t *journal, struct buffer_head *bh, break; case EXT4_FC_TAG_PAD: trace_ext4_fc_replay(sb, EXT4_FC_TAG_PAD, 0, - le16_to_cpu(tl.fc_len), 0); + tl.fc_len, 0); break; case EXT4_FC_TAG_TAIL: - trace_ext4_fc_replay(sb, EXT4_FC_TAG_TAIL, 0, - le16_to_cpu(tl.fc_len), 0); + trace_ext4_fc_replay(sb, EXT4_FC_TAG_TAIL, + 0, tl.fc_len, 0); memcpy(&tail, val, sizeof(tail)); WARN_ON(le32_to_cpu(tail.fc_tid) != expected_tid); break; case EXT4_FC_TAG_HEAD: break; default: - trace_ext4_fc_replay(sb, le16_to_cpu(tl.fc_tag), 0, - le16_to_cpu(tl.fc_len), 0); + trace_ext4_fc_replay(sb, tl.fc_tag, 0, tl.fc_len, 0); ret = -ECANCELED; break; } -- 2.39.2

1 3

[PATCH OLK-6.6 0/5] *** Mainline PATCH backport ***
by Xinyu Zheng 03 Nov '25

03 Nov '25

Daniel Tang (1): ACPI: TAD: Add missing sysfs_remove_group() for ACPI_TAD_RT Huisong Li (1): ACPI: processor: idle: Fix memory leak when register cpuidle device failed Rafael J. Wysocki (1): PM: sleep: core: Clear power.must_resume in noirq suspend error path Sean Christopherson (2): x86/umip: Check that the instruction opcode is at least two bytes x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) arch/x86/kernel/umip.c | 15 +++++++++++++-- drivers/acpi/acpi_tad.c | 3 +++ drivers/acpi/processor_idle.c | 3 +++ drivers/base/power/main.c | 14 +++++++++++++- 4 files changed, 32 insertions(+), 3 deletions(-) -- 2.34.1

2 6

[PATCH openEuler-1.0] tty: vt: Fix vc_origin buffer copy overflow in fbcon_prepare_logo()
by Chen Jun 03 Nov '25

03 Nov '25

From: Wang ShaoBo <bobo.shaobowang(a)huawei.com> Offering: HULK hulk inclusion category: bugfix bugzilla: NA CVE: NA ---------------------------------------------------------------------- I got some KASAN report as below: BUG: KASAN: slab-use-after-free in fbcon_prepare_logo+0x61e/0xc90 Read of size 14 at addr ffff88812c9a4c38 by task syz.0.3549/19016 CPU: 0 PID: 19016 Comm: syz.0.3549 Not tainted 6.6.0+ #80 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x72/0xa0 print_address_description.constprop.0+0x6b/0x3d0 ? fbcon_prepare_logo+0x61e/0xc90 print_report+0xba/0x280 ? fbcon_prepare_logo+0x61e/0xc90 ? kasan_addr_to_slab+0xd/0xa0 ? fbcon_prepare_logo+0x61e/0xc90 kasan_report+0xaf/0xe0 ? fbcon_prepare_logo+0x61e/0xc90 kasan_check_range+0x100/0x1c0 __asan_memcpy+0x23/0x60 fbcon_prepare_logo+0x61e/0xc90 fbcon_init+0xeb9/0x1db0 ? __pfx_drm_fb_helper_set_par+0x10/0x10 visual_init+0x310/0x5c0 do_bind_con_driver.isra.0+0x627/0xbd0 store_bind+0x60b/0x710 ? __pfx_store_bind+0x10/0x10 dev_attr_store+0x5a/0x90 ? __pfx_dev_attr_store+0x10/0x10 sysfs_kf_write+0x145/0x1b0 kernfs_fop_write_iter+0x367/0x580 ? __pfx_sysfs_kf_write+0x10/0x10 new_sync_write+0x1b1/0x2d0 ? __pfx_new_sync_write+0x10/0x10 ? rb_commit+0x121/0x910 ? avc_policy_seqno+0xe/0x20 ? selinux_file_permission+0x129/0x5d0 ? security_file_permission+0xa8/0x700 vfs_write+0x71a/0x960 ksys_write+0x12e/0x260 fbcon_init() -> vc_resize() //success resize vc_origin buffer size=224=7(cols)*2*16(rows) -> bcon_prepare_logo(vc, info, old_cols, old_rows, new_cols, new_rows) //old_cols=256，old_rows=4，new_cols=7，new_rows=16 There happened to be a vc_origin buffer copy overflow error in fbcon_prepare_logo(), scrolling screen down when using old cols after vc resize would trigger out of lower bound of vc_origin buffer. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Wang ShaoBo <bobo.shaobowang(a)huawei.com> Acked-by: Thomas Zimmermann <tzimmermann(a)suse.de> --- drivers/video/fbdev/core/fbcon.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c index f5178eefec64..83a4949e2497 100644 --- a/drivers/video/fbdev/core/fbcon.c +++ b/drivers/video/fbdev/core/fbcon.c @@ -592,6 +592,8 @@ static void fbcon_prepare_logo(struct vc_data *vc, struct fb_info *info, /* We can scroll screen down */ r = q - step - cols; for (cnt = rows - logo_lines; cnt > 0; cnt--) { + if (r < (unsigned short *) vc->vc_origin) + break; scr_memcpyw(r + step, r, vc->vc_size_row); r -= cols; } -- 2.22.0

1 0

[PATCH OLK-6.6 0/2] *** SUBJECT HERE ***
by Zhao Yipeng 03 Nov '25

03 Nov '25

*** BLURB HERE *** Michael Chan (1): bnxt_en: Fix possible crash after creating sw mqprio TCs Sreekanth Reddy (1): bnxt_en: Fix memory corruption when FW resources change during ifdown drivers/net/ethernet/broadcom/bnxt/bnxt.c | 32 +++++++++++++------ drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 + drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c | 2 +- .../net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 4 +-- drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c | 2 +- 5 files changed, 28 insertions(+), 13 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10 0/5] CVE-2022-49722
by Xiaomeng Zhang 03 Nov '25

03 Nov '25

Jacob Keller (2): ice: convert ice_reset_vf to standard error codes ice: convert ice_reset_vf to take flags Michal Jaron (1): ice: Fix call trace with null VSI during VF reset Norbert Zulinski (1): ice: Fix spurious interrupt during removal of trusted VF Przemyslaw Patynowski (1): ice: Fix memory corruption in VF driver drivers/net/ethernet/intel/ice/ice_base.c | 4 +- drivers/net/ethernet/intel/ice/ice_lib.c | 25 +++++++++ drivers/net/ethernet/intel/ice/ice_lib.h | 1 + drivers/net/ethernet/intel/ice/ice_main.c | 2 +- .../net/ethernet/intel/ice/ice_virtchnl_pf.c | 52 ++++++++++++++----- .../net/ethernet/intel/ice/ice_virtchnl_pf.h | 14 +++-- 6 files changed, 79 insertions(+), 19 deletions(-) -- 2.34.1

2 6

[PATCH openEuler-1.0-LTS 0/5] *** CVE-2023-53199 ***
by Ziming Du 03 Nov '25

03 Nov '25

*** BLURB HERE *** Arnd Bergmann (1): wifi: ath9k: use proper statements in conditionals Fedor Pchelkin (1): wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails Pavel Skripkin (1): ath9k: htc: clean up statistics macros Wan Jiabing (1): ath9k: hif_usb: simplify if-if to if-else Zekun Shen (1): ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream drivers/net/wireless/ath/ath9k/hif_usb.c | 63 ++++++++++++------- drivers/net/wireless/ath/ath9k/htc.h | 32 +++++----- drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 10 +-- 3 files changed, 64 insertions(+), 41 deletions(-) -- 2.43.0

2 6

[PATCH OLK-6.6] fs: udf: fix OOB read in lengthAllocDescs handling
by Yifan Qiao 03 Nov '25

03 Nov '25

From: Larshin Sergey <Sergey.Larshin(a)kaspersky.com> mainline inclusion from mainline-v6.18-rc1 commit 3bd5e45c2ce30e239d596becd5db720f7eb83c99 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID3WJ5 CVE: CVE-2025-40044 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When parsing Allocation Extent Descriptor, lengthAllocDescs comes from on-disk data and must be validated against the block size. Crafted or corrupted images may set lengthAllocDescs so that the total descriptor length (sizeof(allocExtDesc) + lengthAllocDescs) exceeds the buffer, leading udf_update_tag() to call crc_itu_t() on out-of-bounds memory and trigger a KASAN use-after-free read. BUG: KASAN: use-after-free in crc_itu_t+0x1d5/0x2b0 lib/crc-itu-t.c:60 Read of size 1 at addr ffff888041e7d000 by task syz-executor317/5309 CPU: 0 UID: 0 PID: 5309 Comm: syz-executor317 Not tainted 6.12.0-rc4-syzkaller-00261-g850925a8133c #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 crc_itu_t+0x1d5/0x2b0 lib/crc-itu-t.c:60 udf_update_tag+0x70/0x6a0 fs/udf/misc.c:261 udf_write_aext+0x4d8/0x7b0 fs/udf/inode.c:2179 extent_trunc+0x2f7/0x4a0 fs/udf/truncate.c:46 udf_truncate_tail_extent+0x527/0x7e0 fs/udf/truncate.c:106 udf_release_file+0xc1/0x120 fs/udf/file.c:185 __fput+0x23f/0x880 fs/file_table.c:431 task_work_run+0x24f/0x310 kernel/task_work.c:239 exit_task_work include/linux/task_work.h:43 [inline] do_exit+0xa2f/0x28e0 kernel/exit.c:939 do_group_exit+0x207/0x2c0 kernel/exit.c:1088 __do_sys_exit_group kernel/exit.c:1099 [inline] __se_sys_exit_group kernel/exit.c:1097 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1097 x64_sys_call+0x2634/0x2640 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> Validate the computed total length against epos->bh->b_size. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Reported-by: syzbot+8743fca924afed42f93e(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=8743fca924afed42f93e Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable(a)vger.kernel.org Signed-off-by: Larshin Sergey <Sergey.Larshin(a)kaspersky.com> Link: https://patch.msgid.link/20250922131358.745579-1-Sergey.Larshin@kaspersky.c… Signed-off-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/udf/inode.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/udf/inode.c b/fs/udf/inode.c index e98c198f85b9..8b842d33a9e0 100644 --- a/fs/udf/inode.c +++ b/fs/udf/inode.c @@ -2264,6 +2264,9 @@ int udf_current_aext(struct inode *inode, struct extent_position *epos, if (check_add_overflow(sizeof(struct allocExtDesc), le32_to_cpu(header->lengthAllocDescs), &alen)) return -1; + + if (alen > epos->bh->b_size) + return -1; } switch (iinfo->i_alloc_type) { -- 2.39.2

2 1

[PATCH OLK-5.10] fs: udf: fix OOB read in lengthAllocDescs handling
by Yifan Qiao 03 Nov '25

03 Nov '25

From: Larshin Sergey <Sergey.Larshin(a)kaspersky.com> mainline inclusion from mainline-v6.18-rc1 commit 3bd5e45c2ce30e239d596becd5db720f7eb83c99 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID3WJ5 CVE: CVE-2025-40044 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When parsing Allocation Extent Descriptor, lengthAllocDescs comes from on-disk data and must be validated against the block size. Crafted or corrupted images may set lengthAllocDescs so that the total descriptor length (sizeof(allocExtDesc) + lengthAllocDescs) exceeds the buffer, leading udf_update_tag() to call crc_itu_t() on out-of-bounds memory and trigger a KASAN use-after-free read. BUG: KASAN: use-after-free in crc_itu_t+0x1d5/0x2b0 lib/crc-itu-t.c:60 Read of size 1 at addr ffff888041e7d000 by task syz-executor317/5309 CPU: 0 UID: 0 PID: 5309 Comm: syz-executor317 Not tainted 6.12.0-rc4-syzkaller-00261-g850925a8133c #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 crc_itu_t+0x1d5/0x2b0 lib/crc-itu-t.c:60 udf_update_tag+0x70/0x6a0 fs/udf/misc.c:261 udf_write_aext+0x4d8/0x7b0 fs/udf/inode.c:2179 extent_trunc+0x2f7/0x4a0 fs/udf/truncate.c:46 udf_truncate_tail_extent+0x527/0x7e0 fs/udf/truncate.c:106 udf_release_file+0xc1/0x120 fs/udf/file.c:185 __fput+0x23f/0x880 fs/file_table.c:431 task_work_run+0x24f/0x310 kernel/task_work.c:239 exit_task_work include/linux/task_work.h:43 [inline] do_exit+0xa2f/0x28e0 kernel/exit.c:939 do_group_exit+0x207/0x2c0 kernel/exit.c:1088 __do_sys_exit_group kernel/exit.c:1099 [inline] __se_sys_exit_group kernel/exit.c:1097 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1097 x64_sys_call+0x2634/0x2640 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> Validate the computed total length against epos->bh->b_size. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Reported-by: syzbot+8743fca924afed42f93e(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=8743fca924afed42f93e Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable(a)vger.kernel.org Signed-off-by: Larshin Sergey <Sergey.Larshin(a)kaspersky.com> Link: https://patch.msgid.link/20250922131358.745579-1-Sergey.Larshin@kaspersky.c… Signed-off-by: Jan Kara <jack(a)suse.cz> Conflicts: fs/udf/inode.c [Context difference] Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/udf/inode.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/udf/inode.c b/fs/udf/inode.c index 6ff9cc8adb26..2e4ada655995 100644 --- a/fs/udf/inode.c +++ b/fs/udf/inode.c @@ -2193,6 +2193,9 @@ int8_t udf_current_aext(struct inode *inode, struct extent_position *epos, if (check_add_overflow((int)sizeof(struct allocExtDesc), (int)le32_to_cpu(header->lengthAllocDescs), &alen)) return -1; + + if (alen > epos->bh->b_size) + return -1; } switch (iinfo->i_alloc_type) { -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] fs: udf: fix OOB read in lengthAllocDescs handling
by Yifan Qiao 03 Nov '25

03 Nov '25

From: Larshin Sergey <Sergey.Larshin(a)kaspersky.com> mainline inclusion from mainline-v6.18-rc1 commit 3bd5e45c2ce30e239d596becd5db720f7eb83c99 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID3WJ5 CVE: CVE-2025-40044 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When parsing Allocation Extent Descriptor, lengthAllocDescs comes from on-disk data and must be validated against the block size. Crafted or corrupted images may set lengthAllocDescs so that the total descriptor length (sizeof(allocExtDesc) + lengthAllocDescs) exceeds the buffer, leading udf_update_tag() to call crc_itu_t() on out-of-bounds memory and trigger a KASAN use-after-free read. BUG: KASAN: use-after-free in crc_itu_t+0x1d5/0x2b0 lib/crc-itu-t.c:60 Read of size 1 at addr ffff888041e7d000 by task syz-executor317/5309 CPU: 0 UID: 0 PID: 5309 Comm: syz-executor317 Not tainted 6.12.0-rc4-syzkaller-00261-g850925a8133c #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 crc_itu_t+0x1d5/0x2b0 lib/crc-itu-t.c:60 udf_update_tag+0x70/0x6a0 fs/udf/misc.c:261 udf_write_aext+0x4d8/0x7b0 fs/udf/inode.c:2179 extent_trunc+0x2f7/0x4a0 fs/udf/truncate.c:46 udf_truncate_tail_extent+0x527/0x7e0 fs/udf/truncate.c:106 udf_release_file+0xc1/0x120 fs/udf/file.c:185 __fput+0x23f/0x880 fs/file_table.c:431 task_work_run+0x24f/0x310 kernel/task_work.c:239 exit_task_work include/linux/task_work.h:43 [inline] do_exit+0xa2f/0x28e0 kernel/exit.c:939 do_group_exit+0x207/0x2c0 kernel/exit.c:1088 __do_sys_exit_group kernel/exit.c:1099 [inline] __se_sys_exit_group kernel/exit.c:1097 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1097 x64_sys_call+0x2634/0x2640 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> Validate the computed total length against epos->bh->b_size. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Reported-by: syzbot+8743fca924afed42f93e(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=8743fca924afed42f93e Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable(a)vger.kernel.org Signed-off-by: Larshin Sergey <Sergey.Larshin(a)kaspersky.com> Link: https://patch.msgid.link/20250922131358.745579-1-Sergey.Larshin@kaspersky.c… Signed-off-by: Jan Kara <jack(a)suse.cz> Conflict: fs/udf/inode.c [Context difference] Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/udf/inode.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/udf/inode.c b/fs/udf/inode.c index 11f104931254..108a1fd75024 100644 --- a/fs/udf/inode.c +++ b/fs/udf/inode.c @@ -2129,6 +2129,9 @@ int8_t udf_current_aext(struct inode *inode, struct extent_position *epos, alen = sizeof(struct allocExtDesc) + le32_to_cpu(((struct allocExtDesc *)epos->bh->b_data)-> lengthAllocDescs); + + if (alen > epos->bh->b_size) + return -1; } switch (iinfo->i_alloc_type) { -- 2.39.2

2 1

[PATCH OLK-6.6] KVM: arm64: Prevent access to vCPU events before init
by Pu Lehui 03 Nov '25

03 Nov '25

From: Oliver Upton <oliver.upton(a)linux.dev> mainline inclusion from mainline-v6.18-rc2 commit 0aa1b76fe1429629215a7c79820e4b96233ac4a3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID4A6U CVE: CVE-2025-40102 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Another day, another syzkaller bug. KVM erroneously allows userspace to pend vCPU events for a vCPU that hasn't been initialized yet, leading to KVM interpreting a bunch of uninitialized garbage for routing / injecting the exception. In one case the injection code and the hyp disagree on whether the vCPU has a 32bit EL1 and put the vCPU into an illegal mode for AArch64, tripping the BUG() in exception_target_el() during the next injection: kernel BUG at arch/arm64/kvm/inject_fault.c:40! Internal error: Oops - BUG: 00000000f2000800 [#1] SMP CPU: 3 UID: 0 PID: 318 Comm: repro Not tainted 6.17.0-rc4-00104-g10fd0285305d #6 PREEMPT Hardware name: linux,dummy-virt (DT) pstate: 21402009 (nzCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) pc : exception_target_el+0x88/0x8c lr : pend_serror_exception+0x18/0x13c sp : ffff800082f03a10 x29: ffff800082f03a10 x28: ffff0000cb132280 x27: 0000000000000000 x26: 0000000000000000 x25: ffff0000c2a99c20 x24: 0000000000000000 x23: 0000000000008000 x22: 0000000000000002 x21: 0000000000000004 x20: 0000000000008000 x19: ffff0000c2a99c20 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 00000000200000c0 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000 x8 : ffff800082f03af8 x7 : 0000000000000000 x6 : 0000000000000000 x5 : ffff800080f621f0 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 000000000040009b x1 : 0000000000000003 x0 : ffff0000c2a99c20 Call trace: exception_target_el+0x88/0x8c (P) kvm_inject_serror_esr+0x40/0x3b4 __kvm_arm_vcpu_set_events+0xf0/0x100 kvm_arch_vcpu_ioctl+0x180/0x9d4 kvm_vcpu_ioctl+0x60c/0x9f4 __arm64_sys_ioctl+0xac/0x104 invoke_syscall+0x48/0x110 el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x34/0xf0 el0t_64_sync_handler+0xa0/0xe4 el0t_64_sync+0x198/0x19c Code: f946bc01 b4fffe61 9101e020 17fffff2 (d4210000) Reject the ioctls outright as no sane VMM would call these before KVM_ARM_VCPU_INIT anyway. Even if it did the exception would've been thrown away by the eventual reset of the vCPU's state. Cc: stable(a)vger.kernel.org # 6.17 Fixes: b7b27facc7b5 ("arm/arm64: KVM: Add KVM_GET/SET_VCPU_EVENTS") Signed-off-by: Oliver Upton <oliver.upton(a)linux.dev> Signed-off-by: Marc Zyngier <maz(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- arch/arm64/kvm/arm.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c index d3831c273843..412c12b22914 100644 --- a/arch/arm64/kvm/arm.c +++ b/arch/arm64/kvm/arm.c @@ -1916,6 +1916,9 @@ long kvm_arch_vcpu_ioctl(struct file *filp, case KVM_GET_VCPU_EVENTS: { struct kvm_vcpu_events events; + if (!kvm_vcpu_initialized(vcpu)) + return -ENOEXEC; + if (kvm_arm_vcpu_get_events(vcpu, &events)) return -EINVAL; @@ -1927,6 +1930,9 @@ long kvm_arch_vcpu_ioctl(struct file *filp, case KVM_SET_VCPU_EVENTS: { struct kvm_vcpu_events events; + if (!kvm_vcpu_initialized(vcpu)) + return -ENOEXEC; + if (copy_from_user(&events, argp, sizeof(events))) return -EFAULT; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS V1] drm/radeon: Fix PCI device refcount leak in radeon_atrm_get_bios()
by Cheng Yu 03 Nov '25

03 Nov '25

From: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> stable inclusion from stable-v4.19.270 commit 1079df6acf56f99d86b0081a38c84701412cc90e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID0VFO CVE: CVE-2022-50520 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 725a521a18734f65de05b8d353b5bd0d3ca4c37a ] As comment of pci_get_class() says, it returns a pci_device with its refcount increased and decreased the refcount for the input parameter @from if it is not NULL. If we break the loop in radeon_atrm_get_bios() with 'pdev' not NULL, we need to call pci_dev_put() to decrease the refcount. Add the missing pci_dev_put() to avoid refcount leak. Fixes: d8ade3526b2a ("drm/radeon: handle non-VGA class pci devices with ATRM") Fixes: c61e2775873f ("drm/radeon: split ATRM support out from the ATPX handler (v3)") Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- drivers/gpu/drm/radeon/radeon_bios.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/radeon/radeon_bios.c b/drivers/gpu/drm/radeon/radeon_bios.c index 80562aeb8149..92f50b26e4c9 100644 --- a/drivers/gpu/drm/radeon/radeon_bios.c +++ b/drivers/gpu/drm/radeon/radeon_bios.c @@ -215,6 +215,7 @@ static bool radeon_atrm_get_bios(struct radeon_device *rdev) if (!found) return false; + pci_dev_put(pdev); rdev->bios = kmalloc(size, GFP_KERNEL); if (!rdev->bios) { -- 2.25.1

2 1

[openeuler:OLK-6.6 3083/3083] drivers/gpu/drm/phytium/phytium_platform.c:348:34: warning: unused variable 'display_of_match'
by kernel test robot 03 Nov '25

03 Nov '25

Hi xuyan, First bad commit (maybe != root cause): tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 923d7e38d0e74b4ae16ccb56d089c2210d2ea5d3 commit: 3b4a5906fa714bdc9a15fc04374942888737eb4c [3083/3083] drm/phytium: Fix Phytium DRM build fail config: x86_64-randconfig-123-20251103 (https://download.01.org/0day-ci/archive/20251103/202511031139.BP8204ku-lkp@…) compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251103/202511031139.BP8204ku-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511031139.BP8204ku-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/gpu/drm/phytium/phytium_platform.c:22:5: warning: no previous prototype for function 'phytium_platform_carveout_mem_init' [-Wmissing-prototypes] 22 | int phytium_platform_carveout_mem_init(struct platform_device *pdev, | ^ drivers/gpu/drm/phytium/phytium_platform.c:22:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 22 | int phytium_platform_carveout_mem_init(struct platform_device *pdev, | ^ | static drivers/gpu/drm/phytium/phytium_platform.c:63:6: warning: no previous prototype for function 'phytium_platform_carveout_mem_fini' [-Wmissing-prototypes] 63 | void phytium_platform_carveout_mem_fini(struct platform_device *pdev, | ^ drivers/gpu/drm/phytium/phytium_platform.c:63:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 63 | void phytium_platform_carveout_mem_fini(struct platform_device *pdev, | ^ | static >> drivers/gpu/drm/phytium/phytium_platform.c:348:34: warning: unused variable 'display_of_match' [-Wunused-const-variable] 348 | static const struct of_device_id display_of_match[] = { | ^~~~~~~~~~~~~~~~ 3 warnings generated. vim +/display_of_match +348 drivers/gpu/drm/phytium/phytium_platform.c b80df10f845813 lishuo 2024-01-31 347 b80df10f845813 lishuo 2024-01-31 @348 static const struct of_device_id display_of_match[] = { b80df10f845813 lishuo 2024-01-31 349 { b80df10f845813 lishuo 2024-01-31 350 .compatible = "phytium,dc", b80df10f845813 lishuo 2024-01-31 351 .data = &pe220x_info, b80df10f845813 lishuo 2024-01-31 352 }, b80df10f845813 lishuo 2024-01-31 353 { } b80df10f845813 lishuo 2024-01-31 354 }; e2cdf30a3e12bb XuYan 2025-04-09 355 MODULE_DEVICE_TABLE(of, display_of_match); b80df10f845813 lishuo 2024-01-31 356 :::::: The code at line 348 was first introduced by commit :::::: b80df10f845813bb4fc2002b5386ecdfa8be5f6c DRM: Phytium display DRM driver :::::: TO: lishuo <lishuo(a)phytium.com.cn> :::::: CC: lishuo <lishuo(a)phytium.com.cn> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] ice: Fix memory corruption in VF driver
by Xiaomeng Zhang 03 Nov '25

03 Nov '25

From: Przemyslaw Patynowski <przemyslawx.patynowski(a)intel.com> mainline inclusion from mainline-v5.19-rc3 commit efe41860008e57fb6b69855b4b93fdf34bc42798 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP3Y9 CVE: CVE-2022-49722 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Disable VF's RX/TX queues, when it's disabled. VF can have queues enabled, when it requests a reset. If PF driver assumes that VF is disabled, while VF still has queues configured, VF may unmap DMA resources. In such scenario device still can map packets to memory, which ends up silently corrupting it. Previously, VF driver could experience memory corruption, which lead to crash: [ 5119.170157] BUG: unable to handle kernel paging request at 00001b9780003237 [ 5119.170166] PGD 0 P4D 0 [ 5119.170173] Oops: 0002 [#1] PREEMPT_RT SMP PTI [ 5119.170181] CPU: 30 PID: 427592 Comm: kworker/u96:2 Kdump: loaded Tainted: G W I --------- - - 4.18.0-372.9.1.rt7.166.el8.x86_64 #1 [ 5119.170189] Hardware name: Dell Inc. PowerEdge R740/014X06, BIOS 2.3.10 08/15/2019 [ 5119.170193] Workqueue: iavf iavf_adminq_task [iavf] [ 5119.170219] RIP: 0010:__page_frag_cache_drain+0x5/0x30 [ 5119.170238] Code: 0f 0f b6 77 51 85 f6 74 07 31 d2 e9 05 df ff ff e9 90 fe ff ff 48 8b 05 49 db 33 01 eb b4 0f 1f 80 00 00 00 00 0f 1f 44 00 00 <f0> 29 77 34 74 01 c3 48 8b 07 f6 c4 80 74 0f 0f b6 77 51 85 f6 74 [ 5119.170244] RSP: 0018:ffffa43b0bdcfd78 EFLAGS: 00010282 [ 5119.170250] RAX: ffffffff896b3e40 RBX: ffff8fb282524000 RCX: 0000000000000002 [ 5119.170254] RDX: 0000000049000000 RSI: 0000000000000000 RDI: 00001b9780003203 [ 5119.170259] RBP: ffff8fb248217b00 R08: 0000000000000022 R09: 0000000000000009 [ 5119.170262] R10: 2b849d6300000000 R11: 0000000000000020 R12: 0000000000000000 [ 5119.170265] R13: 0000000000001000 R14: 0000000000000009 R15: 0000000000000000 [ 5119.170269] FS: 0000000000000000(0000) GS:ffff8fb1201c0000(0000) knlGS:0000000000000000 [ 5119.170274] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 5119.170279] CR2: 00001b9780003237 CR3: 00000008f3e1a003 CR4: 00000000007726e0 [ 5119.170283] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 5119.170286] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 5119.170290] PKRU: 55555554 [ 5119.170292] Call Trace: [ 5119.170298] iavf_clean_rx_ring+0xad/0x110 [iavf] [ 5119.170324] iavf_free_rx_resources+0xe/0x50 [iavf] [ 5119.170342] iavf_free_all_rx_resources.part.51+0x30/0x40 [iavf] [ 5119.170358] iavf_virtchnl_completion+0xd8a/0x15b0 [iavf] [ 5119.170377] ? iavf_clean_arq_element+0x210/0x280 [iavf] [ 5119.170397] iavf_adminq_task+0x126/0x2e0 [iavf] [ 5119.170416] process_one_work+0x18f/0x420 [ 5119.170429] worker_thread+0x30/0x370 [ 5119.170437] ? process_one_work+0x420/0x420 [ 5119.170445] kthread+0x151/0x170 [ 5119.170452] ? set_kthread_struct+0x40/0x40 [ 5119.170460] ret_from_fork+0x35/0x40 [ 5119.170477] Modules linked in: iavf sctp ip6_udp_tunnel udp_tunnel mlx4_en mlx4_core nfp tls vhost_net vhost vhost_iotlb tap tun xt_CHECKSUM ipt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4 nft_compat nft_counter nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables nfnetlink bridge stp llc rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache sunrpc intel_rapl_msr iTCO_wdt iTCO_vendor_support dell_smbios wmi_bmof dell_wmi_descriptor dcdbas kvm_intel kvm irqbypass intel_rapl_common isst_if_common skx_edac irdma nfit libnvdimm x86_pkg_temp_thermal i40e intel_powerclamp coretemp crct10dif_pclmul crc32_pclmul ghash_clmulni_intel ib_uverbs rapl ipmi_ssif intel_cstate intel_uncore mei_me pcspkr acpi_ipmi ib_core mei lpc_ich i2c_i801 ipmi_si ipmi_devintf wmi ipmi_msghandler acpi_power_meter xfs libcrc32c sd_mod t10_pi sg mgag200 drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ice ahci drm libahci crc32c_intel libata tg3 megaraid_sas [ 5119.170613] i2c_algo_bit dm_mirror dm_region_hash dm_log dm_mod fuse [last unloaded: iavf] [ 5119.170627] CR2: 00001b9780003237 Fixes: ec4f5a436bdf ("ice: Check if VF is disabled for Opcode and other operations") Signed-off-by: Przemyslaw Patynowski <przemyslawx.patynowski(a)intel.com> Co-developed-by: Slawomir Laba <slawomirx.laba(a)intel.com> Signed-off-by: Slawomir Laba <slawomirx.laba(a)intel.com> Signed-off-by: Mateusz Palczewski <mateusz.palczewski(a)intel.com> Tested-by: Konrad Jankowski <konrad0.jankowski(a)intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com> Conflicts: drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c drivers/net/ethernet/intel/ice/ice_vf_lib.c [Due to previous commit c5afbe99b778('ice: Add helper function to get the VF's VSI') not merged.] Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- .../net/ethernet/intel/ice/ice_virtchnl_pf.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c b/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c index a980d337861d..dc27850adb56 100644 --- a/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c +++ b/drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c @@ -1261,6 +1261,18 @@ static bool ice_is_vf_disabled(struct ice_vf *vf) test_bit(ICE_VF_STATE_DIS, vf->vf_states)); } +/** + * ice_get_vf_vsi - get VF's VSI based on the stored index + * @vf: VF used to get VSI + */ +struct ice_vsi *ice_get_vf_vsi(struct ice_vf *vf) +{ + if (vf->lan_vsi_idx == ICE_NO_VSI) + return NULL; + + return vf->pf->vsi[vf->lan_vsi_idx]; +} + /** * ice_reset_vf - Reset a particular VF * @vf: pointer to the VF structure @@ -1291,6 +1303,11 @@ bool ice_reset_vf(struct ice_vf *vf, bool is_vflr) } if (ice_is_vf_disabled(vf)) { + vsi = ice_get_vf_vsi(vf); + if (WARN_ON(!vsi)) + return -EINVAL; + ice_vsi_stop_lan_tx_rings(vsi, ICE_NO_RESET, vf->vf_id); + ice_vsi_stop_all_rx_rings(vsi); dev_dbg(dev, "VF is already disabled, there is no need for resetting it, telling VM, all is fine %d\n", vf->vf_id); return true; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/2] *** CVE-2023-53446 ***
by Ziming Du 03 Nov '25

03 Nov '25

*** BLURB HERE *** Daniel Stodden (1): PCI/ASPM: Fix link state exit during switch upstream function removal Ding Hui (1): PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free drivers/pci/pcie/aspm.c | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-) -- 2.43.0

2 3

[PATCH openEuler-1.0-LTS] wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback()
by Ziming Du 03 Nov '25

03 Nov '25

From: Minsuk Kang <linuxlovemin(a)yonsei.ac.kr> stable inclusion from stable-v4.19.276 commit ae4933b4f17de8e2b7ff6f91b17d3b0099a6d6bc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID33EO CVE: CVE-2023-53717 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 8a2f35b9830692f7a616f2f627f943bc748af13a ] Fix a stack-out-of-bounds write that occurs in a WMI response callback function that is called after a timeout occurs in ath9k_wmi_cmd(). The callback writes to wmi->cmd_rsp_buf, a stack-allocated buffer that could no longer be valid when a timeout occurs. Set wmi->last_seq_id to 0 when a timeout occurred. Found by a modified version of syzkaller. BUG: KASAN: stack-out-of-bounds in ath9k_wmi_ctrl_rx Write of size 4 Call Trace: memcpy ath9k_wmi_ctrl_rx ath9k_htc_rx_msg ath9k_hif_usb_reg_in_cb __usb_hcd_giveback_urb usb_hcd_giveback_urb dummy_timer call_timer_fn run_timer_softirq __do_softirq irq_exit_rcu sysvec_apic_timer_interrupt Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.") Signed-off-by: Minsuk Kang <linuxlovemin(a)yonsei.ac.kr> Acked-by: Toke Høiland-Jørgensen <toke(a)toke.dk> Signed-off-by: Kalle Valo <quic_kvalo(a)quicinc.com> Link: https://lore.kernel.org/r/20230104124130.10996-1-linuxlovemin@yonsei.ac.kr Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ziming Du <duziming2(a)huawei.com> --- drivers/net/wireless/ath/ath9k/wmi.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/wireless/ath/ath9k/wmi.c b/drivers/net/wireless/ath/ath9k/wmi.c index f054c7d1c83c1..c111b77b044aa 100644 --- a/drivers/net/wireless/ath/ath9k/wmi.c +++ b/drivers/net/wireless/ath/ath9k/wmi.c @@ -341,6 +341,7 @@ int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id, if (!time_left) { ath_dbg(common, WMI, "Timeout waiting for WMI command: %s\n", wmi_cmd_to_name(cmd_id)); + wmi->last_seq_id = 0; mutex_unlock(&wmi->op_mutex); kfree_skb(skb); return -ETIMEDOUT; -- 2.43.0

2 1

[PATCH OLK-5.10] perf: arm_spe: Prevent overflow in PERF_IDX2OFF()
by Luo Gengkun 03 Nov '25

03 Nov '25

From: Leo Yan <leo.yan(a)arm.com> stable inclusion from stable-v5.10.246 commit 9c045d4501f7f70724a3bbb561f4f22d292bbfe6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID3WGV CVE: CVE-2025-40081 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- [ Upstream commit a29fea30dd93da16652930162b177941abd8c75e ] Cast nr_pages to unsigned long to avoid overflow when handling large AUX buffer sizes (>= 2 GiB). Fixes: d5d9696b0380 ("drivers/perf: Add support for ARMv8.2 Statistical Profiling Extension") Signed-off-by: Leo Yan <leo.yan(a)arm.com> Signed-off-by: Will Deacon <will(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- drivers/perf/arm_spe_pmu.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/perf/arm_spe_pmu.c b/drivers/perf/arm_spe_pmu.c index 3b5d7b690622..30ff2ad32e8d 100644 --- a/drivers/perf/arm_spe_pmu.c +++ b/drivers/perf/arm_spe_pmu.c @@ -94,7 +94,8 @@ struct arm_spe_pmu { #define to_spe_pmu(p) (container_of(p, struct arm_spe_pmu, pmu)) /* Convert a free-running index from perf into an SPE buffer offset */ -#define PERF_IDX2OFF(idx, buf) ((idx) % ((buf)->nr_pages << PAGE_SHIFT)) +#define PERF_IDX2OFF(idx, buf) \ + ((idx) % ((unsigned long)(buf)->nr_pages << PAGE_SHIFT)) /* Keep track of our dynamic hotplug state */ static enum cpuhp_state arm_spe_pmu_online; -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] *** CVE-2025-39973 ***
by Ziming Du 03 Nov '25

03 Nov '25

*** BLURB HERE *** Justin Bronder (1): i40e: increase max descriptors for XL710 Lukasz Czapnik (1): i40e: add validation for ring_len param drivers/net/ethernet/intel/i40e/i40e.h | 1 + .../net/ethernet/intel/i40e/i40e_ethtool.c | 25 ++++++++++++++----- .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 14 +++++++++++ 3 files changed, 34 insertions(+), 6 deletions(-) -- 2.43.0

2 3

[PATCH openEuler-1.0-LTS] fbdev: Fix out-of-bounds issue in sys_fillrect()
by Gu Bowen 03 Nov '25

03 Nov '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICYDSQ -------------------------------- BUG: unable to handle page fault for address: ffffc90000c3f000 PGD 100000067 P4D 100000067 PUD 100c80067 PMD 10ac1c067 PTE 0 Oops: 0002 [#1] PREEMPT SMP KASAN PTI CPU: 3 PID: 6521 Comm: syz.3.1365 Not tainted 6.6.0+ #82 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 RIP: 0010:memset64 arch/x86/include/asm/string_64.h:58 [inline] RIP: 0010:memset_l include/linux/string.h:168 [inline] RIP: 0010:bitfill_aligned drivers/video/fbdev/core/sysfillrect.c:53 [inline] RIP: 0010:bitfill_aligned+0x144/0x1c0 drivers/video/fbdev/core/sysfillrect.c:25 Code: 23 04 24 48 31 d0 49 89 46 f8 44 89 e0 44 29 f8 29 c3 e8 9f 39 49 fe 89 d8 31 d2 4c 89 f7 41 f7 f4 48 89 c3 48 89 c1 48 89 e8 <f3> 48 ab 31 ff 4c 89 ee e8 df 2f 49 fe 4d 85 ed 0f 84 6b ff ff ff RSP: 0018:ffff888119ce7418 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000180 RCX: 0000000000000180 RDX: 0000000000000000 RSI: ffffc90003873000 RDI: ffffc90000c3f000 RBP: 0000000000000000 R08: 0000000000006000 R09: 0000000000000040 R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000040 R13: 0000000000000000 R14: ffffc90000c3f000 R15: 0000000000000000 FS: 00007f1704b926c0(0000) GS:ffff8881f5980000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffc90000c3f000 CR3: 00000001230d0002 CR4: 0000000000770ee0 DR0: 0000000000000000 DR1: 000000000000e000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 PKRU: 80000000 Call Trace: <TASK> sys_fillrect+0x429/0x830 drivers/video/fbdev/core/sysfillrect.c:281 drm_fbdev_generic_defio_fillrect+0x27/0x140 drivers/gpu/drm/drm_fbdev_generic.c:37 bit_clear+0x183/0x220 drivers/video/fbdev/core/bitblit.c:73 __fbcon_clear+0x5ea/0x670 drivers/video/fbdev/core/fbcon.c:1281 fbcon_scroll+0x41e/0x560 drivers/video/fbdev/core/fbcon.c:1847 con_scroll+0x464/0x6a0 drivers/tty/vt/vt.c:577 lf+0x274/0x2d0 drivers/tty/vt/vt.c:1461 do_con_trol+0x5ea/0x3d80 drivers/tty/vt/vt.c:2149 do_con_write+0x780/0x10c0 drivers/tty/vt/vt.c:2905 con_write+0x28/0xc0 drivers/tty/vt/vt.c:3245 do_output_char+0x5de/0x850 drivers/tty/n_tty.c:433 process_output drivers/tty/n_tty.c:500 [inline] n_tty_write+0x442/0xb00 drivers/tty/n_tty.c:2406 iterate_tty_write+0x2b5/0x630 drivers/tty/tty_io.c:1017 file_tty_write.constprop.0+0x20c/0x3b0 drivers/tty/tty_io.c:1088 call_write_iter include/linux/fs.h:2085 [inline] do_iter_readv_writev+0x210/0x3c0 fs/read_write.c:737 do_iter_write+0x181/0x4e0 fs/read_write.c:862 vfs_writev+0x15b/0x4d0 fs/read_write.c:935 do_writev+0x136/0x370 fs/read_write.c:978 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x59/0x110 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x78/0xe2 When the virtual console is rotated in the backend state, it can lead to inconsistencies between the size of the virtual console's size and its hook functions. In such cases, clearing the screen may result in out-of-bounds issue. Fix it by adding a check in sys_fillrect() and moving set_blitting_type() to the visible area of the VC. Fixes: 68648ed1f58d ("fbdev: add drawing functions for framebuffers in system RAM") Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- drivers/video/fbdev/core/fbcon.c | 2 +- drivers/video/fbdev/core/sysfillrect.c | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c index f5178eefec64..ec3c71edf72e 100644 --- a/drivers/video/fbdev/core/fbcon.c +++ b/drivers/video/fbdev/core/fbcon.c @@ -2647,9 +2647,9 @@ static void fbcon_modechanged(struct fb_info *info) return; p = &fb_display[vc->vc_num]; - set_blitting_type(vc, info); if (con_is_visible(vc)) { + set_blitting_type(vc, info); var_to_display(p, &info->var, info); cols = FBCON_SWAP(ops->rotate, info->var.xres, info->var.yres); rows = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres); diff --git a/drivers/video/fbdev/core/sysfillrect.c b/drivers/video/fbdev/core/sysfillrect.c index 33ee3d34f9d2..7b4103c3288e 100644 --- a/drivers/video/fbdev/core/sysfillrect.c +++ b/drivers/video/fbdev/core/sysfillrect.c @@ -248,6 +248,7 @@ void sys_fillrect(struct fb_info *p, const struct fb_fillrect *rect) u32 bpp = p->var.bits_per_pixel; unsigned long *dst; int dst_idx, left; + long dst_offset; if (p->state != FBINFO_STATE_RUNNING) return; @@ -287,6 +288,11 @@ void sys_fillrect(struct fb_info *p, const struct fb_fillrect *rect) } while (height--) { dst += dst_idx >> (ffs(bits) - 1); + dst_offset = (long)dst - (long)p->screen_base; + if (dst_offset < 0 || dst_offset >= p->fix.smem_len) { + pr_err("dst offset out of bound: dst_offset(%ld)", dst_offset); + return; + } dst_idx &= (bits - 1); fill_op32(p, dst, dst_idx, pat, width*bpp, bits); dst_idx += p->fix.line_length*8; -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS V2] ext4: avoid crash when inline data creation follows DIO write
by Zizhi Wo 03 Nov '25

03 Nov '25

From: Jan Kara <jack(a)suse.cz> stable inclusion from stable-v5.10.150 commit fb98cb61efff3b2a1964939465ccaaf906af1d4f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID0RD5 CVE: CVE-2022-50435 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 4bb26f2885ac6930984ee451b952c5a6042f2c0e upstream. When inode is created and written to using direct IO, there is nothing to clear the EXT4_STATE_MAY_INLINE_DATA flag. Thus when inode gets truncated later to say 1 byte and written using normal write, we will try to store the data as inline data. This confuses the code later because the inode now has both normal block and inline data allocated and the confusion manifests for example as: kernel BUG at fs/ext4/inode.c:2721! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 359 Comm: repro Not tainted 5.19.0-rc8-00001-g31ba1e3b8305-dirty #15 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-1.fc36 04/01/2014 RIP: 0010:ext4_writepages+0x363d/0x3660 RSP: 0018:ffffc90000ccf260 EFLAGS: 00010293 RAX: ffffffff81e1abcd RBX: 0000008000000000 RCX: ffff88810842a180 RDX: 0000000000000000 RSI: 0000008000000000 RDI: 0000000000000000 RBP: ffffc90000ccf650 R08: ffffffff81e17d58 R09: ffffed10222c680b R10: dfffe910222c680c R11: 1ffff110222c680a R12: ffff888111634128 R13: ffffc90000ccf880 R14: 0000008410000000 R15: 0000000000000001 FS: 00007f72635d2640(0000) GS:ffff88811b000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000565243379180 CR3: 000000010aa74000 CR4: 0000000000150eb0 Call Trace: <TASK> do_writepages+0x397/0x640 filemap_fdatawrite_wbc+0x151/0x1b0 file_write_and_wait_range+0x1c9/0x2b0 ext4_sync_file+0x19e/0xa00 vfs_fsync_range+0x17b/0x190 ext4_buffered_write_iter+0x488/0x530 ext4_file_write_iter+0x449/0x1b90 vfs_write+0xbcd/0xf40 ksys_write+0x198/0x2c0 __x64_sys_write+0x7b/0x90 do_syscall_64+0x3d/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd </TASK> Fix the problem by clearing EXT4_STATE_MAY_INLINE_DATA when we are doing direct IO write to a file. Cc: stable(a)kernel.org Reported-by: Tadeusz Struk <tadeusz.struk(a)linaro.org> Reported-by: syzbot+bd13648a53ed6933ca49(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?id=a1e89d09bbbcbd5c4cb45db230ee28c8229539… Signed-off-by: Jan Kara <jack(a)suse.cz> Reviewed-by: Lukas Czerner <lczerner(a)redhat.com> Tested-by: Tadeusz Struk<tadeusz.struk(a)linaro.org> Link: https://lore.kernel.org/r/20220727155753.13969-1-jack@suse.cz Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/ext4/file.c fs/ext4/inode.c [The current direct_IO implementation function of ext4 is ext4_direct_IO_write(), so modify it in this function.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/ext4/inode.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c index 61c07bbeba03..8f38837f41f3 100644 --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -3677,6 +3677,13 @@ static ssize_t ext4_direct_IO_write(struct kiocb *iocb, struct iov_iter *iter) int orphan = 0; handle_t *handle; + /* + * Make sure inline data cannot be created anymore since we are going + * to allocate blocks for DIO. We know the inode does not have any + * inline data now because ext4_dio_supported() checked for that. + */ + ext4_clear_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA); + if (final_size > inode->i_size || final_size > ei->i_disksize) { /* Credits for sb + inode write */ handle = ext4_journal_start(inode, EXT4_HT_INODE, 2); -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] ipvs: Defer ip_vs_ftp unregister during netns cleanup
by Wang Liang 03 Nov '25

03 Nov '25

From: Slavin Liu <slavin452(a)gmail.com> mainline inclusion from mainline-v6.18-rc1 commit 134121bfd99a06d44ef5ba15a9beb075297c0821 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID3FOO CVE: CVE-2025-40018 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- On the netns cleanup path, __ip_vs_ftp_exit() may unregister ip_vs_ftp before connections with valid cp->app pointers are flushed, leading to a use-after-free. Fix this by introducing a global `exiting_module` flag, set to true in ip_vs_ftp_exit() before unregistering the pernet subsystem. In __ip_vs_ftp_exit(), skip ip_vs_ftp unregister if called during netns cleanup (when exiting_module is false) and defer it to __ip_vs_cleanup_batch(), which unregisters all apps after all connections are flushed. If called during module exit, unregister ip_vs_ftp immediately. Fixes: 61b1ab4583e2 ("IPVS: netns, add basic init per netns.") Suggested-by: Julian Anastasov <ja(a)ssi.bg> Signed-off-by: Slavin Liu <slavin452(a)gmail.com> Signed-off-by: Julian Anastasov <ja(a)ssi.bg> Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/netfilter/ipvs/ip_vs_ftp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c index 4398a72edec5..bed914dc138a 100644 --- a/net/netfilter/ipvs/ip_vs_ftp.c +++ b/net/netfilter/ipvs/ip_vs_ftp.c @@ -59,6 +59,7 @@ enum { IP_VS_FTP_EPSV, }; +static bool exiting_module; /* * List of ports (up to IP_VS_APP_MAX_PORTS) to be handled by helper * First port is set to the default port. @@ -613,7 +614,7 @@ static void __ip_vs_ftp_exit(struct net *net) { struct netns_ipvs *ipvs = net_ipvs(net); - if (!ipvs) + if (!ipvs || !exiting_module) return; unregister_ip_vs_app(ipvs, &ip_vs_ftp); @@ -635,6 +636,7 @@ static int __init ip_vs_ftp_init(void) */ static void __exit ip_vs_ftp_exit(void) { + exiting_module = true; unregister_pernet_subsys(&ip_vs_ftp_ops); /* rcu_barrier() is called by netns */ } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/3] *** CVE-2023-53185 ***
by Ziming Du 03 Nov '25

03 Nov '25

*** BLURB HERE *** Dan Carpenter (1): ath9k: Fix potential out of bounds in ath9k_htc_txcompletion_cb() Fedor Pchelkin (1): wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes Qiujun Huang (1): ath9k: Fix use-after-free Write in ath9k_htc_rx_msg drivers/net/wireless/ath/ath9k/htc_hst.c | 11 +++++++++++ 1 file changed, 11 insertions(+) -- 2.43.0

2 4

[openeuler:OLK-6.6 3083/3083] net/core/filter.c:12101:17: sparse: sparse: symbol 'bpf_xdp_change_dev' was not declared. Should it be static?
by kernel test robot 03 Nov '25

03 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 5394cae209c4a4990d81be436ba17ae56fb09d16 commit: 94ac90c1b608e26cfd82703606d5e13667983b96 [3083/3083] bpf: Add bpf_*_change_dev kfunc config: x86_64-randconfig-123-20251103 (https://download.01.org/0day-ci/archive/20251103/202511030954.SJ0Hsr2z-lkp@…) compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251103/202511030954.SJ0Hsr2z-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511030954.SJ0Hsr2z-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) net/core/filter.c:1416:39: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected struct sock_filter const *filter @@ got struct sock_filter [noderef] __user *filter @@ net/core/filter.c:1416:39: sparse: expected struct sock_filter const *filter net/core/filter.c:1416:39: sparse: got struct sock_filter [noderef] __user *filter net/core/filter.c:1494:39: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected struct sock_filter const *filter @@ got struct sock_filter [noderef] __user *filter @@ net/core/filter.c:1494:39: sparse: expected struct sock_filter const *filter net/core/filter.c:1494:39: sparse: got struct sock_filter [noderef] __user *filter net/core/filter.c:2325:45: sparse: sparse: incorrect type in argument 2 (different base types) @@ expected restricted __be32 [usertype] daddr @@ got unsigned int [usertype] ipv4_nh @@ net/core/filter.c:2325:45: sparse: expected restricted __be32 [usertype] daddr net/core/filter.c:2325:45: sparse: got unsigned int [usertype] ipv4_nh >> net/core/filter.c:12101:17: sparse: sparse: symbol 'bpf_xdp_change_dev' was not declared. Should it be static? net/core/filter.c:1931:43: sparse: sparse: incorrect type in argument 2 (different base types) @@ expected restricted __wsum [usertype] diff @@ got unsigned long long [usertype] to @@ net/core/filter.c:1931:43: sparse: expected restricted __wsum [usertype] diff net/core/filter.c:1931:43: sparse: got unsigned long long [usertype] to net/core/filter.c:1934:36: sparse: sparse: incorrect type in argument 2 (different base types) @@ expected restricted __be16 [usertype] old @@ got unsigned long long [usertype] from @@ net/core/filter.c:1934:36: sparse: expected restricted __be16 [usertype] old net/core/filter.c:1934:36: sparse: got unsigned long long [usertype] from net/core/filter.c:1934:42: sparse: sparse: incorrect type in argument 3 (different base types) @@ expected restricted __be16 [usertype] new @@ got unsigned long long [usertype] to @@ net/core/filter.c:1934:42: sparse: expected restricted __be16 [usertype] new net/core/filter.c:1934:42: sparse: got unsigned long long [usertype] to net/core/filter.c:1937:36: sparse: sparse: incorrect type in argument 2 (different base types) @@ expected restricted __be32 [usertype] from @@ got unsigned long long [usertype] from @@ net/core/filter.c:1937:36: sparse: expected restricted __be32 [usertype] from net/core/filter.c:1937:36: sparse: got unsigned long long [usertype] from net/core/filter.c:1937:42: sparse: sparse: incorrect type in argument 3 (different base types) @@ expected restricted __be32 [usertype] to @@ got unsigned long long [usertype] to @@ net/core/filter.c:1937:42: sparse: expected restricted __be32 [usertype] to net/core/filter.c:1937:42: sparse: got unsigned long long [usertype] to net/core/filter.c:1982:59: sparse: sparse: incorrect type in argument 3 (different base types) @@ expected restricted __wsum [usertype] diff @@ got unsigned long long [usertype] to @@ net/core/filter.c:1982:59: sparse: expected restricted __wsum [usertype] diff net/core/filter.c:1982:59: sparse: got unsigned long long [usertype] to net/core/filter.c:1985:52: sparse: sparse: incorrect type in argument 3 (different base types) @@ expected restricted __be16 [usertype] from @@ got unsigned long long [usertype] from @@ net/core/filter.c:1985:52: sparse: expected restricted __be16 [usertype] from net/core/filter.c:1985:52: sparse: got unsigned long long [usertype] from net/core/filter.c:1985:58: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected restricted __be16 [usertype] to @@ got unsigned long long [usertype] to @@ net/core/filter.c:1985:58: sparse: expected restricted __be16 [usertype] to net/core/filter.c:1985:58: sparse: got unsigned long long [usertype] to net/core/filter.c:1988:52: sparse: sparse: incorrect type in argument 3 (different base types) @@ expected restricted __be32 [usertype] from @@ got unsigned long long [usertype] from @@ net/core/filter.c:1988:52: sparse: expected restricted __be32 [usertype] from net/core/filter.c:1988:52: sparse: got unsigned long long [usertype] from net/core/filter.c:1988:58: sparse: sparse: incorrect type in argument 4 (different base types) @@ expected restricted __be32 [usertype] to @@ got unsigned long long [usertype] to @@ net/core/filter.c:1988:58: sparse: expected restricted __be32 [usertype] to net/core/filter.c:1988:58: sparse: got unsigned long long [usertype] to net/core/filter.c:2034:28: sparse: sparse: incorrect type in return expression (different base types) @@ expected unsigned long long @@ got restricted __wsum @@ net/core/filter.c:2034:28: sparse: expected unsigned long long net/core/filter.c:2034:28: sparse: got restricted __wsum net/core/filter.c:2056:35: sparse: sparse: incorrect type in return expression (different base types) @@ expected unsigned long long @@ got restricted __wsum [usertype] csum @@ net/core/filter.c:2056:35: sparse: expected unsigned long long net/core/filter.c:2056:35: sparse: got restricted __wsum [usertype] csum net/core/filter.c:5895:17: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] spi @@ got restricted __be32 const [usertype] spi @@ net/core/filter.c:5895:17: sparse: expected unsigned int [usertype] spi net/core/filter.c:5895:17: sparse: got restricted __be32 const [usertype] spi net/core/filter.c:5903:33: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] remote_ipv4 @@ got restricted __be32 const [usertype] a4 @@ net/core/filter.c:5903:33: sparse: expected unsigned int [usertype] remote_ipv4 net/core/filter.c:5903:33: sparse: got restricted __be32 const [usertype] a4 vim +/bpf_xdp_change_dev +12101 net/core/filter.c 12100 12101 __bpf_kfunc int bpf_xdp_change_dev(struct xdp_md *xdp_ctx, u32 ifindex) 12102 { 12103 struct xdp_buff *xdp = (struct xdp_buff *)xdp_ctx; 12104 struct hisock_xdp_buff *hxdp = (void *)xdp; 12105 struct net_device *dev; 12106 12107 WARN_ON_ONCE(!rcu_read_lock_held()); 12108 12109 if (!hxdp->skb) 12110 return -EOPNOTSUPP; 12111 12112 dev = dev_get_by_index_rcu(&init_net, ifindex); 12113 if (!dev) 12114 return -ENODEV; 12115 12116 hxdp->skb->dev = dev; 12117 return 0; 12118 } 12119 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] dm array: fix releasing a faulty array block twice in dm_array_cursor_end
by Li Lingfeng 03 Nov '25

03 Nov '25

From: Ming-Hung Tsai <mtsai(a)redhat.com> mainline inclusion from mainline-v6.13-rc7 commit f2893c0804d86230ffb8f1c8703fdbb18648abc8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBIQYC CVE: CVE-2024-57929 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When dm_bm_read_lock() fails due to locking or checksum errors, it releases the faulty block implicitly while leaving an invalid output pointer behind. The caller of dm_bm_read_lock() should not operate on this invalid dm_block pointer, or it will lead to undefined result. For example, the dm_array_cursor incorrectly caches the invalid pointer on reading a faulty array block, causing a double release in dm_array_cursor_end(), then hitting the BUG_ON in dm-bufio cache_put(). Reproduce steps: 1. initialize a cache device dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 65536 linear /dev/sdc 8192" dmsetup create corig --table "0 524288 linear /dev/sdc $262144" dd if=/dev/zero of=/dev/mapper/cmeta bs=4k count=1 dmsetup create cache --table "0 524288 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0" 2. wipe the second array block offline dmsteup remove cache cmeta cdata corig mapping_root=$(dd if=/dev/sdc bs=1c count=8 skip=192 \ 2>/dev/null | hexdump -e '1/8 "%u\n"') ablock=$(dd if=/dev/sdc bs=1c count=8 skip=$((4096*mapping_root+2056)) \ 2>/dev/null | hexdump -e '1/8 "%u\n"') dd if=/dev/zero of=/dev/sdc bs=4k count=1 seek=$ablock 3. try reopen the cache device dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 65536 linear /dev/sdc 8192" dmsetup create corig --table "0 524288 linear /dev/sdc $262144" dmsetup create cache --table "0 524288 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0" Kernel logs: (snip) device-mapper: array: array_block_check failed: blocknr 0 != wanted 10 device-mapper: block manager: array validator check failed for block 10 device-mapper: array: get_ablock failed device-mapper: cache metadata: dm_array_cursor_next for mapping failed ------------[ cut here ]------------ kernel BUG at drivers/md/dm-bufio.c:638! Fix by setting the cached block pointer to NULL on errors. In addition to the reproducer described above, this fix can be verified using the "array_cursor/damaged" test in dm-unit: dm-unit run /pdata/array_cursor/damaged --kernel-dir <KERNEL_DIR> Signed-off-by: Ming-Hung Tsai <mtsai(a)redhat.com> Fixes: fdd1315aa5f0 ("dm array: introduce cursor api") Reviewed-by: Joe Thornber <thornber(a)redhat.com> Signed-off-by: Mike Snitzer <snitzer(a)kernel.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/md/persistent-data/dm-array.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/drivers/md/persistent-data/dm-array.c b/drivers/md/persistent-data/dm-array.c index 185dc60360b5..849eb1b97c43 100644 --- a/drivers/md/persistent-data/dm-array.c +++ b/drivers/md/persistent-data/dm-array.c @@ -907,23 +907,27 @@ static int load_ablock(struct dm_array_cursor *c) if (c->block) unlock_ablock(c->info, c->block); - c->block = NULL; - c->ab = NULL; c->index = 0; r = dm_btree_cursor_get_value(&c->cursor, &key, &value_le); if (r) { DMERR("dm_btree_cursor_get_value failed"); - dm_btree_cursor_end(&c->cursor); + goto out; } else { r = get_ablock(c->info, le64_to_cpu(value_le), &c->block, &c->ab); if (r) { DMERR("get_ablock failed"); - dm_btree_cursor_end(&c->cursor); + goto out; } } + return 0; + +out: + dm_btree_cursor_end(&c->cursor); + c->block = NULL; + c->ab = NULL; return r; } -- 2.46.1

2 1

[PATCH OLK-6.6] KVM: SVM: Skip fastpath emulation on VM-Exit if next RIP isn't valid
by Pan Taixi 03 Nov '25

03 Nov '25

From: Sean Christopherson <seanjc(a)google.com> stable inclusion from stable-v6.6.113 commit cd3efb93677c4b0cf76348882fb429165fee33fd category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID3WHO CVE: CVE-2025-40038 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 0910dd7c9ad45a2605c45fd2bf3d1bcac087687c ] Skip the WRMSR and HLT fastpaths in SVM's VM-Exit handler if the next RIP isn't valid, e.g. because KVM is running with nrips=false. SVM must decode and emulate to skip the instruction if the CPU doesn't provide the next RIP, and getting the instruction bytes to decode requires reading guest memory. Reading guest memory through the emulator can fault, i.e. can sleep, which is disallowed since the fastpath handlers run with IRQs disabled. BUG: sleeping function called from invalid context at ./include/linux/uaccess.h:106 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 32611, name: qemu preempt_count: 1, expected: 0 INFO: lockdep is turned off. irq event stamp: 30580 hardirqs last enabled at (30579): [<ffffffffc08b2527>] vcpu_run+0x1787/0x1db0 [kvm] hardirqs last disabled at (30580): [<ffffffffb4f62e32>] __schedule+0x1e2/0xed0 softirqs last enabled at (30570): [<ffffffffb4247a64>] fpu_swap_kvm_fpstate+0x44/0x210 softirqs last disabled at (30568): [<ffffffffb4247a64>] fpu_swap_kvm_fpstate+0x44/0x210 CPU: 298 UID: 0 PID: 32611 Comm: qemu Tainted: G U 6.16.0-smp--e6c618b51cfe-sleep #782 NONE Tainted: [U]=USER Hardware name: Google Astoria-Turin/astoria, BIOS 0.20241223.2-0 01/17/2025 Call Trace: <TASK> dump_stack_lvl+0x7d/0xb0 __might_resched+0x271/0x290 __might_fault+0x28/0x80 kvm_vcpu_read_guest_page+0x8d/0xc0 [kvm] kvm_fetch_guest_virt+0x92/0xc0 [kvm] __do_insn_fetch_bytes+0xf3/0x1e0 [kvm] x86_decode_insn+0xd1/0x1010 [kvm] x86_emulate_instruction+0x105/0x810 [kvm] __svm_skip_emulated_instruction+0xc4/0x140 [kvm_amd] handle_fastpath_invd+0xc4/0x1a0 [kvm] vcpu_run+0x11a1/0x1db0 [kvm] kvm_arch_vcpu_ioctl_run+0x5cc/0x730 [kvm] kvm_vcpu_ioctl+0x578/0x6a0 [kvm] __se_sys_ioctl+0x6d/0xb0 do_syscall_64+0x8a/0x2c0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f479d57a94b </TASK> Note, this is essentially a reapply of commit 5c30e8101e8d ("KVM: SVM: Skip WRMSR fastpath on VM-Exit if next RIP isn't valid"), but with different justification (KVM now grabs SRCU when skipping the instruction for other reasons). Fixes: b439eb8ab578 ("Revert "KVM: SVM: Skip WRMSR fastpath on VM-Exit if next RIP isn't valid"") Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20250805190526.1453366-2-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc(a)google.com> [ adapted switch-based MSR/HLT fastpath to if-based MSR-only check ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: arch/x86/kvm/svm/svm.c [Context conflicts due to stable commit ca3cc405a3bc ("KVM: x86: Move handling of is_guest_mode() into fastpath exit handlers") not merged. Also this makes nrip check comes after is_guest_mode check, which is fine as both checks return the same exit code.] Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com> --- arch/x86/kvm/svm/svm.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index 8692b7892d0f..7bf68a753a97 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -4206,8 +4206,17 @@ static int svm_vcpu_pre_run(struct kvm_vcpu *vcpu) static fastpath_t svm_exit_handlers_fastpath(struct kvm_vcpu *vcpu) { - if (to_svm(vcpu)->vmcb->control.exit_code == SVM_EXIT_MSR && - to_svm(vcpu)->vmcb->control.exit_info_1) + struct vcpu_svm *svm = to_svm(vcpu); + + /* + * Next RIP must be provided as IRQs are disabled, and accessing guest + * memory to decode the instruction might fault, i.e. might sleep. + */ + if (!nrips || !svm->vmcb->control.next_rip) + return EXIT_FASTPATH_NONE; + + if (svm->vmcb->control.exit_code == SVM_EXIT_MSR && + svm->vmcb->control.exit_info_1) return handle_fastpath_set_msr_irqoff(vcpu); return EXIT_FASTPATH_NONE; -- 2.34.1

2 1

[openeuler:OLK-6.6 3083/3083] mm/memcontrol.c:4061:5: sparse: sparse: symbol 'sysctl_memcg_oom_prio' was not declared. Should it be static?
by kernel test robot 03 Nov '25

03 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 5394cae209c4a4990d81be436ba17ae56fb09d16 commit: 44391f3171b05060096ff496f3507033f2460161 [3083/3083] memcg: Add sysctl memcg_qos_enable config: x86_64-randconfig-123-20251103 (https://download.01.org/0day-ci/archive/20251103/202511030753.dgyTecoe-lkp@…) compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251103/202511030753.dgyTecoe-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511030753.dgyTecoe-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> mm/memcontrol.c:4061:5: sparse: sparse: symbol 'sysctl_memcg_oom_prio' was not declared. Should it be static? mm/memcontrol.c:4223:50: sparse: sparse: incorrect type in argument 3 (different address spaces) @@ expected void * @@ got void [noderef] __user *buffer @@ mm/memcontrol.c:4223:50: sparse: expected void * mm/memcontrol.c:4223:50: sparse: got void [noderef] __user *buffer mm/memcontrol.c:4245:35: sparse: sparse: incorrect type in initializer (incompatible argument 3 (different address spaces)) @@ expected int ( [usertype] *proc_handler )( ... ) @@ got int ( * )( ... ) @@ mm/memcontrol.c:4245:35: sparse: expected int ( [usertype] *proc_handler )( ... ) mm/memcontrol.c:4245:35: sparse: got int ( * )( ... ) mm/memcontrol.c:4504:21: sparse: sparse: incompatible types in comparison expression (different address spaces): mm/memcontrol.c:4504:21: sparse: struct mem_cgroup_threshold_ary [noderef] __rcu * mm/memcontrol.c:4504:21: sparse: struct mem_cgroup_threshold_ary * mm/memcontrol.c:4506:21: sparse: sparse: incompatible types in comparison expression (different address spaces): mm/memcontrol.c:4506:21: sparse: struct mem_cgroup_threshold_ary [noderef] __rcu * mm/memcontrol.c:4506:21: sparse: struct mem_cgroup_threshold_ary * mm/memcontrol.c:4662:9: sparse: sparse: incompatible types in comparison expression (different address spaces): mm/memcontrol.c:4662:9: sparse: struct mem_cgroup_threshold_ary [noderef] __rcu * mm/memcontrol.c:4662:9: sparse: struct mem_cgroup_threshold_ary * mm/memcontrol.c:4756:9: sparse: sparse: incompatible types in comparison expression (different address spaces): mm/memcontrol.c:4756:9: sparse: struct mem_cgroup_threshold_ary [noderef] __rcu * mm/memcontrol.c:4756:9: sparse: struct mem_cgroup_threshold_ary * mm/memcontrol.c:6799:23: sparse: sparse: incompatible types in comparison expression (different address spaces): mm/memcontrol.c:6799:23: sparse: struct task_struct [noderef] __rcu * mm/memcontrol.c:6799:23: sparse: struct task_struct * mm/memcontrol.c:7016:52: sparse: sparse: incompatible types in comparison expression (different address spaces): mm/memcontrol.c:7016:52: sparse: struct task_struct [noderef] __rcu * mm/memcontrol.c:7016:52: sparse: struct task_struct * mm/memcontrol.c: note: in included file: include/linux/memcontrol.h:782:9: sparse: sparse: context imbalance in 'folio_lruvec_lock' - wrong count at exit include/linux/memcontrol.h:782:9: sparse: sparse: context imbalance in 'folio_lruvec_lock_irq' - wrong count at exit include/linux/memcontrol.h:782:9: sparse: sparse: context imbalance in 'folio_lruvec_lock_irqsave' - wrong count at exit mm/memcontrol.c:2134:6: sparse: sparse: context imbalance in 'folio_memcg_lock' - wrong count at exit mm/memcontrol.c:2181:17: sparse: sparse: context imbalance in '__folio_memcg_unlock' - unexpected unlock mm/memcontrol.c:6659:9: sparse: sparse: context imbalance in 'mem_cgroup_count_precharge_pte_range' - unexpected unlock mm/memcontrol.c:6927:9: sparse: sparse: context imbalance in 'mem_cgroup_move_charge_pte_range' - unexpected unlock vim +/sysctl_memcg_oom_prio +4061 mm/memcontrol.c 4057 4058 #ifdef CONFIG_MEMCG_OOM_PRIORITY 4059 #define ENABLE_MEMCG_OOM_PROIRITY 1 4060 #define DISABLE_MEMCG_OOM_PROIRITY 0 > 4061 int sysctl_memcg_oom_prio = DISABLE_MEMCG_OOM_PROIRITY; 4062 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0