- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] can: peak_usb: fix use after free bugs
by Zhang Changzhong 04 May '25

04 May '25

From: Vincent Mailhol <mailhol.vincent(a)wanadoo.fr> stable inclusion from stable-v5.11-rc5 commit 50aca891d7a554db0901b245167cd653d73aaa71 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC21UY CVE: CVE-2021-47670 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- After calling peak_usb_netif_rx_ni(skb), dereferencing skb is unsafe. Especially, the can_frame cf which aliases skb memory is accessed after the peak_usb_netif_rx_ni(). Reordering the lines solves the issue. Fixes: 0a25e1f4f185 ("can: peak_usb: add support for PEAK new CANFD USB adapters") Link: https://lore.kernel.org/r/20210120114137.200019-4-mailhol.vincent@wanadoo.fr Signed-off-by: Vincent Mailhol <mailhol.vincent(a)wanadoo.fr> Signed-off-by: Marc Kleine-Budde <mkl(a)pengutronix.de> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c index 4198835..87574ce 100644 --- a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c +++ b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c @@ -514,11 +514,11 @@ static int pcan_usb_fd_decode_canmsg(struct pcan_usb_fd_if *usb_if, else memcpy(cfd->data, rm->d, cfd->len); - peak_usb_netif_rx(skb, &usb_if->time_ref, le32_to_cpu(rm->ts_low)); - netdev->stats.rx_packets++; netdev->stats.rx_bytes += cfd->len; + peak_usb_netif_rx(skb, &usb_if->time_ref, le32_to_cpu(rm->ts_low)); + return 0; } @@ -574,11 +574,11 @@ static int pcan_usb_fd_decode_status(struct pcan_usb_fd_if *usb_if, if (!skb) return -ENOMEM; - peak_usb_netif_rx(skb, &usb_if->time_ref, le32_to_cpu(sm->ts_low)); - netdev->stats.rx_packets++; netdev->stats.rx_bytes += cf->can_dlc; + peak_usb_netif_rx(skb, &usb_if->time_ref, le32_to_cpu(sm->ts_low)); + return 0; } -- 2.9.5

2 1

[PATCH openEuler-1.0-LTS] net: mdio: validate parameter addr in mdiobus_get_phy()
by Zhang Changzhong 04 May '25

04 May '25

From: Heiner Kallweit <hkallweit1(a)gmail.com> stable inclusion from stable-v4.19.272 commit c431a3d642593bbdb99e8a9e3eed608b730db6f8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVY6 CVE: CVE-2023-53019 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 867dbe784c5010a466f00a7d1467c1c5ea569c75 ] The caller may pass any value as addr, what may result in an out-of-bounds access to array mdio_map. One existing case is stmmac_init_phy() that may pass -1 as addr. Therefore validate addr before using it. Fixes: 7f854420fbfe ("phy: Add API for {un}registering an mdio device to a bus.") Signed-off-by: Heiner Kallweit <hkallweit1(a)gmail.com> Reviewed-by: Andrew Lunn <andrew(a)lunn.ch> Link: https://lore.kernel.org/r/cdf664ea-3312-e915-73f8-021678d08887@gmail.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/net/phy/mdio_bus.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c index 3593717..60c732d 100644 --- a/drivers/net/phy/mdio_bus.c +++ b/drivers/net/phy/mdio_bus.c @@ -102,7 +102,12 @@ EXPORT_SYMBOL(mdiobus_unregister_device); struct phy_device *mdiobus_get_phy(struct mii_bus *bus, int addr) { - struct mdio_device *mdiodev = bus->mdio_map[addr]; + struct mdio_device *mdiodev; + + if (addr < 0 || addr >= ARRAY_SIZE(bus->mdio_map)) + return NULL; + + mdiodev = bus->mdio_map[addr]; if (!mdiodev) return NULL; -- 2.9.5

2 1

[openeuler:OLK-5.10 2882/2882] ld.lld: error: undefined symbol: sk_msg_alloc
by kernel test robot 02 May '25

02 May '25

Hi Wei, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 46abe407b020831448331eea487e07c883e95836 commit: e9ce37bbceb2779c0015fcac54cc8df7a2ec8b76 [2882/2882] tcp_comp: implement sendmsg for tcp compression config: x86_64-randconfig-102-20250502 (https://download.01.org/0day-ci/archive/20250502/202505021845.WkxnVSOV-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250502/202505021845.WkxnVSOV-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202505021845.WkxnVSOV-lkp@intel.com/ All errors (new ones prefixed by >>): >> ld.lld: error: undefined symbol: sk_msg_alloc >>> referenced by tcp_comp.c:148 (net/ipv4/tcp_comp.c:148) >>> ipv4/tcp_comp.o:(tcp_comp_sendmsg) in archive net/built-in.a -- >> ld.lld: error: undefined symbol: sk_msg_trim >>> referenced by tcp_comp.c:236 (net/ipv4/tcp_comp.c:236) >>> ipv4/tcp_comp.o:(tcp_comp_sendmsg) in archive net/built-in.a -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2882/2882] drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_monitor.o: warning: objtool: sxevf_work_cb()+0x108b: can't find switch jump table
by kernel test robot 02 May '25

02 May '25

Hi liujie_answer, First bad commit (maybe != root cause): tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 46abe407b020831448331eea487e07c883e95836 commit: 8cee206b5558245197158bd20895f95cc28d8468 [2882/2882] Ethernet: Linkdata: Supports Linkdata ethernet Controllers config: x86_64-randconfig-101-20250502 (https://download.01.org/0day-ci/archive/20250502/202505021622.Vo53IuHc-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250502/202505021622.Vo53IuHc-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202505021622.Vo53IuHc-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_monitor.o: warning: objtool: sxevf_work_cb()+0x108b: can't find switch jump table Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PGP_KEY_PARSER Depends on [m]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] && ASYMMETRIC_PUBLIC_KEY_SUBTYPE [=m] Selected by [y]: - PGP_PRELOAD [=y] && CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2195/2195] include/linux/pgplib.h:36:23: error: field has incomplete type 'enum pgp_key_version'
by kernel test robot 02 May '25

02 May '25

Hi David, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 241523b7d82e629fd115303840c385702bf2ea5e commit: 43d4042e06d2bf96adf67d25e8d91653507a4cf9 [2195/2195] KEYS: Provide a function to load keys from a PGP keyring blob config: x86_64-randconfig-101-20250502 (https://download.01.org/0day-ci/archive/20250502/202505021617.FheAIoZW-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250502/202505021617.FheAIoZW-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202505021617.FheAIoZW-lkp@intel.com/ All error/warnings (new ones prefixed by >>): In file included from crypto/asymmetric_keys/pgp_preload.c:19: >> include/linux/pgplib.h:26:15: warning: declaration of 'enum pgp_packet_tag' will not be visible outside of this function [-Wvisibility] 26 | enum pgp_packet_tag type, | ^ >> include/linux/pgplib.h:36:23: error: field has incomplete type 'enum pgp_key_version' 36 | enum pgp_key_version version : 8; | ^ include/linux/pgplib.h:36:7: note: forward declaration of 'enum pgp_key_version' 36 | enum pgp_key_version version : 8; | ^ >> include/linux/pgplib.h:37:23: error: field has incomplete type 'enum pgp_pubkey_algo' 37 | enum pgp_pubkey_algo pubkey_algo : 8; | ^ include/linux/pgplib.h:37:7: note: forward declaration of 'enum pgp_pubkey_algo' 37 | enum pgp_pubkey_algo pubkey_algo : 8; | ^ >> crypto/asymmetric_keys/pgp_preload.c:63:10: warning: declaration of 'enum pgp_packet_tag' will not be visible outside of this function [-Wvisibility] 63 | enum pgp_packet_tag type, u8 headerlen, | ^ >> crypto/asymmetric_keys/pgp_preload.c:63:25: error: variable has incomplete type 'enum pgp_packet_tag' 63 | enum pgp_packet_tag type, u8 headerlen, | ^ crypto/asymmetric_keys/pgp_preload.c:63:10: note: forward declaration of 'enum pgp_packet_tag' 63 | enum pgp_packet_tag type, u8 headerlen, | ^ >> crypto/asymmetric_keys/pgp_preload.c:107:36: error: use of undeclared identifier 'PGP_PKT_PUBLIC_KEY' 107 | ctx.pgp.types_of_interest = (1 << PGP_PKT_PUBLIC_KEY); | ^ >> crypto/asymmetric_keys/pgp_preload.c:108:25: error: incompatible function pointer types assigning to 'int (*)(struct pgp_parse_context *, enum pgp_packet_tag, u8, const u8 *, size_t)' (aka 'int (*)(struct pgp_parse_context *, enum pgp_packet_tag, unsigned char, const unsigned char *, unsigned long)') from 'int (struct pgp_parse_context *, enum pgp_packet_tag, u8, const u8 *, size_t)' (aka 'int (struct pgp_parse_context *, enum pgp_packet_tag, unsigned char, const unsigned char *, unsigned long)') [-Wincompatible-function-pointer-types] 108 | ctx.pgp.process_packet = found_pgp_key; | ^ ~~~~~~~~~~~~~ >> crypto/asymmetric_keys/pgp_preload.c:101:12: warning: no previous prototype for function 'preload_pgp_keys' [-Wmissing-prototypes] 101 | int __init preload_pgp_keys(const u8 *pgpdata, size_t pgpdatalen, | ^ crypto/asymmetric_keys/pgp_preload.c:101:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 101 | int __init preload_pgp_keys(const u8 *pgpdata, size_t pgpdatalen, | ^ | static 3 warnings and 5 errors generated. -- In file included from crypto/asymmetric_keys/pgp_public_key.c:19: In file included from include/linux/mpi.h:21: In file included from include/linux/scatterlist.h:8: In file included from include/linux/mm.h:2193: include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ In file included from crypto/asymmetric_keys/pgp_public_key.c:20: >> include/linux/pgplib.h:26:15: warning: declaration of 'enum pgp_packet_tag' will not be visible outside of this function [-Wvisibility] 26 | enum pgp_packet_tag type, | ^ >> include/linux/pgplib.h:36:23: error: field has incomplete type 'enum pgp_key_version' 36 | enum pgp_key_version version : 8; | ^ include/linux/pgplib.h:36:7: note: forward declaration of 'enum pgp_key_version' 36 | enum pgp_key_version version : 8; | ^ >> include/linux/pgplib.h:37:23: error: field has incomplete type 'enum pgp_pubkey_algo' 37 | enum pgp_pubkey_algo pubkey_algo : 8; | ^ include/linux/pgplib.h:37:7: note: forward declaration of 'enum pgp_pubkey_algo' 37 | enum pgp_pubkey_algo pubkey_algo : 8; | ^ >> crypto/asymmetric_keys/pgp_public_key.c:63:2: error: call to undeclared function 'kenter'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 63 | kenter(""); | ^ >> crypto/asymmetric_keys/pgp_public_key.c:65:22: error: use of undeclared identifier 'PGP_KEY_VERSION_4' 65 | n = (pgp->version < PGP_KEY_VERSION_4) ? 8 : 6; | ^ >> crypto/asymmetric_keys/pgp_public_key.c:67:9: error: call to undeclared function 'mpi_key_length'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 67 | ret = mpi_key_length(key_ptr, keylen, nb + i, nn + i); | ^ crypto/asymmetric_keys/pgp_public_key.c:95:21: error: use of undeclared identifier 'PGP_KEY_VERSION_4' 95 | if (pgp->version < PGP_KEY_VERSION_4) { | ^ >> crypto/asymmetric_keys/pgp_public_key.c:115:2: error: call to undeclared function 'kleave'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 115 | kleave(" = %d", ret); | ^ crypto/asymmetric_keys/pgp_public_key.c:134:42: error: use of undeclared identifier 'PGP_KEY_VERSION_4' 134 | tfm = crypto_alloc_shash(pgp->version < PGP_KEY_VERSION_4 ? | ^ crypto/asymmetric_keys/pgp_public_key.c:191:2: error: call to undeclared function 'kleave'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 191 | kleave(" = %d", ret); | ^ >> crypto/asymmetric_keys/pgp_public_key.c:199:12: warning: declaration of 'enum pgp_packet_tag' will not be visible outside of this function [-Wvisibility] 199 | enum pgp_packet_tag type, | ^ >> crypto/asymmetric_keys/pgp_public_key.c:199:27: error: variable has incomplete type 'enum pgp_packet_tag' 199 | enum pgp_packet_tag type, | ^ crypto/asymmetric_keys/pgp_public_key.c:199:12: note: forward declaration of 'enum pgp_packet_tag' 199 | enum pgp_packet_tag type, | ^ crypto/asymmetric_keys/pgp_public_key.c:211:2: error: call to undeclared function 'kenter'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 211 | kenter(",%u,%u,,%zu", type, headerlen, datalen); | ^ >> crypto/asymmetric_keys/pgp_public_key.c:213:14: error: use of undeclared identifier 'PGP_PKT_USER_ID' 213 | if (type == PGP_PKT_USER_ID) { | ^ crypto/asymmetric_keys/pgp_public_key.c:216:3: error: call to undeclared function 'kleave'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 216 | kleave(" = 0 [user ID]"); | ^ crypto/asymmetric_keys/pgp_public_key.c:221:3: error: call to undeclared function 'kleave'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 221 | kleave(" = -ENOKEY [already]"); | ^ >> crypto/asymmetric_keys/pgp_public_key.c:234:25: error: use of undeclared identifier 'PGP_PUBKEY__LAST' 234 | if (pgp.pubkey_algo >= PGP_PUBKEY__LAST) | ^ >> crypto/asymmetric_keys/pgp_public_key.c:236:9: error: use of undeclared identifier 'pgp_to_public_key_algo' 236 | algo = pgp_to_public_key_algo[pgp.pubkey_algo]; | ^ crypto/asymmetric_keys/pgp_public_key.c:252:2: error: call to undeclared function 'kleave'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 252 | kleave(" = 0 [use]"); | ^ crypto/asymmetric_keys/pgp_public_key.c:310:2: error: call to undeclared function 'kenter'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 310 | kenter(""); | ^ >> crypto/asymmetric_keys/pgp_public_key.c:313:36: error: use of undeclared identifier 'PGP_PKT_PUBLIC_KEY' 313 | ctx.pgp.types_of_interest = (1 << PGP_PKT_PUBLIC_KEY) | | ^ fatal error: too many errors emitted, stopping now [-ferror-limit=] 3 warnings and 20 errors generated. Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PGP_KEY_PARSER Depends on [m]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] && ASYMMETRIC_PUBLIC_KEY_SUBTYPE [=m] Selected by [y]: - PGP_PRELOAD [=y] && CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] vim +36 include/linux/pgplib.h b78af6579e15dc David Howells 2023-09-12 19 b78af6579e15dc David Howells 2023-09-12 20 /* b78af6579e15dc David Howells 2023-09-12 21 * PGP library packet parser b78af6579e15dc David Howells 2023-09-12 22 */ b78af6579e15dc David Howells 2023-09-12 23 struct pgp_parse_context { b78af6579e15dc David Howells 2023-09-12 24 u64 types_of_interest; b78af6579e15dc David Howells 2023-09-12 25 int (*process_packet)(struct pgp_parse_context *context, b78af6579e15dc David Howells 2023-09-12 @26 enum pgp_packet_tag type, b78af6579e15dc David Howells 2023-09-12 27 u8 headerlen, b78af6579e15dc David Howells 2023-09-12 28 const u8 *data, b78af6579e15dc David Howells 2023-09-12 29 size_t datalen); b78af6579e15dc David Howells 2023-09-12 30 }; b78af6579e15dc David Howells 2023-09-12 31 b78af6579e15dc David Howells 2023-09-12 32 extern int pgp_parse_packets(const u8 *data, size_t datalen, b78af6579e15dc David Howells 2023-09-12 33 struct pgp_parse_context *ctx); b78af6579e15dc David Howells 2023-09-12 34 b78af6579e15dc David Howells 2023-09-12 35 struct pgp_parse_pubkey { b78af6579e15dc David Howells 2023-09-12 @36 enum pgp_key_version version : 8; b78af6579e15dc David Howells 2023-09-12 @37 enum pgp_pubkey_algo pubkey_algo : 8; b78af6579e15dc David Howells 2023-09-12 38 __kernel_old_time_t creation_time; b78af6579e15dc David Howells 2023-09-12 39 __kernel_old_time_t expires_at; b78af6579e15dc David Howells 2023-09-12 40 }; b78af6579e15dc David Howells 2023-09-12 41 :::::: The code at line 36 was first introduced by commit :::::: b78af6579e15dcdff86504da90af77f3e890270e PGPLIB: Basic packet parser :::::: TO: David Howells <dhowells(a)redhat.com> :::::: CC: zgzxx <zhangguangzhi3(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2882/2882] drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:134:36: sparse: sparse: invalid assignment: |=
by kernel test robot 02 May '25

02 May '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 46abe407b020831448331eea487e07c883e95836 commit: 8cee206b5558245197158bd20895f95cc28d8468 [2882/2882] Ethernet: Linkdata: Supports Linkdata ethernet Controllers config: x86_64-randconfig-122-20250502 (https://download.01.org/0day-ci/archive/20250502/202505021153.ilI6N3GY-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250502/202505021153.ilI6N3GY-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202505021153.ilI6N3GY-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) drivers/net/ethernet/linkdata/sxe/sxepf/sxe_csum.c: note: in included file: >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:134:36: sparse: sparse: invalid assignment: |= drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:134:36: sparse: left side has type restricted __le32 drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:134:36: sparse: right side has type unsigned int drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:115:36: sparse: sparse: invalid assignment: |= drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:115:36: sparse: left side has type restricted __le32 drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:115:36: sparse: right side has type unsigned int drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:121:36: sparse: sparse: invalid assignment: &= drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:121:36: sparse: left side has type restricted __le32 drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:121:36: sparse: right side has type int drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:122:36: sparse: sparse: invalid assignment: |= drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:122:36: sparse: left side has type restricted __le32 drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:122:36: sparse: right side has type unsigned int -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_host_cli.c:174:30: sparse: sparse: symbol 'sxe_cdev_fops' was not declared. Should it be static? -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_host_hdc.c:42:1: sparse: sparse: symbol 'g_hdc_sema' was not declared. Should it be static? -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.c:505:36: sparse: sparse: invalid assignment: |= drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.c:505:36: sparse: left side has type restricted __le32 drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.c:505:36: sparse: right side has type int >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.c:507:41: sparse: sparse: cast from restricted __le32 drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.c:508:32: sparse: sparse: cast from restricted __le32 drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.c:509:41: sparse: sparse: cast from restricted __le32 drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.c:510:39: sparse: sparse: cast from restricted __le32 drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.c: note: in included file: drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:115:36: sparse: sparse: invalid assignment: |= drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:115:36: sparse: left side has type restricted __le32 drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:115:36: sparse: right side has type unsigned int drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:121:36: sparse: sparse: invalid assignment: &= drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:121:36: sparse: left side has type restricted __le32 drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:121:36: sparse: right side has type int drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:122:36: sparse: sparse: invalid assignment: |= drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:122:36: sparse: left side has type restricted __le32 drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:122:36: sparse: right side has type unsigned int >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:134:36: sparse: sparse: invalid assignment: |= drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:134:36: sparse: left side has type restricted __le32 drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:134:36: sparse: right side has type unsigned int >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:147:34: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __le32 [usertype] mss_l4len_idx @@ got unsigned int [usertype] mss_l4len @@ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:147:34: sparse: expected restricted __le32 [usertype] mss_l4len_idx drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:147:34: sparse: got unsigned int [usertype] mss_l4len drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:128:36: sparse: sparse: invalid assignment: |= drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:128:36: sparse: left side has type restricted __le32 drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:128:36: sparse: right side has type unsigned int drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:121:36: sparse: sparse: invalid assignment: &= drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:121:36: sparse: left side has type restricted __le32 drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:121:36: sparse: right side has type int drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:122:36: sparse: sparse: invalid assignment: |= drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:122:36: sparse: left side has type restricted __le32 drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h:122:36: sparse: right side has type unsigned int -- drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_csum.c: note: in included file: >> drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_tx_proc.h:103:36: sparse: sparse: invalid assignment: |= drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_tx_proc.h:103:36: sparse: left side has type restricted __le32 drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_tx_proc.h:103:36: sparse: right side has type unsigned int drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_tx_proc.h:77:36: sparse: sparse: invalid assignment: |= drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_tx_proc.h:77:36: sparse: left side has type restricted __le32 drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_tx_proc.h:77:36: sparse: right side has type unsigned int drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_tx_proc.h:83:36: sparse: sparse: invalid assignment: &= drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_tx_proc.h:83:36: sparse: left side has type restricted __le32 drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_tx_proc.h:83:36: sparse: right side has type int drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_tx_proc.h:84:36: sparse: sparse: invalid assignment: |= drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_tx_proc.h:84:36: sparse: left side has type restricted __le32 drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_tx_proc.h:84:36: sparse: right side has type unsigned int vim +134 drivers/net/ethernet/linkdata/sxe/sxepf/sxe_tx_proc.h 130 131 static inline void 132 sxe_ctxt_desc_tucmd_set(struct sxe_tx_context_desc *ctxt_desc, u32 tucmd) 133 { > 134 ctxt_desc->type_tucmd_mlhl |= tucmd; 135 } 136 137 static inline void 138 sxe_ctxt_desc_sa_idx_set(struct sxe_tx_context_desc *ctxt_desc, u32 sa_idx) 139 { 140 ctxt_desc->sa_idx = sa_idx; 141 } 142 143 static inline void 144 sxe_ctxt_desc_mss_l4len_set(struct sxe_tx_context_desc *ctxt_desc, 145 u32 mss_l4len) 146 { > 147 ctxt_desc->mss_l4len_idx = mss_l4len; 148 } 149 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2882/2882] drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_main.c:32:19: sparse: sparse: symbol 'g_netdev' was not declared. Should it be static?
by kernel test robot 02 May '25

02 May '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 46abe407b020831448331eea487e07c883e95836 commit: 8cee206b5558245197158bd20895f95cc28d8468 [2882/2882] Ethernet: Linkdata: Supports Linkdata ethernet Controllers config: x86_64-randconfig-123-20250502 (https://download.01.org/0day-ci/archive/20250502/202505021040.redoLH7C-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250502/202505021040.redoLH7C-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202505021040.redoLH7C-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_main.c:32:19: sparse: sparse: symbol 'g_netdev' was not declared. Should it be static? >> drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_main.c:262:22: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __iomem *addr @@ got void const *reg @@ drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_main.c:262:22: sparse: expected void const volatile [noderef] __iomem *addr drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_main.c:262:22: sparse: got void const *reg >> drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_main.c:267:23: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void volatile [noderef] __iomem *addr @@ got void *reg @@ drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_main.c:267:23: sparse: expected void volatile [noderef] __iomem *addr drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_main.c:267:23: sparse: got void *reg vim +/g_netdev +32 drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_main.c 30 31 static struct workqueue_struct *sxevf_wq; > 32 struct net_device *g_netdev; 33 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2882/2882] drivers/net/ethernet/linkdata/sxe/sxepf/sxe_main.c:1071:12: error: 'sxe_resume' defined but not used
by kernel test robot 02 May '25

02 May '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 46abe407b020831448331eea487e07c883e95836 commit: 8cee206b5558245197158bd20895f95cc28d8468 [2882/2882] Ethernet: Linkdata: Supports Linkdata ethernet Controllers config: x86_64-randconfig-122-20250502 (https://download.01.org/0day-ci/archive/20250502/202505020850.kZitpRTl-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250502/202505020850.kZitpRTl-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202505020850.kZitpRTl-lkp@intel.com/ All errors (new ones prefixed by >>): drivers/net/ethernet/linkdata/sxe/sxepf/sxe_main.c:70:6: error: no previous prototype for 'sxe_allow_inval_mac' [-Werror=missing-prototypes] 70 | bool sxe_allow_inval_mac(void) | ^~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_main.c:1071:12: error: 'sxe_resume' defined but not used [-Werror=unused-function] 1071 | static int sxe_resume(struct device *dev) | ^~~~~~~~~~ >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_main.c:1038:12: error: 'sxe_suspend' defined but not used [-Werror=unused-function] 1038 | static int sxe_suspend(struct device *dev) | ^~~~~~~~~~~ cc1: all warnings being treated as errors -- >> drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_main.c:543:12: error: 'sxevf_resume' defined but not used [-Werror=unused-function] 543 | static s32 sxevf_resume(struct device *dev) | ^~~~~~~~~~~~ cc1: all warnings being treated as errors vim +/sxe_resume +1071 drivers/net/ethernet/linkdata/sxe/sxepf/sxe_main.c 1036 1037 #ifdef CONFIG_PM > 1038 static int sxe_suspend(struct device *dev) 1039 { 1040 struct pci_dev *pdev = to_pci_dev(dev); 1041 int ret; 1042 bool wol_enable; 1043 struct sxe_adapter *adapter = pci_get_drvdata(pdev); 1044 struct sxe_hw *hw = &adapter->hw; 1045 1046 ret = __sxe_shutdown(pdev, &wol_enable); 1047 1048 cancel_work_sync(&adapter->monitor_ctxt.work); 1049 cancel_work_sync(&adapter->hdc_ctxt.time_sync_work); 1050 1051 sxe_hdc_channel_destroy(hw); 1052 if (ret) { 1053 LOG_ERROR_BDF("driver shutdown err:%d\n", ret); 1054 goto l_ret; 1055 } 1056 1057 LOG_DEBUG_BDF("pci dev[%p], wol_enable:%s\n", pdev, 1058 wol_enable ? "yes" : "no"); 1059 1060 if (wol_enable) { 1061 pci_prepare_to_sleep(pdev); 1062 } else { 1063 pci_wake_from_d3(pdev, false); 1064 pci_set_power_state(pdev, PCI_D3hot); 1065 } 1066 1067 l_ret: 1068 return ret; 1069 } 1070 > 1071 static int sxe_resume(struct device *dev) 1072 { 1073 struct pci_dev *pdev = to_pci_dev(dev); 1074 struct sxe_adapter *adapter = pci_get_drvdata(pdev); 1075 struct net_device *netdev = adapter->netdev; 1076 s32 ret; 1077 #ifdef SXE_WOL_CONFIGURE 1078 struct sxe_hw *hw = &adapter->hw; 1079 #endif 1080 1081 pci_set_power_state(pdev, PCI_D0); 1082 pci_restore_state(pdev); 1083 1084 pci_save_state(pdev); 1085 1086 ret = pci_enable_device_mem(pdev); 1087 if (ret) { 1088 LOG_DEV_ERR("cannot enable pci device from suspend\n"); 1089 goto l_ret; 1090 } 1091 1092 /* in order to force CPU ordering */ 1093 smp_mb__before_atomic(); 1094 clear_bit(SXE_DISABLED, &adapter->state); 1095 pci_set_master(pdev); 1096 1097 pci_wake_from_d3(pdev, false); 1098 1099 sxe_hdc_available_set(1); 1100 1101 sxe_reset(adapter); 1102 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2882/2882] drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c:2327:6: sparse: sparse: symbol 'mcp251xfd_tx_obj_write_sync' was not declared. Should it be static?
by kernel test robot 02 May '25

02 May '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 46abe407b020831448331eea487e07c883e95836 commit: b4eaf3e808dc2abcab55bc72df3b0d15961f33f0 [2882/2882] can: mcp251xfd: fix infinite loop when xmit fails config: x86_64-randconfig-123-20250502 (https://download.01.org/0day-ci/archive/20250502/202505020705.McaLXQv7-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250502/202505020705.McaLXQv7-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202505020705.McaLXQv7-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c:2327:6: sparse: sparse: symbol 'mcp251xfd_tx_obj_write_sync' was not declared. Should it be static? vim +/mcp251xfd_tx_obj_write_sync +2327 drivers/net/can/spi/mcp251xfd/mcp251xfd-core.c 2326 > 2327 void mcp251xfd_tx_obj_write_sync(struct work_struct *work) 2328 { 2329 struct mcp251xfd_priv *priv = container_of(work, struct mcp251xfd_priv, 2330 tx_work); 2331 struct mcp251xfd_tx_obj *tx_obj = priv->tx_work_obj; 2332 struct mcp251xfd_tx_ring *tx_ring = priv->tx; 2333 int err; 2334 2335 err = spi_sync(priv->spi, &tx_obj->msg); 2336 if (err) 2337 mcp251xfd_tx_failure_drop(priv, tx_ring, err); 2338 } 2339 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1365/1365] drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed.
by kernel test robot 01 May '25

01 May '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: a48a35466505c8a52da57596944bd0b4485e825f commit: b8815fbbe89b0d15fa3296c3e57d2197a92f5bc0 [1365/1365] ACPI: CPPC: Fix cppc_cpufreq_init failed in CPU Hotplug situation config: x86_64-randconfig-102-20250103 (https://download.01.org/0day-ci/archive/20250501/202505010210.KOXBibOl-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202505010210.KOXBibOl-lkp@intel.com/ cocci warnings: (new ones prefixed by >>) >> drivers/acpi/cppc_acpi.c:614:3-8: WARNING: NULL check before some freeing functions is not needed. vim +614 drivers/acpi/cppc_acpi.c 576 577 int acpi_get_psd_map(struct cppc_cpudata **all_cpu_data) 578 { 579 struct cpc_desc **cpc_pptr, *cpc_ptr; 580 int parsed_core_num = 0; 581 int i, ret; 582 583 cpc_pptr = kcalloc(num_possible_cpus(), sizeof(void *), GFP_KERNEL); 584 if (!cpc_pptr) 585 return -ENOMEM; 586 for_each_possible_cpu(i) { 587 cpc_pptr[i] = kzalloc(sizeof(struct cpc_desc), GFP_KERNEL); 588 if (!cpc_pptr[i]) { 589 ret = -ENOMEM; 590 goto out; 591 } 592 } 593 594 /* 595 * We can not use acpi_get_devices() to walk the processor devices 596 * because some processor device is not present. 597 */ 598 ret = acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_ROOT_OBJECT, 599 ACPI_UINT32_MAX, acpi_parse_cpc, NULL, 600 cpc_pptr, (void **)&parsed_core_num); 601 if (ret) 602 goto out; 603 if (parsed_core_num != num_possible_cpus()) { 604 ret = -EINVAL; 605 goto out; 606 } 607 608 ret = __acpi_get_psd_map(all_cpu_data, cpc_pptr); 609 610 out: 611 for_each_possible_cpu(i) { 612 cpc_ptr = cpc_pptr[i]; 613 if (cpc_ptr) > 614 kfree(cpc_ptr); 615 } 616 kfree(cpc_pptr); 617 618 return ret; 619 } 620 EXPORT_SYMBOL_GPL(acpi_get_psd_map); 621 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2195/2195] drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:66: warning: Cannot understand * @force_free:
by kernel test robot 01 May '25

01 May '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 241523b7d82e629fd115303840c385702bf2ea5e commit: 2e6ffd454acd9b4432dfee6868f3c00be7df0b6c [2195/2195] RNP: NET: Fix rnp errors dmesg show in hygon config: loongarch-allmodconfig (https://download.01.org/0day-ci/archive/20250501/202505010014.X9c71jEV-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250501/202505010014.X9c71jEV-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202505010014.X9c71jEV-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c:66: warning: Cannot understand * @force_free: on line 66 - I thought it was a doc line vim +66 drivers/net/ethernet/mucse/rnp/rnp_mbx_fw.c 64 65 /** > 66 * @force_free: 67 * true: no other reference to this cookie, it is save to mark cookie reusable 68 * false: cookie may used by other(firmware), only available after 2min 69 **/ 70 static void mbx_free_cookie(struct mbx_req_cookie *cookie, bool force_free) 71 { 72 if (!cookie) 73 return; 74 75 if (force_free) { 76 cookie->stat = COOKIE_FREE; 77 } else { 78 cookie->stat = COOKIE_FREE_WAIT_TIMEOUT; 79 } 80 } 81 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1605/1605] block/blk-core.c:158:18: sparse: sparse: incorrect type in initializer (different address spaces)
by kernel test robot 30 Apr '25

30 Apr '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: a48a35466505c8a52da57596944bd0b4485e825f commit: f39ebff66fab7eee91421258aa7254ee0bbac778 [1605/1605] block: support to dispatch bio asynchronously config: x86_64-randconfig-r112-20250430 (https://download.01.org/0day-ci/archive/20250430/202504302251.rkbjGYqc-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250430/202504302251.rkbjGYqc-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504302251.rkbjGYqc-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> block/blk-core.c:158:18: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected void const [noderef] __percpu *__vpp_verify @@ got struct bio_dispatch_async_ctl [noderef] __percpu ** @@ block/blk-core.c:158:18: sparse: expected void const [noderef] __percpu *__vpp_verify block/blk-core.c:158:18: sparse: got struct bio_dispatch_async_ctl [noderef] __percpu ** >> block/blk-core.c:158:17: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct bio_dispatch_async_ctl *ctl @@ got struct bio_dispatch_async_ctl [noderef] __percpu * @@ block/blk-core.c:158:17: sparse: expected struct bio_dispatch_async_ctl *ctl block/blk-core.c:158:17: sparse: got struct bio_dispatch_async_ctl [noderef] __percpu * block/blk-core.c:222:18: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected void const [noderef] __percpu *__vpp_verify @@ got struct bio_dispatch_async_ctl [noderef] __percpu ** @@ block/blk-core.c:222:18: sparse: expected void const [noderef] __percpu *__vpp_verify block/blk-core.c:222:18: sparse: got struct bio_dispatch_async_ctl [noderef] __percpu ** block/blk-core.c:222:17: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct bio_dispatch_async_ctl *ctl @@ got struct bio_dispatch_async_ctl [noderef] __percpu * @@ block/blk-core.c:222:17: sparse: expected struct bio_dispatch_async_ctl *ctl block/blk-core.c:222:17: sparse: got struct bio_dispatch_async_ctl [noderef] __percpu * >> block/blk-core.c:259:32: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct bio_dispatch_async_ctl [noderef] __percpu **static [toplevel] bio_dispatch_async_ctl @@ got struct bio_dispatch_async_ctl *[noderef] __percpu * @@ block/blk-core.c:259:32: sparse: expected struct bio_dispatch_async_ctl [noderef] __percpu **static [toplevel] bio_dispatch_async_ctl block/blk-core.c:259:32: sparse: got struct bio_dispatch_async_ctl *[noderef] __percpu * block/blk-core.c:269:18: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected void const [noderef] __percpu *__vpp_verify @@ got struct bio_dispatch_async_ctl [noderef] __percpu ** @@ block/blk-core.c:269:18: sparse: expected void const [noderef] __percpu *__vpp_verify block/blk-core.c:269:18: sparse: got struct bio_dispatch_async_ctl [noderef] __percpu ** >> block/blk-core.c:269:59: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct bio_dispatch_async_ctl [noderef] __percpu * @@ got struct bio_dispatch_async_ctl *ctl @@ block/blk-core.c:269:59: sparse: expected struct bio_dispatch_async_ctl [noderef] __percpu * block/blk-core.c:269:59: sparse: got struct bio_dispatch_async_ctl *ctl block/blk-core.c: note: in included file: include/linux/backing-dev.h:511:19: sparse: sparse: incompatible types in comparison expression (different address spaces): include/linux/backing-dev.h:511:19: sparse: struct rcu_device [noderef] __rcu * include/linux/backing-dev.h:511:19: sparse: struct rcu_device * block/blk-core.c: In function 'blk_account_io_completion': block/blk-core.c:2999:21: warning: variable 'cpu' set but not used [-Wunused-but-set-variable] 2999 | int cpu; | ^~~ vim +158 block/blk-core.c 152 153 static int bio_dispatch_work(void *data) 154 { 155 int loop_count = 0; 156 int cpu = smp_processor_id(); 157 struct bio_dispatch_async_ctl *ctl = > 158 *per_cpu_ptr(bio_dispatch_async_ctl, cpu); 159 160 for (;; loop_count++) { 161 struct bio_list bio_list_on_stack; 162 struct blk_plug plug; 163 struct bio *bio; 164 int count; 165 166 bio_list_init(&bio_list_on_stack); 167 count = collect_bio(ctl, &bio_list_on_stack); 168 169 if (!count) { 170 DEFINE_WAIT(wait); 171 172 for (;;) { 173 prepare_to_wait(&ctl->wait, &wait, 174 TASK_INTERRUPTIBLE); 175 count = collect_bio(ctl, &bio_list_on_stack); 176 if (count) 177 break; 178 schedule(); 179 loop_count = 0; 180 } 181 finish_wait(&ctl->wait, &wait); 182 183 } 184 185 blk_start_plug(&plug); 186 while ((bio = bio_list_pop(&bio_list_on_stack))) { 187 struct request_queue *q = bio->bi_disk->queue; 188 189 q->make_request_fn(q, bio); 190 } 191 blk_finish_plug(&plug); 192 193 /* prevent soft lockup */ 194 if (loop_count >= BIO_DISPATCH_MAX_LOOP) { 195 loop_count = 0; 196 cond_resched(); 197 } 198 } 199 200 return 0; 201 } 202 203 static int get_dispatch_cpu(struct request_queue *q, int cpu) 204 { 205 int *last_dispatch_cpu = per_cpu_ptr(q->last_dispatch_cpu, cpu); 206 207 cpu = cpumask_next(*last_dispatch_cpu, &q->dispatch_async_cpus); 208 if (cpu >= nr_cpu_ids) 209 cpu = cpumask_first(&q->dispatch_async_cpus); 210 211 *last_dispatch_cpu = cpu; 212 213 return cpu; 214 } 215 216 static void blk_queue_make_request_async(struct bio *bio) 217 { 218 struct request_queue *q = bio->bi_disk->queue; 219 int cpu = smp_processor_id(); 220 int dispatch_cpu = get_dispatch_cpu(q, cpu); 221 struct bio_dispatch_async_ctl *ctl = 222 *per_cpu_ptr(bio_dispatch_async_ctl, dispatch_cpu); 223 224 spin_lock_irq(bio_async_lock(ctl, cpu)); 225 bio_list_add(bio_async_list(ctl, cpu), bio); 226 spin_unlock_irq(bio_async_lock(ctl, cpu)); 227 228 if (wq_has_sleeper(&ctl->wait)) 229 wake_up(&ctl->wait); 230 } 231 232 static blk_qc_t blk_queue_do_make_request(struct bio *bio) 233 { 234 struct request_queue *q = bio->bi_disk->queue; 235 int cpu = smp_processor_id(); 236 237 /* 238 * Don't dispatch bio asynchronously in following cases: 239 * 240 * 1) QUEUE_FLAG_DISPATCH_ASYNC is not set; 241 * 2) current cpu is the target cpu; 242 * 3) bio is flagged no wait; 243 * 4) TODO: return value of submit_bio() will be used in io polling. 244 */ 245 if (!test_bit(QUEUE_FLAG_DISPATCH_ASYNC, &q->queue_flags) || 246 cpumask_test_cpu(cpu, &q->dispatch_async_cpus) || 247 bio->bi_opf & REQ_NOWAIT) 248 return q->make_request_fn(q, bio); 249 250 /* return value is not concerned */ 251 blk_queue_make_request_async(bio); 252 return BLK_QC_T_NONE; 253 } 254 255 static void init_blk_queue_async_dispatch(void) 256 { 257 int cpu; 258 > 259 bio_dispatch_async_ctl = alloc_percpu(struct bio_dispatch_async_ctl *); 260 if (!bio_dispatch_async_ctl) 261 panic("Failed to alloc bio_dispatch_async_ctl\n"); 262 263 for_each_possible_cpu(cpu) { 264 int i; 265 struct bio_dispatch_async_ctl *ctl = 266 kmalloc(sizeof(struct bio_dispatch_async_ctl), 267 GFP_KERNEL | __GFP_NOFAIL); 268 > 269 *per_cpu_ptr(bio_dispatch_async_ctl, cpu) = ctl; 270 271 ctl->thread = 272 kthread_create_on_cpu(bio_dispatch_work, NULL, cpu, 273 "bio_dispatch_work_%u"); 274 if (IS_ERR_OR_NULL(ctl->thread)) 275 panic("Failed to create bio dispatch thread\n"); 276 277 ctl->list = kmalloc_array(nr_cpu_ids, 278 sizeof(struct bio_list) << BIO_ASYNC_LIST_SHIFT, 279 GFP_KERNEL | __GFP_NOFAIL); 280 ctl->lock = kmalloc_array(nr_cpu_ids, 281 sizeof(spinlock_t) << BIO_ASYNC_LOCK_SHIFT, 282 GFP_KERNEL | __GFP_NOFAIL); 283 for (i = 0; i < nr_cpu_ids; ++i) { 284 bio_list_init(bio_async_list(ctl, i)); 285 spin_lock_init(bio_async_lock(ctl, i)); 286 } 287 288 wake_up_process(ctl->thread); 289 init_waitqueue_head(&ctl->wait); 290 } 291 } 292 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2880/2880] drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf.h: sxe_errno.h is included more than once.
by kernel test robot 30 Apr '25

30 Apr '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 46abe407b020831448331eea487e07c883e95836 commit: 8cee206b5558245197158bd20895f95cc28d8468 [2880/2880] Ethernet: Linkdata: Supports Linkdata ethernet Controllers compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504302232.oeU1VyOU-lkp@intel.com/ includecheck warnings: (new ones prefixed by >>) >> drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf.h: sxe_errno.h is included more than once. -- >> drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c: sxevf_hw.h is included more than once. >> drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_hw.c: sxevf.h is included more than once. -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_netdev.c: sxe_netdev.h is included more than once. -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_sriov.c: sxe_ipsec.h is included more than once. -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_main.c: linux/moduleparam.h is included more than once. -- >> drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf_netdev.c: sxevf_hw.h is included more than once. vim +25 drivers/net/ethernet/linkdata/sxevf/sxevf/sxevf.h 18 19 #include "sxe_log.h" 20 #include "sxevf_hw.h" 21 #include "sxevf_ring.h" 22 #include "sxevf_irq.h" 23 #include "sxevf_monitor.h" 24 #include "sxevf_ipsec.h" > 25 #include "sxe_errno.h" 26 #include "sxe_compat.h" > 27 #include "sxe_errno.h" 28 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] arp: use RCU protection in arp_xmit()
by Dong Chenchen 30 Apr '25

30 Apr '25

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.14-rc3 commit a42b69f692165ec39db42d595f4f65a4c8f42e44 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC8P CVE: CVE-2025-21762 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- arp_xmit() can be called without RTNL or RCU protection. Use RCU protection to avoid potential UAF. Fixes: 29a26a568038 ("netfilter: Pass struct net into the netfilter hooks") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Link: https://patch.msgid.link/20250207135841.1948589-5-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ipv4/arp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c index 6185e50c1972..74e27a60ace9 100644 --- a/net/ipv4/arp.c +++ b/net/ipv4/arp.c @@ -637,10 +637,12 @@ static int arp_xmit_finish(struct net *net, struct sock *sk, struct sk_buff *skb */ void arp_xmit(struct sk_buff *skb) { + rcu_read_lock(); /* Send it off, maybe filter it using firewalling first. */ NF_HOOK(NFPROTO_ARP, NF_ARP_OUT, - dev_net(skb->dev), NULL, skb, NULL, skb->dev, + dev_net_rcu(skb->dev), NULL, skb, NULL, skb->dev, arp_xmit_finish); + rcu_read_unlock(); } EXPORT_SYMBOL(arp_xmit); -- 2.25.1

2 1

[PATCH OLK-5.10] openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
by Dong Chenchen 30 Apr '25

30 Apr '25

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.14-rc3 commit 90b2f49a502fa71090d9f4fe29a2f51fe5dff76d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC5W CVE: CVE-2025-21761 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ovs_vport_cmd_fill_info() can be called without RTNL or RCU. Use RCU protection and dev_net_rcu() to avoid potential UAF. Fixes: 9354d4520342 ("openvswitch: reliable interface indentification in port dumps") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Link: https://patch.msgid.link/20250207135841.1948589-6-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/openvswitch/datapath.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c index b625ab5e9a43..b493931433e9 100644 --- a/net/openvswitch/datapath.c +++ b/net/openvswitch/datapath.c @@ -1980,6 +1980,7 @@ static int ovs_vport_cmd_fill_info(struct vport *vport, struct sk_buff *skb, { struct ovs_header *ovs_header; struct ovs_vport_stats vport_stats; + struct net *net_vport; int err; ovs_header = genlmsg_put(skb, portid, seq, &dp_vport_genl_family, @@ -1996,12 +1997,15 @@ static int ovs_vport_cmd_fill_info(struct vport *vport, struct sk_buff *skb, nla_put_u32(skb, OVS_VPORT_ATTR_IFINDEX, vport->dev->ifindex)) goto nla_put_failure; - if (!net_eq(net, dev_net(vport->dev))) { - int id = peernet2id_alloc(net, dev_net(vport->dev), gfp); + rcu_read_lock(); + net_vport = dev_net_rcu(vport->dev); + if (!net_eq(net, net_vport)) { + int id = peernet2id_alloc(net, net_vport, GFP_ATOMIC); if (nla_put_s32(skb, OVS_VPORT_ATTR_NETNSID, id)) - goto nla_put_failure; + goto nla_put_failure_unlock; } + rcu_read_unlock(); ovs_vport_get_stats(vport, &vport_stats); if (nla_put_64bit(skb, OVS_VPORT_ATTR_STATS, @@ -2019,6 +2023,8 @@ static int ovs_vport_cmd_fill_info(struct vport *vport, struct sk_buff *skb, genlmsg_end(skb, ovs_header); return 0; +nla_put_failure_unlock: + rcu_read_unlock(); nla_put_failure: err = -EMSGSIZE; error: -- 2.25.1

2 1

[PATCH OLK-5.10 0/2] net: Fix CVE-2025-21763
by Dong Chenchen 30 Apr '25

30 Apr '25

Fix CVE-2025-21763 Eric Dumazet (1): neighbour: use RCU protection in __neigh_notify() Li Zetao (1): neighbour: delete redundant judgment statements net/core/neighbour.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS] net: openvswitch: fix leak of nested actions
by Dong Chenchen 30 Apr '25

30 Apr '25

From: Ilya Maximets <i.maximets(a)ovn.org> stable inclusion from stable-4.19.249 commit 7438dc55c0709819b813f4778aec2c48b782990b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP3FB CVE: CVE-2022-49086 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 1f30fb9166d4f15a1aa19449b9da871fe0ed4796 upstream. While parsing user-provided actions, openvswitch module may dynamically allocate memory and store pointers in the internal copy of the actions. So this memory has to be freed while destroying the actions. Currently there are only two such actions: ct() and set(). However, there are many actions that can hold nested lists of actions and ovs_nla_free_flow_actions() just jumps over them leaking the memory. For example, removal of the flow with the following actions will lead to a leak of the memory allocated by nf_ct_tmpl_alloc(): actions:clone(ct(commit),0) Non-freed set() action may also leak the 'dst' structure for the tunnel info including device references. Under certain conditions with a high rate of flow rotation that may cause significant memory leak problem (2MB per second in reporter's case). The problem is also hard to mitigate, because the user doesn't have direct control over the datapath flows generated by OVS. Fix that by iterating over all the nested actions and freeing everything that needs to be freed recursively. New build time assertion should protect us from this problem if new actions will be added in the future. Unfortunately, openvswitch module doesn't use NLA_F_NESTED, so all attributes has to be explicitly checked. sample() and clone() actions are mixing extra attributes into the user-provided action list. That prevents some code generalization too. Fixes: 34ae932a4036 ("openvswitch: Make tunnel set action attach a metadata dst") Link: https://mail.openvswitch.org/pipermail/ovs-dev/2022-March/392922.html Reported-by: Stéphane Graber <stgraber(a)ubuntu.com> Signed-off-by: Ilya Maximets <i.maximets(a)ovn.org> Acked-by: Aaron Conole <aconole(a)redhat.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> [Backport for 4.19: Removed handling of OVS_ACTION_ATTR_DEC_TTL and OVS_ACTION_ATTR_CHECK_PKT_LEN as these actions do not exist in this version. BUILD_BUG_ON condition adjusted accordingly.] Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/openvswitch/flow_netlink.c | 61 +++++++++++++++++++++++++++++++--- 1 file changed, 56 insertions(+), 5 deletions(-) diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c index 45acc612c73b..37bbe70893eb 100644 --- a/net/openvswitch/flow_netlink.c +++ b/net/openvswitch/flow_netlink.c @@ -2254,6 +2254,36 @@ static struct sw_flow_actions *nla_alloc_flow_actions(int size) return sfa; } +static void ovs_nla_free_nested_actions(const struct nlattr *actions, int len); + +static void ovs_nla_free_clone_action(const struct nlattr *action) +{ + const struct nlattr *a = nla_data(action); + int rem = nla_len(action); + + switch (nla_type(a)) { + case OVS_CLONE_ATTR_EXEC: + /* The real list of actions follows this attribute. */ + a = nla_next(a, &rem); + ovs_nla_free_nested_actions(a, rem); + break; + } +} + +static void ovs_nla_free_sample_action(const struct nlattr *action) +{ + const struct nlattr *a = nla_data(action); + int rem = nla_len(action); + + switch (nla_type(a)) { + case OVS_SAMPLE_ATTR_ARG: + /* The real list of actions follows this attribute. */ + a = nla_next(a, &rem); + ovs_nla_free_nested_actions(a, rem); + break; + } +} + static void ovs_nla_free_set_action(const struct nlattr *a) { const struct nlattr *ovs_key = nla_data(a); @@ -2267,25 +2297,46 @@ static void ovs_nla_free_set_action(const struct nlattr *a) } } -void ovs_nla_free_flow_actions(struct sw_flow_actions *sf_acts) +static void ovs_nla_free_nested_actions(const struct nlattr *actions, int len) { const struct nlattr *a; int rem; - if (!sf_acts) + /* Whenever new actions are added, the need to update this + * function should be considered. + */ + BUILD_BUG_ON(OVS_ACTION_ATTR_MAX != 20); + + if (!actions) return; - nla_for_each_attr(a, sf_acts->actions, sf_acts->actions_len, rem) { + nla_for_each_attr(a, actions, len, rem) { switch (nla_type(a)) { - case OVS_ACTION_ATTR_SET: - ovs_nla_free_set_action(a); + case OVS_ACTION_ATTR_CLONE: + ovs_nla_free_clone_action(a); break; + case OVS_ACTION_ATTR_CT: ovs_ct_free_action(a); break; + + case OVS_ACTION_ATTR_SAMPLE: + ovs_nla_free_sample_action(a); + break; + + case OVS_ACTION_ATTR_SET: + ovs_nla_free_set_action(a); + break; } } +} + +void ovs_nla_free_flow_actions(struct sw_flow_actions *sf_acts) +{ + if (!sf_acts) + return; + ovs_nla_free_nested_actions(sf_acts->actions, sf_acts->actions_len); kfree(sf_acts); } -- 2.25.1

2 1

[PATCH OLK-5.10] ndisc: extend RCU protection in ndisc_send_skb()
by Dong Chenchen 30 Apr '25

30 Apr '25

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.14-rc3 commit ed6ae1f325d3c43966ec1b62ac1459e2b8e45640 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC4V CVE: CVE-2025-21760 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ndisc_send_skb() can be called without RTNL or RCU held. Acquire rcu_read_lock() earlier, so that we can use dev_net_rcu() and avoid a potential UAF. Fixes: 1762f7e88eb3 ("[NETNS][IPV6] ndisc - make socket control per namespace") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Link: https://patch.msgid.link/20250207135841.1948589-8-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv6/ndisc.c [commit 696c65444120 modify param format of ndisc_send_skb(), which not merged lead to context confict] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ipv6/ndisc.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c index 5134fa7f2888..8155fdb7b0f4 100644 --- a/net/ipv6/ndisc.c +++ b/net/ipv6/ndisc.c @@ -469,16 +469,20 @@ static void ndisc_send_skb(struct sk_buff *skb, const struct in6_addr *daddr, const struct in6_addr *saddr) { + struct icmp6hdr *icmp6h = icmp6_hdr(skb); struct dst_entry *dst = skb_dst(skb); - struct net *net = dev_net(skb->dev); - struct sock *sk = net->ipv6.ndisc_sk; struct inet6_dev *idev; + struct net *net; + struct sock *sk; int err; - struct icmp6hdr *icmp6h = icmp6_hdr(skb); u8 type; type = icmp6h->icmp6_type; + rcu_read_lock(); + + net = dev_net_rcu(skb->dev); + sk = net->ipv6.ndisc_sk; if (!dst) { struct flowi6 fl6; int oif = skb->dev->ifindex; @@ -486,6 +490,7 @@ static void ndisc_send_skb(struct sk_buff *skb, icmpv6_flow_init(sk, &fl6, type, saddr, daddr, oif); dst = icmp6_dst_alloc(skb->dev, &fl6); if (IS_ERR(dst)) { + rcu_read_unlock(); kfree_skb(skb); return; } @@ -500,7 +505,6 @@ static void ndisc_send_skb(struct sk_buff *skb, ip6_nd_hdr(skb, saddr, daddr, inet6_sk(sk)->hop_limit, skb->len); - rcu_read_lock(); idev = __in6_dev_get(dst->dev); IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, skb->len); -- 2.25.1

2 1

[PATCH OLK-5.10] ipv6: mcast: extend RCU protection in igmp6_send()
by Dong Chenchen 30 Apr '25

30 Apr '25

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.14-rc3 commit 087c1faa594fa07a66933d750c0b2610aa1a2946 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC5R CVE: CVE-2025-21759 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- igmp6_send() can be called without RTNL or RCU being held. Extend RCU protection so that we can safely fetch the net pointer and avoid a potential UAF. Note that we no longer can use sock_alloc_send_skb() because ipv6.igmp_sk uses GFP_KERNEL allocations which can sleep. Instead use alloc_skb() and charge the net->ipv6.igmp_sk socket under RCU protection. Fixes: b8ad0cbc58f7 ("[NETNS][IPV6] mcast - handle several network namespace") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Link: https://patch.msgid.link/20250207135841.1948589-9-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv6/mcast.c [commit b4a11b2033b7 separates OUTREQUESTS stastic from MIB_OUT, which not merged lead to context conflicts] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ipv6/mcast.c | 33 +++++++++++++++------------------ 1 file changed, 15 insertions(+), 18 deletions(-) diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c index 9fb5077f8e9a..95b7f3216491 100644 --- a/net/ipv6/mcast.c +++ b/net/ipv6/mcast.c @@ -1974,21 +1974,21 @@ static void mld_send_cr(struct inet6_dev *idev) static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type) { - struct net *net = dev_net(dev); - struct sock *sk = net->ipv6.igmp_sk; + const struct in6_addr *snd_addr, *saddr; + int err, len, payload_len, full_len; + struct in6_addr addr_buf; struct inet6_dev *idev; struct sk_buff *skb; struct mld_msg *hdr; - const struct in6_addr *snd_addr, *saddr; - struct in6_addr addr_buf; int hlen = LL_RESERVED_SPACE(dev); int tlen = dev->needed_tailroom; - int err, len, payload_len, full_len; u8 ra[8] = { IPPROTO_ICMPV6, 0, IPV6_TLV_ROUTERALERT, 2, 0, 0, IPV6_TLV_PADN, 0 }; - struct flowi6 fl6; struct dst_entry *dst; + struct flowi6 fl6; + struct net *net; + struct sock *sk; if (type == ICMPV6_MGM_REDUCTION) snd_addr = &in6addr_linklocal_allrouters; @@ -1999,20 +1999,20 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type) payload_len = len + sizeof(ra); full_len = sizeof(struct ipv6hdr) + payload_len; - rcu_read_lock(); - IP6_UPD_PO_STATS(net, __in6_dev_get(dev), - IPSTATS_MIB_OUT, full_len); - rcu_read_unlock(); - - skb = sock_alloc_send_skb(sk, hlen + tlen + full_len, 1, &err); + skb = alloc_skb(hlen + tlen + full_len, GFP_KERNEL); + rcu_read_lock(); + net = dev_net_rcu(dev); + idev = __in6_dev_get(dev); + IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, full_len); if (!skb) { - rcu_read_lock(); - IP6_INC_STATS(net, __in6_dev_get(dev), - IPSTATS_MIB_OUTDISCARDS); + IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS); rcu_read_unlock(); return; } + sk = net->ipv6.igmp_sk; + skb_set_owner_w(skb, sk); + skb->priority = TC_PRIO_CONTROL; skb_reserve(skb, hlen); @@ -2037,9 +2037,6 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type) IPPROTO_ICMPV6, csum_partial(hdr, len, 0)); - rcu_read_lock(); - idev = __in6_dev_get(skb->dev); - icmpv6_flow_init(sk, &fl6, type, &ipv6_hdr(skb)->saddr, &ipv6_hdr(skb)->daddr, skb->dev->ifindex); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] netfilter: ipset: Fix overflow before widen in the bitmap_ip_create() function.
by Dong Chenchen 30 Apr '25

30 Apr '25

From: Gavrilov Ilia <Ilia.Gavrilov(a)infotecs.ru> stable inclusion from stable-v4.19.270 commit dfd834ccc1b88bbbab81b9046a3a539dd0c2d14f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVWD CVE: CVE-2023-53032 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 9ea4b476cea1b7d461d16dda25ca3c7e616e2d15 upstream. When first_ip is 0, last_ip is 0xFFFFFFFF, and netmask is 31, the value of an arithmetic expression 2 << (netmask - mask_bits - 1) is subject to overflow due to a failure casting operands to a larger data type before performing the arithmetic. Note that it's harmless since the value will be checked at the next step. Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with SVACE. Fixes: b9fed748185a ("netfilter: ipset: Check and reject crazy /0 input parameters") Signed-off-by: Ilia.Gavrilov <Ilia.Gavrilov(a)infotecs.ru> Reviewed-by: Simon Horman <simon.horman(a)corigine.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/ipset/ip_set_bitmap_ip.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/netfilter/ipset/ip_set_bitmap_ip.c b/net/netfilter/ipset/ip_set_bitmap_ip.c index 49a6eec6f12f..b3ca8e87f629 100644 --- a/net/netfilter/ipset/ip_set_bitmap_ip.c +++ b/net/netfilter/ipset/ip_set_bitmap_ip.c @@ -296,8 +296,8 @@ bitmap_ip_create(struct net *net, struct ip_set *set, struct nlattr *tb[], return -IPSET_ERR_BITMAP_RANGE; pr_debug("mask_bits %u, netmask %u\n", mask_bits, netmask); - hosts = 2 << (32 - netmask - 1); - elements = 2 << (netmask - mask_bits - 1); + hosts = 2U << (32 - netmask - 1); + elements = 2UL << (netmask - mask_bits - 1); } if (elements > IPSET_BITMAP_MAX_RANGE + 1) return -IPSET_ERR_BITMAP_RANGE_SIZE; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] ndisc: extend RCU protection in ndisc_send_skb()
by Dong Chenchen 30 Apr '25

30 Apr '25

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.14-rc3 commit ed6ae1f325d3c43966ec1b62ac1459e2b8e45640 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC4V CVE: CVE-2025-21760 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ndisc_send_skb() can be called without RTNL or RCU held. Acquire rcu_read_lock() earlier, so that we can use dev_net_rcu() and avoid a potential UAF. Fixes: 1762f7e88eb3 ("[NETNS][IPV6] ndisc - make socket control per namespace") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Link: https://patch.msgid.link/20250207135841.1948589-8-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv6/ndisc.c [commit 696c65444120 modify param format of ndisc_send_skb(), which not merged lead to context confict] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ipv6/ndisc.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c index 5c1d092711aa..bd3153f5a63a 100644 --- a/net/ipv6/ndisc.c +++ b/net/ipv6/ndisc.c @@ -451,16 +451,20 @@ static void ndisc_send_skb(struct sk_buff *skb, const struct in6_addr *daddr, const struct in6_addr *saddr) { + struct icmp6hdr *icmp6h = icmp6_hdr(skb); struct dst_entry *dst = skb_dst(skb); - struct net *net = dev_net(skb->dev); - struct sock *sk = net->ipv6.ndisc_sk; struct inet6_dev *idev; + struct net *net; + struct sock *sk; int err; - struct icmp6hdr *icmp6h = icmp6_hdr(skb); u8 type; type = icmp6h->icmp6_type; + rcu_read_lock(); + + net = dev_net_rcu(skb->dev); + sk = net->ipv6.ndisc_sk; if (!dst) { struct flowi6 fl6; int oif = skb->dev->ifindex; @@ -468,6 +472,7 @@ static void ndisc_send_skb(struct sk_buff *skb, icmpv6_flow_init(sk, &fl6, type, saddr, daddr, oif); dst = icmp6_dst_alloc(skb->dev, &fl6); if (IS_ERR(dst)) { + rcu_read_unlock(); kfree_skb(skb); return; } @@ -482,7 +487,6 @@ static void ndisc_send_skb(struct sk_buff *skb, ip6_nd_hdr(skb, saddr, daddr, inet6_sk(sk)->hop_limit, skb->len); - rcu_read_lock(); idev = __in6_dev_get(dst->dev); IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, skb->len); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] ipv6: mcast: extend RCU protection in igmp6_send()
by Dong Chenchen 30 Apr '25

30 Apr '25

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.14-rc3 commit 087c1faa594fa07a66933d750c0b2610aa1a2946 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC5R CVE: CVE-2025-21759 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- igmp6_send() can be called without RTNL or RCU being held. Extend RCU protection so that we can safely fetch the net pointer and avoid a potential UAF. Note that we no longer can use sock_alloc_send_skb() because ipv6.igmp_sk uses GFP_KERNEL allocations which can sleep. Instead use alloc_skb() and charge the net->ipv6.igmp_sk socket under RCU protection. Fixes: b8ad0cbc58f7 ("[NETNS][IPV6] mcast - handle several network namespace") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Link: https://patch.msgid.link/20250207135841.1948589-9-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv6/mcast.c [commit b4a11b2033b7 separates OUTREQUESTS stastic from MIB_OUT, which not merged lead to context conflicts] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ipv6/mcast.c | 33 +++++++++++++++------------------ 1 file changed, 15 insertions(+), 18 deletions(-) diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c index 3d048401141f..d2b39d9af0a3 100644 --- a/net/ipv6/mcast.c +++ b/net/ipv6/mcast.c @@ -1979,21 +1979,21 @@ static void mld_send_cr(struct inet6_dev *idev) static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type) { - struct net *net = dev_net(dev); - struct sock *sk = net->ipv6.igmp_sk; + const struct in6_addr *snd_addr, *saddr; + int err, len, payload_len, full_len; + struct in6_addr addr_buf; struct inet6_dev *idev; struct sk_buff *skb; struct mld_msg *hdr; - const struct in6_addr *snd_addr, *saddr; - struct in6_addr addr_buf; int hlen = LL_RESERVED_SPACE(dev); int tlen = dev->needed_tailroom; - int err, len, payload_len, full_len; u8 ra[8] = { IPPROTO_ICMPV6, 0, IPV6_TLV_ROUTERALERT, 2, 0, 0, IPV6_TLV_PADN, 0 }; - struct flowi6 fl6; struct dst_entry *dst; + struct flowi6 fl6; + struct net *net; + struct sock *sk; if (type == ICMPV6_MGM_REDUCTION) snd_addr = &in6addr_linklocal_allrouters; @@ -2004,20 +2004,20 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type) payload_len = len + sizeof(ra); full_len = sizeof(struct ipv6hdr) + payload_len; - rcu_read_lock(); - IP6_UPD_PO_STATS(net, __in6_dev_get(dev), - IPSTATS_MIB_OUT, full_len); - rcu_read_unlock(); - - skb = sock_alloc_send_skb(sk, hlen + tlen + full_len, 1, &err); + skb = alloc_skb(hlen + tlen + full_len, GFP_KERNEL); + rcu_read_lock(); + net = dev_net_rcu(dev); + idev = __in6_dev_get(dev); + IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, full_len); if (!skb) { - rcu_read_lock(); - IP6_INC_STATS(net, __in6_dev_get(dev), - IPSTATS_MIB_OUTDISCARDS); + IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS); rcu_read_unlock(); return; } + sk = net->ipv6.igmp_sk; + skb_set_owner_w(skb, sk); + skb->priority = TC_PRIO_CONTROL; skb_reserve(skb, hlen); @@ -2042,9 +2042,6 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type) IPPROTO_ICMPV6, csum_partial(hdr, len, 0)); - rcu_read_lock(); - idev = __in6_dev_get(skb->dev); - icmpv6_flow_init(sk, &fl6, type, &ipv6_hdr(skb)->saddr, &ipv6_hdr(skb)->daddr, skb->dev->ifindex); -- 2.25.1

2 1

[PATCH OLK-5.10 0/2] fuse: support fastpath
by chenrenhui 30 Apr '25

30 Apr '25

Support fuse fastpath by using the newly added kernel_ipc module. chenrenhui (2): ipc: add kernel_ipc module to enable fast process switching fuse: support fastpath via kernel_ipc Kconfig | 2 + arch/arm64/configs/openeuler_defconfig | 2 + arch/x86/configs/openeuler_defconfig | 2 + fs/fuse/Kconfig | 9 + fs/fuse/dev.c | 744 +++++++++++++++++++++++++ fs/fuse/dir.c | 87 ++- fs/fuse/file.c | 235 +++++++- fs/fuse/fuse_i.h | 55 ++ fs/fuse/inode.c | 112 ++++ fs/fuse/readdir.c | 8 + include/linux/kernel_ipc.h | 48 ++ include/uapi/linux/fuse.h | 15 +- ipc/Kconfig | 5 + ipc/Makefile | 2 +- ipc/kernel_ipc.c | 301 ++++++++++ 15 files changed, 1599 insertions(+), 28 deletions(-) create mode 100644 include/linux/kernel_ipc.h create mode 100644 ipc/Kconfig create mode 100644 ipc/kernel_ipc.c -- 2.33.0

2 3

[PATCH openEuler-1.0-LTS 0/6] driver: base: fix UAF when driver_attach failed
by Yin Tirui 30 Apr '25

30 Apr '25

The following series contains six patches that fix UAF when driver_attach failed: Alexander Duyck (2): driver core: Probe devices asynchronously instead of the driver driver core: Attach devices on CPU local to device node Jason Gunthorpe (1): driver core: Pull required checks into driver_probe_device() Mark-PK Tsai (1): driver core: Prevent overriding async driver of a device before it probe Schspa Shi (1): driver: base: fix UAF when driver_attach failed Zhang Wensheng (1): driver core: fix potential deadlock in __driver_attach drivers/base/base.h | 2 ++ drivers/base/bus.c | 27 +++++---------------- drivers/base/dd.c | 59 ++++++++++++++++++++++++++++++++++++--------- 3 files changed, 55 insertions(+), 33 deletions(-) -- 2.22.0

2 7

[PATCH OLK-6.6] PCI: brcmstb: Fix error path after a call to regulator_bulk_get()
by Zeng Heng 30 Apr '25

30 Apr '25

From: Jim Quinlan <james.quinlan(a)broadcom.com> stable inclusion from stable-6.6.87 commit eedd054834930b8d678f0776cd4b091b8fffbb4a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QR8 CVE: CVE-2025-22095 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3651ad5249c51cf7eee078e12612557040a6bdb4 ] If the regulator_bulk_get() returns an error and no regulators are created, we need to set their number to zero. If we don't do this and the PCIe link up fails, a call to the regulator_bulk_free() will result in a kernel panic. While at it, print the error value, as we cannot return an error upwards as the kernel will WARN() on an error from add_bus(). Fixes: 9e6be018b263 ("PCI: brcmstb: Enable child bus device regulators from DT") Signed-off-by: Jim Quinlan <james.quinlan(a)broadcom.com> Reviewed-by: Florian Fainelli <florian.fainelli(a)broadcom.com> Link: https://lore.kernel.org/r/20250214173944.47506-5-james.quinlan@broadcom.com [kwilczynski: commit log, use comma in the message to match style with other similar messages] Signed-off-by: Krzysztof Wilczyński <kwilczynski(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/pci/controller/pcie-brcmstb.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/pci/controller/pcie-brcmstb.c b/drivers/pci/controller/pcie-brcmstb.c index e47a77f943b1..e07fda97c7eb 100644 --- a/drivers/pci/controller/pcie-brcmstb.c +++ b/drivers/pci/controller/pcie-brcmstb.c @@ -1132,7 +1132,8 @@ static int brcm_pcie_add_bus(struct pci_bus *bus) ret = regulator_bulk_get(dev, sr->num_supplies, sr->supplies); if (ret) { - dev_info(dev, "No regulators for downstream device\n"); + dev_info(dev, "Did not get regulators, err=%d\n", ret); + pcie->sr = NULL; goto no_regulators; } -- 2.25.1

2 1

[PATCH OLK-6.6] spufs: fix gang directory lifetimes
by Zeng Heng 30 Apr '25

30 Apr '25

From: Al Viro <viro(a)zeniv.linux.org.uk> stable inclusion from stable-6.6.87 commit 324f280806aab28ef757aecc18df419676c10ef8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QOU CVE: CVE-2025-22072 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit c134deabf4784e155d360744d4a6a835b9de4dd4 ] prior to "[POWERPC] spufs: Fix gang destroy leaks" we used to have a problem with gang lifetimes - creation of a gang returns opened gang directory, which normally gets removed when that gets closed, but if somebody has created a context belonging to that gang and kept it alive until the gang got closed, removal failed and we ended up with a leak. Unfortunately, it had been fixed the wrong way. Dentry of gang directory was no longer pinned, and rmdir on close was gone. One problem was that failure of open kept calling simple_rmdir() as cleanup, which meant an unbalanced dput(). Another bug was in the success case - gang creation incremented link count on root directory, but that was no longer undone when gang got destroyed. Fix consists of * reverting the commit in question * adding a counter to gang, protected by ->i_rwsem of gang directory inode. * having it set to 1 at creation time, dropped in both spufs_dir_close() and spufs_gang_close() and bumped in spufs_create_context(), provided that it's not 0. * using simple_recursive_removal() to take the gang directory out when counter reaches zero. Fixes: 877907d37da9 "[POWERPC] spufs: Fix gang destroy leaks" Signed-off-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/powerpc/platforms/cell/spufs/gang.c | 1 + arch/powerpc/platforms/cell/spufs/inode.c | 54 +++++++++++++++++++---- arch/powerpc/platforms/cell/spufs/spufs.h | 2 + 3 files changed, 49 insertions(+), 8 deletions(-) diff --git a/arch/powerpc/platforms/cell/spufs/gang.c b/arch/powerpc/platforms/cell/spufs/gang.c index 827d338deaf4..2c2999de6bfa 100644 --- a/arch/powerpc/platforms/cell/spufs/gang.c +++ b/arch/powerpc/platforms/cell/spufs/gang.c @@ -25,6 +25,7 @@ struct spu_gang *alloc_spu_gang(void) mutex_init(&gang->aff_mutex); INIT_LIST_HEAD(&gang->list); INIT_LIST_HEAD(&gang->aff_list_head); + gang->alive = 1; out: return gang; diff --git a/arch/powerpc/platforms/cell/spufs/inode.c b/arch/powerpc/platforms/cell/spufs/inode.c index 38c5be34c895..d0c273b10a1d 100644 --- a/arch/powerpc/platforms/cell/spufs/inode.c +++ b/arch/powerpc/platforms/cell/spufs/inode.c @@ -198,6 +198,23 @@ static int spufs_fill_dir(struct dentry *dir, return 0; } +static void unuse_gang(struct dentry *dir) +{ + struct inode *inode = dir->d_inode; + struct spu_gang *gang = SPUFS_I(inode)->i_gang; + + if (gang) { + bool dead; + + inode_lock(inode); // exclusion with spufs_create_context() + dead = !--gang->alive; + inode_unlock(inode); + + if (dead) + simple_recursive_removal(dir, NULL); + } +} + static int spufs_dir_close(struct inode *inode, struct file *file) { struct inode *parent; @@ -212,6 +229,7 @@ static int spufs_dir_close(struct inode *inode, struct file *file) inode_unlock(parent); WARN_ON(ret); + unuse_gang(dir->d_parent); return dcache_dir_close(inode, file); } @@ -404,7 +422,7 @@ spufs_create_context(struct inode *inode, struct dentry *dentry, { int ret; int affinity; - struct spu_gang *gang; + struct spu_gang *gang = SPUFS_I(inode)->i_gang; struct spu_context *neighbor; struct path path = {.mnt = mnt, .dentry = dentry}; @@ -419,11 +437,15 @@ spufs_create_context(struct inode *inode, struct dentry *dentry, if ((flags & SPU_CREATE_ISOLATE) && !isolated_loader) return -ENODEV; - gang = NULL; + if (gang) { + if (!gang->alive) + return -ENOENT; + gang->alive++; + } + neighbor = NULL; affinity = flags & (SPU_CREATE_AFFINITY_MEM | SPU_CREATE_AFFINITY_SPU); if (affinity) { - gang = SPUFS_I(inode)->i_gang; if (!gang) return -EINVAL; mutex_lock(&gang->aff_mutex); @@ -452,6 +474,8 @@ spufs_create_context(struct inode *inode, struct dentry *dentry, out_aff_unlock: if (affinity) mutex_unlock(&gang->aff_mutex); + if (ret && gang) + gang->alive--; // can't reach 0 return ret; } @@ -481,6 +505,7 @@ spufs_mkgang(struct inode *dir, struct dentry *dentry, umode_t mode) inode->i_fop = &simple_dir_operations; d_instantiate(dentry, inode); + dget(dentry); inc_nlink(dir); inc_nlink(d_inode(dentry)); return ret; @@ -491,6 +516,21 @@ spufs_mkgang(struct inode *dir, struct dentry *dentry, umode_t mode) return ret; } +static int spufs_gang_close(struct inode *inode, struct file *file) +{ + unuse_gang(file->f_path.dentry); + return dcache_dir_close(inode, file); +} + +static const struct file_operations spufs_gang_fops = { + .open = dcache_dir_open, + .release = spufs_gang_close, + .llseek = dcache_dir_lseek, + .read = generic_read_dir, + .iterate_shared = dcache_readdir, + .fsync = noop_fsync, +}; + static int spufs_gang_open(const struct path *path) { int ret; @@ -510,7 +550,7 @@ static int spufs_gang_open(const struct path *path) return PTR_ERR(filp); } - filp->f_op = &simple_dir_operations; + filp->f_op = &spufs_gang_fops; fd_install(ret, filp); return ret; } @@ -525,10 +565,8 @@ static int spufs_create_gang(struct inode *inode, ret = spufs_mkgang(inode, dentry, mode & 0777); if (!ret) { ret = spufs_gang_open(&path); - if (ret < 0) { - int err = simple_rmdir(inode, dentry); - WARN_ON(err); - } + if (ret < 0) + unuse_gang(dentry); } return ret; } diff --git a/arch/powerpc/platforms/cell/spufs/spufs.h b/arch/powerpc/platforms/cell/spufs/spufs.h index 84958487f696..d33787c57c39 100644 --- a/arch/powerpc/platforms/cell/spufs/spufs.h +++ b/arch/powerpc/platforms/cell/spufs/spufs.h @@ -151,6 +151,8 @@ struct spu_gang { int aff_flags; struct spu *aff_ref_spu; atomic_t aff_sched_count; + + int alive; }; /* Flag bits for spu_gang aff_flags */ -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/2] driver: base: fix UAF when driver_attach failed
by Yin Tirui 30 Apr '25

30 Apr '25

The following series contains two patches that a fix UAF when driver_attach failed: Alexander Duyck (1): driver core: Probe devices asynchronously instead of the driver Schspa Shi (1): driver: base: fix UAF when driver_attach failed drivers/base/base.h | 2 ++ drivers/base/bus.c | 25 +++++-------------------- drivers/base/dd.c | 43 +++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 50 insertions(+), 20 deletions(-) -- 2.22.0

2 3

[PATCH OLK-6.6] ice: fix memory leak in aRFS after reset
by Yin Tirui 30 Apr '25

30 Apr '25

From: Grzegorz Nitka <grzegorz.nitka(a)intel.com> stable inclusion from stable-v6.6.84 commit 5d30d256661fc11b6e73fac6c3783a702e1006a3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPLKM CVE: CVE-2025-21981 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 23d97f18901ef5e4e264e3b1777fe65c760186b5 ] Fix aRFS (accelerated Receive Flow Steering) structures memory leak by adding a checker to verify if aRFS memory is already allocated while configuring VSI. aRFS objects are allocated in two cases: - as part of VSI initialization (at probe), and - as part of reset handling However, VSI reconfiguration executed during reset involves memory allocation one more time, without prior releasing already allocated resources. This led to the memory leak with the following signature: [root@os-delivery ~]# cat /sys/kernel/debug/kmemleak unreferenced object 0xff3c1ca7252e6000 (size 8192): comm "kworker/0:0", pid 8, jiffies 4296833052 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc 0): [<ffffffff991ec485>] __kmalloc_cache_noprof+0x275/0x340 [<ffffffffc0a6e06a>] ice_init_arfs+0x3a/0xe0 [ice] [<ffffffffc09f1027>] ice_vsi_cfg_def+0x607/0x850 [ice] [<ffffffffc09f244b>] ice_vsi_setup+0x5b/0x130 [ice] [<ffffffffc09c2131>] ice_init+0x1c1/0x460 [ice] [<ffffffffc09c64af>] ice_probe+0x2af/0x520 [ice] [<ffffffff994fbcd3>] local_pci_probe+0x43/0xa0 [<ffffffff98f07103>] work_for_cpu_fn+0x13/0x20 [<ffffffff98f0b6d9>] process_one_work+0x179/0x390 [<ffffffff98f0c1e9>] worker_thread+0x239/0x340 [<ffffffff98f14abc>] kthread+0xcc/0x100 [<ffffffff98e45a6d>] ret_from_fork+0x2d/0x50 [<ffffffff98e083ba>] ret_from_fork_asm+0x1a/0x30 ... Fixes: 28bf26724fdb ("ice: Implement aRFS") Reviewed-by: Michal Swiatkowski <michal.swiatkowski(a)linux.intel.com> Signed-off-by: Grzegorz Nitka <grzegorz.nitka(a)intel.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Tested-by: Rinitha S <sx.rinitha(a)intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Tirui Yin <yintirui(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> --- drivers/net/ethernet/intel/ice/ice_arfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/intel/ice/ice_arfs.c b/drivers/net/ethernet/intel/ice/ice_arfs.c index cca0e753f38f..d7e0116f6773 100644 --- a/drivers/net/ethernet/intel/ice/ice_arfs.c +++ b/drivers/net/ethernet/intel/ice/ice_arfs.c @@ -510,7 +510,7 @@ void ice_init_arfs(struct ice_vsi *vsi) struct hlist_head *arfs_fltr_list; unsigned int i; - if (!vsi || vsi->type != ICE_VSI_PF) + if (!vsi || vsi->type != ICE_VSI_PF || ice_is_arfs_active(vsi)) return; arfs_fltr_list = kcalloc(ICE_MAX_ARFS_LIST, sizeof(*arfs_fltr_list), -- 2.22.0

2 1

[PATCH OLK-5.10] ice: fix memory leak in aRFS after reset
by Yin Tirui 30 Apr '25

30 Apr '25

From: Grzegorz Nitka <grzegorz.nitka(a)intel.com> mainline inclusion from mainline-v6.14-rc7 commit 23d97f18901ef5e4e264e3b1777fe65c760186b5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPLKM CVE: CVE-2025-21981 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Fix aRFS (accelerated Receive Flow Steering) structures memory leak by adding a checker to verify if aRFS memory is already allocated while configuring VSI. aRFS objects are allocated in two cases: - as part of VSI initialization (at probe), and - as part of reset handling However, VSI reconfiguration executed during reset involves memory allocation one more time, without prior releasing already allocated resources. This led to the memory leak with the following signature: [root@os-delivery ~]# cat /sys/kernel/debug/kmemleak unreferenced object 0xff3c1ca7252e6000 (size 8192): comm "kworker/0:0", pid 8, jiffies 4296833052 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc 0): [<ffffffff991ec485>] __kmalloc_cache_noprof+0x275/0x340 [<ffffffffc0a6e06a>] ice_init_arfs+0x3a/0xe0 [ice] [<ffffffffc09f1027>] ice_vsi_cfg_def+0x607/0x850 [ice] [<ffffffffc09f244b>] ice_vsi_setup+0x5b/0x130 [ice] [<ffffffffc09c2131>] ice_init+0x1c1/0x460 [ice] [<ffffffffc09c64af>] ice_probe+0x2af/0x520 [ice] [<ffffffff994fbcd3>] local_pci_probe+0x43/0xa0 [<ffffffff98f07103>] work_for_cpu_fn+0x13/0x20 [<ffffffff98f0b6d9>] process_one_work+0x179/0x390 [<ffffffff98f0c1e9>] worker_thread+0x239/0x340 [<ffffffff98f14abc>] kthread+0xcc/0x100 [<ffffffff98e45a6d>] ret_from_fork+0x2d/0x50 [<ffffffff98e083ba>] ret_from_fork_asm+0x1a/0x30 ... Fixes: 28bf26724fdb ("ice: Implement aRFS") Reviewed-by: Michal Swiatkowski <michal.swiatkowski(a)linux.intel.com> Signed-off-by: Grzegorz Nitka <grzegorz.nitka(a)intel.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Tested-by: Rinitha S <sx.rinitha(a)intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com> Signed-off-by: Tirui Yin <yintirui(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> --- drivers/net/ethernet/intel/ice/ice_arfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/intel/ice/ice_arfs.c b/drivers/net/ethernet/intel/ice/ice_arfs.c index 6560acd76c94..632f16ffee40 100644 --- a/drivers/net/ethernet/intel/ice/ice_arfs.c +++ b/drivers/net/ethernet/intel/ice/ice_arfs.c @@ -510,7 +510,7 @@ void ice_init_arfs(struct ice_vsi *vsi) struct hlist_head *arfs_fltr_list; unsigned int i; - if (!vsi || vsi->type != ICE_VSI_PF) + if (!vsi || vsi->type != ICE_VSI_PF || ice_is_arfs_active(vsi)) return; arfs_fltr_list = kzalloc(sizeof(*arfs_fltr_list) * ICE_MAX_ARFS_LIST, -- 2.22.0

2 1

[PATCH OLK-6.6] HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint check
by Yin Tirui 30 Apr '25

30 Apr '25

From: Karol Przybylski <karprzy7(a)gmail.com> stable inclusion from stable-v6.6.76 commit ae730deded66150204c494282969bfa98dc3ae67 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPBL8 CVE: CVE-2024-57993 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 50420d7c79c37a3efe4010ff9b1bb14bc61ebccf ] syzbot has found a type mismatch between a USB pipe and the transfer endpoint, which is triggered by the hid-thrustmaster driver[1]. There is a number of similar, already fixed issues [2]. In this case as in others, implementing check for endpoint type fixes the issue. [1] https://syzkaller.appspot.com/bug?extid=040e8b3db6a96908d470 [2] https://syzkaller.appspot.com/bug?extid=348331f63b034f89b622 Fixes: c49c33637802 ("HID: support for initialization of some Thrustmaster wheels") Reported-by: syzbot+040e8b3db6a96908d470(a)syzkaller.appspotmail.com Tested-by: syzbot+040e8b3db6a96908d470(a)syzkaller.appspotmail.com Signed-off-by: Karol Przybylski <karprzy7(a)gmail.com> Signed-off-by: Jiri Kosina <jkosina(a)suse.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Tirui Yin <yintirui(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> --- drivers/hid/hid-thrustmaster.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/hid/hid-thrustmaster.c b/drivers/hid/hid-thrustmaster.c index cf1679b0d4fb..6c3e758bbb09 100644 --- a/drivers/hid/hid-thrustmaster.c +++ b/drivers/hid/hid-thrustmaster.c @@ -170,6 +170,14 @@ static void thrustmaster_interrupts(struct hid_device *hdev) ep = &usbif->cur_altsetting->endpoint[1]; b_ep = ep->desc.bEndpointAddress; + /* Are the expected endpoints present? */ + u8 ep_addr[1] = {b_ep}; + + if (!usb_check_int_endpoints(usbif, ep_addr)) { + hid_err(hdev, "Unexpected non-int endpoint\n"); + return; + } + for (i = 0; i < ARRAY_SIZE(setup_arr); ++i) { memcpy(send_buf, setup_arr[i], setup_arr_sizes[i]); -- 2.22.0

2 1

[PATCH openEuler-1.0-LTS 1/2] driver core: Probe devices asynchronously instead of the driver
by Yin Tirui 30 Apr '25

30 Apr '25

From: Alexander Duyck <alexander.h.duyck(a)linux.intel.com> mainline inclusion from mainline-v5.19-rc1 commit ef0ff68351be4fd83bec2d797f0efdc0174a55a4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP35K CVE: CVE-2022-49385 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Probe devices asynchronously instead of the driver. This results in us seeing the same behavior if the device is registered before the driver or after. This way we can avoid serializing the initialization should the driver not be loaded until after the devices have already been added. The motivation behind this is that if we have a set of devices that take a significant amount of time to load we can greatly reduce the time to load by processing them in parallel instead of one at a time. In addition, each device can exist on a different node so placing a single thread on one CPU to initialize all of the devices for a given driver can result in poor performance on a system with multiple nodes. This approach can reduce the time needed to scan SCSI LUNs significantly. The only way to realize that speedup is by enabling more concurrency which is what is achieved with this patch. To achieve this it was necessary to add a new member "async_driver" to the device_private structure to store the driver pointer while we wait on the deferred probe call. Reviewed-by: Bart Van Assche <bvanassche(a)acm.org> Reviewed-by: Dan Williams <dan.j.williams(a)intel.com> Signed-off-by: Alexander Duyck <alexander.h.duyck(a)linux.intel.com> Reviewed-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yin Tirui <yintirui(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> --- drivers/base/base.h | 2 ++ drivers/base/bus.c | 23 +++-------------------- drivers/base/dd.c | 43 +++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 48 insertions(+), 20 deletions(-) diff --git a/drivers/base/base.h b/drivers/base/base.h index 2d270b8c731a..92803ce31257 100644 --- a/drivers/base/base.h +++ b/drivers/base/base.h @@ -64,6 +64,7 @@ struct driver_private { * binding of drivers which were unable to get all the resources needed by * the device; typically because it depends on another driver getting * probed first. + * @async_driver - pointer to device driver awaiting probe via async_probe * @device - pointer back to the struct device that this structure is * associated with. * @dead - This device is currently either in the process of or has been @@ -78,6 +79,7 @@ struct device_private { struct klist_node knode_driver; struct klist_node knode_bus; struct list_head deferred_probe; + struct device_driver *async_driver; struct device *device; u8 dead:1; }; diff --git a/drivers/base/bus.c b/drivers/base/bus.c index 5f1966081c42..07876b6aac57 100644 --- a/drivers/base/bus.c +++ b/drivers/base/bus.c @@ -611,17 +611,6 @@ static ssize_t uevent_store(struct device_driver *drv, const char *buf, } static DRIVER_ATTR_WO(uevent); -static void driver_attach_async(void *_drv, async_cookie_t cookie) -{ - struct device_driver *drv = _drv; - int ret; - - ret = driver_attach(drv); - - pr_debug("bus: '%s': driver %s async attach completed: %d\n", - drv->bus->name, drv->name, ret); -} - /** * bus_add_driver - Add a driver to the bus. * @drv: driver. @@ -654,15 +643,9 @@ int bus_add_driver(struct device_driver *drv) klist_add_tail(&priv->knode_bus, &bus->p->klist_drivers); if (drv->bus->p->drivers_autoprobe) { - if (driver_allows_async_probing(drv)) { - pr_debug("bus: '%s': probing driver %s asynchronously\n", - drv->bus->name, drv->name); - async_schedule(driver_attach_async, drv); - } else { - error = driver_attach(drv); - if (error) - goto out_unregister; - } + error = driver_attach(drv); + if (error) + goto out_unregister; } module_add_driver(drv->owner, drv); diff --git a/drivers/base/dd.c b/drivers/base/dd.c index 432a5645bac3..b69691f5d217 100644 --- a/drivers/base/dd.c +++ b/drivers/base/dd.c @@ -928,6 +928,30 @@ int device_driver_attach(struct device_driver *drv, struct device *dev) return ret; } +static void __driver_attach_async_helper(void *_dev, async_cookie_t cookie) +{ + struct device *dev = _dev; + struct device_driver *drv; + int ret = 0; + + __device_driver_lock(dev, dev->parent); + + drv = dev->p->async_driver; + + /* + * If device has been removed or someone has already successfully + * bound a driver before us just skip the driver probe call. + */ + if (!dev->p->dead && !dev->driver) + ret = driver_probe_device(drv, dev); + + __device_driver_unlock(dev, dev->parent); + + dev_dbg(dev, "driver %s async attach completed: %d\n", drv->name, ret); + + put_device(dev); +} + static int __driver_attach(struct device *dev, void *data) { struct device_driver *drv = data; @@ -964,6 +988,25 @@ static int __driver_attach(struct device *dev, void *data) return 0; } /* ret > 0 means positive match */ + if (driver_allows_async_probing(drv)) { + /* + * Instead of probing the device synchronously we will + * probe it asynchronously to allow for more parallelism. + * + * We only take the device lock here in order to guarantee + * that the dev->driver and async_driver fields are protected + */ + dev_dbg(dev, "probing driver %s asynchronously\n", drv->name); + device_lock(dev); + if (!dev->driver) { + get_device(dev); + dev->p->async_driver = drv; + async_schedule(__driver_attach_async_helper, dev); + } + device_unlock(dev); + return 0; + } + device_driver_attach(drv, dev); return 0; -- 2.22.0

2 2

[PATCH openEuler-1.0-LTS] mpage: fix softlockup in mpage_readahead()
by Zheng Qixing 30 Apr '25

30 Apr '25

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBYXQD CVE: NA --------------------------- When using null_blk with a large readahead window, calling madvise to trigger readahead can lead to system softlocks. This occurs because the CPU can remain in the mpage_readpages loop for extended periods without rescheduling, preventing other processes from running. Add a cond_resched() call at the beginning of each loop iteration to allow the CPU to schedule other tasks when necessary, avoiding potential softlocks during heavy readahead operations. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- fs/mpage.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/mpage.c b/fs/mpage.c index fb2ff971c66b..d67a2bae0b87 100644 --- a/fs/mpage.c +++ b/fs/mpage.c @@ -394,6 +394,7 @@ mpage_readpages(struct address_space *mapping, struct list_head *pages, for (page_idx = 0; page_idx < nr_pages; page_idx++) { struct page *page = lru_to_page(pages); + cond_resched(); prefetchw(&page->flags); list_del(&page->lru); if (!add_to_page_cache_lru(page, mapping, -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] arp: use RCU protection in arp_xmit()
by Dong Chenchen 30 Apr '25

30 Apr '25

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.14-rc3 commit a42b69f692165ec39db42d595f4f65a4c8f42e44 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC8P CVE: CVE-2025-21762 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- arp_xmit() can be called without RTNL or RCU protection. Use RCU protection to avoid potential UAF. Fixes: 29a26a568038 ("netfilter: Pass struct net into the netfilter hooks") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Link: https://patch.msgid.link/20250207135841.1948589-5-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ipv4/arp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c index fccf246e4263..638e6e91441b 100644 --- a/net/ipv4/arp.c +++ b/net/ipv4/arp.c @@ -639,10 +639,12 @@ static int arp_xmit_finish(struct net *net, struct sock *sk, struct sk_buff *skb */ void arp_xmit(struct sk_buff *skb) { + rcu_read_lock(); /* Send it off, maybe filter it using firewalling first. */ NF_HOOK(NFPROTO_ARP, NF_ARP_OUT, - dev_net(skb->dev), NULL, skb, NULL, skb->dev, + dev_net_rcu(skb->dev), NULL, skb, NULL, skb->dev, arp_xmit_finish); + rcu_read_unlock(); } EXPORT_SYMBOL(arp_xmit); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
by Dong Chenchen 30 Apr '25

30 Apr '25

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.14-rc3 commit 90b2f49a502fa71090d9f4fe29a2f51fe5dff76d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC5W CVE: CVE-2025-21761 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ovs_vport_cmd_fill_info() can be called without RTNL or RCU. Use RCU protection and dev_net_rcu() to avoid potential UAF. Fixes: 9354d4520342 ("openvswitch: reliable interface indentification in port dumps") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Link: https://patch.msgid.link/20250207135841.1948589-6-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/openvswitch/datapath.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c index 9143d4ee1c33..2dac3aaa8520 100644 --- a/net/openvswitch/datapath.c +++ b/net/openvswitch/datapath.c @@ -1873,6 +1873,7 @@ static int ovs_vport_cmd_fill_info(struct vport *vport, struct sk_buff *skb, { struct ovs_header *ovs_header; struct ovs_vport_stats vport_stats; + struct net *net_vport; int err; ovs_header = genlmsg_put(skb, portid, seq, &dp_vport_genl_family, @@ -1889,12 +1890,15 @@ static int ovs_vport_cmd_fill_info(struct vport *vport, struct sk_buff *skb, nla_put_u32(skb, OVS_VPORT_ATTR_IFINDEX, vport->dev->ifindex)) goto nla_put_failure; - if (!net_eq(net, dev_net(vport->dev))) { - int id = peernet2id_alloc(net, dev_net(vport->dev), gfp); + rcu_read_lock(); + net_vport = dev_net_rcu(vport->dev); + if (!net_eq(net, net_vport)) { + int id = peernet2id_alloc(net, net_vport, GFP_ATOMIC); if (nla_put_s32(skb, OVS_VPORT_ATTR_NETNSID, id)) - goto nla_put_failure; + goto nla_put_failure_unlock; } + rcu_read_unlock(); ovs_vport_get_stats(vport, &vport_stats); if (nla_put_64bit(skb, OVS_VPORT_ATTR_STATS, @@ -1912,6 +1916,8 @@ static int ovs_vport_cmd_fill_info(struct vport *vport, struct sk_buff *skb, genlmsg_end(skb, ovs_header); return 0; +nla_put_failure_unlock: + rcu_read_unlock(); nla_put_failure: err = -EMSGSIZE; error: -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/2] net: Fix CVE-2025-21763
by Dong Chenchen 30 Apr '25

30 Apr '25

Fix CVE-2025-21763 Eric Dumazet (1): neighbour: use RCU protection in __neigh_notify() Li Zetao (1): neighbour: delete redundant judgment statements net/core/neighbour.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6] mm: zswap: handle incorrect attempts to load large folios
by Tong Tiangen 30 Apr '25

30 Apr '25

From: Yosry Ahmed <yosryahmed(a)google.com> mainline inclusion from mainline-v6.11-rc1 commit c63f210d4891f5b1b1057a0d7c91d2b0d15431d1 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IC3A3N Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Zswap does not support storing or loading large folios. Until proper support is added, attempts to load large folios from zswap are a bug. For example, if a swapin fault observes that contiguous PTEs are pointing to contiguous swap entries and tries to swap them in as a large folio, swap_read_folio() will pass in a large folio to zswap_load(), but zswap_load() will only effectively load the first page in the folio. If the first page is not in zswap, the folio will be read from disk, even though other pages may be in zswap. In both cases, this will lead to silent data corruption. Proper support needs to be added before large folio swapins and zswap can work together. Looking at callers of swap_read_folio(), it seems like they are either allocated from __read_swap_cache_async() or do_swap_page() in the SWP_SYNCHRONOUS_IO path. Both of which allocate order-0 folios, so everything is fine for now. However, there is ongoing work to add to support large folio swapins [1]. To make sure new development does not break zswap (or get broken by zswap), add minimal handling of incorrect loads of large folios to zswap. First, move the call folio_mark_uptodate() inside zswap_load(). If a large folio load is attempted, and zswap was ever enabled on the system, return 'true' without calling folio_mark_uptodate(). This will prevent the folio from being read from disk, and will emit an IO error because the folio is not uptodate (e.g. do_swap_fault() will return VM_FAULT_SIGBUS). It may not be reliable recovery in all cases, but it is better than nothing. This was tested by hacking the allocation in __read_swap_cache_async() to use order 2 and __GFP_COMP. In the future, to handle this correctly, the swapin code should: (a) Fall back to order-0 swapins if zswap was ever used on the machine, because compressed pages remain in zswap after it is disabled. (b) Add proper support to swapin large folios from zswap (fully or partially). Probably start with (a) then followup with (b). [1]https://lore.kernel.org/linux-mm/20240304081348.197341-6-21cnbao@gmail.co… Link: https://lkml.kernel.org/r/20240611024516.1375191-3-yosryahmed@google.com Signed-off-by: Yosry Ahmed <yosryahmed(a)google.com> Acked-by: Barry Song <baohua(a)kernel.org> Cc: Barry Song <baohua(a)kernel.org> Cc: Chengming Zhou <chengming.zhou(a)linux.dev> Cc: Chris Li <chrisl(a)kernel.org> Cc: David Hildenbrand <david(a)redhat.com> Cc: Johannes Weiner <hannes(a)cmpxchg.org> Cc: Matthew Wilcox (Oracle) <willy(a)infradead.org> Cc: Nhat Pham <nphamcs(a)gmail.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: mm/zswap.c mm/page_io.c [context conflict because of a large number of zswap patchs are not merged, mainly include: 1. 5b297f70bb2 "mm: zswap: inline and remove zswap_entry_find_get()", 2. 796c2c23e14e "zswap: replace RB tree with xarray", 3. 66447fd036a5 "mm/zswap: cleanup zswap_load()"] Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> --- mm/page_io.c | 1 - mm/zswap.c | 14 ++++++++++++++ 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/mm/page_io.c b/mm/page_io.c index 839a3b0a90f0..63817e97b472 100644 --- a/mm/page_io.c +++ b/mm/page_io.c @@ -521,7 +521,6 @@ void swap_read_folio(struct folio *folio, bool synchronous, delayacct_swapin_start(); if (zswap_load(folio)) { - folio_mark_uptodate(folio); folio_unlock(folio); } else if (data_race(sis->flags & SWP_FS_OPS)) { swap_read_folio_fs(folio, plug); diff --git a/mm/zswap.c b/mm/zswap.c index 491487925192..dcf44712f0bf 100644 --- a/mm/zswap.c +++ b/mm/zswap.c @@ -1419,6 +1419,17 @@ bool zswap_load(struct folio *folio) if (zswap_never_enabled()) return false; + /* + * Large folios should not be swapped in while zswap is being used, as + * they are not properly handled. Zswap does not properly load large + * folios, and a large folio may only be partially in zswap. + * + * Return true without marking the folio uptodate so that an IO error is + * emitted (e.g. do_swap_page() will sigbus). + */ + if (WARN_ON_ONCE(folio_test_large(folio))) + return true; + /* find */ spin_lock(&tree->lock); entry = zswap_entry_find_get(&tree->rbroot, offset); @@ -1488,6 +1499,9 @@ bool zswap_load(struct folio *folio) zswap_entry_put(tree, entry); spin_unlock(&tree->lock); + if (ret == true) + folio_mark_uptodate(folio); + return ret; } -- 2.25.1

2 2

[PATCH openEuler-1.0-LTS] qede: confirm skb is allocated before using
by Zhang Zekun 30 Apr '25

30 Apr '25

From: Jamie Bainbridge <jamie.bainbridge(a)gmail.com> stable inclusion from stable-v4.19.238 commit 9648adb1b3ece55c657d3a4f52bfee663b710dfe category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP4XO CVE: CVE-2022-49084 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------- [ Upstream commit 4e910dbe36508654a896d5735b318c0b88172570 ] qede_build_skb() assumes build_skb() always works and goes straight to skb_reserve(). However, build_skb() can fail under memory pressure. This results in a kernel panic because the skb to reserve is NULL. Add a check in case build_skb() failed to allocate and return NULL. The NULL return is handled correctly in callers to qede_build_skb(). Fixes: 8a8633978b842 ("qede: Add build_skb() support.") Signed-off-by: Jamie Bainbridge <jamie.bainbridge(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/net/ethernet/qlogic/qede/qede_fp.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/ethernet/qlogic/qede/qede_fp.c b/drivers/net/ethernet/qlogic/qede/qede_fp.c index a96da16f3404..09ca436e7d49 100644 --- a/drivers/net/ethernet/qlogic/qede/qede_fp.c +++ b/drivers/net/ethernet/qlogic/qede/qede_fp.c @@ -731,6 +731,9 @@ qede_build_skb(struct qede_rx_queue *rxq, buf = page_address(bd->data) + bd->page_offset; skb = build_skb(buf, rxq->rx_buf_seg_size); + if (unlikely(!skb)) + return NULL; + skb_reserve(skb, pad); skb_put(skb, len); -- 2.22.0

2 1

[PATCH openEuler-1.0-LTS] mpage: fix softlockup in mpage_readahead()
by Zheng Qixing 30 Apr '25

30 Apr '25

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBYXQD --------------------------- When using null_blk with a large readahead window, calling madvise to trigger readahead can lead to system softlocks. This occurs because the CPU can remain in the mpage_readpages loop for extended periods without rescheduling, preventing other processes from running. Add a cond_resched() call at the beginning of each loop iteration to allow the CPU to schedule other tasks when necessary, avoiding potential softlocks during heavy readahead operations. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- fs/mpage.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/mpage.c b/fs/mpage.c index fb2ff971c66b..d67a2bae0b87 100644 --- a/fs/mpage.c +++ b/fs/mpage.c @@ -394,6 +394,7 @@ mpage_readpages(struct address_space *mapping, struct list_head *pages, for (page_idx = 0; page_idx < nr_pages; page_idx++) { struct page *page = lru_to_page(pages); + cond_resched(); prefetchw(&page->flags); list_del(&page->lru); if (!add_to_page_cache_lru(page, mapping, -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] md/raid1,raid10: don't ignore IO flags
by Zheng Qixing 30 Apr '25

30 Apr '25

From: Yu Kuai <yukuai3(a)huawei.com> mainline inclusion from mainline-v6.15-rc1 commit e879a0d9cb086c8e52ce6c04e5bfa63825a6213c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QST CVE: CVE-2025-22125 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------ If blk-wbt is enabled by default, it's found that raid write performance is quite bad because all IO are throttled by wbt of underlying disks, due to flag REQ_IDLE is ignored. And turns out this behaviour exist since blk-wbt is introduced. Other than REQ_IDLE, other flags should not be ignored as well, for example REQ_META can be set for filesystems, clearing it can cause priority reverse problems; And REQ_NOWAIT should not be cleared as well, because io will wait instead of failing directly in underlying disks. Fix those problems by keep IO flags from master bio. Fises: f51d46d0e7cb ("md: add support for REQ_NOWAIT") Fixes: e34cbd307477 ("blk-wbt: add general throttling mechanism") Fixes: 5404bc7a87b9 ("[PATCH] Allow file systems to differentiate between data and meta reads") Link: https://lore.kernel.org/linux-raid/20250227121657.832356-1-yukuai1@huaweicl… Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Conflicts: drivers/md/raid1.c drivers/md/raid10.c [Due to not merging commit 3c5e514db58f ("md/raid1: Use the new blk_opf_t type"), commit cb1802ff82e1 ("md/raid10: Use the new blk_opf_t type"), commit c34b7ac65087 ("block: remove bio_set_op_attrs") and commit f2a38abf5f1c ("md/raid1: Atomic write support").] Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/md/raid1.c | 4 ---- drivers/md/raid10.c | 7 ------- 2 files changed, 11 deletions(-) diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c index 6ad47783e974..0275dcb18692 100644 --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -1199,8 +1199,6 @@ static void raid1_read_request(struct mddev *mddev, struct bio *bio, struct raid1_info *mirror; struct bio *read_bio; struct bitmap *bitmap = mddev->bitmap; - const int op = bio_op(bio); - const unsigned long do_sync = (bio->bi_opf & REQ_SYNC); int max_sectors; int rdisk; bool print_msg = !!r1_bio; @@ -1293,7 +1291,6 @@ static void raid1_read_request(struct mddev *mddev, struct bio *bio, mirror->rdev->data_offset; bio_set_dev(read_bio, mirror->rdev->bdev); read_bio->bi_end_io = raid1_end_read_request; - bio_set_op_attrs(read_bio, op, do_sync); if (test_bit(FailFast, &mirror->rdev->flags) && test_bit(R1BIO_FailFast, &r1_bio->state)) read_bio->bi_opf |= MD_FAILFAST; @@ -1519,7 +1516,6 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio, conf->mirrors[i].rdev->data_offset); bio_set_dev(mbio, conf->mirrors[i].rdev->bdev); mbio->bi_end_io = raid1_end_write_request; - mbio->bi_opf = bio_op(bio) | (bio->bi_opf & (REQ_SYNC | REQ_FUA)); if (test_bit(FailFast, &conf->mirrors[i].rdev->flags) && !test_bit(WriteMostly, &conf->mirrors[i].rdev->flags) && conf->raid_disks - mddev->degraded > 1) diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c index f8fea9593955..07d58e88eb7b 100644 --- a/drivers/md/raid10.c +++ b/drivers/md/raid10.c @@ -1166,8 +1166,6 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio, { struct r10conf *conf = mddev->private; struct bio *read_bio; - const int op = bio_op(bio); - const unsigned long do_sync = (bio->bi_opf & REQ_SYNC); int max_sectors; sector_t sectors; struct md_rdev *rdev; @@ -1264,7 +1262,6 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio, choose_data_offset(r10_bio, rdev); bio_set_dev(read_bio, rdev->bdev); read_bio->bi_end_io = raid10_end_read_request; - bio_set_op_attrs(read_bio, op, do_sync); if (test_bit(FailFast, &rdev->flags) && test_bit(R10BIO_FailFast, &r10_bio->state)) read_bio->bi_opf |= MD_FAILFAST; @@ -1282,9 +1279,6 @@ static void raid10_write_one_disk(struct mddev *mddev, struct r10bio *r10_bio, struct bio *bio, bool replacement, int n_copy) { - const int op = bio_op(bio); - const unsigned long do_sync = (bio->bi_opf & REQ_SYNC); - const unsigned long do_fua = (bio->bi_opf & REQ_FUA); unsigned long flags; struct blk_plug_cb *cb; struct raid10_plug_cb *plug = NULL; @@ -1313,7 +1307,6 @@ static void raid10_write_one_disk(struct mddev *mddev, struct r10bio *r10_bio, choose_data_offset(r10_bio, rdev)); bio_set_dev(mbio, rdev->bdev); mbio->bi_end_io = raid10_end_write_request; - bio_set_op_attrs(mbio, op, do_sync | do_fua); if (!replacement && test_bit(FailFast, &conf->mirrors[devnum].rdev->flags) && enough(conf, devnum)) -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] md/raid1,raid10: don't ignore IO flags
by Zheng Qixing 30 Apr '25

30 Apr '25

From: Yu Kuai <yukuai3(a)huawei.com> mainline inclusion from mainline-v6.15-rc1 commit e879a0d9cb086c8e52ce6c04e5bfa63825a6213c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QST CVE: CVE-2025-22125 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------ If blk-wbt is enabled by default, it's found that raid write performance is quite bad because all IO are throttled by wbt of underlying disks, due to flag REQ_IDLE is ignored. And turns out this behaviour exist since blk-wbt is introduced. Other than REQ_IDLE, other flags should not be ignored as well, for example REQ_META can be set for filesystems, clearing it can cause priority reverse problems; And REQ_NOWAIT should not be cleared as well, because io will wait instead of failing directly in underlying disks. Fix those problems by keep IO flags from master bio. Fises: f51d46d0e7cb ("md: add support for REQ_NOWAIT") Fixes: e34cbd307477 ("blk-wbt: add general throttling mechanism") Fixes: 5404bc7a87b9 ("[PATCH] Allow file systems to differentiate between data and meta reads") Link: https://lore.kernel.org/linux-raid/20250227121657.832356-1-yukuai1@huaweicl… Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Conflicts: drivers/md/raid1.c drivers/md/raid10.c [Due to not merging commit 3c5e514db58f ("md/raid1: Use the new blk_opf_t type"), commit cb1802ff82e1 ("md/raid10: Use the new blk_opf_t type"), commit c34b7ac65087 ("block: remove bio_set_op_attrs") and commit f2a38abf5f1c ("md/raid1: Atomic write support").] Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/md/raid1.c | 4 ---- drivers/md/raid10.c | 7 ------- 2 files changed, 11 deletions(-) diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c index 6ad47783e974..0275dcb18692 100644 --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -1199,8 +1199,6 @@ static void raid1_read_request(struct mddev *mddev, struct bio *bio, struct raid1_info *mirror; struct bio *read_bio; struct bitmap *bitmap = mddev->bitmap; - const int op = bio_op(bio); - const unsigned long do_sync = (bio->bi_opf & REQ_SYNC); int max_sectors; int rdisk; bool print_msg = !!r1_bio; @@ -1293,7 +1291,6 @@ static void raid1_read_request(struct mddev *mddev, struct bio *bio, mirror->rdev->data_offset; bio_set_dev(read_bio, mirror->rdev->bdev); read_bio->bi_end_io = raid1_end_read_request; - bio_set_op_attrs(read_bio, op, do_sync); if (test_bit(FailFast, &mirror->rdev->flags) && test_bit(R1BIO_FailFast, &r1_bio->state)) read_bio->bi_opf |= MD_FAILFAST; @@ -1519,7 +1516,6 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio, conf->mirrors[i].rdev->data_offset); bio_set_dev(mbio, conf->mirrors[i].rdev->bdev); mbio->bi_end_io = raid1_end_write_request; - mbio->bi_opf = bio_op(bio) | (bio->bi_opf & (REQ_SYNC | REQ_FUA)); if (test_bit(FailFast, &conf->mirrors[i].rdev->flags) && !test_bit(WriteMostly, &conf->mirrors[i].rdev->flags) && conf->raid_disks - mddev->degraded > 1) diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c index f8fea9593955..07d58e88eb7b 100644 --- a/drivers/md/raid10.c +++ b/drivers/md/raid10.c @@ -1166,8 +1166,6 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio, { struct r10conf *conf = mddev->private; struct bio *read_bio; - const int op = bio_op(bio); - const unsigned long do_sync = (bio->bi_opf & REQ_SYNC); int max_sectors; sector_t sectors; struct md_rdev *rdev; @@ -1264,7 +1262,6 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio, choose_data_offset(r10_bio, rdev); bio_set_dev(read_bio, rdev->bdev); read_bio->bi_end_io = raid10_end_read_request; - bio_set_op_attrs(read_bio, op, do_sync); if (test_bit(FailFast, &rdev->flags) && test_bit(R10BIO_FailFast, &r10_bio->state)) read_bio->bi_opf |= MD_FAILFAST; @@ -1282,9 +1279,6 @@ static void raid10_write_one_disk(struct mddev *mddev, struct r10bio *r10_bio, struct bio *bio, bool replacement, int n_copy) { - const int op = bio_op(bio); - const unsigned long do_sync = (bio->bi_opf & REQ_SYNC); - const unsigned long do_fua = (bio->bi_opf & REQ_FUA); unsigned long flags; struct blk_plug_cb *cb; struct raid10_plug_cb *plug = NULL; @@ -1313,7 +1307,6 @@ static void raid10_write_one_disk(struct mddev *mddev, struct r10bio *r10_bio, choose_data_offset(r10_bio, rdev)); bio_set_dev(mbio, rdev->bdev); mbio->bi_end_io = raid10_end_write_request; - bio_set_op_attrs(mbio, op, do_sync | do_fua); if (!replacement && test_bit(FailFast, &conf->mirrors[devnum].rdev->flags) && enough(conf, devnum)) -- 2.39.2

2 1

[PATCH OLK-6.6] md/raid1,raid10: don't ignore IO flags
by Zheng Qixing 30 Apr '25

30 Apr '25

From: Yu Kuai <yukuai3(a)huawei.com> mainline inclusion from mainline-v6.15-rc1 commit e879a0d9cb086c8e52ce6c04e5bfa63825a6213c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QST CVE: CVE-2025-22125 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------ If blk-wbt is enabled by default, it's found that raid write performance is quite bad because all IO are throttled by wbt of underlying disks, due to flag REQ_IDLE is ignored. And turns out this behaviour exist since blk-wbt is introduced. Other than REQ_IDLE, other flags should not be ignored as well, for example REQ_META can be set for filesystems, clearing it can cause priority reverse problems; And REQ_NOWAIT should not be cleared as well, because io will wait instead of failing directly in underlying disks. Fix those problems by keep IO flags from master bio. Fises: f51d46d0e7cb ("md: add support for REQ_NOWAIT") Fixes: e34cbd307477 ("blk-wbt: add general throttling mechanism") Fixes: 5404bc7a87b9 ("[PATCH] Allow file systems to differentiate between data and meta reads") Link: https://lore.kernel.org/linux-raid/20250227121657.832356-1-yukuai1@huaweicl… Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Conflicts: drivers/md/raid1.c [Due to not merging f2a38abf5f1c ("md/raid1: Atomic write support").] drivers/md/raid10.c [Due to not merging a1d9b4fd42d9 ("md/raid10: Atomic write support").] Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/md/raid1.c | 4 ---- drivers/md/raid10.c | 7 ------- 2 files changed, 11 deletions(-) diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c index 1be011a700f8..4b7e68276d6c 100644 --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -1212,8 +1212,6 @@ static void raid1_read_request(struct mddev *mddev, struct bio *bio, struct raid1_info *mirror; struct bio *read_bio; struct bitmap *bitmap = mddev->bitmap; - const enum req_op op = bio_op(bio); - const blk_opf_t do_sync = bio->bi_opf & REQ_SYNC; int max_sectors; int rdisk; bool r1bio_existed = !!r1_bio; @@ -1311,7 +1309,6 @@ static void raid1_read_request(struct mddev *mddev, struct bio *bio, read_bio->bi_iter.bi_sector = r1_bio->sector + mirror->rdev->data_offset; read_bio->bi_end_io = raid1_end_read_request; - read_bio->bi_opf = op | do_sync; if (test_bit(FailFast, &mirror->rdev->flags) && test_bit(R1BIO_FailFast, &r1_bio->state)) read_bio->bi_opf |= MD_FAILFAST; @@ -1532,7 +1529,6 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio, mbio->bi_iter.bi_sector = (r1_bio->sector + rdev->data_offset); mbio->bi_end_io = raid1_end_write_request; - mbio->bi_opf = bio_op(bio) | (bio->bi_opf & (REQ_SYNC | REQ_FUA)); if (test_bit(FailFast, &rdev->flags) && !test_bit(WriteMostly, &rdev->flags) && conf->raid_disks - mddev->degraded > 1) diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c index 5d197d747697..1f7fa6f8f84e 100644 --- a/drivers/md/raid10.c +++ b/drivers/md/raid10.c @@ -1161,8 +1161,6 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio, { struct r10conf *conf = mddev->private; struct bio *read_bio; - const enum req_op op = bio_op(bio); - const blk_opf_t do_sync = bio->bi_opf & REQ_SYNC; int max_sectors; struct md_rdev *rdev; char b[BDEVNAME_SIZE]; @@ -1238,7 +1236,6 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio, read_bio->bi_iter.bi_sector = r10_bio->devs[slot].addr + choose_data_offset(r10_bio, rdev); read_bio->bi_end_io = raid10_end_read_request; - read_bio->bi_opf = op | do_sync; if (test_bit(FailFast, &rdev->flags) && test_bit(R10BIO_FailFast, &r10_bio->state)) read_bio->bi_opf |= MD_FAILFAST; @@ -1255,9 +1252,6 @@ static void raid10_write_one_disk(struct mddev *mddev, struct r10bio *r10_bio, struct bio *bio, bool replacement, int n_copy) { - const enum req_op op = bio_op(bio); - const blk_opf_t do_sync = bio->bi_opf & REQ_SYNC; - const blk_opf_t do_fua = bio->bi_opf & REQ_FUA; unsigned long flags; struct r10conf *conf = mddev->private; struct md_rdev *rdev; @@ -1276,7 +1270,6 @@ static void raid10_write_one_disk(struct mddev *mddev, struct r10bio *r10_bio, mbio->bi_iter.bi_sector = (r10_bio->devs[n_copy].addr + choose_data_offset(r10_bio, rdev)); mbio->bi_end_io = raid10_end_write_request; - mbio->bi_opf = op | do_sync | do_fua; if (!replacement && test_bit(FailFast, &conf->mirrors[devnum].rdev->flags) && enough(conf, devnum)) -- 2.39.2

2 1

[PATCH OLK-6.6] scsi: qla1280: Fix kernel oops when debug level > 2
by Zheng Qixing 30 Apr '25

30 Apr '25

From: Magnus Lindholm <linmag7(a)gmail.com> stable inclusion from stable-v6.6.84 commit ea371d1cdefb0951c7127a33bcd7eb931cf44571 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBY434 CVE: CVE-2025-21957 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5233e3235dec3065ccc632729675575dbe3c6b8a ] A null dereference or oops exception will eventually occur when qla1280.c driver is compiled with DEBUG_QLA1280 enabled and ql_debug_level > 2. I think its clear from the code that the intention here is sg_dma_len(s) not length of sg_next(s) when printing the debug info. Signed-off-by: Magnus Lindholm <linmag7(a)gmail.com> Link: https://lore.kernel.org/r/20250125095033.26188-1-linmag7@gmail.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/scsi/qla1280.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/scsi/qla1280.c b/drivers/scsi/qla1280.c index 6e5e89aaa283..74b23c43af3e 100644 --- a/drivers/scsi/qla1280.c +++ b/drivers/scsi/qla1280.c @@ -2866,7 +2866,7 @@ qla1280_64bit_start_scsi(struct scsi_qla_host *ha, struct srb * sp) dprintk(3, "S/G Segment phys_addr=%x %x, len=0x%x\n", cpu_to_le32(upper_32_bits(dma_handle)), cpu_to_le32(lower_32_bits(dma_handle)), - cpu_to_le32(sg_dma_len(sg_next(s)))); + cpu_to_le32(sg_dma_len(s))); remseg--; } dprintk(5, "qla1280_64bit_start_scsi: Scatter/gather " -- 2.39.2

2 1

[openeuler:OLK-6.6 2175/2175] include/linux/sched/signal.h: linux/kabi.h is included more than once.
by kernel test robot 30 Apr '25

30 Apr '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: dfd1abba9b4387cb2e9e79e3d6097c2ba507ce32 commit: b53643e68c841ccb6f05f90601ea30b1afeb0a2b [2175/2175] !3695 x86: Add x86 related kabi reservations compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504300733.mAi3Indd-lkp@intel.com/ includecheck warnings: (new ones prefixed by >>) >> include/linux/sched/signal.h: linux/kabi.h is included more than once. vim +15 include/linux/sched/signal.h 4 5 #include <linux/rculist.h> 6 #include <linux/signal.h> 7 #include <linux/sched.h> 8 #include <linux/sched/jobctl.h> 9 #include <linux/sched/task.h> 10 #include <linux/cred.h> 11 #include <linux/refcount.h> 12 #include <linux/posix-timers.h> 13 #include <linux/mm_types.h> 14 #include <asm/ptrace.h> > 15 #include <linux/kabi.h> 16 > 17 #include <linux/kabi.h> 18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2175/2175] drivers/net/ethernet/linkdata/sxe/sxepf/sxe_debug.c:3: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst
by kernel test robot 30 Apr '25

30 Apr '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: dfd1abba9b4387cb2e9e79e3d6097c2ba507ce32 commit: 0ba0ebb029b99864fa5963024535f48299373354 [2175/2175] !15589 [OLK-6.6] Ethernet: Supports Linkdata ethernet Controllers config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20250430/202504300433.T31occlR-lkp@…) compiler: clang version 19.1.7 (https://github.com/llvm/llvm-project cd708029e0b2869e80abe31ddb175f7c35361f90) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250430/202504300433.T31occlR-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504300433.T31occlR-lkp@intel.com/ All error/warnings (new ones prefixed by >>): | ^ | static drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:262:6: error: no previous prototype for function 'sxe_hw_uc_addr_pool_del' [-Werror,-Wmissing-prototypes] 262 | void sxe_hw_uc_addr_pool_del(struct sxe_hw *hw, u32 rar_idx, u32 pool_idx) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:262:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 262 | void sxe_hw_uc_addr_pool_del(struct sxe_hw *hw, u32 rar_idx, u32 pool_idx) | ^ | static drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:283:5: error: no previous prototype for function 'sxe_hw_uc_addr_pool_enable' [-Werror,-Wmissing-prototypes] 283 | s32 sxe_hw_uc_addr_pool_enable(struct sxe_hw *hw, u8 rar_idx, u8 pool_idx) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:283:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 283 | s32 sxe_hw_uc_addr_pool_enable(struct sxe_hw *hw, u8 rar_idx, u8 pool_idx) | ^ | static drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:337:5: error: no previous prototype for function 'sxe_hw_nic_reset' [-Werror,-Wmissing-prototypes] 337 | s32 sxe_hw_nic_reset(struct sxe_hw *hw) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:337:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 337 | s32 sxe_hw_nic_reset(struct sxe_hw *hw) | ^ | static drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:367:6: error: no previous prototype for function 'sxe_hw_pf_rst_done_set' [-Werror,-Wmissing-prototypes] 367 | void sxe_hw_pf_rst_done_set(struct sxe_hw *hw) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:367:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 367 | void sxe_hw_pf_rst_done_set(struct sxe_hw *hw) | ^ | static drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:735:5: error: no previous prototype for function 'sxe_hw_pending_irq_read_clear' [-Werror,-Wmissing-prototypes] 735 | u32 sxe_hw_pending_irq_read_clear(struct sxe_hw *hw) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:735:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 735 | u32 sxe_hw_pending_irq_read_clear(struct sxe_hw *hw) | ^ | static drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:740:6: error: no previous prototype for function 'sxe_hw_pending_irq_write_clear' [-Werror,-Wmissing-prototypes] 740 | void sxe_hw_pending_irq_write_clear(struct sxe_hw *hw, u32 value) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:740:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 740 | void sxe_hw_pending_irq_write_clear(struct sxe_hw *hw, u32 value) | ^ | static drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:745:5: error: no previous prototype for function 'sxe_hw_irq_cause_get' [-Werror,-Wmissing-prototypes] 745 | u32 sxe_hw_irq_cause_get(struct sxe_hw *hw) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:745:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 745 | u32 sxe_hw_irq_cause_get(struct sxe_hw *hw) | ^ | static drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:765:6: error: no previous prototype for function 'sxe_hw_ring_irq_auto_disable' [-Werror,-Wmissing-prototypes] 765 | void sxe_hw_ring_irq_auto_disable(struct sxe_hw *hw, bool is_msix) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:765:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 765 | void sxe_hw_ring_irq_auto_disable(struct sxe_hw *hw, bool is_msix) | ^ | static drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:775:6: error: no previous prototype for function 'sxe_hw_irq_general_reg_set' [-Werror,-Wmissing-prototypes] 775 | void sxe_hw_irq_general_reg_set(struct sxe_hw *hw, u32 value) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:775:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 775 | void sxe_hw_irq_general_reg_set(struct sxe_hw *hw, u32 value) | ^ | static drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:780:5: error: no previous prototype for function 'sxe_hw_irq_general_reg_get' [-Werror,-Wmissing-prototypes] 780 | u32 sxe_hw_irq_general_reg_get(struct sxe_hw *hw) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:780:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 780 | u32 sxe_hw_irq_general_reg_get(struct sxe_hw *hw) | ^ | static drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:790:6: error: no previous prototype for function 'sxe_hw_event_irq_map' [-Werror,-Wmissing-prototypes] 790 | void sxe_hw_event_irq_map(struct sxe_hw *hw, u8 offset, u16 irq_idx) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:790:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 790 | void sxe_hw_event_irq_map(struct sxe_hw *hw, u8 offset, u16 irq_idx) | ^ | static drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:806:6: error: no previous prototype for function 'sxe_hw_ring_irq_map' [-Werror,-Wmissing-prototypes] 806 | void sxe_hw_ring_irq_map(struct sxe_hw *hw, bool is_tx, u16 reg_idx, | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:806:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 806 | void sxe_hw_ring_irq_map(struct sxe_hw *hw, bool is_tx, u16 reg_idx, | ^ | static drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:823:6: error: no previous prototype for function 'sxe_hw_ring_irq_interval_set' [-Werror,-Wmissing-prototypes] 823 | void sxe_hw_ring_irq_interval_set(struct sxe_hw *hw, u16 irq_idx, u32 interval) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:823:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 823 | void sxe_hw_ring_irq_interval_set(struct sxe_hw *hw, u16 irq_idx, u32 interval) | ^ | static drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:838:6: error: no previous prototype for function 'sxe_hw_event_irq_auto_clear_set' [-Werror,-Wmissing-prototypes] 838 | void sxe_hw_event_irq_auto_clear_set(struct sxe_hw *hw, u32 value) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:838:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 838 | void sxe_hw_event_irq_auto_clear_set(struct sxe_hw *hw, u32 value) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:843:6: error: no previous prototype for function 'sxe_hw_specific_irq_disable' [-Werror,-Wmissing-prototypes] 843 | void sxe_hw_specific_irq_disable(struct sxe_hw *hw, u32 value) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:843:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 843 | void sxe_hw_specific_irq_disable(struct sxe_hw *hw, u32 value) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:848:6: error: no previous prototype for function 'sxe_hw_specific_irq_enable' [-Werror,-Wmissing-prototypes] 848 | void sxe_hw_specific_irq_enable(struct sxe_hw *hw, u32 value) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:848:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 848 | void sxe_hw_specific_irq_enable(struct sxe_hw *hw, u32 value) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:876:6: error: no previous prototype for function 'sxe_hw_all_irq_disable' [-Werror,-Wmissing-prototypes] 876 | void sxe_hw_all_irq_disable(struct sxe_hw *hw) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:876:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 876 | void sxe_hw_all_irq_disable(struct sxe_hw *hw) | ^ | static >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:994:5: error: no previous prototype for function 'sxe_hw_link_speed_get' [-Werror,-Wmissing-prototypes] 994 | u32 sxe_hw_link_speed_get(struct sxe_hw *hw) | ^ drivers/net/ethernet/linkdata/sxe/sxepf/sxe_hw.c:994:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 994 | u32 sxe_hw_link_speed_get(struct sxe_hw *hw) | ^ | static fatal error: too many errors emitted, stopping now [-ferror-limit=] 20 errors generated. -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_debug.c:3: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Copyright (C), 2020, Linkdata Technologies Co., Ltd. -- >> drivers/net/ethernet/linkdata/sxe/base/log/sxe_log.c:3: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Copyright (C), 2020, Linkdata Technologies Co., Ltd. -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_host_cli.c:3: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Copyright (C), 2020, Linkdata Technologies Co., Ltd. -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_pci.c:3: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Copyright (C), 2020, Linkdata Technologies Co., Ltd. -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_dcb.c:3: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Copyright (C), 2020, Linkdata Technologies Co., Ltd. -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_csum.c:3: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Copyright (C), 2020, Linkdata Technologies Co., Ltd. -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_host_hdc.c:3: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Copyright (C), 2020, Linkdata Technologies Co., Ltd. -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_dcb_nl.c:3: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Copyright (C), 2020, Linkdata Technologies Co., Ltd. -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_monitor.c:3: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Copyright (C), 2020, Linkdata Technologies Co., Ltd. -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_filter.c:3: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * Copyright (C), 2020, Linkdata Technologies Co., Ltd. .. vim +3 drivers/net/ethernet/linkdata/sxe/sxepf/sxe_debug.c dd013ad487534c liujie_answer 2025-04-15 @3 * Copyright (C), 2020, Linkdata Technologies Co., Ltd. dd013ad487534c liujie_answer 2025-04-15 4 * dd013ad487534c liujie_answer 2025-04-15 5 * @file: sxe_debug.c dd013ad487534c liujie_answer 2025-04-15 6 * @author: Linkdata dd013ad487534c liujie_answer 2025-04-15 7 * @date: 2025.02.16 dd013ad487534c liujie_answer 2025-04-15 8 * @brief: dd013ad487534c liujie_answer 2025-04-15 9 * @note: dd013ad487534c liujie_answer 2025-04-15 10 */ dd013ad487534c liujie_answer 2025-04-15 11 :::::: The code at line 3 was first introduced by commit :::::: dd013ad487534c1838afc2f55efdb5daec15aace Ethernet: Linkdata: Supports Linkdata ethernet Controllers :::::: TO: liujie_answer <liujie5(a)linkdatatechnology.com> :::::: CC: liujie_answer <liujie5(a)linkdatatechnology.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1597/1597] include/linux/thread_info.h:59:17: warning: 'b' may be used uninitialized
by kernel test robot 30 Apr '25

30 Apr '25

Hi Yu, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: a48a35466505c8a52da57596944bd0b4485e825f commit: b9f356e64a7eda411ba8b63df9d4c5e204f16025 [1597/1597] block-io-hierarchy: core hierarchy iodump implementation config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20250430/202504300437.9dd9ulNF-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250430/202504300437.9dd9ulNF-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504300437.9dd9ulNF-lkp@intel.com/ Note: it may well be a FALSE warning. FWIW you are at least aware of it now. http://gcc.gnu.org/wiki/Better_Uninitialized_Warnings All warnings (new ones prefixed by >>): In file included from include/asm-generic/preempt.h:5, from ./arch/arm64/include/generated/asm/preempt.h:1, from include/linux/preempt.h:81, from include/linux/spinlock.h:51, from include/linux/wait.h:9, from include/linux/wait_bit.h:8, from include/linux/fs.h:7, from include/linux/seq_file.h:11, from block/blk-io-hierarchy/iodump.c:14: In function 'check_object_size', inlined from 'check_copy_size' at include/linux/thread_info.h:90:2, inlined from 'copy_from_user' at include/linux/uaccess.h:143:6, inlined from 'threshold_store' at block/blk-io-hierarchy/iodump.c:240:6: >> include/linux/thread_info.h:59:17: warning: 'b' may be used uninitialized [-Wmaybe-uninitialized] 59 | __check_object_size(ptr, n, to_user); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/thread_info.h: In function 'threshold_store': include/linux/thread_info.h:52:13: note: by argument 1 of type 'const void *' to '__check_object_size' declared here 52 | extern void __check_object_size(const void *ptr, unsigned long n, | ^~~~~~~~~~~~~~~~~~~ block/blk-io-hierarchy/iodump.c:234:14: note: 'b' declared here 234 | char b[MAX_BUF_LEN + 1]; | ^ vim +/b +59 include/linux/thread_info.h 0f60a8efe4005a Kees Cook 2016-07-12 50 f5509cc18daa7f Kees Cook 2016-06-07 51 #ifdef CONFIG_HARDENED_USERCOPY f5509cc18daa7f Kees Cook 2016-06-07 52 extern void __check_object_size(const void *ptr, unsigned long n, f5509cc18daa7f Kees Cook 2016-06-07 53 bool to_user); f5509cc18daa7f Kees Cook 2016-06-07 54 a85d6b8242dc78 Kees Cook 2016-09-07 55 static __always_inline void check_object_size(const void *ptr, unsigned long n, f5509cc18daa7f Kees Cook 2016-06-07 56 bool to_user) f5509cc18daa7f Kees Cook 2016-06-07 57 { 81409e9e280588 Kees Cook 2016-08-31 58 if (!__builtin_constant_p(n)) f5509cc18daa7f Kees Cook 2016-06-07 @59 __check_object_size(ptr, n, to_user); f5509cc18daa7f Kees Cook 2016-06-07 60 } f5509cc18daa7f Kees Cook 2016-06-07 61 #else f5509cc18daa7f Kees Cook 2016-06-07 62 static inline void check_object_size(const void *ptr, unsigned long n, f5509cc18daa7f Kees Cook 2016-06-07 63 bool to_user) f5509cc18daa7f Kees Cook 2016-06-07 64 { } f5509cc18daa7f Kees Cook 2016-06-07 65 #endif /* CONFIG_HARDENED_USERCOPY */ f5509cc18daa7f Kees Cook 2016-06-07 66 :::::: The code at line 59 was first introduced by commit :::::: f5509cc18daa7f82bcc553be70df2117c8eedc16 mm: Hardened usercopy :::::: TO: Kees Cook <keescook(a)chromium.org> :::::: CC: Kees Cook <keescook(a)chromium.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1597/1597] include/asm-generic/bitops/non-atomic.h:106:27: warning: array subscript 'long unsigned int[0]' is partly outside array bounds of 'u32[1]' {aka 'unsigned int[1]'}
by kernel test robot 30 Apr '25

30 Apr '25

Hi Steven, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: a48a35466505c8a52da57596944bd0b4485e825f commit: a6a7981cbf66d4951425d33cdce6ef39206eba83 [1597/1597] Net: ethernet: Support 3snic 3s9xx network card config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20250430/202504300130.TAvuRGbz-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250430/202504300130.TAvuRGbz-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504300130.TAvuRGbz-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_stats_api.c:492:5: warning: no previous prototype for 'sss_nic_get_io_stats_size' [-Wmissing-prototypes] 492 | u32 sss_nic_get_io_stats_size(const struct sss_nic_dev *nic_dev) | ^~~~~~~~~~~~~~~~~~~~~~~~~ In file included from arch/arm64/include/asm/bitops.h:39, from include/linux/bitops.h:20, from include/linux/kernel.h:11, from drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_stats_api.c:6: In function 'test_bit', inlined from 'sss_nic_add_ethtool_link_mode' at drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_stats_api.c:764:7: >> include/asm-generic/bitops/non-atomic.h:106:27: warning: array subscript 'long unsigned int[0]' is partly outside array bounds of 'u32[1]' {aka 'unsigned int[1]'} [-Warray-bounds=] 106 | return 1UL & (addr[BIT_WORD(nr)] >> (nr & (BITS_PER_LONG-1))); | ~~~~^~~~~~~~~~~~~~ drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_stats_api.c: In function 'sss_nic_add_ethtool_link_mode': drivers/net/ethernet/3snic/sssnic/nic/sss_nic_ethtool_stats_api.c:759:40: note: object 'hw_mode' of size 4 759 | u32 hw_mode, u32 op) | ~~~~^~~~~~~ vim +106 include/asm-generic/bitops/non-atomic.h 4117b02132d1cf Akinobu Mita 2006-03-26 98 4117b02132d1cf Akinobu Mita 2006-03-26 99 /** 4117b02132d1cf Akinobu Mita 2006-03-26 100 * test_bit - Determine whether a bit is set 4117b02132d1cf Akinobu Mita 2006-03-26 101 * @nr: bit number to test 4117b02132d1cf Akinobu Mita 2006-03-26 102 * @addr: Address to start counting from 4117b02132d1cf Akinobu Mita 2006-03-26 103 */ 4117b02132d1cf Akinobu Mita 2006-03-26 104 static inline int test_bit(int nr, const volatile unsigned long *addr) 4117b02132d1cf Akinobu Mita 2006-03-26 105 { d05be13bcc6ec6 Jiri Slaby 2007-10-18 @106 return 1UL & (addr[BIT_WORD(nr)] >> (nr & (BITS_PER_LONG-1))); 4117b02132d1cf Akinobu Mita 2006-03-26 107 } 4117b02132d1cf Akinobu Mita 2006-03-26 108 :::::: The code at line 106 was first introduced by commit :::::: d05be13bcc6ec615fb2e9556a9b85d52800669b6 define first set of BIT* macros :::::: TO: Jiri Slaby <jirislaby(a)gmail.com> :::::: CC: Linus Torvalds <torvalds(a)woody.linux-foundation.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2880/2880] include/linux/blk_types.h: linux/kabi.h is included more than once.
by kernel test robot 30 Apr '25

30 Apr '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: b7710e01aad5e90a681267c840f4815b024b98c6 commit: dde4fe567523327d09054824030fb2d22e5009c7 [2880/2880] kabi: Add kabi reservation for storage module compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504300111.nH5Pw0yV-lkp@intel.com/ includecheck warnings: (new ones prefixed by >>) >> include/linux/blk_types.h: linux/kabi.h is included more than once. -- >> include/linux/mm.h: linux/kabi.h is included more than once. -- >> include/linux/ioport.h: linux/kabi.h is included more than once. -- >> include/linux/device.h: linux/kabi.h is included more than once. -- >> include/linux/device/class.h: linux/kabi.h is included more than once. -- >> include/linux/cred.h: linux/kabi.h is included more than once. -- >> include/linux/swap.h: linux/kabi.h is included more than once. vim +9 include/linux/blk_types.h 8 > 9 #include <linux/kabi.h> 10 #include <linux/types.h> 11 #include <linux/bvec.h> 12 #include <linux/ktime.h> > 13 #include <linux/kabi.h> 14 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2881/2881] kismet: WARNING: unmet direct dependencies detected for PTP_1588_CLOCK when selected by SXE_VF
by kernel test robot 30 Apr '25

30 Apr '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: b7710e01aad5e90a681267c840f4815b024b98c6 commit: 8cee206b5558245197158bd20895f95cc28d8468 [2881/2881] Ethernet: Linkdata: Supports Linkdata ethernet Controllers config: x86_64-kismet-CONFIG_PTP_1588_CLOCK-CONFIG_SXE_VF-0-0 (https://download.01.org/0day-ci/archive/20250430/202504300151.RfBZyPgj-lkp@…) reproduce: (https://download.01.org/0day-ci/archive/20250430/202504300151.RfBZyPgj-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504300151.RfBZyPgj-lkp@intel.com/ kismet warnings: (new ones prefixed by >>) >> kismet: WARNING: unmet direct dependencies detected for PTP_1588_CLOCK when selected by SXE_VF WARNING: unmet direct dependencies detected for PTP_1588_CLOCK Depends on [n]: NET [=y] && POSIX_TIMERS [=n] Selected by [y]: - SXE [=y] && NETDEVICES [=y] && ETHERNET [=y] && NET_VENDOR_LINKDATA [=y] && (X86 [=y] || ARM64) && PCI [=y] - SXE_VF [=y] && NETDEVICES [=y] && ETHERNET [=y] && NET_VENDOR_LINKDATA [=y] && (X86 [=y] || ARM64) && PCI [=y] -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2881/2881] kismet: WARNING: unmet direct dependencies detected for PTP_1588_CLOCK when selected by SXE
by kernel test robot 30 Apr '25

30 Apr '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: b7710e01aad5e90a681267c840f4815b024b98c6 commit: 8cee206b5558245197158bd20895f95cc28d8468 [2881/2881] Ethernet: Linkdata: Supports Linkdata ethernet Controllers config: x86_64-kismet-CONFIG_PTP_1588_CLOCK-CONFIG_SXE-0-0 (https://download.01.org/0day-ci/archive/20250430/202504300001.MoxWgMgI-lkp@…) reproduce: (https://download.01.org/0day-ci/archive/20250430/202504300001.MoxWgMgI-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504300001.MoxWgMgI-lkp@intel.com/ kismet warnings: (new ones prefixed by >>) >> kismet: WARNING: unmet direct dependencies detected for PTP_1588_CLOCK when selected by SXE WARNING: unmet direct dependencies detected for PTP_1588_CLOCK Depends on [n]: NET [=y] && POSIX_TIMERS [=n] Selected by [y]: - SXE [=y] && NETDEVICES [=y] && ETHERNET [=y] && NET_VENDOR_LINKDATA [=y] && (X86 [=y] || ARM64) && PCI [=y] Selected by [m]: - SXE_VF [=m] && NETDEVICES [=y] && ETHERNET [=y] && NET_VENDOR_LINKDATA [=y] && (X86 [=y] || ARM64) && PCI [=y] -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/7] fs/resctrl: Create l2 cache monitors
by Zeng Heng 29 Apr '25

29 Apr '25

James Morse (2): arm64: mpam: Add cpu_pm notifier to restore MPAM sysregs arm64: mpam: Restore the expected MPAM sysregs on cpuhp Zeng Heng (5): x86/resctrl: Add a handling path of default label in get_arch_mbm_state() fs/resctrl: Create l2 cache monitors fs/resctrl: Add l2 mount option to enable L2 msc arm64/mpam: Refuse cpu offline when L2 msc is enabled arm64/mpam: Refuse to enter powerdown state after L2 msc updated arch/arm64/kernel/cpufeature.c | 6 ++ arch/arm64/kernel/mpam.c | 41 ++++++++++++++ arch/x86/include/asm/resctrl.h | 2 + arch/x86/kernel/cpu/resctrl/monitor.c | 2 + drivers/platform/mpam/mpam_devices.c | 7 ++- drivers/platform/mpam/mpam_internal.h | 2 + drivers/platform/mpam/mpam_resctrl.c | 79 +++++++++++++++++++++++++-- fs/resctrl/ctrlmondata.c | 6 ++ fs/resctrl/internal.h | 2 +- fs/resctrl/monitor.c | 14 +++++ fs/resctrl/rdtgroup.c | 33 ++++++++++- include/linux/arm_mpam.h | 2 + include/linux/resctrl.h | 5 ++ include/linux/resctrl_types.h | 10 ++++ 14 files changed, 200 insertions(+), 11 deletions(-) -- 2.25.1

2 8