- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] vsock: Do not allow binding to VMADDR_PORT_ANY
by Wang Liang 10 Dec '25

10 Dec '25

From: Budimir Markovic <markovicbudimir(a)gmail.com> stable inclusion from stable-v6.6.102 commit 44bd006d5c93f6a8f28b106cbae2428c5d0275b7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICUC4U CVE: CVE-2025-38618 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit aba0c94f61ec05315fa7815d21aefa4c87f6a9f4 upstream. It is possible for a vsock to autobind to VMADDR_PORT_ANY. This can cause a use-after-free when a connection is made to the bound socket. The socket returned by accept() also has port VMADDR_PORT_ANY but is not on the list of unbound sockets. Binding it will result in an extra refcount decrement similar to the one fixed in fcdd2242c023 (vsock: Keep the binding until socket destruction). Modify the check in __vsock_bind_connectible() to also prevent binding to VMADDR_PORT_ANY. Fixes: d021c344051a ("VSOCK: Introduce VM Sockets") Reported-by: Budimir Markovic <markovicbudimir(a)gmail.com> Signed-off-by: Budimir Markovic <markovicbudimir(a)gmail.com> Reviewed-by: Stefano Garzarella <sgarzare(a)redhat.com> Link: https://patch.msgid.link/20250807041811.678-1-markovicbudimir@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/vmw_vsock/af_vsock.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c index f8f1a49689da..cdcffa01c230 100644 --- a/net/vmw_vsock/af_vsock.c +++ b/net/vmw_vsock/af_vsock.c @@ -654,7 +654,8 @@ static int __vsock_bind_connectible(struct vsock_sock *vsk, unsigned int i; for (i = 0; i < MAX_PORT_RETRIES; i++) { - if (port <= LAST_RESERVED_PORT) + if (port == VMADDR_PORT_ANY || + port <= LAST_RESERVED_PORT) port = LAST_RESERVED_PORT + 1; new_addr.svm_port = port++; -- 2.34.1

2 1

[PATCH OLK-6.6] netfilter: ctnetlink: fix refcount leak on table dump
by Wang Liang 10 Dec '25

10 Dec '25

From: Florian Westphal <fw(a)strlen.de> stable inclusion from stable-v6.6.103 commit 30cf811058552b8cd0e98dff677ef3f89d6d34ce category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICWGI3 CVE: CVE-2025-38721 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit de788b2e6227462b6dcd0e07474e72c089008f74 ] There is a reference count leak in ctnetlink_dump_table(): if (res < 0) { nf_conntrack_get(&ct->ct_general); // HERE cb->args[1] = (unsigned long)ct; ... While its very unlikely, its possible that ct == last. If this happens, then the refcount of ct was already incremented. This 2nd increment is never undone. This prevents the conntrack object from being released, which in turn keeps prevents cnet->count from dropping back to 0. This will then block the netns dismantle (or conntrack rmmod) as nf_conntrack_cleanup_net_list() will wait forever. This can be reproduced by running conntrack_resize.sh selftest in a loop. It takes ~20 minutes for me on a preemptible kernel on average before I see a runaway kworker spinning in nf_conntrack_cleanup_net_list. One fix would to change this to: if (res < 0) { if (ct != last) nf_conntrack_get(&ct->ct_general); But this reference counting isn't needed in the first place. We can just store a cookie value instead. A followup patch will do the same for ctnetlink_exp_dump_table, it looks to me as if this has the same problem and like ctnetlink_dump_table, we only need a 'skip hint', not the actual object so we can apply the same cookie strategy there as well. Fixes: d205dc40798d ("[NETFILTER]: ctnetlink: fix deadlock in table dumping") Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/netfilter/nf_conntrack_netlink.c | 24 +++++++++++++----------- 1 file changed, 13 insertions(+), 11 deletions(-) diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c index 282e9644f6fd..928bd2013289 100644 --- a/net/netfilter/nf_conntrack_netlink.c +++ b/net/netfilter/nf_conntrack_netlink.c @@ -859,8 +859,6 @@ ctnetlink_conntrack_event(unsigned int events, const struct nf_ct_event *item) static int ctnetlink_done(struct netlink_callback *cb) { - if (cb->args[1]) - nf_ct_put((struct nf_conn *)cb->args[1]); kfree(cb->data); return 0; } @@ -1175,19 +1173,26 @@ static int ctnetlink_filter_match(struct nf_conn *ct, void *data) return 0; } +static unsigned long ctnetlink_get_id(const struct nf_conn *ct) +{ + unsigned long id = nf_ct_get_id(ct); + + return id ? id : 1; +} + static int ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb) { unsigned int flags = cb->data ? NLM_F_DUMP_FILTERED : 0; struct net *net = sock_net(skb->sk); - struct nf_conn *ct, *last; + unsigned long last_id = cb->args[1]; struct nf_conntrack_tuple_hash *h; struct hlist_nulls_node *n; struct nf_conn *nf_ct_evict[8]; + struct nf_conn *ct; int res, i; spinlock_t *lockp; - last = (struct nf_conn *)cb->args[1]; i = 0; local_bh_disable(); @@ -1224,7 +1229,7 @@ ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb) continue; if (cb->args[1]) { - if (ct != last) + if (ctnetlink_get_id(ct) != last_id) continue; cb->args[1] = 0; } @@ -1237,8 +1242,7 @@ ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb) NFNL_MSG_TYPE(cb->nlh->nlmsg_type), ct, true, flags); if (res < 0) { - nf_conntrack_get(&ct->ct_general); - cb->args[1] = (unsigned long)ct; + cb->args[1] = ctnetlink_get_id(ct); spin_unlock(lockp); goto out; } @@ -1251,12 +1255,10 @@ ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb) } out: local_bh_enable(); - if (last) { + if (last_id) { /* nf ct hash resize happened, now clear the leftover. */ - if ((struct nf_conn *)cb->args[1] == last) + if (cb->args[1] == last_id) cb->args[1] = 0; - - nf_ct_put(last); } while (i) { -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] CVE-2025-38571
by Wang Liang 10 Dec '25

10 Dec '25

Justin Worrell (1): SUNRPC: call xs_sock_process_cmsg for all cmsg Olga Kornievskaia (1): sunrpc: fix client side handling of tls alerts net/sunrpc/xprtsock.c | 40 ++++++++++++++++++++++++++++++---------- 1 file changed, 30 insertions(+), 10 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] ipv6: fix possible infinite loop in fib6_info_uses_dev()
by Wang Liang 10 Dec '25

10 Dec '25

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v6.6.102 commit 9cb6de8ee144a94ae7a40bdb32560329ab7276f0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICU76Y CVE: CVE-2025-38587 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f8d8ce1b515a0a6af72b30502670a406cfb75073 ] fib6_info_uses_dev() seems to rely on RCU without an explicit protection. Like the prior fix in rt6_nlmsg_size(), we need to make sure fib6_del_route() or fib6_add_rt2node() have not removed the anchor from the list, or we risk an infinite loop. Fixes: d9ccb18f83ea ("ipv6: Fix soft lockups in fib6_select_path under high next hop churn") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20250725140725.3626540-4-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/ipv6/route.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/net/ipv6/route.c b/net/ipv6/route.c index 53197087353a..6f64fd9fe763 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -5863,16 +5863,21 @@ static bool fib6_info_uses_dev(const struct fib6_info *f6i, if (f6i->fib6_nh->fib_nh_dev == dev) return true; - if (f6i->fib6_nsiblings) { - struct fib6_info *sibling, *next_sibling; + if (READ_ONCE(f6i->fib6_nsiblings)) { + const struct fib6_info *sibling; - list_for_each_entry_safe(sibling, next_sibling, - &f6i->fib6_siblings, fib6_siblings) { - if (sibling->fib6_nh->fib_nh_dev == dev) + rcu_read_lock(); + list_for_each_entry_rcu(sibling, &f6i->fib6_siblings, + fib6_siblings) { + if (sibling->fib6_nh->fib_nh_dev == dev) { + rcu_read_unlock(); return true; + } + if (!READ_ONCE(f6i->fib6_nsiblings)) + break; } + rcu_read_unlock(); } - return false; } -- 2.34.1

2 1

[PATCH OLK-6.6 0/9] xsched: XCU Partition
by Zicheng Qu 10 Dec '25

10 Dec '25

Zicheng Qu (9): xsched: refactor CFS per-XCU rq init/deinit paths xsched: fix NULL pointer risk on attach entry allocation xsched: fix concurrent modification NULL pointer dereference in xcu.sched_class xsched: fix hung_task caused by cgroup_file_show and xcg_mutex deadlock xsched: prevent NULL deref by refcounting css and tracking offline state xsched: fix divide-by-zero caused by u64 overflow in CFS shares weight calculation xsched: DEBUG log cleanup xsched: prevent race between enqueue_ctx and xsched_task_free xsched: fix infinite loop caused by invalid CFS group vruntime update include/linux/xsched.h | 40 ++++++- kernel/xsched/cfs.c | 47 +++++--- kernel/xsched/cfs_quota.c | 9 ++ kernel/xsched/cgroup.c | 224 +++++++++++++++++++++----------------- kernel/xsched/core.c | 9 +- kernel/xsched/rt.c | 19 +--- kernel/xsched/vstream.c | 3 + 7 files changed, 210 insertions(+), 141 deletions(-) -- 2.34.1

2 10

[PATCH OLK-6.6 0/9] xsched: XCU Partition
by Zicheng Qu 10 Dec '25

10 Dec '25

Zicheng Qu (9): xsched: refactor CFS per-XCU rq init/deinit paths xsched: fix NULL pointer risk on attach entry allocation xsched: fix concurrent modification NULL pointer dereference in xcu.sched_class xsched: fix hung_task caused by cgroup_file_show and xcg_mutex deadlock xsched: prevent NULL deref by refcounting css and tracking offline state xsched: fix divide-by-zero caused by u64 overflow in CFS shares weight calculation xsched: DEBUG log cleanup xsched: prevent race between enqueue_ctx and xsched_task_free xsched: fix infinite loop caused by invalid CFS group vruntime update include/linux/xsched.h | 40 ++++++- kernel/xsched/cfs.c | 47 +++++--- kernel/xsched/cfs_quota.c | 9 ++ kernel/xsched/cgroup.c | 224 +++++++++++++++++++++----------------- kernel/xsched/core.c | 9 +- kernel/xsched/rt.c | 19 +--- kernel/xsched/vstream.c | 3 + 7 files changed, 210 insertions(+), 141 deletions(-) -- 2.34.1

2 10

[openeuler:OLK-5.10 3399/3399] drivers/net/ethernet/linkdata/sxe/base/log/sxe_log.c:24: warning: Function parameter or member 'buff' not described in 'time_for_file_name'
by kernel test robot 10 Dec '25

10 Dec '25

Hi liujie_answer, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 7579fd89cb4a201d22bd5b78f48df5ce339c0b2d commit: 8cee206b5558245197158bd20895f95cc28d8468 [3399/3399] Ethernet: Linkdata: Supports Linkdata ethernet Controllers config: x86_64-allnoconfig-bpf (https://download.01.org/0day-ci/archive/20251210/202512100859.mEVPzizr-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251210/202512100859.mEVPzizr-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512100859.mEVPzizr-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/net/ethernet/linkdata/sxe/base/log/sxe_log.c:24: warning: Function parameter or member 'buff' not described in 'time_for_file_name' >> drivers/net/ethernet/linkdata/sxe/base/log/sxe_log.c:24: warning: Function parameter or member 'buf_len' not described in 'time_for_file_name' >> drivers/net/ethernet/linkdata/sxe/base/log/sxe_log.c:24: warning: Excess function parameter 'file' description in 'time_for_file_name' >> drivers/net/ethernet/linkdata/sxe/base/log/sxe_log.c:24: warning: Excess function parameter 'author' description in 'time_for_file_name' >> drivers/net/ethernet/linkdata/sxe/base/log/sxe_log.c:24: warning: Excess function parameter 'date' description in 'time_for_file_name' -- >> drivers/net/ethernet/linkdata/sxe/base/trace/sxe_trace.c:21: warning: Excess function parameter 'file' description in 'SXE_FILE_NAME_LEN' >> drivers/net/ethernet/linkdata/sxe/base/trace/sxe_trace.c:21: warning: Excess function parameter 'author' description in 'SXE_FILE_NAME_LEN' >> drivers/net/ethernet/linkdata/sxe/base/trace/sxe_trace.c:21: warning: Excess function parameter 'date' description in 'SXE_FILE_NAME_LEN' -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_csum.c:23: warning: Function parameter or member 'protocol' not described in 'sxe_is_sctp_ipv4' >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_csum.c:23: warning: Function parameter or member 'skb' not described in 'sxe_is_sctp_ipv4' >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_csum.c:23: warning: Excess function parameter 'file' description in 'sxe_is_sctp_ipv4' >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_csum.c:23: warning: Excess function parameter 'author' description in 'sxe_is_sctp_ipv4' >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_csum.c:23: warning: Excess function parameter 'date' description in 'sxe_is_sctp_ipv4' -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_dcb.c:16: warning: Excess function parameter 'file' description in 'SXE_TC_BWG_PERCENT_PER_CHAN' >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_dcb.c:16: warning: Excess function parameter 'author' description in 'SXE_TC_BWG_PERCENT_PER_CHAN' >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_dcb.c:16: warning: Excess function parameter 'date' description in 'SXE_TC_BWG_PERCENT_PER_CHAN' -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_dcb_nl.c:20: warning: Excess function parameter 'file' description in 'BIT_PFC' >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_dcb_nl.c:20: warning: Excess function parameter 'author' description in 'BIT_PFC' >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_dcb_nl.c:20: warning: Excess function parameter 'date' description in 'BIT_PFC' -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_debug.c:18: warning: Excess function parameter 'file' description in 'SKB_DESCRIPTION_LEN' >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_debug.c:18: warning: Excess function parameter 'author' description in 'SKB_DESCRIPTION_LEN' >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_debug.c:18: warning: Excess function parameter 'date' description in 'SKB_DESCRIPTION_LEN' -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_ipsec.c:23: warning: cannot understand function prototype: 'const char ipsec_aes_name[] = "rfc4106(gcm(aes))"; ' -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_host_cli.c:18: warning: cannot understand function prototype: 'dev_t sxe_cdev_major; ' -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_host_hdc.c:27: warning: cannot understand function prototype: 'atomic_t hdc_available = ATOMIC_INIT(1); ' -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_filter.c:24: warning: cannot understand function prototype: 'struct workqueue_struct *sxe_fnav_workqueue; ' -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_monitor.c:24: warning: cannot understand function prototype: 'struct workqueue_struct *sxe_fnav_workqueue; ' .. Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PTP_1588_CLOCK Depends on [n]: NET [=y] && POSIX_TIMERS [=n] Selected by [m]: - SXE [=m] && NETDEVICES [=y] && ETHERNET [=y] && NET_VENDOR_LINKDATA [=y] && (X86 [=y] || ARM64) && PCI [=y] - SXE_VF [=m] && NETDEVICES [=y] && ETHERNET [=y] && NET_VENDOR_LINKDATA [=y] && (X86 [=y] || ARM64) && PCI [=y] vim +24 drivers/net/ethernet/linkdata/sxe/base/log/sxe_log.c 19 20 #if (defined SXE_DRIVER_DEBUG && defined __KERNEL__) || \ 21 (defined SXE_DRIVER_TRACE) 22 23 int time_for_file_name(char *buff, int buf_len) > 24 { 25 #ifdef SXE_LOG_TIME_TO_TM 26 struct timeval tv; 27 struct tm td; 28 29 do_gettimeofday(&tv); 30 time_to_tm(tv.tv_sec, -sys_tz.tz_minuteswest * 60, &td); 31 #else 32 struct timespec64 tv; 33 struct tm td; 34 35 ktime_get_real_ts64(&tv); 36 time64_to_tm(tv.tv_sec, -sys_tz.tz_minuteswest * 60, &td); 37 #endif 38 return snprintf(buff, buf_len, "%04ld-%02d-%02d_%02d:%02d:%02d", 39 td.tm_year + 1900, td.tm_mon + 1, td.tm_mday, 40 td.tm_hour, td.tm_min, td.tm_sec); 41 } 42 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process()
by Li Lingfeng 10 Dec '25

10 Dec '25

From: Tomas Henzl <thenzl(a)redhat.com> stable inclusion from stable-v4.19.276 commit 9e5c7d52085b8c84bc82a261580f0eb170039325 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IDBMX7 CVE: CVE-2023-53803 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 9b4f5028e493cb353a5c8f5c45073eeea0303abd upstream. A fix for: BUG: KASAN: slab-out-of-bounds in ses_enclosure_data_process+0x949/0xe30 [ses] Read of size 1 at addr ffff88a1b043a451 by task systemd-udevd/3271 Checking after (and before in next loop) addl_desc_ptr[1] is sufficient, we expect the size to be sanitized before first access to addl_desc_ptr[1]. Make sure we don't walk beyond end of page. Link: https://lore.kernel.org/r/20230202162451.15346-2-thenzl@redhat.com Cc: stable(a)vger.kernel.org Signed-off-by: Tomas Henzl <thenzl(a)redhat.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/scsi/ses.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c index b42c0bb8caa9..3a0cb1fa6767 100644 --- a/drivers/scsi/ses.c +++ b/drivers/scsi/ses.c @@ -625,9 +625,11 @@ static void ses_enclosure_data_process(struct enclosure_device *edev, /* these elements are optional */ type_ptr[0] == ENCLOSURE_COMPONENT_SCSI_TARGET_PORT || type_ptr[0] == ENCLOSURE_COMPONENT_SCSI_INITIATOR_PORT || - type_ptr[0] == ENCLOSURE_COMPONENT_CONTROLLER_ELECTRONICS)) + type_ptr[0] == ENCLOSURE_COMPONENT_CONTROLLER_ELECTRONICS)) { addl_desc_ptr += addl_desc_ptr[1] + 2; - + if (addl_desc_ptr + 1 >= ses_dev->page10 + ses_dev->page10_len) + addl_desc_ptr = NULL; + } } } kfree(buf); -- 2.31.1

2 1

[PATCH OLK-6.6 0/2] Handling Kunpeng Chip ARM Spectre-BHB (CVE-2022-23960) Issue
by Jinqian Yang 10 Dec '25

10 Dec '25

Previously, the mitigation for HIP09 had been incorporated into 6.6. Now, the mitigation for TSV100 is being incorporated into 6.6. And non-privileged eBPF is disabled by default. In addition, the GRUB in the distribution needs to include 'nospectre-bhb'. Jinqian Yang (2): arm64: Add support for TSV110 Spectre-BHB mitigation config: Disable unprivileged BPF syscall by default arch/arm64/configs/openeuler_defconfig | 2 +- arch/arm64/kernel/proton-pack.c | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) -- 2.33.0

2 3

[openeuler:OLK-6.6 3508/3508] mm/memblock.c:1409:20: warning: no previous prototype for 'memblock_alloc_range_nid_flags'
by kernel test robot 10 Dec '25

10 Dec '25

Hi Ma, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: d7d7f131569485a9b6737b85cd8144196135b1a1 commit: 64018b291c1f49622c4b23b303364d760306d662 [3508/3508] mm/memblock: Introduce ability to alloc memory from specify memory region config: x86_64-allnoconfig-bpf (https://download.01.org/0day-ci/archive/20251210/202512100803.QFVpHYI3-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251210/202512100803.QFVpHYI3-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512100803.QFVpHYI3-lkp@intel.com/ All warnings (new ones prefixed by >>): >> mm/memblock.c:1409:20: warning: no previous prototype for 'memblock_alloc_range_nid_flags' [-Wmissing-prototypes] 1409 | phys_addr_t __init memblock_alloc_range_nid_flags(phys_addr_t size, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +/memblock_alloc_range_nid_flags +1409 mm/memblock.c 1386 1387 /** 1388 * memblock_alloc_range_nid_flags - allocate boot memory block with specify flag 1389 * @size: size of memory block to be allocated in bytes 1390 * @align: alignment of the region and block's size 1391 * @start: the lower bound of the memory region to allocate (phys address) 1392 * @end: the upper bound of the memory region to allocate (phys address) 1393 * @nid: nid of the free area to find, %NUMA_NO_NODE for any node 1394 * @exact_nid: control the allocation fall back to other nodes 1395 * @flags: alloc memory from specify memblock flag 1396 * 1397 * The allocation is performed from memory region limited by 1398 * memblock.current_limit if @end == %MEMBLOCK_ALLOC_ACCESSIBLE. 1399 * 1400 * If the specified node can not hold the requested memory and @exact_nid 1401 * is false, the allocation falls back to any node in the system. 1402 * 1403 * In addition, function sets the min_count to 0 using kmemleak_alloc_phys for 1404 * allocated boot memory block, so that it is never reported as leaks. 1405 * 1406 * Return: 1407 * Physical address of allocated memory block on success, %0 on failure. 1408 */ > 1409 phys_addr_t __init memblock_alloc_range_nid_flags(phys_addr_t size, 1410 phys_addr_t align, phys_addr_t start, 1411 phys_addr_t end, int nid, 1412 bool exact_nid, 1413 enum memblock_flags flags) 1414 { 1415 phys_addr_t found; 1416 1417 if (WARN_ONCE(nid == MAX_NUMNODES, "Usage of MAX_NUMNODES is deprecated. Use NUMA_NO_NODE instead\n")) 1418 nid = NUMA_NO_NODE; 1419 1420 if (!align) { 1421 /* Can't use WARNs this early in boot on powerpc */ 1422 dump_stack(); 1423 align = SMP_CACHE_BYTES; 1424 } 1425 1426 again: 1427 found = memblock_find_in_range_node(size, align, start, end, nid, 1428 flags); 1429 if (found && !memblock_reserve(found, size)) 1430 goto done; 1431 1432 if (nid != NUMA_NO_NODE && !exact_nid) { 1433 found = memblock_find_in_range_node(size, align, start, 1434 end, NUMA_NO_NODE, 1435 flags); 1436 if (found && !memblock_reserve(found, size)) 1437 goto done; 1438 } 1439 1440 if (flags & MEMBLOCK_MIRROR) { 1441 flags &= ~MEMBLOCK_MIRROR; 1442 pr_warn_ratelimited("Could not allocate %pap bytes of mirrored memory\n", 1443 &size); 1444 goto again; 1445 } 1446 1447 return 0; 1448 1449 done: 1450 /* 1451 * Skip kmemleak for those places like kasan_init() and 1452 * early_pgtable_alloc() due to high volume. 1453 */ 1454 if (end != MEMBLOCK_ALLOC_NOLEAKTRACE) 1455 /* 1456 * Memblock allocated blocks are never reported as 1457 * leaks. This is because many of these blocks are 1458 * only referred via the physical address which is 1459 * not looked up by kmemleak. 1460 */ 1461 kmemleak_alloc_phys(found, size, 0); 1462 1463 /* 1464 * Some Virtual Machine platforms, such as Intel TDX or AMD SEV-SNP, 1465 * require memory to be accepted before it can be used by the 1466 * guest. 1467 * 1468 * Accept the memory of the allocated buffer. 1469 */ 1470 accept_memory(found, found + size); 1471 1472 return found; 1473 } 1474 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3508/3508] arch/arm64/kvm/virtcca_cvm.c:992:5: warning: no previous prototype for 'kvm_cvm_vgic_nr_lr'
by kernel test robot 10 Dec '25

10 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: d7d7f131569485a9b6737b85cd8144196135b1a1 commit: befbde867291b5bb068a97b17086ad20484b6068 [3508/3508] VirtCCA: Adapt virtcca operations by cca_base. config: arm64-randconfig-r112-20251210 (https://download.01.org/0day-ci/archive/20251210/202512101452.vWsWIlEF-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.4.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251210/202512101452.vWsWIlEF-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512101452.vWsWIlEF-lkp@intel.com/ All warnings (new ones prefixed by >>): arch/arm64/kvm/virtcca_cvm.c:825:5: warning: no previous prototype for 'virtcca_get_tmi_version' [-Wmissing-prototypes] 825 | u64 virtcca_get_tmi_version(void) | ^~~~~~~~~~~~~~~~~~~~~~~ arch/arm64/kvm/virtcca_cvm.c: In function 'kvm_load_user_data': arch/arm64/kvm/virtcca_cvm.c:885:35: error: 'struct kvm_user_data' has no member named 'data_start' 885 | (user_data.data_start + user_data.data_size < user_data.data_start)) | ^ arch/arm64/kvm/virtcca_cvm.c:885:59: error: 'struct kvm_user_data' has no member named 'data_size'; did you mean 'ram_size'? 885 | (user_data.data_start + user_data.data_size < user_data.data_start)) | ^~~~~~~~~ | ram_size arch/arm64/kvm/virtcca_cvm.c:885:80: error: 'struct kvm_user_data' has no member named 'data_start' 885 | (user_data.data_start + user_data.data_size < user_data.data_start)) | ^ arch/arm64/kvm/virtcca_cvm.c:888:58: error: 'struct kvm_user_data' has no member named 'dtb_info' 888 | if (is_dtb_info_has_extend_data(user_data.dtb_info)) { | ^ arch/arm64/kvm/virtcca_cvm.c:890:38: error: 'struct kvm_user_data' has no member named 'data_start' 890 | if (user_data.data_start + user_data.data_size > ipa_end) | ^ arch/arm64/kvm/virtcca_cvm.c:890:62: error: 'struct kvm_user_data' has no member named 'data_size'; did you mean 'ram_size'? 890 | if (user_data.data_start + user_data.data_size > ipa_end) | ^~~~~~~~~ | ram_size arch/arm64/kvm/virtcca_cvm.c:897:38: error: 'struct kvm_user_data' has no member named 'data_start' 897 | if (user_data.data_start + user_data.data_size > user_data.loader_start) | ^ arch/arm64/kvm/virtcca_cvm.c:897:62: error: 'struct kvm_user_data' has no member named 'data_size'; did you mean 'ram_size'? 897 | if (user_data.data_start + user_data.data_size > user_data.loader_start) | ^~~~~~~~~ | ram_size arch/arm64/kvm/virtcca_cvm.c:907:50: error: 'struct kvm_user_data' has no member named 'dtb_info' 907 | if (is_dtb_info_has_extend_data(user_data.dtb_info)) | ^ arch/arm64/kvm/virtcca_cvm.c:908:41: error: 'struct kvm_user_data' has no member named 'data_start' 908 | cvm->dtb_end = user_data.data_start + user_data.data_size; | ^ arch/arm64/kvm/virtcca_cvm.c:908:65: error: 'struct kvm_user_data' has no member named 'data_size'; did you mean 'ram_size'? 908 | cvm->dtb_end = user_data.data_start + user_data.data_size; | ^~~~~~~~~ | ram_size arch/arm64/kvm/virtcca_cvm.c:910:66: error: 'struct kvm_user_data' has no member named 'dtb_info' 910 | cvm->dtb_end = user_data.loader_start + user_data.dtb_info; | ^ arch/arm64/kvm/virtcca_cvm.c:911:44: error: 'struct kvm_user_data' has no member named 'data_start' 911 | cvm->mmio_start = user_data.data_start; | ^ arch/arm64/kvm/virtcca_cvm.c:912:42: error: 'struct kvm_user_data' has no member named 'data_start' 912 | cvm->mmio_end = user_data.data_start + user_data.data_size; | ^ arch/arm64/kvm/virtcca_cvm.c:912:66: error: 'struct kvm_user_data' has no member named 'data_size'; did you mean 'ram_size'? 912 | cvm->mmio_end = user_data.data_start + user_data.data_size; | ^~~~~~~~~ | ram_size arch/arm64/kvm/virtcca_cvm.c: At top level: >> arch/arm64/kvm/virtcca_cvm.c:992:5: warning: no previous prototype for 'kvm_cvm_vgic_nr_lr' [-Wmissing-prototypes] 992 | u32 kvm_cvm_vgic_nr_lr(void) | ^~~~~~~~~~~~~~~~~~ Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for HALTPOLL_CPUIDLE Depends on [n]: CPU_IDLE [=n] && ARCH_CPUIDLE_HALTPOLL [=y] && ARCH_HAS_OPTIMIZED_POLL [=y] Selected by [y]: - ARM64 [=y] vim +/kvm_cvm_vgic_nr_lr +992 arch/arm64/kvm/virtcca_cvm.c 991 > 992 u32 kvm_cvm_vgic_nr_lr(void) 993 { 994 return kvm_vgic_global_state.nr_lr; 995 } 996 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] NFSD: Fix crash in nfsd4_read_release()
by Li Lingfeng 10 Dec '25

10 Dec '25

From: Chuck Lever <chuck.lever(a)oracle.com> mainline inclusion from mainline-v6.18-rc4 commit abb1f08a2121dd270193746e43b2a9373db9ad84 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IDBAJB CVE: CVE-2025-40324 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When tracing is enabled, the trace_nfsd_read_done trace point crashes during the pynfs read.testNoFh test. Fixes: 15a8b55dbb1b ("nfsd: call op_release, even when op_func returns an error") Cc: stable(a)vger.kernel.org Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Conflicts: fs/nfsd/nfs4proc.c [Commit 5c4583b2b78e ("nfsd: hook up nfs4_preprocess_stateid_op to the nfsd_file cache") replace rd_filp by rd_nf.] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfsd/nfs4proc.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c index 1c3e6de6bcba..ea3db7d8b567 100644 --- a/fs/nfsd/nfs4proc.c +++ b/fs/nfsd/nfs4proc.c @@ -796,10 +796,11 @@ nfsd4_read(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, static void nfsd4_read_release(union nfsd4_op_u *u) { - if (u->read.rd_filp) + if (u->read.rd_filp) { + trace_nfsd_read_done(u->read.rd_rqstp, u->read.rd_fhp, + u->read.rd_offset, u->read.rd_length); fput(u->read.rd_filp); - trace_nfsd_read_done(u->read.rd_rqstp, u->read.rd_fhp, - u->read.rd_offset, u->read.rd_length); + } } static __be32 -- 2.31.1

2 1

[PATCH OLK-5.10] NFSD: Fix crash in nfsd4_read_release()
by Li Lingfeng 10 Dec '25

10 Dec '25

From: Chuck Lever <chuck.lever(a)oracle.com> stable inclusion from stable-v5.10.247 commit 930cb4fe3ab4061be31f20ee30bb72a66f7bb6d1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IDBAJB CVE: CVE-2025-40324 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit abb1f08a2121dd270193746e43b2a9373db9ad84 upstream. When tracing is enabled, the trace_nfsd_read_done trace point crashes during the pynfs read.testNoFh test. Fixes: 15a8b55dbb1b ("nfsd: call op_release, even when op_func returns an error") Cc: stable(a)vger.kernel.org Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfsd/nfs4proc.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c index 96c4e2616b51..61c87c54cd7b 100644 --- a/fs/nfsd/nfs4proc.c +++ b/fs/nfsd/nfs4proc.c @@ -812,10 +812,11 @@ nfsd4_read(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, static void nfsd4_read_release(union nfsd4_op_u *u) { - if (u->read.rd_nf) + if (u->read.rd_nf) { + trace_nfsd_read_done(u->read.rd_rqstp, u->read.rd_fhp, + u->read.rd_offset, u->read.rd_length); nfsd_file_put(u->read.rd_nf); - trace_nfsd_read_done(u->read.rd_rqstp, u->read.rd_fhp, - u->read.rd_offset, u->read.rd_length); + } } static __be32 -- 2.46.1

2 1

[PATCH OLK-6.6] NFSD: Fix crash in nfsd4_read_release()
by Li Lingfeng 10 Dec '25

10 Dec '25

From: Chuck Lever <chuck.lever(a)oracle.com> stable inclusion from stable-v6.6.117 commit 03524ccff698d4a77d096ed529073d91f5edee5d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IDBAJB CVE: CVE-2025-40324 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit abb1f08a2121dd270193746e43b2a9373db9ad84 upstream. When tracing is enabled, the trace_nfsd_read_done trace point crashes during the pynfs read.testNoFh test. Fixes: 15a8b55dbb1b ("nfsd: call op_release, even when op_func returns an error") Cc: stable(a)vger.kernel.org Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfsd/nfs4proc.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c index b2bbf3d6d177..04a2c44e0f95 100644 --- a/fs/nfsd/nfs4proc.c +++ b/fs/nfsd/nfs4proc.c @@ -978,10 +978,11 @@ nfsd4_read(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, static void nfsd4_read_release(union nfsd4_op_u *u) { - if (u->read.rd_nf) + if (u->read.rd_nf) { + trace_nfsd_read_done(u->read.rd_rqstp, u->read.rd_fhp, + u->read.rd_offset, u->read.rd_length); nfsd_file_put(u->read.rd_nf); - trace_nfsd_read_done(u->read.rd_rqstp, u->read.rd_fhp, - u->read.rd_offset, u->read.rd_length); + } } static __be32 -- 2.46.1

2 1

[PATCH OLK-6.6 0/8] xsched: XCU Partition
by Zicheng Qu 10 Dec '25

10 Dec '25

Zicheng Qu (8): xsched: refactor CFS per-XCU rq init/deinit paths xsched: fix NULL pointer risk on attach entry allocation xsched: fix concurrent modification NULL pointer dereference in xcu.sched_class xsched: fix hung_task caused by cgroup_file_show and xcg_mutex deadlock xsched: prevent NULL deref by refcounting css and tracking offline state xsched: fix divide-by-zero caused by u64 overflow in CFS shares weight calculation xsched: DEBUG log cleanup xsched: prevent race between enqueue_ctx and xsched_task_free include/linux/xsched.h | 36 +++++- kernel/xsched/cfs.c | 31 +++++- kernel/xsched/cfs_quota.c | 9 ++ kernel/xsched/cgroup.c | 224 +++++++++++++++++++++----------------- kernel/xsched/core.c | 9 +- kernel/xsched/rt.c | 19 +--- kernel/xsched/vstream.c | 3 + 7 files changed, 200 insertions(+), 131 deletions(-) -- 2.34.1

2 9

[openeuler:OLK-5.10 3399/3399] block/bio.c:412: warning: Function parameter or member 'nr_iovecs_int' not described in 'bio_alloc_bioset'
by kernel test robot 10 Dec '25

10 Dec '25

Hi Li, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 7579fd89cb4a201d22bd5b78f48df5ce339c0b2d commit: 6381672514c4d94637cd4db830b8644440abe99a [3399/3399] block: fix kabi broken config: x86_64-allnoconfig-bpf (https://download.01.org/0day-ci/archive/20251210/202512100653.S0mIExGw-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251210/202512100653.S0mIExGw-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512100653.S0mIExGw-lkp@intel.com/ All warnings (new ones prefixed by >>): >> block/bio.c:412: warning: Function parameter or member 'nr_iovecs_int' not described in 'bio_alloc_bioset' >> block/bio.c:412: warning: Excess function parameter 'nr_iovecs' description in 'bio_alloc_bioset' vim +412 block/bio.c df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 374 ^1da177e4c3f41 fs/bio.c Linus Torvalds 2005-04-16 375 /** ^1da177e4c3f41 fs/bio.c Linus Torvalds 2005-04-16 376 * bio_alloc_bioset - allocate a bio for I/O 519c8e9ffd8614 block/bio.c Randy Dunlap 2017-10-16 377 * @gfp_mask: the GFP_* mask given to the slab allocator ^1da177e4c3f41 fs/bio.c Linus Torvalds 2005-04-16 378 * @nr_iovecs: number of iovecs to pre-allocate db18efac0bd644 fs/bio.c Jaak Ristioja 2010-01-15 379 * @bs: the bio_set to allocate from. ^1da177e4c3f41 fs/bio.c Linus Torvalds 2005-04-16 380 * ^1da177e4c3f41 fs/bio.c Linus Torvalds 2005-04-16 381 * Description: 3f86a82aeb03e6 fs/bio.c Kent Overstreet 2012-09-06 382 * If @bs is NULL, uses kmalloc() to allocate the bio; else the allocation is 3f86a82aeb03e6 fs/bio.c Kent Overstreet 2012-09-06 383 * backed by the @bs's mempool. 3f86a82aeb03e6 fs/bio.c Kent Overstreet 2012-09-06 384 * d0164adc89f6bb block/bio.c Mel Gorman 2015-11-06 385 * When @bs is not NULL, if %__GFP_DIRECT_RECLAIM is set then bio_alloc will d0164adc89f6bb block/bio.c Mel Gorman 2015-11-06 386 * always be able to allocate a bio. This is due to the mempool guarantees. d0164adc89f6bb block/bio.c Mel Gorman 2015-11-06 387 * To make this work, callers must never allocate more than 1 bio at a time d0164adc89f6bb block/bio.c Mel Gorman 2015-11-06 388 * from this pool. Callers that need to allocate more than 1 bio must always d0164adc89f6bb block/bio.c Mel Gorman 2015-11-06 389 * submit the previously allocated bio for IO before attempting to allocate d0164adc89f6bb block/bio.c Mel Gorman 2015-11-06 390 * a new one. Failure to do so can cause deadlocks under memory pressure. 3f86a82aeb03e6 fs/bio.c Kent Overstreet 2012-09-06 391 * ed00aabd5eb9fb block/bio.c Christoph Hellwig 2020-07-01 392 * Note that when running under submit_bio_noacct() (i.e. any block df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 393 * driver), bios are not submitted until after you return - see the code in ed00aabd5eb9fb block/bio.c Christoph Hellwig 2020-07-01 394 * submit_bio_noacct() that converts recursion into iteration, to prevent df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 395 * stack overflows. df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 396 * df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 397 * This would normally mean allocating multiple bios under ed00aabd5eb9fb block/bio.c Christoph Hellwig 2020-07-01 398 * submit_bio_noacct() would be susceptible to deadlocks, but we have df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 399 * deadlock avoidance code that resubmits any blocked bios from a rescuer df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 400 * thread. df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 401 * df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 402 * However, we do not guarantee forward progress for allocations from other df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 403 * mempools. Doing multiple allocations from the same mempool under ed00aabd5eb9fb block/bio.c Christoph Hellwig 2020-07-01 404 * submit_bio_noacct() should be avoided - instead, use bio_set's front_pad df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 405 * for per bio allocations. df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 406 * 3f86a82aeb03e6 fs/bio.c Kent Overstreet 2012-09-06 407 * RETURNS: 3f86a82aeb03e6 fs/bio.c Kent Overstreet 2012-09-06 408 * Pointer to new bio on success, NULL on failure. 3f86a82aeb03e6 fs/bio.c Kent Overstreet 2012-09-06 409 */ 6381672514c4d9 block/bio.c Li Lingfeng 2025-02-10 410 struct bio *bio_alloc_bioset(gfp_t gfp_mask, unsigned int nr_iovecs_int, 7a88fa19194458 block/bio.c Dan Carpenter 2017-03-23 411 struct bio_set *bs) ^1da177e4c3f41 fs/bio.c Linus Torvalds 2005-04-16 @412 { df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 413 gfp_t saved_gfp = gfp_mask; 3f86a82aeb03e6 fs/bio.c Kent Overstreet 2012-09-06 414 unsigned front_pad; 3f86a82aeb03e6 fs/bio.c Kent Overstreet 2012-09-06 415 unsigned inline_vecs; 34053979fb1d92 fs/bio.c Ingo Molnar 2009-02-21 416 struct bio_vec *bvl = NULL; 451a9ebf653d28 fs/bio.c Tejun Heo 2009-04-15 417 struct bio *bio; 451a9ebf653d28 fs/bio.c Tejun Heo 2009-04-15 418 void *p; 6381672514c4d9 block/bio.c Li Lingfeng 2025-02-10 419 unsigned short nr_iovecs = (unsigned short)nr_iovecs_int; 0a0d96b03a1f3b fs/bio.c Jens Axboe 2008-09-11 420 3f86a82aeb03e6 fs/bio.c Kent Overstreet 2012-09-06 421 if (!bs) { 3f86a82aeb03e6 fs/bio.c Kent Overstreet 2012-09-06 422 if (nr_iovecs > UIO_MAXIOV) 3f86a82aeb03e6 fs/bio.c Kent Overstreet 2012-09-06 423 return NULL; 3f86a82aeb03e6 fs/bio.c Kent Overstreet 2012-09-06 424 1f4fe21cf45c79 block/bio.c Gustavo A. R. Silva 2020-06-19 425 p = kmalloc(struct_size(bio, bi_inline_vecs, nr_iovecs), gfp_mask); 3f86a82aeb03e6 fs/bio.c Kent Overstreet 2012-09-06 426 front_pad = 0; 3f86a82aeb03e6 fs/bio.c Kent Overstreet 2012-09-06 427 inline_vecs = nr_iovecs; 3f86a82aeb03e6 fs/bio.c Kent Overstreet 2012-09-06 428 } else { d8f429e1669b97 block/bio.c Junichi Nomura 2014-10-03 429 /* should not use nobvec bioset for nr_iovecs > 0 */ 8aa6ba2f6e3dea block/bio.c Kent Overstreet 2018-05-08 430 if (WARN_ON_ONCE(!mempool_initialized(&bs->bvec_pool) && 8aa6ba2f6e3dea block/bio.c Kent Overstreet 2018-05-08 431 nr_iovecs > 0)) d8f429e1669b97 block/bio.c Junichi Nomura 2014-10-03 432 return NULL; df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 433 /* ed00aabd5eb9fb block/bio.c Christoph Hellwig 2020-07-01 434 * submit_bio_noacct() converts recursion to iteration; this df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 435 * means if we're running beneath it, any bios we allocate and df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 436 * submit will not be submitted (and thus freed) until after we df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 437 * return. df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 438 * df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 439 * This exposes us to a potential deadlock if we allocate df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 440 * multiple bios from the same bio_set() while running ed00aabd5eb9fb block/bio.c Christoph Hellwig 2020-07-01 441 * underneath submit_bio_noacct(). If we were to allocate df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 442 * multiple bios (say a stacking block driver that was splitting df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 443 * bios), we would deadlock if we exhausted the mempool's df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 444 * reserve. df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 445 * df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 446 * We solve this, and guarantee forward progress, with a rescuer df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 447 * workqueue per bio_set. If we go to allocate and there are df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 448 * bios on current->bio_list, we first try the allocation d0164adc89f6bb block/bio.c Mel Gorman 2015-11-06 449 * without __GFP_DIRECT_RECLAIM; if that fails, we punt those d0164adc89f6bb block/bio.c Mel Gorman 2015-11-06 450 * bios we would be blocking to the rescuer workqueue before d0164adc89f6bb block/bio.c Mel Gorman 2015-11-06 451 * we retry with the original gfp_flags. df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 452 */ df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 453 f5fe1b51905df7 block/bio.c NeilBrown 2017-03-10 454 if (current->bio_list && f5fe1b51905df7 block/bio.c NeilBrown 2017-03-10 455 (!bio_list_empty(&current->bio_list[0]) || 47e0fb461fca1a block/bio.c NeilBrown 2017-06-18 456 !bio_list_empty(&current->bio_list[1])) && 47e0fb461fca1a block/bio.c NeilBrown 2017-06-18 457 bs->rescue_workqueue) d0164adc89f6bb block/bio.c Mel Gorman 2015-11-06 458 gfp_mask &= ~__GFP_DIRECT_RECLAIM; df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 459 8aa6ba2f6e3dea block/bio.c Kent Overstreet 2018-05-08 460 p = mempool_alloc(&bs->bio_pool, gfp_mask); df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 461 if (!p && gfp_mask != saved_gfp) { df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 462 punt_bios_to_rescuer(bs); df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 463 gfp_mask = saved_gfp; 8aa6ba2f6e3dea block/bio.c Kent Overstreet 2018-05-08 464 p = mempool_alloc(&bs->bio_pool, gfp_mask); df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 465 } df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 466 3f86a82aeb03e6 fs/bio.c Kent Overstreet 2012-09-06 467 front_pad = bs->front_pad; 3f86a82aeb03e6 fs/bio.c Kent Overstreet 2012-09-06 468 inline_vecs = BIO_INLINE_VECS; 3f86a82aeb03e6 fs/bio.c Kent Overstreet 2012-09-06 469 } 3f86a82aeb03e6 fs/bio.c Kent Overstreet 2012-09-06 470 451a9ebf653d28 fs/bio.c Tejun Heo 2009-04-15 471 if (unlikely(!p)) 451a9ebf653d28 fs/bio.c Tejun Heo 2009-04-15 472 return NULL; ^1da177e4c3f41 fs/bio.c Linus Torvalds 2005-04-16 473 3f86a82aeb03e6 fs/bio.c Kent Overstreet 2012-09-06 474 bio = p + front_pad; 3a83f4677539bc block/bio.c Ming Lei 2016-11-22 475 bio_init(bio, NULL, 0); 34053979fb1d92 fs/bio.c Ingo Molnar 2009-02-21 476 3f86a82aeb03e6 fs/bio.c Kent Overstreet 2012-09-06 477 if (nr_iovecs > inline_vecs) { ed996a52c868b6 block/bio.c Christoph Hellwig 2016-07-19 478 958384da6a734e block/bio.c Christoph Hellwig 2025-02-10 479 bvl = bvec_alloc(&bs->bvec_pool, &nr_iovecs, gfp_mask); df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 480 if (!bvl && gfp_mask != saved_gfp) { df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 481 punt_bios_to_rescuer(bs); df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 482 gfp_mask = saved_gfp; 958384da6a734e block/bio.c Christoph Hellwig 2025-02-10 483 bvl = bvec_alloc(&bs->bvec_pool, &nr_iovecs, gfp_mask); df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 484 } df2cb6daa4cbc3 fs/bio.c Kent Overstreet 2012-09-10 485 34053979fb1d92 fs/bio.c Ingo Molnar 2009-02-21 486 if (unlikely(!bvl)) 34053979fb1d92 fs/bio.c Ingo Molnar 2009-02-21 487 goto err_free; a38352e0ac02db fs/bio.c Kent Overstreet 2012-05-25 488 3f86a82aeb03e6 fs/bio.c Kent Overstreet 2012-09-06 489 } else if (nr_iovecs) { 3f86a82aeb03e6 fs/bio.c Kent Overstreet 2012-09-06 490 bvl = bio->bi_inline_vecs; 392ddc32982a5c fs/bio.c Jens Axboe 2008-12-23 491 } 3f86a82aeb03e6 fs/bio.c Kent Overstreet 2012-09-06 492 3f86a82aeb03e6 fs/bio.c Kent Overstreet 2012-09-06 493 bio->bi_pool = bs; 392ddc32982a5c fs/bio.c Jens Axboe 2008-12-23 494 bio->bi_max_vecs = nr_iovecs; ^1da177e4c3f41 fs/bio.c Linus Torvalds 2005-04-16 495 bio->bi_io_vec = bvl; ^1da177e4c3f41 fs/bio.c Linus Torvalds 2005-04-16 496 return bio; 34053979fb1d92 fs/bio.c Ingo Molnar 2009-02-21 497 34053979fb1d92 fs/bio.c Ingo Molnar 2009-02-21 498 err_free: 8aa6ba2f6e3dea block/bio.c Kent Overstreet 2018-05-08 499 mempool_free(p, &bs->bio_pool); 34053979fb1d92 fs/bio.c Ingo Molnar 2009-02-21 500 return NULL; ^1da177e4c3f41 fs/bio.c Linus Torvalds 2005-04-16 501 } a112a71d45b5e4 fs/bio.c H Hartley Sweeten 2009-09-26 502 EXPORT_SYMBOL(bio_alloc_bioset); ^1da177e4c3f41 fs/bio.c Linus Torvalds 2005-04-16 503 :::::: The code at line 412 was first introduced by commit :::::: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Linux-2.6.12-rc2 :::::: TO: Linus Torvalds <torvalds(a)ppc970.osdl.org> :::::: CC: Linus Torvalds <torvalds(a)ppc970.osdl.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3508/3508] mm/madvise.c:297:6: warning: no previous prototype for 'force_swapin_vma'
by kernel test robot 10 Dec '25

10 Dec '25

Hi Liu, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: d7d7f131569485a9b6737b85cd8144196135b1a1 commit: 92a0eb9bde6c03412b39f9f3d20968c091ea3b46 [3508/3508] memcg: introduce per-memcg swapin interface config: x86_64-allnoconfig-bpf (https://download.01.org/0day-ci/archive/20251210/202512100526.hg7amXND-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251210/202512100526.hg7amXND-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512100526.hg7amXND-lkp@intel.com/ All warnings (new ones prefixed by >>): >> mm/madvise.c:297:6: warning: no previous prototype for 'force_swapin_vma' [-Wmissing-prototypes] 297 | void force_swapin_vma(struct vm_area_struct *vma) | ^~~~~~~~~~~~~~~~ vim +/force_swapin_vma +297 mm/madvise.c 280 281 #ifdef CONFIG_MEMCG_SWAP_QOS 282 void force_swapin_vma(struct vm_area_struct *vma) 283 { 284 struct file *file = vma->vm_file; 285 286 if (!can_madv_lru_vma(vma)) 287 return; 288 289 if (!file) { 290 walk_page_vma(vma, &swapin_walk_ops, vma); 291 lru_add_drain(); 292 } else if (shmem_mapping(file->f_mapping)) 293 shmem_swapin_range(vma, vma->vm_start, 294 vma->vm_end, file->f_mapping); 295 } 296 #else > 297 void force_swapin_vma(struct vm_area_struct *vma) 298 { 299 } 300 #endif 301 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 3399/3399] drivers/acpi/numa/hmat.c:726:6: warning: no previous prototype for 'hmat_restore_target'
by kernel test robot 10 Dec '25

10 Dec '25

Hi Zhang, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 7579fd89cb4a201d22bd5b78f48df5ce339c0b2d commit: 2e1b00fcf1e3152a1e73846f5f9ec37cef088a65 [3399/3399] ACPI/HMAT: Add missing locality information for hot-added device config: x86_64-allnoconfig-bpf (https://download.01.org/0day-ci/archive/20251210/202512100332.Dzr4IpBp-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251210/202512100332.Dzr4IpBp-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512100332.Dzr4IpBp-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/acpi/numa/hmat.c:726:6: warning: no previous prototype for 'hmat_restore_target' [-Wmissing-prototypes] 726 | void hmat_restore_target(int nid) | ^~~~~~~~~~~~~~~~~~~ vim +/hmat_restore_target +726 drivers/acpi/numa/hmat.c 725 > 726 void hmat_restore_target(int nid) 727 { 728 struct memory_target *target; 729 int pxm; 730 731 pxm = node_to_pxm(nid); 732 target = find_mem_target(pxm); 733 if (!target) 734 return; 735 736 mutex_lock(&target_lock); 737 hmat_register_target_cache(target); 738 hmat_register_target_perf(target, 0); 739 hmat_register_target_perf(target, 1); 740 mutex_unlock(&target_lock); 741 } 742 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 3388/3388] kernel/sched/core.c:8279:18: error: member reference type 'struct mem_cgroup *' is a pointer; did you mean to use '->'?
by kernel test robot 10 Dec '25

10 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: ea8b5fbcdf7f5ce2d966ae6aa4e95e2ebde6cb03 commit: b7772972a0a76efac27078392f3f706914fe2af7 [3388/3388] sched/core: Add cpu.steal_task in cgroup v1 cpu subsystem config: x86_64-randconfig-r054-20251209 (https://download.01.org/0day-ci/archive/20251210/202512101034.mDWav7mE-lkp@…) compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project 6ec8c4351cfc1d0627d1633b02ea787bd29c77d8) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251210/202512101034.mDWav7mE-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512101034.mDWav7mE-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from <built-in>:2: In file included from include/linux/compiler_types.h:69: include/linux/compiler-clang.h:34:9: warning: '__SANITIZE_ADDRESS__' macro redefined [-Wmacro-redefined] 34 | #define __SANITIZE_ADDRESS__ | ^ <built-in>:352:9: note: previous definition is here 352 | #define __SANITIZE_ADDRESS__ 1 | ^ kernel/sched/core.c:2750:6: warning: no previous prototype for function 'sched_set_stop_task' [-Wmissing-prototypes] 2750 | void sched_set_stop_task(int cpu, struct task_struct *stop) | ^ kernel/sched/core.c:2750:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2750 | void sched_set_stop_task(int cpu, struct task_struct *stop) | ^ | static kernel/sched/core.c:8279:3: error: use of undeclared identifier 'root_task_group'; did you mean 'root_mem_cgroup'? 8279 | root_task_group.steal_task = TG_STEAL_NO; | ^~~~~~~~~~~~~~~ | root_mem_cgroup include/linux/memcontrol.h:461:27: note: 'root_mem_cgroup' declared here 461 | extern struct mem_cgroup *root_mem_cgroup; | ^ >> kernel/sched/core.c:8279:18: error: member reference type 'struct mem_cgroup *' is a pointer; did you mean to use '->'? 8279 | root_task_group.steal_task = TG_STEAL_NO; | ~~~~~~~~~~~~~~~^ | -> >> kernel/sched/core.c:8279:19: error: no member named 'steal_task' in 'struct mem_cgroup' 8279 | root_task_group.steal_task = TG_STEAL_NO; | ~~~~~~~~~~~~~~~ ^ kernel/sched/core.c:8279:32: error: use of undeclared identifier 'TG_STEAL_NO' 8279 | root_task_group.steal_task = TG_STEAL_NO; | ^~~~~~~~~~~ 2 warnings and 4 errors generated. vim +8279 kernel/sched/core.c 8253 8254 wait_bit_init(); 8255 8256 #ifdef CONFIG_FAIR_GROUP_SCHED 8257 ptr += 2 * nr_cpu_ids * sizeof(void **); 8258 #endif 8259 #ifdef CONFIG_RT_GROUP_SCHED 8260 ptr += 2 * nr_cpu_ids * sizeof(void **); 8261 #endif 8262 if (ptr) { 8263 ptr = (unsigned long)kzalloc(ptr, GFP_NOWAIT); 8264 8265 #ifdef CONFIG_FAIR_GROUP_SCHED 8266 root_task_group.se = (struct sched_entity **)ptr; 8267 ptr += nr_cpu_ids * sizeof(void **); 8268 8269 root_task_group.cfs_rq = (struct cfs_rq **)ptr; 8270 ptr += nr_cpu_ids * sizeof(void **); 8271 8272 root_task_group.shares = ROOT_TASK_GROUP_LOAD; 8273 init_cfs_bandwidth(&root_task_group.cfs_bandwidth); 8274 #endif /* CONFIG_FAIR_GROUP_SCHED */ 8275 #ifdef CONFIG_QOS_SCHED_SMT_EXPELLER 8276 root_task_group.smt_expell = TG_SMT_EXPELL; 8277 #endif 8278 #ifdef CONFIG_SCHED_STEAL > 8279 root_task_group.steal_task = TG_STEAL_NO; 8280 #endif 8281 #ifdef CONFIG_RT_GROUP_SCHED 8282 root_task_group.rt_se = (struct sched_rt_entity **)ptr; 8283 ptr += nr_cpu_ids * sizeof(void **); 8284 8285 root_task_group.rt_rq = (struct rt_rq **)ptr; 8286 ptr += nr_cpu_ids * sizeof(void **); 8287 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] test arm ci
by Tengda Wu 10 Dec '25

10 Dec '25

--- kernel/cgroup/ifs.c | 1 + 1 file changed, 1 insertion(+) diff --git a/kernel/cgroup/ifs.c b/kernel/cgroup/ifs.c index e6419899d725..0cd53572dac4 100644 --- a/kernel/cgroup/ifs.c +++ b/kernel/cgroup/ifs.c @@ -314,6 +314,7 @@ static void tdesc_init(struct ifs_tdesc *desc, u64 freq) static void cgroup_ifs_tdesc_init(void) { + // test tdesc_init(&ifs_tdesc[IFS_TIMER_CLK], NSEC_PER_SEC); tdesc_init(&ifs_tdesc[IFS_TIMER_TSC], this_cpu_read(ifs_tsc_freq)); } -- 2.34.1

2 1

[PATCH OLK-6.6] sctp: initialize more fields in sctp_v6_from_sk()
by Wang Liang 10 Dec '25

10 Dec '25

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v6.6.104 commit 463aa96fca6209bb205f49f7deea3817d7ddaa3a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICYBRO CVE: CVE-2025-39812 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2e8750469242cad8f01f320131fd5a6f540dbb99 ] syzbot found that sin6_scope_id was not properly initialized, leading to undefined behavior. Clear sin6_scope_id and sin6_flowinfo. BUG: KMSAN: uninit-value in __sctp_v6_cmp_addr+0x887/0x8c0 net/sctp/ipv6.c:649 __sctp_v6_cmp_addr+0x887/0x8c0 net/sctp/ipv6.c:649 sctp_inet6_cmp_addr+0x4f2/0x510 net/sctp/ipv6.c:983 sctp_bind_addr_conflict+0x22a/0x3b0 net/sctp/bind_addr.c:390 sctp_get_port_local+0x21eb/0x2440 net/sctp/socket.c:8452 sctp_get_port net/sctp/socket.c:8523 [inline] sctp_listen_start net/sctp/socket.c:8567 [inline] sctp_inet_listen+0x710/0xfd0 net/sctp/socket.c:8636 __sys_listen_socket net/socket.c:1912 [inline] __sys_listen net/socket.c:1927 [inline] __do_sys_listen net/socket.c:1932 [inline] __se_sys_listen net/socket.c:1930 [inline] __x64_sys_listen+0x343/0x4c0 net/socket.c:1930 x64_sys_call+0x271d/0x3e20 arch/x86/include/generated/asm/syscalls_64.h:51 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Local variable addr.i.i created at: sctp_get_port net/sctp/socket.c:8515 [inline] sctp_listen_start net/sctp/socket.c:8567 [inline] sctp_inet_listen+0x650/0xfd0 net/sctp/socket.c:8636 __sys_listen_socket net/socket.c:1912 [inline] __sys_listen net/socket.c:1927 [inline] __do_sys_listen net/socket.c:1932 [inline] __se_sys_listen net/socket.c:1930 [inline] __x64_sys_listen+0x343/0x4c0 net/socket.c:1930 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+e69f06a0f30116c68056(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/68adc0a2.050a0220.37038e.00c4.GAE@google.com… Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Marcelo Ricardo Leitner <marcelo.leitner(a)gmail.com> Acked-by: Xin Long <lucien.xin(a)gmail.com> Link: https://patch.msgid.link/20250826141314.1802610-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/sctp/ipv6.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c index 717828e53162..0673857cb3d8 100644 --- a/net/sctp/ipv6.c +++ b/net/sctp/ipv6.c @@ -547,7 +547,9 @@ static void sctp_v6_from_sk(union sctp_addr *addr, struct sock *sk) { addr->v6.sin6_family = AF_INET6; addr->v6.sin6_port = 0; + addr->v6.sin6_flowinfo = 0; addr->v6.sin6_addr = sk->sk_v6_rcv_saddr; + addr->v6.sin6_scope_id = 0; } /* Initialize sk->sk_rcv_saddr from sctp_addr. */ -- 2.34.1

2 1

[PATCH OLK-6.6] netfilter: nf_tables: reject duplicate device on updates
by Wang Liang 10 Dec '25

10 Dec '25

From: Pablo Neira Ayuso <pablo(a)netfilter.org> stable inclusion from stable-v6.6.117 commit 3f358a66a04513311668ea4b40f5064e253d8386 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICW8ZD CVE: CVE-2025-38678 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit cf5fb87fcdaaaafec55dcc0dc5a9e15ead343973 upstream. A chain/flowtable update with duplicated devices in the same batch is possible. Unfortunately, netdev event path only removes the first device that is found, leaving unregistered the hook of the duplicated device. Check if a duplicated device exists in the transaction batch, bail out with EEXIST in such case. WARNING is hit when unregistering the hook: [49042.221275] WARNING: CPU: 4 PID: 8425 at net/netfilter/core.c:340 nf_hook_entry_head+0xaa/0x150 [49042.221375] CPU: 4 UID: 0 PID: 8425 Comm: nft Tainted: G S 6.16.0+ #170 PREEMPT(full) [...] [49042.221382] RIP: 0010:nf_hook_entry_head+0xaa/0x150 Fixes: 78d9f48f7f44 ("netfilter: nf_tables: add devices to existing flowtable") Fixes: b9703ed44ffb ("netfilter: nf_tables: support for adding new devices to an existing netdev chain") Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/netfilter/nf_tables_api.c | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 18ae39cf4188..bea2c3c4d3de 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -2586,6 +2586,7 @@ static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy, struct nft_chain *chain = ctx->chain; struct nft_chain_hook hook = {}; struct nft_stats *stats = NULL; + struct nftables_pernet *nft_net; struct nft_hook *h, *next; struct nf_hook_ops *ops; struct nft_trans *trans; @@ -2626,6 +2627,20 @@ static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy, if (nft_hook_list_find(&basechain->hook_list, h)) { list_del(&h->list); kfree(h); + continue; + } + + nft_net = nft_pernet(ctx->net); + list_for_each_entry(trans, &nft_net->commit_list, list) { + if (trans->msg_type != NFT_MSG_NEWCHAIN || + trans->ctx.table != ctx->table || + !nft_trans_chain_update(trans)) + continue; + + if (nft_hook_list_find(&nft_trans_chain_hooks(trans), h)) { + nft_chain_release_hook(&hook); + return -EEXIST; + } } } } else { @@ -8514,6 +8529,7 @@ static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh, { const struct nlattr * const *nla = ctx->nla; struct nft_flowtable_hook flowtable_hook; + struct nftables_pernet *nft_net; struct nft_hook *hook, *next; struct nft_trans *trans; bool unregister = false; @@ -8529,6 +8545,20 @@ static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh, if (nft_hook_list_find(&flowtable->hook_list, hook)) { list_del(&hook->list); kfree(hook); + continue; + } + + nft_net = nft_pernet(ctx->net); + list_for_each_entry(trans, &nft_net->commit_list, list) { + if (trans->msg_type != NFT_MSG_NEWFLOWTABLE || + trans->ctx.table != ctx->table || + !nft_trans_flowtable_update(trans)) + continue; + + if (nft_hook_list_find(&nft_trans_flowtable_hooks(trans), hook)) { + err = -EEXIST; + goto err_flowtable_update_hook; + } } } -- 2.34.1

2 1

[PATCH OLK-6.6] net/packet: fix a race in packet_set_ring() and packet_notifier()
by Wang Liang 10 Dec '25

10 Dec '25

From: Quang Le <quanglex97(a)gmail.com> stable inclusion from stable-v6.6.102 commit 88caf46db8239e6471413d28aabaa6b8bd552805 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICUC4S CVE: CVE-2025-38617 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 01d3c8417b9c1b884a8a981a3b886da556512f36 upstream. When packet_set_ring() releases po->bind_lock, another thread can run packet_notifier() and process an NETDEV_UP event. This race and the fix are both similar to that of commit 15fe076edea7 ("net/packet: fix a race in packet_bind() and packet_notifier()"). There too the packet_notifier NETDEV_UP event managed to run while a po->bind_lock critical section had to be temporarily released. And the fix was similarly to temporarily set po->num to zero to keep the socket unhooked until the lock is retaken. The po->bind_lock in packet_set_ring and packet_notifier precede the introduction of git history. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable(a)vger.kernel.org Signed-off-by: Quang Le <quanglex97(a)gmail.com> Signed-off-by: Willem de Bruijn <willemb(a)google.com> Link: https://patch.msgid.link/20250801175423.2970334-1-willemdebruijn.kernel@gma… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/packet/af_packet.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c index 4abf7e9ac4f2..677d3190479f 100644 --- a/net/packet/af_packet.c +++ b/net/packet/af_packet.c @@ -4567,10 +4567,10 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, spin_lock(&po->bind_lock); was_running = packet_sock_flag(po, PACKET_SOCK_RUNNING); num = po->num; - if (was_running) { - WRITE_ONCE(po->num, 0); + WRITE_ONCE(po->num, 0); + if (was_running) __unregister_prot_hook(sk, false); - } + spin_unlock(&po->bind_lock); synchronize_net(); @@ -4602,10 +4602,10 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, mutex_unlock(&po->pg_vec_lock); spin_lock(&po->bind_lock); - if (was_running) { - WRITE_ONCE(po->num, num); + WRITE_ONCE(po->num, num); + if (was_running) register_prot_hook(sk); - } + spin_unlock(&po->bind_lock); if (pg_vec && (po->tp_version > TPACKET_V2)) { /* Because we don't support block-based V3 on tx-ring */ -- 2.34.1

2 1

[PATCH OLK-6.6] netfilter: xt_nfacct: don't assume acct name is null-terminated
by Wang Liang 10 Dec '25

10 Dec '25

From: Florian Westphal <fw(a)strlen.de> stable inclusion from stable-v6.6.102 commit 58004aa21e79addaf41667bfe65e93ec51653f18 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICUC9G CVE: CVE-2025-38639 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit bf58e667af7d96c8eb9411f926a0a0955f41ce21 ] BUG: KASAN: slab-out-of-bounds in .. lib/vsprintf.c:721 Read of size 1 at addr ffff88801eac95c8 by task syz-executor183/5851 [..] string+0x231/0x2b0 lib/vsprintf.c:721 vsnprintf+0x739/0xf00 lib/vsprintf.c:2874 [..] nfacct_mt_checkentry+0xd2/0xe0 net/netfilter/xt_nfacct.c:41 xt_check_match+0x3d1/0xab0 net/netfilter/x_tables.c:523 nfnl_acct_find_get() handles non-null input, but the error printk relied on its presence. Reported-by: syzbot+4ff165b9251e4d295690(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=4ff165b9251e4d295690 Tested-by: syzbot+4ff165b9251e4d295690(a)syzkaller.appspotmail.com Fixes: ceb98d03eac5 ("netfilter: xtables: add nfacct match to support extended accounting") Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/netfilter/xt_nfacct.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/netfilter/xt_nfacct.c b/net/netfilter/xt_nfacct.c index 7c6bf1c16813..0ca1cdfc4095 100644 --- a/net/netfilter/xt_nfacct.c +++ b/net/netfilter/xt_nfacct.c @@ -38,8 +38,8 @@ nfacct_mt_checkentry(const struct xt_mtchk_param *par) nfacct = nfnl_acct_find_get(par->net, info->name); if (nfacct == NULL) { - pr_info_ratelimited("accounting object `%s' does not exists\n", - info->name); + pr_info_ratelimited("accounting object `%.*s' does not exist\n", + NFACCT_NAME_MAX, info->name); return -ENOENT; } info->nfacct = nfacct; -- 2.34.1

2 1

[PATCH OLK-6.6] net: drop UFO packets in udp_rcv_segment()
by Wang Liang 10 Dec '25

10 Dec '25

stable inclusion from stable-v6.6.102 commit 0d45954034f8edd6d4052e0190d3d6335c37e4de category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICUC8Y CVE: CVE-2025-38622 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d46e51f1c78b9ab9323610feb14238d06d46d519 ] When sending a packet with virtio_net_hdr to tun device, if the gso_type in virtio_net_hdr is SKB_GSO_UDP and the gso_size is less than udphdr size, below crash may happen. ------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:4572! Oops: invalid opcode: 0000 [#1] SMP NOPTI CPU: 0 UID: 0 PID: 62 Comm: mytest Not tainted 6.16.0-rc7 #203 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:skb_pull_rcsum+0x8e/0xa0 Code: 00 00 5b c3 cc cc cc cc 8b 93 88 00 00 00 f7 da e8 37 44 38 00 f7 d8 89 83 88 00 00 00 48 8b 83 c8 00 00 00 5b c3 cc cc cc cc <0f> 0b 0f 0b 66 66 2e 0f 1f 84 00 000 RSP: 0018:ffffc900001fba38 EFLAGS: 00000297 RAX: 0000000000000004 RBX: ffff8880040c1000 RCX: ffffc900001fb948 RDX: ffff888003e6d700 RSI: 0000000000000008 RDI: ffff88800411a062 RBP: ffff8880040c1000 R08: 0000000000000000 R09: 0000000000000001 R10: ffff888003606c00 R11: 0000000000000001 R12: 0000000000000000 R13: ffff888004060900 R14: ffff888004050000 R15: ffff888004060900 FS: 000000002406d3c0(0000) GS:ffff888084a19000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000040 CR3: 0000000004007000 CR4: 00000000000006f0 Call Trace: <TASK> udp_queue_rcv_one_skb+0x176/0x4b0 net/ipv4/udp.c:2445 udp_queue_rcv_skb+0x155/0x1f0 net/ipv4/udp.c:2475 udp_unicast_rcv_skb+0x71/0x90 net/ipv4/udp.c:2626 __udp4_lib_rcv+0x433/0xb00 net/ipv4/udp.c:2690 ip_protocol_deliver_rcu+0xa6/0x160 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x72/0x90 net/ipv4/ip_input.c:233 ip_sublist_rcv_finish+0x5f/0x70 net/ipv4/ip_input.c:579 ip_sublist_rcv+0x122/0x1b0 net/ipv4/ip_input.c:636 ip_list_rcv+0xf7/0x130 net/ipv4/ip_input.c:670 __netif_receive_skb_list_core+0x21d/0x240 net/core/dev.c:6067 netif_receive_skb_list_internal+0x186/0x2b0 net/core/dev.c:6210 napi_complete_done+0x78/0x180 net/core/dev.c:6580 tun_get_user+0xa63/0x1120 drivers/net/tun.c:1909 tun_chr_write_iter+0x65/0xb0 drivers/net/tun.c:1984 vfs_write+0x300/0x420 fs/read_write.c:593 ksys_write+0x60/0xd0 fs/read_write.c:686 do_syscall_64+0x50/0x1c0 arch/x86/entry/syscall_64.c:63 </TASK> To trigger gso segment in udp_queue_rcv_skb(), we should also set option UDP_ENCAP_ESPINUDP to enable udp_sk(sk)->encap_rcv. When the encap_rcv hook return 1 in udp_queue_rcv_one_skb(), udp_csum_pull_header() will try to pull udphdr, but the skb size has been segmented to gso size, which leads to this crash. Previous commit cf329aa42b66 ("udp: cope with UDP GRO packet misdirection") introduces segmentation in UDP receive path only for GRO, which was never intended to be used for UFO, so drop UFO packets in udp_rcv_segment(). Link: https://lore.kernel.org/netdev/20250724083005.3918375-1-wangliang74@huawei.… Link: https://lore.kernel.org/netdev/20250729123907.3318425-1-wangliang74@huawei.… Fixes: cf329aa42b66 ("udp: cope with UDP GRO packet misdirection") Suggested-by: Willem de Bruijn <willemdebruijn.kernel(a)gmail.com> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> Reviewed-by: Willem de Bruijn <willemb(a)google.com> Link: https://patch.msgid.link/20250730101458.3470788-1-wangliang74@huawei.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- include/net/udp.h | 24 ++++++++++++++++++------ 1 file changed, 18 insertions(+), 6 deletions(-) diff --git a/include/net/udp.h b/include/net/udp.h index 488a6d2babcc..89eeb187667b 100644 --- a/include/net/udp.h +++ b/include/net/udp.h @@ -466,6 +466,16 @@ static inline struct sk_buff *udp_rcv_segment(struct sock *sk, { netdev_features_t features = NETIF_F_SG; struct sk_buff *segs; + int drop_count; + + /* + * Segmentation in UDP receive path is only for UDP GRO, drop udp + * fragmentation offload (UFO) packets. + */ + if (skb_shinfo(skb)->gso_type & SKB_GSO_UDP) { + drop_count = 1; + goto drop; + } /* Avoid csum recalculation by skb_segment unless userspace explicitly * asks for the final checksum values @@ -489,16 +499,18 @@ static inline struct sk_buff *udp_rcv_segment(struct sock *sk, */ segs = __skb_gso_segment(skb, features, false); if (IS_ERR_OR_NULL(segs)) { - int segs_nr = skb_shinfo(skb)->gso_segs; - - atomic_add(segs_nr, &sk->sk_drops); - SNMP_ADD_STATS(__UDPX_MIB(sk, ipv4), UDP_MIB_INERRORS, segs_nr); - kfree_skb(skb); - return NULL; + drop_count = skb_shinfo(skb)->gso_segs; + goto drop; } consume_skb(skb); return segs; + +drop: + atomic_add(drop_count, &sk->sk_drops); + SNMP_ADD_STATS(__UDPX_MIB(sk, ipv4), UDP_MIB_INERRORS, drop_count); + kfree_skb(skb); + return NULL; } static inline void udp_post_segment_fix_csum(struct sk_buff *skb) -- 2.34.1

2 1

[PATCH OLK-6.6] ice: Fix a null pointer dereference in ice_copy_and_init_pkg()
by Wang Liang 10 Dec '25

10 Dec '25

From: Haoxiang Li <haoxiang_li2024(a)163.com> stable inclusion from stable-v6.6.101 commit 3028f2a4e746b499043bbb8ab816f975473a0535 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICUCA2 CVE: CVE-2025-38664 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 4ff12d82dac119b4b99b5a78b5af3bf2474c0a36 upstream. Add check for the return value of devm_kmemdup() to prevent potential null pointer dereference. Fixes: c76488109616 ("ice: Implement Dynamic Device Personalization (DDP) download") Cc: stable(a)vger.kernel.org Signed-off-by: Haoxiang Li <haoxiang_li2024(a)163.com> Reviewed-by: Michal Swiatkowski <michal.swiatkowski(a)linux.intel.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov(a)intel.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Tested-by: Rinitha S <sx.rinitha(a)intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- drivers/net/ethernet/intel/ice/ice_ddp.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/ethernet/intel/ice/ice_ddp.c b/drivers/net/ethernet/intel/ice/ice_ddp.c index b27ec93638b6..cd97974b451a 100644 --- a/drivers/net/ethernet/intel/ice/ice_ddp.c +++ b/drivers/net/ethernet/intel/ice/ice_ddp.c @@ -1884,6 +1884,8 @@ enum ice_ddp_state ice_copy_and_init_pkg(struct ice_hw *hw, const u8 *buf, return ICE_DDP_PKG_ERR; buf_copy = devm_kmemdup(ice_hw_to_dev(hw), buf, len, GFP_KERNEL); + if (!buf_copy) + return ICE_DDP_PKG_ERR; state = ice_init_pkg(hw, buf_copy, len); if (!ice_is_init_pkg_successful(state)) { -- 2.34.1

2 1

[PATCH OLK-6.6] ipv6: prevent infinite loop in rt6_nlmsg_size()
by Wang Liang 10 Dec '25

10 Dec '25

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v6.6.102 commit e1b7932af47f92432be8303d2439d1bf77b0be23 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICU76G CVE: CVE-2025-38588 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 54e6fe9dd3b0e7c481c2228782c9494d653546da ] While testing prior patch, I was able to trigger an infinite loop in rt6_nlmsg_size() in the following place: list_for_each_entry_rcu(sibling, &f6i->fib6_siblings, fib6_siblings) { rt6_nh_nlmsg_size(sibling->fib6_nh, &nexthop_len); } This is because fib6_del_route() and fib6_add_rt2node() uses list_del_rcu(), which can confuse rcu readers, because they might no longer see the head of the list. Restart the loop if f6i->fib6_nsiblings is zero. Fixes: d9ccb18f83ea ("ipv6: Fix soft lockups in fib6_select_path under high next hop churn") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20250725140725.3626540-3-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/ipv6/ip6_fib.c | 4 ++-- net/ipv6/route.c | 34 ++++++++++++++++++---------------- 2 files changed, 20 insertions(+), 18 deletions(-) diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c index 023ac39041a2..65702bddb21f 100644 --- a/net/ipv6/ip6_fib.c +++ b/net/ipv6/ip6_fib.c @@ -1240,7 +1240,7 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt, &rt->fib6_siblings, fib6_siblings) sibling->fib6_nsiblings--; - rt->fib6_nsiblings = 0; + WRITE_ONCE(rt->fib6_nsiblings, 0); list_del_rcu(&rt->fib6_siblings); rt6_multipath_rebalance(next_sibling); return err; @@ -1953,7 +1953,7 @@ static void fib6_del_route(struct fib6_table *table, struct fib6_node *fn, list_for_each_entry_safe(sibling, next_sibling, &rt->fib6_siblings, fib6_siblings) sibling->fib6_nsiblings--; - rt->fib6_nsiblings = 0; + WRITE_ONCE(rt->fib6_nsiblings, 0); list_del_rcu(&rt->fib6_siblings); rt6_multipath_rebalance(next_sibling); } diff --git a/net/ipv6/route.c b/net/ipv6/route.c index 53197087353a..41d358dd58c0 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -5577,32 +5577,34 @@ static int rt6_nh_nlmsg_size(struct fib6_nh *nh, void *arg) static size_t rt6_nlmsg_size(struct fib6_info *f6i) { + struct fib6_info *sibling; + struct fib6_nh *nh; int nexthop_len; if (f6i->nh) { nexthop_len = nla_total_size(4); /* RTA_NH_ID */ nexthop_for_each_fib6_nh(f6i->nh, rt6_nh_nlmsg_size, &nexthop_len); - } else { - struct fib6_nh *nh = f6i->fib6_nh; - struct fib6_info *sibling; - - nexthop_len = 0; - if (f6i->fib6_nsiblings) { - rt6_nh_nlmsg_size(nh, &nexthop_len); - - rcu_read_lock(); + goto common; + } - list_for_each_entry_rcu(sibling, &f6i->fib6_siblings, - fib6_siblings) { - rt6_nh_nlmsg_size(sibling->fib6_nh, &nexthop_len); - } + rcu_read_lock(); +retry: + nh = f6i->fib6_nh; + nexthop_len = 0; + if (READ_ONCE(f6i->fib6_nsiblings)) { + rt6_nh_nlmsg_size(nh, &nexthop_len); - rcu_read_unlock(); + list_for_each_entry_rcu(sibling, &f6i->fib6_siblings, + fib6_siblings) { + rt6_nh_nlmsg_size(sibling->fib6_nh, &nexthop_len); + if (!READ_ONCE(f6i->fib6_nsiblings)) + goto retry; } - nexthop_len += lwtunnel_get_encap_size(nh->fib_nh_lws); } - + rcu_read_unlock(); + nexthop_len += lwtunnel_get_encap_size(nh->fib_nh_lws); +common: return NLMSG_ALIGN(sizeof(struct rtmsg)) + nla_total_size(16) /* RTA_SRC */ + nla_total_size(16) /* RTA_DST */ -- 2.34.1

2 1

[PATCH OLK-6.6] net: phy: Don't register LEDs for genphy
by Wang Liang 10 Dec '25

10 Dec '25

From: Sean Anderson <sean.anderson(a)linux.dev> stable inclusion from stable-v6.6.100 commit ec158d05eaa91b2809cab65f8068290e3c05ebdd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICTB60 CVE: CVE-2025-38537 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f0f2b992d8185a0366be951685e08643aae17d6d ] If a PHY has no driver, the genphy driver is probed/removed directly in phy_attach/detach. If the PHY's ofnode has an "leds" subnode, then the LEDs will be (un)registered when probing/removing the genphy driver. This could occur if the leds are for a non-generic driver that isn't loaded for whatever reason. Synchronously removing the PHY device in phy_detach leads to the following deadlock: rtnl_lock() ndo_close() ... phy_detach() phy_remove() phy_leds_unregister() led_classdev_unregister() led_trigger_set() netdev_trigger_deactivate() unregister_netdevice_notifier() rtnl_lock() There is a corresponding deadlock on the open/register side of things (and that one is reported by lockdep), but it requires a race while this one is deterministic. Generic PHYs do not support LEDs anyway, so don't bother registering them. Fixes: 01e5b728e9e4 ("net: phy: Add a binding for PHY LEDs") Signed-off-by: Sean Anderson <sean.anderson(a)linux.dev> Link: https://patch.msgid.link/20250707195803.666097-1-sean.anderson@linux.dev Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- drivers/net/phy/phy_device.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c index ee43f4dbf6a7..0550c89761f9 100644 --- a/drivers/net/phy/phy_device.c +++ b/drivers/net/phy/phy_device.c @@ -3402,7 +3402,8 @@ static int phy_probe(struct device *dev) /* Get the LEDs from the device tree, and instantiate standard * LEDs for them. */ - if (IS_ENABLED(CONFIG_PHYLIB_LEDS)) + if (IS_ENABLED(CONFIG_PHYLIB_LEDS) && !phy_driver_is_genphy(phydev) && + !phy_driver_is_genphy_10g(phydev)) err = of_phy_leds(phydev); out: @@ -3419,7 +3420,8 @@ static int phy_remove(struct device *dev) cancel_delayed_work_sync(&phydev->state_queue); - if (IS_ENABLED(CONFIG_PHYLIB_LEDS)) + if (IS_ENABLED(CONFIG_PHYLIB_LEDS) && !phy_driver_is_genphy(phydev) && + !phy_driver_is_genphy_10g(phydev)) phy_leds_unregister(phydev); phydev->state = PHY_DOWN; -- 2.34.1

2 1

[PATCH OLK-6.6] ipv6: mcast: Delay put pmc->idev in mld_del_delrec()
by Wang Liang 10 Dec '25

10 Dec '25

From: Yue Haibing <yuehaibing(a)huawei.com> stable inclusion from stable-v6.6.100 commit dcbc346f50a009d8b7f4e330f9f2e22d6442fa26 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICTB6U CVE: CVE-2025-38550 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ae3264a25a4635531264728859dbe9c659fad554 ] pmc->idev is still used in ip6_mc_clear_src(), so as mld_clear_delrec() does, the reference should be put after ip6_mc_clear_src() return. Fixes: 63ed8de4be81 ("mld: add mc_lock for protecting per-interface mld data") Signed-off-by: Yue Haibing <yuehaibing(a)huawei.com> Link: https://patch.msgid.link/20250714141957.3301871-1-yuehaibing@huawei.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/ipv6/mcast.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c index 9bb246c09fce..e153dac47a53 100644 --- a/net/ipv6/mcast.c +++ b/net/ipv6/mcast.c @@ -803,8 +803,8 @@ static void mld_del_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im) } else { im->mca_crcount = idev->mc_qrv; } - in6_dev_put(pmc->idev); ip6_mc_clear_src(pmc); + in6_dev_put(pmc->idev); kfree_rcu(pmc, rcu); } } -- 2.34.1

2 1

[PATCH OLK-6.6] netfilter: nf_conntrack: fix crash due to removal of uninitialised entry
by Wang Liang 10 Dec '25

10 Dec '25

From: Florian Westphal <fw(a)strlen.de> stable inclusion from stable-v6.6.100 commit 76179961c423cd698080b5e4d5583cf7f4fcdde9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICPD78 CVE: CVE-2025-38472 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2d72afb340657f03f7261e9243b44457a9228ac7 ] A crash in conntrack was reported while trying to unlink the conntrack entry from the hash bucket list: [exception RIP: __nf_ct_delete_from_lists+172] [..] #7 [ff539b5a2b043aa0] nf_ct_delete at ffffffffc124d421 [nf_conntrack] #8 [ff539b5a2b043ad0] nf_ct_gc_expired at ffffffffc124d999 [nf_conntrack] #9 [ff539b5a2b043ae0] __nf_conntrack_find_get at ffffffffc124efbc [nf_conntrack] [..] The nf_conn struct is marked as allocated from slab but appears to be in a partially initialised state: ct hlist pointer is garbage; looks like the ct hash value (hence crash). ct->status is equal to IPS_CONFIRMED|IPS_DYING, which is expected ct->timeout is 30000 (=30s), which is unexpected. Everything else looks like normal udp conntrack entry. If we ignore ct->status and pretend its 0, the entry matches those that are newly allocated but not yet inserted into the hash: - ct hlist pointers are overloaded and store/cache the raw tuple hash - ct->timeout matches the relative time expected for a new udp flow rather than the absolute 'jiffies' value. If it were not for the presence of IPS_CONFIRMED, __nf_conntrack_find_get() would have skipped the entry. Theory is that we did hit following race: cpu x cpu y cpu z found entry E found entry E E is expired <preemption> nf_ct_delete() return E to rcu slab init_conntrack E is re-inited, ct->status set to 0 reply tuplehash hnnode.pprev stores hash value. cpu y found E right before it was deleted on cpu x. E is now re-inited on cpu z. cpu y was preempted before checking for expiry and/or confirm bit. ->refcnt set to 1 E now owned by skb ->timeout set to 30000 If cpu y were to resume now, it would observe E as expired but would skip E due to missing CONFIRMED bit. nf_conntrack_confirm gets called sets: ct->status |= CONFIRMED This is wrong: E is not yet added to hashtable. cpu y resumes, it observes E as expired but CONFIRMED: <resumes> nf_ct_expired() -> yes (ct->timeout is 30s) confirmed bit set. cpu y will try to delete E from the hashtable: nf_ct_delete() -> set DYING bit __nf_ct_delete_from_lists Even this scenario doesn't guarantee a crash: cpu z still holds the table bucket lock(s) so y blocks: wait for spinlock held by z CONFIRMED is set but there is no guarantee ct will be added to hash: "chaintoolong" or "clash resolution" logic both skip the insert step. reply hnnode.pprev still stores the hash value. unlocks spinlock return NF_DROP <unblocks, then crashes on hlist_nulls_del_rcu pprev> In case CPU z does insert the entry into the hashtable, cpu y will unlink E again right away but no crash occurs. Without 'cpu y' race, 'garbage' hlist is of no consequence: ct refcnt remains at 1, eventually skb will be free'd and E gets destroyed via: nf_conntrack_put -> nf_conntrack_destroy -> nf_ct_destroy. To resolve this, move the IPS_CONFIRMED assignment after the table insertion but before the unlock. Pablo points out that the confirm-bit-store could be reordered to happen before hlist add resp. the timeout fixup, so switch to set_bit and before_atomic memory barrier to prevent this. It doesn't matter if other CPUs can observe a newly inserted entry right before the CONFIRMED bit was set: Such event cannot be distinguished from above "E is the old incarnation" case: the entry will be skipped. Also change nf_ct_should_gc() to first check the confirmed bit. The gc sequence is: 1. Check if entry has expired, if not skip to next entry 2. Obtain a reference to the expired entry. 3. Call nf_ct_should_gc() to double-check step 1. nf_ct_should_gc() is thus called only for entries that already failed an expiry check. After this patch, once the confirmed bit check passes ct->timeout has been altered to reflect the absolute 'best before' date instead of a relative time. Step 3 will therefore not remove the entry. Without this change to nf_ct_should_gc() we could still get this sequence: 1. Check if entry has expired. 2. Obtain a reference. 3. Call nf_ct_should_gc() to double-check step 1: 4 - entry is still observed as expired 5 - meanwhile, ct->timeout is corrected to absolute value on other CPU and confirm bit gets set 6 - confirm bit is seen 7 - valid entry is removed again First do check 6), then 4) so the gc expiry check always picks up either confirmed bit unset (entry gets skipped) or expiry re-check failure for re-inited conntrack objects. This change cannot be backported to releases before 5.19. Without commit 8a75a2c17410 ("netfilter: conntrack: remove unconfirmed list") |= IPS_CONFIRMED line cannot be moved without further changes. Cc: Razvan Cojocaru <rzvncj(a)gmail.com> Link: https://lore.kernel.org/netfilter-devel/20250627142758.25664-1-fw@strlen.de/ Link: https://lore.kernel.org/netfilter-devel/4239da15-83ff-4ca4-939d-faef283471b… Fixes: 1397af5bfd7d ("netfilter: conntrack: remove the percpu dying list") Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- include/net/netfilter/nf_conntrack.h | 15 +++++++++++++-- net/netfilter/nf_conntrack_core.c | 26 ++++++++++++++++++++------ 2 files changed, 33 insertions(+), 8 deletions(-) diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h index f2a2c2c69175..f991f6e523c2 100644 --- a/include/net/netfilter/nf_conntrack.h +++ b/include/net/netfilter/nf_conntrack.h @@ -306,8 +306,19 @@ static inline bool nf_ct_is_expired(const struct nf_conn *ct) /* use after obtaining a reference count */ static inline bool nf_ct_should_gc(const struct nf_conn *ct) { - return nf_ct_is_expired(ct) && nf_ct_is_confirmed(ct) && - !nf_ct_is_dying(ct); + if (!nf_ct_is_confirmed(ct)) + return false; + + /* load ct->timeout after is_confirmed() test. + * Pairs with __nf_conntrack_confirm() which: + * 1. Increases ct->timeout value + * 2. Inserts ct into rcu hlist + * 3. Sets the confirmed bit + * 4. Unlocks the hlist lock + */ + smp_acquire__after_ctrl_dep(); + + return nf_ct_is_expired(ct) && !nf_ct_is_dying(ct); } #define NF_CT_DAY (86400 * HZ) diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c index 34ad5975fbf3..0081c1a0d5e5 100644 --- a/net/netfilter/nf_conntrack_core.c +++ b/net/netfilter/nf_conntrack_core.c @@ -1075,6 +1075,12 @@ static int nf_ct_resolve_clash_harder(struct sk_buff *skb, u32 repl_idx) hlist_nulls_add_head_rcu(&loser_ct->tuplehash[IP_CT_DIR_REPLY].hnnode, &nf_conntrack_hash[repl_idx]); + /* confirmed bit must be set after hlist add, not before: + * loser_ct can still be visible to other cpu due to + * SLAB_TYPESAFE_BY_RCU. + */ + smp_mb__before_atomic(); + set_bit(IPS_CONFIRMED_BIT, &loser_ct->status); NF_CT_STAT_INC(net, clash_resolve); return NF_ACCEPT; @@ -1211,8 +1217,6 @@ __nf_conntrack_confirm(struct sk_buff *skb) * user context, else we insert an already 'dead' hash, blocking * further use of that particular connection -JM. */ - ct->status |= IPS_CONFIRMED; - if (unlikely(nf_ct_is_dying(ct))) { NF_CT_STAT_INC(net, insert_failed); goto dying; @@ -1244,7 +1248,7 @@ __nf_conntrack_confirm(struct sk_buff *skb) } } - /* Timer relative to confirmation time, not original + /* Timeout is relative to confirmation time, not original setting time, otherwise we'd get timer wrap in weird delay cases. */ ct->timeout += nfct_time_stamp; @@ -1252,11 +1256,21 @@ __nf_conntrack_confirm(struct sk_buff *skb) __nf_conntrack_insert_prepare(ct); /* Since the lookup is lockless, hash insertion must be done after - * starting the timer and setting the CONFIRMED bit. The RCU barriers - * guarantee that no other CPU can find the conntrack before the above - * stores are visible. + * setting ct->timeout. The RCU barriers guarantee that no other CPU + * can find the conntrack before the above stores are visible. */ __nf_conntrack_hash_insert(ct, hash, reply_hash); + + /* IPS_CONFIRMED unset means 'ct not (yet) in hash', conntrack lookups + * skip entries that lack this bit. This happens when a CPU is looking + * at a stale entry that is being recycled due to SLAB_TYPESAFE_BY_RCU + * or when another CPU encounters this entry right after the insertion + * but before the set-confirm-bit below. This bit must not be set until + * after __nf_conntrack_hash_insert(). + */ + smp_mb__before_atomic(); + set_bit(IPS_CONFIRMED_BIT, &ct->status); + nf_conntrack_double_unlock(hash, reply_hash); local_bh_enable(); -- 2.34.1

2 1

[openeuler:OLK-5.10 3399/3399] certs/system_keyring.c:42: warning: Function parameter or member 'dest_keyring' not described in 'restrict_link_by_builtin_trusted'
by kernel test robot 10 Dec '25

10 Dec '25

Hi Salvatore, First bad commit (maybe != root cause): tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: ea8b5fbcdf7f5ce2d966ae6aa4e95e2ebde6cb03 commit: 68ee705da160d123656dcbf9ebd449fb77b54bc0 [3399/3399] scripts: kernel-doc: Fix syntax error due to undeclared args variable config: x86_64-allnoconfig-bpf (https://download.01.org/0day-ci/archive/20251210/202512100037.0LOqY3GV-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251210/202512100037.0LOqY3GV-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512100037.0LOqY3GV-lkp@intel.com/ All warnings (new ones prefixed by >>): >> certs/system_keyring.c:42: warning: Function parameter or member 'dest_keyring' not described in 'restrict_link_by_builtin_trusted' >> certs/system_keyring.c:42: warning: Function parameter or member 'type' not described in 'restrict_link_by_builtin_trusted' >> certs/system_keyring.c:42: warning: Function parameter or member 'payload' not described in 'restrict_link_by_builtin_trusted' >> certs/system_keyring.c:42: warning: Function parameter or member 'restriction_key' not described in 'restrict_link_by_builtin_trusted' >> certs/system_keyring.c:61: warning: Function parameter or member 'dest_keyring' not described in 'restrict_link_by_builtin_and_secondary_trusted' >> certs/system_keyring.c:61: warning: Function parameter or member 'type' not described in 'restrict_link_by_builtin_and_secondary_trusted' >> certs/system_keyring.c:61: warning: Function parameter or member 'payload' not described in 'restrict_link_by_builtin_and_secondary_trusted' >> certs/system_keyring.c:61: warning: Function parameter or member 'restrict_key' not described in 'restrict_link_by_builtin_and_secondary_trusted' -- >> mm/filemap.c:823:14: warning: no previous prototype for '__add_to_page_cache_locked' [-Wmissing-prototypes] 823 | noinline int __add_to_page_cache_locked(struct page *page, | ^~~~~~~~~~~~~~~~~~~~~~~~~~ -- >> mm/truncate.c:543: warning: Function parameter or member 'mapping' not described in 'invalidate_mapping_pagevec' >> mm/truncate.c:543: warning: Function parameter or member 'start' not described in 'invalidate_mapping_pagevec' >> mm/truncate.c:543: warning: Function parameter or member 'end' not described in 'invalidate_mapping_pagevec' >> mm/truncate.c:543: warning: Function parameter or member 'nr_pagevec' not described in 'invalidate_mapping_pagevec' -- >> mm/oom_kill.c:316: warning: Function parameter or member 'task' not described in 'oom_next_task' >> mm/oom_kill.c:316: warning: Function parameter or member 'oc' not described in 'oom_next_task' >> mm/oom_kill.c:316: warning: Function parameter or member 'points' not described in 'oom_next_task' -- >> mm/page_vma_mapped.c:86: warning: Function parameter or member 'pvmw' not described in 'check_pte' -- >> mm/vmalloc.c:3666: warning: Function parameter or member 'pgoff' not described in 'remap_vmalloc_hugepage_range_partial' >> mm/vmalloc.c:3795: warning: Function parameter or member 'align' not described in 'pvm_determine_end_from_reverse' -- >> mm/page_alloc.c:3040:6: warning: no previous prototype for '__drain_all_pages' [-Wmissing-prototypes] 3040 | void __drain_all_pages(struct zone *zone, bool force_all_cpus) | ^~~~~~~~~~~~~~~~~ >> mm/page_alloc.c:3603:15: warning: no previous prototype for 'should_fail_alloc_page' [-Wmissing-prototypes] 3603 | noinline bool should_fail_alloc_page(gfp_t gfp_mask, unsigned int order) | ^~~~~~~~~~~~~~~~~~~~~~ >> mm/page_alloc.c:6754:20: warning: no previous prototype for 'memmap_init' [-Wmissing-prototypes] 6754 | void __init __weak memmap_init(void) | ^~~~~~~~~~~ >> mm/page_alloc.c:6792:23: warning: no previous prototype for 'arch_memmap_init' [-Wmissing-prototypes] 6792 | void __meminit __weak arch_memmap_init(unsigned long size, int nid, | ^~~~~~~~~~~~~~~~ >> mm/page_alloc.c:6910:6: warning: no previous prototype for '__zone_set_pageset_high_and_batch' [-Wmissing-prototypes] 6910 | void __zone_set_pageset_high_and_batch(struct zone *zone, unsigned long high, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- >> mm/khugepaged.c:102: warning: Function parameter or member 'nr_pte_mapped_thp' not described in 'mm_slot' >> mm/khugepaged.c:102: warning: Function parameter or member 'pte_mapped_thp' not described in 'mm_slot' >> mm/khugepaged.c:1453: warning: Function parameter or member 'mm' not described in 'collapse_pte_mapped_thp' >> mm/khugepaged.c:1453: warning: Function parameter or member 'addr' not described in 'collapse_pte_mapped_thp' >> mm/khugepaged.c:1691: warning: Function parameter or member 'mm' not described in 'collapse_file' >> mm/khugepaged.c:1691: warning: Function parameter or member 'file' not described in 'collapse_file' >> mm/khugepaged.c:1691: warning: Function parameter or member 'start' not described in 'collapse_file' >> mm/khugepaged.c:1691: warning: Function parameter or member 'hpage' not described in 'collapse_file' >> mm/khugepaged.c:1691: warning: Function parameter or member 'node' not described in 'collapse_file' >> mm/khugepaged.c:1691: warning: Function parameter or member 'reliable' not described in 'collapse_file' -- >> mm/early_ioremap.c:34:24: warning: no previous prototype for 'early_memremap_pgprot_adjust' [-Wmissing-prototypes] 34 | pgprot_t __init __weak early_memremap_pgprot_adjust(resource_size_t phys_addr, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- >> mm/kasan/init.c:232: warning: Function parameter or member 'shadow_start' not described in 'kasan_populate_early_shadow' >> mm/kasan/init.c:232: warning: Function parameter or member 'shadow_end' not described in 'kasan_populate_early_shadow' -- >> fs/open.c:887: warning: Excess function parameter 'opened' description in 'finish_open' >> fs/open.c:929: warning: Excess function parameter 'cred' description in 'vfs_open' .. vim +42 certs/system_keyring.c b56e5a17b6b9acd kernel/system_keyring.c David Howells 2013-08-30 31 a511e1af8b12f44 certs/system_keyring.c David Howells 2016-04-06 32 /** d3bfe84129f65e0 certs/system_keyring.c David Howells 2016-04-06 33 * restrict_link_to_builtin_trusted - Restrict keyring addition by built in CA a511e1af8b12f44 certs/system_keyring.c David Howells 2016-04-06 34 * a511e1af8b12f44 certs/system_keyring.c David Howells 2016-04-06 35 * Restrict the addition of keys into a keyring based on the key-to-be-added d3bfe84129f65e0 certs/system_keyring.c David Howells 2016-04-06 36 * being vouched for by a key in the built in system keyring. a511e1af8b12f44 certs/system_keyring.c David Howells 2016-04-06 37 */ aaf66c883813f00 certs/system_keyring.c Mat Martineau 2016-08-30 38 int restrict_link_by_builtin_trusted(struct key *dest_keyring, a511e1af8b12f44 certs/system_keyring.c David Howells 2016-04-06 39 const struct key_type *type, aaf66c883813f00 certs/system_keyring.c Mat Martineau 2016-08-30 40 const union key_payload *payload, aaf66c883813f00 certs/system_keyring.c Mat Martineau 2016-08-30 41 struct key *restriction_key) a511e1af8b12f44 certs/system_keyring.c David Howells 2016-04-06 @42 { aaf66c883813f00 certs/system_keyring.c Mat Martineau 2016-08-30 43 return restrict_link_by_signature(dest_keyring, type, payload, aaf66c883813f00 certs/system_keyring.c Mat Martineau 2016-08-30 44 builtin_trusted_keys); a511e1af8b12f44 certs/system_keyring.c David Howells 2016-04-06 45 } a511e1af8b12f44 certs/system_keyring.c David Howells 2016-04-06 46 d3bfe84129f65e0 certs/system_keyring.c David Howells 2016-04-06 47 #ifdef CONFIG_SECONDARY_TRUSTED_KEYRING d3bfe84129f65e0 certs/system_keyring.c David Howells 2016-04-06 48 /** d3bfe84129f65e0 certs/system_keyring.c David Howells 2016-04-06 49 * restrict_link_by_builtin_and_secondary_trusted - Restrict keyring d3bfe84129f65e0 certs/system_keyring.c David Howells 2016-04-06 50 * addition by both builtin and secondary keyrings d3bfe84129f65e0 certs/system_keyring.c David Howells 2016-04-06 51 * d3bfe84129f65e0 certs/system_keyring.c David Howells 2016-04-06 52 * Restrict the addition of keys into a keyring based on the key-to-be-added d3bfe84129f65e0 certs/system_keyring.c David Howells 2016-04-06 53 * being vouched for by a key in either the built-in or the secondary system d3bfe84129f65e0 certs/system_keyring.c David Howells 2016-04-06 54 * keyrings. d3bfe84129f65e0 certs/system_keyring.c David Howells 2016-04-06 55 */ d3bfe84129f65e0 certs/system_keyring.c David Howells 2016-04-06 56 int restrict_link_by_builtin_and_secondary_trusted( aaf66c883813f00 certs/system_keyring.c Mat Martineau 2016-08-30 57 struct key *dest_keyring, d3bfe84129f65e0 certs/system_keyring.c David Howells 2016-04-06 58 const struct key_type *type, aaf66c883813f00 certs/system_keyring.c Mat Martineau 2016-08-30 59 const union key_payload *payload, aaf66c883813f00 certs/system_keyring.c Mat Martineau 2016-08-30 60 struct key *restrict_key) d3bfe84129f65e0 certs/system_keyring.c David Howells 2016-04-06 @61 { d3bfe84129f65e0 certs/system_keyring.c David Howells 2016-04-06 62 /* If we have a secondary trusted keyring, then that contains a link d3bfe84129f65e0 certs/system_keyring.c David Howells 2016-04-06 63 * through to the builtin keyring and the search will follow that link. d3bfe84129f65e0 certs/system_keyring.c David Howells 2016-04-06 64 */ d3bfe84129f65e0 certs/system_keyring.c David Howells 2016-04-06 65 if (type == &key_type_keyring && aaf66c883813f00 certs/system_keyring.c Mat Martineau 2016-08-30 66 dest_keyring == secondary_trusted_keys && d3bfe84129f65e0 certs/system_keyring.c David Howells 2016-04-06 67 payload == &builtin_trusted_keys->payload) d3bfe84129f65e0 certs/system_keyring.c David Howells 2016-04-06 68 /* Allow the builtin keyring to be added to the secondary */ d3bfe84129f65e0 certs/system_keyring.c David Howells 2016-04-06 69 return 0; d3bfe84129f65e0 certs/system_keyring.c David Howells 2016-04-06 70 aaf66c883813f00 certs/system_keyring.c Mat Martineau 2016-08-30 71 return restrict_link_by_signature(dest_keyring, type, payload, aaf66c883813f00 certs/system_keyring.c Mat Martineau 2016-08-30 72 secondary_trusted_keys); d3bfe84129f65e0 certs/system_keyring.c David Howells 2016-04-06 73 } 2b6aa412ff23a02 certs/system_keyring.c Mat Martineau 2016-08-31 74 :::::: The code at line 42 was first introduced by commit :::::: a511e1af8b12f44c6e55786c463c9f093c214fb6 KEYS: Move the point of trust determination to __key_link() :::::: TO: David Howells <dhowells(a)redhat.com> :::::: CC: David Howells <dhowells(a)redhat.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3508/3508] include/linux/bitfield.h:165:17: error: call to '__bad_mask' declared with attribute error: bad bitfield mask
by kernel test robot 10 Dec '25

10 Dec '25

Hi Suzuki, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: f3072e528ba53a76e66a34613ecc7b86dc96816d commit: 9e76624e89d2d5210d25a33749d8989212945735 [3508/3508] [v8-28-43]arm64: RME: Allow checking SVE on VM instance config: arm64-randconfig-001-20251210 (https://download.01.org/0day-ci/archive/20251210/202512100623.1pjIPxzS-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251210/202512100623.1pjIPxzS-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512100623.1pjIPxzS-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from arch/arm64/include/asm/sysreg.h:1065, from arch/arm64/include/asm/percpu.h:13, from arch/arm64/include/asm/smp.h:28, from include/linux/smp.h:113, from include/linux/percpu.h:7, from include/linux/context_tracking_state.h:5, from include/linux/hardirq.h:5, from include/linux/kvm_host.h:7, from arch/arm64/kvm/rme.c:6: In function 'field_multiplier', inlined from 'u64_get_bits' at include/linux/bitfield.h:201:1, inlined from 'rme_has_feature' at arch/arm64/kvm/rme.c:38:11: >> include/linux/bitfield.h:165:17: error: call to '__bad_mask' declared with attribute error: bad bitfield mask 165 | __bad_mask(); | ^~~~~~~~~~~~ vim +/__bad_mask +165 include/linux/bitfield.h e2192de59e457ae Johannes Berg 2023-01-18 119 e2192de59e457ae Johannes Berg 2023-01-18 120 /** e2192de59e457ae Johannes Berg 2023-01-18 121 * FIELD_PREP_CONST() - prepare a constant bitfield element e2192de59e457ae Johannes Berg 2023-01-18 122 * @_mask: shifted mask defining the field's length and position e2192de59e457ae Johannes Berg 2023-01-18 123 * @_val: value to put in the field e2192de59e457ae Johannes Berg 2023-01-18 124 * e2192de59e457ae Johannes Berg 2023-01-18 125 * FIELD_PREP_CONST() masks and shifts up the value. The result should e2192de59e457ae Johannes Berg 2023-01-18 126 * be combined with other fields of the bitfield using logical OR. e2192de59e457ae Johannes Berg 2023-01-18 127 * e2192de59e457ae Johannes Berg 2023-01-18 128 * Unlike FIELD_PREP() this is a constant expression and can therefore e2192de59e457ae Johannes Berg 2023-01-18 129 * be used in initializers. Error checking is less comfortable for this e2192de59e457ae Johannes Berg 2023-01-18 130 * version, and non-constant masks cannot be used. e2192de59e457ae Johannes Berg 2023-01-18 131 */ e2192de59e457ae Johannes Berg 2023-01-18 132 #define FIELD_PREP_CONST(_mask, _val) \ e2192de59e457ae Johannes Berg 2023-01-18 133 ( \ e2192de59e457ae Johannes Berg 2023-01-18 134 /* mask must be non-zero */ \ e2192de59e457ae Johannes Berg 2023-01-18 135 BUILD_BUG_ON_ZERO((_mask) == 0) + \ e2192de59e457ae Johannes Berg 2023-01-18 136 /* check if value fits */ \ e2192de59e457ae Johannes Berg 2023-01-18 137 BUILD_BUG_ON_ZERO(~((_mask) >> __bf_shf(_mask)) & (_val)) + \ e2192de59e457ae Johannes Berg 2023-01-18 138 /* check if mask is contiguous */ \ e2192de59e457ae Johannes Berg 2023-01-18 139 __BF_CHECK_POW2((_mask) + (1ULL << __bf_shf(_mask))) + \ e2192de59e457ae Johannes Berg 2023-01-18 140 /* and create the value */ \ e2192de59e457ae Johannes Berg 2023-01-18 141 (((typeof(_mask))(_val) << __bf_shf(_mask)) & (_mask)) \ e2192de59e457ae Johannes Berg 2023-01-18 142 ) e2192de59e457ae Johannes Berg 2023-01-18 143 3e9b3112ec74f19 Jakub Kicinski 2016-08-31 144 /** 3e9b3112ec74f19 Jakub Kicinski 2016-08-31 145 * FIELD_GET() - extract a bitfield element 3e9b3112ec74f19 Jakub Kicinski 2016-08-31 146 * @_mask: shifted mask defining the field's length and position 7240767450d6d83 Masahiro Yamada 2017-10-03 147 * @_reg: value of entire bitfield 3e9b3112ec74f19 Jakub Kicinski 2016-08-31 148 * 3e9b3112ec74f19 Jakub Kicinski 2016-08-31 149 * FIELD_GET() extracts the field specified by @_mask from the 3e9b3112ec74f19 Jakub Kicinski 2016-08-31 150 * bitfield passed in as @_reg by masking and shifting it down. 3e9b3112ec74f19 Jakub Kicinski 2016-08-31 151 */ 3e9b3112ec74f19 Jakub Kicinski 2016-08-31 152 #define FIELD_GET(_mask, _reg) \ 3e9b3112ec74f19 Jakub Kicinski 2016-08-31 153 ({ \ 3e9b3112ec74f19 Jakub Kicinski 2016-08-31 154 __BF_FIELD_CHECK(_mask, _reg, 0U, "FIELD_GET: "); \ 3e9b3112ec74f19 Jakub Kicinski 2016-08-31 155 (typeof(_mask))(((_reg) & (_mask)) >> __bf_shf(_mask)); \ 3e9b3112ec74f19 Jakub Kicinski 2016-08-31 156 }) 3e9b3112ec74f19 Jakub Kicinski 2016-08-31 157 e7d4a95da86e0b0 Johannes Berg 2018-06-20 158 extern void __compiletime_error("value doesn't fit into mask") 00b0c9b82663ac4 Al Viro 2017-12-14 159 __field_overflow(void); 00b0c9b82663ac4 Al Viro 2017-12-14 160 extern void __compiletime_error("bad bitfield mask") 00b0c9b82663ac4 Al Viro 2017-12-14 161 __bad_mask(void); 00b0c9b82663ac4 Al Viro 2017-12-14 162 static __always_inline u64 field_multiplier(u64 field) 00b0c9b82663ac4 Al Viro 2017-12-14 163 { 00b0c9b82663ac4 Al Viro 2017-12-14 164 if ((field | (field - 1)) & ((field | (field - 1)) + 1)) 00b0c9b82663ac4 Al Viro 2017-12-14 @165 __bad_mask(); 00b0c9b82663ac4 Al Viro 2017-12-14 166 return field & -field; 00b0c9b82663ac4 Al Viro 2017-12-14 167 } 00b0c9b82663ac4 Al Viro 2017-12-14 168 static __always_inline u64 field_mask(u64 field) 00b0c9b82663ac4 Al Viro 2017-12-14 169 { 00b0c9b82663ac4 Al Viro 2017-12-14 170 return field / field_multiplier(field); 00b0c9b82663ac4 Al Viro 2017-12-14 171 } e31a50162feb352 Alex Elder 2020-03-12 172 #define field_max(field) ((typeof(field))field_mask(field)) 00b0c9b82663ac4 Al Viro 2017-12-14 173 #define ____MAKE_OP(type,base,to,from) \ 00b0c9b82663ac4 Al Viro 2017-12-14 174 static __always_inline __##type type##_encode_bits(base v, base field) \ 00b0c9b82663ac4 Al Viro 2017-12-14 175 { \ e7d4a95da86e0b0 Johannes Berg 2018-06-20 176 if (__builtin_constant_p(v) && (v & ~field_mask(field))) \ 00b0c9b82663ac4 Al Viro 2017-12-14 177 __field_overflow(); \ 00b0c9b82663ac4 Al Viro 2017-12-14 178 return to((v & field_mask(field)) * field_multiplier(field)); \ 00b0c9b82663ac4 Al Viro 2017-12-14 179 } \ 00b0c9b82663ac4 Al Viro 2017-12-14 180 static __always_inline __##type type##_replace_bits(__##type old, \ 00b0c9b82663ac4 Al Viro 2017-12-14 181 base val, base field) \ 00b0c9b82663ac4 Al Viro 2017-12-14 182 { \ 00b0c9b82663ac4 Al Viro 2017-12-14 183 return (old & ~to(field)) | type##_encode_bits(val, field); \ 00b0c9b82663ac4 Al Viro 2017-12-14 184 } \ 00b0c9b82663ac4 Al Viro 2017-12-14 185 static __always_inline void type##p_replace_bits(__##type *p, \ 00b0c9b82663ac4 Al Viro 2017-12-14 186 base val, base field) \ 00b0c9b82663ac4 Al Viro 2017-12-14 187 { \ 00b0c9b82663ac4 Al Viro 2017-12-14 188 *p = (*p & ~to(field)) | type##_encode_bits(val, field); \ 00b0c9b82663ac4 Al Viro 2017-12-14 189 } \ 00b0c9b82663ac4 Al Viro 2017-12-14 190 static __always_inline base type##_get_bits(__##type v, base field) \ 00b0c9b82663ac4 Al Viro 2017-12-14 191 { \ 00b0c9b82663ac4 Al Viro 2017-12-14 192 return (from(v) & field)/field_multiplier(field); \ 00b0c9b82663ac4 Al Viro 2017-12-14 193 } 00b0c9b82663ac4 Al Viro 2017-12-14 194 #define __MAKE_OP(size) \ 00b0c9b82663ac4 Al Viro 2017-12-14 195 ____MAKE_OP(le##size,u##size,cpu_to_le##size,le##size##_to_cpu) \ 00b0c9b82663ac4 Al Viro 2017-12-14 196 ____MAKE_OP(be##size,u##size,cpu_to_be##size,be##size##_to_cpu) \ 00b0c9b82663ac4 Al Viro 2017-12-14 197 ____MAKE_OP(u##size,u##size,,) 37a3862e1238262 Johannes Berg 2018-06-20 198 ____MAKE_OP(u8,u8,,) 00b0c9b82663ac4 Al Viro 2017-12-14 199 __MAKE_OP(16) 00b0c9b82663ac4 Al Viro 2017-12-14 200 __MAKE_OP(32) 00b0c9b82663ac4 Al Viro 2017-12-14 201 __MAKE_OP(64) 00b0c9b82663ac4 Al Viro 2017-12-14 202 #undef __MAKE_OP 00b0c9b82663ac4 Al Viro 2017-12-14 203 #undef ____MAKE_OP 00b0c9b82663ac4 Al Viro 2017-12-14 204 :::::: The code at line 165 was first introduced by commit :::::: 00b0c9b82663ac42e5a09f58ce960f81f29d64ee Add primitives for manipulating bitfields both in host- and fixed-endian. :::::: TO: Al Viro <viro(a)zeniv.linux.org.uk> :::::: CC: Al Viro <viro(a)zeniv.linux.org.uk> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 3398/3398] htmldocs: Warning: arch/x86/kernel/cpu/resctrl/monitor.c references a file that doesn't exist: Documentation/x86/resctrl.rst
by kernel test robot 10 Dec '25

10 Dec '25

Hi Fenghua, First bad commit (maybe != root cause): tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: ea8b5fbcdf7f5ce2d966ae6aa4e95e2ebde6cb03 commit: a6c0245e15d65203dbe3b21d47e8618b4444bf27 [3398/3398] x86/resctrl: Correct MBM total and local values reproduce: (https://download.01.org/0day-ci/archive/20251209/202512092256.qjUEQ2Ay-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512092256.qjUEQ2Ay-lkp@intel.com/ All warnings (new ones prefixed by >>): Warning: MAINTAINERS references a file that doesn't exist: Documentation/x86/amd_hsmp.rst Warning: MAINTAINERS references a file that doesn't exist: Documentation/devicetree/bindings/pinctrl/toshiba,tmpv7700-pinctrl.yaml Warning: MAINTAINERS references a file that doesn't exist: Documentation/devicetree/bindings/misc/hisilicon-hikey-usb.yaml Warning: arch/Kconfig references a file that doesn't exist: Documentation/unaligned-memory-access.txt Warning: arch/riscv/kvm/vcpu.c references a file that doesn't exist: Documentation/virtual/kvm/vcpu-requests.rst >> Warning: arch/x86/kernel/cpu/resctrl/monitor.c references a file that doesn't exist: Documentation/x86/resctrl.rst Warning: crypto/asymmetric_keys/pgp_preload.c references a file that doesn't exist: Documentation/security/keys-crypto.txt Warning: drivers/irqchip/Kconfig references a file that doesn't exist: Documentation/loongarch/irq-chip-model.rst Warning: drivers/net/ethernet/yunsilicon/xsc/common/xsc_ioctl.h references a file that doesn't exist: Documentation/ioctl/ioctl-number.txt Warning: openEuler/MAINTAINERS references a file that doesn't exist: Documentation/networking/hinic3.rst Warning: /sys/bus/iio/devices/iio:deviceX/in_accel_x_calibbias is defined 2 times: ./Documentation/ABI/testing/sysfs-bus-iio-icm42600:0 ./Documentation/ABI/testing/sysfs-bus-iio:394 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 3398/3398] htmldocs: Warning: openEuler/MAINTAINERS references a file that doesn't exist: Documentation/networking/hinic3.rst
by kernel test robot 10 Dec '25

10 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: ea8b5fbcdf7f5ce2d966ae6aa4e95e2ebde6cb03 commit: 0378ac5f333ca75e4fae5a8a8ed499ed374f3bdd [3398/3398] net/ethernet/huawei/hinic3: Add the CQM on which the RDMA depends reproduce: (https://download.01.org/0day-ci/archive/20251209/202512092215.R7vj8ToZ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512092215.R7vj8ToZ-lkp@intel.com/ All warnings (new ones prefixed by >>): Warning: arch/riscv/kvm/vcpu.c references a file that doesn't exist: Documentation/virtual/kvm/vcpu-requests.rst Warning: crypto/asymmetric_keys/pgp_preload.c references a file that doesn't exist: Documentation/security/keys-crypto.txt Warning: drivers/irqchip/Kconfig references a file that doesn't exist: Documentation/loongarch/irq-chip-model.rst Warning: drivers/net/ethernet/yunsilicon/xsc/common/xsc_ioctl.h references a file that doesn't exist: Documentation/ioctl/ioctl-number.txt Warning: openEuler/MAINTAINERS references a file that doesn't exist: Documentation/admin-guide/perf/hisi-pcie-pmu.rst >> Warning: openEuler/MAINTAINERS references a file that doesn't exist: Documentation/networking/hinic3.rst Warning: /sys/bus/iio/devices/iio:deviceX/in_accel_x_calibbias is defined 2 times: ./Documentation/ABI/testing/sysfs-bus-iio-icm42600:0 ./Documentation/ABI/testing/sysfs-bus-iio:394 Warning: /sys/bus/iio/devices/iio:deviceX/in_accel_y_calibbias is defined 2 times: ./Documentation/ABI/testing/sysfs-bus-iio-icm42600:1 ./Documentation/ABI/testing/sysfs-bus-iio:395 Warning: /sys/bus/iio/devices/iio:deviceX/in_accel_z_calibbias is defined 2 times: ./Documentation/ABI/testing/sysfs-bus-iio-icm42600:2 ./Documentation/ABI/testing/sysfs-bus-iio:396 Warning: /sys/bus/iio/devices/iio:deviceX/in_anglvel_x_calibbias is defined 2 times: ./Documentation/ABI/testing/sysfs-bus-iio-icm42600:3 ./Documentation/ABI/testing/sysfs-bus-iio:397 Warning: /sys/bus/iio/devices/iio:deviceX/in_anglvel_y_calibbias is defined 2 times: ./Documentation/ABI/testing/sysfs-bus-iio-icm42600:4 ./Documentation/ABI/testing/sysfs-bus-iio:398 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 3398/3398] htmldocs: Warning: drivers/net/ethernet/yunsilicon/xsc/common/xsc_ioctl.h references a file that doesn't exist: Documentation/ioctl/ioctl-number.txt
by kernel test robot 10 Dec '25

10 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: ea8b5fbcdf7f5ce2d966ae6aa4e95e2ebde6cb03 commit: d48b7d951d22f7f97d68ae7b580769827683d404 [3398/3398] drivers: initial support for xsc drivers from Yunsilicon Technology reproduce: (https://download.01.org/0day-ci/archive/20251209/202512092129.rSRtn0GX-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512092129.rSRtn0GX-lkp@intel.com/ All warnings (new ones prefixed by >>): Warning: MAINTAINERS references a file that doesn't exist: Documentation/admin-guide/perf/hisi-pcie-pmu.rst Warning: arch/Kconfig references a file that doesn't exist: Documentation/unaligned-memory-access.txt Warning: arch/riscv/kvm/vcpu.c references a file that doesn't exist: Documentation/virtual/kvm/vcpu-requests.rst Warning: crypto/asymmetric_keys/pgp_preload.c references a file that doesn't exist: Documentation/security/keys-crypto.txt Warning: drivers/irqchip/Kconfig references a file that doesn't exist: Documentation/loongarch/irq-chip-model.rst >> Warning: drivers/net/ethernet/yunsilicon/xsc/common/xsc_ioctl.h references a file that doesn't exist: Documentation/ioctl/ioctl-number.txt Warning: openEuler/MAINTAINERS references a file that doesn't exist: Documentation/admin-guide/perf/hisi-pcie-pmu.rst Warning: /sys/bus/iio/devices/iio:deviceX/in_accel_x_calibbias is defined 2 times: ./Documentation/ABI/testing/sysfs-bus-iio-icm42600:0 ./Documentation/ABI/testing/sysfs-bus-iio:394 Warning: /sys/bus/iio/devices/iio:deviceX/in_accel_y_calibbias is defined 2 times: ./Documentation/ABI/testing/sysfs-bus-iio-icm42600:1 ./Documentation/ABI/testing/sysfs-bus-iio:395 Warning: /sys/bus/iio/devices/iio:deviceX/in_accel_z_calibbias is defined 2 times: ./Documentation/ABI/testing/sysfs-bus-iio-icm42600:2 ./Documentation/ABI/testing/sysfs-bus-iio:396 Warning: /sys/bus/iio/devices/iio:deviceX/in_anglvel_x_calibbias is defined 2 times: ./Documentation/ABI/testing/sysfs-bus-iio-icm42600:3 ./Documentation/ABI/testing/sysfs-bus-iio:397 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 3398/3398] htmldocs: Warning: The Sphinx 'sphinx_rtd_theme' HTML theme was not found. Make sure you have the theme installed to produce pretty HTML output. Falling back to the default theme.
by kernel test robot 10 Dec '25

10 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: ea8b5fbcdf7f5ce2d966ae6aa4e95e2ebde6cb03 commit: 9ecc6f98e74d5553122ee564caa72dd2a1abf9ff [3398/3398] docs: Fix the docs build with Sphinx 6.0 reproduce: (https://download.01.org/0day-ci/archive/20251209/202512092104.D3gEhdzh-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512092104.D3gEhdzh-lkp@intel.com/ All warnings (new ones prefixed by >>): Warning: /sys/class/leds/<led>/repeat is defined 2 times: ./Documentation/ABI/testing/sysfs-class-led-trigger-pattern:28 ./Documentation/ABI/testing/sysfs-class-led-driver-el15203000:0 Warning: /sys/kernel/iommu_groups/reserved_regions is defined 2 times: ./Documentation/ABI/testing/sysfs-kernel-iommu_groups:15 ./Documentation/ABI/testing/sysfs-kernel-iommu_groups:27 WARNING: The kernel documentation build process support for Sphinx v3.0 and above is brand new. Be prepared for possible issues in the generated output. >> Warning: The Sphinx 'sphinx_rtd_theme' HTML theme was not found. Make sure you have the theme installed to produce pretty HTML output. Falling back to the default theme. -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 3398/3398] htmldocs: Warning: drivers/irqchip/Kconfig references a file that doesn't exist: Documentation/loongarch/irq-chip-model.rst
by kernel test robot 10 Dec '25

10 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: ea8b5fbcdf7f5ce2d966ae6aa4e95e2ebde6cb03 commit: 8dbec732f16ae6510354065536da591114ec83ab [3398/3398] irqchip: Add LoongArch CPU interrupt controller support reproduce: (https://download.01.org/0day-ci/archive/20251209/202512092124.8pmDXxxf-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512092124.8pmDXxxf-lkp@intel.com/ All warnings (new ones prefixed by >>): Warning: MAINTAINERS references a file that doesn't exist: Documentation/devicetree/bindings/misc/hisilicon-hikey-usb.yaml Warning: MAINTAINERS references a file that doesn't exist: Documentation/admin-guide/perf/hisi-pcie-pmu.rst Warning: arch/Kconfig references a file that doesn't exist: Documentation/unaligned-memory-access.txt Warning: arch/riscv/kvm/vcpu.c references a file that doesn't exist: Documentation/virtual/kvm/vcpu-requests.rst Warning: crypto/asymmetric_keys/pgp_preload.c references a file that doesn't exist: Documentation/security/keys-crypto.txt >> Warning: drivers/irqchip/Kconfig references a file that doesn't exist: Documentation/loongarch/irq-chip-model.rst Warning: /sys/bus/iio/devices/iio:deviceX/in_accel_x_calibbias is defined 2 times: ./Documentation/ABI/testing/sysfs-bus-iio-icm42600:0 ./Documentation/ABI/testing/sysfs-bus-iio:394 Warning: /sys/bus/iio/devices/iio:deviceX/in_accel_y_calibbias is defined 2 times: ./Documentation/ABI/testing/sysfs-bus-iio-icm42600:1 ./Documentation/ABI/testing/sysfs-bus-iio:395 Warning: /sys/bus/iio/devices/iio:deviceX/in_accel_z_calibbias is defined 2 times: ./Documentation/ABI/testing/sysfs-bus-iio-icm42600:2 ./Documentation/ABI/testing/sysfs-bus-iio:396 Warning: /sys/bus/iio/devices/iio:deviceX/in_anglvel_x_calibbias is defined 2 times: ./Documentation/ABI/testing/sysfs-bus-iio-icm42600:3 ./Documentation/ABI/testing/sysfs-bus-iio:397 Warning: /sys/bus/iio/devices/iio:deviceX/in_anglvel_y_calibbias is defined 2 times: ./Documentation/ABI/testing/sysfs-bus-iio-icm42600:4 ./Documentation/ABI/testing/sysfs-bus-iio:398 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 3398/3398] htmldocs: Warning: MAINTAINERS references a file that doesn't exist: Documentation/x86/amd_hsmp.rst
by kernel test robot 10 Dec '25

10 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: ea8b5fbcdf7f5ce2d966ae6aa4e95e2ebde6cb03 commit: 2970038b4fbf5aee2a666769d676f01dc74fe7c9 [3398/3398] platform/x86: Add AMD system management interface reproduce: (https://download.01.org/0day-ci/archive/20251209/202512092005.eZ34Xp2b-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512092005.eZ34Xp2b-lkp@intel.com/ All warnings (new ones prefixed by >>): Warning: Documentation/arm/booting.rst references a file that doesn't exist: Documentation/devicetree/booting-without-of.rst Warning: Documentation/devicetree/bindings/regulator/rohm,bd9576-regulator.yaml references a file that doesn't exist: Documentation/devicetree/bindings/mfd/rohm,bd9576-pmic.yaml Warning: Documentation/translations/zh_CN/arm/Booting references a file that doesn't exist: Documentation/devicetree/booting-without-of.rst >> Warning: MAINTAINERS references a file that doesn't exist: Documentation/x86/amd_hsmp.rst Warning: MAINTAINERS references a file that doesn't exist: Documentation/devicetree/bindings/pinctrl/toshiba,tmpv7700-pinctrl.yaml Warning: MAINTAINERS references a file that doesn't exist: Documentation/devicetree/bindings/misc/hisilicon-hikey-usb.yaml Warning: MAINTAINERS references a file that doesn't exist: Documentation/admin-guide/perf/hisi-pcie-pmu.rst Warning: arch/Kconfig references a file that doesn't exist: Documentation/unaligned-memory-access.txt Warning: arch/riscv/kvm/vcpu.c references a file that doesn't exist: Documentation/virtual/kvm/vcpu-requests.rst -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 3399/3399] versioncheck: ./drivers/gpu/drm/inspur/inspur_drm_de.c: 513: need linux/version.h
by kernel test robot 09 Dec '25

09 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: ea8b5fbcdf7f5ce2d966ae6aa4e95e2ebde6cb03 commit: b9d65551a3adfa87a7c5d33391187ee60a1b501d [3399/3399] drm: add inspur drm driver support reproduce: (https://download.01.org/0day-ci/archive/20251209/202512091544.uZcPctXl-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512091544.uZcPctXl-lkp@intel.com/ versioncheck warnings: (new ones prefixed by >>) INFO PATH=/opt/cross/rustc-1.58.0-bindgen-0.56.0/cargo/bin:/opt/cross/clang/bin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin /usr/bin/timeout -k 100 3h /usr/bin/make KCFLAGS= -fno-crash-diagnostics -Wno-error=return-type -Wreturn-type -funsigned-char -Wundef W=1 --keep-going LLVM=1 -j32 ARCH=x86_64 versioncheck find ./* \( -name SCCS -o -name BitKeeper -o -name .svn -o -name CVS -o -name .pc -o -name .hg -o -name .git \) -prune -o \ -name '*.[hcS]' -type f -print | sort \ | xargs perl -w ./scripts/checkversion.pl ./arch/csky/include/asm/atomic.h: 6 linux/version.h not needed. ./arch/csky/include/asm/io.h: 9 linux/version.h not needed. ./arch/csky/include/asm/thread_info.h: 9 linux/version.h not needed. ./arch/csky/include/asm/uaccess.h: 15 linux/version.h not needed. ./arch/csky/kernel/process.c: 5 linux/version.h not needed. ./arch/csky/mm/dma-mapping.c: 12 linux/version.h not needed. ./arch/csky/mm/fault.c: 16 linux/version.h not needed. ./arch/s390/include/asm/setup.h: 183: need linux/version.h ./arch/um/drivers/vector_kern.c: 11 linux/version.h not needed. ./drivers/block/rsxx/rsxx_priv.h: 14 linux/version.h not needed. ./drivers/char/ipmi/ipmi_si_ls2k500.c: 19 linux/version.h not needed. ./drivers/crypto/cavium/cpt/cptpf_main.c: 13 linux/version.h not needed. ./drivers/crypto/cavium/zip/common.h: 59 linux/version.h not needed. ./drivers/crypto/ccree/cc_driver.h: 26 linux/version.h not needed. ./drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c: 62 linux/version.h not needed. ./drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c: 28 linux/version.h not needed. ./drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c: 26 linux/version.h not needed. >> ./drivers/gpu/drm/inspur/inspur_drm_de.c: 513: need linux/version.h >> ./drivers/gpu/drm/inspur/inspur_drm_drv.c: 456: need linux/version.h ./drivers/gpu/drm/pl111/pl111_display.c: 14 linux/version.h not needed. ./drivers/gpu/drm/pl111/pl111_drv.c: 47 linux/version.h not needed. ./drivers/gpu/drm/tve200/tve200_display.c: 14 linux/version.h not needed. ./drivers/gpu/drm/tve200/tve200_drv.c: 38 linux/version.h not needed. ./drivers/hv/hv.c: 16 linux/version.h not needed. ./drivers/i2c/busses/i2c-brcmstb.c: 25 linux/version.h not needed. ./drivers/i2c/busses/i2c-xgene-slimpro.c: 22 linux/version.h not needed. ./drivers/media/pci/cx25821/cx25821.h: 31 linux/version.h not needed. ./drivers/media/platform/s3c-camif/camif-core.c: 26 linux/version.h not needed. ./drivers/media/platform/sti/c8sectpfe/c8sectpfe-common.h: 16 linux/version.h not needed. ./drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c: 31 linux/version.h not needed. ./drivers/media/platform/sti/c8sectpfe/c8sectpfe-dvb.c: 14 linux/version.h not needed. ./drivers/media/usb/uvc/uvc_driver.c: 18 linux/version.h not needed. ./drivers/net/ethernet/3snic/sssnic/include/kernel/sss_linux_kernel.h: 12 linux/version.h not needed. ./drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c: 21 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/edma_drv/bma_include.h: 32 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.c: 17 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/kbox_drv/kbox_include.h: 20 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/kbox_drv/kbox_main.c: 22 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/kbox_drv/kbox_mce.c: 16 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c: 16 linux/version.h not needed. ./drivers/net/ethernet/huawei/hinic/ossl_knl.h: 22 linux/version.h not needed. ./drivers/net/ethernet/huawei/hinic3/ossl_knl_linux.h: 12 linux/version.h not needed. ./drivers/net/ethernet/nebula-matrix/m1600/common.h: 12 linux/version.h not needed. ./drivers/net/ethernet/nebula-matrix/m1600/txrx.c: 9 linux/version.h not needed. ./drivers/net/ethernet/qlogic/qede/qede.h: 10 linux/version.h not needed. ./drivers/net/ethernet/qlogic/qede/qede_ethtool.c: 7 linux/version.h not needed. ./drivers/net/ethernet/qlogic/qede/qede_main.c: 10 linux/version.h not needed. ./drivers/net/usb/lan78xx.c: 5 linux/version.h not needed. ./drivers/net/wireless/rsi/rsi_91x_ps.c: 19 linux/version.h not needed. ./drivers/scsi/cxgbi/libcxgbi.h: 27 linux/version.h not needed. ./drivers/scsi/huawei/hifc/hifc_knl_adp.h: 23 linux/version.h not needed. ./drivers/scsi/qedf/qedf.h: 15 linux/version.h not needed. ./drivers/scsi/qedf/qedf_dbg.h: 13 linux/version.h not needed. ./drivers/scsi/qedi/qedi_dbg.h: 14 linux/version.h not needed. ./drivers/scsi/sssraid/sssraid_fw.c: 6 linux/version.h not needed. ./drivers/scsi/sssraid/sssraid_os.c: 6 linux/version.h not needed. ./drivers/soc/tegra/powergate-bpmp.c: 10 linux/version.h not needed. ./drivers/staging/media/atomisp/include/linux/atomisp.h: 23 linux/version.h not needed. ./drivers/staging/rtl8723bs/include/drv_types.h: 17 linux/version.h not needed. ./drivers/staging/rtl8723bs/include/ioctl_cfg80211.h: 10 linux/version.h not needed. ./drivers/watchdog/ziirave_wdt.c: 21 linux/version.h not needed. ./fs/eulerfs/euler.h: 20 linux/version.h not needed. ./fs/eulerfs/euler_common.h: 25 linux/version.h not needed. ./fs/proc/etmem_scan.c: 13 linux/version.h not needed. ./include/linux/qed/qed_ll2_if.h: 15 linux/version.h not needed. ./kernel/bpf/syscall.c: 20 linux/version.h not needed. ./samples/bpf/sampleip_kern.c: 7 linux/version.h not needed. ./samples/bpf/trace_event_kern.c: 8 linux/version.h not needed. ./sound/soc/codecs/cs35l35.c: 12 linux/version.h not needed. ./sound/soc/codecs/cs42l42.c: 14 linux/version.h not needed. ./tools/lib/bpf/libbpf_sched.h: 19 linux/version.h not needed. ./tools/perf/include/bpf/bpf.h: 70: need linux/version.h ./tools/perf/tests/bpf-script-example.c: 49: need linux/version.h ./tools/perf/tests/bpf-script-test-kbuild.c: 21: need linux/version.h ./tools/perf/tests/bpf-script-test-prologue.c: 47: need linux/version.h ./tools/perf/tests/bpf-script-test-relocation.c: 51: need linux/version.h ./tools/testing/selftests/bpf/progs/test_map_lock.c: 4 linux/version.h not needed. ./tools/testing/selftests/bpf/progs/test_send_signal_kern.c: 4 linux/version.h not needed. ./tools/testing/selftests/bpf/progs/test_spin_lock.c: 4 linux/version.h not needed. ./tools/testing/selftests/bpf/progs/test_tcp_estats.c: 37 linux/version.h not needed. ./tools/testing/selftests/wireguard/qemu/init.c: 25 linux/version.h not needed. -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 3398/3398] versioncheck: ./drivers/net/ethernet/nebula-matrix/m1600/common.h: 12 linux/version.h not needed.
by kernel test robot 09 Dec '25

09 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: ea8b5fbcdf7f5ce2d966ae6aa4e95e2ebde6cb03 commit: 01e6e2075c432fde7fb5a66202b41bbd469de620 [3398/3398] Net: m1600: Add m1600-driver for nebula-matrix m1600 series smart NIC. reproduce: (https://download.01.org/0day-ci/archive/20251209/202512091533.OSoO5rbE-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512091533.OSoO5rbE-lkp@intel.com/ versioncheck warnings: (new ones prefixed by >>) INFO PATH=/opt/cross/rustc-1.58.0-bindgen-0.56.0/cargo/bin:/opt/cross/clang/bin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin /usr/bin/timeout -k 100 3h /usr/bin/make KCFLAGS= -fno-crash-diagnostics -Wno-error=return-type -Wreturn-type -funsigned-char -Wundef W=1 --keep-going LLVM=1 -j32 ARCH=x86_64 versioncheck find ./* \( -name SCCS -o -name BitKeeper -o -name .svn -o -name CVS -o -name .pc -o -name .hg -o -name .git \) -prune -o \ -name '*.[hcS]' -type f -print | sort \ | xargs perl -w ./scripts/checkversion.pl ./arch/csky/include/asm/atomic.h: 6 linux/version.h not needed. ./arch/csky/include/asm/io.h: 9 linux/version.h not needed. ./arch/csky/include/asm/thread_info.h: 9 linux/version.h not needed. ./arch/csky/include/asm/uaccess.h: 15 linux/version.h not needed. ./arch/csky/kernel/process.c: 5 linux/version.h not needed. ./arch/csky/mm/dma-mapping.c: 12 linux/version.h not needed. ./arch/csky/mm/fault.c: 16 linux/version.h not needed. ./arch/s390/include/asm/setup.h: 183: need linux/version.h ./arch/um/drivers/vector_kern.c: 11 linux/version.h not needed. ./drivers/block/rsxx/rsxx_priv.h: 14 linux/version.h not needed. ./drivers/crypto/cavium/cpt/cptpf_main.c: 13 linux/version.h not needed. ./drivers/crypto/cavium/zip/common.h: 59 linux/version.h not needed. ./drivers/crypto/ccree/cc_driver.h: 26 linux/version.h not needed. ./drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c: 62 linux/version.h not needed. ./drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_helpers.c: 28 linux/version.h not needed. ./drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c: 26 linux/version.h not needed. ./drivers/gpu/drm/pl111/pl111_display.c: 14 linux/version.h not needed. ./drivers/gpu/drm/pl111/pl111_drv.c: 47 linux/version.h not needed. ./drivers/gpu/drm/tve200/tve200_display.c: 14 linux/version.h not needed. ./drivers/gpu/drm/tve200/tve200_drv.c: 38 linux/version.h not needed. ./drivers/hv/hv.c: 16 linux/version.h not needed. ./drivers/i2c/busses/i2c-brcmstb.c: 25 linux/version.h not needed. ./drivers/i2c/busses/i2c-xgene-slimpro.c: 22 linux/version.h not needed. ./drivers/media/pci/cx25821/cx25821.h: 31 linux/version.h not needed. ./drivers/media/platform/s3c-camif/camif-core.c: 26 linux/version.h not needed. ./drivers/media/platform/sti/c8sectpfe/c8sectpfe-common.h: 16 linux/version.h not needed. ./drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c: 31 linux/version.h not needed. ./drivers/media/platform/sti/c8sectpfe/c8sectpfe-dvb.c: 14 linux/version.h not needed. ./drivers/media/usb/uvc/uvc_driver.c: 18 linux/version.h not needed. ./drivers/net/ethernet/broadcom/genet/bcmgenet_wol.c: 21 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/edma_drv/bma_include.h: 32 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.c: 17 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/kbox_drv/kbox_include.h: 20 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/kbox_drv/kbox_main.c: 22 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/kbox_drv/kbox_mce.c: 16 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c: 16 linux/version.h not needed. ./drivers/net/ethernet/huawei/hinic/ossl_knl.h: 22 linux/version.h not needed. >> ./drivers/net/ethernet/nebula-matrix/m1600/common.h: 12 linux/version.h not needed. ./drivers/net/ethernet/nebula-matrix/m1600/txrx.c: 9 linux/version.h not needed. ./drivers/net/ethernet/qlogic/qede/qede.h: 10 linux/version.h not needed. ./drivers/net/ethernet/qlogic/qede/qede_ethtool.c: 7 linux/version.h not needed. ./drivers/net/ethernet/qlogic/qede/qede_main.c: 10 linux/version.h not needed. ./drivers/net/usb/lan78xx.c: 5 linux/version.h not needed. ./drivers/net/wireless/rsi/rsi_91x_ps.c: 19 linux/version.h not needed. ./drivers/scsi/cxgbi/libcxgbi.h: 27 linux/version.h not needed. ./drivers/scsi/huawei/hifc/hifc_knl_adp.h: 23 linux/version.h not needed. ./drivers/scsi/qedf/qedf.h: 15 linux/version.h not needed. ./drivers/scsi/qedf/qedf_dbg.h: 13 linux/version.h not needed. ./drivers/scsi/qedi/qedi_dbg.h: 14 linux/version.h not needed. ./drivers/scsi/sssraid/sssraid_fw.c: 6 linux/version.h not needed. ./drivers/scsi/sssraid/sssraid_os.c: 6 linux/version.h not needed. ./drivers/soc/tegra/powergate-bpmp.c: 10 linux/version.h not needed. ./drivers/staging/media/atomisp/include/linux/atomisp.h: 23 linux/version.h not needed. ./drivers/staging/rtl8723bs/include/drv_types.h: 17 linux/version.h not needed. ./drivers/staging/rtl8723bs/include/ioctl_cfg80211.h: 10 linux/version.h not needed. ./drivers/watchdog/ziirave_wdt.c: 21 linux/version.h not needed. ./fs/eulerfs/euler.h: 20 linux/version.h not needed. ./fs/eulerfs/euler_common.h: 25 linux/version.h not needed. ./fs/proc/etmem_scan.c: 13 linux/version.h not needed. ./include/linux/qed/qed_ll2_if.h: 15 linux/version.h not needed. ./kernel/bpf/syscall.c: 20 linux/version.h not needed. ./samples/bpf/sampleip_kern.c: 7 linux/version.h not needed. ./samples/bpf/trace_event_kern.c: 8 linux/version.h not needed. ./sound/soc/codecs/cs35l35.c: 12 linux/version.h not needed. ./sound/soc/codecs/cs42l42.c: 14 linux/version.h not needed. ./tools/lib/bpf/libbpf_sched.h: 19 linux/version.h not needed. ./tools/perf/include/bpf/bpf.h: 70: need linux/version.h ./tools/perf/tests/bpf-script-example.c: 49: need linux/version.h ./tools/perf/tests/bpf-script-test-kbuild.c: 21: need linux/version.h ./tools/perf/tests/bpf-script-test-prologue.c: 47: need linux/version.h ./tools/perf/tests/bpf-script-test-relocation.c: 51: need linux/version.h ./tools/testing/selftests/bpf/progs/test_map_lock.c: 4 linux/version.h not needed. ./tools/testing/selftests/bpf/progs/test_send_signal_kern.c: 4 linux/version.h not needed. ./tools/testing/selftests/bpf/progs/test_spin_lock.c: 4 linux/version.h not needed. ./tools/testing/selftests/bpf/progs/test_tcp_estats.c: 37 linux/version.h not needed. ./tools/testing/selftests/wireguard/qemu/init.c: 25 linux/version.h not needed. -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] start_kernel: Add __no_stack_protector function attribute
by Lin Yujun 09 Dec '25

09 Dec '25

From: "ndesaulniers(a)google.com" <ndesaulniers(a)google.com> mainline inclusion from mainline-v6.5-rc1 commit 514ca14ed5444b911de59ed3381dfd195d99fe4b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID0RFA CVE: CVE-2023-53491 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Back during the discussion of commit a9a3ed1eff36 ("x86: Fix early boot crash on gcc-10, third try") we discussed the need for a function attribute to control the omission of stack protectors on a per-function basis; at the time Clang had support for no_stack_protector but GCC did not. This was fixed in gcc-11. Now that the function attribute is available, let's start using it. Callers of boot_init_stack_canary need to use this function attribute unless they're compiled with -fno-stack-protector, otherwise the canary stored in the stack slot of the caller will differ upon the call to boot_init_stack_canary. This will lead to a call to __stack_chk_fail() then panic. Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94722 Link: https://lore.kernel.org/all/20200316130414.GC12561@hirez.programming.kicks-… Tested-by: Nathan Chancellor <nathan(a)kernel.org> Acked-by: Michael Ellerman <mpe(a)ellerman.id.au> (powerpc) Acked-by: Miguel Ojeda <ojeda(a)kernel.org> Acked-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Signed-off-by: Nick Desaulniers <ndesaulniers(a)google.com> Link: https://lore.kernel.org/r/20230412-no_stackp-v2-1-116f9fe4bbe7@google.com Signed-off-by: Josh Poimboeuf <jpoimboe(a)kernel.org> Signed-off-by: ndesaulniers(a)google.com <ndesaulniers(a)google.com> Conflicts: arch/powerpc/kernel/smp.c include/linux/compiler_attributes.h init/main.c [fix context conflicts] Signed-off-by: Lin Yujun <linyujun809(a)h-partners.com> --- arch/powerpc/kernel/smp.c | 1 + include/linux/compiler_attributes.h | 12 ++++++++++++ init/main.c | 3 ++- 3 files changed, 15 insertions(+), 1 deletion(-) diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c index b12e4437bf0a..f3fea3928efc 100644 --- a/arch/powerpc/kernel/smp.c +++ b/arch/powerpc/kernel/smp.c @@ -1467,10 +1467,11 @@ static void add_cpu_to_masks(int cpu) free_cpumask_var(mask); } /* Activate a secondary processor. */ +__no_stack_protector void start_secondary(void *unused) { unsigned int cpu = raw_smp_processor_id(); mmgrab(&init_mm); diff --git a/include/linux/compiler_attributes.h b/include/linux/compiler_attributes.h index 08eb06301791..6f495fca9d79 100644 --- a/include/linux/compiler_attributes.h +++ b/include/linux/compiler_attributes.h @@ -249,10 +249,22 @@ * clang: https://clang.llvm.org/docs/AttributeReference.html#noreturn * clang: https://clang.llvm.org/docs/AttributeReference.html#id1 */ #define __noreturn __attribute__((__noreturn__)) +/* + * Optional: only supported since GCC >= 11.1, clang >= 7.0. + * + * gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Function-Attributes.html#index-no… + * clang: https://clang.llvm.org/docs/AttributeReference.html#no-stack-protector-safe… + */ +#if __has_attribute(__no_stack_protector__) +# define __no_stack_protector __attribute__((__no_stack_protector__)) +#else +# define __no_stack_protector +#endif + /* * gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Type-Attributes.html#index-packed… * clang: https://gcc.gnu.org/onlinedocs/gcc/Common-Variable-Attributes.html#index-pa… */ #define __packed __attribute__((__packed__)) diff --git a/init/main.c b/init/main.c index 2b466bd04110..5d73bd096bd0 100644 --- a/init/main.c +++ b/init/main.c @@ -872,11 +872,12 @@ early_param("randomize_kstack_offset", early_randomize_kstack_offset); void __init __weak arch_call_rest_init(void) { rest_init(); } -asmlinkage __visible void __init __no_sanitize_address start_kernel(void) +asmlinkage __visible __init __no_sanitize_address __noreturn __no_stack_protector +void start_kernel(void) { char *command_line; char *after_dashes; set_task_stack_end_magic(&init_task); -- 2.34.1

2 1

[PATCH OLK-6.6 00/14] Fix incorrect use of cpuhp_remove_multi_state parameter
by Yushan Wang 09 Dec '25

09 Dec '25

driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IDBQ74 ---------------------------------------------------------------------- Yifan Wu (3): soc_cache: Fix incorrect use of cpuhp_remove_multi_state parameter soc_cache: Fix error code returning from hisi_soc_l3c_do_lock soc_cache: Fix component removal order to avoid race condition Yushan Wang (10): soc cache: cleanup: replace dynamically allocated param with local variable soc cache: cleanup: fix memory leakage on error path soc cache: cleanup: move judgement of soc cache dev into lock protection soc cache: cleanup: avoid tag addr from interfering range validation soc cache: cleanup: Change type of mnt_type soc cache: cleanup: Remove the redundant check of vm_pgoff soc cache: Check address while walking pages soc cache: fix walk page parameter and drop incorrect check soc cache: Drop redundant vm_pgoff soc cache: Don't poll before removing all locks .../soc/hisilicon/hisi_soc_cache_framework.c | 65 ++++++++----------- drivers/soc/hisilicon/hisi_soc_l3c.c | 13 ++-- 2 files changed, 31 insertions(+), 47 deletions(-) -- 2.33.0

2 15

[PATCH 00/14] Fix incorrect use of cpuhp_remove_multi_state parameter
by Yushan Wang 09 Dec '25

09 Dec '25

driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IDBQ74 ---------------------------------------------------------------------- Yifan Wu (3): soc_cache: Fix incorrect use of cpuhp_remove_multi_state parameter soc_cache: Fix error code returning from hisi_soc_l3c_do_lock soc_cache: Fix component removal order to avoid race condition Yushan Wang (10): soc cache: cleanup: replace dynamically allocated param with local variable soc cache: cleanup: fix memory leakage on error path soc cache: cleanup: move judgement of soc cache dev into lock protection soc cache: cleanup: avoid tag addr from interfering range validation soc cache: cleanup: Change type of mnt_type soc cache: cleanup: Remove the redundant check of vm_pgoff soc cache: Check address while walking pages soc cache: fix walk page parameter and drop incorrect check soc cache: Drop redundant vm_pgoff soc cache: Don't poll before removing all locks .../soc/hisilicon/hisi_soc_cache_framework.c | 65 ++++++++----------- drivers/soc/hisilicon/hisi_soc_l3c.c | 13 ++-- 2 files changed, 31 insertions(+), 47 deletions(-) -- 2.33.0

1 14

[PATCH OLK-6.6 0/3] Some bugfixes for interference
by Tengda Wu 09 Dec '25

09 Dec '25

This small patch series addresses some interference issues. Tengda Wu (3): interference: Add fallback to sched_clock when TSC is unavailable interference: Fix missing interference.stat file in v1 hierarchy interference: add version compatibility check between subsystem and cgroup include/linux/cgroup.h | 25 ++++++++++++++------- kernel/cgroup/ifs.c | 51 +++++++++++++++++++++++++++++------------- 2 files changed, 53 insertions(+), 23 deletions(-) -- 2.34.1

2 4

[PATCH OLK-5.10 0/2] CVE-2023-53491 v3
by Lin Yujun 09 Dec '25

09 Dec '25

Lin Yujun (1): start_kernel: use unreachable too fix __noreturn build warning ndesaulniers(a)google.com (1): start_kernel: Add __no_stack_protector function attribute arch/powerpc/kernel/smp.c | 1 + include/linux/compiler_attributes.h | 12 ++++++++++++ init/main.c | 4 +++- 3 files changed, 16 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH OLK-5.10 0/2] CVE-2023-53491 v2
by Lin Yujun 09 Dec '25

09 Dec '25

Lin Yujun (1): start_kernel: use unreachable too fix __noreturn build warning ndesaulniers(a)google.com (1): start_kernel: Add __no_stack_protector function attribute arch/powerpc/kernel/smp.c | 1 + include/linux/compiler_attributes.h | 12 ++++++++++++ init/main.c | 4 +++- 3 files changed, 16 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[openeuler:OLK-6.6 3493/3493] mm/dynamic_pool.c:1577:25: sparse: sparse: symbol 'pagelist_dpool_ops' was not declared. Should it be static?
by kernel test robot 09 Dec '25

09 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 0189df7df2ef7f7dbbabf7ff8398e45adf306e24 commit: cf98ffbc116bc49dc4506c68e20b02e26519ad35 [3493/3493] mm/dynamic_pool: fill dpool with pagelist config: x86_64-randconfig-r122-20251209 (https://download.01.org/0day-ci/archive/20251209/202512091544.YzqAeHFm-lkp@…) compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251209/202512091544.YzqAeHFm-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512091544.YzqAeHFm-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) mm/dynamic_pool.c:999:55: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct cgroup_subsys_state *css @@ got struct cgroup_subsys_state [noderef] __rcu * @@ mm/dynamic_pool.c:999:55: sparse: expected struct cgroup_subsys_state *css mm/dynamic_pool.c:999:55: sparse: got struct cgroup_subsys_state [noderef] __rcu * >> mm/dynamic_pool.c:1577:25: sparse: sparse: symbol 'pagelist_dpool_ops' was not declared. Should it be static? vim +/pagelist_dpool_ops +1577 mm/dynamic_pool.c 1576 > 1577 struct dynamic_pool_ops pagelist_dpool_ops = { 1578 .fill_pool = dpool_fill_from_pagelist, 1579 .drain_pool = dpool_drain_to_pagelist, 1580 .restore_pool = dpool_migrate_used_pages, 1581 }; 1582 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] net/oenetcls: Prioritize oenetcls hooks over rps
by Yue Haibing 09 Dec '25

09 Dec '25

hulk inclusion category: cleanup bugzilla: https://gitee.com/openeuler/kernel/issues/ICBFCS -------------------------------- Prioritize oenetcls hooks over rps, clean up unnecessary oecls_rps goto statements. Signed-off-by: Yue Haibing <yuehaibing(a)huawei.com> --- net/core/dev.c | 29 +++++++++-------------------- 1 file changed, 9 insertions(+), 20 deletions(-) diff --git a/net/core/dev.c b/net/core/dev.c index df6c0ac02a5e..372bab73b8bf 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -5890,11 +5890,15 @@ static int netif_receive_skb_internal(struct sk_buff *skb) return NET_RX_SUCCESS; rcu_read_lock(); -#ifdef CONFIG_RPS #if IS_ENABLED(CONFIG_OENETCLS) - if (static_branch_unlikely(&oecls_rps_needed)) - goto oecls_rps; + if (static_branch_unlikely(&oecls_rps_needed)) { + if (oenetcls_skb_set_cpu(skb, enqueue_to_backlog, &ret)) { + rcu_read_unlock(); + return ret; + } + } #endif +#ifdef CONFIG_RPS if (static_branch_unlikely(&rps_needed)) { struct rps_dev_flow voidflow, *rflow = &voidflow; int cpu = get_rps_cpu(skb->dev, skb, &rflow); @@ -5906,15 +5910,6 @@ static int netif_receive_skb_internal(struct sk_buff *skb) } } #endif - -#if IS_ENABLED(CONFIG_OENETCLS) -oecls_rps: - if (oenetcls_skb_set_cpu(skb, enqueue_to_backlog, &ret)) { - rcu_read_unlock(); - return ret; - } -#endif - ret = __netif_receive_skb(skb); rcu_read_unlock(); return ret; @@ -5935,11 +5930,11 @@ static void netif_receive_skb_list_internal(struct list_head *head) list_splice_init(&sublist, head); rcu_read_lock(); -#ifdef CONFIG_RPS #if IS_ENABLED(CONFIG_OENETCLS) if (static_branch_unlikely(&oecls_rps_needed)) - goto oecls_rps_list; + oenetcls_skblist_set_cpu(head, enqueue_to_backlog); #endif +#ifdef CONFIG_RPS if (static_branch_unlikely(&rps_needed)) { list_for_each_entry_safe(skb, next, head, list) { struct rps_dev_flow voidflow, *rflow = &voidflow; @@ -5953,12 +5948,6 @@ static void netif_receive_skb_list_internal(struct list_head *head) } } #endif - -#if IS_ENABLED(CONFIG_OENETCLS) -oecls_rps_list: - oenetcls_skblist_set_cpu(head, enqueue_to_backlog); -#endif - __netif_receive_skb_list(head); rcu_read_unlock(); } -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] CVE-2023-53491
by Lin Yujun 09 Dec '25

09 Dec '25

Lin Yujun (1): start_kernel: use unreachable too fix __noreturn build warning ndesaulniers(a)google.com (1): start_kernel: Add __no_stack_protector function attribute arch/powerpc/kernel/smp.c | 1 + include/linux/compiler_attributes.h | 12 ++++++++++++ init/main.c | 4 +++- 3 files changed, 16 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/2] Bugfix for two issues
by Liu Mingrui 09 Dec '25

09 Dec '25

Bugfix for the following two issues Liu Mingrui (2): zcopy: Fix NULL pointer dereference while attach conflict with free zcopy: Fix softlockup while attach PUD-SIZE page drivers/misc/zcopy/zcopy.c | 5 +++++ 1 file changed, 5 insertions(+) -- 2.25.1

2 3