- Kernel - mailweb.openeuler.org

[openeuler:OLK-6.6 3098/3098] kernel/bpf-rvi/common_kfuncs.c:260:27: warning: no previous prototype for 'bpf_mem_vmalloc_used'
by kernel test robot 05 Nov '25

05 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: b2b8512ca97108929f3aca5405875d91577b8c80 commit: c4e5391b74ba345c143a4af707330ac9b33aac71 [3098/3098] bpf-rvi: Add bpf_mem_vmalloc_{used,total} kfunc config: x86_64-randconfig-001-20251104 (https://download.01.org/0day-ci/archive/20251105/202511052209.ExfiyFp7-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251105/202511052209.ExfiyFp7-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511052209.ExfiyFp7-lkp@intel.com/ All warnings (new ones prefixed by >>): kernel/bpf-rvi/common_kfuncs.c:29:32: warning: no previous prototype for 'bpf_mem_cgroup_from_task' [-Wmissing-prototypes] 29 | __bpf_kfunc struct mem_cgroup *bpf_mem_cgroup_from_task(struct task_struct *p) | ^~~~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:38:35: warning: no previous prototype for 'bpf_task_active_pid_ns' [-Wmissing-prototypes] 38 | __bpf_kfunc struct pid_namespace *bpf_task_active_pid_ns(struct task_struct *task) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:43:17: warning: no previous prototype for 'bpf_pidns_nr_tasks' [-Wmissing-prototypes] 43 | __bpf_kfunc u64 bpf_pidns_nr_tasks(struct pid_namespace *ns) | ^~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:57:17: warning: no previous prototype for 'bpf_pidns_last_pid' [-Wmissing-prototypes] 57 | __bpf_kfunc u32 bpf_pidns_last_pid(struct pid_namespace *ns) | ^~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:86:18: warning: no previous prototype for 'bpf_si_memswinfo' [-Wmissing-prototypes] 86 | __bpf_kfunc void bpf_si_memswinfo(struct bpf_sysinfo *bsi) | ^~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:96:27: warning: no previous prototype for 'bpf_page_counter_read' [-Wmissing-prototypes] 96 | __bpf_kfunc unsigned long bpf_page_counter_read(struct page_counter *counter) | ^~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:106:18: warning: no previous prototype for 'bpf_seq_file_append' [-Wmissing-prototypes] 106 | __bpf_kfunc void bpf_seq_file_append(struct seq_file *dst, struct seq_file *src) | ^~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:120:18: warning: no previous prototype for 'bpf_get_boottime_timens' [-Wmissing-prototypes] 120 | __bpf_kfunc void bpf_get_boottime_timens(struct task_struct *tsk, struct timespec64 *boottime) | ^~~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:126:27: warning: no previous prototype for 'bpf_get_total_forks' [-Wmissing-prototypes] 126 | __bpf_kfunc unsigned long bpf_get_total_forks(void) | ^~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:131:26: warning: no previous prototype for 'bpf_nr_running' [-Wmissing-prototypes] 131 | __bpf_kfunc unsigned int bpf_nr_running(void) | ^~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:136:32: warning: no previous prototype for 'bpf_nr_context_switches' [-Wmissing-prototypes] 136 | __bpf_kfunc unsigned long long bpf_nr_context_switches(void) | ^~~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:141:26: warning: no previous prototype for 'bpf_nr_iowait' [-Wmissing-prototypes] 141 | __bpf_kfunc unsigned int bpf_nr_iowait(void) | ^~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:147:26: warning: no previous prototype for 'bpf_kstat_softirqs_cpu' [-Wmissing-prototypes] 147 | __bpf_kfunc unsigned int bpf_kstat_softirqs_cpu(unsigned int irq, int cpu) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:152:27: warning: no previous prototype for 'bpf_kstat_cpu_irqs_sum' [-Wmissing-prototypes] 152 | __bpf_kfunc unsigned long bpf_kstat_cpu_irqs_sum(unsigned int cpu) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:157:18: warning: no previous prototype for 'bpf_kcpustat_cpu_fetch' [-Wmissing-prototypes] 157 | __bpf_kfunc void bpf_kcpustat_cpu_fetch(struct kernel_cpustat *dst, int cpu) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:166:27: warning: no previous prototype for 'bpf_mem_file_hugepage' [-Wmissing-prototypes] 166 | __bpf_kfunc unsigned long bpf_mem_file_hugepage(void) | ^~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:171:27: warning: no previous prototype for 'bpf_mem_file_pmdmapped' [-Wmissing-prototypes] 171 | __bpf_kfunc unsigned long bpf_mem_file_pmdmapped(void) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:176:27: warning: no previous prototype for 'bpf_mem_kreclaimable' [-Wmissing-prototypes] 176 | __bpf_kfunc unsigned long bpf_mem_kreclaimable(void) | ^~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:182:27: warning: no previous prototype for 'bpf_mem_totalcma' [-Wmissing-prototypes] 182 | __bpf_kfunc unsigned long bpf_mem_totalcma(void) | ^~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:187:27: warning: no previous prototype for 'bpf_mem_freecma' [-Wmissing-prototypes] 187 | __bpf_kfunc unsigned long bpf_mem_freecma(void) | ^~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:202:17: warning: no previous prototype for 'bpf_hugetlb_report_meminfo' [-Wmissing-prototypes] 202 | __bpf_kfunc int bpf_hugetlb_report_meminfo(struct bpf_mem_hugepage *hugepage_info) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:235:27: warning: no previous prototype for 'bpf_mem_failure' [-Wmissing-prototypes] 235 | __bpf_kfunc unsigned long bpf_mem_failure(void) | ^~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:246:27: warning: no previous prototype for 'bpf_mem_percpu' [-Wmissing-prototypes] 246 | __bpf_kfunc unsigned long bpf_mem_percpu(void) | ^~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:251:27: warning: no previous prototype for 'bpf_mem_commit_limit' [-Wmissing-prototypes] 251 | __bpf_kfunc unsigned long bpf_mem_commit_limit(void) | ^~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:255:27: warning: no previous prototype for 'bpf_mem_committed' [-Wmissing-prototypes] 255 | __bpf_kfunc unsigned long bpf_mem_committed(void) | ^~~~~~~~~~~~~~~~~ >> kernel/bpf-rvi/common_kfuncs.c:260:27: warning: no previous prototype for 'bpf_mem_vmalloc_used' [-Wmissing-prototypes] 260 | __bpf_kfunc unsigned long bpf_mem_vmalloc_used(void) | ^~~~~~~~~~~~~~~~~~~~ >> kernel/bpf-rvi/common_kfuncs.c:265:27: warning: no previous prototype for 'bpf_mem_vmalloc_total' [-Wmissing-prototypes] 265 | __bpf_kfunc unsigned long bpf_mem_vmalloc_total(void) | ^~~~~~~~~~~~~~~~~~~~~ vim +/bpf_mem_vmalloc_used +260 kernel/bpf-rvi/common_kfuncs.c 259 > 260 __bpf_kfunc unsigned long bpf_mem_vmalloc_used(void) 261 { 262 return vmalloc_nr_pages(); 263 } 264 > 265 __bpf_kfunc unsigned long bpf_mem_vmalloc_total(void) 266 { 267 return (unsigned long)VMALLOC_TOTAL >> 10; 268 } 269 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3103/3103] mm/swap.h:66:26: error: implicit declaration of function 'swp_offset'; did you mean 'pud_offset'?
by kernel test robot 05 Nov '25

05 Nov '25

Hi Kairui, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: b2b8512ca97108929f3aca5405875d91577b8c80 commit: 5a72d2e54e8ff7c7f9510de875cf201ad18f36c4 [3103/3103] mm/shmem, swap: fix softlockup with mTHP swapin config: x86_64-randconfig-005-20251105 (https://download.01.org/0day-ci/archive/20251105/202511052045.6ZI8bKFl-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251105/202511052045.6ZI8bKFl-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511052045.6ZI8bKFl-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from mm/shmem.c:43: mm/swap.h: In function 'non_swapcache_batch': >> mm/swap.h:66:26: error: implicit declaration of function 'swp_offset'; did you mean 'pud_offset'? [-Wimplicit-function-declaration] 66 | pgoff_t offset = swp_offset(entry); | ^~~~~~~~~~ | pud_offset In file included from mm/shmem.c:68: include/linux/swapops.h: At top level: >> include/linux/swapops.h:107:23: error: conflicting types for 'swp_offset'; have 'long unsigned int(swp_entry_t)' 107 | static inline pgoff_t swp_offset(swp_entry_t entry) | ^~~~~~~~~~ mm/swap.h:66:26: note: previous implicit declaration of 'swp_offset' with type 'int()' 66 | pgoff_t offset = swp_offset(entry); | ^~~~~~~~~~ vim +66 mm/swap.h 62 63 static inline int non_swapcache_batch(swp_entry_t entry, int max_nr) 64 { 65 struct swap_info_struct *si = swp_swap_info(entry); > 66 pgoff_t offset = swp_offset(entry); 67 int i; 68 69 /* 70 * While allocating a large folio and doing mTHP swapin, we need to 71 * ensure all entries are not cached, otherwise, the mTHP folio will 72 * be in conflict with the folio in swap cache. 73 */ 74 for (i = 0; i < max_nr; i++) { 75 if ((si->swap_map[offset + i] & SWAP_HAS_CACHE)) 76 return i; 77 } 78 79 return i; 80 } 81 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/2] CVE-2025-37997
by Zhang Changzhong 05 Nov '25

05 Nov '25

Jozsef Kadlecsik (1): netfilter: ipset: fix region locking in hash types Zhen Ni (1): netfilter: ipset: Remove unused htable_bits in macro ahash_region net/netfilter/ipset/ip_set_hash_gen.h | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) -- 2.9.5

2 3

[PATCH OLK-5.10 0/2] CVE-2025-37997
by Zhang Changzhong 05 Nov '25

05 Nov '25

Jozsef Kadlecsik (1): netfilter: ipset: fix region locking in hash types Zhen Ni (1): netfilter: ipset: Remove unused htable_bits in macro ahash_region net/netfilter/ipset/ip_set_hash_gen.h | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) -- 2.9.5

2 3

[openeuler:OLK-6.6 3098/3098] kernel/bpf-rvi/common_kfuncs.c:250:27: warning: no previous prototype for 'bpf_mem_commit_limit'
by kernel test robot 05 Nov '25

05 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: b2b8512ca97108929f3aca5405875d91577b8c80 commit: 7aa850a9126f0acd994e09afe54bb0200214e068 [3098/3098] bpf-rvi: Add bpf_mem_commit_limit & bpf_mem_committed kfunc config: x86_64-randconfig-001-20251104 (https://download.01.org/0day-ci/archive/20251105/202511052033.01T6CrLU-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251105/202511052033.01T6CrLU-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511052033.01T6CrLU-lkp@intel.com/ All warnings (new ones prefixed by >>): kernel/bpf-rvi/common_kfuncs.c:28:32: warning: no previous prototype for 'bpf_mem_cgroup_from_task' [-Wmissing-prototypes] 28 | __bpf_kfunc struct mem_cgroup *bpf_mem_cgroup_from_task(struct task_struct *p) | ^~~~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:37:35: warning: no previous prototype for 'bpf_task_active_pid_ns' [-Wmissing-prototypes] 37 | __bpf_kfunc struct pid_namespace *bpf_task_active_pid_ns(struct task_struct *task) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:42:17: warning: no previous prototype for 'bpf_pidns_nr_tasks' [-Wmissing-prototypes] 42 | __bpf_kfunc u64 bpf_pidns_nr_tasks(struct pid_namespace *ns) | ^~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:56:17: warning: no previous prototype for 'bpf_pidns_last_pid' [-Wmissing-prototypes] 56 | __bpf_kfunc u32 bpf_pidns_last_pid(struct pid_namespace *ns) | ^~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:85:18: warning: no previous prototype for 'bpf_si_memswinfo' [-Wmissing-prototypes] 85 | __bpf_kfunc void bpf_si_memswinfo(struct bpf_sysinfo *bsi) | ^~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:95:27: warning: no previous prototype for 'bpf_page_counter_read' [-Wmissing-prototypes] 95 | __bpf_kfunc unsigned long bpf_page_counter_read(struct page_counter *counter) | ^~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:105:18: warning: no previous prototype for 'bpf_seq_file_append' [-Wmissing-prototypes] 105 | __bpf_kfunc void bpf_seq_file_append(struct seq_file *dst, struct seq_file *src) | ^~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:119:18: warning: no previous prototype for 'bpf_get_boottime_timens' [-Wmissing-prototypes] 119 | __bpf_kfunc void bpf_get_boottime_timens(struct task_struct *tsk, struct timespec64 *boottime) | ^~~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:125:27: warning: no previous prototype for 'bpf_get_total_forks' [-Wmissing-prototypes] 125 | __bpf_kfunc unsigned long bpf_get_total_forks(void) | ^~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:130:26: warning: no previous prototype for 'bpf_nr_running' [-Wmissing-prototypes] 130 | __bpf_kfunc unsigned int bpf_nr_running(void) | ^~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:135:32: warning: no previous prototype for 'bpf_nr_context_switches' [-Wmissing-prototypes] 135 | __bpf_kfunc unsigned long long bpf_nr_context_switches(void) | ^~~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:140:26: warning: no previous prototype for 'bpf_nr_iowait' [-Wmissing-prototypes] 140 | __bpf_kfunc unsigned int bpf_nr_iowait(void) | ^~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:146:26: warning: no previous prototype for 'bpf_kstat_softirqs_cpu' [-Wmissing-prototypes] 146 | __bpf_kfunc unsigned int bpf_kstat_softirqs_cpu(unsigned int irq, int cpu) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:151:27: warning: no previous prototype for 'bpf_kstat_cpu_irqs_sum' [-Wmissing-prototypes] 151 | __bpf_kfunc unsigned long bpf_kstat_cpu_irqs_sum(unsigned int cpu) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:156:18: warning: no previous prototype for 'bpf_kcpustat_cpu_fetch' [-Wmissing-prototypes] 156 | __bpf_kfunc void bpf_kcpustat_cpu_fetch(struct kernel_cpustat *dst, int cpu) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:165:27: warning: no previous prototype for 'bpf_mem_file_hugepage' [-Wmissing-prototypes] 165 | __bpf_kfunc unsigned long bpf_mem_file_hugepage(void) | ^~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:170:27: warning: no previous prototype for 'bpf_mem_file_pmdmapped' [-Wmissing-prototypes] 170 | __bpf_kfunc unsigned long bpf_mem_file_pmdmapped(void) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:175:27: warning: no previous prototype for 'bpf_mem_kreclaimable' [-Wmissing-prototypes] 175 | __bpf_kfunc unsigned long bpf_mem_kreclaimable(void) | ^~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:181:27: warning: no previous prototype for 'bpf_mem_totalcma' [-Wmissing-prototypes] 181 | __bpf_kfunc unsigned long bpf_mem_totalcma(void) | ^~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:186:27: warning: no previous prototype for 'bpf_mem_freecma' [-Wmissing-prototypes] 186 | __bpf_kfunc unsigned long bpf_mem_freecma(void) | ^~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:201:17: warning: no previous prototype for 'bpf_hugetlb_report_meminfo' [-Wmissing-prototypes] 201 | __bpf_kfunc int bpf_hugetlb_report_meminfo(struct bpf_mem_hugepage *hugepage_info) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:234:27: warning: no previous prototype for 'bpf_mem_failure' [-Wmissing-prototypes] 234 | __bpf_kfunc unsigned long bpf_mem_failure(void) | ^~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:245:27: warning: no previous prototype for 'bpf_mem_percpu' [-Wmissing-prototypes] 245 | __bpf_kfunc unsigned long bpf_mem_percpu(void) | ^~~~~~~~~~~~~~ >> kernel/bpf-rvi/common_kfuncs.c:250:27: warning: no previous prototype for 'bpf_mem_commit_limit' [-Wmissing-prototypes] 250 | __bpf_kfunc unsigned long bpf_mem_commit_limit(void) | ^~~~~~~~~~~~~~~~~~~~ >> kernel/bpf-rvi/common_kfuncs.c:254:27: warning: no previous prototype for 'bpf_mem_committed' [-Wmissing-prototypes] 254 | __bpf_kfunc unsigned long bpf_mem_committed(void) | ^~~~~~~~~~~~~~~~~ vim +/bpf_mem_commit_limit +250 kernel/bpf-rvi/common_kfuncs.c 199 200 #ifdef CONFIG_HUGETLB_PAGE > 201 __bpf_kfunc int bpf_hugetlb_report_meminfo(struct bpf_mem_hugepage *hugepage_info) 202 { 203 struct hstate *h; 204 unsigned long total = 0; 205 206 if (!hugepages_supported()) 207 return -1; 208 209 for_each_hstate(h) { 210 unsigned long count = h->nr_huge_pages; 211 212 total += huge_page_size(h) * count; 213 214 if (h == &default_hstate) { 215 hugepage_info->total = count; 216 hugepage_info->free = h->free_huge_pages; 217 hugepage_info->rsvd = h->resv_huge_pages; 218 hugepage_info->surp = h->surplus_huge_pages; 219 hugepage_info->size = huge_page_size(h) / SZ_1K; 220 } 221 } 222 223 hugepage_info->hugetlb = total / SZ_1K; 224 return 0; 225 } 226 #else 227 __bpf_kfunc int bpf_hugetlb_report_meminfo(struct bpf_mem_hugepage *hugepage_info) 228 { 229 return -1; 230 } 231 #endif 232 233 #ifdef CONFIG_MEMORY_FAILURE > 234 __bpf_kfunc unsigned long bpf_mem_failure(void) 235 { 236 return atomic_long_read(&num_poisoned_pages) << (PAGE_SHIFT - 10); 237 } 238 #else 239 __bpf_kfunc unsigned long bpf_mem_failure(void) 240 { 241 return 0; 242 } 243 #endif 244 245 __bpf_kfunc unsigned long bpf_mem_percpu(void) 246 { 247 return pcpu_nr_pages(); 248 } 249 > 250 __bpf_kfunc unsigned long bpf_mem_commit_limit(void) 251 { 252 return vm_commit_limit(); 253 } > 254 __bpf_kfunc unsigned long bpf_mem_committed(void) 255 { 256 return vm_memory_committed(); 257 } 258 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] Bluetooth: hci_core: Disable works on hci_unregister_dev
by Zhang Changzhong 05 Nov '25

05 Nov '25

From: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> mainline inclusion from mainline-v6.12-rc5 commit 989fa5171f005ecf63440057218d8aeb1795287d category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICZL5V CVE: CVE-2024-58241 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- This make use of disable_work_* on hci_unregister_dev since the hci_dev is about to be freed new submissions are not disarable. Fixes: 0d151a103775 ("Bluetooth: hci_core: cancel all works upon hci_unregister_dev()") Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Conflicts: net/bluetooth/hci_sync.c [commit 78db544b5d27 ("Bluetooth: hci_core: Remove le_restart_scan work") and f2d897753586 ("Bluetooth: hci_sync: Remove remaining dependencies of hci_request") not merged] Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/bluetooth/hci_core.c | 24 +++++++++++++++--------- net/bluetooth/hci_sync.c | 15 +++++++++++---- 2 files changed, 26 insertions(+), 13 deletions(-) diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c index c5e3ae5..4b4e3579 100644 --- a/net/bluetooth/hci_core.c +++ b/net/bluetooth/hci_core.c @@ -1638,12 +1638,12 @@ void hci_adv_instances_clear(struct hci_dev *hdev) struct adv_info *adv_instance, *n; if (hdev->adv_instance_timeout) { - cancel_delayed_work(&hdev->adv_instance_expire); + disable_delayed_work(&hdev->adv_instance_expire); hdev->adv_instance_timeout = 0; } list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) { - cancel_delayed_work_sync(&adv_instance->rpa_expired_cb); + disable_delayed_work_sync(&adv_instance->rpa_expired_cb); list_del(&adv_instance->list); kfree(adv_instance); } @@ -2670,11 +2670,11 @@ void hci_unregister_dev(struct hci_dev *hdev) list_del(&hdev->list); write_unlock(&hci_dev_list_lock); - cancel_work_sync(&hdev->rx_work); - cancel_work_sync(&hdev->cmd_work); - cancel_work_sync(&hdev->tx_work); - cancel_work_sync(&hdev->power_on); - cancel_work_sync(&hdev->error_reset); + disable_work_sync(&hdev->rx_work); + disable_work_sync(&hdev->cmd_work); + disable_work_sync(&hdev->tx_work); + disable_work_sync(&hdev->power_on); + disable_work_sync(&hdev->error_reset); hci_cmd_sync_clear(hdev); @@ -2781,8 +2781,14 @@ static void hci_cancel_cmd_sync(struct hci_dev *hdev, int err) { bt_dev_dbg(hdev, "err 0x%2.2x", err); - cancel_delayed_work_sync(&hdev->cmd_timer); - cancel_delayed_work_sync(&hdev->ncmd_timer); + if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) { + disable_delayed_work_sync(&hdev->cmd_timer); + disable_delayed_work_sync(&hdev->ncmd_timer); + } else { + cancel_delayed_work_sync(&hdev->cmd_timer); + cancel_delayed_work_sync(&hdev->ncmd_timer); + } + atomic_set(&hdev->cmd_cnt, 1); hci_cmd_sync_cancel_sync(hdev, err); diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c index e086f29..9d31b78 100644 --- a/net/bluetooth/hci_sync.c +++ b/net/bluetooth/hci_sync.c @@ -5158,10 +5158,17 @@ int hci_dev_close_sync(struct hci_dev *hdev) bt_dev_dbg(hdev, ""); - cancel_delayed_work(&hdev->power_off); - cancel_delayed_work(&hdev->ncmd_timer); - cancel_delayed_work(&hdev->le_scan_disable); - cancel_delayed_work(&hdev->le_scan_restart); + if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) { + disable_delayed_work(&hdev->power_off); + disable_delayed_work(&hdev->ncmd_timer); + disable_delayed_work(&hdev->le_scan_disable); + disable_delayed_work(&hdev->le_scan_restart); + } else { + cancel_delayed_work(&hdev->power_off); + cancel_delayed_work(&hdev->ncmd_timer); + cancel_delayed_work(&hdev->le_scan_disable); + cancel_delayed_work(&hdev->le_scan_restart); + } hci_request_cancel_all(hdev); -- 2.9.5

2 1

[PATCH OLK-6.6 0/2] CVE-2025-39925
by Zhang Changzhong 05 Nov '25

05 Nov '25

Tetsuo Handa (2): can: j1939: implement NETDEV_UNREGISTER notification handler can: j1939: add missing calls in NETDEV_UNREGISTER notification handler net/can/j1939/j1939-priv.h | 1 + net/can/j1939/main.c | 5 +++++ net/can/j1939/socket.c | 49 ++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 55 insertions(+) -- 2.9.5

2 3

[openeuler:OLK-6.6 3098/3098] kernel/bpf-rvi/common_kfuncs.c:244:27: warning: no previous prototype for 'bpf_mem_percpu'
by kernel test robot 05 Nov '25

05 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 534b306a9ab27f36c465a7c90a32a1b4ff3a641c commit: af34a7a840fd24a050a5fee8ea4dcfad963f3abc [3098/3098] bpf-rvi: Add bpf_mem_percpu kfunc config: x86_64-randconfig-001-20251104 (https://download.01.org/0day-ci/archive/20251105/202511051816.mAnFluwr-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251105/202511051816.mAnFluwr-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511051816.mAnFluwr-lkp@intel.com/ All warnings (new ones prefixed by >>): kernel/bpf-rvi/common_kfuncs.c:27:32: warning: no previous prototype for 'bpf_mem_cgroup_from_task' [-Wmissing-prototypes] 27 | __bpf_kfunc struct mem_cgroup *bpf_mem_cgroup_from_task(struct task_struct *p) | ^~~~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:36:35: warning: no previous prototype for 'bpf_task_active_pid_ns' [-Wmissing-prototypes] 36 | __bpf_kfunc struct pid_namespace *bpf_task_active_pid_ns(struct task_struct *task) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:41:17: warning: no previous prototype for 'bpf_pidns_nr_tasks' [-Wmissing-prototypes] 41 | __bpf_kfunc u64 bpf_pidns_nr_tasks(struct pid_namespace *ns) | ^~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:55:17: warning: no previous prototype for 'bpf_pidns_last_pid' [-Wmissing-prototypes] 55 | __bpf_kfunc u32 bpf_pidns_last_pid(struct pid_namespace *ns) | ^~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:84:18: warning: no previous prototype for 'bpf_si_memswinfo' [-Wmissing-prototypes] 84 | __bpf_kfunc void bpf_si_memswinfo(struct bpf_sysinfo *bsi) | ^~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:94:27: warning: no previous prototype for 'bpf_page_counter_read' [-Wmissing-prototypes] 94 | __bpf_kfunc unsigned long bpf_page_counter_read(struct page_counter *counter) | ^~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:104:18: warning: no previous prototype for 'bpf_seq_file_append' [-Wmissing-prototypes] 104 | __bpf_kfunc void bpf_seq_file_append(struct seq_file *dst, struct seq_file *src) | ^~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:118:18: warning: no previous prototype for 'bpf_get_boottime_timens' [-Wmissing-prototypes] 118 | __bpf_kfunc void bpf_get_boottime_timens(struct task_struct *tsk, struct timespec64 *boottime) | ^~~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:124:27: warning: no previous prototype for 'bpf_get_total_forks' [-Wmissing-prototypes] 124 | __bpf_kfunc unsigned long bpf_get_total_forks(void) | ^~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:129:26: warning: no previous prototype for 'bpf_nr_running' [-Wmissing-prototypes] 129 | __bpf_kfunc unsigned int bpf_nr_running(void) | ^~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:134:32: warning: no previous prototype for 'bpf_nr_context_switches' [-Wmissing-prototypes] 134 | __bpf_kfunc unsigned long long bpf_nr_context_switches(void) | ^~~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:139:26: warning: no previous prototype for 'bpf_nr_iowait' [-Wmissing-prototypes] 139 | __bpf_kfunc unsigned int bpf_nr_iowait(void) | ^~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:145:26: warning: no previous prototype for 'bpf_kstat_softirqs_cpu' [-Wmissing-prototypes] 145 | __bpf_kfunc unsigned int bpf_kstat_softirqs_cpu(unsigned int irq, int cpu) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:150:27: warning: no previous prototype for 'bpf_kstat_cpu_irqs_sum' [-Wmissing-prototypes] 150 | __bpf_kfunc unsigned long bpf_kstat_cpu_irqs_sum(unsigned int cpu) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:155:18: warning: no previous prototype for 'bpf_kcpustat_cpu_fetch' [-Wmissing-prototypes] 155 | __bpf_kfunc void bpf_kcpustat_cpu_fetch(struct kernel_cpustat *dst, int cpu) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:164:27: warning: no previous prototype for 'bpf_mem_file_hugepage' [-Wmissing-prototypes] 164 | __bpf_kfunc unsigned long bpf_mem_file_hugepage(void) | ^~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:169:27: warning: no previous prototype for 'bpf_mem_file_pmdmapped' [-Wmissing-prototypes] 169 | __bpf_kfunc unsigned long bpf_mem_file_pmdmapped(void) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:174:27: warning: no previous prototype for 'bpf_mem_kreclaimable' [-Wmissing-prototypes] 174 | __bpf_kfunc unsigned long bpf_mem_kreclaimable(void) | ^~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:180:27: warning: no previous prototype for 'bpf_mem_totalcma' [-Wmissing-prototypes] 180 | __bpf_kfunc unsigned long bpf_mem_totalcma(void) | ^~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:185:27: warning: no previous prototype for 'bpf_mem_freecma' [-Wmissing-prototypes] 185 | __bpf_kfunc unsigned long bpf_mem_freecma(void) | ^~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:200:17: warning: no previous prototype for 'bpf_hugetlb_report_meminfo' [-Wmissing-prototypes] 200 | __bpf_kfunc int bpf_hugetlb_report_meminfo(struct bpf_mem_hugepage *hugepage_info) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:233:27: warning: no previous prototype for 'bpf_mem_failure' [-Wmissing-prototypes] 233 | __bpf_kfunc unsigned long bpf_mem_failure(void) | ^~~~~~~~~~~~~~~ >> kernel/bpf-rvi/common_kfuncs.c:244:27: warning: no previous prototype for 'bpf_mem_percpu' [-Wmissing-prototypes] 244 | __bpf_kfunc unsigned long bpf_mem_percpu(void) | ^~~~~~~~~~~~~~ vim +/bpf_mem_percpu +244 kernel/bpf-rvi/common_kfuncs.c 184 > 185 __bpf_kfunc unsigned long bpf_mem_freecma(void) 186 { 187 return global_zone_page_state(NR_FREE_CMA_PAGES); 188 } 189 190 struct bpf_mem_hugepage { 191 unsigned long total; 192 unsigned long free; 193 unsigned long rsvd; 194 unsigned long surp; 195 unsigned long size; 196 unsigned long hugetlb; 197 }; 198 199 #ifdef CONFIG_HUGETLB_PAGE 200 __bpf_kfunc int bpf_hugetlb_report_meminfo(struct bpf_mem_hugepage *hugepage_info) 201 { 202 struct hstate *h; 203 unsigned long total = 0; 204 205 if (!hugepages_supported()) 206 return -1; 207 208 for_each_hstate(h) { 209 unsigned long count = h->nr_huge_pages; 210 211 total += huge_page_size(h) * count; 212 213 if (h == &default_hstate) { 214 hugepage_info->total = count; 215 hugepage_info->free = h->free_huge_pages; 216 hugepage_info->rsvd = h->resv_huge_pages; 217 hugepage_info->surp = h->surplus_huge_pages; 218 hugepage_info->size = huge_page_size(h) / SZ_1K; 219 } 220 } 221 222 hugepage_info->hugetlb = total / SZ_1K; 223 return 0; 224 } 225 #else 226 __bpf_kfunc int bpf_hugetlb_report_meminfo(struct bpf_mem_hugepage *hugepage_info) 227 { 228 return -1; 229 } 230 #endif 231 232 #ifdef CONFIG_MEMORY_FAILURE 233 __bpf_kfunc unsigned long bpf_mem_failure(void) 234 { 235 return atomic_long_read(&num_poisoned_pages) << (PAGE_SHIFT - 10); 236 } 237 #else 238 __bpf_kfunc unsigned long bpf_mem_failure(void) 239 { 240 return 0; 241 } 242 #endif 243 > 244 __bpf_kfunc unsigned long bpf_mem_percpu(void) 245 { 246 return pcpu_nr_pages(); 247 } 248 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] PM: sleep: core: Clear power.must_resume in noirq suspend error path
by Xinyu Zheng 05 Nov '25

05 Nov '25

From: "Rafael J. Wysocki" <rafael.j.wysocki(a)intel.com> mainline inclusion from mainline-v6.18-rc1 commit be82483d1b60baf6747884bd74cb7de484deaf76 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID4AQL Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------------------------------------- If system suspend is aborted in the "noirq" phase (for instance, due to an error returned by one of the device callbacks), power.is_noirq_suspended will not be set for some devices and device_resume_noirq() will return early for them. Consequently, noirq resume callbacks will not run for them at all because the noirq suspend callbacks have not run for them yet. If any of them has power.must_resume set and late suspend has been skipped for it (due to power.smart_suspend), early resume should be skipped for it either, or its state may become inconsistent (for instance, if the early resume assumes that it will always follow noirq resume). Make that happen by clearing power.must_resume in device_resume_noirq() for devices with power.is_noirq_suspended clear that have been left in suspend by device_suspend_late(), which will subsequently cause device_resume_early() to leave the device in suspend and avoid changing its state. Fixes: 0d4b54c6fee8 ("PM / core: Add LEAVE_SUSPENDED driver flag") Link: https://lore.kernel.org/linux-pm/5d692b81-6f58-4e86-9cb0-ede69a09d799@rowla… Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Reviewed-by: Ulf Hansson <ulf.hansson(a)linaro.org> Link: https://patch.msgid.link/3381776.aeNJFYEL58@rafael.j.wysocki Conflicts: drivers/base/power/main.c [context conflict and function rename] Signed-off-by: Xinyu Zheng <zhengxinyu6(a)huawei.com> --- drivers/base/power/main.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c index fe7506aae13c..703de8f203a6 100644 --- a/drivers/base/power/main.c +++ b/drivers/base/power/main.c @@ -625,8 +625,20 @@ static int device_resume_noirq(struct device *dev, pm_message_t state, bool asyn if (dev->power.syscore || dev->power.direct_complete) goto Out; - if (!dev->power.is_noirq_suspended) + if (!dev->power.is_noirq_suspended) { + /* + * This means that system suspend has been aborted in the noirq + * phase before invoking the noirq suspend callback for the + * device, so if device_suspend_late() has left it in suspend, + * device_resume_early() should leave it in suspend either in + * case the early resume of it depends on the noirq resume that + * has not run. + */ + if (dev_pm_smart_suspend_and_suspended(dev)) + dev->power.must_resume = false; + goto Out; + } dpm_wait_for_superior(dev, async); -- 2.34.1

2 1

[PATCH OLK-6.6] mm: swap: check for stable address space before operating on the VMA
by Ze Zuo 05 Nov '25

05 Nov '25

From: Charan Teja Kalla <charan.kalla(a)oss.qualcomm.com> mainline inclusion from mainline-v6.18-rc1 commit 1367da7eb875d01102d2ed18654b24d261ff5393 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID22QV CVE: CVE-2025-39992 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- It is possible to hit a zero entry while traversing the vmas in unuse_mm() called from swapoff path and accessing it causes the OOPS: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000446--> Loading the memory from offset 0x40 on the XA_ZERO_ENTRY as address. Mem abort info: ESR = 0x0000000096000005 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x05: level 1 translation fault The issue is manifested from the below race between the fork() on a process and swapoff: fork(dup_mmap()) swapoff(unuse_mm) --------------- ----------------- 1) Identical mtree is built using __mt_dup(). 2) copy_pte_range()--> copy_nonpresent_pte(): The dst mm is added into the mmlist to be visible to the swapoff operation. 3) Fatal signal is sent to the parent process(which is the current during the fork) thus skip the duplication of the vmas and mark the vma range with XA_ZERO_ENTRY as a marker for this process that helps during exit_mmap(). 4) swapoff is tried on the 'mm' added to the 'mmlist' as part of the 2. 5) unuse_mm(), that iterates through the vma's of this 'mm' will hit the non-NULL zero entry and operating on this zero entry as a vma is resulting into the oops. The proper fix would be around not exposing this partially-valid tree to others when droping the mmap lock, which is being solved with [1]. A simpler solution would be checking for MMF_UNSTABLE, as it is set if mm_struct is not fully initialized in dup_mmap(). Thanks to Liam/Lorenzo/David for all the suggestions in fixing this issue. Link: https://lkml.kernel.org/r/20250924181138.1762750-1-charan.kalla@oss.qualcom… Link: https://lore.kernel.org/all/20250815191031.3769540-1-Liam.Howlett@oracle.co… [1] Fixes: d24062914837 ("fork: use __mt_dup() to duplicate maple tree in dup_mmap()") Signed-off-by: Charan Teja Kalla <charan.kalla(a)oss.qualcomm.com> Suggested-by: David Hildenbrand <david(a)redhat.com> Cc: Baoquan He <bhe(a)redhat.com> Cc: Barry Song <baohua(a)kernel.org> Cc: Chris Li <chrisl(a)kernel.org> Cc: Kairui Song <kasong(a)tencent.com> Cc: Kemeng Shi <shikemeng(a)huaweicloud.com> Cc: Liam Howlett <liam.howlett(a)oracle.com> Cc: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Cc: Nhat Pham <nphamcs(a)gmail.com> Cc: Peng Zhang <zhangpeng.00(a)bytedance.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- mm/swapfile.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/mm/swapfile.c b/mm/swapfile.c index 5e77c6417ec6..3c98e0447994 100644 --- a/mm/swapfile.c +++ b/mm/swapfile.c @@ -2190,6 +2190,8 @@ static int unuse_mm(struct mm_struct *mm, unsigned int type) VMA_ITERATOR(vmi, mm, 0); mmap_read_lock(mm); + if (check_stable_address_space(mm)) + goto unlock; for_each_vma(vmi, vma) { if (vma->anon_vma && !is_vm_hugetlb_page(vma)) { ret = unuse_vma(vma, type); @@ -2199,6 +2201,7 @@ static int unuse_mm(struct mm_struct *mm, unsigned int type) cond_resched(); } +unlock: mmap_read_unlock(mm); return ret; } -- 2.25.1

2 1

[PATCH OLK-6.6 0/3] CVE-2025-39910
by Ze Zuo 05 Nov '25

05 Nov '25

CVE-2025-39910 Alexander Gordeev (1): kasan: avoid sleepable page allocation from atomic context Andrey Konovalov (1): kasan: use unchecked __memset internally Uladzislau Rezki (Sony) (1): mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc() include/linux/kasan.h | 6 +-- mm/kasan/report.c | 4 +- mm/kasan/shadow.c | 111 ++++++++++++++++++++++++++++++++++++------ mm/vmalloc.c | 8 +-- 4 files changed, 105 insertions(+), 24 deletions(-) -- 2.25.1

2 4

[PATCH OLK-6.6 0/2] CVE-2025-38627
by Ze Zuo 05 Nov '25

05 Nov '25

CVE-2025-38627 Zhiguo Niu (2): f2fs: compress: change the first parameter of page_array_{alloc,free} to sbi f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic fs/f2fs/compress.c | 76 +++++++++++++++++++++++----------------------- fs/f2fs/f2fs.h | 2 ++ 2 files changed, 40 insertions(+), 38 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6] KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls
by Ze Zuo 05 Nov '25

05 Nov '25

From: Manuel Andreas <manuel.andreas(a)tum.de> mainline inclusion from mainline-v6.16-rc1 commit 5a53249d149f48b558368c5338b9921b76a12f8c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICPD7K CVE: CVE-2025-38469 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- kvm_xen_schedop_poll does a kmalloc_array() when a VM polls the host for more than one event channel potr (nr_ports > 1). After the kmalloc_array(), the error paths need to go through the "out" label, but the call to kvm_read_guest_virt() does not. Fixes: 92c58965e965 ("KVM: x86/xen: Use kvm_read_guest_virt() instead of open-coding it badly") Reviewed-by: David Woodhouse <dwmw(a)amazon.co.uk> Signed-off-by: Manuel Andreas <manuel.andreas(a)tum.de> [Adjusted commit message. - Paolo] Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com> Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- arch/x86/kvm/xen.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/kvm/xen.c b/arch/x86/kvm/xen.c index 0ea6016ad132..eb62e05e8e63 100644 --- a/arch/x86/kvm/xen.c +++ b/arch/x86/kvm/xen.c @@ -1260,7 +1260,7 @@ static bool kvm_xen_schedop_poll(struct kvm_vcpu *vcpu, bool longmode, if (kvm_read_guest_virt(vcpu, (gva_t)sched_poll.ports, ports, sched_poll.nr_ports * sizeof(*ports), &e)) { *r = -EFAULT; - return true; + goto out; } for (i = 0; i < sched_poll.nr_ports; i++) { -- 2.25.1

2 1

[PATCH OLK-6.6] maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate()
by Ze Zuo 05 Nov '25

05 Nov '25

From: "Liam R. Howlett" <Liam.Howlett(a)oracle.com> stable inclusion from stable-v6.6.99 commit e63032e66bca1d06e600033f3369ba3db3af0870 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICOXDR CVE: CVE-2025-38364 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit fba46a5d83ca8decb338722fb4899026d8d9ead2 upstream. Temporarily clear the preallocation flag when explicitly requesting allocations. Pre-existing allocations are already counted against the request through mas_node_count_gfp(), but the allocations will not happen if the MA_STATE_PREALLOC flag is set. This flag is meant to avoid re-allocating in bulk allocation mode, and to detect issues with preallocation calculations. The MA_STATE_PREALLOC flag should also always be set on zero allocations so that detection of underflow allocations will print a WARN_ON() during consumption. User visible effect of this flaw is a WARN_ON() followed by a null pointer dereference when subsequent requests for larger number of nodes is ignored, such as the vma merge retry in mmap_region() caused by drivers altering the vma flags (which happens in v6.6, at least) Link: https://lkml.kernel.org/r/20250616184521.3382795-3-Liam.Howlett@oracle.com Fixes: 54a611b60590 ("Maple Tree: add new data structure") Signed-off-by: Liam R. Howlett <Liam.Howlett(a)oracle.com> Reported-by: Zhaoyang Huang <zhaoyang.huang(a)unisoc.com> Reported-by: Hailong Liu <hailong.liu(a)oppo.com> Link: https://lore.kernel.org/all/1652f7eb-a51b-4fee-8058-c73af63bacd1@oppo.com/ Link: https://lore.kernel.org/all/20250428184058.1416274-1-Liam.Howlett@oracle.co… Link: https://lore.kernel.org/all/20250429014754.1479118-1-Liam.Howlett@oracle.co… Cc: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Cc: Suren Baghdasaryan <surenb(a)google.com> Cc: Hailong Liu <hailong.liu(a)oppo.com> Cc: zhangpeng.00(a)bytedance.com <zhangpeng.00(a)bytedance.com> Cc: Steve Kang <Steve.Kang(a)unisoc.com> Cc: Matthew Wilcox <willy(a)infradead.org> Cc: Sidhartha Kumar <sidhartha.kumar(a)oracle.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Liam R. Howlett <Liam.Howlett(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: lib/maple_tree.c [context conflicts due to merged mainline 5143eecd2af2 ("lib/maple_tree.c: fix build error due to hotfix alteration")] Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- lib/maple_tree.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/lib/maple_tree.c b/lib/maple_tree.c index 88e478d6840c..cdec348e7820 100644 --- a/lib/maple_tree.c +++ b/lib/maple_tree.c @@ -5571,7 +5571,7 @@ int mas_preallocate(struct ma_state *mas, void *entry, gfp_t gfp) /* At this point, we are at the leaf node that needs to be altered. */ /* Exact fit, no nodes needed. */ if (wr_mas.r_min == mas->index && wr_mas.r_max == mas->last) - return 0; + goto set_flag; mas_wr_end_piv(&wr_mas); node_size = mas_wr_new_end(&wr_mas); @@ -5580,10 +5580,10 @@ int mas_preallocate(struct ma_state *mas, void *entry, gfp_t gfp) if (node_size == mas->end) { /* reuse node */ if (!mt_in_rcu(mas->tree)) - return 0; + goto set_flag; /* shifting boundary */ if (wr_mas.offset_end - mas->offset == 1) - return 0; + goto set_flag; } if (node_size >= mt_slots[wr_mas.type]) { @@ -5602,10 +5602,13 @@ int mas_preallocate(struct ma_state *mas, void *entry, gfp_t gfp) /* node store, slot store needs one node */ ask_now: + mas->mas_flags &= ~MA_STATE_PREALLOC; mas_node_count_gfp(mas, request, gfp); - mas->mas_flags |= MA_STATE_PREALLOC; - if (likely(!mas_is_err(mas))) + if (likely(!mas_is_err(mas))) { +set_flag: + mas->mas_flags |= MA_STATE_PREALLOC; return 0; + } mas_set_alloc_req(mas, 0); ret = xa_err(mas->node); -- 2.25.1

2 1

[PATCH OLK-6.6] ASoC: Intel: avs: Fix null-ptr-deref in avs_component_probe()
by Ze Zuo 05 Nov '25

05 Nov '25

From: Henry Martin <bsdhenrymartin(a)gmail.com> mainline inclusion from mainline-v6.15-rc3 commit 95f723cf141b95e3b3a5b92cf2ea98a863fe7275 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IC8J7I CVE: CVE-2025-37793 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 95f723cf141b95e3b3a5b92cf2ea98a863fe7275 ] devm_kasprintf() returns NULL when memory allocation fails. Currently, avs_component_probe() does not check for this case, which results in a NULL pointer dereference. Fixes: 739c031110da ("ASoC: Intel: avs: Provide support for fallback topology") Reviewed-by: Cezary Rojewski <cezary.rojewski(a)intel.com> Reviewed-by: Ethan Carter Edwards <ethan(a)ethancedwards.com> Signed-off-by: Henry Martin <bsdhenrymartin(a)gmail.com> Link: https://patch.msgid.link/20250402141411.44972-1-bsdhenrymartin@gmail.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- sound/soc/intel/avs/pcm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/sound/soc/intel/avs/pcm.c b/sound/soc/intel/avs/pcm.c index bb1e77ac78e0..781019685b94 100644 --- a/sound/soc/intel/avs/pcm.c +++ b/sound/soc/intel/avs/pcm.c @@ -808,7 +808,8 @@ static int avs_component_probe(struct snd_soc_component *component) else mach->tplg_filename = devm_kasprintf(adev->dev, GFP_KERNEL, "hda-generic-tplg.bin"); - + if (!mach->tplg_filename) + return -ENOMEM; filename = kasprintf(GFP_KERNEL, "%s/%s", component->driver->topology_name_prefix, mach->tplg_filename); if (!filename) -- 2.25.1

2 1

[PATCH OLK-6.6 0/2] CVE-2025-22090
by Ze Zuo 05 Nov '25

05 Nov '25

CVE-2025-22090 David Hildenbrand (2): x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() mm: (un)track_pfn_copy() fix + doc improvements arch/x86/mm/pat/memtype.c | 52 +++++++++++++++++++++------------------ include/linux/pgtable.h | 31 ++++++++++++++++++----- kernel/fork.c | 4 +++ mm/memory.c | 11 +++------ 4 files changed, 61 insertions(+), 37 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6] hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio
by Ze Zuo 05 Nov '25

05 Nov '25

From: Ma Wupeng <mawupeng1(a)huawei.com> mainline inclusion from mainline-v6.14-rc6 commit af288a426c3e3552b62595c6138ec6371a17dbba category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBY42N CVE: CVE-2025-21931 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Commit b15c87263a69 ("hwpoison, memory_hotplug: allow hwpoisoned pages to be offlined) add page poison checks in do_migrate_range in order to make offline hwpoisoned page possible by introducing isolate_lru_page and try_to_unmap for hwpoisoned page. However folio lock must be held before calling try_to_unmap. Add it to fix this problem. Warning will be produced if folio is not locked during unmap: ------------[ cut here ]------------ kernel BUG at ./include/linux/swapops.h:400! Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP Modules linked in: CPU: 4 UID: 0 PID: 411 Comm: bash Tainted: G W 6.13.0-rc1-00016-g3c434c7ee82a-dirty #41 Tainted: [W]=WARN Hardware name: QEMU QEMU Virtual Machine, BIOS 0.0.0 02/06/2015 pstate: 40400005 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : try_to_unmap_one+0xb08/0xd3c lr : try_to_unmap_one+0x3dc/0xd3c Call trace: try_to_unmap_one+0xb08/0xd3c (P) try_to_unmap_one+0x3dc/0xd3c (L) rmap_walk_anon+0xdc/0x1f8 rmap_walk+0x3c/0x58 try_to_unmap+0x88/0x90 unmap_poisoned_folio+0x30/0xa8 do_migrate_range+0x4a0/0x568 offline_pages+0x5a4/0x670 memory_block_action+0x17c/0x374 memory_subsys_offline+0x3c/0x78 device_offline+0xa4/0xd0 state_store+0x8c/0xf0 dev_attr_store+0x18/0x2c sysfs_kf_write+0x44/0x54 kernfs_fop_write_iter+0x118/0x1a8 vfs_write+0x3a8/0x4bc ksys_write+0x6c/0xf8 __arm64_sys_write+0x1c/0x28 invoke_syscall+0x44/0x100 el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x30/0xd0 el0t_64_sync_handler+0xc8/0xcc el0t_64_sync+0x198/0x19c Code: f9407be0 b5fff320 d4210000 17ffff97 (d4210000) ---[ end trace 0000000000000000 ]--- Link: https://lkml.kernel.org/r/20250217014329.3610326-4-mawupeng1@huawei.com Fixes: b15c87263a69 ("hwpoison, memory_hotplug: allow hwpoisoned pages to be offlined") Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> Acked-by: David Hildenbrand <david(a)redhat.com> Acked-by: Miaohe Lin <linmiaohe(a)huawei.com> Cc: Michal Hocko <mhocko(a)suse.com> Cc: Naoya Horiguchi <nao.horiguchi(a)gmail.com> Cc: Oscar Salvador <osalvador(a)suse.de> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: mm/memory_hotplug.c [Wupeng Ma: Fix this based on ideas since too much conflicts] Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- mm/memory_hotplug.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c index 074ec691e892..cd67b161189b 100644 --- a/mm/memory_hotplug.c +++ b/mm/memory_hotplug.c @@ -1762,8 +1762,12 @@ void do_migrate_range(unsigned long start_pfn, unsigned long end_pfn) if (PageHWPoison(page)) { if (WARN_ON(folio_test_lru(folio))) folio_isolate_lru(folio); - if (folio_mapped(folio)) + if (folio_mapped(folio)) { + folio_lock(folio); try_to_unmap(folio, TTU_IGNORE_MLOCK | TTU_HWPOISON); + folio_unlock(folio); + } + continue; } -- 2.25.1

2 1

[PATCH OLK-6.6 0/2] CVE-2025-21696
by Ze Zuo 05 Nov '25

05 Nov '25

CVE-2025-21696 Lokesh Gidra (1): userfaultfd: move userfaultfd_ctx struct to header file Ryan Roberts (1): mm: clear uffd-wp PTE/PMD state on mremap() fs/userfaultfd.c | 39 --------------------------- include/linux/userfaultfd_k.h | 51 +++++++++++++++++++++++++++++++++++ mm/huge_memory.c | 12 +++++++++ mm/hugetlb.c | 14 +++++++++- mm/mremap.c | 32 +++++++++++++++++++++- 5 files changed, 107 insertions(+), 41 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6 00/18] Backport some memory policy feature and bugfix from mainline
by Ze Zuo 05 Nov '25

05 Nov '25

Implementation of weight-based L/R memory interleaving allocation Gregory Price (3): mm/mempolicy: refactor a read-once mechanism into a function for re-use mm/mempolicy: introduce MPOL_WEIGHTED_INTERLEAVE for weighted interleaving mm/mempolicy: protect task interleave functions with tsk->mems_allowed_seq Honggyu Kim (1): mm/mempolicy: count MPOL_WEIGHTED_INTERLEAVE to "interleave_hit" Hugh Dickins (10): mempolicy: fix migrate_pages(2) syscall return nr_failed mempolicy trivia: delete those ancient pr_debug()s mempolicy trivia: slightly more consistent naming mempolicy trivia: use pgoff_t in shared mempolicy tree mempolicy: mpol_shared_policy_init() without pseudo-vma mempolicy: remove confusing MPOL_MF_LAZY dead code kernfs: drop shared NUMA mempolicy hooks mempolicy: alloc_pages_mpol() for NUMA policy without vma mempolicy: mmap_lock is not needed while migrating folios mempolicy: migration attempt to match interleave nodes Lukas Bulwahn (1): mempolicy: clean up minor dead code in queue_pages_test_walk() Rakie Kim (2): mm/mempolicy: implement the sysfs-based weighted_interleave interface mm/mempolicy: fix memory leaks in weighted interleave sysfs Ze Zuo (1): Revert "mm/mempolicy.c: fix the out-of-bounds access issue in mpol_parse_str" .../ABI/testing/sysfs-kernel-mm-mempolicy | 4 + ...fs-kernel-mm-mempolicy-weighted-interleave | 25 + .../admin-guide/mm/numa_memory_policy.rst | 9 + fs/kernfs/file.c | 49 - fs/proc/task_mmu.c | 5 +- include/linux/gfp.h | 10 +- include/linux/hugetlb.h | 9 - include/linux/mempolicy.h | 51 +- include/uapi/linux/mempolicy.h | 2 +- ipc/shm.c | 19 +- mm/hugetlb.c | 38 +- mm/mempolicy.c | 1505 ++++++++++------- mm/shmem.c | 77 +- mm/swap.h | 7 +- mm/swap_state.c | 81 +- mm/zswap.c | 7 +- 16 files changed, 1143 insertions(+), 755 deletions(-) create mode 100644 Documentation/ABI/testing/sysfs-kernel-mm-mempolicy create mode 100644 Documentation/ABI/testing/sysfs-kernel-mm-mempolicy-weighted-interleave -- 2.25.1

2 19

[openeuler:OLK-6.6 3098/3098] kernel/bpf-rvi/common_kfuncs.c:233:27: warning: no previous prototype for 'bpf_mem_failure'
by kernel test robot 05 Nov '25

05 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 534b306a9ab27f36c465a7c90a32a1b4ff3a641c commit: 09893ff02def3af3147aff056dca7bee71c432f0 [3098/3098] bpf-rvi: Add bpf_mem_failure kfunc config: x86_64-randconfig-001-20251104 (https://download.01.org/0day-ci/archive/20251105/202511051752.bxOVRS5t-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251105/202511051752.bxOVRS5t-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511051752.bxOVRS5t-lkp@intel.com/ All warnings (new ones prefixed by >>): kernel/bpf-rvi/common_kfuncs.c:27:32: warning: no previous prototype for 'bpf_mem_cgroup_from_task' [-Wmissing-prototypes] 27 | __bpf_kfunc struct mem_cgroup *bpf_mem_cgroup_from_task(struct task_struct *p) | ^~~~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:36:35: warning: no previous prototype for 'bpf_task_active_pid_ns' [-Wmissing-prototypes] 36 | __bpf_kfunc struct pid_namespace *bpf_task_active_pid_ns(struct task_struct *task) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:41:17: warning: no previous prototype for 'bpf_pidns_nr_tasks' [-Wmissing-prototypes] 41 | __bpf_kfunc u64 bpf_pidns_nr_tasks(struct pid_namespace *ns) | ^~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:55:17: warning: no previous prototype for 'bpf_pidns_last_pid' [-Wmissing-prototypes] 55 | __bpf_kfunc u32 bpf_pidns_last_pid(struct pid_namespace *ns) | ^~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:84:18: warning: no previous prototype for 'bpf_si_memswinfo' [-Wmissing-prototypes] 84 | __bpf_kfunc void bpf_si_memswinfo(struct bpf_sysinfo *bsi) | ^~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:94:27: warning: no previous prototype for 'bpf_page_counter_read' [-Wmissing-prototypes] 94 | __bpf_kfunc unsigned long bpf_page_counter_read(struct page_counter *counter) | ^~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:104:18: warning: no previous prototype for 'bpf_seq_file_append' [-Wmissing-prototypes] 104 | __bpf_kfunc void bpf_seq_file_append(struct seq_file *dst, struct seq_file *src) | ^~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:118:18: warning: no previous prototype for 'bpf_get_boottime_timens' [-Wmissing-prototypes] 118 | __bpf_kfunc void bpf_get_boottime_timens(struct task_struct *tsk, struct timespec64 *boottime) | ^~~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:124:27: warning: no previous prototype for 'bpf_get_total_forks' [-Wmissing-prototypes] 124 | __bpf_kfunc unsigned long bpf_get_total_forks(void) | ^~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:129:26: warning: no previous prototype for 'bpf_nr_running' [-Wmissing-prototypes] 129 | __bpf_kfunc unsigned int bpf_nr_running(void) | ^~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:134:32: warning: no previous prototype for 'bpf_nr_context_switches' [-Wmissing-prototypes] 134 | __bpf_kfunc unsigned long long bpf_nr_context_switches(void) | ^~~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:139:26: warning: no previous prototype for 'bpf_nr_iowait' [-Wmissing-prototypes] 139 | __bpf_kfunc unsigned int bpf_nr_iowait(void) | ^~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:145:26: warning: no previous prototype for 'bpf_kstat_softirqs_cpu' [-Wmissing-prototypes] 145 | __bpf_kfunc unsigned int bpf_kstat_softirqs_cpu(unsigned int irq, int cpu) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:150:27: warning: no previous prototype for 'bpf_kstat_cpu_irqs_sum' [-Wmissing-prototypes] 150 | __bpf_kfunc unsigned long bpf_kstat_cpu_irqs_sum(unsigned int cpu) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:155:18: warning: no previous prototype for 'bpf_kcpustat_cpu_fetch' [-Wmissing-prototypes] 155 | __bpf_kfunc void bpf_kcpustat_cpu_fetch(struct kernel_cpustat *dst, int cpu) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:164:27: warning: no previous prototype for 'bpf_mem_file_hugepage' [-Wmissing-prototypes] 164 | __bpf_kfunc unsigned long bpf_mem_file_hugepage(void) | ^~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:169:27: warning: no previous prototype for 'bpf_mem_file_pmdmapped' [-Wmissing-prototypes] 169 | __bpf_kfunc unsigned long bpf_mem_file_pmdmapped(void) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:174:27: warning: no previous prototype for 'bpf_mem_kreclaimable' [-Wmissing-prototypes] 174 | __bpf_kfunc unsigned long bpf_mem_kreclaimable(void) | ^~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:180:27: warning: no previous prototype for 'bpf_mem_totalcma' [-Wmissing-prototypes] 180 | __bpf_kfunc unsigned long bpf_mem_totalcma(void) | ^~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:185:27: warning: no previous prototype for 'bpf_mem_freecma' [-Wmissing-prototypes] 185 | __bpf_kfunc unsigned long bpf_mem_freecma(void) | ^~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:200:17: warning: no previous prototype for 'bpf_hugetlb_report_meminfo' [-Wmissing-prototypes] 200 | __bpf_kfunc int bpf_hugetlb_report_meminfo(struct bpf_mem_hugepage *hugepage_info) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ >> kernel/bpf-rvi/common_kfuncs.c:233:27: warning: no previous prototype for 'bpf_mem_failure' [-Wmissing-prototypes] 233 | __bpf_kfunc unsigned long bpf_mem_failure(void) | ^~~~~~~~~~~~~~~ vim +/bpf_mem_failure +233 kernel/bpf-rvi/common_kfuncs.c 179 > 180 __bpf_kfunc unsigned long bpf_mem_totalcma(void) 181 { 182 return totalcma_pages; 183 } 184 185 __bpf_kfunc unsigned long bpf_mem_freecma(void) 186 { 187 return global_zone_page_state(NR_FREE_CMA_PAGES); 188 } 189 190 struct bpf_mem_hugepage { 191 unsigned long total; 192 unsigned long free; 193 unsigned long rsvd; 194 unsigned long surp; 195 unsigned long size; 196 unsigned long hugetlb; 197 }; 198 199 #ifdef CONFIG_HUGETLB_PAGE 200 __bpf_kfunc int bpf_hugetlb_report_meminfo(struct bpf_mem_hugepage *hugepage_info) 201 { 202 struct hstate *h; 203 unsigned long total = 0; 204 205 if (!hugepages_supported()) 206 return -1; 207 208 for_each_hstate(h) { 209 unsigned long count = h->nr_huge_pages; 210 211 total += huge_page_size(h) * count; 212 213 if (h == &default_hstate) { 214 hugepage_info->total = count; 215 hugepage_info->free = h->free_huge_pages; 216 hugepage_info->rsvd = h->resv_huge_pages; 217 hugepage_info->surp = h->surplus_huge_pages; 218 hugepage_info->size = huge_page_size(h) / SZ_1K; 219 } 220 } 221 222 hugepage_info->hugetlb = total / SZ_1K; 223 return 0; 224 } 225 #else 226 __bpf_kfunc int bpf_hugetlb_report_meminfo(struct bpf_mem_hugepage *hugepage_info) 227 { 228 return -1; 229 } 230 #endif 231 232 #ifdef CONFIG_MEMORY_FAILURE > 233 __bpf_kfunc unsigned long bpf_mem_failure(void) 234 { 235 return atomic_long_read(&num_poisoned_pages) << (PAGE_SHIFT - 10); 236 } 237 #else 238 __bpf_kfunc unsigned long bpf_mem_failure(void) 239 { 240 return 0; 241 } 242 #endif 243 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3098/3098] kernel/bpf-rvi/common_kfuncs.c:200:17: warning: no previous prototype for 'bpf_hugetlb_report_meminfo'
by kernel test robot 05 Nov '25

05 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: fe656d8bc10b5c4ced04a8821909e64adc18a7ef commit: edd6acd9af851644d1673be6bebb16269c67e018 [3098/3098] bpf-rvi: Add bpf_hugetlb_report_meminfo kfunc config: x86_64-randconfig-001-20251104 (https://download.01.org/0day-ci/archive/20251105/202511051536.EFEBzJen-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251105/202511051536.EFEBzJen-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511051536.EFEBzJen-lkp@intel.com/ All warnings (new ones prefixed by >>): kernel/bpf-rvi/common_kfuncs.c:27:32: warning: no previous prototype for 'bpf_mem_cgroup_from_task' [-Wmissing-prototypes] 27 | __bpf_kfunc struct mem_cgroup *bpf_mem_cgroup_from_task(struct task_struct *p) | ^~~~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:36:35: warning: no previous prototype for 'bpf_task_active_pid_ns' [-Wmissing-prototypes] 36 | __bpf_kfunc struct pid_namespace *bpf_task_active_pid_ns(struct task_struct *task) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:41:17: warning: no previous prototype for 'bpf_pidns_nr_tasks' [-Wmissing-prototypes] 41 | __bpf_kfunc u64 bpf_pidns_nr_tasks(struct pid_namespace *ns) | ^~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:55:17: warning: no previous prototype for 'bpf_pidns_last_pid' [-Wmissing-prototypes] 55 | __bpf_kfunc u32 bpf_pidns_last_pid(struct pid_namespace *ns) | ^~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:84:18: warning: no previous prototype for 'bpf_si_memswinfo' [-Wmissing-prototypes] 84 | __bpf_kfunc void bpf_si_memswinfo(struct bpf_sysinfo *bsi) | ^~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:94:27: warning: no previous prototype for 'bpf_page_counter_read' [-Wmissing-prototypes] 94 | __bpf_kfunc unsigned long bpf_page_counter_read(struct page_counter *counter) | ^~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:104:18: warning: no previous prototype for 'bpf_seq_file_append' [-Wmissing-prototypes] 104 | __bpf_kfunc void bpf_seq_file_append(struct seq_file *dst, struct seq_file *src) | ^~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:118:18: warning: no previous prototype for 'bpf_get_boottime_timens' [-Wmissing-prototypes] 118 | __bpf_kfunc void bpf_get_boottime_timens(struct task_struct *tsk, struct timespec64 *boottime) | ^~~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:124:27: warning: no previous prototype for 'bpf_get_total_forks' [-Wmissing-prototypes] 124 | __bpf_kfunc unsigned long bpf_get_total_forks(void) | ^~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:129:26: warning: no previous prototype for 'bpf_nr_running' [-Wmissing-prototypes] 129 | __bpf_kfunc unsigned int bpf_nr_running(void) | ^~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:134:32: warning: no previous prototype for 'bpf_nr_context_switches' [-Wmissing-prototypes] 134 | __bpf_kfunc unsigned long long bpf_nr_context_switches(void) | ^~~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:139:26: warning: no previous prototype for 'bpf_nr_iowait' [-Wmissing-prototypes] 139 | __bpf_kfunc unsigned int bpf_nr_iowait(void) | ^~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:145:26: warning: no previous prototype for 'bpf_kstat_softirqs_cpu' [-Wmissing-prototypes] 145 | __bpf_kfunc unsigned int bpf_kstat_softirqs_cpu(unsigned int irq, int cpu) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:150:27: warning: no previous prototype for 'bpf_kstat_cpu_irqs_sum' [-Wmissing-prototypes] 150 | __bpf_kfunc unsigned long bpf_kstat_cpu_irqs_sum(unsigned int cpu) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:155:18: warning: no previous prototype for 'bpf_kcpustat_cpu_fetch' [-Wmissing-prototypes] 155 | __bpf_kfunc void bpf_kcpustat_cpu_fetch(struct kernel_cpustat *dst, int cpu) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:164:27: warning: no previous prototype for 'bpf_mem_file_hugepage' [-Wmissing-prototypes] 164 | __bpf_kfunc unsigned long bpf_mem_file_hugepage(void) | ^~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:169:27: warning: no previous prototype for 'bpf_mem_file_pmdmapped' [-Wmissing-prototypes] 169 | __bpf_kfunc unsigned long bpf_mem_file_pmdmapped(void) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:174:27: warning: no previous prototype for 'bpf_mem_kreclaimable' [-Wmissing-prototypes] 174 | __bpf_kfunc unsigned long bpf_mem_kreclaimable(void) | ^~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:180:27: warning: no previous prototype for 'bpf_mem_totalcma' [-Wmissing-prototypes] 180 | __bpf_kfunc unsigned long bpf_mem_totalcma(void) | ^~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:185:27: warning: no previous prototype for 'bpf_mem_freecma' [-Wmissing-prototypes] 185 | __bpf_kfunc unsigned long bpf_mem_freecma(void) | ^~~~~~~~~~~~~~~ >> kernel/bpf-rvi/common_kfuncs.c:200:17: warning: no previous prototype for 'bpf_hugetlb_report_meminfo' [-Wmissing-prototypes] 200 | __bpf_kfunc int bpf_hugetlb_report_meminfo(struct bpf_mem_hugepage *hugepage_info) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ vim +/bpf_hugetlb_report_meminfo +200 kernel/bpf-rvi/common_kfuncs.c 198 199 #ifdef CONFIG_HUGETLB_PAGE > 200 __bpf_kfunc int bpf_hugetlb_report_meminfo(struct bpf_mem_hugepage *hugepage_info) 201 { 202 struct hstate *h; 203 unsigned long total = 0; 204 205 if (!hugepages_supported()) 206 return -1; 207 208 for_each_hstate(h) { 209 unsigned long count = h->nr_huge_pages; 210 211 total += huge_page_size(h) * count; 212 213 if (h == &default_hstate) { 214 hugepage_info->total = count; 215 hugepage_info->free = h->free_huge_pages; 216 hugepage_info->rsvd = h->resv_huge_pages; 217 hugepage_info->surp = h->surplus_huge_pages; 218 hugepage_info->size = huge_page_size(h) / SZ_1K; 219 } 220 } 221 222 hugepage_info->hugetlb = total / SZ_1K; 223 return 0; 224 } 225 #else 226 __bpf_kfunc int bpf_hugetlb_report_meminfo(struct bpf_mem_hugepage *hugepage_info) 227 { 228 return -1; 229 } 230 #endif 231 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3098/3098] kernel/bpf-rvi/common_kfuncs.c:179:27: warning: no previous prototype for 'bpf_mem_totalcma'
by kernel test robot 05 Nov '25

05 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: fe656d8bc10b5c4ced04a8821909e64adc18a7ef commit: 9c449e4d9af5b69a1b9fdae9e3f18dc1515635b8 [3098/3098] bpf-rvi: Add bpf_mem_{total,free}cma kfunc config: x86_64-randconfig-001-20251104 (https://download.01.org/0day-ci/archive/20251105/202511051322.XbdPyERX-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251105/202511051322.XbdPyERX-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511051322.XbdPyERX-lkp@intel.com/ All warnings (new ones prefixed by >>): kernel/bpf-rvi/common_kfuncs.c:26:32: warning: no previous prototype for 'bpf_mem_cgroup_from_task' [-Wmissing-prototypes] 26 | __bpf_kfunc struct mem_cgroup *bpf_mem_cgroup_from_task(struct task_struct *p) | ^~~~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:35:35: warning: no previous prototype for 'bpf_task_active_pid_ns' [-Wmissing-prototypes] 35 | __bpf_kfunc struct pid_namespace *bpf_task_active_pid_ns(struct task_struct *task) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:40:17: warning: no previous prototype for 'bpf_pidns_nr_tasks' [-Wmissing-prototypes] 40 | __bpf_kfunc u64 bpf_pidns_nr_tasks(struct pid_namespace *ns) | ^~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:54:17: warning: no previous prototype for 'bpf_pidns_last_pid' [-Wmissing-prototypes] 54 | __bpf_kfunc u32 bpf_pidns_last_pid(struct pid_namespace *ns) | ^~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:83:18: warning: no previous prototype for 'bpf_si_memswinfo' [-Wmissing-prototypes] 83 | __bpf_kfunc void bpf_si_memswinfo(struct bpf_sysinfo *bsi) | ^~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:93:27: warning: no previous prototype for 'bpf_page_counter_read' [-Wmissing-prototypes] 93 | __bpf_kfunc unsigned long bpf_page_counter_read(struct page_counter *counter) | ^~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:103:18: warning: no previous prototype for 'bpf_seq_file_append' [-Wmissing-prototypes] 103 | __bpf_kfunc void bpf_seq_file_append(struct seq_file *dst, struct seq_file *src) | ^~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:117:18: warning: no previous prototype for 'bpf_get_boottime_timens' [-Wmissing-prototypes] 117 | __bpf_kfunc void bpf_get_boottime_timens(struct task_struct *tsk, struct timespec64 *boottime) | ^~~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:123:27: warning: no previous prototype for 'bpf_get_total_forks' [-Wmissing-prototypes] 123 | __bpf_kfunc unsigned long bpf_get_total_forks(void) | ^~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:128:26: warning: no previous prototype for 'bpf_nr_running' [-Wmissing-prototypes] 128 | __bpf_kfunc unsigned int bpf_nr_running(void) | ^~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:133:32: warning: no previous prototype for 'bpf_nr_context_switches' [-Wmissing-prototypes] 133 | __bpf_kfunc unsigned long long bpf_nr_context_switches(void) | ^~~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:138:26: warning: no previous prototype for 'bpf_nr_iowait' [-Wmissing-prototypes] 138 | __bpf_kfunc unsigned int bpf_nr_iowait(void) | ^~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:144:26: warning: no previous prototype for 'bpf_kstat_softirqs_cpu' [-Wmissing-prototypes] 144 | __bpf_kfunc unsigned int bpf_kstat_softirqs_cpu(unsigned int irq, int cpu) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:149:27: warning: no previous prototype for 'bpf_kstat_cpu_irqs_sum' [-Wmissing-prototypes] 149 | __bpf_kfunc unsigned long bpf_kstat_cpu_irqs_sum(unsigned int cpu) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:154:18: warning: no previous prototype for 'bpf_kcpustat_cpu_fetch' [-Wmissing-prototypes] 154 | __bpf_kfunc void bpf_kcpustat_cpu_fetch(struct kernel_cpustat *dst, int cpu) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:163:27: warning: no previous prototype for 'bpf_mem_file_hugepage' [-Wmissing-prototypes] 163 | __bpf_kfunc unsigned long bpf_mem_file_hugepage(void) | ^~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:168:27: warning: no previous prototype for 'bpf_mem_file_pmdmapped' [-Wmissing-prototypes] 168 | __bpf_kfunc unsigned long bpf_mem_file_pmdmapped(void) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:173:27: warning: no previous prototype for 'bpf_mem_kreclaimable' [-Wmissing-prototypes] 173 | __bpf_kfunc unsigned long bpf_mem_kreclaimable(void) | ^~~~~~~~~~~~~~~~~~~~ >> kernel/bpf-rvi/common_kfuncs.c:179:27: warning: no previous prototype for 'bpf_mem_totalcma' [-Wmissing-prototypes] 179 | __bpf_kfunc unsigned long bpf_mem_totalcma(void) | ^~~~~~~~~~~~~~~~ >> kernel/bpf-rvi/common_kfuncs.c:184:27: warning: no previous prototype for 'bpf_mem_freecma' [-Wmissing-prototypes] 184 | __bpf_kfunc unsigned long bpf_mem_freecma(void) | ^~~~~~~~~~~~~~~ vim +/bpf_mem_totalcma +179 kernel/bpf-rvi/common_kfuncs.c 178 > 179 __bpf_kfunc unsigned long bpf_mem_totalcma(void) 180 { 181 return totalcma_pages; 182 } 183 > 184 __bpf_kfunc unsigned long bpf_mem_freecma(void) 185 { 186 return global_zone_page_state(NR_FREE_CMA_PAGES); 187 } 188 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3075/3075] drivers/ub/ubus/ubus_entity.c:56:6: warning: no previous prototype for function 'ub_entity_num_free'
by kernel test robot 05 Nov '25

05 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: f1418110051edb8e47923b009bbd051f7c06ad1a commit: 8ae16d21707c9299ad950c2511508a3d3407de7a [3075/3075] ub:ubus: Support UB device enabling basic interface config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20251105/202511051215.u37nznQt-lkp@…) compiler: clang version 19.1.7 (https://github.com/llvm/llvm-project cd708029e0b2869e80abe31ddb175f7c35361f90) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251105/202511051215.u37nznQt-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511051215.u37nznQt-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/ub/ubus/ubus_entity.c:35:19: warning: no previous prototype for function 'ub_alloc_ent' [-Wmissing-prototypes] 35 | struct ub_entity *ub_alloc_ent(void) | ^ drivers/ub/ubus/ubus_entity.c:35:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 35 | struct ub_entity *ub_alloc_ent(void) | ^ | static >> drivers/ub/ubus/ubus_entity.c:56:6: warning: no previous prototype for function 'ub_entity_num_free' [-Wmissing-prototypes] 56 | void ub_entity_num_free(struct ub_entity *uent) | ^ drivers/ub/ubus/ubus_entity.c:56:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 56 | void ub_entity_num_free(struct ub_entity *uent) | ^ | static drivers/ub/ubus/ubus_entity.c:157:5: warning: no previous prototype for function 'ub_setup_ent' [-Wmissing-prototypes] 157 | int ub_setup_ent(struct ub_entity *uent) | ^ drivers/ub/ubus/ubus_entity.c:157:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 157 | int ub_setup_ent(struct ub_entity *uent) | ^ | static drivers/ub/ubus/ubus_entity.c:220:6: warning: no previous prototype for function 'ub_entity_add' [-Wmissing-prototypes] 220 | void ub_entity_add(struct ub_entity *uent, void *ctx) | ^ drivers/ub/ubus/ubus_entity.c:220:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 220 | void ub_entity_add(struct ub_entity *uent, void *ctx) | ^ | static drivers/ub/ubus/ubus_entity.c:263:6: warning: no previous prototype for function 'ub_start_ent' [-Wmissing-prototypes] 263 | void ub_start_ent(struct ub_entity *uent) | ^ drivers/ub/ubus/ubus_entity.c:263:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 263 | void ub_start_ent(struct ub_entity *uent) | ^ | static drivers/ub/ubus/ubus_entity.c:312:6: warning: no previous prototype for function 'ub_remove_ent' [-Wmissing-prototypes] 312 | void ub_remove_ent(struct ub_entity *uent) | ^ drivers/ub/ubus/ubus_entity.c:312:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 312 | void ub_remove_ent(struct ub_entity *uent) | ^ | static drivers/ub/ubus/ubus_entity.c:343:6: warning: no previous prototype for function 'ub_stop_entities' [-Wmissing-prototypes] 343 | void ub_stop_entities(void) | ^ drivers/ub/ubus/ubus_entity.c:343:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 343 | void ub_stop_entities(void) | ^ | static drivers/ub/ubus/ubus_entity.c:347:6: warning: no previous prototype for function 'ub_remove_entities' [-Wmissing-prototypes] 347 | void ub_remove_entities(void) | ^ drivers/ub/ubus/ubus_entity.c:347:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 347 | void ub_remove_entities(void) | ^ | static 8 warnings generated. vim +/ub_entity_num_free +56 drivers/ub/ubus/ubus_entity.c 34 > 35 struct ub_entity *ub_alloc_ent(void) 36 { 37 struct ub_entity *uent; 38 39 uent = kzalloc(sizeof(*uent), GFP_KERNEL); 40 if (!uent) 41 return NULL; 42 43 INIT_LIST_HEAD(&uent->node); 44 INIT_LIST_HEAD(&uent->cna_list); 45 46 uent->dev.type = &ub_dev_type; 47 uent->cna = 0; 48 49 ub_entity_assign_priv_flag(uent, UB_ENTITY_DETACHED, true); 50 51 return uent; 52 } 53 EXPORT_SYMBOL_GPL(ub_alloc_ent); 54 55 static DEFINE_IDA(uent_num_ida); > 56 void ub_entity_num_free(struct ub_entity *uent) 57 { 58 ida_free(&uent_num_ida, uent->uent_num); 59 } 60 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 0/3] CVE-2025-22121
by Yongjian Sun 05 Nov '25

05 Nov '25

Ye Bin (2): ext4: introduce ITAIL helper ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() Yongjian Sun (1): ext4: Restore the deleted check paths of the xattr. fs/ext4/inode.c | 5 +++++ fs/ext4/xattr.c | 15 ++++++--------- fs/ext4/xattr.h | 10 ++++++++++ 3 files changed, 21 insertions(+), 9 deletions(-) -- 2.39.2

2 4

[openeuler:OLK-6.6 3098/3098] kernel/bpf-rvi/common_kfuncs.c:162:27: warning: no previous prototype for 'bpf_mem_file_hugepage'
by kernel test robot 05 Nov '25

05 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: f1418110051edb8e47923b009bbd051f7c06ad1a commit: d97bc9c8827bb5cd9f66dab10e0b505a879256e2 [3098/3098] bpf-rvi: Add bpf_mem_{file_{hugepage,pmdmapped},kreclaimable} kfunc config: x86_64-randconfig-001-20251104 (https://download.01.org/0day-ci/archive/20251105/202511051134.JuwQrZOr-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251105/202511051134.JuwQrZOr-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511051134.JuwQrZOr-lkp@intel.com/ All warnings (new ones prefixed by >>): kernel/bpf-rvi/common_kfuncs.c:25:32: warning: no previous prototype for 'bpf_mem_cgroup_from_task' [-Wmissing-prototypes] 25 | __bpf_kfunc struct mem_cgroup *bpf_mem_cgroup_from_task(struct task_struct *p) | ^~~~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:34:35: warning: no previous prototype for 'bpf_task_active_pid_ns' [-Wmissing-prototypes] 34 | __bpf_kfunc struct pid_namespace *bpf_task_active_pid_ns(struct task_struct *task) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:39:17: warning: no previous prototype for 'bpf_pidns_nr_tasks' [-Wmissing-prototypes] 39 | __bpf_kfunc u64 bpf_pidns_nr_tasks(struct pid_namespace *ns) | ^~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:53:17: warning: no previous prototype for 'bpf_pidns_last_pid' [-Wmissing-prototypes] 53 | __bpf_kfunc u32 bpf_pidns_last_pid(struct pid_namespace *ns) | ^~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:82:18: warning: no previous prototype for 'bpf_si_memswinfo' [-Wmissing-prototypes] 82 | __bpf_kfunc void bpf_si_memswinfo(struct bpf_sysinfo *bsi) | ^~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:92:27: warning: no previous prototype for 'bpf_page_counter_read' [-Wmissing-prototypes] 92 | __bpf_kfunc unsigned long bpf_page_counter_read(struct page_counter *counter) | ^~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:102:18: warning: no previous prototype for 'bpf_seq_file_append' [-Wmissing-prototypes] 102 | __bpf_kfunc void bpf_seq_file_append(struct seq_file *dst, struct seq_file *src) | ^~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:116:18: warning: no previous prototype for 'bpf_get_boottime_timens' [-Wmissing-prototypes] 116 | __bpf_kfunc void bpf_get_boottime_timens(struct task_struct *tsk, struct timespec64 *boottime) | ^~~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:122:27: warning: no previous prototype for 'bpf_get_total_forks' [-Wmissing-prototypes] 122 | __bpf_kfunc unsigned long bpf_get_total_forks(void) | ^~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:127:26: warning: no previous prototype for 'bpf_nr_running' [-Wmissing-prototypes] 127 | __bpf_kfunc unsigned int bpf_nr_running(void) | ^~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:132:32: warning: no previous prototype for 'bpf_nr_context_switches' [-Wmissing-prototypes] 132 | __bpf_kfunc unsigned long long bpf_nr_context_switches(void) | ^~~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:137:26: warning: no previous prototype for 'bpf_nr_iowait' [-Wmissing-prototypes] 137 | __bpf_kfunc unsigned int bpf_nr_iowait(void) | ^~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:143:26: warning: no previous prototype for 'bpf_kstat_softirqs_cpu' [-Wmissing-prototypes] 143 | __bpf_kfunc unsigned int bpf_kstat_softirqs_cpu(unsigned int irq, int cpu) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:148:27: warning: no previous prototype for 'bpf_kstat_cpu_irqs_sum' [-Wmissing-prototypes] 148 | __bpf_kfunc unsigned long bpf_kstat_cpu_irqs_sum(unsigned int cpu) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:153:18: warning: no previous prototype for 'bpf_kcpustat_cpu_fetch' [-Wmissing-prototypes] 153 | __bpf_kfunc void bpf_kcpustat_cpu_fetch(struct kernel_cpustat *dst, int cpu) | ^~~~~~~~~~~~~~~~~~~~~~ >> kernel/bpf-rvi/common_kfuncs.c:162:27: warning: no previous prototype for 'bpf_mem_file_hugepage' [-Wmissing-prototypes] 162 | __bpf_kfunc unsigned long bpf_mem_file_hugepage(void) | ^~~~~~~~~~~~~~~~~~~~~ >> kernel/bpf-rvi/common_kfuncs.c:167:27: warning: no previous prototype for 'bpf_mem_file_pmdmapped' [-Wmissing-prototypes] 167 | __bpf_kfunc unsigned long bpf_mem_file_pmdmapped(void) | ^~~~~~~~~~~~~~~~~~~~~~ >> kernel/bpf-rvi/common_kfuncs.c:172:27: warning: no previous prototype for 'bpf_mem_kreclaimable' [-Wmissing-prototypes] 172 | __bpf_kfunc unsigned long bpf_mem_kreclaimable(void) | ^~~~~~~~~~~~~~~~~~~~ vim +/bpf_mem_file_hugepage +162 kernel/bpf-rvi/common_kfuncs.c 157 158 /* 159 * Meminfo related kfuncs 160 */ 161 > 162 __bpf_kfunc unsigned long bpf_mem_file_hugepage(void) 163 { 164 return global_node_page_state(NR_FILE_THPS); 165 } 166 > 167 __bpf_kfunc unsigned long bpf_mem_file_pmdmapped(void) 168 { 169 return global_node_page_state(NR_FILE_PMDMAPPED); 170 } 171 > 172 __bpf_kfunc unsigned long bpf_mem_kreclaimable(void) 173 { 174 return global_node_page_state_pages(NR_SLAB_RECLAIMABLE_B) + 175 global_node_page_state(NR_KERNEL_MISC_RECLAIMABLE); 176 } 177 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1930/1930] drivers/video/fbdev/core/sysfillrect.c:291:51: sparse: sparse: cast removes address space '<asn:2>' of expression
by kernel test robot 05 Nov '25

05 Nov '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: ef0390f1259df6b9ca86aa41a598fd07c29ba602 commit: 7389066b79d5dc829e15de2509e43a66bf24e296 [1930/1930] fbdev: Fix out-of-bounds issue in sys_fillrect() config: arm64-randconfig-r134-20251105 (https://download.01.org/0day-ci/archive/20251105/202511051110.kqecU8nf-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251105/202511051110.kqecU8nf-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511051110.kqecU8nf-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/video/fbdev/core/sysfillrect.c:291:51: sparse: sparse: cast removes address space '<asn:2>' of expression drivers/video/fbdev/core/sysfillrect.c:329:32: sparse: sparse: incorrect type in argument 1 (different base types) @@ expected unsigned long word @@ got restricted __le64 [usertype] @@ drivers/video/fbdev/core/sysfillrect.c:329:32: sparse: expected unsigned long word drivers/video/fbdev/core/sysfillrect.c:329:32: sparse: got restricted __le64 [usertype] drivers/video/fbdev/core/sysfillrect.c:329:32: sparse: sparse: cast to restricted __le64 vim +291 drivers/video/fbdev/core/sysfillrect.c 242 243 void sys_fillrect(struct fb_info *p, const struct fb_fillrect *rect) 244 { 245 unsigned long pat, pat2, fg; 246 unsigned long width = rect->width, height = rect->height; 247 int bits = BITS_PER_LONG, bytes = bits >> 3; 248 u32 bpp = p->var.bits_per_pixel; 249 unsigned long *dst; 250 int dst_idx, left; 251 long dst_offset; 252 253 if (p->state != FBINFO_STATE_RUNNING) 254 return; 255 256 if (p->fix.visual == FB_VISUAL_TRUECOLOR || 257 p->fix.visual == FB_VISUAL_DIRECTCOLOR ) 258 fg = ((u32 *) (p->pseudo_palette))[rect->color]; 259 else 260 fg = rect->color; 261 262 pat = pixel_to_pat( bpp, fg); 263 264 dst = (unsigned long *)((unsigned long)p->screen_base & ~(bytes-1)); 265 dst_idx = ((unsigned long)p->screen_base & (bytes - 1))*8; 266 dst_idx += rect->dy*p->fix.line_length*8+rect->dx*bpp; 267 /* FIXME For now we support 1-32 bpp only */ 268 left = bits % bpp; 269 if (p->fbops->fb_sync) 270 p->fbops->fb_sync(p); 271 if (!left) { 272 void (*fill_op32)(struct fb_info *p, unsigned long *dst, 273 int dst_idx, unsigned long pat, unsigned n, 274 int bits) = NULL; 275 276 switch (rect->rop) { 277 case ROP_XOR: 278 fill_op32 = bitfill_aligned_rev; 279 break; 280 case ROP_COPY: 281 fill_op32 = bitfill_aligned; 282 break; 283 default: 284 printk( KERN_ERR "cfb_fillrect(): unknown rop, " 285 "defaulting to ROP_COPY\n"); 286 fill_op32 = bitfill_aligned; 287 break; 288 } 289 while (height--) { 290 dst += dst_idx >> (ffs(bits) - 1); > 291 dst_offset = (long)dst - (long)p->screen_base; 292 if (dst_offset < 0 || dst_offset >= p->fix.smem_len) { 293 pr_err("dst offset out of bound: dst_offset(%ld)", dst_offset); 294 return; 295 } 296 dst_idx &= (bits - 1); 297 fill_op32(p, dst, dst_idx, pat, width*bpp, bits); 298 dst_idx += p->fix.line_length*8; 299 } 300 } else { 301 int right, r; 302 void (*fill_op)(struct fb_info *p, unsigned long *dst, 303 int dst_idx, unsigned long pat, int left, 304 int right, unsigned n, int bits) = NULL; 305 #ifdef __LITTLE_ENDIAN 306 right = left; 307 left = bpp - right; 308 #else 309 right = bpp - left; 310 #endif 311 switch (rect->rop) { 312 case ROP_XOR: 313 fill_op = bitfill_unaligned_rev; 314 break; 315 case ROP_COPY: 316 fill_op = bitfill_unaligned; 317 break; 318 default: 319 printk(KERN_ERR "sys_fillrect(): unknown rop, " 320 "defaulting to ROP_COPY\n"); 321 fill_op = bitfill_unaligned; 322 break; 323 } 324 while (height--) { 325 dst += dst_idx / bits; 326 dst_idx &= (bits - 1); 327 r = dst_idx % bpp; 328 /* rotate pattern to the correct start position */ 329 pat2 = le_long_to_cpu(rolx(cpu_to_le_long(pat), r, bpp)); 330 fill_op(p, dst, dst_idx, pat2, left, right, 331 width*bpp, bits); 332 dst_idx += p->fix.line_length*8; 333 } 334 } 335 } 336 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3099/3099] mm/shmem.o: warning: objtool: .init.text: unexpected end of section
by kernel test robot 05 Nov '25

05 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: f1418110051edb8e47923b009bbd051f7c06ad1a commit: 8be4868c4f23d36ca7409bcd5492fb554933bb64 [3099/3099] mm: shmem: override mTHP shmem default with a kernel parameter config: loongarch-randconfig-002-20251104 (https://download.01.org/0day-ci/archive/20251105/202511051154.EI2nBnB9-lkp@…) compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project d2625a438020ad35330cda29c3def102c1687b1b) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251105/202511051154.EI2nBnB9-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511051154.EI2nBnB9-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from mm/shmem.c:28: In file included from include/linux/ramfs.h:5: In file included from include/linux/fs_parser.h:11: In file included from include/linux/fs_context.h:14: In file included from include/linux/security.h:33: In file included from include/linux/mm.h:2253: include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ mm/shmem.c:1654:24: warning: default initialization of an object of type 'struct vm_area_struct' with const member leaves the object uninitialized [-Wdefault-const-init-field-unsafe] 1654 | struct vm_area_struct pvma; | ^ include/linux/mm_types.h:629:20: note: member 'vm_flags' declared 'const' here 629 | const vm_flags_t vm_flags; | ^ mm/shmem.c:1802:24: warning: default initialization of an object of type 'struct vm_area_struct' with const member leaves the object uninitialized [-Wdefault-const-init-field-unsafe] 1802 | struct vm_area_struct pvma; | ^ include/linux/mm_types.h:629:20: note: member 'vm_flags' declared 'const' here 629 | const vm_flags_t vm_flags; | ^ 3 warnings generated. mm/shmem.o: warning: objtool: shmem_enabled_store() falls through to next function thpsize_shmem_enabled_show() >> mm/shmem.o: warning: objtool: .init.text: unexpected end of section -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb
by Fanhua Li 05 Nov '25

05 Nov '25

From: Alan Stern <stern(a)rowland.harvard.edu> stable inclusion from stable-v4.19.291 commit 53c250ea57cf03af41339234b9855ae284f9db91 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID0UAL CVE: CVE-2023-53548 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 5e1627cb43ddf1b24b92eb26f8d958a3f5676ccb upstream. The syzbot fuzzer identified a problem in the usbnet driver: usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 0 PID: 754 at drivers/usb/core/urb.c:504 usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504 Modules linked in: CPU: 0 PID: 754 Comm: kworker/0:2 Not tainted 6.4.0-rc7-syzkaller-00014-g692b7dc87ca6 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 Workqueue: mld mld_ifc_work RIP: 0010:usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504 Code: 7c 24 18 e8 2c b4 5b fb 48 8b 7c 24 18 e8 42 07 f0 fe 41 89 d8 44 89 e1 4c 89 ea 48 89 c6 48 c7 c7 a0 c9 fc 8a e8 5a 6f 23 fb <0f> 0b e9 58 f8 ff ff e8 fe b3 5b fb 48 81 c5 c0 05 00 00 e9 84 f7 RSP: 0018:ffffc9000463f568 EFLAGS: 00010086 RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000 RDX: ffff88801eb28000 RSI: ffffffff814c03b7 RDI: 0000000000000001 RBP: ffff8881443b7190 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000003 R13: ffff88802a77cb18 R14: 0000000000000003 R15: ffff888018262500 FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000556a99c15a18 CR3: 0000000028c71000 CR4: 0000000000350ef0 Call Trace: <TASK> usbnet_start_xmit+0xfe5/0x2190 drivers/net/usb/usbnet.c:1453 __netdev_start_xmit include/linux/netdevice.h:4918 [inline] netdev_start_xmit include/linux/netdevice.h:4932 [inline] xmit_one net/core/dev.c:3578 [inline] dev_hard_start_xmit+0x187/0x700 net/core/dev.c:3594 ... This bug is caused by the fact that usbnet trusts the bulk endpoint addresses its probe routine receives in the driver_info structure, and it does not check to see that these endpoints actually exist and have the expected type and directions. The fix is simply to add such a check. Reported-and-tested-by: syzbot+63ee658b9a100ffadbe2(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-usb/000000000000a56e9105d0cec021@google.com/ Signed-off-by: Alan Stern <stern(a)rowland.harvard.edu> CC: Oliver Neukum <oneukum(a)suse.com> Link: https://lore.kernel.org/r/ea152b6d-44df-4f8a-95c6-4db51143dcc1@rowland.harv… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Fanhua Li <lifanhua5(a)huawei.com> --- drivers/net/usb/usbnet.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c index 1316f5b0c0d7e..cb27b076e4710 100644 --- a/drivers/net/usb/usbnet.c +++ b/drivers/net/usb/usbnet.c @@ -1762,6 +1762,10 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod) } else if (!info->in || !info->out) status = usbnet_get_endpoints (dev, udev); else { + u8 ep_addrs[3] = { + info->in + USB_DIR_IN, info->out + USB_DIR_OUT, 0 + }; + dev->in = usb_rcvbulkpipe (xdev, info->in); dev->out = usb_sndbulkpipe (xdev, info->out); if (!(info->flags & FLAG_NO_SETINT)) @@ -1771,6 +1775,8 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod) else status = 0; + if (status == 0 && !usb_check_bulk_endpoints(udev, ep_addrs)) + status = -EINVAL; } if (status >= 0 && dev->status) status = init_status (dev, udev); -- 2.43.0

2 1

[openeuler:OLK-6.6 3098/3098] kernel/bpf-rvi/common_kfuncs.c:143:26: warning: no previous prototype for 'bpf_kstat_softirqs_cpu'
by kernel test robot 05 Nov '25

05 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: faa195bad3afed3c326917fb4cd36e0bd311220c commit: e553ff4b5e1eed196ab68b4efd4a189c45396667 [3098/3098] bpf-rvi: Add kstat_ & kcpustat_ kfuncs config: x86_64-randconfig-001-20251104 (https://download.01.org/0day-ci/archive/20251105/202511050941.wo8YZedF-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251105/202511050941.wo8YZedF-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511050941.wo8YZedF-lkp@intel.com/ All warnings (new ones prefixed by >>): kernel/bpf-rvi/common_kfuncs.c:25:32: warning: no previous prototype for 'bpf_mem_cgroup_from_task' [-Wmissing-prototypes] 25 | __bpf_kfunc struct mem_cgroup *bpf_mem_cgroup_from_task(struct task_struct *p) | ^~~~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:34:35: warning: no previous prototype for 'bpf_task_active_pid_ns' [-Wmissing-prototypes] 34 | __bpf_kfunc struct pid_namespace *bpf_task_active_pid_ns(struct task_struct *task) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:39:17: warning: no previous prototype for 'bpf_pidns_nr_tasks' [-Wmissing-prototypes] 39 | __bpf_kfunc u64 bpf_pidns_nr_tasks(struct pid_namespace *ns) | ^~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:53:17: warning: no previous prototype for 'bpf_pidns_last_pid' [-Wmissing-prototypes] 53 | __bpf_kfunc u32 bpf_pidns_last_pid(struct pid_namespace *ns) | ^~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:82:18: warning: no previous prototype for 'bpf_si_memswinfo' [-Wmissing-prototypes] 82 | __bpf_kfunc void bpf_si_memswinfo(struct bpf_sysinfo *bsi) | ^~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:92:27: warning: no previous prototype for 'bpf_page_counter_read' [-Wmissing-prototypes] 92 | __bpf_kfunc unsigned long bpf_page_counter_read(struct page_counter *counter) | ^~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:102:18: warning: no previous prototype for 'bpf_seq_file_append' [-Wmissing-prototypes] 102 | __bpf_kfunc void bpf_seq_file_append(struct seq_file *dst, struct seq_file *src) | ^~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:116:18: warning: no previous prototype for 'bpf_get_boottime_timens' [-Wmissing-prototypes] 116 | __bpf_kfunc void bpf_get_boottime_timens(struct task_struct *tsk, struct timespec64 *boottime) | ^~~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:122:27: warning: no previous prototype for 'bpf_get_total_forks' [-Wmissing-prototypes] 122 | __bpf_kfunc unsigned long bpf_get_total_forks(void) | ^~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:127:26: warning: no previous prototype for 'bpf_nr_running' [-Wmissing-prototypes] 127 | __bpf_kfunc unsigned int bpf_nr_running(void) | ^~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:132:32: warning: no previous prototype for 'bpf_nr_context_switches' [-Wmissing-prototypes] 132 | __bpf_kfunc unsigned long long bpf_nr_context_switches(void) | ^~~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:137:26: warning: no previous prototype for 'bpf_nr_iowait' [-Wmissing-prototypes] 137 | __bpf_kfunc unsigned int bpf_nr_iowait(void) | ^~~~~~~~~~~~~ >> kernel/bpf-rvi/common_kfuncs.c:143:26: warning: no previous prototype for 'bpf_kstat_softirqs_cpu' [-Wmissing-prototypes] 143 | __bpf_kfunc unsigned int bpf_kstat_softirqs_cpu(unsigned int irq, int cpu) | ^~~~~~~~~~~~~~~~~~~~~~ >> kernel/bpf-rvi/common_kfuncs.c:148:27: warning: no previous prototype for 'bpf_kstat_cpu_irqs_sum' [-Wmissing-prototypes] 148 | __bpf_kfunc unsigned long bpf_kstat_cpu_irqs_sum(unsigned int cpu) | ^~~~~~~~~~~~~~~~~~~~~~ >> kernel/bpf-rvi/common_kfuncs.c:153:18: warning: no previous prototype for 'bpf_kcpustat_cpu_fetch' [-Wmissing-prototypes] 153 | __bpf_kfunc void bpf_kcpustat_cpu_fetch(struct kernel_cpustat *dst, int cpu) | ^~~~~~~~~~~~~~~~~~~~~~ vim +/bpf_kstat_softirqs_cpu +143 kernel/bpf-rvi/common_kfuncs.c 126 > 127 __bpf_kfunc unsigned int bpf_nr_running(void) 128 { 129 return nr_running(); 130 } 131 > 132 __bpf_kfunc unsigned long long bpf_nr_context_switches(void) 133 { 134 return nr_context_switches(); 135 } 136 > 137 __bpf_kfunc unsigned int bpf_nr_iowait(void) 138 { 139 return nr_iowait(); 140 } 141 142 /* Kernel statistics for CPU accounting */ > 143 __bpf_kfunc unsigned int bpf_kstat_softirqs_cpu(unsigned int irq, int cpu) 144 { 145 return kstat_softirqs_cpu(irq, cpu); 146 } 147 > 148 __bpf_kfunc unsigned long bpf_kstat_cpu_irqs_sum(unsigned int cpu) 149 { 150 return kstat_cpu_irqs_sum(cpu); 151 } 152 > 153 __bpf_kfunc void bpf_kcpustat_cpu_fetch(struct kernel_cpustat *dst, int cpu) 154 { 155 kcpustat_cpu_fetch(dst, cpu); 156 } 157 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] net/oenetcls: Add mode 2 for rps numa affinity
by Yue Haibing 05 Nov '25

05 Nov '25

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/ICBFCS -------------------------------- Add numa affinity RPS to balance softirq for vm. Signed-off-by: Yue Haibing <yuehaibing(a)huawei.com> --- net/oenetcls/oenetcls.h | 2 ++ net/oenetcls/oenetcls_flow.c | 30 +++++++++++++++++++ net/oenetcls/oenetcls_main.c | 56 +++++++++++++++++++++++++++++++----- 3 files changed, 81 insertions(+), 7 deletions(-) diff --git a/net/oenetcls/oenetcls.h b/net/oenetcls/oenetcls.h index f2726582db91..81f752590f9f 100644 --- a/net/oenetcls/oenetcls.h +++ b/net/oenetcls/oenetcls.h @@ -131,6 +131,8 @@ struct cfg_param { extern int match_ip_flag; extern int debug; +extern int mode; +extern int rcpu_probability; extern int oecls_netdev_num; extern int oecls_numa_num; diff --git a/net/oenetcls/oenetcls_flow.c b/net/oenetcls/oenetcls_flow.c index 62bad2408966..9b2d08d99418 100644 --- a/net/oenetcls/oenetcls_flow.c +++ b/net/oenetcls/oenetcls_flow.c @@ -171,6 +171,17 @@ static void set_oecls_cpu(struct net_device *dev, struct sk_buff *skb, rflow->cpu = next_cpu; } +static bool oecls_do_hash(void) +{ + if (rcpu_probability <= 0) + return false; + + if (rcpu_probability >= 100) + return true; + + return prandom_u32() % 100 < rcpu_probability; +} + static int get_cpu_in_mask(int tcpu, u32 hash) { const struct cpumask *mask; @@ -219,6 +230,25 @@ static void __oecls_set_cpu(struct sk_buff *skb, struct net_device *ndev, if ((val ^ hash) & ~oecls_cpu_mask) return; + if (mode == 2) { + if (!oecls_do_hash()) { + *rcpu = last_recv_cpu; + return; + } + if (last_recv_cpu != cpu) + return; + newcpu = get_cpu_in_mask(last_recv_cpu, hash); + if (newcpu < 0) + newcpu = cpu; + if (newcpu == cpu) { + newcpu = cpumask_first(cpumask_of_node(cpu_to_node(cpu))); + newcpu = newcpu + (cpu + 1) % (nr_cpu_ids / oecls_numa_num); + } + oecls_debug("last_recv_cpu:%d irq_cpu:%d newcpu:%d\n", last_recv_cpu, cpu, newcpu); + *rcpu = newcpu; + return; + } + newcpu = get_cpu_in_mask(last_recv_cpu, hash); if (newcpu >= 0) *rcpu = newcpu; diff --git a/net/oenetcls/oenetcls_main.c b/net/oenetcls/oenetcls_main.c index ec37e38d7f48..04922368bb73 100644 --- a/net/oenetcls/oenetcls_main.c +++ b/net/oenetcls/oenetcls_main.c @@ -19,7 +19,7 @@ int debug; module_param(debug, int, 0644); MODULE_PARM_DESC(debug, "debug switch"); -static int mode; +int mode; module_param(mode, int, 0444); MODULE_PARM_DESC(mode, "mode, default 0"); @@ -43,13 +43,17 @@ static int check_cap = 1; module_param(check_cap, int, 0444); MODULE_PARM_DESC(check_cap, "check_cap, default 1"); +int rcpu_probability = -1; +module_param(rcpu_probability, int, 0444); +MODULE_PARM_DESC(rcpu_probability, "rcpu select policy probability, default -1"); + static char irqname[64] = "comp"; module_param_string(irqname, irqname, sizeof(irqname), 0644); MODULE_PARM_DESC(irqname, "nic irq name string, default comp"); static bool check_params(void) { - if (mode != 0 && mode != 1) + if (mode != 0 && mode != 1 && mode != 2) return false; if (strlen(ifname) == 0) @@ -376,7 +380,7 @@ static struct oecls_netdev_info *alloc_oecls_netdev_info(void) static bool check_irq_name(const char *irq_name, struct oecls_netdev_info *oecls_dev) { if (!strstr(irq_name, "TxRx") && !strstr(irq_name, "comp") && !strstr(irq_name, "rx") && - strlen(irqname) > 0 && !strstr(irq_name, irqname)) + !strstr(irq_name, "virtio0-input") && strlen(irqname) > 0 && !strstr(irq_name, irqname)) return false; if (strstr(irq_name, oecls_dev->dev_name)) @@ -519,10 +523,12 @@ static int init_single_oecls_dev(char *if_name, unsigned int length) goto out; } - ret = oecls_filter_enable(dev_name, &old_state); - if (ret) { - oecls_error("dev [%s] not support ntuple! ret=%d\n", dev_name, ret); - goto out; + if (mode != 2) { + ret = oecls_filter_enable(dev_name, &old_state); + if (ret) { + oecls_error("dev [%s] not support ntuple! ret=%d\n", dev_name, ret); + goto out; + } } oecls_dev = alloc_oecls_netdev_info(); @@ -1017,6 +1023,39 @@ static void set_netdev_xps_queue(bool enable) } } +static void fixup_rcpu_load(void) +{ + char *start = appname, *end; + char *task_name = "redis-proxy"; + + if (!strlen(appname)) + return; + + // support appname: app1#app2#appN + while (*start != '\0') { + end = strchr(start, '#'); + if (end == start) { + start++; + continue; + } + + if (!end) { + if (!strncmp(task_name, start, strlen(start))) { + rcpu_probability = 100; + return; + } + break; + } + + if (!strncmp(task_name, start, end - start)) { + rcpu_probability = 100; + return; + } + start = end + 1; + } + rcpu_probability = 65; +} + static __init int oecls_init(void) { struct oecls_numa_info *numa_info; @@ -1048,6 +1087,9 @@ static __init int oecls_init(void) set_netdev_xps_queue(true); #endif + if (mode == 2 && rcpu_probability < 0) + fixup_rcpu_load(); + if (mode == 0) err = oecls_ntuple_res_init(); else -- 2.34.1

2 1

[PATCH OLK-6.6] smb: client: fix wrong index reference in smb2_compound_op()
by Yifan Qiao 05 Nov '25

05 Nov '25

From: Sang-Heon Jeon <ekffu200098(a)gmail.com> stable inclusion from stable-v6.6.109 commit ba7bcfd52c66dd1c2dfa5142aca7e4a70b62dfa5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID228Z CVE: CVE-2025-39975 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fbe2dc6a9c7318f7263f5e4d50f6272b931c5756 ] In smb2_compound_op(), the loop that processes each command's response uses wrong indices when accessing response bufferes. This incorrect indexing leads to improper handling of command results. Also, if incorrectly computed index is greather than or equal to MAX_COMPOUND, it can cause out-of-bounds accesses. Fixes: 3681c74d342d ("smb: client: handle lack of EA support in smb2_query_path_info()") # 6.14 Reviewed-by: Paulo Alcantara (Red Hat) <pc(a)manguebit.org> Signed-off-by: Sang-Heon Jeon <ekffu200098(a)gmail.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/smb/client/smb2inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/smb/client/smb2inode.c b/fs/smb/client/smb2inode.c index 0cc80f472432..79641d1ee867 100644 --- a/fs/smb/client/smb2inode.c +++ b/fs/smb/client/smb2inode.c @@ -641,7 +641,7 @@ static int smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon, tmp_rc = rc; for (i = 0; i < num_cmds; i++) { - char *buf = rsp_iov[i + i].iov_base; + char *buf = rsp_iov[i + 1].iov_base; if (buf && resp_buftype[i + 1] != CIFS_NO_BUFFER) rc = server->ops->map_error(buf, false); -- 2.39.2

2 1

[openeuler:OLK-6.6 3098/3098] kernel/bpf-rvi/common_kfuncs.c:127:26: warning: no previous prototype for 'bpf_nr_running'
by kernel test robot 05 Nov '25

05 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: faa195bad3afed3c326917fb4cd36e0bd311220c commit: 34f90dce941b028e02a0336711907b220e3c5765 [3098/3098] bpf-rvi: Add cpu runqueue related kfuncs config: x86_64-randconfig-001-20251104 (https://download.01.org/0day-ci/archive/20251105/202511050754.SzG0bccj-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251105/202511050754.SzG0bccj-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511050754.SzG0bccj-lkp@intel.com/ All warnings (new ones prefixed by >>): kernel/bpf-rvi/common_kfuncs.c:25:32: warning: no previous prototype for 'bpf_mem_cgroup_from_task' [-Wmissing-prototypes] 25 | __bpf_kfunc struct mem_cgroup *bpf_mem_cgroup_from_task(struct task_struct *p) | ^~~~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:34:35: warning: no previous prototype for 'bpf_task_active_pid_ns' [-Wmissing-prototypes] 34 | __bpf_kfunc struct pid_namespace *bpf_task_active_pid_ns(struct task_struct *task) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:39:17: warning: no previous prototype for 'bpf_pidns_nr_tasks' [-Wmissing-prototypes] 39 | __bpf_kfunc u64 bpf_pidns_nr_tasks(struct pid_namespace *ns) | ^~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:53:17: warning: no previous prototype for 'bpf_pidns_last_pid' [-Wmissing-prototypes] 53 | __bpf_kfunc u32 bpf_pidns_last_pid(struct pid_namespace *ns) | ^~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:82:18: warning: no previous prototype for 'bpf_si_memswinfo' [-Wmissing-prototypes] 82 | __bpf_kfunc void bpf_si_memswinfo(struct bpf_sysinfo *bsi) | ^~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:92:27: warning: no previous prototype for 'bpf_page_counter_read' [-Wmissing-prototypes] 92 | __bpf_kfunc unsigned long bpf_page_counter_read(struct page_counter *counter) | ^~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:102:18: warning: no previous prototype for 'bpf_seq_file_append' [-Wmissing-prototypes] 102 | __bpf_kfunc void bpf_seq_file_append(struct seq_file *dst, struct seq_file *src) | ^~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:116:18: warning: no previous prototype for 'bpf_get_boottime_timens' [-Wmissing-prototypes] 116 | __bpf_kfunc void bpf_get_boottime_timens(struct task_struct *tsk, struct timespec64 *boottime) | ^~~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:122:27: warning: no previous prototype for 'bpf_get_total_forks' [-Wmissing-prototypes] 122 | __bpf_kfunc unsigned long bpf_get_total_forks(void) | ^~~~~~~~~~~~~~~~~~~ >> kernel/bpf-rvi/common_kfuncs.c:127:26: warning: no previous prototype for 'bpf_nr_running' [-Wmissing-prototypes] 127 | __bpf_kfunc unsigned int bpf_nr_running(void) | ^~~~~~~~~~~~~~ >> kernel/bpf-rvi/common_kfuncs.c:132:32: warning: no previous prototype for 'bpf_nr_context_switches' [-Wmissing-prototypes] 132 | __bpf_kfunc unsigned long long bpf_nr_context_switches(void) | ^~~~~~~~~~~~~~~~~~~~~~~ >> kernel/bpf-rvi/common_kfuncs.c:137:26: warning: no previous prototype for 'bpf_nr_iowait' [-Wmissing-prototypes] 137 | __bpf_kfunc unsigned int bpf_nr_iowait(void) | ^~~~~~~~~~~~~ vim +/bpf_nr_running +127 kernel/bpf-rvi/common_kfuncs.c 96 97 /* 98 * Stat related kfuncs 99 */ 100 101 /* Moving src's content to the end of dst. Reference: seq_vprintf. */ > 102 __bpf_kfunc void bpf_seq_file_append(struct seq_file *dst, struct seq_file *src) 103 { 104 /* 105 * ->count: length of content 106 * ->size: available buffer space 107 * i.e. seq_printf(dst, "%s", src->buf) 108 */ 109 if (dst->count < dst->size) 110 if (src->count < dst->size - dst->count) { 111 memmove(dst->buf + dst->count, src->buf, src->count); 112 dst->count += src->count; 113 } 114 } 115 > 116 __bpf_kfunc void bpf_get_boottime_timens(struct task_struct *tsk, struct timespec64 *boottime) 117 { 118 getboottime64(boottime); 119 *boottime = timespec64_sub(*boottime, tsk->nsproxy->time_ns->offsets.boottime); 120 } 121 > 122 __bpf_kfunc unsigned long bpf_get_total_forks(void) 123 { 124 return total_forks; 125 } 126 > 127 __bpf_kfunc unsigned int bpf_nr_running(void) 128 { 129 return nr_running(); 130 } 131 > 132 __bpf_kfunc unsigned long long bpf_nr_context_switches(void) 133 { 134 return nr_context_switches(); 135 } 136 > 137 __bpf_kfunc unsigned int bpf_nr_iowait(void) 138 { 139 return nr_iowait(); 140 } 141 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3098/3098] fs/proc/stat.c:234:18: warning: no previous prototype for 'bpf_show_all_irqs'
by kernel test robot 05 Nov '25

05 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: faa195bad3afed3c326917fb4cd36e0bd311220c commit: 19895b9974c36318281e4e18131a2cfb43543ffd [3098/3098] bpf-rvi: Add stat-related misc kfuncs config: x86_64-randconfig-001-20251104 (https://download.01.org/0day-ci/archive/20251105/202511050607.O3tCEeVJ-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251105/202511050607.O3tCEeVJ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511050607.O3tCEeVJ-lkp@intel.com/ All warnings (new ones prefixed by >>): fs/proc/stat.c:224:17: warning: no previous prototype for 'bpf_get_idle_time' [-Wmissing-prototypes] 224 | __bpf_kfunc u64 bpf_get_idle_time(struct kernel_cpustat *kcs, int cpu) | ^~~~~~~~~~~~~~~~~ fs/proc/stat.c:229:17: warning: no previous prototype for 'bpf_get_iowait_time' [-Wmissing-prototypes] 229 | __bpf_kfunc u64 bpf_get_iowait_time(struct kernel_cpustat *kcs, int cpu) | ^~~~~~~~~~~~~~~~~~~ >> fs/proc/stat.c:234:18: warning: no previous prototype for 'bpf_show_all_irqs' [-Wmissing-prototypes] 234 | __bpf_kfunc void bpf_show_all_irqs(struct seq_file *p) | ^~~~~~~~~~~~~~~~~ -- kernel/bpf-rvi/common_kfuncs.c:24:32: warning: no previous prototype for 'bpf_mem_cgroup_from_task' [-Wmissing-prototypes] 24 | __bpf_kfunc struct mem_cgroup *bpf_mem_cgroup_from_task(struct task_struct *p) | ^~~~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:33:35: warning: no previous prototype for 'bpf_task_active_pid_ns' [-Wmissing-prototypes] 33 | __bpf_kfunc struct pid_namespace *bpf_task_active_pid_ns(struct task_struct *task) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:38:17: warning: no previous prototype for 'bpf_pidns_nr_tasks' [-Wmissing-prototypes] 38 | __bpf_kfunc u64 bpf_pidns_nr_tasks(struct pid_namespace *ns) | ^~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:52:17: warning: no previous prototype for 'bpf_pidns_last_pid' [-Wmissing-prototypes] 52 | __bpf_kfunc u32 bpf_pidns_last_pid(struct pid_namespace *ns) | ^~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:81:18: warning: no previous prototype for 'bpf_si_memswinfo' [-Wmissing-prototypes] 81 | __bpf_kfunc void bpf_si_memswinfo(struct bpf_sysinfo *bsi) | ^~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:91:27: warning: no previous prototype for 'bpf_page_counter_read' [-Wmissing-prototypes] 91 | __bpf_kfunc unsigned long bpf_page_counter_read(struct page_counter *counter) | ^~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:101:18: warning: no previous prototype for 'bpf_seq_file_append' [-Wmissing-prototypes] 101 | __bpf_kfunc void bpf_seq_file_append(struct seq_file *dst, struct seq_file *src) | ^~~~~~~~~~~~~~~~~~~ >> kernel/bpf-rvi/common_kfuncs.c:115:18: warning: no previous prototype for 'bpf_get_boottime_timens' [-Wmissing-prototypes] 115 | __bpf_kfunc void bpf_get_boottime_timens(struct task_struct *tsk, struct timespec64 *boottime) | ^~~~~~~~~~~~~~~~~~~~~~~ >> kernel/bpf-rvi/common_kfuncs.c:121:27: warning: no previous prototype for 'bpf_get_total_forks' [-Wmissing-prototypes] 121 | __bpf_kfunc unsigned long bpf_get_total_forks(void) | ^~~~~~~~~~~~~~~~~~~ vim +/bpf_show_all_irqs +234 fs/proc/stat.c 222 223 #ifdef CONFIG_BPF_RVI > 224 __bpf_kfunc u64 bpf_get_idle_time(struct kernel_cpustat *kcs, int cpu) 225 { 226 return get_idle_time(kcs, cpu); 227 } 228 229 __bpf_kfunc u64 bpf_get_iowait_time(struct kernel_cpustat *kcs, int cpu) 230 { 231 return get_iowait_time(kcs, cpu); 232 } 233 > 234 __bpf_kfunc void bpf_show_all_irqs(struct seq_file *p) 235 { 236 show_all_irqs(p); 237 } 238 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3098/3098] kernel/bpf-rvi/common_kfuncs.c:97:18: warning: no previous prototype for 'bpf_seq_file_append'
by kernel test robot 05 Nov '25

05 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: faa195bad3afed3c326917fb4cd36e0bd311220c commit: 1afa15e45da121993a15941b08fef5e3d58f40e5 [3098/3098] bpf-rvi: Add bpf_seq_file_append() kfunc config: x86_64-randconfig-001-20251104 (https://download.01.org/0day-ci/archive/20251105/202511050410.2c1BvP2L-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251105/202511050410.2c1BvP2L-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511050410.2c1BvP2L-lkp@intel.com/ All warnings (new ones prefixed by >>): kernel/bpf-rvi/common_kfuncs.c:20:32: warning: no previous prototype for 'bpf_mem_cgroup_from_task' [-Wmissing-prototypes] 20 | __bpf_kfunc struct mem_cgroup *bpf_mem_cgroup_from_task(struct task_struct *p) | ^~~~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:29:35: warning: no previous prototype for 'bpf_task_active_pid_ns' [-Wmissing-prototypes] 29 | __bpf_kfunc struct pid_namespace *bpf_task_active_pid_ns(struct task_struct *task) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:34:17: warning: no previous prototype for 'bpf_pidns_nr_tasks' [-Wmissing-prototypes] 34 | __bpf_kfunc u64 bpf_pidns_nr_tasks(struct pid_namespace *ns) | ^~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:48:17: warning: no previous prototype for 'bpf_pidns_last_pid' [-Wmissing-prototypes] 48 | __bpf_kfunc u32 bpf_pidns_last_pid(struct pid_namespace *ns) | ^~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:77:18: warning: no previous prototype for 'bpf_si_memswinfo' [-Wmissing-prototypes] 77 | __bpf_kfunc void bpf_si_memswinfo(struct bpf_sysinfo *bsi) | ^~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:87:27: warning: no previous prototype for 'bpf_page_counter_read' [-Wmissing-prototypes] 87 | __bpf_kfunc unsigned long bpf_page_counter_read(struct page_counter *counter) | ^~~~~~~~~~~~~~~~~~~~~ >> kernel/bpf-rvi/common_kfuncs.c:97:18: warning: no previous prototype for 'bpf_seq_file_append' [-Wmissing-prototypes] 97 | __bpf_kfunc void bpf_seq_file_append(struct seq_file *dst, struct seq_file *src) | ^~~~~~~~~~~~~~~~~~~ vim +/bpf_seq_file_append +97 kernel/bpf-rvi/common_kfuncs.c 91 92 /* 93 * Stat related kfuncs 94 */ 95 96 /* Moving src's content to the end of dst. Reference: seq_vprintf. */ > 97 __bpf_kfunc void bpf_seq_file_append(struct seq_file *dst, struct seq_file *src) 98 { 99 /* 100 * ->count: length of content 101 * ->size: available buffer space 102 * i.e. seq_printf(dst, "%s", src->buf) 103 */ 104 if (dst->count < dst->size) 105 if (src->count < dst->size - dst->count) { 106 memmove(dst->buf + dst->count, src->buf, src->count); 107 dst->count += src->count; 108 } 109 } 110 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3098/3098] kernel/bpf-rvi/common_kfuncs.c:86:27: warning: no previous prototype for 'bpf_page_counter_read'
by kernel test robot 05 Nov '25

05 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: faa195bad3afed3c326917fb4cd36e0bd311220c commit: 5e4cec4acb12a17b26d4d2ae4c29eb29b017f854 [3098/3098] bpf-rvi: Add bpf_page_counter_read() kfunc config: x86_64-randconfig-001-20251104 (https://download.01.org/0day-ci/archive/20251105/202511050235.5PdxK5fh-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251105/202511050235.5PdxK5fh-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511050235.5PdxK5fh-lkp@intel.com/ All warnings (new ones prefixed by >>): kernel/bpf-rvi/common_kfuncs.c:19:32: warning: no previous prototype for 'bpf_mem_cgroup_from_task' [-Wmissing-prototypes] 19 | __bpf_kfunc struct mem_cgroup *bpf_mem_cgroup_from_task(struct task_struct *p) | ^~~~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:28:35: warning: no previous prototype for 'bpf_task_active_pid_ns' [-Wmissing-prototypes] 28 | __bpf_kfunc struct pid_namespace *bpf_task_active_pid_ns(struct task_struct *task) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:33:17: warning: no previous prototype for 'bpf_pidns_nr_tasks' [-Wmissing-prototypes] 33 | __bpf_kfunc u64 bpf_pidns_nr_tasks(struct pid_namespace *ns) | ^~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:47:17: warning: no previous prototype for 'bpf_pidns_last_pid' [-Wmissing-prototypes] 47 | __bpf_kfunc u32 bpf_pidns_last_pid(struct pid_namespace *ns) | ^~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:76:18: warning: no previous prototype for 'bpf_si_memswinfo' [-Wmissing-prototypes] 76 | __bpf_kfunc void bpf_si_memswinfo(struct bpf_sysinfo *bsi) | ^~~~~~~~~~~~~~~~ >> kernel/bpf-rvi/common_kfuncs.c:86:27: warning: no previous prototype for 'bpf_page_counter_read' [-Wmissing-prototypes] 86 | __bpf_kfunc unsigned long bpf_page_counter_read(struct page_counter *counter) | ^~~~~~~~~~~~~~~~~~~~~ vim +/bpf_page_counter_read +86 kernel/bpf-rvi/common_kfuncs.c 32 > 33 __bpf_kfunc u64 bpf_pidns_nr_tasks(struct pid_namespace *ns) 34 { 35 struct pid_iter iter = {}; 36 u32 nr_running = 0, nr_threads = 0; 37 38 for_each_task_in_pidns(iter, ns) { 39 nr_threads++; 40 if (task_is_running(iter.task)) 41 nr_running++; 42 } 43 44 return (u64)nr_running << 32 | nr_threads; 45 } 46 47 __bpf_kfunc u32 bpf_pidns_last_pid(struct pid_namespace *ns) 48 { 49 return idr_get_cursor(&ns->idr) - 1; 50 } 51 52 /* 53 * Swaps related kfuncs 54 */ 55 56 /* 57 * no padding member "_f" compared to struct sysinfo, because sizeof(_f) 58 * maybe zero and not supported by bpf_verifier. 59 */ 60 struct bpf_sysinfo { 61 __kernel_long_t uptime; /* Seconds since boot */ 62 __kernel_ulong_t loads[3]; /* 1, 5, and 15 minute load averages */ 63 __kernel_ulong_t totalram; /* Total usable main memory size */ 64 __kernel_ulong_t freeram; /* Available memory size */ 65 __kernel_ulong_t sharedram; /* Amount of shared memory */ 66 __kernel_ulong_t bufferram; /* Memory used by buffers */ 67 __kernel_ulong_t totalswap; /* Total swap space size */ 68 __kernel_ulong_t freeswap; /* swap space still available */ 69 __u16 procs; /* Number of current processes */ 70 __u16 pad; /* Explicit padding for m68k */ 71 __kernel_ulong_t totalhigh; /* Total high memory size */ 72 __kernel_ulong_t freehigh; /* Available high memory size */ 73 __u32 mem_unit; /* Memory unit size in bytes */ 74 }; 75 76 __bpf_kfunc void bpf_si_memswinfo(struct bpf_sysinfo *bsi) 77 { 78 struct sysinfo *si = (struct sysinfo *)bsi; 79 80 if (si) { 81 si_meminfo(si); 82 si_swapinfo(si); 83 } 84 } 85 > 86 __bpf_kfunc unsigned long bpf_page_counter_read(struct page_counter *counter) 87 { 88 return page_counter_read(counter); 89 } 90 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3098/3098] kernel/bpf-rvi/common_kfuncs.c:75:18: warning: no previous prototype for 'bpf_si_memswinfo'
by kernel test robot 05 Nov '25

05 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: faa195bad3afed3c326917fb4cd36e0bd311220c commit: b3aa368c1f9f8f3acee4703cfebb30e7a909df9f [3098/3098] bpf-rvi: Add bpf_si_memswinfo() kfunc config: x86_64-randconfig-001-20251104 (https://download.01.org/0day-ci/archive/20251105/202511050050.0VfB10bw-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251105/202511050050.0VfB10bw-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511050050.0VfB10bw-lkp@intel.com/ All warnings (new ones prefixed by >>): kernel/bpf-rvi/common_kfuncs.c:18:32: warning: no previous prototype for 'bpf_mem_cgroup_from_task' [-Wmissing-prototypes] 18 | __bpf_kfunc struct mem_cgroup *bpf_mem_cgroup_from_task(struct task_struct *p) | ^~~~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:27:35: warning: no previous prototype for 'bpf_task_active_pid_ns' [-Wmissing-prototypes] 27 | __bpf_kfunc struct pid_namespace *bpf_task_active_pid_ns(struct task_struct *task) | ^~~~~~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:32:17: warning: no previous prototype for 'bpf_pidns_nr_tasks' [-Wmissing-prototypes] 32 | __bpf_kfunc u64 bpf_pidns_nr_tasks(struct pid_namespace *ns) | ^~~~~~~~~~~~~~~~~~ kernel/bpf-rvi/common_kfuncs.c:46:17: warning: no previous prototype for 'bpf_pidns_last_pid' [-Wmissing-prototypes] 46 | __bpf_kfunc u32 bpf_pidns_last_pid(struct pid_namespace *ns) | ^~~~~~~~~~~~~~~~~~ >> kernel/bpf-rvi/common_kfuncs.c:75:18: warning: no previous prototype for 'bpf_si_memswinfo' [-Wmissing-prototypes] 75 | __bpf_kfunc void bpf_si_memswinfo(struct bpf_sysinfo *bsi) | ^~~~~~~~~~~~~~~~ vim +/bpf_si_memswinfo +75 kernel/bpf-rvi/common_kfuncs.c 22 23 /* 24 * Loadavg related kfuncs 25 */ 26 > 27 __bpf_kfunc struct pid_namespace *bpf_task_active_pid_ns(struct task_struct *task) 28 { 29 return task_active_pid_ns(task); 30 } 31 32 __bpf_kfunc u64 bpf_pidns_nr_tasks(struct pid_namespace *ns) 33 { 34 struct pid_iter iter = {}; 35 u32 nr_running = 0, nr_threads = 0; 36 37 for_each_task_in_pidns(iter, ns) { 38 nr_threads++; 39 if (task_is_running(iter.task)) 40 nr_running++; 41 } 42 43 return (u64)nr_running << 32 | nr_threads; 44 } 45 46 __bpf_kfunc u32 bpf_pidns_last_pid(struct pid_namespace *ns) 47 { 48 return idr_get_cursor(&ns->idr) - 1; 49 } 50 51 /* 52 * Swaps related kfuncs 53 */ 54 55 /* 56 * no padding member "_f" compared to struct sysinfo, because sizeof(_f) 57 * maybe zero and not supported by bpf_verifier. 58 */ 59 struct bpf_sysinfo { 60 __kernel_long_t uptime; /* Seconds since boot */ 61 __kernel_ulong_t loads[3]; /* 1, 5, and 15 minute load averages */ 62 __kernel_ulong_t totalram; /* Total usable main memory size */ 63 __kernel_ulong_t freeram; /* Available memory size */ 64 __kernel_ulong_t sharedram; /* Amount of shared memory */ 65 __kernel_ulong_t bufferram; /* Memory used by buffers */ 66 __kernel_ulong_t totalswap; /* Total swap space size */ 67 __kernel_ulong_t freeswap; /* swap space still available */ 68 __u16 procs; /* Number of current processes */ 69 __u16 pad; /* Explicit padding for m68k */ 70 __kernel_ulong_t totalhigh; /* Total high memory size */ 71 __kernel_ulong_t freehigh; /* Available high memory size */ 72 __u32 mem_unit; /* Memory unit size in bytes */ 73 }; 74 > 75 __bpf_kfunc void bpf_si_memswinfo(struct bpf_sysinfo *bsi) 76 { 77 struct sysinfo *si = (struct sysinfo *)bsi; 78 79 if (si) { 80 si_meminfo(si); 81 si_swapinfo(si); 82 } 83 } 84 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3075/3075] drivers/ub/ubus/enum.c:1332:5: warning: no previous prototype for function 'ub_enum_entities_active'
by kernel test robot 04 Nov '25

04 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 25097b0e8b7a08363a1cba931a5762548a3b0e16 commit: e7af929fc0444491fa5f13a00c3f576ea5a4b923 [3075/3075] ub:ubus: Supports device enumeration. config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20251104/202511042359.TcIxX2CV-lkp@…) compiler: clang version 19.1.7 (https://github.com/llvm/llvm-project cd708029e0b2869e80abe31ddb175f7c35361f90) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251104/202511042359.TcIxX2CV-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511042359.TcIxX2CV-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/ub/ubus/enum.c:996:5: warning: no previous prototype for function 'ub_cfg_read_guid' [-Wmissing-prototypes] 996 | int ub_cfg_read_guid(struct ub_entity *uent) | ^ drivers/ub/ubus/enum.c:996:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 996 | int ub_cfg_read_guid(struct ub_entity *uent) | ^ | static drivers/ub/ubus/enum.c:1097:6: warning: no previous prototype for function 'ub_enum_clear_ent_list' [-Wmissing-prototypes] 1097 | void ub_enum_clear_ent_list(struct list_head *dev_list) | ^ drivers/ub/ubus/enum.c:1097:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1097 | void ub_enum_clear_ent_list(struct list_head *dev_list) | ^ | static >> drivers/ub/ubus/enum.c:1332:5: warning: no previous prototype for function 'ub_enum_entities_active' [-Wmissing-prototypes] 1332 | int ub_enum_entities_active(struct list_head *dev_list) | ^ drivers/ub/ubus/enum.c:1332:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1332 | int ub_enum_entities_active(struct list_head *dev_list) | ^ | static 3 warnings generated. vim +/ub_enum_entities_active +1332 drivers/ub/ubus/enum.c 1331 > 1332 int ub_enum_entities_active(struct list_head *dev_list) 1333 { 1334 struct ub_entity *uent, *tmp; 1335 int ret; 1336 1337 list_for_each_entry_safe(uent, tmp, dev_list, node) { 1338 if (uent->entity_idx != 0) 1339 continue; 1340 1341 ub_route_sync_dev(uent); 1342 ret = ub_setup_ent(uent); 1343 if (ret) { 1344 pr_err("setup dev err, ret=%d\n", ret); 1345 return ret; 1346 } 1347 1348 list_del(&uent->node); 1349 ub_entity_add(uent, uent->ubc); 1350 ub_start_ent(uent); 1351 } 1352 1353 return 0; 1354 } 1355 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3098/3098] kernel/sched/cpuacct.c:417:17: warning: no previous prototype for 'bpf_task_ca_cpuusage'
by kernel test robot 04 Nov '25

04 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 25097b0e8b7a08363a1cba931a5762548a3b0e16 commit: 00c32c5569d488b6c90f1695175577e35c17c21c [3098/3098] bpf-rvi: cpuacct: Add bpf_task_ca_cpuusage() kfunc config: x86_64-randconfig-001-20251104 (https://download.01.org/0day-ci/archive/20251104/202511042208.SaUQnITn-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251104/202511042208.SaUQnITn-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511042208.SaUQnITn-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from kernel/sched/build_utility.c:61: >> kernel/sched/cpuacct.c:417:17: warning: no previous prototype for 'bpf_task_ca_cpuusage' [-Wmissing-prototypes] 417 | __bpf_kfunc u64 bpf_task_ca_cpuusage(struct task_struct *p) | ^~~~~~~~~~~~~~~~~~~~ kernel/sched/cpuacct.c:424:18: warning: no previous prototype for 'bpf_cpuacct_kcpustat_cpu_fetch' [-Wmissing-prototypes] 424 | __bpf_kfunc void bpf_cpuacct_kcpustat_cpu_fetch(struct kernel_cpustat *dst, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from kernel/sched/build_utility.c:73: kernel/sched/debug.c:102:12: warning: no previous prototype for 'is_prefer_numa' [-Wmissing-prototypes] 102 | int __weak is_prefer_numa(void) | ^~~~~~~~~~~~~~ vim +/bpf_task_ca_cpuusage +417 kernel/sched/cpuacct.c 416 > 417 __bpf_kfunc u64 bpf_task_ca_cpuusage(struct task_struct *p) 418 { 419 if (!p) 420 return 0; 421 return cpuusage_read(task_css(p, cpuacct_cgrp_id), NULL); 422 } 423 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] fs/smb: Fix inconsistent refcnt update
by Yifan Qiao 04 Nov '25

04 Nov '25

From: Shuhao Fu <sfual(a)cse.ust.hk> mainline inclusion from mainline-v6.17-rc4 commit ab529e6ca1f67bcf31f3ea80c72bffde2e9e053e category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICYBJ5 CVE: CVE-2025-39819 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- A possible inconsistent update of refcount was identified in `smb2_compound_op`. Such inconsistent update could lead to possible resource leaks. Why it is a possible bug: 1. In the comment section of the function, it clearly states that the reference to `cfile` should be dropped after calling this function. 2. Every control flow path would check and drop the reference to `cfile`, except the patched one. 3. Existing callers would not handle refcount update of `cfile` if -ENOMEM is returned. To fix the bug, an extra goto label "out" is added, to make sure that the cleanup logic would always be respected. As the problem is caused by the allocation failure of `vars`, the cleanup logic between label "finished" and "out" can be safely ignored. According to the definition of function `is_replayable_error`, the error code of "-ENOMEM" is not recoverable. Therefore, the replay logic also gets ignored. Signed-off-by: Shuhao Fu <sfual(a)cse.ust.hk> Acked-by: Paulo Alcantara (Red Hat) <pc(a)manguebit.org> Cc: stable(a)vger.kernel.org Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/smb/client/smb2inode.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/fs/smb/client/smb2inode.c b/fs/smb/client/smb2inode.c index e1078a1decdf..0cc80f472432 100644 --- a/fs/smb/client/smb2inode.c +++ b/fs/smb/client/smb2inode.c @@ -206,8 +206,10 @@ static int smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon, server = cifs_pick_channel(ses); vars = kzalloc(sizeof(*vars), GFP_ATOMIC); - if (vars == NULL) - return -ENOMEM; + if (vars == NULL) { + rc = -ENOMEM; + goto out; + } rqst = &vars->rqst[0]; rsp_iov = &vars->rsp_iov[0]; @@ -828,6 +830,7 @@ static int smb2_compound_op(const unsigned int xid, struct cifs_tcon *tcon, smb2_should_replay(tcon, &retries, &cur_sleep)) goto replay_again; +out: if (cfile) cifsFileInfo_put(cfile); -- 2.39.2

2 1

[openeuler:OLK-6.6 3098/3098] kernel/bpf-rvi/common_kfuncs.c:24:35: warning: no previous prototype for 'bpf_task_active_pid_ns'
by kernel test robot 04 Nov '25

04 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 25097b0e8b7a08363a1cba931a5762548a3b0e16 commit: ef015dbb4151c10d0415045f9d0fcf3dc85063d7 [3098/3098] bpf-rvi: pidns: Add for_each_task_in_pidns and loadavg-related kfuncs config: x86_64-randconfig-001-20251104 (https://download.01.org/0day-ci/archive/20251104/202511042031.XJbcBnUd-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251104/202511042031.XJbcBnUd-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511042031.XJbcBnUd-lkp@intel.com/ All warnings (new ones prefixed by >>): kernel/bpf-rvi/common_kfuncs.c:15:32: warning: no previous prototype for 'bpf_mem_cgroup_from_task' [-Wmissing-prototypes] 15 | __bpf_kfunc struct mem_cgroup *bpf_mem_cgroup_from_task(struct task_struct *p) | ^~~~~~~~~~~~~~~~~~~~~~~~ >> kernel/bpf-rvi/common_kfuncs.c:24:35: warning: no previous prototype for 'bpf_task_active_pid_ns' [-Wmissing-prototypes] 24 | __bpf_kfunc struct pid_namespace *bpf_task_active_pid_ns(struct task_struct *task) | ^~~~~~~~~~~~~~~~~~~~~~ >> kernel/bpf-rvi/common_kfuncs.c:29:17: warning: no previous prototype for 'bpf_pidns_nr_tasks' [-Wmissing-prototypes] 29 | __bpf_kfunc u64 bpf_pidns_nr_tasks(struct pid_namespace *ns) | ^~~~~~~~~~~~~~~~~~ >> kernel/bpf-rvi/common_kfuncs.c:43:17: warning: no previous prototype for 'bpf_pidns_last_pid' [-Wmissing-prototypes] 43 | __bpf_kfunc u32 bpf_pidns_last_pid(struct pid_namespace *ns) | ^~~~~~~~~~~~~~~~~~ vim +/bpf_task_active_pid_ns +24 kernel/bpf-rvi/common_kfuncs.c 19 20 /* 21 * Loadavg related kfuncs 22 */ 23 > 24 __bpf_kfunc struct pid_namespace *bpf_task_active_pid_ns(struct task_struct *task) 25 { 26 return task_active_pid_ns(task); 27 } 28 > 29 __bpf_kfunc u64 bpf_pidns_nr_tasks(struct pid_namespace *ns) 30 { 31 struct pid_iter iter = {}; 32 u32 nr_running = 0, nr_threads = 0; 33 34 for_each_task_in_pidns(iter, ns) { 35 nr_threads++; 36 if (task_is_running(iter.task)) 37 nr_running++; 38 } 39 40 return (u64)nr_running << 32 | nr_threads; 41 } 42 > 43 __bpf_kfunc u32 bpf_pidns_last_pid(struct pid_namespace *ns) 44 { 45 return idr_get_cursor(&ns->idr) - 1; 46 } 47 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3098/3098] block/bpf-rvi.c:36:28: error: implicit declaration of function 'css_to_blkcg'; did you mean 'pd_to_blkg'?
by kernel test robot 04 Nov '25

04 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 25097b0e8b7a08363a1cba931a5762548a3b0e16 commit: 89fa7dcff5e533bd14396601f40c388cfb6c1e59 [3098/3098] bpf-rvi: block: Add diskstats iterator target config: x86_64-randconfig-001-20251104 (https://download.01.org/0day-ci/archive/20251104/202511041808.gFZ75q5u-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251104/202511041808.gFZ75q5u-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511041808.gFZ75q5u-lkp@intel.com/ All errors (new ones prefixed by >>): block/bpf-rvi.c: In function 'bpf_disk_seqf_start': >> block/bpf-rvi.c:36:28: error: implicit declaration of function 'css_to_blkcg'; did you mean 'pd_to_blkg'? [-Wimplicit-function-declaration] 36 | priv->task_blkcg = css_to_blkcg(task_css(reaper ?: current, io_cgrp_id)); | ^~~~~~~~~~~~ | pd_to_blkg >> block/bpf-rvi.c:36:69: error: 'io_cgrp_id' undeclared (first use in this function); did you mean 'cpu_cgrp_id'? 36 | priv->task_blkcg = css_to_blkcg(task_css(reaper ?: current, io_cgrp_id)); | ^~~~~~~~~~ | cpu_cgrp_id block/bpf-rvi.c:36:69: note: each undeclared identifier is reported only once for each function it appears in vim +36 block/bpf-rvi.c 20 21 /* 22 * Basically the same with disk_seqf_start() but without allocating iter and 23 * then overwriting seqf->private, which points to priv_data->target_private 24 * in bpf_iter case (see prepare_seq_file()), and is needed to retrieve 25 * struct bpf_iter_priv_data. Here we allocate iter via setting 26 * .seq_priv_size and turning priv_data->target_private into iter. 27 */ 28 static void *bpf_disk_seqf_start(struct seq_file *seqf, loff_t *pos) 29 { 30 loff_t skip = *pos; 31 struct diskstats_seq_priv *priv = seqf->private; 32 struct class_dev_iter *iter; 33 struct device *dev; 34 struct task_struct *reaper = get_current_level1_reaper(); 35 > 36 priv->task_blkcg = css_to_blkcg(task_css(reaper ?: current, io_cgrp_id)); 37 if (reaper) 38 put_task_struct(reaper); 39 40 iter = &priv->iter; 41 class_dev_iter_init(iter, &block_class, NULL, &disk_type); 42 do { 43 dev = class_dev_iter_next(iter); 44 if (!dev) 45 return NULL; 46 } while (skip--); 47 48 return dev_to_disk(dev); 49 } 50 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] arm64/mpam: Add quirk to retrigger L3 CSU monitor
by Zeng Heng 04 Nov '25

04 Nov '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID4UC2 -------------------------------- Due to the inaccurate L2 CSU sampling on the specified platform, the L3 cache capacity statistics accumulate error. To avoid this, perform a full re-scan instead of incremental counting. Each time when read the L3 CSU monitor, we forcibly reconfigure it so that the hardware rescans the L3 cache capacity. Note that the first read of the L3 CSU usually returns EBUSY, so a second read is required. On the second attempt, skip forcibly reconfigure the monitor, preventing another EBUSY and ensuring the correct result. Fixes: bb66b4d115e5 ("arm_mpam: Add mpam_msmon_read() to read monitor value") Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/platform/mpam/mpam_devices.c | 27 +++++++++++++++++++++++++-- 1 file changed, 25 insertions(+), 2 deletions(-) diff --git a/drivers/platform/mpam/mpam_devices.c b/drivers/platform/mpam/mpam_devices.c index 30e4ce54a3c4..ebc8887d8267 100644 --- a/drivers/platform/mpam/mpam_devices.c +++ b/drivers/platform/mpam/mpam_devices.c @@ -909,6 +909,27 @@ static void read_msmon_ctl_flt_vals(struct mon_read *m, u32 *ctl_val, } } +static bool mpam_csu_hisi_need_retrigger(struct mpam_msc_ris *ris, + bool read_again) +{ + static const struct midr_range cpus[] = { + MIDR_ALL_VERSIONS(MIDR_HISI_HIP12), + { /* sentinel */ } + }; + + if (ris->comp->class->type != MPAM_CLASS_CACHE || + ris->comp->class->level != 3) + return false; + + if (!is_midr_in_range_list(cpus)) + return false; + + if (read_again) + return false; + + return true; +} + static void write_msmon_ctl_flt_vals(struct mon_read *m, u32 ctl_val, u32 flt_val) { @@ -1047,7 +1068,8 @@ static void __ris_msmon_read(void *arg) config_mismatch = cur_flt != flt_val || cur_ctl != (ctl_val | MSMON_CFG_x_CTL_EN); - if (config_mismatch || reset_on_next_read) { + if (config_mismatch || reset_on_next_read || + mpam_csu_hisi_need_retrigger(ris, m->err == -EBUSY)) { write_msmon_ctl_flt_vals(m, ctl_val, flt_val); if (mbwu_state) { mbwu_state->prev_val = 0; @@ -1190,6 +1212,7 @@ int mpam_msmon_read(struct mpam_component *comp, struct mon_cfg *ctx, arg.ctx = ctx; arg.type = type; arg.val = val; + arg.err = 0; *val = 0; return _msmon_read(comp, &arg); @@ -1448,7 +1471,7 @@ static int mpam_reprogram_ris(void *_arg) static int mpam_restore_mbwu_state(void *_ris) { int i; - struct mon_read mwbu_arg; + struct mon_read mwbu_arg = {}; struct mpam_msc_ris *ris = _ris; for (i = 0; i < ris->props.num_mbwu_mon; i++) { -- 2.25.1

2 1

[PATCH OLK-6.6] [Backport] KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O
by Chen Jinghuang 04 Nov '25

04 Nov '25

From: Sean Christopherson <seanjc(a)google.com> stable inclusion from stable-v6.6.111 commit 3d3abf3f7e8b1abb082070a343de82d7efc80523 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID3VRJ CVE: CVE-2025-40026 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e750f85391286a4c8100275516973324b621a269 upstream. When completing emulation of instruction that generated a userspace exit for I/O, don't recheck L1 intercepts as KVM has already finished that phase of instruction execution, i.e. has already committed to allowing L2 to perform I/O. If L1 (or host userspace) modifies the I/O permission bitmaps during the exit to userspace, KVM will treat the access as being intercepted despite already having emulated the I/O access. Pivot on EMULTYPE_NO_DECODE to detect that KVM is completing emulation. Of the three users of EMULTYPE_NO_DECODE, only complete_emulated_io() (the intended "recipient") can reach the code in question. gp_interception()'s use is mutually exclusive with is_guest_mode(), and complete_emulated_insn_gp() unconditionally pairs EMULTYPE_NO_DECODE with EMULTYPE_SKIP. The bad behavior was detected by a syzkaller program that toggles port I/O interception during the userspace I/O exit, ultimately resulting in a WARN on vcpu->arch.pio.count being non-zero due to KVM no completing emulation of the I/O instruction. WARNING: CPU: 23 PID: 1083 at arch/x86/kvm/x86.c:8039 emulator_pio_in_out+0x154/0x170 [kvm] Modules linked in: kvm_intel kvm irqbypass CPU: 23 UID: 1000 PID: 1083 Comm: repro Not tainted 6.16.0-rc5-c1610d2d66b1-next-vm #74 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:emulator_pio_in_out+0x154/0x170 [kvm] PKRU: 55555554 Call Trace: <TASK> kvm_fast_pio+0xd6/0x1d0 [kvm] vmx_handle_exit+0x149/0x610 [kvm_intel] kvm_arch_vcpu_ioctl_run+0xda8/0x1ac0 [kvm] kvm_vcpu_ioctl+0x244/0x8c0 [kvm] __x64_sys_ioctl+0x8a/0xd0 do_syscall_64+0x5d/0xc60 entry_SYSCALL_64_after_hwframe+0x4b/0x53 </TASK> Reported-by: syzbot+cc2032ba16cc2018ca25(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68790db4.a00a0220.3af5df.0020.GAE@google.com Fixes: 8a76d7f25f8f ("KVM: x86: Add x86 callback for intercept check") Cc: stable(a)vger.kernel.org Cc: Jim Mattson <jmattson(a)google.com> Link: https://lore.kernel.org/r/20250715190638.1899116-1-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- arch/x86/kvm/emulate.c | 9 ++++----- arch/x86/kvm/kvm_emulate.h | 3 +-- arch/x86/kvm/x86.c | 15 ++++++++------- 3 files changed, 13 insertions(+), 14 deletions(-) diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c index 296e289472a2..5a49156c9540 100644 --- a/arch/x86/kvm/emulate.c +++ b/arch/x86/kvm/emulate.c @@ -5140,12 +5140,11 @@ void init_decode_cache(struct x86_emulate_ctxt *ctxt) ctxt->mem_read.end = 0; } -int x86_emulate_insn(struct x86_emulate_ctxt *ctxt) +int x86_emulate_insn(struct x86_emulate_ctxt *ctxt, bool check_intercepts) { const struct x86_emulate_ops *ops = ctxt->ops; int rc = X86EMUL_CONTINUE; int saved_dst_type = ctxt->dst.type; - bool is_guest_mode = ctxt->ops->is_guest_mode(ctxt); ctxt->mem_read.pos = 0; @@ -5193,7 +5192,7 @@ int x86_emulate_insn(struct x86_emulate_ctxt *ctxt) fetch_possible_mmx_operand(&ctxt->dst); } - if (unlikely(is_guest_mode) && ctxt->intercept) { + if (unlikely(check_intercepts) && ctxt->intercept) { rc = emulator_check_intercept(ctxt, ctxt->intercept, X86_ICPT_PRE_EXCEPT); if (rc != X86EMUL_CONTINUE) @@ -5222,7 +5221,7 @@ int x86_emulate_insn(struct x86_emulate_ctxt *ctxt) goto done; } - if (unlikely(is_guest_mode) && (ctxt->d & Intercept)) { + if (unlikely(check_intercepts) && (ctxt->d & Intercept)) { rc = emulator_check_intercept(ctxt, ctxt->intercept, X86_ICPT_POST_EXCEPT); if (rc != X86EMUL_CONTINUE) @@ -5276,7 +5275,7 @@ int x86_emulate_insn(struct x86_emulate_ctxt *ctxt) special_insn: - if (unlikely(is_guest_mode) && (ctxt->d & Intercept)) { + if (unlikely(check_intercepts) && (ctxt->d & Intercept)) { rc = emulator_check_intercept(ctxt, ctxt->intercept, X86_ICPT_POST_MEMACCESS); if (rc != X86EMUL_CONTINUE) diff --git a/arch/x86/kvm/kvm_emulate.h b/arch/x86/kvm/kvm_emulate.h index c224cf4126f2..c74d20a14246 100644 --- a/arch/x86/kvm/kvm_emulate.h +++ b/arch/x86/kvm/kvm_emulate.h @@ -228,7 +228,6 @@ struct x86_emulate_ops { void (*set_nmi_mask)(struct x86_emulate_ctxt *ctxt, bool masked); bool (*is_smm)(struct x86_emulate_ctxt *ctxt); - bool (*is_guest_mode)(struct x86_emulate_ctxt *ctxt); int (*leave_smm)(struct x86_emulate_ctxt *ctxt); void (*triple_fault)(struct x86_emulate_ctxt *ctxt); int (*set_xcr)(struct x86_emulate_ctxt *ctxt, u32 index, u64 xcr); @@ -512,7 +511,7 @@ bool x86_page_table_writing_insn(struct x86_emulate_ctxt *ctxt); #define EMULATION_RESTART 1 #define EMULATION_INTERCEPTED 2 void init_decode_cache(struct x86_emulate_ctxt *ctxt); -int x86_emulate_insn(struct x86_emulate_ctxt *ctxt); +int x86_emulate_insn(struct x86_emulate_ctxt *ctxt, bool check_intercepts); int emulator_task_switch(struct x86_emulate_ctxt *ctxt, u16 tss_selector, int idt_index, int reason, bool has_error_code, u32 error_code); diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index c30e3e9d60f7..7a98760a4c03 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -8454,11 +8454,6 @@ static bool emulator_is_smm(struct x86_emulate_ctxt *ctxt) return is_smm(emul_to_vcpu(ctxt)); } -static bool emulator_is_guest_mode(struct x86_emulate_ctxt *ctxt) -{ - return is_guest_mode(emul_to_vcpu(ctxt)); -} - #ifndef CONFIG_KVM_SMM static int emulator_leave_smm(struct x86_emulate_ctxt *ctxt) { @@ -8540,7 +8535,6 @@ static const struct x86_emulate_ops emulate_ops = { .guest_has_rdpid = emulator_guest_has_rdpid, .set_nmi_mask = emulator_set_nmi_mask, .is_smm = emulator_is_smm, - .is_guest_mode = emulator_is_guest_mode, .leave_smm = emulator_leave_smm, .triple_fault = emulator_triple_fault, .set_xcr = emulator_set_xcr, @@ -9160,7 +9154,14 @@ int x86_emulate_instruction(struct kvm_vcpu *vcpu, gpa_t cr2_or_gpa, ctxt->exception.address = 0; } - r = x86_emulate_insn(ctxt); + /* + * Check L1's instruction intercepts when emulating instructions for + * L2, unless KVM is re-emulating a previously decoded instruction, + * e.g. to complete userspace I/O, in which case KVM has already + * checked the intercepts. + */ + r = x86_emulate_insn(ctxt, is_guest_mode(vcpu) && + !(emulation_type & EMULTYPE_NO_DECODE)); if (r == EMULATION_INTERCEPTED) return 1; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/2] *** fix CVE-2023-53454 ***
by Lin Ruifeng 04 Nov '25

04 Nov '25

*** fix CVE-2023-53454 *** Charles Han (1): HID: multitouch: Add NULL check in mt_input_configured Rahul Rameshbabu (1): HID: multitouch: Correct devm device reference for hidinput input_dev name drivers/hid/hid-multitouch.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) -- 2.22.0

2 3

[PATCH OLK-5.10 0/3] CVE-2025-22121
by Yongjian Sun 04 Nov '25

04 Nov '25

Ye Bin (2): ext4: introduce ITAIL helper ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() Yongjian Sun (1): ext4: Restore the deleted check paths of the xattr. fs/ext4/inode.c | 5 +++++ fs/ext4/xattr.c | 15 ++++++--------- fs/ext4/xattr.h | 10 ++++++++++ 3 files changed, 21 insertions(+), 9 deletions(-) -- 2.39.2

2 4

[PATCH 0/2] EEVDF null pointer
by Zicheng Qu 04 Nov '25

04 Nov '25

Zicheng Qu (2): EEVDF null pointer reproduction zero_vruntime kernel/sched/debug.c | 8 +- kernel/sched/fair.c | 170 +++++++++++++++++----------- kernel/sched/sched.h | 2 +- null_reproduction_test/Makefile | 9 ++ null_reproduction_test/fullcpu.c | 12 ++ null_reproduction_test/make.sh | 17 +++ null_reproduction_test/test.sh | 34 ++++++ null_reproduction_test/test_sched.c | 141 +++++++++++++++++++++++ 8 files changed, 325 insertions(+), 68 deletions(-) create mode 100644 null_reproduction_test/Makefile create mode 100644 null_reproduction_test/fullcpu.c create mode 100755 null_reproduction_test/make.sh create mode 100755 null_reproduction_test/test.sh create mode 100644 null_reproduction_test/test_sched.c -- 2.34.1

1 2

[openeuler:OLK-6.6 3098/3098] kernel/sched/cpuacct.c:412:18: warning: no previous prototype for 'bpf_cpuacct_kcpustat_cpu_fetch'
by kernel test robot 04 Nov '25

04 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 9b7e6f8aa58e8c131766ecd2c6eb9bd1dce85ca7 commit: 6ed308fc1d6f486c9e3c171b6b80c1c5f0f57df6 [3098/3098] bpf-rvi: cpuacct: Add bpf_cpuacct_kcpustat_cpu_fetch kfunc config: x86_64-randconfig-001-20251104 (https://download.01.org/0day-ci/archive/20251104/202511041308.wdMKtoD8-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251104/202511041308.wdMKtoD8-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511041308.wdMKtoD8-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from kernel/sched/build_utility.c:61: >> kernel/sched/cpuacct.c:412:18: warning: no previous prototype for 'bpf_cpuacct_kcpustat_cpu_fetch' [-Wmissing-prototypes] 412 | __bpf_kfunc void bpf_cpuacct_kcpustat_cpu_fetch(struct kernel_cpustat *dst, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from kernel/sched/build_utility.c:73: kernel/sched/debug.c:102:12: warning: no previous prototype for 'is_prefer_numa' [-Wmissing-prototypes] 102 | int __weak is_prefer_numa(void) | ^~~~~~~~~~~~~~ vim +/bpf_cpuacct_kcpustat_cpu_fetch +412 kernel/sched/cpuacct.c 410 411 #ifdef CONFIG_BPF_RVI > 412 __bpf_kfunc void bpf_cpuacct_kcpustat_cpu_fetch(struct kernel_cpustat *dst, 413 struct cpuacct *ca, int cpu) 414 { 415 memcpy(dst, per_cpu_ptr(ca->cpustat, cpu), sizeof(struct kernel_cpustat)); 416 } 417 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] misc: tifm: fix possible memory leak in tifm_7xx1_switch_media()
by Quanmin Yan 04 Nov '25

04 Nov '25

From: ruanjinjie <ruanjinjie(a)huawei.com> stable inclusion from stable-v4.19.270 commit 1695b1adcc3a7d985cd22fa3b55761edf3fab50d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICYBXA CVE: CVE-2022-50349 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fd2c930cf6a5b9176382c15f9acb1996e76e25ad ] If device_register() returns error in tifm_7xx1_switch_media(), name of kobject which is allocated in dev_set_name() called in device_add() is leaked. Never directly free @dev after calling device_register(), even if it returned an error! Always use put_device() to give up the reference initialized. Fixes: 2428a8fe2261 ("tifm: move common device management tasks from tifm_7xx1 to tifm_core") Signed-off-by: ruanjinjie <ruanjinjie(a)huawei.com> Link: https://lore.kernel.org/r/20221117064725.3478402-1-ruanjinjie@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Quanmin Yan <yanquanmin1(a)huawei.com> --- drivers/misc/tifm_7xx1.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/misc/tifm_7xx1.c b/drivers/misc/tifm_7xx1.c index 9ac95b48ef92..1d33c4facd44 100644 --- a/drivers/misc/tifm_7xx1.c +++ b/drivers/misc/tifm_7xx1.c @@ -194,7 +194,7 @@ static void tifm_7xx1_switch_media(struct work_struct *work) spin_unlock_irqrestore(&fm->lock, flags); } if (sock) - tifm_free_device(&sock->dev); + put_device(&sock->dev); } spin_lock_irqsave(&fm->lock, flags); } -- 2.43.0

2 1

[PATCH OLK-6.6] riscv, bpf: Sign extend struct ops return values properly
by Wang Tao 04 Nov '25

04 Nov '25

From: Hengqi Chen <hengqi.chen(a)gmail.com> mainline inclusion from mainline-v6.18-rc1 commit fd2e08128944a7679e753f920e9eda72057e427c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID3WJL CVE: CVE-2025-40079 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The ns_bpf_qdisc selftest triggers a kernel panic: Unable to handle kernel paging request at virtual address ffffffffa38dbf58 Current test_progs pgtable: 4K pagesize, 57-bit VAs, pgdp=0x00000001109cc000 [ffffffffa38dbf58] pgd=000000011fffd801, p4d=000000011fffd401, pud=000000011fffd001, pmd=0000000000000000 Oops [#1] Modules linked in: bpf_testmod(OE) xt_conntrack nls_iso8859_1 [...] [last unloaded: bpf_testmod(OE)] CPU: 1 UID: 0 PID: 23584 Comm: test_progs Tainted: G W OE 6.17.0-rc1-g2465bb83e0b4 #1 NONE Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2024.01+dfsg-1ubuntu5.1 01/01/2024 epc : __qdisc_run+0x82/0x6f0 ra : __qdisc_run+0x6e/0x6f0 epc : ffffffff80bd5c7a ra : ffffffff80bd5c66 sp : ff2000000eecb550 gp : ffffffff82472098 tp : ff60000096895940 t0 : ffffffff8001f180 t1 : ffffffff801e1664 t2 : 0000000000000000 s0 : ff2000000eecb5d0 s1 : ff60000093a6a600 a0 : ffffffffa38dbee8 a1 : 0000000000000001 a2 : ff2000000eecb510 a3 : 0000000000000001 a4 : 0000000000000000 a5 : 0000000000000010 a6 : 0000000000000000 a7 : 0000000000735049 s2 : ffffffffa38dbee8 s3 : 0000000000000040 s4 : ff6000008bcda000 s5 : 0000000000000008 s6 : ff60000093a6a680 s7 : ff60000093a6a6f0 s8 : ff60000093a6a6ac s9 : ff60000093140000 s10: 0000000000000000 s11: ff2000000eecb9d0 t3 : 0000000000000000 t4 : 0000000000ff0000 t5 : 0000000000000000 t6 : ff60000093a6a8b6 status: 0000000200000120 badaddr: ffffffffa38dbf58 cause: 000000000000000d [<ffffffff80bd5c7a>] __qdisc_run+0x82/0x6f0 [<ffffffff80b6fe58>] __dev_queue_xmit+0x4c0/0x1128 [<ffffffff80b80ae0>] neigh_resolve_output+0xd0/0x170 [<ffffffff80d2daf6>] ip6_finish_output2+0x226/0x6c8 [<ffffffff80d31254>] ip6_finish_output+0x10c/0x2a0 [<ffffffff80d31446>] ip6_output+0x5e/0x178 [<ffffffff80d2e232>] ip6_xmit+0x29a/0x608 [<ffffffff80d6f4c6>] inet6_csk_xmit+0xe6/0x140 [<ffffffff80c985e4>] __tcp_transmit_skb+0x45c/0xaa8 [<ffffffff80c995fe>] tcp_connect+0x9ce/0xd10 [<ffffffff80d66524>] tcp_v6_connect+0x4ac/0x5e8 [<ffffffff80cc19b8>] __inet_stream_connect+0xd8/0x318 [<ffffffff80cc1c36>] inet_stream_connect+0x3e/0x68 [<ffffffff80b42b20>] __sys_connect_file+0x50/0x88 [<ffffffff80b42bee>] __sys_connect+0x96/0xc8 [<ffffffff80b42c40>] __riscv_sys_connect+0x20/0x30 [<ffffffff80e5bcae>] do_trap_ecall_u+0x256/0x378 [<ffffffff80e69af2>] handle_exception+0x14a/0x156 Code: 892a 0363 1205 489c 8bc1 c7e5 2d03 084a 2703 080a (2783) 0709 ---[ end trace 0000000000000000 ]--- The bpf_fifo_dequeue prog returns a skb which is a pointer. The pointer is treated as a 32bit value and sign extend to 64bit in epilogue. This behavior is right for most bpf prog types but wrong for struct ops which requires RISC-V ABI. So let's sign extend struct ops return values according to the function model and RISC-V ABI([0]). [0]: https://riscv.org/wp-content/uploads/2024/12/riscv-calling.pdf Fixes: 25ad10658dc1 ("riscv, bpf: Adapt bpf trampoline to optimized riscv ftrace framework") Signed-off-by: Hengqi Chen <hengqi.chen(a)gmail.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Tested-by: Pu Lehui <pulehui(a)huawei.com> Reviewed-by: Pu Lehui <pulehui(a)huawei.com> Link: https://lore.kernel.org/bpf/20250908012448.1695-1-hengqi.chen@gmail.com Conflicts: arch/riscv/net/bpf_jit_comp64.c [Due to differences in the context of the patch modifications, there are no conflicts with the patch changes.] Signed-off-by: Wang Tao <wangtao554(a)huawei.com> --- arch/riscv/net/bpf_jit_comp64.c | 42 ++++++++++++++++++++++++++++++++- 1 file changed, 41 insertions(+), 1 deletion(-) diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c index 16eb4cd11cbd..ea9ce281c336 100644 --- a/arch/riscv/net/bpf_jit_comp64.c +++ b/arch/riscv/net/bpf_jit_comp64.c @@ -565,6 +565,39 @@ static void emit_atomic(u8 rd, u8 rs, s16 off, s32 imm, bool is64, } } +/* + * Sign-extend the register if necessary + */ +static int sign_extend(u8 rd, u8 rs, u8 sz, bool sign, struct rv_jit_context *ctx) +{ + if (!sign && (sz == 1 || sz == 2)) { + if (rd != rs) + emit_mv(rd, rs, ctx); + return 0; + } + + switch (sz) { + case 1: + emit_sextb(rd, rs, ctx); + break; + case 2: + emit_sexth(rd, rs, ctx); + break; + case 4: + emit_sextw(rd, rs, ctx); + break; + case 8: + if (rd != rs) + emit_mv(rd, rs, ctx); + break; + default: + pr_err("bpf-jit: invalid size %d for sign_extend\n", sz); + return -EINVAL; + } + + return 0; +} + #define BPF_FIXUP_OFFSET_MASK GENMASK(26, 0) #define BPF_FIXUP_REG_MASK GENMASK(31, 27) @@ -993,8 +1026,15 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, restore_args(nregs, args_off, ctx); if (save_ret) { - emit_ld(RV_REG_A0, -retval_off, RV_REG_FP, ctx); emit_ld(regmap[BPF_REG_0], -(retval_off - 8), RV_REG_FP, ctx); + if (is_struct_ops) { + ret = sign_extend(RV_REG_A0, regmap[BPF_REG_0], m->ret_size, + m->ret_flags & BTF_FMODEL_SIGNED_ARG, ctx); + if (ret) + goto out; + } else { + emit_ld(RV_REG_A0, -retval_off, RV_REG_FP, ctx); + } } emit_ld(RV_REG_S1, -sreg_off, RV_REG_FP, ctx); -- 2.34.1

2 1

[PATCH OLK-6.6] padata: Reset next CPU when reorder sequence wraps around
by Wang Tao 04 Nov '25

04 Nov '25

From: Xiao Liang <shaw.leon(a)gmail.com> mainline inclusion from mainline-v6.18-rc1 commit 501302d5cee0d8e8ec2c4a5919c37e0df9abc99b category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID3Y90 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When seq_nr wraps around, the next reorder job with seq 0 is hashed to the first CPU in padata_do_serial(). Correspondingly, need reset pd->cpu to the first one when pd->processed wraps around. Otherwise, if the number of used CPUs is not a power of 2, padata_find_next() will be checking a wrong list, hence deadlock. Fixes: 6fc4dbcf0276 ("padata: Replace delayed timer with immediate workqueue in padata_reorder") Cc: <stable(a)vger.kernel.org> Signed-off-by: Xiao Liang <shaw.leon(a)gmail.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Conflicts: kernel/padata.c [In mainline, commit f954a2d37637 ("padata: switch padata_find_next() to using cpumask_next_wrap()") has change the "cpumask_next_wrap" function.] Signed-off-by: Wang Tao <wangtao554(a)huawei.com> --- kernel/padata.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/kernel/padata.c b/kernel/padata.c index 44ea75bfd868..e87bbefdf0a0 100644 --- a/kernel/padata.c +++ b/kernel/padata.c @@ -307,8 +307,12 @@ static void padata_reorder(struct padata_priv *padata) struct padata_serial_queue *squeue; int cb_cpu; - cpu = cpumask_next_wrap(cpu, pd->cpumask.pcpu, -1, false); processed++; + /* When sequence wraps around, reset to the first CPU. */ + if (unlikely(processed == 0)) + cpu = cpumask_first(pd->cpumask.pcpu); + else + cpu = cpumask_next_wrap(cpu, pd->cpumask.pcpu, -1, false); cb_cpu = padata->cb_cpu; squeue = per_cpu_ptr(pd->squeue, cb_cpu); -- 2.34.1

2 1