- Kernel - mailweb.openeuler.org

[openeuler:OLK-5.10 3301/3301] drivers/misc/zcopy/zcopy.c:259:5: warning: no previous prototype for 'attach_huge_pmd'
by kernel test robot 23 Nov '25

23 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 40e02117ca786975378e324ac2e14cc00b00206e commit: 2125c55fc8765bced7091ccef19d2733a9ad9de0 [3301/3301] zcopy: Extend PMD trans hugepage mapping ability config: arm64-randconfig-002-20251123 (https://download.01.org/0day-ci/archive/20251123/202511230145.Q8A14oTe-lkp@…) compiler: aarch64-linux-gcc (GCC) 11.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251123/202511230145.Q8A14oTe-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511230145.Q8A14oTe-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/misc/zcopy/zcopy.c:259:5: warning: no previous prototype for 'attach_huge_pmd' [-Wmissing-prototypes] 259 | int attach_huge_pmd(struct vm_area_struct *dst_vma, struct vm_area_struct *src_vma, | ^~~~~~~~~~~~~~~ vim +/attach_huge_pmd +259 drivers/misc/zcopy/zcopy.c 258 > 259 int attach_huge_pmd(struct vm_area_struct *dst_vma, struct vm_area_struct *src_vma, 260 unsigned long dst_addr, unsigned long src_addr, pmd_t *dst_pmdp, pmd_t *src_pmdp) 261 { 262 struct mm_struct *dst_mm, *src_mm; 263 spinlock_t *src_ptl, *dst_ptl; 264 struct page *src_thp_page, *orig_thp_page; 265 pmd_t pmd, orig_pmd; 266 pgtable_t pgtable; 267 268 269 if (!vma_is_anonymous(dst_vma)) 270 return -EINVAL; 271 272 dst_mm = dst_vma->vm_mm; 273 src_mm = src_vma->vm_mm; 274 275 /* alloc a pgtable for new pmdp */ 276 pgtable = pte_alloc_one(dst_mm); 277 if (unlikely(!pgtable)) 278 return -ENOMEM; 279 280 src_ptl = pmd_lockptr(src_mm, src_pmdp); 281 dst_ptl = pmd_lockptr(dst_mm, dst_pmdp); 282 283 spin_lock(src_ptl); 284 pmd = *src_pmdp; 285 src_thp_page = pmd_page(pmd); 286 if (unlikely(!PageHead(src_thp_page))) { 287 pr_err("VM assertion failed: it is not a head page\n"); 288 spin_unlock(src_ptl); 289 return -EINVAL; 290 } 291 292 get_page(src_thp_page); 293 atomic_inc(compound_mapcount_ptr(src_thp_page)); 294 spin_unlock(src_ptl); 295 296 spin_lock_nested(dst_ptl, SINGLE_DEPTH_NESTING); 297 orig_pmd = *dst_pmdp; 298 /* umap the old page mappings */ 299 if (!pmd_none(orig_pmd)) { 300 orig_thp_page = pmd_page(orig_pmd); 301 put_page(orig_thp_page); 302 atomic_dec(compound_mapcount_ptr(orig_thp_page)); 303 zcopy_add_mm_counter(dst_mm, MM_ANONPAGES, -HPAGE_PMD_NR); 304 mm_dec_nr_ptes(dst_mm); 305 } 306 307 zcopy_add_mm_counter(dst_mm, MM_ANONPAGES, HPAGE_PMD_NR); 308 mm_inc_nr_ptes(dst_mm); 309 zcopy_pgtable_trans_huge_deposit(dst_mm, dst_pmdp, pgtable); 310 zcopy_set_pmd_at(dst_mm, dst_addr, dst_pmdp, pmd); 311 flush_tlb_range(dst_vma, dst_addr, dst_addr + HPAGE_PMD_SIZE); 312 spin_unlock(dst_ptl); 313 314 return 0; 315 } 316 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3304/3304] arch/arm64/kvm/vgic/vgic-its.c:567:40: error: passing argument 1 of 'hisi_ipiv_supported_per_vm' from incompatible pointer type
by kernel test robot 22 Nov '25

22 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: ea193ff9f080f6657caa2b5f907d5465ca3147dc commit: 22f1e3b38ca09cbc655a606e6404b996710841a1 [3304/3304] KVM: arm64: ipiv: fix bug in live migration config: arm64-defconfig (https://download.01.org/0day-ci/archive/20251122/202511221815.EIAnEfb9-lkp@…) compiler: aarch64-linux-gcc (GCC) 15.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251122/202511221815.EIAnEfb9-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511221815.EIAnEfb9-lkp@intel.com/ All errors (new ones prefixed by >>): arch/arm64/kvm/vgic/vgic-its.c: In function 'vgic_mmio_uaccess_write_its_iidr': >> arch/arm64/kvm/vgic/vgic-its.c:567:40: error: passing argument 1 of 'hisi_ipiv_supported_per_vm' from incompatible pointer type [-Wincompatible-pointer-types] 567 | if (hisi_ipiv_supported_per_vm(kvm) && | ^~~ | | | struct kvm * In file included from arch/arm64/kvm/vgic/vgic-its.c:25: arch/arm64/kvm/hisilicon/hisi_virt.h:127:64: note: expected 'struct kvm_vcpu *' but argument is of type 'struct kvm *' 127 | static inline bool hisi_ipiv_supported_per_vm(struct kvm_vcpu *vcpu) | ~~~~~~~~~~~~~~~~~^~~~ vim +/hisi_ipiv_supported_per_vm +567 arch/arm64/kvm/vgic/vgic-its.c 555 556 static int vgic_mmio_uaccess_write_its_iidr(struct kvm *kvm, 557 struct vgic_its *its, 558 gpa_t addr, unsigned int len, 559 unsigned long val) 560 { 561 u32 rev = GITS_IIDR_REV(val); 562 563 if (rev >= NR_ITS_ABIS) 564 return -EINVAL; 565 566 #ifdef CONFIG_ARM64_HISI_IPIV > 567 if (hisi_ipiv_supported_per_vm(kvm) && 568 val & (1UL << HISI_GUEST_ENABLE_IPIV_SHIFT)) 569 kvm->arch.vgic.its_vm.enable_ipiv_from_guest = true; 570 #endif 571 572 return vgic_its_set_abi(its, rev); 573 } 574 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping
by z00845436 22 Nov '25

22 Nov '25

From: Takashi Iwai <tiwai(a)suse.de> mainline inclusion from mainline-v6.18-rc1 commit 4336efb59ef364e691ef829a73d9dbd4d5ed7c7b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6BB3 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------- When an invalid value is passed via quirk option, currently bytcr_rt5640 driver just ignores and leaves as is, which may lead to unepxected results like OOB access. This patch adds the sanity check and corrects the input mapping to the certain default value if an invalid value is passed. Fixes: 64484ccee7af ("ASoC: Intel: bytcr_rt5651: Set card long_name based on quirks") Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Message-ID: <20250902171826.27329-4-tiwai(a)suse.de> Signed-off-by: Mark Brown <broonie(a)kernel.org> --- sound/soc/intel/boards/bytcr_rt5651.c | 26 +++++++++++++++++++++----- 1 file changed, 21 insertions(+), 5 deletions(-) diff --git a/sound/soc/intel/boards/bytcr_rt5651.c b/sound/soc/intel/boards/bytcr_rt5651.c index 805afaf47b29..2abe47303ecd 100644 --- a/sound/soc/intel/boards/bytcr_rt5651.c +++ b/sound/soc/intel/boards/bytcr_rt5651.c @@ -58,7 +58,8 @@ enum { BYT_RT5651_OVCD_SF_1P5 = (RT5651_OVCD_SF_1P5 << 13), }; -#define BYT_RT5651_MAP(quirk) ((quirk) & GENMASK(3, 0)) +#define BYT_RT5651_MAP_MASK GENMASK(3, 0) +#define BYT_RT5651_MAP(quirk) ((quirk) & BYT_RT5651_MAP_MASK) #define BYT_RT5651_JDSRC(quirk) (((quirk) & GENMASK(7, 4)) >> 4) #define BYT_RT5651_OVCD_TH(quirk) (((quirk) & GENMASK(12, 8)) >> 8) #define BYT_RT5651_OVCD_SF(quirk) (((quirk) & GENMASK(14, 13)) >> 13) @@ -100,14 +101,29 @@ MODULE_PARM_DESC(quirk, "Board-specific quirk override"); static void log_quirks(struct device *dev) { - if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_DMIC_MAP) + int map; + + map = BYT_RT5651_MAP(byt_rt5651_quirk); + switch (map) { + case BYT_RT5651_DMIC_MAP: dev_info(dev, "quirk DMIC_MAP enabled"); - if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_MAP) + break; + case BYT_RT5651_IN1_MAP: dev_info(dev, "quirk IN1_MAP enabled"); - if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN2_MAP) + break; + case BYT_RT5651_IN2_MAP: dev_info(dev, "quirk IN2_MAP enabled"); - if (BYT_RT5651_MAP(byt_rt5651_quirk) == BYT_RT5651_IN1_IN2_MAP) + break; + case BYT_RT5651_IN1_IN2_MAP: dev_info(dev, "quirk IN1_IN2_MAP enabled"); + break; + default: + dev_warn_once(dev, "quirk sets invalid input map: 0x%x, default to DMIC_MAP\n", map); + byt_rt5651_quirk &= ~BYT_RT5651_MAP_MASK; + byt_rt5651_quirk |= BYT_RT5651_DMIC_MAP; + break; + } + if (BYT_RT5651_JDSRC(byt_rt5651_quirk)) { dev_info(dev, "quirk realtek,jack-detect-source %ld\n", BYT_RT5651_JDSRC(byt_rt5651_quirk)); -- 2.43.0

2 1

[PATCH OLK-6.6] iommu/vt-d: debugfs: Fix legacy mode page table dump logic
by z00845436 22 Nov '25

22 Nov '25

From: "Vineeth Pillai (Google)" <vineeth(a)bitbyteword.org> mainline inclusion from mainline-v6.18-rc1 commit fbe6070c73badca726e4ff7877320e6c62339917 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6B92 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In legacy mode, SSPTPTR is ignored if TT is not 00b or 01b. SSPTPTR maybe uninitialized or zero in that case and may cause oops like: Oops: general protection fault, probably for non-canonical address 0xf00087d3f000f000: 0000 [#1] SMP NOPTI CPU: 2 UID: 0 PID: 786 Comm: cat Not tainted 6.16.0 #191 PREEMPT(voluntary) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-5.fc42 04/01/2014 RIP: 0010:pgtable_walk_level+0x98/0x150 RSP: 0018:ffffc90000f279c0 EFLAGS: 00010206 RAX: 0000000040000000 RBX: ffffc90000f27ab0 RCX: 000000000000001e RDX: 0000000000000003 RSI: f00087d3f000f000 RDI: f00087d3f0010000 RBP: ffffc90000f27a00 R08: ffffc90000f27a98 R09: 0000000000000002 R10: 0000000000000000 R11: 0000000000000000 R12: f00087d3f000f000 R13: 0000000000000000 R14: 0000000040000000 R15: ffffc90000f27a98 FS: 0000764566dcb740(0000) GS:ffff8881f812c000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000764566d44000 CR3: 0000000109d81003 CR4: 0000000000772ef0 PKRU: 55555554 Call Trace: <TASK> pgtable_walk_level+0x88/0x150 domain_translation_struct_show.isra.0+0x2d9/0x300 dev_domain_translation_struct_show+0x20/0x40 seq_read_iter+0x12d/0x490 ... Avoid walking the page table if TT is not 00b or 01b. Fixes: 2b437e804566 ("iommu/vt-d: debugfs: Support dumping a specified page table") Signed-off-by: Vineeth Pillai (Google) <vineeth(a)bitbyteword.org> Reviewed-by: Kevin Tian <kevin.tian(a)intel.com> Link: https://lore.kernel.org/r/20250814163153.634680-1-vineeth@bitbyteword.org Signed-off-by: Lu Baolu <baolu.lu(a)linux.intel.com> Signed-off-by: Joerg Roedel <joerg.roedel(a)amd.com> --- drivers/iommu/intel/debugfs.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/drivers/iommu/intel/debugfs.c b/drivers/iommu/intel/debugfs.c index 86b506af7daa..7223adfabd7d 100644 --- a/drivers/iommu/intel/debugfs.c +++ b/drivers/iommu/intel/debugfs.c @@ -435,8 +435,21 @@ static int domain_translation_struct_show(struct seq_file *m, } pgd &= VTD_PAGE_MASK; } else { /* legacy mode */ - pgd = context->lo & VTD_PAGE_MASK; - agaw = context->hi & 7; + u8 tt = (u8)(context->lo & GENMASK_ULL(3, 2)) >> 2; + + /* + * According to Translation Type(TT), + * get the page table pointer(SSPTPTR). + */ + switch (tt) { + case CONTEXT_TT_MULTI_LEVEL: + case CONTEXT_TT_DEV_IOTLB: + pgd = context->lo & VTD_PAGE_MASK; + agaw = context->hi & 7; + break; + default: + goto iommu_unlock; + } } seq_printf(m, "Device %04x:%02x:%02x.%x ", -- 2.43.0

2 1

[PATCH OLK-6.6] iommu/vt-d: debugfs: Fix legacy mode page table dump logic
by z00845436 22 Nov '25

22 Nov '25

From: "Vineeth Pillai (Google)" <vineeth(a)bitbyteword.org> mainline inclusion from mainline-v6.18-rc1 commit fbe6070c73badca726e4ff7877320e6c62339917 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6B92 Reference:https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.gi… -------------------------------- In legacy mode, SSPTPTR is ignored if TT is not 00b or 01b. SSPTPTR maybe uninitialized or zero in that case and may cause oops like: Oops: general protection fault, probably for non-canonical address 0xf00087d3f000f000: 0000 [#1] SMP NOPTI CPU: 2 UID: 0 PID: 786 Comm: cat Not tainted 6.16.0 #191 PREEMPT(voluntary) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-5.fc42 04/01/2014 RIP: 0010:pgtable_walk_level+0x98/0x150 RSP: 0018:ffffc90000f279c0 EFLAGS: 00010206 RAX: 0000000040000000 RBX: ffffc90000f27ab0 RCX: 000000000000001e RDX: 0000000000000003 RSI: f00087d3f000f000 RDI: f00087d3f0010000 RBP: ffffc90000f27a00 R08: ffffc90000f27a98 R09: 0000000000000002 R10: 0000000000000000 R11: 0000000000000000 R12: f00087d3f000f000 R13: 0000000000000000 R14: 0000000040000000 R15: ffffc90000f27a98 FS: 0000764566dcb740(0000) GS:ffff8881f812c000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000764566d44000 CR3: 0000000109d81003 CR4: 0000000000772ef0 PKRU: 55555554 Call Trace: <TASK> pgtable_walk_level+0x88/0x150 domain_translation_struct_show.isra.0+0x2d9/0x300 dev_domain_translation_struct_show+0x20/0x40 seq_read_iter+0x12d/0x490 ... Avoid walking the page table if TT is not 00b or 01b. Fixes: 2b437e804566 ("iommu/vt-d: debugfs: Support dumping a specified page table") Signed-off-by: Vineeth Pillai (Google) <vineeth(a)bitbyteword.org> Reviewed-by: Kevin Tian <kevin.tian(a)intel.com> Link: https://lore.kernel.org/r/20250814163153.634680-1-vineeth@bitbyteword.org Signed-off-by: Lu Baolu <baolu.lu(a)linux.intel.com> Signed-off-by: Joerg Roedel <joerg.roedel(a)amd.com> --- drivers/iommu/intel/debugfs.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/drivers/iommu/intel/debugfs.c b/drivers/iommu/intel/debugfs.c index 86b506af7daa..7223adfabd7d 100644 --- a/drivers/iommu/intel/debugfs.c +++ b/drivers/iommu/intel/debugfs.c @@ -435,8 +435,21 @@ static int domain_translation_struct_show(struct seq_file *m, } pgd &= VTD_PAGE_MASK; } else { /* legacy mode */ - pgd = context->lo & VTD_PAGE_MASK; - agaw = context->hi & 7; + u8 tt = (u8)(context->lo & GENMASK_ULL(3, 2)) >> 2; + + /* + * According to Translation Type(TT), + * get the page table pointer(SSPTPTR). + */ + switch (tt) { + case CONTEXT_TT_MULTI_LEVEL: + case CONTEXT_TT_DEV_IOTLB: + pgd = context->lo & VTD_PAGE_MASK; + agaw = context->hi & 7; + break; + default: + goto iommu_unlock; + } } seq_printf(m, "Device %04x:%02x:%02x.%x ", -- 2.43.0

2 1

[PATCH OLK-6.6] iommu/vt-d: debugfs: Fix legacy mode page table dump logic
by z00845436 22 Nov '25

22 Nov '25

From: "Vineeth Pillai (Google)" <vineeth(a)bitbyteword.org> mainline inclusion from mainline-v6.18-rc1 commit fbe6070c73badca726e4ff7877320e6c62339917 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6B92 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In legacy mode, SSPTPTR is ignored if TT is not 00b or 01b. SSPTPTR maybe uninitialized or zero in that case and may cause oops like: Oops: general protection fault, probably for non-canonical address 0xf00087d3f000f000: 0000 [#1] SMP NOPTI CPU: 2 UID: 0 PID: 786 Comm: cat Not tainted 6.16.0 #191 PREEMPT(voluntary) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-5.fc42 04/01/2014 RIP: 0010:pgtable_walk_level+0x98/0x150 RSP: 0018:ffffc90000f279c0 EFLAGS: 00010206 RAX: 0000000040000000 RBX: ffffc90000f27ab0 RCX: 000000000000001e RDX: 0000000000000003 RSI: f00087d3f000f000 RDI: f00087d3f0010000 RBP: ffffc90000f27a00 R08: ffffc90000f27a98 R09: 0000000000000002 R10: 0000000000000000 R11: 0000000000000000 R12: f00087d3f000f000 R13: 0000000000000000 R14: 0000000040000000 R15: ffffc90000f27a98 FS: 0000764566dcb740(0000) GS:ffff8881f812c000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000764566d44000 CR3: 0000000109d81003 CR4: 0000000000772ef0 PKRU: 55555554 Call Trace: <TASK> pgtable_walk_level+0x88/0x150 domain_translation_struct_show.isra.0+0x2d9/0x300 dev_domain_translation_struct_show+0x20/0x40 seq_read_iter+0x12d/0x490 ... Avoid walking the page table if TT is not 00b or 01b. Fixes: 2b437e804566 ("iommu/vt-d: debugfs: Support dumping a specified page table") Signed-off-by: Vineeth Pillai (Google) <vineeth(a)bitbyteword.org> Reviewed-by: Kevin Tian <kevin.tian(a)intel.com> Link: https://lore.kernel.org/r/20250814163153.634680-1-vineeth@bitbyteword.org Signed-off-by: Lu Baolu <baolu.lu(a)linux.intel.com> Signed-off-by: Joerg Roedel <joerg.roedel(a)amd.com> --- drivers/iommu/intel/debugfs.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/drivers/iommu/intel/debugfs.c b/drivers/iommu/intel/debugfs.c index 86b506af7daa..7223adfabd7d 100644 --- a/drivers/iommu/intel/debugfs.c +++ b/drivers/iommu/intel/debugfs.c @@ -435,8 +435,21 @@ static int domain_translation_struct_show(struct seq_file *m, } pgd &= VTD_PAGE_MASK; } else { /* legacy mode */ - pgd = context->lo & VTD_PAGE_MASK; - agaw = context->hi & 7; + u8 tt = (u8)(context->lo & GENMASK_ULL(3, 2)) >> 2; + + /* + * According to Translation Type(TT), + * get the page table pointer(SSPTPTR). + */ + switch (tt) { + case CONTEXT_TT_MULTI_LEVEL: + case CONTEXT_TT_DEV_IOTLB: + pgd = context->lo & VTD_PAGE_MASK; + agaw = context->hi & 7; + break; + default: + goto iommu_unlock; + } } seq_printf(m, "Device %04x:%02x:%02x.%x ", -- 2.43.0

2 1

[openeuler:OLK-6.6 3304/3304] drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:450:39: error: incomplete definition of type 'struct ieee_pfc'
by kernel test robot 22 Nov '25

22 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 2e375b157ddf25336989b074c1f2a88a80ab72f5 commit: 2048b5b7f264f56a4d9e73079e790e13c8596aaf [3304/3304] net: wangxun: txgbe: add support for wangxun 10G/25G/40G config: x86_64-randconfig-015-20251122 (https://download.01.org/0day-ci/archive/20251122/202511221659.lFpcDW1g-lkp@…) compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251122/202511221659.lFpcDW1g-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511221659.lFpcDW1g-lkp@intel.com/ All error/warnings (new ones prefixed by >>): In file included from drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:28: In file included from drivers/net/ethernet/wangxun/txgbe/txgbe_xsk.h:7: drivers/net/ethernet/wangxun/txgbe/txgbe.h:987:6: warning: variable 'cur_diff' set but not used [-Wunused-but-set-variable] 987 | u32 cur_diff = 0; | ^ >> drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:450:39: error: incomplete definition of type 'struct ieee_pfc' 450 | pfc_en |= !!(adapter->txgbe_ieee_pfc->pfc_en); | ~~~~~~~~~~~~~~~~~~~~~~~^ drivers/net/ethernet/wangxun/txgbe/txgbe.h:814:9: note: forward declaration of 'struct ieee_pfc' 814 | struct ieee_pfc *txgbe_ieee_pfc; | ^ drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:582:7: warning: variable 'real_tx_hang' set but not used [-Wunused-but-set-variable] 582 | bool real_tx_hang = false; | ^ drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:2618:21: warning: variable 'tx_ring' set but not used [-Wunused-but-set-variable] 2618 | struct txgbe_ring *tx_ring; | ^ drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:3270:39: error: incomplete definition of type 'struct ieee_pfc' 3270 | pfc_en |= !!(adapter->txgbe_ieee_pfc->pfc_en); | ~~~~~~~~~~~~~~~~~~~~~~~^ drivers/net/ethernet/wangxun/txgbe/txgbe.h:814:9: note: forward declaration of 'struct ieee_pfc' 814 | struct ieee_pfc *txgbe_ieee_pfc; | ^ drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:4403:20: warning: variable 'vlnctrl' set but not used [-Wunused-but-set-variable] 4403 | u32 fctrl, vmolr, vlnctrl; | ^ >> drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:4517:15: error: use of undeclared identifier 'IEEE_8021QAZ_MAX_TCS' 4517 | __u16 refill[IEEE_8021QAZ_MAX_TCS], max[IEEE_8021QAZ_MAX_TCS]; | ^ drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:4517:42: error: use of undeclared identifier 'IEEE_8021QAZ_MAX_TCS' 4517 | __u16 refill[IEEE_8021QAZ_MAX_TCS], max[IEEE_8021QAZ_MAX_TCS]; | ^ drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:4518:17: error: use of undeclared identifier 'IEEE_8021QAZ_MAX_TCS' 4518 | __u8 prio_type[IEEE_8021QAZ_MAX_TCS]; | ^ drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:4522:14: error: use of undeclared identifier 'IEEE_8021QAZ_MAX_TCS' 4522 | __u8 bwg_id[IEEE_8021QAZ_MAX_TCS] = {0, 1, 2, 3, 4, 5, 6, 7}; | ^ drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:4525:18: error: use of undeclared identifier 'IEEE_8021QAZ_MAX_TCS' 4525 | for (i = 0; i < IEEE_8021QAZ_MAX_TCS; i++) { | ^ >> drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:4526:14: error: incomplete definition of type 'struct ieee_ets' 4526 | switch (ets->tc_tsa[i]) { | ~~~^ drivers/net/ethernet/wangxun/txgbe/txgbe.h:815:9: note: forward declaration of 'struct ieee_ets' 815 | struct ieee_ets *txgbe_ieee_ets; | ^ >> drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:4527:8: error: use of undeclared identifier 'IEEE_8021QAZ_TSA_STRICT' 4527 | case IEEE_8021QAZ_TSA_STRICT: | ^ >> drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:4530:8: error: use of undeclared identifier 'IEEE_8021QAZ_TSA_ETS' 4530 | case IEEE_8021QAZ_TSA_ETS: | ^ drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:4543:36: error: incomplete definition of type 'struct ieee_ets' 4543 | txgbe_dcb_calculate_tc_credits(ets->tc_tx_bw, refill, max, max_frame); | ~~~^ drivers/net/ethernet/wangxun/txgbe/txgbe.h:815:9: note: forward declaration of 'struct ieee_ets' 815 | struct ieee_ets *txgbe_ieee_ets; | ^ >> drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:4543:56: error: use of undeclared identifier 'max' 4543 | txgbe_dcb_calculate_tc_credits(ets->tc_tx_bw, refill, max, max_frame); | ^ drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:4545:30: error: incomplete definition of type 'struct ieee_ets' 4545 | bwg_id, prio_type, ets->prio_tc); | ~~~^ drivers/net/ethernet/wangxun/txgbe/txgbe.h:815:9: note: forward declaration of 'struct ieee_ets' 815 | struct ieee_ets *txgbe_ieee_ets; | ^ drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:4544:41: error: use of undeclared identifier 'max' 4544 | return txgbe_dcb_hw_config(hw, refill, max, | ^ >> drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:4515:5: warning: no previous prototype for function 'txgbe_dcb_hw_ets' [-Wmissing-prototypes] 4515 | s32 txgbe_dcb_hw_ets(struct txgbe_hw *hw, struct ieee_ets *ets, int max_frame) | ^ drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:4515:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 4515 | s32 txgbe_dcb_hw_ets(struct txgbe_hw *hw, struct ieee_ets *ets, int max_frame) | ^ | static >> drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:4591:26: error: use of undeclared identifier 'DCB_CAP_DCBX_VER_IEEE' 4591 | if (adapter->dcbx_cap & DCB_CAP_DCBX_VER_IEEE) { | ^ drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:4599:36: error: incomplete definition of type 'struct ieee_ets' 4599 | u8 *tc = adapter->txgbe_ieee_ets->prio_tc; | ~~~~~~~~~~~~~~~~~~~~~~~^ drivers/net/ethernet/wangxun/txgbe/txgbe.h:815:9: note: forward declaration of 'struct ieee_ets' 815 | struct ieee_ets *txgbe_ieee_ets; | ^ drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:4601:42: error: incomplete definition of type 'struct ieee_pfc' 4601 | txgbe_dcb_config_pfc(&adapter->hw, pfc->pfc_en, tc); | ~~~^ drivers/net/ethernet/wangxun/txgbe/txgbe.h:814:9: note: forward declaration of 'struct ieee_pfc' 814 | struct ieee_pfc *txgbe_ieee_pfc; | ^ drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:6709:9: warning: variable 'missed_rx' set but not used [-Wunused-but-set-variable] 6709 | u32 i, missed_rx = 0, mpc, bprc, lxon, lxoff; | ^ drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:6915:6: warning: no previous prototype for function 'txgbe_irq_rearm_queues' [-Wmissing-prototypes] 6915 | void txgbe_irq_rearm_queues(struct txgbe_adapter *adapter, | ^ drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:6915:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 6915 | void txgbe_irq_rearm_queues(struct txgbe_adapter *adapter, | ^ | static drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:7007:39: error: incomplete definition of type 'struct ieee_pfc' 7007 | pfc_en |= !!(adapter->txgbe_ieee_pfc->pfc_en); | ~~~~~~~~~~~~~~~~~~~~~~~^ drivers/net/ethernet/wangxun/txgbe/txgbe.h:814:9: note: forward declaration of 'struct ieee_pfc' 814 | struct ieee_pfc *txgbe_ieee_pfc; | ^ >> drivers/net/ethernet/wangxun/txgbe/txgbe_main.c:7091:22: error: use of undeclared identifier 'DCB_APP_IDTYPE_ETHTYPE' 7091 | .selector = DCB_APP_IDTYPE_ETHTYPE, | ^ fatal error: too many errors emitted, stopping now [-ferror-limit=] 7 warnings and 20 errors generated. vim +450 drivers/net/ethernet/wangxun/txgbe/txgbe_main.c 439 440 static void txgbe_update_xoff_received(struct txgbe_adapter *adapter) 441 { 442 struct txgbe_hw *hw = &adapter->hw; 443 struct txgbe_hw_stats *hwstats = &adapter->stats; 444 u32 xoff[8] = {0}; 445 int tc; 446 int i; 447 bool pfc_en = adapter->dcb_cfg.pfc_mode_enable; 448 449 if (adapter->txgbe_ieee_pfc) > 450 pfc_en |= !!(adapter->txgbe_ieee_pfc->pfc_en); 451 452 if (!(adapter->flags & TXGBE_FLAG_DCB_ENABLED) || !pfc_en) { 453 txgbe_update_xoff_rx_lfc(adapter); 454 return; 455 } 456 457 /* update stats for each tc, only valid with PFC enabled */ 458 for (i = 0; i < MAX_TX_PACKET_BUFFERS; i++) { 459 u32 pxoffrxc; 460 461 wr32m(hw, TXGBE_MMC_CONTROL, TXGBE_MMC_CONTROL_UP, i << 16); 462 pxoffrxc = rd32(hw, TXGBE_MAC_PXOFFRXC); 463 hwstats->pxoffrxc[i] += pxoffrxc; 464 /* Get the TC for given UP */ 465 tc = netdev_get_prio_tc_map(adapter->netdev, i); 466 xoff[tc] += pxoffrxc; 467 } 468 469 /* disarm tx queues that have received xoff frames */ 470 for (i = 0; i < adapter->num_tx_queues; i++) { 471 struct txgbe_ring *tx_ring = adapter->tx_ring[i]; 472 473 tc = tx_ring->dcb_tc; 474 if (tc <= 7 && xoff[tc]) 475 clear_bit(__TXGBE_HANG_CHECK_ARMED, &tx_ring->state); 476 } 477 for (i = 0; i < adapter->num_xdp_queues; i++) { 478 struct txgbe_ring *xdp_ring = adapter->xdp_ring[i]; 479 480 tc = xdp_ring->dcb_tc; 481 if (tc <= 7 && xoff[tc]) 482 clear_bit(__TXGBE_HANG_CHECK_ARMED, &xdp_ring->state); 483 } 484 } 485 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3304/3304] arch/arm64/kvm/hypercalls.c:380:52: error: passing argument 1 of 'hisi_ipiv_supported_per_vm' from incompatible pointer type
by kernel test robot 22 Nov '25

22 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 2e375b157ddf25336989b074c1f2a88a80ab72f5 commit: cbd165f529bd32b586342c0a2d11c3ca50b9fdd3 [3304/3304] KVM: arm64: ipiv: Change parameter from vcpu to kvm config: arm64-defconfig (https://download.01.org/0day-ci/archive/20251122/202511221643.H3LgffBo-lkp@…) compiler: aarch64-linux-gcc (GCC) 15.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251122/202511221643.H3LgffBo-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511221643.H3LgffBo-lkp@intel.com/ All errors (new ones prefixed by >>): arch/arm64/kvm/hypercalls.c: In function 'kvm_smccc_call_handler': >> arch/arm64/kvm/hypercalls.c:380:52: error: passing argument 1 of 'hisi_ipiv_supported_per_vm' from incompatible pointer type [-Wincompatible-pointer-types] 380 | if (hisi_ipiv_supported_per_vm(vcpu->kvm)) | ~~~~^~~~~ | | | struct kvm * In file included from arch/arm64/kvm/hypercalls.c:13: arch/arm64/kvm/hisilicon/hisi_virt.h:127:64: note: expected 'struct kvm_vcpu *' but argument is of type 'struct kvm *' 127 | static inline bool hisi_ipiv_supported_per_vm(struct kvm_vcpu *vcpu) | ~~~~~~~~~~~~~~~~~^~~~ arch/arm64/kvm/hypercalls.c:386:52: error: passing argument 1 of 'hisi_ipiv_supported_per_vm' from incompatible pointer type [-Wincompatible-pointer-types] 386 | if (hisi_ipiv_supported_per_vm(vcpu->kvm)) { | ~~~~^~~~~ | | | struct kvm * arch/arm64/kvm/hisilicon/hisi_virt.h:127:64: note: expected 'struct kvm_vcpu *' but argument is of type 'struct kvm *' 127 | static inline bool hisi_ipiv_supported_per_vm(struct kvm_vcpu *vcpu) | ~~~~~~~~~~~~~~~~~^~~~ >> arch/arm64/kvm/hypercalls.c:387:53: error: passing argument 1 of 'hisi_ipiv_enable_per_vm' from incompatible pointer type [-Wincompatible-pointer-types] 387 | hisi_ipiv_enable_per_vm(vcpu->kvm); | ~~~~^~~~~ | | | struct kvm * arch/arm64/kvm/hisilicon/hisi_virt.h:131:61: note: expected 'struct kvm_vcpu *' but argument is of type 'struct kvm *' 131 | static inline void hisi_ipiv_enable_per_vm(struct kvm_vcpu *vcpu) {} | ~~~~~~~~~~~~~~~~~^~~~ vim +/hisi_ipiv_supported_per_vm +380 arch/arm64/kvm/hypercalls.c 264 265 int kvm_smccc_call_handler(struct kvm_vcpu *vcpu) 266 { 267 struct kvm_smccc_features *smccc_feat = &vcpu->kvm->arch.smccc_feat; 268 u32 func_id = smccc_get_function(vcpu); 269 u64 val[4] = {SMCCC_RET_NOT_SUPPORTED}; 270 u32 feature; 271 u8 action; 272 gpa_t gpa; 273 274 action = kvm_smccc_get_action(vcpu, func_id); 275 switch (action) { 276 case KVM_SMCCC_FILTER_HANDLE: 277 break; 278 case KVM_SMCCC_FILTER_DENY: 279 goto out; 280 case KVM_SMCCC_FILTER_FWD_TO_USER: 281 kvm_prepare_hypercall_exit(vcpu, func_id); 282 return 0; 283 default: 284 WARN_RATELIMIT(1, "Unhandled SMCCC filter action: %d\n", action); 285 goto out; 286 } 287 288 switch (func_id) { 289 case ARM_SMCCC_VERSION_FUNC_ID: 290 val[0] = ARM_SMCCC_VERSION_1_1; 291 break; 292 case ARM_SMCCC_ARCH_FEATURES_FUNC_ID: 293 feature = smccc_get_arg1(vcpu); 294 switch (feature) { 295 case ARM_SMCCC_ARCH_WORKAROUND_1: 296 switch (arm64_get_spectre_v2_state()) { 297 case SPECTRE_VULNERABLE: 298 break; 299 case SPECTRE_MITIGATED: 300 val[0] = SMCCC_RET_SUCCESS; 301 break; 302 case SPECTRE_UNAFFECTED: 303 val[0] = SMCCC_ARCH_WORKAROUND_RET_UNAFFECTED; 304 break; 305 } 306 break; 307 case ARM_SMCCC_ARCH_WORKAROUND_2: 308 switch (arm64_get_spectre_v4_state()) { 309 case SPECTRE_VULNERABLE: 310 break; 311 case SPECTRE_MITIGATED: 312 /* 313 * SSBS everywhere: Indicate no firmware 314 * support, as the SSBS support will be 315 * indicated to the guest and the default is 316 * safe. 317 * 318 * Otherwise, expose a permanent mitigation 319 * to the guest, and hide SSBS so that the 320 * guest stays protected. 321 */ 322 if (cpus_have_final_cap(ARM64_SSBS)) 323 break; 324 fallthrough; 325 case SPECTRE_UNAFFECTED: 326 val[0] = SMCCC_RET_NOT_REQUIRED; 327 break; 328 } 329 break; 330 case ARM_SMCCC_ARCH_WORKAROUND_3: 331 switch (arm64_get_spectre_bhb_state()) { 332 case SPECTRE_VULNERABLE: 333 break; 334 case SPECTRE_MITIGATED: 335 val[0] = SMCCC_RET_SUCCESS; 336 break; 337 case SPECTRE_UNAFFECTED: 338 val[0] = SMCCC_ARCH_WORKAROUND_RET_UNAFFECTED; 339 break; 340 } 341 break; 342 case ARM_SMCCC_HV_PV_TIME_FEATURES: 343 if (test_bit(KVM_REG_ARM_STD_HYP_BIT_PV_TIME, 344 &smccc_feat->std_hyp_bmap)) 345 val[0] = SMCCC_RET_SUCCESS; 346 break; 347 #ifdef CONFIG_PARAVIRT_SCHED 348 case ARM_SMCCC_HV_PV_SCHED_FEATURES: 349 val[0] = SMCCC_RET_SUCCESS; 350 break; 351 #endif /* CONFIG_PARAVIRT_SCHED */ 352 } 353 break; 354 case ARM_SMCCC_HV_PV_TIME_FEATURES: 355 val[0] = kvm_hypercall_pv_features(vcpu); 356 break; 357 case ARM_SMCCC_HV_PV_TIME_ST: 358 gpa = kvm_init_stolen_time(vcpu); 359 if (gpa != INVALID_GPA) 360 val[0] = gpa; 361 break; 362 #ifdef CONFIG_PARAVIRT_SCHED 363 case ARM_SMCCC_HV_PV_SCHED_FEATURES: 364 val[0] = kvm_hypercall_pvsched_features(vcpu); 365 break; 366 case ARM_SMCCC_HV_PV_SCHED_IPA_INIT: 367 gpa = smccc_get_arg1(vcpu); 368 if (gpa != INVALID_GPA) { 369 vcpu->arch.pvsched.base = gpa; 370 val[0] = SMCCC_RET_SUCCESS; 371 } 372 break; 373 case ARM_SMCCC_HV_PV_SCHED_IPA_RELEASE: 374 vcpu->arch.pvsched.base = INVALID_GPA; 375 val[0] = SMCCC_RET_SUCCESS; 376 break; 377 #endif /* CONFIG_PARAVIRT_SCHED */ 378 #ifdef CONFIG_ARM64_HISI_IPIV 379 case ARM_SMCCC_VENDOR_PV_SGI_FEATURES: > 380 if (hisi_ipiv_supported_per_vm(vcpu->kvm)) 381 val[0] = SMCCC_RET_SUCCESS; 382 else 383 val[0] = SMCCC_RET_NOT_SUPPORTED; 384 break; 385 case ARM_SMCCC_VENDOR_PV_SGI_ENABLE: > 386 if (hisi_ipiv_supported_per_vm(vcpu->kvm)) { > 387 hisi_ipiv_enable_per_vm(vcpu->kvm); 388 val[0] = SMCCC_RET_SUCCESS; 389 } else { 390 val[0] = SMCCC_RET_NOT_SUPPORTED; 391 } 392 break; 393 #endif 394 case ARM_SMCCC_VENDOR_HYP_CALL_UID_FUNC_ID: 395 val[0] = ARM_SMCCC_VENDOR_HYP_UID_KVM_REG_0; 396 val[1] = ARM_SMCCC_VENDOR_HYP_UID_KVM_REG_1; 397 val[2] = ARM_SMCCC_VENDOR_HYP_UID_KVM_REG_2; 398 val[3] = ARM_SMCCC_VENDOR_HYP_UID_KVM_REG_3; 399 break; 400 case ARM_SMCCC_VENDOR_HYP_KVM_FEATURES_FUNC_ID: 401 val[0] = smccc_feat->vendor_hyp_bmap; 402 /* Function numbers 2-63 are reserved for pKVM for now */ 403 val[2] = smccc_feat->vendor_hyp_bmap_2; 404 break; 405 case ARM_SMCCC_VENDOR_HYP_KVM_PTP_FUNC_ID: 406 kvm_ptp_get_time(vcpu, val); 407 break; 408 case ARM_SMCCC_TRNG_VERSION: 409 case ARM_SMCCC_TRNG_FEATURES: 410 case ARM_SMCCC_TRNG_GET_UUID: 411 case ARM_SMCCC_TRNG_RND32: 412 case ARM_SMCCC_TRNG_RND64: 413 return kvm_trng_call(vcpu); 414 default: 415 return kvm_psci_call(vcpu); 416 } 417 418 out: 419 smccc_set_retval(vcpu, val[0], val[1], val[2], val[3]); 420 return 1; 421 } 422 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] crypto: essiv - Check ssize for decryption and in-place encryption
by Yi Yang 22 Nov '25

22 Nov '25

From: Herbert Xu <herbert(a)gondor.apana.org.au> mainline inclusion from mainline-v6.18-rc1 commit 6bb73db6948c2de23e407fe1b7ef94bf02b7529f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID3FOP CVE: CVE-2025-40019 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Move the ssize check to the start in essiv_aead_crypt so that it's also checked for decryption and in-place encryption. Reported-by: Muhammad Alifa Ramdhan <ramdhan(a)starlabs.sg> Fixes: be1eb7f78aa8 ("crypto: essiv - create wrapper template for ESSIV generation") Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- crypto/essiv.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/crypto/essiv.c b/crypto/essiv.c index 85bb624e32b9..7db206fc97f2 100644 --- a/crypto/essiv.c +++ b/crypto/essiv.c @@ -185,9 +185,14 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc) const struct essiv_tfm_ctx *tctx = crypto_aead_ctx(tfm); struct essiv_aead_request_ctx *rctx = aead_request_ctx(req); struct aead_request *subreq = &rctx->aead_req; + int ivsize = crypto_aead_ivsize(tfm); + int ssize = req->assoclen - ivsize; struct scatterlist *src = req->src; int err; + if (ssize < 0) + return -EINVAL; + crypto_cipher_encrypt_one(tctx->essiv_cipher, req->iv, req->iv); /* @@ -197,19 +202,12 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc) */ rctx->assoc = NULL; if (req->src == req->dst || !enc) { - scatterwalk_map_and_copy(req->iv, req->dst, - req->assoclen - crypto_aead_ivsize(tfm), - crypto_aead_ivsize(tfm), 1); + scatterwalk_map_and_copy(req->iv, req->dst, ssize, ivsize, 1); } else { u8 *iv = (u8 *)aead_request_ctx(req) + tctx->ivoffset; - int ivsize = crypto_aead_ivsize(tfm); - int ssize = req->assoclen - ivsize; struct scatterlist *sg; int nents; - if (ssize < 0) - return -EINVAL; - nents = sg_nents_for_len(req->src, ssize); if (nents < 0) return -EINVAL; -- 2.25.1

2 1

[PATCH OLK-6.6] drm/vmwgfx: Fix a null-ptr access in the cursor snooper
by Yi Yang 22 Nov '25

22 Nov '25

From: Zack Rusin <zack.rusin(a)broadcom.com> stable inclusion from stable-v6.6.113 commit 299cfb5a7deabdf9ecd30071755672af0aced5eb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6796 CVE: CVE-2025-40110 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5ac2c0279053a2c5265d46903432fb26ae2d0da2 ] Check that the resource which is converted to a surface exists before trying to use the cursor snooper on it. vmw_cmd_res_check allows explicit invalid (SVGA3D_INVALID_ID) identifiers because some svga commands accept SVGA3D_INVALID_ID to mean "no surface", unfortunately functions that accept the actual surfaces as objects might (and in case of the cursor snooper, do not) be able to handle null objects. Make sure that we validate not only the identifier (via the vmw_cmd_res_check) but also check that the actual resource exists before trying to do something with it. Fixes unchecked null-ptr reference in the snooping code. Signed-off-by: Zack Rusin <zack.rusin(a)broadcom.com> Fixes: c0951b797e7d ("drm/vmwgfx: Refactor resource management") Reported-by: Kuzey Arda Bulut <kuzeyardabulut(a)gmail.com> Cc: Broadcom internal kernel review list <bcm-kernel-feedback-list(a)broadcom.com> Cc: dri-devel(a)lists.freedesktop.org Reviewed-by: Ian Forbes <ian.forbes(a)broadcom.com> Link: https://lore.kernel.org/r/20250917153655.1968583-1-zack.rusin@broadcom.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c index 5fef0b31c117..41be22e781e4 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c @@ -1514,6 +1514,7 @@ static int vmw_cmd_dma(struct vmw_private *dev_priv, SVGA3dCmdHeader *header) { struct vmw_bo *vmw_bo = NULL; + struct vmw_resource *res; struct vmw_surface *srf = NULL; VMW_DECLARE_CMD_VAR(*cmd, SVGA3dCmdSurfaceDMA); int ret; @@ -1549,18 +1550,24 @@ static int vmw_cmd_dma(struct vmw_private *dev_priv, dirty = (cmd->body.transfer == SVGA3D_WRITE_HOST_VRAM) ? VMW_RES_DIRTY_SET : 0; - ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface, - dirty, user_surface_converter, - &cmd->body.host.sid, NULL); + ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface, dirty, + user_surface_converter, &cmd->body.host.sid, + NULL); if (unlikely(ret != 0)) { if (unlikely(ret != -ERESTARTSYS)) VMW_DEBUG_USER("could not find surface for DMA.\n"); return ret; } - srf = vmw_res_to_srf(sw_context->res_cache[vmw_res_surface].res); + res = sw_context->res_cache[vmw_res_surface].res; + if (!res) { + VMW_DEBUG_USER("Invalid DMA surface.\n"); + return -EINVAL; + } - vmw_kms_cursor_snoop(srf, sw_context->fp->tfile, &vmw_bo->tbo, header); + srf = vmw_res_to_srf(res); + vmw_kms_cursor_snoop(srf, sw_context->fp->tfile, &vmw_bo->tbo, + header); return 0; } -- 2.25.1

2 1