- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port()
by Yifan Qiao 05 Aug '25

05 Aug '25

From: Maurizio Lombardi <mlombard(a)redhat.com> mainline inclusion from mainline-v6.16-rc3 commit d8ab68bdb294b09a761e967dad374f2965e1913f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICOXB6 CVE: CVE-2025-38399 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The function core_scsi3_decode_spec_i_port(), in its error code path, unconditionally calls core_scsi3_lunacl_undepend_item() passing the dest_se_deve pointer, which may be NULL. This can lead to a NULL pointer dereference if dest_se_deve remains unset. SPC-3 PR SPEC_I_PT: Unable to locate dest_tpg Unable to handle kernel paging request at virtual address dfff800000000012 Call trace: core_scsi3_lunacl_undepend_item+0x2c/0xf0 [target_core_mod] (P) core_scsi3_decode_spec_i_port+0x120c/0x1c30 [target_core_mod] core_scsi3_emulate_pro_register+0x6b8/0xcd8 [target_core_mod] target_scsi3_emulate_pr_out+0x56c/0x840 [target_core_mod] Fix this by adding a NULL check before calling core_scsi3_lunacl_undepend_item() Signed-off-by: Maurizio Lombardi <mlombard(a)redhat.com> Link: https://lore.kernel.org/r/20250612101556.24829-1-mlombard@redhat.com Reviewed-by: Mike Christie <michael.christie(a)oracle.com> Reviewed-by: John Meneghini <jmeneghi(a)redhat.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- drivers/target/target_core_pr.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c index b42193c554fb..2bc849799739 100644 --- a/drivers/target/target_core_pr.c +++ b/drivers/target/target_core_pr.c @@ -1858,7 +1858,9 @@ core_scsi3_decode_spec_i_port( } kmem_cache_free(t10_pr_reg_cache, dest_pr_reg); - core_scsi3_lunacl_undepend_item(dest_se_deve); + + if (dest_se_deve) + core_scsi3_lunacl_undepend_item(dest_se_deve); if (is_local) continue; -- 2.39.2

2 1

[PATCH OLK-6.6] scsi: target: Fix NULL pointer dereference in core_scsi3_decode_spec_i_port()
by Yifan Qiao 05 Aug '25

05 Aug '25

From: Maurizio Lombardi <mlombard(a)redhat.com> mainline inclusion from mainline-v6.16-rc3 commit d8ab68bdb294b09a761e967dad374f2965e1913f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICOXB6 CVE: CVE-2025-38399 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The function core_scsi3_decode_spec_i_port(), in its error code path, unconditionally calls core_scsi3_lunacl_undepend_item() passing the dest_se_deve pointer, which may be NULL. This can lead to a NULL pointer dereference if dest_se_deve remains unset. SPC-3 PR SPEC_I_PT: Unable to locate dest_tpg Unable to handle kernel paging request at virtual address dfff800000000012 Call trace: core_scsi3_lunacl_undepend_item+0x2c/0xf0 [target_core_mod] (P) core_scsi3_decode_spec_i_port+0x120c/0x1c30 [target_core_mod] core_scsi3_emulate_pro_register+0x6b8/0xcd8 [target_core_mod] target_scsi3_emulate_pr_out+0x56c/0x840 [target_core_mod] Fix this by adding a NULL check before calling core_scsi3_lunacl_undepend_item() Signed-off-by: Maurizio Lombardi <mlombard(a)redhat.com> Link: https://lore.kernel.org/r/20250612101556.24829-1-mlombard@redhat.com Reviewed-by: Mike Christie <michael.christie(a)oracle.com> Reviewed-by: John Meneghini <jmeneghi(a)redhat.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- drivers/target/target_core_pr.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c index 49d9167bb263..a9eb6a3e8383 100644 --- a/drivers/target/target_core_pr.c +++ b/drivers/target/target_core_pr.c @@ -1841,7 +1841,9 @@ core_scsi3_decode_spec_i_port( } kmem_cache_free(t10_pr_reg_cache, dest_pr_reg); - core_scsi3_lunacl_undepend_item(dest_se_deve); + + if (dest_se_deve) + core_scsi3_lunacl_undepend_item(dest_se_deve); if (is_local) continue; -- 2.39.2

2 1

[PATCH OLK-6.6] sdei_watchdog: use lockup_detector_retry_init() to init sdei watchdog
by Yang Yingliang 05 Aug '25

05 Aug '25

hulk inclusion category: other bugzilla: https://gitee.com/openeuler/kernel/issues/I8LQCC CVE: NA ------------------------------------------------- sdei watchdog needs to be initialized after sdei_init, so commit 1509d06c9c41 ("init: only move down lockup_detector_init() when sdei_watchdog is enabled") move down the lockup_detector_init(). Now Commit 930d8f8dbab9 ("watchdog/perf: adapt the watchdog_perf interface for async model") provide an API lockup_detector_retry_init() for anyone who needs to delayed init lockup detector, so use this API to delay init sdei watchdog. Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- arch/arm64/kernel/watchdog_sdei.c | 10 ++++++++++ drivers/perf/arm_pmuv3.c | 2 +- init/main.c | 7 +------ kernel/watchdog.c | 10 +++++++--- 4 files changed, 19 insertions(+), 10 deletions(-) diff --git a/arch/arm64/kernel/watchdog_sdei.c b/arch/arm64/kernel/watchdog_sdei.c index d1ad8c184296..19f47e24fa59 100644 --- a/arch/arm64/kernel/watchdog_sdei.c +++ b/arch/arm64/kernel/watchdog_sdei.c @@ -183,3 +183,13 @@ int __init sdei_watchdog_hardlockup_probe(void) return 0; } + +static int __init sdei_watchdog_hardlockup_init(void) +{ + /* sdei_watchdog needs to be initialized after sdei_init */ + if (!disable_sdei_nmi_watchdog) + lockup_detector_retry_init(); + + return 0; +} +device_initcall(sdei_watchdog_hardlockup_init) diff --git a/drivers/perf/arm_pmuv3.c b/drivers/perf/arm_pmuv3.c index baa700ab5e03..c51206684863 100644 --- a/drivers/perf/arm_pmuv3.c +++ b/drivers/perf/arm_pmuv3.c @@ -1582,7 +1582,7 @@ static int __init armv8_pmu_driver_init(void) else ret = arm_pmu_acpi_probe(armv8_pmuv3_pmu_init); - if (!ret) + if (!ret && disable_sdei_nmi_watchdog) lockup_detector_retry_init(); return ret; diff --git a/init/main.c b/init/main.c index afead48c58e4..f97f06547078 100644 --- a/init/main.c +++ b/init/main.c @@ -1546,8 +1546,7 @@ static noinline void __init kernel_init_freeable(void) rcu_init_tasks_generic(); do_pre_smp_initcalls(); - if (disable_sdei_nmi_watchdog) - lockup_detector_init(); + lockup_detector_init(); smp_init(); sched_init_smp(); @@ -1558,10 +1557,6 @@ static noinline void __init kernel_init_freeable(void) do_basic_setup(); - /* sdei_watchdog needs to be initialized after sdei_init */ - if (!disable_sdei_nmi_watchdog) - lockup_detector_init(); - kunit_run_all_tests(); wait_for_initramfs(); diff --git a/kernel/watchdog.c b/kernel/watchdog.c index ea5c5f9371b1..6313fe17bca7 100644 --- a/kernel/watchdog.c +++ b/kernel/watchdog.c @@ -986,7 +986,12 @@ static void __init lockup_detector_delay_init(struct work_struct *work) { int ret; - ret = watchdog_hardlockup_probe(); + if (disable_sdei_nmi_watchdog) { + ret = watchdog_hardlockup_probe(); + } else { + ret = sdei_watchdog_hardlockup_probe(); + } + if (ret) { pr_info("Delayed init of the lockup detector failed: %d\n", ret); pr_info("Hard watchdog permanently disabled\n"); @@ -1042,8 +1047,7 @@ void __init lockup_detector_init(void) cpumask_copy(&watchdog_cpumask, housekeeping_cpumask(HK_TYPE_TIMER)); - if ((!disable_sdei_nmi_watchdog && !sdei_watchdog_hardlockup_probe()) || - (disable_sdei_nmi_watchdog && !watchdog_hardlockup_probe())) + if (disable_sdei_nmi_watchdog && !watchdog_hardlockup_probe()) watchdog_hardlockup_available = true; else allow_lockup_detector_init_retry = true; -- 2.25.1

2 1

[PATCH OLK-6.6 v6 00/39] High Performance Container Resource View Isolation -- Stage 2
by GONG Ruiqi 05 Aug '25

05 Aug '25

v6: - Remove bpf_mem_direct_map(). Export direct_pages_count[] and get it via bpf_x86_direct_pages(). v5: - Gather bpf_arm64_cpu_have_feature() into arch/arm64/kernel/bpf-rvi.c v4: - Fix compile failure of bpf_mem_failure() when CONFIG_MEMORY_FAILURE=n - Move iterator target for diskstats & partitions into block/bpf-rvi.c, to avoid unexpected "kABI changes" (actually no) v3: - Optimize swaptotal's estimation and make it a stand-alone function v2: - Remove pidns's refcount from the loadavg global list. - Optimize calculation of swap{total,usage,free} for swap and meminfo - Fix a put_task_struct() missing for bpf_disk_seqf_start() - Remove ineffective build control in samples/bpf/Makefile - Clean up some commented code --- Common supports: bpf-rvi: cpuset: Fix missing of return for !tsk in task_effective_cpumask() bpf-rvi: Add bpf_mem_cgroup_from_task() kfunc bpf-rvi: cgroup: Add cgroup_rstat_flush_atomic() kfunc bpf-rvi: proc: add bpf_get_{idle,iowait}_time kfunc bpf-rvi: cpuacct: Add bpf_cpuacct_kcpustat_cpu_fetch kfunc bpf-rvi: cpuacct: Add task_cpuacct() Cpuinfo_arm64: bpf-rvi: arm64: Add bpf_arm64_cpu_have_feature() kfunc bpf-rvi: arm64: Add cpuinfo_arm64 iterator target bpf-rvi: Add bpf_arch_flags kunc for arm64 samples/bpf: Add iterator program for cpuinfo_arm64 Diskstats: bpf-rvi: block: Add diskstats iterator target bpf-rvi: blk-cgroup: Add bpf_blkcg_get_dev_iostat() kfunc samples/bpf: Add iterator program for diskstats Partitions: bpf-rvi: block: Add partitions iterator target bpf-rvi: block: Look up /dev in reaper's fs->root and filter partitions samples/bpf: Add iterator program for partitions Loadavg: bpf-rvi: pidns: Calculate loadavg for each pid namespace bpf-rvi: pidns: Add for_each_task_in_pidns and loadavg-related kfuncs samples/bpf: Add iterator program for loadavg Uptime: bpf-rvi: cpuacct: Add bpf_task_ca_cpuusage() kfunc samples/bpf: Add iterator program for uptime Swaps: bpf-rvi: Add bpf_si_memswinfo() kfunc bpf-rvi: Add bpf_page_counter_read() kfunc samples/bpf: Add iterator program for swaps Stat: bpf-rvi: Add bpf_seq_file_append() kfunc bpf-rvi: Add stat-related misc kfuncs bpf-rvi: Add cpu runqueue related kfuncs bpf-rvi: Add kstat_ & kcpustat_ kfuncs bpf-rvi: stat: Add stat iterator target samples/bpf: Add iterator program for stat Meminfo: bpf-rvi: Add bpf_mem_{file_{hugepage,pmdmapped},kreclaimable} kfunc bpf-rvi: Add bpf_mem_{total,free}cma kfunc bpf-rvi: Add bpf_hugetlb_report_meminfo kfunc bpf-rvi: Add bpf_mem_failure kfunc bpf-rvi: Add bpf_mem_percpu kfunc bpf-rvi: Add bpf_mem_commit_limit & bpf_mem_committed kfunc bpf-rvi: Add bpf_mem_vmalloc_{used,total} kfunc bpf-rvi: Add bpf_x86_direct_pages kfunc samples/bpf: Add iterator program for meminfo --- GONG Ruiqi (32): bpf-rvi: cpuset: Fix missing of return for !tsk in task_effective_cpumask() bpf-rvi: Add bpf_mem_cgroup_from_task() kfunc bpf-rvi: cgroup: Add cgroup_rstat_flush_atomic() kfunc bpf-rvi: proc: add bpf_get_{idle,iowait}_time kfunc bpf-rvi: cpuacct: Add bpf_cpuacct_kcpustat_cpu_fetch kfunc bpf-rvi: cpuacct: Add task_cpuacct() bpf-rvi: arm64: Add bpf_arm64_cpu_have_feature() kfunc bpf-rvi: arm64: Add cpuinfo_arm64 iterator target bpf-rvi: arm64: Add bpf_arch_flags kunc for arm64 samples/bpf: Add iterator program for cpuinfo_arm64 bpf-rvi: block: Add diskstats iterator target bpf-rvi: blk-cgroup: Add bpf_blkcg_get_dev_iostat() kfunc samples/bpf: Add iterator program for diskstats bpf-rvi: block: Add partitions iterator target bpf-rvi: block: Look up /dev in reaper's fs->root and filter partitions samples/bpf: Add iterator program for partitions bpf-rvi: pidns: Calculate loadavg for each pid namespace bpf-rvi: pidns: Add for_each_task_in_pidns and loadavg-related kfuncs samples/bpf: Add iterator program for loadavg bpf-rvi: cpuacct: Add bpf_task_ca_cpuusage() kfunc samples/bpf: Add iterator program for uptime bpf-rvi: Add bpf_si_memswinfo() kfunc bpf-rvi: Add bpf_page_counter_read() kfunc samples/bpf: Add iterator program for swaps bpf-rvi: Add bpf_seq_file_append() kfunc bpf-rvi: Add stat-related misc kfuncs bpf-rvi: Add cpu runqueue related kfuncs bpf-rvi: Add kstat_ & kcpustat_ kfuncs bpf-rvi: stat: Add stat iterator target samples/bpf: Add iterator program for stat bpf-rvi: Add bpf_x86_direct_pages kfunc samples/bpf: Add iterator program for meminfo Gu Bowen (7): bpf-rvi: Add bpf_mem_{file_{hugepage,pmdmapped},kreclaimable} kfunc bpf-rvi: Add bpf_mem_{total,free}cma kfunc bpf-rvi: Add bpf_hugetlb_report_meminfo kfunc bpf-rvi: Add bpf_mem_failure kfunc bpf-rvi: Add bpf_mem_percpu kfunc bpf-rvi: Add bpf_mem_commit_limit & bpf_mem_committed kfunc bpf-rvi: Add bpf_mem_vmalloc_{used,total} kfunc arch/arm64/kernel/Makefile | 1 + arch/arm64/kernel/bpf-rvi.c | 223 ++++++++++++ arch/arm64/kernel/cpuinfo.c | 128 +------ arch/arm64/kernel/hwcap_str.h | 131 +++++++ arch/x86/mm/pat/set_memory.c | 7 + block/Kconfig.iosched | 3 + block/Makefile | 1 + block/blk-cgroup.c | 158 +++++++++ block/bpf-rvi.c | 442 ++++++++++++++++++++++++ block/genhd.c | 3 +- fs/proc/stat.c | 204 +++++++++++ include/linux/cgroup.h | 12 + include/linux/pid.h | 5 + include/linux/pid_namespace.h | 28 ++ kernel/bpf-rvi/Kconfig | 2 + kernel/bpf-rvi/Makefile | 2 +- kernel/bpf-rvi/common_kfuncs.c | 324 +++++++++++++++++ kernel/bpf-rvi/generic_single_iter.c | 3 + kernel/cgroup/cpuset.c | 4 +- kernel/cgroup/rstat.c | 18 + kernel/pid.c | 9 + kernel/pid_namespace.c | 130 +++++++ kernel/sched/cpuacct.c | 43 +++ samples/bpf/bpf_rvi_cpuinfo_arm64.bpf.c | 112 ++++++ samples/bpf/bpf_rvi_diskstats.bpf.c | 299 ++++++++++++++++ samples/bpf/bpf_rvi_loadavg.bpf.c | 60 ++++ samples/bpf/bpf_rvi_meminfo.bpf.c | 286 +++++++++++++++ samples/bpf/bpf_rvi_partitions.bpf.c | 42 +++ samples/bpf/bpf_rvi_stat.bpf.c | 220 ++++++++++++ samples/bpf/bpf_rvi_swaps.bpf.c | 138 ++++++++ samples/bpf/bpf_rvi_uptime.bpf.c | 122 +++++++ 31 files changed, 3029 insertions(+), 131 deletions(-) create mode 100644 arch/arm64/kernel/bpf-rvi.c create mode 100644 arch/arm64/kernel/hwcap_str.h create mode 100644 block/bpf-rvi.c create mode 100644 kernel/bpf-rvi/common_kfuncs.c create mode 100644 samples/bpf/bpf_rvi_cpuinfo_arm64.bpf.c create mode 100644 samples/bpf/bpf_rvi_diskstats.bpf.c create mode 100644 samples/bpf/bpf_rvi_loadavg.bpf.c create mode 100644 samples/bpf/bpf_rvi_meminfo.bpf.c create mode 100644 samples/bpf/bpf_rvi_partitions.bpf.c create mode 100644 samples/bpf/bpf_rvi_stat.bpf.c create mode 100644 samples/bpf/bpf_rvi_swaps.bpf.c create mode 100644 samples/bpf/bpf_rvi_uptime.bpf.c -- 2.25.1

2 40

[openeuler:openEuler-1.0-LTS 1743/1743] drivers/md/bcache/acache.c:65:5: warning: no previous prototype for 'acache_open'
by kernel test robot 05 Aug '25

05 Aug '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: cea2d27f02854c9aba193ad093f873bbda55f449 commit: 1c09f1b02db96b8277226cbe64fe5bbd185a7149 [1743/1743] bcache: add a framework to perform prefetch config: x86_64-buildonly-randconfig-2004-20250802 (https://download.01.org/0day-ci/archive/20250805/202508050735.PtzXJY7a-lkp@…) compiler: gcc-11 (Debian 11.3.0-12) 11.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250805/202508050735.PtzXJY7a-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202508050735.PtzXJY7a-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/md/bcache/acache.c:65:5: warning: no previous prototype for 'acache_open' [-Wmissing-prototypes] 65 | int acache_open(struct inode *inode, struct file *filp) | ^~~~~~~~~~~ >> drivers/md/bcache/acache.c:83:5: warning: no previous prototype for 'acache_release' [-Wmissing-prototypes] 83 | int acache_release(struct inode *inode, struct file *filp) | ^~~~~~~~~~~~~~ >> drivers/md/bcache/acache.c:89:9: warning: no previous prototype for 'read_circ_slice' [-Wmissing-prototypes] 89 | ssize_t read_circ_slice(struct acache_circ *circ, struct acache_info *buf, | ^~~~~~~~~~~~~~~ >> drivers/md/bcache/acache.c:224:6: warning: no previous prototype for 'init_acache_circ' [-Wmissing-prototypes] 224 | void init_acache_circ(struct acache_circ **circ, void *startaddr) | ^~~~~~~~~~~~~~~~ >> drivers/md/bcache/acache.c:253:5: warning: no previous prototype for 'acache_prefetch_init' [-Wmissing-prototypes] 253 | int acache_prefetch_init(struct acache_device *adev) | ^~~~~~~~~~~~~~~~~~~~ >> drivers/md/bcache/acache.c:401:20: warning: no previous prototype for 'get_cached_device_by_dev' [-Wmissing-prototypes] 401 | struct cached_dev *get_cached_device_by_dev(dev_t dev) | ^~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/md/bcache/acache.c:414:13: warning: no previous prototype for 'get_bio_by_item' [-Wmissing-prototypes] 414 | struct bio *get_bio_by_item(struct cached_dev *dc, struct acache_info *item) | ^~~~~~~~~~~~~~~ vim +/acache_open +65 drivers/md/bcache/acache.c 63 64 > 65 int acache_open(struct inode *inode, struct file *filp) 66 { 67 struct mem_reg *dev; 68 69 int minor = MINOR(inode->i_rdev); 70 71 if (minor >= ACACHE_NR_DEVS) 72 return -ENODEV; 73 if (atomic_xchg(&acache_opened_dev, 1)) 74 return -EPERM; 75 76 dev = &adev.mem_regionp[minor]; 77 78 filp->private_data = dev; 79 80 return 0; 81 } 82 > 83 int acache_release(struct inode *inode, struct file *filp) 84 { 85 atomic_dec(&acache_opened_dev); 86 return 0; 87 } 88 > 89 ssize_t read_circ_slice(struct acache_circ *circ, struct acache_info *buf, 90 size_t size) 91 { 92 unsigned long first, todo, flags; 93 94 spin_lock_irqsave(&circ->lock, flags); 95 96 todo = CIRC_CNT(circ->head, circ->tail, circ->size); 97 if (todo == 0) { 98 spin_unlock_irqrestore(&circ->lock, flags); 99 return 0; 100 } 101 if (todo > size / sizeof(struct acache_info)) 102 todo = size / sizeof(struct acache_info); 103 104 first = CIRC_CNT_TO_END(circ->head, circ->tail, circ->size); 105 if (first > todo) 106 first = todo; 107 108 memcpy(buf, circ->data + circ->tail, first * sizeof(struct acache_info)); 109 if (first < todo) 110 memcpy(buf + first, circ->data, 111 (todo - first) * sizeof(struct acache_info)); 112 circ->tail = (circ->tail + todo) & (circ->size - 1); 113 114 spin_unlock_irqrestore(&circ->lock, flags); 115 return todo * sizeof(struct acache_info); 116 } 117 118 static ssize_t acache_read(struct file *filp, char __user *buf, 119 size_t size, loff_t *ppos) 120 { 121 long ret, cut; 122 123 if (metadata.conntype != ACACHE_READWRITE_CONN) 124 return -EINVAL; 125 126 if (size > MAX_TRANSFER_SIZE) 127 size = MAX_TRANSFER_SIZE; 128 129 ret = read_circ_slice(adev.acache_info_circ, adev.readbuf, size); 130 if (ret <= 0) 131 return ret; 132 133 cut = copy_to_user(buf, adev.readbuf, size); 134 return ret - cut; 135 } 136 137 int process_one_request(struct acache_info *item); 138 static void prefetch_worker_func(struct work_struct *work) 139 { 140 struct prefetch_worker *sw = 141 container_of(work, struct prefetch_worker, work); 142 143 process_one_request(&sw->s); 144 spin_lock(&adev.prefetch_workers_free_list_lock); 145 list_add_tail(&sw->list, &adev.prefetch_workers_free); 146 spin_unlock(&adev.prefetch_workers_free_list_lock); 147 } 148 149 static int queue_prefetch_item(struct acache_info *s) 150 { 151 struct prefetch_worker *sw; 152 153 spin_lock(&adev.prefetch_workers_free_list_lock); 154 sw = list_first_entry_or_null(&adev.prefetch_workers_free, 155 struct prefetch_worker, list); 156 if (!sw) { 157 spin_unlock(&adev.prefetch_workers_free_list_lock); 158 return -1; 159 } 160 list_del_init(&sw->list); 161 spin_unlock(&adev.prefetch_workers_free_list_lock); 162 163 memcpy(&sw->s, s, sizeof(struct acache_info)); 164 INIT_WORK(&sw->work, prefetch_worker_func); 165 queue_work(adev.wq, &sw->work); 166 return 0; 167 } 168 169 static ssize_t acache_write(struct file *filp, const char __user *buf, 170 size_t size, loff_t *ppos) 171 { 172 long cut; 173 int i; 174 175 if (metadata.conntype != ACACHE_READWRITE_CONN) 176 return -EINVAL; 177 178 if (size > MAX_TRANSFER_SIZE) 179 size = MAX_TRANSFER_SIZE; 180 181 cut = copy_from_user(adev.writebuf, buf, size); 182 for (i = 0; i < (size - cut) / sizeof(struct acache_info); i++) { 183 if (queue_prefetch_item(adev.writebuf + i)) 184 break; 185 } 186 return i * sizeof(struct acache_info); 187 } 188 189 static long acache_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) 190 { 191 switch (cmd) { 192 case ACACHE_GET_METADATA: 193 return copy_to_user((struct acache_metadata __user *)arg, 194 &metadata, sizeof(struct acache_metadata)); 195 default: 196 return -EINVAL; 197 } 198 } 199 200 static const struct file_operations acache_fops = { 201 .owner = THIS_MODULE, 202 .read = acache_read, 203 .write = acache_write, 204 .open = acache_open, 205 .release = acache_release, 206 .unlocked_ioctl = acache_ioctl, 207 }; 208 209 void save_circ_item(struct acache_info *data) 210 { 211 unsigned long flags; 212 struct acache_circ *circ = adev.acache_info_circ; 213 214 spin_lock_irqsave(&circ->lock, flags); 215 if (CIRC_SPACE(circ->head, circ->tail, circ->size) >= 1) { 216 memcpy(&circ->data[circ->head], data, sizeof(struct acache_info)); 217 circ->head = (circ->head + 1) & (circ->size - 1); 218 } else { 219 pr_debug("ringbuffer is full; discard new request."); 220 } 221 spin_unlock_irqrestore(&circ->lock, flags); 222 } 223 > 224 void init_acache_circ(struct acache_circ **circ, void *startaddr) 225 { 226 *circ = (struct acache_circ *)startaddr; 227 (*circ)->head = 0; 228 (*circ)->tail = 0; 229 (*circ)->size = ACACHE_CIRC_SIZE; 230 spin_lock_init(&(*circ)->lock); 231 } 232 233 static void acache_free_mem(void) 234 { 235 int i; 236 237 for (i = 0; i < ACACHE_NR_DEVS; i++) 238 vfree(adev.mem_regionp[i].data); 239 240 if (adev.readbuf) { 241 vfree(adev.readbuf); 242 adev.readbuf = NULL; 243 } 244 if (adev.writebuf) { 245 vfree(adev.writebuf); 246 adev.writebuf = NULL; 247 } 248 249 kfree(adev.prefetch_workers); 250 adev.prefetch_workers = NULL; 251 } 252 > 253 int acache_prefetch_init(struct acache_device *adev) 254 { 255 int i; 256 257 if (acache_prefetch_workers <= 0) { 258 pr_err("acache_dev_size should not be less than zero"); 259 return -1; 260 } 261 adev->prefetch_workers = kmalloc_array(acache_prefetch_workers, 262 sizeof(struct prefetch_worker), 263 GFP_KERNEL); 264 if (!adev->prefetch_workers) 265 goto fail_prefetch_workers_alloc; 266 267 INIT_LIST_HEAD(&adev->prefetch_workers_free); 268 spin_lock_init(&adev->prefetch_workers_free_list_lock); 269 for (i = 0; i < acache_prefetch_workers; i++) { 270 spin_lock(&adev->prefetch_workers_free_list_lock); 271 list_add_tail(&adev->prefetch_workers[i].list, 272 &adev->prefetch_workers_free); 273 spin_unlock(&adev->prefetch_workers_free_list_lock); 274 } 275 276 adev->wq = alloc_workqueue("acache_prefetch", WQ_MEM_RECLAIM, 0); 277 if (!adev->wq) 278 goto fail_workqueue_alloc; 279 280 return 0; 281 282 fail_workqueue_alloc: 283 kfree(adev->prefetch_workers); 284 adev->prefetch_workers = NULL; 285 fail_prefetch_workers_alloc: 286 if (adev->wq) 287 destroy_workqueue(adev->wq); 288 return -1; 289 } 290 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1743/1743] arch/x86/kernel/cpu/cacheinfo.c:685:6: warning: no previous prototype for 'cacheinfo_hygon_init_llc_id'
by kernel test robot 05 Aug '25

05 Aug '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 5c1061eccd6b1d6c12741278240a2b93ff91a0a8 commit: 1a0525a3d6d3c9c8effb3ae49581ef8ef99d8b26 [1743/1743] x86/cpu: Get cache info and setup cache cpumap for Hygon Dhyana config: x86_64-buildonly-randconfig-2004-20250802 (https://download.01.org/0day-ci/archive/20250805/202508050522.5Dp2I0DP-lkp@…) compiler: gcc-11 (Debian 11.3.0-12) 11.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250805/202508050522.5Dp2I0DP-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202508050522.5Dp2I0DP-lkp@intel.com/ All warnings (new ones prefixed by >>): arch/x86/kernel/cpu/cacheinfo.c:647:6: warning: no previous prototype for 'cacheinfo_amd_init_llc_id' [-Wmissing-prototypes] 647 | void cacheinfo_amd_init_llc_id(struct cpuinfo_x86 *c, int cpu, u8 node_id) | ^~~~~~~~~~~~~~~~~~~~~~~~~ >> arch/x86/kernel/cpu/cacheinfo.c:685:6: warning: no previous prototype for 'cacheinfo_hygon_init_llc_id' [-Wmissing-prototypes] 685 | void cacheinfo_hygon_init_llc_id(struct cpuinfo_x86 *c, int cpu, u8 node_id) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ arch/x86/kernel/cpu/cacheinfo.c: In function 'amd_cpuid4': arch/x86/kernel/cpu/cacheinfo.c:249:20: warning: this statement may fall through [-Wimplicit-fallthrough=] 249 | l1 = &l1i; | ~~~^~~~~~ arch/x86/kernel/cpu/cacheinfo.c:250:9: note: here 250 | case 0: | ^~~~ vim +/cacheinfo_hygon_init_llc_id +685 arch/x86/kernel/cpu/cacheinfo.c 684 > 685 void cacheinfo_hygon_init_llc_id(struct cpuinfo_x86 *c, int cpu, u8 node_id) 686 { 687 /* 688 * We may have multiple LLCs if L3 caches exist, so check if we 689 * have an L3 cache by looking at the L3 cache CPUID leaf. 690 */ 691 if (!cpuid_edx(0x80000006)) 692 return; 693 694 /* 695 * LLC is at the core complex level. 696 * Core complex ID is ApicId[3] for these processors. 697 */ 698 per_cpu(cpu_llc_id, cpu) = c->apicid >> 3; 699 } 700 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 V1] i2c/designware: Fix an initialization issue
by Wang Tao 05 Aug '25

05 Aug '25

From: "Michael J. Ruhl" <michael.j.ruhl(a)intel.com> stable inclusion from stable-v6.6.97 commit 6358cb9c2a31e23b6b51bfcd7fe2b7becaf6b149 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICOXE9 CVE: CVE-2025-38380 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 3d30048958e0d43425f6d4e76565e6249fa71050 upstream. The i2c_dw_xfer_init() function requires msgs and msg_write_idx from the dev context to be initialized. amd_i2c_dw_xfer_quirk() inits msgs and msgs_num, but not msg_write_idx. This could allow an out of bounds access (of msgs). Initialize msg_write_idx before calling i2c_dw_xfer_init(). Reviewed-by: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> Fixes: 17631e8ca2d3 ("i2c: designware: Add driver support for AMD NAVI GPU") Cc: <stable(a)vger.kernel.org> # v5.13+ Signed-off-by: Michael J. Ruhl <michael.j.ruhl(a)intel.com> Signed-off-by: Andi Shyti <andi.shyti(a)kernel.org> Link: https://lore.kernel.org/r/20250627143511.489570-1-michael.j.ruhl@intel.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Tao <wangtao554(a)huawei.com> --- drivers/i2c/busses/i2c-designware-master.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/i2c/busses/i2c-designware-master.c b/drivers/i2c/busses/i2c-designware-master.c index 579c668cb78a..042642a93cf2 100644 --- a/drivers/i2c/busses/i2c-designware-master.c +++ b/drivers/i2c/busses/i2c-designware-master.c @@ -327,6 +327,7 @@ static int amd_i2c_dw_xfer_quirk(struct i2c_adapter *adap, struct i2c_msg *msgs, dev->msgs = msgs; dev->msgs_num = num_msgs; + dev->msg_write_idx = 0; i2c_dw_xfer_init(dev); regmap_write(dev->map, DW_IC_INTR_MASK, 0); -- 2.34.1

2 1

[PATCH OLK-6.6 1/2] x86/apic: Provide cpu_primary_thread mask
by Qi Xi 05 Aug '25

05 Aug '25

From: Thomas Gleixner <tglx(a)linutronix.de> commit f54d4434c281f38b975d58de47adeca671beff4f upstream. Make the primary thread tracking CPU mask based in preparation for simpler handling of parallel bootup. Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Tested-by: Michael Kelley <mikelley(a)microsoft.com> Tested-by: Oleksandr Natalenko <oleksandr(a)natalenko.name> Tested-by: Helge Deller <deller(a)gmx.de> # parisc Tested-by: Guilherme G. Piccoli <gpiccoli(a)igalia.com> # Steam Deck Link: https://lore.kernel.org/r/20230512205257.186599880@linutronix.de Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- arch/x86/include/asm/apic.h | 2 -- arch/x86/include/asm/topology.h | 18 ++++++++++++++---- arch/x86/kernel/apic/apic.c | 20 +++++++++----------- arch/x86/kernel/smpboot.c | 11 +++-------- 4 files changed, 26 insertions(+), 25 deletions(-) diff --git a/arch/x86/include/asm/apic.h b/arch/x86/include/asm/apic.h index 48067af94678..b54aedbfde7e 100644 --- a/arch/x86/include/asm/apic.h +++ b/arch/x86/include/asm/apic.h @@ -503,10 +503,8 @@ extern int default_check_phys_apicid_present(int phys_apicid); #endif /* CONFIG_X86_LOCAL_APIC */ #ifdef CONFIG_SMP -bool apic_id_is_primary_thread(unsigned int id); void apic_smt_update(void); #else -static inline bool apic_id_is_primary_thread(unsigned int id) { return false; } static inline void apic_smt_update(void) { } #endif diff --git a/arch/x86/include/asm/topology.h b/arch/x86/include/asm/topology.h index 39b3b4a12773..196cfd25d2e4 100644 --- a/arch/x86/include/asm/topology.h +++ b/arch/x86/include/asm/topology.h @@ -31,9 +31,9 @@ * CONFIG_NUMA. */ #include <linux/numa.h> +#include <linux/cpumask.h> #ifdef CONFIG_NUMA -#include <linux/cpumask.h> #include <asm/mpspec.h> #include <asm/percpu.h> @@ -141,8 +141,18 @@ int topology_update_package_map(unsigned int apicid, unsigned int cpu); int topology_update_die_map(unsigned int dieid, unsigned int cpu); int topology_phys_to_logical_pkg(unsigned int pkg); int topology_phys_to_logical_die(unsigned int die, unsigned int cpu); -bool topology_is_primary_thread(unsigned int cpu); -#else +extern struct cpumask __cpu_primary_thread_mask; +#define cpu_primary_thread_mask ((const struct cpumask *)&__cpu_primary_thread_mask) + +/** + * topology_is_primary_thread - Check whether CPU is the primary SMT thread + * @cpu: CPU to check + */ +static inline bool topology_is_primary_thread(unsigned int cpu) +{ + return cpumask_test_cpu(cpu, cpu_primary_thread_mask); +} +#else /* CONFIG_SMP */ #define topology_max_packages() (1) static inline int topology_update_package_map(unsigned int apicid, unsigned int cpu) { return 0; } @@ -153,7 +163,7 @@ static inline int topology_phys_to_logical_die(unsigned int die, unsigned int cpu) { return 0; } static inline int topology_max_die_per_package(void) { return 1; } static inline int topology_max_smt_threads(void) { return 1; } -#endif +#endif /* !CONFIG_SMP */ static inline void arch_fix_phys_package_id(int num, u32 slot) { diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c index 4df7d694369a..b4a476016349 100644 --- a/arch/x86/kernel/apic/apic.c +++ b/arch/x86/kernel/apic/apic.c @@ -2344,20 +2344,16 @@ bool arch_match_cpu_phys_id(int cpu, u64 phys_id) } #ifdef CONFIG_SMP -/** - * apic_id_is_primary_thread - Check whether APIC ID belongs to a primary thread - * @apicid: APIC ID to check - */ -bool apic_id_is_primary_thread(unsigned int apicid) +static void cpu_mark_primary_thread(unsigned int cpu, unsigned int apicid) { - u32 mask; - - if (smp_num_siblings == 1) - return true; /* Isolate the SMT bit(s) in the APICID and check for 0 */ - mask = (1U << (fls(smp_num_siblings) - 1)) - 1; - return !(apicid & mask); + u32 mask = (1U << (fls(smp_num_siblings) - 1)) - 1; + + if (smp_num_siblings == 1 || !(apicid & mask)) + cpumask_set_cpu(cpu, &__cpu_primary_thread_mask); } +#else +static inline void cpu_mark_primary_thread(unsigned int cpu, unsigned int apicid) { } #endif /* @@ -2502,6 +2498,8 @@ int generic_processor_info(int apicid, int version) set_cpu_present(cpu, true); num_processors++; + cpu_mark_primary_thread(cpu, apicid); + return cpu; } diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c index 58f683388fc5..3dde2a6e795b 100644 --- a/arch/x86/kernel/smpboot.c +++ b/arch/x86/kernel/smpboot.c @@ -102,6 +102,9 @@ DEFINE_PER_CPU_READ_MOSTLY(cpumask_var_t, cpu_l2c_shared_map); DEFINE_PER_CPU_READ_MOSTLY(struct cpuinfo_x86, cpu_info); EXPORT_PER_CPU_SYMBOL(cpu_info); +/* CPUs which are the primary SMT threads */ +struct cpumask __cpu_primary_thread_mask __read_mostly; + struct mwait_cpu_dead { unsigned int control; unsigned int status; @@ -276,14 +279,6 @@ static void notrace start_secondary(void *unused) cpu_startup_entry(CPUHP_AP_ONLINE_IDLE); } -/** - * topology_is_primary_thread - Check whether CPU is the primary SMT thread - * @cpu: CPU to check - */ -bool topology_is_primary_thread(unsigned int cpu) -{ - return apic_id_is_primary_thread(per_cpu(x86_cpu_to_apicid, cpu)); -} #define topology_is_primary_thread topology_is_primary_thread /** -- 2.33.0

2 2

[openeuler:openEuler-1.0-LTS 1743/1743] fs/block_dev.c:1096:6: warning: no previous prototype for 'bd_abort_claiming'
by kernel test robot 05 Aug '25

05 Aug '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: ba07135cf74b1424e2f7f0c60e59c5b206ab320c commit: abbf198d064fa41dcc413c392423ad71c2c85c3e [1743/1743] block: Do not discard buffers under a mounted filesystem config: x86_64-buildonly-randconfig-2004-20250802 (https://download.01.org/0day-ci/archive/20250805/202508050226.6CBD8sQZ-lkp@…) compiler: gcc-11 (Debian 11.3.0-12) 11.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250805/202508050226.6CBD8sQZ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202508050226.6CBD8sQZ-lkp@intel.com/ All warnings (new ones prefixed by >>): >> fs/block_dev.c:1096:6: warning: no previous prototype for 'bd_abort_claiming' [-Wmissing-prototypes] 1096 | void bd_abort_claiming(struct block_device *bdev, struct block_device *whole, | ^~~~~~~~~~~~~~~~~ vim +/bd_abort_claiming +1096 fs/block_dev.c 1085 1086 /** 1087 * bd_abort_claiming - abort claiming of a block device 1088 * @bdev: block device of interest 1089 * @whole: whole block device (returned from bd_start_claiming()) 1090 * @holder: holder that has claimed @bdev 1091 * 1092 * Abort claiming of a block device when the exclusive open failed. This can be 1093 * also used when exclusive open is not actually desired and we just needed 1094 * to block other exclusive openers for a while. 1095 */ > 1096 void bd_abort_claiming(struct block_device *bdev, struct block_device *whole, 1097 void *holder) 1098 { 1099 spin_lock(&bdev_lock); 1100 bd_clear_claiming(whole, holder); 1101 spin_unlock(&bdev_lock); 1102 } 1103 EXPORT_SYMBOL(bd_abort_claiming); 1104 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1743/1743] fs/proc/vmcore.c:183:1: warning: no previous prototype for 'copy_oldmem_page_encrypted'
by kernel test robot 05 Aug '25

05 Aug '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: ba07135cf74b1424e2f7f0c60e59c5b206ab320c commit: e4590de4701ee3ee748058abf7b4e9492fa2b4a9 [1743/1743] proc/vmcore: Fix i386 build error of missing copy_oldmem_page_encrypted() config: x86_64-buildonly-randconfig-2004-20250802 (https://download.01.org/0day-ci/archive/20250805/202508050002.tGJgi27V-lkp@…) compiler: gcc-11 (Debian 11.3.0-12) 11.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250805/202508050002.tGJgi27V-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202508050002.tGJgi27V-lkp@intel.com/ All warnings (new ones prefixed by >>): >> fs/proc/vmcore.c:183:1: warning: no previous prototype for 'copy_oldmem_page_encrypted' [-Wmissing-prototypes] 183 | copy_oldmem_page_encrypted(unsigned long pfn, char *buf, size_t csize, | ^~~~~~~~~~~~~~~~~~~~~~~~~~ fs/proc/vmcore.c:441: warning: Function parameter or member 'size' not described in 'vmcore_alloc_buf' fs/proc/vmcore.c:441: warning: Excess function parameter 'sizez' description in 'vmcore_alloc_buf' vim +/copy_oldmem_page_encrypted +183 fs/proc/vmcore.c 178 179 /* 180 * Architectures which support memory encryption override this. 181 */ 182 ssize_t __weak > 183 copy_oldmem_page_encrypted(unsigned long pfn, char *buf, size_t csize, 184 unsigned long offset, int userbuf) 185 { 186 return copy_oldmem_page(pfn, buf, csize, offset, userbuf); 187 } 188 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0