- Kernel - mailweb.openeuler.org

[openeuler:OLK-6.6 3045/3045] drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_dev.c:2963:8: error: unknown type name 'ivoidnt'
by kernel test robot 27 Oct '25

27 Oct '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: efe5cf254a3b58c26841d55757906bd9acf77e30 commit: 468b0cd7b1e1c131b3ee7d2ea8b96521d3faad8b [3045/3045] net:nebula-matrix:Add S1000 SNIC driver support config: x86_64-randconfig-161-20251027 (https://download.01.org/0day-ci/archive/20251027/202510271755.BtJ3vZX2-lkp@…) compiler: gcc-13 (Debian 13.3.0-16) 13.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251027/202510271755.BtJ3vZX2-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202510271755.BtJ3vZX2-lkp@intel.com/ All error/warnings (new ones prefixed by >>): drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_ethtool.c: In function 'nbl_serv_adjust_interrpt_param': drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_ethtool.c:380:33: warning: variable 'net_priv' set but not used [-Wunused-but-set-variable] 380 | struct nbl_netdev_priv *net_priv; | ^~~~~~~~ drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_ethtool.c: In function 'nbl_serv_update_stats': drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_ethtool.c:503:13: warning: variable 'ret' set but not used [-Wunused-but-set-variable] 503 | int ret = 0; | ^~~ drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_ethtool.c: In function 'nbl_set_ksettings': drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_ethtool.c:1108:30: warning: variable 'phy_caps' set but not used [-Wunused-but-set-variable] 1108 | struct nbl_phy_caps *phy_caps; | ^~~~~~~~ drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_ethtool.c: In function 'nbl_set_pause_param': drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_ethtool.c:3129:30: warning: variable 'phy_caps' set but not used [-Wunused-but-set-variable] 3129 | struct nbl_phy_caps *phy_caps; | ^~~~~~~~ drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_ethtool.c: In function 'nbl_stats_fill_strings': >> drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_ethtool.c:218:47: warning: '%s' directive output may be truncated writing up to 1891 bytes into a region of size 32 [-Wformat-truncation=] 218 | snprintf(p, ETH_GSTRING_LEN, "%s", nbl_gstrings_stats[i].stat_string); | ^~ drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_ethtool.c:218:17: note: 'snprintf' output between 1 and 1892 bytes into a destination of size 32 218 | snprintf(p, ETH_GSTRING_LEN, "%s", nbl_gstrings_stats[i].stat_string); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_dev.c: In function 'nbl_dev_prepare_reset_task': drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_dev.c:896:13: warning: variable 'ret' set but not used [-Wunused-but-set-variable] 896 | int ret; | ^~~ drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_dev.c: At top level: >> drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_dev.c:2963:8: error: unknown type name 'ivoidnt' 2963 | static ivoidnt nbl_dev_setup_ktls_ops(struct nbl_dev_mgt *dev_mgt, struct net_device *netdev | ^~~~~~~ >> drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_dev.c:2964:39: error: expected ';', ',' or ')' before 'struct' 2964 | struct nbl_init_param *param) | ^~~~~~ drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_dev.c: In function 'nbl_dev_cfg_netdev': >> drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_dev.c:3316:23: error: implicit declaration of function 'nbl_dev_setup_ktls_ops'; did you mean 'nbl_dev_setup_xfrm_ops'? [-Werror=implicit-function-declaration] 3316 | ret = nbl_dev_setup_ktls_ops(dev_mgt, netdev); | ^~~~~~~~~~~~~~~~~~~~~~ | nbl_dev_setup_xfrm_ops cc1: some warnings being treated as errors vim +/ivoidnt +2963 drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_dev.c 2961 2962 #else > 2963 static ivoidnt nbl_dev_setup_ktls_ops(struct nbl_dev_mgt *dev_mgt, struct net_device *netdev > 2964 struct nbl_init_param *param) 2965 { 2966 } 2967 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3045/3045] drivers/pci/pci.c:177:17: error: expected ')'
by kernel test robot 27 Oct '25

27 Oct '25

Hi Jianmin, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 9094437bec1ace7378abfe84597e722209d03f85 commit: 1f46f3a128f21c190281c72cad99267bcc177e34 [3045/3045] PCI: PM: fix pcie mrrs restoring config: loongarch-allnoconfig (https://download.01.org/0day-ci/archive/20251027/202510271529.3vEp7o79-lkp@…) compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project e1ae12640102fd2b05bc567243580f90acb1135f) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251027/202510271529.3vEp7o79-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202510271529.3vEp7o79-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from drivers/pci/pci.c:11: In file included from include/linux/acpi.h:14: In file included from include/linux/device.h:32: In file included from include/linux/device/driver.h:21: In file included from include/linux/module.h:19: In file included from include/linux/elf.h:6: In file included from arch/loongarch/include/asm/elf.h:13: In file included from arch/loongarch/include/asm/vdso.h:10: In file included from include/linux/mm.h:2181: include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ >> drivers/pci/pci.c:177:17: error: expected ')' 177 | suspend_state_t pm_suspend_target_state; | ^ include/linux/suspend.h:341:34: note: expanded from macro 'pm_suspend_target_state' 341 | #define pm_suspend_target_state (PM_SUSPEND_ON) | ^ include/linux/suspend.h:36:51: note: expanded from macro 'PM_SUSPEND_ON' 36 | #define PM_SUSPEND_ON ((__force suspend_state_t) 0) | ^ drivers/pci/pci.c:177:17: note: to match this '(' include/linux/suspend.h:341:34: note: expanded from macro 'pm_suspend_target_state' 341 | #define pm_suspend_target_state (PM_SUSPEND_ON) | ^ include/linux/suspend.h:36:24: note: expanded from macro 'PM_SUSPEND_ON' 36 | #define PM_SUSPEND_ON ((__force suspend_state_t) 0) | ^ drivers/pci/pci.c:177:17: error: redefinition of 'suspend_state_t' as different kind of symbol 177 | suspend_state_t pm_suspend_target_state; | ^ include/linux/suspend.h:341:34: note: expanded from macro 'pm_suspend_target_state' 341 | #define pm_suspend_target_state (PM_SUSPEND_ON) | ^ include/linux/suspend.h:36:34: note: expanded from macro 'PM_SUSPEND_ON' 36 | #define PM_SUSPEND_ON ((__force suspend_state_t) 0) | ^ include/linux/suspend.h:34:23: note: previous definition is here 34 | typedef int __bitwise suspend_state_t; | ^ 1 warning and 2 errors generated. vim +177 drivers/pci/pci.c 175 176 #ifndef CONFIG_PM_SLEEP > 177 suspend_state_t pm_suspend_target_state; 178 #define pm_suspend_target_state (PM_SUSPEND_ON) 179 #endif 180 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS 0/2] *** SUBJECT HERE ***
by Zhao Yipeng 27 Oct '25

27 Oct '25

*** BLURB HERE *** Alexander Aring (2): fs: dlm: fix invalid derefence of sb_lvbptr fs: dlm: stop unnecessarily filling zero ms_extra bytes fs/dlm/lock.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10] hisi: l0: update device name from hisi_l0 to hisi_soc_cache_mgmt
by Wupeng Ma 27 Oct '25

27 Oct '25

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I9UDJX -------------------------------- Update device name from hisi_l0 to hisi_soc_cache_mgmt to improve compatibility with subsequent versions. Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- drivers/soc/hisilicon/hisi_l0.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/soc/hisilicon/hisi_l0.c b/drivers/soc/hisilicon/hisi_l0.c index 75d63c091a1b..aecd45b47e5e 100644 --- a/drivers/soc/hisilicon/hisi_l0.c +++ b/drivers/soc/hisilicon/hisi_l0.c @@ -183,11 +183,13 @@ static const struct file_operations l0_fops = { static struct miscdevice l0_dev = { .minor = MISC_DYNAMIC_MINOR, - .name = "hisi_l0", + .name = "hisi_soc_cache_mgmt", .fops = &l0_fops, + .mode = 0600, }; module_misc_device(l0_dev); +MODULE_VERSION("1.0"); MODULE_DESCRIPTION("HiSilicon SoC L0 driver"); MODULE_LICENSE("GPL v2"); MODULE_AUTHOR("Ma Wupeng <mawupeng1(a)huawei.com>"); -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] HID: multitouch: Correct devm device reference for hidinput input_dev name
by Lin Ruifeng 27 Oct '25

27 Oct '25

From: Rahul Rameshbabu <sergeantsagara(a)protonmail.com> stable inclusion from stable-v4.19.295 commit 39c70c19456e50dcb3abfe53539220dff0490f1d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID0REB CVE:CVE-2023-53454 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4794394635293a3e74591351fff469cea7ad15a2 ] Reference the HID device rather than the input device for the devm allocation of the input_dev name. Referencing the input_dev would lead to a use-after-free when the input_dev was unregistered and subsequently fires a uevent that depends on the name. At the point of firing the uevent, the name would be freed by devres management. Use devm_kasprintf to simplify the logic for allocating memory and formatting the input_dev name string. Reported-by: Maxime Ripard <mripard(a)kernel.org> Closes: https://lore.kernel.org/linux-input/ZOZIZCND+L0P1wJc@penguin/T/#m443f3dce92… Fixes: c08d46aa805b ("HID: multitouch: devm conversion") Suggested-by: Maxime Ripard <mripard(a)kernel.org> Suggested-by: Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Signed-off-by: Rahul Rameshbabu <sergeantsagara(a)protonmail.com> Reviewed-by: Maxime Ripard <mripard(a)kernel.org> Link: https://lore.kernel.org/r/20230824061308.222021-3-sergeantsagara@protonmail… Signed-off-by: Benjamin Tissoires <bentiss(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/hid/hid-multitouch.c | 13 +++---------- 1 file changed, 3 insertions(+), 10 deletions(-) diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c index dfb2548e0052..0f8cb441190b 100644 --- a/drivers/hid/hid-multitouch.c +++ b/drivers/hid/hid-multitouch.c @@ -1514,7 +1514,6 @@ static void mt_post_parse(struct mt_device *td, struct mt_application *app) static int mt_input_configured(struct hid_device *hdev, struct hid_input *hi) { struct mt_device *td = hid_get_drvdata(hdev); - char *name; const char *suffix = NULL; unsigned int application = 0; struct mt_report_data *rdata; @@ -1580,15 +1579,9 @@ static int mt_input_configured(struct hid_device *hdev, struct hid_input *hi) } } - if (suffix) { - name = devm_kzalloc(&hi->input->dev, - strlen(hdev->name) + strlen(suffix) + 2, - GFP_KERNEL); - if (name) { - sprintf(name, "%s %s", hdev->name, suffix); - hi->input->name = name; - } - } + if (suffix) + hi->input->name = devm_kasprintf(&hdev->dev, GFP_KERNEL, + "%s %s", hdev->name, suffix); return 0; } -- 2.22.0

2 1

[PATCH openEuler-1.0-LTS] media: v4l2-mem2mem: add lock to protect parameter num_rdy
by Yin Tirui 27 Oct '25

27 Oct '25

From: Yunfei Dong <yunfei.dong(a)mediatek.com> stable inclusion from stable-v4.19.293 commit 7fc7f87725805197388ba749a1801df33000fa50 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID0RG4 CVE: CVE-2023-53519 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 56b5c3e67b0f9af3f45cf393be048ee8d8a92694 ] Getting below error when using KCSAN to check the driver. Adding lock to protect parameter num_rdy when getting the value with function: v4l2_m2m_num_src_bufs_ready/v4l2_m2m_num_dst_bufs_ready. kworker/u16:3: [name:report&]BUG: KCSAN: data-race in v4l2_m2m_buf_queue kworker/u16:3: [name:report&] kworker/u16:3: [name:report&]read-write to 0xffffff8105f35b94 of 1 bytes by task 20865 on cpu 7: kworker/u16:3: v4l2_m2m_buf_queue+0xd8/0x10c Signed-off-by: Pina Chen <pina.chen(a)mediatek.com> Signed-off-by: Yunfei Dong <yunfei.dong(a)mediatek.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yin Tirui <yintirui(a)huawei.com> --- include/media/v4l2-mem2mem.h | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/include/media/v4l2-mem2mem.h b/include/media/v4l2-mem2mem.h index d655720e16a1..62c67e9e190c 100644 --- a/include/media/v4l2-mem2mem.h +++ b/include/media/v4l2-mem2mem.h @@ -405,7 +405,14 @@ void v4l2_m2m_buf_queue(struct v4l2_m2m_ctx *m2m_ctx, static inline unsigned int v4l2_m2m_num_src_bufs_ready(struct v4l2_m2m_ctx *m2m_ctx) { - return m2m_ctx->out_q_ctx.num_rdy; + unsigned int num_buf_rdy; + unsigned long flags; + + spin_lock_irqsave(&m2m_ctx->out_q_ctx.rdy_spinlock, flags); + num_buf_rdy = m2m_ctx->out_q_ctx.num_rdy; + spin_unlock_irqrestore(&m2m_ctx->out_q_ctx.rdy_spinlock, flags); + + return num_buf_rdy; } /** @@ -417,7 +424,14 @@ unsigned int v4l2_m2m_num_src_bufs_ready(struct v4l2_m2m_ctx *m2m_ctx) static inline unsigned int v4l2_m2m_num_dst_bufs_ready(struct v4l2_m2m_ctx *m2m_ctx) { - return m2m_ctx->cap_q_ctx.num_rdy; + unsigned int num_buf_rdy; + unsigned long flags; + + spin_lock_irqsave(&m2m_ctx->cap_q_ctx.rdy_spinlock, flags); + num_buf_rdy = m2m_ctx->cap_q_ctx.num_rdy; + spin_unlock_irqrestore(&m2m_ctx->cap_q_ctx.rdy_spinlock, flags); + + return num_buf_rdy; } /** -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] net/tunnel: wait until all sk_user_data reader finish before releasing the sock
by Wang Liang 27 Oct '25

27 Oct '25

From: Hangbin Liu <liuhangbin(a)gmail.com> stable inclusion from stable-v4.19.270 commit be34e79e0ae6adbf6e7e75ddaee9ad84795ab933 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICYQRI CVE: CVE-2022-50405 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3cf7203ca620682165706f70a1b12b5194607dce ] There is a race condition in vxlan that when deleting a vxlan device during receiving packets, there is a possibility that the sock is released after getting vxlan_sock vs from sk_user_data. Then in later vxlan_ecn_decapsulate(), vxlan_get_sk_family() we will got NULL pointer dereference. e.g. #0 [ffffa25ec6978a38] machine_kexec at ffffffff8c669757 #1 [ffffa25ec6978a90] __crash_kexec at ffffffff8c7c0a4d #2 [ffffa25ec6978b58] crash_kexec at ffffffff8c7c1c48 #3 [ffffa25ec6978b60] oops_end at ffffffff8c627f2b #4 [ffffa25ec6978b80] page_fault_oops at ffffffff8c678fcb #5 [ffffa25ec6978bd8] exc_page_fault at ffffffff8d109542 #6 [ffffa25ec6978c00] asm_exc_page_fault at ffffffff8d200b62 [exception RIP: vxlan_ecn_decapsulate+0x3b] RIP: ffffffffc1014e7b RSP: ffffa25ec6978cb0 RFLAGS: 00010246 RAX: 0000000000000008 RBX: ffff8aa000888000 RCX: 0000000000000000 RDX: 000000000000000e RSI: ffff8a9fc7ab803e RDI: ffff8a9fd1168700 RBP: ffff8a9fc7ab803e R8: 0000000000700000 R9: 00000000000010ae R10: ffff8a9fcb748980 R11: 0000000000000000 R12: ffff8a9fd1168700 R13: ffff8aa000888000 R14: 00000000002a0000 R15: 00000000000010ae ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 #7 [ffffa25ec6978ce8] vxlan_rcv at ffffffffc10189cd [vxlan] #8 [ffffa25ec6978d90] udp_queue_rcv_one_skb at ffffffff8cfb6507 #9 [ffffa25ec6978dc0] udp_unicast_rcv_skb at ffffffff8cfb6e45 #10 [ffffa25ec6978dc8] __udp4_lib_rcv at ffffffff8cfb8807 #11 [ffffa25ec6978e20] ip_protocol_deliver_rcu at ffffffff8cf76951 #12 [ffffa25ec6978e48] ip_local_deliver at ffffffff8cf76bde #13 [ffffa25ec6978ea0] __netif_receive_skb_one_core at ffffffff8cecde9b #14 [ffffa25ec6978ec8] process_backlog at ffffffff8cece139 #15 [ffffa25ec6978f00] __napi_poll at ffffffff8ceced1a #16 [ffffa25ec6978f28] net_rx_action at ffffffff8cecf1f3 #17 [ffffa25ec6978fa0] __softirqentry_text_start at ffffffff8d4000ca #18 [ffffa25ec6978ff0] do_softirq at ffffffff8c6fbdc3 Reproducer: https://github.com/Mellanox/ovs-tests/blob/master/test-ovs-vxlan-remove-tun… Fix this by waiting for all sk_user_data reader to finish before releasing the sock. Reported-by: Jianlin Shi <jishi(a)redhat.com> Suggested-by: Jakub Sitnicki <jakub(a)cloudflare.com> Fixes: 6a93cc905274 ("udp-tunnel: Add a few more UDP tunnel APIs") Signed-off-by: Hangbin Liu <liuhangbin(a)gmail.com> Reviewed-by: Jiri Pirko <jiri(a)nvidia.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/ipv4/udp_tunnel.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/ipv4/udp_tunnel.c b/net/ipv4/udp_tunnel.c index 6539ff15e9a3..d03d74388870 100644 --- a/net/ipv4/udp_tunnel.c +++ b/net/ipv4/udp_tunnel.c @@ -186,6 +186,7 @@ EXPORT_SYMBOL_GPL(udp_tunnel_xmit_skb); void udp_tunnel_sock_release(struct socket *sock) { rcu_assign_sk_user_data(sock->sk, NULL); + synchronize_rcu(); kernel_sock_shutdown(sock, SHUT_RDWR); sock_release(sock); } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] sctp: fix a potential overflow in sctp_ifwdtsn_skip
by Wang Liang 27 Oct '25

27 Oct '25

From: Xin Long <lucien.xin(a)gmail.com> stable inclusion from stable-v4.19.281 commit 4fbd094d4131a10d06a45d64158567052a35b3f4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICYQM2 CVE: CVE-2023-53372 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 32832a2caf82663870126c5186cf8f86c8b2a649 ] Currently, when traversing ifwdtsn skips with _sctp_walk_ifwdtsn, it only checks the pos against the end of the chunk. However, the data left for the last pos may be < sizeof(struct sctp_ifwdtsn_skip), and dereference it as struct sctp_ifwdtsn_skip may cause coverflow. This patch fixes it by checking the pos against "the end of the chunk - sizeof(struct sctp_ifwdtsn_skip)" in sctp_ifwdtsn_skip, similar to sctp_fwdtsn_skip. Fixes: 0fc2ea922c8a ("sctp: implement validate_ftsn for sctp_stream_interleave") Signed-off-by: Xin Long <lucien.xin(a)gmail.com> Link: https://lore.kernel.org/r/2a71bffcd80b4f2c61fac6d344bb2f11c8fd74f7.16811558… Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/sctp/stream_interleave.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/sctp/stream_interleave.c b/net/sctp/stream_interleave.c index 0a78cdf86463..3290e6f5b6c6 100644 --- a/net/sctp/stream_interleave.c +++ b/net/sctp/stream_interleave.c @@ -1151,7 +1151,8 @@ static void sctp_generate_iftsn(struct sctp_outq *q, __u32 ctsn) #define _sctp_walk_ifwdtsn(pos, chunk, end) \ for (pos = chunk->subh.ifwdtsn_hdr->skip; \ - (void *)pos < (void *)chunk->subh.ifwdtsn_hdr->skip + (end); pos++) + (void *)pos <= (void *)chunk->subh.ifwdtsn_hdr->skip + (end) - \ + sizeof(struct sctp_ifwdtsn_skip); pos++) #define sctp_walk_ifwdtsn(pos, ch) \ _sctp_walk_ifwdtsn((pos), (ch), ntohs((ch)->chunk_hdr->length) - \ -- 2.34.1

2 1

[PATCH OLK-6.6] regulator: core: fix NULL dereference on unbind due to stale coupling data
by Chen Ridong 27 Oct '25

27 Oct '25

From: Alessandro Carminati <acarmina(a)redhat.com> stable inclusion from stable-v6.6.101 commit 233d3c54c9620e95193923859ea1d0b0f5d748ca category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICUCAO CVE: CVE-2025-38668 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ca46946a482238b0cdea459fb82fc837fb36260e ] Failing to reset coupling_desc.n_coupled after freeing coupled_rdevs can lead to NULL pointer dereference when regulators are accessed post-unbind. This can happen during runtime PM or other regulator operations that rely on coupling metadata. For example, on ridesx4, unbinding the 'reg-dummy' platform device triggers a panic in regulator_lock_recursive() due to stale coupling state. Ensure n_coupled is set to 0 to prevent access to invalid pointers. Signed-off-by: Alessandro Carminati <acarmina(a)redhat.com> Link: https://patch.msgid.link/20250626083809.314842-1-acarmina@redhat.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Chen Ridong <chenridong(a)huawei.com> --- drivers/regulator/core.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c index d2e21dc61dd7d..1d49612eeb7e5 100644 --- a/drivers/regulator/core.c +++ b/drivers/regulator/core.c @@ -5422,6 +5422,7 @@ static void regulator_remove_coupling(struct regulator_dev *rdev) ERR_PTR(err)); } + rdev->coupling_desc.n_coupled = 0; kfree(rdev->coupling_desc.coupled_rdevs); rdev->coupling_desc.coupled_rdevs = NULL; } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] sctp: check send stream number after wait_for_sndbuf
by Wang Liang 27 Oct '25

27 Oct '25

From: Xin Long <lucien.xin(a)gmail.com> stable inclusion from stable-v4.19.281 commit 9346a1a21142357972a6f466ba6275ddc54b04ac category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICYA9X CVE: CVE-2023-53296 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2584024b23552c00d95b50255e47bd18d306d31a ] This patch fixes a corner case where the asoc out stream count may change after wait_for_sndbuf. When the main thread in the client starts a connection, if its out stream count is set to N while the in stream count in the server is set to N - 2, another thread in the client keeps sending the msgs with stream number N - 1, and waits for sndbuf before processing INIT_ACK. However, after processing INIT_ACK, the out stream count in the client is shrunk to N - 2, the same to the in stream count in the server. The crash occurs when the thread waiting for sndbuf is awake and sends the msg in a non-existing stream(N - 1), the call trace is as below: KASAN: null-ptr-deref in range [0x0000000000000038-0x000000000000003f] Call Trace: <TASK> sctp_cmd_send_msg net/sctp/sm_sideeffect.c:1114 [inline] sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1777 [inline] sctp_side_effects net/sctp/sm_sideeffect.c:1199 [inline] sctp_do_sm+0x197d/0x5310 net/sctp/sm_sideeffect.c:1170 sctp_primitive_SEND+0x9f/0xc0 net/sctp/primitive.c:163 sctp_sendmsg_to_asoc+0x10eb/0x1a30 net/sctp/socket.c:1868 sctp_sendmsg+0x8d4/0x1d90 net/sctp/socket.c:2026 inet_sendmsg+0x9d/0xe0 net/ipv4/af_inet.c:825 sock_sendmsg_nosec net/socket.c:722 [inline] sock_sendmsg+0xde/0x190 net/socket.c:745 The fix is to add an unlikely check for the send stream number after the thread wakes up from the wait_for_sndbuf. Fixes: 5bbbbe32a431 ("sctp: introduce stream scheduler foundations") Reported-by: syzbot+47c24ca20a2fa01f082e(a)syzkaller.appspotmail.com Signed-off-by: Xin Long <lucien.xin(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/sctp/socket.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/sctp/socket.c b/net/sctp/socket.c index 2a11b464182e..e6ac0bc410a7 100644 --- a/net/sctp/socket.c +++ b/net/sctp/socket.c @@ -1955,6 +1955,10 @@ static int sctp_sendmsg_to_asoc(struct sctp_association *asoc, err = sctp_wait_for_sndbuf(asoc, &timeo, msg_len); if (err) goto err; + if (unlikely(sinfo->sinfo_stream >= asoc->stream.outcnt)) { + err = -EINVAL; + goto err; + } } if (sctp_state(asoc, CLOSED)) { -- 2.34.1

2 1