- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] nfs: handle failure of nfs_get_lock_context in unlock path
by Li Lingfeng 03 Jul '25

03 Jul '25

mainline inclusion from mainline-v6.15-rc7 commit c457dc1ec770a22636b473ce5d35614adfe97636 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICGAL9 CVE: CVE-2025-38023 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- When memory is insufficient, the allocation of nfs_lock_context in nfs_get_lock_context() fails and returns -ENOMEM. If we mistakenly treat an nfs4_unlockdata structure (whose l_ctx member has been set to -ENOMEM) as valid and proceed to execute rpc_run_task(), this will trigger a NULL pointer dereference in nfs4_locku_prepare. For example: BUG: kernel NULL pointer dereference, address: 000000000000000c PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP PTI CPU: 15 UID: 0 PID: 12 Comm: kworker/u64:0 Not tainted 6.15.0-rc2-dirty #60 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-2.fc40 Workqueue: rpciod rpc_async_schedule RIP: 0010:nfs4_locku_prepare+0x35/0xc2 Code: 89 f2 48 89 fd 48 c7 c7 68 69 ef b5 53 48 8b 8e 90 00 00 00 48 89 f3 RSP: 0018:ffffbbafc006bdb8 EFLAGS: 00010246 RAX: 000000000000004b RBX: ffff9b964fc1fa00 RCX: 0000000000000000 RDX: 0000000000000000 RSI: fffffffffffffff4 RDI: ffff9ba53fddbf40 RBP: ffff9ba539934000 R08: 0000000000000000 R09: ffffbbafc006bc38 R10: ffffffffb6b689c8 R11: 0000000000000003 R12: ffff9ba539934030 R13: 0000000000000001 R14: 0000000004248060 R15: ffffffffb56d1c30 FS: 0000000000000000(0000) GS:ffff9ba5881f0000(0000) knlGS:00000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000000000c CR3: 000000093f244000 CR4: 00000000000006f0 Call Trace: <TASK> __rpc_execute+0xbc/0x480 rpc_async_schedule+0x2f/0x40 process_one_work+0x232/0x5d0 worker_thread+0x1da/0x3d0 ? __pfx_worker_thread+0x10/0x10 kthread+0x10d/0x240 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x34/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Modules linked in: CR2: 000000000000000c ---[ end trace 0000000000000000 ]--- Free the allocated nfs4_unlockdata when nfs_get_lock_context() fails and return NULL to terminate subsequent rpc_run_task, preventing NULL pointer dereference. Fixes: f30cb757f680 ("NFS: Always wait for I/O completion before unlock") Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Link: https://lore.kernel.org/r/20250417072508.3850532-1-lilingfeng3@huawei.com Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Conflicts: fs/nfs/nfs4proc.c [Commit 32c6e7eee399 ("NFSv4: Handle NFS4ERR_OLD_STATEID in LOCKU") added a local variable state; commit 7b587e1a5a6c ("NFS: use locks_copy_lock() to copy locks.") initialized lock with locks_init_lock and locks_copy_lock instead of memcpy.] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfs/nfs4proc.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c index 282e5559b176..6d47a1922a1b 100644 --- a/fs/nfs/nfs4proc.c +++ b/fs/nfs/nfs4proc.c @@ -6415,10 +6415,18 @@ static struct nfs4_unlockdata *nfs4_alloc_unlockdata(struct file_lock *fl, { struct nfs4_unlockdata *p; struct inode *inode = lsp->ls_state->inode; + struct nfs_lock_context *l_ctx; p = kzalloc(sizeof(*p), GFP_NOFS); if (p == NULL) return NULL; + l_ctx = nfs_get_lock_context(ctx); + if (!IS_ERR(l_ctx)) { + p->l_ctx = l_ctx; + } else { + kfree(p); + return NULL; + } p->arg.fh = NFS_FH(inode); p->arg.fl = &p->fl; p->arg.seqid = seqid; @@ -6427,7 +6435,6 @@ static struct nfs4_unlockdata *nfs4_alloc_unlockdata(struct file_lock *fl, refcount_inc(&lsp->ls_count); /* Ensure we don't close file until we're done freeing locks! */ p->ctx = get_nfs_open_context(ctx); - p->l_ctx = nfs_get_lock_context(ctx); memcpy(&p->fl, fl, sizeof(p->fl)); p->server = NFS_SERVER(inode); return p; -- 2.31.1

2 1

[PATCH OLK-5.10 0/4] Backport mainline patches
by Wang Liang 03 Jul '25

03 Jul '25

Eric Dumazet (2): net: add more sanity check in virtio_net_hdr_to_skb() net: test for not too small csum_start in virtio_net_hdr_to_skb() Wang Liang (2): net: fix crash when config small gso_max_size/gso_ipv4_max_size net: virtio: Fix kabi broken include/linux/virtio_net.h | 13 +++++++++++-- net/core/rtnetlink.c | 2 +- 2 files changed, 12 insertions(+), 3 deletions(-) -- 2.34.1

2 5

[PATCH openEuler-1.0-LTS] arm64: cacheinfo: Fix incorrect assignment of signed error value to unsigned fw_level
by Wupeng Ma 03 Jul '25

03 Jul '25

From: Sudeep Holla <sudeep.holla(a)arm.com> stable inclusion from stable-v4.19.256 commit c3396c1c8b87510f2ac2a674948156577559d42d category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICG9RO CVE: CVE-2022-50228 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit e75d18cecbb3805895d8ed64da4f78575ec96043 ] Though acpi_find_last_cache_level() always returned signed value and the document states it will return any errors caused by lack of a PPTT table, it never returned negative values before. Commit 0c80f9e165f8 ("ACPI: PPTT: Leave the table mapped for the runtime usage") however changed it by returning -ENOENT if no PPTT was found. The value returned from acpi_find_last_cache_level() is then assigned to unsigned fw_level. It will result in the number of cache leaves calculated incorrectly as a huge value which will then cause the following warning from __alloc_pages as the order would be great than MAX_ORDER because of incorrect and huge cache leaves value. | WARNING: CPU: 0 PID: 1 at mm/page_alloc.c:5407 __alloc_pages+0x74/0x314 | Modules linked in: | CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.19.0-10393-g7c2a8d3ac4c0 #73 | pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) | pc : __alloc_pages+0x74/0x314 | lr : alloc_pages+0xe8/0x318 | Call trace: | __alloc_pages+0x74/0x314 | alloc_pages+0xe8/0x318 | kmalloc_order_trace+0x68/0x1dc | __kmalloc+0x240/0x338 | detect_cache_attributes+0xe0/0x56c | update_siblings_masks+0x38/0x284 | store_cpu_topology+0x78/0x84 | smp_prepare_cpus+0x48/0x134 | kernel_init_freeable+0xc4/0x14c | kernel_init+0x2c/0x1b4 | ret_from_fork+0x10/0x20 Fix the same by changing fw_level to be signed integer and return the error from init_cache_level() early in case of error. Reported-and-Tested-by: Bruno Goncalves <bgoncalv(a)redhat.com> Signed-off-by: Sudeep Holla <sudeep.holla(a)arm.com> Link: https://lore.kernel.org/r/20220808084640.3165368-1-sudeep.holla@arm.com Signed-off-by: Will Deacon <will(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- arch/arm64/kernel/cacheinfo.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/arch/arm64/kernel/cacheinfo.c b/arch/arm64/kernel/cacheinfo.c index 80a4ab1c43fd..be11effcb090 100644 --- a/arch/arm64/kernel/cacheinfo.c +++ b/arch/arm64/kernel/cacheinfo.c @@ -58,7 +58,8 @@ static void ci_leaf_init(struct cacheinfo *this_leaf, static int __init_cache_level(unsigned int cpu) { - unsigned int ctype, level, leaves, fw_level; + unsigned int ctype, level, leaves; + int fw_level; struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu); for (level = 1, leaves = 0; level <= MAX_CACHE_LEVEL; level++) { @@ -76,6 +77,9 @@ static int __init_cache_level(unsigned int cpu) else fw_level = acpi_find_last_cache_level(cpu); + if (fw_level < 0) + return fw_level; + if (level < fw_level) { /* * some external caches not specified in CLIDR_EL1 -- 2.43.0

2 1

[openeuler:openEuler-1.0-LTS 1605/1605] arch/x86/mm/maccess.o: warning: objtool: missing symbol for section .text
by kernel test robot 03 Jul '25

03 Jul '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 382711115afc1197da2c288679079946650ef017 commit: 22058d2bdaf6b0526395ceec2736c72c3b5f435a [1605/1605] uaccess: Add strict non-pagefault kernel-space read function config: x86_64-buildonly-randconfig-2004-20250501 (https://download.01.org/0day-ci/archive/20250703/202507030925.ESXy0WXt-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250703/202507030925.ESXy0WXt-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507030925.ESXy0WXt-lkp@intel.com/ All warnings (new ones prefixed by >>): >> arch/x86/mm/maccess.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] net: fix slab-use-after-free read in decode_session6
by Wang Liang 03 Jul '25

03 Jul '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBRT1V CVE: NA ------------------ The skb->cb may be modified in qdisc enqueue() functions, like fq_enqueue and sfb_enqueue. So the cb field should not be visited as IP6CB() after qdisc dequeue(). However, decode_session6() visit IP6CB(skb). If qdisc enqueue() modify the cb field, IP6CB(skb)->nhoff may be also modified, which may trigger a KASAN issue. The stack information is as follows: dump_backtrace+0x12c/0x220 arch/arm64/kernel/stacktrace.c:233 show_stack+0x34/0x50 arch/arm64/kernel/stacktrace.c:240 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x80/0x118 lib/dump_stack.c:106 print_address_description.constprop.0+0x84/0x3c8 mm/kasan/report.c:364 print_report+0xb0/0x280 mm/kasan/report.c:475 kasan_report+0x84/0xd0 mm/kasan/report.c:588 __asan_report_load1_noabort+0x20/0x30 mm/kasan/report_generic.c:378 decode_session6+0xf74/0x1198 net/xfrm/xfrm_policy.c:3491 __xfrm_decode_session+0x78/0xf8 net/xfrm/xfrm_policy.c:3597 xfrm_decode_session_reverse include/net/xfrm.h:1257 [inline] icmpv6_route_lookup+0x30c/0x498 net/ipv6/icmp.c:392 icmp6_send+0x94c/0x1af8 net/ipv6/icmp.c:601 __icmpv6_send include/linux/icmpv6.h:28 [inline] icmpv6_send include/linux/icmpv6.h:49 [inline] ip6_link_failure+0x3c/0x1b0 net/ipv6/route.c:2791 dst_link_failure include/net/dst.h:447 [inline] ip6_tnl_xmit+0x3cc/0x2778 net/ipv6/ip6_tunnel.c:1283 ipxip6_tnl_xmit net/ipv6/ip6_tunnel.c:1399 [inline] ip6_tnl_start_xmit+0x774/0x1138 net/ipv6/ip6_tunnel.c:1447 __netdev_start_xmit include/linux/netdevice.h:4965 [inline] netdev_start_xmit include/linux/netdevice.h:4979 [inline] xmit_one.constprop.0+0x114/0x3c0 net/core/dev.c:3580 dev_hard_start_xmit+0xb0/0x180 net/core/dev.c:3596 sch_direct_xmit+0x17c/0x1088 net/sched/sch_generic.c:342 qdisc_restart net/sched/sch_generic.c:407 [inline] __qdisc_run+0x1a4/0x358 net/sched/sch_generic.c:415 __dev_xmit_skb net/core/dev.c:3886 [inline] __dev_queue_xmit+0x156c/0x3380 net/core/dev.c:4358 dev_queue_xmit include/linux/netdevice.h:3146 [inline] neigh_connected_output+0x2e8/0x3e0 net/core/neighbour.c:1592 neigh_output include/net/neighbour.h:553 [inline] ip6_finish_output2+0xb58/0x17b0 net/ipv6/ip6_output.c:141 ip6_fragment+0x1778/0x1d70 net/ipv6/ip6_output.c:962 __ip6_finish_output+0x61c/0x9f0 net/ipv6/ip6_output.c:206 ip6_finish_output+0x48/0x2d8 net/ipv6/ip6_output.c:219 NF_HOOK_COND include/linux/netfilter.h:297 [inline] ip6_output+0x1cc/0x3a0 net/ipv6/ip6_output.c:240 dst_output include/net/dst.h:468 [inline] ip6_local_out+0xa4/0xe0 net/ipv6/output_core.c:155 ip6_send_skb+0x88/0x1f0 net/ipv6/ip6_output.c:2038 udp_v6_send_skb+0xa7c/0x10b8 net/ipv6/udp.c:1295 udpv6_sendmsg+0x1b04/0x2320 net/ipv6/udp.c:1591 inet6_sendmsg+0xb0/0x110 net/ipv6/af_inet6.c:657 sock_sendmsg_nosec net/socket.c:734 [inline] __sock_sendmsg net/socket.c:749 [inline] __sock_sendmsg+0xc8/0x190 net/socket.c:744 sock_sendmsg+0x120/0x210 net/socket.c:772 splice_to_socket+0x8d8/0xc88 fs/splice.c:881 do_splice_from fs/splice.c:933 [inline] direct_splice_actor+0x100/0x1a0 fs/splice.c:1142 splice_direct_to_actor+0x300/0x898 fs/splice.c:1088 do_splice_direct+0x190/0x268 fs/splice.c:1194 do_sendfile+0xa50/0xf50 fs/read_write.c:1256 __do_sys_sendfile64 fs/read_write.c:1324 [inline] __se_sys_sendfile64+0x2e4/0x3a0 fs/read_write.c:1310 __arm64_sys_sendfile64+0x94/0xe0 fs/read_write.c:1310 __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline] invoke_syscall+0x8c/0x2e0 arch/arm64/kernel/syscall.c:51 el0_svc_common.constprop.0+0x200/0x2a8 arch/arm64/kernel/syscall.c:134 do_el0_svc+0x4c/0x70 arch/arm64/kernel/syscall.c:176 el0_svc+0x44/0x1d8 arch/arm64/kernel/entry-common.c:806 el0t_64_sync_handler+0x100/0x130 arch/arm64/kernel/entry-common.c:844 el0t_64_sync+0x188/0x190 arch/arm64/kernel/entry.S:757 Therefore, set the cb field in the skb to 0 before xfrm decode process. Fixes: e5d25a90886d ("[IPV6] XFRM: Fix decoding session with preceding extension header(s).") Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/ipv6/ip6_tunnel.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c index d1f819238414..dc8d7ed637ef 100644 --- a/net/ipv6/ip6_tunnel.c +++ b/net/ipv6/ip6_tunnel.c @@ -1227,6 +1227,7 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield, t->err_time + IP6TUNNEL_ERR_TIMEO)) { t->err_count--; + memset(skb->cb, 0, sizeof(struct inet6_skb_parm)); dst_link_failure(skb); } else { t->err_count = 0; @@ -1302,6 +1303,7 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield, return 0; tx_err_link_failure: stats->tx_carrier_errors++; + memset(skb->cb, 0, sizeof(struct inet6_skb_parm)); dst_link_failure(skb); tx_err_dst_release: dst_release(dst); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] [Backport] drm/amd/display: clear optc underflow before turn off odm clock
by Lin Ruifeng 03 Jul '25

03 Jul '25

From: Fudong Wang <Fudong.Wang(a)amd.com> stable inclusion from stable-v4.19.257 commit 443687798d6f094412b7312b64b3bb4d99aedff7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICG9B8 CVE: CVE-2022-49969 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b2a93490201300a749ad261b5c5d05cb50179c44 ] [Why] After ODM clock off, optc underflow bit will be kept there always and clear not work. We need to clear that before clock off. [How] Clear that if have when clock off. Reviewed-by: Alvin Lee <alvin.lee2(a)amd.com> Acked-by: Tom Chung <chiahsuan.chung(a)amd.com> Signed-off-by: Fudong Wang <Fudong.Wang(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.c index 411f89218e01..cb5c44b339e0 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.c +++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_optc.c @@ -452,6 +452,11 @@ void optc1_enable_optc_clock(struct timing_generator *optc, bool enable) OTG_CLOCK_ON, 1, 1, 1000); } else { + + //last chance to clear underflow, otherwise, it will always there due to clock is off. + if (optc->funcs->is_optc_underflow_occurred(optc) == true) + optc->funcs->clear_optc_underflow(optc); + REG_UPDATE_2(OTG_CLOCK_CONTROL, OTG_CLOCK_GATE_DIS, 0, OTG_CLOCK_EN, 0); -- 2.22.0

2 1

[openeuler:openEuler-1.0-LTS 1605/1605] net/ipv4/arp.c:1106:5: warning: comparison of distinct pointer types ('typeof (dev->addr_len) *' (aka 'unsigned char *') and 'typeof (sizeof (r->arp_ha.sa_data)) *' (aka 'unsigned long *'))
by kernel test robot 03 Jul '25

03 Jul '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 382711115afc1197da2c288679079946650ef017 commit: 7ad207616673722d5cf52c18d9464e0d3184ffc9 [1605/1605] arp: Prevent overflow in arp_req_get(). config: x86_64-buildonly-randconfig-2002-20250501 (https://download.01.org/0day-ci/archive/20250703/202507030748.cQODcYRb-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250703/202507030748.cQODcYRb-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507030748.cQODcYRb-lkp@intel.com/ All warnings (new ones prefixed by >>): >> net/ipv4/arp.c:1106:5: warning: comparison of distinct pointer types ('typeof (dev->addr_len) *' (aka 'unsigned char *') and 'typeof (sizeof (r->arp_ha.sa_data)) *' (aka 'unsigned long *')) [-Wcompare-distinct-pointer-types] 1106 | min(dev->addr_len, sizeof(r->arp_ha.sa_data))); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kernel.h:884:19: note: expanded from macro 'min' 884 | #define min(x, y) __careful_cmp(x, y, <) | ^~~~~~~~~~~~~~~~~~~~~~ include/linux/kernel.h:875:24: note: expanded from macro '__careful_cmp' 875 | __builtin_choose_expr(__safe_cmp(x, y), \ | ^~~~~~~~~~~~~~~~ include/linux/kernel.h:865:4: note: expanded from macro '__safe_cmp' 865 | (__typecheck(x, y) && __no_side_effects(x, y)) | ^~~~~~~~~~~~~~~~~ include/linux/kernel.h:851:29: note: expanded from macro '__typecheck' 851 | (!!(sizeof((typeof(x) *)1 == (typeof(y) *)1))) | ~~~~~~~~~~~~~~ ^ ~~~~~~~~~~~~~~ 1 warning generated. net/ipv4/arp.o: warning: objtool: missing symbol for section .init.text vim +1106 net/ipv4/arp.c 1090 1091 /* 1092 * Get an ARP cache entry. 1093 */ 1094 1095 static int arp_req_get(struct arpreq *r, struct net_device *dev) 1096 { 1097 __be32 ip = ((struct sockaddr_in *) &r->arp_pa)->sin_addr.s_addr; 1098 struct neighbour *neigh; 1099 int err = -ENXIO; 1100 1101 neigh = neigh_lookup(&arp_tbl, &ip, dev); 1102 if (neigh) { 1103 if (!(neigh->nud_state & NUD_NOARP)) { 1104 read_lock_bh(&neigh->lock); 1105 memcpy(r->arp_ha.sa_data, neigh->ha, > 1106 min(dev->addr_len, sizeof(r->arp_ha.sa_data))); 1107 r->arp_flags = arp_state_to_flags(neigh); 1108 read_unlock_bh(&neigh->lock); 1109 r->arp_ha.sa_family = dev->type; 1110 strlcpy(r->arp_dev, dev->name, sizeof(r->arp_dev)); 1111 err = 0; 1112 } 1113 neigh_release(neigh); 1114 } 1115 return err; 1116 } 1117 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1605/1605] drivers/pwm/pwm-pca9685.c:173:21: warning: variable 'pwm' set but not used
by kernel test robot 03 Jul '25

03 Jul '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 382711115afc1197da2c288679079946650ef017 commit: 0e0a61eb0d758e7fd91a0543e7d12fc065df5b70 [1605/1605] pwm: Clear chip_data in pwm_put() config: x86_64-buildonly-randconfig-2004-20250501 (https://download.01.org/0day-ci/archive/20250703/202507030648.wv6Tc1L9-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250703/202507030648.wv6Tc1L9-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507030648.wv6Tc1L9-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/pwm/pwm-pca9685.c:173:21: warning: variable 'pwm' set but not used [-Wunused-but-set-variable] 173 | struct pwm_device *pwm; | ^ 1 warning generated. vim +/pwm +173 drivers/pwm/pwm-pca9685.c bccec89f0a35f65 Mika Westerberg 2016-09-20 169 c40c461e1944b9c Sven Van Asbroeck 2017-04-13 170 static void pca9685_pwm_gpio_free(struct gpio_chip *gpio, unsigned int offset) c40c461e1944b9c Sven Van Asbroeck 2017-04-13 171 { c40c461e1944b9c Sven Van Asbroeck 2017-04-13 172 struct pca9685 *pca = gpiochip_get_data(gpio); c40c461e1944b9c Sven Van Asbroeck 2017-04-13 @173 struct pwm_device *pwm; c40c461e1944b9c Sven Van Asbroeck 2017-04-13 174 c40c461e1944b9c Sven Van Asbroeck 2017-04-13 175 pca9685_pwm_gpio_set(gpio, offset, 0); c40c461e1944b9c Sven Van Asbroeck 2017-04-13 176 pm_runtime_put(pca->chip.dev); c40c461e1944b9c Sven Van Asbroeck 2017-04-13 177 mutex_lock(&pca->lock); c40c461e1944b9c Sven Van Asbroeck 2017-04-13 178 pwm = &pca->chip.pwms[offset]; c40c461e1944b9c Sven Van Asbroeck 2017-04-13 179 mutex_unlock(&pca->lock); c40c461e1944b9c Sven Van Asbroeck 2017-04-13 180 } c40c461e1944b9c Sven Van Asbroeck 2017-04-13 181 :::::: The code at line 173 was first introduced by commit :::::: c40c461e1944b9cfb520e04184ec1e5c80fb210b pwm: pca9685: Fix GPIO-only operation :::::: TO: Sven Van Asbroeck <thesven73(a)gmail.com> :::::: CC: Thierry Reding <thierry.reding(a)gmail.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] arm64: cacheinfo: Fix incorrect assignment of signed error value to unsigned fw_level
by Wupeng Ma 03 Jul '25

03 Jul '25

From: Sudeep Holla <sudeep.holla(a)arm.com> mainline inclusion from mainline-v4.19.258 commit 1668c38ef2e5bb80dbee88afcecfcdc3e7abc2aa category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICG9EE CVE: CVE-2022-49964 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit e75d18cecbb3805895d8ed64da4f78575ec96043 ] Though acpi_find_last_cache_level() always returned signed value and the document states it will return any errors caused by lack of a PPTT table, it never returned negative values before. Commit 0c80f9e165f8 ("ACPI: PPTT: Leave the table mapped for the runtime usage") however changed it by returning -ENOENT if no PPTT was found. The value returned from acpi_find_last_cache_level() is then assigned to unsigned fw_level. It will result in the number of cache leaves calculated incorrectly as a huge value which will then cause the following warning from __alloc_pages as the order would be great than MAX_ORDER because of incorrect and huge cache leaves value. | WARNING: CPU: 0 PID: 1 at mm/page_alloc.c:5407 __alloc_pages+0x74/0x314 | Modules linked in: | CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.19.0-10393-g7c2a8d3ac4c0 #73 | pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) | pc : __alloc_pages+0x74/0x314 | lr : alloc_pages+0xe8/0x318 | Call trace: | __alloc_pages+0x74/0x314 | alloc_pages+0xe8/0x318 | kmalloc_order_trace+0x68/0x1dc | __kmalloc+0x240/0x338 | detect_cache_attributes+0xe0/0x56c | update_siblings_masks+0x38/0x284 | store_cpu_topology+0x78/0x84 | smp_prepare_cpus+0x48/0x134 | kernel_init_freeable+0xc4/0x14c | kernel_init+0x2c/0x1b4 | ret_from_fork+0x10/0x20 Fix the same by changing fw_level to be signed integer and return the error from init_cache_level() early in case of error. Reported-and-Tested-by: Bruno Goncalves <bgoncalv(a)redhat.com> Signed-off-by: Sudeep Holla <sudeep.holla(a)arm.com> Link: https://lore.kernel.org/r/20220808084640.3165368-1-sudeep.holla@arm.com Signed-off-by: Will Deacon <will(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- arch/arm64/kernel/cacheinfo.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/arch/arm64/kernel/cacheinfo.c b/arch/arm64/kernel/cacheinfo.c index 80a4ab1c43fd..be11effcb090 100644 --- a/arch/arm64/kernel/cacheinfo.c +++ b/arch/arm64/kernel/cacheinfo.c @@ -58,7 +58,8 @@ static void ci_leaf_init(struct cacheinfo *this_leaf, static int __init_cache_level(unsigned int cpu) { - unsigned int ctype, level, leaves, fw_level; + unsigned int ctype, level, leaves; + int fw_level; struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu); for (level = 1, leaves = 0; level <= MAX_CACHE_LEVEL; level++) { @@ -76,6 +77,9 @@ static int __init_cache_level(unsigned int cpu) else fw_level = acpi_find_last_cache_level(cpu); + if (fw_level < 0) + return fw_level; + if (level < fw_level) { /* * some external caches not specified in CLIDR_EL1 -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0
by Wupeng Ma 03 Jul '25

03 Jul '25

From: "Maciej S. Szmigiero" <maciej.szmigiero(a)oracle.com> stable inclusion from stable-v4.19.256 commit c3396c1c8b87510f2ac2a674948156577559d42d category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICG9RO CVE: CVE-2022-50228 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f17c31c48e5cde9895a491d91c424eeeada3e134 upstream. Don't BUG/WARN on interrupt injection due to GIF being cleared, since it's trivial for userspace to force the situation via KVM_SET_VCPU_EVENTS (even if having at least a WARN there would be correct for KVM internally generated injections). kernel BUG at arch/x86/kvm/svm/svm.c:3386! invalid opcode: 0000 [#1] SMP CPU: 15 PID: 926 Comm: smm_test Not tainted 5.17.0-rc3+ #264 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:svm_inject_irq+0xab/0xb0 [kvm_amd] Code: <0f> 0b 0f 1f 00 0f 1f 44 00 00 80 3d ac b3 01 00 00 55 48 89 f5 53 RSP: 0018:ffffc90000b37d88 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff88810a234ac0 RCX: 0000000000000006 RDX: 0000000000000000 RSI: ffffc90000b37df7 RDI: ffff88810a234ac0 RBP: ffffc90000b37df7 R08: ffff88810a1fa410 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: ffff888109571000 R14: ffff88810a234ac0 R15: 0000000000000000 FS: 0000000001821380(0000) GS:ffff88846fdc0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f74fc550008 CR3: 000000010a6fe000 CR4: 0000000000350ea0 Call Trace: <TASK> inject_pending_event+0x2f7/0x4c0 [kvm] kvm_arch_vcpu_ioctl_run+0x791/0x17a0 [kvm] kvm_vcpu_ioctl+0x26d/0x650 [kvm] __x64_sys_ioctl+0x82/0xb0 do_syscall_64+0x3b/0xc0 entry_SYSCALL_64_after_hwframe+0x44/0xae </TASK> Fixes: 219b65dcf6c0 ("KVM: SVM: Improve nested interrupt injection") Cc: stable(a)vger.kernel.org Co-developed-by: Sean Christopherson <seanjc(a)google.com> Signed-off-by: Sean Christopherson <seanjc(a)google.com> Signed-off-by: Maciej S. Szmigiero <maciej.szmigiero(a)oracle.com> Message-Id: <35426af6e123cbe91ec7ce5132ce72521f02b1b5.1651440202.git.maciej.szmigiero(a)oracle.com> Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- arch/x86/kvm/svm.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c index 74b4c98c6607..e62bcdb0822e 100644 --- a/arch/x86/kvm/svm.c +++ b/arch/x86/kvm/svm.c @@ -5127,8 +5127,6 @@ static void svm_set_irq(struct kvm_vcpu *vcpu) { struct vcpu_svm *svm = to_svm(vcpu); - BUG_ON(!(gif_set(svm))); - trace_kvm_inj_virq(vcpu->arch.interrupt.nr); ++vcpu->stat.irq_injections; -- 2.43.0

2 1