- Kernel - mailweb.openeuler.org

[openeuler:openEuler-1.0-LTS 1753/1753] mm/memcontrol.o: warning: objtool: missing symbol for section .text.unlikely
by kernel test robot 09 Aug '25

09 Aug '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 748957057cef2d3b3e35d749c9a1ade66e2b5e73 commit: 3d8b38eb81cac81395f6a823f6bf401b327268e6 [1753/1753] mm, oom: introduce memory.oom.group config: x86_64-buildonly-randconfig-2002-20250806 (https://download.01.org/0day-ci/archive/20250808/202508082052.b36GXYCR-lkp@…) compiler: gcc-11 (Debian 11.3.0-12) 11.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250808/202508082052.b36GXYCR-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202508082052.b36GXYCR-lkp@intel.com/ All warnings (new ones prefixed by >>): mm/memcontrol.c:5751: warning: bad line: | 0, otherwise. >> mm/memcontrol.o: warning: objtool: missing symbol for section .text.unlikely -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2662/2662] crypto/asymmetric_keys/pgp_library.c:189: warning: Function parameter or member 'data' not described in 'pgp_parse_packets'
by kernel test robot 08 Aug '25

08 Aug '25

Hi David, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 9f11838de785067991187f7d0aa9b340abfba381 commit: b78af6579e15dcdff86504da90af77f3e890270e [2662/2662] PGPLIB: Basic packet parser config: loongarch-allmodconfig (https://download.01.org/0day-ci/archive/20250808/202508081825.fqBn1XgA-lkp@…) compiler: clang version 19.1.7 (https://github.com/llvm/llvm-project cd708029e0b2869e80abe31ddb175f7c35361f90) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250808/202508081825.fqBn1XgA-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202508081825.fqBn1XgA-lkp@intel.com/ All warnings (new ones prefixed by >>): >> crypto/asymmetric_keys/pgp_library.c:189: warning: Function parameter or member 'data' not described in 'pgp_parse_packets' >> crypto/asymmetric_keys/pgp_library.c:189: warning: Function parameter or member 'datalen' not described in 'pgp_parse_packets' >> crypto/asymmetric_keys/pgp_library.c:189: warning: Excess function parameter '_data' description in 'pgp_parse_packets' >> crypto/asymmetric_keys/pgp_library.c:189: warning: Excess function parameter '_datalen' description in 'pgp_parse_packets' vim +189 crypto/asymmetric_keys/pgp_library.c 178 179 /** 180 * pgp_parse_packets - Parse a set of PGP packets 181 * @_data: Data to be parsed (updated) 182 * @_datalen: Amount of data (updated) 183 * @ctx: Parsing context 184 * 185 * Parse a set of PGP packets [RFC 4880: 4]. 186 */ 187 int pgp_parse_packets(const u8 *data, size_t datalen, 188 struct pgp_parse_context *ctx) > 189 { 190 enum pgp_packet_tag type; 191 ssize_t pktlen; 192 u8 headerlen; 193 int ret; 194 195 while (datalen > 2) { 196 pktlen = pgp_parse_packet_header(&data, &datalen, &type, 197 &headerlen); 198 if (pktlen < 0) 199 return pktlen; 200 201 if ((ctx->types_of_interest >> type) & 1) { 202 ret = ctx->process_packet(ctx, type, headerlen, 203 data, pktlen); 204 if (ret < 0) 205 return ret; 206 } 207 data += pktlen; 208 datalen -= pktlen; 209 } 210 211 if (datalen != 0) { 212 pr_debug("Excess octets in packet stream\n"); 213 return -EBADMSG; 214 } 215 216 return 0; 217 } 218 EXPORT_SYMBOL_GPL(pgp_parse_packets); 219 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] mm/mem_sampling: preserve kernel subsystem SPE state across perf sampling
by Ze Zuo 08 Aug '25

08 Aug '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICRXXI CVE: NA -------------------------------- Ensure proper save/restore of SPE state for kernel subsystems (NUMA balancing, DAMON etc.) when perf SPE sampling is enabled/disabled: - Suspend subsystem memory sampling during perf SPE operation - Restore original configurations when perf sampling stops Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- mm/mem_sampling.c | 124 ++++++++++++++++++++++++++-------------------- 1 file changed, 69 insertions(+), 55 deletions(-) diff --git a/mm/mem_sampling.c b/mm/mem_sampling.c index 74f95e4611fe..8483ebe1a83c 100644 --- a/mm/mem_sampling.c +++ b/mm/mem_sampling.c @@ -41,8 +41,11 @@ DEFINE_PER_CPU(enum arm_spe_user_e, arm_spe_user); EXPORT_PER_CPU_SYMBOL_GPL(arm_spe_user); enum mem_sampling_saved_state_e { - MEM_SAMPLING_STATE_ENABLE, MEM_SAMPLING_STATE_DISABLE, + MEM_SAMPLING_STATE_ENABLE, + MEM_SAMPLING_STATE_NUMA_ENABLE, + MEM_SAMPLING_STATE_DAMON_ENABLE, + MEM_SAMPLING_STATE_NUM_DAMON_ENABLE, MEM_SAMPLING_STATE_EMPTY, }; enum mem_sampling_saved_state_e mem_sampling_saved_state = MEM_SAMPLING_STATE_EMPTY; @@ -416,17 +419,26 @@ static void __set_mem_sampling_state(bool enabled) } } +static enum mem_sampling_saved_state_e get_mem_sampling_saved_state(void) +{ + if (static_branch_likely(&mm_damon_mem_sampling) && + static_branch_likely(&sched_numabalancing_mem_sampling)) + return MEM_SAMPLING_STATE_NUM_DAMON_ENABLE; + if (static_branch_likely(&mm_damon_mem_sampling)) + return MEM_SAMPLING_STATE_DAMON_ENABLE; + if (static_branch_likely(&sched_numabalancing_mem_sampling)) + return MEM_SAMPLING_STATE_NUMA_ENABLE; + if (static_branch_likely(&mem_sampling_access_hints)) + return MEM_SAMPLING_STATE_ENABLE; + + return MEM_SAMPLING_STATE_DISABLE; +} + void set_mem_sampling_state(bool enabled) { if (!mem_sampling_ops.sampling_start || !mm_spe_enabled()) return; - if (mem_sampling_saved_state != MEM_SAMPLING_STATE_EMPTY) { - mem_sampling_saved_state = enabled ? MEM_SAMPLING_STATE_ENABLE : - MEM_SAMPLING_STATE_DISABLE; - return; - } - if (enabled) sysctl_mem_sampling_mode = MEM_SAMPLING_NORMAL; else @@ -434,10 +446,45 @@ void set_mem_sampling_state(bool enabled) __set_mem_sampling_state(enabled); } +static int set_state(int state) +{ + if (mem_sampling_saved_state != MEM_SAMPLING_STATE_EMPTY) { + mem_sampling_saved_state = state; + return -EINVAL; + } + switch (state) { + case 0: + set_mem_sampling_state(false); + break; + case 1: + set_mem_sampling_state(false); + set_mem_sampling_state(true); + break; + case 2: + set_mem_sampling_state(false); + set_mem_sampling_state(true); + set_numabalancing_mem_sampling_state(true); + break; + case 3: + set_mem_sampling_state(false); + set_mem_sampling_state(true); + set_damon_mem_sampling_state(true); + break; + case 4: + set_mem_sampling_state(true); + set_numabalancing_mem_sampling_state(true); + set_damon_mem_sampling_state(true); + break; + default: + return -EINVAL; + } + return 0; +} + void mem_sampling_user_switch_process(enum user_switch_type type) { - bool state, mm_spe_is_perf_user = false; - int cpu; + bool mm_spe_is_perf_user = false; + int cpu, hints; if (type >= USER_SWITCH_TYPE_MAX) { pr_err("user switch type error.\n"); @@ -456,26 +503,27 @@ void mem_sampling_user_switch_process(enum user_switch_type type) if (mem_sampling_saved_state != MEM_SAMPLING_STATE_EMPTY) return; - if (static_branch_unlikely(&mem_sampling_access_hints)) - mem_sampling_saved_state = MEM_SAMPLING_STATE_ENABLE; + hints = get_mem_sampling_saved_state(); + set_state(0); + + if (hints) + mem_sampling_saved_state = hints; else mem_sampling_saved_state = MEM_SAMPLING_STATE_DISABLE; - pr_debug("user switch away from mem_sampling, %s is saved, set to disable.\n", - mem_sampling_saved_state ? "disabled" : "enabled"); + pr_debug("user switch away from mem_sampling, %d is saved, set to disable.\n", + mem_sampling_saved_state); - set_mem_sampling_state(false); } else { /* If the state is not backed up, do not restore it */ if (mem_sampling_saved_state == MEM_SAMPLING_STATE_EMPTY || mm_spe_is_perf_user) return; - state = (mem_sampling_saved_state == MEM_SAMPLING_STATE_ENABLE) ? true : false; - set_mem_sampling_state(state); + hints = mem_sampling_saved_state; mem_sampling_saved_state = MEM_SAMPLING_STATE_EMPTY; + set_state(hints); - pr_debug("user switch back to mem_sampling, set to saved %s.\n", - state ? "enalbe" : "disable"); + pr_debug("user switch back to mem_sampling, set to saved %d.\n", hints); } } EXPORT_SYMBOL_GPL(mem_sampling_user_switch_process); @@ -488,15 +536,7 @@ static int proc_mem_sampling_enable(struct ctl_table *table, int write, int err; int state = 0; - if (static_branch_likely(&mem_sampling_access_hints)) - state = 1; - if (static_branch_likely(&sched_numabalancing_mem_sampling)) - state = 2; - if (static_branch_likely(&mm_damon_mem_sampling)) - state = 3; - if (static_branch_likely(&mm_damon_mem_sampling) && - static_branch_likely(&sched_numabalancing_mem_sampling)) - state = 4; + state = get_mem_sampling_saved_state(); if (write && !capable(CAP_SYS_ADMIN)) return -EPERM; @@ -508,34 +548,8 @@ static int proc_mem_sampling_enable(struct ctl_table *table, int write, err = proc_dointvec_minmax(&t, write, buffer, lenp, ppos); if (err < 0) return err; - if (write) { - switch (state) { - case 0: - set_mem_sampling_state(false); - break; - case 1: - set_mem_sampling_state(false); - set_mem_sampling_state(true); - break; - case 2: - set_mem_sampling_state(false); - set_mem_sampling_state(true); - set_numabalancing_mem_sampling_state(true); - break; - case 3: - set_mem_sampling_state(false); - set_mem_sampling_state(true); - set_damon_mem_sampling_state(true); - break; - case 4: - set_mem_sampling_state(true); - set_numabalancing_mem_sampling_state(true); - set_damon_mem_sampling_state(true); - break; - default: - return -EINVAL; - } - } + if (write) + err = set_state(state); return err; } -- 2.33.0

2 1

[PATCH OLK-6.6 00/21] perf jevents: add some pmu event and metric
by Qinxin Xia 08 Aug '25

08 Aug '25

From: JiangShui Yang <yangjiangshui(a)h-partners.com> perf jevents: add some pmu event and metric Junhao He (4): perf vendor events arm64: Move HiSi hip09/sys/ JSON files to hip09/ perf jevents: Add support to parse sys metrics perf jevents: Add support for HiSilicon UC PMU aliasing perf vendor events arm64: Add Hisi hip12 Topdown metrics Qi Liu (6): perf jevents: Add support for HiSilicon L3C PMU aliasing perf jevents: Add support for HiSilicon DDRC PMU aliasing perf jevents: Add support for HiSilicon HHA PMU aliasing perf jevents: Add support for HiSilicon SLLC PMU aliasing perf jevents: Add support for HiSilicon PA PMU aliasing perf pmu: Add alias match method to fit pmu_name of HiSilicon DDRC Qinxin Xia (8): perf jevents: Add support for HiSilicon NOC PMU aliasing perf pmu: Adjust the pmu event/metric framework perf jevents: Add support for HiSilicon MN PMU aliasing perf pmu: Adjust the pmu event/metric framework perf jevents: Add support for HiSilicon l3c PMU aliasing perf pmu-events: Fix filter 'ext' filed config incorrect perf pmu: remove l3 0x80-0x8f event in pmu event json perf jevents: add some PMU-event metrics Yicong Yang (1): perf jevents: Fix and more metrics for HiSilicon UC PMU Yushan Wang (2): perf: correct event code in metric json perf: Fix incorrect event alias .../hisilicon/hip09/uncore-cpa-metric.json | 20 + .../hisilicon/hip09/uncore-ddrc-metric.json | 56 +++ .../hisilicon/hip09/uncore-hha-metric.json | 65 +++ .../hisilicon/hip09/uncore-l3c-metric.json | 38 ++ .../hisilicon/hip09/uncore-pa-metric.json | 92 ++++ .../hisilicon/hip09/uncore-sllc-metric.json | 74 +++ .../hisilicon/hip09/uncore-uc-metric.json | 146 ++++++ .../arm64/hisilicon/hip12/core-imp-def.json | 125 +++++ .../arch/arm64/hisilicon/hip12/metrics.json | 459 +++++++++++++++++ .../hisilicon/hip12/uncore-cpa-metric.json | 20 + .../hisilicon/hip12/uncore-ddrc-metric.json | 56 +++ .../hisilicon/hip12/uncore-hha-metric.json | 65 +++ .../hisilicon/hip12/uncore-l3c-metric.json | 65 +++ .../hisilicon/hip12/uncore-mn-metric.json | 58 +++ .../hisilicon/hip12/uncore-noc-metric.json | 38 ++ .../hisilicon/hip12/uncore-pa-metric.json | 92 ++++ .../hisilicon/hip12/uncore-sllc-metric.json | 74 +++ .../{hip09 => hipxx}/sys/uncore-cpa.json | 16 - .../hisilicon/hipxx/sys/uncore-ddrc.json | 100 ++++ .../arm64/hisilicon/hipxx/sys/uncore-hha.json | 128 +++++ .../arm64/hisilicon/hipxx/sys/uncore-l3c.json | 448 +++++++++++++++++ .../arm64/hisilicon/hipxx/sys/uncore-mn.json | 163 ++++++ .../arm64/hisilicon/hipxx/sys/uncore-noc.json | 329 +++++++++++++ .../arm64/hisilicon/hipxx/sys/uncore-pa.json | 184 +++++++ .../hisilicon/hipxx/sys/uncore-sllc.json | 132 +++++ .../arm64/hisilicon/hipxx/sys/uncore-uc.json | 462 ++++++++++++++++++ tools/perf/pmu-events/jevents.py | 2 + tools/perf/util/pmu.c | 2 +- 28 files changed, 3492 insertions(+), 17 deletions(-) create mode 100644 tools/perf/pmu-events/arch/arm64/hisilicon/hip09/uncore-cpa-metric.json create mode 100644 tools/perf/pmu-events/arch/arm64/hisilicon/hip09/uncore-ddrc-metric.json create mode 100644 tools/perf/pmu-events/arch/arm64/hisilicon/hip09/uncore-hha-metric.json create mode 100644 tools/perf/pmu-events/arch/arm64/hisilicon/hip09/uncore-l3c-metric.json create mode 100644 tools/perf/pmu-events/arch/arm64/hisilicon/hip09/uncore-pa-metric.json create mode 100644 tools/perf/pmu-events/arch/arm64/hisilicon/hip09/uncore-sllc-metric.json create mode 100644 tools/perf/pmu-events/arch/arm64/hisilicon/hip09/uncore-uc-metric.json create mode 100644 tools/perf/pmu-events/arch/arm64/hisilicon/hip12/core-imp-def.json create mode 100644 tools/perf/pmu-events/arch/arm64/hisilicon/hip12/metrics.json create mode 100644 tools/perf/pmu-events/arch/arm64/hisilicon/hip12/uncore-cpa-metric.json create mode 100644 tools/perf/pmu-events/arch/arm64/hisilicon/hip12/uncore-ddrc-metric.json create mode 100644 tools/perf/pmu-events/arch/arm64/hisilicon/hip12/uncore-hha-metric.json create mode 100644 tools/perf/pmu-events/arch/arm64/hisilicon/hip12/uncore-l3c-metric.json create mode 100644 tools/perf/pmu-events/arch/arm64/hisilicon/hip12/uncore-mn-metric.json create mode 100644 tools/perf/pmu-events/arch/arm64/hisilicon/hip12/uncore-noc-metric.json create mode 100644 tools/perf/pmu-events/arch/arm64/hisilicon/hip12/uncore-pa-metric.json create mode 100644 tools/perf/pmu-events/arch/arm64/hisilicon/hip12/uncore-sllc-metric.json rename tools/perf/pmu-events/arch/arm64/hisilicon/{hip09 => hipxx}/sys/uncore-cpa.json (76%) create mode 100644 tools/perf/pmu-events/arch/arm64/hisilicon/hipxx/sys/uncore-ddrc.json create mode 100644 tools/perf/pmu-events/arch/arm64/hisilicon/hipxx/sys/uncore-hha.json create mode 100644 tools/perf/pmu-events/arch/arm64/hisilicon/hipxx/sys/uncore-l3c.json create mode 100644 tools/perf/pmu-events/arch/arm64/hisilicon/hipxx/sys/uncore-mn.json create mode 100644 tools/perf/pmu-events/arch/arm64/hisilicon/hipxx/sys/uncore-noc.json create mode 100644 tools/perf/pmu-events/arch/arm64/hisilicon/hipxx/sys/uncore-pa.json create mode 100644 tools/perf/pmu-events/arch/arm64/hisilicon/hipxx/sys/uncore-sllc.json create mode 100644 tools/perf/pmu-events/arch/arm64/hisilicon/hipxx/sys/uncore-uc.json -- 2.43.0

2 22

[PATCH OLK-6.6] arm64/mpam: Set 1 as the minimum setting value for CMAX
by Zeng Heng 08 Aug '25

08 Aug '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8T2RT -------------------------------- The MPAM hardware does not allow setting 0 as the cache occupancy limit value of CMAX. Otherwise, L3 msc would exhibit undefined behavior. Fixes: 83c4315c75ba ("arm64/mpam: Add CMAX feature") Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/platform/mpam/mpam_resctrl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/platform/mpam/mpam_resctrl.c b/drivers/platform/mpam/mpam_resctrl.c index 428afe27fda2..38d6d633a645 100644 --- a/drivers/platform/mpam/mpam_resctrl.c +++ b/drivers/platform/mpam/mpam_resctrl.c @@ -990,7 +990,7 @@ static int mpam_resctrl_resource_init(struct mpam_resctrl_res *res) if (cache_has_usable_cmax(class)) r->alloc_capable = true; - r->membw.min_bw = 0; + r->membw.min_bw = 1; r->membw.bw_gran = max(100 / (1 << cprops->cmax_wd), 1); break; -- 2.25.1

2 1

[PATCH OLK-6.6] arm64/mpam: Support partial-core boot for MPAM
by Zeng Heng 08 Aug '25

08 Aug '25

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/ICRZPF -------------------------------- L2 shares the same power domain with its associated CPUs. Therefore, in scenarios where only partial cores power up, the L2 MSCs belonging to the un-powered cores should not access, otherwise bus-access fault would occur. During initialization of class->props, skip any L2 MSC that is not powered, so that ensure the class->props member unaffected from uninitialized ris->props in mpam_enable_merge_features(). Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/platform/mpam/mpam_devices.c | 22 ++++++++++++++-------- drivers/platform/mpam/mpam_internal.h | 1 + 2 files changed, 15 insertions(+), 8 deletions(-) diff --git a/drivers/platform/mpam/mpam_devices.c b/drivers/platform/mpam/mpam_devices.c index 3fe0a7902d35..1317acfc4307 100644 --- a/drivers/platform/mpam/mpam_devices.c +++ b/drivers/platform/mpam/mpam_devices.c @@ -1535,8 +1535,11 @@ static int mpam_discovery_cpu_online(unsigned int cpu) mutex_lock(&mpam_list_lock); list_for_each_entry(msc, &mpam_all_msc, glbl_list) { - if (!cpumask_test_cpu(cpu, &msc->accessibility)) + if (!cpumask_test_cpu(cpu, &msc->accessibility)) { + msc->probed = true; + msc->skipped = true; continue; + } mutex_lock(&msc->lock); if (!msc->probed) @@ -1952,14 +1955,14 @@ static void mpam_enable_init_class_features(struct mpam_class *class) struct mpam_msc_ris *ris; struct mpam_component *comp; - comp = list_first_entry_or_null(&class->components, - struct mpam_component, class_list); - if (WARN_ON(!comp)) - return; + list_for_each_entry(comp, &class->components, class_list) { + list_for_each_entry(ris, &comp->ris, comp_list) { + if (!ris->msc->skipped) + break; + } + } - ris = list_first_entry_or_null(&comp->ris, - struct mpam_msc_ris, comp_list); - if (WARN_ON(!ris)) + if (WARN_ON(!comp) || WARN_ON(!ris)) return; class->props = ris->props; @@ -1979,6 +1982,9 @@ static void mpam_enable_merge_features(void) list_for_each_entry(comp, &class->components, class_list) { list_for_each_entry(ris, &comp->ris, comp_list) { + if (ris->msc->skipped) + continue; + __resource_props_mismatch(ris, class); class->nrdy_usec = max(class->nrdy_usec, diff --git a/drivers/platform/mpam/mpam_internal.h b/drivers/platform/mpam/mpam_internal.h index ff1890b3a78e..94872c0930a6 100644 --- a/drivers/platform/mpam/mpam_internal.h +++ b/drivers/platform/mpam/mpam_internal.h @@ -55,6 +55,7 @@ struct mpam_msc struct mutex lock; bool probed; + bool skipped; bool error_irq_requested; bool error_irq_hw_enabled; u16 partid_max; -- 2.25.1

2 1

[PATCH OLK-5.10] net: atm: fix use after free in lec_send()
by Wang Liang 08 Aug '25

08 Aug '25

From: Dan Carpenter <dan.carpenter(a)linaro.org> mainline inclusion from mainline-v6.14 commit f3009d0d6ab78053117f8857b921a8237f4d17b3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBYOFX CVE: CVE-2025-22004 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The ->send() operation frees skb so save the length before calling ->send() to avoid a use after free. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://patch.msgid.link/c751531d-4af4-42fe-affe-6104b34b791d@stanley.mount… Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/atm/lec.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/atm/lec.c b/net/atm/lec.c index 7226c784dbe0..ca9952c52fb5 100644 --- a/net/atm/lec.c +++ b/net/atm/lec.c @@ -181,6 +181,7 @@ static void lec_send(struct atm_vcc *vcc, struct sk_buff *skb) { struct net_device *dev = skb->dev; + unsigned int len = skb->len; ATM_SKB(skb)->vcc = vcc; atm_account_tx(vcc, skb); @@ -191,7 +192,7 @@ lec_send(struct atm_vcc *vcc, struct sk_buff *skb) } dev->stats.tx_packets++; - dev->stats.tx_bytes += skb->len; + dev->stats.tx_bytes += len; } static void lec_tx_timeout(struct net_device *dev, unsigned int txqueue) -- 2.34.1

2 1

[PATCH OLK-5.10] vlan: enforce underlying device type
by Wang Liang 08 Aug '25

08 Aug '25

From: Oscar Maes <oscmaes92(a)gmail.com> stable inclusion from stable-v5.10.235 commit fa40ebef69234e39ec2d26930d045f2fb9a8cb2b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBY43J CVE: CVE-2025-21920 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b33a534610067ade2bdaf2052900aaad99701353 ] Currently, VLAN devices can be created on top of non-ethernet devices. Besides the fact that it doesn't make much sense, this also causes a bug which leaks the address of a kernel function to usermode. When creating a VLAN device, we initialize GARP (garp_init_applicant) and MRP (mrp_init_applicant) for the underlying device. As part of the initialization process, we add the multicast address of each applicant to the underlying device, by calling dev_mc_add. __dev_mc_add uses dev->addr_len to determine the length of the new multicast address. This causes an out-of-bounds read if dev->addr_len is greater than 6, since the multicast addresses provided by GARP and MRP are only 6 bytes long. This behaviour can be reproduced using the following commands: ip tunnel add gretest mode ip6gre local ::1 remote ::2 dev lo ip l set up dev gretest ip link add link gretest name vlantest type vlan id 100 Then, the following command will display the address of garp_pdu_rcv: ip maddr show | grep 01:80:c2:00:00:21 Fix the bug by enforcing the type of the underlying device during VLAN device initialization. Fixes: 22bedad3ce11 ("net: convert multicast list to list_head") Reported-by: syzbot+91161fe81857b396c8a0(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/000000000000ca9a81061a01ec20@google.com/ Signed-off-by: Oscar Maes <oscmaes92(a)gmail.com> Reviewed-by: Jiri Pirko <jiri(a)nvidia.com> Link: https://patch.msgid.link/20250303155619.8918-1-oscmaes92@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/8021q/vlan.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c index 19c5212a4827..f48c7373d2fc 100644 --- a/net/8021q/vlan.c +++ b/net/8021q/vlan.c @@ -131,7 +131,8 @@ int vlan_check_real_dev(struct net_device *real_dev, { const char *name = real_dev->name; - if (real_dev->features & NETIF_F_VLAN_CHALLENGED) { + if (real_dev->features & NETIF_F_VLAN_CHALLENGED || + real_dev->type != ARPHRD_ETHER) { pr_info("VLANs not supported on %s\n", name); NL_SET_ERR_MSG_MOD(extack, "VLANs not supported on device"); return -EOPNOTSUPP; -- 2.34.1

2 1

[PATCH OLK-5.10] net: gso: fix ownership in __udp_gso_segment
by Wang Liang 08 Aug '25

08 Aug '25

From: Antoine Tenart <atenart(a)kernel.org> stable inclusion from stable-v5.10.235 commit a2d1cca955ed34873e524cc2e6e885450d262f05 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBY44J CVE: CVE-2025-21926 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ee01b2f2d7d0010787c2343463965bbc283a497f ] In __udp_gso_segment the skb destructor is removed before segmenting the skb but the socket reference is kept as-is. This is an issue if the original skb is later orphaned as we can hit the following bug: kernel BUG at ./include/linux/skbuff.h:3312! (skb_orphan) RIP: 0010:ip_rcv_core+0x8b2/0xca0 Call Trace: ip_rcv+0xab/0x6e0 __netif_receive_skb_one_core+0x168/0x1b0 process_backlog+0x384/0x1100 __napi_poll.constprop.0+0xa1/0x370 net_rx_action+0x925/0xe50 The above can happen following a sequence of events when using OpenVSwitch, when an OVS_ACTION_ATTR_USERSPACE action precedes an OVS_ACTION_ATTR_OUTPUT action: 1. OVS_ACTION_ATTR_USERSPACE is handled (in do_execute_actions): the skb goes through queue_gso_packets and then __udp_gso_segment, where its destructor is removed. 2. The segments' data are copied and sent to userspace. 3. OVS_ACTION_ATTR_OUTPUT is handled (in do_execute_actions) and the same original skb is sent to its path. 4. If it later hits skb_orphan, we hit the bug. Fix this by also removing the reference to the socket in __udp_gso_segment. Fixes: ad405857b174 ("udp: better wmem accounting on gso") Signed-off-by: Antoine Tenart <atenart(a)kernel.org> Link: https://patch.msgid.link/20250226171352.258045-1-atenart@kernel.org Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/ipv4/udp_offload.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c index d6d45c5c47c6..9024c55db2a6 100644 --- a/net/ipv4/udp_offload.c +++ b/net/ipv4/udp_offload.c @@ -311,13 +311,17 @@ struct sk_buff *__udp_gso_segment(struct sk_buff *gso_skb, /* clear destructor to avoid skb_segment assigning it to tail */ copy_dtor = gso_skb->destructor == sock_wfree; - if (copy_dtor) + if (copy_dtor) { gso_skb->destructor = NULL; + gso_skb->sk = NULL; + } segs = skb_segment(gso_skb, features); if (IS_ERR_OR_NULL(segs)) { - if (copy_dtor) + if (copy_dtor) { gso_skb->destructor = sock_wfree; + gso_skb->sk = sk; + } return segs; } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] mm: Fix possible deadlock in console_trylock_spinning
by Gu Bowen 08 Aug '25

08 Aug '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICPTGF CVE: NA -------------------------------- kmemleak_scan_thread() invokes scan_block() which may invoke a nomal printk() to print warning message. This can cause a deadlock in the scenario reported below: Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(kmemleak_lock); lock(&(&port->lock)->rlock); lock(kmemleak_lock); lock(console_owner); To solve this problem, switch to printk_safe mode before printing warning message, this will redirect all printk()-s to a special per-CPU buffer, which will be flushed later from a safe context (irq work), and this deadlock problem can be avoided. Our syztester report the following lockdep error: ====================================================== WARNING: possible circular locking dependency detected 4.19.90-00049-g58693b1f5fa8-dirty #3 Tainted: G O ------------------------------------------------------ systemd-journal/150 is trying to acquire lock: 00000000ef13bd01 (console_owner){-...}, at: vprintk_emit+0x252/0x420 but task is already holding lock: 0000000078c4087b (kmemleak_lock){-.-.}, at: find_and_remove_object+0x1d/0x120 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #3 (kmemleak_lock){-.-.}: _raw_write_lock_irqsave+0x3a/0x50 create_object+0x435/0x960 __kmalloc+0x243/0x310 __tty_buffer_request_room+0x1bc/0x580 tty_insert_flip_string_fixed_flag+0x91/0x1c0 tty_insert_flip_string_and_push_buffer+0x43/0x160 pty_write+0xc8/0xf0 do_output_char+0x500/0x770 n_tty_write+0x43c/0xeb0 tty_write+0x3d9/0x6d0 __vfs_write+0xfe/0x690 vfs_write+0x16d/0x490 ksys_write+0x106/0x250 do_syscall_64+0xfa/0xee0 entry_SYSCALL_64_after_hwframe+0x61/0xd6 -> #2 (&(&port->lock)->rlock){-.-.}: _raw_spin_lock_irqsave+0x3a/0x50 tty_port_tty_get+0x22/0x90 tty_port_default_wakeup+0x16/0x40 serial8250_tx_chars+0x415/0xab0 serial8250_handle_irq.part.0+0x2d4/0x390 serial8250_default_handle_irq+0xa1/0x110 serial8250_interrupt+0xfe/0x220 __handle_irq_event_percpu+0xf5/0x680 handle_irq_event_percpu+0x7b/0x150 handle_irq_event+0xa6/0x131 handle_edge_irq+0x220/0x830 handle_irq+0x40/0x60 do_IRQ+0x84/0x1c0 ret_from_intr+0x0/0x1d -> #1 (&port_lock_key){-.-.}: _raw_spin_lock_irqsave+0x3a/0x50 serial8250_console_write+0x424/0x860 console_unlock+0x6ab/0xc70 register_console+0x5bd/0x9f0 univ8250_console_init+0x34/0x3f console_init+0x398/0x549 start_kernel+0x443/0x7a0 secondary_startup_64+0xb6/0xc0 -> #0 (console_owner){-...}: lock_acquire+0x109/0x300 vprintk_emit+0x28f/0x420 vprintk_func+0x5d/0x157 printk+0xbf/0xf2 lookup_object.cold+0x3d/0x64 find_and_remove_object+0x2b/0x120 delete_object_full+0xc/0x20 kmem_cache_free+0x1d5/0x2b0 putname+0xd2/0x110 do_sys_open+0x21e/0x440 do_syscall_64+0xfa/0xee0 entry_SYSCALL_64_after_hwframe+0x61/0xd6 other info that might help us debug this: Chain exists of: console_owner --> &(&port->lock)->rlock --> kmemleak_lock Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- mm/kmemleak.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/mm/kmemleak.c b/mm/kmemleak.c index f54734abf946..5c90c54529a7 100644 --- a/mm/kmemleak.c +++ b/mm/kmemleak.c @@ -423,9 +423,16 @@ static struct kmemleak_object *lookup_object(unsigned long ptr, int alias) else if (object->pointer == ptr || alias) return object; else { + /* + * Printk deferring due to the kmemleak_lock held. + * This is done to avoid deadlock. + */ + printk_safe_enter(); kmemleak_warn("Found object by alias at 0x%08lx\n", ptr); dump_object_info(object); + printk_safe_exit(); + break; } } -- 2.25.1

2 1