- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] sched/fair: scale wake_wide() threshold by SMT width
by Zhang Qiao 07 Apr '26

07 Apr '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8882 -------------------------------- wake_wide() uses sd_llc_size as the spreading threshold to detect wide waker/wakee relationships and to disable wake_affine() for those cases. On SMT systems, sd_llc_size counts logical CPUs rather than physical cores. This inflates the wake_wide() threshold, allowing wake_affine() to pack more tasks into one LLC domain than the actual compute capacity of its physical cores can sustain. The resulting SMT interference may cost more than the cache-locality benefit wake_affine() intends to gain. Scale the factor by the SMT width of the current CPU so that it approximates the number of independent physical cores in the LLC domain, making wake_wide() more likely to kick in before SMT interference becomes significant. On non-SMT systems the SMT width is 1 and behaviour is unchanged. Fixes: 63b0e9edceec ("sched/fair: Beef up wake_wide()") Signed-off-by: Zhang Qiao <zhangqiao22(a)huawei.com> --- kernel/sched/fair.c | 5 +++++ kernel/sched/features.h | 2 ++ 2 files changed, 7 insertions(+) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index ad30bb800961..4100998e18cd 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -7850,6 +7850,11 @@ static int wake_wide(struct task_struct *p) unsigned int slave = p->wakee_flips; int factor = __this_cpu_read(sd_llc_size); + /* Scale factor to physical-core count to account for SMT interference. */ + if (sched_feat(WA_SMT)) + factor = DIV_ROUND_UP(factor, + cpumask_weight(cpu_smt_mask(smp_processor_id()))); + if (master < slave) swap(master, slave); if (slave < factor || master < slave * factor) diff --git a/kernel/sched/features.h b/kernel/sched/features.h index 24a0c853a8a0..c9ad8e72ecd0 100644 --- a/kernel/sched/features.h +++ b/kernel/sched/features.h @@ -128,3 +128,5 @@ SCHED_FEAT(SOFT_DOMAIN, false) #ifdef CONFIG_SCHED_SOFT_QUOTA SCHED_FEAT(SOFT_QUOTA, false) #endif + +SCHED_FEAT(WA_SMT, false) -- 2.18.0

2 1

[PATCH OLK-6.6 0/2] Fix riscv check-build warning
by Tengda Wu 07 Apr '26

07 Apr '26

Fix riscv check-build warning. Björn Töpel (1): riscv: Replace function-like macro by static inline function Tengda Wu (1): Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" arch/riscv/include/asm/cacheflush.h | 15 ++++++++++----- arch/riscv/kernel/stacktrace.c | 16 ---------------- 2 files changed, 10 insertions(+), 21 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10 0/3] Xen privcmd driver: restrict to target domain at boot when not in dom0 to fix secure boot issue
by Zhang Yuwei 07 Apr '26

07 Apr '26

Patch 1: Restrict the privcmd driver in unprivileged domU to only allow hypercalls targeting a specific domain obtained from Xenstore, preventing secure boot bypass. Patch 2: Unregister the xenstore notifier on module exit to clean up resources added by patch 1. Patch 3: Add an unrestricted boot parameter to optionally allow all hypercalls when secure boot is not active, guarded by a new lockdown reason. GuoHan Zhao (1): xen/privcmd: unregister xenstore notifier on module exit Juergen Gross (2): xen/privcmd: restrict usage in unprivileged domU xen/privcmd: add boot control for restricted usage in domU drivers/xen/privcmd.c | 78 +++++++++++++++++++++++++++++++++++++--- include/linux/security.h | 1 + security/security.c | 1 + 3 files changed, 75 insertions(+), 5 deletions(-) -- 2.22.0

2 4

[PATCH OLK-6.6 0/3] Xen privcmd driver: restrict to target domain at boot when not in dom0 to fix secure boot issue
by Zhang Yuwei 07 Apr '26

07 Apr '26

Patch 1: Restrict the privcmd driver in unprivileged domU to only allow hypercalls targeting a specific domain obtained from Xenstore, preventing secure boot bypass. Patch 2: Unregister the xenstore notifier on module exit to clean up resources added by patch 1. Patch 3: Add an unrestricted boot parameter to optionally allow all hypercalls when secure boot is not active, guarded by a new lockdown reason. GuoHan Zhao (1): xen/privcmd: unregister xenstore notifier on module exit Juergen Gross (2): xen/privcmd: restrict usage in unprivileged domU xen/privcmd: add boot control for restricted usage in domU drivers/xen/privcmd.c | 78 +++++++++++++++++++++++++++++++++++++--- include/linux/security.h | 1 + security/security.c | 1 + 3 files changed, 75 insertions(+), 5 deletions(-) -- 2.22.0

2 4

[PATCH OLK-6.6] apparmor: replace recursive profile removal with iterative approach
by Cui GaoSheng 07 Apr '26

07 Apr '26

From: Massimiliano Pellizzer <massimiliano.pellizzer(a)canonical.com> stable inclusion from stable-v6.6.130 commit 33959a491e9fd557abfa5fce5ae4637d400915d3 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14038 CVE: CVE-2026-23404 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit ab09264660f9de5d05d1ef4e225aa447c63a8747 upstream. The profile removal code uses recursion when removing nested profiles, which can lead to kernel stack exhaustion and system crashes. Reproducer: $ pf='a'; for ((i=0; i<1024; i++)); do echo -e "profile $pf { \n }" | apparmor_parser -K -a; pf="$pf//x"; done $ echo -n a > /sys/kernel/security/apparmor/.remove Replace the recursive __aa_profile_list_release() approach with an iterative approach in __remove_profile(). The function repeatedly finds and removes leaf profiles until the entire subtree is removed, maintaining the same removal semantic without recursion. Fixes: c88d4c7b049e ("AppArmor: core policy routines") Reported-by: Qualys Security Advisory <qsa(a)qualys.com> Tested-by: Salvatore Bonaccorso <carnil(a)debian.org> Reviewed-by: Georgia Garcia <georgia.garcia(a)canonical.com> Reviewed-by: Cengiz Can <cengiz.can(a)canonical.com> Signed-off-by: Massimiliano Pellizzer <massimiliano.pellizzer(a)canonical.com> Signed-off-by: John Johansen <john.johansen(a)canonical.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Cui GaoSheng <cuigaosheng1(a)huawei.com> --- security/apparmor/policy.c | 30 +++++++++++++++++++++++++++--- 1 file changed, 27 insertions(+), 3 deletions(-) diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c index 83693b8d18d4..2cbe89e135fb 100644 --- a/security/apparmor/policy.c +++ b/security/apparmor/policy.c @@ -147,19 +147,43 @@ static void __list_remove_profile(struct aa_profile *profile) } /** - * __remove_profile - remove old profile, and children - * @profile: profile to be replaced (NOT NULL) + * __remove_profile - remove profile, and children + * @profile: profile to be removed (NOT NULL) * * Requires: namespace list lock be held, or list not be shared */ static void __remove_profile(struct aa_profile *profile) { + struct aa_profile *curr, *to_remove; + AA_BUG(!profile); AA_BUG(!profile->ns); AA_BUG(!mutex_is_locked(&profile->ns->lock)); /* release any children lists first */ - __aa_profile_list_release(&profile->base.profiles); + if (!list_empty(&profile->base.profiles)) { + curr = list_first_entry(&profile->base.profiles, struct aa_profile, base.list); + + while (curr != profile) { + + while (!list_empty(&curr->base.profiles)) + curr = list_first_entry(&curr->base.profiles, + struct aa_profile, base.list); + + to_remove = curr; + if (!list_is_last(&to_remove->base.list, + &aa_deref_parent(curr)->base.profiles)) + curr = list_next_entry(to_remove, base.list); + else + curr = aa_deref_parent(curr); + + /* released by free_profile */ + aa_label_remove(&to_remove->label); + __aafs_profile_rmdir(to_remove); + __list_remove_profile(to_remove); + } + } + /* released by free_profile */ aa_label_remove(&profile->label); __aafs_profile_rmdir(profile); -- 2.34.1

2 1

[PATCH OLK-6.6] apparmor: fix: limit the number of levels of policy namespaces
by Cui GaoSheng 07 Apr '26

07 Apr '26

From: John Johansen <john.johansen(a)canonical.com> stable inclusion from stable-v6.6.130 commit 3f8699b3ee0c04b4b9bc27b82cd89a40e81e1d2e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14047 CVE: CVE-2026-23405 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 306039414932c80f8420695a24d4fe10c84ccfb2 upstream. Currently the number of policy namespaces is not bounded relying on the user namespace limit. However policy namespaces aren't strictly tied to user namespaces and it is possible to create them and nest them arbitrarily deep which can be used to exhaust system resource. Hard cap policy namespaces to the same depth as user namespaces. Fixes: c88d4c7b049e8 ("AppArmor: core policy routines") Reported-by: Qualys Security Advisory <qsa(a)qualys.com> Reviewed-by: Ryan Lee <ryan.lee(a)canonical.com> Reviewed-by: Cengiz Can <cengiz.can(a)canonical.com> Signed-off-by: John Johansen <john.johansen(a)canonical.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Cui GaoSheng <cuigaosheng1(a)huawei.com> --- security/apparmor/include/policy_ns.h | 2 ++ security/apparmor/policy_ns.c | 2 ++ 2 files changed, 4 insertions(+) diff --git a/security/apparmor/include/policy_ns.h b/security/apparmor/include/policy_ns.h index 33d665516fc1..dabb69bc87e0 100644 --- a/security/apparmor/include/policy_ns.h +++ b/security/apparmor/include/policy_ns.h @@ -18,6 +18,8 @@ #include "label.h" #include "policy.h" +/* Match max depth of user namespaces */ +#define MAX_NS_DEPTH 32 /* struct aa_ns_acct - accounting of profiles in namespace * @max_size: maximum space allowed for all profiles in namespace diff --git a/security/apparmor/policy_ns.c b/security/apparmor/policy_ns.c index fd5b7afbcb48..c56ef36baef4 100644 --- a/security/apparmor/policy_ns.c +++ b/security/apparmor/policy_ns.c @@ -260,6 +260,8 @@ static struct aa_ns *__aa_create_ns(struct aa_ns *parent, const char *name, AA_BUG(!name); AA_BUG(!mutex_is_locked(&parent->lock)); + if (parent->level > MAX_NS_DEPTH) + return ERR_PTR(-ENOSPC); ns = alloc_ns(parent->base.hname, name); if (!ns) return ERR_PTR(-ENOMEM); -- 2.34.1

2 1

[PATCH OLK-5.10] apparmor: fix: limit the number of levels of policy namespaces
by Cui GaoSheng 07 Apr '26

07 Apr '26

From: John Johansen <john.johansen(a)canonical.com> stable inclusion from stable-v6.6.130 commit 3f8699b3ee0c04b4b9bc27b82cd89a40e81e1d2e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14047 CVE: CVE-2026-23405 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 306039414932c80f8420695a24d4fe10c84ccfb2 upstream. Currently the number of policy namespaces is not bounded relying on the user namespace limit. However policy namespaces aren't strictly tied to user namespaces and it is possible to create them and nest them arbitrarily deep which can be used to exhaust system resource. Hard cap policy namespaces to the same depth as user namespaces. Fixes: c88d4c7b049e8 ("AppArmor: core policy routines") Reported-by: Qualys Security Advisory <qsa(a)qualys.com> Reviewed-by: Ryan Lee <ryan.lee(a)canonical.com> Reviewed-by: Cengiz Can <cengiz.can(a)canonical.com> Signed-off-by: John Johansen <john.johansen(a)canonical.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Cui GaoSheng <cuigaosheng1(a)huawei.com> --- security/apparmor/include/policy_ns.h | 2 ++ security/apparmor/policy_ns.c | 2 ++ 2 files changed, 4 insertions(+) diff --git a/security/apparmor/include/policy_ns.h b/security/apparmor/include/policy_ns.h index 3df6f804922d..e5704947e86e 100644 --- a/security/apparmor/include/policy_ns.h +++ b/security/apparmor/include/policy_ns.h @@ -18,6 +18,8 @@ #include "label.h" #include "policy.h" +/* Match max depth of user namespaces */ +#define MAX_NS_DEPTH 32 /* struct aa_ns_acct - accounting of profiles in namespace * @max_size: maximum space allowed for all profiles in namespace diff --git a/security/apparmor/policy_ns.c b/security/apparmor/policy_ns.c index 53d24cf63893..5d342ef078e9 100644 --- a/security/apparmor/policy_ns.c +++ b/security/apparmor/policy_ns.c @@ -249,6 +249,8 @@ static struct aa_ns *__aa_create_ns(struct aa_ns *parent, const char *name, AA_BUG(!name); AA_BUG(!mutex_is_locked(&parent->lock)); + if (parent->level > MAX_NS_DEPTH) + return ERR_PTR(-ENOSPC); ns = alloc_ns(parent->base.hname, name); if (!ns) return ERR_PTR(-ENOMEM); -- 2.34.1

2 1

[PATCH OLK-5.10] apparmor: replace recursive profile removal with iterative approach
by Cui GaoSheng 07 Apr '26

07 Apr '26

From: Massimiliano Pellizzer <massimiliano.pellizzer(a)canonical.com> stable inclusion from stable-v6.6.130 commit 33959a491e9fd557abfa5fce5ae4637d400915d3 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14038 CVE: CVE-2026-23404 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit ab09264660f9de5d05d1ef4e225aa447c63a8747 upstream. The profile removal code uses recursion when removing nested profiles, which can lead to kernel stack exhaustion and system crashes. Reproducer: $ pf='a'; for ((i=0; i<1024; i++)); do echo -e "profile $pf { \n }" | apparmor_parser -K -a; pf="$pf//x"; done $ echo -n a > /sys/kernel/security/apparmor/.remove Replace the recursive __aa_profile_list_release() approach with an iterative approach in __remove_profile(). The function repeatedly finds and removes leaf profiles until the entire subtree is removed, maintaining the same removal semantic without recursion. Fixes: c88d4c7b049e ("AppArmor: core policy routines") Reported-by: Qualys Security Advisory <qsa(a)qualys.com> Tested-by: Salvatore Bonaccorso <carnil(a)debian.org> Reviewed-by: Georgia Garcia <georgia.garcia(a)canonical.com> Reviewed-by: Cengiz Can <cengiz.can(a)canonical.com> Signed-off-by: Massimiliano Pellizzer <massimiliano.pellizzer(a)canonical.com> Signed-off-by: John Johansen <john.johansen(a)canonical.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Cui GaoSheng <cuigaosheng1(a)huawei.com> --- security/apparmor/policy.c | 30 +++++++++++++++++++++++++++--- 1 file changed, 27 insertions(+), 3 deletions(-) diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c index e5f501f89803..57be581980b3 100644 --- a/security/apparmor/policy.c +++ b/security/apparmor/policy.c @@ -146,19 +146,43 @@ static void __list_remove_profile(struct aa_profile *profile) } /** - * __remove_profile - remove old profile, and children - * @profile: profile to be replaced (NOT NULL) + * __remove_profile - remove profile, and children + * @profile: profile to be removed (NOT NULL) * * Requires: namespace list lock be held, or list not be shared */ static void __remove_profile(struct aa_profile *profile) { + struct aa_profile *curr, *to_remove; + AA_BUG(!profile); AA_BUG(!profile->ns); AA_BUG(!mutex_is_locked(&profile->ns->lock)); /* release any children lists first */ - __aa_profile_list_release(&profile->base.profiles); + if (!list_empty(&profile->base.profiles)) { + curr = list_first_entry(&profile->base.profiles, struct aa_profile, base.list); + + while (curr != profile) { + + while (!list_empty(&curr->base.profiles)) + curr = list_first_entry(&curr->base.profiles, + struct aa_profile, base.list); + + to_remove = curr; + if (!list_is_last(&to_remove->base.list, + &aa_deref_parent(curr)->base.profiles)) + curr = list_next_entry(to_remove, base.list); + else + curr = aa_deref_parent(curr); + + /* released by free_profile */ + aa_label_remove(&to_remove->label); + __aafs_profile_rmdir(to_remove); + __list_remove_profile(to_remove); + } + } + /* released by free_profile */ aa_label_remove(&profile->label); __aafs_profile_rmdir(profile); -- 2.34.1

2 1

[PATCH OLK-6.6 v6 0/2] kvm: arm64: Transition from CPU Type to MIDR Register for Virtualization Feature Detection
by liqiqi 07 Apr '26

07 Apr '26

Currently, there are two methods for determining whether a chip supports specific virtualization features: 1. Reading the chip's CPU type from BIOS 2. Reading the value of the MIDR register The issue with the first method is that each time a new chip is introduced, the new CPU type must be defined, which leads to poor code portability and maintainability. Therefore, the second method has been adopted to replace the first. This approach eliminates the dependency on CPU type by using the MIDR register. liqiqi (2): kvm: arm64: Add MIDR definitions and use MIDR to determine whether features are supported kvm: arm64: Remove cpu_type definition and it's related interfaces arch/arm64/include/asm/cache.h | 2 +- arch/arm64/include/asm/cputype.h | 8 +- arch/arm64/kernel/cpu_errata.c | 4 +- arch/arm64/kernel/cpufeature.c | 2 +- arch/arm64/kernel/proton-pack.c | 4 +- arch/arm64/kvm/arm.c | 1 - arch/arm64/kvm/hisilicon/hisi_virt.c | 110 +++-------------------- arch/arm64/kvm/hisilicon/hisi_virt.h | 12 --- drivers/perf/hisilicon/hisi_uncore_pmu.c | 2 +- tools/arch/arm64/include/asm/cputype.h | 4 +- 10 files changed, 25 insertions(+), 124 deletions(-) -- 2.43.0

2 3

[PATCH OLK-6.6] nf_tables: nft_dynset: fix possible stateful expression memleak in error path
by Dong Chenchen 07 Apr '26

07 Apr '26

From: Pablo Neira Ayuso <pablo(a)netfilter.org> mainline inclusion from mainline-v7.0-rc3 commit 0548a13b5a145b16e4da0628b5936baf35f51b43 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14034 CVE: CVE-2026-23399 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If cloning the second stateful expression in the element via GFP_ATOMIC fails, then the first stateful expression remains in place without being released. unreferenced object (percpu) 0x607b97e9cab8 (size 16): comm "softirq", pid 0, jiffies 4294931867 hex dump (first 16 bytes on cpu 3): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 backtrace (crc 0): pcpu_alloc_noprof+0x453/0xd80 nft_counter_clone+0x9c/0x190 [nf_tables] nft_expr_clone+0x8f/0x1b0 [nf_tables] nft_dynset_new+0x2cb/0x5f0 [nf_tables] nft_rhash_update+0x236/0x11c0 [nf_tables] nft_dynset_eval+0x11f/0x670 [nf_tables] nft_do_chain+0x253/0x1700 [nf_tables] nft_do_chain_ipv4+0x18d/0x270 [nf_tables] nf_hook_slow+0xaa/0x1e0 ip_local_deliver+0x209/0x330 Fixes: 563125a73ac3 ("netfilter: nftables: generalize set extension to support for several expressions") Reported-by: Gurpreet Shergill <giki.shergill(a)proton.me> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Florian Westphal <fw(a)strlen.de> Conflicts: include/net/netfilter/nf_tables.h net/netfilter/nft_dynset.c [commit 9dad402b89e8 is not backport] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- include/net/netfilter/nf_tables.h | 2 ++ net/netfilter/nf_tables_api.c | 4 ++-- net/netfilter/nft_dynset.c | 10 +++++++++- 3 files changed, 13 insertions(+), 3 deletions(-) diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h index e1c4d903f39b..0f890ff1769b 100644 --- a/include/net/netfilter/nf_tables.h +++ b/include/net/netfilter/nf_tables.h @@ -859,6 +859,8 @@ void *nft_set_elem_init(const struct nft_set *set, u64 timeout, u64 expiration, gfp_t gfp); int nft_set_elem_expr_clone(const struct nft_ctx *ctx, struct nft_set *set, struct nft_expr *expr_array[]); +void nft_set_elem_expr_destroy(const struct nft_ctx *ctx, + struct nft_set_elem_expr *elem_expr); void nft_set_elem_destroy(const struct nft_set *set, void *elem, bool destroy_expr); void nf_tables_set_elem_destroy(const struct nft_ctx *ctx, diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 98d3156179ee..9d5f7bafa4d6 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -6471,8 +6471,8 @@ static void __nft_set_elem_expr_destroy(const struct nft_ctx *ctx, } } -static void nft_set_elem_expr_destroy(const struct nft_ctx *ctx, - struct nft_set_elem_expr *elem_expr) +void nft_set_elem_expr_destroy(const struct nft_ctx *ctx, + struct nft_set_elem_expr *elem_expr) { struct nft_expr *expr; u32 size; diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c index a81bd69b059b..8ea45d61ed88 100644 --- a/net/netfilter/nft_dynset.c +++ b/net/netfilter/nft_dynset.c @@ -30,18 +30,26 @@ static int nft_dynset_expr_setup(const struct nft_dynset *priv, const struct nft_set_ext *ext) { struct nft_set_elem_expr *elem_expr = nft_set_ext_expr(ext); + struct nft_ctx ctx = { + .net = read_pnet(&priv->set->net), + .family = priv->set->table->family, + }; struct nft_expr *expr; int i; for (i = 0; i < priv->num_exprs; i++) { expr = nft_setelem_expr_at(elem_expr, elem_expr->size); if (nft_expr_clone(expr, priv->expr_array[i], GFP_ATOMIC) < 0) - return -1; + goto err_out; elem_expr->size += priv->expr_array[i]->ops->size; } return 0; +err_out: + nft_set_elem_expr_destroy(&ctx, elem_expr); + + return -1; } static void *nft_dynset_new(struct nft_set *set, const struct nft_expr *expr, -- 2.25.1

2 1