September 2025 - Kernel - mailweb.openeuler.org

[openeuler:openEuler-1.0-LTS 1740/1740] mm/mem_reliable.c:272:5: sparse: sparse: symbol 'reliable_debug_handler' was not declared. Should it be static?
by kernel test robot 02 Sep '25

02 Sep '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 54968bf23106d2ac31ede8dca013a7fadeb3dd75 commit: 851a3ff0b4de68403c9a344c3d5378aa590705b7 [1740/1740] mm: Introduce proc interface to control memory reliable features config: arm64-randconfig-r121-20250729 (https://download.01.org/0day-ci/archive/20250902/202509020104.GWuHy81V-lkp@…) compiler: aarch64-linux-gcc (GCC) 15.1.0 reproduce: (https://download.01.org/0day-ci/archive/20250902/202509020104.GWuHy81V-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202509020104.GWuHy81V-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) mm/mem_reliable.c:52:14: sparse: sparse: restricted gfp_t degrades to integer mm/mem_reliable.c:199:5: sparse: sparse: symbol 'reliable_limit_handler' was not declared. Should it be static? >> mm/mem_reliable.c:272:5: sparse: sparse: symbol 'reliable_debug_handler' was not declared. Should it be static? mm/mem_reliable.c:199:5: warning: no previous prototype for 'reliable_limit_handler' [-Wmissing-prototypes] 199 | int reliable_limit_handler(struct ctl_table *table, int write, | ^~~~~~~~~~~~~~~~~~~~~~ mm/mem_reliable.c:272:5: warning: no previous prototype for 'reliable_debug_handler' [-Wmissing-prototypes] 272 | int reliable_debug_handler(struct ctl_table *table, int write, | ^~~~~~~~~~~~~~~~~~~~~~ vim +/reliable_debug_handler +272 mm/mem_reliable.c 271 > 272 int reliable_debug_handler(struct ctl_table *table, int write, 273 void __user *buffer, size_t *length, loff_t *ppos) 274 { 275 unsigned long old_ctrl_bits, new_ctrl_bits; 276 static DEFINE_MUTEX(reliable_debug_mutex); 277 int ret; 278 279 mutex_lock(&reliable_debug_mutex); 280 old_ctrl_bits = mem_reliable_ctrl_bits; 281 ret = proc_doulongvec_minmax(table, write, buffer, length, ppos); 282 if (ret == 0 && write) { 283 if (mem_reliable_ctrl_bits > (1 << CTRL_BITS_SHIFT) - 1) { 284 mem_reliable_ctrl_bits = old_ctrl_bits; 285 mutex_unlock(&reliable_debug_mutex); 286 287 return -EINVAL; 288 } 289 290 new_ctrl_bits = mem_reliable_ctrl_bits; 291 mem_reliable_ctrl_bits = old_ctrl_bits; 292 if (!!test_bit(MEM_RELIABLE_ALL, &new_ctrl_bits)) 293 mem_reliable_parse_ctrl_bits(new_ctrl_bits); 294 else 295 mem_reliable_disable_all(); 296 } 297 298 mutex_unlock(&reliable_debug_mutex); 299 300 return ret; 301 } 302 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1740/1740] include/linux/mem_reliable.h:41:15: sparse: sparse: restricted gfp_t degrades to integer
by kernel test robot 01 Sep '25

01 Sep '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 291b31b5afcf0c223cd3305c734a298f3193f9d3 commit: 33d1f46ad98ea3a13752a6360d97732ab4e119b9 [1740/1740] mm: Introduce memory reliable config: arm64-randconfig-r121-20250729 (https://download.01.org/0day-ci/archive/20250901/202509012150.u8RYNbiq-lkp@…) compiler: aarch64-linux-gcc (GCC) 15.1.0 reproduce: (https://download.01.org/0day-ci/archive/20250901/202509012150.u8RYNbiq-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202509012150.u8RYNbiq-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) mm/page_alloc.c:140:1: sparse: sparse: symbol 'pcpu_drain_mutex' was not declared. Should it be static? mm/page_alloc.c: note: in included file (through include/linux/mm.h): >> include/linux/mem_reliable.h:41:15: sparse: sparse: restricted gfp_t degrades to integer mm/page_alloc.c:4572:13: sparse: sparse: restricted gfp_t degrades to integer mm/page_alloc.c:4573:27: sparse: sparse: invalid assignment: |= mm/page_alloc.c:4573:27: sparse: left side has type restricted gfp_t mm/page_alloc.c:4573:27: sparse: right side has type unsigned int mm/page_alloc.c: note: in included file (through include/linux/mm.h): include/linux/gfp.h:457:34: sparse: sparse: restricted gfp_t degrades to integer include/linux/gfp.h:324:27: sparse: sparse: restricted gfp_t degrades to integer include/linux/gfp.h:324:27: sparse: sparse: restricted gfp_t degrades to integer include/linux/gfp.h:457:34: sparse: sparse: restricted gfp_t degrades to integer include/linux/gfp.h:457:34: sparse: sparse: restricted gfp_t degrades to integer mm/page_alloc.c: In function 'mem_init_print_info': mm/page_alloc.c:7373:27: warning: comparison between two arrays [-Warray-compare] 7373 | if (start <= pos && pos < end && size > adj) 20- | ^~ mm/page_alloc.c:7377:9: note: in expansion of macro 'adj_init_size' 7377 | adj_init_size(__init_begin, __init_end, init_data_size, | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:27: note: use '&__init_begin[0] <= &_sinittext[0]' to compare the addresses 7373 | if (start <= pos && pos < end && size > adj) 26- | ^~ mm/page_alloc.c:7377:9: note: in expansion of macro 'adj_init_size' 7377 | adj_init_size(__init_begin, __init_end, init_data_size, | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:41: warning: comparison between two arrays [-Warray-compare] 7373 | if (start <= pos && pos < end && size > adj) 32- | ^ mm/page_alloc.c:7377:9: note: in expansion of macro 'adj_init_size' 7377 | adj_init_size(__init_begin, __init_end, init_data_size, | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:41: note: use '&_sinittext[0] < &__init_end[0]' to compare the addresses 7373 | if (start <= pos && pos < end && size > adj) 38- | ^ mm/page_alloc.c:7377:9: note: in expansion of macro 'adj_init_size' 7377 | adj_init_size(__init_begin, __init_end, init_data_size, | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:27: warning: comparison between two arrays [-Warray-compare] 7373 | if (start <= pos && pos < end && size > adj) 44- | ^~ mm/page_alloc.c:7379:9: note: in expansion of macro 'adj_init_size' 7379 | adj_init_size(_stext, _etext, codesize, _sinittext, init_code_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:27: note: use '&_stext[0] <= &_sinittext[0]' to compare the addresses 7373 | if (start <= pos && pos < end && size > adj) 50- | ^~ mm/page_alloc.c:7379:9: note: in expansion of macro 'adj_init_size' 7379 | adj_init_size(_stext, _etext, codesize, _sinittext, init_code_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:41: warning: comparison between two arrays [-Warray-compare] 7373 | if (start <= pos && pos < end && size > adj) 56- | ^ mm/page_alloc.c:7379:9: note: in expansion of macro 'adj_init_size' 7379 | adj_init_size(_stext, _etext, codesize, _sinittext, init_code_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:41: note: use '&_sinittext[0] < &_etext[0]' to compare the addresses 7373 | if (start <= pos && pos < end && size > adj) 62- | ^ mm/page_alloc.c:7379:9: note: in expansion of macro 'adj_init_size' 7379 | adj_init_size(_stext, _etext, codesize, _sinittext, init_code_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:27: warning: comparison between two arrays [-Warray-compare] 7373 | if (start <= pos && pos < end && size > adj) 68- | ^~ mm/page_alloc.c:7380:9: note: in expansion of macro 'adj_init_size' 7380 | adj_init_size(_sdata, _edata, datasize, __init_begin, init_data_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:27: note: use '&_sdata[0] <= &__init_begin[0]' to compare the addresses 7373 | if (start <= pos && pos < end && size > adj) 74- | ^~ mm/page_alloc.c:7380:9: note: in expansion of macro 'adj_init_size' 7380 | adj_init_size(_sdata, _edata, datasize, __init_begin, init_data_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:41: warning: comparison between two arrays [-Warray-compare] 7373 | if (start <= pos && pos < end && size > adj) 80- | ^ mm/page_alloc.c:7380:9: note: in expansion of macro 'adj_init_size' 7380 | adj_init_size(_sdata, _edata, datasize, __init_begin, init_data_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:41: note: use '&__init_begin[0] < &_edata[0]' to compare the addresses 7373 | if (start <= pos && pos < end && size > adj) 86- | ^ mm/page_alloc.c:7380:9: note: in expansion of macro 'adj_init_size' 7380 | adj_init_size(_sdata, _edata, datasize, __init_begin, init_data_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:27: warning: comparison between two arrays [-Warray-compare] 7373 | if (start <= pos && pos < end && size > adj) 92- | ^~ mm/page_alloc.c:7381:9: note: in expansion of macro 'adj_init_size' 7381 | adj_init_size(_stext, _etext, codesize, __start_rodata, rosize); | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:27: note: use '&_stext[0] <= &__start_rodata[0]' to compare the addresses 7373 | if (start <= pos && pos < end && size > adj) 98- | ^~ mm/page_alloc.c:7381:9: note: in expansion of macro 'adj_init_size' 7381 | adj_init_size(_stext, _etext, codesize, __start_rodata, rosize); | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:41: warning: comparison between two arrays [-Warray-compare] 7373 | if (start <= pos && pos < end && size > adj) 104- | ^ mm/page_alloc.c:7381:9: note: in expansion of macro 'adj_init_size' 7381 | adj_init_size(_stext, _etext, codesize, __start_rodata, rosize); vim +41 include/linux/mem_reliable.h 31 32 static inline bool skip_none_movable_zone(gfp_t gfp, struct zoneref *z) 33 { 34 if (!mem_reliable_is_enabled()) 35 return false; 36 37 if (!current->mm || (current->flags & PF_KTHREAD)) 38 return false; 39 40 /* user tasks can only alloc memory from non-mirrored region */ > 41 if (!(gfp & ___GFP_RELIABILITY) && (gfp & __GFP_HIGHMEM) && 42 (gfp & __GFP_MOVABLE)) { 43 if (zonelist_zone_idx(z) < ZONE_MOVABLE) 44 return true; 45 } 46 47 return false; 48 } 49 #else 50 #define reliable_enabled 0 51 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] xfrm: interface: fix use-after-free after changing collect_md xfrm interface
by Zhang Changzhong 01 Sep '25

01 Sep '25

From: Eyal Birger <eyal.birger(a)gmail.com> stable inclusion from stable-v6.6.101 commit bfebdb85496e1da21d3cf05de099210915c3e706 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICT8XQ CVE: CVE-2025-38500 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a90b2a1aaacbcf0f91d7e4868ad6c51c5dee814b ] collect_md property on xfrm interfaces can only be set on device creation, thus xfrmi_changelink() should fail when called on such interfaces. The check to enforce this was done only in the case where the xi was returned from xfrmi_locate() which doesn't look for the collect_md interface, and thus the validation was never reached. Calling changelink would thus errornously place the special interface xi in the xfrmi_net->xfrmi hash, but since it also exists in the xfrmi_net->collect_md_xfrmi pointer it would lead to a double free when the net namespace was taken down [1]. Change the check to use the xi from netdev_priv which is available earlier in the function to prevent changes in xfrm collect_md interfaces. [1] resulting oops: [ 8.516540] kernel BUG at net/core/dev.c:12029! [ 8.516552] Oops: invalid opcode: 0000 [#1] SMP NOPTI [ 8.516559] CPU: 0 UID: 0 PID: 12 Comm: kworker/u80:0 Not tainted 6.15.0-virtme #5 PREEMPT(voluntary) [ 8.516565] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 8.516569] Workqueue: netns cleanup_net [ 8.516579] RIP: 0010:unregister_netdevice_many_notify+0x101/0xab0 [ 8.516590] Code: 90 0f 0b 90 48 8b b0 78 01 00 00 48 8b 90 80 01 00 00 48 89 56 08 48 89 32 4c 89 80 78 01 00 00 48 89 b8 80 01 00 00 eb ac 90 <0f> 0b 48 8b 45 00 4c 8d a0 88 fe ff ff 48 39 c5 74 5c 41 80 bc 24 [ 8.516593] RSP: 0018:ffffa93b8006bd30 EFLAGS: 00010206 [ 8.516598] RAX: ffff98fe4226e000 RBX: ffffa93b8006bd58 RCX: ffffa93b8006bc60 [ 8.516601] RDX: 0000000000000004 RSI: 0000000000000000 RDI: dead000000000122 [ 8.516603] RBP: ffffa93b8006bdd8 R08: dead000000000100 R09: ffff98fe4133c100 [ 8.516605] R10: 0000000000000000 R11: 00000000000003d2 R12: ffffa93b8006be00 [ 8.516608] R13: ffffffff96c1a510 R14: ffffffff96c1a510 R15: ffffa93b8006be00 [ 8.516615] FS: 0000000000000000(0000) GS:ffff98fee73b7000(0000) knlGS:0000000000000000 [ 8.516619] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 8.516622] CR2: 00007fcd2abd0700 CR3: 000000003aa40000 CR4: 0000000000752ef0 [ 8.516625] PKRU: 55555554 [ 8.516627] Call Trace: [ 8.516632] <TASK> [ 8.516635] ? rtnl_is_locked+0x15/0x20 [ 8.516641] ? unregister_netdevice_queue+0x29/0xf0 [ 8.516650] ops_undo_list+0x1f2/0x220 [ 8.516659] cleanup_net+0x1ad/0x2e0 [ 8.516664] process_one_work+0x160/0x380 [ 8.516673] worker_thread+0x2aa/0x3c0 [ 8.516679] ? __pfx_worker_thread+0x10/0x10 [ 8.516686] kthread+0xfb/0x200 [ 8.516690] ? __pfx_kthread+0x10/0x10 [ 8.516693] ? __pfx_kthread+0x10/0x10 [ 8.516697] ret_from_fork+0x82/0xf0 [ 8.516705] ? __pfx_kthread+0x10/0x10 [ 8.516709] ret_from_fork_asm+0x1a/0x30 [ 8.516718] </TASK> Fixes: abc340b38ba2 ("xfrm: interface: support collect metadata mode") Reported-by: Lonial Con <kongln9170(a)gmail.com> Signed-off-by: Eyal Birger <eyal.birger(a)gmail.com> Signed-off-by: Steffen Klassert <steffen.klassert(a)secunet.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/xfrm/xfrm_interface_core.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/net/xfrm/xfrm_interface_core.c b/net/xfrm/xfrm_interface_core.c index 21d50d7..84f0781 100644 --- a/net/xfrm/xfrm_interface_core.c +++ b/net/xfrm/xfrm_interface_core.c @@ -880,7 +880,7 @@ static int xfrmi_changelink(struct net_device *dev, struct nlattr *tb[], return -EINVAL; } - if (p.collect_md) { + if (p.collect_md || xi->p.collect_md) { NL_SET_ERR_MSG(extack, "collect_md can't be changed"); return -EINVAL; } @@ -891,11 +891,6 @@ static int xfrmi_changelink(struct net_device *dev, struct nlattr *tb[], } else { if (xi->dev != dev) return -EEXIST; - if (xi->p.collect_md) { - NL_SET_ERR_MSG(extack, - "device can't be changed to collect_md"); - return -EINVAL; - } } return xfrmi_update(xi, &p); -- 2.9.5

2 1

[PATCH OLK-6.6 0/2] CVE-2025-37752
by Zhang Changzhong 01 Sep '25

01 Sep '25

Octavian Purdila (2): net_sched: sch_sfq: use a temporary work area for validating configuration net_sched: sch_sfq: move the limit validation net/sched/sch_sfq.c | 66 ++++++++++++++++++++++++++++++++++++++++------------- 1 file changed, 50 insertions(+), 16 deletions(-) -- 2.9.5

2 3

[PATCH openEuler-1.0-LTS] NFSv4: Fail mounts if the lease setup times out
by Li Lingfeng 01 Sep '25

01 Sep '25

From: Trond Myklebust <trond.myklebust(a)hammerspace.com> mainline inclusion from mainline-v6.12-rc1 commit af94dca79b1296a6db7b8b47cd43be8e94fce8bb category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICMK5J Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If the server is down when the client is trying to mount, so that the calls to exchange_id or create_session fail, then we should allow the mount system call to fail rather than hang and block other mount/umount calls. Reported-by: Oleksandr Tymoshenko <ovt(a)google.com> Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Signed-off-by: Anna Schumaker <anna.schumaker(a)oracle.com> Conflicts: fs/nfs/nfs4state.c [Commit 67e7b52d44e3 ("NFSv4: Ensure state recovery handles ETIMEDOUT correctly") removed -ETIMEDOUT from nfs4_handle_reclaim_lease_error.] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfs/nfs4state.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c index 4a06e5ae0cba..5411847cb820 100644 --- a/fs/nfs/nfs4state.c +++ b/fs/nfs/nfs4state.c @@ -1955,9 +1955,13 @@ static int nfs4_handle_reclaim_lease_error(struct nfs_client *clp, int status) nfs_mark_client_ready(clp, -EPERM); clear_bit(NFS4CLNT_LEASE_CONFIRM, &clp->cl_state); return -EPERM; + case -ETIMEDOUT: + if (clp->cl_cons_state == NFS_CS_SESSION_INITING) { + nfs_mark_client_ready(clp, -EIO); + return -EIO; + } case -EACCES: case -NFS4ERR_DELAY: - case -ETIMEDOUT: case -EAGAIN: ssleep(1); break; -- 2.31.1

2 1

[PATCH OLK-6.6] fs/resctrl: Fix max_threshold_occupancy write operation
by Zeng Heng 01 Sep '25

01 Sep '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICVT69 -------------------------------- Since L2_MON does not support the limbo mechanism, the max_threshold_occupancy interface does not allow updates. If a write operation is attempted, skip it simply and return nbytes. Fixes: da5038956e65 ("fs/resctrl: L2_MON does not support the limbo mechanism") Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- fs/resctrl/rdtgroup.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/resctrl/rdtgroup.c b/fs/resctrl/rdtgroup.c index 86567d32e4df..4e0b2dfaa436 100644 --- a/fs/resctrl/rdtgroup.c +++ b/fs/resctrl/rdtgroup.c @@ -1336,7 +1336,7 @@ static ssize_t max_threshold_occ_write(struct kernfs_open_file *of, int ret; if (r->cache_level != 3) - return 0; + goto out; ret = kstrtouint(buf, 0, &bytes); if (ret) @@ -1347,6 +1347,7 @@ static ssize_t max_threshold_occ_write(struct kernfs_open_file *of, resctrl_rmid_realloc_threshold = resctrl_arch_round_mon_val(bytes); +out: return nbytes; } -- 2.25.1

2 1

[PATCH OLK-6.6] arm64/mpam: Fix num_rmids when enable CDP mode
by Zeng Heng 01 Sep '25

01 Sep '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICVT5V -------------------------------- At initialization, the number of RMIDs is set to num_of_PARTID * num_of_PMG. When resctrl is later mounted in CDP mode, however, the RMID count should be halved, just like the CLOSID count. Because CDP mode is activated during the mount operation, update the num_of_RMID in rdt_enable_ctx(). Fixes: ae6bcabac715 ("arm64/mpam: Fix num_rmids information") Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/platform/mpam/mpam_resctrl.c | 8 +++++++- include/linux/arm_mpam.h | 2 +- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/platform/mpam/mpam_resctrl.c b/drivers/platform/mpam/mpam_resctrl.c index c4049cbfe8eb..bb350d672836 100644 --- a/drivers/platform/mpam/mpam_resctrl.c +++ b/drivers/platform/mpam/mpam_resctrl.c @@ -101,11 +101,17 @@ bool resctrl_arch_get_cdp_enabled(enum resctrl_res_level rid) } } -int resctrl_arch_set_cdp_enabled(enum resctrl_res_level ignored, bool enable) +int resctrl_arch_set_cdp_enabled(enum resctrl_res_level rid, bool enable) { u64 regval; + struct rdt_resource *r; u32 partid, partid_i, partid_d; + r = resctrl_arch_get_resource(rid); + r->num_rmid = resctrl_arch_system_num_rmid_idx(); + if (enable) + r->num_rmid >>= 1; + cdp_enabled = enable; partid = RESCTRL_RESERVED_CLOSID; diff --git a/include/linux/arm_mpam.h b/include/linux/arm_mpam.h index 3a06a8afad7c..0c14f62a0e8f 100644 --- a/include/linux/arm_mpam.h +++ b/include/linux/arm_mpam.h @@ -74,7 +74,7 @@ bool resctrl_arch_would_mbm_overflow(void); void resctrl_arch_reset_resources(void); bool resctrl_arch_get_cdp_enabled(enum resctrl_res_level ignored); -int resctrl_arch_set_cdp_enabled(enum resctrl_res_level ignored, bool enable); +int resctrl_arch_set_cdp_enabled(enum resctrl_res_level rid, bool enable); bool resctrl_arch_hide_cdp(enum resctrl_res_level rid); bool resctrl_arch_match_closid(struct task_struct *tsk, u32 closid); bool resctrl_arch_match_rmid(struct task_struct *tsk, u32 closid, u32 rmid); -- 2.25.1

2 1

[PATCH OLK-6.6] mm/hugetlb: fix set_max_huge_pages() when there are surplus pages
by Jinjiang Tu 01 Sep '25

01 Sep '25

mainline inclusion from mainline-v6.15-rc3 commit aabf58bfaacedb3f54801ba09c6d50daf83b74f4 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICVOMX Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In set_max_huge_pages(), min_count is computed taking into account surplus huge pages, which might lead in some cases to not be able to free huge pages and end up accounting them as surplus instead. One way to solve it is to subtract surplus_huge_pages directly, but we cannot do it blindly because there might be surplus pages that are also free pages, which might happen when we fail to restore the vmemmap for optimized hvo pages. So we could be subtracting the same page twice. In order to work this around, let us first compute the number of free persistent pages, and use that along with surplus pages to compute min_count. Steps to reproduce: 1) create 5 hugetlb folios in Node0 2) run a program to use all the hugetlb folios 3) echo 0 > nr_hugepages for Node0 to free the hugetlb folios. Thus the 5 hugetlb folios in Node0 are accounted as surplus. 4) create 5 hugetlb folios in Node1 5) echo 0 > nr_hugepages for Node1 to free the hugetlb folios The result: Node0 Node1 Total 5 5 Free 0 5 Surp 5 5 The result with this patch: Node0 Node1 Total 5 0 Free 0 0 Surp 5 0 Link: https://lkml.kernel.org/r/20250409055957.3774471-1-tujinjiang@huawei.com Link: https://lkml.kernel.org/r/20250407124706.2688092-1-tujinjiang@huawei.com Fixes: 9a30523066cd ("hugetlb: add per node hstate attributes") Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> Acked-by: Oscar Salvador <osalvador(a)suse.de> Cc: David Hildenbrand <david(a)redhat.com> Cc: Kefeng Wang <wangkefeng.wang(a)huawei.com> Cc: Muchun Song <muchun.song(a)linux.dev> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: mm/hugetlb.c [Context conflicts.] Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- mm/hugetlb.c | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index 090da344e4b7..bad0dcf0faeb 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -3727,6 +3727,7 @@ static int adjust_pool_surplus(struct hstate *h, nodemask_t *nodes_allowed, static int set_max_huge_pages(struct hstate *h, unsigned long count, int nid, nodemask_t *nodes_allowed) { + unsigned long persistent_free_count; unsigned long min_count, ret; struct page *page; LIST_HEAD(page_list); @@ -3841,8 +3842,24 @@ static int set_max_huge_pages(struct hstate *h, unsigned long count, int nid, * though, we'll note that we're not allowed to exceed surplus * and won't grow the pool anywhere else. Not until one of the * sysctls are changed, or the surplus pages go out of use. + * + * min_count is the expected number of persistent pages, we + * shouldn't calculate min_count by using + * resv_huge_pages + persistent_huge_pages() - free_huge_pages, + * because there may exist free surplus huge pages, and this will + * lead to subtracting twice. Free surplus huge pages come from HVO + * failing to restore vmemmap, see comments in the callers of + * hugetlb_vmemmap_restore_folio(). Thus, we should calculate + * persistent free count first. */ - min_count = h->resv_huge_pages + h->nr_huge_pages - h->free_huge_pages; + persistent_free_count = h->free_huge_pages; + if (h->free_huge_pages > persistent_huge_pages(h)) { + if (h->free_huge_pages > h->surplus_huge_pages) + persistent_free_count -= h->surplus_huge_pages; + else + persistent_free_count = 0; + } + min_count = h->resv_huge_pages + persistent_huge_pages(h) - persistent_free_count; min_count = max(count, min_count); try_to_free_low(h, min_count, nodes_allowed); -- 2.43.0

2 1

[PATCH OLK-6.6 v2] perf/aux: Fix pending disable flow when the AUX ring buffer overruns
by Pu Lehui 01 Sep '25

01 Sep '25

From: Leo Yan <leo.yan(a)arm.com> mainline inclusion from mainline-v6.16-rc4 commit 1476b218327b89bbb64c14619a2d34f0c320f2c3 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICVQU8 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If an AUX event overruns, the event core layer intends to disable the event by setting the 'pending_disable' flag. Unfortunately, the event is not actually disabled afterwards. In commit: ca6c21327c6a ("perf: Fix missing SIGTRAPs") the 'pending_disable' flag was changed to a boolean. However, the AUX event code was not updated accordingly. The flag ends up holding a CPU number. If this number is zero, the flag is taken as false and the IRQ work is never triggered. Later, with commit: 2b84def990d3 ("perf: Split __perf_pending_irq() out of perf_pending_irq()") a new IRQ work 'pending_disable_irq' was introduced to handle event disabling. The AUX event path was not updated to kick off the work queue. To fix this bug, when an AUX ring buffer overrun is detected, call perf_event_disable_inatomic() to initiate the pending disable flow. Also update the outdated comment for setting the flag, to reflect the boolean values (0 or 1). Fixes: 2b84def990d3 ("perf: Split __perf_pending_irq() out of perf_pending_irq()") Fixes: ca6c21327c6a ("perf: Fix missing SIGTRAPs") Signed-off-by: Leo Yan <leo.yan(a)arm.com> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Reviewed-by: James Clark <james.clark(a)linaro.org> Reviewed-by: Yeoreum Yun <yeoreum.yun(a)arm.com> Cc: Adrian Hunter <adrian.hunter(a)intel.com> Cc: Alexander Shishkin <alexander.shishkin(a)linux.intel.com> Cc: Arnaldo Carvalho de Melo <acme(a)kernel.org> Cc: Ian Rogers <irogers(a)google.com> Cc: Jiri Olsa <jolsa(a)redhat.com> Cc: Liang Kan <kan.liang(a)linux.intel.com> Cc: Marco Elver <elver(a)google.com> Cc: Mark Rutland <mark.rutland(a)arm.com> Cc: Namhyung Kim <namhyung(a)kernel.org> Cc: Peter Zijlstra <peterz(a)infradead.org> Cc: Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> Cc: linux-perf-users(a)vger.kernel.org Link: https://lore.kernel.org/r/20250625170737.2918295-1-leo.yan@arm.com Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/events/core.c | 6 +++--- kernel/events/ring_buffer.c | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/kernel/events/core.c b/kernel/events/core.c index 1ee8084e343d..ec89dc39ae16 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -6807,15 +6807,15 @@ static void __perf_pending_irq(struct perf_event *event) * CPU-A CPU-B * * perf_event_disable_inatomic() - * @pending_disable = CPU-A; + * @pending_disable = 1; * irq_work_queue(); * * sched-out - * @pending_disable = -1; + * @pending_disable = 0; * * sched-in * perf_event_disable_inatomic() - * @pending_disable = CPU-B; + * @pending_disable = 1; * irq_work_queue(); // FAILS * * irq_work_run() diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c index cfd9448ce28f..610e9b22f0c4 100644 --- a/kernel/events/ring_buffer.c +++ b/kernel/events/ring_buffer.c @@ -437,7 +437,7 @@ void *perf_aux_output_begin(struct perf_output_handle *handle, * store that will be enabled on successful return */ if (!handle->size) { /* A, matches D */ - event->pending_disable = smp_processor_id(); + perf_event_disable_inatomic(handle->event); perf_output_wakeup(handle); WRITE_ONCE(rb->aux_nest, 0); goto err_put; @@ -522,7 +522,7 @@ void perf_aux_output_end(struct perf_output_handle *handle, unsigned long size) if (wakeup) { if (handle->aux_flags & PERF_AUX_FLAG_TRUNCATED) - handle->event->pending_disable = smp_processor_id(); + perf_event_disable_inatomic(handle->event); perf_output_wakeup(handle); } -- 2.34.1

2 1

[PATCH OLK-6.6] cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate()
by Lin Yujun 01 Sep '25

01 Sep '25

From: Henry Martin <bsdhenrymartin(a)gmail.com> stable inclusion from stable-v6.6.89 commit 19e0eaa62e8831f2bc0285fef3bf8faaa7f3e09b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC6BI0 CVE: CVE-2025-37829 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 73b24dc731731edf762f9454552cb3a5b7224949 ] cpufreq_cpu_get_raw() can return NULL when the target CPU is not present in the policy->cpus mask. scpi_cpufreq_get_rate() does not check for this case, which results in a NULL pointer dereference. Fixes: 343a8d17fa8d ("cpufreq: scpi: remove arm_big_little dependency") Signed-off-by: Henry Martin <bsdhenrymartin(a)gmail.com> Acked-by: Sudeep Holla <sudeep.holla(a)arm.com> Signed-off-by: Viresh Kumar <viresh.kumar(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Yujun <linyujun809(a)h-partners.com> --- drivers/cpufreq/scpi-cpufreq.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/drivers/cpufreq/scpi-cpufreq.c b/drivers/cpufreq/scpi-cpufreq.c index d33be56983ed..e7abab7ebde9 100644 --- a/drivers/cpufreq/scpi-cpufreq.c +++ b/drivers/cpufreq/scpi-cpufreq.c @@ -29,9 +29,16 @@ static struct scpi_ops *scpi_ops; static unsigned int scpi_cpufreq_get_rate(unsigned int cpu) { - struct cpufreq_policy *policy = cpufreq_cpu_get_raw(cpu); - struct scpi_data *priv = policy->driver_data; - unsigned long rate = clk_get_rate(priv->clk); + struct cpufreq_policy *policy; + struct scpi_data *priv; + unsigned long rate; + + policy = cpufreq_cpu_get_raw(cpu); + if (unlikely(!policy)) + return 0; + + priv = policy->driver_data; + rate = clk_get_rate(priv->clk); return rate / 1000; } -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 1343/1343] fs/ext4/mballoc.o: warning: objtool: ext4_mb_complex_scan_group()+0x11a4: unreachable instruction
by kernel test robot 01 Sep '25

01 Sep '25

Hi Theodore, First bad commit (maybe != root cause): tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 7dd09dff93e7ad921baf5cec4b58301d9aebb79a commit: 41298197ead9e85ee2ec1d52122f03fd1863cff2 [1343/1343] ext4: convert BUG_ON's to WARN_ON's in mballoc.c config: x86_64-randconfig-101-20241223 (https://download.01.org/0day-ci/archive/20250901/202509011339.wShfHPCs-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250901/202509011339.wShfHPCs-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202509011339.wShfHPCs-lkp@intel.com/ All warnings (new ones prefixed by >>): fs/ext4/mballoc.c:4734: warning: Function parameter or member 'bh' not described in 'ext4_free_blocks' >> fs/ext4/mballoc.o: warning: objtool: ext4_mb_complex_scan_group()+0x11a4: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1353/1353] fs/debugfs/file.o: warning: objtool: full_proxy_open()+0x55a: unreachable instruction
by kernel test robot 01 Sep '25

01 Sep '25

Hi Drew, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 7dd09dff93e7ad921baf5cec4b58301d9aebb79a commit: d4bdc26bcd632cee393b5171345d5fa6293fe42b [1353/1353] include/asm-generic/bug.h: fix "cut here" for WARN_ON for __WARN_TAINT architectures config: x86_64-randconfig-122-20241226 (https://download.01.org/0day-ci/archive/20250901/202509011343.tLFbbMN4-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250901/202509011343.tLFbbMN4-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202509011343.tLFbbMN4-lkp@intel.com/ All warnings (new ones prefixed by >>): fs/debugfs/file.c: note: in included file (through include/linux/kernel.h, include/linux/list.h, include/linux/module.h): /opt/cross/clang-cd708029e0/lib/clang/19/include/stdarg.h:22:44: sparse: sparse: Expected ) in function call /opt/cross/clang-cd708029e0/lib/clang/19/include/stdarg.h:22:44: sparse: sparse: got < /opt/cross/clang-cd708029e0/lib/clang/19/include/stdarg.h:22:43: sparse: sparse: not a function <noident> /opt/cross/clang-cd708029e0/lib/clang/19/include/stdarg.h:22:22: sparse: sparse: bad constant expression type fs/debugfs/file.c: note: in included file (through include/linux/printk.h, include/linux/kernel.h, include/linux/list.h, ...): /opt/cross/clang-cd708029e0/lib/clang/19/include/stdarg.h:22:44: sparse: sparse: Expected ) in function call /opt/cross/clang-cd708029e0/lib/clang/19/include/stdarg.h:22:44: sparse: sparse: got < /opt/cross/clang-cd708029e0/lib/clang/19/include/stdarg.h:22:43: sparse: sparse: not a function <noident> /opt/cross/clang-cd708029e0/lib/clang/19/include/stdarg.h:22:22: sparse: sparse: bad constant expression type fs/debugfs/file.c: note: in included file (through include/linux/string.h, include/linux/bitmap.h, include/linux/cpumask.h, ...): /opt/cross/clang-cd708029e0/lib/clang/19/include/stdarg.h:22:44: sparse: sparse: Expected ) in function call /opt/cross/clang-cd708029e0/lib/clang/19/include/stdarg.h:22:44: sparse: sparse: got < /opt/cross/clang-cd708029e0/lib/clang/19/include/stdarg.h:22:43: sparse: sparse: not a function <noident> /opt/cross/clang-cd708029e0/lib/clang/19/include/stdarg.h:22:22: sparse: sparse: bad constant expression type >> fs/debugfs/file.o: warning: objtool: full_proxy_open()+0x55a: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1327/1327] mm/vmscan.c:3257:21: error: implicit declaration of function 'kernel_swap_enabled'
by kernel test robot 01 Sep '25

01 Sep '25

Hi liubo, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 7dd09dff93e7ad921baf5cec4b58301d9aebb79a commit: 44983705e56ab22fda801d66e2a6bd0d1be7ca0b [1327/1327] etmem: add original kernel swap enabled options config: x86_64-buildonly-randconfig-005-20241216 (https://download.01.org/0day-ci/archive/20250901/202509011244.xk0lo5DG-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250901/202509011244.xk0lo5DG-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202509011244.xk0lo5DG-lkp@intel.com/ All errors (new ones prefixed by >>): mm/vmscan.c:2734:17: warning: variable 'node_lru_pages' set but not used [-Wunused-but-set-variable] 2734 | unsigned long node_lru_pages = 0; | ^ >> mm/vmscan.c:3257:21: error: implicit declaration of function 'kernel_swap_enabled' [-Werror,-Wimplicit-function-declaration] 3257 | if (sc != NULL && !kernel_swap_enabled()) | ^ mm/vmscan.c:3257:21: note: did you mean 'kernfs_ns_enabled'? include/linux/kernfs.h:309:20: note: 'kernfs_ns_enabled' declared here 309 | static inline bool kernfs_ns_enabled(struct kernfs_node *kn) | ^ 1 warning and 1 error generated. vim +/kernel_swap_enabled +3257 mm/vmscan.c 3250 3251 /* 3252 * Check if original kernel swap is enabled 3253 * turn off kernel swap,but leave page cache reclaim on 3254 */ 3255 static inline void kernel_swap_check(struct scan_control *sc) 3256 { > 3257 if (sc != NULL && !kernel_swap_enabled()) 3258 sc->may_swap = 0; 3259 } 3260 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] sdei_watchdog: add percpu flag to fix sdei watchdog state in lpi mode
by Bowen You 01 Sep '25

01 Sep '25

From: youbowen <youbowen2(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8LQCC CVE: NA ------------------------------------------------- /proc/sys/kernel/nmi_watchdog interface is designed to close nmi watchdog, but currently, it's not working when in low power scenario, since pm callback will enable/disable event when power state changes. This commit add a percpu flag to be compatible with pm callback. Fixes: f022c4cac9c1 ("sdei_watchdog: use lockup_detector_retry_init() to init sdei watchdog") Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- arch/arm64/kernel/watchdog_sdei.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/arch/arm64/kernel/watchdog_sdei.c b/arch/arm64/kernel/watchdog_sdei.c index 19f47e24fa59..87d97aace5b3 100644 --- a/arch/arm64/kernel/watchdog_sdei.c +++ b/arch/arm64/kernel/watchdog_sdei.c @@ -25,6 +25,7 @@ static int sdei_watchdog_event_num; bool disable_sdei_nmi_watchdog; static bool sdei_watchdog_registered; static DEFINE_PER_CPU(ktime_t, last_check_time); +static DEFINE_PER_CPU(bool, sdei_usr_en); void sdei_watchdog_hardlockup_enable(unsigned int cpu) { @@ -44,6 +45,7 @@ void sdei_watchdog_hardlockup_enable(unsigned int cpu) pr_err("Enable NMI Watchdog failed on cpu%d\n", smp_processor_id()); } + __this_cpu_write(sdei_usr_en, 1); } void sdei_watchdog_hardlockup_disable(unsigned int cpu) @@ -54,6 +56,7 @@ void sdei_watchdog_hardlockup_disable(unsigned int cpu) return; ret = sdei_api_event_disable(sdei_watchdog_event_num); + __this_cpu_write(sdei_usr_en, 0); if (ret) pr_err("Disable NMI Watchdog failed on cpu%d\n", smp_processor_id()); @@ -116,10 +119,12 @@ static int sdei_watchdog_pm_notifier(struct notifier_block *nb, switch (action) { case CPU_PM_ENTER: - rv = sdei_api_event_disable(sdei_watchdog_event_num); + if (per_cpu(sdei_usr_en, smp_processor_id())) + rv = sdei_api_event_disable(sdei_watchdog_event_num); break; case CPU_PM_EXIT: - rv = sdei_api_event_enable(sdei_watchdog_event_num); + if (per_cpu(sdei_usr_en, smp_processor_id())) + rv = sdei_api_event_enable(sdei_watchdog_event_num); break; default: return NOTIFY_DONE; -- 2.34.1

2 1

[PATCH OLK-6.6] sdei_watchdog: add percpu flag to fix sdei watchdog state in lpi mode
by Bowen You 01 Sep '25

01 Sep '25

From: youbowen <youbowen2(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8LQCC CVE: NA ------------------------------------------------- /proc/sys/kernel/nmi_watchdog interface is designed to close nmi watchdog, but currently, it's not working when in low power scenario, since pm callback will enable/disable event when power state changes. This commit add a percpu flag to be compatible with pm callback. Fixes: f022c4cac9c1 ("sdei_watchdog: use lockup_detector_retry_init() to init sdei watchdog") Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- arch/arm64/kernel/watchdog_sdei.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/arch/arm64/kernel/watchdog_sdei.c b/arch/arm64/kernel/watchdog_sdei.c index 19f47e24fa59..da1d80743996 100644 --- a/arch/arm64/kernel/watchdog_sdei.c +++ b/arch/arm64/kernel/watchdog_sdei.c @@ -25,6 +25,7 @@ static int sdei_watchdog_event_num; bool disable_sdei_nmi_watchdog; static bool sdei_watchdog_registered; static DEFINE_PER_CPU(ktime_t, last_check_time); +static DEFINE_PER_CPU(bool, sdei_usr_en); void sdei_watchdog_hardlockup_enable(unsigned int cpu) { @@ -44,6 +45,7 @@ void sdei_watchdog_hardlockup_enable(unsigned int cpu) pr_err("Enable NMI Watchdog failed on cpu%d\n", smp_processor_id()); } + __this_cpu_write(sdei_usr_en, 1); } void sdei_watchdog_hardlockup_disable(unsigned int cpu) @@ -54,6 +56,7 @@ void sdei_watchdog_hardlockup_disable(unsigned int cpu) return; ret = sdei_api_event_disable(sdei_watchdog_event_num); + __this_cpu_write(sdei_usr_en, 0); if (ret) pr_err("Disable NMI Watchdog failed on cpu%d\n", smp_processor_id()); @@ -62,6 +65,7 @@ void sdei_watchdog_hardlockup_disable(unsigned int cpu) static int sdei_watchdog_callback(u32 event, struct pt_regs *regs, void *arg) { + pr_err("sdei watchdog callback on cpu %d\n", smp_processor_id()); ktime_t delta, now = ktime_get_mono_fast_ns(); delta = now - __this_cpu_read(last_check_time); @@ -116,10 +120,12 @@ static int sdei_watchdog_pm_notifier(struct notifier_block *nb, switch (action) { case CPU_PM_ENTER: - rv = sdei_api_event_disable(sdei_watchdog_event_num); + if (per_cpu(sdei_usr_en, smp_processor_id())) + rv = sdei_api_event_disable(sdei_watchdog_event_num); break; case CPU_PM_EXIT: - rv = sdei_api_event_enable(sdei_watchdog_event_num); + if (per_cpu(sdei_usr_en, smp_processor_id())) + rv = sdei_api_event_enable(sdei_watchdog_event_num); break; default: return NOTIFY_DONE; -- 2.34.1

2 1

[PATCH OLK-6.6] perf/aux: Fix pending disable flow when the AUX ring buffer overruns
by Pu Lehui 01 Sep '25

01 Sep '25

From: Leo Yan <leo.yan(a)arm.com> mainline inclusion from mainline-v6.16-rc4 commit 1476b218327b89bbb64c14619a2d34f0c320f2c3 category: bugfix bugzilla: 190743 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If an AUX event overruns, the event core layer intends to disable the event by setting the 'pending_disable' flag. Unfortunately, the event is not actually disabled afterwards. In commit: ca6c21327c6a ("perf: Fix missing SIGTRAPs") the 'pending_disable' flag was changed to a boolean. However, the AUX event code was not updated accordingly. The flag ends up holding a CPU number. If this number is zero, the flag is taken as false and the IRQ work is never triggered. Later, with commit: 2b84def990d3 ("perf: Split __perf_pending_irq() out of perf_pending_irq()") a new IRQ work 'pending_disable_irq' was introduced to handle event disabling. The AUX event path was not updated to kick off the work queue. To fix this bug, when an AUX ring buffer overrun is detected, call perf_event_disable_inatomic() to initiate the pending disable flow. Also update the outdated comment for setting the flag, to reflect the boolean values (0 or 1). Fixes: 2b84def990d3 ("perf: Split __perf_pending_irq() out of perf_pending_irq()") Fixes: ca6c21327c6a ("perf: Fix missing SIGTRAPs") Signed-off-by: Leo Yan <leo.yan(a)arm.com> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Reviewed-by: James Clark <james.clark(a)linaro.org> Reviewed-by: Yeoreum Yun <yeoreum.yun(a)arm.com> Cc: Adrian Hunter <adrian.hunter(a)intel.com> Cc: Alexander Shishkin <alexander.shishkin(a)linux.intel.com> Cc: Arnaldo Carvalho de Melo <acme(a)kernel.org> Cc: Ian Rogers <irogers(a)google.com> Cc: Jiri Olsa <jolsa(a)redhat.com> Cc: Liang Kan <kan.liang(a)linux.intel.com> Cc: Marco Elver <elver(a)google.com> Cc: Mark Rutland <mark.rutland(a)arm.com> Cc: Namhyung Kim <namhyung(a)kernel.org> Cc: Peter Zijlstra <peterz(a)infradead.org> Cc: Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> Cc: linux-perf-users(a)vger.kernel.org Link: https://lore.kernel.org/r/20250625170737.2918295-1-leo.yan@arm.com Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/events/core.c | 6 +++--- kernel/events/ring_buffer.c | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/kernel/events/core.c b/kernel/events/core.c index 1ee8084e343d..ec89dc39ae16 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -6807,15 +6807,15 @@ static void __perf_pending_irq(struct perf_event *event) * CPU-A CPU-B * * perf_event_disable_inatomic() - * @pending_disable = CPU-A; + * @pending_disable = 1; * irq_work_queue(); * * sched-out - * @pending_disable = -1; + * @pending_disable = 0; * * sched-in * perf_event_disable_inatomic() - * @pending_disable = CPU-B; + * @pending_disable = 1; * irq_work_queue(); // FAILS * * irq_work_run() diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c index cfd9448ce28f..610e9b22f0c4 100644 --- a/kernel/events/ring_buffer.c +++ b/kernel/events/ring_buffer.c @@ -437,7 +437,7 @@ void *perf_aux_output_begin(struct perf_output_handle *handle, * store that will be enabled on successful return */ if (!handle->size) { /* A, matches D */ - event->pending_disable = smp_processor_id(); + perf_event_disable_inatomic(handle->event); perf_output_wakeup(handle); WRITE_ONCE(rb->aux_nest, 0); goto err_put; @@ -522,7 +522,7 @@ void perf_aux_output_end(struct perf_output_handle *handle, unsigned long size) if (wakeup) { if (handle->aux_flags & PERF_AUX_FLAG_TRUNCATED) - handle->event->pending_disable = smp_processor_id(); + perf_event_disable_inatomic(handle->event); perf_output_wakeup(handle); } -- 2.34.1

2 1

[PATCH OLK-6.6] sdei_watchdog: add percpu flag to fix sdei watchdog state in lpi mode
by Bowen You 01 Sep '25

01 Sep '25

From: youbowen <youbowen2(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8LQCC CVE: NA ------------------------------------------------- /proc/sys/kernel/nmi_watchdog interface is designed to close nmi watchdog, but currently, it's not working when in low power scenario, since pm callback will enable/disable event when power state changes. This commit add a percpu flag to be compatible with pm callback. Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- arch/arm64/kernel/watchdog_sdei.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/arch/arm64/kernel/watchdog_sdei.c b/arch/arm64/kernel/watchdog_sdei.c index 19f47e24fa59..da1d80743996 100644 --- a/arch/arm64/kernel/watchdog_sdei.c +++ b/arch/arm64/kernel/watchdog_sdei.c @@ -25,6 +25,7 @@ static int sdei_watchdog_event_num; bool disable_sdei_nmi_watchdog; static bool sdei_watchdog_registered; static DEFINE_PER_CPU(ktime_t, last_check_time); +static DEFINE_PER_CPU(bool, sdei_usr_en); void sdei_watchdog_hardlockup_enable(unsigned int cpu) { @@ -44,6 +45,7 @@ void sdei_watchdog_hardlockup_enable(unsigned int cpu) pr_err("Enable NMI Watchdog failed on cpu%d\n", smp_processor_id()); } + __this_cpu_write(sdei_usr_en, 1); } void sdei_watchdog_hardlockup_disable(unsigned int cpu) @@ -54,6 +56,7 @@ void sdei_watchdog_hardlockup_disable(unsigned int cpu) return; ret = sdei_api_event_disable(sdei_watchdog_event_num); + __this_cpu_write(sdei_usr_en, 0); if (ret) pr_err("Disable NMI Watchdog failed on cpu%d\n", smp_processor_id()); @@ -62,6 +65,7 @@ void sdei_watchdog_hardlockup_disable(unsigned int cpu) static int sdei_watchdog_callback(u32 event, struct pt_regs *regs, void *arg) { + pr_err("sdei watchdog callback on cpu %d\n", smp_processor_id()); ktime_t delta, now = ktime_get_mono_fast_ns(); delta = now - __this_cpu_read(last_check_time); @@ -116,10 +120,12 @@ static int sdei_watchdog_pm_notifier(struct notifier_block *nb, switch (action) { case CPU_PM_ENTER: - rv = sdei_api_event_disable(sdei_watchdog_event_num); + if (per_cpu(sdei_usr_en, smp_processor_id())) + rv = sdei_api_event_disable(sdei_watchdog_event_num); break; case CPU_PM_EXIT: - rv = sdei_api_event_enable(sdei_watchdog_event_num); + if (per_cpu(sdei_usr_en, smp_processor_id())) + rv = sdei_api_event_enable(sdei_watchdog_event_num); break; default: return NOTIFY_DONE; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] ipv6: reject malicious packets in ipv6_gso_segment()
by Wang Liang 01 Sep '25

01 Sep '25

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.17-rc1 commit d45cf1e7d7180256e17c9ce88e32e8061a7887fe category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICU6G7 CVE: CVE-2025-38572 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzbot was able to craft a packet with very long IPv6 extension headers leading to an overflow of skb->transport_header. This 16bit field has a limited range. Add skb_reset_transport_header_careful() helper and use it from ipv6_gso_segment() WARNING: CPU: 0 PID: 5871 at ./include/linux/skbuff.h:3032 skb_reset_transport_header include/linux/skbuff.h:3032 [inline] WARNING: CPU: 0 PID: 5871 at ./include/linux/skbuff.h:3032 ipv6_gso_segment+0x15e2/0x21e0 net/ipv6/ip6_offload.c:151 Modules linked in: CPU: 0 UID: 0 PID: 5871 Comm: syz-executor211 Not tainted 6.16.0-rc6-syzkaller-g7abc678e3084 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:skb_reset_transport_header include/linux/skbuff.h:3032 [inline] RIP: 0010:ipv6_gso_segment+0x15e2/0x21e0 net/ipv6/ip6_offload.c:151 Call Trace: <TASK> skb_mac_gso_segment+0x31c/0x640 net/core/gso.c:53 nsh_gso_segment+0x54a/0xe10 net/nsh/nsh.c:110 skb_mac_gso_segment+0x31c/0x640 net/core/gso.c:53 __skb_gso_segment+0x342/0x510 net/core/gso.c:124 skb_gso_segment include/net/gso.h:83 [inline] validate_xmit_skb+0x857/0x11b0 net/core/dev.c:3950 validate_xmit_skb_list+0x84/0x120 net/core/dev.c:4000 sch_direct_xmit+0xd3/0x4b0 net/sched/sch_generic.c:329 __dev_xmit_skb net/core/dev.c:4102 [inline] __dev_queue_xmit+0x17b6/0x3a70 net/core/dev.c:4679 Fixes: d1da932ed4ec ("ipv6: Separate ipv6 offload support") Reported-by: syzbot+af43e647fd835acc02df(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/688a1a05.050a0220.5d226.0008.GAE@google.com/… Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Dawid Osuchowski <dawid.osuchowski(a)linux.intel.com> Reviewed-by: Willem de Bruijn <willemb(a)google.com> Link: https://patch.msgid.link/20250730131738.3385939-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- include/linux/skbuff.h | 23 +++++++++++++++++++++++ net/ipv6/ip6_offload.c | 4 +++- 2 files changed, 26 insertions(+), 1 deletion(-) diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h index c7d1d8b5f41b..2e2d504c7902 100644 --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h @@ -2374,6 +2374,29 @@ static inline void skb_reset_transport_header(struct sk_buff *skb) skb->transport_header = skb->data - skb->head; } +/** + * skb_reset_transport_header_careful - conditionally reset transport header + * @skb: buffer to alter + * + * Hardened version of skb_reset_transport_header(). + * + * Returns: true if the operation was a success. + */ +static inline bool __must_check +skb_reset_transport_header_careful(struct sk_buff *skb) +{ + long offset = skb->data - skb->head; + + if (unlikely(offset != (typeof(skb->transport_header))offset)) + return false; + + if (unlikely(offset == (typeof(skb->transport_header))~0U)) + return false; + + skb->transport_header = offset; + return true; +} + static inline void skb_set_transport_header(struct sk_buff *skb, const int offset) { diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c index 6c47cd0ef240..81227ca2a883 100644 --- a/net/ipv6/ip6_offload.c +++ b/net/ipv6/ip6_offload.c @@ -96,7 +96,9 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb, ops = rcu_dereference(inet6_offloads[proto]); if (likely(ops && ops->callbacks.gso_segment)) { - skb_reset_transport_header(skb); + if (!skb_reset_transport_header_careful(skb)) + goto out; + segs = ops->callbacks.gso_segment(skb, features); if (!segs) skb->network_header = skb_mac_header(skb) + nhoff - skb->head; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] vsock: Do not allow binding to VMADDR_PORT_ANY
by Wang Liang 01 Sep '25

01 Sep '25

From: Budimir Markovic <markovicbudimir(a)gmail.com> mainline inclusion from mainline-v6.17-rc2 commit aba0c94f61ec05315fa7815d21aefa4c87f6a9f4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICUC4U CVE: CVE-2025-38618 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- It is possible for a vsock to autobind to VMADDR_PORT_ANY. This can cause a use-after-free when a connection is made to the bound socket. The socket returned by accept() also has port VMADDR_PORT_ANY but is not on the list of unbound sockets. Binding it will result in an extra refcount decrement similar to the one fixed in fcdd2242c023 (vsock: Keep the binding until socket destruction). Modify the check in __vsock_bind_connectible() to also prevent binding to VMADDR_PORT_ANY. Fixes: d021c344051a ("VSOCK: Introduce VM Sockets") Reported-by: Budimir Markovic <markovicbudimir(a)gmail.com> Signed-off-by: Budimir Markovic <markovicbudimir(a)gmail.com> Reviewed-by: Stefano Garzarella <sgarzare(a)redhat.com> Link: https://patch.msgid.link/20250807041811.678-1-markovicbudimir@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/vmw_vsock/af_vsock.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c index 00374327bf9a..51558c689ab9 100644 --- a/net/vmw_vsock/af_vsock.c +++ b/net/vmw_vsock/af_vsock.c @@ -495,7 +495,8 @@ static int __vsock_bind_stream(struct vsock_sock *vsk, unsigned int i; for (i = 0; i < MAX_PORT_RETRIES; i++) { - if (port <= LAST_RESERVED_PORT) + if (port == VMADDR_PORT_ANY || + port <= LAST_RESERVED_PORT) port = LAST_RESERVED_PORT + 1; new_addr.svm_port = port++; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] net/packet: fix a race in packet_set_ring() and packet_notifier()
by Wang Liang 01 Sep '25

01 Sep '25

From: Quang Le <quanglex97(a)gmail.com> mainline inclusion from mainline-v6.17-rc1 commit 01d3c8417b9c1b884a8a981a3b886da556512f36 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICUC4S CVE: CVE-2025-38617 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When packet_set_ring() releases po->bind_lock, another thread can run packet_notifier() and process an NETDEV_UP event. This race and the fix are both similar to that of commit 15fe076edea7 ("net/packet: fix a race in packet_bind() and packet_notifier()"). There too the packet_notifier NETDEV_UP event managed to run while a po->bind_lock critical section had to be temporarily released. And the fix was similarly to temporarily set po->num to zero to keep the socket unhooked until the lock is retaken. The po->bind_lock in packet_set_ring and packet_notifier precede the introduction of git history. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable(a)vger.kernel.org Signed-off-by: Quang Le <quanglex97(a)gmail.com> Signed-off-by: Willem de Bruijn <willemb(a)google.com> Link: https://patch.msgid.link/20250801175423.2970334-1-willemdebruijn.kernel@gma… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/packet/af_packet.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c index 98b9e4f19778..3938c9df92da 100644 --- a/net/packet/af_packet.c +++ b/net/packet/af_packet.c @@ -4411,10 +4411,10 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, spin_lock(&po->bind_lock); was_running = po->running; num = po->num; - if (was_running) { - WRITE_ONCE(po->num, 0); + WRITE_ONCE(po->num, 0); + if (was_running) __unregister_prot_hook(sk, false); - } + spin_unlock(&po->bind_lock); synchronize_net(); @@ -4446,10 +4446,10 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, mutex_unlock(&po->pg_vec_lock); spin_lock(&po->bind_lock); - if (was_running) { - WRITE_ONCE(po->num, num); + WRITE_ONCE(po->num, num); + if (was_running) register_prot_hook(sk); - } + spin_unlock(&po->bind_lock); if (pg_vec && (po->tp_version > TPACKET_V2)) { /* Because we don't support block-based V3 on tx-ring */ -- 2.34.1

2 1

[PATCH OLK-6.6] sdei_watchdog: add percpu flag to fix sdei watchdog state in lpi mode
by Bowen You 01 Sep '25

01 Sep '25

From: youbowen <youbowen2(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8LQCC CVE: NA ------------------------------------------------- /proc/sys/kernel/nmi_watchdog interface is designed to close nmi watchdog, but currently, it's not working when in low power scenario, since pm callback will enable/disable event when power state changes. This commit add a percpu flag to be compatible with pm callback. Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- arch/arm64/kernel/watchdog_sdei.c | 10 ++++++++-- include/linux/nmi.h | 1 + 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/arch/arm64/kernel/watchdog_sdei.c b/arch/arm64/kernel/watchdog_sdei.c index 19f47e24fa59..13a9341bd5ca 100644 --- a/arch/arm64/kernel/watchdog_sdei.c +++ b/arch/arm64/kernel/watchdog_sdei.c @@ -25,6 +25,7 @@ static int sdei_watchdog_event_num; bool disable_sdei_nmi_watchdog; static bool sdei_watchdog_registered; static DEFINE_PER_CPU(ktime_t, last_check_time); +DEFINE_PER_CPU(bool, sdei_usr_en); void sdei_watchdog_hardlockup_enable(unsigned int cpu) { @@ -44,6 +45,7 @@ void sdei_watchdog_hardlockup_enable(unsigned int cpu) pr_err("Enable NMI Watchdog failed on cpu%d\n", smp_processor_id()); } + __this_cpu_write(sdei_usr_en, 1); } void sdei_watchdog_hardlockup_disable(unsigned int cpu) @@ -54,6 +56,7 @@ void sdei_watchdog_hardlockup_disable(unsigned int cpu) return; ret = sdei_api_event_disable(sdei_watchdog_event_num); + __this_cpu_write(sdei_usr_en, 0); if (ret) pr_err("Disable NMI Watchdog failed on cpu%d\n", smp_processor_id()); @@ -62,6 +65,7 @@ void sdei_watchdog_hardlockup_disable(unsigned int cpu) static int sdei_watchdog_callback(u32 event, struct pt_regs *regs, void *arg) { + pr_err("sdei watchdog callback on cpu %d\n", smp_processor_id()); ktime_t delta, now = ktime_get_mono_fast_ns(); delta = now - __this_cpu_read(last_check_time); @@ -116,10 +120,12 @@ static int sdei_watchdog_pm_notifier(struct notifier_block *nb, switch (action) { case CPU_PM_ENTER: - rv = sdei_api_event_disable(sdei_watchdog_event_num); + if (per_cpu(sdei_usr_en, smp_processor_id())) + rv = sdei_api_event_disable(sdei_watchdog_event_num); break; case CPU_PM_EXIT: - rv = sdei_api_event_enable(sdei_watchdog_event_num); + if (per_cpu(sdei_usr_en, smp_processor_id())) + rv = sdei_api_event_enable(sdei_watchdog_event_num); break; default: return NOTIFY_DONE; diff --git a/include/linux/nmi.h b/include/linux/nmi.h index 25fe091e1d19..0d32046d4b01 100644 --- a/include/linux/nmi.h +++ b/include/linux/nmi.h @@ -238,6 +238,7 @@ void sdei_watchdog_hardlockup_enable(unsigned int cpu); void sdei_watchdog_hardlockup_disable(unsigned int cpu); void sdei_watchdog_clear_eoi(void); int sdei_watchdog_hardlockup_probe(void); +DECLARE_PER_CPU(bool, sdei_usr_en); extern bool disable_sdei_nmi_watchdog; #else static inline void sdei_watchdog_hardlockup_enable(unsigned int cpu) { } -- 2.34.1

2 1