- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10 0/7] CVE-2022-49722
by Xiaomeng Zhang 26 Nov '25

26 Nov '25

Jacob Keller (3): ice: convert ice_reset_vf to standard error codes ice: convert ice_reset_vf to take flags ice: introduce ICE_VF_RESET_LOCK flag Michal Jaron (1): ice: Fix call trace with null VSI during VF reset Norbert Zulinski (1): ice: Fix spurious interrupt during removal of trusted VF Petr Oros (1): ice: Fix NULL pointer deref during VF reset Przemyslaw Patynowski (1): ice: Fix memory corruption in VF driver drivers/net/ethernet/intel/ice/ice_base.c | 4 +- drivers/net/ethernet/intel/ice/ice_lib.c | 28 ++++++++ drivers/net/ethernet/intel/ice/ice_lib.h | 1 + drivers/net/ethernet/intel/ice/ice_main.c | 4 +- .../net/ethernet/intel/ice/ice_virtchnl_pf.c | 71 +++++++++++++++---- .../net/ethernet/intel/ice/ice_virtchnl_pf.h | 18 ++++- 6 files changed, 104 insertions(+), 22 deletions(-) -- 2.34.1

3 10

[PATCH openEuler-1.0-LTS] sched: Fix race between yield_to() and try_to_wake_up()
by Xia Fukun 26 Nov '25

26 Nov '25

From: Tianchen Ding <dtcccc(a)linux.alibaba.com> mainline inclusion from mainline-v6.18-rc1 commit 5d808c78d97251af1d3a3e4f253e7d6c39fd871e category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID8CE7 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- We met a SCHED_WARN in set_next_buddy(): __warn_printk set_next_buddy yield_to_task_fair yield_to kvm_vcpu_yield_to [kvm] ... After a short dig, we found the rq_lock held by yield_to() may not be exactly the rq that the target task belongs to. There is a race window against try_to_wake_up(). CPU0 target_task blocking on CPU1 lock rq0 & rq1 double check task_rq == p_rq, ok woken to CPU2 (lock task_pi & rq2) task_rq = rq2 yield_to_task_fair (w/o lock rq2) In this race window, yield_to() is operating the task w/o the correct lock. Fix this by taking task pi_lock first. Fixes: d95f41220065 ("sched: Add yield_to(task, preempt) functionality") Signed-off-by: Tianchen Ding <dtcccc(a)linux.alibaba.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Link: https://lkml.kernel.org/r/20241231055020.6521-1-dtcccc@linux.alibaba.com Conflicts: kernel/sched/syscalls.c kernel/sched/core.c [Context differences.] Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- kernel/sched/core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 4149f554debd..f7fa066b05ba 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -5144,7 +5144,7 @@ int __sched yield_to(struct task_struct *p, bool preempt) unsigned long flags; int yielded = 0; - local_irq_save(flags); + raw_spin_lock_irqsave(&p->pi_lock, flags); rq = this_rq(); again: @@ -5187,7 +5187,7 @@ int __sched yield_to(struct task_struct *p, bool preempt) out_unlock: double_rq_unlock(rq, p_rq); out_irq: - local_irq_restore(flags); + raw_spin_unlock_irqrestore(&p->pi_lock, flags); if (yielded > 0) schedule(); -- 2.34.1

2 1

[PATCH OLK-6.6 00/11] xsched: XCU Partition
by Zicheng Qu 26 Nov '25

26 Nov '25

Zicheng Qu (11): xsched: unify log prefix format and remove duplicated prefix macros xsched: enforce valid xsched scheduler config dependencies xsched: add missing spin_unlock() in xcu_move_task() error path xsched: avoid sleeping while holding spinlock in xcu_move_task() xsched: remove parent->lock and rely on cgroup_mutex for shares update xsched: unify root detection logic for cgroups xsched: replace hard-coded numeric values xsched: modify the logic for inc and dec the count value xsched: add null check for sched in xsched_xse_set_class xsched: rename vstream->id to vstream->sq_id xsched: move stream_lock into xsched_vsm_add_tail() to avoid sleeping in atomic context arch/arm64/configs/openeuler_defconfig | 6 +- arch/x86/configs/openeuler_defconfig | 6 +- drivers/xcu/xcu_group.c | 2 + include/linux/vstream.h | 2 +- include/linux/xsched.h | 76 ++++++++--------------- kernel/xsched/Kconfig | 14 ++++- kernel/xsched/cgroup.c | 79 ++++++++++-------------- kernel/xsched/core.c | 83 ++++++++++++++------------ kernel/xsched/vstream.c | 29 +++------ 9 files changed, 134 insertions(+), 163 deletions(-) -- 2.34.1

2 12

[PATCH OLK-6.6 0/3] fix cve-2025-40300
by Bowen You 26 Nov '25

26 Nov '25

fix cve 2025-40300 Pawan Gupta (3): x86/vmscape: Add conditional IBPB mitigation x86/vmscape: Enumerate VMSCAPE bug x86/vmscape: Enable the mitigation .../ABI/testing/sysfs-devices-system-cpu | 1 + .../admin-guide/kernel-parameters.txt | 11 +++ arch/x86/Kconfig | 9 ++ arch/x86/include/asm/cpufeatures.h | 2 + arch/x86/include/asm/entry-common.h | 7 ++ arch/x86/include/asm/nospec-branch.h | 2 + arch/x86/kernel/cpu/bugs.c | 85 +++++++++++++++++++ arch/x86/kernel/cpu/common.c | 58 +++++++++---- arch/x86/kvm/x86.c | 9 ++ drivers/base/cpu.c | 3 + 10 files changed, 169 insertions(+), 18 deletions(-) -- 2.34.1

2 4

[PATCH OLK-5.10 0/8] fix cves
by Wupeng Ma 26 Nov '25

26 Nov '25

fix the fellowing cves: - CVE-2025-38084 - CVE-2025-21693 - CVE-2021-47653 Chengming Zhou (1): mm/zswap: change per-cpu mutex and buffer to per-acomp_ctx Dmitry Nikiforov (1): media: davinci: vpif: Fix memory leak in probe error path James Houghton (1): hugetlb: unshare some PMDs when splitting VMAs Jann Horn (1): mm/hugetlb: unshare page tables during VMA split, not before Johan Hovold (1): media: davinci: vpif: fix use-after-free on driver unbind Yosry Ahmed (3): mm: zswap: properly synchronize freeing resources during CPU hotunplug mm: zswap: move allocations during CPU init outside the lock mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead() drivers/media/platform/davinci/vpif.c | 99 ++++++++++---- include/linux/cpuhotplug.h | 2 +- include/linux/hugetlb.h | 6 + mm/hugetlb.c | 92 +++++++++++++ mm/mmap.c | 8 ++ mm/zswap.c | 186 ++++++++++++++------------ 6 files changed, 280 insertions(+), 113 deletions(-) -- 2.43.0

2 9

[PATCH OLK-6.6 0/5] fix cves
by Wupeng Ma 26 Nov '25

26 Nov '25

fix the fellowing cves: - CVE-2025-38084 - CVE-2025-21693 - CVE-2021-47653 Chengming Zhou (1): mm/zswap: change per-cpu mutex and buffer to per-acomp_ctx Jann Horn (1): mm/hugetlb: unshare page tables during VMA split, not before Yosry Ahmed (3): mm: zswap: properly synchronize freeing resources during CPU hotunplug mm: zswap: move allocations during CPU init outside the lock mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead() include/linux/cpuhotplug.h | 2 +- include/linux/hugetlb.h | 3 + mm/hugetlb.c | 60 ++++++++---- mm/mmap.c | 6 ++ mm/zswap.c | 187 ++++++++++++++++++++----------------- 5 files changed, 154 insertions(+), 104 deletions(-) -- 2.43.0

2 6

[PATCH OLK-5.10 0/6] fix cves
by Wupeng Ma 26 Nov '25

26 Nov '25

fix the fellowing cves: - CVE-2025-38084 - CVE-2025-21693 - CVE-2021-47653 Chengming Zhou (1): mm/zswap: change per-cpu mutex and buffer to per-acomp_ctx James Houghton (1): hugetlb: unshare some PMDs when splitting VMAs Jann Horn (1): mm/hugetlb: unshare page tables during VMA split, not before Johan Hovold (1): media: davinci: vpif: fix use-after-free on driver unbind Yosry Ahmed (2): mm: zswap: properly synchronize freeing resources during CPU hotunplug mm: zswap: move allocations during CPU init outside the lock drivers/media/platform/davinci/vpif.c | 97 +++++++++++----- include/linux/cpuhotplug.h | 2 +- include/linux/hugetlb.h | 6 + mm/hugetlb.c | 92 +++++++++++++++ mm/mmap.c | 8 ++ mm/zswap.c | 160 +++++++++++++------------- 6 files changed, 258 insertions(+), 107 deletions(-) -- 2.43.0

2 7

[PATCH OLK-6.6 0/4] fix cves for 6.6
by Wupeng Ma 26 Nov '25

26 Nov '25

fix the following cve: - CVE-2025-38084 - CVE-2025-21693 Chengming Zhou (1): mm/zswap: change per-cpu mutex and buffer to per-acomp_ctx Jann Horn (1): mm/hugetlb: unshare page tables during VMA split, not before Yosry Ahmed (2): mm: zswap: properly synchronize freeing resources during CPU hotunplug mm: zswap: move allocations during CPU init outside the lock include/linux/cpuhotplug.h | 2 +- include/linux/hugetlb.h | 3 + mm/hugetlb.c | 60 ++++++++++---- mm/mmap.c | 6 ++ mm/zswap.c | 161 ++++++++++++++++++------------------- 5 files changed, 134 insertions(+), 98 deletions(-) -- 2.43.0

2 5

[PATCH OLK-6.6 00/11] xsched: XCU Partition
by Zicheng Qu 26 Nov '25

26 Nov '25

Zicheng Qu (11): xsched: unify log prefix format and remove duplicated prefix macros xsched: enforce valid xsched scheduler config dependencies xsched: add missing spin_unlock() in xcu_move_task() error path xsched: avoid sleeping while holding spinlock in xcu_move_task() xsched: remove parent->lock and rely on cgroup_mutex for shares update xsched: unify root detection logic for cgroups xsched: replace hard-coded numeric values xsched: modify the logic for inc and dec the count value xsched: add null check for sched in xsched_xse_set_class xsched: rename vstream->id to vstream->sq_id xsched: move stream_lock into xsched_vsm_add_tail() to avoid sleeping in atomic context arch/arm64/configs/openeuler_defconfig | 6 +- arch/x86/configs/openeuler_defconfig | 6 +- drivers/xcu/xcu_group.c | 2 + include/linux/vstream.h | 2 +- include/linux/xsched.h | 76 ++++++++--------------- kernel/xsched/Kconfig | 5 +- kernel/xsched/cgroup.c | 79 ++++++++++-------------- kernel/xsched/core.c | 83 ++++++++++++++------------ kernel/xsched/vstream.c | 29 +++------ 9 files changed, 125 insertions(+), 163 deletions(-) -- 2.34.1

2 12

[openeuler:OLK-6.6 3316/3316] kernel/xsched/cgroup.c:368:6: warning: no previous prototype for 'xcu_move_task'
by kernel test robot 26 Nov '25

26 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 0fa9557473e665984ed5e97515969035324b2ec5 commit: 43bbefc53356009d3603faa2c6e6a2858f724e4d [3316/3316] xsched: Add XCU control group implementation and its backend in xsched CFS config: x86_64-buildonly-randconfig-002-20251125 (https://download.01.org/0day-ci/archive/20251126/202511260440.XtGIX1Qz-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251126/202511260440.XtGIX1Qz-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511260440.XtGIX1Qz-lkp@intel.com/ All warnings (new ones prefixed by >>): >> kernel/xsched/cgroup.c:368:6: warning: no previous prototype for 'xcu_move_task' [-Wmissing-prototypes] 368 | void xcu_move_task(struct task_struct *task, struct xsched_group *old_xcg, | ^~~~~~~~~~~~~ -- kernel/xsched/cfs.c:56: warning: Function parameter or member 'xse_cfs' not described in 'xs_cfs_rq_update' kernel/xsched/cfs.c:56: warning: Function parameter or member 'new_xrt' not described in 'xs_cfs_rq_update' >> kernel/xsched/cfs.c:103: warning: Function parameter or member 'xg' not described in 'xg_update' >> kernel/xsched/cfs.c:103: warning: Function parameter or member 'task_delta' not described in 'xg_update' >> kernel/xsched/cfs.c:103: warning: Excess function parameter 'gxcu' description in 'xg_update' -- >> kernel/xsched/cgroup.c:46: warning: Cannot understand * @brief Initialize the core components of an xsched_group. on line 46 - I thought it was a doc line vim +/xcu_move_task +368 kernel/xsched/cgroup.c 367 > 368 void xcu_move_task(struct task_struct *task, struct xsched_group *old_xcg, 369 struct xsched_group *new_xcg) 370 { 371 struct xsched_entity *xse, *tmp; 372 struct xsched_cu *xcu; 373 374 spin_lock(&old_xcg->lock); 375 list_for_each_entry_safe(xse, tmp, &old_xcg->members, group_node) { 376 if (xse->owner_pid != task_pid_nr(task)) 377 continue; 378 379 xcu = xse->xcu; 380 381 if (old_xcg != xse->parent_grp) { 382 WARN_ON(old_xcg != xse->parent_grp); 383 return; 384 } 385 386 /* delete from the old_xcg */ 387 list_del(&xse->group_node); 388 389 mutex_lock(&xcu->xcu_lock); 390 /* dequeue from the current runqueue */ 391 dequeue_ctx(xse, xcu); 392 /* attach to the new_xcg */ 393 xsched_group_xse_attach(new_xcg, xse); 394 /* enqueue to the runqueue in new_xcg */ 395 enqueue_ctx(xse, xcu); 396 mutex_unlock(&xcu->xcu_lock); 397 } 398 spin_unlock(&old_xcg->lock); 399 } 400 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0