- Kernel - mailweb.openeuler.org

[PATCH 00/14] Fix incorrect use of cpuhp_remove_multi_state parameter
by Yushan Wang 09 Dec '25

09 Dec '25

driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IDBQ74 ---------------------------------------------------------------------- Yifan Wu (3): soc_cache: Fix incorrect use of cpuhp_remove_multi_state parameter soc_cache: Fix error code returning from hisi_soc_l3c_do_lock soc_cache: Fix component removal order to avoid race condition Yushan Wang (10): soc cache: cleanup: replace dynamically allocated param with local variable soc cache: cleanup: fix memory leakage on error path soc cache: cleanup: move judgement of soc cache dev into lock protection soc cache: cleanup: avoid tag addr from interfering range validation soc cache: cleanup: Change type of mnt_type soc cache: cleanup: Remove the redundant check of vm_pgoff soc cache: Check address while walking pages soc cache: fix walk page parameter and drop incorrect check soc cache: Drop redundant vm_pgoff soc cache: Don't poll before removing all locks .../soc/hisilicon/hisi_soc_cache_framework.c | 65 ++++++++----------- drivers/soc/hisilicon/hisi_soc_l3c.c | 13 ++-- 2 files changed, 31 insertions(+), 47 deletions(-) -- 2.33.0

1 14

[PATCH OLK-6.6 0/3] Some bugfixes for interference
by Tengda Wu 09 Dec '25

09 Dec '25

This small patch series addresses some interference issues. Tengda Wu (3): interference: Add fallback to sched_clock when TSC is unavailable interference: Fix missing interference.stat file in v1 hierarchy interference: add version compatibility check between subsystem and cgroup include/linux/cgroup.h | 25 ++++++++++++++------- kernel/cgroup/ifs.c | 51 +++++++++++++++++++++++++++++------------- 2 files changed, 53 insertions(+), 23 deletions(-) -- 2.34.1

2 4

[PATCH OLK-5.10 0/2] CVE-2023-53491 v3
by Lin Yujun 09 Dec '25

09 Dec '25

Lin Yujun (1): start_kernel: use unreachable too fix __noreturn build warning ndesaulniers(a)google.com (1): start_kernel: Add __no_stack_protector function attribute arch/powerpc/kernel/smp.c | 1 + include/linux/compiler_attributes.h | 12 ++++++++++++ init/main.c | 4 +++- 3 files changed, 16 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH OLK-5.10 0/2] CVE-2023-53491 v2
by Lin Yujun 09 Dec '25

09 Dec '25

Lin Yujun (1): start_kernel: use unreachable too fix __noreturn build warning ndesaulniers(a)google.com (1): start_kernel: Add __no_stack_protector function attribute arch/powerpc/kernel/smp.c | 1 + include/linux/compiler_attributes.h | 12 ++++++++++++ init/main.c | 4 +++- 3 files changed, 16 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[openeuler:OLK-6.6 3493/3493] mm/dynamic_pool.c:1577:25: sparse: sparse: symbol 'pagelist_dpool_ops' was not declared. Should it be static?
by kernel test robot 09 Dec '25

09 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 0189df7df2ef7f7dbbabf7ff8398e45adf306e24 commit: cf98ffbc116bc49dc4506c68e20b02e26519ad35 [3493/3493] mm/dynamic_pool: fill dpool with pagelist config: x86_64-randconfig-r122-20251209 (https://download.01.org/0day-ci/archive/20251209/202512091544.YzqAeHFm-lkp@…) compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251209/202512091544.YzqAeHFm-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512091544.YzqAeHFm-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) mm/dynamic_pool.c:999:55: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct cgroup_subsys_state *css @@ got struct cgroup_subsys_state [noderef] __rcu * @@ mm/dynamic_pool.c:999:55: sparse: expected struct cgroup_subsys_state *css mm/dynamic_pool.c:999:55: sparse: got struct cgroup_subsys_state [noderef] __rcu * >> mm/dynamic_pool.c:1577:25: sparse: sparse: symbol 'pagelist_dpool_ops' was not declared. Should it be static? vim +/pagelist_dpool_ops +1577 mm/dynamic_pool.c 1576 > 1577 struct dynamic_pool_ops pagelist_dpool_ops = { 1578 .fill_pool = dpool_fill_from_pagelist, 1579 .drain_pool = dpool_drain_to_pagelist, 1580 .restore_pool = dpool_migrate_used_pages, 1581 }; 1582 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] net/oenetcls: Prioritize oenetcls hooks over rps
by Yue Haibing 09 Dec '25

09 Dec '25

hulk inclusion category: cleanup bugzilla: https://gitee.com/openeuler/kernel/issues/ICBFCS -------------------------------- Prioritize oenetcls hooks over rps, clean up unnecessary oecls_rps goto statements. Signed-off-by: Yue Haibing <yuehaibing(a)huawei.com> --- net/core/dev.c | 29 +++++++++-------------------- 1 file changed, 9 insertions(+), 20 deletions(-) diff --git a/net/core/dev.c b/net/core/dev.c index df6c0ac02a5e..372bab73b8bf 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -5890,11 +5890,15 @@ static int netif_receive_skb_internal(struct sk_buff *skb) return NET_RX_SUCCESS; rcu_read_lock(); -#ifdef CONFIG_RPS #if IS_ENABLED(CONFIG_OENETCLS) - if (static_branch_unlikely(&oecls_rps_needed)) - goto oecls_rps; + if (static_branch_unlikely(&oecls_rps_needed)) { + if (oenetcls_skb_set_cpu(skb, enqueue_to_backlog, &ret)) { + rcu_read_unlock(); + return ret; + } + } #endif +#ifdef CONFIG_RPS if (static_branch_unlikely(&rps_needed)) { struct rps_dev_flow voidflow, *rflow = &voidflow; int cpu = get_rps_cpu(skb->dev, skb, &rflow); @@ -5906,15 +5910,6 @@ static int netif_receive_skb_internal(struct sk_buff *skb) } } #endif - -#if IS_ENABLED(CONFIG_OENETCLS) -oecls_rps: - if (oenetcls_skb_set_cpu(skb, enqueue_to_backlog, &ret)) { - rcu_read_unlock(); - return ret; - } -#endif - ret = __netif_receive_skb(skb); rcu_read_unlock(); return ret; @@ -5935,11 +5930,11 @@ static void netif_receive_skb_list_internal(struct list_head *head) list_splice_init(&sublist, head); rcu_read_lock(); -#ifdef CONFIG_RPS #if IS_ENABLED(CONFIG_OENETCLS) if (static_branch_unlikely(&oecls_rps_needed)) - goto oecls_rps_list; + oenetcls_skblist_set_cpu(head, enqueue_to_backlog); #endif +#ifdef CONFIG_RPS if (static_branch_unlikely(&rps_needed)) { list_for_each_entry_safe(skb, next, head, list) { struct rps_dev_flow voidflow, *rflow = &voidflow; @@ -5953,12 +5948,6 @@ static void netif_receive_skb_list_internal(struct list_head *head) } } #endif - -#if IS_ENABLED(CONFIG_OENETCLS) -oecls_rps_list: - oenetcls_skblist_set_cpu(head, enqueue_to_backlog); -#endif - __netif_receive_skb_list(head); rcu_read_unlock(); } -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] CVE-2023-53491
by Lin Yujun 09 Dec '25

09 Dec '25

Lin Yujun (1): start_kernel: use unreachable too fix __noreturn build warning ndesaulniers(a)google.com (1): start_kernel: Add __no_stack_protector function attribute arch/powerpc/kernel/smp.c | 1 + include/linux/compiler_attributes.h | 12 ++++++++++++ init/main.c | 4 +++- 3 files changed, 16 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/2] Bugfix for two issues
by Liu Mingrui 09 Dec '25

09 Dec '25

Bugfix for the following two issues Liu Mingrui (2): zcopy: Fix NULL pointer dereference while attach conflict with free zcopy: Fix softlockup while attach PUD-SIZE page drivers/misc/zcopy/zcopy.c | 5 +++++ 1 file changed, 5 insertions(+) -- 2.25.1

2 3

[PATCH OLK-5.10 0/3] Bugfix for three issues
by Liu Mingrui 09 Dec '25

09 Dec '25

Bugfix for the following issues: Liu Mingrui (3): zcopy: Fix invalid paging request while attach transhugepage to same addr zcopy: Fix softlockup while attach PUD-SIZE page zcopy: Fix NULL pointer dereference while attach conflict with free drivers/misc/zcopy/zcopy.c | 104 +++++++++++++++---------------------- 1 file changed, 42 insertions(+), 62 deletions(-) -- 2.25.1

2 4

[PATCH OLK-5.10] Bluetooth: hci_event: call disconnect callback before deleting conn
by Wang Liang 09 Dec '25

09 Dec '25

From: Pauli Virtanen <pav(a)iki.fi> mainline inclusion from mainline-v6.5-rc3 commit 7f7cfcb6f0825652973b780f248603e23f16ee90 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID0VIH CVE: CVE-2023-53673 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In hci_cs_disconnect, we do hci_conn_del even if disconnection failed. ISO, L2CAP and SCO connections refer to the hci_conn without hci_conn_get, so disconn_cfm must be called so they can clean up their conn, otherwise use-after-free occurs. ISO: ========================================================== iso_sock_connect:880: sk 00000000eabd6557 iso_connect_cis:356: 70:1a:b8:98:ff:a2 -> 28:3d:c2:4a:7e:da ... iso_conn_add:140: hcon 000000001696f1fd conn 00000000b6251073 hci_dev_put:1487: hci0 orig refcnt 17 __iso_chan_add:214: conn 00000000b6251073 iso_sock_clear_timer:117: sock 00000000eabd6557 state 3 ... hci_rx_work:4085: hci0 Event packet hci_event_packet:7601: hci0: event 0x0f hci_cmd_status_evt:4346: hci0: opcode 0x0406 hci_cs_disconnect:2760: hci0: status 0x0c hci_sent_cmd_data:3107: hci0 opcode 0x0406 hci_conn_del:1151: hci0 hcon 000000001696f1fd handle 2560 hci_conn_unlink:1102: hci0: hcon 000000001696f1fd hci_conn_drop:1451: hcon 00000000d8521aaf orig refcnt 2 hci_chan_list_flush:2780: hcon 000000001696f1fd hci_dev_put:1487: hci0 orig refcnt 21 hci_dev_put:1487: hci0 orig refcnt 20 hci_req_cmd_complete:3978: opcode 0x0406 status 0x0c ... <no iso_* activity on sk/conn> ... iso_sock_sendmsg:1098: sock 00000000dea5e2e0, sk 00000000eabd6557 BUG: kernel NULL pointer dereference, address: 0000000000000668 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-1.fc38 04/01/2014 RIP: 0010:iso_sock_sendmsg (net/bluetooth/iso.c:1112) bluetooth ========================================================== L2CAP: ================================================================== hci_cmd_status_evt:4359: hci0: opcode 0x0406 hci_cs_disconnect:2760: hci0: status 0x0c hci_sent_cmd_data:3085: hci0 opcode 0x0406 hci_conn_del:1151: hci0 hcon ffff88800c999000 handle 3585 hci_conn_unlink:1102: hci0: hcon ffff88800c999000 hci_chan_list_flush:2780: hcon ffff88800c999000 hci_chan_del:2761: hci0 hcon ffff88800c999000 chan ffff888018ddd280 ... BUG: KASAN: slab-use-after-free in hci_send_acl+0x2d/0x540 [bluetooth] Read of size 8 at addr ffff888018ddd298 by task bluetoothd/1175 CPU: 0 PID: 1175 Comm: bluetoothd Tainted: G E 6.4.0-rc4+ #2 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-1.fc38 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x5b/0x90 print_report+0xcf/0x670 ? __virt_addr_valid+0xf8/0x180 ? hci_send_acl+0x2d/0x540 [bluetooth] kasan_report+0xa8/0xe0 ? hci_send_acl+0x2d/0x540 [bluetooth] hci_send_acl+0x2d/0x540 [bluetooth] ? __pfx___lock_acquire+0x10/0x10 l2cap_chan_send+0x1fd/0x1300 [bluetooth] ? l2cap_sock_sendmsg+0xf2/0x170 [bluetooth] ? __pfx_l2cap_chan_send+0x10/0x10 [bluetooth] ? lock_release+0x1d5/0x3c0 ? mark_held_locks+0x1a/0x90 l2cap_sock_sendmsg+0x100/0x170 [bluetooth] sock_write_iter+0x275/0x280 ? __pfx_sock_write_iter+0x10/0x10 ? __pfx___lock_acquire+0x10/0x10 do_iter_readv_writev+0x176/0x220 ? __pfx_do_iter_readv_writev+0x10/0x10 ? find_held_lock+0x83/0xa0 ? selinux_file_permission+0x13e/0x210 do_iter_write+0xda/0x340 vfs_writev+0x1b4/0x400 ? __pfx_vfs_writev+0x10/0x10 ? __seccomp_filter+0x112/0x750 ? populate_seccomp_data+0x182/0x220 ? __fget_light+0xdf/0x100 ? do_writev+0x19d/0x210 do_writev+0x19d/0x210 ? __pfx_do_writev+0x10/0x10 ? mark_held_locks+0x1a/0x90 do_syscall_64+0x60/0x90 ? lockdep_hardirqs_on_prepare+0x149/0x210 ? do_syscall_64+0x6c/0x90 ? lockdep_hardirqs_on_prepare+0x149/0x210 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7ff45cb23e64 Code: 15 d1 1f 0d 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 80 3d 9d a7 0d 00 00 74 13 b8 14 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 48 83 ec 28 89 54 24 1c 48 89 RSP: 002b:00007fff21ae09b8 EFLAGS: 00000202 ORIG_RAX: 0000000000000014 RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007ff45cb23e64 RDX: 0000000000000001 RSI: 00007fff21ae0aa0 RDI: 0000000000000017 RBP: 00007fff21ae0aa0 R08: 000000000095a8a0 R09: 0000607000053f40 R10: 0000000000000001 R11: 0000000000000202 R12: 00007fff21ae0ac0 R13: 00000fffe435c150 R14: 00007fff21ae0a80 R15: 000060f000000040 </TASK> Allocated by task 771: kasan_save_stack+0x33/0x60 kasan_set_track+0x25/0x30 __kasan_kmalloc+0xaa/0xb0 hci_chan_create+0x67/0x1b0 [bluetooth] l2cap_conn_add.part.0+0x17/0x590 [bluetooth] l2cap_connect_cfm+0x266/0x6b0 [bluetooth] hci_le_remote_feat_complete_evt+0x167/0x310 [bluetooth] hci_event_packet+0x38d/0x800 [bluetooth] hci_rx_work+0x287/0xb20 [bluetooth] process_one_work+0x4f7/0x970 worker_thread+0x8f/0x620 kthread+0x17f/0x1c0 ret_from_fork+0x2c/0x50 Freed by task 771: kasan_save_stack+0x33/0x60 kasan_set_track+0x25/0x30 kasan_save_free_info+0x2e/0x50 ____kasan_slab_free+0x169/0x1c0 slab_free_freelist_hook+0x9e/0x1c0 __kmem_cache_free+0xc0/0x310 hci_chan_list_flush+0x46/0x90 [bluetooth] hci_conn_cleanup+0x7d/0x330 [bluetooth] hci_cs_disconnect+0x35d/0x530 [bluetooth] hci_cmd_status_evt+0xef/0x2b0 [bluetooth] hci_event_packet+0x38d/0x800 [bluetooth] hci_rx_work+0x287/0xb20 [bluetooth] process_one_work+0x4f7/0x970 worker_thread+0x8f/0x620 kthread+0x17f/0x1c0 ret_from_fork+0x2c/0x50 ================================================================== Fixes: b8d290525e39 ("Bluetooth: clean up connection in hci_cs_disconnect") Signed-off-by: Pauli Virtanen <pav(a)iki.fi> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Conflicts: net/bluetooth/hci_event.c [conflicts due to not merge 182ee45da083 ("Bluetooth: hci_sync: Rework hci_suspend_notifier")] Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/bluetooth/hci_event.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c index 037f923b433b..509ec9fd4865 100644 --- a/net/bluetooth/hci_event.c +++ b/net/bluetooth/hci_event.c @@ -2286,6 +2286,9 @@ static void hci_cs_disconnect(struct hci_dev *hdev, u8 status) mgmt_disconnect_failed(hdev, &conn->dst, conn->type, conn->dst_type, status); + /* Inform sockets conn is gone before we delete it */ + hci_disconn_cfm(conn, HCI_ERROR_UNSPECIFIED); + /* If the disconnection failed for any reason, the upper layer * does not retry to disconnect in current implementation. * Hence, we need to do some basic cleanup here and re-enable -- 2.34.1

2 1