- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] pinmux: fix race causing mux_owner NULL with active mux_usecount
by Xiongfeng Wang 29 Aug '25

29 Aug '25

From: Mukesh Ojha <mukesh.ojha(a)oss.qualcomm.com> stable inclusion from stable-6.6.102 commit 9b2a3e7189028aa7c4d53a84364f2ea9fb209787 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICUC98 CVE: CVE-2025-38632 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 0b075c011032f88d1cfde3b45d6dcf08b44140eb ] commit 5a3e85c3c397 ("pinmux: Use sequential access to access desc->pinmux data") tried to address the issue when two client of the same gpio calls pinctrl_select_state() for the same functionality, was resulting in NULL pointer issue while accessing desc->mux_owner. However, issue was not completely fixed due to the way it was handled and it can still result in the same NULL pointer. The issue occurs due to the following interleaving: cpu0 (process A) cpu1 (process B) pin_request() { pin_free() { mutex_lock() desc->mux_usecount--; //becomes 0 .. mutex_unlock() mutex_lock(desc->mux) desc->mux_usecount++; // becomes 1 desc->mux_owner = owner; mutex_unlock(desc->mux) mutex_lock(desc->mux) desc->mux_owner = NULL; mutex_unlock(desc->mux) This sequence leads to a state where the pin appears to be in use (`mux_usecount == 1`) but has no owner (`mux_owner == NULL`), which can cause NULL pointer on next pin_request on the same pin. Ensure that updates to mux_usecount and mux_owner are performed atomically under the same lock. Only clear mux_owner when mux_usecount reaches zero and no new owner has been assigned. Fixes: 5a3e85c3c397 ("pinmux: Use sequential access to access desc->pinmux data") Signed-off-by: Mukesh Ojha <mukesh.ojha(a)oss.qualcomm.com> Link: https://lore.kernel.org/20250708-pinmux-race-fix-v2-1-8ae9e8a0d1a1@oss.qual… Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/pinctrl/pinmux.c [wxf: fix conflicts because 'scoped_guard' is not introduced.] Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/pinctrl/pinmux.c | 20 +++++++++----------- 1 file changed, 9 insertions(+), 11 deletions(-) diff --git a/drivers/pinctrl/pinmux.c b/drivers/pinctrl/pinmux.c index 53fe25e9e8647..92cd855f37487 100644 --- a/drivers/pinctrl/pinmux.c +++ b/drivers/pinctrl/pinmux.c @@ -247,18 +247,7 @@ static const char *pin_free(struct pinctrl_dev *pctldev, int pin, return NULL; } } - mutex_unlock(&desc->mux_lock); - - /* - * If there is no kind of request function for the pin we just assume - * we got it by default and proceed. - */ - if (gpio_range && ops->gpio_disable_free) - ops->gpio_disable_free(pctldev, gpio_range, pin); - else if (ops->free) - ops->free(pctldev, pin); - mutex_lock(&desc->mux_lock); if (gpio_range) { owner = desc->gpio_owner; desc->gpio_owner = NULL; @@ -269,6 +258,15 @@ static const char *pin_free(struct pinctrl_dev *pctldev, int pin, } mutex_unlock(&desc->mux_lock); + /* + * If there is no kind of request function for the pin we just assume + * we got it by default and proceed. + */ + if (gpio_range && ops->gpio_disable_free) + ops->gpio_disable_free(pctldev, gpio_range, pin); + else if (ops->free) + ops->free(pctldev, pin); + module_put(pctldev->owner); return owner; -- 2.20.1

2 1

[PATCH OLK-5.10] f2fs: fix to avoid out-of-boundary access in devs.path
by Xiongfeng Wang 29 Aug '25

29 Aug '25

From: Chao Yu <chao(a)kernel.org> stable inclusion from stable-6.6.102 commit 345fc8d1838f3f8be7c8ed08d86a13dedef67136 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICUC9Y CVE: CVE-2025-38652 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5661998536af52848cc4d52a377e90368196edea ] - touch /mnt/f2fs/012345678901234567890123456789012345678901234567890123 - truncate -s $((1024*1024*1024)) \ /mnt/f2fs/012345678901234567890123456789012345678901234567890123 - touch /mnt/f2fs/file - truncate -s $((1024*1024*1024)) /mnt/f2fs/file - mkfs.f2fs /mnt/f2fs/012345678901234567890123456789012345678901234567890123 \ -c /mnt/f2fs/file - mount /mnt/f2fs/012345678901234567890123456789012345678901234567890123 \ /mnt/f2fs/loop [16937.192225] F2FS-fs (loop0): Mount Device [ 0]: /mnt/f2fs/012345678901234567890123456789012345678901234567890123\xff\x01, 511, 0 - 3ffff [16937.192268] F2FS-fs (loop0): Failed to find devices If device path length equals to MAX_PATH_LEN, sbi->devs.path[] may not end up w/ null character due to path array is fully filled, So accidently, fields locate after path[] may be treated as part of device path, result in parsing wrong device path. struct f2fs_dev_info { ... char path[MAX_PATH_LEN]; ... }; Let's add one byte space for sbi->devs.path[] to store null character of device path string. Fixes: 3c62be17d4f5 ("f2fs: support multiple devices") Signed-off-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- fs/f2fs/f2fs.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h index 49e74f45a5cd1..89b615765567c 100644 --- a/fs/f2fs/f2fs.h +++ b/fs/f2fs/f2fs.h @@ -1152,7 +1152,7 @@ struct f2fs_bio_info { #define RDEV(i) (raw_super->devs[i]) struct f2fs_dev_info { struct block_device *bdev; - char path[MAX_PATH_LEN]; + char path[MAX_PATH_LEN + 1]; unsigned int total_segments; block_t start_blk; block_t end_blk; -- 2.20.1

2 1

[PATCH OLK-6.6] pinmux: fix race causing mux_owner NULL with active mux_usecount
by Xiongfeng Wang 29 Aug '25

29 Aug '25

From: Mukesh Ojha <mukesh.ojha(a)oss.qualcomm.com> stable inclusion from stable-6.6.102 commit 9b2a3e7189028aa7c4d53a84364f2ea9fb209787 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICUC98 CVE: CVE-2025-38632 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 0b075c011032f88d1cfde3b45d6dcf08b44140eb ] commit 5a3e85c3c397 ("pinmux: Use sequential access to access desc->pinmux data") tried to address the issue when two client of the same gpio calls pinctrl_select_state() for the same functionality, was resulting in NULL pointer issue while accessing desc->mux_owner. However, issue was not completely fixed due to the way it was handled and it can still result in the same NULL pointer. The issue occurs due to the following interleaving: cpu0 (process A) cpu1 (process B) pin_request() { pin_free() { mutex_lock() desc->mux_usecount--; //becomes 0 .. mutex_unlock() mutex_lock(desc->mux) desc->mux_usecount++; // becomes 1 desc->mux_owner = owner; mutex_unlock(desc->mux) mutex_lock(desc->mux) desc->mux_owner = NULL; mutex_unlock(desc->mux) This sequence leads to a state where the pin appears to be in use (`mux_usecount == 1`) but has no owner (`mux_owner == NULL`), which can cause NULL pointer on next pin_request on the same pin. Ensure that updates to mux_usecount and mux_owner are performed atomically under the same lock. Only clear mux_owner when mux_usecount reaches zero and no new owner has been assigned. Fixes: 5a3e85c3c397 ("pinmux: Use sequential access to access desc->pinmux data") Signed-off-by: Mukesh Ojha <mukesh.ojha(a)oss.qualcomm.com> Link: https://lore.kernel.org/20250708-pinmux-race-fix-v2-1-8ae9e8a0d1a1@oss.qual… Signed-off-by: Linus Walleij <linus.walleij(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/pinctrl/pinmux.c | 20 +++++++++----------- 1 file changed, 9 insertions(+), 11 deletions(-) diff --git a/drivers/pinctrl/pinmux.c b/drivers/pinctrl/pinmux.c index 97e8af88df85..ab853d6c586b 100644 --- a/drivers/pinctrl/pinmux.c +++ b/drivers/pinctrl/pinmux.c @@ -238,18 +238,7 @@ static const char *pin_free(struct pinctrl_dev *pctldev, int pin, if (desc->mux_usecount) return NULL; } - } - - /* - * If there is no kind of request function for the pin we just assume - * we got it by default and proceed. - */ - if (gpio_range && ops->gpio_disable_free) - ops->gpio_disable_free(pctldev, gpio_range, pin); - else if (ops->free) - ops->free(pctldev, pin); - scoped_guard(mutex, &desc->mux_lock) { if (gpio_range) { owner = desc->gpio_owner; desc->gpio_owner = NULL; @@ -260,6 +249,15 @@ static const char *pin_free(struct pinctrl_dev *pctldev, int pin, } } + /* + * If there is no kind of request function for the pin we just assume + * we got it by default and proceed. + */ + if (gpio_range && ops->gpio_disable_free) + ops->gpio_disable_free(pctldev, gpio_range, pin); + else if (ops->free) + ops->free(pctldev, pin); + module_put(pctldev->owner); return owner; -- 2.20.1

2 1

[openeuler:OLK-6.6 2784/2784] arch/arm64/kernel/idle.c:51:5: warning: no previous prototype for function 'is_sibling_idle'
by kernel test robot 28 Aug '25

28 Aug '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: ed9bff77568b702badeef2b7c7776bb93d993768 commit: a91091aed1fa925eef3085facb44c4826b317f39 [2784/2784] sched: More flexible use of CPU quota when CPU is idle config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20250828/202508282129.EDKxrS6o-lkp@…) compiler: clang version 19.1.7 (https://github.com/llvm/llvm-project cd708029e0b2869e80abe31ddb175f7c35361f90) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250828/202508282129.EDKxrS6o-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202508282129.EDKxrS6o-lkp@intel.com/ All warnings (new ones prefixed by >>): >> arch/arm64/kernel/idle.c:51:5: warning: no previous prototype for function 'is_sibling_idle' [-Wmissing-prototypes] 51 | int is_sibling_idle(void) | ^ arch/arm64/kernel/idle.c:51:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 51 | int is_sibling_idle(void) | ^ | static 1 warning generated. -- kernel/sched/fair.c:7235:6: warning: no previous prototype for function 'free_affinity_domains' [-Wmissing-prototypes] 7235 | void free_affinity_domains(struct affinity_domain *ad) | ^ kernel/sched/fair.c:7235:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 7235 | void free_affinity_domains(struct affinity_domain *ad) | ^ | static >> kernel/sched/fair.c:15430:12: warning: no previous prototype for function 'is_sibling_idle' [-Wmissing-prototypes] 15430 | int __weak is_sibling_idle(void) | ^ kernel/sched/fair.c:15430:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 15430 | int __weak is_sibling_idle(void) | ^ | static kernel/sched/fair.c:730:19: warning: unused function 'max_vruntime' [-Wunused-function] 730 | static inline u64 max_vruntime(u64 max_vruntime, u64 vruntime) | ^~~~~~~~~~~~ 3 warnings generated. vim +/is_sibling_idle +51 arch/arm64/kernel/idle.c 50 > 51 int is_sibling_idle(void) 52 { 53 return this_cpu_read(sibling_idle); 54 } 55 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2784/2784] net/oenetcls/oenetcls_flow.c:18:6: warning: no previous prototype for function 'is_oecls_config_netdev'
by kernel test robot 28 Aug '25

28 Aug '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: ed9bff77568b702badeef2b7c7776bb93d993768 commit: 4bed6ba0e88f50484fd5fb06bd993727b981b718 [2784/2784] net/oenetcls: introduce oenetcls for network optimization config: loongarch-allmodconfig (https://download.01.org/0day-ci/archive/20250828/202508282115.FeEkHc1L-lkp@…) compiler: clang version 19.1.7 (https://github.com/llvm/llvm-project cd708029e0b2869e80abe31ddb175f7c35361f90) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250828/202508282115.FeEkHc1L-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202508282115.FeEkHc1L-lkp@intel.com/ All warnings (new ones prefixed by >>): >> net/oenetcls/oenetcls_flow.c:18:6: warning: no previous prototype for function 'is_oecls_config_netdev' [-Wmissing-prototypes] 18 | bool is_oecls_config_netdev(const char *name) | ^ net/oenetcls/oenetcls_flow.c:18:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 18 | bool is_oecls_config_netdev(const char *name) | ^ | static 1 warning generated. vim +/is_oecls_config_netdev +18 net/oenetcls/oenetcls_flow.c 17 > 18 bool is_oecls_config_netdev(const char *name) 19 { 20 struct oecls_netdev_info *netdev_info; 21 int netdev_loop; 22 23 for_each_oecls_netdev(netdev_loop, netdev_info) 24 if (strcmp(netdev_info->dev_name, name) == 0) 25 return true; 26 27 return false; 28 } 29 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/1] irqchip/gicv3-its: Add workaround for HIP09/HIP10/HIP10C erratum 162100803/162200807/162400807
by Jinqian Yang 28 Aug '25

28 Aug '25

Zhou Wang (1): irqchip/gicv3-its: Add workaround for HIP09/HIP10/HIP10C erratum 162100803/162200807/162400807 arch/arm64/Kconfig | 13 ++++ drivers/irqchip/irq-gic-v3-its.c | 114 +++++++++++++++++++++++++++---- 2 files changed, 113 insertions(+), 14 deletions(-) -- 2.33.0

2 2

[PATCH OLK-6.6 0/1] KVM: arm64: fix the issue of vNMI not supporting live migration
by Jinqian Yang 28 Aug '25

28 Aug '25

Jinqian Yang (1): KVM: arm64: fix the issue of vNMI not supporting live migration arch/arm64/kvm/vgic/vgic-mmio-v3.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) -- 2.33.0

2 2

[PATCH OLK-5.10 0/3] page_pool: Fix use-after-free in page_pool_recycle_in_ring
by Dong Chenchen 28 Aug '25

28 Aug '25

Fix use-after-free in page_pool_recycle_in_ring Dong Chenchen (1): page_pool: Fix use-after-free in page_pool_recycle_in_ring Qingfang DENG (1): net: page_pool: use in_softirq() instead Yunsheng Lin (1): page_pool: fix inconsistency for page_pool_ring_[un]lock() include/net/page_pool.h | 18 ------------- net/core/page_pool.c | 58 +++++++++++++++++++++++++++++------------ 2 files changed, 41 insertions(+), 35 deletions(-) -- 2.25.1

2 4

[PATCH OLK-6.6 0/1] gic: increase the arch_timer
by Qinxin Xia 28 Aug '25

28 Aug '25

driver inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/ICUJ1T ---------------------------------------------------------------------- Qinxin Xia (1): gic: increase the arch_timer priority to avoid hardlockup arch/arm64/Kconfig | 11 +++++++ arch/arm64/configs/openeuler_defconfig | 1 + drivers/clocksource/arm_arch_timer.c | 44 ++++++++++++++++++++++++++ drivers/irqchip/irq-gic-v3.c | 2 +- include/linux/irqchip/arm-gic-v3.h | 4 +++ 5 files changed, 61 insertions(+), 1 deletion(-) -- 2.33.0

2 2

[PATCH OLK-5.10] iwlwifi: Add missing check for alloc_ordered_workqueue
by Ziming Du 28 Aug '25

28 Aug '25

From: Jiasheng Jiang <jiasheng(a)iscas.ac.cn> stable inclusion from stable-v6.1.148 commit 6663c52608d8d8727bf1911e6d9218069ba1c85e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICU6EY CVE: CVE-2025-38602 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 90a0d9f339960448a3acc1437a46730f975efd6a ] Add check for the return value of alloc_ordered_workqueue since it may return NULL pointer. Fixes: b481de9ca074 ("[IWLWIFI]: add iwlwifi wireless drivers") Signed-off-by: Jiasheng Jiang <jiasheng(a)iscas.ac.cn> Link: https://patch.msgid.link/20230110014848.28226-1-jiasheng@iscas.ac.cn Signed-off-by: Miri Korenblit <miriam.rachel.korenblit(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ziming Du <duziming2(a)huawei.com> --- drivers/net/wireless/intel/iwlwifi/dvm/main.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/main.c b/drivers/net/wireless/intel/iwlwifi/dvm/main.c index 461af58311561..d371889e03853 100644 --- a/drivers/net/wireless/intel/iwlwifi/dvm/main.c +++ b/drivers/net/wireless/intel/iwlwifi/dvm/main.c @@ -1054,9 +1054,11 @@ static void iwl_bg_restart(struct work_struct *data) * *****************************************************************************/ -static void iwl_setup_deferred_work(struct iwl_priv *priv) +static int iwl_setup_deferred_work(struct iwl_priv *priv) { priv->workqueue = alloc_ordered_workqueue(DRV_NAME, 0); + if (!priv->workqueue) + return -ENOMEM; INIT_WORK(&priv->restart, iwl_bg_restart); INIT_WORK(&priv->beacon_update, iwl_bg_beacon_update); @@ -1073,6 +1075,8 @@ static void iwl_setup_deferred_work(struct iwl_priv *priv) timer_setup(&priv->statistics_periodic, iwl_bg_statistics_periodic, 0); timer_setup(&priv->ucode_trace, iwl_bg_ucode_trace, 0); + + return 0; } void iwl_cancel_deferred_work(struct iwl_priv *priv) @@ -1462,7 +1466,9 @@ static struct iwl_op_mode *iwl_op_mode_dvm_start(struct iwl_trans *trans, /******************** * 6. Setup services ********************/ - iwl_setup_deferred_work(priv); + if (iwl_setup_deferred_work(priv)) + goto out_uninit_drv; + iwl_setup_rx_handlers(priv); iwl_power_initialize(priv); @@ -1500,6 +1506,7 @@ static struct iwl_op_mode *iwl_op_mode_dvm_start(struct iwl_trans *trans, iwl_cancel_deferred_work(priv); destroy_workqueue(priv->workqueue); priv->workqueue = NULL; +out_uninit_drv: iwl_uninit_drv(priv); out_free_eeprom_blob: kfree(priv->eeprom_blob); -- 2.43.0

2 1