- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10 0/2] *** CVE-2026-98343 ***
by Hongtao Zhang 03 Nov '26

03 Nov '26

*** BLURB HERE *** Shivank Garg (2): dmaengine: Fix device kref underflow in dma_chan_put() dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel() drivers/dma/dmaengine.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) -- 2.43.0

2 3

[PATCH OLK-6.6 v4 00/18] MOC bypass cache
by Jiacheng Yu 03 Nov '26

03 Nov '26

The MOC (MemoryOnChip) bypass cache feature uses the Arm Page Based Hardware Attributes (PBHA, FEAT_HPDS2) to describe per-mapping performance hints. MOC memory is not cached in the system cache, so the OS has to be told which pages may be mapped with the MOC attribute. This series adds: - stage1 PBHA support, discovered from the device tree or from the EFI stub - KVM stage2 support, including the VTCR_EL2.PBHA override mask - page based control: PROT_PBHA_BIT0, VM_PBHA_BIT0, prctl and /proc/<pid>/pbha_bit0 - the pbha= boot parameter and the MOC mode plumbing in the EFI stub Based on OLK-6.6. Changes in v4: - restore %ld when printing the static key state; %d broke the aarch64 build with -Werror=format Changes in v3: - dt-bindings: update the six stale references to arm/cpu.yaml, add the maintainers entry and fix the description - fix the for-loop style in the PBHA parsing code - move pbha.rst to Documentation/arch/arm64/ - use a free vm_flags bit for VM_PBHA_BIT0 and document the p0 mnemonic - drop the set_huge_pte_at() find_vma() lookup; the hint is carried by vm_page_prot - rewrite a live THP pmd through pmdp_invalidate_ad() - take an mm reference in pbha_bit0_read() - add a .hugetlb_entry callback so /proc/<pid>/pbha_bit0 and prctl update hugetlb mappings as well - limit the global-init flagging to current->mm - base the "nothing to do" decision on the actual VMA state instead of mm->def_flags - reject a NULL or unrecognized pbha= value Fanhua Li (2): arm64: mm: Set PBHA0 bit for VM_PBHA_BIT0 arm64: mm: Introduce procfs interface to update PBHA0 bit James Morse (7): KVM: arm64: Detect and enable PBHA for stage2 dt-bindings: Rename the description of cpu nodes cpu.yaml dt-bindings: arm: Add binding for Page Based Hardware Attributes arm64: cpufeature: Enable PBHA bits for stage1 arm64: mm: Add pgprot_pbha() to allow drivers to request PBHA values KVM: arm64: Configure PBHA bits for stage2 Documentation: arm64: Describe the support and expectations for PBHA Ma Wupeng (9): arm64: cpufeature: Enable PBHA for stage1 early via FDT arm64: mm: Detect and enable PBHA bit0 at early startup arm64: mm: Update kernel pte entries if pbha bit0 enabled arm64: mm: Show PBHA bit 59 as PBHA0 in ptdump arm64: mm: Introduce VM_PBHA_BIT0 to enable pbha bit0 for single vma arm64: mm: Set flag VM_PBHA_BIT0 for global init task arm64: mm: Introduce prctl to control pbha behavior arm64: mm: Introduce kernel param pbha openeuler: configs: arm64: Enable PBHA by default .../admin-guide/kernel-parameters.txt | 7 + Documentation/admin-guide/mm/pagemap.rst | 4 +- Documentation/arch/arm64/index.rst | 1 + Documentation/arch/arm64/pbha.rst | 87 +++ .../devicetree/bindings/arm/cpu.yaml | 578 ++++++++++++++++ .../devicetree/bindings/arm/cpus.yaml | 622 ++---------------- .../devicetree/bindings/cpu/cpu-capacity.txt | 2 +- .../devicetree/bindings/cpu/cpu-topology.txt | 2 +- .../devicetree/bindings/cpu/idle-states.yaml | 2 +- .../interrupt-controller/apple,aic.yaml | 2 +- .../interrupt-controller/apple,aic2.yaml | 2 +- .../interrupt-controller/arm,gic-v3.yaml | 2 +- Documentation/filesystems/proc.rst | 1 + arch/arm64/Kconfig | 19 + arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/cpufeature.h | 15 + arch/arm64/include/asm/kvm_arm.h | 1 + arch/arm64/include/asm/kvm_pgtable.h | 9 + arch/arm64/include/asm/mman.h | 7 + arch/arm64/include/asm/pgtable-hwdef.h | 6 + arch/arm64/include/asm/pgtable.h | 26 + arch/arm64/include/asm/setup.h | 1 + arch/arm64/include/uapi/asm/mman.h | 1 + arch/arm64/kernel/cpufeature.c | 258 ++++++++ arch/arm64/kernel/head.S | 3 + arch/arm64/kernel/image-vars.h | 2 + arch/arm64/kvm/hyp/pgtable.c | 16 +- arch/arm64/mm/fixmap.c | 2 + arch/arm64/mm/mmap.c | 3 + arch/arm64/mm/mmu.c | 13 +- arch/arm64/mm/ptdump.c | 5 + arch/arm64/tools/cpucaps | 6 +- .../firmware/efi/libstub/efi-stub-helper.c | 3 + drivers/firmware/efi/libstub/fdt.c | 52 ++ drivers/soc/hisilicon/Makefile | 1 + drivers/soc/hisilicon/pbha.c | 265 ++++++++ fs/proc/base.c | 124 ++++ fs/proc/task_mmu.c | 18 + include/linux/mm.h | 8 +- include/linux/pbha.h | 93 +++ include/uapi/asm-generic/mman-common.h | 1 + include/uapi/linux/prctl.h | 1 + kernel/sys.c | 10 + mm/memory.c | 4 + mm/vmalloc.c | 4 + tools/include/uapi/asm-generic/mman-common.h | 1 + 46 files changed, 1725 insertions(+), 566 deletions(-) create mode 100644 Documentation/arch/arm64/pbha.rst create mode 100644 Documentation/devicetree/bindings/arm/cpu.yaml create mode 100644 drivers/soc/hisilicon/pbha.c create mode 100644 include/linux/pbha.h

2 19

[PATCH OLK-6.6 0/2] Fix CVE-2026-97480 for OLK-6.6
by Yi Yang 03 Nov '26

03 Nov '26

*** BLURB HERE *** Jiri Slaby (SUSE) (1): serial: 8250: invert serial8250_register_8250_port() CIR condition Stepan Ionichev (1): tty: serial: 8250: protect against NULL uart->port.dev in register drivers/tty/serial/8250/8250_core.c | 253 ++++++++++++++-------------- 1 file changed, 127 insertions(+), 126 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10] vfio/pci: clear vdev->msi_perm after freeing it on init failure
by Zhang Yuwei 03 Nov '26

03 Nov '26

From: Xiang Mei <xmei5(a)asu.edu> stable inclusion from stable-v5.10.270 commit eb84cd81040e58dd05ac190f561f2115e3367249 category: bugfix bugzilla: https://gitcode.com/src-openeuler/kernel/issues/21108 CVE: CVE-2026-89777 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit dc77acfeb979dded39b247b60fef0399536bfa77 ] vfio_msi_cap_len() lazily allocates the per-device MSI permission table: vdev->msi_perm = kmalloc_obj(struct perm_bits, GFP_KERNEL_ACCOUNT); if (!vdev->msi_perm) return -ENOMEM; ret = init_pci_cap_msi_perm(vdev->msi_perm, len, flags); if (ret) { kfree(vdev->msi_perm); return ret; /* vdev->msi_perm left dangling */ } When init_pci_cap_msi_perm() -> alloc_perm_bits() fails with -ENOMEM, the error path frees vdev->msi_perm but leaves the freed pointer stored in it. vdev->msi_perm is not re-zeroed later because struct vfio_pci_core_device is per-device and persists across open/close cycles, and the vfio_config_init() error path returns without calling vfio_config_free(). So the dangling pointer outlives the failed open. That leads to two use-after-frees on the same device: 1. Reuse. The next vfio_config_init() sees the stale pointer at "if (vdev->msi_perm) return len;" and reuses the freed object. MSI config accesses in vfio_pci_config_rw_single() then dereference and call the freed perm->readfn / perm->writefn function pointers. 2. Double free. A later vfio_config_free() runs free_perm_bits() and kfree() on the already-freed object. Fix it by NULLing vdev->msi_perm after the kfree(), matching the NULL-after-free discipline already used in free_perm_bits() and vfio_config_free(). BUG: KASAN: slab-use-after-free in vfio_pci_config_rw_single (drivers/vfio/pci/vfio_pci_config.c:1961) Read of size 8 at addr ffff88800fcc88d0 by task exploit/143 Call Trace: ... kasan_report (mm/kasan/report.c:595) vfio_pci_config_rw_single (drivers/vfio/pci/vfio_pci_config.c:1961) vfio_pci_config_rw (drivers/vfio/pci/vfio_pci_config.c:1986) vfio_pci_rw (drivers/vfio/pci/vfio_pci_core.c:1599) vfs_read (fs/read_write.c:572) __x64_sys_pread64 (fs/read_write.c:764) do_syscall_64 (arch/x86/entry/syscall_64.c:94) ... Followed on device close by a double free of the same object: Oops: general protection fault, probably for non-canonical address 0x1f63e0e8000008: 0000 [#1] SMP KASAN NOPTI RIP: 0010:kfree (mm/slub.c:6711) Call Trace: vfio_config_free (drivers/vfio/pci/vfio_pci_config.c:1861) vfio_pci_core_disable (drivers/vfio/pci/vfio_pci_core.c:685) vfio_pci_core_close_device (drivers/vfio/pci/vfio_pci_core.c:777) vfio_df_close (drivers/vfio/vfio_main.c:602) vfio_device_fops_release (drivers/vfio/vfio_main.c:648) __fput (fs/file_table.c:512) __x64_sys_close (fs/open.c:1496) do_syscall_64 (arch/x86/entry/syscall_64.c:94) ... Kernel panic - not syncing: Fatal exception Fixes: 30ea32ab1951 ("vfio/pci: Fix potential memory leak in vfio_msi_cap_len") Reported-by: Weiming Shi <bestswngs(a)gmail.com> Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Xiang Mei <xmei5(a)asu.edu> Link: https://lore.kernel.org/r/20260705014010.1297885-1-xmei5@asu.edu Signed-off-by: Alex Williamson <alex(a)shazbot.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Hulk Robot <hulkrobot(a)huawei.com> --- drivers/vfio/pci/vfio_pci_config.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/vfio/pci/vfio_pci_config.c b/drivers/vfio/pci/vfio_pci_config.c index 7a4b7b8b432c..a23e4975694f 100644 --- a/drivers/vfio/pci/vfio_pci_config.c +++ b/drivers/vfio/pci/vfio_pci_config.c @@ -1221,6 +1221,7 @@ static int vfio_msi_cap_len(struct vfio_pci_device *vdev, u8 pos) ret = init_pci_cap_msi_perm(vdev->msi_perm, len, flags); if (ret) { kfree(vdev->msi_perm); + vdev->msi_perm = NULL; return ret; } -- 2.22.0

2 1

[PATCH OLK-5.10] vfio/pci: clear vdev->msi_perm after freeing it on init failure
by Zhang Yuwei 03 Nov '26

03 Nov '26

From: Xiang Mei <xmei5(a)asu.edu> stable inclusion from stable-v5.10.270 commit eb84cd81040e58dd05ac190f561f2115e3367249 category: bugfix bugzilla: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit dc77acfeb979dded39b247b60fef0399536bfa77 ] vfio_msi_cap_len() lazily allocates the per-device MSI permission table: vdev->msi_perm = kmalloc_obj(struct perm_bits, GFP_KERNEL_ACCOUNT); if (!vdev->msi_perm) return -ENOMEM; ret = init_pci_cap_msi_perm(vdev->msi_perm, len, flags); if (ret) { kfree(vdev->msi_perm); return ret; /* vdev->msi_perm left dangling */ } When init_pci_cap_msi_perm() -> alloc_perm_bits() fails with -ENOMEM, the error path frees vdev->msi_perm but leaves the freed pointer stored in it. vdev->msi_perm is not re-zeroed later because struct vfio_pci_core_device is per-device and persists across open/close cycles, and the vfio_config_init() error path returns without calling vfio_config_free(). So the dangling pointer outlives the failed open. That leads to two use-after-frees on the same device: 1. Reuse. The next vfio_config_init() sees the stale pointer at "if (vdev->msi_perm) return len;" and reuses the freed object. MSI config accesses in vfio_pci_config_rw_single() then dereference and call the freed perm->readfn / perm->writefn function pointers. 2. Double free. A later vfio_config_free() runs free_perm_bits() and kfree() on the already-freed object. Fix it by NULLing vdev->msi_perm after the kfree(), matching the NULL-after-free discipline already used in free_perm_bits() and vfio_config_free(). BUG: KASAN: slab-use-after-free in vfio_pci_config_rw_single (drivers/vfio/pci/vfio_pci_config.c:1961) Read of size 8 at addr ffff88800fcc88d0 by task exploit/143 Call Trace: ... kasan_report (mm/kasan/report.c:595) vfio_pci_config_rw_single (drivers/vfio/pci/vfio_pci_config.c:1961) vfio_pci_config_rw (drivers/vfio/pci/vfio_pci_config.c:1986) vfio_pci_rw (drivers/vfio/pci/vfio_pci_core.c:1599) vfs_read (fs/read_write.c:572) __x64_sys_pread64 (fs/read_write.c:764) do_syscall_64 (arch/x86/entry/syscall_64.c:94) ... Followed on device close by a double free of the same object: Oops: general protection fault, probably for non-canonical address 0x1f63e0e8000008: 0000 [#1] SMP KASAN NOPTI RIP: 0010:kfree (mm/slub.c:6711) Call Trace: vfio_config_free (drivers/vfio/pci/vfio_pci_config.c:1861) vfio_pci_core_disable (drivers/vfio/pci/vfio_pci_core.c:685) vfio_pci_core_close_device (drivers/vfio/pci/vfio_pci_core.c:777) vfio_df_close (drivers/vfio/vfio_main.c:602) vfio_device_fops_release (drivers/vfio/vfio_main.c:648) __fput (fs/file_table.c:512) __x64_sys_close (fs/open.c:1496) do_syscall_64 (arch/x86/entry/syscall_64.c:94) ... Kernel panic - not syncing: Fatal exception Fixes: 30ea32ab1951 ("vfio/pci: Fix potential memory leak in vfio_msi_cap_len") Reported-by: Weiming Shi <bestswngs(a)gmail.com> Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Xiang Mei <xmei5(a)asu.edu> Link: https://lore.kernel.org/r/20260705014010.1297885-1-xmei5@asu.edu Signed-off-by: Alex Williamson <alex(a)shazbot.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Hulk Robot <hulkrobot(a)huawei.com> --- drivers/vfio/pci/vfio_pci_config.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/vfio/pci/vfio_pci_config.c b/drivers/vfio/pci/vfio_pci_config.c index 7a4b7b8b432c..a23e4975694f 100644 --- a/drivers/vfio/pci/vfio_pci_config.c +++ b/drivers/vfio/pci/vfio_pci_config.c @@ -1221,6 +1221,7 @@ static int vfio_msi_cap_len(struct vfio_pci_device *vdev, u8 pos) ret = init_pci_cap_msi_perm(vdev->msi_perm, len, flags); if (ret) { kfree(vdev->msi_perm); + vdev->msi_perm = NULL; return ret; } -- 2.22.0

2 1

[PATCH OLK-5.10 v2] md: Fix the null-ptr-deref of 'mddev->private' while submitting IO
by Zhou Minqiang 03 Nov '26

03 Nov '26

maillist inclusion category: bugfix bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=222020 Reference: https://lore.kernel.org/linux-raid/20260917024205.2331019-1-chengzhihao1@hu… -------------------------------- Concurrent processes md_stop and IO submitting could trigger a null-ptr-deref of 'mddev->private': BUG: kernel NULL pointer dereference, address: 0000000000000070 RIP: 0010:_wait_barrier+0x2f/0x250 Call Trace: raid1_make_request+0x150/0xf50 md_handle_request+0x104/0x530 md_submit_bio+0x76/0x130 submit_bio+0xdd/0x250 submit_bio_wait+0x1f/0x40 __blkdev_direct_IO_simple+0x1f6/0x370 blkdev_write_iter+0x3b2/0x520 ksys_write+0x7d/0x190 P1 fd = open(/dev/md0, O_RDWR) P2 (forked from P1, fd' <= fd) write(fd) submit_bio md_handle_request raid1_make_request raid1_write_request ioctl(fd, STOP_ARRAY) mddev_set_closing_and_sync_blockdev // check passed, mddev->openers = 1, // because md_open() is only called // once in P1->open do_md_stop __md_stop mddev->private = NULL conf = mddev->private // NULL wait_barrier(conf, sector) // null-ptr-deref ! It is a common problem for raid0/1/10/5, and __md_stop could be triggered by several paths(eg. ioctl, sysfs, ->dtr). Fix it by replacing mddev_lock() with mddev_suspend_and_lock() for all __md_stop() callers. The caller dm_table_destroy() is guaranteed being invoked with device suspended, so raid_dtr() could keep using mddev_lock_nointr(). Besides, fail the submitting IO in md_handle_request() if the 'mddev->pers' becomes NULL. Fetch a reproducer in https://bugzilla.kernel.org/show_bug.cgi?id=222020 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+3fe892ea5fc292e1353f(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3fe892ea5fc292e1353f Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Signed-off-by: Zhou Minqiang <zhouminqiang2(a)huawei.com> --- drivers/md/md.c | 70 +++++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 68 insertions(+), 2 deletions(-) diff --git a/drivers/md/md.c b/drivers/md/md.c index d00ceffb8812..54109499bd7b 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -445,7 +445,21 @@ void md_handle_request(struct mddev *mddev, struct bio *bio) } atomic_inc(&mddev->active_io); rcu_read_unlock(); - + if (!mddev->pers) { + /* + * The __md_stop() sets 'mddev->private' to NULL during + * the IO submitting, check 'mddev->pers' before the IO + * being processed by specific driver to avoid the + * null-ptr-deref of 'mddev-><member>'. The check is + * safe because the IO has got the 'mddev->active_io' + * reference, and all __md_stop() callers will wait for + * the reference to be zero. + */ + bio_io_error(bio); + if (atomic_dec_and_test(&mddev->active_io) && mddev->suspended) + wake_up(&mddev->sb_wait); + return; + } if (!mddev->pers->make_request(mddev, bio)) { atomic_dec(&mddev->active_io); wake_up(&mddev->sb_wait); @@ -489,6 +503,26 @@ static blk_qc_t md_submit_bio(struct bio *bio) return BLK_QC_T_NONE; } +static void __mddev_suspend(struct mddev *mddev) +{ + struct md_thread *thread = rcu_dereference_protected(mddev->thread, + lockdep_is_held(&mddev->reconfig_mutex)); + + WARN_ON_ONCE(thread && current == thread->tsk); + if (mddev->suspended++) + return; + synchronize_rcu(); + wake_up(&mddev->sb_wait); + set_bit(MD_ALLOW_SB_UPDATE, &mddev->flags); + smp_mb__after_atomic(); + wait_event(mddev->sb_wait, atomic_read(&mddev->active_io) == 0); + clear_bit_unlock(MD_ALLOW_SB_UPDATE, &mddev->flags); + wait_event(mddev->sb_wait, !test_bit(MD_UPDATING_SB, &mddev->flags)); + + /* restrict memory reclaim I/O during raid array is suspend */ + mddev->noio_flag = memalloc_noio_save(); +} + /* mddev_suspend makes sure no new requests are submitted * to the device, and that any requests that have been submitted * are completely handled. @@ -518,6 +552,22 @@ void mddev_suspend(struct mddev *mddev) } EXPORT_SYMBOL_GPL(mddev_suspend); +static void __mddev_resume(struct mddev *mddev) +{ + lockdep_assert_held(&mddev->reconfig_mutex); + if (--mddev->suspended) + return; + + /* entred the memalloc scope from mddev_suspend() */ + memalloc_noio_restore(mddev->noio_flag); + + wake_up(&mddev->sb_wait); + + set_bit(MD_RECOVERY_NEEDED, &mddev->recovery); + md_wakeup_thread(mddev->thread); + md_wakeup_thread(mddev->sync_thread); /* possibly kick off a reshape */ +} + void mddev_resume(struct mddev *mddev) { lockdep_assert_held(&mddev->reconfig_mutex); @@ -4433,6 +4483,7 @@ array_state_store(struct mddev *mddev, const char *buf, size_t len) { int err = 0; enum array_state st = match_word(buf, array_states); + bool suspend = false; if (mddev->pers && (st == active || st == clean) && mddev->ro != 1) { /* don't take reconfig_mutex when toggling between @@ -4454,9 +4505,16 @@ array_state_store(struct mddev *mddev, const char *buf, size_t len) spin_unlock(&mddev->lock); return err ?: len; } + if (st == inactive || st == clear) + suspend = true; + if (suspend) + __mddev_suspend(mddev); err = mddev_lock(mddev); - if (err) + if (err) { + if (suspend) + __mddev_resume(mddev); return err; + } err = -EINVAL; switch(st) { case bad_word: @@ -4536,6 +4594,8 @@ array_state_store(struct mddev *mddev, const char *buf, size_t len) mddev->hold_active = 0; sysfs_notify_dirent_safe(mddev->sysfs_state); } + if (suspend) + __mddev_resume(mddev); mddev_unlock(mddev); return err ?: len; } @@ -7670,8 +7730,12 @@ static int md_ioctl(struct block_device *bdev, fmode_t mode, mutex_unlock(&mddev->open_mutex); sync_blockdev(bdev); } + if (cmd == STOP_ARRAY) + __mddev_suspend(mddev); err = mddev_lock(mddev); if (err) { + if (cmd == STOP_ARRAY) + __mddev_resume(mddev); pr_debug("md: ioctl lock interrupted, reason %d, cmd %d\n", err, cmd); goto out; @@ -7858,6 +7922,8 @@ static int md_ioctl(struct block_device *bdev, fmode_t mode, err != -EINVAL) mddev->hold_active = 0; mddev_unlock(mddev); + if (cmd == STOP_ARRAY) + __mddev_resume(mddev); out: if(did_set_md_closing) clear_bit(MD_CLOSING, &mddev->flags); -- 2.52.0

2 1

[PATCH OLK-5.10] vfio/pci: clear vdev->msi_perm after freeing it on init failure
by Zhang Yuwei 03 Nov '26

03 Nov '26

From: Xiang Mei <xmei5(a)asu.edu> stable inclusion from stable-v5.10.270 commit eb84cd81040e58dd05ac190f561f2115e3367249 category: bugfix bugzilla: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit dc77acfeb979dded39b247b60fef0399536bfa77 ] vfio_msi_cap_len() lazily allocates the per-device MSI permission table: vdev->msi_perm = kmalloc_obj(struct perm_bits, GFP_KERNEL_ACCOUNT); if (!vdev->msi_perm) return -ENOMEM; ret = init_pci_cap_msi_perm(vdev->msi_perm, len, flags); if (ret) { kfree(vdev->msi_perm); return ret; /* vdev->msi_perm left dangling */ } When init_pci_cap_msi_perm() -> alloc_perm_bits() fails with -ENOMEM, the error path frees vdev->msi_perm but leaves the freed pointer stored in it. vdev->msi_perm is not re-zeroed later because struct vfio_pci_core_device is per-device and persists across open/close cycles, and the vfio_config_init() error path returns without calling vfio_config_free(). So the dangling pointer outlives the failed open. That leads to two use-after-frees on the same device: 1. Reuse. The next vfio_config_init() sees the stale pointer at "if (vdev->msi_perm) return len;" and reuses the freed object. MSI config accesses in vfio_pci_config_rw_single() then dereference and call the freed perm->readfn / perm->writefn function pointers. 2. Double free. A later vfio_config_free() runs free_perm_bits() and kfree() on the already-freed object. Fix it by NULLing vdev->msi_perm after the kfree(), matching the NULL-after-free discipline already used in free_perm_bits() and vfio_config_free(). BUG: KASAN: slab-use-after-free in vfio_pci_config_rw_single (drivers/vfio/pci/vfio_pci_config.c:1961) Read of size 8 at addr ffff88800fcc88d0 by task exploit/143 Call Trace: ... kasan_report (mm/kasan/report.c:595) vfio_pci_config_rw_single (drivers/vfio/pci/vfio_pci_config.c:1961) vfio_pci_config_rw (drivers/vfio/pci/vfio_pci_config.c:1986) vfio_pci_rw (drivers/vfio/pci/vfio_pci_core.c:1599) vfs_read (fs/read_write.c:572) __x64_sys_pread64 (fs/read_write.c:764) do_syscall_64 (arch/x86/entry/syscall_64.c:94) ... Followed on device close by a double free of the same object: Oops: general protection fault, probably for non-canonical address 0x1f63e0e8000008: 0000 [#1] SMP KASAN NOPTI RIP: 0010:kfree (mm/slub.c:6711) Call Trace: vfio_config_free (drivers/vfio/pci/vfio_pci_config.c:1861) vfio_pci_core_disable (drivers/vfio/pci/vfio_pci_core.c:685) vfio_pci_core_close_device (drivers/vfio/pci/vfio_pci_core.c:777) vfio_df_close (drivers/vfio/vfio_main.c:602) vfio_device_fops_release (drivers/vfio/vfio_main.c:648) __fput (fs/file_table.c:512) __x64_sys_close (fs/open.c:1496) do_syscall_64 (arch/x86/entry/syscall_64.c:94) ... Kernel panic - not syncing: Fatal exception Fixes: 30ea32ab1951 ("vfio/pci: Fix potential memory leak in vfio_msi_cap_len") Reported-by: Weiming Shi <bestswngs(a)gmail.com> Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Xiang Mei <xmei5(a)asu.edu> Link: https://lore.kernel.org/r/20260705014010.1297885-1-xmei5@asu.edu Signed-off-by: Alex Williamson <alex(a)shazbot.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Hulk Robot <hulkrobot(a)huawei.com> --- drivers/vfio/pci/vfio_pci_config.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/vfio/pci/vfio_pci_config.c b/drivers/vfio/pci/vfio_pci_config.c index 7a4b7b8b432c..a23e4975694f 100644 --- a/drivers/vfio/pci/vfio_pci_config.c +++ b/drivers/vfio/pci/vfio_pci_config.c @@ -1221,6 +1221,7 @@ static int vfio_msi_cap_len(struct vfio_pci_device *vdev, u8 pos) ret = init_pci_cap_msi_perm(vdev->msi_perm, len, flags); if (ret) { kfree(vdev->msi_perm); + vdev->msi_perm = NULL; return ret; } -- 2.22.0

2 1

[PATCH OLK-6.6] tty: fix saved termios reset race
by Gu Bowen 03 Nov '26

03 Nov '26

From: Johan Hovold <johan(a)kernel.org> stable inclusion from stable-v6.6.160 commit 6b4e15cccfbe03b7c6ae60ff570c401bfb1e51d6 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20428 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 8df07fe93573e9e548d6645273e9bcb6eb74059e ] Resetting saved termios state on device registration is needed where a minor number can be reused for an entirely different device and where the old settings may prevent the port from even being opened (e.g. when CLOCAL is not set). Not all TTY drivers guarantee that the minor number is no longer in use when registering devices however, something which can lead to a use-after-free when closing a TTY (and saving its termios) races with re-registration. Add a new TTY_DRIVER_RESET_SAVED_TERMIOS flag to request that any saved termios state is reset on registration and only set it for drivers that make sure that the minor number is no longer in use. Fixes: 93857edd9829 ("tty: reset termios state on device registration") Reported-by: Chengfeng Ye <nicoyip.dev(a)gmail.com> Link: https://lore.kernel.org/20260926184154.3017929-1-nicoyip.dev@gmail.com Cc: stable(a)kernel.org # 4.12 Signed-off-by: Johan Hovold <johan(a)kernel.org> Link: https://patch.msgid.link/20260930131845.1809256-1-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> [ sashal: Adapted TTY_DRIVER_RESET_SAVED_TERMIOS to the existing macro-based driver flag setup. ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- drivers/staging/greybus/uart.c | 3 ++- drivers/tty/tty_io.c | 18 ++++++++++-------- drivers/usb/class/cdc-acm.c | 2 +- drivers/usb/serial/usb-serial.c | 3 ++- include/linux/tty_driver.h | 6 ++++++ 5 files changed, 21 insertions(+), 11 deletions(-) diff --git a/drivers/staging/greybus/uart.c b/drivers/staging/greybus/uart.c index 526573556cda..f067f26fefcb 100644 --- a/drivers/staging/greybus/uart.c +++ b/drivers/staging/greybus/uart.c @@ -954,7 +954,8 @@ static int gb_tty_init(void) gb_tty_driver->minor_start = 0; gb_tty_driver->type = TTY_DRIVER_TYPE_SERIAL; gb_tty_driver->subtype = SERIAL_TYPE_NORMAL; - gb_tty_driver->flags = TTY_DRIVER_REAL_RAW | TTY_DRIVER_DYNAMIC_DEV; + gb_tty_driver->flags = TTY_DRIVER_REAL_RAW | TTY_DRIVER_DYNAMIC_DEV | + TTY_DRIVER_RESET_SAVED_TERMIOS; gb_tty_driver->init_termios = tty_std_termios; gb_tty_driver->init_termios.c_cflag = B9600 | CS8 | CREAD | HUPCL | CLOCAL; diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c index 4ff991cc9607..c1cffb241407 100644 --- a/drivers/tty/tty_io.c +++ b/drivers/tty/tty_io.c @@ -3255,14 +3255,16 @@ struct device *tty_register_device_attr(struct tty_driver *driver, goto err_put; if (!(driver->flags & TTY_DRIVER_DYNAMIC_ALLOC)) { - /* - * Free any saved termios data so that the termios state is - * reset when reusing a minor number. - */ - tp = driver->termios[index]; - if (tp) { - driver->termios[index] = NULL; - kfree(tp); + if (driver->flags & TTY_DRIVER_RESET_SAVED_TERMIOS) { + /* + * Free any saved termios data so that the termios + * state is reset when reusing a minor number. + */ + tp = driver->termios[index]; + if (tp) { + driver->termios[index] = NULL; + kfree(tp); + } } retval = tty_cdev_add(driver, devt, index, 1); diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c index 659884a46437..639af21e63f5 100644 --- a/drivers/usb/class/cdc-acm.c +++ b/drivers/usb/class/cdc-acm.c @@ -2140,7 +2140,7 @@ static int __init acm_init(void) { int retval; acm_tty_driver = tty_alloc_driver(ACM_TTY_MINORS, TTY_DRIVER_REAL_RAW | - TTY_DRIVER_DYNAMIC_DEV); + TTY_DRIVER_DYNAMIC_DEV | TTY_DRIVER_RESET_SAVED_TERMIOS); if (IS_ERR(acm_tty_driver)) return PTR_ERR(acm_tty_driver); acm_tty_driver->driver_name = "acm", diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c index 08c673f4e572..878b4defdec4 100644 --- a/drivers/usb/serial/usb-serial.c +++ b/drivers/usb/serial/usb-serial.c @@ -1372,7 +1372,8 @@ static int __init usb_serial_init(void) int result; usb_serial_tty_driver = tty_alloc_driver(USB_SERIAL_TTY_MINORS, - TTY_DRIVER_REAL_RAW | TTY_DRIVER_DYNAMIC_DEV); + TTY_DRIVER_REAL_RAW | TTY_DRIVER_DYNAMIC_DEV | + TTY_DRIVER_RESET_SAVED_TERMIOS); if (IS_ERR(usb_serial_tty_driver)) return PTR_ERR(usb_serial_tty_driver); diff --git a/include/linux/tty_driver.h b/include/linux/tty_driver.h index aaaab5095d7c..8bf92a986dbf 100644 --- a/include/linux/tty_driver.h +++ b/include/linux/tty_driver.h @@ -544,6 +544,11 @@ static inline void tty_set_operations(struct tty_driver *driver, * Do not create numbered ``/dev`` nodes. For example, create * ``/dev/ttyprintk`` and not ``/dev/ttyprintk0``. Applicable only when a * driver for a single tty device is being allocated. + * + * TTY_DRIVER_RESET_SAVED_TERMIOS + * Reset any saved termios settings on device registration when reusing a + * minor number. Must only be set by drivers that guarantee that the minor + * number is no longer in use. */ #define TTY_DRIVER_INSTALLED 0x0001 #define TTY_DRIVER_RESET_TERMIOS 0x0002 @@ -553,6 +558,7 @@ static inline void tty_set_operations(struct tty_driver *driver, #define TTY_DRIVER_HARDWARE_BREAK 0x0020 #define TTY_DRIVER_DYNAMIC_ALLOC 0x0040 #define TTY_DRIVER_UNNUMBERED_NODE 0x0080 +#define TTY_DRIVER_RESET_SAVED_TERMIOS 0x0200 /* tty driver types */ #define TTY_DRIVER_TYPE_SYSTEM 0x0001 -- 2.43.0

2 1

[PATCH OLK-6.6 v3 00/18] MOC bypass cache
by Jiacheng Yu 03 Nov '26

03 Nov '26

The MOC (MemoryOnChip) bypass cache feature uses the Arm Page Based Hardware Attributes (PBHA, FEAT_HPDS2) to describe per-mapping performance hints. MOC memory is not cached in the system cache, so the OS has to be told which pages may be mapped with the MOC attribute. This series adds: - stage1 PBHA support, discovered from the device tree or from the EFI stub - KVM stage2 support, including the VTCR_EL2.PBHA override mask - page based control: PROT_PBHA_BIT0, VM_PBHA_BIT0, prctl and /proc/<pid>/pbha_bit0 - the pbha= boot parameter and the MOC mode plumbing in the EFI stub Based on OLK-6.6. Changes in v3: - dt-bindings: update the six stale references to arm/cpu.yaml, add the maintainers entry and fix the description - fix the for-loop style in the PBHA parsing code - move pbha.rst to Documentation/arch/arm64/ - use a free vm_flags bit for VM_PBHA_BIT0 and document the p0 mnemonic - drop the set_huge_pte_at() find_vma() lookup; the hint is carried by vm_page_prot - rewrite a live THP pmd through pmdp_invalidate_ad() - take an mm reference in pbha_bit0_read() - add a .hugetlb_entry callback so /proc/<pid>/pbha_bit0 and prctl update hugetlb mappings as well - limit the global-init flagging to current->mm and refresh vm_page_prot - base the "nothing to do" decision on the actual VMA state instead of mm->def_flags - reject a NULL or unrecognized pbha= value Fanhua Li (2): arm64: mm: Set PBHA0 bit for VM_PBHA_BIT0 arm64: mm: Introduce procfs interface to update PBHA0 bit James Morse (7): KVM: arm64: Detect and enable PBHA for stage2 dt-bindings: Rename the description of cpu nodes cpu.yaml dt-bindings: arm: Add binding for Page Based Hardware Attributes arm64: cpufeature: Enable PBHA bits for stage1 arm64: mm: Add pgprot_pbha() to allow drivers to request PBHA values KVM: arm64: Configure PBHA bits for stage2 Documentation: arm64: Describe the support and expectations for PBHA Ma Wupeng (9): arm64: cpufeature: Enable PBHA for stage1 early via FDT arm64: mm: Detect and enable PBHA bit0 at early startup arm64: mm: Update kernel pte entries if pbha bit0 enabled arm64: mm: Show PBHA bit 59 as PBHA0 in ptdump arm64: mm: Introduce VM_PBHA_BIT0 to enable pbha bit0 for single vma arm64: mm: Set flag VM_PBHA_BIT0 for global init task arm64: mm: Introduce prctl to control pbha behavior arm64: mm: Introduce kernel param pbha openeuler: configs: arm64: Enable PBHA by default .../admin-guide/kernel-parameters.txt | 7 + Documentation/admin-guide/mm/pagemap.rst | 4 +- Documentation/arch/arm64/index.rst | 1 + Documentation/arch/arm64/pbha.rst | 87 +++ .../devicetree/bindings/arm/cpu.yaml | 578 ++++++++++++++++ .../devicetree/bindings/arm/cpus.yaml | 622 ++---------------- .../devicetree/bindings/cpu/cpu-capacity.txt | 2 +- .../devicetree/bindings/cpu/cpu-topology.txt | 2 +- .../devicetree/bindings/cpu/idle-states.yaml | 2 +- .../interrupt-controller/apple,aic.yaml | 2 +- .../interrupt-controller/apple,aic2.yaml | 2 +- .../interrupt-controller/arm,gic-v3.yaml | 2 +- Documentation/filesystems/proc.rst | 1 + arch/arm64/Kconfig | 19 + arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/cpufeature.h | 15 + arch/arm64/include/asm/kvm_arm.h | 1 + arch/arm64/include/asm/kvm_pgtable.h | 9 + arch/arm64/include/asm/mman.h | 7 + arch/arm64/include/asm/pgtable-hwdef.h | 6 + arch/arm64/include/asm/pgtable.h | 26 + arch/arm64/include/asm/setup.h | 1 + arch/arm64/include/uapi/asm/mman.h | 1 + arch/arm64/kernel/cpufeature.c | 258 ++++++++ arch/arm64/kernel/head.S | 3 + arch/arm64/kernel/image-vars.h | 2 + arch/arm64/kvm/hyp/pgtable.c | 16 +- arch/arm64/mm/fixmap.c | 2 + arch/arm64/mm/mmap.c | 3 + arch/arm64/mm/mmu.c | 13 +- arch/arm64/mm/ptdump.c | 5 + arch/arm64/tools/cpucaps | 6 +- .../firmware/efi/libstub/efi-stub-helper.c | 3 + drivers/firmware/efi/libstub/fdt.c | 52 ++ drivers/soc/hisilicon/Makefile | 1 + drivers/soc/hisilicon/pbha.c | 265 ++++++++ fs/proc/base.c | 124 ++++ fs/proc/task_mmu.c | 18 + include/linux/mm.h | 8 +- include/linux/pbha.h | 95 +++ include/uapi/asm-generic/mman-common.h | 1 + include/uapi/linux/prctl.h | 1 + kernel/sys.c | 10 + mm/memory.c | 4 + mm/vmalloc.c | 4 + tools/include/uapi/asm-generic/mman-common.h | 1 + 46 files changed, 1727 insertions(+), 566 deletions(-) create mode 100644 Documentation/arch/arm64/pbha.rst create mode 100644 Documentation/devicetree/bindings/arm/cpu.yaml create mode 100644 drivers/soc/hisilicon/pbha.c create mode 100644 include/linux/pbha.h

2 19

[PATCH v3 00/18] MOC bypass cache
by Jiacheng Yu 02 Nov '26

02 Nov '26

The MOC (MemoryOnChip) bypass cache feature uses the Arm Page Based Hardware Attributes (PBHA, FEAT_HPDS2) to describe per-mapping performance hints. MOC memory is not cached in the system cache, so the OS has to be told which pages may be mapped with the MOC attribute. This series adds: - stage1 PBHA support, discovered from the device tree or from the EFI stub - KVM stage2 support, including the VTCR_EL2.PBHA override mask - page based control: PROT_PBHA_BIT0, VM_PBHA_BIT0, prctl and /proc/<pid>/pbha_bit0 - the pbha= boot parameter and the MOC mode plumbing in the EFI stub Based on OLK-6.6. Changes in v3: - dt-bindings: update the six stale references to arm/cpu.yaml, add the maintainers entry and fix the description - fix the for-loop style in the PBHA parsing code - move pbha.rst to Documentation/arch/arm64/ - use a free vm_flags bit for VM_PBHA_BIT0 and document the p0 mnemonic - drop the set_huge_pte_at() find_vma() lookup; the hint is carried by vm_page_prot - rewrite a live THP pmd through pmdp_invalidate_ad() - take an mm reference in pbha_bit0_read() - add a .hugetlb_entry callback so /proc/<pid>/pbha_bit0 and prctl update hugetlb mappings as well - limit the global-init flagging to current->mm and refresh vm_page_prot - base the "nothing to do" decision on the actual VMA state instead of mm->def_flags - reject a NULL or unrecognized pbha= value Fanhua Li (2): arm64: mm: Set PBHA0 bit for VM_PBHA_BIT0 arm64: mm: Introduce procfs interface to update PBHA0 bit James Morse (7): KVM: arm64: Detect and enable PBHA for stage2 dt-bindings: Rename the description of cpu nodes cpu.yaml dt-bindings: arm: Add binding for Page Based Hardware Attributes arm64: cpufeature: Enable PBHA bits for stage1 arm64: mm: Add pgprot_pbha() to allow drivers to request PBHA values KVM: arm64: Configure PBHA bits for stage2 Documentation: arm64: Describe the support and expectations for PBHA Ma Wupeng (9): arm64: cpufeature: Enable PBHA for stage1 early via FDT arm64: mm: Detect and enable PBHA bit0 at early startup arm64: mm: Update kernel pte entries if pbha bit0 enabled arm64: mm: Show PBHA bit 59 as PBHA0 in ptdump arm64: mm: Introduce VM_PBHA_BIT0 to enable pbha bit0 for single vma arm64: mm: Set flag VM_PBHA_BIT0 for global init task arm64: mm: Introduce prctl to control pbha behavior arm64: mm: Introduce kernel param pbha openeuler: configs: arm64: Enable PBHA by default .../admin-guide/kernel-parameters.txt | 7 + Documentation/admin-guide/mm/pagemap.rst | 4 +- Documentation/arch/arm64/index.rst | 1 + Documentation/arch/arm64/pbha.rst | 87 +++ .../devicetree/bindings/arm/cpu.yaml | 578 ++++++++++++++++ .../devicetree/bindings/arm/cpus.yaml | 622 ++---------------- .../devicetree/bindings/cpu/cpu-capacity.txt | 2 +- .../devicetree/bindings/cpu/cpu-topology.txt | 2 +- .../devicetree/bindings/cpu/idle-states.yaml | 2 +- .../interrupt-controller/apple,aic.yaml | 2 +- .../interrupt-controller/apple,aic2.yaml | 2 +- .../interrupt-controller/arm,gic-v3.yaml | 2 +- Documentation/filesystems/proc.rst | 1 + arch/arm64/Kconfig | 19 + arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/cpufeature.h | 15 + arch/arm64/include/asm/kvm_arm.h | 1 + arch/arm64/include/asm/kvm_pgtable.h | 9 + arch/arm64/include/asm/mman.h | 7 + arch/arm64/include/asm/pgtable-hwdef.h | 6 + arch/arm64/include/asm/pgtable.h | 26 + arch/arm64/include/asm/setup.h | 1 + arch/arm64/include/uapi/asm/mman.h | 1 + arch/arm64/kernel/cpufeature.c | 258 ++++++++ arch/arm64/kernel/head.S | 3 + arch/arm64/kernel/image-vars.h | 2 + arch/arm64/kvm/hyp/pgtable.c | 16 +- arch/arm64/mm/fixmap.c | 2 + arch/arm64/mm/mmap.c | 3 + arch/arm64/mm/mmu.c | 13 +- arch/arm64/mm/ptdump.c | 5 + arch/arm64/tools/cpucaps | 6 +- .../firmware/efi/libstub/efi-stub-helper.c | 3 + drivers/firmware/efi/libstub/fdt.c | 52 ++ drivers/soc/hisilicon/Makefile | 1 + drivers/soc/hisilicon/pbha.c | 265 ++++++++ fs/proc/base.c | 124 ++++ fs/proc/task_mmu.c | 18 + include/linux/mm.h | 8 +- include/linux/pbha.h | 95 +++ include/uapi/asm-generic/mman-common.h | 1 + include/uapi/linux/prctl.h | 1 + kernel/sys.c | 10 + mm/memory.c | 4 + mm/vmalloc.c | 4 + tools/include/uapi/asm-generic/mman-common.h | 1 + 46 files changed, 1727 insertions(+), 566 deletions(-) create mode 100644 Documentation/arch/arm64/pbha.rst create mode 100644 Documentation/devicetree/bindings/arm/cpu.yaml create mode 100644 drivers/soc/hisilicon/pbha.c create mode 100644 include/linux/pbha.h

1 18