- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10 0/2] tracepoints: get correct superblock from dentry in event btrfs_sync_file()
by Pan Taixi 21 May '26

21 May '26

[ Upstream commit a85b46db143fda5869e7d8df8f258ccef5fa1719 ] If overlay is used on top of btrfs, dentry->d_sb translates to overlay's super block and fsid assignment will lead to a crash. Use file_inode(file)->i_sb to always get btrfs_sb. The patch above introduced another problem and is fixed in the following patch: The trace event btrfs_sync_file() is called in an atomic context (all trace events are) and its call to dput(), which is needed due to the call to dget_parent(), can sleep, triggering a kernel splat. This can be reproduced by enabling the trace event and running btrfs/056 from fstests for example. The splat shown in dmesg is the following: [53.919] BUG: sleeping function called from invalid context at fs/dcache.c:970 [53.947] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 32773, name: xfs_io [53.988] preempt_count: 2, expected: 0 [53.967] RCU nest depth: 0, expected: 0 [53.943] Preemption disabled at: [53.944] [<0000000000000000>] 0x0 [54.078] CPU: 0 UID: 0 PID: 32773 Comm: xfs_io Tainted: G W 7.1.0-rc1-btrfs-next-232+ #1 PREEMPT(full) [54.070] Tainted: [W]=WARN [54.071] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014 [54.072] Call Trace: [54.074] <TASK> [54.076] dump_stack_lvl+0x56/0x80 [54.079] __might_resched.cold+0xd6/0x10f [54.072] dput.part.0+0x24/0x110 [54.078] trace_event_raw_event_btrfs_sync_file+0x75/0x140 [btrfs] [54.089] btrfs_sync_file+0x1ed/0x530 [btrfs] [54.087] ? __handle_mm_fault+0x8ae/0xed0 [54.089] btrfs_do_write_iter+0x172/0x210 [btrfs] [54.091] vfs_write+0x21f/0x450 [54.094] __x64_sys_pwrite64+0x8d/0xc0 [54.096] ? do_user_addr_fault+0x20c/0x670 [54.099] do_syscall_64+0x60/0xf20 [54.092] ? clear_bhb_loop+0x60/0xb0 [54.094] entry_SYSCALL_64_after_hwframe+0x76/0x7e So stop using dget_parent() and dput() and access the parent dentry directly as dentry->d_parent. This is also what ext4 is doing in its equivalent trace event ext4_sync_file_enter(). Filipe Manana (1): btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() Goldwyn Rodrigues (1): btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file() include/trace/events/btrfs.h | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) -- 2.34.1

1 2

[PATCH OLK-6.6 0/1] mfs: fix inode resource leak when cache object fd is zero
by Hongbo Li 21 May '26

21 May '26

Fix inode resource leak when cache object fd is zero. Hongbo Li (1): mfs: fix inode resource leak when cache object fd is zero fs/mfs/cache.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) -- 2.34.1

2 2

[PATCH OLK-6.6 00/10] bpf mainline for olk-6.6
by Pu Lehui 21 May '26

21 May '26

Daniel Borkmann (1): bpf, arm64: Fix off-by-one in check_imm signed range check David Carlier (1): bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path Jiayuan Chen (2): bpf: Fix use-after-free in offloaded map/prog info fill bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks Lang Xu (1): bpf: Fix OOB in pcpu_init_value MingTao Huang (1): bpf: Fix stale offload->prog pointer after constant blinding Mykyta Yatsenko (2): bpf: Fix NULL deref in map_kptr_match_type for scalar regs bpf: Use copy_map_value_locked() in alloc_htab_elem() for BPF_F_LOCK Sechang Lim (1): bpf: Fix RCU stall in bpf_fd_array_map_clear() Weiming Shi (1): bpf: fix end-of-list detection in cgroup_storage_get_next_key() arch/arm64/net/bpf_jit_comp.c | 4 ++-- kernel/bpf/arraymap.c | 4 +++- kernel/bpf/bpf_lsm.c | 2 -- kernel/bpf/core.c | 2 ++ kernel/bpf/devmap.c | 5 ++--- kernel/bpf/hashtab.c | 12 ++++++++---- kernel/bpf/local_storage.c | 2 +- kernel/bpf/offload.c | 10 ++++------ kernel/bpf/verifier.c | 5 ++++- 9 files changed, 26 insertions(+), 20 deletions(-) -- 2.34.1

2 12

[PATCH v2 OLK-6.6 0/5] Fix NULL pointer dereference
by Liu Kai 21 May '26

21 May '26

Fix NULL pointer dereference Liu Kai (5): xSched/cgroup: remove legacy cftypes due to cgroup v1 incompatibility xSched: fix incorrect error returns in vstream allocation xSched: prevent HBM allocation for non-AI tasks xSched/dmem: memory allocation size must larger than 0 xSched: fix NULL pointer dereference in cfs_rq during class switch include/linux/xsched.h | 26 ++++++++++++++++++++------ kernel/xsched/cgroup.c | 2 -- kernel/xsched/vstream.c | 27 +++++++++------------------ 3 files changed, 29 insertions(+), 26 deletions(-) -- 2.34.1

2 6

[PATCH OLK-6.6] Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists
by Liu Kai 21 May '26

21 May '26

From: Pauli Virtanen <pav(a)iki.fi> mainline inclusion from mainline-v7.0-rc7 commit 2969554bcfccb5c609f6b6cd4a014933f3a66dd0 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14554 CVE: CVE-2026-43022 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- hci_cmd_sync_queue_once() needs to indicate whether a queue item was added, so caller can know if callbacks are called, so it can avoid leaking resources. Change the function to return -EEXIST if queue item already exists. Modify all callsites to handle that. Signed-off-by: Pauli Virtanen <pav(a)iki.fi> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Conflicts: net/bluetooth/hci_sync.c [hci_connect_pa_sync(), hci_connect_big_sync(), hci_past_sync(), hci_le_read_remote_features(), hci_acl_change_pkt_type(), hci_le_set_phy() are not introduced, so some changes are not applied] Signed-off-by: Liu Kai <liukai284(a)huawei.com> --- net/bluetooth/hci_sync.c | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-) diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c index f4066b8e95da..0648cebf0865 100644 --- a/net/bluetooth/hci_sync.c +++ b/net/bluetooth/hci_sync.c @@ -798,7 +798,7 @@ int hci_cmd_sync_queue_once(struct hci_dev *hdev, hci_cmd_sync_work_func_t func, void *data, hci_cmd_sync_work_destroy_t destroy) { if (hci_cmd_sync_lookup_entry(hdev, func, data, destroy)) - return 0; + return -EEXIST; return hci_cmd_sync_queue(hdev, func, data, destroy); } @@ -3266,6 +3266,8 @@ static int update_passive_scan_sync(struct hci_dev *hdev, void *data) int hci_update_passive_scan(struct hci_dev *hdev) { + int err; + /* Only queue if it would have any effect */ if (!test_bit(HCI_UP, &hdev->flags) || test_bit(HCI_INIT, &hdev->flags) || @@ -3275,8 +3277,9 @@ int hci_update_passive_scan(struct hci_dev *hdev) hci_dev_test_flag(hdev, HCI_UNREGISTER)) return 0; - return hci_cmd_sync_queue_once(hdev, update_passive_scan_sync, NULL, - NULL); + err = hci_cmd_sync_queue_once(hdev, update_passive_scan_sync, NULL, + NULL); + return (err == -EEXIST) ? 0 : err; } int hci_write_sc_support_sync(struct hci_dev *hdev, u8 val) @@ -6904,8 +6907,11 @@ static int hci_acl_create_conn_sync(struct hci_dev *hdev, void *data) int hci_connect_acl_sync(struct hci_dev *hdev, struct hci_conn *conn) { - return hci_cmd_sync_queue_once(hdev, hci_acl_create_conn_sync, conn, - NULL); + int err; + + err = hci_cmd_sync_queue_once(hdev, hci_acl_create_conn_sync, conn, + NULL); + return (err == -EEXIST) ? 0 : err; } static void create_le_conn_complete(struct hci_dev *hdev, void *data, int err) @@ -6941,8 +6947,11 @@ static void create_le_conn_complete(struct hci_dev *hdev, void *data, int err) int hci_connect_le_sync(struct hci_dev *hdev, struct hci_conn *conn) { - return hci_cmd_sync_queue_once(hdev, hci_le_create_conn_sync, conn, - create_le_conn_complete); + int err; + + err = hci_cmd_sync_queue_once(hdev, hci_le_create_conn_sync, conn, + create_le_conn_complete); + return (err == -EEXIST) ? 0 : err; } int hci_cancel_connect_sync(struct hci_dev *hdev, struct hci_conn *conn) -- 2.34.1

2 1

[PATCH openEuler-24.03-LTS_SP3] tracing: test ci
by Tengda Wu 20 May '26

20 May '26

hulk inclusion category: feature bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14259 -------------------------------- This is a test. Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/trace/trace.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c index 39bef9ddc5ae..affd03dd969c 100644 --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -106,6 +106,8 @@ dummy_set_flag(struct trace_array *tr, u32 old_flags, u32 bit, int set) return 0; } +/* This is a test */ + /* * To prevent the comm cache from being overwritten when no * tracing is active, only save the comm when a trace event -- 2.34.1

1 0

[PATCH OLK-6.6 0/5] Fix NULL pointer dereference
by Liu Kai 20 May '26

20 May '26

Fix NULL pointer dereference Liu Kai (5): xSched/cgroup: remove legacy cftypes due to cgroup v1 incompatibility xSched: fix incorrect error returns in vstream allocation xSched: prevent HBM allocation for non-AI tasks xSched/dmem: memory allocation size must larger than 0 xSched: fix NULL pointer dereference in cfs_rq during class switch include/linux/xsched.h | 7 ++++++- kernel/xsched/cgroup.c | 2 -- kernel/xsched/vstream.c | 27 +++++++++------------------ 3 files changed, 15 insertions(+), 21 deletions(-) -- 2.34.1

2 6

[PATCH OLK-6.6 00/10] backport cpuidle patches from linux mainline
by Lifeng Zheng 20 May '26

20 May '26

From: Hongye Lin <linhongye(a)h-partners.com> driver inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9163 ---------------------------------------------------------------------- backport cpuidle patches from linux mainline Bowen Yu (3): update to sysfs_emit() for safer buffer handling cpufreq: Update sscanf() to kstrtouint() cpufreq: Replace magic number Hongye Lin (1): Revert "cpufreq: CPPC: Don't warn on failing to read perf counters on offline cpus" Jie Zhan (4): cpufreq: CPPC: Don't warn if FIE init fails to read counters ACPI: CPPC: Factor out and export per-cpu cppc_perf_ctrs_in_pcc_cpu() cpufreq: CPPC: Factor out cppc_fie_kworker_init() cpufreq: CPPC: Update FIE arch_freq_scale in ticks for non-PCC regs Pengjie Zhang (1): PM / devfreq: use _visible attribute to replace create/remove_sysfs_files() Sumit Gupta (1): arm64: topology: Fix false warning in counters_read_on_cpu() for same-CPU reads arch/arm64/kernel/topology.c | 21 +++++-- drivers/acpi/cppc_acpi.c | 48 ++++++++------- drivers/cpufreq/cppc_cpufreq.c | 105 ++++++++++++++++++++++----------- drivers/cpufreq/cpufreq.c | 14 ++--- drivers/devfreq/devfreq.c | 99 ++++++++++++++++++------------- include/acpi/cppc_acpi.h | 5 ++ 6 files changed, 181 insertions(+), 111 deletions(-) -- 2.33.0

2 11

[PATCH OLK-6.6 0/2] tracepoints: get correct superblock from dentry in event btrfs_sync_file()
by Pan Taixi 20 May '26

20 May '26

[ Upstream commit a85b46db143fda5869e7d8df8f258ccef5fa1719 ] If overlay is used on top of btrfs, dentry->d_sb translates to overlay's super block and fsid assignment will lead to a crash. Use file_inode(file)->i_sb to always get btrfs_sb. The patch above introduced another problem and is fixed in the following patch: The trace event btrfs_sync_file() is called in an atomic context (all trace events are) and its call to dput(), which is needed due to the call to dget_parent(), can sleep, triggering a kernel splat. This can be reproduced by enabling the trace event and running btrfs/056 from fstests for example. The splat shown in dmesg is the following: [53.919] BUG: sleeping function called from invalid context at fs/dcache.c:970 [53.947] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 32773, name: xfs_io [53.988] preempt_count: 2, expected: 0 [53.967] RCU nest depth: 0, expected: 0 [53.943] Preemption disabled at: [53.944] [<0000000000000000>] 0x0 [54.078] CPU: 0 UID: 0 PID: 32773 Comm: xfs_io Tainted: G W 7.1.0-rc1-btrfs-next-232+ #1 PREEMPT(full) [54.070] Tainted: [W]=WARN [54.071] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014 [54.072] Call Trace: [54.074] <TASK> [54.076] dump_stack_lvl+0x56/0x80 [54.079] __might_resched.cold+0xd6/0x10f [54.072] dput.part.0+0x24/0x110 [54.078] trace_event_raw_event_btrfs_sync_file+0x75/0x140 [btrfs] [54.089] btrfs_sync_file+0x1ed/0x530 [btrfs] [54.087] ? __handle_mm_fault+0x8ae/0xed0 [54.089] btrfs_do_write_iter+0x172/0x210 [btrfs] [54.091] vfs_write+0x21f/0x450 [54.094] __x64_sys_pwrite64+0x8d/0xc0 [54.096] ? do_user_addr_fault+0x20c/0x670 [54.099] do_syscall_64+0x60/0xf20 [54.092] ? clear_bhb_loop+0x60/0xb0 [54.094] entry_SYSCALL_64_after_hwframe+0x76/0x7e So stop using dget_parent() and dput() and access the parent dentry directly as dentry->d_parent. This is also what ext4 is doing in its equivalent trace event ext4_sync_file_enter(). Filipe Manana (1): btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() Goldwyn Rodrigues (1): btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file() include/trace/events/btrfs.h | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/3]Backport per-vma locks in userfaultfd for OLK 6.6
by Wupeng Ma 20 May '26

20 May '26

Backport per-vma locks in userfaultfd[1] for OLK 6.6 Lokesh Gidra (3): userfaultfd: protect mmap_changing with rw_sem in userfaulfd_ctx mm: add vma_assert_locked() for !CONFIG_PER_VMA_LOCK userfaultfd: use per-vma locks in userfaultfd operations fs/userfaultfd.c | 35 ++-- include/linux/mm.h | 5 + include/linux/userfaultfd_k.h | 24 ++- include/linux/userfaultfd_k_ext.h | 7 + mm/userfaultfd.c | 273 ++++++++++++++++++++---------- 5 files changed, 226 insertions(+), 118 deletions(-) -- 2.43.0

2 4