- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 0/4] LoongArch: internal repository sync 20250528
by Hongchen Zhang 28 May '25

28 May '25

Huacai Chen (1): LoongArch: Fix early_numa_add_cpu() usage for FDT systems Qunqin Zhao (1): tpm: Add a driver for Loongson TPM device Tianyang Zhang (2): Loongarch: Fix panic caused by NULL pmd in huge_pte_offset() mm/page_alloc.c: avoid infinite retries caused by cpuset race MAINTAINERS | 5 + arch/loongarch/configs/loongson3_defconfig | 1 + arch/loongarch/kernel/smp.c | 2 +- arch/loongarch/mm/hugetlbpage.c | 3 +- drivers/char/Kconfig | 1 + drivers/char/loongson_se.c | 33 +++++-- drivers/char/tpm/Kconfig | 9 ++ drivers/char/tpm/Makefile | 1 + drivers/char/tpm/tpm_loongson.c | 103 +++++++++++++++++++++ include/soc/loongson/se.h | 1 + mm/page_alloc.c | 8 ++ 11 files changed, 155 insertions(+), 12 deletions(-) create mode 100644 drivers/char/tpm/tpm_loongson.c -- 2.33.0

2 5

[PATCH OLK-6.6 V1] padata: do not leak refcount in reorder_work
by Wang Tao 28 May '25

28 May '25

From: Dominik Grzegorzek <dominik.grzegorzek(a)oracle.com> mainline inclusion from mainline-v6.15 commit d6ebcde6d4ecf34f8495fb30516645db3aea8993 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICAXLF Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- A recent patch that addressed a UAF introduced a reference count leak: the parallel_data refcount is incremented unconditionally, regardless of the return value of queue_work(). If the work item is already queued, the incremented refcount is never decremented. Fix this by checking the return value of queue_work() and decrementing the refcount when necessary. Resolves: Unreferenced object 0xffff9d9f421e3d80 (size 192): comm "cryptomgr_probe", pid 157, jiffies 4294694003 hex dump (first 32 bytes): 80 8b cf 41 9f 9d ff ff b8 97 e0 89 ff ff ff ff ...A............ d0 97 e0 89 ff ff ff ff 19 00 00 00 1f 88 23 00 ..............#. backtrace (crc 838fb36): __kmalloc_cache_noprof+0x284/0x320 padata_alloc_pd+0x20/0x1e0 padata_alloc_shell+0x3b/0xa0 0xffffffffc040a54d cryptomgr_probe+0x43/0xc0 kthread+0xf6/0x1f0 ret_from_fork+0x2f/0x50 ret_from_fork_asm+0x1a/0x30 Fixes: dd7d37ccf6b1 ("padata: avoid UAF for reorder_work") Cc: <stable(a)vger.kernel.org> Signed-off-by: Dominik Grzegorzek <dominik.grzegorzek(a)oracle.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Wang Tao <wangtao554(a)huawei.com> --- kernel/padata.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/kernel/padata.c b/kernel/padata.c index 071d8cad8078..93cd7704ab63 100644 --- a/kernel/padata.c +++ b/kernel/padata.c @@ -358,7 +358,8 @@ static void padata_reorder(struct parallel_data *pd) * To avoid UAF issue, add pd ref here, and put pd ref after reorder_work finish. */ padata_get_pd(pd); - queue_work(pinst->serial_wq, &pd->reorder_work); + if (!queue_work(pinst->serial_wq, &pd->reorder_work)) + padata_put_pd(pd); } } -- 2.34.1

2 1

[PATCH OLK-5.10 V1] padata: do not leak refcount in reorder_work
by Wang Tao 28 May '25

28 May '25

From: Dominik Grzegorzek <dominik.grzegorzek(a)oracle.com> mainline inclusion from mainline-v6.15 commit d6ebcde6d4ecf34f8495fb30516645db3aea8993 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICAXMC Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- A recent patch that addressed a UAF introduced a reference count leak: the parallel_data refcount is incremented unconditionally, regardless of the return value of queue_work(). If the work item is already queued, the incremented refcount is never decremented. Fix this by checking the return value of queue_work() and decrementing the refcount when necessary. Resolves: Unreferenced object 0xffff9d9f421e3d80 (size 192): comm "cryptomgr_probe", pid 157, jiffies 4294694003 hex dump (first 32 bytes): 80 8b cf 41 9f 9d ff ff b8 97 e0 89 ff ff ff ff ...A............ d0 97 e0 89 ff ff ff ff 19 00 00 00 1f 88 23 00 ..............#. backtrace (crc 838fb36): __kmalloc_cache_noprof+0x284/0x320 padata_alloc_pd+0x20/0x1e0 padata_alloc_shell+0x3b/0xa0 0xffffffffc040a54d cryptomgr_probe+0x43/0xc0 kthread+0xf6/0x1f0 ret_from_fork+0x2f/0x50 ret_from_fork_asm+0x1a/0x30 Fixes: dd7d37ccf6b1 ("padata: avoid UAF for reorder_work") Cc: <stable(a)vger.kernel.org> Signed-off-by: Dominik Grzegorzek <dominik.grzegorzek(a)oracle.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Wang Tao <wangtao554(a)huawei.com> --- kernel/padata.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/kernel/padata.c b/kernel/padata.c index 574ad4d7325d..d0f6bf1cf18a 100644 --- a/kernel/padata.c +++ b/kernel/padata.c @@ -363,7 +363,8 @@ static void padata_reorder(struct parallel_data *pd) * To avoid UAF issue, add pd ref here, and put pd ref after reorder_work finish. */ padata_get_pd(pd); - queue_work(pinst->serial_wq, &pd->reorder_work); + if (!queue_work(pinst->serial_wq, &pd->reorder_work)) + padata_put_pd(pd); } } -- 2.34.1

2 1

[PATCH OLK-6.6 v3 0/5] Support soft domain v3
by Zhang Qiao 28 May '25

28 May '25

v3: - Fix x86 build error v2: - fix __SCHED_FEAT_SOFT_DOMAIN build error Zhang Qiao (5): sched: topology: Build soft domain for LLC sched: Attach task group to soft domain sched: fair: Select idle cpu in soft domain sched: fair: Disable numa migrate for soft domian task arm64: Enable CONFIG_SCHED_SOFT_DOMAIN arch/arm64/configs/openeuler_defconfig | 2 + include/linux/sched/topology.h | 21 ++ init/Kconfig | 11 + kernel/sched/build_policy.c | 3 + kernel/sched/core.c | 72 ++++++ kernel/sched/fair.c | 91 +++++++ kernel/sched/features.h | 4 + kernel/sched/sched.h | 34 +++ kernel/sched/soft_domain.c | 334 +++++++++++++++++++++++++ 9 files changed, 572 insertions(+) create mode 100644 kernel/sched/soft_domain.c -- 2.18.0.huawei.25

2 6

[PATCH OLK-6.6] fbdev: omapfb: Add 'plane' value check
by Yi Yang 28 May '25

28 May '25

From: Leonid Arapov <arapovl839(a)gmail.com> stable inclusion from stable-v6.6.88 commit fda15c5b96b883d62fb2d84a3a1422aa87717897 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC6PUR CVE: CVE-2025-37851 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3e411827f31db7f938a30a3c7a7599839401ec30 ] Function dispc_ovl_setup is not intended to work with the value OMAP_DSS_WB of the enum parameter plane. The value of this parameter is initialized in dss_init_overlays and in the current state of the code it cannot take this value so it's not a real problem. For the purposes of defensive coding it wouldn't be superfluous to check the parameter value, because some functions down the call stack process this value correctly and some not. For example, in dispc_ovl_setup_global_alpha it may lead to buffer overflow. Add check for this value. Found by Linux Verification Center (linuxtesting.org) with SVACE static analysis tool. Signed-off-by: Leonid Arapov <arapovl839(a)gmail.com> Signed-off-by: Helge Deller <deller(a)gmx.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/video/fbdev/omap2/omapfb/dss/dispc.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/video/fbdev/omap2/omapfb/dss/dispc.c b/drivers/video/fbdev/omap2/omapfb/dss/dispc.c index 21fef9db90d2..4f09111f8b57 100644 --- a/drivers/video/fbdev/omap2/omapfb/dss/dispc.c +++ b/drivers/video/fbdev/omap2/omapfb/dss/dispc.c @@ -2749,9 +2749,13 @@ int dispc_ovl_setup(enum omap_plane plane, const struct omap_overlay_info *oi, bool mem_to_mem) { int r; - enum omap_overlay_caps caps = dss_feat_get_overlay_caps(plane); + enum omap_overlay_caps caps; enum omap_channel channel; + if (plane == OMAP_DSS_WB) + return -EINVAL; + + caps = dss_feat_get_overlay_caps(plane); channel = dispc_ovl_get_channel_out(plane); DSSDBG("dispc_ovl_setup %d, pa %pad, pa_uv %pad, sw %d, %d,%d, %dx%d ->" -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] dm crypt: add cond_resched() to dmcrypt_write()
by Zheng Qixing 28 May '25

28 May '25

From: Mikulas Patocka <mpatocka(a)redhat.com> stable inclusion from stable-v4.19.280 commit 7b9f8efb5fc888dd938d2964e705b8e00f1dc0f6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC5DGE CVE: CVE-2023-53051 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------ commit fb294b1c0ba982144ca467a75e7d01ff26304e2b upstream. The loop in dmcrypt_write may be running for unbounded amount of time, thus we need cond_resched() in it. This commit fixes the following warning: [ 3391.153255][ C12] watchdog: BUG: soft lockup - CPU#12 stuck for 23s! [dmcrypt_write/2:2897] ... [ 3391.387210][ C12] Call trace: [ 3391.390338][ C12] blk_attempt_bio_merge.part.6+0x38/0x158 [ 3391.395970][ C12] blk_attempt_plug_merge+0xc0/0x1b0 [ 3391.401085][ C12] blk_mq_submit_bio+0x398/0x550 [ 3391.405856][ C12] submit_bio_noacct+0x308/0x380 [ 3391.410630][ C12] dmcrypt_write+0x1e4/0x208 [dm_crypt] [ 3391.416005][ C12] kthread+0x130/0x138 [ 3391.419911][ C12] ret_from_fork+0x10/0x18 Reported-by: yangerkun <yangerkun(a)huawei.com> Fixes: dc2676210c42 ("dm crypt: offload writes to thread") Cc: stable(a)vger.kernel.org Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Signed-off-by: Mike Snitzer <snitzer(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/md/dm-crypt.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c index fee23d3e2eba..be1ec17a0a4e 100644 --- a/drivers/md/dm-crypt.c +++ b/drivers/md/dm-crypt.c @@ -1661,6 +1661,7 @@ static int dmcrypt_write(void *data) io = crypt_io_from_node(rb_first(&write_tree)); rb_erase(&io->rb_node, &write_tree); kcryptd_io_write(io); + cond_resched(); } while (!RB_EMPTY_ROOT(&write_tree)); blk_finish_plug(&plug); } -- 2.39.2

2 1

[PATCH OLK-6.6] scsi: st: Fix array overflow in st_setup()
by Zheng Qixing 28 May '25

28 May '25

From: Kai Mäkisara <Kai.Makisara(a)kolumbus.fi> stable inclusion from stable-v6.6.88 commit e4d1ca0a84a6650d3172eb8c07ef2fbc585b0d96 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC6M09 CVE: CVE-2025-37857 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------ [ Upstream commit a018d1cf990d0c339fe0e29b762ea5dc10567d67 ] Change the array size to follow parms size instead of a fixed value. Reported-by: Chenyuan Yang <chenyuan0y(a)gmail.com> Closes: https://lore.kernel.org/linux-scsi/CALGdzuoubbra4xKOJcsyThdk5Y1BrAmZs==wbqj… Signed-off-by: Kai Mäkisara <Kai.Makisara(a)kolumbus.fi> Link: https://lore.kernel.org/r/20250311112516.5548-2-Kai.Makisara@kolumbus.fi Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/scsi/st.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c index bdbe94f30f07..900322bad4f3 100644 --- a/drivers/scsi/st.c +++ b/drivers/scsi/st.c @@ -4120,7 +4120,7 @@ static void validate_options(void) */ static int __init st_setup(char *str) { - int i, len, ints[5]; + int i, len, ints[ARRAY_SIZE(parms) + 1]; char *stp; stp = get_options(str, ARRAY_SIZE(ints), ints); -- 2.39.2

2 1

[PATCH OLK-6.6] arm64/watchdog: fix watchdog failure in low power scenarios
by Bowen You 28 May '25

28 May '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICAO4O -------------------------------- During testing, it was found that in low-power scenarios, the CPU core frequently powers on and off, which causes the SDEI watchdog to fail. This is because the secure timer in the BIOS does not save and restore the state during the CPU core power-on and power-off process. The OS needs to add enable/disable operations in the suspend/resume process. Fixes: 06f3c8d59324 ("watchdog: add nmi_watchdog support for arm64 based on SDEI") Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- arch/arm64/kernel/watchdog_sdei.c | 34 +++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) diff --git a/arch/arm64/kernel/watchdog_sdei.c b/arch/arm64/kernel/watchdog_sdei.c index b0302b22dc72..d1ad8c184296 100644 --- a/arch/arm64/kernel/watchdog_sdei.c +++ b/arch/arm64/kernel/watchdog_sdei.c @@ -16,6 +16,7 @@ #include <linux/arm_sdei.h> #include <linux/kprobes.h> #include <linux/nmi.h> +#include <linux/cpu_pm.h> /* We use the secure physical timer as SDEI NMI watchdog timer */ #define SDEI_NMI_WATCHDOG_HWIRQ 29 @@ -106,6 +107,34 @@ void sdei_watchdog_clear_eoi(void) sdei_api_clear_eoi(SDEI_NMI_WATCHDOG_HWIRQ); } +static int sdei_watchdog_pm_notifier(struct notifier_block *nb, + unsigned long action, void *data) +{ + int rv; + + WARN_ON_ONCE(preemptible()); + + switch (action) { + case CPU_PM_ENTER: + rv = sdei_api_event_disable(sdei_watchdog_event_num); + break; + case CPU_PM_EXIT: + rv = sdei_api_event_enable(sdei_watchdog_event_num); + break; + default: + return NOTIFY_DONE; + } + + if (rv) + return notifier_from_errno(rv); + + return NOTIFY_OK; +} + +static struct notifier_block sdei_watchdog_pm_nb = { + .notifier_call = sdei_watchdog_pm_notifier, +}; + int __init sdei_watchdog_hardlockup_probe(void) { int ret; @@ -144,6 +173,11 @@ int __init sdei_watchdog_hardlockup_probe(void) return ret; } + ret = cpu_pm_register_notifier(&sdei_watchdog_pm_nb); + if (ret) { + pr_warn("Failed to register sdei PM notifier...\n"); + return ret; + } sdei_watchdog_registered = true; pr_info("SDEI Watchdog registered successfully\n"); -- 2.34.1

2 1

[PATCH OLK-6.6 0/5] memcg: Add new interface for async reclaim
by Liu Shixin 28 May '25

28 May '25

1. memory.wmark_ratio 2. memory.wmark_scale_factor 3. memory.wmark_high 4. memory.wmark_low Liu Shixin (5): memcg: extract function async_high_read/async_low_read memcg: replace memory.high with memory.limit_in_bytes memcg: add memory.wmark_ratio memcg: add memory.wmark_scale_factor memcg: add memory.wmark_high and memory.wmark_low include/linux/memcontrol.h | 5 +- mm/memcontrol.c | 143 +++++++++++++++++++++++++++++++++++-- 2 files changed, 141 insertions(+), 7 deletions(-) -- 2.34.1

2 6

[PATCH OLK-5.10] mm: slub: add __GFP_NOWARN when allocations with GFP_NOWAIT
by Nanyong Sun 28 May '25

28 May '25

From: Kaixiong Yu <yukaixiong(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICAVPP -------------------------------- GFP_NOWAIT callers are always prepared for their allocations to fail because they fail so frequently. In such case, don't need to generate a warning. So, add __GFP_NOWARN to flag when allocations. Fixes:76e3125423ba ("mm/slub: Reduce memory consumption in extreme scenarios") Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- mm/slub.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/slub.c b/mm/slub.c index d4e7e88df7ff..bcc00a95c368 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -2782,7 +2782,7 @@ static void *___slab_alloc(struct kmem_cache *s, gfp_t gfpflags, int node, */ if (unlikely(node != NUMA_NO_NODE && !(gfpflags & __GFP_THISNODE) && try_thisnode)) - pc_gfpflags = GFP_NOWAIT | __GFP_THISNODE; + pc_gfpflags = GFP_NOWAIT | __GFP_THISNODE | __GFP_NOWARN; freelist = new_slab_objects(s, pc_gfpflags, node, &c); -- 2.34.1

2 1