- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2()
by Jinjie Ruan 09 May '26

09 May '26

From: Vasiliy Kovalev <kovalev(a)altlinux.org> stable inclusion from stable-v6.6.128 commit 708e20c66b2761d878a2bc3c7534e7f814e4dec5 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14760 CVE: CVE-2026-43214 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 95d848dc7e639988dbb385a8cba9b484607cf98c ] Add SRCU read-side protection when reading PDPTR registers in __get_sregs2(). Reading PDPTRs may trigger access to guest memory: kvm_pdptr_read() -> svm_cache_reg() -> load_pdptrs() -> kvm_vcpu_read_guest_page() -> kvm_vcpu_gfn_to_memslot() kvm_vcpu_gfn_to_memslot() dereferences memslots via __kvm_memslots(), which uses srcu_dereference_check() and requires either kvm->srcu or kvm->slots_lock to be held. Currently only vcpu->mutex is held, triggering lockdep warning: ============================= WARNING: suspicious RCU usage in kvm_vcpu_gfn_to_memslot 6.12.59+ #3 Not tainted include/linux/kvm_host.h:1062 suspicious rcu_dereference_check() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 1 lock held by syz.5.1717/15100: #0: ff1100002f4b00b0 (&vcpu->mutex){+.+.}-{3:3}, at: kvm_vcpu_ioctl+0x1d5/0x1590 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0xf0/0x120 lib/dump_stack.c:120 lockdep_rcu_suspicious+0x1e3/0x270 kernel/locking/lockdep.c:6824 __kvm_memslots include/linux/kvm_host.h:1062 [inline] __kvm_memslots include/linux/kvm_host.h:1059 [inline] kvm_vcpu_memslots include/linux/kvm_host.h:1076 [inline] kvm_vcpu_gfn_to_memslot+0x518/0x5e0 virt/kvm/kvm_main.c:2617 kvm_vcpu_read_guest_page+0x27/0x50 virt/kvm/kvm_main.c:3302 load_pdptrs+0xff/0x4b0 arch/x86/kvm/x86.c:1065 svm_cache_reg+0x1c9/0x230 arch/x86/kvm/svm/svm.c:1688 kvm_pdptr_read arch/x86/kvm/kvm_cache_regs.h:141 [inline] __get_sregs2 arch/x86/kvm/x86.c:11784 [inline] kvm_arch_vcpu_ioctl+0x3e20/0x4aa0 arch/x86/kvm/x86.c:6279 kvm_vcpu_ioctl+0x856/0x1590 virt/kvm/kvm_main.c:4663 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl fs/ioctl.c:893 [inline] __x64_sys_ioctl+0x18b/0x210 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xbd/0x1d0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Suggested-by: Sean Christopherson <seanjc(a)google.com> Cc: stable(a)vger.kernel.org Fixes: 6dba94035203 ("KVM: x86: Introduce KVM_GET_SREGS2 / KVM_SET_SREGS2") Signed-off-by: Vasiliy Kovalev <kovalev(a)altlinux.org> Link: https://patch.msgid.link/20260123222801.646123-1-kovalev@altlinux.org Signed-off-by: Sean Christopherson <seanjc(a)google.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- arch/x86/kvm/x86.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 6ca2798494dd..9d561bcc0611 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -11631,9 +11631,11 @@ static void __get_sregs2(struct kvm_vcpu *vcpu, struct kvm_sregs2 *sregs2) return; if (is_pae_paging(vcpu)) { + kvm_vcpu_srcu_read_lock(vcpu); for (i = 0 ; i < 4 ; i++) sregs2->pdptrs[i] = kvm_pdptr_read(vcpu, i); sregs2->flags |= KVM_SREGS2_FLAGS_PDPTRS_VALID; + kvm_vcpu_srcu_read_unlock(vcpu); } } -- 2.34.1

2 1

[PATCH OLK-6.6 v2 0/2] CVE-2026-43265
by Jinjie Ruan 09 May '26

09 May '26

CVE-2026-43265 Sean Christopherson (2): KVM: x86: WARN if a vCPU gets a valid wakeup that KVM can't yet inject KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block() arch/x86/kvm/x86.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/2] CVE-2026-43265
by Jinjie Ruan 09 May '26

09 May '26

CVE-2026-43265 Sean Christopherson (2): KVM: x86: WARN if a vCPU gets a valid wakeup that KVM can't yet inject KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block() arch/x86/kvm/x86.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/1] Fix CVE-2026-43262
by Hongbo Li 09 May '26

09 May '26

Fix CVE-2026-43262. Andreas Gruenbacher (1): gfs2: fiemap page fault fix fs/gfs2/inode.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) -- 2.34.1

2 2

[PATCH OLK-5.10 0/1] Fix CVE-2026-43262
by Hongbo Li 09 May '26

09 May '26

Fix CVE-2026-43262. Andreas Gruenbacher (1): gfs2: fiemap page fault fix fs/gfs2/inode.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) -- 2.34.1

2 2

[PATCH OLK-6.6 00/36] perf arm-spe: Support SPE new features
by Yushan Wang 09 May '26

09 May '26

From: Ying Jiang<jiangying44(a)h-partners.com> Anshuman Khandual (9): arm64: Handle BRBE booting requirements arm64/sysreg: Update register fields for ID_AA64MMFR0_EL1 arm64/sysreg: Add register fields for HDFGRTR2_EL2 arm64/sysreg: Add register fields for HDFGWTR2_EL2 arm64/sysreg: Add register fields for HFGITR2_EL2 arm64/sysreg: Add register fields for HFGRTR2_EL2 arm64/sysreg: Add register fields for HFGWTR2_EL2 arm64/sysreg: Update ID_DFR0_EL1 register fields arm64/boot: Enable EL2 requirements for FEAT_PMUv3p9 Dave Martin (1): arm64: el2_setup.h: Rename some labels to be more diff-friendly James Clark (12): perf: arm_spe: Add format option for discard mode arm64: sysreg: Add new PMSFCR_EL1 fields and PMSDSFR_EL1 register perf: arm_spe: Support FEAT_SPEv1p4 filters perf: arm_spe: Add support for FEAT_SPE_EFT extended filtering arm64/boot: Factor out a macro to check SPE version arm64/boot: Enable EL2 requirements for SPE_FEAT_FDS KVM: arm64: Add trap configs for PMSDSFR_EL1 perf: Add perf_event_attr::config4 perf: arm_spe: Add support for filtering on data source tools headers UAPI: Sync linux/perf_event.h with the kernel sources perf tools: Add support for perf_event_attr::config4 perf docs: arm-spe: Document new SPE filtering features Leo Yan (1): perf: arm_spe: Expose event filter Marc Zyngier (5): KVM: arm64: Shave a few bytes from the EL2 idmap code arm64/sysreg: Allow a 'Mapping' descriptor for system registers arm64: sysreg: Add registers trapped by HDFG{R,W}TR2_EL2 KVM: arm64: nv: Add include containing the VNCR_EL2 offsets arm64: sysreg: Update PMSIDR_EL1 description Rob Herring (Arm) (4): arm64: el2_setup.h: Make __init_el2_fgt labels consistent, again perf/arm_pmuv3: Add PMUv3.9 per counter EL0 access control perf: arm_pmu: Use of_property_present() perf: arm_pmu: Remove event index to counter remapping Yushan Wang (4): Revert "arm64/boot: Enable EL2 requirements for BRBE" perf: Fix hw_metric event idx config perf: Keep event consistency of hw_metric events arm_pmuv3: hw_metric: Remove unnecessary check of event type Documentation/arch/arm64/booting.rst | 75 +++- arch/arm64/include/asm/el2_setup.h | 130 +++--- arch/arm64/include/asm/kvm_asm.h | 1 + arch/arm64/include/asm/sysreg.h | 19 +- arch/arm64/include/asm/vncr_mapping.h | 105 +++++ arch/arm64/kernel/asm-offsets.c | 1 + arch/arm64/kvm/emulate-nested.c | 1 + arch/arm64/kvm/hyp/nvhe/hyp-init.S | 52 ++- arch/arm64/kvm/pmu-emul.c | 6 +- arch/arm64/kvm/sys_regs.c | 1 + arch/arm64/tools/gen-sysreg.awk | 2 +- arch/arm64/tools/sysreg | 502 +++++++++++++++++++++- drivers/perf/apple_m1_cpu_pmu.c | 4 +- drivers/perf/arm_pmu.c | 11 +- drivers/perf/arm_pmu_platform.c | 2 +- drivers/perf/arm_pmuv3.c | 68 +-- drivers/perf/arm_spe_pmu.c | 170 +++++++- include/linux/perf/arm_pmu.h | 2 +- include/linux/perf/arm_pmuv3.h | 1 + include/uapi/linux/perf_event.h | 4 + tools/include/uapi/linux/perf_event.h | 2 + tools/perf/Documentation/perf-arm-spe.txt | 103 ++++- tools/perf/tests/parse-events.c | 14 +- tools/perf/util/parse-events.c | 11 + tools/perf/util/parse-events.h | 1 + tools/perf/util/parse-events.l | 1 + tools/perf/util/pmu.c | 3 + tools/perf/util/pmu.h | 1 + 28 files changed, 1098 insertions(+), 195 deletions(-) create mode 100644 arch/arm64/include/asm/vncr_mapping.h -- 2.33.0

2 37

[PATCH OLK-6.6] Revert "efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs"
by Xinyu Zheng 08 May '26

08 May '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8677 -------------------------------- This reverts commit b9c7bcaf7b0531bade10dfed2a453e0b40e62d20. This patch follow the latest UEFI/2.10 2.9A data structure specs description. In downstream CI environment, their Bios version just follow UEFI 2.8 verison, which has error type parse conflict. Since now all released BIOS version still following UEFI 2.8, revert this LTS patch to keep consistency. Fixes: b9c7bcaf7b05 ("efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs") Signed-off-by: Xinyu Zheng <zhengxinyu6(a)huawei.com> --- drivers/acpi/apei/ghes.c | 16 ++++------- drivers/firmware/efi/cper-arm.c | 50 +++++++++++++++++---------------- include/linux/cper.h | 10 +++---- 3 files changed, 37 insertions(+), 39 deletions(-) diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c index 4c3dee093745..34ab844bd013 100644 --- a/drivers/acpi/apei/ghes.c +++ b/drivers/acpi/apei/ghes.c @@ -22,7 +22,6 @@ #include <linux/moduleparam.h> #include <linux/init.h> #include <linux/acpi.h> -#include <linux/bitfield.h> #include <linux/io.h> #include <linux/interrupt.h> #include <linux/timer.h> @@ -608,7 +607,6 @@ static bool ghes_handle_arm_hw_error(struct acpi_hest_generic_data *gdata, { struct cper_sec_proc_arm *err = acpi_hest_get_payload(gdata); int flags = sync ? MF_ACTION_REQUIRED : 0; - char error_type[120]; bool queued = false; int sec_sev, i; bool critical; @@ -627,8 +625,9 @@ static bool ghes_handle_arm_hw_error(struct acpi_hest_generic_data *gdata, critical = ghes_armp_vendor_critical_error(err, sync); for (i = 0; i < err->err_info_num; i++) { struct cper_arm_err_info *err_info = (struct cper_arm_err_info *)p; - bool is_cache = err_info->type & CPER_ARM_CACHE_ERROR; + bool is_cache = (err_info->type == CPER_ARM_CACHE_ERROR); bool has_pa = (err_info->validation_bits & CPER_ARM_INFO_VALID_PHYSICAL_ADDR); + const char *error_type = "unknown error"; /* * The field (err_info->error_info & BIT(26)) is fixed to set to @@ -642,15 +641,12 @@ static bool ghes_handle_arm_hw_error(struct acpi_hest_generic_data *gdata, continue; } - cper_bits_to_str(error_type, sizeof(error_type), - FIELD_GET(CPER_ARM_ERR_TYPE_MASK, err_info->type), - cper_proc_error_type_strs, - ARRAY_SIZE(cper_proc_error_type_strs)); + if (err_info->type < ARRAY_SIZE(cper_proc_error_type_strs)) + error_type = cper_proc_error_type_strs[err_info->type]; pr_warn_ratelimited(FW_WARN GHES_PFX - "Unhandled processor error type 0x%02x: %s%s\n", - err_info->type, error_type, - (err_info->type & ~CPER_ARM_ERR_TYPE_MASK) ? " with reserved bit(s)" : ""); + "Unhandled processor error type: %s\n", + error_type); p += err_info->length; } diff --git a/drivers/firmware/efi/cper-arm.c b/drivers/firmware/efi/cper-arm.c index 52d18490b59e..eb7ee6af55f2 100644 --- a/drivers/firmware/efi/cper-arm.c +++ b/drivers/firmware/efi/cper-arm.c @@ -93,11 +93,15 @@ static void cper_print_arm_err_info(const char *pfx, u32 type, bool proc_context_corrupt, corrected, precise_pc, restartable_pc; bool time_out, access_mode; + /* If the type is unknown, bail. */ + if (type > CPER_ARM_MAX_TYPE) + return; + /* * Vendor type errors have error information values that are vendor * specific. */ - if (type & CPER_ARM_VENDOR_ERROR) + if (type == CPER_ARM_VENDOR_ERROR) return; if (error_info & CPER_ARM_ERR_VALID_TRANSACTION_TYPE) { @@ -112,38 +116,43 @@ static void cper_print_arm_err_info(const char *pfx, u32 type, if (error_info & CPER_ARM_ERR_VALID_OPERATION_TYPE) { op_type = ((error_info >> CPER_ARM_ERR_OPERATION_SHIFT) & CPER_ARM_ERR_OPERATION_MASK); - if (type & CPER_ARM_CACHE_ERROR) { + switch (type) { + case CPER_ARM_CACHE_ERROR: if (op_type < ARRAY_SIZE(arm_cache_err_op_strs)) { - printk("%scache error, operation type: %s\n", pfx, + printk("%soperation type: %s\n", pfx, arm_cache_err_op_strs[op_type]); } - } - if (type & CPER_ARM_TLB_ERROR) { + break; + case CPER_ARM_TLB_ERROR: if (op_type < ARRAY_SIZE(arm_tlb_err_op_strs)) { - printk("%sTLB error, operation type: %s\n", pfx, + printk("%soperation type: %s\n", pfx, arm_tlb_err_op_strs[op_type]); } - } - if (type & CPER_ARM_BUS_ERROR) { + break; + case CPER_ARM_BUS_ERROR: if (op_type < ARRAY_SIZE(arm_bus_err_op_strs)) { - printk("%sbus error, operation type: %s\n", pfx, + printk("%soperation type: %s\n", pfx, arm_bus_err_op_strs[op_type]); } + break; } } if (error_info & CPER_ARM_ERR_VALID_LEVEL) { level = ((error_info >> CPER_ARM_ERR_LEVEL_SHIFT) & CPER_ARM_ERR_LEVEL_MASK); - if (type & CPER_ARM_CACHE_ERROR) + switch (type) { + case CPER_ARM_CACHE_ERROR: printk("%scache level: %d\n", pfx, level); - - if (type & CPER_ARM_TLB_ERROR) + break; + case CPER_ARM_TLB_ERROR: printk("%sTLB level: %d\n", pfx, level); - - if (type & CPER_ARM_BUS_ERROR) + break; + case CPER_ARM_BUS_ERROR: printk("%saffinity level at which the bus error occurred: %d\n", pfx, level); + break; + } } if (error_info & CPER_ARM_ERR_VALID_PROC_CONTEXT_CORRUPT) { @@ -232,7 +241,6 @@ void cper_print_proc_arm(const char *pfx, struct cper_arm_err_info *err_info; struct cper_arm_ctx_info *ctx_info; char newpfx[64], infopfx[ARRAY_SIZE(newpfx) + 1]; - char error_type[120]; printk("%sMIDR: 0x%016llx\n", pfx, proc->midr); @@ -281,15 +289,9 @@ void cper_print_proc_arm(const char *pfx, newpfx); } - cper_bits_to_str(error_type, sizeof(error_type), - FIELD_GET(CPER_ARM_ERR_TYPE_MASK, err_info->type), - cper_proc_error_type_strs, - ARRAY_SIZE(cper_proc_error_type_strs)); - - printk("%serror_type: 0x%02x: %s%s\n", newpfx, err_info->type, - error_type, - (err_info->type & ~CPER_ARM_ERR_TYPE_MASK) ? " with reserved bit(s)" : ""); - + printk("%serror_type: %d, %s\n", newpfx, err_info->type, + err_info->type < ARRAY_SIZE(cper_proc_error_type_strs) ? + cper_proc_error_type_strs[err_info->type] : "unknown"); if (err_info->validation_bits & CPER_ARM_INFO_VALID_ERR_INFO) { printk("%serror_info: 0x%016llx\n", newpfx, err_info->error_info); diff --git a/include/linux/cper.h b/include/linux/cper.h index eb5c54814e76..e94724818bc2 100644 --- a/include/linux/cper.h +++ b/include/linux/cper.h @@ -274,11 +274,11 @@ enum { #define CPER_ARM_INFO_FLAGS_PROPAGATED BIT(2) #define CPER_ARM_INFO_FLAGS_OVERFLOW BIT(3) -#define CPER_ARM_ERR_TYPE_MASK GENMASK(4,1) -#define CPER_ARM_CACHE_ERROR BIT(1) -#define CPER_ARM_TLB_ERROR BIT(2) -#define CPER_ARM_BUS_ERROR BIT(3) -#define CPER_ARM_VENDOR_ERROR BIT(4) +#define CPER_ARM_CACHE_ERROR 0 +#define CPER_ARM_TLB_ERROR 1 +#define CPER_ARM_BUS_ERROR 2 +#define CPER_ARM_VENDOR_ERROR 3 +#define CPER_ARM_MAX_TYPE CPER_ARM_VENDOR_ERROR #define CPER_ARM_ERR_VALID_TRANSACTION_TYPE BIT(0) #define CPER_ARM_ERR_VALID_OPERATION_TYPE BIT(1) -- 2.34.1

2 1

[PATCH OLK-6.6] Revert "efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs"
by Xinyu Zheng 08 May '26

08 May '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8677 -------------------------------- This reverts commit b9c7bcaf7b0531bade10dfed2a453e0b40e62d20. This patch follow the latest UEFI/2.10 2.9A data structure specs description. In downstream CI environment, their Bios version just follow UEFI 2.8 verison, which has error type parse conflict. Since now all released BIOS version still following UEFI 2.8, revert this LTS patch to keep consistency. Fixes: b9c7bcaf7b05 ("[Backport] efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs") Signed-off-by: Xinyu Zheng <zhengxinyu6(a)huawei.com> --- drivers/acpi/apei/ghes.c | 16 ++++------- drivers/firmware/efi/cper-arm.c | 50 +++++++++++++++++---------------- include/linux/cper.h | 10 +++---- 3 files changed, 37 insertions(+), 39 deletions(-) diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c index 4c3dee093745..34ab844bd013 100644 --- a/drivers/acpi/apei/ghes.c +++ b/drivers/acpi/apei/ghes.c @@ -22,7 +22,6 @@ #include <linux/moduleparam.h> #include <linux/init.h> #include <linux/acpi.h> -#include <linux/bitfield.h> #include <linux/io.h> #include <linux/interrupt.h> #include <linux/timer.h> @@ -608,7 +607,6 @@ static bool ghes_handle_arm_hw_error(struct acpi_hest_generic_data *gdata, { struct cper_sec_proc_arm *err = acpi_hest_get_payload(gdata); int flags = sync ? MF_ACTION_REQUIRED : 0; - char error_type[120]; bool queued = false; int sec_sev, i; bool critical; @@ -627,8 +625,9 @@ static bool ghes_handle_arm_hw_error(struct acpi_hest_generic_data *gdata, critical = ghes_armp_vendor_critical_error(err, sync); for (i = 0; i < err->err_info_num; i++) { struct cper_arm_err_info *err_info = (struct cper_arm_err_info *)p; - bool is_cache = err_info->type & CPER_ARM_CACHE_ERROR; + bool is_cache = (err_info->type == CPER_ARM_CACHE_ERROR); bool has_pa = (err_info->validation_bits & CPER_ARM_INFO_VALID_PHYSICAL_ADDR); + const char *error_type = "unknown error"; /* * The field (err_info->error_info & BIT(26)) is fixed to set to @@ -642,15 +641,12 @@ static bool ghes_handle_arm_hw_error(struct acpi_hest_generic_data *gdata, continue; } - cper_bits_to_str(error_type, sizeof(error_type), - FIELD_GET(CPER_ARM_ERR_TYPE_MASK, err_info->type), - cper_proc_error_type_strs, - ARRAY_SIZE(cper_proc_error_type_strs)); + if (err_info->type < ARRAY_SIZE(cper_proc_error_type_strs)) + error_type = cper_proc_error_type_strs[err_info->type]; pr_warn_ratelimited(FW_WARN GHES_PFX - "Unhandled processor error type 0x%02x: %s%s\n", - err_info->type, error_type, - (err_info->type & ~CPER_ARM_ERR_TYPE_MASK) ? " with reserved bit(s)" : ""); + "Unhandled processor error type: %s\n", + error_type); p += err_info->length; } diff --git a/drivers/firmware/efi/cper-arm.c b/drivers/firmware/efi/cper-arm.c index 52d18490b59e..eb7ee6af55f2 100644 --- a/drivers/firmware/efi/cper-arm.c +++ b/drivers/firmware/efi/cper-arm.c @@ -93,11 +93,15 @@ static void cper_print_arm_err_info(const char *pfx, u32 type, bool proc_context_corrupt, corrected, precise_pc, restartable_pc; bool time_out, access_mode; + /* If the type is unknown, bail. */ + if (type > CPER_ARM_MAX_TYPE) + return; + /* * Vendor type errors have error information values that are vendor * specific. */ - if (type & CPER_ARM_VENDOR_ERROR) + if (type == CPER_ARM_VENDOR_ERROR) return; if (error_info & CPER_ARM_ERR_VALID_TRANSACTION_TYPE) { @@ -112,38 +116,43 @@ static void cper_print_arm_err_info(const char *pfx, u32 type, if (error_info & CPER_ARM_ERR_VALID_OPERATION_TYPE) { op_type = ((error_info >> CPER_ARM_ERR_OPERATION_SHIFT) & CPER_ARM_ERR_OPERATION_MASK); - if (type & CPER_ARM_CACHE_ERROR) { + switch (type) { + case CPER_ARM_CACHE_ERROR: if (op_type < ARRAY_SIZE(arm_cache_err_op_strs)) { - printk("%scache error, operation type: %s\n", pfx, + printk("%soperation type: %s\n", pfx, arm_cache_err_op_strs[op_type]); } - } - if (type & CPER_ARM_TLB_ERROR) { + break; + case CPER_ARM_TLB_ERROR: if (op_type < ARRAY_SIZE(arm_tlb_err_op_strs)) { - printk("%sTLB error, operation type: %s\n", pfx, + printk("%soperation type: %s\n", pfx, arm_tlb_err_op_strs[op_type]); } - } - if (type & CPER_ARM_BUS_ERROR) { + break; + case CPER_ARM_BUS_ERROR: if (op_type < ARRAY_SIZE(arm_bus_err_op_strs)) { - printk("%sbus error, operation type: %s\n", pfx, + printk("%soperation type: %s\n", pfx, arm_bus_err_op_strs[op_type]); } + break; } } if (error_info & CPER_ARM_ERR_VALID_LEVEL) { level = ((error_info >> CPER_ARM_ERR_LEVEL_SHIFT) & CPER_ARM_ERR_LEVEL_MASK); - if (type & CPER_ARM_CACHE_ERROR) + switch (type) { + case CPER_ARM_CACHE_ERROR: printk("%scache level: %d\n", pfx, level); - - if (type & CPER_ARM_TLB_ERROR) + break; + case CPER_ARM_TLB_ERROR: printk("%sTLB level: %d\n", pfx, level); - - if (type & CPER_ARM_BUS_ERROR) + break; + case CPER_ARM_BUS_ERROR: printk("%saffinity level at which the bus error occurred: %d\n", pfx, level); + break; + } } if (error_info & CPER_ARM_ERR_VALID_PROC_CONTEXT_CORRUPT) { @@ -232,7 +241,6 @@ void cper_print_proc_arm(const char *pfx, struct cper_arm_err_info *err_info; struct cper_arm_ctx_info *ctx_info; char newpfx[64], infopfx[ARRAY_SIZE(newpfx) + 1]; - char error_type[120]; printk("%sMIDR: 0x%016llx\n", pfx, proc->midr); @@ -281,15 +289,9 @@ void cper_print_proc_arm(const char *pfx, newpfx); } - cper_bits_to_str(error_type, sizeof(error_type), - FIELD_GET(CPER_ARM_ERR_TYPE_MASK, err_info->type), - cper_proc_error_type_strs, - ARRAY_SIZE(cper_proc_error_type_strs)); - - printk("%serror_type: 0x%02x: %s%s\n", newpfx, err_info->type, - error_type, - (err_info->type & ~CPER_ARM_ERR_TYPE_MASK) ? " with reserved bit(s)" : ""); - + printk("%serror_type: %d, %s\n", newpfx, err_info->type, + err_info->type < ARRAY_SIZE(cper_proc_error_type_strs) ? + cper_proc_error_type_strs[err_info->type] : "unknown"); if (err_info->validation_bits & CPER_ARM_INFO_VALID_ERR_INFO) { printk("%serror_info: 0x%016llx\n", newpfx, err_info->error_info); diff --git a/include/linux/cper.h b/include/linux/cper.h index eb5c54814e76..e94724818bc2 100644 --- a/include/linux/cper.h +++ b/include/linux/cper.h @@ -274,11 +274,11 @@ enum { #define CPER_ARM_INFO_FLAGS_PROPAGATED BIT(2) #define CPER_ARM_INFO_FLAGS_OVERFLOW BIT(3) -#define CPER_ARM_ERR_TYPE_MASK GENMASK(4,1) -#define CPER_ARM_CACHE_ERROR BIT(1) -#define CPER_ARM_TLB_ERROR BIT(2) -#define CPER_ARM_BUS_ERROR BIT(3) -#define CPER_ARM_VENDOR_ERROR BIT(4) +#define CPER_ARM_CACHE_ERROR 0 +#define CPER_ARM_TLB_ERROR 1 +#define CPER_ARM_BUS_ERROR 2 +#define CPER_ARM_VENDOR_ERROR 3 +#define CPER_ARM_MAX_TYPE CPER_ARM_VENDOR_ERROR #define CPER_ARM_ERR_VALID_TRANSACTION_TYPE BIT(0) #define CPER_ARM_ERR_VALID_OPERATION_TYPE BIT(1) -- 2.34.1

2 1

[openEuler-1.0-LTS] pstore: ram_core: fix incorrect success return when vmap() fails
by Luo Gengkun 08 May '26

08 May '26

From: Ruipeng Qi <ruipengqi3(a)gmail.com> stable inclusion from stable-v5.10.252 commit d47234840aeb4182ed3ee795c578b1dfa9cbd25b category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14671 CVE: CVE-2026-43124 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- [ Upstream commit 05363abc7625cf18c96e67f50673cd07f11da5e9 ] In persistent_ram_vmap(), vmap() may return NULL on failure. If offset is non-zero, adding offset_in_page(start) causes the function to return a non-NULL pointer even though the mapping failed. persistent_ram_buffer_map() therefore incorrectly returns success. Subsequent access to prz->buffer may dereference an invalid address and cause crashes. Add proper NULL checking for vmap() failures. Signed-off-by: Ruipeng Qi <ruipengqi3(a)gmail.com> Link: https://patch.msgid.link/20260203020358.3315299-1-ruipengqi3@gmail.com Signed-off-by: Kees Cook <kees(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- fs/pstore/ram_core.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c index 588392e6f531..749a9fa36b62 100644 --- a/fs/pstore/ram_core.c +++ b/fs/pstore/ram_core.c @@ -433,6 +433,13 @@ static void *persistent_ram_vmap(phys_addr_t start, size_t size, vaddr = vmap(pages, page_count, VM_MAP | VM_IOREMAP, prot); kfree(pages); + /* + * vmap() may fail and return NULL. Do not add the offset in this + * case, otherwise a NULL mapping would appear successful. + */ + if (!vaddr) + return NULL; + /* * Since vmap() uses page granularity, we must add the offset * into the page here, to get the byte granularity address -- 2.34.1

1 0

[PATCH OLK-6.6 0/2] Fix CVE-2026-31729
by Hongbo Li 08 May '26

08 May '26

Fix CVE-2026-31729. Nathan Rebello (2): usb: typec: ucsi: validate connector number in ucsi_notify_common() usb: typec: ucsi: skip connector validation before init drivers/usb/typec/ucsi/ucsi.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) -- 2.34.1

2 3