- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] cifs: fix oops during encryption
by Li Lingfeng 14 Oct '25

14 Oct '25

From: Paulo Alcantara <pc(a)cjr.nz> mainline inclusion from mainline-v6.2-rc1 commit f7f291e14dde32a07b1f0aa06921d28f875a7b54 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICYBW6 CVE: CVE-2022-50341 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When running xfstests against Azure the following oops occurred on an arm64 system Unable to handle kernel write to read-only memory at virtual address ffff0001221cf000 Mem abort info: ESR = 0x9600004f EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x0f: level 3 permission fault Data abort info: ISV = 0, ISS = 0x0000004f CM = 0, WnR = 1 swapper pgtable: 4k pages, 48-bit VAs, pgdp=00000000294f3000 [ffff0001221cf000] pgd=18000001ffff8003, p4d=18000001ffff8003, pud=18000001ff82e003, pmd=18000001ff71d003, pte=00600001221cf787 Internal error: Oops: 9600004f [#1] PREEMPT SMP ... pstate: 80000005 (Nzcv daif -PAN -UAO -TCO BTYPE=--) pc : __memcpy+0x40/0x230 lr : scatterwalk_copychunks+0xe0/0x200 sp : ffff800014e92de0 x29: ffff800014e92de0 x28: ffff000114f9de80 x27: 0000000000000008 x26: 0000000000000008 x25: ffff800014e92e78 x24: 0000000000000008 x23: 0000000000000001 x22: 0000040000000000 x21: ffff000000000000 x20: 0000000000000001 x19: ffff0001037c4488 x18: 0000000000000014 x17: 235e1c0d6efa9661 x16: a435f9576b6edd6c x15: 0000000000000058 x14: 0000000000000001 x13: 0000000000000008 x12: ffff000114f2e590 x11: ffffffffffffffff x10: 0000040000000000 x9 : ffff8000105c3580 x8 : 2e9413b10000001a x7 : 534b4410fb86b005 x6 : 534b4410fb86b005 x5 : ffff0001221cf008 x4 : ffff0001037c4490 x3 : 0000000000000001 x2 : 0000000000000008 x1 : ffff0001037c4488 x0 : ffff0001221cf000 Call trace: __memcpy+0x40/0x230 scatterwalk_map_and_copy+0x98/0x100 crypto_ccm_encrypt+0x150/0x180 crypto_aead_encrypt+0x2c/0x40 crypt_message+0x750/0x880 smb3_init_transform_rq+0x298/0x340 smb_send_rqst.part.11+0xd8/0x180 smb_send_rqst+0x3c/0x100 compound_send_recv+0x534/0xbc0 smb2_query_info_compound+0x32c/0x440 smb2_set_ea+0x438/0x4c0 cifs_xattr_set+0x5d4/0x7c0 This is because in scatterwalk_copychunks(), we attempted to write to a buffer (@sign) that was allocated in the stack (vmalloc area) by crypt_message() and thus accessing its remaining 8 (x2) bytes ended up crossing a page boundary. To simply fix it, we could just pass @sign kmalloc'd from crypt_message() and then we're done. Luckily, we don't seem to pass any other vmalloc'd buffers in smb_rqst::rq_iov... Instead, let's map the correct pages and offsets from vmalloc buffers as well in cifs_sg_set_buf() and then avoiding such oopses. Signed-off-by: Paulo Alcantara (SUSE) <pc(a)cjr.nz> Cc: stable(a)vger.kernel.org Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/cifs/cifsglob.h fs/cifs/cifsproto.h fs/cifs/misc.c fs/cifs/smb2ops.c [Commit 49bd49f983b5 ("cifs: send workstation name during ntlmssp session setup") added inclusion of utsname.h in cifsglob.h; commit 76894f3e2f71 ("cifs: improve symlink handling for smb2+") added definition of move_cifs_info_to_smb2 in cifsglob.h; commit 2f5896797940 ("cifs: multichannel: try to rebind when reconnecting a channel") add definition of cifs_ses_find_chan in cifsproto.h; commit 03ab9cb982b6 ("cifs: Deal with some warnings from W=1") changed the comment of rqst_page_get_length; commit 070fb21e5912 ("cifsd: Alignment should match open parenthesis") modified the parameter indentation of smb2_sg_set_buf; commit 5a0ca7700591 ("cifsd: add support for AES256 encryption") SMB3_SIGN_KEY_SIZE by SMB3_ENC_DEC_KEY_SIZE in crypt_message; commit 2b2f75480762 ("SMB3.1.1: Add GCM crypto to the encrypt and decrypt functions") modified the initialization method of iv; commit a4e430c8c8ba ("cifs: replace kfree() with kfree_sensitive() for sensitive data") change the way to free iv/sg/req in crypt_message.] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/cifs/cifsglob.h | 70 ++++++++++++++++++++++ fs/cifs/cifsproto.h | 4 +- fs/cifs/misc.c | 4 +- fs/cifs/smb2ops.c | 139 +++++++++++++++++++++----------------------- 4 files changed, 141 insertions(+), 76 deletions(-) diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h index 08e9edbd8337..3a5ad0add234 100644 --- a/fs/cifs/cifsglob.h +++ b/fs/cifs/cifsglob.h @@ -22,6 +22,8 @@ #include <linux/in.h> #include <linux/in6.h> #include <linux/slab.h> +#include <linux/scatterlist.h> +#include <linux/mm.h> #include <linux/mempool.h> #include <linux/workqueue.h> #include "cifs_fs_sb.h" @@ -29,6 +31,7 @@ #include <crypto/internal/hash.h> #include <linux/scatterlist.h> #include <uapi/linux/cifs/cifs_mount.h> +#include "smb2glob.h" #include "smb2pdu.h" #define CIFS_MAGIC_NUMBER 0xFF534D42 /* the first four bytes of SMB PDUs */ @@ -1835,4 +1838,71 @@ extern struct smb_version_values smb302_values; #define ALT_SMB311_VERSION_STRING "3.11" extern struct smb_version_operations smb311_operations; extern struct smb_version_values smb311_values; + +static inline unsigned int cifs_get_num_sgs(const struct smb_rqst *rqst, + int num_rqst, + const u8 *sig) +{ + unsigned int len, skip; + unsigned int nents = 0; + unsigned long addr; + int i, j; + + /* Assumes the first rqst has a transform header as the first iov. + * I.e. + * rqst[0].rq_iov[0] is transform header + * rqst[0].rq_iov[1+] data to be encrypted/decrypted + * rqst[1+].rq_iov[0+] data to be encrypted/decrypted + */ + for (i = 0; i < num_rqst; i++) { + /* + * The first rqst has a transform header where the + * first 20 bytes are not part of the encrypted blob. + */ + for (j = 0; j < rqst[i].rq_nvec; j++) { + struct kvec *iov = &rqst[i].rq_iov[j]; + + skip = (i == 0) && (j == 0) ? 20 : 0; + addr = (unsigned long)iov->iov_base + skip; + if (unlikely(is_vmalloc_addr((void *)addr))) { + len = iov->iov_len - skip; + nents += DIV_ROUND_UP(offset_in_page(addr) + len, + PAGE_SIZE); + } else { + nents++; + } + } + nents += rqst[i].rq_npages; + } + nents += DIV_ROUND_UP(offset_in_page(sig) + SMB2_SIGNATURE_SIZE, PAGE_SIZE); + return nents; +} + +/* We can not use the normal sg_set_buf() as we will sometimes pass a + * stack object as buf. + */ +static inline struct scatterlist *cifs_sg_set_buf(struct scatterlist *sg, + const void *buf, + unsigned int buflen) +{ + unsigned long addr = (unsigned long)buf; + unsigned int off = offset_in_page(addr); + + addr &= PAGE_MASK; + if (unlikely(is_vmalloc_addr((void *)addr))) { + do { + unsigned int len = min_t(unsigned int, buflen, PAGE_SIZE - off); + + sg_set_page(sg++, vmalloc_to_page((void *)addr), len, off); + + off = 0; + addr += PAGE_SIZE; + buflen -= len; + } while (buflen); + } else { + sg_set_page(sg++, virt_to_page(addr), buflen, off); + } + return sg; +} + #endif /* _CIFS_GLOB_H */ diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h index bd97f2abeee8..357d8f32583b 100644 --- a/fs/cifs/cifsproto.h +++ b/fs/cifs/cifsproto.h @@ -562,7 +562,7 @@ int cifs_alloc_hash(const char *name, struct crypto_shash **shash, struct sdesc **sdesc); void cifs_free_hash(struct crypto_shash **shash, struct sdesc **sdesc); -extern void rqst_page_get_length(struct smb_rqst *rqst, unsigned int page, - unsigned int *len, unsigned int *offset); +void rqst_page_get_length(const struct smb_rqst *rqst, unsigned int page, + unsigned int *len, unsigned int *offset); #endif /* _CIFSPROTO_H */ diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c index 006f05ad2b80..17bd7901c4b7 100644 --- a/fs/cifs/misc.c +++ b/fs/cifs/misc.c @@ -954,8 +954,8 @@ cifs_free_hash(struct crypto_shash **shash, struct sdesc **sdesc) * Input: rqst - a smb_rqst, page - a page index for rqst * Output: *len - the length for this page, *offset - the offset for this page */ -void rqst_page_get_length(struct smb_rqst *rqst, unsigned int page, - unsigned int *len, unsigned int *offset) +void rqst_page_get_length(const struct smb_rqst *rqst, unsigned int page, + unsigned int *len, unsigned int *offset) { *len = rqst->rq_pagesz; *offset = (page == 0) ? rqst->rq_offset : 0; diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c index 193bfdc9d1d7..fe6d5d0e93f6 100644 --- a/fs/cifs/smb2ops.c +++ b/fs/cifs/smb2ops.c @@ -2603,69 +2603,83 @@ fill_transform_hdr(struct smb2_transform_hdr *tr_hdr, unsigned int orig_len, memcpy(&tr_hdr->SessionId, &shdr->SessionId, 8); } -/* We can not use the normal sg_set_buf() as we will sometimes pass a - * stack object as buf. - */ -static inline void smb2_sg_set_buf(struct scatterlist *sg, const void *buf, - unsigned int buflen) +static void *smb2_aead_req_alloc(struct crypto_aead *tfm, const struct smb_rqst *rqst, + int num_rqst, const u8 *sig, u8 **iv, + struct aead_request **req, struct scatterlist **sgl, + unsigned int *num_sgs) { - void *addr; - /* - * VMAP_STACK (at least) puts stack into the vmalloc address space - */ - if (is_vmalloc_addr(buf)) - addr = vmalloc_to_page(buf); - else - addr = virt_to_page(buf); - sg_set_page(sg, addr, buflen, offset_in_page(buf)); + unsigned int req_size = sizeof(**req) + crypto_aead_reqsize(tfm); + unsigned int iv_size = crypto_aead_ivsize(tfm); + unsigned int len; + u8 *p; + + *num_sgs = cifs_get_num_sgs(rqst, num_rqst, sig); + + len = iv_size; + len += crypto_aead_alignmask(tfm) & ~(crypto_tfm_ctx_alignment() - 1); + len = ALIGN(len, crypto_tfm_ctx_alignment()); + len += req_size; + len = ALIGN(len, __alignof__(struct scatterlist)); + len += *num_sgs * sizeof(**sgl); + + p = kmalloc(len, GFP_ATOMIC); + if (!p) + return NULL; + + *iv = (u8 *)PTR_ALIGN(p, crypto_aead_alignmask(tfm) + 1); + *req = (struct aead_request *)PTR_ALIGN(*iv + iv_size, + crypto_tfm_ctx_alignment()); + *sgl = (struct scatterlist *)PTR_ALIGN((u8 *)*req + req_size, + __alignof__(struct scatterlist)); + return p; } -/* Assumes the first rqst has a transform header as the first iov. - * I.e. - * rqst[0].rq_iov[0] is transform header - * rqst[0].rq_iov[1+] data to be encrypted/decrypted - * rqst[1+].rq_iov[0+] data to be encrypted/decrypted - */ -static struct scatterlist * -init_sg(int num_rqst, struct smb_rqst *rqst, u8 *sign) +static void *smb2_get_aead_req(struct crypto_aead *tfm, const struct smb_rqst *rqst, + int num_rqst, const u8 *sig, u8 **iv, + struct aead_request **req, struct scatterlist **sgl) { - unsigned int sg_len; + unsigned int off, len, skip; struct scatterlist *sg; - unsigned int i; - unsigned int j; - unsigned int idx = 0; - int skip; - - sg_len = 1; - for (i = 0; i < num_rqst; i++) - sg_len += rqst[i].rq_nvec + rqst[i].rq_npages; + unsigned int num_sgs; + unsigned long addr; + int i, j; + void *p; - sg = kmalloc_array(sg_len, sizeof(struct scatterlist), GFP_KERNEL); - if (!sg) + p = smb2_aead_req_alloc(tfm, rqst, num_rqst, sig, iv, req, sgl, &num_sgs); + if (!p) return NULL; - sg_init_table(sg, sg_len); + sg_init_table(*sgl, num_sgs); + sg = *sgl; + + /* Assumes the first rqst has a transform header as the first iov. + * I.e. + * rqst[0].rq_iov[0] is transform header + * rqst[0].rq_iov[1+] data to be encrypted/decrypted + * rqst[1+].rq_iov[0+] data to be encrypted/decrypted + */ for (i = 0; i < num_rqst; i++) { + /* + * The first rqst has a transform header where the + * first 20 bytes are not part of the encrypted blob. + */ for (j = 0; j < rqst[i].rq_nvec; j++) { - /* - * The first rqst has a transform header where the - * first 20 bytes are not part of the encrypted blob - */ + struct kvec *iov = &rqst[i].rq_iov[j]; + skip = (i == 0) && (j == 0) ? 20 : 0; - smb2_sg_set_buf(&sg[idx++], - rqst[i].rq_iov[j].iov_base + skip, - rqst[i].rq_iov[j].iov_len - skip); + addr = (unsigned long)iov->iov_base + skip; + len = iov->iov_len - skip; + sg = cifs_sg_set_buf(sg, (void *)addr, len); } for (j = 0; j < rqst[i].rq_npages; j++) { - unsigned int len, offset; - - rqst_page_get_length(&rqst[i], j, &len, &offset); - sg_set_page(&sg[idx++], rqst[i].rq_pages[j], len, offset); + rqst_page_get_length(&rqst[i], j, &len, &off); + sg_set_page(sg++, rqst[i].rq_pages[j], len, off); } } - smb2_sg_set_buf(&sg[idx], sign, SMB2_SIGNATURE_SIZE); - return sg; + cifs_sg_set_buf(sg, sig, SMB2_SIGNATURE_SIZE); + + return p; } static int @@ -2707,11 +2721,11 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst, u8 sign[SMB2_SIGNATURE_SIZE] = {}; u8 key[SMB3_SIGN_KEY_SIZE]; struct aead_request *req; - char *iv; - unsigned int iv_len; + u8 *iv; DECLARE_CRYPTO_WAIT(wait); struct crypto_aead *tfm; unsigned int crypt_len = le32_to_cpu(tr_hdr->OriginalMessageSize); + void *creq; rc = smb2_get_enc_key(server, tr_hdr->SessionId, enc, key); if (rc) { @@ -2740,34 +2754,19 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst, return rc; } - req = aead_request_alloc(tfm, GFP_KERNEL); - if (!req) { - cifs_dbg(VFS, "%s: Failed to alloc aead request", __func__); + creq = smb2_get_aead_req(tfm, rqst, num_rqst, sign, &iv, &req, &sg); + if (unlikely(!creq)) return -ENOMEM; - } if (!enc) { memcpy(sign, &tr_hdr->Signature, SMB2_SIGNATURE_SIZE); crypt_len += SMB2_SIGNATURE_SIZE; } - sg = init_sg(num_rqst, rqst, sign); - if (!sg) { - cifs_dbg(VFS, "%s: Failed to init sg", __func__); - rc = -ENOMEM; - goto free_req; - } - - iv_len = crypto_aead_ivsize(tfm); - iv = kzalloc(iv_len, GFP_KERNEL); - if (!iv) { - cifs_dbg(VFS, "%s: Failed to alloc IV", __func__); - rc = -ENOMEM; - goto free_sg; - } iv[0] = 3; memcpy(iv + 1, (char *)tr_hdr->Nonce, SMB3_AES128CMM_NONCE); + aead_request_set_tfm(req, tfm); aead_request_set_crypt(req, sg, sg, crypt_len, iv); aead_request_set_ad(req, assoc_data_len); @@ -2780,11 +2779,7 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst, if (!rc && enc) memcpy(&tr_hdr->Signature, sign, SMB2_SIGNATURE_SIZE); - kfree(iv); -free_sg: - kfree(sg); -free_req: - kfree(req); + kfree(creq); return rc; } -- 2.31.1

2 1

[PATCH OLK-6.6 0/3] *** OLK-6.6-fix-CVE-2025-39787 ***
by Chen Jinghuang 14 Oct '25

14 Oct '25

*** BLURB HERE *** Bjorn Andersson (2): [Backport] soc: qcom: mdt_loader: Ensure we don't read past the ELF header [Backport] soc: qcom: mdt_loader: Deal with zero e_shentsize Dan Carpenter (1): [Backport] soc: qcom: mdt_loader: Fix error return values in mdt_header_valid() drivers/soc/qcom/mdt_loader.c | 45 +++++++++++++++++++++++++++++++++++ 1 file changed, 45 insertions(+) -- 2.34.1

2 4

[PATCH v6 openEuler-25.03 00/16] Xsched Kernel Patch
by Xia Fukun 14 Oct '25

14 Oct '25

Xsched Kernel Patch Alekseev Dmitry (3): xsched: Add XCU control group implementation and its backend in xsched CFS xsched: Add support for CFS quota for cgroups xsched/core: Add xcu_wait() implementation Konstantin Meskhidze (11): xsched: Add base vstream support xcu: Add base NPU driver support xsched: Add debug prints in XSched mechanism xsched: Add XCU initialization support xsched: Introduce vstream management xsched: Add vstream_kick() implementation xsched: Add xsched_ctx_init_xse() implementation xsched: Add XCU xsched_schedule() implementation xsched: Add xsched RT class xsched: Add xsched_submit() implementation xsched: Add xsched CFS class Liu Kai (1): xsched/core: Add multi-card support for xsched Xia Fukun (1): XSched driver patch arch/arm/include/uapi/asm/unistd.h | 1 + arch/arm64/configs/openeuler_defconfig | 1 + arch/powerpc/include/uapi/asm/unistd.h | 1 + arch/x86/configs/openeuler_defconfig | 1 + arch/x86/entry/syscalls/syscall_64.tbl | 2 +- arch/x86/include/uapi/asm/unistd.h | 1 + drivers/Makefile | 1 + .../0001-Adapt-910b-npu-driver-for-xsched.txt | 917 ++++++++++++++++++ drivers/xcu/Makefile | 2 + drivers/xcu/xcu_group.c | 246 +++++ include/linux/cgroup_subsys.h | 4 + include/linux/syscalls.h | 2 + include/linux/vstream.h | 86 ++ include/linux/xcu_group.h | 112 +++ include/linux/xsched.h | 625 ++++++++++++ include/uapi/asm-generic/unistd.h | 5 +- include/uapi/linux/xcu_vstream.h | 57 ++ init/Kconfig | 1 + kernel/Makefile | 1 + kernel/cgroup/cgroup.c | 2 +- kernel/xsched/Kconfig | 51 + kernel/xsched/Makefile | 4 + kernel/xsched/cfs.c | 227 +++++ kernel/xsched/cfs_quota.c | 92 ++ kernel/xsched/cgroup.c | 680 +++++++++++++ kernel/xsched/core.c | 752 ++++++++++++++ kernel/xsched/rt.c | 242 +++++ kernel/xsched/vstream.c | 502 ++++++++++ 28 files changed, 4614 insertions(+), 4 deletions(-) create mode 100644 drivers/xcu/0001-Adapt-910b-npu-driver-for-xsched.txt create mode 100644 drivers/xcu/Makefile create mode 100644 drivers/xcu/xcu_group.c create mode 100644 include/linux/vstream.h create mode 100644 include/linux/xcu_group.h create mode 100644 include/linux/xsched.h create mode 100644 include/uapi/linux/xcu_vstream.h create mode 100644 kernel/xsched/Kconfig create mode 100644 kernel/xsched/Makefile create mode 100644 kernel/xsched/cfs.c create mode 100644 kernel/xsched/cfs_quota.c create mode 100644 kernel/xsched/cgroup.c create mode 100644 kernel/xsched/core.c create mode 100644 kernel/xsched/rt.c create mode 100644 kernel/xsched/vstream.c -- 2.34.1

2 17

[PATCH openEuler-1.0-LTS 0/2] fix CVE-2023-53560
by Tengda Wu 14 Oct '25

14 Oct '25

This patch series is a small bugfixes for ftrace hist feature. Mohamed Khalfella (2): tracing/histograms: Add histograms to hist_vars if they have referenced variables tracing/histograms: Return an error if we fail to add histogram to hist_vars list kernel/trace/trace_events_hist.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/5] Add XCALL_SMT_QOS support
by Jinjie Ruan 14 Oct '25

14 Oct '25

Add XCALL_SMT_QOS support. Jinjie Ruan (5): arm64: Let hardware xint use el0_xint() irqchip/gic-v3: Support PPI interrupt to be xint arm64: Add XCALL_SMT_QOS VDSO WFxt support sched: Reuse task online label logic of SMT expel arm64: Support pmu irq inject when select online/offline task arch/arm64/Kconfig.turbo | 12 ++ arch/arm64/include/asm/smt_qos.h | 102 +++++++++++ arch/arm64/include/asm/thread_info.h | 5 + arch/arm64/include/asm/vdso.h | 6 +- arch/arm64/include/uapi/asm/unistd.h | 5 + arch/arm64/kernel/Makefile | 1 + arch/arm64/kernel/entry-common.c | 46 ++++- arch/arm64/kernel/smt_qos.c | 95 +++++++++++ arch/arm64/kernel/vdso.c | 25 +++ arch/arm64/kernel/vdso/Makefile | 10 ++ arch/arm64/kernel/vdso/smt_qos.c | 47 +++++ arch/arm64/kernel/vdso/smt_qos_trampoline.S | 52 ++++++ arch/arm64/kernel/vdso/vdso.lds.S | 7 + drivers/irqchip/irq-gic-v3.c | 3 +- drivers/perf/arm_pmu.c | 11 ++ include/linux/mm_types.h | 4 + include/linux/syscalls.h | 4 + include/vdso/datapage.h | 5 + kernel/fork.c | 14 ++ kernel/sched/core.c | 55 +++++- kernel/sched/fair.c | 179 +++++++++++++++++++- kernel/sched/sched.h | 6 +- kernel/sysctl.c | 33 ++++ 23 files changed, 713 insertions(+), 14 deletions(-) create mode 100644 arch/arm64/include/asm/smt_qos.h create mode 100644 arch/arm64/kernel/smt_qos.c create mode 100644 arch/arm64/kernel/vdso/smt_qos.c create mode 100644 arch/arm64/kernel/vdso/smt_qos_trampoline.S -- 2.34.1

2 6

[PATCH OLK-5.10] net/oenetcls: Fix memleak when clean flow table
by Wang Liang 14 Oct '25

14 Oct '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICBFCS -------------------------------- When clean dev flow table in oecls_dev_flow_table_cleanup(), the oecls_ftb memory of every dev queue should be freed. Fixes: d60758b0ffcd ("net/oenetcls: introduce oenetcls for network optimization") Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/oenetcls/oenetcls_flow.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/net/oenetcls/oenetcls_flow.c b/net/oenetcls/oenetcls_flow.c index 3834f500f75d..8d9fdb343d28 100644 --- a/net/oenetcls/oenetcls_flow.c +++ b/net/oenetcls/oenetcls_flow.c @@ -251,15 +251,16 @@ static void oecls_dev_flow_table_cleanup(struct net_device *netdev, int qid) struct netdev_rx_queue *queue; int i; - spin_lock(&oecls_dev_flow_lock); for (i = 0; i < qid; i++) { queue = netdev->_rx + i; + spin_lock(&oecls_dev_flow_lock); dtb = rcu_dereference_protected(queue->oecls_ftb, lockdep_is_held(&oecls_dev_flow_lock)); rcu_assign_pointer(queue->oecls_ftb, NULL); + spin_unlock(&oecls_dev_flow_lock); + if (dtb) + call_rcu(&dtb->rcu, oecls_dev_flow_table_free); } - spin_unlock(&oecls_dev_flow_lock); - call_rcu(&dtb->rcu, oecls_dev_flow_table_free); } static int oecls_dev_flow_table_release(void) -- 2.34.1

2 1

[PATCH OLK-6.6] net/oenetcls: Fix memleak when clean flow table
by Wang Liang 14 Oct '25

14 Oct '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICS3XV -------------------------------- When clean dev flow table in oecls_dev_flow_table_cleanup(), the oecls_ftb memory of every dev queue should be freed. Fixes: 4bed6ba0e88f ("net/oenetcls: introduce oenetcls for network optimization") Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/oenetcls/oenetcls_flow.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/net/oenetcls/oenetcls_flow.c b/net/oenetcls/oenetcls_flow.c index 87efb5e6a126..eb7fae400e8e 100644 --- a/net/oenetcls/oenetcls_flow.c +++ b/net/oenetcls/oenetcls_flow.c @@ -252,15 +252,16 @@ static void oecls_dev_flow_table_cleanup(struct net_device *netdev, int qid) struct netdev_rx_queue *queue; int i; - spin_lock(&oecls_dev_flow_lock); for (i = 0; i < qid; i++) { queue = netdev->_rx + i; + spin_lock(&oecls_dev_flow_lock); dtb = rcu_dereference_protected(queue->oecls_ftb, lockdep_is_held(&oecls_dev_flow_lock)); rcu_assign_pointer(queue->oecls_ftb, NULL); + spin_unlock(&oecls_dev_flow_lock); + if (dtb) + call_rcu(&dtb->rcu, oecls_dev_flow_table_free); } - spin_unlock(&oecls_dev_flow_lock); - call_rcu(&dtb->rcu, oecls_dev_flow_table_free); } static int oecls_dev_flow_table_release(void) -- 2.34.1

2 1

[PATCH OLK-6.6 0/5] Add XCALL_SMT_QOS support
by Jinjie Ruan 14 Oct '25

14 Oct '25

Add XCALL_SMT_QOS support. Jinjie Ruan (5): arm64: Let hardware xint use el0_xint() irqchip/gic-v3: Support PPI interrupt to be xint arm64: Add XCALL_SMT_QOS VDSO WFxt support sched: Reuse task online label logic of SMT expel arm64: Support pmu irq inject when select online/offline task arch/arm64/Kconfig.turbo | 12 ++ arch/arm64/include/asm/smt_qos.h | 102 +++++++++++ arch/arm64/include/asm/thread_info.h | 5 + arch/arm64/include/asm/vdso.h | 6 +- arch/arm64/include/uapi/asm/unistd.h | 5 + arch/arm64/kernel/Makefile | 1 + arch/arm64/kernel/entry-common.c | 46 ++++- arch/arm64/kernel/smt_qos.c | 95 +++++++++++ arch/arm64/kernel/vdso.c | 25 +++ arch/arm64/kernel/vdso/Makefile | 10 ++ arch/arm64/kernel/vdso/smt_qos.c | 44 +++++ arch/arm64/kernel/vdso/smt_qos_trampoline.S | 52 ++++++ arch/arm64/kernel/vdso/vdso.lds.S | 7 + drivers/irqchip/irq-gic-v3.c | 3 +- drivers/perf/arm_pmu.c | 11 ++ include/linux/mm_types.h | 4 + include/linux/syscalls.h | 4 + include/vdso/datapage.h | 5 + kernel/fork.c | 14 ++ kernel/sched/core.c | 55 +++++- kernel/sched/fair.c | 179 +++++++++++++++++++- kernel/sched/sched.h | 6 +- kernel/sysctl.c | 33 ++++ 23 files changed, 710 insertions(+), 14 deletions(-) create mode 100644 arch/arm64/include/asm/smt_qos.h create mode 100644 arch/arm64/kernel/smt_qos.c create mode 100644 arch/arm64/kernel/vdso/smt_qos.c create mode 100644 arch/arm64/kernel/vdso/smt_qos_trampoline.S -- 2.34.1

2 6

[PATCH OLK-6.6 1/3] [Backport] soc: qcom: mdt_loader: Ensure we don't read past the ELF header
by Chen Jinghuang 14 Oct '25

14 Oct '25

From: Bjorn Andersson <bjorn.andersson(a)oss.qualcomm.com> stable inclusion from stable-v6.6.103 commit 981c845f29838e468a9bfa87f784307193a31297 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICXMCU CVE: CVE-2025-39787 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 9f9967fed9d066ed3dae9372b45ffa4f6fccfeef upstream. When the MDT loader is used in remoteproc, the ELF header is sanitized beforehand, but that's not necessary the case for other clients. Validate the size of the firmware buffer to ensure that we don't read past the end as we iterate over the header. e_phentsize and e_shentsize are validated as well, to ensure that the assumptions about step size in the traversal are valid. Fixes: 2aad40d911ee ("remoteproc: Move qcom_mdt_loader into drivers/soc/qcom") Cc: stable(a)vger.kernel.org Reported-by: Doug Anderson <dianders(a)chromium.org> Signed-off-by: Bjorn Andersson <bjorn.andersson(a)oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov(a)oss.qualcomm.com> Link: https://lore.kernel.org/r/20250610-mdt-loader-validation-and-fixes-v2-1-f70… Signed-off-by: Bjorn Andersson <andersson(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- drivers/soc/qcom/mdt_loader.c | 43 +++++++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+) diff --git a/drivers/soc/qcom/mdt_loader.c b/drivers/soc/qcom/mdt_loader.c index 6f177e46fa0f..2834f0771d3f 100644 --- a/drivers/soc/qcom/mdt_loader.c +++ b/drivers/soc/qcom/mdt_loader.c @@ -17,6 +17,37 @@ #include <linux/slab.h> #include <linux/soc/qcom/mdt_loader.h> +static bool mdt_header_valid(const struct firmware *fw) +{ + const struct elf32_hdr *ehdr; + size_t phend; + size_t shend; + + if (fw->size < sizeof(*ehdr)) + return false; + + ehdr = (struct elf32_hdr *)fw->data; + + if (memcmp(ehdr->e_ident, ELFMAG, SELFMAG)) + return false; + + if (ehdr->e_phentsize != sizeof(struct elf32_phdr)) + return -EINVAL; + + phend = size_add(size_mul(sizeof(struct elf32_phdr), ehdr->e_phnum), ehdr->e_phoff); + if (phend > fw->size) + return false; + + if (ehdr->e_shentsize != sizeof(struct elf32_shdr)) + return -EINVAL; + + shend = size_add(size_mul(sizeof(struct elf32_shdr), ehdr->e_shnum), ehdr->e_shoff); + if (shend > fw->size) + return false; + + return true; +} + static bool mdt_phdr_valid(const struct elf32_phdr *phdr) { if (phdr->p_type != PT_LOAD) @@ -84,6 +115,9 @@ ssize_t qcom_mdt_get_size(const struct firmware *fw) phys_addr_t max_addr = 0; int i; + if (!mdt_header_valid(fw)) + return -EINVAL; + ehdr = (struct elf32_hdr *)fw->data; phdrs = (struct elf32_phdr *)(ehdr + 1); @@ -136,6 +170,9 @@ void *qcom_mdt_read_metadata(const struct firmware *fw, size_t *data_len, ssize_t ret; void *data; + if (!mdt_header_valid(fw)) + return ERR_PTR(-EINVAL); + ehdr = (struct elf32_hdr *)fw->data; phdrs = (struct elf32_phdr *)(ehdr + 1); @@ -216,6 +253,9 @@ int qcom_mdt_pas_init(struct device *dev, const struct firmware *fw, int ret; int i; + if (!mdt_header_valid(fw)) + return -EINVAL; + ehdr = (struct elf32_hdr *)fw->data; phdrs = (struct elf32_phdr *)(ehdr + 1); @@ -312,6 +352,9 @@ static int __qcom_mdt_load(struct device *dev, const struct firmware *fw, if (!fw || !mem_region || !mem_phys || !mem_size) return -EINVAL; + if (!mdt_header_valid(fw)) + return -EINVAL; + is_split = qcom_mdt_bins_are_split(fw, fw_name); ehdr = (struct elf32_hdr *)fw->data; phdrs = (struct elf32_phdr *)(ehdr + 1); -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] vme: Fix error not catched in fake_init()
by Xiaomeng Zhang 14 Oct '25

14 Oct '25

From: Chen Zhongjin <chenzhongjin(a)huawei.com> stable inclusion from stable-v4.19.270 commit 09be0e7ac5f9374b6f8de72c89ed67129af71f65 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID0VG9 CVE: CVE-2022-50538 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 7bef797d707f1744f71156b21d41e3b8c946631f ] In fake_init(), __root_device_register() is possible to fail but it's ignored, which can cause unregistering vme_root fail when exit. general protection fault, probably for non-canonical address 0xdffffc000000008c KASAN: null-ptr-deref in range [0x0000000000000460-0x0000000000000467] RIP: 0010:root_device_unregister+0x26/0x60 Call Trace: <TASK> __x64_sys_delete_module+0x34f/0x540 do_syscall_64+0x38/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd Return error when __root_device_register() fails. Fixes: 658bcdae9c67 ("vme: Adding Fake VME driver") Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> Link: https://lore.kernel.org/r/20221205084805.147436-1-chenzhongjin@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/vme/bridges/vme_fake.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/vme/bridges/vme_fake.c b/drivers/vme/bridges/vme_fake.c index 7d83691047f4..142e784b60f4 100644 --- a/drivers/vme/bridges/vme_fake.c +++ b/drivers/vme/bridges/vme_fake.c @@ -1071,6 +1071,8 @@ static int __init fake_init(void) /* We need a fake parent device */ vme_root = __root_device_register("vme", THIS_MODULE); + if (IS_ERR(vme_root)) + return PTR_ERR(vme_root); /* If we want to support more than one bridge at some point, we need to * dynamically allocate this so we get one per device. -- 2.34.1

2 1