- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 0/2] workqueue: Make flush_workqueue() cost scale with active pwqs
by Yao Kai 09 Sep '26

09 Sep '26

Hello, Since 636b927eba5b ("workqueue: Make unbound workqueues to use per-cpu pool_workqueues"), flush_workqueue() walks one pwq per possible CPU, cycling each pool lock, even when the workqueue is idle. Yao Kai reported the XFS CIL workqueue, flushed on every log force, spending up to 64us per flush in that walk on a 128-CPU machine. This patchset makes flushes visit only the pwqs which have been active since the last flush by tracking them on per-node lists. On a 192-CPU 2-node machine, flushing an idle per-cpu workqueue goes from 40k to 4.2M per second and 16 threads doing queue+flush in a loop go from 30k to 110k flushes per second. Dense flushes with every pwq active get 15-20% slower on unbound workqueues. Tejun Heo (2): workqueue: Maintain pwq->total_in_flight workqueue: Make flush_workqueue() visit only pwqs active since the last flush kernel/workqueue.c | 286 +++++++++++++++++++++++++++++++++++++-------- 1 file changed, 236 insertions(+), 50 deletions(-) -- 2.43.0

2 3

[PATCH OLK-5.10] sctp: stream: fully roll back denied add-stream state
by Zhang Qilong 09 Sep '26

09 Sep '26

From: Wyatt Feng <bronzed_45_vested(a)icloud.com> stable inclusion from stable-v5.10.259 commit 0cd2dc6dce8ca47212cd306ccd52eb315ef3cf85 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15635 CVE: CVE-2026-52929 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit a5f8a90ac9f77c678a9781c0a464b635e0d63e49 upstream. When ADD_OUT_STREAMS is denied, SCTP only shrinks the queued chunks and then lowers outcnt. That leaves removed stream metadata behind, so a later re-add can reuse a stale ext and hit a null-pointer dereference in the scheduler get path. Fix the rollback by tearing down the removed stream state the same way other stream resizes do. Unschedule the current scheduler state, drop the removed stream ext state with sctp_stream_outq_migrate(), and then reschedule the remaining streams. This keeps scheduler-private RR/FC/PRIO lists consistent while fully rolling back denied outgoing stream additions. Fixes: 637784ade221 ("sctp: introduce priority based stream scheduler") Cc: stable(a)kernel.org Reported-by: Yuan Tan <yuantan098(a)gmail.com> Reported-by: Yifan Wu <yifanwucs(a)gmail.com> Reported-by: Juefei Pu <tomapufckgml(a)gmail.com> Reported-by: Zhengchuan Liang <zcliangcn(a)gmail.com> Reported-by: Xin Liu <bird(a)lzu.edu.cn> Signed-off-by: Wyatt Feng <bronzed_45_vested(a)icloud.com> Signed-off-by: Ren Wei <n05ec(a)lzu.edu.cn> Acked-by: Xin Long <lucien.xin(a)gmail.com> Link: https://patch.msgid.link/d78954ecd94954653ee299400e98d74a03a6f7d3.178060339… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lin Yujun <linyujun809(a)h-partners.com> Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- net/sctp/stream.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/net/sctp/stream.c b/net/sctp/stream.c index 73c212ae69d8..6697ee605536 100644 --- a/net/sctp/stream.c +++ b/net/sctp/stream.c @@ -1040,21 +1040,25 @@ struct sctp_chunk *sctp_process_strreset_resp( *evp = sctp_ulpevent_make_assoc_reset_event(asoc, flags, stsn, rtsn, GFP_ATOMIC); } else if (req->type == SCTP_PARAM_RESET_ADD_OUT_STREAMS) { struct sctp_strreset_addstrm *addstrm; + const struct sctp_sched_ops *sched; __u16 number; addstrm = (struct sctp_strreset_addstrm *)req; nums = ntohs(addstrm->number_of_streams); number = stream->outcnt - nums; if (result == SCTP_STRRESET_PERFORMED) { for (i = number; i < stream->outcnt; i++) SCTP_SO(stream, i)->state = SCTP_STREAM_OPEN; } else { - sctp_stream_shrink_out(stream, number); + sched = sctp_sched_ops_from_stream(stream); + sched->unsched_all(stream); + sctp_stream_outq_migrate(stream, NULL, number); + sched->sched_all(stream); stream->outcnt = number; } *evp = sctp_ulpevent_make_stream_change_event(asoc, flags, 0, nums, GFP_ATOMIC); -- 2.43.0

2 1

[PATCH OLK-5.10] libceph: handle rbtree insertion error in decode_choose_args()
by Zhang Qilong 09 Sep '26

09 Sep '26

From: Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> stable inclusion from stable-v5.10.258 commit c7bf7864e2924fa5508ac270b0e9364bc13d5a6c category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15656 CVE: CVE-2026-52954 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit d289478cfc0bcf81c7914200d6abdcb78bd04ded upstream. A message of type CEPH_MSG_OSD_MAP contains an OSD map that itself contains a CRUSH map. The received CRUSH map may optionally contain choose_args that get decoded in decode_choose_args(). In this function, num_choose_arg_maps is read from the message, and a corresponding number of crush_choose_arg_maps gets decoded afterwards. Each crush_choose_arg_map has a choose_args_index, which serves as the key when inserting it into the choose_args rbtree of the decoded crush_map. If a (potentially corrupted) message contains two crush_choose_arg_maps with the same index, the assertion in insert_choose_arg_map() triggers a kernel BUG when trying to insert the second crush_choose_arg_map. This patch fixes the issue by switching to the non-asserting rbtree insertion function and rejecting the message if the insertion fails. [ idryomov: changelog ] Cc: stable(a)vger.kernel.org Signed-off-by: Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> Reviewed-by: Ilya Dryomov <idryomov(a)gmail.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- net/ceph/osdmap.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c index c6127aba5a70..2480ce67323c 100644 --- a/net/ceph/osdmap.c +++ b/net/ceph/osdmap.c @@ -373,11 +373,14 @@ static int decode_choose_args(void **p, void *end, struct crush_map *c) (!c->buckets[bucket_index] || arg->ids_size != c->buckets[bucket_index]->size)) goto e_inval; } - insert_choose_arg_map(&c->choose_args, arg_map); + if (!__insert_choose_arg_map(&c->choose_args, arg_map)) { + ret = -EEXIST; + goto fail; + } } return 0; e_inval: -- 2.43.0

2 1

[PATCH OLK-5.10] thunderbolt: Limit XDomain response copy to actual frame size
by Zhang Qilong 09 Sep '26

09 Sep '26

From: Michael Bommarito <michael.bommarito(a)gmail.com> stable inclusion from stable-v5.10.259 commit c55da494dfb445fb28df3a9d293c2be6a299cd01 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16026 CVE: CVE-2026-53146 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 4db2bd2ed4785dbadaeeab9f4e346b21ac5fb8eb upstream. tb_xdomain_copy() copies req->response_size bytes from the received packet buffer regardless of the actual frame size. When a short response arrives, this reads past the valid frame data in the DMA pool buffer into stale contents from previous transactions. Use the minimum of frame size and expected response size for the copy length. Fixes: cdae7c07e3e3 ("thunderbolt: Add support for XDomain properties") Cc: stable(a)vger.kernel.org Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Signed-off-by: Mika Westerberg <mika.westerberg(a)linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- drivers/thunderbolt/xdomain.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/thunderbolt/xdomain.c b/drivers/thunderbolt/xdomain.c index c00ad817042e..4071923583c7 100644 --- a/drivers/thunderbolt/xdomain.c +++ b/drivers/thunderbolt/xdomain.c @@ -79,11 +79,13 @@ static bool tb_xdomain_match(const struct tb_cfg_request *req, } static bool tb_xdomain_copy(struct tb_cfg_request *req, const struct ctl_pkg *pkg) { - memcpy(req->response, pkg->buffer, req->response_size); + size_t len = min_t(size_t, pkg->frame.size, req->response_size); + + memcpy(req->response, pkg->buffer, len); req->result.err = 0; return true; } static void response_ready(void *data) -- 2.43.0

2 1

[PATCH OLK-5.10] mm/huge_memory: update file PMD counter before folio_put()
by Zhang Qilong 09 Sep '26

09 Sep '26

From: Yin Tirui <yintirui(a)huawei.com> stable inclusion from stable-v5.10.259 commit 84b3212b166b446faea27ebebb7161405ffceef9 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15875 CVE: CVE-2026-53189 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 8d878059924f12c1bc24556a92ec56add74de3c8 ] __split_huge_pmd_locked() updates the file/shmem RSS counter after dropping the PMD mapping's folio reference. If folio_put() drops the last reference, mm_counter_file() can later read freed folio state via folio_test_swapbacked(). Move the counter update before folio_put(). Link: https://lore.kernel.org/20260526101337.1984081-1-yintirui@huawei.com Fixes: fadae2953072 ("thp: use mm_file_counter to determine update which rss counter") Signed-off-by: Yin Tirui <yintirui(a)huawei.com> Reviewed-by: Lorenzo Stoakes <ljs(a)kernel.org> Acked-by: David Hildenbrand (arm) <david(a)kernel.org> Reviewed-by: Lance Yang <lance.yang(a)linux.dev> Reviewed-by: Dev Jain <dev.jain(a)arm.com> Cc: Baolin Wang <baolin.wang(a)linux.alibaba.com> Cc: Barry Song <baohua(a)kernel.org> Cc: Chen Jun <chenjun102(a)huawei.com> Cc: Kefeng Wang <wangkefeng.wang(a)huawei.com> Cc: Liam R. Howlett <liam(a)infradead.org> Cc: Nico Pache <npache(a)redhat.com> Cc: Ryan Roberts <ryan.roberts(a)arm.com> Cc: Vlastimil Babka <vbabka(a)kernel.org> Cc: Yang Shi <yang.shi(a)linux.alibaba.com> Cc: Zi Yan <ziy(a)nvidia.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: mm/huge_memory.c [Just context conflicts] Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- mm/huge_memory.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/mm/huge_memory.c b/mm/huge_memory.c index 2825c5390fe9..261eefa41fa1 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -2038,11 +2038,13 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd, set_page_dirty(page); if (!PageReferenced(page) && pmd_young(old_pmd)) SetPageReferenced(page); reliable_page_counter(page, mm, -HPAGE_PMD_NR); page_remove_rmap(page, true); + add_mm_counter(mm, mm_counter_file(page), -HPAGE_PMD_NR); put_page(page); + return; } add_mm_counter(mm, mm_counter_file(page), -HPAGE_PMD_NR); return; } -- 2.43.0

2 1

[PATCH OLK-5.10 0/2] *** fix CVE-2026-74713 ***
by Lin Ruifeng 09 Sep '26

09 Sep '26

*** fix CVE-2026-74713 *** Lin Ruifeng (1): vhost_iotlb: bound map allocation in add_range Stefano Garzarella (1): vdpa_sim: make IOTLB entries limit configurable drivers/vdpa/vdpa_sim/vdpa_sim.c | 10 ++++++- drivers/vhost/iotlb.c | 46 +++++++++++++++++++++++--------- drivers/vhost/vhost.c | 8 ++++++ 3 files changed, 50 insertions(+), 14 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10 0/2] *** fix CVE-2026-74713 ***
by Lin Ruifeng 08 Sep '26

08 Sep '26

*** fix CVE-2026-74713 *** Lin Ruifeng (1): vhost_iotlb: bound map allocation in add_range Stefano Garzarella (1): vdpa_sim: make IOTLB entries limit configurable drivers/vdpa/vdpa_sim/vdpa_sim.c | 10 ++++++- drivers/vhost/iotlb.c | 46 +++++++++++++++++++++++--------- drivers/vhost/vhost.c | 8 ++++++ 3 files changed, 50 insertions(+), 14 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] libceph: fix multiple unsafe decodes in decode_locker()
by Zhang Qilong 08 Sep '26

08 Sep '26

From: Pavitra Jha <jhapavitra98(a)gmail.com> stable inclusion from stable-v6.6.153 commit fa4aa86fff0c56799c2e3f51a88879053285f4a9 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18381 CVE: CVE-2026-80561 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------ commit 437b6551cfcc235eea1d735a874f9d421f555e17 upstream. decode_locker() in cls_lock_client.c contains three unsafe decode operations that allow a malicious or compromised OSD to trigger slab-out-of-bounds reads: 1. ceph_decode_copy() at the locker_id_t name field has no preceding bounds check. With p == end after ceph_start_decoding() accepts struct_len=0, this reads sizeof(ceph_entity_name) = 9 bytes past the validated buffer boundary. 2. *p += sizeof(struct ceph_timespec) after the locker_info_t header is an unchecked pointer advance. A malicious OSD can position p past end, causing all subsequent _safe checks to pass against a bogus boundary. 3. len = ceph_decode_32(p) has no preceding bounds check, and the immediately following *p += len is uncapped. A malicious OSD can send len=0xffffffff, advancing p gigabytes past end and escaping the decode window entirely. Fix all three by replacing bare operations with their safe variants: ceph_decode_copy -> ceph_decode_copy_safe *p += sizeof(...) -> ceph_decode_skip_n ceph_decode_32(p) -> ceph_decode_32_safe *p += len -> ceph_decode_skip_n A new label is added to return -EINVAL on any bounds violation. -EINVAL is appropriate here: the data received from the OSD is structurally malformed, which is an invalid argument to the decode contract regardless of whether the caller or the wire is at fault. Attacker model: a malicious or compromised OSD in a multi-tenant Ceph deployment can trigger this against any kernel client that issues the lock.get_info class method (e.g. during RBD exclusive lock acquisition) without any further privileges beyond OSD session establishment. [ idryomov: use ceph_decode_skip_string() to skip description, trim changelog ] Cc: stable(a)vger.kernel.org Fixes: d4ed4a530562 ("libceph: support for lock.lock_info") Signed-off-by: Pavitra Jha <jhapavitra98(a)gmail.com> Reviewed-by: Ilya Dryomov <idryomov(a)gmail.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Hulk Robot <hulkrobot(a)huawei.com> Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- net/ceph/cls_lock_client.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/net/ceph/cls_lock_client.c b/net/ceph/cls_lock_client.c index 639793597b76..a9655678be6f 100644 --- a/net/ceph/cls_lock_client.c +++ b/net/ceph/cls_lock_client.c @@ -257,34 +257,39 @@ static int decode_locker(void **p, void *end, struct ceph_locker *locker) ret = ceph_start_decoding(p, end, 1, "locker_id_t", &struct_v, &len); if (ret) return ret; - ceph_decode_copy(p, &locker->id.name, sizeof(locker->id.name)); + ceph_decode_copy_safe(p, end, &locker->id.name, + sizeof(locker->id.name), bad); s = ceph_extract_encoded_string(p, end, NULL, GFP_NOIO); if (IS_ERR(s)) return PTR_ERR(s); locker->id.cookie = s; ret = ceph_start_decoding(p, end, 1, "locker_info_t", &struct_v, &len); if (ret) return ret; - *p += sizeof(struct ceph_timespec); /* skip expiration */ + /* skip expiration */ + ceph_decode_skip_n(p, end, sizeof(struct ceph_timespec), bad); ret = ceph_decode_entity_addr(p, end, &locker->info.addr); if (ret) return ret; - len = ceph_decode_32(p); - *p += len; /* skip description */ + /* skip description */ + ceph_decode_skip_string(p, end, bad); dout("%s %s%llu cookie %s addr %s\n", __func__, ENTITY_NAME(locker->id.name), locker->id.cookie, ceph_pr_addr(&locker->info.addr)); return 0; + +bad: + return -EINVAL; } static int decode_lockers(void **p, void *end, u8 *type, char **tag, struct ceph_locker **lockers, u32 *num_lockers) { -- 2.43.0

2 1

[PATCH OLK-5.10] vdpa_sim: make IOTLB entries limit configurable
by Lin Ruifeng 08 Sep '26

08 Sep '26

From: Stefano Garzarella <sgarzare(a)redhat.com> mainline inclusion from mainline-5.11-rc1 commit 2fc0ebfa039025d88009e8f275ea8bcd177a9cd9 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18250 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm… -------------------------------- Some devices may require a higher limit for the number of IOTLB entries, so let's make it configurable through a module parameter. By default, it's initialized with the current limit (2048). Suggested-by: Jason Wang <jasowang(a)redhat.com> Signed-off-by: Stefano Garzarella <sgarzare(a)redhat.com> Link: https://lore.kernel.org/r/20201215144256.155342-5-sgarzare@redhat.com Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Conflicts: drivers/vdpa/vdpa_sim/vdpa_sim.c [Context Conflicts] Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/vdpa/vdpa_sim/vdpa_sim.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/vdpa/vdpa_sim/vdpa_sim.c b/drivers/vdpa/vdpa_sim/vdpa_sim.c index be925462922d..b7d93e906aa2 100644 --- a/drivers/vdpa/vdpa_sim/vdpa_sim.c +++ b/drivers/vdpa/vdpa_sim/vdpa_sim.c @@ -36,6 +36,11 @@ static int batch_mapping = 1; module_param(batch_mapping, int, 0444); MODULE_PARM_DESC(batch_mapping, "Batched mapping 1 -Enable; 0 - Disable"); +static int max_iotlb_entries = 2048; +module_param(max_iotlb_entries, int, 0444); +MODULE_PARM_DESC(max_iotlb_entries, + "Maximum number of iotlb entries. 0 means unlimited. (default: 2048)"); + #define VDPASIM_QUEUE_ALIGN PAGE_SIZE #define VDPASIM_QUEUE_MAX 256 #define VDPASIM_VENDOR_ID 0 @@ -262,7 +267,7 @@ struct vdpasim *vdpasim_create(struct vdpasim_dev_attr *dev_attr) if (!vdpasim->vqs) goto err_iommu; - vdpasim->iommu = vhost_iotlb_alloc(2048, 0); + vdpasim->iommu = vhost_iotlb_alloc(max_iotlb_entries, 0); if (!vdpasim->iommu) goto err_iommu; -- 2.34.1

2 1

[PATCH OLK-6.6 0/4] Fix CVE-2026-68096
by Yi Yang 08 Sep '26

08 Sep '26

The following four patches are used to fix the CVE-2026-68096 vulnerability: Jeff Layton (1): audit: widen ino fields to u64 NeilBrown (1): VFS/audit: introduce kern_path_parent() for audit Ricardo Robaina (2): audit: use 'unsigned int' instead of 'unsigned' audit: fix recursive locking deadlock in audit_dupe_exe() fs/namei.c | 43 ++++++++++++++++++++++++++++++++++++++ include/linux/audit.h | 6 +++--- include/linux/audit_arch.h | 12 +++++------ include/linux/namei.h | 1 + kernel/audit.c | 2 +- kernel/audit.h | 32 ++++++++++++++++------------ kernel/audit_fsnotify.c | 39 +++++++++++++++++++++------------- kernel/audit_tree.c | 2 +- kernel/audit_watch.c | 42 ++++++++++++++++++++++++------------- kernel/auditfilter.c | 17 ++++++++------- kernel/auditsc.c | 6 +++--- lib/compat_audit.c | 12 +++++------ 12 files changed, 144 insertions(+), 70 deletions(-) -- 2.25.1

2 5