- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] sched: Add the qos schduler's cgroup v2 interface
by Chen Jinghuang 10 Aug '26

10 Aug '26

hulk inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/9738 -------------------------------- Add the qos schduler's cgroup v2 interface. Cgroup v2 use the qos scheduler, as follows: offline group: echo -1 > /sys/fs/cgroup/xxxx/offline/cpu.qos_level online group: /sys/fs/cgroup/xxxx/online/cpu.qos_level Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- kernel/sched/core.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 98bd31a685a9..03fbea3c1bbe 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -10661,6 +10661,14 @@ static struct cftype cpu_files[] = { .write = cpu_uclamp_max_write, }, #endif +#endif +#ifdef CONFIG_QOS_SCHED + { + .name = "qos_level", + .flags = CFTYPE_NOT_ON_ROOT, + .read_s64 = cpu_qos_read, + .write_s64 = cpu_qos_write, + }, #ifdef CONFIG_SCHED_SOFT_DOMAIN { .name = "soft_domain", -- 2.34.1

2 1

[PATCH OLK-5.10] exfat: bound uniname advance in exfat_find_dir_entry()
by Lai Zewei 10 Aug '26

10 Aug '26

stable inclusion from stable-v5.10.261 commit 72a2589d82eb001c94b74bcfe6f9a599bd9bef60 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16838 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- In exfat_find_dir_entry(), each TYPE_EXTEND (file name) entry advances the output pointer by a fixed amount while the loop guard only tracks the accumulated name length: if (++order == 2) uniname = p_uniname->name; else uniname += EXFAT_FILE_NAME_LEN; len = exfat_extract_uni_name(ep, entry_uniname); name_len += len; unichar = *(uniname+len); *(uniname+len) = 0x0; uniname grows by EXFAT_FILE_NAME_LEN (15) per name entry, but name_len grows only by the actual extracted length, which is shorter when a name fragment contains an early NUL. The only guard is `name_len >= MAX_NAME_LENGTH`, so a crafted directory with many short name fragments lets uniname run far past the p_uniname->name[MAX_NAME_LENGTH + 3] buffer while name_len stays small, causing an out-of-bounds read and write at *(uniname+len). The sibling extractor exfat_get_uniname_from_ext_entry() already stops on a short fragment (the lockstep `len != EXFAT_FILE_NAME_LEN` guard added in commit d42334578eba ("exfat: check if filename entries exceeds max filename length")); exfat_find_dir_entry() never got the equivalent. Track the per-entry write offset as a count and reject a fragment once the offset, or the offset plus the extracted length, would exceed MAX_NAME_LENGTH, before forming the output pointer. Fixes: ca06197382bd ("exfat: add directory operations") Cc: stable(a)vger.kernel.org Suggested-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Bryam Vargas <hexlabsecurity(a)proton.me> Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Conflicts: fs/exfat/dir.c [ctx conflicts] Signed-off-by: Lai Zewei <laizewei3(a)huawei.com> --- fs/exfat/dir.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/fs/exfat/dir.c b/fs/exfat/dir.c index 4543013ac048..3c88edfcb03a 100644 --- a/fs/exfat/dir.c +++ b/fs/exfat/dir.c @@ -1045,6 +1045,7 @@ int exfat_find_dir_entry(struct super_block *sb, struct exfat_inode_info *ei, brelse(bh); if (entry_type == TYPE_EXTEND) { unsigned short entry_uniname[16], unichar; + unsigned int offset; if (step != DIRENT_STEP_NAME || name_len >= MAX_NAME_LENGTH) { @@ -1052,12 +1053,14 @@ int exfat_find_dir_entry(struct super_block *sb, struct exfat_inode_info *ei, continue; } - if (++order == 2) - uniname = p_uniname->name; - else - uniname += EXFAT_FILE_NAME_LEN; - + offset = (++order - 2) * EXFAT_FILE_NAME_LEN; len = exfat_extract_uni_name(ep, entry_uniname); + if (offset > MAX_NAME_LENGTH || + len > MAX_NAME_LENGTH - offset) { + step = DIRENT_STEP_FILE; + continue; + } + uniname = p_uniname->name + offset; name_len += len; unichar = *(uniname+len); -- 2.52.0

2 3

[PATCH OLK-6.6 0/2] Fix ringbuffer swap cpu buffer issue
by Tengda Wu 10 Aug '26

10 Aug '26

This series backports two mainline patches to resolve an issue with swapping CPU buffers in the ring buffer. Steven Rostedt (1): ring-buffer: Remove jump to out label in ring_buffer_swap_cpu() Tengda Wu (1): ring-buffer: Use current_context for safe per-CPU buffer swap kernel/trace/ring_buffer.c | 23 ++++++++++------------- 1 file changed, 10 insertions(+), 13 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10] USB: serial: mxuport: fix memory corruption with small endpoint
by Liu Mingrui 10 Aug '26

10 Aug '26

From: Johan Hovold <johan(a)kernel.org> stable inclusion from stable-v5.10.259 commit 086b858b5f5125bc9d967ea2bd825f83d9f8f29d category: bugfix bugzilla: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 4085f0dbb1ce2251c9a5938d693de6593f0ab2bd upstream. Make sure that the bulk-out endpoint max packet size is at least eight bytes to avoid user-controlled slab corruption should a malicious device report a smaller size. Fixes: ee467a1f2066 ("USB: serial: add Moxa UPORT 12XX/14XX/16XX driver") Cc: stable(a)vger.kernel.org # 3.14 Cc: Andrew Lunn <andrew(a)lunn.ch> Reviewed-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Johan Hovold <johan(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lin Yujun <linyujun809(a)h-partners.com> Signed-off-by: Mingrui Liu <liumingrui(a)huawei.com> --- drivers/usb/serial/mxuport.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/usb/serial/mxuport.c b/drivers/usb/serial/mxuport.c index 5d38c2a0f590..217b114db6bf 100644 --- a/drivers/usb/serial/mxuport.c +++ b/drivers/usb/serial/mxuport.c @@ -969,6 +969,14 @@ static int mxuport_calc_num_ports(struct usb_serial *serial, */ BUILD_BUG_ON(ARRAY_SIZE(epds->bulk_out) < 16); + /* + * The bulk-out buffers must be large enough for the four-byte header + * (and following data), but assume anything smaller than eight bytes + * is broken. + */ + if (usb_endpoint_maxp(epds->bulk_out[0]) < 8) + return -EINVAL; + for (i = 1; i < num_ports; ++i) epds->bulk_out[i] = epds->bulk_out[0]; -- 2.34.1

2 1

[PTACH OLK-6.6] sched: Add the qos schduler's cgroup v2 interface
by Chen Jinghuang 10 Aug '26

10 Aug '26

hulk inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/9738 -------------------------------- Add the qos schduler's cgroup v2 interface. Cgroup v2 use the qos scheduler, as follows: offline group: echo -1 > /sys/fs/cgroup/xxxx/offline/cpu.qos_level online group: /sys/fs/cgroup/xxxx/online/cpu.qos_level Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- kernel/sched/core.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/kernel/sched/core.c b/kernel/sched/core.c index cdc931c14930..fd8fdaaf7cbb 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -10660,6 +10660,14 @@ static struct cftype cpu_files[] = { .write = cpu_uclamp_max_write, }, #endif +#endif +#ifdef CONFIG_QOS_SCHED + { + .name = "qos_level", + .flags = CFTYPE_NOT_ON_ROOT, + .read_s64 = cpu_qos_read, + .write_s64 = cpu_qos_write, + }, #ifdef CONFIG_SCHED_SOFT_DOMAIN { .name = "soft_domain", -- 2.34.1

1 0

[PATCH OLK-6.6] ring-buffer: Use current_context for safe per-CPU buffer swap
by Tengda Wu 10 Aug '26

10 Aug '26

From: Tengda Wu <wutengda(a)huaweicloud.com> mainline inclusion from mainline-v7.2-rc7 commit f27bdc43077e4fcb5557dfc315ee8d91e741f483 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9717 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- The ring_buffer_swap_cpu() function currently checks the per-CPU committing counter to determine if a buffer is actively being written to before performing the swap. However, there exists a race window where this check can be bypassed: ring_buffer_lock_reserve cpu_buffer = buffer->buffers[cpu]; // cpu_buffer_a rb_reserve_next_event rb_start_commit // inc committing if (unlikely(READ_ONCE(cpu_buffer->buffer) != buffer)) {...} __rb_reserve_next rb_move_tail rb_end_commit(cpu_buffer); // dec committing => 0 /* interrupt hits here, successfully swaps! */ local_inc(&cpu_buffer->committing); ring_buffer_unlock_commit cpu_buffer = buffer->buffers[cpu]; // cpu_buffer_b rb_commit rb_end_commit RB_WARN_ON(cpu_buffer, !local_read(&cpu_buffer->committing)) // triggers warning The committing counter can temporarily drop to 0 during a single write operation (within rb_move_tail), creating a window where swap can succeed even though the write is still in progress. This leads to inconsistent buffer state and triggers the RB_WARN_ON in rb_commit(). Replace the committing counter check with current_context checks, which are set at the entry of ring_buffer_lock_reserve() and remain valid throughout the entire write operation, providing a reliable indicator of buffer busy state during swap. Cc: stable(a)vger.kernel.org Fixes: 4239c38fe0b3 ("ring-buffer: Process commits whenever moving to a new page.") Link: https://patch.msgid.link/20260803005640.2445666-2-wutengda@huaweicloud.com Signed-off-by: Tengda Wu <wutengda(a)huaweicloud.com> Signed-off-by: Steven Rostedt <rostedt(a)goodmis.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/trace/ring_buffer.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c index 3b42f1632cda..52e6ccb68067 100644 --- a/kernel/trace/ring_buffer.c +++ b/kernel/trace/ring_buffer.c @@ -5476,7 +5476,7 @@ int ring_buffer_swap_cpu(struct trace_buffer *buffer_a, { struct ring_buffer_per_cpu *cpu_buffer_a; struct ring_buffer_per_cpu *cpu_buffer_b; - int ret = -EINVAL; + int ret = -EBUSY; if (!cpumask_test_cpu(cpu, buffer_a->cpumask) || !cpumask_test_cpu(cpu, buffer_b->cpumask)) @@ -5512,10 +5512,10 @@ int ring_buffer_swap_cpu(struct trace_buffer *buffer_a, atomic_inc(&cpu_buffer_a->record_disabled); atomic_inc(&cpu_buffer_b->record_disabled); - ret = -EBUSY; - if (local_read(&cpu_buffer_a->committing)) + /* Do not swap if either buffer is in the process of writing */ + if (cpu_buffer_a->current_context) goto out_dec; - if (local_read(&cpu_buffer_b->committing)) + if (cpu_buffer_b->current_context) goto out_dec; /* -- 2.34.1

2 1

[PTACH OLK-6.6] sched: Add the qos schduler's cgroup v2 interface
by Chen Jinghuang 10 Aug '26

10 Aug '26

hulk inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/9738 -------------------------------- Add the qos schduler's cgroup v2 interface. Cgroup v2 use the qos scheduler, as follows: offline group: echo -1 > /sys/fs/cgroup/xxxx/offline/cpu.qos_level online group: /sys/fs/cgroup/xxxx/online/cpu.qos_level Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- kernel/sched/core.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/kernel/sched/core.c b/kernel/sched/core.c index cdc931c14930..fd8fdaaf7cbb 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -10660,6 +10660,14 @@ static struct cftype cpu_files[] = { .write = cpu_uclamp_max_write, }, #endif +#endif +#ifdef CONFIG_QOS_SCHED + { + .name = "qos_level", + .flags = CFTYPE_NOT_ON_ROOT, + .read_s64 = cpu_qos_read, + .write_s64 = cpu_qos_write, + }, #ifdef CONFIG_SCHED_SOFT_DOMAIN { .name = "soft_domain", -- 2.34.1

1 0

[PATCH OLK-5.10] bpf, cgroup: Fix storage null-ptr-deref after replacing prog
by Pu Lehui 10 Aug '26

10 Aug '26

maillist inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9715 Reference: https://git.kernel.org/bpf/bpf-next/c/3f562c537e9e -------------------------------- Syzkaller reported a storage null-ptr-deref issue after replacing prog. This occurs in the following scenario: 1. prog A, an empty prog, is attached to a cgrp. 2. prog B uses BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE and calls the bpf_get_local_storage helper. 3. link_update is called to replace prog A with prog B. The reason is that __cgroup_bpf_replace fails to alloc and assign the required cgrp storage for the incoming replacement prog. Consequently, the new prog inherits an uninit storage, leading to null-ptr-deref panic when kick the new prog. Fix this by rejecting a link update if new_prog's cgroup storage is incompatible with link->prog. Fixes: 0c991ebc8c69 ("bpf: Implement bpf_prog replacement for an active bpf_cgroup_link") Signed-off-by: Pu Lehui <pulehui(a)huawei.com> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Reviewed-by: Amery Hung <ameryhung(a)gmail.com> Acked-by: Leon Hwang <leon.hwang(a)linux.dev> Link: https://lore.kernel.org/bpf/20260728132336.2857800-1-pulehui@huaweicloud.com [0] Link: https://lore.kernel.org/bpf/f87b53c0-8f00-45a6-82db-8242fa9b143f@huaweiclou… [1] Link: https://lore.kernel.org/bpf/20260807104403.1013064-1-pulehui@huaweicloud.com Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/cgroup.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c index 41bd6032c6b4..c044c25eadbd 100644 --- a/kernel/bpf/cgroup.c +++ b/kernel/bpf/cgroup.c @@ -591,6 +591,20 @@ static void replace_effective_prog(struct cgroup *cgrp, } } +static bool cgroup_bpf_storages_compatible(struct bpf_prog *old_prog, + struct bpf_prog *new_prog) +{ + enum bpf_cgroup_storage_type stype; + + for_each_cgroup_storage_type(stype) { + if (old_prog->aux->cgroup_storage[stype] != + new_prog->aux->cgroup_storage[stype]) + return false; + } + + return true; +} + /** * __cgroup_bpf_replace() - Replace link's program and propagate the change * to descendants @@ -628,6 +642,9 @@ static int __cgroup_bpf_replace(struct cgroup *cgrp, if (!found) return -ENOENT; + if (!cgroup_bpf_storages_compatible(link->link.prog, new_prog)) + return -EINVAL; + old_prog = xchg(&link->link.prog, new_prog); replace_effective_prog(cgrp, atype, link); bpf_prog_put(old_prog); -- 2.34.1

2 1

[PATCH OLK-6.6] bpf, cgroup: Fix storage null-ptr-deref after replacing prog
by Pu Lehui 10 Aug '26

10 Aug '26

maillist inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9715 Reference: https://git.kernel.org/bpf/bpf-next/c/3f562c537e9e -------------------------------- Syzkaller reported a storage null-ptr-deref issue after replacing prog. This occurs in the following scenario: 1. prog A, an empty prog, is attached to a cgrp. 2. prog B uses BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE and calls the bpf_get_local_storage helper. 3. link_update is called to replace prog A with prog B. The reason is that __cgroup_bpf_replace fails to alloc and assign the required cgrp storage for the incoming replacement prog. Consequently, the new prog inherits an uninit storage, leading to null-ptr-deref panic when kick the new prog. Fix this by rejecting link update with -EINVAL if new_prog's cgroup storage is incompatible with link->prog. Fixes: 0c991ebc8c69 ("bpf: Implement bpf_prog replacement for an active bpf_cgroup_link") Signed-off-by: Pu Lehui <pulehui(a)huawei.com> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Reviewed-by: Amery Hung <ameryhung(a)gmail.com> Acked-by: Leon Hwang <leon.hwang(a)linux.dev> Link: https://lore.kernel.org/bpf/20260728132336.2857800-1-pulehui@huaweicloud.com [0] Link: https://lore.kernel.org/bpf/f87b53c0-8f00-45a6-82db-8242fa9b143f@huaweiclou… [1] Link: https://lore.kernel.org/bpf/20260807104403.1013064-1-pulehui@huaweicloud.com Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/cgroup.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c index 10bd2335631b..1c8513521951 100644 --- a/kernel/bpf/cgroup.c +++ b/kernel/bpf/cgroup.c @@ -824,6 +824,20 @@ static void replace_effective_prog(struct cgroup *cgrp, } } +static bool cgroup_bpf_storages_compatible(struct bpf_prog *old_prog, + struct bpf_prog *new_prog) +{ + enum bpf_cgroup_storage_type stype; + + for_each_cgroup_storage_type(stype) { + if (old_prog->aux->cgroup_storage[stype] != + new_prog->aux->cgroup_storage[stype]) + return false; + } + + return true; +} + /** * __cgroup_bpf_replace() - Replace link's program and propagate the change * to descendants @@ -862,6 +876,9 @@ static int __cgroup_bpf_replace(struct cgroup *cgrp, if (!found) return -ENOENT; + if (!cgroup_bpf_storages_compatible(link->link.prog, new_prog)) + return -EINVAL; + old_prog = xchg(&link->link.prog, new_prog); replace_effective_prog(cgrp, atype, link); bpf_prog_put(old_prog); -- 2.34.1

2 1

[PATCH OLK-5.10] Bluetooth: add kfree in hci_cleanup_dev()
by Chen Jinghuang 09 Aug '26

09 Aug '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/1593 CVE: CVE-2026-53252 -------------------------------- When adapting commit fbdc919a77f7("[Backport] Bluetooth: fix memory leak in error path of hci_alloc_dev()"), the mainline hci_release_dev() was found to include kfree(), but the current version of hci_cleanup_dev() missed this deallocation. This commit adds the missing kfree() to prevent memory leaks and ensure resource cleanup is consistent with the mainline implementation. Fixes: fbdc919a77f7 ("[Backport] Bluetooth: fix memory leak in error path of hci_alloc_dev()") Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- net/bluetooth/hci_core.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c index e3b98fd6e1f3..89f55b2833e8 100644 --- a/net/bluetooth/hci_core.c +++ b/net/bluetooth/hci_core.c @@ -3938,6 +3938,7 @@ void hci_cleanup_dev(struct hci_dev *hdev) ida_simple_remove(&hci_index_ida, hdev->id); kfree_skb(hdev->sent_cmd); + kfree(hdev); } /* Suspend HCI device */ -- 2.34.1

2 1