- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS v6 00/10] support apei_page_offline_policy
by Qi Xi 04 Mar '26

04 Mar '26

Patches 1-4 with [Merged] prefix are four patches from the old page isolation solution (enable_soft_offline + panic prevention), already delivered to customers. Original PR: https://atomgit.com/openeuler/kernel/merge_requests/20004 Patches 5-9 are the new solution, enabling automated configuration in the new version: Patches 5-7 remove the redundant enable_soft_offline bit 1 huge page isolation switch from the old solution, and copy mc only supports THP and regular pages. Patch 8 adds sysctl_apei_page_offline_policy to support regular/huge page isolation policies and driver notification chain. Patch 9-10 fix bugs. Changes in v6: Fix panic casued by UCE in kernel context (!current->mm). Changes in v5: Change sysctl_apei_page_offline_policy bit0 to enable/disable driver notification. Backport some patches that have been merged. Since CONFIG_UCE_KERNEL_RECOVERY depends on CONFIG_ARM64, remove the redundant condition in migrate_page(). Changes in v4: Fix typo errors and backport bugfix for mc_copy. Changes in v3: Use bool rather than int as the return type of apei_page_should_offline(). Drop the PF_UCE_KERNEL_RECOVERY flag after soft-offlining the page. Changes in v2: Add a new sysctl_apei_page_offline_policy, instead of changing soft_offline_page. Jiaqi Yan (1): mm/memory-failure: userspace controls soft-offlining pages Kyle Meyer (1): mm/memory-failure: support disabling soft offline for HugeTLB pages Qi Xi (4): Revert "mm/memory-failure: support disabling soft offline for HugeTLB pages" Revert "arm64: mm: Add copy mc support for migrate_page" apei/ghes: Add sysctl interface to control soft-offline page isolation uce: Prevent kernel panic for kernel-context UCE with recovery path Wupeng Ma (3): uce: add copy_mc_highpage{s} arm64: mm: Add copy mc support for migrate_page arm64: mm: Add copy mc support for migrate_page Yongjian Sun (1): ext4: fix e4b bitmap inconsistency reports arch/arm64/mm/fault.c | 10 +++++- drivers/acpi/apei/ghes.c | 77 ++++++++++++++++++++++++++++++++++++++++ fs/ext4/mballoc.c | 21 +++++------ include/linux/highmem.h | 55 ++++++++++++++++++++++++++++ include/linux/mm.h | 7 ++++ kernel/sysctl.c | 21 +++++++++++ mm/memory-failure.c | 20 +++++++++-- mm/migrate.c | 58 ++++++++++++++++++++++++++++-- 8 files changed, 253 insertions(+), 16 deletions(-) -- 2.33.0

2 11

[PATCH OLK-6.6 v4 0/2] support apei_page_offline_policy
by Qi Xi 04 Mar '26

04 Mar '26

Changes in v4: Add function stubs when CONFIG_ACPI_APEI_MEMORY_FAILURE=n. Add log when sysctl_apei_page_offline_policy changed. Fix typos. Changes in v3: Fix compile error when CONFIG_ACPI_APEI_MEMORY_FAILURE=n Changes in v2: Refactor the code by moving apei policy control to the seperate file ghes-policy.c No need to enhance logging in do_sea() in this patch series. Automated configuration with enable_soft_offline as global master switch (default=1): enable_soft_offline = 0: Page isolation completely disabled enable_soft_offline = 1: Page isolation enabled, policy controlled by new interface New interface: sysctl_apei_page_offline_policy provides fine-grained control (default=2, isolating base pages only): bit 0: Notify BMC about soft_offline_page scanning bit 1: Control base page isolation bit 2: Control hugetlb page isolation Qi Xi (2): Revert "mm/memory-failure: support disabling soft offline for HugeTLB pages" apei/ghes: Add sysctl interface to control soft-offline page isolation .../ABI/testing/sysfs-memory-page-offline | 3 - drivers/acpi/apei/Makefile | 1 + drivers/acpi/apei/apei-internal.h | 8 ++ drivers/acpi/apei/ghes-policy.c | 102 ++++++++++++++++++ drivers/acpi/apei/ghes.c | 3 + include/linux/acpi.h | 13 +++ mm/memory-failure.c | 17 +-- 7 files changed, 130 insertions(+), 17 deletions(-) create mode 100644 drivers/acpi/apei/ghes-policy.c -- 2.33.0

2 3

[PATCH OLK-5.10 0/2] support apei_page_offline_policy
by Qi Xi 04 Mar '26

04 Mar '26

Automated configuration with enable_soft_offline as global master switch (default=1): enable_soft_offline = 0: Page isolation completely disabled enable_soft_offline = 1: Page isolation enabled, policy controlled by new interface New interface: sysctl_apei_page_offline_policy provides fine-grained control (default=2, isolating base pages only): bit 0: Notify BMC about soft_offline_page scanning bit 1: Control base page isolation bit 2: Control hugetlb page isolation Qi Xi (2): Revert "mm/memory-failure: support disabling soft offline for HugeTLB pages" apei/ghes: Add sysctl interface to control soft-offline page isolation .../ABI/testing/sysfs-memory-page-offline | 3 - drivers/acpi/apei/Makefile | 1 + drivers/acpi/apei/apei-internal.h | 8 ++ drivers/acpi/apei/ghes-policy.c | 102 ++++++++++++++++++ drivers/acpi/apei/ghes.c | 3 + include/linux/acpi.h | 14 +++ kernel/sysctl.c | 2 +- mm/memory-failure.c | 15 +-- 8 files changed, 131 insertions(+), 17 deletions(-) create mode 100644 drivers/acpi/apei/ghes-policy.c -- 2.33.0

2 3

[PATCH OLK-6.6 0/3] CVE-2026-23102
by Liu Mingrui 04 Mar '26

04 Mar '26

From: Mingrui Liu <liumingrui(a)huawei.com> CVE-2026-23102 Mark Rutland (3): arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state arm64/fpsimd: signal: Consistently read FPSIMD context arm64/fpsimd: signal: Fix restoration of SVE context arch/arm64/kernel/signal.c | 92 +++++++++++++++++++++++--------------- 1 file changed, 57 insertions(+), 35 deletions(-) -- 2.34.1

2 4

[PATCH v5 openEuler-26.09 00/12] Introduce dmem cgroup
by Liu Kai 04 Mar '26

04 Mar '26

Introduce dmem cgroup Chen Ridong (3): cgroup/dmem: fix NULL pointer dereference when setting max cgroup/dmem: avoid rcu warning when unregister region cgroup/dmem: avoid pool UAF Friedrich Vock (1): cgroup/dmem: Don't open-code css_for_each_descendant_pre Geert Uytterhoeven (1): cgroup/rdma: Drop bogus PAGE_COUNTER select Jiapeng Chong (1): kernel/cgroup: Remove the unused variable climit Maarten Lankhorst (2): mm/page_counter: move calculating protection values to page_counter kernel/cgroup: Add "dmem" memory accounting cgroup Maxime Ripard (3): cgroup/dmem: Select PAGE_COUNTER cgroup/dmem: Fix parameters documentation doc/cgroup: Fix title underline length Roman Gushchin (1): mm: page_counters: put page_counter_calculate_protection() under CONFIG_MEMCG Documentation/admin-guide/cgroup-v2.rst | 58 +- Documentation/core-api/cgroup.rst | 9 + Documentation/core-api/index.rst | 1 + Documentation/gpu/drm-compute.rst | 54 ++ include/linux/cgroup_dmem.h | 66 ++ include/linux/cgroup_subsys.h | 4 + include/linux/page_counter.h | 10 + init/Kconfig | 10 + kernel/cgroup/Makefile | 1 + kernel/cgroup/cgroup.c | 2 +- kernel/cgroup/dmem.c | 885 ++++++++++++++++++++++++ mm/memcontrol.c | 154 +---- mm/page_counter.c | 175 +++++ 13 files changed, 1270 insertions(+), 159 deletions(-) create mode 100644 Documentation/core-api/cgroup.rst create mode 100644 Documentation/gpu/drm-compute.rst create mode 100644 include/linux/cgroup_dmem.h create mode 100644 kernel/cgroup/dmem.c -- 2.34.1

2 13

[PATCH OLK-6.6] dmaengine: xilinx: xdma: Fix regmap max_register
by Yin Tirui 03 Mar '26

03 Mar '26

From: Anthony Brandon <anthony(a)amarulasolutions.com> stable inclusion from stable-v6.6.122 commit df8a131a41ff6202d47f59452735787f2b71dd2d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13577 CVE: CVE-2025-71195 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit c7d436a6c1a274c1ac28d5fb3b8eb8f03b6d0e10 ] The max_register field is assigned the size of the register memory region instead of the offset of the last register. The result is that reading from the regmap via debugfs can cause a segmentation fault: tail /sys/kernel/debug/regmap/xdma.1.auto/registers Unable to handle kernel paging request at virtual address ffff800082f70000 Mem abort info: ESR = 0x0000000096000007 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x07: level 3 translation fault [...] Call trace: regmap_mmio_read32le+0x10/0x30 _regmap_bus_reg_read+0x74/0xc0 _regmap_read+0x68/0x198 regmap_read+0x54/0x88 regmap_read_debugfs+0x140/0x380 regmap_map_read_file+0x30/0x48 full_proxy_read+0x68/0xc8 vfs_read+0xcc/0x310 ksys_read+0x7c/0x120 __arm64_sys_read+0x24/0x40 invoke_syscall.constprop.0+0x64/0x108 do_el0_svc+0xb0/0xd8 el0_svc+0x38/0x130 el0t_64_sync_handler+0x120/0x138 el0t_64_sync+0x194/0x198 Code: aa1e03e9 d503201f f9400000 8b214000 (b9400000) ---[ end trace 0000000000000000 ]--- note: tail[1217] exited with irqs disabled note: tail[1217] exited with preempt_count 1 Segmentation fault Fixes: 17ce252266c7 ("dmaengine: xilinx: xdma: Add xilinx xdma driver") Reviewed-by: Lizhi Hou <lizhi.hou(a)amd.com> Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> Reviewed-by: Alexander Stein <alexander.stein(a)ew.tq-group.com> Signed-off-by: Anthony Brandon <anthony(a)amarulasolutions.com> Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yin Tirui <yintirui(a)huawei.com> --- drivers/dma/xilinx/xdma-regs.h | 1 + drivers/dma/xilinx/xdma.c | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/dma/xilinx/xdma-regs.h b/drivers/dma/xilinx/xdma-regs.h index dd98b4526b90..b19c173d8bfc 100644 --- a/drivers/dma/xilinx/xdma-regs.h +++ b/drivers/dma/xilinx/xdma-regs.h @@ -9,6 +9,7 @@ /* The length of register space exposed to host */ #define XDMA_REG_SPACE_LEN 65536 +#define XDMA_MAX_REG_OFFSET (XDMA_REG_SPACE_LEN - 4) /* * maximum number of DMA channels for each direction: diff --git a/drivers/dma/xilinx/xdma.c b/drivers/dma/xilinx/xdma.c index e0bfd129d563..dbab4c449914 100644 --- a/drivers/dma/xilinx/xdma.c +++ b/drivers/dma/xilinx/xdma.c @@ -38,7 +38,7 @@ static const struct regmap_config xdma_regmap_config = { .reg_bits = 32, .val_bits = 32, .reg_stride = 4, - .max_register = XDMA_REG_SPACE_LEN, + .max_register = XDMA_MAX_REG_OFFSET, }; /** -- 2.43.0

2 1

[PATCH OLK-5.10 0/3] CVE-2025-39967
by Zicheng Qu 03 Mar '26

03 Mar '26

Kees Cook (1): overflow: Allow mixed type arguments Samasth Norway Ananda (1): fbcon: fix integer overflow in fbcon_do_set_font Thomas Zimmermann (1): fbcon: Fix OOB access in font allocation drivers/video/fbdev/core/fbcon.c | 13 ++++-- include/linux/overflow.h | 72 ++++++++++++++++++-------------- 2 files changed, 51 insertions(+), 34 deletions(-) -- 2.34.1

2 4

[PATCH v2 openEuler-26.09 0/3] Introduce xsched dmem
by Liu Kai 03 Mar '26

03 Mar '26

Introduce xsched dmem Alexander Pavlenko (3): xsched/dmem: init xsched dmem region xsched/dmem: introduce xsched_dmem_alloc() xsched/dmem: introduce xsched_dmem_free() include/linux/xsched.h | 16 ++++ include/uapi/linux/xcu_vstream.h | 8 ++ kernel/xsched/Makefile | 1 + kernel/xsched/core.c | 4 + kernel/xsched/dmem.c | 135 +++++++++++++++++++++++++++++++ kernel/xsched/vstream.c | 42 ++++++++++ 6 files changed, 206 insertions(+) create mode 100644 kernel/xsched/dmem.c -- 2.34.1

2 4

[PATCH OLK-5.10] hwmon: (acpi_power_meter) Fix deadlocks related to acpi_power_meter_notify()
by Yin Tirui 03 Mar '26

03 Mar '26

From: "Rafael J. Wysocki" <rafael.j.wysocki(a)intel.com> mainline inclusion from mainline-v6.19 commit 615901b57b7ef8eb655f71358f7e956e42bcd16b category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13743 CVE: CVE-2026-23186 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- The acpi_power_meter driver's .notify() callback function, acpi_power_meter_notify(), calls hwmon_device_unregister() under a lock that is also acquired by callbacks in sysfs attributes of the device being unregistered which is prone to deadlocks between sysfs access and device removal. Address this by moving the hwmon device removal in acpi_power_meter_notify() outside the lock in question, but notice that doing it alone is not sufficient because two concurrent METER_NOTIFY_CONFIG notifications may be attempting to remove the same device at the same time. To prevent that from happening, add a new lock serializing the execution of the switch () statement in acpi_power_meter_notify(). For simplicity, it is a static mutex which should not be a problem from the performance perspective. The new lock also allows the hwmon_device_register_with_info() in acpi_power_meter_notify() to be called outside the inner lock because it prevents the other notifications handled by that function from manipulating the "resource" object while the hwmon device based on it is being registered. The sending of ACPI netlink messages from acpi_power_meter_notify() is serialized by the new lock too which generally helps to ensure that the order of handling firmware notifications is the same as the order of sending netlink messages related to them. In addition, notice that hwmon_device_register_with_info() may fail in which case resource->hwmon_dev will become an error pointer, so add checks to avoid attempting to unregister the hwmon device pointer to by it in that case to acpi_power_meter_notify() and acpi_power_meter_remove(). Fixes: 16746ce8adfe ("hwmon: (acpi_power_meter) Replace the deprecated hwmon_device_register") Closes: https://lore.kernel.org/linux-hwmon/CAK8fFZ58fidGUCHi5WFX0uoTPzveUUDzT=k=AA… Reported-by: Jaroslav Pulchart <jaroslav.pulchart(a)gooddata.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Signed-off-by: Guenter Roeck <linux(a)roeck-us.net> Signed-off-by: Yin Tirui <yintirui(a)huawei.com> --- drivers/hwmon/acpi_power_meter.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/drivers/hwmon/acpi_power_meter.c b/drivers/hwmon/acpi_power_meter.c index 95d0d39738a1..02a57ea3e566 100644 --- a/drivers/hwmon/acpi_power_meter.c +++ b/drivers/hwmon/acpi_power_meter.c @@ -47,6 +47,8 @@ static int cap_in_hardware; static bool force_cap_on; +static DEFINE_MUTEX(acpi_notify_lock); + static int can_cap_in_hardware(void) { return force_cap_on || cap_in_hardware; @@ -826,18 +828,26 @@ static void acpi_power_meter_notify(struct acpi_device *device, u32 event) resource = acpi_driver_data(device); + guard(mutex)(&acpi_notify_lock); + switch (event) { case METER_NOTIFY_CONFIG: + if (!IS_ERR(resource->hwmon_dev)) + hwmon_device_unregister(resource->hwmon_dev); + mutex_lock(&resource->lock); + free_capabilities(resource); remove_domain_devices(resource); - hwmon_device_unregister(resource->hwmon_dev); res = read_capabilities(resource); if (res) dev_err_once(&device->dev, "read capabilities failed.\n"); res = read_domain_devices(resource); if (res && res != -ENODEV) dev_err_once(&device->dev, "read domain devices failed.\n"); + + mutex_unlock(&resource->lock); + resource->hwmon_dev = hwmon_device_register_with_info(&device->dev, ACPI_POWER_METER_NAME, @@ -846,7 +856,7 @@ static void acpi_power_meter_notify(struct acpi_device *device, u32 event) power_extra_groups); if (IS_ERR(resource->hwmon_dev)) dev_err_once(&device->dev, "register hwmon device failed.\n"); - mutex_unlock(&resource->lock); + break; case METER_NOTIFY_TRIP: sysfs_notify(&device->dev.kobj, NULL, POWER_AVERAGE_NAME); @@ -956,7 +966,8 @@ static int acpi_power_meter_remove(struct acpi_device *device) return -EINVAL; resource = acpi_driver_data(device); - hwmon_device_unregister(resource->hwmon_dev); + if (!IS_ERR(resource->hwmon_dev)) + hwmon_device_unregister(resource->hwmon_dev); remove_domain_devices(resource); free_capabilities(resource); -- 2.43.0

2 1

[PATCH OLK-5.10 0/3] CVE-2025-39967
by Zicheng Qu 03 Mar '26

03 Mar '26

Kees Cook (1): overflow: Allow mixed type arguments Samasth Norway Ananda (1): fbcon: fix integer overflow in fbcon_do_set_font Thomas Zimmermann (1): fbcon: Fix OOB access in font allocation drivers/video/fbdev/core/fbcon.c | 13 ++++-- include/linux/overflow.h | 72 ++++++++++++++++++-------------- 2 files changed, 51 insertions(+), 34 deletions(-) -- 2.34.1

2 4