- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 00/11] HiSock Redirect Framework
by Pu Lehui 26 Aug '25

26 Aug '25

Pu Lehui (10): bpf: Add CONFIG_HISOCK bpf: Add XDP_HISOCK_REDIRECT action bpf: Add BPF_PROG_TYPE_HISOCK prog type bpf: Add HISOCK_EGRESS hook on network egress path bpf: Add bpf_get_ingress_dst helper bpf: Add hisock_xdp_buff wrapper for xdp_buff bpf: Add bpf_set_ingress_dst helper bpf: Add bpf_change_skb_dev helper openeuler_defconfig: Enable CONFIG_HISOCK samples/bpf: Add HiSock Redirect sample Xu Kuohai (1): bpf: Add bpf_ext_memcpy extension helper for arm64 arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/insn.h | 4 + arch/arm64/lib/insn.c | 8 + arch/arm64/net/bpf_jit.h | 15 + arch/arm64/net/bpf_jit_comp.c | 266 ++++++++++++++++ arch/x86/configs/openeuler_defconfig | 1 + include/linux/bpf-cgroup-defs.h | 3 + include/linux/bpf-cgroup.h | 25 ++ include/linux/bpf_types.h | 4 + include/linux/filter.h | 3 + include/net/xdp.h | 5 + include/uapi/linux/bpf.h | 45 +++ kernel/bpf/cgroup.c | 43 +++ kernel/bpf/core.c | 7 + kernel/bpf/helpers.c | 27 ++ kernel/bpf/syscall.c | 19 ++ kernel/bpf/verifier.c | 27 ++ net/Kconfig | 10 + net/core/dev.c | 76 ++++- net/core/filter.c | 182 +++++++++++ net/ipv4/ip_output.c | 68 +++++ samples/bpf/.gitignore | 1 + samples/bpf/Makefile | 3 + samples/bpf/hisock/bpf.c | 247 +++++++++++++++ samples/bpf/hisock/hisock_cmd.c | 405 +++++++++++++++++++++++++ tools/include/uapi/linux/bpf.h | 45 +++ tools/lib/bpf/libbpf.c | 3 + 27 files changed, 1540 insertions(+), 3 deletions(-) create mode 100644 samples/bpf/hisock/bpf.c create mode 100644 samples/bpf/hisock/hisock_cmd.c -- 2.34.1

2 12

[PATCH OLK-5.10 0/2] CVE-2025-37834
by Jinjiang Tu 26 Aug '25

26 Aug '25

Jinjiang Tu (2): mm/vmscan: don't try to reclaim hwpoison folio mm/vmscan: fix hwpoisoned large folio handling in shrink_folio_list mm/vmscan.c | 10 ++++++++++ 1 file changed, 10 insertions(+) -- 2.43.0

2 3

[PATCH OLK-6.6] iBMA: Fix veth soft lockup by adding DMA-pre-readl sync
by linan666＠huaweicloud.com 26 Aug '25

26 Aug '25

From: Huangjunhua <huangjunhua14(a)huawei.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICUK85 CVE: NA ----------------------------------------- Fix soft lockup during large file transfers over veth interfaces in Taishan 500(Model 2280) environments by adding a readl operation prior to DMA initiation. This guarantees proper synchronization of Send Queue buffer descriptors, preventing descriptor corruption that caused system hangs. Fixes: 85502a982830 ("Huawei iBMA: Added support for Hi1712 Chip") Signed-off-by: Huangjunhua <huangjunhua14(a)huawei.com> --- drivers/net/ethernet/huawei/bma/edma_drv/edma_queue.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/net/ethernet/huawei/bma/edma_drv/edma_queue.c b/drivers/net/ethernet/huawei/bma/edma_drv/edma_queue.c index 678262f7412c..94e63d3ee9dd 100644 --- a/drivers/net/ethernet/huawei/bma/edma_drv/edma_queue.c +++ b/drivers/net/ethernet/huawei/bma/edma_drv/edma_queue.c @@ -406,6 +406,12 @@ static s32 submit_dma_queue_sq(u32 dir, struct bspveth_dmal pdmalbase_v, u32 pf) BMA_LOG(DLOG_DEBUG, "submit dma queue sq, sq_tail change %d,\n", sq_tail); wmb(); /* memory barriers. */ + /* readl last u32 of sq buffer descriptor to confirm the sq buffer descriptor + * write to local sq + */ + (void)readl((void __iomem *)(p_dma_sq + sq_tail + sizeof(struct dma_ch_sq_s) + - sizeof(u32))); + (void)set_dma_queue_sq_tail(sq_tail); return 0; -- 2.33.0

2 1

[PATCH OLK-5.10 0/6] fix some CVEs
by Jinjiang Tu 26 Aug '25

26 Aug '25

Guixin Liu (1): scsi: ufs: bsg: Set bsg_queue to NULL after removal Haoxiang Li (1): rapidio: fix an API misues when rio_add_net() fails Ivan Stepchenko (1): drm/amdgpu: Fix potential NULL pointer dereference in atomctrl_get_smc_sclk_range_table Marco Nelissen (1): filemap: avoid truncating 64-bit offset to 32 bits Sean Christopherson (1): KVM: x86: Reset IRTE to host control if *new* route isn't postable Yongzhi Liu (1): drm/amd/display: Fix memory leak arch/x86/kvm/svm/avic.c | 58 ++++++++------- arch/x86/kvm/vmx/posted_intr.c | 28 +++----- .../amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 72 ++++++++++++++----- .../drm/amd/pm/powerplay/hwmgr/ppatomctrl.c | 2 + drivers/rapidio/devices/rio_mport_cdev.c | 3 +- drivers/scsi/ufs/ufs_bsg.c | 1 + mm/filemap.c | 2 +- 7 files changed, 101 insertions(+), 65 deletions(-) -- 2.43.0

2 7

[PATCH OLK-5.10] mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race
by Jinjiang Tu 26 Aug '25

26 Aug '25

From: Jann Horn <jannh(a)google.com> mainline inclusion from mainline-v6.16-rc1 commit 1013af4f585fccc4d3e5c5824d174de2257f7d6d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICIQAF CVE: CVE-2025-38085 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- huge_pmd_unshare() drops a reference on a page table that may have previously been shared across processes, potentially turning it into a normal page table used in another process in which unrelated VMAs can afterwards be installed. If this happens in the middle of a concurrent gup_fast(), gup_fast() could end up walking the page tables of another process. While I don't see any way in which that immediately leads to kernel memory corruption, it is really weird and unexpected. Fix it with an explicit broadcast IPI through tlb_remove_table_sync_one(), just like we do in khugepaged when removing page tables for a THP collapse. Link: https://lkml.kernel.org/r/20250528-hugetlb-fixes-splitrace-v2-2-1329349bad1… Link: https://lkml.kernel.org/r/20250527-hugetlb-fixes-splitrace-v1-2-f4136f5ec58… Fixes: 39dde65c9940 ("[PATCH] shared page table for hugetlb page") Signed-off-by: Jann Horn <jannh(a)google.com> Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Cc: Liam Howlett <liam.howlett(a)oracle.com> Cc: Muchun Song <muchun.song(a)linux.dev> Cc: Oscar Salvador <osalvador(a)suse.de> Cc: Vlastimil Babka <vbabka(a)suse.cz> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: mm/hugetlb.c [Context conflicts.] Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- mm/hugetlb.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index bed9f05ecaf1..32b7ee895315 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -6001,6 +6001,13 @@ int huge_pmd_unshare(struct mm_struct *mm, struct vm_area_struct *vma, return 0; pud_clear(pud); + /* + * Once our caller drops the rmap lock, some other process might be + * using this page table as a normal, non-hugetlb page table. + * Wait for pending gup_fast() in other threads to finish before letting + * that happen. + */ + tlb_remove_table_sync_one(); put_page(virt_to_page(ptep)); mm_dec_nr_pmds(mm); /* -- 2.43.0

2 1

[PATCH OLK-6.6 0/2] fix bug in hdbss
by Jinqian Yang 26 Aug '25

26 Aug '25

Jinqian Yang (2): KVM: arm64: do not support hdbss in nvhe KVM: arm64: fix memory leak in HDBSS arch/arm64/kvm/arm.c | 45 +++++++++++++++++++++++++++++--------------- 1 file changed, 30 insertions(+), 15 deletions(-) -- 2.33.0

2 3

[PATCH OLK-6.6 0/5]fix some CVE
by Tong Tiangen 26 Aug '25

26 Aug '25

Ma Wupeng (1): mm: memory-failure: update ttu flag inside unmap_poisoned_folio Michał Pecio (1): usb: xhci: Fix invalid pointer dereference in Etron workaround Neeraj Sanjay Kale (1): Bluetooth: btnxpuart: Fix kernel panic during FW release Ritesh Harjani (1): powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap Sergey Senozhatsky (1): thunderbolt: Do not double dequeue a configuration request arch/powerpc/platforms/powernv/memtrace.c | 8 ++++++-- drivers/bluetooth/btnxpuart.c | 6 ++++-- drivers/thunderbolt/ctl.c | 5 +++++ drivers/usb/host/xhci-ring.c | 2 +- mm/memory_hotplug.c | 2 +- 5 files changed, 17 insertions(+), 6 deletions(-) -- 2.25.1

2 6

[PATCH OLK-6.6] iBMA: Fix veth soft lockup by adding DMA-pre-readl sync
by linan666＠huaweicloud.com 26 Aug '25

26 Aug '25

From: Huangjunhua <huangjunhua14(a)huawei.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICUK85 CVE: NA ----------------------------------------- Fix soft lockup during large file transfers over veth interfaces in Taishan 500(Model 2280) environments by adding a readl operation prior to DMA initiation. This guarantees proper synchronization of Send Queue buffer descriptors, preventing descriptor corruption that caused system hangs. Signed-off-by: Huangjunhua <huangjunhua14(a)huawei.com> --- drivers/net/ethernet/huawei/bma/edma_drv/edma_queue.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/net/ethernet/huawei/bma/edma_drv/edma_queue.c b/drivers/net/ethernet/huawei/bma/edma_drv/edma_queue.c index 678262f7412c..94e63d3ee9dd 100644 --- a/drivers/net/ethernet/huawei/bma/edma_drv/edma_queue.c +++ b/drivers/net/ethernet/huawei/bma/edma_drv/edma_queue.c @@ -406,6 +406,12 @@ static s32 submit_dma_queue_sq(u32 dir, struct bspveth_dmal pdmalbase_v, u32 pf) BMA_LOG(DLOG_DEBUG, "submit dma queue sq, sq_tail change %d,\n", sq_tail); wmb(); /* memory barriers. */ + /* readl last u32 of sq buffer descriptor to confirm the sq buffer descriptor + * write to local sq + */ + (void)readl((void __iomem *)(p_dma_sq + sq_tail + sizeof(struct dma_ch_sq_s) + - sizeof(u32))); + (void)set_dma_queue_sq_tail(sq_tail); return 0; -- 2.33.0

2 1

[PATCH OLK-5.10] trace/fgraph: Fix the warning caused by missing unregister notifier
by Ye Weihua 26 Aug '25

26 Aug '25

mainline inclusion from mainline-v6.17-rc3 commit edede7a6dcd7435395cf757d053974aaab6ab1c2 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICUMJS Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------- This warning was triggered during testing on v6.16: notifier callback ftrace_suspend_notifier_call already registered WARNING: CPU: 2 PID: 86 at kernel/notifier.c:23 notifier_chain_register+0x44/0xb0 ... Call Trace: <TASK> blocking_notifier_chain_register+0x34/0x60 register_ftrace_graph+0x330/0x410 ftrace_profile_write+0x1e9/0x340 vfs_write+0xf8/0x420 ? filp_flush+0x8a/0xa0 ? filp_close+0x1f/0x30 ? do_dup2+0xaf/0x160 ksys_write+0x65/0xe0 do_syscall_64+0xa4/0x260 entry_SYSCALL_64_after_hwframe+0x77/0x7f When writing to the function_profile_enabled interface, the notifier was not unregistered after start_graph_tracing failed, causing a warning the next time function_profile_enabled was written. Fixed by adding unregister_pm_notifier in the exception path. Link: https://lore.kernel.org/20250818073332.3890629-1-yeweihua4@huawei.com Fixes: 4a2b8dda3f87 ("tracing/function-graph-tracer: fix a regression while suspend to disk") Acked-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org> Signed-off-by: Ye Weihua <yeweihua4(a)huawei.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Conflicts: kernel/trace/fgraph.c [just contex conflicts] Signed-off-by: Ye Weihua <yeweihua4(a)huawei.com> --- kernel/trace/fgraph.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/kernel/trace/fgraph.c b/kernel/trace/fgraph.c index a58da91eadb5..fd8f06c5dcc3 100644 --- a/kernel/trace/fgraph.c +++ b/kernel/trace/fgraph.c @@ -609,10 +609,11 @@ int register_ftrace_graph(struct fgraph_ops *gops) ftrace_graph_active++; ret = start_graph_tracing(); if (ret) { ftrace_graph_active--; + unregister_pm_notifier(&ftrace_suspend_notifier); goto out; } ftrace_graph_return = gops->retfunc; @@ -625,10 +626,12 @@ int register_ftrace_graph(struct fgraph_ops *gops) __ftrace_graph_entry = gops->entryfunc; ftrace_graph_entry = ftrace_graph_entry_test; update_function_graph_func(); ret = ftrace_startup(&graph_ops, FTRACE_START_FUNC_RET); + if (ret) + unregister_pm_notifier(&ftrace_suspend_notifier); out: mutex_unlock(&ftrace_lock); return ret; } -- 2.34.1

2 1

[PATCH OLK-6.6] trace/fgraph: Fix the warning caused by missing unregister notifier
by Ye Weihua 26 Aug '25

26 Aug '25

mainline inclusion from mainline-v6.17-rc3 commit edede7a6dcd7435395cf757d053974aaab6ab1c2 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICUMJS Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------- This warning was triggered during testing on v6.16: notifier callback ftrace_suspend_notifier_call already registered WARNING: CPU: 2 PID: 86 at kernel/notifier.c:23 notifier_chain_register+0x44/0xb0 ... Call Trace: <TASK> blocking_notifier_chain_register+0x34/0x60 register_ftrace_graph+0x330/0x410 ftrace_profile_write+0x1e9/0x340 vfs_write+0xf8/0x420 ? filp_flush+0x8a/0xa0 ? filp_close+0x1f/0x30 ? do_dup2+0xaf/0x160 ksys_write+0x65/0xe0 do_syscall_64+0xa4/0x260 entry_SYSCALL_64_after_hwframe+0x77/0x7f When writing to the function_profile_enabled interface, the notifier was not unregistered after start_graph_tracing failed, causing a warning the next time function_profile_enabled was written. Fixed by adding unregister_pm_notifier in the exception path. Link: https://lore.kernel.org/20250818073332.3890629-1-yeweihua4@huawei.com Fixes: 4a2b8dda3f87 ("tracing/function-graph-tracer: fix a regression while suspend to disk") Acked-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org> Signed-off-by: Ye Weihua <yeweihua4(a)huawei.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Conflicts: kernel/trace/fgraph.c [just contex conflicts] Signed-off-by: Ye Weihua <yeweihua4(a)huawei.com> --- kernel/trace/fgraph.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/kernel/trace/fgraph.c b/kernel/trace/fgraph.c index c83c005e654e..7956a799b5e8 100644 --- a/kernel/trace/fgraph.c +++ b/kernel/trace/fgraph.c @@ -646,10 +646,11 @@ int register_ftrace_graph(struct fgraph_ops *gops) ftrace_graph_active++; ret = start_graph_tracing(); if (ret) { ftrace_graph_active--; + unregister_pm_notifier(&ftrace_suspend_notifier); goto out; } ftrace_graph_return = gops->retfunc; @@ -662,10 +663,12 @@ int register_ftrace_graph(struct fgraph_ops *gops) __ftrace_graph_entry = gops->entryfunc; ftrace_graph_entry = ftrace_graph_entry_test; update_function_graph_func(); ret = ftrace_startup(&graph_ops, FTRACE_START_FUNC_RET); + if (ret) + unregister_pm_notifier(&ftrace_suspend_notifier); out: mutex_unlock(&ftrace_lock); return ret; } -- 2.34.1

2 1