- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
by Dong Chenchen 30 Apr '25

30 Apr '25

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.14-rc3 commit 90b2f49a502fa71090d9f4fe29a2f51fe5dff76d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC5W CVE: CVE-2025-21761 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ovs_vport_cmd_fill_info() can be called without RTNL or RCU. Use RCU protection and dev_net_rcu() to avoid potential UAF. Fixes: 9354d4520342 ("openvswitch: reliable interface indentification in port dumps") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Link: https://patch.msgid.link/20250207135841.1948589-6-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/openvswitch/datapath.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c index 9143d4ee1c33..2dac3aaa8520 100644 --- a/net/openvswitch/datapath.c +++ b/net/openvswitch/datapath.c @@ -1873,6 +1873,7 @@ static int ovs_vport_cmd_fill_info(struct vport *vport, struct sk_buff *skb, { struct ovs_header *ovs_header; struct ovs_vport_stats vport_stats; + struct net *net_vport; int err; ovs_header = genlmsg_put(skb, portid, seq, &dp_vport_genl_family, @@ -1889,12 +1890,15 @@ static int ovs_vport_cmd_fill_info(struct vport *vport, struct sk_buff *skb, nla_put_u32(skb, OVS_VPORT_ATTR_IFINDEX, vport->dev->ifindex)) goto nla_put_failure; - if (!net_eq(net, dev_net(vport->dev))) { - int id = peernet2id_alloc(net, dev_net(vport->dev), gfp); + rcu_read_lock(); + net_vport = dev_net_rcu(vport->dev); + if (!net_eq(net, net_vport)) { + int id = peernet2id_alloc(net, net_vport, GFP_ATOMIC); if (nla_put_s32(skb, OVS_VPORT_ATTR_NETNSID, id)) - goto nla_put_failure; + goto nla_put_failure_unlock; } + rcu_read_unlock(); ovs_vport_get_stats(vport, &vport_stats); if (nla_put_64bit(skb, OVS_VPORT_ATTR_STATS, @@ -1912,6 +1916,8 @@ static int ovs_vport_cmd_fill_info(struct vport *vport, struct sk_buff *skb, genlmsg_end(skb, ovs_header); return 0; +nla_put_failure_unlock: + rcu_read_unlock(); nla_put_failure: err = -EMSGSIZE; error: -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/2] net: Fix CVE-2025-21763
by Dong Chenchen 30 Apr '25

30 Apr '25

Fix CVE-2025-21763 Eric Dumazet (1): neighbour: use RCU protection in __neigh_notify() Li Zetao (1): neighbour: delete redundant judgment statements net/core/neighbour.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6] mm: zswap: handle incorrect attempts to load large folios
by Tong Tiangen 30 Apr '25

30 Apr '25

From: Yosry Ahmed <yosryahmed(a)google.com> mainline inclusion from mainline-v6.11-rc1 commit c63f210d4891f5b1b1057a0d7c91d2b0d15431d1 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IC3A3N Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Zswap does not support storing or loading large folios. Until proper support is added, attempts to load large folios from zswap are a bug. For example, if a swapin fault observes that contiguous PTEs are pointing to contiguous swap entries and tries to swap them in as a large folio, swap_read_folio() will pass in a large folio to zswap_load(), but zswap_load() will only effectively load the first page in the folio. If the first page is not in zswap, the folio will be read from disk, even though other pages may be in zswap. In both cases, this will lead to silent data corruption. Proper support needs to be added before large folio swapins and zswap can work together. Looking at callers of swap_read_folio(), it seems like they are either allocated from __read_swap_cache_async() or do_swap_page() in the SWP_SYNCHRONOUS_IO path. Both of which allocate order-0 folios, so everything is fine for now. However, there is ongoing work to add to support large folio swapins [1]. To make sure new development does not break zswap (or get broken by zswap), add minimal handling of incorrect loads of large folios to zswap. First, move the call folio_mark_uptodate() inside zswap_load(). If a large folio load is attempted, and zswap was ever enabled on the system, return 'true' without calling folio_mark_uptodate(). This will prevent the folio from being read from disk, and will emit an IO error because the folio is not uptodate (e.g. do_swap_fault() will return VM_FAULT_SIGBUS). It may not be reliable recovery in all cases, but it is better than nothing. This was tested by hacking the allocation in __read_swap_cache_async() to use order 2 and __GFP_COMP. In the future, to handle this correctly, the swapin code should: (a) Fall back to order-0 swapins if zswap was ever used on the machine, because compressed pages remain in zswap after it is disabled. (b) Add proper support to swapin large folios from zswap (fully or partially). Probably start with (a) then followup with (b). [1]https://lore.kernel.org/linux-mm/20240304081348.197341-6-21cnbao@gmail.co… Link: https://lkml.kernel.org/r/20240611024516.1375191-3-yosryahmed@google.com Signed-off-by: Yosry Ahmed <yosryahmed(a)google.com> Acked-by: Barry Song <baohua(a)kernel.org> Cc: Barry Song <baohua(a)kernel.org> Cc: Chengming Zhou <chengming.zhou(a)linux.dev> Cc: Chris Li <chrisl(a)kernel.org> Cc: David Hildenbrand <david(a)redhat.com> Cc: Johannes Weiner <hannes(a)cmpxchg.org> Cc: Matthew Wilcox (Oracle) <willy(a)infradead.org> Cc: Nhat Pham <nphamcs(a)gmail.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: mm/zswap.c mm/page_io.c [context conflict because of a large number of zswap patchs are not merged, mainly include: 1. 5b297f70bb2 "mm: zswap: inline and remove zswap_entry_find_get()", 2. 796c2c23e14e "zswap: replace RB tree with xarray", 3. 66447fd036a5 "mm/zswap: cleanup zswap_load()"] Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> --- mm/page_io.c | 1 - mm/zswap.c | 14 ++++++++++++++ 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/mm/page_io.c b/mm/page_io.c index 839a3b0a90f0..63817e97b472 100644 --- a/mm/page_io.c +++ b/mm/page_io.c @@ -521,7 +521,6 @@ void swap_read_folio(struct folio *folio, bool synchronous, delayacct_swapin_start(); if (zswap_load(folio)) { - folio_mark_uptodate(folio); folio_unlock(folio); } else if (data_race(sis->flags & SWP_FS_OPS)) { swap_read_folio_fs(folio, plug); diff --git a/mm/zswap.c b/mm/zswap.c index 491487925192..dcf44712f0bf 100644 --- a/mm/zswap.c +++ b/mm/zswap.c @@ -1419,6 +1419,17 @@ bool zswap_load(struct folio *folio) if (zswap_never_enabled()) return false; + /* + * Large folios should not be swapped in while zswap is being used, as + * they are not properly handled. Zswap does not properly load large + * folios, and a large folio may only be partially in zswap. + * + * Return true without marking the folio uptodate so that an IO error is + * emitted (e.g. do_swap_page() will sigbus). + */ + if (WARN_ON_ONCE(folio_test_large(folio))) + return true; + /* find */ spin_lock(&tree->lock); entry = zswap_entry_find_get(&tree->rbroot, offset); @@ -1488,6 +1499,9 @@ bool zswap_load(struct folio *folio) zswap_entry_put(tree, entry); spin_unlock(&tree->lock); + if (ret == true) + folio_mark_uptodate(folio); + return ret; } -- 2.25.1

2 2

[PATCH openEuler-1.0-LTS] qede: confirm skb is allocated before using
by Zhang Zekun 30 Apr '25

30 Apr '25

From: Jamie Bainbridge <jamie.bainbridge(a)gmail.com> stable inclusion from stable-v4.19.238 commit 9648adb1b3ece55c657d3a4f52bfee663b710dfe category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP4XO CVE: CVE-2022-49084 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------- [ Upstream commit 4e910dbe36508654a896d5735b318c0b88172570 ] qede_build_skb() assumes build_skb() always works and goes straight to skb_reserve(). However, build_skb() can fail under memory pressure. This results in a kernel panic because the skb to reserve is NULL. Add a check in case build_skb() failed to allocate and return NULL. The NULL return is handled correctly in callers to qede_build_skb(). Fixes: 8a8633978b842 ("qede: Add build_skb() support.") Signed-off-by: Jamie Bainbridge <jamie.bainbridge(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/net/ethernet/qlogic/qede/qede_fp.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/ethernet/qlogic/qede/qede_fp.c b/drivers/net/ethernet/qlogic/qede/qede_fp.c index a96da16f3404..09ca436e7d49 100644 --- a/drivers/net/ethernet/qlogic/qede/qede_fp.c +++ b/drivers/net/ethernet/qlogic/qede/qede_fp.c @@ -731,6 +731,9 @@ qede_build_skb(struct qede_rx_queue *rxq, buf = page_address(bd->data) + bd->page_offset; skb = build_skb(buf, rxq->rx_buf_seg_size); + if (unlikely(!skb)) + return NULL; + skb_reserve(skb, pad); skb_put(skb, len); -- 2.22.0

2 1

[PATCH openEuler-1.0-LTS] mpage: fix softlockup in mpage_readahead()
by Zheng Qixing 30 Apr '25

30 Apr '25

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBYXQD --------------------------- When using null_blk with a large readahead window, calling madvise to trigger readahead can lead to system softlocks. This occurs because the CPU can remain in the mpage_readpages loop for extended periods without rescheduling, preventing other processes from running. Add a cond_resched() call at the beginning of each loop iteration to allow the CPU to schedule other tasks when necessary, avoiding potential softlocks during heavy readahead operations. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- fs/mpage.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/mpage.c b/fs/mpage.c index fb2ff971c66b..d67a2bae0b87 100644 --- a/fs/mpage.c +++ b/fs/mpage.c @@ -394,6 +394,7 @@ mpage_readpages(struct address_space *mapping, struct list_head *pages, for (page_idx = 0; page_idx < nr_pages; page_idx++) { struct page *page = lru_to_page(pages); + cond_resched(); prefetchw(&page->flags); list_del(&page->lru); if (!add_to_page_cache_lru(page, mapping, -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] md/raid1,raid10: don't ignore IO flags
by Zheng Qixing 30 Apr '25

30 Apr '25

From: Yu Kuai <yukuai3(a)huawei.com> mainline inclusion from mainline-v6.15-rc1 commit e879a0d9cb086c8e52ce6c04e5bfa63825a6213c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QST CVE: CVE-2025-22125 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------ If blk-wbt is enabled by default, it's found that raid write performance is quite bad because all IO are throttled by wbt of underlying disks, due to flag REQ_IDLE is ignored. And turns out this behaviour exist since blk-wbt is introduced. Other than REQ_IDLE, other flags should not be ignored as well, for example REQ_META can be set for filesystems, clearing it can cause priority reverse problems; And REQ_NOWAIT should not be cleared as well, because io will wait instead of failing directly in underlying disks. Fix those problems by keep IO flags from master bio. Fises: f51d46d0e7cb ("md: add support for REQ_NOWAIT") Fixes: e34cbd307477 ("blk-wbt: add general throttling mechanism") Fixes: 5404bc7a87b9 ("[PATCH] Allow file systems to differentiate between data and meta reads") Link: https://lore.kernel.org/linux-raid/20250227121657.832356-1-yukuai1@huaweicl… Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Conflicts: drivers/md/raid1.c drivers/md/raid10.c [Due to not merging commit 3c5e514db58f ("md/raid1: Use the new blk_opf_t type"), commit cb1802ff82e1 ("md/raid10: Use the new blk_opf_t type"), commit c34b7ac65087 ("block: remove bio_set_op_attrs") and commit f2a38abf5f1c ("md/raid1: Atomic write support").] Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/md/raid1.c | 4 ---- drivers/md/raid10.c | 7 ------- 2 files changed, 11 deletions(-) diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c index 6ad47783e974..0275dcb18692 100644 --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -1199,8 +1199,6 @@ static void raid1_read_request(struct mddev *mddev, struct bio *bio, struct raid1_info *mirror; struct bio *read_bio; struct bitmap *bitmap = mddev->bitmap; - const int op = bio_op(bio); - const unsigned long do_sync = (bio->bi_opf & REQ_SYNC); int max_sectors; int rdisk; bool print_msg = !!r1_bio; @@ -1293,7 +1291,6 @@ static void raid1_read_request(struct mddev *mddev, struct bio *bio, mirror->rdev->data_offset; bio_set_dev(read_bio, mirror->rdev->bdev); read_bio->bi_end_io = raid1_end_read_request; - bio_set_op_attrs(read_bio, op, do_sync); if (test_bit(FailFast, &mirror->rdev->flags) && test_bit(R1BIO_FailFast, &r1_bio->state)) read_bio->bi_opf |= MD_FAILFAST; @@ -1519,7 +1516,6 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio, conf->mirrors[i].rdev->data_offset); bio_set_dev(mbio, conf->mirrors[i].rdev->bdev); mbio->bi_end_io = raid1_end_write_request; - mbio->bi_opf = bio_op(bio) | (bio->bi_opf & (REQ_SYNC | REQ_FUA)); if (test_bit(FailFast, &conf->mirrors[i].rdev->flags) && !test_bit(WriteMostly, &conf->mirrors[i].rdev->flags) && conf->raid_disks - mddev->degraded > 1) diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c index f8fea9593955..07d58e88eb7b 100644 --- a/drivers/md/raid10.c +++ b/drivers/md/raid10.c @@ -1166,8 +1166,6 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio, { struct r10conf *conf = mddev->private; struct bio *read_bio; - const int op = bio_op(bio); - const unsigned long do_sync = (bio->bi_opf & REQ_SYNC); int max_sectors; sector_t sectors; struct md_rdev *rdev; @@ -1264,7 +1262,6 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio, choose_data_offset(r10_bio, rdev); bio_set_dev(read_bio, rdev->bdev); read_bio->bi_end_io = raid10_end_read_request; - bio_set_op_attrs(read_bio, op, do_sync); if (test_bit(FailFast, &rdev->flags) && test_bit(R10BIO_FailFast, &r10_bio->state)) read_bio->bi_opf |= MD_FAILFAST; @@ -1282,9 +1279,6 @@ static void raid10_write_one_disk(struct mddev *mddev, struct r10bio *r10_bio, struct bio *bio, bool replacement, int n_copy) { - const int op = bio_op(bio); - const unsigned long do_sync = (bio->bi_opf & REQ_SYNC); - const unsigned long do_fua = (bio->bi_opf & REQ_FUA); unsigned long flags; struct blk_plug_cb *cb; struct raid10_plug_cb *plug = NULL; @@ -1313,7 +1307,6 @@ static void raid10_write_one_disk(struct mddev *mddev, struct r10bio *r10_bio, choose_data_offset(r10_bio, rdev)); bio_set_dev(mbio, rdev->bdev); mbio->bi_end_io = raid10_end_write_request; - bio_set_op_attrs(mbio, op, do_sync | do_fua); if (!replacement && test_bit(FailFast, &conf->mirrors[devnum].rdev->flags) && enough(conf, devnum)) -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] md/raid1,raid10: don't ignore IO flags
by Zheng Qixing 30 Apr '25

30 Apr '25

From: Yu Kuai <yukuai3(a)huawei.com> mainline inclusion from mainline-v6.15-rc1 commit e879a0d9cb086c8e52ce6c04e5bfa63825a6213c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QST CVE: CVE-2025-22125 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------ If blk-wbt is enabled by default, it's found that raid write performance is quite bad because all IO are throttled by wbt of underlying disks, due to flag REQ_IDLE is ignored. And turns out this behaviour exist since blk-wbt is introduced. Other than REQ_IDLE, other flags should not be ignored as well, for example REQ_META can be set for filesystems, clearing it can cause priority reverse problems; And REQ_NOWAIT should not be cleared as well, because io will wait instead of failing directly in underlying disks. Fix those problems by keep IO flags from master bio. Fises: f51d46d0e7cb ("md: add support for REQ_NOWAIT") Fixes: e34cbd307477 ("blk-wbt: add general throttling mechanism") Fixes: 5404bc7a87b9 ("[PATCH] Allow file systems to differentiate between data and meta reads") Link: https://lore.kernel.org/linux-raid/20250227121657.832356-1-yukuai1@huaweicl… Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Conflicts: drivers/md/raid1.c drivers/md/raid10.c [Due to not merging commit 3c5e514db58f ("md/raid1: Use the new blk_opf_t type"), commit cb1802ff82e1 ("md/raid10: Use the new blk_opf_t type"), commit c34b7ac65087 ("block: remove bio_set_op_attrs") and commit f2a38abf5f1c ("md/raid1: Atomic write support").] Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/md/raid1.c | 4 ---- drivers/md/raid10.c | 7 ------- 2 files changed, 11 deletions(-) diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c index 6ad47783e974..0275dcb18692 100644 --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -1199,8 +1199,6 @@ static void raid1_read_request(struct mddev *mddev, struct bio *bio, struct raid1_info *mirror; struct bio *read_bio; struct bitmap *bitmap = mddev->bitmap; - const int op = bio_op(bio); - const unsigned long do_sync = (bio->bi_opf & REQ_SYNC); int max_sectors; int rdisk; bool print_msg = !!r1_bio; @@ -1293,7 +1291,6 @@ static void raid1_read_request(struct mddev *mddev, struct bio *bio, mirror->rdev->data_offset; bio_set_dev(read_bio, mirror->rdev->bdev); read_bio->bi_end_io = raid1_end_read_request; - bio_set_op_attrs(read_bio, op, do_sync); if (test_bit(FailFast, &mirror->rdev->flags) && test_bit(R1BIO_FailFast, &r1_bio->state)) read_bio->bi_opf |= MD_FAILFAST; @@ -1519,7 +1516,6 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio, conf->mirrors[i].rdev->data_offset); bio_set_dev(mbio, conf->mirrors[i].rdev->bdev); mbio->bi_end_io = raid1_end_write_request; - mbio->bi_opf = bio_op(bio) | (bio->bi_opf & (REQ_SYNC | REQ_FUA)); if (test_bit(FailFast, &conf->mirrors[i].rdev->flags) && !test_bit(WriteMostly, &conf->mirrors[i].rdev->flags) && conf->raid_disks - mddev->degraded > 1) diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c index f8fea9593955..07d58e88eb7b 100644 --- a/drivers/md/raid10.c +++ b/drivers/md/raid10.c @@ -1166,8 +1166,6 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio, { struct r10conf *conf = mddev->private; struct bio *read_bio; - const int op = bio_op(bio); - const unsigned long do_sync = (bio->bi_opf & REQ_SYNC); int max_sectors; sector_t sectors; struct md_rdev *rdev; @@ -1264,7 +1262,6 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio, choose_data_offset(r10_bio, rdev); bio_set_dev(read_bio, rdev->bdev); read_bio->bi_end_io = raid10_end_read_request; - bio_set_op_attrs(read_bio, op, do_sync); if (test_bit(FailFast, &rdev->flags) && test_bit(R10BIO_FailFast, &r10_bio->state)) read_bio->bi_opf |= MD_FAILFAST; @@ -1282,9 +1279,6 @@ static void raid10_write_one_disk(struct mddev *mddev, struct r10bio *r10_bio, struct bio *bio, bool replacement, int n_copy) { - const int op = bio_op(bio); - const unsigned long do_sync = (bio->bi_opf & REQ_SYNC); - const unsigned long do_fua = (bio->bi_opf & REQ_FUA); unsigned long flags; struct blk_plug_cb *cb; struct raid10_plug_cb *plug = NULL; @@ -1313,7 +1307,6 @@ static void raid10_write_one_disk(struct mddev *mddev, struct r10bio *r10_bio, choose_data_offset(r10_bio, rdev)); bio_set_dev(mbio, rdev->bdev); mbio->bi_end_io = raid10_end_write_request; - bio_set_op_attrs(mbio, op, do_sync | do_fua); if (!replacement && test_bit(FailFast, &conf->mirrors[devnum].rdev->flags) && enough(conf, devnum)) -- 2.39.2

2 1

[PATCH OLK-6.6] md/raid1,raid10: don't ignore IO flags
by Zheng Qixing 30 Apr '25

30 Apr '25

From: Yu Kuai <yukuai3(a)huawei.com> mainline inclusion from mainline-v6.15-rc1 commit e879a0d9cb086c8e52ce6c04e5bfa63825a6213c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QST CVE: CVE-2025-22125 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------ If blk-wbt is enabled by default, it's found that raid write performance is quite bad because all IO are throttled by wbt of underlying disks, due to flag REQ_IDLE is ignored. And turns out this behaviour exist since blk-wbt is introduced. Other than REQ_IDLE, other flags should not be ignored as well, for example REQ_META can be set for filesystems, clearing it can cause priority reverse problems; And REQ_NOWAIT should not be cleared as well, because io will wait instead of failing directly in underlying disks. Fix those problems by keep IO flags from master bio. Fises: f51d46d0e7cb ("md: add support for REQ_NOWAIT") Fixes: e34cbd307477 ("blk-wbt: add general throttling mechanism") Fixes: 5404bc7a87b9 ("[PATCH] Allow file systems to differentiate between data and meta reads") Link: https://lore.kernel.org/linux-raid/20250227121657.832356-1-yukuai1@huaweicl… Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Conflicts: drivers/md/raid1.c [Due to not merging f2a38abf5f1c ("md/raid1: Atomic write support").] drivers/md/raid10.c [Due to not merging a1d9b4fd42d9 ("md/raid10: Atomic write support").] Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/md/raid1.c | 4 ---- drivers/md/raid10.c | 7 ------- 2 files changed, 11 deletions(-) diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c index 1be011a700f8..4b7e68276d6c 100644 --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -1212,8 +1212,6 @@ static void raid1_read_request(struct mddev *mddev, struct bio *bio, struct raid1_info *mirror; struct bio *read_bio; struct bitmap *bitmap = mddev->bitmap; - const enum req_op op = bio_op(bio); - const blk_opf_t do_sync = bio->bi_opf & REQ_SYNC; int max_sectors; int rdisk; bool r1bio_existed = !!r1_bio; @@ -1311,7 +1309,6 @@ static void raid1_read_request(struct mddev *mddev, struct bio *bio, read_bio->bi_iter.bi_sector = r1_bio->sector + mirror->rdev->data_offset; read_bio->bi_end_io = raid1_end_read_request; - read_bio->bi_opf = op | do_sync; if (test_bit(FailFast, &mirror->rdev->flags) && test_bit(R1BIO_FailFast, &r1_bio->state)) read_bio->bi_opf |= MD_FAILFAST; @@ -1532,7 +1529,6 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio, mbio->bi_iter.bi_sector = (r1_bio->sector + rdev->data_offset); mbio->bi_end_io = raid1_end_write_request; - mbio->bi_opf = bio_op(bio) | (bio->bi_opf & (REQ_SYNC | REQ_FUA)); if (test_bit(FailFast, &rdev->flags) && !test_bit(WriteMostly, &rdev->flags) && conf->raid_disks - mddev->degraded > 1) diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c index 5d197d747697..1f7fa6f8f84e 100644 --- a/drivers/md/raid10.c +++ b/drivers/md/raid10.c @@ -1161,8 +1161,6 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio, { struct r10conf *conf = mddev->private; struct bio *read_bio; - const enum req_op op = bio_op(bio); - const blk_opf_t do_sync = bio->bi_opf & REQ_SYNC; int max_sectors; struct md_rdev *rdev; char b[BDEVNAME_SIZE]; @@ -1238,7 +1236,6 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio, read_bio->bi_iter.bi_sector = r10_bio->devs[slot].addr + choose_data_offset(r10_bio, rdev); read_bio->bi_end_io = raid10_end_read_request; - read_bio->bi_opf = op | do_sync; if (test_bit(FailFast, &rdev->flags) && test_bit(R10BIO_FailFast, &r10_bio->state)) read_bio->bi_opf |= MD_FAILFAST; @@ -1255,9 +1252,6 @@ static void raid10_write_one_disk(struct mddev *mddev, struct r10bio *r10_bio, struct bio *bio, bool replacement, int n_copy) { - const enum req_op op = bio_op(bio); - const blk_opf_t do_sync = bio->bi_opf & REQ_SYNC; - const blk_opf_t do_fua = bio->bi_opf & REQ_FUA; unsigned long flags; struct r10conf *conf = mddev->private; struct md_rdev *rdev; @@ -1276,7 +1270,6 @@ static void raid10_write_one_disk(struct mddev *mddev, struct r10bio *r10_bio, mbio->bi_iter.bi_sector = (r10_bio->devs[n_copy].addr + choose_data_offset(r10_bio, rdev)); mbio->bi_end_io = raid10_end_write_request; - mbio->bi_opf = op | do_sync | do_fua; if (!replacement && test_bit(FailFast, &conf->mirrors[devnum].rdev->flags) && enough(conf, devnum)) -- 2.39.2

2 1

[PATCH OLK-6.6] scsi: qla1280: Fix kernel oops when debug level > 2
by Zheng Qixing 30 Apr '25

30 Apr '25

From: Magnus Lindholm <linmag7(a)gmail.com> stable inclusion from stable-v6.6.84 commit ea371d1cdefb0951c7127a33bcd7eb931cf44571 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBY434 CVE: CVE-2025-21957 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5233e3235dec3065ccc632729675575dbe3c6b8a ] A null dereference or oops exception will eventually occur when qla1280.c driver is compiled with DEBUG_QLA1280 enabled and ql_debug_level > 2. I think its clear from the code that the intention here is sg_dma_len(s) not length of sg_next(s) when printing the debug info. Signed-off-by: Magnus Lindholm <linmag7(a)gmail.com> Link: https://lore.kernel.org/r/20250125095033.26188-1-linmag7@gmail.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/scsi/qla1280.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/scsi/qla1280.c b/drivers/scsi/qla1280.c index 6e5e89aaa283..74b23c43af3e 100644 --- a/drivers/scsi/qla1280.c +++ b/drivers/scsi/qla1280.c @@ -2866,7 +2866,7 @@ qla1280_64bit_start_scsi(struct scsi_qla_host *ha, struct srb * sp) dprintk(3, "S/G Segment phys_addr=%x %x, len=0x%x\n", cpu_to_le32(upper_32_bits(dma_handle)), cpu_to_le32(lower_32_bits(dma_handle)), - cpu_to_le32(sg_dma_len(sg_next(s)))); + cpu_to_le32(sg_dma_len(s))); remseg--; } dprintk(5, "qla1280_64bit_start_scsi: Scatter/gather " -- 2.39.2

2 1

[openeuler:OLK-6.6 2175/2175] include/linux/sched/signal.h: linux/kabi.h is included more than once.
by kernel test robot 30 Apr '25

30 Apr '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: dfd1abba9b4387cb2e9e79e3d6097c2ba507ce32 commit: b53643e68c841ccb6f05f90601ea30b1afeb0a2b [2175/2175] !3695 x86: Add x86 related kabi reservations compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504300733.mAi3Indd-lkp@intel.com/ includecheck warnings: (new ones prefixed by >>) >> include/linux/sched/signal.h: linux/kabi.h is included more than once. vim +15 include/linux/sched/signal.h 4 5 #include <linux/rculist.h> 6 #include <linux/signal.h> 7 #include <linux/sched.h> 8 #include <linux/sched/jobctl.h> 9 #include <linux/sched/task.h> 10 #include <linux/cred.h> 11 #include <linux/refcount.h> 12 #include <linux/posix-timers.h> 13 #include <linux/mm_types.h> 14 #include <asm/ptrace.h> > 15 #include <linux/kabi.h> 16 > 17 #include <linux/kabi.h> 18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0