- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10 0/2] Fix livepatch activation failure
by Tengda Wu 14 Jul '26

14 Jul '26

During KO compilation, the absence of the elfutils-devel package in the build environment results in the KO missing the ORC section. Consequently, after the KO is loaded, any resident kernel threads spawned by it cannot reliably unwind the stack, causing livepatch activation to fail. This is resolved by backporting the mainline patch [1]. [1] https://lore.kernel.org/all/20210512065201.35268-1-masahiroy@kernel.org/ Masahiro Yamada (2): kbuild: hide tools/ build targets from external module builds kbuild: remove libelf checks from top Makefile Makefile | 104 +++++++++++++++-------------------------- scripts/Makefile.build | 2 - 2 files changed, 38 insertions(+), 68 deletions(-) -- 2.34.1

1 2

[OLK-5.10 0/2] Avoid unreliable stack during activating livepatch
by Tengda Wu 13 Jul '26

13 Jul '26

Avoid unreliable stack during activating livepatch. Masahiro Yamada (2): kbuild: hide tools/ build targets from external module builds kbuild: remove libelf checks from top Makefile Makefile | 104 +++++++++++++++-------------------------- scripts/Makefile.build | 2 - 2 files changed, 38 insertions(+), 68 deletions(-) -- 2.34.1

1 2

[PATCH OLK-6.6] perf/x86/amd/core: Avoid enabling BRS from the SVM reload path
by Luo Gengkun 13 Jul '26

13 Jul '26

From: Sandipan Das <sandipan.das(a)amd.com> mainline inclusion from mainline-v7.2-rc3 commit 07c60dda9c059c09f83d42a3ebda2e7cc1cf3bc2 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16080 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- Branch Sampling (BRS) and Last Branch Record (LBR) are mutually exclusive hardware features, and users of both are tracked via cpuc->lbr_users. When SVM is toggled on a CPU, the host perf events are reprogrammed to update the HostOnly filter bit (set when virtualization is enabled, cleared when it is disabled). On PerfMonV2-capable processors, this reprogramming is performed by calling amd_pmu_enable_all() to rewrite the event selectors. However, amd_pmu_enable_all() also calls amd_brs_enable_all(), which enables BRS whenever cpuc->lbr_users > 0. Having active LBR events satisfies this gating on processors that have LBR but not BRS. The kernel then tries to set the BRS enable bit in DebugExtnCfg (MSR 0xc000010f). Since that bit is deprecated on such hardware, the write results in a #GP: Call Trace: <IRQ> amd_pmu_enable_all+0x1d/0x90 amd_pmu_disable_virt+0x62/0xb0 kvm_arch_disable_virtualization_cpu+0xa/0x40 [kvm] hardware_disable_nolock+0x1a/0x30 [kvm] __flush_smp_call_function_queue+0x9b/0x410 __sysvec_call_function+0x18/0xc0 sysvec_call_function+0x69/0x90 </IRQ> <TASK> asm_sysvec_call_function+0x16/0x20 RIP: 0010:cpuidle_enter_state+0xc4/0x450 ? cpuidle_enter_state+0xb7/0x450 cpuidle_enter+0x29/0x40 cpuidle_idle_call+0xf5/0x160 do_idle+0x7b/0xe0 cpu_startup_entry+0x26/0x30 start_secondary+0x115/0x140 secondary_startup_64_no_verify+0x194/0x19b </TASK> Fix this by ensuring that BRS is not enabled from the event selector reprogramming path even when cpuc->lbr_users > 0. Fixes: bae19fdd7e9e ("perf/x86/amd/core: Fix reloading events for SVM") Signed-off-by: Sandipan Das <sandipan.das(a)amd.com> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Cc: Peter Zijlstra <peterz(a)infradead.org> Link: https://patch.msgid.link/702fa204d574b03d14e3664c7d4b201db048bbfd.178350652… Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- arch/x86/events/amd/core.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/arch/x86/events/amd/core.c b/arch/x86/events/amd/core.c index 5c93241b4262..5fbe0241a6eb 100644 --- a/arch/x86/events/amd/core.c +++ b/arch/x86/events/amd/core.c @@ -751,13 +751,11 @@ static void amd_pmu_enable_event(struct perf_event *event) x86_pmu_enable_event(event); } -static void amd_pmu_enable_all(int added) +static void __amd_pmu_enable_all(void) { struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events); int idx; - amd_brs_enable_all(); - for_each_set_bit(idx, x86_pmu.cntr_mask, X86_PMC_IDX_MAX) { /* only activate events which are marked as active */ if (!test_bit(idx, cpuc->active_mask)) @@ -772,6 +770,12 @@ static void amd_pmu_enable_all(int added) } } +static void amd_pmu_enable_all(int added) +{ + amd_brs_enable_all(); + __amd_pmu_enable_all(); +} + static void amd_pmu_v2_enable_event(struct perf_event *event) { struct hw_perf_event *hwc = &event->hw; @@ -1522,7 +1526,7 @@ static inline void amd_pmu_reload_virt(void) * set global enable bits once again */ amd_pmu_v2_disable_all(); - amd_pmu_enable_all(0); + __amd_pmu_enable_all(); amd_pmu_v2_enable_all(0); return; } -- 2.34.1

2 1

[PATCH OLK-6.6] perf/x86/amd/core: Avoid enabling BRS from the SVM reload path
by Luo Gengkun 13 Jul '26

13 Jul '26

From: Sandipan Das <sandipan.das(a)amd.com> mainline inclusion from mainline-v7.2-rc3 commit 07c60dda9c059c09f83d42a3ebda2e7cc1cf3bc2 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- Branch Sampling (BRS) and Last Branch Record (LBR) are mutually exclusive hardware features, and users of both are tracked via cpuc->lbr_users. When SVM is toggled on a CPU, the host perf events are reprogrammed to update the HostOnly filter bit (set when virtualization is enabled, cleared when it is disabled). On PerfMonV2-capable processors, this reprogramming is performed by calling amd_pmu_enable_all() to rewrite the event selectors. However, amd_pmu_enable_all() also calls amd_brs_enable_all(), which enables BRS whenever cpuc->lbr_users > 0. Having active LBR events satisfies this gating on processors that have LBR but not BRS. The kernel then tries to set the BRS enable bit in DebugExtnCfg (MSR 0xc000010f). Since that bit is deprecated on such hardware, the write results in a #GP: Call Trace: <IRQ> amd_pmu_enable_all+0x1d/0x90 amd_pmu_disable_virt+0x62/0xb0 kvm_arch_disable_virtualization_cpu+0xa/0x40 [kvm] hardware_disable_nolock+0x1a/0x30 [kvm] __flush_smp_call_function_queue+0x9b/0x410 __sysvec_call_function+0x18/0xc0 sysvec_call_function+0x69/0x90 </IRQ> <TASK> asm_sysvec_call_function+0x16/0x20 RIP: 0010:cpuidle_enter_state+0xc4/0x450 ? cpuidle_enter_state+0xb7/0x450 cpuidle_enter+0x29/0x40 cpuidle_idle_call+0xf5/0x160 do_idle+0x7b/0xe0 cpu_startup_entry+0x26/0x30 start_secondary+0x115/0x140 secondary_startup_64_no_verify+0x194/0x19b </TASK> Fix this by ensuring that BRS is not enabled from the event selector reprogramming path even when cpuc->lbr_users > 0. Fixes: bae19fdd7e9e ("perf/x86/amd/core: Fix reloading events for SVM") Signed-off-by: Sandipan Das <sandipan.das(a)amd.com> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Cc: Peter Zijlstra <peterz(a)infradead.org> Link: https://patch.msgid.link/702fa204d574b03d14e3664c7d4b201db048bbfd.178350652… Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- arch/x86/events/amd/core.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/arch/x86/events/amd/core.c b/arch/x86/events/amd/core.c index 5c93241b4262..5fbe0241a6eb 100644 --- a/arch/x86/events/amd/core.c +++ b/arch/x86/events/amd/core.c @@ -751,13 +751,11 @@ static void amd_pmu_enable_event(struct perf_event *event) x86_pmu_enable_event(event); } -static void amd_pmu_enable_all(int added) +static void __amd_pmu_enable_all(void) { struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events); int idx; - amd_brs_enable_all(); - for_each_set_bit(idx, x86_pmu.cntr_mask, X86_PMC_IDX_MAX) { /* only activate events which are marked as active */ if (!test_bit(idx, cpuc->active_mask)) @@ -772,6 +770,12 @@ static void amd_pmu_enable_all(int added) } } +static void amd_pmu_enable_all(int added) +{ + amd_brs_enable_all(); + __amd_pmu_enable_all(); +} + static void amd_pmu_v2_enable_event(struct perf_event *event) { struct hw_perf_event *hwc = &event->hw; @@ -1522,7 +1526,7 @@ static inline void amd_pmu_reload_virt(void) * set global enable bits once again */ amd_pmu_v2_disable_all(); - amd_pmu_enable_all(0); + __amd_pmu_enable_all(); amd_pmu_v2_enable_all(0); return; } -- 2.34.1

2 1

[PATCH OLK-5.10] bpf, arm64: Fix off-by-one in check_imm signed range check
by Pan Taixi 12 Jul '26

12 Jul '26

From: Daniel Borkmann <daniel(a)iogearbox.net> mainline inclusion from mainline-v7.1-rc1 commit 1dd8be4ec722ce54e4cace59f3a4ba658111b3ec category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15738 CVE: CVE-2026-53036 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- check_imm(bits, imm) is used in the arm64 BPF JIT to verify that a branch displacement (in arm64 instruction units) fits into the signed N-bit immediate field of a B, B.cond or CBZ/CBNZ encoding before it is handed to the encoder. The macro currently tests for (imm > 0 && imm >> bits) || (imm < 0 && ~imm >> bits) which admits values in [-2^N, 2^N) — effectively a signed (N+1)-bit range. A signed N-bit field only holds [-2^(N-1), 2^(N-1)), so the check admits one extra bit of range on each side. In particular, for check_imm19(), values in [2^18, 2^19) slip past the check but do not fit into the 19-bit signed imm19 field of B.cond. aarch64_insn_encode_immediate() then masks the raw value into the 19-bit field, setting bit 18 (the sign bit) and flipping a forward branch into a backward one. Same class of issue exists for check_imm26() and the B/BL encoding. Shift by (bits - 1) instead of bits so the actual signed N-bit range is enforced. Fixes: e54bcde3d69d ("arm64: eBPF JIT compiler") Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Reviewed-by: Puranjay Mohan <puranjay(a)kernel.org> Link: https://lore.kernel.org/r/20260415121403.639619-2-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Conflicts: arch/arm64/net/bpf_jit_comp.c [ctx conflicts] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com> --- arch/arm64/net/bpf_jit_comp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c index bb4c246aea96..2a6e0b80cae7 100644 --- a/arch/arm64/net/bpf_jit_comp.c +++ b/arch/arm64/net/bpf_jit_comp.c @@ -595,12 +595,12 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx, u8 dst_adj; int off_adj; int ret; #define check_imm(bits, imm) do { \ - if ((((imm) > 0) && ((imm) >> (bits))) || \ - (((imm) < 0) && (~(imm) >> (bits)))) { \ + if ((((imm) > 0) && ((imm) >> ((bits) - 1))) || \ + (((imm) < 0) && (~(imm) >> ((bits) - 1)))) { \ pr_info("[%2d] imm=%d(0x%x) out of range\n", \ i, imm, imm); \ return -EINVAL; \ } \ } while (0) -- 2.34.1

2 1

[PATCH OLK-5.10 00/14] CVE-2026-46054
by Cai Xinchen 10 Jul '26

10 Jul '26

ovl_open_realfile reletion code feature patch ("ovl: pass layer mnt to ovl_open_realfile: ovl_open_realfile reletion.") init_file code refactoring patch ("fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers") backing_file structure and backing_file_open function reletion features: patch ("fs: use backing_file container for internal files with "fake" f_path") patch ("fs: move cleanup from init_file() into its callers") bpf_fd_pass const warning fix patch ("lsm: constify the 'file' parameter in security_binder_transfer_file()") code refactoring: store real path instead of fake path in backing file f_path patch ("fs: get mnt_writers count for an open backing file's real path") patch ("fs: create helper file_user_path() for user displayed mapped file path") patch ("fs: store real path instead of fake path in backing file f_path") patch ("ovl: Fix nested backing file paths") patch ("perf/core: Fix MMAP event path names with backing files") backing_file const warning fix patch ("fs: constify file ptr in backing_file accessor helpers") SELinux overlay backing_file mmap/mprotect check prepare for lsm function: patch ("fs: prepare for adding LSM blob to backing_file") patch ("lsm: add backing_file LSM hooks") CVE-2026-46054 fix: Add SELinux lsm hooks for backing_file mmap/mprotect patch ("selinux: fix overlayfs mmap() and mprotect() access checks") Adrian Hunter (1): perf/core: Fix MMAP event path names with backing files Amir Goldstein (9): [Backport] ovl: pass layer mnt to ovl_open_realfile() fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers fs: use backing_file container for internal files with "fake" f_path fs: move cleanup from init_file() into its callers fs: get mnt_writers count for an open backing file's real path fs: create helper file_user_path() for user displayed mapped file path fs: store real path instead of fake path in backing file f_path fs: constify file ptr in backing_file accessor helpers fs: prepare for adding LSM blob to backing_file André Almeida (1): ovl: Fix nested backing file paths Khadija Kamran (1): lsm: constify the 'file' parameter in security_binder_transfer_file() Paul Moore (2): lsm: add backing_file LSM hooks selinux: fix overlayfs mmap() and mprotect() access checks arch/arc/kernel/troubleshoot.c | 6 +- fs/file_table.c | 139 ++++++++++++++--- fs/internal.h | 18 ++- fs/open.c | 76 ++++++--- fs/overlayfs/file.c | 34 ++-- fs/overlayfs/overlayfs.h | 1 + fs/overlayfs/super.c | 16 +- fs/overlayfs/util.c | 14 ++ fs/proc/base.c | 2 +- fs/proc/nommu.c | 2 +- fs/proc/task_mmu.c | 4 +- fs/proc/task_nommu.c | 2 +- include/linux/fs.h | 44 +++++- include/linux/lsm_audit.h | 2 +- include/linux/lsm_hook_defs.h | 7 +- include/linux/lsm_hooks.h | 1 + include/linux/security.h | 26 +++- kernel/events/core.c | 2 +- kernel/trace/trace_output.c | 2 +- security/security.c | 112 ++++++++++++- security/selinux/hooks.c | 250 ++++++++++++++++++++++-------- security/selinux/include/objsec.h | 11 ++ 22 files changed, 631 insertions(+), 140 deletions(-) -- 2.18.0.huawei.25

2 15

[PATCH OLK-6.6] mm/numa_remote: limit remote NUMA linear mapping to PMD granularity
by Jinjiang Tu 09 Jul '26

09 Jul '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9543 ---------------------------------------- When hot-adding 1G memory and then hot-removing a 128MB portion, the entire 1G PUD-level page table gets torn down because the linear mapping was created at PUD block granularity. This causes valid remaining memory to lose its mapping. Fix this by forcing PMD-level block mappings for remote NUMA nodes during arch_add_memory(), so that hot-remove only tears down PMD-sized segments rather than the full PUD range. Since hot-add/hot-remove granularity is larger than PMD size, there is no risk of incorrectly removing linear mappings belonging to adjacent memory regions. Fixes: 564bbaf3fbb5 ("mm/numa_remote: support to hotplug/hotremove remote memory") Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- arch/arm64/mm/mmu.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c index 6fd01159820b..2820748d7152 100644 --- a/arch/arm64/mm/mmu.c +++ b/arch/arm64/mm/mmu.c @@ -25,6 +25,7 @@ #include <linux/vmalloc.h> #include <linux/set_memory.h> #include <linux/kfence.h> +#include <linux/numa_remote.h> #include "internal.h" #include <asm/barrier.h> @@ -1408,7 +1409,7 @@ int arch_add_memory(int nid, u64 start, u64 size, if (can_set_direct_map() || is_virtcca_cvm_world()) flags |= NO_BLOCK_MAPPINGS | NO_CONT_MAPPINGS; - else if (should_pmd_linear_mapping()) + else if (should_pmd_linear_mapping() || numa_is_remote_node(nid)) flags |= NO_PUD_BLOCK_MAPPINGS | NO_CONT_MAPPINGS; __create_pgd_mapping(swapper_pg_dir, start, __phys_to_virt(start), -- 2.43.0

2 1

[PATCH OLK-6.6 0/4] Fix CVE-2026-46054
by Cai Xinchen 08 Jul '26

08 Jul '26

Backport the patch series "Fix incorrect overlayfs mmap() and mprotect() LSM access controls" [1] to OLK-6.6. The patch "fs: constify file ptr in backing_file accessor helpers" is backport to fix const warning. Amir Goldstein (2): fs: prepare for adding LSM blob to backing_file fs: constify file ptr in backing_file accessor helpers Paul Moore (2): lsm: add backing_file LSM hooks selinux: fix overlayfs mmap() and mprotect() access checks fs/backing-file.c | 15 +- fs/file_table.c | 54 ++++++- fs/fuse/passthrough.c | 2 +- fs/internal.h | 4 +- fs/overlayfs/file.c | 4 +- include/linux/backing-file.h | 2 +- include/linux/fs.h | 17 ++- include/linux/lsm_audit.h | 2 +- include/linux/lsm_hook_defs.h | 5 + include/linux/lsm_hooks.h | 1 + include/linux/security.h | 22 +++ security/security.c | 109 ++++++++++++++ security/selinux/hooks.c | 242 ++++++++++++++++++++++-------- security/selinux/include/objsec.h | 11 ++ 14 files changed, 408 insertions(+), 82 deletions(-) -- 2.18.0.huawei.25

2 5

openEuler Kernel SIG双周例会
by openEuler conference 08 Jul '26

08 Jul '26

您好！ Kernel 邀请您参加 2026-07-10 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议发起人： LiaoTao_Wave 会议内容： 1. 进展update 2. 议题征集中（新增议题请填报至会议纪要看板）会议链接：https://meeting.huaweicloud.com:36443/#/j/968477591 会议纪要&签到链接：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2026-07-10 14:00 The subject of the conference is openEuler Kernel SIG双周例会 The sponsor of the conference is LiaoTao_Wave Summary: 1. 进展update 2. 议题征集中（新增议题请填报至会议纪要看板） You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/968477591 Add topics at https://etherpad.openeuler.org/p/Kernel-meetings More information: https://www.openeuler.org/en/

1 0

[PATCH OLK-6.6 0/4] Fix CVE-2026-46054
by Cai Xinchen 08 Jul '26

08 Jul '26

Backport the patch series "Fix incorrect overlayfs mmap() and mprotect() LSM access controls" [1] to OLK-6.6. The patch "fs: constify file ptr in backing_file accessor helpers" is backport to fix const warning. Amir Goldstein (2): fs: prepare for adding LSM blob to backing_file fs: constify file ptr in backing_file accessor helpers Paul Moore (2): lsm: add backing_file LSM hooks selinux: fix overlayfs mmap() and mprotect() access checks fs/backing-file.c | 15 +- fs/file_table.c | 54 ++++++- fs/fuse/passthrough.c | 2 +- fs/internal.h | 4 +- fs/overlayfs/file.c | 4 +- include/linux/backing-file.h | 2 +- include/linux/fs.h | 17 ++- include/linux/lsm_audit.h | 2 +- include/linux/lsm_hook_defs.h | 5 + include/linux/lsm_hooks.h | 1 + include/linux/security.h | 22 +++ security/security.c | 109 ++++++++++++++ security/selinux/hooks.c | 242 ++++++++++++++++++++++-------- security/selinux/include/objsec.h | 11 ++ 14 files changed, 408 insertions(+), 82 deletions(-) -- 2.18.0.huawei.25

2 8