- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS 0/2] CVE-2025-38180
by Yongqiang Liu 25 Aug '25

25 Aug '25

Eric Dumazet (2): net: atm: add lec_mutex net: atm: fix /proc/net/atm/lec handling net/atm/lec.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) -- 2.25.1

2 3

[openeuler:openEuler-1.0-LTS 1761/1761] include/uapi/../../drivers/scsi/isci/isci.h:531:1: error: attempted to randomize userland API struct sci_base_state
by kernel test robot 25 Aug '25

25 Aug '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 6140b9e22a5c2bec953454ba4737dd9cd2a1f754 commit: 28617d9631dc65be773b8a28718e8614558caa5f [1761/1761] scsi: libsas: Abort all in-flight requests when device is gone config: arm64-randconfig-001-20250825 (https://download.01.org/0day-ci/archive/20250825/202508252122.UpJYI1df-lkp@…) compiler: aarch64-linux-gcc (GCC) 7.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250825/202508252122.UpJYI1df-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202508252122.UpJYI1df-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from include/uapi/../../drivers/scsi/isci/remote_node_context.h:67:0, from include/uapi/../../drivers/scsi/isci/remote_device.h:61, from drivers/scsi/libsas/sas_discover.c:36: >> include/uapi/../../drivers/scsi/isci/isci.h:531:1: error: attempted to randomize userland API struct sci_base_state }; ^ In file included from drivers/scsi/libsas/sas_discover.c:30:0: drivers/scsi/libsas/sas_discover.c: In function 'sas_discover_domain': drivers/scsi/libsas/sas_internal.h:37:31: warning: this statement may fall through [-Wimplicit-fallthrough=] #define SAS_DPRINTK(fmt, ...) printk(KERN_DEBUG "sas: " fmt, ## __VA_ARGS__) ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/scsi/libsas/sas_discover.c:512:3: note: in expansion of macro 'SAS_DPRINTK' SAS_DPRINTK("ATA device seen but CONFIG_SCSI_SAS_ATA=N so cannot attach\n"); ^~~~~~~~~~~ drivers/scsi/libsas/sas_discover.c:515:2: note: here default: ^~~~~~~ vim +531 include/uapi/../../drivers/scsi/isci/isci.h 12ef65444de9d3 Edmund Nadolski 2011-06-02 527 12ef65444de9d3 Edmund Nadolski 2011-06-02 528 struct sci_base_state { 12ef65444de9d3 Edmund Nadolski 2011-06-02 529 sci_state_transition_t enter_state; /* Called on state entry */ 12ef65444de9d3 Edmund Nadolski 2011-06-02 530 sci_state_transition_t exit_state; /* Called on state exit */ 12ef65444de9d3 Edmund Nadolski 2011-06-02 @531 }; 12ef65444de9d3 Edmund Nadolski 2011-06-02 532 :::::: The code at line 531 was first introduced by commit :::::: 12ef65444de9d387a383b9991960848bed5bbe74 isci: additional state machine cleanup :::::: TO: Edmund Nadolski <edmund.nadolski(a)intel.com> :::::: CC: Dan Williams <dan.j.williams(a)intel.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] arm64/mpam: Add mb_only boot option
by Zeng Heng 25 Aug '25

25 Aug '25

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/ICUMVC -------------------------------- Within MPAM's shared-resource pool, different types frequently vary in quantity and specification. To present a uniform partition and monitoring interface, the driver traditionally constrains every resource set to the smallest common denominator, leaving much of the underlying hardware idle and wasted. To maximize utilization of a designated resource for single-type scenarios, allow enabling that resource exclusively. Therefore, we extend the boot parameter to initialize only specified resource type while ignoring all others. Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/arm64/include/asm/cpufeature.h | 1 + arch/arm64/kernel/cpufeature.c | 10 ++++++++++ drivers/acpi/arm64/mpam.c | 5 +++++ fs/resctrl/monitor.c | 25 ++++++++++++++++++------- 4 files changed, 34 insertions(+), 7 deletions(-) diff --git a/arch/arm64/include/asm/cpufeature.h b/arch/arm64/include/asm/cpufeature.h index 859236125cb1..c4d4ab854e81 100644 --- a/arch/arm64/include/asm/cpufeature.h +++ b/arch/arm64/include/asm/cpufeature.h @@ -880,6 +880,7 @@ static inline bool cpus_support_mpam(void) } bool mpam_detect_is_enabled(void); +bool mpam_only_enable_mb(void); static inline bool system_supports_haft(void) { diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c index 672accbd5b4a..f8c225c90439 100644 --- a/arch/arm64/kernel/cpufeature.c +++ b/arch/arm64/kernel/cpufeature.c @@ -2363,9 +2363,19 @@ bool mpam_detect_is_enabled(void) return mpam_force_enabled; } +static bool __read_mostly mpam_mb_only; +bool mpam_only_enable_mb(void) +{ + return mpam_mb_only; +} + static int __init mpam_setup(char *str) { mpam_force_enabled = true; + + if (str && !strcmp(str, "mb_only")) + mpam_mb_only = true; + return 0; } early_param("arm64.mpam", mpam_setup); diff --git a/drivers/acpi/arm64/mpam.c b/drivers/acpi/arm64/mpam.c index de866e711be2..277e7d2bc58b 100644 --- a/drivers/acpi/arm64/mpam.c +++ b/drivers/acpi/arm64/mpam.c @@ -120,6 +120,11 @@ static int acpi_mpam_parse_resource(struct acpi_mpam_msc_node *tbl_msc, off_t offset; int level; + if (mpam_only_enable_mb()) { + if (res->locator_type != ACPI_MPAM_LOCATION_TYPE_MEMORY) + return 0; + } + /* * Class IDs are somewhat arbitrary, but need to be co-ordinated. * 0-N are caches, diff --git a/fs/resctrl/monitor.c b/fs/resctrl/monitor.c index 66ebfaa26e28..d10497013638 100644 --- a/fs/resctrl/monitor.c +++ b/fs/resctrl/monitor.c @@ -790,9 +790,6 @@ static int dom_data_init(struct rdt_resource *r) static void dom_data_exit(struct rdt_resource *r) { - if (!r->mon_capable) - return; - mutex_lock(&rdtgroup_mutex); if (IS_ENABLED(CONFIG_RESCTRL_RMID_DEPENDS_ON_CLOSID)) { kfree(closid_num_dirty_rmid); @@ -807,10 +804,15 @@ static void dom_data_exit(struct rdt_resource *r) int resctrl_mon_resource_init(void) { - struct rdt_resource *r = resctrl_arch_get_resource(RDT_RESOURCE_L3); - int ret; + struct rdt_resource *r; + int i, ret; - if (!r->mon_capable) + for (i = 0; i < RDT_NUM_RESOURCES; i++) { + r = resctrl_arch_get_resource(i); + if (r->mon_capable) + break; + } + if (i == RDT_NUM_RESOURCES) return 0; ret = dom_data_init(r); @@ -822,7 +824,16 @@ int resctrl_mon_resource_init(void) void resctrl_mon_resource_exit(void) { - struct rdt_resource *r = resctrl_arch_get_resource(RDT_RESOURCE_L3); + struct rdt_resource *r; + int i; + + for (i = 0; i < RDT_NUM_RESOURCES; i++) { + r = resctrl_arch_get_resource(i); + if (r->mon_capable) + break; + } + if (i == RDT_NUM_RESOURCES) + return; dom_data_exit(r); } -- 2.25.1

2 1

[PATCH OLK-6.6] arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack()
by Jinjie Ruan 25 Aug '25

25 Aug '25

From: Ada Couprie Diaz <ada.coupriediaz(a)arm.com> stable inclusion from stable-v6.6.101 commit 9433a5f437b0948d6a2d8a02ad7a42ab7ca27a61 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICUCAD CVE: CVE-2025-38670 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit d42e6c20de6192f8e4ab4cf10be8c694ef27e8cb upstream. `cpu_switch_to()` and `call_on_irq_stack()` manipulate SP to change to different stacks along with the Shadow Call Stack if it is enabled. Those two stack changes cannot be done atomically and both functions can be interrupted by SErrors or Debug Exceptions which, though unlikely, is very much broken : if interrupted, we can end up with mismatched stacks and Shadow Call Stack leading to clobbered stacks. In `cpu_switch_to()`, it can happen when SP_EL0 points to the new task, but x18 stills points to the old task's SCS. When the interrupt handler tries to save the task's SCS pointer, it will save the old task SCS pointer (x18) into the new task struct (pointed to by SP_EL0), clobbering it. In `call_on_irq_stack()`, it can happen when switching from the task stack to the IRQ stack and when switching back. In both cases, we can be interrupted when the SCS pointer points to the IRQ SCS, but SP points to the task stack. The nested interrupt handler pushes its return addresses on the IRQ SCS. It then detects that SP points to the task stack, calls `call_on_irq_stack()` and clobbers the task SCS pointer with the IRQ SCS pointer, which it will also use ! This leads to tasks returning to addresses on the wrong SCS, or even on the IRQ SCS, triggering kernel panics via CONFIG_VMAP_STACK or FPAC if enabled. This is possible on a default config, but unlikely. However, when enabling CONFIG_ARM64_PSEUDO_NMI, DAIF is unmasked and instead the GIC is responsible for filtering what interrupts the CPU should receive based on priority. Given the goal of emulating NMIs, pseudo-NMIs can be received by the CPU even in `cpu_switch_to()` and `call_on_irq_stack()`, possibly *very* frequently depending on the system configuration and workload, leading to unpredictable kernel panics. Completely mask DAIF in `cpu_switch_to()` and restore it when returning. Do the same in `call_on_irq_stack()`, but restore and mask around the branch. Mask DAIF even if CONFIG_SHADOW_CALL_STACK is not enabled for consistency of behaviour between all configurations. Introduce and use an assembly macro for saving and masking DAIF, as the existing one saves but only masks IF. Cc: <stable(a)vger.kernel.org> Signed-off-by: Ada Couprie Diaz <ada.coupriediaz(a)arm.com> Reported-by: Cristian Prundeanu <cpru(a)amazon.com> Fixes: 59b37fe52f49 ("arm64: Stash shadow stack pointer in the task struct on interrupt") Tested-by: Cristian Prundeanu <cpru(a)amazon.com> Acked-by: Will Deacon <will(a)kernel.org> Link: https://lore.kernel.org/r/20250718142814.133329-1-ada.coupriediaz@arm.com Signed-off-by: Will Deacon <will(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- arch/arm64/include/asm/assembler.h | 5 +++++ arch/arm64/kernel/entry.S | 6 ++++++ 2 files changed, 11 insertions(+) diff --git a/arch/arm64/include/asm/assembler.h b/arch/arm64/include/asm/assembler.h index 38b23786aeb4..f6f92c582e0f 100644 --- a/arch/arm64/include/asm/assembler.h +++ b/arch/arm64/include/asm/assembler.h @@ -63,6 +63,11 @@ alternative_else_nop_endif /* * Save/restore interrupts. */ + .macro save_and_disable_daif, flags + mrs \flags, daif + msr daifset, #0xf + .endm + .macro save_and_disable_irq, flags mrs \flags, daif msr daifset, #3 diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S index 62b59d67b27e..5648a3119f90 100644 --- a/arch/arm64/kernel/entry.S +++ b/arch/arm64/kernel/entry.S @@ -1048,6 +1048,7 @@ SYM_CODE_END(__bp_harden_el1_vectors) * */ SYM_FUNC_START(cpu_switch_to) + save_and_disable_daif x11 mov x10, #THREAD_CPU_CONTEXT add x8, x0, x10 mov x9, sp @@ -1071,6 +1072,7 @@ SYM_FUNC_START(cpu_switch_to) ptrauth_keys_install_kernel x1, x8, x9, x10 scs_save x0 scs_load_current + restore_irq x11 ret SYM_FUNC_END(cpu_switch_to) NOKPROBE(cpu_switch_to) @@ -1097,6 +1099,7 @@ NOKPROBE(ret_from_fork) * Calls func(regs) using this CPU's irq stack and shadow irq stack. */ SYM_FUNC_START(call_on_irq_stack) + save_and_disable_daif x9 #ifdef CONFIG_SHADOW_CALL_STACK get_current_task x16 scs_save x16 @@ -1111,8 +1114,10 @@ SYM_FUNC_START(call_on_irq_stack) /* Move to the new stack and call the function there */ add sp, x16, #IRQ_STACK_SIZE + restore_irq x9 blr x1 + save_and_disable_daif x9 /* * Restore the SP from the FP, and restore the FP and LR from the frame * record. @@ -1120,6 +1125,7 @@ SYM_FUNC_START(call_on_irq_stack) mov sp, x29 ldp x29, x30, [sp], #16 scs_load_current + restore_irq x9 ret SYM_FUNC_END(call_on_irq_stack) NOKPROBE(call_on_irq_stack) -- 2.34.1

2 1

[PATCH OLK-6.6] arm64: Fix actlr_el1 can not set problem in guest
by Jinjie Ruan 25 Aug '25

25 Aug '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/release-management/issues/IBV2E4 -------------------------------- During the initialization of the vCPU, the vcpu->arch.hcr_el2 is set to HCR_GUEST_FLAGS, which include HCR_TACR, so regardless of whether the host has configured HCR_EL2, accessing ACTLR_EL1 in the guest virtual machine will trap to EL2. However, the current implementation of KVM ignores writes to ACTLR_EL1, so it is currently not possible to set this register in the guest, hardware xcall/xint can not take effect anyway, so modify the state of actlr based on the written value in access_actlr(). Fixes: 7f2e02718bba ("arm64: entry: Support hardware xcall and xint") Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- arch/arm64/kernel/cpufeature.c | 4 ---- arch/arm64/kvm/sys_regs.c | 6 ++++-- 2 files changed, 4 insertions(+), 6 deletions(-) diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c index 672accbd5b4a..053a95cdcec7 100644 --- a/arch/arm64/kernel/cpufeature.c +++ b/arch/arm64/kernel/cpufeature.c @@ -2523,10 +2523,6 @@ static void cpu_enable_arch_xcall_xint(const struct arm64_cpu_capabilities *__un el = read_sysreg(CurrentEL); if (el == CurrentEL_EL2) { - /* - * Enable EL2 trap when access ACTLR_EL1 in guest kernel. - */ - write_sysreg_s(read_sysreg_s(SYS_HCR_EL2) | HCR_TACR, SYS_HCR_EL2); actlr_el2 = read_sysreg(actlr_el2); actlr_el2 |= ACTLR_ELx_XINT; write_sysreg(actlr_el2, actlr_el2); diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c index ff00ad782d7d..9a404daeb2ff 100644 --- a/arch/arm64/kvm/sys_regs.c +++ b/arch/arm64/kvm/sys_regs.c @@ -281,8 +281,10 @@ static bool access_actlr(struct kvm_vcpu *vcpu, { u64 mask, shift; - if (p->is_write) - return ignore_write(vcpu, p); + if (p->is_write) { + vcpu_write_sys_reg(vcpu, p->regval, r->reg); + return true; + } get_access_mask(r, &mask, &shift); p->regval = (vcpu_read_sys_reg(vcpu, r->reg) & mask) >> shift; -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] CVE-2025-38006
by Wang Liang 25 Aug '25

25 Aug '25

Eric Dumazet (1): mctp: no longer rely on net->dev_index_head[] Matt Johnston (1): net: mctp: Don't access ifa_index when missing net/mctp/device.c | 65 ++++++++++++++++++++++------------------------- 1 file changed, 30 insertions(+), 35 deletions(-) -- 2.33.0

2 3

[PATCH OLK-5.10 0/4] CVE-2025-38465
by Wang Liang 25 Aug '25

25 Aug '25

Fedor Pchelkin (1): netlink: avoid infinite retry looping in netlink_unicast() Jakub Kicinski (1): netlink: make sure we allow at least one dump skb Kuniyuki Iwashima (2): netlink: Fix wraparounds of sk->sk_rmem_alloc. netlink: Fix rmem check in netlink_broadcast_deliver(). net/netlink/af_netlink.c | 82 ++++++++++++++++++++++++---------------- 1 file changed, 50 insertions(+), 32 deletions(-) -- 2.33.0

2 5

[PATCH OLK-5.10] perf/core: Don't leak AUX buffer refcount on allocation failure
by Tengda Wu 25 Aug '25

25 Aug '25

From: Thomas Gleixner <tglx(a)linutronix.de> mainline inclusion from mainline-v6.17-rc1 commit 5468c0fbccbb9d156522c50832244a8b722374fb category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICULKF Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Failure of the AUX buffer allocation leaks the reference count. Set the reference count to 1 only when the allocation succeeds. Fixes: 45bfb2e50471 ("perf: Add AUX area to ring buffer for raw data streams") Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Cc: stable(a)vger.kernel.org Conflicts: kernel/events/core.c [Two cleanup patch (0c8a4e4139 and 954878377) did not backport, causing conflicts] Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/events/core.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/kernel/events/core.c b/kernel/events/core.c index e1125d158c74..4b9c5050ede2 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -6138,7 +6138,6 @@ static int perf_mmap(struct file *file, struct vm_area_struct *vma) goto unlock; } - atomic_set(&rb->aux_mmap_count, 1); user_extra = nr_pages; goto accounting; @@ -6243,8 +6242,10 @@ static int perf_mmap(struct file *file, struct vm_area_struct *vma) } else { ret = rb_alloc_aux(rb, event, vma->vm_pgoff, nr_pages, event->attr.aux_watermark, flags); - if (!ret) + if (!ret) { + atomic_set(&rb->aux_mmap_count, 1); rb->aux_mmap_locked = extra; + } } unlock: @@ -6254,6 +6255,7 @@ static int perf_mmap(struct file *file, struct vm_area_struct *vma) atomic_inc(&event->mmap_count); } else if (rb) { + /* AUX allocation failed */ atomic_dec(&rb->mmap_count); } aux_unlock: -- 2.34.1

2 1

[PATCH OLK-6.6] perf/core: Don't leak AUX buffer refcount on allocation failure
by Tengda Wu 25 Aug '25

25 Aug '25

From: Thomas Gleixner <tglx(a)linutronix.de> stable inclusion from stable-6.6.102 commit f07ab7a4b572fa0a6fef26df54c1a1c6710c07ca category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICULKF Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 5468c0fbccbb9d156522c50832244a8b722374fb upstream. Failure of the AUX buffer allocation leaks the reference count. Set the reference count to 1 only when the allocation succeeds. Fixes: 45bfb2e50471 ("perf/core: Add AUX area to ring buffer for raw data streams") Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Cc: stable(a)vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/events/core.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/kernel/events/core.c b/kernel/events/core.c index 0b09ace2f009..cdef6ae43f4a 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -6565,9 +6565,7 @@ static int perf_mmap(struct file *file, struct vm_area_struct *vma) goto unlock; } - atomic_set(&rb->aux_mmap_count, 1); user_extra = nr_pages; - goto accounting; } @@ -6669,8 +6667,10 @@ static int perf_mmap(struct file *file, struct vm_area_struct *vma) } else { ret = rb_alloc_aux(rb, event, vma->vm_pgoff, nr_pages, event->attr.aux_watermark, flags); - if (!ret) + if (!ret) { + atomic_set(&rb->aux_mmap_count, 1); rb->aux_mmap_locked = extra; + } } unlock: @@ -6680,6 +6680,7 @@ static int perf_mmap(struct file *file, struct vm_area_struct *vma) atomic_inc(&event->mmap_count); } else if (rb) { + /* AUX allocation failed */ atomic_dec(&rb->mmap_count); } aux_unlock: -- 2.34.1

2 1

[PATCH OLK-6.6] mm/dpool: mark dpool hugetlb page as dirty in free_huge_folio()
by Tong Tiangen 25 Aug '25

25 Aug '25

HULK inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBJCOJ CVE: NA -------------------------------- Similar to normal hugetlb page, dynamic pool hugetlb page also need be marked as dirty when freed, ensuring that the icache consistency is maintained in __set_pte_at(). This prevents illegal instruction issues that may arise when the corresponding icache is reused in the future. Fixes: 8ce9d44df8ec ("mm/dynamic_pool: support HugeTLB page allocation from dpool") Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> --- mm/hugetlb.c | 1 + 1 file changed, 1 insertion(+) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index b94470b4cfc1..0318c97df14c 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -1952,6 +1952,7 @@ void free_huge_folio(struct folio *folio) pages_per_huge_page(h), folio); mem_cgroup_uncharge(folio); if (page_from_dynamic_pool(folio_page(folio, 0))) { + arch_clear_hugepage_flags(&folio->page); list_del(&folio->lru); spin_unlock_irqrestore(&hugetlb_lock, flags); dynamic_pool_free_hugepage(folio, restore_reserve); -- 2.25.1

2 1