- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] crypto: essiv - Check ssize for decryption and in-place encryption
by Yi Yang 22 Nov '25

22 Nov '25

From: Herbert Xu <herbert(a)gondor.apana.org.au> mainline inclusion from mainline-v6.18-rc1 commit 6bb73db6948c2de23e407fe1b7ef94bf02b7529f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID3FOP CVE: CVE-2025-40019 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Move the ssize check to the start in essiv_aead_crypt so that it's also checked for decryption and in-place encryption. Reported-by: Muhammad Alifa Ramdhan <ramdhan(a)starlabs.sg> Fixes: be1eb7f78aa8 ("crypto: essiv - create wrapper template for ESSIV generation") Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- crypto/essiv.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/crypto/essiv.c b/crypto/essiv.c index 85bb624e32b9..7db206fc97f2 100644 --- a/crypto/essiv.c +++ b/crypto/essiv.c @@ -185,9 +185,14 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc) const struct essiv_tfm_ctx *tctx = crypto_aead_ctx(tfm); struct essiv_aead_request_ctx *rctx = aead_request_ctx(req); struct aead_request *subreq = &rctx->aead_req; + int ivsize = crypto_aead_ivsize(tfm); + int ssize = req->assoclen - ivsize; struct scatterlist *src = req->src; int err; + if (ssize < 0) + return -EINVAL; + crypto_cipher_encrypt_one(tctx->essiv_cipher, req->iv, req->iv); /* @@ -197,19 +202,12 @@ static int essiv_aead_crypt(struct aead_request *req, bool enc) */ rctx->assoc = NULL; if (req->src == req->dst || !enc) { - scatterwalk_map_and_copy(req->iv, req->dst, - req->assoclen - crypto_aead_ivsize(tfm), - crypto_aead_ivsize(tfm), 1); + scatterwalk_map_and_copy(req->iv, req->dst, ssize, ivsize, 1); } else { u8 *iv = (u8 *)aead_request_ctx(req) + tctx->ivoffset; - int ivsize = crypto_aead_ivsize(tfm); - int ssize = req->assoclen - ivsize; struct scatterlist *sg; int nents; - if (ssize < 0) - return -EINVAL; - nents = sg_nents_for_len(req->src, ssize); if (nents < 0) return -EINVAL; -- 2.25.1

2 1

[PATCH OLK-6.6] drm/vmwgfx: Fix a null-ptr access in the cursor snooper
by Yi Yang 22 Nov '25

22 Nov '25

From: Zack Rusin <zack.rusin(a)broadcom.com> stable inclusion from stable-v6.6.113 commit 299cfb5a7deabdf9ecd30071755672af0aced5eb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6796 CVE: CVE-2025-40110 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5ac2c0279053a2c5265d46903432fb26ae2d0da2 ] Check that the resource which is converted to a surface exists before trying to use the cursor snooper on it. vmw_cmd_res_check allows explicit invalid (SVGA3D_INVALID_ID) identifiers because some svga commands accept SVGA3D_INVALID_ID to mean "no surface", unfortunately functions that accept the actual surfaces as objects might (and in case of the cursor snooper, do not) be able to handle null objects. Make sure that we validate not only the identifier (via the vmw_cmd_res_check) but also check that the actual resource exists before trying to do something with it. Fixes unchecked null-ptr reference in the snooping code. Signed-off-by: Zack Rusin <zack.rusin(a)broadcom.com> Fixes: c0951b797e7d ("drm/vmwgfx: Refactor resource management") Reported-by: Kuzey Arda Bulut <kuzeyardabulut(a)gmail.com> Cc: Broadcom internal kernel review list <bcm-kernel-feedback-list(a)broadcom.com> Cc: dri-devel(a)lists.freedesktop.org Reviewed-by: Ian Forbes <ian.forbes(a)broadcom.com> Link: https://lore.kernel.org/r/20250917153655.1968583-1-zack.rusin@broadcom.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c index 5fef0b31c117..41be22e781e4 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c @@ -1514,6 +1514,7 @@ static int vmw_cmd_dma(struct vmw_private *dev_priv, SVGA3dCmdHeader *header) { struct vmw_bo *vmw_bo = NULL; + struct vmw_resource *res; struct vmw_surface *srf = NULL; VMW_DECLARE_CMD_VAR(*cmd, SVGA3dCmdSurfaceDMA); int ret; @@ -1549,18 +1550,24 @@ static int vmw_cmd_dma(struct vmw_private *dev_priv, dirty = (cmd->body.transfer == SVGA3D_WRITE_HOST_VRAM) ? VMW_RES_DIRTY_SET : 0; - ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface, - dirty, user_surface_converter, - &cmd->body.host.sid, NULL); + ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface, dirty, + user_surface_converter, &cmd->body.host.sid, + NULL); if (unlikely(ret != 0)) { if (unlikely(ret != -ERESTARTSYS)) VMW_DEBUG_USER("could not find surface for DMA.\n"); return ret; } - srf = vmw_res_to_srf(sw_context->res_cache[vmw_res_surface].res); + res = sw_context->res_cache[vmw_res_surface].res; + if (!res) { + VMW_DEBUG_USER("Invalid DMA surface.\n"); + return -EINVAL; + } - vmw_kms_cursor_snoop(srf, sw_context->fp->tfile, &vmw_bo->tbo, header); + srf = vmw_res_to_srf(res); + vmw_kms_cursor_snoop(srf, sw_context->fp->tfile, &vmw_bo->tbo, + header); return 0; } -- 2.25.1

2 1

[openeuler:OLK-6.6 3304/3304] mm/gmem.c:813:29: sparse: sparse: incorrect type in assignment (different base types)
by kernel test robot 22 Nov '25

22 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 2e375b157ddf25336989b074c1f2a88a80ab72f5 commit: 8a89dde40c2bd82755f374bc86b46c77acdfd0b6 [3304/3304] mm: implement hmemcpy API config: arm64-randconfig-r122-20251122 (https://download.01.org/0day-ci/archive/20251122/202511221253.wiWo5CIW-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.4.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251122/202511221253.wiWo5CIW-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511221253.wiWo5CIW-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) mm/gmem.c:384:13: sparse: sparse: symbol 'gm_dev_fault' was not declared. Should it be static? >> mm/gmem.c:813:29: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int enum gm_ret ret @@ got restricted vm_fault_t @@ mm/gmem.c:813:29: sparse: expected unsigned int enum gm_ret ret mm/gmem.c:813:29: sparse: got restricted vm_fault_t vim +813 mm/gmem.c 765 766 static void do_hmemcpy(struct mm_struct *mm, int hnid, unsigned long dest, 767 unsigned long src, size_t size) 768 { 769 enum gm_ret ret; 770 int page_size = HPAGE_SIZE; 771 struct vm_area_struct *vma_dest, *vma_src; 772 struct gm_mapping *gm_mapping_dest, *gm_mapping_src; 773 struct gm_dev *dev = NULL; 774 struct gm_memcpy_t gmc = {0}; 775 776 if (size == 0) 777 return; 778 779 mmap_read_lock(mm); 780 vma_dest = find_vma(mm, dest); 781 vma_src = find_vma(mm, src); 782 783 if (!vma_src || vma_src->vm_start > src || !vma_dest || vma_dest->vm_start > dest) { 784 gmem_err("hmemcpy: the vma find by src/dest is NULL!"); 785 goto unlock_mm; 786 } 787 788 gm_mapping_dest = vm_object_lookup(vma_dest->vm_obj, dest & ~(page_size - 1)); 789 gm_mapping_src = vm_object_lookup(vma_src->vm_obj, src & ~(page_size - 1)); 790 791 if (!gm_mapping_src) { 792 gmem_err("hmemcpy: gm_mapping_src is NULL"); 793 goto unlock_mm; 794 } 795 796 if (gm_mapping_nomap(gm_mapping_src)) { 797 gmem_err("hmemcpy: src address is not mapping to CPU or device"); 798 goto unlock_mm; 799 } 800 801 if (hnid != -1) { 802 dev = get_gm_dev(hnid); 803 if (!dev) { 804 gmem_err("hmemcpy: hnode's dev is NULL"); 805 goto unlock_mm; 806 } 807 } 808 809 // Trigger dest page fault on host or device 810 if (!gm_mapping_dest || gm_mapping_nomap(gm_mapping_dest) 811 || !hnid_match_dest(hnid, gm_mapping_dest)) { 812 if (hnid == -1) { > 813 ret = handle_mm_fault(vma_dest, dest & ~(page_size - 1), FAULT_FLAG_USER | 814 FAULT_FLAG_INSTRUCTION | FAULT_FLAG_WRITE, NULL); 815 if (ret) { 816 gmem_err("%s: failed to execute host page fault, ret:%d", 817 __func__, ret); 818 goto unlock_mm; 819 } 820 } else { 821 ret = gm_dev_fault_locked(mm, dest & ~(page_size - 1), dev, MADV_WILLNEED); 822 if (ret != GM_RET_SUCCESS) { 823 gmem_err("%s: failed to excecute dev page fault.", __func__); 824 goto unlock_mm; 825 } 826 } 827 } 828 if (!gm_mapping_dest) 829 gm_mapping_dest = vm_object_lookup(vma_dest->vm_obj, round_down(dest, page_size)); 830 831 if (gm_mapping_dest && gm_mapping_dest != gm_mapping_src) 832 mutex_lock(&gm_mapping_dest->lock); 833 834 mutex_lock(&gm_mapping_src->lock); 835 // Use memcpy when there is no device address, otherwise use peer_memcpy 836 if (hnid == -1) { 837 if (gm_mapping_cpu(gm_mapping_src)) { // host to host 838 gmem_err("hmemcpy: host to host is unimplemented\n"); 839 goto unlock_gm_mapping; 840 } else if (gm_mapping_device(gm_mapping_src)) { // device to host 841 dev = gm_mapping_src->dev; 842 gmc.dest = phys_to_dma(dev->dma_dev, 843 page_to_phys(gm_mapping_dest->page) + (dest & (page_size - 1))); 844 gmc.src = gm_mapping_src->gm_page->dev_dma_addr + (src & (page_size - 1)); 845 gmc.kind = GM_MEMCPY_D2H; 846 } else { 847 gmem_err("hmemcpy: src address is not mapping to CPU or device"); 848 goto unlock_gm_mapping; 849 } 850 } else { 851 if (gm_mapping_cpu(gm_mapping_src)) { // host to device 852 gmc.dest = gm_mapping_dest->gm_page->dev_dma_addr + 853 (dest & (page_size - 1)); 854 gmc.src = phys_to_dma(dev->dma_dev, 855 page_to_phys(gm_mapping_src->page) + (src & (page_size - 1))); 856 gmc.kind = GM_MEMCPY_H2D; 857 } else if (gm_mapping_device(gm_mapping_src)) { // device to device 858 gmem_err("hmemcpy: device to device is unimplemented\n"); 859 goto unlock_gm_mapping; 860 } else { 861 gmem_err("hmemcpy: src address is not mapping to CPU or device"); 862 goto unlock_gm_mapping; 863 } 864 } 865 gmc.mm = mm; 866 gmc.dev = dev; 867 gmc.size = size; 868 dev->mmu->peer_hmemcpy(&gmc); 869 870 unlock_gm_mapping: 871 mutex_unlock(&gm_mapping_src->lock); 872 if (gm_mapping_dest && gm_mapping_dest != gm_mapping_src) 873 mutex_unlock(&gm_mapping_dest->lock); 874 unlock_mm: 875 mmap_read_unlock(mm); 876 } 877 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3304/3304] mm/kasan/shadow.c:90:(.text+0x590): relocation truncated to fit: R_AARCH64_CALL26 against undefined symbol `__memcpy_mc'
by kernel test robot 22 Nov '25

22 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 7fe983da1977aac40da78a43010d0612ff5c0bb1 commit: b991780c836ceb9a479c6c6e385e914b487e353a [3304/3304] arm64: introduce copy_mc_to_kernel() implementation config: arm64-randconfig-003-20251122 (https://download.01.org/0day-ci/archive/20251122/202511221034.dymjxfJa-lkp@…) compiler: aarch64-linux-gcc (GCC) 10.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251122/202511221034.dymjxfJa-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511221034.dymjxfJa-lkp@intel.com/ All errors (new ones prefixed by >>): aarch64-linux-ld: mm/kasan/shadow.o: in function `memcpy_mc': mm/kasan/shadow.c:90: undefined reference to `__memcpy_mc' >> mm/kasan/shadow.c:90:(.text+0x590): relocation truncated to fit: R_AARCH64_CALL26 against undefined symbol `__memcpy_mc' vim +90 mm/kasan/shadow.c 81 82 #ifdef __HAVE_ARCH_MEMCPY_MC 83 #undef memcpy_mc 84 int memcpy_mc(void *dest, const void *src, size_t len) 85 { 86 if (!kasan_check_range(src, len, false, _RET_IP_) || 87 !kasan_check_range(dest, len, true, _RET_IP_)) 88 return (int)len; 89 > 90 return __memcpy_mc(dest, src, len); 91 } 92 #endif 93 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 2818/2818] ../lib/gcc/aarch64-linux/5.5.0/plugin/include/config/elfos.h:102:21: warning: invalid suffix on literal; C++11 requires a space between literal and string macro
by kernel test robot 21 Nov '25

21 Nov '25

Hi Valdis, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 3f1b18215d39769abfd210cb9a02b06b47b0b4b5 commit: 0908fe0570df658beb3866ddcb7bc55b0fb834b0 [2818/2818] gcc-plugins: fix gcc 11 indigestion with plugins... config: arm64-randconfig-002-20250321 (https://download.01.org/0day-ci/archive/20251121/202511212044.w0VqCIiP-lkp@…) compiler: aarch64-linux-gcc (GCC) 5.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251121/202511212044.w0VqCIiP-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511212044.w0VqCIiP-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from ../lib/gcc/aarch64-linux/5.5.0/plugin/include/tm.h:24, from ../lib/gcc/aarch64-linux/5.5.0/plugin/include/gcc-plugin.h:31, from ../lib/gcc/aarch64-linux/5.5.0/plugin/include/plugin.h:23, from scripts/gcc-plugins/gcc-common.h:9, from scripts/gcc-plugins/stackleak_plugin.c:30: >> ../lib/gcc/aarch64-linux/5.5.0/plugin/include/config/elfos.h:102:21: warning: invalid suffix on literal; C++11 requires a space between literal and string macro [-Wliteral-suffix] 102 | fprintf ((FILE), "%s"HOST_WIDE_INT_PRINT_UNSIGNED"\n",\ | ^ In file included from ../lib/gcc/aarch64-linux/5.5.0/plugin/include/tm.h:24, from ../lib/gcc/aarch64-linux/5.5.0/plugin/include/gcc-plugin.h:31, from ../lib/gcc/aarch64-linux/5.5.0/plugin/include/plugin.h:23, from scripts/gcc-plugins/gcc-common.h:9, from scripts/gcc-plugins/randomize_layout_plugin.c:19: >> ../lib/gcc/aarch64-linux/5.5.0/plugin/include/config/elfos.h:102:21: warning: invalid suffix on literal; C++11 requires a space between literal and string macro [-Wliteral-suffix] 102 | fprintf ((FILE), "%s"HOST_WIDE_INT_PRINT_UNSIGNED"\n",\ | ^ ../lib/gcc/aarch64-linux/5.5.0/plugin/include/config/elfos.h:170:24: warning: invalid suffix on literal; C++11 requires a space between literal and string macro [-Wliteral-suffix] 170 | fprintf ((FILE), ","HOST_WIDE_INT_PRINT_UNSIGNED",%u\n", \ | ^ ../lib/gcc/aarch64-linux/5.5.0/plugin/include/config/elfos.h:170:24: warning: invalid suffix on literal; C++11 requires a space between literal and string macro [-Wliteral-suffix] 170 | fprintf ((FILE), ","HOST_WIDE_INT_PRINT_UNSIGNED",%u\n", \ | ^ In file included from ../lib/gcc/aarch64-linux/5.5.0/plugin/include/tm.h:24, from ../lib/gcc/aarch64-linux/5.5.0/plugin/include/gcc-plugin.h:31, from ../lib/gcc/aarch64-linux/5.5.0/plugin/include/plugin.h:23, from scripts/gcc-plugins/gcc-common.h:9, from scripts/gcc-plugins/sancov_plugin.c:22: >> ../lib/gcc/aarch64-linux/5.5.0/plugin/include/config/elfos.h:102:21: warning: invalid suffix on literal; C++11 requires a space between literal and string macro [-Wliteral-suffix] 102 | fprintf ((FILE), "%s"HOST_WIDE_INT_PRINT_UNSIGNED"\n",\ | ^ ../lib/gcc/aarch64-linux/5.5.0/plugin/include/config/elfos.h:170:24: warning: invalid suffix on literal; C++11 requires a space between literal and string macro [-Wliteral-suffix] 170 | fprintf ((FILE), ","HOST_WIDE_INT_PRINT_UNSIGNED",%u\n", \ | ^ In file included from ../lib/gcc/aarch64-linux/5.5.0/plugin/include/tm.h:41: >> ../lib/gcc/aarch64-linux/5.5.0/plugin/include/defaults.h:126:24: warning: invalid suffix on literal; C++11 requires a space between literal and string macro [-Wliteral-suffix] 126 | fprintf ((FILE), ","HOST_WIDE_INT_PRINT_UNSIGNED",%u\n", \ | ^ In file included from ../lib/gcc/aarch64-linux/5.5.0/plugin/include/tm.h:41: >> ../lib/gcc/aarch64-linux/5.5.0/plugin/include/defaults.h:126:24: warning: invalid suffix on literal; C++11 requires a space between literal and string macro [-Wliteral-suffix] 126 | fprintf ((FILE), ","HOST_WIDE_INT_PRINT_UNSIGNED",%u\n", \ | ^ In file included from ../lib/gcc/aarch64-linux/5.5.0/plugin/include/tm.h:41: >> ../lib/gcc/aarch64-linux/5.5.0/plugin/include/defaults.h:126:24: warning: invalid suffix on literal; C++11 requires a space between literal and string macro [-Wliteral-suffix] 126 | fprintf ((FILE), ","HOST_WIDE_INT_PRINT_UNSIGNED",%u\n", \ | ^ ../libexec/gcc/aarch64-linux/5.5.0/cc1: error while loading shared libraries: libmpfr.so.4: cannot open shared object file: No such file or directory ../libexec/gcc/aarch64-linux/5.5.0/cc1: error while loading shared libraries: libmpfr.so.4: cannot open shared object file: No such file or directory make[2]: *** [scripts/Makefile.build:280: scripts/mod/empty.o] Error 1 shuffle=1096673560 make[2]: *** [scripts/Makefile.build:117: scripts/mod/devicetable-offsets.s] Error 1 shuffle=1096673560 make[2]: Target '__build' not remade because of errors. make[1]: *** [Makefile:1214: prepare0] Error 2 shuffle=1096673560 make[1]: Target 'prepare' not remade because of errors. make: *** [Makefile:185: __sub-make] Error 2 shuffle=1096673560 make: Target 'prepare' not remade because of errors. -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()
by Xinyu Zheng 21 Nov '25

21 Nov '25

From: "Rafael J. Wysocki" <rafael.j.wysocki(a)intel.com> stable inclusion from stable-v6.6.113 commit 69a18ff6c60e8e113420f15355fad862cb45d38e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6BVZ CVE: CVE-2025-40194 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 69e5d50fcf4093fb3f9f41c4f931f12c2ca8c467 upstream. The cpufreq_cpu_put() call in update_qos_request() takes place too early because the latter subsequently calls freq_qos_update_request() that indirectly accesses the policy object in question through the QoS request object passed to it. Fortunately, update_qos_request() is called under intel_pstate_driver_lock, so this issue does not matter for changing the intel_pstate operation mode, but it theoretically can cause a crash to occur on CPU device hot removal (which currently can only happen in virt, but it is formally supported nevertheless). Address this issue by modifying update_qos_request() to drop the reference to the policy later. Fixes: da5c504c7aae ("cpufreq: intel_pstate: Implement QoS supported freq constraints") Cc: 5.4+ <stable(a)vger.kernel.org> # 5.4+ Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Reviewed-by: Zihuan Zhang <zhangzihuan(a)kylinos.cn> Link: https://patch.msgid.link/2255671.irdbgypaU6@rafael.j.wysocki Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xinyu Zheng <zhengxinyu6(a)huawei.com> --- drivers/cpufreq/intel_pstate.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c index 0cec5148b69f..8d0d62aca50d 100644 --- a/drivers/cpufreq/intel_pstate.c +++ b/drivers/cpufreq/intel_pstate.c @@ -1243,10 +1243,10 @@ static void update_qos_request(enum freq_qos_req_type type) continue; req = policy->driver_data; - cpufreq_cpu_put(policy); - - if (!req) + if (!req) { + cpufreq_cpu_put(policy); continue; + } if (hwp_active) intel_pstate_get_hwp_cap(cpu); @@ -1262,6 +1262,8 @@ static void update_qos_request(enum freq_qos_req_type type) if (freq_qos_update_request(req, freq) < 0) pr_warn("Failed to update freq constraint: CPU%d\n", i); + + cpufreq_cpu_put(policy); } } -- 2.34.1

2 1

[PATCH OLK-6.6 v2 0/6] xcall2.0: bugfix for prefetch ko
by Xinyu Zheng 21 Nov '25

21 Nov '25

Xinyu Zheng (6): xcall2.0: prefetch: fix value name typos in __do_sys_epoll_pwait xcall2.0: prefetch: keep prefetch module name same with file name xcall2.0: prefetch: fix memory leak when release prefetch item through mmu notifier xcall2.0: add xcall_subdir_create help to create subdir below /proc/xcall xcall2.0: prefetch: epoll_ctl no need to occupy a file refcount xcall2.0: prefetch: introduce struct prefetch_mm_data arch/arm64/kernel/xcall/proc.c | 10 +- drivers/staging/xcall/prefetch.c | 163 ++++++++++++++++++++----------- include/linux/xcall.h | 1 + 3 files changed, 114 insertions(+), 60 deletions(-) -- 2.34.1

2 7

[PATCH OLK-6.6] mfs: tool: Add mfs user space tool prefetch demo
by Huang Xiaojia 21 Nov '25

21 Nov '25

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/release-management/issues/ID5W1P --------------------------------------- Provide a prefetch demo of mfs tools. When a MISS event is reported, prefetching will be triggered to accelerate latter reading. Files under a directory will all be prefecthed. Signed-off-by: Huang Xiaojia <huangxiaojia2(a)huawei.com> --- tools/mfs/Makefile | 2 +- tools/mfs/mfs_prefetch.cpp | 269 +++++++++++++++++++++++++++++++++++++ 2 files changed, 270 insertions(+), 1 deletion(-) create mode 100644 tools/mfs/mfs_prefetch.cpp diff --git a/tools/mfs/Makefile b/tools/mfs/Makefile index a6e3e970b63e..f99c9cde828f 100644 --- a/tools/mfs/Makefile +++ b/tools/mfs/Makefile @@ -3,7 +3,7 @@ CFLAGS = -Wall -Wextra -PROGS := mfsd +PROGS := mfsd mfsd_prefetch all: $(PROGS) %: %.c diff --git a/tools/mfs/mfs_prefetch.cpp b/tools/mfs/mfs_prefetch.cpp new file mode 100644 index 000000000000..3b1d4c0151ca --- /dev/null +++ b/tools/mfs/mfs_prefetch.cpp @@ -0,0 +1,269 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * User-space demo of mfs + * + * Example use: + * ./mfsd [mfs_mountpoint] + * mfsd.c demostrates how to poll mfs device, read the events, + * parse the events, process the events according to user mode + * and trigger the ioctls mfs supported. + * + * See Documentation/filesystems/mfs.rst + */ + +#include <errno.h> +#include <unistd.h> +#include <fcntl.h> +#include <stdlib.h> +#include <stdio.h> +#include <poll.h> +#include <string.h> +#include <dirent.h> +#include <sys/ioctl.h> +#include <sys/statfs.h> +#include <sys/stat.h> +#include <sys/mman.h> + +#include <map> +#include <string> + +#include "../../include/uapi/linux/mfs.h" +#include "../../include/uapi/linux/magic.h" + +using namespace std; + +#define pr_err(fmt, ...) fprintf(stderr, fmt, ##__VA_ARGS__) + +static int mfs_mode = -1; +static map<string, uint64_t> files; + +struct thread_ctx { + char *path; + uint64_t off; + uint64_t len; +}; + +static int get_files(const char *parent) +{ + DIR *dir; + struct dirent *entry; + string filepath; + struct stat buf; + + if ((dir = opendir(parent)) == NULL) { + perror("opening directory failed"); + return -1; + } + + while ((entry = readdir(dir)) != NULL) { + if (strcmp(entry->d_name, ".") == 0 || strcmp(entry->d_name, "..") == 0) + continue; + + filepath = string(parent) + "/" + string(entry->d_name); + if (stat(filepath.c_str(), &buf) == -1) { + pr_err("stat path:%s failed\n", filepath.c_str()); + continue; + } + if (S_ISDIR(buf.st_mode)) + continue; + files.insert(pair<string, uint64_t>(filepath, buf.st_size)); + } + + return 0; +} + +static void *fault(void *arg) +{ + struct thread_ctx *ctx = (struct thread_ctx *)arg; + int fd = open(ctx->path, O_RDONLY); + if (fd < 0) { + pr_err("open file:%s failed\n", ctx->path); + free(ctx); + return NULL; + } + + void *addr = mmap(NULL, ctx->len, PROT_READ, MAP_SHARED, fd, 0); + uint64_t idx; + char tmp, total, *buffer = (char *)addr; + total = 'B'; + for (idx = 0; idx < ctx->len; idx += 4096) { + tmp = buffer[idx]; + total += tmp; + } + munmap(addr, ctx->len); + close(fd); + free(ctx); + return NULL; +} + +static int process_local_read(struct mfs_msg *msg) +{ + map<string, uint64_t>::iterator it; + struct thread_ctx *ctx; + pthread_t t0; + int ret; + + if (files.empty()) + return 0; + + for (it = files.begin(); it != files.end(); ++it) { + ctx = (struct thread_ctx *)malloc(sizeof(struct thread_ctx)); + if (!ctx) { + perror("malloc ctx failed"); + continue; + } + ctx->path = strdup(it->first.c_str()); + ctx->off = 0; + ctx->len = it->second; + ret = pthread_create(&t0, NULL, fault, ctx); + if (ret == 0) + pthread_detach(t0); + } + files.clear(); + return 0; +} + +static int process_remote_read(struct mfs_msg *msg) +{ + struct mfs_ioc_rpath *rpath; + struct mfs_ioc_done done; + int fd = msg->fd; + int ret; + + rpath = (struct mfs_ioc_rpath *)malloc(sizeof(struct mfs_ioc_rpath) + 1024); + + if (!rpath) { + pr_err("malloc for path failed\n"); + return -1; + } + rpath->max = 1024; + ret = ioctl(fd, MFS_IOC_RPATH, (unsigned long)rpath); + if (ret) { + free(rpath); + perror("ioctl failed"); + return -1; + } + free(rpath); + + done.id = msg->id; + done.ret = 0; + ret = ioctl(fd, MFS_IOC_DONE, (unsigned long)&done); + if (ret) + perror("failed to ioctl MFS_IOC_DONE"); + + return ret; +} + +static int process_read(struct mfs_msg *msg) +{ + int ret; + + if (mfs_mode == MFS_MODE_REMOTE) + ret = process_remote_read(msg); + else if (mfs_mode == MFS_MODE_LOCAL) + ret = process_local_read(msg); + else + ret = -EINVAL; + return ret; +} + +static int process_req(int fd) +{ + char buf[1024]; + struct mfs_msg *msg; + int ret; + + memset(buf, 0, sizeof(buf)); + ret = read(fd, buf, sizeof(buf)); + if (ret <= 0) { + if (ret < 0) + pr_err("read failed, ret:%d\n", ret); + return -1; + } + + msg = (struct mfs_msg *)buf; + if (ret != msg->len) { + pr_err("invalid message length, read:%d, need:%d\n", ret, msg->len); + return -1; + } + if (msg->opcode == MFS_OP_READ || msg->opcode == MFS_OP_FAULT || + msg->opcode == MFS_OP_FAROUND) { + return process_read(msg); + } + pr_err("invalid opcode:%d\n", msg->opcode); + return -1; +} + +static void ioctl_mfs_mode(int fd) +{ + struct mfs_ioc_fsinfo fsinfo = {0}; + int ret; + + ret = ioctl(fd, MFS_IOC_FSINFO, (unsigned long)&fsinfo); + if (ret < 0) { + perror("failed to ioctl mfs_ioc_fsinfo"); + close(fd); + exit(-1); + } + + mfs_mode = fsinfo.mode; +} + +int main(int argc, char *argv[]) +{ + struct pollfd pfd; + struct statfs buf; + char *mountpoint; + char *parent; + char devname[10]; + int fd, ret; + + if (argc != 3) { + printf("./mfsd ${mfs_mountpoint} {data_dir}\n"); + return -1; + } + mountpoint = argv[1]; + parent = argv[2]; + + ret = statfs(mountpoint, &buf); + if (ret) { + pr_err("statfs %s failed\n", mountpoint); + return -1; + } + if (buf.f_type != MFS_SUPER_MAGIC) { + pr_err("fstype(%lx) is invalid, please check the mountpoint\n", buf.f_type); + return -1; + } + + sprintf(devname, "/dev/mfs%ld", buf.f_spare[0]); + fd = open(devname, O_RDWR); + if (fd < 0) { + pr_err("open %s failed\n", devname); + return -1; + } + + ioctl_mfs_mode(fd); + pfd.fd = fd; + pfd.events = POLLIN; + + ret = get_files(parent); + if (ret < 0) + return -1; + + while (1) { + ret = poll(&pfd, 1, -1); + if (ret < 0) { + pr_err("poll failed\n"); + return -1; + } + + if (ret == 0 || !(pfd.revents & POLLIN)) { + pr_err("poll event error, ret:%d, revents:%x\n", ret, pfd.revents); + continue; + } + + if (process_req(fd) == -1) + pr_err("process req failed, errcode:%d\n", errno); + } + return 0; +} -- 2.25.1

2 1

[PATCH OLK-6.6 0/3] cve-2025-40300-r
by Bowen You 21 Nov '25

21 Nov '25

fix cve 2025 40300 Pawan Gupta (3): x86/vmscape: Add conditional IBPB mitigation x86/vmscape: Enumerate VMSCAPE bug x86/vmscape: Enable the mitigation .../ABI/testing/sysfs-devices-system-cpu | 1 + .../admin-guide/kernel-parameters.txt | 11 +++ arch/x86/Kconfig | 8 ++ arch/x86/include/asm/cpufeatures.h | 2 + arch/x86/include/asm/entry-common.h | 7 ++ arch/x86/include/asm/nospec-branch.h | 2 + arch/x86/kernel/cpu/bugs.c | 86 +++++++++++++++++++ arch/x86/kernel/cpu/common.c | 58 +++++++++---- arch/x86/kvm/x86.c | 9 ++ drivers/base/cpu.c | 3 + include/linux/cpu.h | 1 + 11 files changed, 170 insertions(+), 18 deletions(-) -- 2.34.1

2 4

[PATCH OLK-6.6 0/2] Fix CVE-2025-39810 fix CVE-2025-39810
by Zhao Yipeng 21 Nov '25

21 Nov '25

Michael Chan (1): [Backport] bnxt_en: Fix possible crash after creating sw mqprio TCs Sreekanth Reddy (1): [Backport] bnxt_en: Fix memory corruption when FW resources change during ifdown drivers/net/ethernet/broadcom/bnxt/bnxt.c | 34 ++++++++++++++----- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 + drivers/net/ethernet/broadcom/bnxt/bnxt_dcb.c | 2 +- .../net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 4 +-- drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c | 2 +- 5 files changed, 30 insertions(+), 13 deletions(-) -- 2.34.1

2 3