- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 0/9] xsched: XCU Partition
by Zicheng Qu 10 Dec '25

10 Dec '25

Zicheng Qu (9): xsched: refactor CFS per-XCU rq init/deinit paths xsched: fix NULL pointer risk on attach entry allocation xsched: fix concurrent modification NULL pointer dereference in xcu.sched_class xsched: fix hung_task caused by cgroup_file_show and xcg_mutex deadlock xsched: prevent NULL deref by refcounting css and tracking offline state xsched: fix divide-by-zero caused by u64 overflow in CFS shares weight calculation xsched: DEBUG log cleanup xsched: prevent race between enqueue_ctx and xsched_task_free xsched: fix infinite loop caused by invalid CFS group vruntime update include/linux/xsched.h | 40 ++++++- kernel/xsched/cfs.c | 47 +++++--- kernel/xsched/cfs_quota.c | 9 ++ kernel/xsched/cgroup.c | 224 +++++++++++++++++++++----------------- kernel/xsched/core.c | 9 +- kernel/xsched/rt.c | 19 +--- kernel/xsched/vstream.c | 3 + 7 files changed, 210 insertions(+), 141 deletions(-) -- 2.34.1

2 10

[openeuler:OLK-5.10 3399/3399] drivers/net/ethernet/linkdata/sxe/base/log/sxe_log.c:24: warning: Function parameter or member 'buff' not described in 'time_for_file_name'
by kernel test robot 10 Dec '25

10 Dec '25

Hi liujie_answer, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 7579fd89cb4a201d22bd5b78f48df5ce339c0b2d commit: 8cee206b5558245197158bd20895f95cc28d8468 [3399/3399] Ethernet: Linkdata: Supports Linkdata ethernet Controllers config: x86_64-allnoconfig-bpf (https://download.01.org/0day-ci/archive/20251210/202512100859.mEVPzizr-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251210/202512100859.mEVPzizr-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512100859.mEVPzizr-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/net/ethernet/linkdata/sxe/base/log/sxe_log.c:24: warning: Function parameter or member 'buff' not described in 'time_for_file_name' >> drivers/net/ethernet/linkdata/sxe/base/log/sxe_log.c:24: warning: Function parameter or member 'buf_len' not described in 'time_for_file_name' >> drivers/net/ethernet/linkdata/sxe/base/log/sxe_log.c:24: warning: Excess function parameter 'file' description in 'time_for_file_name' >> drivers/net/ethernet/linkdata/sxe/base/log/sxe_log.c:24: warning: Excess function parameter 'author' description in 'time_for_file_name' >> drivers/net/ethernet/linkdata/sxe/base/log/sxe_log.c:24: warning: Excess function parameter 'date' description in 'time_for_file_name' -- >> drivers/net/ethernet/linkdata/sxe/base/trace/sxe_trace.c:21: warning: Excess function parameter 'file' description in 'SXE_FILE_NAME_LEN' >> drivers/net/ethernet/linkdata/sxe/base/trace/sxe_trace.c:21: warning: Excess function parameter 'author' description in 'SXE_FILE_NAME_LEN' >> drivers/net/ethernet/linkdata/sxe/base/trace/sxe_trace.c:21: warning: Excess function parameter 'date' description in 'SXE_FILE_NAME_LEN' -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_csum.c:23: warning: Function parameter or member 'protocol' not described in 'sxe_is_sctp_ipv4' >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_csum.c:23: warning: Function parameter or member 'skb' not described in 'sxe_is_sctp_ipv4' >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_csum.c:23: warning: Excess function parameter 'file' description in 'sxe_is_sctp_ipv4' >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_csum.c:23: warning: Excess function parameter 'author' description in 'sxe_is_sctp_ipv4' >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_csum.c:23: warning: Excess function parameter 'date' description in 'sxe_is_sctp_ipv4' -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_dcb.c:16: warning: Excess function parameter 'file' description in 'SXE_TC_BWG_PERCENT_PER_CHAN' >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_dcb.c:16: warning: Excess function parameter 'author' description in 'SXE_TC_BWG_PERCENT_PER_CHAN' >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_dcb.c:16: warning: Excess function parameter 'date' description in 'SXE_TC_BWG_PERCENT_PER_CHAN' -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_dcb_nl.c:20: warning: Excess function parameter 'file' description in 'BIT_PFC' >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_dcb_nl.c:20: warning: Excess function parameter 'author' description in 'BIT_PFC' >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_dcb_nl.c:20: warning: Excess function parameter 'date' description in 'BIT_PFC' -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_debug.c:18: warning: Excess function parameter 'file' description in 'SKB_DESCRIPTION_LEN' >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_debug.c:18: warning: Excess function parameter 'author' description in 'SKB_DESCRIPTION_LEN' >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_debug.c:18: warning: Excess function parameter 'date' description in 'SKB_DESCRIPTION_LEN' -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_ipsec.c:23: warning: cannot understand function prototype: 'const char ipsec_aes_name[] = "rfc4106(gcm(aes))"; ' -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_host_cli.c:18: warning: cannot understand function prototype: 'dev_t sxe_cdev_major; ' -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_host_hdc.c:27: warning: cannot understand function prototype: 'atomic_t hdc_available = ATOMIC_INIT(1); ' -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_filter.c:24: warning: cannot understand function prototype: 'struct workqueue_struct *sxe_fnav_workqueue; ' -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_monitor.c:24: warning: cannot understand function prototype: 'struct workqueue_struct *sxe_fnav_workqueue; ' .. Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PTP_1588_CLOCK Depends on [n]: NET [=y] && POSIX_TIMERS [=n] Selected by [m]: - SXE [=m] && NETDEVICES [=y] && ETHERNET [=y] && NET_VENDOR_LINKDATA [=y] && (X86 [=y] || ARM64) && PCI [=y] - SXE_VF [=m] && NETDEVICES [=y] && ETHERNET [=y] && NET_VENDOR_LINKDATA [=y] && (X86 [=y] || ARM64) && PCI [=y] vim +24 drivers/net/ethernet/linkdata/sxe/base/log/sxe_log.c 19 20 #if (defined SXE_DRIVER_DEBUG && defined __KERNEL__) || \ 21 (defined SXE_DRIVER_TRACE) 22 23 int time_for_file_name(char *buff, int buf_len) > 24 { 25 #ifdef SXE_LOG_TIME_TO_TM 26 struct timeval tv; 27 struct tm td; 28 29 do_gettimeofday(&tv); 30 time_to_tm(tv.tv_sec, -sys_tz.tz_minuteswest * 60, &td); 31 #else 32 struct timespec64 tv; 33 struct tm td; 34 35 ktime_get_real_ts64(&tv); 36 time64_to_tm(tv.tv_sec, -sys_tz.tz_minuteswest * 60, &td); 37 #endif 38 return snprintf(buff, buf_len, "%04ld-%02d-%02d_%02d:%02d:%02d", 39 td.tm_year + 1900, td.tm_mon + 1, td.tm_mday, 40 td.tm_hour, td.tm_min, td.tm_sec); 41 } 42 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process()
by Li Lingfeng 10 Dec '25

10 Dec '25

From: Tomas Henzl <thenzl(a)redhat.com> stable inclusion from stable-v4.19.276 commit 9e5c7d52085b8c84bc82a261580f0eb170039325 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IDBMX7 CVE: CVE-2023-53803 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 9b4f5028e493cb353a5c8f5c45073eeea0303abd upstream. A fix for: BUG: KASAN: slab-out-of-bounds in ses_enclosure_data_process+0x949/0xe30 [ses] Read of size 1 at addr ffff88a1b043a451 by task systemd-udevd/3271 Checking after (and before in next loop) addl_desc_ptr[1] is sufficient, we expect the size to be sanitized before first access to addl_desc_ptr[1]. Make sure we don't walk beyond end of page. Link: https://lore.kernel.org/r/20230202162451.15346-2-thenzl@redhat.com Cc: stable(a)vger.kernel.org Signed-off-by: Tomas Henzl <thenzl(a)redhat.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/scsi/ses.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c index b42c0bb8caa9..3a0cb1fa6767 100644 --- a/drivers/scsi/ses.c +++ b/drivers/scsi/ses.c @@ -625,9 +625,11 @@ static void ses_enclosure_data_process(struct enclosure_device *edev, /* these elements are optional */ type_ptr[0] == ENCLOSURE_COMPONENT_SCSI_TARGET_PORT || type_ptr[0] == ENCLOSURE_COMPONENT_SCSI_INITIATOR_PORT || - type_ptr[0] == ENCLOSURE_COMPONENT_CONTROLLER_ELECTRONICS)) + type_ptr[0] == ENCLOSURE_COMPONENT_CONTROLLER_ELECTRONICS)) { addl_desc_ptr += addl_desc_ptr[1] + 2; - + if (addl_desc_ptr + 1 >= ses_dev->page10 + ses_dev->page10_len) + addl_desc_ptr = NULL; + } } } kfree(buf); -- 2.31.1

2 1

[PATCH OLK-6.6 0/2] Handling Kunpeng Chip ARM Spectre-BHB (CVE-2022-23960) Issue
by Jinqian Yang 10 Dec '25

10 Dec '25

Previously, the mitigation for HIP09 had been incorporated into 6.6. Now, the mitigation for TSV100 is being incorporated into 6.6. And non-privileged eBPF is disabled by default. In addition, the GRUB in the distribution needs to include 'nospectre-bhb'. Jinqian Yang (2): arm64: Add support for TSV110 Spectre-BHB mitigation config: Disable unprivileged BPF syscall by default arch/arm64/configs/openeuler_defconfig | 2 +- arch/arm64/kernel/proton-pack.c | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) -- 2.33.0

2 3

[openeuler:OLK-6.6 3508/3508] mm/memblock.c:1409:20: warning: no previous prototype for 'memblock_alloc_range_nid_flags'
by kernel test robot 10 Dec '25

10 Dec '25

Hi Ma, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: d7d7f131569485a9b6737b85cd8144196135b1a1 commit: 64018b291c1f49622c4b23b303364d760306d662 [3508/3508] mm/memblock: Introduce ability to alloc memory from specify memory region config: x86_64-allnoconfig-bpf (https://download.01.org/0day-ci/archive/20251210/202512100803.QFVpHYI3-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251210/202512100803.QFVpHYI3-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512100803.QFVpHYI3-lkp@intel.com/ All warnings (new ones prefixed by >>): >> mm/memblock.c:1409:20: warning: no previous prototype for 'memblock_alloc_range_nid_flags' [-Wmissing-prototypes] 1409 | phys_addr_t __init memblock_alloc_range_nid_flags(phys_addr_t size, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +/memblock_alloc_range_nid_flags +1409 mm/memblock.c 1386 1387 /** 1388 * memblock_alloc_range_nid_flags - allocate boot memory block with specify flag 1389 * @size: size of memory block to be allocated in bytes 1390 * @align: alignment of the region and block's size 1391 * @start: the lower bound of the memory region to allocate (phys address) 1392 * @end: the upper bound of the memory region to allocate (phys address) 1393 * @nid: nid of the free area to find, %NUMA_NO_NODE for any node 1394 * @exact_nid: control the allocation fall back to other nodes 1395 * @flags: alloc memory from specify memblock flag 1396 * 1397 * The allocation is performed from memory region limited by 1398 * memblock.current_limit if @end == %MEMBLOCK_ALLOC_ACCESSIBLE. 1399 * 1400 * If the specified node can not hold the requested memory and @exact_nid 1401 * is false, the allocation falls back to any node in the system. 1402 * 1403 * In addition, function sets the min_count to 0 using kmemleak_alloc_phys for 1404 * allocated boot memory block, so that it is never reported as leaks. 1405 * 1406 * Return: 1407 * Physical address of allocated memory block on success, %0 on failure. 1408 */ > 1409 phys_addr_t __init memblock_alloc_range_nid_flags(phys_addr_t size, 1410 phys_addr_t align, phys_addr_t start, 1411 phys_addr_t end, int nid, 1412 bool exact_nid, 1413 enum memblock_flags flags) 1414 { 1415 phys_addr_t found; 1416 1417 if (WARN_ONCE(nid == MAX_NUMNODES, "Usage of MAX_NUMNODES is deprecated. Use NUMA_NO_NODE instead\n")) 1418 nid = NUMA_NO_NODE; 1419 1420 if (!align) { 1421 /* Can't use WARNs this early in boot on powerpc */ 1422 dump_stack(); 1423 align = SMP_CACHE_BYTES; 1424 } 1425 1426 again: 1427 found = memblock_find_in_range_node(size, align, start, end, nid, 1428 flags); 1429 if (found && !memblock_reserve(found, size)) 1430 goto done; 1431 1432 if (nid != NUMA_NO_NODE && !exact_nid) { 1433 found = memblock_find_in_range_node(size, align, start, 1434 end, NUMA_NO_NODE, 1435 flags); 1436 if (found && !memblock_reserve(found, size)) 1437 goto done; 1438 } 1439 1440 if (flags & MEMBLOCK_MIRROR) { 1441 flags &= ~MEMBLOCK_MIRROR; 1442 pr_warn_ratelimited("Could not allocate %pap bytes of mirrored memory\n", 1443 &size); 1444 goto again; 1445 } 1446 1447 return 0; 1448 1449 done: 1450 /* 1451 * Skip kmemleak for those places like kasan_init() and 1452 * early_pgtable_alloc() due to high volume. 1453 */ 1454 if (end != MEMBLOCK_ALLOC_NOLEAKTRACE) 1455 /* 1456 * Memblock allocated blocks are never reported as 1457 * leaks. This is because many of these blocks are 1458 * only referred via the physical address which is 1459 * not looked up by kmemleak. 1460 */ 1461 kmemleak_alloc_phys(found, size, 0); 1462 1463 /* 1464 * Some Virtual Machine platforms, such as Intel TDX or AMD SEV-SNP, 1465 * require memory to be accepted before it can be used by the 1466 * guest. 1467 * 1468 * Accept the memory of the allocated buffer. 1469 */ 1470 accept_memory(found, found + size); 1471 1472 return found; 1473 } 1474 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3508/3508] arch/arm64/kvm/virtcca_cvm.c:992:5: warning: no previous prototype for 'kvm_cvm_vgic_nr_lr'
by kernel test robot 10 Dec '25

10 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: d7d7f131569485a9b6737b85cd8144196135b1a1 commit: befbde867291b5bb068a97b17086ad20484b6068 [3508/3508] VirtCCA: Adapt virtcca operations by cca_base. config: arm64-randconfig-r112-20251210 (https://download.01.org/0day-ci/archive/20251210/202512101452.vWsWIlEF-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.4.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251210/202512101452.vWsWIlEF-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512101452.vWsWIlEF-lkp@intel.com/ All warnings (new ones prefixed by >>): arch/arm64/kvm/virtcca_cvm.c:825:5: warning: no previous prototype for 'virtcca_get_tmi_version' [-Wmissing-prototypes] 825 | u64 virtcca_get_tmi_version(void) | ^~~~~~~~~~~~~~~~~~~~~~~ arch/arm64/kvm/virtcca_cvm.c: In function 'kvm_load_user_data': arch/arm64/kvm/virtcca_cvm.c:885:35: error: 'struct kvm_user_data' has no member named 'data_start' 885 | (user_data.data_start + user_data.data_size < user_data.data_start)) | ^ arch/arm64/kvm/virtcca_cvm.c:885:59: error: 'struct kvm_user_data' has no member named 'data_size'; did you mean 'ram_size'? 885 | (user_data.data_start + user_data.data_size < user_data.data_start)) | ^~~~~~~~~ | ram_size arch/arm64/kvm/virtcca_cvm.c:885:80: error: 'struct kvm_user_data' has no member named 'data_start' 885 | (user_data.data_start + user_data.data_size < user_data.data_start)) | ^ arch/arm64/kvm/virtcca_cvm.c:888:58: error: 'struct kvm_user_data' has no member named 'dtb_info' 888 | if (is_dtb_info_has_extend_data(user_data.dtb_info)) { | ^ arch/arm64/kvm/virtcca_cvm.c:890:38: error: 'struct kvm_user_data' has no member named 'data_start' 890 | if (user_data.data_start + user_data.data_size > ipa_end) | ^ arch/arm64/kvm/virtcca_cvm.c:890:62: error: 'struct kvm_user_data' has no member named 'data_size'; did you mean 'ram_size'? 890 | if (user_data.data_start + user_data.data_size > ipa_end) | ^~~~~~~~~ | ram_size arch/arm64/kvm/virtcca_cvm.c:897:38: error: 'struct kvm_user_data' has no member named 'data_start' 897 | if (user_data.data_start + user_data.data_size > user_data.loader_start) | ^ arch/arm64/kvm/virtcca_cvm.c:897:62: error: 'struct kvm_user_data' has no member named 'data_size'; did you mean 'ram_size'? 897 | if (user_data.data_start + user_data.data_size > user_data.loader_start) | ^~~~~~~~~ | ram_size arch/arm64/kvm/virtcca_cvm.c:907:50: error: 'struct kvm_user_data' has no member named 'dtb_info' 907 | if (is_dtb_info_has_extend_data(user_data.dtb_info)) | ^ arch/arm64/kvm/virtcca_cvm.c:908:41: error: 'struct kvm_user_data' has no member named 'data_start' 908 | cvm->dtb_end = user_data.data_start + user_data.data_size; | ^ arch/arm64/kvm/virtcca_cvm.c:908:65: error: 'struct kvm_user_data' has no member named 'data_size'; did you mean 'ram_size'? 908 | cvm->dtb_end = user_data.data_start + user_data.data_size; | ^~~~~~~~~ | ram_size arch/arm64/kvm/virtcca_cvm.c:910:66: error: 'struct kvm_user_data' has no member named 'dtb_info' 910 | cvm->dtb_end = user_data.loader_start + user_data.dtb_info; | ^ arch/arm64/kvm/virtcca_cvm.c:911:44: error: 'struct kvm_user_data' has no member named 'data_start' 911 | cvm->mmio_start = user_data.data_start; | ^ arch/arm64/kvm/virtcca_cvm.c:912:42: error: 'struct kvm_user_data' has no member named 'data_start' 912 | cvm->mmio_end = user_data.data_start + user_data.data_size; | ^ arch/arm64/kvm/virtcca_cvm.c:912:66: error: 'struct kvm_user_data' has no member named 'data_size'; did you mean 'ram_size'? 912 | cvm->mmio_end = user_data.data_start + user_data.data_size; | ^~~~~~~~~ | ram_size arch/arm64/kvm/virtcca_cvm.c: At top level: >> arch/arm64/kvm/virtcca_cvm.c:992:5: warning: no previous prototype for 'kvm_cvm_vgic_nr_lr' [-Wmissing-prototypes] 992 | u32 kvm_cvm_vgic_nr_lr(void) | ^~~~~~~~~~~~~~~~~~ Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for HALTPOLL_CPUIDLE Depends on [n]: CPU_IDLE [=n] && ARCH_CPUIDLE_HALTPOLL [=y] && ARCH_HAS_OPTIMIZED_POLL [=y] Selected by [y]: - ARM64 [=y] vim +/kvm_cvm_vgic_nr_lr +992 arch/arm64/kvm/virtcca_cvm.c 991 > 992 u32 kvm_cvm_vgic_nr_lr(void) 993 { 994 return kvm_vgic_global_state.nr_lr; 995 } 996 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] NFSD: Fix crash in nfsd4_read_release()
by Li Lingfeng 10 Dec '25

10 Dec '25

From: Chuck Lever <chuck.lever(a)oracle.com> mainline inclusion from mainline-v6.18-rc4 commit abb1f08a2121dd270193746e43b2a9373db9ad84 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IDBAJB CVE: CVE-2025-40324 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When tracing is enabled, the trace_nfsd_read_done trace point crashes during the pynfs read.testNoFh test. Fixes: 15a8b55dbb1b ("nfsd: call op_release, even when op_func returns an error") Cc: stable(a)vger.kernel.org Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Conflicts: fs/nfsd/nfs4proc.c [Commit 5c4583b2b78e ("nfsd: hook up nfs4_preprocess_stateid_op to the nfsd_file cache") replace rd_filp by rd_nf.] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfsd/nfs4proc.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c index 1c3e6de6bcba..ea3db7d8b567 100644 --- a/fs/nfsd/nfs4proc.c +++ b/fs/nfsd/nfs4proc.c @@ -796,10 +796,11 @@ nfsd4_read(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, static void nfsd4_read_release(union nfsd4_op_u *u) { - if (u->read.rd_filp) + if (u->read.rd_filp) { + trace_nfsd_read_done(u->read.rd_rqstp, u->read.rd_fhp, + u->read.rd_offset, u->read.rd_length); fput(u->read.rd_filp); - trace_nfsd_read_done(u->read.rd_rqstp, u->read.rd_fhp, - u->read.rd_offset, u->read.rd_length); + } } static __be32 -- 2.31.1

2 1

[PATCH OLK-5.10] NFSD: Fix crash in nfsd4_read_release()
by Li Lingfeng 10 Dec '25

10 Dec '25

From: Chuck Lever <chuck.lever(a)oracle.com> stable inclusion from stable-v5.10.247 commit 930cb4fe3ab4061be31f20ee30bb72a66f7bb6d1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IDBAJB CVE: CVE-2025-40324 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit abb1f08a2121dd270193746e43b2a9373db9ad84 upstream. When tracing is enabled, the trace_nfsd_read_done trace point crashes during the pynfs read.testNoFh test. Fixes: 15a8b55dbb1b ("nfsd: call op_release, even when op_func returns an error") Cc: stable(a)vger.kernel.org Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfsd/nfs4proc.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c index 96c4e2616b51..61c87c54cd7b 100644 --- a/fs/nfsd/nfs4proc.c +++ b/fs/nfsd/nfs4proc.c @@ -812,10 +812,11 @@ nfsd4_read(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, static void nfsd4_read_release(union nfsd4_op_u *u) { - if (u->read.rd_nf) + if (u->read.rd_nf) { + trace_nfsd_read_done(u->read.rd_rqstp, u->read.rd_fhp, + u->read.rd_offset, u->read.rd_length); nfsd_file_put(u->read.rd_nf); - trace_nfsd_read_done(u->read.rd_rqstp, u->read.rd_fhp, - u->read.rd_offset, u->read.rd_length); + } } static __be32 -- 2.46.1

2 1

[PATCH OLK-6.6] NFSD: Fix crash in nfsd4_read_release()
by Li Lingfeng 10 Dec '25

10 Dec '25

From: Chuck Lever <chuck.lever(a)oracle.com> stable inclusion from stable-v6.6.117 commit 03524ccff698d4a77d096ed529073d91f5edee5d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IDBAJB CVE: CVE-2025-40324 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit abb1f08a2121dd270193746e43b2a9373db9ad84 upstream. When tracing is enabled, the trace_nfsd_read_done trace point crashes during the pynfs read.testNoFh test. Fixes: 15a8b55dbb1b ("nfsd: call op_release, even when op_func returns an error") Cc: stable(a)vger.kernel.org Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfsd/nfs4proc.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c index b2bbf3d6d177..04a2c44e0f95 100644 --- a/fs/nfsd/nfs4proc.c +++ b/fs/nfsd/nfs4proc.c @@ -978,10 +978,11 @@ nfsd4_read(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, static void nfsd4_read_release(union nfsd4_op_u *u) { - if (u->read.rd_nf) + if (u->read.rd_nf) { + trace_nfsd_read_done(u->read.rd_rqstp, u->read.rd_fhp, + u->read.rd_offset, u->read.rd_length); nfsd_file_put(u->read.rd_nf); - trace_nfsd_read_done(u->read.rd_rqstp, u->read.rd_fhp, - u->read.rd_offset, u->read.rd_length); + } } static __be32 -- 2.46.1

2 1

[PATCH OLK-6.6 0/8] xsched: XCU Partition
by Zicheng Qu 10 Dec '25

10 Dec '25

Zicheng Qu (8): xsched: refactor CFS per-XCU rq init/deinit paths xsched: fix NULL pointer risk on attach entry allocation xsched: fix concurrent modification NULL pointer dereference in xcu.sched_class xsched: fix hung_task caused by cgroup_file_show and xcg_mutex deadlock xsched: prevent NULL deref by refcounting css and tracking offline state xsched: fix divide-by-zero caused by u64 overflow in CFS shares weight calculation xsched: DEBUG log cleanup xsched: prevent race between enqueue_ctx and xsched_task_free include/linux/xsched.h | 36 +++++- kernel/xsched/cfs.c | 31 +++++- kernel/xsched/cfs_quota.c | 9 ++ kernel/xsched/cgroup.c | 224 +++++++++++++++++++++----------------- kernel/xsched/core.c | 9 +- kernel/xsched/rt.c | 19 +--- kernel/xsched/vstream.c | 3 + 7 files changed, 200 insertions(+), 131 deletions(-) -- 2.34.1

2 9