- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] cnic: Fix use-after-free bugs in cnic_delete_task
by Yao Kai 30 Oct '25

30 Oct '25

From: Duoming Zhou <duoming(a)zju.edu.cn> stable inclusion from stable-v6.6.108 commit 8eeb2091e72d75df8ceaa2172638d61b4cf8929a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID0U8X CVE: CVE-2025-39945 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit cfa7d9b1e3a8604afc84e9e51d789c29574fb216 ] The original code uses cancel_delayed_work() in cnic_cm_stop_bnx2x_hw(), which does not guarantee that the delayed work item 'delete_task' has fully completed if it was already running. Additionally, the delayed work item is cyclic, the flush_workqueue() in cnic_cm_stop_bnx2x_hw() only blocks and waits for work items that were already queued to the workqueue prior to its invocation. Any work items submitted after flush_workqueue() is called are not included in the set of tasks that the flush operation awaits. This means that after the cyclic work items have finished executing, a delayed work item may still exist in the workqueue. This leads to use-after-free scenarios where the cnic_dev is deallocated by cnic_free_dev(), while delete_task remains active and attempt to dereference cnic_dev in cnic_delete_task(). A typical race condition is illustrated below: CPU 0 (cleanup) | CPU 1 (delayed work callback) cnic_netdev_event() | cnic_stop_hw() | cnic_delete_task() cnic_cm_stop_bnx2x_hw() | ... cancel_delayed_work() | /* the queue_delayed_work() flush_workqueue() | executes after flush_workqueue()*/ | queue_delayed_work() cnic_free_dev(dev)//free | cnic_delete_task() //new instance | dev = cp->dev; //use Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure that the cyclic delayed work item is properly canceled and that any ongoing execution of the work item completes before the cnic_dev is deallocated. Furthermore, since cancel_delayed_work_sync() uses __flush_work(work, true) to synchronously wait for any currently executing instance of the work item to finish, the flush_workqueue() becomes redundant and should be removed. This bug was identified through static analysis. To reproduce the issue and validate the fix, I simulated the cnic PCI device in QEMU and introduced intentional delays — such as inserting calls to ssleep() within the cnic_delete_task() function — to increase the likelihood of triggering the bug. Fixes: fdf24086f475 ("cnic: Defer iscsi connection cleanup") Signed-off-by: Duoming Zhou <duoming(a)zju.edu.cn> Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yao Kai <yaokai34(a)huawei.com> --- drivers/net/ethernet/broadcom/cnic.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/net/ethernet/broadcom/cnic.c b/drivers/net/ethernet/broadcom/cnic.c index 7926aaef8f0c..ad2745c07c1a 100644 --- a/drivers/net/ethernet/broadcom/cnic.c +++ b/drivers/net/ethernet/broadcom/cnic.c @@ -4220,8 +4220,7 @@ static void cnic_cm_stop_bnx2x_hw(struct cnic_dev *dev) cnic_bnx2x_delete_wait(dev, 0); - cancel_delayed_work(&cp->delete_task); - flush_workqueue(cnic_wq); + cancel_delayed_work_sync(&cp->delete_task); if (atomic_read(&cp->iscsi_conn) != 0) netdev_warn(dev->netdev, "%d iSCSI connections not destroyed\n", -- 2.43.0

2 9

[PATCH openEuler-1.0-LTS] PCI/sysfs: Prohibit unaligned access to I/O port on non-x86
by Ziming Du 30 Oct '25

30 Oct '25

From: Yongqiang Liu <liuyongqiang13(a)huawei.com> hulk inclusion category: bugfix bugzilla: 190753 -------------------------------- Unaligned access is harmful for non-x86 archs such as arm64. When we use pwrite or pread to access the I/O port resources with unaligned offset, system will crash as follows: Unable to handle kernel paging request at virtual address fffffbfffe8010c1 Internal error: Oops: 0000000096000061 [#1] SMP Modules linked in: CPU: 1 PID: 44230 Comm: syz.1.10955 Not tainted 6.6.0+ #1 Hardware name: linux,dummy-virt (DT) pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __raw_writew arch/arm64/include/asm/io.h:33 [inline] pc : _outw include/asm-generic/io.h:594 [inline] pc : logic_outw+0x54/0x218 lib/logic_pio.c:305 lr : _outw include/asm-generic/io.h:593 [inline] lr : logic_outw+0x40/0x218 lib/logic_pio.c:305 sp : ffff800083097a30 x29: ffff800083097a30 x28: ffffba71ba86e130 x27: 1ffff00010612f93 x26: ffff3bae63b3a420 x25: ffffba71bbf585d0 x24: 0000000000005ac1 x23: 00000000000010c1 x22: ffff3baf0deb6488 x21: 0000000000000002 x20: 00000000000010c1 x19: 0000000000ffbffe x18: 0000000000000000 x17: 0000000000000000 x16: ffffba71b9f44b48 x15: 00000000200002c0 x14: 0000000000000000 x13: 0000000000000000 x12: ffff6775ca80451f x11: 1fffe775ca80451e x10: ffff6775ca80451e x9 : ffffba71bb78cf2c x8 : 0000988a357fbae2 x7 : ffff3bae540228f7 x6 : 0000000000000001 x5 : 1fffe775e2b43c78 x4 : dfff800000000000 x3 : ffffba71b9a00000 x2 : ffff80008d22a000 x1 : ffffc58ec6600000 x0 : fffffbfffe8010c1 Call trace: _outw include/asm-generic/io.h:594 [inline] logic_outw+0x54/0x218 lib/logic_pio.c:305 pci_resource_io drivers/pci/pci-sysfs.c:1157 [inline] pci_write_resource_io drivers/pci/pci-sysfs.c:1191 [inline] pci_write_resource_io+0x208/0x260 drivers/pci/pci-sysfs.c:1181 sysfs_kf_bin_write+0x188/0x210 fs/sysfs/file.c:158 kernfs_fop_write_iter+0x2e8/0x4b0 fs/kernfs/file.c:338 call_write_iter include/linux/fs.h:2085 [inline] new_sync_write fs/read_write.c:493 [inline] vfs_write+0x7bc/0xac8 fs/read_write.c:586 ksys_write+0x12c/0x270 fs/read_write.c:639 __do_sys_write fs/read_write.c:651 [inline] __se_sys_write fs/read_write.c:648 [inline] __arm64_sys_write+0x78/0xb8 fs/read_write.c:648 __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline] invoke_syscall+0x8c/0x2e0 arch/arm64/kernel/syscall.c:51 el0_svc_common.constprop.0+0x200/0x2a8 arch/arm64/kernel/syscall.c:134 do_el0_svc+0x4c/0x70 arch/arm64/kernel/syscall.c:176 el0_svc+0x44/0x1d8 arch/arm64/kernel/entry-common.c:806 el0t_64_sync_handler+0x100/0x130 arch/arm64/kernel/entry-common.c:844 el0t_64_sync+0x3c8/0x3d0 arch/arm64/kernel/entry.S:757 Powerpc seems affected as well, so prohibit the unaligned access on non-x86 archs. Fixes: 8633328be242 ("PCI: Allow read/write access to sysfs I/O port resources") Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> Signed-off-by: Ziming Du <duziming2(a)huawei.com> --- drivers/pci/pci-sysfs.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c index 48c56cb086524..e8c3a1b7d4a93 100644 --- a/drivers/pci/pci-sysfs.c +++ b/drivers/pci/pci-sysfs.c @@ -1204,6 +1204,13 @@ static int pci_mmap_resource_wc(struct file *filp, struct kobject *kobj, return pci_mmap_resource(kobj, attr, vma, 1); } +#if !defined(CONFIG_X86) +static bool is_unaligned(unsigned long port, size_t size) +{ + return port & (size - 1); +} +#endif + static ssize_t pci_resource_io(struct file *filp, struct kobject *kobj, struct bin_attribute *attr, char *buf, loff_t off, size_t count, bool write) @@ -1220,6 +1227,11 @@ static ssize_t pci_resource_io(struct file *filp, struct kobject *kobj, if (port + count - 1 > pci_resource_end(pdev, bar)) return -EINVAL; +#if !defined(CONFIG_X86) + if (is_unaligned(port, count)) + return -EFAULT; +#endif + switch (count) { case 1: if (write) -- 2.43.0

2 1

[openeuler:OLK-5.10 3257/3257] mm/mem_reliable.c:214:52: sparse: sparse: incorrect type in argument 3 (different address spaces)
by kernel test robot 30 Oct '25

30 Oct '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 13f149450a6b4609c03a79beee0859dfe43ca949 commit: 714b582e1796fefd9d81f83fdc12a56390af1a99 [3257/3257] mm: Enable reliable memory for x86 platform config: x86_64-randconfig-121-20251030 (https://download.01.org/0day-ci/archive/20251030/202510301407.l2kqHqRB-lkp@…) compiler: gcc-12 (Debian 12.4.0-5) 12.4.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251030/202510301407.l2kqHqRB-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202510301407.l2kqHqRB-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> mm/mem_reliable.c:214:52: sparse: sparse: incorrect type in argument 3 (different address spaces) @@ expected void * @@ got void [noderef] __user *buffer @@ mm/mem_reliable.c:214:52: sparse: expected void * mm/mem_reliable.c:214:52: sparse: got void [noderef] __user *buffer mm/mem_reliable.c:234:52: sparse: sparse: incorrect type in argument 3 (different address spaces) @@ expected void * @@ got void [noderef] __user *buffer @@ mm/mem_reliable.c:234:52: sparse: expected void * mm/mem_reliable.c:234:52: sparse: got void [noderef] __user *buffer mm/mem_reliable.c:298:52: sparse: sparse: incorrect type in argument 3 (different address spaces) @@ expected void * @@ got void [noderef] __user *buffer @@ mm/mem_reliable.c:298:52: sparse: expected void * mm/mem_reliable.c:298:52: sparse: got void [noderef] __user *buffer mm/mem_reliable.c:332:52: sparse: sparse: incorrect type in argument 3 (different address spaces) @@ expected void * @@ got void [noderef] __user *buffer @@ mm/mem_reliable.c:332:52: sparse: expected void * mm/mem_reliable.c:332:52: sparse: got void [noderef] __user *buffer >> mm/mem_reliable.c:352:33: sparse: sparse: incorrect type in initializer (incompatible argument 3 (different address spaces)) @@ expected int ( [usertype] *proc_handler )( ... ) @@ got int ( * )( ... ) @@ mm/mem_reliable.c:352:33: sparse: expected int ( [usertype] *proc_handler )( ... ) mm/mem_reliable.c:352:33: sparse: got int ( * )( ... ) mm/mem_reliable.c:359:33: sparse: sparse: incorrect type in initializer (incompatible argument 3 (different address spaces)) @@ expected int ( [usertype] *proc_handler )( ... ) @@ got int ( * )( ... ) @@ mm/mem_reliable.c:359:33: sparse: expected int ( [usertype] *proc_handler )( ... ) mm/mem_reliable.c:359:33: sparse: got int ( * )( ... ) mm/mem_reliable.c:367:33: sparse: sparse: incorrect type in initializer (incompatible argument 3 (different address spaces)) @@ expected int ( [usertype] *proc_handler )( ... ) @@ got int ( * )( ... ) @@ mm/mem_reliable.c:367:33: sparse: expected int ( [usertype] *proc_handler )( ... ) mm/mem_reliable.c:367:33: sparse: got int ( * )( ... ) mm/mem_reliable.c:375:33: sparse: sparse: incorrect type in initializer (incompatible argument 3 (different address spaces)) @@ expected int ( [usertype] *proc_handler )( ... ) @@ got int ( * )( ... ) @@ mm/mem_reliable.c:375:33: sparse: expected int ( [usertype] *proc_handler )( ... ) mm/mem_reliable.c:375:33: sparse: got int ( * )( ... ) vim +214 mm/mem_reliable.c 6e6cf0d7d67425 Chen Wandun 2022-11-11 205 2525d04c630800 Ma Wupeng 2022-11-11 206 #ifdef CONFIG_SYSCTL 8968270eb5fbed Ma Wupeng 2022-11-11 207 static int reliable_limit_handler(struct ctl_table *table, int write, 8968270eb5fbed Ma Wupeng 2022-11-11 208 void __user *buffer, size_t *length, 8968270eb5fbed Ma Wupeng 2022-11-11 209 loff_t *ppos) 8968270eb5fbed Ma Wupeng 2022-11-11 210 { 8968270eb5fbed Ma Wupeng 2022-11-11 211 unsigned long old = task_reliable_limit; 8968270eb5fbed Ma Wupeng 2022-11-11 212 int ret; 8968270eb5fbed Ma Wupeng 2022-11-11 213 8968270eb5fbed Ma Wupeng 2022-11-11 @214 ret = proc_doulongvec_minmax(table, write, buffer, length, ppos); 8968270eb5fbed Ma Wupeng 2022-11-11 215 if (ret == 0 && write) { 8968270eb5fbed Ma Wupeng 2022-11-11 216 if (task_reliable_limit > PAGES_TO_B(total_reliable_pages()) || 8968270eb5fbed Ma Wupeng 2022-11-11 217 task_reliable_limit < 8968270eb5fbed Ma Wupeng 2022-11-11 218 (task_reliable_used_pages() << PAGE_SHIFT)) { 8968270eb5fbed Ma Wupeng 2022-11-11 219 task_reliable_limit = old; 8968270eb5fbed Ma Wupeng 2022-11-11 220 return -EINVAL; 8968270eb5fbed Ma Wupeng 2022-11-11 221 } 8968270eb5fbed Ma Wupeng 2022-11-11 222 } 8968270eb5fbed Ma Wupeng 2022-11-11 223 8968270eb5fbed Ma Wupeng 2022-11-11 224 return ret; 8968270eb5fbed Ma Wupeng 2022-11-11 225 } 8968270eb5fbed Ma Wupeng 2022-11-11 226 4021a0d53e3e0d Chen Wandun 2022-11-11 227 static int reliable_pagecache_max_bytes_write(struct ctl_table *table, 4021a0d53e3e0d Chen Wandun 2022-11-11 228 int write, void __user *buffer, 4021a0d53e3e0d Chen Wandun 2022-11-11 229 size_t *length, loff_t *ppos) 4021a0d53e3e0d Chen Wandun 2022-11-11 230 { 4021a0d53e3e0d Chen Wandun 2022-11-11 231 unsigned long old_value = reliable_pagecache_max_bytes; 4021a0d53e3e0d Chen Wandun 2022-11-11 232 int ret; 4021a0d53e3e0d Chen Wandun 2022-11-11 233 4021a0d53e3e0d Chen Wandun 2022-11-11 234 ret = proc_doulongvec_minmax(table, write, buffer, length, ppos); 4021a0d53e3e0d Chen Wandun 2022-11-11 235 if (!ret && write) { 4021a0d53e3e0d Chen Wandun 2022-11-11 236 if (reliable_pagecache_max_bytes > 4021a0d53e3e0d Chen Wandun 2022-11-11 237 PAGES_TO_B(total_reliable_pages())) { 4021a0d53e3e0d Chen Wandun 2022-11-11 238 reliable_pagecache_max_bytes = old_value; 4021a0d53e3e0d Chen Wandun 2022-11-11 239 return -EINVAL; 4021a0d53e3e0d Chen Wandun 2022-11-11 240 } 4021a0d53e3e0d Chen Wandun 2022-11-11 241 } 4021a0d53e3e0d Chen Wandun 2022-11-11 242 4021a0d53e3e0d Chen Wandun 2022-11-11 243 return ret; 4021a0d53e3e0d Chen Wandun 2022-11-11 244 } 4021a0d53e3e0d Chen Wandun 2022-11-11 245 2525d04c630800 Ma Wupeng 2022-11-11 246 static void mem_reliable_feature_disable(int idx); 2525d04c630800 Ma Wupeng 2022-11-11 247 2525d04c630800 Ma Wupeng 2022-11-11 248 #define CTRL_BITS_SHIFT MEM_RELIABLE_MAX 2525d04c630800 Ma Wupeng 2022-11-11 249 #define CTRL_BITS_MASK ((1 << CTRL_BITS_SHIFT) - 1) 2525d04c630800 Ma Wupeng 2022-11-11 250 2525d04c630800 Ma Wupeng 2022-11-11 251 static unsigned long mem_reliable_ctrl_bits = CTRL_BITS_MASK; 2525d04c630800 Ma Wupeng 2022-11-11 252 2525d04c630800 Ma Wupeng 2022-11-11 253 static void mem_reliable_ctrl_bit_disable(int idx) 2525d04c630800 Ma Wupeng 2022-11-11 254 { 2525d04c630800 Ma Wupeng 2022-11-11 255 clear_bit(idx, &mem_reliable_ctrl_bits); 2525d04c630800 Ma Wupeng 2022-11-11 256 } 2525d04c630800 Ma Wupeng 2022-11-11 257 2525d04c630800 Ma Wupeng 2022-11-11 258 static bool mem_reliable_ctrl_bit_is_enabled(int idx) 2525d04c630800 Ma Wupeng 2022-11-11 259 { 2525d04c630800 Ma Wupeng 2022-11-11 260 return !!test_bit(idx, &mem_reliable_ctrl_bits); 2525d04c630800 Ma Wupeng 2022-11-11 261 } 2525d04c630800 Ma Wupeng 2022-11-11 262 2525d04c630800 Ma Wupeng 2022-11-11 263 static void mem_reliable_parse_ctrl_bits(unsigned long ctrl_bits) 2525d04c630800 Ma Wupeng 2022-11-11 264 { 2525d04c630800 Ma Wupeng 2022-11-11 265 bool status; 2525d04c630800 Ma Wupeng 2022-11-11 266 int i; 2525d04c630800 Ma Wupeng 2022-11-11 267 2525d04c630800 Ma Wupeng 2022-11-11 268 for (i = MEM_RELIABLE_FALLBACK; i < MEM_RELIABLE_MAX; i++) { 2525d04c630800 Ma Wupeng 2022-11-11 269 status = !!test_bit(i, &ctrl_bits); 2525d04c630800 Ma Wupeng 2022-11-11 270 2525d04c630800 Ma Wupeng 2022-11-11 271 if (mem_reliable_ctrl_bit_is_enabled(i) && !status) 2525d04c630800 Ma Wupeng 2022-11-11 272 mem_reliable_feature_disable(i); 2525d04c630800 Ma Wupeng 2022-11-11 273 } 2525d04c630800 Ma Wupeng 2022-11-11 274 } 2525d04c630800 Ma Wupeng 2022-11-11 275 2525d04c630800 Ma Wupeng 2022-11-11 276 static void mem_reliable_disable_all(void) 2525d04c630800 Ma Wupeng 2022-11-11 277 { 2525d04c630800 Ma Wupeng 2022-11-11 278 mem_reliable_ctrl_bits = 0; 2525d04c630800 Ma Wupeng 2022-11-11 279 2525d04c630800 Ma Wupeng 2022-11-11 280 reliable_allow_fallback = false; 2525d04c630800 Ma Wupeng 2022-11-11 281 shmem_reliable = false; 2525d04c630800 Ma Wupeng 2022-11-11 282 pagecache_use_reliable_mem = false; 2525d04c630800 Ma Wupeng 2022-11-11 283 static_branch_disable(&mem_reliable); 2525d04c630800 Ma Wupeng 2022-11-11 284 2525d04c630800 Ma Wupeng 2022-11-11 285 pr_info("memory reliable feature disabled.\n"); 2525d04c630800 Ma Wupeng 2022-11-11 286 } 2525d04c630800 Ma Wupeng 2022-11-11 287 2525d04c630800 Ma Wupeng 2022-11-11 288 static int reliable_debug_handler(struct ctl_table *table, int write, 2525d04c630800 Ma Wupeng 2022-11-11 289 void __user *buffer, size_t *length, 2525d04c630800 Ma Wupeng 2022-11-11 290 loff_t *ppos) 2525d04c630800 Ma Wupeng 2022-11-11 291 { 2525d04c630800 Ma Wupeng 2022-11-11 292 unsigned long old_ctrl_bits, new_ctrl_bits; 2525d04c630800 Ma Wupeng 2022-11-11 293 static DEFINE_MUTEX(reliable_debug_mutex); 2525d04c630800 Ma Wupeng 2022-11-11 294 int ret; 2525d04c630800 Ma Wupeng 2022-11-11 295 2525d04c630800 Ma Wupeng 2022-11-11 296 mutex_lock(&reliable_debug_mutex); 2525d04c630800 Ma Wupeng 2022-11-11 297 old_ctrl_bits = mem_reliable_ctrl_bits; 2525d04c630800 Ma Wupeng 2022-11-11 298 ret = proc_doulongvec_minmax(table, write, buffer, length, ppos); 2525d04c630800 Ma Wupeng 2022-11-11 299 if (ret == 0 && write) { 2525d04c630800 Ma Wupeng 2022-11-11 300 if (!mem_reliable_is_enabled() || 2525d04c630800 Ma Wupeng 2022-11-11 301 (mem_reliable_ctrl_bits > (1 << CTRL_BITS_SHIFT) - 1)) { 2525d04c630800 Ma Wupeng 2022-11-11 302 mem_reliable_ctrl_bits = old_ctrl_bits; 2525d04c630800 Ma Wupeng 2022-11-11 303 mutex_unlock(&reliable_debug_mutex); 2525d04c630800 Ma Wupeng 2022-11-11 304 2525d04c630800 Ma Wupeng 2022-11-11 305 return -EINVAL; 2525d04c630800 Ma Wupeng 2022-11-11 306 } 2525d04c630800 Ma Wupeng 2022-11-11 307 2525d04c630800 Ma Wupeng 2022-11-11 308 new_ctrl_bits = mem_reliable_ctrl_bits; 2525d04c630800 Ma Wupeng 2022-11-11 309 mem_reliable_ctrl_bits = old_ctrl_bits; 2525d04c630800 Ma Wupeng 2022-11-11 310 if (!!test_bit(MEM_RELIABLE_ALL, &new_ctrl_bits)) 2525d04c630800 Ma Wupeng 2022-11-11 311 mem_reliable_parse_ctrl_bits(new_ctrl_bits); 2525d04c630800 Ma Wupeng 2022-11-11 312 else 2525d04c630800 Ma Wupeng 2022-11-11 313 mem_reliable_disable_all(); 2525d04c630800 Ma Wupeng 2022-11-11 314 } 2525d04c630800 Ma Wupeng 2022-11-11 315 2525d04c630800 Ma Wupeng 2022-11-11 316 mutex_unlock(&reliable_debug_mutex); 2525d04c630800 Ma Wupeng 2022-11-11 317 2525d04c630800 Ma Wupeng 2022-11-11 318 return ret; 2525d04c630800 Ma Wupeng 2022-11-11 319 } 2525d04c630800 Ma Wupeng 2022-11-11 320 f30c7817f982da Ma Wupeng 2022-11-11 321 #ifdef CONFIG_SHMEM f30c7817f982da Ma Wupeng 2022-11-11 322 static unsigned long sysctl_shmem_reliable_bytes_limit = ULONG_MAX; f30c7817f982da Ma Wupeng 2022-11-11 323 f30c7817f982da Ma Wupeng 2022-11-11 324 static int reliable_shmem_bytes_limit_handler(struct ctl_table *table, f30c7817f982da Ma Wupeng 2022-11-11 325 int write, void __user *buffer, f30c7817f982da Ma Wupeng 2022-11-11 326 size_t *length, loff_t *ppos) f30c7817f982da Ma Wupeng 2022-11-11 327 { f30c7817f982da Ma Wupeng 2022-11-11 328 unsigned long *data_ptr = (unsigned long *)(table->data); f30c7817f982da Ma Wupeng 2022-11-11 329 unsigned long old = *data_ptr; f30c7817f982da Ma Wupeng 2022-11-11 330 int ret; f30c7817f982da Ma Wupeng 2022-11-11 331 f30c7817f982da Ma Wupeng 2022-11-11 332 ret = proc_doulongvec_minmax(table, write, buffer, length, ppos); f30c7817f982da Ma Wupeng 2022-11-11 333 if (!ret && write) { f30c7817f982da Ma Wupeng 2022-11-11 334 if (*data_ptr > PAGES_TO_B(total_reliable_pages())) { f30c7817f982da Ma Wupeng 2022-11-11 335 *data_ptr = old; f30c7817f982da Ma Wupeng 2022-11-11 336 return -EINVAL; f30c7817f982da Ma Wupeng 2022-11-11 337 } f30c7817f982da Ma Wupeng 2022-11-11 338 f30c7817f982da Ma Wupeng 2022-11-11 339 shmem_reliable_nr_page = *data_ptr >> PAGE_SHIFT; f30c7817f982da Ma Wupeng 2022-11-11 340 } f30c7817f982da Ma Wupeng 2022-11-11 341 f30c7817f982da Ma Wupeng 2022-11-11 342 return ret; f30c7817f982da Ma Wupeng 2022-11-11 343 } f30c7817f982da Ma Wupeng 2022-11-11 344 #endif f30c7817f982da Ma Wupeng 2022-11-11 345 4021a0d53e3e0d Chen Wandun 2022-11-11 346 static struct ctl_table reliable_ctl_table[] = { 4021a0d53e3e0d Chen Wandun 2022-11-11 347 { 4021a0d53e3e0d Chen Wandun 2022-11-11 348 .procname = "reliable_pagecache_max_bytes", 4021a0d53e3e0d Chen Wandun 2022-11-11 349 .data = &reliable_pagecache_max_bytes, 4021a0d53e3e0d Chen Wandun 2022-11-11 350 .maxlen = sizeof(reliable_pagecache_max_bytes), 4021a0d53e3e0d Chen Wandun 2022-11-11 351 .mode = 0644, 4021a0d53e3e0d Chen Wandun 2022-11-11 @352 .proc_handler = reliable_pagecache_max_bytes_write, 4021a0d53e3e0d Chen Wandun 2022-11-11 353 }, 8968270eb5fbed Ma Wupeng 2022-11-11 354 { 8968270eb5fbed Ma Wupeng 2022-11-11 355 .procname = "task_reliable_limit", 8968270eb5fbed Ma Wupeng 2022-11-11 356 .data = &task_reliable_limit, 8968270eb5fbed Ma Wupeng 2022-11-11 357 .maxlen = sizeof(task_reliable_limit), 8968270eb5fbed Ma Wupeng 2022-11-11 358 .mode = 0644, 8968270eb5fbed Ma Wupeng 2022-11-11 359 .proc_handler = reliable_limit_handler, 8968270eb5fbed Ma Wupeng 2022-11-11 360 }, f30c7817f982da Ma Wupeng 2022-11-11 361 #ifdef CONFIG_SHMEM f30c7817f982da Ma Wupeng 2022-11-11 362 { f30c7817f982da Ma Wupeng 2022-11-11 363 .procname = "shmem_reliable_bytes_limit", f30c7817f982da Ma Wupeng 2022-11-11 364 .data = &sysctl_shmem_reliable_bytes_limit, f30c7817f982da Ma Wupeng 2022-11-11 365 .maxlen = sizeof(sysctl_shmem_reliable_bytes_limit), f30c7817f982da Ma Wupeng 2022-11-11 366 .mode = 0644, f30c7817f982da Ma Wupeng 2022-11-11 367 .proc_handler = reliable_shmem_bytes_limit_handler, f30c7817f982da Ma Wupeng 2022-11-11 368 }, f30c7817f982da Ma Wupeng 2022-11-11 369 #endif 2525d04c630800 Ma Wupeng 2022-11-11 370 { 2525d04c630800 Ma Wupeng 2022-11-11 371 .procname = "reliable_debug", 2525d04c630800 Ma Wupeng 2022-11-11 372 .data = &mem_reliable_ctrl_bits, 2525d04c630800 Ma Wupeng 2022-11-11 373 .maxlen = sizeof(mem_reliable_ctrl_bits), 2525d04c630800 Ma Wupeng 2022-11-11 374 .mode = 0600, 2525d04c630800 Ma Wupeng 2022-11-11 375 .proc_handler = reliable_debug_handler, 2525d04c630800 Ma Wupeng 2022-11-11 376 }, 4021a0d53e3e0d Chen Wandun 2022-11-11 377 {} 4021a0d53e3e0d Chen Wandun 2022-11-11 378 }; 4021a0d53e3e0d Chen Wandun 2022-11-11 379 :::::: The code at line 214 was first introduced by commit :::::: 8968270eb5fbedb9c62e265e49228ef59a4f2321 mm: Add reliable memory use limit for user tasks :::::: TO: Ma Wupeng <mawupeng1(a)huawei.com> :::::: CC: Wang Wensheng <wangwensheng4(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

openEuler Kernel SIG双周例会
by openEuler conference 30 Oct '25

30 Oct '25

您好！ Kernel 邀请您参加 2025-10-31 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议内容： 1. 进展update 2. 议题征集中（可直接回复本邮件申请，也可填报至kernel会议纪要看板）会议链接：https://meeting.huaweicloud.com:36443/#/j/985774693 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2025-10-31 14:00, The subject of the conference is openEuler Kernel SIG双周例会 Summary: 1. 进展update 2. 议题征集中（可直接回复本邮件申请，也可填报至kernel会议纪要看板） You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/985774693 Add topics at https://etherpad.openeuler.org/p/Kernel-meetings More information: https://www.openeuler.org/en/

1 0

[PATCH OLK-6.6 V1] sched/fair: Prefer physical cores when migrating tasks
by Cheng Yu 30 Oct '25

30 Oct '25

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IAJEHU -------------------------------- When cpu hyperthreading is enabled, one physical core can virtualize multiple logical cpus. Assume that physical core0 virtualizes two logical cpus, cpu0 and cpu1. Only when the load of cpu0 exceeds the set ratio to the capacity of cpu0, the task will be migrated to the cpu1, otherwise the task will not be migrated and the cpu0 will still be used. External impacts: 1) default config: CONFIG_SCHED_KEEP_ON_CORE=y 2) sysctl: /proc/sys/kernel/sched_util_ratio 3) sched features: KEEP_ON_CORE (default NO_KEEP_ON_CORE) Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- arch/arm64/Kconfig | 1 + arch/arm64/configs/openeuler_defconfig | 1 + init/Kconfig | 19 +++++++++++ kernel/sched/fair.c | 47 ++++++++++++++++++++++++++ kernel/sched/features.h | 4 +++ 5 files changed, 72 insertions(+) diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index dec41d9fa054..8ad5692a460c 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -107,6 +107,7 @@ config ARM64 select ARCH_SUPPORTS_NUMA_BALANCING select ARCH_SUPPORTS_SCHED_PARAL select ARCH_SUPPORTS_SCHED_SOFT_QUOTA + select ARCH_SUPPORTS_SCHED_KEEP_ON_CORE select ARCH_SUPPORTS_PAGE_TABLE_CHECK select ARCH_SUPPORTS_PER_VMA_LOCK select ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index ce292ed39752..57dcf692d82e 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -211,6 +211,7 @@ CONFIG_NET_NS=y CONFIG_SCHED_STEAL=y CONFIG_SCHED_PARAL=y CONFIG_SCHED_SOFT_QUOTA=y +CONFIG_SCHED_KEEP_ON_CORE=y CONFIG_CHECKPOINT_RESTORE=y CONFIG_SCHED_AUTOGROUP=y CONFIG_RELAY=y diff --git a/init/Kconfig b/init/Kconfig index 2720083aaa17..2322830cb4ce 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -1192,6 +1192,25 @@ config SCHED_SOFT_QUOTA restrictions on the use of the CPU quota, such as some commercial scenarios that charge based on the use of CPU quota. +# +# For architectures that want to enable the support for SCHED_KEEP_ON_CORE +# +config ARCH_SUPPORTS_SCHED_KEEP_ON_CORE + bool + +config SCHED_KEEP_ON_CORE + bool "Prefer physical cores when migrating tasks" + depends on ARCH_SUPPORTS_SCHED_KEEP_ON_CORE + depends on SCHED_SMT + default n + help + When cpu hyperthreading is enabled, one physical core can virtualize + multiple logical cpus. Assume that physical core0 virtualizes two + logical cpus, cpu0 and cpu1. Only when the load of cpu0 exceeds the + ratio to the capacity of cpu0, the task will be migrated to the cpu1, + otherwise the task will not be migrated and the cpu0 will still be + used. + config SCHED_MM_CID def_bool n depends on SMP && RSEQ diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index b22f3c072d20..d0ee00a018b0 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -231,6 +231,10 @@ static int sysctl_affinity_adjust_delay_ms = 5000; unsigned int sysctl_soft_runtime_ratio = 20; #endif +#ifdef CONFIG_SCHED_KEEP_ON_CORE +int sysctl_sched_util_ratio = 100; +#endif + #ifdef CONFIG_SYSCTL static struct ctl_table sched_fair_sysctls[] = { { @@ -341,6 +345,17 @@ static struct ctl_table sched_fair_sysctls[] = { .extra1 = SYSCTL_ONE, .extra2 = SYSCTL_ONE_HUNDRED, }, +#endif +#ifdef CONFIG_SCHED_KEEP_ON_CORE + { + .procname = "sched_util_ratio", + .data = &sysctl_sched_util_ratio, + .maxlen = sizeof(sysctl_sched_util_ratio), + .mode = 0644, + .proc_handler = proc_dointvec_minmax, + .extra1 = SYSCTL_ZERO, + .extra2 = SYSCTL_ONE_HUNDRED, + }, #endif {} }; @@ -8784,6 +8799,20 @@ static __always_inline unsigned long cpu_util_without(int cpu, struct task_struc return cpu_util(cpu, p, -1, 0); } +#ifdef CONFIG_SCHED_KEEP_ON_CORE +static bool core_has_spare(int cpu) +{ + int core_id = cpumask_first(cpu_smt_mask(cpu)); + unsigned long util = cpu_util_cfs(core_id); + unsigned long capacity = capacity_of(core_id); + + if (sysctl_sched_util_ratio == 100) + return true; + + return util * 100 < capacity * sysctl_sched_util_ratio; +} +#endif + /* * energy_env - Utilization landscape for energy estimation. * @task_busy_time: Utilization contribution by the task for which we test the @@ -9453,6 +9482,15 @@ select_task_rq_fair(struct task_struct *p, int prev_cpu, int wake_flags) /* Fast path */ new_cpu = select_idle_sibling(p, prev_cpu, new_cpu); } + +#ifdef CONFIG_SCHED_KEEP_ON_CORE + if (sched_feat(KEEP_ON_CORE) && + static_branch_likely(&sched_smt_present)) { + if (core_has_spare(new_cpu)) + new_cpu = cpumask_first(cpu_smt_mask((new_cpu))); + } +#endif + rcu_read_unlock(); schedstat_end_time(cpu_rq(cpu), time); @@ -10825,6 +10863,15 @@ int can_migrate_task(struct task_struct *p, struct lb_env *env) } #endif +#ifdef CONFIG_SCHED_KEEP_ON_CORE + if (sched_feat(KEEP_ON_CORE) && + static_branch_likely(&sched_smt_present)) { + if (core_has_spare(env->dst_cpu) && + cpumask_first(cpu_smt_mask((env->dst_cpu))) != env->dst_cpu) + return 0; + } +#endif + /* * We do not migrate tasks that are: * 1) throttled_lb_pair, or diff --git a/kernel/sched/features.h b/kernel/sched/features.h index b95797360dd6..1f135b0ea6fd 100644 --- a/kernel/sched/features.h +++ b/kernel/sched/features.h @@ -65,6 +65,10 @@ SCHED_FEAT(STEAL, false) SCHED_FEAT(PARAL, false) #endif +#ifdef CONFIG_SCHED_KEEP_ON_CORE +SCHED_FEAT(KEEP_ON_CORE, false) +#endif + /* * Issue a WARN when we do multiple update_rq_clock() calls * in a single rq->lock section. Default disabled because the -- 2.25.1

2 1

[openeuler:OLK-6.6 3067/3067] drivers/ub/ubfi/irq.c:11:5: warning: no previous prototype for 'ubrt_register_gsi'
by kernel test robot 30 Oct '25

30 Oct '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 8894fa6a2898641fafc4ccaaa73f0078705a223e commit: 6533f3af69cee90712f3481841901ab0a10f8339 [3067/3067] ub:ubfi: ubfi driver create ubc device config: arm64-allnoconfig (https://download.01.org/0day-ci/archive/20251030/202510301347.pIaq0wY3-lkp@…) compiler: aarch64-linux-gcc (GCC) 15.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251030/202510301347.pIaq0wY3-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202510301347.pIaq0wY3-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/ub/ubfi/irq.c:11:5: warning: no previous prototype for 'ubrt_register_gsi' [-Wmissing-prototypes] 11 | int ubrt_register_gsi(u32 hwirq, int trigger, int polarity, const char *name, | ^~~~~~~~~~~~~~~~~ >> drivers/ub/ubfi/irq.c:37:6: warning: no previous prototype for 'ubrt_unregister_gsi' [-Wmissing-prototypes] 37 | void ubrt_unregister_gsi(u32 hwirq) | ^~~~~~~~~~~~~~~~~~~ Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for ARCH_SUPPORTS_SCHED_SOFT_QUOTA Depends on [n]: CGROUPS [=n] Selected by [y]: - ARM64 [=y] WARNING: unmet direct dependencies detected for HALTPOLL_CPUIDLE Depends on [n]: CPU_IDLE [=n] && ARCH_CPUIDLE_HALTPOLL [=y] && ARCH_HAS_OPTIMIZED_POLL [=y] Selected by [y]: - ARM64 [=y] vim +/ubrt_register_gsi +11 drivers/ub/ubfi/irq.c 10 > 11 int ubrt_register_gsi(u32 hwirq, int trigger, int polarity, const char *name, 12 struct resource *res) 13 { 14 #ifdef CONFIG_ACPI 15 int irq; 16 17 if (!res) { 18 pr_err("ub register gsi, res is null\n"); 19 return -EINVAL; 20 } 21 22 irq = acpi_register_gsi(NULL, hwirq, trigger, polarity); 23 if (irq <= 0) { 24 pr_err("could not register ub gsi hwirq %u\n", hwirq); 25 return -EINVAL; 26 } 27 28 res->name = name; 29 res->start = irq; 30 res->end = irq; 31 res->flags = IORESOURCE_IRQ; 32 #endif 33 return 0; 34 } 35 EXPORT_SYMBOL_GPL(ubrt_register_gsi); 36 > 37 void ubrt_unregister_gsi(u32 hwirq) -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 3257/3257] drivers/gpu/drm/inspur/inspur_cursor.c:54:32: sparse: sparse: cast removes address space '__iomem' of expression
by kernel test robot 30 Oct '25

30 Oct '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 13f149450a6b4609c03a79beee0859dfe43ca949 commit: b9d65551a3adfa87a7c5d33391187ee60a1b501d [3257/3257] drm: add inspur drm driver support config: x86_64-randconfig-121-20251030 (https://download.01.org/0day-ci/archive/20251030/202510301254.n0HWSdf0-lkp@…) compiler: gcc-12 (Debian 12.4.0-5) 12.4.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251030/202510301254.n0HWSdf0-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202510301254.n0HWSdf0-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/gpu/drm/inspur/inspur_cursor.c:54:32: sparse: sparse: cast removes address space '__iomem' of expression vim +/__iomem +54 drivers/gpu/drm/inspur/inspur_cursor.c 49 50 #define HW_FLAG_OFFSET 0x01ffff00 51 #define HW_FLAG_ENABLE 0x1bd40750 52 unsigned char getKVMHWCursorSetting(struct inspur_drm_private *priv) 53 { > 54 unsigned int value = *(unsigned int *)(priv->fb_map + HW_FLAG_OFFSET); -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3067/3067] drivers/ub/ubfi/irq.c:11:5: warning: no previous prototype for function 'ubrt_register_gsi'
by kernel test robot 30 Oct '25

30 Oct '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 39d344bdf1da74284209d54d7199c6c6daca9905 commit: 6533f3af69cee90712f3481841901ab0a10f8339 [3067/3067] ub:ubfi: ubfi driver create ubc device config: x86_64-allnoconfig (https://download.01.org/0day-ci/archive/20251030/202510301246.3F4So5Wc-lkp@…) compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251030/202510301246.3F4So5Wc-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202510301246.3F4So5Wc-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/ub/ubfi/irq.c:11:5: warning: no previous prototype for function 'ubrt_register_gsi' [-Wmissing-prototypes] 11 | int ubrt_register_gsi(u32 hwirq, int trigger, int polarity, const char *name, | ^ drivers/ub/ubfi/irq.c:11:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 11 | int ubrt_register_gsi(u32 hwirq, int trigger, int polarity, const char *name, | ^ | static >> drivers/ub/ubfi/irq.c:37:6: warning: no previous prototype for function 'ubrt_unregister_gsi' [-Wmissing-prototypes] 37 | void ubrt_unregister_gsi(u32 hwirq) | ^ drivers/ub/ubfi/irq.c:37:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 37 | void ubrt_unregister_gsi(u32 hwirq) | ^ | static 2 warnings generated. vim +/ubrt_register_gsi +11 drivers/ub/ubfi/irq.c 10 > 11 int ubrt_register_gsi(u32 hwirq, int trigger, int polarity, const char *name, 12 struct resource *res) 13 { 14 #ifdef CONFIG_ACPI 15 int irq; 16 17 if (!res) { 18 pr_err("ub register gsi, res is null\n"); 19 return -EINVAL; 20 } 21 22 irq = acpi_register_gsi(NULL, hwirq, trigger, polarity); 23 if (irq <= 0) { 24 pr_err("could not register ub gsi hwirq %u\n", hwirq); 25 return -EINVAL; 26 } 27 28 res->name = name; 29 res->start = irq; 30 res->end = irq; 31 res->flags = IORESOURCE_IRQ; 32 #endif 33 return 0; 34 } 35 EXPORT_SYMBOL_GPL(ubrt_register_gsi); 36 > 37 void ubrt_unregister_gsi(u32 hwirq) -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 V1] sched/fair: Prefer physical cores when migrating tasks
by Cheng Yu 30 Oct '25

30 Oct '25

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IAJEHU -------------------------------- When cpu hyperthreading is enabled, one physical core can virtualize multiple logical cpus. Assume that physical core0 virtualizes two logical cpus, cpu0 and cpu1. Only when the load of cpu0 exceeds the set ratio to the capacity of cpu0, the task will be migrated to the cpu1, otherwise the task will not be migrated and the cpu0 will still be used. External impacts: 1) default config: CONFIG_SCHED_KEEP_ON_CORE=y 2) sysctl: /proc/sys/kernel/sched_util_ratio 3) sched features: KEEP_ON_CORE (default NO_KEEP_ON_CORE) Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- arch/arm64/Kconfig | 1 + arch/arm64/configs/openeuler_defconfig | 1 + init/Kconfig | 19 ++++++++++ kernel/sched/fair.c | 48 +++++++++++++++++++++++++- kernel/sched/features.h | 4 +++ 5 files changed, 72 insertions(+), 1 deletion(-) diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index dec41d9fa054..8ad5692a460c 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -107,6 +107,7 @@ config ARM64 select ARCH_SUPPORTS_NUMA_BALANCING select ARCH_SUPPORTS_SCHED_PARAL select ARCH_SUPPORTS_SCHED_SOFT_QUOTA + select ARCH_SUPPORTS_SCHED_KEEP_ON_CORE select ARCH_SUPPORTS_PAGE_TABLE_CHECK select ARCH_SUPPORTS_PER_VMA_LOCK select ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index ce292ed39752..57dcf692d82e 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -211,6 +211,7 @@ CONFIG_NET_NS=y CONFIG_SCHED_STEAL=y CONFIG_SCHED_PARAL=y CONFIG_SCHED_SOFT_QUOTA=y +CONFIG_SCHED_KEEP_ON_CORE=y CONFIG_CHECKPOINT_RESTORE=y CONFIG_SCHED_AUTOGROUP=y CONFIG_RELAY=y diff --git a/init/Kconfig b/init/Kconfig index 2720083aaa17..2322830cb4ce 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -1192,6 +1192,25 @@ config SCHED_SOFT_QUOTA restrictions on the use of the CPU quota, such as some commercial scenarios that charge based on the use of CPU quota. +# +# For architectures that want to enable the support for SCHED_KEEP_ON_CORE +# +config ARCH_SUPPORTS_SCHED_KEEP_ON_CORE + bool + +config SCHED_KEEP_ON_CORE + bool "Prefer physical cores when migrating tasks" + depends on ARCH_SUPPORTS_SCHED_KEEP_ON_CORE + depends on SCHED_SMT + default n + help + When cpu hyperthreading is enabled, one physical core can virtualize + multiple logical cpus. Assume that physical core0 virtualizes two + logical cpus, cpu0 and cpu1. Only when the load of cpu0 exceeds the + ratio to the capacity of cpu0, the task will be migrated to the cpu1, + otherwise the task will not be migrated and the cpu0 will still be + used. + config SCHED_MM_CID def_bool n depends on SMP && RSEQ diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index b22f3c072d20..c0618a244052 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -231,6 +231,10 @@ static int sysctl_affinity_adjust_delay_ms = 5000; unsigned int sysctl_soft_runtime_ratio = 20; #endif +#ifdef CONFIG_SCHED_KEEP_ON_CORE +int sysctl_sched_util_ratio = 100; +#endif + #ifdef CONFIG_SYSCTL static struct ctl_table sched_fair_sysctls[] = { { @@ -341,6 +345,17 @@ static struct ctl_table sched_fair_sysctls[] = { .extra1 = SYSCTL_ONE, .extra2 = SYSCTL_ONE_HUNDRED, }, +#endif +#ifdef CONFIG_SCHED_KEEP_ON_CORE + { + .procname = "sched_util_ratio", + .data = &sysctl_sched_util_ratio, + .maxlen = sizeof(sysctl_sched_util_ratio), + .mode = 0644, + .proc_handler = proc_dointvec_minmax, + .extra1 = SYSCTL_ZERO, + .extra2 = SYSCTL_ONE_HUNDRED, + }, #endif {} }; @@ -8230,7 +8245,6 @@ static int select_idle_smt(struct task_struct *p, struct sched_domain *sd, int t return -1; } - #else /* CONFIG_SCHED_SMT */ static inline void set_idle_cores(int cpu, int val) @@ -8784,6 +8798,20 @@ static __always_inline unsigned long cpu_util_without(int cpu, struct task_struc return cpu_util(cpu, p, -1, 0); } +#ifdef CONFIG_SCHED_KEEP_ON_CORE +static bool core_has_spare(int cpu) +{ + int core_id = cpumask_first(cpu_smt_mask(cpu)); + unsigned long util = cpu_util_cfs(core_id); + unsigned long capacity = capacity_of(core_id); + + if (sysctl_sched_util_ratio == 100) + return true; + + return util * 100 < capacity * sysctl_sched_util_ratio; +} +#endif + /* * energy_env - Utilization landscape for energy estimation. * @task_busy_time: Utilization contribution by the task for which we test the @@ -9453,6 +9481,15 @@ select_task_rq_fair(struct task_struct *p, int prev_cpu, int wake_flags) /* Fast path */ new_cpu = select_idle_sibling(p, prev_cpu, new_cpu); } + +#ifdef CONFIG_SCHED_KEEP_ON_CORE + if (sched_feat(KEEP_ON_CORE) && + static_branch_likely(&sched_smt_present)) { + if (core_has_spare(new_cpu)) + new_cpu = cpumask_first(cpu_smt_mask((new_cpu))); + } +#endif + rcu_read_unlock(); schedstat_end_time(cpu_rq(cpu), time); @@ -10825,6 +10862,15 @@ int can_migrate_task(struct task_struct *p, struct lb_env *env) } #endif +#ifdef CONFIG_SCHED_KEEP_ON_CORE + if (sched_feat(KEEP_ON_CORE) && + static_branch_likely(&sched_smt_present)) { + if (core_has_spare(env->dst_cpu) && + cpumask_first(cpu_smt_mask((env->dst_cpu))) != env->dst_cpu) + return 0; + } +#endif + /* * We do not migrate tasks that are: * 1) throttled_lb_pair, or diff --git a/kernel/sched/features.h b/kernel/sched/features.h index b95797360dd6..1f135b0ea6fd 100644 --- a/kernel/sched/features.h +++ b/kernel/sched/features.h @@ -65,6 +65,10 @@ SCHED_FEAT(STEAL, false) SCHED_FEAT(PARAL, false) #endif +#ifdef CONFIG_SCHED_KEEP_ON_CORE +SCHED_FEAT(KEEP_ON_CORE, false) +#endif + /* * Issue a WARN when we do multiple update_rq_clock() calls * in a single rq->lock section. Default disabled because the -- 2.25.1

2 1

[PATCH OLK-6.6] netfilter: ipset: fix region locking in hash types
by Zhang Changzhong 30 Oct '25

30 Oct '25

From: Jozsef Kadlecsik <kadlec(a)netfilter.org> stable inclusion from stable-v6.6.91 commit a3dfec485401943e315c394c29afe2db8f9481d6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICBIZM CVE: CVE-2025-37997 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 8478a729c0462273188263136880480729e9efca ] Region locking introduced in v5.6-rc4 contained three macros to handle the region locks: ahash_bucket_start(), ahash_bucket_end() which gave back the start and end hash bucket values belonging to a given region lock and ahash_region() which should give back the region lock belonging to a given hash bucket. The latter was incorrect which can lead to a race condition between the garbage collector and adding new elements when a hash type of set is defined with timeouts. Fixes: f66ee0410b1c ("netfilter: ipset: Fix "INFO: rcu detected stall in hash_xxx" reports") Reported-by: Kota Toda <kota.toda(a)gmo-cybersecurity.com> Signed-off-by: Jozsef Kadlecsik <kadlec(a)netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/netfilter/ipset/ip_set_hash_gen.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h index 20aad81..c2d88b1 100644 --- a/net/netfilter/ipset/ip_set_hash_gen.h +++ b/net/netfilter/ipset/ip_set_hash_gen.h @@ -63,7 +63,7 @@ struct hbucket { #define ahash_sizeof_regions(htable_bits) \ (ahash_numof_locks(htable_bits) * sizeof(struct ip_set_region)) #define ahash_region(n, htable_bits) \ - ((n) % ahash_numof_locks(htable_bits)) + ((n) / jhash_size(HTABLE_REGION_BITS)) #define ahash_bucket_start(h, htable_bits) \ ((htable_bits) < HTABLE_REGION_BITS ? 0 \ : (h) * jhash_size(HTABLE_REGION_BITS)) -- 2.9.5

2 1