- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] usb: chipidea: ci_hdrc_imx: fix usbmisc handling
by Tengda Wu 12 May '25

12 May '25

From: Fedor Pchelkin <pchelkin(a)ispras.ru> stable inclusion from stable-6.6.90 commit 121e9f80ea5478bca3a8f3f26593fd66f87da649 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC6BLK CVE: CVE-2025-37811 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 4e28f79e3dffa52d327b46d1a78dac16efb5810b upstream. usbmisc is an optional device property so it is totally valid for the corresponding data->usbmisc_data to have a NULL value. Check that before dereferencing the pointer. Found by Linux Verification Center (linuxtesting.org) with Svace static analysis tool. Fixes: 74adad500346 ("usb: chipidea: ci_hdrc_imx: decrement device's refcount in .remove() and in the error path of .probe()") Cc: stable <stable(a)kernel.org> Signed-off-by: Fedor Pchelkin <pchelkin(a)ispras.ru> Acked-by: Peter Chen <peter.chen(a)kernel.org> Link: https://lore.kernel.org/r/20250316102658.490340-2-pchelkin@ispras.ru Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- drivers/usb/chipidea/ci_hdrc_imx.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/usb/chipidea/ci_hdrc_imx.c b/drivers/usb/chipidea/ci_hdrc_imx.c index b3cbca361a96..1a050bdf7bdb 100644 --- a/drivers/usb/chipidea/ci_hdrc_imx.c +++ b/drivers/usb/chipidea/ci_hdrc_imx.c @@ -520,7 +520,8 @@ static int ci_hdrc_imx_probe(struct platform_device *pdev) cpu_latency_qos_remove_request(&data->pm_qos_req); data->ci_pdev = NULL; err_put: - put_device(data->usbmisc_data->dev); + if (data->usbmisc_data) + put_device(data->usbmisc_data->dev); return ret; } @@ -544,7 +545,8 @@ static void ci_hdrc_imx_remove(struct platform_device *pdev) if (data->hsic_pad_regulator) regulator_disable(data->hsic_pad_regulator); } - put_device(data->usbmisc_data->dev); + if (data->usbmisc_data) + put_device(data->usbmisc_data->dev); } static void ci_hdrc_imx_shutdown(struct platform_device *pdev) -- 2.34.1

2 1

[openeuler:OLK-6.6 2220/2220] arch/loongarch/kernel/paravirt.c:57:undefined reference to `__ashlti3'
by kernel test robot 12 May '25

12 May '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: e1106320058bf1d983657f80490249b4f919ebad commit: 462dd429f52a7659ea1c74f02f7134a43fccccc8 [2220/2220] LoongArch: Add pv ipi support on guest kernel side config: loongarch-randconfig-001-20250512 (https://download.01.org/0day-ci/archive/20250512/202505122209.a4CThmkS-lkp@…) compiler: loongarch64-linux-gcc (GCC) 13.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250512/202505122209.a4CThmkS-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202505122209.a4CThmkS-lkp@intel.com/ All errors (new ones prefixed by >>): loongarch64-linux-ld: arch/loongarch/kernel/paravirt.o: in function `pv_send_ipi_mask': >> arch/loongarch/kernel/paravirt.c:57:(.text+0x1f4): undefined reference to `__ashlti3' vim +57 arch/loongarch/kernel/paravirt.c 33 34 #define KVM_IPI_CLUSTER_SIZE (2 * BITS_PER_LONG) 35 static void pv_send_ipi_mask(const struct cpumask *mask, unsigned int action) 36 { 37 unsigned int cpu, i, min = 0, max = 0, old; 38 __uint128_t bitmap = 0; 39 irq_cpustat_t *info; 40 41 if (cpumask_empty(mask)) 42 return; 43 44 action = BIT(action); 45 for_each_cpu(i, mask) { 46 info = &per_cpu(irq_stat, i); 47 old = atomic_fetch_or(action, &info->message); 48 if (old) 49 continue; 50 51 cpu = cpu_logical_map(i); 52 if (!bitmap) { 53 min = max = cpu; 54 } else if (cpu > min && cpu < min + KVM_IPI_CLUSTER_SIZE) { 55 max = cpu > max ? cpu : max; 56 } else if (cpu < min && (max - cpu) < KVM_IPI_CLUSTER_SIZE) { > 57 bitmap <<= min - cpu; 58 min = cpu; 59 } else { 60 /* 61 * Physical cpuid is sorted in ascending order ascend 62 * for the next mask calculation, send IPI here 63 * directly and skip the remainding cpus 64 */ 65 kvm_hypercall3(KVM_HCALL_FUNC_PV_IPI, 66 (unsigned long)bitmap, 67 (unsigned long)(bitmap >> BITS_PER_LONG), min); 68 min = max = cpu; 69 bitmap = 0; 70 } 71 __set_bit(cpu - min, (unsigned long *)&bitmap); 72 } 73 74 if (bitmap) 75 kvm_hypercall3(KVM_HCALL_FUNC_PV_IPI, (unsigned long)bitmap, 76 (unsigned long)(bitmap >> BITS_PER_LONG), min); 77 } 78 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2220/2220] drivers/net/ethernet/huawei/hinic3/cqm/cqm_bitmap_table.c:445:23: error: invalid application of 'sizeof' to an incomplete type 'const struct free_memory[]'
by kernel test robot 12 May '25

12 May '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: e1106320058bf1d983657f80490249b4f919ebad commit: 0bf0c942a09ba92e1d22e6960464b628dd4408fa [2220/2220] net/hinic3: Synchronize new NIC features and bug fixes config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20250512/202505122110.l7rKvRzx-lkp@…) compiler: clang version 19.1.7 (https://github.com/llvm/llvm-project cd708029e0b2869e80abe31ddb175f7c35361f90) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250512/202505122110.l7rKvRzx-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202505122110.l7rKvRzx-lkp@intel.com/ All error/warnings (new ones prefixed by >>): drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwif.c:312: warning: Function parameter or member 'attr6' not described in 'set_hwif_attr' drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwif.c:774: warning: Function parameter or member 'hwdev' not described in 'hinic3_init_hwif' drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwif.c:774: warning: Function parameter or member 'cfg_reg_base' not described in 'hinic3_init_hwif' drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwif.c:774: warning: Function parameter or member 'intr_reg_base' not described in 'hinic3_init_hwif' drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwif.c:774: warning: Function parameter or member 'mgmt_regs_base' not described in 'hinic3_init_hwif' drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwif.c:774: warning: Function parameter or member 'db_base_phy' not described in 'hinic3_init_hwif' drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwif.c:774: warning: Function parameter or member 'db_base' not described in 'hinic3_init_hwif' drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwif.c:774: warning: Function parameter or member 'db_dwqe_len' not described in 'hinic3_init_hwif' drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwif.c:774: warning: Excess function parameter 'hwif' description in 'hinic3_init_hwif' drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwif.c:774: warning: Excess function parameter 'pdev' description in 'hinic3_init_hwif' drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwif.c:840: warning: Function parameter or member 'hwdev' not described in 'hinic3_free_hwif' drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwif.c:840: warning: Excess function parameter 'hwif' description in 'hinic3_free_hwif' drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwif.c:840: warning: Excess function parameter 'pdev' description in 'hinic3_free_hwif' >> drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwif.c:862: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * get function id from register,used by sriov hot migration process drivers/net/ethernet/huawei/hinic3/hw/hinic3_hwif.c:878: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * get function id, used by sriov hot migratition process. -- drivers/net/ethernet/huawei/hinic3/cqm/cqm_bitmap_table.c:415:3: error: a randomized struct can only be initialized with a designated initializer 415 | {check_use_vram, cqm_buf_vram_kalloc}, | ^ drivers/net/ethernet/huawei/hinic3/cqm/cqm_bitmap_table.c:416:3: error: a randomized struct can only be initialized with a designated initializer 416 | {check_for_use_node_alloc, cqm_buf_use_node_alloc_page}, | ^ drivers/net/ethernet/huawei/hinic3/cqm/cqm_bitmap_table.c:417:3: error: a randomized struct can only be initialized with a designated initializer 417 | {check_for_nouse_node_alloc, cqm_buf_unused_node_alloc_page} | ^ drivers/net/ethernet/huawei/hinic3/cqm/cqm_bitmap_table.c:421:3: error: a randomized struct can only be initialized with a designated initializer 421 | {check_use_vram, cqm_buf_vram_free}, | ^ drivers/net/ethernet/huawei/hinic3/cqm/cqm_bitmap_table.c:422:3: error: a randomized struct can only be initialized with a designated initializer 422 | {check_use_non_vram, cqm_buf_free_page_common} | ^ drivers/net/ethernet/huawei/hinic3/cqm/cqm_bitmap_table.c:428:25: error: invalid application of 'sizeof' to an incomplete type 'const struct malloc_memory[]' 428 | u32 malloc_funcs_num = ARRAY_SIZE(g_malloc_funcs); | ^~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kernel.h:57:32: note: expanded from macro 'ARRAY_SIZE' 57 | #define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]) + __must_be_array(arr)) | ^~~~~ >> drivers/net/ethernet/huawei/hinic3/cqm/cqm_bitmap_table.c:445:23: error: invalid application of 'sizeof' to an incomplete type 'const struct free_memory[]' 445 | u32 free_funcs_num = ARRAY_SIZE(g_free_funcs); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kernel.h:57:32: note: expanded from macro 'ARRAY_SIZE' 57 | #define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]) + __must_be_array(arr)) | ^~~~~ 7 errors generated. vim +445 drivers/net/ethernet/huawei/hinic3/cqm/cqm_bitmap_table.c 419 420 static const struct free_memory g_free_funcs[] = { 421 {check_use_vram, cqm_buf_vram_free}, > 422 {check_use_non_vram, cqm_buf_free_page_common} 423 }; 424 425 static s32 cqm_buf_alloc_page(struct tag_cqm_handle *cqm_handle, struct tag_cqm_buf *buf) 426 { 427 struct hinic3_hwdev *handle = cqm_handle->ex_handle; 428 u32 malloc_funcs_num = ARRAY_SIZE(g_malloc_funcs); 429 u32 i; 430 431 for (i = 0; i < malloc_funcs_num; i++) { 432 if (g_malloc_funcs[i].check_alloc_mode && 433 g_malloc_funcs[i].malloc_func && 434 g_malloc_funcs[i].check_alloc_mode(handle, buf)) 435 return g_malloc_funcs[i].malloc_func(handle, buf); 436 } 437 438 cqm_err(handle->dev_hdl, "Unknown alloc mode\n"); 439 440 return CQM_FAIL; 441 } 442 443 static void cqm_buf_free_page(struct tag_cqm_buf *buf) 444 { > 445 u32 free_funcs_num = ARRAY_SIZE(g_free_funcs); 446 u32 i; 447 448 for (i = 0; i < free_funcs_num; i++) { 449 if (g_free_funcs[i].check_alloc_mode && 450 g_free_funcs[i].free_func && 451 g_free_funcs[i].check_alloc_mode(NULL, buf)) 452 return g_free_funcs[i].free_func(buf); 453 } 454 } 455 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/2] CVE-2024-27079
by Guo Mengqi 12 May '25

12 May '25

CVE-2024-27079 Lu Baolu (2): iommu: Add static iommu_ops->release_domain iommu/vt-d: Fix NULL domain on device release drivers/iommu/intel/iommu.c | 31 ++++-------------- drivers/iommu/intel/pasid.c | 64 +++++++++++++++++++++++++++++++++++++ drivers/iommu/intel/pasid.h | 1 + drivers/iommu/iommu.c | 19 ++++++++--- include/linux/iommu.h | 2 +- 5 files changed, 87 insertions(+), 30 deletions(-) -- 2.22.0

2 3

[PATCH OLK-6.6] LoongArch: Return NULL from huge_pte_offset() for invalid PMD
by Xiaomeng Zhang 12 May '25

12 May '25

From: Ming Wang <wangming01(a)loongson.cn> stable inclusion from stable-v6.6.89 commit 2ca9380b12711afe95b3589bd82b59623b3c96b3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC6BTY CVE: CVE-2025-37818 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit bd51834d1cf65a2c801295d230c220aeebf87a73 upstream. LoongArch's huge_pte_offset() currently returns a pointer to a PMD slot even if the underlying entry points to invalid_pte_table (indicating no mapping). Callers like smaps_hugetlb_range() fetch this invalid entry value (the address of invalid_pte_table) via this pointer. The generic is_swap_pte() check then incorrectly identifies this address as a swap entry on LoongArch, because it satisfies the "!pte_present() && !pte_none()" conditions. This misinterpretation, combined with a coincidental match by is_migration_entry() on the address bits, leads to kernel crashes in pfn_swap_entry_to_page(). Fix this at the architecture level by modifying huge_pte_offset() to check the PMD entry's content using pmd_none() before returning. If the entry is invalid (i.e., it points to invalid_pte_table), return NULL instead of the pointer to the slot. Cc: stable(a)vger.kernel.org Acked-by: Peter Xu <peterx(a)redhat.com> Co-developed-by: Hongchen Zhang <zhanghongchen(a)loongson.cn> Signed-off-by: Hongchen Zhang <zhanghongchen(a)loongson.cn> Signed-off-by: Ming Wang <wangming01(a)loongson.cn> Signed-off-by: Huacai Chen <chenhuacai(a)loongson.cn> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: arch/loongarch/mm/hugetlbpage.c [The conflicts were due to some minor issue.] Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- arch/loongarch/mm/hugetlbpage.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/loongarch/mm/hugetlbpage.c b/arch/loongarch/mm/hugetlbpage.c index 62ddcea0aa14..aca52c42e94e 100644 --- a/arch/loongarch/mm/hugetlbpage.c +++ b/arch/loongarch/mm/hugetlbpage.c @@ -47,7 +47,7 @@ pte_t *huge_pte_offset(struct mm_struct *mm, unsigned long addr, pmd = pmd_offset(pud, addr); } } - return (pte_t *) pmd; + return pmd_none(pmdp_get(pmd)) ? NULL : (pte_t *) pmd; } int pmd_huge(pmd_t pmd) -- 2.34.1

2 1

Re: [Dev] openEuler 2026 年 LTS 版本内核选型公示
by Xie XiuQi 12 May '25

12 May '25

感谢反馈， On 2025/5/9 18:02, Funda Wang wrote: > 建议明确“2026 年 LTS 版本”意味着什么，因为这还涉及到 26.03 LTS 生命周期（约四年）内后续 SP 版本的内核版本序列。字面上的歧义尽可能避免。 > 2026 年 LTS 版本，就是说2026年新发的 LTS 版本，不管是不是叫 26.03，都是选择 6.6 版本。因为选型是内核先选型， 26.03 的计划还没有出来，所以，为了避免歧义，这里笼统的说 2026 年 LTS 版本。生命周期的问题：6.6 内核会支持 26 年发的 LTS 整个生命周期。至于后续的SP是否有多版本的内核，这是另外一个问题，为了公示邮件简单明确，这里没有把其他事情混在一起讲。 > > 在 2025-05-09 16:52:25，"Xie XiuQi" <xiexiuqi(a)huawei.com> 写道： >>各位开发者和用户， >> >> 经2025年5月9日 openEuler Kernel SIG 会议讨论，拟定继续使用 6.6 内核支撑 openEuler 2026 年 LTS 版本发布， >>特此公示。 >> 公示时间：2025-5-9 18:00 - 2025-5-23 18:00，公示14天。 >> 公示期间，如果您有任何意见，请邮件反馈至：xiexiuqi@huawei.com,jason.zeng@intel.com,sanglipeng1@jd.com. >>如需反馈意见，请说明您所在的团队，您的联系方式，并详细描述原因。您的反馈意见可能会在社区会议中公开讨论，请 >>不要包含保密信息。 >> >> openEuler Kernel SIG >> 2025年5月9日 >>_______________________________________________ >>Dev mailing list -- dev(a)openeuler.org >>To unsubscribe send an email to dev-leave(a)openeuler.org >

1 0

[PATCH OLK-5.10 v2 0/9] arm64: Support xcall prefetch
by Jinjie Ruan 12 May '25

12 May '25

Support arm64 xcall prefetch. Changes in v2: - Remove is_read_cache. - Simplify the ksys_read(). - Use percpu cache_hit/miss_wait and remove cache_queued and sync_mode. - Remove keep_running in prefetch_item struct. - Add /proc/xcall/stats dir. - Remove pfi in file struct and use hash table. Jinjie Ruan (3): arm64: Introduce Xint software solution arm64: Add debugfs dir for xint xcall: Add /proc/xcall/stats dir for performance tuning Liao Chen (1): revert kpti bypass Yipeng Zou (5): arm64: Introduce xcall a faster svc exception handling arm64: Faster SVC exception handler with xcall xcall: introduce xcall_select to implement a custom xcall function eventpoll: xcall: Support sync and async prefetch data in epoll xcall: eventpoll: add tracepoint arch/Kconfig | 64 +++++++ arch/arm64/Kconfig | 2 + arch/arm64/configs/openeuler_defconfig | 4 + arch/arm64/include/asm/cpucaps.h | 2 + arch/arm64/include/asm/exception.h | 6 + arch/arm64/include/asm/syscall.h | 14 ++ arch/arm64/include/asm/syscall_wrapper.h | 25 +++ arch/arm64/kernel/asm-offsets.c | 3 + arch/arm64/kernel/cpufeature.c | 54 ++++++ arch/arm64/kernel/entry-common.c | 22 +++ arch/arm64/kernel/entry.S | 183 +++++++++++++++++- arch/arm64/kernel/sys.c | 20 ++ arch/arm64/kernel/syscall.c | 69 +++++++ drivers/irqchip/irq-gic-v3.c | 123 ++++++++++++ fs/eventpoll.c | 232 +++++++++++++++++++++++ fs/open.c | 4 + fs/proc/base.c | 214 +++++++++++++++++++++ fs/read_write.c | 95 +++++++++- include/linux/fs.h | 31 +++ include/linux/hardirq.h | 5 + include/linux/irqchip/arm-gic-v3.h | 13 ++ include/linux/sched.h | 5 + include/linux/syscalls.h | 19 ++ include/trace/events/fs.h | 91 +++++++++ include/uapi/asm-generic/unistd.h | 11 ++ kernel/fork.c | 32 ++++ kernel/irq/debugfs.c | 33 ++++ kernel/irq/internals.h | 18 ++ kernel/irq/irqdesc.c | 19 ++ kernel/irq/proc.c | 10 + kernel/softirq.c | 73 +++++++ kernel/sysctl.c | 36 ++++ 32 files changed, 1529 insertions(+), 3 deletions(-) -- 2.34.1

2 10

[PATCH OLK-6.6] kvm: x86: fix infinite loop in kvm_guest_time_update when tsc is 0
by Yuntao Liu 12 May '25

12 May '25

Offering: HULK hulk inclusion category: bugfix bugzilla: 190614 -------------------------------- Syzkaller testing detected a soft lockup. watchdog: BUG: soft lockup - CPU#3 stuck for 127s! [syz.1.2088:9817] Modules linked in: CPU: 3 PID: 9817 Comm: syz.1.2088 Tainted: G S 6.6.0+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 RIP: 0010:__sanitizer_cov_trace_const_cmp4+0x8/0x20 kernel/kcov.c:313 Code: bf 03 00 00 00 e9 48 fe ff ff 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 48 8b 0c 24 <89> f2 89 fe bf 05 00 00 00 e9 1a fe ff ff 66 2e 0f 1f 84 00 00 00 RSP: 0018:ffff888016d8fad8 EFLAGS: 00000206 RAX: 0000000000080000 RBX: ffff88810e242540 RCX: ffffffff901150d6 RDX: 0000000000080000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffff888016d8fb50 R08: 0000000000000001 R09: ffffed1021c484af R10: 0000000000000000 R11: 0000000000000277 R12: 0000000000000000 R13: fffffed357281918 R14: 0000000000000000 R15: 0000000000000001 FS: 00007f2a8f6ea6c0(0000) GS:ffff888119780000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000012c56c0 CR3: 000000000dce8001 CR4: 0000000000772ee0 DR0: 0000000000000000 DR1: 0000000000d3eb1c DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 PKRU: 80000000 Call Trace: <TASK> kvm_get_time_scale arch/x86/kvm/x86.c:2458 [inline] kvm_guest_time_update+0x926/0xb00 arch/x86/kvm/x86.c:3268 vcpu_enter_guest.constprop.0+0x1e70/0x3cf0 arch/x86/kvm/x86.c:10678 vcpu_run+0x129/0x8d0 arch/x86/kvm/x86.c:11126 kvm_arch_vcpu_ioctl_run+0x37a/0x13d0 arch/x86/kvm/x86.c:11352 kvm_vcpu_ioctl+0x56b/0xe60 virt/kvm/kvm_main.c:4188 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:871 [inline] __se_sys_ioctl+0x12d/0x190 fs/ioctl.c:857 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x59/0x110 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x78/0xe2 test case: 18.689865147s ago: executing program 1 (id=2088): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000002080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_TSC_KHZ(r2, 0xaea2, 0x1) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000001c0)={'netdevsim0\x00', <r4=>0x0}) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x1, 0x4, 0x8000, 0x2, 0x0, 0xffffffffffffffff, 0x0, '\x00', r4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000100)={{r5}, &(0x7f0000000000), &(0x7f0000000040)='%ps \x00'}, 0x20) bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000000c0)={r5, &(0x7f0000001480)}, 0x20) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000000)={0x1ff, 0x3, 0x3000, 0x1000, &(0x7f0000fec000/0x1000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) openat$ipvs(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text64={0x40, &(0x7f0000000040)="26f2a70f3548b807000000000000000f23c00f21f835020008000f23f80fc73eb9330800000f326666470f3880be6cc468550f01cf360f01f80f30450f01c9", 0x3f}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_TSC_KHZ(r2, 0xaea2, 0x1) user_tsc_khz = 0x1 | kvm_set_tsc_khz(struct kvm_vcpu *vcpu, u32 user_tsc_khz) | ioctl$KVM_RUN(r2, 0xae80, 0x0) | ... kvm_guest_time_update(struct kvm_vcpu *v) | if (kvm_caps.has_tsc_control) tgt_tsc_khz = kvm_scale_tsc(tgt_tsc_khz, v->arch.l1_tsc_scaling_ratio); | kvm_scale_tsc(u64 tsc, u64 ratio) | __scale_tsc(u64 ratio, u64 tsc) ratio=122380531, tsc=2299998, N=48 ratio*tsc >> N = 0.999... -> 0 | kvm_get_time_scale In function __scale_tsc, it uses fixed point number to calculate tsc, therefore, a certain degree of precision is lost, the actual tsc value of 0.999... would be 0. In function kvm_get_time_scale tps32=tps64=base_hz=0, would lead second while_loop infinite. when CONFIG_PREEMPT is n, it causes a soft lockup issue. Signed-off-by: Yuntao Liu <liuyuntao12(a)huawei.com> --- arch/x86/kvm/x86.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 1fa5d89f8d27..92460a69ff0f 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -2605,10 +2605,12 @@ static void kvm_track_tsc_matching(struct kvm_vcpu *vcpu) * point number (mult + frac * 2^(-N)). * * N equals to kvm_caps.tsc_scaling_ratio_frac_bits. + * + * add 1 to compensate for precision loss. */ static inline u64 __scale_tsc(u64 ratio, u64 tsc) { - return mul_u64_u64_shr(tsc, ratio, kvm_caps.tsc_scaling_ratio_frac_bits); + return mul_u64_u64_shr(tsc, ratio, kvm_caps.tsc_scaling_ratio_frac_bits) + 1; } u64 kvm_scale_tsc(u64 tsc, u64 ratio) -- 2.34.1

2 1

[PATCH OLK-5.10 0/4] fuse: support fastpath
by chenrenhui 12 May '25

12 May '25

Support fuse fastpath by using the newly added fast_ipc module. Alessio Balsini (1): fuse: 32-bit user space ioctl compat for fuse device chenrenhui (2): ipc: add fast_ipc module to enable fast process switching fuse: support fastpath via fast_ipc yangyun (1): fuse: add fast path for fuse_range_is_writeback Kconfig | 2 + arch/arm64/configs/openeuler_defconfig | 2 + fs/fuse/Kconfig | 9 + fs/fuse/dev.c | 770 ++++++++++++++++++++++++- fs/fuse/dir.c | 87 ++- fs/fuse/file.c | 241 +++++++- fs/fuse/fuse_i.h | 55 ++ fs/fuse/inode.c | 112 ++++ fs/fuse/readdir.c | 8 + include/linux/fast_ipc.h | 48 ++ include/uapi/linux/fuse.h | 15 +- ipc/Kconfig | 6 + ipc/Makefile | 2 +- ipc/fast_ipc.c | 299 ++++++++++ 14 files changed, 1615 insertions(+), 41 deletions(-) create mode 100644 include/linux/fast_ipc.h create mode 100644 ipc/Kconfig create mode 100644 ipc/fast_ipc.c -- 2.33.0

2 5

[PATCH OLK-5.10] [Backport] backlight: led_bl: Hold led_access lock when calling led_sysfs_disable()
by Yuntao Liu 12 May '25

12 May '25

From: Herve Codina <herve.codina(a)bootlin.com> stable inclusion from stable-v5.10.237 commit 87d947a0607be384bfe7bb0935884a711e35ca07 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC5BJZ CVE: CVE-2025-23144 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 276822a00db3c1061382b41e72cafc09d6a0ec30 ] Lockdep detects the following issue on led-backlight removal: [ 142.315935] ------------[ cut here ]------------ [ 142.315954] WARNING: CPU: 2 PID: 292 at drivers/leds/led-core.c:455 led_sysfs_enable+0x54/0x80 ... [ 142.500725] Call trace: [ 142.503176] led_sysfs_enable+0x54/0x80 (P) [ 142.507370] led_bl_remove+0x80/0xa8 [led_bl] [ 142.511742] platform_remove+0x30/0x58 [ 142.515501] device_remove+0x54/0x90 ... Indeed, led_sysfs_enable() has to be called with the led_access lock held. Hold the lock when calling led_sysfs_disable(). Fixes: ae232e45acf9 ("backlight: add led-backlight driver") Cc: stable(a)vger.kernel.org Signed-off-by: Herve Codina <herve.codina(a)bootlin.com> Link: https://lore.kernel.org/r/20250122091914.309533-1-herve.codina@bootlin.com Signed-off-by: Lee Jones <lee(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yuntao Liu <liuyuntao12(a)huawei.com> --- drivers/video/backlight/led_bl.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/video/backlight/led_bl.c b/drivers/video/backlight/led_bl.c index f54d256e2d54..1020e4405a4d 100644 --- a/drivers/video/backlight/led_bl.c +++ b/drivers/video/backlight/led_bl.c @@ -226,8 +226,11 @@ static int led_bl_remove(struct platform_device *pdev) backlight_device_unregister(bl); led_bl_power_off(priv); - for (i = 0; i < priv->nb_leds; i++) + for (i = 0; i < priv->nb_leds; i++) { + mutex_lock(&priv->leds[i]->led_access); led_sysfs_enable(priv->leds[i]); + mutex_unlock(&priv->leds[i]->led_access); + } return 0; } -- 2.34.1

2 1