- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] ipc: fix to protect IPCS lookups using RCU
by Xia Fukun 15 Jul '25

15 Jul '25

From: Jeongjun Park <aha310510(a)gmail.com> mainline inclusion from mainline-v6.16-rc1 commit d66adabe91803ef34a8b90613c81267b5ded1472 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICK4NN CVE: CVE-2025-38212 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzbot reported that it discovered a use-after-free vulnerability, [0] [0]: https://lore.kernel.org/all/67af13f8.050a0220.21dd3.0038.GAE@google.com/ idr_for_each() is protected by rwsem, but this is not enough. If it is not protected by RCU read-critical region, when idr_for_each() calls radix_tree_node_free() through call_rcu() to free the radix_tree_node structure, the node will be freed immediately, and when reading the next node in radix_tree_for_each_slot(), the already freed memory may be read. Therefore, we need to add code to make sure that idr_for_each() is protected within the RCU read-critical region when we call it in shm_destroy_orphaned(). Link: https://lkml.kernel.org/r/20250424143322.18830-1-aha310510@gmail.com Fixes: b34a6b1da371 ("ipc: introduce shm_rmid_forced sysctl") Signed-off-by: Jeongjun Park <aha310510(a)gmail.com> Reported-by: syzbot+a2b84e569d06ca3a949c(a)syzkaller.appspotmail.com Cc: Jeongjun Park <aha310510(a)gmail.com> Cc: Liam Howlett <liam.howlett(a)oracle.com> Cc: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Cc: Matthew Wilcox (Oracle) <willy(a)infradead.org> Cc: Vasiliy Kulikov <segoon(a)openwall.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- ipc/shm.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ipc/shm.c b/ipc/shm.c index 0a5053f5726f..14282b7f9800 100644 --- a/ipc/shm.c +++ b/ipc/shm.c @@ -417,8 +417,11 @@ static int shm_try_destroy_orphaned(int id, void *p, void *data) void shm_destroy_orphaned(struct ipc_namespace *ns) { down_write(&shm_ids(ns).rwsem); - if (shm_ids(ns).in_use) + if (shm_ids(ns).in_use) { + rcu_read_lock(); idr_for_each(&shm_ids(ns).ipcs_idr, &shm_try_destroy_orphaned, ns); + rcu_read_unlock(); + } up_write(&shm_ids(ns).rwsem); } -- 2.34.1

2 1

[PATCH OLK-6.6 0/6] hns3: Fix debugfs inconsistency and optimize driver code (stack usage, timer init, readability)
by Donghua Huang 15 Jul '25

15 Jul '25

This patchset fixes debugfs query inconsistencies and optimizes the hns3 driver by reducing stack usage, improving timer initialization, and enhancing array handling readability. These changes improve the reliability and maintainability of the hns3 networking driver. Arnd Bergmann (1): net: hns3: reduce stack usage in hclge_dbg_dump_tm_pri() Hao Lan (1): net: hns3: Resolved the issue that the debugfs query result is inconsistent. Jian Shen (1): net: hns3: initialize reset_timer before hclgevf_misc_irq_init() Zhang Zekun (1): net: hns3: Use ARRAY_SIZE() to improve readability huangdonghua (2): Revert "net: hns3: initialize reset_timer before hclgevf_misc_irq_init()" Revert "net: hns3: Resolved the issue that the debugfs query result is inconsistent." drivers/net/ethernet/hisilicon/hns3/hnae3.h | 3 - .../ethernet/hisilicon/hns3/hns3_debugfs.c | 98 ++++++------------- .../hisilicon/hns3/hns3pf/hclge_debugfs.c | 21 ++-- .../hisilicon/hns3/hns3vf/hclgevf_main.c | 2 + .../hisilicon/hns3/hns3vf/hclgevf_regs.c | 8 +- 5 files changed, 51 insertions(+), 81 deletions(-) -- 2.33.0

2 7

[PATCH OLK-6.6 0/6] hns3: Fix debugfs inconsistency and optimize driver code (stack usage, timer init, readability)
by Donghua Huang 15 Jul '25

15 Jul '25

This patchset fixes debugfs query inconsistencies and optimizes the hns3 driver by reducing stack usage, improving timer initialization, and enhancing array handling readability. These changes improve the reliability and maintainability of the hns3 networking driver. Arnd Bergmann (1): net: hns3: reduce stack usage in hclge_dbg_dump_tm_pri() Hao Lan (1): net: hns3: Resolved the issue that the debugfs query result is inconsistent. Jian Shen (1): net: hns3: initialize reset_timer before hclgevf_misc_irq_init() Zhang Zekun (1): net: hns3: Use ARRAY_SIZE() to improve readability huangdonghua (2): Revert "net: hns3: initialize reset_timer before hclgevf_misc_irq_init()" Revert "net: hns3: Resolved the issue that the debugfs query result is inconsistent." drivers/net/ethernet/hisilicon/hns3/hnae3.h | 3 - .../ethernet/hisilicon/hns3/hns3_debugfs.c | 98 ++++++------------- .../hisilicon/hns3/hns3pf/hclge_debugfs.c | 21 ++-- .../hisilicon/hns3/hns3vf/hclgevf_main.c | 2 + .../hisilicon/hns3/hns3vf/hclgevf_regs.c | 8 +- 5 files changed, 51 insertions(+), 81 deletions(-) -- 2.33.0

2 7

[PATCH OLK-6.6] EDAC/skx_common: Fix general protection fault
by Xiaomeng Zhang 15 Jul '25

15 Jul '25

From: Qiuxu Zhuo <qiuxu.zhuo(a)intel.com> mainline inclusion from mainline-v6.16-rc1 commit 20d2d476b3ae18041be423671a8637ed5ffd6958 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICLGFA CVE: CVE-2025-38298 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- After loading i10nm_edac (which automatically loads skx_edac_common), if unload only i10nm_edac, then reload it and perform error injection testing, a general protection fault may occur: mce: [Hardware Error]: Machine check events logged Oops: general protection fault ... ... Workqueue: events mce_gen_pool_process RIP: 0010:string+0x53/0xe0 ... Call Trace: <TASK> ? die_addr+0x37/0x90 ? exc_general_protection+0x1e7/0x3f0 ? asm_exc_general_protection+0x26/0x30 ? string+0x53/0xe0 vsnprintf+0x23e/0x4c0 snprintf+0x4d/0x70 skx_adxl_decode+0x16a/0x330 [skx_edac_common] skx_mce_check_error.part.0+0xf8/0x220 [skx_edac_common] skx_mce_check_error+0x17/0x20 [skx_edac_common] ... The issue arose was because the variable 'adxl_component_count' (inside skx_edac_common), which counts the ADXL components, was not reset. During the reloading of i10nm_edac, the count was incremented by the actual number of ADXL components again, resulting in a count that was double the real number of ADXL components. This led to an out-of-bounds reference to the ADXL component array, causing the general protection fault above. Fix this issue by resetting the 'adxl_component_count' in adxl_put(), which is called during the unloading of {skx,i10nm}_edac. Fixes: 123b15863550 ("EDAC, i10nm: make skx_common.o a separate module") Reported-by: Feng Xu <feng.f.xu(a)intel.com> Signed-off-by: Qiuxu Zhuo <qiuxu.zhuo(a)intel.com> Signed-off-by: Tony Luck <tony.luck(a)intel.com> Tested-by: Feng Xu <feng.f.xu(a)intel.com> Link: https://lore.kernel.org/r/20250417150724.1170168-2-qiuxu.zhuo@intel.com Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/edac/skx_common.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/edac/skx_common.c b/drivers/edac/skx_common.c index 0b8aaf5f77d9..bef81976867e 100644 --- a/drivers/edac/skx_common.c +++ b/drivers/edac/skx_common.c @@ -115,6 +115,7 @@ EXPORT_SYMBOL_GPL(skx_adxl_get); void skx_adxl_put(void) { + adxl_component_count = 0; kfree(adxl_values); kfree(adxl_msg); } -- 2.34.1

2 1

[PATCH OLK-5.10] EDAC/skx_common: Fix general protection fault
by Xiaomeng Zhang 15 Jul '25

15 Jul '25

From: Qiuxu Zhuo <qiuxu.zhuo(a)intel.com> mainline inclusion from mainline-v6.16-rc1 commit 20d2d476b3ae18041be423671a8637ed5ffd6958 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICLGFA CVE: CVE-2025-38298 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- After loading i10nm_edac (which automatically loads skx_edac_common), if unload only i10nm_edac, then reload it and perform error injection testing, a general protection fault may occur: mce: [Hardware Error]: Machine check events logged Oops: general protection fault ... ... Workqueue: events mce_gen_pool_process RIP: 0010:string+0x53/0xe0 ... Call Trace: <TASK> ? die_addr+0x37/0x90 ? exc_general_protection+0x1e7/0x3f0 ? asm_exc_general_protection+0x26/0x30 ? string+0x53/0xe0 vsnprintf+0x23e/0x4c0 snprintf+0x4d/0x70 skx_adxl_decode+0x16a/0x330 [skx_edac_common] skx_mce_check_error.part.0+0xf8/0x220 [skx_edac_common] skx_mce_check_error+0x17/0x20 [skx_edac_common] ... The issue arose was because the variable 'adxl_component_count' (inside skx_edac_common), which counts the ADXL components, was not reset. During the reloading of i10nm_edac, the count was incremented by the actual number of ADXL components again, resulting in a count that was double the real number of ADXL components. This led to an out-of-bounds reference to the ADXL component array, causing the general protection fault above. Fix this issue by resetting the 'adxl_component_count' in adxl_put(), which is called during the unloading of {skx,i10nm}_edac. Fixes: 123b15863550 ("EDAC, i10nm: make skx_common.o a separate module") Reported-by: Feng Xu <feng.f.xu(a)intel.com> Signed-off-by: Qiuxu Zhuo <qiuxu.zhuo(a)intel.com> Signed-off-by: Tony Luck <tony.luck(a)intel.com> Tested-by: Feng Xu <feng.f.xu(a)intel.com> Link: https://lore.kernel.org/r/20250417150724.1170168-2-qiuxu.zhuo@intel.com Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/edac/skx_common.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/edac/skx_common.c b/drivers/edac/skx_common.c index 534d035c4ee8..3d912671d4a3 100644 --- a/drivers/edac/skx_common.c +++ b/drivers/edac/skx_common.c @@ -115,6 +115,7 @@ EXPORT_SYMBOL_GPL(skx_adxl_get); void skx_adxl_put(void) { + adxl_component_count = 0; kfree(adxl_values); kfree(adxl_msg); } -- 2.34.1

2 1

[PATCH OLK-6.6] crypto: algif_hash - fix double free in hash_accept
by Gu Bowen 15 Jul '25

15 Jul '25

From: Ivan Pravdin <ipravdin.official(a)gmail.com> stable inclusion from stable-v6.6.93 commit 134daaba93193df9e988524b5cd2f52d15eb1993 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICGACQ CVE: CVE-2025-38079 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit b2df03ed4052e97126267e8c13ad4204ea6ba9b6 upstream. If accept(2) is called on socket type algif_hash with MSG_MORE flag set and crypto_ahash_import fails, sk2 is freed. However, it is also freed in af_alg_release, leading to slab-use-after-free error. Fixes: fe869cdb89c9 ("crypto: algif_hash - User-space interface for hash operations") Cc: <stable(a)vger.kernel.org> Signed-off-by: Ivan Pravdin <ipravdin.official(a)gmail.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- crypto/algif_hash.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/crypto/algif_hash.c b/crypto/algif_hash.c index e24c829d7a01..5ab7441734b8 100644 --- a/crypto/algif_hash.c +++ b/crypto/algif_hash.c @@ -265,10 +265,6 @@ static int hash_accept(struct socket *sock, struct socket *newsock, int flags, goto out_free_state; err = crypto_ahash_import(&ctx2->req, state); - if (err) { - sock_orphan(sk2); - sock_put(sk2); - } out_free_state: kfree_sensitive(state); -- 2.25.1

2 1

[PATCH OLK-5.10] crypto: algif_hash - fix double free in hash_accept
by Gu Bowen 15 Jul '25

15 Jul '25

From: Ivan Pravdin <ipravdin.official(a)gmail.com> stable inclusion from stable-v5.10.238 commit bf7bba75b91539e93615f560893a599c1e1c98bf category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICGACQ CVE: CVE-2025-38079 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit b2df03ed4052e97126267e8c13ad4204ea6ba9b6 upstream. If accept(2) is called on socket type algif_hash with MSG_MORE flag set and crypto_ahash_import fails, sk2 is freed. However, it is also freed in af_alg_release, leading to slab-use-after-free error. Fixes: fe869cdb89c9 ("crypto: algif_hash - User-space interface for hash operations") Cc: <stable(a)vger.kernel.org> Signed-off-by: Ivan Pravdin <ipravdin.official(a)gmail.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- crypto/algif_hash.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/crypto/algif_hash.c b/crypto/algif_hash.c index 50f7b22f1b48..be21cfdc6dbc 100644 --- a/crypto/algif_hash.c +++ b/crypto/algif_hash.c @@ -262,10 +262,6 @@ static int hash_accept(struct socket *sock, struct socket *newsock, int flags, return err; err = crypto_ahash_import(&ctx2->req, state); - if (err) { - sock_orphan(sk2); - sock_put(sk2); - } return err; } -- 2.25.1

2 1

[PATCH OLK-6.6 0/2] v2:add perpcu stock for kmem
by Chen Ridong 15 Jul '25

15 Jul '25

v2:add perpcu stock for kmem Chen Ridong (2): memcg: add CONFIG_MEMCG_KMEM_STOCK memcg: add stock for kmem [un]charging arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + init/Kconfig | 14 +++ mm/memcontrol.c | 122 ++++++++++++++++++++++++- 4 files changed, 137 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH OLK-6.6 v3 0/5]mm: batched unmap lazyfree large folios
by Tong Tiangen 15 Jul '25

15 Jul '25

Commit 735ecdfaf4e8 ("mm/vmscan: avoid split lazyfree THP during shrink_folio_list()") prevents the splitting of MADV_FREE'd THP in madvise.c. However, those folios are still added to the deferred_split list in try_to_unmap_one() because we are unmapping PTEs and removing rmap entries one by one. Firstly, this has rendered the following counter somewhat confusing, /sys/kernel/mm/transparent_hugepage/hugepages-size/stats/split_deferred The split_deferred counter was originally designed to track operations such as partial unmap or madvise of large folios. However, in practice, most split_deferred cases arise from memory reclamation of aligned lazyfree mTHPs as observed by Tangquan. This discrepancy has made the split_deferred counter highly misleading. Secondly, this approach is slow because it requires iterating through each PTE and removing the rmap one by one for a large folio. In fact, all PTEs of a pte-mapped large folio should be unmapped at once, and the entire folio should be removed from the rmap as a whole. Thirdly, it also increases the risk of a race condition where lazyfree folios are incorrectly set back to swapbacked, as a speculative folio_get may occur in the shrinker's callback. deferred_split_scan() might call folio_try_get(folio) since we have added the folio to split_deferred list while removing rmap for the 1st subpage, and while we are scanning the 2nd to nr_pages PTEs of this folio in try_to_unmap_one(), the entire mTHP could be transitioned back to swap-backed because the reference count is incremented, which can make "ref_count == 1 + map_count" within try_to_unmap_one() false. /* * The only page refs must be one from isolation * plus the rmap(s) (dropped by discard:). */ if (ref_count == 1 + map_count && (!folio_test_dirty(folio) || ... (vma->vm_flags & VM_DROPPABLE))) { dec_mm_counter(mm, MM_ANONPAGES); goto discard; } This patchset resolves the issue by marking only genuinely dirty folios as swap-backed, as suggested by David, and transitioning to batched unmapping of entire folios in try_to_unmap_one(). Consequently, the deferred_split count drops to zero, and memory reclamation performance improves significantly — reclaiming 64KiB lazyfree large folios is now 2.5x faster(The specific data is embedded in the changelog of patch 3/4). By the way, while the patchset is primarily aimed at PTE-mapped large folios, Baolin and Lance also found that try_to_unmap_one() handles lazyfree redirtied PMD-mapped large folios inefficiently — it splits the PMD into PTEs and iterates over them. This patchset removes the unnecessary splitting, enabling us to skip redirtied PMD-mapped large folios 3.5X faster during memory reclamation. (The specific data can be found in the changelog of patch 4/4). v3: fix checkformat. v2: add bugfix patch5. Barry Song (4): mm: set folio swapbacked iff folios are dirty in try_to_unmap_one mm: support tlbbatch flush for a range of PTEs mm: support batched unmap for lazyfree large folios during reclamation mm: avoid splitting pmd for lazyfree pmd-mapped THP in try_to_unmap Lance Yang (1): mm/rmap: fix potential out-of-bounds page table access during batched unmap arch/arm64/include/asm/tlbflush.h | 23 +++-- arch/arm64/mm/contpte.c | 2 +- arch/x86/include/asm/tlbflush.h | 3 +- mm/huge_memory.c | 24 ++++-- mm/rmap.c | 139 ++++++++++++++++++++---------- 5 files changed, 125 insertions(+), 66 deletions(-) -- 2.25.1

2 6

[PATCH openEuler-24.03-LTS-SP2] ethtool: hibmcge: fix wrong register address in pretty print of ethtool -d command
by Donghua Huang 15 Jul '25

15 Jul '25

maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICM2CV CVE: NA Reference: https://git.kernel.org/pub/scm/network/ethtool/ethtool.git/commit/?id=196c3… ---------------------------------------------------------------------- The addresses of mac_addr_h and mac_addr_l are wrong, they need to be swapped. Signed-off-by: Donghua Huang <huangdonghua3(a)h-partners.com> --- ...in-pretty-print-of-ethtool-d-command.patch | 32 +++++++++++++++++++ ethtool.spec | 9 +++++- 2 files changed, 40 insertions(+), 1 deletion(-) create mode 100644 ethtool-hibmcge-fix-wrong-register-address-in-pretty-print-of-ethtool-d-command.patch diff --git a/ethtool-hibmcge-fix-wrong-register-address-in-pretty-print-of-ethtool-d-command.patch b/ethtool-hibmcge-fix-wrong-register-address-in-pretty-print-of-ethtool-d-command.patch new file mode 100644 index 0000000..0ae9252 --- /dev/null +++ b/ethtool-hibmcge-fix-wrong-register-address-in-pretty-print-of-ethtool-d-command.patch @@ -0,0 +1,32 @@ +From 196c3609ad9b8ad7a675d36cb2c5672d12ef3293 Mon Sep 17 00:00:00 2001 +From: Jijie Shao <shaojijie(a)huawei.com> +Date: Mon, 16 Jun 2025 21:18:40 +0800 +Subject: ethtool: hibmcge: fix wrong register address in pretty print of + ethtool -d command + +The addresses of mac_addr_h and mac_addr_l are wrong, +they need to be swapped. + +Fixes: d89f6ee9c12a ("hibmcge: add support dump registers for hibmcge driver") +Signed-off-by: Jijie Shao <shaojijie(a)huawei.com> +--- + hibmcge.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/hibmcge.c b/hibmcge.c +index 921efd2..ca81bc0 100644 +--- a/hibmcge.c ++++ b/hibmcge.c +@@ -36,8 +36,8 @@ static const struct hbg_offset_name_map hbg_spec_maps[] = { + {0x0004, "event_req"}, + {0x0008, "mac_id"}, + {0x000c, "phy_addr"}, +- {0x0010, "mac_addr_h"}, +- {0x0014, "mac_addr_l"}, ++ {0x0010, "mac_addr_l"}, ++ {0x0014, "mac_addr_h"}, + {0x0018, "uc_max_num"}, + {0x0024, "mdio_freq"}, + {0x0028, "max_mtu"}, +-- +cgit 1.2.3-korg \ No newline at end of file diff --git a/ethtool.spec b/ethtool.spec index fb2e3ca..4022bab 100644 --- a/ethtool.spec +++ b/ethtool.spec @@ -1,7 +1,7 @@ Name: ethtool Epoch: 2 Version: 6.6 -Release: 4 +Release: 5 Summary: Settings tool for Ethernet NICs License: GPL-2.0-only AND GPL-2.0-or-later URL: https://www.kernel.org/pub/software/network/ethtool @@ -10,6 +10,7 @@ Source0: https://www.kernel.org/pub/software/network/%{name}/%{name}-%{version}. Patch0: netlink-fix-typo.patch patch1: ethtool-add-suppport-specifications-for-vxlan-by-eth.patch patch2: backport-ethtool-add-support-dump-registers-for-hibmcge-drive.patch +patch3: ethtool-hibmcge-fix-wrong-register-address-in-pretty-print-of-ethtool-d-command.patch BuildRequires: gcc BuildRequires: libmnl-devel @@ -57,6 +58,12 @@ make check %{_mandir}/man8/%{name}.8* %changelog +* Mon Jul 14 2025 Donghua Huang <huangdonghua3(a)h-partners.com> - 2:6.6-5 +- Type:bugfix +- Id:NA +- SUG:NA +- DESC:fix wrong regs for hibmcge driver + * Wed Apr 16 2025 Hao Chen <chenhao418(a)huawei.com> - 2:6.6-4 - Type:bugfix - Id:NA -- 2.33.0

1 0