- Kernel - mailweb.openeuler.org

[openeuler:openEuler-1.0-LTS 1740/1740] mm/mem_reliable.c:272:5: sparse: sparse: symbol 'reliable_debug_handler' was not declared. Should it be static?
by kernel test robot 02 Sep '25

02 Sep '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 54968bf23106d2ac31ede8dca013a7fadeb3dd75 commit: 851a3ff0b4de68403c9a344c3d5378aa590705b7 [1740/1740] mm: Introduce proc interface to control memory reliable features config: arm64-randconfig-r121-20250729 (https://download.01.org/0day-ci/archive/20250902/202509020104.GWuHy81V-lkp@…) compiler: aarch64-linux-gcc (GCC) 15.1.0 reproduce: (https://download.01.org/0day-ci/archive/20250902/202509020104.GWuHy81V-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202509020104.GWuHy81V-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) mm/mem_reliable.c:52:14: sparse: sparse: restricted gfp_t degrades to integer mm/mem_reliable.c:199:5: sparse: sparse: symbol 'reliable_limit_handler' was not declared. Should it be static? >> mm/mem_reliable.c:272:5: sparse: sparse: symbol 'reliable_debug_handler' was not declared. Should it be static? mm/mem_reliable.c:199:5: warning: no previous prototype for 'reliable_limit_handler' [-Wmissing-prototypes] 199 | int reliable_limit_handler(struct ctl_table *table, int write, | ^~~~~~~~~~~~~~~~~~~~~~ mm/mem_reliable.c:272:5: warning: no previous prototype for 'reliable_debug_handler' [-Wmissing-prototypes] 272 | int reliable_debug_handler(struct ctl_table *table, int write, | ^~~~~~~~~~~~~~~~~~~~~~ vim +/reliable_debug_handler +272 mm/mem_reliable.c 271 > 272 int reliable_debug_handler(struct ctl_table *table, int write, 273 void __user *buffer, size_t *length, loff_t *ppos) 274 { 275 unsigned long old_ctrl_bits, new_ctrl_bits; 276 static DEFINE_MUTEX(reliable_debug_mutex); 277 int ret; 278 279 mutex_lock(&reliable_debug_mutex); 280 old_ctrl_bits = mem_reliable_ctrl_bits; 281 ret = proc_doulongvec_minmax(table, write, buffer, length, ppos); 282 if (ret == 0 && write) { 283 if (mem_reliable_ctrl_bits > (1 << CTRL_BITS_SHIFT) - 1) { 284 mem_reliable_ctrl_bits = old_ctrl_bits; 285 mutex_unlock(&reliable_debug_mutex); 286 287 return -EINVAL; 288 } 289 290 new_ctrl_bits = mem_reliable_ctrl_bits; 291 mem_reliable_ctrl_bits = old_ctrl_bits; 292 if (!!test_bit(MEM_RELIABLE_ALL, &new_ctrl_bits)) 293 mem_reliable_parse_ctrl_bits(new_ctrl_bits); 294 else 295 mem_reliable_disable_all(); 296 } 297 298 mutex_unlock(&reliable_debug_mutex); 299 300 return ret; 301 } 302 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1740/1740] include/linux/mem_reliable.h:41:15: sparse: sparse: restricted gfp_t degrades to integer
by kernel test robot 01 Sep '25

01 Sep '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 291b31b5afcf0c223cd3305c734a298f3193f9d3 commit: 33d1f46ad98ea3a13752a6360d97732ab4e119b9 [1740/1740] mm: Introduce memory reliable config: arm64-randconfig-r121-20250729 (https://download.01.org/0day-ci/archive/20250901/202509012150.u8RYNbiq-lkp@…) compiler: aarch64-linux-gcc (GCC) 15.1.0 reproduce: (https://download.01.org/0day-ci/archive/20250901/202509012150.u8RYNbiq-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202509012150.u8RYNbiq-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) mm/page_alloc.c:140:1: sparse: sparse: symbol 'pcpu_drain_mutex' was not declared. Should it be static? mm/page_alloc.c: note: in included file (through include/linux/mm.h): >> include/linux/mem_reliable.h:41:15: sparse: sparse: restricted gfp_t degrades to integer mm/page_alloc.c:4572:13: sparse: sparse: restricted gfp_t degrades to integer mm/page_alloc.c:4573:27: sparse: sparse: invalid assignment: |= mm/page_alloc.c:4573:27: sparse: left side has type restricted gfp_t mm/page_alloc.c:4573:27: sparse: right side has type unsigned int mm/page_alloc.c: note: in included file (through include/linux/mm.h): include/linux/gfp.h:457:34: sparse: sparse: restricted gfp_t degrades to integer include/linux/gfp.h:324:27: sparse: sparse: restricted gfp_t degrades to integer include/linux/gfp.h:324:27: sparse: sparse: restricted gfp_t degrades to integer include/linux/gfp.h:457:34: sparse: sparse: restricted gfp_t degrades to integer include/linux/gfp.h:457:34: sparse: sparse: restricted gfp_t degrades to integer mm/page_alloc.c: In function 'mem_init_print_info': mm/page_alloc.c:7373:27: warning: comparison between two arrays [-Warray-compare] 7373 | if (start <= pos && pos < end && size > adj) 20- | ^~ mm/page_alloc.c:7377:9: note: in expansion of macro 'adj_init_size' 7377 | adj_init_size(__init_begin, __init_end, init_data_size, | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:27: note: use '&__init_begin[0] <= &_sinittext[0]' to compare the addresses 7373 | if (start <= pos && pos < end && size > adj) 26- | ^~ mm/page_alloc.c:7377:9: note: in expansion of macro 'adj_init_size' 7377 | adj_init_size(__init_begin, __init_end, init_data_size, | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:41: warning: comparison between two arrays [-Warray-compare] 7373 | if (start <= pos && pos < end && size > adj) 32- | ^ mm/page_alloc.c:7377:9: note: in expansion of macro 'adj_init_size' 7377 | adj_init_size(__init_begin, __init_end, init_data_size, | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:41: note: use '&_sinittext[0] < &__init_end[0]' to compare the addresses 7373 | if (start <= pos && pos < end && size > adj) 38- | ^ mm/page_alloc.c:7377:9: note: in expansion of macro 'adj_init_size' 7377 | adj_init_size(__init_begin, __init_end, init_data_size, | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:27: warning: comparison between two arrays [-Warray-compare] 7373 | if (start <= pos && pos < end && size > adj) 44- | ^~ mm/page_alloc.c:7379:9: note: in expansion of macro 'adj_init_size' 7379 | adj_init_size(_stext, _etext, codesize, _sinittext, init_code_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:27: note: use '&_stext[0] <= &_sinittext[0]' to compare the addresses 7373 | if (start <= pos && pos < end && size > adj) 50- | ^~ mm/page_alloc.c:7379:9: note: in expansion of macro 'adj_init_size' 7379 | adj_init_size(_stext, _etext, codesize, _sinittext, init_code_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:41: warning: comparison between two arrays [-Warray-compare] 7373 | if (start <= pos && pos < end && size > adj) 56- | ^ mm/page_alloc.c:7379:9: note: in expansion of macro 'adj_init_size' 7379 | adj_init_size(_stext, _etext, codesize, _sinittext, init_code_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:41: note: use '&_sinittext[0] < &_etext[0]' to compare the addresses 7373 | if (start <= pos && pos < end && size > adj) 62- | ^ mm/page_alloc.c:7379:9: note: in expansion of macro 'adj_init_size' 7379 | adj_init_size(_stext, _etext, codesize, _sinittext, init_code_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:27: warning: comparison between two arrays [-Warray-compare] 7373 | if (start <= pos && pos < end && size > adj) 68- | ^~ mm/page_alloc.c:7380:9: note: in expansion of macro 'adj_init_size' 7380 | adj_init_size(_sdata, _edata, datasize, __init_begin, init_data_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:27: note: use '&_sdata[0] <= &__init_begin[0]' to compare the addresses 7373 | if (start <= pos && pos < end && size > adj) 74- | ^~ mm/page_alloc.c:7380:9: note: in expansion of macro 'adj_init_size' 7380 | adj_init_size(_sdata, _edata, datasize, __init_begin, init_data_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:41: warning: comparison between two arrays [-Warray-compare] 7373 | if (start <= pos && pos < end && size > adj) 80- | ^ mm/page_alloc.c:7380:9: note: in expansion of macro 'adj_init_size' 7380 | adj_init_size(_sdata, _edata, datasize, __init_begin, init_data_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:41: note: use '&__init_begin[0] < &_edata[0]' to compare the addresses 7373 | if (start <= pos && pos < end && size > adj) 86- | ^ mm/page_alloc.c:7380:9: note: in expansion of macro 'adj_init_size' 7380 | adj_init_size(_sdata, _edata, datasize, __init_begin, init_data_size); | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:27: warning: comparison between two arrays [-Warray-compare] 7373 | if (start <= pos && pos < end && size > adj) 92- | ^~ mm/page_alloc.c:7381:9: note: in expansion of macro 'adj_init_size' 7381 | adj_init_size(_stext, _etext, codesize, __start_rodata, rosize); | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:27: note: use '&_stext[0] <= &__start_rodata[0]' to compare the addresses 7373 | if (start <= pos && pos < end && size > adj) 98- | ^~ mm/page_alloc.c:7381:9: note: in expansion of macro 'adj_init_size' 7381 | adj_init_size(_stext, _etext, codesize, __start_rodata, rosize); | ^~~~~~~~~~~~~ mm/page_alloc.c:7373:41: warning: comparison between two arrays [-Warray-compare] 7373 | if (start <= pos && pos < end && size > adj) 104- | ^ mm/page_alloc.c:7381:9: note: in expansion of macro 'adj_init_size' 7381 | adj_init_size(_stext, _etext, codesize, __start_rodata, rosize); vim +41 include/linux/mem_reliable.h 31 32 static inline bool skip_none_movable_zone(gfp_t gfp, struct zoneref *z) 33 { 34 if (!mem_reliable_is_enabled()) 35 return false; 36 37 if (!current->mm || (current->flags & PF_KTHREAD)) 38 return false; 39 40 /* user tasks can only alloc memory from non-mirrored region */ > 41 if (!(gfp & ___GFP_RELIABILITY) && (gfp & __GFP_HIGHMEM) && 42 (gfp & __GFP_MOVABLE)) { 43 if (zonelist_zone_idx(z) < ZONE_MOVABLE) 44 return true; 45 } 46 47 return false; 48 } 49 #else 50 #define reliable_enabled 0 51 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] xfrm: interface: fix use-after-free after changing collect_md xfrm interface
by Zhang Changzhong 01 Sep '25

01 Sep '25

From: Eyal Birger <eyal.birger(a)gmail.com> stable inclusion from stable-v6.6.101 commit bfebdb85496e1da21d3cf05de099210915c3e706 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICT8XQ CVE: CVE-2025-38500 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a90b2a1aaacbcf0f91d7e4868ad6c51c5dee814b ] collect_md property on xfrm interfaces can only be set on device creation, thus xfrmi_changelink() should fail when called on such interfaces. The check to enforce this was done only in the case where the xi was returned from xfrmi_locate() which doesn't look for the collect_md interface, and thus the validation was never reached. Calling changelink would thus errornously place the special interface xi in the xfrmi_net->xfrmi hash, but since it also exists in the xfrmi_net->collect_md_xfrmi pointer it would lead to a double free when the net namespace was taken down [1]. Change the check to use the xi from netdev_priv which is available earlier in the function to prevent changes in xfrm collect_md interfaces. [1] resulting oops: [ 8.516540] kernel BUG at net/core/dev.c:12029! [ 8.516552] Oops: invalid opcode: 0000 [#1] SMP NOPTI [ 8.516559] CPU: 0 UID: 0 PID: 12 Comm: kworker/u80:0 Not tainted 6.15.0-virtme #5 PREEMPT(voluntary) [ 8.516565] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 8.516569] Workqueue: netns cleanup_net [ 8.516579] RIP: 0010:unregister_netdevice_many_notify+0x101/0xab0 [ 8.516590] Code: 90 0f 0b 90 48 8b b0 78 01 00 00 48 8b 90 80 01 00 00 48 89 56 08 48 89 32 4c 89 80 78 01 00 00 48 89 b8 80 01 00 00 eb ac 90 <0f> 0b 48 8b 45 00 4c 8d a0 88 fe ff ff 48 39 c5 74 5c 41 80 bc 24 [ 8.516593] RSP: 0018:ffffa93b8006bd30 EFLAGS: 00010206 [ 8.516598] RAX: ffff98fe4226e000 RBX: ffffa93b8006bd58 RCX: ffffa93b8006bc60 [ 8.516601] RDX: 0000000000000004 RSI: 0000000000000000 RDI: dead000000000122 [ 8.516603] RBP: ffffa93b8006bdd8 R08: dead000000000100 R09: ffff98fe4133c100 [ 8.516605] R10: 0000000000000000 R11: 00000000000003d2 R12: ffffa93b8006be00 [ 8.516608] R13: ffffffff96c1a510 R14: ffffffff96c1a510 R15: ffffa93b8006be00 [ 8.516615] FS: 0000000000000000(0000) GS:ffff98fee73b7000(0000) knlGS:0000000000000000 [ 8.516619] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 8.516622] CR2: 00007fcd2abd0700 CR3: 000000003aa40000 CR4: 0000000000752ef0 [ 8.516625] PKRU: 55555554 [ 8.516627] Call Trace: [ 8.516632] <TASK> [ 8.516635] ? rtnl_is_locked+0x15/0x20 [ 8.516641] ? unregister_netdevice_queue+0x29/0xf0 [ 8.516650] ops_undo_list+0x1f2/0x220 [ 8.516659] cleanup_net+0x1ad/0x2e0 [ 8.516664] process_one_work+0x160/0x380 [ 8.516673] worker_thread+0x2aa/0x3c0 [ 8.516679] ? __pfx_worker_thread+0x10/0x10 [ 8.516686] kthread+0xfb/0x200 [ 8.516690] ? __pfx_kthread+0x10/0x10 [ 8.516693] ? __pfx_kthread+0x10/0x10 [ 8.516697] ret_from_fork+0x82/0xf0 [ 8.516705] ? __pfx_kthread+0x10/0x10 [ 8.516709] ret_from_fork_asm+0x1a/0x30 [ 8.516718] </TASK> Fixes: abc340b38ba2 ("xfrm: interface: support collect metadata mode") Reported-by: Lonial Con <kongln9170(a)gmail.com> Signed-off-by: Eyal Birger <eyal.birger(a)gmail.com> Signed-off-by: Steffen Klassert <steffen.klassert(a)secunet.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/xfrm/xfrm_interface_core.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/net/xfrm/xfrm_interface_core.c b/net/xfrm/xfrm_interface_core.c index 21d50d7..84f0781 100644 --- a/net/xfrm/xfrm_interface_core.c +++ b/net/xfrm/xfrm_interface_core.c @@ -880,7 +880,7 @@ static int xfrmi_changelink(struct net_device *dev, struct nlattr *tb[], return -EINVAL; } - if (p.collect_md) { + if (p.collect_md || xi->p.collect_md) { NL_SET_ERR_MSG(extack, "collect_md can't be changed"); return -EINVAL; } @@ -891,11 +891,6 @@ static int xfrmi_changelink(struct net_device *dev, struct nlattr *tb[], } else { if (xi->dev != dev) return -EEXIST; - if (xi->p.collect_md) { - NL_SET_ERR_MSG(extack, - "device can't be changed to collect_md"); - return -EINVAL; - } } return xfrmi_update(xi, &p); -- 2.9.5

2 1

[PATCH OLK-6.6 0/2] CVE-2025-37752
by Zhang Changzhong 01 Sep '25

01 Sep '25

Octavian Purdila (2): net_sched: sch_sfq: use a temporary work area for validating configuration net_sched: sch_sfq: move the limit validation net/sched/sch_sfq.c | 66 ++++++++++++++++++++++++++++++++++++++++------------- 1 file changed, 50 insertions(+), 16 deletions(-) -- 2.9.5

2 3

[PATCH openEuler-1.0-LTS] NFSv4: Fail mounts if the lease setup times out
by Li Lingfeng 01 Sep '25

01 Sep '25

From: Trond Myklebust <trond.myklebust(a)hammerspace.com> mainline inclusion from mainline-v6.12-rc1 commit af94dca79b1296a6db7b8b47cd43be8e94fce8bb category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICMK5J Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If the server is down when the client is trying to mount, so that the calls to exchange_id or create_session fail, then we should allow the mount system call to fail rather than hang and block other mount/umount calls. Reported-by: Oleksandr Tymoshenko <ovt(a)google.com> Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Signed-off-by: Anna Schumaker <anna.schumaker(a)oracle.com> Conflicts: fs/nfs/nfs4state.c [Commit 67e7b52d44e3 ("NFSv4: Ensure state recovery handles ETIMEDOUT correctly") removed -ETIMEDOUT from nfs4_handle_reclaim_lease_error.] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfs/nfs4state.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c index 4a06e5ae0cba..5411847cb820 100644 --- a/fs/nfs/nfs4state.c +++ b/fs/nfs/nfs4state.c @@ -1955,9 +1955,13 @@ static int nfs4_handle_reclaim_lease_error(struct nfs_client *clp, int status) nfs_mark_client_ready(clp, -EPERM); clear_bit(NFS4CLNT_LEASE_CONFIRM, &clp->cl_state); return -EPERM; + case -ETIMEDOUT: + if (clp->cl_cons_state == NFS_CS_SESSION_INITING) { + nfs_mark_client_ready(clp, -EIO); + return -EIO; + } case -EACCES: case -NFS4ERR_DELAY: - case -ETIMEDOUT: case -EAGAIN: ssleep(1); break; -- 2.31.1

2 1

[PATCH OLK-6.6] fs/resctrl: Fix max_threshold_occupancy write operation
by Zeng Heng 01 Sep '25

01 Sep '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICVT69 -------------------------------- Since L2_MON does not support the limbo mechanism, the max_threshold_occupancy interface does not allow updates. If a write operation is attempted, skip it simply and return nbytes. Fixes: da5038956e65 ("fs/resctrl: L2_MON does not support the limbo mechanism") Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- fs/resctrl/rdtgroup.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/resctrl/rdtgroup.c b/fs/resctrl/rdtgroup.c index 86567d32e4df..4e0b2dfaa436 100644 --- a/fs/resctrl/rdtgroup.c +++ b/fs/resctrl/rdtgroup.c @@ -1336,7 +1336,7 @@ static ssize_t max_threshold_occ_write(struct kernfs_open_file *of, int ret; if (r->cache_level != 3) - return 0; + goto out; ret = kstrtouint(buf, 0, &bytes); if (ret) @@ -1347,6 +1347,7 @@ static ssize_t max_threshold_occ_write(struct kernfs_open_file *of, resctrl_rmid_realloc_threshold = resctrl_arch_round_mon_val(bytes); +out: return nbytes; } -- 2.25.1

2 1

[PATCH OLK-6.6] arm64/mpam: Fix num_rmids when enable CDP mode
by Zeng Heng 01 Sep '25

01 Sep '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICVT5V -------------------------------- At initialization, the number of RMIDs is set to num_of_PARTID * num_of_PMG. When resctrl is later mounted in CDP mode, however, the RMID count should be halved, just like the CLOSID count. Because CDP mode is activated during the mount operation, update the num_of_RMID in rdt_enable_ctx(). Fixes: ae6bcabac715 ("arm64/mpam: Fix num_rmids information") Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/platform/mpam/mpam_resctrl.c | 8 +++++++- include/linux/arm_mpam.h | 2 +- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/platform/mpam/mpam_resctrl.c b/drivers/platform/mpam/mpam_resctrl.c index c4049cbfe8eb..bb350d672836 100644 --- a/drivers/platform/mpam/mpam_resctrl.c +++ b/drivers/platform/mpam/mpam_resctrl.c @@ -101,11 +101,17 @@ bool resctrl_arch_get_cdp_enabled(enum resctrl_res_level rid) } } -int resctrl_arch_set_cdp_enabled(enum resctrl_res_level ignored, bool enable) +int resctrl_arch_set_cdp_enabled(enum resctrl_res_level rid, bool enable) { u64 regval; + struct rdt_resource *r; u32 partid, partid_i, partid_d; + r = resctrl_arch_get_resource(rid); + r->num_rmid = resctrl_arch_system_num_rmid_idx(); + if (enable) + r->num_rmid >>= 1; + cdp_enabled = enable; partid = RESCTRL_RESERVED_CLOSID; diff --git a/include/linux/arm_mpam.h b/include/linux/arm_mpam.h index 3a06a8afad7c..0c14f62a0e8f 100644 --- a/include/linux/arm_mpam.h +++ b/include/linux/arm_mpam.h @@ -74,7 +74,7 @@ bool resctrl_arch_would_mbm_overflow(void); void resctrl_arch_reset_resources(void); bool resctrl_arch_get_cdp_enabled(enum resctrl_res_level ignored); -int resctrl_arch_set_cdp_enabled(enum resctrl_res_level ignored, bool enable); +int resctrl_arch_set_cdp_enabled(enum resctrl_res_level rid, bool enable); bool resctrl_arch_hide_cdp(enum resctrl_res_level rid); bool resctrl_arch_match_closid(struct task_struct *tsk, u32 closid); bool resctrl_arch_match_rmid(struct task_struct *tsk, u32 closid, u32 rmid); -- 2.25.1

2 1

[PATCH OLK-6.6] mm/hugetlb: fix set_max_huge_pages() when there are surplus pages
by Jinjiang Tu 01 Sep '25

01 Sep '25

mainline inclusion from mainline-v6.15-rc3 commit aabf58bfaacedb3f54801ba09c6d50daf83b74f4 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICVOMX Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In set_max_huge_pages(), min_count is computed taking into account surplus huge pages, which might lead in some cases to not be able to free huge pages and end up accounting them as surplus instead. One way to solve it is to subtract surplus_huge_pages directly, but we cannot do it blindly because there might be surplus pages that are also free pages, which might happen when we fail to restore the vmemmap for optimized hvo pages. So we could be subtracting the same page twice. In order to work this around, let us first compute the number of free persistent pages, and use that along with surplus pages to compute min_count. Steps to reproduce: 1) create 5 hugetlb folios in Node0 2) run a program to use all the hugetlb folios 3) echo 0 > nr_hugepages for Node0 to free the hugetlb folios. Thus the 5 hugetlb folios in Node0 are accounted as surplus. 4) create 5 hugetlb folios in Node1 5) echo 0 > nr_hugepages for Node1 to free the hugetlb folios The result: Node0 Node1 Total 5 5 Free 0 5 Surp 5 5 The result with this patch: Node0 Node1 Total 5 0 Free 0 0 Surp 5 0 Link: https://lkml.kernel.org/r/20250409055957.3774471-1-tujinjiang@huawei.com Link: https://lkml.kernel.org/r/20250407124706.2688092-1-tujinjiang@huawei.com Fixes: 9a30523066cd ("hugetlb: add per node hstate attributes") Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> Acked-by: Oscar Salvador <osalvador(a)suse.de> Cc: David Hildenbrand <david(a)redhat.com> Cc: Kefeng Wang <wangkefeng.wang(a)huawei.com> Cc: Muchun Song <muchun.song(a)linux.dev> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: mm/hugetlb.c [Context conflicts.] Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- mm/hugetlb.c | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index 090da344e4b7..bad0dcf0faeb 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -3727,6 +3727,7 @@ static int adjust_pool_surplus(struct hstate *h, nodemask_t *nodes_allowed, static int set_max_huge_pages(struct hstate *h, unsigned long count, int nid, nodemask_t *nodes_allowed) { + unsigned long persistent_free_count; unsigned long min_count, ret; struct page *page; LIST_HEAD(page_list); @@ -3841,8 +3842,24 @@ static int set_max_huge_pages(struct hstate *h, unsigned long count, int nid, * though, we'll note that we're not allowed to exceed surplus * and won't grow the pool anywhere else. Not until one of the * sysctls are changed, or the surplus pages go out of use. + * + * min_count is the expected number of persistent pages, we + * shouldn't calculate min_count by using + * resv_huge_pages + persistent_huge_pages() - free_huge_pages, + * because there may exist free surplus huge pages, and this will + * lead to subtracting twice. Free surplus huge pages come from HVO + * failing to restore vmemmap, see comments in the callers of + * hugetlb_vmemmap_restore_folio(). Thus, we should calculate + * persistent free count first. */ - min_count = h->resv_huge_pages + h->nr_huge_pages - h->free_huge_pages; + persistent_free_count = h->free_huge_pages; + if (h->free_huge_pages > persistent_huge_pages(h)) { + if (h->free_huge_pages > h->surplus_huge_pages) + persistent_free_count -= h->surplus_huge_pages; + else + persistent_free_count = 0; + } + min_count = h->resv_huge_pages + persistent_huge_pages(h) - persistent_free_count; min_count = max(count, min_count); try_to_free_low(h, min_count, nodes_allowed); -- 2.43.0

2 1

[PATCH OLK-6.6 v2] perf/aux: Fix pending disable flow when the AUX ring buffer overruns
by Pu Lehui 01 Sep '25

01 Sep '25

From: Leo Yan <leo.yan(a)arm.com> mainline inclusion from mainline-v6.16-rc4 commit 1476b218327b89bbb64c14619a2d34f0c320f2c3 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICVQU8 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If an AUX event overruns, the event core layer intends to disable the event by setting the 'pending_disable' flag. Unfortunately, the event is not actually disabled afterwards. In commit: ca6c21327c6a ("perf: Fix missing SIGTRAPs") the 'pending_disable' flag was changed to a boolean. However, the AUX event code was not updated accordingly. The flag ends up holding a CPU number. If this number is zero, the flag is taken as false and the IRQ work is never triggered. Later, with commit: 2b84def990d3 ("perf: Split __perf_pending_irq() out of perf_pending_irq()") a new IRQ work 'pending_disable_irq' was introduced to handle event disabling. The AUX event path was not updated to kick off the work queue. To fix this bug, when an AUX ring buffer overrun is detected, call perf_event_disable_inatomic() to initiate the pending disable flow. Also update the outdated comment for setting the flag, to reflect the boolean values (0 or 1). Fixes: 2b84def990d3 ("perf: Split __perf_pending_irq() out of perf_pending_irq()") Fixes: ca6c21327c6a ("perf: Fix missing SIGTRAPs") Signed-off-by: Leo Yan <leo.yan(a)arm.com> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Reviewed-by: James Clark <james.clark(a)linaro.org> Reviewed-by: Yeoreum Yun <yeoreum.yun(a)arm.com> Cc: Adrian Hunter <adrian.hunter(a)intel.com> Cc: Alexander Shishkin <alexander.shishkin(a)linux.intel.com> Cc: Arnaldo Carvalho de Melo <acme(a)kernel.org> Cc: Ian Rogers <irogers(a)google.com> Cc: Jiri Olsa <jolsa(a)redhat.com> Cc: Liang Kan <kan.liang(a)linux.intel.com> Cc: Marco Elver <elver(a)google.com> Cc: Mark Rutland <mark.rutland(a)arm.com> Cc: Namhyung Kim <namhyung(a)kernel.org> Cc: Peter Zijlstra <peterz(a)infradead.org> Cc: Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> Cc: linux-perf-users(a)vger.kernel.org Link: https://lore.kernel.org/r/20250625170737.2918295-1-leo.yan@arm.com Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/events/core.c | 6 +++--- kernel/events/ring_buffer.c | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/kernel/events/core.c b/kernel/events/core.c index 1ee8084e343d..ec89dc39ae16 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -6807,15 +6807,15 @@ static void __perf_pending_irq(struct perf_event *event) * CPU-A CPU-B * * perf_event_disable_inatomic() - * @pending_disable = CPU-A; + * @pending_disable = 1; * irq_work_queue(); * * sched-out - * @pending_disable = -1; + * @pending_disable = 0; * * sched-in * perf_event_disable_inatomic() - * @pending_disable = CPU-B; + * @pending_disable = 1; * irq_work_queue(); // FAILS * * irq_work_run() diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c index cfd9448ce28f..610e9b22f0c4 100644 --- a/kernel/events/ring_buffer.c +++ b/kernel/events/ring_buffer.c @@ -437,7 +437,7 @@ void *perf_aux_output_begin(struct perf_output_handle *handle, * store that will be enabled on successful return */ if (!handle->size) { /* A, matches D */ - event->pending_disable = smp_processor_id(); + perf_event_disable_inatomic(handle->event); perf_output_wakeup(handle); WRITE_ONCE(rb->aux_nest, 0); goto err_put; @@ -522,7 +522,7 @@ void perf_aux_output_end(struct perf_output_handle *handle, unsigned long size) if (wakeup) { if (handle->aux_flags & PERF_AUX_FLAG_TRUNCATED) - handle->event->pending_disable = smp_processor_id(); + perf_event_disable_inatomic(handle->event); perf_output_wakeup(handle); } -- 2.34.1

2 1

[PATCH OLK-6.6] cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate()
by Lin Yujun 01 Sep '25

01 Sep '25

From: Henry Martin <bsdhenrymartin(a)gmail.com> stable inclusion from stable-v6.6.89 commit 19e0eaa62e8831f2bc0285fef3bf8faaa7f3e09b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC6BI0 CVE: CVE-2025-37829 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 73b24dc731731edf762f9454552cb3a5b7224949 ] cpufreq_cpu_get_raw() can return NULL when the target CPU is not present in the policy->cpus mask. scpi_cpufreq_get_rate() does not check for this case, which results in a NULL pointer dereference. Fixes: 343a8d17fa8d ("cpufreq: scpi: remove arm_big_little dependency") Signed-off-by: Henry Martin <bsdhenrymartin(a)gmail.com> Acked-by: Sudeep Holla <sudeep.holla(a)arm.com> Signed-off-by: Viresh Kumar <viresh.kumar(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Yujun <linyujun809(a)h-partners.com> --- drivers/cpufreq/scpi-cpufreq.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/drivers/cpufreq/scpi-cpufreq.c b/drivers/cpufreq/scpi-cpufreq.c index d33be56983ed..e7abab7ebde9 100644 --- a/drivers/cpufreq/scpi-cpufreq.c +++ b/drivers/cpufreq/scpi-cpufreq.c @@ -29,9 +29,16 @@ static struct scpi_ops *scpi_ops; static unsigned int scpi_cpufreq_get_rate(unsigned int cpu) { - struct cpufreq_policy *policy = cpufreq_cpu_get_raw(cpu); - struct scpi_data *priv = policy->driver_data; - unsigned long rate = clk_get_rate(priv->clk); + struct cpufreq_policy *policy; + struct scpi_data *priv; + unsigned long rate; + + policy = cpufreq_cpu_get_raw(cpu); + if (unlikely(!policy)) + return 0; + + priv = policy->driver_data; + rate = clk_get_rate(priv->clk); return rate / 1000; } -- 2.34.1

2 1