- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 0/6] xsched: XCU Partition
by Zicheng Qu 08 Dec '25

08 Dec '25

Zicheng Qu (6): xsched: refactor CFS per-XCU rq init/deinit paths xsched: fix NULL pointer risk on attach entry allocation xsched: fix concurrent modification NULL pointer dereference in xcu.sched_class xsched: fix hung_task caused by cgroup_file_show and xcg_mutex deadlock xsched: prevent NULL deref by refcounting css and tracking offline state xsched: fix divide-by-zero caused by u64 overflow in CFS shares weight calculation include/linux/xsched.h | 27 ++++- kernel/xsched/cfs.c | 31 +++++- kernel/xsched/cfs_quota.c | 7 ++ kernel/xsched/cgroup.c | 219 +++++++++++++++++++++----------------- 4 files changed, 179 insertions(+), 105 deletions(-) -- 2.34.1

2 7

[openeuler:OLK-6.6 3485/3485] mm/internal.h:1522:55: warning: diagnostic behavior may be improved by adding the 'format(printf, 2, 0)' attribute to the declaration of 'shrinker_debugfs_name_alloc'
by kernel test robot 08 Dec '25

08 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: b3214ddbe58a44bd3829617668a8d301c8f1994e commit: 5d638f251ef64f68766caaeaf41fbe159807b392 [3485/3485] mm: shrinker: add infrastructure for dynamically allocating shrinker config: arm64-randconfig-004-20251208 (https://download.01.org/0day-ci/archive/20251208/202512081644.0Feaab8s-lkp@…) compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project 000e46219ba1ee53fc42d35e00c314c2807e8b14) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251208/202512081644.0Feaab8s-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512081644.0Feaab8s-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from mm/secretmem.c:26: >> mm/internal.h:1522:55: warning: diagnostic behavior may be improved by adding the 'format(printf, 2, 0)' attribute to the declaration of 'shrinker_debugfs_name_alloc' [-Wmissing-format-attribute] 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | __attribute__((format(printf, 2, 0))) 1520 | const char *fmt, va_list ap) 1521 | { 1522 | shrinker->name = kvasprintf_const(GFP_KERNEL, fmt, ap); | ^ mm/internal.h:1519:19: note: 'shrinker_debugfs_name_alloc' declared here 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | ^ 1 warning generated. -- In file included from mm/page_alloc.c:59: >> mm/internal.h:1522:55: warning: diagnostic behavior may be improved by adding the 'format(printf, 2, 0)' attribute to the declaration of 'shrinker_debugfs_name_alloc' [-Wmissing-format-attribute] 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | __attribute__((format(printf, 2, 0))) 1520 | const char *fmt, va_list ap) 1521 | { 1522 | shrinker->name = kvasprintf_const(GFP_KERNEL, fmt, ap); | ^ mm/internal.h:1519:19: note: 'shrinker_debugfs_name_alloc' declared here 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | ^ mm/page_alloc.c:7210:20: warning: unused function 'has_unaccepted_memory' [-Wunused-function] 7210 | static inline bool has_unaccepted_memory(void) | ^~~~~~~~~~~~~~~~~~~~~ 2 warnings generated. -- In file included from mm/shrinker.c:7: >> mm/internal.h:1522:55: warning: diagnostic behavior may be improved by adding the 'format(printf, 2, 0)' attribute to the declaration of 'shrinker_debugfs_name_alloc' [-Wmissing-format-attribute] 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | __attribute__((format(printf, 2, 0))) 1520 | const char *fmt, va_list ap) 1521 | { 1522 | shrinker->name = kvasprintf_const(GFP_KERNEL, fmt, ap); | ^ mm/internal.h:1519:19: note: 'shrinker_debugfs_name_alloc' declared here 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | ^ >> mm/shrinker.c:565:53: warning: diagnostic behavior may be improved by adding the 'format(printf, 2, 3)' attribute to the declaration of 'shrinker_alloc' [-Wmissing-format-attribute] 565 | err = shrinker_debugfs_name_alloc(shrinker, fmt, ap); | ^ include/linux/shrinker.h:111:18: note: 'shrinker_alloc' declared here 111 | struct shrinker *shrinker_alloc(unsigned int flags, const char *fmt, ...); | ^ 2 warnings generated. -- In file included from mm/list_lru.c:16: >> mm/internal.h:1522:55: warning: diagnostic behavior may be improved by adding the 'format(printf, 2, 0)' attribute to the declaration of 'shrinker_debugfs_name_alloc' [-Wmissing-format-attribute] 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | __attribute__((format(printf, 2, 0))) 1520 | const char *fmt, va_list ap) 1521 | { 1522 | shrinker->name = kvasprintf_const(GFP_KERNEL, fmt, ap); | ^ mm/internal.h:1519:19: note: 'shrinker_debugfs_name_alloc' declared here 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | ^ mm/list_lru.c:98:20: warning: unused function 'list_lru_memcg_aware' [-Wunused-function] 98 | static inline bool list_lru_memcg_aware(struct list_lru *lru) | ^~~~~~~~~~~~~~~~~~~~ 2 warnings generated. -- In file included from mm/madvise.c:37: >> mm/internal.h:1522:55: warning: diagnostic behavior may be improved by adding the 'format(printf, 2, 0)' attribute to the declaration of 'shrinker_debugfs_name_alloc' [-Wmissing-format-attribute] 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | __attribute__((format(printf, 2, 0))) 1520 | const char *fmt, va_list ap) 1521 | { 1522 | shrinker->name = kvasprintf_const(GFP_KERNEL, fmt, ap); | ^ mm/internal.h:1519:19: note: 'shrinker_debugfs_name_alloc' declared here 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | ^ mm/madvise.c:285:6: warning: no previous prototype for function 'force_swapin_vma' [-Wmissing-prototypes] 285 | void force_swapin_vma(struct vm_area_struct *vma) | ^ mm/madvise.c:285:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 285 | void force_swapin_vma(struct vm_area_struct *vma) | ^ | static 2 warnings generated. -- In file included from mm/memblock.c:23: >> mm/internal.h:1522:55: warning: diagnostic behavior may be improved by adding the 'format(printf, 2, 0)' attribute to the declaration of 'shrinker_debugfs_name_alloc' [-Wmissing-format-attribute] 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | __attribute__((format(printf, 2, 0))) 1520 | const char *fmt, va_list ap) 1521 | { 1522 | shrinker->name = kvasprintf_const(GFP_KERNEL, fmt, ap); | ^ mm/internal.h:1519:19: note: 'shrinker_debugfs_name_alloc' declared here 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | ^ mm/memblock.c:1444:20: warning: no previous prototype for function 'memblock_alloc_range_nid_flags' [-Wmissing-prototypes] 1444 | phys_addr_t __init memblock_alloc_range_nid_flags(phys_addr_t size, | ^ mm/memblock.c:1444:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1444 | phys_addr_t __init memblock_alloc_range_nid_flags(phys_addr_t size, | ^ | static 2 warnings generated. -- In file included from mm/mempolicy.c:111: >> mm/internal.h:1522:55: warning: diagnostic behavior may be improved by adding the 'format(printf, 2, 0)' attribute to the declaration of 'shrinker_debugfs_name_alloc' [-Wmissing-format-attribute] 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | __attribute__((format(printf, 2, 0))) 1520 | const char *fmt, va_list ap) 1521 | { 1522 | shrinker->name = kvasprintf_const(GFP_KERNEL, fmt, ap); | ^ mm/internal.h:1519:19: note: 'shrinker_debugfs_name_alloc' declared here 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | ^ mm/mempolicy.c:1123:25: warning: variable 'vma' set but not used [-Wunused-but-set-variable] 1123 | struct vm_area_struct *vma; | ^ mm/mempolicy.c:2959:25: warning: default initialization of an object of type 'struct vm_area_struct' with const member leaves the object uninitialized [-Wdefault-const-init-field-unsafe] 2959 | struct vm_area_struct pvma; | ^ include/linux/mm_types.h:659:20: note: member 'vm_flags' declared 'const' here 659 | const vm_flags_t vm_flags; | ^ 3 warnings generated. -- In file included from mm/memory.c:93: >> mm/internal.h:1522:55: warning: diagnostic behavior may be improved by adding the 'format(printf, 2, 0)' attribute to the declaration of 'shrinker_debugfs_name_alloc' [-Wmissing-format-attribute] 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | __attribute__((format(printf, 2, 0))) 1520 | const char *fmt, va_list ap) 1521 | { 1522 | shrinker->name = kvasprintf_const(GFP_KERNEL, fmt, ap); | ^ mm/internal.h:1519:19: note: 'shrinker_debugfs_name_alloc' declared here 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | ^ mm/memory.c:5512:17: warning: variable 'nr_pages' set but not used [-Wunused-but-set-variable] 5512 | int flags = 0, nr_pages; | ^ 2 warnings generated. -- In file included from mm/shmem.c:43: mm/swap.h:66:19: error: call to undeclared function 'swp_offset'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 66 | pgoff_t offset = swp_offset(entry); | ^ In file included from mm/shmem.c:58: include/linux/mman.h:158:9: warning: division by zero is undefined [-Wdivision-by-zero] 158 | _calc_vm_trans(flags, MAP_SYNC, VM_SYNC ) | | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/mman.h:136:21: note: expanded from macro '_calc_vm_trans' 136 | : ((x) & (bit1)) / ((bit1) / (bit2)))) | ^ ~~~~~~~~~~~~~~~~~ include/linux/mman.h:159:9: warning: division by zero is undefined [-Wdivision-by-zero] 159 | _calc_vm_trans(flags, MAP_STACK, VM_NOHUGEPAGE) | | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/mman.h:136:21: note: expanded from macro '_calc_vm_trans' 136 | : ((x) & (bit1)) / ((bit1) / (bit2)))) | ^ ~~~~~~~~~~~~~~~~~ In file included from mm/shmem.c:68: include/linux/swapops.h:107:23: error: static declaration of 'swp_offset' follows non-static declaration 107 | static inline pgoff_t swp_offset(swp_entry_t entry) | ^ mm/swap.h:66:19: note: previous implicit declaration is here 66 | pgoff_t offset = swp_offset(entry); | ^ In file included from mm/shmem.c:86: >> mm/internal.h:1522:55: warning: diagnostic behavior may be improved by adding the 'format(printf, 2, 0)' attribute to the declaration of 'shrinker_debugfs_name_alloc' [-Wmissing-format-attribute] 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | __attribute__((format(printf, 2, 0))) 1520 | const char *fmt, va_list ap) 1521 | { 1522 | shrinker->name = kvasprintf_const(GFP_KERNEL, fmt, ap); | ^ mm/internal.h:1519:19: note: 'shrinker_debugfs_name_alloc' declared here 1519 | static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, | ^ mm/shmem.c:1747:24: warning: default initialization of an object of type 'struct vm_area_struct' with const member leaves the object uninitialized [-Wdefault-const-init-field-unsafe] 1747 | struct vm_area_struct pvma; | ^ include/linux/mm_types.h:659:20: note: member 'vm_flags' declared 'const' here 659 | const vm_flags_t vm_flags; | ^ mm/shmem.c:1877:24: warning: default initialization of an object of type 'struct vm_area_struct' with const member leaves the object uninitialized [-Wdefault-const-init-field-unsafe] 1877 | struct vm_area_struct pvma; | ^ include/linux/mm_types.h:659:20: note: member 'vm_flags' declared 'const' here 659 | const vm_flags_t vm_flags; | ^ 5 warnings and 2 errors generated. Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for ARCH_SUPPORTS_SCHED_SOFT_QUOTA Depends on [n]: CGROUPS [=n] Selected by [y]: - ARM64 [=y] vim +1522 mm/internal.h 1513 1514 /* shrinker related functions */ 1515 unsigned long shrink_slab(gfp_t gfp_mask, int nid, struct mem_cgroup *memcg, 1516 int priority); 1517 1518 #ifdef CONFIG_SHRINKER_DEBUG 1519 static inline int shrinker_debugfs_name_alloc(struct shrinker *shrinker, 1520 const char *fmt, va_list ap) 1521 { > 1522 shrinker->name = kvasprintf_const(GFP_KERNEL, fmt, ap); 1523 1524 return shrinker->name ? 0 : -ENOMEM; 1525 } 1526 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] vfs: Don't leak disconnected dentries on umount
by Zizhi Wo 08 Dec '25

08 Dec '25

From: Jan Kara <jack(a)suse.cz> stable inclusion from stable-v5.10.246 commit 20863bb7fbb016379f8227122edfabc5c799bc79 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID4A7Q CVE: CVE-2025-40105 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 56094ad3eaa21e6621396cc33811d8f72847a834 ] When user calls open_by_handle_at() on some inode that is not cached, we will create disconnected dentry for it. If such dentry is a directory, exportfs_decode_fh_raw() will then try to connect this dentry to the dentry tree through reconnect_path(). It may happen for various reasons (such as corrupted fs or race with rename) that the call to lookup_one_unlocked() in reconnect_one() will fail to find the dentry we are trying to reconnect and instead create a new dentry under the parent. Now this dentry will not be marked as disconnected although the parent still may well be disconnected (at least in case this inconsistency happened because the fs is corrupted and .. doesn't point to the real parent directory). This creates inconsistency in disconnected flags but AFAICS it was mostly harmless. At least until commit f1ee616214cb ("VFS: don't keep disconnected dentries on d_anon") which removed adding of most disconnected dentries to sb->s_anon list. Thus after this commit cleanup of disconnected dentries implicitely relies on the fact that dput() will immediately reclaim such dentries. However when some leaf dentry isn't marked as disconnected, as in the scenario described above, the reclaim doesn't happen and the dentries are "leaked". Memory reclaim can eventually reclaim them but otherwise they stay in memory and if umount comes first, we hit infamous "Busy inodes after unmount" bug. Make sure all dentries created under a disconnected parent are marked as disconnected as well. Reported-by: syzbot+1d79ebe5383fc016cf07(a)syzkaller.appspotmail.com Fixes: f1ee616214cb ("VFS: don't keep disconnected dentries on d_anon") CC: stable(a)vger.kernel.org Signed-off-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Christian Brauner <brauner(a)kernel.org> [ relocated DCACHE_DISCONNECTED propagation from d_alloc_parallel() to d_alloc() ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/dcache.c [6a8c6793785d ("fs/dcache.c: avoid panic while lockref of dentry overflow") introduces conflicts, which does not affect this patch.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/dcache.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/dcache.c b/fs/dcache.c index d36bb8fc2c41..a316a1b2e144 100644 --- a/fs/dcache.c +++ b/fs/dcache.c @@ -1884,6 +1884,8 @@ struct dentry *d_alloc(struct dentry * parent, const struct qstr *name) __dget_dlock(parent); dentry->d_parent = parent; list_add(&dentry->d_child, &parent->d_subdirs); + if (parent->d_flags & DCACHE_DISCONNECTED) + dentry->d_flags |= DCACHE_DISCONNECTED; spin_unlock(&parent->d_lock); out: return dentry; -- 2.39.2

2 1

[PATCH OLK-5.10] fs/proc: fix uaf in proc_readdir_de()
by Zizhi Wo 08 Dec '25

08 Dec '25

From: Wei Yang <albinwyang(a)tencent.com> stable inclusion from stable-v5.10.247 commit c81d0385500446efe48c305bbb83d47f2ae23a50 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IDB6QZ CVE: CVE-2025-40271 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 895b4c0c79b092d732544011c3cecaf7322c36a1 upstream. Pde is erased from subdir rbtree through rb_erase(), but not set the node to EMPTY, which may result in uaf access. We should use RB_CLEAR_NODE() set the erased node to EMPTY, then pde_subdir_next() will return NULL to avoid uaf access. We found an uaf issue while using stress-ng testing, need to run testcase getdent and tun in the same time. The steps of the issue is as follows: 1) use getdent to traverse dir /proc/pid/net/dev_snmp6/, and current pde is tun3; 2) in the [time windows] unregister netdevice tun3 and tun2, and erase them from rbtree. erase tun3 first, and then erase tun2. the pde(tun2) will be released to slab; 3) continue to getdent process, then pde_subdir_next() will return pde(tun2) which is released, it will case uaf access. CPU 0 | CPU 1 ------------------------------------------------------------------------- traverse dir /proc/pid/net/dev_snmp6/ | unregister_netdevice(tun->dev) //tun3 tun2 sys_getdents64() | iterate_dir() | proc_readdir() | proc_readdir_de() | snmp6_unregister_dev() pde_get(de); | proc_remove() read_unlock(&proc_subdir_lock); | remove_proc_subtree() | write_lock(&proc_subdir_lock); [time window] | rb_erase(&root->subdir_node, &parent->subdir); | write_unlock(&proc_subdir_lock); read_lock(&proc_subdir_lock); | next = pde_subdir_next(de); | pde_put(de); | de = next; //UAF | rbtree of dev_snmp6 | pde(tun3) / \ NULL pde(tun2) Link: https://lkml.kernel.org/r/20251025024233.158363-1-albin_yang@163.com Signed-off-by: Wei Yang <albinwyang(a)tencent.com> Cc: Al Viro <viro(a)zeniv.linux.org.uk> Cc: Christian Brauner <brauner(a)kernel.org> Cc: wangzijie <wangzijie1(a)honor.com> Cc: Alexey Dobriyan <adobriyan(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/proc/generic.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/fs/proc/generic.c b/fs/proc/generic.c index 7b6d9c77b425..643e7d4dc59d 100644 --- a/fs/proc/generic.c +++ b/fs/proc/generic.c @@ -693,6 +693,12 @@ void pde_put(struct proc_dir_entry *pde) } } +static void pde_erase(struct proc_dir_entry *pde, struct proc_dir_entry *parent) +{ + rb_erase(&pde->subdir_node, &parent->subdir); + RB_CLEAR_NODE(&pde->subdir_node); +} + /* * Remove a /proc entry and free it if it's not currently in use. */ @@ -715,7 +721,7 @@ void remove_proc_entry(const char *name, struct proc_dir_entry *parent) WARN(1, "removing permanent /proc entry '%s'", de->name); de = NULL; } else { - rb_erase(&de->subdir_node, &parent->subdir); + pde_erase(de, parent); if (S_ISDIR(de->mode)) parent->nlink--; } @@ -759,7 +765,7 @@ int remove_proc_subtree(const char *name, struct proc_dir_entry *parent) root->parent->name, root->name); return -EINVAL; } - rb_erase(&root->subdir_node, &parent->subdir); + pde_erase(root, parent); de = root; while (1) { @@ -771,7 +777,7 @@ int remove_proc_subtree(const char *name, struct proc_dir_entry *parent) next->parent->name, next->name); return -EINVAL; } - rb_erase(&next->subdir_node, &de->subdir); + pde_erase(next, de); de = next; continue; } -- 2.39.2

2 1

[PATCH OLK-5.10] fs: Prevent file descriptor table allocations exceeding INT_MAX
by Zizhi Wo 08 Dec '25

08 Dec '25

From: Sasha Levin <sashal(a)kernel.org> stable inclusion from stable-v5.10.241 commit f95638a8f22eba307dceddf5aef9ae2326bbcf98 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICXMCD CVE: CVE-2025-39756 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 04a2c4b4511d186b0fce685da21085a5d4acd370 upstream. When sysctl_nr_open is set to a very high value (for example, 1073741816 as set by systemd), processes attempting to use file descriptors near the limit can trigger massive memory allocation attempts that exceed INT_MAX, resulting in a WARNING in mm/slub.c: WARNING: CPU: 0 PID: 44 at mm/slub.c:5027 __kvmalloc_node_noprof+0x21a/0x288 This happens because kvmalloc_array() and kvmalloc() check if the requested size exceeds INT_MAX and emit a warning when the allocation is not flagged with __GFP_NOWARN. Specifically, when nr_open is set to 1073741816 (0x3ffffff8) and a process calls dup2(oldfd, 1073741880), the kernel attempts to allocate: - File descriptor array: 1073741880 * 8 bytes = 8,589,935,040 bytes - Multiple bitmaps: ~400MB - Total allocation size: > 8GB (exceeding INT_MAX = 2,147,483,647) Reproducer: 1. Set /proc/sys/fs/nr_open to 1073741816: # echo 1073741816 > /proc/sys/fs/nr_open 2. Run a program that uses a high file descriptor: #include <unistd.h> #include <sys/resource.h> int main() { struct rlimit rlim = {1073741824, 1073741824}; setrlimit(RLIMIT_NOFILE, &rlim); dup2(2, 1073741880); // Triggers the warning return 0; } 3. Observe WARNING in dmesg at mm/slub.c:5027 systemd commit a8b627a introduced automatic bumping of fs.nr_open to the maximum possible value. The rationale was that systems with memory control groups (memcg) no longer need separate file descriptor limits since memory is properly accounted. However, this change overlooked that: 1. The kernel's allocation functions still enforce INT_MAX as a maximum size regardless of memcg accounting 2. Programs and tests that legitimately test file descriptor limits can inadvertently trigger massive allocations 3. The resulting allocations (>8GB) are impractical and will always fail systemd's algorithm starts with INT_MAX and keeps halving the value until the kernel accepts it. On most systems, this results in nr_open being set to 1073741816 (0x3ffffff8), which is just under 1GB of file descriptors. While processes rarely use file descriptors near this limit in normal operation, certain selftests (like tools/testing/selftests/core/unshare_test.c) and programs that test file descriptor limits can trigger this issue. Fix this by adding a check in alloc_fdtable() to ensure the requested allocation size does not exceed INT_MAX. This causes the operation to fail with -EMFILE instead of triggering a kernel warning and avoids the impractical >8GB memory allocation request. Fixes: 9cfe015aa424 ("get rid of NR_OPEN and introduce a sysctl_nr_open") Cc: stable(a)vger.kernel.org Signed-off-by: Sasha Levin <sashal(a)kernel.org> Link: https://lore.kernel.org/20250629074021.1038845-1-sashal@kernel.org Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/file.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/fs/file.c b/fs/file.c index 0558890fe20c..246ee67dd10e 100644 --- a/fs/file.c +++ b/fs/file.c @@ -126,6 +126,21 @@ static struct fdtable * alloc_fdtable(unsigned int nr) if (unlikely(nr > sysctl_nr_open)) nr = ((sysctl_nr_open - 1) | (BITS_PER_LONG - 1)) + 1; + /* + * Check if the allocation size would exceed INT_MAX. kvmalloc_array() + * and kvmalloc() will warn if the allocation size is greater than + * INT_MAX, as filp_cachep objects are not __GFP_NOWARN. + * + * This can happen when sysctl_nr_open is set to a very high value and + * a process tries to use a file descriptor near that limit. For example, + * if sysctl_nr_open is set to 1073741816 (0x3ffffff8) - which is what + * systemd typically sets it to - then trying to use a file descriptor + * close to that value will require allocating a file descriptor table + * that exceeds 8GB in size. + */ + if (unlikely(nr > INT_MAX / sizeof(struct file *))) + return ERR_PTR(-EMFILE); + fdt = kmalloc(sizeof(struct fdtable), GFP_KERNEL_ACCOUNT); if (!fdt) goto out; -- 2.39.2

2 1

[PATCH OLK-5.10 0/2] Fix CVE-2025-40190
by Zizhi Wo 08 Dec '25

08 Dec '25

Fix CVE-2025-40190 Ahmet Eray Karadag (1): ext4: guard against EA inode refcount underflow in xattr update Wojciech Gładysz (1): ext4: nested locking for xattr inode fs/ext4/xattr.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) -- 2.39.2

2 3

[PATCH openEuler-1.0-LTS] fs/proc: fix uaf in proc_readdir_de()
by Zizhi Wo 08 Dec '25

08 Dec '25

From: Wei Yang <albinwyang(a)tencent.com> stable inclusion from stable-v5.4.302 commit 1d1596d68a6f11d28f677eedf6cf5b17dbfeb491 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IDB6QZ CVE: CVE-2025-40271 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 895b4c0c79b092d732544011c3cecaf7322c36a1 ] Pde is erased from subdir rbtree through rb_erase(), but not set the node to EMPTY, which may result in uaf access. We should use RB_CLEAR_NODE() set the erased node to EMPTY, then pde_subdir_next() will return NULL to avoid uaf access. We found an uaf issue while using stress-ng testing, need to run testcase getdent and tun in the same time. The steps of the issue is as follows: 1) use getdent to traverse dir /proc/pid/net/dev_snmp6/, and current pde is tun3; 2) in the [time windows] unregister netdevice tun3 and tun2, and erase them from rbtree. erase tun3 first, and then erase tun2. the pde(tun2) will be released to slab; 3) continue to getdent process, then pde_subdir_next() will return pde(tun2) which is released, it will case uaf access. CPU 0 | CPU 1 ------------------------------------------------------------------------- traverse dir /proc/pid/net/dev_snmp6/ | unregister_netdevice(tun->dev) //tun3 tun2 sys_getdents64() | iterate_dir() | proc_readdir() | proc_readdir_de() | snmp6_unregister_dev() pde_get(de); | proc_remove() read_unlock(&proc_subdir_lock); | remove_proc_subtree() | write_lock(&proc_subdir_lock); [time window] | rb_erase(&root->subdir_node, &parent->subdir); | write_unlock(&proc_subdir_lock); read_lock(&proc_subdir_lock); | next = pde_subdir_next(de); | pde_put(de); | de = next; //UAF | rbtree of dev_snmp6 | pde(tun3) / \ NULL pde(tun2) Link: https://lkml.kernel.org/r/20251025024233.158363-1-albin_yang@163.com Signed-off-by: Wei Yang <albinwyang(a)tencent.com> Cc: Al Viro <viro(a)zeniv.linux.org.uk> Cc: Christian Brauner <brauner(a)kernel.org> Cc: wangzijie <wangzijie1(a)honor.com> Cc: Alexey Dobriyan <adobriyan(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/proc/generic.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/fs/proc/generic.c b/fs/proc/generic.c index d8b3c6a7173f..c6495decf1ed 100644 --- a/fs/proc/generic.c +++ b/fs/proc/generic.c @@ -670,6 +670,12 @@ void pde_put(struct proc_dir_entry *pde) } } +static void pde_erase(struct proc_dir_entry *pde, struct proc_dir_entry *parent) +{ + rb_erase(&pde->subdir_node, &parent->subdir); + RB_CLEAR_NODE(&pde->subdir_node); +} + /* * Remove a /proc entry and free it if it's not currently in use. */ @@ -688,7 +694,7 @@ void remove_proc_entry(const char *name, struct proc_dir_entry *parent) de = pde_subdir_find(parent, fn, len); if (de) { - rb_erase(&de->subdir_node, &parent->subdir); + pde_erase(de, parent); if (S_ISDIR(de->mode)) { parent->nlink--; } @@ -726,13 +732,13 @@ int remove_proc_subtree(const char *name, struct proc_dir_entry *parent) write_unlock(&proc_subdir_lock); return -ENOENT; } - rb_erase(&root->subdir_node, &parent->subdir); + pde_erase(root, parent); de = root; while (1) { next = pde_subdir_first(de); if (next) { - rb_erase(&next->subdir_node, &de->subdir); + pde_erase(next, de); de = next; continue; } -- 2.39.2

2 1

[PATCH OLK-5.10 0/1] zcopy: Fix invalid paging request while attach transhugepage to same addr
by Liu Mingrui 08 Dec '25

08 Dec '25

Fix invalid paging request while attach transhugepage to same addr Liu Mingrui (1): zcopy: Fix invalid paging request while attach transhugepage to same addr drivers/misc/zcopy/zcopy.c | 68 +++++++++++++++++++------------------- 1 file changed, 34 insertions(+), 34 deletions(-) -- 2.25.1

2 2

[PATCH OLK-6.6 0/3] arm64/mpam: Reset mbwu_state while creating new monitor group
by Zeng Heng 08 Dec '25

08 Dec '25

Zeng Heng (3): arm64/mpam: Reset mbwu_state while creating new monitor group arm64/mpam: Remove the redundant prev_val member variable arm64/mpam: Need to reset MPAM component when umounting resctrl drivers/platform/mpam/mpam_devices.c | 9 +-------- drivers/platform/mpam/mpam_internal.h | 3 --- drivers/platform/mpam/mpam_resctrl.c | 3 ++- 3 files changed, 3 insertions(+), 12 deletions(-) -- 2.25.1

2 4

[openeuler:OLK-6.6 3485/3485] drivers/media/v4l2-core/v4l2-subdev.c:2253:17: error: implicit declaration of function 'v4l2_subdev_get_locked_active_state'
by kernel test robot 08 Dec '25

08 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 79aa4f2e99baed837a6933aa6b1a852197d30b91 commit: c1be6d998806425f28600e867a8e9a2dd9bac741 [3485/3485] media: subdev: Add v4l2_subdev_is_streaming() config: x86_64-randconfig-003-20251208 (https://download.01.org/0day-ci/archive/20251208/202512081445.4S7Y9xWG-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251208/202512081445.4S7Y9xWG-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512081445.4S7Y9xWG-lkp@intel.com/ All errors (new ones prefixed by >>): drivers/media/v4l2-core/v4l2-subdev.c: In function 'v4l2_subdev_is_streaming': >> drivers/media/v4l2-core/v4l2-subdev.c:2253:17: error: implicit declaration of function 'v4l2_subdev_get_locked_active_state' [-Wimplicit-function-declaration] 2253 | state = v4l2_subdev_get_locked_active_state(sd); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> drivers/media/v4l2-core/v4l2-subdev.c:2253:15: error: assignment to 'struct v4l2_subdev_state *' from 'int' makes pointer from integer without a cast [-Wint-conversion] 2253 | state = v4l2_subdev_get_locked_active_state(sd); | ^ vim +/v4l2_subdev_get_locked_active_state +2253 drivers/media/v4l2-core/v4l2-subdev.c 2242 2243 bool v4l2_subdev_is_streaming(struct v4l2_subdev *sd) 2244 { 2245 struct v4l2_subdev_state *state; 2246 2247 if (!v4l2_subdev_has_op(sd, pad, enable_streams)) 2248 return sd->s_stream_enabled; 2249 2250 if (!(sd->flags & V4L2_SUBDEV_FL_STREAMS)) 2251 return !!sd->enabled_pads; 2252 > 2253 state = v4l2_subdev_get_locked_active_state(sd); 2254 2255 for (unsigned int i = 0; i < state->stream_configs.num_configs; ++i) { 2256 const struct v4l2_subdev_stream_config *cfg; 2257 2258 cfg = &state->stream_configs.configs[i]; 2259 2260 if (cfg->enabled) 2261 return true; 2262 } 2263 2264 return false; 2265 } 2266 EXPORT_SYMBOL_GPL(v4l2_subdev_is_streaming); 2267 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0