- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] dm-thin: fix metadata refcount underflow
by Zizhi Wo 03 Jun '26

03 Jun '26

From: Mikulas Patocka <mpatocka(a)redhat.com> stable inclusion from stable-v6.6.140 commit 12161e03d33afce781f68fa11cc6060538862fad category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15360 CVE: CVE-2026-46107 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit… -------------------------------- commit 09a65adc7d8bbfce06392cb6d375468e2728ead5 upstream. There's a bug in dm-thin in the function rebalance_children. If the internal btree node has one entry, the code tries to copy all btree entries from the node's child to the node itself and then decrement the child's reference count. If the child node is shared (it has reference count > 1), we won't free it, so there would be two pointers to each of the grandchildren nodes. But the reference counts of the grandchildren is not increased, thus the reference count doesn't match the number of pointers that point to the grandchildren. This results in "device mapper: space map common: unable to decrement block" errors. Fix this bug by incrementing reference counts on the grandchildren if the btree node is shared. Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Fixes: 3241b1d3e0aa ("dm: add persistent data library") Cc: stable(a)vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/md/persistent-data/dm-transaction-manager.c drivers/md/persistent-data/dm-transaction-manager.h [This kernel version does not have dm_tm_block_is_shared() function as commit 4eafdb1515a7 ("dm btree: improve btree residency") not merged. So the functionality of this function was implemented manually.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- drivers/md/persistent-data/dm-btree-remove.c | 8 ++++++++ drivers/md/persistent-data/dm-transaction-manager.c | 9 +++++++++ drivers/md/persistent-data/dm-transaction-manager.h | 7 +++++++ 3 files changed, 24 insertions(+) diff --git a/drivers/md/persistent-data/dm-btree-remove.c b/drivers/md/persistent-data/dm-btree-remove.c index 63f2baed3c8a..1cf31861020b 100644 --- a/drivers/md/persistent-data/dm-btree-remove.c +++ b/drivers/md/persistent-data/dm-btree-remove.c @@ -413,16 +413,24 @@ static int rebalance_children(struct shadow_spine *s, n = dm_block_data(shadow_current(s)); if (le32_to_cpu(n->header.nr_entries) == 1) { struct dm_block *child; + int is_shared; dm_block_t b = value64(n, 0); + r = dm_tm_block_is_shared(info->tm, b, &is_shared); + if (r) + return r; + r = dm_tm_read_lock(info->tm, b, &btree_node_validator, &child); if (r) return r; + if (is_shared) + inc_children(info->tm, dm_block_data(child), vt); + memcpy(n, dm_block_data(child), dm_bm_block_size(dm_tm_get_bm(info->tm))); dm_tm_dec(info->tm, dm_block_location(child)); dm_tm_unlock(info->tm, child); diff --git a/drivers/md/persistent-data/dm-transaction-manager.c b/drivers/md/persistent-data/dm-transaction-manager.c index 73f57977b2e3..eda9d7a02008 100644 --- a/drivers/md/persistent-data/dm-transaction-manager.c +++ b/drivers/md/persistent-data/dm-transaction-manager.c @@ -380,10 +380,19 @@ int dm_tm_ref(struct dm_transaction_manager *tm, dm_block_t b, return -EWOULDBLOCK; return dm_sm_get_count(tm->sm, b, result); } +int dm_tm_block_is_shared(struct dm_transaction_manager *tm, dm_block_t b, + int *result) +{ + if (tm->is_clone) + return -EWOULDBLOCK; + + return dm_sm_count_is_more_than_one(tm->sm, b, result); +} + struct dm_block_manager *dm_tm_get_bm(struct dm_transaction_manager *tm) { return tm->bm; } diff --git a/drivers/md/persistent-data/dm-transaction-manager.h b/drivers/md/persistent-data/dm-transaction-manager.h index f3a18be68f30..dbc6e4b13b06 100644 --- a/drivers/md/persistent-data/dm-transaction-manager.h +++ b/drivers/md/persistent-data/dm-transaction-manager.h @@ -104,10 +104,17 @@ void dm_tm_inc(struct dm_transaction_manager *tm, dm_block_t b); void dm_tm_dec(struct dm_transaction_manager *tm, dm_block_t b); int dm_tm_ref(struct dm_transaction_manager *tm, dm_block_t b, uint32_t *result); +/* + * Finds out if a given block is shared (ie. has a reference count higher + * than one). + */ +int dm_tm_block_is_shared(struct dm_transaction_manager *tm, dm_block_t b, + int *result); + struct dm_block_manager *dm_tm_get_bm(struct dm_transaction_manager *tm); /* * If you're using a non-blocking clone the tm will build up a list of * requested blocks that weren't in core. This call will request those -- 2.52.0

2 2

[PATCH openEuler-1.0-LTS V1] RDMA/rxe: Fix double free in rxe_srq_from_init
by Cheng Yu 03 Jun '26

03 Jun '26

From: Jiasheng Jiang <jiashengjiangcool(a)gmail.com> mainline inclusion from mainline-v7.0-rc1 commit 0beefd0e15d962f497aad750b2d5e9c3570b66d1 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15105 CVE: CVE-2026-45852 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In rxe_srq_from_init(), the queue pointer 'q' is assigned to 'srq->rq.queue' before copying the SRQ number to user space. If copy_to_user() fails, the function calls rxe_queue_cleanup() to free the queue, but leaves the now-invalid pointer in 'srq->rq.queue'. The caller of rxe_srq_from_init() (rxe_create_srq) eventually calls rxe_srq_cleanup() upon receiving the error, which triggers a second rxe_queue_cleanup() on the same memory, leading to a double free. The call trace looks like this: kmem_cache_free+0x.../0x... rxe_queue_cleanup+0x1a/0x30 [rdma_rxe] rxe_srq_cleanup+0x42/0x60 [rdma_rxe] rxe_elem_release+0x31/0x70 [rdma_rxe] rxe_create_srq+0x12b/0x1a0 [rdma_rxe] ib_create_srq_user+0x9a/0x150 [ib_core] Fix this by moving 'srq->rq.queue = q' after copy_to_user. Fixes: aae0484e15f0 ("IB/rxe: avoid srq memory leak") Signed-off-by: Jiasheng Jiang <jiashengjiangcool(a)gmail.com> Link: https://patch.msgid.link/20260112015412.29458-1-jiashengjiangcool@gmail.com Reviewed-by: Zhu Yanjun <yanjun.Zhu(a)linux.dev> Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Conflicts: drivers/infiniband/sw/rxe/rxe_srq.c [The conflict is caused by not having applied the patch cc28f351155d("RDMA/rxe: Fix rxe_modify_srq"). ] Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- drivers/infiniband/sw/rxe/rxe_srq.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/sw/rxe/rxe_srq.c b/drivers/infiniband/sw/rxe/rxe_srq.c index c41a5fee81f7..ec564e7010c4 100644 --- a/drivers/infiniband/sw/rxe/rxe_srq.c +++ b/drivers/infiniband/sw/rxe/rxe_srq.c @@ -126,8 +126,6 @@ int rxe_srq_from_init(struct rxe_dev *rxe, struct rxe_srq *srq, return -ENOMEM; } - srq->rq.queue = q; - err = do_mmap_info(rxe, uresp ? &uresp->mi : NULL, context, q->buf, q->buf_size, &q->ip); if (err) { @@ -144,6 +142,8 @@ int rxe_srq_from_init(struct rxe_dev *rxe, struct rxe_srq *srq, } } + srq->rq.queue = q; + return 0; } -- 2.25.1

2 1

[PATCH OLK-5.10] fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot
by Zizhi Wo 03 Jun '26

03 Jun '26

From: Jiasheng Jiang <jiashengjiangcool(a)gmail.com> stable inclusion from stable-v5.15.202 commit 36c03f7f177b34d51f1cf1d2304b1074607bf4b0 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15173 CVE: CVE-2026-45935 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit… -------------------------------- [ Upstream commit b2bc7c44ed1779fc9eaab9a186db0f0d01439622 ] In the 'DeleteIndexEntryRoot' case of the 'do_action' function, the entry size ('esize') is retrieved from the log record without adequate bounds checking. Specifically, the code calculates the end of the entry ('e2') using: e2 = Add2Ptr(e1, esize); It then calculates the size for memmove using 'PtrOffset(e2, ...)', which subtracts the end pointer from the buffer limit. If 'esize' is maliciously large, 'e2' exceeds the used buffer size. This results in a negative offset which, when cast to size_t for memmove, interprets as a massive unsigned integer, leading to a heap buffer overflow. This commit adds a check to ensure that the entry size ('esize') strictly fits within the remaining used space of the index header before performing memory operations. Fixes: b46acd6a6a62 ("fs/ntfs3: Add NTFS journal") Signed-off-by: Jiasheng Jiang <jiashengjiangcool(a)gmail.com> Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/ntfs3/fslog.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c index d1f48ffe846e..ef4e7dbc35cf 100644 --- a/fs/ntfs3/fslog.c +++ b/fs/ntfs3/fslog.c @@ -3435,10 +3435,13 @@ static int do_action(struct ntfs_log *log, struct OPEN_ATTR_ENRTY *oe, goto dirty_vol; } e1 = Add2Ptr(attr, le16_to_cpu(lrh->attr_off)); esize = le16_to_cpu(e1->size); + if (PtrOffset(e1, Add2Ptr(hdr, used)) < esize) + goto dirty_vol; + e2 = Add2Ptr(e1, esize); memmove(e1, e2, PtrOffset(e2, Add2Ptr(hdr, used))); le32_sub_cpu(&attr->res.data_size, esize); -- 2.52.0

2 1

[PATCH OLK-6.6 0/3] CVEs
by Liu Kai 03 Jun '26

03 Jun '26

CVEs Chiara Meiohas (1): RDMA/mlx5: Fix UMR hang in LAG error state unload Jonathan McDowell (1): hwrng: core - Allow runtime disabling of the HW RNG Lianjie Wang (1): hwrng: core - use RCU and work_struct to fix race condition drivers/char/hw_random/core.c | 178 +++++++++++++++++---------- drivers/infiniband/hw/mlx5/main.c | 75 +++++++++-- drivers/infiniband/hw/mlx5/mlx5_ib.h | 2 + include/linux/hw_random.h | 2 + 4 files changed, 184 insertions(+), 73 deletions(-) -- 2.34.1

2 4

[PATCH openEuler-1.0-LTS] ipv6: prevent possible UaF in addrconf_permanent_addr()
by Zhang Changzhong 03 Jun '26

03 Jun '26

From: Paolo Abeni <pabeni(a)redhat.com> mainline inclusion from mainline-v7.0-rc7 commit fd63f185979b047fb22a0dfc6bd94d0cab6a6a70 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14897 CVE: CVE-2026-43339 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The mentioned helper try to warn the user about an exceptional condition, but the message is delivered too late, accessing the ipv6 after its possible deletion. Reorder the statement to avoid the possible UaF; while at it, place the warning outside the idev->lock as it needs no protection. Reported-by: Jakub Kicinski <kuba(a)kernel.org> Closes: https://sashiko.dev/#/patchset/8c8bfe2e1a324e501f0e15fef404a77443fd8caf.177… Fixes: f1705ec197e7 ("net: ipv6: Make address flushing on ifdown optional") Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Link: https://patch.msgid.link/ef973c3a8cb4f8f1787ed469f3e5391b9fe95aa0.177460154… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/ipv6/addrconf.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c index 6c76c0c..98a24b5 100644 --- a/net/ipv6/addrconf.c +++ b/net/ipv6/addrconf.c @@ -3421,12 +3421,12 @@ static void addrconf_permanent_addr(struct net *net, struct net_device *dev) if ((ifp->flags & IFA_F_PERMANENT) && fixup_permanent_addr(net, idev, ifp) < 0) { write_unlock_bh(&idev->lock); - in6_ifa_hold(ifp); - ipv6_del_addr(ifp); - write_lock_bh(&idev->lock); net_info_ratelimited("%s: Failed to add prefix route for address %pI6c; dropping\n", idev->dev->name, &ifp->addr); + in6_ifa_hold(ifp); + ipv6_del_addr(ifp); + write_lock_bh(&idev->lock); } } -- 2.9.5

2 1

[PATCH OLK-6.6 0/6] Fix CVE-2026-46242
by Zizhi Wo 03 Jun '26

03 Jun '26

Fix CVE-2026-46242 Christian Brauner (6): eventpoll: use hlist_is_singular_node() in __ep_remove() eventpoll: split __ep_remove() eventpoll: kill __ep_remove() eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() eventpoll: move epi_fget() up eventpoll: fix ep_remove struct eventpoll / struct file UAF fs/eventpoll.c | 128 ++++++++++++++++++++++++++++--------------------- 1 file changed, 73 insertions(+), 55 deletions(-) -- 2.52.0

2 7

[PATCH openEuler-1.0-LTS 0/7] backport some zram bugfixes
by Jinjiang Tu 03 Jun '26

03 Jun '26

Georgi Djakov (1): mm/page_io: use pr_alert_ratelimited for swap read/write errors Ming Lei (3): zram: fix race between zram_reset_device() and disksize_store() zram: don't fail to remove zram during unloading module zram: avoid race between zram_remove and disksize_store Rokudo Yan (1): zsmalloc: account the number of compacted pages correctly Sergey Senozhatsky (2): zram: do not lookup algorithm in backends table drivers/block/zram/zram_drv.c: do not keep dangling zcomp pointer after zram reset drivers/block/zram/zcomp.c | 11 ++++---- drivers/block/zram/zram_drv.c | 53 ++++++++++++++++++++++++----------- include/linux/zsmalloc.h | 2 +- mm/page_io.c | 12 ++++---- mm/zsmalloc.c | 17 +++++++---- 5 files changed, 59 insertions(+), 36 deletions(-) -- 2.43.0

2 8

[PATCH OLK-6.6 v2] bpf: Remove smap argument from bpf_selem_free()
by Pu Lehui 03 Jun '26

03 Jun '26

From: Amery Hung <ameryhung(a)gmail.com> mainline inclusion from mainline-v6.19-rc1 commit e76a33e1c7186526c2c133af73ea70da9275e1ba category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9328 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Since selem already saves a pointer to smap, use it instead of an additional argument in bpf_selem_free(). This requires moving the SDATA(selem)->smap assignment from bpf_selem_link_map() to bpf_selem_alloc() since bpf_selem_free() may be called without the selem being linked to smap in bpf_local_storage_update(). Signed-off-by: Amery Hung <ameryhung(a)gmail.com> Reviewed-by: Martin KaFai Lau <martin.lau(a)kernel.org> Link: https://lore.kernel.org/r/20251114201329.3275875-3-ameryhung@gmail.com Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Fixes: 499c90ae60d8 ("bpf: Convert bpf_selem_unlink_map to failable") Conflicts: include/linux/bpf_local_storage.h kernel/bpf/bpf_local_storage.c net/core/bpf_sk_storage.c [Not merged bpf_selem_free_list] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- include/linux/bpf_local_storage.h | 1 - kernel/bpf/bpf_local_storage.c | 14 +++++++++----- net/core/bpf_sk_storage.c | 4 ++-- 3 files changed, 11 insertions(+), 8 deletions(-) diff --git a/include/linux/bpf_local_storage.h b/include/linux/bpf_local_storage.h index cec87412cef9..05153bc722ba 100644 --- a/include/linux/bpf_local_storage.h +++ b/include/linux/bpf_local_storage.h @@ -170,7 +170,6 @@ bpf_selem_alloc(struct bpf_local_storage_map *smap, void *owner, void *value, bool charge_mem, gfp_t gfp_flags); void bpf_selem_free(struct bpf_local_storage_elem *selem, - struct bpf_local_storage_map *smap, bool reuse_now); int diff --git a/kernel/bpf/bpf_local_storage.c b/kernel/bpf/bpf_local_storage.c index 8b1280bef364..c27d8f75a2dc 100644 --- a/kernel/bpf/bpf_local_storage.c +++ b/kernel/bpf/bpf_local_storage.c @@ -89,6 +89,8 @@ bpf_selem_alloc(struct bpf_local_storage_map *smap, void *owner, } if (selem) { + RCU_INIT_POINTER(SDATA(selem)->smap, smap); + if (value) copy_map_value(&smap->map, SDATA(selem)->data, value); /* No need to call check_and_init_map_value as memory is zero init */ @@ -213,9 +215,12 @@ static void bpf_selem_free_trace_rcu(struct rcu_head *rcu) } void bpf_selem_free(struct bpf_local_storage_elem *selem, - struct bpf_local_storage_map *smap, bool reuse_now) { + struct bpf_local_storage_map *smap; + + smap = rcu_dereference_check(SDATA(selem)->smap, bpf_rcu_lock_held()); + bpf_obj_free_fields(smap->map.record, SDATA(selem)->data); if (!smap->bpf_ma) { @@ -286,7 +291,7 @@ static bool bpf_selem_unlink_storage_nolock(struct bpf_local_storage *local_stor SDATA(selem)) RCU_INIT_POINTER(local_storage->cache[smap->cache_idx], NULL); - bpf_selem_free(selem, smap, reuse_now); + bpf_selem_free(selem, reuse_now); if (rcu_access_pointer(local_storage->smap) == smap) RCU_INIT_POINTER(local_storage->smap, NULL); @@ -368,7 +373,6 @@ int bpf_selem_link_map(struct bpf_local_storage_map *smap, b = select_bucket(smap, local_storage); raw_spin_lock_irqsave(&b->lock, flags); - RCU_INIT_POINTER(SDATA(selem)->smap, smap); hlist_add_head_rcu(&selem->map_node, &b->list); raw_spin_unlock_irqrestore(&b->lock, flags); @@ -600,7 +604,7 @@ bpf_local_storage_update(void *owner, struct bpf_local_storage_map *smap, err = bpf_local_storage_alloc(owner, smap, selem, gfp_flags); if (err) { - bpf_selem_free(selem, smap, true); + bpf_selem_free(selem, true); mem_uncharge(smap, owner, smap->elem_size); return ERR_PTR(err); } @@ -680,7 +684,7 @@ bpf_local_storage_update(void *owner, struct bpf_local_storage_map *smap, raw_spin_unlock_irqrestore(&local_storage->lock, flags); if (alloc_selem) { mem_uncharge(smap, owner, smap->elem_size); - bpf_selem_free(alloc_selem, smap, true); + bpf_selem_free(alloc_selem, true); } return err ? ERR_PTR(err) : SDATA(selem); } diff --git a/net/core/bpf_sk_storage.c b/net/core/bpf_sk_storage.c index 626d0aa79751..35bbd8b372df 100644 --- a/net/core/bpf_sk_storage.c +++ b/net/core/bpf_sk_storage.c @@ -192,7 +192,7 @@ int bpf_sk_storage_clone(const struct sock *sk, struct sock *newsk) if (new_sk_storage) { ret = bpf_selem_link_map(smap, new_sk_storage, copy_selem); if (ret) { - bpf_selem_free(copy_selem, smap, true); + bpf_selem_free(copy_selem, true); atomic_sub(smap->elem_size, &newsk->sk_omem_alloc); bpf_map_put(map); @@ -202,7 +202,7 @@ int bpf_sk_storage_clone(const struct sock *sk, struct sock *newsk) } else { ret = bpf_local_storage_alloc(newsk, smap, copy_selem, GFP_ATOMIC); if (ret) { - bpf_selem_free(copy_selem, smap, true); + bpf_selem_free(copy_selem, true); atomic_sub(smap->elem_size, &newsk->sk_omem_alloc); bpf_map_put(map); -- 2.34.1

2 1

[PATCH OLK-6.6] bpf: Remove smap argument from bpf_selem_free()
by Pu Lehui 03 Jun '26

03 Jun '26

From: Amery Hung <ameryhung(a)gmail.com> mainline inclusion from mainline-v6.19-rc1 commit e76a33e1c7186526c2c133af73ea70da9275e1ba category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9328 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Since selem already saves a pointer to smap, use it instead of an additional argument in bpf_selem_free(). This requires moving the SDATA(selem)->smap assignment from bpf_selem_link_map() to bpf_selem_alloc() since bpf_selem_free() may be called without the selem being linked to smap in bpf_local_storage_update(). Signed-off-by: Amery Hung <ameryhung(a)gmail.com> Reviewed-by: Martin KaFai Lau <martin.lau(a)kernel.org> Link: https://lore.kernel.org/r/20251114201329.3275875-3-ameryhung@gmail.com Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Fixes: 65aeed7d8c14 ("[Backport] bpf: Convert bpf_selem_unlink_map to failable") Conflicts: include/linux/bpf_local_storage.h kernel/bpf/bpf_local_storage.c net/core/bpf_sk_storage.c [Not merged bpf_selem_free_list] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- include/linux/bpf_local_storage.h | 1 - kernel/bpf/bpf_local_storage.c | 14 +++++++++----- net/core/bpf_sk_storage.c | 4 ++-- 3 files changed, 11 insertions(+), 8 deletions(-) diff --git a/include/linux/bpf_local_storage.h b/include/linux/bpf_local_storage.h index cec87412cef9..05153bc722ba 100644 --- a/include/linux/bpf_local_storage.h +++ b/include/linux/bpf_local_storage.h @@ -170,7 +170,6 @@ bpf_selem_alloc(struct bpf_local_storage_map *smap, void *owner, void *value, bool charge_mem, gfp_t gfp_flags); void bpf_selem_free(struct bpf_local_storage_elem *selem, - struct bpf_local_storage_map *smap, bool reuse_now); int diff --git a/kernel/bpf/bpf_local_storage.c b/kernel/bpf/bpf_local_storage.c index 8b1280bef364..c27d8f75a2dc 100644 --- a/kernel/bpf/bpf_local_storage.c +++ b/kernel/bpf/bpf_local_storage.c @@ -89,6 +89,8 @@ bpf_selem_alloc(struct bpf_local_storage_map *smap, void *owner, } if (selem) { + RCU_INIT_POINTER(SDATA(selem)->smap, smap); + if (value) copy_map_value(&smap->map, SDATA(selem)->data, value); /* No need to call check_and_init_map_value as memory is zero init */ @@ -213,9 +215,12 @@ static void bpf_selem_free_trace_rcu(struct rcu_head *rcu) } void bpf_selem_free(struct bpf_local_storage_elem *selem, - struct bpf_local_storage_map *smap, bool reuse_now) { + struct bpf_local_storage_map *smap; + + smap = rcu_dereference_check(SDATA(selem)->smap, bpf_rcu_lock_held()); + bpf_obj_free_fields(smap->map.record, SDATA(selem)->data); if (!smap->bpf_ma) { @@ -286,7 +291,7 @@ static bool bpf_selem_unlink_storage_nolock(struct bpf_local_storage *local_stor SDATA(selem)) RCU_INIT_POINTER(local_storage->cache[smap->cache_idx], NULL); - bpf_selem_free(selem, smap, reuse_now); + bpf_selem_free(selem, reuse_now); if (rcu_access_pointer(local_storage->smap) == smap) RCU_INIT_POINTER(local_storage->smap, NULL); @@ -368,7 +373,6 @@ int bpf_selem_link_map(struct bpf_local_storage_map *smap, b = select_bucket(smap, local_storage); raw_spin_lock_irqsave(&b->lock, flags); - RCU_INIT_POINTER(SDATA(selem)->smap, smap); hlist_add_head_rcu(&selem->map_node, &b->list); raw_spin_unlock_irqrestore(&b->lock, flags); @@ -600,7 +604,7 @@ bpf_local_storage_update(void *owner, struct bpf_local_storage_map *smap, err = bpf_local_storage_alloc(owner, smap, selem, gfp_flags); if (err) { - bpf_selem_free(selem, smap, true); + bpf_selem_free(selem, true); mem_uncharge(smap, owner, smap->elem_size); return ERR_PTR(err); } @@ -680,7 +684,7 @@ bpf_local_storage_update(void *owner, struct bpf_local_storage_map *smap, raw_spin_unlock_irqrestore(&local_storage->lock, flags); if (alloc_selem) { mem_uncharge(smap, owner, smap->elem_size); - bpf_selem_free(alloc_selem, smap, true); + bpf_selem_free(alloc_selem, true); } return err ? ERR_PTR(err) : SDATA(selem); } diff --git a/net/core/bpf_sk_storage.c b/net/core/bpf_sk_storage.c index 626d0aa79751..35bbd8b372df 100644 --- a/net/core/bpf_sk_storage.c +++ b/net/core/bpf_sk_storage.c @@ -192,7 +192,7 @@ int bpf_sk_storage_clone(const struct sock *sk, struct sock *newsk) if (new_sk_storage) { ret = bpf_selem_link_map(smap, new_sk_storage, copy_selem); if (ret) { - bpf_selem_free(copy_selem, smap, true); + bpf_selem_free(copy_selem, true); atomic_sub(smap->elem_size, &newsk->sk_omem_alloc); bpf_map_put(map); @@ -202,7 +202,7 @@ int bpf_sk_storage_clone(const struct sock *sk, struct sock *newsk) } else { ret = bpf_local_storage_alloc(newsk, smap, copy_selem, GFP_ATOMIC); if (ret) { - bpf_selem_free(copy_selem, smap, true); + bpf_selem_free(copy_selem, true); atomic_sub(smap->elem_size, &newsk->sk_omem_alloc); bpf_map_put(map); -- 2.34.1

2 1

openEuler Kernel SIG双周例会
by openEuler conference 03 Jun '26

03 Jun '26

您好！ Kernel 邀请您参加 2026-06-05 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议发起人： LiaoTao_Wave 会议内容： 1. 进展update 2. 议题征集中（新增议题请填报至会议纪要看板）会议链接：https://meeting.huaweicloud.com:36443/#/j/961342573 会议纪要&签到链接：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2026-06-05 14:00 The subject of the conference is openEuler Kernel SIG双周例会 The sponsor of the conference is LiaoTao_Wave Summary: 1. 进展update 2. 议题征集中（新增议题请填报至会议纪要看板） You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/961342573 Add topics at https://etherpad.openeuler.org/p/Kernel-meetings More information: https://www.openeuler.org/en/

1 0