- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 v6 0/5] bugfix for xcall2.0
by Xinyu Zheng 27 Nov '25

27 Nov '25

Xinyu Zheng (5): xcall2.0: prefetch: fix value name typos in __do_sys_epoll_pwait xcall2.0: prefetch: keep prefetch module name same with file name xcall2.0: add xcall_subdir_create help to create subdir below /proc/xcall xcall2.0: Fix mem leak in proc_xcall_command xcall2.0: prefetch: introduce struct prefetch_mm_data arch/arm64/include/asm/xcall.h | 4 +- arch/arm64/kernel/xcall/core.c | 25 ++++- arch/arm64/kernel/xcall/proc.c | 61 ++---------- drivers/staging/xcall/prefetch.c | 156 +++++++++++++++++++++---------- include/linux/xcall.h | 1 + 5 files changed, 140 insertions(+), 107 deletions(-) -- 2.34.1

2 6

[openeuler:OLK-6.6 3392/3392] htmldocs: Documentation/networking/ub/ubl.rst:63: WARNING: undefined label: 'documentation/networking/ub/unic.rst' [ref.ref]
by kernel test robot 27 Nov '25

27 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: ef262ed1914f6af42786e3f0785c3ea16d21e335 commit: 5581b34fafcb3d4c4d1e98b6bf6a543ca47db91b [3392/3392] net: ubl: Add a doc for ubl module reproduce: (https://download.01.org/0day-ci/archive/20251127/202511270737.QHfXJWa1-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511270737.QHfXJWa1-lkp@intel.com/ All warnings (new ones prefixed by >>): Documentation/scsi/sssraid.rst: WARNING: document isn't included in any toctree [toc.not_included] Documentation/virt/coco/csv-guest.rst: WARNING: document isn't included in any toctree [toc.not_included] Documentation/virt/kvm/arm/pvsched.rst: WARNING: document isn't included in any toctree [toc.not_included] Documentation/virt/kvm/arm/pvsgi.rst: WARNING: document isn't included in any toctree [toc.not_included] Documentation/vm/memcg_memfs_info.rst: WARNING: document isn't included in any toctree [toc.not_included] >> Documentation/networking/ub/ubl.rst:63: WARNING: undefined label: 'documentation/networking/ub/unic.rst' [ref.ref] vim +63 Documentation/networking/ub/ubl.rst 59 60 .. kernel-doc:: drivers/net/ub/dev/ubl.c 61 :identifiers: alloc_ubldev_mqs ubl_create_header ubl_type_trans 62 > 63 An example of using the above API is the unic driver, see more detail using in 64 :ref:`Documentation/networking/ub/unic.rst` 65 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] nfsd: don't ignore the return code of svc_proc_register()
by Li Lingfeng 27 Nov '25

27 Nov '25

From: Jeff Layton <jlayton(a)kernel.org> mainline inclusion from mainline-v6.15-rc1 commit 930b64ca0c511521f0abdd1d57ce52b2a6e3476b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QT8 CVE: CVE-2025-22026 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Currently, nfsd_proc_stat_init() ignores the return value of svc_proc_register(). If the procfile creation fails, then the kernel will WARN when it tries to remove the entry later. Fix nfsd_proc_stat_init() to return the same type of pointer as svc_proc_register(), and fix up nfsd_net_init() to check that and fail the nfsd_net construction if it occurs. svc_proc_register() can fail if the dentry can't be allocated, or if an identical dentry already exists. The second case is pretty unlikely in the nfsd_net construction codepath, so if this happens, return -ENOMEM. Reported-by: syzbot+e34ad04f27991521104c(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-nfs/67a47501.050a0220.19061f.05f9.GAE@google.… Cc: stable(a)vger.kernel.org # v6.9 Signed-off-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Conflicts: fs/nfsd/nfsctl.c fs/nfsd/stats.c fs/nfsd/stats.h [Commit 73598a0cfb21 ("nfsd: don't allocate the versions array.") declare an array to the max size instead of using kmalloc to allocate an array; commit 7d12cce8784c ("fs: nfsd: use group allocation/free of per-cpu counters API") remove some functions;] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfsd/nfsctl.c | 9 ++++++++- fs/nfsd/stats.c | 4 ++-- fs/nfsd/stats.h | 2 +- 3 files changed, 11 insertions(+), 4 deletions(-) diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c index 887035b74467..f9015635fb37 100644 --- a/fs/nfsd/nfsctl.c +++ b/fs/nfsd/nfsctl.c @@ -1527,17 +1527,24 @@ static __net_init int nfsd_net_init(struct net *net) retval = nfsd_stat_counters_init(nn); if (retval) goto out_repcache_error; + memset(&nn->nfsd_svcstats, 0, sizeof(nn->nfsd_svcstats)); nn->nfsd_svcstats.program = &nfsd_program; + if (!nfsd_proc_stat_init(net)) { + retval = -ENOMEM; + goto out_proc_error; + } + nn->nfsd_versions = NULL; nn->nfsd4_minorversions = NULL; nfsd4_init_leases_net(nn); get_random_bytes(&nn->siphash_key, sizeof(nn->siphash_key)); seqlock_init(&nn->writeverf_lock); - nfsd_proc_stat_init(net); return 0; +out_proc_error: + nfsd_stat_counters_destroy(nn); out_repcache_error: nfsd_idmap_shutdown(net); out_idmap_error: diff --git a/fs/nfsd/stats.c b/fs/nfsd/stats.c index 9f606fa08bd4..0a629a18831f 100644 --- a/fs/nfsd/stats.c +++ b/fs/nfsd/stats.c @@ -115,11 +115,11 @@ void nfsd_stat_counters_destroy(struct nfsd_net *nn) nfsd_percpu_counters_destroy(nn->counter, NFSD_STATS_COUNTERS_NUM); } -void nfsd_proc_stat_init(struct net *net) +struct proc_dir_entry *nfsd_proc_stat_init(struct net *net) { struct nfsd_net *nn = net_generic(net, nfsd_net_id); - svc_proc_register(net, &nn->nfsd_svcstats, &nfsd_proc_ops); + return svc_proc_register(net, &nn->nfsd_svcstats, &nfsd_proc_ops); } void nfsd_proc_stat_shutdown(struct net *net) diff --git a/fs/nfsd/stats.h b/fs/nfsd/stats.h index d2753e975dfd..b1f7d21cbcd1 100644 --- a/fs/nfsd/stats.h +++ b/fs/nfsd/stats.h @@ -15,7 +15,7 @@ void nfsd_percpu_counters_reset(struct percpu_counter *counters, int num); void nfsd_percpu_counters_destroy(struct percpu_counter *counters, int num); int nfsd_stat_counters_init(struct nfsd_net *nn); void nfsd_stat_counters_destroy(struct nfsd_net *nn); -void nfsd_proc_stat_init(struct net *net); +struct proc_dir_entry *nfsd_proc_stat_init(struct net *net); void nfsd_proc_stat_shutdown(struct net *net); static inline void nfsd_stats_rc_hits_inc(struct nfsd_net *nn) -- 2.46.1

2 1

[PATCH OLK-6.6 00/10] CVE-2025-39697
by Li Lingfeng 27 Nov '25

27 Nov '25

Fix CVE-2025-39697. Christoph Hellwig (7): nfs: remove dead code for the old swap over NFS implementation nfs: remove nfs_folio_private_request nfs: simplify nfs_folio_find_and_lock_request nfs: fold nfs_folio_find_and_lock_request into nfs_lock_and_join_requests nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests nfs: move nfs_wait_on_request to write.c nfs: don't reuse partially completed requests in nfs_lock_and_join_requests Dan Carpenter (1): nfs: Add missing release on error in nfs_lock_and_join_requests() Trond Myklebust (2): Revert "nfs: don't reuse partially completed requests in nfs_lock_and_join_requests" NFS: Fix a race when updating an existing write fs/nfs/file.c | 6 +- fs/nfs/filelayout/filelayout.c | 1 - fs/nfs/fscache.c | 2 +- fs/nfs/internal.h | 8 +- fs/nfs/pagelist.c | 126 +------------- fs/nfs/pnfs.h | 22 --- fs/nfs/pnfs_nfs.c | 47 ------ fs/nfs/read.c | 2 +- fs/nfs/write.c | 293 +++++++++++++++------------------ include/linux/nfs_page.h | 8 +- 10 files changed, 153 insertions(+), 362 deletions(-) -- 2.46.1

2 11

[PATCH OLK-6.6 v5 0/7] bugfix for xcall2.0
by Xinyu Zheng 27 Nov '25

27 Nov '25

Xinyu Zheng (7): xcall2.0: prefetch: fix value name typos in __do_sys_epoll_pwait xcall2.0: prefetch: keep prefetch module name same with file name xcall2.0: prefetch: fix memory leak when release prefetch item through mmu notifier xcall2.0: add xcall_subdir_create help to create subdir below /proc/xcall xcall2.0: prefetch: epoll_ctl no need to occupy a file refcount xcall2.0: prefetch: introduce struct prefetch_mm_data xcall2.0: Fix mem leak in proc_xcall_command arch/arm64/include/asm/xcall.h | 4 +- arch/arm64/kernel/xcall/core.c | 25 ++++- arch/arm64/kernel/xcall/proc.c | 61 ++---------- drivers/staging/xcall/prefetch.c | 164 ++++++++++++++++++++----------- include/linux/xcall.h | 1 + 5 files changed, 141 insertions(+), 114 deletions(-) -- 2.34.1

2 8

[PATCH OLK-6.6 v5 0/7] bugfix for xcall2.0
by Xinyu Zheng 27 Nov '25

27 Nov '25

Xinyu Zheng (7): xcall2.0: prefetch: fix value name typos in __do_sys_epoll_pwait xcall2.0: prefetch: keep prefetch module name same with file name xcall2.0: prefetch: fix memory leak when release prefetch item through mmu notifier xcall2.0: add xcall_subdir_create help to create subdir below /proc/xcall xcall2.0: prefetch: epoll_ctl no need to occupy a file refcount xcall2.0: prefetch: introduce struct prefetch_mm_data xcall2.0: Fix mem leak in proc_xcall_command arch/arm64/include/asm/xcall.h | 4 +- arch/arm64/kernel/xcall/core.c | 16 +++ arch/arm64/kernel/xcall/proc.c | 61 ++---------- drivers/staging/xcall/prefetch.c | 164 ++++++++++++++++++++----------- include/linux/xcall.h | 1 + 5 files changed, 136 insertions(+), 110 deletions(-) -- 2.34.1

2 8

[PATCH OLK-6.6 0/2] Fix cves CVE-2025-40040 & CVE-2025-40058
by Quanmin Yan 27 Nov '25

27 Nov '25

Fix the fellowing cves: - CVE-2025-40040 - CVE-2025-40058 Jakub Acs (1): mm/ksm: fix flag-dropping behavior in ksm_madvise Lu Baolu (1): iommu/vt-d: Disallow dirty tracking if incoherent page walk drivers/iommu/intel/iommu.h | 3 ++- drivers/net/ethernet/huawei/bma/edma_drv/edma_host.h | 2 +- include/linux/mm.h | 2 +- rust/bindings/bindings_helper.h | 2 ++ rust/bindings/lib.rs | 1 + 5 files changed, 7 insertions(+), 3 deletions(-) -- 2.43.0

2 3

[openeuler:OLK-5.10 3333/3333] htmldocs: Warning: mm/hugetlb.c references a file that doesn't exist: Documentation/mm/mmu_notifier.rst
by kernel test robot 27 Nov '25

27 Nov '25

Hi James, First bad commit (maybe != root cause): tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 18627faf2934ad96de2e45368ec4cf2444343b22 commit: 06bf7ef0de9fd581d9a66f2154dddbaddc1812da [3333/3333] hugetlb: unshare some PMDs when splitting VMAs reproduce: (https://download.01.org/0day-ci/archive/20251126/202511261802.tpTOoC8k-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511261802.tpTOoC8k-lkp@intel.com/ All warnings (new ones prefixed by >>): Warning: arch/riscv/kvm/vcpu.c references a file that doesn't exist: Documentation/virtual/kvm/vcpu-requests.rst Warning: arch/x86/kernel/cpu/resctrl/monitor.c references a file that doesn't exist: Documentation/x86/resctrl.rst Warning: crypto/asymmetric_keys/pgp_preload.c references a file that doesn't exist: Documentation/security/keys-crypto.txt Warning: drivers/irqchip/Kconfig references a file that doesn't exist: Documentation/loongarch/irq-chip-model.rst Warning: drivers/net/ethernet/yunsilicon/xsc/common/xsc_ioctl.h references a file that doesn't exist: Documentation/ioctl/ioctl-number.txt >> Warning: mm/hugetlb.c references a file that doesn't exist: Documentation/mm/mmu_notifier.rst Warning: openEuler/MAINTAINERS references a file that doesn't exist: Documentation/networking/hinic3.rst Warning: /sys/bus/iio/devices/iio:deviceX/in_accel_x_calibbias is defined 2 times: ./Documentation/ABI/testing/sysfs-bus-iio:394 ./Documentation/ABI/testing/sysfs-bus-iio-icm42600:0 Warning: /sys/bus/iio/devices/iio:deviceX/in_accel_y_calibbias is defined 2 times: ./Documentation/ABI/testing/sysfs-bus-iio:395 ./Documentation/ABI/testing/sysfs-bus-iio-icm42600:1 Warning: /sys/bus/iio/devices/iio:deviceX/in_accel_z_calibbias is defined 2 times: ./Documentation/ABI/testing/sysfs-bus-iio:396 ./Documentation/ABI/testing/sysfs-bus-iio-icm42600:2 Warning: /sys/bus/iio/devices/iio:deviceX/in_anglvel_x_calibbias is defined 2 times: ./Documentation/ABI/testing/sysfs-bus-iio:397 ./Documentation/ABI/testing/sysfs-bus-iio-icm42600:3 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/4] fix cve-2025-40300
by Bowen You 26 Nov '25

26 Nov '25

*** BLURB HERE *** Bowen You (1): config: enable CONFIG_MITIGATION_VMESCAPE by default on x86 Pawan Gupta (3): x86/vmscape: Add conditional IBPB mitigation x86/vmscape: Enumerate VMSCAPE bug x86/vmscape: Enable the mitigation .../ABI/testing/sysfs-devices-system-cpu | 1 + .../admin-guide/kernel-parameters.txt | 11 +++ arch/x86/Kconfig | 9 ++ arch/x86/configs/openeuler_defconfig | 1 + arch/x86/include/asm/cpufeatures.h | 2 + arch/x86/include/asm/entry-common.h | 7 ++ arch/x86/include/asm/nospec-branch.h | 2 + arch/x86/kernel/cpu/bugs.c | 85 +++++++++++++++++++ arch/x86/kernel/cpu/common.c | 58 +++++++++---- arch/x86/kvm/x86.c | 9 ++ drivers/base/cpu.c | 3 + 11 files changed, 170 insertions(+), 18 deletions(-) -- 2.34.1

2 5

[PATCH OLK-6.6] nbd: fix uaf in nbd_genl_connect() error path
by Zizhi Wo 26 Nov '25

26 Nov '25

From: Zheng Qixing <zhengqixing(a)huawei.com> stable inclusion from stable-v6.6.99 commit d46186eb7bbd9a11c145120f2d77effa8d4d44c2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICOXOQ CVE: CVE-2025-38443 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit aa9552438ebf015fc5f9f890dbfe39f0c53cf37e ] There is a use-after-free issue in nbd: block nbd6: Receive control failed (result -104) block nbd6: shutting down sockets ================================================================== BUG: KASAN: slab-use-after-free in recv_work+0x694/0xa80 drivers/block/nbd.c:1022 Write of size 4 at addr ffff8880295de478 by task kworker/u33:0/67 CPU: 2 UID: 0 PID: 67 Comm: kworker/u33:0 Not tainted 6.15.0-rc5-syzkaller-00123-g2c89c1b655c0 #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Workqueue: nbd6-recv recv_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0xc3/0x670 mm/kasan/report.c:521 kasan_report+0xe0/0x110 mm/kasan/report.c:634 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189 instrument_atomic_read_write include/linux/instrumented.h:96 [inline] atomic_dec include/linux/atomic/atomic-instrumented.h:592 [inline] recv_work+0x694/0xa80 drivers/block/nbd.c:1022 process_one_work+0x9cc/0x1b70 kernel/workqueue.c:3238 process_scheduled_works kernel/workqueue.c:3319 [inline] worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400 kthread+0x3c2/0x780 kernel/kthread.c:464 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:153 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> nbd_genl_connect() does not properly stop the device on certain error paths after nbd_start_device() has been called. This causes the error path to put nbd->config while recv_work continue to use the config after putting it, leading to use-after-free in recv_work. This patch moves nbd_start_device() after the backend file creation. Reported-by: syzbot+48240bab47e705c53126(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68227a04.050a0220.f2294.00b5.GAE@google.com/T/ Fixes: 6497ef8df568 ("nbd: provide a way for userspace processes to identify device backends") Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> Reviewed-by: Yu Kuai <yukuai3(a)huawei.com> Link: https://lore.kernel.org/r/20250612132405.364904-1-zhengqixing@huaweicloud.c… Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- drivers/block/nbd.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index 26e1cf7f666c..6e42099dc70c 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -2133,9 +2133,7 @@ static int nbd_genl_connect(struct sk_buff *skb, struct genl_info *info) goto out; } } - ret = nbd_start_device(nbd); - if (ret) - goto out; + if (info->attrs[NBD_ATTR_BACKEND_IDENTIFIER]) { nbd->backend = nla_strdup(info->attrs[NBD_ATTR_BACKEND_IDENTIFIER], GFP_KERNEL); @@ -2151,6 +2149,8 @@ static int nbd_genl_connect(struct sk_buff *skb, struct genl_info *info) goto out; } set_bit(NBD_RT_HAS_BACKEND_FILE, &config->runtime_flags); + + ret = nbd_start_device(nbd); out: mutex_unlock(&nbd->config_lock); if (!ret) { -- 2.39.2

2 1