- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] blk-ioinf: accumulate total latency properly across sampling periods
by Baokun Li 26 Nov '25

26 Nov '25

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/ID0C1D -------------------------------- QoS evaluation based on delta_stat should only be performed when the number of samples exceeds IOINF_MIN_SAMPLES. Otherwise, abnormal cases in small sample sets may cause overly aggressive adjustments. Therefore, when updating delta_stat, it is only reset if the number of I/Os exceeds IOINF_MIN_SAMPLES; otherwise, sampling results are accumulated across multiple periods until the total sample count reaches at least IOINF_MIN_SAMPLES. However, when accumulating across multiple periods, the average latency was treated as total latency, leading to underestimated values. Fix this by introducing a variable to track total latency. In addition, since the update logic for read and write is identical, a helper function ioinf_update_delta_io_stat() is added to avoid code duplication. Fixes: 4192ef0b0776 ("blk-ioinf: add rqos/inflight/stat debufs interface") Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- block/blk-ioinf.c | 26 +++++++++++++++----------- 1 file changed, 15 insertions(+), 11 deletions(-) diff --git a/block/blk-ioinf.c b/block/blk-ioinf.c index 623c2715802b..1be9c690d8a4 100644 --- a/block/blk-ioinf.c +++ b/block/blk-ioinf.c @@ -680,20 +680,24 @@ static void ioinf_sample_cpu_lat(struct ioinf_lat_stat *cur, int cpu, cur->write.met += pstat->write.met; } +static inline void ioinf_update_delta_io_stat(struct ioinf_io_stat cur, + struct ioinf_io_stat last, struct ioinf_io_stat *delta) +{ + u64 lat = delta->nr * delta->lat; + + delta->nr += cur.nr - last.nr; + delta->met += cur.met - last.met; + if (delta->nr > 0) { + lat += cur.lat - last.lat; + delta->lat = div_u64(lat, delta->nr); + } +} + static void ioinf_update_delta_stat(struct ioinf_lat_stat *cur, struct ioinf_lat_stat *last, struct ioinf_lat_stat *delta) { - delta->read.nr += cur->read.nr - last->read.nr; - delta->read.met += cur->read.met - last->read.met; - delta->read.lat += cur->read.lat - last->read.lat; - if (delta->read.nr > 0) - delta->read.lat = div_u64(delta->read.lat, delta->read.nr); - - delta->write.nr += cur->write.nr - last->write.nr; - delta->write.met += cur->write.met - last->write.met; - delta->write.lat += cur->write.lat - last->write.lat; - if (delta->write.nr > 0) - delta->write.lat = div_u64(delta->write.lat, delta->write.nr); + ioinf_update_delta_io_stat(cur->read, last->read, &delta->read); + ioinf_update_delta_io_stat(cur->write, last->write, &delta->write); } static void ioinf_sample_lat(struct ioinf *inf) -- 2.46.1

2 1

[PATCH OLK-6.6] usbnet: Fix using smp_processor_id() in preemptible code warnings
by Jiacheng Yu 26 Nov '25

26 Nov '25

From: Zqiang <qiang.zhang(a)linux.dev> stable inclusion from stable-v6.17.5 commit 0134c7bff14bd50314a4f92b182850ddfc38e255 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6BA2 CVE: CVE-2025-40164 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 327cd4b68b4398b6c24f10eb2b2533ffbfc10185 ] Syzbot reported the following warning: BUG: using smp_processor_id() in preemptible [00000000] code: dhcpcd/2879 caller is usbnet_skb_return+0x74/0x490 drivers/net/usb/usbnet.c:331 CPU: 1 UID: 0 PID: 2879 Comm: dhcpcd Not tainted 6.15.0-rc4-syzkaller-00098-g615dca38c2ea #0 PREEMPT(voluntary) Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 check_preemption_disabled+0xd0/0xe0 lib/smp_processor_id.c:49 usbnet_skb_return+0x74/0x490 drivers/net/usb/usbnet.c:331 usbnet_resume_rx+0x4b/0x170 drivers/net/usb/usbnet.c:708 usbnet_change_mtu+0x1be/0x220 drivers/net/usb/usbnet.c:417 __dev_set_mtu net/core/dev.c:9443 [inline] netif_set_mtu_ext+0x369/0x5c0 net/core/dev.c:9496 netif_set_mtu+0xb0/0x160 net/core/dev.c:9520 dev_set_mtu+0xae/0x170 net/core/dev_api.c:247 dev_ifsioc+0xa31/0x18d0 net/core/dev_ioctl.c:572 dev_ioctl+0x223/0x10e0 net/core/dev_ioctl.c:821 sock_do_ioctl+0x19d/0x280 net/socket.c:1204 sock_ioctl+0x42f/0x6a0 net/socket.c:1311 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:906 [inline] __se_sys_ioctl fs/ioctl.c:892 [inline] __x64_sys_ioctl+0x190/0x200 fs/ioctl.c:892 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f For historical and portability reasons, the netif_rx() is usually run in the softirq or interrupt context, this commit therefore add local_bh_disable/enable() protection in the usbnet_resume_rx(). Fixes: 43daa96b166c ("usbnet: Stop RX Q on MTU change") Link: https://syzkaller.appspot.com/bug?id=81f55dfa587ee544baaaa5a359a060512228c1… Suggested-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Zqiang <qiang.zhang(a)linux.dev> Link: https://patch.msgid.link/20251011070518.7095-1-qiang.zhang@linux.dev Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jiacheng Yu <yujiacheng3(a)huawei.com> --- drivers/net/usb/usbnet.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c index ac0458b96738..c4134303d395 100644 --- a/drivers/net/usb/usbnet.c +++ b/drivers/net/usb/usbnet.c @@ -702,6 +702,7 @@ void usbnet_resume_rx(struct usbnet *dev) struct sk_buff *skb; int num = 0; + local_bh_disable(); clear_bit(EVENT_RX_PAUSED, &dev->flags); while ((skb = skb_dequeue(&dev->rxq_pause)) != NULL) { @@ -710,6 +711,7 @@ void usbnet_resume_rx(struct usbnet *dev) } tasklet_schedule(&dev->bh); + local_bh_enable(); netif_dbg(dev, rx_status, dev->net, "paused rx queue disabled, %d skbs requeued\n", num); -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] sched: Fix race between yield_to() and try_to_wake_up()
by Xia Fukun 26 Nov '25

26 Nov '25

From: Tianchen Ding <dtcccc(a)linux.alibaba.com> mainline inclusion from mainline-v6.18-rc1 commit 5d808c78d97251af1d3a3e4f253e7d6c39fd871e category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID8CE7 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- We met a SCHED_WARN in set_next_buddy(): __warn_printk set_next_buddy yield_to_task_fair yield_to kvm_vcpu_yield_to [kvm] ... After a short dig, we found the rq_lock held by yield_to() may not be exactly the rq that the target task belongs to. There is a race window against try_to_wake_up(). CPU0 target_task blocking on CPU1 lock rq0 & rq1 double check task_rq == p_rq, ok woken to CPU2 (lock task_pi & rq2) task_rq = rq2 yield_to_task_fair (w/o lock rq2) In this race window, yield_to() is operating the task w/o the correct lock. Fix this by taking task pi_lock first. Fixes: d95f41220065 ("sched: Add yield_to(task, preempt) functionality") Signed-off-by: Tianchen Ding <dtcccc(a)linux.alibaba.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Link: https://lkml.kernel.org/r/20241231055020.6521-1-dtcccc@linux.alibaba.com Conflicts: kernel/sched/syscalls.c kernel/sched/core.c [Context differences.] Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- kernel/sched/core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 4149f554debd..f7fa066b05ba 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -5144,7 +5144,7 @@ int __sched yield_to(struct task_struct *p, bool preempt) unsigned long flags; int yielded = 0; - local_irq_save(flags); + raw_spin_lock_irqsave(&p->pi_lock, flags); rq = this_rq(); again: @@ -5187,7 +5187,7 @@ int __sched yield_to(struct task_struct *p, bool preempt) out_unlock: double_rq_unlock(rq, p_rq); out_irq: - local_irq_restore(flags); + raw_spin_unlock_irqrestore(&p->pi_lock, flags); if (yielded > 0) schedule(); -- 2.34.1

2 1

[PATCH OLK-6.6 00/11] xsched: XCU Partition
by Zicheng Qu 26 Nov '25

26 Nov '25

Zicheng Qu (11): xsched: unify log prefix format and remove duplicated prefix macros xsched: enforce valid xsched scheduler config dependencies xsched: add missing spin_unlock() in xcu_move_task() error path xsched: avoid sleeping while holding spinlock in xcu_move_task() xsched: remove parent->lock and rely on cgroup_mutex for shares update xsched: unify root detection logic for cgroups xsched: replace hard-coded numeric values xsched: modify the logic for inc and dec the count value xsched: add null check for sched in xsched_xse_set_class xsched: rename vstream->id to vstream->sq_id xsched: move stream_lock into xsched_vsm_add_tail() to avoid sleeping in atomic context arch/arm64/configs/openeuler_defconfig | 6 +- arch/x86/configs/openeuler_defconfig | 6 +- drivers/xcu/xcu_group.c | 2 + include/linux/vstream.h | 2 +- include/linux/xsched.h | 76 ++++++++--------------- kernel/xsched/Kconfig | 14 ++++- kernel/xsched/cgroup.c | 79 ++++++++++-------------- kernel/xsched/core.c | 83 ++++++++++++++------------ kernel/xsched/vstream.c | 29 +++------ 9 files changed, 134 insertions(+), 163 deletions(-) -- 2.34.1

2 12

[PATCH OLK-6.6 0/3] fix cve-2025-40300
by Bowen You 26 Nov '25

26 Nov '25

fix cve 2025-40300 Pawan Gupta (3): x86/vmscape: Add conditional IBPB mitigation x86/vmscape: Enumerate VMSCAPE bug x86/vmscape: Enable the mitigation .../ABI/testing/sysfs-devices-system-cpu | 1 + .../admin-guide/kernel-parameters.txt | 11 +++ arch/x86/Kconfig | 9 ++ arch/x86/include/asm/cpufeatures.h | 2 + arch/x86/include/asm/entry-common.h | 7 ++ arch/x86/include/asm/nospec-branch.h | 2 + arch/x86/kernel/cpu/bugs.c | 85 +++++++++++++++++++ arch/x86/kernel/cpu/common.c | 58 +++++++++---- arch/x86/kvm/x86.c | 9 ++ drivers/base/cpu.c | 3 + 10 files changed, 169 insertions(+), 18 deletions(-) -- 2.34.1

2 4

[PATCH OLK-5.10 0/8] fix cves
by Wupeng Ma 26 Nov '25

26 Nov '25

fix the fellowing cves: - CVE-2025-38084 - CVE-2025-21693 - CVE-2021-47653 Chengming Zhou (1): mm/zswap: change per-cpu mutex and buffer to per-acomp_ctx Dmitry Nikiforov (1): media: davinci: vpif: Fix memory leak in probe error path James Houghton (1): hugetlb: unshare some PMDs when splitting VMAs Jann Horn (1): mm/hugetlb: unshare page tables during VMA split, not before Johan Hovold (1): media: davinci: vpif: fix use-after-free on driver unbind Yosry Ahmed (3): mm: zswap: properly synchronize freeing resources during CPU hotunplug mm: zswap: move allocations during CPU init outside the lock mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead() drivers/media/platform/davinci/vpif.c | 99 ++++++++++---- include/linux/cpuhotplug.h | 2 +- include/linux/hugetlb.h | 6 + mm/hugetlb.c | 92 +++++++++++++ mm/mmap.c | 8 ++ mm/zswap.c | 186 ++++++++++++++------------ 6 files changed, 280 insertions(+), 113 deletions(-) -- 2.43.0

2 9

[PATCH OLK-6.6 0/5] fix cves
by Wupeng Ma 26 Nov '25

26 Nov '25

fix the fellowing cves: - CVE-2025-38084 - CVE-2025-21693 - CVE-2021-47653 Chengming Zhou (1): mm/zswap: change per-cpu mutex and buffer to per-acomp_ctx Jann Horn (1): mm/hugetlb: unshare page tables during VMA split, not before Yosry Ahmed (3): mm: zswap: properly synchronize freeing resources during CPU hotunplug mm: zswap: move allocations during CPU init outside the lock mm: zswap: fix crypto_free_acomp() deadlock in zswap_cpu_comp_dead() include/linux/cpuhotplug.h | 2 +- include/linux/hugetlb.h | 3 + mm/hugetlb.c | 60 ++++++++---- mm/mmap.c | 6 ++ mm/zswap.c | 187 ++++++++++++++++++++----------------- 5 files changed, 154 insertions(+), 104 deletions(-) -- 2.43.0

2 6

[PATCH OLK-5.10 0/6] fix cves
by Wupeng Ma 26 Nov '25

26 Nov '25

fix the fellowing cves: - CVE-2025-38084 - CVE-2025-21693 - CVE-2021-47653 Chengming Zhou (1): mm/zswap: change per-cpu mutex and buffer to per-acomp_ctx James Houghton (1): hugetlb: unshare some PMDs when splitting VMAs Jann Horn (1): mm/hugetlb: unshare page tables during VMA split, not before Johan Hovold (1): media: davinci: vpif: fix use-after-free on driver unbind Yosry Ahmed (2): mm: zswap: properly synchronize freeing resources during CPU hotunplug mm: zswap: move allocations during CPU init outside the lock drivers/media/platform/davinci/vpif.c | 97 +++++++++++----- include/linux/cpuhotplug.h | 2 +- include/linux/hugetlb.h | 6 + mm/hugetlb.c | 92 +++++++++++++++ mm/mmap.c | 8 ++ mm/zswap.c | 160 +++++++++++++------------- 6 files changed, 258 insertions(+), 107 deletions(-) -- 2.43.0

2 7

[PATCH OLK-6.6 0/4] fix cves for 6.6
by Wupeng Ma 26 Nov '25

26 Nov '25

fix the following cve: - CVE-2025-38084 - CVE-2025-21693 Chengming Zhou (1): mm/zswap: change per-cpu mutex and buffer to per-acomp_ctx Jann Horn (1): mm/hugetlb: unshare page tables during VMA split, not before Yosry Ahmed (2): mm: zswap: properly synchronize freeing resources during CPU hotunplug mm: zswap: move allocations during CPU init outside the lock include/linux/cpuhotplug.h | 2 +- include/linux/hugetlb.h | 3 + mm/hugetlb.c | 60 ++++++++++---- mm/mmap.c | 6 ++ mm/zswap.c | 161 ++++++++++++++++++------------------- 5 files changed, 134 insertions(+), 98 deletions(-) -- 2.43.0

2 5

[PATCH OLK-6.6 00/11] xsched: XCU Partition
by Zicheng Qu 26 Nov '25

26 Nov '25

Zicheng Qu (11): xsched: unify log prefix format and remove duplicated prefix macros xsched: enforce valid xsched scheduler config dependencies xsched: add missing spin_unlock() in xcu_move_task() error path xsched: avoid sleeping while holding spinlock in xcu_move_task() xsched: remove parent->lock and rely on cgroup_mutex for shares update xsched: unify root detection logic for cgroups xsched: replace hard-coded numeric values xsched: modify the logic for inc and dec the count value xsched: add null check for sched in xsched_xse_set_class xsched: rename vstream->id to vstream->sq_id xsched: move stream_lock into xsched_vsm_add_tail() to avoid sleeping in atomic context arch/arm64/configs/openeuler_defconfig | 6 +- arch/x86/configs/openeuler_defconfig | 6 +- drivers/xcu/xcu_group.c | 2 + include/linux/vstream.h | 2 +- include/linux/xsched.h | 76 ++++++++--------------- kernel/xsched/Kconfig | 5 +- kernel/xsched/cgroup.c | 79 ++++++++++-------------- kernel/xsched/core.c | 83 ++++++++++++++------------ kernel/xsched/vstream.c | 29 +++------ 9 files changed, 125 insertions(+), 163 deletions(-) -- 2.34.1

2 12