- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] padata: Reset next CPU when reorder sequence wraps around
by Wang Tao 04 Nov '25

04 Nov '25

From: Xiao Liang <shaw.leon(a)gmail.com> mainline inclusion from mainline-v6.18-rc1 commit 501302d5cee0d8e8ec2c4a5919c37e0df9abc99b category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID3Y90 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When seq_nr wraps around, the next reorder job with seq 0 is hashed to the first CPU in padata_do_serial(). Correspondingly, need reset pd->cpu to the first one when pd->processed wraps around. Otherwise, if the number of used CPUs is not a power of 2, padata_find_next() will be checking a wrong list, hence deadlock. Fixes: 6fc4dbcf0276 ("padata: Replace delayed timer with immediate workqueue in padata_reorder") Cc: <stable(a)vger.kernel.org> Signed-off-by: Xiao Liang <shaw.leon(a)gmail.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Conflicts: kernel/padata.c [In mainline, commit f954a2d37637 ("padata: switch padata_find_next() to using cpumask_next_wrap()") has change the "cpumask_next_wrap" function.] Signed-off-by: Wang Tao <wangtao554(a)huawei.com> --- kernel/padata.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/kernel/padata.c b/kernel/padata.c index 44ea75bfd868..e87bbefdf0a0 100644 --- a/kernel/padata.c +++ b/kernel/padata.c @@ -307,8 +307,12 @@ static void padata_reorder(struct padata_priv *padata) struct padata_serial_queue *squeue; int cb_cpu; - cpu = cpumask_next_wrap(cpu, pd->cpumask.pcpu, -1, false); processed++; + /* When sequence wraps around, reset to the first CPU. */ + if (unlikely(processed == 0)) + cpu = cpumask_first(pd->cpumask.pcpu); + else + cpu = cpumask_next_wrap(cpu, pd->cpumask.pcpu, -1, false); cb_cpu = padata->cb_cpu; squeue = per_cpu_ptr(pd->squeue, cb_cpu); -- 2.34.1

2 1

[PATCH OLK-5.10] padata: Reset next CPU when reorder sequence wraps around
by Wang Tao 04 Nov '25

04 Nov '25

From: Xiao Liang <shaw.leon(a)gmail.com> stable inclusion from stable-v5.10.246 commit 3c1cb53236a12a3374365990eccfff5336aa63df category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID3Y90 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 501302d5cee0d8e8ec2c4a5919c37e0df9abc99b ] When seq_nr wraps around, the next reorder job with seq 0 is hashed to the first CPU in padata_do_serial(). Correspondingly, need reset pd->cpu to the first one when pd->processed wraps around. Otherwise, if the number of used CPUs is not a power of 2, padata_find_next() will be checking a wrong list, hence deadlock. Fixes: 6fc4dbcf0276 ("padata: Replace delayed timer with immediate workqueue in padata_reorder") Cc: <stable(a)vger.kernel.org> Signed-off-by: Xiao Liang <shaw.leon(a)gmail.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> [ moved from padata_reorder() local variables to padata_find_next() using pd->processed and pd->cpu struct members ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Tao <wangtao554(a)huawei.com> --- kernel/padata.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/kernel/padata.c b/kernel/padata.c index d0f6bf1cf18a..a93a269045da 100644 --- a/kernel/padata.c +++ b/kernel/padata.c @@ -295,7 +295,11 @@ static struct padata_priv *padata_find_next(struct parallel_data *pd, if (remove_object) { list_del_init(&padata->list); ++pd->processed; - pd->cpu = cpumask_next_wrap(cpu, pd->cpumask.pcpu, -1, false); + /* When sequence wraps around, reset to the first CPU. */ + if (unlikely(pd->processed == 0)) + pd->cpu = cpumask_first(pd->cpumask.pcpu); + else + pd->cpu = cpumask_next_wrap(cpu, pd->cpumask.pcpu, -1, false); } spin_unlock(&reorder->lock); -- 2.34.1

2 1

[openeuler:OLK-6.6 3098/3098] fs/proc/stat.c:224:17: warning: no previous prototype for 'bpf_get_idle_time'
by kernel test robot 04 Nov '25

04 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: a29fc03bd0ddaf7388cf31604ef5bd9807585109 commit: 70780f6924c9b58d5a745d4e20e08e9ace28e711 [3098/3098] bpf-rvi: proc: add bpf_get_{idle,iowait}_time kfunc config: x86_64-randconfig-001-20251104 (https://download.01.org/0day-ci/archive/20251104/202511041056.Im8VvChb-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251104/202511041056.Im8VvChb-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511041056.Im8VvChb-lkp@intel.com/ All warnings (new ones prefixed by >>): >> fs/proc/stat.c:224:17: warning: no previous prototype for 'bpf_get_idle_time' [-Wmissing-prototypes] 224 | __bpf_kfunc u64 bpf_get_idle_time(struct kernel_cpustat *kcs, int cpu) | ^~~~~~~~~~~~~~~~~ >> fs/proc/stat.c:229:17: warning: no previous prototype for 'bpf_get_iowait_time' [-Wmissing-prototypes] 229 | __bpf_kfunc u64 bpf_get_iowait_time(struct kernel_cpustat *kcs, int cpu) | ^~~~~~~~~~~~~~~~~~~ vim +/bpf_get_idle_time +224 fs/proc/stat.c 222 223 #ifdef CONFIG_BPF_RVI > 224 __bpf_kfunc u64 bpf_get_idle_time(struct kernel_cpustat *kcs, int cpu) 225 { 226 return get_idle_time(kcs, cpu); 227 } 228 > 229 __bpf_kfunc u64 bpf_get_iowait_time(struct kernel_cpustat *kcs, int cpu) 230 { 231 return get_iowait_time(kcs, cpu); 232 } 233 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/4] CVE-2025-39981
by Jiacheng Yu 04 Nov '25

04 Nov '25

*** BLURB HERE *** Christian Eggers (1): Bluetooth: MGMT: set_mesh: update LE scan interval and window Luiz Augusto von Dentz (1): Bluetooth: MGMT: Fix possible UAFs Pavel Shpakovskiy (1): Bluetooth: hci_sync: fix set_local_name race condition Roman Smirnov (1): Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() include/net/bluetooth/hci_sync.h | 2 +- net/bluetooth/hci_sync.c | 6 +- net/bluetooth/mgmt.c | 279 ++++++++++++++++++++++--------- net/bluetooth/mgmt_util.c | 46 +++++ net/bluetooth/mgmt_util.h | 3 + 5 files changed, 257 insertions(+), 79 deletions(-) -- 2.43.0

2 5

[PATCH 0/2] EEVDF null pointer
by Zicheng Qu 04 Nov '25

04 Nov '25

Zicheng Qu (2): EEVDF null pointer reproduction zero_vruntime kernel/sched/debug.c | 8 +- kernel/sched/fair.c | 170 +++++++++++++++++----------- kernel/sched/sched.h | 2 +- null_reproduction_test/Makefile | 9 ++ null_reproduction_test/fullcpu.c | 12 ++ null_reproduction_test/make.sh | 17 +++ null_reproduction_test/test.sh | 34 ++++++ null_reproduction_test/test_sched.c | 141 +++++++++++++++++++++++ 8 files changed, 325 insertions(+), 68 deletions(-) create mode 100644 null_reproduction_test/Makefile create mode 100644 null_reproduction_test/fullcpu.c create mode 100755 null_reproduction_test/make.sh create mode 100755 null_reproduction_test/test.sh create mode 100644 null_reproduction_test/test_sched.c -- 2.34.1

1 2

[PATCH openEuler-1.0-LTS] tty: vt: Fix vc_origin buffer copy overflow in fbcon_prepare_logo()
by Chen Jun 04 Nov '25

04 Nov '25

From: Wang ShaoBo <bobo.shaobowang(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID4U8F ---------------------------------------------------------------------- I got some KASAN report as below: BUG: KASAN: slab-use-after-free in fbcon_prepare_logo+0x61e/0xc90 Read of size 14 at addr ffff88812c9a4c38 by task syz.0.3549/19016 CPU: 0 PID: 19016 Comm: syz.0.3549 Not tainted 6.6.0+ #80 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x72/0xa0 print_address_description.constprop.0+0x6b/0x3d0 ? fbcon_prepare_logo+0x61e/0xc90 print_report+0xba/0x280 ? fbcon_prepare_logo+0x61e/0xc90 ? kasan_addr_to_slab+0xd/0xa0 ? fbcon_prepare_logo+0x61e/0xc90 kasan_report+0xaf/0xe0 ? fbcon_prepare_logo+0x61e/0xc90 kasan_check_range+0x100/0x1c0 __asan_memcpy+0x23/0x60 fbcon_prepare_logo+0x61e/0xc90 fbcon_init+0xeb9/0x1db0 ? __pfx_drm_fb_helper_set_par+0x10/0x10 visual_init+0x310/0x5c0 do_bind_con_driver.isra.0+0x627/0xbd0 store_bind+0x60b/0x710 ? __pfx_store_bind+0x10/0x10 dev_attr_store+0x5a/0x90 ? __pfx_dev_attr_store+0x10/0x10 sysfs_kf_write+0x145/0x1b0 kernfs_fop_write_iter+0x367/0x580 ? __pfx_sysfs_kf_write+0x10/0x10 new_sync_write+0x1b1/0x2d0 ? __pfx_new_sync_write+0x10/0x10 ? rb_commit+0x121/0x910 ? avc_policy_seqno+0xe/0x20 ? selinux_file_permission+0x129/0x5d0 ? security_file_permission+0xa8/0x700 vfs_write+0x71a/0x960 ksys_write+0x12e/0x260 fbcon_init() -> vc_resize() //success resize vc_origin buffer size=224=7(cols)*2*16(rows) -> bcon_prepare_logo(vc, info, old_cols, old_rows, new_cols, new_rows) //old_cols=256，old_rows=4，new_cols=7，new_rows=16 There happened to be a vc_origin buffer copy overflow error in fbcon_prepare_logo(), scrolling screen down when using old cols after vc resize would trigger out of lower bound of vc_origin buffer. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Wang ShaoBo <bobo.shaobowang(a)huawei.com> Acked-by: Thomas Zimmermann <tzimmermann(a)suse.de> Signed-off-by: Chen Jun <chenjun102(a)huawei.com> --- drivers/video/fbdev/core/fbcon.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c index f5178eefec64..83a4949e2497 100644 --- a/drivers/video/fbdev/core/fbcon.c +++ b/drivers/video/fbdev/core/fbcon.c @@ -592,6 +592,8 @@ static void fbcon_prepare_logo(struct vc_data *vc, struct fb_info *info, /* We can scroll screen down */ r = q - step - cols; for (cnt = rows - logo_lines; cnt > 0; cnt--) { + if (r < (unsigned short *) vc->vc_origin) + break; scr_memcpyw(r + step, r, vc->vc_size_row); r -= cols; } -- 2.22.0

2 1

[PATCH OLK-5.10 0/3] fix CVE-2025-40080
by Zheng Qixing 04 Nov '25

04 Nov '25

fix CVE-2025-40080 Eric Dumazet (2): net: use sk_is_tcp() in more places nbd: restrict sockets to TCP and UDP John Fastabend (1): bpf: syzkaller found null ptr deref in unix_bpf proto add drivers/block/nbd.c | 8 ++++++++ include/net/sock.h | 10 ++++++++++ net/core/skbuff.c | 6 ++---- net/core/sock.c | 6 ++---- net/core/sock_map.c | 6 ------ 5 files changed, 22 insertions(+), 14 deletions(-) -- 2.39.2

2 4

[PATCH openEuler-1.0-LTS 0/2] *** fix CVE-2023-53454 ***
by Lin Ruifeng 04 Nov '25

04 Nov '25

*** fix CVE-2023-53454 *** Charles Han (1): HID: multitouch: Add NULL check in mt_input_configured Rahul Rameshbabu (1): HID: multitouch: Correct devm device reference for hidinput input_dev name drivers/hid/hid-multitouch.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) -- 2.22.0

2 3

[PATCH openEuler-1.0-LTS] PM: sleep: core: Clear power.must_resume in noirq suspend error path
by Xinyu Zheng 04 Nov '25

04 Nov '25

From: "Rafael J. Wysocki" <rafael.j.wysocki(a)intel.com> mainline inclusion from mainline-v6.18-rc1 commit be82483d1b60baf6747884bd74cb7de484deaf76 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID4AQL Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------------------------------------- If system suspend is aborted in the "noirq" phase (for instance, due to an error returned by one of the device callbacks), power.is_noirq_suspended will not be set for some devices and device_resume_noirq() will return early for them. Consequently, noirq resume callbacks will not run for them at all because the noirq suspend callbacks have not run for them yet. If any of them has power.must_resume set and late suspend has been skipped for it (due to power.smart_suspend), early resume should be skipped for it either, or its state may become inconsistent (for instance, if the early resume assumes that it will always follow noirq resume). Make that happen by clearing power.must_resume in device_resume_noirq() for devices with power.is_noirq_suspended clear that have been left in suspend by device_suspend_late(), which will subsequently cause device_resume_early() to leave the device in suspend and avoid changing its state. Fixes: 0d4b54c6fee8 ("PM / core: Add LEAVE_SUSPENDED driver flag") Link: https://lore.kernel.org/linux-pm/5d692b81-6f58-4e86-9cb0-ede69a09d799@rowla… Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Reviewed-by: Ulf Hansson <ulf.hansson(a)linaro.org> Link: https://patch.msgid.link/3381776.aeNJFYEL58@rafael.j.wysocki Conflicts: drivers/base/power/main.c [context conflict and function rename] Signed-off-by: Xinyu Zheng <zhengxinyu6(a)huawei.com> --- drivers/base/power/main.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c index fe7506aae13c..00d9353927ae 100644 --- a/drivers/base/power/main.c +++ b/drivers/base/power/main.c @@ -625,8 +625,20 @@ static int device_resume_noirq(struct device *dev, pm_message_t state, bool asyn if (dev->power.syscore || dev->power.direct_complete) goto Out; - if (!dev->power.is_noirq_suspended) + if (!dev->power.is_noirq_suspended) { + /* + * This means that system suspend has been aborted in the noirq + * phase before invoking the noirq suspend callback for the + * device, so if device_suspend_late() has left it in suspend, + * device_resume_early() should leave it in suspend either in + * case the early resume of it depends on the noirq resume that + * has not run. + */ + if ((dev_pm_smart_suspend_and_suspended(dev)) + dev->power.must_resume = false; + goto Out; + } dpm_wait_for_superior(dev, async); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] tty: vt: Fix vc_origin buffer copy overflow in fbcon_prepare_logo()
by Chen Jun 04 Nov '25

04 Nov '25

From: Wang ShaoBo <bobo.shaobowang(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID4U8F ---------------------------------------------------------------------- I got some KASAN report as below: BUG: KASAN: slab-use-after-free in fbcon_prepare_logo+0x61e/0xc90 Read of size 14 at addr ffff88812c9a4c38 by task syz.0.3549/19016 CPU: 0 PID: 19016 Comm: syz.0.3549 Not tainted 6.6.0+ #80 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x72/0xa0 print_address_description.constprop.0+0x6b/0x3d0 ? fbcon_prepare_logo+0x61e/0xc90 print_report+0xba/0x280 ? fbcon_prepare_logo+0x61e/0xc90 ? kasan_addr_to_slab+0xd/0xa0 ? fbcon_prepare_logo+0x61e/0xc90 kasan_report+0xaf/0xe0 ? fbcon_prepare_logo+0x61e/0xc90 kasan_check_range+0x100/0x1c0 __asan_memcpy+0x23/0x60 fbcon_prepare_logo+0x61e/0xc90 fbcon_init+0xeb9/0x1db0 ? __pfx_drm_fb_helper_set_par+0x10/0x10 visual_init+0x310/0x5c0 do_bind_con_driver.isra.0+0x627/0xbd0 store_bind+0x60b/0x710 ? __pfx_store_bind+0x10/0x10 dev_attr_store+0x5a/0x90 ? __pfx_dev_attr_store+0x10/0x10 sysfs_kf_write+0x145/0x1b0 kernfs_fop_write_iter+0x367/0x580 ? __pfx_sysfs_kf_write+0x10/0x10 new_sync_write+0x1b1/0x2d0 ? __pfx_new_sync_write+0x10/0x10 ? rb_commit+0x121/0x910 ? avc_policy_seqno+0xe/0x20 ? selinux_file_permission+0x129/0x5d0 ? security_file_permission+0xa8/0x700 vfs_write+0x71a/0x960 ksys_write+0x12e/0x260 fbcon_init() -> vc_resize() //success resize vc_origin buffer size=224=7(cols)*2*16(rows) -> bcon_prepare_logo(vc, info, old_cols, old_rows, new_cols, new_rows) //old_cols=256，old_rows=4，new_cols=7，new_rows=16 There happened to be a vc_origin buffer copy overflow error in fbcon_prepare_logo(), scrolling screen down when using old cols after vc resize would trigger out of lower bound of vc_origin buffer. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Wang ShaoBo <bobo.shaobowang(a)huawei.com> Acked-by: Thomas Zimmermann <tzimmermann(a)suse.de> --- drivers/video/fbdev/core/fbcon.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c index f5178eefec64..83a4949e2497 100644 --- a/drivers/video/fbdev/core/fbcon.c +++ b/drivers/video/fbdev/core/fbcon.c @@ -592,6 +592,8 @@ static void fbcon_prepare_logo(struct vc_data *vc, struct fb_info *info, /* We can scroll screen down */ r = q - step - cols; for (cnt = rows - logo_lines; cnt > 0; cnt--) { + if (r < (unsigned short *) vc->vc_origin) + break; scr_memcpyw(r + step, r, vc->vc_size_row); r -= cols; } -- 2.22.0

2 1