- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0
by Wupeng Ma 03 Jul '25

03 Jul '25

From: "Maciej S. Szmigiero" <maciej.szmigiero(a)oracle.com> stable inclusion from stable-v4.19.256 commit c3396c1c8b87510f2ac2a674948156577559d42d category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICG9RO CVE: CVE-2022-50228 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f17c31c48e5cde9895a491d91c424eeeada3e134 upstream. Don't BUG/WARN on interrupt injection due to GIF being cleared, since it's trivial for userspace to force the situation via KVM_SET_VCPU_EVENTS (even if having at least a WARN there would be correct for KVM internally generated injections). kernel BUG at arch/x86/kvm/svm/svm.c:3386! invalid opcode: 0000 [#1] SMP CPU: 15 PID: 926 Comm: smm_test Not tainted 5.17.0-rc3+ #264 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:svm_inject_irq+0xab/0xb0 [kvm_amd] Code: <0f> 0b 0f 1f 00 0f 1f 44 00 00 80 3d ac b3 01 00 00 55 48 89 f5 53 RSP: 0018:ffffc90000b37d88 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff88810a234ac0 RCX: 0000000000000006 RDX: 0000000000000000 RSI: ffffc90000b37df7 RDI: ffff88810a234ac0 RBP: ffffc90000b37df7 R08: ffff88810a1fa410 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: ffff888109571000 R14: ffff88810a234ac0 R15: 0000000000000000 FS: 0000000001821380(0000) GS:ffff88846fdc0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f74fc550008 CR3: 000000010a6fe000 CR4: 0000000000350ea0 Call Trace: <TASK> inject_pending_event+0x2f7/0x4c0 [kvm] kvm_arch_vcpu_ioctl_run+0x791/0x17a0 [kvm] kvm_vcpu_ioctl+0x26d/0x650 [kvm] __x64_sys_ioctl+0x82/0xb0 do_syscall_64+0x3b/0xc0 entry_SYSCALL_64_after_hwframe+0x44/0xae </TASK> Fixes: 219b65dcf6c0 ("KVM: SVM: Improve nested interrupt injection") Cc: stable(a)vger.kernel.org Co-developed-by: Sean Christopherson <seanjc(a)google.com> Signed-off-by: Sean Christopherson <seanjc(a)google.com> Signed-off-by: Maciej S. Szmigiero <maciej.szmigiero(a)oracle.com> Message-Id: <35426af6e123cbe91ec7ce5132ce72521f02b1b5.1651440202.git.maciej.szmigiero(a)oracle.com> Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- arch/x86/kvm/svm.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c index 74b4c98c6607..e62bcdb0822e 100644 --- a/arch/x86/kvm/svm.c +++ b/arch/x86/kvm/svm.c @@ -5127,8 +5127,6 @@ static void svm_set_irq(struct kvm_vcpu *vcpu) { struct vcpu_svm *svm = to_svm(vcpu); - BUG_ON(!(gif_set(svm))); - trace_kvm_inj_virq(vcpu->arch.interrupt.nr); ++vcpu->stat.irq_injections; -- 2.43.0

2 1

[PATCH OLK-6.6 01/12] cpufreq: Support per-policy performance boost
by Qi Xi 03 Jul '25

03 Jul '25

From: Jie Zhan <zhanjie9(a)hisilicon.com> The boost control currently applies to the whole system. However, users may prefer to boost a subset of cores in order to provide prioritized performance to workloads running on the boosted cores. Enable per-policy boost by adding a 'boost' sysfs interface under each policy path. This can be found at: /sys/devices/system/cpu/cpufreq/policy<*>/boost Same to the global boost switch, writing 1/0 to the per-policy 'boost' enables/disables boost on a cpufreq policy respectively. The user view of global and per-policy boost controls should be: 1. Enabling global boost initially enables boost on all policies, and per-policy boost can then be enabled or disabled individually, given that the platform does support so. 2. Disabling global boost makes the per-policy boost interface illegal. Signed-off-by: Jie Zhan <zhanjie9(a)hisilicon.com> Reviewed-by: Wei Xu <xuwei5(a)hisilicon.com> Acked-by: Viresh Kumar <viresh.kumar(a)linaro.org> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- drivers/cpufreq/cpufreq.c | 43 +++++++++++++++++++++++++++++++++++++++ include/linux/cpufreq.h | 3 +++ 2 files changed, 46 insertions(+) diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c index c2227be7bad8..0d5942f3f0df 100644 --- a/drivers/cpufreq/cpufreq.c +++ b/drivers/cpufreq/cpufreq.c @@ -81,6 +81,7 @@ static void cpufreq_governor_limits(struct cpufreq_policy *policy); static int cpufreq_set_policy(struct cpufreq_policy *policy, struct cpufreq_governor *new_gov, unsigned int new_pol); +static bool cpufreq_boost_supported(void); /* * Two notifier lists: the "policy" list is involved in the @@ -618,6 +619,40 @@ static ssize_t store_boost(struct kobject *kobj, struct kobj_attribute *attr, } define_one_global_rw(boost); +static ssize_t show_local_boost(struct cpufreq_policy *policy, char *buf) +{ + return sysfs_emit(buf, "%d\n", policy->boost_enabled); +} + +static ssize_t store_local_boost(struct cpufreq_policy *policy, + const char *buf, size_t count) +{ + int ret, enable; + + ret = kstrtoint(buf, 10, &enable); + if (ret || enable < 0 || enable > 1) + return -EINVAL; + + if (!cpufreq_driver->boost_enabled) + return -EINVAL; + + if (policy->boost_enabled == enable) + return count; + + cpus_read_lock(); + ret = cpufreq_driver->set_boost(policy, enable); + cpus_read_unlock(); + + if (ret) + return ret; + + policy->boost_enabled = enable; + + return count; +} + +static struct freq_attr local_boost = __ATTR(boost, 0644, show_local_boost, store_local_boost); + static struct cpufreq_governor *find_governor(const char *str_governor) { struct cpufreq_governor *t; @@ -1057,6 +1092,12 @@ static int cpufreq_add_dev_interface(struct cpufreq_policy *policy) return ret; } + if (cpufreq_boost_supported()) { + ret = sysfs_create_file(&policy->kobj, &local_boost.attr); + if (ret) + return ret; + } + return 0; } @@ -2687,6 +2728,8 @@ int cpufreq_boost_trigger_state(int state) ret = cpufreq_driver->set_boost(policy, state); if (ret) goto err_reset_state; + + policy->boost_enabled = state; } cpus_read_unlock(); diff --git a/include/linux/cpufreq.h b/include/linux/cpufreq.h index 3e2818678cc3..896ca659e66a 100644 --- a/include/linux/cpufreq.h +++ b/include/linux/cpufreq.h @@ -134,6 +134,9 @@ struct cpufreq_policy { */ bool dvfs_possible_from_any_cpu; + /* Per policy boost enabled flag. */ + bool boost_enabled; + /* Cached frequency lookup from cpufreq_driver_resolve_freq. */ unsigned int cached_target_freq; unsigned int cached_resolved_idx; -- 2.33.0

2 12

[PATCH OLK-5.10] mm/hugetlb: fix incorrect gfp flag for mempolicy MPOL_PREFERRED_MANY
by Wupeng Ma 03 Jul '25

03 Jul '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6I1Z2 -------------------------------- Commit 27a782f719fd ("mm/hugetlb: add support for mempolicy MPOL_PREFERRED_MANY") bring mempolicy MPOL_PREFERRED_MANY for hugetlb, however the gfp flag is incorrect. Fix this. Reported-by: kernel test robot <lkp(a)intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202507020936.wpYnAMsn-lkp@intel.com/ Fixes: 27a782f719fd ("mm/hugetlb: add support for mempolicy MPOL_PREFERRED_MANY") Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- mm/hugetlb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index 967c97c42653..ec0ab09e1b56 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -2223,7 +2223,7 @@ struct page *alloc_buddy_huge_page_with_mpol(struct hstate *h, gfp_t gfp = gfp_mask | __GFP_NOWARN; gfp &= ~(__GFP_DIRECT_RECLAIM | __GFP_NOFAIL); - page = alloc_surplus_huge_page(h, gfp_mask, nid, nodemask); + page = alloc_surplus_huge_page(h, gfp, nid, nodemask); /* Fallback to all nodes if page==NULL */ nodemask = NULL; -- 2.43.0

2 1

[PATCH OLK-6.6 01/12] cpufreq: Support per-policy performance boost
by Qi Xi 03 Jul '25

03 Jul '25

From: Jie Zhan <zhanjie9(a)hisilicon.com> The boost control currently applies to the whole system. However, users may prefer to boost a subset of cores in order to provide prioritized performance to workloads running on the boosted cores. Enable per-policy boost by adding a 'boost' sysfs interface under each policy path. This can be found at: /sys/devices/system/cpu/cpufreq/policy<*>/boost Same to the global boost switch, writing 1/0 to the per-policy 'boost' enables/disables boost on a cpufreq policy respectively. The user view of global and per-policy boost controls should be: 1. Enabling global boost initially enables boost on all policies, and per-policy boost can then be enabled or disabled individually, given that the platform does support so. 2. Disabling global boost makes the per-policy boost interface illegal. Signed-off-by: Jie Zhan <zhanjie9(a)hisilicon.com> Reviewed-by: Wei Xu <xuwei5(a)hisilicon.com> Acked-by: Viresh Kumar <viresh.kumar(a)linaro.org> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- drivers/cpufreq/cpufreq.c | 43 +++++++++++++++++++++++++++++++++++++++ include/linux/cpufreq.h | 3 +++ 2 files changed, 46 insertions(+) diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c index c2227be7bad8..0d5942f3f0df 100644 --- a/drivers/cpufreq/cpufreq.c +++ b/drivers/cpufreq/cpufreq.c @@ -81,6 +81,7 @@ static void cpufreq_governor_limits(struct cpufreq_policy *policy); static int cpufreq_set_policy(struct cpufreq_policy *policy, struct cpufreq_governor *new_gov, unsigned int new_pol); +static bool cpufreq_boost_supported(void); /* * Two notifier lists: the "policy" list is involved in the @@ -618,6 +619,40 @@ static ssize_t store_boost(struct kobject *kobj, struct kobj_attribute *attr, } define_one_global_rw(boost); +static ssize_t show_local_boost(struct cpufreq_policy *policy, char *buf) +{ + return sysfs_emit(buf, "%d\n", policy->boost_enabled); +} + +static ssize_t store_local_boost(struct cpufreq_policy *policy, + const char *buf, size_t count) +{ + int ret, enable; + + ret = kstrtoint(buf, 10, &enable); + if (ret || enable < 0 || enable > 1) + return -EINVAL; + + if (!cpufreq_driver->boost_enabled) + return -EINVAL; + + if (policy->boost_enabled == enable) + return count; + + cpus_read_lock(); + ret = cpufreq_driver->set_boost(policy, enable); + cpus_read_unlock(); + + if (ret) + return ret; + + policy->boost_enabled = enable; + + return count; +} + +static struct freq_attr local_boost = __ATTR(boost, 0644, show_local_boost, store_local_boost); + static struct cpufreq_governor *find_governor(const char *str_governor) { struct cpufreq_governor *t; @@ -1057,6 +1092,12 @@ static int cpufreq_add_dev_interface(struct cpufreq_policy *policy) return ret; } + if (cpufreq_boost_supported()) { + ret = sysfs_create_file(&policy->kobj, &local_boost.attr); + if (ret) + return ret; + } + return 0; } @@ -2687,6 +2728,8 @@ int cpufreq_boost_trigger_state(int state) ret = cpufreq_driver->set_boost(policy, state); if (ret) goto err_reset_state; + + policy->boost_enabled = state; } cpus_read_unlock(); diff --git a/include/linux/cpufreq.h b/include/linux/cpufreq.h index 3e2818678cc3..896ca659e66a 100644 --- a/include/linux/cpufreq.h +++ b/include/linux/cpufreq.h @@ -134,6 +134,9 @@ struct cpufreq_policy { */ bool dvfs_possible_from_any_cpu; + /* Per policy boost enabled flag. */ + bool boost_enabled; + /* Cached frequency lookup from cpufreq_driver_resolve_freq. */ unsigned int cached_target_freq; unsigned int cached_resolved_idx; -- 2.33.0

2 12

[PATCH OLK-6.6 01/12] cpufreq: Support per-policy performance boost
by Qi Xi 03 Jul '25

03 Jul '25

From: Jie Zhan <zhanjie9(a)hisilicon.com> The boost control currently applies to the whole system. However, users may prefer to boost a subset of cores in order to provide prioritized performance to workloads running on the boosted cores. Enable per-policy boost by adding a 'boost' sysfs interface under each policy path. This can be found at: /sys/devices/system/cpu/cpufreq/policy<*>/boost Same to the global boost switch, writing 1/0 to the per-policy 'boost' enables/disables boost on a cpufreq policy respectively. The user view of global and per-policy boost controls should be: 1. Enabling global boost initially enables boost on all policies, and per-policy boost can then be enabled or disabled individually, given that the platform does support so. 2. Disabling global boost makes the per-policy boost interface illegal. Signed-off-by: Jie Zhan <zhanjie9(a)hisilicon.com> Reviewed-by: Wei Xu <xuwei5(a)hisilicon.com> Acked-by: Viresh Kumar <viresh.kumar(a)linaro.org> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- drivers/cpufreq/cpufreq.c | 43 +++++++++++++++++++++++++++++++++++++++ include/linux/cpufreq.h | 3 +++ 2 files changed, 46 insertions(+) diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c index c2227be7bad8..0d5942f3f0df 100644 --- a/drivers/cpufreq/cpufreq.c +++ b/drivers/cpufreq/cpufreq.c @@ -81,6 +81,7 @@ static void cpufreq_governor_limits(struct cpufreq_policy *policy); static int cpufreq_set_policy(struct cpufreq_policy *policy, struct cpufreq_governor *new_gov, unsigned int new_pol); +static bool cpufreq_boost_supported(void); /* * Two notifier lists: the "policy" list is involved in the @@ -618,6 +619,40 @@ static ssize_t store_boost(struct kobject *kobj, struct kobj_attribute *attr, } define_one_global_rw(boost); +static ssize_t show_local_boost(struct cpufreq_policy *policy, char *buf) +{ + return sysfs_emit(buf, "%d\n", policy->boost_enabled); +} + +static ssize_t store_local_boost(struct cpufreq_policy *policy, + const char *buf, size_t count) +{ + int ret, enable; + + ret = kstrtoint(buf, 10, &enable); + if (ret || enable < 0 || enable > 1) + return -EINVAL; + + if (!cpufreq_driver->boost_enabled) + return -EINVAL; + + if (policy->boost_enabled == enable) + return count; + + cpus_read_lock(); + ret = cpufreq_driver->set_boost(policy, enable); + cpus_read_unlock(); + + if (ret) + return ret; + + policy->boost_enabled = enable; + + return count; +} + +static struct freq_attr local_boost = __ATTR(boost, 0644, show_local_boost, store_local_boost); + static struct cpufreq_governor *find_governor(const char *str_governor) { struct cpufreq_governor *t; @@ -1057,6 +1092,12 @@ static int cpufreq_add_dev_interface(struct cpufreq_policy *policy) return ret; } + if (cpufreq_boost_supported()) { + ret = sysfs_create_file(&policy->kobj, &local_boost.attr); + if (ret) + return ret; + } + return 0; } @@ -2687,6 +2728,8 @@ int cpufreq_boost_trigger_state(int state) ret = cpufreq_driver->set_boost(policy, state); if (ret) goto err_reset_state; + + policy->boost_enabled = state; } cpus_read_unlock(); diff --git a/include/linux/cpufreq.h b/include/linux/cpufreq.h index 3e2818678cc3..896ca659e66a 100644 --- a/include/linux/cpufreq.h +++ b/include/linux/cpufreq.h @@ -134,6 +134,9 @@ struct cpufreq_policy { */ bool dvfs_possible_from_any_cpu; + /* Per policy boost enabled flag. */ + bool boost_enabled; + /* Cached frequency lookup from cpufreq_driver_resolve_freq. */ unsigned int cached_target_freq; unsigned int cached_resolved_idx; -- 2.33.0

2 13

[openeuler:openEuler-1.0-LTS 1605/1605] net/netfilter/nf_conntrack_core.c:1017: warning: Function parameter or member 'reply_hash' not described in 'nf_ct_resolve_clash'
by kernel test robot 03 Jul '25

03 Jul '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 382711115afc1197da2c288679079946650ef017 commit: cc12c927ac504e99fc176ea49e85226b6aeadcd5 [1605/1605] netfilter: conntrack: allow insertion of clashing entries config: x86_64-buildonly-randconfig-2002-20250501 (https://download.01.org/0day-ci/archive/20250703/202507030549.czVv179y-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250703/202507030549.czVv179y-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507030549.czVv179y-lkp@intel.com/ All warnings (new ones prefixed by >>): >> net/netfilter/nf_conntrack_core.c:1017: warning: Function parameter or member 'reply_hash' not described in 'nf_ct_resolve_clash' >> net/netfilter/nf_conntrack_core.c:1017: warning: Excess function parameter 'hash_reply' description in 'nf_ct_resolve_clash' vim +1017 net/netfilter/nf_conntrack_core.c cc12c927ac504e Florian Westphal 2023-11-02 980 6199b71796bcaa Florian Westphal 2023-11-02 981 /** 6199b71796bcaa Florian Westphal 2023-11-02 982 * nf_ct_resolve_clash - attempt to handle clash without packet drop 6199b71796bcaa Florian Westphal 2023-11-02 983 * 6199b71796bcaa Florian Westphal 2023-11-02 984 * @skb: skb that causes the clash 6199b71796bcaa Florian Westphal 2023-11-02 985 * @h: tuplehash of the clashing entry already in table cc12c927ac504e Florian Westphal 2023-11-02 986 * @hash_reply: hash slot for reply direction 6199b71796bcaa Florian Westphal 2023-11-02 987 * 6199b71796bcaa Florian Westphal 2023-11-02 988 * A conntrack entry can be inserted to the connection tracking table 6199b71796bcaa Florian Westphal 2023-11-02 989 * if there is no existing entry with an identical tuple. 6199b71796bcaa Florian Westphal 2023-11-02 990 * 6199b71796bcaa Florian Westphal 2023-11-02 991 * If there is one, @skb (and the assocated, unconfirmed conntrack) has 6199b71796bcaa Florian Westphal 2023-11-02 992 * to be dropped. In case @skb is retransmitted, next conntrack lookup 6199b71796bcaa Florian Westphal 2023-11-02 993 * will find the already-existing entry. 6199b71796bcaa Florian Westphal 2023-11-02 994 * 6199b71796bcaa Florian Westphal 2023-11-02 995 * The major problem with such packet drop is the extra delay added by 6199b71796bcaa Florian Westphal 2023-11-02 996 * the packet loss -- it will take some time for a retransmit to occur 6199b71796bcaa Florian Westphal 2023-11-02 997 * (or the sender to time out when waiting for a reply). 6199b71796bcaa Florian Westphal 2023-11-02 998 * 6199b71796bcaa Florian Westphal 2023-11-02 999 * This function attempts to handle the situation without packet drop. 6199b71796bcaa Florian Westphal 2023-11-02 1000 * 6199b71796bcaa Florian Westphal 2023-11-02 1001 * If @skb has no NAT transformation or if the colliding entries are 6199b71796bcaa Florian Westphal 2023-11-02 1002 * exactly the same, only the to-be-confirmed conntrack entry is discarded 6199b71796bcaa Florian Westphal 2023-11-02 1003 * and @skb is associated with the conntrack entry already in the table. 6199b71796bcaa Florian Westphal 2023-11-02 1004 * cc12c927ac504e Florian Westphal 2023-11-02 1005 * Failing that, the new, unconfirmed conntrack is still added to the table cc12c927ac504e Florian Westphal 2023-11-02 1006 * provided that the collision only occurs in the ORIGINAL direction. cc12c927ac504e Florian Westphal 2023-11-02 1007 * The new entry will be added after the existing one in the hash list, cc12c927ac504e Florian Westphal 2023-11-02 1008 * so packets in the ORIGINAL direction will continue to match the existing cc12c927ac504e Florian Westphal 2023-11-02 1009 * entry. The new entry will also have a fixed timeout so it expires -- cc12c927ac504e Florian Westphal 2023-11-02 1010 * due to the collision, it will not see bidirectional traffic. cc12c927ac504e Florian Westphal 2023-11-02 1011 * 6199b71796bcaa Florian Westphal 2023-11-02 1012 * Returns NF_DROP if the clash could not be resolved. 6199b71796bcaa Florian Westphal 2023-11-02 1013 */ 115dffa33ea6f5 Florian Westphal 2023-11-02 1014 static __cold noinline int cc12c927ac504e Florian Westphal 2023-11-02 1015 nf_ct_resolve_clash(struct sk_buff *skb, struct nf_conntrack_tuple_hash *h, cc12c927ac504e Florian Westphal 2023-11-02 1016 u32 reply_hash) 71d8c47fc65371 Pablo Neira Ayuso 2016-05-01 @1017 { 71d8c47fc65371 Pablo Neira Ayuso 2016-05-01 1018 /* This is the conntrack entry already in hashes that won race. */ 71d8c47fc65371 Pablo Neira Ayuso 2016-05-01 1019 struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h); b3480fe059ac91 Florian Westphal 2017-08-12 1020 const struct nf_conntrack_l4proto *l4proto; 6199b71796bcaa Florian Westphal 2023-11-02 1021 enum ip_conntrack_info ctinfo; 6199b71796bcaa Florian Westphal 2023-11-02 1022 struct nf_conn *loser_ct; 6199b71796bcaa Florian Westphal 2023-11-02 1023 struct net *net; 94ebb264459f97 Florian Westphal 2023-11-02 1024 int ret; 6199b71796bcaa Florian Westphal 2023-11-02 1025 6199b71796bcaa Florian Westphal 2023-11-02 1026 loser_ct = nf_ct_get(skb, &ctinfo); 94ebb264459f97 Florian Westphal 2023-11-02 1027 net = nf_ct_net(loser_ct); 71d8c47fc65371 Pablo Neira Ayuso 2016-05-01 1028 71d8c47fc65371 Pablo Neira Ayuso 2016-05-01 1029 l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct)); 6199b71796bcaa Florian Westphal 2023-11-02 1030 if (!l4proto->allow_clash) 6199b71796bcaa Florian Westphal 2023-11-02 1031 goto drop; 6199b71796bcaa Florian Westphal 2023-11-02 1032 94ebb264459f97 Florian Westphal 2023-11-02 1033 ret = __nf_ct_resolve_clash(skb, h); 94ebb264459f97 Florian Westphal 2023-11-02 1034 if (ret == NF_ACCEPT) 94ebb264459f97 Florian Westphal 2023-11-02 1035 return ret; 6199b71796bcaa Florian Westphal 2023-11-02 1036 cc12c927ac504e Florian Westphal 2023-11-02 1037 ret = nf_ct_resolve_clash_harder(skb, reply_hash); cc12c927ac504e Florian Westphal 2023-11-02 1038 if (ret == NF_ACCEPT) cc12c927ac504e Florian Westphal 2023-11-02 1039 return ret; cc12c927ac504e Florian Westphal 2023-11-02 1040 6199b71796bcaa Florian Westphal 2023-11-02 1041 drop: 94ebb264459f97 Florian Westphal 2023-11-02 1042 nf_ct_add_to_dying_list(loser_ct); 71d8c47fc65371 Pablo Neira Ayuso 2016-05-01 1043 NF_CT_STAT_INC(net, drop); 94ebb264459f97 Florian Westphal 2023-11-02 1044 NF_CT_STAT_INC(net, insert_failed); 71d8c47fc65371 Pablo Neira Ayuso 2016-05-01 1045 return NF_DROP; 71d8c47fc65371 Pablo Neira Ayuso 2016-05-01 1046 } 71d8c47fc65371 Pablo Neira Ayuso 2016-05-01 1047 :::::: The code at line 1017 was first introduced by commit :::::: 71d8c47fc653711c41bc3282e5b0e605b3727956 netfilter: conntrack: introduce clash resolution on insertion race :::::: TO: Pablo Neira Ayuso <pablo(a)netfilter.org> :::::: CC: Pablo Neira Ayuso <pablo(a)netfilter.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/6] OLK-6.6 Bperf
by Xiaomeng Zhang 03 Jul '25

03 Jul '25

Ian Rogers (1): perf test bpf-counters: Add test for BPF event modifier Tengda Wu (2): perf stat: Support inherit events during fork() for bperf perf test: Use sqrtloop workload to test bperf event Veronika Molnarova (1): perf test stat_bpf_counter.sh: Stabilize the test results Xiaomeng Zhang (2): perf stat: Increase perf_attr_map entries perf stat: Fix incorrect display of bperf when event count is 0 tools/lib/perf/include/perf/bpf_perf.h | 1 + tools/perf/builtin-stat.c | 1 + tools/perf/tests/shell/stat_bpf_counters.sh | 79 ++++++++++----- tools/perf/util/bpf_counter.c | 61 +++++++++--- tools/perf/util/bpf_skel/bperf_follower.bpf.c | 98 +++++++++++++++++-- tools/perf/util/bpf_skel/bperf_u.h | 5 + tools/perf/util/target.h | 1 + 7 files changed, 198 insertions(+), 48 deletions(-) -- 2.34.1

2 7

[openeuler:openEuler-1.0-LTS 1605/1605] fs/ocfs2/dlm/dlmcommon.h:709:9: warning: 'BITS_TO_BYTES' macro redefined
by kernel test robot 03 Jul '25

03 Jul '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: d96cd567c8d8d584405abe92c2576bf58202fa6e commit: 8f44df8094e0d4dcd28122eab732820e5c639ccd [1605/1605] net/netlink: fix NETLINK_LIST_MEMBERSHIPS length report config: x86_64-buildonly-randconfig-2002-20250501 (https://download.01.org/0day-ci/archive/20250703/202507030301.JSR1Dol1-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250703/202507030301.JSR1Dol1-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507030301.JSR1Dol1-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from fs/ocfs2/dlm/dlmdomain.c:43: >> fs/ocfs2/dlm/dlmcommon.h:709:9: warning: 'BITS_TO_BYTES' macro redefined [-Wmacro-redefined] 709 | #define BITS_TO_BYTES(bits) (((bits)+BITS_PER_BYTE-1)/BITS_PER_BYTE) | ^ include/linux/bitops.h:9:9: note: previous definition is here 9 | #define BITS_TO_BYTES(nr) DIV_ROUND_UP(nr, BITS_PER_TYPE(char)) | ^ 1 warning generated. -- In file included from fs/ocfs2/dlm/dlmthread.c:48: >> fs/ocfs2/dlm/dlmcommon.h:709:9: warning: 'BITS_TO_BYTES' macro redefined [-Wmacro-redefined] 709 | #define BITS_TO_BYTES(bits) (((bits)+BITS_PER_BYTE-1)/BITS_PER_BYTE) | ^ include/linux/bitops.h:9:9: note: previous definition is here 9 | #define BITS_TO_BYTES(nr) DIV_ROUND_UP(nr, BITS_PER_TYPE(char)) | ^ fs/ocfs2/dlm/dlmthread.c:534:18: warning: equality comparison with extraneous parentheses [-Wparentheses-equality] 534 | if ((res->owner == dlm->node_num)) { | ~~~~~~~~~~~^~~~~~~~~~~~~~~~ fs/ocfs2/dlm/dlmthread.c:534:18: note: remove extraneous parentheses around the comparison to silence this warning 534 | if ((res->owner == dlm->node_num)) { | ~ ^ ~ fs/ocfs2/dlm/dlmthread.c:534:18: note: use '=' to turn this equality comparison into an assignment 534 | if ((res->owner == dlm->node_num)) { | ^~ | = 2 warnings generated. vim +/BITS_TO_BYTES +709 fs/ocfs2/dlm/dlmcommon.h 6714d8e86bf443 Kurt Hackel 2005-12-15 706 6714d8e86bf443 Kurt Hackel 2005-12-15 707 1faf289454b9ee Srinivas Eeda 2007-01-29 708 #define BITS_PER_BYTE 8 1faf289454b9ee Srinivas Eeda 2007-01-29 @709 #define BITS_TO_BYTES(bits) (((bits)+BITS_PER_BYTE-1)/BITS_PER_BYTE) 1faf289454b9ee Srinivas Eeda 2007-01-29 710 :::::: The code at line 709 was first introduced by commit :::::: 1faf289454b9eeb6e463da3eee47f7009668370d ocfs2_dlm: disallow a domain join if node maps mismatch :::::: TO: Srinivas Eeda <srinivas.eeda(a)oracle.com> :::::: CC: Mark Fasheh <mark.fasheh(a)oracle.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] crypto: algif_hash - fix double free in hash_accept
by Gu Bowen 03 Jul '25

03 Jul '25

From: Ivan Pravdin <ipravdin.official(a)gmail.com> mainline inclusion from mainline-v6.15 commit b2df03ed4052e97126267e8c13ad4204ea6ba9b6 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICGACQ CVE: CVE-2025-38079 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If accept(2) is called on socket type algif_hash with MSG_MORE flag set and crypto_ahash_import fails, sk2 is freed. However, it is also freed in af_alg_release, leading to slab-use-after-free error. Fixes: fe869cdb89c9 ("crypto: algif_hash - User-space interface for hash operations") Cc: <stable(a)vger.kernel.org> Signed-off-by: Ivan Pravdin <ipravdin.official(a)gmail.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Conflicts: crypto/algif_hash.c [Context conflicts.] Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- crypto/algif_hash.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/crypto/algif_hash.c b/crypto/algif_hash.c index bfcf595fd8f9..3547db4ac4b2 100644 --- a/crypto/algif_hash.c +++ b/crypto/algif_hash.c @@ -267,10 +267,6 @@ static int hash_accept(struct socket *sock, struct socket *newsock, int flags, return err; err = crypto_ahash_import(&ctx2->req, state); - if (err) { - sock_orphan(sk2); - sock_put(sk2); - } return err; } -- 2.25.1

2 1

[PATCH OLK-6.6 V1] rseq: Fix segfault on registration when rseq_cs is non-zero
by Wang Tao 03 Jul '25

03 Jul '25

From: Michael Jeanson <mjeanson(a)efficios.com> mainline inclusion from mainline-v6.15-rc1 commit fd881d0a085fc54354414aed990ccf05f282ba53 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICGAFQ CVE: CVE-2025-38067 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The rseq_cs field is documented as being set to 0 by user-space prior to registration, however this is not currently enforced by the kernel. This can result in a segfault on return to user-space if the value stored in the rseq_cs field doesn't point to a valid struct rseq_cs. The correct solution to this would be to fail the rseq registration when the rseq_cs field is non-zero. However, some older versions of glibc will reuse the rseq area of previous threads without clearing the rseq_cs field and will also terminate the process if the rseq registration fails in a secondary thread. This wasn't caught in testing because in this case the leftover rseq_cs does point to a valid struct rseq_cs. What we can do is clear the rseq_cs field on registration when it's non-zero which will prevent segfaults on registration and won't break the glibc versions that reuse rseq areas on thread creation. Signed-off-by: Michael Jeanson <mjeanson(a)efficios.com> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Reviewed-by: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Cc: Peter Zijlstra <peterz(a)infradead.org> Cc: Linus Torvalds <torvalds(a)linux-foundation.org> Link: https://lore.kernel.org/r/20250306211223.109455-1-mjeanson@efficios.com Conflicts: kernel/rseq.c [In method SYSCALL_DEFINE4(), there are some code in mainline but OLK-6.6 has not merged] Signed-off-by: Wang Tao <wangtao554(a)huawei.com> --- kernel/rseq.c | 60 ++++++++++++++++++++++++++++++++++++++++----------- 1 file changed, 48 insertions(+), 12 deletions(-) diff --git a/kernel/rseq.c b/kernel/rseq.c index 9de6e35fe679..b4136ec87737 100644 --- a/kernel/rseq.c +++ b/kernel/rseq.c @@ -149,6 +149,29 @@ static int rseq_reset_rseq_cpu_node_id(struct task_struct *t) return 0; } +/* + * Get the user-space pointer value stored in the 'rseq_cs' field. + */ +static int rseq_get_rseq_cs_ptr_val(struct rseq __user *rseq, u64 *rseq_cs) +{ + if (!rseq_cs) + return -EFAULT; + +#ifdef CONFIG_64BIT + if (get_user(*rseq_cs, &rseq->rseq_cs)) + return -EFAULT; +#else + if (copy_from_user(rseq_cs, &rseq->rseq_cs, sizeof(*rseq_cs))) + return -EFAULT; +#endif + + return 0; +} + +/* + * If the rseq_cs field of 'struct rseq' contains a valid pointer to + * user-space, copy 'struct rseq_cs' from user-space and validate its fields. + */ static int rseq_get_rseq_cs(struct task_struct *t, struct rseq_cs *rseq_cs) { struct rseq_cs __user *urseq_cs; @@ -157,17 +180,16 @@ static int rseq_get_rseq_cs(struct task_struct *t, struct rseq_cs *rseq_cs) u32 sig; int ret; -#ifdef CONFIG_64BIT - if (get_user(ptr, &t->rseq->rseq_cs)) - return -EFAULT; -#else - if (copy_from_user(&ptr, &t->rseq->rseq_cs, sizeof(ptr))) - return -EFAULT; -#endif + ret = rseq_get_rseq_cs_ptr_val(t->rseq, &ptr); + if (ret) + return ret; + + /* If the rseq_cs pointer is NULL, return a cleared struct rseq_cs. */ if (!ptr) { memset(rseq_cs, 0, sizeof(*rseq_cs)); return 0; } + /* Check that the pointer value fits in the user-space process space. */ if (ptr >= TASK_SIZE) return -EINVAL; urseq_cs = (struct rseq_cs __user *)(unsigned long)ptr; @@ -243,7 +265,7 @@ static int rseq_need_restart(struct task_struct *t, u32 cs_flags) return !!event_mask; } -static int clear_rseq_cs(struct task_struct *t) +static int clear_rseq_cs(struct rseq __user *rseq) { /* * The rseq_cs field is set to NULL on preemption or signal @@ -254,9 +276,9 @@ static int clear_rseq_cs(struct task_struct *t) * Set rseq_cs to NULL. */ #ifdef CONFIG_64BIT - return put_user(0UL, &t->rseq->rseq_cs); + return put_user(0UL, &rseq->rseq_cs); #else - if (clear_user(&t->rseq->rseq_cs, sizeof(t->rseq->rseq_cs))) + if (clear_user(&rseq->rseq_cs, sizeof(rseq->rseq_cs))) return -EFAULT; return 0; #endif @@ -288,11 +310,11 @@ static int rseq_ip_fixup(struct pt_regs *regs) * Clear the rseq_cs pointer and return. */ if (!in_rseq_cs(ip, &rseq_cs)) - return clear_rseq_cs(t); + return clear_rseq_cs(t->rseq); ret = rseq_need_restart(t, rseq_cs.flags); if (ret <= 0) return ret; - ret = clear_rseq_cs(t); + ret = clear_rseq_cs(t->rseq); if (ret) return ret; trace_rseq_ip_fixup(ip, rseq_cs.start_ip, rseq_cs.post_commit_offset, @@ -366,6 +388,7 @@ SYSCALL_DEFINE4(rseq, struct rseq __user *, rseq, u32, rseq_len, int, flags, u32, sig) { int ret; + u64 rseq_cs; if (flags & RSEQ_FLAG_UNREGISTER) { if (flags & ~RSEQ_FLAG_UNREGISTER) @@ -420,6 +443,19 @@ SYSCALL_DEFINE4(rseq, struct rseq __user *, rseq, u32, rseq_len, return -EINVAL; if (!access_ok(rseq, rseq_len)) return -EFAULT; + + /* + * If the rseq_cs pointer is non-NULL on registration, clear it to + * avoid a potential segfault on return to user-space. The proper thing + * to do would have been to fail the registration but this would break + * older libcs that reuse the rseq area for new threads without + * clearing the fields. + */ + if (rseq_get_rseq_cs_ptr_val(rseq, &rseq_cs)) + return -EFAULT; + if (rseq_cs && clear_rseq_cs(rseq)) + return -EFAULT; + current->rseq = rseq; current->rseq_len = rseq_len; current->rseq_sig = sig; -- 2.34.1

2 1