- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] perf/x86/intel: Add missing branch counters constraint apply
by Luo Gengkun 24 Apr '26

24 Apr '26

From: Dapeng Mi <dapeng1.mi(a)linux.intel.com> mainline inclusion from mainline-v7.0-rc5 commit 1d07bbd7ea36ea0b8dfa8068dbe67eb3a32d9590 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14277 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- When running the command: 'perf record -e "{instructions,instructions:p}" -j any,counter sleep 1', a "shift-out-of-bounds" warning is reported on CWF. UBSAN: shift-out-of-bounds in /kbuild/src/consumer/arch/x86/events/intel/lbr.c:970:15 shift exponent 64 is too large for 64-bit type 'long long unsigned int' ...... intel_pmu_lbr_counters_reorder.isra.0.cold+0x2a/0xa7 intel_pmu_lbr_save_brstack+0xc0/0x4c0 setup_arch_pebs_sample_data+0x114b/0x2400 The warning occurs because the second "instructions:p" event, which involves branch counters sampling, is incorrectly programmed to fixed counter 0 instead of the general-purpose (GP) counters 0-3 that support branch counters sampling. Currently only GP counters 0-3 support branch counters sampling on CWF, any event involving branch counters sampling should be programed on GP counters 0-3. Since the counter index of fixed counter 0 is 32, it leads to the "src" value in below code is right shifted 64 bits and trigger the "shift-out-of-bounds" warning. cnt = (src >> (order[j] * LBR_INFO_BR_CNTR_BITS)) & LBR_INFO_BR_CNTR_MASK; The root cause is the loss of the branch counters constraint for the new event in the branch counters sampling event group. Since it isn't yet part of the sibling list. This results in the second "instructions:p" event being programmed on fixed counter 0 incorrectly instead of the appropriate GP counters 0-3. To address this, we apply the missing branch counters constraint for the last event in the group. Additionally, we introduce a new function, `intel_set_branch_counter_constr()`, to apply the branch counters constraint and avoid code duplication. Fixes: 33744916196b ("perf/x86/intel: Support branch counters logging") Reported-by: Xudong Hao <xudong.hao(a)intel.com> Signed-off-by: Dapeng Mi <dapeng1.mi(a)linux.intel.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Link: https://patch.msgid.link/20260228053320.140406-2-dapeng1.mi@linux.intel.com Cc: stable(a)vger.kernel.org Conflicts: arch/x86/events/intel/core.c [Fix conflict because of context diff.] Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- arch/x86/events/intel/core.c | 31 +++++++++++++++++++++---------- 1 file changed, 21 insertions(+), 10 deletions(-) diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c index 5c6673124520..1844d4917bbb 100644 --- a/arch/x86/events/intel/core.c +++ b/arch/x86/events/intel/core.c @@ -4210,6 +4210,19 @@ static inline void intel_pmu_set_acr_caused_constr(struct perf_event *event, event->hw_ext->dyn_constraint &= hybrid(event->pmu, acr_cause_mask64); } +static inline int intel_set_branch_counter_constr(struct perf_event *event, + int *num) +{ + if (branch_sample_call_stack(event)) + return -EINVAL; + if (branch_sample_counters(event)) { + (*num)++; + event->hw_ext->dyn_constraint &= x86_pmu.lbr_counters; + } + + return 0; +} + static int intel_pmu_hw_config(struct perf_event *event) { int ret = x86_pmu_hw_config(event); @@ -4265,21 +4278,19 @@ static int intel_pmu_hw_config(struct perf_event *event) * group, which requires the extra space to store the counters. */ leader = event->group_leader; - if (branch_sample_call_stack(leader)) + if (intel_set_branch_counter_constr(leader, &num)) return -EINVAL; - if (branch_sample_counters(leader)) { - num++; - leader->hw_ext->dyn_constraint &= x86_pmu.lbr_counters; - } leader->hw.flags |= PERF_X86_EVENT_BRANCH_COUNTERS; for_each_sibling_event(sibling, leader) { - if (branch_sample_call_stack(sibling)) + if (intel_set_branch_counter_constr(sibling, &num)) + return -EINVAL; + } + + /* event isn't installed as a sibling yet. */ + if (event != leader) { + if (intel_set_branch_counter_constr(event, &num)) return -EINVAL; - if (branch_sample_counters(sibling)) { - num++; - sibling->hw_ext->dyn_constraint &= x86_pmu.lbr_counters; - } } if (num > fls(x86_pmu.lbr_counters)) -- 2.34.1

2 1

[PATCH OLK-6.6 0/4] Fix CVE-2026-31528
by Luo Gengkun 24 Apr '26

24 Apr '26

Luo Gengkun (1): perf: Fix kabi breakage of perf_output_handle Peter Zijlstra (2): perf: Extract a few helpers perf: Make sure to use pmu_ctx->pmu for groups Peter Zijlstra (Intel) (1): perf: Avoid the read if the count is already updated include/linux/perf_event.h | 9 +++- kernel/events/core.c | 91 +++++++++++++++++++------------------ kernel/events/ring_buffer.c | 1 + 3 files changed, 55 insertions(+), 46 deletions(-) -- 2.34.1

2 6

[PATCH OLK-6.6] bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN
by Pu Lehui 24 Apr '26

24 Apr '26

From: Jenny Guanni Qu <qguanni(a)gmail.com> stable inclusion from stable-v6.6.131 commit 694ea55f1b1c74f9942d91ec366ae9e822422e42 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14258 CVE: CVE-2026-31525 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit c77b30bd1dcb61f66c640ff7d2757816210c7cb0 ] The BPF interpreter's signed 32-bit division and modulo handlers use the kernel abs() macro on s32 operands. The abs() macro documentation (include/linux/math.h) explicitly states the result is undefined when the input is the type minimum. When DST contains S32_MIN (0x80000000), abs((s32)DST) triggers undefined behavior and returns S32_MIN unchanged on arm64/x86. This value is then sign-extended to u64 as 0xFFFFFFFF80000000, causing do_div() to compute the wrong result. The verifier's abstract interpretation (scalar32_min_max_sdiv) computes the mathematically correct result for range tracking, creating a verifier/interpreter mismatch that can be exploited for out-of-bounds map value access. Introduce abs_s32() which handles S32_MIN correctly by casting to u32 before negating, avoiding signed overflow entirely. Replace all 8 abs((s32)...) call sites in the interpreter's sdiv32/smod32 handlers. s32 is the only affected case -- the s64 division/modulo handlers do not use abs(). Fixes: ec0e2da95f72 ("bpf: Support new signed div/mod instructions.") Acked-by: Yonghong Song <yonghong.song(a)linux.dev> Acked-by: Mykyta Yatsenko <yatsenko(a)meta.com> Signed-off-by: Jenny Guanni Qu <qguanni(a)gmail.com> Link: https://lore.kernel.org/r/20260311011116.2108005-2-qguanni@gmail.com Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/core.c | 22 ++++++++++++++-------- 1 file changed, 14 insertions(+), 8 deletions(-) diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c index 72a7503a59d0..e9ca3e36783e 100644 --- a/kernel/bpf/core.c +++ b/kernel/bpf/core.c @@ -1668,6 +1668,12 @@ bool bpf_opcode_in_insntable(u8 code) } #ifndef CONFIG_BPF_JIT_ALWAYS_ON +/* Absolute value of s32 without undefined behavior for S32_MIN */ +static u32 abs_s32(s32 x) +{ + return x >= 0 ? (u32)x : -(u32)x; +} + /** * ___bpf_prog_run - run eBPF program on a given context * @regs: is the array of MAX_BPF_EXT_REG eBPF pseudo-registers @@ -1832,8 +1838,8 @@ static u64 ___bpf_prog_run(u64 *regs, const struct bpf_insn *insn) DST = do_div(AX, (u32) SRC); break; case 1: - AX = abs((s32)DST); - AX = do_div(AX, abs((s32)SRC)); + AX = abs_s32((s32)DST); + AX = do_div(AX, abs_s32((s32)SRC)); if ((s32)DST < 0) DST = (u32)-AX; else @@ -1860,8 +1866,8 @@ static u64 ___bpf_prog_run(u64 *regs, const struct bpf_insn *insn) DST = do_div(AX, (u32) IMM); break; case 1: - AX = abs((s32)DST); - AX = do_div(AX, abs((s32)IMM)); + AX = abs_s32((s32)DST); + AX = do_div(AX, abs_s32((s32)IMM)); if ((s32)DST < 0) DST = (u32)-AX; else @@ -1887,8 +1893,8 @@ static u64 ___bpf_prog_run(u64 *regs, const struct bpf_insn *insn) DST = (u32) AX; break; case 1: - AX = abs((s32)DST); - do_div(AX, abs((s32)SRC)); + AX = abs_s32((s32)DST); + do_div(AX, abs_s32((s32)SRC)); if (((s32)DST < 0) == ((s32)SRC < 0)) DST = (u32)AX; else @@ -1914,8 +1920,8 @@ static u64 ___bpf_prog_run(u64 *regs, const struct bpf_insn *insn) DST = (u32) AX; break; case 1: - AX = abs((s32)DST); - do_div(AX, abs((s32)IMM)); + AX = abs_s32((s32)DST); + do_div(AX, abs_s32((s32)IMM)); if (((s32)DST < 0) == ((s32)IMM < 0)) DST = (u32)AX; else -- 2.34.1

2 1

[PATCH OLK-6.6 0/3] Fix CVE-2026-31528
by Luo Gengkun 23 Apr '26

23 Apr '26

Peter Zijlstra (2): perf: Extract a few helpers perf: Make sure to use pmu_ctx->pmu for groups Peter Zijlstra (Intel) (1): perf: Avoid the read if the count is already updated include/linux/perf_event.h | 8 +++- kernel/events/core.c | 91 +++++++++++++++++++------------------ kernel/events/ring_buffer.c | 1 + 3 files changed, 54 insertions(+), 46 deletions(-) -- 2.34.1

2 4

[PATCH OLK-6.6 0/1] Fix CVE-2026-31467
by Hongbo Li 23 Apr '26

23 Apr '26

Fix CVE-2026-31467. Jiucheng Xu (1): erofs: add GFP_NOIO in the bio completion if needed fs/erofs/zdata.c | 3 +++ 1 file changed, 3 insertions(+) -- 2.34.1

2 2

[PATCH OLK-6.6] sched/ebpf: Fix bpf_sched_set_task_prefer_nid()
by Hui Tang 23 Apr '26

23 Apr '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9010 ---------------------------------------- The current bpf_sched_set_task_prefer_nid() passes the full node mask directly to set_prefer_cpus_ptr(), which may result in preferred CPUs being outside of task->cpus_ptr. In such cases, the scheduler will ignore the preferred CPUs completely, causing the preferred node setting to NOT work at all. Fix this by computing the intersection between task->cpus_ptr and cpumask_of_node(nid), ensuring the resulting preferred mask is a subset of the task's allowed CPUs. Fixes: 4e47cb331dc0 ("sched/ebpf: Add kfunc to set the preferred NUMA node for the task") Signed-off-by: Hui Tang <tanghui20(a)huawei.com> --- kernel/sched/bpf_sched.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/kernel/sched/bpf_sched.c b/kernel/sched/bpf_sched.c index 6849a58439b2..ffe13eed601c 100644 --- a/kernel/sched/bpf_sched.c +++ b/kernel/sched/bpf_sched.c @@ -212,13 +212,16 @@ __bpf_kfunc long bpf_sched_tag_of_entity(struct sched_entity *se) __bpf_kfunc int bpf_sched_set_task_prefer_nid(struct task_struct *task, int nid) { + cpumask_t mask; + if (!task) return -EINVAL; if ((unsigned int)nid >= nr_node_ids) return -EINVAL; - return set_prefer_cpus_ptr(task, cpumask_of_node(nid)); + cpumask_and(&mask, task->cpus_ptr, cpumask_of_node(nid)); + return set_prefer_cpus_ptr(task, &mask); } BTF_SET8_START(sched_task_kfunc_btf_ids) -- 2.34.1

2 1

[PATCH OLK-6.6] sched/ebpf: Fix bpf_sched_set_task_prefer_nid()
by Hui Tang 23 Apr '26

23 Apr '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9010 ---------------------------------------- The current bpf_sched_set_task_prefer_nid() passes the full node mask directly to set_prefer_cpus_ptr(), which may result in preferred CPUs being outside of task->cpus_ptr. In such cases, the scheduler will ignore the preferred CPUs completely, causing the preferred node setting to NOT work at all. Fix this by computing the intersection between task->cpus_ptr and cpumask_of_node(nid), ensuring the resulting preferred mask is a subset of the task's allowed CPUs. Fixes: 4e47cb331dc0b ("sched/ebpf: Add kfunc to set the preferred...") Signed-off-by: Hui Tang <tanghui20(a)huawei.com> --- kernel/sched/bpf_sched.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/kernel/sched/bpf_sched.c b/kernel/sched/bpf_sched.c index 6849a58439b2..ffe13eed601c 100644 --- a/kernel/sched/bpf_sched.c +++ b/kernel/sched/bpf_sched.c @@ -212,13 +212,16 @@ __bpf_kfunc long bpf_sched_tag_of_entity(struct sched_entity *se) __bpf_kfunc int bpf_sched_set_task_prefer_nid(struct task_struct *task, int nid) { + cpumask_t mask; + if (!task) return -EINVAL; if ((unsigned int)nid >= nr_node_ids) return -EINVAL; - return set_prefer_cpus_ptr(task, cpumask_of_node(nid)); + cpumask_and(&mask, task->cpus_ptr, cpumask_of_node(nid)); + return set_prefer_cpus_ptr(task, &mask); } BTF_SET8_START(sched_task_kfunc_btf_ids) -- 2.34.1

2 1

[OLK-6.6] sched/ebpf: Fix bpf_sched_set_task_prefer_nid()
by Hui Tang 23 Apr '26

23 Apr '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9010 ---------------------------------------- The current bpf_sched_set_task_prefer_nid() passes the full node mask directly to set_prefer_cpus_ptr(), which may result in preferred CPUs being outside of task->cpus_ptr. In such cases, the scheduler will ignore the preferred CPUs completely, causing the preferred node setting to NOT work at all. Fix this by computing the intersection between task->cpus_ptr and cpumask_of_node(nid), ensuring the resulting preferred mask is a subset of the task's allowed CPUs. Fixes: 4e47cb331dc0b ("sched/ebpf: Add kfunc to set the preferred...") Signed-off-by: Hui Tang <tanghui20(a)huawei.com> --- kernel/sched/bpf_sched.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/kernel/sched/bpf_sched.c b/kernel/sched/bpf_sched.c index 6849a58439b2..ffe13eed601c 100644 --- a/kernel/sched/bpf_sched.c +++ b/kernel/sched/bpf_sched.c @@ -212,13 +212,16 @@ __bpf_kfunc long bpf_sched_tag_of_entity(struct sched_entity *se) __bpf_kfunc int bpf_sched_set_task_prefer_nid(struct task_struct *task, int nid) { + cpumask_t mask; + if (!task) return -EINVAL; if ((unsigned int)nid >= nr_node_ids) return -EINVAL; - return set_prefer_cpus_ptr(task, cpumask_of_node(nid)); + cpumask_and(&mask, task->cpus_ptr, cpumask_of_node(nid)); + return set_prefer_cpus_ptr(task, &mask); } BTF_SET8_START(sched_task_kfunc_btf_ids) -- 2.34.1

1 0

[PATCH v2 OLK-6.6 0/7] fix CVE-2026-31398
by Wupeng Ma 22 Apr '26

22 Apr '26

Fix CVE-2026-31398. David Hildenbrand (4): mm: convert FPB_IGNORE_* into FPB_RESPECT_* mm: smaller folio_pte_batch() improvements mm: split folio_pte_batch() into folio_pte_batch() and folio_pte_batch_flags() mm: remove boolean output parameters from folio_pte_batch_ext() Dev Jain (2): mm: introduce FPB_RESPECT_WRITE for PTE batching infrastructure mm/rmap: fix incorrect pte restoration for lazyfree folios Petr Vaněk (1): mm: fix folio_pte_batch() on XEN PV mm/internal.h | 151 +++++++++++++++++++++++++++---------------------- mm/madvise.c | 27 ++------- mm/memory.c | 21 +++---- mm/mempolicy.c | 5 +- mm/mremap.c | 4 +- mm/rmap.c | 11 +++- mm/util.c | 29 ++++++++++ 7 files changed, 135 insertions(+), 113 deletions(-) -- 2.43.0

2 8

[PATCH OLK-6.6 v2 0/3] mainline bpf patch
by Pu Lehui 22 Apr '26

22 Apr '26

Daniel Borkmann (1): bpf: Fix incorrect pruning due to atomic fetch precision tracking Qi Tang (1): bpf: reject direct access to nullable PTR_TO_BUF pointers Varun R Mallya (1): bpf: Reject sleepable kprobe_multi programs at attach time kernel/bpf/verifier.c | 28 ++++++++++++++++++++++++---- kernel/trace/bpf_trace.c | 4 ++++ 2 files changed, 28 insertions(+), 4 deletions(-) -- 2.34.1

2 4