- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 v5 0/9] Add xcall 2.0 support
by Jinjie Ruan 10 Nov '25

10 Nov '25

Add xcall 2.0 support, which is compatible with xcall1.0, and can be used to dynamic instruction replacement for hardware xcall. Changes in v5: - Fix build problem. - el0t_64_sync_ventry jump to kernel_ventry to do VMAP_STACK. - Some cleanups. - Merge the three refactor patch. Changes in v4: - Reuse uprobe_write_opcode() instead of use __replace_page() and copy_to_page(). - Handle error for uprobe_write_opcode(). - Support xcall1.0 before 920G. - Change xcall1.0 bitmap to byte array to save check insns. - Use percpu variable to save check insns for xcall1.0. - A little cleanup. Changes in v3: - Add validity checks during xcall registration to prevent out-of-bounds access and null pointer dereferences. - Extract __replace_page() and copy_to_page() from uprobe, to avoid code duplication. - Replace with new compatible refactored code. - Remove unnecessary member, such as old_name. Changes in v2: - Remove duplicates or unnecessary ~300 LOC, such as link_slot, init_task. - Fix kabi. - Some cleanups. Jinjie Ruan (2): xcall2.0: Support xcall1.0 for hardware xcall openeuler_defconfig: Enable CONFIG_DYNAMIC_XCALL by default Liao Chang (6): xcall2.0: Add userspace proc interface xcall2.0: Add xcall module register interface xcall2.0: Add xcall_area xcall2.0: Hajack syscall with dynamic instruciton replace xcall: Refactor the early exception entry for ACTLR.xcall xcall2.0: Add a basic testcase Yuntao Liu (1): xcall2.0: Intruduce xcall2.0 prefetch kernel module arch/arm64/Kconfig.turbo | 13 + arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/exception.h | 4 +- arch/arm64/include/asm/mmu_context.h | 7 - arch/arm64/include/asm/xcall.h | 142 ++++---- arch/arm64/kernel/cpufeature.c | 71 ++-- arch/arm64/kernel/entry-common.c | 28 +- arch/arm64/kernel/entry.S | 86 +---- arch/arm64/kernel/probes/uprobes.c | 6 + arch/arm64/kernel/process.c | 5 + arch/arm64/kernel/syscall.c | 14 + arch/arm64/kernel/xcall/Makefile | 3 +- arch/arm64/kernel/xcall/core.c | 390 +++++++++++++++++++++ arch/arm64/kernel/xcall/entry.S | 133 +++++-- arch/arm64/kernel/xcall/proc.c | 203 +++++++++++ arch/arm64/kernel/xcall/xcall.c | 56 +-- arch/arm64/kvm/sys_regs.c | 1 + drivers/staging/Kconfig | 2 + drivers/staging/Makefile | 1 + drivers/staging/xcall/Kconfig | 19 + drivers/staging/xcall/Makefile | 1 + drivers/staging/xcall/dynamic_xcall_test.c | 97 +++++ drivers/staging/xcall/prefetch.c | 267 ++++++++++++++ fs/proc/proc_xcall.c | 141 ++------ include/linux/mm_types.h | 4 + include/linux/xcall.h | 52 +++ kernel/events/uprobes.c | 23 ++ kernel/fork.c | 3 + mm/mmap.c | 14 +- 29 files changed, 1416 insertions(+), 371 deletions(-) create mode 100644 arch/arm64/kernel/xcall/core.c create mode 100644 arch/arm64/kernel/xcall/proc.c create mode 100644 drivers/staging/xcall/Kconfig create mode 100644 drivers/staging/xcall/Makefile create mode 100644 drivers/staging/xcall/dynamic_xcall_test.c create mode 100644 drivers/staging/xcall/prefetch.c create mode 100644 include/linux/xcall.h -- 2.34.1

2 10

[PATCH OLK-5.10] ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans
by Xiaomeng Zhang 10 Nov '25

10 Nov '25

From: Yajun Deng <yajun.deng(a)linux.dev> stable inclusion from stable-v5.10.236 commit de203da734fae00e75be50220ba5391e7beecdf9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QP4 CVE: CVE-2023-53034 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit de203da734fae00e75be50220ba5391e7beecdf9 ] There is a kernel API ntb_mw_clear_trans() would pass 0 to both addr and size. This would make xlate_pos negative. [ 23.734156] switchtec switchtec0: MW 0: part 0 addr 0x0000000000000000 size 0x0000000000000000 [ 23.734158] ================================================================================ [ 23.734172] UBSAN: shift-out-of-bounds in drivers/ntb/hw/mscc/ntb_hw_switchtec.c:293:7 [ 23.734418] shift exponent -1 is negative Ensuring xlate_pos is a positive or zero before BIT. Fixes: 1e2fd202f859 ("ntb_hw_switchtec: Check for alignment of the buffer in mw_set_trans()") Signed-off-by: Yajun Deng <yajun.deng(a)linux.dev> Reviewed-by: Logan Gunthorpe <logang(a)deltatee.com> Signed-off-by: Jon Mason <jdmason(a)kudzu.us> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c index ad09946100b5..c5c1963c699d 100644 --- a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c +++ b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c @@ -288,7 +288,7 @@ static int switchtec_ntb_mw_set_trans(struct ntb_dev *ntb, int pidx, int widx, if (size != 0 && xlate_pos < 12) return -EINVAL; - if (!IS_ALIGNED(addr, BIT_ULL(xlate_pos))) { + if (xlate_pos >= 0 && !IS_ALIGNED(addr, BIT_ULL(xlate_pos))) { /* * In certain circumstances we can get a buffer that is * not aligned to its size. (Most of the time -- 2.34.1

2 1

[PATCH OLK-5.10] slimbus: messaging: Free transaction ID in delayed interrupt scenario
by Xiaomeng Zhang 10 Nov '25

10 Nov '25

From: Visweswara Tanuku <quic_vtanuku(a)quicinc.com> stable inclusion from stable-v5.10.235 commit a32e5198a9134772eb03f7b72a7849094c55bda9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBY44F CVE: CVE-2025-21914 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit dcb0d43ba8eb9517e70b1a0e4b0ae0ab657a0e5a upstream. In case of interrupt delay for any reason, slim_do_transfer() returns timeout error but the transaction ID (TID) is not freed. This results into invalid memory access inside qcom_slim_ngd_rx_msgq_cb() due to invalid TID. Fix the issue by freeing the TID in slim_do_transfer() before returning timeout error to avoid invalid memory access. Call trace: __memcpy_fromio+0x20/0x190 qcom_slim_ngd_rx_msgq_cb+0x130/0x290 [slim_qcom_ngd_ctrl] vchan_complete+0x2a0/0x4a0 tasklet_action_common+0x274/0x700 tasklet_action+0x28/0x3c _stext+0x188/0x620 run_ksoftirqd+0x34/0x74 smpboot_thread_fn+0x1d8/0x464 kthread+0x178/0x238 ret_from_fork+0x10/0x20 Code: aa0003e8 91000429 f100044a 3940002b (3800150b) ---[ end trace 0fe00bec2b975c99 ]--- Kernel panic - not syncing: Oops: Fatal exception in interrupt. Fixes: afbdcc7c384b ("slimbus: Add messaging APIs to slimbus framework") Cc: stable <stable(a)kernel.org> Signed-off-by: Visweswara Tanuku <quic_vtanuku(a)quicinc.com> Link: https://lore.kernel.org/r/20250124125740.16897-1-quic_vtanuku@quicinc.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/slimbus/messaging.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/slimbus/messaging.c b/drivers/slimbus/messaging.c index ddf0371ad52b..c1171ec5efeb 100644 --- a/drivers/slimbus/messaging.c +++ b/drivers/slimbus/messaging.c @@ -147,8 +147,9 @@ int slim_do_transfer(struct slim_controller *ctrl, struct slim_msg_txn *txn) } ret = ctrl->xfer_msg(ctrl, txn); - - if (!ret && need_tid && !txn->msg->comp) { + if (ret == -ETIMEDOUT) { + slim_free_txn_tid(ctrl, txn); + } else if (!ret && need_tid && !txn->msg->comp) { unsigned long ms = txn->rl + HZ; timeout = wait_for_completion_timeout(txn->comp, -- 2.34.1

2 1

[PATCH OLK-6.6 v5 RESEND 0/9] Add xcall 2.0 support
by Jinjie Ruan 10 Nov '25

10 Nov '25

Add xcall 2.0 support, which is compatible with xcall1.0, and can be used to dynamic instruction replacement for hardware xcall. Changes in v5: - Fix build problem. - el0t_64_sync_ventry jump to kernel_ventry to do VMAP_STACK. - Some cleanups. - Merge the three refactor patch. Changes in v4: - Reuse uprobe_write_opcode() instead of use __replace_page() and copy_to_page(). - Handle error for uprobe_write_opcode(). - Support xcall1.0 before 920G. - Change xcall1.0 bitmap to byte array to save check insns. - Use percpu variable to save check insns for xcall1.0. - A little cleanup. Changes in v3: - Add validity checks during xcall registration to prevent out-of-bounds access and null pointer dereferences. - Extract __replace_page() and copy_to_page() from uprobe, to avoid code duplication. - Replace with new compatible refactored code. - Remove unnecessary member, such as old_name. Changes in v2: - Remove duplicates or unnecessary ~300 LOC, such as link_slot, init_task. - Fix kabi. - Some cleanups. Jinjie Ruan (2): xcall2.0: Support xcall1.0 for hardware xcall openeuler_defconfig: Enable CONFIG_DYNAMIC_XCALL by default Liao Chang (6): xcall2.0: Add userspace proc interface xcall2.0: Add xcall module register interface xcall2.0: Add xcall_area xcall2.0: Hajack syscall with dynamic instruciton replace xcall: Refactor the early exception entry for ACTLR.xcall xcall2.0: Add a basic testcase Yuntao Liu (1): xcall2.0: Intruduce xcall2.0 prefetch kernel module arch/arm64/Kconfig.turbo | 13 + arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/exception.h | 4 +- arch/arm64/include/asm/mmu_context.h | 7 - arch/arm64/include/asm/xcall.h | 142 ++++---- arch/arm64/kernel/cpufeature.c | 71 ++-- arch/arm64/kernel/entry-common.c | 28 +- arch/arm64/kernel/entry.S | 86 +---- arch/arm64/kernel/probes/uprobes.c | 6 + arch/arm64/kernel/process.c | 5 + arch/arm64/kernel/syscall.c | 14 + arch/arm64/kernel/xcall/Makefile | 3 +- arch/arm64/kernel/xcall/core.c | 390 +++++++++++++++++++++ arch/arm64/kernel/xcall/entry.S | 133 +++++-- arch/arm64/kernel/xcall/proc.c | 203 +++++++++++ arch/arm64/kernel/xcall/xcall.c | 56 +-- arch/arm64/kvm/sys_regs.c | 1 + drivers/staging/Kconfig | 2 + drivers/staging/Makefile | 1 + drivers/staging/xcall/Kconfig | 19 + drivers/staging/xcall/Makefile | 1 + drivers/staging/xcall/dynamic_xcall_test.c | 97 +++++ drivers/staging/xcall/prefetch.c | 267 ++++++++++++++ fs/proc/proc_xcall.c | 141 ++------ include/linux/mm_types.h | 4 + include/linux/xcall.h | 52 +++ kernel/events/uprobes.c | 23 ++ kernel/fork.c | 3 + mm/mmap.c | 14 +- 29 files changed, 1416 insertions(+), 371 deletions(-) create mode 100644 arch/arm64/kernel/xcall/core.c create mode 100644 arch/arm64/kernel/xcall/proc.c create mode 100644 drivers/staging/xcall/Kconfig create mode 100644 drivers/staging/xcall/Makefile create mode 100644 drivers/staging/xcall/dynamic_xcall_test.c create mode 100644 drivers/staging/xcall/prefetch.c create mode 100644 include/linux/xcall.h -- 2.34.1

1 9

[PATCH OLK-6.6 00/21] Add MFS support
by Huang Xiaojia 10 Nov '25

10 Nov '25

MFS is a stackable file system that utilizes a lower and a cache layer. It provides users with programmable caching capabilities. MFS only supports read-only operations for regular files, directories and symbolic links. When MFS is stacked on top of the lower and cache layers (which are themselves mounted on other file systems, such as ext4 or xfs), the underlying file systems must be also kept read-only to prevent the data inconsistency. MFS supports three running mode: none, local and remote. These modes are explained in running mode section. In short, MFS requires the `mtree` and `cachedir` mount options. The `mtree` option specifies the metadata source for MFS, while the `cachedir` option specifies the data source. In local or remote mode, `cachedir` points to a local cache (in memory or on disk) for backend file systems. Hongbo Li (19): mfs: Initialize mfs module mfs: implement the mount procedure mfs: Add basic metadata operation for MFS mfs: Add basic data operation for MFS mfs: Add basic cache framework: check method and control structure mfs: Add basic events framework mfs: Add communication devie and event acquisition operations mfs: Add user command for handling events mfs: Add tracepoint for MFS mfs: Add MFS documentation MAINTAINERS: Add maintainer for mfs mfs: enable MFS mfs: Fix the UAF problems on syncer object mfs: Make mfs_filemap_map_pages static mfs: Make mfs_dops, mfs_sops and _acquire_set_path static mfs: Make mfs_lookup, mfs_dir_iops, mfs_symlink_iops and mfs_symlink_iops static mfs: Make sure all delayed rcu inodes are safe to be destroyed mfs: Pending when umount with the device opening mfs: allow resched when too many events need to be destroyed Huang Xiaojia (1): mfs: tool: Add mfs user space tool demo HuangXiaojia (1): mfs: Fix null pointer access in mfs_open or mfs_lookup Documentation/filesystems/index.rst | 1 + Documentation/filesystems/mfs.rst | 223 +++++++++++ MAINTAINERS | 10 + arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + fs/Kconfig | 1 + fs/Makefile | 1 + fs/mfs/Kconfig | 12 + fs/mfs/Makefile | 4 + fs/mfs/cache.c | 507 ++++++++++++++++++++++++ fs/mfs/data.c | 523 +++++++++++++++++++++++++ fs/mfs/dev.c | 242 ++++++++++++ fs/mfs/inode.c | 303 ++++++++++++++ fs/mfs/internal.h | 232 +++++++++++ fs/mfs/super.c | 499 +++++++++++++++++++++++ include/trace/events/mfs.h | 105 +++++ include/uapi/linux/magic.h | 1 + include/uapi/linux/mfs.h | 62 +++ tools/mfs/.gitignore | 2 + tools/mfs/Makefile | 13 + tools/mfs/mfsd.c | 186 +++++++++ 21 files changed, 2929 insertions(+) create mode 100644 Documentation/filesystems/mfs.rst create mode 100644 fs/mfs/Kconfig create mode 100644 fs/mfs/Makefile create mode 100644 fs/mfs/cache.c create mode 100644 fs/mfs/data.c create mode 100644 fs/mfs/dev.c create mode 100644 fs/mfs/inode.c create mode 100644 fs/mfs/internal.h create mode 100644 fs/mfs/super.c create mode 100644 include/trace/events/mfs.h create mode 100644 include/uapi/linux/mfs.h create mode 100644 tools/mfs/.gitignore create mode 100644 tools/mfs/Makefile create mode 100644 tools/mfs/mfsd.c -- 2.25.1

2 22

[PATCH openEuler-1.0-LTS] Revert "fbdev: Fix out-of-bounds issue in sys_fillrect()"
by Gu Bowen 10 Nov '25

10 Nov '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID5JM1 CVE: NA ------------------ This reverts commit 7389066b79d5dc829e15de2509e43a66bf24e296. This patch caused an issue which a virtual machine could not start, revert it. Fixes: 7389066b79d5 ("fbdev: Fix out-of-bounds issue in sys_fillrect()") Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- drivers/video/fbdev/core/fbcon.c | 2 +- drivers/video/fbdev/core/sysfillrect.c | 6 ------ 2 files changed, 1 insertion(+), 7 deletions(-) diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c index e893835c1c25..83a4949e2497 100644 --- a/drivers/video/fbdev/core/fbcon.c +++ b/drivers/video/fbdev/core/fbcon.c @@ -2649,9 +2649,9 @@ static void fbcon_modechanged(struct fb_info *info) return; p = &fb_display[vc->vc_num]; + set_blitting_type(vc, info); if (con_is_visible(vc)) { - set_blitting_type(vc, info); var_to_display(p, &info->var, info); cols = FBCON_SWAP(ops->rotate, info->var.xres, info->var.yres); rows = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres); diff --git a/drivers/video/fbdev/core/sysfillrect.c b/drivers/video/fbdev/core/sysfillrect.c index 7b4103c3288e..33ee3d34f9d2 100644 --- a/drivers/video/fbdev/core/sysfillrect.c +++ b/drivers/video/fbdev/core/sysfillrect.c @@ -248,7 +248,6 @@ void sys_fillrect(struct fb_info *p, const struct fb_fillrect *rect) u32 bpp = p->var.bits_per_pixel; unsigned long *dst; int dst_idx, left; - long dst_offset; if (p->state != FBINFO_STATE_RUNNING) return; @@ -288,11 +287,6 @@ void sys_fillrect(struct fb_info *p, const struct fb_fillrect *rect) } while (height--) { dst += dst_idx >> (ffs(bits) - 1); - dst_offset = (long)dst - (long)p->screen_base; - if (dst_offset < 0 || dst_offset >= p->fix.smem_len) { - pr_err("dst offset out of bound: dst_offset(%ld)", dst_offset); - return; - } dst_idx &= (bits - 1); fill_op32(p, dst, dst_idx, pat, width*bpp, bits); dst_idx += p->fix.line_length*8; -- 2.43.0

2 1

[PATCH OLK-5.10] slimbus: messaging: Free transaction ID in delayed interrupt scenario
by Xiaomeng Zhang 10 Nov '25

10 Nov '25

From: Visweswara Tanuku <quic_vtanuku(a)quicinc.com> stable inclusion from stable-v5.10.235 commit a32e5198a9134772eb03f7b72a7849094c55bda9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBY44F CVE: CVE-2025-21914 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit dcb0d43ba8eb9517e70b1a0e4b0ae0ab657a0e5a upstream. In case of interrupt delay for any reason, slim_do_transfer() returns timeout error but the transaction ID (TID) is not freed. This results into invalid memory access inside qcom_slim_ngd_rx_msgq_cb() due to invalid TID. Fix the issue by freeing the TID in slim_do_transfer() before returning timeout error to avoid invalid memory access. Call trace: __memcpy_fromio+0x20/0x190 qcom_slim_ngd_rx_msgq_cb+0x130/0x290 [slim_qcom_ngd_ctrl] vchan_complete+0x2a0/0x4a0 tasklet_action_common+0x274/0x700 tasklet_action+0x28/0x3c _stext+0x188/0x620 run_ksoftirqd+0x34/0x74 smpboot_thread_fn+0x1d8/0x464 kthread+0x178/0x238 ret_from_fork+0x10/0x20 Code: aa0003e8 91000429 f100044a 3940002b (3800150b) ---[ end trace 0fe00bec2b975c99 ]--- Kernel panic - not syncing: Oops: Fatal exception in interrupt. Fixes: afbdcc7c384b ("slimbus: Add messaging APIs to slimbus framework") Cc: stable <stable(a)kernel.org> Signed-off-by: Visweswara Tanuku <quic_vtanuku(a)quicinc.com> Link: https://lore.kernel.org/r/20250124125740.16897-1-quic_vtanuku@quicinc.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/slimbus/messaging.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/slimbus/messaging.c b/drivers/slimbus/messaging.c index ddf0371ad52b..c1171ec5efeb 100644 --- a/drivers/slimbus/messaging.c +++ b/drivers/slimbus/messaging.c @@ -147,8 +147,9 @@ int slim_do_transfer(struct slim_controller *ctrl, struct slim_msg_txn *txn) } ret = ctrl->xfer_msg(ctrl, txn); - - if (!ret && need_tid && !txn->msg->comp) { + if (ret == -ETIMEDOUT) { + slim_free_txn_tid(ctrl, txn); + } else if (!ret && need_tid && !txn->msg->comp) { unsigned long ms = txn->rl + HZ; timeout = wait_for_completion_timeout(txn->comp, -- 2.34.1

2 1

[PATCH OLK-6.6 v5 0/8] Add xcall 2.0 support
by Jinjie Ruan 10 Nov '25

10 Nov '25

Add xcall 2.0 support, which is compatible with xcall1.0, and can be used to dynamic instruction replacement for hardware xcall. Changes in v5: - Fix build problem. - el0t_64_sync_ventry jump to kernel_ventry to do VMAP_STACK. - Some cleanups. - Merge the three refactor patch. Changes in v4: - Reuse uprobe_write_opcode() instead of use __replace_page() and copy_to_page(). - Handle error for uprobe_write_opcode(). - Support xcall1.0 before 920G. - Change xcall1.0 bitmap to byte array to save check insns. - Use percpu variable to save check insns for xcall1.0. - A little cleanup. Changes in v3: - Add validity checks during xcall registration to prevent out-of-bounds access and null pointer dereferences. - Extract __replace_page() and copy_to_page() from uprobe, to avoid code duplication. - Replace with new compatible refactored code. - Remove unnecessary member, such as old_name. Changes in v2: - Remove duplicates or unnecessary ~300 LOC, such as link_slot, init_task. - Fix kabi. - Some cleanups. Jinjie Ruan (1): xcall2.0: Support xcall1.0 for hardware xcall Liao Chang (6): xcall2.0: Add userspace proc interface xcall2.0: Add xcall module register interface xcall2.0: Add xcall_area xcall2.0: Hajack syscall with dynamic instruciton replace xcall: Refactor the early exception entry for ACTLR.xcall xcall2.0: Add a basic testcase Yuntao Liu (1): xcall2.0: Intruduce xcall2.0 prefetch kernel module arch/arm64/Kconfig.turbo | 13 + arch/arm64/include/asm/exception.h | 4 +- arch/arm64/include/asm/mmu_context.h | 7 - arch/arm64/include/asm/xcall.h | 142 ++++---- arch/arm64/kernel/cpufeature.c | 71 ++-- arch/arm64/kernel/entry-common.c | 28 +- arch/arm64/kernel/entry.S | 86 +---- arch/arm64/kernel/probes/uprobes.c | 6 + arch/arm64/kernel/process.c | 5 + arch/arm64/kernel/syscall.c | 14 + arch/arm64/kernel/xcall/Makefile | 3 +- arch/arm64/kernel/xcall/core.c | 390 +++++++++++++++++++++ arch/arm64/kernel/xcall/entry.S | 133 +++++-- arch/arm64/kernel/xcall/proc.c | 203 +++++++++++ arch/arm64/kernel/xcall/xcall.c | 56 +-- arch/arm64/kvm/sys_regs.c | 1 + drivers/staging/Kconfig | 2 + drivers/staging/Makefile | 1 + drivers/staging/xcall/Kconfig | 19 + drivers/staging/xcall/Makefile | 1 + drivers/staging/xcall/dynamic_xcall_test.c | 97 +++++ drivers/staging/xcall/prefetch.c | 270 ++++++++++++++ fs/proc/proc_xcall.c | 141 ++------ include/linux/mm_types.h | 4 + include/linux/xcall.h | 52 +++ kernel/events/uprobes.c | 23 ++ kernel/fork.c | 3 + mm/mmap.c | 14 +- 28 files changed, 1418 insertions(+), 371 deletions(-) create mode 100644 arch/arm64/kernel/xcall/core.c create mode 100644 arch/arm64/kernel/xcall/proc.c create mode 100644 drivers/staging/xcall/Kconfig create mode 100644 drivers/staging/xcall/Makefile create mode 100644 drivers/staging/xcall/dynamic_xcall_test.c create mode 100644 drivers/staging/xcall/prefetch.c create mode 100644 include/linux/xcall.h -- 2.34.1

2 9

[PATCH OLK-5.10] slimbus: messaging: Free transaction ID in delayed interrupt scenario
by Xiaomeng Zhang 10 Nov '25

10 Nov '25

From: Visweswara Tanuku <quic_vtanuku(a)quicinc.com> stable inclusion from stable-v5.10.235 commit a32e5198a9134772eb03f7b72a7849094c55bda9 category: bugfix bugzilla: 189268 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit dcb0d43ba8eb9517e70b1a0e4b0ae0ab657a0e5a upstream. In case of interrupt delay for any reason, slim_do_transfer() returns timeout error but the transaction ID (TID) is not freed. This results into invalid memory access inside qcom_slim_ngd_rx_msgq_cb() due to invalid TID. Fix the issue by freeing the TID in slim_do_transfer() before returning timeout error to avoid invalid memory access. Call trace: __memcpy_fromio+0x20/0x190 qcom_slim_ngd_rx_msgq_cb+0x130/0x290 [slim_qcom_ngd_ctrl] vchan_complete+0x2a0/0x4a0 tasklet_action_common+0x274/0x700 tasklet_action+0x28/0x3c _stext+0x188/0x620 run_ksoftirqd+0x34/0x74 smpboot_thread_fn+0x1d8/0x464 kthread+0x178/0x238 ret_from_fork+0x10/0x20 Code: aa0003e8 91000429 f100044a 3940002b (3800150b) ---[ end trace 0fe00bec2b975c99 ]--- Kernel panic - not syncing: Oops: Fatal exception in interrupt. Fixes: afbdcc7c384b ("slimbus: Add messaging APIs to slimbus framework") Cc: stable <stable(a)kernel.org> Signed-off-by: Visweswara Tanuku <quic_vtanuku(a)quicinc.com> Link: https://lore.kernel.org/r/20250124125740.16897-1-quic_vtanuku@quicinc.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/slimbus/messaging.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/slimbus/messaging.c b/drivers/slimbus/messaging.c index ddf0371ad52b..c1171ec5efeb 100644 --- a/drivers/slimbus/messaging.c +++ b/drivers/slimbus/messaging.c @@ -147,8 +147,9 @@ int slim_do_transfer(struct slim_controller *ctrl, struct slim_msg_txn *txn) } ret = ctrl->xfer_msg(ctrl, txn); - - if (!ret && need_tid && !txn->msg->comp) { + if (ret == -ETIMEDOUT) { + slim_free_txn_tid(ctrl, txn); + } else if (!ret && need_tid && !txn->msg->comp) { unsigned long ms = txn->rl + HZ; timeout = wait_for_completion_timeout(txn->comp, -- 2.34.1

2 1

[PATCH OLK-5.10] ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans
by Xiaomeng Zhang 10 Nov '25

10 Nov '25

From: Yajun Deng <yajun.deng(a)linux.dev> stable inclusion from stable-v5.10.236 commit de203da734fae00e75be50220ba5391e7beecdf9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QP4 CVE: CVE-2023-53034 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit de203da734fae00e75be50220ba5391e7beecdf9 ] There is a kernel API ntb_mw_clear_trans() would pass 0 to both addr and size. This would make xlate_pos negative. [ 23.734156] switchtec switchtec0: MW 0: part 0 addr 0x0000000000000000 size 0x0000000000000000 [ 23.734158] ================================================================================ [ 23.734172] UBSAN: shift-out-of-bounds in drivers/ntb/hw/mscc/ntb_hw_switchtec.c:293:7 [ 23.734418] shift exponent -1 is negative Ensuring xlate_pos is a positive or zero before BIT. Fixes: 1e2fd202f859 ("ntb_hw_switchtec: Check for alignment of the buffer in mw_set_trans()") Signed-off-by: Yajun Deng <yajun.deng(a)linux.dev> Reviewed-by: Logan Gunthorpe <logang(a)deltatee.com> Signed-off-by: Jon Mason <jdmason(a)kudzu.us> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c index ad09946100b5..c5c1963c699d 100644 --- a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c +++ b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c @@ -288,7 +288,7 @@ static int switchtec_ntb_mw_set_trans(struct ntb_dev *ntb, int pidx, int widx, if (size != 0 && xlate_pos < 12) return -EINVAL; - if (!IS_ALIGNED(addr, BIT_ULL(xlate_pos))) { + if (xlate_pos >= 0 && !IS_ALIGNED(addr, BIT_ULL(xlate_pos))) { /* * In certain circumstances we can get a buffer that is * not aligned to its size. (Most of the time -- 2.34.1

2 1