- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host()
by Cui GaoSheng 10 Oct '25

10 Oct '25

From: Yang Yingliang <yangyingliang(a)huawei.com> stable inclusion from stable-v4.19.270 commit 89303ddbb502c3bc8edbf864f9f85500c8fe07e9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICYBX9 CVE: CVE-2022-50347 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fc38a5a10e9e5a75eb9189854abeb8405b214cc9 ] mmc_add_host() may return error, if we ignore its return value, the memory that allocated in mmc_alloc_host() will be leaked and it will lead a kernel crash because of deleting not added device in the remove path. So fix this by checking the return value and calling mmc_free_host() in the error path, besides, led_classdev_unregister() and pm_runtime_disable() also need be called. Fixes: c7f6558d84af ("mmc: Add realtek USB sdmmc host driver") Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Link: https://lore.kernel.org/r/20221101063023.1664968-7-yangyingliang@huawei.com Signed-off-by: Ulf Hansson <ulf.hansson(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cui GaoSheng <cuigaosheng1(a)huawei.com> --- drivers/mmc/host/rtsx_usb_sdmmc.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/drivers/mmc/host/rtsx_usb_sdmmc.c b/drivers/mmc/host/rtsx_usb_sdmmc.c index 9a3ff22dd0fe..1e5f54054a53 100644 --- a/drivers/mmc/host/rtsx_usb_sdmmc.c +++ b/drivers/mmc/host/rtsx_usb_sdmmc.c @@ -1344,6 +1344,7 @@ static int rtsx_usb_sdmmc_drv_probe(struct platform_device *pdev) #ifdef RTSX_USB_USE_LEDS_CLASS int err; #endif + int ret; ucr = usb_get_intfdata(to_usb_interface(pdev->dev.parent)); if (!ucr) @@ -1382,7 +1383,15 @@ static int rtsx_usb_sdmmc_drv_probe(struct platform_device *pdev) INIT_WORK(&host->led_work, rtsx_usb_update_led); #endif - mmc_add_host(mmc); + ret = mmc_add_host(mmc); + if (ret) { +#ifdef RTSX_USB_USE_LEDS_CLASS + led_classdev_unregister(&host->led); +#endif + mmc_free_host(mmc); + pm_runtime_disable(&pdev->dev); + return ret; + } return 0; } -- 2.34.1

2 1

[PATCH OLK-6.6] workqueue: Fix kabi broken of enum WORK_OFFQ_POOL_SHIFT
by Qi Xi 10 Oct '25

10 Oct '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID0EGV -------------------------------- Fix kabi broken of enum WORK_OFFQ_POOL_SHIFT Fixes: ff86423eddff ("[Backport] workqueue: Implement disable/enable for (delayed) work items") Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- include/linux/workqueue.h | 11 ++++++----- kernel/workqueue.c | 12 ++++++------ 2 files changed, 12 insertions(+), 11 deletions(-) diff --git a/include/linux/workqueue.h b/include/linux/workqueue.h index 3f1c3e699266..50ff1d28fb31 100644 --- a/include/linux/workqueue.h +++ b/include/linux/workqueue.h @@ -72,15 +72,14 @@ enum { * data contains off-queue information when !WORK_STRUCT_PWQ. * * MSB - * [ pool ID ] [ disable depth ] [ OFFQ flags ] [ STRUCT flags ] - * 16 bits 1 bit 4 or 5 bits + * [ disable depth ] [ pool ID ] [ OFFQ flags ] [ STRUCT flags ] + * 16 bits 1 bit 4 or 5 bits */ WORK_OFFQ_FLAG_SHIFT = WORK_STRUCT_FLAG_BITS, WORK_OFFQ_CANCELING_BIT = WORK_OFFQ_FLAG_SHIFT, WORK_OFFQ_FLAG_END, WORK_OFFQ_FLAG_BITS = WORK_OFFQ_FLAG_END - WORK_OFFQ_FLAG_SHIFT, - WORK_OFFQ_DISABLE_SHIFT = WORK_OFFQ_FLAG_SHIFT + WORK_OFFQ_FLAG_BITS, WORK_OFFQ_DISABLE_BITS = 16, /* @@ -88,10 +87,12 @@ enum { * and the last pool it was on. Cap pool ID to 31 bits and use the * highest number to indicate that no pool is associated. */ - WORK_OFFQ_POOL_SHIFT = WORK_OFFQ_DISABLE_SHIFT + WORK_OFFQ_DISABLE_BITS, - WORK_OFFQ_LEFT = BITS_PER_LONG - WORK_OFFQ_POOL_SHIFT, + WORK_OFFQ_POOL_SHIFT = WORK_OFFQ_FLAG_SHIFT + WORK_OFFQ_FLAG_BITS, + WORK_OFFQ_LEFT = BITS_PER_LONG - WORK_OFFQ_POOL_SHIFT - WORK_OFFQ_DISABLE_BITS, WORK_OFFQ_POOL_BITS = WORK_OFFQ_LEFT <= 31 ? WORK_OFFQ_LEFT : 31, + WORK_OFFQ_DISABLE_SHIFT = WORK_OFFQ_POOL_SHIFT + WORK_OFFQ_POOL_BITS, + /* bit mask for work_busy() return values */ WORK_BUSY_PENDING = 1 << 0, WORK_BUSY_RUNNING = 1 << 1, diff --git a/kernel/workqueue.c b/kernel/workqueue.c index 81615eb5562e..fe1afd7fad31 100644 --- a/kernel/workqueue.c +++ b/kernel/workqueue.c @@ -722,6 +722,11 @@ static struct pool_workqueue *get_work_pwq(struct work_struct *work) return NULL; } +static unsigned long shift_and_mask(unsigned long v, u32 shift, u32 bits) +{ + return (v >> shift) & ((1U << bits) - 1); +} + /** * get_work_pool - return the worker_pool a given work was associated with * @work: the work item of interest @@ -747,18 +752,13 @@ static struct worker_pool *get_work_pool(struct work_struct *work) if (data & WORK_STRUCT_PWQ) return work_struct_pwq(data)->pool; - pool_id = data >> WORK_OFFQ_POOL_SHIFT; + pool_id = shift_and_mask(data, WORK_OFFQ_POOL_SHIFT, WORK_OFFQ_POOL_BITS); if (pool_id == WORK_OFFQ_POOL_NONE) return NULL; return idr_find(&worker_pool_idr, pool_id); } -static unsigned long shift_and_mask(unsigned long v, u32 shift, u32 bits) -{ - return (v >> shift) & ((1U << bits) - 1); -} - static void work_offqd_unpack(struct work_offq_data *offqd, unsigned long data) { WARN_ON_ONCE(data & WORK_STRUCT_PWQ); -- CodeHub

2 1

[PATCH OLK-6.6] workqueue: Fix kabi broken of enum WORK_OFFQ_POOL_SHIFT
by Qi Xi 10 Oct '25

10 Oct '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID0EGV -------------------------------- Fix kabi broken of enum WORK_OFFQ_POOL_SHIFT Fixes: 26f866c1be5a ("[Backport] workqueue: Implement disable/enable for (delayed) work items") Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- include/linux/workqueue.h | 11 ++++++----- kernel/workqueue.c | 12 ++++++------ 2 files changed, 12 insertions(+), 11 deletions(-) diff --git a/include/linux/workqueue.h b/include/linux/workqueue.h index 3f1c3e699266..50ff1d28fb31 100644 --- a/include/linux/workqueue.h +++ b/include/linux/workqueue.h @@ -72,15 +72,14 @@ enum { * data contains off-queue information when !WORK_STRUCT_PWQ. * * MSB - * [ pool ID ] [ disable depth ] [ OFFQ flags ] [ STRUCT flags ] - * 16 bits 1 bit 4 or 5 bits + * [ disable depth ] [ pool ID ] [ OFFQ flags ] [ STRUCT flags ] + * 16 bits 1 bit 4 or 5 bits */ WORK_OFFQ_FLAG_SHIFT = WORK_STRUCT_FLAG_BITS, WORK_OFFQ_CANCELING_BIT = WORK_OFFQ_FLAG_SHIFT, WORK_OFFQ_FLAG_END, WORK_OFFQ_FLAG_BITS = WORK_OFFQ_FLAG_END - WORK_OFFQ_FLAG_SHIFT, - WORK_OFFQ_DISABLE_SHIFT = WORK_OFFQ_FLAG_SHIFT + WORK_OFFQ_FLAG_BITS, WORK_OFFQ_DISABLE_BITS = 16, /* @@ -88,10 +87,12 @@ enum { * and the last pool it was on. Cap pool ID to 31 bits and use the * highest number to indicate that no pool is associated. */ - WORK_OFFQ_POOL_SHIFT = WORK_OFFQ_DISABLE_SHIFT + WORK_OFFQ_DISABLE_BITS, - WORK_OFFQ_LEFT = BITS_PER_LONG - WORK_OFFQ_POOL_SHIFT, + WORK_OFFQ_POOL_SHIFT = WORK_OFFQ_FLAG_SHIFT + WORK_OFFQ_FLAG_BITS, + WORK_OFFQ_LEFT = BITS_PER_LONG - WORK_OFFQ_POOL_SHIFT - WORK_OFFQ_DISABLE_BITS, WORK_OFFQ_POOL_BITS = WORK_OFFQ_LEFT <= 31 ? WORK_OFFQ_LEFT : 31, + WORK_OFFQ_DISABLE_SHIFT = WORK_OFFQ_POOL_SHIFT + WORK_OFFQ_POOL_BITS, + /* bit mask for work_busy() return values */ WORK_BUSY_PENDING = 1 << 0, WORK_BUSY_RUNNING = 1 << 1, diff --git a/kernel/workqueue.c b/kernel/workqueue.c index 81615eb5562e..fe1afd7fad31 100644 --- a/kernel/workqueue.c +++ b/kernel/workqueue.c @@ -722,6 +722,11 @@ static struct pool_workqueue *get_work_pwq(struct work_struct *work) return NULL; } +static unsigned long shift_and_mask(unsigned long v, u32 shift, u32 bits) +{ + return (v >> shift) & ((1U << bits) - 1); +} + /** * get_work_pool - return the worker_pool a given work was associated with * @work: the work item of interest @@ -747,18 +752,13 @@ static struct worker_pool *get_work_pool(struct work_struct *work) if (data & WORK_STRUCT_PWQ) return work_struct_pwq(data)->pool; - pool_id = data >> WORK_OFFQ_POOL_SHIFT; + pool_id = shift_and_mask(data, WORK_OFFQ_POOL_SHIFT, WORK_OFFQ_POOL_BITS); if (pool_id == WORK_OFFQ_POOL_NONE) return NULL; return idr_find(&worker_pool_idr, pool_id); } -static unsigned long shift_and_mask(unsigned long v, u32 shift, u32 bits) -{ - return (v >> shift) & ((1U << bits) - 1); -} - static void work_offqd_unpack(struct work_offq_data *offqd, unsigned long data) { WARN_ON_ONCE(data & WORK_STRUCT_PWQ); -- CodeHub

2 1

[PATCH v4 openEuler-25.03 00/16] Xsched Kernel Patch
by Xia Fukun 10 Oct '25

10 Oct '25

Xsched Kernel Patch Alekseev Dmitry (3): xsched: Add XCU control group implementation and its backend in xsched CFS xsched: Add support for CFS quota for cgroups xsched/core: Add xcu_wait() implementation Konstantin Meskhidze (11): xsched: Add base vstream support xcu: Add base NPU driver support xsched: Add debug prints in XSched mechanism xsched: Add XCU initialization support xsched: Introduce vstream management xsched: Add vstream_kick() implementation xsched: Add xsched_ctx_init_xse() implementation xsched: Add XCU xsched_schedule() implementation xsched: Add xsched RT class xsched: Add xsched_submit() implementation xsched: Add xsched CFS class Liu Kai (1): xsched/core: Add multi-card support for xsched Xia Fukun (1): XSched driver patch arch/arm/include/uapi/asm/unistd.h | 1 + arch/arm64/configs/openeuler_defconfig | 1 + arch/powerpc/include/uapi/asm/unistd.h | 1 + arch/x86/configs/openeuler_defconfig | 1 + arch/x86/entry/syscalls/syscall_64.tbl | 2 +- arch/x86/include/uapi/asm/unistd.h | 1 + drivers/Makefile | 1 + .../0001-Adapt-910b-npu-driver-for-xsched.txt | 918 ++++++++++++++++++ drivers/xcu/Makefile | 2 + drivers/xcu/xcu_group.c | 246 +++++ include/linux/cgroup_subsys.h | 4 + include/linux/syscalls.h | 2 + include/linux/vstream.h | 86 ++ include/linux/xcu_group.h | 112 +++ include/linux/xsched.h | 625 ++++++++++++ include/uapi/asm-generic/unistd.h | 5 +- include/uapi/linux/xcu_vstream.h | 57 ++ init/Kconfig | 1 + kernel/Makefile | 1 + kernel/cgroup/cgroup.c | 2 +- kernel/xsched/Kconfig | 51 + kernel/xsched/Makefile | 4 + kernel/xsched/cfs.c | 227 +++++ kernel/xsched/cfs_quota.c | 92 ++ kernel/xsched/cgroup.c | 675 +++++++++++++ kernel/xsched/core.c | 752 ++++++++++++++ kernel/xsched/rt.c | 242 +++++ kernel/xsched/vstream.c | 502 ++++++++++ 28 files changed, 4610 insertions(+), 4 deletions(-) create mode 100644 drivers/xcu/0001-Adapt-910b-npu-driver-for-xsched.txt create mode 100644 drivers/xcu/Makefile create mode 100644 drivers/xcu/xcu_group.c create mode 100644 include/linux/vstream.h create mode 100644 include/linux/xcu_group.h create mode 100644 include/linux/xsched.h create mode 100644 include/uapi/linux/xcu_vstream.h create mode 100644 kernel/xsched/Kconfig create mode 100644 kernel/xsched/Makefile create mode 100644 kernel/xsched/cfs.c create mode 100644 kernel/xsched/cfs_quota.c create mode 100644 kernel/xsched/cgroup.c create mode 100644 kernel/xsched/core.c create mode 100644 kernel/xsched/rt.c create mode 100644 kernel/xsched/vstream.c -- 2.34.1

2 17

[PATCH OLK-6.6] workqueue: Fix kabi broken of enum WORK_OFFQ_POOL_SHIFT
by Qi Xi 10 Oct '25

10 Oct '25

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID0EGV -------------------------------- Fix kabi broken of enum WORK_OFFQ_POOL_SHIFT Fixes: 26f866c1be5a ("[Backport] workqueue: Implement disable/enable for (delayed) work items") Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- include/linux/workqueue.h | 11 ++++++----- kernel/workqueue.c | 12 ++++++------ 2 files changed, 12 insertions(+), 11 deletions(-) diff --git a/include/linux/workqueue.h b/include/linux/workqueue.h index 3f1c3e699266..50ff1d28fb31 100644 --- a/include/linux/workqueue.h +++ b/include/linux/workqueue.h @@ -72,15 +72,14 @@ enum { * data contains off-queue information when !WORK_STRUCT_PWQ. * * MSB - * [ pool ID ] [ disable depth ] [ OFFQ flags ] [ STRUCT flags ] - * 16 bits 1 bit 4 or 5 bits + * [ disable depth ] [ pool ID ] [ OFFQ flags ] [ STRUCT flags ] + * 16 bits 1 bit 4 or 5 bits */ WORK_OFFQ_FLAG_SHIFT = WORK_STRUCT_FLAG_BITS, WORK_OFFQ_CANCELING_BIT = WORK_OFFQ_FLAG_SHIFT, WORK_OFFQ_FLAG_END, WORK_OFFQ_FLAG_BITS = WORK_OFFQ_FLAG_END - WORK_OFFQ_FLAG_SHIFT, - WORK_OFFQ_DISABLE_SHIFT = WORK_OFFQ_FLAG_SHIFT + WORK_OFFQ_FLAG_BITS, WORK_OFFQ_DISABLE_BITS = 16, /* @@ -88,10 +87,12 @@ enum { * and the last pool it was on. Cap pool ID to 31 bits and use the * highest number to indicate that no pool is associated. */ - WORK_OFFQ_POOL_SHIFT = WORK_OFFQ_DISABLE_SHIFT + WORK_OFFQ_DISABLE_BITS, - WORK_OFFQ_LEFT = BITS_PER_LONG - WORK_OFFQ_POOL_SHIFT, + WORK_OFFQ_POOL_SHIFT = WORK_OFFQ_FLAG_SHIFT + WORK_OFFQ_FLAG_BITS, + WORK_OFFQ_LEFT = BITS_PER_LONG - WORK_OFFQ_POOL_SHIFT - WORK_OFFQ_DISABLE_BITS, WORK_OFFQ_POOL_BITS = WORK_OFFQ_LEFT <= 31 ? WORK_OFFQ_LEFT : 31, + WORK_OFFQ_DISABLE_SHIFT = WORK_OFFQ_POOL_SHIFT + WORK_OFFQ_POOL_BITS, + /* bit mask for work_busy() return values */ WORK_BUSY_PENDING = 1 << 0, WORK_BUSY_RUNNING = 1 << 1, diff --git a/kernel/workqueue.c b/kernel/workqueue.c index 81615eb5562e..fe1afd7fad31 100644 --- a/kernel/workqueue.c +++ b/kernel/workqueue.c @@ -722,6 +722,11 @@ static struct pool_workqueue *get_work_pwq(struct work_struct *work) return NULL; } +static unsigned long shift_and_mask(unsigned long v, u32 shift, u32 bits) +{ + return (v >> shift) & ((1U << bits) - 1); +} + /** * get_work_pool - return the worker_pool a given work was associated with * @work: the work item of interest @@ -747,18 +752,13 @@ static struct worker_pool *get_work_pool(struct work_struct *work) if (data & WORK_STRUCT_PWQ) return work_struct_pwq(data)->pool; - pool_id = data >> WORK_OFFQ_POOL_SHIFT; + pool_id = shift_and_mask(data, WORK_OFFQ_POOL_SHIFT, WORK_OFFQ_POOL_BITS); if (pool_id == WORK_OFFQ_POOL_NONE) return NULL; return idr_find(&worker_pool_idr, pool_id); } -static unsigned long shift_and_mask(unsigned long v, u32 shift, u32 bits) -{ - return (v >> shift) & ((1U << bits) - 1); -} - static void work_offqd_unpack(struct work_offq_data *offqd, unsigned long data) { WARN_ON_ONCE(data & WORK_STRUCT_PWQ); -- CodeHub

2 1

[PATCH v3 openEuler-25.03 00/16] Xsched Kernel Patch
by Xia Fukun 10 Oct '25

10 Oct '25

Xsched Kernel Patch Alekseev Dmitry (3): xsched: Add XCU control group implementation and its backend in xsched CFS xsched: Add support for CFS quota for cgroups xsched/core: Add xcu_wait() implementation Konstantin Meskhidze (11): xsched: Add base vstream support xcu: Add base NPU driver support xsched: Add debug prints in XSched mechanism xsched: Add XCU initialization support xsched: Introduce vstream management xsched: Add vstream_kick() implementation xsched: Add xsched_ctx_init_xse() implementation xsched: Add XCU xsched_schedule() implementation xsched: Add xsched RT class xsched: Add xsched_submit() implementation xsched: Add xsched CFS class Liu Kai (1): xsched/core: Add multi-card support for xsched Xia Fukun (1): XSched driver patch arch/arm/include/uapi/asm/unistd.h | 1 + arch/arm64/configs/openeuler_defconfig | 1 + arch/powerpc/include/uapi/asm/unistd.h | 1 + arch/x86/configs/openeuler_defconfig | 1 + arch/x86/entry/syscalls/syscall_64.tbl | 2 +- arch/x86/include/uapi/asm/unistd.h | 1 + drivers/Makefile | 1 + .../0001-Adapt-910b-npu-driver-for-xsched.txt | 918 ++++++++++++++++++ drivers/xcu/Makefile | 2 + drivers/xcu/xcu_group.c | 246 +++++ include/linux/cgroup_subsys.h | 4 + include/linux/syscalls.h | 2 + include/linux/vstream.h | 86 ++ include/linux/xcu_group.h | 112 +++ include/linux/xsched.h | 625 ++++++++++++ include/uapi/asm-generic/unistd.h | 5 +- include/uapi/linux/xcu_vstream.h | 57 ++ init/Kconfig | 1 + kernel/Makefile | 1 + kernel/cgroup/cgroup.c | 2 +- kernel/xsched/Kconfig | 51 + kernel/xsched/Makefile | 4 + kernel/xsched/cfs.c | 227 +++++ kernel/xsched/cfs_quota.c | 92 ++ kernel/xsched/cgroup.c | 675 +++++++++++++ kernel/xsched/core.c | 752 ++++++++++++++ kernel/xsched/rt.c | 242 +++++ kernel/xsched/vstream.c | 502 ++++++++++ 28 files changed, 4610 insertions(+), 4 deletions(-) create mode 100644 drivers/xcu/0001-Adapt-910b-npu-driver-for-xsched.txt create mode 100644 drivers/xcu/Makefile create mode 100644 drivers/xcu/xcu_group.c create mode 100644 include/linux/vstream.h create mode 100644 include/linux/xcu_group.h create mode 100644 include/linux/xsched.h create mode 100644 include/uapi/linux/xcu_vstream.h create mode 100644 kernel/xsched/Kconfig create mode 100644 kernel/xsched/Makefile create mode 100644 kernel/xsched/cfs.c create mode 100644 kernel/xsched/cfs_quota.c create mode 100644 kernel/xsched/cgroup.c create mode 100644 kernel/xsched/core.c create mode 100644 kernel/xsched/rt.c create mode 100644 kernel/xsched/vstream.c -- 2.34.1

2 17

[PATCH OLK-6.6 0/2] CVE-2025-39886
by Pu Lehui 10 Oct '25

10 Oct '25

Peilin Ye (1): bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() Shakeel Butt (1): memcg: skip cgroup_file_notify if spinning is not allowed include/linux/gfp.h | 19 +++++++++++++++++++ include/linux/memcontrol.h | 26 +++++++++++++++++++------- kernel/bpf/helpers.c | 7 +++++-- mm/memcontrol.c | 5 +++-- 4 files changed, 46 insertions(+), 11 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/2] CVE-2025-39850
by Pu Lehui 10 Oct '25

10 Oct '25

Ido Schimmel (2): vxlan: Fix NPD when refreshing an FDB entry with a nexthop object vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects drivers/net/vxlan/vxlan_core.c | 18 ++++++++++++------ drivers/net/vxlan/vxlan_private.h | 4 +--- 2 files changed, 13 insertions(+), 9 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/3] CVE-2025-39844
by Jinjiang Tu 10 Oct '25

10 Oct '25

Harry Yoo (3): mm: move page table sync declarations to linux/pgtable.h mm: introduce and use {pgd,p4d}_populate_kernel() x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() arch/x86/include/asm/pgtable_64_types.h | 3 +++ arch/x86/mm/init_64.c | 18 +++++++++++++++ include/linux/pgalloc.h | 29 +++++++++++++++++++++++++ include/linux/pgtable.h | 25 +++++++++++++++++---- include/linux/vmalloc.h | 16 -------------- mm/kasan/init.c | 12 +++++----- mm/percpu.c | 6 ++--- mm/sparse-vmemmap.c | 6 ++--- 8 files changed, 83 insertions(+), 32 deletions(-) create mode 100644 include/linux/pgalloc.h -- 2.43.0

2 4

[PATCH OLK-6.6] vxlan: Fix NPD when refreshing an FDB entry with a nexthop object
by Xiaomeng Zhang 10 Oct '25

10 Oct '25

From: Ido Schimmel <idosch(a)nvidia.com> mainline inclusion from mainline-v6.17-rc5 commit 6ead38147ebb813f08be6ea8ef547a0e4c09559a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICYXVU CVE: CVE-2025-39851 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- VXLAN FDB entries can point to either a remote destination or an FDB nexthop group. The latter is usually used in EVPN deployments where learning is disabled. However, when learning is enabled, an incoming packet might try to refresh an FDB entry that points to an FDB nexthop group and therefore does not have a remote. Such packets should be dropped, but they are only dropped after dereferencing the non-existent remote, resulting in a NPD [1] which can be reproduced using [2]. Fix by dropping such packets earlier. Remove the misleading comment from first_remote_rcu(). [1] BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] CPU: 13 UID: 0 PID: 361 Comm: mausezahn Not tainted 6.17.0-rc1-virtme-g9f6b606b6b37 #1 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc41 04/01/2014 RIP: 0010:vxlan_snoop+0x98/0x1e0 [...] Call Trace: <TASK> vxlan_encap_bypass+0x209/0x240 encap_bypass_if_local+0xb1/0x100 vxlan_xmit_one+0x1375/0x17e0 vxlan_xmit+0x6b4/0x15f0 dev_hard_start_xmit+0x5d/0x1c0 __dev_queue_xmit+0x246/0xfd0 packet_sendmsg+0x113a/0x1850 __sock_sendmsg+0x38/0x70 __sys_sendto+0x126/0x180 __x64_sys_sendto+0x24/0x30 do_syscall_64+0xa4/0x260 entry_SYSCALL_64_after_hwframe+0x4b/0x53 [2] #!/bin/bash ip address add 192.0.2.1/32 dev lo ip address add 192.0.2.2/32 dev lo ip nexthop add id 1 via 192.0.2.3 fdb ip nexthop add id 10 group 1 fdb ip link add name vx0 up type vxlan id 10010 local 192.0.2.1 dstport 12345 localbypass ip link add name vx1 up type vxlan id 10020 local 192.0.2.2 dstport 54321 learning bridge fdb add 00:11:22:33:44:55 dev vx0 self static dst 192.0.2.2 port 54321 vni 10020 bridge fdb add 00:aa:bb:cc:dd:ee dev vx1 self static nhid 10 mausezahn vx0 -a 00:aa:bb:cc:dd:ee -b 00:11:22:33:44:55 -c 1 -q Fixes: 1274e1cc4226 ("vxlan: ecmp support for mac fdb entries") Reported-by: Marlin Cremers <mcremers(a)cloudbear.nl> Reviewed-by: Petr Machata <petrm(a)nvidia.com> Signed-off-by: Ido Schimmel <idosch(a)nvidia.com> Reviewed-by: Nikolay Aleksandrov <razor(a)blackwall.org> Link: https://patch.msgid.link/20250901065035.159644-2-idosch@nvidia.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: drivers/net/vxlan/vxlan_core.c [The conflicts were due to some minor issue.] Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/net/vxlan/vxlan_core.c | 8 ++++---- drivers/net/vxlan/vxlan_private.h | 4 +--- 2 files changed, 5 insertions(+), 7 deletions(-) diff --git a/drivers/net/vxlan/vxlan_core.c b/drivers/net/vxlan/vxlan_core.c index 64db3e98a1b6..4f01e6d1bb95 100644 --- a/drivers/net/vxlan/vxlan_core.c +++ b/drivers/net/vxlan/vxlan_core.c @@ -1460,6 +1460,10 @@ static bool vxlan_snoop(struct net_device *dev, if (likely(f)) { struct vxlan_rdst *rdst = first_remote_rcu(f); + /* Don't override an fdb with nexthop with a learnt entry */ + if (rcu_access_pointer(f->nh)) + return true; + if (likely(vxlan_addr_equal(&rdst->remote_ip, src_ip) && rdst->remote_ifindex == ifindex)) return false; @@ -1468,10 +1472,6 @@ static bool vxlan_snoop(struct net_device *dev, if (f->state & (NUD_PERMANENT | NUD_NOARP)) return true; - /* Don't override an fdb with nexthop with a learnt entry */ - if (rcu_access_pointer(f->nh)) - return true; - if (net_ratelimit()) netdev_info(dev, "%pM migrated from %pIS to %pIS\n", diff --git a/drivers/net/vxlan/vxlan_private.h b/drivers/net/vxlan/vxlan_private.h index 85b6d0c347e3..8444b5d1ca60 100644 --- a/drivers/net/vxlan/vxlan_private.h +++ b/drivers/net/vxlan/vxlan_private.h @@ -56,9 +56,7 @@ static inline struct hlist_head *vs_head(struct net *net, __be16 port) return &vn->sock_list[hash_32(ntohs(port), PORT_HASH_BITS)]; } -/* First remote destination for a forwarding entry. - * Guaranteed to be non-NULL because remotes are never deleted. - */ +/* First remote destination for a forwarding entry. */ static inline struct vxlan_rdst *first_remote_rcu(struct vxlan_fdb *fdb) { if (rcu_access_pointer(fdb->nh)) -- 2.34.1

2 1