- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] regmap: Fix race condition in hwspinlock irqsave routine
by Lin Ruifeng 05 Mar '26

05 Mar '26

From: Cheng-Yu Lee <cylee12(a)realtek.com> stable inclusion from stable-v6.6.122 commit 24f31be6ad70537fd7706269d99c92cade465a09 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13604 CVE: CVE-2026-23071 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4b58aac989c1e3fafb1c68a733811859df388250 ] Previously, the address of the shared member '&map->spinlock_flags' was passed directly to 'hwspin_lock_timeout_irqsave'. This creates a race condition where multiple contexts contending for the lock could overwrite the shared flags variable, potentially corrupting the state for the current lock owner. Fix this by using a local stack variable 'flags' to store the IRQ state temporarily. Fixes: 8698b9364710 ("regmap: Add hardware spinlock support") Signed-off-by: Cheng-Yu Lee <cylee12(a)realtek.com> Co-developed-by: Yu-Chun Lin <eleanor.lin(a)realtek.com> Signed-off-by: Yu-Chun Lin <eleanor.lin(a)realtek.com> Link: https://patch.msgid.link/20260109032633.8732-1-eleanor.lin@realtek.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/base/regmap/regmap.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c index 1209e01f8c7f..17c0c4412270 100644 --- a/drivers/base/regmap/regmap.c +++ b/drivers/base/regmap/regmap.c @@ -408,9 +408,11 @@ static void regmap_lock_hwlock_irq(void *__map) static void regmap_lock_hwlock_irqsave(void *__map) { struct regmap *map = __map; + unsigned long flags = 0; hwspin_lock_timeout_irqsave(map->hwlock, UINT_MAX, - &map->spinlock_flags); + &flags); + map->spinlock_flags = flags; } static void regmap_unlock_hwlock(void *__map) -- 2.43.0

2 1

[PATCH OLK-6.6] ceph: fix oops due to invalid pointer for kfree() in parse_longname()
by Pan Taixi 05 Mar '26

05 Mar '26

From: Daniel Vogelbacher <daniel(a)chaospixel.com> mainline inclusion from mainline-v6.19 commit bc8dedae022ce3058659c3addef3ec4b41d15e00 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13836/ CVE: CVE-2026-23201 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- This fixes a kernel oops when reading ceph snapshot directories (.snap), for example by simply running `ls /mnt/my_ceph/.snap`. The variable str is guarded by __free(kfree), but advanced by one for skipping the initial '_' in snapshot names. Thus, kfree() is called with an invalid pointer. This patch removes the need for advancing the pointer so kfree() is called with correct memory pointer. Steps to reproduce: 1. Create snapshots on a cephfs volume (I've 63 snaps in my testcase) 2. Add cephfs mount to fstab $ echo "samba-fileserver@.files=/volumes/datapool/stuff/3461082b-ecc9-4e82-8549-3fd2590d3fb6 /mnt/test/stuff ceph acl,noatime,_netdev 0 0" >> /etc/fstab 3. Reboot the system $ systemctl reboot 4. Check if it's really mounted $ mount | grep stuff 5. List snapshots (expected 63 snapshots on my system) $ ls /mnt/test/stuff/.snap Now ls hangs forever and the kernel log shows the oops. Cc: stable(a)vger.kernel.org Fixes: 101841c38346 ("[ceph] parse_longname(): strrchr() expects NUL-terminated string") Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220807 Suggested-by: Helge Deller <deller(a)gmx.de> Signed-off-by: Daniel Vogelbacher <daniel(a)chaospixel.com> Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko(a)ibm.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Conflicts: fs/ceph/crypto.c [Context conflicts due to unmmerged commit 38d46409c463 ("ceph: print cluster fsid and client global_id in all debug logs")] Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com> --- fs/ceph/crypto.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/fs/ceph/crypto.c b/fs/ceph/crypto.c index fa2aaf1d30f8..b0337c4b1bd7 100644 --- a/fs/ceph/crypto.c +++ b/fs/ceph/crypto.c @@ -215,12 +215,13 @@ static struct inode *parse_longname(const struct inode *parent, struct ceph_vino vino = { .snap = CEPH_NOSNAP }; char *name_end, *inode_number; int ret = -EIO; - /* NUL-terminate */ - char *str __free(kfree) = kmemdup_nul(name, *name_len, GFP_KERNEL); + /* Snapshot name must start with an underscore */ + if (*name_len <= 0 || name[0] != '_') + return ERR_PTR(-EIO); + /* Skip initial '_' and NUL-terminate */ + char *str __free(kfree) = kmemdup_nul(name + 1, *name_len - 1, GFP_KERNEL); if (!str) return ERR_PTR(-ENOMEM); - /* Skip initial '_' */ - str++; name_end = strrchr(str, '_'); if (!name_end) { dout("Failed to parse long snapshot name: %s\n", str); -- 2.34.1

2 1

[PATCH v3 openEuler-26.09 0/3] Introduce xsched dmem
by Liu Kai 04 Mar '26

04 Mar '26

Introduce xsched dmem Liu Kai (3): xsched: replace magic number with SCHED_CLASS_MAX_LENGTH for scheduler class string length xsched: simplify root group check by direct comparison with root_xcg xsched: add is_offline check in work function include/linux/xsched.h | 5 ++--- kernel/xsched/cfs_quota.c | 5 +++-- kernel/xsched/cgroup.c | 20 ++++++-------------- 3 files changed, 11 insertions(+), 19 deletions(-) -- 2.34.1

2 4

[PATCH v3 openEuler-26.09 0/4] Introduce xsched dmem
by Liu Kai 04 Mar '26

04 Mar '26

Introduce xsched dmem Alexander Pavlenko (4): xsched/dmem: set max region size of xsched dmem root group to physical XPU memory size xsched/dmem: init xsched dmem region xsched/dmem: introduce xsched_dmem_alloc() xsched/dmem: introduce xsched_dmem_free() include/linux/xsched.h | 16 ++++ include/uapi/linux/xcu_vstream.h | 8 ++ kernel/cgroup/dmem.c | 5 ++ kernel/xsched/Makefile | 1 + kernel/xsched/core.c | 4 + kernel/xsched/dmem.c | 135 +++++++++++++++++++++++++++++++ kernel/xsched/vstream.c | 42 ++++++++++ 7 files changed, 211 insertions(+) create mode 100644 kernel/xsched/dmem.c -- 2.34.1

2 5

[PATCH v6 openEuler-26.09 00/13] Introduce dmem cgroup
by Liu Kai 04 Mar '26

04 Mar '26

Introduce dmem cgroup Chen Ridong (4): cgroup/dmem: fix NULL pointer dereference when setting max cgroup/dmem: avoid rcu warning when unregister region cgroup/dmem: avoid pool UAF cgroup: increase maximum subsystem count from 16 to 32 Friedrich Vock (1): cgroup/dmem: Don't open-code css_for_each_descendant_pre Geert Uytterhoeven (1): cgroup/rdma: Drop bogus PAGE_COUNTER select Jiapeng Chong (1): kernel/cgroup: Remove the unused variable climit Maarten Lankhorst (2): mm/page_counter: move calculating protection values to page_counter kernel/cgroup: Add "dmem" memory accounting cgroup Maxime Ripard (3): cgroup/dmem: Select PAGE_COUNTER cgroup/dmem: Fix parameters documentation doc/cgroup: Fix title underline length Roman Gushchin (1): mm: page_counters: put page_counter_calculate_protection() under CONFIG_MEMCG Documentation/admin-guide/cgroup-v2.rst | 58 +- Documentation/core-api/cgroup.rst | 9 + Documentation/core-api/index.rst | 1 + Documentation/gpu/drm-compute.rst | 54 ++ include/linux/cgroup-defs.h | 8 +- include/linux/cgroup_dmem.h | 66 ++ include/linux/cgroup_subsys.h | 4 + include/linux/page_counter.h | 10 + include/trace/events/cgroup.h | 2 +- init/Kconfig | 10 + kernel/cgroup/Makefile | 1 + kernel/cgroup/cgroup-internal.h | 8 +- kernel/cgroup/cgroup-v1.c | 12 +- kernel/cgroup/cgroup.c | 46 +- kernel/cgroup/debug.c | 2 +- kernel/cgroup/dmem.c | 885 ++++++++++++++++++++++++ mm/memcontrol.c | 154 +---- mm/page_counter.c | 175 +++++ 18 files changed, 1308 insertions(+), 197 deletions(-) create mode 100644 Documentation/core-api/cgroup.rst create mode 100644 Documentation/gpu/drm-compute.rst create mode 100644 include/linux/cgroup_dmem.h create mode 100644 kernel/cgroup/dmem.c -- 2.34.1

2 14

[PATCH openEuler-1.0-LTS v6 00/10] support apei_page_offline_policy
by Qi Xi 04 Mar '26

04 Mar '26

Patches 1-4 with [Merged] prefix are four patches from the old page isolation solution (enable_soft_offline + panic prevention), already delivered to customers. Original PR: https://atomgit.com/openeuler/kernel/merge_requests/20004 Patches 5-9 are the new solution, enabling automated configuration in the new version: Patches 5-7 remove the redundant enable_soft_offline bit 1 huge page isolation switch from the old solution, and copy mc only supports THP and regular pages. Patch 8 adds sysctl_apei_page_offline_policy to support regular/huge page isolation policies and driver notification chain. Patch 9-10 fix bugs. Changes in v6: Fix panic casued by UCE in kernel context (!current->mm). Changes in v5: Change sysctl_apei_page_offline_policy bit0 to enable/disable driver notification. Backport some patches that have been merged. Since CONFIG_UCE_KERNEL_RECOVERY depends on CONFIG_ARM64, remove the redundant condition in migrate_page(). Changes in v4: Fix typo errors and backport bugfix for mc_copy. Changes in v3: Use bool rather than int as the return type of apei_page_should_offline(). Drop the PF_UCE_KERNEL_RECOVERY flag after soft-offlining the page. Changes in v2: Add a new sysctl_apei_page_offline_policy, instead of changing soft_offline_page. Jiaqi Yan (1): mm/memory-failure: userspace controls soft-offlining pages Kyle Meyer (1): mm/memory-failure: support disabling soft offline for HugeTLB pages Qi Xi (4): Revert "mm/memory-failure: support disabling soft offline for HugeTLB pages" Revert "arm64: mm: Add copy mc support for migrate_page" apei/ghes: Add sysctl interface to control soft-offline page isolation uce: Prevent kernel panic for kernel-context UCE with recovery path Wupeng Ma (3): uce: add copy_mc_highpage{s} arm64: mm: Add copy mc support for migrate_page arm64: mm: Add copy mc support for migrate_page Yongjian Sun (1): ext4: fix e4b bitmap inconsistency reports arch/arm64/mm/fault.c | 10 +++++- drivers/acpi/apei/ghes.c | 77 ++++++++++++++++++++++++++++++++++++++++ fs/ext4/mballoc.c | 21 +++++------ include/linux/highmem.h | 55 ++++++++++++++++++++++++++++ include/linux/mm.h | 7 ++++ kernel/sysctl.c | 21 +++++++++++ mm/memory-failure.c | 20 +++++++++-- mm/migrate.c | 58 ++++++++++++++++++++++++++++-- 8 files changed, 253 insertions(+), 16 deletions(-) -- 2.33.0

2 11

[PATCH OLK-6.6 v4 0/2] support apei_page_offline_policy
by Qi Xi 04 Mar '26

04 Mar '26

Changes in v4: Add function stubs when CONFIG_ACPI_APEI_MEMORY_FAILURE=n. Add log when sysctl_apei_page_offline_policy changed. Fix typos. Changes in v3: Fix compile error when CONFIG_ACPI_APEI_MEMORY_FAILURE=n Changes in v2: Refactor the code by moving apei policy control to the seperate file ghes-policy.c No need to enhance logging in do_sea() in this patch series. Automated configuration with enable_soft_offline as global master switch (default=1): enable_soft_offline = 0: Page isolation completely disabled enable_soft_offline = 1: Page isolation enabled, policy controlled by new interface New interface: sysctl_apei_page_offline_policy provides fine-grained control (default=2, isolating base pages only): bit 0: Notify BMC about soft_offline_page scanning bit 1: Control base page isolation bit 2: Control hugetlb page isolation Qi Xi (2): Revert "mm/memory-failure: support disabling soft offline for HugeTLB pages" apei/ghes: Add sysctl interface to control soft-offline page isolation .../ABI/testing/sysfs-memory-page-offline | 3 - drivers/acpi/apei/Makefile | 1 + drivers/acpi/apei/apei-internal.h | 8 ++ drivers/acpi/apei/ghes-policy.c | 102 ++++++++++++++++++ drivers/acpi/apei/ghes.c | 3 + include/linux/acpi.h | 13 +++ mm/memory-failure.c | 17 +-- 7 files changed, 130 insertions(+), 17 deletions(-) create mode 100644 drivers/acpi/apei/ghes-policy.c -- 2.33.0

2 3

[PATCH OLK-5.10 0/2] support apei_page_offline_policy
by Qi Xi 04 Mar '26

04 Mar '26

Automated configuration with enable_soft_offline as global master switch (default=1): enable_soft_offline = 0: Page isolation completely disabled enable_soft_offline = 1: Page isolation enabled, policy controlled by new interface New interface: sysctl_apei_page_offline_policy provides fine-grained control (default=2, isolating base pages only): bit 0: Notify BMC about soft_offline_page scanning bit 1: Control base page isolation bit 2: Control hugetlb page isolation Qi Xi (2): Revert "mm/memory-failure: support disabling soft offline for HugeTLB pages" apei/ghes: Add sysctl interface to control soft-offline page isolation .../ABI/testing/sysfs-memory-page-offline | 3 - drivers/acpi/apei/Makefile | 1 + drivers/acpi/apei/apei-internal.h | 8 ++ drivers/acpi/apei/ghes-policy.c | 102 ++++++++++++++++++ drivers/acpi/apei/ghes.c | 3 + include/linux/acpi.h | 14 +++ kernel/sysctl.c | 2 +- mm/memory-failure.c | 15 +-- 8 files changed, 131 insertions(+), 17 deletions(-) create mode 100644 drivers/acpi/apei/ghes-policy.c -- 2.33.0

2 3

[PATCH OLK-6.6 0/3] CVE-2026-23102
by Liu Mingrui 04 Mar '26

04 Mar '26

From: Mingrui Liu <liumingrui(a)huawei.com> CVE-2026-23102 Mark Rutland (3): arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state arm64/fpsimd: signal: Consistently read FPSIMD context arm64/fpsimd: signal: Fix restoration of SVE context arch/arm64/kernel/signal.c | 92 +++++++++++++++++++++++--------------- 1 file changed, 57 insertions(+), 35 deletions(-) -- 2.34.1

2 4

[PATCH v5 openEuler-26.09 00/12] Introduce dmem cgroup
by Liu Kai 04 Mar '26

04 Mar '26

Introduce dmem cgroup Chen Ridong (3): cgroup/dmem: fix NULL pointer dereference when setting max cgroup/dmem: avoid rcu warning when unregister region cgroup/dmem: avoid pool UAF Friedrich Vock (1): cgroup/dmem: Don't open-code css_for_each_descendant_pre Geert Uytterhoeven (1): cgroup/rdma: Drop bogus PAGE_COUNTER select Jiapeng Chong (1): kernel/cgroup: Remove the unused variable climit Maarten Lankhorst (2): mm/page_counter: move calculating protection values to page_counter kernel/cgroup: Add "dmem" memory accounting cgroup Maxime Ripard (3): cgroup/dmem: Select PAGE_COUNTER cgroup/dmem: Fix parameters documentation doc/cgroup: Fix title underline length Roman Gushchin (1): mm: page_counters: put page_counter_calculate_protection() under CONFIG_MEMCG Documentation/admin-guide/cgroup-v2.rst | 58 +- Documentation/core-api/cgroup.rst | 9 + Documentation/core-api/index.rst | 1 + Documentation/gpu/drm-compute.rst | 54 ++ include/linux/cgroup_dmem.h | 66 ++ include/linux/cgroup_subsys.h | 4 + include/linux/page_counter.h | 10 + init/Kconfig | 10 + kernel/cgroup/Makefile | 1 + kernel/cgroup/cgroup.c | 2 +- kernel/cgroup/dmem.c | 885 ++++++++++++++++++++++++ mm/memcontrol.c | 154 +---- mm/page_counter.c | 175 +++++ 13 files changed, 1270 insertions(+), 159 deletions(-) create mode 100644 Documentation/core-api/cgroup.rst create mode 100644 Documentation/gpu/drm-compute.rst create mode 100644 include/linux/cgroup_dmem.h create mode 100644 kernel/cgroup/dmem.c -- 2.34.1

2 13