- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 0/2] CVE-2026-98800
by Pu Lehui 26 Oct '26

26 Oct '26

Florent Revest (Anthropic) (1): bpf: Wait for an RCU tasks grace period before freeing trampoline progs Pu Lehui (1): bpf: Fix kabi breakage in struct bpf_prog_aux include/linux/bpf.h | 1 + kernel/bpf/syscall.c | 19 ++++++++++++++++++- kernel/bpf/trampoline.c | 1 + 3 files changed, 20 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH OLK-5.10 0/2] CVE-2026-97563 and CVE-2026-97565
by Yifan Qiao 26 Oct '26

26 Oct '26

Diego Oliva (2): smb: client: reject short READ responses in CIFSSMBRead() smb: client: reject out-of-bounds DataOffset in CIFSSMBRead() fs/cifs/cifssmb.c | 24 +++++++++++++++++++----- 1 file changed, 19 insertions(+), 5 deletions(-) -- 2.52.0

2 3

[PATCH OLK-6.6 0/9] add ksm_only_merge_zero_pages mode and some fixes
by Jinjiang Tu 26 Oct '26

26 Oct '26

Andrew Morton (1): mm/hugetlb.c: undo errant change Chengming Zhou (2): mm/ksm: refactor out try_to_merge_with_zero_page() mm/ksm: don't waste time searching stable tree for fast changing page Jinjiang Tu (4): mm/ksm: fix ksm exec support for prctl mm/memcontrol: add ksm state for memcg mm/memcontrol: enable KSM for tasks moving to new memcg mm/ksm: add ksm_only_merge_zero_pages mode to merge zero pages only Johannes Weiner (1): mm: page_alloc: avoid kswapd thrashing due to NUMA restrictions Stefan Roesch (1): mm/ksm: support fork/exec for prctl fs/exec.c | 11 ++ include/linux/ksm.h | 14 +++ include/linux/memcontrol.h | 4 + include/linux/sched/coredump.h | 8 +- mm/ksm.c | 190 +++++++++++++++++++++++++-------- mm/memcontrol.c | 67 +++++++++++- mm/page_alloc.c | 24 +++++ 7 files changed, 270 insertions(+), 48 deletions(-) -- 2.43.0

2 10

[PATCH OLK-6.6] scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking
by Zizhi Wo 23 Oct '26

23 Oct '26

From: Nilesh Javali <njavali(a)marvell.com> stable inclusion from stable-v6.6.160 commit 2e6f60adf609c77e828f64e0cd371920bef91c12 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20146 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit… -------------------------------- [ Upstream commit 34a40e0dff940ac5eba494a69b553ea571e24873 ] qla25xx_free_req_que() and qla25xx_free_rsp_que() have two pre-existing bugs exposed on the error path of qla25xx_create_{req,rsp}_que(): 1. When dma_alloc_coherent() fails during queue creation, the error path calls the free function with req->ring / rsp->ring still NULL (from kzalloc). The unconditional dma_free_coherent() with a NULL cpu_addr is undefined behavior and can panic. 2. The free functions clear req_qid_map / rsp_qid_map under vport_lock, but the create functions protect the same bitmaps with mq_lock. This provides no mutual exclusion. Additionally, the create error path clears the bit and releases mq_lock before calling the free function, creating a window where another thread can allocate the same que_id and have its ha->req_q_map entry clobbered by the subsequent lockless NULL assignment in the free function. Fix by: - Guarding dma_free_coherent() with a NULL check on the ring pointer. - Using mq_lock (the lock held by all creators) in the free functions to atomically NULL the map entry and clear the bitmap bit. - Removing the now-redundant clear_bit blocks from the create error paths since the free functions handle it atomically. Signed-off-by: Nilesh Javali <njavali(a)marvell.com> Reviewed-by: Hannes Reinecke <hare(a)kernel.org> Link: https://patch.msgid.link/20260723050413.3897522-41-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) <mkp(a)kernel.org> Backport adaptation for the stable tree: the 29xx IOCB size-selection helpers are absent, and queue creation still allocates fixed-size entries. Initialize the local req_entry_size and rsp_entry_size values with sizeof(request_t) and sizeof(response_t), respectively, so DMA freeing continues to match allocation without adding helper functions or 29xx support. Retain all NULL-ring guards, mq_lock protection, and removal of the premature bitmap clears. Keep the response-ring cleanup layout used by upstream so target commit 19788a55cab61d78e33e0914a5a31d27843e8a4a applies unchanged. Stable-dep-of: 19788a55cab6 ("scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown") Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/scsi/qla2xxx/qla_mid.c [Simple context conflicts.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- drivers/scsi/qla2xxx/qla_mid.c | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/drivers/scsi/qla2xxx/qla_mid.c b/drivers/scsi/qla2xxx/qla_mid.c index 4029b7942e21..86c0217d1763 100644 --- a/drivers/scsi/qla2xxx/qla_mid.c +++ b/drivers/scsi/qla2xxx/qla_mid.c @@ -572,30 +572,34 @@ qla24xx_create_vhost(struct fc_vport *fc_vport) static void qla25xx_free_req_que(struct scsi_qla_host *vha, struct req_que *req) { struct qla_hw_data *ha = vha->hw; uint16_t que_id = req->id; + size_t req_entry_size = sizeof(request_t); - dma_free_coherent(&ha->pdev->dev, (req->length + 1) * - sizeof(request_t), req->ring, req->dma); + if (req->ring) + dma_free_coherent(&ha->pdev->dev, + (req->length + 1) * req_entry_size, + req->ring, req->dma); req->ring = NULL; req->dma = 0; if (que_id) { + mutex_lock(&ha->mq_lock); ha->req_q_map[que_id] = NULL; - mutex_lock(&ha->vport_lock); clear_bit(que_id, ha->req_qid_map); - mutex_unlock(&ha->vport_lock); + mutex_unlock(&ha->mq_lock); } kfree(req->outstanding_cmds); kfree(req); } static void qla25xx_free_rsp_que(struct scsi_qla_host *vha, struct rsp_que *rsp) { struct qla_hw_data *ha = vha->hw; uint16_t que_id = rsp->id; + size_t rsp_entry_size = sizeof(response_t); if (rsp->msix && rsp->msix->have_irq) { free_irq(rsp->msix->vector, rsp->msix->handle); rsp->msix->have_irq = 0; rsp->msix->in_use = 0; @@ -604,19 +608,21 @@ qla25xx_free_rsp_que(struct scsi_qla_host *vha, struct rsp_que *rsp) /* Flush any queued response work before freeing the queue/qpair. */ if (rsp->qpair && ha->wq) cancel_work_sync(&rsp->qpair->q_work); - dma_free_coherent(&ha->pdev->dev, (rsp->length + 1) * - sizeof(response_t), rsp->ring, rsp->dma); + if (rsp->ring) + dma_free_coherent(&ha->pdev->dev, + (rsp->length + 1) * rsp_entry_size, + rsp->ring, rsp->dma); rsp->ring = NULL; rsp->dma = 0; if (que_id) { + mutex_lock(&ha->mq_lock); ha->rsp_q_map[que_id] = NULL; - mutex_lock(&ha->vport_lock); clear_bit(que_id, ha->rsp_qid_map); - mutex_unlock(&ha->vport_lock); + mutex_unlock(&ha->mq_lock); } kfree(rsp); } int @@ -797,13 +803,10 @@ qla25xx_create_req_que(struct qla_hw_data *ha, uint16_t options, if (startqp) { ret = qla25xx_init_req_que(base_vha, req); if (ret != QLA_SUCCESS) { ql_log(ql_log_fatal, base_vha, 0x00df, "%s failed.\n", __func__); - mutex_lock(&ha->mq_lock); - clear_bit(que_id, ha->req_qid_map); - mutex_unlock(&ha->mq_lock); goto que_failed; } vha->flags.qpairs_req_created = 1; } @@ -911,13 +914,10 @@ qla25xx_create_rsp_que(struct qla_hw_data *ha, uint16_t options, if (startqp) { ret = qla25xx_init_rsp_que(base_vha, rsp); if (ret != QLA_SUCCESS) { ql_log(ql_log_fatal, base_vha, 0x00e7, "%s failed.\n", __func__); - mutex_lock(&ha->mq_lock); - clear_bit(que_id, ha->rsp_qid_map); - mutex_unlock(&ha->mq_lock); goto que_failed; } vha->flags.qpairs_rsp_created = 1; } rsp->req = NULL; -- 2.52.0

2 1

[PATCH OLK-6.6 0/2] resolve hungtask
by Chen Jinghuang 23 Oct '26

23 Oct '26

*** BLURB HERE *** Chen Jinghuang (1): sched: Fix struct sched_entity kabi broken Ingo Molnar (1): sched/fair: Separate se->vlag from se->vprot include/linux/sched.h | 17 ++++------------- 1 file changed, 4 insertions(+), 13 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking
by Zizhi Wo 23 Oct '26

23 Oct '26

From: Nilesh Javali <njavali(a)marvell.com> stable inclusion from stable-v6.6.160 commit 2e6f60adf609c77e828f64e0cd371920bef91c12 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20146 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit… -------------------------------- [ Upstream commit 34a40e0dff940ac5eba494a69b553ea571e24873 ] qla25xx_free_req_que() and qla25xx_free_rsp_que() have two pre-existing bugs exposed on the error path of qla25xx_create_{req,rsp}_que(): 1. When dma_alloc_coherent() fails during queue creation, the error path calls the free function with req->ring / rsp->ring still NULL (from kzalloc). The unconditional dma_free_coherent() with a NULL cpu_addr is undefined behavior and can panic. 2. The free functions clear req_qid_map / rsp_qid_map under vport_lock, but the create functions protect the same bitmaps with mq_lock. This provides no mutual exclusion. Additionally, the create error path clears the bit and releases mq_lock before calling the free function, creating a window where another thread can allocate the same que_id and have its ha->req_q_map entry clobbered by the subsequent lockless NULL assignment in the free function. Fix by: - Guarding dma_free_coherent() with a NULL check on the ring pointer. - Using mq_lock (the lock held by all creators) in the free functions to atomically NULL the map entry and clear the bitmap bit. - Removing the now-redundant clear_bit blocks from the create error paths since the free functions handle it atomically. Signed-off-by: Nilesh Javali <njavali(a)marvell.com> Reviewed-by: Hannes Reinecke <hare(a)kernel.org> Link: https://patch.msgid.link/20260723050413.3897522-41-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) <mkp(a)kernel.org> Backport adaptation for the stable tree: the 29xx IOCB size-selection helpers are absent, and queue creation still allocates fixed-size entries. Initialize the local req_entry_size and rsp_entry_size values with sizeof(request_t) and sizeof(response_t), respectively, so DMA freeing continues to match allocation without adding helper functions or 29xx support. Retain all NULL-ring guards, mq_lock protection, and removal of the premature bitmap clears. Keep the response-ring cleanup layout used by upstream so target commit 19788a55cab61d78e33e0914a5a31d27843e8a4a applies unchanged. Stable-dep-of: 19788a55cab6 ("scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown") Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/scsi/qla2xxx/qla_mid.c [Simple context conflicts.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- drivers/scsi/qla2xxx/qla_mid.c | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/drivers/scsi/qla2xxx/qla_mid.c b/drivers/scsi/qla2xxx/qla_mid.c index 4029b7942e21..53a523adcd06 100644 --- a/drivers/scsi/qla2xxx/qla_mid.c +++ b/drivers/scsi/qla2xxx/qla_mid.c @@ -572,30 +572,34 @@ qla24xx_create_vhost(struct fc_vport *fc_vport) static void qla25xx_free_req_que(struct scsi_qla_host *vha, struct req_que *req) { struct qla_hw_data *ha = vha->hw; uint16_t que_id = req->id; + size_t req_entry_size = sizeof(request_t); - dma_free_coherent(&ha->pdev->dev, (req->length + 1) * - sizeof(request_t), req->ring, req->dma); + if (req->ring) + dma_free_coherent(&ha->pdev->dev, + (req->length + 1) * req_entry_size, + req->ring, req->dma); req->ring = NULL; req->dma = 0; if (que_id) { + mutex_lock(&ha->mq_lock); ha->req_q_map[que_id] = NULL; - mutex_lock(&ha->vport_lock); clear_bit(que_id, ha->req_qid_map); - mutex_unlock(&ha->vport_lock); + mutex_unlock(&ha->mq_lock); } kfree(req->outstanding_cmds); kfree(req); } static void qla25xx_free_rsp_que(struct scsi_qla_host *vha, struct rsp_que *rsp) { struct qla_hw_data *ha = vha->hw; uint16_t que_id = rsp->id; + size_t rsp_entry_size = sizeof(response_t); if (rsp->msix && rsp->msix->have_irq) { free_irq(rsp->msix->vector, rsp->msix->handle); rsp->msix->have_irq = 0; rsp->msix->in_use = 0; @@ -604,19 +608,21 @@ qla25xx_free_rsp_que(struct scsi_qla_host *vha, struct rsp_que *rsp) /* Flush any queued response work before freeing the queue/qpair. */ if (rsp->qpair && ha->wq) cancel_work_sync(&rsp->qpair->q_work); - dma_free_coherent(&ha->pdev->dev, (rsp->length + 1) * - sizeof(response_t), rsp->ring, rsp->dma); + if (req->ring) + dma_free_coherent(&ha->pdev->dev, + (req->length + 1) * req_entry_size, + req->ring, req->dma); rsp->ring = NULL; rsp->dma = 0; if (que_id) { + mutex_lock(&ha->mq_lock); ha->rsp_q_map[que_id] = NULL; - mutex_lock(&ha->vport_lock); clear_bit(que_id, ha->rsp_qid_map); - mutex_unlock(&ha->vport_lock); + mutex_unlock(&ha->mq_lock); } kfree(rsp); } int @@ -797,13 +803,10 @@ qla25xx_create_req_que(struct qla_hw_data *ha, uint16_t options, if (startqp) { ret = qla25xx_init_req_que(base_vha, req); if (ret != QLA_SUCCESS) { ql_log(ql_log_fatal, base_vha, 0x00df, "%s failed.\n", __func__); - mutex_lock(&ha->mq_lock); - clear_bit(que_id, ha->req_qid_map); - mutex_unlock(&ha->mq_lock); goto que_failed; } vha->flags.qpairs_req_created = 1; } @@ -911,13 +914,10 @@ qla25xx_create_rsp_que(struct qla_hw_data *ha, uint16_t options, if (startqp) { ret = qla25xx_init_rsp_que(base_vha, rsp); if (ret != QLA_SUCCESS) { ql_log(ql_log_fatal, base_vha, 0x00e7, "%s failed.\n", __func__); - mutex_lock(&ha->mq_lock); - clear_bit(que_id, ha->rsp_qid_map); - mutex_unlock(&ha->mq_lock); goto que_failed; } vha->flags.qpairs_rsp_created = 1; } rsp->req = NULL; -- 2.52.0

2 1

[PATCH OLK-6.6 0/2] resolve hungtask
by Chen Jinghuang 23 Oct '26

23 Oct '26

*** BLURB HERE *** Chen Jinghuang (1): sched: Fix struct sched_entity kabi broken Ingo Molnar (1): sched/fair: Separate se->vlag from se->vprot include/linux/sched.h | 17 ++++------------- 1 file changed, 4 insertions(+), 13 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 1/2] sched/fair: Separate se->vlag from se->vprot
by Chen Jinghuang 23 Oct '26

23 Oct '26

From: Ingo Molnar <mingo(a)kernel.org> mainline inclusion from mainline-v7.0-rc1 commit 80390ead2080071cbd6f427ff8deb94d10a4a50f category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/10165 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There's no real space concerns here and keeping these fields in a union makes reading (and tracing) the scheduler code harder. Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Link: https://patch.msgid.link/20251201064647.1851919-4-mingo@kernel.org Conflicts: include/linux/sched.h [a trival context conflict about kabi] Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- include/linux/sched.h | 16 ++++------------ 1 file changed, 4 insertions(+), 12 deletions(-) diff --git a/include/linux/sched.h b/include/linux/sched.h index c7229faef4c7..639851dbd85e 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -595,18 +595,10 @@ struct sched_entity { u64 sum_exec_runtime; u64 prev_sum_exec_runtime; u64 vruntime; - KABI_BROKEN_REPLACE( - s64 vlag, - union { - /* - * When !@on_rq this field is vlag. - * When cfs_rq->curr == se (which implies @on_rq) - * this field is vprot. See protect_slice(). - */ - s64 vlag; - u64 vprot; - } - ) + /* Approximated virtual lag: */ + s64 vlag; + /* 'Protected' deadline, to give out minimum quantums: */ + u64 vprot; u64 slice; u64 nr_migrations; -- 2.34.1

2 2

[PATCH OLK-6.6] drm/amdkfd: fix SMI event cross-process information leak
by Zhang Yuwei 22 Oct '26

22 Oct '26

From: Yongqiang Sun <Yongqiang.Sun(a)amd.com> mainline inclusion from mainline-v7.2-rc1 commit 92a8dba246d371fe268280e5fd74b0955688e6df category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19653 CVE: CVE-2026-97422 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- kfd_smi_ev_enabled() skips the suser privilege check when pid=0. PROCESS_START, PROCESS_END, and VMFAULT events are emitted with pid=0 while carrying another process's PID and command name, so any /dev/kfd user in the render group can monitor all GPU workloads. Pass the target process PID into kfd_smi_event_add() for these events so the existing per-client filter restricts delivery to the owning process or CAP_SYS_ADMIN subscribers. Signed-off-by: Yongqiang Sun <Yongqiang.Sun(a)amd.com> Acked-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Co-authored-by: BackportAgent(a)deepseek-v4.1-flash Signed-off-by: Hulk Robot <hulkrobot(a)huawei.com> Conflicts: drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c [Commit b8f67b9ddf4f changed vm->task_info to flat fields (task_info->pid/tgid/task_name), so pass task_info->tgid as the SMI client pid filter instead of task_info->task.tgid. The kfd_smi_event_process()/PROCESS_START|END path does not exist in this tree, so only the VMFAULT caller is adapted.] Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> --- drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c b/drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c index 06ac835190f9..4e374c0e5a52 100644 --- a/drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c +++ b/drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c @@ -244,8 +244,9 @@ void kfd_smi_event_update_vmfault(struct kfd_node *dev, uint16_t pasid) if (task_info) { /* Report VM faults from user applications, not retry from kernel */ if (task_info->pid) - kfd_smi_event_add(0, dev, KFD_SMI_EVENT_VMFAULT, "%x:%s\n", - task_info->pid, task_info->task_name); + kfd_smi_event_add(task_info->tgid, dev, + KFD_SMI_EVENT_VMFAULT, "%x:%s\n", + task_info->pid, task_info->task_name); amdgpu_vm_put_task_info(task_info); } } -- 2.22.0

2 1

[PATCH OLK-6.6] drm/amdkfd: fix SMI event cross-process information leak
by Zhang Yuwei 22 Oct '26

22 Oct '26

From: Yongqiang Sun <Yongqiang.Sun(a)amd.com> mainline inclusion from mainline-v7.2-rc1 commit 92a8dba246d371fe268280e5fd74b0955688e6df category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19653 CVE: CVE-2026-97422 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- kfd_smi_ev_enabled() skips the suser privilege check when pid=0. PROCESS_START, PROCESS_END, and VMFAULT events are emitted with pid=0 while carrying another process's PID and command name, so any /dev/kfd user in the render group can monitor all GPU workloads. Pass the target process PID into kfd_smi_event_add() for these events so the existing per-client filter restricts delivery to the owning process or CAP_SYS_ADMIN subscribers. Signed-off-by: Yongqiang Sun <Yongqiang.Sun(a)amd.com> Acked-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Conflicts: drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c [Commit b8f67b9ddf4f changed vm->task_info to flat fields (task_info->pid/tgid/task_name), so pass task_info->tgid as the SMI client pid filter instead of task_info->task.tgid. The kfd_smi_event_process()/PROCESS_START|END path does not exist in this tree, so only the VMFAULT caller is adapted.] Co-authored-by: BackportAgent(a)deepseek-v4.1-flash Signed-off-by: Hulk Robot <hulkrobot(a)huawei.com> Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> --- drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c b/drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c index 06ac835190f9..4e374c0e5a52 100644 --- a/drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c +++ b/drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c @@ -244,8 +244,9 @@ void kfd_smi_event_update_vmfault(struct kfd_node *dev, uint16_t pasid) if (task_info) { /* Report VM faults from user applications, not retry from kernel */ if (task_info->pid) - kfd_smi_event_add(0, dev, KFD_SMI_EVENT_VMFAULT, "%x:%s\n", - task_info->pid, task_info->task_name); + kfd_smi_event_add(task_info->tgid, dev, + KFD_SMI_EVENT_VMFAULT, "%x:%s\n", + task_info->pid, task_info->task_name); amdgpu_vm_put_task_info(task_info); } } -- 2.22.0

2 1