- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] media: dvb-core: fix wrong reinitialization of ringbuffer on reopen
by Chen Jinghuang 13 Apr '26

13 Apr '26

From: Jens Axboe <axboe(a)kernel.dk> mainline inclusion from mainline-v7.0-rc2 commit bfbc0b5b32a8f28ce284add619bf226716a59bc0 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13873 CVE: CVE-2026-23253 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- dvb_dvr_open() calls dvb_ringbuffer_init() when a new reader opens the DVR device. dvb_ringbuffer_init() calls init_waitqueue_head(), which reinitializes the waitqueue list head to empty. Since dmxdev->dvr_buffer.queue is a shared waitqueue (all opens of the same DVR device share it), this orphans any existing waitqueue entries from io_uring poll or epoll, leaving them with stale prev/next pointers while the list head is reset to {self, self}. The waitqueue and spinlock in dvr_buffer are already properly initialized once in dvb_dmxdev_init(). The open path only needs to reset the buffer data pointer, size, and read/write positions. Replace the dvb_ringbuffer_init() call in dvb_dvr_open() with direct assignment of data/size and a call to dvb_ringbuffer_reset(), which properly resets pread, pwrite, and error with correct memory ordering without touching the waitqueue or spinlock. Cc: stable(a)vger.kernel.org Fixes: 34731df288a5f ("V4L/DVB (3501): Dmxdev: use dvb_ringbuffer") Reported-by: syzbot+ab12f0c08dd7ab8d057c(a)syzkaller.appspotmail.com Tested-by: syzbot+ab12f0c08dd7ab8d057c(a)syzkaller.appspotmail.com Link: https://lore.kernel.org/all/698a26d3.050a0220.3b3015.007d.GAE@google.com/ Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Conflicts: drivers/media/dvb-core/dmxdev.c [context conflict] Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- drivers/media/dvb-core/dmxdev.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/media/dvb-core/dmxdev.c b/drivers/media/dvb-core/dmxdev.c index 12b7f698f562..c32adebd0e16 100644 --- a/drivers/media/dvb-core/dmxdev.c +++ b/drivers/media/dvb-core/dmxdev.c @@ -178,7 +178,9 @@ static int dvb_dvr_open(struct inode *inode, struct file *file) mutex_unlock(&dmxdev->mutex); return -ENOMEM; } - dvb_ringbuffer_init(&dmxdev->dvr_buffer, mem, DVR_BUFFER_SIZE); + dmxdev->dvr_buffer.data = mem; + dmxdev->dvr_buffer.size = DVR_BUFFER_SIZE; + dvb_ringbuffer_reset(&dmxdev->dvr_buffer); if (dmxdev->may_do_mmap) dvb_vb2_init(&dmxdev->dvr_vb2_ctx, "dvr", file->f_flags & O_NONBLOCK); -- 2.34.1

2 1

[PATCH OLK-5.10] media: dvb-core: fix wrong reinitialization of ringbuffer on reopen
by Chen Jinghuang 13 Apr '26

13 Apr '26

From: Jens Axboe <axboe(a)kernel.dk> mainline inclusion from mainline-v7.0-rc2 commit bfbc0b5b32a8f28ce284add619bf226716a59bc0 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13873 CVE: CVE-2026-23253 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- dvb_dvr_open() calls dvb_ringbuffer_init() when a new reader opens the DVR device. dvb_ringbuffer_init() calls init_waitqueue_head(), which reinitializes the waitqueue list head to empty. Since dmxdev->dvr_buffer.queue is a shared waitqueue (all opens of the same DVR device share it), this orphans any existing waitqueue entries from io_uring poll or epoll, leaving them with stale prev/next pointers while the list head is reset to {self, self}. The waitqueue and spinlock in dvr_buffer are already properly initialized once in dvb_dmxdev_init(). The open path only needs to reset the buffer data pointer, size, and read/write positions. Replace the dvb_ringbuffer_init() call in dvb_dvr_open() with direct assignment of data/size and a call to dvb_ringbuffer_reset(), which properly resets pread, pwrite, and error with correct memory ordering without touching the waitqueue or spinlock. Cc: stable(a)vger.kernel.org Fixes: 34731df288a5f ("V4L/DVB (3501): Dmxdev: use dvb_ringbuffer") Reported-by: syzbot+ab12f0c08dd7ab8d057c(a)syzkaller.appspotmail.com Tested-by: syzbot+ab12f0c08dd7ab8d057c(a)syzkaller.appspotmail.com Link: https://lore.kernel.org/all/698a26d3.050a0220.3b3015.007d.GAE@google.com/ Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Conflicts: drivers/media/dvb-core/dmxdev.c [context conflict] Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- drivers/media/dvb-core/dmxdev.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/media/dvb-core/dmxdev.c b/drivers/media/dvb-core/dmxdev.c index 12b7f698f562..c32adebd0e16 100644 --- a/drivers/media/dvb-core/dmxdev.c +++ b/drivers/media/dvb-core/dmxdev.c @@ -178,7 +178,9 @@ static int dvb_dvr_open(struct inode *inode, struct file *file) mutex_unlock(&dmxdev->mutex); return -ENOMEM; } - dvb_ringbuffer_init(&dmxdev->dvr_buffer, mem, DVR_BUFFER_SIZE); + dmxdev->dvr_buffer.data = mem; + dmxdev->dvr_buffer.size = DVR_BUFFER_SIZE; + dvb_ringbuffer_reset(&dmxdev->dvr_buffer); if (dmxdev->may_do_mmap) dvb_vb2_init(&dmxdev->dvr_vb2_ctx, "dvr", file->f_flags & O_NONBLOCK); -- 2.34.1

2 1

[PATCH OLK-6.6 00/15] *** backport task throttle ***
by Zhang Qiao 13 Apr '26

13 Apr '26

Aaron Lu (7): [Backport] sched/fair: Task based throttle time accounting [Backport] sched/fair: Get rid of throttled_lb_pair() [Backport] sched/fair: Propagate load for throttled cfs_rq [Backport] sched/fair: update_cfs_group() for throttled cfs_rqs [Backport] sched/fair: Do not balance task to a throttled cfs_rq [Backport] sched/fair: Prevent cfs_rq from being unthrottled with zero runtime_remaining [Backport] sched/fair: Do not special case tasks in throttled hierarchy K Prateek Nayak (1): [Backport] sched/fair: Start a cfs_rq on throttled hierarchy with PELT clock throttled Valentin Schneider (3): [Backport] sched/fair: Add related data structure for task based throttle [Backport] sched/fair: Implement throttle task work and related helpers [Backport] sched/fair: Switch to task based throttle model Wang Tao (2): [Huawei] sched: Fix kabi broken of struct task_struct and struct cfs_rq [Huawei] sched: Fix kabi broken of struct cfs_rq Zhang Qiao (2): [Huawei] sched/fair: Use separate throttle functions for QoS [Huawei] sched/fair: Use separate qos_throttled and qos_throttle_count include/linux/sched.h | 8 + kernel/sched/core.c | 5 +- kernel/sched/fair.c | 622 ++++++++++++++++++++++++++---------------- kernel/sched/pelt.h | 4 +- kernel/sched/sched.h | 17 +- 5 files changed, 409 insertions(+), 247 deletions(-) -- 2.18.0

1 15

[PATCH OLK-5.10] apparmor: validate DFA start states are in bounds in unpack_pdb
by Zhao Yipeng 11 Apr '26

11 Apr '26

From: Massimiliano Pellizzer <massimiliano.pellizzer(a)canonical.com> mainline inclusion from mainline-v7.0-rc4 commit 9063d7e2615f4a7ab321de6b520e23d370e58816 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13880 CVE: CVE-2026-23269 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Start states are read from untrusted data and used as indexes into the DFA state tables. The aa_dfa_next() function call in unpack_pdb() will access dfa->tables[YYTD_ID_BASE][start], and if the start state exceeds the number of states in the DFA, this results in an out-of-bound read. ================================================================== BUG: KASAN: slab-out-of-bounds in aa_dfa_next+0x2a1/0x360 Read of size 4 at addr ffff88811956fb90 by task su/1097 ... Reject policies with out-of-bounds start states during unpacking to prevent the issue. Fixes: ad5ff3db53c6 ("AppArmor: Add ability to load extended policy") Reported-by: Qualys Security Advisory <qsa(a)qualys.com> Tested-by: Salvatore Bonaccorso <carnil(a)debian.org> Reviewed-by: Georgia Garcia <georgia.garcia(a)canonical.com> Reviewed-by: Cengiz Can <cengiz.can(a)canonical.com> Signed-off-by: Massimiliano Pellizzer <massimiliano.pellizzer(a)canonical.com> Signed-off-by: John Johansen <john.johansen(a)canonical.com> Conflicts: security/apparmor/policy_unpack.c [The conflict is due to the commit ad596ea74e746 ("apparmor: group dfa policydb unpacking") and 98b824ff8984f ("apparmor: refcount the pdb") not being merged. The first commit change profile->policy to *policy and move to a new function: unpack_pdb. And the second commit change *policy to *pdb. So keep use profile-policy in this commit.] Signed-off-by: Zhao Yipeng <zhaoyipeng5(a)huawei.com> --- security/apparmor/policy_unpack.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c index 33fac6489077..bac5cccbf2e9 100644 --- a/security/apparmor/policy_unpack.c +++ b/security/apparmor/policy_unpack.c @@ -860,6 +860,12 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name) if (!unpack_u32(e, &profile->policy.start[0], "start")) /* default start state */ profile->policy.start[0] = DFA_START; + + if (profile->policy.start[0] >= profile->policy.dfa->tables[YYTD_ID_BASE]->td_lolen) { + info = "invalid dfa start state"; + goto fail; + } + /* setup class index */ for (i = AA_CLASS_FILE; i <= AA_CLASS_LAST; i++) { profile->policy.start[i] = @@ -890,6 +896,12 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name) } else profile->file.dfa = aa_get_dfa(nulldfa); + if (profile->file.dfa && profile->file.start >= + profile->file.dfa->tables[YYTD_ID_BASE]->td_lolen) { + info = "invalid file dfa start state"; + goto fail; + } + if (!unpack_trans_table(e, profile)) { info = "failed to unpack profile transition table"; goto fail; -- 2.34.1

2 1

[PATCH OLK-6.6 00/24] OLK-6.6 mainline or LTS patches sync
by Zicheng Qu 11 Apr '26

11 Apr '26

Chen Yu (1): sched/eevdf: Fix wakeup-preempt by checking cfs_rq->nr_running Ingo Molnar (2): sched/fair: Rename cfs_rq::avg_load to cfs_rq::sum_weight sched/fair: Rename cfs_rq::avg_vruntime to ::sum_w_vruntime, and helper functions Peter Zijlstra (10): sched/fair: Fix zero_vruntime tracking sched/fair: Fix EEVDF entity placement bug causing scheduling lag sched/fair: Adhere to place_entity() constraints sched: Unify runtime accounting across classes sched: Remove vruntime from trace_sched_stat_runtime() sched: Unify more update_curr*() sched/eevdf: Allow shorter slices to wakeup-preempt sched/fair: Only set slice protection at pick time sched/fair: Fix zero_vruntime tracking fix sched/debug: Fix avg_vruntime() usage Vincent Guittot (2): sched/fair: Use protect_slice() instead of direct comparison sched/fair: Fix NO_RUN_TO_PARITY case Wang Tao (1): sched/eevdf: Update se->vprot in reweight_entity() Xia Fukun (1): sched: fix kabi broken in struct sched_statistics Zhang Qiao (1): sched: Fix struct sched_entity kabi broken Zicheng Qu (5): sched: Re-evaluate scheduling when migrating queued tasks out of throttled cgroups sched: Fix kabi breakage of struct cfs_rq for sum_weight sched: Fix kabi breakage of struct cfs_rq for sum_w_vruntime sched/eevdf: Disable shorter slices to wakeup-preempt sched/fair: Fix vruntime drift by preventing double lag scaling during reweight zihan zhou (1): sched: Cancel the slice protection of the idle entity include/linux/sched.h | 15 +- include/trace/events/sched.h | 15 +- kernel/sched/core.c | 4 +- kernel/sched/deadline.c | 15 +- kernel/sched/debug.c | 4 +- kernel/sched/fair.c | 477 +++++++++++++++++++---------------- kernel/sched/features.h | 5 + kernel/sched/rt.c | 15 +- kernel/sched/sched.h | 18 +- kernel/sched/stop_task.c | 13 +- 10 files changed, 304 insertions(+), 277 deletions(-) -- 2.34.1

2 25

[PATCH OLK-5.10] nfsd: provide locking for v4_end_grace
by Li Lingfeng 10 Apr '26

10 Apr '26

From: NeilBrown <neil(a)brown.name> stable inclusion from stable-v5.10.248 commit ca97360860eb02e3ae4ba42c19b439a0fcecbf06 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13489 CVE: CVE-2026-22980 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2857bd59feb63fcf40fe4baf55401baea6b4feb4 ] Writing to v4_end_grace can race with server shutdown and result in memory being accessed after it was freed - reclaim_str_hashtbl in particularly. We cannot hold nfsd_mutex across the nfsd4_end_grace() call as that is held while client_tracking_op->init() is called and that can wait for an upcall to nfsdcltrack which can write to v4_end_grace, resulting in a deadlock. nfsd4_end_grace() is also called by the landromat work queue and this doesn't require locking as server shutdown will stop the work and wait for it before freeing anything that nfsd4_end_grace() might access. However, we must be sure that writing to v4_end_grace doesn't restart the work item after shutdown has already waited for it. For this we add a new flag protected with nn->client_lock. It is set only while it is safe to make client tracking calls, and v4_end_grace only schedules work while the flag is set with the spinlock held. So this patch adds a nfsd_net field "client_tracking_active" which is set as described. Another field "grace_end_forced", is set when v4_end_grace is written. After this is set, and providing client_tracking_active is set, the laundromat is scheduled. This "grace_end_forced" field bypasses other checks for whether the grace period has finished. This resolves a race which can result in use-after-free. Reported-by: Li Lingfeng <lilingfeng3(a)huawei.com> Closes: https://lore.kernel.org/linux-nfs/20250623030015.2353515-1-neil@brown.name/… Fixes: 7f5ef2e900d9 ("nfsd: add a v4_end_grace file to /proc/fs/nfsd") Cc: stable(a)vger.kernel.org Signed-off-by: NeilBrown <neil(a)brown.name> Tested-by: Li Lingfeng <lilingfeng3(a)huawei.com> Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> [ Adjust context ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/nfsd/nfs4state.c [Commit 5aa2c4a1fe28 ("NFSD: Add a nfsd4_file_hash_remove() helper") add declaration of nfsd4_file_hash_remove(); commit ea92c0768f98 ("nfsd: simplify nfsd_renew") change the return value; commit 438ef64bbfe4 ("NFSD: register/unregister of nfsd-client shrinker at nfsd startup/shutdown time") add unregister_shrinker() in nfs4_state_shutdown_net(); commit 67ef9e5fd737 ("NFSD: add courteous server support for thread with only delegation") move the position of declaration of laundry_wq.] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfsd/netns.h | 2 ++ fs/nfsd/nfs4state.c | 44 +++++++++++++++++++++++++++++++++++++++++--- fs/nfsd/nfsctl.c | 3 +-- fs/nfsd/state.h | 2 +- 4 files changed, 45 insertions(+), 6 deletions(-) diff --git a/fs/nfsd/netns.h b/fs/nfsd/netns.h index 8500acac09e0..ca5c386aafce 100644 --- a/fs/nfsd/netns.h +++ b/fs/nfsd/netns.h @@ -40,6 +40,8 @@ struct nfsd_net { struct lock_manager nfsd4_manager; bool grace_ended; + bool grace_end_forced; + bool client_tracking_active; time64_t boot_time; struct dentry *nfsd_client_dir; diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c index 302bbad5cdc6..ee28d5456dde 100644 --- a/fs/nfsd/nfs4state.c +++ b/fs/nfsd/nfs4state.c @@ -80,7 +80,7 @@ static u64 current_sessionid = 1; /* forward declarations */ static bool check_for_locks(struct nfs4_file *fp, struct nfs4_lockowner *lowner); static void nfs4_free_ol_stateid(struct nfs4_stid *stid); -void nfsd4_end_grace(struct nfsd_net *nn); +static void nfsd4_end_grace(struct nfsd_net *nn); static void _free_cpntf_state_locked(struct nfsd_net *nn, struct nfs4_cpntf_state *cps); /* Locking: */ @@ -5346,7 +5346,7 @@ nfsd4_renew(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, return status; } -void +static void nfsd4_end_grace(struct nfsd_net *nn) { /* do nothing if grace period already ended */ @@ -5379,6 +5379,34 @@ nfsd4_end_grace(struct nfsd_net *nn) */ } +static struct workqueue_struct *laundry_wq; +/** + * nfsd4_force_end_grace - forcibly end the NFSv4 grace period + * @nn: network namespace for the server instance to be updated + * + * Forces bypass of normal grace period completion, then schedules + * the laundromat to end the grace period immediately. Does not wait + * for the grace period to fully terminate before returning. + * + * Return values: + * %true: Grace termination schedule + * %false: No action was taken + */ +bool nfsd4_force_end_grace(struct nfsd_net *nn) +{ + if (!nn->client_tracking_ops) + return false; + spin_lock(&nn->client_lock); + if (nn->grace_ended || !nn->client_tracking_active) { + spin_unlock(&nn->client_lock); + return false; + } + WRITE_ONCE(nn->grace_end_forced, true); + mod_delayed_work(laundry_wq, &nn->laundromat_work, 0); + spin_unlock(&nn->client_lock); + return true; +} + /* * If we've waited a lease period but there are still clients trying to * reclaim, wait a little longer to give them a chance to finish. @@ -5388,6 +5416,8 @@ static bool clients_still_reclaiming(struct nfsd_net *nn) time64_t double_grace_period_end = nn->boot_time + 2 * nn->nfsd4_lease; + if (READ_ONCE(nn->grace_end_forced)) + return false; if (nn->track_reclaim_completes && atomic_read(&nn->nr_reclaim_complete) == nn->reclaim_str_hashtbl_size) @@ -5530,7 +5560,6 @@ nfs4_laundromat(struct nfsd_net *nn) return new_timeo; } -static struct workqueue_struct *laundry_wq; static void laundromat_main(struct work_struct *); static void @@ -7343,6 +7372,8 @@ static int nfs4_state_create_net(struct net *net) nn->unconf_name_tree = RB_ROOT; nn->boot_time = ktime_get_real_seconds(); nn->grace_ended = false; + nn->grace_end_forced = false; + nn->client_tracking_active = false; nn->nfsd4_manager.block_opens = true; INIT_LIST_HEAD(&nn->nfsd4_manager.list); INIT_LIST_HEAD(&nn->client_lru); @@ -7409,6 +7440,10 @@ nfs4_state_start_net(struct net *net) return ret; locks_start_grace(net, &nn->nfsd4_manager); nfsd4_client_tracking_init(net); + /* safe for laundromat to run now */ + spin_lock(&nn->client_lock); + nn->client_tracking_active = true; + spin_unlock(&nn->client_lock); if (nn->track_reclaim_completes && nn->reclaim_str_hashtbl_size == 0) goto skip_grace; printk(KERN_INFO "NFSD: starting %lld-second grace period (net %x)\n", @@ -7458,6 +7493,9 @@ nfs4_state_shutdown_net(struct net *net) struct nfsd_net *nn = net_generic(net, nfsd_net_id); cancel_delayed_work_sync(&nn->laundromat_work); + spin_lock(&nn->client_lock); + nn->client_tracking_active = false; + spin_unlock(&nn->client_lock); locks_end_grace(&nn->nfsd4_manager); INIT_LIST_HEAD(&reaplist); diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c index 040340080b3d..e84c8cf8e2c0 100644 --- a/fs/nfsd/nfsctl.c +++ b/fs/nfsd/nfsctl.c @@ -1133,9 +1133,8 @@ static ssize_t write_v4_end_grace(struct file *file, char *buf, size_t size) case 'Y': case 'y': case '1': - if (!nn->nfsd_serv) + if (!nfsd4_force_end_grace(nn)) return -EBUSY; - nfsd4_end_grace(nn); break; default: return -EINVAL; diff --git a/fs/nfsd/state.h b/fs/nfsd/state.h index 9eae11a9d21c..0e4f98b41364 100644 --- a/fs/nfsd/state.h +++ b/fs/nfsd/state.h @@ -683,7 +683,7 @@ static inline void get_nfs4_file(struct nfs4_file *fi) struct nfsd_file *find_any_file(struct nfs4_file *f); /* grace period management */ -void nfsd4_end_grace(struct nfsd_net *nn); +bool nfsd4_force_end_grace(struct nfsd_net *nn); /* nfs4recover operations */ extern int nfsd4_client_tracking_init(struct net *net); -- 2.52.0

2 1

[PATCH OLK-6.6 00/22] arm64/sysreg: Add definition for FPMR
by Qinxin Xia 10 Apr '26

10 Apr '26

From: Hongye Lin <linhongye(a)h-partners.com> mainline inclusion from mainline-v6.8-rc1 commit e3a649ecf8b9253cb1d05ceb085544472b06446f category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/8904 CVE: NA Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm… ---------------------------------------------------------------------- DDI0601 2023-09 defines a new sysrem register FPMR (Floating Point Mode Register) which configures the new FP8 features. Add a definition of this register. Qinxin Xia (18): arm64/sysreg: Add definition for ID_AA64PFR2_EL1 arm64/sysreg: Add definition for ID_AA64ISAR3_EL1 arm64/sysreg: Add definition for ID_AA64FPFR0_EL1 arm64/sysreg: Add definition for FPMR arm64/sysreg: Add EnFPM field for SCTLR_EL1 and HCRX_EL2 arm64/sysreg: Add LUT field for ID_AA64ISAR2_EL1 arm64/cpufeature: Hook new identification registers up to cpufeature arm64/fpsimd: Support FEAT_FPMR arm64/hwcap: Define hwcaps for 2023 DPISA features kselftest/arm64: Add basic FPMR test kselftest/arm64: Handle FPMR context in generic signal frame parser kselftest/arm64: Add 2023 DPISA hwcap test coverage arm64: Kconfig: Detect toolchain support for LSUI arm64: cpufeature: add FEAT_LSUI arm64/signal: Add FPMR signal handling arm64/ptrace: Expose FPMR via ptrace Fix kabi for thread struct with FPMR Add support "arm64.nocnp" for start option Yifan Wu (4): arm64/hwcap: Add support for FEAT_CMPBR kselftest/arm64: Add FEAT_CMPBR to the hwcap selftest arm64/sysreg: Update ID_AA64ISAR2_EL1 for FEAT_CMPBR selftest/arm64: Fix sve2p1_sigill() to hwcap test Documentation/arch/arm64/elf_hwcaps.rst | 30 +++++ arch/arm64/Kconfig | 5 + arch/arm64/include/asm/cpu.h | 3 + arch/arm64/include/asm/cpufeature.h | 6 + arch/arm64/include/asm/fpsimd.h | 2 + arch/arm64/include/asm/hwcap.h | 10 ++ arch/arm64/include/asm/processor.h | 5 + arch/arm64/include/asm/signal_common.h | 16 +++ arch/arm64/include/uapi/asm/hwcap.h | 10 ++ arch/arm64/include/uapi/asm/sigcontext.h | 8 ++ arch/arm64/kernel/cpufeature.c | 70 +++++++++- arch/arm64/kernel/cpuinfo.c | 3 + arch/arm64/kernel/fpsimd.c | 13 ++ arch/arm64/kernel/hwcap_str.h | 10 ++ arch/arm64/kernel/idreg-override.c | 11 ++ arch/arm64/kernel/ptrace.c | 42 ++++++ arch/arm64/kernel/signal.c | 46 +++++++ arch/arm64/tools/cpucaps | 2 + arch/arm64/tools/sysreg | 122 +++++++++++++++++- include/uapi/linux/elf.h | 1 + tools/testing/selftests/arm64/abi/hwcap.c | 120 ++++++++++++++++- .../testing/selftests/arm64/signal/.gitignore | 1 + .../arm64/signal/testcases/fpmr_siginfo.c | 82 ++++++++++++ .../arm64/signal/testcases/testcases.c | 8 ++ .../arm64/signal/testcases/testcases.h | 1 + 25 files changed, 621 insertions(+), 6 deletions(-) create mode 100644 tools/testing/selftests/arm64/signal/testcases/fpmr_siginfo.c -- 2.33.0

2 23

[PATCH OLK-6.6 00/23] OLK-6.6 mainline or LTS patches sync
by Zicheng Qu 10 Apr '26

10 Apr '26

Chen Yu (1): sched/eevdf: Fix wakeup-preempt by checking cfs_rq->nr_running Ingo Molnar (2): sched/fair: Rename cfs_rq::avg_load to cfs_rq::sum_weight sched/fair: Rename cfs_rq::avg_vruntime to ::sum_w_vruntime, and helper functions Peter Zijlstra (10): sched/fair: Fix zero_vruntime tracking sched/fair: Fix EEVDF entity placement bug causing scheduling lag sched/fair: Adhere to place_entity() constraints sched: Unify runtime accounting across classes sched: Remove vruntime from trace_sched_stat_runtime() sched: Unify more update_curr*() sched/eevdf: Allow shorter slices to wakeup-preempt sched/fair: Only set slice protection at pick time sched/fair: Fix zero_vruntime tracking fix sched/debug: Fix avg_vruntime() usage Vincent Guittot (2): sched/fair: Use protect_slice() instead of direct comparison sched/fair: Fix NO_RUN_TO_PARITY case Wang Tao (1): sched/eevdf: Update se->vprot in reweight_entity() Zhang Qiao (1): sched: Fix struct sched_entity kabi broken Zicheng Qu (5): sched: Re-evaluate scheduling when migrating queued tasks out of throttled cgroups sched: Fix kabi breakage of struct cfs_rq for sum_weight sched: Fix kabi breakage of struct cfs_rq for sum_w_vruntime sched/eevdf: Disable shorter slices to wakeup-preempt sched/fair: Fix vruntime drift by preventing double lag scaling during reweight zihan zhou (1): sched: Cancel the slice protection of the idle entity include/linux/sched.h | 15 +- include/trace/events/sched.h | 15 +- kernel/sched/core.c | 4 +- kernel/sched/deadline.c | 15 +- kernel/sched/debug.c | 4 +- kernel/sched/fair.c | 477 +++++++++++++++++++---------------- kernel/sched/features.h | 5 + kernel/sched/rt.c | 15 +- kernel/sched/sched.h | 18 +- kernel/sched/stop_task.c | 13 +- 10 files changed, 304 insertions(+), 277 deletions(-) -- 2.34.1

2 24

[PATCH OLK-6.6 0/6] arm64: tlbflush: Optimize flush_tlb_mm() by using TLBID
by Zeng Heng 10 Apr '26

10 Apr '26

Jinjiang Tu (3): arm64: mm: hardcode domain info and add get_domain_cpumask() arm64: mm: Track CPUs that a task has run on for TLBID optimization arm64: tlbflush: Optimize flush_tlb_mm() by using TLBID Marc Zyngier (2): arm64: cpufeature: Add ID_AA64MMFR4_EL1 handling arm64: sysreg: Add layout for ID_AA64MMFR4_EL1 Zeng Heng (1): arm64: cpufeature: Add TLBID (Domain-based TLB Invalidation) detection arch/arm64/Kconfig | 12 ++ arch/arm64/include/asm/cpu.h | 1 + arch/arm64/include/asm/cpufeature.h | 6 + arch/arm64/include/asm/mmu_context.h | 3 + arch/arm64/include/asm/tlbflush.h | 74 ++++++++- arch/arm64/kernel/cpufeature.c | 17 ++ arch/arm64/kernel/cpuinfo.c | 1 + arch/arm64/mm/context.c | 224 ++++++++++++++++++++++++++- arch/arm64/tools/cpucaps | 1 + arch/arm64/tools/sysreg | 41 +++++ 10 files changed, 375 insertions(+), 5 deletions(-) -- 2.25.1

3 8

[PATCH OLK-6.6 00/14] Introduce dmem cgroup
by Liu Kai 09 Apr '26

09 Apr '26

Introduce dmem cgroup Chen Ridong (3): cgroup/dmem: fix NULL pointer dereference when setting max cgroup/dmem: avoid rcu warning when unregister region cgroup/dmem: avoid pool UAF Friedrich Vock (1): cgroup/dmem: Don't open-code css_for_each_descendant_pre Geert Uytterhoeven (1): cgroup/rdma: Drop bogus PAGE_COUNTER select Jiapeng Chong (1): kernel/cgroup: Remove the unused variable climit Liu Kai (2): cgroup/dmem: reuse SUBSYS for dmem and devices to preserve KABI dmem: enable CONFIG_CGROUP_DMEM in arm64/x86 defconfig Maarten Lankhorst (2): mm/page_counter: move calculating protection values to page_counter kernel/cgroup: Add "dmem" memory accounting cgroup Maxime Ripard (3): cgroup/dmem: Select PAGE_COUNTER cgroup/dmem: Fix parameters documentation doc/cgroup: Fix title underline length Roman Gushchin (1): mm: page_counters: put page_counter_calculate_protection() under CONFIG_MEMCG Documentation/admin-guide/cgroup-v2.rst | 58 +- Documentation/core-api/cgroup.rst | 9 + Documentation/core-api/index.rst | 1 + Documentation/gpu/drm-compute.rst | 54 ++ arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + include/linux/cgroup_dmem.h | 71 ++ include/linux/cgroup_subsys.h | 4 +- include/linux/device_cgroup.h | 20 + include/linux/page_counter.h | 10 + init/Kconfig | 10 + kernel/cgroup/Makefile | 1 + kernel/cgroup/dmem.c | 1025 +++++++++++++++++++++++ mm/memcontrol.c | 154 +--- mm/page_counter.c | 175 ++++ security/device_cgroup.c | 63 +- 16 files changed, 1492 insertions(+), 165 deletions(-) create mode 100644 Documentation/core-api/cgroup.rst create mode 100644 Documentation/gpu/drm-compute.rst create mode 100644 include/linux/cgroup_dmem.h create mode 100644 kernel/cgroup/dmem.c -- 2.34.1

2 15