- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees
by Chen Jinghuang 20 Oct '25

20 Oct '25

From: Stephan Gerhold <stephan.gerhold(a)linaro.org> stable inclusion from stable-v6.6.107 commit ebf6c7c908e5999531c3517289598f187776124f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID0R5A CVE: CVE-2025-39923 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 5068b5254812433e841a40886e695633148d362d upstream. When we don't have a clock specified in the device tree, we have no way to ensure the BAM is on. This is often the case for remotely-controlled or remotely-powered BAM instances. In this case, we need to read num-channels from the DT to have all the necessary information to complete probing. However, at the moment invalid device trees without clock and without num-channels still continue probing, because the error handling is missing return statements. The driver will then later try to read the number of channels from the registers. This is unsafe, because it relies on boot firmware and lucky timing to succeed. Unfortunately, the lack of proper error handling here has been abused for several Qualcomm SoCs upstream, causing early boot crashes in several situations [1, 2]. Avoid these early crashes by erroring out when any of the required DT properties are missing. Note that this will break some of the existing DTs upstream (mainly BAM instances related to the crypto engine). However, clearly these DTs have never been tested properly, since the error in the kernel log was just ignored. It's safer to disable the crypto engine for these broken DTBs. [1]: https://lore.kernel.org/r/CY01EKQVWE36.B9X5TDXAREPF@fairphone.com/ [2]: https://lore.kernel.org/r/20230626145959.646747-1-krzysztof.kozlowski@linar… Cc: stable(a)vger.kernel.org Fixes: 48d163b1aa6e ("dmaengine: qcom: bam_dma: get num-channels and num-ees from dt") Signed-off-by: Stephan Gerhold <stephan.gerhold(a)linaro.org> Reviewed-by: Konrad Dybcio <konrad.dybcio(a)oss.qualcomm.com> Link: https://lore.kernel.org/r/20250212-bam-dma-fixes-v1-8-f560889e65d8@linaro.o… Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- drivers/dma/qcom/bam_dma.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/dma/qcom/bam_dma.c b/drivers/dma/qcom/bam_dma.c index 4c3eb972039d..d5882c8537e5 100644 --- a/drivers/dma/qcom/bam_dma.c +++ b/drivers/dma/qcom/bam_dma.c @@ -1283,13 +1283,17 @@ static int bam_dma_probe(struct platform_device *pdev) if (!bdev->bamclk) { ret = of_property_read_u32(pdev->dev.of_node, "num-channels", &bdev->num_channels); - if (ret) + if (ret) { dev_err(bdev->dev, "num-channels unspecified in dt\n"); + return ret; + } ret = of_property_read_u32(pdev->dev.of_node, "qcom,num-ees", &bdev->num_ees); - if (ret) + if (ret) { dev_err(bdev->dev, "num-ees unspecified in dt\n"); + return ret; + } } ret = clk_prepare_enable(bdev->bamclk); -- 2.34.1

2 1

[PATCH OLK-6.6] s390/sclp: Fix SCCB present check
by Zhang Kunbo 20 Oct '25

20 Oct '25

From: Peter Oberparleiter <oberpar(a)linux.ibm.com> stable inclusion from stable-v6.6.103 commit 86c2825791c3836a8f77a954b9c5ebe6fab410c5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICWO2L CVE: CVE-2025-39694 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 430fa71027b6ac9bb0ce5532b8d0676777d4219a upstream. Tracing code called by the SCLP interrupt handler contains early exits if the SCCB address associated with an interrupt is NULL. This check is performed after physical to virtual address translation. If the kernel identity mapping does not start at address zero, the resulting virtual address is never zero, so that the NULL checks won't work. Subsequently this may result in incorrect accesses to the first page of the identity mapping. Fix this by introducing a function that handles the NULL case before address translation. Fixes: ada1da31ce34 ("s390/sclp: sort out physical vs virtual pointers usage") Cc: stable(a)vger.kernel.org Reviewed-by: Alexander Gordeev <agordeev(a)linux.ibm.com> Signed-off-by: Peter Oberparleiter <oberpar(a)linux.ibm.com> Signed-off-by: Alexander Gordeev <agordeev(a)linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- drivers/s390/char/sclp.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/drivers/s390/char/sclp.c b/drivers/s390/char/sclp.c index 6fa0fb35e521..3409822dfbb4 100644 --- a/drivers/s390/char/sclp.c +++ b/drivers/s390/char/sclp.c @@ -76,6 +76,13 @@ unsigned long sclp_console_full; /* The currently active SCLP command word. */ static sclp_cmdw_t active_cmd; +static inline struct sccb_header *sclpint_to_sccb(u32 sccb_int) +{ + if (sccb_int) + return __va(sccb_int); + return NULL; +} + static inline void sclp_trace(int prio, char *id, u32 a, u64 b, bool err) { struct sclp_trace_entry e; @@ -620,7 +627,7 @@ __sclp_find_req(u32 sccb) static bool ok_response(u32 sccb_int, sclp_cmdw_t cmd) { - struct sccb_header *sccb = (struct sccb_header *)__va(sccb_int); + struct sccb_header *sccb = sclpint_to_sccb(sccb_int); struct evbuf_header *evbuf; u16 response; @@ -659,7 +666,7 @@ static void sclp_interrupt_handler(struct ext_code ext_code, /* INT: Interrupt received (a=intparm, b=cmd) */ sclp_trace_sccb(0, "INT", param32, active_cmd, active_cmd, - (struct sccb_header *)__va(finished_sccb), + sclpint_to_sccb(finished_sccb), !ok_response(finished_sccb, active_cmd)); if (finished_sccb) { -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] bcache: Fix __bch_btree_node_alloc to make the failure behavior consistent
by Xia Fukun 20 Oct '25

20 Oct '25

From: Zheng Wang <zyytlz.wz(a)163.com> stable inclusion from stable-v4.19.325 commit 587b4e8bb5dac682f09280ab35db4632b29d5ac4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID0VIM CVE: CVE-2023-53681 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 80fca8a10b604afad6c14213fdfd816c4eda3ee4 ] In some specific situations, the return value of __bch_btree_node_alloc may be NULL. This may lead to a potential NULL pointer dereference in caller function like a calling chain : btree_split->bch_btree_node_alloc->__bch_btree_node_alloc. Fix it by initializing the return value in __bch_btree_node_alloc. Fixes: cafe56359144 ("bcache: A block layer cache") Cc: stable(a)vger.kernel.org Signed-off-by: Zheng Wang <zyytlz.wz(a)163.com> Signed-off-by: Coly Li <colyli(a)suse.de> Link: https://lore.kernel.org/r/20230615121223.22502-6-colyli@suse.de Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/md/bcache/btree.c [Context differences.] Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- drivers/md/bcache/btree.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c index 24e70ee342f0..2b2621a6092c 100644 --- a/drivers/md/bcache/btree.c +++ b/drivers/md/bcache/btree.c @@ -1062,10 +1062,12 @@ struct btree *__bch_btree_node_alloc(struct cache_set *c, struct btree_op *op, struct btree *parent) { BKEY_PADDED(key) k; - struct btree *b = ERR_PTR(-EAGAIN); + struct btree *b; mutex_lock(&c->bucket_lock); retry: + /* return ERR_PTR(-EAGAIN) when it fails */ + b = ERR_PTR(-EAGAIN); if (__bch_bucket_alloc_set(c, RESERVE_BTREE, &k.key, 1, wait)) goto err; -- 2.34.1

2 1

[PATCH OLK-6.6] i40e: fix idx validation in config queues msg
by Fanhua Li 20 Oct '25

20 Oct '25

From: Lukasz Czapnik <lukasz.czapnik(a)intel.com> stable inclusion from stable-v6.6.109 commit 2cc26dac0518d2fa9b67ec813ee60e183480f98a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID2290 CVE: CVE-2025-39971 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f1ad24c5abe1eaef69158bac1405a74b3c365115 upstream. Ensure idx is within range of active/initialized TCs when iterating over vf->ch[idx] in i40e_vc_config_queues_msg(). Fixes: c27eac48160d ("i40e: Enable ADq and create queue channel/s on VF") Cc: stable(a)vger.kernel.org Signed-off-by: Lukasz Czapnik <lukasz.czapnik(a)intel.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov(a)intel.com> Signed-off-by: Przemek Kitszel <przemyslaw.kitszel(a)intel.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Tested-by: Kamakshi Nellore <nellorex.kamakshi(a)intel.com> (A Contingent Worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Fanhua Li <lifanhua5(a)huawei.com> --- drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c index d5509bc16d0d5..9a9195a7e5d46 100644 --- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c @@ -2390,7 +2390,7 @@ static int i40e_vc_config_queues_msg(struct i40e_vf *vf, u8 *msg) } if (vf->adq_enabled) { - if (idx >= ARRAY_SIZE(vf->ch)) { + if (idx >= vf->num_tc) { aq_ret = -ENODEV; goto error_param; } @@ -2411,7 +2411,7 @@ static int i40e_vc_config_queues_msg(struct i40e_vf *vf, u8 *msg) * to its appropriate VSIs based on TC mapping */ if (vf->adq_enabled) { - if (idx >= ARRAY_SIZE(vf->ch)) { + if (idx >= vf->num_tc) { aq_ret = -ENODEV; goto error_param; } -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path
by Xia Fukun 20 Oct '25

20 Oct '25

From: Mike Snitzer <snitzer(a)kernel.org> stable inclusion from stable-v4.19.283 commit ca8b634fdf07dee3f6dfde57079c4511480b525e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID0UC2 CVE: CVE-2023-53604 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 6b79a428c02769f2a11f8ae76bf866226d134887 upstream. Otherwise the journal_io_cache will leak if dm_register_target() fails. Cc: stable(a)vger.kernel.org Signed-off-by: Mike Snitzer <snitzer(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- drivers/md/dm-integrity.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c index db09e8748ec8..3f06aa909c01 100644 --- a/drivers/md/dm-integrity.c +++ b/drivers/md/dm-integrity.c @@ -3699,11 +3699,13 @@ int __init dm_integrity_init(void) } r = dm_register_target(&integrity_target); - - if (r < 0) + if (r < 0) { DMERR("register failed %d", r); + kmem_cache_destroy(journal_io_cache); + return r; + } - return r; + return 0; } void dm_integrity_exit(void) -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] Fix CVE-2025-39989
by Xinyu Zheng 20 Oct '25

20 Oct '25

*** BLURB HERE *** Shuai Xue (1): x86/mce: use is_copy_from_user() to determine copy-from-user context Tong Tiangen (1): x86/extable: Remove unused fixup type EX_TYPE_COPY arch/x86/include/asm/asm.h | 3 --- arch/x86/include/asm/extable_fixup_types.h | 2 +- arch/x86/kernel/cpu/mce/severity.c | 12 +++++------- arch/x86/mm/extable.c | 9 --------- 4 files changed, 6 insertions(+), 20 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10] net/hinic3: Modify driver version
by LinKun 20 Oct '25

20 Oct '25

From: zhuyikai <zhuyikai1(a)h-partners.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICGDO6?from=project-issue CVE: NA -------------------------------- Modify driver version. Fixes: 79871cd2cd72 ("net/hinic3: Synchronize new NIC features and bug fixes") Signed-off-by: zhuyikai <zhuyikai1(a)h-partners.com> --- drivers/net/ethernet/huawei/hinic3/hinic3_crm.h | 2 +- drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_crm.h b/drivers/net/ethernet/huawei/hinic3/hinic3_crm.h index 7979244..5a11331 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_crm.h +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_crm.h @@ -8,7 +8,7 @@ #include "mpu_cmd_base_defs.h" -#define HINIC3_DRV_VERSION "17.7.8.1" +#define HINIC3_DRV_VERSION "17.7.8.101" #define HINIC3_DRV_DESC "Intelligent Network Interface Card Driver" #define HIUDK_DRV_DESC "Intelligent Network Unified Driver" diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h b/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h index 137098b..3d2a962 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h @@ -18,7 +18,7 @@ #include "vram_common.h" #define HINIC3_NIC_DRV_NAME "hinic3" -#define HINIC3_NIC_DRV_VERSION "17.7.8.1" +#define HINIC3_NIC_DRV_VERSION "17.7.8.101" #define HINIC3_FUNC_IS_VF(hwdev) (hinic3_func_type(hwdev) == TYPE_VF) -- 2.28.0.windows.1

2 3

[PATCH OLK-5.10] net/hinic3: Modify driver version
by LinKun 20 Oct '25

20 Oct '25

From: zhuyikai <zhuyikai1(a)h-partners.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICGDO6?from=project-issue CVE: NA -------------------------------- Modify driver version. Fixes: 79871cd2cd72 ("net/hinic3: Synchronize new NIC features and bug fixes") Signed-off-by: zhuyikai <zhuyikai1(a)h-partners.com> --- hinic3/hinic3_crm.h | 2 +- hinic3/hinic3_nic_dev.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/hinic3/hinic3_crm.h b/hinic3/hinic3_crm.h index 7979244..5a11331 100644 --- a/hinic3/hinic3_crm.h +++ b/hinic3/hinic3_crm.h @@ -8,7 +8,7 @@ #include "mpu_cmd_base_defs.h" -#define HINIC3_DRV_VERSION "17.7.8.1" +#define HINIC3_DRV_VERSION "17.7.8.101" #define HINIC3_DRV_DESC "Intelligent Network Interface Card Driver" #define HIUDK_DRV_DESC "Intelligent Network Unified Driver" diff --git a/hinic3/hinic3_nic_dev.h b/hinic3/hinic3_nic_dev.h index 137098b..3d2a962 100644 --- a/hinic3/hinic3_nic_dev.h +++ b/hinic3/hinic3_nic_dev.h @@ -18,7 +18,7 @@ #include "vram_common.h" #define HINIC3_NIC_DRV_NAME "hinic3" -#define HINIC3_NIC_DRV_VERSION "17.7.8.1" +#define HINIC3_NIC_DRV_VERSION "17.7.8.101" #define HINIC3_FUNC_IS_VF(hwdev) (hinic3_func_type(hwdev) == TYPE_VF) -- 2.28.0.windows.1

2 3

[PATCH openEuler-1.0-LTS 0/2] CVE-2023-53265
by Wang Zhaolong 20 Oct '25

20 Oct '25

George Kennedy (1): ubi: ensure that VID header offset + VID header size <= alloc, size Zhihao Cheng (1): ubi: Fix failure attaching when vid_hdr offset equals to (sub)page size drivers/mtd/ubi/build.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) -- 2.34.3

2 3

[PATCH OLK-6.6] sched/core: Add sched_change_qos_group() in sched_cgroup_fork()
by Wang Tao 20 Oct '25

20 Oct '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID23FN ------------------ We use sched_change_qos_group() to change task qos group for the new task in cgroup_post_fork() if we enable the qos sched feature. Since commit 39c4261191bf ("sched/fair: Remove redundant cpu_cgrp_subsys->fork()") has remove cpu_cgrp_subsys->fork(), if we enable qos sched feature, the function "sched_change_qos_group" is lost. cgroup_post_fork() ss->fork() := cpu_cgroup_fork() --> removed sched_change_group(..., TASK_SET_GROUP) #ifdef CONFIG_QOS_SCHED sched_change_qos_group(); --> lost #endif So this patch add the function "sched_change_qos_group" in sched_cgroup_fork(). Fixes: 39c4261191bf ("sched/fair: Remove redundant cpu_cgrp_subsys->fork()") Signed-off-by: Wang Tao <wangtao554(a)huawei.com> --- kernel/sched/core.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 47877f3b52f6..2740e9b918f5 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -120,6 +120,10 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(sched_update_nr_running_tp); DEFINE_PER_CPU_SHARED_ALIGNED(struct rq, runqueues); +#ifdef CONFIG_QOS_SCHED +static void sched_change_qos_group(struct task_struct *tsk, struct task_group *tg); +#endif + #ifdef CONFIG_SCHED_DEBUG /* * Debugging: various feature bits @@ -4863,6 +4867,7 @@ int sched_fork(unsigned long clone_flags, struct task_struct *p) void sched_cgroup_fork(struct task_struct *p, struct kernel_clone_args *kargs) { unsigned long flags; + struct task_group *tg_qos __maybe_unused = NULL; /* * Because we're not yet on the pid-hash, p->pi_lock isn't strictly @@ -4876,6 +4881,9 @@ void sched_cgroup_fork(struct task_struct *p, struct kernel_clone_args *kargs) struct task_group, css); tg = autogroup_task_group(p, tg); p->sched_task_group = tg; +#ifdef CONFIG_QOS_SCHED + tg_qos = tg; +#endif } #endif rseq_migrate(p); @@ -4884,6 +4892,10 @@ void sched_cgroup_fork(struct task_struct *p, struct kernel_clone_args *kargs) * so use __set_task_cpu(). */ __set_task_cpu(p, smp_processor_id()); +#ifdef CONFIG_QOS_SCHED + sched_change_qos_group(p, tg_qos); +#endif + if (p->sched_class->task_fork) p->sched_class->task_fork(p); raw_spin_unlock_irqrestore(&p->pi_lock, flags); -- 2.34.1

2 1