- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] ipv6: prevent in6_dev_get() from resurrecting inet6_dev
by JiangJieHua 21 Sep '26

21 Sep '26

From: Kyle Zeng <kylebot(a)openai.com> mainline inclusion from mainline-v7.2-rc7 commit 0e243671bc7b8eaf00f83dd2f4367436dc0cff98 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18316 CVE: CVE-2026-74630 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- in6_dev_get() reads dev->ip6_ptr under RCU and then unconditionally increments its refcount. Device teardown can clear the pointer and drop the last reference between these operations. The increment then resurrects an object whose RCU free has already been queued, so callers can use it after it is freed. Use refcount_inc_not_zero() and return NULL when the object has already reached zero. RCU keeps the memory accessible through the attempted reference acquisition, and a successful increment pins the object for the caller. An independent run on the exact unpatched 6f5156d7a31a (v7.2-rc3) kernel reproduced the invalid reference acquisition as UID 1000: refcount_t: addition on 0; use-after-free. ip6_mc_source+0xef4/0x17e0 It was followed by the corresponding reference underflow in ip6_mc_source(). The supplied trace from the same unpatched revision additionally shows the access after the RCU read-side section ends: BUG: KASAN: slab-use-after-free in mutex_lock+0x76/0xe0 Write of size 8 at addr ffff888015b50240 by task poc/1219 Bug found and triaged by OpenAI Security Research and validated by Trail of Bits. Fixes: 8814c4b53381 ("[IPV6] ADDRCONF: Convert addrconf_lock to RCU.") Cc: stable(a)vger.kernel.org Signed-off-by: Kyle Zeng <kylebot(a)openai.com> Co-developed-by: David Lee <david.lee(a)trailofbits.com> Signed-off-by: David Lee <david.lee(a)trailofbits.com> Reviewed-by: Ido Schimmel <idosch(a)nvidia.com> Link: https://patch.msgid.link/20260803122758.666112-1-david.lee@trailofbits.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: JiangJieHua <jiangjiehua1(a)huawei.com> --- include/net/addrconf.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/include/net/addrconf.h b/include/net/addrconf.h index 10d270f004f0d..de1e3dd0c26b5 100644 --- a/include/net/addrconf.h +++ b/include/net/addrconf.h @@ -384,8 +384,8 @@ static inline struct inet6_dev *in6_dev_get(const struct net_device *dev) rcu_read_lock(); idev = rcu_dereference(dev->ip6_ptr); - if (idev) - refcount_inc(&idev->refcnt); + if (idev && !refcount_inc_not_zero(&idev->refcnt)) + idev = NULL; rcu_read_unlock(); return idev; } -- 2.33.8

2 1

[PATCH openEuler-1.0-LTS] ipv6: fix Route Information option length validation
by JiangJieHua 21 Sep '26

21 Sep '26

From: Yuejie Shi <syjcnss(a)gmail.com> mainline inclusion from mainline-v7.2-rc7 commit d1ad8fb2ac6a1afb71dc22d9ae8efb4dda96c824 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18174 CVE: CVE-2026-74598 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- rt6_route_rcv() validates the Route Information option (RFC 4191) length against the prefix length, but both checks are off by one. rinfo->length is the ND option length in units of 8 octets and it *includes* the 8-byte option header, so an option carrying N bytes of prefix has length == 1 + N/8. RFC 4191 section 2.3 requires length 3 when Prefix Length is greater than 64, and 2 or 3 when it is greater than 0. The code accepts length >= 2 and length >= 1 respectively. ipv6_addr_prefix() then copies prefix_len/8 bytes out of rinfo->prefix, so a Router Advertisement with (prefix_len=128, length=2) or (prefix_len=64, length=1) makes the kernel read up to 8 bytes past the end of the option. Those bytes end up in the prefix of the route that gets installed, so they are visible to userspace: # RA with a Route Information option (prefix_len=128, length=2) # followed by a source link-layer address option, 01 01 de ad be ef ca fe $ ip -6 route show 2001:db8:dead:beef:101:dead:beef:cafe via fe80::1234 dev veth0 proto ra ^^^^^^^^^^^^^^^^^^ the next option, read out of bounds When the Route Information option is the last one in the packet, those eight bytes come from the skb tail room instead. Reject the option lengths RFC 4191 does not allow. Fixes: 70ceb4f53929 ("[IPV6]: ROUTE: Add experimental support for Route Information Option in RA (RFC4191).") Cc: stable(a)vger.kernel.org Signed-off-by: Yuejie Shi <syjcnss(a)gmail.com> Reviewed-by: Ido Schimmel <idosch(a)nvidia.com> Link: https://patch.msgid.link/20260730035310.74584-1-syjcnss@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: JiangJieHua <jiangjiehua1(a)huawei.com> --- net/ipv6/route.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/net/ipv6/route.c b/net/ipv6/route.c index 907a5e5078199..e806ddc33c259 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -821,13 +821,13 @@ int rt6_route_rcv(struct net_device *dev, u8 *opt, int len, } else if (rinfo->prefix_len > 128) { return -EINVAL; } else if (rinfo->prefix_len > 64) { - if (rinfo->length < 2) { + /* RFC 4191: Length MUST be 3 when Prefix Length > 64 */ + if (rinfo->length < 3) return -EINVAL; - } } else if (rinfo->prefix_len > 0) { - if (rinfo->length < 1) { + /* RFC 4191: Length MUST be 2 or 3 when Prefix Length > 0 */ + if (rinfo->length < 2) return -EINVAL; - } } pref = rinfo->route_pref; -- 2.33.8

2 1

[PATCH openEuler-1.0-LTS] net: pktgen: fix proc entry use-after-free
by JiangJieHua 21 Sep '26

21 Sep '26

From: Chengfeng Ye <nicoyip.dev(a)gmail.com> mainline inclusion from mainline-v7.2-rc6 commit 817ff6efdb7f484ea547218e11e17d8e43daa3b4 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17690 CVE: CVE-2026-74479 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- pktgen_change_name() replaces pkt_dev->entry while holding t->if_lock. pktgen_remove_device() removes the same entry before _rem_dev_from_if_list() takes that lock. This allows the following interleaving: CPU 0 (NETDEV_CHANGENAME) CPU 1 (kpktgend) if_lock(t) proc_remove(pkt_dev->entry) proc_remove(pkt_dev->entry) pkt_dev->entry = proc_create_data(...) if_unlock(t) The kthread can pass the stale proc_dir_entry to proc_remove() after the rename path has freed it. A reproducer with a widened race window reports: BUG: KASAN: slab-use-after-free in proc_remove+0x78/0x80 Read of size 8 at addr ffff8881478fea70 by task kpktgend_0/67 Call Trace: proc_remove+0x78/0x80 pktgen_remove_device.isra.0+0x11c/0x4c0 pktgen_thread_worker+0x1214/0x6bc0 kthread+0x2c6/0x3b0 Allocated by task 95: __proc_create+0x204/0x790 proc_create_data+0x72/0xe0 pktgen_thread_write+0xd61/0x1510 Freed by task 28: kmem_cache_free+0xcb/0x3d0 proc_free_inode+0x5b/0x80 rcu_core+0x50a/0x1850 The buggy address belongs to the object at ffff8881478fea00 which belongs to the cache proc_dir_entry of size 192 Move proc_remove() into the if_lock-protected list removal helper. Keep it before list_del_rcu() to preserve the ordering required by add_device(). The rename path must then finish replacing the entry before removal, or it observes that the device is no longer on the list. Fixes: 39df232f1a9b ("[PKTGEN]: fix device name handling") Cc: stable(a)vger.kernel.org Signed-off-by: Chengfeng Ye <nicoyip.dev(a)gmail.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://patch.msgid.link/20260719145740.2888967-1-nicoyip.dev@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/core/pktgen.c [Context differences are due to the following patches not being merged: 870b856cb478 ("net: pktgen: fix code style (WARNING: Block comments)")] Signed-off-by: JiangJieHua <jiangjiehua1(a)huawei.com> --- net/core/pktgen.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/net/core/pktgen.c b/net/core/pktgen.c index 092fa3d75b32a..369f590ce235d 100644 --- a/net/core/pktgen.c +++ b/net/core/pktgen.c @@ -3743,6 +3743,7 @@ static void _rem_dev_from_if_list(struct pktgen_thread *t, struct pktgen_dev *p; if_lock(t); + proc_remove(pkt_dev->entry); list_for_each_safe(q, n, &t->if_list) { p = list_entry(q, struct pktgen_dev, list); if (p == pkt_dev) @@ -3771,9 +3772,6 @@ static int pktgen_remove_device(struct pktgen_thread *t, /* Remove proc before if_list entry, because add_device uses * list to determine if interface already exist, avoid race * with proc_create_data() */ - proc_remove(pkt_dev->entry); - - /* And update the thread if_list */ _rem_dev_from_if_list(t, pkt_dev); #ifdef CONFIG_XFRM -- 2.33.8

2 1

[PATCH openEuler-1.0-LTS] ipv4: fib: Don't dump dying fib_info in fib_leaf_notify().
by JiangJieHua 21 Sep '26

21 Sep '26

From: Kuniyuki Iwashima <kuniyu(a)google.com> mainline inclusion from mainline-v7.2-rc1 commit 06b693d2eb6651a63ad85bad8673de3b7d4edd6d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17956 CVE: CVE-2026-74289 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzbot reported use-after-free in nsim_fib4_prepare_event(). [0] The problem is that the following functions call fib_info_hold() / refcount_inc() while dumping fib_info under RCU, which is unsafe. * mlxsw_sp_router_fib4_event() * rocker_router_fib_event() * nsim_fib4_prepare_event() refcount_inc_not_zero() must be used, but it would be too late there. Let's guarantee the lifetime of fib_info in fib_leaf_notify(). Note that IPv6 does not need the corresponding change since fib6_table_dump() holds fib6_table.tb6_lock. [0]: refcount_t: addition on 0; use-after-free. WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x9f/0x110 lib/refcount.c:25, CPU#0: kworker/u8:15/3420 Modules linked in: CPU: 0 UID: 0 PID: 3420 Comm: kworker/u8:15 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 Workqueue: netns cleanup_net RIP: 0010:refcount_warn_saturate+0x9f/0x110 lib/refcount.c:25 Code: eb 66 85 db 74 3e 83 fb 01 75 4c e8 1b f1 22 fd 48 8d 3d 84 cb f1 0a 67 48 0f b9 3a eb 4a e8 08 f1 22 fd 48 8d 3d 81 cb f1 0a <67> 48 0f b9 3a eb 37 e8 f5 f0 22 fd 48 8d 3d 7e cb f1 0a 67 48 0f RSP: 0018:ffffc9000f2c7270 EFLAGS: 00010293 RAX: ffffffff84a18858 RBX: 0000000000000002 RCX: ffff888032ff9ec0 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8f9353e0 RBP: 0000000000000000 R08: ffff888032ff9ec0 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880570cc000 R13: dffffc0000000000 R14: ffff88802b40563c R15: ffff8880570cc000 FS: 0000000000000000(0000) GS:ffff888126173000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fb1f4d5d000 CR3: 000000006072a000 CR4: 00000000003526f0 Call Trace: <TASK> __refcount_add include/linux/refcount.h:-1 [inline] __refcount_inc include/linux/refcount.h:366 [inline] refcount_inc include/linux/refcount.h:383 [inline] fib_info_hold include/net/ip_fib.h:629 [inline] nsim_fib4_prepare_event drivers/net/netdevsim/fib.c:930 [inline] nsim_fib_event_schedule_work drivers/net/netdevsim/fib.c:1000 [inline] nsim_fib_event_nb+0x1055/0x1240 drivers/net/netdevsim/fib.c:1043 call_fib_notifier+0x45/0x80 net/core/fib_notifier.c:25 call_fib_entry_notifier net/ipv4/fib_trie.c:90 [inline] fib_leaf_notify net/ipv4/fib_trie.c:2176 [inline] fib_table_notify net/ipv4/fib_trie.c:2194 [inline] fib_notify+0x36b/0x5e0 net/ipv4/fib_trie.c:2217 fib_net_dump net/core/fib_notifier.c:70 [inline] register_fib_notifier+0x184/0x360 net/core/fib_notifier.c:108 nsim_fib_create+0x85d/0x9f0 drivers/net/netdevsim/fib.c:1596 nsim_dev_reload_create drivers/net/netdevsim/dev.c:1604 [inline] nsim_dev_reload_up+0x374/0x7c0 drivers/net/netdevsim/dev.c:1058 devlink_reload+0x501/0x8d0 net/devlink/dev.c:475 devlink_pernet_pre_exit+0x1ff/0x420 net/devlink/core.c:558 ops_pre_exit_list net/core/net_namespace.c:161 [inline] ops_undo_list+0x187/0x940 net/core/net_namespace.c:234 cleanup_net+0x56e/0x800 net/core/net_namespace.c:702 process_one_work kernel/workqueue.c:3314 [inline] process_scheduled_works+0xb5d/0x1860 kernel/workqueue.c:3397 worker_thread+0xa53/0xfc0 kernel/workqueue.c:3478 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> Fixes: 0ae3eb7b4611 ("netdevsim: fib: Perform the route programming in a non-atomic context") Fixes: c3852ef7f2f8 ("ipv4: fib: Replay events when registering FIB notifier") Reported-by: syzbot+cb2aa2390ac024e25f5c(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/6a290011.39669fcc.33b062.00b1.GAE@google.com/ Signed-off-by: Kuniyuki Iwashima <kuniyu(a)google.com> Reviewed-by: Ido Schimmel <idosch(a)nvidia.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Link: https://patch.msgid.link/20260610061744.2030996-2-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv4/fib_trie.c [Context differences are due to the following patches not being merged: net: fib_notifier per-netns / error / extack rework: 7c550daffe22 ("net: fib_notifier: make FIB notifier per-netns") 55c894f762a1 ("net: fib_notifier: propagate possible error during fib notifier registration") b7a595577ef3 ("net: fib_notifier: propagate extack down to the notifier block callback") route replay dedup and ADD->REPLACE conversion: 20d1565203e6 ("ipv4: Only Replay routes of interest to new listeners") 446f739104f4 ("ipv4: Remove old route notifications and convert listeners")] Signed-off-by: JiangJieHua <jiangjiehua1(a)huawei.com> --- include/net/ip_fib.h | 5 +++++ net/ipv4/fib_trie.c | 4 ++++ 2 files changed, 9 insertions(+) diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h index 95eed32d8c6bb..1ba7d0c878145 100644 --- a/include/net/ip_fib.h +++ b/include/net/ip_fib.h @@ -431,6 +431,11 @@ static inline void fib_info_hold(struct fib_info *fi) refcount_inc(&fi->fib_clntref); } +static inline bool fib_info_hold_safe(struct fib_info *fi) +{ + return refcount_inc_not_zero(&fi->fib_clntref); +} + static inline void fib_info_put(struct fib_info *fi) { if (refcount_dec_and_test(&fi->fib_clntref)) diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c index 48d7125501b4e..592a8c7f69366 100644 --- a/net/ipv4/fib_trie.c +++ b/net/ipv4/fib_trie.c @@ -1959,8 +1959,12 @@ static void fib_leaf_notify(struct net *net, struct key_vector *l, if (tb->tb_id != fa->tb_id) continue; + if (!fib_info_hold_safe(fa->fa_info)) + continue; + call_fib_entry_notifier(nb, net, FIB_EVENT_ENTRY_ADD, l->key, KEYLENGTH - fa->fa_slen, fa); + fib_info_put(fa->fa_info); } } -- 2.33.8

2 1

[PATCH openEuler-1.0-LTS] tcp: ipv6: clamp default adverting MSS to avoid GSO_BY_FRAGS (0xFFFF)
by JiangJieHua 21 Sep '26

21 Sep '26

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v7.2-rc1 commit 2bf43d0e2e6a27d52a7d624e2d6b9116972e8a22 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18083 CVE: CVE-2026-72502 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When MTU is large, ip6_default_advmss() can return IPV6_MAXPLEN (65535). This is interpreted by TCP as mss_clamp, allowing the MSS to reach 65535. However, 0xFFFF is also used as a magic value GSO_BY_FRAGS in the kernel. If a TCP packet with gso_size=0xFFFF is passed to skb_segment(), it will be mistakenly treated as GSO_BY_FRAGS, leading to a NULL pointer dereference because local TCP packets do not use frag_list. Fix this by returning min(IPV6_MAXPLEN, GSO_BY_FRAGS - 1) (65534) from ip6_default_advmss() when MTU is large. Also update the stale comment in ip6_default_advmss() which suggested that IPV6_MAXPLEN is returned to mean "any MSS". Fixes: 3953c46c3ac7 ("sk_buff: allow segmenting based on frag sizes") Reported-by: syzbot+ebdb22d461c904fc3cb2(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/6a2c3193.8812e0fc.3c3fa4.0001.GAE@google.com… Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)google.com> Link: https://patch.msgid.link/20260612162517.83394-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: JiangJieHua <jiangjiehua1(a)huawei.com> --- net/ipv6/route.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/net/ipv6/route.c b/net/ipv6/route.c index 907a5e5078199..8873c4c85d6f4 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -2665,11 +2665,11 @@ static unsigned int ip6_default_advmss(const struct dst_entry *dst) /* * Maximal non-jumbo IPv6 payload is IPV6_MAXPLEN and * corresponding MSS is IPV6_MAXPLEN - tcp_header_size. - * IPV6_MAXPLEN is also valid and means: "any MSS, - * rely only on pmtu discovery" + * Limit the default MSS to GSO_BY_FRAGS - 1 to avoid + * collision with the GSO_BY_FRAGS magic value (0xFFFF). */ if (mtu > IPV6_MAXPLEN - sizeof(struct tcphdr)) - mtu = IPV6_MAXPLEN; + mtu = min_t(unsigned int, IPV6_MAXPLEN, GSO_BY_FRAGS - 1); return mtu; } -- 2.33.8

2 1

[PATCH openEuler-1.0-LTS] openvswitch: fix GSO userspace truncation underflow
by Yi Yang 21 Sep '26

21 Sep '26

From: Kyle Zeng <kylebot(a)openai.com> stable inclusion from stable-v5.10.265 commit 50a6a85f3d6b1d22d8436848606cdef5d2c490b4 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16932 CVE: CVE-2026-68123 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4032f8ed10fcb84d41c508dfb04be96589f78dfe ] OVS_ACTION_ATTR_TRUNC currently stores a delta from the original skb length in OVS_CB(skb)->cutlen. When a later userspace action segments a GSO skb, queue_gso_packets() reuses that delta for each smaller segment. A segment can then reach queue_userspace_packet() with cutlen greater than skb->len, underflowing the length passed to skb_zerocopy(). Store the maximum preserved length instead and bound each consumer against the current skb length. Use U32_MAX as the no-truncation sentinel so the value remains valid if skb geometry changes before a consumer handles it. Fixes: f2a4d086ed4c ("openvswitch: Add packet truncation support.") Cc: stable(a)vger.kernel.org Assisted-by: Codex:gpt-5.5 Signed-off-by: Kyle Zeng <kylebot(a)openai.com> Reviewed-by: Ilya Maximets <i.maximets(a)ovn.org> Reviewed-by: Aaron Conole <aconole(a)redhat.com> Link: https://patch.msgid.link/20260707221635.27489-1-kylebot@openai.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> [5.10.y supports neither OVS_ACTION_ATTR_PSAMPLE nor OVS drop reasons] Signed-off-by: Ilya Maximets <i.maximets(a)ovn.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: net/openvswitch/actions.c [The max function requires that the types be the same.] net/openvswitch/datapath.c [Context conflicts.] Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- net/openvswitch/actions.c | 16 ++++++---------- net/openvswitch/datapath.c | 25 ++++++++++++++----------- net/openvswitch/datapath.h | 2 +- net/openvswitch/vport.c | 2 +- 4 files changed, 22 insertions(+), 23 deletions(-) diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c index 7ac5f75e06a9..669578e423f9 100644 --- a/net/openvswitch/actions.c +++ b/net/openvswitch/actions.c @@ -949,12 +949,9 @@ static void do_output(struct datapath *dp, struct sk_buff *skb, int out_port, u16 mru = OVS_CB(skb)->mru; u32 cutlen = OVS_CB(skb)->cutlen; - if (unlikely(cutlen > 0)) { - if (skb->len - cutlen > ovs_mac_header_len(key)) - pskb_trim(skb, skb->len - cutlen); - else - pskb_trim(skb, ovs_mac_header_len(key)); - } + if (unlikely(cutlen < skb->len)) + pskb_trim(skb, max_t(u32, cutlen, + ovs_mac_header_len(key))); if (likely(!mru || (skb->len <= mru + vport->dev->hard_header_len))) { @@ -1237,22 +1234,21 @@ static int do_execute_actions(struct datapath *dp, struct sk_buff *skb, clone = skb_clone(skb, GFP_ATOMIC); if (clone) do_output(dp, clone, port, key); - OVS_CB(skb)->cutlen = 0; + OVS_CB(skb)->cutlen = U32_MAX; break; } case OVS_ACTION_ATTR_TRUNC: { struct ovs_action_trunc *trunc = nla_data(a); - if (skb->len > trunc->max_len) - OVS_CB(skb)->cutlen = skb->len - trunc->max_len; + OVS_CB(skb)->cutlen = trunc->max_len; break; } case OVS_ACTION_ATTR_USERSPACE: output_userspace(dp, skb, key, a, attr, len, OVS_CB(skb)->cutlen); - OVS_CB(skb)->cutlen = 0; + OVS_CB(skb)->cutlen = U32_MAX; break; case OVS_ACTION_ATTR_HASH: diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c index bd00e63603ca..1aeeb18c8812 100644 --- a/net/openvswitch/datapath.c +++ b/net/openvswitch/datapath.c @@ -248,7 +248,7 @@ void ovs_dp_process_packet(struct sk_buff *skb, struct sw_flow_key *key) upcall.cmd = OVS_PACKET_CMD_MISS; upcall.portid = ovs_vport_find_upcall_portid(p, skb); upcall.mru = OVS_CB(skb)->mru; - error = ovs_dp_upcall(dp, skb, key, &upcall, 0); + error = ovs_dp_upcall(dp, skb, key, &upcall, U32_MAX); if (unlikely(error)) kfree_skb(skb); else @@ -399,7 +399,8 @@ static int queue_userspace_packet(struct datapath *dp, struct sk_buff *skb, struct sk_buff *nskb = NULL; struct sk_buff *user_skb = NULL; /* to be queued to userspace */ struct nlattr *nla; - size_t len; + size_t msg_size; + size_t skb_len; unsigned int hlen; int err, dp_ifindex; @@ -419,7 +420,8 @@ static int queue_userspace_packet(struct datapath *dp, struct sk_buff *skb, skb = nskb; } - if (nla_attr_size(skb->len) > USHRT_MAX) { + skb_len = min(skb->len, cutlen); + if (nla_attr_size(skb_len) > USHRT_MAX) { err = -EFBIG; goto out; } @@ -434,13 +436,13 @@ static int queue_userspace_packet(struct datapath *dp, struct sk_buff *skb, * padding logic. Only perform zerocopy if padding is not required. */ if (dp->user_features & OVS_DP_F_UNALIGNED) - hlen = skb_zerocopy_headlen(skb); + hlen = min(skb_zerocopy_headlen(skb), cutlen); else - hlen = skb->len; + hlen = skb_len; - len = upcall_msg_size(upcall_info, hlen - cutlen, - OVS_CB(skb)->acts_origlen); - user_skb = genlmsg_new(len, GFP_ATOMIC); + msg_size = upcall_msg_size(upcall_info, hlen, + OVS_CB(skb)->acts_origlen); + user_skb = genlmsg_new(msg_size, GFP_ATOMIC); if (!user_skb) { err = -ENOMEM; goto out; @@ -503,7 +505,7 @@ static int queue_userspace_packet(struct datapath *dp, struct sk_buff *skb, } /* Add OVS_PACKET_ATTR_LEN when packet is truncated */ - if (cutlen > 0) { + if (skb_len < skb->len) { if (nla_put_u32(user_skb, OVS_PACKET_ATTR_LEN, skb->len)) { err = -ENOBUFS; @@ -518,9 +520,9 @@ static int queue_userspace_packet(struct datapath *dp, struct sk_buff *skb, err = -ENOBUFS; goto out; } - nla->nla_len = nla_attr_size(skb->len - cutlen); + nla->nla_len = nla_attr_size(skb_len); - err = skb_zerocopy(user_skb, skb, skb->len - cutlen, hlen); + err = skb_zerocopy(user_skb, skb, skb_len, hlen); if (err) goto out; @@ -575,6 +577,7 @@ static int ovs_packet_cmd_execute(struct sk_buff *skb, struct genl_info *info) packet->ignore_df = 1; } OVS_CB(packet)->mru = mru; + OVS_CB(packet)->cutlen = U32_MAX; /* Build an sw_flow for sending this packet. */ flow = ovs_flow_alloc(); diff --git a/net/openvswitch/datapath.h b/net/openvswitch/datapath.h index c9eb267c6f7e..9192c9970cc3 100644 --- a/net/openvswitch/datapath.h +++ b/net/openvswitch/datapath.h @@ -105,7 +105,7 @@ struct datapath { * @mru: The maximum received fragement size; 0 if the packet is not * fragmented. * @acts_origlen: The netlink size of the flow actions applied to this skb. - * @cutlen: The number of bytes from the packet end to be removed. + * @cutlen: The number of bytes in the packet to preserve on output. */ struct ovs_skb_cb { struct vport *input_vport; diff --git a/net/openvswitch/vport.c b/net/openvswitch/vport.c index 5541f4c9a0a1..586428d2015d 100644 --- a/net/openvswitch/vport.c +++ b/net/openvswitch/vport.c @@ -447,7 +447,7 @@ int ovs_vport_receive(struct vport *vport, struct sk_buff *skb, OVS_CB(skb)->input_vport = vport; OVS_CB(skb)->mru = 0; - OVS_CB(skb)->cutlen = 0; + OVS_CB(skb)->cutlen = U32_MAX; if (unlikely(dev_net(skb->dev) != ovs_dp_get_net(vport->dp))) { u32 mark; -- 2.25.1

2 1

[PATCH v2 OLK-5.10 0/3] CVE-2026-89636
by Yifan Qiao 21 Sep '26

21 Sep '26

Fredric Cover (3): smb: client: harden DFS cache against invalid target hints smb: client: clear ce->tgthint in free_tgts() smb: client: fill cache fields after populating cache in copy_ref_data() fs/cifs/dfs_cache.c | 61 ++++++++++++++++++++++++++++++++------------- 1 file changed, 44 insertions(+), 17 deletions(-) -- 2.52.0

2 4

[PATCH openEuler-1.0-LTS V1] IB/isert: reject login PDUs declaring more data than was received
by Yao Yiqi 21 Sep '26

21 Sep '26

From: Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> stable inclusion from stable-v5.10.270 commit b1f3313e7b3e396e4985fea5c709477387e0a065 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19431 CVE: CVE-2026-90413 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------ [ Upstream commit 2488b5b4827e5415768afc8daf097e8eb83c98df ] isert_login_recv_done() records how many bytes the HCA actually placed in the login buffer, but nothing compares that against the length the login PDU's BHS declares. isert_rx_login_req() copies min(login_req_len, MAX_KEY_VALUE_PAIRS) bytes into login->req_buf, and the login code then reads the declared length back out of that buffer - for the first PDU in iscsi_target_locate_portal(), payload_length = ntoh24(login_req->dlength); tmpbuf = kmemdup_nul(login->req_buf, payload_length, GFP_KERNEL); and for the ones after it in iscsi_decode_text_input(), reached from iscsi_target_do_login(). login->req_buf is a fixed MAX_KEY_VALUE_PAIRS (8192) byte allocation, so an initiator that declares more than it sends reads off the end of it, before authentication and with the length under its control: BUG: KASAN: slab-out-of-bounds in kmemdup_nul+0x43/0x80 Read of size 8193 at addr ffff8881056a8000 by task iscsi_np/167 __asan_memcpy+0x23/0x60 kmemdup_nul+0x43/0x80 iscsi_target_locate_portal+0x48d/0x1180 iscsi_target_login_thread+0x19a9/0x3350 Allocated by task 167: __kmalloc_cache_noprof+0x158/0x370 iscsi_target_login_thread+0x971/0x3350 which belongs to the cache kmalloc-8k of size 8192 allocated 8192-byte region Falsifying the second login PDU instead reaches the other reader, on the same buffer: BUG: KASAN: slab-out-of-bounds in kmemdup_nul+0x43/0x80 Read of size 8193 at addr ffff888104d10000 by task kworker/1:1/50 Workqueue: isert_login_wq iscsi_target_do_login_rx __asan_memcpy+0x23/0x60 kmemdup_nul+0x43/0x80 iscsi_decode_text_input+0xc6/0x11c0 iscsi_target_do_login+0x261/0x1470 iscsi_target_do_login_rx+0x51d/0x7d0 iscsit over TCP is not exposed: iscsit_get_login_rx() validates the declared length with iscsi_target_check_login_request() and then reads exactly that many bytes off the socket, so the declared length governs how much arrives rather than how much is copied out of an already-filled buffer. isert does not call iscsi_target_check_login_request() at all. Reject a login PDU whose declared DataSegmentLength exceeds what was received, in both paths that reach isert_rx_login_req(): isert_get_login_rx() for the first login PDU and isert_login_recv_done() for the ones after it. dlength <= login_req_len is allowed because the received count can include up to three bytes of iSCSI padding. Once the check is in place the copy out can no longer exceed the copy in: the posted login SGE is ISER_RX_PAYLOAD_SIZE, so login_req_len cannot exceed MAX_KEY_VALUE_PAIRS and the min() in isert_rx_login_req() is login_req_len. Like the existing short-PDU check added by 29e7b925ae6d, the reject in isert_login_recv_done() returns without completing login_req_comp, so a malformed subsequent PDU leaves the login to be torn down by the login timer rather than failing immediately. The first-PDU path returns an error and fails straight away. Reproduced on 7.2.0-rc4 with soft-RoCE (rdma_rxe) under KASAN, using an initiator that sends the real key=value payload while declaring 8193 in the BHS, on the first login PDU and on the second in separate runs. The reported read size tracks the declared value exactly; 16384 and 61440 behave the same. Unpatched 3 of 3 runs report on each of the two paths, patched 0 of 3 on both, run alternately in a single session, and a normal login still completes on the patched build. Fixes: b8d26b3be8b3 ("iser-target: Add iSCSI Extensions for RDMA (iSER) target driver") Suggested-by: Leon Romanovsky <leonro(a)nvidia.com> Signed-off-by: Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> Link: https://patch.msgid.link/20260726163931.971063-3-yhlee@isslab.korea.ac.kr Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/infiniband/ulp/isert/ib_isert.c [ 4.19 does not have isert_get_iscsi_hdr helper funciton ] Signed-off-by: Yao Yiqi <yaoyiqi3(a)huawei.com> --- drivers/infiniband/ulp/isert/ib_isert.c | 25 ++++++++++++++++++++++++- 1 file changed, 24 insertions(+), 1 deletion(-) diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c index 97119e8e0751..fbe073ebfbcc 100644 --- a/drivers/infiniband/ulp/isert/ib_isert.c +++ b/drivers/infiniband/ulp/isert/ib_isert.c @@ -1056,6 +1056,21 @@ isert_put_login_tx(struct iscsi_conn *conn, struct iscsi_login *login, return 0; } +static int +isert_check_login_req(struct isert_conn *isert_conn) +{ + struct iscsi_hdr *hdr = &isert_conn->login_req_buf->iscsi_header; + u32 dlength = ntoh24(hdr->dlength); + + if (unlikely(dlength > (u32)isert_conn->login_req_len)) { + isert_dbg("login PDU declares %u data bytes but only %d were received\n", + dlength, isert_conn->login_req_len); + return -EINVAL; + } + + return 0; +} + static void isert_rx_login_req(struct isert_conn *isert_conn) { @@ -1484,8 +1499,12 @@ isert_login_recv_done(struct ib_cq *cq, struct ib_wc *wc) if (isert_conn->conn) { struct iscsi_login *login = isert_conn->conn->conn_login; - if (login && !login->first_request) + if (login && !login->first_request) { + if (isert_check_login_req(isert_conn)) + return; + isert_rx_login_req(isert_conn); + } } mutex_lock(&isert_conn->mutex); @@ -2445,6 +2464,10 @@ isert_get_login_rx(struct iscsi_conn *conn, struct iscsi_login *login) if (!login->first_request) return 0; + ret = isert_check_login_req(isert_conn); + if (ret) + return ret; + isert_rx_login_req(isert_conn); isert_info("before login_comp conn: %p\n", conn); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] selinux: check connect-related permissions on TCP Fast Open
by Yi Yang 21 Sep '26

21 Sep '26

From: Stephen Smalley <stephen.smalley.work(a)gmail.com> mainline inclusion from mainline-v7.2-rc3 commit 44c74d27d1b9aaa99fa8a83640c1223575262b80 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17775 CVE: CVE-2026-72243 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Similar to Landlock, SELinux was not updated when TCP Fast Open support was introduced to ensure connect-related permissions are checked when using TCP Fast Open. Update its socket_sendmsg() hook to call selinux_socket_connect() when MSG_FASTOPEN is passed. Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/linux-security-module/20260616201615.275032-1-hexla… Link: https://lore.kernel.org/linux-security-module/20260617180526.15627-2-matthi… Reported-by: Bryam Vargas <hexlabsecurity(a)proton.me> Reported-by: Matthieu Buffet <matthieu(a)buffet.re> Reported-by: Mikhail Ivanov <ivanov.mikhail1(a)huawei-partners.com> Signed-off-by: Stephen Smalley <stephen.smalley.work(a)gmail.com> Tested-by: Bryam Vargas <hexlabsecurity(a)proton.me> Signed-off-by: Paul Moore <paul(a)paul-moore.com> Conflicts: security/selinux/hooks.c [The sk_is_tcp function was not introduced.] Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- security/selinux/hooks.c | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 3550ded07457..f85147d8704d 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -4910,7 +4910,25 @@ static int selinux_socket_accept(struct socket *sock, struct socket *newsock) static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg, int size) { - return sock_has_perm(sock->sk, SOCKET__WRITE); + int rc; + struct sockaddr *const addr = msg->msg_name; + const int addrlen = msg->msg_namelen; + + rc = sock_has_perm(sock->sk, SOCKET__WRITE); + if (rc) + return rc; + + if (addr && (msg->msg_flags & MSG_FASTOPEN) && + (sock->sk->sk_family == AF_INET || + sock->sk->sk_family == AF_INET6) && + sock->sk->sk_type == SOCK_STREAM && + sock->sk->sk_protocol == IPPROTO_TCP) { + rc = selinux_socket_connect(sock, addr, addrlen); + if (rc) + return rc; + } + + return 0; } static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg, -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS V1] IB/isert: reject login PDUs declaring more data than was received
by Yao Yiqi 21 Sep '26

21 Sep '26

From: Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> stable inclusion from stable-v5.10.270 commit b1f3313e7b3e396e4985fea5c709477387e0a065 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19431 CVE: CVE-2026-90413 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------ [ Upstream commit 2488b5b4827e5415768afc8daf097e8eb83c98df ] isert_login_recv_done() records how many bytes the HCA actually placed in the login buffer, but nothing compares that against the length the login PDU's BHS declares. isert_rx_login_req() copies min(login_req_len, MAX_KEY_VALUE_PAIRS) bytes into login->req_buf, and the login code then reads the declared length back out of that buffer - for the first PDU in iscsi_target_locate_portal(), payload_length = ntoh24(login_req->dlength); tmpbuf = kmemdup_nul(login->req_buf, payload_length, GFP_KERNEL); and for the ones after it in iscsi_decode_text_input(), reached from iscsi_target_do_login(). login->req_buf is a fixed MAX_KEY_VALUE_PAIRS (8192) byte allocation, so an initiator that declares more than it sends reads off the end of it, before authentication and with the length under its control: BUG: KASAN: slab-out-of-bounds in kmemdup_nul+0x43/0x80 Read of size 8193 at addr ffff8881056a8000 by task iscsi_np/167 __asan_memcpy+0x23/0x60 kmemdup_nul+0x43/0x80 iscsi_target_locate_portal+0x48d/0x1180 iscsi_target_login_thread+0x19a9/0x3350 Allocated by task 167: __kmalloc_cache_noprof+0x158/0x370 iscsi_target_login_thread+0x971/0x3350 which belongs to the cache kmalloc-8k of size 8192 allocated 8192-byte region Falsifying the second login PDU instead reaches the other reader, on the same buffer: BUG: KASAN: slab-out-of-bounds in kmemdup_nul+0x43/0x80 Read of size 8193 at addr ffff888104d10000 by task kworker/1:1/50 Workqueue: isert_login_wq iscsi_target_do_login_rx __asan_memcpy+0x23/0x60 kmemdup_nul+0x43/0x80 iscsi_decode_text_input+0xc6/0x11c0 iscsi_target_do_login+0x261/0x1470 iscsi_target_do_login_rx+0x51d/0x7d0 iscsit over TCP is not exposed: iscsit_get_login_rx() validates the declared length with iscsi_target_check_login_request() and then reads exactly that many bytes off the socket, so the declared length governs how much arrives rather than how much is copied out of an already-filled buffer. isert does not call iscsi_target_check_login_request() at all. Reject a login PDU whose declared DataSegmentLength exceeds what was received, in both paths that reach isert_rx_login_req(): isert_get_login_rx() for the first login PDU and isert_login_recv_done() for the ones after it. dlength <= login_req_len is allowed because the received count can include up to three bytes of iSCSI padding. Once the check is in place the copy out can no longer exceed the copy in: the posted login SGE is ISER_RX_PAYLOAD_SIZE, so login_req_len cannot exceed MAX_KEY_VALUE_PAIRS and the min() in isert_rx_login_req() is login_req_len. Like the existing short-PDU check added by 29e7b925ae6d, the reject in isert_login_recv_done() returns without completing login_req_comp, so a malformed subsequent PDU leaves the login to be torn down by the login timer rather than failing immediately. The first-PDU path returns an error and fails straight away. Reproduced on 7.2.0-rc4 with soft-RoCE (rdma_rxe) under KASAN, using an initiator that sends the real key=value payload while declaring 8193 in the BHS, on the first login PDU and on the second in separate runs. The reported read size tracks the declared value exactly; 16384 and 61440 behave the same. Unpatched 3 of 3 runs report on each of the two paths, patched 0 of 3 on both, run alternately in a single session, and a normal login still completes on the patched build. Fixes: b8d26b3be8b3 ("iser-target: Add iSCSI Extensions for RDMA (iSER) target driver") Suggested-by: Leon Romanovsky <leonro(a)nvidia.com> Signed-off-by: Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> Link: https://patch.msgid.link/20260726163931.971063-3-yhlee@isslab.korea.ac.kr Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yao Yiqi <yaoyiqi3(a)huawei.com> --- drivers/infiniband/ulp/isert/ib_isert.c | 25 ++++++++++++++++++++++++- 1 file changed, 24 insertions(+), 1 deletion(-) diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c index 97119e8e0751..4d0da69103cf 100644 --- a/drivers/infiniband/ulp/isert/ib_isert.c +++ b/drivers/infiniband/ulp/isert/ib_isert.c @@ -1056,6 +1056,21 @@ isert_put_login_tx(struct iscsi_conn *conn, struct iscsi_login *login, return 0; } +static int +isert_check_login_req(struct isert_conn *isert_conn) +{ + struct iscsi_hdr *hdr = isert_get_iscsi_hdr(isert_conn->login_desc); + u32 dlength = ntoh24(hdr->dlength); + + if (unlikely(dlength > (u32)isert_conn->login_req_len)) { + isert_dbg("login PDU declares %u data bytes but only %d were received\n", + dlength, isert_conn->login_req_len); + return -EINVAL; + } + + return 0; +} + static void isert_rx_login_req(struct isert_conn *isert_conn) { @@ -1484,8 +1499,12 @@ isert_login_recv_done(struct ib_cq *cq, struct ib_wc *wc) if (isert_conn->conn) { struct iscsi_login *login = isert_conn->conn->conn_login; - if (login && !login->first_request) + if (login && !login->first_request) { + if (isert_check_login_req(isert_conn)) + return; + isert_rx_login_req(isert_conn); + } } mutex_lock(&isert_conn->mutex); @@ -2445,6 +2464,10 @@ isert_get_login_rx(struct iscsi_conn *conn, struct iscsi_login *login) if (!login->first_request) return 0; + ret = isert_check_login_req(isert_conn); + if (ret) + return ret; + isert_rx_login_req(isert_conn); isert_info("before login_comp conn: %p\n", conn); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS V1] IB/isert: reject PDUs declaring more data than was received
by Yao Yiqi 21 Sep '26

21 Sep '26

From: Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> stable inclusion from stable-v5.10.270 commit b4706722ed3ea72882b3c986a19b4a1ba66384c4 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19430 CVE: CVE-2026-90414 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------ [ Upstream commit 957f92ea4022fb6af4618271615a2a21a7b5bef9 ] isert_recv_done() hands each received PDU to the opcode handlers without ever looking at wc->byte_len, the number of bytes the HCA actually placed in the receive descriptor. The handlers then copy that many bytes - the data-segment length the initiator declared in the BHS (ntoh24(hdr->dlength), via the derived unsol_data_len / imm_data_len) - out of the fixed-size descriptor: isert_handle_iscsi_dataout(): sg_copy_from_buffer(sg_start, sg_nents, isert_get_data(rx_desc), unsol_data_len); isert_handle_scsi_cmd(): sg_copy_from_buffer(cmd->se_cmd.t_data_sg, sg_nents, isert_get_data(rx_desc), imm_data_len); Because the declared length is never checked against wc->byte_len, an initiator can declare a data segment larger than the bytes it actually sent (and larger than the descriptor) and cause an out-of-bounds read of the receive buffer. Nothing upstream of isert closes this door: - __iscsit_check_dataout_hdr() bounds the inbound payload against conn_ops->MaxXmitDataSegmentLength (MXDSL) - a transmit parameter, used here for the inbound check. - iscsi_set_connection_parameters() sets ops->MaxXmitDataSegmentLength = ops->TargetRecvDataSegmentLength; and TARGETRECVDATASEGMENTLENGTH is absent from the min()-clamp list in iscsi_check_acceptor_state(), so the value the initiator declares is adopted verbatim (type range 512..16777215). The initiator effectively raises its own ceiling. - isert never clamps the negotiated value to its own fixed receive descriptor (ISER_RX_SIZE, 9216 bytes), so the target core's bound and the descriptor size are unrelated. The imm_data_len == data_len path is more than an over-read: it aliases the receive descriptor via sg_set_buf() and passes it to the backend as the data source for the SCSI WRITE, so an over-declared length causes heap contents past the descriptor to be written through the backend to the backing store. The backend is the victim of the oversized scatterlist isert hands it, not the cause; no read-back of the written bytes was demonstrated. Trigger: after login completes (full feature phase), an initiator that has declared a large TargetRecvDataSegmentLength and a FirstBurstLength that permits unsolicited/immediate data sends a PDU whose declared data-segment length exceeds what was received. With KASAN: BUG: KASAN: slab-out-of-bounds in sg_copy_buffer+0x150/0x1c0 Read of size 4096 at addr ffff888109720800 by task kworker/1:0H/25 Workqueue: ib-comp-wq ib_cq_poll_work Call Trace: sg_copy_buffer+0x150/0x1c0 isert_recv_done+0xba6/0x2390 __ib_process_cq+0xe1/0x390 ib_cq_poll_work+0x46/0x150 isert_recv_done+0xba6 resolves to isert_handle_iscsi_dataout() (ib_isert.c:1160), inlined through isert_rx_opcode(). Validate wc->byte_len against the framing in isert_recv_done() before the PDU reaches any handler, and reinstate the connection if it is short. Because the test compares without subtracting the header length, it also rejects PDUs shorter than the iSER and iSCSI headers, which would otherwise be parsed out of stale descriptor contents. The login handler rejects PDUs shorter than ISER_HEADERS_LEN (commit 29e7b925ae6d ("IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN")) but does not bound the declared length either; that is fixed in the next patch. The data handlers had no length check at all. isert reads the data segment from a fixed offset: isert_get_data() returns the iSER header plus ISER_HEADERS_LEN and makes no adjustment for an AHS. The bytes the handlers touch are therefore exactly [ISER_HEADERS_LEN, ISER_HEADERS_LEN + dlength), and comparing that sum against wc->byte_len bounds precisely the region that is read. An AHS term would only make the test stricter without bounding anything further, and cannot cause a false reject: a PDU carrying an AHS is longer, not shorter. This is a memory-safety fix that verifies the bytes that were actually received; it does not touch RFC 7145 length negotiation and is not the MaxXmitDataSegmentLength negotiation redesign raised in the 2017 "[Query] iSER-Target: QP errors observed on increasing MaxXmitDataSegmentLength" discussion. That redesign is explicitly out of scope here. The patched kernel rejects the malformed DataOut PDU and both immediate-data variants with "PDU declares ... bytes were received" and continues to pass normal traffic with no regression. Reproduced with soft-RoCE (rdma_rxe) and a raw rdma_cm/ibv initiator; no kernel-side test hooks were needed. Fixes: b8d26b3be8b3 ("iser-target: Add iSCSI Extensions for RDMA (iSER) target driver") Signed-off-by: Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> Link: https://patch.msgid.link/20260726163931.971063-2-yhlee@isslab.korea.ac.kr Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/infiniband/ulp/isert/ib_isert.c [ Context conflicts ] Signed-off-by: Yao Yiqi <yaoyiqi3(a)huawei.com> --- drivers/infiniband/ulp/isert/ib_isert.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c index 97119e8e0751..d950cfd1be53 100644 --- a/drivers/infiniband/ulp/isert/ib_isert.c +++ b/drivers/infiniband/ulp/isert/ib_isert.c @@ -1423,6 +1423,21 @@ isert_recv_done(struct ib_cq *cq, struct ib_wc *wc) ib_dma_sync_single_for_cpu(ib_dev, rx_desc->dma_addr, ISER_RX_PAYLOAD_SIZE, DMA_FROM_DEVICE); + /* + * The data segment length declared in the BHS is attacker controlled + * and is used further down to read that many bytes out of the fixed + * size receive descriptor, so it has to be checked against the number + * of bytes that were actually received. Comparing without subtracting + * also rejects PDUs shorter than the iSER and iSCSI headers, which + * would otherwise be parsed out of stale descriptor contents. + */ + if (unlikely(wc->byte_len < ISER_HEADERS_LEN + ntoh24(hdr->dlength))) { + isert_err("PDU declares %u data bytes but only %u bytes were received\n", + ntoh24(hdr->dlength), wc->byte_len); + iscsit_cause_connection_reinstatement(isert_conn->conn, 0); + return; + } + isert_dbg("DMA: 0x%llx, iSCSI opcode: 0x%02x, ITT: 0x%08x, flags: 0x%02x dlen: %d\n", rx_desc->dma_addr, hdr->opcode, hdr->itt, hdr->flags, (int)(wc->byte_len - ISER_HEADERS_LEN)); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] openvswitch: fix GSO userspace truncation underflow
by Yi Yang 21 Sep '26

21 Sep '26

From: Kyle Zeng <kylebot(a)openai.com> stable inclusion from stable-v5.10.265 commit 50a6a85f3d6b1d22d8436848606cdef5d2c490b4 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16932 CVE: CVE-2026-68123 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4032f8ed10fcb84d41c508dfb04be96589f78dfe ] OVS_ACTION_ATTR_TRUNC currently stores a delta from the original skb length in OVS_CB(skb)->cutlen. When a later userspace action segments a GSO skb, queue_gso_packets() reuses that delta for each smaller segment. A segment can then reach queue_userspace_packet() with cutlen greater than skb->len, underflowing the length passed to skb_zerocopy(). Store the maximum preserved length instead and bound each consumer against the current skb length. Use U32_MAX as the no-truncation sentinel so the value remains valid if skb geometry changes before a consumer handles it. Fixes: f2a4d086ed4c ("openvswitch: Add packet truncation support.") Cc: stable(a)vger.kernel.org Assisted-by: Codex:gpt-5.5 Signed-off-by: Kyle Zeng <kylebot(a)openai.com> Reviewed-by: Ilya Maximets <i.maximets(a)ovn.org> Reviewed-by: Aaron Conole <aconole(a)redhat.com> Link: https://patch.msgid.link/20260707221635.27489-1-kylebot@openai.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> [5.10.y supports neither OVS_ACTION_ATTR_PSAMPLE nor OVS drop reasons] Signed-off-by: Ilya Maximets <i.maximets(a)ovn.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: net/openvswitch/datapath.c [Context conflicts.] Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- net/openvswitch/actions.c | 15 +++++---------- net/openvswitch/datapath.c | 25 ++++++++++++++----------- net/openvswitch/datapath.h | 2 +- net/openvswitch/vport.c | 2 +- 4 files changed, 21 insertions(+), 23 deletions(-) diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c index 7ac5f75e06a9..f3b3fd459600 100644 --- a/net/openvswitch/actions.c +++ b/net/openvswitch/actions.c @@ -949,12 +949,8 @@ static void do_output(struct datapath *dp, struct sk_buff *skb, int out_port, u16 mru = OVS_CB(skb)->mru; u32 cutlen = OVS_CB(skb)->cutlen; - if (unlikely(cutlen > 0)) { - if (skb->len - cutlen > ovs_mac_header_len(key)) - pskb_trim(skb, skb->len - cutlen); - else - pskb_trim(skb, ovs_mac_header_len(key)); - } + if (unlikely(cutlen < skb->len)) + pskb_trim(skb, max(cutlen, ovs_mac_header_len(key))); if (likely(!mru || (skb->len <= mru + vport->dev->hard_header_len))) { @@ -1237,22 +1233,21 @@ static int do_execute_actions(struct datapath *dp, struct sk_buff *skb, clone = skb_clone(skb, GFP_ATOMIC); if (clone) do_output(dp, clone, port, key); - OVS_CB(skb)->cutlen = 0; + OVS_CB(skb)->cutlen = U32_MAX; break; } case OVS_ACTION_ATTR_TRUNC: { struct ovs_action_trunc *trunc = nla_data(a); - if (skb->len > trunc->max_len) - OVS_CB(skb)->cutlen = skb->len - trunc->max_len; + OVS_CB(skb)->cutlen = trunc->max_len; break; } case OVS_ACTION_ATTR_USERSPACE: output_userspace(dp, skb, key, a, attr, len, OVS_CB(skb)->cutlen); - OVS_CB(skb)->cutlen = 0; + OVS_CB(skb)->cutlen = U32_MAX; break; case OVS_ACTION_ATTR_HASH: diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c index bd00e63603ca..1aeeb18c8812 100644 --- a/net/openvswitch/datapath.c +++ b/net/openvswitch/datapath.c @@ -248,7 +248,7 @@ void ovs_dp_process_packet(struct sk_buff *skb, struct sw_flow_key *key) upcall.cmd = OVS_PACKET_CMD_MISS; upcall.portid = ovs_vport_find_upcall_portid(p, skb); upcall.mru = OVS_CB(skb)->mru; - error = ovs_dp_upcall(dp, skb, key, &upcall, 0); + error = ovs_dp_upcall(dp, skb, key, &upcall, U32_MAX); if (unlikely(error)) kfree_skb(skb); else @@ -399,7 +399,8 @@ static int queue_userspace_packet(struct datapath *dp, struct sk_buff *skb, struct sk_buff *nskb = NULL; struct sk_buff *user_skb = NULL; /* to be queued to userspace */ struct nlattr *nla; - size_t len; + size_t msg_size; + size_t skb_len; unsigned int hlen; int err, dp_ifindex; @@ -419,7 +420,8 @@ static int queue_userspace_packet(struct datapath *dp, struct sk_buff *skb, skb = nskb; } - if (nla_attr_size(skb->len) > USHRT_MAX) { + skb_len = min(skb->len, cutlen); + if (nla_attr_size(skb_len) > USHRT_MAX) { err = -EFBIG; goto out; } @@ -434,13 +436,13 @@ static int queue_userspace_packet(struct datapath *dp, struct sk_buff *skb, * padding logic. Only perform zerocopy if padding is not required. */ if (dp->user_features & OVS_DP_F_UNALIGNED) - hlen = skb_zerocopy_headlen(skb); + hlen = min(skb_zerocopy_headlen(skb), cutlen); else - hlen = skb->len; + hlen = skb_len; - len = upcall_msg_size(upcall_info, hlen - cutlen, - OVS_CB(skb)->acts_origlen); - user_skb = genlmsg_new(len, GFP_ATOMIC); + msg_size = upcall_msg_size(upcall_info, hlen, + OVS_CB(skb)->acts_origlen); + user_skb = genlmsg_new(msg_size, GFP_ATOMIC); if (!user_skb) { err = -ENOMEM; goto out; @@ -503,7 +505,7 @@ static int queue_userspace_packet(struct datapath *dp, struct sk_buff *skb, } /* Add OVS_PACKET_ATTR_LEN when packet is truncated */ - if (cutlen > 0) { + if (skb_len < skb->len) { if (nla_put_u32(user_skb, OVS_PACKET_ATTR_LEN, skb->len)) { err = -ENOBUFS; @@ -518,9 +520,9 @@ static int queue_userspace_packet(struct datapath *dp, struct sk_buff *skb, err = -ENOBUFS; goto out; } - nla->nla_len = nla_attr_size(skb->len - cutlen); + nla->nla_len = nla_attr_size(skb_len); - err = skb_zerocopy(user_skb, skb, skb->len - cutlen, hlen); + err = skb_zerocopy(user_skb, skb, skb_len, hlen); if (err) goto out; @@ -575,6 +577,7 @@ static int ovs_packet_cmd_execute(struct sk_buff *skb, struct genl_info *info) packet->ignore_df = 1; } OVS_CB(packet)->mru = mru; + OVS_CB(packet)->cutlen = U32_MAX; /* Build an sw_flow for sending this packet. */ flow = ovs_flow_alloc(); diff --git a/net/openvswitch/datapath.h b/net/openvswitch/datapath.h index c9eb267c6f7e..9192c9970cc3 100644 --- a/net/openvswitch/datapath.h +++ b/net/openvswitch/datapath.h @@ -105,7 +105,7 @@ struct datapath { * @mru: The maximum received fragement size; 0 if the packet is not * fragmented. * @acts_origlen: The netlink size of the flow actions applied to this skb. - * @cutlen: The number of bytes from the packet end to be removed. + * @cutlen: The number of bytes in the packet to preserve on output. */ struct ovs_skb_cb { struct vport *input_vport; diff --git a/net/openvswitch/vport.c b/net/openvswitch/vport.c index 5541f4c9a0a1..586428d2015d 100644 --- a/net/openvswitch/vport.c +++ b/net/openvswitch/vport.c @@ -447,7 +447,7 @@ int ovs_vport_receive(struct vport *vport, struct sk_buff *skb, OVS_CB(skb)->input_vport = vport; OVS_CB(skb)->mru = 0; - OVS_CB(skb)->cutlen = 0; + OVS_CB(skb)->cutlen = U32_MAX; if (unlikely(dev_net(skb->dev) != ovs_dp_get_net(vport->dp))) { u32 mark; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] pppoe: reload header pointer after dev_hard_header()
by Yi Yang 21 Sep '26

21 Sep '26

From: Asim Viladi Oglu Manizada <manizada(a)pm.me> mainline inclusion from mainline-v7.2-rc5 commit e9c238f6fe42fb1b4dba3a578277de32cb487937 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16930 CVE: CVE-2026-68121 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- pppoe_sendmsg() saves a pointer to the PPPoE header before calling dev_hard_header(). Device header callbacks are allowed to reallocate the skb head, invalidating pointers into it. This can happen when a send is blocked in copy_from_user() while the first non-Ethernet port is added to an empty team device. The team's delegated GRE header callback then expands the skb head. PPPoE subsequently writes six bytes through the stale pointer into the freed head. Reload the PPPoE header through the skb's network-header offset after device header creation. pskb_expand_head() updates that offset when it relocates the head. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable(a)vger.kernel.org Signed-off-by: Asim Viladi Oglu Manizada <manizada(a)pm.me> Reviewed-by: Vadim Fedorenko <vadim.fedorenko(a)linux.dev> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20260722093814.3017176-1-manizada@pm.me Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/net/ppp/pppoe.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c index c04f3dc17d76..86fc5f7551ff 100644 --- a/drivers/net/ppp/pppoe.c +++ b/drivers/net/ppp/pppoe.c @@ -897,6 +897,7 @@ static int pppoe_sendmsg(struct socket *sock, struct msghdr *m, dev_hard_header(skb, dev, ETH_P_PPP_SES, po->pppoe_pa.remote, NULL, total_len); + ph = pppoe_hdr(skb); memcpy(ph, &hdr, sizeof(struct pppoe_hdr)); ph->length = htons(total_len); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] openvswitch: fix GSO userspace truncation underflow
by Yi Yang 21 Sep '26

21 Sep '26

From: Kyle Zeng <kylebot(a)openai.com> stable inclusion from stable-v5.10.265 commit 50a6a85f3d6b1d22d8436848606cdef5d2c490b4 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16932 CVE: CVE-2026-68123 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4032f8ed10fcb84d41c508dfb04be96589f78dfe ] OVS_ACTION_ATTR_TRUNC currently stores a delta from the original skb length in OVS_CB(skb)->cutlen. When a later userspace action segments a GSO skb, queue_gso_packets() reuses that delta for each smaller segment. A segment can then reach queue_userspace_packet() with cutlen greater than skb->len, underflowing the length passed to skb_zerocopy(). Store the maximum preserved length instead and bound each consumer against the current skb length. Use U32_MAX as the no-truncation sentinel so the value remains valid if skb geometry changes before a consumer handles it. Fixes: f2a4d086ed4c ("openvswitch: Add packet truncation support.") Cc: stable(a)vger.kernel.org Assisted-by: Codex:gpt-5.5 Signed-off-by: Kyle Zeng <kylebot(a)openai.com> Reviewed-by: Ilya Maximets <i.maximets(a)ovn.org> Reviewed-by: Aaron Conole <aconole(a)redhat.com> Link: https://patch.msgid.link/20260707221635.27489-1-kylebot@openai.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> [5.10.y supports neither OVS_ACTION_ATTR_PSAMPLE nor OVS drop reasons] Signed-off-by: Ilya Maximets <i.maximets(a)ovn.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: net/openvswitch/datapath.c [Context conflicts.] Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- net/openvswitch/actions.c | 15 +++++---------- net/openvswitch/datapath.c | 25 ++++++++++++++----------- net/openvswitch/datapath.h | 2 +- net/openvswitch/vport.c | 2 +- 4 files changed, 21 insertions(+), 23 deletions(-) diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c index 7ac5f75e06a9..f3b3fd459600 100644 --- a/net/openvswitch/actions.c +++ b/net/openvswitch/actions.c @@ -949,12 +949,8 @@ static void do_output(struct datapath *dp, struct sk_buff *skb, int out_port, u16 mru = OVS_CB(skb)->mru; u32 cutlen = OVS_CB(skb)->cutlen; - if (unlikely(cutlen > 0)) { - if (skb->len - cutlen > ovs_mac_header_len(key)) - pskb_trim(skb, skb->len - cutlen); - else - pskb_trim(skb, ovs_mac_header_len(key)); - } + if (unlikely(cutlen < skb->len)) + pskb_trim(skb, max(cutlen, ovs_mac_header_len(key))); if (likely(!mru || (skb->len <= mru + vport->dev->hard_header_len))) { @@ -1237,22 +1233,21 @@ static int do_execute_actions(struct datapath *dp, struct sk_buff *skb, clone = skb_clone(skb, GFP_ATOMIC); if (clone) do_output(dp, clone, port, key); - OVS_CB(skb)->cutlen = 0; + OVS_CB(skb)->cutlen = U32_MAX; break; } case OVS_ACTION_ATTR_TRUNC: { struct ovs_action_trunc *trunc = nla_data(a); - if (skb->len > trunc->max_len) - OVS_CB(skb)->cutlen = skb->len - trunc->max_len; + OVS_CB(skb)->cutlen = trunc->max_len; break; } case OVS_ACTION_ATTR_USERSPACE: output_userspace(dp, skb, key, a, attr, len, OVS_CB(skb)->cutlen); - OVS_CB(skb)->cutlen = 0; + OVS_CB(skb)->cutlen = U32_MAX; break; case OVS_ACTION_ATTR_HASH: diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c index bd00e63603ca..1aeeb18c8812 100644 --- a/net/openvswitch/datapath.c +++ b/net/openvswitch/datapath.c @@ -248,7 +248,7 @@ void ovs_dp_process_packet(struct sk_buff *skb, struct sw_flow_key *key) upcall.cmd = OVS_PACKET_CMD_MISS; upcall.portid = ovs_vport_find_upcall_portid(p, skb); upcall.mru = OVS_CB(skb)->mru; - error = ovs_dp_upcall(dp, skb, key, &upcall, 0); + error = ovs_dp_upcall(dp, skb, key, &upcall, U32_MAX); if (unlikely(error)) kfree_skb(skb); else @@ -399,7 +399,8 @@ static int queue_userspace_packet(struct datapath *dp, struct sk_buff *skb, struct sk_buff *nskb = NULL; struct sk_buff *user_skb = NULL; /* to be queued to userspace */ struct nlattr *nla; - size_t len; + size_t msg_size; + size_t skb_len; unsigned int hlen; int err, dp_ifindex; @@ -419,7 +420,8 @@ static int queue_userspace_packet(struct datapath *dp, struct sk_buff *skb, skb = nskb; } - if (nla_attr_size(skb->len) > USHRT_MAX) { + skb_len = min(skb->len, cutlen); + if (nla_attr_size(skb_len) > USHRT_MAX) { err = -EFBIG; goto out; } @@ -434,13 +436,13 @@ static int queue_userspace_packet(struct datapath *dp, struct sk_buff *skb, * padding logic. Only perform zerocopy if padding is not required. */ if (dp->user_features & OVS_DP_F_UNALIGNED) - hlen = skb_zerocopy_headlen(skb); + hlen = min(skb_zerocopy_headlen(skb), cutlen); else - hlen = skb->len; + hlen = skb_len; - len = upcall_msg_size(upcall_info, hlen - cutlen, - OVS_CB(skb)->acts_origlen); - user_skb = genlmsg_new(len, GFP_ATOMIC); + msg_size = upcall_msg_size(upcall_info, hlen, + OVS_CB(skb)->acts_origlen); + user_skb = genlmsg_new(msg_size, GFP_ATOMIC); if (!user_skb) { err = -ENOMEM; goto out; @@ -503,7 +505,7 @@ static int queue_userspace_packet(struct datapath *dp, struct sk_buff *skb, } /* Add OVS_PACKET_ATTR_LEN when packet is truncated */ - if (cutlen > 0) { + if (skb_len < skb->len) { if (nla_put_u32(user_skb, OVS_PACKET_ATTR_LEN, skb->len)) { err = -ENOBUFS; @@ -518,9 +520,9 @@ static int queue_userspace_packet(struct datapath *dp, struct sk_buff *skb, err = -ENOBUFS; goto out; } - nla->nla_len = nla_attr_size(skb->len - cutlen); + nla->nla_len = nla_attr_size(skb_len); - err = skb_zerocopy(user_skb, skb, skb->len - cutlen, hlen); + err = skb_zerocopy(user_skb, skb, skb_len, hlen); if (err) goto out; @@ -575,6 +577,7 @@ static int ovs_packet_cmd_execute(struct sk_buff *skb, struct genl_info *info) packet->ignore_df = 1; } OVS_CB(packet)->mru = mru; + OVS_CB(packet)->cutlen = U32_MAX; /* Build an sw_flow for sending this packet. */ flow = ovs_flow_alloc(); diff --git a/net/openvswitch/datapath.h b/net/openvswitch/datapath.h index c9eb267c6f7e..9192c9970cc3 100644 --- a/net/openvswitch/datapath.h +++ b/net/openvswitch/datapath.h @@ -105,7 +105,7 @@ struct datapath { * @mru: The maximum received fragement size; 0 if the packet is not * fragmented. * @acts_origlen: The netlink size of the flow actions applied to this skb. - * @cutlen: The number of bytes from the packet end to be removed. + * @cutlen: The number of bytes in the packet to preserve on output. */ struct ovs_skb_cb { struct vport *input_vport; diff --git a/net/openvswitch/vport.c b/net/openvswitch/vport.c index 5541f4c9a0a1..586428d2015d 100644 --- a/net/openvswitch/vport.c +++ b/net/openvswitch/vport.c @@ -447,7 +447,7 @@ int ovs_vport_receive(struct vport *vport, struct sk_buff *skb, OVS_CB(skb)->input_vport = vport; OVS_CB(skb)->mru = 0; - OVS_CB(skb)->cutlen = 0; + OVS_CB(skb)->cutlen = U32_MAX; if (unlikely(dev_net(skb->dev) != ovs_dp_get_net(vport->dp))) { u32 mark; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] selinux: check connect-related permissions on TCP Fast Open
by Yi Yang 20 Sep '26

20 Sep '26

From: Stephen Smalley <stephen.smalley.work(a)gmail.com> mainline inclusion from mainline-v7.2-rc3 commit 44c74d27d1b9aaa99fa8a83640c1223575262b80 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17775 CVE: CVE-2026-72243 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Similar to Landlock, SELinux was not updated when TCP Fast Open support was introduced to ensure connect-related permissions are checked when using TCP Fast Open. Update its socket_sendmsg() hook to call selinux_socket_connect() when MSG_FASTOPEN is passed. Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/linux-security-module/20260616201615.275032-1-hexla… Link: https://lore.kernel.org/linux-security-module/20260617180526.15627-2-matthi… Reported-by: Bryam Vargas <hexlabsecurity(a)proton.me> Reported-by: Matthieu Buffet <matthieu(a)buffet.re> Reported-by: Mikhail Ivanov <ivanov.mikhail1(a)huawei-partners.com> Signed-off-by: Stephen Smalley <stephen.smalley.work(a)gmail.com> Tested-by: Bryam Vargas <hexlabsecurity(a)proton.me> Signed-off-by: Paul Moore <paul(a)paul-moore.com> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- security/selinux/hooks.c | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 3550ded07457..c0b5af6a82a7 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -4910,7 +4910,24 @@ static int selinux_socket_accept(struct socket *sock, struct socket *newsock) static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg, int size) { - return sock_has_perm(sock->sk, SOCKET__WRITE); + int rc; + struct sockaddr *const addr = msg->msg_name; + const int addrlen = msg->msg_namelen; + + rc = sock_has_perm(sock->sk, SOCKET__WRITE); + if (rc) + return rc; + + if (addr && (msg->msg_flags & MSG_FASTOPEN) && + (sk_is_tcp(sock->sk) || + (sk_is_inet(sock->sk) && sock->sk->sk_type == SOCK_STREAM && + sock->sk->sk_protocol == IPPROTO_MPTCP))) { + rc = selinux_socket_connect(sock, addr, addrlen); + if (rc) + return rc; + } + + return 0; } static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg, -- 2.25.1

2 1

[PATCH OLK-6.6 0/4] arm64: smt: Introduce VIP-SMT QoS mode for SMT
by Yipeng Zou 20 Sep '26

20 Sep '26

This patchset introduces VIP-SMT, an Hisilicon-specific SMT QoS enhancement for Arm64. It allows marking specific hardware threads as "VIP" (high-priority) and others as non-VIP within the same physical core, enabling differentiated resource allocation (instruction fetch, execution pipeline, and out-of-order resources) for latency-sensitive workloads while background tasks run on non-VIP threads. Use cases include running real-time/network packet processing on VIP threads, performance isolation for mixed-criticality tasks, and QoS enforcement for cloud/virtualization scenarios. The series is organized as follows: Patch 1 refactors arch_cpu_idle_{enter,exit}() so the SMT measurement and the VIP-SMT hooks can be shared cleanly across all configs; the ACTLR_XCALL_XINT register save/restore is moved under its own config guard. Patch 2 is the core feature. It adds CONFIG_ARM64_VIP_SMT and a new vip_smt.c driver exposing per-CPU sysfs entries under /sys/devices/system/cpu/cpuN/regs/vip-smt/ to configure three ACTLR system registers (IFU_ACTLR1_EL1, OOO_DEC_ROB_SHA_CTLR_EL1, and OOO_DEC_DSP_CTLR_EL1). Feature detection is based on MIDR (HIP13), restricted to EL2 at the moment, and requires SMT to be enabled on the physical core. Per-CPU register values are shadowed and restored on idle exit so they survive core power-down. Patch 3 adds a "novipsmt" kernel command line parameter (with an optional "force" value) that disables the feature at boot time and prevents the vip_smt sysfs directory from being created. Yipeng Zou (4): arm64: idle: make arch_cpu_idle_{enter,exit} more refactorable arm64: smt: Introduce VIP-SMT a QoS Mode for SMT arm64: smt: Add novipsmt kernel command line parameter arm64: configs: Enable ARM64_VIP_SMT in openeuler_defconfig .../admin-guide/kernel-parameters.txt | 4 + arch/arm64/Kconfig | 16 + arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/vip_smt.h | 109 ++++ arch/arm64/kernel/Makefile | 1 + arch/arm64/kernel/cpufeature.c | 9 + arch/arm64/kernel/cpuinfo.c | 7 + arch/arm64/kernel/idle.c | 51 +- arch/arm64/kernel/vip_smt.c | 483 ++++++++++++++++++ arch/arm64/tools/cpucaps | 2 +- 10 files changed, 653 insertions(+), 30 deletions(-) create mode 100644 arch/arm64/include/asm/vip_smt.h create mode 100644 arch/arm64/kernel/vip_smt.c -- 2.34.1

2 5

[PATCH OLK-6.6] ceph: cap delegated inode count in ceph_parse_deleg_inos()
by Pan Taixi 20 Sep '26

20 Sep '26

From: Michael Bommarito <michael.bommarito(a)gmail.com> mainline inclusion from mainline-v7.3-rc1 commit 4bd3158bd62466d57ed72a3f7bc5f205fedd6919 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/18927 CVE: CVE-2026-89648 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- ceph_parse_deleg_inos() decodes interval sets of delegated inode numbers from an MDS create-with-delegation reply. For each set it reads a 64-bit start and a 64-bit len with ceph_decode_64_safe(), which only validates that the eight bytes are present in the message, not the value, and then loops over len while inserting entries into s_delegated_inos. len is fully attacker controlled. A malicious or compromised MDS can send one huge interval, many intervals in one reply, duplicate intervals, or repeated replies that accumulate delegated inodes on the same session. The original code bounded none of these and could spin the insert loop or grow the xarray without limit. Bound both dimensions with a single enforcement point. Track the number of delegated inodes held by each MDS session in an atomic counter and grow it only in ceph_insert_deleg_ino(), which uses atomic_add_unless() to refuse to push the count past CEPH_MAX_DELEG_INOS. Because that helper is the only place the counter grows, the per-session population can never exceed the cap, so no separate per-session pre-check is needed. The counter is decremented when async create consumes a delegated inode or when an insert fails, incremented when a delegated inode is restored, initialized with the session xarray, and reset when reconnect destroys the xarray. A per-session cap alone still lets one reply spin the insert loop on duplicate ranges without growing the counter, so also cap the aggregate interval length accepted from a single reply. Together these bound both the loop trip count per reply and the xarray population across replies. The cap is a fixed, client-chosen constant rather than a value derived from the MDS. mds_client_prealloc_inos is a userspace MDS configuration option; it is never sent to the kernel client on the wire, and a server-supplied bound could not be trusted for a defensive limit in any case. The constant is set well above that option's documented default of 1000 (a generous multiple), so legitimate refill behavior is unaffected while the CPU and xarray memory a malformed delegation stream can consume stays bounded. Impact: a malicious or compromised Ceph MDS can no longer make a client spin through an unbounded delegated-inode interval or grow one session's delegated-inode xarray without limit. Cc: stable(a)vger.kernel.org Fixes: d48464878708 ("ceph: decode interval_sets for delegated inos") Suggested-by: Viacheslav Dubeyko <Slava.Dubeyko(a)ibm.com> Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko(a)ibm.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Conflicts: fs/ceph/mds_client.c [backport to OLK-6.6: context adjusted for this tree: pr_warn_ratelimited_client()/doutc() from 38d46409c4639 are not used here, so the new warnings use plain pr_warn_ratelimited() and the struct ceph_client *cl local is not added. CEPH_MAX_DELEG_INOS is inserted right after CEPH_INO_SYSTEM_BASE. s_num_deleg_inos is reset next to the existing xa_destroy() in send_mds_reconnect(), which still runs before mutex_lock(&session->s_mutex) in this tree (39fe30315893 not applied); this matches the linux-6.18.y stable backport c040e139f1a62.] Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com> --- fs/ceph/mds_client.c | 56 +++++++++++++++++++++++++++++++++++++++----- fs/ceph/mds_client.h | 1 + fs/ceph/super.h | 9 +++++++ 3 files changed, 60 insertions(+), 6 deletions(-) diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c index 00b9f9f3f4d7..a3fa2fd0b974 100644 --- a/fs/ceph/mds_client.c +++ b/fs/ceph/mds_client.c @@ -566,13 +566,37 @@ static int parse_reply_info_filelock(void **p, void *end, #if BITS_PER_LONG == 64 #define DELEGATED_INO_AVAILABLE xa_mk_value(1) +static int ceph_insert_deleg_ino(struct ceph_mds_session *s, u64 ino) +{ + int err; + + /* + * Cap how many delegated inodes a single session may hold. This is + * the only place that grows the count, so atomic_add_unless() bounds + * it at exactly CEPH_MAX_DELEG_INOS; s_num_deleg_inos can never exceed + * that. + */ + if (!atomic_add_unless(&s->s_num_deleg_inos, 1, CEPH_MAX_DELEG_INOS)) { + pr_warn_ratelimited("MDS session already holds %d delegated inodes\n", + CEPH_MAX_DELEG_INOS); + return -EOVERFLOW; + } + + err = xa_insert(&s->s_delegated_inos, ino, DELEGATED_INO_AVAILABLE, + GFP_KERNEL); + if (err) + atomic_dec(&s->s_num_deleg_inos); + return err; +} + static int ceph_parse_deleg_inos(void **p, void *end, struct ceph_mds_session *s) { + u64 msg_deleg_inos = 0; u32 sets; ceph_decode_32_safe(p, end, sets, bad); dout("got %u sets of delegated inodes\n", sets); while (sets--) { @@ -585,20 +609,37 @@ static int ceph_parse_deleg_inos(void **p, void *end, if (start < CEPH_INO_SYSTEM_BASE) { pr_warn_ratelimited("ceph: ignoring reserved inode range delegation (start=0x%llx len=0x%llx)\n", start, len); continue; } + + /* + * Bound the number of inodes one reply may delegate. + * ceph_insert_deleg_ino() separately caps the per-session + * population, so this only has to stop one reply from spinning + * the insert loop under an attacker-controlled len. + */ + if (len > (u64)CEPH_MAX_DELEG_INOS || + msg_deleg_inos > (u64)CEPH_MAX_DELEG_INOS - len) { + pr_warn_ratelimited("MDS reply delegates too many inodes (have %llu, +%llu, max %d)\n", + msg_deleg_inos, len, CEPH_MAX_DELEG_INOS); + return -EIO; + } + msg_deleg_inos += len; + while (len--) { - int err = xa_insert(&s->s_delegated_inos, start++, - DELEGATED_INO_AVAILABLE, - GFP_KERNEL); + int err = ceph_insert_deleg_ino(s, start++); + if (!err) { dout("added delegated inode 0x%llx\n", start - 1); } else if (err == -EBUSY) { pr_warn("MDS delegated inode 0x%llx more than once.\n", start - 1); + } else if (err == -EOVERFLOW) { + /* ceph_insert_deleg_ino() already warned. */ + return -EIO; } else { return err; } } } @@ -612,20 +653,21 @@ u64 ceph_get_deleg_ino(struct ceph_mds_session *s) unsigned long ino; void *val; xa_for_each(&s->s_delegated_inos, ino, val) { val = xa_erase(&s->s_delegated_inos, ino); - if (val == DELEGATED_INO_AVAILABLE) + if (val == DELEGATED_INO_AVAILABLE) { + atomic_dec(&s->s_num_deleg_inos); return ino; + } } return 0; } int ceph_restore_deleg_ino(struct ceph_mds_session *s, u64 ino) { - return xa_insert(&s->s_delegated_inos, ino, DELEGATED_INO_AVAILABLE, - GFP_KERNEL); + return ceph_insert_deleg_ino(s, ino); } #else /* BITS_PER_LONG == 64 */ /* * FIXME: xarrays can't handle 64-bit indexes on a 32-bit arch. For now, just * ignore delegated_inos on 32 bit arch. Maybe eventually add xarrays for top @@ -1002,10 +1044,11 @@ static struct ceph_mds_session *register_session(struct ceph_mds_client *mdsc, INIT_LIST_HEAD(&s->s_caps); refcount_set(&s->s_ref, 1); INIT_LIST_HEAD(&s->s_waiting); INIT_LIST_HEAD(&s->s_unsafe); xa_init(&s->s_delegated_inos); + atomic_set(&s->s_num_deleg_inos, 0); INIT_LIST_HEAD(&s->s_cap_releases); INIT_WORK(&s->s_cap_release_work, ceph_cap_release_work); INIT_LIST_HEAD(&s->s_cap_dirty); INIT_LIST_HEAD(&s->s_cap_flushing); @@ -4619,10 +4662,11 @@ static void send_mds_reconnect(struct ceph_mds_client *mdsc, reply = ceph_msg_new2(CEPH_MSG_CLIENT_RECONNECT, 0, 1, GFP_NOFS, false); if (!reply) goto fail_nomsg; xa_destroy(&session->s_delegated_inos); + atomic_set(&session->s_num_deleg_inos, 0); mutex_lock(&session->s_mutex); session->s_state = CEPH_MDS_SESSION_RECONNECTING; session->s_seq = 0; diff --git a/fs/ceph/mds_client.h b/fs/ceph/mds_client.h index 22398ccb21a4..9916acd901ab 100644 --- a/fs/ceph/mds_client.h +++ b/fs/ceph/mds_client.h @@ -228,10 +228,11 @@ struct ceph_mds_session { u64 s_renew_seq; struct list_head s_waiting; /* waiting requests */ struct list_head s_unsafe; /* unsafe requests */ struct xarray s_delegated_inos; + atomic_t s_num_deleg_inos; }; /* * modes of choosing which MDS to send a request to */ diff --git a/fs/ceph/super.h b/fs/ceph/super.h index 5903e3fb6d75..09bf04f4452e 100644 --- a/fs/ceph/super.h +++ b/fs/ceph/super.h @@ -588,10 +588,19 @@ static inline int ceph_ino_compare(struct inode *inode, void *data) #define CEPH_NUM_STRAY 10 #define CEPH_MDS_INO_MDSDIR_OFFSET (1 * CEPH_MAX_MDS) #define CEPH_MDS_INO_LOG_OFFSET (2 * CEPH_MAX_MDS) #define CEPH_INO_SYSTEM_BASE ((6*CEPH_MAX_MDS) + (CEPH_MAX_MDS * CEPH_NUM_STRAY)) +/* + * Upper bound on the number of delegated inodes a single MDS session may + * hold. The MDS normally hands out a small preallocation window (the + * userspace mds_client_prealloc_inos option defaults to 1000) and refills + * it as the client consumes entries. This leaves generous headroom while + * bounding the CPU and memory a malformed delegation interval can consume. + */ +#define CEPH_MAX_DELEG_INOS 8192 + static inline bool ceph_vino_is_reserved(const struct ceph_vino vino) { if (vino.ino >= CEPH_INO_SYSTEM_BASE || vino.ino < CEPH_MDS_INO_MDSDIR_OFFSET) return false; -- 2.34.1

2 1

[PATCH OLK-5.10] ceph: cap delegated inode count in ceph_parse_deleg_inos()
by Pan Taixi 20 Sep '26

20 Sep '26

From: Michael Bommarito <michael.bommarito(a)gmail.com> mainline inclusion from mainline-v7.3-rc1 commit 4bd3158bd62466d57ed72a3f7bc5f205fedd6919 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/18927 CVE: CVE-2026-89648 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- ceph_parse_deleg_inos() decodes interval sets of delegated inode numbers from an MDS create-with-delegation reply. For each set it reads a 64-bit start and a 64-bit len with ceph_decode_64_safe(), which only validates that the eight bytes are present in the message, not the value, and then loops over len while inserting entries into s_delegated_inos. len is fully attacker controlled. A malicious or compromised MDS can send one huge interval, many intervals in one reply, duplicate intervals, or repeated replies that accumulate delegated inodes on the same session. The original code bounded none of these and could spin the insert loop or grow the xarray without limit. Bound both dimensions with a single enforcement point. Track the number of delegated inodes held by each MDS session in an atomic counter and grow it only in ceph_insert_deleg_ino(), which uses atomic_add_unless() to refuse to push the count past CEPH_MAX_DELEG_INOS. Because that helper is the only place the counter grows, the per-session population can never exceed the cap, so no separate per-session pre-check is needed. The counter is decremented when async create consumes a delegated inode or when an insert fails, incremented when a delegated inode is restored, initialized with the session xarray, and reset when reconnect destroys the xarray. A per-session cap alone still lets one reply spin the insert loop on duplicate ranges without growing the counter, so also cap the aggregate interval length accepted from a single reply. Together these bound both the loop trip count per reply and the xarray population across replies. The cap is a fixed, client-chosen constant rather than a value derived from the MDS. mds_client_prealloc_inos is a userspace MDS configuration option; it is never sent to the kernel client on the wire, and a server-supplied bound could not be trusted for a defensive limit in any case. The constant is set well above that option's documented default of 1000 (a generous multiple), so legitimate refill behavior is unaffected while the CPU and xarray memory a malformed delegation stream can consume stays bounded. Impact: a malicious or compromised Ceph MDS can no longer make a client spin through an unbounded delegated-inode interval or grow one session's delegated-inode xarray without limit. Cc: stable(a)vger.kernel.org Fixes: d48464878708 ("ceph: decode interval_sets for delegated inos") Suggested-by: Viacheslav Dubeyko <Slava.Dubeyko(a)ibm.com> Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko(a)ibm.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Conflicts: fs/ceph/mds_client.c [backport to OLK-5.10: context adjusted for this tree: pr_warn_ratelimited_client()/doutc() from 38d46409c4639 are not used here, so the new warnings use plain pr_warn_ratelimited() and the struct ceph_client *cl local is not added. The redundant 'ino' local (2ecd0edd13a8b not applied here) is dropped together with its only user, the open-coded xa_insert() in ceph_parse_deleg_inos(). CEPH_MAX_DELEG_INOS is inserted right after CEPH_INO_SYSTEM_BASE. s_num_deleg_inos is reset next to the existing xa_destroy() in send_mds_reconnect(), which still runs before mutex_lock(&session->s_mutex) in this tree (39fe30315893 not applied); this matches the linux-6.18.y stable backport c040e139f1a62.] Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com> --- fs/ceph/mds_client.c | 58 ++++++++++++++++++++++++++++++++++++++------ fs/ceph/mds_client.h | 1 + fs/ceph/super.h | 9 +++++++ 3 files changed, 61 insertions(+), 7 deletions(-) diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c index aea1b42b9b18..ef39852280c8 100644 --- a/fs/ceph/mds_client.c +++ b/fs/ceph/mds_client.c @@ -419,39 +419,80 @@ static int parse_reply_info_filelock(void **p, void *end, #if BITS_PER_LONG == 64 #define DELEGATED_INO_AVAILABLE xa_mk_value(1) +static int ceph_insert_deleg_ino(struct ceph_mds_session *s, u64 ino) +{ + int err; + + /* + * Cap how many delegated inodes a single session may hold. This is + * the only place that grows the count, so atomic_add_unless() bounds + * it at exactly CEPH_MAX_DELEG_INOS; s_num_deleg_inos can never exceed + * that. + */ + if (!atomic_add_unless(&s->s_num_deleg_inos, 1, CEPH_MAX_DELEG_INOS)) { + pr_warn_ratelimited("MDS session already holds %d delegated inodes\n", + CEPH_MAX_DELEG_INOS); + return -EOVERFLOW; + } + + err = xa_insert(&s->s_delegated_inos, ino, DELEGATED_INO_AVAILABLE, + GFP_KERNEL); + if (err) + atomic_dec(&s->s_num_deleg_inos); + return err; +} + static int ceph_parse_deleg_inos(void **p, void *end, struct ceph_mds_session *s) { + u64 msg_deleg_inos = 0; u32 sets; ceph_decode_32_safe(p, end, sets, bad); dout("got %u sets of delegated inodes\n", sets); while (sets--) { - u64 start, len, ino; + u64 start, len; ceph_decode_64_safe(p, end, start, bad); ceph_decode_64_safe(p, end, len, bad); /* Don't accept a delegation of system inodes */ if (start < CEPH_INO_SYSTEM_BASE) { pr_warn_ratelimited("ceph: ignoring reserved inode range delegation (start=0x%llx len=0x%llx)\n", start, len); continue; } + + /* + * Bound the number of inodes one reply may delegate. + * ceph_insert_deleg_ino() separately caps the per-session + * population, so this only has to stop one reply from spinning + * the insert loop under an attacker-controlled len. + */ + if (len > (u64)CEPH_MAX_DELEG_INOS || + msg_deleg_inos > (u64)CEPH_MAX_DELEG_INOS - len) { + pr_warn_ratelimited("MDS reply delegates too many inodes (have %llu, +%llu, max %d)\n", + msg_deleg_inos, len, CEPH_MAX_DELEG_INOS); + return -EIO; + } + msg_deleg_inos += len; + while (len--) { - int err = xa_insert(&s->s_delegated_inos, ino = start++, - DELEGATED_INO_AVAILABLE, - GFP_KERNEL); + int err = ceph_insert_deleg_ino(s, start++); + if (!err) { dout("added delegated inode 0x%llx\n", start - 1); } else if (err == -EBUSY) { pr_warn("ceph: MDS delegated inode 0x%llx more than once.\n", start - 1); + } else if (err == -EOVERFLOW) { + /* ceph_insert_deleg_ino() already warned. */ + return -EIO; } else { return err; } } } @@ -465,20 +506,21 @@ u64 ceph_get_deleg_ino(struct ceph_mds_session *s) unsigned long ino; void *val; xa_for_each(&s->s_delegated_inos, ino, val) { val = xa_erase(&s->s_delegated_inos, ino); - if (val == DELEGATED_INO_AVAILABLE) + if (val == DELEGATED_INO_AVAILABLE) { + atomic_dec(&s->s_num_deleg_inos); return ino; + } } return 0; } int ceph_restore_deleg_ino(struct ceph_mds_session *s, u64 ino) { - return xa_insert(&s->s_delegated_inos, ino, DELEGATED_INO_AVAILABLE, - GFP_KERNEL); + return ceph_insert_deleg_ino(s, ino); } #else /* BITS_PER_LONG == 64 */ /* * FIXME: xarrays can't handle 64-bit indexes on a 32-bit arch. For now, just * ignore delegated_inos on 32 bit arch. Maybe eventually add xarrays for top @@ -760,10 +802,11 @@ static struct ceph_mds_session *register_session(struct ceph_mds_client *mdsc, s->s_nr_caps = 0; refcount_set(&s->s_ref, 1); INIT_LIST_HEAD(&s->s_waiting); INIT_LIST_HEAD(&s->s_unsafe); xa_init(&s->s_delegated_inos); + atomic_set(&s->s_num_deleg_inos, 0); s->s_num_cap_releases = 0; s->s_cap_reconnect = 0; s->s_cap_iterator = NULL; INIT_LIST_HEAD(&s->s_cap_releases); INIT_WORK(&s->s_cap_release_work, ceph_cap_release_work); @@ -3908,10 +3951,11 @@ static void send_mds_reconnect(struct ceph_mds_client *mdsc, reply = ceph_msg_new2(CEPH_MSG_CLIENT_RECONNECT, 0, 1, GFP_NOFS, false); if (!reply) goto fail_nomsg; xa_destroy(&session->s_delegated_inos); + atomic_set(&session->s_num_deleg_inos, 0); mutex_lock(&session->s_mutex); session->s_state = CEPH_MDS_SESSION_RECONNECTING; session->s_seq = 0; diff --git a/fs/ceph/mds_client.h b/fs/ceph/mds_client.h index b1939f916228..847f04424be3 100644 --- a/fs/ceph/mds_client.h +++ b/fs/ceph/mds_client.h @@ -208,10 +208,11 @@ struct ceph_mds_session { u64 s_renew_seq; struct list_head s_waiting; /* waiting requests */ struct list_head s_unsafe; /* unsafe requests */ struct xarray s_delegated_inos; + atomic_t s_num_deleg_inos; }; /* * modes of choosing which MDS to send a request to */ diff --git a/fs/ceph/super.h b/fs/ceph/super.h index c0c5ed3e2718..6b2e0cfb9ae3 100644 --- a/fs/ceph/super.h +++ b/fs/ceph/super.h @@ -538,10 +538,19 @@ static inline int ceph_ino_compare(struct inode *inode, void *data) #define CEPH_MAX_MDS 0x100 #define CEPH_NUM_STRAY 10 #define CEPH_MDS_INO_MDSDIR_OFFSET (1 * CEPH_MAX_MDS) #define CEPH_INO_SYSTEM_BASE ((6*CEPH_MAX_MDS) + (CEPH_MAX_MDS * CEPH_NUM_STRAY)) +/* + * Upper bound on the number of delegated inodes a single MDS session may + * hold. The MDS normally hands out a small preallocation window (the + * userspace mds_client_prealloc_inos option defaults to 1000) and refills + * it as the client consumes entries. This leaves generous headroom while + * bounding the CPU and memory a malformed delegation interval can consume. + */ +#define CEPH_MAX_DELEG_INOS 8192 + static inline bool ceph_vino_is_reserved(const struct ceph_vino vino) { if (vino.ino < CEPH_INO_SYSTEM_BASE && vino.ino >= CEPH_MDS_INO_MDSDIR_OFFSET) { WARN_RATELIMIT(1, "Attempt to access reserved inode number 0x%llx", vino.ino); -- 2.34.1

2 1

[PATCH OLK-6.6] ceph: do not repeat ceph_trim_dentries() if no progress possible
by Pan Taixi 20 Sep '26

20 Sep '26

From: Max Kellermann <max.kellermann(a)ionos.com> mainline inclusion from mainline-v7.3-rc1 commit e7d7aa7b730178278109c41fa1b17b06873065d5 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/19026 CVE: CVE-2026-89647 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- ceph_cap_reclaim_work() re-queues itself for as long as ceph_trim_dentries() returns -EAGAIN, which happens whenever a lease walk exhausts its `nr_to_scan` budget. This creates a busy loop that consumes CPU without making any progress when there is nothing to reclaim: with no cap pressure (`count==0`) and every scanned lease still valid, each pass runs the full scan budget down to zero and returns `-EAGAIN`, only to be queued again immediately. The dir-lease walk made this worse. When `expire_dir_lease` is `false` (i.e. we have no intention of reclaiming dir leases), __dir_lease_check() returned `TOUCH` for every valid lease. `TOUCH` moves the dentry to the tail of the list and resets `di->time` via __dentry_dir_lease_touch(), so a walk over N valid leases pointlessly rewrote the list, refreshed the timestamps (preventing them from ever aging out) and always drained `nr_to_scan`, guaranteeing the `-EAGAIN` requeue. Fix this in three steps: - Return `KEEP` instead of `TOUCH` when `expire_dir_lease` is `false`. If we are not going to reclaim the lease, leave it in place instead of churning the list and resetting its timestamp; the walk then terminates naturally (or via `STOP` at the first fresh lease). - Only return `-EAGAIN` from the first (dentry-lease) walk when something was actually freed. A full batch that frees nothing means retrying the same list immediately is futile; fall through to the dir-lease walk instead. - After both walks, bail out with success (0) when nothing was freed and there is no cap pressure (`count==0`). There is no reason to keep retrying when we are not over the cap limit and made no progress. Under real cap pressure (`count>0`) the reclaim path is unchanged and still retries via `-EAGAIN`. Without this patch, I saw 500 ceph_trim_dentries() calls per second on our web servers. This is very visible in `/proc/lock_stat` (5 minute capture): class name con-bounces contentions waittime-min waittime-max waittime-total waittime-avg acq-bounces acquisitions holdtime-min holdtime-max holdtime-total holdtime-avg &mdsc->dentry_list_lock: 126180 128218 0.04 8063.44 15986965.20 124.69 1573354 5296812 0.04 8291.28 74164526.48 14.00 ----------------------- &mdsc->dentry_list_lock 111736 [<000000007b11e319>] __ceph_dentry_dir_lease_touch+0x7c/0xa8 &mdsc->dentry_list_lock 2631 [<0000000050597999>] __dentry_leases_walk+0x64/0x2c8 &mdsc->dentry_list_lock 3878 [<00000000c0022f62>] __ceph_dentry_lease_touch+0x5c/0xa8 &mdsc->dentry_list_lock 9973 [<000000002f27cb6f>] __dentry_lease_unlist+0x50/0xa0 ----------------------- &mdsc->dentry_list_lock 123621 [<0000000050597999>] __dentry_leases_walk+0x64/0x2c8 &mdsc->dentry_list_lock 1822 [<000000007b11e319>] __ceph_dentry_dir_lease_touch+0x7c/0xa8 &mdsc->dentry_list_lock 2720 [<000000002f27cb6f>] __dentry_lease_unlist+0x50/0xa0 &mdsc->dentry_list_lock 55 [<00000000c0022f62>] __ceph_dentry_lease_touch+0x5c/0xa8 With this patch: class name con-bounces contentions waittime-min waittime-max waittime-total waittime-avg acq-bounces acquisitions holdtime-min holdtime-max holdtime-total holdtime-avg &mdsc->dentry_list_lock: 1203 1215 0.16 408.88 33082.88 27.23 4320501 7357389 0.04 500.64 1961578.00 0.27 ----------------------- &mdsc->dentry_list_lock 1029 [<000000003c9aea8a>] __ceph_dentry_dir_lease_touch+0x7c/0xa8 &mdsc->dentry_list_lock 169 [<000000002038c577>] __dentry_lease_unlist+0x50/0xa0 &mdsc->dentry_list_lock 16 [<00000000c991106d>] __ceph_dentry_lease_touch+0x5c/0xa8 &mdsc->dentry_list_lock 1 [<00000000612fe15f>] __dentry_leases_walk+0x64/0x2c8 ----------------------- &mdsc->dentry_list_lock 158 [<000000002038c577>] __dentry_lease_unlist+0x50/0xa0 &mdsc->dentry_list_lock 858 [<000000003c9aea8a>] __ceph_dentry_dir_lease_touch+0x7c/0xa8 &mdsc->dentry_list_lock 182 [<00000000612fe15f>] __dentry_leases_walk+0x64/0x2c8 &mdsc->dentry_list_lock 17 [<00000000c991106d>] __ceph_dentry_lease_touch+0x5c/0xa8 __dentry_leases_walk() is almost gone. The total wait time is reduced by a factor of 483. That will give some latency gains to ceph_readdir(). Cc: stable(a)vger.kernel.org Fixes: 37c4efc1ddf9 ("ceph: periodically trim stale dentries") Signed-off-by: Max Kellermann <max.kellermann(a)ionos.com> Reviewed-by: Alex Markuze <amarkuze(a)redhat.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Conflicts: fs/ceph/dir.c [backport to OLK-6.6: the three upstream semantic changes are taken verbatim - __dir_lease_check() now returns KEEP instead of TOUCH when expire_dir_lease is false (moved above the round-robin comment), the first -EAGAIN is gated on freed > 0, and ceph_trim_dentries() bails out with 0 when freed == 0 && count == 0. Only the two __dentry_leases_walk() call sites had to be adapted: like linux-5.10.y, this tree still passes the check callback as a third argument, because 2a965d1b15d28 ("ceph: get rid of passing callbacks in __dentry_leases_walk()", v6.8-rc1, which is what the linux-6.12.y stable backport is based on) is a pure cleanup that is neither present in OLK-6.6 nor part of this fix's dependency chain. linux-6.6.y LTS has not taken this fix, so mainline e7d7aa7b73017 is used as the baseline.] Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com> --- fs/ceph/dir.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c index 949c2a450cfb..5f82537ba37c 100644 --- a/fs/ceph/dir.c +++ b/fs/ceph/dir.c @@ -1674,15 +1674,15 @@ static int __dir_lease_check(struct dentry *dentry, void *arg) if (ret == -EBUSY) return KEEP; if (ret > 0) { if (time_before(jiffies, di->time + lwc->dir_lease_ttl)) return STOP; + if (!lwc->expire_dir_lease) + return KEEP; /* Move dentry to tail of dir lease list if we don't want * to delete it. So dentries in the list are checked in a * round robin manner */ - if (!lwc->expire_dir_lease) - return TOUCH; if (dentry->d_lockref.count > 0 || (di->flags & CEPH_DENTRY_REFERENCED)) return TOUCH; /* invalidate dir lease */ di->lease_shared_gen = 0; @@ -1705,20 +1705,24 @@ int ceph_trim_dentries(struct ceph_mds_client *mdsc) spin_unlock(&mdsc->caps_list_lock); lwc.dir_lease = false; lwc.nr_to_scan = CEPH_CAPS_PER_RELEASE * 2; freed = __dentry_leases_walk(mdsc, &lwc, __dentry_lease_check); - if (!lwc.nr_to_scan) /* more invalid leases */ + if (freed > 0 && !lwc.nr_to_scan) /* more invalid leases */ return -EAGAIN; if (lwc.nr_to_scan < CEPH_CAPS_PER_RELEASE) lwc.nr_to_scan = CEPH_CAPS_PER_RELEASE; lwc.dir_lease = true; lwc.expire_dir_lease = freed < count; lwc.dir_lease_ttl = mdsc->fsc->mount_options->caps_wanted_delay_max * HZ; freed +=__dentry_leases_walk(mdsc, &lwc, __dir_lease_check); + if (freed == 0 && count == 0) + /* no progress possible currently, retry futile */ + return 0; + if (!lwc.nr_to_scan) /* more to check */ return -EAGAIN; return freed > 0 ? 1 : 0; } -- 2.34.1

2 1

[PATCH OLK-5.10] ceph: do not repeat ceph_trim_dentries() if no progress possible
by Pan Taixi 20 Sep '26

20 Sep '26

From: Max Kellermann <max.kellermann(a)ionos.com> mainline inclusion from mainline-v7.3-rc1 commit e7d7aa7b730178278109c41fa1b17b06873065d5 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/19026 CVE: CVE-2026-89647 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- ceph_cap_reclaim_work() re-queues itself for as long as ceph_trim_dentries() returns -EAGAIN, which happens whenever a lease walk exhausts its `nr_to_scan` budget. This creates a busy loop that consumes CPU without making any progress when there is nothing to reclaim: with no cap pressure (`count==0`) and every scanned lease still valid, each pass runs the full scan budget down to zero and returns `-EAGAIN`, only to be queued again immediately. The dir-lease walk made this worse. When `expire_dir_lease` is `false` (i.e. we have no intention of reclaiming dir leases), __dir_lease_check() returned `TOUCH` for every valid lease. `TOUCH` moves the dentry to the tail of the list and resets `di->time` via __dentry_dir_lease_touch(), so a walk over N valid leases pointlessly rewrote the list, refreshed the timestamps (preventing them from ever aging out) and always drained `nr_to_scan`, guaranteeing the `-EAGAIN` requeue. Fix this in three steps: - Return `KEEP` instead of `TOUCH` when `expire_dir_lease` is `false`. If we are not going to reclaim the lease, leave it in place instead of churning the list and resetting its timestamp; the walk then terminates naturally (or via `STOP` at the first fresh lease). - Only return `-EAGAIN` from the first (dentry-lease) walk when something was actually freed. A full batch that frees nothing means retrying the same list immediately is futile; fall through to the dir-lease walk instead. - After both walks, bail out with success (0) when nothing was freed and there is no cap pressure (`count==0`). There is no reason to keep retrying when we are not over the cap limit and made no progress. Under real cap pressure (`count>0`) the reclaim path is unchanged and still retries via `-EAGAIN`. Without this patch, I saw 500 ceph_trim_dentries() calls per second on our web servers. This is very visible in `/proc/lock_stat` (5 minute capture): class name con-bounces contentions waittime-min waittime-max waittime-total waittime-avg acq-bounces acquisitions holdtime-min holdtime-max holdtime-total holdtime-avg &mdsc->dentry_list_lock: 126180 128218 0.04 8063.44 15986965.20 124.69 1573354 5296812 0.04 8291.28 74164526.48 14.00 ----------------------- &mdsc->dentry_list_lock 111736 [<000000007b11e319>] __ceph_dentry_dir_lease_touch+0x7c/0xa8 &mdsc->dentry_list_lock 2631 [<0000000050597999>] __dentry_leases_walk+0x64/0x2c8 &mdsc->dentry_list_lock 3878 [<00000000c0022f62>] __ceph_dentry_lease_touch+0x5c/0xa8 &mdsc->dentry_list_lock 9973 [<000000002f27cb6f>] __dentry_lease_unlist+0x50/0xa0 ----------------------- &mdsc->dentry_list_lock 123621 [<0000000050597999>] __dentry_leases_walk+0x64/0x2c8 &mdsc->dentry_list_lock 1822 [<000000007b11e319>] __ceph_dentry_dir_lease_touch+0x7c/0xa8 &mdsc->dentry_list_lock 2720 [<000000002f27cb6f>] __dentry_lease_unlist+0x50/0xa0 &mdsc->dentry_list_lock 55 [<00000000c0022f62>] __ceph_dentry_lease_touch+0x5c/0xa8 With this patch: class name con-bounces contentions waittime-min waittime-max waittime-total waittime-avg acq-bounces acquisitions holdtime-min holdtime-max holdtime-total holdtime-avg &mdsc->dentry_list_lock: 1203 1215 0.16 408.88 33082.88 27.23 4320501 7357389 0.04 500.64 1961578.00 0.27 ----------------------- &mdsc->dentry_list_lock 1029 [<000000003c9aea8a>] __ceph_dentry_dir_lease_touch+0x7c/0xa8 &mdsc->dentry_list_lock 169 [<000000002038c577>] __dentry_lease_unlist+0x50/0xa0 &mdsc->dentry_list_lock 16 [<00000000c991106d>] __ceph_dentry_lease_touch+0x5c/0xa8 &mdsc->dentry_list_lock 1 [<00000000612fe15f>] __dentry_leases_walk+0x64/0x2c8 ----------------------- &mdsc->dentry_list_lock 158 [<000000002038c577>] __dentry_lease_unlist+0x50/0xa0 &mdsc->dentry_list_lock 858 [<000000003c9aea8a>] __ceph_dentry_dir_lease_touch+0x7c/0xa8 &mdsc->dentry_list_lock 182 [<00000000612fe15f>] __dentry_leases_walk+0x64/0x2c8 &mdsc->dentry_list_lock 17 [<00000000c991106d>] __ceph_dentry_lease_touch+0x5c/0xa8 __dentry_leases_walk() is almost gone. The total wait time is reduced by a factor of 483. That will give some latency gains to ceph_readdir(). Cc: stable(a)vger.kernel.org Fixes: 37c4efc1ddf9 ("ceph: periodically trim stale dentries") Signed-off-by: Max Kellermann <max.kellermann(a)ionos.com> Reviewed-by: Alex Markuze <amarkuze(a)redhat.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Conflicts: fs/ceph/dir.c [backport to OLK-5.10: the three upstream semantic changes are taken verbatim - __dir_lease_check() now returns KEEP instead of TOUCH when expire_dir_lease is false (moved above the round-robin comment), the first -EAGAIN is gated on freed > 0, and ceph_trim_dentries() bails out with 0 when freed == 0 && count == 0. Only the two __dentry_leases_walk() call sites had to be adapted: this tree still passes the check callback as a third argument, because 2a965d1b15d28 ("ceph: get rid of passing callbacks in __dentry_leases_walk()", v6.8-rc1) is a pure cleanup that is neither present in OLK-5.10 nor part of this fix's dependency chain. linux-5.10.y LTS has not taken this fix, so mainline e7d7aa7b73017 is used as the baseline.] Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com> --- fs/ceph/dir.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c index 504693f6b72d..fafff54e30d5 100644 --- a/fs/ceph/dir.c +++ b/fs/ceph/dir.c @@ -1468,15 +1468,15 @@ static int __dir_lease_check(struct dentry *dentry, void *arg) if (ret == -EBUSY) return KEEP; if (ret > 0) { if (time_before(jiffies, di->time + lwc->dir_lease_ttl)) return STOP; + if (!lwc->expire_dir_lease) + return KEEP; /* Move dentry to tail of dir lease list if we don't want * to delete it. So dentries in the list are checked in a * round robin manner */ - if (!lwc->expire_dir_lease) - return TOUCH; if (dentry->d_lockref.count > 0 || (di->flags & CEPH_DENTRY_REFERENCED)) return TOUCH; /* invalidate dir lease */ di->lease_shared_gen = 0; @@ -1499,20 +1499,24 @@ int ceph_trim_dentries(struct ceph_mds_client *mdsc) spin_unlock(&mdsc->caps_list_lock); lwc.dir_lease = false; lwc.nr_to_scan = CEPH_CAPS_PER_RELEASE * 2; freed = __dentry_leases_walk(mdsc, &lwc, __dentry_lease_check); - if (!lwc.nr_to_scan) /* more invalid leases */ + if (freed > 0 && !lwc.nr_to_scan) /* more invalid leases */ return -EAGAIN; if (lwc.nr_to_scan < CEPH_CAPS_PER_RELEASE) lwc.nr_to_scan = CEPH_CAPS_PER_RELEASE; lwc.dir_lease = true; lwc.expire_dir_lease = freed < count; lwc.dir_lease_ttl = mdsc->fsc->mount_options->caps_wanted_delay_max * HZ; freed +=__dentry_leases_walk(mdsc, &lwc, __dir_lease_check); + if (freed == 0 && count == 0) + /* no progress possible currently, retry futile */ + return 0; + if (!lwc.nr_to_scan) /* more to check */ return -EAGAIN; return freed > 0 ? 1 : 0; } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS V1] media: saa7164: fix cleanup on resource allocation failure
by Yao Yiqi 20 Sep '26

20 Sep '26

From: Guangshuo Li <lgs201920130244(a)gmail.com> stable inclusion from stable-v6.6.157 commit 77f216f8de6221efb6f6c471bc9e598f1879825b category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19083 CVE: CVE-2026-89877 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------ commit 28e84c6e2e6753ed238ea097b2842a32a6a6879b upstream. saa7164_dev_setup() adds the device to the global saa7164_devlist before requesting the PCI BAR memory regions. If get_resources() fails, saa7164_dev_setup() decrements the device count and returns an error, but leaves the device on saa7164_devlist. The probe error path then frees the device, leaving a dangling entry on the global list. Reuse the existing MMIO mapping error path to remove the device from saa7164_devlist and decrement the device count before returning. Also release BAR0 if it was successfully requested but the BAR2 request fails. Fixes: 443c1228d505 ("V4L/DVB (12923): SAA7164: Add support for the NXP SAA7164 silicon") Cc: stable(a)vger.kernel.org Signed-off-by: Guangshuo Li <lgs201920130244(a)gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/media/pci/saa7164/saa7164-core.c [ context conflicts ] Signed-off-by: Yao Yiqi <yaoyiqi3(a)huawei.com> --- drivers/media/pci/saa7164/saa7164-core.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/media/pci/saa7164/saa7164-core.c b/drivers/media/pci/saa7164/saa7164-core.c index 5102519df108..c067550db0d3 100644 --- a/drivers/media/pci/saa7164/saa7164-core.c +++ b/drivers/media/pci/saa7164/saa7164-core.c @@ -892,6 +892,9 @@ static int get_resources(struct saa7164_dev *dev) if (request_mem_region(pci_resource_start(dev->pci, 2), pci_resource_len(dev->pci, 2), dev->name)) return 0; + + release_mem_region(pci_resource_start(dev->pci, 0), + pci_resource_len(dev->pci, 0)); } printk(KERN_ERR "%s: can't get MMIO memory @ 0x%llx or 0x%llx\n", @@ -1006,6 +1009,10 @@ static int saa7164_dev_setup(struct saa7164_dev *dev) dev->name, dev->pci->subsystem_vendor, dev->pci->subsystem_device); + mutex_lock(&devlist); + list_del(&dev->devlist); + mutex_unlock(&devlist); + saa7164_devcount--; return -ENODEV; } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] tracing: Take trace_array reference when opening options file
by Tengda Wu 20 Sep '26

20 Sep '26

From: Steven Rostedt <rostedt(a)goodmis.org> mainline inclusion from mainline-v7.3-rc2 commit f2951ebd15c36a1ea4820a7f0cbb0b5f1c028b73 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19114 CVE: CVE-2026-90013 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The options files do not take the trace_array reference for the options they represent. This could cause a use-after-free kernel crash if one of these files is opened by one task and another task removes the instance that the option is for. Because it doesn't take a reference upon opening, it will not stop the removal which will free the options descriptor that is being used. As the options are somewhat dynamic in their creation at boot up, each file represents a flag in the trace_array. The trace_array has an array of indexes to represent each of these flags that is stored in the trace_flags_index array. The address of the index array element is used to pass to the inode->i_private pointer. Then that element is read which holds the index (which represents the flag) and then the index is used to calculate the trace_array descriptor from its trace_flags_index array. One issue is that the index element can not be referenced until the trace_array's reference is taken. To handle this, create a new helper function called: trace_array_options_get() that will iterate all the existing trace_arrays in the ftrace_trace_arrays list (under the trace_types_lock), and compare the passed in address of the index element with the entire array of the trace_array's trace_flags_index array. If it matches, then up the corresponding trace_array's reference and return. Cc: stable(a)vger.kernel.org Link: https://patch.msgid.link/20260902121918.5a9e9d1b@gandalf.local.home Fixes: 577b785f55168 ("tracing: add tracer dependent options to options directory") Reported-by: sashiko-bot(a)kernel.org Closes: https://lore.kernel.org/linux-trace-kernel/20260828135858.2AC501F000E9@smtp… Signed-off-by: Steven Rostedt <rostedt(a)goodmis.org> Conflicts: kernel/trace/trace.c [1. This version lacks the lock-free __trace_array_get, which is hidden inside a refactoring patch in the mainline, commit eca33fdab47b. To avoid introducing that refactoring patch, __trace_array_get was manually adapted. 2. This version has no security_locked_down(LOCKDOWN_TRACEFS) mechanism, so it was removed.] Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/trace/trace.c | 76 ++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 70 insertions(+), 6 deletions(-) diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c index e85b2e082085..99077926ba5d 100644 --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -275,6 +275,12 @@ static struct trace_array global_trace = { LIST_HEAD(ftrace_trace_arrays); +static int __trace_array_get(struct trace_array *this_tr) +{ + this_tr->ref++; + return 0; +} + int trace_array_get(struct trace_array *this_tr) { struct trace_array *tr; @@ -283,8 +289,7 @@ int trace_array_get(struct trace_array *this_tr) mutex_lock(&trace_types_lock); list_for_each_entry(tr, &ftrace_trace_arrays, list) { if (tr == this_tr) { - tr->ref++; - ret = 0; + ret = __trace_array_get(tr); break; } } @@ -7496,11 +7501,70 @@ trace_options_core_write(struct file *filp, const char __user *ubuf, size_t cnt, return cnt; } +/* + * The tr_index is the address of a trace_array->trace_flags_index[] + * element that holds the index of the trace flag. But since the + * trace_array reference has not been taken yet, it cannot be referenced + * as it could have been freed by a rmdir of the instance the trace_array + * represents. + * + * Search the list of trace_arrays and compare the tr_index to the + * address of the entire trace_array trace_flags_index array for each + * trace_array in the list. If one is matched, then take the reference + * and return it. If not, the trace_array no longer exits. + */ +static int trace_array_options_get(void *tr_index) +{ + struct trace_array *tr; + int ret; + + if (tracing_disabled) + return -ENODEV; + + mutex_lock(&trace_types_lock); + list_for_each_entry(tr, &ftrace_trace_arrays, list) { + if (tr_index >= (void *)&tr->trace_flags_index[0] && + tr_index < (void *)&tr->trace_flags_index[TRACE_FLAGS_MAX_SIZE]) { + ret = __trace_array_get(tr); + mutex_unlock(&trace_types_lock); + return ret; + } + } + mutex_unlock(&trace_types_lock); + return -ENODEV; +} + +static int trace_options_open(struct inode *inode, struct file *filp) +{ + void *tr_index = inode->i_private; + + if (trace_array_options_get(tr_index) < 0) + return -ENODEV; + + filp->private_data = tr_index; + + return 0; +} + +static int trace_options_release(struct inode *inode, struct file *filp) +{ + void *tr_index = filp->private_data; + struct trace_array *tr; + unsigned int index; + + get_tr_index(tr_index, &tr, &index); + + trace_array_put(tr); + + return 0; +} + static const struct file_operations trace_options_core_fops = { - .open = tracing_open_generic, - .read = trace_options_core_read, - .write = trace_options_core_write, - .llseek = generic_file_llseek, + .open = trace_options_open, + .read = trace_options_core_read, + .write = trace_options_core_write, + .llseek = generic_file_llseek, + .release = trace_options_release, }; struct dentry *trace_create_file(const char *name, -- 2.34.1

2 1

[PATCH OLK-5.10 v4 0/2] CVE-2026-89580
by Pu Lehui 20 Sep '26

20 Sep '26

Andrii Nakryiko (1): bpf: decouple stack_map_get_build_id_offset() from perf_callchain_entry Daniel Borkmann (1): bpf: Disable preemption in __bpf_get_stack kernel/bpf/stackmap.c | 57 +++++++++++++++++++++++++++++++------------ 1 file changed, 42 insertions(+), 15 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 v4 0/2] CVE-2026-89580
by Pu Lehui 20 Sep '26

20 Sep '26

Andrii Nakryiko (1): bpf: decouple stack_map_get_build_id_offset() from perf_callchain_entry Daniel Borkmann (1): bpf: Disable preemption in __bpf_get_stack kernel/bpf/stackmap.c | 62 ++++++++++++++++++++++++++++++------------- 1 file changed, 44 insertions(+), 18 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS V1] media: saa7164: fix cleanup on resource allocation failure
by Yao Yiqi 20 Sep '26

20 Sep '26

From: Guangshuo Li <lgs201920130244(a)gmail.com> stable inclusion from stable-v6.1.188 commit daa5b32cdf7db81a07ee2a91ce092a363e7754aa category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19083 CVE: CVE-2026-89877 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------ commit 28e84c6e2e6753ed238ea097b2842a32a6a6879b upstream. saa7164_dev_setup() adds the device to the global saa7164_devlist before requesting the PCI BAR memory regions. If get_resources() fails, saa7164_dev_setup() decrements the device count and returns an error, but leaves the device on saa7164_devlist. The probe error path then frees the device, leaving a dangling entry on the global list. Reuse the existing MMIO mapping error path to remove the device from saa7164_devlist and decrement the device count before returning. Also release BAR0 if it was successfully requested but the BAR2 request fails. Fixes: 443c1228d505 ("V4L/DVB (12923): SAA7164: Add support for the NXP SAA7164 silicon") Cc: stable(a)vger.kernel.org Signed-off-by: Guangshuo Li <lgs201920130244(a)gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/media/pci/saa7164/saa7164-core.c [ context conflicts ] Signed-off-by: Yao Yiqi <yaoyiqi3(a)huawei.com> --- drivers/media/pci/saa7164/saa7164-core.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/media/pci/saa7164/saa7164-core.c b/drivers/media/pci/saa7164/saa7164-core.c index 5102519df108..c067550db0d3 100644 --- a/drivers/media/pci/saa7164/saa7164-core.c +++ b/drivers/media/pci/saa7164/saa7164-core.c @@ -892,6 +892,9 @@ static int get_resources(struct saa7164_dev *dev) if (request_mem_region(pci_resource_start(dev->pci, 2), pci_resource_len(dev->pci, 2), dev->name)) return 0; + + release_mem_region(pci_resource_start(dev->pci, 0), + pci_resource_len(dev->pci, 0)); } printk(KERN_ERR "%s: can't get MMIO memory @ 0x%llx or 0x%llx\n", @@ -1006,6 +1009,10 @@ static int saa7164_dev_setup(struct saa7164_dev *dev) dev->name, dev->pci->subsystem_vendor, dev->pci->subsystem_device); + mutex_lock(&devlist); + list_del(&dev->devlist); + mutex_unlock(&devlist); + saa7164_devcount--; return -ENODEV; } -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] CVE-2026-90037 and CVE-2026-90036 v2
by Yifan Qiao 20 Sep '26

20 Sep '26

Chuck Lever (2): NFSD: Prevent client use-after-free during blocked-lock reaping NFSD: Prevent client use-after-free during close_lru reaping fs/nfsd/nfs4state.c | 52 ++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 49 insertions(+), 3 deletions(-) -- 2.52.0

2 3

[PATCH openEuler-1.0-LTS] tracing: Take trace_array reference when opening options file
by Tengda Wu 20 Sep '26

20 Sep '26

From: Steven Rostedt <rostedt(a)goodmis.org> mainline inclusion from mainline-v7.3-rc2 commit f2951ebd15c36a1ea4820a7f0cbb0b5f1c028b73 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19114 CVE: CVE-2026-90013 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The options files do not take the trace_array reference for the options they represent. This could cause a use-after-free kernel crash if one of these files is opened by one task and another task removes the instance that the option is for. Because it doesn't take a reference upon opening, it will not stop the removal which will free the options descriptor that is being used. As the options are somewhat dynamic in their creation at boot up, each file represents a flag in the trace_array. The trace_array has an array of indexes to represent each of these flags that is stored in the trace_flags_index array. The address of the index array element is used to pass to the inode->i_private pointer. Then that element is read which holds the index (which represents the flag) and then the index is used to calculate the trace_array descriptor from its trace_flags_index array. One issue is that the index element can not be referenced until the trace_array's reference is taken. To handle this, create a new helper function called: trace_array_options_get() that will iterate all the existing trace_arrays in the ftrace_trace_arrays list (under the trace_types_lock), and compare the passed in address of the index element with the entire array of the trace_array's trace_flags_index array. If it matches, then up the corresponding trace_array's reference and return. Cc: stable(a)vger.kernel.org Link: https://patch.msgid.link/20260902121918.5a9e9d1b@gandalf.local.home Fixes: 577b785f55168 ("tracing: add tracer dependent options to options directory") Reported-by: sashiko-bot(a)kernel.org Closes: https://lore.kernel.org/linux-trace-kernel/20260828135858.2AC501F000E9@smtp… Signed-off-by: Steven Rostedt <rostedt(a)goodmis.org> Conflicts: kernel/trace/trace.c [1. This version lacks the lock-free __trace_array_get, which is hidden inside a refactoring patch in the mainline, commit eca33fdab47b. To avoid introducing that refactoring patch, __trace_array_get was manually adapted. 2. This version has no security_locked_down(LOCKDOWN_TRACEFS) mechanism, so it was removed.] Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/trace/trace.c | 75 ++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 69 insertions(+), 6 deletions(-) diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c index e85b2e082085..76510d3f3b27 100644 --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -275,6 +275,12 @@ static struct trace_array global_trace = { LIST_HEAD(ftrace_trace_arrays); +static int __trace_array_get(struct trace_array *this_tr) +{ + this_tr->ref++; + return 0; +} + int trace_array_get(struct trace_array *this_tr) { struct trace_array *tr; @@ -283,8 +289,7 @@ int trace_array_get(struct trace_array *this_tr) mutex_lock(&trace_types_lock); list_for_each_entry(tr, &ftrace_trace_arrays, list) { if (tr == this_tr) { - tr->ref++; - ret = 0; + ret = __trace_array_get(tr); break; } } @@ -7496,11 +7501,69 @@ trace_options_core_write(struct file *filp, const char __user *ubuf, size_t cnt, return cnt; } +/* + * The tr_index is the address of a trace_array->trace_flags_index[] + * element that holds the index of the trace flag. But since the + * trace_array reference has not been taken yet, it cannot be referenced + * as it could have been freed by a rmdir of the instance the trace_array + * represents. + * + * Search the list of trace_arrays and compare the tr_index to the + * address of the entire trace_array trace_flags_index array for each + * trace_array in the list. If one is matched, then take the reference + * and return it. If not, the trace_array no longer exits. + */ +static int trace_array_options_get(void *tr_index) +{ + struct trace_array *tr; + + if (tracing_disabled) + return -ENODEV; + + mutex_lock(&trace_types_lock); + list_for_each_entry(tr, &ftrace_trace_arrays, list) { + if (tr_index >= (void *)&tr->trace_flags_index[0] && + tr_index < (void *)&tr->trace_flags_index[TRACE_FLAGS_MAX_SIZE]) { + ret = __trace_array_get(tr); + mutex_unlock(&trace_types_lock); + return ret; + } + } + mutex_unlock(&trace_types_lock); + return -ENODEV; +} + +static int trace_options_open(struct inode *inode, struct file *filp) +{ + void *tr_index = inode->i_private; + + if (trace_array_options_get(tr_index) < 0) + return -ENODEV; + + filp->private_data = tr_index; + + return 0; +} + +static int trace_options_release(struct inode *inode, struct file *filp) +{ + void *tr_index = filp->private_data; + struct trace_array *tr; + unsigned int index; + + get_tr_index(tr_index, &tr, &index); + + trace_array_put(tr); + + return 0; +} + static const struct file_operations trace_options_core_fops = { - .open = tracing_open_generic, - .read = trace_options_core_read, - .write = trace_options_core_write, - .llseek = generic_file_llseek, + .open = trace_options_open, + .read = trace_options_core_read, + .write = trace_options_core_write, + .llseek = generic_file_llseek, + .release = trace_options_release, }; struct dentry *trace_create_file(const char *name, -- 2.34.1

2 1

[PATCH OLK-5.10] tracing: Take trace_array reference when opening options file
by Tengda Wu 20 Sep '26

20 Sep '26

From: Steven Rostedt <rostedt(a)goodmis.org> mainline inclusion from mainline-v7.3-rc2 commit f2951ebd15c36a1ea4820a7f0cbb0b5f1c028b73 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19114 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The options files do not take the trace_array reference for the options they represent. This could cause a use-after-free kernel crash if one of these files is opened by one task and another task removes the instance that the option is for. Because it doesn't take a reference upon opening, it will not stop the removal which will free the options descriptor that is being used. As the options are somewhat dynamic in their creation at boot up, each file represents a flag in the trace_array. The trace_array has an array of indexes to represent each of these flags that is stored in the trace_flags_index array. The address of the index array element is used to pass to the inode->i_private pointer. Then that element is read which holds the index (which represents the flag) and then the index is used to calculate the trace_array descriptor from its trace_flags_index array. One issue is that the index element can not be referenced until the trace_array's reference is taken. To handle this, create a new helper function called: trace_array_options_get() that will iterate all the existing trace_arrays in the ftrace_trace_arrays list (under the trace_types_lock), and compare the passed in address of the index element with the entire array of the trace_array's trace_flags_index array. If it matches, then up the corresponding trace_array's reference and return. Cc: stable(a)vger.kernel.org Link: https://patch.msgid.link/20260902121918.5a9e9d1b@gandalf.local.home Fixes: 577b785f55168 ("tracing: add tracer dependent options to options directory") Reported-by: sashiko-bot(a)kernel.org Closes: https://lore.kernel.org/linux-trace-kernel/20260828135858.2AC501F000E9@smtp… Signed-off-by: Steven Rostedt <rostedt(a)goodmis.org> Conflicts: kernel/trace/trace.c [This version lacks the lock-free __trace_array_get, which is hidden inside a refactoring patch in the mainline, commit eca33fdab47b. To avoid introducing that refactoring patch, __trace_array_get was manually adapted.] Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/trace/trace.c | 80 ++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 74 insertions(+), 6 deletions(-) diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c index 8c4e4cfa2945..b15c07c3050e 100644 --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -433,6 +433,12 @@ static struct trace_array global_trace = { LIST_HEAD(ftrace_trace_arrays); +static int __trace_array_get(struct trace_array *this_tr) +{ + this_tr->ref++; + return 0; +} + int trace_array_get(struct trace_array *this_tr) { struct trace_array *tr; @@ -441,8 +447,7 @@ int trace_array_get(struct trace_array *this_tr) mutex_lock(&trace_types_lock); list_for_each_entry(tr, &ftrace_trace_arrays, list) { if (tr == this_tr) { - tr->ref++; - ret = 0; + ret = __trace_array_get(tr); break; } } @@ -8538,11 +8543,74 @@ trace_options_core_write(struct file *filp, const char __user *ubuf, size_t cnt, return cnt; } +/* + * The tr_index is the address of a trace_array->trace_flags_index[] + * element that holds the index of the trace flag. But since the + * trace_array reference has not been taken yet, it cannot be referenced + * as it could have been freed by a rmdir of the instance the trace_array + * represents. + * + * Search the list of trace_arrays and compare the tr_index to the + * address of the entire trace_array trace_flags_index array for each + * trace_array in the list. If one is matched, then take the reference + * and return it. If not, the trace_array no longer exits. + */ +static int trace_array_options_get(void *tr_index) +{ + struct trace_array *tr; + int ret; + + ret = security_locked_down(LOCKDOWN_TRACEFS); + if (ret) + return ret; + + if (tracing_disabled) + return -ENODEV; + + mutex_lock(&trace_types_lock); + list_for_each_entry(tr, &ftrace_trace_arrays, list) { + if (tr_index >= (void *)&tr->trace_flags_index[0] && + tr_index < (void *)&tr->trace_flags_index[TRACE_FLAGS_MAX_SIZE]) { + ret = __trace_array_get(tr); + mutex_unlock(&trace_types_lock); + return ret; + } + } + mutex_unlock(&trace_types_lock); + return -ENODEV; +} + +static int trace_options_open(struct inode *inode, struct file *filp) +{ + void *tr_index = inode->i_private; + + if (trace_array_options_get(tr_index) < 0) + return -ENODEV; + + filp->private_data = tr_index; + + return 0; +} + +static int trace_options_release(struct inode *inode, struct file *filp) +{ + void *tr_index = filp->private_data; + struct trace_array *tr; + unsigned int index; + + get_tr_index(tr_index, &tr, &index); + + trace_array_put(tr); + + return 0; +} + static const struct file_operations trace_options_core_fops = { - .open = tracing_open_generic, - .read = trace_options_core_read, - .write = trace_options_core_write, - .llseek = generic_file_llseek, + .open = trace_options_open, + .read = trace_options_core_read, + .write = trace_options_core_write, + .llseek = generic_file_llseek, + .release = trace_options_release, }; struct dentry *trace_create_file(const char *name, -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS v2] ceph: bound num_export_targets array for mds info v2/v3
by Pu Lehui 20 Sep '26

20 Sep '26

From: Michael Bommarito <michael.bommarito(a)gmail.com> mainline inclusion from mainline-v7.3-rc1 commit a3eb169ee297aa99670ba927c659990bd1e453f3 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19003 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- ceph_mdsmap_decode() in fs/ceph/mdsmap.c reads num_export_targets from each per-mds info record and advances the decode cursor by num_export_targets * sizeof(u32) without first checking that many bytes remain. The only upper-bound check that catches a runaway cursor (*p > info_end) is gated on info_v >= 4, because info_end is left NULL for info_v 2 and 3. When the monitor sends an MDS map whose per-mds info version is 2 or 3 with an oversized num_export_targets, the cursor moves past the message front buffer and the later export-targets loop calls the unchecked ceph_decode_32() on out-of-bounds memory. A kernel client processes CEPH_MSG_MDS_MAP from its monitor session (net/ceph/mon_client.c dispatches it; fs/ceph/super.c routes it to ceph_mdsc_handle_mdsmap(), which sets end to the front buffer bound and calls ceph_mdsmap_decode()). A malicious or compromised monitor, or an on-path attacker on an unsigned/unencrypted messenger session, can therefore drive an out-of-bounds read in the client kernel; on x86_64 with KASAN it is reported as a slab-out-of-bounds read in ceph_mdsmap_decode(). The decoded values land in the internal info->export_targets[] array, so the consequence is a kernel out-of-bounds read, not an information leak to the attacker. Impact: a malicious or compromised Ceph monitor sending an MDS map with a per-mds info version of 2 or 3 and an oversized num_export_targets field triggers an out-of-bounds read in the CephFS client kernel. Add a ceph_decode_need() for the export-targets array before advancing the cursor, so the bound is enforced for every info_v >= 2, not only info_v >= 4. This mirrors the count-then-need idiom already used for m_data_pg_pools later in the same function. Compute the export-targets byte count with size_mul() and reuse that checked length when advancing the cursor, so the attacker-controlled num_export_targets multiplication fails closed on overflow rather than relying on the later kcalloc() guard. Cc: stable(a)vger.kernel.org Fixes: d463a43d69f4 ("ceph: CEPH_FEATURE_MDSENC support") Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Reviewed-by: Viacheslav Dubeyko <slava(a)dubeyko.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Conflicts: fs/ceph/mdsmap.c [size_mul -> array_size] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- fs/ceph/mdsmap.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/fs/ceph/mdsmap.c b/fs/ceph/mdsmap.c index 44e53abeb32a..0091f2d88aa1 100644 --- a/fs/ceph/mdsmap.c +++ b/fs/ceph/mdsmap.c @@ -3,6 +3,7 @@ #include <linux/bug.h> #include <linux/err.h> +#include <linux/overflow.h> #include <linux/random.h> #include <linux/slab.h> #include <linux/types.h> @@ -111,6 +112,7 @@ struct ceph_mdsmap *ceph_mdsmap_decode(void **p, void *end) int err = -EINVAL; u8 mdsmap_v, mdsmap_cv; u16 mdsmap_ev; + size_t export_targets_len; m = kzalloc(sizeof(*m), GFP_NOFS); if (!m) @@ -192,8 +194,11 @@ struct ceph_mdsmap *ceph_mdsmap_decode(void **p, void *end) *p += namelen; if (info_v >= 2) { ceph_decode_32_safe(p, end, num_export_targets, bad); + export_targets_len = array_size(num_export_targets, + sizeof(u32)); + ceph_decode_need(p, end, export_targets_len, bad); pexport_targets = *p; - *p += num_export_targets * sizeof(u32); + *p += export_targets_len; } else { num_export_targets = 0; } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS V1] HID: synchronize input before cleaning up a failed probe
by Yao Yiqi 20 Sep '26

20 Sep '26

From: Yousef Alhouseen <alhouseenyousef(a)gmail.com> stable inclusion from stable-v5.10.270 commit 3ffb088a2ed34ca982cfc2c81d107ce370aa45f1 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19484 CVE: CVE-2026-90329 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------ [ Upstream commit 207853d46f7ef2e28042344a1468da8754c3ddbf ] hid_device_io_start() allows reports to run concurrently with probe. If the probe subsequently fails, __hid_device_probe() releases driver resources and clears hdev->driver without first excluding those report callbacks. For example, a report may enter hidraw_report_event() while the failure path frees the associated hidraw object, leading to a use-after-free when the report takes the object's list lock. Stop input before performing failed-probe cleanup. This reacquires driver_input_lock and waits for any report callback already in progress. Fixes: c849a6143bec ("HID: Separate struct hid_device's driver_lock into two locks.") Reported-by: syzbot+9eebf5f6544c5e873858(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=9eebf5f6544c5e873858 Signed-off-by: Yousef Alhouseen <alhouseenyousef(a)gmail.com> Signed-off-by: Jiri Kosina <jkosina(a)suse.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/hid/hid-core.c [ 4.19 does not have __hid_device_probe, added in hid_device_probe ] Signed-off-by: Yao Yiqi <yaoyiqi3(a)huawei.com> --- drivers/hid/hid-core.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c index 61b614072e05..8041a90afb7d 100644 --- a/drivers/hid/hid-core.c +++ b/drivers/hid/hid-core.c @@ -2097,6 +2097,8 @@ static int hid_device_probe(struct device *dev) ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT); } if (ret) { + if (hdev->io_started) + hid_device_io_stop(hdev); hid_close_report(hdev); hdev->driver = NULL; } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] ieee802154: admin-gate legacy LLSEC dump operations
by Gu Bowen 20 Sep '26

20 Sep '26

From: Michael Bommarito <michael.bommarito(a)gmail.com> mainline inclusion from mainline-v7.2-rc1 commit 9c1e0b6d49471a712511d23fc9d06901561135e8 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17950 CVE: CVE-2026-72049 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In net/ieee802154/netlink.c, the legacy IEEE802154_NL family ops table builds the LLSEC dump entries (LLSEC_LIST_KEY, LLSEC_LIST_DEV, LLSEC_LIST_DEVKEY, LLSEC_LIST_SECLEVEL) with IEEE802154_DUMP() which sets no .flags, so generic netlink runs them ungated. The modern nl802154 family admin-gates the equivalent reads via NL802154_CMD_GET_SEC_KEY and friends with .flags = GENL_ADMIN_PERM. Any local uid that can open AF_NETLINK / NETLINK_GENERIC can resolve the "802.15.4 MAC" family and dump LLSEC_LIST_KEY on any wpan netdev that has an LLSEC key installed; the dump handler writes the raw 16-byte AES-128 key bytes (IEEE802154_ATTR_LLSEC_KEY_BYTES, copied verbatim from struct ieee802154_llsec_key.key) into the reply. Recovering the AES key compromises 802.15.4 LLSEC link confidentiality and authenticity, since LLSEC uses CCM* and the same key authenticates and encrypts frames. Impact: any local uid with no capabilities can read the raw 16-byte AES-128 LLSEC key from the kernel keytable on any wpan netdev that has an administrator-installed LLSEC key, by issuing an LLSEC_LIST_KEY dump on the legacy IEEE802154_NL generic-netlink family. Introduce IEEE802154_DUMP_PRIV() mirroring IEEE802154_DUMP() but setting .flags = GENL_ADMIN_PERM, and use it for the four LLSEC dump entries. LIST_PHY and LIST_IFACE retain IEEE802154_DUMP() because the modern nl802154 family exposes their equivalents to unprivileged readers by design (NL802154_CMD_GET_WPAN_PHY and NL802154_CMD_GET_INTERFACE carry "can be retrieved by unprivileged users" annotations). Fixes: 3e9c156e2c21 ("ieee802154: add netlink interfaces for llsec") Cc: stable(a)vger.kernel.org Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Link: https://lore.kernel.org/20260520141640.1149513-2-michael.bommarito@gmail.com Signed-off-by: Stefan Schmidt <stefan(a)datenfreihafen.org> Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- net/ieee802154/ieee802154.h | 8 ++++++++ net/ieee802154/netlink.c | 16 ++++++++-------- 2 files changed, 16 insertions(+), 8 deletions(-) diff --git a/net/ieee802154/ieee802154.h b/net/ieee802154/ieee802154.h index a5d7515b7f62..6ada0a87ad8a 100644 --- a/net/ieee802154/ieee802154.h +++ b/net/ieee802154/ieee802154.h @@ -34,6 +34,14 @@ void ieee802154_nl_exit(void); .dumpit = _dump, \ } +#define IEEE802154_DUMP_PRIV(_cmd, _func, _dump) \ + { \ + .cmd = _cmd, \ + .doit = _func, \ + .dumpit = _dump, \ + .flags = GENL_ADMIN_PERM, \ + } + struct genl_info; struct sk_buff *ieee802154_nl_create(int flags, u8 req); diff --git a/net/ieee802154/netlink.c b/net/ieee802154/netlink.c index 96636e3b7aa9..4504b34168f0 100644 --- a/net/ieee802154/netlink.c +++ b/net/ieee802154/netlink.c @@ -106,20 +106,20 @@ static const struct genl_ops ieee802154_ops[] = { IEEE802154_OP(IEEE802154_SET_MACPARAMS, ieee802154_set_macparams), IEEE802154_OP(IEEE802154_LLSEC_GETPARAMS, ieee802154_llsec_getparams), IEEE802154_OP(IEEE802154_LLSEC_SETPARAMS, ieee802154_llsec_setparams), - IEEE802154_DUMP(IEEE802154_LLSEC_LIST_KEY, NULL, - ieee802154_llsec_dump_keys), + IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_KEY, NULL, + ieee802154_llsec_dump_keys), IEEE802154_OP(IEEE802154_LLSEC_ADD_KEY, ieee802154_llsec_add_key), IEEE802154_OP(IEEE802154_LLSEC_DEL_KEY, ieee802154_llsec_del_key), - IEEE802154_DUMP(IEEE802154_LLSEC_LIST_DEV, NULL, - ieee802154_llsec_dump_devs), + IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_DEV, NULL, + ieee802154_llsec_dump_devs), IEEE802154_OP(IEEE802154_LLSEC_ADD_DEV, ieee802154_llsec_add_dev), IEEE802154_OP(IEEE802154_LLSEC_DEL_DEV, ieee802154_llsec_del_dev), - IEEE802154_DUMP(IEEE802154_LLSEC_LIST_DEVKEY, NULL, - ieee802154_llsec_dump_devkeys), + IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_DEVKEY, NULL, + ieee802154_llsec_dump_devkeys), IEEE802154_OP(IEEE802154_LLSEC_ADD_DEVKEY, ieee802154_llsec_add_devkey), IEEE802154_OP(IEEE802154_LLSEC_DEL_DEVKEY, ieee802154_llsec_del_devkey), - IEEE802154_DUMP(IEEE802154_LLSEC_LIST_SECLEVEL, NULL, - ieee802154_llsec_dump_seclevels), + IEEE802154_DUMP_PRIV(IEEE802154_LLSEC_LIST_SECLEVEL, NULL, + ieee802154_llsec_dump_seclevels), IEEE802154_OP(IEEE802154_LLSEC_ADD_SECLEVEL, ieee802154_llsec_add_seclevel), IEEE802154_OP(IEEE802154_LLSEC_DEL_SECLEVEL, -- 2.43.0

2 1

[PATCH OLK-5.10] tracing: Take trace_array reference when opening options file
by Tengda Wu 18 Sep '26

18 Sep '26

From: Steven Rostedt <rostedt(a)goodmis.org> mainline inclusion from mainline-v7.3-rc2 commit f2951ebd15c36a1ea4820a7f0cbb0b5f1c028b73 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19114 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The options files do not take the trace_array reference for the options they represent. This could cause a use-after-free kernel crash if one of these files is opened by one task and another task removes the instance that the option is for. Because it doesn't take a reference upon opening, it will not stop the removal which will free the options descriptor that is being used. As the options are somewhat dynamic in their creation at boot up, each file represents a flag in the trace_array. The trace_array has an array of indexes to represent each of these flags that is stored in the trace_flags_index array. The address of the index array element is used to pass to the inode->i_private pointer. Then that element is read which holds the index (which represents the flag) and then the index is used to calculate the trace_array descriptor from its trace_flags_index array. One issue is that the index element can not be referenced until the trace_array's reference is taken. To handle this, create a new helper function called: trace_array_options_get() that will iterate all the existing trace_arrays in the ftrace_trace_arrays list (under the trace_types_lock), and compare the passed in address of the index element with the entire array of the trace_array's trace_flags_index array. If it matches, then up the corresponding trace_array's reference and return. Cc: stable(a)vger.kernel.org Link: https://patch.msgid.link/20260902121918.5a9e9d1b@gandalf.local.home Fixes: 577b785f55168 ("tracing: add tracer dependent options to options directory") Reported-by: sashiko-bot(a)kernel.org Closes: https://lore.kernel.org/linux-trace-kernel/20260828135858.2AC501F000E9@smtp… Signed-off-by: Steven Rostedt <rostedt(a)goodmis.org> Conflicts: kernel/trace/trace.c [This version lacks the lock-free __trace_array_get, which is hidden inside a refactoring patch in the mainline, commit eca33fdab47b. To avoid introducing that refactoring patch, __trace_array_get was manually adapted.] Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/trace/trace.c | 79 ++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 73 insertions(+), 6 deletions(-) diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c index 8c4e4cfa2945..7a57721c1a54 100644 --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -433,6 +433,12 @@ static struct trace_array global_trace = { LIST_HEAD(ftrace_trace_arrays); +static int __trace_array_get(struct trace_array *this_tr) +{ + this_tr->ref++; + return 0; +} + int trace_array_get(struct trace_array *this_tr) { struct trace_array *tr; @@ -441,8 +447,7 @@ int trace_array_get(struct trace_array *this_tr) mutex_lock(&trace_types_lock); list_for_each_entry(tr, &ftrace_trace_arrays, list) { if (tr == this_tr) { - tr->ref++; - ret = 0; + ret = __trace_array_get(tr); break; } } @@ -8538,11 +8543,73 @@ trace_options_core_write(struct file *filp, const char __user *ubuf, size_t cnt, return cnt; } +/* + * The tr_index is the address of a trace_array->trace_flags_index[] + * element that holds the index of the trace flag. But since the + * trace_array reference has not been taken yet, it cannot be referenced + * as it could have been freed by a rmdir of the instance the trace_array + * represents. + * + * Search the list of trace_arrays and compare the tr_index to the + * address of the entire trace_array trace_flags_index array for each + * trace_array in the list. If one is matched, then take the reference + * and return it. If not, the trace_array no longer exits. + */ +static int trace_array_options_get(void *tr_index) +{ + struct trace_array *tr; + int ret; + + ret = security_locked_down(LOCKDOWN_TRACEFS); + if (ret) + return ret; + + if (tracing_disabled) + return -ENODEV; + + mutex_lock(&trace_types_lock); + list_for_each_entry(tr, &ftrace_trace_arrays, list) { + if (tr_index >= (void *)&tr->trace_flags_index[0] && + tr_index < (void *)&tr->trace_flags_index[TRACE_FLAGS_MAX_SIZE]) { + mutex_unlock(&trace_types_lock); + return __trace_array_get(tr); + } + } + mutex_unlock(&trace_types_lock); + return -ENODEV; +} + +static int trace_options_open(struct inode *inode, struct file *filp) +{ + void *tr_index = inode->i_private; + + if (trace_array_options_get(tr_index) < 0) + return -ENODEV; + + filp->private_data = tr_index; + + return 0; +} + +static int trace_options_release(struct inode *inode, struct file *filp) +{ + void *tr_index = filp->private_data; + struct trace_array *tr; + unsigned int index; + + get_tr_index(tr_index, &tr, &index); + + trace_array_put(tr); + + return 0; +} + static const struct file_operations trace_options_core_fops = { - .open = tracing_open_generic, - .read = trace_options_core_read, - .write = trace_options_core_write, - .llseek = generic_file_llseek, + .open = trace_options_open, + .read = trace_options_core_read, + .write = trace_options_core_write, + .llseek = generic_file_llseek, + .release = trace_options_release, }; struct dentry *trace_create_file(const char *name, -- 2.34.1

2 1

[PATCH OLK-6.6] tracing: Take trace_array reference when opening options file
by Tengda Wu 18 Sep '26

18 Sep '26

From: Steven Rostedt <rostedt(a)goodmis.org> mainline inclusion from mainline-v7.3-rc2 commit f2951ebd15c36a1ea4820a7f0cbb0b5f1c028b73 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19114 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The options files do not take the trace_array reference for the options they represent. This could cause a use-after-free kernel crash if one of these files is opened by one task and another task removes the instance that the option is for. Because it doesn't take a reference upon opening, it will not stop the removal which will free the options descriptor that is being used. As the options are somewhat dynamic in their creation at boot up, each file represents a flag in the trace_array. The trace_array has an array of indexes to represent each of these flags that is stored in the trace_flags_index array. The address of the index array element is used to pass to the inode->i_private pointer. Then that element is read which holds the index (which represents the flag) and then the index is used to calculate the trace_array descriptor from its trace_flags_index array. One issue is that the index element can not be referenced until the trace_array's reference is taken. To handle this, create a new helper function called: trace_array_options_get() that will iterate all the existing trace_arrays in the ftrace_trace_arrays list (under the trace_types_lock), and compare the passed in address of the index element with the entire array of the trace_array's trace_flags_index array. If it matches, then up the corresponding trace_array's reference and return. Cc: stable(a)vger.kernel.org Link: https://patch.msgid.link/20260902121918.5a9e9d1b@gandalf.local.home Fixes: 577b785f55168 ("tracing: add tracer dependent options to options directory") Reported-by: sashiko-bot(a)kernel.org Closes: https://lore.kernel.org/linux-trace-kernel/20260828135858.2AC501F000E9@smtp… Signed-off-by: Steven Rostedt <rostedt(a)goodmis.org> Conflicts: kernel/trace/trace.c [This version lacks the lock-free __trace_array_get, which is hidden inside a refactoring patch in the mainline, commit eca33fdab47b. To avoid introducing that refactoring patch, __trace_array_get was manually adapted.] Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/trace/trace.c | 76 ++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 70 insertions(+), 6 deletions(-) diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c index 62d20a0d737b..962705fa7894 100644 --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -493,6 +493,12 @@ static struct trace_array global_trace = { LIST_HEAD(ftrace_trace_arrays); +static int __trace_array_get(struct trace_array *this_tr) +{ + this_tr->ref++; + return 0; +} + int trace_array_get(struct trace_array *this_tr) { struct trace_array *tr; @@ -501,8 +507,7 @@ int trace_array_get(struct trace_array *this_tr) mutex_lock(&trace_types_lock); list_for_each_entry(tr, &ftrace_trace_arrays, list) { if (tr == this_tr) { - tr->ref++; - ret = 0; + ret = __trace_array_get(tr); break; } } @@ -9032,11 +9037,70 @@ trace_options_core_write(struct file *filp, const char __user *ubuf, size_t cnt, return cnt; } +/* + * The tr_index is the address of a trace_array->trace_flags_index[] + * element that holds the index of the trace flag. But since the + * trace_array reference has not been taken yet, it cannot be referenced + * as it could have been freed by a rmdir of the instance the trace_array + * represents. + * + * Search the list of trace_arrays and compare the tr_index to the + * address of the entire trace_array trace_flags_index array for each + * trace_array in the list. If one is matched, then take the reference + * and return it. If not, the trace_array no longer exits. + */ +static int trace_array_options_get(void *tr_index) +{ + struct trace_array *tr; + int ret; + + ret = security_locked_down(LOCKDOWN_TRACEFS); + if (ret) + return ret; + + if (tracing_disabled) + return -ENODEV; + + guard(mutex)(&trace_types_lock); + list_for_each_entry(tr, &ftrace_trace_arrays, list) { + if (tr_index >= (void *)&tr->trace_flags_index[0] && + tr_index < (void *)&tr->trace_flags_index[TRACE_FLAGS_MAX_SIZE]) + return __trace_array_get(tr); + } + return -ENODEV; +} + +static int trace_options_open(struct inode *inode, struct file *filp) +{ + void *tr_index = inode->i_private; + + if (trace_array_options_get(tr_index) < 0) + return -ENODEV; + + filp->private_data = tr_index; + + return 0; +} + +static int trace_options_release(struct inode *inode, struct file *filp) +{ + void *tr_index = filp->private_data; + struct trace_array *tr; + unsigned int index; + + get_tr_index(tr_index, &tr, &index); + + trace_array_put(tr); + + return 0; +} + static const struct file_operations trace_options_core_fops = { - .open = tracing_open_generic, - .read = trace_options_core_read, - .write = trace_options_core_write, - .llseek = generic_file_llseek, + .open = trace_options_open, + .read = trace_options_core_read, + .write = trace_options_core_write, + .llseek = generic_file_llseek, + .release = trace_options_release, }; struct dentry *trace_create_file(const char *name, -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] tracing: Take trace_array reference when opening options file
by Tengda Wu 18 Sep '26

18 Sep '26

From: Steven Rostedt <rostedt(a)goodmis.org> mainline inclusion from mainline-v7.3-rc2 commit f2951ebd15c36a1ea4820a7f0cbb0b5f1c028b73 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19114 CVE: CVE-2026-90013 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The options files do not take the trace_array reference for the options they represent. This could cause a use-after-free kernel crash if one of these files is opened by one task and another task removes the instance that the option is for. Because it doesn't take a reference upon opening, it will not stop the removal which will free the options descriptor that is being used. As the options are somewhat dynamic in their creation at boot up, each file represents a flag in the trace_array. The trace_array has an array of indexes to represent each of these flags that is stored in the trace_flags_index array. The address of the index array element is used to pass to the inode->i_private pointer. Then that element is read which holds the index (which represents the flag) and then the index is used to calculate the trace_array descriptor from its trace_flags_index array. One issue is that the index element can not be referenced until the trace_array's reference is taken. To handle this, create a new helper function called: trace_array_options_get() that will iterate all the existing trace_arrays in the ftrace_trace_arrays list (under the trace_types_lock), and compare the passed in address of the index element with the entire array of the trace_array's trace_flags_index array. If it matches, then up the corresponding trace_array's reference and return. Cc: stable(a)vger.kernel.org Link: https://patch.msgid.link/20260902121918.5a9e9d1b@gandalf.local.home Fixes: 577b785f55168 ("tracing: add tracer dependent options to options directory") Reported-by: sashiko-bot(a)kernel.org Closes: https://lore.kernel.org/linux-trace-kernel/20260828135858.2AC501F000E9@smtp… Signed-off-by: Steven Rostedt <rostedt(a)goodmis.org> Conflicts: kernel/trace/trace.c [1. This version lacks the lock-free __trace_array_get, which is hidden inside a refactoring patch in the mainline, commit eca33fdab47b. To avoid introducing that refactoring patch, __trace_array_get was manually adapted. 2. This version has no security_locked_down(LOCKDOWN_TRACEFS) mechanism, so it was removed.] Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/trace/trace.c | 74 ++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 68 insertions(+), 6 deletions(-) diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c index e85b2e082085..91e69ad1181c 100644 --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -275,6 +275,12 @@ static struct trace_array global_trace = { LIST_HEAD(ftrace_trace_arrays); +static int __trace_array_get(struct trace_array *this_tr) +{ + this_tr->ref++; + return 0; +} + int trace_array_get(struct trace_array *this_tr) { struct trace_array *tr; @@ -283,8 +289,7 @@ int trace_array_get(struct trace_array *this_tr) mutex_lock(&trace_types_lock); list_for_each_entry(tr, &ftrace_trace_arrays, list) { if (tr == this_tr) { - tr->ref++; - ret = 0; + ret = __trace_array_get(tr); break; } } @@ -7496,11 +7501,68 @@ trace_options_core_write(struct file *filp, const char __user *ubuf, size_t cnt, return cnt; } +/* + * The tr_index is the address of a trace_array->trace_flags_index[] + * element that holds the index of the trace flag. But since the + * trace_array reference has not been taken yet, it cannot be referenced + * as it could have been freed by a rmdir of the instance the trace_array + * represents. + * + * Search the list of trace_arrays and compare the tr_index to the + * address of the entire trace_array trace_flags_index array for each + * trace_array in the list. If one is matched, then take the reference + * and return it. If not, the trace_array no longer exits. + */ +static int trace_array_options_get(void *tr_index) +{ + struct trace_array *tr; + + if (tracing_disabled) + return -ENODEV; + + mutex_lock(&trace_types_lock); + list_for_each_entry(tr, &ftrace_trace_arrays, list) { + if (tr_index >= (void *)&tr->trace_flags_index[0] && + tr_index < (void *)&tr->trace_flags_index[TRACE_FLAGS_MAX_SIZE]) { + mutex_unlock(&trace_types_lock); + return __trace_array_get(tr); + } + } + mutex_unlock(&trace_types_lock); + return -ENODEV; +} + +static int trace_options_open(struct inode *inode, struct file *filp) +{ + void *tr_index = inode->i_private; + + if (trace_array_options_get(tr_index) < 0) + return -ENODEV; + + filp->private_data = tr_index; + + return 0; +} + +static int trace_options_release(struct inode *inode, struct file *filp) +{ + void *tr_index = filp->private_data; + struct trace_array *tr; + unsigned int index; + + get_tr_index(tr_index, &tr, &index); + + trace_array_put(tr); + + return 0; +} + static const struct file_operations trace_options_core_fops = { - .open = tracing_open_generic, - .read = trace_options_core_read, - .write = trace_options_core_write, - .llseek = generic_file_llseek, + .open = trace_options_open, + .read = trace_options_core_read, + .write = trace_options_core_write, + .llseek = generic_file_llseek, + .release = trace_options_release, }; struct dentry *trace_create_file(const char *name, -- 2.34.1

2 1

[PATCH OLK-5.10] smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions
by Zizhi Wo 18 Sep '26

18 Sep '26

From: Jiangshan Yi <yijiangshan(a)kylinos.cn> stable inclusion from stable-v6.18.51 commit b10015807e4c628095d1d1d1c9307efc8cdd9e1b category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18923 CVE: CVE-2026-89638 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit… -------------------------------- [ Upstream commit b8e5dc4f95e5484159b343903f302eb6d783f2e6 ] When a file has the setuid or setgid bit set and is written to, the VFS strips those bits and issues a setattr with ATTR_KILL_SUID/ATTR_KILL_SGID together with an ATTR_MODE carrying the already-cleared mode. Both cifs_setattr_unix() and cifs_setattr_nounix() unconditionally dropped ATTR_MODE in that case: /* skip mode change if it's just for clearing setuid/setgid */ if (attrs->ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID)) attrs->ia_valid &= ~ATTR_MODE; This is fine for the default mount, where the mode is only emulated via the DOS read-only attribute and cannot represent the setuid/setgid bits anyway. However, with the "cifsacl" or "modefromsid" mount options the mode is stored on the server through an ACL (id_mode_to_cifs_acl()), with the SMB3.1.1 POSIX extensions the mode is sent to the server directly, and with the SMB1 Unix extensions (cifs_setattr_unix) the mode is sent via CIFSSMBUnixSetPathInfo(). In all those cases dropping ATTR_MODE means the cleared mode is never pushed to the server, so the setuid/setgid bit survives the write. This is a security issue: on local filesystems the setuid bit is stripped when a file is written, but over these cifs.ko mounts the bit persists on the server, potentially allowing an unexpected privilege escalation on subsequent execution. Fix this in two places: 1. cifs_setattr_nounix(): only take the "skip mode change" shortcut when the mode is emulated via the DOS read-only attribute (i.e. neither cifsacl/modefromsid nor the SMB3.1.1 POSIX extensions are in effect), so that the cleared mode is propagated to the server in the ACL / POSIX cases. 2. cifs_setattr_unix(): this function is only called when Unix extensions are in effect, so the mode is always stored on the server. Remove the shortcut entirely so that the cleared mode is always pushed. Fixes: d32c4f2626ac ("CIFS: ignore mode change if it's just for clearing setuid/setgid bits") Cc: stable(a)vger.kernel.org Signed-off-by: Jiangshan Yi <yijiangshan(a)kylinos.cn> Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Paulo Alcantara <pc(a)manguebit.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/cifs/inode.c fs/smb/client/inode.c [Commit b8e5dc4f95e5 touches fs/smb/client/inode.c, which this tree still has as fs/cifs/inode.c. The new check used the upstream-local sbflags variable, which does not exist here, so use cifs_sb->mnt_cifs_flags instead.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/cifs/inode.c | 30 +++++++++++++++++++++++++----- 1 file changed, 25 insertions(+), 5 deletions(-) diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c index 045d77a929df..83974a528024 100644 --- a/fs/cifs/inode.c +++ b/fs/cifs/inode.c @@ -2662,13 +2662,17 @@ cifs_setattr_unix(struct dentry *direntry, struct iattr *attrs) rc = cifs_set_file_size(inode, attrs, xid, full_path); if (rc != 0) goto out; } - /* skip mode change if it's just for clearing setuid/setgid */ - if (attrs->ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID)) - attrs->ia_valid &= ~ATTR_MODE; + /* + * This function is only called when Unix extensions are in effect, + * so the mode is always sent to and stored on the server. Do not + * skip the mode change when clearing setuid/setgid bits: dropping + * ATTR_MODE here would leave those bits set on the server after a + * write, which is a security issue. + */ args = kmalloc(sizeof(*args), GFP_KERNEL); if (args == NULL) { rc = -ENOMEM; goto out; @@ -2848,12 +2852,28 @@ cifs_setattr_nounix(struct dentry *direntry, struct iattr *attrs) } } else if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SET_UID)) attrs->ia_valid &= ~(ATTR_UID | ATTR_GID); - /* skip mode change if it's just for clearing setuid/setgid */ - if (attrs->ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID)) + /* + * Skip the mode change if it is only being done to clear the + * setuid/setgid bits *and* the mode is emulated via the DOS + * read-only attribute (the default, non-ACL case), which cannot + * represent the setuid/setgid bits anyway. + * + * When the mode is instead stored on the server - i.e. with the + * cifsacl or modefromsid mount options (via an ACL) or with the + * SMB3.1.1 POSIX extensions - the cleared mode must be pushed to + * the server. Dropping ATTR_MODE here would leave the setuid/ + * setgid bit set on the server after a write, which is a security + * issue (the bits are not stripped as they are on local + * filesystems). + */ + if ((attrs->ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID)) && + !((cifs_sb->mnt_cifs_flags & + (CIFS_MOUNT_CIFS_ACL | CIFS_MOUNT_MODE_FROM_SID)) || + cifs_sb_master_tcon(cifs_sb)->posix_extensions)) attrs->ia_valid &= ~ATTR_MODE; if (attrs->ia_valid & ATTR_MODE) { mode = attrs->ia_mode; rc = 0; -- 2.52.0

2 1

[PATCH openEuler-1.0-LTS] smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions
by Zizhi Wo 18 Sep '26

18 Sep '26

From: Jiangshan Yi <yijiangshan(a)kylinos.cn> stable inclusion from stable-v6.18.51 commit b10015807e4c628095d1d1d1c9307efc8cdd9e1b category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18923 CVE: CVE-2026-89638 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit… -------------------------------- [ Upstream commit b8e5dc4f95e5484159b343903f302eb6d783f2e6 ] When a file has the setuid or setgid bit set and is written to, the VFS strips those bits and issues a setattr with ATTR_KILL_SUID/ATTR_KILL_SGID together with an ATTR_MODE carrying the already-cleared mode. Both cifs_setattr_unix() and cifs_setattr_nounix() unconditionally dropped ATTR_MODE in that case: /* skip mode change if it's just for clearing setuid/setgid */ if (attrs->ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID)) attrs->ia_valid &= ~ATTR_MODE; This is fine for the default mount, where the mode is only emulated via the DOS read-only attribute and cannot represent the setuid/setgid bits anyway. However, with the "cifsacl" or "modefromsid" mount options the mode is stored on the server through an ACL (id_mode_to_cifs_acl()), with the SMB3.1.1 POSIX extensions the mode is sent to the server directly, and with the SMB1 Unix extensions (cifs_setattr_unix) the mode is sent via CIFSSMBUnixSetPathInfo(). In all those cases dropping ATTR_MODE means the cleared mode is never pushed to the server, so the setuid/setgid bit survives the write. This is a security issue: on local filesystems the setuid bit is stripped when a file is written, but over these cifs.ko mounts the bit persists on the server, potentially allowing an unexpected privilege escalation on subsequent execution. Fix this in two places: 1. cifs_setattr_nounix(): only take the "skip mode change" shortcut when the mode is emulated via the DOS read-only attribute (i.e. neither cifsacl/modefromsid nor the SMB3.1.1 POSIX extensions are in effect), so that the cleared mode is propagated to the server in the ACL / POSIX cases. 2. cifs_setattr_unix(): this function is only called when Unix extensions are in effect, so the mode is always stored on the server. Remove the shortcut entirely so that the cleared mode is always pushed. Fixes: d32c4f2626ac ("CIFS: ignore mode change if it's just for clearing setuid/setgid bits") Cc: stable(a)vger.kernel.org Signed-off-by: Jiangshan Yi <yijiangshan(a)kylinos.cn> Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Paulo Alcantara <pc(a)manguebit.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/cifs/inode.c fs/smb/client/inode.c [1. Commit b8e5dc4f95e5 touches fs/smb/client/inode.c, which this tree still has as fs/cifs/inode.c. The new check used the upstream-local sbflags variable, which does not exist here, so use cifs_sb->mnt_cifs_flags instead. 2. Commit 412094a8fb07 ("smb3: add new mount option to retrieve mode from special ACE") introduce CIFS_MOUNT_MODE_FROM_SID, this version has not merged.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/cifs/inode.c | 29 ++++++++++++++++++++++++----- 1 file changed, 24 insertions(+), 5 deletions(-) diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c index e5d0066f6125..3865ca0ce04a 100644 --- a/fs/cifs/inode.c +++ b/fs/cifs/inode.c @@ -2290,13 +2290,17 @@ cifs_setattr_unix(struct dentry *direntry, struct iattr *attrs) rc = cifs_set_file_size(inode, attrs, xid, full_path); if (rc != 0) goto out; } - /* skip mode change if it's just for clearing setuid/setgid */ - if (attrs->ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID)) - attrs->ia_valid &= ~ATTR_MODE; + /* + * This function is only called when Unix extensions are in effect, + * so the mode is always sent to and stored on the server. Do not + * skip the mode change when clearing setuid/setgid bits: dropping + * ATTR_MODE here would leave those bits set on the server after a + * write, which is a security issue. + */ args = kmalloc(sizeof(*args), GFP_KERNEL); if (args == NULL) { rc = -ENOMEM; goto out; @@ -2461,12 +2465,27 @@ cifs_setattr_nounix(struct dentry *direntry, struct iattr *attrs) } else #endif /* CONFIG_CIFS_ACL */ if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SET_UID)) attrs->ia_valid &= ~(ATTR_UID | ATTR_GID); - /* skip mode change if it's just for clearing setuid/setgid */ - if (attrs->ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID)) + /* + * Skip the mode change if it is only being done to clear the + * setuid/setgid bits *and* the mode is emulated via the DOS + * read-only attribute (the default, non-ACL case), which cannot + * represent the setuid/setgid bits anyway. + * + * When the mode is instead stored on the server - i.e. with the + * cifsacl or modefromsid mount options (via an ACL) or with the + * SMB3.1.1 POSIX extensions - the cleared mode must be pushed to + * the server. Dropping ATTR_MODE here would leave the setuid/ + * setgid bit set on the server after a write, which is a security + * issue (the bits are not stripped as they are on local + * filesystems). + */ + if ((attrs->ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID)) && + !((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_CIFS_ACL) || + cifs_sb_master_tcon(cifs_sb)->posix_extensions)) attrs->ia_valid &= ~ATTR_MODE; if (attrs->ia_valid & ATTR_MODE) { mode = attrs->ia_mode; rc = 0; -- 2.52.0

2 1

[PATCH openEuler-1.0-LTS] smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions
by Zizhi Wo 18 Sep '26

18 Sep '26

From: Jiangshan Yi <yijiangshan(a)kylinos.cn> stable inclusion from stable-v6.18.51 commit b10015807e4c628095d1d1d1c9307efc8cdd9e1b category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18923 CVE: CVE-2026-89638 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit… -------------------------------- [ Upstream commit b8e5dc4f95e5484159b343903f302eb6d783f2e6 ] When a file has the setuid or setgid bit set and is written to, the VFS strips those bits and issues a setattr with ATTR_KILL_SUID/ATTR_KILL_SGID together with an ATTR_MODE carrying the already-cleared mode. Both cifs_setattr_unix() and cifs_setattr_nounix() unconditionally dropped ATTR_MODE in that case: /* skip mode change if it's just for clearing setuid/setgid */ if (attrs->ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID)) attrs->ia_valid &= ~ATTR_MODE; This is fine for the default mount, where the mode is only emulated via the DOS read-only attribute and cannot represent the setuid/setgid bits anyway. However, with the "cifsacl" or "modefromsid" mount options the mode is stored on the server through an ACL (id_mode_to_cifs_acl()), with the SMB3.1.1 POSIX extensions the mode is sent to the server directly, and with the SMB1 Unix extensions (cifs_setattr_unix) the mode is sent via CIFSSMBUnixSetPathInfo(). In all those cases dropping ATTR_MODE means the cleared mode is never pushed to the server, so the setuid/setgid bit survives the write. This is a security issue: on local filesystems the setuid bit is stripped when a file is written, but over these cifs.ko mounts the bit persists on the server, potentially allowing an unexpected privilege escalation on subsequent execution. Fix this in two places: 1. cifs_setattr_nounix(): only take the "skip mode change" shortcut when the mode is emulated via the DOS read-only attribute (i.e. neither cifsacl/modefromsid nor the SMB3.1.1 POSIX extensions are in effect), so that the cleared mode is propagated to the server in the ACL / POSIX cases. 2. cifs_setattr_unix(): this function is only called when Unix extensions are in effect, so the mode is always stored on the server. Remove the shortcut entirely so that the cleared mode is always pushed. Fixes: d32c4f2626ac ("CIFS: ignore mode change if it's just for clearing setuid/setgid bits") Cc: stable(a)vger.kernel.org Signed-off-by: Jiangshan Yi <yijiangshan(a)kylinos.cn> Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Paulo Alcantara <pc(a)manguebit.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/cifs/inode.c fs/smb/client/inode.c [1. Commit b8e5dc4f95e5 touches fs/smb/client/inode.c, which this tree still has as fs/cifs/inode.c. The new check used the upstream-local sbflags variable, which does not exist here, so use cifs_sb->mnt_cifs_flags instead. 2. Commit 412094a8fb07 ("smb3: add new mount option to retrieve mode from special ACE") introduce CIFS_MOUNT_MODE_FROM_SID, this version has not merged.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/cifs/inode.c | 29 ++++++++++++++++++++++++----- 1 file changed, 24 insertions(+), 5 deletions(-) diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c index e5d0066f6125..3865ca0ce04a 100644 --- a/fs/cifs/inode.c +++ b/fs/cifs/inode.c @@ -2290,13 +2290,17 @@ cifs_setattr_unix(struct dentry *direntry, struct iattr *attrs) rc = cifs_set_file_size(inode, attrs, xid, full_path); if (rc != 0) goto out; } - /* skip mode change if it's just for clearing setuid/setgid */ - if (attrs->ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID)) - attrs->ia_valid &= ~ATTR_MODE; + /* + * This function is only called when Unix extensions are in effect, + * so the mode is always sent to and stored on the server. Do not + * skip the mode change when clearing setuid/setgid bits: dropping + * ATTR_MODE here would leave those bits set on the server after a + * write, which is a security issue. + */ args = kmalloc(sizeof(*args), GFP_KERNEL); if (args == NULL) { rc = -ENOMEM; goto out; @@ -2461,12 +2465,27 @@ cifs_setattr_nounix(struct dentry *direntry, struct iattr *attrs) } else #endif /* CONFIG_CIFS_ACL */ if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SET_UID)) attrs->ia_valid &= ~(ATTR_UID | ATTR_GID); - /* skip mode change if it's just for clearing setuid/setgid */ - if (attrs->ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID)) + /* + * Skip the mode change if it is only being done to clear the + * setuid/setgid bits *and* the mode is emulated via the DOS + * read-only attribute (the default, non-ACL case), which cannot + * represent the setuid/setgid bits anyway. + * + * When the mode is instead stored on the server - i.e. with the + * cifsacl or modefromsid mount options (via an ACL) or with the + * SMB3.1.1 POSIX extensions - the cleared mode must be pushed to + * the server. Dropping ATTR_MODE here would leave the setuid/ + * setgid bit set on the server after a write, which is a security + * issue (the bits are not stripped as they are on local + * filesystems). + */ + if ((attrs->ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID)) && + !((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_CIFS_ACL) || + cifs_sb_master_tcon(cifs_sb)->posix_extensions)) attrs->ia_valid &= ~ATTR_MODE; if (attrs->ia_valid & ATTR_MODE) { mode = attrs->ia_mode; rc = 0; -- 2.52.0

2 1

[PATCH] smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions
by Zizhi Wo 18 Sep '26

18 Sep '26

From: Jiangshan Yi <yijiangshan(a)kylinos.cn> stable inclusion from stable-v6.18.51 commit b10015807e4c628095d1d1d1c9307efc8cdd9e1b category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18923 CVE: CVE-2026-89638 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit… -------------------------------- [ Upstream commit b8e5dc4f95e5484159b343903f302eb6d783f2e6 ] When a file has the setuid or setgid bit set and is written to, the VFS strips those bits and issues a setattr with ATTR_KILL_SUID/ATTR_KILL_SGID together with an ATTR_MODE carrying the already-cleared mode. Both cifs_setattr_unix() and cifs_setattr_nounix() unconditionally dropped ATTR_MODE in that case: /* skip mode change if it's just for clearing setuid/setgid */ if (attrs->ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID)) attrs->ia_valid &= ~ATTR_MODE; This is fine for the default mount, where the mode is only emulated via the DOS read-only attribute and cannot represent the setuid/setgid bits anyway. However, with the "cifsacl" or "modefromsid" mount options the mode is stored on the server through an ACL (id_mode_to_cifs_acl()), with the SMB3.1.1 POSIX extensions the mode is sent to the server directly, and with the SMB1 Unix extensions (cifs_setattr_unix) the mode is sent via CIFSSMBUnixSetPathInfo(). In all those cases dropping ATTR_MODE means the cleared mode is never pushed to the server, so the setuid/setgid bit survives the write. This is a security issue: on local filesystems the setuid bit is stripped when a file is written, but over these cifs.ko mounts the bit persists on the server, potentially allowing an unexpected privilege escalation on subsequent execution. Fix this in two places: 1. cifs_setattr_nounix(): only take the "skip mode change" shortcut when the mode is emulated via the DOS read-only attribute (i.e. neither cifsacl/modefromsid nor the SMB3.1.1 POSIX extensions are in effect), so that the cleared mode is propagated to the server in the ACL / POSIX cases. 2. cifs_setattr_unix(): this function is only called when Unix extensions are in effect, so the mode is always stored on the server. Remove the shortcut entirely so that the cleared mode is always pushed. Fixes: d32c4f2626ac ("CIFS: ignore mode change if it's just for clearing setuid/setgid bits") Cc: stable(a)vger.kernel.org Signed-off-by: Jiangshan Yi <yijiangshan(a)kylinos.cn> Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Paulo Alcantara <pc(a)manguebit.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/cifs/inode.c fs/smb/client/inode.c [Commit b8e5dc4f95e5 touches fs/smb/client/inode.c, which this tree still has as fs/cifs/inode.c. The new check used the upstream-local sbflags variable, which does not exist here, so use cifs_sb->mnt_cifs_flags instead.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/cifs/inode.c | 30 +++++++++++++++++++++++++----- 1 file changed, 25 insertions(+), 5 deletions(-) diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c index 045d77a929df..83974a528024 100644 --- a/fs/cifs/inode.c +++ b/fs/cifs/inode.c @@ -2662,13 +2662,17 @@ cifs_setattr_unix(struct dentry *direntry, struct iattr *attrs) rc = cifs_set_file_size(inode, attrs, xid, full_path); if (rc != 0) goto out; } - /* skip mode change if it's just for clearing setuid/setgid */ - if (attrs->ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID)) - attrs->ia_valid &= ~ATTR_MODE; + /* + * This function is only called when Unix extensions are in effect, + * so the mode is always sent to and stored on the server. Do not + * skip the mode change when clearing setuid/setgid bits: dropping + * ATTR_MODE here would leave those bits set on the server after a + * write, which is a security issue. + */ args = kmalloc(sizeof(*args), GFP_KERNEL); if (args == NULL) { rc = -ENOMEM; goto out; @@ -2848,12 +2852,28 @@ cifs_setattr_nounix(struct dentry *direntry, struct iattr *attrs) } } else if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SET_UID)) attrs->ia_valid &= ~(ATTR_UID | ATTR_GID); - /* skip mode change if it's just for clearing setuid/setgid */ - if (attrs->ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID)) + /* + * Skip the mode change if it is only being done to clear the + * setuid/setgid bits *and* the mode is emulated via the DOS + * read-only attribute (the default, non-ACL case), which cannot + * represent the setuid/setgid bits anyway. + * + * When the mode is instead stored on the server - i.e. with the + * cifsacl or modefromsid mount options (via an ACL) or with the + * SMB3.1.1 POSIX extensions - the cleared mode must be pushed to + * the server. Dropping ATTR_MODE here would leave the setuid/ + * setgid bit set on the server after a write, which is a security + * issue (the bits are not stripped as they are on local + * filesystems). + */ + if ((attrs->ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID)) && + !((cifs_sb->mnt_cifs_flags & + (CIFS_MOUNT_CIFS_ACL | CIFS_MOUNT_MODE_FROM_SID)) || + cifs_sb_master_tcon(cifs_sb)->posix_extensions)) attrs->ia_valid &= ~ATTR_MODE; if (attrs->ia_valid & ATTR_MODE) { mode = attrs->ia_mode; rc = 0; -- 2.52.0

1 0

[PATCH OLK-5.10] cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0
by Zizhi Wo 18 Sep '26

18 Sep '26

From: Frank Sorenson <sorenson(a)redhat.com> mainline inclusion from mainline-v7.3-rc1 commit 6c322f5cf7476ded7a9a20f7be72462065a03c68 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18924 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- With len == 0 (clone to EOF), the effective length is computed as: len = src_inode->i_size - off; If off > i_size, this is a negative loff_t, corrupting the ByteCount in the FSCTL_DUPLICATE_EXTENTS_TO_FILE request and inverting the range in filemap_write_and_wait_range(). The existing off >= i_size check fires only after the ioctl has already been sent. Snapshot i_size_read() once for both the bounds check and the length calculation, eliminating the TOCTOU and 32-bit torn-read risk. Reject off > src_size with -EINVAL. Treat off == src_size as a no-op, consistent with __generic_remap_file_range_prep(). Fixes: 04b38d601239 ("vfs: pull btrfs clone API to vfs layer") Cc: stable(a)vger.kernel.org Signed-off-by: Frank Sorenson <sorenson(a)redhat.com> Reviewed-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Paulo Alcantara <pc(a)manguebit.org> Conflicts: fs/cifs/cifsfs.c [5.10 keeps this file at fs/cifs/cifsfs.c and its cifs_remap_file_range() has no unlock label, which this fix references; add unlock: right before unlock_two_nondirectories() so the new error and zero-length exits release the locks and still free the xid via the existing out: path.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/cifs/cifsfs.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c index a86a1fb34e59..1d102d8c3ba6 100644 --- a/fs/cifs/cifsfs.c +++ b/fs/cifs/cifsfs.c @@ -1116,12 +1116,23 @@ static loff_t cifs_remap_file_range(struct file *src_file, loff_t off, * checks for proper open modes and file type and if it wants * server could even support copy of range where source = target */ lock_two_nondirectories(target_inode, src_inode); - if (len == 0) - len = src_inode->i_size - off; + if (len == 0) { + loff_t src_size = i_size_read(src_inode); + + if (off > src_size) { + rc = -EINVAL; + goto unlock; + } + len = src_size - off; + if (!len) { + rc = 0; + goto unlock; + } + } cifs_dbg(FYI, "about to flush pages\n"); /* should we flush first and last page first */ truncate_inode_pages_range(&target_inode->i_data, destoff, PAGE_ALIGN(destoff + len)-1); @@ -1133,10 +1144,11 @@ static loff_t cifs_remap_file_range(struct file *src_file, loff_t off, rc = -EOPNOTSUPP; /* force revalidate of size and timestamps of target file now that target is updated on the server */ CIFS_I(target_inode)->time = 0; +unlock: /* although unlocking in the reverse order from locking is not strictly necessary here it is a little cleaner to be consistent */ unlock_two_nondirectories(src_inode, target_inode); out: free_xid(xid); -- 2.52.0

2 1

[PATCH OLK-6.6 0/5] mainline patch submission for OLK-6.6
by Chen Yuxi 18 Sep '26

18 Sep '26

Nicholas Dudar (2): bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max bpf: Reject writes through untrusted BTF pointers Pu Lehui (2): bpf: Fix potential UAF when reading bpf link info bpf: Fix potential UAF in bpf_netns_link_update_prog Sanghyun Park (1): bpf: Fix use-after-free on mm_struct in bpf_find_vma() kernel/bpf/net_namespace.c | 17 ++++++----------- kernel/bpf/syscall.c | 21 +++++++++++++++++---- kernel/bpf/task_iter.c | 36 +++++++++++++++++++++++++++++++++--- kernel/bpf/verifier.c | 13 +++++++++++-- 4 files changed, 67 insertions(+), 20 deletions(-) -- 2.34.1

2 6

[PATCH OLK-6.6 0/5] mainline patch submission for OLK-6.6
by Chen Yuxi 18 Sep '26

18 Sep '26

Nicholas Dudar (2): bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max bpf: Reject writes through untrusted BTF pointers Pu Lehui (2): bpf: Fix potential UAF when reading bpf link info bpf: Fix potential UAF in bpf_netns_link_update_prog Sanghyun Park (1): bpf: Fix use-after-free on mm_struct in bpf_find_vma() kernel/bpf/net_namespace.c | 17 ++++++----------- kernel/bpf/syscall.c | 21 +++++++++++++++++---- kernel/bpf/task_iter.c | 36 +++++++++++++++++++++++++++++++++--- kernel/bpf/verifier.c | 13 +++++++++++-- 4 files changed, 67 insertions(+), 20 deletions(-) -- 2.34.1

2 6

[PATCH openEuler-1.0-LTS] smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions
by Zizhi Wo 18 Sep '26

18 Sep '26

From: Jiangshan Yi <yijiangshan(a)kylinos.cn> stable inclusion from stable-v6.18.51 commit b10015807e4c628095d1d1d1c9307efc8cdd9e1b category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18923 CVE: CVE-2026-89638 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit… -------------------------------- [ Upstream commit b8e5dc4f95e5484159b343903f302eb6d783f2e6 ] When a file has the setuid or setgid bit set and is written to, the VFS strips those bits and issues a setattr with ATTR_KILL_SUID/ATTR_KILL_SGID together with an ATTR_MODE carrying the already-cleared mode. Both cifs_setattr_unix() and cifs_setattr_nounix() unconditionally dropped ATTR_MODE in that case: /* skip mode change if it's just for clearing setuid/setgid */ if (attrs->ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID)) attrs->ia_valid &= ~ATTR_MODE; This is fine for the default mount, where the mode is only emulated via the DOS read-only attribute and cannot represent the setuid/setgid bits anyway. However, with the "cifsacl" or "modefromsid" mount options the mode is stored on the server through an ACL (id_mode_to_cifs_acl()), with the SMB3.1.1 POSIX extensions the mode is sent to the server directly, and with the SMB1 Unix extensions (cifs_setattr_unix) the mode is sent via CIFSSMBUnixSetPathInfo(). In all those cases dropping ATTR_MODE means the cleared mode is never pushed to the server, so the setuid/setgid bit survives the write. This is a security issue: on local filesystems the setuid bit is stripped when a file is written, but over these cifs.ko mounts the bit persists on the server, potentially allowing an unexpected privilege escalation on subsequent execution. Fix this in two places: 1. cifs_setattr_nounix(): only take the "skip mode change" shortcut when the mode is emulated via the DOS read-only attribute (i.e. neither cifsacl/modefromsid nor the SMB3.1.1 POSIX extensions are in effect), so that the cleared mode is propagated to the server in the ACL / POSIX cases. 2. cifs_setattr_unix(): this function is only called when Unix extensions are in effect, so the mode is always stored on the server. Remove the shortcut entirely so that the cleared mode is always pushed. Fixes: d32c4f2626ac ("CIFS: ignore mode change if it's just for clearing setuid/setgid bits") Cc: stable(a)vger.kernel.org Signed-off-by: Jiangshan Yi <yijiangshan(a)kylinos.cn> Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Paulo Alcantara <pc(a)manguebit.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/cifs/inode.c fs/smb/client/inode.c [1. Commit b8e5dc4f95e5 touches fs/smb/client/inode.c, which this tree still has as fs/cifs/inode.c. The new check used the upstream-local sbflags variable, which does not exist here, so use cifs_sb->mnt_cifs_flags instead. 2. Commit 412094a8fb07 ("smb3: add new mount option to retrieve mode from special ACE") introduce CIFS_MOUNT_MODE_FROM_SID, this version has not merged.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/cifs/inode.c | 29 ++++++++++++++++++++++++----- 1 file changed, 24 insertions(+), 5 deletions(-) diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c index e5d0066f6125..793cd915ec1d 100644 --- a/fs/cifs/inode.c +++ b/fs/cifs/inode.c @@ -2290,12 +2290,27 @@ cifs_setattr_unix(struct dentry *direntry, struct iattr *attrs) rc = cifs_set_file_size(inode, attrs, xid, full_path); if (rc != 0) goto out; } - /* skip mode change if it's just for clearing setuid/setgid */ - if (attrs->ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID)) + /* + * Skip the mode change if it is only being done to clear the + * setuid/setgid bits *and* the mode is emulated via the DOS + * read-only attribute (the default, non-ACL case), which cannot + * represent the setuid/setgid bits anyway. + * + * When the mode is instead stored on the server - i.e. with the + * cifsacl or modefromsid mount options (via an ACL) or with the + * SMB3.1.1 POSIX extensions - the cleared mode must be pushed to + * the server. Dropping ATTR_MODE here would leave the setuid/ + * setgid bit set on the server after a write, which is a security + * issue (the bits are not stripped as they are on local + * filesystems). + */ + if ((attrs->ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID)) && + !((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_CIFS_ACL) || + cifs_sb_master_tcon(cifs_sb)->posix_extensions)) attrs->ia_valid &= ~ATTR_MODE; args = kmalloc(sizeof(*args), GFP_KERNEL); if (args == NULL) { rc = -ENOMEM; @@ -2461,13 +2476,17 @@ cifs_setattr_nounix(struct dentry *direntry, struct iattr *attrs) } else #endif /* CONFIG_CIFS_ACL */ if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SET_UID)) attrs->ia_valid &= ~(ATTR_UID | ATTR_GID); - /* skip mode change if it's just for clearing setuid/setgid */ - if (attrs->ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID)) - attrs->ia_valid &= ~ATTR_MODE; + /* + * This function is only called when Unix extensions are in effect, + * so the mode is always sent to and stored on the server. Do not + * skip the mode change when clearing setuid/setgid bits: dropping + * ATTR_MODE here would leave those bits set on the server after a + * write, which is a security issue. + */ if (attrs->ia_valid & ATTR_MODE) { mode = attrs->ia_mode; rc = 0; #ifdef CONFIG_CIFS_ACL -- 2.52.0

2 1

[PATCH OLK-5.10] smb: client: clear setuid/setgid bit on write with cifsacl/modefromsid/posix extensions
by Zizhi Wo 18 Sep '26

18 Sep '26

From: Jiangshan Yi <yijiangshan(a)kylinos.cn> stable inclusion from stable-v6.18.51 commit b10015807e4c628095d1d1d1c9307efc8cdd9e1b category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18923 CVE: CVE-2026-89638 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit… -------------------------------- [ Upstream commit b8e5dc4f95e5484159b343903f302eb6d783f2e6 ] When a file has the setuid or setgid bit set and is written to, the VFS strips those bits and issues a setattr with ATTR_KILL_SUID/ATTR_KILL_SGID together with an ATTR_MODE carrying the already-cleared mode. Both cifs_setattr_unix() and cifs_setattr_nounix() unconditionally dropped ATTR_MODE in that case: /* skip mode change if it's just for clearing setuid/setgid */ if (attrs->ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID)) attrs->ia_valid &= ~ATTR_MODE; This is fine for the default mount, where the mode is only emulated via the DOS read-only attribute and cannot represent the setuid/setgid bits anyway. However, with the "cifsacl" or "modefromsid" mount options the mode is stored on the server through an ACL (id_mode_to_cifs_acl()), with the SMB3.1.1 POSIX extensions the mode is sent to the server directly, and with the SMB1 Unix extensions (cifs_setattr_unix) the mode is sent via CIFSSMBUnixSetPathInfo(). In all those cases dropping ATTR_MODE means the cleared mode is never pushed to the server, so the setuid/setgid bit survives the write. This is a security issue: on local filesystems the setuid bit is stripped when a file is written, but over these cifs.ko mounts the bit persists on the server, potentially allowing an unexpected privilege escalation on subsequent execution. Fix this in two places: 1. cifs_setattr_nounix(): only take the "skip mode change" shortcut when the mode is emulated via the DOS read-only attribute (i.e. neither cifsacl/modefromsid nor the SMB3.1.1 POSIX extensions are in effect), so that the cleared mode is propagated to the server in the ACL / POSIX cases. 2. cifs_setattr_unix(): this function is only called when Unix extensions are in effect, so the mode is always stored on the server. Remove the shortcut entirely so that the cleared mode is always pushed. Fixes: d32c4f2626ac ("CIFS: ignore mode change if it's just for clearing setuid/setgid bits") Cc: stable(a)vger.kernel.org Signed-off-by: Jiangshan Yi <yijiangshan(a)kylinos.cn> Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Paulo Alcantara <pc(a)manguebit.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/cifs/inode.c fs/smb/client/inode.c [Commit b8e5dc4f95e5 touches fs/smb/client/inode.c, which this tree still has as fs/cifs/inode.c. The new check used the upstream-local sbflags variable, which does not exist here, so use cifs_sb->mnt_cifs_flags instead.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/cifs/inode.c | 30 +++++++++++++++++++++++++----- 1 file changed, 25 insertions(+), 5 deletions(-) diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c index 045d77a929df..774acee6fb58 100644 --- a/fs/cifs/inode.c +++ b/fs/cifs/inode.c @@ -2662,12 +2662,28 @@ cifs_setattr_unix(struct dentry *direntry, struct iattr *attrs) rc = cifs_set_file_size(inode, attrs, xid, full_path); if (rc != 0) goto out; } - /* skip mode change if it's just for clearing setuid/setgid */ - if (attrs->ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID)) + /* + * Skip the mode change if it is only being done to clear the + * setuid/setgid bits *and* the mode is emulated via the DOS + * read-only attribute (the default, non-ACL case), which cannot + * represent the setuid/setgid bits anyway. + * + * When the mode is instead stored on the server - i.e. with the + * cifsacl or modefromsid mount options (via an ACL) or with the + * SMB3.1.1 POSIX extensions - the cleared mode must be pushed to + * the server. Dropping ATTR_MODE here would leave the setuid/ + * setgid bit set on the server after a write, which is a security + * issue (the bits are not stripped as they are on local + * filesystems). + */ + if ((attrs->ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID)) && + !((cifs_sb->mnt_cifs_flags & + (CIFS_MOUNT_CIFS_ACL | CIFS_MOUNT_MODE_FROM_SID)) || + cifs_sb_master_tcon(cifs_sb)->posix_extensions)) attrs->ia_valid &= ~ATTR_MODE; args = kmalloc(sizeof(*args), GFP_KERNEL); if (args == NULL) { rc = -ENOMEM; @@ -2848,13 +2864,17 @@ cifs_setattr_nounix(struct dentry *direntry, struct iattr *attrs) } } else if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SET_UID)) attrs->ia_valid &= ~(ATTR_UID | ATTR_GID); - /* skip mode change if it's just for clearing setuid/setgid */ - if (attrs->ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID)) - attrs->ia_valid &= ~ATTR_MODE; + /* + * This function is only called when Unix extensions are in effect, + * so the mode is always sent to and stored on the server. Do not + * skip the mode change when clearing setuid/setgid bits: dropping + * ATTR_MODE here would leave those bits set on the server after a + * write, which is a security issue. + */ if (attrs->ia_valid & ATTR_MODE) { mode = attrs->ia_mode; rc = 0; if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_CIFS_ACL) || -- 2.52.0

2 2

[PATCH OLK-6.6] Revert "iomap: guard io_size EOF trim against concurrent truncate underflow"
by Ran Hongyun 18 Sep '26

18 Sep '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17916 CVE: CVE-2026-72367 -------------------------------- This reverts commit 70ad22e4e8dfd119161fdaebc2bf4007f136516a. The upstream fix (55ec50d046c0) guards against unsigned underflow when `end_pos < io_offset` by clamping io_size to zero. In mainline, `end_pos` is a per-folio snapshot passed as a parameter. commit e728e754141f uses `isize = i_size_read(inode)` instead of `end_pos`: if (pos < isize && pos + len > isize) wpc->ioend->io_size = isize - wpc->ioend->io_offset; Since `io_offset <= pos < isize`, when the branch is taken, the subtraction cannot underflow. Fixes: 70ad22e4e8df ("iomap: guard io_size EOF trim against concurrent truncate underflow") Signed-off-by: Ran Hongyun <ranhongyun1(a)huawei.com> --- fs/iomap/buffered-io.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/fs/iomap/buffered-io.c b/fs/iomap/buffered-io.c index baa7bbe02fad..1b9177ad7cdd 100644 --- a/fs/iomap/buffered-io.c +++ b/fs/iomap/buffered-io.c @@ -2002,12 +2002,8 @@ static int iomap_add_to_ioend(struct iomap_writepage_ctx *wpc, * should not be trimmed in such cases. */ wpc->ioend->io_size += len; - if (wpc->ioend->io_offset + wpc->ioend->io_size > isize) { - if (wpc->ioend->io_offset >= isize) - wpc->ioend->io_size = 0; - else - wpc->ioend->io_size = isize - wpc->ioend->io_offset; - } + if (pos < isize && pos + len > isize) + wpc->ioend->io_size = isize - wpc->ioend->io_offset; wbc_account_cgroup_owner(wbc, &folio->page, len); return 0; -- 2.52.0

2 1

[PATCH OLK-6.6 0/2] eventpoll: use spinlock under CONFIG_PREEMPT_RT, rwlock otherwise
by Ran Hongyun 18 Sep '26

18 Sep '26

Commit d26ee5945bbc ("eventpoll: Replace rwlock with spinlock") replaced ep->lock rwlock with spinlock to fix RT priority inversion. However, the rwlock read-side cannot be priority-boosted on PREEMPT_RT (rwbase_rt readers are not rt_mutex owners), while on non-RT kernels preempt_disable already guarantees bounded waiting. So the inversion is RT-only. Replacing rwlock with spinlock unconditionally causes performance regression on non-RT systems with many producers, since producers can no longer hold the read lock concurrently. This series reverts the unconditional replacement, then re-applies it under CONFIG_PREEMPT_RT via ep_lock_* wrapper macros: - RT: spinlock_t (PI chain complete, no inversion) - non-RT: rwlock_t (preserved for producer concurrency) The lockless helpers list_add_tail_lockless() and chain_epi_lockless() are compiled out under CONFIG_PREEMPT_RT. Ran Hongyun (2): Revert "eventpoll: Replace rwlock with spinlock" eventpoll: use spinlock under CONFIG_PREEMPT_RT, rwlock otherwise fs/eventpoll.c | 174 +++++++++++++++++++++++++++++++++++++++++++------ 1 file changed, 154 insertions(+), 20 deletions(-) -- 2.52.0

2 1

[PATCH OLK-6.6] md: use bio_alloc when sync_set is not initialized in md_super_write
by Ran Hongyun 18 Sep '26

18 Sep '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9983 -------------------------------- Commit 6a5965696856 removed md_bio_alloc_sync and used bio_alloc_bioset instead. But when md_super_write is called after __md_stop has destroyed sync_set, bio_alloc_bioset with &mddev->sync_set triggers WARN_ON_ONCE because the bioset is not initialized. Fall back to bio_alloc (which uses fs_bio_set) when sync_set is not initialized. Fixes: 6a5965696856 ("md: remove md_bio_alloc_sync") Signed-off-by: Ran Hongyun <ranhongyun1(a)huawei.com> --- drivers/md/md.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/drivers/md/md.c b/drivers/md/md.c index 2a32de5f5b64..a501fe675893 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -1075,6 +1075,9 @@ void md_super_write(struct mddev *mddev, struct md_rdev *rdev, * If an error occurred, call md_error */ struct bio *bio; + struct block_device *bdev; + blk_opf_t opf = REQ_OP_WRITE | REQ_SYNC | REQ_IDLE | REQ_META + | REQ_PREFLUSH | REQ_FUA; if (!page) return; @@ -1082,11 +1085,12 @@ void md_super_write(struct mddev *mddev, struct md_rdev *rdev, if (test_bit(Faulty, &rdev->flags)) return; - bio = bio_alloc_bioset(rdev->meta_bdev ? rdev->meta_bdev : rdev->bdev, - 1, - REQ_OP_WRITE | REQ_SYNC | REQ_IDLE | REQ_META - | REQ_PREFLUSH | REQ_FUA, - GFP_NOIO, &mddev->sync_set); + bdev = rdev->meta_bdev ? rdev->meta_bdev : rdev->bdev; + + if (bioset_initialized(&mddev->sync_set)) + bio = bio_alloc_bioset(bdev, 1, opf, GFP_NOIO, &mddev->sync_set); + else + bio = bio_alloc(bdev, 1, opf, GFP_NOIO); atomic_inc(&rdev->nr_pending); -- 2.52.0

2 1

[PATCH OLK-6.6 2/2] eventpoll: use spinlock under CONFIG_PREEMPT_RT, rwlock otherwise
by Ran Hongyun 18 Sep '26

18 Sep '26

hulk inclusion category: bugfix bugzilla: NA -------------------------------- Introduce ep_lock_* wrapper macros that select spinlock_t under CONFIG_PREEMPT_RT and rwlock_t otherwise. The rwlock read-side cannot be priority-boosted on RT (rwbase_rt readers are not rt_mutex owners), causing unbounded priority inversion; spinlock fixes this. On non-RT kernels the rwlock is preserved for producer concurrency. The lockless helpers list_add_tail_lockless() and chain_epi_lockless() are compiled out under CONFIG_PREEMPT_RT since the spinlock serializes all producers. Fixes: a218cc491420 ("epoll: use rwlock in order to reduce ep_poll_callback() contention") Signed-off-by: Ran Hongyun <ranhongyun1(a)huawei.com> --- fs/eventpoll.c | 95 +++++++++++++++++++++++++++++++++++++------------- 1 file changed, 71 insertions(+), 24 deletions(-) diff --git a/fs/eventpoll.c b/fs/eventpoll.c index ba719222a2da..523e69de1e32 100644 --- a/fs/eventpoll.c +++ b/fs/eventpoll.c @@ -39,13 +39,45 @@ #include <linux/rculist.h> #include <net/busy_poll.h> +/* + * Under CONFIG_PREEMPT_RT the ep->lock is a spinlock because the rwlock + * read-side cannot be priority-boosted (rwbase_rt readers are not + * rt_mutex owners), which causes unbounded priority inversion when a + * high-priority consumer (writer) waits on low-priority producers + * (readers). On non-RT kernels the rwlock is preserved so that multiple + * producers can run concurrently, which scales better with large event + * sources. + */ + +#ifdef CONFIG_PREEMPT_RT + +#define ep_lock_t spinlock_t +#define ep_lock_init(lock) spin_lock_init(lock) +#define ep_lock_irq(lock) spin_lock_irq(lock) +#define ep_unlock_irq(lock) spin_unlock_irq(lock) +#define ep_lock_irqsave(lock, flags) spin_lock_irqsave(lock, flags) +#define ep_unlock_irqrestore(lock, flags) \ + spin_unlock_irqrestore(lock, flags) + +#else /* !CONFIG_PREEMPT_RT */ + +#define ep_lock_t rwlock_t +#define ep_lock_init(lock) rwlock_init(lock) +#define ep_lock_irq(lock) write_lock_irq(lock) +#define ep_unlock_irq(lock) write_unlock_irq(lock) +#define ep_lock_irqsave(lock, flags) read_lock_irqsave(lock, flags) +#define ep_unlock_irqrestore(lock, flags) \ + read_unlock_irqrestore(lock, flags) + +#endif /* CONFIG_PREEMPT_RT */ + /* * LOCKING: * There are three level of locking required by epoll : * * 1) epnested_mutex (mutex) * 2) ep->mtx (mutex) - * 3) ep->lock (rwlock) + * 3) ep->lock (rwlock or spinlock, see above) * * The acquire order is the one listed above, from 1 to 3. * We need a rwlock (ep->lock) because we manipulate objects @@ -194,7 +226,7 @@ struct eventpoll { struct list_head rdllist; /* Lock which protects rdllist and ovflist */ - rwlock_t lock; + ep_lock_t lock; /* RB tree root used to store monitored fd structs */ struct rb_root_cached rbr; @@ -628,10 +660,10 @@ static void ep_start_scan(struct eventpoll *ep, struct list_head *txlist) * in a lockless way. */ lockdep_assert_irqs_enabled(); - write_lock_irq(&ep->lock); + ep_lock_irq(&ep->lock); list_splice_init(&ep->rdllist, txlist); WRITE_ONCE(ep->ovflist, NULL); - write_unlock_irq(&ep->lock); + ep_unlock_irq(&ep->lock); } static void ep_done_scan(struct eventpoll *ep, @@ -639,7 +671,7 @@ static void ep_done_scan(struct eventpoll *ep, { struct epitem *epi, *nepi; - write_lock_irq(&ep->lock); + ep_lock_irq(&ep->lock); /* * During the time we spent inside the "sproc" callback, some * other events might have been queued by the poll callback. @@ -680,7 +712,7 @@ static void ep_done_scan(struct eventpoll *ep, wake_up(&ep->wq); } - write_unlock_irq(&ep->lock); + ep_unlock_irq(&ep->lock); } static void epi_rcu_free(struct rcu_head *head) @@ -777,10 +809,10 @@ static bool ep_remove_epi(struct eventpoll *ep, struct epitem *epi) rb_erase_cached(&epi->rbn, &ep->rbr); - write_lock_irq(&ep->lock); + ep_lock_irq(&ep->lock); if (ep_is_linked(epi)) list_del_init(&epi->rdllink); - write_unlock_irq(&ep->lock); + ep_unlock_irq(&ep->lock); wakeup_source_unregister(ep_wakeup_source(epi)); /* @@ -1040,7 +1072,7 @@ static int ep_alloc(struct eventpoll **pep) return -ENOMEM; mutex_init(&ep->mtx); - rwlock_init(&ep->lock); + ep_lock_init(&ep->lock); init_waitqueue_head(&ep->wq); init_waitqueue_head(&ep->poll_wait); INIT_LIST_HEAD(&ep->rdllist); @@ -1127,6 +1159,7 @@ struct file *get_epoll_tfile_raw_ptr(struct file *file, int tfd, } #endif /* CONFIG_KCMP */ +#ifndef CONFIG_PREEMPT_RT /* * Adds a new entry to the tail of the list in a lockless way, i.e. * multiple CPUs are allowed to call this function concurrently. @@ -1204,16 +1237,17 @@ static inline bool chain_epi_lockless(struct epitem *epi) return true; } +#endif /* !CONFIG_PREEMPT_RT */ /* * This is the callback that is passed to the wait queue wakeup * mechanism. It is called by the stored file descriptors when they * have events to report. * - * This callback takes a read lock in order not to contend with concurrent - * events from another file descriptor, thus all modifications to ->rdllist - * or ->ovflist are lockless. Read lock is paired with the write lock from - * ep_start/done_scan(), which stops all list modifications and guarantees - * that lists state is seen correctly. + * Under !CONFIG_PREEMPT_RT this callback takes a read lock in order not + * to contend with concurrent events from another file descriptor, thus + * all modifications to ->rdllist or ->ovflist are lockless. Read lock is + * paired with the write lock from ep_start/done_scan(), which stops all + * list modifications and guarantees that lists state is seen correctly. * * Another thing worth to mention is that ep_poll_callback() can be called * concurrently for the same @epi from different CPUs if poll table was inited @@ -1231,7 +1265,7 @@ static int ep_poll_callback(wait_queue_entry_t *wait, unsigned mode, int sync, v unsigned long flags; int ewake = 0; - read_lock_irqsave(&ep->lock, flags); + ep_lock_irqsave(&ep->lock, flags); ep_set_busy_poll_napi_id(epi); @@ -1260,12 +1294,25 @@ static int ep_poll_callback(wait_queue_entry_t *wait, unsigned mode, int sync, v * chained in ep->ovflist and requeued later on. */ if (READ_ONCE(ep->ovflist) != EP_UNACTIVE_PTR) { +#ifdef CONFIG_PREEMPT_RT + if (epi->next == EP_UNACTIVE_PTR) { + epi->next = READ_ONCE(ep->ovflist); + WRITE_ONCE(ep->ovflist, epi); + ep_pm_stay_awake_rcu(epi); + } +#else if (chain_epi_lockless(epi)) ep_pm_stay_awake_rcu(epi); +#endif } else if (!ep_is_linked(epi)) { /* In the usual case, add event to ready list. */ +#ifdef CONFIG_PREEMPT_RT + list_add_tail(&epi->rdllink, &ep->rdllist); + ep_pm_stay_awake_rcu(epi); +#else if (list_add_tail_lockless(&epi->rdllink, &ep->rdllist)) ep_pm_stay_awake_rcu(epi); +#endif } /* @@ -1298,7 +1345,7 @@ static int ep_poll_callback(wait_queue_entry_t *wait, unsigned mode, int sync, v pwake++; out_unlock: - read_unlock_irqrestore(&ep->lock, flags); + ep_unlock_irqrestore(&ep->lock, flags); /* We have to call this outside the lock */ if (pwake) @@ -1633,7 +1680,7 @@ static int ep_insert(struct eventpoll *ep, const struct epoll_event *event, } /* We have to drop the new item inside our item list to keep track of it */ - write_lock_irq(&ep->lock); + ep_lock_irq(&ep->lock); /* record NAPI ID of new item if present */ ep_set_busy_poll_napi_id(epi); @@ -1650,7 +1697,7 @@ static int ep_insert(struct eventpoll *ep, const struct epoll_event *event, pwake++; } - write_unlock_irq(&ep->lock); + ep_unlock_irq(&ep->lock); /* We have to call this outside the lock */ if (pwake) @@ -1714,7 +1761,7 @@ static int ep_modify(struct eventpoll *ep, struct epitem *epi, * list, push it inside. */ if (ep_item_poll(epi, &pt, 1)) { - write_lock_irq(&ep->lock); + ep_lock_irq(&ep->lock); if (!ep_is_linked(epi)) { list_add_tail(&epi->rdllink, &ep->rdllist); ep_pm_stay_awake(epi); @@ -1725,7 +1772,7 @@ static int ep_modify(struct eventpoll *ep, struct epitem *epi, if (waitqueue_active(&ep->poll_wait)) pwake++; } - write_unlock_irq(&ep->lock); + ep_unlock_irq(&ep->lock); } /* We have to call this outside the lock */ @@ -1958,7 +2005,7 @@ static int ep_poll(struct eventpoll *ep, struct epoll_event __user *events, init_wait(&wait); wait.func = ep_autoremove_wake_function; - write_lock_irq(&ep->lock); + ep_lock_irq(&ep->lock); /* * Barrierless variant, waitqueue_active() is called under * the same lock on wakeup ep_poll_callback() side, so it @@ -1977,7 +2024,7 @@ static int ep_poll(struct eventpoll *ep, struct epoll_event __user *events, if (!eavail) __add_wait_queue_exclusive(&ep->wq, &wait); - write_unlock_irq(&ep->lock); + ep_unlock_irq(&ep->lock); if (!eavail) timed_out = !schedule_hrtimeout_range(to, slack, @@ -1992,7 +2039,7 @@ static int ep_poll(struct eventpoll *ep, struct epoll_event __user *events, eavail = 1; if (!list_empty_careful(&wait.entry)) { - write_lock_irq(&ep->lock); + ep_lock_irq(&ep->lock); /* * If the thread timed out and is not on the wait queue, * it means that the thread was woken up after its @@ -2003,7 +2050,7 @@ static int ep_poll(struct eventpoll *ep, struct epoll_event __user *events, if (timed_out) eavail = list_empty(&wait.entry); __remove_wait_queue(&ep->wq, &wait); - write_unlock_irq(&ep->lock); + ep_unlock_irq(&ep->lock); } } } -- 2.52.0

1 0

[PATCH OLK-6.6 1/2] Revert "eventpoll: Replace rwlock with spinlock"
by Ran Hongyun 18 Sep '26

18 Sep '26

hulk inclusion category: bugfix bugzilla: NA -------------------------------- This reverts commit d26ee5945bbcd8be44bf38853afe5d0b4e2e1e31. Commit d26ee5945bbc ("eventpoll: Replace rwlock with spinlock") replaced rwlock with spinlock to fix priority inversion. However, in eventpoll, the issue only affects RT. To avoid the performance regression on non-RT systems, revert this change in preparation for adding macro isolation to keep using rwlock on non-RT systems. Fixes: d26ee5945bbc ("eventpoll: Replace rwlock with spinlock") Signed-off-by: Ran Hongyun <ranhongyun1(a)huawei.com> --- fs/eventpoll.c | 139 ++++++++++++++++++++++++++++++++++++++++--------- 1 file changed, 113 insertions(+), 26 deletions(-) diff --git a/fs/eventpoll.c b/fs/eventpoll.c index 2cfee7d7b50c..ba719222a2da 100644 --- a/fs/eventpoll.c +++ b/fs/eventpoll.c @@ -45,10 +45,10 @@ * * 1) epnested_mutex (mutex) * 2) ep->mtx (mutex) - * 3) ep->lock (spinlock) + * 3) ep->lock (rwlock) * * The acquire order is the one listed above, from 1 to 3. - * We need a spinlock (ep->lock) because we manipulate objects + * We need a rwlock (ep->lock) because we manipulate objects * from inside the poll callback, that might be triggered from * a wake_up() that in turn might be called from IRQ context. * So we can't sleep inside the poll callback and hence we need @@ -194,7 +194,7 @@ struct eventpoll { struct list_head rdllist; /* Lock which protects rdllist and ovflist */ - spinlock_t lock; + rwlock_t lock; /* RB tree root used to store monitored fd structs */ struct rb_root_cached rbr; @@ -628,10 +628,10 @@ static void ep_start_scan(struct eventpoll *ep, struct list_head *txlist) * in a lockless way. */ lockdep_assert_irqs_enabled(); - spin_lock_irq(&ep->lock); + write_lock_irq(&ep->lock); list_splice_init(&ep->rdllist, txlist); WRITE_ONCE(ep->ovflist, NULL); - spin_unlock_irq(&ep->lock); + write_unlock_irq(&ep->lock); } static void ep_done_scan(struct eventpoll *ep, @@ -639,7 +639,7 @@ static void ep_done_scan(struct eventpoll *ep, { struct epitem *epi, *nepi; - spin_lock_irq(&ep->lock); + write_lock_irq(&ep->lock); /* * During the time we spent inside the "sproc" callback, some * other events might have been queued by the poll callback. @@ -680,7 +680,7 @@ static void ep_done_scan(struct eventpoll *ep, wake_up(&ep->wq); } - spin_unlock_irq(&ep->lock); + write_unlock_irq(&ep->lock); } static void epi_rcu_free(struct rcu_head *head) @@ -777,10 +777,10 @@ static bool ep_remove_epi(struct eventpoll *ep, struct epitem *epi) rb_erase_cached(&epi->rbn, &ep->rbr); - spin_lock_irq(&ep->lock); + write_lock_irq(&ep->lock); if (ep_is_linked(epi)) list_del_init(&epi->rdllink); - spin_unlock_irq(&ep->lock); + write_unlock_irq(&ep->lock); wakeup_source_unregister(ep_wakeup_source(epi)); /* @@ -1040,7 +1040,7 @@ static int ep_alloc(struct eventpoll **pep) return -ENOMEM; mutex_init(&ep->mtx); - spin_lock_init(&ep->lock); + rwlock_init(&ep->lock); init_waitqueue_head(&ep->wq); init_waitqueue_head(&ep->poll_wait); INIT_LIST_HEAD(&ep->rdllist); @@ -1127,10 +1127,100 @@ struct file *get_epoll_tfile_raw_ptr(struct file *file, int tfd, } #endif /* CONFIG_KCMP */ +/* + * Adds a new entry to the tail of the list in a lockless way, i.e. + * multiple CPUs are allowed to call this function concurrently. + * + * Beware: it is necessary to prevent any other modifications of the + * existing list until all changes are completed, in other words + * concurrent list_add_tail_lockless() calls should be protected + * with a read lock, where write lock acts as a barrier which + * makes sure all list_add_tail_lockless() calls are fully + * completed. + * + * Also an element can be locklessly added to the list only in one + * direction i.e. either to the tail or to the head, otherwise + * concurrent access will corrupt the list. + * + * Return: %false if element has been already added to the list, %true + * otherwise. + */ +static inline bool list_add_tail_lockless(struct list_head *new, + struct list_head *head) +{ + struct list_head *prev; + + /* + * This is simple 'new->next = head' operation, but cmpxchg() + * is used in order to detect that same element has been just + * added to the list from another CPU: the winner observes + * new->next == new. + */ + if (!try_cmpxchg(&new->next, &new, head)) + return false; + + /* + * Initially ->next of a new element must be updated with the head + * (we are inserting to the tail) and only then pointers are atomically + * exchanged. XCHG guarantees memory ordering, thus ->next should be + * updated before pointers are actually swapped and pointers are + * swapped before prev->next is updated. + */ + + prev = xchg(&head->prev, new); + + /* + * It is safe to modify prev->next and new->prev, because a new element + * is added only to the tail and new->next is updated before XCHG. + */ + + prev->next = new; + new->prev = prev; + + return true; +} + +/* + * Chains a new epi entry to the tail of the ep->ovflist in a lockless way, + * i.e. multiple CPUs are allowed to call this function concurrently. + * + * Return: %false if epi element has been already chained, %true otherwise. + */ +static inline bool chain_epi_lockless(struct epitem *epi) +{ + struct eventpoll *ep = epi->ep; + + /* Fast preliminary check */ + if (epi->next != EP_UNACTIVE_PTR) + return false; + + /* Check that the same epi has not been just chained from another CPU */ + if (cmpxchg(&epi->next, EP_UNACTIVE_PTR, NULL) != EP_UNACTIVE_PTR) + return false; + + /* Atomically exchange tail */ + epi->next = xchg(&ep->ovflist, epi); + + return true; +} + /* * This is the callback that is passed to the wait queue wakeup * mechanism. It is called by the stored file descriptors when they * have events to report. + * + * This callback takes a read lock in order not to contend with concurrent + * events from another file descriptor, thus all modifications to ->rdllist + * or ->ovflist are lockless. Read lock is paired with the write lock from + * ep_start/done_scan(), which stops all list modifications and guarantees + * that lists state is seen correctly. + * + * Another thing worth to mention is that ep_poll_callback() can be called + * concurrently for the same @epi from different CPUs if poll table was inited + * with several wait queues entries. Plural wakeup from different CPUs of a + * single wait queue is serialized by wq.lock, but the case when multiple wait + * queues are used should be detected accordingly. This is detected using + * cmpxchg() operation. */ static int ep_poll_callback(wait_queue_entry_t *wait, unsigned mode, int sync, void *key) { @@ -1141,7 +1231,7 @@ static int ep_poll_callback(wait_queue_entry_t *wait, unsigned mode, int sync, v unsigned long flags; int ewake = 0; - spin_lock_irqsave(&ep->lock, flags); + read_lock_irqsave(&ep->lock, flags); ep_set_busy_poll_napi_id(epi); @@ -1170,15 +1260,12 @@ static int ep_poll_callback(wait_queue_entry_t *wait, unsigned mode, int sync, v * chained in ep->ovflist and requeued later on. */ if (READ_ONCE(ep->ovflist) != EP_UNACTIVE_PTR) { - if (epi->next == EP_UNACTIVE_PTR) { - epi->next = READ_ONCE(ep->ovflist); - WRITE_ONCE(ep->ovflist, epi); + if (chain_epi_lockless(epi)) ep_pm_stay_awake_rcu(epi); - } } else if (!ep_is_linked(epi)) { /* In the usual case, add event to ready list. */ - list_add_tail(&epi->rdllink, &ep->rdllist); - ep_pm_stay_awake_rcu(epi); + if (list_add_tail_lockless(&epi->rdllink, &ep->rdllist)) + ep_pm_stay_awake_rcu(epi); } /* @@ -1211,7 +1298,7 @@ static int ep_poll_callback(wait_queue_entry_t *wait, unsigned mode, int sync, v pwake++; out_unlock: - spin_unlock_irqrestore(&ep->lock, flags); + read_unlock_irqrestore(&ep->lock, flags); /* We have to call this outside the lock */ if (pwake) @@ -1546,7 +1633,7 @@ static int ep_insert(struct eventpoll *ep, const struct epoll_event *event, } /* We have to drop the new item inside our item list to keep track of it */ - spin_lock_irq(&ep->lock); + write_lock_irq(&ep->lock); /* record NAPI ID of new item if present */ ep_set_busy_poll_napi_id(epi); @@ -1563,7 +1650,7 @@ static int ep_insert(struct eventpoll *ep, const struct epoll_event *event, pwake++; } - spin_unlock_irq(&ep->lock); + write_unlock_irq(&ep->lock); /* We have to call this outside the lock */ if (pwake) @@ -1627,7 +1714,7 @@ static int ep_modify(struct eventpoll *ep, struct epitem *epi, * list, push it inside. */ if (ep_item_poll(epi, &pt, 1)) { - spin_lock_irq(&ep->lock); + write_lock_irq(&ep->lock); if (!ep_is_linked(epi)) { list_add_tail(&epi->rdllink, &ep->rdllist); ep_pm_stay_awake(epi); @@ -1638,7 +1725,7 @@ static int ep_modify(struct eventpoll *ep, struct epitem *epi, if (waitqueue_active(&ep->poll_wait)) pwake++; } - spin_unlock_irq(&ep->lock); + write_unlock_irq(&ep->lock); } /* We have to call this outside the lock */ @@ -1871,7 +1958,7 @@ static int ep_poll(struct eventpoll *ep, struct epoll_event __user *events, init_wait(&wait); wait.func = ep_autoremove_wake_function; - spin_lock_irq(&ep->lock); + write_lock_irq(&ep->lock); /* * Barrierless variant, waitqueue_active() is called under * the same lock on wakeup ep_poll_callback() side, so it @@ -1890,7 +1977,7 @@ static int ep_poll(struct eventpoll *ep, struct epoll_event __user *events, if (!eavail) __add_wait_queue_exclusive(&ep->wq, &wait); - spin_unlock_irq(&ep->lock); + write_unlock_irq(&ep->lock); if (!eavail) timed_out = !schedule_hrtimeout_range(to, slack, @@ -1905,7 +1992,7 @@ static int ep_poll(struct eventpoll *ep, struct epoll_event __user *events, eavail = 1; if (!list_empty_careful(&wait.entry)) { - spin_lock_irq(&ep->lock); + write_lock_irq(&ep->lock); /* * If the thread timed out and is not on the wait queue, * it means that the thread was woken up after its @@ -1916,7 +2003,7 @@ static int ep_poll(struct eventpoll *ep, struct epoll_event __user *events, if (timed_out) eavail = list_empty(&wait.entry); __remove_wait_queue(&ep->wq, &wait); - spin_unlock_irq(&ep->lock); + write_unlock_irq(&ep->lock); } } } -- 2.52.0

1 0

[PATCH OLK-6.6] md: use bio_alloc when sync_set is not initialized in md_super_write
by Ran Hongyun 18 Sep '26

18 Sep '26

Offering: HULK hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9983 -------------------------------- Commit 6a5965696856 removed md_bio_alloc_sync and used bio_alloc_bioset instead. But when md_super_write is called after __md_stop has destroyed sync_set, bio_alloc_bioset with &mddev->sync_set triggers WARN_ON_ONCE because the bioset is not initialized. Fall back to bio_alloc (which uses fs_bio_set) when sync_set is not initialized. Fixes: 6a5965696856 ("md: remove md_bio_alloc_sync") Signed-off-by: Ran Hongyun <ranhongyun1(a)huawei.com> --- drivers/md/md.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/drivers/md/md.c b/drivers/md/md.c index 2a32de5f5b64..a501fe675893 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -1075,6 +1075,9 @@ void md_super_write(struct mddev *mddev, struct md_rdev *rdev, * If an error occurred, call md_error */ struct bio *bio; + struct block_device *bdev; + blk_opf_t opf = REQ_OP_WRITE | REQ_SYNC | REQ_IDLE | REQ_META + | REQ_PREFLUSH | REQ_FUA; if (!page) return; @@ -1082,11 +1085,12 @@ void md_super_write(struct mddev *mddev, struct md_rdev *rdev, if (test_bit(Faulty, &rdev->flags)) return; - bio = bio_alloc_bioset(rdev->meta_bdev ? rdev->meta_bdev : rdev->bdev, - 1, - REQ_OP_WRITE | REQ_SYNC | REQ_IDLE | REQ_META - | REQ_PREFLUSH | REQ_FUA, - GFP_NOIO, &mddev->sync_set); + bdev = rdev->meta_bdev ? rdev->meta_bdev : rdev->bdev; + + if (bioset_initialized(&mddev->sync_set)) + bio = bio_alloc_bioset(bdev, 1, opf, GFP_NOIO, &mddev->sync_set); + else + bio = bio_alloc(bdev, 1, opf, GFP_NOIO); atomic_inc(&rdev->nr_pending); -- 2.52.0

2 1

[PATCH OLK-6.6 00/19] backport minios part4 patches from linux mainline on September 19th.
by Qinxin Xia 17 Sep '26

17 Sep '26

driver inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/8904 ---------------------------------------------------------------------- backport minios part4 patches from linux mainline on September 19th. Marc Zyngier (2): KVM: arm64: Properly save/restore HCRX_EL2 KVM: arm64: Kill HCRX_HOST_FLAGS Mark Brown (6): arm64/sysreg: Update HCRX_EL2 definition for DDI0601 2023-09 arm64/fpsimd: Enable host kernel access to FPMR arm64/fpsimd: Support FEAT_FPMR arm64/signal: Add FPMR signal handling arm64/ptrace: Expose FPMR via ptrace arm64/fpsimd: Don't corrupt FPMR when streaming mode changes Mark Rutland (10): arm64: ptrace: fix partial SETREGSET for NT_ARM_FPMR arm64/fpsimd: Add fpsimd_save_and_flush_current_state() arm64/fpsimd: Reset FPMR upon exec() arm64/fpsimd: signal32: Always save+flush state early arm64/fpsimd: signal: Always save+flush state early arm64/fpsimd: Avoid warning when sve_to_fpsimd() is unused arm64/fpsimd: Do not discard modified SVE state arm64/fpsimd: signal: Clear TPIDR2 when delivering signals arm64/fpsimd: signal: Use SMSTOP behaviour in setup_return() arm64/fpsimd: Add task_smstop_sm() Qinxin Xia (2): arm64/fpsimd: Fix fpmr KABI breakage arm64/idreg: Add support "arm64.nocnp" for start option Documentation/arch/arm64/sme.rst | 2 +- arch/arm64/include/asm/cpufeature.h | 6 ++ arch/arm64/include/asm/el2_setup.h | 2 +- arch/arm64/include/asm/fpsimd.h | 10 +- arch/arm64/include/asm/kvm_arm.h | 1 - arch/arm64/include/asm/processor.h | 2 +- arch/arm64/include/asm/signal_common.h | 20 +++- arch/arm64/include/uapi/asm/sigcontext.h | 8 ++ arch/arm64/kernel/cpufeature.c | 15 ++- arch/arm64/kernel/entry-common.c | 50 +++++++--- arch/arm64/kernel/fpsimd.c | 99 +++++++++++++------- arch/arm64/kernel/idreg-override.c | 11 +++ arch/arm64/kernel/ptrace.c | 46 +++++++++ arch/arm64/kernel/signal.c | 114 +++++++++++------------ arch/arm64/kernel/signal32.c | 11 ++- arch/arm64/kvm/hyp/include/hyp/switch.h | 13 ++- arch/arm64/tools/cpucaps | 2 +- arch/arm64/tools/sysreg | 4 +- include/uapi/linux/elf.h | 1 + 19 files changed, 287 insertions(+), 130 deletions(-) -- 2.33.0

2 21

[PATCH OLK-6.6] null_blk: serialize configfs attribute stores with the lock
by Zhou Minqiang 17 Sep '26

17 Sep '26

mainline inclusion from mainline-v7.3-rc1 commit 7e7fff51808237703a3a1df6dd5cae1dfd1db86d category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/10007 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The NULLB_DEVICE_ATTR _store takes no lock: apply_fn attributes (submit_queues, poll_queues) get dev->NAME written again after apply_fn returns, outside its lock; APPLY=NULL attributes are entirely lockless. configfs only serializes stores per-open-file, so concurrent stores on separate fds race. For apply_fn attributes, once one store's apply_fn has reconfigured the hardware, a second (losing) store can still overwrite dev->NAME afterwards. This leaves dev->submit_queues out of sync with the live queue count, which is later caught by the WARN_ON_ONCE() in null_map_queues(). For !apply_fn attributes, power_store()'s null_add_dev() validates and builds the device under "lock" but only sets CONFIGURED afterwards. A store slipping in during this window can change a field mid-setup -- for example, zone_nr_conv can be pushed above nr_zones after it has already been clamped, leading to an out-of-bounds dev->zones[] access. Take "lock" in the macro around the apply_fn call, the CONFIGURED test and the field write, and move it out of nullb_apply_submit_queues()/ nullb_apply_poll_queues() so both paths are covered once. This serializes stores with power_store's setup and with each other. Fixes: 45919fbfe1c4 ("null_blk: Enable modifying 'submit_queues' after an instance has been configured") Suggested-by: Bart Van Assche <bvanassche(a)acm.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> Reviewed-by: Nilay Shroff <nilay(a)linux.ibm.com> Link: https://patch.msgid.link/20260725022509.714271-10-wozizhi@huaweicloud.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Zhou Minqiang <zhouminqiang2(a)huawei.com> --- drivers/block/null_blk/main.c | 17 +++-------------- 1 file changed, 3 insertions(+), 14 deletions(-) diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c index b42b0c3f3d59..7db8af00c468 100644 --- a/drivers/block/null_blk/main.c +++ b/drivers/block/null_blk/main.c @@ -331,6 +331,7 @@ nullb_device_##NAME##_store(struct config_item *item, const char *page, \ ret = nullb_device_##TYPE##_attr_store(&new_value, page, count);\ if (ret < 0) \ return ret; \ + guard(mutex)(&lock); \ if (apply_fn) \ ret = apply_fn(dev, new_value); \ else if (test_bit(NULLB_DEV_FL_CONFIGURED, &dev->flags)) \ @@ -392,25 +393,13 @@ static int nullb_update_nr_hw_queues(struct nullb_device *dev, static int nullb_apply_submit_queues(struct nullb_device *dev, unsigned int submit_queues) { - int ret; - - mutex_lock(&lock); - ret = nullb_update_nr_hw_queues(dev, submit_queues, dev->poll_queues); - mutex_unlock(&lock); - - return ret; + return nullb_update_nr_hw_queues(dev, submit_queues, dev->poll_queues); } static int nullb_apply_poll_queues(struct nullb_device *dev, unsigned int poll_queues) { - int ret; - - mutex_lock(&lock); - ret = nullb_update_nr_hw_queues(dev, dev->submit_queues, poll_queues); - mutex_unlock(&lock); - - return ret; + return nullb_update_nr_hw_queues(dev, dev->submit_queues, poll_queues); } NULLB_DEVICE_ATTR(size, ulong, NULL); -- 2.52.0

2 1

[PATCH OLK-6.6] md: Fix the null-ptr-deref of 'mddev->private' while submitting IO
by Zhou Minqiang 17 Sep '26

17 Sep '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/10008 Reference: https://lore.kernel.org/linux-raid/20260917024205.2331019-1-chengzhihao1@hu… -------------------------------- Concurrent processes md_stop and IO submitting could trigger a null-ptr-deref of 'mddev->private': BUG: kernel NULL pointer dereference, address: 0000000000000070 RIP: 0010:_wait_barrier+0x2f/0x250 Call Trace: raid1_make_request+0x150/0xf50 md_handle_request+0x104/0x530 md_submit_bio+0x76/0x130 submit_bio+0xdd/0x250 submit_bio_wait+0x1f/0x40 __blkdev_direct_IO_simple+0x1f6/0x370 blkdev_write_iter+0x3b2/0x520 ksys_write+0x7d/0x190 P1 fd = open(/dev/md0, O_RDWR) P2 (forked from P1, fd' <= fd) write(fd) submit_bio md_handle_request raid1_make_request raid1_write_request ioctl(fd, STOP_ARRAY) mddev_set_closing_and_sync_blockdev // check passed, mddev->openers = 1, // because md_open() is only called // once in P1->open do_md_stop __md_stop mddev->private = NULL conf = mddev->private // NULL wait_barrier(conf, sector) // null-ptr-deref ! It is a common problem for raid0/1/10/5, and __md_stop could be triggered by several paths(eg. ioctl, sysfs, ->dtr). Fix it by replacing mddev_lock() with mddev_suspend_and_lock() for all __md_stop() callers. The caller dm_table_destroy() is guaranteed being invoked with device suspended, so raid_dtr() could keep using mddev_lock_nointr(). Besides, fail the submitting IO in md_handle_request() if the 'mddev->pers' becomes NULL. Fetch a reproducer in https://bugzilla.kernel.org/show_bug.cgi?id=222020 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+3fe892ea5fc292e1353f(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3fe892ea5fc292e1353f Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Signed-off-by: Zhou Minqiang <zhouminqiang2(a)huawei.com> --- drivers/md/md.c | 32 +++++++++++++++++++++++++++++--- 1 file changed, 29 insertions(+), 3 deletions(-) diff --git a/drivers/md/md.c b/drivers/md/md.c index 2a32de5f5b64..60fd3494a527 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -404,6 +404,20 @@ bool md_handle_request(struct mddev *mddev, struct bio *bio) if (!percpu_ref_tryget_live(&mddev->active_io)) goto check_suspended; } + if (!mddev->pers) { + /* + * The __md_stop() sets 'mddev->private' to NULL during + * the IO submitting, check 'mddev->pers' before the IO + * being processed by specific driver to avoid the + * null-ptr-deref of 'mddev-><member>'. The check is + * safe because the IO has got the 'mddev->active_io' + * reference, and all __md_stop() callers will wait for + * the reference to be zero. + */ + bio_io_error(bio); + percpu_ref_put(&mddev->active_io); + return true; + } if (!mddev->pers->make_request(mddev, bio)) { percpu_ref_put(&mddev->active_io); if (!mddev->gendisk && mddev->pers->prepare_suspend) @@ -4543,6 +4557,8 @@ array_state_store(struct mddev *mddev, const char *buf, size_t len) { int err = 0; enum array_state st = match_word(buf, array_states); + unsigned int noio_flags = 0; + bool suspend = false; /* No lock dependent actions */ switch (st) { @@ -4552,9 +4568,11 @@ array_state_store(struct mddev *mddev, const char *buf, size_t len) case broken: /* cannot be set */ case bad_word: return -EINVAL; + case inactive: case clear: + suspend = true; + fallthrough; case readonly: - case inactive: case read_auto: if (!mddev->pers || !md_is_rdwr(mddev)) break; @@ -4588,9 +4606,11 @@ array_state_store(struct mddev *mddev, const char *buf, size_t len) spin_unlock(&mddev->lock); return err ?: len; } - err = mddev_lock(mddev); + err = suspend ? mddev_suspend_and_lock(mddev) : mddev_lock(mddev); if (err) return err; + if (suspend) + noio_flags = memalloc_noio_save(); switch (st) { case inactive: @@ -4661,7 +4681,12 @@ array_state_store(struct mddev *mddev, const char *buf, size_t len) mddev->hold_active = 0; sysfs_notify_dirent_safe(mddev->sysfs_state); } - mddev_unlock(mddev); + if (suspend) { + mddev_unlock_and_resume(mddev); + memalloc_noio_restore(noio_flags); + } else { + mddev_unlock(mddev); + } if (st == readonly || st == read_auto || st == inactive || (err && st == clear)) @@ -7750,6 +7775,7 @@ static bool md_ioctl_need_suspend(unsigned int cmd) case HOT_REMOVE_DISK: case SET_BITMAP_FILE: case SET_ARRAY_INFO: + case STOP_ARRAY: return true; default: return false; -- 2.52.0

2 1

[PATCH OLK-6.6] nvmet-tcp: bound SGL data length before allocating command buffers
by Yifan Qiao 17 Sep '26

17 Sep '26

From: Ibrahim Hashimov <security(a)auditcode.ai> mainline inclusion from mainline-v7.3-rc1 commit 4a3f00262a044e8e15064b1a6860968bf0500bf4 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18635 CVE: CVE-2026-80789 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- nvmet_tcp_map_data() reads the host-controlled 32-bit sgl->length and, for the in-capsule offset descriptor (type 0x01), checks it against port->inline_data_size before use. Any other SGL descriptor type -- including the non-inline transport SGL data-block descriptor (type (NVME_TRANSPORT_SGL_DATA_DESC << 4) | NVME_SGL_FMT_TRANSPORT_A, the type a real host uses for out-of-capsule writes) skips that check entirely and falls straight through to: cmd->req.sg = sgl_alloc(len, GFP_KERNEL, &cmd->req.sg_cnt); with len taken directly from the wire, unbounded up to 4 GiB. nvmet_req_init() only parses the command and never inspects sgl->length, and nvmet_check_transfer_len() -- the only other place transfer_len is validated -- runs later, from req->execute(), after the allocation has already happened. For a write command the target responds with an R2T and parks the command waiting for the host to send the data; if the host (or an unauthenticated peer that simply never follows up) never does, the sgl_alloc() buffer stays resident for the life of the command. NVMe/TCP has no mandatory authentication in the default configuration, so any peer able to reach the target portal and complete a Fabrics connect can drive this with a single crafted command, repeatable across queues and connections for amplification. This is unbounded kernel memory allocation triggered by a remote, effectively unauthenticated peer. Validate len against the same NVMET_TCP_MAXH2CDATA ceiling this file already uses to bound per-PDU H2C data, for every SGL descriptor type, before doing any allocation. This closes the gap for the non-inline descriptor while leaving the existing, tighter inline_data_size check in place for the in-capsule case. Runtime-verified on a v6.19 KASAN stand: with this bound in place, a crafted write command carrying an oversized non-inline SGL length is rejected before sgl_alloc() runs, where the same request previously drove an unbounded ~256 MiB kernel allocation (up to 4 GiB) that stayed resident pending an R2T the host never satisfies. Fixes: 872d26a391da ("nvmet-tcp: add NVMe over TCP target driver") Cc: stable(a)vger.kernel.org Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Ibrahim Hashimov <security(a)auditcode.ai> Assisted-by: AuditCode-AI:2026.07 Signed-off-by: Keith Busch <kbusch(a)kernel.org> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- drivers/nvme/target/tcp.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c index 85dfec2adb26..a5a4443241cd 100644 --- a/drivers/nvme/target/tcp.c +++ b/drivers/nvme/target/tcp.c @@ -417,6 +417,19 @@ static int nvmet_tcp_map_data(struct nvmet_tcp_cmd *cmd) if (!len) return 0; + /* + * inline_data_size only bounds the in-capsule (type 0x01) SGL + * descriptor below. A non-inline transport SGL data-block + * descriptor skips that check entirely and would otherwise reach + * sgl_alloc() with an attacker-controlled len of up to 4 GiB, + * pinning that much kernel memory for a command that may never + * complete. Bound every descriptor type here, before allocating + * anything, using the same ceiling this file already applies to + * per-PDU H2C data. + */ + if (len > NVMET_TCP_MAXH2CDATA) + return NVME_SC_SGL_INVALID_DATA | NVME_SC_DNR; + if (sgl->type == ((NVME_SGL_FMT_DATA_DESC << 4) | NVME_SGL_FMT_OFFSET)) { if (!nvme_is_write(cmd->req.cmd)) -- 2.52.0

2 1

[PATCH openEuler-1.0-LTS v2] bpf: Disable preemption in __bpf_get_stack
by Pu Lehui 17 Sep '26

17 Sep '26

From: Daniel Borkmann <borkmann(a)iogearbox.net> mainline inclusion from mainline-v7.3-rc1 commit b1a47b2708d4e95dbd23aee2ec83752190897b3f category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18901 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- get_perf_callchain() returns a per-CPU perf_callchain_entry buffer and releases its recursion slot via put_callchain_entry() before returning, so nothing keeps the entry reserved while __bpf_get_stack() consumes it below. A preemptible BPF program (e.g. a non-sleepable raw tracepoint program on a PREEMPT kernel, which runs under migrate_disable() but not preempt_disable()) can be scheduled out between obtaining the entry and the copy. Another task scheduled on the same CPU then reuses the same per-CPU buffer and overwrites trace->nr with a larger value. copy_len is then computed from the inflated trace->nr and can exceed the caller's buffer, causing an out-of-bounds write in the memcpy() and in the build_id path. The rcu_read_lock() taken here alone does not prevent this. It is only taken on the may_fault path, and under CONFIG_PREEMPT_RCU it does not disable preemption; it merely keeps perf's callchain buffer array alive (freed via call_rcu()) and does nothing to stop another task from reusing the entry. Disable preemption around obtaining the callchain entry and copying it into the caller's buffer, so the entry cannot be reused underneath us and trace->nr stays bounded by max_depth. Build ID resolution may fault and is therefore deferred until after preemption is re-enabled; by then the instruction pointers have already been copied into buf, so it operates only on that private copy. Note, preempt_disable() also subsumes the buffer-lifetime guarantee the rcu_read_lock() provided, since a preempt-disabled section is an RCU read-side critical section for the callchain buffers' call_rcu() reclaim. Fixes: c195651e565a ("bpf: add bpf_get_stack helper") Reported-by: Tao Chen <chen.dylane(a)linux.dev> Reported-by: STAR Labs SG <info(a)starlabs.sg> Signed-off-by: Daniel Borkmann <borkmann(a)iogearbox.net> Signed-off-by: Jiri Olsa <jolsa(a)kernel.org> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/bpf/20260803210149.296496-11-jolsa@kernel.org Closes: https://lore.kernel.org/bpf/20260206090653.1336687-1-chen.dylane@linux.dev/ [ changed Fixes: commit ] Conflicts: kernel/bpf/stackmap.c [not refactor to callchain_store and callchain_finalize] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/stackmap.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c index a41858db1441..aefa036c9a91 100644 --- a/kernel/bpf/stackmap.c +++ b/kernel/bpf/stackmap.c @@ -477,6 +477,7 @@ BPF_CALL_4(bpf_get_stack, struct pt_regs *, regs, void *, buf, u32, size, if (unlikely(size % elem_size)) goto clear; + preempt_disable(); num_elem = size / elem_size; if (sysctl_perf_event_max_stack < num_elem) init_nr = 0; @@ -484,12 +485,16 @@ BPF_CALL_4(bpf_get_stack, struct pt_regs *, regs, void *, buf, u32, size, init_nr = sysctl_perf_event_max_stack - num_elem; trace = get_perf_callchain(regs, init_nr, kernel, user, sysctl_perf_event_max_stack, false, false); - if (unlikely(!trace)) + if (unlikely(!trace)) { + preempt_enable(); goto err_fault; + } trace_nr = trace->nr - init_nr; - if (trace_nr < skip) + if (trace_nr < skip) { + preempt_enable(); goto err_fault; + } trace_nr -= skip; trace_nr = (trace_nr <= num_elem) ? trace_nr : num_elem; @@ -500,6 +505,8 @@ BPF_CALL_4(bpf_get_stack, struct pt_regs *, regs, void *, buf, u32, size, else memcpy(buf, ips, copy_len); + preempt_enable(); + if (size > copy_len) memset(buf + copy_len, 0, size - copy_len); return copy_len; -- 2.34.1

2 1

[PATCH OLK-6.6 v3] bpf: Disable preemption in __bpf_get_stack
by Pu Lehui 17 Sep '26

17 Sep '26

From: Daniel Borkmann <borkmann(a)iogearbox.net> mainline inclusion from mainline-v7.3-rc1 commit b1a47b2708d4e95dbd23aee2ec83752190897b3f category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18901 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- get_perf_callchain() returns a per-CPU perf_callchain_entry buffer and releases its recursion slot via put_callchain_entry() before returning, so nothing keeps the entry reserved while __bpf_get_stack() consumes it below. A preemptible BPF program (e.g. a non-sleepable raw tracepoint program on a PREEMPT kernel, which runs under migrate_disable() but not preempt_disable()) can be scheduled out between obtaining the entry and the copy. Another task scheduled on the same CPU then reuses the same per-CPU buffer and overwrites trace->nr with a larger value. copy_len is then computed from the inflated trace->nr and can exceed the caller's buffer, causing an out-of-bounds write in the memcpy() and in the build_id path. The rcu_read_lock() taken here alone does not prevent this. It is only taken on the may_fault path, and under CONFIG_PREEMPT_RCU it does not disable preemption; it merely keeps perf's callchain buffer array alive (freed via call_rcu()) and does nothing to stop another task from reusing the entry. Disable preemption around obtaining the callchain entry and copying it into the caller's buffer, so the entry cannot be reused underneath us and trace->nr stays bounded by max_depth. Build ID resolution may fault and is therefore deferred until after preemption is re-enabled; by then the instruction pointers have already been copied into buf, so it operates only on that private copy. Note, preempt_disable() also subsumes the buffer-lifetime guarantee the rcu_read_lock() provided, since a preempt-disabled section is an RCU read-side critical section for the callchain buffers' call_rcu() reclaim. Fixes: c195651e565a ("bpf: add bpf_get_stack helper") Reported-by: Tao Chen <chen.dylane(a)linux.dev> Reported-by: STAR Labs SG <info(a)starlabs.sg> Signed-off-by: Daniel Borkmann <borkmann(a)iogearbox.net> Signed-off-by: Jiri Olsa <jolsa(a)kernel.org> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/bpf/20260803210149.296496-11-jolsa@kernel.org Closes: https://lore.kernel.org/bpf/20260206090653.1336687-1-chen.dylane@linux.dev/ [ changed Fixes: commit ] Conflicts: kernel/bpf/stackmap.c [not refactor to callchain_store and callchain_finalize] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/stackmap.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c index 2a4070d0b594..e496da6e5ddf 100644 --- a/kernel/bpf/stackmap.c +++ b/kernel/bpf/stackmap.c @@ -444,6 +444,7 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task, max_depth = stack_map_calculate_max_depth(size, elem_size, flags); + preempt_disable(); if (trace_in) { trace = trace_in; trace->nr = min_t(u32, trace->nr, max_depth); @@ -453,11 +454,15 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task, trace = get_perf_callchain(regs, 0, kernel, user, max_depth, crosstask, false); } - if (unlikely(!trace)) + if (unlikely(!trace)) { + preempt_enable(); goto err_fault; + } - if (trace->nr < skip) + if (trace->nr < skip) { + preempt_enable(); goto err_fault; + } trace_nr = trace->nr - skip; copy_len = trace_nr * elem_size; @@ -468,6 +473,8 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task, else memcpy(buf, ips, copy_len); + preempt_enable(); + if (size > copy_len) memset(buf + copy_len, 0, size - copy_len); return copy_len; -- 2.34.1

2 1

[PATCH OLK-5.10 v3] bpf: Disable preemption in __bpf_get_stack
by Pu Lehui 17 Sep '26

17 Sep '26

From: Daniel Borkmann <borkmann(a)iogearbox.net> mainline inclusion from mainline-v7.3-rc1 commit b1a47b2708d4e95dbd23aee2ec83752190897b3f category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18901 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- get_perf_callchain() returns a per-CPU perf_callchain_entry buffer and releases its recursion slot via put_callchain_entry() before returning, so nothing keeps the entry reserved while __bpf_get_stack() consumes it below. A preemptible BPF program (e.g. a non-sleepable raw tracepoint program on a PREEMPT kernel, which runs under migrate_disable() but not preempt_disable()) can be scheduled out between obtaining the entry and the copy. Another task scheduled on the same CPU then reuses the same per-CPU buffer and overwrites trace->nr with a larger value. copy_len is then computed from the inflated trace->nr and can exceed the caller's buffer, causing an out-of-bounds write in the memcpy() and in the build_id path. The rcu_read_lock() taken here alone does not prevent this. It is only taken on the may_fault path, and under CONFIG_PREEMPT_RCU it does not disable preemption; it merely keeps perf's callchain buffer array alive (freed via call_rcu()) and does nothing to stop another task from reusing the entry. Disable preemption around obtaining the callchain entry and copying it into the caller's buffer, so the entry cannot be reused underneath us and trace->nr stays bounded by max_depth. Build ID resolution may fault and is therefore deferred until after preemption is re-enabled; by then the instruction pointers have already been copied into buf, so it operates only on that private copy. Note, preempt_disable() also subsumes the buffer-lifetime guarantee the rcu_read_lock() provided, since a preempt-disabled section is an RCU read-side critical section for the callchain buffers' call_rcu() reclaim. Fixes: c195651e565a ("bpf: add bpf_get_stack helper") Reported-by: Tao Chen <chen.dylane(a)linux.dev> Reported-by: STAR Labs SG <info(a)starlabs.sg> Signed-off-by: Daniel Borkmann <borkmann(a)iogearbox.net> Signed-off-by: Jiri Olsa <jolsa(a)kernel.org> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/bpf/20260803210149.296496-11-jolsa@kernel.org Closes: https://lore.kernel.org/bpf/20260206090653.1336687-1-chen.dylane@linux.dev/ [ changed Fixes: commit ] Conflicts: kernel/bpf/stackmap.c [not refactor to callchain_store and callchain_finalize] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/stackmap.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c index 0c3504e598e3..30fd2bd4a997 100644 --- a/kernel/bpf/stackmap.c +++ b/kernel/bpf/stackmap.c @@ -620,6 +620,7 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task, if (sysctl_perf_event_max_stack < max_depth) max_depth = sysctl_perf_event_max_stack; + preempt_disable(); if (trace_in) trace = trace_in; else if (kernel && task) @@ -627,11 +628,15 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task, else trace = get_perf_callchain(regs, 0, kernel, user, max_depth, crosstask, false); - if (unlikely(!trace)) + if (unlikely(!trace)) { + preempt_enable(); goto err_fault; + } - if (trace->nr < skip) + if (trace->nr < skip) { + preempt_enable(); goto err_fault; + } trace_nr = trace->nr - skip; trace_nr = (trace_nr <= num_elem) ? trace_nr : num_elem; @@ -643,6 +648,8 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task, else memcpy(buf, ips, copy_len); + preempt_enable(); + if (size > copy_len) memset(buf + copy_len, 0, size - copy_len); return copy_len; -- 2.34.1

2 1

[PATCH OLK-6.6] ceph: bound copied dentry name length in NFS export get_name
by Chen Yuxi 17 Sep '26

17 Sep '26

From: Michael Bommarito <michael.bommarito(a)gmail.com> mainline inclusion from mainline-v7.3-rc1 commit eff8013c5a8916613c742ae5a2cc341cb605c0ae category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18968 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm… -------------------------------- ceph_get_name() copies the MDS-supplied name into the caller's NAME_MAX-sized buffer with memcpy(name, rinfo->dname, rinfo->dname_len) and then writes name[rinfo->dname_len] = 0, without checking dname_len against NAME_MAX. A malicious or buggy MDS that returns a LOOKUPNAME reply with dname_len > NAME_MAX overflows the buffer. __get_snap_name() copies rde->name / rde->name_len the same unchecked way. Impact: a malicious or compromised Ceph MDS overflows the NAME_MAX name buffer in a client's NFS-export get_name path, a slab out-of-bounds write reported by KASAN. Reachable when a CephFS mount is re-exported over NFS. Add ceph_export_copy_name(), which rejects lengths above NAME_MAX with -ENAMETOOLONG before the copy, and use it in both ceph_get_name() and __get_snap_name(). Cc: stable(a)vger.kernel.org Fixes: 19913b4eac4a ("ceph: add get_name() NFS export callback") Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Reviewed-by: Viacheslav Dubeyko <slava(a)dubeyko.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Conflicts: fs/ceph/export.c [ctx conflict] Signed-off-by: Chen Yuxi <chenyuxi19(a)huawei.com> --- fs/ceph/export.c | 26 +++++++++++++++++--------- 1 file changed, 17 insertions(+), 9 deletions(-) diff --git a/fs/ceph/export.c b/fs/ceph/export.c index 52c4daf2447d..e9cbd08a7dcb 100644 --- a/fs/ceph/export.c +++ b/fs/ceph/export.c @@ -434,6 +434,16 @@ static struct dentry *ceph_fh_to_parent(struct super_block *sb, return dentry; } +static int ceph_export_copy_name(char *name, const char *src, u32 len) +{ + if (len > NAME_MAX) + return -ENAMETOOLONG; + + memcpy(name, src, len); + name[len] = '\0'; + return 0; +} + static int __get_snap_name(struct dentry *parent, char *name, struct dentry *child) { @@ -499,9 +509,8 @@ static int __get_snap_name(struct dentry *parent, char *name, BUG_ON(!rde->inode.in); if (ceph_snap(inode) == le64_to_cpu(rde->inode.in->snapid)) { - memcpy(name, rde->name, rde->name_len); - name[rde->name_len] = '\0'; - err = 0; + err = ceph_export_copy_name(name, rde->name, + rde->name_len); goto out; } } @@ -566,8 +575,8 @@ static int ceph_get_name(struct dentry *parent, char *name, rinfo = &req->r_reply_info; if (!IS_ENCRYPTED(dir)) { - memcpy(name, rinfo->dname, rinfo->dname_len); - name[rinfo->dname_len] = 0; + err = ceph_export_copy_name(name, rinfo->dname, + rinfo->dname_len); } else { struct fscrypt_str oname = FSTR_INIT(NULL, 0); struct ceph_fname fname = { .dir = dir, @@ -581,10 +590,9 @@ static int ceph_get_name(struct dentry *parent, char *name, goto out; err = ceph_fname_to_usr(&fname, NULL, &oname, NULL); - if (!err) { - memcpy(name, oname.name, oname.len); - name[oname.len] = 0; - } + if (!err) + err = ceph_export_copy_name(name, oname.name, + oname.len); ceph_fname_free_buffer(dir, &oname); } out: -- 2.34.1

2 1

[PATCH OLK-5.10] smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()
by Yifan Qiao 17 Sep '26

17 Sep '26

From: Frank Sorenson <sorenson(a)redhat.com> mainline inclusion from mainline-v7.3-rc1 commit 6343c1da561962688f203362d80d6a3bfa39fa1b category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18919 CVE: CVE-2026-89633 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- coalesce_t2() computes data pointers directly from server-supplied DataOffset fields with no validation against buffer bounds: data_area_of_tgt = (char *)&pSMBt->hdr.Protocol + get_unaligned_le16(&pSMBt->t2_rsp.DataOffset); data_area_of_src = (char *)&pSMBs->hdr.Protocol + get_unaligned_le16(&pSMBs->t2_rsp.DataOffset); data_area_of_tgt += total_in_tgt; ... memcpy(data_area_of_tgt, data_area_of_src, total_in_src); A small DataOffset can push a pointer below the actual byte area, overwriting header fields; a large one can push it past the buffer end, causing out-of-bounds heap reads (source) or writes (target). The BCC overflow guard does not prevent this: BCC reflects how much data is present, while DataOffset controls where in the buffer it starts. The "validate target area" comment present since the function was first written in 2005 was a placeholder that was never implemented. Add lower- and upper-bound checks for both data pointers before the memcpy, and before any target header fields are modified. Fixes: e4eb295d38b5 ("[PATCH] cifs: Handle multiple response transact2 part 1 of 2") Cc: stable(a)vger.kernel.org Reported-by: Shen Yongchao <grayhat(a)foxmail.com> Signed-off-by: Frank Sorenson <sorenson(a)redhat.com> Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Paulo Alcantara <pc(a)manguebit.org> Conflicts: fs/cifs/smb1ops.c fs/smb/client/smb1ops.c [different files] Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/cifs/smb1ops.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/fs/cifs/smb1ops.c b/fs/cifs/smb1ops.c index e540908bae43..6bcd2805cead 100644 --- a/fs/cifs/smb1ops.c +++ b/fs/cifs/smb1ops.c @@ -324,6 +324,26 @@ coalesce_t2(char *second_buf, struct smb_hdr *target_hdr) data_area_of_tgt += total_in_tgt; + /* + * DataOffset fields are server-supplied and not validated against + * buffer bounds; check both data pointers before mutating the + * target header. + */ + if (data_area_of_tgt < (char *)target_hdr + + sizeof(struct smb_t2_rsp) + sizeof(__le16) || + data_area_of_tgt + total_in_src > + (char *)target_hdr + CIFSMaxBufSize + MAX_CIFS_HDR_SIZE) { + cifs_dbg(VFS, "%s: target data area out of bounds\n", __func__); + return -EPROTO; + } + if (data_area_of_src < second_buf + + sizeof(struct smb_t2_rsp) + sizeof(__le16) || + data_area_of_src + total_in_src > + second_buf + smbCalcSize((struct smb_hdr *)second_buf, NULL)) { + cifs_dbg(VFS, "%s: secondary data area out of bounds\n", __func__); + return -EPROTO; + } + total_in_tgt += total_in_src; /* is the result too big for the field? */ if (total_in_tgt > USHRT_MAX) { -- 2.52.0

2 1

[PATCH OLK-5.10] smb: client: clear ce->tgthint in free_tgts()
by Yifan Qiao 17 Sep '26

17 Sep '26

From: Fredric Cover <fredric.cover.lkernel(a)gmail.com> mainline inclusion from mainline-v7.3-rc1 commit b1b741cf8e7ce1b91d937e23decd3d3358748700 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18921 CVE: CVE-2026-89636 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When free_tgts() frees all structures in ce->tlist, ce->tgthint is left pointing to one of the freed cache_dfs_tgt structures. If ce->tgthint is not reset before it is used later, it results in a use-after-free. Set ce->tgthint to NULL in free_tgts() after the elements are freed to reflect that no elements remain. Fixes: 54be1f6c1c37 ("cifs: Add DFS cache routines") Cc: stable(a)vger.kernel.org # depends on: smb: client: harden DFS cache against invalid target hints Signed-off-by: Fredric Cover <fredric.cover.lkernel(a)gmail.com> Reviewed-by: ChenXiaoSong <chenxiaosong(a)kylinos.cn> Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Paulo Alcantara <pc(a)manguebit.org> Conflicts: fs/cifs/dfs_cache.c fs/smb/client/dfs_cache.c [different files] Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/cifs/dfs_cache.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/cifs/dfs_cache.c b/fs/cifs/dfs_cache.c index b83932175c83..9bdc9918b12e 100644 --- a/fs/cifs/dfs_cache.c +++ b/fs/cifs/dfs_cache.c @@ -118,6 +118,8 @@ static inline void free_tgts(struct cache_entry *ce) kfree(t->name); kfree(t); } + + WRITE_ONCE(ce->tgthint, NULL); } static inline void flush_cache_ent(struct cache_entry *ce) -- 2.52.0

2 2

[PATCH openEuler-1.0-LTS] ceph: bound copied dentry name length in NFS export get_name
by Chen Yuxi 17 Sep '26

17 Sep '26

From: Michael Bommarito <michael.bommarito(a)gmail.com> mainline inclusion from mainline-v7.3-rc1 commit eff8013c5a8916613c742ae5a2cc341cb605c0ae category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18968 CVE: CVE-2026-89652 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ceph_get_name() copies the MDS-supplied name into the caller's NAME_MAX-sized buffer with memcpy(name, rinfo->dname, rinfo->dname_len) and then writes name[rinfo->dname_len] = 0, without checking dname_len against NAME_MAX. A malicious or buggy MDS that returns a LOOKUPNAME reply with dname_len > NAME_MAX overflows the buffer. __get_snap_name() copies rde->name / rde->name_len the same unchecked way. Impact: a malicious or compromised Ceph MDS overflows the NAME_MAX name buffer in a client's NFS-export get_name path, a slab out-of-bounds write reported by KASAN. Reachable when a CephFS mount is re-exported over NFS. Add ceph_export_copy_name(), which rejects lengths above NAME_MAX with -ENAMETOOLONG before the copy, and use it in both ceph_get_name() and __get_snap_name(). Cc: stable(a)vger.kernel.org Fixes: 19913b4eac4a ("ceph: add get_name() NFS export callback") Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Reviewed-by: Viacheslav Dubeyko <slava(a)dubeyko.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Conflicts: fs/ceph/export.c [Downstream tree lacks the __get_snap_name() function and fscrypt support, so only the ceph_export_copy_name() helper and the ceph_get_name() change were applied while keeping the tree's simpler (non-encrypted) get_name structure.] Signed-off-by: Chen Yuxi <chenyuxi19(a)huawei.com> --- fs/ceph/export.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) diff --git a/fs/ceph/export.c b/fs/ceph/export.c index 3c59ad180ef0..1d087cf1770c 100644 --- a/fs/ceph/export.c +++ b/fs/ceph/export.c @@ -194,6 +194,16 @@ static struct dentry *ceph_fh_to_parent(struct super_block *sb, return dentry; } +static int ceph_export_copy_name(char *name, const char *src, u32 len) +{ + if (len > NAME_MAX) + return -ENAMETOOLONG; + + memcpy(name, src, len); + name[len] = '\0'; + return 0; +} + static int ceph_get_name(struct dentry *parent, char *name, struct dentry *child) { @@ -221,10 +231,11 @@ static int ceph_get_name(struct dentry *parent, char *name, if (!err) { struct ceph_mds_reply_info_parsed *rinfo = &req->r_reply_info; - memcpy(name, rinfo->dname, rinfo->dname_len); - name[rinfo->dname_len] = 0; - dout("get_name %p ino %llx.%llx name %s\n", - child, ceph_vinop(d_inode(child)), name); + err = ceph_export_copy_name(name, rinfo->dname, + rinfo->dname_len); + if (!err) + dout("get_name %p ino %llx.%llx name %s\n", + child, ceph_vinop(d_inode(child)), name); } else { dout("get_name %p ino %llx.%llx err %d\n", child, ceph_vinop(d_inode(child)), err); -- 2.34.1

2 1

[PATCH OLK-6.6 v2] bpf: Disable preemption in __bpf_get_stack
by Pu Lehui 17 Sep '26

17 Sep '26

From: Daniel Borkmann <borkmann(a)iogearbox.net> mainline inclusion from mainline-v7.3-rc1 commit b1a47b2708d4e95dbd23aee2ec83752190897b3f category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18901 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- get_perf_callchain() returns a per-CPU perf_callchain_entry buffer and releases its recursion slot via put_callchain_entry() before returning, so nothing keeps the entry reserved while __bpf_get_stack() consumes it below. A preemptible BPF program (e.g. a non-sleepable raw tracepoint program on a PREEMPT kernel, which runs under migrate_disable() but not preempt_disable()) can be scheduled out between obtaining the entry and the copy. Another task scheduled on the same CPU then reuses the same per-CPU buffer and overwrites trace->nr with a larger value. copy_len is then computed from the inflated trace->nr and can exceed the caller's buffer, causing an out-of-bounds write in the memcpy() and in the build_id path. The rcu_read_lock() taken here alone does not prevent this. It is only taken on the may_fault path, and under CONFIG_PREEMPT_RCU it does not disable preemption; it merely keeps perf's callchain buffer array alive (freed via call_rcu()) and does nothing to stop another task from reusing the entry. Disable preemption around obtaining the callchain entry and copying it into the caller's buffer, so the entry cannot be reused underneath us and trace->nr stays bounded by max_depth. Build ID resolution may fault and is therefore deferred until after preemption is re-enabled; by then the instruction pointers have already been copied into buf, so it operates only on that private copy. Note, preempt_disable() also subsumes the buffer-lifetime guarantee the rcu_read_lock() provided, since a preempt-disabled section is an RCU read-side critical section for the callchain buffers' call_rcu() reclaim. Fixes: c195651e565a ("bpf: add bpf_get_stack helper") Reported-by: Tao Chen <chen.dylane(a)linux.dev> Reported-by: STAR Labs SG <info(a)starlabs.sg> Signed-off-by: Daniel Borkmann <borkmann(a)iogearbox.net> Signed-off-by: Jiri Olsa <jolsa(a)kernel.org> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/bpf/20260803210149.296496-11-jolsa@kernel.org Closes: https://lore.kernel.org/bpf/20260206090653.1336687-1-chen.dylane@linux.dev/ [ changed Fixes: commit ] Conflicts: kernel/bpf/stackmap.c [not refactor to callchain_store and callchain_finalize] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/stackmap.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c index 2a4070d0b594..3dc99abc1d51 100644 --- a/kernel/bpf/stackmap.c +++ b/kernel/bpf/stackmap.c @@ -444,6 +444,7 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task, max_depth = stack_map_calculate_max_depth(size, elem_size, flags); + preempt_disable(); if (trace_in) { trace = trace_in; trace->nr = min_t(u32, trace->nr, max_depth); @@ -453,16 +454,21 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task, trace = get_perf_callchain(regs, 0, kernel, user, max_depth, crosstask, false); } - if (unlikely(!trace)) + if (unlikely(!trace)) { + preempt_enable(); goto err_fault; + } - if (trace->nr < skip) + if (trace->nr < skip) { + preempt_enable(); goto err_fault; + } trace_nr = trace->nr - skip; copy_len = trace_nr * elem_size; ips = trace->ip + skip; + preempt_enable(); if (user && user_build_id) stack_map_get_build_id_offset(buf, ips, trace_nr, user); else -- 2.34.1

2 1

[PATCH OLK-5.10 v2] bpf: Disable preemption in __bpf_get_stack
by Pu Lehui 17 Sep '26

17 Sep '26

From: Daniel Borkmann <borkmann(a)iogearbox.net> mainline inclusion from mainline-v7.3-rc1 commit b1a47b2708d4e95dbd23aee2ec83752190897b3f category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18901 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- get_perf_callchain() returns a per-CPU perf_callchain_entry buffer and releases its recursion slot via put_callchain_entry() before returning, so nothing keeps the entry reserved while __bpf_get_stack() consumes it below. A preemptible BPF program (e.g. a non-sleepable raw tracepoint program on a PREEMPT kernel, which runs under migrate_disable() but not preempt_disable()) can be scheduled out between obtaining the entry and the copy. Another task scheduled on the same CPU then reuses the same per-CPU buffer and overwrites trace->nr with a larger value. copy_len is then computed from the inflated trace->nr and can exceed the caller's buffer, causing an out-of-bounds write in the memcpy() and in the build_id path. The rcu_read_lock() taken here alone does not prevent this. It is only taken on the may_fault path, and under CONFIG_PREEMPT_RCU it does not disable preemption; it merely keeps perf's callchain buffer array alive (freed via call_rcu()) and does nothing to stop another task from reusing the entry. Disable preemption around obtaining the callchain entry and copying it into the caller's buffer, so the entry cannot be reused underneath us and trace->nr stays bounded by max_depth. Build ID resolution may fault and is therefore deferred until after preemption is re-enabled; by then the instruction pointers have already been copied into buf, so it operates only on that private copy. Note, preempt_disable() also subsumes the buffer-lifetime guarantee the rcu_read_lock() provided, since a preempt-disabled section is an RCU read-side critical section for the callchain buffers' call_rcu() reclaim. Fixes: c195651e565a ("bpf: add bpf_get_stack helper") Reported-by: Tao Chen <chen.dylane(a)linux.dev> Reported-by: STAR Labs SG <info(a)starlabs.sg> Signed-off-by: Daniel Borkmann <borkmann(a)iogearbox.net> Signed-off-by: Jiri Olsa <jolsa(a)kernel.org> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/bpf/20260803210149.296496-11-jolsa@kernel.org Closes: https://lore.kernel.org/bpf/20260206090653.1336687-1-chen.dylane@linux.dev/ [ changed Fixes: commit ] Conflicts: kernel/bpf/stackmap.c [not refactor to callchain_store and callchain_finalize] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/stackmap.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c index 0c3504e598e3..44eccaf13aa0 100644 --- a/kernel/bpf/stackmap.c +++ b/kernel/bpf/stackmap.c @@ -620,6 +620,7 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task, if (sysctl_perf_event_max_stack < max_depth) max_depth = sysctl_perf_event_max_stack; + preempt_disable(); if (trace_in) trace = trace_in; else if (kernel && task) @@ -627,17 +628,22 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task, else trace = get_perf_callchain(regs, 0, kernel, user, max_depth, crosstask, false); - if (unlikely(!trace)) + if (unlikely(!trace)) { + preempt_enable(); goto err_fault; + } - if (trace->nr < skip) + if (trace->nr < skip) { + preempt_enable(); goto err_fault; + } trace_nr = trace->nr - skip; trace_nr = (trace_nr <= num_elem) ? trace_nr : num_elem; copy_len = trace_nr * elem_size; ips = trace->ip + skip; + preempt_enable(); if (user && user_build_id) stack_map_get_build_id_offset(buf, ips, trace_nr, user); else -- 2.34.1

2 1

[PATCH OLK-6.6] ceph: bound copied dentry name length in NFS export get_name
by Chen Yuxi 17 Sep '26

17 Sep '26

From: Michael Bommarito <michael.bommarito(a)gmail.com> mainline inclusion from mainline-v7.3-rc1 commit eff8013c5a8916613c742ae5a2cc341cb605c0ae category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18968 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm… -------------------------------- ceph_get_name() copies the MDS-supplied name into the caller's NAME_MAX-sized buffer with memcpy(name, rinfo->dname, rinfo->dname_len) and then writes name[rinfo->dname_len] = 0, without checking dname_len against NAME_MAX. A malicious or buggy MDS that returns a LOOKUPNAME reply with dname_len > NAME_MAX overflows the buffer. __get_snap_name() copies rde->name / rde->name_len the same unchecked way. Impact: a malicious or compromised Ceph MDS overflows the NAME_MAX name buffer in a client's NFS-export get_name path, a slab out-of-bounds write reported by KASAN. Reachable when a CephFS mount is re-exported over NFS. Add ceph_export_copy_name(), which rejects lengths above NAME_MAX with -ENAMETOOLONG before the copy, and use it in both ceph_get_name() and __get_snap_name(). Cc: stable(a)vger.kernel.org Fixes: 19913b4eac4a ("ceph: add get_name() NFS export callback") Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Reviewed-by: Viacheslav Dubeyko <slava(a)dubeyko.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Signed-off-by: Chen Yuxi <chenyuxi19(a)huawei.com> --- fs/ceph/export.c | 26 +++++++++++++++++--------- 1 file changed, 17 insertions(+), 9 deletions(-) diff --git a/fs/ceph/export.c b/fs/ceph/export.c index 52c4daf2447d..e9cbd08a7dcb 100644 --- a/fs/ceph/export.c +++ b/fs/ceph/export.c @@ -434,6 +434,16 @@ static struct dentry *ceph_fh_to_parent(struct super_block *sb, return dentry; } +static int ceph_export_copy_name(char *name, const char *src, u32 len) +{ + if (len > NAME_MAX) + return -ENAMETOOLONG; + + memcpy(name, src, len); + name[len] = '\0'; + return 0; +} + static int __get_snap_name(struct dentry *parent, char *name, struct dentry *child) { @@ -499,9 +509,8 @@ static int __get_snap_name(struct dentry *parent, char *name, BUG_ON(!rde->inode.in); if (ceph_snap(inode) == le64_to_cpu(rde->inode.in->snapid)) { - memcpy(name, rde->name, rde->name_len); - name[rde->name_len] = '\0'; - err = 0; + err = ceph_export_copy_name(name, rde->name, + rde->name_len); goto out; } } @@ -566,8 +575,8 @@ static int ceph_get_name(struct dentry *parent, char *name, rinfo = &req->r_reply_info; if (!IS_ENCRYPTED(dir)) { - memcpy(name, rinfo->dname, rinfo->dname_len); - name[rinfo->dname_len] = 0; + err = ceph_export_copy_name(name, rinfo->dname, + rinfo->dname_len); } else { struct fscrypt_str oname = FSTR_INIT(NULL, 0); struct ceph_fname fname = { .dir = dir, @@ -581,10 +590,9 @@ static int ceph_get_name(struct dentry *parent, char *name, goto out; err = ceph_fname_to_usr(&fname, NULL, &oname, NULL); - if (!err) { - memcpy(name, oname.name, oname.len); - name[oname.len] = 0; - } + if (!err) + err = ceph_export_copy_name(name, oname.name, + oname.len); ceph_fname_free_buffer(dir, &oname); } out: -- 2.34.1

2 1

[PATCH OLK-5.10] ceph: bound copied dentry name length in NFS export get_name
by Chen Yuxi 17 Sep '26

17 Sep '26

From: Michael Bommarito <michael.bommarito(a)gmail.com> mainline inclusion from mainline-v7.3-rc1 commit eff8013c5a8916613c742ae5a2cc341cb605c0ae category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18968 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ceph_get_name() copies the MDS-supplied name into the caller's NAME_MAX-sized buffer with memcpy(name, rinfo->dname, rinfo->dname_len) and then writes name[rinfo->dname_len] = 0, without checking dname_len against NAME_MAX. A malicious or buggy MDS that returns a LOOKUPNAME reply with dname_len > NAME_MAX overflows the buffer. __get_snap_name() copies rde->name / rde->name_len the same unchecked way. Impact: a malicious or compromised Ceph MDS overflows the NAME_MAX name buffer in a client's NFS-export get_name path, a slab out-of-bounds write reported by KASAN. Reachable when a CephFS mount is re-exported over NFS. Add ceph_export_copy_name(), which rejects lengths above NAME_MAX with -ENAMETOOLONG before the copy, and use it in both ceph_get_name() and __get_snap_name(). Cc: stable(a)vger.kernel.org Fixes: 19913b4eac4a ("ceph: add get_name() NFS export callback") Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Reviewed-by: Viacheslav Dubeyko <slava(a)dubeyko.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Conflicts: fs/ceph/export.c [Downstream tree lacks the fscrypt support, so keep the tree's simpler (non-encrypted) get_name structure.] Signed-off-by: Chen Yuxi <chenyuxi19(a)huawei.com> --- fs/ceph/export.c | 24 +++++++++++++++++------- 1 file changed, 17 insertions(+), 7 deletions(-) diff --git a/fs/ceph/export.c b/fs/ceph/export.c index 952a590dd4bc..54efb44fc89b 100644 --- a/fs/ceph/export.c +++ b/fs/ceph/export.c @@ -431,6 +431,16 @@ static struct dentry *ceph_fh_to_parent(struct super_block *sb, return dentry; } +static int ceph_export_copy_name(char *name, const char *src, u32 len) +{ + if (len > NAME_MAX) + return -ENAMETOOLONG; + + memcpy(name, src, len); + name[len] = '\0'; + return 0; +} + static int __get_snap_name(struct dentry *parent, char *name, struct dentry *child) { @@ -496,9 +506,8 @@ static int __get_snap_name(struct dentry *parent, char *name, BUG_ON(!rde->inode.in); if (ceph_snap(inode) == le64_to_cpu(rde->inode.in->snapid)) { - memcpy(name, rde->name, rde->name_len); - name[rde->name_len] = '\0'; - err = 0; + err = ceph_export_copy_name(name, rde->name, + rde->name_len); goto out; } } @@ -559,10 +568,11 @@ static int ceph_get_name(struct dentry *parent, char *name, if (!err) { struct ceph_mds_reply_info_parsed *rinfo = &req->r_reply_info; - memcpy(name, rinfo->dname, rinfo->dname_len); - name[rinfo->dname_len] = 0; - dout("get_name %p ino %llx.%llx name %s\n", - child, ceph_vinop(inode), name); + err = ceph_export_copy_name(name, rinfo->dname, + rinfo->dname_len); + if (!err) + dout("get_name %p ino %llx.%llx name %s\n", + child, ceph_vinop(d_inode(child)), name); } else { dout("get_name %p ino %llx.%llx err %d\n", child, ceph_vinop(inode), err); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] bpf: Disable preemption in __bpf_get_stack
by Pu Lehui 17 Sep '26

17 Sep '26

From: Daniel Borkmann <borkmann(a)iogearbox.net> mainline inclusion from mainline-v7.3-rc1 commit b1a47b2708d4e95dbd23aee2ec83752190897b3f category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18901 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- get_perf_callchain() returns a per-CPU perf_callchain_entry buffer and releases its recursion slot via put_callchain_entry() before returning, so nothing keeps the entry reserved while __bpf_get_stack() consumes it below. A preemptible BPF program (e.g. a non-sleepable raw tracepoint program on a PREEMPT kernel, which runs under migrate_disable() but not preempt_disable()) can be scheduled out between obtaining the entry and the copy. Another task scheduled on the same CPU then reuses the same per-CPU buffer and overwrites trace->nr with a larger value. copy_len is then computed from the inflated trace->nr and can exceed the caller's buffer, causing an out-of-bounds write in the memcpy() and in the build_id path. The rcu_read_lock() taken here alone does not prevent this. It is only taken on the may_fault path, and under CONFIG_PREEMPT_RCU it does not disable preemption; it merely keeps perf's callchain buffer array alive (freed via call_rcu()) and does nothing to stop another task from reusing the entry. Disable preemption around obtaining the callchain entry and copying it into the caller's buffer, so the entry cannot be reused underneath us and trace->nr stays bounded by max_depth. Build ID resolution may fault and is therefore deferred until after preemption is re-enabled; by then the instruction pointers have already been copied into buf, so it operates only on that private copy. Note, preempt_disable() also subsumes the buffer-lifetime guarantee the rcu_read_lock() provided, since a preempt-disabled section is an RCU read-side critical section for the callchain buffers' call_rcu() reclaim. Fixes: c195651e565a ("bpf: add bpf_get_stack helper") Reported-by: Tao Chen <chen.dylane(a)linux.dev> Reported-by: STAR Labs SG <info(a)starlabs.sg> Signed-off-by: Daniel Borkmann <borkmann(a)iogearbox.net> Signed-off-by: Jiri Olsa <jolsa(a)kernel.org> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/bpf/20260803210149.296496-11-jolsa@kernel.org Closes: https://lore.kernel.org/bpf/20260206090653.1336687-1-chen.dylane@linux.dev/ [ changed Fixes: commit ] Conflicts: kernel/bpf/stackmap.c [not refactor to callchain_store and callchain_finalize] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/stackmap.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c index a41858db1441..beaf63f17d60 100644 --- a/kernel/bpf/stackmap.c +++ b/kernel/bpf/stackmap.c @@ -477,6 +477,7 @@ BPF_CALL_4(bpf_get_stack, struct pt_regs *, regs, void *, buf, u32, size, if (unlikely(size % elem_size)) goto clear; + preempt_disable(); num_elem = size / elem_size; if (sysctl_perf_event_max_stack < num_elem) init_nr = 0; @@ -484,17 +485,23 @@ BPF_CALL_4(bpf_get_stack, struct pt_regs *, regs, void *, buf, u32, size, init_nr = sysctl_perf_event_max_stack - num_elem; trace = get_perf_callchain(regs, init_nr, kernel, user, sysctl_perf_event_max_stack, false, false); - if (unlikely(!trace)) + if (unlikely(!trace)) { + preempt_enable(); goto err_fault; + } trace_nr = trace->nr - init_nr; - if (trace_nr < skip) + if (trace_nr < skip) { + preempt_enable(); goto err_fault; + } trace_nr -= skip; trace_nr = (trace_nr <= num_elem) ? trace_nr : num_elem; copy_len = trace_nr * elem_size; ips = trace->ip + skip + init_nr; + + preempt_enable(); if (user && user_build_id) stack_map_get_build_id_offset(buf, ips, trace_nr, user); else -- 2.34.1

2 1

[PATCH OLK-5.10] [Backport] ceph: bound copied dentry name length in NFS export get_name
by Chen Yuxi 17 Sep '26

17 Sep '26

From: Michael Bommarito <michael.bommarito(a)gmail.com> mainline inclusion from mainline-v7.3-rc1 commit eff8013c5a8916613c742ae5a2cc341cb605c0ae category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18968 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ceph_get_name() copies the MDS-supplied name into the caller's NAME_MAX-sized buffer with memcpy(name, rinfo->dname, rinfo->dname_len) and then writes name[rinfo->dname_len] = 0, without checking dname_len against NAME_MAX. A malicious or buggy MDS that returns a LOOKUPNAME reply with dname_len > NAME_MAX overflows the buffer. __get_snap_name() copies rde->name / rde->name_len the same unchecked way. Impact: a malicious or compromised Ceph MDS overflows the NAME_MAX name buffer in a client's NFS-export get_name path, a slab out-of-bounds write reported by KASAN. Reachable when a CephFS mount is re-exported over NFS. Add ceph_export_copy_name(), which rejects lengths above NAME_MAX with -ENAMETOOLONG before the copy, and use it in both ceph_get_name() and __get_snap_name(). Cc: stable(a)vger.kernel.org Fixes: 19913b4eac4a ("ceph: add get_name() NFS export callback") Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Reviewed-by: Viacheslav Dubeyko <slava(a)dubeyko.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Conflicts: fs/ceph/export.c [Downstream tree lacks the fscrypt support, so keep the tree's simpler (non-encrypted) get_name structure.] Signed-off-by: Chen Yuxi <chenyuxi19(a)huawei.com> --- fs/ceph/export.c | 24 +++++++++++++++++------- 1 file changed, 17 insertions(+), 7 deletions(-) diff --git a/fs/ceph/export.c b/fs/ceph/export.c index 952a590dd4bc..54efb44fc89b 100644 --- a/fs/ceph/export.c +++ b/fs/ceph/export.c @@ -431,6 +431,16 @@ static struct dentry *ceph_fh_to_parent(struct super_block *sb, return dentry; } +static int ceph_export_copy_name(char *name, const char *src, u32 len) +{ + if (len > NAME_MAX) + return -ENAMETOOLONG; + + memcpy(name, src, len); + name[len] = '\0'; + return 0; +} + static int __get_snap_name(struct dentry *parent, char *name, struct dentry *child) { @@ -496,9 +506,8 @@ static int __get_snap_name(struct dentry *parent, char *name, BUG_ON(!rde->inode.in); if (ceph_snap(inode) == le64_to_cpu(rde->inode.in->snapid)) { - memcpy(name, rde->name, rde->name_len); - name[rde->name_len] = '\0'; - err = 0; + err = ceph_export_copy_name(name, rde->name, + rde->name_len); goto out; } } @@ -559,10 +568,11 @@ static int ceph_get_name(struct dentry *parent, char *name, if (!err) { struct ceph_mds_reply_info_parsed *rinfo = &req->r_reply_info; - memcpy(name, rinfo->dname, rinfo->dname_len); - name[rinfo->dname_len] = 0; - dout("get_name %p ino %llx.%llx name %s\n", - child, ceph_vinop(inode), name); + err = ceph_export_copy_name(name, rinfo->dname, + rinfo->dname_len); + if (!err) + dout("get_name %p ino %llx.%llx name %s\n", + child, ceph_vinop(d_inode(child)), name); } else { dout("get_name %p ino %llx.%llx err %d\n", child, ceph_vinop(inode), err); -- 2.34.1

2 1

[PATCH OLK-5.10] bpf: Disable preemption in __bpf_get_stack
by Pu Lehui 17 Sep '26

17 Sep '26

From: Daniel Borkmann <borkmann(a)iogearbox.net> mainline inclusion from mainline-v7.3-rc1 commit b1a47b2708d4e95dbd23aee2ec83752190897b3f category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18901 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- get_perf_callchain() returns a per-CPU perf_callchain_entry buffer and releases its recursion slot via put_callchain_entry() before returning, so nothing keeps the entry reserved while __bpf_get_stack() consumes it below. A preemptible BPF program (e.g. a non-sleepable raw tracepoint program on a PREEMPT kernel, which runs under migrate_disable() but not preempt_disable()) can be scheduled out between obtaining the entry and the copy. Another task scheduled on the same CPU then reuses the same per-CPU buffer and overwrites trace->nr with a larger value. copy_len is then computed from the inflated trace->nr and can exceed the caller's buffer, causing an out-of-bounds write in the memcpy() and in the build_id path. The rcu_read_lock() taken here alone does not prevent this. It is only taken on the may_fault path, and under CONFIG_PREEMPT_RCU it does not disable preemption; it merely keeps perf's callchain buffer array alive (freed via call_rcu()) and does nothing to stop another task from reusing the entry. Disable preemption around obtaining the callchain entry and copying it into the caller's buffer, so the entry cannot be reused underneath us and trace->nr stays bounded by max_depth. Build ID resolution may fault and is therefore deferred until after preemption is re-enabled; by then the instruction pointers have already been copied into buf, so it operates only on that private copy. Note, preempt_disable() also subsumes the buffer-lifetime guarantee the rcu_read_lock() provided, since a preempt-disabled section is an RCU read-side critical section for the callchain buffers' call_rcu() reclaim. Fixes: c195651e565a ("bpf: add bpf_get_stack helper") Reported-by: Tao Chen <chen.dylane(a)linux.dev> Reported-by: STAR Labs SG <info(a)starlabs.sg> Signed-off-by: Daniel Borkmann <borkmann(a)iogearbox.net> Signed-off-by: Jiri Olsa <jolsa(a)kernel.org> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/bpf/20260803210149.296496-11-jolsa@kernel.org Closes: https://lore.kernel.org/bpf/20260206090653.1336687-1-chen.dylane@linux.dev/ [ changed Fixes: commit ] Conflicts: kernel/bpf/stackmap.c [not refactor to callchain_store and callchain_finalize] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/stackmap.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c index 0c3504e598e3..1f2547acf3d1 100644 --- a/kernel/bpf/stackmap.c +++ b/kernel/bpf/stackmap.c @@ -620,6 +620,7 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task, if (sysctl_perf_event_max_stack < max_depth) max_depth = sysctl_perf_event_max_stack; + preempt_disable(); if (trace_in) trace = trace_in; else if (kernel && task) @@ -627,16 +628,22 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task, else trace = get_perf_callchain(regs, 0, kernel, user, max_depth, crosstask, false); - if (unlikely(!trace)) + if (unlikely(!trace)) { + preempt_enable(); goto err_fault; + } - if (trace->nr < skip) + if (trace->nr < skip) { + preempt_enable(); goto err_fault; + } trace_nr = trace->nr - skip; trace_nr = (trace_nr <= num_elem) ? trace_nr : num_elem; copy_len = trace_nr * elem_size; + preempt_enable(); + ips = trace->ip + skip; if (user && user_build_id) stack_map_get_build_id_offset(buf, ips, trace_nr, user); -- 2.34.1

2 1

[PATCH OLK-6.6] bpf: Disable preemption in __bpf_get_stack
by Pu Lehui 17 Sep '26

17 Sep '26

From: Daniel Borkmann <borkmann(a)iogearbox.net> mainline inclusion from mainline-v7.3-rc1 commit b1a47b2708d4e95dbd23aee2ec83752190897b3f category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18901 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- get_perf_callchain() returns a per-CPU perf_callchain_entry buffer and releases its recursion slot via put_callchain_entry() before returning, so nothing keeps the entry reserved while __bpf_get_stack() consumes it below. A preemptible BPF program (e.g. a non-sleepable raw tracepoint program on a PREEMPT kernel, which runs under migrate_disable() but not preempt_disable()) can be scheduled out between obtaining the entry and the copy. Another task scheduled on the same CPU then reuses the same per-CPU buffer and overwrites trace->nr with a larger value. copy_len is then computed from the inflated trace->nr and can exceed the caller's buffer, causing an out-of-bounds write in the memcpy() and in the build_id path. The rcu_read_lock() taken here alone does not prevent this. It is only taken on the may_fault path, and under CONFIG_PREEMPT_RCU it does not disable preemption; it merely keeps perf's callchain buffer array alive (freed via call_rcu()) and does nothing to stop another task from reusing the entry. Disable preemption around obtaining the callchain entry and copying it into the caller's buffer, so the entry cannot be reused underneath us and trace->nr stays bounded by max_depth. Build ID resolution may fault and is therefore deferred until after preemption is re-enabled; by then the instruction pointers have already been copied into buf, so it operates only on that private copy. Note, preempt_disable() also subsumes the buffer-lifetime guarantee the rcu_read_lock() provided, since a preempt-disabled section is an RCU read-side critical section for the callchain buffers' call_rcu() reclaim. Fixes: c195651e565a ("bpf: add bpf_get_stack helper") Reported-by: Tao Chen <chen.dylane(a)linux.dev> Reported-by: STAR Labs SG <info(a)starlabs.sg> Signed-off-by: Daniel Borkmann <borkmann(a)iogearbox.net> Signed-off-by: Jiri Olsa <jolsa(a)kernel.org> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/bpf/20260803210149.296496-11-jolsa@kernel.org Closes: https://lore.kernel.org/bpf/20260206090653.1336687-1-chen.dylane@linux.dev/ [ changed Fixes: commit ] Conflicts: kernel/bpf/stackmap.c [not refactor to callchain_store and callchain_finalize] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/stackmap.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c index 2a4070d0b594..a30a136ea954 100644 --- a/kernel/bpf/stackmap.c +++ b/kernel/bpf/stackmap.c @@ -444,6 +444,7 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task, max_depth = stack_map_calculate_max_depth(size, elem_size, flags); + preempt_disable(); if (trace_in) { trace = trace_in; trace->nr = min_t(u32, trace->nr, max_depth); @@ -453,15 +454,21 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task, trace = get_perf_callchain(regs, 0, kernel, user, max_depth, crosstask, false); } - if (unlikely(!trace)) + if (unlikely(!trace)) { + preempt_enable(); goto err_fault; + } - if (trace->nr < skip) + if (trace->nr < skip) { + preempt_enable(); goto err_fault; + } trace_nr = trace->nr - skip; copy_len = trace_nr * elem_size; + preempt_enable(); + ips = trace->ip + skip; if (user && user_build_id) stack_map_get_build_id_offset(buf, ips, trace_nr, user); -- 2.34.1

2 1

[PATCH OLK-6.6] bpf: Harden bloom filter sizing and indexing on 32-bit kernels
by Pu Lehui 17 Sep '26

17 Sep '26

From: Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> stable inclusion from stable-v6.6.157 commit 80551bf8912c42d1e3d55eec6fa3c40f306c3de8 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18900 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 11c1e836710dcba03e50454a4eedfdbaf8d3050e upstream. bloom_map_alloc() has two 32-bit-specific problems when the computed bitmap reaches the U32_MAX fallback case. First, BITS_TO_BYTES(U32_MAX) is evaluated with 32-bit arithmetic. The addition performed by DIV_ROUND_UP wraps, so the map allocates only the fixed-size bloom filter object while keeping bitset_mask == U32_MAX. Subsequent updates can then write past the allocated object. Second, fixing only the allocation size is not sufficient. The bloom hash is a u32, but set_bit() takes a signed long bit number and x86 test_bit() eventually feeds the index to variable_test_bit(long, ...). On 32-bit kernels, hashes in [0x80000000, U32_MAX] therefore become negative bit offsets. x86 bt/bts with a memory operand interpret those offsets relative to the supplied base, so a map with bitset_mask == U32_MAX can read or write before bloom->bitset even after allocating the full 512 MiB bitmap. Keep the U32_MAX fallback, but split each hash into a word pointer and an in-word bit number before calling test_bit() or set_bit(). The bitops argument is then always in [0, BITS_PER_LONG - 1], while BIT_WORD(h) still selects the intended word in the full bitmap. Compute the bitset size from (u64)bitset_mask + 1 before passing the final size to bpf_map_area_alloc(). This fixes the original under-allocation and keeps the allocated storage consistent with the addressable bitset. Exploitation note: local privilege escalation is possible on a 32-bit x86 kernel using the under-allocation bug from a binary with CAP_BPF. Fixes: 9330986c0300 ("bpf: Add bloom filter map implementation") Signed-off-by: Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/bpf/20260805060228.2703051-1-Jeremy.Jean@oss.cyber.… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Assisted-by: Codex:gpt-5 Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/bloom_filter.c | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) diff --git a/kernel/bpf/bloom_filter.c b/kernel/bpf/bloom_filter.c index 35e1ddca74d2..3f55f28fd589 100644 --- a/kernel/bpf/bloom_filter.c +++ b/kernel/bpf/bloom_filter.c @@ -41,7 +41,7 @@ static long bloom_map_peek_elem(struct bpf_map *map, void *value) for (i = 0; i < bloom->nr_hash_funcs; i++) { h = hash(bloom, value, map->value_size, i); - if (!test_bit(h, bloom->bitset)) + if (!test_bit(h % BITS_PER_LONG, bloom->bitset + BIT_WORD(h))) return -ENOENT; } @@ -57,9 +57,13 @@ static long bloom_map_push_elem(struct bpf_map *map, void *value, u64 flags) if (flags != BPF_ANY) return -EINVAL; + /* + * On 32-bit architectures, hashes larger than INT_MAX would be + * treated as negative by set_bit(). + */ for (i = 0; i < bloom->nr_hash_funcs; i++) { h = hash(bloom, value, map->value_size, i); - set_bit(h, bloom->bitset); + set_bit(h % BITS_PER_LONG, bloom->bitset + BIT_WORD(h)); } return 0; @@ -94,9 +98,10 @@ static int bloom_map_alloc_check(union bpf_attr *attr) static struct bpf_map *bloom_map_alloc(union bpf_attr *attr) { - u32 bitset_bytes, bitset_mask, nr_hash_funcs, nr_bits; + u32 bitset_mask, nr_hash_funcs, nr_bits; int numa_node = bpf_map_attr_numa_node(attr); struct bpf_bloom_filter *bloom; + u64 bitset_bytes; if (attr->key_size != 0 || attr->value_size == 0 || attr->max_entries == 0 || @@ -127,22 +132,16 @@ static struct bpf_map *bloom_map_alloc(union bpf_attr *attr) if (check_mul_overflow(attr->max_entries, nr_hash_funcs, &nr_bits) || check_mul_overflow(nr_bits / 5, (u32)7, &nr_bits) || nr_bits > (1UL << 31)) { - /* The bit array size is 2^32 bits but to avoid overflowing the - * u32, we use U32_MAX, which will round up to the equivalent - * number of bytes - */ - bitset_bytes = BITS_TO_BYTES(U32_MAX); bitset_mask = U32_MAX; } else { if (nr_bits <= BITS_PER_LONG) nr_bits = BITS_PER_LONG; else nr_bits = roundup_pow_of_two(nr_bits); - bitset_bytes = BITS_TO_BYTES(nr_bits); bitset_mask = nr_bits - 1; } - bitset_bytes = roundup(bitset_bytes, sizeof(unsigned long)); + bitset_bytes = BITS_TO_LONGS((u64)bitset_mask + 1) * sizeof(unsigned long); bloom = bpf_map_area_alloc(sizeof(*bloom) + bitset_bytes, numa_node); if (!bloom) -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] ceph: bound xattr value length in __build_xattrs()
by Pu Lehui 17 Sep '26

17 Sep '26

From: Michael Bommarito <michael.bommarito(a)gmail.com> mainline inclusion from mainline-v7.3-rc1 commit 68d541754d6cd3bb98d1fd8314f57e5eb533557d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18970 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- __build_xattrs() decodes the MDS-supplied xattr blob one attribute at a time. For each attribute it reads a 32-bit name length, advances past the name bytes, reads a 32-bit value length, records the value pointer, and advances past the value bytes. The two length fields are read with ceph_decode_32_safe(), but the value bytes themselves are advanced over with a bare "p += len" and no ceph_decode_need() check that "len" bytes remain in the blob. For every attribute except the last, the next iteration's ceph_decode_32_safe() on the following name length implicitly verifies that the previous value did not run past the blob end. The final attribute has no successor, so its decoded value length is never checked against the blob bounds. A malicious or compromised metadata server can set the last attribute's value length larger than the bytes actually present in the blob. The blob is a dedicated kvmalloc() allocation sized to the wire length (ceph_buffer_new() in ceph_fill_inode()). __set_xattr() records the oversized length in xattr->val_len verbatim, and a later getxattr(2) runs memcpy(value, xattr->val, xattr->val_len) into a user-supplied buffer, copying bytes past the end of the allocation back to user space. Impact: a malicious metadata server discloses adjacent kernel heap bytes to a local user via getxattr(2) on a CephFS file. Add the missing ceph_decode_need() so an out-of-bounds value length on the final attribute fails the decode and returns -EIO instead of being stored. Cc: stable(a)vger.kernel.org Fixes: 355da1eb7a1f ("ceph: inode operations") Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko(a)ibm.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- fs/ceph/xattr.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/ceph/xattr.c b/fs/ceph/xattr.c index 5e4f3f833e85..f22811d4ba06 100644 --- a/fs/ceph/xattr.c +++ b/fs/ceph/xattr.c @@ -685,6 +685,7 @@ static int __build_xattrs(struct inode *inode) name = p; p += len; ceph_decode_32_safe(&p, end, len, bad); + ceph_decode_need(&p, end, len, bad); val = p; p += len; -- 2.34.1

2 1

[PATCH OLK-5.10] ceph: bound xattr value length in __build_xattrs()
by Pu Lehui 17 Sep '26

17 Sep '26

From: Michael Bommarito <michael.bommarito(a)gmail.com> stable inclusion from stable-v5.10.270 commit 848b80ca6b410f350d08b8ac19a00ef88223f2ea category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18970 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 68d541754d6cd3bb98d1fd8314f57e5eb533557d upstream. __build_xattrs() decodes the MDS-supplied xattr blob one attribute at a time. For each attribute it reads a 32-bit name length, advances past the name bytes, reads a 32-bit value length, records the value pointer, and advances past the value bytes. The two length fields are read with ceph_decode_32_safe(), but the value bytes themselves are advanced over with a bare "p += len" and no ceph_decode_need() check that "len" bytes remain in the blob. For every attribute except the last, the next iteration's ceph_decode_32_safe() on the following name length implicitly verifies that the previous value did not run past the blob end. The final attribute has no successor, so its decoded value length is never checked against the blob bounds. A malicious or compromised metadata server can set the last attribute's value length larger than the bytes actually present in the blob. The blob is a dedicated kvmalloc() allocation sized to the wire length (ceph_buffer_new() in ceph_fill_inode()). __set_xattr() records the oversized length in xattr->val_len verbatim, and a later getxattr(2) runs memcpy(value, xattr->val, xattr->val_len) into a user-supplied buffer, copying bytes past the end of the allocation back to user space. Impact: a malicious metadata server discloses adjacent kernel heap bytes to a local user via getxattr(2) on a CephFS file. Add the missing ceph_decode_need() so an out-of-bounds value length on the final attribute fails the decode and returns -EIO instead of being stored. Cc: stable(a)vger.kernel.org Fixes: 355da1eb7a1f ("ceph: inode operations") Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko(a)ibm.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- fs/ceph/xattr.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/ceph/xattr.c b/fs/ceph/xattr.c index d1fd81b1b541..80f39d46f12d 100644 --- a/fs/ceph/xattr.c +++ b/fs/ceph/xattr.c @@ -715,6 +715,7 @@ static int __build_xattrs(struct inode *inode) name = p; p += len; ceph_decode_32_safe(&p, end, len, bad); + ceph_decode_need(&p, end, len, bad); val = p; p += len; -- 2.34.1

2 1

[PATCH OLK-6.6] ceph: bound xattr value length in __build_xattrs()
by Pu Lehui 17 Sep '26

17 Sep '26

From: Michael Bommarito <michael.bommarito(a)gmail.com> stable inclusion from stable-v6.6.157 commit 61f085cb8976c9cebc90e1a8933e4cc1ad8b0fce category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18970 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 68d541754d6cd3bb98d1fd8314f57e5eb533557d upstream. __build_xattrs() decodes the MDS-supplied xattr blob one attribute at a time. For each attribute it reads a 32-bit name length, advances past the name bytes, reads a 32-bit value length, records the value pointer, and advances past the value bytes. The two length fields are read with ceph_decode_32_safe(), but the value bytes themselves are advanced over with a bare "p += len" and no ceph_decode_need() check that "len" bytes remain in the blob. For every attribute except the last, the next iteration's ceph_decode_32_safe() on the following name length implicitly verifies that the previous value did not run past the blob end. The final attribute has no successor, so its decoded value length is never checked against the blob bounds. A malicious or compromised metadata server can set the last attribute's value length larger than the bytes actually present in the blob. The blob is a dedicated kvmalloc() allocation sized to the wire length (ceph_buffer_new() in ceph_fill_inode()). __set_xattr() records the oversized length in xattr->val_len verbatim, and a later getxattr(2) runs memcpy(value, xattr->val, xattr->val_len) into a user-supplied buffer, copying bytes past the end of the allocation back to user space. Impact: a malicious metadata server discloses adjacent kernel heap bytes to a local user via getxattr(2) on a CephFS file. Add the missing ceph_decode_need() so an out-of-bounds value length on the final attribute fails the decode and returns -EIO instead of being stored. Cc: stable(a)vger.kernel.org Fixes: 355da1eb7a1f ("ceph: inode operations") Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko(a)ibm.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- fs/ceph/xattr.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/ceph/xattr.c b/fs/ceph/xattr.c index 3920aa4e40a8..4abed75b01ba 100644 --- a/fs/ceph/xattr.c +++ b/fs/ceph/xattr.c @@ -844,6 +844,7 @@ static int __build_xattrs(struct inode *inode) name = p; p += len; ceph_decode_32_safe(&p, end, len, bad); + ceph_decode_need(&p, end, len, bad); val = p; p += len; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] ceph: bound num_export_targets array for mds info v2/v3
by Pu Lehui 17 Sep '26

17 Sep '26

From: Michael Bommarito <michael.bommarito(a)gmail.com> mainline inclusion from mainline-v7.3-rc1 commit a3eb169ee297aa99670ba927c659990bd1e453f3 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19003 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- ceph_mdsmap_decode() in fs/ceph/mdsmap.c reads num_export_targets from each per-mds info record and advances the decode cursor by num_export_targets * sizeof(u32) without first checking that many bytes remain. The only upper-bound check that catches a runaway cursor (*p > info_end) is gated on info_v >= 4, because info_end is left NULL for info_v 2 and 3. When the monitor sends an MDS map whose per-mds info version is 2 or 3 with an oversized num_export_targets, the cursor moves past the message front buffer and the later export-targets loop calls the unchecked ceph_decode_32() on out-of-bounds memory. A kernel client processes CEPH_MSG_MDS_MAP from its monitor session (net/ceph/mon_client.c dispatches it; fs/ceph/super.c routes it to ceph_mdsc_handle_mdsmap(), which sets end to the front buffer bound and calls ceph_mdsmap_decode()). A malicious or compromised monitor, or an on-path attacker on an unsigned/unencrypted messenger session, can therefore drive an out-of-bounds read in the client kernel; on x86_64 with KASAN it is reported as a slab-out-of-bounds read in ceph_mdsmap_decode(). The decoded values land in the internal info->export_targets[] array, so the consequence is a kernel out-of-bounds read, not an information leak to the attacker. Impact: a malicious or compromised Ceph monitor sending an MDS map with a per-mds info version of 2 or 3 and an oversized num_export_targets field triggers an out-of-bounds read in the CephFS client kernel. Add a ceph_decode_need() for the export-targets array before advancing the cursor, so the bound is enforced for every info_v >= 2, not only info_v >= 4. This mirrors the count-then-need idiom already used for m_data_pg_pools later in the same function. Compute the export-targets byte count with size_mul() and reuse that checked length when advancing the cursor, so the attacker-controlled num_export_targets multiplication fails closed on overflow rather than relying on the later kcalloc() guard. Cc: stable(a)vger.kernel.org Fixes: d463a43d69f4 ("ceph: CEPH_FEATURE_MDSENC support") Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Reviewed-by: Viacheslav Dubeyko <slava(a)dubeyko.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Conflicts: fs/ceph/mdsmap.c [ctx conflicts] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- fs/ceph/mdsmap.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/fs/ceph/mdsmap.c b/fs/ceph/mdsmap.c index 44e53abeb32a..5583f5e171af 100644 --- a/fs/ceph/mdsmap.c +++ b/fs/ceph/mdsmap.c @@ -3,6 +3,7 @@ #include <linux/bug.h> #include <linux/err.h> +#include <linux/overflow.h> #include <linux/random.h> #include <linux/slab.h> #include <linux/types.h> @@ -111,6 +112,7 @@ struct ceph_mdsmap *ceph_mdsmap_decode(void **p, void *end) int err = -EINVAL; u8 mdsmap_v, mdsmap_cv; u16 mdsmap_ev; + size_t export_targets_len; m = kzalloc(sizeof(*m), GFP_NOFS); if (!m) @@ -192,8 +194,11 @@ struct ceph_mdsmap *ceph_mdsmap_decode(void **p, void *end) *p += namelen; if (info_v >= 2) { ceph_decode_32_safe(p, end, num_export_targets, bad); + export_targets_len = size_mul(num_export_targets, + sizeof(u32)); + ceph_decode_need(p, end, export_targets_len, bad); pexport_targets = *p; - *p += num_export_targets * sizeof(u32); + *p += export_targets_len; } else { num_export_targets = 0; } -- 2.34.1

2 1

[PATCH OLK-5.10] ceph: bound num_export_targets array for mds info v2/v3
by Pu Lehui 17 Sep '26

17 Sep '26

From: Michael Bommarito <michael.bommarito(a)gmail.com> mainline inclusion from mainline-v7.3-rc1 commit a3eb169ee297aa99670ba927c659990bd1e453f3 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19003 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- ceph_mdsmap_decode() in fs/ceph/mdsmap.c reads num_export_targets from each per-mds info record and advances the decode cursor by num_export_targets * sizeof(u32) without first checking that many bytes remain. The only upper-bound check that catches a runaway cursor (*p > info_end) is gated on info_v >= 4, because info_end is left NULL for info_v 2 and 3. When the monitor sends an MDS map whose per-mds info version is 2 or 3 with an oversized num_export_targets, the cursor moves past the message front buffer and the later export-targets loop calls the unchecked ceph_decode_32() on out-of-bounds memory. A kernel client processes CEPH_MSG_MDS_MAP from its monitor session (net/ceph/mon_client.c dispatches it; fs/ceph/super.c routes it to ceph_mdsc_handle_mdsmap(), which sets end to the front buffer bound and calls ceph_mdsmap_decode()). A malicious or compromised monitor, or an on-path attacker on an unsigned/unencrypted messenger session, can therefore drive an out-of-bounds read in the client kernel; on x86_64 with KASAN it is reported as a slab-out-of-bounds read in ceph_mdsmap_decode(). The decoded values land in the internal info->export_targets[] array, so the consequence is a kernel out-of-bounds read, not an information leak to the attacker. Impact: a malicious or compromised Ceph monitor sending an MDS map with a per-mds info version of 2 or 3 and an oversized num_export_targets field triggers an out-of-bounds read in the CephFS client kernel. Add a ceph_decode_need() for the export-targets array before advancing the cursor, so the bound is enforced for every info_v >= 2, not only info_v >= 4. This mirrors the count-then-need idiom already used for m_data_pg_pools later in the same function. Compute the export-targets byte count with size_mul() and reuse that checked length when advancing the cursor, so the attacker-controlled num_export_targets multiplication fails closed on overflow rather than relying on the later kcalloc() guard. Cc: stable(a)vger.kernel.org Fixes: d463a43d69f4 ("ceph: CEPH_FEATURE_MDSENC support") Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Reviewed-by: Viacheslav Dubeyko <slava(a)dubeyko.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Conflicts: fs/ceph/mdsmap.c [ctx conflicts] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- fs/ceph/mdsmap.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/fs/ceph/mdsmap.c b/fs/ceph/mdsmap.c index 47f2903bacb9..05c25f1de6ad 100644 --- a/fs/ceph/mdsmap.c +++ b/fs/ceph/mdsmap.c @@ -3,6 +3,7 @@ #include <linux/bug.h> #include <linux/err.h> +#include <linux/overflow.h> #include <linux/random.h> #include <linux/slab.h> #include <linux/types.h> @@ -122,6 +123,7 @@ struct ceph_mdsmap *ceph_mdsmap_decode(void **p, void *end) int err; u8 mdsmap_v; u16 mdsmap_ev; + size_t export_targets_len; m = kzalloc(sizeof(*m), GFP_NOFS); if (!m) @@ -219,8 +221,11 @@ struct ceph_mdsmap *ceph_mdsmap_decode(void **p, void *end) *p += namelen; if (info_v >= 2) { ceph_decode_32_safe(p, end, num_export_targets, bad); + export_targets_len = size_mul(num_export_targets, + sizeof(u32)); + ceph_decode_need(p, end, export_targets_len, bad); pexport_targets = *p; - *p += num_export_targets * sizeof(u32); + *p += export_targets_len; } else { num_export_targets = 0; } -- 2.34.1

2 1

[PATCH OLK-6.6] ceph: bound num_export_targets array for mds info v2/v3
by Pu Lehui 17 Sep '26

17 Sep '26

From: Michael Bommarito <michael.bommarito(a)gmail.com> stable inclusion from stable-v6.6.157 commit eb3e1a1cb1634c76d59c5a9cb1a026fc69d40911 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19003 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit a3eb169ee297aa99670ba927c659990bd1e453f3 upstream. ceph_mdsmap_decode() in fs/ceph/mdsmap.c reads num_export_targets from each per-mds info record and advances the decode cursor by num_export_targets * sizeof(u32) without first checking that many bytes remain. The only upper-bound check that catches a runaway cursor (*p > info_end) is gated on info_v >= 4, because info_end is left NULL for info_v 2 and 3. When the monitor sends an MDS map whose per-mds info version is 2 or 3 with an oversized num_export_targets, the cursor moves past the message front buffer and the later export-targets loop calls the unchecked ceph_decode_32() on out-of-bounds memory. A kernel client processes CEPH_MSG_MDS_MAP from its monitor session (net/ceph/mon_client.c dispatches it; fs/ceph/super.c routes it to ceph_mdsc_handle_mdsmap(), which sets end to the front buffer bound and calls ceph_mdsmap_decode()). A malicious or compromised monitor, or an on-path attacker on an unsigned/unencrypted messenger session, can therefore drive an out-of-bounds read in the client kernel; on x86_64 with KASAN it is reported as a slab-out-of-bounds read in ceph_mdsmap_decode(). The decoded values land in the internal info->export_targets[] array, so the consequence is a kernel out-of-bounds read, not an information leak to the attacker. Impact: a malicious or compromised Ceph monitor sending an MDS map with a per-mds info version of 2 or 3 and an oversized num_export_targets field triggers an out-of-bounds read in the CephFS client kernel. Add a ceph_decode_need() for the export-targets array before advancing the cursor, so the bound is enforced for every info_v >= 2, not only info_v >= 4. This mirrors the count-then-need idiom already used for m_data_pg_pools later in the same function. Compute the export-targets byte count with size_mul() and reuse that checked length when advancing the cursor, so the attacker-controlled num_export_targets multiplication fails closed on overflow rather than relying on the later kcalloc() guard. Cc: stable(a)vger.kernel.org Fixes: d463a43d69f4 ("ceph: CEPH_FEATURE_MDSENC support") Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Reviewed-by: Viacheslav Dubeyko <slava(a)dubeyko.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- fs/ceph/mdsmap.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/fs/ceph/mdsmap.c b/fs/ceph/mdsmap.c index c046b567ac30..939790d2620f 100644 --- a/fs/ceph/mdsmap.c +++ b/fs/ceph/mdsmap.c @@ -3,6 +3,7 @@ #include <linux/bug.h> #include <linux/err.h> +#include <linux/overflow.h> #include <linux/random.h> #include <linux/slab.h> #include <linux/types.h> @@ -124,6 +125,7 @@ struct ceph_mdsmap *ceph_mdsmap_decode(struct ceph_mds_client *mdsc, void **p, u8 mdsmap_v; u16 mdsmap_ev; u32 target; + size_t export_targets_len; m = kzalloc(sizeof(*m), GFP_NOFS); if (!m) @@ -222,8 +224,11 @@ struct ceph_mdsmap *ceph_mdsmap_decode(struct ceph_mds_client *mdsc, void **p, *p += namelen; if (info_v >= 2) { ceph_decode_32_safe(p, end, num_export_targets, bad); + export_targets_len = size_mul(num_export_targets, + sizeof(u32)); + ceph_decode_need(p, end, export_targets_len, bad); pexport_targets = *p; - *p += num_export_targets * sizeof(u32); + *p += export_targets_len; } else { num_export_targets = 0; } -- 2.34.1

2 1

[PATCH OLK-6.6] ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode
by Pu Lehui 17 Sep '26

17 Sep '26

From: Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> stable inclusion from stable-v6.6.157 commit c4addccd05bacbef2144b4db14853d0308a218ac category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18981 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit aedc9053d909508a5f56c3f49f885fc030df4730 upstream. MDSMap export_targets entries are monitor controlled. check_new_map() uses each entry as a bit number in a fixed stack bitmap, so a rank outside the protocol namespace can make set_bit() write past the end of the array. Reject ranks outside CEPH_MAX_MDS while decoding the map. Do not validate against possible_max_rank here because maps may legitimately reference ranks beyond a temporarily reduced max_mds. Cc: stable(a)vger.kernel.org Fixes: d517b3983dd3 ("ceph: reconnect to the export targets on new mdsmaps") Signed-off-by: Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> Reviewed-by: Alex Markuze <amarkuze(a)redhat.com> Signed-off-by: Alex Markuze <amarkuze(a)redhat.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- fs/ceph/mdsmap.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/ceph/mdsmap.c b/fs/ceph/mdsmap.c index 15243241bc2b..c046b567ac30 100644 --- a/fs/ceph/mdsmap.c +++ b/fs/ceph/mdsmap.c @@ -264,6 +264,10 @@ struct ceph_mdsmap *ceph_mdsmap_decode(struct ceph_mds_client *mdsc, void **p, goto nomem; for (j = 0; j < num_export_targets; j++) { target = ceph_decode_32(&pexport_targets); + if (target >= CEPH_MAX_MDS) { + err = -EIO; + goto corrupt; + } info->export_targets[j] = target; } } else { -- 2.34.1

2 1

[PATCH OLK-5.10] ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock
by Chen Yuxi 17 Sep '26

17 Sep '26

From: Xiubo Li <xiubo.li(a)clyso.com> mainline inclusion from mainline-v7.3-rc1 commit 7af4c4f01305b0935adf6d4301b1ec407025485d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19017 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- list_for_each_entry() iterates ci->i_cap_flush_list but drops i_ceph_lock to send cap messages. During the unlock window, handle_cap_flush_ack() can acquire i_ceph_lock, detach cf entries with tid <= flush_tid from the list, release i_ceph_lock, and free them via ceph_free_cap_flush() outside any lock. When the original thread reacquires i_ceph_lock and the for-loop macro advances via cf = list_next_entry(cf, i_list), it dereferences cf->i_list.next on freed memory. The race timeline: __kick_flushing_caps() handle_cap_flush_ack() ----------------------- ----------------------- holds i_ceph_lock <--- iterates to cf (tid=10) prepares FLUSH message drops i_ceph_lock <--- __send_cap() ── FLUSH(tid=10) MDS sends FLUSH_ACK(tid=10) ---> acquires i_ceph_lock cf->tid(10) <= flush_tid(10), detaches cf from i_cap_flush_list drops i_ceph_lock ceph_free_cap_flush(cf) <- frees it! acquires i_ceph_lock <--- for-loop advances: cf = list_next_entry(cf, i_list) -- UAF on freed cf->i_list.next The cf was just sent by __kick_flushing_caps itself via __send_cap(). The MDS may respond with FLUSH_ACK quickly enough that handle_cap_flush_ack() frees cf before __kick_flushing_caps can finish the iteration. Fix by converting to a manual while loop: save the next pointer under i_ceph_lock before dropping it, then use the saved pointer after reacquiring, so the potentially-freed cf is never accessed again. Cc: stable(a)vger.kernel.org Signed-off-by: Xiubo Li <xiubo.li(a)clyso.com> Reviewed-by: Viacheslav Dubeyko <slava(a)dubeyko.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Conflicts: fs/ceph/caps.c [ctx conflicts] Signed-off-by: Chen Yuxi <chenyuxi19(a)huawei.com> --- fs/ceph/caps.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c index 9bebdafd5ec9..d709edea84ae 100644 --- a/fs/ceph/caps.c +++ b/fs/ceph/caps.c @@ -2513,9 +2513,14 @@ static void __kick_flushing_caps(struct ceph_mds_client *mdsc, } } - list_for_each_entry(cf, &ci->i_cap_flush_list, i_list) { - if (cf->tid < first_tid) + cf = list_first_entry(&ci->i_cap_flush_list, struct ceph_cap_flush, i_list); + while (&cf->i_list != &ci->i_cap_flush_list) { + struct ceph_cap_flush *next; + + if (cf->tid < first_tid) { + cf = list_next_entry(cf, i_list); continue; + } cap = ci->i_auth_cap; if (!(cap && cap->session == session)) { @@ -2525,6 +2530,7 @@ static void __kick_flushing_caps(struct ceph_mds_client *mdsc, } first_tid = cf->tid + 1; + next = list_next_entry(cf, i_list); if (!cf->is_capsnap) { struct cap_msg_args arg; @@ -2565,6 +2571,7 @@ static void __kick_flushing_caps(struct ceph_mds_client *mdsc, } spin_lock(&ci->i_ceph_lock); + cf = next; } } -- 2.34.1

2 1

[PATCH OLK-6.6] ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock
by Chen Yuxi 17 Sep '26

17 Sep '26

From: Xiubo Li <xiubo.li(a)clyso.com> mainline inclusion from mainline-v7.3-rc1 commit 7af4c4f01305b0935adf6d4301b1ec407025485d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19017 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- list_for_each_entry() iterates ci->i_cap_flush_list but drops i_ceph_lock to send cap messages. During the unlock window, handle_cap_flush_ack() can acquire i_ceph_lock, detach cf entries with tid <= flush_tid from the list, release i_ceph_lock, and free them via ceph_free_cap_flush() outside any lock. When the original thread reacquires i_ceph_lock and the for-loop macro advances via cf = list_next_entry(cf, i_list), it dereferences cf->i_list.next on freed memory. The race timeline: __kick_flushing_caps() handle_cap_flush_ack() ----------------------- ----------------------- holds i_ceph_lock <--- iterates to cf (tid=10) prepares FLUSH message drops i_ceph_lock <--- __send_cap() ── FLUSH(tid=10) MDS sends FLUSH_ACK(tid=10) ---> acquires i_ceph_lock cf->tid(10) <= flush_tid(10), detaches cf from i_cap_flush_list drops i_ceph_lock ceph_free_cap_flush(cf) <- frees it! acquires i_ceph_lock <--- for-loop advances: cf = list_next_entry(cf, i_list) -- UAF on freed cf->i_list.next The cf was just sent by __kick_flushing_caps itself via __send_cap(). The MDS may respond with FLUSH_ACK quickly enough that handle_cap_flush_ack() frees cf before __kick_flushing_caps can finish the iteration. Fix by converting to a manual while loop: save the next pointer under i_ceph_lock before dropping it, then use the saved pointer after reacquiring, so the potentially-freed cf is never accessed again. Cc: stable(a)vger.kernel.org Signed-off-by: Xiubo Li <xiubo.li(a)clyso.com> Reviewed-by: Viacheslav Dubeyko <slava(a)dubeyko.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Conflicts: fs/ceph/caps.c [ctx conflict] Signed-off-by: Chen Yuxi <chenyuxi19(a)huawei.com> --- fs/ceph/caps.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c index 0ff68e63f5a6..c80a17f82f81 100644 --- a/fs/ceph/caps.c +++ b/fs/ceph/caps.c @@ -2534,9 +2534,14 @@ static void __kick_flushing_caps(struct ceph_mds_client *mdsc, } } - list_for_each_entry(cf, &ci->i_cap_flush_list, i_list) { - if (cf->tid < first_tid) + cf = list_first_entry(&ci->i_cap_flush_list, struct ceph_cap_flush, i_list); + while (&cf->i_list != &ci->i_cap_flush_list) { + struct ceph_cap_flush *next; + + if (cf->tid < first_tid) { + cf = list_next_entry(cf, i_list); continue; + } cap = ci->i_auth_cap; if (!(cap && cap->session == session)) { @@ -2546,6 +2551,7 @@ static void __kick_flushing_caps(struct ceph_mds_client *mdsc, } first_tid = cf->tid + 1; + next = list_next_entry(cf, i_list); if (!cf->is_capsnap) { struct cap_msg_args arg; @@ -2586,6 +2592,7 @@ static void __kick_flushing_caps(struct ceph_mds_client *mdsc, } spin_lock(&ci->i_ceph_lock); + cf = next; } } -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] CVE-2026-89636
by Yifan Qiao 17 Sep '26

17 Sep '26

Fredric Cover (2): smb: client: harden DFS cache against invalid target hints smb: client: clear ce->tgthint in free_tgts() fs/smb/client/dfs_cache.c | 33 ++++++++++++++++++++++++++------- 1 file changed, 26 insertions(+), 7 deletions(-) -- 2.52.0

2 3

[PATCH OLK-5.10 0/2] CVE-2026-89636
by Yifan Qiao 17 Sep '26

17 Sep '26

Fredric Cover (2): smb: client: harden DFS cache against invalid target hints smb: client: clear ce->tgthint in free_tgts() fs/cifs/dfs_cache.c | 35 +++++++++++++++++++++++++++-------- 1 file changed, 27 insertions(+), 8 deletions(-) -- 2.52.0

2 3

[PATCH openEuler-1.0-LTS] smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()
by Yifan Qiao 17 Sep '26

17 Sep '26

From: Frank Sorenson <sorenson(a)redhat.com> mainline inclusion from mainline-v7.3-rc1 commit 6343c1da561962688f203362d80d6a3bfa39fa1b category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18919 CVE: CVE-2026-89633 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- coalesce_t2() computes data pointers directly from server-supplied DataOffset fields with no validation against buffer bounds: data_area_of_tgt = (char *)&pSMBt->hdr.Protocol + get_unaligned_le16(&pSMBt->t2_rsp.DataOffset); data_area_of_src = (char *)&pSMBs->hdr.Protocol + get_unaligned_le16(&pSMBs->t2_rsp.DataOffset); data_area_of_tgt += total_in_tgt; ... memcpy(data_area_of_tgt, data_area_of_src, total_in_src); A small DataOffset can push a pointer below the actual byte area, overwriting header fields; a large one can push it past the buffer end, causing out-of-bounds heap reads (source) or writes (target). The BCC overflow guard does not prevent this: BCC reflects how much data is present, while DataOffset controls where in the buffer it starts. The "validate target area" comment present since the function was first written in 2005 was a placeholder that was never implemented. Add lower- and upper-bound checks for both data pointers before the memcpy, and before any target header fields are modified. Fixes: e4eb295d38b5 ("[PATCH] cifs: Handle multiple response transact2 part 1 of 2") Cc: stable(a)vger.kernel.org Reported-by: Shen Yongchao <grayhat(a)foxmail.com> Signed-off-by: Frank Sorenson <sorenson(a)redhat.com> Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Paulo Alcantara <pc(a)manguebit.org> Conflicts: fs/cifs/smb1ops.c fs/smb/client/smb1ops.c [different files] Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/cifs/smb1ops.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/fs/cifs/smb1ops.c b/fs/cifs/smb1ops.c index 774043781e85..6b8277decef5 100644 --- a/fs/cifs/smb1ops.c +++ b/fs/cifs/smb1ops.c @@ -336,6 +336,26 @@ coalesce_t2(char *second_buf, struct smb_hdr *target_hdr) data_area_of_tgt += total_in_tgt; + /* + * DataOffset fields are server-supplied and not validated against + * buffer bounds; check both data pointers before mutating the + * target header. + */ + if (data_area_of_tgt < (char *)target_hdr + + sizeof(struct smb_t2_rsp) + sizeof(__le16) || + data_area_of_tgt + total_in_src > + (char *)target_hdr + CIFSMaxBufSize + MAX_CIFS_HDR_SIZE) { + cifs_dbg(VFS, "%s: target data area out of bounds\n", __func__); + return -EPROTO; + } + if (data_area_of_src < second_buf + + sizeof(struct smb_t2_rsp) + sizeof(__le16) || + data_area_of_src + total_in_src > + second_buf + smbCalcSize((struct smb_hdr *)second_buf, NULL)) { + cifs_dbg(VFS, "%s: secondary data area out of bounds\n", __func__); + return -EPROTO; + } + total_in_tgt += total_in_src; /* is the result too big for the field? */ if (total_in_tgt > USHRT_MAX) { -- 2.52.0

2 1

[PATCH] smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()
by Yifan Qiao 17 Sep '26

17 Sep '26

From: Frank Sorenson <sorenson(a)redhat.com> mainline inclusion from mainline-v7.3-rc1 commit 6343c1da561962688f203362d80d6a3bfa39fa1b category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18919 CVE: CVE-2026-89633 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- coalesce_t2() computes data pointers directly from server-supplied DataOffset fields with no validation against buffer bounds: data_area_of_tgt = (char *)&pSMBt->hdr.Protocol + get_unaligned_le16(&pSMBt->t2_rsp.DataOffset); data_area_of_src = (char *)&pSMBs->hdr.Protocol + get_unaligned_le16(&pSMBs->t2_rsp.DataOffset); data_area_of_tgt += total_in_tgt; ... memcpy(data_area_of_tgt, data_area_of_src, total_in_src); A small DataOffset can push a pointer below the actual byte area, overwriting header fields; a large one can push it past the buffer end, causing out-of-bounds heap reads (source) or writes (target). The BCC overflow guard does not prevent this: BCC reflects how much data is present, while DataOffset controls where in the buffer it starts. The "validate target area" comment present since the function was first written in 2005 was a placeholder that was never implemented. Add lower- and upper-bound checks for both data pointers before the memcpy, and before any target header fields are modified. Fixes: e4eb295d38b5 ("[PATCH] cifs: Handle multiple response transact2 part 1 of 2") Cc: stable(a)vger.kernel.org Reported-by: Shen Yongchao <grayhat(a)foxmail.com> Signed-off-by: Frank Sorenson <sorenson(a)redhat.com> Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Paulo Alcantara <pc(a)manguebit.org> Conflicts: fs/cifs/smb1ops.c fs/smb/client/smb1ops.c [different files] Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/cifs/smb1ops.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/fs/cifs/smb1ops.c b/fs/cifs/smb1ops.c index e540908bae43..6bcd2805cead 100644 --- a/fs/cifs/smb1ops.c +++ b/fs/cifs/smb1ops.c @@ -324,6 +324,26 @@ coalesce_t2(char *second_buf, struct smb_hdr *target_hdr) data_area_of_tgt += total_in_tgt; + /* + * DataOffset fields are server-supplied and not validated against + * buffer bounds; check both data pointers before mutating the + * target header. + */ + if (data_area_of_tgt < (char *)target_hdr + + sizeof(struct smb_t2_rsp) + sizeof(__le16) || + data_area_of_tgt + total_in_src > + (char *)target_hdr + CIFSMaxBufSize + MAX_CIFS_HDR_SIZE) { + cifs_dbg(VFS, "%s: target data area out of bounds\n", __func__); + return -EPROTO; + } + if (data_area_of_src < second_buf + + sizeof(struct smb_t2_rsp) + sizeof(__le16) || + data_area_of_src + total_in_src > + second_buf + smbCalcSize((struct smb_hdr *)second_buf, NULL)) { + cifs_dbg(VFS, "%s: secondary data area out of bounds\n", __func__); + return -EPROTO; + } + total_in_tgt += total_in_src; /* is the result too big for the field? */ if (total_in_tgt > USHRT_MAX) { -- 2.52.0

1 0

[PATCH OLK-6.6] Revert "iomap: guard io_size EOF trim against concurrent truncate underflow"
by Ran Hongyun 16 Sep '26

16 Sep '26

Offering: HULK hulk inclusion category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17916 CVE: CVE-2026-72367 -------------------------------- This reverts commit 70ad22e4e8dfd119161fdaebc2bf4007f136516a. The upstream fix (55ec50d046c0) guards against unsigned underflow when `end_pos < io_offset` by clamping io_size to zero. In mainline, `end_pos` is a per-folio snapshot passed as a parameter. commit e728e754141f uses `isize = i_size_read(inode)` instead of `end_pos`: if (pos < isize && pos + len > isize) wpc->ioend->io_size = isize - wpc->ioend->io_offset; Since `io_offset <= pos < isize`, when the branch is taken, the subtraction cannot underflow. Fixes: 70ad22e4e8df ("iomap: guard io_size EOF trim against concurrent truncate underflow") Signed-off-by: Ran Hongyun <ranhongyun1(a)huawei.com> --- fs/iomap/buffered-io.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/fs/iomap/buffered-io.c b/fs/iomap/buffered-io.c index baa7bbe02fad..1b9177ad7cdd 100644 --- a/fs/iomap/buffered-io.c +++ b/fs/iomap/buffered-io.c @@ -2002,12 +2002,8 @@ static int iomap_add_to_ioend(struct iomap_writepage_ctx *wpc, * should not be trimmed in such cases. */ wpc->ioend->io_size += len; - if (wpc->ioend->io_offset + wpc->ioend->io_size > isize) { - if (wpc->ioend->io_offset >= isize) - wpc->ioend->io_size = 0; - else - wpc->ioend->io_size = isize - wpc->ioend->io_offset; - } + if (pos < isize && pos + len > isize) + wpc->ioend->io_size = isize - wpc->ioend->io_offset; wbc_account_cgroup_owner(wbc, &folio->page, len); return 0; -- 2.52.0

2 1

[PATCH openEuler-1.0-LTS] ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock
by Chen Yuxi 16 Sep '26

16 Sep '26

From: Xiubo Li <xiubo.li(a)clyso.com> mainline inclusion from mainline-v7.3-rc1 commit 7af4c4f01305b0935adf6d4301b1ec407025485d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19017 CVE: CVE-2026-89655 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm… -------------------------------- list_for_each_entry() iterates ci->i_cap_flush_list but drops i_ceph_lock to send cap messages. During the unlock window, handle_cap_flush_ack() can acquire i_ceph_lock, detach cf entries with tid <= flush_tid from the list, release i_ceph_lock, and free them via ceph_free_cap_flush() outside any lock. When the original thread reacquires i_ceph_lock and the for-loop macro advances via cf = list_next_entry(cf, i_list), it dereferences cf->i_list.next on freed memory. The race timeline: __kick_flushing_caps() handle_cap_flush_ack() ----------------------- ----------------------- holds i_ceph_lock <--- iterates to cf (tid=10) prepares FLUSH message drops i_ceph_lock <--- __send_cap() ── FLUSH(tid=10) MDS sends FLUSH_ACK(tid=10) ---> acquires i_ceph_lock cf->tid(10) <= flush_tid(10), detaches cf from i_cap_flush_list drops i_ceph_lock ceph_free_cap_flush(cf) <- frees it! acquires i_ceph_lock <--- for-loop advances: cf = list_next_entry(cf, i_list) -- UAF on freed cf->i_list.next The cf was just sent by __kick_flushing_caps itself via __send_cap(). The MDS may respond with FLUSH_ACK quickly enough that handle_cap_flush_ack() frees cf before __kick_flushing_caps can finish the iteration. Fix by converting to a manual while loop: save the next pointer under i_ceph_lock before dropping it, then use the saved pointer after reacquiring, so the potentially-freed cf is never accessed again. Cc: stable(a)vger.kernel.org Signed-off-by: Xiubo Li <xiubo.li(a)clyso.com> Reviewed-by: Viacheslav Dubeyko <slava(a)dubeyko.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Conflicts: fs/ceph/caps.c [commit b2f9fa1f3bd8846f50b355fc2168236975c4d264 not backport] Signed-off-by: Chen Yuxi <chenyuxi19(a)huawei.com> --- fs/ceph/caps.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c index 80591f37dd77..a89ca4d01f91 100644 --- a/fs/ceph/caps.c +++ b/fs/ceph/caps.c @@ -2303,9 +2303,14 @@ static void __kick_flushing_caps(struct ceph_mds_client *mdsc, int ret; u64 first_tid = 0; - list_for_each_entry(cf, &ci->i_cap_flush_list, i_list) { - if (cf->tid < first_tid) + cf = list_first_entry(&ci->i_cap_flush_list, struct ceph_cap_flush, i_list); + while (&cf->i_list != &ci->i_cap_flush_list) { + struct ceph_cap_flush *next; + + if (cf->tid < first_tid) { + cf = list_next_entry(cf, i_list); continue; + } cap = ci->i_auth_cap; if (!(cap && cap->session == session)) { @@ -2315,6 +2320,7 @@ static void __kick_flushing_caps(struct ceph_mds_client *mdsc, } first_tid = cf->tid + 1; + next = list_next_entry(cf, i_list); if (cf->caps) { dout("kick_flushing_caps %p cap %p tid %llu %s\n", @@ -2357,6 +2363,7 @@ static void __kick_flushing_caps(struct ceph_mds_client *mdsc, } spin_lock(&ci->i_ceph_lock); + cf = next; } } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS V1] HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature
by Yao Yiqi 16 Sep '26

16 Sep '26

From: Xingrui Li <baka9(a)bakabaka9.tech> stable inclusion from stable-v5.10.270 commit 1c0463f0f028801a933f090cd2695f132635b374 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18767 CVE: CVE-2026-89729 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------ commit c92693f3ed099401d0383ef35ca1fe1e6ba033de upstream. sensor_hub_get_feature() clamps its return value to the caller's buffer size, but the copy loop still copies field->report_size / 8 bytes for each report value. A malicious HID descriptor can advertise a large feature field size while an IIO caller supplies a small stack buffer, such as a single s32, causing an out-of-bounds write. HID core stores parsed report values in __s32 slots and clamps extracted values to 32 bits. Reject feature fields that require more than one slot per value, guard the total byte count calculation, and clamp each per-value copy to the remaining caller buffer. Fixes: 5459ada2b3cd69 ("HID: sensor-hub: Fix packing of result buffer for feature report") Cc: stable(a)kernel.org Assisted-by: OpenAI:GPT-5.5-Cyber Signed-off-by: Xingrui Li <baka9(a)bakabaka9.tech> Acked-by: Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> Signed-off-by: Jiri Kosina <jkosina(a)suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yao Yiqi <yaoyiqi3(a)huawei.com> --- drivers/hid/hid-sensor-hub.c | 42 +++++++++++++++++++++--------------- 1 file changed, 25 insertions(+), 17 deletions(-) diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c index 4256fdc5cd6d..22b9008a7ebb 100644 --- a/drivers/hid/hid-sensor-hub.c +++ b/drivers/hid/hid-sensor-hub.c @@ -248,12 +248,17 @@ int sensor_hub_get_feature(struct hid_sensor_hub_device *hsdev, u32 report_id, u32 field_index, int buffer_size, void *buffer) { struct hid_report *report; + struct hid_field *field; struct sensor_hub_data *data = hid_get_drvdata(hsdev->hdev); - int report_size; + size_t field_size; + size_t report_size; + size_t copied = 0; + size_t to_copy; int ret = 0; - u8 *val_ptr; - int buffer_index = 0; - int i; + unsigned int i; + + if (!buffer || buffer_size <= 0) + return -EINVAL; memset(buffer, 0, buffer_size); @@ -267,26 +272,29 @@ int sensor_hub_get_feature(struct hid_sensor_hub_device *hsdev, u32 report_id, hid_hw_request(hsdev->hdev, report, HID_REQ_GET_REPORT); hid_hw_wait(hsdev->hdev); + field = report->field[field_index]; + /* calculate number of bytes required to read this field */ - report_size = DIV_ROUND_UP(report->field[field_index]->report_size, - 8) * - report->field[field_index]->report_count; - if (!report_size) { + field_size = DIV_ROUND_UP(field->report_size, 8); + /* HID core stores each parsed report value in a __s32 slot. */ + if (!field_size || field_size > sizeof(field->value[0])) { + ret = -EINVAL; + goto done_proc; + } + if (field->report_count > SIZE_MAX / field_size) { ret = -EINVAL; goto done_proc; } - ret = min(report_size, buffer_size); - val_ptr = (u8 *)report->field[field_index]->value; - for (i = 0; i < report->field[field_index]->report_count; ++i) { - if (buffer_index >= ret) - break; + report_size = field_size * field->report_count; + report_size = min_t(size_t, report_size, buffer_size); - memcpy(&((u8 *)buffer)[buffer_index], val_ptr, - report->field[field_index]->report_size / 8); - val_ptr += sizeof(__s32); - buffer_index += (report->field[field_index]->report_size / 8); + for (i = 0; i < field->report_count && copied < report_size; ++i) { + to_copy = min(field_size, report_size - copied); + memcpy(&((u8 *)buffer)[copied], &field->value[i], to_copy); + copied += to_copy; } + ret = copied; done_proc: mutex_unlock(&data->mutex); -- 2.34.1

2 1

[PATCH OLK-6.6 00/12] KVM: arm64: Add support for vTLBID
by Jinqian Yang 16 Sep '26

16 Sep '26

This series adds KVM virtualization for TLBID so that a guest can use the feature. KVM maintains a vDomain-to-pDomain mapping and writes it into VTLBID(n) on vCPU load; the hardware then translates the guest's vDomain id into the corresponding pDomain id for TLBI broadcast. The series covers: - TLBID-related sysreg definitions (TLBIDIDR_EL1, VTLBIDn_EL2, HCRX_EL2). - KVM internal helpers for TLBID virtualization init/teardown and vDomain configuration. - VTLBID(n) map update on vCPU load/migration, with ioctls for QEMU to query max vDomains and set per-vCPU vDomain bitmaps. - Guest exposure of TLBIDIDR_EL1 and ID_AA64MMFR4_EL1.TLBID, with trap handling. - Optimizations: pCPU-to-vCPU reverse index to avoid vCPU traversal, skipping TLB flush/IPI when the domain map is unchanged, and a tracepoint to replace trace_printk. Jinqian Yang (10): KVM: arm64: Add internal helpers to support TLBID virtualization KVM: arm64: Update VTLBID(n) when vCPU load KVM: arm64: Add ioctls to support TLBID virtualzation KVM: arm64: Ensure DVMBM is disabled when TLBID is enabled KVM: arm64: Expose tlbididr_el1 to guest KVM: arm64: Expose ID_AA64MMFR4_EL1_TLBID to guest KVM: arm64: Enable read TLBIDIDR_EL1 trap in guest KVM: arm64: Use pCPU-to-vCPU reverse index to avoid vCPU traversal KVM: arm64: Skip TLB invalidation and vCPU IPI when domain map is unchanged KVM: arm64: Replace trace_printk with tracepoint in kvm_tlbidomain_vcpu_load Tian Zheng (1): KVM: arm64: Skip VM-level ID_AA64MMFR4 write on vCPU hotplug Zhou Wang (1): arm64/sysreg: Add TLBID sysreg Documentation/virt/kvm/api.rst | 62 ++++ arch/arm64/include/asm/kvm_host.h | 45 +++ arch/arm64/include/uapi/asm/kvm.h | 2 + arch/arm64/kvm/arm.c | 453 ++++++++++++++++++++++++++- arch/arm64/kvm/hisilicon/hisi_virt.c | 9 + arch/arm64/kvm/sys_regs.c | 67 +++- arch/arm64/kvm/sys_regs.h | 2 + arch/arm64/kvm/trace_arm.h | 47 +++ arch/arm64/tools/sysreg | 24 +- include/uapi/linux/kvm.h | 14 + 10 files changed, 721 insertions(+), 4 deletions(-) -- 2.33.0

2 13

[PATCH OLK-6.6 00/19] backport minios part4 patches from linux mainline on September 16th.
by Qinxin Xia 16 Sep '26

16 Sep '26

driver inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/8904 ---------------------------------------------------------------------- backport minios part4 patches from linux mainline on September 16th. Marc Zyngier (2): KVM: arm64: Properly save/restore HCRX_EL2 KVM: arm64: Kill HCRX_HOST_FLAGS Mark Brown (6): arm64/sysreg: Update HCRX_EL2 definition for DDI0601 2023-09 arm64/fpsimd: Enable host kernel access to FPMR arm64/fpsimd: Support FEAT_FPMR arm64/signal: Add FPMR signal handling arm64/ptrace: Expose FPMR via ptrace arm64/fpsimd: Don't corrupt FPMR when streaming mode changes Mark Rutland (10): arm64: ptrace: fix partial SETREGSET for NT_ARM_FPMR arm64/fpsimd: Add fpsimd_save_and_flush_current_state() arm64/fpsimd: Reset FPMR upon exec() arm64/fpsimd: signal32: Always save+flush state early arm64/fpsimd: signal: Always save+flush state early arm64/fpsimd: Avoid warning when sve_to_fpsimd() is unused arm64/fpsimd: Do not discard modified SVE state arm64/fpsimd: signal: Clear TPIDR2 when delivering signals arm64/fpsimd: signal: Use SMSTOP behaviour in setup_return() arm64/fpsimd: Add task_smstop_sm() Qinxin Xia (1): arm64/idreg: Add support "arm64.nocnp" for start option Documentation/arch/arm64/sme.rst | 2 +- arch/arm64/include/asm/cpufeature.h | 6 ++ arch/arm64/include/asm/el2_setup.h | 2 +- arch/arm64/include/asm/fpsimd.h | 9 +- arch/arm64/include/asm/kvm_arm.h | 1 - arch/arm64/include/asm/kvm_kabi.h | 18 ++++ arch/arm64/include/asm/processor.h | 2 +- arch/arm64/include/asm/signal_common.h | 20 +++- arch/arm64/include/uapi/asm/sigcontext.h | 8 ++ arch/arm64/kernel/cpufeature.c | 15 ++- arch/arm64/kernel/entry-common.c | 50 +++++++--- arch/arm64/kernel/fpsimd.c | 99 +++++++++++++------- arch/arm64/kernel/idreg-override.c | 11 +++ arch/arm64/kernel/ptrace.c | 46 +++++++++ arch/arm64/kernel/signal.c | 114 +++++++++++------------ arch/arm64/kernel/signal32.c | 11 ++- arch/arm64/kvm/arm.c | 3 +- arch/arm64/kvm/fpsimd.c | 2 + arch/arm64/kvm/hyp/include/hyp/switch.h | 13 ++- arch/arm64/tools/cpucaps | 2 +- arch/arm64/tools/sysreg | 4 +- include/uapi/linux/elf.h | 1 + 22 files changed, 308 insertions(+), 131 deletions(-) create mode 100644 arch/arm64/include/asm/kvm_kabi.h -- 2.33.0

2 20

[PATCH openEuler-1.0-LTS] ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock
by Chen Yuxi 16 Sep '26

16 Sep '26

From: Xiubo Li <xiubo.li(a)clyso.com> mainline inclusion from mainline-v7.3-rc1 commit 7af4c4f01305b0935adf6d4301b1ec407025485d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19017 CVE: CVE-2026-89655 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm… -------------------------------- list_for_each_entry() iterates ci->i_cap_flush_list but drops i_ceph_lock to send cap messages. During the unlock window, handle_cap_flush_ack() can acquire i_ceph_lock, detach cf entries with tid <= flush_tid from the list, release i_ceph_lock, and free them via ceph_free_cap_flush() outside any lock. When the original thread reacquires i_ceph_lock and the for-loop macro advances via cf = list_next_entry(cf, i_list), it dereferences cf->i_list.next on freed memory. The race timeline: __kick_flushing_caps() handle_cap_flush_ack() ----------------------- ----------------------- holds i_ceph_lock <--- iterates to cf (tid=10) prepares FLUSH message drops i_ceph_lock <--- __send_cap() ── FLUSH(tid=10) MDS sends FLUSH_ACK(tid=10) ---> acquires i_ceph_lock cf->tid(10) <= flush_tid(10), detaches cf from i_cap_flush_list drops i_ceph_lock ceph_free_cap_flush(cf) <- frees it! acquires i_ceph_lock <--- for-loop advances: cf = list_next_entry(cf, i_list) -- UAF on freed cf->i_list.next The cf was just sent by __kick_flushing_caps itself via __send_cap(). The MDS may respond with FLUSH_ACK quickly enough that handle_cap_flush_ack() frees cf before __kick_flushing_caps can finish the iteration. Fix by converting to a manual while loop: save the next pointer under i_ceph_lock before dropping it, then use the saved pointer after reacquiring, so the potentially-freed cf is never accessed again. Cc: stable(a)vger.kernel.org Signed-off-by: Xiubo Li <xiubo.li(a)clyso.com> Reviewed-by: Viacheslav Dubeyko <slava(a)dubeyko.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Signed-off-by: Chen Yuxi <chenyuxi19(a)huawei.com> --- fs/ceph/caps.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c index 80591f37dd77..a89ca4d01f91 100644 --- a/fs/ceph/caps.c +++ b/fs/ceph/caps.c @@ -2303,9 +2303,14 @@ static void __kick_flushing_caps(struct ceph_mds_client *mdsc, int ret; u64 first_tid = 0; - list_for_each_entry(cf, &ci->i_cap_flush_list, i_list) { - if (cf->tid < first_tid) + cf = list_first_entry(&ci->i_cap_flush_list, struct ceph_cap_flush, i_list); + while (&cf->i_list != &ci->i_cap_flush_list) { + struct ceph_cap_flush *next; + + if (cf->tid < first_tid) { + cf = list_next_entry(cf, i_list); continue; + } cap = ci->i_auth_cap; if (!(cap && cap->session == session)) { @@ -2315,6 +2320,7 @@ static void __kick_flushing_caps(struct ceph_mds_client *mdsc, } first_tid = cf->tid + 1; + next = list_next_entry(cf, i_list); if (cf->caps) { dout("kick_flushing_caps %p cap %p tid %llu %s\n", @@ -2357,6 +2363,7 @@ static void __kick_flushing_caps(struct ceph_mds_client *mdsc, } spin_lock(&ci->i_ceph_lock); + cf = next; } } -- 2.34.1

2 1

[PATCH OLK-5.10] ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock
by Chen Yuxi 16 Sep '26

16 Sep '26

From: Xiubo Li <xiubo.li(a)clyso.com> mainline inclusion from mainline-v7.3-rc1 commit 7af4c4f01305b0935adf6d4301b1ec407025485d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19017 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- list_for_each_entry() iterates ci->i_cap_flush_list but drops i_ceph_lock to send cap messages. During the unlock window, handle_cap_flush_ack() can acquire i_ceph_lock, detach cf entries with tid <= flush_tid from the list, release i_ceph_lock, and free them via ceph_free_cap_flush() outside any lock. When the original thread reacquires i_ceph_lock and the for-loop macro advances via cf = list_next_entry(cf, i_list), it dereferences cf->i_list.next on freed memory. The race timeline: __kick_flushing_caps() handle_cap_flush_ack() ----------------------- ----------------------- holds i_ceph_lock <--- iterates to cf (tid=10) prepares FLUSH message drops i_ceph_lock <--- __send_cap() ── FLUSH(tid=10) MDS sends FLUSH_ACK(tid=10) ---> acquires i_ceph_lock cf->tid(10) <= flush_tid(10), detaches cf from i_cap_flush_list drops i_ceph_lock ceph_free_cap_flush(cf) <- frees it! acquires i_ceph_lock <--- for-loop advances: cf = list_next_entry(cf, i_list) -- UAF on freed cf->i_list.next The cf was just sent by __kick_flushing_caps itself via __send_cap(). The MDS may respond with FLUSH_ACK quickly enough that handle_cap_flush_ack() frees cf before __kick_flushing_caps can finish the iteration. Fix by converting to a manual while loop: save the next pointer under i_ceph_lock before dropping it, then use the saved pointer after reacquiring, so the potentially-freed cf is never accessed again. Cc: stable(a)vger.kernel.org Signed-off-by: Xiubo Li <xiubo.li(a)clyso.com> Reviewed-by: Viacheslav Dubeyko <slava(a)dubeyko.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Signed-off-by: Chen Yuxi <chenyuxi19(a)huawei.com> --- fs/ceph/caps.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c index 9bebdafd5ec9..d709edea84ae 100644 --- a/fs/ceph/caps.c +++ b/fs/ceph/caps.c @@ -2513,9 +2513,14 @@ static void __kick_flushing_caps(struct ceph_mds_client *mdsc, } } - list_for_each_entry(cf, &ci->i_cap_flush_list, i_list) { - if (cf->tid < first_tid) + cf = list_first_entry(&ci->i_cap_flush_list, struct ceph_cap_flush, i_list); + while (&cf->i_list != &ci->i_cap_flush_list) { + struct ceph_cap_flush *next; + + if (cf->tid < first_tid) { + cf = list_next_entry(cf, i_list); continue; + } cap = ci->i_auth_cap; if (!(cap && cap->session == session)) { @@ -2525,6 +2530,7 @@ static void __kick_flushing_caps(struct ceph_mds_client *mdsc, } first_tid = cf->tid + 1; + next = list_next_entry(cf, i_list); if (!cf->is_capsnap) { struct cap_msg_args arg; @@ -2565,6 +2571,7 @@ static void __kick_flushing_caps(struct ceph_mds_client *mdsc, } spin_lock(&ci->i_ceph_lock); + cf = next; } } -- 2.34.1

2 1

[PATCH OLK-6.6] ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock
by Chen Yuxi 16 Sep '26

16 Sep '26

From: Xiubo Li <xiubo.li(a)clyso.com> mainline inclusion from mainline-v7.3-rc1 commit 7af4c4f01305b0935adf6d4301b1ec407025485d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19017 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- list_for_each_entry() iterates ci->i_cap_flush_list but drops i_ceph_lock to send cap messages. During the unlock window, handle_cap_flush_ack() can acquire i_ceph_lock, detach cf entries with tid <= flush_tid from the list, release i_ceph_lock, and free them via ceph_free_cap_flush() outside any lock. When the original thread reacquires i_ceph_lock and the for-loop macro advances via cf = list_next_entry(cf, i_list), it dereferences cf->i_list.next on freed memory. The race timeline: __kick_flushing_caps() handle_cap_flush_ack() ----------------------- ----------------------- holds i_ceph_lock <--- iterates to cf (tid=10) prepares FLUSH message drops i_ceph_lock <--- __send_cap() ── FLUSH(tid=10) MDS sends FLUSH_ACK(tid=10) ---> acquires i_ceph_lock cf->tid(10) <= flush_tid(10), detaches cf from i_cap_flush_list drops i_ceph_lock ceph_free_cap_flush(cf) <- frees it! acquires i_ceph_lock <--- for-loop advances: cf = list_next_entry(cf, i_list) -- UAF on freed cf->i_list.next The cf was just sent by __kick_flushing_caps itself via __send_cap(). The MDS may respond with FLUSH_ACK quickly enough that handle_cap_flush_ack() frees cf before __kick_flushing_caps can finish the iteration. Fix by converting to a manual while loop: save the next pointer under i_ceph_lock before dropping it, then use the saved pointer after reacquiring, so the potentially-freed cf is never accessed again. Cc: stable(a)vger.kernel.org Signed-off-by: Xiubo Li <xiubo.li(a)clyso.com> Reviewed-by: Viacheslav Dubeyko <slava(a)dubeyko.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Signed-off-by: Chen Yuxi <chenyuxi19(a)huawei.com> --- fs/ceph/caps.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c index 0ff68e63f5a6..c80a17f82f81 100644 --- a/fs/ceph/caps.c +++ b/fs/ceph/caps.c @@ -2534,9 +2534,14 @@ static void __kick_flushing_caps(struct ceph_mds_client *mdsc, } } - list_for_each_entry(cf, &ci->i_cap_flush_list, i_list) { - if (cf->tid < first_tid) + cf = list_first_entry(&ci->i_cap_flush_list, struct ceph_cap_flush, i_list); + while (&cf->i_list != &ci->i_cap_flush_list) { + struct ceph_cap_flush *next; + + if (cf->tid < first_tid) { + cf = list_next_entry(cf, i_list); continue; + } cap = ci->i_auth_cap; if (!(cap && cap->session == session)) { @@ -2546,6 +2551,7 @@ static void __kick_flushing_caps(struct ceph_mds_client *mdsc, } first_tid = cf->tid + 1; + next = list_next_entry(cf, i_list); if (!cf->is_capsnap) { struct cap_msg_args arg; @@ -2586,6 +2592,7 @@ static void __kick_flushing_caps(struct ceph_mds_client *mdsc, } spin_lock(&ci->i_ceph_lock); + cf = next; } } -- 2.34.1

2 1

[PATCH OLK-6.6] mm: fix double initialization race in mm_counter_try_switch_to_pcpu
by Jinjiang Tu 16 Sep '26

16 Sep '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9960 ---------------------------------------- When CONFIG_MM_COUNTER_ATOMIC is enabled, mm counters start in atomic mode (using count_atomic) for single-threaded processes and switch to percpu mode (using count) upon the first CLONE_THREAD. The switch is performed by mm_counter_try_switch_to_pcpu(), which calls percpu_counter_switch_to_pcpu_many() without any lock protection. If the first switch attempt fails (GFP_ATOMIC allocation failure under memory pressure), the mm remains in atomic mode while the process is now multi-threaded. Subsequent CLONE_THREAD calls from two threads can race into mm_counter_try_switch_to_pcpu() simultaneously: Thread A (CLONE_THREAD) Thread B (CLONE_THREAD) ------------------------- ------------------------- percpu_counter_switch_to_pcpu_many percpu_counter_switch_to_pcpu_many percpu_counter_initialized? false percpu_counter_initialized? false __percpu_counter_init_many __percpu_counter_init_many alloc counters (1st) alloc counters (2nd, leaked) fbc[i].counters = ptr1 fbc[i].counters = ptr2 (overwrite) list_add(&fbc[i].list) list_add(&fbc[i].list) (double add) Both threads pass the percpu_counter_initialized() check before either completes __percpu_counter_init_many(), leading to: - Double percpu memory allocation (first allocation leaked) - Concurrent re-init of fbc[i].lock - Same fbc[i].list node added twice to the global percpu_counters list, corrupting the list and potentially triggering a list_add BUG() Fix this by serializing the switch with mm->arg_lock. This ensures the check-then-init sequence in percpu_counter_switch_to_pcpu_many() is atomic across concurrent CLONE_THREAD callers: if the first caller succeeds, the second observes counters != NULL and returns early; if the first fails, the second retries safely without overlap. Fixes: 46213033b804 ("mm: add config option for atomic mode in mm counter") Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- include/linux/mm.h | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/include/linux/mm.h b/include/linux/mm.h index 5fc9092ea039..dd84843c3029 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -2793,10 +2793,16 @@ static inline s64 get_mm_counter_sum(struct mm_struct *mm, int member) static inline int mm_counter_try_switch_to_pcpu(struct mm_struct *mm) { + int ret; + if (!mm_counter_is_atomic()) return 0; - return percpu_counter_switch_to_pcpu_many(mm->rss_stat, NR_MM_COUNTERS); + spin_lock(&mm->arg_lock); + ret = percpu_counter_switch_to_pcpu_many(mm->rss_stat, NR_MM_COUNTERS); + spin_unlock(&mm->arg_lock); + + return ret; } static inline int mm_counter_init(struct mm_struct *mm) -- 2.43.0

2 1

[PATCH 01/19] arm64/sysreg: Update HCRX_EL2 definition for DDI0601 2023-09
by Qinxin Xia 16 Sep '26

16 Sep '26

From: Mark Brown <broonie(a)kernel.org> mainline inclusion from mainline-6.8 commit 126cb3a60d35cc2ce7db090b087e00ff85b12cfc category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/8904 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------------------------------------- DDI0601 2023-09 defines new fields in HCRX_EL2 controlling access to new system registers, update our definition of HCRX_EL2 to reflect this. Signed-off-by: Mark Brown <broonie(a)kernel.org> Reviewed-by: Fuad Tabba <tabba(a)google.com> Link: https://lore.kernel.org/r/20231209-b4-arm64-sysreg-additions-v1-11-45284e53… Signed-off-by: Will Deacon <will(a)kernel.org> Signed-off-by: Qinxin Xia <xiaqinxin(a)huawei.com> Signed-off-by: Hongye Lin <linhongye(a)h-partners.com> --- arch/arm64/tools/sysreg | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/arch/arm64/tools/sysreg b/arch/arm64/tools/sysreg index 4067136b8863..603456d5e469 100644 --- a/arch/arm64/tools/sysreg +++ b/arch/arm64/tools/sysreg @@ -3124,7 +3124,9 @@ Fields ZCR_ELx EndSysreg Sysreg HCRX_EL2 3 4 1 2 2 -Res0 63:23 +Res0 63:25 +Field 24 PACMEn +Field 23 EnFPM Field 22 GCSEn Field 21 EnIDCP128 Field 20 EnSDERR -- 2.33.0

1 18

[PATCH OLK-6.6] iommufd: Fix race during abort for file descriptors
by Zhang Yuwei 15 Sep '26

15 Sep '26

mainline inclusion from mainline-v6.17-rc1 commit 4e034bf045b12852a24d5d33f2451850818ba0c1 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/7960 CVE: CVE-2025-39966 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- fput() doesn't actually call file_operations release() synchronously, it puts the file on a work queue and it will be released eventually. This is normally fine, except for iommufd the file and the iommufd_object are tied to gether. The file has the object as it's private_data and holds a users refcount, while the object is expected to remain alive as long as the file is. When the allocation of a new object aborts before installing the file it will fput() the file and then go on to immediately kfree() the obj. This causes a UAF once the workqueue completes the fput() and tries to decrement the users refcount. Fix this by putting the core code in charge of the file lifetime, and call __fput_sync() during abort to ensure that release() is called before kfree. __fput_sync() is a bit too tricky to open code in all the object implementations. Instead the objects tell the core code where the file pointer is and the core will take care of the life cycle. Adapted from upstream commit 4e034bf045b1 ("iommufd: Fix race during abort for file descriptors"). Differences vs upstream: - No eventq.c/veventq/hw_queue in this tree; the eventq hunks fall to fault.c iommufd_fault_alloc() error paths directly. - struct iommufd_fault holds obj/filep directly (no common substruct). - No pre_destroy member in struct iommufd_object_ops. Link: https://patch.msgid.link/r/1-v1-02cd136829df+31-iommufd_syz_fput_jgg@nvidia… Cc: stable(a)vger.kernel.org Fixes: 07838f7fd529 ("iommufd: Add iommufd fault object") Reviewed-by: Nicolin Chen <nicolinc(a)nvidia.com> Reviewed-by: Nirmoy Das <nirmoyd(a)nvidia.com> Reviewed-by: Kevin Tian <kevin.tian(a)intel.com> Tested-by: Nicolin Chen <nicolinc(a)nvidia.com> Reported-by: syzbot+80620e2d0d0a33b09f93(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/r/68c8583d.050a0220.2ff435.03a2.GAE@google.com Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Conflicts: drivers/iommu/iommufd/eventq.c drivers/iommu/iommufd/main.c [context conflict] Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> --- drivers/iommu/iommufd/fault.c | 5 ++--- drivers/iommu/iommufd/main.c | 34 +++++++++++++++++++++++++++++++--- 2 files changed, 33 insertions(+), 6 deletions(-) diff --git a/drivers/iommu/iommufd/fault.c b/drivers/iommu/iommufd/fault.c index b6a669d06110..8c41c49be2c6 100644 --- a/drivers/iommu/iommufd/fault.c +++ b/drivers/iommu/iommufd/fault.c @@ -401,6 +401,7 @@ int iommufd_fault_alloc(struct iommufd_ucmd *ucmd) mutex_init(&fault->mutex); init_waitqueue_head(&fault->wait_queue); + /* The filep is fput() by the core code during failure */ filep = anon_inode_getfile("[iommufd-pgfault]", &iommufd_fault_fops, fault, O_RDWR); if (IS_ERR(filep)) { @@ -415,7 +416,7 @@ int iommufd_fault_alloc(struct iommufd_ucmd *ucmd) fdno = get_unused_fd_flags(O_CLOEXEC); if (fdno < 0) { rc = fdno; - goto out_fput; + goto out_abort; } cmd->out_fault_id = fault->obj.id; @@ -431,8 +432,6 @@ int iommufd_fault_alloc(struct iommufd_ucmd *ucmd) return 0; out_put_fdno: put_unused_fd(fdno); -out_fput: - fput(filep); out_abort: iommufd_object_abort_and_destroy(ucmd->ictx, &fault->obj); diff --git a/drivers/iommu/iommufd/main.c b/drivers/iommu/iommufd/main.c index dc5353e30ac2..35f570875f65 100644 --- a/drivers/iommu/iommufd/main.c +++ b/drivers/iommu/iommufd/main.c @@ -23,6 +23,7 @@ #include "iommufd_test.h" struct iommufd_object_ops { + size_t file_offset; void (*destroy)(struct iommufd_object *obj); void (*abort)(struct iommufd_object *obj); }; @@ -71,10 +72,30 @@ void iommufd_object_abort(struct iommufd_ctx *ictx, struct iommufd_object *obj) void iommufd_object_abort_and_destroy(struct iommufd_ctx *ictx, struct iommufd_object *obj) { - if (iommufd_object_ops[obj->type].abort) - iommufd_object_ops[obj->type].abort(obj); + const struct iommufd_object_ops *ops = &iommufd_object_ops[obj->type]; + + if (ops->file_offset) { + struct file **filep = ((void *)obj) + ops->file_offset; + + /* + * A file should hold a users refcount while the file is open + * and put it back in its release. The file should hold a + * pointer to obj in their private data. Normal fput() is + * deferred to a workqueue and can get out of order with the + * following kfree(obj). Using the sync version ensures the + * release happens immediately. During abort we require the file + * refcount is one at this point - meaning the object alloc + * function cannot do anything to allow another thread to take a + * refcount prior to a guaranteed success. + */ + if (*filep) + __fput_sync(*filep); + } + + if (ops->abort) + ops->abort(obj); else - iommufd_object_ops[obj->type].destroy(obj); + ops->destroy(obj); iommufd_object_abort(ictx, obj); } @@ -497,6 +518,12 @@ void iommufd_ctx_set_kvm(struct iommufd_ctx *ictx, struct kvm *kvm) } EXPORT_SYMBOL_NS_GPL(iommufd_ctx_set_kvm, IOMMUFD); +#define IOMMUFD_FILE_OFFSET(_struct, _filep, _obj) \ + .file_offset = (offsetof(_struct, _filep) + \ + BUILD_BUG_ON_ZERO(!__same_type( \ + struct file *, ((_struct *)NULL)->_filep)) + \ + BUILD_BUG_ON_ZERO(offsetof(_struct, _obj))) + static const struct iommufd_object_ops iommufd_object_ops[] = { [IOMMUFD_OBJ_ACCESS] = { .destroy = iommufd_access_destroy_object, @@ -517,6 +544,7 @@ static const struct iommufd_object_ops iommufd_object_ops[] = { }, [IOMMUFD_OBJ_FAULT] = { .destroy = iommufd_fault_destroy, + IOMMUFD_FILE_OFFSET(struct iommufd_fault, filep, obj), }, [IOMMUFD_OBJ_VIOMMU] = { .destroy = iommufd_viommu_destroy, -- 2.22.0

2 1

[PATCH OLK-5.10] net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()
by Zhang Qilong 15 Sep '26

15 Sep '26

From: Zhan Jun <zhanjun(a)uniontech.com> stable inclusion from stable-v5.10.258 commit 5af290c86fa81ddbc86a08d54229af5daa40c6a4 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15684 CVE: CVE-2026-52982 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 23f0e34c64acba15cad4d23e50f41f533da195fa ] syzbot reported a KASAN slab-use-after-free read in rtl8150_start_xmit() when accessing skb->len for tx statistics after usb_submit_urb() has been called: BUG: KASAN: slab-use-after-free in rtl8150_start_xmit+0x71f/0x760 drivers/net/usb/rtl8150.c:712 Read of size 4 at addr ffff88810eb7a930 by task kworker/0:4/5226 The URB completion handler write_bulk_callback() frees the skb via dev_kfree_skb_irq(dev->tx_skb). The URB may complete on another CPU in softirq context before usb_submit_urb() returns in the submitter, so by the time the submitter reads skb->len the skb has already been queued to the per-CPU completion_queue and freed by net_tx_action(): CPU A (xmit) CPU B (USB completion softirq) ------------ ------------------------------ dev->tx_skb = skb; usb_submit_urb() --+ |-------> write_bulk_callback() | dev_kfree_skb_irq(dev->tx_skb) | net_tx_action() | napi_skb_cache_put() <-- free netdev->stats.tx_bytes | += skb->len; <-- UAF read Fix it by caching skb->len before submitting the URB and using the cached value when updating the tx_bytes counter. The pre-existing tx_bytes semantics are preserved: the counter tracks the original frame length (skb->len), not the ETH_ZLEN/USB-alignment padded "count" value that is handed to the device. Changing that would be a user-visible accounting change and is out of scope for this UAF fix. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+3f46c095ac0ca048cb71(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/69e69ee7.050a0220.24bfd3.002b.GAE@google.com/ Closes: https://syzkaller.appspot.com/bug?extid=3f46c095ac0ca048cb71 Reviewed-by: Andrew Lunn <andrew(a)lunn.ch> Signed-off-by: Zhan Jun <zhanjun(a)uniontech.com> Link: https://patch.msgid.link/809895186B866C10+20260423004913.136655-1-zhangdand… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/net/usb/rtl8150.c [Just context confilcts] Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- drivers/net/usb/rtl8150.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c index bf8a60533f3e..7b775cd89f4a 100644 --- a/drivers/net/usb/rtl8150.c +++ b/drivers/net/usb/rtl8150.c @@ -675,12 +675,15 @@ static void rtl8150_set_multicast(struct net_device *netdev) static netdev_tx_t rtl8150_start_xmit(struct sk_buff *skb, struct net_device *netdev) { rtl8150_t *dev = netdev_priv(netdev); + unsigned int skb_len; int count, res; + skb_len = skb->len; + netif_stop_queue(netdev); count = (skb->len < 60) ? 60 : skb->len; count = (count & 0x3f) ? count : count + 1; dev->tx_skb = skb; usb_fill_bulk_urb(dev->tx_urb, dev->udev, usb_sndbulkpipe(dev->udev, 2), @@ -694,11 +697,11 @@ static netdev_tx_t rtl8150_start_xmit(struct sk_buff *skb, netdev->stats.tx_errors++; netif_start_queue(netdev); } } else { netdev->stats.tx_packets++; - netdev->stats.tx_bytes += skb->len; + netdev->stats.tx_bytes += skb_len; netif_trans_update(netdev); } return NETDEV_TX_OK; } -- 2.43.0

2 1

[PATCH OLK-5.10] net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()
by Zhang Qilong 15 Sep '26

15 Sep '26

From: Zhan Jun <zhanjun(a)uniontech.com> stable inclusion from stable-v5.10.258 commit 5af290c86fa81ddbc86a08d54229af5daa40c6a4 category: bugfix bugzilla: https://gitcode.com/src-openeuler/kernel/issues/15684 CVE: CVE-2026-52982 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 23f0e34c64acba15cad4d23e50f41f533da195fa ] syzbot reported a KASAN slab-use-after-free read in rtl8150_start_xmit() when accessing skb->len for tx statistics after usb_submit_urb() has been called: BUG: KASAN: slab-use-after-free in rtl8150_start_xmit+0x71f/0x760 drivers/net/usb/rtl8150.c:712 Read of size 4 at addr ffff88810eb7a930 by task kworker/0:4/5226 The URB completion handler write_bulk_callback() frees the skb via dev_kfree_skb_irq(dev->tx_skb). The URB may complete on another CPU in softirq context before usb_submit_urb() returns in the submitter, so by the time the submitter reads skb->len the skb has already been queued to the per-CPU completion_queue and freed by net_tx_action(): CPU A (xmit) CPU B (USB completion softirq) ------------ ------------------------------ dev->tx_skb = skb; usb_submit_urb() --+ |-------> write_bulk_callback() | dev_kfree_skb_irq(dev->tx_skb) | net_tx_action() | napi_skb_cache_put() <-- free netdev->stats.tx_bytes | += skb->len; <-- UAF read Fix it by caching skb->len before submitting the URB and using the cached value when updating the tx_bytes counter. The pre-existing tx_bytes semantics are preserved: the counter tracks the original frame length (skb->len), not the ETH_ZLEN/USB-alignment padded "count" value that is handed to the device. Changing that would be a user-visible accounting change and is out of scope for this UAF fix. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+3f46c095ac0ca048cb71(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/69e69ee7.050a0220.24bfd3.002b.GAE@google.com/ Closes: https://syzkaller.appspot.com/bug?extid=3f46c095ac0ca048cb71 Reviewed-by: Andrew Lunn <andrew(a)lunn.ch> Signed-off-by: Zhan Jun <zhanjun(a)uniontech.com> Link: https://patch.msgid.link/809895186B866C10+20260423004913.136655-1-zhangdand… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/net/usb/rtl8150.c [Just context confilcts] Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- drivers/net/usb/rtl8150.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c index bf8a60533f3e..7b775cd89f4a 100644 --- a/drivers/net/usb/rtl8150.c +++ b/drivers/net/usb/rtl8150.c @@ -675,12 +675,15 @@ static void rtl8150_set_multicast(struct net_device *netdev) static netdev_tx_t rtl8150_start_xmit(struct sk_buff *skb, struct net_device *netdev) { rtl8150_t *dev = netdev_priv(netdev); + unsigned int skb_len; int count, res; + skb_len = skb->len; + netif_stop_queue(netdev); count = (skb->len < 60) ? 60 : skb->len; count = (count & 0x3f) ? count : count + 1; dev->tx_skb = skb; usb_fill_bulk_urb(dev->tx_urb, dev->udev, usb_sndbulkpipe(dev->udev, 2), @@ -694,11 +697,11 @@ static netdev_tx_t rtl8150_start_xmit(struct sk_buff *skb, netdev->stats.tx_errors++; netif_start_queue(netdev); } } else { netdev->stats.tx_packets++; - netdev->stats.tx_bytes += skb->len; + netdev->stats.tx_bytes += skb_len; netif_trans_update(netdev); } return NETDEV_TX_OK; } -- 2.43.0

2 1

[PATCH OLK-5.10] [Backport] remoteproc: Prevent crash handling to race with rproc_del()
by Chen Jinghuang 15 Sep '26

15 Sep '26

From: Bjorn Andersson <bjorn.andersson(a)oss.qualcomm.com> mainline inclusion from mainline-v7.3-rc1 commit 74ee3b2f5767447c57959994341e5b95f1079977 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9905 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There's no synchronization between rproc_crash_handler_work() and rproc_del(), as such it's possible for a driver to be removed while crash-handler work is scheduled, or even executing - resulting in use-after-free issues. To avoid this the scheduled work need to be cancelled and synchronized against before the removal proceeds. In order to ensure that this doesn't race with the reporting, and thereby scheduling new work, a "deleting" flag is introduced. This is similar to the RPROC_DELETE state that was introduced to ensure that "start" didn't race with rproc_del(), but the existing mechanism can not be used as it's valid to call rproc_report_crash() in atomic context - and the "state" is protected by a mutex. In the event that work is cancelled the pm_stay_awake() is left unbalanced and need to be unrolled. The blocking and cancelling of crash-handler work prior to the actual rproc_shutdown() call does have the explicit side-effect that crashes resulting from the shutdown process will not enter the crash-handling path, and as such will not generate devcoredumps etc. Due to the existing mutual exclusion between these code paths there's no concrete reduction in functionality, but further work would be needed to handle this case. Assisted-by: OpenCode:GPT-5.5 Fixes: 8afd519c3470 ("remoteproc: add rproc_report_crash function to notify rproc crashes") Signed-off-by: Bjorn Andersson <bjorn.andersson(a)oss.qualcomm.com> Reviewed-by: Pradnya Dahiwale <pradnya.dahiwale(a)oss.qualcomm.com> Link: https://lore.kernel.org/r/20260723-rproc-rmmod-not-crashing-v1-2-546dfd5de0… Signed-off-by: Bjorn Andersson <andersson(a)kernel.org> Conflicts: drivers/remoteproc/remoteproc_core.c drivers/remoteproc/remoteproc_sysfs.c include/linux/remoteproc.h [Target tree lacks the attach feature and rproc_recovery_wq; retained rproc_notifier_head_init() and schedule_work() semantics, renumbered rproc_state enum by removing RPROC_DELETED in favor of RPROC_ATTACHED to match the upstream enum reordering.] Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- drivers/remoteproc/remoteproc_core.c | 39 ++++++++++++++++++++++----- drivers/remoteproc/remoteproc_sysfs.c | 1 - include/linux/remoteproc.h | 10 +++++-- 3 files changed, 40 insertions(+), 10 deletions(-) diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c index cc55ff0128cf..d5206e4a2c48 100644 --- a/drivers/remoteproc/remoteproc_core.c +++ b/drivers/remoteproc/remoteproc_core.c @@ -1695,6 +1695,11 @@ int rproc_trigger_recovery(struct rproc *rproc) if (ret) return ret; + if (READ_ONCE(rproc->deleting)) { + ret = -ENODEV; + goto unlock_mutex; + } + /* State could have changed before we got the mutex */ if (rproc->state != RPROC_CRASHED) goto unlock_mutex; @@ -1741,6 +1746,11 @@ static void rproc_crash_handler_work(struct work_struct *work) mutex_lock(&rproc->lock); + if (READ_ONCE(rproc->deleting)) { + mutex_unlock(&rproc->lock); + goto out; + } + if (rproc->state == RPROC_CRASHED) { /* handle only the first crash detected */ mutex_unlock(&rproc->lock); @@ -1796,9 +1806,9 @@ int rproc_boot(struct rproc *rproc) return ret; } - if (rproc->state == RPROC_DELETED) { + if (READ_ONCE(rproc->deleting)) { ret = -ENODEV; - dev_err(dev, "can't boot deleted rproc %s\n", rproc->name); + dev_err(dev, "can't boot deleting rproc %s\n", rproc->name); goto unlock_mutex; } @@ -2227,6 +2237,7 @@ struct rproc *rproc_alloc(struct device *dev, const char *name, INIT_LIST_HEAD(&rproc->dump_segments); INIT_WORK(&rproc->crash_handler, rproc_crash_handler_work); + spin_lock_init(&rproc->crash_handler_lock); rproc->state = RPROC_OFFLINE; @@ -2286,18 +2297,23 @@ EXPORT_SYMBOL(rproc_put); */ int rproc_del(struct rproc *rproc) { + unsigned long flags; + if (!rproc) return -EINVAL; + spin_lock_irqsave(&rproc->crash_handler_lock, flags); + WRITE_ONCE(rproc->deleting, true); + spin_unlock_irqrestore(&rproc->crash_handler_lock, flags); + + if (cancel_work_sync(&rproc->crash_handler)) + pm_relax(rproc->dev.parent); + /* if rproc is marked always-on, rproc_add() booted it */ /* TODO: make sure this works with rproc->power > 1 */ if (rproc->auto_boot) rproc_shutdown(rproc); - mutex_lock(&rproc->lock); - rproc->state = RPROC_DELETED; - mutex_unlock(&rproc->lock); - rproc_delete_debug_dir(rproc); /* the rproc is downref'ed as soon as it's removed from the klist */ @@ -2409,19 +2425,28 @@ EXPORT_SYMBOL(rproc_get_by_child); */ void rproc_report_crash(struct rproc *rproc, enum rproc_crash_type type) { + unsigned long flags; + if (!rproc) { pr_err("NULL rproc pointer\n"); return; } + spin_lock_irqsave(&rproc->crash_handler_lock, flags); + if (READ_ONCE(rproc->deleting)) { + spin_unlock_irqrestore(&rproc->crash_handler_lock, flags); + return; + } + /* Prevent suspend while the remoteproc is being recovered */ pm_stay_awake(rproc->dev.parent); + schedule_work(&rproc->crash_handler); + spin_unlock_irqrestore(&rproc->crash_handler_lock, flags); dev_err(&rproc->dev, "crash detected in %s: type %s\n", rproc->name, rproc_crash_to_string(type)); /* create a new task to handle the error */ - schedule_work(&rproc->crash_handler); } EXPORT_SYMBOL(rproc_report_crash); diff --git a/drivers/remoteproc/remoteproc_sysfs.c b/drivers/remoteproc/remoteproc_sysfs.c index d1cf7bf277c4..171d240e5ae9 100644 --- a/drivers/remoteproc/remoteproc_sysfs.c +++ b/drivers/remoteproc/remoteproc_sysfs.c @@ -200,7 +200,6 @@ static const char * const rproc_state_string[] = { [RPROC_SUSPENDED] = "suspended", [RPROC_RUNNING] = "running", [RPROC_CRASHED] = "crashed", - [RPROC_DELETED] = "deleted", [RPROC_DETACHED] = "detached", [RPROC_LAST] = "invalid", }; diff --git a/include/linux/remoteproc.h b/include/linux/remoteproc.h index 3fa3ba6498e8..729e4d98a35c 100644 --- a/include/linux/remoteproc.h +++ b/include/linux/remoteproc.h @@ -37,6 +37,7 @@ #include <linux/types.h> #include <linux/mutex.h> +#include <linux/spinlock.h> #include <linux/virtio.h> #include <linux/cdev.h> #include <linux/completion.h> @@ -402,7 +403,8 @@ struct rproc_ops { * a message. * @RPROC_RUNNING: device is up and running * @RPROC_CRASHED: device has crashed; need to start recovery - * @RPROC_DELETED: device is deleted + * @RPROC_ATTACHED: device has been booted by another entity and the core + * has attached to it * @RPROC_DETACHED: device has been booted by another entity and waiting * for the core to attach to it * @RPROC_LAST: just keep this one at the end @@ -418,7 +420,7 @@ enum rproc_state { RPROC_SUSPENDED = 1, RPROC_RUNNING = 2, RPROC_CRASHED = 3, - RPROC_DELETED = 4, + RPROC_ATTACHED = 4, RPROC_DETACHED = 5, RPROC_LAST = 6, }; @@ -499,6 +501,8 @@ struct rproc_dump_segment { * @notifyids: idr for dynamically assigning rproc-wide unique notify ids * @index: index of this rproc device * @crash_handler: workqueue for handling a crash + * @crash_handler_lock: serializes crash handler queueing and deletion + * @deleting: remoteproc deletion has begun * @crash_cnt: crash counter * @recovery_disabled: flag that state if recovery was disabled * @max_notifyid: largest allocated notify id. @@ -536,6 +540,8 @@ struct rproc { struct idr notifyids; int index; struct work_struct crash_handler; + spinlock_t crash_handler_lock; + bool deleting; unsigned int crash_cnt; bool recovery_disabled; int max_notifyid; -- 2.34.1

2 1

[PATCH OLK-6.6] ceph: fix UAF in check_new_map() on session freed during unlock
by Chen Yuxi 15 Sep '26

15 Sep '26

From: Xiubo Li <xiubo.li(a)clyso.com> mainline inclusion from mainline-v7.3-rc1 commit ee611a7509554c4ca1f54f6aefe592fb1df7ea70 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18967 CVE: CVE-2026-89654 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- check_new_map() iterates mdsc->sessions[] and for each active session drops mdsc->mutex to perform per-session operations. The forced-close path (rank removed from map) correctly takes a reference on s via ceph_get_mds_session() before releasing mdsc->mutex, but three other paths do not: Path A (address changed): mutex_unlock → mutex_lock(&s->s_mutex) Path B (reconnect): mutex_unlock → send_mds_reconnect(mdsc, s) Path C (active transition): mutex_unlock → mutex_lock(&s->s_mutex) Without the extra reference, another thread can acquire mdsc->mutex during the unlock window, call __unregister_session() which drops the last reference on s, and free it. The original thread then accesses freed memory via s->s_mutex. Fix by adding ceph_get_mds_session(s) before each mutex_unlock and ceph_put_mds_session(s) after the corresponding mutex_lock, matching the pattern already used in the forced-close path. Race timeline (Path A): Thread A (check_new_map) Thread B (another map update holds mdsc->mutex or session teardown) -------------------------- -------------------------- s = mdsc->sessions[i] (refcount == 1, held only by sessions[] array) mutex_unlock(&mdsc->mutex) ---> acquires mdsc->mutex __unregister_session(mdsc, s) sessions[i] = NULL ceph_put_mds_session(s) refcount: 1 -> 0 kfree(s) <--- freed! mutex_lock(&s->s_mutex) UAF on freed s->s_mutex Cc: stable(a)vger.kernel.org Signed-off-by: Xiubo Li <xiubo.li(a)clyso.com> Reviewed-by: Viacheslav Dubeyko <slava(a)dubeyko.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Conflicts: fs/ceph/mds_client.c [commit 39fe3031589386ae7ce3fd7132beb6bb229e22ce not backport] Signed-off-by: Chen Yuxi <chenyuxi19(a)huawei.com> --- fs/ceph/mds_client.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c index 00b9f9f3f4d7..0d5712299909 100644 --- a/fs/ceph/mds_client.c +++ b/fs/ceph/mds_client.c @@ -4828,9 +4828,11 @@ static void check_new_map(struct ceph_mds_client *mdsc, ceph_mdsmap_get_addr(newmap, i), sizeof(struct ceph_entity_addr))) { /* just close it */ + ceph_get_mds_session(s); mutex_unlock(&mdsc->mutex); mutex_lock(&s->s_mutex); mutex_lock(&mdsc->mutex); + ceph_put_mds_session(s); ceph_con_close(&s->s_con); mutex_unlock(&s->s_mutex); s->s_state = CEPH_MDS_SESSION_RESTARTING; @@ -4843,10 +4845,12 @@ static void check_new_map(struct ceph_mds_client *mdsc, */ if (s->s_state == CEPH_MDS_SESSION_RESTARTING && newstate >= CEPH_MDS_STATE_RECONNECT) { + ceph_get_mds_session(s); mutex_unlock(&mdsc->mutex); clear_bit(i, targets); send_mds_reconnect(mdsc, s); mutex_lock(&mdsc->mutex); + ceph_put_mds_session(s); } /* @@ -4858,9 +4862,11 @@ static void check_new_map(struct ceph_mds_client *mdsc, oldstate != CEPH_MDS_STATE_STARTING) pr_info("mds%d recovery completed\n", s->s_mds); kick_requests(mdsc, i); + ceph_get_mds_session(s); mutex_unlock(&mdsc->mutex); mutex_lock(&s->s_mutex); mutex_lock(&mdsc->mutex); + ceph_put_mds_session(s); ceph_kick_flushing_caps(mdsc, s); mutex_unlock(&s->s_mutex); wake_up_session_caps(s, RECONNECT); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] ceph: fix UAF in check_new_map() on session freed during unlock
by Chen Yuxi 15 Sep '26

15 Sep '26

From: Xiubo Li <xiubo.li(a)clyso.com> mainline inclusion from mainline-v7.3-rc1 commit ee611a7509554c4ca1f54f6aefe592fb1df7ea70 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18967 CVE: CVE-2026-89654 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- check_new_map() iterates mdsc->sessions[] and for each active session drops mdsc->mutex to perform per-session operations. The forced-close path (rank removed from map) correctly takes a reference on s via ceph_get_mds_session() before releasing mdsc->mutex, but three other paths do not: Path A (address changed): mutex_unlock → mutex_lock(&s->s_mutex) Path B (reconnect): mutex_unlock → send_mds_reconnect(mdsc, s) Path C (active transition): mutex_unlock → mutex_lock(&s->s_mutex) Without the extra reference, another thread can acquire mdsc->mutex during the unlock window, call __unregister_session() which drops the last reference on s, and free it. The original thread then accesses freed memory via s->s_mutex. Fix by adding ceph_get_mds_session(s) before each mutex_unlock and ceph_put_mds_session(s) after the corresponding mutex_lock, matching the pattern already used in the forced-close path. Race timeline (Path A): Thread A (check_new_map) Thread B (another map update holds mdsc->mutex or session teardown) -------------------------- -------------------------- s = mdsc->sessions[i] (refcount == 1, held only by sessions[] array) mutex_unlock(&mdsc->mutex) ---> acquires mdsc->mutex __unregister_session(mdsc, s) sessions[i] = NULL ceph_put_mds_session(s) refcount: 1 -> 0 kfree(s) <--- freed! mutex_lock(&s->s_mutex) UAF on freed s->s_mutex Cc: stable(a)vger.kernel.org Signed-off-by: Xiubo Li <xiubo.li(a)clyso.com> Reviewed-by: Viacheslav Dubeyko <slava(a)dubeyko.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Conflicts: fs/ceph/mds_client.c [Commit ee611a7509554 added a session reference around the mdsc->mutex drop in check_new_map(). This tree names the helper get_session() instead of ceph_get_mds_session(), and its active-transition path does not drop mdsc->mutex, so only the address-changed and reconnect paths needed the reference.] Signed-off-by: Chen Yuxi <chenyuxi19(a)huawei.com> --- fs/ceph/mds_client.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c index 09db6d08614d..25219838930c 100644 --- a/fs/ceph/mds_client.c +++ b/fs/ceph/mds_client.c @@ -3363,9 +3363,11 @@ static void check_new_map(struct ceph_mds_client *mdsc, mutex_lock(&mdsc->mutex); } else { /* just close it */ + get_session(s); mutex_unlock(&mdsc->mutex); mutex_lock(&s->s_mutex); mutex_lock(&mdsc->mutex); + ceph_put_mds_session(s); ceph_con_close(&s->s_con); mutex_unlock(&s->s_mutex); s->s_state = CEPH_MDS_SESSION_RESTARTING; @@ -3379,9 +3381,11 @@ static void check_new_map(struct ceph_mds_client *mdsc, */ if (s->s_state == CEPH_MDS_SESSION_RESTARTING && newstate >= CEPH_MDS_STATE_RECONNECT) { + get_session(s); mutex_unlock(&mdsc->mutex); send_mds_reconnect(mdsc, s); mutex_lock(&mdsc->mutex); + ceph_put_mds_session(s); } /* -- 2.34.1

2 1

[PATCH OLK-5.10] ceph: fix UAF in check_new_map() on session freed during unlock
by Chen Yuxi 15 Sep '26

15 Sep '26

From: Xiubo Li <xiubo.li(a)clyso.com> mainline inclusion from mainline-v7.3-rc1 commit ee611a7509554c4ca1f54f6aefe592fb1df7ea70 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18967 CVE: CVE-2026-89654 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- check_new_map() iterates mdsc->sessions[] and for each active session drops mdsc->mutex to perform per-session operations. The forced-close path (rank removed from map) correctly takes a reference on s via ceph_get_mds_session() before releasing mdsc->mutex, but three other paths do not: Path A (address changed): mutex_unlock → mutex_lock(&s->s_mutex) Path B (reconnect): mutex_unlock → send_mds_reconnect(mdsc, s) Path C (active transition): mutex_unlock → mutex_lock(&s->s_mutex) Without the extra reference, another thread can acquire mdsc->mutex during the unlock window, call __unregister_session() which drops the last reference on s, and free it. The original thread then accesses freed memory via s->s_mutex. Fix by adding ceph_get_mds_session(s) before each mutex_unlock and ceph_put_mds_session(s) after the corresponding mutex_lock, matching the pattern already used in the forced-close path. Race timeline (Path A): Thread A (check_new_map) Thread B (another map update holds mdsc->mutex or session teardown) -------------------------- -------------------------- s = mdsc->sessions[i] (refcount == 1, held only by sessions[] array) mutex_unlock(&mdsc->mutex) ---> acquires mdsc->mutex __unregister_session(mdsc, s) sessions[i] = NULL ceph_put_mds_session(s) refcount: 1 -> 0 kfree(s) <--- freed! mutex_lock(&s->s_mutex) UAF on freed s->s_mutex Cc: stable(a)vger.kernel.org Signed-off-by: Xiubo Li <xiubo.li(a)clyso.com> Reviewed-by: Viacheslav Dubeyko <slava(a)dubeyko.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Conflicts: fs/ceph/mds_client.c [commit 39fe3031589386ae7ce3fd7132beb6bb229e22ce not backport] Signed-off-by: Chen Yuxi <chenyuxi19(a)huawei.com> --- fs/ceph/mds_client.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c index aea1b42b9b18..ed021d76359f 100644 --- a/fs/ceph/mds_client.c +++ b/fs/ceph/mds_client.c @@ -4111,9 +4111,11 @@ static void check_new_map(struct ceph_mds_client *mdsc, ceph_mdsmap_get_addr(newmap, i), sizeof(struct ceph_entity_addr))) { /* just close it */ + ceph_get_mds_session(s); mutex_unlock(&mdsc->mutex); mutex_lock(&s->s_mutex); mutex_lock(&mdsc->mutex); + ceph_put_mds_session(s); ceph_con_close(&s->s_con); mutex_unlock(&s->s_mutex); s->s_state = CEPH_MDS_SESSION_RESTARTING; @@ -4126,9 +4128,11 @@ static void check_new_map(struct ceph_mds_client *mdsc, */ if (s->s_state == CEPH_MDS_SESSION_RESTARTING && newstate >= CEPH_MDS_STATE_RECONNECT) { + ceph_get_mds_session(s); mutex_unlock(&mdsc->mutex); send_mds_reconnect(mdsc, s); mutex_lock(&mdsc->mutex); + ceph_put_mds_session(s); } /* @@ -4140,9 +4144,11 @@ static void check_new_map(struct ceph_mds_client *mdsc, oldstate != CEPH_MDS_STATE_STARTING) pr_info("mds%d recovery completed\n", s->s_mds); kick_requests(mdsc, i); + ceph_get_mds_session(s); mutex_unlock(&mdsc->mutex); mutex_lock(&s->s_mutex); mutex_lock(&mdsc->mutex); + ceph_put_mds_session(s); ceph_kick_flushing_caps(mdsc, s); mutex_unlock(&s->s_mutex); wake_up_session_caps(s, RECONNECT); -- 2.34.1

2 1

openEuler Kernel SIG双周例会
by openEuler conference 15 Sep '26

15 Sep '26

您好！ Kernel 邀请您参加 2026-09-18 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议发起人： LiaoTao_Wave 会议内容： 1. 进展update 2. 议题征集中（新增议题可填报至会议纪要看板）会议链接：https://meeting.huaweicloud.com:36443/#/j/989882321 会议纪要&签到链接：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2026-09-18 14:00 The subject of the conference is openEuler Kernel SIG双周例会 The sponsor of the conference is LiaoTao_Wave Summary: 1. 进展update 2. 议题征集中（新增议题可填报至会议纪要看板） You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/989882321 Add topics at https://etherpad.openeuler.org/p/Kernel-meetings More information: https://www.openeuler.org/en/

1 0

[PATCH OLK-6.6] [Backport] remoteproc: Prevent crash handling to race with rproc_del()
by Chen Jinghuang 15 Sep '26

15 Sep '26

From: Bjorn Andersson <bjorn.andersson(a)oss.qualcomm.com> mainline inclusion from mainline-v7.3-rc1 commit 74ee3b2f5767447c57959994341e5b95f1079977 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9905 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There's no synchronization between rproc_crash_handler_work() and rproc_del(), as such it's possible for a driver to be removed while crash-handler work is scheduled, or even executing - resulting in use-after-free issues. To avoid this the scheduled work need to be cancelled and synchronized against before the removal proceeds. In order to ensure that this doesn't race with the reporting, and thereby scheduling new work, a "deleting" flag is introduced. This is similar to the RPROC_DELETE state that was introduced to ensure that "start" didn't race with rproc_del(), but the existing mechanism can not be used as it's valid to call rproc_report_crash() in atomic context - and the "state" is protected by a mutex. In the event that work is cancelled the pm_stay_awake() is left unbalanced and need to be unrolled. The blocking and cancelling of crash-handler work prior to the actual rproc_shutdown() call does have the explicit side-effect that crashes resulting from the shutdown process will not enter the crash-handling path, and as such will not generate devcoredumps etc. Due to the existing mutual exclusion between these code paths there's no concrete reduction in functionality, but further work would be needed to handle this case. Assisted-by: OpenCode:GPT-5.5 Fixes: 8afd519c3470 ("remoteproc: add rproc_report_crash function to notify rproc crashes") Signed-off-by: Bjorn Andersson <bjorn.andersson(a)oss.qualcomm.com> Reviewed-by: Pradnya Dahiwale <pradnya.dahiwale(a)oss.qualcomm.com> Link: https://lore.kernel.org/r/20260723-rproc-rmmod-not-crashing-v1-2-546dfd5de0… Signed-off-by: Bjorn Andersson <andersson(a)kernel.org> Conflicts: drivers/remoteproc/remoteproc_core.c include/linux/remoteproc.h [The downstream 6.6 tree has no struct rproc::attach_work field nor rproc_attach_work(); the conflict was resolved by keeping only INIT_WORK() for crash_handler and adding spin_lock_init() for the new crash_handler_lock, dropping the upstream attach_work init line.] Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- drivers/remoteproc/remoteproc_core.c | 40 +++++++++++++++++++++------ drivers/remoteproc/remoteproc_sysfs.c | 1 - include/linux/remoteproc.h | 13 +++++---- 3 files changed, 40 insertions(+), 14 deletions(-) diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c index 2d4ae3b5af86..1c489b757419 100644 --- a/drivers/remoteproc/remoteproc_core.c +++ b/drivers/remoteproc/remoteproc_core.c @@ -1837,6 +1837,11 @@ int rproc_trigger_recovery(struct rproc *rproc) if (ret) return ret; + if (READ_ONCE(rproc->deleting)) { + ret = -ENODEV; + goto unlock_mutex; + } + /* State could have changed before we got the mutex */ if (rproc->state != RPROC_CRASHED) goto unlock_mutex; @@ -1869,6 +1874,11 @@ static void rproc_crash_handler_work(struct work_struct *work) mutex_lock(&rproc->lock); + if (READ_ONCE(rproc->deleting)) { + mutex_unlock(&rproc->lock); + goto out; + } + if (rproc->state == RPROC_CRASHED) { /* handle only the first crash detected */ mutex_unlock(&rproc->lock); @@ -1924,9 +1934,9 @@ int rproc_boot(struct rproc *rproc) return ret; } - if (rproc->state == RPROC_DELETED) { + if (READ_ONCE(rproc->deleting)) { ret = -ENODEV; - dev_err(dev, "can't boot deleted rproc %s\n", rproc->name); + dev_err(dev, "can't boot deleting rproc %s\n", rproc->name); goto unlock_mutex; } @@ -2497,6 +2507,7 @@ struct rproc *rproc_alloc(struct device *dev, const char *name, INIT_LIST_HEAD(&rproc->dump_segments); INIT_WORK(&rproc->crash_handler, rproc_crash_handler_work); + spin_lock_init(&rproc->crash_handler_lock); rproc->state = RPROC_OFFLINE; @@ -2556,16 +2567,21 @@ EXPORT_SYMBOL(rproc_put); */ int rproc_del(struct rproc *rproc) { + unsigned long flags; + if (!rproc) return -EINVAL; + spin_lock_irqsave(&rproc->crash_handler_lock, flags); + WRITE_ONCE(rproc->deleting, true); + spin_unlock_irqrestore(&rproc->crash_handler_lock, flags); + + if (cancel_work_sync(&rproc->crash_handler)) + pm_relax(rproc->dev.parent); + /* TODO: make sure this works with rproc->power > 1 */ rproc_shutdown(rproc); - mutex_lock(&rproc->lock); - rproc->state = RPROC_DELETED; - mutex_unlock(&rproc->lock); - rproc_delete_debug_dir(rproc); /* the rproc is downref'ed as soon as it's removed from the klist */ @@ -2677,18 +2693,26 @@ EXPORT_SYMBOL(rproc_get_by_child); */ void rproc_report_crash(struct rproc *rproc, enum rproc_crash_type type) { + unsigned long flags; + if (!rproc) { pr_err("NULL rproc pointer\n"); return; } + spin_lock_irqsave(&rproc->crash_handler_lock, flags); + if (READ_ONCE(rproc->deleting)) { + spin_unlock_irqrestore(&rproc->crash_handler_lock, flags); + return; + } + /* Prevent suspend while the remoteproc is being recovered */ pm_stay_awake(rproc->dev.parent); + queue_work(rproc_recovery_wq, &rproc->crash_handler); + spin_unlock_irqrestore(&rproc->crash_handler_lock, flags); dev_err(&rproc->dev, "crash detected in %s: type %s\n", rproc->name, rproc_crash_to_string(type)); - - queue_work(rproc_recovery_wq, &rproc->crash_handler); } EXPORT_SYMBOL(rproc_report_crash); diff --git a/drivers/remoteproc/remoteproc_sysfs.c b/drivers/remoteproc/remoteproc_sysfs.c index 8c7ea8922638..23de0490ba16 100644 --- a/drivers/remoteproc/remoteproc_sysfs.c +++ b/drivers/remoteproc/remoteproc_sysfs.c @@ -168,7 +168,6 @@ static const char * const rproc_state_string[] = { [RPROC_SUSPENDED] = "suspended", [RPROC_RUNNING] = "running", [RPROC_CRASHED] = "crashed", - [RPROC_DELETED] = "deleted", [RPROC_ATTACHED] = "attached", [RPROC_DETACHED] = "detached", [RPROC_LAST] = "invalid", diff --git a/include/linux/remoteproc.h b/include/linux/remoteproc.h index b4795698d8c2..e1634b9c7992 100644 --- a/include/linux/remoteproc.h +++ b/include/linux/remoteproc.h @@ -37,6 +37,7 @@ #include <linux/types.h> #include <linux/mutex.h> +#include <linux/spinlock.h> #include <linux/virtio.h> #include <linux/cdev.h> #include <linux/completion.h> @@ -412,7 +413,6 @@ struct rproc_ops { * a message. * @RPROC_RUNNING: device is up and running * @RPROC_CRASHED: device has crashed; need to start recovery - * @RPROC_DELETED: device is deleted * @RPROC_ATTACHED: device has been booted by another entity and the core * has attached to it * @RPROC_DETACHED: device has been booted by another entity and waiting @@ -430,10 +430,9 @@ enum rproc_state { RPROC_SUSPENDED = 1, RPROC_RUNNING = 2, RPROC_CRASHED = 3, - RPROC_DELETED = 4, - RPROC_ATTACHED = 5, - RPROC_DETACHED = 6, - RPROC_LAST = 7, + RPROC_ATTACHED = 4, + RPROC_DETACHED = 5, + RPROC_LAST = 6, }; /** @@ -527,6 +526,8 @@ enum rproc_features { * @notifyids: idr for dynamically assigning rproc-wide unique notify ids * @index: index of this rproc device * @crash_handler: workqueue for handling a crash + * @crash_handler_lock: serializes crash handler queueing and deletion + * @deleting: remoteproc deletion has begun * @crash_cnt: crash counter * @recovery_disabled: flag that state if recovery was disabled * @max_notifyid: largest allocated notify id. @@ -569,6 +570,8 @@ struct rproc { struct idr notifyids; int index; struct work_struct crash_handler; + spinlock_t crash_handler_lock; + bool deleting; unsigned int crash_cnt; bool recovery_disabled; int max_notifyid; -- 2.34.1

2 1

[PATCH OLK-6.6] kallsyms: prevent module removal when printing module name and buildid
by Tengda Wu 15 Sep '26

15 Sep '26

From: Petr Mladek <pmladek(a)suse.com> mainline inclusion from mainline-v7.0-rc1 commit 3b07086444f80c844351255fd94c2cb0a7224df2 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9956 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- kallsyms_lookup_buildid() copies the symbol name into the given buffer so that it can be safely read anytime later. But it just copies pointers to mod->name and mod->build_id which might get reused after the related struct module gets removed. The lifetime of struct module is synchronized using RCU. Take the rcu read lock for the entire __sprint_symbol(). Link: https://lkml.kernel.org/r/20251128135920.217303-8-pmladek@suse.com Signed-off-by: Petr Mladek <pmladek(a)suse.com> Reviewed-by: Aaron Tomlin <atomlin(a)atomlin.com> Cc: Alexei Starovoitov <ast(a)kernel.org> Cc: Daniel Borkman <daniel(a)iogearbox.net> Cc: Daniel Gomez <da.gomez(a)samsung.com> Cc: John Fastabend <john.fastabend(a)gmail.com> Cc: Kees Cook <kees(a)kernel.org> Cc: Luis Chamberalin <mcgrof(a)kernel.org> Cc: Marc Rutland <mark.rutland(a)arm.com> Cc: "Masami Hiramatsu (Google)" <mhiramat(a)kernel.org> Cc: Petr Pavlu <petr.pavlu(a)suse.com> Cc: Sami Tolvanen <samitolvanen(a)google.com> Cc: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: kernel/kallsyms.c [Context conflict] Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/kallsyms.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/kernel/kallsyms.c b/kernel/kallsyms.c index 78b5bda6f531..0919c4dd9d8b 100644 --- a/kernel/kallsyms.c +++ b/kernel/kallsyms.c @@ -485,6 +485,9 @@ static int __sprint_symbol(char *buffer, unsigned long address, unsigned long offset, size; int len; + /* Prevent module removal until modname and modbuildid are printed */ + guard(rcu)(); + address += symbol_offset; name = kallsyms_lookup_buildid(address, &size, &offset, &modname, &buildid, buffer); -- 2.34.1

2 1

[PATCH OLK-6.6] KVM: arm64: vgic-v3: Restrict ICH_AP1Rn_EL2 accesses to 64-bit only with vNMI
by Jinqian Yang 15 Sep '26

15 Sep '26

virt inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9836 -------------------------------------------------------------------- ICH_AP1Rn_EL2 is 64-bit only when vNMI is in use, with the NMI priority in ICH_AP1R0_EL2[63:32]; otherwise the upper bits are RES0. Gate the save/restore access width on vgic_v3_vcpu_has_vnmi() which checks both vgic.has_nmi and ID_AA64PFR1_EL1.NMI, so that the NMI priority is preserved across context switch only when vNMI is actually enabled for the guest. Also drop the early assignment of kvm->arch.pfr1_nmi in kvm_arch_init_vm(). Without it vNMI is no longer enabled by default at VM creation on hosts with FEAT_NMI; instead the VMM must explicitly set ID_AA64PFR1_EL1.NMI via SET_ONE_REG to enable vNMI for the guest. Fixes: d46e52452afc ("KVM: arm64: vgic-v3: Upgrade AP1Rn to 64bit.") Signed-off-by: Jinqian Yang <yangjinqian1(a)huawei.com> --- arch/arm64/include/asm/kvm_hyp.h | 1 + arch/arm64/kvm/arm.c | 3 -- arch/arm64/kvm/hyp/vgic-v3-sr.c | 55 +++++++++++++++++++++++++++----- 3 files changed, 48 insertions(+), 11 deletions(-) diff --git a/arch/arm64/include/asm/kvm_hyp.h b/arch/arm64/include/asm/kvm_hyp.h index 127ad280e68b..c4121bf0aadc 100644 --- a/arch/arm64/include/asm/kvm_hyp.h +++ b/arch/arm64/include/asm/kvm_hyp.h @@ -82,6 +82,7 @@ void __vgic_v3_activate_traps(struct vgic_v3_cpu_if *cpu_if); void __vgic_v3_deactivate_traps(struct vgic_v3_cpu_if *cpu_if); void __vgic_v3_save_aprs(struct vgic_v3_cpu_if *cpu_if); void __vgic_v3_restore_aprs(struct vgic_v3_cpu_if *cpu_if); +bool vgic_v3_vcpu_has_vnmi(struct kvm_vcpu *vcpu); int __vgic_v3_perform_cpuif_access(struct kvm_vcpu *vcpu); #ifdef __KVM_NVHE_HYPERVISOR__ diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c index 2b560eba3e0b..9a4be08730da 100644 --- a/arch/arm64/kvm/arm.c +++ b/arch/arm64/kvm/arm.c @@ -381,9 +381,6 @@ int kvm_arch_init_vm(struct kvm *kvm, unsigned long type) /* The maximum number of VCPUs is limited by the host's GIC model */ kvm->max_vcpus = kvm_arm_default_max_vcpus(); - if (cpus_have_const_cap(ARM64_HAS_NMI) && !static_branch_unlikely(&vgic_v3_cpuif_trap)) - kvm->arch.pfr1_nmi = ID_AA64PFR1_EL1_NMI_IMP; - kvm_arm_init_hypercalls(kvm); if (!kvm_is_realm(kvm)) diff --git a/arch/arm64/kvm/hyp/vgic-v3-sr.c b/arch/arm64/kvm/hyp/vgic-v3-sr.c index 7a9e132f68db..ab406332762e 100644 --- a/arch/arm64/kvm/hyp/vgic-v3-sr.c +++ b/arch/arm64/kvm/hyp/vgic-v3-sr.c @@ -335,10 +335,40 @@ void __vgic_v3_deactivate_traps(struct vgic_v3_cpu_if *cpu_if) write_gicreg(0, ICH_HCR_EL2); } +static struct kvm_vcpu *vgic_v3_cpu_if_to_vcpu(struct vgic_v3_cpu_if *cpu_if) +{ + struct vgic_cpu *vgic_cpu = container_of(cpu_if, struct vgic_cpu, vgic_v3); + + return container_of(vgic_cpu, struct kvm_vcpu, arch.vgic_cpu); +} + +/* + * vNMI is only usable if the guest has selected NMI support + * (vgic.has_nmi) and the vcpu has FEAT_NMI (pfr1_nmi). + * + * This drives the width of the ICH_AP1Rn_EL2 accesses: with vNMI the + * registers are 64bit (the NMI priority lives in ICH_AP1R0_EL2[63]), + * without it only the low 32 bits are valid. + */ +bool vgic_v3_vcpu_has_vnmi(struct kvm_vcpu *vcpu) +{ + struct kvm *kvm = kern_hyp_va(vcpu->kvm); + + return kvm->arch.vgic.has_nmi && + kvm->arch.pfr1_nmi == ID_AA64PFR1_EL1_NMI_IMP; +} + void __vgic_v3_save_aprs(struct vgic_v3_cpu_if *cpu_if) { u64 val; u32 nr_pre_bits; + /* + * ICH_AP1Rn_EL2 are only 64bit when the vcpu has vNMI: the NMI + * priority is encoded in ICH_AP1R0_EL2[63]. Without vNMI, the + * upper bits are RES0 and only the low 32 bits must be + * preserved. + */ + bool vnmi = vgic_v3_vcpu_has_vnmi(vgic_v3_cpu_if_to_vcpu(cpu_if)); val = read_gicreg(ICH_VTR_EL2); nr_pre_bits = vtr_to_nr_pre_bits(val); @@ -357,14 +387,18 @@ void __vgic_v3_save_aprs(struct vgic_v3_cpu_if *cpu_if) switch (nr_pre_bits) { case 7: - cpu_if->vgic_ap1r[3] = __vgic_v3_read_ap1rn(3); - cpu_if->vgic_ap1r[2] = __vgic_v3_read_ap1rn(2); + cpu_if->vgic_ap1r[3] = vnmi ? __vgic_v3_read_ap1rn(3) + : (u32)__vgic_v3_read_ap1rn(3); + cpu_if->vgic_ap1r[2] = vnmi ? __vgic_v3_read_ap1rn(2) + : (u32)__vgic_v3_read_ap1rn(2); fallthrough; case 6: - cpu_if->vgic_ap1r[1] = __vgic_v3_read_ap1rn(1); + cpu_if->vgic_ap1r[1] = vnmi ? __vgic_v3_read_ap1rn(1) + : (u32)__vgic_v3_read_ap1rn(1); fallthrough; default: - cpu_if->vgic_ap1r[0] = __vgic_v3_read_ap1rn(0); + cpu_if->vgic_ap1r[0] = vnmi ? __vgic_v3_read_ap1rn(0) + : (u32)__vgic_v3_read_ap1rn(0); } } @@ -372,6 +406,7 @@ void __vgic_v3_restore_aprs(struct vgic_v3_cpu_if *cpu_if) { u64 val; u32 nr_pre_bits; + bool vnmi = vgic_v3_vcpu_has_vnmi(vgic_v3_cpu_if_to_vcpu(cpu_if)); val = read_gicreg(ICH_VTR_EL2); nr_pre_bits = vtr_to_nr_pre_bits(val); @@ -390,14 +425,18 @@ void __vgic_v3_restore_aprs(struct vgic_v3_cpu_if *cpu_if) switch (nr_pre_bits) { case 7: - __vgic_v3_write_ap1rn(cpu_if->vgic_ap1r[3], 3); - __vgic_v3_write_ap1rn(cpu_if->vgic_ap1r[2], 2); + __vgic_v3_write_ap1rn(vnmi ? cpu_if->vgic_ap1r[3] + : (u32)cpu_if->vgic_ap1r[3], 3); + __vgic_v3_write_ap1rn(vnmi ? cpu_if->vgic_ap1r[2] + : (u32)cpu_if->vgic_ap1r[2], 2); fallthrough; case 6: - __vgic_v3_write_ap1rn(cpu_if->vgic_ap1r[1], 1); + __vgic_v3_write_ap1rn(vnmi ? cpu_if->vgic_ap1r[1] + : (u32)cpu_if->vgic_ap1r[1], 1); fallthrough; default: - __vgic_v3_write_ap1rn(cpu_if->vgic_ap1r[0], 0); + __vgic_v3_write_ap1rn(vnmi ? cpu_if->vgic_ap1r[0] + : (u32)cpu_if->vgic_ap1r[0], 0); } } -- 2.33.0

2 1

[PATCH OLK-6.6] KVM: arm64: vgic-v3: Restrict ICH_AP1Rn_EL2 accesses to 64-bit only with vNMI
by Jinqian Yang 15 Sep '26

15 Sep '26

virt inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9836 -------------------------------------------------------------------- ICH_AP1Rn_EL2 is 64-bit only when vNMI is in use, with the NMI priority in ICH_AP1R0_EL2[63:32]; otherwise the upper bits are RES0. Gate the save/restore access width on vgic_v3_vcpu_has_vnmi() which checks both vgic.has_nmi and ID_AA64PFR1_EL1.NMI, so that the NMI priority is preserved across context switch only when vNMI is actually enabled for the guest. Also drop the early assignment of kvm->arch.pfr1_nmi in kvm_arch_init_vm(). Without it vNMI is no longer enabled by default at VM creation on hosts with FEAT_NMI; instead the VMM must explicitly set ID_AA64PFR1_EL1.NMI via SET_ONE_REG to enable vNMI for the guest. Signed-off-by: Jinqian Yang <yangjinqian1(a)huawei.com> --- arch/arm64/include/asm/kvm_hyp.h | 1 + arch/arm64/kvm/arm.c | 3 -- arch/arm64/kvm/hyp/vgic-v3-sr.c | 55 +++++++++++++++++++++++++++----- 3 files changed, 48 insertions(+), 11 deletions(-) diff --git a/arch/arm64/include/asm/kvm_hyp.h b/arch/arm64/include/asm/kvm_hyp.h index 127ad280e68b..c4121bf0aadc 100644 --- a/arch/arm64/include/asm/kvm_hyp.h +++ b/arch/arm64/include/asm/kvm_hyp.h @@ -82,6 +82,7 @@ void __vgic_v3_activate_traps(struct vgic_v3_cpu_if *cpu_if); void __vgic_v3_deactivate_traps(struct vgic_v3_cpu_if *cpu_if); void __vgic_v3_save_aprs(struct vgic_v3_cpu_if *cpu_if); void __vgic_v3_restore_aprs(struct vgic_v3_cpu_if *cpu_if); +bool vgic_v3_vcpu_has_vnmi(struct kvm_vcpu *vcpu); int __vgic_v3_perform_cpuif_access(struct kvm_vcpu *vcpu); #ifdef __KVM_NVHE_HYPERVISOR__ diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c index 2b560eba3e0b..9a4be08730da 100644 --- a/arch/arm64/kvm/arm.c +++ b/arch/arm64/kvm/arm.c @@ -381,9 +381,6 @@ int kvm_arch_init_vm(struct kvm *kvm, unsigned long type) /* The maximum number of VCPUs is limited by the host's GIC model */ kvm->max_vcpus = kvm_arm_default_max_vcpus(); - if (cpus_have_const_cap(ARM64_HAS_NMI) && !static_branch_unlikely(&vgic_v3_cpuif_trap)) - kvm->arch.pfr1_nmi = ID_AA64PFR1_EL1_NMI_IMP; - kvm_arm_init_hypercalls(kvm); if (!kvm_is_realm(kvm)) diff --git a/arch/arm64/kvm/hyp/vgic-v3-sr.c b/arch/arm64/kvm/hyp/vgic-v3-sr.c index 7a9e132f68db..ab406332762e 100644 --- a/arch/arm64/kvm/hyp/vgic-v3-sr.c +++ b/arch/arm64/kvm/hyp/vgic-v3-sr.c @@ -335,10 +335,40 @@ void __vgic_v3_deactivate_traps(struct vgic_v3_cpu_if *cpu_if) write_gicreg(0, ICH_HCR_EL2); } +static struct kvm_vcpu *vgic_v3_cpu_if_to_vcpu(struct vgic_v3_cpu_if *cpu_if) +{ + struct vgic_cpu *vgic_cpu = container_of(cpu_if, struct vgic_cpu, vgic_v3); + + return container_of(vgic_cpu, struct kvm_vcpu, arch.vgic_cpu); +} + +/* + * vNMI is only usable if the guest has selected NMI support + * (vgic.has_nmi) and the vcpu has FEAT_NMI (pfr1_nmi). + * + * This drives the width of the ICH_AP1Rn_EL2 accesses: with vNMI the + * registers are 64bit (the NMI priority lives in ICH_AP1R0_EL2[63]), + * without it only the low 32 bits are valid. + */ +bool vgic_v3_vcpu_has_vnmi(struct kvm_vcpu *vcpu) +{ + struct kvm *kvm = kern_hyp_va(vcpu->kvm); + + return kvm->arch.vgic.has_nmi && + kvm->arch.pfr1_nmi == ID_AA64PFR1_EL1_NMI_IMP; +} + void __vgic_v3_save_aprs(struct vgic_v3_cpu_if *cpu_if) { u64 val; u32 nr_pre_bits; + /* + * ICH_AP1Rn_EL2 are only 64bit when the vcpu has vNMI: the NMI + * priority is encoded in ICH_AP1R0_EL2[63]. Without vNMI, the + * upper bits are RES0 and only the low 32 bits must be + * preserved. + */ + bool vnmi = vgic_v3_vcpu_has_vnmi(vgic_v3_cpu_if_to_vcpu(cpu_if)); val = read_gicreg(ICH_VTR_EL2); nr_pre_bits = vtr_to_nr_pre_bits(val); @@ -357,14 +387,18 @@ void __vgic_v3_save_aprs(struct vgic_v3_cpu_if *cpu_if) switch (nr_pre_bits) { case 7: - cpu_if->vgic_ap1r[3] = __vgic_v3_read_ap1rn(3); - cpu_if->vgic_ap1r[2] = __vgic_v3_read_ap1rn(2); + cpu_if->vgic_ap1r[3] = vnmi ? __vgic_v3_read_ap1rn(3) + : (u32)__vgic_v3_read_ap1rn(3); + cpu_if->vgic_ap1r[2] = vnmi ? __vgic_v3_read_ap1rn(2) + : (u32)__vgic_v3_read_ap1rn(2); fallthrough; case 6: - cpu_if->vgic_ap1r[1] = __vgic_v3_read_ap1rn(1); + cpu_if->vgic_ap1r[1] = vnmi ? __vgic_v3_read_ap1rn(1) + : (u32)__vgic_v3_read_ap1rn(1); fallthrough; default: - cpu_if->vgic_ap1r[0] = __vgic_v3_read_ap1rn(0); + cpu_if->vgic_ap1r[0] = vnmi ? __vgic_v3_read_ap1rn(0) + : (u32)__vgic_v3_read_ap1rn(0); } } @@ -372,6 +406,7 @@ void __vgic_v3_restore_aprs(struct vgic_v3_cpu_if *cpu_if) { u64 val; u32 nr_pre_bits; + bool vnmi = vgic_v3_vcpu_has_vnmi(vgic_v3_cpu_if_to_vcpu(cpu_if)); val = read_gicreg(ICH_VTR_EL2); nr_pre_bits = vtr_to_nr_pre_bits(val); @@ -390,14 +425,18 @@ void __vgic_v3_restore_aprs(struct vgic_v3_cpu_if *cpu_if) switch (nr_pre_bits) { case 7: - __vgic_v3_write_ap1rn(cpu_if->vgic_ap1r[3], 3); - __vgic_v3_write_ap1rn(cpu_if->vgic_ap1r[2], 2); + __vgic_v3_write_ap1rn(vnmi ? cpu_if->vgic_ap1r[3] + : (u32)cpu_if->vgic_ap1r[3], 3); + __vgic_v3_write_ap1rn(vnmi ? cpu_if->vgic_ap1r[2] + : (u32)cpu_if->vgic_ap1r[2], 2); fallthrough; case 6: - __vgic_v3_write_ap1rn(cpu_if->vgic_ap1r[1], 1); + __vgic_v3_write_ap1rn(vnmi ? cpu_if->vgic_ap1r[1] + : (u32)cpu_if->vgic_ap1r[1], 1); fallthrough; default: - __vgic_v3_write_ap1rn(cpu_if->vgic_ap1r[0], 0); + __vgic_v3_write_ap1rn(vnmi ? cpu_if->vgic_ap1r[0] + : (u32)cpu_if->vgic_ap1r[0], 0); } } -- 2.33.0

2 1

[PATCH OLK-5.10 0/2] CVE-2026-68396
by Zhou Minqiang 14 Sep '26

14 Sep '26

CVE-2026-68396 Zhou Minqiang (2): scsi: core: wake eh reliably when using scsi_schedule_eh scsi: core: Fix kabi breakage of struct Scsi_Host drivers/scsi/hosts.c | 13 +++++++++++++ drivers/scsi/scsi_error.c | 24 +++++++++++++++++++++++- drivers/scsi/scsi_priv.h | 1 + include/scsi/scsi_host.h | 7 ++++++- 4 files changed, 43 insertions(+), 2 deletions(-) -- 2.52.0

2 3

[PATCH OLK-5.10] scsi: core: pair EH runtime PM get and put
by Zhou Minqiang 14 Sep '26

14 Sep '26

mainline inclusion from mainline-v7.2 commit 872f486259ae0bc6b73ca4735a15d013241f73e9 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18399 CVE: CVE-2026-74754 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- shost->eh_noresume is currently consulted twice in one error handling iteration: once before scsi_autopm_get_host() and once again before scsi_autopm_put_host(). That is racy when a PM-triggered error path flips shost->eh_noresume while the SCSI EH thread is still running. The problem flow looks like this: PM path ufshcd_set_dev_pwr_mode() shost->eh_noresume = 1 ufshcd_execute_start_stop <-- trigger EH ... shost->eh_noresume = 0 EH path scsi_error_handler() if (!shost->eh_noresume) scsi_autopm_get_host() <-- skipped ... if (!shost->eh_noresume) scsi_autopm_put_host() <-- executed later In that case one EH iteration can skip autoresume on entry and still drop a runtime PM reference on exit. That leaves an unmatched runtime PM put and can trigger a runtime PM usage count underflow. Fix this by making eh_noresume a regular bool so it can be accessed with READ_ONCE() and WRITE_ONCE(). Snapshot it once per EH iteration and use that snapshot for both runtime PM get and put decisions. Fixes: ae0751ffc77e ("[SCSI] add flag to skip the runtime PM calls on the host") Signed-off-by: Hongjie Fang <hongjiefang(a)asrmicro.com> Reviewed-by: Bart Van Assche <bvanassche(a)acm.org> Reviewed-by: Peter Wang <peter.wang(a)mediatek.com> Link: https://patch.msgid.link/20260729111614.2407559-1-hongjiefang@asrmicro.com Signed-off-by: Martin K. Petersen (Oracle) <mkp(a)kernel.org> Conflicts: drivers/scsi/scsi_error.c drivers/scsi/ufs/ufshcd.c [ctx conflicts] Signed-off-by: Zhou Minqiang <zhouminqiang2(a)huawei.com> --- drivers/scsi/scsi_error.c | 9 +++++++-- drivers/scsi/ufs/ufshcd.c | 4 ++++ 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c index 18512b33a190..90f275ac43c6 100644 --- a/drivers/scsi/scsi_error.c +++ b/drivers/scsi/scsi_error.c @@ -2204,6 +2204,8 @@ static void scsi_unjam_host(struct Scsi_Host *shost) int scsi_error_handler(void *data) { struct Scsi_Host *shost = data; + bool eh_noresume; + unsigned long flags; /* * We use TASK_INTERRUPTIBLE so that the thread is not @@ -2245,7 +2247,10 @@ int scsi_error_handler(void *data) * what we need to do to get it up and online again (if we can). * If we fail, we end up taking the thing offline. */ - if (!shost->eh_noresume && scsi_autopm_get_host(shost) != 0) { + spin_lock_irqsave(shost->host_lock, flags); + eh_noresume = shost->eh_noresume; + spin_unlock_irqrestore(shost->host_lock, flags); + if (!eh_noresume && scsi_autopm_get_host(shost) != 0) { SCSI_LOG_ERROR_RECOVERY(1, shost_printk(KERN_ERR, shost, "scsi_eh_%d: unable to autoresume\n", @@ -2269,7 +2274,7 @@ int scsi_error_handler(void *data) * which are still online. */ scsi_restart_operations(shost); - if (!shost->eh_noresume) + if (!eh_noresume) scsi_autopm_put_host(shost); } __set_current_state(TASK_RUNNING); diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c index ae00892ba44a..b3c6f41a5284 100644 --- a/drivers/scsi/ufs/ufshcd.c +++ b/drivers/scsi/ufs/ufshcd.c @@ -8291,7 +8291,9 @@ static int ufshcd_set_dev_pwr_mode(struct ufs_hba *hba, * we are functional while we are here, skip host resume in error * handling context. */ + spin_lock_irqsave(hba->host->host_lock, flags); hba->host->eh_noresume = 1; + spin_unlock_irqrestore(hba->host->host_lock, flags); if (hba->wlun_dev_clr_ua) { ret = ufshcd_send_request_sense(hba, sdp); if (ret) @@ -8321,7 +8323,9 @@ static int ufshcd_set_dev_pwr_mode(struct ufs_hba *hba, hba->curr_dev_pwr_mode = pwr_mode; out: scsi_device_put(sdp); + spin_lock_irqsave(hba->host->host_lock, flags); hba->host->eh_noresume = 0; + spin_unlock_irqrestore(hba->host->host_lock, flags); return ret; } -- 2.52.0

2 1

[PATCH OLK-6.6 0/8] arm64: Add FEAT_TLBID support
by Zeng Heng 14 Sep '26

14 Sep '26

TLBI broadcasting all PEs introduces performance noise. By combining hardware and software, TLBID (TLBI Domain) limit TLBI to an appropriate scope, avoiding the performance overhead caused by broadcasting. Arm Architecture defines the FEAT_TLBID extension since Armv9.3, when present, allows the OSPM to target TLB invalidations to a specific domain. A TLBI domain can be contained in multiple parent domains. The TLBI table lists all the PE and SMMU components and the TLBI Domains that each component belongs to. The feature is detected at runtime, and will remain disabled if the system does not implement the feature. Jinjiang Tu (1): arm64: tlbflush: Optimize flush_tlb_mm() by using TLBID Liao Chang (1): acpi: arm64: Add basic skeleton for TLBI Domains Marc Zyngier (4): arm64: cpufeature: Add ID_AA64MMFR4_EL1 handling arm64: sysreg: Add layout for ID_AA64MMFR4_EL1 arm64: cpufeatures: Add missing ID_AA64MMFR4_EL1 to __read_sysreg_by_encoding() arm64: sysreg: Update ID_AA64MMFR4_EL1 description Zeng Heng (2): arm64: cpufeature: Add TLBID (Domain-based TLB Invalidation) detection arm64: mm: Track CPUs that a task has run on for TLBID optimization arch/arm64/Kconfig | 20 ++ arch/arm64/include/asm/cpu.h | 2 + arch/arm64/include/asm/cpufeature.h | 13 ++ arch/arm64/include/asm/tlbflush.h | 66 +++++- arch/arm64/include/asm/tlbidomain.h | 34 +++ arch/arm64/kernel/cpufeature.c | 20 ++ arch/arm64/kernel/cpuinfo.c | 4 + arch/arm64/mm/Makefile | 1 + arch/arm64/mm/context.c | 9 +- arch/arm64/mm/tlbidomain.c | 339 ++++++++++++++++++++++++++++ arch/arm64/tools/cpucaps | 2 +- arch/arm64/tools/sysreg | 64 ++++++ drivers/acpi/arm64/Makefile | 1 + drivers/acpi/arm64/init.c | 2 + drivers/acpi/arm64/init.h | 1 + drivers/acpi/arm64/tlbid.c | 107 +++++++++ drivers/acpi/tables.c | 9 + include/acpi/actbl2.h | 29 +++ include/linux/acpi.h | 1 + 19 files changed, 718 insertions(+), 6 deletions(-) create mode 100644 arch/arm64/include/asm/tlbidomain.h create mode 100644 arch/arm64/mm/tlbidomain.c create mode 100644 drivers/acpi/arm64/tlbid.c -- 2.43.0

2 9

[PATCH OLK-6.6 0/2] CVE-2026-68396
by Zhou Minqiang 14 Sep '26

14 Sep '26

CVE-2026-68396 Zhou Minqiang (2): scsi: core: wake eh reliably when using scsi_schedule_eh scsi: core: Fix kabi breakage of struct Scsi_Host drivers/scsi/hosts.c | 13 +++++++++++++ drivers/scsi/scsi_error.c | 24 +++++++++++++++++++++++- drivers/scsi/scsi_priv.h | 1 + include/scsi/scsi_host.h | 7 ++++++- 4 files changed, 43 insertions(+), 2 deletions(-) -- 2.52.0

2 3

[PATCH OLK-6.6] scsi: core: pair EH runtime PM get and put
by Zhou Minqiang 14 Sep '26

14 Sep '26

mainline inclusion from mainline-v7.2 commit 872f486259ae0bc6b73ca4735a15d013241f73e9 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18399 CVE: CVE-2026-74754 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 872f486259ae0bc6b73ca4735a15d013241f73e9 ] shost->eh_noresume is currently consulted twice in one error handling iteration: once before scsi_autopm_get_host() and once again before scsi_autopm_put_host(). That is racy when a PM-triggered error path flips shost->eh_noresume while the SCSI EH thread is still running. The problem flow looks like this: PM path ufshcd_set_dev_pwr_mode() shost->eh_noresume = 1 ufshcd_execute_start_stop <-- trigger EH ... shost->eh_noresume = 0 EH path scsi_error_handler() if (!shost->eh_noresume) scsi_autopm_get_host() <-- skipped ... if (!shost->eh_noresume) scsi_autopm_put_host() <-- executed later In that case one EH iteration can skip autoresume on entry and still drop a runtime PM reference on exit. That leaves an unmatched runtime PM put and can trigger a runtime PM usage count underflow. Fix this by making eh_noresume a regular bool so it can be accessed with READ_ONCE() and WRITE_ONCE(). Snapshot it once per EH iteration and use that snapshot for both runtime PM get and put decisions. Fixes: ae0751ffc77e ("[SCSI] add flag to skip the runtime PM calls on the host") Signed-off-by: Hongjie Fang <hongjiefang(a)asrmicro.com> Reviewed-by: Bart Van Assche <bvanassche(a)acm.org> Reviewed-by: Peter Wang <peter.wang(a)mediatek.com> Link: https://patch.msgid.link/20260729111614.2407559-1-hongjiefang@asrmicro.com Signed-off-by: Martin K. Petersen (Oracle) <mkp(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/scsi/scsi_error.c drivers/ufs/core/ufshcd.c [ctx conflicts] Signed-off-by: Zhou Minqiang <zhouminqiang2(a)huawei.com> --- drivers/scsi/scsi_error.c | 9 +++++++-- drivers/ufs/core/ufshcd.c | 4 ++++ 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c index 9b0ff9fad104..18474e441b87 100644 --- a/drivers/scsi/scsi_error.c +++ b/drivers/scsi/scsi_error.c @@ -2293,6 +2293,8 @@ static void scsi_unjam_host(struct Scsi_Host *shost) int scsi_error_handler(void *data) { struct Scsi_Host *shost = data; + bool eh_noresume; + unsigned long flags; /* * We use TASK_INTERRUPTIBLE so that the thread is not @@ -2334,7 +2336,10 @@ int scsi_error_handler(void *data) * what we need to do to get it up and online again (if we can). * If we fail, we end up taking the thing offline. */ - if (!shost->eh_noresume && scsi_autopm_get_host(shost) != 0) { + spin_lock_irqsave(shost->host_lock, flags); + eh_noresume = shost->eh_noresume; + spin_unlock_irqrestore(shost->host_lock, flags); + if (!eh_noresume && scsi_autopm_get_host(shost) != 0) { SCSI_LOG_ERROR_RECOVERY(1, shost_printk(KERN_ERR, shost, "scsi_eh_%d: unable to autoresume\n", @@ -2358,7 +2363,7 @@ int scsi_error_handler(void *data) * which are still online. */ scsi_restart_operations(shost); - if (!shost->eh_noresume) + if (!eh_noresume) scsi_autopm_put_host(shost); } __set_current_state(TASK_RUNNING); diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c index 06f2626063a1..724e0225c932 100644 --- a/drivers/ufs/core/ufshcd.c +++ b/drivers/ufs/core/ufshcd.c @@ -9613,7 +9613,9 @@ static int ufshcd_set_dev_pwr_mode(struct ufs_hba *hba, * we are functional while we are here, skip host resume in error * handling context. */ + spin_lock_irqsave(hba->host->host_lock, flags); hba->host->eh_noresume = 1; + spin_unlock_irqrestore(hba->host->host_lock, flags); /* * Current function would be generally called from the power management @@ -9643,7 +9645,9 @@ static int ufshcd_set_dev_pwr_mode(struct ufs_hba *hba, } scsi_device_put(sdp); + spin_lock_irqsave(hba->host->host_lock, flags); hba->host->eh_noresume = 0; + spin_unlock_irqrestore(hba->host->host_lock, flags); return ret; } -- 2.52.0

2 1

[PATCH OLK-6.6 v2] md/raid1,raid10: fix bio accounting for split md cloned bios
by Zhou Minqiang 14 Sep '26

14 Sep '26

mainline inclusion from mainline-v7.2-rc1 commit ba976e3501111d11c550848b3b7341a73035f582 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17965 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Use md_cloned_bio() to control bio accounting instead of relying on r1bio_existed in raid1 or the io_accounting flag in raid10. The previous logic does not reliably reflect whether a bio is an md cloned bio. When a failed bio is split and resubmitted via bio_submit_split_bioset() on the error path, this can lead to either double accounting for md cloned bios, or missing accounting for bios returned from bio_submit_split_bioset() Fix this by using md_cloned_bio() to detect md cloned bios and skip accounting accordingly. Fixes: bb2a9acefaf9 ("md/raid1: switch to use md_account_bio() for io accounting") Fixes: 820455238366 ("md/raid10: switch to use md_account_bio() for io accounting") Signed-off-by: Abd-Alrhman Masalkhi <abd.masalkhi(a)gmail.com> Reviewed-by: Xiao Ni <xiao(a)kernel.org> Link: https://patch.msgid.link/20260501114652.590037-4-abd.masalkhi@gmail.com Signed-off-by: Yu Kuai <yukuai(a)fygo.io> Signed-off-by: Zhou Minqiang <zhouminqiang2(a)huawei.com> --- drivers/md/raid1.c | 2 +- drivers/md/raid10.c | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c index a4662d5077ba..80c1802c26e1 100644 --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -1412,7 +1412,7 @@ static void raid1_read_request(struct mddev *mddev, struct bio *bio, } r1_bio->read_disk = rdisk; - if (!r1bio_existed) { + if (likely(!md_cloned_bio(mddev, bio))) { md_account_bio(mddev, &bio); r1_bio->master_bio = bio; } diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c index 316b6c96d413..e8ce8cdd7fce 100644 --- a/drivers/md/raid10.c +++ b/drivers/md/raid10.c @@ -1140,7 +1140,7 @@ static bool regular_request_wait(struct mddev *mddev, struct r10conf *conf, } static void raid10_read_request(struct mddev *mddev, struct bio *bio, - struct r10bio *r10_bio, bool io_accounting) + struct r10bio *r10_bio) { struct r10conf *conf = mddev->private; struct bio *read_bio; @@ -1218,7 +1218,7 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio, } slot = r10_bio->read_slot; - if (io_accounting) { + if (likely(!md_cloned_bio(mddev, bio))) { md_account_bio(mddev, &bio); r10_bio->master_bio = bio; } @@ -1514,7 +1514,7 @@ static bool __make_request(struct mddev *mddev, struct bio *bio, int sectors) ret = true; if (bio_data_dir(bio) == READ) - raid10_read_request(mddev, bio, r10_bio, true); + raid10_read_request(mddev, bio, r10_bio); else ret = raid10_write_request(mddev, bio, r10_bio); @@ -2839,7 +2839,7 @@ static void handle_read_error(struct mddev *mddev, struct r10bio *r10_bio) rdev_dec_pending(rdev, mddev); r10_bio->state = 0; - raid10_read_request(mddev, r10_bio->master_bio, r10_bio, false); + raid10_read_request(mddev, r10_bio->master_bio, r10_bio); /* * allow_barrier after re-submit to ensure no sync io * can be issued while regular io pending. -- 2.52.0

2 1

[PATCH OLK-5.10] ipv4: validate IPV4_DEVCONF attributes properly
by JiangJieHua 14 Sep '26

14 Sep '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9803 -------------------------------- syzbot reported a UBSAN undefined behavior issue in vif_delete(): UBSAN: Undefined behaviour in net/ipv4/ipmr.c:720:43 signed integer overflow: -2147483648 - 1 cannot be represented in type 'int' MC_FORWARDING is a read-only sysctl (0444), but netlink RTM_SETLINK allows userspace to modify it via inet_validate_link_af() without permission checks, bypassing the read-only restriction. A corrupted counter can lead to inconsistent multicast routing state. Fix by rejecting IPV4_DEVCONF_MC_FORWARDING in inet_validate_link_af() with -EINVAL. Fixes: 9f0f7272ac95 ("ipv4: AF_INET link address family") Signed-off-by: JiangJieHua <jiangjiehua1(a)huawei.com> --- net/ipv4/devinet.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c index 9ac7d47d27b81..6822408e8f8d2 100644 --- a/net/ipv4/devinet.c +++ b/net/ipv4/devinet.c @@ -1987,6 +1987,9 @@ static int inet_validate_link_af(const struct net_device *dev, if (cfgid <= 0 || cfgid > IPV4_DEVCONF_MAX) return -EINVAL; + + if (cfgid == IPV4_DEVCONF_MC_FORWARDING) + return -EINVAL; } } -- 2.33.8

2 1

[PATCH OLK-6.6] ipv4: validate IPV4_DEVCONF attributes properly
by JiangJieHua 14 Sep '26

14 Sep '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9803 -------------------------------- syzbot reported a UBSAN undefined behavior issue in vif_delete(): UBSAN: Undefined behaviour in net/ipv4/ipmr.c:720:43 signed integer overflow: -2147483648 - 1 cannot be represented in type 'int' MC_FORWARDING is a read-only sysctl (0444), but netlink RTM_SETLINK allows userspace to modify it via inet_validate_link_af() without permission checks, bypassing the read-only restriction. A corrupted counter can lead to inconsistent multicast routing state. Fix by rejecting IPV4_DEVCONF_MC_FORWARDING in inet_validate_link_af() with -EINVAL. Fixes: 9f0f7272ac95 ("ipv4: AF_INET link address family") Signed-off-by: JiangJieHua <jiangjiehua1(a)huawei.com> --- net/ipv4/devinet.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c index 798497c8b1923..9b42ef2cc4ae2 100644 --- a/net/ipv4/devinet.c +++ b/net/ipv4/devinet.c @@ -2028,6 +2028,9 @@ static int inet_validate_link_af(const struct net_device *dev, if (cfgid <= 0 || cfgid > IPV4_DEVCONF_MAX) return -EINVAL; + + if (cfgid == IPV4_DEVCONF_MC_FORWARDING) + return -EINVAL; } } -- 2.33.8

2 1

[PATCH OLK-6.6] tracing/probes: Fix use-after-free on field name/type of events with multiple probes
by Tengda Wu 14 Sep '26

14 Sep '26

From: Henry Martin <bsdhenrymartin(a)gmail.com> mainline inclusion from mainline-v7.3-rc2 commit 86b7a239ec6b14a7544200ede85474c6f5526049 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9956 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The fields of a probe-based dynamic event (kprobe, uprobe, eprobe and fprobe events) are created in traceprobe_define_arg_fields() by handing the probe_arg name/type strings to trace_define_field(), which only stores the pointers without copying. Those strings are owned by the trace_probe and are freed when that probe is removed. An event can have several probes attached. The field list is defined only once, by the first probe that registers the event, but it is kept alive by any surviving sibling probe. Deleting just that first probe by symbol - # primary A: fields are defined from A's args echo 'p:kprobes/ev vfs_read a1=$arg1' > kprobe_events # append B: shares A's event call echo 'p:kprobes/ev vfs_write a1=$arg1' >> kprobe_events # delete only A (matched by symbol), B survives echo '-:kprobes/ev vfs_read' >> kprobe_events frees A's args (trace_probe_cleanup() -> traceprobe_free_probe_arg()), but trace_probe_unlink() keeps the trace_probe_event because the probe list is not empty. The event call stays registered via B while its fields now reference freed memory. Any field lookup then reads it, e.g. echo 'a1 == 1' > events/kprobes/ev/filter BUG: KASAN: slab-use-after-free in strcmp+0xa7/0xb0 Call Trace: strcmp trace_find_event_field parse_pred process_preds create_filter apply_event_filter event_filter_write field->name references parg->name (kstrdup'd, freed with the probe) and, for array arguments, field->type references parg->fmt (kmalloc'd, freed with the probe) - the scalar type otherwise points at the static fmttype rodata, which is safe. Have traceprobe_define_arg_fields() duplicate the name and type strings and anchor the copies on the trace_probe_event, which embeds the event call and outlives every individual probe; trace_probe_event_free() releases them. The reproducer above triggers reliably; the field lookup and the delete both run under event_mutex, so this is a dangling reference after removal rather than a race. The issue was found by the autokbug dynamic kernel fuzzer at Tencent Yunding Lab. Link: https://lore.kernel.org/all/20260826030009.1855331-1-bsdhenrymartin@gmail.c… Fixes: ca89bc071d5e4 ("tracing/kprobe: Add multi-probe per event support") Signed-off-by: Henry Martin <bsdhenrymartin(a)gmail.com> Signed-off-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/trace/trace_probe.c | 48 +++++++++++++++++++++++++++++++++++++- kernel/trace/trace_probe.h | 2 ++ 2 files changed, 49 insertions(+), 1 deletion(-) diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c index 066e154b91ee..1c05937d2ee0 100644 --- a/kernel/trace/trace_probe.c +++ b/kernel/trace/trace_probe.c @@ -1782,19 +1782,60 @@ int traceprobe_set_print_fmt(struct trace_probe *tp, enum probe_print_type ptype int traceprobe_define_arg_fields(struct trace_event_call *event_call, size_t offset, struct trace_probe *tp) { + struct trace_probe_event *tpe = trace_probe_event_from_call(event_call); int ret, i; + /* + * A field created by trace_define_field() only stores the name and + * type pointers, it does not copy the strings. Here they point into + * the probe_arg of @tp, which is freed when @tp is removed. For an + * event with multiple probes attached, the field list is defined + * once by the first probe but kept alive by the surviving siblings, + * so removing that first probe would leave the fields referencing + * freed memory. Duplicate the strings and anchor the copies on the + * trace_probe_event, which lives as long as the field list itself. + * + * event_define_fields() ignores the return value of this hook, so + * if a previous attempt failed before creating any field, it may + * call here again. Release duplicates left behind by such an + * attempt before starting over. + */ + for (i = 0; i < tpe->nr_field_strings; i++) + kfree(tpe->field_strings[i]); + kfree(tpe->field_strings); + tpe->field_strings = NULL; + tpe->nr_field_strings = 0; + + if (tp->nr_args) { + tpe->field_strings = kcalloc(tp->nr_args * 2, sizeof(char *), + GFP_KERNEL); + if (!tpe->field_strings) + return -ENOMEM; + } + /* Set argument names as fields */ for (i = 0; i < tp->nr_args; i++) { struct probe_arg *parg = &tp->args[i]; const char *fmt = parg->type->fmttype; int size = parg->type->size; + char *name, *type; if (parg->fmt) fmt = parg->fmt; if (parg->count) size *= parg->count; - ret = trace_define_field(event_call, fmt, parg->name, + + name = kstrdup(parg->name, GFP_KERNEL); + type = kstrdup(fmt, GFP_KERNEL); + if (!name || !type) { + kfree(name); + kfree(type); + return -ENOMEM; + } + tpe->field_strings[tpe->nr_field_strings++] = name; + tpe->field_strings[tpe->nr_field_strings++] = type; + + ret = trace_define_field(event_call, type, name, offset + parg->offset, size, parg->type->is_signed, FILTER_OTHER); @@ -1806,6 +1847,11 @@ int traceprobe_define_arg_fields(struct trace_event_call *event_call, static void trace_probe_event_free(struct trace_probe_event *tpe) { + int i; + + for (i = 0; i < tpe->nr_field_strings; i++) + kfree(tpe->field_strings[i]); + kfree(tpe->field_strings); kfree(tpe->class.system); kfree(tpe->call.name); kfree(tpe->call.print_fmt); diff --git a/kernel/trace/trace_probe.h b/kernel/trace/trace_probe.h index e8efa55b3a18..47982338bd42 100644 --- a/kernel/trace/trace_probe.h +++ b/kernel/trace/trace_probe.h @@ -246,6 +246,8 @@ struct trace_probe_event { struct trace_event_call call; struct list_head files; struct list_head probes; + char **field_strings; + int nr_field_strings; struct trace_uprobe_filter filter[]; }; -- 2.34.1

2 1

[PATCH OLK-6.6] tracing: Fix crash passing ERR_PTR to kthread_stop()
by Tengda Wu 14 Sep '26

14 Sep '26

From: Hui Su <sh_def(a)163.com> mainline inclusion from mainline-v7.3-rc1 commit 649bc7df3e5d7be6f7996a95084037dbf3cad1e5 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18775 CVE: CVE-2026-89749 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- event_test_stuff() calls kthread_run() and unconditionally passes the returned task_struct pointer to kthread_stop(). kthread_run() returns an error pointer such as ERR_PTR(-ENOMEM) when kthread creation fails, for example under memory pressure during the boot-time event self-test. kthread_stop() then dereferences the invalid pointer, crashing the kernel. Check the result of kthread_run() before passing it to kthread_stop(). Use WARN_ON() so that a failure to create the self-test thread does not go unnoticed, matching the ring-buffer self-test fix in commit 91542863abad ("ring-buffer: Fix crash passing ERR_PTR to kthread_stop()"). Cc: stable(a)vger.kernel.org Fixes: e6187007d6c3 ("tracing/events: add startup tests for events") Link: https://patch.msgid.link/20260817120642.668375-3-sh_def@163.com Signed-off-by: Hui Su <sh_def(a)163.com> Signed-off-by: Steven Rostedt <rostedt(a)goodmis.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/trace/trace_events.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c index 7326cfafcc23..48a29993b95d 100644 --- a/kernel/trace/trace_events.c +++ b/kernel/trace/trace_events.c @@ -4291,6 +4291,8 @@ static __init void event_test_stuff(void) struct task_struct *test_thread; test_thread = kthread_run(event_test_thread, NULL, "test-events"); + if (WARN_ON(IS_ERR(test_thread))) + return; msleep(1); kthread_stop(test_thread); } -- 2.34.1

2 1

[PATCH OLK-6.6] tracing: Fix use-after-free with same-name named triggers
by Tengda Wu 14 Sep '26

14 Sep '26

From: Hui Su <sh_def(a)163.com> mainline inclusion from mainline-v7.3-rc1 commit a7318172aa332a161fb9618286e64454c827f8fd category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18798 CVE: CVE-2026-89746 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When two hist triggers on different events are registered with the same name=, the second one reuses the first as named_data. Both are added to tr->hist_vars by save_hist_vars() during event_hist_trigger_parse(), because save_hist_vars() is called before event_trigger_register() while the named reuse is only detected later, in hist_register_trigger(). In the named-data branch hist_register_trigger() then frees the second histogram's hist_data via destroy_hist_data(), but never removes its tr->hist_vars list entry, leaving a dangling pointer and leaking the trace_array reference it holds. A later hist trigger that references a variable makes find_var_file() walk tr->hist_vars and dereference the freed hist_data. The bug is reproducible from userspace by writing three hist triggers to tracefs: cd /sys/kernel/tracing echo 'hist:keys=common_pid:x=common_pid:name=mh' > events/sched/sched_switch/trigger echo 'hist:keys=common_pid:x=common_pid:name=mh' > events/sched/sched_process_fork/trigger echo 'hist:keys=common_pid:vals=$x' > events/sched/sched_process_exit/trigger The third write panics the kernel: BUG: KASAN: slab-use-after-free in find_var_file.part.0+0x272/0x290 Read of size 8 at addr ffff888001f8a0e0 by task sh/1 CPU: 1 UID: 0 PID: 1 Comm: sh Tainted: G D N Call Trace: find_var_file.part.0 find_event_var parse_atom parse_expr __create_val_field event_hist_trigger_parse trigger_process_regex event_trigger_write vfs_write ksys_write do_syscall_64 entry_SYSCALL_64_after_hwframe Allocated by task 1: event_hist_trigger_parse Freed by task 1: hist_register_trigger+0x618/0xa30 event_hist_trigger_parse The buggy address belongs to freed 2048-byte region Oops: general protection fault ... RIP: find_var_file.part.0 Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b Fix by removing the hist_data from tr->hist_vars and releasing the trace_array reference in the named-data branch of hist_register_trigger() before freeing the hist_data. Cc: stable(a)vger.kernel.org Fixes: 6f86bdeab633 ("tracing: Fix bad hist from corrupting named_triggers list") Link: https://patch.msgid.link/20260816100427.33642-3-sh_def@163.com Signed-off-by: Hui Su <sh_def(a)163.com> Signed-off-by: Steven Rostedt <rostedt(a)goodmis.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/trace/trace_events_hist.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c index a5fe1776d2a9..40e81642c75d 100644 --- a/kernel/trace/trace_events_hist.c +++ b/kernel/trace/trace_events_hist.c @@ -6421,8 +6421,10 @@ static int hist_register_trigger(char *glob, tracing_set_filter_buffering(file->tr, true); } - if (named_data) + if (named_data) { + remove_hist_vars(hist_data); destroy_hist_data(hist_data); + } out: return ret; } -- 2.34.1

2 1

[PATCH OLK-6.6] eventfs: Initialize ei->children and ei->list in init_ei()
by Tengda Wu 14 Sep '26

14 Sep '26

From: Deepanshu Kartikey <kartikey406(a)gmail.com> mainline inclusion from mainline-v7.3-rc1 commit 1704aaaf5d22bc765c168402350d191e24e245bc category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18805 CVE: CVE-2026-89618 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- eventfs_create_dir() allocates the eventfs_inode and initializes it with init_ei(). But this does not initialize the eventfs_inode list_heads. If the eventfs_create_dir() fails due to memory pressure, it will call free_ei() before it initialized the lists, and that checks to make sure the eventfs_inode has no children. But because the list wasn't initialized, it will give a false warning. Fix it by moving the list initialization into init_ei(). Cc: stable(a)vger.kernel.org Fixes: 5790b1fb3d67 ("eventfs: Remove eventfs_file and just use eventfs_inode") Reported-by: syzbot+3ef80b4ed02226d04a06(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3ef80b4ed02226d04a06 Link: https://patch.msgid.link/20260824144653.54044-1-kartikey406@gmail.com Signed-off-by: Deepanshu Kartikey <kartikey406(a)gmail.com> [ Rewrote change log ] Signed-off-by: Steven Rostedt <rostedt(a)goodmis.org> Conflicts: fs/tracefs/event_inode.c [Context conflict] Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- fs/tracefs/event_inode.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/fs/tracefs/event_inode.c b/fs/tracefs/event_inode.c index 0a004263a769..8efb9c467b7d 100644 --- a/fs/tracefs/event_inode.c +++ b/fs/tracefs/event_inode.c @@ -521,6 +521,8 @@ static inline struct eventfs_inode *init_ei(struct eventfs_inode *ei, const char if (!ei->name) return NULL; kref_init(&ei->kref); + INIT_LIST_HEAD(&ei->children); + INIT_LIST_HEAD(&ei->list); return ei; } @@ -823,8 +825,6 @@ struct eventfs_inode *eventfs_create_dir(const char *name, struct eventfs_inode ei->entries = entries; ei->nr_entries = size; ei->data = data; - INIT_LIST_HEAD(&ei->children); - INIT_LIST_HEAD(&ei->list); mutex_lock(&eventfs_mutex); if (!parent->is_freed) @@ -900,9 +900,6 @@ struct eventfs_inode *eventfs_create_events_dir(const char *name, struct dentry */ ei->attr.mode |= EVENTFS_SAVE_UID | EVENTFS_SAVE_GID; - INIT_LIST_HEAD(&ei->children); - INIT_LIST_HEAD(&ei->list); - ti = get_tracefs(inode); ti->flags |= TRACEFS_EVENT_INODE; ti->private = ei; -- 2.34.1

2 1

[PATCH OLK-6.6] bpf: Reject key-less BTF for hash maps
by Pu Lehui 14 Sep '26

14 Sep '26

From: Jiayuan Chen <jiayuan.chen(a)linux.dev> mainline inclusion from mainline-v7.3-rc2 commit 0895a0c0734703be5532f3883c42db95615fd98b category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9949 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- map_check_btf() allows a key-less BTF (btf_key_type_id == 0) only for maps that have a ->map_check_btf callback, and leaves the actual decision to that callback. Hash maps used to have no ->map_check_btf, so a key-less BTF was rejected outright. That changed when htab and rhtab gained a ->map_check_btf to register a dtor - htab in commit 1df97a7453ee ("bpf: Register dtor for freeing special fields") and rhtab in commit 6905f8601298 ("bpf: Allow special fields in resizable hashtab"). Neither looks at the key, so a key-less hash map now passes map_check_btf() and gets created. Reading it back through bpffs feeds the key type_id 0 into btf_type_seq_show(); btf_type_by_id() returns the void type, kind_ops[BTF_KIND_UNKN] is NULL, and btf_type_show() dereferences it: RIP: 0010:btf_type_show+0x223/0x2e0 kernel/bpf/btf.c:8232 RSP: 0018:ffffc9000399f868 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000028 RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 R10: ffffc9000399f970 R11: 0000000000000001 R12: ffffffff9b96b140 R13: ffffc9000399f8e0 R14: ffff88803d393c00 R15: 0000000000000003 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000000000 CR3: 000000003d213000 CR4: 0000000000352ef0 DR0: 0000000039ae8f55 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Call Trace: <TASK> btf_type_seq_show_flags+0xca/0x120 kernel/bpf/btf.c:8250 htab_map_seq_show_elem+0x12e/0x350 kernel/bpf/hashtab.c:1669 map_seq_show+0x13d/0x1e0 kernel/bpf/inode.c:293 traverse.part.0.constprop.0+0x107/0x650 fs/seq_file.c:112 traverse fs/seq_file.c:99 [inline] seq_read_iter+0x93f/0x1270 fs/seq_file.c:196 seq_read+0x344/0x4d0 fs/seq_file.c:163 vfs_read+0x1e4/0xb40 fs/read_write.c:572 ksys_pread64 fs/read_write.c:764 [inline] __do_sys_pread64 fs/read_write.c:772 [inline] __se_sys_pread64 fs/read_write.c:769 [inline] __x64_sys_pread64+0x1eb/0x250 fs/read_write.c:769 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f Reject a key-less BTF in htab_map_check_btf() and rhtab_map_check_btf(), restoring the previous behavior. Fixes: 1df97a7453ee ("bpf: Register dtor for freeing special fields") Fixes: 6905f8601298 ("bpf: Allow special fields in resizable hashtab") Reported-by: syzbot+37b56485bbbf90ad8489(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/6a8f4e88.27659fcc.2ceef7.0008.GAE@google.com/T/ Signed-off-by: Jiayuan Chen <jiayuan.chen(a)linux.dev> Acked-by: Ihor Solodrai <ihor.solodrai(a)linux.dev> Link: https://lore.kernel.org/r/20260901104924.346187-2-jiayuan.chen@linux.dev Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Conflicts: kernel/bpf/hashtab.c [not merged commit 6905f8601298] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/hashtab.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c index 9221625c256a..8aafe8db5883 100644 --- a/kernel/bpf/hashtab.c +++ b/kernel/bpf/hashtab.c @@ -486,6 +486,9 @@ static int htab_map_check_btf(const struct bpf_map *map, const struct btf *btf, { struct bpf_htab *htab = container_of(map, struct bpf_htab, map); + if (btf_type_is_void(key_type)) + return -EINVAL; + if (htab_is_prealloc(htab)) return 0; /* -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] [Backport] serial: amba-pl011: synchronize DMA teardown
by Cai Xinchen 14 Sep '26

14 Sep '26

From: Fan Wu <fanwu01(a)zju.edu.cn> stable inclusion from stable-v5.10.267 commit a38fae9d212e2d3ed5e9ec0ef773f8c0a27fb76e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18582 CVE: CVE-2026-80737 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------ [ Upstream commit 440915499231e9db1c361aa45bb702e8fd3b4a32 ] dmaengine_terminate_all() does not wait for a running callback, so the TX callback can still touch the TX buffer after it is freed. The RX poll timer reads the RX buffers without the port lock. Switch to dmaengine_terminate_sync() and delete the RX timer before freeing the buffers. Fixes: ead76f329f77 ("ARM: 6763/1: pl011: add optional RX DMA to PL011 v2") Cc: stable <stable(a)kernel.org> Assisted-by: Codex:gpt-5.6 Signed-off-by: Fan Wu <fanwu01(a)zju.edu.cn> Link: https://patch.msgid.link/20260731085915.326775-4-fanwu01@zju.edu.cn Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> [ changed upstream's `timer_delete_sync()` deletion to match this tree's `del_timer_sync()` spelling at the old call site ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/tty/serial/amba-pl011.c [The commit 9b13df3fb64ee95e2397585404e442afee2c7d4f ("timers: Rename del_timer_sync() to timer_delete_sync()") is not merged. Use del_timer_sync in this patch.] Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- drivers/tty/serial/amba-pl011.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c index c987db50757c..d229f36b929d 100644 --- a/drivers/tty/serial/amba-pl011.c +++ b/drivers/tty/serial/amba-pl011.c @@ -1206,7 +1206,7 @@ static void pl011_dma_shutdown(struct uart_amba_port *uap) if (uap->using_tx_dma) { /* In theory, this should already be done by pl011_dma_flush_buffer */ - dmaengine_terminate_all(uap->dmatx.chan); + dmaengine_terminate_sync(uap->dmatx.chan); if (uap->dmatx.queued) { dma_unmap_sg(uap->dmatx.chan->device->dev, &uap->dmatx.sg, 1, DMA_TO_DEVICE); @@ -1218,12 +1218,12 @@ static void pl011_dma_shutdown(struct uart_amba_port *uap) } if (uap->using_rx_dma) { - dmaengine_terminate_all(uap->dmarx.chan); + if (uap->dmarx.poll_rate) + del_timer_sync(&uap->dmarx.timer); + dmaengine_terminate_sync(uap->dmarx.chan); /* Clean up the RX DMA */ pl011_sgbuf_free(uap->dmarx.chan, &uap->dmarx.sgbuf_a, DMA_FROM_DEVICE); pl011_sgbuf_free(uap->dmarx.chan, &uap->dmarx.sgbuf_b, DMA_FROM_DEVICE); - if (uap->dmarx.poll_rate) - del_timer_sync(&uap->dmarx.timer); uap->using_rx_dma = false; } } -- 2.34.1

2 1

[PATCH OLK-6.6 00/32] arm_mpam: Introduce Narrow-PARTID feature
by Zeng Heng 14 Sep '26

14 Sep '26

Background ========== On x86, the resctrl allows creating up to num_rmids monitoring groups under parent control group. However, ARM64 MPAM is currently limited by the PMG (Performance Monitoring Group) count, which is typically much smaller than the theoretical RMID limit. This creates a significant scalability gap: users expecting fine-grained per-process or per-thread monitoring quickly exhaust the PMG space, even when plenty of reqPARTIDs remain available. The Narrow-PARTID feature, defined in the ARM MPAM architecture, addresses this by associating reqPARTIDs with intPARTIDs through a programmable many-to-one mapping. This allows the kernel to present more logical monitoring contexts. Design Overview =============== The implementation extends the RMID encoding to carry reqPARTID information: RMID = reqPARTID * NUM_PMG + PMG In this patchset, a monitoring group is uniquely identified by the combination of reqPARTID and PMG. The closid is represented by intPARTID, which is exactly the original PARTID. For systems with homogeneous MSCs (all supporting Narrow-PARTID), the driver exposes the full reqPARTID range directly. For heterogeneous systems where some MSCs lack Narrow-PARTID support, the driver utilizes PARTIDs beyond the intPARTID range as reqPARTIDs to expand monitoring capacity. The sole exception is when MBA MSCs lack Narrow-PARTID support, their percentage-based control mechanism prevents the use of PARTIDs as reqPARTIDs. Capacity Improvements ===================== -------------------------------------------------------------------------- The maximum | Sub-monitoring groups | System-wide number of | under a control group | monitoring groups -------------------------------------------------------------------------- Without | | reqPARTID | PMG | intPARTID * PMG -------------------------------------------------------------------------- reqPARTID | | static allocation | (reqPARTID // intPARTID) * PMG | reqPARTID * PMG -------------------------------------------------------------------------- reqPARTID | | dynamic allocation | (reqPARTID − intPARTID + 1) * PMG | reqPARTID * PMG -------------------------------------------------------------------------- Under MPAM, the number of reqPARTID is always greater than or equal to intPARTID. Dave Martin (1): arm_mpam: Set INTERNAL as needed when setting MSC controls James Morse (1): debugfs: Add helpers for creating cpumask entries in debugfs Zeng Heng (30): arm_mpam: Add intPARTID and reqPARTID support for narrow PARTID feature arm_mpam: Refactor rmid to reqPARTID/PMG mapping arm_mpam: Propagate control group config to sub-monitoring groups fs/resctrl: Add rmid_entry state helpers arm_mpam: Implement dynamic reqPARTID allocation for monitoring groups fs/resctrl: Wire up rmid expansion and reclaim functions arm64/mpam: Add mpam_sync_config() for dynamic rmid expansion fs/resctrl: Prevent rmid parsing errors by flushing limbo on umount arm_mpam: Disable reqPARTID expansion when Narrow-PARTID is unavailable arm_mpam: Add MBWU counter scaling support fs/resctrl: Fix incorrect closid propagation during monitor group reparenting arm64/mpam: Fix wd boundary check and GENMASK range in percent-mbw conversion arm64/mpam: Add HISI_HIP13 support fs/resctrl: Introduce per-resource MBM enable check fs/resctrl: Add arch-specific MBM overflow setup helpers arm64/mpam: Add selective L2 MBM overflow checking arm64/mpam: Add MBM overflow handling for HIP13 arm64/mpam: Allow zero-bit CPBM for L2 cache arm64/mpam: Adapt SMMU IOMMU interface for Narrow PARTID support arm64/mpam: Add MBOPT (Memory Bandwidth Optimal) feature resctrl: Remove unused mbm_core field from rdt_domain fs/resctrl: Introduce resctrl_arch_mbm_update() for arch-specific MBM event handling arm64/mpam: Add MBM_TOTAL_EVENT configurability check arm64/mpam: Add debugfs entries to show the MSC/RIS the driver discovered iommu/arm-smmu-v3: Add debug logging for MPAM STE configuration Revert "fs/resctrl: Re-allocate rmid for the monitor when migrating across control groups" fs/resctrl: Fix iommu_group and kobject reference leaks arm_mpam: Fix NULL pointer dereference after freeing comp->cfg arm_mpam: Wait for SRCU grace period before destroying RIS arm_mpam: Fix percpu memory leak in __setup_ppi() error path arch/arm64/include/asm/mpam.h | 17 +- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 3 + drivers/platform/mpam/mpam_devices.c | 271 ++++++++- drivers/platform/mpam/mpam_internal.h | 21 +- drivers/platform/mpam/mpam_resctrl.c | 617 ++++++++++++++++---- fs/debugfs/file.c | 64 ++ fs/resctrl/internal.h | 1 - fs/resctrl/monitor.c | 123 ++-- fs/resctrl/rdtgroup.c | 132 +++-- include/linux/arm_mpam.h | 20 +- include/linux/debugfs.h | 6 + include/linux/resctrl.h | 35 +- include/linux/resctrl_types.h | 2 + 13 files changed, 1031 insertions(+), 281 deletions(-) -- 2.43.0

2 33

[PATCH OLK-6.6] scsi: leapraid: update driver to v2.00.01.10
by haodongdong 13 Sep '26

13 Sep '26

LeapIO inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/9946 ------------------------------------------ leapraid driver changes from v2.00.01.02 to v2.00.01.10. This update includes: - AI-assisted code inspection rollout and follow-up bug fixes - Clang, Sparse, and Smatch issue cleanup - recovery-wait and nested hard-reset stabilization - SCSI EH, task-management, and AER recovery fixes - timeout, IOC-fault, and I/O diagnostic improvements - MSI-X/IRQ affinity and sparse-CPU mapping fixes - SAS topology, event bitmap, and VPHY handling fixes - async-event and SMP payload validation hardening - ioctl and passthrough bounds-checking cleanup - adapter-removal and firmware-event race fixes - firmware-log mmap lifetime and reference-count fixes - active-command teardown and IRQ synchronization - probe rollback and host-memory cleanup hardening - config-page stack usage reduction - SMART polling and NCQ sysfs alignment - drive matching and adapter metadata cleanup Signed-off-by: haodongdong <doubled(a)leap-io.com> --- drivers/scsi/leapraid/leapraid.h | 37 +- drivers/scsi/leapraid/leapraid_app.c | 169 ++- drivers/scsi/leapraid/leapraid_func.c | 1126 +++++++------------- drivers/scsi/leapraid/leapraid_func.h | 130 +-- drivers/scsi/leapraid/leapraid_os.c | 276 ++--- drivers/scsi/leapraid/leapraid_transport.c | 40 +- 6 files changed, 693 insertions(+), 1085 deletions(-) diff --git a/drivers/scsi/leapraid/leapraid.h b/drivers/scsi/leapraid/leapraid.h index 2a99417143ad..c2d28359be5b 100644 --- a/drivers/scsi/leapraid/leapraid.h +++ b/drivers/scsi/leapraid/leapraid.h @@ -27,8 +27,6 @@ /* Maximum number of retries waiting for doorbell to become operational. */ #define LEAPRAID_DB_WAIT_OP_SHORT 10 #define LEAPRAID_DB_WAIT_OP_LONG 200 -/* Sleep interval (in seconds) between doorbell polls. */ -#define LEAPRAID_DB_POLL_INTERVAL_S 1 /* Maximum number of retries waiting for host to end recovery. */ #define LEAPRAID_WAIT_SHOST_RECOVERY 400 @@ -43,7 +41,6 @@ /* The number of debug register. */ #define LEAPRAID_DEBUGLOG_SZ_MAX 16 -#define LEAPRAID_DEBUGLOG_DWORDS_PER_LINE 4 /* Reply post host register definitions. */ #define REP_POST_HOST_IDX_REG_CNT 16 @@ -180,8 +177,6 @@ #define LEAPRAID_CFG_PAGE_NUM_DEV0 0x0 /* SAS device page 0 flags. */ -#define LEAPRAID_SAS_DEV_P0_FLG_FP_CAP 0x2000 -#define LEAPRAID_SAS_DEV_P0_FLG_SATA_SMART 0x0040 #define LEAPRAID_SAS_DEV_P0_FLG_ENC_LEVEL_VALID 0x0002 #define LEAPRAID_SAS_DEV_P0_FLG_DEV_PRESENT 0x0001 #define LEAPRAID_SAS_DEV_P0_CON_NAME_LEN 4 @@ -207,15 +202,9 @@ /* Physical disk page number. */ #define LEAPRAID_CFG_PAGE_NUM_PD0 0x0 -/* Adapter page number. */ -#define LEAPRAID_CFG_PAGE_NUM_ADAPTER1 0x1 - #define LEAPRAID_CFG_UNIT_SIZE 4 /* Raid volume type and state. */ -#define LEAPRAID_VOL_STATE_MISSING 0x00 -#define LEAPRAID_VOL_STATE_FAILED 0x01 -#define LEAPRAID_VOL_STATE_INITIALIZING 0x02 #define LEAPRAID_VOL_STATE_ONLINE 0x03 #define LEAPRAID_VOL_STATE_DEGRADED 0x04 #define LEAPRAID_VOL_STATE_OPTIMAL 0x05 @@ -231,10 +220,6 @@ #define LEAPRAID_RAIDCFG_P0_EFLG_HOT_SPARE_ELEMENT 0x0002 #define LEAPRAID_RAIDCFG_P0_EFLG_OCE_ELEMENT 0x0003 -/* Raid action. */ -#define LEAPRAID_RAID_ACT_SYSTEM_SHUTDOWN_INITIATED 0x20 -#define LEAPRAID_RAID_ACT_PHYSDISK_HIDDEN 0x24 - /* SAS negotiated link rates. */ #define LEAPRAID_SAS_NEG_LINK_RATE_MASK_PHYSICAL 0x0F #define LEAPRAID_SAS_NEG_LINK_RATE_UNKNOWN_LINK_RATE 0x00 @@ -290,8 +275,6 @@ #define LEAPRAID_TM_MSGFLAGS_LINK_RESET 0x00 #define LEAPRAID_TM_RSP_INVALID_FRAME 0x02 -#define LEAPRAID_TM_RSP_TM_SUCCEEDED 0x08 -#define LEAPRAID_TM_RSP_IO_QUEUED_ON_ADAPTER 0x80 /* SCSI enclosure processor request defines. */ #define LEAPRAID_SEP_REQ_ACT_WRITE_STATUS 0x00 @@ -301,8 +284,6 @@ /* The capabilities of the adapter. */ #define LEAPRAID_ADAPTER_FEATURES_CAP_ATOMIC_REQ 0x00080000 -#define LEAPRAID_ADAPTER_FEATURES_CAP_RDPQ_ARRAY_CAPABLE 0x00040000 -#define LEAPRAID_ADAPTER_FEATURES_CAP_EVENT_REPLAY 0x00002000 #define LEAPRAID_ADAPTER_FEATURES_CAP_INTEGRATED_RAID 0x00001000 /* Event code definitions for the firmware. */ @@ -338,10 +319,6 @@ #define LEAPRAID_EVT_SAS_TOPO_RC_TARG_ADDED 0x01 #define LEAPRAID_EVT_SAS_TOPO_RC_TARG_NOT_RESPONDING 0x02 -/* SAS discovery event defines. */ -#define LEAPRAID_EVT_SAS_DISC_RC_STARTED 0x01 -#define LEAPRAID_EVT_SAS_DISC_RC_COMPLETED 0x02 - /* Enclosure device status change event. */ #define LEAPRAID_EVT_SAS_ENCL_RC_ADDED 0x01 #define LEAPRAID_EVT_SAS_ENCL_RC_NOT_RESPONDING 0x02 @@ -543,7 +520,7 @@ struct leapraid_sge_simple_union { union { __le32 addr32; __le64 addr64; - } u; + } __packed __aligned(4) u; } __packed __aligned(4); /** @@ -562,7 +539,7 @@ struct leapraid_sge_chain_union { union { __le32 addr32; __le64 addr64; - } u; + } __packed __aligned(4) u; } __packed __aligned(4); /** @@ -1672,7 +1649,7 @@ struct leapraid_adapter_features_req { * @r9: Reserved. */ struct leapraid_adapter_features_rep { - u16 msg_ver; + __le16 msg_ver; u8 msg_len; u8 func; u16 header_ver; @@ -1686,7 +1663,7 @@ struct leapraid_adapter_features_rep { u8 r4; u8 max_msix_vectors; __le16 req_slot; - u8 r5[2]; + __le16 product_id; __le32 adapter_caps; __le32 fw_version; __le16 sas_wide_max_qdepth; @@ -1871,7 +1848,7 @@ struct leapraid_evt_sas_topo_phy_entry { * @exp_dev_hdl: Expander device handle. * @num_phys: Number of PHYs in this entry. * @r1: Reserved. - * @entry_num: Entry index. + * @entry_num: Number of PHY elements. * @start_phy_num: Start PHY number. * @exp_status: Expander status. * @physical_port: Physical port number. @@ -1909,7 +1886,7 @@ struct leapraid_evt_data_sas_enc_dev_status_change { __le16 num_slots; __le16 start_slot; __le32 phy_bits; -}; +} __packed __aligned(4); /** * struct leapraid_io_unit_ctrl_req - I/O unit control request @@ -1933,7 +1910,7 @@ struct leapraid_io_unit_ctrl_req { u8 r1; u8 chain_offset; u8 func; - u16 dev_hdl; + __le16 dev_hdl; u8 adapter_para; u8 msg_flag; u8 r2[6]; diff --git a/drivers/scsi/leapraid/leapraid_app.c b/drivers/scsi/leapraid/leapraid_app.c index 25ec57c2ce4b..c4d4aace8112 100644 --- a/drivers/scsi/leapraid/leapraid_app.c +++ b/drivers/scsi/leapraid/leapraid_app.c @@ -134,13 +134,59 @@ struct leapraid_ioctl_command { u8 mf[]; }; -static struct leapraid_adapter *leapraid_ctl_lookup_adapter(int adapter_id) +static int leapraid_ctl_validate_sge_offset(struct leapraid_adapter *adapter, + const struct leapraid_req *req, + u32 offset_bytes, + size_t h2c_size, + size_t c2h_size) +{ + size_t sge_bytes; + + switch (req->func) { + case LEAPRAID_FUNC_SCSIIO: + case LEAPRAID_FUNC_SCSIIO_RAID_PASSTHROUGH: + case LEAPRAID_FUNC_SMP_PASSTHROUGH: + case LEAPRAID_FUNC_SCSIIO_SATA_PASSTHROUGH: + case LEAPRAID_FUNC_FW_DOWNLOAD: + case LEAPRAID_FUNC_FW_UPLOAD: + sge_bytes = LEAPRAID_IEEE_SGE64_ENTRY_SIZE; + break; + default: + sge_bytes = adapter->adapter_attr.use_32_dma_mask ? + sizeof(struct leapraid_sge_simple32) : + sizeof(struct leapraid_sge_simple64); + break; + } + + if (h2c_size && c2h_size) + sge_bytes *= 2; + + if (offset_bytes > LEAPRAID_REQUEST_SIZE - sge_bytes) { + dev_err(&adapter->pdev->dev, + "%s: Invalid offset_bytes=%u for func=0x%x\n", + __func__, offset_bytes, req->func); + return -EINVAL; + } + + return 0; +} + +static struct leapraid_adapter *leapraid_ctl_lookup_adapter(int adapter_id, + bool track_mmap) { struct leapraid_adapter *adapter; + struct Scsi_Host *shost; spin_lock(&leapraid_adapter_lock); list_for_each_entry(adapter, &leapraid_adapter_list, list) { if (adapter->adapter_attr.id == adapter_id) { + if (READ_ONCE(adapter->access_ctrl.host_removing)) + break; + shost = adapter->shost; + if (!shost || !scsi_host_get(shost)) + break; + if (track_mmap) + atomic_inc(&adapter->fw_log_desc.mmap_refcnt); spin_unlock(&leapraid_adapter_lock); return adapter; } @@ -150,6 +196,12 @@ static struct leapraid_adapter *leapraid_ctl_lookup_adapter(int adapter_id) return NULL; } +static void leapraid_ctl_put_adapter(struct leapraid_adapter *adapter) +{ + if (adapter && adapter->shost) + scsi_host_put(adapter->shost); +} + static void leapraid_ctl_scsiio_cmd(struct leapraid_adapter *adapter, void *ctl_sp_mpi_req, u16 taskid, @@ -245,6 +297,7 @@ static int leapraid_ctl_do_command(struct leapraid_adapter *adapter, unsigned long timeout; u16 dev_hdl = LEAPRAID_INVALID_DEV_HANDLE; bool issue_reset = false; + u32 data_sge_offset_bytes; u32 sz; int rc; @@ -257,9 +310,17 @@ static int leapraid_ctl_do_command(struct leapraid_adapter *adapter, if (!leap_mpi_req) return -ENOMEM; - if (karg->data_sge_offset > (UINT_MAX / LEAPRAID_SGE_OFFSET_SIZE) || - karg->data_sge_offset * LEAPRAID_SGE_OFFSET_SIZE > - LEAPRAID_REQUEST_SIZE) { + if (karg->data_sge_offset > (UINT_MAX / LEAPRAID_SGE_OFFSET_SIZE)) { + dev_err(&adapter->pdev->dev, + "%s: Invalid data_sge_offset=%u\n", + __func__, karg->data_sge_offset); + rc = -EINVAL; + goto out_cleanup; + } + + data_sge_offset_bytes = karg->data_sge_offset * + LEAPRAID_SGE_OFFSET_SIZE; + if (data_sge_offset_bytes > LEAPRAID_REQUEST_SIZE) { dev_err(&adapter->pdev->dev, "%s: Invalid data_sge_offset=%u\n", __func__, karg->data_sge_offset); @@ -267,8 +328,7 @@ static int leapraid_ctl_do_command(struct leapraid_adapter *adapter, goto out_cleanup; } - if (copy_from_user(leap_mpi_req, mf, - karg->data_sge_offset * LEAPRAID_SGE_OFFSET_SIZE)) { + if (copy_from_user(leap_mpi_req, mf, data_sge_offset_bytes)) { dev_err(&adapter->pdev->dev, "%s: Failed to copy request message from user\n", __func__); @@ -276,16 +336,21 @@ static int leapraid_ctl_do_command(struct leapraid_adapter *adapter, goto out_cleanup; } + h2c_size = karg->h2c_size; + c2h_size = karg->c2h_size; + rc = leapraid_ctl_validate_sge_offset(adapter, leap_mpi_req, + data_sge_offset_bytes, + h2c_size, c2h_size); + if (rc) + goto out_cleanup; + taskid = adapter->driver_cmds.ctl_cmd.taskid; adapter->driver_cmds.ctl_cmd.status = LEAPRAID_CMD_PENDING; - memset(&adapter->driver_cmds.ctl_cmd.reply, 0, - LEAPRAID_REPLY_SIZE); + memset(&adapter->driver_cmds.ctl_cmd.reply, 0, LEAPRAID_REPLY_SIZE); ctl_sp_mpi_req = leapraid_get_task_desc(adapter, taskid); memset(ctl_sp_mpi_req, 0, LEAPRAID_REQUEST_SIZE); - memcpy(ctl_sp_mpi_req, - leap_mpi_req, - karg->data_sge_offset * LEAPRAID_SGE_OFFSET_SIZE); + memcpy(ctl_sp_mpi_req, leap_mpi_req, data_sge_offset_bytes); if (ctl_sp_mpi_req->func == LEAPRAID_FUNC_SCSIIO || ctl_sp_mpi_req->func == LEAPRAID_FUNC_SCSIIO_RAID_PASSTHROUGH || @@ -305,8 +370,6 @@ static int leapraid_ctl_do_command(struct leapraid_adapter *adapter, goto out_cleanup; } - h2c_size = karg->h2c_size; - c2h_size = karg->c2h_size; if (h2c_size) { h2c = dma_alloc_coherent(&adapter->pdev->dev, h2c_size, &h2c_dma_addr, GFP_KERNEL); @@ -331,8 +394,7 @@ static int leapraid_ctl_do_command(struct leapraid_adapter *adapter, } } - psge = (void *)ctl_sp_mpi_req + (karg->data_sge_offset * - LEAPRAID_SGE_OFFSET_SIZE); + psge = (void *)ctl_sp_mpi_req + data_sge_offset_bytes; init_completion(&adapter->driver_cmds.ctl_cmd.done); switch (ctl_sp_mpi_req->func) { @@ -388,6 +450,7 @@ static int leapraid_ctl_do_command(struct leapraid_adapter *adapter, dev_err(&adapter->pdev->dev, "%s: ctl_cmd timeout, status=0x%x\n", __func__, adapter->driver_cmds.ctl_cmd.status); + leapraid_log_req_context(adapter, taskid, ctl_sp_mpi_req); } if ((leap_mpi_req->func == LEAPRAID_FUNC_SMP_PASSTHROUGH || @@ -517,7 +580,7 @@ static int leapraid_ctl_ioctl_main(struct file *file, unsigned int cmd, void __user *arg) { struct leapraid_ioctl_header ioctl_header; - struct leapraid_adapter *adapter; + struct leapraid_adapter *adapter = NULL; struct leapraid_ioctl_command __user *uarg; struct leapraid_ioctl_command karg; int rc = -ENOIOCTLCMD; @@ -529,7 +592,7 @@ static int leapraid_ctl_ioctl_main(struct file *file, unsigned int cmd, return -EFAULT; } - adapter = leapraid_ctl_lookup_adapter(ioctl_header.adapter_id); + adapter = leapraid_ctl_lookup_adapter(ioctl_header.adapter_id, false); if (!adapter) return -EFAULT; @@ -538,7 +601,8 @@ static int leapraid_ctl_ioctl_main(struct file *file, unsigned int cmd, "%s: Failed, thermal_alert=%d\n", __func__, atomic_read(&adapter->overheat_desc.thermal_alert)); - return -EFAULT; + rc = -EFAULT; + goto out_put; } mutex_lock(&adapter->access_ctrl.pci_access_lock); @@ -590,7 +654,7 @@ static int leapraid_ctl_ioctl_main(struct file *file, unsigned int cmd, break; } - if (karg.hdr.adapter_id != ioctl_header.adapter_id) { + if (karg.hdr.adapter_id != ioctl_header.adapter_id) { rc = -EINVAL; break; } @@ -618,46 +682,78 @@ static int leapraid_ctl_ioctl_main(struct file *file, unsigned int cmd, unlock: mutex_unlock(&adapter->access_ctrl.pci_access_lock); +out_put: + leapraid_ctl_put_adapter(adapter); return rc; } -static long bad_ioctl(struct file *file, unsigned int cmd, unsigned long arg) -{ - return -ENOTTY; -} - static long leapraid_ctl_ioctl(struct file *file, unsigned int cmd, unsigned long arg) { return leapraid_ctl_ioctl_main(file, cmd, (void __user *)arg); } +static void leapraid_fw_mmap_open(struct vm_area_struct *vma) +{ + struct leapraid_adapter *adapter = vma->vm_private_data; + + if (!adapter) + return; + + get_device(&adapter->shost->shost_gendev); + atomic_inc(&adapter->fw_log_desc.mmap_refcnt); +} + +static void leapraid_fw_mmap_close(struct vm_area_struct *vma) +{ + struct leapraid_adapter *adapter = vma->vm_private_data; + + if (!adapter) + return; + + if (atomic_dec_and_test(&adapter->fw_log_desc.mmap_refcnt)) + wake_up(&adapter->fw_log_desc.mmap_waitq); + leapraid_ctl_put_adapter(adapter); +} + +static const struct vm_operations_struct leapraid_fw_mmap_vm_ops = { + .open = leapraid_fw_mmap_open, + .close = leapraid_fw_mmap_close, +}; + static int leapraid_fw_mmap(struct file *filp, struct vm_area_struct *vma) { - struct leapraid_adapter *adapter; + struct leapraid_adapter *adapter = NULL; /* Userspace passes the adapter ID via vma->vm_pgoff. */ u32 adapter_id = vma->vm_pgoff; unsigned long length; - int rc; + int rc = -EINVAL; length = vma->vm_end - vma->vm_start; - adapter = leapraid_ctl_lookup_adapter(adapter_id); + adapter = leapraid_ctl_lookup_adapter(adapter_id, true); if (!adapter) { pr_err("%s: No adapter found!\n", __func__); return -EINVAL; } + if (READ_ONCE(adapter->access_ctrl.host_removing)) { + rc = -EAGAIN; + goto out_put; + } + if (length > (LEAPRAID_SYS_LOG_BUF_SIZE + LEAPRAID_SYS_LOG_BUF_RESERVE)) { dev_err(&adapter->pdev->dev, "Requested mapping size is too large!\n"); - return -EINVAL; + rc = -EINVAL; + goto out_put; } if (!adapter->fw_log_desc.fw_log_buffer) { dev_err(&adapter->pdev->dev, "No log buffer!\n"); - return -EINVAL; + rc = -EINVAL; + goto out_put; } vma->vm_pgoff = 0; @@ -669,17 +765,26 @@ static int leapraid_fw_mmap(struct file *filp, struct vm_area_struct *vma) if (rc) { dev_err(&adapter->pdev->dev, "Failed to map memory to user space!\n"); - return rc; + goto out_put; } - return 0; + vma->vm_private_data = adapter; + vma->vm_ops = &leapraid_fw_mmap_vm_ops; + leapraid_fw_mmap_open(vma); + + rc = 0; +out_put: + if (adapter && + atomic_dec_and_test(&adapter->fw_log_desc.mmap_refcnt)) + wake_up(&adapter->fw_log_desc.mmap_waitq); + leapraid_ctl_put_adapter(adapter); + return rc; } static const struct file_operations leapraid_ctl_fops = { .owner = THIS_MODULE, .unlocked_ioctl = leapraid_ctl_ioctl, .mmap = leapraid_fw_mmap, - .compat_ioctl = bad_ioctl, }; static struct miscdevice leapraid_ctl_dev = { diff --git a/drivers/scsi/leapraid/leapraid_func.c b/drivers/scsi/leapraid/leapraid_func.c index f2574feb2514..32683f205d10 100644 --- a/drivers/scsi/leapraid/leapraid_func.c +++ b/drivers/scsi/leapraid/leapraid_func.c @@ -8,21 +8,6 @@ #include "leapraid_func.h" -static int msix_disable; -module_param(msix_disable, int, 0444); -MODULE_PARM_DESC(msix_disable, - "disable msix routed interrupts (default=0)"); - -static int smart_poll; -module_param(smart_poll, int, 0444); -MODULE_PARM_DESC(smart_poll, - "check SATA drive health via SMART polling: (default=0)"); - -static int interrupt_mode; -module_param(interrupt_mode, int, 0444); -MODULE_PARM_DESC(interrupt_mode, - "intr mode: 0 is MSI-X, 1 is MSI, 2 is legacy. (default=0)"); - static int poll_queues; module_param(poll_queues, int, 0444); MODULE_PARM_DESC(poll_queues, @@ -42,45 +27,23 @@ static void leapraid_ublk_io_dev(struct leapraid_adapter *adapter, static void leapraid_clear_cached_boot_dev(struct leapraid_adapter *adapter, void *dev, u32 chnl); static int leapraid_make_adapter_available(struct leapraid_adapter *adapter); +static void leapraid_sync_irqs_for_cleanup(struct leapraid_adapter *adapter); static int leapraid_fw_log_init(struct leapraid_adapter *adapter); static bool leapraid_should_skip_poll_work(struct leapraid_adapter *adapter); static int leapraid_make_adapter_ready(struct leapraid_adapter *adapter, enum reset_type type); -static void leapraid_debug_log_info(struct leapraid_adapter *adapter) +static noinline bool leapraid_shost_in_recovery(struct Scsi_Host *shost) { - struct leapraid_reg_base __iomem *iomem_base = adapter->iomem_base; - u32 debug_log[LEAPRAID_DEBUGLOG_SZ_MAX]; - bool changed = false; - int i; + enum scsi_host_state state; - if (leapraid_should_skip_poll_work(adapter)) - return; - - for (i = 0; i < LEAPRAID_DEBUGLOG_SZ_MAX; i++) { - debug_log[i] = leapraid_readl(&iomem_base->debug_log[i]); - if (debug_log[i] != adapter->fw_log_desc.pre_debug_log[i]) - changed = true; - } - - if (!changed) - return; - - memcpy(adapter->fw_log_desc.pre_debug_log, - debug_log, - sizeof(debug_log)); - - for (i = 0; i < LEAPRAID_DEBUGLOG_SZ_MAX; - i += LEAPRAID_DEBUGLOG_DWORDS_PER_LINE) - dev_warn(&adapter->pdev->dev, - "debug_log[%d-%d]: 0x%08x 0x%08x 0x%08x 0x%08x\n", - i, - i + LEAPRAID_DEBUGLOG_DWORDS_PER_LINE - 1, - debug_log[i], - debug_log[i + 1], - debug_log[i + 2], - debug_log[i + 3]); + state = READ_ONCE(shost->shost_state); + return state == SHOST_RECOVERY || + state == SHOST_CANCEL_RECOVERY || + state == SHOST_DEL_RECOVERY || + shost->tmf_in_progress; } + static inline bool leapraid_is_end_dev(u32 dev_type) { return (dev_type & LEAPRAID_DEVTYP_END_DEV) && @@ -171,7 +134,6 @@ static void leapraid_overheat_suspend(struct leapraid_adapter *adapter) pdev = adapter->pdev; shost = pci_get_drvdata(pdev); - if (!shost) { dev_warn(&pdev->dev, "Overheat suspend failed, invalid host or adapter\n"); @@ -361,6 +323,12 @@ int leapraid_check_adapter_is_op(struct leapraid_adapter *adapter, int wait, int wait_count; for (wait_count = wait; wait_count > 0; wait_count--) { + if (READ_ONCE(adapter->access_ctrl.host_removing)) { + dev_warn(&adapter->pdev->dev, + "%s: Host is removing\n", caller); + return -EFAULT; + } + if (leapraid_pci_removed(adapter)) { dev_warn(&adapter->pdev->dev, "%s: PCI device removed\n", __func__); @@ -499,11 +467,9 @@ static bool leapraid_is_fixed_taskid(struct leapraid_adapter *adapter, struct leapraid_driver_cmds *driver_cmds = &adapter->driver_cmds; return (taskid == driver_cmds->ctl_cmd.taskid || - taskid == driver_cmds->driver_scsiio_cmd.taskid || taskid == driver_cmds->tm_cmd.hp_taskid || taskid == driver_cmds->ctl_cmd.hp_taskid || taskid == driver_cmds->scan_dev_cmd.inter_taskid || - taskid == driver_cmds->timestamp_sync_cmd.inter_taskid || taskid == driver_cmds->transport_cmd.inter_taskid || taskid == driver_cmds->cfg_op_cmd.inter_taskid || taskid == driver_cmds->enc_cmd.inter_taskid || @@ -606,6 +572,8 @@ void leapraid_clean_active_scsi_cmds(struct leapraid_adapter *adapter) void *task_desc; u16 taskid; + leapraid_sync_irqs_for_cleanup(adapter); + for (taskid = 1; taskid <= adapter->shost->can_queue; taskid++) { scmd = leapraid_get_scmd_from_taskid(adapter, taskid); if (!scmd) @@ -643,8 +611,6 @@ static void leapraid_clean_active_driver_cmds(struct leapraid_adapter *adapter) struct leapraid_driver_cmds *driver_cmds; driver_cmds = &adapter->driver_cmds; - leapraid_clean_active_driver_cmd(&driver_cmds->timestamp_sync_cmd); - leapraid_clean_active_driver_cmd(&driver_cmds->driver_scsiio_cmd); leapraid_clean_active_driver_cmd(&driver_cmds->tm_cmd); leapraid_clean_active_driver_cmd(&driver_cmds->transport_cmd); leapraid_clean_active_driver_cmd(&driver_cmds->enc_cmd); @@ -1912,16 +1878,6 @@ static const char *leapraid_sas_op_name(u8 op) } } -static const char *leapraid_io_param_name(u8 adapter_param) -{ - switch (adapter_param) { - case LEAPRAID_SET_PARAMETER_SYNC_TIMESTAMP: - return "SYNC_TIMESTAMP"; - default: - return "UNKNOWN"; - } -} - static const char *leapraid_tm_type_name(u8 task_type) { switch (task_type) { @@ -1948,7 +1904,7 @@ static const char *leapraid_tm_type_name(u8 task_type) } } -void leapraid_log_req_context(struct leapraid_adapter *adapter, +void leapraid_log_req_context(struct leapraid_adapter *adapter, u16 smid, const void *req_data) { const struct leapraid_req *req = req_data; @@ -1961,8 +1917,8 @@ void leapraid_log_req_context(struct leapraid_adapter *adapter, const struct leapraid_cfg_req *cfg_req = req_data; dev_err(&adapter->pdev->dev, - "cfg-req: func=0x%02x(%s) act=0x%02x(%s)\n", - req->func, leapraid_func_name(req->func), + "cfg-req: smid=%u func=0x%02x(%s) action=0x%02x(%s)\n", + smid, req->func, leapraid_func_name(req->func), cfg_req->action, leapraid_cfg_action_name(cfg_req->action)); dev_err(&adapter->pdev->dev, @@ -1984,12 +1940,12 @@ void leapraid_log_req_context(struct leapraid_adapter *adapter, const struct leapraid_scsi_tm_req *tm_req = req_data; dev_err(&adapter->pdev->dev, - "scsi_tm: func=0x%02x(%s) task=0x%02x(%s)\n", - req->func, leapraid_func_name(req->func), + "scsi_tm:: smid=%u func=0x%02x(%s) task=0x%02x(%s)\n", + smid, req->func, leapraid_func_name(req->func), tm_req->task_type, leapraid_tm_type_name(tm_req->task_type)); dev_err(&adapter->pdev->dev, - "scsi_tm: dev_hdl=0x%04x task_mid=%u\n", + "scsi_tm:: dev_hdl=0x%04x task_mid=%u\n", le16_to_cpu(tm_req->dev_hdl), le16_to_cpu(tm_req->task_mid)); break; @@ -1998,8 +1954,8 @@ void leapraid_log_req_context(struct leapraid_adapter *adapter, const struct leapraid_sep_req *sep_req = req_data; dev_err(&adapter->pdev->dev, - "sep: func=0x%02x(%s) act=0x%02x(%s)\n", - req->func, leapraid_func_name(req->func), + "sep: smid=%u func=0x%02x(%s) action=0x%02x(%s)\n", + smid, req->func, leapraid_func_name(req->func), sep_req->act, leapraid_sep_action_name(sep_req->act)); dev_err(&adapter->pdev->dev, @@ -2013,32 +1969,34 @@ void leapraid_log_req_context(struct leapraid_adapter *adapter, const struct leapraid_io_unit_ctrl_req *io_req = req_data; dev_err(&adapter->pdev->dev, - "timestamp sync: func=0x%02x(%s) op=0x%02x(%s)\n", - req->func, leapraid_func_name(req->func), + "ctl_cmd: smid=%u func=0x%02x(%s) action=0x%02x(%s)\n", + smid, req->func, leapraid_func_name(req->func), io_req->op, leapraid_sas_op_name(io_req->op)); dev_err(&adapter->pdev->dev, - "timestamp sync: dev_hdl=0x%04x param=0x%02x(%s)\n", + "ctl_cmd: dev_hdl=0x%04x param=0x%02x\n", le16_to_cpu(io_req->dev_hdl), - io_req->adapter_para, - leapraid_io_param_name(io_req->adapter_para)); + io_req->adapter_para); break; } case LEAPRAID_FUNC_SMP_PASSTHROUGH: { const struct leapraid_smp_passthrough_req *smp_req = req_data; dev_err(&adapter->pdev->dev, - "transport: func=0x%02x(%s) port=%u req_len=%u\n", - req->func, leapraid_func_name(req->func), + "smp_cmd: smid=%u func=0x%02x(%s) action=0x%02x\n", + smid, req->func, leapraid_func_name(req->func), + smp_req->passthrough_flg); + dev_err(&adapter->pdev->dev, + "smp_cmd: port=%u req_len=%u\n", smp_req->physical_port, le16_to_cpu(smp_req->req_data_len)); - dev_err(&adapter->pdev->dev, "transport: sas_addr=0x%016llx\n", + dev_err(&adapter->pdev->dev, "smp_cmd: sas_addr=0x%016llx\n", (unsigned long long)le64_to_cpu(smp_req->sas_address)); break; } default: dev_err(&adapter->pdev->dev, - "%s: func=0x%02x(%s)\n", - __func__, req->func, leapraid_func_name(req->func)); + "cmd: smid=%u func=0x%02x(%s)\n", + smid, req->func, leapraid_func_name(req->func)); break; } } @@ -2049,19 +2007,18 @@ static void leapraid_build_and_fire_cfg_req( struct leapraid_cfg_rep *leap_mpi_cfgp_rep) { struct leapraid_cfg_req *local_leap_cfg_req; + u16 smid; memset(leap_mpi_cfgp_rep, 0, sizeof(struct leapraid_cfg_rep)); memset(&adapter->driver_cmds.cfg_op_cmd.reply, 0, sizeof(struct leapraid_cfg_rep)); adapter->driver_cmds.cfg_op_cmd.status = LEAPRAID_CMD_PENDING; - local_leap_cfg_req = leapraid_get_task_desc( - adapter, - adapter->driver_cmds.cfg_op_cmd.inter_taskid); + smid = adapter->driver_cmds.cfg_op_cmd.inter_taskid; + local_leap_cfg_req = leapraid_get_task_desc(adapter, smid); memcpy(local_leap_cfg_req, leap_mpi_cfgp_req, sizeof(struct leapraid_cfg_req)); init_completion(&adapter->driver_cmds.cfg_op_cmd.done); - leapraid_fire_task(adapter, - adapter->driver_cmds.cfg_op_cmd.inter_taskid); + leapraid_fire_task(adapter, smid); wait_for_completion_timeout(&adapter->driver_cmds.cfg_op_cmd.done, LEAPRAID_CFG_OP_TIMEOUT * HZ); } @@ -2074,11 +2031,13 @@ static int leapraid_req_cfg_func(struct leapraid_adapter *adapter, { u32 adapter_status = UINT_MAX; bool issue_reset = false; + u16 smid; u8 retry_cnt; int rc; retry_cnt = 0; mutex_lock(&adapter->driver_cmds.cfg_op_cmd.mutex); + smid = adapter->driver_cmds.cfg_op_cmd.inter_taskid; retry: if (retry_cnt) { if (retry_cnt > LEAPRAID_CFG_REQ_RETRY_TIMES) { @@ -2115,14 +2074,16 @@ static int leapraid_req_cfg_func(struct leapraid_adapter *adapter, adapter->access_ctrl.shost_recovering ? "shost recovery" : "pcie recovery", adapter->driver_cmds.cfg_op_cmd.status); - leapraid_log_req_context(adapter, leap_mpi_cfgp_req); + leapraid_log_req_context(adapter, smid, + leap_mpi_cfgp_req); issue_reset = false; rc = -EFAULT; } else { dev_err(&adapter->pdev->dev, "cfg-req: timeout, status=0x%x, reset\n", adapter->driver_cmds.cfg_op_cmd.status); - leapraid_log_req_context(adapter, leap_mpi_cfgp_req); + leapraid_log_req_context(adapter, smid, + leap_mpi_cfgp_req); issue_reset = true; } @@ -2162,7 +2123,7 @@ static int leapraid_req_cfg_func(struct leapraid_adapter *adapter, mutex_unlock(&adapter->driver_cmds.cfg_op_cmd.mutex); if (issue_reset) { if (adapter->scan_dev_desc.first_scan_dev_fired) { - dev_info(&adapter->pdev->dev, + dev_warn(&adapter->pdev->dev, "%s:%d cfg-req: Failure, issuing reset\n", __func__, __LINE__); leapraid_hard_reset_handler(adapter, FULL_RESET); @@ -2433,14 +2394,12 @@ static int leapraid_cfg_find_vol_in_page( u16 phys_hdl; phys_hdl = le16_to_cpu(elem->phys_disk_dev_hdl); - if (phys_hdl == pd_hdl) { *vol_hdl = le16_to_cpu(elem->vol_dev_hdl); return 0; } break; } - case LEAPRAID_RAIDCFG_P0_EFLG_HOT_SPARE_ELEMENT: *vol_hdl = 0; return 0; @@ -2607,7 +2566,6 @@ static int leapraid_cfg_get_number_pds(struct leapraid_adapter *adapter, cfgp2.handle = hdl; rc = leapraid_op_config_page(adapter, &raidvol_p0, cfgp1, cfgp2, GET_RAID_VOLUME_PG0); - if (!rc) *num_pds = raidvol_p0.num_phys_disks; @@ -2821,61 +2779,6 @@ void leapraid_fw_log_start(struct leapraid_adapter *adapter) spin_unlock_irqrestore(&adapter->reset_desc.adapter_reset_lock, flags); } -static void leapraid_timestamp_sync(struct leapraid_adapter *adapter) -{ - struct leapraid_io_unit_ctrl_req *io_unit_ctrl_req; - ktime_t current_time; - bool issue_reset = false; - u64 time_stamp; - - mutex_lock(&adapter->driver_cmds.timestamp_sync_cmd.mutex); - adapter->driver_cmds.timestamp_sync_cmd.status = LEAPRAID_CMD_PENDING; - io_unit_ctrl_req = - leapraid_get_task_desc( - adapter, - adapter->driver_cmds.timestamp_sync_cmd.inter_taskid); - memset(io_unit_ctrl_req, 0, sizeof(struct leapraid_io_unit_ctrl_req)); - io_unit_ctrl_req->func = LEAPRAID_FUNC_SAS_IO_UNIT_CTRL; - io_unit_ctrl_req->op = LEAPRAID_SAS_OP_SET_PARAMETER; - io_unit_ctrl_req->adapter_para = LEAPRAID_SET_PARAMETER_SYNC_TIMESTAMP; - - current_time = ktime_get_real(); - time_stamp = ktime_to_ms(current_time); - - io_unit_ctrl_req->adapter_para_value = - cpu_to_le32(time_stamp & 0xFFFFFFFF); - io_unit_ctrl_req->adapter_para_value2 = - cpu_to_le32(time_stamp >> 32); - init_completion(&adapter->driver_cmds.timestamp_sync_cmd.done); - leapraid_fire_task( - adapter, - adapter->driver_cmds.timestamp_sync_cmd.inter_taskid); - leapraid_debug_log_info(adapter); - wait_for_completion_timeout(&adapter->driver_cmds - .timestamp_sync_cmd.done, - LEAPRAID_TIMESTAMP_SYNC_CMD_TIMEOUT * HZ); - if (!(adapter->driver_cmds.timestamp_sync_cmd.status & - LEAPRAID_CMD_DONE)) { - dev_err(&adapter->pdev->dev, - "%s: timestamp sync timeout, status=0x%x\n", - __func__, - adapter->driver_cmds.timestamp_sync_cmd.status); - leapraid_log_req_context(adapter, io_unit_ctrl_req); - issue_reset = - leapraid_check_reset( - adapter->driver_cmds.timestamp_sync_cmd.status); - } - - if (issue_reset) { - dev_info(&adapter->pdev->dev, "%s:%d: call hard_reset\n", - __func__, __LINE__); - leapraid_hard_reset_handler(adapter, FULL_RESET); - } - - adapter->driver_cmds.timestamp_sync_cmd.status = LEAPRAID_CMD_NOT_USED; - mutex_unlock(&adapter->driver_cmds.timestamp_sync_cmd.mutex); -} - static void leapraid_check_scheduled_fault_work(struct work_struct *work) { struct leapraid_adapter *adapter; @@ -2891,21 +2794,16 @@ static void leapraid_check_scheduled_fault_work(struct work_struct *work) adapter_state = leapraid_get_adapter_state(adapter); if (adapter_state != LEAPRAID_DB_OPERATIONAL) { - dev_info(&adapter->pdev->dev, "%s:%d: call hard_reset\n", - __func__, __LINE__); + dev_info(&adapter->pdev->dev, "%s:%d: call hard_reset 0x%x\n", + __func__, __LINE__, adapter_state); rc = leapraid_hard_reset_handler(adapter, FULL_RESET); - dev_warn(&adapter->pdev->dev, "%s: Hard reset %s\n", - __func__, rc == 0 ? "success" : "failed"); - adapter_state = leapraid_get_adapter_state(adapter); - if (rc && adapter_state != LEAPRAID_DB_OPERATIONAL) + if (rc && adapter_state != LEAPRAID_DB_OPERATIONAL) { + dev_err(&adapter->pdev->dev, + "%s: Hard reset failed, state=0x%x rc=%d\n", + __func__, adapter_state, rc); return; - } - - if (++adapter->timestamp_sync_cnt >= - LEAPRAID_TIMESTAMP_SYNC_INTERVAL) { - adapter->timestamp_sync_cnt = 0; - leapraid_timestamp_sync(adapter); + } } scheduled_timer: @@ -2925,7 +2823,6 @@ void leapraid_check_scheduled_fault_start(struct leapraid_adapter *adapter) if (adapter->reset_desc.fault_reset_wq) return; - adapter->timestamp_sync_cnt = 0; INIT_DELAYED_WORK(&adapter->reset_desc.fault_reset_work, leapraid_check_scheduled_fault_work); snprintf(adapter->reset_desc.fault_reset_wq_name, @@ -2968,308 +2865,6 @@ void leapraid_check_scheduled_fault_stop(struct leapraid_adapter *adapter) destroy_workqueue(wq); } -static bool leapraid_ready_for_scsi_io(struct leapraid_adapter *adapter, - u16 hdl) -{ - if (adapter->access_ctrl.pcie_recovering || - adapter->access_ctrl.shost_recovering) { - dev_err(&adapter->pdev->dev, - "%s: Failed, pcie_recovering=%d shost_recovering=%d\n", - __func__, - adapter->access_ctrl.pcie_recovering, - adapter->access_ctrl.shost_recovering); - return false; - } - - if (leapraid_check_adapter_is_op(adapter, LEAPRAID_DB_WAIT_OP_SHORT, - __func__)) - return false; - - if (hdl == LEAPRAID_INVALID_DEV_HANDLE) { - dev_err(&adapter->pdev->dev, - "%s: Device handle is invalid\n", __func__); - return false; - } - - return true; -} - -static int leapraid_dispatch_scsi_io(struct leapraid_adapter *adapter, - struct leapraid_scsi_cmd_desc *cmd_desc) -{ - struct scsi_device *sdev; - struct scsi_device *target_sdev = NULL; - struct leapraid_sdev_priv *sdev_priv; - struct scsi_cmnd *scmd; - void *dma_buffer = NULL; - dma_addr_t dma_addr; - bool issue_reset = false; - int rc; - - if (WARN_ON(!adapter->driver_cmds.internal_scmd)) - return -EINVAL; - - if (!leapraid_ready_for_scsi_io(adapter, cmd_desc->hdl)) - return -EINVAL; - - mutex_lock(&adapter->driver_cmds.driver_scsiio_cmd.mutex); - if (adapter->driver_cmds.driver_scsiio_cmd.status != - LEAPRAID_CMD_NOT_USED) { - dev_err(&adapter->pdev->dev, - "%s: scsiio cmd busy\n", __func__); - rc = -EAGAIN; - goto out_cleanup; - } - adapter->driver_cmds.driver_scsiio_cmd.status = LEAPRAID_CMD_PENDING; - - shost_for_each_device(sdev, adapter->shost) { - sdev_priv = sdev->hostdata; - - if (sdev_priv->starget_priv->hdl == cmd_desc->hdl && - sdev_priv->lun == cmd_desc->lun) { - target_sdev = sdev; - break; - } - } - - if (!target_sdev) { - dev_warn(&adapter->pdev->dev, - "%s: Device not found\n", __func__); - rc = -ENXIO; - goto out_cleanup; - } - - if (cmd_desc->data_length) { - dma_buffer = dma_alloc_coherent(&adapter->pdev->dev, - cmd_desc->data_length, - &dma_addr, GFP_ATOMIC); - if (!dma_buffer) { - rc = -ENOMEM; - goto out_cleanup; - } - if (cmd_desc->dir == DMA_TO_DEVICE) - memcpy(dma_buffer, cmd_desc->data_buffer, - cmd_desc->data_length); - } - - scmd = adapter->driver_cmds.internal_scmd; - scmd->device = target_sdev; - scmd->cmd_len = cmd_desc->cdb_length; - memcpy(scmd->cmnd, cmd_desc->cdb, cmd_desc->cdb_length); - scmd->sc_data_direction = cmd_desc->dir; - scmd->sdb.length = cmd_desc->data_length; - scmd->sdb.table.nents = 1; - scmd->sdb.table.orig_nents = 1; - sg_init_one(scmd->sdb.table.sgl, dma_buffer, cmd_desc->data_length); - init_completion(&adapter->driver_cmds.driver_scsiio_cmd.done); - if (leapraid_queuecommand(adapter->shost, scmd)) { - adapter->driver_cmds.driver_scsiio_cmd.status &= - ~LEAPRAID_CMD_PENDING; - complete(&adapter->driver_cmds.driver_scsiio_cmd.done); - dev_err(&adapter->pdev->dev, - "%s: queuecommand failed\n", __func__); - rc = -EINVAL; - goto out_cleanup; - } - - wait_for_completion_timeout(&adapter->driver_cmds - .driver_scsiio_cmd.done, - cmd_desc->time_out * HZ); - - if (!(adapter->driver_cmds.driver_scsiio_cmd.status & - LEAPRAID_CMD_DONE)) { - issue_reset = - leapraid_check_reset( - adapter->driver_cmds.driver_scsiio_cmd.status); - rc = -ENODATA; - goto reset; - } - - rc = adapter->driver_cmds.internal_scmd->result; - if (!rc && cmd_desc->dir == DMA_FROM_DEVICE) - memcpy(cmd_desc->data_buffer, dma_buffer, - cmd_desc->data_length); - -reset: - if (issue_reset) { - rc = -ENODATA; - dev_err(&adapter->pdev->dev, "fire tgt reset: hdl=0x%04x\n", - cmd_desc->hdl); - leapraid_issue_locked_tm( - adapter, cmd_desc->hdl, 0, 0, 0, - LEAPRAID_TM_TASKTYPE_TARGET_RESET, - adapter->driver_cmds.driver_scsiio_cmd.taskid, - LEAPRAID_TM_MSGFLAGS_LINK_RESET); - } -out_cleanup: - if (target_sdev) - scsi_device_put(target_sdev); - - if (dma_buffer) - dma_free_coherent(&adapter->pdev->dev, - cmd_desc->data_length, - dma_buffer, - dma_addr); - - adapter->driver_cmds.driver_scsiio_cmd.status = LEAPRAID_CMD_NOT_USED; - mutex_unlock(&adapter->driver_cmds.driver_scsiio_cmd.mutex); - return rc; -} - -static int leapraid_dispatch_logsense(struct leapraid_adapter *adapter, - u16 hdl, u32 lun) -{ - struct leapraid_scsi_cmd_desc *desc; - char *buf; - int rc; - - desc = kzalloc(sizeof(*desc), GFP_KERNEL); - if (!desc) - return -ENOMEM; - - desc->hdl = hdl; - desc->lun = lun; - desc->data_length = LEAPRAID_LOGSENSE_DATA_LENGTH; - desc->dir = DMA_FROM_DEVICE; - desc->cdb_length = LEAPRAID_LOGSENSE_CDB_LENGTH; - desc->cdb[0] = LOG_SENSE; - desc->cdb[2] = LEAPRAID_LOGSENSE_CDB_CODE; - desc->cdb[8] = desc->data_length; - desc->raid_member = 0; - desc->time_out = LEAPRAID_LOGSENSE_TIMEOUT; - - desc->data_buffer = kzalloc(desc->data_length, GFP_KERNEL); - if (!desc->data_buffer) { - kfree(desc); - return -ENOMEM; - } - - rc = leapraid_dispatch_scsi_io(adapter, desc); - buf = desc->data_buffer; - - if (!rc && buf[8] == LEAPRAID_LOGSENSE_SMART_CODE) - leapraid_smart_fault_detect(adapter, hdl); - - kfree(desc->data_buffer); - kfree(desc); - - return rc; -} - -static bool leapraid_smart_poll_check(struct leapraid_adapter *adapter, - struct leapraid_sdev_priv *sdev_priv, - u32 reset_flg) -{ - struct leapraid_sas_dev *sas_dev; - - if (!sdev_priv || !sdev_priv->starget_priv->card_port) - return false; - - sas_dev = leapraid_get_sas_dev_by_addr( - adapter, - sdev_priv->starget_priv->sas_address, - sdev_priv->starget_priv->card_port); - if (!sas_dev || !sas_dev->support_smart) - goto out_fail; - - if (reset_flg) - sas_dev->led_on = 0; - else if (sas_dev->led_on) - goto out_fail; - - if (sdev_priv->starget_priv->flg & LEAPRAID_TGT_FLG_RAID_MEMBER || - sdev_priv->starget_priv->flg & LEAPRAID_TGT_FLG_VOLUME || - sdev_priv->block) - goto out_fail; - - leapraid_sdev_put(sas_dev); - return true; - -out_fail: - if (sas_dev) - leapraid_sdev_put(sas_dev); - return false; -} - -static void leapraid_sata_smart_poll_work(struct work_struct *work) -{ - struct leapraid_adapter *adapter = - container_of(work, struct leapraid_adapter, - smart_poll_desc.smart_poll_work.work); - struct scsi_device *sdev; - struct leapraid_sdev_priv *sdev_priv; - bool reset_flg = false; - - if (leapraid_should_skip_poll_work(adapter)) - goto scheduled_timer; - - if (leapraid_check_adapter_is_op(adapter, LEAPRAID_DB_WAIT_OP_SHORT, - __func__)) - goto scheduled_timer; - - if (adapter->reset_desc.last_reset_cnt < adapter->reset_desc.reset_cnt) - reset_flg = true; - - adapter->reset_desc.last_reset_cnt = adapter->reset_desc.reset_cnt; - - shost_for_each_device(sdev, adapter->shost) { - sdev_priv = sdev->hostdata; - if (leapraid_smart_poll_check(adapter, sdev_priv, reset_flg)) - leapraid_dispatch_logsense(adapter, - sdev_priv->starget_priv->hdl, - sdev_priv->lun); - } - -scheduled_timer: - if (adapter->smart_poll_desc.smart_poll_wq) - queue_delayed_work( - adapter->smart_poll_desc.smart_poll_wq, - &adapter->smart_poll_desc.smart_poll_work, - msecs_to_jiffies(LEAPRAID_SMART_POLLING_INTERVAL)); -} - -void leapraid_smart_polling_start(struct leapraid_adapter *adapter) -{ - if (adapter->smart_poll_desc.smart_poll_wq || !smart_poll) - return; - - INIT_DELAYED_WORK(&adapter->smart_poll_desc.smart_poll_work, - leapraid_sata_smart_poll_work); - - snprintf(adapter->smart_poll_desc.smart_poll_wq_name, - sizeof(adapter->smart_poll_desc.smart_poll_wq_name), - "poll_%s%u_smart_poll", - LEAPRAID_DRIVER_NAME, - adapter->adapter_attr.id); - adapter->smart_poll_desc.smart_poll_wq = - create_singlethread_workqueue( - adapter->smart_poll_desc.smart_poll_wq_name); - if (!adapter->smart_poll_desc.smart_poll_wq) - return; - queue_delayed_work(adapter->smart_poll_desc.smart_poll_wq, - &adapter->smart_poll_desc.smart_poll_work, - msecs_to_jiffies(LEAPRAID_SMART_POLLING_INTERVAL)); -} - -void leapraid_smart_polling_stop(struct leapraid_adapter *adapter) -{ - struct workqueue_struct *wq; - struct leapraid_smart_poll_desc *desc; - - desc = &adapter->smart_poll_desc; - if (!desc->smart_poll_wq) - return; - - wq = desc->smart_poll_wq; - desc->smart_poll_wq = NULL; - - if (wq) { - if (!cancel_delayed_work_sync(&desc->smart_poll_work)) - flush_workqueue(wq); - destroy_workqueue(wq); - } -} - static void leapraid_overheat_work(struct work_struct *work) { struct leapraid_overheat_desc *desc; @@ -3304,13 +2899,11 @@ static void leapraid_overheat_work(struct work_struct *work) adapter->scan_dev_desc.scan_start = 0; adapter->scan_dev_desc.wait_scan_dev_done = 0; adapter->scan_dev_desc.driver_loading = 0; - wake_up(&adapter->access_ctrl.recovery_waitq); wake_up(&adapter->access_ctrl.shost_recover_wq); wake_up(&adapter->scan_dev_desc.wait_driver_loading); leapraid_mask_int(adapter); - leapraid_smart_polling_stop(adapter); leapraid_check_scheduled_fault_stop(adapter); leapraid_fw_log_stop(adapter); leapraid_mq_polling_pause(adapter); @@ -3393,10 +2986,10 @@ static struct leapraid_fw_evt_work *leapraid_alloc_fw_evt_work(void) { struct leapraid_fw_evt_work *fw_evt = kzalloc(sizeof(*fw_evt), GFP_ATOMIC); - if (!fw_evt) - return NULL; - kref_init(&fw_evt->refcnt); + if (fw_evt) + kref_init(&fw_evt->refcnt); + return fw_evt; } @@ -3413,10 +3006,14 @@ static void leapraid_fw_evt_add(struct leapraid_adapter *adapter, { unsigned long flags; - if (!adapter->fw_evt_s.fw_evt_thread) + spin_lock_irqsave(&adapter->fw_evt_s.fw_evt_lock, flags); + if (adapter->access_ctrl.host_removing || + adapter->access_ctrl.pcie_recovering || + !adapter->fw_evt_s.fw_evt_thread) { + spin_unlock_irqrestore(&adapter->fw_evt_s.fw_evt_lock, flags); return; + } - spin_lock_irqsave(&adapter->fw_evt_s.fw_evt_lock, flags); leapraid_fw_evt_get(fw_evt); INIT_LIST_HEAD(&fw_evt->list); list_add_tail(&fw_evt->list, &adapter->fw_evt_s.fw_evt_list); @@ -3467,7 +3064,6 @@ void leapraid_clean_active_fw_evt(struct leapraid_adapter *adapter) return; adapter->fw_evt_s.fw_evt_cleanup = 1; - wake_up(&adapter->access_ctrl.recovery_waitq); if (adapter->access_ctrl.shost_recovering && adapter->fw_evt_s.cur_evt) adapter->fw_evt_s.cur_evt->ignore = 1; @@ -3742,8 +3338,6 @@ static struct leapraid_sas_dev *leapraid_init_sas_dev( sas_dev->dev_name = le64_to_cpu(sas_dev_pg0->dev_name); sas_dev->port_connection = sas_dev_pg0->max_port_connections; sas_dev->slot = sas_dev->enc_hdl ? le16_to_cpu(sas_dev_pg0->slot) : 0; - sas_dev->support_smart = (le16_to_cpu(sas_dev_pg0->flg) & - LEAPRAID_SAS_DEV_P0_FLG_SATA_SMART); if (le16_to_cpu(sas_dev_pg0->flg) & LEAPRAID_SAS_DEV_P0_FLG_ENC_LEVEL_VALID) { sas_dev->enc_level = sas_dev_pg0->enc_level; @@ -3991,11 +3585,11 @@ static int leapraid_refresh_card_phy(struct leapraid_adapter *adapter, return 0; if (le32_to_cpu(phy_pg0.phy_info) & - LEAPRAID_SAS_PHYINFO_VPHY && - !leapraid_alloc_vphy(adapter, port_id, i)) - return -EINVAL; - - card->card_phy[i].vphy = 1; + LEAPRAID_SAS_PHYINFO_VPHY) { + if (!leapraid_alloc_vphy(adapter, port_id, i)) + return -ENOMEM; + card->card_phy[i].vphy = 1; + } } card->card_phy[i].hdl = card->hdl; @@ -4382,7 +3976,7 @@ void leapraid_exp_rm(struct leapraid_adapter *adapter, u64 sas_addr, leapraid_exp_node_rm(adapter, topo_node_exp); } -static int leapraid_internal_sas_topo_chg_evt( +static void leapraid_internal_sas_topo_chg_evt( struct leapraid_adapter *adapter, struct leapraid_card_port *card_port, struct leapraid_topo_node *topo_node_exp, @@ -4399,11 +3993,11 @@ static int leapraid_internal_sas_topo_chg_evt( evt_data = fw_evt->evt_data; for (i = 0; i < evt_data->entry_num; i++) { if (fw_evt->ignore) - return 0; + return; if (adapter->access_ctrl.host_removing || adapter->access_ctrl.pcie_recovering) - return 0; + return; phy_number = evt_data->start_phy_num + i; if (phy_number >= max_phys) @@ -4441,12 +4035,10 @@ static int leapraid_internal_sas_topo_chg_evt( if (evt_data->exp_status == LEAPRAID_EVT_SAS_TOPO_ES_NOT_RESPONDING && topo_node_exp) leapraid_exp_rm(adapter, sas_addr, card_port); - - return 0; } -static int leapraid_sas_topo_chg_evt(struct leapraid_adapter *adapter, - struct leapraid_fw_evt_work *fw_evt) +static void leapraid_sas_topo_chg_evt(struct leapraid_adapter *adapter, + struct leapraid_fw_evt_work *fw_evt) { struct leapraid_topo_node *topo_node_exp; struct leapraid_card_port *card_port; @@ -4459,13 +4051,13 @@ static int leapraid_sas_topo_chg_evt(struct leapraid_adapter *adapter, if (adapter->access_ctrl.shost_recovering || adapter->access_ctrl.host_removing || adapter->access_ctrl.pcie_recovering) - return 0; + return; evt_data = fw_evt->evt_data; leapraid_sas_host_add(adapter, adapter->dev_topo.card.phys_num > 0); if (fw_evt->ignore) - return 0; + return; phdl = le16_to_cpu(evt_data->exp_dev_hdl); card_port = leapraid_get_port_by_id(adapter, @@ -4473,7 +4065,7 @@ static int leapraid_sas_topo_chg_evt(struct leapraid_adapter *adapter, false); if (evt_data->exp_status == LEAPRAID_EVT_SAS_TOPO_ES_ADDED && leapraid_exp_add(adapter, phdl) != 0) - return 0; + return; spin_lock_irqsave(&adapter->dev_topo.topo_node_lock, flags); topo_node_exp = leapraid_exp_find_by_hdl(adapter, phdl); @@ -4487,13 +4079,13 @@ static int leapraid_sas_topo_chg_evt(struct leapraid_adapter *adapter, } else { spin_unlock_irqrestore(&adapter->dev_topo.topo_node_lock, flags); - return 0; + return; } spin_unlock_irqrestore(&adapter->dev_topo.topo_node_lock, flags); - return leapraid_internal_sas_topo_chg_evt(adapter, card_port, - topo_node_exp, fw_evt, - sas_addr, max_phys); + leapraid_internal_sas_topo_chg_evt(adapter, card_port, + topo_node_exp, fw_evt, + sas_addr, max_phys); } static void leapraid_reprobe_lun(struct scsi_device *sdev, void *no_uld_attach) @@ -4603,7 +4195,6 @@ static void leapraid_sas_pd_hide( } spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); if (starget) { - dev_info(&adapter->pdev->dev, "hide sas_dev, hdl=0x%x\n", hdl); starget_for_each_device(starget, (void *)LEAPRAID_NO_ULD_ATTACH_FLAG, leapraid_reprobe_lun); @@ -4623,7 +4214,6 @@ static void leapraid_sas_pd_expose( u16 hdl; hdl = le16_to_cpu(evt_data->phys_disk_dev_hdl); - if (!hdl || hdl > adapter->adapter_attr.features.max_dev_handle) { dev_warn(&adapter->pdev->dev, "%s: Invalid device handle\n", __func__); @@ -4652,10 +4242,8 @@ static void leapraid_sas_pd_expose( spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); if (starget) { - dev_info(&adapter->pdev->dev, - "expose sas_dev, hdl=0x%x\n", hdl); starget_for_each_device(starget, - LEAPRAID_ULD_ATTACH_FLAG, + NULL, leapraid_reprobe_lun); } @@ -4986,7 +4574,7 @@ static void leapraid_remove_unresp_sas_end_dev( leapraid_sdev_put(sas_dev); } - dev_info(&adapter->pdev->dev, + dev_warn(&adapter->pdev->dev, "Unresponsive SAS end devices removed\n"); } @@ -5011,7 +4599,7 @@ static void leapraid_remove_unresp_raid_volumes( leapraid_sas_volume_delete_by_ptr(adapter, raid_volume); } - dev_info(&adapter->pdev->dev, + dev_warn(&adapter->pdev->dev, "Unresponsive RAID volumes removed\n"); } @@ -5035,7 +4623,7 @@ static void leapraid_remove_unresp_sas_exp(struct leapraid_adapter *adapter) &head, list) leapraid_exp_node_rm(adapter, topo_node_exp); - dev_info(&adapter->pdev->dev, + dev_warn(&adapter->pdev->dev, "Unresponsive SAS expanders removed\n"); } @@ -5153,8 +4741,6 @@ static void leapraid_scan_exp_after_reset(struct leapraid_adapter *adapter) u16 hdl; u8 port_id; - dev_info(&adapter->pdev->dev, "Begin scanning expanders\n"); - cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (hdl = 0xFFFF, cfgp2.handle = hdl; !leapraid_op_config_page(adapter, &exp_p0, cfgp1, cfgp2, @@ -5185,8 +4771,6 @@ static void leapraid_scan_exp_after_reset(struct leapraid_adapter *adapter) exp_p0.sas_address)); } } - - dev_info(&adapter->pdev->dev, "Expanders scan complete\n"); } static void leapraid_scan_phy_disks_after_reset( @@ -5203,8 +4787,6 @@ static void leapraid_scan_phy_disks_after_reset( u16 hdl, parent_hdl; u64 sas_addr; - dev_info(&adapter->pdev->dev, "Begin scanning phys disk\n"); - cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (phys_disk_num = 0xFF, cfgp2.form_specific = phys_disk_num; !leapraid_op_config_page(adapter, &raidpd_p0, @@ -5253,8 +4835,6 @@ static void leapraid_scan_phy_disks_after_reset( } } } - - dev_info(&adapter->pdev->dev, "PHYs disk scan complete\n"); } static void leapraid_scan_vol_after_reset(struct leapraid_adapter *adapter) @@ -5279,7 +4859,6 @@ static void leapraid_scan_vol_after_reset(struct leapraid_adapter *adapter) return; } - dev_info(&adapter->pdev->dev, "Begin scanning volumes\n"); cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (hdl = 0xFFFF, cfgp2.handle = hdl; !leapraid_op_config_page(adapter, vol_p1, cfgp1, @@ -5316,8 +4895,6 @@ static void leapraid_scan_vol_after_reset(struct leapraid_adapter *adapter) kfree(vol_p0); kfree(vol_p1); - - dev_info(&adapter->pdev->dev, "Volumes scan complete\n"); } static void leapraid_scan_sas_dev_after_reset(struct leapraid_adapter *adapter) @@ -5330,9 +4907,6 @@ static void leapraid_scan_sas_dev_after_reset(struct leapraid_adapter *adapter) u64 sas_address; u8 port_id; - dev_info(&adapter->pdev->dev, - "Begin scanning SAS end devices\n"); - cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (hdl = 0xFFFF, cfgp2.handle = hdl; !leapraid_op_config_page(adapter, &sas_dev_p0, cfgp1, cfgp2, @@ -5382,14 +4956,10 @@ static void leapraid_scan_sas_dev_after_reset(struct leapraid_adapter *adapter) sas_dev_p0.sas_address)); } } - - dev_info(&adapter->pdev->dev, "SAS end devices scan complete\n"); } static void leapraid_scan_all_dev_after_reset(struct leapraid_adapter *adapter) { - dev_info(&adapter->pdev->dev, "Begin scanning devices\n"); - leapraid_sas_host_add(adapter, adapter->dev_topo.card.phys_num > 0); leapraid_scan_exp_after_reset(adapter); if (adapter->adapter_attr.raid_support) { @@ -5397,8 +4967,6 @@ static void leapraid_scan_all_dev_after_reset(struct leapraid_adapter *adapter) leapraid_scan_vol_after_reset(adapter); } leapraid_scan_sas_dev_after_reset(adapter); - - dev_info(&adapter->pdev->dev, "Devices scan complete\n"); } static void leapraid_hardreset_async_logic(struct leapraid_adapter *adapter) @@ -5426,6 +4994,7 @@ static int leapraid_send_enc_cmd(struct leapraid_adapter *adapter, void *req; bool reset_flg = false; int rc; + u16 smid; mutex_lock(&adapter->driver_cmds.enc_cmd.mutex); rc = leapraid_check_adapter_is_op(adapter, LEAPRAID_DB_WAIT_OP_SHORT, @@ -5434,21 +5003,19 @@ static int leapraid_send_enc_cmd(struct leapraid_adapter *adapter, goto unlock; adapter->driver_cmds.enc_cmd.status = LEAPRAID_CMD_PENDING; - req = leapraid_get_task_desc( - adapter, - adapter->driver_cmds.enc_cmd.inter_taskid); + smid = adapter->driver_cmds.enc_cmd.inter_taskid; + req = leapraid_get_task_desc(adapter, smid); memset(req, 0, LEAPRAID_REQUEST_SIZE); memcpy(req, sep_req, sizeof(struct leapraid_sep_req)); init_completion(&adapter->driver_cmds.enc_cmd.done); - leapraid_fire_task(adapter, - adapter->driver_cmds.enc_cmd.inter_taskid); + leapraid_fire_task(adapter, smid); wait_for_completion_timeout(&adapter->driver_cmds.enc_cmd.done, LEAPRAID_ENC_CMD_TIMEOUT * HZ); if (!(adapter->driver_cmds.enc_cmd.status & LEAPRAID_CMD_DONE)) { dev_err(&adapter->pdev->dev, "%s: SEP command timeout, status=0x%x\n", __func__, adapter->driver_cmds.enc_cmd.status); - leapraid_log_req_context(adapter, sep_req); + leapraid_log_req_context(adapter, smid, sep_req); reset_flg = leapraid_check_reset( adapter->driver_cmds.enc_cmd.status); @@ -5512,10 +5079,10 @@ static int leapraid_wait_adapter_recovery(struct leapraid_adapter *adapter) { unsigned long flags; - while (scsi_host_in_recovery(adapter->shost) || - adapter->access_ctrl.shost_recovering) { - if (adapter->access_ctrl.host_removing || - adapter->fw_evt_s.fw_evt_cleanup) { + while (leapraid_shost_in_recovery(adapter->shost) || + READ_ONCE(adapter->access_ctrl.shost_recovering)) { + if (READ_ONCE(adapter->access_ctrl.host_removing) || + READ_ONCE(adapter->fw_evt_s.fw_evt_cleanup)) { spin_lock_irqsave( &adapter->reset_desc.adapter_reset_lock, flags); @@ -5535,12 +5102,13 @@ static int leapraid_wait_adapter_recovery(struct leapraid_adapter *adapter) return -EFAULT; } - wait_event_timeout(adapter->access_ctrl.recovery_waitq, - !adapter->access_ctrl.shost_recovering || - adapter->access_ctrl.host_removing || - adapter->fw_evt_s.fw_evt_cleanup, - msecs_to_jiffies(1000)); + wait_event_timeout( + adapter->access_ctrl.recovery_waitq, + (!leapraid_shost_in_recovery(adapter->shost) && + !READ_ONCE(adapter->access_ctrl.shost_recovering)), + msecs_to_jiffies(1000)); } + return 0; } @@ -5625,7 +5193,6 @@ static void leapraid_sas_dev_stat_chg_evt( leapraid_get_port_by_id(adapter, event_data->physical_port, false)); - if (!sas_dev || !sas_dev->starget) goto out_unlock; @@ -5755,6 +5322,80 @@ static void leapraid_check_topo_del_evts( leapraid_topo_del_evts_process_exp_status(adapter, evt_data); } +static bool leapraid_async_evt_validate( + struct leapraid_adapter *adapter, + struct leapraid_evt_notify_rep *event_notify_rep) +{ + size_t msg_len; + size_t evt_sz; + size_t evt_avail; + u16 evt; + + msg_len = event_notify_rep->msg_len * sizeof(u32); + if (msg_len > LEAPRAID_REPLY_SIZE || + msg_len < offsetof(struct leapraid_evt_notify_rep, evt_data)) { + dev_warn(&adapter->pdev->dev, + "%s: Invalid async event msg_len=%zu\n", + __func__, msg_len); + return false; + } + + evt_sz = le16_to_cpu(event_notify_rep->evt_data_len) * sizeof(u32); + evt_avail = msg_len - + offsetof(struct leapraid_evt_notify_rep, evt_data); + if (evt_sz > evt_avail) { + dev_warn(&adapter->pdev->dev, + "%s: Invalid async event evt_data_len=%zu\n", + __func__, evt_sz); + return false; + } + + evt = le16_to_cpu(event_notify_rep->evt); + switch (evt) { + case LEAPRAID_EVT_SAS_DEV_STATUS_CHANGE: + if (evt_sz < + sizeof(struct leapraid_evt_data_sas_dev_status_change)) + goto invalid_evt_sz; + break; + case LEAPRAID_EVT_IR_CHANGE: + if (evt_sz < sizeof(struct leapraid_evt_data_ir_change)) + goto invalid_evt_sz; + break; + case LEAPRAID_EVT_SAS_TOPO_CHANGE_LIST: + { + struct leapraid_evt_data_sas_topo_change_list *evt_data = + (void *)event_notify_rep->evt_data; + size_t hdr_sz; + + hdr_sz = + offsetof(struct leapraid_evt_data_sas_topo_change_list, + phy); + if (evt_sz < hdr_sz) + goto invalid_evt_sz; + + if (evt_data->entry_num > + (evt_sz - hdr_sz) / sizeof(evt_data->phy[0])) + goto invalid_evt_sz; + break; + } + case LEAPRAID_EVT_SAS_ENCL_DEV_STATUS_CHANGE: + if (evt_sz < + sizeof(struct leapraid_evt_data_sas_enc_dev_status_change)) + goto invalid_evt_sz; + break; + default: + break; + } + + return true; + +invalid_evt_sz: + dev_warn(&adapter->pdev->dev, + "%s: Invalid async event size=%zu for evt=0x%x\n", + __func__, evt_sz, evt); + return false; +} + static bool leapraid_async_process_evt( struct leapraid_adapter *adapter, struct leapraid_evt_notify_rep *event_notify_rep) @@ -5762,6 +5403,10 @@ static bool leapraid_async_process_evt( u16 evt = le16_to_cpu(event_notify_rep->evt); bool exit_flag = false; + if (adapter->access_ctrl.host_removing || + adapter->access_ctrl.pcie_recovering) + return true; + switch (evt) { case LEAPRAID_EVT_SAS_DEV_STATUS_CHANGE: leapraid_sas_dev_stat_chg_evt( @@ -5824,13 +5469,17 @@ static void leapraid_async_evt_cb(struct leapraid_adapter *adapter, { struct leapraid_evt_notify_rep *evt_notify_rep; - if (adapter->access_ctrl.pcie_recovering) + if (adapter->access_ctrl.host_removing || + adapter->access_ctrl.pcie_recovering) return; evt_notify_rep = leapraid_get_reply_vaddr(adapter, rep_paddr); if (unlikely(!evt_notify_rep)) return; + if (!leapraid_async_evt_validate(adapter, evt_notify_rep)) + return; + if (leapraid_async_process_evt(adapter, evt_notify_rep)) return; @@ -5895,9 +5544,9 @@ static void leapraid_scan_dev_complete(struct leapraid_adapter *adapter) leapraid_fw_evt_put(fw_evt); } -static u8 leapraid_handle_scan_cb(struct leapraid_adapter *adapter, - struct leapraid_driver_cmd *cmd, - struct leapraid_rep *rep) +static void leapraid_handle_scan_cb(struct leapraid_adapter *adapter, + struct leapraid_driver_cmd *cmd, + struct leapraid_rep *rep) { u16 status; @@ -5905,21 +5554,18 @@ static u8 leapraid_handle_scan_cb(struct leapraid_adapter *adapter, status = le16_to_cpu(rep->adapter_status) & LEAPRAID_ADAPTER_STATUS_MASK; - if (status != LEAPRAID_ADAPTER_STATUS_SUCCESS) adapter->scan_dev_desc.scan_dev_failed = 1; if (!cmd->async_scan_dev) { complete(&cmd->done); - return 1; + return; } if (status == LEAPRAID_ADAPTER_STATUS_SUCCESS) leapraid_scan_dev_complete(adapter); else adapter->scan_dev_desc.scan_start_failed = status; - - return 1; } static void leapraid_handle_ctl_cb(struct leapraid_adapter *adapter, @@ -5933,7 +5579,6 @@ static void leapraid_handle_ctl_cb(struct leapraid_adapter *adapter, return; scsiio_reply = (struct leapraid_scsiio_rep *)rep; - if (!(scsiio_reply->scsi_state & LEAPRAID_SCSI_STATE_AUTOSENSE_VALID)) return; @@ -5976,10 +5621,11 @@ static bool leapraid_driver_cmds_done(struct leapraid_adapter *adapter, memcpy(&_sp_cmd->reply, leap_mpi_rep, reply_len); _sp_cmd->status |= LEAPRAID_CMD_REPLY_VALID; - if (_sp_cmd->cb_idx == LEAPRAID_SCAN_DEV_CB_IDX) - return leapraid_handle_scan_cb(adapter, - _sp_cmd, - leap_mpi_rep); + if (_sp_cmd->cb_idx == LEAPRAID_SCAN_DEV_CB_IDX) { + leapraid_handle_scan_cb(adapter, _sp_cmd, + leap_mpi_rep); + return true; + } if (_sp_cmd->cb_idx == LEAPRAID_CTL_CB_IDX) leapraid_handle_ctl_cb(adapter, leap_mpi_rep, taskid); @@ -5994,8 +5640,9 @@ static bool leapraid_driver_cmds_done(struct leapraid_adapter *adapter, static void leapraid_complete_task(struct leapraid_adapter *adapter, u16 taskid, u8 msix_idx, u32 rep) { - if (taskid <= adapter->shost->can_queue || - taskid == adapter->driver_cmds.driver_scsiio_cmd.taskid) { + bool scsiio_task = taskid <= adapter->shost->can_queue; + + if (scsiio_task) { if (leapraid_scsiio_done(adapter, taskid, msix_idx, rep)) leapraid_free_taskid(adapter, taskid); return; @@ -6175,6 +5822,22 @@ void leapraid_sync_irqs(struct leapraid_adapter *adapter, bool poll) } } +static void leapraid_sync_irqs_for_cleanup(struct leapraid_adapter *adapter) +{ + struct leapraid_notification_desc *desc = &adapter->notification_desc; + struct leapraid_int_rq *int_rq; + unsigned int i; + + if (!adapter->mask_int && leapraid_pci_active(adapter)) + leapraid_mask_int(adapter); + + for (i = 0; i < desc->int_rqs_allocated; i++) { + int_rq = &desc->int_rqs[i]; + synchronize_irq(pci_irq_vector(adapter->pdev, + int_rq->rq.msix_idx)); + } +} + void leapraid_mq_polling_pause(struct leapraid_adapter *adapter) { struct leapraid_notification_desc *desc; @@ -6245,7 +5908,6 @@ static int leapraid_host_diag_reset(struct leapraid_adapter *adapter) { u32 host_diag; - dev_info(&adapter->pdev->dev, "Entering host diag reset!\n"); pci_cfg_access_lock(adapter->pdev); mutex_lock(&adapter->reset_desc.host_diag_mutex); @@ -6269,14 +5931,13 @@ static int leapraid_host_diag_reset(struct leapraid_adapter *adapter) goto out_failed; pci_cfg_access_unlock(adapter->pdev); - dev_info(&adapter->pdev->dev, "Host diag success!\n"); return 0; out_cleanup: mutex_unlock(&adapter->reset_desc.host_diag_mutex); out_failed: pci_cfg_access_unlock(adapter->pdev); - dev_info(&adapter->pdev->dev, "Host diag failed!\n"); + dev_err(&adapter->pdev->dev, "Host diag failed\n"); return -EFAULT; } @@ -6791,11 +6452,8 @@ static void leapraid_search_resp_sas_dev(struct leapraid_adapter *adapter) struct leapraid_sas_dev_p0 sas_dev_p0; u32 device_info; - dev_info(&adapter->pdev->dev, - "Begin searching for SAS end devices\n"); - if (list_empty(&adapter->dev_topo.sas_dev_list)) - goto exit_search; + return; cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (cfgp2.handle = 0xFFFF; @@ -6808,9 +6466,6 @@ static void leapraid_search_resp_sas_dev(struct leapraid_adapter *adapter) leapraid_mark_resp_sas_dev(adapter, &sas_dev_p0); } -exit_search: - dev_info(&adapter->pdev->dev, - "SAS end devices searching complete\n"); } static void leapraid_mark_resp_raid_volume(struct leapraid_adapter *adapter, @@ -6879,14 +6534,11 @@ static void leapraid_search_resp_raid_volume(struct leapraid_adapter *adapter) if (!adapter->adapter_attr.raid_support) return; - dev_info(&adapter->pdev->dev, - "Begin searching for RAID volumes\n"); - spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); is_empty = list_empty(&adapter->dev_topo.raid_volume_list); spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); if (is_empty) - goto exit_search; + return; cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (hdl = 0xFFFF, cfgp2.handle = hdl; @@ -6924,9 +6576,6 @@ static void leapraid_search_resp_raid_volume(struct leapraid_adapter *adapter) else set_bit(hdl, adapter->dev_topo.pd_hdls); } -exit_search: - dev_info(&adapter->pdev->dev, - "RAID volumes searching complete\n"); } static void leapraid_mark_resp_exp(struct leapraid_adapter *adapter, @@ -6987,10 +6636,8 @@ static void leapraid_search_resp_exp(struct leapraid_adapter *adapter) u16 hdl; u8 port; - dev_dbg(&adapter->pdev->dev, - "Begin searching for expanders\n"); if (list_empty(&adapter->dev_topo.exp_list)) - goto exit_search; + return; cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (hdl = 0xFFFF, cfgp2.handle = hdl; @@ -7008,9 +6655,6 @@ static void leapraid_search_resp_exp(struct leapraid_adapter *adapter) LEAPRAID_DISABLE_MP_PORT_ID); leapraid_mark_resp_exp(adapter, &exp_p0); } -exit_search: - dev_dbg(&adapter->pdev->dev, - "Expander searching complete\n"); } void leapraid_wait_cmds_done(struct leapraid_adapter *adapter) @@ -7057,6 +6701,15 @@ int leapraid_hard_reset_handler(struct leapraid_adapter *adapter, mutex_lock(&adapter->reset_desc.adapter_reset_mutex); + if (adapter->access_ctrl.shost_recover_async) { + rc = adapter->reset_desc.adapter_reset_results; + dev_info(&adapter->pdev->dev, + "Skip nested hard reset, async evt running, rc=%d\n", + rc); + mutex_unlock(&adapter->reset_desc.adapter_reset_mutex); + return rc; + } + if (!leapraid_pci_active(adapter)) { if (leapraid_pci_removed(adapter)) { dev_info(&adapter->pdev->dev, @@ -7099,7 +6752,6 @@ int leapraid_hard_reset_handler(struct leapraid_adapter *adapter, dev_err(&adapter->pdev->dev, "Previous device scan failed or driver loading\n"); adapter->access_ctrl.host_removing = 1; - wake_up(&adapter->access_ctrl.recovery_waitq); rc = -EFAULT; goto out_cleanup; } @@ -7120,8 +6772,8 @@ int leapraid_hard_reset_handler(struct leapraid_adapter *adapter, leapraid_hardreset_barrier(adapter); } out_cleanup: - dev_info(&adapter->pdev->dev, "Hard reset %s\n", - rc == 0 ? "SUCCESS" : "FAILED"); + if (rc) + dev_err(&adapter->pdev->dev, "Hard reset failed\n"); spin_lock_irqsave(&adapter->reset_desc.adapter_reset_lock, flags); adapter->reset_desc.adapter_reset_results = rc; @@ -7253,9 +6905,17 @@ static int leapraid_get_adapter_features(struct leapraid_adapter *adapter) fw_major, fw_minor, fw_build, fw_release, adapter->adapter_attr.features.fw_version); - if (fw_major < 2) { - dev_err(&adapter->pdev->dev, - "Unsupported firmware major version, requires >= 2\n"); + adapter->adapter_attr.features.msg_ver = + le16_to_cpu(leap_mpi_rep.msg_ver); + adapter->adapter_attr.features.product_id = + le16_to_cpu(leap_mpi_rep.product_id); + dev_info(&adapter->pdev->dev, + "message version: 0x%x, product id 0x%x\n", + adapter->adapter_attr.features.msg_ver, + adapter->adapter_attr.features.product_id); + + if (adapter->adapter_attr.features.msg_ver < 0x1000) { + dev_err(&adapter->pdev->dev, "Device not supported\n"); return -EFAULT; } adapter->shost->max_id = LEAPRAID_INVALID_INITIAL_VALUE; @@ -7340,13 +7000,16 @@ static void leapraid_cpus_on_irq(struct leapraid_adapter *adapter) index++) { int_rq = &adapter->notification_desc.int_rqs[index]; - if (cpu >= nr_cpus) + if (cpu >= adapter->notification_desc.msix_cpu_map_sz) break; this_group = base_group + (index < (nr_cpus % total_msix) ? 1 : 0); for (i = 0 ; i < this_group ; i++) { + if (cpu >= adapter->notification_desc.msix_cpu_map_sz) + break; + adapter->notification_desc.msix_cpu_map[cpu] = int_rq->rq.msix_idx; cpu = cpumask_next(cpu, cpu_online_mask); @@ -7358,8 +7021,8 @@ static void leapraid_map_msix_to_cpu(struct leapraid_adapter *adapter) { struct leapraid_int_rq *int_rq; const cpumask_t *affinity_mask; + int cpu; u32 i; - u16 cpu; if (!adapter->adapter_attr.rq_cnt) return; @@ -7377,16 +7040,29 @@ static void leapraid_map_msix_to_cpu(struct leapraid_adapter *adapter) for_each_cpu_and(cpu, affinity_mask, cpu_online_mask) { if (cpu >= adapter->notification_desc.msix_cpu_map_sz) - break; + continue; adapter->notification_desc.msix_cpu_map[cpu] = int_rq->rq.msix_idx; } } + return; out_apply_irq_affinity: leapraid_cpus_on_irq(adapter); } +static int leapraid_alloc_msix_cpu_map(struct leapraid_adapter *adapter) +{ + adapter->notification_desc.msix_cpu_map_sz = nr_cpu_ids; + adapter->notification_desc.msix_cpu_map = + kzalloc(adapter->notification_desc.msix_cpu_map_sz, + GFP_KERNEL); + if (!adapter->notification_desc.msix_cpu_map) + return -ENOMEM; + + return 0; +} + static void leapraid_configure_reply_queue_affinity( struct leapraid_adapter *adapter) { @@ -7436,16 +7112,16 @@ static void leapraid_free_irq(struct leapraid_adapter *adapter) static int leapraid_setup_irqs(struct leapraid_adapter *adapter) { + int irq_mode = adapter->notification_desc.irq_mode; unsigned int i; int rc = 0; - if (interrupt_mode == LEAPRAID_INTERRUPT_MODE_MSIX) { + if (irq_mode == LEAPRAID_INTERRUPT_MODE_MSIX) { rc = pci_alloc_irq_vectors_affinity( adapter->pdev, adapter->notification_desc.iopoll_qdex, adapter->notification_desc.iopoll_qdex, PCI_IRQ_MSIX | PCI_IRQ_AFFINITY, NULL); - if (rc < 0) { dev_err(&adapter->pdev->dev, "%d MSI/MSIX vectors allocated failed!\n", @@ -7454,20 +7130,18 @@ static int leapraid_setup_irqs(struct leapraid_adapter *adapter) } adapter->notification_desc.irq_vectors_allocated = 1; - adapter->notification_desc.irq_mode = - LEAPRAID_INTERRUPT_MODE_MSIX; } for (i = 0; i < adapter->notification_desc.iopoll_qdex; i++) { adapter->notification_desc.int_rqs[i].rq.adapter = adapter; adapter->notification_desc.int_rqs[i].rq.msix_idx = i; atomic_set(&adapter->notification_desc.int_rqs[i].rq.busy, 0); - if (interrupt_mode == LEAPRAID_INTERRUPT_MODE_MSIX) + if (irq_mode == LEAPRAID_INTERRUPT_MODE_MSIX) snprintf(adapter->notification_desc.int_rqs[i].rq.name, LEAPRAID_NAME_LENGTH, "%s%u-MSIx%u", LEAPRAID_DRIVER_NAME, adapter->adapter_attr.id, i); - else if (interrupt_mode == LEAPRAID_INTERRUPT_MODE_MSI) + else if (irq_mode == LEAPRAID_INTERRUPT_MODE_MSI) snprintf(adapter->notification_desc.int_rqs[i].rq.name, LEAPRAID_NAME_LENGTH, "%s%u-MSI%u", LEAPRAID_DRIVER_NAME, @@ -7478,7 +7152,6 @@ static int leapraid_setup_irqs(struct leapraid_adapter *adapter) IRQF_SHARED, adapter->notification_desc.int_rqs[i].rq.name, &adapter->notification_desc.int_rqs[i].rq); - if (rc) { dev_err(&adapter->pdev->dev, "MSI/MSIx: request_irq %s failed!\n", @@ -7538,12 +7211,9 @@ static int leapraid_set_legacy_int(struct leapraid_adapter *adapter) { int rc; - adapter->notification_desc.msix_cpu_map_sz = num_online_cpus(); - adapter->notification_desc.msix_cpu_map = - kzalloc(adapter->notification_desc.msix_cpu_map_sz, - GFP_KERNEL); - if (!adapter->notification_desc.msix_cpu_map) - return -ENOMEM; + rc = leapraid_alloc_msix_cpu_map(adapter); + if (rc) + return rc; adapter->adapter_attr.rq_cnt = 1; adapter->notification_desc.iopoll_qdex = @@ -7560,9 +7230,7 @@ static int leapraid_set_legacy_int(struct leapraid_adapter *adapter) if (!adapter->notification_desc.int_rqs) return -ENOMEM; - rc = leapraid_setup_legacy_int(adapter); - - return rc; + return leapraid_setup_legacy_int(adapter); } static int leapraid_set_msix(struct leapraid_adapter *adapter) @@ -7571,14 +7239,11 @@ static int leapraid_set_msix(struct leapraid_adapter *adapter) unsigned int i; int rc, msix_cnt; - if (msix_disable == 1) - goto apply_legacy_int; - msix_cnt = pci_msix_vec_count(adapter->pdev); if (msix_cnt <= 0 || adapter->adapter_attr.features.max_msix_vectors == 0) { dev_info(&adapter->pdev->dev, "MSIX unsupported!\n"); - goto apply_legacy_int; + return -EOPNOTSUPP; } msix_cnt = min_t(int, msix_cnt, @@ -7648,31 +7313,20 @@ static int leapraid_set_msix(struct leapraid_adapter *adapter) 0); } - adapter->notification_desc.msix_cpu_map_sz = - num_online_cpus(); - adapter->notification_desc.msix_cpu_map = - kzalloc(adapter->notification_desc.msix_cpu_map_sz, - GFP_KERNEL); - if (!adapter->notification_desc.msix_cpu_map) - return -ENOMEM; - - memset(adapter->notification_desc.msix_cpu_map, 0, - adapter->notification_desc.msix_cpu_map_sz); + rc = leapraid_alloc_msix_cpu_map(adapter); + if (rc) + return rc; + adapter->notification_desc.irq_mode = LEAPRAID_INTERRUPT_MODE_MSIX; adapter->notification_desc.msix_enable = 1; rc = leapraid_setup_irqs(adapter); if (rc) { leapraid_free_irq(adapter); adapter->notification_desc.msix_enable = 0; - goto apply_legacy_int; + return rc; } return 0; - -apply_legacy_int: - rc = leapraid_set_legacy_int(adapter); - - return rc; } static int leapraid_set_msi(struct leapraid_adapter *adapter) @@ -7681,14 +7335,11 @@ static int leapraid_set_msi(struct leapraid_adapter *adapter) unsigned int i; int rc, msi_cnt; - if (msix_disable == 1) - goto apply_legacy_int; - msi_cnt = pci_msi_vec_count(adapter->pdev); if (msi_cnt <= 0 || adapter->adapter_attr.features.max_msix_vectors == 0) { dev_info(&adapter->pdev->dev, "MSI unsupported!\n"); - goto apply_legacy_int; + return -EOPNOTSUPP; } msi_cnt = min_t(int, msi_cnt, @@ -7738,10 +7389,9 @@ static int leapraid_set_msi(struct leapraid_adapter *adapter) "%d MSI vectors allocated failed!\n", adapter->notification_desc.iopoll_qdex); leapraid_free_irq(adapter); - goto apply_legacy_int; + return rc; } adapter->notification_desc.irq_vectors_allocated = 1; - adapter->notification_desc.irq_mode = LEAPRAID_INTERRUPT_MODE_MSI; if (rc != adapter->notification_desc.iopoll_qdex) { adapter->notification_desc.iopoll_qdex = rc; adapter->adapter_attr.rq_cnt = @@ -7781,51 +7431,46 @@ static int leapraid_set_msi(struct leapraid_adapter *adapter) 0); } - adapter->notification_desc.msix_cpu_map_sz = num_online_cpus(); - adapter->notification_desc.msix_cpu_map = - kzalloc(adapter->notification_desc.msix_cpu_map_sz, - GFP_KERNEL); - if (!adapter->notification_desc.msix_cpu_map) - return -ENOMEM; - memset(adapter->notification_desc.msix_cpu_map, 0, - adapter->notification_desc.msix_cpu_map_sz); + rc = leapraid_alloc_msix_cpu_map(adapter); + if (rc) + return rc; + adapter->notification_desc.irq_mode = LEAPRAID_INTERRUPT_MODE_MSI; adapter->notification_desc.msix_enable = 1; rc = leapraid_setup_irqs(adapter); if (rc) { leapraid_free_irq(adapter); adapter->notification_desc.msix_enable = 0; - goto apply_legacy_int; + return rc; } return 0; - -apply_legacy_int: - rc = leapraid_set_legacy_int(adapter); - - return rc; } -static int leapraid_set_notification(struct leapraid_adapter *adapter) +static int leapraid_set_notification_auto(struct leapraid_adapter *adapter) { - int rc = 0; + int rc; - if (interrupt_mode == LEAPRAID_INTERRUPT_MODE_MSIX) { - rc = leapraid_set_msix(adapter); - if (rc) - dev_err(&adapter->pdev->dev, - "%s: Enable MSI-X irq failed!\n", __func__); - } else if (interrupt_mode == LEAPRAID_INTERRUPT_MODE_MSI) { - rc = leapraid_set_msi(adapter); - if (rc) - dev_err(&adapter->pdev->dev, - "%s: Enable MSI irq failed!\n", __func__); - } else if (interrupt_mode == LEAPRAID_INTERRUPT_MODE_LEGACY) { - rc = leapraid_set_legacy_int(adapter); - if (rc) - dev_err(&adapter->pdev->dev, - "%s: Enable legacy irq failed!\n", __func__); - } + rc = leapraid_set_msix(adapter); + if (!rc) + return 0; + + leapraid_free_irq(adapter); + dev_info(&adapter->pdev->dev, + "MSI-X setup failed (%d), trying MSI\n", rc); + + rc = leapraid_set_msi(adapter); + if (!rc) + return 0; + + leapraid_free_irq(adapter); + dev_info(&adapter->pdev->dev, + "MSI setup failed (%d), back to legacy INTx\n", rc); + + rc = leapraid_set_legacy_int(adapter); + if (rc) + dev_err(&adapter->pdev->dev, + "%s: Enable legacy irq failed!\n", __func__); return rc; } @@ -7852,7 +7497,7 @@ int leapraid_set_pcie_and_notification(struct leapraid_adapter *adapter) goto out_fail; } - rc = leapraid_set_notification(adapter); + rc = leapraid_set_notification_auto(adapter); if (rc) goto out_fail; @@ -7886,18 +7531,16 @@ static int leapraid_adapter_unit_reset(struct leapraid_adapter *adapter) { int rc = 0; - dev_info(&adapter->pdev->dev, "fire unit reset\n"); writel(LEAPRAID_FUNC_ADAPTER_UNIT_RESET << LEAPRAID_DB_FUNC_SHIFT, &adapter->iomem_base->db); if (leapraid_db_wait_ack_and_clear_int(adapter)) rc = -EFAULT; if (!leapraid_wait_adapter_ready(adapter)) { - dev_info(&adapter->pdev->dev, "unit reset: FAILED\n"); + dev_err(&adapter->pdev->dev, "unit reset failed\n"); return -EFAULT; } - dev_info(&adapter->pdev->dev, "unit reset: SUCCESS\n"); return rc; } @@ -7905,7 +7548,6 @@ static int leapraid_make_adapter_ready(struct leapraid_adapter *adapter, enum reset_type type) { u32 db; - int rc; int count; if (!leapraid_pci_active(adapter)) @@ -7944,8 +7586,7 @@ static int leapraid_make_adapter_ready(struct leapraid_adapter *adapter, return 0; full_reset: - rc = leapraid_host_diag_reset(adapter); - return rc; + return leapraid_host_diag_reset(adapter); } static void leapraid_fw_log_exit(struct leapraid_adapter *adapter) @@ -7954,6 +7595,8 @@ static void leapraid_fw_log_exit(struct leapraid_adapter *adapter) return; if (adapter->fw_log_desc.fw_log_buffer) { + wait_event(adapter->fw_log_desc.mmap_waitq, + !atomic_read(&adapter->fw_log_desc.mmap_refcnt)); dma_free_coherent(&adapter->pdev->dev, (LEAPRAID_SYS_LOG_BUF_SIZE + LEAPRAID_SYS_LOG_BUF_RESERVE), @@ -8085,16 +7728,22 @@ static void leapraid_free_host_memory(struct leapraid_adapter *adapter) adapter->mem_desc.rep_desc_q_arr = NULL; } - for (i = 0; i < adapter->adapter_attr.rep_desc_q_seg_cnt; i++) + for (i = 0; i < adapter->adapter_attr.rep_desc_q_seg_cnt; i++) { + struct leapraid_mem_desc *mem_desc = + &adapter->mem_desc; kfree(adapter->mem_desc.rep_desc_seg_maint[i] .rep_desc_maint); + mem_desc->rep_desc_seg_maint[i].rep_desc_maint = NULL; + } kfree(adapter->mem_desc.rep_desc_seg_maint); + adapter->mem_desc.rep_desc_seg_maint = NULL; } kfree(adapter->mem_desc.taskid_to_uniq_tag); adapter->mem_desc.taskid_to_uniq_tag = NULL; dma_pool_destroy(adapter->mem_desc.sg_chain_pool); + adapter->mem_desc.sg_chain_pool = NULL; } static inline bool leapraid_is_in_same_4g_seg(dma_addr_t start, u32 size) @@ -8116,15 +7765,13 @@ int leapraid_internal_init_cmd_priv(struct leapraid_adapter *adapter, return 0; } -int leapraid_internal_exit_cmd_priv(struct leapraid_adapter *adapter, - struct leapraid_io_req_tracker *io_tracker) +void leapraid_internal_exit_cmd_priv(struct leapraid_adapter *adapter, + struct leapraid_io_req_tracker *io_tracker) { if (io_tracker && io_tracker->chain) dma_pool_free(adapter->mem_desc.sg_chain_pool, io_tracker->chain, io_tracker->chain_dma); - - return 0; } static int leapraid_request_host_memory(struct leapraid_adapter *adapter) @@ -8170,12 +7817,9 @@ static int leapraid_request_host_memory(struct leapraid_adapter *adapter) adapter->dynamic_task_desc.inter_cmd_qd; /* SCSI host can queue. */ adapter->shost->can_queue = adapter->adapter_attr.io_qd - - LEAPRAID_TASKID_OFFSET_SCSIIO_CMD; + LEAPRAID_TASKID_OFFSET_CTRL_CMD; adapter->driver_cmds.ctl_cmd.taskid = adapter->shost->can_queue + LEAPRAID_TASKID_OFFSET_CTRL_CMD; - adapter->driver_cmds.driver_scsiio_cmd.taskid = - adapter->shost->can_queue + - LEAPRAID_TASKID_OFFSET_SCSIIO_CMD; /* Allocate task descriptor. */ try_again: @@ -8203,7 +7847,6 @@ static int leapraid_request_host_memory(struct leapraid_adapter *adapter) return -ENOMEM; /* Allocate I/O tracker to SCSI I/O. */ - adapter->mem_desc.taskid_to_uniq_tag = kcalloc(adapter->shost->can_queue, sizeof(u16), GFP_KERNEL); if (!adapter->mem_desc.taskid_to_uniq_tag) @@ -8230,9 +7873,6 @@ static int leapraid_request_host_memory(struct leapraid_adapter *adapter) adapter->driver_cmds.transport_cmd.inter_taskid = adapter->dynamic_task_desc.inter_taskid + LEAPRAID_TASKID_OFFSET_TRANSPORT_CMD; - adapter->driver_cmds.timestamp_sync_cmd.inter_taskid = - adapter->dynamic_task_desc.inter_taskid + - LEAPRAID_TASKID_OFFSET_TIMESTAMP_SYNC_CMD; adapter->driver_cmds.enc_cmd.inter_taskid = adapter->dynamic_task_desc.inter_taskid + LEAPRAID_TASKID_OFFSET_ENC_CMD; @@ -8292,8 +7932,11 @@ static int leapraid_request_host_memory(struct leapraid_adapter *adapter) LEAPRAID_REPLY_SIZE, &adapter->mem_desc.rep_msg_dma, GFP_KERNEL); - if (!adapter->mem_desc.rep_msg) - return -ENOMEM; + if (!adapter->mem_desc.rep_msg) { + rc = -ENOMEM; + goto out_fail; + } + if (!leapraid_is_in_same_4g_seg(adapter->mem_desc.rep_msg_dma, adapter->adapter_attr.rep_msg_qd * LEAPRAID_REPLY_SIZE)) { @@ -8405,9 +8048,10 @@ static int leapraid_alloc_dev_topo_bitmaps(struct leapraid_adapter *adapter) { u16 pd_hdls_sz; - pd_hdls_sz = adapter->adapter_attr.features.max_dev_handle / - LEAPRAID_BITS_PER_BYTE; - pd_hdls_sz++; + pd_hdls_sz = + BITS_TO_LONGS( + adapter->adapter_attr.features.max_dev_handle + 1) * + sizeof(unsigned long); adapter->dev_topo.pd_hdls_sz = pd_hdls_sz; adapter->dev_topo.pd_hdls = @@ -8431,9 +8075,6 @@ static void leapraid_free_dev_topo_bitmaps(struct leapraid_adapter *adapter) static int leapraid_init_driver_cmds(struct leapraid_adapter *adapter) { - u32 buffer_size; - void *buffer; - INIT_LIST_HEAD(&adapter->driver_cmds.special_cmd_list); adapter->driver_cmds.scan_dev_cmd.status = LEAPRAID_CMD_NOT_USED; @@ -8453,45 +8094,6 @@ static int leapraid_init_driver_cmds(struct leapraid_adapter *adapter) list_add_tail(&adapter->driver_cmds.transport_cmd.list, &adapter->driver_cmds.special_cmd_list); - adapter->driver_cmds.timestamp_sync_cmd.status = LEAPRAID_CMD_NOT_USED; - adapter->driver_cmds.timestamp_sync_cmd.cb_idx = - LEAPRAID_TIMESTAMP_SYNC_CB_IDX; - mutex_init(&adapter->driver_cmds.timestamp_sync_cmd.mutex); - list_add_tail(&adapter->driver_cmds.timestamp_sync_cmd.list, - &adapter->driver_cmds.special_cmd_list); - - adapter->driver_cmds.raid_action_cmd.status = LEAPRAID_CMD_NOT_USED; - adapter->driver_cmds.raid_action_cmd.cb_idx = - LEAPRAID_RAID_ACTION_CB_IDX; - mutex_init(&adapter->driver_cmds.raid_action_cmd.mutex); - list_add_tail(&adapter->driver_cmds.raid_action_cmd.list, - &adapter->driver_cmds.special_cmd_list); - - adapter->driver_cmds.driver_scsiio_cmd.status = LEAPRAID_CMD_NOT_USED; - adapter->driver_cmds.driver_scsiio_cmd.cb_idx = - LEAPRAID_DRIVER_SCSIIO_CB_IDX; - mutex_init(&adapter->driver_cmds.driver_scsiio_cmd.mutex); - list_add_tail(&adapter->driver_cmds.driver_scsiio_cmd.list, - &adapter->driver_cmds.special_cmd_list); - - buffer_size = sizeof(struct scsi_cmnd) + - sizeof(struct leapraid_io_req_tracker) + - SCSI_SENSE_BUFFERSIZE + - sizeof(struct scatterlist); - buffer = kzalloc(buffer_size, GFP_KERNEL); - if (!buffer) - return -ENOMEM; - - adapter->driver_cmds.internal_scmd = buffer; - buffer = (u8 *)buffer + sizeof(struct scsi_cmnd) + - sizeof(struct leapraid_io_req_tracker); - adapter->driver_cmds.internal_scmd->sense_buffer = - (unsigned char *)buffer; - buffer = (u8 *)buffer + SCSI_SENSE_BUFFERSIZE; - adapter->driver_cmds.internal_scmd->sdb.table.sgl = - (struct scatterlist *)buffer; - buffer = (u8 *)buffer + sizeof(struct scatterlist); - adapter->driver_cmds.enc_cmd.status = LEAPRAID_CMD_NOT_USED; adapter->driver_cmds.enc_cmd.cb_idx = LEAPRAID_ENC_CB_IDX; mutex_init(&adapter->driver_cmds.enc_cmd.mutex); @@ -8635,7 +8237,6 @@ static int leapraid_send_adapter_init(struct leapraid_adapter *adapter) rc = -EIO; } - adapter->timestamp_sync_cnt = 0; return rc; } @@ -8643,48 +8244,52 @@ static int leapraid_cfg_pages(struct leapraid_adapter *adapter) { union cfg_param_1 cfgp1 = {0}; union cfg_param_2 cfgp2 = {0}; - struct leapraid_manufacturing_p0 manufacturing_page0; - struct leapraid_bios_page3 bios_page3; - struct leapraid_bios_page2 bios_page2; + union { + struct leapraid_manufacturing_p0 manufacturing_page0; + struct leapraid_bios_page3 bios_page3; + struct leapraid_bios_page2 bios_page2; + } cfg_page; int rc; - rc = leapraid_op_config_page(adapter, &bios_page3, cfgp1, + rc = leapraid_op_config_page(adapter, &cfg_page.bios_page3, cfgp1, cfgp2, GET_BIOS_PG3); if (rc) return rc; - rc = leapraid_op_config_page(adapter, &bios_page2, cfgp1, - cfgp2, GET_BIOS_PG2); - if (rc) - return rc; + adapter->adapter_attr.bios_version = + le32_to_cpu(cfg_page.bios_page3.bios_version); - rc = leapraid_op_config_page(adapter, &manufacturing_page0, cfgp1, - cfgp2, GET_MANUFACTURING_PG0); + rc = leapraid_op_config_page(adapter, &cfg_page.bios_page2, cfgp1, + cfgp2, GET_BIOS_PG2); if (rc) return rc; - adapter->adapter_attr.bios_version = - le32_to_cpu(bios_page3.bios_version); - snprintf(adapter->adapter_attr.board_name, - sizeof(adapter->adapter_attr.board_name), - "%.*s", - (int)sizeof(manufacturing_page0.board_name), - manufacturing_page0.board_name); adapter->boot_devs.requested_boot_dev.form = - bios_page2.requested_boot_dev_form; + cfg_page.bios_page2.requested_boot_dev_form; memcpy(adapter->boot_devs.requested_boot_dev.pg_dev, - &bios_page2.requested_boot_dev, + &cfg_page.bios_page2.requested_boot_dev, LEAPRAID_BOOT_DEV_SIZE); adapter->boot_devs.requested_alt_boot_dev.form = - bios_page2.requested_alt_boot_dev_form; + cfg_page.bios_page2.requested_alt_boot_dev_form; memcpy(adapter->boot_devs.requested_alt_boot_dev.pg_dev, - &bios_page2.requested_alt_boot_dev, + &cfg_page.bios_page2.requested_alt_boot_dev, LEAPRAID_BOOT_DEV_SIZE); adapter->boot_devs.current_boot_dev.form = - bios_page2.current_boot_dev_form; + cfg_page.bios_page2.current_boot_dev_form; memcpy(adapter->boot_devs.current_boot_dev.pg_dev, - &bios_page2.current_boot_dev, + &cfg_page.bios_page2.current_boot_dev, LEAPRAID_BOOT_DEV_SIZE); + + rc = leapraid_op_config_page(adapter, &cfg_page.manufacturing_page0, + cfgp1, cfgp2, GET_MANUFACTURING_PG0); + if (rc) + return rc; + + snprintf(adapter->adapter_attr.board_name, + sizeof(adapter->adapter_attr.board_name), + "%.*s", + (int)sizeof(cfg_page.manufacturing_page0.board_name), + cfg_page.manufacturing_page0.board_name); return rc; } @@ -8793,8 +8398,6 @@ int leapraid_scan_dev(struct leapraid_adapter *adapter, bool async_scan_dev) out_cleanup: adapter->driver_cmds.scan_dev_cmd.status = LEAPRAID_CMD_NOT_USED; - dev_info(&adapter->pdev->dev, - "Device scan %s\n", rc == 0 ? "SUCCESS" : "FAILED"); return rc; } @@ -8936,11 +8539,7 @@ static int leapraid_make_adapter_available(struct leapraid_adapter *adapter) return 0; } - rc = leapraid_scan_dev(adapter, false); - if (rc) - return rc; - - return rc; + return leapraid_scan_dev(adapter, false); } int leapraid_ctrl_init(struct leapraid_adapter *adapter) @@ -8948,6 +8547,12 @@ int leapraid_ctrl_init(struct leapraid_adapter *adapter) u32 cap; int rc; + rc = leapraid_init_driver_cmds(adapter); + if (rc) { + dev_err(&adapter->pdev->dev, "Init driver cmds failure\n"); + goto out_free; + } + rc = leapraid_set_pcie_and_notification(adapter); if (rc) goto out_free; @@ -8981,12 +8586,6 @@ int leapraid_ctrl_init(struct leapraid_adapter *adapter) goto out_free; } - rc = leapraid_init_driver_cmds(adapter); - if (rc) { - dev_err(&adapter->pdev->dev, "Init driver cmds failure\n"); - goto out_free; - } - leapraid_init_event_mask(adapter); rc = leapraid_make_adapter_available(adapter); @@ -9006,9 +8605,7 @@ int leapraid_ctrl_init(struct leapraid_adapter *adapter) out_free: adapter->access_ctrl.host_removing = 1; - wake_up(&adapter->access_ctrl.recovery_waitq); leapraid_fw_log_exit(adapter); - leapraid_free_internal_scsi_cmd(adapter); leapraid_disable_controller(adapter); leapraid_free_host_memory(adapter); leapraid_free_dev_topo_bitmaps(adapter); @@ -9022,18 +8619,9 @@ void leapraid_remove_ctrl(struct leapraid_adapter *adapter) leapraid_check_scheduled_fault_stop(adapter); leapraid_fw_log_stop(adapter); leapraid_fw_log_exit(adapter); - leapraid_free_internal_scsi_cmd(adapter); leapraid_disable_controller(adapter); leapraid_free_host_memory(adapter); leapraid_free_dev_topo_bitmaps(adapter); leapraid_free_enc_list(adapter); pci_set_drvdata(adapter->pdev, NULL); } - -void leapraid_free_internal_scsi_cmd(struct leapraid_adapter *adapter) -{ - mutex_lock(&adapter->driver_cmds.driver_scsiio_cmd.mutex); - kfree(adapter->driver_cmds.internal_scmd); - adapter->driver_cmds.internal_scmd = NULL; - mutex_unlock(&adapter->driver_cmds.driver_scsiio_cmd.mutex); -} diff --git a/drivers/scsi/leapraid/leapraid_func.h b/drivers/scsi/leapraid/leapraid_func.h index df61bc2e994a..b4dce7e4b355 100644 --- a/drivers/scsi/leapraid/leapraid_func.h +++ b/drivers/scsi/leapraid/leapraid_func.h @@ -51,11 +51,11 @@ #define LEAPRAID_BOARD_NAME_LENGTH 17 #define LEAPRAID_AUTHOR "LeapIO Inc." #define LEAPRAID_DESCRIPTION "LeapRAID Driver" -#define LEAPRAID_DRIVER_VERSION "2.00.01.02" +#define LEAPRAID_DRIVER_VERSION "2.00.01.10" #define LEAPRAID_MAJOR_VERSION 2 -#define LEAPRAID_MINOR_VERSION 00 -#define LEAPRAID_BUILD_VERSION 01 -#define LEAPRAID_RELEASE_VERSION 02 +#define LEAPRAID_MINOR_VERSION 0 +#define LEAPRAID_BUILD_VERSION 1 +#define LEAPRAID_RELEASE_VERSION 10 #define LEAPRAID_MSG_VERSION 0x1021 #define LEAPRAID_HEADER_VERSION 0x0000 @@ -77,7 +77,6 @@ #define LEAPRAID_SG_DEPTH LEAPRAID_MAX_PHYS_SEGMENTS /* Firmware and config page operations. */ -#define LEAPRAID_SET_PARAMETER_SYNC_TIMESTAMP 0x81 #define LEAPRAID_CFG_REQ_RETRY_TIMES 2 /* Hardware access helpers. */ @@ -88,8 +87,6 @@ /* Polling intervals. */ #define LEAPRAID_PCIE_LOG_POLLING_INTERVAL 1 #define LEAPRAID_FAULT_POLLING_INTERVAL 1000 -#define LEAPRAID_TIMESTAMP_SYNC_INTERVAL 900 -#define LEAPRAID_SMART_POLLING_INTERVAL (300 * 1000) /* Init mask. */ #define LEAPRAID_RESET_IRQ_MASK 0x40000000 @@ -103,7 +100,6 @@ /* Target probe flag. */ #define LEAPRAID_NO_ULD_ATTACH_FLAG 1 -#define LEAPRAID_ULD_ATTACH_FLAG 0 /* SCSI device and queue limits. */ #define LEAPRAID_MAX_SECTORS 2048 @@ -127,7 +123,6 @@ /* SMP (Serial Management Protocol). */ #define LEAPRAID_SMP_PT_FLAG_SGL_PTR 0x80 -#define LEAPRAID_SMP_FN_REPORT_PHY_ERR_LOG 0x91 #define LEAPRAID_SMP_FRAME_HEADER_SIZE 4 #define LEAPRAID_SCSI_HOST_SHIFT 16 #define LEAPRAID_SCSI_DRIVER_SHIFT 24 @@ -171,13 +166,9 @@ /* Basic constants and limits. */ #define LEAPRAID_BUSY_LIMIT 1 -#define LEAPRAID_INDEX_FIRST 0 -#define LEAPRAID_BITS_PER_BYTE 8 #define LEAPRAID_INVALID_HOST_DIAG_VAL 0xFFFFFFFF /* Retry/Sleep configuration. */ -#define LEAPRAID_WRITE_SEQUENCE_OFFSET 0x4 -#define LEAPRAID_WRSEQ_KEY_VALUE_MASK 0xF #define LEAPRAID_WRSEQ_FLUSH_KEY_VALUE 0x0 #define LEAPRAID_WRSEQ_1ST_KEY_VALUE 0xF #define LEAPRAID_WRSEQ_2ND_KEY_VALUE 0x4 @@ -187,7 +178,6 @@ #define LEAPRAID_WRSEQ_6TH_KEY_VALUE 0xD #define LEAPRAID_UNLOCK_RETRY_LIMIT 20 #define LEAPRAID_UNLOCK_SLEEP_MS 100 -#define LEAPRAID_MSLEEP_SHORT_MS 50 #define LEAPRAID_MSLEEP_NORMAL_MS 100 #define LEAPRAID_MSLEEP_EXTRA_LONG_MS 500 #define LEAPRAID_IO_POLL_DELAY_US 500 @@ -198,17 +188,14 @@ #define LEAPRAID_INVALID_DEV_HANDLE 0xFFFF /* Commands queue depth. */ -#define LEAPRAID_COALESCING_DEPTH_MAX 256 #define LEAPRAID_DEFAULT_CMD_QD_OFFSET 64 #define LEAPRAID_REPLY_QD_ALIGNMENT 16 /* Task ID offset. */ #define LEAPRAID_TASKID_OFFSET_CTRL_CMD 1 -#define LEAPRAID_TASKID_OFFSET_SCSIIO_CMD 2 #define LEAPRAID_TASKID_OFFSET_CFG_OP_CMD 1 #define LEAPRAID_TASKID_OFFSET_TRANSPORT_CMD 2 -#define LEAPRAID_TASKID_OFFSET_TIMESTAMP_SYNC_CMD 3 -#define LEAPRAID_TASKID_OFFSET_ENC_CMD 4 -#define LEAPRAID_TASKID_OFFSET_NOTIFY_EVENT_CMD 5 +#define LEAPRAID_TASKID_OFFSET_ENC_CMD 3 +#define LEAPRAID_TASKID_OFFSET_NOTIFY_EVENT_CMD 4 /* Task ID offset for high-priority. */ #define LEAPRAID_HP_TASKID_OFFSET_CTL_CMD 0 @@ -223,21 +210,12 @@ #define LEAPRAID_CFG_OP_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT #define LEAPRAID_CTL_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT #define LEAPRAID_SCAN_DEV_CMD_TIMEOUT 300 -#define LEAPRAID_TIMESTAMP_SYNC_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT -#define LEAPRAID_RAID_ACTION_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT #define LEAPRAID_ENC_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT #define LEAPRAID_IO_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT #define LEAPRAID_NOTIFY_EVENT_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT #define LEAPRAID_TM_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT #define LEAPRAID_TRANSPORT_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT -/* Logsense command definitions. */ -#define LEAPRAID_LOGSENSE_DATA_LENGTH 16 -#define LEAPRAID_LOGSENSE_CDB_LENGTH 10 -#define LEAPRAID_LOGSENSE_CDB_CODE 0x6F -#define LEAPRAID_LOGSENSE_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT -#define LEAPRAID_LOGSENSE_SMART_CODE 0x5D - /* Host DMA cap. */ #define DMA_32_BITS 32 #define DMA_64_BITS 64 @@ -284,6 +262,8 @@ struct leapraid_adapter_features { u8 max_volumes; u16 max_dev_handle; u16 min_dev_handle; + u16 msg_ver; + u16 product_id; }; /** @@ -424,7 +404,7 @@ struct leapraid_mem_desc { }; /* internal cmd description */ -#define LEAPRAID_FIXED_INTER_CMDS 6 +#define LEAPRAID_FIXED_INTER_CMDS 5 #define LEAPRAID_FIXED_HP_CMDS 2 #define LEAPRAID_CMD_NOT_USED 0x8000 @@ -439,9 +419,6 @@ struct leapraid_mem_desc { * @LEAPRAID_SCAN_DEV_CB_IDX: Scan device callback index. * @LEAPRAID_CONFIG_CB_IDX: Configuration callback index. * @LEAPRAID_TRANSPORT_CB_IDX: Transport callback index. - * @LEAPRAID_TIMESTAMP_SYNC_CB_IDX: Timestamp sync callback index. - * @LEAPRAID_RAID_ACTION_CB_IDX: RAID action callback index. - * @LEAPRAID_DRIVER_SCSIIO_CB_IDX: Driver SCSI I/O callback index. * @LEAPRAID_SAS_CTRL_CB_IDX: SAS controller callback index. * @LEAPRAID_ENC_CB_IDX: Encryption callback index. * @LEAPRAID_NOTIFY_EVENT_CB_IDX: Notify event callback index. @@ -452,14 +429,11 @@ enum LEAPRAID_CB_INDEX { LEAPRAID_SCAN_DEV_CB_IDX = 0x1, LEAPRAID_CONFIG_CB_IDX = 0x2, LEAPRAID_TRANSPORT_CB_IDX = 0x3, - LEAPRAID_TIMESTAMP_SYNC_CB_IDX = 0x4, - LEAPRAID_RAID_ACTION_CB_IDX = 0x5, - LEAPRAID_DRIVER_SCSIIO_CB_IDX = 0x6, - LEAPRAID_SAS_CTRL_CB_IDX = 0x7, - LEAPRAID_ENC_CB_IDX = 0x8, - LEAPRAID_NOTIFY_EVENT_CB_IDX = 0x9, - LEAPRAID_CTL_CB_IDX = 0xA, - LEAPRAID_TM_CB_IDX = 0xB, + LEAPRAID_SAS_CTRL_CB_IDX = 0x5, + LEAPRAID_ENC_CB_IDX = 0x6, + LEAPRAID_NOTIFY_EVENT_CB_IDX = 0x7, + LEAPRAID_CTL_CB_IDX = 0x8, + LEAPRAID_TM_CB_IDX = 0x9, LEAPRAID_NUM_CB_IDXS }; @@ -522,28 +496,20 @@ struct leapraid_driver_cmd { * @scan_dev_cmd: Command used for asynchronous device scan operations. * @cfg_op_cmd: Command for configuration operations. * @transport_cmd: Command for transport-level operations. - * @timestamp_sync_cmd: Command for synchronizing timestamp with firmware. - * @raid_action_cmd: Command for RAID-related management or action requests. - * @driver_scsiio_cmd: Command used for internal SCSI I/O processing. * @enc_cmd: Command for enclosure management operations. * @notify_event_cmd: Command for asynchronous event notification handling. * @ctl_cmd: Command for generic control or maintenance operations. * @tm_cmd: Task management command. - * @internal_scmd: Pointer to internal SCSI command used by the driver. */ struct leapraid_driver_cmds { struct list_head special_cmd_list; struct leapraid_driver_cmd scan_dev_cmd; struct leapraid_driver_cmd cfg_op_cmd; struct leapraid_driver_cmd transport_cmd; - struct leapraid_driver_cmd timestamp_sync_cmd; - struct leapraid_driver_cmd raid_action_cmd; - struct leapraid_driver_cmd driver_scsiio_cmd; struct leapraid_driver_cmd enc_cmd; struct leapraid_driver_cmd notify_event_cmd; struct leapraid_driver_cmd ctl_cmd; struct leapraid_driver_cmd tm_cmd; - struct scsi_cmnd *internal_scmd; }; /** @@ -599,6 +565,7 @@ struct leapraid_fw_evt_work { * @leapraid_evt_masks: Array of event masks for filtering firmware events. */ struct leapraid_fw_evt_struct { + u32 leapraid_evt_masks[4]; char fw_evt_name[48]; struct workqueue_struct *fw_evt_thread; spinlock_t fw_evt_lock; /* protects firmware event */ @@ -606,7 +573,6 @@ struct leapraid_fw_evt_struct { struct leapraid_fw_evt_work *cur_evt; struct task_struct *cur_evt_task; u8 fw_evt_cleanup; - u32 leapraid_evt_masks[4]; }; /** @@ -660,8 +626,8 @@ struct leapraid_blk_mq_poll_rq { * @msix_enable: Flag indicating MSI-X is enabled. * @irq_vectors_allocated: Flag indicating PCI IRQ vectors are allocated. * @irq_mode: Actual interrupt mode used for allocated PCI IRQ vectors. - * @msix_cpu_map: CPU map for MSI-X interrupts. - * @msix_cpu_map_sz: Size of the MSI-X CPU map. + * @msix_cpu_map: CPU-ID indexed MSI-X queue map. + * @msix_cpu_map_sz: Number of CPU-ID slots allocated in @msix_cpu_map. * @int_rqs: Array of interrupt request queues. * @int_rqs_allocated: Count of allocated interrupt request queues. * @blk_mq_poll_rqs: Array of blk-mq polling requests. @@ -708,7 +674,6 @@ struct leapraid_overheat_desc { * @pending_io_cnt: Count of pending I/O operations. * @reset_wait_queue: Wait queue for reset operations. * @reset_cnt: Counter for reset operations. - * @last_reset_cnt: Last observed adapter reset counter. */ struct leapraid_reset_desc { struct workqueue_struct *fault_reset_wq; @@ -722,7 +687,6 @@ struct leapraid_reset_desc { int pending_io_cnt; wait_queue_head_t reset_wait_queue; u32 reset_cnt; - u32 last_reset_cnt; }; /** @@ -776,7 +740,8 @@ struct leapraid_access_ctrl { * @fw_log_work: Delayed work structure for firmware log. * @open_pcie_trace: Flag indicating if PCIe tracing is open. * @fw_log_init_flag: Flag indicating if firmware log is initialized. - * @pre_debug_log: Last DebugLog register snapshot for change detection. + * @mmap_refcnt: Number of active user VMAs on fw_log_buffer. + * @mmap_waitq: Waitqueue for fw_log_buffer VMA teardown. */ struct leapraid_fw_log_desc { u8 *fw_log_buffer; @@ -786,7 +751,8 @@ struct leapraid_fw_log_desc { struct delayed_work fw_log_work; int open_pcie_trace; int fw_log_init_flag; - u32 pre_debug_log[LEAPRAID_DEBUGLOG_SZ_MAX]; + atomic_t mmap_refcnt; + wait_queue_head_t mmap_waitq; }; #define LEAPRAID_CARD_PORT_FLG_DIRTY 0x01 @@ -939,19 +905,6 @@ struct leapraid_boot_devs { struct leapraid_boot_dev current_boot_dev; }; -/** - * struct leapraid_smart_poll_desc - SMART polling descriptor - * - * @smart_poll_wq: Workqueue for SMART polling tasks. - * @smart_poll_work: Delayed work for SMART polling operations. - * @smart_poll_wq_name: Workqueue name string. - */ -struct leapraid_smart_poll_desc { - struct workqueue_struct *smart_poll_wq; - struct delayed_work smart_poll_work; - char smart_poll_wq_name[48]; -}; - /** * struct leapraid_adapter - Main LeapRAID adapter structure * @@ -961,7 +914,6 @@ struct leapraid_smart_poll_desc { * @iomem_base: I/O memory mapped base address. * @rep_msg_host_idx: Host index for reply messages. * @mask_int: Interrupt masking flag. - * @timestamp_sync_cnt: Timestamp synchronization counter. * @adapter_attr: Adapter attributes. * @mem_desc: Memory descriptor. * @driver_cmds: Driver commands. @@ -974,7 +926,6 @@ struct leapraid_smart_poll_desc { * @fw_log_desc: Firmware log descriptor. * @dev_topo: Device topology. * @boot_devs: Boot devices. - * @smart_poll_desc: SMART polling descriptor. * @overheat_desc: Overheat processing descriptor. */ struct leapraid_adapter { @@ -984,7 +935,6 @@ struct leapraid_adapter { struct leapraid_reg_base __iomem *iomem_base; u32 rep_msg_host_idx; u8 mask_int; - u32 timestamp_sync_cnt; struct leapraid_adapter_attr adapter_attr; struct leapraid_mem_desc mem_desc; @@ -998,7 +948,6 @@ struct leapraid_adapter { struct leapraid_fw_log_desc fw_log_desc; struct leapraid_dev_topo dev_topo; struct leapraid_boot_devs boot_devs; - struct leapraid_smart_poll_desc smart_poll_desc; struct leapraid_overheat_desc overheat_desc; }; @@ -1116,6 +1065,7 @@ struct leapraid_starget_priv { * @starget_priv: Associated target private data. * @lun: Logical Unit Number. * @flg: Flags. + * @ncq_prio_enable: Enables NCQ command priority for RT I/O. * @block: Block flag. * @deleted: Deletion flag. * @sep: SEP flag. @@ -1124,7 +1074,7 @@ struct leapraid_sdev_priv { struct leapraid_starget_priv *starget_priv; unsigned int lun; u32 flg; - u8 ncq; + u8 ncq_prio_enable; u8 block; u8 deleted; u8 sep; @@ -1157,7 +1107,6 @@ struct leapraid_sdev_priv { * @enc_level: Enclosure level. * @port_connection: Port connection. * @connector_name: Connector name. - * @support_smart: SMART support flag. */ struct leapraid_sas_dev { struct list_head list; @@ -1184,7 +1133,6 @@ struct leapraid_sas_dev { u8 enc_level; u8 port_connection; u8 connector_name[LEAPRAID_SAS_DEV_P0_CON_NAME_LEN + 1]; - u8 support_smart; }; static inline void leapraid_sdev_free(struct kref *ref) @@ -1362,31 +1310,6 @@ struct leapraid_rep_manu_reply { u8 vendor_specific[8]; }; -/** - * struct leapraid_scsi_cmd_desc - SCSI command descriptor - * - * @hdl: Device handle. - * @lun: Logical Unit Number. - * @raid_member: RAID member flag. - * @dir: DMA data direction. - * @data_length: Data transfer length. - * @data_buffer: Data buffer pointer. - * @cdb_length: CDB length. - * @cdb: Command Descriptor Block. - * @time_out: Timeout. - */ -struct leapraid_scsi_cmd_desc { - u16 hdl; - u32 lun; - u8 raid_member; - enum dma_data_direction dir; - u32 data_length; - void *data_buffer; - u8 cdb_length; - u8 cdb[32]; - u8 time_out; -}; - extern struct list_head leapraid_adapter_list; extern spinlock_t leapraid_adapter_lock; extern char driver_name[LEAPRAID_NAME_LENGTH]; @@ -1446,7 +1369,7 @@ int leapraid_get_volume_cap(struct leapraid_adapter *adapter, int leapraid_internal_init_cmd_priv( struct leapraid_adapter *adapter, struct leapraid_io_req_tracker *io_tracker); -int leapraid_internal_exit_cmd_priv( +void leapraid_internal_exit_cmd_priv( struct leapraid_adapter *adapter, struct leapraid_io_req_tracker *io_tracker); void leapraid_clean_active_fw_evt(struct leapraid_adapter *adapter); @@ -1517,7 +1440,7 @@ int leapraid_op_config_page(struct leapraid_adapter *adapter, void *cfgp, union cfg_param_1 cfgp1, union cfg_param_2 cfgp2, enum config_page_action cfg_op); -void leapraid_log_req_context(struct leapraid_adapter *adapter, +void leapraid_log_req_context(struct leapraid_adapter *adapter, u16 smid, const void *req_data); int leapraid_change_queue_depth(struct scsi_device *sdev, int qdepth); @@ -1557,10 +1480,7 @@ void leapraid_transport_attach_phy_to_port( u64 sas_address, struct leapraid_card_port *card_port); int leapraid_queuecommand(struct Scsi_Host *shost, struct scsi_cmnd *scmd); -void leapraid_smart_polling_start(struct leapraid_adapter *adapter); -void leapraid_smart_polling_stop(struct leapraid_adapter *adapter); void leapraid_overheat_cleanup(struct leapraid_adapter *adapter); void leapraid_smart_fault_detect(struct leapraid_adapter *adapter, u16 hdl); -void leapraid_free_internal_scsi_cmd(struct leapraid_adapter *adapter); #endif /* LEAPRAID_FUNC_H_INCLUDED */ diff --git a/drivers/scsi/leapraid/leapraid_os.c b/drivers/scsi/leapraid/leapraid_os.c index c60c5d80c7b3..6a9f97e4c63a 100644 --- a/drivers/scsi/leapraid/leapraid_os.c +++ b/drivers/scsi/leapraid/leapraid_os.c @@ -125,13 +125,6 @@ static int leapraid_tm_cmd_map_status(struct leapraid_adapter *adapter, } } - if (taskid_task == adapter->driver_cmds.driver_scsiio_cmd.taskid && - (adapter->driver_cmds.driver_scsiio_cmd.status & - LEAPRAID_CMD_DONE || - adapter->driver_cmds.driver_scsiio_cmd.status & - LEAPRAID_CMD_NOT_USED)) - rc = SUCCESS; - if (taskid_task == adapter->driver_cmds.ctl_cmd.hp_taskid && (adapter->driver_cmds.ctl_cmd.status & LEAPRAID_CMD_DONE || @@ -157,9 +150,8 @@ static int leapraid_tm_post_processing(struct leapraid_adapter *adapter, leapraid_sync_irqs(adapter, true); leapraid_unmask_int(adapter); - rc = leapraid_tm_cmd_map_status(adapter, channel, id, lun, type, - taskid_task); - return rc; + return leapraid_tm_cmd_map_status(adapter, channel, id, lun, type, + taskid_task); } static void leapraid_build_tm_req(struct leapraid_scsi_tm_req *scsi_tm_req, @@ -185,6 +177,7 @@ int leapraid_issue_tm(struct leapraid_adapter *adapter, u16 hdl, uint channel, struct leapraid_scsiio_req *scsiio_req; struct leapraid_io_req_tracker *io_req_tracker = NULL; u16 msix_task; + u16 taskid; bool issue_reset = false; u32 db; int rc; @@ -239,16 +232,15 @@ int leapraid_issue_tm(struct leapraid_adapter *adapter, u16 hdl, uint channel, msix_task = io_req_tracker->msix_io; else msix_task = 0; - leapraid_fire_hpr_task(adapter, - adapter->driver_cmds.tm_cmd.hp_taskid, - msix_task); + taskid = adapter->driver_cmds.tm_cmd.hp_taskid; + leapraid_fire_hpr_task(adapter, taskid, msix_task); wait_for_completion_timeout(&adapter->driver_cmds.tm_cmd.done, LEAPRAID_TM_CMD_TIMEOUT * HZ); if (!(adapter->driver_cmds.tm_cmd.status & LEAPRAID_CMD_DONE)) { dev_err(&adapter->pdev->dev, "%s: TM cmd timeout, status=0x%x\n", __func__, adapter->driver_cmds.tm_cmd.status); - leapraid_log_req_context(adapter, scsi_tm_req); + leapraid_log_req_context(adapter, taskid, scsi_tm_req); issue_reset = leapraid_check_reset( adapter->driver_cmds.tm_cmd.status); @@ -508,11 +500,11 @@ static void leapraid_scsiio_done_dispatch( if (!scmd->result) return; - scsi_print_command(scmd); - dev_warn(&adapter->pdev->dev, - "SCSI I/O: hdl=0x%x, status: 0x%x, 0x%x, 0x%x\n", - le16_to_cpu(scsiio_rep->dev_hdl), adapter_status, - scsi_status, scsi_state); + dev_dbg(&adapter->pdev->dev, + "SCSI I/O: CDB=%*ph, hdl=0x%x, status: 0x%x, 0x%x, 0x%x\n", + scmd->cmd_len, scmd->cmnd, + le16_to_cpu(scsiio_rep->dev_hdl), adapter_status, + scsi_status, scsi_state); if (scsi_state & LEAPRAID_SCSI_STATE_AUTOSENSE_VALID) { struct scsi_sense_hdr sshdr; @@ -521,13 +513,13 @@ static void leapraid_scsiio_done_dispatch( le32_to_cpu(scsiio_rep->sense_count)); if (scsi_normalize_sense(scmd->sense_buffer, sz, &sshdr)) - dev_warn(&adapter->pdev->dev, - "Sense: key=0x%x asc=0x%x ascq=0x%x\n", - sshdr.sense_key, sshdr.asc, - sshdr.ascq); + dev_dbg(&adapter->pdev->dev, + "Sense: key=0x%x asc=0x%x ascq=0x%x\n", + sshdr.sense_key, sshdr.asc, + sshdr.ascq); else - dev_warn(&adapter->pdev->dev, - "Sense: Invalid sense data\n"); + dev_dbg(&adapter->pdev->dev, + "Sense: Invalid sense data\n"); } } @@ -539,10 +531,7 @@ bool leapraid_scsiio_done(struct leapraid_adapter *adapter, u16 taskid, struct scsi_cmnd *scmd; u32 response_code = 0; - if (likely(taskid != adapter->driver_cmds.driver_scsiio_cmd.taskid)) - scmd = leapraid_get_scmd_from_taskid(adapter, taskid); - else - scmd = adapter->driver_cmds.internal_scmd; + scmd = leapraid_get_scmd_from_taskid(adapter, taskid); if (!scmd) return true; @@ -569,13 +558,6 @@ bool leapraid_scsiio_done(struct leapraid_adapter *adapter, u16 taskid, out_scsiio_done: scsi_dma_unmap(scmd); - if (unlikely(taskid == - adapter->driver_cmds.driver_scsiio_cmd.taskid)) { - adapter->driver_cmds.driver_scsiio_cmd.status = - LEAPRAID_CMD_DONE; - complete(&adapter->driver_cmds.driver_scsiio_cmd.done); - return false; - } leapraid_free_taskid(adapter, taskid); scsi_done(scmd); return false; @@ -644,7 +626,6 @@ static void leapraid_probe_sas(struct leapraid_adapter *adapter) sas_dev->hdl, sas_dev->parent_sas_addr, sas_dev->card_port); - if (!added) goto remove_dev; @@ -781,7 +762,6 @@ void leapraid_scan_dev_done(struct leapraid_adapter *adapter) leapraid_fw_log_start(adapter); adapter->scan_dev_desc.driver_loading = 0; wake_up(&adapter->scan_dev_desc.wait_driver_loading); - leapraid_smart_polling_start(adapter); } static const struct pci_device_id leapraid_pci_table[] = { @@ -805,10 +785,7 @@ static inline bool leapraid_is_scmd_permitted(struct leapraid_adapter *adapter, return false; opcode = scmd->cmnd[0]; - if (opcode == SYNCHRONIZE_CACHE || opcode == START_STOP) - return true; - - return false; + return opcode == SYNCHRONIZE_CACHE || opcode == START_STOP; } return true; } @@ -857,10 +834,7 @@ static bool leapraid_should_queuecommand(struct leapraid_adapter *adapter, no_connect: scmd->result = DID_NO_CONNECT << LEAPRAID_SCSI_HOST_SHIFT; scsiio_done: - if (likely(scmd != adapter->driver_cmds.internal_scmd)) - scsi_done(scmd); - else - *rc = LEAPRAID_OPERATION_FAILED; + scsi_done(scmd); return false; } @@ -884,7 +858,7 @@ static u32 build_scsiio_req_control(struct scsi_cmnd *scmd, control |= LEAPRAID_SCSIIO_CTRL_SIMPLEQ; - if (sdev_priv->ncq && + if (sdev_priv->ncq_prio_enable && (IOPRIO_PRIO_CLASS(req_get_ioprio(scsi_cmd_to_rq(scmd))) == IOPRIO_CLASS_RT)) control |= LEAPRAID_SCSIIO_CTRL_CMDPRI; @@ -914,10 +888,7 @@ int leapraid_queuecommand(struct Scsi_Host *shost, hdl = starget_priv->hdl; control = build_scsiio_req_control(scmd, sdev_priv); - if (unlikely(scmd == adapter->driver_cmds.internal_scmd)) - taskid = adapter->driver_cmds.driver_scsiio_cmd.taskid; - else - taskid = leapraid_alloc_scsiio_taskid(adapter, scmd); + taskid = leapraid_alloc_scsiio_taskid(adapter, scmd); scsiio_req = leapraid_get_task_desc(adapter, taskid); scsiio_req->func = LEAPRAID_FUNC_SCSIIO; @@ -1101,13 +1072,15 @@ static int leapraid_error_handler(struct scsi_cmnd *scmd, out_eh_done: if (type == LEAPRAID_TM_TASKTYPE_ABORT_TASK) { - dev_info(&adapter->pdev->dev, - "EH ABORT result: %s, scmd=0x%p\n", - rc == SUCCESS ? "success" : "failed", scmd); + if (rc != SUCCESS) + dev_err(&adapter->pdev->dev, + "EH ABORT result: failed, scmd=0x%p\n", + scmd); } else { - dev_info(&adapter->pdev->dev, - "EH %s result: %s, scmd=0x%p\n", - str, rc == SUCCESS ? "success" : "failed", scmd); + if (rc != SUCCESS) + dev_err(&adapter->pdev->dev, + "EH %s result: failed, scmd=0x%p\n", + str, scmd); if (sas_dev) leapraid_sdev_put(sas_dev); } @@ -1161,8 +1134,10 @@ static int leapraid_eh_host_reset_handler(struct scsi_cmnd *scmd) rc = SUCCESS; out_host_reset_done: - dev_info(&adapter->pdev->dev, "EH HOST RESET result: %s, scmd=0x%p\n", - rc == SUCCESS ? "success" : "failed", scmd); + if (rc != SUCCESS) + dev_err(&adapter->pdev->dev, + "EH HOST RESET result: failed, scmd=0x%p\n", + scmd); return rc; } @@ -1227,7 +1202,7 @@ static int leapraid_slave_alloc(struct scsi_device *sdev) return 0; } -static int leapraid_slave_cfg_volume(struct scsi_device *sdev) +static bool leapraid_slave_cfg_volume(struct scsi_device *sdev) { struct Scsi_Host *shost = sdev->host; struct leapraid_adapter *adapter = shost_priv(shost); @@ -1276,10 +1251,10 @@ static int leapraid_slave_cfg_volume(struct scsi_device *sdev) return 0; } -static int leapraid_slave_configure_extra(struct scsi_device *sdev, - struct leapraid_sas_dev **psas_dev, - u16 vol_hdl, u64 volume_wwid, - bool *is_target_ssp, int *qd) +static bool leapraid_slave_configure_extra(struct scsi_device *sdev, + struct leapraid_sas_dev **psas_dev, + u16 vol_hdl, u64 volume_wwid, + bool *is_target_ssp, int *qd) { struct leapraid_sas_dev *sas_dev; struct leapraid_sdev_priv *sdev_priv; @@ -1586,11 +1561,9 @@ static bool leapraid_scan_check_status(struct leapraid_adapter *adapter, wake_up(&adapter->scan_dev_desc.wait_driver_loading); adapter->scan_dev_desc.wait_scan_dev_done = 0; adapter->access_ctrl.host_removing = 1; - wake_up(&adapter->access_ctrl.recovery_waitq); return true; } - dev_info(&adapter->pdev->dev, "Device scan: SUCCESS\n"); adapter->driver_cmds.scan_dev_cmd.status = LEAPRAID_CMD_NOT_USED; leapraid_scan_dev_done(adapter); return true; @@ -1861,12 +1834,11 @@ static struct attribute *leapraid_shost_attrs[] = { ATTRIBUTE_GROUPS(leapraid_shost); -static ssize_t sas_address_show(struct device *dev, - struct device_attribute *attr, char *buf) +static ssize_t sas_device_handle_show(struct device *dev, + struct device_attribute *attr, char *buf) { struct scsi_device *sdev = to_scsi_device(dev); struct leapraid_sdev_priv *sas_device_priv_data = sdev->hostdata; - u64 sas_address; if (!sas_device_priv_data || !sas_device_priv_data->starget_priv) { dev_err(&sdev->sdev_gendev, @@ -1874,29 +1846,45 @@ static ssize_t sas_address_show(struct device *dev, return -EINVAL; } - sas_address = sas_device_priv_data->starget_priv->sas_address; - - return sysfs_emit(buf, "0x%016llx\n", (unsigned long long)sas_address); + return sysfs_emit(buf, "0x%04x\n", + sas_device_priv_data->starget_priv->hdl); } -static ssize_t sas_device_handle_show(struct device *dev, - struct device_attribute *attr, char *buf) +static int leapraid_ncq_prio_supported(struct scsi_device *sdev, + bool *supported) +{ + struct scsi_vpd *vpd_pg89; + + *supported = false; + rcu_read_lock(); + vpd_pg89 = rcu_dereference(sdev->vpd_pg89); + if (vpd_pg89 && vpd_pg89->len >= LEAPRAID_VPD_PG89_MIN_LEN) + *supported = + (vpd_pg89->data[LEAPRAID_VPD_PG89_NCQ_BYTE_IDX] >> + LEAPRAID_VPD_PG89_NCQ_BIT_SHIFT) & + LEAPRAID_VPD_PG89_NCQ_BIT_MASK; + rcu_read_unlock(); + + return 0; +} +static ssize_t sas_ncq_prio_supported_show(struct device *dev, + struct device_attribute *attr, + char *buf) { struct scsi_device *sdev = to_scsi_device(dev); - struct leapraid_sdev_priv *sas_device_priv_data = sdev->hostdata; + bool supported; + int rc; - if (!sas_device_priv_data || !sas_device_priv_data->starget_priv) { - dev_err(&sdev->sdev_gendev, - "%s: Invalid sdev_priv or starget_priv\n", __func__); - return -EINVAL; - } + rc = leapraid_ncq_prio_supported(sdev, &supported); + if (rc) + return rc; - return sysfs_emit(buf, "0x%04x\n", - sas_device_priv_data->starget_priv->hdl); + return sysfs_emit(buf, "%d\n", supported); } -static ssize_t sas_ncq_show(struct device *dev, struct device_attribute *attr, - char *buf) +static ssize_t sas_ncq_prio_enable_show(struct device *dev, + struct device_attribute *attr, + char *buf) { struct scsi_device *sdev = to_scsi_device(dev); struct leapraid_sdev_priv *sas_device_priv_data = sdev->hostdata; @@ -1907,18 +1895,18 @@ static ssize_t sas_ncq_show(struct device *dev, struct device_attribute *attr, return -EINVAL; } - return sysfs_emit(buf, "%d\n", sas_device_priv_data->ncq); + return sysfs_emit(buf, "%d\n", sas_device_priv_data->ncq_prio_enable); } -static ssize_t sas_ncq_store(struct device *dev, - struct device_attribute *attr, - const char *buf, size_t count) +static ssize_t sas_ncq_prio_enable_store(struct device *dev, + struct device_attribute *attr, + const char *buf, size_t count) { struct scsi_device *sdev = to_scsi_device(dev); struct leapraid_sdev_priv *sas_device_priv_data = sdev->hostdata; - struct scsi_vpd *vpd_pg89; - int ncq_op; - bool ncq_supported; + bool supported; + int rc; + bool enable; if (!sas_device_priv_data) { dev_err(&sdev->sdev_gendev, @@ -1926,45 +1914,66 @@ static ssize_t sas_ncq_store(struct device *dev, return -EINVAL; } - if (kstrtoint(buf, 0, &ncq_op)) - return -EINVAL; - - if (ncq_op != 0 && ncq_op != 1) { - dev_err(&sdev->sdev_gendev, - "%s: Invalid NCQ value %d (only 0/1 allowed)\n", - __func__, ncq_op); + if (kstrtobool(buf, &enable)) return -EINVAL; - } - rcu_read_lock(); - vpd_pg89 = rcu_dereference(sdev->vpd_pg89); - if (!vpd_pg89 || vpd_pg89->len < LEAPRAID_VPD_PG89_MIN_LEN) { - rcu_read_unlock(); + rc = leapraid_ncq_prio_supported(sdev, &supported); + if (rc) + return rc; + if (!supported) return -EINVAL; - } - ncq_supported = (vpd_pg89->data[LEAPRAID_VPD_PG89_NCQ_BYTE_IDX] >> - LEAPRAID_VPD_PG89_NCQ_BIT_SHIFT) & - LEAPRAID_VPD_PG89_NCQ_BIT_MASK; - rcu_read_unlock(); - if (ncq_supported) - sas_device_priv_data->ncq = ncq_op; + sas_device_priv_data->ncq_prio_enable = enable; return count; } -static DEVICE_ATTR_RO(sas_address); static DEVICE_ATTR_RO(sas_device_handle); +static DEVICE_ATTR_RO(sas_ncq_prio_supported); +static DEVICE_ATTR_RW(sas_ncq_prio_enable); -static DEVICE_ATTR_RW(sas_ncq); +static bool leapraid_sdev_is_sata(struct scsi_device *sdev) +{ + struct scsi_target *starget = sdev->sdev_target; + struct leapraid_starget_priv *starget_priv = starget->hostdata; + struct leapraid_sas_dev *sas_dev; + + if (!starget_priv) + return false; + + sas_dev = starget_priv->sas_dev; + return sas_dev && (sas_dev->dev_info & LEAPRAID_DEVTYP_SATA_DEV); +} static struct attribute *leapraid_sdev_attrs[] = { - &dev_attr_sas_address.attr, &dev_attr_sas_device_handle.attr, - &dev_attr_sas_ncq.attr, + &dev_attr_sas_ncq_prio_supported.attr, + &dev_attr_sas_ncq_prio_enable.attr, NULL, }; -ATTRIBUTE_GROUPS(leapraid_sdev); +static umode_t leapraid_sdev_attr_is_visible(struct kobject *kobj, + struct attribute *attr, int i) +{ + struct device *dev = kobj_to_dev(kobj); + struct scsi_device *sdev = to_scsi_device(dev); + + if (attr == &dev_attr_sas_ncq_prio_supported.attr || + attr == &dev_attr_sas_ncq_prio_enable.attr) + if (!leapraid_sdev_is_sata(sdev)) + return 0; + + return attr->mode; +} + +static const struct attribute_group leapraid_sdev_attr_group = { + .attrs = leapraid_sdev_attrs, + .is_visible = leapraid_sdev_attr_is_visible, +}; + +static const struct attribute_group *leapraid_sdev_groups[] = { + &leapraid_sdev_attr_group, + NULL, +}; static struct scsi_host_template leapraid_driver_template = { .module = THIS_MODULE, @@ -2053,13 +2062,12 @@ static int leapraid_probe(struct pci_dev *pdev, const struct pci_device_id *id) adapter = shost_priv(shost); INIT_LIST_HEAD(&adapter->list); - spin_lock(&leapraid_adapter_lock); - list_add_tail(&adapter->list, &leapraid_adapter_list); - spin_unlock(&leapraid_adapter_lock); adapter->shost = shost; adapter->pdev = pdev; adapter->fw_log_desc.open_pcie_trace = open_pcie_trace; + atomic_set(&adapter->fw_log_desc.mmap_refcnt, 0); + init_waitqueue_head(&adapter->fw_log_desc.mmap_waitq); leapraid_lock_init(adapter); leapraid_list_init(adapter); snprintf(adapter->adapter_attr.name, LEAPRAID_NAME_LENGTH, "%s%d", @@ -2111,6 +2119,10 @@ static int leapraid_probe(struct pci_dev *pdev, const struct pci_device_id *id) goto scsi_add_shost_fail; } + spin_lock(&leapraid_adapter_lock); + list_add_tail(&adapter->list, &leapraid_adapter_list); + spin_unlock(&leapraid_adapter_lock); + scsi_scan_host(shost); return 0; @@ -2120,9 +2132,6 @@ static int leapraid_probe(struct pci_dev *pdev, const struct pci_device_id *id) leapraid_overheat_cleanup(adapter); destroy_workqueue(adapter->fw_evt_s.fw_evt_thread); evt_wq_fail: - spin_lock(&leapraid_adapter_lock); - list_del(&adapter->list); - spin_unlock(&leapraid_adapter_lock); scsi_host_put(shost); return rc; } @@ -2205,13 +2214,13 @@ static void leapraid_remove(struct pci_dev *pdev) wait_event(adapter->scan_dev_desc.wait_driver_loading, !atomic_read(&adapter->overheat_desc.thermal_alert)); - adapter->access_ctrl.host_removing = 1; - wake_up(&adapter->access_ctrl.recovery_waitq); + WRITE_ONCE(adapter->access_ctrl.host_removing, 1); + spin_lock(&leapraid_adapter_lock); + list_del(&adapter->list); + spin_unlock(&leapraid_adapter_lock); leapraid_wait_cmds_done(adapter); - leapraid_smart_polling_stop(adapter); - if (leapraid_pci_removed(adapter)) { leapraid_mq_polling_pause(adapter); leapraid_clean_active_scsi_cmds(adapter); @@ -2228,9 +2237,6 @@ static void leapraid_remove(struct pci_dev *pdev) sas_remove_host(shost); leapraid_cleanup_lists(adapter); leapraid_remove_ctrl(adapter); - spin_lock(&leapraid_adapter_lock); - list_del(&adapter->list); - spin_unlock(&leapraid_adapter_lock); scsi_host_put(shost); } @@ -2247,7 +2253,6 @@ static void leapraid_shutdown(struct pci_dev *pdev) } adapter->access_ctrl.host_removing = 1; - wake_up(&adapter->access_ctrl.recovery_waitq); leapraid_wait_cmds_done(adapter); leapraid_clean_active_fw_evt(adapter); leapraid_overheat_cleanup(adapter); @@ -2283,7 +2288,6 @@ static pci_ers_result_t leapraid_pci_error_detected(struct pci_dev *pdev, adapter->access_ctrl.pcie_recovering = 1; scsi_block_requests(adapter->shost); leapraid_overheat_cleanup(adapter); - leapraid_smart_polling_stop(adapter); leapraid_check_scheduled_fault_stop(adapter); leapraid_fw_log_stop(adapter); leapraid_disable_controller(adapter); @@ -2291,7 +2295,6 @@ static pci_ers_result_t leapraid_pci_error_detected(struct pci_dev *pdev, case pci_channel_io_perm_failure: adapter->access_ctrl.pcie_recovering = 1; leapraid_overheat_cleanup(adapter); - leapraid_smart_polling_stop(adapter); leapraid_check_scheduled_fault_stop(adapter); leapraid_fw_log_stop(adapter); leapraid_mq_polling_pause(adapter); @@ -2334,7 +2337,6 @@ static pci_ers_result_t leapraid_pci_slot_reset(struct pci_dev *pdev) dev_err(&pdev->dev, "%s PCI error slot reset\n", adapter->adapter_attr.name); - adapter->access_ctrl.pcie_recovering = 0; adapter->pdev = pdev; pci_restore_state(pdev); if (leapraid_set_pcie_and_notification(adapter)) { @@ -2344,13 +2346,15 @@ static pci_ers_result_t leapraid_pci_slot_reset(struct pci_dev *pdev) return PCI_ERS_RESULT_DISCONNECT; } + adapter->access_ctrl.pcie_recovering = 0; dev_info(&pdev->dev, "%s: Hard reset triggered by PCI slot reset\n", adapter->adapter_attr.name); dev_info(&adapter->pdev->dev, "%s: %d: call hard_reset\n", __func__, __LINE__); rc = leapraid_hard_reset_handler(adapter, FULL_RESET); - dev_info(&pdev->dev, "%s hard reset: %s\n", - adapter->adapter_attr.name, rc == 0 ? "success" : "failed"); + if (rc) + dev_err(&pdev->dev, "%s hard reset: failed\n", + adapter->adapter_attr.name); return rc == 0 ? PCI_ERS_RESULT_RECOVERED : PCI_ERS_RESULT_DISCONNECT; @@ -2367,11 +2371,11 @@ static void leapraid_pci_resume(struct pci_dev *pdev) } dev_err(&pdev->dev, "PCI error resume!\n"); + pci_aer_clear_nonfatal_status(pdev); leapraid_check_scheduled_fault_start(adapter); leapraid_fw_log_start(adapter); scsi_unblock_requests(adapter->shost); - leapraid_smart_polling_start(adapter); } MODULE_DEVICE_TABLE(pci, leapraid_pci_table); @@ -2396,7 +2400,6 @@ static int leapraid_suspend(struct pci_dev *pdev, pm_message_t state) } leapraid_overheat_cleanup(adapter); - leapraid_smart_polling_stop(adapter); leapraid_check_scheduled_fault_stop(adapter); leapraid_fw_log_stop(adapter); scsi_block_requests(shost); @@ -2452,7 +2455,6 @@ static int leapraid_resume(struct pci_dev *pdev) scsi_unblock_requests(shost); leapraid_check_scheduled_fault_start(adapter); leapraid_fw_log_start(adapter); - leapraid_smart_polling_start(adapter); return 0; } #endif /* CONFIG_PM */ diff --git a/drivers/scsi/leapraid/leapraid_transport.c b/drivers/scsi/leapraid/leapraid_transport.c index 738bc55df416..379029685e16 100644 --- a/drivers/scsi/leapraid/leapraid_transport.c +++ b/drivers/scsi/leapraid/leapraid_transport.c @@ -298,6 +298,7 @@ static int leapraid_transport_exp_report_manu(struct leapraid_adapter *adapter, dma_addr_t c2h_dma_addr; bool issue_reset = false; void *data_out = NULL; + u16 inter_taskid; size_t c2h_size; size_t h2c_size; void *psge; @@ -338,10 +339,8 @@ static int leapraid_transport_exp_report_manu(struct leapraid_adapter *adapter, rep_manu_request->allocated_response_length = 0; rep_manu_request->request_length = 0; - smp_passthrough_req = - leapraid_get_task_desc( - adapter, - adapter->driver_cmds.transport_cmd.inter_taskid); + inter_taskid = adapter->driver_cmds.transport_cmd.inter_taskid; + smp_passthrough_req = leapraid_get_task_desc(adapter, inter_taskid); memset(smp_passthrough_req, 0, sizeof(struct leapraid_smp_passthrough_req)); smp_passthrough_req->func = LEAPRAID_FUNC_SMP_PASSTHROUGH; @@ -354,8 +353,7 @@ static int leapraid_transport_exp_report_manu(struct leapraid_adapter *adapter, c2h_dma_addr, c2h_size); init_completion(&adapter->driver_cmds.transport_cmd.done); - leapraid_fire_task(adapter, - adapter->driver_cmds.transport_cmd.inter_taskid); + leapraid_fire_task(adapter, inter_taskid); wait_for_completion_timeout(&adapter->driver_cmds.transport_cmd.done, LEAPRAID_TRANSPORT_CMD_TIMEOUT * HZ); if (!(adapter->driver_cmds.transport_cmd.status & LEAPRAID_CMD_DONE)) { @@ -363,7 +361,8 @@ static int leapraid_transport_exp_report_manu(struct leapraid_adapter *adapter, dev_err(&adapter->pdev->dev, "%s: SMP passthrough timeout, st=0x%x\n", __func__, adapter->driver_cmds.transport_cmd.status); - leapraid_log_req_context(adapter, smp_passthrough_req); + leapraid_log_req_context(adapter, inter_taskid, + smp_passthrough_req); if (!(adapter->driver_cmds.transport_cmd.status & LEAPRAID_CMD_RESET)) issue_reset = true; @@ -1249,20 +1248,21 @@ static void leapraid_build_smp_task(struct leapraid_adapter *adapter, static int leapraid_send_smp_req(struct leapraid_adapter *adapter) { const struct leapraid_smp_passthrough_req *smp_passthrough_req; + u16 inter_taskid; dev_dbg(&adapter->pdev->dev, "%s: Sending smp request\n", __func__); - smp_passthrough_req = leapraid_get_task_desc( - adapter, adapter->driver_cmds.transport_cmd.inter_taskid); + inter_taskid = adapter->driver_cmds.transport_cmd.inter_taskid; + smp_passthrough_req = leapraid_get_task_desc(adapter, inter_taskid); init_completion(&adapter->driver_cmds.transport_cmd.done); - leapraid_fire_task(adapter, - adapter->driver_cmds.transport_cmd.inter_taskid); + leapraid_fire_task(adapter, inter_taskid); wait_for_completion_timeout(&adapter->driver_cmds.transport_cmd.done, LEAPRAID_TRANSPORT_CMD_TIMEOUT * HZ); if (!(adapter->driver_cmds.transport_cmd.status & LEAPRAID_CMD_DONE)) { dev_err(&adapter->pdev->dev, "%s: timeout, st=0x%x\n", __func__, adapter->driver_cmds.transport_cmd.status); - leapraid_log_req_context(adapter, smp_passthrough_req); + leapraid_log_req_context(adapter, inter_taskid, + smp_passthrough_req); if (!(adapter->driver_cmds.transport_cmd.status & LEAPRAID_CMD_RESET)) { dev_dbg(&adapter->pdev->dev, @@ -1343,6 +1343,14 @@ static void leapraid_transport_smp_handler(struct bsg_job *job, if (rc) goto release_lock; + if (h2c_size < LEAPRAID_SMP_FRAME_HEADER_SIZE) { + dev_err(&adapter->pdev->dev, + "%s: Invalid SMP request payload size=%zu\n", + __func__, h2c_size); + rc = -EINVAL; + goto free_req_buf; + } + if (addr_out) sg_copy_to_buffer(job->request_payload.sg_list, job->request_payload.sg_cnt, addr_out, @@ -1353,6 +1361,14 @@ static void leapraid_transport_smp_handler(struct bsg_job *job, if (rc) goto free_req_buf; + if (c2h_size < LEAPRAID_SMP_FRAME_HEADER_SIZE) { + dev_err(&adapter->pdev->dev, + "%s: Invalid SMP reply payload size=%zu\n", + __func__, c2h_size); + rc = -EINVAL; + goto free_rep_buf; + } + rc = leapraid_check_adapter_is_op(adapter, LEAPRAID_DB_WAIT_OP_SHORT, __func__); if (rc) -- 2.25.1

2 1

[PATCH OLK-5.10] scsi: leapraid: update driver to v2.00.01.10
by haodongdong 13 Sep '26

13 Sep '26

LeapIO inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/9945 ------------------------------------------ leapraid driver changes from v2.00.01.02 to v2.00.01.10. This update includes: - AI-assisted code inspection rollout and follow-up bug fixes - Clang, Sparse, and Smatch issue cleanup - recovery-wait and nested hard-reset stabilization - SCSI EH, task-management, and AER recovery fixes - timeout, IOC-fault, and I/O diagnostic improvements - MSI-X/IRQ affinity and sparse-CPU mapping fixes - SAS topology, event bitmap, and VPHY handling fixes - async-event and SMP payload validation hardening - ioctl and passthrough bounds-checking cleanup - adapter-removal and firmware-event race fixes - firmware-log mmap lifetime and reference-count fixes - active-command teardown and IRQ synchronization - probe rollback and host-memory cleanup hardening - config-page stack usage reduction - SMART polling and NCQ sysfs alignment - drive matching and adapter metadata cleanup Signed-off-by: haodongdong <doubled(a)leap-io.com> --- drivers/scsi/leapraid/leapraid.h | 37 +- drivers/scsi/leapraid/leapraid_app.c | 169 ++- drivers/scsi/leapraid/leapraid_func.c | 1130 +++++++------------- drivers/scsi/leapraid/leapraid_func.h | 130 +-- drivers/scsi/leapraid/leapraid_os.c | 261 +++-- drivers/scsi/leapraid/leapraid_transport.c | 40 +- 6 files changed, 673 insertions(+), 1094 deletions(-) diff --git a/drivers/scsi/leapraid/leapraid.h b/drivers/scsi/leapraid/leapraid.h index 2a99417143ad..c2d28359be5b 100644 --- a/drivers/scsi/leapraid/leapraid.h +++ b/drivers/scsi/leapraid/leapraid.h @@ -27,8 +27,6 @@ /* Maximum number of retries waiting for doorbell to become operational. */ #define LEAPRAID_DB_WAIT_OP_SHORT 10 #define LEAPRAID_DB_WAIT_OP_LONG 200 -/* Sleep interval (in seconds) between doorbell polls. */ -#define LEAPRAID_DB_POLL_INTERVAL_S 1 /* Maximum number of retries waiting for host to end recovery. */ #define LEAPRAID_WAIT_SHOST_RECOVERY 400 @@ -43,7 +41,6 @@ /* The number of debug register. */ #define LEAPRAID_DEBUGLOG_SZ_MAX 16 -#define LEAPRAID_DEBUGLOG_DWORDS_PER_LINE 4 /* Reply post host register definitions. */ #define REP_POST_HOST_IDX_REG_CNT 16 @@ -180,8 +177,6 @@ #define LEAPRAID_CFG_PAGE_NUM_DEV0 0x0 /* SAS device page 0 flags. */ -#define LEAPRAID_SAS_DEV_P0_FLG_FP_CAP 0x2000 -#define LEAPRAID_SAS_DEV_P0_FLG_SATA_SMART 0x0040 #define LEAPRAID_SAS_DEV_P0_FLG_ENC_LEVEL_VALID 0x0002 #define LEAPRAID_SAS_DEV_P0_FLG_DEV_PRESENT 0x0001 #define LEAPRAID_SAS_DEV_P0_CON_NAME_LEN 4 @@ -207,15 +202,9 @@ /* Physical disk page number. */ #define LEAPRAID_CFG_PAGE_NUM_PD0 0x0 -/* Adapter page number. */ -#define LEAPRAID_CFG_PAGE_NUM_ADAPTER1 0x1 - #define LEAPRAID_CFG_UNIT_SIZE 4 /* Raid volume type and state. */ -#define LEAPRAID_VOL_STATE_MISSING 0x00 -#define LEAPRAID_VOL_STATE_FAILED 0x01 -#define LEAPRAID_VOL_STATE_INITIALIZING 0x02 #define LEAPRAID_VOL_STATE_ONLINE 0x03 #define LEAPRAID_VOL_STATE_DEGRADED 0x04 #define LEAPRAID_VOL_STATE_OPTIMAL 0x05 @@ -231,10 +220,6 @@ #define LEAPRAID_RAIDCFG_P0_EFLG_HOT_SPARE_ELEMENT 0x0002 #define LEAPRAID_RAIDCFG_P0_EFLG_OCE_ELEMENT 0x0003 -/* Raid action. */ -#define LEAPRAID_RAID_ACT_SYSTEM_SHUTDOWN_INITIATED 0x20 -#define LEAPRAID_RAID_ACT_PHYSDISK_HIDDEN 0x24 - /* SAS negotiated link rates. */ #define LEAPRAID_SAS_NEG_LINK_RATE_MASK_PHYSICAL 0x0F #define LEAPRAID_SAS_NEG_LINK_RATE_UNKNOWN_LINK_RATE 0x00 @@ -290,8 +275,6 @@ #define LEAPRAID_TM_MSGFLAGS_LINK_RESET 0x00 #define LEAPRAID_TM_RSP_INVALID_FRAME 0x02 -#define LEAPRAID_TM_RSP_TM_SUCCEEDED 0x08 -#define LEAPRAID_TM_RSP_IO_QUEUED_ON_ADAPTER 0x80 /* SCSI enclosure processor request defines. */ #define LEAPRAID_SEP_REQ_ACT_WRITE_STATUS 0x00 @@ -301,8 +284,6 @@ /* The capabilities of the adapter. */ #define LEAPRAID_ADAPTER_FEATURES_CAP_ATOMIC_REQ 0x00080000 -#define LEAPRAID_ADAPTER_FEATURES_CAP_RDPQ_ARRAY_CAPABLE 0x00040000 -#define LEAPRAID_ADAPTER_FEATURES_CAP_EVENT_REPLAY 0x00002000 #define LEAPRAID_ADAPTER_FEATURES_CAP_INTEGRATED_RAID 0x00001000 /* Event code definitions for the firmware. */ @@ -338,10 +319,6 @@ #define LEAPRAID_EVT_SAS_TOPO_RC_TARG_ADDED 0x01 #define LEAPRAID_EVT_SAS_TOPO_RC_TARG_NOT_RESPONDING 0x02 -/* SAS discovery event defines. */ -#define LEAPRAID_EVT_SAS_DISC_RC_STARTED 0x01 -#define LEAPRAID_EVT_SAS_DISC_RC_COMPLETED 0x02 - /* Enclosure device status change event. */ #define LEAPRAID_EVT_SAS_ENCL_RC_ADDED 0x01 #define LEAPRAID_EVT_SAS_ENCL_RC_NOT_RESPONDING 0x02 @@ -543,7 +520,7 @@ struct leapraid_sge_simple_union { union { __le32 addr32; __le64 addr64; - } u; + } __packed __aligned(4) u; } __packed __aligned(4); /** @@ -562,7 +539,7 @@ struct leapraid_sge_chain_union { union { __le32 addr32; __le64 addr64; - } u; + } __packed __aligned(4) u; } __packed __aligned(4); /** @@ -1672,7 +1649,7 @@ struct leapraid_adapter_features_req { * @r9: Reserved. */ struct leapraid_adapter_features_rep { - u16 msg_ver; + __le16 msg_ver; u8 msg_len; u8 func; u16 header_ver; @@ -1686,7 +1663,7 @@ struct leapraid_adapter_features_rep { u8 r4; u8 max_msix_vectors; __le16 req_slot; - u8 r5[2]; + __le16 product_id; __le32 adapter_caps; __le32 fw_version; __le16 sas_wide_max_qdepth; @@ -1871,7 +1848,7 @@ struct leapraid_evt_sas_topo_phy_entry { * @exp_dev_hdl: Expander device handle. * @num_phys: Number of PHYs in this entry. * @r1: Reserved. - * @entry_num: Entry index. + * @entry_num: Number of PHY elements. * @start_phy_num: Start PHY number. * @exp_status: Expander status. * @physical_port: Physical port number. @@ -1909,7 +1886,7 @@ struct leapraid_evt_data_sas_enc_dev_status_change { __le16 num_slots; __le16 start_slot; __le32 phy_bits; -}; +} __packed __aligned(4); /** * struct leapraid_io_unit_ctrl_req - I/O unit control request @@ -1933,7 +1910,7 @@ struct leapraid_io_unit_ctrl_req { u8 r1; u8 chain_offset; u8 func; - u16 dev_hdl; + __le16 dev_hdl; u8 adapter_para; u8 msg_flag; u8 r2[6]; diff --git a/drivers/scsi/leapraid/leapraid_app.c b/drivers/scsi/leapraid/leapraid_app.c index 25ec57c2ce4b..c4d4aace8112 100644 --- a/drivers/scsi/leapraid/leapraid_app.c +++ b/drivers/scsi/leapraid/leapraid_app.c @@ -134,13 +134,59 @@ struct leapraid_ioctl_command { u8 mf[]; }; -static struct leapraid_adapter *leapraid_ctl_lookup_adapter(int adapter_id) +static int leapraid_ctl_validate_sge_offset(struct leapraid_adapter *adapter, + const struct leapraid_req *req, + u32 offset_bytes, + size_t h2c_size, + size_t c2h_size) +{ + size_t sge_bytes; + + switch (req->func) { + case LEAPRAID_FUNC_SCSIIO: + case LEAPRAID_FUNC_SCSIIO_RAID_PASSTHROUGH: + case LEAPRAID_FUNC_SMP_PASSTHROUGH: + case LEAPRAID_FUNC_SCSIIO_SATA_PASSTHROUGH: + case LEAPRAID_FUNC_FW_DOWNLOAD: + case LEAPRAID_FUNC_FW_UPLOAD: + sge_bytes = LEAPRAID_IEEE_SGE64_ENTRY_SIZE; + break; + default: + sge_bytes = adapter->adapter_attr.use_32_dma_mask ? + sizeof(struct leapraid_sge_simple32) : + sizeof(struct leapraid_sge_simple64); + break; + } + + if (h2c_size && c2h_size) + sge_bytes *= 2; + + if (offset_bytes > LEAPRAID_REQUEST_SIZE - sge_bytes) { + dev_err(&adapter->pdev->dev, + "%s: Invalid offset_bytes=%u for func=0x%x\n", + __func__, offset_bytes, req->func); + return -EINVAL; + } + + return 0; +} + +static struct leapraid_adapter *leapraid_ctl_lookup_adapter(int adapter_id, + bool track_mmap) { struct leapraid_adapter *adapter; + struct Scsi_Host *shost; spin_lock(&leapraid_adapter_lock); list_for_each_entry(adapter, &leapraid_adapter_list, list) { if (adapter->adapter_attr.id == adapter_id) { + if (READ_ONCE(adapter->access_ctrl.host_removing)) + break; + shost = adapter->shost; + if (!shost || !scsi_host_get(shost)) + break; + if (track_mmap) + atomic_inc(&adapter->fw_log_desc.mmap_refcnt); spin_unlock(&leapraid_adapter_lock); return adapter; } @@ -150,6 +196,12 @@ static struct leapraid_adapter *leapraid_ctl_lookup_adapter(int adapter_id) return NULL; } +static void leapraid_ctl_put_adapter(struct leapraid_adapter *adapter) +{ + if (adapter && adapter->shost) + scsi_host_put(adapter->shost); +} + static void leapraid_ctl_scsiio_cmd(struct leapraid_adapter *adapter, void *ctl_sp_mpi_req, u16 taskid, @@ -245,6 +297,7 @@ static int leapraid_ctl_do_command(struct leapraid_adapter *adapter, unsigned long timeout; u16 dev_hdl = LEAPRAID_INVALID_DEV_HANDLE; bool issue_reset = false; + u32 data_sge_offset_bytes; u32 sz; int rc; @@ -257,9 +310,17 @@ static int leapraid_ctl_do_command(struct leapraid_adapter *adapter, if (!leap_mpi_req) return -ENOMEM; - if (karg->data_sge_offset > (UINT_MAX / LEAPRAID_SGE_OFFSET_SIZE) || - karg->data_sge_offset * LEAPRAID_SGE_OFFSET_SIZE > - LEAPRAID_REQUEST_SIZE) { + if (karg->data_sge_offset > (UINT_MAX / LEAPRAID_SGE_OFFSET_SIZE)) { + dev_err(&adapter->pdev->dev, + "%s: Invalid data_sge_offset=%u\n", + __func__, karg->data_sge_offset); + rc = -EINVAL; + goto out_cleanup; + } + + data_sge_offset_bytes = karg->data_sge_offset * + LEAPRAID_SGE_OFFSET_SIZE; + if (data_sge_offset_bytes > LEAPRAID_REQUEST_SIZE) { dev_err(&adapter->pdev->dev, "%s: Invalid data_sge_offset=%u\n", __func__, karg->data_sge_offset); @@ -267,8 +328,7 @@ static int leapraid_ctl_do_command(struct leapraid_adapter *adapter, goto out_cleanup; } - if (copy_from_user(leap_mpi_req, mf, - karg->data_sge_offset * LEAPRAID_SGE_OFFSET_SIZE)) { + if (copy_from_user(leap_mpi_req, mf, data_sge_offset_bytes)) { dev_err(&adapter->pdev->dev, "%s: Failed to copy request message from user\n", __func__); @@ -276,16 +336,21 @@ static int leapraid_ctl_do_command(struct leapraid_adapter *adapter, goto out_cleanup; } + h2c_size = karg->h2c_size; + c2h_size = karg->c2h_size; + rc = leapraid_ctl_validate_sge_offset(adapter, leap_mpi_req, + data_sge_offset_bytes, + h2c_size, c2h_size); + if (rc) + goto out_cleanup; + taskid = adapter->driver_cmds.ctl_cmd.taskid; adapter->driver_cmds.ctl_cmd.status = LEAPRAID_CMD_PENDING; - memset(&adapter->driver_cmds.ctl_cmd.reply, 0, - LEAPRAID_REPLY_SIZE); + memset(&adapter->driver_cmds.ctl_cmd.reply, 0, LEAPRAID_REPLY_SIZE); ctl_sp_mpi_req = leapraid_get_task_desc(adapter, taskid); memset(ctl_sp_mpi_req, 0, LEAPRAID_REQUEST_SIZE); - memcpy(ctl_sp_mpi_req, - leap_mpi_req, - karg->data_sge_offset * LEAPRAID_SGE_OFFSET_SIZE); + memcpy(ctl_sp_mpi_req, leap_mpi_req, data_sge_offset_bytes); if (ctl_sp_mpi_req->func == LEAPRAID_FUNC_SCSIIO || ctl_sp_mpi_req->func == LEAPRAID_FUNC_SCSIIO_RAID_PASSTHROUGH || @@ -305,8 +370,6 @@ static int leapraid_ctl_do_command(struct leapraid_adapter *adapter, goto out_cleanup; } - h2c_size = karg->h2c_size; - c2h_size = karg->c2h_size; if (h2c_size) { h2c = dma_alloc_coherent(&adapter->pdev->dev, h2c_size, &h2c_dma_addr, GFP_KERNEL); @@ -331,8 +394,7 @@ static int leapraid_ctl_do_command(struct leapraid_adapter *adapter, } } - psge = (void *)ctl_sp_mpi_req + (karg->data_sge_offset * - LEAPRAID_SGE_OFFSET_SIZE); + psge = (void *)ctl_sp_mpi_req + data_sge_offset_bytes; init_completion(&adapter->driver_cmds.ctl_cmd.done); switch (ctl_sp_mpi_req->func) { @@ -388,6 +450,7 @@ static int leapraid_ctl_do_command(struct leapraid_adapter *adapter, dev_err(&adapter->pdev->dev, "%s: ctl_cmd timeout, status=0x%x\n", __func__, adapter->driver_cmds.ctl_cmd.status); + leapraid_log_req_context(adapter, taskid, ctl_sp_mpi_req); } if ((leap_mpi_req->func == LEAPRAID_FUNC_SMP_PASSTHROUGH || @@ -517,7 +580,7 @@ static int leapraid_ctl_ioctl_main(struct file *file, unsigned int cmd, void __user *arg) { struct leapraid_ioctl_header ioctl_header; - struct leapraid_adapter *adapter; + struct leapraid_adapter *adapter = NULL; struct leapraid_ioctl_command __user *uarg; struct leapraid_ioctl_command karg; int rc = -ENOIOCTLCMD; @@ -529,7 +592,7 @@ static int leapraid_ctl_ioctl_main(struct file *file, unsigned int cmd, return -EFAULT; } - adapter = leapraid_ctl_lookup_adapter(ioctl_header.adapter_id); + adapter = leapraid_ctl_lookup_adapter(ioctl_header.adapter_id, false); if (!adapter) return -EFAULT; @@ -538,7 +601,8 @@ static int leapraid_ctl_ioctl_main(struct file *file, unsigned int cmd, "%s: Failed, thermal_alert=%d\n", __func__, atomic_read(&adapter->overheat_desc.thermal_alert)); - return -EFAULT; + rc = -EFAULT; + goto out_put; } mutex_lock(&adapter->access_ctrl.pci_access_lock); @@ -590,7 +654,7 @@ static int leapraid_ctl_ioctl_main(struct file *file, unsigned int cmd, break; } - if (karg.hdr.adapter_id != ioctl_header.adapter_id) { + if (karg.hdr.adapter_id != ioctl_header.adapter_id) { rc = -EINVAL; break; } @@ -618,46 +682,78 @@ static int leapraid_ctl_ioctl_main(struct file *file, unsigned int cmd, unlock: mutex_unlock(&adapter->access_ctrl.pci_access_lock); +out_put: + leapraid_ctl_put_adapter(adapter); return rc; } -static long bad_ioctl(struct file *file, unsigned int cmd, unsigned long arg) -{ - return -ENOTTY; -} - static long leapraid_ctl_ioctl(struct file *file, unsigned int cmd, unsigned long arg) { return leapraid_ctl_ioctl_main(file, cmd, (void __user *)arg); } +static void leapraid_fw_mmap_open(struct vm_area_struct *vma) +{ + struct leapraid_adapter *adapter = vma->vm_private_data; + + if (!adapter) + return; + + get_device(&adapter->shost->shost_gendev); + atomic_inc(&adapter->fw_log_desc.mmap_refcnt); +} + +static void leapraid_fw_mmap_close(struct vm_area_struct *vma) +{ + struct leapraid_adapter *adapter = vma->vm_private_data; + + if (!adapter) + return; + + if (atomic_dec_and_test(&adapter->fw_log_desc.mmap_refcnt)) + wake_up(&adapter->fw_log_desc.mmap_waitq); + leapraid_ctl_put_adapter(adapter); +} + +static const struct vm_operations_struct leapraid_fw_mmap_vm_ops = { + .open = leapraid_fw_mmap_open, + .close = leapraid_fw_mmap_close, +}; + static int leapraid_fw_mmap(struct file *filp, struct vm_area_struct *vma) { - struct leapraid_adapter *adapter; + struct leapraid_adapter *adapter = NULL; /* Userspace passes the adapter ID via vma->vm_pgoff. */ u32 adapter_id = vma->vm_pgoff; unsigned long length; - int rc; + int rc = -EINVAL; length = vma->vm_end - vma->vm_start; - adapter = leapraid_ctl_lookup_adapter(adapter_id); + adapter = leapraid_ctl_lookup_adapter(adapter_id, true); if (!adapter) { pr_err("%s: No adapter found!\n", __func__); return -EINVAL; } + if (READ_ONCE(adapter->access_ctrl.host_removing)) { + rc = -EAGAIN; + goto out_put; + } + if (length > (LEAPRAID_SYS_LOG_BUF_SIZE + LEAPRAID_SYS_LOG_BUF_RESERVE)) { dev_err(&adapter->pdev->dev, "Requested mapping size is too large!\n"); - return -EINVAL; + rc = -EINVAL; + goto out_put; } if (!adapter->fw_log_desc.fw_log_buffer) { dev_err(&adapter->pdev->dev, "No log buffer!\n"); - return -EINVAL; + rc = -EINVAL; + goto out_put; } vma->vm_pgoff = 0; @@ -669,17 +765,26 @@ static int leapraid_fw_mmap(struct file *filp, struct vm_area_struct *vma) if (rc) { dev_err(&adapter->pdev->dev, "Failed to map memory to user space!\n"); - return rc; + goto out_put; } - return 0; + vma->vm_private_data = adapter; + vma->vm_ops = &leapraid_fw_mmap_vm_ops; + leapraid_fw_mmap_open(vma); + + rc = 0; +out_put: + if (adapter && + atomic_dec_and_test(&adapter->fw_log_desc.mmap_refcnt)) + wake_up(&adapter->fw_log_desc.mmap_waitq); + leapraid_ctl_put_adapter(adapter); + return rc; } static const struct file_operations leapraid_ctl_fops = { .owner = THIS_MODULE, .unlocked_ioctl = leapraid_ctl_ioctl, .mmap = leapraid_fw_mmap, - .compat_ioctl = bad_ioctl, }; static struct miscdevice leapraid_ctl_dev = { diff --git a/drivers/scsi/leapraid/leapraid_func.c b/drivers/scsi/leapraid/leapraid_func.c index 01096664d122..edb6530735ab 100644 --- a/drivers/scsi/leapraid/leapraid_func.c +++ b/drivers/scsi/leapraid/leapraid_func.c @@ -8,21 +8,6 @@ #include "leapraid_func.h" -static int msix_disable; -module_param(msix_disable, int, 0444); -MODULE_PARM_DESC(msix_disable, - "disable msix routed interrupts (default=0)"); - -static int smart_poll; -module_param(smart_poll, int, 0444); -MODULE_PARM_DESC(smart_poll, - "check SATA drive health via SMART polling: (default=0)"); - -static int interrupt_mode; -module_param(interrupt_mode, int, 0444); -MODULE_PARM_DESC(interrupt_mode, - "intr mode: 0 is MSI-X, 1 is MSI, 2 is legacy. (default=0)"); - static int max_msix_vectors = LEAPRAID_INVALID_MSIX_VECTORS; module_param(max_msix_vectors, int, 0444); @@ -38,45 +23,23 @@ static void leapraid_ublk_io_dev(struct leapraid_adapter *adapter, static void leapraid_clear_cached_boot_dev(struct leapraid_adapter *adapter, void *dev, u32 chnl); static int leapraid_make_adapter_available(struct leapraid_adapter *adapter); +static void leapraid_sync_irqs_for_cleanup(struct leapraid_adapter *adapter); static int leapraid_fw_log_init(struct leapraid_adapter *adapter); static bool leapraid_should_skip_poll_work(struct leapraid_adapter *adapter); static int leapraid_make_adapter_ready(struct leapraid_adapter *adapter, enum reset_type type); -static void leapraid_debug_log_info(struct leapraid_adapter *adapter) +static noinline bool leapraid_shost_in_recovery(struct Scsi_Host *shost) { - struct leapraid_reg_base __iomem *iomem_base = adapter->iomem_base; - u32 debug_log[LEAPRAID_DEBUGLOG_SZ_MAX]; - bool changed = false; - int i; + enum scsi_host_state state; - if (leapraid_should_skip_poll_work(adapter)) - return; - - for (i = 0; i < LEAPRAID_DEBUGLOG_SZ_MAX; i++) { - debug_log[i] = leapraid_readl(&iomem_base->debug_log[i]); - if (debug_log[i] != adapter->fw_log_desc.pre_debug_log[i]) - changed = true; - } - - if (!changed) - return; - - memcpy(adapter->fw_log_desc.pre_debug_log, - debug_log, - sizeof(debug_log)); - - for (i = 0; i < LEAPRAID_DEBUGLOG_SZ_MAX; - i += LEAPRAID_DEBUGLOG_DWORDS_PER_LINE) - dev_warn(&adapter->pdev->dev, - "debug_log[%d-%d]: 0x%08x 0x%08x 0x%08x 0x%08x\n", - i, - i + LEAPRAID_DEBUGLOG_DWORDS_PER_LINE - 1, - debug_log[i], - debug_log[i + 1], - debug_log[i + 2], - debug_log[i + 3]); + state = READ_ONCE(shost->shost_state); + return state == SHOST_RECOVERY || + state == SHOST_CANCEL_RECOVERY || + state == SHOST_DEL_RECOVERY || + shost->tmf_in_progress; } + static inline bool leapraid_is_end_dev(u32 dev_type) { return (dev_type & LEAPRAID_DEVTYP_END_DEV) && @@ -167,7 +130,6 @@ static void leapraid_overheat_suspend(struct leapraid_adapter *adapter) pdev = adapter->pdev; shost = pci_get_drvdata(pdev); - if (!shost) { dev_warn(&pdev->dev, "Overheat suspend failed, invalid host or adapter\n"); @@ -357,6 +319,12 @@ int leapraid_check_adapter_is_op(struct leapraid_adapter *adapter, int wait, int wait_count; for (wait_count = wait; wait_count > 0; wait_count--) { + if (READ_ONCE(adapter->access_ctrl.host_removing)) { + dev_warn(&adapter->pdev->dev, + "%s: Host is removing\n", caller); + return -EFAULT; + } + if (leapraid_pci_removed(adapter)) { dev_warn(&adapter->pdev->dev, "%s: PCI device removed\n", __func__); @@ -490,11 +458,9 @@ static bool leapraid_is_fixed_taskid(struct leapraid_adapter *adapter, struct leapraid_driver_cmds *driver_cmds = &adapter->driver_cmds; return (taskid == driver_cmds->ctl_cmd.taskid || - taskid == driver_cmds->driver_scsiio_cmd.taskid || taskid == driver_cmds->tm_cmd.hp_taskid || taskid == driver_cmds->ctl_cmd.hp_taskid || taskid == driver_cmds->scan_dev_cmd.inter_taskid || - taskid == driver_cmds->timestamp_sync_cmd.inter_taskid || taskid == driver_cmds->transport_cmd.inter_taskid || taskid == driver_cmds->cfg_op_cmd.inter_taskid || taskid == driver_cmds->enc_cmd.inter_taskid || @@ -591,6 +557,8 @@ void leapraid_clean_active_scsi_cmds(struct leapraid_adapter *adapter) void *task_desc; u16 taskid; + leapraid_sync_irqs_for_cleanup(adapter); + for (taskid = 1; taskid <= adapter->shost->can_queue; taskid++) { scmd = leapraid_get_scmd_from_taskid(adapter, taskid); if (!scmd) @@ -628,8 +596,6 @@ static void leapraid_clean_active_driver_cmds(struct leapraid_adapter *adapter) struct leapraid_driver_cmds *driver_cmds; driver_cmds = &adapter->driver_cmds; - leapraid_clean_active_driver_cmd(&driver_cmds->timestamp_sync_cmd); - leapraid_clean_active_driver_cmd(&driver_cmds->driver_scsiio_cmd); leapraid_clean_active_driver_cmd(&driver_cmds->tm_cmd); leapraid_clean_active_driver_cmd(&driver_cmds->transport_cmd); leapraid_clean_active_driver_cmd(&driver_cmds->enc_cmd); @@ -1897,16 +1863,6 @@ static const char *leapraid_sas_op_name(u8 op) } } -static const char *leapraid_io_param_name(u8 adapter_param) -{ - switch (adapter_param) { - case LEAPRAID_SET_PARAMETER_SYNC_TIMESTAMP: - return "SYNC_TIMESTAMP"; - default: - return "UNKNOWN"; - } -} - static const char *leapraid_tm_type_name(u8 task_type) { switch (task_type) { @@ -1933,7 +1889,7 @@ static const char *leapraid_tm_type_name(u8 task_type) } } -void leapraid_log_req_context(struct leapraid_adapter *adapter, +void leapraid_log_req_context(struct leapraid_adapter *adapter, u16 smid, const void *req_data) { const struct leapraid_req *req = req_data; @@ -1946,8 +1902,8 @@ void leapraid_log_req_context(struct leapraid_adapter *adapter, const struct leapraid_cfg_req *cfg_req = req_data; dev_err(&adapter->pdev->dev, - "cfg-req: func=0x%02x(%s) act=0x%02x(%s)\n", - req->func, leapraid_func_name(req->func), + "cfg-req: smid=%u func=0x%02x(%s) action=0x%02x(%s)\n", + smid, req->func, leapraid_func_name(req->func), cfg_req->action, leapraid_cfg_action_name(cfg_req->action)); dev_err(&adapter->pdev->dev, @@ -1969,12 +1925,12 @@ void leapraid_log_req_context(struct leapraid_adapter *adapter, const struct leapraid_scsi_tm_req *tm_req = req_data; dev_err(&adapter->pdev->dev, - "scsi_tm: func=0x%02x(%s) task=0x%02x(%s)\n", - req->func, leapraid_func_name(req->func), + "scsi_tm:: smid=%u func=0x%02x(%s) task=0x%02x(%s)\n", + smid, req->func, leapraid_func_name(req->func), tm_req->task_type, leapraid_tm_type_name(tm_req->task_type)); dev_err(&adapter->pdev->dev, - "scsi_tm: dev_hdl=0x%04x task_mid=%u\n", + "scsi_tm:: dev_hdl=0x%04x task_mid=%u\n", le16_to_cpu(tm_req->dev_hdl), le16_to_cpu(tm_req->task_mid)); break; @@ -1983,8 +1939,8 @@ void leapraid_log_req_context(struct leapraid_adapter *adapter, const struct leapraid_sep_req *sep_req = req_data; dev_err(&adapter->pdev->dev, - "sep: func=0x%02x(%s) act=0x%02x(%s)\n", - req->func, leapraid_func_name(req->func), + "sep: smid=%u func=0x%02x(%s) action=0x%02x(%s)\n", + smid, req->func, leapraid_func_name(req->func), sep_req->act, leapraid_sep_action_name(sep_req->act)); dev_err(&adapter->pdev->dev, @@ -1998,32 +1954,34 @@ void leapraid_log_req_context(struct leapraid_adapter *adapter, const struct leapraid_io_unit_ctrl_req *io_req = req_data; dev_err(&adapter->pdev->dev, - "timestamp sync: func=0x%02x(%s) op=0x%02x(%s)\n", - req->func, leapraid_func_name(req->func), + "ctl_cmd: smid=%u func=0x%02x(%s) action=0x%02x(%s)\n", + smid, req->func, leapraid_func_name(req->func), io_req->op, leapraid_sas_op_name(io_req->op)); dev_err(&adapter->pdev->dev, - "timestamp sync: dev_hdl=0x%04x param=0x%02x(%s)\n", + "ctl_cmd: dev_hdl=0x%04x param=0x%02x\n", le16_to_cpu(io_req->dev_hdl), - io_req->adapter_para, - leapraid_io_param_name(io_req->adapter_para)); + io_req->adapter_para); break; } case LEAPRAID_FUNC_SMP_PASSTHROUGH: { const struct leapraid_smp_passthrough_req *smp_req = req_data; dev_err(&adapter->pdev->dev, - "transport: func=0x%02x(%s) port=%u req_len=%u\n", - req->func, leapraid_func_name(req->func), + "smp_cmd: smid=%u func=0x%02x(%s) action=0x%02x\n", + smid, req->func, leapraid_func_name(req->func), + smp_req->passthrough_flg); + dev_err(&adapter->pdev->dev, + "smp_cmd: port=%u req_len=%u\n", smp_req->physical_port, le16_to_cpu(smp_req->req_data_len)); - dev_err(&adapter->pdev->dev, "transport: sas_addr=0x%016llx\n", + dev_err(&adapter->pdev->dev, "smp_cmd: sas_addr=0x%016llx\n", (unsigned long long)le64_to_cpu(smp_req->sas_address)); break; } default: dev_err(&adapter->pdev->dev, - "%s: func=0x%02x(%s)\n", - __func__, req->func, leapraid_func_name(req->func)); + "cmd: smid=%u func=0x%02x(%s)\n", + smid, req->func, leapraid_func_name(req->func)); break; } } @@ -2034,19 +1992,18 @@ static void leapraid_build_and_fire_cfg_req( struct leapraid_cfg_rep *leap_mpi_cfgp_rep) { struct leapraid_cfg_req *local_leap_cfg_req; + u16 smid; memset(leap_mpi_cfgp_rep, 0, sizeof(struct leapraid_cfg_rep)); memset(&adapter->driver_cmds.cfg_op_cmd.reply, 0, sizeof(struct leapraid_cfg_rep)); adapter->driver_cmds.cfg_op_cmd.status = LEAPRAID_CMD_PENDING; - local_leap_cfg_req = leapraid_get_task_desc( - adapter, - adapter->driver_cmds.cfg_op_cmd.inter_taskid); + smid = adapter->driver_cmds.cfg_op_cmd.inter_taskid; + local_leap_cfg_req = leapraid_get_task_desc(adapter, smid); memcpy(local_leap_cfg_req, leap_mpi_cfgp_req, sizeof(struct leapraid_cfg_req)); init_completion(&adapter->driver_cmds.cfg_op_cmd.done); - leapraid_fire_task(adapter, - adapter->driver_cmds.cfg_op_cmd.inter_taskid); + leapraid_fire_task(adapter, smid); wait_for_completion_timeout(&adapter->driver_cmds.cfg_op_cmd.done, LEAPRAID_CFG_OP_TIMEOUT * HZ); } @@ -2059,11 +2016,13 @@ static int leapraid_req_cfg_func(struct leapraid_adapter *adapter, { u32 adapter_status = UINT_MAX; bool issue_reset = false; + u16 smid; u8 retry_cnt; int rc; retry_cnt = 0; mutex_lock(&adapter->driver_cmds.cfg_op_cmd.mutex); + smid = adapter->driver_cmds.cfg_op_cmd.inter_taskid; retry: if (retry_cnt) { if (retry_cnt > LEAPRAID_CFG_REQ_RETRY_TIMES) { @@ -2100,14 +2059,16 @@ static int leapraid_req_cfg_func(struct leapraid_adapter *adapter, adapter->access_ctrl.shost_recovering ? "shost recovery" : "pcie recovery", adapter->driver_cmds.cfg_op_cmd.status); - leapraid_log_req_context(adapter, leap_mpi_cfgp_req); + leapraid_log_req_context(adapter, smid, + leap_mpi_cfgp_req); issue_reset = false; rc = -EFAULT; } else { dev_err(&adapter->pdev->dev, "cfg-req: timeout, status=0x%x, reset\n", adapter->driver_cmds.cfg_op_cmd.status); - leapraid_log_req_context(adapter, leap_mpi_cfgp_req); + leapraid_log_req_context(adapter, smid, + leap_mpi_cfgp_req); issue_reset = true; } @@ -2147,7 +2108,7 @@ static int leapraid_req_cfg_func(struct leapraid_adapter *adapter, mutex_unlock(&adapter->driver_cmds.cfg_op_cmd.mutex); if (issue_reset) { if (adapter->scan_dev_desc.first_scan_dev_fired) { - dev_info(&adapter->pdev->dev, + dev_warn(&adapter->pdev->dev, "%s:%d cfg-req: Failure, issuing reset\n", __func__, __LINE__); leapraid_hard_reset_handler(adapter, FULL_RESET); @@ -2418,14 +2379,12 @@ static int leapraid_cfg_find_vol_in_page( u16 phys_hdl; phys_hdl = le16_to_cpu(elem->phys_disk_dev_hdl); - if (phys_hdl == pd_hdl) { *vol_hdl = le16_to_cpu(elem->vol_dev_hdl); return 0; } break; } - case LEAPRAID_RAIDCFG_P0_EFLG_HOT_SPARE_ELEMENT: *vol_hdl = 0; return 0; @@ -2592,7 +2551,6 @@ static int leapraid_cfg_get_number_pds(struct leapraid_adapter *adapter, cfgp2.handle = hdl; rc = leapraid_op_config_page(adapter, &raidvol_p0, cfgp1, cfgp2, GET_RAID_VOLUME_PG0); - if (!rc) *num_pds = raidvol_p0.num_phys_disks; @@ -2806,61 +2764,6 @@ void leapraid_fw_log_start(struct leapraid_adapter *adapter) spin_unlock_irqrestore(&adapter->reset_desc.adapter_reset_lock, flags); } -static void leapraid_timestamp_sync(struct leapraid_adapter *adapter) -{ - struct leapraid_io_unit_ctrl_req *io_unit_ctrl_req; - ktime_t current_time; - bool issue_reset = false; - u64 time_stamp; - - mutex_lock(&adapter->driver_cmds.timestamp_sync_cmd.mutex); - adapter->driver_cmds.timestamp_sync_cmd.status = LEAPRAID_CMD_PENDING; - io_unit_ctrl_req = - leapraid_get_task_desc( - adapter, - adapter->driver_cmds.timestamp_sync_cmd.inter_taskid); - memset(io_unit_ctrl_req, 0, sizeof(struct leapraid_io_unit_ctrl_req)); - io_unit_ctrl_req->func = LEAPRAID_FUNC_SAS_IO_UNIT_CTRL; - io_unit_ctrl_req->op = LEAPRAID_SAS_OP_SET_PARAMETER; - io_unit_ctrl_req->adapter_para = LEAPRAID_SET_PARAMETER_SYNC_TIMESTAMP; - - current_time = ktime_get_real(); - time_stamp = ktime_to_ms(current_time); - - io_unit_ctrl_req->adapter_para_value = - cpu_to_le32(time_stamp & 0xFFFFFFFF); - io_unit_ctrl_req->adapter_para_value2 = - cpu_to_le32(time_stamp >> 32); - init_completion(&adapter->driver_cmds.timestamp_sync_cmd.done); - leapraid_fire_task( - adapter, - adapter->driver_cmds.timestamp_sync_cmd.inter_taskid); - leapraid_debug_log_info(adapter); - wait_for_completion_timeout(&adapter->driver_cmds - .timestamp_sync_cmd.done, - LEAPRAID_TIMESTAMP_SYNC_CMD_TIMEOUT * HZ); - if (!(adapter->driver_cmds.timestamp_sync_cmd.status & - LEAPRAID_CMD_DONE)) { - dev_err(&adapter->pdev->dev, - "%s: timestamp sync timeout, status=0x%x\n", - __func__, - adapter->driver_cmds.timestamp_sync_cmd.status); - leapraid_log_req_context(adapter, io_unit_ctrl_req); - issue_reset = - leapraid_check_reset( - adapter->driver_cmds.timestamp_sync_cmd.status); - } - - if (issue_reset) { - dev_info(&adapter->pdev->dev, "%s:%d: call hard_reset\n", - __func__, __LINE__); - leapraid_hard_reset_handler(adapter, FULL_RESET); - } - - adapter->driver_cmds.timestamp_sync_cmd.status = LEAPRAID_CMD_NOT_USED; - mutex_unlock(&adapter->driver_cmds.timestamp_sync_cmd.mutex); -} - static void leapraid_check_scheduled_fault_work(struct work_struct *work) { struct leapraid_adapter *adapter; @@ -2876,21 +2779,16 @@ static void leapraid_check_scheduled_fault_work(struct work_struct *work) adapter_state = leapraid_get_adapter_state(adapter); if (adapter_state != LEAPRAID_DB_OPERATIONAL) { - dev_info(&adapter->pdev->dev, "%s:%d: call hard_reset\n", - __func__, __LINE__); + dev_info(&adapter->pdev->dev, "%s:%d: call hard_reset 0x%x\n", + __func__, __LINE__, adapter_state); rc = leapraid_hard_reset_handler(adapter, FULL_RESET); - dev_warn(&adapter->pdev->dev, "%s: Hard reset %s\n", - __func__, rc == 0 ? "success" : "failed"); - adapter_state = leapraid_get_adapter_state(adapter); - if (rc && adapter_state != LEAPRAID_DB_OPERATIONAL) + if (rc && adapter_state != LEAPRAID_DB_OPERATIONAL) { + dev_err(&adapter->pdev->dev, + "%s: Hard reset failed, state=0x%x rc=%d\n", + __func__, adapter_state, rc); return; - } - - if (++adapter->timestamp_sync_cnt >= - LEAPRAID_TIMESTAMP_SYNC_INTERVAL) { - adapter->timestamp_sync_cnt = 0; - leapraid_timestamp_sync(adapter); + } } scheduled_timer: @@ -2910,7 +2808,6 @@ void leapraid_check_scheduled_fault_start(struct leapraid_adapter *adapter) if (adapter->reset_desc.fault_reset_wq) return; - adapter->timestamp_sync_cnt = 0; INIT_DELAYED_WORK(&adapter->reset_desc.fault_reset_work, leapraid_check_scheduled_fault_work); snprintf(adapter->reset_desc.fault_reset_wq_name, @@ -2953,308 +2850,6 @@ void leapraid_check_scheduled_fault_stop(struct leapraid_adapter *adapter) destroy_workqueue(wq); } -static bool leapraid_ready_for_scsi_io(struct leapraid_adapter *adapter, - u16 hdl) -{ - if (adapter->access_ctrl.pcie_recovering || - adapter->access_ctrl.shost_recovering) { - dev_err(&adapter->pdev->dev, - "%s: Failed, pcie_recovering=%d shost_recovering=%d\n", - __func__, - adapter->access_ctrl.pcie_recovering, - adapter->access_ctrl.shost_recovering); - return false; - } - - if (leapraid_check_adapter_is_op(adapter, LEAPRAID_DB_WAIT_OP_SHORT, - __func__)) - return false; - - if (hdl == LEAPRAID_INVALID_DEV_HANDLE) { - dev_err(&adapter->pdev->dev, - "%s: Device handle is invalid\n", __func__); - return false; - } - - return true; -} - -static int leapraid_dispatch_scsi_io(struct leapraid_adapter *adapter, - struct leapraid_scsi_cmd_desc *cmd_desc) -{ - struct scsi_device *sdev; - struct scsi_device *target_sdev = NULL; - struct leapraid_sdev_priv *sdev_priv; - struct scsi_cmnd *scmd; - void *dma_buffer = NULL; - dma_addr_t dma_addr; - bool issue_reset = false; - int rc; - - if (WARN_ON(!adapter->driver_cmds.internal_scmd)) - return -EINVAL; - - if (!leapraid_ready_for_scsi_io(adapter, cmd_desc->hdl)) - return -EINVAL; - - mutex_lock(&adapter->driver_cmds.driver_scsiio_cmd.mutex); - if (adapter->driver_cmds.driver_scsiio_cmd.status != - LEAPRAID_CMD_NOT_USED) { - dev_err(&adapter->pdev->dev, - "%s: scsiio cmd busy\n", __func__); - rc = -EAGAIN; - goto out_cleanup; - } - adapter->driver_cmds.driver_scsiio_cmd.status = LEAPRAID_CMD_PENDING; - - shost_for_each_device(sdev, adapter->shost) { - sdev_priv = sdev->hostdata; - - if (sdev_priv->starget_priv->hdl == cmd_desc->hdl && - sdev_priv->lun == cmd_desc->lun) { - target_sdev = sdev; - break; - } - } - - if (!target_sdev) { - dev_warn(&adapter->pdev->dev, - "%s: Device not found\n", __func__); - rc = -ENXIO; - goto out_cleanup; - } - - if (cmd_desc->data_length) { - dma_buffer = dma_alloc_coherent(&adapter->pdev->dev, - cmd_desc->data_length, - &dma_addr, GFP_ATOMIC); - if (!dma_buffer) { - rc = -ENOMEM; - goto out_cleanup; - } - if (cmd_desc->dir == DMA_TO_DEVICE) - memcpy(dma_buffer, cmd_desc->data_buffer, - cmd_desc->data_length); - } - - scmd = adapter->driver_cmds.internal_scmd; - scmd->device = target_sdev; - scmd->cmd_len = cmd_desc->cdb_length; - memcpy(scmd->cmnd, cmd_desc->cdb, cmd_desc->cdb_length); - scmd->sc_data_direction = cmd_desc->dir; - scmd->sdb.length = cmd_desc->data_length; - scmd->sdb.table.nents = 1; - scmd->sdb.table.orig_nents = 1; - sg_init_one(scmd->sdb.table.sgl, dma_buffer, cmd_desc->data_length); - init_completion(&adapter->driver_cmds.driver_scsiio_cmd.done); - if (leapraid_queuecommand(adapter->shost, scmd)) { - adapter->driver_cmds.driver_scsiio_cmd.status &= - ~LEAPRAID_CMD_PENDING; - complete(&adapter->driver_cmds.driver_scsiio_cmd.done); - dev_err(&adapter->pdev->dev, - "%s: queuecommand failed\n", __func__); - rc = -EINVAL; - goto out_cleanup; - } - - wait_for_completion_timeout(&adapter->driver_cmds - .driver_scsiio_cmd.done, - cmd_desc->time_out * HZ); - - if (!(adapter->driver_cmds.driver_scsiio_cmd.status & - LEAPRAID_CMD_DONE)) { - issue_reset = - leapraid_check_reset( - adapter->driver_cmds.driver_scsiio_cmd.status); - rc = -ENODATA; - goto reset; - } - - rc = adapter->driver_cmds.internal_scmd->result; - if (!rc && cmd_desc->dir == DMA_FROM_DEVICE) - memcpy(cmd_desc->data_buffer, dma_buffer, - cmd_desc->data_length); - -reset: - if (issue_reset) { - rc = -ENODATA; - dev_err(&adapter->pdev->dev, "fire tgt reset: hdl=0x%04x\n", - cmd_desc->hdl); - leapraid_issue_locked_tm( - adapter, cmd_desc->hdl, 0, 0, 0, - LEAPRAID_TM_TASKTYPE_TARGET_RESET, - adapter->driver_cmds.driver_scsiio_cmd.taskid, - LEAPRAID_TM_MSGFLAGS_LINK_RESET); - } -out_cleanup: - if (target_sdev) - scsi_device_put(target_sdev); - - if (dma_buffer) - dma_free_coherent(&adapter->pdev->dev, - cmd_desc->data_length, - dma_buffer, - dma_addr); - - adapter->driver_cmds.driver_scsiio_cmd.status = LEAPRAID_CMD_NOT_USED; - mutex_unlock(&adapter->driver_cmds.driver_scsiio_cmd.mutex); - return rc; -} - -static int leapraid_dispatch_logsense(struct leapraid_adapter *adapter, - u16 hdl, u32 lun) -{ - struct leapraid_scsi_cmd_desc *desc; - char *buf; - int rc; - - desc = kzalloc(sizeof(*desc), GFP_KERNEL); - if (!desc) - return -ENOMEM; - - desc->hdl = hdl; - desc->lun = lun; - desc->data_length = LEAPRAID_LOGSENSE_DATA_LENGTH; - desc->dir = DMA_FROM_DEVICE; - desc->cdb_length = LEAPRAID_LOGSENSE_CDB_LENGTH; - desc->cdb[0] = LOG_SENSE; - desc->cdb[2] = LEAPRAID_LOGSENSE_CDB_CODE; - desc->cdb[8] = desc->data_length; - desc->raid_member = 0; - desc->time_out = LEAPRAID_LOGSENSE_TIMEOUT; - - desc->data_buffer = kzalloc(desc->data_length, GFP_KERNEL); - if (!desc->data_buffer) { - kfree(desc); - return -ENOMEM; - } - - rc = leapraid_dispatch_scsi_io(adapter, desc); - buf = desc->data_buffer; - - if (!rc && buf[8] == LEAPRAID_LOGSENSE_SMART_CODE) - leapraid_smart_fault_detect(adapter, hdl); - - kfree(desc->data_buffer); - kfree(desc); - - return rc; -} - -static bool leapraid_smart_poll_check(struct leapraid_adapter *adapter, - struct leapraid_sdev_priv *sdev_priv, - u32 reset_flg) -{ - struct leapraid_sas_dev *sas_dev; - - if (!sdev_priv || !sdev_priv->starget_priv->card_port) - return false; - - sas_dev = leapraid_get_sas_dev_by_addr( - adapter, - sdev_priv->starget_priv->sas_address, - sdev_priv->starget_priv->card_port); - if (!sas_dev || !sas_dev->support_smart) - goto out_fail; - - if (reset_flg) - sas_dev->led_on = 0; - else if (sas_dev->led_on) - goto out_fail; - - if (sdev_priv->starget_priv->flg & LEAPRAID_TGT_FLG_RAID_MEMBER || - sdev_priv->starget_priv->flg & LEAPRAID_TGT_FLG_VOLUME || - sdev_priv->block) - goto out_fail; - - leapraid_sdev_put(sas_dev); - return true; - -out_fail: - if (sas_dev) - leapraid_sdev_put(sas_dev); - return false; -} - -static void leapraid_sata_smart_poll_work(struct work_struct *work) -{ - struct leapraid_adapter *adapter = - container_of(work, struct leapraid_adapter, - smart_poll_desc.smart_poll_work.work); - struct scsi_device *sdev; - struct leapraid_sdev_priv *sdev_priv; - bool reset_flg = false; - - if (leapraid_should_skip_poll_work(adapter)) - goto scheduled_timer; - - if (leapraid_check_adapter_is_op(adapter, LEAPRAID_DB_WAIT_OP_SHORT, - __func__)) - goto scheduled_timer; - - if (adapter->reset_desc.last_reset_cnt < adapter->reset_desc.reset_cnt) - reset_flg = true; - - adapter->reset_desc.last_reset_cnt = adapter->reset_desc.reset_cnt; - - shost_for_each_device(sdev, adapter->shost) { - sdev_priv = sdev->hostdata; - if (leapraid_smart_poll_check(adapter, sdev_priv, reset_flg)) - leapraid_dispatch_logsense(adapter, - sdev_priv->starget_priv->hdl, - sdev_priv->lun); - } - -scheduled_timer: - if (adapter->smart_poll_desc.smart_poll_wq) - queue_delayed_work( - adapter->smart_poll_desc.smart_poll_wq, - &adapter->smart_poll_desc.smart_poll_work, - msecs_to_jiffies(LEAPRAID_SMART_POLLING_INTERVAL)); -} - -void leapraid_smart_polling_start(struct leapraid_adapter *adapter) -{ - if (adapter->smart_poll_desc.smart_poll_wq || !smart_poll) - return; - - INIT_DELAYED_WORK(&adapter->smart_poll_desc.smart_poll_work, - leapraid_sata_smart_poll_work); - - snprintf(adapter->smart_poll_desc.smart_poll_wq_name, - sizeof(adapter->smart_poll_desc.smart_poll_wq_name), - "poll_%s%u_smart_poll", - LEAPRAID_DRIVER_NAME, - adapter->adapter_attr.id); - adapter->smart_poll_desc.smart_poll_wq = - create_singlethread_workqueue( - adapter->smart_poll_desc.smart_poll_wq_name); - if (!adapter->smart_poll_desc.smart_poll_wq) - return; - queue_delayed_work(adapter->smart_poll_desc.smart_poll_wq, - &adapter->smart_poll_desc.smart_poll_work, - msecs_to_jiffies(LEAPRAID_SMART_POLLING_INTERVAL)); -} - -void leapraid_smart_polling_stop(struct leapraid_adapter *adapter) -{ - struct workqueue_struct *wq; - struct leapraid_smart_poll_desc *desc; - - desc = &adapter->smart_poll_desc; - if (!desc->smart_poll_wq) - return; - - wq = desc->smart_poll_wq; - desc->smart_poll_wq = NULL; - - if (wq) { - if (!cancel_delayed_work_sync(&desc->smart_poll_work)) - flush_workqueue(wq); - destroy_workqueue(wq); - } -} - static void leapraid_overheat_work(struct work_struct *work) { struct leapraid_overheat_desc *desc; @@ -3289,13 +2884,11 @@ static void leapraid_overheat_work(struct work_struct *work) adapter->scan_dev_desc.scan_start = 0; adapter->scan_dev_desc.wait_scan_dev_done = 0; adapter->scan_dev_desc.driver_loading = 0; - wake_up(&adapter->access_ctrl.recovery_waitq); wake_up(&adapter->access_ctrl.shost_recover_wq); wake_up(&adapter->scan_dev_desc.wait_driver_loading); leapraid_mask_int(adapter); - leapraid_smart_polling_stop(adapter); leapraid_check_scheduled_fault_stop(adapter); leapraid_fw_log_stop(adapter); leapraid_mq_polling_pause(adapter); @@ -3378,10 +2971,10 @@ static struct leapraid_fw_evt_work *leapraid_alloc_fw_evt_work(void) { struct leapraid_fw_evt_work *fw_evt = kzalloc(sizeof(*fw_evt), GFP_ATOMIC); - if (!fw_evt) - return NULL; - kref_init(&fw_evt->refcnt); + if (fw_evt) + kref_init(&fw_evt->refcnt); + return fw_evt; } @@ -3398,10 +2991,14 @@ static void leapraid_fw_evt_add(struct leapraid_adapter *adapter, { unsigned long flags; - if (!adapter->fw_evt_s.fw_evt_thread) + spin_lock_irqsave(&adapter->fw_evt_s.fw_evt_lock, flags); + if (adapter->access_ctrl.host_removing || + adapter->access_ctrl.pcie_recovering || + !adapter->fw_evt_s.fw_evt_thread) { + spin_unlock_irqrestore(&adapter->fw_evt_s.fw_evt_lock, flags); return; + } - spin_lock_irqsave(&adapter->fw_evt_s.fw_evt_lock, flags); leapraid_fw_evt_get(fw_evt); INIT_LIST_HEAD(&fw_evt->list); list_add_tail(&fw_evt->list, &adapter->fw_evt_s.fw_evt_list); @@ -3452,7 +3049,6 @@ void leapraid_clean_active_fw_evt(struct leapraid_adapter *adapter) return; adapter->fw_evt_s.fw_evt_cleanup = 1; - wake_up(&adapter->access_ctrl.recovery_waitq); if (adapter->access_ctrl.shost_recovering && adapter->fw_evt_s.cur_evt) adapter->fw_evt_s.cur_evt->ignore = 1; @@ -3727,8 +3323,6 @@ static struct leapraid_sas_dev *leapraid_init_sas_dev( sas_dev->dev_name = le64_to_cpu(sas_dev_pg0->dev_name); sas_dev->port_connection = sas_dev_pg0->max_port_connections; sas_dev->slot = sas_dev->enc_hdl ? le16_to_cpu(sas_dev_pg0->slot) : 0; - sas_dev->support_smart = (le16_to_cpu(sas_dev_pg0->flg) & - LEAPRAID_SAS_DEV_P0_FLG_SATA_SMART); if (le16_to_cpu(sas_dev_pg0->flg) & LEAPRAID_SAS_DEV_P0_FLG_ENC_LEVEL_VALID) { sas_dev->enc_level = sas_dev_pg0->enc_level; @@ -3976,11 +3570,11 @@ static int leapraid_refresh_card_phy(struct leapraid_adapter *adapter, return 0; if (le32_to_cpu(phy_pg0.phy_info) & - LEAPRAID_SAS_PHYINFO_VPHY && - !leapraid_alloc_vphy(adapter, port_id, i)) - return -EINVAL; - - card->card_phy[i].vphy = 1; + LEAPRAID_SAS_PHYINFO_VPHY) { + if (!leapraid_alloc_vphy(adapter, port_id, i)) + return -ENOMEM; + card->card_phy[i].vphy = 1; + } } card->card_phy[i].hdl = card->hdl; @@ -4367,7 +3961,7 @@ void leapraid_exp_rm(struct leapraid_adapter *adapter, u64 sas_addr, leapraid_exp_node_rm(adapter, topo_node_exp); } -static int leapraid_internal_sas_topo_chg_evt( +static void leapraid_internal_sas_topo_chg_evt( struct leapraid_adapter *adapter, struct leapraid_card_port *card_port, struct leapraid_topo_node *topo_node_exp, @@ -4384,11 +3978,11 @@ static int leapraid_internal_sas_topo_chg_evt( evt_data = fw_evt->evt_data; for (i = 0; i < evt_data->entry_num; i++) { if (fw_evt->ignore) - return 0; + return; if (adapter->access_ctrl.host_removing || adapter->access_ctrl.pcie_recovering) - return 0; + return; phy_number = evt_data->start_phy_num + i; if (phy_number >= max_phys) @@ -4426,12 +4020,10 @@ static int leapraid_internal_sas_topo_chg_evt( if (evt_data->exp_status == LEAPRAID_EVT_SAS_TOPO_ES_NOT_RESPONDING && topo_node_exp) leapraid_exp_rm(adapter, sas_addr, card_port); - - return 0; } -static int leapraid_sas_topo_chg_evt(struct leapraid_adapter *adapter, - struct leapraid_fw_evt_work *fw_evt) +static void leapraid_sas_topo_chg_evt(struct leapraid_adapter *adapter, + struct leapraid_fw_evt_work *fw_evt) { struct leapraid_topo_node *topo_node_exp; struct leapraid_card_port *card_port; @@ -4444,13 +4036,13 @@ static int leapraid_sas_topo_chg_evt(struct leapraid_adapter *adapter, if (adapter->access_ctrl.shost_recovering || adapter->access_ctrl.host_removing || adapter->access_ctrl.pcie_recovering) - return 0; + return; evt_data = fw_evt->evt_data; leapraid_sas_host_add(adapter, adapter->dev_topo.card.phys_num > 0); if (fw_evt->ignore) - return 0; + return; phdl = le16_to_cpu(evt_data->exp_dev_hdl); card_port = leapraid_get_port_by_id(adapter, @@ -4458,7 +4050,7 @@ static int leapraid_sas_topo_chg_evt(struct leapraid_adapter *adapter, false); if (evt_data->exp_status == LEAPRAID_EVT_SAS_TOPO_ES_ADDED && leapraid_exp_add(adapter, phdl) != 0) - return 0; + return; spin_lock_irqsave(&adapter->dev_topo.topo_node_lock, flags); topo_node_exp = leapraid_exp_find_by_hdl(adapter, phdl); @@ -4472,13 +4064,13 @@ static int leapraid_sas_topo_chg_evt(struct leapraid_adapter *adapter, } else { spin_unlock_irqrestore(&adapter->dev_topo.topo_node_lock, flags); - return 0; + return; } spin_unlock_irqrestore(&adapter->dev_topo.topo_node_lock, flags); - return leapraid_internal_sas_topo_chg_evt(adapter, card_port, - topo_node_exp, fw_evt, - sas_addr, max_phys); + leapraid_internal_sas_topo_chg_evt(adapter, card_port, + topo_node_exp, fw_evt, + sas_addr, max_phys); } static void leapraid_reprobe_lun(struct scsi_device *sdev, void *no_uld_attach) @@ -4588,7 +4180,6 @@ static void leapraid_sas_pd_hide( } spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); if (starget) { - dev_info(&adapter->pdev->dev, "hide sas_dev, hdl=0x%x\n", hdl); starget_for_each_device(starget, (void *)LEAPRAID_NO_ULD_ATTACH_FLAG, leapraid_reprobe_lun); @@ -4608,7 +4199,6 @@ static void leapraid_sas_pd_expose( u16 hdl; hdl = le16_to_cpu(evt_data->phys_disk_dev_hdl); - if (!hdl || hdl > adapter->adapter_attr.features.max_dev_handle) { dev_warn(&adapter->pdev->dev, "%s: Invalid device handle\n", __func__); @@ -4637,10 +4227,8 @@ static void leapraid_sas_pd_expose( spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); if (starget) { - dev_info(&adapter->pdev->dev, - "expose sas_dev, hdl=0x%x\n", hdl); starget_for_each_device(starget, - LEAPRAID_ULD_ATTACH_FLAG, + NULL, leapraid_reprobe_lun); } @@ -4971,7 +4559,7 @@ static void leapraid_remove_unresp_sas_end_dev( leapraid_sdev_put(sas_dev); } - dev_info(&adapter->pdev->dev, + dev_warn(&adapter->pdev->dev, "Unresponsive SAS end devices removed\n"); } @@ -4996,7 +4584,7 @@ static void leapraid_remove_unresp_raid_volumes( leapraid_sas_volume_delete_by_ptr(adapter, raid_volume); } - dev_info(&adapter->pdev->dev, + dev_warn(&adapter->pdev->dev, "Unresponsive RAID volumes removed\n"); } @@ -5020,7 +4608,7 @@ static void leapraid_remove_unresp_sas_exp(struct leapraid_adapter *adapter) &head, list) leapraid_exp_node_rm(adapter, topo_node_exp); - dev_info(&adapter->pdev->dev, + dev_warn(&adapter->pdev->dev, "Unresponsive SAS expanders removed\n"); } @@ -5138,8 +4726,6 @@ static void leapraid_scan_exp_after_reset(struct leapraid_adapter *adapter) u16 hdl; u8 port_id; - dev_info(&adapter->pdev->dev, "Begin scanning expanders\n"); - cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (hdl = 0xFFFF, cfgp2.handle = hdl; !leapraid_op_config_page(adapter, &exp_p0, cfgp1, cfgp2, @@ -5170,8 +4756,6 @@ static void leapraid_scan_exp_after_reset(struct leapraid_adapter *adapter) exp_p0.sas_address)); } } - - dev_info(&adapter->pdev->dev, "Expanders scan complete\n"); } static void leapraid_scan_phy_disks_after_reset( @@ -5188,8 +4772,6 @@ static void leapraid_scan_phy_disks_after_reset( u16 hdl, parent_hdl; u64 sas_addr; - dev_info(&adapter->pdev->dev, "Begin scanning phys disk\n"); - cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (phys_disk_num = 0xFF, cfgp2.form_specific = phys_disk_num; !leapraid_op_config_page(adapter, &raidpd_p0, @@ -5238,8 +4820,6 @@ static void leapraid_scan_phy_disks_after_reset( } } } - - dev_info(&adapter->pdev->dev, "PHYs disk scan complete\n"); } static void leapraid_scan_vol_after_reset(struct leapraid_adapter *adapter) @@ -5264,7 +4844,6 @@ static void leapraid_scan_vol_after_reset(struct leapraid_adapter *adapter) return; } - dev_info(&adapter->pdev->dev, "Begin scanning volumes\n"); cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (hdl = 0xFFFF, cfgp2.handle = hdl; !leapraid_op_config_page(adapter, vol_p1, cfgp1, @@ -5301,8 +4880,6 @@ static void leapraid_scan_vol_after_reset(struct leapraid_adapter *adapter) kfree(vol_p0); kfree(vol_p1); - - dev_info(&adapter->pdev->dev, "Volumes scan complete\n"); } static void leapraid_scan_sas_dev_after_reset(struct leapraid_adapter *adapter) @@ -5315,9 +4892,6 @@ static void leapraid_scan_sas_dev_after_reset(struct leapraid_adapter *adapter) u64 sas_address; u8 port_id; - dev_info(&adapter->pdev->dev, - "Begin scanning SAS end devices\n"); - cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (hdl = 0xFFFF, cfgp2.handle = hdl; !leapraid_op_config_page(adapter, &sas_dev_p0, cfgp1, cfgp2, @@ -5367,14 +4941,10 @@ static void leapraid_scan_sas_dev_after_reset(struct leapraid_adapter *adapter) sas_dev_p0.sas_address)); } } - - dev_info(&adapter->pdev->dev, "SAS end devices scan complete\n"); } static void leapraid_scan_all_dev_after_reset(struct leapraid_adapter *adapter) { - dev_info(&adapter->pdev->dev, "Begin scanning devices\n"); - leapraid_sas_host_add(adapter, adapter->dev_topo.card.phys_num > 0); leapraid_scan_exp_after_reset(adapter); if (adapter->adapter_attr.raid_support) { @@ -5382,8 +4952,6 @@ static void leapraid_scan_all_dev_after_reset(struct leapraid_adapter *adapter) leapraid_scan_vol_after_reset(adapter); } leapraid_scan_sas_dev_after_reset(adapter); - - dev_info(&adapter->pdev->dev, "Devices scan complete\n"); } static void leapraid_hardreset_async_logic(struct leapraid_adapter *adapter) @@ -5411,6 +4979,7 @@ static int leapraid_send_enc_cmd(struct leapraid_adapter *adapter, void *req; bool reset_flg = false; int rc; + u16 smid; mutex_lock(&adapter->driver_cmds.enc_cmd.mutex); rc = leapraid_check_adapter_is_op(adapter, LEAPRAID_DB_WAIT_OP_SHORT, @@ -5419,21 +4988,19 @@ static int leapraid_send_enc_cmd(struct leapraid_adapter *adapter, goto unlock; adapter->driver_cmds.enc_cmd.status = LEAPRAID_CMD_PENDING; - req = leapraid_get_task_desc( - adapter, - adapter->driver_cmds.enc_cmd.inter_taskid); + smid = adapter->driver_cmds.enc_cmd.inter_taskid; + req = leapraid_get_task_desc(adapter, smid); memset(req, 0, LEAPRAID_REQUEST_SIZE); memcpy(req, sep_req, sizeof(struct leapraid_sep_req)); init_completion(&adapter->driver_cmds.enc_cmd.done); - leapraid_fire_task(adapter, - adapter->driver_cmds.enc_cmd.inter_taskid); + leapraid_fire_task(adapter, smid); wait_for_completion_timeout(&adapter->driver_cmds.enc_cmd.done, LEAPRAID_ENC_CMD_TIMEOUT * HZ); if (!(adapter->driver_cmds.enc_cmd.status & LEAPRAID_CMD_DONE)) { dev_err(&adapter->pdev->dev, "%s: SEP command timeout, status=0x%x\n", __func__, adapter->driver_cmds.enc_cmd.status); - leapraid_log_req_context(adapter, sep_req); + leapraid_log_req_context(adapter, smid, sep_req); reset_flg = leapraid_check_reset( adapter->driver_cmds.enc_cmd.status); @@ -5497,10 +5064,10 @@ static int leapraid_wait_adapter_recovery(struct leapraid_adapter *adapter) { unsigned long flags; - while (scsi_host_in_recovery(adapter->shost) || - adapter->access_ctrl.shost_recovering) { - if (adapter->access_ctrl.host_removing || - adapter->fw_evt_s.fw_evt_cleanup) { + while (leapraid_shost_in_recovery(adapter->shost) || + READ_ONCE(adapter->access_ctrl.shost_recovering)) { + if (READ_ONCE(adapter->access_ctrl.host_removing) || + READ_ONCE(adapter->fw_evt_s.fw_evt_cleanup)) { spin_lock_irqsave( &adapter->reset_desc.adapter_reset_lock, flags); @@ -5520,12 +5087,13 @@ static int leapraid_wait_adapter_recovery(struct leapraid_adapter *adapter) return -EFAULT; } - wait_event_timeout(adapter->access_ctrl.recovery_waitq, - !adapter->access_ctrl.shost_recovering || - adapter->access_ctrl.host_removing || - adapter->fw_evt_s.fw_evt_cleanup, - msecs_to_jiffies(1000)); + wait_event_timeout( + adapter->access_ctrl.recovery_waitq, + (!leapraid_shost_in_recovery(adapter->shost) && + !READ_ONCE(adapter->access_ctrl.shost_recovering)), + msecs_to_jiffies(1000)); } + return 0; } @@ -5610,7 +5178,6 @@ static void leapraid_sas_dev_stat_chg_evt( leapraid_get_port_by_id(adapter, event_data->physical_port, false)); - if (!sas_dev || !sas_dev->starget) goto out_unlock; @@ -5740,6 +5307,80 @@ static void leapraid_check_topo_del_evts( leapraid_topo_del_evts_process_exp_status(adapter, evt_data); } +static bool leapraid_async_evt_validate( + struct leapraid_adapter *adapter, + struct leapraid_evt_notify_rep *event_notify_rep) +{ + size_t msg_len; + size_t evt_sz; + size_t evt_avail; + u16 evt; + + msg_len = event_notify_rep->msg_len * sizeof(u32); + if (msg_len > LEAPRAID_REPLY_SIZE || + msg_len < offsetof(struct leapraid_evt_notify_rep, evt_data)) { + dev_warn(&adapter->pdev->dev, + "%s: Invalid async event msg_len=%zu\n", + __func__, msg_len); + return false; + } + + evt_sz = le16_to_cpu(event_notify_rep->evt_data_len) * sizeof(u32); + evt_avail = msg_len - + offsetof(struct leapraid_evt_notify_rep, evt_data); + if (evt_sz > evt_avail) { + dev_warn(&adapter->pdev->dev, + "%s: Invalid async event evt_data_len=%zu\n", + __func__, evt_sz); + return false; + } + + evt = le16_to_cpu(event_notify_rep->evt); + switch (evt) { + case LEAPRAID_EVT_SAS_DEV_STATUS_CHANGE: + if (evt_sz < + sizeof(struct leapraid_evt_data_sas_dev_status_change)) + goto invalid_evt_sz; + break; + case LEAPRAID_EVT_IR_CHANGE: + if (evt_sz < sizeof(struct leapraid_evt_data_ir_change)) + goto invalid_evt_sz; + break; + case LEAPRAID_EVT_SAS_TOPO_CHANGE_LIST: + { + struct leapraid_evt_data_sas_topo_change_list *evt_data = + (void *)event_notify_rep->evt_data; + size_t hdr_sz; + + hdr_sz = + offsetof(struct leapraid_evt_data_sas_topo_change_list, + phy); + if (evt_sz < hdr_sz) + goto invalid_evt_sz; + + if (evt_data->entry_num > + (evt_sz - hdr_sz) / sizeof(evt_data->phy[0])) + goto invalid_evt_sz; + break; + } + case LEAPRAID_EVT_SAS_ENCL_DEV_STATUS_CHANGE: + if (evt_sz < + sizeof(struct leapraid_evt_data_sas_enc_dev_status_change)) + goto invalid_evt_sz; + break; + default: + break; + } + + return true; + +invalid_evt_sz: + dev_warn(&adapter->pdev->dev, + "%s: Invalid async event size=%zu for evt=0x%x\n", + __func__, evt_sz, evt); + return false; +} + static bool leapraid_async_process_evt( struct leapraid_adapter *adapter, struct leapraid_evt_notify_rep *event_notify_rep) @@ -5747,6 +5388,10 @@ static bool leapraid_async_process_evt( u16 evt = le16_to_cpu(event_notify_rep->evt); bool exit_flag = false; + if (adapter->access_ctrl.host_removing || + adapter->access_ctrl.pcie_recovering) + return true; + switch (evt) { case LEAPRAID_EVT_SAS_DEV_STATUS_CHANGE: leapraid_sas_dev_stat_chg_evt( @@ -5809,13 +5454,17 @@ static void leapraid_async_evt_cb(struct leapraid_adapter *adapter, { struct leapraid_evt_notify_rep *evt_notify_rep; - if (adapter->access_ctrl.pcie_recovering) + if (adapter->access_ctrl.host_removing || + adapter->access_ctrl.pcie_recovering) return; evt_notify_rep = leapraid_get_reply_vaddr(adapter, rep_paddr); if (unlikely(!evt_notify_rep)) return; + if (!leapraid_async_evt_validate(adapter, evt_notify_rep)) + return; + if (leapraid_async_process_evt(adapter, evt_notify_rep)) return; @@ -5880,9 +5529,9 @@ static void leapraid_scan_dev_complete(struct leapraid_adapter *adapter) leapraid_fw_evt_put(fw_evt); } -static u8 leapraid_handle_scan_cb(struct leapraid_adapter *adapter, - struct leapraid_driver_cmd *cmd, - struct leapraid_rep *rep) +static void leapraid_handle_scan_cb(struct leapraid_adapter *adapter, + struct leapraid_driver_cmd *cmd, + struct leapraid_rep *rep) { u16 status; @@ -5890,21 +5539,18 @@ static u8 leapraid_handle_scan_cb(struct leapraid_adapter *adapter, status = le16_to_cpu(rep->adapter_status) & LEAPRAID_ADAPTER_STATUS_MASK; - if (status != LEAPRAID_ADAPTER_STATUS_SUCCESS) adapter->scan_dev_desc.scan_dev_failed = 1; if (!cmd->async_scan_dev) { complete(&cmd->done); - return 1; + return; } if (status == LEAPRAID_ADAPTER_STATUS_SUCCESS) leapraid_scan_dev_complete(adapter); else adapter->scan_dev_desc.scan_start_failed = status; - - return 1; } static void leapraid_handle_ctl_cb(struct leapraid_adapter *adapter, @@ -5918,7 +5564,6 @@ static void leapraid_handle_ctl_cb(struct leapraid_adapter *adapter, return; scsiio_reply = (struct leapraid_scsiio_rep *)rep; - if (!(scsiio_reply->scsi_state & LEAPRAID_SCSI_STATE_AUTOSENSE_VALID)) return; @@ -5961,10 +5606,11 @@ static bool leapraid_driver_cmds_done(struct leapraid_adapter *adapter, memcpy(&_sp_cmd->reply, leap_mpi_rep, reply_len); _sp_cmd->status |= LEAPRAID_CMD_REPLY_VALID; - if (_sp_cmd->cb_idx == LEAPRAID_SCAN_DEV_CB_IDX) - return leapraid_handle_scan_cb(adapter, - _sp_cmd, - leap_mpi_rep); + if (_sp_cmd->cb_idx == LEAPRAID_SCAN_DEV_CB_IDX) { + leapraid_handle_scan_cb(adapter, _sp_cmd, + leap_mpi_rep); + return true; + } if (_sp_cmd->cb_idx == LEAPRAID_CTL_CB_IDX) leapraid_handle_ctl_cb(adapter, leap_mpi_rep, taskid); @@ -5979,8 +5625,9 @@ static bool leapraid_driver_cmds_done(struct leapraid_adapter *adapter, static void leapraid_complete_task(struct leapraid_adapter *adapter, u16 taskid, u8 msix_idx, u32 rep) { - if (taskid <= adapter->shost->can_queue || - taskid == adapter->driver_cmds.driver_scsiio_cmd.taskid) { + bool scsiio_task = taskid <= adapter->shost->can_queue; + + if (scsiio_task) { if (leapraid_scsiio_done(adapter, taskid, msix_idx, rep)) leapraid_free_taskid(adapter, taskid); return; @@ -6160,6 +5807,22 @@ void leapraid_sync_irqs(struct leapraid_adapter *adapter, bool poll) } } +static void leapraid_sync_irqs_for_cleanup(struct leapraid_adapter *adapter) +{ + struct leapraid_notification_desc *desc = &adapter->notification_desc; + struct leapraid_int_rq *int_rq; + unsigned int i; + + if (!adapter->mask_int && leapraid_pci_active(adapter)) + leapraid_mask_int(adapter); + + for (i = 0; i < desc->int_rqs_allocated; i++) { + int_rq = &desc->int_rqs[i]; + synchronize_irq(pci_irq_vector(adapter->pdev, + int_rq->rq.msix_idx)); + } +} + void leapraid_mq_polling_pause(struct leapraid_adapter *adapter) { struct leapraid_notification_desc *desc; @@ -6230,7 +5893,6 @@ static int leapraid_host_diag_reset(struct leapraid_adapter *adapter) { u32 host_diag; - dev_info(&adapter->pdev->dev, "Entering host diag reset!\n"); pci_cfg_access_lock(adapter->pdev); mutex_lock(&adapter->reset_desc.host_diag_mutex); @@ -6254,14 +5916,13 @@ static int leapraid_host_diag_reset(struct leapraid_adapter *adapter) goto out_failed; pci_cfg_access_unlock(adapter->pdev); - dev_info(&adapter->pdev->dev, "Host diag success!\n"); return 0; out_cleanup: mutex_unlock(&adapter->reset_desc.host_diag_mutex); out_failed: pci_cfg_access_unlock(adapter->pdev); - dev_info(&adapter->pdev->dev, "Host diag failed!\n"); + dev_err(&adapter->pdev->dev, "Host diag failed\n"); return -EFAULT; } @@ -6776,11 +6437,8 @@ static void leapraid_search_resp_sas_dev(struct leapraid_adapter *adapter) struct leapraid_sas_dev_p0 sas_dev_p0; u32 device_info; - dev_info(&adapter->pdev->dev, - "Begin searching for SAS end devices\n"); - if (list_empty(&adapter->dev_topo.sas_dev_list)) - goto exit_search; + return; cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (cfgp2.handle = 0xFFFF; @@ -6793,9 +6451,6 @@ static void leapraid_search_resp_sas_dev(struct leapraid_adapter *adapter) leapraid_mark_resp_sas_dev(adapter, &sas_dev_p0); } -exit_search: - dev_info(&adapter->pdev->dev, - "SAS end devices searching complete\n"); } static void leapraid_mark_resp_raid_volume(struct leapraid_adapter *adapter, @@ -6864,14 +6519,11 @@ static void leapraid_search_resp_raid_volume(struct leapraid_adapter *adapter) if (!adapter->adapter_attr.raid_support) return; - dev_info(&adapter->pdev->dev, - "Begin searching for RAID volumes\n"); - spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); is_empty = list_empty(&adapter->dev_topo.raid_volume_list); spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); if (is_empty) - goto exit_search; + return; cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (hdl = 0xFFFF, cfgp2.handle = hdl; @@ -6909,9 +6561,6 @@ static void leapraid_search_resp_raid_volume(struct leapraid_adapter *adapter) else set_bit(hdl, adapter->dev_topo.pd_hdls); } -exit_search: - dev_info(&adapter->pdev->dev, - "RAID volumes searching complete\n"); } static void leapraid_mark_resp_exp(struct leapraid_adapter *adapter, @@ -6972,10 +6621,8 @@ static void leapraid_search_resp_exp(struct leapraid_adapter *adapter) u16 hdl; u8 port; - dev_dbg(&adapter->pdev->dev, - "Begin searching for expanders\n"); if (list_empty(&adapter->dev_topo.exp_list)) - goto exit_search; + return; cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (hdl = 0xFFFF, cfgp2.handle = hdl; @@ -6993,9 +6640,6 @@ static void leapraid_search_resp_exp(struct leapraid_adapter *adapter) LEAPRAID_DISABLE_MP_PORT_ID); leapraid_mark_resp_exp(adapter, &exp_p0); } -exit_search: - dev_dbg(&adapter->pdev->dev, - "Expander searching complete\n"); } void leapraid_wait_cmds_done(struct leapraid_adapter *adapter) @@ -7042,6 +6686,15 @@ int leapraid_hard_reset_handler(struct leapraid_adapter *adapter, mutex_lock(&adapter->reset_desc.adapter_reset_mutex); + if (adapter->access_ctrl.shost_recover_async) { + rc = adapter->reset_desc.adapter_reset_results; + dev_info(&adapter->pdev->dev, + "Skip nested hard reset, async evt running, rc=%d\n", + rc); + mutex_unlock(&adapter->reset_desc.adapter_reset_mutex); + return rc; + } + if (!leapraid_pci_active(adapter)) { if (leapraid_pci_removed(adapter)) { dev_info(&adapter->pdev->dev, @@ -7084,7 +6737,6 @@ int leapraid_hard_reset_handler(struct leapraid_adapter *adapter, dev_err(&adapter->pdev->dev, "Previous device scan failed or driver loading\n"); adapter->access_ctrl.host_removing = 1; - wake_up(&adapter->access_ctrl.recovery_waitq); rc = -EFAULT; goto out_cleanup; } @@ -7105,8 +6757,8 @@ int leapraid_hard_reset_handler(struct leapraid_adapter *adapter, leapraid_hardreset_barrier(adapter); } out_cleanup: - dev_info(&adapter->pdev->dev, "Hard reset %s\n", - rc == 0 ? "SUCCESS" : "FAILED"); + if (rc) + dev_err(&adapter->pdev->dev, "Hard reset failed\n"); spin_lock_irqsave(&adapter->reset_desc.adapter_reset_lock, flags); adapter->reset_desc.adapter_reset_results = rc; @@ -7238,9 +6890,17 @@ static int leapraid_get_adapter_features(struct leapraid_adapter *adapter) fw_major, fw_minor, fw_build, fw_release, adapter->adapter_attr.features.fw_version); - if (fw_major < 2) { - dev_err(&adapter->pdev->dev, - "Unsupported firmware major version, requires >= 2\n"); + adapter->adapter_attr.features.msg_ver = + le16_to_cpu(leap_mpi_rep.msg_ver); + adapter->adapter_attr.features.product_id = + le16_to_cpu(leap_mpi_rep.product_id); + dev_info(&adapter->pdev->dev, + "message version: 0x%x, product id 0x%x\n", + adapter->adapter_attr.features.msg_ver, + adapter->adapter_attr.features.product_id); + + if (adapter->adapter_attr.features.msg_ver < 0x1000) { + dev_err(&adapter->pdev->dev, "Device not supported\n"); return -EFAULT; } adapter->shost->max_id = LEAPRAID_INVALID_INITIAL_VALUE; @@ -7327,13 +6987,16 @@ static void leapraid_cpus_on_irq(struct leapraid_adapter *adapter) index++) { int_rq = &adapter->notification_desc.int_rqs[index]; - if (cpu >= nr_cpus) + if (cpu >= adapter->notification_desc.msix_cpu_map_sz) break; this_group = base_group + (index < (nr_cpus % total_msix) ? 1 : 0); for (i = 0 ; i < this_group ; i++) { + if (cpu >= adapter->notification_desc.msix_cpu_map_sz) + break; + adapter->notification_desc.msix_cpu_map[cpu] = int_rq->rq.msix_idx; cpu = cpumask_next(cpu, cpu_online_mask); @@ -7345,8 +7008,8 @@ static void leapraid_map_msix_to_cpu(struct leapraid_adapter *adapter) { struct leapraid_int_rq *int_rq; const cpumask_t *affinity_mask; + int cpu; u32 i; - u16 cpu; if (!adapter->adapter_attr.rq_cnt) return; @@ -7364,16 +7027,29 @@ static void leapraid_map_msix_to_cpu(struct leapraid_adapter *adapter) for_each_cpu_and(cpu, affinity_mask, cpu_online_mask) { if (cpu >= adapter->notification_desc.msix_cpu_map_sz) - break; + continue; adapter->notification_desc.msix_cpu_map[cpu] = int_rq->rq.msix_idx; } } + return; out_apply_irq_affinity: leapraid_cpus_on_irq(adapter); } +static int leapraid_alloc_msix_cpu_map(struct leapraid_adapter *adapter) +{ + adapter->notification_desc.msix_cpu_map_sz = nr_cpu_ids; + adapter->notification_desc.msix_cpu_map = + kzalloc(adapter->notification_desc.msix_cpu_map_sz, + GFP_KERNEL); + if (!adapter->notification_desc.msix_cpu_map) + return -ENOMEM; + + return 0; +} + static void leapraid_configure_reply_queue_affinity( struct leapraid_adapter *adapter) { @@ -7423,16 +7099,16 @@ static void leapraid_free_irq(struct leapraid_adapter *adapter) static int leapraid_setup_irqs(struct leapraid_adapter *adapter) { + int irq_mode = adapter->notification_desc.irq_mode; unsigned int i; int rc = 0; - if (interrupt_mode == LEAPRAID_INTERRUPT_MODE_MSIX) { + if (irq_mode == LEAPRAID_INTERRUPT_MODE_MSIX) { rc = pci_alloc_irq_vectors_affinity( adapter->pdev, adapter->notification_desc.iopoll_qdex, adapter->notification_desc.iopoll_qdex, PCI_IRQ_MSIX | PCI_IRQ_AFFINITY, NULL); - if (rc < 0) { dev_err(&adapter->pdev->dev, "%d MSI/MSIX vectors allocated failed!\n", @@ -7441,20 +7117,18 @@ static int leapraid_setup_irqs(struct leapraid_adapter *adapter) } adapter->notification_desc.irq_vectors_allocated = 1; - adapter->notification_desc.irq_mode = - LEAPRAID_INTERRUPT_MODE_MSIX; } for (i = 0; i < adapter->notification_desc.iopoll_qdex; i++) { adapter->notification_desc.int_rqs[i].rq.adapter = adapter; adapter->notification_desc.int_rqs[i].rq.msix_idx = i; atomic_set(&adapter->notification_desc.int_rqs[i].rq.busy, 0); - if (interrupt_mode == LEAPRAID_INTERRUPT_MODE_MSIX) + if (irq_mode == LEAPRAID_INTERRUPT_MODE_MSIX) snprintf(adapter->notification_desc.int_rqs[i].rq.name, LEAPRAID_NAME_LENGTH, "%s%u-MSIx%u", LEAPRAID_DRIVER_NAME, adapter->adapter_attr.id, i); - else if (interrupt_mode == LEAPRAID_INTERRUPT_MODE_MSI) + else if (irq_mode == LEAPRAID_INTERRUPT_MODE_MSI) snprintf(adapter->notification_desc.int_rqs[i].rq.name, LEAPRAID_NAME_LENGTH, "%s%u-MSI%u", LEAPRAID_DRIVER_NAME, @@ -7465,7 +7139,6 @@ static int leapraid_setup_irqs(struct leapraid_adapter *adapter) IRQF_SHARED, adapter->notification_desc.int_rqs[i].rq.name, &adapter->notification_desc.int_rqs[i].rq); - if (rc) { dev_err(&adapter->pdev->dev, "MSI/MSIx: request_irq %s failed!\n", @@ -7525,12 +7198,9 @@ static int leapraid_set_legacy_int(struct leapraid_adapter *adapter) { int rc; - adapter->notification_desc.msix_cpu_map_sz = num_online_cpus(); - adapter->notification_desc.msix_cpu_map = - kzalloc(adapter->notification_desc.msix_cpu_map_sz, - GFP_KERNEL); - if (!adapter->notification_desc.msix_cpu_map) - return -ENOMEM; + rc = leapraid_alloc_msix_cpu_map(adapter); + if (rc) + return rc; adapter->adapter_attr.rq_cnt = 1; adapter->notification_desc.iopoll_qdex = @@ -7547,9 +7217,7 @@ static int leapraid_set_legacy_int(struct leapraid_adapter *adapter) if (!adapter->notification_desc.int_rqs) return -ENOMEM; - rc = leapraid_setup_legacy_int(adapter); - - return rc; + return leapraid_setup_legacy_int(adapter); } static int leapraid_set_msix(struct leapraid_adapter *adapter) @@ -7558,14 +7226,11 @@ static int leapraid_set_msix(struct leapraid_adapter *adapter) unsigned int i; int rc, msix_cnt; - if (msix_disable == 1) - goto apply_legacy_int; - msix_cnt = pci_msix_vec_count(adapter->pdev); if (msix_cnt <= 0 || adapter->adapter_attr.features.max_msix_vectors == 0) { dev_info(&adapter->pdev->dev, "MSIX unsupported!\n"); - goto apply_legacy_int; + return -EOPNOTSUPP; } msix_cnt = min_t(int, msix_cnt, @@ -7628,31 +7293,20 @@ static int leapraid_set_msix(struct leapraid_adapter *adapter) 0); } - adapter->notification_desc.msix_cpu_map_sz = - num_online_cpus(); - adapter->notification_desc.msix_cpu_map = - kzalloc(adapter->notification_desc.msix_cpu_map_sz, - GFP_KERNEL); - if (!adapter->notification_desc.msix_cpu_map) - return -ENOMEM; - - memset(adapter->notification_desc.msix_cpu_map, 0, - adapter->notification_desc.msix_cpu_map_sz); + rc = leapraid_alloc_msix_cpu_map(adapter); + if (rc) + return rc; + adapter->notification_desc.irq_mode = LEAPRAID_INTERRUPT_MODE_MSIX; adapter->notification_desc.msix_enable = 1; rc = leapraid_setup_irqs(adapter); if (rc) { leapraid_free_irq(adapter); adapter->notification_desc.msix_enable = 0; - goto apply_legacy_int; + return rc; } return 0; - -apply_legacy_int: - rc = leapraid_set_legacy_int(adapter); - - return rc; } static int leapraid_set_msi(struct leapraid_adapter *adapter) @@ -7661,14 +7315,11 @@ static int leapraid_set_msi(struct leapraid_adapter *adapter) unsigned int i; int rc, msi_cnt; - if (msix_disable == 1) - goto apply_legacy_int; - msi_cnt = pci_msi_vec_count(adapter->pdev); if (msi_cnt <= 0 || adapter->adapter_attr.features.max_msix_vectors == 0) { dev_info(&adapter->pdev->dev, "MSI unsupported!\n"); - goto apply_legacy_int; + return -EOPNOTSUPP; } msi_cnt = min_t(int, msi_cnt, @@ -7711,10 +7362,9 @@ static int leapraid_set_msi(struct leapraid_adapter *adapter) "%d MSI vectors allocated failed!\n", adapter->notification_desc.iopoll_qdex); leapraid_free_irq(adapter); - goto apply_legacy_int; + return rc; } adapter->notification_desc.irq_vectors_allocated = 1; - adapter->notification_desc.irq_mode = LEAPRAID_INTERRUPT_MODE_MSI; if (rc != adapter->notification_desc.iopoll_qdex) { adapter->notification_desc.iopoll_qdex = rc; adapter->adapter_attr.rq_cnt = @@ -7754,51 +7404,46 @@ static int leapraid_set_msi(struct leapraid_adapter *adapter) 0); } - adapter->notification_desc.msix_cpu_map_sz = num_online_cpus(); - adapter->notification_desc.msix_cpu_map = - kzalloc(adapter->notification_desc.msix_cpu_map_sz, - GFP_KERNEL); - if (!adapter->notification_desc.msix_cpu_map) - return -ENOMEM; - memset(adapter->notification_desc.msix_cpu_map, 0, - adapter->notification_desc.msix_cpu_map_sz); + rc = leapraid_alloc_msix_cpu_map(adapter); + if (rc) + return rc; + adapter->notification_desc.irq_mode = LEAPRAID_INTERRUPT_MODE_MSI; adapter->notification_desc.msix_enable = 1; rc = leapraid_setup_irqs(adapter); if (rc) { leapraid_free_irq(adapter); adapter->notification_desc.msix_enable = 0; - goto apply_legacy_int; + return rc; } return 0; - -apply_legacy_int: - rc = leapraid_set_legacy_int(adapter); - - return rc; } -static int leapraid_set_notification(struct leapraid_adapter *adapter) +static int leapraid_set_notification_auto(struct leapraid_adapter *adapter) { - int rc = 0; + int rc; - if (interrupt_mode == LEAPRAID_INTERRUPT_MODE_MSIX) { - rc = leapraid_set_msix(adapter); - if (rc) - dev_err(&adapter->pdev->dev, - "%s: Enable MSI-X irq failed!\n", __func__); - } else if (interrupt_mode == LEAPRAID_INTERRUPT_MODE_MSI) { - rc = leapraid_set_msi(adapter); - if (rc) - dev_err(&adapter->pdev->dev, - "%s: Enable MSI irq failed!\n", __func__); - } else if (interrupt_mode == LEAPRAID_INTERRUPT_MODE_LEGACY) { - rc = leapraid_set_legacy_int(adapter); - if (rc) - dev_err(&adapter->pdev->dev, - "%s: Enable legacy irq failed!\n", __func__); - } + rc = leapraid_set_msix(adapter); + if (!rc) + return 0; + + leapraid_free_irq(adapter); + dev_info(&adapter->pdev->dev, + "MSI-X setup failed (%d), trying MSI\n", rc); + + rc = leapraid_set_msi(adapter); + if (!rc) + return 0; + + leapraid_free_irq(adapter); + dev_info(&adapter->pdev->dev, + "MSI setup failed (%d), back to legacy INTx\n", rc); + + rc = leapraid_set_legacy_int(adapter); + if (rc) + dev_err(&adapter->pdev->dev, + "%s: Enable legacy irq failed!\n", __func__); return rc; } @@ -7825,7 +7470,7 @@ int leapraid_set_pcie_and_notification(struct leapraid_adapter *adapter) goto out_fail; } - rc = leapraid_set_notification(adapter); + rc = leapraid_set_notification_auto(adapter); if (rc) goto out_fail; @@ -7859,18 +7504,16 @@ static int leapraid_adapter_unit_reset(struct leapraid_adapter *adapter) { int rc = 0; - dev_info(&adapter->pdev->dev, "fire unit reset\n"); writel(LEAPRAID_FUNC_ADAPTER_UNIT_RESET << LEAPRAID_DB_FUNC_SHIFT, &adapter->iomem_base->db); if (leapraid_db_wait_ack_and_clear_int(adapter)) rc = -EFAULT; if (!leapraid_wait_adapter_ready(adapter)) { - dev_info(&adapter->pdev->dev, "unit reset: FAILED\n"); + dev_err(&adapter->pdev->dev, "unit reset failed\n"); return -EFAULT; } - dev_info(&adapter->pdev->dev, "unit reset: SUCCESS\n"); return rc; } @@ -7878,7 +7521,6 @@ static int leapraid_make_adapter_ready(struct leapraid_adapter *adapter, enum reset_type type) { u32 db; - int rc; int count; if (!leapraid_pci_active(adapter)) @@ -7917,8 +7559,7 @@ static int leapraid_make_adapter_ready(struct leapraid_adapter *adapter, return 0; full_reset: - rc = leapraid_host_diag_reset(adapter); - return rc; + return leapraid_host_diag_reset(adapter); } static void leapraid_fw_log_exit(struct leapraid_adapter *adapter) @@ -7927,6 +7568,8 @@ static void leapraid_fw_log_exit(struct leapraid_adapter *adapter) return; if (adapter->fw_log_desc.fw_log_buffer) { + wait_event(adapter->fw_log_desc.mmap_waitq, + !atomic_read(&adapter->fw_log_desc.mmap_refcnt)); dma_free_coherent(&adapter->pdev->dev, (LEAPRAID_SYS_LOG_BUF_SIZE + LEAPRAID_SYS_LOG_BUF_RESERVE), @@ -8058,10 +7701,15 @@ static void leapraid_free_host_memory(struct leapraid_adapter *adapter) adapter->mem_desc.rep_desc_q_arr = NULL; } - for (i = 0; i < adapter->adapter_attr.rep_desc_q_seg_cnt; i++) + for (i = 0; i < adapter->adapter_attr.rep_desc_q_seg_cnt; i++) { + struct leapraid_mem_desc *mem_desc = + &adapter->mem_desc; kfree(adapter->mem_desc.rep_desc_seg_maint[i] .rep_desc_maint); + mem_desc->rep_desc_seg_maint[i].rep_desc_maint = NULL; + } kfree(adapter->mem_desc.rep_desc_seg_maint); + adapter->mem_desc.rep_desc_seg_maint = NULL; } if (adapter->mem_desc.io_tracker) { @@ -8074,6 +7722,7 @@ static void leapraid_free_host_memory(struct leapraid_adapter *adapter) } dma_pool_destroy(adapter->mem_desc.sg_chain_pool); + adapter->mem_desc.sg_chain_pool = NULL; } static inline bool leapraid_is_in_same_4g_seg(dma_addr_t start, u32 size) @@ -8095,15 +7744,13 @@ int leapraid_internal_init_cmd_priv(struct leapraid_adapter *adapter, return 0; } -int leapraid_internal_exit_cmd_priv(struct leapraid_adapter *adapter, - struct leapraid_io_req_tracker *io_tracker) +void leapraid_internal_exit_cmd_priv(struct leapraid_adapter *adapter, + struct leapraid_io_req_tracker *io_tracker) { if (io_tracker && io_tracker->chain) dma_pool_free(adapter->mem_desc.sg_chain_pool, io_tracker->chain, io_tracker->chain_dma); - - return 0; } static int leapraid_request_host_memory(struct leapraid_adapter *adapter) @@ -8149,12 +7796,9 @@ static int leapraid_request_host_memory(struct leapraid_adapter *adapter) adapter->dynamic_task_desc.inter_cmd_qd; /* SCSI host can queue. */ adapter->shost->can_queue = adapter->adapter_attr.io_qd - - LEAPRAID_TASKID_OFFSET_SCSIIO_CMD; + LEAPRAID_TASKID_OFFSET_CTRL_CMD; adapter->driver_cmds.ctl_cmd.taskid = adapter->shost->can_queue + LEAPRAID_TASKID_OFFSET_CTRL_CMD; - adapter->driver_cmds.driver_scsiio_cmd.taskid = - adapter->shost->can_queue + - LEAPRAID_TASKID_OFFSET_SCSIIO_CMD; /* Allocate task descriptor. */ try_again: @@ -8197,7 +7841,6 @@ static int leapraid_request_host_memory(struct leapraid_adapter *adapter) goto out_fail; } - adapter->dynamic_task_desc.hp_taskid = adapter->adapter_attr.io_qd + LEAPRAID_HP_TASKID_OFFSET_CTL_CMD; @@ -8219,9 +7862,6 @@ static int leapraid_request_host_memory(struct leapraid_adapter *adapter) adapter->driver_cmds.transport_cmd.inter_taskid = adapter->dynamic_task_desc.inter_taskid + LEAPRAID_TASKID_OFFSET_TRANSPORT_CMD; - adapter->driver_cmds.timestamp_sync_cmd.inter_taskid = - adapter->dynamic_task_desc.inter_taskid + - LEAPRAID_TASKID_OFFSET_TIMESTAMP_SYNC_CMD; adapter->driver_cmds.enc_cmd.inter_taskid = adapter->dynamic_task_desc.inter_taskid + LEAPRAID_TASKID_OFFSET_ENC_CMD; @@ -8281,8 +7921,11 @@ static int leapraid_request_host_memory(struct leapraid_adapter *adapter) LEAPRAID_REPLY_SIZE, &adapter->mem_desc.rep_msg_dma, GFP_KERNEL); - if (!adapter->mem_desc.rep_msg) - return -ENOMEM; + if (!adapter->mem_desc.rep_msg) { + rc = -ENOMEM; + goto out_fail; + } + if (!leapraid_is_in_same_4g_seg(adapter->mem_desc.rep_msg_dma, adapter->adapter_attr.rep_msg_qd * LEAPRAID_REPLY_SIZE)) { @@ -8394,9 +8037,10 @@ static int leapraid_alloc_dev_topo_bitmaps(struct leapraid_adapter *adapter) { u16 pd_hdls_sz; - pd_hdls_sz = adapter->adapter_attr.features.max_dev_handle / - LEAPRAID_BITS_PER_BYTE; - pd_hdls_sz++; + pd_hdls_sz = + BITS_TO_LONGS( + adapter->adapter_attr.features.max_dev_handle + 1) * + sizeof(unsigned long); adapter->dev_topo.pd_hdls_sz = pd_hdls_sz; adapter->dev_topo.pd_hdls = @@ -8420,9 +8064,6 @@ static void leapraid_free_dev_topo_bitmaps(struct leapraid_adapter *adapter) static int leapraid_init_driver_cmds(struct leapraid_adapter *adapter) { - u32 buffer_size; - void *buffer; - INIT_LIST_HEAD(&adapter->driver_cmds.special_cmd_list); adapter->driver_cmds.scan_dev_cmd.status = LEAPRAID_CMD_NOT_USED; @@ -8442,49 +8083,6 @@ static int leapraid_init_driver_cmds(struct leapraid_adapter *adapter) list_add_tail(&adapter->driver_cmds.transport_cmd.list, &adapter->driver_cmds.special_cmd_list); - adapter->driver_cmds.timestamp_sync_cmd.status = LEAPRAID_CMD_NOT_USED; - adapter->driver_cmds.timestamp_sync_cmd.cb_idx = - LEAPRAID_TIMESTAMP_SYNC_CB_IDX; - mutex_init(&adapter->driver_cmds.timestamp_sync_cmd.mutex); - list_add_tail(&adapter->driver_cmds.timestamp_sync_cmd.list, - &adapter->driver_cmds.special_cmd_list); - - adapter->driver_cmds.raid_action_cmd.status = LEAPRAID_CMD_NOT_USED; - adapter->driver_cmds.raid_action_cmd.cb_idx = - LEAPRAID_RAID_ACTION_CB_IDX; - mutex_init(&adapter->driver_cmds.raid_action_cmd.mutex); - list_add_tail(&adapter->driver_cmds.raid_action_cmd.list, - &adapter->driver_cmds.special_cmd_list); - - adapter->driver_cmds.driver_scsiio_cmd.status = LEAPRAID_CMD_NOT_USED; - adapter->driver_cmds.driver_scsiio_cmd.cb_idx = - LEAPRAID_DRIVER_SCSIIO_CB_IDX; - mutex_init(&adapter->driver_cmds.driver_scsiio_cmd.mutex); - list_add_tail(&adapter->driver_cmds.driver_scsiio_cmd.list, - &adapter->driver_cmds.special_cmd_list); - - buffer_size = sizeof(struct scsi_cmnd) + - sizeof(struct leapraid_io_req_tracker) + - SCSI_SENSE_BUFFERSIZE + - sizeof(struct scatterlist); - buffer_size += 32; - buffer = kzalloc(buffer_size, GFP_KERNEL); - if (!buffer) - return -ENOMEM; - - adapter->driver_cmds.internal_scmd = buffer; - buffer = (u8 *)buffer + sizeof(struct scsi_cmnd) + - sizeof(struct leapraid_io_req_tracker); - adapter->driver_cmds.internal_scmd->sense_buffer = - (unsigned char *)buffer; - buffer = (u8 *)buffer + SCSI_SENSE_BUFFERSIZE; - adapter->driver_cmds.internal_scmd->sdb.table.sgl = - (struct scatterlist *)buffer; - buffer = (u8 *)buffer + sizeof(struct scatterlist); - adapter->driver_cmds.internal_scmd->cmnd = buffer; - adapter->driver_cmds.internal_scmd->host_scribble = - (unsigned char *)(adapter->driver_cmds.internal_scmd + 1); - adapter->driver_cmds.enc_cmd.status = LEAPRAID_CMD_NOT_USED; adapter->driver_cmds.enc_cmd.cb_idx = LEAPRAID_ENC_CB_IDX; mutex_init(&adapter->driver_cmds.enc_cmd.mutex); @@ -8628,7 +8226,6 @@ static int leapraid_send_adapter_init(struct leapraid_adapter *adapter) rc = -EIO; } - adapter->timestamp_sync_cnt = 0; return rc; } @@ -8636,48 +8233,52 @@ static int leapraid_cfg_pages(struct leapraid_adapter *adapter) { union cfg_param_1 cfgp1 = {0}; union cfg_param_2 cfgp2 = {0}; - struct leapraid_manufacturing_p0 manufacturing_page0; - struct leapraid_bios_page3 bios_page3; - struct leapraid_bios_page2 bios_page2; + union { + struct leapraid_manufacturing_p0 manufacturing_page0; + struct leapraid_bios_page3 bios_page3; + struct leapraid_bios_page2 bios_page2; + } cfg_page; int rc; - rc = leapraid_op_config_page(adapter, &bios_page3, cfgp1, + rc = leapraid_op_config_page(adapter, &cfg_page.bios_page3, cfgp1, cfgp2, GET_BIOS_PG3); if (rc) return rc; - rc = leapraid_op_config_page(adapter, &bios_page2, cfgp1, - cfgp2, GET_BIOS_PG2); - if (rc) - return rc; + adapter->adapter_attr.bios_version = + le32_to_cpu(cfg_page.bios_page3.bios_version); - rc = leapraid_op_config_page(adapter, &manufacturing_page0, cfgp1, - cfgp2, GET_MANUFACTURING_PG0); + rc = leapraid_op_config_page(adapter, &cfg_page.bios_page2, cfgp1, + cfgp2, GET_BIOS_PG2); if (rc) return rc; - adapter->adapter_attr.bios_version = - le32_to_cpu(bios_page3.bios_version); - snprintf(adapter->adapter_attr.board_name, - sizeof(adapter->adapter_attr.board_name), - "%.*s", - (int)sizeof(manufacturing_page0.board_name), - manufacturing_page0.board_name); adapter->boot_devs.requested_boot_dev.form = - bios_page2.requested_boot_dev_form; + cfg_page.bios_page2.requested_boot_dev_form; memcpy(adapter->boot_devs.requested_boot_dev.pg_dev, - &bios_page2.requested_boot_dev, + &cfg_page.bios_page2.requested_boot_dev, LEAPRAID_BOOT_DEV_SIZE); adapter->boot_devs.requested_alt_boot_dev.form = - bios_page2.requested_alt_boot_dev_form; + cfg_page.bios_page2.requested_alt_boot_dev_form; memcpy(adapter->boot_devs.requested_alt_boot_dev.pg_dev, - &bios_page2.requested_alt_boot_dev, + &cfg_page.bios_page2.requested_alt_boot_dev, LEAPRAID_BOOT_DEV_SIZE); adapter->boot_devs.current_boot_dev.form = - bios_page2.current_boot_dev_form; + cfg_page.bios_page2.current_boot_dev_form; memcpy(adapter->boot_devs.current_boot_dev.pg_dev, - &bios_page2.current_boot_dev, + &cfg_page.bios_page2.current_boot_dev, LEAPRAID_BOOT_DEV_SIZE); + + rc = leapraid_op_config_page(adapter, &cfg_page.manufacturing_page0, + cfgp1, cfgp2, GET_MANUFACTURING_PG0); + if (rc) + return rc; + + snprintf(adapter->adapter_attr.board_name, + sizeof(adapter->adapter_attr.board_name), + "%.*s", + (int)sizeof(cfg_page.manufacturing_page0.board_name), + cfg_page.manufacturing_page0.board_name); return rc; } @@ -8786,8 +8387,6 @@ int leapraid_scan_dev(struct leapraid_adapter *adapter, bool async_scan_dev) out_cleanup: adapter->driver_cmds.scan_dev_cmd.status = LEAPRAID_CMD_NOT_USED; - dev_info(&adapter->pdev->dev, - "Device scan %s\n", rc == 0 ? "SUCCESS" : "FAILED"); return rc; } @@ -8936,11 +8535,7 @@ static int leapraid_make_adapter_available(struct leapraid_adapter *adapter) return 0; } - rc = leapraid_scan_dev(adapter, false); - if (rc) - return rc; - - return rc; + return leapraid_scan_dev(adapter, false); } int leapraid_ctrl_init(struct leapraid_adapter *adapter) @@ -8948,6 +8543,12 @@ int leapraid_ctrl_init(struct leapraid_adapter *adapter) u32 cap; int rc; + rc = leapraid_init_driver_cmds(adapter); + if (rc) { + dev_err(&adapter->pdev->dev, "Init driver cmds failure\n"); + goto out_free; + } + rc = leapraid_set_pcie_and_notification(adapter); if (rc) goto out_free; @@ -8981,12 +8582,6 @@ int leapraid_ctrl_init(struct leapraid_adapter *adapter) goto out_free; } - rc = leapraid_init_driver_cmds(adapter); - if (rc) { - dev_err(&adapter->pdev->dev, "Init driver cmds failure\n"); - goto out_free; - } - leapraid_init_event_mask(adapter); rc = leapraid_make_adapter_available(adapter); @@ -9006,9 +8601,7 @@ int leapraid_ctrl_init(struct leapraid_adapter *adapter) out_free: adapter->access_ctrl.host_removing = 1; - wake_up(&adapter->access_ctrl.recovery_waitq); leapraid_fw_log_exit(adapter); - leapraid_free_internal_scsi_cmd(adapter); leapraid_disable_controller(adapter); leapraid_free_host_memory(adapter); leapraid_free_dev_topo_bitmaps(adapter); @@ -9022,18 +8615,9 @@ void leapraid_remove_ctrl(struct leapraid_adapter *adapter) leapraid_check_scheduled_fault_stop(adapter); leapraid_fw_log_stop(adapter); leapraid_fw_log_exit(adapter); - leapraid_free_internal_scsi_cmd(adapter); leapraid_disable_controller(adapter); leapraid_free_host_memory(adapter); leapraid_free_dev_topo_bitmaps(adapter); leapraid_free_enc_list(adapter); pci_set_drvdata(adapter->pdev, NULL); } - -void leapraid_free_internal_scsi_cmd(struct leapraid_adapter *adapter) -{ - mutex_lock(&adapter->driver_cmds.driver_scsiio_cmd.mutex); - kfree(adapter->driver_cmds.internal_scmd); - adapter->driver_cmds.internal_scmd = NULL; - mutex_unlock(&adapter->driver_cmds.driver_scsiio_cmd.mutex); -} diff --git a/drivers/scsi/leapraid/leapraid_func.h b/drivers/scsi/leapraid/leapraid_func.h index 359802578586..38a24915f8dd 100644 --- a/drivers/scsi/leapraid/leapraid_func.h +++ b/drivers/scsi/leapraid/leapraid_func.h @@ -50,11 +50,11 @@ #define LEAPRAID_BOARD_NAME_LENGTH 17 #define LEAPRAID_AUTHOR "LeapIO Inc." #define LEAPRAID_DESCRIPTION "LeapRAID Driver" -#define LEAPRAID_DRIVER_VERSION "2.00.01.02" +#define LEAPRAID_DRIVER_VERSION "2.00.01.10" #define LEAPRAID_MAJOR_VERSION 2 -#define LEAPRAID_MINOR_VERSION 00 -#define LEAPRAID_BUILD_VERSION 01 -#define LEAPRAID_RELEASE_VERSION 02 +#define LEAPRAID_MINOR_VERSION 0 +#define LEAPRAID_BUILD_VERSION 1 +#define LEAPRAID_RELEASE_VERSION 10 #define LEAPRAID_MSG_VERSION 0x1021 #define LEAPRAID_HEADER_VERSION 0x0000 @@ -76,7 +76,6 @@ #define LEAPRAID_SG_DEPTH LEAPRAID_MAX_PHYS_SEGMENTS /* Firmware and config page operations. */ -#define LEAPRAID_SET_PARAMETER_SYNC_TIMESTAMP 0x81 #define LEAPRAID_CFG_REQ_RETRY_TIMES 2 /* Hardware access helpers. */ @@ -87,8 +86,6 @@ /* Polling intervals. */ #define LEAPRAID_PCIE_LOG_POLLING_INTERVAL 1 #define LEAPRAID_FAULT_POLLING_INTERVAL 1000 -#define LEAPRAID_TIMESTAMP_SYNC_INTERVAL 900 -#define LEAPRAID_SMART_POLLING_INTERVAL (300 * 1000) /* Init mask. */ #define LEAPRAID_RESET_IRQ_MASK 0x40000000 @@ -102,7 +99,6 @@ /* Target probe flag. */ #define LEAPRAID_NO_ULD_ATTACH_FLAG 1 -#define LEAPRAID_ULD_ATTACH_FLAG 0 /* SCSI device and queue limits. */ #define LEAPRAID_MAX_SECTORS 2048 @@ -126,7 +122,6 @@ /* SMP (Serial Management Protocol). */ #define LEAPRAID_SMP_PT_FLAG_SGL_PTR 0x80 -#define LEAPRAID_SMP_FN_REPORT_PHY_ERR_LOG 0x91 #define LEAPRAID_SMP_FRAME_HEADER_SIZE 4 #define LEAPRAID_SCSI_HOST_SHIFT 16 #define LEAPRAID_SCSI_DRIVER_SHIFT 24 @@ -170,13 +165,9 @@ /* Basic constants and limits. */ #define LEAPRAID_BUSY_LIMIT 1 -#define LEAPRAID_INDEX_FIRST 0 -#define LEAPRAID_BITS_PER_BYTE 8 #define LEAPRAID_INVALID_HOST_DIAG_VAL 0xFFFFFFFF /* Retry/Sleep configuration. */ -#define LEAPRAID_WRITE_SEQUENCE_OFFSET 0x4 -#define LEAPRAID_WRSEQ_KEY_VALUE_MASK 0xF #define LEAPRAID_WRSEQ_FLUSH_KEY_VALUE 0x0 #define LEAPRAID_WRSEQ_1ST_KEY_VALUE 0xF #define LEAPRAID_WRSEQ_2ND_KEY_VALUE 0x4 @@ -186,7 +177,6 @@ #define LEAPRAID_WRSEQ_6TH_KEY_VALUE 0xD #define LEAPRAID_UNLOCK_RETRY_LIMIT 20 #define LEAPRAID_UNLOCK_SLEEP_MS 100 -#define LEAPRAID_MSLEEP_SHORT_MS 50 #define LEAPRAID_MSLEEP_NORMAL_MS 100 #define LEAPRAID_MSLEEP_EXTRA_LONG_MS 500 #define LEAPRAID_IO_POLL_DELAY_US 500 @@ -197,17 +187,14 @@ #define LEAPRAID_INVALID_DEV_HANDLE 0xFFFF /* Commands queue depth. */ -#define LEAPRAID_COALESCING_DEPTH_MAX 256 #define LEAPRAID_DEFAULT_CMD_QD_OFFSET 64 #define LEAPRAID_REPLY_QD_ALIGNMENT 16 /* Task ID offset. */ #define LEAPRAID_TASKID_OFFSET_CTRL_CMD 1 -#define LEAPRAID_TASKID_OFFSET_SCSIIO_CMD 2 #define LEAPRAID_TASKID_OFFSET_CFG_OP_CMD 1 #define LEAPRAID_TASKID_OFFSET_TRANSPORT_CMD 2 -#define LEAPRAID_TASKID_OFFSET_TIMESTAMP_SYNC_CMD 3 -#define LEAPRAID_TASKID_OFFSET_ENC_CMD 4 -#define LEAPRAID_TASKID_OFFSET_NOTIFY_EVENT_CMD 5 +#define LEAPRAID_TASKID_OFFSET_ENC_CMD 3 +#define LEAPRAID_TASKID_OFFSET_NOTIFY_EVENT_CMD 4 /* Task ID offset for high-priority. */ #define LEAPRAID_HP_TASKID_OFFSET_CTL_CMD 0 @@ -222,21 +209,12 @@ #define LEAPRAID_CFG_OP_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT #define LEAPRAID_CTL_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT #define LEAPRAID_SCAN_DEV_CMD_TIMEOUT 300 -#define LEAPRAID_TIMESTAMP_SYNC_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT -#define LEAPRAID_RAID_ACTION_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT #define LEAPRAID_ENC_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT #define LEAPRAID_IO_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT #define LEAPRAID_NOTIFY_EVENT_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT #define LEAPRAID_TM_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT #define LEAPRAID_TRANSPORT_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT -/* Logsense command definitions. */ -#define LEAPRAID_LOGSENSE_DATA_LENGTH 16 -#define LEAPRAID_LOGSENSE_CDB_LENGTH 10 -#define LEAPRAID_LOGSENSE_CDB_CODE 0x6F -#define LEAPRAID_LOGSENSE_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT -#define LEAPRAID_LOGSENSE_SMART_CODE 0x5D - /* Host DMA cap. */ #define DMA_32_BITS 32 #define DMA_64_BITS 64 @@ -283,6 +261,8 @@ struct leapraid_adapter_features { u8 max_volumes; u16 max_dev_handle; u16 min_dev_handle; + u16 msg_ver; + u16 product_id; }; /** @@ -423,7 +403,7 @@ struct leapraid_mem_desc { }; /* internal cmd description */ -#define LEAPRAID_FIXED_INTER_CMDS 6 +#define LEAPRAID_FIXED_INTER_CMDS 5 #define LEAPRAID_FIXED_HP_CMDS 2 #define LEAPRAID_CMD_NOT_USED 0x8000 @@ -438,9 +418,6 @@ struct leapraid_mem_desc { * @LEAPRAID_SCAN_DEV_CB_IDX: Scan device callback index. * @LEAPRAID_CONFIG_CB_IDX: Configuration callback index. * @LEAPRAID_TRANSPORT_CB_IDX: Transport callback index. - * @LEAPRAID_TIMESTAMP_SYNC_CB_IDX: Timestamp sync callback index. - * @LEAPRAID_RAID_ACTION_CB_IDX: RAID action callback index. - * @LEAPRAID_DRIVER_SCSIIO_CB_IDX: Driver SCSI I/O callback index. * @LEAPRAID_SAS_CTRL_CB_IDX: SAS controller callback index. * @LEAPRAID_ENC_CB_IDX: Encryption callback index. * @LEAPRAID_NOTIFY_EVENT_CB_IDX: Notify event callback index. @@ -451,14 +428,11 @@ enum LEAPRAID_CB_INDEX { LEAPRAID_SCAN_DEV_CB_IDX = 0x1, LEAPRAID_CONFIG_CB_IDX = 0x2, LEAPRAID_TRANSPORT_CB_IDX = 0x3, - LEAPRAID_TIMESTAMP_SYNC_CB_IDX = 0x4, - LEAPRAID_RAID_ACTION_CB_IDX = 0x5, - LEAPRAID_DRIVER_SCSIIO_CB_IDX = 0x6, - LEAPRAID_SAS_CTRL_CB_IDX = 0x7, - LEAPRAID_ENC_CB_IDX = 0x8, - LEAPRAID_NOTIFY_EVENT_CB_IDX = 0x9, - LEAPRAID_CTL_CB_IDX = 0xA, - LEAPRAID_TM_CB_IDX = 0xB, + LEAPRAID_SAS_CTRL_CB_IDX = 0x5, + LEAPRAID_ENC_CB_IDX = 0x6, + LEAPRAID_NOTIFY_EVENT_CB_IDX = 0x7, + LEAPRAID_CTL_CB_IDX = 0x8, + LEAPRAID_TM_CB_IDX = 0x9, LEAPRAID_NUM_CB_IDXS }; @@ -521,28 +495,20 @@ struct leapraid_driver_cmd { * @scan_dev_cmd: Command used for asynchronous device scan operations. * @cfg_op_cmd: Command for configuration operations. * @transport_cmd: Command for transport-level operations. - * @timestamp_sync_cmd: Command for synchronizing timestamp with firmware. - * @raid_action_cmd: Command for RAID-related management or action requests. - * @driver_scsiio_cmd: Command used for internal SCSI I/O processing. * @enc_cmd: Command for enclosure management operations. * @notify_event_cmd: Command for asynchronous event notification handling. * @ctl_cmd: Command for generic control or maintenance operations. * @tm_cmd: Task management command. - * @internal_scmd: Pointer to internal SCSI command used by the driver. */ struct leapraid_driver_cmds { struct list_head special_cmd_list; struct leapraid_driver_cmd scan_dev_cmd; struct leapraid_driver_cmd cfg_op_cmd; struct leapraid_driver_cmd transport_cmd; - struct leapraid_driver_cmd timestamp_sync_cmd; - struct leapraid_driver_cmd raid_action_cmd; - struct leapraid_driver_cmd driver_scsiio_cmd; struct leapraid_driver_cmd enc_cmd; struct leapraid_driver_cmd notify_event_cmd; struct leapraid_driver_cmd ctl_cmd; struct leapraid_driver_cmd tm_cmd; - struct scsi_cmnd *internal_scmd; }; /** @@ -598,6 +564,7 @@ struct leapraid_fw_evt_work { * @leapraid_evt_masks: Array of event masks for filtering firmware events. */ struct leapraid_fw_evt_struct { + u32 leapraid_evt_masks[4]; char fw_evt_name[48]; struct workqueue_struct *fw_evt_thread; spinlock_t fw_evt_lock; /* protects firmware event */ @@ -605,7 +572,6 @@ struct leapraid_fw_evt_struct { struct leapraid_fw_evt_work *cur_evt; struct task_struct *cur_evt_task; u8 fw_evt_cleanup; - u32 leapraid_evt_masks[4]; }; /** @@ -659,8 +625,8 @@ struct leapraid_blk_mq_poll_rq { * @msix_enable: Flag indicating MSI-X is enabled. * @irq_vectors_allocated: Flag indicating PCI IRQ vectors are allocated. * @irq_mode: Actual interrupt mode used for allocated PCI IRQ vectors. - * @msix_cpu_map: CPU map for MSI-X interrupts. - * @msix_cpu_map_sz: Size of the MSI-X CPU map. + * @msix_cpu_map: CPU-ID indexed MSI-X queue map. + * @msix_cpu_map_sz: Number of CPU-ID slots allocated in @msix_cpu_map. * @int_rqs: Array of interrupt request queues. * @int_rqs_allocated: Count of allocated interrupt request queues. * @blk_mq_poll_rqs: Array of blk-mq polling requests. @@ -707,7 +673,6 @@ struct leapraid_overheat_desc { * @pending_io_cnt: Count of pending I/O operations. * @reset_wait_queue: Wait queue for reset operations. * @reset_cnt: Counter for reset operations. - * @last_reset_cnt: Last observed adapter reset counter. */ struct leapraid_reset_desc { struct workqueue_struct *fault_reset_wq; @@ -721,7 +686,6 @@ struct leapraid_reset_desc { int pending_io_cnt; wait_queue_head_t reset_wait_queue; u32 reset_cnt; - u32 last_reset_cnt; }; /** @@ -775,7 +739,8 @@ struct leapraid_access_ctrl { * @fw_log_work: Delayed work structure for firmware log. * @open_pcie_trace: Flag indicating if PCIe tracing is open. * @fw_log_init_flag: Flag indicating if firmware log is initialized. - * @pre_debug_log: Last DebugLog register snapshot for change detection. + * @mmap_refcnt: Number of active user VMAs on fw_log_buffer. + * @mmap_waitq: Waitqueue for fw_log_buffer VMA teardown. */ struct leapraid_fw_log_desc { u8 *fw_log_buffer; @@ -785,7 +750,8 @@ struct leapraid_fw_log_desc { struct delayed_work fw_log_work; int open_pcie_trace; int fw_log_init_flag; - u32 pre_debug_log[LEAPRAID_DEBUGLOG_SZ_MAX]; + atomic_t mmap_refcnt; + wait_queue_head_t mmap_waitq; }; #define LEAPRAID_CARD_PORT_FLG_DIRTY 0x01 @@ -938,19 +904,6 @@ struct leapraid_boot_devs { struct leapraid_boot_dev current_boot_dev; }; -/** - * struct leapraid_smart_poll_desc - SMART polling descriptor - * - * @smart_poll_wq: Workqueue for SMART polling tasks. - * @smart_poll_work: Delayed work for SMART polling operations. - * @smart_poll_wq_name: Workqueue name string. - */ -struct leapraid_smart_poll_desc { - struct workqueue_struct *smart_poll_wq; - struct delayed_work smart_poll_work; - char smart_poll_wq_name[48]; -}; - /** * struct leapraid_adapter - Main LeapRAID adapter structure * @@ -960,7 +913,6 @@ struct leapraid_smart_poll_desc { * @iomem_base: I/O memory mapped base address. * @rep_msg_host_idx: Host index for reply messages. * @mask_int: Interrupt masking flag. - * @timestamp_sync_cnt: Timestamp synchronization counter. * @adapter_attr: Adapter attributes. * @mem_desc: Memory descriptor. * @driver_cmds: Driver commands. @@ -973,7 +925,6 @@ struct leapraid_smart_poll_desc { * @fw_log_desc: Firmware log descriptor. * @dev_topo: Device topology. * @boot_devs: Boot devices. - * @smart_poll_desc: SMART polling descriptor. * @overheat_desc: Overheat processing descriptor. */ struct leapraid_adapter { @@ -983,7 +934,6 @@ struct leapraid_adapter { struct leapraid_reg_base __iomem *iomem_base; u32 rep_msg_host_idx; u8 mask_int; - u32 timestamp_sync_cnt; struct leapraid_adapter_attr adapter_attr; struct leapraid_mem_desc mem_desc; @@ -997,7 +947,6 @@ struct leapraid_adapter { struct leapraid_fw_log_desc fw_log_desc; struct leapraid_dev_topo dev_topo; struct leapraid_boot_devs boot_devs; - struct leapraid_smart_poll_desc smart_poll_desc; struct leapraid_overheat_desc overheat_desc; }; @@ -1115,6 +1064,7 @@ struct leapraid_starget_priv { * @starget_priv: Associated target private data. * @lun: Logical Unit Number. * @flg: Flags. + * @ncq_prio_enable: Enables NCQ command priority for RT I/O. * @block: Block flag. * @deleted: Deletion flag. * @sep: SEP flag. @@ -1123,7 +1073,7 @@ struct leapraid_sdev_priv { struct leapraid_starget_priv *starget_priv; unsigned int lun; u32 flg; - u8 ncq; + u8 ncq_prio_enable; u8 block; u8 deleted; u8 sep; @@ -1156,7 +1106,6 @@ struct leapraid_sdev_priv { * @enc_level: Enclosure level. * @port_connection: Port connection. * @connector_name: Connector name. - * @support_smart: SMART support flag. */ struct leapraid_sas_dev { struct list_head list; @@ -1183,7 +1132,6 @@ struct leapraid_sas_dev { u8 enc_level; u8 port_connection; u8 connector_name[LEAPRAID_SAS_DEV_P0_CON_NAME_LEN + 1]; - u8 support_smart; }; static inline void leapraid_sdev_free(struct kref *ref) @@ -1361,31 +1309,6 @@ struct leapraid_rep_manu_reply { u8 vendor_specific[8]; }; -/** - * struct leapraid_scsi_cmd_desc - SCSI command descriptor - * - * @hdl: Device handle. - * @lun: Logical Unit Number. - * @raid_member: RAID member flag. - * @dir: DMA data direction. - * @data_length: Data transfer length. - * @data_buffer: Data buffer pointer. - * @cdb_length: CDB length. - * @cdb: Command Descriptor Block. - * @time_out: Timeout. - */ -struct leapraid_scsi_cmd_desc { - u16 hdl; - u32 lun; - u8 raid_member; - enum dma_data_direction dir; - u32 data_length; - void *data_buffer; - u8 cdb_length; - u8 cdb[32]; - u8 time_out; -}; - extern struct list_head leapraid_adapter_list; extern spinlock_t leapraid_adapter_lock; extern char driver_name[LEAPRAID_NAME_LENGTH]; @@ -1444,7 +1367,7 @@ int leapraid_get_volume_cap(struct leapraid_adapter *adapter, int leapraid_internal_init_cmd_priv( struct leapraid_adapter *adapter, struct leapraid_io_req_tracker *io_tracker); -int leapraid_internal_exit_cmd_priv( +void leapraid_internal_exit_cmd_priv( struct leapraid_adapter *adapter, struct leapraid_io_req_tracker *io_tracker); void leapraid_clean_active_fw_evt(struct leapraid_adapter *adapter); @@ -1515,7 +1438,7 @@ int leapraid_op_config_page(struct leapraid_adapter *adapter, void *cfgp, union cfg_param_1 cfgp1, union cfg_param_2 cfgp2, enum config_page_action cfg_op); -void leapraid_log_req_context(struct leapraid_adapter *adapter, +void leapraid_log_req_context(struct leapraid_adapter *adapter, u16 smid, const void *req_data); int leapraid_change_queue_depth(struct scsi_device *sdev, int qdepth); @@ -1555,10 +1478,7 @@ void leapraid_transport_attach_phy_to_port( u64 sas_address, struct leapraid_card_port *card_port); int leapraid_queuecommand(struct Scsi_Host *shost, struct scsi_cmnd *scmd); -void leapraid_smart_polling_start(struct leapraid_adapter *adapter); -void leapraid_smart_polling_stop(struct leapraid_adapter *adapter); void leapraid_overheat_cleanup(struct leapraid_adapter *adapter); void leapraid_smart_fault_detect(struct leapraid_adapter *adapter, u16 hdl); -void leapraid_free_internal_scsi_cmd(struct leapraid_adapter *adapter); #endif /* LEAPRAID_FUNC_H_INCLUDED */ diff --git a/drivers/scsi/leapraid/leapraid_os.c b/drivers/scsi/leapraid/leapraid_os.c index 5a6cda0b5ea8..144c859ab25d 100644 --- a/drivers/scsi/leapraid/leapraid_os.c +++ b/drivers/scsi/leapraid/leapraid_os.c @@ -125,13 +125,6 @@ static int leapraid_tm_cmd_map_status(struct leapraid_adapter *adapter, } } - if (taskid_task == adapter->driver_cmds.driver_scsiio_cmd.taskid && - (adapter->driver_cmds.driver_scsiio_cmd.status & - LEAPRAID_CMD_DONE || - adapter->driver_cmds.driver_scsiio_cmd.status & - LEAPRAID_CMD_NOT_USED)) - rc = SUCCESS; - if (taskid_task == adapter->driver_cmds.ctl_cmd.hp_taskid && (adapter->driver_cmds.ctl_cmd.status & LEAPRAID_CMD_DONE || @@ -157,9 +150,8 @@ static int leapraid_tm_post_processing(struct leapraid_adapter *adapter, leapraid_sync_irqs(adapter, true); leapraid_unmask_int(adapter); - rc = leapraid_tm_cmd_map_status(adapter, channel, id, lun, type, - taskid_task); - return rc; + return leapraid_tm_cmd_map_status(adapter, channel, id, lun, type, + taskid_task); } static void leapraid_build_tm_req(struct leapraid_scsi_tm_req *scsi_tm_req, @@ -185,6 +177,7 @@ int leapraid_issue_tm(struct leapraid_adapter *adapter, u16 hdl, uint channel, struct leapraid_scsiio_req *scsiio_req; struct leapraid_io_req_tracker *io_req_tracker = NULL; u16 msix_task; + u16 taskid; bool issue_reset = false; u32 db; int rc; @@ -239,16 +232,15 @@ int leapraid_issue_tm(struct leapraid_adapter *adapter, u16 hdl, uint channel, msix_task = io_req_tracker->msix_io; else msix_task = 0; - leapraid_fire_hpr_task(adapter, - adapter->driver_cmds.tm_cmd.hp_taskid, - msix_task); + taskid = adapter->driver_cmds.tm_cmd.hp_taskid; + leapraid_fire_hpr_task(adapter, taskid, msix_task); wait_for_completion_timeout(&adapter->driver_cmds.tm_cmd.done, LEAPRAID_TM_CMD_TIMEOUT * HZ); if (!(adapter->driver_cmds.tm_cmd.status & LEAPRAID_CMD_DONE)) { dev_err(&adapter->pdev->dev, "%s: TM cmd timeout, status=0x%x\n", __func__, adapter->driver_cmds.tm_cmd.status); - leapraid_log_req_context(adapter, scsi_tm_req); + leapraid_log_req_context(adapter, taskid, scsi_tm_req); issue_reset = leapraid_check_reset( adapter->driver_cmds.tm_cmd.status); @@ -511,11 +503,11 @@ static void leapraid_scsiio_done_dispatch( if (!scmd->result) return; - scsi_print_command(scmd); - dev_warn(&adapter->pdev->dev, - "SCSI I/O: hdl=0x%x, status: 0x%x, 0x%x, 0x%x\n", - le16_to_cpu(scsiio_rep->dev_hdl), adapter_status, - scsi_status, scsi_state); + dev_dbg(&adapter->pdev->dev, + "SCSI I/O: CDB=%*ph, hdl=0x%x, status: 0x%x, 0x%x, 0x%x\n", + scmd->cmd_len, scmd->cmnd, + le16_to_cpu(scsiio_rep->dev_hdl), adapter_status, + scsi_status, scsi_state); if (scsi_state & LEAPRAID_SCSI_STATE_AUTOSENSE_VALID) { struct scsi_sense_hdr sshdr; @@ -524,13 +516,13 @@ static void leapraid_scsiio_done_dispatch( le32_to_cpu(scsiio_rep->sense_count)); if (scsi_normalize_sense(scmd->sense_buffer, sz, &sshdr)) - dev_warn(&adapter->pdev->dev, - "Sense: key=0x%x asc=0x%x ascq=0x%x\n", - sshdr.sense_key, sshdr.asc, - sshdr.ascq); + dev_dbg(&adapter->pdev->dev, + "Sense: key=0x%x asc=0x%x ascq=0x%x\n", + sshdr.sense_key, sshdr.asc, + sshdr.ascq); else - dev_warn(&adapter->pdev->dev, - "Sense: Invalid sense data\n"); + dev_dbg(&adapter->pdev->dev, + "Sense: Invalid sense data\n"); } } @@ -542,10 +534,7 @@ bool leapraid_scsiio_done(struct leapraid_adapter *adapter, u16 taskid, struct scsi_cmnd *scmd; u32 response_code = 0; - if (likely(taskid != adapter->driver_cmds.driver_scsiio_cmd.taskid)) - scmd = leapraid_get_scmd_from_taskid(adapter, taskid); - else - scmd = adapter->driver_cmds.internal_scmd; + scmd = leapraid_get_scmd_from_taskid(adapter, taskid); if (!scmd) return true; @@ -572,13 +561,6 @@ bool leapraid_scsiio_done(struct leapraid_adapter *adapter, u16 taskid, out_scsiio_done: scsi_dma_unmap(scmd); - if (unlikely(taskid == - adapter->driver_cmds.driver_scsiio_cmd.taskid)) { - adapter->driver_cmds.driver_scsiio_cmd.status = - LEAPRAID_CMD_DONE; - complete(&adapter->driver_cmds.driver_scsiio_cmd.done); - return false; - } leapraid_free_taskid(adapter, taskid); scmd->scsi_done(scmd); return false; @@ -647,7 +629,6 @@ static void leapraid_probe_sas(struct leapraid_adapter *adapter) sas_dev->hdl, sas_dev->parent_sas_addr, sas_dev->card_port); - if (!added) goto remove_dev; @@ -784,7 +765,6 @@ void leapraid_scan_dev_done(struct leapraid_adapter *adapter) leapraid_fw_log_start(adapter); adapter->scan_dev_desc.driver_loading = 0; wake_up(&adapter->scan_dev_desc.wait_driver_loading); - leapraid_smart_polling_start(adapter); } static const struct pci_device_id leapraid_pci_table[] = { @@ -808,10 +788,7 @@ static inline bool leapraid_is_scmd_permitted(struct leapraid_adapter *adapter, return false; opcode = scmd->cmnd[0]; - if (opcode == SYNCHRONIZE_CACHE || opcode == START_STOP) - return true; - - return false; + return opcode == SYNCHRONIZE_CACHE || opcode == START_STOP; } return true; } @@ -863,10 +840,7 @@ static bool leapraid_should_queuecommand(struct leapraid_adapter *adapter, no_connect: scmd->result = DID_NO_CONNECT << LEAPRAID_SCSI_HOST_SHIFT; scsiio_done: - if (likely(scmd != adapter->driver_cmds.internal_scmd)) - scmd->scsi_done(scmd); - else - *rc = LEAPRAID_OPERATION_FAILED; + scmd->scsi_done(scmd); return false; } @@ -890,7 +864,7 @@ static u32 build_scsiio_req_control(struct scsi_cmnd *scmd, control |= LEAPRAID_SCSIIO_CTRL_SIMPLEQ; - if (sdev_priv->ncq && + if (sdev_priv->ncq_prio_enable && (IOPRIO_PRIO_CLASS(req_get_ioprio(scmd->request)) == IOPRIO_CLASS_RT)) control |= LEAPRAID_SCSIIO_CTRL_CMDPRI; @@ -920,10 +894,7 @@ int leapraid_queuecommand(struct Scsi_Host *shost, hdl = starget_priv->hdl; control = build_scsiio_req_control(scmd, sdev_priv); - if (unlikely(scmd == adapter->driver_cmds.internal_scmd)) - taskid = adapter->driver_cmds.driver_scsiio_cmd.taskid; - else - taskid = leapraid_alloc_scsiio_taskid(adapter, scmd); + taskid = leapraid_alloc_scsiio_taskid(adapter, scmd); scsiio_req = leapraid_get_task_desc(adapter, taskid); scsiio_req->func = LEAPRAID_FUNC_SCSIIO; @@ -1084,13 +1055,15 @@ static int leapraid_error_handler(struct scsi_cmnd *scmd, out_eh_done: if (type == LEAPRAID_TM_TASKTYPE_ABORT_TASK) { - dev_info(&adapter->pdev->dev, - "EH ABORT result: %s, scmd=0x%p\n", - rc == SUCCESS ? "success" : "failed", scmd); + if (rc != SUCCESS) + dev_err(&adapter->pdev->dev, + "EH ABORT result: failed, scmd=0x%p\n", + scmd); } else { - dev_info(&adapter->pdev->dev, - "EH %s result: %s, scmd=0x%p\n", - str, rc == SUCCESS ? "success" : "failed", scmd); + if (rc != SUCCESS) + dev_err(&adapter->pdev->dev, + "EH %s result: failed, scmd=0x%p\n", + str, scmd); if (sas_dev) leapraid_sdev_put(sas_dev); } @@ -1144,8 +1117,10 @@ static int leapraid_eh_host_reset_handler(struct scsi_cmnd *scmd) rc = SUCCESS; out_host_reset_done: - dev_info(&adapter->pdev->dev, "EH HOST RESET result: %s, scmd=0x%p\n", - rc == SUCCESS ? "success" : "failed", scmd); + if (rc != SUCCESS) + dev_err(&adapter->pdev->dev, + "EH HOST RESET result: failed, scmd=0x%p\n", + scmd); return rc; } @@ -1210,7 +1185,7 @@ static int leapraid_slave_alloc(struct scsi_device *sdev) return 0; } -static int leapraid_slave_cfg_volume(struct scsi_device *sdev) +static bool leapraid_slave_cfg_volume(struct scsi_device *sdev) { struct Scsi_Host *shost = sdev->host; struct leapraid_adapter *adapter = shost_priv(shost); @@ -1259,10 +1234,10 @@ static int leapraid_slave_cfg_volume(struct scsi_device *sdev) return 0; } -static int leapraid_slave_configure_extra(struct scsi_device *sdev, - struct leapraid_sas_dev **psas_dev, - u16 vol_hdl, u64 volume_wwid, - bool *is_target_ssp, int *qd) +static bool leapraid_slave_configure_extra(struct scsi_device *sdev, + struct leapraid_sas_dev **psas_dev, + u16 vol_hdl, u64 volume_wwid, + bool *is_target_ssp, int *qd) { struct leapraid_sas_dev *sas_dev; struct leapraid_sdev_priv *sdev_priv; @@ -1569,11 +1544,9 @@ static bool leapraid_scan_check_status(struct leapraid_adapter *adapter, wake_up(&adapter->scan_dev_desc.wait_driver_loading); adapter->scan_dev_desc.wait_scan_dev_done = 0; adapter->access_ctrl.host_removing = 1; - wake_up(&adapter->access_ctrl.recovery_waitq); return true; } - dev_info(&adapter->pdev->dev, "Device scan: SUCCESS\n"); adapter->driver_cmds.scan_dev_cmd.status = LEAPRAID_CMD_NOT_USED; leapraid_scan_dev_done(adapter); return true; @@ -1785,12 +1758,11 @@ static struct device_attribute *leapraid_shost_attrs[] = { NULL, }; -static ssize_t sas_address_show(struct device *dev, - struct device_attribute *attr, char *buf) +static ssize_t sas_device_handle_show(struct device *dev, + struct device_attribute *attr, char *buf) { struct scsi_device *sdev = to_scsi_device(dev); struct leapraid_sdev_priv *sas_device_priv_data = sdev->hostdata; - u64 sas_address; if (!sas_device_priv_data || !sas_device_priv_data->starget_priv) { dev_err(&sdev->sdev_gendev, @@ -1798,30 +1770,59 @@ static ssize_t sas_address_show(struct device *dev, return -EINVAL; } - sas_address = sas_device_priv_data->starget_priv->sas_address; - - return scnprintf(buf, PAGE_SIZE, "0x%016llx\n", - (unsigned long long)sas_address); + return scnprintf(buf, PAGE_SIZE, "0x%04x\n", + sas_device_priv_data->starget_priv->hdl); } -static ssize_t sas_device_handle_show(struct device *dev, - struct device_attribute *attr, char *buf) +static int leapraid_ncq_prio_supported(struct scsi_device *sdev, + bool *supported) { - struct scsi_device *sdev = to_scsi_device(dev); - struct leapraid_sdev_priv *sas_device_priv_data = sdev->hostdata; + unsigned char *vpd_pg89; + unsigned int vpd_len; + int rc; - if (!sas_device_priv_data || !sas_device_priv_data->starget_priv) { - dev_err(&sdev->sdev_gendev, - "%s: Invalid sdev_priv or starget_priv\n", __func__); - return -EINVAL; + *supported = false; + if (!scsi_device_supports_vpd(sdev)) + return 0; + + vpd_pg89 = kzalloc(LEAPRAID_VPD_PG89_MAX_LEN, GFP_KERNEL); + if (!vpd_pg89) + return -ENOMEM; + + rc = scsi_get_vpd_page(sdev, LEAPRAID_VPD_PAGE_ATA_INFO, + vpd_pg89, LEAPRAID_VPD_PG89_MAX_LEN); + if (rc) { + kfree(vpd_pg89); + return rc; } - return scnprintf(buf, PAGE_SIZE, "0x%04x\n", - sas_device_priv_data->starget_priv->hdl); + vpd_len = ((unsigned int)vpd_pg89[2] << 8) | vpd_pg89[3]; + if (vpd_len + 4 >= LEAPRAID_VPD_PG89_MIN_LEN) + *supported = + (vpd_pg89[LEAPRAID_VPD_PG89_NCQ_BYTE_IDX] >> + LEAPRAID_VPD_PG89_NCQ_BIT_SHIFT) & + LEAPRAID_VPD_PG89_NCQ_BIT_MASK; + kfree(vpd_pg89); + return 0; } +static ssize_t sas_ncq_prio_supported_show(struct device *dev, + struct device_attribute *attr, + char *buf) +{ + struct scsi_device *sdev = to_scsi_device(dev); + bool supported; + int rc; -static ssize_t sas_ncq_show(struct device *dev, struct device_attribute *attr, - char *buf) + rc = leapraid_ncq_prio_supported(sdev, &supported); + if (rc) + return rc; + + return scnprintf(buf, PAGE_SIZE, "%d\n", supported); +} + +static ssize_t sas_ncq_prio_enable_show(struct device *dev, + struct device_attribute *attr, + char *buf) { struct scsi_device *sdev = to_scsi_device(dev); struct leapraid_sdev_priv *sas_device_priv_data = sdev->hostdata; @@ -1832,18 +1833,19 @@ static ssize_t sas_ncq_show(struct device *dev, struct device_attribute *attr, return -EINVAL; } - return scnprintf(buf, PAGE_SIZE, "%d\n", sas_device_priv_data->ncq); + return scnprintf(buf, PAGE_SIZE, "%d\n", + sas_device_priv_data->ncq_prio_enable); } -static ssize_t sas_ncq_store(struct device *dev, - struct device_attribute *attr, - const char *buf, size_t count) +static ssize_t sas_ncq_prio_enable_store(struct device *dev, + struct device_attribute *attr, + const char *buf, size_t count) { struct scsi_device *sdev = to_scsi_device(dev); struct leapraid_sdev_priv *sas_device_priv_data = sdev->hostdata; - unsigned char *vpd_pg89; - int ncq_op; - bool ncq_supported; + bool supported; + int rc; + bool enable; if (!sas_device_priv_data) { dev_err(&sdev->sdev_gendev, @@ -1851,45 +1853,27 @@ static ssize_t sas_ncq_store(struct device *dev, return -EINVAL; } - if (kstrtoint(buf, 0, &ncq_op)) - return -EINVAL; - - if (ncq_op != 0 && ncq_op != 1) { - dev_err(&sdev->sdev_gendev, - "%s: Invalid NCQ value %d (only 0/1 allowed)\n", - __func__, ncq_op); + if (kstrtobool(buf, &enable)) return -EINVAL; - } - - vpd_pg89 = kmalloc(LEAPRAID_VPD_PG89_MAX_LEN, GFP_KERNEL); - if (!vpd_pg89) - return -ENOMEM; - if (!scsi_device_supports_vpd(sdev) || - scsi_get_vpd_page(sdev, LEAPRAID_VPD_PAGE_ATA_INFO, - vpd_pg89, LEAPRAID_VPD_PG89_MAX_LEN)) { - kfree(vpd_pg89); + rc = leapraid_ncq_prio_supported(sdev, &supported); + if (rc) + return rc; + if (!supported) return -EINVAL; - } - ncq_supported = (vpd_pg89[LEAPRAID_VPD_PG89_NCQ_BYTE_IDX] >> - LEAPRAID_VPD_PG89_NCQ_BIT_SHIFT) & - LEAPRAID_VPD_PG89_NCQ_BIT_MASK; - kfree(vpd_pg89); - if (ncq_supported) - sas_device_priv_data->ncq = ncq_op; + sas_device_priv_data->ncq_prio_enable = enable; return count; } -static DEVICE_ATTR_RO(sas_address); static DEVICE_ATTR_RO(sas_device_handle); - -static DEVICE_ATTR_RW(sas_ncq); +static DEVICE_ATTR_RO(sas_ncq_prio_supported); +static DEVICE_ATTR_RW(sas_ncq_prio_enable); static struct device_attribute *leapraid_sdev_attrs[] = { - &dev_attr_sas_address, &dev_attr_sas_device_handle, - &dev_attr_sas_ncq, + &dev_attr_sas_ncq_prio_supported, + &dev_attr_sas_ncq_prio_enable, NULL, }; @@ -1974,13 +1958,12 @@ static int leapraid_probe(struct pci_dev *pdev, const struct pci_device_id *id) adapter = shost_priv(shost); INIT_LIST_HEAD(&adapter->list); - spin_lock(&leapraid_adapter_lock); - list_add_tail(&adapter->list, &leapraid_adapter_list); - spin_unlock(&leapraid_adapter_lock); adapter->shost = shost; adapter->pdev = pdev; adapter->fw_log_desc.open_pcie_trace = open_pcie_trace; + atomic_set(&adapter->fw_log_desc.mmap_refcnt, 0); + init_waitqueue_head(&adapter->fw_log_desc.mmap_waitq); leapraid_lock_init(adapter); leapraid_list_init(adapter); snprintf(adapter->adapter_attr.name, LEAPRAID_NAME_LENGTH, "%s%d", @@ -2021,6 +2004,10 @@ static int leapraid_probe(struct pci_dev *pdev, const struct pci_device_id *id) goto scsi_add_shost_fail; } + spin_lock(&leapraid_adapter_lock); + list_add_tail(&adapter->list, &leapraid_adapter_list); + spin_unlock(&leapraid_adapter_lock); + scsi_scan_host(shost); return 0; @@ -2030,9 +2017,6 @@ static int leapraid_probe(struct pci_dev *pdev, const struct pci_device_id *id) leapraid_overheat_cleanup(adapter); destroy_workqueue(adapter->fw_evt_s.fw_evt_thread); evt_wq_fail: - spin_lock(&leapraid_adapter_lock); - list_del(&adapter->list); - spin_unlock(&leapraid_adapter_lock); scsi_host_put(shost); return rc; } @@ -2115,13 +2099,13 @@ static void leapraid_remove(struct pci_dev *pdev) wait_event(adapter->scan_dev_desc.wait_driver_loading, !atomic_read(&adapter->overheat_desc.thermal_alert)); - adapter->access_ctrl.host_removing = 1; - wake_up(&adapter->access_ctrl.recovery_waitq); + WRITE_ONCE(adapter->access_ctrl.host_removing, 1); + spin_lock(&leapraid_adapter_lock); + list_del(&adapter->list); + spin_unlock(&leapraid_adapter_lock); leapraid_wait_cmds_done(adapter); - leapraid_smart_polling_stop(adapter); - if (leapraid_pci_removed(adapter)) { leapraid_mq_polling_pause(adapter); leapraid_clean_active_scsi_cmds(adapter); @@ -2138,9 +2122,6 @@ static void leapraid_remove(struct pci_dev *pdev) sas_remove_host(shost); leapraid_cleanup_lists(adapter); leapraid_remove_ctrl(adapter); - spin_lock(&leapraid_adapter_lock); - list_del(&adapter->list); - spin_unlock(&leapraid_adapter_lock); scsi_host_put(shost); } @@ -2157,7 +2138,6 @@ static void leapraid_shutdown(struct pci_dev *pdev) } adapter->access_ctrl.host_removing = 1; - wake_up(&adapter->access_ctrl.recovery_waitq); leapraid_wait_cmds_done(adapter); leapraid_clean_active_fw_evt(adapter); leapraid_overheat_cleanup(adapter); @@ -2193,7 +2173,6 @@ static pci_ers_result_t leapraid_pci_error_detected(struct pci_dev *pdev, adapter->access_ctrl.pcie_recovering = 1; scsi_block_requests(adapter->shost); leapraid_overheat_cleanup(adapter); - leapraid_smart_polling_stop(adapter); leapraid_check_scheduled_fault_stop(adapter); leapraid_fw_log_stop(adapter); leapraid_disable_controller(adapter); @@ -2201,7 +2180,6 @@ static pci_ers_result_t leapraid_pci_error_detected(struct pci_dev *pdev, case pci_channel_io_perm_failure: adapter->access_ctrl.pcie_recovering = 1; leapraid_overheat_cleanup(adapter); - leapraid_smart_polling_stop(adapter); leapraid_check_scheduled_fault_stop(adapter); leapraid_fw_log_stop(adapter); leapraid_mq_polling_pause(adapter); @@ -2244,7 +2222,6 @@ static pci_ers_result_t leapraid_pci_slot_reset(struct pci_dev *pdev) dev_err(&pdev->dev, "%s PCI error slot reset\n", adapter->adapter_attr.name); - adapter->access_ctrl.pcie_recovering = 0; adapter->pdev = pdev; pci_restore_state(pdev); if (leapraid_set_pcie_and_notification(adapter)) { @@ -2254,13 +2231,15 @@ static pci_ers_result_t leapraid_pci_slot_reset(struct pci_dev *pdev) return PCI_ERS_RESULT_DISCONNECT; } + adapter->access_ctrl.pcie_recovering = 0; dev_info(&pdev->dev, "%s: Hard reset triggered by PCI slot reset\n", adapter->adapter_attr.name); dev_info(&adapter->pdev->dev, "%s: %d: call hard_reset\n", __func__, __LINE__); rc = leapraid_hard_reset_handler(adapter, FULL_RESET); - dev_info(&pdev->dev, "%s hard reset: %s\n", - adapter->adapter_attr.name, rc == 0 ? "success" : "failed"); + if (rc) + dev_err(&pdev->dev, "%s hard reset: failed\n", + adapter->adapter_attr.name); return rc == 0 ? PCI_ERS_RESULT_RECOVERED : PCI_ERS_RESULT_DISCONNECT; @@ -2277,11 +2256,11 @@ static void leapraid_pci_resume(struct pci_dev *pdev) } dev_err(&pdev->dev, "PCI error resume!\n"); + pci_aer_clear_nonfatal_status(pdev); leapraid_check_scheduled_fault_start(adapter); leapraid_fw_log_start(adapter); scsi_unblock_requests(adapter->shost); - leapraid_smart_polling_start(adapter); } MODULE_DEVICE_TABLE(pci, leapraid_pci_table); @@ -2306,7 +2285,6 @@ static int leapraid_suspend(struct pci_dev *pdev, pm_message_t state) } leapraid_overheat_cleanup(adapter); - leapraid_smart_polling_stop(adapter); leapraid_check_scheduled_fault_stop(adapter); leapraid_fw_log_stop(adapter); flush_scheduled_work(); @@ -2363,7 +2341,6 @@ static int leapraid_resume(struct pci_dev *pdev) scsi_unblock_requests(shost); leapraid_check_scheduled_fault_start(adapter); leapraid_fw_log_start(adapter); - leapraid_smart_polling_start(adapter); return 0; } #endif /* CONFIG_PM */ diff --git a/drivers/scsi/leapraid/leapraid_transport.c b/drivers/scsi/leapraid/leapraid_transport.c index 738bc55df416..379029685e16 100644 --- a/drivers/scsi/leapraid/leapraid_transport.c +++ b/drivers/scsi/leapraid/leapraid_transport.c @@ -298,6 +298,7 @@ static int leapraid_transport_exp_report_manu(struct leapraid_adapter *adapter, dma_addr_t c2h_dma_addr; bool issue_reset = false; void *data_out = NULL; + u16 inter_taskid; size_t c2h_size; size_t h2c_size; void *psge; @@ -338,10 +339,8 @@ static int leapraid_transport_exp_report_manu(struct leapraid_adapter *adapter, rep_manu_request->allocated_response_length = 0; rep_manu_request->request_length = 0; - smp_passthrough_req = - leapraid_get_task_desc( - adapter, - adapter->driver_cmds.transport_cmd.inter_taskid); + inter_taskid = adapter->driver_cmds.transport_cmd.inter_taskid; + smp_passthrough_req = leapraid_get_task_desc(adapter, inter_taskid); memset(smp_passthrough_req, 0, sizeof(struct leapraid_smp_passthrough_req)); smp_passthrough_req->func = LEAPRAID_FUNC_SMP_PASSTHROUGH; @@ -354,8 +353,7 @@ static int leapraid_transport_exp_report_manu(struct leapraid_adapter *adapter, c2h_dma_addr, c2h_size); init_completion(&adapter->driver_cmds.transport_cmd.done); - leapraid_fire_task(adapter, - adapter->driver_cmds.transport_cmd.inter_taskid); + leapraid_fire_task(adapter, inter_taskid); wait_for_completion_timeout(&adapter->driver_cmds.transport_cmd.done, LEAPRAID_TRANSPORT_CMD_TIMEOUT * HZ); if (!(adapter->driver_cmds.transport_cmd.status & LEAPRAID_CMD_DONE)) { @@ -363,7 +361,8 @@ static int leapraid_transport_exp_report_manu(struct leapraid_adapter *adapter, dev_err(&adapter->pdev->dev, "%s: SMP passthrough timeout, st=0x%x\n", __func__, adapter->driver_cmds.transport_cmd.status); - leapraid_log_req_context(adapter, smp_passthrough_req); + leapraid_log_req_context(adapter, inter_taskid, + smp_passthrough_req); if (!(adapter->driver_cmds.transport_cmd.status & LEAPRAID_CMD_RESET)) issue_reset = true; @@ -1249,20 +1248,21 @@ static void leapraid_build_smp_task(struct leapraid_adapter *adapter, static int leapraid_send_smp_req(struct leapraid_adapter *adapter) { const struct leapraid_smp_passthrough_req *smp_passthrough_req; + u16 inter_taskid; dev_dbg(&adapter->pdev->dev, "%s: Sending smp request\n", __func__); - smp_passthrough_req = leapraid_get_task_desc( - adapter, adapter->driver_cmds.transport_cmd.inter_taskid); + inter_taskid = adapter->driver_cmds.transport_cmd.inter_taskid; + smp_passthrough_req = leapraid_get_task_desc(adapter, inter_taskid); init_completion(&adapter->driver_cmds.transport_cmd.done); - leapraid_fire_task(adapter, - adapter->driver_cmds.transport_cmd.inter_taskid); + leapraid_fire_task(adapter, inter_taskid); wait_for_completion_timeout(&adapter->driver_cmds.transport_cmd.done, LEAPRAID_TRANSPORT_CMD_TIMEOUT * HZ); if (!(adapter->driver_cmds.transport_cmd.status & LEAPRAID_CMD_DONE)) { dev_err(&adapter->pdev->dev, "%s: timeout, st=0x%x\n", __func__, adapter->driver_cmds.transport_cmd.status); - leapraid_log_req_context(adapter, smp_passthrough_req); + leapraid_log_req_context(adapter, inter_taskid, + smp_passthrough_req); if (!(adapter->driver_cmds.transport_cmd.status & LEAPRAID_CMD_RESET)) { dev_dbg(&adapter->pdev->dev, @@ -1343,6 +1343,14 @@ static void leapraid_transport_smp_handler(struct bsg_job *job, if (rc) goto release_lock; + if (h2c_size < LEAPRAID_SMP_FRAME_HEADER_SIZE) { + dev_err(&adapter->pdev->dev, + "%s: Invalid SMP request payload size=%zu\n", + __func__, h2c_size); + rc = -EINVAL; + goto free_req_buf; + } + if (addr_out) sg_copy_to_buffer(job->request_payload.sg_list, job->request_payload.sg_cnt, addr_out, @@ -1353,6 +1361,14 @@ static void leapraid_transport_smp_handler(struct bsg_job *job, if (rc) goto free_req_buf; + if (c2h_size < LEAPRAID_SMP_FRAME_HEADER_SIZE) { + dev_err(&adapter->pdev->dev, + "%s: Invalid SMP reply payload size=%zu\n", + __func__, c2h_size); + rc = -EINVAL; + goto free_rep_buf; + } + rc = leapraid_check_adapter_is_op(adapter, LEAPRAID_DB_WAIT_OP_SHORT, __func__); if (rc) -- 2.25.1

2 1

[PATCH OLK-6.6 0/5] mm/dpool: bugfix
by Wupeng Ma 12 Sep '26

12 Sep '26

bugfix for dpool Wupeng Ma (5): dpool: Fix refcount leak when page not in dpagelist mm/dpool: fix race between fill_pool and page_in_dynamic_pool dpool: fix compile error for CONFIG_MEMORY_RELIABLE mm/dpool: allow longterm pin for dpool mm/dpool: hide dpool related files if not enabled include/linux/dynamic_pool.h | 29 +++++------------------------ include/linux/mm.h | 36 ++++++++++++++++++++++++++++++++++++ mm/dynamic_pool.c | 31 +++++++++++++++++++++++++------ mm/gup.c | 3 ++- 4 files changed, 68 insertions(+), 31 deletions(-) -- 2.43.0

2 6

[PATCH openEuler-1.0-LTS] ipvlan: inherit needed_headroom and needed_tailroom from phy_dev
by JiangJieHua 11 Sep '26

11 Sep '26

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v7.2 commit e16e960d55a40d36bd7c2494cc005e757dc9a1ef category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18377 CVE: CVE-2026-74744 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ipvlan devices inherit hard_header_len from phy_dev during ipvlan_init(), but leave needed_headroom and needed_tailroom set to 0. When the underlying phy_dev (or stacked lower device) requires extra headroom or tailroom for headers/trailers (e.g. macsec, ipsec, wireguard, tunnels, or veth with rx headroom), upper layers calculating packet headroom and tailroom fail to reserve sufficient space. This can result in reallocation overhead, skb headroom underflows, or KASAN slab-use-after-free crashes when dev_hard_header() / ipvlan_hard_header() prepends header data or when lower devices append tailroom. Fix this by: 1. Inheriting needed_headroom and needed_tailroom from phy_dev in ipvlan_init(). 2. Propagating needed_headroom and needed_tailroom updates to attached ipvlans in ipvlan_device_event() when receiving NETDEV_FEAT_CHANGE events. Fixes: 2ad7bf363841 ("ipvlan: Initial check-in of the IPVLAN driver.") Reported-by: syzbot+1f9fd0f4b601cf88d6e6(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/6a720a21.40259c87.584f4.04bb.GAE@google.com/… Reported-by: Tangxin Xie <xietangxin(a)h-partners.com> Closes: https://lore.kernel.org/netdev/CANn89i+1EW-sFNK8xoq98gMbPCeLS7e=+rs9gHfLg5W… Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Hangbin Liu <liuhangbin(a)kylinos.cn> Link: https://patch.msgid.link/20260806103857.115541-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: drivers/net/ipvlan/ipvlan_main.c [Context differences are due to the following patches not being merged: a4d2113e46c1 ("ipvlan: set hw_enc_features like macvlan") 6df6398f7c8b ("net: add netif_inherit_tso_max()") 00d066a4d4ed ("netdev_features: convert NETIF_F_LLTX to dev->lltx")] Signed-off-by: JiangJieHua <jiangjiehua1(a)huawei.com> --- drivers/net/ipvlan/ipvlan_main.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c index 9057cdf9b2162..ed1a5af42b072 100644 --- a/drivers/net/ipvlan/ipvlan_main.c +++ b/drivers/net/ipvlan/ipvlan_main.c @@ -258,6 +258,8 @@ static int ipvlan_init(struct net_device *dev) dev->gso_max_size = phy_dev->gso_max_size; dev->gso_max_segs = phy_dev->gso_max_segs; dev->hard_header_len = phy_dev->hard_header_len; + dev->needed_headroom = phy_dev->needed_headroom; + dev->needed_tailroom = phy_dev->needed_tailroom; netdev_lockdep_set_classes(dev); @@ -899,6 +901,8 @@ static int ipvlan_device_event(struct notifier_block *unused, list_for_each_entry(ipvlan, &port->ipvlans, pnode) { ipvlan->dev->gso_max_size = dev->gso_max_size; ipvlan->dev->gso_max_segs = dev->gso_max_segs; + ipvlan->dev->needed_headroom = dev->needed_headroom; + ipvlan->dev->needed_tailroom = dev->needed_tailroom; netdev_update_features(ipvlan->dev); } break; -- 2.33.8

2 1

[PATCH openEuler-1.0-LTS] ipvlan: inherit needed_headroom and needed_tailroom from phy_dev
by JiangJieHua 11 Sep '26

11 Sep '26

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v7.2 commit e16e960d55a40d36bd7c2494cc005e757dc9a1ef category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18377 CVE: CVE-2026-74744 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ipvlan devices inherit hard_header_len from phy_dev during ipvlan_init(), but leave needed_headroom and needed_tailroom set to 0. When the underlying phy_dev (or stacked lower device) requires extra headroom or tailroom for headers/trailers (e.g. macsec, ipsec, wireguard, tunnels, or veth with rx headroom), upper layers calculating packet headroom and tailroom fail to reserve sufficient space. This can result in reallocation overhead, skb headroom underflows, or KASAN slab-use-after-free crashes when dev_hard_header() / ipvlan_hard_header() prepends header data or when lower devices append tailroom. Fix this by: 1. Inheriting needed_headroom and needed_tailroom from phy_dev in ipvlan_init(). 2. Propagating needed_headroom and needed_tailroom updates to attached ipvlans in ipvlan_device_event() when receiving NETDEV_FEAT_CHANGE events. Fixes: 2ad7bf363841 ("ipvlan: Initial check-in of the IPVLAN driver.") Reported-by: syzbot+1f9fd0f4b601cf88d6e6(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/6a720a21.40259c87.584f4.04bb.GAE@google.com/… Reported-by: Tangxin Xie <xietangxin(a)h-partners.com> Closes: https://lore.kernel.org/netdev/CANn89i+1EW-sFNK8xoq98gMbPCeLS7e=+rs9gHfLg5W… Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Hangbin Liu <liuhangbin(a)kylinos.cn> Link: https://patch.msgid.link/20260806103857.115541-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: drivers/net/ipvlan/ipvlan_main.c [Context differences are due to the following patches not being merged: a4d2113e46c1 ("ipvlan: set hw_enc_features like macvlan") 6df6398f7c8b ("net: add netif_inherit_tso_max()") 00d066a4d4ed ("netdev_features: convert NETIF_F_LLTX to dev->lltx")] ] Signed-off-by: JiangJieHua <jiangjiehua1(a)huawei.com> --- drivers/net/ipvlan/ipvlan_main.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c index 9057cdf9b2162..ed1a5af42b072 100644 --- a/drivers/net/ipvlan/ipvlan_main.c +++ b/drivers/net/ipvlan/ipvlan_main.c @@ -258,6 +258,8 @@ static int ipvlan_init(struct net_device *dev) dev->gso_max_size = phy_dev->gso_max_size; dev->gso_max_segs = phy_dev->gso_max_segs; dev->hard_header_len = phy_dev->hard_header_len; + dev->needed_headroom = phy_dev->needed_headroom; + dev->needed_tailroom = phy_dev->needed_tailroom; netdev_lockdep_set_classes(dev); @@ -899,6 +901,8 @@ static int ipvlan_device_event(struct notifier_block *unused, list_for_each_entry(ipvlan, &port->ipvlans, pnode) { ipvlan->dev->gso_max_size = dev->gso_max_size; ipvlan->dev->gso_max_segs = dev->gso_max_segs; + ipvlan->dev->needed_headroom = dev->needed_headroom; + ipvlan->dev->needed_tailroom = dev->needed_tailroom; netdev_update_features(ipvlan->dev); } break; -- 2.33.8

2 1

[PATCH openEuler-1.0-LTS] ipv6: mcast: Fix potential UAF in MLD delayed work
by JiangJieHua 11 Sep '26

11 Sep '26

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v7.2-rc3 commit 9b26518b6896a16b809b1e42986f4ebac7bccc1e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17356 CVE: CVE-2026-72322 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- A race condition exists between device teardown and incoming MLD query processing, leading to a Use-After-Free in the MLD delayed work. During device destruction, the primary reference to inet6_dev is dropped, which can drop its refcount to 0. The actual freeing of inet6_dev memory is deferred via RCU. Concurrently, the packet receive path runs under RCU read lock and obtains the inet6_dev pointer. Because the memory is RCU-protected, CPU-0 can safely dereference inet6_dev even if its refcount has hit 0. However, if CPU-0 calls igmp6_event_query() and schedules delayed work, it attempts to acquire a reference using in6_dev_hold(). This increments the refcount from 0 to 1, triggering a "refcount_t: addition on 0" warning. Since the inet6_dev memory is still scheduled to be freed after the RCU grace period, the device is freed while the work is still scheduled. When the work runs, it accesses the freed memory, causing a kernel panic. Fix this by using refcount_inc_not_zero() (via a new helper in6_dev_hold_safe()) to prevent acquiring a reference if the device is already being destroyed. If the refcount is 0, we do not schedule the work. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Ido Schimmel <idosch(a)nvidia.com> Link: https://patch.msgid.link/20260705181756.963063-3-edumazet@google.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Conflicts: include/net/addrconf.h net/ipv6/mcast.c [Context differences are due to the following patches not being merged: 2d9a93b4902b ("mld: convert from timer to delayed work") f185de28d9ae ("mld: add new workqueues for process mld events") 81895a65ec63 ("treewide: use prandom_u32_max() when possible, part 1") 8032bf1233a7 ("treewide: use get_random_u32_below() instead of deprecated function")] Signed-off-by: JiangJieHua <jiangjiehua1(a)huawei.com> --- include/net/addrconf.h | 5 +++++ net/ipv6/mcast.c | 18 ++++++++++++------ 2 files changed, 17 insertions(+), 6 deletions(-) diff --git a/include/net/addrconf.h b/include/net/addrconf.h index 10d270f004f0d..26f0a5bc234be 100644 --- a/include/net/addrconf.h +++ b/include/net/addrconf.h @@ -425,6 +425,11 @@ static inline void in6_dev_hold(struct inet6_dev *idev) refcount_inc(&idev->refcnt); } +static inline bool in6_dev_hold_safe(struct inet6_dev *idev) +{ + return refcount_inc_not_zero(&idev->refcnt); +} + void inet6_ifa_finish_destroy(struct inet6_ifaddr *ifp); static inline void in6_ifa_put(struct inet6_ifaddr *ifp) diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c index bb484fe27e137..787800af097a5 100644 --- a/net/ipv6/mcast.c +++ b/net/ipv6/mcast.c @@ -1037,8 +1037,10 @@ static void mld_gq_start_timer(struct inet6_dev *idev) unsigned long tv = prandom_u32() % idev->mc_maxdelay; idev->mc_gq_running = 1; - if (!mod_timer(&idev->mc_gq_timer, jiffies+tv+2)) - in6_dev_hold(idev); + if (in6_dev_hold_safe(idev)) { + if (mod_timer(&idev->mc_gq_timer, jiffies+tv+2)) + in6_dev_put(idev); + } } static void mld_gq_stop_timer(struct inet6_dev *idev) @@ -1052,8 +1054,10 @@ static void mld_ifc_start_timer(struct inet6_dev *idev, unsigned long delay) { unsigned long tv = prandom_u32() % delay; - if (!mod_timer(&idev->mc_ifc_timer, jiffies+tv+2)) - in6_dev_hold(idev); + if (in6_dev_hold_safe(idev)) { + if (mod_timer(&idev->mc_ifc_timer, jiffies+tv+2)) + in6_dev_put(idev); + } } static void mld_ifc_stop_timer(struct inet6_dev *idev) @@ -1067,8 +1071,10 @@ static void mld_dad_start_timer(struct inet6_dev *idev, unsigned long delay) { unsigned long tv = prandom_u32() % delay; - if (!mod_timer(&idev->mc_dad_timer, jiffies+tv+2)) - in6_dev_hold(idev); + if (in6_dev_hold_safe(idev)) { + if (mod_timer(&idev->mc_dad_timer, jiffies+tv+2)) + in6_dev_put(idev); + } } static void mld_dad_stop_timer(struct inet6_dev *idev) -- 2.33.8

2 1

[PATCH OLK-6.6 v4 0/5] cgroup/cpuset: Backport upstream remote partition accounting fixes
by Zhang Qiao 11 Sep '26

11 Sep '26

This series backports a minimal set of upstream cpuset fixes to openEuler OLK-6.6 so that remote partition operations no longer trigger list BUG_ON / use-after-free / oops / panic under the no-hotplug high-concurrency cpuset stress test (fn_warn_repro_008 without CPU online/offline). Verified stable over 50 rounds (KASAN + CONFIG_DEBUG_LIST): no list corruption, KASAN UAF, BUG, Oops or panic. Bugzilla: https://atomgit.com/openeuler/kernel/issues/9899 The 5 backports (in mainline order): 1. cgroup/cpuset: Correct invalid remote parition prs 2. cgroup/cpuset: Fix incorrect isolated_cpus update in update_parent_effective_cpumask() 3. cgroup/cpuset: Fix error handling in remote_partition_disable() 4. cgroup/cpuset: Remove remote_partition_check() & make update_cpumasks_hier() handle remote partition 5. cpuset: remove global remote_children list Patches 4 and 5 are the core fix: they route remote partition teardown through the centralized update_cpumasks_hier() path and drop the global remote_children linked list that was the source of the list corruption / UAF. Patches 1-3 are required prerequisites (PERR_ACCESS enum, effective xcpus accounting, and remote_partition_disable error handling). Chen Ridong (2): cgroup/cpuset: Correct invalid remote parition prs cpuset: remove global remote_children list Waiman Long (3): cgroup/cpuset: Fix incorrect isolated_cpus update in update_parent_effective_cpumask() cgroup/cpuset: Fix error handling in remote_partition_disable() cgroup/cpuset: Remove remote_partition_check() & make update_cpumasks_hier() handle remote partition kernel/cgroup/cpuset.c | 354 +++++++++++++++++++++++------------------ 1 file changed, 203 insertions(+), 151 deletions(-) -- 2.18.0

2 6

[PATCH OLK-6.6 v4 0/5] cgroup/cpuset: Backport upstream remote partition accounting fixes
by Zhang Qiao 11 Sep '26

11 Sep '26

This series backports a minimal set of upstream cpuset fixes to openEuler OLK-6.6 so that remote partition operations no longer trigger list BUG_ON / use-after-free / oops / panic under the no-hotplug high-concurrency cpuset stress test (fn_warn_repro_008 without CPU online/offline). Verified stable over 50 rounds (KASAN + CONFIG_DEBUG_LIST): no list corruption, KASAN UAF, BUG, Oops or panic. Bugzilla: https://atomgit.com/openeuler/kernel/issues/9899 The 5 backports (in mainline order): 1. cgroup/cpuset: Correct invalid remote parition prs 2. cgroup/cpuset: Fix incorrect isolated_cpus update in update_parent_effective_cpumask() 3. cgroup/cpuset: Fix error handling in remote_partition_disable() 4. cgroup/cpuset: Remove remote_partition_check() & make update_cpumasks_hier() handle remote partition 5. cpuset: remove global remote_children list Patches 4 and 5 are the core fix: they route remote partition teardown through the centralized update_cpumasks_hier() path and drop the global remote_children linked list that was the source of the list corruption / UAF. Patches 1-3 are required prerequisites (PERR_ACCESS enum, effective xcpus accounting, and remote_partition_disable error handling). Chen Ridong (2): cgroup/cpuset: Correct invalid remote parition prs cpuset: remove global remote_children list Waiman Long (3): cgroup/cpuset: Fix incorrect isolated_cpus update in update_parent_effective_cpumask() cgroup/cpuset: Fix error handling in remote_partition_disable() cgroup/cpuset: Remove remote_partition_check() & make update_cpumasks_hier() handle remote partition kernel/cgroup/cpuset.c | 354 +++++++++++++++++++++++------------------ 1 file changed, 203 insertions(+), 151 deletions(-) -- 2.18.0

2 6

[PATCH OLK-6.6 v4 0/5] cgroup/cpuset: Backport upstream remote partition accounting fixes
by Zhang Qiao 11 Sep '26

11 Sep '26

This series backports a minimal set of upstream cpuset fixes to openEuler OLK-6.6 so that remote partition operations no longer trigger list BUG_ON / use-after-free / oops / panic under the no-hotplug high-concurrency cpuset stress test (fn_warn_repro_008 without CPU online/offline). Verified stable over 50 rounds (KASAN + CONFIG_DEBUG_LIST): no list corruption, KASAN UAF, BUG, Oops or panic. Bugzilla: https://atomgit.com/openeuler/kernel/issues/9899 The 5 backports (in mainline order): 1. cgroup/cpuset: Correct invalid remote parition prs 2. cgroup/cpuset: Fix incorrect isolated_cpus update in update_parent_effective_cpumask() 3. cgroup/cpuset: Fix error handling in remote_partition_disable() 4. cgroup/cpuset: Remove remote_partition_check() & make update_cpumasks_hier() handle remote partition 5. cpuset: remove global remote_children list Patches 4 and 5 are the core fix: they route remote partition teardown through the centralized update_cpumasks_hier() path and drop the global remote_children linked list that was the source of the list corruption / UAF. Patches 1-3 are required prerequisites (PERR_ACCESS enum, effective xcpus accounting, and remote_partition_disable error handling). Chen Ridong (2): cgroup/cpuset: Correct invalid remote parition prs cpuset: remove global remote_children list Waiman Long (3): cgroup/cpuset: Fix incorrect isolated_cpus update in update_parent_effective_cpumask() cgroup/cpuset: Fix error handling in remote_partition_disable() cgroup/cpuset: Remove remote_partition_check() & make update_cpumasks_hier() handle remote partition kernel/cgroup/cpuset.c | 354 +++++++++++++++++++++++------------------ 1 file changed, 203 insertions(+), 151 deletions(-) -- 2.18.0

2 6

[PATCH OLK-6.6 v3 1/5] cgroup/cpuset: Correct invalid remote parition prs
by Zhang Qiao 11 Sep '26

11 Sep '26

From: Chen Ridong <chenridong(a)huawei.com> mainline inclusion from mainline-v6.12 commit e55f45b4bafee0ef488e815aa88368444ec5c79c category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9899 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When enable a remote partition, I found that: cd /sys/fs/cgroup/ mkdir test mkdir test/test1 echo +cpuset > cgroup.subtree_control echo +cpuset > test/cgroup.subtree_control echo 3 > test/test1/cpuset.cpus echo root > test/test1/cpuset.cpus.partition cat test/test1/cpuset.cpus.partition root invalid (Parent is not a partition root) The parent of a remote partition could not be a root. This is due to the emtpy effective_xcpus. It would be better to prompt the message "invalid cpu list in cpuset.cpus.exclusive". Signed-off-by: Chen Ridong <chenridong(a)huawei.com> Reviewed-by: Waiman Long <longman(a)redhat.com> Signed-off-by: Tejun Heo <tj(a)kernel.org> Conflicts: kernel/cgroup/cpuset.c [ OLK-6.6 does not have the partcmd_enablei command (isolated partition rework not backported); update_prstate() enables a local partition with partcmd_enable only. remote_partition_enable() keeps the (cs, tmp) signature as the upstream new_prs parameter comes from a commit not backported. ] Signed-off-by: Zhang Qiao <zhangqiao22(a)huawei.com> --- kernel/cgroup/cpuset.c | 24 ++++++++++++++---------- 1 file changed, 14 insertions(+), 10 deletions(-) diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c index 3823e17157b1..d0fa90510e07 100644 --- a/kernel/cgroup/cpuset.c +++ b/kernel/cgroup/cpuset.c @@ -84,6 +84,7 @@ enum prs_errcode { PERR_HOTPLUG, PERR_CPUSEMPTY, PERR_HKEEPING, + PERR_ACCESS, }; static const char * const perr_strings[] = { @@ -95,6 +96,7 @@ static const char * const perr_strings[] = { [PERR_HOTPLUG] = "No cpu available due to hotplug", [PERR_CPUSEMPTY] = "cpuset.cpus and cpuset.cpus.exclusive are empty", [PERR_HKEEPING] = "partition config conflicts with housekeeping setup", + [PERR_ACCESS] = "Enable partition not permitted", }; struct cpuset { @@ -1686,7 +1688,7 @@ static inline bool is_local_partition(struct cpuset *cs) * remote_partition_enable - Enable current cpuset as a remote partition root * @cs: the cpuset to update * @tmp: temparary masks - * Return: 1 if successful, 0 if error + * Return: 0 if successful, errcode if error * * Enable the current cpuset to become a remote partition root taking CPUs * directly from the top cpuset. cpuset_mutex must be held by the caller. @@ -1697,7 +1699,7 @@ static int remote_partition_enable(struct cpuset *cs, struct tmpmasks *tmp) * The user must have sysadmin privilege. */ if (!capable(CAP_SYS_ADMIN)) - return 0; + return PERR_ACCESS; /* * The requested exclusive_cpus must not be allocated to other @@ -1711,7 +1713,7 @@ static int remote_partition_enable(struct cpuset *cs, struct tmpmasks *tmp) if (cpumask_empty(tmp->new_cpus) || cpumask_intersects(tmp->new_cpus, subpartitions_cpus) || cpumask_subset(top_cpuset.effective_cpus, tmp->new_cpus)) - return 0; + return PERR_INVCPUS; spin_lock_irq(&callback_lock); cpumask_andnot(top_cpuset.effective_cpus, @@ -1734,7 +1736,7 @@ static int remote_partition_enable(struct cpuset *cs, struct tmpmasks *tmp) update_tasks_cpumask(&top_cpuset, tmp->new_cpus); update_sibling_cpumasks(&top_cpuset, NULL, tmp); - return 1; + return 0; } /* @@ -3216,14 +3218,16 @@ static int update_prstate(struct cpuset *cs, int new_prs) goto out; } - err = update_parent_effective_cpumask(cs, partcmd_enable, - NULL, &tmpmask); /* - * If an attempt to become local partition root fails, - * try to become a remote partition root instead. + * If parent is valid partition, enable local partiion. + * Otherwise, enable a remote partition. */ - if (err && remote_partition_enable(cs, &tmpmask)) - err = 0; + if (is_partition_valid(parent)) { + err = update_parent_effective_cpumask(cs, partcmd_enable, + NULL, &tmpmask); + } else { + err = remote_partition_enable(cs, &tmpmask); + } } else if (old_prs && new_prs) { /* * A change in load balance state only, no change in cpumasks. -- 2.18.0

2 5

[PATCH openEuler-1.0-LTS] ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD
by JiangJieHua 11 Sep '26

11 Sep '26

From: Linmao Li <lilinmao(a)kylinos.cn> mainline inclusion from mainline-v7.2-rc1 commit 627ac78f2741e2ebd2225e2e953b6964a8a9182f category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18025 CVE: CVE-2026-74398 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- addrconf_dad_failure() transitions ifp->state from DAD to POSTDAD via addrconf_dad_end(), which drops ifp->lock on return. The lock is re-acquired after net_info_ratelimited(). A concurrent ipv6_del_addr() can take the lock in that window, set ifp->state to DEAD and run list_del_rcu(&ifp->if_list). addrconf_dad_failure() then overwrites DEAD with ERRDAD at errdad: and schedules a new dad_work. The work calls ipv6_del_addr() again, hitting the already-poisoned list entry: general protection fault: 0000 [#1] SMP NOPTI CPU: 4 PID: 217 Comm: kworker/4:1 Workqueue: ipv6_addrconf addrconf_dad_work RIP: 0010:ipv6_del_addr+0xe9/0x280 RAX: dead000000000122 Call Trace: addrconf_dad_stop+0x113/0x140 addrconf_dad_work+0x28c/0x430 process_one_work+0x1eb/0x3b0 worker_thread+0x4d/0x400 kthread+0x104/0x140 ret_from_fork+0x35/0x40 Fold the addrconf_dad_end() logic into addrconf_dad_failure() under a single ifp->lock critical section. The STABLE_PRIVACY branch temporarily drops ifp->lock around address regeneration, so at lock_errdad: verify the state is still POSTDAD before transitioning to ERRDAD; bail out otherwise to avoid overwriting a state set by another path while the lock was released. Fixes: c15b1ccadb32 ("ipv6: move DAD and addrconf_verify processing to workqueue") Signed-off-by: Linmao Li <lilinmao(a)kylinos.cn> Reviewed-by: Ido Schimmel <idosch(a)nvidia.com> Link: https://patch.msgid.link/20260513025509.3776405-1-lilinmao@kylinos.cn Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv6/addrconf.c [Contextual differences between the branch and mainline required adaptation during patch application. The functional changes from the upstream commit are preserved.] Signed-off-by: JiangJieHua <jiangjiehua1(a)huawei.com> --- net/ipv6/addrconf.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c index 98a24b5e6f036..7b8dda47d3855 100644 --- a/net/ipv6/addrconf.c +++ b/net/ipv6/addrconf.c @@ -2020,16 +2020,18 @@ void addrconf_dad_failure(struct sk_buff *skb, struct inet6_ifaddr *ifp) struct inet6_dev *idev = ifp->idev; struct net *net = dev_net(ifp->idev->dev); - if (addrconf_dad_end(ifp)) { + spin_lock_bh(&ifp->lock); + + if (ifp->state != INET6_IFADDR_STATE_DAD) { + spin_unlock_bh(&ifp->lock); in6_ifa_put(ifp); return; } + ifp->state = INET6_IFADDR_STATE_POSTDAD; net_info_ratelimited("%s: IPv6 duplicate address %pI6c used by %pM detected!\n", ifp->idev->dev->name, &ifp->addr, eth_hdr(skb)->h_source); - spin_lock_bh(&ifp->lock); - if (ifp->flags & IFA_F_STABLE_PRIVACY) { struct in6_addr new_addr; struct inet6_ifaddr *ifp2; @@ -2077,6 +2079,11 @@ void addrconf_dad_failure(struct sk_buff *skb, struct inet6_ifaddr *ifp) in6_ifa_put(ifp2); lock_errdad: spin_lock_bh(&ifp->lock); + if (ifp->state != INET6_IFADDR_STATE_POSTDAD) { + spin_unlock_bh(&ifp->lock); + in6_ifa_put(ifp); + return; + } } errdad: -- 2.33.8

2 1

[PATCH openEuler-1.0-LTS] ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
by JiangJieHua 11 Sep '26

11 Sep '26

From: Zhiling Zou <zhilinz(a)nebusec.ai> mainline inclusion from mainline-v7.2-rc7 commit f803c086399da277b5d0ff36a107d0f162751800 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18284 CVE: CVE-2026-74597 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ip6ip6_err() clones an outer IPv6 ICMP error skb, pulls it to the quoted inner IPv6 packet, and then passes the clone to icmpv6_send(). The clone still carries the outer packet's inet6_skb_parm in skb->cb. If the outer packet had a Home Address Option, IP6CB(skb2)->dsthao remains non-zero after skb_pull(). icmpv6_send() later calls mip6_addr_swap(), which uses that stale dsthao offset against the quoted inner packet. A malformed inner destination-options header can then make the HAO lookup and address swap run past the end of the quoted packet and corrupt skb_shared_info. Clear skb2->cb[] before pulling the quoted inner IPv6 packet so the reply path does not reuse metadata left by the outer IPv6 stack. Fixes: e490d1d85cf5 ("[IPV6] IP6TUNNEL: Split out generic routine in ip6ip6_err().") Cc: stable(a)vger.kernel.org Reported-by: Vega <vega(a)nebusec.ai> Signed-off-by: Zhiling Zou <zhilinz(a)nebusec.ai> Reviewed-by: Ido Schimmel <idosch(a)nvidia.com> Link: https://patch.msgid.link/fe1a5e765fbca88d69391887f0ed26a19e3e4d39.178573656… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: JiangJieHua <jiangjiehua1(a)huawei.com> --- net/ipv6/ip6_tunnel.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c index 7cec56b336eee..021c62c5bdcf8 100644 --- a/net/ipv6/ip6_tunnel.c +++ b/net/ipv6/ip6_tunnel.c @@ -680,6 +680,9 @@ ip6ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, if (!skb2) return 0; + /* Remove debris left by outer IPv6 stack. */ + memset(IP6CB(skb2), 0, sizeof(*IP6CB(skb2))); + skb_dst_drop(skb2); skb_pull(skb2, offset); skb_reset_network_header(skb2); -- 2.33.8

2 1

[PATCH openEuler-1.0-LTS] inet: frags: publish queues before arming timer
by JiangJieHua 10 Sep '26

10 Sep '26

From: Zhiling Zou <zhilinz(a)nebusec.ai> mainline inclusion from mainline-v7.2-rc7 commit 653d7ddf6cba867777a3d14c4f83ace008c5ad13 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18205 CVE: CVE-2026-74662 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- inet_frag_create() arms the fragment queue timer before inserting the queue into the fqdir rhashtable. If the namespace fragment timeout is zero or negative, the timer can run before the queue is published. The timer callback then marks the queue complete, tries to remove a node that is not in the hash table yet, and drops the anticipated hash reference. Creation can subsequently publish the completed queue without restoring that reference, leaving a stale hash node after the caller drops the remaining reference. Publish the queue first and arm the timer while holding the queue lock. This makes timer expiry wait until the queue is visible in the hash table, so inet_frag_kill() can remove the node and balance the hash reference. Fixes: 648700f76b03 ("inet: frags: use rhashtables for reassembly units") Cc: stable(a)vger.kernel.org Reported-by: Vega <vega(a)nebusec.ai> Signed-off-by: Zhiling Zou <zhilinz(a)nebusec.ai> Signed-off-by: Ren Wei <enjou1224z(a)gmail.com> Link: https://patch.msgid.link/bf66785e7c0c139d7a1900e2f01faeeab344b960.178494884… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv4/inet_fragment.c [4.19 use struct netns_frags *nf (not struct fqdir *fqdir) and have no inet_frag_putn(); inet_frag_kill() takes a single argument. The conflict error path keeps the target's inet_frag_kill(q) + inet_frag_destroy(q) cleanup instead of upstream's inet_frag_putn(q, 2). The fix semantics are preserved: the queue is published into the rhashtable before the timer is armed, both under q->lock.] Signed-off-by: JiangJieHua <jiangjiehua1(a)huawei.com> --- net/ipv4/inet_fragment.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c index 5d004c3f4e2b0..4f2118c7f3db6 100644 --- a/net/ipv4/inet_fragment.c +++ b/net/ipv4/inet_fragment.c @@ -270,16 +270,19 @@ static struct inet_frag_queue *inet_frag_create(struct netns_frags *nf, *prev = ERR_PTR(-ENOMEM); return NULL; } - mod_timer(&q->timer, jiffies + nf->timeout); + spin_lock_bh(&q->lock); *prev = rhashtable_lookup_get_insert_key(&nf->rhashtable, &q->key, &q->node, f->rhash_params); if (*prev) { q->flags |= INET_FRAG_COMPLETE; + spin_unlock_bh(&q->lock); inet_frag_kill(q); inet_frag_destroy(q); return NULL; } + mod_timer(&q->timer, jiffies + nf->timeout); + spin_unlock_bh(&q->lock); return q; } -- 2.33.8

2 1

[PATCH openEuler-1.0-LTS] ipvlan: inherit needed_headroom and needed_tailroom from phy_dev
by JiangJieHua 10 Sep '26

10 Sep '26

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v7.2 commit e16e960d55a40d36bd7c2494cc005e757dc9a1ef category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18377 CVE: CVE-2026-74744 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ipvlan devices inherit hard_header_len from phy_dev during ipvlan_init(), but leave needed_headroom and needed_tailroom set to 0. When the underlying phy_dev (or stacked lower device) requires extra headroom or tailroom for headers/trailers (e.g. macsec, ipsec, wireguard, tunnels, or veth with rx headroom), upper layers calculating packet headroom and tailroom fail to reserve sufficient space. This can result in reallocation overhead, skb headroom underflows, or KASAN slab-use-after-free crashes when dev_hard_header() / ipvlan_hard_header() prepends header data or when lower devices append tailroom. Fix this by: 1. Inheriting needed_headroom and needed_tailroom from phy_dev in ipvlan_init(). 2. Propagating needed_headroom and needed_tailroom updates to attached ipvlans in ipvlan_device_event() when receiving NETDEV_FEAT_CHANGE events. Fixes: 2ad7bf363841 ("ipvlan: Initial check-in of the IPVLAN driver.") Reported-by: syzbot+1f9fd0f4b601cf88d6e6(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/6a720a21.40259c87.584f4.04bb.GAE@google.com/… Reported-by: Tangxin Xie <xietangxin(a)h-partners.com> Closes: https://lore.kernel.org/netdev/CANn89i+1EW-sFNK8xoq98gMbPCeLS7e=+rs9gHfLg5W… Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Hangbin Liu <liuhangbin(a)kylinos.cn> Link: https://patch.msgid.link/20260806103857.115541-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: drivers/net/ipvlan/ipvlan_main.c [ a4d2113e46c1 ("ipvlan: set hw_enc_features like macvlan") 6df6398f7c8b ("net: add netif_inherit_tso_max()") 00d066a4d4ed ("netdev_features: convert NETIF_F_LLTX to dev->lltx") ] Signed-off-by: JiangJieHua <jiangjiehua1(a)huawei.com> --- drivers/net/ipvlan/ipvlan_main.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c index 9057cdf9b2162..ed1a5af42b072 100644 --- a/drivers/net/ipvlan/ipvlan_main.c +++ b/drivers/net/ipvlan/ipvlan_main.c @@ -258,6 +258,8 @@ static int ipvlan_init(struct net_device *dev) dev->gso_max_size = phy_dev->gso_max_size; dev->gso_max_segs = phy_dev->gso_max_segs; dev->hard_header_len = phy_dev->hard_header_len; + dev->needed_headroom = phy_dev->needed_headroom; + dev->needed_tailroom = phy_dev->needed_tailroom; netdev_lockdep_set_classes(dev); @@ -899,6 +901,8 @@ static int ipvlan_device_event(struct notifier_block *unused, list_for_each_entry(ipvlan, &port->ipvlans, pnode) { ipvlan->dev->gso_max_size = dev->gso_max_size; ipvlan->dev->gso_max_segs = dev->gso_max_segs; + ipvlan->dev->needed_headroom = dev->needed_headroom; + ipvlan->dev->needed_tailroom = dev->needed_tailroom; netdev_update_features(ipvlan->dev); } break; -- 2.33.8

2 1

[PATCH OLK-5.10] ipv4: validate IPV4_DEVCONF attributes properly
by JiangJieHua 10 Sep '26

10 Sep '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9803 -------------------------------- syzbot reported a UBSAN undefined behavior issue in vif_delete(): UBSAN: Undefined behaviour in net/ipv4/ipmr.c:720:43 signed integer overflow: -2147483648 - 1 cannot be represented in type 'int' MC_FORWARDING is a read-only sysctl (0444), but netlink RTM_SETLINK allows userspace to modify it via inet_validate_link_af() without permission checks, bypassing the read-only restriction. A corrupted counter can lead to inconsistent multicast routing state. Fix by rejecting IPV4_DEVCONF_MC_FORWARDING in inet_validate_link_af() with -EINVAL. Fixes: 9f0f7272ac95 ("ipv4: AF_INET link address family") Signed-off-by: JiangJieHua <jiangjiehua1(a)huawei.com> --- net/ipv4/devinet.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c index 9ac7d47d27b81..6822408e8f8d2 100644 --- a/net/ipv4/devinet.c +++ b/net/ipv4/devinet.c @@ -1987,6 +1987,9 @@ static int inet_validate_link_af(const struct net_device *dev, if (cfgid <= 0 || cfgid > IPV4_DEVCONF_MAX) return -EINVAL; + + if (cfgid == IPV4_DEVCONF_MC_FORWARDING) + return -EINVAL; } } -- 2.33.8

2 1

[PATCH openEuler-1.0-LTS] [Backport] serial: amba-pl011: synchronize DMA teardown
by Cai Xinchen 10 Sep '26

10 Sep '26

From: Fan Wu <fanwu01(a)zju.edu.cn> stable inclusion from stable-v5.10.267 commit a38fae9d212e2d3ed5e9ec0ef773f8c0a27fb76e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18582 CVE: CVE-2026-80737 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------ [ Upstream commit 440915499231e9db1c361aa45bb702e8fd3b4a32 ] dmaengine_terminate_all() does not wait for a running callback, so the TX callback can still touch the TX buffer after it is freed. The RX poll timer reads the RX buffers without the port lock. Switch to dmaengine_terminate_sync() and delete the RX timer before freeing the buffers. Fixes: ead76f329f77 ("ARM: 6763/1: pl011: add optional RX DMA to PL011 v2") Cc: stable <stable(a)kernel.org> Assisted-by: Codex:gpt-5.6 Signed-off-by: Fan Wu <fanwu01(a)zju.edu.cn> Link: https://patch.msgid.link/20260731085915.326775-4-fanwu01@zju.edu.cn Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> [ changed upstream's `timer_delete_sync()` deletion to match this tree's `del_timer_sync()` spelling at the old call site ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/tty/serial/amba-pl011.c [The commit 3875c56ac4af62fb904e2b6f2a78b5314a6875d2 ("timers: Rename del_timer_sync() to timer_delete_sync()") is not merged. Use del_timer_sync in this patch.] Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- drivers/tty/serial/amba-pl011.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c index c987db50757c..d229f36b929d 100644 --- a/drivers/tty/serial/amba-pl011.c +++ b/drivers/tty/serial/amba-pl011.c @@ -1206,7 +1206,7 @@ static void pl011_dma_shutdown(struct uart_amba_port *uap) if (uap->using_tx_dma) { /* In theory, this should already be done by pl011_dma_flush_buffer */ - dmaengine_terminate_all(uap->dmatx.chan); + dmaengine_terminate_sync(uap->dmatx.chan); if (uap->dmatx.queued) { dma_unmap_sg(uap->dmatx.chan->device->dev, &uap->dmatx.sg, 1, DMA_TO_DEVICE); @@ -1218,12 +1218,12 @@ static void pl011_dma_shutdown(struct uart_amba_port *uap) } if (uap->using_rx_dma) { - dmaengine_terminate_all(uap->dmarx.chan); + if (uap->dmarx.poll_rate) + del_timer_sync(&uap->dmarx.timer); + dmaengine_terminate_sync(uap->dmarx.chan); /* Clean up the RX DMA */ pl011_sgbuf_free(uap->dmarx.chan, &uap->dmarx.sgbuf_a, DMA_FROM_DEVICE); pl011_sgbuf_free(uap->dmarx.chan, &uap->dmarx.sgbuf_b, DMA_FROM_DEVICE); - if (uap->dmarx.poll_rate) - del_timer_sync(&uap->dmarx.timer); uap->using_rx_dma = false; } } -- 2.34.1

2 1

[PATCH OLK-5.10] [Backport] serial: amba-pl011: synchronize DMA teardown
by Cai Xinchen 10 Sep '26

10 Sep '26

From: Fan Wu <fanwu01(a)zju.edu.cn> stable inclusion from stable-v5.10.267 commit a38fae9d212e2d3ed5e9ec0ef773f8c0a27fb76e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18582 CVE: CVE-2026-80737 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------ [ Upstream commit 440915499231e9db1c361aa45bb702e8fd3b4a32 ] dmaengine_terminate_all() does not wait for a running callback, so the TX callback can still touch the TX buffer after it is freed. The RX poll timer reads the RX buffers without the port lock. Switch to dmaengine_terminate_sync() and delete the RX timer before freeing the buffers. Fixes: ead76f329f77 ("ARM: 6763/1: pl011: add optional RX DMA to PL011 v2") Cc: stable <stable(a)kernel.org> Assisted-by: Codex:gpt-5.6 Signed-off-by: Fan Wu <fanwu01(a)zju.edu.cn> Link: https://patch.msgid.link/20260731085915.326775-4-fanwu01@zju.edu.cn Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> [ changed upstream's `timer_delete_sync()` deletion to match this tree's `del_timer_sync()` spelling at the old call site ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- drivers/tty/serial/amba-pl011.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c index 638255a0ea37..109333e9be26 100644 --- a/drivers/tty/serial/amba-pl011.c +++ b/drivers/tty/serial/amba-pl011.c @@ -1197,7 +1197,7 @@ static void pl011_dma_shutdown(struct uart_amba_port *uap) if (uap->using_tx_dma) { /* In theory, this should already be done by pl011_dma_flush_buffer */ - dmaengine_terminate_all(uap->dmatx.chan); + dmaengine_terminate_sync(uap->dmatx.chan); if (uap->dmatx.queued) { dma_unmap_single(uap->dmatx.chan->device->dev, uap->dmatx.dma, uap->dmatx.len, @@ -1210,12 +1210,12 @@ static void pl011_dma_shutdown(struct uart_amba_port *uap) } if (uap->using_rx_dma) { - dmaengine_terminate_all(uap->dmarx.chan); + if (uap->dmarx.poll_rate) + timer_delete_sync(&uap->dmarx.timer); + dmaengine_terminate_sync(uap->dmarx.chan); /* Clean up the RX DMA */ pl011_dmabuf_free(uap->dmarx.chan, &uap->dmarx.dbuf_a, DMA_FROM_DEVICE); pl011_dmabuf_free(uap->dmarx.chan, &uap->dmarx.dbuf_b, DMA_FROM_DEVICE); - if (uap->dmarx.poll_rate) - del_timer_sync(&uap->dmarx.timer); uap->using_rx_dma = false; } } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] [Backport] serial: amba-pl011: synchronize DMA teardown
by Cai Xinchen 10 Sep '26

10 Sep '26

From: Fan Wu <fanwu01(a)zju.edu.cn> stable inclusion from stable-v5.10.267 commit a38fae9d212e2d3ed5e9ec0ef773f8c0a27fb76e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18582 CVE: CVE-2026-80737 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------ [ Upstream commit 440915499231e9db1c361aa45bb702e8fd3b4a32 ] dmaengine_terminate_all() does not wait for a running callback, so the TX callback can still touch the TX buffer after it is freed. The RX poll timer reads the RX buffers without the port lock. Switch to dmaengine_terminate_sync() and delete the RX timer before freeing the buffers. Fixes: ead76f329f77 ("ARM: 6763/1: pl011: add optional RX DMA to PL011 v2") Cc: stable <stable(a)kernel.org> Assisted-by: Codex:gpt-5.6 Signed-off-by: Fan Wu <fanwu01(a)zju.edu.cn> Link: https://patch.msgid.link/20260731085915.326775-4-fanwu01@zju.edu.cn Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> [ changed upstream's `timer_delete_sync()` deletion to match this tree's `del_timer_sync()` spelling at the old call site ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/tty/serial/amba-pl011.c [The commit 3875c56ac4af62fb904e2b6f2a78b5314a6875d2 ("timers: Rename del_timer_sync() to timer_delete_sync()") is not merged. Use del_timer_sync in this patch.] Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- drivers/tty/serial/amba-pl011.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c index c987db50757c..3b242654cede 100644 --- a/drivers/tty/serial/amba-pl011.c +++ b/drivers/tty/serial/amba-pl011.c @@ -1206,7 +1206,7 @@ static void pl011_dma_shutdown(struct uart_amba_port *uap) if (uap->using_tx_dma) { /* In theory, this should already be done by pl011_dma_flush_buffer */ - dmaengine_terminate_all(uap->dmatx.chan); + dmaengine_terminate_sync(uap->dmatx.chan); if (uap->dmatx.queued) { dma_unmap_sg(uap->dmatx.chan->device->dev, &uap->dmatx.sg, 1, DMA_TO_DEVICE); @@ -1219,11 +1219,12 @@ static void pl011_dma_shutdown(struct uart_amba_port *uap) if (uap->using_rx_dma) { dmaengine_terminate_all(uap->dmarx.chan); + if (uap->dmarx.poll_rate) + del_timer_sync(&uap->dmarx.timer); + dmaengine_terminate_sync(uap->dmarx.chan); /* Clean up the RX DMA */ pl011_sgbuf_free(uap->dmarx.chan, &uap->dmarx.sgbuf_a, DMA_FROM_DEVICE); pl011_sgbuf_free(uap->dmarx.chan, &uap->dmarx.sgbuf_b, DMA_FROM_DEVICE); - if (uap->dmarx.poll_rate) - del_timer_sync(&uap->dmarx.timer); uap->using_rx_dma = false; } } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] [Backport] serial: amba-pl011: synchronize DMA teardown
by Cai Xinchen 10 Sep '26

10 Sep '26

From: Fan Wu <fanwu01(a)zju.edu.cn> stable inclusion from stable-v5.10.267 commit a38fae9d212e2d3ed5e9ec0ef773f8c0a27fb76e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18582 CVE: CVE-2026-80737 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------ [ Upstream commit 440915499231e9db1c361aa45bb702e8fd3b4a32 ] dmaengine_terminate_all() does not wait for a running callback, so the TX callback can still touch the TX buffer after it is freed. The RX poll timer reads the RX buffers without the port lock. Switch to dmaengine_terminate_sync() and delete the RX timer before freeing the buffers. Fixes: ead76f329f77 ("ARM: 6763/1: pl011: add optional RX DMA to PL011 v2") Cc: stable <stable(a)kernel.org> Assisted-by: Codex:gpt-5.6 Signed-off-by: Fan Wu <fanwu01(a)zju.edu.cn> Link: https://patch.msgid.link/20260731085915.326775-4-fanwu01@zju.edu.cn Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> [ changed upstream's `timer_delete_sync()` deletion to match this tree's `del_timer_sync()` spelling at the old call site ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- drivers/tty/serial/amba-pl011.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c index c987db50757c..bb15fcb2fa6d 100644 --- a/drivers/tty/serial/amba-pl011.c +++ b/drivers/tty/serial/amba-pl011.c @@ -1206,7 +1206,7 @@ static void pl011_dma_shutdown(struct uart_amba_port *uap) if (uap->using_tx_dma) { /* In theory, this should already be done by pl011_dma_flush_buffer */ - dmaengine_terminate_all(uap->dmatx.chan); + dmaengine_terminate_sync(uap->dmatx.chan); if (uap->dmatx.queued) { dma_unmap_sg(uap->dmatx.chan->device->dev, &uap->dmatx.sg, 1, DMA_TO_DEVICE); @@ -1219,11 +1219,12 @@ static void pl011_dma_shutdown(struct uart_amba_port *uap) if (uap->using_rx_dma) { dmaengine_terminate_all(uap->dmarx.chan); + if (uap->dmarx.poll_rate) + timer_delete_sync(&uap->dmarx.timer); + dmaengine_terminate_sync(uap->dmarx.chan); /* Clean up the RX DMA */ pl011_sgbuf_free(uap->dmarx.chan, &uap->dmarx.sgbuf_a, DMA_FROM_DEVICE); pl011_sgbuf_free(uap->dmarx.chan, &uap->dmarx.sgbuf_b, DMA_FROM_DEVICE); - if (uap->dmarx.poll_rate) - del_timer_sync(&uap->dmarx.timer); uap->using_rx_dma = false; } } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] serial: amba-pl011: synchronize DMA teardown
by Cai Xinchen 10 Sep '26

10 Sep '26

From: Fan Wu <fanwu01(a)zju.edu.cn> [ Upstream commit 440915499231e9db1c361aa45bb702e8fd3b4a32 ] dmaengine_terminate_all() does not wait for a running callback, so the TX callback can still touch the TX buffer after it is freed. The RX poll timer reads the RX buffers without the port lock. Switch to dmaengine_terminate_sync() and delete the RX timer before freeing the buffers. Fixes: ead76f329f77 ("ARM: 6763/1: pl011: add optional RX DMA to PL011 v2") Cc: stable <stable(a)kernel.org> Assisted-by: Codex:gpt-5.6 Signed-off-by: Fan Wu <fanwu01(a)zju.edu.cn> Link: https://patch.msgid.link/20260731085915.326775-4-fanwu01@zju.edu.cn Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> [ changed upstream's `timer_delete_sync()` deletion to match this tree's `del_timer_sync()` spelling at the old call site ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- drivers/tty/serial/amba-pl011.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c index c987db50757c..bb15fcb2fa6d 100644 --- a/drivers/tty/serial/amba-pl011.c +++ b/drivers/tty/serial/amba-pl011.c @@ -1206,7 +1206,7 @@ static void pl011_dma_shutdown(struct uart_amba_port *uap) if (uap->using_tx_dma) { /* In theory, this should already be done by pl011_dma_flush_buffer */ - dmaengine_terminate_all(uap->dmatx.chan); + dmaengine_terminate_sync(uap->dmatx.chan); if (uap->dmatx.queued) { dma_unmap_sg(uap->dmatx.chan->device->dev, &uap->dmatx.sg, 1, DMA_TO_DEVICE); @@ -1219,11 +1219,12 @@ static void pl011_dma_shutdown(struct uart_amba_port *uap) if (uap->using_rx_dma) { dmaengine_terminate_all(uap->dmarx.chan); + if (uap->dmarx.poll_rate) + timer_delete_sync(&uap->dmarx.timer); + dmaengine_terminate_sync(uap->dmarx.chan); /* Clean up the RX DMA */ pl011_sgbuf_free(uap->dmarx.chan, &uap->dmarx.sgbuf_a, DMA_FROM_DEVICE); pl011_sgbuf_free(uap->dmarx.chan, &uap->dmarx.sgbuf_b, DMA_FROM_DEVICE); - if (uap->dmarx.poll_rate) - del_timer_sync(&uap->dmarx.timer); uap->using_rx_dma = false; } } -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] Fix CVE-2026-80872
by Tengda Wu 10 Sep '26

10 Sep '26

Fix CVE-2026-80872. Cássio Gabriel (2): firmware_loader: Add cancel helper for async requests ALSA: hda/tas2781: Cancel async firmware request at unbind drivers/base/firmware_loader/main.c | 69 ++++++++++++++++++++++++++--- include/linux/firmware.h | 10 +++++ sound/pci/hda/tas2781_hda_i2c.c | 3 ++ 3 files changed, 77 insertions(+), 5 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/2] CVE-2026-80747
by Jiacheng Yu 10 Sep '26

10 Sep '26

CVE-2026-80747 William Palacek (1): [Backport] drm/amdkfd: Add bounds check for CRAT subtype length Yongqiang Sun (1): [Backport] drm/amdkfd: Fix infinite loop parsing CRAT with zero subtype length drivers/gpu/drm/amd/amdkfd/kfd_crat.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS 0/3] CVE-2026-74730
by Zhou Minqiang 10 Sep '26

10 Sep '26

CVE-2026-74730 Zhou Minqiang (3): nfs4: take a reference on the nfs_client when running FREE_STATEID NFS: Pin the 'struct nfs_server' during a FREE_STATEID call NFS: Decrement refcounts if allocating nfs_free_stateid_data fails fs/nfs/nfs4proc.c | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) -- 2.52.0

2 4

[PATCH OLK-6.6] md/raid1,raid10: fix bio accounting for split md cloned bios
by Zhou Minqiang 09 Sep '26

09 Sep '26

mainline inclusion from mainline-v7.2-rc1 commit ba976e3501111d11c550848b3b7341a73035f582 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17965 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Use md_cloned_bio() to control bio accounting instead of relying on r1bio_existed in raid1 or the io_accounting flag in raid10. The previous logic does not reliably reflect whether a bio is an md cloned bio. When a failed bio is split and resubmitted via bio_submit_split_bioset() on the error path, this can lead to either double accounting for md cloned bios, or missing accounting for bios returned from bio_submit_split_bioset() Fix this by using md_cloned_bio() to detect md cloned bios and skip accounting accordingly. Fixes: bb2a9acefaf9 ("md/raid1: switch to use md_account_bio() for io accounting") Fixes: 820455238366 ("md/raid10: switch to use md_account_bio() for io accounting") Signed-off-by: Abd-Alrhman Masalkhi <abd.masalkhi(a)gmail.com> Reviewed-by: Xiao Ni <xiao(a)kernel.org> Link: https://patch.msgid.link/20260501114652.590037-4-abd.masalkhi@gmail.com Signed-off-by: Yu Kuai <yukuai(a)fygo.io> Signed-off-by: Zhou Minqiang <zhouminqiang2(a)huawei.com> --- drivers/md/raid1.c | 2 +- drivers/md/raid10.c | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c index a4662d5077ba..e71ddd532455 100644 --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -1333,7 +1333,7 @@ static void raid1_read_request(struct mddev *mddev, struct bio *bio, */ gfp_t gfp = err_path ? (GFP_NOIO | __GFP_HIGH) : GFP_NOIO; - if (r1bio_existed) { + if (likely(!md_cloned_bio(mddev, bio))) { /* Need to get the block device name carefully */ struct md_rdev *rdev = conf->mirrors[r1_bio->read_disk].rdev; diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c index 316b6c96d413..e8ce8cdd7fce 100644 --- a/drivers/md/raid10.c +++ b/drivers/md/raid10.c @@ -1140,7 +1140,7 @@ static bool regular_request_wait(struct mddev *mddev, struct r10conf *conf, } static void raid10_read_request(struct mddev *mddev, struct bio *bio, - struct r10bio *r10_bio, bool io_accounting) + struct r10bio *r10_bio) { struct r10conf *conf = mddev->private; struct bio *read_bio; @@ -1218,7 +1218,7 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio, } slot = r10_bio->read_slot; - if (io_accounting) { + if (likely(!md_cloned_bio(mddev, bio))) { md_account_bio(mddev, &bio); r10_bio->master_bio = bio; } @@ -1514,7 +1514,7 @@ static bool __make_request(struct mddev *mddev, struct bio *bio, int sectors) ret = true; if (bio_data_dir(bio) == READ) - raid10_read_request(mddev, bio, r10_bio, true); + raid10_read_request(mddev, bio, r10_bio); else ret = raid10_write_request(mddev, bio, r10_bio); @@ -2839,7 +2839,7 @@ static void handle_read_error(struct mddev *mddev, struct r10bio *r10_bio) rdev_dec_pending(rdev, mddev); r10_bio->state = 0; - raid10_read_request(mddev, r10_bio->master_bio, r10_bio, false); + raid10_read_request(mddev, r10_bio->master_bio, r10_bio); /* * allow_barrier after re-submit to ensure no sync io * can be issued while regular io pending. -- 2.52.0

2 1

[PATCH OLK-6.6] Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero
by Xia Fukun 09 Sep '26

09 Sep '26

From: Pauli Virtanen <pav(a)iki.fi> mainline inclusion from mainline-v7.2-rc6 commit af24e338bf5dafb80f42baa9a0b9e9b57b1c5d9c category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17795 CVE: CVE-2026-74533 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- hci_conn::iso_data is accessed and modified without lock or RCU. This leads to a race [Task hdev->workqueue] [Task 2] iso_recv iso_conn_put(conn) conn = LOAD hcon->iso_data iso_conn_free(conn) iso_conn_hold_unless_zero(conn) hcon->iso_data = NULL kfree(conn) kref_get_unless_zero(&conn->ref) /* UAF */ and also to races in iso_conn_add() vs. iso_conn_free(). Fix by adding spinlock hci_conn::proto_lock and using it to guard hci_conn::iso_data. Fixes: dc26097bdb86 ("Bluetooth: ISO: Use kref to track lifetime of iso_conn") Signed-off-by: Pauli Virtanen <pav(a)iki.fi> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Conflicts: include/net/bluetooth/hci_core.h net/bluetooth/iso.c [Downstream 6.6 baseline lacks the __guarded_by sparse annotation (dropped it from iso_data). iso_listen_bis() does not use iso_conn_add(), so that hunk was skipped.] Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- include/net/bluetooth/hci_core.h | 2 ++ net/bluetooth/hci_conn.c | 2 ++ net/bluetooth/iso.c | 62 ++++++++++++++++++++++++++------ 3 files changed, 55 insertions(+), 11 deletions(-) diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h index 8da493385bd4..7ef7a8b4dd23 100644 --- a/include/net/bluetooth/hci_core.h +++ b/include/net/bluetooth/hci_core.h @@ -744,6 +744,8 @@ struct hci_conn { struct dentry *debugfs; struct hci_dev *hdev; + + spinlock_t proto_lock; /* lock guarding protocol data */ void *l2cap_data; void *sco_data; void *iso_data; diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c index 53abbea42845..c3329000da80 100644 --- a/net/bluetooth/hci_conn.c +++ b/net/bluetooth/hci_conn.c @@ -1001,6 +1001,8 @@ static struct hci_conn *__hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t INIT_DELAYED_WORK(&conn->idle_work, hci_conn_idle); INIT_DELAYED_WORK(&conn->le_conn_timeout, le_conn_timeout); + spin_lock_init(&conn->proto_lock); + atomic_set(&conn->refcnt, 0); hci_dev_hold(hdev); diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c index 61a1c8bddf16..5e84b6c8a194 100644 --- a/net/bluetooth/iso.c +++ b/net/bluetooth/iso.c @@ -106,9 +106,16 @@ static void iso_conn_free(struct kref *ref) BT_DBG("conn %p", conn); if (conn->hcon) { - conn->hcon->iso_data = NULL; - if (!test_and_set_bit(ISO_CONN_DROPPED, conn->flags)) - hci_conn_drop(conn->hcon); + spin_lock(&conn->hcon->proto_lock); + + /* Check we are not racing with iso_conn_add */ + if (conn->hcon->iso_data == conn) { + conn->hcon->iso_data = NULL; + if (!test_and_set_bit(ISO_CONN_DROPPED, conn->flags)) + hci_conn_drop(conn->hcon); + } + + spin_unlock(&conn->hcon->proto_lock); } kfree_skb(conn->rx_skb); @@ -123,7 +130,21 @@ static void iso_conn_put(struct iso_conn *conn) BT_DBG("conn %p refcnt %d", conn, kref_read(&conn->ref)); + /* The following race vs. iso_conn_del() is possible: + * + * 1. conn->hcon != NULL here + * 2. kref_put puts the last reference + * 3. concurrent iso_conn_del() gets iso_conn_hold_unless_zero() -> NULL + * and returns immediately, so conn->hcon is not cleared + * 4. iso_conn_free() dereferences conn->hcon + * + * To avoid UAF in step 4, take RCU before decrementing the refcount. + */ + rcu_read_lock(); + kref_put(&conn->ref, iso_conn_free); + + rcu_read_unlock(); } static struct iso_conn *iso_conn_hold_unless_zero(struct iso_conn *conn) @@ -202,22 +223,28 @@ static void iso_sock_disable_timer(struct sock *sk) /* ---- ISO connections ---- */ static struct iso_conn *iso_conn_add(struct hci_conn *hcon) + __must_hold(&hcon->hdev->lock) { - struct iso_conn *conn = hcon->iso_data; + struct iso_conn *conn; + + spin_lock(&hcon->proto_lock); - conn = iso_conn_hold_unless_zero(conn); + conn = iso_conn_hold_unless_zero(hcon->iso_data); if (conn) { if (!conn->hcon) { iso_conn_lock(conn); conn->hcon = hcon; iso_conn_unlock(conn); } + spin_unlock(&hcon->proto_lock); return conn; } - conn = kzalloc(sizeof(*conn), GFP_KERNEL); - if (!conn) + conn = kzalloc(sizeof(*conn), GFP_ATOMIC); + if (!conn) { + spin_unlock(&hcon->proto_lock); return NULL; + } kref_init(&conn->ref); spin_lock_init(&conn->lock); @@ -226,6 +253,8 @@ static struct iso_conn *iso_conn_add(struct hci_conn *hcon) conn->hcon = hcon; conn->tx_sn = 0; + spin_unlock(&hcon->proto_lock); + BT_DBG("hcon %p conn %p", hcon, conn); return conn; @@ -276,11 +305,13 @@ static bool iso_match_conn_sync_handle(struct sock *sk, void *data) static void iso_conn_del(struct hci_conn *hcon, int err) __must_hold(&hcon->hdev->lock) { - struct iso_conn *conn = hcon->iso_data; + struct iso_conn *conn; struct sock *sk; struct sock *parent; - conn = iso_conn_hold_unless_zero(conn); + spin_lock(&hcon->proto_lock); + conn = iso_conn_hold_unless_zero(hcon->iso_data); + spin_unlock(&hcon->proto_lock); if (!conn) return; @@ -322,10 +353,12 @@ static void iso_conn_del(struct hci_conn *hcon, int err) done: /* No sk access to conn->hcon any more (lock_sock + hdev->lock) */ + spin_lock(&hcon->proto_lock); iso_conn_lock(conn); conn->hcon = NULL; hcon->iso_data = NULL; iso_conn_unlock(conn); + spin_unlock(&hcon->proto_lock); iso_conn_put(conn); } @@ -439,6 +472,8 @@ static int iso_connect_bis(struct sock *sk) } } + lockdep_assert_held(&hcon->hdev->lock); + conn = iso_conn_add(hcon); if (!conn) { hci_conn_drop(hcon); @@ -537,6 +572,8 @@ static int iso_connect_cis(struct sock *sk) } } + lockdep_assert_held(&hcon->hdev->lock); + conn = iso_conn_add(hcon); if (!conn) { hci_conn_drop(hcon); @@ -854,8 +891,8 @@ static void iso_sock_disconn(struct sock *sk) */ if (bis_sk) { hcon->state = BT_OPEN; - hcon->iso_data = NULL; - iso_pi(sk)->conn->hcon = NULL; + set_bit(ISO_CONN_DROPPED, iso_pi(sk)->conn->flags); + iso_sock_clear_timer(sk); iso_chan_del(sk, bt_to_errno(hcon->abort_reason)); sock_put(bis_sk); @@ -2161,7 +2198,10 @@ int iso_recv(struct hci_dev *hdev, u16 handle, struct sk_buff *skb, u16 flags) return -ENOENT; } + spin_lock(&hcon->proto_lock); conn = iso_conn_hold_unless_zero(hcon->iso_data); + spin_unlock(&hcon->proto_lock); + hcon = NULL; hci_dev_unlock(hdev); -- 2.34.1

2 1

[PATCH OLK-5.10 v2] md/raid1,raid10: fix error-path detection with md_cloned_bio()
by Zhou Minqiang 09 Sep '26

09 Sep '26

mainline inclusion from mainline-v7.2-rc1 commit 811545e0926d02a6a0b1a1258bb5544777c164d4 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17694 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Detect the error path using md_cloned_bio() instead of relying on r1_bio in raid1 or r10_bio->read_slot in raid10, which may be NULL or -1 after splitting and resubmitting a failed bio. As a result, the error path may not be recognized and memory allocations can incorrectly use GFP_NOIO instead of (GFP_NOIO | __GFP_HIGH), which can lead to a deadlock under memory pressure. Fixes: 689389a06ce7 ("md/raid1: simplify handle_read_error().") Fixes: 545250f24809 ("md/raid10: simplify handle_read_error()") Signed-off-by: Abd-Alrhman Masalkhi <abd.masalkhi(a)gmail.com> Reviewed-by: Xiao Ni <xiao(a)kernel.org> Link: https://patch.msgid.link/20260501114652.590037-3-abd.masalkhi@gmail.com Signed-off-by: Yu Kuai <yukuai(a)fygo.io> Conflicts: drivers/md/raid1.c drivers/md/raid10.c [Backport to hulk-5.10: upstream uses md_cloned_bio() which depends on io_clone_set infrastructure absent in hulk-5.10. Use current == mddev->thread->tsk to detect error path instead] Signed-off-by: Zhou Minqiang <zhouminqiang2(a)huawei.com> --- drivers/md/raid1.c | 9 ++++++--- drivers/md/raid10.c | 14 +++++++++----- 2 files changed, 15 insertions(+), 8 deletions(-) diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c index acd008f97847..5f929347d77d 100644 --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -1198,13 +1198,16 @@ static void raid1_read_request(struct mddev *mddev, struct bio *bio, int rdisk; bool r1bio_existed = !!r1_bio; char b[BDEVNAME_SIZE]; + struct md_thread *thread = rcu_dereference_protected(mddev->thread, true); + gfp_t gfp = GFP_NOIO; /* - * If r1_bio is set, we are blocking the raid1d thread - * so there is a tiny risk of deadlock. So ask for + * If we are in the error path, we are blocking the raid1d + * thread so there is a tiny risk of deadlock. So ask for * emergency memory if needed. */ - gfp_t gfp = r1_bio ? (GFP_NOIO | __GFP_HIGH) : GFP_NOIO; + if (thread && current == thread->tsk) + gfp = GFP_NOIO | __GFP_HIGH; if (r1bio_existed) { /* Need to get the block device name carefully */ diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c index f272021d4e8b..dc5401ae3b84 100644 --- a/drivers/md/raid10.c +++ b/drivers/md/raid10.c @@ -1127,8 +1127,17 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio, char b[BDEVNAME_SIZE]; int slot = r10_bio->read_slot; struct md_rdev *err_rdev = NULL; + struct md_thread *thread = rcu_dereference_protected(mddev->thread, true); gfp_t gfp = GFP_NOIO; + /* + * If we are in the error path, we are blocking the raid10d + * thread so there is a tiny risk of deadlock. So ask for + * emergency memory if needed. + */ + if (thread && current == thread->tsk) + gfp = GFP_NOIO | __GFP_HIGH; + if (slot >= 0 && r10_bio->devs[slot].rdev) { /* * This is an error retry, but we cannot @@ -1138,11 +1147,6 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio, * we lose the device name in error messages. */ int disk; - /* - * As we are blocking raid10, it is a little safer to - * use __GFP_HIGH. - */ - gfp = GFP_NOIO | __GFP_HIGH; rcu_read_lock(); disk = r10_bio->devs[slot].devnum; -- 2.52.0

2 1

[PATCH OLK-6.6] drm/amdkfd: Add bounds check for CRAT subtype length
by Jiacheng Yu 09 Sep '26

09 Sep '26

From: William Palacek <William.Palacek(a)amd.com> mainline inclusion from mainline-v7.2-rc6 commit 6e7566ba4739dd573c331adde1c96690f7a567bd category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18596 CVE: CVE-2026-80747 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The CRAT parser validates that the subtype header fits within the image, but does not verify that the advertised subtype length fits. A malformed CRAT table with an oversized length field causes out-of-bounds reads when kfd_parse_subtype() casts the header to specific subtype structures. Add validation that sub_type_hdr + length does not exceed the image boundary before parsing the subtype contents. Signed-off-by: William Palacek <William.Palacek(a)amd.com> Reviewed-by: Alysa Liu <Alysa.Liu(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> (cherry picked from commit 48e1d1e6e8798aef0312e68d8e586021b5b3cf4d) Cc: stable(a)vger.kernel.org Conflicts: drivers/gpu/drm/amd/amdkfd/kfd_crat.c [Context conflicts] Signed-off-by: Jiacheng Yu <yujiacheng3(a)huawei.com> --- drivers/gpu/drm/amd/amdkfd/kfd_crat.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_crat.c b/drivers/gpu/drm/amd/amdkfd/kfd_crat.c index 29a02c175228..58edf03e4e1d 100644 --- a/drivers/gpu/drm/amd/amdkfd/kfd_crat.c +++ b/drivers/gpu/drm/amd/amdkfd/kfd_crat.c @@ -1314,6 +1314,15 @@ int kfd_parse_crat_table(void *crat_image, struct list_head *device_list, sub_type_hdr = (struct crat_subtype_generic *)(crat_table+1); while ((char *)sub_type_hdr + sizeof(struct crat_subtype_generic) < ((char *)crat_image) + image_len) { + /* Validate subtype fits within remaining image */ + if ((char *)sub_type_hdr + sub_type_hdr->length > + (char *)crat_image + image_len) { + pr_warn("CRAT subtype length %u exceeds image bounds\n", + sub_type_hdr->length); + ret = -EINVAL; + break; + } + if (sub_type_hdr->flags & CRAT_SUBTYPE_FLAGS_ENABLED) { ret = kfd_parse_subtype(sub_type_hdr, device_list); if (ret) -- 2.34.1

2 1

[PATCH OLK-6.6] Bluetooth: ISO: hold sk properly in iso_conn_ready
by Xia Fukun 09 Sep '26

09 Sep '26

From: Pauli Virtanen <pav(a)iki.fi> mainline inclusion from mainline-v7.2-rc6 commit 0d255e63fcf3f13a570d7ac11678fa1164ac015c category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17977 CVE: CVE-2026-74537 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- sk deref in iso_conn_ready must be done either under conn->lock, or holding a refcount, to avoid concurrent close. conn->sk is currently accessed without either: [Task 1] [Task 2] iso_sock_release iso_conn_ready sk = conn->sk lock_sock(sk) conn->sk = NULL lock_sock(sk) release_sock(sk) iso_sock_kill(sk) UAF on sk deref Fix possible UAF by holding sk refcount in iso_conn_ready(). Also recheck after lock_sock that the socket is still valid. Adjust locking so conn->sk is cleared only under lock_sock. Fixes: 27c24fda62b60 ("Bluetooth: switch to lock_sock in SCO") Signed-off-by: Pauli Virtanen <pav(a)iki.fi> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Conflicts: net/bluetooth/iso.c [In openEuler 6.6 iso_sock_kill() already takes lock_sock() at function entry, so the upstream-added lock_sock()/release_sock() around the conn->sk = NULL clearing were dropped to avoid a double-lock deadlock. The BIS sender source-address context is absent in this tree's iso_conn_ready() and was not introduced.] Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- net/bluetooth/iso.c | 30 +++++++++++++++++++++--------- 1 file changed, 21 insertions(+), 9 deletions(-) diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c index eda45006fddd..45e462478225 100644 --- a/net/bluetooth/iso.c +++ b/net/bluetooth/iso.c @@ -1781,23 +1781,17 @@ static void iso_sock_ready(struct sock *sk) { BT_DBG("sk %p", sk); - if (!sk) - return; - - lock_sock(sk); + lockdep_assert(lockdep_sock_is_held(sk)); switch (sk->sk_state) { case BT_DISCONN: case BT_CLOSED: - release_sock(sk); return; } iso_sock_clear_timer(sk); sk->sk_state = BT_CONNECTED; sk->sk_state_change(sk); - - release_sock(sk); } struct iso_list_data { @@ -1820,7 +1814,7 @@ static bool iso_match_pa_sync_flag(struct sock *sk, void *data) static void iso_conn_ready(struct iso_conn *conn) { struct sock *parent = NULL; - struct sock *sk = conn->sk; + struct sock *sk; struct hci_ev_le_big_sync_estabilished *ev = NULL; struct hci_ev_le_pa_sync_established *ev2 = NULL; struct hci_evt_le_big_info_adv_report *ev3 = NULL; @@ -1828,8 +1822,26 @@ static void iso_conn_ready(struct iso_conn *conn) BT_DBG("conn %p", conn); + iso_conn_lock(conn); + sk = iso_sock_hold(conn); + iso_conn_unlock(conn); + if (sk) { - iso_sock_ready(conn->sk); + lock_sock(sk); + + /* conn->sk may have become NULL if racing with sk close, but + * due to held hdev->lock, it can't become different sk. + */ + if (!conn->sk) { + release_sock(sk); + sock_put(sk); + return; + } + + iso_sock_ready(sk); + + release_sock(sk); + sock_put(sk); } else { hcon = conn->hcon; if (!hcon) -- 2.34.1

2 1

[PATCH OLK-6.6 0/5] net: Fix CVE-2026-53091
by Dong Chenchen 09 Sep '26

09 Sep '26

Fix CVE-2026-53091 Cosmin Ratiu (1): xfrm: Don't clobber inner headers when already set Dong Chenchen (1): net: iptunnel: fix stale transport header during tunnel decapsulation Eric Dumazet (2): net: qdisc_pkt_len_segs_init() cleanup net: pull headers in qdisc_pkt_len_segs_init() Fengyuan Gong (1): net: account for encap headers in qdisc pkt len drivers/net/gtp.c | 5 +++ include/linux/skbuff.h | 5 +++ net/core/dev.c | 79 ++++++++++++++++++++++++++---------------- net/core/gro_cells.c | 2 ++ net/sched/sch_cake.c | 5 ++- net/xfrm/xfrm_output.c | 20 +++++++---- 6 files changed, 79 insertions(+), 37 deletions(-) -- 2.25.1

2 6

[PATCH OLK-6.6 0/7] net: sched: Fix CVE-2026-74700
by Dong Chenchen 09 Sep '26

09 Sep '26

Fix CVE-2026-74700 Asbjørn Sloth Tønnesen (3): net: sched: cls_api: add skip_sw counter net: sched: cls_api: add filter counter net: sched: make skip_sw actually skip software Jamal Hadi Salim (1): net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers Jianbo Liu (1): net: sched: cls_api: fix slab-use-after-free in fl_dump_key Li Xiasong (1): net/sched: preserve kABI for tcf_proto and tcf_block Xin Long (1): net: sched: refine software bypass handling in tc_run include/net/pkt_cls.h | 18 +++++++++++++++ include/net/sch_generic.h | 3 +++ net/core/dev.c | 13 +++++++++++ net/sched/cls_api.c | 47 ++++++++++++++++++++++++++++++++++++++- net/sched/cls_bpf.c | 2 ++ net/sched/cls_flower.c | 2 ++ net/sched/cls_matchall.c | 2 ++ net/sched/cls_u32.c | 4 ++++ 8 files changed, 90 insertions(+), 1 deletion(-) -- 2.25.1

2 8

[PATCH OLK-6.6] md/raid1,raid10: fix bio accounting for split md cloned bios
by Zhou Minqiang 09 Sep '26

09 Sep '26

mainline inclusion from mainline-v7.2-rc1 commit ba976e3501111d11c550848b3b7341a73035f582 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17965 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Use md_cloned_bio() to control bio accounting instead of relying on r1bio_existed in raid1 or the io_accounting flag in raid10. The previous logic does not reliably reflect whether a bio is an md cloned bio. When a failed bio is split and resubmitted via bio_submit_split_bioset() on the error path, this can lead to either double accounting for md cloned bios, or missing accounting for bios returned from bio_submit_split_bioset() Fix this by using md_cloned_bio() to detect md cloned bios and skip accounting accordingly. Fixes: bb2a9acefaf9 ("md/raid1: switch to use md_account_bio() for io accounting") Fixes: 820455238366 ("md/raid10: switch to use md_account_bio() for io accounting") Signed-off-by: Abd-Alrhman Masalkhi <abd.masalkhi(a)gmail.com> Reviewed-by: Xiao Ni <xiao(a)kernel.org> Link: https://patch.msgid.link/20260501114652.590037-4-abd.masalkhi@gmail.com Signed-off-by: Yu Kuai <yukuai(a)fygo.io> Signed-off-by: Zhou Minqiang <zhouminqiang2(a)huawei.com> --- drivers/md/raid1.c | 2 +- drivers/md/raid10.c | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c index a4662d5077ba..e71ddd532455 100644 --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -1333,7 +1333,7 @@ static void raid1_read_request(struct mddev *mddev, struct bio *bio, */ gfp_t gfp = err_path ? (GFP_NOIO | __GFP_HIGH) : GFP_NOIO; - if (r1bio_existed) { + if (likely(!md_cloned_bio(mddev, bio))) { /* Need to get the block device name carefully */ struct md_rdev *rdev = conf->mirrors[r1_bio->read_disk].rdev; diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c index 316b6c96d413..e8ce8cdd7fce 100644 --- a/drivers/md/raid10.c +++ b/drivers/md/raid10.c @@ -1140,7 +1140,7 @@ static bool regular_request_wait(struct mddev *mddev, struct r10conf *conf, } static void raid10_read_request(struct mddev *mddev, struct bio *bio, - struct r10bio *r10_bio, bool io_accounting) + struct r10bio *r10_bio) { struct r10conf *conf = mddev->private; struct bio *read_bio; @@ -1218,7 +1218,7 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio, } slot = r10_bio->read_slot; - if (io_accounting) { + if (likely(!md_cloned_bio(mddev, bio))) { md_account_bio(mddev, &bio); r10_bio->master_bio = bio; } @@ -1514,7 +1514,7 @@ static bool __make_request(struct mddev *mddev, struct bio *bio, int sectors) ret = true; if (bio_data_dir(bio) == READ) - raid10_read_request(mddev, bio, r10_bio, true); + raid10_read_request(mddev, bio, r10_bio); else ret = raid10_write_request(mddev, bio, r10_bio); @@ -2839,7 +2839,7 @@ static void handle_read_error(struct mddev *mddev, struct r10bio *r10_bio) rdev_dec_pending(rdev, mddev); r10_bio->state = 0; - raid10_read_request(mddev, r10_bio->master_bio, r10_bio, false); + raid10_read_request(mddev, r10_bio->master_bio, r10_bio); /* * allow_barrier after re-submit to ensure no sync io * can be issued while regular io pending. -- 2.52.0

2 1

[PATCH OLK-6.6] md/raid1,raid10: fix error-path detection with md_cloned_bio()
by Zhou Minqiang 09 Sep '26

09 Sep '26

mainline inclusion from mainline-v7.2-rc1 commit 811545e0926d02a6a0b1a1258bb5544777c164d4 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17694 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Detect the error path using md_cloned_bio() instead of relying on r1_bio in raid1 or r10_bio->read_slot in raid10, which may be NULL or -1 after splitting and resubmitting a failed bio. As a result, the error path may not be recognized and memory allocations can incorrectly use GFP_NOIO instead of (GFP_NOIO | __GFP_HIGH), which can lead to a deadlock under memory pressure. Fixes: 689389a06ce7 ("md/raid1: simplify handle_read_error().") Fixes: 545250f24809 ("md/raid10: simplify handle_read_error()") Signed-off-by: Abd-Alrhman Masalkhi <abd.masalkhi(a)gmail.com> Reviewed-by: Xiao Ni <xiao(a)kernel.org> Link: https://patch.msgid.link/20260501114652.590037-3-abd.masalkhi@gmail.com Signed-off-by: Yu Kuai <yukuai(a)fygo.io> Signed-off-by: Zhou Minqiang <zhouminqiang2(a)huawei.com> --- drivers/md/raid1.c | 13 ++++++++++--- drivers/md/raid10.c | 20 ++++++++++++++------ 2 files changed, 24 insertions(+), 9 deletions(-) diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c index a804593e178b..a4662d5077ba 100644 --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -1320,11 +1320,18 @@ static void raid1_read_request(struct mddev *mddev, struct bio *bio, char b[BDEVNAME_SIZE]; /* - * If r1_bio is set, we are blocking the raid1d thread - * so there is a tiny risk of deadlock. So ask for + * An md cloned bio indicates we are in the error path. + * This is more reliable than checking r1_bio, which might + * be NULL even in the error path if a failed bio was split. + */ + bool err_path = md_cloned_bio(mddev, bio); + + /* + * If we are in the error path, we are blocking the raid1d + * thread so there is a tiny risk of deadlock. So ask for * emergency memory if needed. */ - gfp_t gfp = r1_bio ? (GFP_NOIO | __GFP_HIGH) : GFP_NOIO; + gfp_t gfp = err_path ? (GFP_NOIO | __GFP_HIGH) : GFP_NOIO; if (r1bio_existed) { /* Need to get the block device name carefully */ diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c index ae423f3952b6..316b6c96d413 100644 --- a/drivers/md/raid10.c +++ b/drivers/md/raid10.c @@ -1149,7 +1149,20 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio, char b[BDEVNAME_SIZE]; int slot = r10_bio->read_slot; struct md_rdev *err_rdev = NULL; - gfp_t gfp = GFP_NOIO; + + /* + * An md cloned bio indicates we are in the error path. + * This is more reliable than checking slot, which might + * be -1 even in the error path if a failed bio was split. + */ + bool err_path = md_cloned_bio(mddev, bio); + + /* + * If we are in the error path, we are blocking the raid10d + * thread so there is a tiny risk of deadlock. So ask for + * emergency memory if needed. + */ + gfp_t gfp = err_path ? (GFP_NOIO | __GFP_HIGH) : GFP_NOIO; if (slot >= 0 && r10_bio->devs[slot].rdev) { /* @@ -1160,11 +1173,6 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio, * we lose the device name in error messages. */ int disk; - /* - * As we are blocking raid10, it is a little safer to - * use __GFP_HIGH. - */ - gfp = GFP_NOIO | __GFP_HIGH; disk = r10_bio->devs[slot].devnum; err_rdev = conf->mirrors[disk].rdev; -- 2.52.0

2 1

[PATCH OLK-5.10] md/raid1,raid10: fix error-path detection with md_cloned_bio()
by Zhou Minqiang 09 Sep '26

09 Sep '26

mainline inclusion from mainline-v7.2-rc1 commit 811545e0926d02a6a0b1a1258bb5544777c164d4 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17694 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Detect the error path using md_cloned_bio() instead of relying on r1_bio in raid1 or r10_bio->read_slot in raid10, which may be NULL or -1 after splitting and resubmitting a failed bio. As a result, the error path may not be recognized and memory allocations can incorrectly use GFP_NOIO instead of (GFP_NOIO | __GFP_HIGH), which can lead to a deadlock under memory pressure. Fixes: 689389a06ce7 ("md/raid1: simplify handle_read_error().") Fixes: 545250f24809 ("md/raid10: simplify handle_read_error()") Signed-off-by: Abd-Alrhman Masalkhi <abd.masalkhi(a)gmail.com> Reviewed-by: Xiao Ni <xiao(a)kernel.org> Link: https://patch.msgid.link/20260501114652.590037-3-abd.masalkhi@gmail.com Signed-off-by: Yu Kuai <yukuai(a)fygo.io> Conflicts: drivers/md/raid1.c drivers/md/raid10.c [Backport to hulk-5.10: upstream uses md_cloned_bio() which depends on io_clone_set infrastructure absent in hulk-5.10. Use current == mddev->thread->tsk to detect error path instead] Signed-off-by: Zhou Minqiang <zhouminqiang2(a)huawei.com> --- drivers/md/raid1.c | 9 ++++++--- drivers/md/raid10.c | 14 +++++++++----- 2 files changed, 15 insertions(+), 8 deletions(-) diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c index acd008f97847..b6ae83158a7b 100644 --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -1198,13 +1198,16 @@ static void raid1_read_request(struct mddev *mddev, struct bio *bio, int rdisk; bool r1bio_existed = !!r1_bio; char b[BDEVNAME_SIZE]; + struct md_thread *thread = rcu_dereference(mddev->thread); + gfp_t gfp = GFP_NOIO; /* - * If r1_bio is set, we are blocking the raid1d thread - * so there is a tiny risk of deadlock. So ask for + * If we are in the error path, we are blocking the raid1d + * thread so there is a tiny risk of deadlock. So ask for * emergency memory if needed. */ - gfp_t gfp = r1_bio ? (GFP_NOIO | __GFP_HIGH) : GFP_NOIO; + if (thread && current == thread->tsk) + gfp = GFP_NOIO | __GFP_HIGH; if (r1bio_existed) { /* Need to get the block device name carefully */ diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c index f272021d4e8b..4c97325905eb 100644 --- a/drivers/md/raid10.c +++ b/drivers/md/raid10.c @@ -1127,8 +1127,17 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio, char b[BDEVNAME_SIZE]; int slot = r10_bio->read_slot; struct md_rdev *err_rdev = NULL; + struct md_thread *thread = rcu_dereference(mddev->thread); gfp_t gfp = GFP_NOIO; + /* + * If we are in the error path, we are blocking the raid10d + * thread so there is a tiny risk of deadlock. So ask for + * emergency memory if needed. + */ + if (thread && current == thread->tsk) + gfp = GFP_NOIO | __GFP_HIGH; + if (slot >= 0 && r10_bio->devs[slot].rdev) { /* * This is an error retry, but we cannot @@ -1138,11 +1147,6 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio, * we lose the device name in error messages. */ int disk; - /* - * As we are blocking raid10, it is a little safer to - * use __GFP_HIGH. - */ - gfp = GFP_NOIO | __GFP_HIGH; rcu_read_lock(); disk = r10_bio->devs[slot].devnum; -- 2.52.0

2 1

[PATCH OLK-6.6 0/3] md/raid1,raid10: fix deadlock and bio accounting in read error path
by Zhou Minqiang 09 Sep '26

09 Sep '26

Splitting a bio while executing in the raid1 thread can lead to recursion, as task->bio_list is NULL in this context. In addition, resubmitting an md_cloned_bio after splitting may lead to a deadlock if the array is suspended before the md driver calls percpu_ref_tryget_live(&mddev->active_io) on it's path to pers->make_request(). Avoid splitting the bio in this context and require that it is either read in full or not at all. This prevents recursion and avoids potential deadlocks during array suspension. Zhou Minqiang (3): md/raid1,raid10: fix deadlock in read error recovery path md/raid1,raid10: fix error-path detection with md_cloned_bio() md/raid1,raid10: fix bio accounting for split md cloned bios drivers/md/md.c | 40 ++++++++++++++++++++++++---------------- drivers/md/md.h | 5 +++++ drivers/md/raid1.c | 15 +++++++++++---- drivers/md/raid10.c | 28 ++++++++++++++++++---------- 4 files changed, 58 insertions(+), 30 deletions(-) -- 2.52.0

2 4

[PATCH OLK-6.6] net/sched: cls_bpf: reject dev-bound programs bound to a different device
by superdcc97＠163.com 09 Sep '26

09 Sep '26

From: Jamal Hadi Salim <jhs(a)mojatatu.com> stable inclusion from stable-v6.6.153 commit ec5a552f4b2d841c6c021752450716e1a9676661 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18373 CVE: CVE-2026-74736 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 120977e2c096deea4e866e4273be9220b957c29e ] cls_bpf_prog_from_efd() obtained a SCHED_CLS program via bpf_prog_get_type_dev() but never verified that a device-bound (offloaded) program's bound netdev matches the TC netdev the classifier is being attached to. This let a program loaded with prog_ifindex for device A be attached via cls_bpf + skip_sw to device B; deleting device A then destroyed the program's offload state while it was still attached to device B, triggering a netdevsim WARN (panic with panic_on_warn=1). Mirror the XDP attach path (net/core/dev.c) and reject the attach with -EINVAL when a dev-bound program's bound device does not match the target device. Fixes: 2b3486bc2d23 ("bpf: Introduce device-bound XDP programs") Reported-by: vega(a)nebusec.ai Tested-by: Victor Nogueira <victor(a)mojatatu.com> Signed-off-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Acked-by: Daniel Borkmann <daniel(a)iogearbox.net> Link: https://patch.msgid.link/20260809094418.901607-1-jhs@mojatatu.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/sched/cls_bpf.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/net/sched/cls_bpf.c b/net/sched/cls_bpf.c index d5a5dffcd6f9..0ad0d665317b 100644 --- a/net/sched/cls_bpf.c +++ b/net/sched/cls_bpf.c @@ -368,32 +368,46 @@ static int cls_bpf_prog_from_ops(struct nlattr **tb, struct cls_bpf_prog *prog) prog->bpf_ops = bpf_ops; prog->bpf_num_ops = bpf_num_ops; prog->bpf_name = NULL; prog->filter = fp; return 0; } static int cls_bpf_prog_from_efd(struct nlattr **tb, struct cls_bpf_prog *prog, - u32 gen_flags, const struct tcf_proto *tp) + u32 gen_flags, const struct tcf_proto *tp, + struct netlink_ext_ack *extack) { struct bpf_prog *fp; char *name = NULL; bool skip_sw; u32 bpf_fd; bpf_fd = nla_get_u32(tb[TCA_BPF_FD]); skip_sw = gen_flags & TCA_CLS_FLAGS_SKIP_SW; fp = bpf_prog_get_type_dev(bpf_fd, BPF_PROG_TYPE_SCHED_CLS, skip_sw); if (IS_ERR(fp)) return PTR_ERR(fp); + if (bpf_prog_is_dev_bound(fp->aux)) { + struct tcf_block *block = tp->chain->block; + struct net_device *dev; + + dev = block->q ? qdisc_dev(block->q) : NULL; + if (!dev || !bpf_offload_dev_match(fp, dev)) { + NL_SET_ERR_MSG(extack, + "Program is bound to a different device"); + bpf_prog_put(fp); + return -EINVAL; + } + } + if (tb[TCA_BPF_NAME]) { name = nla_memdup(tb[TCA_BPF_NAME], GFP_KERNEL); if (!name) { bpf_prog_put(fp); return -ENOMEM; } } prog->bpf_ops = NULL; @@ -486,19 +500,19 @@ static int cls_bpf_change(struct net *net, struct sk_buff *in_skb, ret = -EINVAL; goto errout_idr; } } prog->exts_integrated = have_exts; prog->gen_flags = gen_flags; ret = is_bpf ? cls_bpf_prog_from_ops(tb, prog) : - cls_bpf_prog_from_efd(tb, prog, gen_flags, tp); + cls_bpf_prog_from_efd(tb, prog, gen_flags, tp, extack); if (ret < 0) goto errout_idr; if (tb[TCA_BPF_CLASSID]) { prog->res.classid = nla_get_u32(tb[TCA_BPF_CLASSID]); tcf_bind_filter(tp, &prog->res, base); bound_to_filter = true; } -- 2.43.0

2 1

[PATCH OLK-5.10] RDMA/rxe: Fix a use-after-free problem in rxe_mmap
by Xia Fukun 09 Sep '26

09 Sep '26

From: Zhu Yanjun <yanjun.zhu(a)linux.dev> stable inclusion from stable-v5.10.265 commit b810352d0916796dabe633cdb9adee9863ab4911 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17098 CVE: CVE-2026-64582 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 35744ab3d03c5fca8c1752f53fc8fc674e14c561 ] rxe_mmap() removes a rxe_mmap_info struct from the pending_mmaps list and releases pending_lock while the struct's kref is still at 1: list_del_init(&ip->pending_mmaps); spin_unlock_bh(&rxe->pending_lock); /* ref == 1, no lock held */ ret = remap_vmalloc_range(vma, ip->obj, 0); /* walks PTEs */ [...] rxe_vma_open(vma); /* kref_get, ref → 2 */ remap_vmalloc_range_partial() walks PTEs without any lock. A concurrent DESTROY_CQ ioctl on another CPU calls: kref_put(&q->ip->ref, rxe_mmap_release) /* ref 1→0 */ vfree(ip->obj) /* clears vmalloc PTEs mid-walk */ kfree(ip) /* frees rxe_mmap_info */ This yields: 1. Kernel crash, vmalloc_to_page() returns NULL when vfree wins the per-PTE race -> vm_insert_page(NULL) → GPF in validate_page_before_insert 2. Page UAF, vmalloc_to_page() reads a stale PTE before vfree clears it. User VMA holds a PTE to a free'd page which might eventually get reallocated later by vmalloc which allows the attacker to get a clean page-level UAF. It is worth noting that even though a page-level UAF is possible given the strong primitive, it is statistically very difficult to achieve given the very short time window (after the last insert_page and before the kref_get). The call trace are as below: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 0 UID: 1000 PID: 413 Comm: poc Not tainted 7.0.0-rc5-dirty #28 PREEMPT(lazy) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:validate_page_before_insert+0x32/0x300 Code: e5 41 57 41 56 49 89 fe 41 55 41 54 53 48 89 f3 e8 93 b5 a3 ff 48 8d 7b 08 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 7b 02 00 00 4c 8b 63 08 31 ff 4d 89 e5 41 83 e5 RSP: 0018:ffff88811b15f2f0 EFLAGS: 00000202 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000008 RBP: ffff88811b15f318 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff8881181eee00 R13: 0000000000000000 R14: ffff8881181eee00 R15: ffff8881181eee20 FS: 00007b1e000f76c0(0000) GS:ffff8884268e0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007b1e00a24ac0 CR3: 0000000116eb3000 CR4: 00000000000006f0 Call Trace: <TASK> insert_page+0x8f/0x190 ? __pfx_insert_page+0x10/0x10 ? kasan_save_alloc_info+0x38/0x60 vm_insert_page+0x2e7/0x400 remap_vmalloc_range_partial+0x212/0x3e0 remap_vmalloc_range+0x6e/0xb0 ? __kasan_check_write+0x14/0x30 rxe_mmap+0x2e9/0x5d0 ib_uverbs_mmap+0x1ad/0x2c0 __mmap_region+0x12c2/0x2ad0 ? __pfx___mmap_region+0x10/0x10 ? __sanitizer_cov_trace_switch+0x58/0xb0 ? mas_prev_slot+0x360/0x39c0 ? __sanitizer_cov_trace_switch+0x58/0xb0 ? mas_next_slot+0x1e5b/0x2f40 ? __sanitizer_cov_trace_cmp8+0x18/0x30 ? unmapped_area_topdown+0x4dd/0x610 ? kfree+0x1b1/0x440 ? free_cpumask_var+0x16/0x30 ? __kasan_slab_free+0x7d/0xa0 ? __sanitizer_cov_trace_cmp8+0x18/0x30 mmap_region+0x2e6/0x3c0 do_mmap+0xa3e/0x12a0 ? __pfx_do_mmap+0x10/0x10 ? __kasan_check_write+0x14/0x30 ? down_write_killable+0xba/0x160 ? __pfx_down_write_killable+0x10/0x10 ? __sanitizer_cov_trace_cmp4+0x16/0x30 vm_mmap_pgoff+0x2d4/0x4a0 ? __pfx_vm_mmap_pgoff+0x10/0x10 ? fget+0x1bf/0x270 ksys_mmap_pgoff+0x40c/0x690 ? __sanitizer_cov_trace_const_cmp4+0x16/0x30 ? __pfx_ksys_mmap_pgoff+0x10/0x10 ? __kasan_check_write+0x14/0x30 ? _raw_spin_trylock+0xbb/0x130 ? __pfx__raw_spin_trylock+0x10/0x10 __x64_sys_mmap+0x135/0x1e0 x64_sys_call+0x1c14/0x2790 do_syscall_64+0xd2/0x1050 ? rcu_core+0x352/0x7d0 ? rcu_core_si+0xe/0x20 ? handle_softirqs+0x1aa/0x650 ? __sanitizer_cov_trace_cmp4+0x16/0x30 ? fpregs_assert_state_consistent+0xe1/0x160 ? irqentry_exit+0xb1/0x670 entry_SYSCALL_64_after_hwframe+0x76/0x7e Link: https://patch.msgid.link/r/20260515002537.6209-1-yanjun.zhu@linux.dev Reported-and-tested-by: nasm <n4sm(a)protonmail.com> Suggested-by: nasm <n4sm(a)protonmail.com> Fixes: 8700e3e7c485 ("Soft RoCE driver") Signed-off-by: Zhu Yanjun <yanjun.zhu(a)linux.dev> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> (cherry picked from commit 35744ab3d03c5fca8c1752f53fc8fc674e14c561) [Harshit: Minor conflict resolution pr_err() vs rxe_dbg_dev() usage] Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- drivers/infiniband/sw/rxe/rxe_mmap.c | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/drivers/infiniband/sw/rxe/rxe_mmap.c b/drivers/infiniband/sw/rxe/rxe_mmap.c index 035f226af133..edd9345da295 100644 --- a/drivers/infiniband/sw/rxe/rxe_mmap.c +++ b/drivers/infiniband/sw/rxe/rxe_mmap.c @@ -94,18 +94,31 @@ int rxe_mmap(struct ib_ucontext *context, struct vm_area_struct *vma) goto done; found_it: + /* + * Increment refcount and check whether it is being freed atm while + * holding lock to prevent UAF + */ + if (!kref_get_unless_zero(&ip->ref)) { + spin_unlock_bh(&rxe->pending_lock); + ret = -ENXIO; + goto done; + } + list_del_init(&ip->pending_mmaps); spin_unlock_bh(&rxe->pending_lock); + vma->vm_ops = &rxe_vm_ops; + vma->vm_private_data = ip; + ret = remap_vmalloc_range(vma, ip->obj, 0); if (ret) { + vma->vm_private_data = NULL; + vma->vm_ops = NULL; + kref_put(&ip->ref, rxe_mmap_release); pr_err("err %d from remap_vmalloc_range\n", ret); goto done; } - vma->vm_ops = &rxe_vm_ops; - vma->vm_private_data = ip; - rxe_vma_open(vma); done: return ret; } -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] workqueue: Make flush_workqueue() cost scale with active pwqs
by Yao Kai 09 Sep '26

09 Sep '26

Hello, Since 636b927eba5b ("workqueue: Make unbound workqueues to use per-cpu pool_workqueues"), flush_workqueue() walks one pwq per possible CPU, cycling each pool lock, even when the workqueue is idle. Yao Kai reported the XFS CIL workqueue, flushed on every log force, spending up to 64us per flush in that walk on a 128-CPU machine. This patchset makes flushes visit only the pwqs which have been active since the last flush by tracking them on per-node lists. On a 192-CPU 2-node machine, flushing an idle per-cpu workqueue goes from 40k to 4.2M per second and 16 threads doing queue+flush in a loop go from 30k to 110k flushes per second. Dense flushes with every pwq active get 15-20% slower on unbound workqueues. Tejun Heo (2): workqueue: Maintain pwq->total_in_flight workqueue: Make flush_workqueue() visit only pwqs active since the last flush kernel/workqueue.c | 286 +++++++++++++++++++++++++++++++++++++-------- 1 file changed, 236 insertions(+), 50 deletions(-) -- 2.43.0

2 3

[PATCH OLK-5.10] sctp: stream: fully roll back denied add-stream state
by Zhang Qilong 09 Sep '26

09 Sep '26

From: Wyatt Feng <bronzed_45_vested(a)icloud.com> stable inclusion from stable-v5.10.259 commit 0cd2dc6dce8ca47212cd306ccd52eb315ef3cf85 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15635 CVE: CVE-2026-52929 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit a5f8a90ac9f77c678a9781c0a464b635e0d63e49 upstream. When ADD_OUT_STREAMS is denied, SCTP only shrinks the queued chunks and then lowers outcnt. That leaves removed stream metadata behind, so a later re-add can reuse a stale ext and hit a null-pointer dereference in the scheduler get path. Fix the rollback by tearing down the removed stream state the same way other stream resizes do. Unschedule the current scheduler state, drop the removed stream ext state with sctp_stream_outq_migrate(), and then reschedule the remaining streams. This keeps scheduler-private RR/FC/PRIO lists consistent while fully rolling back denied outgoing stream additions. Fixes: 637784ade221 ("sctp: introduce priority based stream scheduler") Cc: stable(a)kernel.org Reported-by: Yuan Tan <yuantan098(a)gmail.com> Reported-by: Yifan Wu <yifanwucs(a)gmail.com> Reported-by: Juefei Pu <tomapufckgml(a)gmail.com> Reported-by: Zhengchuan Liang <zcliangcn(a)gmail.com> Reported-by: Xin Liu <bird(a)lzu.edu.cn> Signed-off-by: Wyatt Feng <bronzed_45_vested(a)icloud.com> Signed-off-by: Ren Wei <n05ec(a)lzu.edu.cn> Acked-by: Xin Long <lucien.xin(a)gmail.com> Link: https://patch.msgid.link/d78954ecd94954653ee299400e98d74a03a6f7d3.178060339… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lin Yujun <linyujun809(a)h-partners.com> Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- net/sctp/stream.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/net/sctp/stream.c b/net/sctp/stream.c index 73c212ae69d8..6697ee605536 100644 --- a/net/sctp/stream.c +++ b/net/sctp/stream.c @@ -1040,21 +1040,25 @@ struct sctp_chunk *sctp_process_strreset_resp( *evp = sctp_ulpevent_make_assoc_reset_event(asoc, flags, stsn, rtsn, GFP_ATOMIC); } else if (req->type == SCTP_PARAM_RESET_ADD_OUT_STREAMS) { struct sctp_strreset_addstrm *addstrm; + const struct sctp_sched_ops *sched; __u16 number; addstrm = (struct sctp_strreset_addstrm *)req; nums = ntohs(addstrm->number_of_streams); number = stream->outcnt - nums; if (result == SCTP_STRRESET_PERFORMED) { for (i = number; i < stream->outcnt; i++) SCTP_SO(stream, i)->state = SCTP_STREAM_OPEN; } else { - sctp_stream_shrink_out(stream, number); + sched = sctp_sched_ops_from_stream(stream); + sched->unsched_all(stream); + sctp_stream_outq_migrate(stream, NULL, number); + sched->sched_all(stream); stream->outcnt = number; } *evp = sctp_ulpevent_make_stream_change_event(asoc, flags, 0, nums, GFP_ATOMIC); -- 2.43.0

2 1

[PATCH OLK-5.10] libceph: handle rbtree insertion error in decode_choose_args()
by Zhang Qilong 09 Sep '26

09 Sep '26

From: Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> stable inclusion from stable-v5.10.258 commit c7bf7864e2924fa5508ac270b0e9364bc13d5a6c category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15656 CVE: CVE-2026-52954 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit d289478cfc0bcf81c7914200d6abdcb78bd04ded upstream. A message of type CEPH_MSG_OSD_MAP contains an OSD map that itself contains a CRUSH map. The received CRUSH map may optionally contain choose_args that get decoded in decode_choose_args(). In this function, num_choose_arg_maps is read from the message, and a corresponding number of crush_choose_arg_maps gets decoded afterwards. Each crush_choose_arg_map has a choose_args_index, which serves as the key when inserting it into the choose_args rbtree of the decoded crush_map. If a (potentially corrupted) message contains two crush_choose_arg_maps with the same index, the assertion in insert_choose_arg_map() triggers a kernel BUG when trying to insert the second crush_choose_arg_map. This patch fixes the issue by switching to the non-asserting rbtree insertion function and rejecting the message if the insertion fails. [ idryomov: changelog ] Cc: stable(a)vger.kernel.org Signed-off-by: Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> Reviewed-by: Ilya Dryomov <idryomov(a)gmail.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- net/ceph/osdmap.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c index c6127aba5a70..2480ce67323c 100644 --- a/net/ceph/osdmap.c +++ b/net/ceph/osdmap.c @@ -373,11 +373,14 @@ static int decode_choose_args(void **p, void *end, struct crush_map *c) (!c->buckets[bucket_index] || arg->ids_size != c->buckets[bucket_index]->size)) goto e_inval; } - insert_choose_arg_map(&c->choose_args, arg_map); + if (!__insert_choose_arg_map(&c->choose_args, arg_map)) { + ret = -EEXIST; + goto fail; + } } return 0; e_inval: -- 2.43.0

2 1

[PATCH OLK-5.10] thunderbolt: Limit XDomain response copy to actual frame size
by Zhang Qilong 09 Sep '26

09 Sep '26

From: Michael Bommarito <michael.bommarito(a)gmail.com> stable inclusion from stable-v5.10.259 commit c55da494dfb445fb28df3a9d293c2be6a299cd01 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16026 CVE: CVE-2026-53146 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 4db2bd2ed4785dbadaeeab9f4e346b21ac5fb8eb upstream. tb_xdomain_copy() copies req->response_size bytes from the received packet buffer regardless of the actual frame size. When a short response arrives, this reads past the valid frame data in the DMA pool buffer into stale contents from previous transactions. Use the minimum of frame size and expected response size for the copy length. Fixes: cdae7c07e3e3 ("thunderbolt: Add support for XDomain properties") Cc: stable(a)vger.kernel.org Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Signed-off-by: Mika Westerberg <mika.westerberg(a)linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- drivers/thunderbolt/xdomain.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/thunderbolt/xdomain.c b/drivers/thunderbolt/xdomain.c index c00ad817042e..4071923583c7 100644 --- a/drivers/thunderbolt/xdomain.c +++ b/drivers/thunderbolt/xdomain.c @@ -79,11 +79,13 @@ static bool tb_xdomain_match(const struct tb_cfg_request *req, } static bool tb_xdomain_copy(struct tb_cfg_request *req, const struct ctl_pkg *pkg) { - memcpy(req->response, pkg->buffer, req->response_size); + size_t len = min_t(size_t, pkg->frame.size, req->response_size); + + memcpy(req->response, pkg->buffer, len); req->result.err = 0; return true; } static void response_ready(void *data) -- 2.43.0

2 1

[PATCH OLK-5.10] mm/huge_memory: update file PMD counter before folio_put()
by Zhang Qilong 09 Sep '26

09 Sep '26

From: Yin Tirui <yintirui(a)huawei.com> stable inclusion from stable-v5.10.259 commit 84b3212b166b446faea27ebebb7161405ffceef9 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15875 CVE: CVE-2026-53189 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 8d878059924f12c1bc24556a92ec56add74de3c8 ] __split_huge_pmd_locked() updates the file/shmem RSS counter after dropping the PMD mapping's folio reference. If folio_put() drops the last reference, mm_counter_file() can later read freed folio state via folio_test_swapbacked(). Move the counter update before folio_put(). Link: https://lore.kernel.org/20260526101337.1984081-1-yintirui@huawei.com Fixes: fadae2953072 ("thp: use mm_file_counter to determine update which rss counter") Signed-off-by: Yin Tirui <yintirui(a)huawei.com> Reviewed-by: Lorenzo Stoakes <ljs(a)kernel.org> Acked-by: David Hildenbrand (arm) <david(a)kernel.org> Reviewed-by: Lance Yang <lance.yang(a)linux.dev> Reviewed-by: Dev Jain <dev.jain(a)arm.com> Cc: Baolin Wang <baolin.wang(a)linux.alibaba.com> Cc: Barry Song <baohua(a)kernel.org> Cc: Chen Jun <chenjun102(a)huawei.com> Cc: Kefeng Wang <wangkefeng.wang(a)huawei.com> Cc: Liam R. Howlett <liam(a)infradead.org> Cc: Nico Pache <npache(a)redhat.com> Cc: Ryan Roberts <ryan.roberts(a)arm.com> Cc: Vlastimil Babka <vbabka(a)kernel.org> Cc: Yang Shi <yang.shi(a)linux.alibaba.com> Cc: Zi Yan <ziy(a)nvidia.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: mm/huge_memory.c [Just context conflicts] Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- mm/huge_memory.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/mm/huge_memory.c b/mm/huge_memory.c index 2825c5390fe9..261eefa41fa1 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -2038,11 +2038,13 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd, set_page_dirty(page); if (!PageReferenced(page) && pmd_young(old_pmd)) SetPageReferenced(page); reliable_page_counter(page, mm, -HPAGE_PMD_NR); page_remove_rmap(page, true); + add_mm_counter(mm, mm_counter_file(page), -HPAGE_PMD_NR); put_page(page); + return; } add_mm_counter(mm, mm_counter_file(page), -HPAGE_PMD_NR); return; } -- 2.43.0

2 1

[PATCH OLK-5.10 0/2] *** fix CVE-2026-74713 ***
by Lin Ruifeng 09 Sep '26

09 Sep '26

*** fix CVE-2026-74713 *** Lin Ruifeng (1): vhost_iotlb: bound map allocation in add_range Stefano Garzarella (1): vdpa_sim: make IOTLB entries limit configurable drivers/vdpa/vdpa_sim/vdpa_sim.c | 10 ++++++- drivers/vhost/iotlb.c | 46 +++++++++++++++++++++++--------- drivers/vhost/vhost.c | 8 ++++++ 3 files changed, 50 insertions(+), 14 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10 0/2] *** fix CVE-2026-74713 ***
by Lin Ruifeng 08 Sep '26

08 Sep '26

*** fix CVE-2026-74713 *** Lin Ruifeng (1): vhost_iotlb: bound map allocation in add_range Stefano Garzarella (1): vdpa_sim: make IOTLB entries limit configurable drivers/vdpa/vdpa_sim/vdpa_sim.c | 10 ++++++- drivers/vhost/iotlb.c | 46 +++++++++++++++++++++++--------- drivers/vhost/vhost.c | 8 ++++++ 3 files changed, 50 insertions(+), 14 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] libceph: fix multiple unsafe decodes in decode_locker()
by Zhang Qilong 08 Sep '26

08 Sep '26

From: Pavitra Jha <jhapavitra98(a)gmail.com> stable inclusion from stable-v6.6.153 commit fa4aa86fff0c56799c2e3f51a88879053285f4a9 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18381 CVE: CVE-2026-80561 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------ commit 437b6551cfcc235eea1d735a874f9d421f555e17 upstream. decode_locker() in cls_lock_client.c contains three unsafe decode operations that allow a malicious or compromised OSD to trigger slab-out-of-bounds reads: 1. ceph_decode_copy() at the locker_id_t name field has no preceding bounds check. With p == end after ceph_start_decoding() accepts struct_len=0, this reads sizeof(ceph_entity_name) = 9 bytes past the validated buffer boundary. 2. *p += sizeof(struct ceph_timespec) after the locker_info_t header is an unchecked pointer advance. A malicious OSD can position p past end, causing all subsequent _safe checks to pass against a bogus boundary. 3. len = ceph_decode_32(p) has no preceding bounds check, and the immediately following *p += len is uncapped. A malicious OSD can send len=0xffffffff, advancing p gigabytes past end and escaping the decode window entirely. Fix all three by replacing bare operations with their safe variants: ceph_decode_copy -> ceph_decode_copy_safe *p += sizeof(...) -> ceph_decode_skip_n ceph_decode_32(p) -> ceph_decode_32_safe *p += len -> ceph_decode_skip_n A new label is added to return -EINVAL on any bounds violation. -EINVAL is appropriate here: the data received from the OSD is structurally malformed, which is an invalid argument to the decode contract regardless of whether the caller or the wire is at fault. Attacker model: a malicious or compromised OSD in a multi-tenant Ceph deployment can trigger this against any kernel client that issues the lock.get_info class method (e.g. during RBD exclusive lock acquisition) without any further privileges beyond OSD session establishment. [ idryomov: use ceph_decode_skip_string() to skip description, trim changelog ] Cc: stable(a)vger.kernel.org Fixes: d4ed4a530562 ("libceph: support for lock.lock_info") Signed-off-by: Pavitra Jha <jhapavitra98(a)gmail.com> Reviewed-by: Ilya Dryomov <idryomov(a)gmail.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Hulk Robot <hulkrobot(a)huawei.com> Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- net/ceph/cls_lock_client.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/net/ceph/cls_lock_client.c b/net/ceph/cls_lock_client.c index 639793597b76..a9655678be6f 100644 --- a/net/ceph/cls_lock_client.c +++ b/net/ceph/cls_lock_client.c @@ -257,34 +257,39 @@ static int decode_locker(void **p, void *end, struct ceph_locker *locker) ret = ceph_start_decoding(p, end, 1, "locker_id_t", &struct_v, &len); if (ret) return ret; - ceph_decode_copy(p, &locker->id.name, sizeof(locker->id.name)); + ceph_decode_copy_safe(p, end, &locker->id.name, + sizeof(locker->id.name), bad); s = ceph_extract_encoded_string(p, end, NULL, GFP_NOIO); if (IS_ERR(s)) return PTR_ERR(s); locker->id.cookie = s; ret = ceph_start_decoding(p, end, 1, "locker_info_t", &struct_v, &len); if (ret) return ret; - *p += sizeof(struct ceph_timespec); /* skip expiration */ + /* skip expiration */ + ceph_decode_skip_n(p, end, sizeof(struct ceph_timespec), bad); ret = ceph_decode_entity_addr(p, end, &locker->info.addr); if (ret) return ret; - len = ceph_decode_32(p); - *p += len; /* skip description */ + /* skip description */ + ceph_decode_skip_string(p, end, bad); dout("%s %s%llu cookie %s addr %s\n", __func__, ENTITY_NAME(locker->id.name), locker->id.cookie, ceph_pr_addr(&locker->info.addr)); return 0; + +bad: + return -EINVAL; } static int decode_lockers(void **p, void *end, u8 *type, char **tag, struct ceph_locker **lockers, u32 *num_lockers) { -- 2.43.0

2 1

[PATCH OLK-5.10] vdpa_sim: make IOTLB entries limit configurable
by Lin Ruifeng 08 Sep '26

08 Sep '26

From: Stefano Garzarella <sgarzare(a)redhat.com> mainline inclusion from mainline-5.11-rc1 commit 2fc0ebfa039025d88009e8f275ea8bcd177a9cd9 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18250 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm… -------------------------------- Some devices may require a higher limit for the number of IOTLB entries, so let's make it configurable through a module parameter. By default, it's initialized with the current limit (2048). Suggested-by: Jason Wang <jasowang(a)redhat.com> Signed-off-by: Stefano Garzarella <sgarzare(a)redhat.com> Link: https://lore.kernel.org/r/20201215144256.155342-5-sgarzare@redhat.com Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Conflicts: drivers/vdpa/vdpa_sim/vdpa_sim.c [Context Conflicts] Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/vdpa/vdpa_sim/vdpa_sim.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/vdpa/vdpa_sim/vdpa_sim.c b/drivers/vdpa/vdpa_sim/vdpa_sim.c index be925462922d..b7d93e906aa2 100644 --- a/drivers/vdpa/vdpa_sim/vdpa_sim.c +++ b/drivers/vdpa/vdpa_sim/vdpa_sim.c @@ -36,6 +36,11 @@ static int batch_mapping = 1; module_param(batch_mapping, int, 0444); MODULE_PARM_DESC(batch_mapping, "Batched mapping 1 -Enable; 0 - Disable"); +static int max_iotlb_entries = 2048; +module_param(max_iotlb_entries, int, 0444); +MODULE_PARM_DESC(max_iotlb_entries, + "Maximum number of iotlb entries. 0 means unlimited. (default: 2048)"); + #define VDPASIM_QUEUE_ALIGN PAGE_SIZE #define VDPASIM_QUEUE_MAX 256 #define VDPASIM_VENDOR_ID 0 @@ -262,7 +267,7 @@ struct vdpasim *vdpasim_create(struct vdpasim_dev_attr *dev_attr) if (!vdpasim->vqs) goto err_iommu; - vdpasim->iommu = vhost_iotlb_alloc(2048, 0); + vdpasim->iommu = vhost_iotlb_alloc(max_iotlb_entries, 0); if (!vdpasim->iommu) goto err_iommu; -- 2.34.1

2 1

[PATCH OLK-6.6 0/4] Fix CVE-2026-68096
by Yi Yang 08 Sep '26

08 Sep '26

The following four patches are used to fix the CVE-2026-68096 vulnerability: Jeff Layton (1): audit: widen ino fields to u64 NeilBrown (1): VFS/audit: introduce kern_path_parent() for audit Ricardo Robaina (2): audit: use 'unsigned int' instead of 'unsigned' audit: fix recursive locking deadlock in audit_dupe_exe() fs/namei.c | 43 ++++++++++++++++++++++++++++++++++++++ include/linux/audit.h | 6 +++--- include/linux/audit_arch.h | 12 +++++------ include/linux/namei.h | 1 + kernel/audit.c | 2 +- kernel/audit.h | 32 ++++++++++++++++------------ kernel/audit_fsnotify.c | 39 +++++++++++++++++++++------------- kernel/audit_tree.c | 2 +- kernel/audit_watch.c | 42 ++++++++++++++++++++++++------------- kernel/auditfilter.c | 17 ++++++++------- kernel/auditsc.c | 6 +++--- lib/compat_audit.c | 12 +++++------ 12 files changed, 144 insertions(+), 70 deletions(-) -- 2.25.1

2 5

[PATCH OLK-5.10] wifi: cfg80211: use wiphy work for socket owner autodisconnect
by Jinjiang Tu 08 Sep '26

08 Sep '26

mainline inclusion from mainline-v7.2-rc4 commit 0c2ed186bbe14304415476d6707b747dddcd8583 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17056 CVE: CVE-2026-68404 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- nl80211_netlink_notify() walks the cfg80211 wireless device list when a NETLINK_GENERIC socket is released. If the socket owns a connection, the notifier queues the embedded wdev->disconnect_wk work item. That work is a plain work_struct today. NETDEV_GOING_DOWN cancels it, but a NETLINK_URELEASE notifier that already observed conn_owner_nlportid can queue it after that cancel returns. _cfg80211_unregister_wdev() then removes the wdev from the list and waits for RCU readers, but synchronize_net() does not drain work queued by such a reader. Make the autodisconnect work a wiphy_work instead. The callback already needs the wiphy mutex, and wiphy_work runs under that mutex. This lets teardown cancel pending autodisconnect work while holding the mutex, without a cancel_work_sync() vs. worker locking concern. Also cancel the wiphy work after list_del_rcu() and synchronize_net(). Any NETLINK_URELEASE notifier that had already reached the wdev list has then either queued the work and it is removed, or can no longer find the wdev. Fixes: bd2522b16884 ("cfg80211: NL80211_ATTR_SOCKET_OWNER support for CMD_CONNECT") Suggested-by: Johannes Berg <johannes(a)sipsolutions.net> Assisted-by: Codex:gpt-5.5 Signed-off-by: Cen Zhang <zzzccc427(a)gmail.com> Link: https://patch.msgid.link/20260706152418.779226-1-zzzccc427@gmail.com Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Conflicts: net/wireless/core.c include/net/cfg80211.h net/wireless/core.h net/wireless/nl80211.c net/wireless/sme.c [Upstream commit 0c2ed186bbe14 ("wifi: cfg80211: use wiphy work for socket owner autodisconnect") converts wdev->disconnect_wk from plain work_struct to wiphy_work and relies on wiphy_lock/guard(wiphy) which were introduced in 6.x. OLK-5.10 (5.10 base) does not carry the wiphy_work framework, so this backport keeps disconnect_wk as plain work_struct and applies the equivalent fix in two places: 1. In __cfg80211_unregister_wdev(): keep the existing cancel/flush position (after list_del_rcu() + synchronize_rcu()) but switch flush_work() to cancel_work_sync(). The position must be after synchronize_rcu(): a NETLINK_URELEASE notifier that entered the RCU reader before list_del_rcu will schedule_work(disconnect_wk) before its reader exits, and only a post-synchronize_rcu cancel catches that work. cancel_work_sync also dequeues pending work that flush_work would have executed needlessly. This matches the upstream semantic "cancel after list_del_rcu and synchronize_net". 2. In NETDEV_GOING_DOWN: cancel_work_sync(&wdev->disconnect_wk) after cfg80211_leave() to drop any disconnect_wk queued by a URELEASE notifier before teardown. olk5.10 was missing this cancel entirely. The upstream commit message mentions that wiphy_work is chosen to avoid "a cancel_work_sync() vs. worker locking concern". That concern is specific to the 6.x lock structure where disconnect_wk's work function takes wiphy_lock and teardown holds wiphy_lock while calling cancel_work_sync (the deadlock pattern described in commit 2b0eab425e1f "wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock"). olk5.10's lock structure is different: cfg80211_autodisconnect_wk only takes wdev->mtx (wdev_lock), and the two cancel_work_sync() call sites added here hold RTNL but not wdev->mtx. There is no lock L that both cancel_work_sync() and the work function need, so the deadlock condition does not apply. ] Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- net/wireless/core.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/net/wireless/core.c b/net/wireless/core.c index c6c5dd4e3520..1a36b52ed744 100644 --- a/net/wireless/core.c +++ b/net/wireless/core.c @@ -1132,9 +1132,8 @@ static void __cfg80211_unregister_wdev(struct wireless_dev *wdev, bool sync) kfree_sensitive(wdev->wext.keys); wdev->wext.keys = NULL; #endif - /* only initialized if we have a netdev */ if (wdev->netdev) - flush_work(&wdev->disconnect_wk); + cancel_work_sync(&wdev->disconnect_wk); cfg80211_cqm_config_free(wdev); } @@ -1340,6 +1339,8 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb, break; case NETDEV_GOING_DOWN: cfg80211_leave(rdev, wdev); + if (wdev->netdev) + cancel_work_sync(&wdev->disconnect_wk); break; case NETDEV_DOWN: cfg80211_update_iface_num(rdev, wdev->iftype, -1); -- 2.43.0

2 1

[PATCH OLK-5.10] sctp: validate stream count in sctp_process_strreset_inreq()
by Jinjiang Tu 08 Sep '26

08 Sep '26

From: "Cen Zhang (Microsoft)" <blbllhy(a)gmail.com> stable inclusion from stable-v5.10.265 commit 61327d8e7cfb0259d527be17202630f556213249 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17149 CVE: CVE-2026-68315 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 18ae07691d43183d270de8be9dc8e027906015d9 ] When processing a RESET_IN_REQUEST from a peer, sctp_process_strreset_inreq() derives the stream count from the parameter length but does not check whether the resulting RESET_OUT_REQUEST would exceed SCTP_MAX_CHUNK_LEN. The OUT request header (sctp_strreset_outreq, 16 bytes) is 8 bytes larger than the IN request header (sctp_strreset_inreq, 8 bytes). Generally, the IP payload is bounded to 65535 bytes, so the stream list cannot be large enough to trigger the overflow. However, on interfaces with MTU > 65535 (e.g., loopback with IPv6 jumbograms), a stream list that fits within the incoming IN parameter can cause a __u16 overflow in sctp_make_strreset_req() when computing the OUT request size, leading to an undersized skb allocation and a kernel BUG: net/core/skbuff.c:207 skb_panic net/core/skbuff.c:2625 skb_put net/sctp/sm_make_chunk.c:1535 sctp_addto_chunk net/sctp/sm_make_chunk.c:3695 sctp_make_strreset_req net/sctp/stream.c:655 sctp_process_strreset_inreq The local setsockopt path validates the generated reset request size. However, for an incoming-only reset, it accounts for the smaller IN request even though the peer must generate an OUT request with the same stream list. Such a request cannot be completed successfully by the peer. Reject peer IN requests whose corresponding OUT request would exceed SCTP_MAX_CHUNK_LEN. Also tighten the local check so it does not send an IN request that would require an oversized OUT request from the peer. Fixes: 7f9d68ac944e ("sctp: implement sender-side procedures for SSN Reset Request Parameter") Reported-by: AutonomousCodeSecurity(a)microsoft.com Closes: https://lore.kernel.org/all/20260707203215.2752-1-blbllhy@gmail.com/ Suggested-by: Xin Long <lucien.xin(a)gmail.com> Signed-off-by: Cen Zhang (Microsoft) <blbllhy(a)gmail.com> Acked-by: Xin Long <lucien.xin(a)gmail.com> Link: https://patch.msgid.link/20260710010718.20318-1-blbllhy@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- net/sctp/stream.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/net/sctp/stream.c b/net/sctp/stream.c index ee6514af830f..73c212ae69d8 100644 --- a/net/sctp/stream.c +++ b/net/sctp/stream.c @@ -308,7 +308,8 @@ int sctp_send_reset_streams(struct sctp_association *asoc, goto out; param_len += str_nums * sizeof(__u16) + - sizeof(struct sctp_strreset_inreq); + (out ? sizeof(struct sctp_strreset_inreq) + : sizeof(struct sctp_strreset_outreq)); } if (param_len > SCTP_MAX_CHUNK_LEN - @@ -639,6 +640,9 @@ struct sctp_chunk *sctp_process_strreset_inreq( nums = (ntohs(param.p->length) - sizeof(*inreq)) / sizeof(__u16); str_p = inreq->list_of_streams; + if (nums * sizeof(__u16) + sizeof(struct sctp_strreset_outreq) > + SCTP_MAX_CHUNK_LEN - sizeof(struct sctp_reconf_chunk)) + goto out; for (i = 0; i < nums; i++) { if (ntohs(str_p[i]) >= stream->outcnt) { result = SCTP_STRRESET_ERR_WRONG_SSN; -- 2.43.0

2 1

[PATCH OLK-5.10] sctp: validate cookie AUTH state before use
by Jinjiang Tu 08 Sep '26

08 Sep '26

From: Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> mainline inclusion from mainline-v7.2 commit 3dbb44d88b1e94dd31fe43588af7437b34b44d56 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18398 CVE: CVE-2026-74752 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- When cookie authentication is disabled, COOKIE_ECHO restores fixed-size AUTH fields directly from peer-controlled cookie bytes. A forged RANDOM length, HMAC list, or CHUNKS list can then reach association consumers with lengths or identifiers that were never validated against the local backing arrays. A forged RANDOM length can cause out-of-bounds reads during key-vector construction. A forged HMAC identifier also caused a 32-byte write past a zero-length AUTH chunk, providing a primitive for a local privilege escalation chain. Validate the cookie's RANDOM, HMACS, and CHUNKS parameters at the cookie trust boundary before copying them into the association. Reject invalid types, malformed lengths, unsupported HMAC identifiers, HMAC lists without SHA1, and forbidden chunk ids. Fixes: bbd0d59809f9 ("[SCTP]: Implement the receive and verification of AUTH chunk") Fixes: 1f485649f529 ("[SCTP]: Implement SCTP-AUTH internals") Signed-off-by: Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> Acked-by: Xin Long <lucien.xin(a)gmail.com> Link: https://patch.msgid.link/20260804200042.2412009-1-Jeremy.Jean@oss.cyber.gou… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: include/net/sctp/auth.h net/sctp/auth.c [Backport of upstream 3dbb44d88b1e adding sctp_auth_verify_cookie_params() to validate the cookie's RANDOM/HMACS/CHUNKS parameters before they are restored into an association. Two helpers used by the new function are provided by later mainline refactors absent on this tree and are replaced with in-tree equivalents: - sctp_sk(ep->base.sk)->cookie_auth_enable (from 2f3dd6ec901f2, which replaces sp->hmac with a bool) becomes sctp_sk(ep->base.sk)->hmac, whose non-NULL value keeps the same "cookie HMAC auth enabled" meaning already used by sctp_pack_cookie()/sctp_unpack_cookie(); - sctp_hmac_supported(hmac_id) (from bf40785fa437c) becomes the equivalent "hmac_id >= SCTP_AUTH_NUM_HMACS || !sctp_hmac_list[hmac_id].hmac_name" check matching auth.c style. In auth.h the new declaration and the struct sctp_cookie forward declaration are added while the downstream crypto_shash, init_hmacs, destroy_hmacs declarations and the non-const sctp_auth_get_hmac()/ sctp_auth_asoc_get_hmac() signatures (predating the const qualifiers of the upstream refactors) are preserved. The full validation logic is retained and is semantically equivalent to upstream.] Signed-off-by: Hulk Robot <hulkrobot(a)huawei.com> Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- include/net/sctp/auth.h | 3 ++ net/sctp/auth.c | 76 ++++++++++++++++++++++++++++++++++++++++ net/sctp/sm_make_chunk.c | 3 ++ 3 files changed, 82 insertions(+) diff --git a/include/net/sctp/auth.h b/include/net/sctp/auth.h index d4b3b2dcd15b..c2399fb17889 100644 --- a/include/net/sctp/auth.h +++ b/include/net/sctp/auth.h @@ -23,6 +23,7 @@ struct sctp_association; struct sctp_authkey; struct sctp_hmacalgo; struct crypto_shash; +struct sctp_cookie; /* * Define a generic struct that will hold all the info @@ -77,6 +78,8 @@ struct sctp_shared_key *sctp_auth_get_shkey( int sctp_auth_asoc_copy_shkeys(const struct sctp_endpoint *ep, struct sctp_association *asoc, gfp_t gfp); +bool sctp_auth_verify_cookie_params(const struct sctp_endpoint *ep, + const struct sctp_cookie *cookie); int sctp_auth_init_hmacs(struct sctp_endpoint *ep, gfp_t gfp); void sctp_auth_destroy_hmacs(struct crypto_shash *auth_hmacs[]); struct sctp_hmac *sctp_auth_get_hmac(__u16 hmac_id); diff --git a/net/sctp/auth.c b/net/sctp/auth.c index 34964145514e..e317a2df046d 100644 --- a/net/sctp/auth.c +++ b/net/sctp/auth.c @@ -376,6 +376,82 @@ int sctp_auth_asoc_copy_shkeys(const struct sctp_endpoint *ep, return -ENOMEM; } +static bool sctp_auth_chunk_id_forbidden(__u8 chunk_id) +{ + switch (chunk_id) { + case SCTP_CID_INIT: + case SCTP_CID_INIT_ACK: + case SCTP_CID_SHUTDOWN_COMPLETE: + case SCTP_CID_AUTH: + return true; + default: + return false; + } +} + +/* Verify AUTH parameters copied from a state cookie before they are restored + * into an association. When cookie authentication is disabled these fields + * are peer-controlled, so they must satisfy the same constraints as locally + * generated AUTH parameters. + */ +bool sctp_auth_verify_cookie_params(const struct sctp_endpoint *ep, + const struct sctp_cookie *cookie) +{ + const struct sctp_paramhdr *random; + const struct sctp_hmac_algo_param *hmacs; + const struct sctp_chunks_param *chunks; + u16 hmacs_len, chunks_len; + u16 n_hmacs, n_chunks, i; + bool has_sha1 = false; + + if (sctp_sk(ep->base.sk)->hmac || !ep->auth_enable) + return true; + + random = (const struct sctp_paramhdr *)cookie->auth_random; + if (random->type != SCTP_PARAM_RANDOM || + ntohs(random->length) != sizeof(*random) + SCTP_AUTH_RANDOM_LENGTH) + return false; + + hmacs = (const struct sctp_hmac_algo_param *)cookie->auth_hmacs; + hmacs_len = ntohs(hmacs->param_hdr.length); + if (hmacs->param_hdr.type != SCTP_PARAM_HMAC_ALGO || + hmacs_len < sizeof(struct sctp_paramhdr) + + sizeof(hmacs->hmac_ids[0]) || + hmacs_len > sizeof(cookie->auth_hmacs) || + (hmacs_len - sizeof(struct sctp_paramhdr)) % + sizeof(hmacs->hmac_ids[0])) + return false; + + n_hmacs = (hmacs_len - sizeof(struct sctp_paramhdr)) / + sizeof(hmacs->hmac_ids[0]); + for (i = 0; i < n_hmacs; i++) { + u16 hmac_id = ntohs(hmacs->hmac_ids[i]); + + if (hmac_id >= SCTP_AUTH_NUM_HMACS || + !sctp_hmac_list[hmac_id].hmac_name) + return false; + if (hmac_id == SCTP_AUTH_HMAC_ID_SHA1) + has_sha1 = true; + } + if (!has_sha1) + return false; + + chunks = (const struct sctp_chunks_param *)cookie->auth_chunks; + chunks_len = ntohs(chunks->param_hdr.length); + if (chunks->param_hdr.type != SCTP_PARAM_CHUNKS || + chunks_len < sizeof(struct sctp_paramhdr) || + chunks_len > sizeof(cookie->auth_chunks)) + return false; + + n_chunks = chunks_len - sizeof(struct sctp_paramhdr); + for (i = 0; i < n_chunks; i++) { + if (sctp_auth_chunk_id_forbidden(chunks->chunks[i])) + return false; + } + + return true; +} + /* Public interface to create the association shared key. * See code above for the algorithm. diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c index 9ee24c361416..07b2a0c97f4a 100644 --- a/net/sctp/sm_make_chunk.c +++ b/net/sctp/sm_make_chunk.c @@ -1828,6 +1828,9 @@ struct sctp_association *sctp_unpack_cookie( /* Set up our peer's port number. */ retval->peer.port = ntohs(chunk->sctp_hdr->source); + if (!sctp_auth_verify_cookie_params(ep, bear_cookie)) + goto malformed; + /* Populate the association from the cookie. */ memcpy(&retval->c, bear_cookie, sizeof(*bear_cookie)); -- 2.43.0

2 1

[PATCH OLK-5.10] sctp: validate Adaptation Indication parameter length
by Jinjiang Tu 08 Sep '26

08 Sep '26

From: Charles Vosburgh <trilobyte777(a)gmail.com> stable inclusion from stable-v5.10.265 commit fa7861ddbe3b525b5d541c15c3953d3569e6eb0e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18468 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 74b21f52c5c5a71a05c0ff70e513f4f04ff28b17 upstream. The Adaptation Layer Indication parameter contains a fixed 32-bit Adaptation Code Point after its parameter header. However, sctp_verify_param() accepts a header-only parameter because the generic parameter walker only requires the header to be present. sctp_process_param() then reads adaptation_ind beyond the declared parameter. When the malformed parameter is last in an INIT, the read starts at the receive skb tail, and the value is copied into the state cookie returned in the INIT ACK. This may disclose four receive-buffer tail bytes. Require the declared parameter length to match the fixed structure size and abort the association through the existing invalid parameter length path otherwise. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable(a)vger.kernel.org Signed-off-by: Charles Vosburgh <trilobyte777(a)gmail.com> Acked-by: Xin Long <lucien.xin(a)gmail.com> Link: https://patch.msgid.link/20260727-sctp-adaptation-length-v1-1-0ab58b2810a5@… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- net/sctp/sm_make_chunk.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c index 07b2a0c97f4a..b6f88f59bc7e 100644 --- a/net/sctp/sm_make_chunk.c +++ b/net/sctp/sm_make_chunk.c @@ -2150,7 +2150,13 @@ static enum sctp_ierror sctp_verify_param(struct net *net, case SCTP_PARAM_HEARTBEAT_INFO: case SCTP_PARAM_UNRECOGNIZED_PARAMETERS: case SCTP_PARAM_ECN_CAPABLE: + break; case SCTP_PARAM_ADAPTATION_LAYER_IND: + if (ntohs(param.p->length) != sizeof(*param.aind)) { + sctp_process_inv_paramlength(asoc, param.p, + chunk, err_chunk); + retval = SCTP_IERROR_ABORT; + } break; case SCTP_PARAM_SUPPORTED_EXT: -- 2.43.0

2 1

[PATCH OLK-6.6] mm/huge_memory: fix huge_zero_pfn race
by Zhang Qilong 08 Sep '26

08 Sep '26

From: "Lorenzo Stoakes (ARM)" <ljs(a)kernel.org> stable inclusion from stable-v6.6.153 commit f3a874a903053c53fb53ba287ea9eacda69c68e8 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18287 CVE: CVE-2026-74632 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 33192a26cddea7a7e4ca66e5c3eebd36fa8be2bb upstream. Patch series "mm/huge_memory: fix huge_zero_pfn race", v2. There is a subtle race in the reference-counted huge_zero_folio implementation. The fast path atomic logic fails to account for the fact that the shrinker (which drops the final huge_zero_refcount pin) can overwrite huge_zero_pfn with the ~0UL sentinel value in shrink_huge_zero_folio_scan() after a racing get_huge_zero_folio() installed a valid value there. This results in huge_zero_folio being correctly set but huge_zero_pfn being set incorrectly and thus is_huge_zero_pfn() and consequently is_huge_zero_pmd() will misidentify the huge zero folio as being an ordinary THP folio. This can result in the huge zero folio being split and otherwise treated incorrectly. The solution to this is very subtle as there is an atomic fast path, and thus ordering in weakly ordered architectures has to be treated very carefully. The first commit fixes the issue by introducing a spinlock around huge_zero_[pfn, folio, refcount] write, with careful consideration paid to load/store ordering in the fast path. It is placed first and kept as small as possible so that it can be backported on its own. The second commit is a pure cleanup which reworks the CONFIG_PERSISTENT_HUGE_ZERO_FOLIO logic to better separate the persistent logic from the dynamically allocated one. This patch (of 2): If !CONFIG_PERSISTENT_HUGE_ZERO_FOLIO, the huge_zero_folio is refcounted by huge_zero_refcount and returned by mm_get_huge_zero_folio(). When the caller is done with the huge zero page, its reference count is decremented. Only a shrinker can set the reference count to zero. A race can unfortunately occur between a shrinker decrementing the reference count to zero and a concurrent page fault. This is because shrink_huge_zero_folio_scan() might, if very unlucky, be preempted between setting huge_zero_refcount to zero and writing an invalid value. During this time get_huge_zero_folio() could write to huge_zero_pfn before shrink_huge_zero_folio_scan() resumes. In this event the huge zero folio will be persistently misidentified causing the THP code path to be entered inappropriately for the huge zero folio: CPU 0 CPU 1 =======================================|================================= shrink_huge_zero_folio_scan() | atomic_cmpxchg() sets refcount to 0 | xchg() sets huge_zero_folio to NULL | get_huge_zero_folio() | | atomic_inc_not_zero() -> zero preempted for a long time | Allocate new huge zero folio | | Write valid huge_zero_folio v | Write valid huge_zero_pfn Overwrite huge_zero_pfn with ~0UL <--- Invalid overwrite! This results in is_huge_zero_pfn() and is_huge_zero_pmd() incorrectly returning false for a huge zero page which could result in issues like the huge zero folio being incorrectly split. Note that the issue is with huge_zero_pfn not huge_zero_folio, as get_huge_zero_folio() uses cmpxchg() gated on huge_zero_folio being NULL with a retry loop and shrink_huge_zero_folio_scan() uses xchg() to set huge_zero_folio. Fix the issue by introducing a spinlock, huge_zero_lock, to prevent concurrent write of huge_zero_folio, huge_zero_pfn and huge_zero_refcount. There needs to be significant care taken here to ensure correctness: The fast path in get_huge_zero_folio() uses atomic_inc_not_zero(), which is outside of the critical section, and means huge zero allocation is gated on zero huge_zero_refcount. The fast path doesn't use huge_zero_lock, so the critical section is irrelevant to it. So invariants are required - huge_zero_refcount MUST: * Only be set in the huge_zero_lock critical section to ensure serialisation of huge_zero_pfn, huge_zero_folio and huge_zero_refcount writes. * Be set non-zero only AFTER huge_zero_[pfn, folio] are set to valid values so installation of the huge zero folio on read page fault ensures concurrent is_huge_zero_*() calls correctly identify the huge zero folio. * Be set zero only BEFORE huge_zero_[pfn, folio] are set to NULL and ~0UL respectively, and atomically. Establish these by: * Only setting huge_zero_refcount to zero or an absolute value in the huge_zero_lock critical section in get_huge_zero_folio() and shrink_huge_zero_folio_scan(), and always updating atomically there and elsewhere. * Using atomic_set_release(&huge_zero_refcount) in get_huge_zero_folio() after huge_zero_[pfn, folio] are set. This is paired with atomic_inc_not_zero() to ensure atomic_inc_not_zero() only observes a non-zero value if huge_zero_[pfn, folio] are set. * Using atomic_cmpxchg() in shrink_huge_zero_folio_scan() (as before) to ensure that it is set zero only when equal to 1 and set atomically. * atomic_cmpxchg() being fully ordered ensures this is done prior to huge_zero_[folio, pfn] being set to NULL and ~0UL respectively. Eliminate the retry loop in get_huge_zero_folio() as the atomic_cmpxchg() in shrink_huge_zero_folio_scan() is now performed under the lock, and replace with an equally locked atomic_inc() to set the reference count should the caller be raced on huge zero folio installation. folio_put() naturally implies a full memory barrier so its ordering is maintained correctly. The huge zero folio also cannot be released except when the shrinker does so as it is non-LRU and non-rmappable. Note that only the huge zero shrinker (via shrink_huge_zero_folio_scan()) can actually set huge_zero_refcount to zero, which is the count of mm's which have at least one huge zero folio installed plus one shrinker pin. Additionally convert a BUG_ON() to a VM_WARN_ON_ONCE(). Link: https://lore.kernel.org/20260730-fix-refcounted-huge-zero-v2-0-c5d8a41b317f… Link: https://lore.kernel.org/20260730-fix-refcounted-huge-zero-v2-1-c5d8a41b317f… Fixes: 3b77e8c8cde5 ("mm/thp: make is_huge_zero_pmd() safe and quicker") Signed-off-by: Lorenzo Stoakes (ARM) <ljs(a)kernel.org> Reported-by: Hengbin Zhang <uqbarz(a)gmail.com> Closes: https://lore.kernel.org/linux-mm/20260727154001.4102341-1-uqbarz@gmail.com/ Suggested-by: David Hildenbrand (Arm) <david(a)kernel.org> Acked-by: David Hildenbrand (Arm) <david(a)kernel.org> Cc: Baolin Wang <baolin.wang(a)linux.alibaba.com> Cc: Barry Song <baohua(a)kernel.org> Cc: Dev Jain <dev.jain(a)arm.com> Cc: Hannes Reinecke <hare(a)suse.de> Cc: Hugh Dickins <hughd(a)google.com> Cc: Kiryl Shutsemau <kas(a)kernel.org> Cc: Lance Yang <lance.yang(a)linux.dev> Cc: Liam R. Howlett <liam(a)infradead.org> Cc: Nico Pache <npache(a)redhat.com> Cc: Pankaj Raghav <p.raghav(a)samsung.com> Cc: Ryan Roberts <ryan.roberts(a)arm.com> Cc: Yang Shi <shy828301(a)gmail.com> Cc: Zi Yan <ziy(a)nvidia.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> [ adapted folio API (`huge_zero_folio`, `folio_pfn`, `folio_put`) to pre-6.11 page naming (`huge_zero_page`, `page_to_pfn`, `__free_pages`) ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: mm/huge_memory.c [Just shrinker name conflicts] Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- mm/huge_memory.c | 43 +++++++++++++++++++++++++++++-------------- 1 file changed, 29 insertions(+), 14 deletions(-) diff --git a/mm/huge_memory.c b/mm/huge_memory.c index bb884be9b761..952abb6d00a7 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -38,10 +38,11 @@ #include <linux/numa.h> #include <linux/page_owner.h> #include <linux/sched/sysctl.h> #include <linux/memory-tiers.h> #include <linux/compat.h> +#include <linux/cleanup.h> #include <asm/tlb.h> #include <asm/pgalloc.h> #include "internal.h" #include "swap.h" @@ -75,10 +76,11 @@ static unsigned long deferred_split_count(struct shrinker_v2 *shrink, struct shrink_control *sc); static unsigned long deferred_split_scan(struct shrinker_v2 *shrink, struct shrink_control *sc); static atomic_t huge_zero_refcount; +static DEFINE_SPINLOCK(huge_zero_lock); struct page *huge_zero_page __read_mostly; unsigned long huge_zero_pfn __read_mostly = ~0UL; unsigned long huge_anon_orders_always __read_mostly; unsigned long huge_anon_orders_madvise __read_mostly; unsigned long huge_anon_orders_inherit __read_mostly; @@ -196,31 +198,37 @@ unsigned long __thp_vma_allowable_orders(struct vm_area_struct *vma, } static bool get_huge_zero_page(void) { struct page *zero_page; -retry: + + /* Paired with atomic_set_release(). */ if (likely(atomic_inc_not_zero(&huge_zero_refcount))) return true; zero_page = alloc_pages((GFP_TRANSHUGE | __GFP_ZERO) & ~__GFP_MOVABLE, HPAGE_PMD_ORDER); if (!zero_page) { count_vm_event(THP_ZERO_PAGE_ALLOC_FAILED); return false; } - preempt_disable(); - if (cmpxchg(&huge_zero_page, NULL, zero_page)) { - preempt_enable(); + + /* Paired with critical section in shrink_huge_zero_page_scan(). */ + spin_lock(&huge_zero_lock); + if (huge_zero_page) { + /* Somebody else already installed it. */ + atomic_inc(&huge_zero_refcount); + spin_unlock(&huge_zero_lock); __free_pages(zero_page, compound_order(zero_page)); - goto retry; + return true; } + WRITE_ONCE(huge_zero_page, zero_page); WRITE_ONCE(huge_zero_pfn, page_to_pfn(zero_page)); + /* Paired with atomic_inc_not_zero(). +1 for shrinker pin. */ + atomic_set_release(&huge_zero_refcount, 2); + spin_unlock(&huge_zero_lock); - /* We take additional reference here. It will be put back by shrinker */ - atomic_set(&huge_zero_refcount, 2); - preempt_enable(); count_vm_event(THP_ZERO_PAGE_ALLOC); return true; } static void put_huge_zero_page(void) @@ -260,19 +268,26 @@ static unsigned long shrink_huge_zero_page_count(struct shrinker_v2 *shrink, } static unsigned long shrink_huge_zero_page_scan(struct shrinker_v2 *shrink, struct shrink_control *sc) { - if (atomic_cmpxchg(&huge_zero_refcount, 1, 0) == 1) { - struct page *zero_page = xchg(&huge_zero_page, NULL); - BUG_ON(zero_page == NULL); + struct page *zero_page; + + /* Paired with critical section in get_huge_zero_page(). */ + scoped_guard(spinlock, &huge_zero_lock) { + /* Paired with atomic_inc_not_zero() in get_huge_zero_page(). */ + if (atomic_cmpxchg(&huge_zero_refcount, 1, 0) != 1) + return 0; + + zero_page = huge_zero_page; + VM_WARN_ON_ONCE(!zero_page); + WRITE_ONCE(huge_zero_page, NULL); WRITE_ONCE(huge_zero_pfn, ~0UL); - __free_pages(zero_page, compound_order(zero_page)); - return HPAGE_PMD_NR; } - return 0; + __free_pages(zero_page, compound_order(zero_page)); + return HPAGE_PMD_NR; } static struct shrinker_v2 *huge_zero_page_shrinker; #ifdef CONFIG_SYSFS -- 2.43.0

2 1

[PATCH OLK-6.6] net: usb: ipheth: fix carrier_work UAF on disconnect
by Zhang Qilong 08 Sep '26

08 Sep '26

From: Doruk Tan Ozturk <doruk(a)0sec.ai> stable inclusion from stable-v6.12.104 commit d07133fe1befae9a1e4c4c5e46ef0b73d2992020 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18212 CVE: CVE-2026-74677 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit fde39b8a521780391fb4e5bda2c0aa4928947f12 upstream. ipheth_sndbulk_callback() re-arms the carrier-check work on any non-zero URB status: else schedule_delayed_work(&dev->carrier_work, 0); Nothing ties that to the interface being up, so the work can be armed again after ipheth_close() has already drained it, and stay armed until the netdev whose private area embeds it is freed. On unplug with a TX URB in flight, ipheth_disconnect() drains the work through unregister_netdev() -> ipheth_close() -> cancel_delayed_work_sync() and only then calls ipheth_kill_urbs(). usb_kill_urb() completes the in-flight TX URB with -ENOENT, so ipheth_sndbulk_callback() runs after the drain and re-arms carrier_work. The same completion also re-arms the work if the interface is only brought down while a TX URB is in flight, and ipheth_carrier_check_work() then keeps re-queueing itself once a second. unregister_netdev() does not call ipheth_close() for an already-down interface, so nothing drains it on the later unplug either. In both cases free_netdev() frees the netdev while carrier_work is still pending, and ipheth_carrier_check_work() dereferences freed memory. Tie the work to the interface state instead of chasing the completion: disable it in ipheth_close() and enable it in ipheth_open(), so a schedule_delayed_work() from the URB completion is a no-op whenever the interface is not up. disable_delayed_work_sync() also waits for a running instance, so it fully replaces the cancel_delayed_work_sync() it takes the place of. The work starts out disabled in ipheth_probe() so the enable/disable counts balance from the first open. Reproduced under KASAN on linux-next (next-20260731) with dummy_hcd and raw-gadget standing in for the device, driving the second path above (the interface is already down, so unregister_netdev() does not call ipheth_close()): 15 of 15 unpatched boots report a slab-use-after-free in __run_timers(), freed by ipheth_disconnect() and re-armed from ipheth_sndbulk_callback() via queue_delayed_work_on(). The same trigger on a kernel differing only by this patch reports 0 of 15, and the carrier check still functions across open/close cycles. The reproducer needs an attached USB device that stops draining bulk OUT, plus a link down and unplug, driven as root. It is not a privilege boundary crossing and no exploit primitive was developed. Found by 0sec (https://0sec.ai) Fixes: bb1b40c7cb86 ("usbnet: ipheth: prevent TX queue timeouts when device not ready") Cc: stable(a)vger.kernel.org Signed-off-by: Doruk Tan Ozturk <doruk(a)0sec.ai> Link: https://patch.msgid.link/20260802120602.42595-1-doruk@0sec.ai Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- drivers/net/usb/ipheth.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c index a19789b57190..a86d0a4dbd28 100644 --- a/drivers/net/usb/ipheth.c +++ b/drivers/net/usb/ipheth.c @@ -488,20 +488,25 @@ static int ipheth_open(struct net_device *net) retval = ipheth_rx_submit(dev, GFP_KERNEL); if (retval) return retval; + enable_delayed_work(&dev->carrier_work); schedule_delayed_work(&dev->carrier_work, IPHETH_CARRIER_CHECK_TIMEOUT); return retval; } static int ipheth_close(struct net_device *net) { struct ipheth_device *dev = netdev_priv(net); netif_stop_queue(net); - cancel_delayed_work_sync(&dev->carrier_work); + /* A TX URB can still complete with an error after this point and + * try to re-arm the carrier work. Disable it instead of cancelling + * it, so that such a schedule_delayed_work() is a no-op. + */ + disable_delayed_work_sync(&dev->carrier_work); return 0; } static netdev_tx_t ipheth_tx(struct sk_buff *skb, struct net_device *net) { @@ -631,10 +636,14 @@ static int ipheth_probe(struct usb_interface *intf, dev->rx_buf_len = IPHETH_RX_BUF_SIZE_NCM; dev->rcvbulk_callback = ipheth_rcvbulk_callback_ncm; } INIT_DELAYED_WORK(&dev->carrier_work, ipheth_carrier_check_work); + /* Armed only between ipheth_open() and ipheth_close(). Start out + * disabled so the enable/disable counts balance from the first open. + */ + disable_delayed_work(&dev->carrier_work); retval = ipheth_alloc_urbs(dev); if (retval) { dev_err(&intf->dev, "error allocating urbs: %d\n", retval); goto err_alloc_urbs; -- 2.43.0

2 1

[PATCH OLK-6.6] sctp: fix addr_wq_timer race in sctp_free_addr_wq()
by Zhang Qilong 08 Sep '26

08 Sep '26

From: Xin Long <lucien.xin(a)gmail.com> stable inclusion from stable-v6.18.40 commit a8323fb2ab6cd6978f359daeed6688e0cadf32ba category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17334 CVE: CVE-2026-72383 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 976c19de0f22a857ba0112f39635f8fd7a257568 ] sctp_free_addr_wq() previously removed addr_wq_timer using timer_delete() while holding addr_wq_lock. However, timer_delete() does not guarantee that a currently running timer handler has completed. This allows a race with sctp_addr_wq_timeout_handler(), where the handler may still run after addr_waitq has been freed, acquire addr_wq_lock, and access freed memory, leading to a use-after-free. Fix this by calling timer_shutdown_sync() before taking addr_wq_lock. This guarantees that any in-flight timer handler has finished and prevents the timer from being re-armed during teardown, making subsequent cleanup safe. Fixes: 4db67e808640 ("sctp: Make the address lists per network namespace") Reported-by: Sashiko <sashiko-bot(a)kernel.org> Signed-off-by: Xin Long <lucien.xin(a)gmail.com> Link: https://patch.msgid.link/5dc95f295bdb5c3f60e880dd9aa5112dc5c071cc.178275787… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: net/sctp/protocol.c [Just context conflicts] Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- net/sctp/protocol.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c index 0beb9a82c2a3..a862644a6caa 100644 --- a/net/sctp/protocol.c +++ b/net/sctp/protocol.c @@ -690,12 +690,13 @@ static void sctp_addr_wq_timeout_handler(struct timer_list *t) static void sctp_free_addr_wq(struct net *net) { struct sctp_sockaddr_entry *addrw; struct sctp_sockaddr_entry *temp; + timer_shutdown_sync(&net->sctp.addr_wq_timer); + spin_lock_bh(&net->sctp.addr_wq_lock); - del_timer(&net->sctp.addr_wq_timer); list_for_each_entry_safe(addrw, temp, &net->sctp.addr_waitq, list) { list_del(&addrw->list); kfree(addrw); } spin_unlock_bh(&net->sctp.addr_wq_lock); -- 2.43.0

2 1

[PATCH OLK-6.6 0/3] md/raid1,raid10: fix deadlock and bio accounting in read error path
by Zhou Minqiang 08 Sep '26

08 Sep '26

Splitting a bio while executing in the raid1 thread can lead to recursion, as task->bio_list is NULL in this context. In addition, resubmitting an md_cloned_bio after splitting may lead to a deadlock if the array is suspended before the md driver calls percpu_ref_tryget_live(&mddev->active_io) on it's path to pers->make_request(). Avoid splitting the bio in this context and require that it is either read in full or not at all. This prevents recursion and avoids potential deadlocks during array suspension. Zhou Minqiang (3): md/raid1,raid10: fix deadlock in read error recovery path md/raid1,raid10: fix error-path detection with md_cloned_bio() md/raid1,raid10: fix bio accounting for split md cloned bios drivers/md/md.c | 40 ++++++++++++++++++++++++---------------- drivers/md/md.h | 5 +++++ drivers/md/raid1.c | 15 +++++++++++---- drivers/md/raid10.c | 28 ++++++++++++++++++---------- 4 files changed, 58 insertions(+), 30 deletions(-) -- 2.52.0

2 4

[PATCH OLK-6.6] enic: fix tx_hang_reset use-after-free on device removal
by Jinjiang Tu 08 Sep '26

08 Sep '26

From: Satish Kharat <satishkh(a)cisco.com> stable inclusion from stable-v6.12.104 commit 8619865f34fb3b130b567855382a5c4aadd522b9 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18260 CVE: CVE-2026-74725 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ec680ea4ba1bca92a767fb7e7869758bfdd886e3 ] enic_remove() cancels the reset and change_mtu_work items but does not cancel tx_hang_reset. A TX timeout that fires while the device is being removed can schedule enic_tx_hang_reset() so that it runs after free_netdev(), resulting in a use-after-free. cancel_work_sync() alone is not sufficient here: the still-live watchdog and notify paths can re-schedule these work items in the window between the cancel and unregister_netdev(). Use disable_work_sync(), which cancels the work and blocks any subsequent schedule_work() from requeuing it, and apply it to the reset and change_mtu_work items as well so the same requeue race is closed for all teardown work. Fixes: 937317c7c109 ("enic: do hang reset only in case of tx timeout") Signed-off-by: Satish Kharat <satishkh(a)cisco.com> Link: https://patch.msgid.link/20260728062730.2394873-1-satishkh@cisco.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- drivers/net/ethernet/cisco/enic/enic_main.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c index 48701032c20c..11cf6709b7c4 100644 --- a/drivers/net/ethernet/cisco/enic/enic_main.c +++ b/drivers/net/ethernet/cisco/enic/enic_main.c @@ -3016,8 +3016,9 @@ static void enic_remove(struct pci_dev *pdev) if (netdev) { struct enic *enic = netdev_priv(netdev); - cancel_work_sync(&enic->reset); - cancel_work_sync(&enic->change_mtu_work); + disable_work_sync(&enic->reset); + disable_work_sync(&enic->tx_hang_reset); + disable_work_sync(&enic->change_mtu_work); unregister_netdev(netdev); enic_dev_deinit(enic); vnic_dev_close(enic->vdev); -- 2.43.0

2 1

[PATCH OLK-5.10] dm-ioctl: fix a possible overflow in list_version_get_info
by Zhou Minqiang 08 Sep '26

08 Sep '26

mainline inclusion from mainline-v7.2-rc3 commit 76c6f845dc0c614304a6e6ee619b552f97cf24b3 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17390 CVE: CVE-2026-72106 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- commit 76c6f845dc0c614304a6e6ee619b552f97cf24b3 upstream. sizeof(tt->version) is 12 bytes, but the code writes 16 bytes into the output buffer - info->vers->version[0], info->vers->version[1], info->vers->version[2] and info->vers->next. This can cause buffer overflow. Fix this buffer overflow by replacing "sizeof(tt->version)" with "sizeof(struct dm_target_versions)". Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Assisted-by: Claude:claude-opus-4.6 Cc: stable(a)vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/md/dm-ioctl.c [ctx conflicts] Signed-off-by: Zhou Minqiang <zhouminqiang2(a)huawei.com> --- drivers/md/dm-ioctl.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c index 3bb9c0dced6e..2665e893cf22 100644 --- a/drivers/md/dm-ioctl.c +++ b/drivers/md/dm-ioctl.c @@ -585,9 +585,7 @@ static void list_version_get_info(struct target_type *tt, void *param) struct vers_iter *info = param; /* Check space - it might have changed since the first iteration */ - if ((char *)info->vers + sizeof(tt->version) + strlen(tt->name) + 1 > - info->end) { - + if ((char *)info->vers + sizeof(struct dm_target_versions) + strlen(tt->name) + 1 > info->end) { info->flags = DM_BUFFER_FULL_FLAG; return; } -- 2.52.0

2 1

[PATCH OLK-5.10 0/3] CVE-2026-74730
by Zhou Minqiang 08 Sep '26

08 Sep '26

CVE-2026-74730 Zhou Minqiang (3): nfs4: take a reference on the nfs_client when running FREE_STATEID NFS: Pin the 'struct nfs_server' during a FREE_STATEID call NFS: Decrement refcounts if allocating nfs_free_stateid_data fails fs/nfs/nfs4proc.c | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) -- 2.52.0

2 4

[PATCH openEuler-1.0-LTS 0/3] CVE-2026-74730
by Zhou Minqiang 08 Sep '26

08 Sep '26

CVE-2026-74730 Zhou Minqiang (3): nfs4: take a reference on the nfs_client when running FREE_STATEID NFS: Pin the 'struct nfs_server' during a FREE_STATEID call NFS: Decrement refcounts if allocating nfs_free_stateid_data fails fs/nfs/nfs4proc.c | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) -- 2.52.0

2 4

[PATCH OLK-6.6 0/3] md/raid1,raid10: fix deadlock and bio accounting in read error path
by Zhou Minqiang 08 Sep '26

08 Sep '26

Splitting a bio while executing in the raid1 thread can lead to recursion, as task->bio_list is NULL in this context. In addition, resubmitting an md_cloned_bio after splitting may lead to a deadlock if the array is suspended before the md driver calls percpu_ref_tryget_live(&mddev->active_io) on it's path to pers->make_request(). Avoid splitting the bio in this context and require that it is either read in full or not at all. This prevents recursion and avoids potential deadlocks during array suspension. Zhou Minqiang (3): md/raid1,raid10: fix deadlock in read error recovery path md/raid1,raid10: fix error-path detection with md_cloned_bio() md/raid1,raid10: fix bio accounting for split md cloned bios drivers/md/md.c | 40 ++++++++++++++++++++++++---------------- drivers/md/md.h | 5 +++++ drivers/md/raid1.c | 15 +++++++++++---- drivers/md/raid10.c | 28 ++++++++++++++++++---------- 4 files changed, 58 insertions(+), 30 deletions(-) -- 2.52.0

2 4

[PATCH OLK-6.6] bpf: Fix NMI/tracepoint re-entry deadlock on lru locks
by Chen Yuxi 08 Sep '26

08 Sep '26

From: Mykyta Yatsenko <yatsenko(a)meta.com> mainline inclusion from mainline-v7.2-rc1 commit 89edbdfc5d0308cef57b71359331de5c4ddbf763 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17962 CVE: CVE-2026-74337 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- NMI and tracepoint BPF programs can re-enter the per-CPU or global LRU lock that bpf_lru_pop_free()/push_free() already hold on the same CPU, AA-deadlocking. Lockdep reports "inconsistent {INITIAL USE} -> {IN-NMI}" on &l->lock (syzbot c69a0a2c816716f1e0d5) and "possible recursive locking detected" on &loc_l->lock (syzbot 18b26edb69b2e19f3b33). Prior trylock and rqspinlock based fixes (see links) were nacked because compromised on reliability. This patch converts every LRU lock site to rqspinlock_t and adds a recovery path for some failure windows to avoid node leaks. Failure recovery: - *_pop_free top-level: return NULL; prealloc_lru_pop() already treats that as no-free-element (-ENOMEM). - Cross-CPU steal: skip the victim's locked loc_l, try next CPU. - Post-steal local lock fail: publish stolen node to lockless per-CPU free_llist; next pop on this CPU picks it up. - push_free fail: mark node pending_free=1. __local_list_flush(), __local_list_pop_pending() reclaim the node from pending_list. __bpf_lru_list_shrink_inactive() reclaims the node from inactive list. Nodes from active list are reclaimed by __bpf_lru_list_shrink() or after __bpf_lru_list_rotate_active() demotes it to the inactive. Fixes: 3a08c2fd7634 ("bpf: LRU List") Reported-by: syzbot+c69a0a2c816716f1e0d5(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=c69a0a2c816716f1e0d5 Reported-by: syzbot+18b26edb69b2e19f3b33(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=18b26edb69b2e19f3b33 Link: https://lore.kernel.org/bpf/CAPPBnEYO4R+m+SpVc2gNj_x31R6fo1uJvj2bK2YS1P09GW… Link: https://lore.kernel.org/bpf/CAPPBnEZmFA3ab8Uc=PEm0bdojZy=7T_F5_+eyZSHyZR3MB… Link: https://lore.kernel.org/bpf/20251030030010.95352-1-dongml2@chinatelecom.cn/ Link: https://lore.kernel.org/bpf/20260119142120.28170-1-leon.hwang@linux.dev/ Signed-off-by: Mykyta Yatsenko <yatsenko(a)meta.com> Link: https://lore.kernel.org/r/20260607-lru_map_spin-v3-1-bcd9332e911b@meta.com Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Conflicts: kernel/bpf/bpf_lru_list.c, kernel/bpf/bpf_lru_list.h [Since hulk-6.6 does not include rqspinlock, this patch does not use the method from mainline, and instead adopts the re-entry rejection form.] Signed-off-by: Chen Yuxi <chenyuxi19(a)huawei.com> --- kernel/bpf/bpf_lru_list.c | 268 +++++++++++++++++++++++++++----------- kernel/bpf/bpf_lru_list.h | 33 ++++- 2 files changed, 223 insertions(+), 78 deletions(-) diff --git a/kernel/bpf/bpf_lru_list.c b/kernel/bpf/bpf_lru_list.c index 2d6e1c98d8ad..aac697d1d593 100644 --- a/kernel/bpf/bpf_lru_list.c +++ b/kernel/bpf/bpf_lru_list.c @@ -4,6 +4,7 @@ #include <linux/cpumask.h> #include <linux/spinlock.h> #include <linux/percpu.h> +#include <linux/llist.h> #include "bpf_lru_list.h" @@ -13,29 +14,75 @@ #define PERCPU_FREE_TARGET (4) #define PERCPU_NR_SCANS PERCPU_FREE_TARGET -/* Helpers to get the local list index */ -#define LOCAL_LIST_IDX(t) ((t) - BPF_LOCAL_LIST_T_OFFSET) -#define LOCAL_FREE_LIST_IDX LOCAL_LIST_IDX(BPF_LRU_LOCAL_LIST_T_FREE) -#define LOCAL_PENDING_LIST_IDX LOCAL_LIST_IDX(BPF_LRU_LOCAL_LIST_T_PENDING) #define IS_LOCAL_LIST_TYPE(t) ((t) >= BPF_LOCAL_LIST_T_OFFSET) -static int get_next_cpu(int cpu) +/* + * Per-CPU spinlock that rejects same-CPU re-entry. + * + * Same-CPU re-entry would AA-deadlock a plain raw spinlock, so an owner + * mark rejects it and lets the caller run its recovery path; cross-CPU + * contention blocks on the raw spinlock. + */ +static int bpf_lru_spin_lock_init(struct bpf_lru_spin_lock *l) { - cpu = cpumask_next(cpu, cpu_possible_mask); - if (cpu >= nr_cpu_ids) - cpu = cpumask_first(cpu_possible_mask); - return cpu; + raw_spin_lock_init(&l->lock); + l->nest = alloc_percpu(int); + if (!l->nest) + return -ENOMEM; + return 0; +} + +static void bpf_lru_spin_lock_destroy(struct bpf_lru_spin_lock *l) +{ + free_percpu(l->nest); +} + +static int bpf_lru_spin_lock(struct bpf_lru_spin_lock *l) +{ + preempt_disable(); + if (this_cpu_inc_return(*l->nest) != 1) { + this_cpu_dec(*l->nest); + preempt_enable(); + return -EBUSY; + } + raw_spin_lock(&l->lock); + return 0; +} + +static void bpf_lru_spin_unlock(struct bpf_lru_spin_lock *l) +{ + raw_spin_unlock(&l->lock); + this_cpu_dec(*l->nest); + preempt_enable(); } -/* Local list helpers */ -static struct list_head *local_free_list(struct bpf_lru_locallist *loc_l) +static int bpf_lru_spin_lock_irqsave(struct bpf_lru_spin_lock *l, + unsigned long *flags) { - return &loc_l->lists[LOCAL_FREE_LIST_IDX]; + preempt_disable(); + if (this_cpu_inc_return(*l->nest) != 1) { + this_cpu_dec(*l->nest); + preempt_enable(); + return -EBUSY; + } + raw_spin_lock_irqsave(&l->lock, *flags); + return 0; } -static struct list_head *local_pending_list(struct bpf_lru_locallist *loc_l) +static void bpf_lru_spin_unlock_irqrestore(struct bpf_lru_spin_lock *l, + unsigned long flags) { - return &loc_l->lists[LOCAL_PENDING_LIST_IDX]; + raw_spin_unlock_irqrestore(&l->lock, flags); + this_cpu_dec(*l->nest); + preempt_enable(); +} + +static int get_next_cpu(int cpu) +{ + cpu = cpumask_next(cpu, cpu_possible_mask); + if (cpu >= nr_cpu_ids) + cpu = cpumask_first(cpu_possible_mask); + return cpu; } /* bpf_lru_node helpers */ @@ -80,6 +127,7 @@ static void __bpf_lru_node_move_to_free(struct bpf_lru_list *l, bpf_lru_list_count_dec(l, node->type); node->type = tgt_free_type; + WRITE_ONCE(node->pending_free, 0); list_move(&node->list, free_list); } @@ -95,6 +143,9 @@ static void __bpf_lru_node_move_in(struct bpf_lru_list *l, bpf_lru_list_count_inc(l, tgt_type); node->type = tgt_type; bpf_lru_node_clear_ref(node); + /* Reset pending_free only when moving to the free list */ + if (tgt_type == BPF_LRU_LIST_T_FREE) + WRITE_ONCE(node->pending_free, 0); list_move(&node->list, &l->lists[tgt_type]); } @@ -220,9 +271,11 @@ __bpf_lru_list_shrink_inactive(struct bpf_lru *lru, unsigned int i = 0; list_for_each_entry_safe_reverse(node, tmp_node, inactive, list) { - if (bpf_lru_node_is_ref(node)) { + if (bpf_lru_node_is_ref(node) && + !READ_ONCE(node->pending_free)) { __bpf_lru_node_move(l, node, BPF_LRU_LIST_T_ACTIVE); - } else if (lru->del_from_htab(lru->del_arg, node)) { + } else if (READ_ONCE(node->pending_free) || + lru->del_from_htab(lru->del_arg, node)) { __bpf_lru_node_move_to_free(l, node, free_list, tgt_free_type); if (++nshrinked == tgt_nshrink) @@ -281,7 +334,8 @@ static unsigned int __bpf_lru_list_shrink(struct bpf_lru *lru, list_for_each_entry_safe_reverse(node, tmp_node, force_shrink_list, list) { - if (lru->del_from_htab(lru->del_arg, node)) { + if (READ_ONCE(node->pending_free) || + lru->del_from_htab(lru->del_arg, node)) { __bpf_lru_node_move_to_free(l, node, free_list, tgt_free_type); return 1; @@ -298,8 +352,10 @@ static void __local_list_flush(struct bpf_lru_list *l, struct bpf_lru_node *node, *tmp_node; list_for_each_entry_safe_reverse(node, tmp_node, - local_pending_list(loc_l), list) { - if (bpf_lru_node_is_ref(node)) + &loc_l->pending_list, list) { + if (READ_ONCE(node->pending_free)) + __bpf_lru_node_move_in(l, node, BPF_LRU_LIST_T_FREE); + else if (bpf_lru_node_is_ref(node)) __bpf_lru_node_move_in(l, node, BPF_LRU_LIST_T_ACTIVE); else __bpf_lru_node_move_in(l, node, @@ -315,9 +371,12 @@ static void bpf_lru_list_push_free(struct bpf_lru_list *l, if (WARN_ON_ONCE(IS_LOCAL_LIST_TYPE(node->type))) return; - raw_spin_lock_irqsave(&l->lock, flags); + if (bpf_lru_spin_lock_irqsave(&l->lock, &flags)) { + WRITE_ONCE(node->pending_free, 1); + return; + } __bpf_lru_node_move(l, node, BPF_LRU_LIST_T_FREE); - raw_spin_unlock_irqrestore(&l->lock, flags); + bpf_lru_spin_unlock_irqrestore(&l->lock, flags); } static void bpf_lru_list_pop_free_to_local(struct bpf_lru *lru, @@ -326,8 +385,10 @@ static void bpf_lru_list_pop_free_to_local(struct bpf_lru *lru, struct bpf_lru_list *l = &lru->common_lru.lru_list; struct bpf_lru_node *node, *tmp_node; unsigned int nfree = 0; + LIST_HEAD(tmp_free); - raw_spin_lock(&l->lock); + if (bpf_lru_spin_lock(&l->lock)) + return; __local_list_flush(l, loc_l); @@ -335,7 +396,7 @@ static void bpf_lru_list_pop_free_to_local(struct bpf_lru *lru, list_for_each_entry_safe(node, tmp_node, &l->lists[BPF_LRU_LIST_T_FREE], list) { - __bpf_lru_node_move_to_free(l, node, local_free_list(loc_l), + __bpf_lru_node_move_to_free(l, node, &tmp_free, BPF_LRU_LOCAL_LIST_T_FREE); if (++nfree == lru->target_free) break; @@ -343,10 +404,19 @@ static void bpf_lru_list_pop_free_to_local(struct bpf_lru *lru, if (nfree < lru->target_free) __bpf_lru_list_shrink(lru, l, lru->target_free - nfree, - local_free_list(loc_l), + &tmp_free, BPF_LRU_LOCAL_LIST_T_FREE); - raw_spin_unlock(&l->lock); + bpf_lru_spin_unlock(&l->lock); + + /* + * Transfer the harvested nodes from the temporary list_head into + * the lockless per-CPU free llist. + */ + list_for_each_entry_safe(node, tmp_node, &tmp_free, list) { + list_del(&node->list); + llist_add(&node->llist, &loc_l->free_llist); + } } static void __local_list_add_pending(struct bpf_lru *lru, @@ -358,22 +428,21 @@ static void __local_list_add_pending(struct bpf_lru *lru, *(u32 *)((void *)node + lru->hash_offset) = hash; node->cpu = cpu; node->type = BPF_LRU_LOCAL_LIST_T_PENDING; + WRITE_ONCE(node->pending_free, 0); bpf_lru_node_clear_ref(node); - list_add(&node->list, local_pending_list(loc_l)); + list_add(&node->list, &loc_l->pending_list); } static struct bpf_lru_node * __local_list_pop_free(struct bpf_lru_locallist *loc_l) { - struct bpf_lru_node *node; + struct llist_node *llnode; - node = list_first_entry_or_null(local_free_list(loc_l), - struct bpf_lru_node, - list); - if (node) - list_del(&node->list); + llnode = llist_del_first(&loc_l->free_llist); + if (!llnode) + return NULL; - return node; + return container_of(llnode, struct bpf_lru_node, llist); } static struct bpf_lru_node * @@ -384,10 +453,10 @@ __local_list_pop_pending(struct bpf_lru *lru, struct bpf_lru_locallist *loc_l) ignore_ref: /* Get from the tail (i.e. older element) of the pending list. */ - list_for_each_entry_reverse(node, local_pending_list(loc_l), - list) { + list_for_each_entry_reverse(node, &loc_l->pending_list, list) { if ((!bpf_lru_node_is_ref(node) || force) && - lru->del_from_htab(lru->del_arg, node)) { + (READ_ONCE(node->pending_free) || + lru->del_from_htab(lru->del_arg, node))) { list_del(&node->list); return node; } @@ -412,7 +481,8 @@ static struct bpf_lru_node *bpf_percpu_lru_pop_free(struct bpf_lru *lru, l = per_cpu_ptr(lru->percpu_lru, cpu); - raw_spin_lock_irqsave(&l->lock, flags); + if (bpf_lru_spin_lock_irqsave(&l->lock, &flags)) + return NULL; __bpf_lru_list_rotate(lru, l); @@ -428,7 +498,7 @@ static struct bpf_lru_node *bpf_percpu_lru_pop_free(struct bpf_lru *lru, __bpf_lru_node_move(l, node, BPF_LRU_LIST_T_INACTIVE); } - raw_spin_unlock_irqrestore(&l->lock, flags); + bpf_lru_spin_unlock_irqrestore(&l->lock, flags); return node; } @@ -445,7 +515,8 @@ static struct bpf_lru_node *bpf_common_lru_pop_free(struct bpf_lru *lru, loc_l = per_cpu_ptr(clru->local_list, cpu); - raw_spin_lock_irqsave(&loc_l->lock, flags); + if (bpf_lru_spin_lock_irqsave(&loc_l->lock, &flags)) + return NULL; node = __local_list_pop_free(loc_l); if (!node) { @@ -456,17 +527,22 @@ static struct bpf_lru_node *bpf_common_lru_pop_free(struct bpf_lru *lru, if (node) __local_list_add_pending(lru, loc_l, cpu, node, hash); - raw_spin_unlock_irqrestore(&loc_l->lock, flags); + bpf_lru_spin_unlock_irqrestore(&loc_l->lock, flags); if (node) return node; - /* No free nodes found from the local free list and + /* + * No free nodes found from the local free list and * the global LRU list. * * Steal from the local free/pending list of the * current CPU and remote CPU in RR. It starts * with the loc_l->next_steal CPU. + * + * Acquire the victim's lock before touching either list. On + * acquisition failure (rqspinlock AA or timeout) skip the victim + * and try the next CPU. */ first_steal = loc_l->next_steal; @@ -474,24 +550,36 @@ static struct bpf_lru_node *bpf_common_lru_pop_free(struct bpf_lru *lru, do { steal_loc_l = per_cpu_ptr(clru->local_list, steal); - raw_spin_lock_irqsave(&steal_loc_l->lock, flags); - - node = __local_list_pop_free(steal_loc_l); - if (!node) - node = __local_list_pop_pending(lru, steal_loc_l); - - raw_spin_unlock_irqrestore(&steal_loc_l->lock, flags); + if (!bpf_lru_spin_lock_irqsave(&steal_loc_l->lock, &flags)) { + node = __local_list_pop_free(steal_loc_l); + if (!node) + node = __local_list_pop_pending(lru, steal_loc_l); + bpf_lru_spin_unlock_irqrestore(&steal_loc_l->lock, flags); + } steal = get_next_cpu(steal); } while (!node && steal != first_steal); loc_l->next_steal = steal; - if (node) { - raw_spin_lock_irqsave(&loc_l->lock, flags); - __local_list_add_pending(lru, loc_l, cpu, node, hash); - raw_spin_unlock_irqrestore(&loc_l->lock, flags); + if (!node) + return NULL; + + if (bpf_lru_spin_lock_irqsave(&loc_l->lock, &flags)) { + /* + * The local pending lock can't be acquired (rqspinlock AA + * or timeout). Return the stolen node to the per-CPU + * free_llist instead of orphaning it; the next pop_free on + * this CPU will pick it up. + */ + node->type = BPF_LRU_LOCAL_LIST_T_FREE; + bpf_lru_node_clear_ref(node); + WRITE_ONCE(node->pending_free, 0); + llist_add(&node->llist, &loc_l->free_llist); + return NULL; } + __local_list_add_pending(lru, loc_l, cpu, node, hash); + bpf_lru_spin_unlock_irqrestore(&loc_l->lock, flags); return node; } @@ -519,18 +607,23 @@ static void bpf_common_lru_push_free(struct bpf_lru *lru, loc_l = per_cpu_ptr(lru->common_lru.local_list, node->cpu); - raw_spin_lock_irqsave(&loc_l->lock, flags); + if (bpf_lru_spin_lock_irqsave(&loc_l->lock, &flags)) { + WRITE_ONCE(node->pending_free, 1); + return; + } if (unlikely(node->type != BPF_LRU_LOCAL_LIST_T_PENDING)) { - raw_spin_unlock_irqrestore(&loc_l->lock, flags); + bpf_lru_spin_unlock_irqrestore(&loc_l->lock, flags); goto check_lru_list; } node->type = BPF_LRU_LOCAL_LIST_T_FREE; bpf_lru_node_clear_ref(node); - list_move(&node->list, local_free_list(loc_l)); + list_del(&node->list); - raw_spin_unlock_irqrestore(&loc_l->lock, flags); + bpf_lru_spin_unlock_irqrestore(&loc_l->lock, flags); + + llist_add(&node->llist, &loc_l->free_llist); return; } @@ -546,11 +639,14 @@ static void bpf_percpu_lru_push_free(struct bpf_lru *lru, l = per_cpu_ptr(lru->percpu_lru, node->cpu); - raw_spin_lock_irqsave(&l->lock, flags); + if (bpf_lru_spin_lock_irqsave(&l->lock, &flags)) { + WRITE_ONCE(node->pending_free, 1); + return; + } __bpf_lru_node_move(l, node, BPF_LRU_LIST_T_FREE); - raw_spin_unlock_irqrestore(&l->lock, flags); + bpf_lru_spin_unlock_irqrestore(&l->lock, flags); } void bpf_lru_push_free(struct bpf_lru *lru, struct bpf_lru_node *node) @@ -573,6 +669,7 @@ static void bpf_common_lru_populate(struct bpf_lru *lru, void *buf, node = (struct bpf_lru_node *)(buf + node_offset); node->type = BPF_LRU_LIST_T_FREE; + node->pending_free = 0; bpf_lru_node_clear_ref(node); list_add(&node->list, &l->lists[BPF_LRU_LIST_T_FREE]); buf += elem_size; @@ -602,6 +699,7 @@ static void bpf_percpu_lru_populate(struct bpf_lru *lru, void *buf, node = (struct bpf_lru_node *)(buf + node_offset); node->cpu = cpu; node->type = BPF_LRU_LIST_T_FREE; + node->pending_free = 0; bpf_lru_node_clear_ref(node); list_add(&node->list, &l->lists[BPF_LRU_LIST_T_FREE]); i++; @@ -624,19 +722,17 @@ void bpf_lru_populate(struct bpf_lru *lru, void *buf, u32 node_offset, nr_elems); } -static void bpf_lru_locallist_init(struct bpf_lru_locallist *loc_l, int cpu) +static int bpf_lru_locallist_init(struct bpf_lru_locallist *loc_l, int cpu) { - int i; - - for (i = 0; i < NR_BPF_LRU_LOCAL_LIST_T; i++) - INIT_LIST_HEAD(&loc_l->lists[i]); + INIT_LIST_HEAD(&loc_l->pending_list); + init_llist_head(&loc_l->free_llist); loc_l->next_steal = cpu; - raw_spin_lock_init(&loc_l->lock); + return bpf_lru_spin_lock_init(&loc_l->lock); } -static void bpf_lru_list_init(struct bpf_lru_list *l) +static int bpf_lru_list_init(struct bpf_lru_list *l) { int i; @@ -648,13 +744,15 @@ static void bpf_lru_list_init(struct bpf_lru_list *l) l->next_inactive_rotation = &l->lists[BPF_LRU_LIST_T_INACTIVE]; - raw_spin_lock_init(&l->lock); + return bpf_lru_spin_lock_init(&l->lock); } int bpf_lru_init(struct bpf_lru *lru, bool percpu, u32 hash_offset, del_from_htab_func del_from_htab, void *del_arg) { - int cpu; + int cpu, err; + + lru->percpu = percpu; if (percpu) { lru->percpu_lru = alloc_percpu(struct bpf_lru_list); @@ -665,7 +763,9 @@ int bpf_lru_init(struct bpf_lru *lru, bool percpu, u32 hash_offset, struct bpf_lru_list *l; l = per_cpu_ptr(lru->percpu_lru, cpu); - bpf_lru_list_init(l); + err = bpf_lru_list_init(l); + if (err) + goto out; } lru->nr_scans = PERCPU_NR_SCANS; } else { @@ -679,25 +779,47 @@ int bpf_lru_init(struct bpf_lru *lru, bool percpu, u32 hash_offset, struct bpf_lru_locallist *loc_l; loc_l = per_cpu_ptr(clru->local_list, cpu); - bpf_lru_locallist_init(loc_l, cpu); + err = bpf_lru_locallist_init(loc_l, cpu); + if (err) + goto out; } - bpf_lru_list_init(&clru->lru_list); + err = bpf_lru_list_init(&clru->lru_list); + if (err) + goto out; lru->nr_scans = LOCAL_NR_SCANS; } - lru->percpu = percpu; lru->del_from_htab = del_from_htab; lru->del_arg = del_arg; lru->hash_offset = hash_offset; return 0; +out: + bpf_lru_destroy(lru); + return err; } void bpf_lru_destroy(struct bpf_lru *lru) { - if (lru->percpu) + int cpu; + + if (lru->percpu) { + for_each_possible_cpu(cpu) { + struct bpf_lru_list *l; + + l = per_cpu_ptr(lru->percpu_lru, cpu); + bpf_lru_spin_lock_destroy(&l->lock); + } free_percpu(lru->percpu_lru); - else + } else { + for_each_possible_cpu(cpu) { + struct bpf_lru_locallist *loc_l; + + loc_l = per_cpu_ptr(lru->common_lru.local_list, cpu); + bpf_lru_spin_lock_destroy(&loc_l->lock); + } + bpf_lru_spin_lock_destroy(&lru->common_lru.lru_list.lock); free_percpu(lru->common_lru.local_list); + } } diff --git a/kernel/bpf/bpf_lru_list.h b/kernel/bpf/bpf_lru_list.h index fe2661a58ea9..6830147c7a6a 100644 --- a/kernel/bpf/bpf_lru_list.h +++ b/kernel/bpf/bpf_lru_list.h @@ -6,11 +6,12 @@ #include <linux/cache.h> #include <linux/list.h> +#include <linux/llist.h> +#include <linux/percpu.h> #include <linux/spinlock_types.h> #define NR_BPF_LRU_LIST_T (3) #define NR_BPF_LRU_LIST_COUNT (2) -#define NR_BPF_LRU_LOCAL_LIST_T (2) #define BPF_LOCAL_LIST_T_OFFSET NR_BPF_LRU_LIST_T enum bpf_lru_list_type { @@ -22,10 +23,31 @@ enum bpf_lru_list_type { }; struct bpf_lru_node { - struct list_head list; + /* + * A node is in at most one list at a time. The free path on the + * per-CPU locallist uses an llist, so share storage via a union. + */ + union { + struct list_head list; + struct llist_node llist; + }; u16 cpu; u8 type; u8 ref; + /* + * Marks nodes whose *_push_free() lock acquire failed; reclaimed + * by flush/shrink which honor the flag instead of del_from_htab(). + */ + u8 pending_free; +}; + +/* + * Mutually-exclusive per-CPU spinlock with re-entry rejection + * (see implementation in bpf_lru_list.c). + */ +struct bpf_lru_spin_lock { + raw_spinlock_t lock; + int __percpu *nest; }; struct bpf_lru_list { @@ -34,13 +56,14 @@ struct bpf_lru_list { /* The next inactive list rotation starts from here */ struct list_head *next_inactive_rotation; - raw_spinlock_t lock ____cacheline_aligned_in_smp; + struct bpf_lru_spin_lock lock ____cacheline_aligned_in_smp; }; struct bpf_lru_locallist { - struct list_head lists[NR_BPF_LRU_LOCAL_LIST_T]; + struct list_head pending_list; + struct llist_head free_llist; u16 next_steal; - raw_spinlock_t lock; + struct bpf_lru_spin_lock lock; }; struct bpf_common_lru { -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] perf: Fix refcount race between perf_event_open() and perf_mmap_close()
by Luo Gengkun 08 Sep '26

08 Sep '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18563 -------------------------------- perf_event_set_output() can succeed and add the event to a ring buffer's event_list, making it visible to concurrent perf_mmap_close(). The latter raises the event refcount via atomic_long_inc_not_zero() during its RCU-protected iteration of rb->event_list. If a subsequent check in sys_perf_event_open() fails, the error path calls free_event() which expects refcount==1. When perf_mmap_close() has already incremented it to 2, free_event() triggers a WARN. Fixes: 9bb5d40cd93c ("perf: Fix mmap() accounting hole") Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- kernel/events/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/events/core.c b/kernel/events/core.c index ff875ddf4aeb..292419dc2ec5 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -11149,7 +11149,7 @@ SYSCALL_DEFINE5(perf_event_open, * and that will take care of freeing the event. */ if (!event_file) - free_event(event); + put_event(event); err_cred: if (task) mutex_unlock(&task->signal->cred_guard_mutex); -- 2.34.1

2 1

[PATCH OLK-5.10] drm/dp/mst: fix buffer overflows in sideband chunk accumulation
by Hongtao Zhang 07 Sep '26

07 Sep '26

From: Ashutosh Desai <ashutoshdesai993(a)gmail.com> stable inclusion from stable-v5.10.266 commit ef2ecb6cf268debf3890df99fea01b6452dcf78e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17183 CVE: CVE-2026-68278 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 55bd5e685bda455b9b50c835f8c8442d52a344a3 ] drm_dp_sideband_append_payload() has three related bugs when processing device-provided sideband reply data: 1. Zero-length curchunk_len underflow: msg_len is a 6-bit field taken directly from the DP sideband header. If a device sends msg_len=0, curchunk_len is set to zero. The condition (curchunk_idx >= curchunk_len) is immediately true, and curchunk_len-1 wraps to 255 (u8 underflow). drm_dp_msg_data_crc4() reads 255 bytes from chunk[48], then memcpy() writes 255 bytes into msg[], both far out of bounds. 2. chunk[48] overflow: curchunk_len can reach 63 (6-bit field). chunk[] is only 48 bytes. Multi-iteration payload assembly appends 16-byte blocks until curchunk_idx reaches curchunk_len, writing up to 15 bytes past the end of chunk[] into msg[]. 3. msg[256] overflow: each chunk contributes (curchunk_len-1) bytes to msg[]. No check ensures curlen + (curchunk_len-1) stays within msg[256], so the memcpy can spill into adjacent struct fields. All three are reachable from any DP MST device that can forge sideband reply messages on a physical connection. Fixes: ad7f8a1f9ced ("drm/helper: add Displayport multi-stream helper (v0.6)") Cc: <stable(a)vger.kernel.org> # v3.17+ Signed-off-by: Ashutosh Desai <ashutoshdesai993(a)gmail.com> Reviewed-by: Lyude Paul <lyude(a)redhat.com> Signed-off-by: Lyude Paul <lyude(a)redhat.com> Link: https://patch.msgid.link/20260410041901.2438960-1-ashutoshdesai993@gmail.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Hulk Robot <hulkrobot(a)huawei.com> Signed-off-by: Zhang Hongtao <zhanghongtao35(a)huawei.com> --- drivers/gpu/drm/drm_dp_mst_topology.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c index e71d76daee748..0802ae9a43d0a 100644 --- a/drivers/gpu/drm/drm_dp_mst_topology.c +++ b/drivers/gpu/drm/drm_dp_mst_topology.c @@ -778,6 +778,12 @@ static bool drm_dp_sideband_append_payload(struct drm_dp_sideband_msg_rx *msg, { u8 crc4; + /* curchunk_len must be >= 1 (min 1 CRC byte) and fit in chunk[] */ + if (!msg->curchunk_len || + msg->curchunk_len > ARRAY_SIZE(msg->chunk) || + msg->curchunk_idx + replybuflen > ARRAY_SIZE(msg->chunk)) + return false; + memcpy(&msg->chunk[msg->curchunk_idx], replybuf, replybuflen); msg->curchunk_idx += replybuflen; @@ -788,6 +794,9 @@ static bool drm_dp_sideband_append_payload(struct drm_dp_sideband_msg_rx *msg, print_hex_dump(KERN_DEBUG, "wrong crc", DUMP_PREFIX_NONE, 16, 1, msg->chunk, msg->curchunk_len, false); + /* Guard against accumulated msg[] overflow */ + if (msg->curlen + msg->curchunk_len - 1 > ARRAY_SIZE(msg->msg)) + return false; /* copy chunk into bigger msg */ memcpy(&msg->msg[msg->curlen], msg->chunk, msg->curchunk_len - 1); msg->curlen += msg->curchunk_len - 1; -- 2.43.0

2 1

[PATCH OLK-5.10 0/1] CVE-2026-74549
by Yongqiang Liu 07 Sep '26

07 Sep '26

Guenter Roeck (1): hwmon: (nct6775-core) Prevent access to unsupported weight registers drivers/hwmon/nct6775.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) -- 2.43.0

2 2

[PATCH OLK-6.6 0/1] CVE-2026-72397
by Yongqiang Liu 07 Sep '26

07 Sep '26

Abdurrahman Hussain (1): hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid() drivers/hwmon/pmbus/pmbus_core.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) -- 2.43.0

2 2

[PATCH OLK-6.6 0/1] CVE-2026-72397
by Yongqiang Liu 07 Sep '26

07 Sep '26

Abdurrahman Hussain (1): hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid() drivers/hwmon/pmbus/pmbus_core.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) -- 2.43.0

2 2

[PATCH OLK-5.10 0/1] CVE-2026-72397
by Yongqiang Liu 07 Sep '26

07 Sep '26

Abdurrahman Hussain (1): hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid() drivers/hwmon/pmbus/pmbus_core.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) -- 2.43.0

2 2

[PATCH OLK-6.6 0/9] nbd: boost nbd setup
by Yang Erkun 07 Sep '26

07 Sep '26

Drop local patchset, using mainline pathset to do the same thing. Yang Erkun (9): Revert "nbd: remove queue freeze in nbd_add_socket" Revert "nbd: remove redundant num_connections boundary checks" Revert "nbd: replace socks pointer array with xarray" Revert "nbd: simplify find_fallback() by removing redundant logic" nbd: disallow NBD_SET_SOCK on an active device nbd: remove queue freeze in nbd_add_socket nbd: factor out a nbd_genl_foreach_sock nbd: remove queue freeze for newly created nbd from netlink path nbd: add pre_defined_connections module parameter for pre-created devices drivers/block/nbd.c | 350 ++++++++++++++++++++++---------------------- 1 file changed, 176 insertions(+), 174 deletions(-) -- 2.52.0

2 10

[PATCH OLK-6.6 00/16] backport minios part4 patches from linux mainline
by Qinxin Xia 07 Sep '26

07 Sep '26

From: Hongye Lin <linhongye(a)h-partners.com> mainline inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/8904 ---------------------------------------------------------------------- backport minios part4 patches from linux mainline Mark Brown (6): arm64/sysreg: Update HCRX_EL2 definition for DDI0601 2023-09 arm64/fpsimd: Enable host kernel access to FPMR arm64/fpsimd: Support FEAT_FPMR arm64/signal: Add FPMR signal handling arm64/ptrace: Expose FPMR via ptrace arm64/fpsimd: Don't corrupt FPMR when streaming mode changes Mark Rutland (7): arm64: ptrace: fix partial SETREGSET for NT_ARM_FPMR arm64/fpsimd: Add fpsimd_save_and_flush_current_state() arm64/fpsimd: Reset FPMR upon exec() arm64/fpsimd: signal32: Always save+flush state early arm64/fpsimd: signal: Always save+flush state early arm64/fpsimd: Avoid warning when sve_to_fpsimd() is unused arm64/fpsimd: Do not discard modified SVE state Qinxin Xia (1): Add support "arm64.nocnp" for start option arch/arm64/include/asm/cpufeature.h | 6 ++ arch/arm64/include/asm/el2_setup.h | 2 +- arch/arm64/include/asm/fpsimd.h | 7 +- arch/arm64/include/asm/kvm_arm.h | 1 - arch/arm64/include/asm/kvm_host.h | 1 + arch/arm64/include/asm/processor.h | 4 + arch/arm64/include/asm/signal_common.h | 20 ++++- arch/arm64/include/uapi/asm/sigcontext.h | 8 ++ arch/arm64/kernel/cpufeature.c | 13 ++- arch/arm64/kernel/entry-common.c | 50 ++++++++--- arch/arm64/kernel/fpsimd.c | 74 ++++++++-------- arch/arm64/kernel/idreg-override.c | 11 +++ arch/arm64/kernel/ptrace.c | 44 ++++++++++ arch/arm64/kernel/signal.c | 103 ++++++++++++----------- arch/arm64/kernel/signal32.c | 11 ++- arch/arm64/kvm/fpsimd.c | 1 + arch/arm64/kvm/hyp/include/hyp/switch.h | 13 ++- arch/arm64/tools/cpucaps | 2 +- arch/arm64/tools/sysreg | 4 +- include/uapi/linux/elf.h | 1 + 20 files changed, 259 insertions(+), 117 deletions(-) -- 2.33.0

2 17

[PATCH OLK-6.6] net/mlx5: LAG, Fix off-by-one in single-FDB error rollback
by Yi Yang 07 Sep '26

07 Sep '26

From: Shay Drory <shayd(a)nvidia.com> mainline inclusion from mainline-v7.2-rc3 commit 0f0e4ae6975c773f7854fc48932a267f6c79088f category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17727 CVE: CVE-2026-72345 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- On failure at index i, the reverse cleanup loop in mlx5_lag_create_single_fdb() starts from i, so the failed index itself is rolled back. That can operate on uninitialized state or double-tear-down a rule the add_one path already self-rolled-back. Start the rollback from i - 1 so only successfully-installed entries are undone. Fixes: ddbb5ddc43ad ("net/mlx5: LAG, Refactor lag logic") Signed-off-by: Shay Drory <shayd(a)nvidia.com> Reviewed-by: Mark Bloch <mbloch(a)nvidia.com> Signed-off-by: Tariq Toukan <tariqt(a)nvidia.com> Link: https://patch.msgid.link/20260630112917.698313-2-tariqt@nvidia.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Conflicts: drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c [Commit 3b8b364f97f40 which factored shared FDB code into shared_fdb.c is not present in this tree; mlx5_lag_create_single_fdb() still lives in lag.c. Apply the same off-by-one rollback fix there by starting the reverse cleanup at i-1 instead of i.] Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c b/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c index f6b1ac80c0af..96b1eb0ec72d 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c @@ -570,7 +570,7 @@ static int mlx5_lag_create_single_fdb(struct mlx5_lag *ldev) } return 0; err: - for (; i > MLX5_LAG_P1; i--) + for (i--; i > MLX5_LAG_P1; i--) mlx5_eswitch_offloads_single_fdb_del_one(master_esw, ldev->pf[i].dev->priv.eswitch); return err; -- 2.25.1

2 1

[PATCH OLK-6.6] ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD
by Lu Chentao 07 Sep '26

07 Sep '26

mainline inclusion from mainline-v7.2-rc2 commit 462775c620197adaabc983ce847e5b9878ff4cb0 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17314 CVE: CVE-2026-72031 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The PNY CS900 1TB SSD (Phison PS3111-S11, DRAM-less) drops off the bus after entering Device-Initiated Slumber during idle. With the default med_power_with_dipm policy the link goes down (SStatus 1 SControl 300) and does not recover, forcing the filesystem read-only. Forcing max_performance keeps the link stable across prolonged idle. Add a NOLPM quirk so link power management is disabled for this drive specifically, leaving it intact for other devices on the host. Cc: stable(a)vger.kernel.org Signed-off-by: Bryam Vargas <hexlabsecurity(a)proton.me> Reviewed-by: Niklas Cassel <cassel(a)kernel.org> Signed-off-by: Damien Le Moal <dlemoal(a)kernel.org> Conflicts: drivers/ata/libata-core.c [5.10 didn't introduce __ata_dev_quirks and ATA_QUIRK_NOLPM, adapted with ATA_HORKAGE_NOLPM] Signed-off-by: Lu Chentao <luchentao1(a)huawei.com> --- drivers/ata/libata-core.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c index 0aac030532c3..9110e9b50b80 100644 --- a/drivers/ata/libata-core.c +++ b/drivers/ata/libata-core.c @@ -4232,10 +4232,13 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { ATA_HORKAGE_NOLPM }, { "Crucial_CT960M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | ATA_HORKAGE_ZERO_AFTER_TRIM | ATA_HORKAGE_NOLPM }, + /* PNY CS900 (Phison PS3111-S11, DRAM-less) drops the link on DIPM */ + { "PNY CS900 1TB SSD", NULL, ATA_HORKAGE_NOLPM }, + /* These specific Samsung models/firmware-revs do not handle LPM well */ { "SAMSUNG MZMPC128HBFU-000MV", "CXM14M1Q", ATA_HORKAGE_NOLPM }, { "SAMSUNG SSD PM830 mSATA *", "CXM13D1Q", ATA_HORKAGE_NOLPM }, { "SAMSUNG MZ7TD256HAFV-000L9", NULL, ATA_HORKAGE_NOLPM }, { "SAMSUNG MZ7TE512HMHP-000L1", "EXT06L0Q", ATA_HORKAGE_NOLPM }, -- 2.52.0

2 1

[PATCH OLK-6.6] ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD
by Lu Chentao 07 Sep '26

07 Sep '26

mainline inclusion from mainline-v7.2-rc2 commit 462775c620197adaabc983ce847e5b9878ff4cb0 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17314 CVE: CVE-2026-72031 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The PNY CS900 1TB SSD (Phison PS3111-S11, DRAM-less) drops off the bus after entering Device-Initiated Slumber during idle. With the default med_power_with_dipm policy the link goes down (SStatus 1 SControl 300) and does not recover, forcing the filesystem read-only. Forcing max_performance keeps the link stable across prolonged idle. Add a NOLPM quirk so link power management is disabled for this drive specifically, leaving it intact for other devices on the host. Cc: stable(a)vger.kernel.org Signed-off-by: Bryam Vargas <hexlabsecurity(a)proton.me> Reviewed-by: Niklas Cassel <cassel(a)kernel.org> Signed-off-by: Damien Le Moal <dlemoal(a)kernel.org> Conflicts: drivers/ata/libata-core.c [5.10 didn't introduce __ata_dev_quirks and ATA_QUIRK_NOLPM, adapted with ATA_HORKAGE_NOLPM] Signed-off-by: Lu Chentao <luchentao1(a)huawei.com> --- drivers/ata/libata-core.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c index 0aac030532c3..9110e9b50b80 100644 --- a/drivers/ata/libata-core.c +++ b/drivers/ata/libata-core.c @@ -4232,10 +4232,13 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { ATA_HORKAGE_NOLPM }, { "Crucial_CT960M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | ATA_HORKAGE_ZERO_AFTER_TRIM | ATA_HORKAGE_NOLPM }, + /* PNY CS900 (Phison PS3111-S11, DRAM-less) drops the link on DIPM */ + { "PNY CS900 1TB SSD", NULL, ATA_HORKAGE_NOLPM }, + /* These specific Samsung models/firmware-revs do not handle LPM well */ { "SAMSUNG MZMPC128HBFU-000MV", "CXM14M1Q", ATA_HORKAGE_NOLPM }, { "SAMSUNG SSD PM830 mSATA *", "CXM13D1Q", ATA_HORKAGE_NOLPM }, { "SAMSUNG MZ7TD256HAFV-000L9", NULL, ATA_HORKAGE_NOLPM }, { "SAMSUNG MZ7TE512HMHP-000L1", "EXT06L0Q", ATA_HORKAGE_NOLPM }, -- 2.52.0

2 1

[PATCH OLK-5.10] ocfs2: validate fast symlink target during inode read
by Lai Zewei 07 Sep '26

07 Sep '26

mainline inclusion from mainline-v7.2-rc1 commit e234973f286ed2e8961a24561ec91594ec3e3ff8 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18148 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ocfs2_validate_inode_block() already rejects several inconsistent self-contained dinodes before they are exposed to the rest of the filesystem. Fast symlinks need the same treatment. A zero-cluster symlink is treated as a fast symlink and later read through page_get_link() and ocfs2_fast_symlink_read_folio(). That path uses strnlen() on the inline payload and then copies len + 1 bytes into the folio. If a corrupt dinode stores an i_size that does not fit the inline area or omits the terminating NUL at i_size, that copy reads past the end of the inode block buffer. Reject zero-cluster symlink dinodes whose i_size exceeds the inline fast-symlink capacity or whose inline payload is not NUL-terminated exactly at i_size when the inode block is validated. This keeps malformed fast symlinks from reaching the read path. Validation reproduced this kernel report: KASAN use-after-free in ocfs2_fast_symlink_read_folio+0x12c/0x1f0 RIP: 0033:0x7f5c6d859aa7 Read of size 3905 Call trace: dump_stack_lvl+0x66/0xa0 (?:?) print_report+0xce/0x630 (?:?) ocfs2_fast_symlink_read_folio+0x12c/0x1f0 (fs/ocfs2/inode.c:?) srso_alias_return_thunk+0x5/0xfbef5 (?:?) __virt_addr_valid+0x19f/0x330 (?:?) kasan_report+0xe0/0x110 (?:?) kasan_check_range+0x105/0x1b0 (?:?) __asan_memcpy+0x23/0x60 (?:?) filemap_read_folio+0x27/0xe0 (?:?) filemap_read_folio+0x35/0xe0 (?:?) do_read_cache_folio+0x138/0x230 (?:?) __page_get_link+0x26/0x110 (?:?) page_get_link+0x2e/0x70 (?:?) vfs_readlink+0x15e/0x250 (?:?) touch_atime+0x4d/0x370 (?:?) do_readlinkat+0x186/0x200 (?:?) do_user_addr_fault+0x65a/0x890 (?:?) __x64_sys_readlink+0x46/0x60 (?:?) do_syscall_64+0x115/0x6a0 (arch/x86/entry/syscall_64.c:87) entry_SYSCALL_64_after_hwframe+0x77/0x7f (?:?) Link: https://lore.kernel.org/20260528151230.361127-1-rollkingzzc@gmail.com Fixes: ea022dfb3c2a ("ocfs: simplify symlink handling") Signed-off-by: Zhang Cen <rollkingzzc(a)gmail.com> Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Cc: Gui-Dong Han <2045gemini(a)gmail.com> Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Jun Piao <piaojun(a)huawei.com> Cc: Heming Zhao <heming.zhao(a)suse.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: fs/ocfs2/inode.c [ctx conflicts] Signed-off-by: Lai Zewei <laizewei3(a)huawei.com> --- fs/ocfs2/inode.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/fs/ocfs2/inode.c b/fs/ocfs2/inode.c index 7c9dfd50c1c1..e5fa0070016f 100644 --- a/fs/ocfs2/inode.c +++ b/fs/ocfs2/inode.c @@ -1418,6 +1418,29 @@ int ocfs2_validate_inode_block(struct super_block *sb, goto bail; } + if (S_ISLNK(le16_to_cpu(di->i_mode)) && + !le32_to_cpu(di->i_clusters)) { + int max_inline = ocfs2_fast_symlink_chars(sb); + u64 i_size = le64_to_cpu(di->i_size); + + if (i_size >= max_inline) { + rc = ocfs2_error(sb, + "Invalid dinode #%llu: fast symlink i_size %llu exceeds max %d\n", + (unsigned long long)bh->b_blocknr, + (unsigned long long)i_size, + max_inline - 1); + goto bail; + } + + if (strnlen((char *)di->id2.i_symlink, i_size + 1) != i_size) { + rc = ocfs2_error(sb, + "Invalid dinode #%llu: fast symlink is not NUL-terminated at i_size %llu\n", + (unsigned long long)bh->b_blocknr, + (unsigned long long)i_size); + goto bail; + } + } + rc = 0; bail: -- 2.52.0

2 1

[PATCH OLK-5.10] wifi: mac80211: validate extension-frame layout before RX
by Gaosheng Cui 07 Sep '26

07 Sep '26

From: Zhao Li <enderaoelyther(a)gmail.com> mainline inclusion from mainline-v7.2-rc4 commit 57d503ce32eccfa7650065ca4c560f7e29a2e676 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17512 CVE: CVE-2026-68470 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Extension frames only have the extension header at the regular 802.11 header offset. The generic RX path can still reach helpers and interface dispatch code that read regular header address fields before unsupported extension subtypes are dropped. mac80211 currently only handles S1G beacon extension frames. Drop other extension subtypes before they can reach regular-header RX processing. For S1G beacons, linearize the SKB with the management-frame path and require the fixed S1G beacon header, including optional fixed fields indicated by frame control, before generic RX dispatch. Route S1G beacons through the station/default-link RX path without regular-header station lookup. Avoid regular-header address reads in the mac80211 RX paths that process S1G extension beacons, including accept-frame, duplicate-detection, address-copy, and MLO address-translation paths. Also make ieee80211_get_bssid() length-safe before returning the S1G source-address pointer. Fixes: 09a740ce352e ("mac80211: receive and process S1G beacons") Cc: stable(a)vger.kernel.org Signed-off-by: Zhao Li <enderaoelyther(a)gmail.com> Link: https://patch.msgid.link/20260611161943.91069-5-enderaoelyther@gmail.com Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Conflicts: net/mac80211/rx.c [Commit 57d503ce32ec built the S1G-beacon handling on top of ieee80211_rx_for_interface() and ieee80211_s1g_optional_len(), which do not exist in this tree (no include/linux/ieee80211-s1g.h). The equivalent logic is inlined into __ieee80211_rx_handle_packet(): S1G beacons are dispatched with a NULL sta (skipping the regular-header addr2 station lookup), and the optional-header length check is expressed with the existing ieee80211_next_tbtt_present(). ieee80211_prepare_and_rx_handle() needs no S1G shortcut because this tree does not have the SW-crypto/MLO address-copy paths.] Co-authored-by: BackportAgent@deepseek-v4-flash Signed-off-by: Hulk Robot <hulkrobot(a)huawei.com> Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- net/mac80211/rx.c | 30 ++++++++++++++++++++++++++---- net/mac80211/util.c | 3 +++ 2 files changed, 29 insertions(+), 4 deletions(-) diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c index 65fea564c9c0..ba25540c4013 100644 --- a/net/mac80211/rx.c +++ b/net/mac80211/rx.c @@ -1429,6 +1429,9 @@ ieee80211_rx_h_check_dup(struct ieee80211_rx_data *rx) if (status->flag & RX_FLAG_DUP_VALIDATED) return RX_CONTINUE; + if (ieee80211_is_ext(hdr->frame_control)) + return RX_CONTINUE; + /* * Drop duplicate 802.11 retransmissions * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery") @@ -4051,8 +4054,12 @@ static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx) struct ieee80211_hdr *hdr = (void *)skb->data; struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); u8 *bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type); - bool multicast = is_multicast_ether_addr(hdr->addr1) || - ieee80211_is_s1g_beacon(hdr->frame_control); + bool multicast; + + if (ieee80211_is_s1g_beacon(hdr->frame_control)) + return sdata->vif.type == NL80211_IFTYPE_STATION && bssid; + + multicast = is_multicast_ether_addr(hdr->addr1); switch (sdata->vif.type) { case NL80211_IFTYPE_STATION: @@ -4639,6 +4646,19 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw, err = -ENOBUFS; else err = skb_linearize(skb); + } else if (ieee80211_is_s1g_beacon(fc)) { + size_t s1g_hdr_len = offsetof(struct ieee80211_ext, + u.s1g_beacon.variable); + + if (ieee80211_next_tbtt_present(fc)) + s1g_hdr_len += 3; + + if (skb->len < s1g_hdr_len) + err = -ENOBUFS; + else + err = skb_linearize(skb); + } else if (ieee80211_is_ext(fc)) { + err = -EINVAL; } else { err = !pskb_may_pull(skb, ieee80211_hdrlen(fc)); } @@ -4714,7 +4734,8 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw, continue; } - rx.sta = sta_info_get_bss(prev, hdr->addr2); + rx.sta = ieee80211_is_s1g_beacon(hdr->frame_control) ? + NULL : sta_info_get_bss(prev, hdr->addr2); rx.sdata = prev; ieee80211_prepare_and_rx_handle(&rx, skb, false); @@ -4722,7 +4743,8 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw, } if (prev) { - rx.sta = sta_info_get_bss(prev, hdr->addr2); + rx.sta = ieee80211_is_s1g_beacon(hdr->frame_control) ? + NULL : sta_info_get_bss(prev, hdr->addr2); rx.sdata = prev; if (ieee80211_prepare_and_rx_handle(&rx, skb, true)) diff --git a/net/mac80211/util.c b/net/mac80211/util.c index e49355cbb1ce..8e27e191945d 100644 --- a/net/mac80211/util.c +++ b/net/mac80211/util.c @@ -67,6 +67,9 @@ u8 *ieee80211_get_bssid(struct ieee80211_hdr *hdr, size_t len, if (ieee80211_is_s1g_beacon(fc)) { struct ieee80211_ext *ext = (void *) hdr; + if (len < offsetofend(struct ieee80211_ext, u.s1g_beacon.sa)) + return NULL; + return ext->u.s1g_beacon.sa; } -- 2.43.0

2 1

[PATCH OLK-6.6 00/24] arm64: support BBML2 noabort feature
by Jinjiang Tu 07 Sep '26

07 Sep '26

Anshuman Khandual (1): arm64/mm: Rename pte_mkpresent() as pte_mkvalid() Ard Biesheuvel (1): arm64: Avoid enabling KPTI unnecessarily Catalin Marinas (1): arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type Dev Jain (2): arm64: Enable permission change on arm64 kernel block mappings arm64/pageattr: Propagate return value from __change_memory_common Jeremy Linton (1): arm64: cpufeature: Display the set of cores with a feature Jinjiang Tu (1): arm64: cpufeature: add HISI_HIP13 to BBML2 allow list Kevin Brodsky (1): arm64: mm: Simplify check in arch_kfence_init_pool() Linu Cherian (3): arm64: sysreg: Add BBM_3 arm64: cpufeature: Rename BBML2_NOABORT as BBML3 arm64: cpufeature: Detect BBML3 based on ID_AA64MMFR2_EL1.BBM Lorenzo Stoakes (1): mm/pagewalk: split walk_page_range_novma() into kernel/user parts Mark Rutland (1): arm64: Split kpti_install_ng_mappings() Mikołaj Lenczewski (2): arm64: Add BBM Level 2 cpu feature arm64/mm: Elide tlbi in contpte_convert() under BBML2 Muchun Song (1): mm: pagewalk: assert write mmap lock only for walking the user page tables Ryan Roberts (7): arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context arm64: mm: Optimize range_split_to_ptes() arm64: mm: Tidy up force_pte_mapping() arm64: mm: Fix rodata=full block mapping support for realm guests arm64/mm: generalize PMD_PRESENT_INVALID for all levels arm64: mm: Handle invalid large leaf mappings correctly Yang Shi (1): arm64: mm: support large block mapping when rodata=full arch/arm64/include/asm/cpufeature.h | 32 ++ arch/arm64/include/asm/kfence.h | 3 +- arch/arm64/include/asm/mmu.h | 5 + arch/arm64/include/asm/pgtable-prot.h | 10 +- arch/arm64/include/asm/pgtable.h | 35 +- arch/arm64/kernel/cpufeature.c | 161 +++++++-- arch/arm64/mm/contpte.c | 134 +++++++- arch/arm64/mm/init.c | 6 +- arch/arm64/mm/mmu.c | 474 +++++++++++++++++++++++++- arch/arm64/mm/pageattr.c | 166 ++++++--- arch/arm64/mm/pfn_range_alloc.c | 6 +- arch/arm64/mm/proc.S | 27 +- arch/arm64/mm/trans_pgd.c | 40 +-- arch/arm64/tools/cpucaps | 2 +- arch/arm64/tools/sysreg | 1 + arch/openrisc/kernel/dma.c | 4 +- arch/riscv/mm/pageattr.c | 8 +- arch/sw_64/mm/pageattr.c | 2 +- include/linux/pagewalk.h | 10 +- mm/internal.h | 5 + mm/pagewalk.c | 82 ++++- mm/ptdump.c | 3 +- 22 files changed, 1047 insertions(+), 169 deletions(-) -- 2.43.0

2 25

[PATCH OLK-5.10] wifi: mac80211: validate extension-frame layout before RX
by Gaosheng Cui 07 Sep '26

07 Sep '26

From: Zhao Li <enderaoelyther(a)gmail.com> mainline inclusion from mainline-v7.2-rc4 commit 57d503ce32eccfa7650065ca4c560f7e29a2e676 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17512 CVE: CVE-2026-68470 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Extension frames only have the extension header at the regular 802.11 header offset. The generic RX path can still reach helpers and interface dispatch code that read regular header address fields before unsupported extension subtypes are dropped. mac80211 currently only handles S1G beacon extension frames. Drop other extension subtypes before they can reach regular-header RX processing. For S1G beacons, linearize the SKB with the management-frame path and require the fixed S1G beacon header, including optional fixed fields indicated by frame control, before generic RX dispatch. Route S1G beacons through the station/default-link RX path without regular-header station lookup. Avoid regular-header address reads in the mac80211 RX paths that process S1G extension beacons, including accept-frame, duplicate-detection, address-copy, and MLO address-translation paths. Also make ieee80211_get_bssid() length-safe before returning the S1G source-address pointer. Fixes: 09a740ce352e ("mac80211: receive and process S1G beacons") Cc: stable(a)vger.kernel.org Signed-off-by: Zhao Li <enderaoelyther(a)gmail.com> Link: https://patch.msgid.link/20260611161943.91069-5-enderaoelyther@gmail.com Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Conflicts: net/mac80211/rx.c [Commit 57d503ce32ec built the S1G-beacon handling on top of ieee80211_rx_for_interface() and ieee80211_s1g_optional_len(), which do not exist in this tree (no include/linux/ieee80211-s1g.h). The equivalent logic is inlined into __ieee80211_rx_handle_packet(): S1G beacons are dispatched with a NULL sta (skipping the regular-header addr2 station lookup), and the optional-header length check is expressed with the existing ieee80211_next_tbtt_present(). ieee80211_prepare_and_rx_handle() needs no S1G shortcut because this tree does not have the SW-crypto/MLO address-copy paths.] Co-authored-by: BackportAgent@deepseek-v4-flash Signed-off-by: Hulk Robot <hulkrobot(a)huawei.com> Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- net/mac80211/rx.c | 30 ++++++++++++++++++++++++++---- net/mac80211/util.c | 3 +++ 2 files changed, 29 insertions(+), 4 deletions(-) diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c index 65fea564c9c0..ba25540c4013 100644 --- a/net/mac80211/rx.c +++ b/net/mac80211/rx.c @@ -1429,6 +1429,9 @@ ieee80211_rx_h_check_dup(struct ieee80211_rx_data *rx) if (status->flag & RX_FLAG_DUP_VALIDATED) return RX_CONTINUE; + if (ieee80211_is_ext(hdr->frame_control)) + return RX_CONTINUE; + /* * Drop duplicate 802.11 retransmissions * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery") @@ -4051,8 +4054,12 @@ static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx) struct ieee80211_hdr *hdr = (void *)skb->data; struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); u8 *bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type); - bool multicast = is_multicast_ether_addr(hdr->addr1) || - ieee80211_is_s1g_beacon(hdr->frame_control); + bool multicast; + + if (ieee80211_is_s1g_beacon(hdr->frame_control)) + return sdata->vif.type == NL80211_IFTYPE_STATION && bssid; + + multicast = is_multicast_ether_addr(hdr->addr1); switch (sdata->vif.type) { case NL80211_IFTYPE_STATION: @@ -4639,6 +4646,19 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw, err = -ENOBUFS; else err = skb_linearize(skb); + } else if (ieee80211_is_s1g_beacon(fc)) { + size_t s1g_hdr_len = offsetof(struct ieee80211_ext, + u.s1g_beacon.variable); + + if (ieee80211_next_tbtt_present(fc)) + s1g_hdr_len += 3; + + if (skb->len < s1g_hdr_len) + err = -ENOBUFS; + else + err = skb_linearize(skb); + } else if (ieee80211_is_ext(fc)) { + err = -EINVAL; } else { err = !pskb_may_pull(skb, ieee80211_hdrlen(fc)); } @@ -4714,7 +4734,8 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw, continue; } - rx.sta = sta_info_get_bss(prev, hdr->addr2); + rx.sta = ieee80211_is_s1g_beacon(hdr->frame_control) ? + NULL : sta_info_get_bss(prev, hdr->addr2); rx.sdata = prev; ieee80211_prepare_and_rx_handle(&rx, skb, false); @@ -4722,7 +4743,8 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw, } if (prev) { - rx.sta = sta_info_get_bss(prev, hdr->addr2); + rx.sta = ieee80211_is_s1g_beacon(hdr->frame_control) ? + NULL : sta_info_get_bss(prev, hdr->addr2); rx.sdata = prev; if (ieee80211_prepare_and_rx_handle(&rx, skb, true)) diff --git a/net/mac80211/util.c b/net/mac80211/util.c index e49355cbb1ce..8e27e191945d 100644 --- a/net/mac80211/util.c +++ b/net/mac80211/util.c @@ -67,6 +67,9 @@ u8 *ieee80211_get_bssid(struct ieee80211_hdr *hdr, size_t len, if (ieee80211_is_s1g_beacon(fc)) { struct ieee80211_ext *ext = (void *) hdr; + if (len < offsetofend(struct ieee80211_ext, u.s1g_beacon.sa)) + return NULL; + return ext->u.s1g_beacon.sa; } -- 2.43.0

2 1

[PATCH OLK-5.10] drm/vmwgfx: validate DRAW_PRIMITIVES header size before division
by Hongtao Zhang 07 Sep '26

07 Sep '26

From: Zack Rusin <zack.rusin(a)broadcom.com> stable inclusion from stable-v6.6.151 commit 2666cddf0dd218aa9bd1f99db688d1b532eac21a category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17884 CVE: CVE-2026-74444 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 85891d174707d8bddcec7a888fb4e1d17def34f3 upstream. vmw_cmd_draw() computes maxnum = (header->size - sizeof(cmd->body)) / sizeof(*decl); where header->size is u32 and is taken straight from the user-supplied command stream. When header->size is less than sizeof(cmd->body) the unsigned subtraction wraps to nearly 4 GiB, producing a huge maxnum. Any user-controlled cmd->body.numVertexDecls then passes the bound and the loop dereferences decl[i] far past the end of the kernel command bounce buffer, producing an out-of-bounds read of kernel memory. Reject undersized headers up front. Fixes: 7a73ba7469cb ("drm/vmwgfx: Use TTM handles instead of SIDs as user-space surface handles.") Cc: stable(a)vger.kernel.org Assisted-by: Claude:claude-opus-4.7 Signed-off-by: Zack Rusin <zack.rusin(a)broadcom.com> Reviewed-by: Ian Forbes <ian.forbes(a)broadcom.com> Link: https://patch.msgid.link/20260505222728.519626-7-zack.rusin@broadcom.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Hongtao <zhanghongtao35(a)huawei.com> --- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c index 6e75adaae0bcd..e690751698307 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c @@ -1563,11 +1563,17 @@ static int vmw_cmd_draw(struct vmw_private *dev_priv, uint32_t maxnum; int ret; + cmd = container_of(header, typeof(*cmd), header); + + if (unlikely(header->size < sizeof(cmd->body))) { + VMW_DEBUG_USER("Illegal DRAW_PRIMITIVES header size.\n"); + return -EINVAL; + } + ret = vmw_cmd_cid_check(dev_priv, sw_context, header); if (unlikely(ret != 0)) return ret; - cmd = container_of(header, typeof(*cmd), header); maxnum = (header->size - sizeof(cmd->body)) / sizeof(*decl); if (unlikely(cmd->body.numVertexDecls > maxnum)) { -- 2.43.0

2 1

[PATCH OLK-6.6] serial: amba-pl011: synchronize DMA teardown
by Cai Xinchen 07 Sep '26

07 Sep '26

From: Fan Wu <fanwu01(a)zju.edu.cn> stable inclusion from stable-6.6.154 commit c8c8e895f65fbf71ea6224e27cf8dab91b776e0d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18582 CVE: CVE-2026-80737 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------ [ Upstream commit 440915499231e9db1c361aa45bb702e8fd3b4a32 ] dmaengine_terminate_all() does not wait for a running callback, so the TX callback can still touch the TX buffer after it is freed. The RX poll timer reads the RX buffers without the port lock. Switch to dmaengine_terminate_sync() and delete the RX timer before freeing the buffers. Fixes: ead76f329f77 ("ARM: 6763/1: pl011: add optional RX DMA to PL011 v2") Cc: stable <stable(a)kernel.org> Assisted-by: Codex:gpt-5.6 Signed-off-by: Fan Wu <fanwu01(a)zju.edu.cn> Link: https://patch.msgid.link/20260731085915.326775-4-fanwu01@zju.edu.cn Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> [ changed upstream's `timer_delete_sync()` deletion to match this tree's `del_timer_sync()` spelling at the old call site ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- drivers/tty/serial/amba-pl011.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c index 8aa71a51cdab..4c107556ae31 100644 --- a/drivers/tty/serial/amba-pl011.c +++ b/drivers/tty/serial/amba-pl011.c @@ -1193,7 +1193,7 @@ static void pl011_dma_shutdown(struct uart_amba_port *uap) if (uap->using_tx_dma) { /* In theory, this should already be done by pl011_dma_flush_buffer */ - dmaengine_terminate_all(uap->dmatx.chan); + dmaengine_terminate_sync(uap->dmatx.chan); if (uap->dmatx.queued) { dma_unmap_single(uap->dmatx.chan->device->dev, uap->dmatx.dma, uap->dmatx.len, @@ -1206,12 +1206,12 @@ static void pl011_dma_shutdown(struct uart_amba_port *uap) } if (uap->using_rx_dma) { - dmaengine_terminate_all(uap->dmarx.chan); + if (uap->dmarx.poll_rate) + timer_delete_sync(&uap->dmarx.timer); + dmaengine_terminate_sync(uap->dmarx.chan); /* Clean up the RX DMA */ pl011_dmabuf_free(uap->dmarx.chan, &uap->dmarx.dbuf_a, DMA_FROM_DEVICE); pl011_dmabuf_free(uap->dmarx.chan, &uap->dmarx.dbuf_b, DMA_FROM_DEVICE); - if (uap->dmarx.poll_rate) - del_timer_sync(&uap->dmarx.timer); uap->using_rx_dma = false; } } -- 2.18.0.huawei.25

2 1

[PATCH OLK-6.6] selinux: reject a permission value exceeding the class permission count
by Cai Xinchen 07 Sep '26

07 Sep '26

From: Bryam Vargas <hexlabsecurity(a)proton.me> mainline inclusion from mainline-v7.2-rc7 commit d14b5d0e97fccd27974fedc03b903408872907fd category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18602 CVE: CVE-2026-80755 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- perm_read() bounds a permission value by SEL_VEC_MAX but never by the nprim of the owning class or common, which is taken verbatim from the policy image. security_get_permissions() then writes perms[value - 1] into an nprim-sized kcalloc() array, so a class declaring fewer permissions than its largest permission value drives an out-of-bounds heap write. The top-level symbol tables are validated this way; the nested per-class permission table is not. Reject a permission whose value exceeds nprim, which is already set when perm_read() runs. Well-formed policies are unaffected. Cc: stable(a)vger.kernel.org Fixes: 55fcf09b3fe4 ("selinux: add support for querying object classes and permissions from the running policy") Signed-off-by: Bryam Vargas <hexlabsecurity(a)proton.me> Acked-by: Stephen Smalley <stephen.smalley.work(a)gmail.com> [PM: tweak comment for line length] Signed-off-by: Paul Moore <paul(a)paul-moore.com> Conflicts: security/selinux/ss/policydb.c [Add rc = -ENVAL to init rc before goto bad;] Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- security/selinux/ss/policydb.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c index f70399373588..d58c9b77505a 100644 --- a/security/selinux/ss/policydb.c +++ b/security/selinux/ss/policydb.c @@ -1109,6 +1109,11 @@ static int perm_read(struct policydb *p, struct symtab *s, void *fp) len = le32_to_cpu(buf[0]); perdatum->value = le32_to_cpu(buf[1]); + rc = -EINVAL; + /* indexes an nprim-sized array in security_get_permissions() */ + if (perdatum->value > s->nprim) + goto bad; + rc = str_read(&key, GFP_KERNEL, fp, len); if (rc) goto bad; -- 2.18.0.huawei.25

2 1

[PATCH] serial: amba-pl011: synchronize DMA teardown
by Cai Xinchen 07 Sep '26

07 Sep '26

From: Fan Wu <fanwu01(a)zju.edu.cn> stable inclusion from stable-6.6.154 commit c8c8e895f65fbf71ea6224e27cf8dab91b776e0d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18582 CVE: CVE-2026-80737 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------ [ Upstream commit 440915499231e9db1c361aa45bb702e8fd3b4a32 ] dmaengine_terminate_all() does not wait for a running callback, so the TX callback can still touch the TX buffer after it is freed. The RX poll timer reads the RX buffers without the port lock. Switch to dmaengine_terminate_sync() and delete the RX timer before freeing the buffers. Fixes: ead76f329f77 ("ARM: 6763/1: pl011: add optional RX DMA to PL011 v2") Cc: stable <stable(a)kernel.org> Assisted-by: Codex:gpt-5.6 Signed-off-by: Fan Wu <fanwu01(a)zju.edu.cn> Link: https://patch.msgid.link/20260731085915.326775-4-fanwu01@zju.edu.cn Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> [ changed upstream's `timer_delete_sync()` deletion to match this tree's `del_timer_sync()` spelling at the old call site ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- drivers/tty/serial/amba-pl011.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c index 8aa71a51cdab..4c107556ae31 100644 --- a/drivers/tty/serial/amba-pl011.c +++ b/drivers/tty/serial/amba-pl011.c @@ -1193,7 +1193,7 @@ static void pl011_dma_shutdown(struct uart_amba_port *uap) if (uap->using_tx_dma) { /* In theory, this should already be done by pl011_dma_flush_buffer */ - dmaengine_terminate_all(uap->dmatx.chan); + dmaengine_terminate_sync(uap->dmatx.chan); if (uap->dmatx.queued) { dma_unmap_single(uap->dmatx.chan->device->dev, uap->dmatx.dma, uap->dmatx.len, @@ -1206,12 +1206,12 @@ static void pl011_dma_shutdown(struct uart_amba_port *uap) } if (uap->using_rx_dma) { - dmaengine_terminate_all(uap->dmarx.chan); + if (uap->dmarx.poll_rate) + timer_delete_sync(&uap->dmarx.timer); + dmaengine_terminate_sync(uap->dmarx.chan); /* Clean up the RX DMA */ pl011_dmabuf_free(uap->dmarx.chan, &uap->dmarx.dbuf_a, DMA_FROM_DEVICE); pl011_dmabuf_free(uap->dmarx.chan, &uap->dmarx.dbuf_b, DMA_FROM_DEVICE); - if (uap->dmarx.poll_rate) - del_timer_sync(&uap->dmarx.timer); uap->using_rx_dma = false; } } -- 2.18.0.huawei.25

1 0

[PATCH OLK-5.10] drm/vmwgfx: Validate vmw_surface_metadata::array_size
by Hongtao Zhang 07 Sep '26

07 Sep '26

From: Ian Forbes <ian.forbes(a)broadcom.com> stable inclusion from stable-v5.10.265 commit e949adf2d42678fb391a41db277e2fcb12090566 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17161 CVE: CVE-2026-68446 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit a4f55260f7f7d4dc4d0ee55063dfb0c457b77991 upstream. This field comes from userspace and should be validated against specific limits depending on which Shader Model (SM) is available. Fixes: 504901dbb0b5 ("drm/vmwgfx: Refactor surface_define to use vmw_surface_metadata") Reported-by: Zero Day Initiative <zdi-disclosures(a)trendmicro.com> Cc: stable(a)vger.kernel.org Signed-off-by: Ian Forbes <ian.forbes(a)broadcom.com> Reviewed-by: Maaz Mombasawala <maaz.mombasawala(a)broadcom.com> Signed-off-by: Zack Rusin <zack.rusin(a)broadcom.com> Link: https://patch.msgid.link/20260623193314.506257-1-ian.forbes@broadcom.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Hongtao <zhanghongtao35(a)huawei.com> --- drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-) diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c index f1a51371de5b1..0005016a9be75 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c @@ -101,7 +101,7 @@ static int vmw_gb_surface_unbind(struct vmw_resource *res, static int vmw_gb_surface_destroy(struct vmw_resource *res); static int vmw_gb_surface_define_internal(struct drm_device *dev, - struct drm_vmw_gb_surface_create_ext_req *req, + const struct drm_vmw_gb_surface_create_ext_req *req, struct drm_vmw_gb_surface_create_rep *rep, struct drm_file *file_priv); static int @@ -1450,7 +1450,7 @@ int vmw_gb_surface_reference_ext_ioctl(struct drm_device *dev, void *data, */ static int vmw_gb_surface_define_internal(struct drm_device *dev, - struct drm_vmw_gb_surface_create_ext_req *req, + const struct drm_vmw_gb_surface_create_ext_req *req, struct drm_vmw_gb_surface_create_rep *rep, struct drm_file *file_priv) { @@ -1469,9 +1469,21 @@ vmw_gb_surface_define_internal(struct drm_device *dev, req->base.svga3d_flags); /* array_size must be null for non-GL3 host. */ - if (req->base.array_size > 0 && !has_sm4_context(dev_priv)) { - VMW_DEBUG_USER("SM4 surface not supported.\n"); - return -EINVAL; + if (req->base.array_size > 0) { + if (has_sm5_context(dev_priv)) { + if (req->base.array_size > SVGA3D_SM5_MAX_SURFACE_ARRAYSIZE) { + VMW_DEBUG_USER("Invalid Surface Array Size.\n"); + return -EINVAL; + } + } else if (has_sm4_context(dev_priv)) { + if (req->base.array_size > SVGA3D_SM4_MAX_SURFACE_ARRAYSIZE) { + VMW_DEBUG_USER("Invalid Surface Array Size.\n"); + return -EINVAL; + } + } else { + VMW_DEBUG_USER("SM4+ surface not supported.\n"); + return -EINVAL; + } } if (!has_sm4_1_context(dev_priv)) { -- 2.43.0

2 1

[PATCH OLK-6.6 0/2] PCI: Check ROM header and data structure addr before accessing
by Hongtao Zhang 07 Sep '26

07 Sep '26

*** BLURB HERE *** Guixin Liu (2): PCI: Introduce named defines for PCI ROM PCI: Check ROM header and data structure addr before accessing drivers/pci/rom.c | 149 +++++++++++++++++++++++++++++++++++++++------- 1 file changed, 126 insertions(+), 23 deletions(-) -- 2.43.0

2 3