- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing
by Pu Lehui 19 Mar '26

19 Mar '26

From: Fuad Tabba <tabba(a)google.com> mainline inclusion from mainline-v7.0-rc2 commit ef06fd16d48704eac868441d98d4ef083d8f3d07 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8762 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- struct bpf_plt contains a u64 target field. Currently, the BPF JIT allocator requests an alignment of 4 bytes (sizeof(u32)) for the JIT buffer. Because the base address of the JIT buffer can be 4-byte aligned (e.g., ending in 0x4 or 0xc), the relative padding logic in build_plt() fails to ensure that target lands on an 8-byte boundary. This leads to two issues: 1. UBSAN reports misaligned-access warnings when dereferencing the structure. 2. More critically, target is updated concurrently via WRITE_ONCE() in bpf_arch_text_poke() while the JIT'd code executes ldr. On arm64, 64-bit loads/stores are only guaranteed to be single-copy atomic if they are 64-bit aligned. A misaligned target risks a torn read, causing the JIT to jump to a corrupted address. Fix this by increasing the allocation alignment requirement to 8 bytes (sizeof(u64)) in bpf_jit_binary_pack_alloc(). This anchors the base of the JIT buffer to an 8-byte boundary, allowing the relative padding math in build_plt() to correctly align the target field. Fixes: b2ad54e1533e ("bpf, arm64: Implement bpf_arch_text_poke() for arm64") Signed-off-by: Fuad Tabba <tabba(a)google.com> Acked-by: Will Deacon <will(a)kernel.org> Link: https://lore.kernel.org/r/20260226075525.233321-1-tabba@google.com Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Conflicts: arch/arm64/net/bpf_jit_comp.c [The conflicts were due to not merge commit 1dad391daef1] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- arch/arm64/net/bpf_jit_comp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c index f98ae8bf4e19..2494a5c96489 100644 --- a/arch/arm64/net/bpf_jit_comp.c +++ b/arch/arm64/net/bpf_jit_comp.c @@ -1648,7 +1648,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) extable_offset = round_up(prog_size + PLT_TARGET_SIZE, extable_align); image_size = extable_offset + extable_size; header = bpf_jit_binary_alloc(image_size, &image_ptr, - sizeof(u32), jit_fill_hole); + sizeof(u64), jit_fill_hole); if (header == NULL) { prog = orig_prog; goto out_off; -- 2.34.1

2 1

[PATCH OLK-6.6] mm/shrinker: Implementation of register_shrinker() and unregister_shrinker()
by Zhang Qilong 19 Mar '26

19 Mar '26

hulk inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/8743 -------------------------------- The commit 6a317cb001d1 ("mm: shrinker: remove old APIs") removed old shrinker API. In order to maintain the compatibility of the KABI interface, it is necessary to adapt the old interface to connect to the new shrinking function. Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- include/linux/shrinker.h | 5 +++-- mm/vmscan.c | 44 +++++++++++++++++++++++++++++++++++----- 2 files changed, 42 insertions(+), 7 deletions(-) diff --git a/include/linux/shrinker.h b/include/linux/shrinker.h index 7091c5d21a9f..3467b18a8dbb 100644 --- a/include/linux/shrinker.h +++ b/include/linux/shrinker.h @@ -72,10 +72,11 @@ struct shrink_control { }; #define SHRINK_STOP (~0UL) #define SHRINK_EMPTY (~0UL - 1) +struct shrinker; /* * A callback you can register to apply pressure to ageable caches. * * @count_objects should return the number of freeable items in the cache. If * there are no objects to free, it should return SHRINK_EMPTY, while 0 is @@ -118,11 +119,11 @@ struct shrinker_v2 { struct dentry *debugfs_entry; #endif /* objs pending delete, per node */ atomic_long_t *nr_deferred; - KABI_RESERVE(1) + KABI_USE(1, struct shrinker *v1) KABI_RESERVE(2) /* * The reference count of this shrinker. Registered shrinker have an * initial refcount of 1, then the lookup operations are now allowed @@ -161,11 +162,11 @@ struct shrinker { const char *name; struct dentry *debugfs_entry; #endif atomic_long_t *nr_deferred; - KABI_RESERVE(1) + KABI_USE(1, struct shrinker_v2 *v2) KABI_RESERVE(2) }; #define DEFAULT_SEEKS 2 /* A good number if you don't know better. */ diff --git a/mm/vmscan.c b/mm/vmscan.c index 9e4aedbfd85e..cf6b9e6dc8cd 100644 --- a/mm/vmscan.c +++ b/mm/vmscan.c @@ -7608,22 +7608,56 @@ void check_move_unevictable_folios(struct folio_batch *fbatch) count_vm_events(UNEVICTABLE_PGSCANNED, pgscanned); } } EXPORT_SYMBOL_GPL(check_move_unevictable_folios); +static unsigned long shrinker_v2_to_v1_count_objects(struct shrinker_v2 *shk_v2, + struct shrink_control *sc) +{ + if (shk_v2->v1) + return shk_v2->v1->count_objects(shk_v2->v1, sc); + + return 0; +} + +static unsigned long shrinker_v2_to_v1_scan_objects(struct shrinker_v2 *shk_v2, + struct shrink_control *sc) +{ + if (shk_v2->v1) + return shk_v2->v1->count_objects(shk_v2->v1, sc); + + return SHRINK_EMPTY; +} + int register_shrinker(struct shrinker *shrinker, const char *fmt, ...) { - pr_warn_once("%s interface is deprecated. Please use instead shrinker_register()\n", - __func__); - return -ENOSYS; + struct shrinker_v2 *shk_v2; + + shk_v2 = shrinker_alloc(shrinker->flags, fmt); + if (!shk_v2) + return -ENOMEM; + + shk_v2->count_objects = shrinker_v2_to_v1_count_objects; + shk_v2->scan_objects = shrinker_v2_to_v1_scan_objects; + shk_v2->batch = shrinker->batch; + shk_v2->seeks = shrinker->seeks; + shk_v2->flags |= shrinker->flags; + shk_v2->v1 = shrinker; + + shrinker_register(shk_v2); + shrinker->v2 = shk_v2; + + return 0; } EXPORT_SYMBOL(register_shrinker); void unregister_shrinker(struct shrinker *shrinker) { - pr_warn_once("%s interface is deprecated. Please use instead shrinker_free()\n", - __func__); + if (shrinker->v2) { + shrinker_free(shrinker->v2); + shrinker->v2 = NULL; + } } EXPORT_SYMBOL(unregister_shrinker); void synchronize_shrinkers(void) { -- 2.43.0

2 1

[PATCH OLK-5.10] mm/shrinker: Implementation of register_shrinker() and unregister_shrinker()
by Zhang Qilong 19 Mar '26

19 Mar '26

hulk inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/8743 -------------------------------- The commit 6a317cb001d1 ("mm: shrinker: remove old APIs") removed old shrinker API. In order to maintain the compatibility of the KABI interface, it is necessary to adapt the old interface to connect to the new shrinking function. Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- include/linux/shrinker.h | 5 +++-- mm/vmscan.c | 44 +++++++++++++++++++++++++++++++++++----- 2 files changed, 42 insertions(+), 7 deletions(-) diff --git a/include/linux/shrinker.h b/include/linux/shrinker.h index 7091c5d21a9f..3467b18a8dbb 100644 --- a/include/linux/shrinker.h +++ b/include/linux/shrinker.h @@ -72,10 +72,11 @@ struct shrink_control { }; #define SHRINK_STOP (~0UL) #define SHRINK_EMPTY (~0UL - 1) +struct shrinker; /* * A callback you can register to apply pressure to ageable caches. * * @count_objects should return the number of freeable items in the cache. If * there are no objects to free, it should return SHRINK_EMPTY, while 0 is @@ -118,11 +119,11 @@ struct shrinker_v2 { struct dentry *debugfs_entry; #endif /* objs pending delete, per node */ atomic_long_t *nr_deferred; - KABI_RESERVE(1) + KABI_USE(1, struct shrinker *v1) KABI_RESERVE(2) /* * The reference count of this shrinker. Registered shrinker have an * initial refcount of 1, then the lookup operations are now allowed @@ -161,11 +162,11 @@ struct shrinker { const char *name; struct dentry *debugfs_entry; #endif atomic_long_t *nr_deferred; - KABI_RESERVE(1) + KABI_USE(1, struct shrinker_v2 *v2) KABI_RESERVE(2) }; #define DEFAULT_SEEKS 2 /* A good number if you don't know better. */ diff --git a/mm/vmscan.c b/mm/vmscan.c index 9e4aedbfd85e..cf6b9e6dc8cd 100644 --- a/mm/vmscan.c +++ b/mm/vmscan.c @@ -7608,22 +7608,56 @@ void check_move_unevictable_folios(struct folio_batch *fbatch) count_vm_events(UNEVICTABLE_PGSCANNED, pgscanned); } } EXPORT_SYMBOL_GPL(check_move_unevictable_folios); +static unsigned long shrinker_v2_to_v1_count_objects(struct shrinker_v2 *shk_v2, + struct shrink_control *sc) +{ + if (shk_v2->v1) + return shk_v2->v1->count_objects(shk_v2->v1, sc); + + return 0; +} + +static unsigned long shrinker_v2_to_v1_scan_objects(struct shrinker_v2 *shk_v2, + struct shrink_control *sc) +{ + if (shk_v2->v1) + return shk_v2->v1->count_objects(shk_v2->v1, sc); + + return SHRINK_EMPTY; +} + int register_shrinker(struct shrinker *shrinker, const char *fmt, ...) { - pr_warn_once("%s interface is deprecated. Please use instead shrinker_register()\n", - __func__); - return -ENOSYS; + struct shrinker_v2 *shk_v2; + + shk_v2 = shrinker_alloc(shrinker->flags, fmt); + if (!shk_v2) + return -ENOMEM; + + shk_v2->count_objects = shrinker_v2_to_v1_count_objects; + shk_v2->scan_objects = shrinker_v2_to_v1_scan_objects; + shk_v2->batch = shrinker->batch; + shk_v2->seeks = shrinker->seeks; + shk_v2->flags |= shrinker->flags; + shk_v2->v1 = shrinker; + + shrinker_register(shk_v2); + shrinker->v2 = shk_v2; + + return 0; } EXPORT_SYMBOL(register_shrinker); void unregister_shrinker(struct shrinker *shrinker) { - pr_warn_once("%s interface is deprecated. Please use instead shrinker_free()\n", - __func__); + if (shrinker->v2) { + shrinker_free(shrinker->v2); + shrinker->v2 = NULL; + } } EXPORT_SYMBOL(unregister_shrinker); void synchronize_shrinkers(void) { -- 2.43.0

2 1

openEuler Kernel SIG双周例会
by openEuler conference 18 Mar '26

18 Mar '26

您好！ Kernel 邀请您参加 2026-03-20 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议发起人： LiaoTao_Wave 会议内容： 1. 进展update 2. 议题征集中（新增议题可直接填报至会议纪要看板）会议链接：https://meeting.huaweicloud.com:36443/#/j/986250028 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2026-03-20 14:00 The subject of the conference is openEuler Kernel SIG双周例会 The sponsor of the conference is LiaoTao_Wave Summary: 1. 进展update 2. 议题征集中（新增议题可直接填报至会议纪要看板） You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/986250028 Add topics at https://etherpad.openeuler.org/p/Kernel-meetings More information: https://www.openeuler.org/en/

1 0

[PATCH OLK-5.10] mm: make sure freeram is smaller than totalram
by Liu Shixin 17 Mar '26

17 Mar '26

From: Yang Yingliang <yangyingliang(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8748 CVE: NA -------------------------------------------------- The memory stat is not done in real time, it have some gap with real value. In CPU-less NUMA node, the values of MemTotal and MemFree can be nearly equal, the gap make cause MemFree is bigger than MemTotal, it leads MemUsed is negative which print as a large positive number. cat /sys/devices/system/node/node17/meminfo Node 17 MemTotal: 4194304 kB Node 17 MemFree: 4195552 kB Node 17 MemUsed: 18446744073709550368 kB Node 17 Active: 52 kB Node 17 Inactive: 320 kB Node 17 Active(anon): 0 kB Node 17 Inactive(anon): 0 kB Node 17 Active(file): 52 kB Node 17 Inactive(file): 320 kB Node 17 Unevictable: 0 kB Node 17 Mlocked: 0 kB Node 17 Dirty: 0 kB Node 17 Writeback: 0 kB Node 17 FilePages: 372 kB Node 17 Mapped: 320 kB Node 17 AnonPages: 0 kB Node 17 Shmem: 0 kB Node 17 KernelStack: 0 kB Node 17 PageTables: 0 kB Node 17 NFS_Unstable: 0 kB Node 17 Bounce: 0 kB Node 17 WritebackTmp: 0 kB Node 17 KReclaimable: 0 kB Node 17 Slab: 0 kB Node 17 SReclaimable: 0 kB Node 17 SUnreclaim: 0 kB Node 17 AnonHugePages: 79872 kB Node 17 ShmemHugePages: 0 kB Node 17 ShmemPmdMapped: 0 kB Node 17 FileHugePages: 0 kB Node 17 FilePmdMapped: 0 kB Node 17 HugePages_Total: 0 Node 17 HugePages_Free: 0 Node 17 HugePages_Surp: 0 To avoid this exception, make MemFree equals MemTotal, when MemFree is bigger than MemTotal Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- mm/page_alloc.c | 1 + 1 file changed, 1 insertion(+) diff --git a/mm/page_alloc.c b/mm/page_alloc.c index 72d5303f8000..02db21de93aa 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -5837,6 +5837,7 @@ void si_meminfo_node(struct sysinfo *val, int nid) val->totalram = managed_pages; val->sharedram = node_page_state(pgdat, NR_SHMEM); val->freeram = sum_zone_node_page_state(nid, NR_FREE_PAGES); + val->freeram = min(val->freeram, val->totalram); #ifdef CONFIG_HIGHMEM for (zone_type = 0; zone_type < MAX_NR_ZONES; zone_type++) { struct zone *zone = &pgdat->node_zones[zone_type]; -- 2.33.0

2 1

[PATCH OLK-5.10] mm: make sure freeram is smaller than totalram
by Liu Shixin 17 Mar '26

17 Mar '26

From: Yang Yingliang <yangyingliang(a)huawei.com> The memory stat is not done in real time, it have some gap with real value. In CPU-less NUMA node, the values of MemTotal and MemFree can be nearly equal, the gap make cause MemFree is bigger than MemTotal, it leads MemUsed is negative which print as a large positive number. cat /sys/devices/system/node/node17/meminfo Node 17 MemTotal: 4194304 kB Node 17 MemFree: 4195552 kB Node 17 MemUsed: 18446744073709550368 kB Node 17 Active: 52 kB Node 17 Inactive: 320 kB Node 17 Active(anon): 0 kB Node 17 Inactive(anon): 0 kB Node 17 Active(file): 52 kB Node 17 Inactive(file): 320 kB Node 17 Unevictable: 0 kB Node 17 Mlocked: 0 kB Node 17 Dirty: 0 kB Node 17 Writeback: 0 kB Node 17 FilePages: 372 kB Node 17 Mapped: 320 kB Node 17 AnonPages: 0 kB Node 17 Shmem: 0 kB Node 17 KernelStack: 0 kB Node 17 PageTables: 0 kB Node 17 NFS_Unstable: 0 kB Node 17 Bounce: 0 kB Node 17 WritebackTmp: 0 kB Node 17 KReclaimable: 0 kB Node 17 Slab: 0 kB Node 17 SReclaimable: 0 kB Node 17 SUnreclaim: 0 kB Node 17 AnonHugePages: 79872 kB Node 17 ShmemHugePages: 0 kB Node 17 ShmemPmdMapped: 0 kB Node 17 FileHugePages: 0 kB Node 17 FilePmdMapped: 0 kB Node 17 HugePages_Total: 0 Node 17 HugePages_Free: 0 Node 17 HugePages_Surp: 0 To avoid this exception, make MemFree equals MemTotal, when MemFree is bigger than MemTotal Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- mm/page_alloc.c | 1 + 1 file changed, 1 insertion(+) diff --git a/mm/page_alloc.c b/mm/page_alloc.c index 72d5303f8000..02db21de93aa 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -5837,6 +5837,7 @@ void si_meminfo_node(struct sysinfo *val, int nid) val->totalram = managed_pages; val->sharedram = node_page_state(pgdat, NR_SHMEM); val->freeram = sum_zone_node_page_state(nid, NR_FREE_PAGES); + val->freeram = min(val->freeram, val->totalram); #ifdef CONFIG_HIGHMEM for (zone_type = 0; zone_type < MAX_NR_ZONES; zone_type++) { struct zone *zone = &pgdat->node_zones[zone_type]; -- 2.33.0

2 1

[PATCH OLK-5.10] l2tp: fix double dst_release() on sk_dst_cache race
by Li Xiasong 17 Mar '26

17 Mar '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8696 Reference: https://lore.kernel.org/netdev/20251215145537.5085-1-m.lobanov@rosa.ru/ ---------------------------------------- A reproducible rcuref - imbalanced put() warning is observed under IPv6 L2TP (pppol2tp) traffic with blackhole routes, indicating an imbalance in dst reference counting for routes cached in sk->sk_dst_cache and pointing to a subtle lifetime/synchronization issue between the helpers that validate and drop cached dst entries. rcuref - imbalanced put() WARNING: CPU: 0 PID: 899 at lib/rcuref.c:266 rcuref_put_slowpath+0x1ce/0x240 lib/rcuref.c:266 Modules linked in: CPSocket connected tcp:127.0.0.1:48148,server=on <-> 127.0.0.1:33750 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:rcuref_put_slowpath+0x1ce/0x240 lib/rcuref.c:266 Call Trace: <TASK> __rcuref_put include/linux/rcuref.h:97 [inline] rcuref_put include/linux/rcuref.h:153 [inline] dst_release+0x291/0x310 net/core/dst.c:167 __sk_dst_check+0x2d4/0x350 net/core/sock.c:604 __inet6_csk_dst_check net/ipv6/inet6_connection_sock.c:76 [inline] inet6_csk_route_socket+0x6ed/0x10c0 net/ipv6/inet6_connection_sock.c:104 inet6_csk_xmit+0x12f/0x740 net/ipv6/inet6_connection_sock.c:121 l2tp_xmit_queue net/l2tp/l2tp_core.c:1214 [inline] l2tp_xmit_core net/l2tp/l2tp_core.c:1309 [inline] l2tp_xmit_skb+0x1404/0x1910 net/l2tp/l2tp_core.c:1325 pppol2tp_sendmsg+0x3ca/0x550 net/l2tp/l2tp_ppp.c:302 sock_sendmsg_nosec net/socket.c:729 [inline] __sock_sendmsg net/socket.c:744 [inline] ____sys_sendmsg+0xab2/0xc70 net/socket.c:2609 ___sys_sendmsg+0x11d/0x1c0 net/socket.c:2663 __sys_sendmmsg+0x188/0x450 net/socket.c:2749 __do_sys_sendmmsg net/socket.c:2778 [inline] __se_sys_sendmmsg net/socket.c:2775 [inline] __x64_sys_sendmmsg+0x98/0x100 net/socket.c:2775 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x64/0x140 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fe6960ec719 </TASK> The race occurs between the lockless UDPv6 transmit path (udpv6_sendmsg() -> sk_dst_check()) and the locked L2TP/pppol2tp transmit path (pppol2tp_sendmsg() -> l2tp_xmit_skb() -> ... -> inet6_csk_xmit() → __sk_dst_check()), when both handle the same obsolete dst from sk->sk_dst_cache: the UDPv6 side takes an extra reference and atomically steals and releases the cached dst, while the L2TP side, using a stale cached pointer, still calls dst_release() on it, and together these updates produce an extra final dst_release() on that dst, triggering rcuref - imbalanced put(). The Race Condition: Initial: sk->sk_dst_cache = dst ref(dst) = 1 Thread 1: sk_dst_check() Thread 2: __sk_dst_check() ------------------------ ---------------------------- sk_dst_get(sk): rcu_read_lock() dst = rcu_dereference(sk->sk_dst_cache) rcuref_get(dst) succeeds rcu_read_unlock() // ref = 2 dst = __sk_dst_get(sk) // reads same dst from sk_dst_cache // ref still = 2 (no extra get) [both see dst obsolete & check() == NULL] sk_dst_reset(sk): old = xchg(&sk->sk_dst_cache, NULL) // old = dst dst_release(old) // drop cached ref // ref: 2 -> 1 RCU_INIT_POINTER(sk->sk_dst_cache, NULL) // cache already NULL after xchg dst_release(dst) // ref: 1 -> 0 dst_release(dst) // tries to drop its own ref after final put // rcuref_put_slowpath() -> "rcuref - imbalanced put()" Make L2TP's IPv6 transmit path stop using inet6_csk_xmit() (and thus __sk_dst_check()) and instead open-code the same routing and transmit sequence using the existing sk_dst_check() with dst reference counting and ip6_dst_lookup_flow(). The new code builds a flowi6 from the socket fields in the same way as inet6_csk_route_socket(), then performs dst lookup using sk_dst_check() with proper reference counting, attaches the resulting dst to the skb via skb_dst_set(), and finally invokes ip6_xmit() for transmission. This makes both the UDPv6 and L2TP IPv6 paths use the same dst-cache handling logic for a given socket and removes the possibility that the lockless sk_dst_check() and the locked __sk_dst_check() concurrently drop the same cached dst and trigger the rcuref - imbalanced put() warning under concurrent traffic. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Fixes: b0270e91014d ("ipv4: add a sock pointer to ip_queue_xmit()") Signed-off-by: Li Xiasong <lixiasong1(a)huawei.com> --- net/l2tp/l2tp_core.c | 60 +++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 57 insertions(+), 3 deletions(-) diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c index 97350350478d..80a20c079a9a 100644 --- a/net/l2tp/l2tp_core.c +++ b/net/l2tp/l2tp_core.c @@ -995,19 +995,73 @@ static int l2tp_build_l2tpv3_header(struct l2tp_session *session, void *buf) return bufp - optr; } +#if IS_ENABLED(CONFIG_IPV6) +static int l2tp_xmit_ipv6(struct sock *sk, struct sk_buff *skb) +{ + struct ipv6_pinfo *np = inet6_sk(sk); + struct inet_sock *inet = inet_sk(sk); + struct in6_addr *final_p, final; + struct dst_entry *dst; + struct flowi6 fl6; + int err; + + memset(&fl6, 0, sizeof(fl6)); + fl6.flowi6_proto = sk->sk_protocol; + fl6.daddr = sk->sk_v6_daddr; + fl6.saddr = np->saddr; + fl6.flowlabel = np->flow_label; + IP6_ECN_flow_xmit(sk, fl6.flowlabel); + + fl6.flowi6_oif = sk->sk_bound_dev_if; + fl6.flowi6_mark = sk->sk_mark; + fl6.fl6_sport = inet->inet_sport; + fl6.fl6_dport = inet->inet_dport; + fl6.flowi6_uid = sk->sk_uid; + + security_sk_classify_flow(sk, flowi6_to_flowi_common(&fl6)); + + rcu_read_lock(); + final_p = fl6_update_dst(&fl6, rcu_dereference(np->opt), &final); + rcu_read_unlock(); + + dst = sk_dst_check(sk, np->dst_cookie); + if (!dst) { + dst = ip6_dst_lookup_flow(sock_net(sk), sk, &fl6, final_p); + if (IS_ERR(dst)) { + sk->sk_err_soft = -PTR_ERR(dst); + sk->sk_route_caps = 0; + kfree_skb(skb); + return PTR_ERR(dst); + } + + ip6_dst_store(sk, dst_clone(dst), NULL, NULL); + } + + skb_dst_set(skb, dst); + fl6.daddr = sk->sk_v6_daddr; + + rcu_read_lock(); + err = ip6_xmit(sk, skb, &fl6, sk->sk_mark, rcu_dereference(np->opt), + np->tclass, sk->sk_priority); + rcu_read_unlock(); + return err; +} +#endif + /* Queue the packet to IP for output: tunnel socket lock must be held */ static int l2tp_xmit_queue(struct l2tp_tunnel *tunnel, struct sk_buff *skb, struct flowi *fl) { int err; + struct sock *sk = tunnel->sock; skb->ignore_df = 1; skb_dst_drop(skb); #if IS_ENABLED(CONFIG_IPV6) - if (l2tp_sk_is_v6(tunnel->sock)) - err = inet6_csk_xmit(tunnel->sock, skb, NULL); + if (l2tp_sk_is_v6(sk)) + err = l2tp_xmit_ipv6(sk, skb); else #endif - err = ip_queue_xmit(tunnel->sock, skb, fl); + err = ip_queue_xmit(sk, skb, fl); return err >= 0 ? NET_XMIT_SUCCESS : NET_XMIT_DROP; } -- 2.34.1

2 1

[PATCH OLK-6.6] l2tp: fix double dst_release() on sk_dst_cache race
by Li Xiasong 17 Mar '26

17 Mar '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8696 Reference: https://lore.kernel.org/netdev/20251215145537.5085-1-m.lobanov@rosa.ru/ ---------------------------------------- A reproducible rcuref - imbalanced put() warning is observed under IPv6 L2TP (pppol2tp) traffic with blackhole routes, indicating an imbalance in dst reference counting for routes cached in sk->sk_dst_cache and pointing to a subtle lifetime/synchronization issue between the helpers that validate and drop cached dst entries. rcuref - imbalanced put() WARNING: CPU: 0 PID: 899 at lib/rcuref.c:266 rcuref_put_slowpath+0x1ce/0x240 lib/rcuref.c:266 Modules linked in: CPSocket connected tcp:127.0.0.1:48148,server=on <-> 127.0.0.1:33750 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:rcuref_put_slowpath+0x1ce/0x240 lib/rcuref.c:266 Call Trace: <TASK> __rcuref_put include/linux/rcuref.h:97 [inline] rcuref_put include/linux/rcuref.h:153 [inline] dst_release+0x291/0x310 net/core/dst.c:167 __sk_dst_check+0x2d4/0x350 net/core/sock.c:604 __inet6_csk_dst_check net/ipv6/inet6_connection_sock.c:76 [inline] inet6_csk_route_socket+0x6ed/0x10c0 net/ipv6/inet6_connection_sock.c:104 inet6_csk_xmit+0x12f/0x740 net/ipv6/inet6_connection_sock.c:121 l2tp_xmit_queue net/l2tp/l2tp_core.c:1214 [inline] l2tp_xmit_core net/l2tp/l2tp_core.c:1309 [inline] l2tp_xmit_skb+0x1404/0x1910 net/l2tp/l2tp_core.c:1325 pppol2tp_sendmsg+0x3ca/0x550 net/l2tp/l2tp_ppp.c:302 sock_sendmsg_nosec net/socket.c:729 [inline] __sock_sendmsg net/socket.c:744 [inline] ____sys_sendmsg+0xab2/0xc70 net/socket.c:2609 ___sys_sendmsg+0x11d/0x1c0 net/socket.c:2663 __sys_sendmmsg+0x188/0x450 net/socket.c:2749 __do_sys_sendmmsg net/socket.c:2778 [inline] __se_sys_sendmmsg net/socket.c:2775 [inline] __x64_sys_sendmmsg+0x98/0x100 net/socket.c:2775 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x64/0x140 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fe6960ec719 </TASK> The race occurs between the lockless UDPv6 transmit path (udpv6_sendmsg() -> sk_dst_check()) and the locked L2TP/pppol2tp transmit path (pppol2tp_sendmsg() -> l2tp_xmit_skb() -> ... -> inet6_csk_xmit() → __sk_dst_check()), when both handle the same obsolete dst from sk->sk_dst_cache: the UDPv6 side takes an extra reference and atomically steals and releases the cached dst, while the L2TP side, using a stale cached pointer, still calls dst_release() on it, and together these updates produce an extra final dst_release() on that dst, triggering rcuref - imbalanced put(). The Race Condition: Initial: sk->sk_dst_cache = dst ref(dst) = 1 Thread 1: sk_dst_check() Thread 2: __sk_dst_check() ------------------------ ---------------------------- sk_dst_get(sk): rcu_read_lock() dst = rcu_dereference(sk->sk_dst_cache) rcuref_get(dst) succeeds rcu_read_unlock() // ref = 2 dst = __sk_dst_get(sk) // reads same dst from sk_dst_cache // ref still = 2 (no extra get) [both see dst obsolete & check() == NULL] sk_dst_reset(sk): old = xchg(&sk->sk_dst_cache, NULL) // old = dst dst_release(old) // drop cached ref // ref: 2 -> 1 RCU_INIT_POINTER(sk->sk_dst_cache, NULL) // cache already NULL after xchg dst_release(dst) // ref: 1 -> 0 dst_release(dst) // tries to drop its own ref after final put // rcuref_put_slowpath() -> "rcuref - imbalanced put()" Make L2TP's IPv6 transmit path stop using inet6_csk_xmit() (and thus __sk_dst_check()) and instead open-code the same routing and transmit sequence using the existing sk_dst_check() with dst reference counting and ip6_dst_lookup_flow(). The new code builds a flowi6 from the socket fields in the same way as inet6_csk_route_socket(), then performs dst lookup using sk_dst_check() with proper reference counting, attaches the resulting dst to the skb via skb_dst_set(), and finally invokes ip6_xmit() for transmission. This makes both the UDPv6 and L2TP IPv6 paths use the same dst-cache handling logic for a given socket and removes the possibility that the lockless sk_dst_check() and the locked __sk_dst_check() concurrently drop the same cached dst and trigger the rcuref - imbalanced put() warning under concurrent traffic. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Fixes: b0270e91014d ("ipv4: add a sock pointer to ip_queue_xmit()") Signed-off-by: Li Xiasong <lixiasong1(a)huawei.com> --- net/l2tp/l2tp_core.c | 60 +++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 57 insertions(+), 3 deletions(-) diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c index f85b383811d5..79a5f635b049 100644 --- a/net/l2tp/l2tp_core.c +++ b/net/l2tp/l2tp_core.c @@ -1000,19 +1000,73 @@ static int l2tp_build_l2tpv3_header(struct l2tp_session *session, void *buf) return bufp - optr; } +#if IS_ENABLED(CONFIG_IPV6) +static int l2tp_xmit_ipv6(struct sock *sk, struct sk_buff *skb) +{ + struct ipv6_pinfo *np = inet6_sk(sk); + struct inet_sock *inet = inet_sk(sk); + struct in6_addr *final_p, final; + struct dst_entry *dst; + struct flowi6 fl6; + int err; + + memset(&fl6, 0, sizeof(fl6)); + fl6.flowi6_proto = sk->sk_protocol; + fl6.daddr = sk->sk_v6_daddr; + fl6.saddr = np->saddr; + fl6.flowlabel = np->flow_label; + IP6_ECN_flow_xmit(sk, fl6.flowlabel); + + fl6.flowi6_oif = sk->sk_bound_dev_if; + fl6.flowi6_mark = sk->sk_mark; + fl6.fl6_sport = inet->inet_sport; + fl6.fl6_dport = inet->inet_dport; + fl6.flowi6_uid = sk->sk_uid; + + security_sk_classify_flow(sk, flowi6_to_flowi_common(&fl6)); + + rcu_read_lock(); + final_p = fl6_update_dst(&fl6, rcu_dereference(np->opt), &final); + rcu_read_unlock(); + + dst = sk_dst_check(sk, np->dst_cookie); + if (!dst) { + dst = ip6_dst_lookup_flow(sock_net(sk), sk, &fl6, final_p); + if (IS_ERR(dst)) { + WRITE_ONCE(sk->sk_err_soft, -PTR_ERR(dst)); + sk->sk_route_caps = 0; + kfree_skb(skb); + return PTR_ERR(dst); + } + + ip6_dst_store(sk, dst_clone(dst), NULL, NULL); + } + + skb_dst_set(skb, dst); + fl6.daddr = sk->sk_v6_daddr; + + rcu_read_lock(); + err = ip6_xmit(sk, skb, &fl6, sk->sk_mark, rcu_dereference(np->opt), + np->tclass, sk->sk_priority); + rcu_read_unlock(); + return err; +} +#endif + /* Queue the packet to IP for output: tunnel socket lock must be held */ static int l2tp_xmit_queue(struct l2tp_tunnel *tunnel, struct sk_buff *skb, struct flowi *fl) { int err; + struct sock *sk = tunnel->sock; skb->ignore_df = 1; skb_dst_drop(skb); #if IS_ENABLED(CONFIG_IPV6) - if (l2tp_sk_is_v6(tunnel->sock)) - err = inet6_csk_xmit(tunnel->sock, skb, NULL); + if (l2tp_sk_is_v6(sk)) + err = l2tp_xmit_ipv6(sk, skb); else #endif - err = ip_queue_xmit(tunnel->sock, skb, fl); + err = ip_queue_xmit(sk, skb, fl); return err >= 0 ? NET_XMIT_SUCCESS : NET_XMIT_DROP; } -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] mptcp: fix soft lockup in mptcp_recvmsg()
by Li Xiasong 17 Mar '26

17 Mar '26

Li Xiasong (1): mptcp: fix soft lockup in mptcp_recvmsg() Paolo Abeni (1): mptcp: fix MSG_PEEK stream corruption net/mptcp/protocol.c | 44 +++++++++++++++++++++++++++++++++----------- 1 file changed, 33 insertions(+), 11 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] l2tp: fix double dst_release() on sk_dst_cache race
by Li Xiasong 17 Mar '26

17 Mar '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8696 Reference: https://lore.kernel.org/netdev/20251215145537.5085-1-m.lobanov@rosa.ru/ ---------------------------------------- A reproducible rcuref - imbalanced put() warning is observed under IPv6 L2TP (pppol2tp) traffic with blackhole routes, indicating an imbalance in dst reference counting for routes cached in sk->sk_dst_cache and pointing to a subtle lifetime/synchronization issue between the helpers that validate and drop cached dst entries. rcuref - imbalanced put() WARNING: CPU: 0 PID: 899 at lib/rcuref.c:266 rcuref_put_slowpath+0x1ce/0x240 lib/rcuref.c:266 Modules linked in: CPSocket connected tcp:127.0.0.1:48148,server=on <-> 127.0.0.1:33750 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:rcuref_put_slowpath+0x1ce/0x240 lib/rcuref.c:266 Call Trace: <TASK> __rcuref_put include/linux/rcuref.h:97 [inline] rcuref_put include/linux/rcuref.h:153 [inline] dst_release+0x291/0x310 net/core/dst.c:167 __sk_dst_check+0x2d4/0x350 net/core/sock.c:604 __inet6_csk_dst_check net/ipv6/inet6_connection_sock.c:76 [inline] inet6_csk_route_socket+0x6ed/0x10c0 net/ipv6/inet6_connection_sock.c:104 inet6_csk_xmit+0x12f/0x740 net/ipv6/inet6_connection_sock.c:121 l2tp_xmit_queue net/l2tp/l2tp_core.c:1214 [inline] l2tp_xmit_core net/l2tp/l2tp_core.c:1309 [inline] l2tp_xmit_skb+0x1404/0x1910 net/l2tp/l2tp_core.c:1325 pppol2tp_sendmsg+0x3ca/0x550 net/l2tp/l2tp_ppp.c:302 sock_sendmsg_nosec net/socket.c:729 [inline] __sock_sendmsg net/socket.c:744 [inline] ____sys_sendmsg+0xab2/0xc70 net/socket.c:2609 ___sys_sendmsg+0x11d/0x1c0 net/socket.c:2663 __sys_sendmmsg+0x188/0x450 net/socket.c:2749 __do_sys_sendmmsg net/socket.c:2778 [inline] __se_sys_sendmmsg net/socket.c:2775 [inline] __x64_sys_sendmmsg+0x98/0x100 net/socket.c:2775 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x64/0x140 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fe6960ec719 </TASK> The race occurs between the lockless UDPv6 transmit path (udpv6_sendmsg() -> sk_dst_check()) and the locked L2TP/pppol2tp transmit path (pppol2tp_sendmsg() -> l2tp_xmit_skb() -> ... -> inet6_csk_xmit() → __sk_dst_check()), when both handle the same obsolete dst from sk->sk_dst_cache: the UDPv6 side takes an extra reference and atomically steals and releases the cached dst, while the L2TP side, using a stale cached pointer, still calls dst_release() on it, and together these updates produce an extra final dst_release() on that dst, triggering rcuref - imbalanced put(). The Race Condition: Initial: sk->sk_dst_cache = dst ref(dst) = 1 Thread 1: sk_dst_check() Thread 2: __sk_dst_check() ------------------------ ---------------------------- sk_dst_get(sk): rcu_read_lock() dst = rcu_dereference(sk->sk_dst_cache) rcuref_get(dst) succeeds rcu_read_unlock() // ref = 2 dst = __sk_dst_get(sk) // reads same dst from sk_dst_cache // ref still = 2 (no extra get) [both see dst obsolete & check() == NULL] sk_dst_reset(sk): old = xchg(&sk->sk_dst_cache, NULL) // old = dst dst_release(old) // drop cached ref // ref: 2 -> 1 RCU_INIT_POINTER(sk->sk_dst_cache, NULL) // cache already NULL after xchg dst_release(dst) // ref: 1 -> 0 dst_release(dst) // tries to drop its own ref after final put // rcuref_put_slowpath() -> "rcuref - imbalanced put()" Make L2TP's IPv6 transmit path stop using inet6_csk_xmit() (and thus __sk_dst_check()) and instead open-code the same routing and transmit sequence using the existing sk_dst_check() with dst reference counting and ip6_dst_lookup_flow(). The new code builds a flowi6 from the socket fields in the same way as inet6_csk_route_socket(), then performs dst lookup using sk_dst_check() with proper reference counting, attaches the resulting dst to the skb via skb_dst_set(), and finally invokes ip6_xmit() for transmission. This makes both the UDPv6 and L2TP IPv6 paths use the same dst-cache handling logic for a given socket and removes the possibility that the lockless sk_dst_check() and the locked __sk_dst_check() concurrently drop the same cached dst and trigger the rcuref - imbalanced put() warning under concurrent traffic. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Fixes: b0270e91014d ("ipv4: add a sock pointer to ip_queue_xmit()") Signed-off-by: Li Xiasong <lixiasong1(a)huawei.com> --- net/l2tp/l2tp_core.c | 60 +++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 57 insertions(+), 3 deletions(-) diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c index f85b383811d5..79a5f635b049 100644 --- a/net/l2tp/l2tp_core.c +++ b/net/l2tp/l2tp_core.c @@ -1000,19 +1000,73 @@ static int l2tp_build_l2tpv3_header(struct l2tp_session *session, void *buf) return bufp - optr; } +#if IS_ENABLED(CONFIG_IPV6) +static int l2tp_xmit_ipv6(struct sock *sk, struct sk_buff *skb) +{ + struct ipv6_pinfo *np = inet6_sk(sk); + struct inet_sock *inet = inet_sk(sk); + struct in6_addr *final_p, final; + struct dst_entry *dst; + struct flowi6 fl6; + int err; + + memset(&fl6, 0, sizeof(fl6)); + fl6.flowi6_proto = sk->sk_protocol; + fl6.daddr = sk->sk_v6_daddr; + fl6.saddr = np->saddr; + fl6.flowlabel = np->flow_label; + IP6_ECN_flow_xmit(sk, fl6.flowlabel); + + fl6.flowi6_oif = sk->sk_bound_dev_if; + fl6.flowi6_mark = sk->sk_mark; + fl6.fl6_sport = inet->inet_sport; + fl6.fl6_dport = inet->inet_dport; + fl6.flowi6_uid = sk->sk_uid; + + security_sk_classify_flow(sk, flowi6_to_flowi_common(&fl6)); + + rcu_read_lock(); + final_p = fl6_update_dst(&fl6, rcu_dereference(np->opt), &final); + rcu_read_unlock(); + + dst = sk_dst_check(sk, np->dst_cookie); + if (!dst) { + dst = ip6_dst_lookup_flow(sock_net(sk), sk, &fl6, final_p); + if (IS_ERR(dst)) { + WRITE_ONCE(sk->sk_err_soft, -PTR_ERR(dst)); + sk->sk_route_caps = 0; + kfree_skb(skb); + return PTR_ERR(dst); + } + + ip6_dst_store(sk, dst_clone(dst), NULL, NULL); + } + + skb_dst_set(skb, dst); + fl6.daddr = sk->sk_v6_daddr; + + rcu_read_lock(); + err = ip6_xmit(sk, skb, &fl6, sk->sk_mark, rcu_dereference(np->opt), + np->tclass, sk->sk_priority); + rcu_read_unlock(); + return err; +} +#endif + /* Queue the packet to IP for output: tunnel socket lock must be held */ static int l2tp_xmit_queue(struct l2tp_tunnel *tunnel, struct sk_buff *skb, struct flowi *fl) { int err; + struct sock *sk = tunnel->sock; skb->ignore_df = 1; skb_dst_drop(skb); #if IS_ENABLED(CONFIG_IPV6) - if (l2tp_sk_is_v6(tunnel->sock)) - err = inet6_csk_xmit(tunnel->sock, skb, NULL); + if (l2tp_sk_is_v6(sk)) + err = l2tp_xmit_ipv6(sk, skb); else #endif - err = ip_queue_xmit(tunnel->sock, skb, fl); + err = ip_queue_xmit(sk, skb, fl); return err >= 0 ? NET_XMIT_SUCCESS : NET_XMIT_DROP; } -- 2.34.1

2 1