- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 0/3] Fix perf sigtrap
by Luo Gengkun 17 Oct '26

17 Oct '26

Luo Gengkun (1): perf: Fix kabi breakage of struct perf_event Sebastian Andrzej Siewior (2): perf: Move irq_work_queue() where the event is prepared. perf: Enqueue SIGTRAP always via task_work. include/linux/perf_event.h | 4 ++-- kernel/events/core.c | 41 ++++++++++++++------------------------ 2 files changed, 17 insertions(+), 28 deletions(-) -- 2.34.1

2 4

[PATCH OLK-6.6 0/3] Fix perf sigtrap
by Luo Gengkun 17 Oct '26

17 Oct '26

Luo Gengkun (1): perf: Fix kabi breakage of struct perf_event Sebastian Andrzej Siewior (2): perf: Move irq_work_queue() where the event is prepared. perf: Enqueue SIGTRAP always via task_work. include/linux/perf_event.h | 4 ++-- kernel/events/core.c | 41 ++++++++++++++------------------------ 2 files changed, 17 insertions(+), 28 deletions(-) -- 2.34.1

1 0

[PATCH OLK-6.6 1/3] perf: Move irq_work_queue() where the event is prepared.
by Luo Gengkun 17 Oct '26

17 Oct '26

From: Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> mainline inclusion from mainline-v6.11-rc1 commit 058244c683111d44a5de16ac74f19a1754dd7a0c category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20234 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- Only if perf_event::pending_sigtrap is zero, the irq_work accounted by increminging perf_event::nr_pending. The member perf_event::pending_addr might be overwritten by a subsequent event if the signal was not yet delivered and is expected. The irq_work will not be enqeueued again because it has a check to be only enqueued once. Move irq_work_queue() to where the counter is incremented and perf_event::pending_sigtrap is set to make it more obvious that the irq_work is scheduled once. Signed-off-by: Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Tested-by: Marco Elver <elver(a)google.com> Tested-by: Arnaldo Carvalho de Melo <acme(a)redhat.com> Link: https://lore.kernel.org/r/20240704170424.1466941-2-bigeasy@linutronix.de Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- kernel/events/core.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/kernel/events/core.c b/kernel/events/core.c index 8ebd91f8df52..6e78b7af0062 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -9729,6 +9729,11 @@ static int __perf_event_overflow(struct perf_event *event, if (!event->pending_sigtrap) { event->pending_sigtrap = pending_id; local_inc(&event->ctx->nr_pending); + + event->pending_addr = 0; + if (valid_sample && (data->sample_flags & PERF_SAMPLE_ADDR)) + event->pending_addr = data->addr; + irq_work_queue(&event->pending_irq); } else if (event->attr.exclude_kernel && valid_sample) { /* * Should not be able to return to user space without @@ -9744,11 +9749,6 @@ static int __perf_event_overflow(struct perf_event *event, */ WARN_ON_ONCE(event->pending_sigtrap != pending_id); } - - event->pending_addr = 0; - if (valid_sample && (data->sample_flags & PERF_SAMPLE_ADDR)) - event->pending_addr = data->addr; - irq_work_queue(&event->pending_irq); } READ_ONCE(event->overflow_handler)(event, data, regs); -- 2.34.1

1 0

[PATCH OLK-6.6 0/3] Fix perf sigtrap
by Luo Gengkun 17 Oct '26

17 Oct '26

Luo Gengkun (1): perf: Fix kabi breakage of struct perf_event Sebastian Andrzej Siewior (2): perf: Move irq_work_queue() where the event is prepared. perf: Enqueue SIGTRAP always via task_work. include/linux/perf_event.h | 4 ++-- kernel/events/core.c | 41 ++++++++++++++------------------------ 2 files changed, 17 insertions(+), 28 deletions(-) -- 2.34.1

2 4

[PATCH OLK-6.6] ALSA: usb-audio: caiaq: validate EP1 reply lengths
by Pan Taixi 16 Oct '26

16 Oct '26

From: Pengpeng Hou <pengpeng(a)iscas.ac.cn> stable inclusion from stable-v6.6.158 commit 319393151367e6626affedcdd4f7b7b0286f4246 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19607 CVE: CVE-2026-93808 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit aba30af07d4fe499b50209801eba9da8a815522f ] usb_ep1_command_reply_dispatch() uses buf[0] as a command byte and then reads command-specific fixed items from the same URB buffer. Several paths use buf + 1, buf[1], buf[2], or buf + 3 without first proving that urb->actual_length contains those bytes. Add per-command length checks, use a payload length derived from the bytes after the command byte for the control-state copy, and reject short analog input payloads before the input helper reads fixed offsets from the EP1 reply. Signed-off-by: Pengpeng Hou <pengpeng(a)iscas.ac.cn> Link: https://patch.msgid.link/20260705084601.56400-1-pengpeng@iscas.ac.cn Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com> --- sound/usb/caiaq/device.c | 17 ++++++++++++++--- sound/usb/caiaq/input.c | 6 ++++++ 2 files changed, 20 insertions(+), 3 deletions(-) diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c index 35e969086d6c..3d821fde4582 100644 --- a/sound/usb/caiaq/device.c +++ b/sound/usb/caiaq/device.c @@ -132,18 +132,26 @@ static void usb_ep1_command_reply_dispatch (struct urb* urb) { int ret; struct device *dev = &urb->dev->dev; struct snd_usb_caiaqdev *cdev = urb->context; unsigned char *buf = urb->transfer_buffer; + unsigned int payload_len; + unsigned int copy_len; if (urb->status || !cdev) { dev_warn(dev, "received EP1 urb->status = %i\n", urb->status); return; } + if (urb->actual_length < 1) + return; + + payload_len = urb->actual_length - 1; switch(buf[0]) { case EP1_CMD_GET_DEVICE_INFO: + if (payload_len < sizeof(struct caiaq_device_spec)) + break; memcpy(&cdev->spec, buf+1, sizeof(struct caiaq_device_spec)); cdev->spec.fw_version = le16_to_cpu(cdev->spec.fw_version); dev_dbg(dev, "device spec (firmware %d): audio: %d in, %d out, " "MIDI: %d in, %d out, data alignment %d\n", cdev->spec.fw_version, @@ -155,22 +163,25 @@ static void usb_ep1_command_reply_dispatch (struct urb* urb) cdev->spec_received++; wake_up(&cdev->ep1_wait_queue); break; case EP1_CMD_AUDIO_PARAMS: + if (payload_len < 1) + break; cdev->audio_parm_answer = buf[1]; wake_up(&cdev->ep1_wait_queue); break; case EP1_CMD_MIDI_READ: + if (urb->actual_length < 3 || urb->actual_length - 3 < buf[2]) + break; snd_usb_caiaq_midi_handle_input(cdev, buf[1], buf + 3, buf[2]); break; case EP1_CMD_READ_IO: if (cdev->chip.usb_id == USB_ID(USB_VID_NATIVEINSTRUMENTS, USB_PID_AUDIO8DJ)) { - if (urb->actual_length > sizeof(cdev->control_state)) - urb->actual_length = sizeof(cdev->control_state); - memcpy(cdev->control_state, buf + 1, urb->actual_length); + copy_len = min_t(unsigned int, payload_len, sizeof(cdev->control_state)); + memcpy(cdev->control_state, buf + 1, copy_len); wake_up(&cdev->ep1_wait_queue); break; } #ifdef CONFIG_SND_USB_CAIAQ_INPUT fallthrough; diff --git a/sound/usb/caiaq/input.c b/sound/usb/caiaq/input.c index 2db4d1332df1..c12eeb971000 100644 --- a/sound/usb/caiaq/input.c +++ b/sound/usb/caiaq/input.c @@ -201,22 +201,28 @@ static void snd_caiaq_input_read_analog(struct snd_usb_caiaqdev *cdev, { struct input_dev *input_dev = cdev->input_dev; switch (cdev->chip.usb_id) { case USB_ID(USB_VID_NATIVEINSTRUMENTS, USB_PID_RIGKONTROL2): + if (len < 6) + return; snd_caiaq_input_report_abs(cdev, ABS_X, buf, 2); snd_caiaq_input_report_abs(cdev, ABS_Y, buf, 0); snd_caiaq_input_report_abs(cdev, ABS_Z, buf, 1); break; case USB_ID(USB_VID_NATIVEINSTRUMENTS, USB_PID_RIGKONTROL3): case USB_ID(USB_VID_NATIVEINSTRUMENTS, USB_PID_KORECONTROLLER): case USB_ID(USB_VID_NATIVEINSTRUMENTS, USB_PID_KORECONTROLLER2): + if (len < 6) + return; snd_caiaq_input_report_abs(cdev, ABS_X, buf, 0); snd_caiaq_input_report_abs(cdev, ABS_Y, buf, 1); snd_caiaq_input_report_abs(cdev, ABS_Z, buf, 2); break; case USB_ID(USB_VID_NATIVEINSTRUMENTS, USB_PID_TRAKTORKONTROLX1): + if (len < 16) + return; snd_caiaq_input_report_abs(cdev, ABS_HAT0X, buf, 4); snd_caiaq_input_report_abs(cdev, ABS_HAT0Y, buf, 2); snd_caiaq_input_report_abs(cdev, ABS_HAT1X, buf, 6); snd_caiaq_input_report_abs(cdev, ABS_HAT1Y, buf, 1); snd_caiaq_input_report_abs(cdev, ABS_HAT2X, buf, 7); -- 2.34.1

2 1

[PATCH OLK-5.10 v3 0/2] Fix KASAN: slab-use-after-free Read in r1buf_pool_alloc
by Zhou Minqiang 16 Oct '26

16 Oct '26

Fix KASAN: slab-use-after-free Read in r1buf_pool_alloc Zhou Minqiang (2): md/raid1: change r1conf->r1bio_pool to a pointer type md/raid1: remove struct pool_info and related code drivers/md/raid1.c | 84 +++++++++++++++++----------------------------- drivers/md/raid1.h | 22 +----------- 2 files changed, 31 insertions(+), 75 deletions(-) -- 2.52.0

2 3

[PATCH OLK-6.6] perf/x86/intel: Prevent drain_pebs() reentry
by Luo Gengkun 16 Oct '26

16 Oct '26

From: Dapeng Mi <dapeng1.mi(a)linux.intel.com> mainline inclusion from mainline-v7.3-rc3 commit a56c03a397e2cd0c4cf8da96dcd6214f7d0e7d8c category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20183 CVE: CVE-2026-97960 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- The PEBS buffer is shared by all events on a CPU, so drain_pebs() must not be reentered. If so, one instance may observe stale buffer state and potentially access out-of-bound memory. Most invocations happen in NMI context, which naturally prevents reentry. However, drain_pebs() is also reachable from process context via intel_pmu_drain_pebs_buffer(). In those paths, the PMU is often already disabled, but not guaranteed. For example, __intel_pmu_pebs_disable() only disables the target counter, so other active counters can still raise a PMI and interrupt an in-flight drain_pebs(). Here is an example, __perf_addr_filters_adjust() perf_event_stop() __perf_event_stop() x86_pmu_stop() (event->pmu->stop) intel_pmu_disable_event() intel_pmu_pebs_disable() __intel_pmu_pebs_disable() intel_pmu_drain_large_pebs() intel_pmu_drain_pebs_buffer() Introduce __intel_pmu_quiesce() and __intel_pmu_resume() helpers and use them in intel_pmu_drain_large_pebs() to disable the full PMU around the intel_pmu_drain_pebs_buffer() call, preventing reentry. Also add a warning in intel_pmu_drain_pebs_buffer() when the full PMU is not disabled. Fixes: b752ea0c28e3 ("perf/x86/intel/ds: Flush PEBS DS when changing PEBS_DATA_CFG") Signed-off-by: Dapeng Mi <dapeng1.mi(a)linux.intel.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Link: https://patch.msgid.link/20260813064346.335458-1-dapeng1.mi@linux.intel.com Conflicts: arch/x86/events/perf_event.h [Fix ctx diff.] Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- arch/x86/events/intel/core.c | 33 ++++++++++++++++++++++++--------- arch/x86/events/intel/ds.c | 8 +++++++- arch/x86/events/perf_event.h | 3 +++ 3 files changed, 34 insertions(+), 10 deletions(-) diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c index 78c514520bb3..7c47ea0403cc 100644 --- a/arch/x86/events/intel/core.c +++ b/arch/x86/events/intel/core.c @@ -3053,6 +3053,27 @@ static void intel_pmu_del_event(struct perf_event *event) this_cpu_ptr(&cpu_hw_events)->n_late_setup--; } +int __intel_pmu_quiesce(void) +{ + struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events); + int pmu_enabled = cpuc->enabled; + + cpuc->enabled = 0; + if (pmu_enabled) + intel_pmu_disable_all(); + + return pmu_enabled; +} + +void __intel_pmu_resume(int pmu_enabled) +{ + struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events); + + cpuc->enabled = pmu_enabled; + if (pmu_enabled) + intel_pmu_enable_all(0); +} + static int icl_set_topdown_event_period(struct perf_event *event) { struct hw_perf_event *hwc = &event->hw; @@ -3244,16 +3265,13 @@ static void intel_pmu_read_event(struct perf_event *event) if (event->hw.flags & (PERF_X86_EVENT_AUTO_RELOAD | PERF_X86_EVENT_TOPDOWN) || is_pebs_counter_event_group(event)) { struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events); - bool pmu_enabled = cpuc->enabled; + int pmu_enabled; /* Only need to call update_topdown_event() once for group read. */ if (is_metric_event(event) && (cpuc->txn_flags & PERF_PMU_TXN_READ)) return; - cpuc->enabled = 0; - if (pmu_enabled) - intel_pmu_disable_all(); - + pmu_enabled = __intel_pmu_quiesce(); /* * If the PEBS counters snapshotting is enabled, * the topdown event is available in PEBS records. @@ -3262,10 +3280,7 @@ static void intel_pmu_read_event(struct perf_event *event) static_call(intel_pmu_update_topdown_event)(event, NULL); else intel_pmu_drain_pebs_buffer(); - - cpuc->enabled = pmu_enabled; - if (pmu_enabled) - intel_pmu_enable_all(0); + __intel_pmu_resume(pmu_enabled); return; } diff --git a/arch/x86/events/intel/ds.c b/arch/x86/events/intel/ds.c index 4966728eb4f4..9d425dd015da 100644 --- a/arch/x86/events/intel/ds.c +++ b/arch/x86/events/intel/ds.c @@ -1139,8 +1139,11 @@ int intel_pmu_drain_bts_buffer(void) void intel_pmu_drain_pebs_buffer(void) { + struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events); struct perf_sample_data data; + WARN_ON_ONCE(cpuc->enabled); + static_call(x86_pmu_drain_pebs)(NULL, &data); } @@ -1761,8 +1764,11 @@ static void intel_pmu_pebs_via_pt_enable(struct perf_event *event) static inline void intel_pmu_drain_large_pebs(struct cpu_hw_events *cpuc) { if (cpuc->n_pebs == cpuc->n_large_pebs && - cpuc->n_pebs != cpuc->n_pebs_via_pt) + cpuc->n_pebs != cpuc->n_pebs_via_pt) { + int enabled = __intel_pmu_quiesce(); intel_pmu_drain_pebs_buffer(); + __intel_pmu_resume(enabled); + } } static void __intel_pmu_pebs_enable(struct perf_event *event) diff --git a/arch/x86/events/perf_event.h b/arch/x86/events/perf_event.h index d3273b181ecd..1e53155503bb 100644 --- a/arch/x86/events/perf_event.h +++ b/arch/x86/events/perf_event.h @@ -1632,6 +1632,9 @@ static __always_inline void __intel_pmu_lbr_disable(void) wrmsrl(MSR_IA32_DEBUGCTLMSR, debugctl); } +extern int __intel_pmu_quiesce(void); +extern void __intel_pmu_resume(int pmu_enabled); + int intel_pmu_save_and_restart(struct perf_event *event); struct event_constraint * -- 2.34.1

2 1

[PATCH OLK-6.6 v2] procfs: move dropping pde and pid from ->evict_inode() to ->free_inode()
by Zhou Minqiang 16 Oct '26

16 Oct '26

mainline inclusion from mainline-v6.8-rc6 commit 47458802f6606f652cd0f6dc38cd52ce60ec0145 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/10078 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- that keeps both around until struct inode is freed, making access to them safe from rcu-pathwalk Acked-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Zhou Minqiang <zhouminqiang2(a)huawei.com> --- fs/proc/base.c | 2 -- fs/proc/inode.c | 19 ++++++++----------- 2 files changed, 8 insertions(+), 13 deletions(-) diff --git a/fs/proc/base.c b/fs/proc/base.c index 7ee2285910bb..f34e357e9f97 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -1932,8 +1932,6 @@ void proc_pid_evict_inode(struct proc_inode *ei) hlist_del_init_rcu(&ei->sibling_inodes); spin_unlock(&pid->lock); } - - put_pid(pid); } struct inode *proc_pid_make_inode(struct super_block *sb, diff --git a/fs/proc/inode.c b/fs/proc/inode.c index 92772702d369..85a09918507e 100644 --- a/fs/proc/inode.c +++ b/fs/proc/inode.c @@ -30,7 +30,6 @@ static void proc_evict_inode(struct inode *inode) { - struct proc_dir_entry *de; struct ctl_table_header *head; struct proc_inode *ei = PROC_I(inode); @@ -38,17 +37,8 @@ static void proc_evict_inode(struct inode *inode) clear_inode(inode); /* Stop tracking associated processes */ - if (ei->pid) { + if (ei->pid) proc_pid_evict_inode(ei); - ei->pid = NULL; - } - - /* Let go of any associated proc directory entry */ - de = ei->pde; - if (de) { - pde_put(de); - ei->pde = NULL; - } head = ei->sysctl; if (head) { @@ -80,6 +70,13 @@ static struct inode *proc_alloc_inode(struct super_block *sb) static void proc_free_inode(struct inode *inode) { + struct proc_inode *ei = PROC_I(inode); + + if (ei->pid) + put_pid(ei->pid); + /* Let go of any associated proc directory entry */ + if (ei->pde) + pde_put(ei->pde); kmem_cache_free(proc_inode_cachep, PROC_I(inode)); } -- 2.52.0

2 2

[PATCH OLK-5.10 v2 0/2] Fix KASAN: slab-use-after-free Read in r1buf_pool_alloc
by Zhou Minqiang 16 Oct '26

16 Oct '26

Fix KASAN: slab-use-after-free Read in r1buf_pool_alloc Zhou Minqiang (2): md/raid1: change r1conf->r1bio_pool to a pointer type md/raid1: remove struct pool_info and related code drivers/md/raid1.c | 84 +++++++++++++++++----------------------------- drivers/md/raid1.h | 22 +----------- 2 files changed, 31 insertions(+), 75 deletions(-) -- 2.52.0

2 3

[PATCH OLK-5.10 v2] procfs: move dropping pde and pid from ->evict_inode() to ->free_inode()
by Zhou Minqiang 16 Oct '26

16 Oct '26

mainline inclusion from mainline-v6.8-rc6 commit 47458802f6606f652cd0f6dc38cd52ce60ec0145 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/10078 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- that keeps both around until struct inode is freed, making access to them safe from rcu-pathwalk Acked-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Zhou Minqiang <zhouminqiang2(a)huawei.com> --- fs/proc/base.c | 2 -- fs/proc/inode.c | 19 ++++++++----------- 2 files changed, 8 insertions(+), 13 deletions(-) diff --git a/fs/proc/base.c b/fs/proc/base.c index 845897ca7e54..7fa69a84899d 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -2082,8 +2082,6 @@ void proc_pid_evict_inode(struct proc_inode *ei) hlist_del_init_rcu(&ei->sibling_inodes); spin_unlock(&pid->lock); } - - put_pid(pid); } struct inode *proc_pid_make_inode(struct super_block *sb, diff --git a/fs/proc/inode.c b/fs/proc/inode.c index ba35ffc426ea..df934ded1bf2 100644 --- a/fs/proc/inode.c +++ b/fs/proc/inode.c @@ -32,7 +32,6 @@ static void proc_evict_inode(struct inode *inode) { - struct proc_dir_entry *de; struct ctl_table_header *head; struct proc_inode *ei = PROC_I(inode); @@ -40,17 +39,8 @@ static void proc_evict_inode(struct inode *inode) clear_inode(inode); /* Stop tracking associated processes */ - if (ei->pid) { + if (ei->pid) proc_pid_evict_inode(ei); - ei->pid = NULL; - } - - /* Let go of any associated proc directory entry */ - de = ei->pde; - if (de) { - pde_put(de); - ei->pde = NULL; - } head = ei->sysctl; if (head) { @@ -82,6 +72,13 @@ static struct inode *proc_alloc_inode(struct super_block *sb) static void proc_free_inode(struct inode *inode) { + struct proc_inode *ei = PROC_I(inode); + + if (ei->pid) + put_pid(ei->pid); + /* Let go of any associated proc directory entry */ + if (ei->pde) + pde_put(ei->pde); kmem_cache_free(proc_inode_cachep, PROC_I(inode)); } -- 2.52.0

2 1