- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10 v2 0/9] arm64: Support xcall prefetch
by Jinjie Ruan 12 May '25

12 May '25

Support arm64 xcall prefetch. Changes in v2: - Remove is_read_cache. - Simplify the ksys_read(). - Use percpu cache_hit/miss_wait and remove cache_queued and sync_mode. - Remove keep_running in prefetch_item struct. - Add /proc/xcall/stats dir. - Remove pfi in file struct and use hash table. Jinjie Ruan (3): arm64: Introduce Xint software solution arm64: Add debugfs dir for xint xcall: Add /proc/xcall/stats dir for performance tuning Liao Chen (1): revert kpti bypass Yipeng Zou (5): arm64: Introduce xcall a faster svc exception handling arm64: Faster SVC exception handler with xcall xcall: introduce xcall_select to implement a custom xcall function eventpoll: xcall: Support sync and async prefetch data in epoll xcall: eventpoll: add tracepoint arch/Kconfig | 64 +++++++ arch/arm64/Kconfig | 2 + arch/arm64/configs/openeuler_defconfig | 4 + arch/arm64/include/asm/cpucaps.h | 2 + arch/arm64/include/asm/exception.h | 6 + arch/arm64/include/asm/syscall.h | 14 ++ arch/arm64/include/asm/syscall_wrapper.h | 25 +++ arch/arm64/kernel/asm-offsets.c | 3 + arch/arm64/kernel/cpufeature.c | 54 ++++++ arch/arm64/kernel/entry-common.c | 22 +++ arch/arm64/kernel/entry.S | 183 +++++++++++++++++- arch/arm64/kernel/sys.c | 20 ++ arch/arm64/kernel/syscall.c | 69 +++++++ drivers/irqchip/irq-gic-v3.c | 123 ++++++++++++ fs/eventpoll.c | 232 +++++++++++++++++++++++ fs/open.c | 4 + fs/proc/base.c | 214 +++++++++++++++++++++ fs/read_write.c | 95 +++++++++- include/linux/fs.h | 31 +++ include/linux/hardirq.h | 5 + include/linux/irqchip/arm-gic-v3.h | 13 ++ include/linux/sched.h | 5 + include/linux/syscalls.h | 19 ++ include/trace/events/fs.h | 91 +++++++++ include/uapi/asm-generic/unistd.h | 11 ++ kernel/fork.c | 32 ++++ kernel/irq/debugfs.c | 33 ++++ kernel/irq/internals.h | 18 ++ kernel/irq/irqdesc.c | 19 ++ kernel/irq/proc.c | 10 + kernel/softirq.c | 73 +++++++ kernel/sysctl.c | 36 ++++ 32 files changed, 1529 insertions(+), 3 deletions(-) -- 2.34.1

2 10

[PATCH OLK-6.6] kvm: x86: fix infinite loop in kvm_guest_time_update when tsc is 0
by Yuntao Liu 12 May '25

12 May '25

Offering: HULK hulk inclusion category: bugfix bugzilla: 190614 -------------------------------- Syzkaller testing detected a soft lockup. watchdog: BUG: soft lockup - CPU#3 stuck for 127s! [syz.1.2088:9817] Modules linked in: CPU: 3 PID: 9817 Comm: syz.1.2088 Tainted: G S 6.6.0+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 RIP: 0010:__sanitizer_cov_trace_const_cmp4+0x8/0x20 kernel/kcov.c:313 Code: bf 03 00 00 00 e9 48 fe ff ff 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 48 8b 0c 24 <89> f2 89 fe bf 05 00 00 00 e9 1a fe ff ff 66 2e 0f 1f 84 00 00 00 RSP: 0018:ffff888016d8fad8 EFLAGS: 00000206 RAX: 0000000000080000 RBX: ffff88810e242540 RCX: ffffffff901150d6 RDX: 0000000000080000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffff888016d8fb50 R08: 0000000000000001 R09: ffffed1021c484af R10: 0000000000000000 R11: 0000000000000277 R12: 0000000000000000 R13: fffffed357281918 R14: 0000000000000000 R15: 0000000000000001 FS: 00007f2a8f6ea6c0(0000) GS:ffff888119780000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000012c56c0 CR3: 000000000dce8001 CR4: 0000000000772ee0 DR0: 0000000000000000 DR1: 0000000000d3eb1c DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 PKRU: 80000000 Call Trace: <TASK> kvm_get_time_scale arch/x86/kvm/x86.c:2458 [inline] kvm_guest_time_update+0x926/0xb00 arch/x86/kvm/x86.c:3268 vcpu_enter_guest.constprop.0+0x1e70/0x3cf0 arch/x86/kvm/x86.c:10678 vcpu_run+0x129/0x8d0 arch/x86/kvm/x86.c:11126 kvm_arch_vcpu_ioctl_run+0x37a/0x13d0 arch/x86/kvm/x86.c:11352 kvm_vcpu_ioctl+0x56b/0xe60 virt/kvm/kvm_main.c:4188 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:871 [inline] __se_sys_ioctl+0x12d/0x190 fs/ioctl.c:857 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x59/0x110 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x78/0xe2 test case: 18.689865147s ago: executing program 1 (id=2088): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000002080), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_TSC_KHZ(r2, 0xaea2, 0x1) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000001c0)={'netdevsim0\x00', <r4=>0x0}) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=@base={0x1, 0x4, 0x8000, 0x2, 0x0, 0xffffffffffffffff, 0x0, '\x00', r4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000100)={{r5}, &(0x7f0000000000), &(0x7f0000000040)='%ps \x00'}, 0x20) bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000000c0)={r5, &(0x7f0000001480)}, 0x20) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000000)={0x1ff, 0x3, 0x3000, 0x1000, &(0x7f0000fec000/0x1000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) openat$ipvs(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text64={0x40, &(0x7f0000000040)="26f2a70f3548b807000000000000000f23c00f21f835020008000f23f80fc73eb9330800000f326666470f3880be6cc468550f01cf360f01f80f30450f01c9", 0x3f}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_TSC_KHZ(r2, 0xaea2, 0x1) user_tsc_khz = 0x1 | kvm_set_tsc_khz(struct kvm_vcpu *vcpu, u32 user_tsc_khz) | ioctl$KVM_RUN(r2, 0xae80, 0x0) | ... kvm_guest_time_update(struct kvm_vcpu *v) | if (kvm_caps.has_tsc_control) tgt_tsc_khz = kvm_scale_tsc(tgt_tsc_khz, v->arch.l1_tsc_scaling_ratio); | kvm_scale_tsc(u64 tsc, u64 ratio) | __scale_tsc(u64 ratio, u64 tsc) ratio=122380531, tsc=2299998, N=48 ratio*tsc >> N = 0.999... -> 0 | kvm_get_time_scale In function __scale_tsc, it uses fixed point number to calculate tsc, therefore, a certain degree of precision is lost, the actual tsc value of 0.999... would be 0. In function kvm_get_time_scale tps32=tps64=base_hz=0, would lead second while_loop infinite. when CONFIG_PREEMPT is n, it causes a soft lockup issue. Signed-off-by: Yuntao Liu <liuyuntao12(a)huawei.com> --- arch/x86/kvm/x86.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 1fa5d89f8d27..92460a69ff0f 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -2605,10 +2605,12 @@ static void kvm_track_tsc_matching(struct kvm_vcpu *vcpu) * point number (mult + frac * 2^(-N)). * * N equals to kvm_caps.tsc_scaling_ratio_frac_bits. + * + * add 1 to compensate for precision loss. */ static inline u64 __scale_tsc(u64 ratio, u64 tsc) { - return mul_u64_u64_shr(tsc, ratio, kvm_caps.tsc_scaling_ratio_frac_bits); + return mul_u64_u64_shr(tsc, ratio, kvm_caps.tsc_scaling_ratio_frac_bits) + 1; } u64 kvm_scale_tsc(u64 tsc, u64 ratio) -- 2.34.1

2 1

[PATCH OLK-5.10 0/4] fuse: support fastpath
by chenrenhui 12 May '25

12 May '25

Support fuse fastpath by using the newly added fast_ipc module. Alessio Balsini (1): fuse: 32-bit user space ioctl compat for fuse device chenrenhui (2): ipc: add fast_ipc module to enable fast process switching fuse: support fastpath via fast_ipc yangyun (1): fuse: add fast path for fuse_range_is_writeback Kconfig | 2 + arch/arm64/configs/openeuler_defconfig | 2 + fs/fuse/Kconfig | 9 + fs/fuse/dev.c | 770 ++++++++++++++++++++++++- fs/fuse/dir.c | 87 ++- fs/fuse/file.c | 241 +++++++- fs/fuse/fuse_i.h | 55 ++ fs/fuse/inode.c | 112 ++++ fs/fuse/readdir.c | 8 + include/linux/fast_ipc.h | 48 ++ include/uapi/linux/fuse.h | 15 +- ipc/Kconfig | 6 + ipc/Makefile | 2 +- ipc/fast_ipc.c | 299 ++++++++++ 14 files changed, 1615 insertions(+), 41 deletions(-) create mode 100644 include/linux/fast_ipc.h create mode 100644 ipc/Kconfig create mode 100644 ipc/fast_ipc.c -- 2.33.0

2 5

[PATCH OLK-5.10] [Backport] backlight: led_bl: Hold led_access lock when calling led_sysfs_disable()
by Yuntao Liu 12 May '25

12 May '25

From: Herve Codina <herve.codina(a)bootlin.com> stable inclusion from stable-v5.10.237 commit 87d947a0607be384bfe7bb0935884a711e35ca07 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC5BJZ CVE: CVE-2025-23144 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 276822a00db3c1061382b41e72cafc09d6a0ec30 ] Lockdep detects the following issue on led-backlight removal: [ 142.315935] ------------[ cut here ]------------ [ 142.315954] WARNING: CPU: 2 PID: 292 at drivers/leds/led-core.c:455 led_sysfs_enable+0x54/0x80 ... [ 142.500725] Call trace: [ 142.503176] led_sysfs_enable+0x54/0x80 (P) [ 142.507370] led_bl_remove+0x80/0xa8 [led_bl] [ 142.511742] platform_remove+0x30/0x58 [ 142.515501] device_remove+0x54/0x90 ... Indeed, led_sysfs_enable() has to be called with the led_access lock held. Hold the lock when calling led_sysfs_disable(). Fixes: ae232e45acf9 ("backlight: add led-backlight driver") Cc: stable(a)vger.kernel.org Signed-off-by: Herve Codina <herve.codina(a)bootlin.com> Link: https://lore.kernel.org/r/20250122091914.309533-1-herve.codina@bootlin.com Signed-off-by: Lee Jones <lee(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yuntao Liu <liuyuntao12(a)huawei.com> --- drivers/video/backlight/led_bl.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/video/backlight/led_bl.c b/drivers/video/backlight/led_bl.c index f54d256e2d54..1020e4405a4d 100644 --- a/drivers/video/backlight/led_bl.c +++ b/drivers/video/backlight/led_bl.c @@ -226,8 +226,11 @@ static int led_bl_remove(struct platform_device *pdev) backlight_device_unregister(bl); led_bl_power_off(priv); - for (i = 0; i < priv->nb_leds; i++) + for (i = 0; i < priv->nb_leds; i++) { + mutex_lock(&priv->leds[i]->led_access); led_sysfs_enable(priv->leds[i]); + mutex_unlock(&priv->leds[i]->led_access); + } return 0; } -- 2.34.1

2 1

[PATCH OLK-6.6] backlight: led_bl: Hold led_access lock when calling led_sysfs_disable()
by Yuntao Liu 12 May '25

12 May '25

From: Herve Codina <herve.codina(a)bootlin.com> stable inclusion from stable-v6.6.88 commit 1c82f5a393d8b9a5c1ea032413719862098afd4b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC5BJZ CVE: CVE-2025-23144 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 276822a00db3c1061382b41e72cafc09d6a0ec30 upstream. Lockdep detects the following issue on led-backlight removal: [ 142.315935] ------------[ cut here ]------------ [ 142.315954] WARNING: CPU: 2 PID: 292 at drivers/leds/led-core.c:455 led_sysfs_enable+0x54/0x80 ... [ 142.500725] Call trace: [ 142.503176] led_sysfs_enable+0x54/0x80 (P) [ 142.507370] led_bl_remove+0x80/0xa8 [led_bl] [ 142.511742] platform_remove+0x30/0x58 [ 142.515501] device_remove+0x54/0x90 ... Indeed, led_sysfs_enable() has to be called with the led_access lock held. Hold the lock when calling led_sysfs_disable(). Fixes: ae232e45acf9 ("backlight: add led-backlight driver") Cc: stable(a)vger.kernel.org Signed-off-by: Herve Codina <herve.codina(a)bootlin.com> Link: https://lore.kernel.org/r/20250122091914.309533-1-herve.codina@bootlin.com Signed-off-by: Lee Jones <lee(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuntao Liu <liuyuntao12(a)huawei.com> --- drivers/video/backlight/led_bl.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/video/backlight/led_bl.c b/drivers/video/backlight/led_bl.c index 032f8bddf872..0e53e427a91d 100644 --- a/drivers/video/backlight/led_bl.c +++ b/drivers/video/backlight/led_bl.c @@ -229,8 +229,11 @@ static void led_bl_remove(struct platform_device *pdev) backlight_device_unregister(bl); led_bl_power_off(priv); - for (i = 0; i < priv->nb_leds; i++) + for (i = 0; i < priv->nb_leds; i++) { + mutex_lock(&priv->leds[i]->led_access); led_sysfs_enable(priv->leds[i]); + mutex_unlock(&priv->leds[i]->led_access); + } } static const struct of_device_id led_bl_of_match[] = { -- 2.34.1

2 1

[PATCH OLK-6.6] cifs: avoid NULL pointer dereference in dbg call
by Wang Zhaolong 12 May '25

12 May '25

From: Alexandra Diupina <adiupina(a)astralinux.ru> mainline inclusion from mainline-v6.15-rc1 commit b4885bd5935bb26f0a414ad55679a372e53f9b9b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC6Q1P CVE: CVE-2025-37844 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- cifs_server_dbg() implies server to be non-NULL so move call under condition to avoid NULL pointer dereference. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: e79b0332ae06 ("cifs: ignore cached share root handle closing errors") Cc: stable(a)vger.kernel.org Signed-off-by: Alexandra Diupina <adiupina(a)astralinux.ru> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- fs/smb/client/smb2misc.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/fs/smb/client/smb2misc.c b/fs/smb/client/smb2misc.c index 677ef6f99a5b..fadc5fc274eb 100644 --- a/fs/smb/client/smb2misc.c +++ b/fs/smb/client/smb2misc.c @@ -814,15 +814,16 @@ smb2_handle_cancelled_close(struct cifs_tcon *tcon, __u64 persistent_fid, trace_smb3_tcon_ref(tcon->debug_id, tcon->tc_count, netfs_trace_tcon_ref_see_cancelled_close); WARN_ONCE(tcon->tc_count < 0, "tcon refcount is negative"); spin_unlock(&cifs_tcp_ses_lock); - if (tcon->ses) + if (tcon->ses) { server = tcon->ses->server; - - cifs_server_dbg(FYI, "tid=0x%x: tcon is closing, skipping async close retry of fid %llu %llu\n", - tcon->tid, persistent_fid, volatile_fid); + cifs_server_dbg(FYI, + "tid=0x%x: tcon is closing, skipping async close retry of fid %llu %llu\n", + tcon->tid, persistent_fid, volatile_fid); + } return 0; } tcon->tc_count++; trace_smb3_tcon_ref(tcon->debug_id, tcon->tc_count, -- 2.34.3

2 1

[PATCH OLK-5.10] cifs: avoid NULL pointer dereference in dbg call
by Wang Zhaolong 12 May '25

12 May '25

From: Alexandra Diupina <adiupina(a)astralinux.ru> mainline inclusion from mainline-v6.15-rc1 commit b4885bd5935bb26f0a414ad55679a372e53f9b9b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC6Q1P CVE: CVE-2025-37844 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- cifs_server_dbg() implies server to be non-NULL so move call under condition to avoid NULL pointer dereference. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: e79b0332ae06 ("cifs: ignore cached share root handle closing errors") Cc: stable(a)vger.kernel.org Signed-off-by: Alexandra Diupina <adiupina(a)astralinux.ru> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/client/smb2misc.c fs/cifs/smb2misc.c [The file path has been changed.] Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- fs/cifs/smb2misc.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c index edffa5657d26..074a56796092 100644 --- a/fs/cifs/smb2misc.c +++ b/fs/cifs/smb2misc.c @@ -807,15 +807,16 @@ smb2_handle_cancelled_close(struct cifs_tcon *tcon, __u64 persistent_fid, struct TCP_Server_Info *server = NULL; WARN_ONCE(tcon->tc_count < 0, "tcon refcount is negative"); spin_unlock(&cifs_tcp_ses_lock); - if (tcon->ses) + if (tcon->ses) { server = tcon->ses->server; - cifs_server_dbg(FYI, "tid=%u: tcon is closing, skipping async close retry of fid %llu %llu\n", - tcon->tid, persistent_fid, volatile_fid); + cifs_server_dbg(FYI, "tid=%u: tcon is closing, skipping async close retry of fid %llu %llu\n", + tcon->tid, persistent_fid, volatile_fid); + } return 0; } tcon->tc_count++; spin_unlock(&cifs_tcp_ses_lock); -- 2.34.3

2 1

[PATCH openEuler-1.0-LTS] jbd2: remove wrong sb->s_sequence check
by Zizhi Wo 12 May '25

12 May '25

From: Jan Kara <jack(a)suse.cz> stable inclusion from stable-v5.10.237 commit b479839525fe7906966cdc4b5b2afbca048558a1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC6LPS CVE: CVE-2025-37839 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e6eff39dd0fe4190c6146069cc16d160e71d1148 upstream. Journal emptiness is not determined by sb->s_sequence == 0 but rather by sb->s_start == 0 (which is set a few lines above). Furthermore 0 is a valid transaction ID so the check can spuriously trigger. Remove the invalid WARN_ON. CC: stable(a)vger.kernel.org Signed-off-by: Jan Kara <jack(a)suse.cz> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Link: https://patch.msgid.link/20250206094657.20865-3-jack@suse.cz Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/jbd2/journal.c | 1 - 1 file changed, 1 deletion(-) diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c index bf83e1c64aa4..5dddfc493ca7 100644 --- a/fs/jbd2/journal.c +++ b/fs/jbd2/journal.c @@ -1517,7 +1517,6 @@ int jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid, /* Log is no longer empty */ write_lock(&journal->j_state_lock); - WARN_ON(!sb->s_sequence); journal->j_flags &= ~JBD2_FLUSHED; write_unlock(&journal->j_state_lock); -- 2.39.2

2 1

[PATCH OLK-5.10] jbd2: remove wrong sb->s_sequence check
by Zizhi Wo 12 May '25

12 May '25

From: Jan Kara <jack(a)suse.cz> stable inclusion from stable-v5.10.237 commit b479839525fe7906966cdc4b5b2afbca048558a1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC6LPS CVE: CVE-2025-37839 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e6eff39dd0fe4190c6146069cc16d160e71d1148 upstream. Journal emptiness is not determined by sb->s_sequence == 0 but rather by sb->s_start == 0 (which is set a few lines above). Furthermore 0 is a valid transaction ID so the check can spuriously trigger. Remove the invalid WARN_ON. CC: stable(a)vger.kernel.org Signed-off-by: Jan Kara <jack(a)suse.cz> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Link: https://patch.msgid.link/20250206094657.20865-3-jack@suse.cz Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/jbd2/journal.c | 1 - 1 file changed, 1 deletion(-) diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c index 7775ad53b291..cc83decc6425 100644 --- a/fs/jbd2/journal.c +++ b/fs/jbd2/journal.c @@ -1705,7 +1705,6 @@ int jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid, /* Log is no longer empty */ write_lock(&journal->j_state_lock); - WARN_ON(!sb->s_sequence); journal->j_flags &= ~JBD2_FLUSHED; write_unlock(&journal->j_state_lock); -- 2.39.2

2 1

[PATCH openeuler-1.0-LTS] jbd2: remove wrong sb->s_sequence check
by Zizhi Wo 12 May '25

12 May '25

From: Jan Kara <jack(a)suse.cz> stable inclusion from stable-v5.10.237 commit b479839525fe7906966cdc4b5b2afbca048558a1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC6LPS CVE: CVE-2025-37839 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e6eff39dd0fe4190c6146069cc16d160e71d1148 upstream. Journal emptiness is not determined by sb->s_sequence == 0 but rather by sb->s_start == 0 (which is set a few lines above). Furthermore 0 is a valid transaction ID so the check can spuriously trigger. Remove the invalid WARN_ON. CC: stable(a)vger.kernel.org Signed-off-by: Jan Kara <jack(a)suse.cz> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Link: https://patch.msgid.link/20250206094657.20865-3-jack@suse.cz Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/jbd2/journal.c | 1 - 1 file changed, 1 deletion(-) diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c index bf83e1c64aa4..5dddfc493ca7 100644 --- a/fs/jbd2/journal.c +++ b/fs/jbd2/journal.c @@ -1517,7 +1517,6 @@ int jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid, /* Log is no longer empty */ write_lock(&journal->j_state_lock); - WARN_ON(!sb->s_sequence); journal->j_flags &= ~JBD2_FLUSHED; write_unlock(&journal->j_state_lock); -- 2.39.2

2 1