- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] mm/hugetlb: fix incorrect gfp flag for mempolicy MPOL_PREFERRED_MANY
by Wupeng Ma 03 Jul '25

03 Jul '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6I1Z2 -------------------------------- Commit 27a782f719fd ("mm/hugetlb: add support for mempolicy MPOL_PREFERRED_MANY") bring mempolicy MPOL_PREFERRED_MANY for hugetlb, however the gfp flag is incorrect. Fix this. Reported-by: kernel test robot <lkp(a)intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202507020936.wpYnAMsn-lkp@intel.com/ Fixes: 27a782f719fd ("mm/hugetlb: add support for mempolicy MPOL_PREFERRED_MANY") Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- mm/hugetlb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index 967c97c42653..ec0ab09e1b56 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -2223,7 +2223,7 @@ struct page *alloc_buddy_huge_page_with_mpol(struct hstate *h, gfp_t gfp = gfp_mask | __GFP_NOWARN; gfp &= ~(__GFP_DIRECT_RECLAIM | __GFP_NOFAIL); - page = alloc_surplus_huge_page(h, gfp_mask, nid, nodemask); + page = alloc_surplus_huge_page(h, gfp, nid, nodemask); /* Fallback to all nodes if page==NULL */ nodemask = NULL; -- 2.43.0

2 1

[PATCH OLK-6.6 01/12] cpufreq: Support per-policy performance boost
by Qi Xi 03 Jul '25

03 Jul '25

From: Jie Zhan <zhanjie9(a)hisilicon.com> The boost control currently applies to the whole system. However, users may prefer to boost a subset of cores in order to provide prioritized performance to workloads running on the boosted cores. Enable per-policy boost by adding a 'boost' sysfs interface under each policy path. This can be found at: /sys/devices/system/cpu/cpufreq/policy<*>/boost Same to the global boost switch, writing 1/0 to the per-policy 'boost' enables/disables boost on a cpufreq policy respectively. The user view of global and per-policy boost controls should be: 1. Enabling global boost initially enables boost on all policies, and per-policy boost can then be enabled or disabled individually, given that the platform does support so. 2. Disabling global boost makes the per-policy boost interface illegal. Signed-off-by: Jie Zhan <zhanjie9(a)hisilicon.com> Reviewed-by: Wei Xu <xuwei5(a)hisilicon.com> Acked-by: Viresh Kumar <viresh.kumar(a)linaro.org> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- drivers/cpufreq/cpufreq.c | 43 +++++++++++++++++++++++++++++++++++++++ include/linux/cpufreq.h | 3 +++ 2 files changed, 46 insertions(+) diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c index c2227be7bad8..0d5942f3f0df 100644 --- a/drivers/cpufreq/cpufreq.c +++ b/drivers/cpufreq/cpufreq.c @@ -81,6 +81,7 @@ static void cpufreq_governor_limits(struct cpufreq_policy *policy); static int cpufreq_set_policy(struct cpufreq_policy *policy, struct cpufreq_governor *new_gov, unsigned int new_pol); +static bool cpufreq_boost_supported(void); /* * Two notifier lists: the "policy" list is involved in the @@ -618,6 +619,40 @@ static ssize_t store_boost(struct kobject *kobj, struct kobj_attribute *attr, } define_one_global_rw(boost); +static ssize_t show_local_boost(struct cpufreq_policy *policy, char *buf) +{ + return sysfs_emit(buf, "%d\n", policy->boost_enabled); +} + +static ssize_t store_local_boost(struct cpufreq_policy *policy, + const char *buf, size_t count) +{ + int ret, enable; + + ret = kstrtoint(buf, 10, &enable); + if (ret || enable < 0 || enable > 1) + return -EINVAL; + + if (!cpufreq_driver->boost_enabled) + return -EINVAL; + + if (policy->boost_enabled == enable) + return count; + + cpus_read_lock(); + ret = cpufreq_driver->set_boost(policy, enable); + cpus_read_unlock(); + + if (ret) + return ret; + + policy->boost_enabled = enable; + + return count; +} + +static struct freq_attr local_boost = __ATTR(boost, 0644, show_local_boost, store_local_boost); + static struct cpufreq_governor *find_governor(const char *str_governor) { struct cpufreq_governor *t; @@ -1057,6 +1092,12 @@ static int cpufreq_add_dev_interface(struct cpufreq_policy *policy) return ret; } + if (cpufreq_boost_supported()) { + ret = sysfs_create_file(&policy->kobj, &local_boost.attr); + if (ret) + return ret; + } + return 0; } @@ -2687,6 +2728,8 @@ int cpufreq_boost_trigger_state(int state) ret = cpufreq_driver->set_boost(policy, state); if (ret) goto err_reset_state; + + policy->boost_enabled = state; } cpus_read_unlock(); diff --git a/include/linux/cpufreq.h b/include/linux/cpufreq.h index 3e2818678cc3..896ca659e66a 100644 --- a/include/linux/cpufreq.h +++ b/include/linux/cpufreq.h @@ -134,6 +134,9 @@ struct cpufreq_policy { */ bool dvfs_possible_from_any_cpu; + /* Per policy boost enabled flag. */ + bool boost_enabled; + /* Cached frequency lookup from cpufreq_driver_resolve_freq. */ unsigned int cached_target_freq; unsigned int cached_resolved_idx; -- 2.33.0

2 12

[PATCH OLK-6.6 01/12] cpufreq: Support per-policy performance boost
by Qi Xi 03 Jul '25

03 Jul '25

From: Jie Zhan <zhanjie9(a)hisilicon.com> The boost control currently applies to the whole system. However, users may prefer to boost a subset of cores in order to provide prioritized performance to workloads running on the boosted cores. Enable per-policy boost by adding a 'boost' sysfs interface under each policy path. This can be found at: /sys/devices/system/cpu/cpufreq/policy<*>/boost Same to the global boost switch, writing 1/0 to the per-policy 'boost' enables/disables boost on a cpufreq policy respectively. The user view of global and per-policy boost controls should be: 1. Enabling global boost initially enables boost on all policies, and per-policy boost can then be enabled or disabled individually, given that the platform does support so. 2. Disabling global boost makes the per-policy boost interface illegal. Signed-off-by: Jie Zhan <zhanjie9(a)hisilicon.com> Reviewed-by: Wei Xu <xuwei5(a)hisilicon.com> Acked-by: Viresh Kumar <viresh.kumar(a)linaro.org> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- drivers/cpufreq/cpufreq.c | 43 +++++++++++++++++++++++++++++++++++++++ include/linux/cpufreq.h | 3 +++ 2 files changed, 46 insertions(+) diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c index c2227be7bad8..0d5942f3f0df 100644 --- a/drivers/cpufreq/cpufreq.c +++ b/drivers/cpufreq/cpufreq.c @@ -81,6 +81,7 @@ static void cpufreq_governor_limits(struct cpufreq_policy *policy); static int cpufreq_set_policy(struct cpufreq_policy *policy, struct cpufreq_governor *new_gov, unsigned int new_pol); +static bool cpufreq_boost_supported(void); /* * Two notifier lists: the "policy" list is involved in the @@ -618,6 +619,40 @@ static ssize_t store_boost(struct kobject *kobj, struct kobj_attribute *attr, } define_one_global_rw(boost); +static ssize_t show_local_boost(struct cpufreq_policy *policy, char *buf) +{ + return sysfs_emit(buf, "%d\n", policy->boost_enabled); +} + +static ssize_t store_local_boost(struct cpufreq_policy *policy, + const char *buf, size_t count) +{ + int ret, enable; + + ret = kstrtoint(buf, 10, &enable); + if (ret || enable < 0 || enable > 1) + return -EINVAL; + + if (!cpufreq_driver->boost_enabled) + return -EINVAL; + + if (policy->boost_enabled == enable) + return count; + + cpus_read_lock(); + ret = cpufreq_driver->set_boost(policy, enable); + cpus_read_unlock(); + + if (ret) + return ret; + + policy->boost_enabled = enable; + + return count; +} + +static struct freq_attr local_boost = __ATTR(boost, 0644, show_local_boost, store_local_boost); + static struct cpufreq_governor *find_governor(const char *str_governor) { struct cpufreq_governor *t; @@ -1057,6 +1092,12 @@ static int cpufreq_add_dev_interface(struct cpufreq_policy *policy) return ret; } + if (cpufreq_boost_supported()) { + ret = sysfs_create_file(&policy->kobj, &local_boost.attr); + if (ret) + return ret; + } + return 0; } @@ -2687,6 +2728,8 @@ int cpufreq_boost_trigger_state(int state) ret = cpufreq_driver->set_boost(policy, state); if (ret) goto err_reset_state; + + policy->boost_enabled = state; } cpus_read_unlock(); diff --git a/include/linux/cpufreq.h b/include/linux/cpufreq.h index 3e2818678cc3..896ca659e66a 100644 --- a/include/linux/cpufreq.h +++ b/include/linux/cpufreq.h @@ -134,6 +134,9 @@ struct cpufreq_policy { */ bool dvfs_possible_from_any_cpu; + /* Per policy boost enabled flag. */ + bool boost_enabled; + /* Cached frequency lookup from cpufreq_driver_resolve_freq. */ unsigned int cached_target_freq; unsigned int cached_resolved_idx; -- 2.33.0

2 13

[openeuler:openEuler-1.0-LTS 1605/1605] net/netfilter/nf_conntrack_core.c:1017: warning: Function parameter or member 'reply_hash' not described in 'nf_ct_resolve_clash'
by kernel test robot 03 Jul '25

03 Jul '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 382711115afc1197da2c288679079946650ef017 commit: cc12c927ac504e99fc176ea49e85226b6aeadcd5 [1605/1605] netfilter: conntrack: allow insertion of clashing entries config: x86_64-buildonly-randconfig-2002-20250501 (https://download.01.org/0day-ci/archive/20250703/202507030549.czVv179y-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250703/202507030549.czVv179y-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507030549.czVv179y-lkp@intel.com/ All warnings (new ones prefixed by >>): >> net/netfilter/nf_conntrack_core.c:1017: warning: Function parameter or member 'reply_hash' not described in 'nf_ct_resolve_clash' >> net/netfilter/nf_conntrack_core.c:1017: warning: Excess function parameter 'hash_reply' description in 'nf_ct_resolve_clash' vim +1017 net/netfilter/nf_conntrack_core.c cc12c927ac504e Florian Westphal 2023-11-02 980 6199b71796bcaa Florian Westphal 2023-11-02 981 /** 6199b71796bcaa Florian Westphal 2023-11-02 982 * nf_ct_resolve_clash - attempt to handle clash without packet drop 6199b71796bcaa Florian Westphal 2023-11-02 983 * 6199b71796bcaa Florian Westphal 2023-11-02 984 * @skb: skb that causes the clash 6199b71796bcaa Florian Westphal 2023-11-02 985 * @h: tuplehash of the clashing entry already in table cc12c927ac504e Florian Westphal 2023-11-02 986 * @hash_reply: hash slot for reply direction 6199b71796bcaa Florian Westphal 2023-11-02 987 * 6199b71796bcaa Florian Westphal 2023-11-02 988 * A conntrack entry can be inserted to the connection tracking table 6199b71796bcaa Florian Westphal 2023-11-02 989 * if there is no existing entry with an identical tuple. 6199b71796bcaa Florian Westphal 2023-11-02 990 * 6199b71796bcaa Florian Westphal 2023-11-02 991 * If there is one, @skb (and the assocated, unconfirmed conntrack) has 6199b71796bcaa Florian Westphal 2023-11-02 992 * to be dropped. In case @skb is retransmitted, next conntrack lookup 6199b71796bcaa Florian Westphal 2023-11-02 993 * will find the already-existing entry. 6199b71796bcaa Florian Westphal 2023-11-02 994 * 6199b71796bcaa Florian Westphal 2023-11-02 995 * The major problem with such packet drop is the extra delay added by 6199b71796bcaa Florian Westphal 2023-11-02 996 * the packet loss -- it will take some time for a retransmit to occur 6199b71796bcaa Florian Westphal 2023-11-02 997 * (or the sender to time out when waiting for a reply). 6199b71796bcaa Florian Westphal 2023-11-02 998 * 6199b71796bcaa Florian Westphal 2023-11-02 999 * This function attempts to handle the situation without packet drop. 6199b71796bcaa Florian Westphal 2023-11-02 1000 * 6199b71796bcaa Florian Westphal 2023-11-02 1001 * If @skb has no NAT transformation or if the colliding entries are 6199b71796bcaa Florian Westphal 2023-11-02 1002 * exactly the same, only the to-be-confirmed conntrack entry is discarded 6199b71796bcaa Florian Westphal 2023-11-02 1003 * and @skb is associated with the conntrack entry already in the table. 6199b71796bcaa Florian Westphal 2023-11-02 1004 * cc12c927ac504e Florian Westphal 2023-11-02 1005 * Failing that, the new, unconfirmed conntrack is still added to the table cc12c927ac504e Florian Westphal 2023-11-02 1006 * provided that the collision only occurs in the ORIGINAL direction. cc12c927ac504e Florian Westphal 2023-11-02 1007 * The new entry will be added after the existing one in the hash list, cc12c927ac504e Florian Westphal 2023-11-02 1008 * so packets in the ORIGINAL direction will continue to match the existing cc12c927ac504e Florian Westphal 2023-11-02 1009 * entry. The new entry will also have a fixed timeout so it expires -- cc12c927ac504e Florian Westphal 2023-11-02 1010 * due to the collision, it will not see bidirectional traffic. cc12c927ac504e Florian Westphal 2023-11-02 1011 * 6199b71796bcaa Florian Westphal 2023-11-02 1012 * Returns NF_DROP if the clash could not be resolved. 6199b71796bcaa Florian Westphal 2023-11-02 1013 */ 115dffa33ea6f5 Florian Westphal 2023-11-02 1014 static __cold noinline int cc12c927ac504e Florian Westphal 2023-11-02 1015 nf_ct_resolve_clash(struct sk_buff *skb, struct nf_conntrack_tuple_hash *h, cc12c927ac504e Florian Westphal 2023-11-02 1016 u32 reply_hash) 71d8c47fc65371 Pablo Neira Ayuso 2016-05-01 @1017 { 71d8c47fc65371 Pablo Neira Ayuso 2016-05-01 1018 /* This is the conntrack entry already in hashes that won race. */ 71d8c47fc65371 Pablo Neira Ayuso 2016-05-01 1019 struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h); b3480fe059ac91 Florian Westphal 2017-08-12 1020 const struct nf_conntrack_l4proto *l4proto; 6199b71796bcaa Florian Westphal 2023-11-02 1021 enum ip_conntrack_info ctinfo; 6199b71796bcaa Florian Westphal 2023-11-02 1022 struct nf_conn *loser_ct; 6199b71796bcaa Florian Westphal 2023-11-02 1023 struct net *net; 94ebb264459f97 Florian Westphal 2023-11-02 1024 int ret; 6199b71796bcaa Florian Westphal 2023-11-02 1025 6199b71796bcaa Florian Westphal 2023-11-02 1026 loser_ct = nf_ct_get(skb, &ctinfo); 94ebb264459f97 Florian Westphal 2023-11-02 1027 net = nf_ct_net(loser_ct); 71d8c47fc65371 Pablo Neira Ayuso 2016-05-01 1028 71d8c47fc65371 Pablo Neira Ayuso 2016-05-01 1029 l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct)); 6199b71796bcaa Florian Westphal 2023-11-02 1030 if (!l4proto->allow_clash) 6199b71796bcaa Florian Westphal 2023-11-02 1031 goto drop; 6199b71796bcaa Florian Westphal 2023-11-02 1032 94ebb264459f97 Florian Westphal 2023-11-02 1033 ret = __nf_ct_resolve_clash(skb, h); 94ebb264459f97 Florian Westphal 2023-11-02 1034 if (ret == NF_ACCEPT) 94ebb264459f97 Florian Westphal 2023-11-02 1035 return ret; 6199b71796bcaa Florian Westphal 2023-11-02 1036 cc12c927ac504e Florian Westphal 2023-11-02 1037 ret = nf_ct_resolve_clash_harder(skb, reply_hash); cc12c927ac504e Florian Westphal 2023-11-02 1038 if (ret == NF_ACCEPT) cc12c927ac504e Florian Westphal 2023-11-02 1039 return ret; cc12c927ac504e Florian Westphal 2023-11-02 1040 6199b71796bcaa Florian Westphal 2023-11-02 1041 drop: 94ebb264459f97 Florian Westphal 2023-11-02 1042 nf_ct_add_to_dying_list(loser_ct); 71d8c47fc65371 Pablo Neira Ayuso 2016-05-01 1043 NF_CT_STAT_INC(net, drop); 94ebb264459f97 Florian Westphal 2023-11-02 1044 NF_CT_STAT_INC(net, insert_failed); 71d8c47fc65371 Pablo Neira Ayuso 2016-05-01 1045 return NF_DROP; 71d8c47fc65371 Pablo Neira Ayuso 2016-05-01 1046 } 71d8c47fc65371 Pablo Neira Ayuso 2016-05-01 1047 :::::: The code at line 1017 was first introduced by commit :::::: 71d8c47fc653711c41bc3282e5b0e605b3727956 netfilter: conntrack: introduce clash resolution on insertion race :::::: TO: Pablo Neira Ayuso <pablo(a)netfilter.org> :::::: CC: Pablo Neira Ayuso <pablo(a)netfilter.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/6] OLK-6.6 Bperf
by Xiaomeng Zhang 03 Jul '25

03 Jul '25

Ian Rogers (1): perf test bpf-counters: Add test for BPF event modifier Tengda Wu (2): perf stat: Support inherit events during fork() for bperf perf test: Use sqrtloop workload to test bperf event Veronika Molnarova (1): perf test stat_bpf_counter.sh: Stabilize the test results Xiaomeng Zhang (2): perf stat: Increase perf_attr_map entries perf stat: Fix incorrect display of bperf when event count is 0 tools/lib/perf/include/perf/bpf_perf.h | 1 + tools/perf/builtin-stat.c | 1 + tools/perf/tests/shell/stat_bpf_counters.sh | 79 ++++++++++----- tools/perf/util/bpf_counter.c | 61 +++++++++--- tools/perf/util/bpf_skel/bperf_follower.bpf.c | 98 +++++++++++++++++-- tools/perf/util/bpf_skel/bperf_u.h | 5 + tools/perf/util/target.h | 1 + 7 files changed, 198 insertions(+), 48 deletions(-) -- 2.34.1

2 7

[openeuler:openEuler-1.0-LTS 1605/1605] fs/ocfs2/dlm/dlmcommon.h:709:9: warning: 'BITS_TO_BYTES' macro redefined
by kernel test robot 03 Jul '25

03 Jul '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: d96cd567c8d8d584405abe92c2576bf58202fa6e commit: 8f44df8094e0d4dcd28122eab732820e5c639ccd [1605/1605] net/netlink: fix NETLINK_LIST_MEMBERSHIPS length report config: x86_64-buildonly-randconfig-2002-20250501 (https://download.01.org/0day-ci/archive/20250703/202507030301.JSR1Dol1-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250703/202507030301.JSR1Dol1-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507030301.JSR1Dol1-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from fs/ocfs2/dlm/dlmdomain.c:43: >> fs/ocfs2/dlm/dlmcommon.h:709:9: warning: 'BITS_TO_BYTES' macro redefined [-Wmacro-redefined] 709 | #define BITS_TO_BYTES(bits) (((bits)+BITS_PER_BYTE-1)/BITS_PER_BYTE) | ^ include/linux/bitops.h:9:9: note: previous definition is here 9 | #define BITS_TO_BYTES(nr) DIV_ROUND_UP(nr, BITS_PER_TYPE(char)) | ^ 1 warning generated. -- In file included from fs/ocfs2/dlm/dlmthread.c:48: >> fs/ocfs2/dlm/dlmcommon.h:709:9: warning: 'BITS_TO_BYTES' macro redefined [-Wmacro-redefined] 709 | #define BITS_TO_BYTES(bits) (((bits)+BITS_PER_BYTE-1)/BITS_PER_BYTE) | ^ include/linux/bitops.h:9:9: note: previous definition is here 9 | #define BITS_TO_BYTES(nr) DIV_ROUND_UP(nr, BITS_PER_TYPE(char)) | ^ fs/ocfs2/dlm/dlmthread.c:534:18: warning: equality comparison with extraneous parentheses [-Wparentheses-equality] 534 | if ((res->owner == dlm->node_num)) { | ~~~~~~~~~~~^~~~~~~~~~~~~~~~ fs/ocfs2/dlm/dlmthread.c:534:18: note: remove extraneous parentheses around the comparison to silence this warning 534 | if ((res->owner == dlm->node_num)) { | ~ ^ ~ fs/ocfs2/dlm/dlmthread.c:534:18: note: use '=' to turn this equality comparison into an assignment 534 | if ((res->owner == dlm->node_num)) { | ^~ | = 2 warnings generated. vim +/BITS_TO_BYTES +709 fs/ocfs2/dlm/dlmcommon.h 6714d8e86bf443 Kurt Hackel 2005-12-15 706 6714d8e86bf443 Kurt Hackel 2005-12-15 707 1faf289454b9ee Srinivas Eeda 2007-01-29 708 #define BITS_PER_BYTE 8 1faf289454b9ee Srinivas Eeda 2007-01-29 @709 #define BITS_TO_BYTES(bits) (((bits)+BITS_PER_BYTE-1)/BITS_PER_BYTE) 1faf289454b9ee Srinivas Eeda 2007-01-29 710 :::::: The code at line 709 was first introduced by commit :::::: 1faf289454b9eeb6e463da3eee47f7009668370d ocfs2_dlm: disallow a domain join if node maps mismatch :::::: TO: Srinivas Eeda <srinivas.eeda(a)oracle.com> :::::: CC: Mark Fasheh <mark.fasheh(a)oracle.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] crypto: algif_hash - fix double free in hash_accept
by Gu Bowen 03 Jul '25

03 Jul '25

From: Ivan Pravdin <ipravdin.official(a)gmail.com> mainline inclusion from mainline-v6.15 commit b2df03ed4052e97126267e8c13ad4204ea6ba9b6 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICGACQ CVE: CVE-2025-38079 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If accept(2) is called on socket type algif_hash with MSG_MORE flag set and crypto_ahash_import fails, sk2 is freed. However, it is also freed in af_alg_release, leading to slab-use-after-free error. Fixes: fe869cdb89c9 ("crypto: algif_hash - User-space interface for hash operations") Cc: <stable(a)vger.kernel.org> Signed-off-by: Ivan Pravdin <ipravdin.official(a)gmail.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Conflicts: crypto/algif_hash.c [Context conflicts.] Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- crypto/algif_hash.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/crypto/algif_hash.c b/crypto/algif_hash.c index bfcf595fd8f9..3547db4ac4b2 100644 --- a/crypto/algif_hash.c +++ b/crypto/algif_hash.c @@ -267,10 +267,6 @@ static int hash_accept(struct socket *sock, struct socket *newsock, int flags, return err; err = crypto_ahash_import(&ctx2->req, state); - if (err) { - sock_orphan(sk2); - sock_put(sk2); - } return err; } -- 2.25.1

2 1

[PATCH OLK-6.6 V1] rseq: Fix segfault on registration when rseq_cs is non-zero
by Wang Tao 03 Jul '25

03 Jul '25

From: Michael Jeanson <mjeanson(a)efficios.com> mainline inclusion from mainline-v6.15-rc1 commit fd881d0a085fc54354414aed990ccf05f282ba53 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICGAFQ CVE: CVE-2025-38067 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The rseq_cs field is documented as being set to 0 by user-space prior to registration, however this is not currently enforced by the kernel. This can result in a segfault on return to user-space if the value stored in the rseq_cs field doesn't point to a valid struct rseq_cs. The correct solution to this would be to fail the rseq registration when the rseq_cs field is non-zero. However, some older versions of glibc will reuse the rseq area of previous threads without clearing the rseq_cs field and will also terminate the process if the rseq registration fails in a secondary thread. This wasn't caught in testing because in this case the leftover rseq_cs does point to a valid struct rseq_cs. What we can do is clear the rseq_cs field on registration when it's non-zero which will prevent segfaults on registration and won't break the glibc versions that reuse rseq areas on thread creation. Signed-off-by: Michael Jeanson <mjeanson(a)efficios.com> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Reviewed-by: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Cc: Peter Zijlstra <peterz(a)infradead.org> Cc: Linus Torvalds <torvalds(a)linux-foundation.org> Link: https://lore.kernel.org/r/20250306211223.109455-1-mjeanson@efficios.com Conflicts: kernel/rseq.c [In method SYSCALL_DEFINE4(), there are some code in mainline but OLK-6.6 has not merged] Signed-off-by: Wang Tao <wangtao554(a)huawei.com> --- kernel/rseq.c | 60 ++++++++++++++++++++++++++++++++++++++++----------- 1 file changed, 48 insertions(+), 12 deletions(-) diff --git a/kernel/rseq.c b/kernel/rseq.c index 9de6e35fe679..b4136ec87737 100644 --- a/kernel/rseq.c +++ b/kernel/rseq.c @@ -149,6 +149,29 @@ static int rseq_reset_rseq_cpu_node_id(struct task_struct *t) return 0; } +/* + * Get the user-space pointer value stored in the 'rseq_cs' field. + */ +static int rseq_get_rseq_cs_ptr_val(struct rseq __user *rseq, u64 *rseq_cs) +{ + if (!rseq_cs) + return -EFAULT; + +#ifdef CONFIG_64BIT + if (get_user(*rseq_cs, &rseq->rseq_cs)) + return -EFAULT; +#else + if (copy_from_user(rseq_cs, &rseq->rseq_cs, sizeof(*rseq_cs))) + return -EFAULT; +#endif + + return 0; +} + +/* + * If the rseq_cs field of 'struct rseq' contains a valid pointer to + * user-space, copy 'struct rseq_cs' from user-space and validate its fields. + */ static int rseq_get_rseq_cs(struct task_struct *t, struct rseq_cs *rseq_cs) { struct rseq_cs __user *urseq_cs; @@ -157,17 +180,16 @@ static int rseq_get_rseq_cs(struct task_struct *t, struct rseq_cs *rseq_cs) u32 sig; int ret; -#ifdef CONFIG_64BIT - if (get_user(ptr, &t->rseq->rseq_cs)) - return -EFAULT; -#else - if (copy_from_user(&ptr, &t->rseq->rseq_cs, sizeof(ptr))) - return -EFAULT; -#endif + ret = rseq_get_rseq_cs_ptr_val(t->rseq, &ptr); + if (ret) + return ret; + + /* If the rseq_cs pointer is NULL, return a cleared struct rseq_cs. */ if (!ptr) { memset(rseq_cs, 0, sizeof(*rseq_cs)); return 0; } + /* Check that the pointer value fits in the user-space process space. */ if (ptr >= TASK_SIZE) return -EINVAL; urseq_cs = (struct rseq_cs __user *)(unsigned long)ptr; @@ -243,7 +265,7 @@ static int rseq_need_restart(struct task_struct *t, u32 cs_flags) return !!event_mask; } -static int clear_rseq_cs(struct task_struct *t) +static int clear_rseq_cs(struct rseq __user *rseq) { /* * The rseq_cs field is set to NULL on preemption or signal @@ -254,9 +276,9 @@ static int clear_rseq_cs(struct task_struct *t) * Set rseq_cs to NULL. */ #ifdef CONFIG_64BIT - return put_user(0UL, &t->rseq->rseq_cs); + return put_user(0UL, &rseq->rseq_cs); #else - if (clear_user(&t->rseq->rseq_cs, sizeof(t->rseq->rseq_cs))) + if (clear_user(&rseq->rseq_cs, sizeof(rseq->rseq_cs))) return -EFAULT; return 0; #endif @@ -288,11 +310,11 @@ static int rseq_ip_fixup(struct pt_regs *regs) * Clear the rseq_cs pointer and return. */ if (!in_rseq_cs(ip, &rseq_cs)) - return clear_rseq_cs(t); + return clear_rseq_cs(t->rseq); ret = rseq_need_restart(t, rseq_cs.flags); if (ret <= 0) return ret; - ret = clear_rseq_cs(t); + ret = clear_rseq_cs(t->rseq); if (ret) return ret; trace_rseq_ip_fixup(ip, rseq_cs.start_ip, rseq_cs.post_commit_offset, @@ -366,6 +388,7 @@ SYSCALL_DEFINE4(rseq, struct rseq __user *, rseq, u32, rseq_len, int, flags, u32, sig) { int ret; + u64 rseq_cs; if (flags & RSEQ_FLAG_UNREGISTER) { if (flags & ~RSEQ_FLAG_UNREGISTER) @@ -420,6 +443,19 @@ SYSCALL_DEFINE4(rseq, struct rseq __user *, rseq, u32, rseq_len, return -EINVAL; if (!access_ok(rseq, rseq_len)) return -EFAULT; + + /* + * If the rseq_cs pointer is non-NULL on registration, clear it to + * avoid a potential segfault on return to user-space. The proper thing + * to do would have been to fail the registration but this would break + * older libcs that reuse the rseq area for new threads without + * clearing the fields. + */ + if (rseq_get_rseq_cs_ptr_val(rseq, &rseq_cs)) + return -EFAULT; + if (rseq_cs && clear_rseq_cs(rseq)) + return -EFAULT; + current->rseq = rseq; current->rseq_len = rseq_len; current->rseq_sig = sig; -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 1605/1605] drivers/pci/hotplug/pciehp_core.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 03 Jul '25

03 Jul '25

Hi Keith, First bad commit (maybe != root cause): tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: d96cd567c8d8d584405abe92c2576bf58202fa6e commit: 58d584102f06f870f118644f1022c751e015e7bb [1605/1605] PCI: portdrv: Initialize service drivers directly config: x86_64-buildonly-randconfig-2004-20250501 (https://download.01.org/0day-ci/archive/20250703/202507030314.c8FttoWL-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250703/202507030314.c8FttoWL-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507030314.c8FttoWL-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/pci/hotplug/pciehp_core.c:214: warning: Function parameter or member 'ctrl' not described in 'pciehp_check_presence' >> drivers/pci/hotplug/pciehp_core.o: warning: objtool: missing symbol for section .init.text -- drivers/pci/pcie/aer.c:217: warning: Function parameter or member 'str' not described in 'pcie_ecrc_get_policy' >> drivers/pci/pcie/aer.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] net: mdio: fix undefined behavior in bit shift for __mdiobus_register
by Zhang Changzhong 03 Jul '25

03 Jul '25

From: Cui GaoSheng <cuigaosheng1(a)huawei.com> stable inclusion from stable-v4.19.265 commit a3fafc974be37319679f36dc4e7cca7db1e02973 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC5BVD CVE: CVE-2022-49907 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 40e4eb324c59e11fcb927aa46742d28aba6ecb8a ] Shifting signed 32-bit value by 31 bits is undefined, so changing significant bit to unsigned. The UBSAN warning calltrace like below: UBSAN: shift-out-of-bounds in drivers/net/phy/mdio_bus.c:586:27 left shift of 1 by 31 places cannot be represented in type 'int' Call Trace: <TASK> dump_stack_lvl+0x7d/0xa5 dump_stack+0x15/0x1b ubsan_epilogue+0xe/0x4e __ubsan_handle_shift_out_of_bounds+0x1e7/0x20c __mdiobus_register+0x49d/0x4e0 fixed_mdio_bus_init+0xd8/0x12d do_one_initcall+0x76/0x430 kernel_init_freeable+0x3b3/0x422 kernel_init+0x24/0x1e0 ret_from_fork+0x1f/0x30 </TASK> Fixes: 4fd5f812c23c ("phylib: allow incremental scanning of an mii bus") Signed-off-by: Gaosheng Cui <cuigaosheng1(a)huawei.com> Reviewed-by: Andrew Lunn <andrew(a)lunn.ch> Link: https://lore.kernel.org/r/20221031132645.168421-1-cuigaosheng1@huawei.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/net/phy/mdio_bus.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c index 60c732d..0f0cdb4 100644 --- a/drivers/net/phy/mdio_bus.c +++ b/drivers/net/phy/mdio_bus.c @@ -416,7 +416,7 @@ int __mdiobus_register(struct mii_bus *bus, struct module *owner) bus->reset(bus); for (i = 0; i < PHY_MAX_ADDR; i++) { - if ((bus->phy_mask & (1 << i)) == 0) { + if ((bus->phy_mask & BIT(i)) == 0) { struct phy_device *phydev; phydev = mdiobus_scan(bus, i); -- 2.9.5

2 1