- Kernel - mailweb.openeuler.org

[PATCH v5.15 0/2] x86/irq: Plug vector setup race
by Jinjie Ruan 21 Aug '25

21 Aug '25

There is a vector setup race, which overwrites the interrupt descriptor in the per CPU vector array resulting in a disfunctional device. CPU0 CPU1 interrupt is raised in APIC IRR but not handled free_irq() per_cpu(vector_irq, CPU1)[vector] = VECTOR_SHUTDOWN; request_irq() common_interrupt() d = this_cpu_read(vector_irq[vector]); per_cpu(vector_irq, CPU1)[vector] = desc; if (d == VECTOR_SHUTDOWN) this_cpu_write(vector_irq[vector], VECTOR_UNUSED); free_irq() cannot observe the pending vector in the CPU1 APIC as there is no way to query the remote CPUs APIC IRR. This requires that request_irq() uses the same vector/CPU as the one which was freed, but this also can be triggered by a spurious interrupt. Interestingly enough this problem managed to be hidden for more than a decade. Prevent this by reevaluating vector_irq under the vector lock, which is held by the interrupt activation code when vector_irq is updated. Fixes: 9345005f4eed ("x86/irq: Fix do_IRQ() interrupt warning for cpu hotplug retriggered irqs") Cc: stable(a)vger.kernel.org#5.15.x Cc: gregkh(a)linuxfoundation.org Jacob Pan (1): x86/irq: Factor out handler invocation from common_interrupt() Thomas Gleixner (1): x86/irq: Plug vector setup race arch/x86/kernel/irq.c | 70 ++++++++++++++++++++++++++++++++++--------- 1 file changed, 56 insertions(+), 14 deletions(-) -- 2.34.1

1 2

[PATCH OLK-5.10] vfio/pci: Properly hide first-in-list PCIe extended capability
by Zhang Qilong 21 Aug '25

21 Aug '25

From: Avihai Horon <avihaih(a)nvidia.com> stable inclusion from stable-v5.10.231 commit 0918f5643fc6c3f7801f4a22397d2cc09ba99207 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBLDIK CVE: CVE-2024-53214 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fe4bf8d0b6716a423b16495d55b35d3fe515905d ] There are cases where a PCIe extended capability should be hidden from the user. For example, an unknown capability (i.e., capability with ID greater than PCI_EXT_CAP_ID_MAX) or a capability that is intentionally chosen to be hidden from the user. Hiding a capability is done by virtualizing and modifying the 'Next Capability Offset' field of the previous capability so it points to the capability after the one that should be hidden. The special case where the first capability in the list should be hidden is handled differently because there is no previous capability that can be modified. In this case, the capability ID and version are zeroed while leaving the next pointer intact. This hides the capability and leaves an anchor for the rest of the capability list. However, today, hiding the first capability in the list is not done properly if the capability is unknown, as struct vfio_pci_core_device->pci_config_map is set to the capability ID during initialization but the capability ID is not properly checked later when used in vfio_config_do_rw(). This leads to the following warning [1] and to an out-of-bounds access to ecap_perms array. Fix it by checking cap_id in vfio_config_do_rw(), and if it is greater than PCI_EXT_CAP_ID_MAX, use an alternative struct perm_bits for direct read only access instead of the ecap_perms array. Note that this is safe since the above is the only case where cap_id can exceed PCI_EXT_CAP_ID_MAX (except for the special capabilities, which are already checked before). [1] WARNING: CPU: 118 PID: 5329 at drivers/vfio/pci/vfio_pci_config.c:1900 vfio_pci_config_rw+0x395/0x430 [vfio_pci_core] CPU: 118 UID: 0 PID: 5329 Comm: simx-qemu-syste Not tainted 6.12.0+ #1 (snip) Call Trace: <TASK> ? show_regs+0x69/0x80 ? __warn+0x8d/0x140 ? vfio_pci_config_rw+0x395/0x430 [vfio_pci_core] ? report_bug+0x18f/0x1a0 ? handle_bug+0x63/0xa0 ? exc_invalid_op+0x19/0x70 ? asm_exc_invalid_op+0x1b/0x20 ? vfio_pci_config_rw+0x395/0x430 [vfio_pci_core] ? vfio_pci_config_rw+0x244/0x430 [vfio_pci_core] vfio_pci_rw+0x101/0x1b0 [vfio_pci_core] vfio_pci_core_read+0x1d/0x30 [vfio_pci_core] vfio_device_fops_read+0x27/0x40 [vfio] vfs_read+0xbd/0x340 ? vfio_device_fops_unl_ioctl+0xbb/0x740 [vfio] ? __rseq_handle_notify_resume+0xa4/0x4b0 __x64_sys_pread64+0x96/0xc0 x64_sys_call+0x1c3d/0x20d0 do_syscall_64+0x4d/0x120 entry_SYSCALL_64_after_hwframe+0x76/0x7e Fixes: 89e1f7d4c66d ("vfio: Add PCI device driver") Signed-off-by: Avihai Horon <avihaih(a)nvidia.com> Reviewed-by: Yi Liu <yi.l.liu(a)intel.com> Tested-by: Yi Liu <yi.l.liu(a)intel.com> Link: https://lore.kernel.org/r/20241124142739.21698-1-avihaih@nvidia.com Signed-off-by: Alex Williamson <alex.williamson(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/vfio/pci/vfio_pci_config.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/drivers/vfio/pci/vfio_pci_config.c b/drivers/vfio/pci/vfio_pci_config.c index 2a1dff299d63..7a4b7b8b432c 100644 --- a/drivers/vfio/pci/vfio_pci_config.c +++ b/drivers/vfio/pci/vfio_pci_config.c @@ -311,10 +311,14 @@ static int vfio_virt_config_read(struct vfio_pci_device *vdev, int pos, { memcpy(val, vdev->vconfig + pos, count); return count; } +static struct perm_bits direct_ro_perms = { + .readfn = vfio_direct_config_read, +}; + /* Default capability regions to read-only, no-virtualization */ static struct perm_bits cap_perms[PCI_CAP_ID_MAX + 1] = { [0 ... PCI_CAP_ID_MAX] = { .readfn = vfio_direct_config_read } }; static struct perm_bits ecap_perms[PCI_EXT_CAP_ID_MAX + 1] = { @@ -1845,13 +1849,21 @@ static ssize_t vfio_config_do_rw(struct vfio_pci_device *vdev, char __user *buf, } else if (cap_id == PCI_CAP_ID_INVALID_VIRT) { perm = &virt_perms; cap_start = *ppos; } else { if (*ppos >= PCI_CFG_SPACE_SIZE) { - WARN_ON(cap_id > PCI_EXT_CAP_ID_MAX); + /* + * We can get a cap_id that exceeds PCI_EXT_CAP_ID_MAX + * if we're hiding an unknown capability at the start + * of the extended capability list. Use default, ro + * access, which will virtualize the id and next values. + */ + if (cap_id > PCI_EXT_CAP_ID_MAX) + perm = &direct_ro_perms; + else + perm = &ecap_perms[cap_id]; - perm = &ecap_perms[cap_id]; cap_start = vfio_find_cap_start(vdev, *ppos); } else { WARN_ON(cap_id > PCI_CAP_ID_MAX); perm = &cap_perms[cap_id]; -- 2.43.0

2 1

[PATCH OLK-6.6] mm/util: make memdup_user_nul() similar to memdup_user()
by Zhang Yuwei 21 Aug '25

21 Aug '25

From: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> mainline inclusion from mainline-v6.13-rc6 commit dd2a5b5514ab0e690f018595e34dd1fcb981d345 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICU1VU CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Since the string data to copy from userspace is likely less than PAGE_SIZE bytes, replace GFP_KERNEL with GFP_USER like commit 6c2c97a24f09 ("memdup_user(): switch to GFP_USER") does and add __GFP_NOWARN like commit 6c8fcc096be9 ("mm: don't let userspace spam allocations warnings") does. Also, use dedicated slab buckets like commit d73778e4b867 ("mm/util: Use dedicated slab buckets for memdup_user()") does. Fixes: e9d408e107db ("new helper: memdup_user_nul()") Link: https://lkml.kernel.org/r/014cd694-cc27-4a07-a34a-2ae95d744515@I-love.SAKUR… Reported-by: syzbot+7e12e97b36154c54414b(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=7e12e97b36154c54414b Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: mm/util.c [Comflicts with mainline commit b32801d1255be ("mm/slab: Introduce kmem_buckets_create() and family").] Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> --- mm/util.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/mm/util.c b/mm/util.c index f3d6751b2f2a..7a5eed15c98f 100644 --- a/mm/util.c +++ b/mm/util.c @@ -278,12 +278,7 @@ void *memdup_user_nul(const void __user *src, size_t len) { char *p; - /* - * Always use GFP_KERNEL, since copy_from_user() can sleep and - * cause pagefault, which makes it pointless to use GFP_NOFS - * or GFP_ATOMIC. - */ - p = kmalloc_track_caller(len + 1, GFP_KERNEL); + p = kmalloc_track_caller(len + 1, GFP_USER | __GFP_NOWARN); if (!p) return ERR_PTR(-ENOMEM); -- 2.22.0

2 1

[PATCH openEuler-1.0-LTS] drm/sched: Increment job count before swapping tail spsc queue
by Yi Yang 21 Aug '25

21 Aug '25

From: Matthew Brost <matthew.brost(a)intel.com> mainline inclusion from mainline-v6.16-rc5 commit 8af39ec5cf2be522c8eb43a3d8005ed59e4daaee category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICTB3B CVE: CVE-2025-38515 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- A small race exists between spsc_queue_push and the run-job worker, in which spsc_queue_push may return not-first while the run-job worker has already idled due to the job count being zero. If this race occurs, job scheduling stops, leading to hangs while waiting on the job’s DMA fences. Seal this race by incrementing the job count before appending to the SPSC queue. This race was observed on a drm-tip 6.16-rc1 build with the Xe driver in an SVM test case. Fixes: 1b1f42d8fde4 ("drm: move amd_gpu_scheduler into common location") Fixes: 27105db6c63a ("drm/amdgpu: Add SPSC queue to scheduler.") Cc: stable(a)vger.kernel.org Signed-off-by: Matthew Brost <matthew.brost(a)intel.com> Reviewed-by: Jonathan Cavitt <jonathan.cavitt(a)intel.com> Link: https://lore.kernel.org/r/20250613212013.719312-1-matthew.brost@intel.com Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- include/drm/spsc_queue.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/include/drm/spsc_queue.h b/include/drm/spsc_queue.h index 125f096c88cb..ee9df8cc67b7 100644 --- a/include/drm/spsc_queue.h +++ b/include/drm/spsc_queue.h @@ -70,9 +70,11 @@ static inline bool spsc_queue_push(struct spsc_queue *queue, struct spsc_node *n preempt_disable(); + atomic_inc(&queue->job_count); + smp_mb__after_atomic(); + tail = (struct spsc_node **)atomic_long_xchg(&queue->tail, (long)&node->next); WRITE_ONCE(*tail, node); - atomic_inc(&queue->job_count); /* * In case of first element verify new node will be visible to the consumer -- 2.25.1

2 1

[PATCH OLK-6.6] drm/sched: Increment job count before swapping tail spsc queue
by Yi Yang 21 Aug '25

21 Aug '25

From: Matthew Brost <matthew.brost(a)intel.com> stable inclusion from stable-v6.6.99 commit c64f5310530baf75328292f9b9f3f2961d185183 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICTB3B CVE: CVE-2025-38515 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 8af39ec5cf2be522c8eb43a3d8005ed59e4daaee upstream. A small race exists between spsc_queue_push and the run-job worker, in which spsc_queue_push may return not-first while the run-job worker has already idled due to the job count being zero. If this race occurs, job scheduling stops, leading to hangs while waiting on the job’s DMA fences. Seal this race by incrementing the job count before appending to the SPSC queue. This race was observed on a drm-tip 6.16-rc1 build with the Xe driver in an SVM test case. Fixes: 1b1f42d8fde4 ("drm: move amd_gpu_scheduler into common location") Fixes: 27105db6c63a ("drm/amdgpu: Add SPSC queue to scheduler.") Cc: stable(a)vger.kernel.org Signed-off-by: Matthew Brost <matthew.brost(a)intel.com> Reviewed-by: Jonathan Cavitt <jonathan.cavitt(a)intel.com> Link: https://lore.kernel.org/r/20250613212013.719312-1-matthew.brost@intel.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- include/drm/spsc_queue.h | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/include/drm/spsc_queue.h b/include/drm/spsc_queue.h index 125f096c88cb..ee9df8cc67b7 100644 --- a/include/drm/spsc_queue.h +++ b/include/drm/spsc_queue.h @@ -70,9 +70,11 @@ static inline bool spsc_queue_push(struct spsc_queue *queue, struct spsc_node *n preempt_disable(); + atomic_inc(&queue->job_count); + smp_mb__after_atomic(); + tail = (struct spsc_node **)atomic_long_xchg(&queue->tail, (long)&node->next); WRITE_ONCE(*tail, node); - atomic_inc(&queue->job_count); /* * In case of first element verify new node will be visible to the consumer -- 2.25.1

2 1

[PATCH OLK-6.6] spi: spi-imx: Add check for spi_imx_setupxfer()
by Zhao Yipeng 21 Aug '25

21 Aug '25

From: Tamura Dai <kirinode0(a)gmail.com> stable inclusion from stable-v6.6.89 commit 2b4479eb462ecb39001b38dfb331fc6028dedac8 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IC8J7I Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 951a04ab3a2db4029debfa48d380ef834b93207e ] Add check for the return value of spi_imx_setupxfer(). spi_imx->rx and spi_imx->tx function pointer can be NULL when spi_imx_setupxfer() return error, and make NULL pointer dereference. Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 Call trace: 0x0 spi_imx_pio_transfer+0x50/0xd8 spi_imx_transfer_one+0x18c/0x858 spi_transfer_one_message+0x43c/0x790 __spi_pump_transfer_message+0x238/0x5d4 __spi_sync+0x2b0/0x454 spi_write_then_read+0x11c/0x200 Signed-off-by: Tamura Dai <kirinode0(a)gmail.com> Reviewed-by: Carlos Song <carlos.song(a)nxp.com> Link: https://patch.msgid.link/20250417011700.14436-1-kirinode0@gmail.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhao Yipeng <zhaoyipeng5(a)huawei.com> --- drivers/spi/spi-imx.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c index daa32bde6155..da4442954375 100644 --- a/drivers/spi/spi-imx.c +++ b/drivers/spi/spi-imx.c @@ -1614,10 +1614,13 @@ static int spi_imx_transfer_one(struct spi_controller *controller, struct spi_device *spi, struct spi_transfer *transfer) { + int ret; struct spi_imx_data *spi_imx = spi_controller_get_devdata(spi->controller); unsigned long hz_per_byte, byte_limit; - spi_imx_setupxfer(spi, transfer); + ret = spi_imx_setupxfer(spi, transfer); + if (ret < 0) + return ret; transfer->effective_speed_hz = spi_imx->spi_bus_clk; /* flush rxfifo before transfer */ -- 2.34.1

2 1

[PATCH OLK-6.6 0/13] cpufreq: Exit governor when failed to start old governor
by Lifeng Zheng 21 Aug '25

21 Aug '25

From: linhongye <linhongye(a)h-partners.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICTP7R ---------------------------------------------------------------------- Lifeng Zheng (12): cpufreq: cppc: Fix invalid return value in hisi_cppc_cpufreq_get_rate() cpufreq: CPPC: Remove forward declaration of hisi_cppc_cpufreq_get_rate() cpufreq: CPPC: Remove cpu_data_list cpufreq: CPPC: Do not return a value from populate_efficiency_class() cpufreq: CPPC: Remove forward declaration of cppc_cpufreq_register_em() cpufreq: Contain scaling_cur_freq.attr in cpufreq_attrs cpufreq: Remove duplicate check in __cpufreq_offline() cpufreq: Hold cpufreq_driver_lock when assigning cpufreq_driver->set_boost cpufreq: Initialize cpufreq-based frequency-invariance later cpufreq: Init policy->rwsem before it may be possibly used cpufreq: Move the check of cpufreq_driver->get into cpufreq_verify_current_freq() cpufreq: Exit governor when failed to start old governor Marc Zyngier (1): cpufreq: cppc: Fix invalid return value in .get() callback drivers/cpufreq/cppc_cpufreq.c | 66 ++++++++++------------------------ drivers/cpufreq/cpufreq.c | 56 +++++++++++++++-------------- include/acpi/cppc_acpi.h | 1 - 3 files changed, 48 insertions(+), 75 deletions(-) -- 2.33.0

2 14

[PATCH] mm/util: make memdup_user_nul() similar to memdup_user()
by Zhang Yuwei 21 Aug '25

21 Aug '25

From: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> mainline inclusion from mainline-v6.13-rc6 commit dd2a5b5514ab0e690f018595e34dd1fcb981d345 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICU1K5 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Since the string data to copy from userspace is likely less than PAGE_SIZE bytes, replace GFP_KERNEL with GFP_USER like commit 6c2c97a24f09 ("memdup_user(): switch to GFP_USER") does and add __GFP_NOWARN like commit 6c8fcc096be9 ("mm: don't let userspace spam allocations warnings") does. Also, use dedicated slab buckets like commit d73778e4b867 ("mm/util: Use dedicated slab buckets for memdup_user()") does. Fixes: e9d408e107db ("new helper: memdup_user_nul()") Link: https://lkml.kernel.org/r/014cd694-cc27-4a07-a34a-2ae95d744515@I-love.SAKUR… Reported-by: syzbot+7e12e97b36154c54414b(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=7e12e97b36154c54414b Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: mm/util.c [Comflicts with mainline commit b32801d1255be ("mm/slab: Introduce kmem_buckets_create() and family").] Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> --- mm/util.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/mm/util.c b/mm/util.c index f3d6751b2f2a..7a5eed15c98f 100644 --- a/mm/util.c +++ b/mm/util.c @@ -278,12 +278,7 @@ void *memdup_user_nul(const void __user *src, size_t len) { char *p; - /* - * Always use GFP_KERNEL, since copy_from_user() can sleep and - * cause pagefault, which makes it pointless to use GFP_NOFS - * or GFP_ATOMIC. - */ - p = kmalloc_track_caller(len + 1, GFP_KERNEL); + p = kmalloc_track_caller(len + 1, GFP_USER | __GFP_NOWARN); if (!p) return ERR_PTR(-ENOMEM); -- 2.22.0

1 0

[PATCH OLK-5.10 0/2] two bugfix for arm64 support HVO
by Nanyong Sun 21 Aug '25

21 Aug '25

two bugfix for arm64 support HVO Nanyong Sun (2): mm: HVO: fix hard lockup in split_vmemmap_huge_pmd under x86 arm64: mm: HVO: fix deadlock in split vmemmap pmd arch/arm64/include/asm/pgtable.h | 2 ++ mm/sparse-vmemmap.c | 18 ++++++++++++++---- 2 files changed, 16 insertions(+), 4 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10 0/2] two bugfix for arm64 support HVO
by Nanyong Sun 21 Aug '25

21 Aug '25

two bugfix for arm64 support HVO Nanyong Sun (2): mm: HVO: fix hard lockup in split_vmemmap_huge_pmd under x86 arm64: mm: HVO: fix deadlock in split vmemmap pmd arch/arm64/include/asm/pgtable.h | 2 ++ mm/sparse-vmemmap.c | 18 ++++++++++++++---- 2 files changed, 16 insertions(+), 4 deletions(-) -- 2.34.1

2 3