- Kernel - mailweb.openeuler.org

[openeuler:OLK-5.10 3333/3333] htmldocs: Warning: mm/hugetlb.c references a file that doesn't exist: Documentation/mm/mmu_notifier.rst
by kernel test robot 27 Nov '25

27 Nov '25

Hi James, First bad commit (maybe != root cause): tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 18627faf2934ad96de2e45368ec4cf2444343b22 commit: 06bf7ef0de9fd581d9a66f2154dddbaddc1812da [3333/3333] hugetlb: unshare some PMDs when splitting VMAs reproduce: (https://download.01.org/0day-ci/archive/20251126/202511261802.tpTOoC8k-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511261802.tpTOoC8k-lkp@intel.com/ All warnings (new ones prefixed by >>): Warning: arch/riscv/kvm/vcpu.c references a file that doesn't exist: Documentation/virtual/kvm/vcpu-requests.rst Warning: arch/x86/kernel/cpu/resctrl/monitor.c references a file that doesn't exist: Documentation/x86/resctrl.rst Warning: crypto/asymmetric_keys/pgp_preload.c references a file that doesn't exist: Documentation/security/keys-crypto.txt Warning: drivers/irqchip/Kconfig references a file that doesn't exist: Documentation/loongarch/irq-chip-model.rst Warning: drivers/net/ethernet/yunsilicon/xsc/common/xsc_ioctl.h references a file that doesn't exist: Documentation/ioctl/ioctl-number.txt >> Warning: mm/hugetlb.c references a file that doesn't exist: Documentation/mm/mmu_notifier.rst Warning: openEuler/MAINTAINERS references a file that doesn't exist: Documentation/networking/hinic3.rst Warning: /sys/bus/iio/devices/iio:deviceX/in_accel_x_calibbias is defined 2 times: ./Documentation/ABI/testing/sysfs-bus-iio:394 ./Documentation/ABI/testing/sysfs-bus-iio-icm42600:0 Warning: /sys/bus/iio/devices/iio:deviceX/in_accel_y_calibbias is defined 2 times: ./Documentation/ABI/testing/sysfs-bus-iio:395 ./Documentation/ABI/testing/sysfs-bus-iio-icm42600:1 Warning: /sys/bus/iio/devices/iio:deviceX/in_accel_z_calibbias is defined 2 times: ./Documentation/ABI/testing/sysfs-bus-iio:396 ./Documentation/ABI/testing/sysfs-bus-iio-icm42600:2 Warning: /sys/bus/iio/devices/iio:deviceX/in_anglvel_x_calibbias is defined 2 times: ./Documentation/ABI/testing/sysfs-bus-iio:397 ./Documentation/ABI/testing/sysfs-bus-iio-icm42600:3 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/4] fix cve-2025-40300
by Bowen You 26 Nov '25

26 Nov '25

*** BLURB HERE *** Bowen You (1): config: enable CONFIG_MITIGATION_VMESCAPE by default on x86 Pawan Gupta (3): x86/vmscape: Add conditional IBPB mitigation x86/vmscape: Enumerate VMSCAPE bug x86/vmscape: Enable the mitigation .../ABI/testing/sysfs-devices-system-cpu | 1 + .../admin-guide/kernel-parameters.txt | 11 +++ arch/x86/Kconfig | 9 ++ arch/x86/configs/openeuler_defconfig | 1 + arch/x86/include/asm/cpufeatures.h | 2 + arch/x86/include/asm/entry-common.h | 7 ++ arch/x86/include/asm/nospec-branch.h | 2 + arch/x86/kernel/cpu/bugs.c | 85 +++++++++++++++++++ arch/x86/kernel/cpu/common.c | 58 +++++++++---- arch/x86/kvm/x86.c | 9 ++ drivers/base/cpu.c | 3 + 11 files changed, 170 insertions(+), 18 deletions(-) -- 2.34.1

2 5

[PATCH OLK-6.6] nbd: fix uaf in nbd_genl_connect() error path
by Zizhi Wo 26 Nov '25

26 Nov '25

From: Zheng Qixing <zhengqixing(a)huawei.com> stable inclusion from stable-v6.6.99 commit d46186eb7bbd9a11c145120f2d77effa8d4d44c2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICOXOQ CVE: CVE-2025-38443 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit aa9552438ebf015fc5f9f890dbfe39f0c53cf37e ] There is a use-after-free issue in nbd: block nbd6: Receive control failed (result -104) block nbd6: shutting down sockets ================================================================== BUG: KASAN: slab-use-after-free in recv_work+0x694/0xa80 drivers/block/nbd.c:1022 Write of size 4 at addr ffff8880295de478 by task kworker/u33:0/67 CPU: 2 UID: 0 PID: 67 Comm: kworker/u33:0 Not tainted 6.15.0-rc5-syzkaller-00123-g2c89c1b655c0 #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Workqueue: nbd6-recv recv_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0xc3/0x670 mm/kasan/report.c:521 kasan_report+0xe0/0x110 mm/kasan/report.c:634 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189 instrument_atomic_read_write include/linux/instrumented.h:96 [inline] atomic_dec include/linux/atomic/atomic-instrumented.h:592 [inline] recv_work+0x694/0xa80 drivers/block/nbd.c:1022 process_one_work+0x9cc/0x1b70 kernel/workqueue.c:3238 process_scheduled_works kernel/workqueue.c:3319 [inline] worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400 kthread+0x3c2/0x780 kernel/kthread.c:464 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:153 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> nbd_genl_connect() does not properly stop the device on certain error paths after nbd_start_device() has been called. This causes the error path to put nbd->config while recv_work continue to use the config after putting it, leading to use-after-free in recv_work. This patch moves nbd_start_device() after the backend file creation. Reported-by: syzbot+48240bab47e705c53126(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68227a04.050a0220.f2294.00b5.GAE@google.com/T/ Fixes: 6497ef8df568 ("nbd: provide a way for userspace processes to identify device backends") Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> Reviewed-by: Yu Kuai <yukuai3(a)huawei.com> Link: https://lore.kernel.org/r/20250612132405.364904-1-zhengqixing@huaweicloud.c… Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- drivers/block/nbd.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index 26e1cf7f666c..6e42099dc70c 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -2133,9 +2133,7 @@ static int nbd_genl_connect(struct sk_buff *skb, struct genl_info *info) goto out; } } - ret = nbd_start_device(nbd); - if (ret) - goto out; + if (info->attrs[NBD_ATTR_BACKEND_IDENTIFIER]) { nbd->backend = nla_strdup(info->attrs[NBD_ATTR_BACKEND_IDENTIFIER], GFP_KERNEL); @@ -2151,6 +2149,8 @@ static int nbd_genl_connect(struct sk_buff *skb, struct genl_info *info) goto out; } set_bit(NBD_RT_HAS_BACKEND_FILE, &config->runtime_flags); + + ret = nbd_start_device(nbd); out: mutex_unlock(&nbd->config_lock); if (!ret) { -- 2.39.2

2 1

[PATCH OLK-6.6] fs: writeback: fix use-after-free in __mark_inode_dirty()
by Zizhi Wo 26 Nov '25

26 Nov '25

From: Jiufei Xue <jiufei.xue(a)samsung.com> stable inclusion from stable-v6.6.105 commit bf89b1f87c72df79cf76203f71fbf8349cd5c9de category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICYXVD CVE: CVE-2025-39866 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d02d2c98d25793902f65803ab853b592c7a96b29 ] An use-after-free issue occurred when __mark_inode_dirty() get the bdi_writeback that was in the progress of switching. CPU: 1 PID: 562 Comm: systemd-random- Not tainted 6.6.56-gb4403bd46a8e #1 ...... pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __mark_inode_dirty+0x124/0x418 lr : __mark_inode_dirty+0x118/0x418 sp : ffffffc08c9dbbc0 ........ Call trace: __mark_inode_dirty+0x124/0x418 generic_update_time+0x4c/0x60 file_modified+0xcc/0xd0 ext4_buffered_write_iter+0x58/0x124 ext4_file_write_iter+0x54/0x704 vfs_write+0x1c0/0x308 ksys_write+0x74/0x10c __arm64_sys_write+0x1c/0x28 invoke_syscall+0x48/0x114 el0_svc_common.constprop.0+0xc0/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x40/0xe4 el0t_64_sync_handler+0x120/0x12c el0t_64_sync+0x194/0x198 Root cause is: systemd-random-seed kworker ---------------------------------------------------------------------- ___mark_inode_dirty inode_switch_wbs_work_fn spin_lock(&inode->i_lock); inode_attach_wb locked_inode_to_wb_and_lock_list get inode->i_wb spin_unlock(&inode->i_lock); spin_lock(&wb->list_lock) spin_lock(&inode->i_lock) inode_io_list_move_locked spin_unlock(&wb->list_lock) spin_unlock(&inode->i_lock) spin_lock(&old_wb->list_lock) inode_do_switch_wbs spin_lock(&inode->i_lock) inode->i_wb = new_wb spin_unlock(&inode->i_lock) spin_unlock(&old_wb->list_lock) wb_put_many(old_wb, nr_switched) cgwb_release old wb released wb_wakeup_delayed() accesses wb, then trigger the use-after-free issue Fix this race condition by holding inode spinlock until wb_wakeup_delayed() finished. Signed-off-by: Jiufei Xue <jiufei.xue(a)samsung.com> Link: https://lore.kernel.org/20250728100715.3863241-1-jiufei.xue@samsung.com Reviewed-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/fs-writeback.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c index c79f04ad646e..f240c69a1a5d 100644 --- a/fs/fs-writeback.c +++ b/fs/fs-writeback.c @@ -2542,10 +2542,6 @@ void __mark_inode_dirty(struct inode *inode, int flags) wakeup_bdi = inode_io_list_move_locked(inode, wb, dirty_list); - spin_unlock(&wb->list_lock); - spin_unlock(&inode->i_lock); - trace_writeback_dirty_inode_enqueue(inode); - /* * If this is the first dirty inode for this bdi, * we have to wake-up the corresponding bdi thread @@ -2555,6 +2551,11 @@ void __mark_inode_dirty(struct inode *inode, int flags) if (wakeup_bdi && (wb->bdi->capabilities & BDI_CAP_WRITEBACK)) wb_wakeup_delayed(wb); + + spin_unlock(&wb->list_lock); + spin_unlock(&inode->i_lock); + trace_writeback_dirty_inode_enqueue(inode); + return; } } -- 2.39.2

2 1

[PATCH OLK-5.10 0/2] Fix CVE-2025-40200
by Long Li 26 Nov '25

26 Nov '25

Fix CVE-2025-40200. Phillip Lougher (2): Squashfs: add additional inode sanity checking Squashfs: reject negative file sizes in squashfs_read_inode() fs/squashfs/inode.c | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-) -- 2.39.2

2 3

[openeuler:OLK-6.6 3372/3372] versioncheck: ./drivers/ub/obmm/obmm_lowmem.c: 13 linux/version.h not needed.
by kernel test robot 26 Nov '25

26 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 9faad151530e11624fffe9d2ab408edffb682db0 commit: f6bc214461e913ec9380b6f692a26e05a3bb276e [3372/3372] obmm: Add low memory management support reproduce: (https://download.01.org/0day-ci/archive/20251126/202511260904.bsCpbGak-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511260904.bsCpbGak-lkp@intel.com/ versioncheck warnings: (new ones prefixed by >>) INFO PATH=/opt/cross/rustc-1.88.0-bindgen-0.72.0/cargo/bin:/opt/cross/clang-20/bin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin /usr/bin/timeout -k 100 3h /usr/bin/make KCFLAGS= -fno-crash-diagnostics -Wno-error=return-type -Wreturn-type -funsigned-char -Wundef W=1 --keep-going LLVM=1 -j32 ARCH=x86_64 versioncheck find ./* \( -name SCCS -o -name BitKeeper -o -name .svn -o -name CVS -o -name .pc -o -name .hg -o -name .git \) -prune -o \ -name '*.[hcS]' -type f -print | sort \ | xargs perl -w ./scripts/checkversion.pl ./drivers/accessibility/speakup/genmap.c: 13 linux/version.h not needed. ./drivers/accessibility/speakup/makemapdata.c: 13 linux/version.h not needed. ./drivers/char/ipmi/ipmi_si_ls2k500.c: 19 linux/version.h not needed. ./drivers/crypto/ccp/hygon/ccp-mdev.c: 12 linux/version.h not needed. ./drivers/crypto/ccp/hygon/hct.c: 6 linux/version.h not needed. ./drivers/crypto/ccp/hygon/tdm-dev.h: 29 linux/version.h not needed. ./drivers/crypto/montage/tsse/tsse_vuart.c: 21 linux/version.h not needed. ./drivers/crypto/sedriver/wst_se_common_type.h: 19 linux/version.h not needed. ./drivers/gpu/drm/phytium/phytium_gem.c: 9 linux/version.h not needed. ./drivers/i2c/busses/i2c-zhaoxin.c: 18 linux/version.h not needed. ./drivers/net/ethernet/3snic/sssnic/include/kernel/sss_linux_kernel.h: 13 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/edma_drv/bma_include.h: 32 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.c: 17 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/kbox_drv/kbox_include.h: 20 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/kbox_drv/kbox_main.c: 22 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/kbox_drv/kbox_mce.c: 16 linux/version.h not needed. ./drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c: 16 linux/version.h not needed. ./drivers/net/ethernet/huawei/hinic/ossl_knl.h: 22 linux/version.h not needed. ./drivers/net/ethernet/huawei/hinic3/bond/hinic3_bond.c: 12 linux/version.h not needed. ./drivers/net/ethernet/huawei/hinic3/ossl_knl_linux.h: 12 linux/version.h not needed. ./drivers/net/ethernet/linkdata/sxe/base/compat/sxe_compat.h: 16 linux/version.h not needed. ./drivers/net/ethernet/linkdata/sxevf/base/compat/sxe_compat.h: 16 linux/version.h not needed. ./drivers/net/ethernet/mucse/rnpm/rnpm_common.h: 7 linux/version.h not needed. ./drivers/net/ethernet/yunsilicon/xsc/common/xsc_core.h: 26 linux/version.h not needed. ./drivers/scsi/hisi_raid/hiraid_main.c: 9 linux/version.h not needed. ./drivers/scsi/linkdata/ps3stor/linux/ps3_base.c: 11 linux/version.h not needed. ./drivers/scsi/linkdata/ps3stor/linux/ps3_cli.c: 14 linux/version.h not needed. ./drivers/scsi/linkdata/ps3stor/linux/ps3_driver_log.c: 3 linux/version.h not needed. ./drivers/scsi/linkdata/ps3stor/ps3_device_manager.h: 9 linux/version.h not needed. ./drivers/scsi/linkdata/ps3stor/ps3_device_manager_sas.h: 6 linux/version.h not needed. ./drivers/scsi/linkdata/ps3stor/ps3_qos.c: 6 linux/version.h not needed. ./drivers/scsi/linkdata/ps3stor/ps3_rb_tree.h: 7 linux/version.h not needed. ./drivers/scsi/linkdata/ps3stor/ps3_sas_transport.h: 9 linux/version.h not needed. ./drivers/scsi/linkdata/ps3stor/ps3_scsi_cmd_err.c: 9 linux/version.h not needed. ./drivers/scsi/sssraid/sssraid_fw.c: 6 linux/version.h not needed. ./drivers/scsi/sssraid/sssraid_os.c: 6 linux/version.h not needed. ./drivers/staging/media/atomisp/include/linux/atomisp.h: 23 linux/version.h not needed. ./drivers/ub/cdma/cdma_mmap.c: 6 linux/version.h not needed. >> ./drivers/ub/obmm/obmm_lowmem.c: 13 linux/version.h not needed. ./drivers/ub/urma/ubagg/ubagg_main.c: 14 linux/version.h not needed. ./drivers/ub/urma/ubcore/net/ubcore_sock.c: 23 linux/version.h not needed. ./drivers/ub/urma/ubcore/ubcm/ub_cm.c: 16 linux/version.h not needed. ./drivers/ub/urma/ubcore/ubcm/ubcm_genl.c: 14 linux/version.h not needed. ./drivers/ub/urma/ubcore/ubcore_cdev_file.c: 14 linux/version.h not needed. ./drivers/ub/urma/ubcore/ubcore_device.c: 13 linux/version.h not needed. ./drivers/ub/urma/ubcore/ubcore_genl.c: 17 linux/version.h not needed. ./drivers/ub/urma/ubcore/ubcore_genl_admin.c: 11 linux/version.h not needed. ./drivers/ub/urma/ubcore/ubcore_umem.c: 17 linux/version.h not needed. ./drivers/ub/urma/uburma/uburma_main.c: 20 linux/version.h not needed. ./drivers/ub/urma/uburma/uburma_mmap.c: 12 linux/version.h not needed. ./fs/proc/etmem_scan.c: 13 linux/version.h not needed. ./samples/bpf/spintest.bpf.c: 8 linux/version.h not needed. ./samples/trace_events/trace_custom_sched.c: 11 linux/version.h not needed. ./sound/soc/codecs/cs42l42.c: 14 linux/version.h not needed. ./tools/lib/bpf/bpf_helpers.h: 402: need linux/version.h ./tools/testing/selftests/bpf/progs/dev_cgroup.c: 9 linux/version.h not needed. ./tools/testing/selftests/bpf/progs/netcnt_prog.c: 3 linux/version.h not needed. ./tools/testing/selftests/bpf/progs/test_map_lock.c: 4 linux/version.h not needed. ./tools/testing/selftests/bpf/progs/test_send_signal_kern.c: 4 linux/version.h not needed. ./tools/testing/selftests/bpf/progs/test_spin_lock.c: 4 linux/version.h not needed. ./tools/testing/selftests/bpf/progs/test_tcp_estats.c: 37 linux/version.h not needed. ./tools/testing/selftests/wireguard/qemu/init.c: 27 linux/version.h not needed. -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 0/9] net: Netdev use RCU protection
by Dong Chenchen 26 Nov '25

26 Nov '25

Netdev use RCU protection Dong Chenchen (1): net: dst: Fix kabi-breakage for struct dst_entry Eric Dumazet (7): net: dst: add four helpers to annotate data-races around dst->dev ipv4: use RCU protection in __ip_rt_update_pmtu() net: dst: introduce dst->dev_rcu tcp_metrics: use dst_dev_net_rcu() ipv4: start using dst_dev_rcu() ipv4: use RCU protection in ip_dst_mtu_maybe_forward() net: use dst_dev_rcu() in sk_setup_caps() Kuniyuki Iwashima (1): tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). include/net/dst.h | 34 ++++++++++++++++++++++++++++++---- include/net/ip.h | 22 ++++++++++++++++------ include/net/ip6_route.h | 2 +- include/net/route.h | 9 +++++++-- net/core/dst.c | 4 ++-- net/core/sock.c | 10 +++++++--- net/ipv4/icmp.c | 10 +++++++--- net/ipv4/ip_fragment.c | 9 +++++++-- net/ipv4/ipmr.c | 2 +- net/ipv4/route.c | 7 ++++--- net/ipv4/tcp_metrics.c | 6 +++--- net/tls/tls_device.c | 13 ++++++------- 12 files changed, 91 insertions(+), 37 deletions(-) -- 2.25.1

2 10

[PATCH OLK-6.6 00/11] net: Netdev use RCU protection
by Dong Chenchen 26 Nov '25

26 Nov '25

Netdev use RCU protection Dong Chenchen (1): net: dst: Fix kabi-breakage for struct dst_entry Eric Dumazet (8): net: dst: add four helpers to annotate data-races around dst->dev net: dst: introduce dst->dev_rcu tcp_metrics: use dst_dev_net_rcu() ipv4: start using dst_dev_rcu() ipv6: use RCU in ip6_xmit() ipv6: use RCU in ip6_output() ipv4: use RCU protection in ip_dst_mtu_maybe_forward() net: use dst_dev_rcu() in sk_setup_caps() Kuniyuki Iwashima (1): tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). Sharath Chandra Vurukala (1): net: Add locking to protect skb->dev access in ip_output include/net/dst.h | 40 ++++++++++++++++++++++++- include/net/ip.h | 17 ++++++++--- include/net/ip6_route.h | 2 +- include/net/route.h | 2 +- net/core/dst.c | 4 +-- net/core/sock.c | 16 ++++++---- net/ipv4/icmp.c | 10 ++++--- net/ipv4/ip_fragment.c | 9 ++++-- net/ipv4/ip_output.c | 15 ++++++---- net/ipv4/ipmr.c | 2 +- net/ipv4/route.c | 8 ++--- net/ipv4/tcp_metrics.c | 6 ++-- net/ipv6/ip6_output.c | 65 +++++++++++++++++++++++------------------ net/tls/tls_device.c | 18 +++++++----- 14 files changed, 144 insertions(+), 70 deletions(-) -- 2.25.1

2 12

[PATCH OLK-5.10 0/2] Add Support for Disabling Hugetlb in soft_offline_page
by Wupeng Ma 26 Nov '25

26 Nov '25

Backport the following patch to add the ability to disable Hugetlb in soft_offline_page: - mm/memory-failure: userspace controls soft-offlining pages - mm/memory-failure: support disabling soft offline for HugeTLB pages Jiaqi Yan (1): mm/memory-failure: userspace controls soft-offlining pages Kyle Meyer (1): mm/memory-failure: support disabling soft offline for HugeTLB pages .../ABI/testing/sysfs-memory-page-offline | 3 +++ include/linux/mm.h | 1 + kernel/sysctl.c | 9 ++++++++ mm/memory-failure.c | 23 ++++++++++++++++++- 4 files changed, 35 insertions(+), 1 deletion(-) -- 2.43.0

2 3

[PATCH OLK-6.6] pid: Add a judgment for ns null in pid_nr_ns
by Liu Kai 26 Nov '25

26 Nov '25

From: gaoxiang17 <gaoxiang17(a)xiaomi.com> stable inclusion from stable-v6.6.113 commit 09d227c59d97efda7d5cc878a4335a6b2bb224c2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6BVM CVE: CVE-2025-40178 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 006568ab4c5ca2309ceb36fa553e390b4aa9c0c7 ] __task_pid_nr_ns ns = task_active_pid_ns(current); pid_nr_ns(rcu_dereference(*task_pid_ptr(task, type)), ns); if (pid && ns->level <= pid->level) { Sometimes null is returned for task_active_pid_ns. Then it will trigger kernel panic in pid_nr_ns. For example: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000058 Mem abort info: ESR = 0x0000000096000007 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x07: level 3 translation fault Data abort info: ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 user pgtable: 4k pages, 39-bit VAs, pgdp=00000002175aa000 [0000000000000058] pgd=08000002175ab003, p4d=08000002175ab003, pud=08000002175ab003, pmd=08000002175be003, pte=0000000000000000 pstate: 834000c5 (Nzcv daIF +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : __task_pid_nr_ns+0x74/0xd0 lr : __task_pid_nr_ns+0x24/0xd0 sp : ffffffc08001bd10 x29: ffffffc08001bd10 x28: ffffffd4422b2000 x27: 0000000000000001 x26: ffffffd442821168 x25: ffffffd442821000 x24: 00000f89492eab31 x23: 00000000000000c0 x22: ffffff806f5693c0 x21: ffffff806f5693c0 x20: 0000000000000001 x19: 0000000000000000 x18: 0000000000000000 x17: 00000000529c6ef0 x16: 00000000529c6ef0 x15: 00000000023a1adc x14: 0000000000000003 x13: 00000000007ef6d8 x12: 001167c391c78800 x11: 00ffffffffffffff x10: 0000000000000000 x9 : 0000000000000001 x8 : ffffff80816fa3c0 x7 : 0000000000000000 x6 : 49534d702d535449 x5 : ffffffc080c4c2c0 x4 : ffffffd43ee128c8 x3 : ffffffd43ee124dc x2 : 0000000000000000 x1 : 0000000000000001 x0 : ffffff806f5693c0 Call trace: __task_pid_nr_ns+0x74/0xd0 ... __handle_irq_event_percpu+0xd4/0x284 handle_irq_event+0x48/0xb0 handle_fasteoi_irq+0x160/0x2d8 generic_handle_domain_irq+0x44/0x60 gic_handle_irq+0x4c/0x114 call_on_irq_stack+0x3c/0x74 do_interrupt_handler+0x4c/0x84 el1_interrupt+0x34/0x58 el1h_64_irq_handler+0x18/0x24 el1h_64_irq+0x68/0x6c account_kernel_stack+0x60/0x144 exit_task_stack_account+0x1c/0x80 do_exit+0x7e4/0xaf8 ... get_signal+0x7bc/0x8d8 do_notify_resume+0x128/0x828 el0_svc+0x6c/0x70 el0t_64_sync_handler+0x68/0xbc el0t_64_sync+0x1a8/0x1ac Code: 35fffe54 911a02a8 f9400108 b4000128 (b9405a69) ---[ end trace 0000000000000000 ]--- Kernel panic - not syncing: Oops: Fatal exception in interrupt Signed-off-by: gaoxiang17 <gaoxiang17(a)xiaomi.com> Link: https://lore.kernel.org/20250802022123.3536934-1-gxxa03070307@gmail.com Reviewed-by: Baoquan He <bhe(a)redhat.com> Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Kai <liukai284(a)huawei.com> --- kernel/pid.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/pid.c b/kernel/pid.c index 39dc8e3a6bc1..bc2f0a6cd3bc 100644 --- a/kernel/pid.c +++ b/kernel/pid.c @@ -502,7 +502,7 @@ pid_t pid_nr_ns(struct pid *pid, struct pid_namespace *ns) struct upid *upid; pid_t nr = 0; - if (pid && ns->level <= pid->level) { + if (pid && ns && ns->level <= pid->level) { upid = &pid->numbers[ns->level]; if (upid->ns == ns) nr = upid->nr; -- 2.34.1

2 1