- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 0/9] merge CVE patches into OLK-6.6
by Nanyong Sun 10 Jun '25

10 Jun '25

From: Kaixiong Yu <yukaixiong(a)huawei.com> merge CVE patches into OLK-6.6 the CVE No. as listed: CVE-2025-37930 CVE-2025-37849 CVE-2025-23149 CVE-2025-39735 CVE-2025-38152 CVE-2025-21861 CVE-2024-47732 Bjorn Andersson (1): Revert "remoteproc: core: Clear table_sz when rproc_shutdown" Dan Carpenter (1): crypto: iaa - Fix potential use after free bug David Hildenbrand (1): mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize() Kefeng Wang (1): mm: migrate_device: use more folio in migrate_device_finalize() Peng Fan (1): remoteproc: core: Clear table_sz when rproc_shutdown Philipp Stanner (1): drm/nouveau: Fix WARN_ON in nouveau_fence_context_kill() Qasim Ijaz (1): jfs: fix slab-out-of-bounds read in ea_get() Thadeu Lima de Souza Cascardo (1): tpm: do not start chip while suspended Will Deacon (1): KVM: arm64: Tear down vGIC on failed vCPU creation arch/arm64/kvm/arm.c | 6 +++- drivers/char/tpm/tpm-chip.c | 5 +++ drivers/char/tpm/tpm-interface.c | 7 ---- drivers/crypto/intel/iaa/iaa_crypto_main.c | 4 +-- drivers/gpu/drm/nouveau/nouveau_fence.c | 2 +- fs/jfs/xattr.c | 15 +++++--- mm/migrate_device.c | 42 +++++++++++----------- 7 files changed, 43 insertions(+), 38 deletions(-) -- 2.34.1

2 10

[PATCH OLK-5.10 v7 RESEND 00/12] arm64: Support xcall prefetch
by Jinjie Ruan 10 Jun '25

10 Jun '25

Support xcall prefetch. Changes in v7: - Remove "echo @xxx > /proc/$PID/xcall" usage, replace with "echo 1 > /proc/$PID/prefetch". Now the xcall enable and prefetch can be enabled separately. Changes in v6: - Only use one reserved kabi in task_struct for xcall. - Free prefetch item after eventpoll_release_file() to avoid possible competition between ep_prefetch_item_enqueue() and pfi free. - Fix "echo > /proc/xcall/cpu_list" show problem. Changes in v5: - Fix dentry free before free_prefetch_item() and then UAF in prefetch work by cancel_work_sync() before free pfi and move free_prefetch_item() to the first of __fput(). - Fix __queue_work() oops bug. - /proc/xcall/mask_list -> /proc/xcall/cpu_list - Fix xcall_prefetch print data type. - Update prefetch tracepoint, move xcall points definition to separete header file. - Make xcall_prefetch depends on EPOLL. - Adjust xcall prefetch buf to 16KB by default. - Add xcall_prefetch_init() function. - Only use write lock in free_prefetch_item(). - Simplify xcall_read() and add some comment. - Update commit message. Changes in v4: - Enable FAST_SYSCALL/IRQ and XCALL_PREFETCH by default. - Fix xint sleeping function called from invalid context bug. - free_prefetch_item() in file_free() instead of filp_close(), which fix the alloc-queue and free competition. - Fix kernel_read() warning for FMODE_READ not set. - Add sock_from_file() limit for prefetch. - Check NULL for rc_work. - Simplfy the cpumask interface code, and rename to "/proc/xcall/mask_list". - Remove the xcall_cache_pages_order interface. - tracepoint update: fd -> file. - Simplify the xcall_read() function again. - Handle copy_to_user() return value. - Remove unused XCALL_CACHE_QUEUED. - Update the commit message. Changes in v3: - Add XCALL_PREFETCH config to isolate feature code. - Split the /proc/xxx interface code out to independent patches, which will make it clear. - Update the cpumask interface to "/proc/xcall/numa_mask", and it can set the numa mask of all numas one time. - Add xcall select count to make xcall_cache_pages_order adjust safe. - Introduce xcall_read_start/end() to make it clear. - Simplify the xcall_read() function. - Use cpumask_next() instead of get_nth_cpu_in_cpumask() function. - Use independent cpu select policy function. - Remove some unnecessary pr_err(). - Update the commit message. Changes in v2: - Upadte the xcall prefetch state machine, remove the queued state and add prefetch, cancel states. - Remove the pfi lock and use atomic variables. - Change the 'xcall select' semantics and simplify the code a lot. - Remove keep_running, remove unrelated code. - Remove the count in struct read_cache_entry, and use percpu hit/miss count. - Remove sync mode, so remove struct read_cache_entry in struct task_struct. - Use hash table to find prefetch item for a file, which will not change the file struct KABI. - Use rwlock instead of spinlock for hash table. - Use alloc_page() instead kmalloc() to align 4KB. - Update the commit message. Jinjie Ruan (9): arm64: Introduce Xint software solution arm64: Add debugfs dir for xint arm64: Reserve a kabi in task_struct exclusively for xcall arm64: Introduce xcall prefetch enable interface eventpoll: xcall: Support async prefetch data in epoll xcall: Add /proc/xcall/prefetch dir for performance tuning xcall: Add /proc/xcall/cpu_list for performance tuning xcall: eventpoll: add tracepoint config: Enable FAST_SYSCALL/IRQ and XCALL_PREFETCH by default Liao Chen (1): revert kpti bypass Yipeng Zou (2): arm64: Introduce xcall a faster svc exception handling arm64: Faster SVC exception handler with xcall arch/Kconfig | 81 +++++ arch/arm64/Kconfig | 2 + arch/arm64/configs/openeuler_defconfig | 7 + arch/arm64/include/asm/cpucaps.h | 2 + arch/arm64/include/asm/exception.h | 3 + arch/arm64/kernel/asm-offsets.c | 3 + arch/arm64/kernel/cpufeature.c | 56 ++++ arch/arm64/kernel/entry-common.c | 22 ++ arch/arm64/kernel/entry.S | 183 ++++++++++- arch/arm64/kernel/syscall.c | 57 ++++ drivers/irqchip/irq-gic-v3.c | 130 ++++++++ fs/eventpoll.c | 408 +++++++++++++++++++++++++ fs/file_table.c | 1 + fs/proc/base.c | 183 +++++++++++ fs/read_write.c | 10 +- include/linux/fs.h | 35 +++ include/linux/hardirq.h | 5 + include/linux/irqchip/arm-gic-v3.h | 13 + include/linux/sched.h | 4 + include/linux/xcall.h | 17 ++ include/trace/events/xcall.h | 106 +++++++ kernel/fork.c | 24 ++ kernel/irq/debugfs.c | 33 ++ kernel/irq/internals.h | 18 ++ kernel/irq/irqdesc.c | 19 ++ kernel/irq/proc.c | 10 + kernel/softirq.c | 73 +++++ 27 files changed, 1502 insertions(+), 3 deletions(-) create mode 100644 include/linux/xcall.h create mode 100644 include/trace/events/xcall.h -- 2.34.1

1 12

[PATCH OLK-5.10 v7 00/12] arm64: Support xcall prefetch
by Jinjie Ruan 10 Jun '25

10 Jun '25

Support xcall prefetch. Changes in v7: - Remove "echo @xxx > /proc/$PID/xcall" usage, replace with "echo 1 > /proc/$PID/prefetch". Now the xcall enable and prefetch can be enabled separately. Changes in v6: - Only use one reserved kabi in task_struct for xcall. - Free prefetch item after eventpoll_release_file() to avoid possible competition between ep_prefetch_item_enqueue() and pfi free. - Fix "echo > /proc/xcall/cpu_list" show problem. Changes in v5: - Fix dentry free before free_prefetch_item() and then UAF in prefetch work by cancel_work_sync() before free pfi and move free_prefetch_item() to the first of __fput(). - Fix __queue_work() oops bug. - /proc/xcall/mask_list -> /proc/xcall/cpu_list - Fix xcall_prefetch print data type. - Update prefetch tracepoint, move xcall points definition to separete header file. - Make xcall_prefetch depends on EPOLL. - Adjust xcall prefetch buf to 16KB by default. - Add xcall_prefetch_init() function. - Only use write lock in free_prefetch_item(). - Simplify xcall_read() and add some comment. - Update commit message. Changes in v4: - Enable FAST_SYSCALL/IRQ and XCALL_PREFETCH by default. - Fix xint sleeping function called from invalid context bug. - free_prefetch_item() in file_free() instead of filp_close(), which fix the alloc-queue and free competition. - Fix kernel_read() warning for FMODE_READ not set. - Add sock_from_file() limit for prefetch. - Check NULL for rc_work. - Simplfy the cpumask interface code, and rename to "/proc/xcall/mask_list". - Remove the xcall_cache_pages_order interface. - tracepoint update: fd -> file. - Simplify the xcall_read() function again. - Handle copy_to_user() return value. - Remove unused XCALL_CACHE_QUEUED. - Update the commit message. Changes in v3: - Add XCALL_PREFETCH config to isolate feature code. - Split the /proc/xxx interface code out to independent patches, which will make it clear. - Update the cpumask interface to "/proc/xcall/numa_mask", and it can set the numa mask of all numas one time. - Add xcall select count to make xcall_cache_pages_order adjust safe. - Introduce xcall_read_start/end() to make it clear. - Simplify the xcall_read() function. - Use cpumask_next() instead of get_nth_cpu_in_cpumask() function. - Use independent cpu select policy function. - Remove some unnecessary pr_err(). - Update the commit message. Changes in v2: - Upadte the xcall prefetch state machine, remove the queued state and add prefetch, cancel states. - Remove the pfi lock and use atomic variables. - Change the 'xcall select' semantics and simplify the code a lot. - Remove keep_running, remove unrelated code. - Remove the count in struct read_cache_entry, and use percpu hit/miss count. - Remove sync mode, so remove struct read_cache_entry in struct task_struct. - Use hash table to find prefetch item for a file, which will not change the file struct KABI. - Use rwlock instead of spinlock for hash table. - Use alloc_page() instead kmalloc() to align 4KB. - Update the commit message. Jinjie Ruan (9): arm64: Introduce Xint software solution arm64: Add debugfs dir for xint arm64: Reserve a kabi in task_struct exclusively for xcall arm64: Introduce xcall prefetch enable interface eventpoll: xcall: Support async prefetch data in epoll xcall: Add /proc/xcall/prefetch dir for performance tuning xcall: Add /proc/xcall/cpu_list for performance tuning xcall: eventpoll: add tracepoint config: Enable FAST_SYSCALL/IRQ and XCALL_PREFETCH by default Liao Chen (1): revert kpti bypass Yipeng Zou (2): arm64: Introduce xcall a faster svc exception handling arm64: Faster SVC exception handler with xcall arch/Kconfig | 81 +++++ arch/arm64/Kconfig | 2 + arch/arm64/configs/openeuler_defconfig | 7 + arch/arm64/include/asm/cpucaps.h | 2 + arch/arm64/include/asm/exception.h | 3 + arch/arm64/kernel/asm-offsets.c | 3 + arch/arm64/kernel/cpufeature.c | 56 ++++ arch/arm64/kernel/entry-common.c | 22 ++ arch/arm64/kernel/entry.S | 183 ++++++++++- arch/arm64/kernel/syscall.c | 57 ++++ drivers/irqchip/irq-gic-v3.c | 130 ++++++++ fs/eventpoll.c | 408 +++++++++++++++++++++++++ fs/file_table.c | 1 + fs/proc/base.c | 183 +++++++++++ fs/read_write.c | 10 +- include/linux/fs.h | 35 +++ include/linux/hardirq.h | 5 + include/linux/irqchip/arm-gic-v3.h | 13 + include/linux/sched.h | 4 + include/linux/xcall.h | 17 ++ include/trace/events/xcall.h | 106 +++++++ kernel/fork.c | 22 ++ kernel/irq/debugfs.c | 33 ++ kernel/irq/internals.h | 18 ++ kernel/irq/irqdesc.c | 19 ++ kernel/irq/proc.c | 10 + kernel/softirq.c | 73 +++++ 27 files changed, 1500 insertions(+), 3 deletions(-) create mode 100644 include/linux/xcall.h create mode 100644 include/trace/events/xcall.h -- 2.34.1

2 13

[PATCH OLK-6.6 v2 00/12] CVE-2025-37948
by Pu Lehui 10 Jun '25

10 Jun '25

Douglas Anderson (5): arm64: errata: Add QCOM_KRYO_4XX_GOLD to the spectre_bhb_k24_list arm64: errata: Assume that unknown CPUs _are_ vulnerable to Spectre BHB arm64: errata: Add KRYO 2XX/3XX/4XX silver cores to Spectre BHB safe list arm64: cputype: Add MIDR_CORTEX_A76AE arm64: errata: Add newer ARM cores to the spectre_bhb_loop_affected() lists James Morse (6): arm64: insn: Add support for encoding DSB arm64: proton-pack: Expose whether the platform is mitigated by firmware arm64: proton-pack: Expose whether the branchy loop k value arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users arm64: proton-pack: Add new CPUs 'k' values for branch mitigation Will Deacon (1): arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays arch/arm64/include/asm/cputype.h | 4 + arch/arm64/include/asm/insn.h | 1 + arch/arm64/include/asm/spectre.h | 4 +- arch/arm64/kernel/proton-pack.c | 231 ++++++++++++++++++------------- arch/arm64/lib/insn.c | 60 +++++--- arch/arm64/net/bpf_jit_comp.c | 57 +++++++- 6 files changed, 229 insertions(+), 128 deletions(-) -- 2.34.1

2 13

[PATCH OLK-6.6 0/3] iommu/arm-smmu-v3: Fix global-out-of-bounds access in arm_smmu_group_get_mpam()
by Zeng Heng 10 Jun '25

10 Jun '25

Zeng Heng (3): arm64/mpam: Update the chip condition judgment in resctrl_arch_would_mbm_overflow() fs/resctrl: Prevent idle RMIDs from not being released in time from limbo iommu/arm-smmu-v3: Fix global-out-of-bounds access in arm_smmu_group_get_mpam() drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 14 ++++++++++++++ drivers/platform/mpam/mpam_devices.c | 12 +----------- fs/resctrl/monitor.c | 2 +- 3 files changed, 16 insertions(+), 12 deletions(-) -- 2.25.1

2 4

[PATCH OLK-5.10 0/2]
by Luo Gengkun 10 Jun '25

10 Jun '25

Fix watchdog false positive problem Luo Gengkun (1): watchdog: fix watchdog may detect false positive of softlockup Nysal Jan K.A (1): watchdog: fix the SOFTLOCKUP_DETECTOR=n case include/linux/nmi.h | 1 + kernel/sysctl.c | 2 +- kernel/watchdog.c | 39 ++++++++++++++++++++++++++------------- 3 files changed, 28 insertions(+), 14 deletions(-) -- 2.34.1

2 7

[PATCH OLK-6.6 0/2]
by Luo Gengkun 10 Jun '25

10 Jun '25

Fix watchdog false positive problem Luo Gengkun (1): watchdog: fix watchdog may detect false positive of softlockup Nysal Jan K.A (1): watchdog: fix the SOFTLOCKUP_DETECTOR=n case kernel/watchdog.c | 41 +++++++++++++++++++++++++++-------------- 1 file changed, 27 insertions(+), 14 deletions(-) -- 2.34.1

2 7

[PATCH openEuler-1.0-LTS] mm/vmscan: fix hwpoisoned THP handling in shrink_page_list
by Jinjiang Tu 10 Jun '25

10 Jun '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICDSA3 CVE: NA ---------------------------------------- In shrink_page_list(), the hwpoisoned page may be THP, which can't be handled by try_to_unmap(), lead to null-ptr-deref in try_to_unmap_one(). To fix it, skip the hwpoisoned page if it is THP. Fixes: 21b0040ede03 ("mm/vmscan: don't try to reclaim hwpoison folio") Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- mm/vmscan.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/mm/vmscan.c b/mm/vmscan.c index df7998e8174f..6a649f02666f 100644 --- a/mm/vmscan.c +++ b/mm/vmscan.c @@ -1170,6 +1170,9 @@ static unsigned long shrink_page_list(struct list_head *page_list, goto keep; if (PageHWPoison(page)) { + if (PageTransHuge(page)) + goto keep_locked; + try_to_unmap(page, TTU_IGNORE_MLOCK | TTU_IGNORE_ACCESS); unlock_page(page); put_page(page); -- 2.43.0

2 1

[PATCH OLK-6.6 00/11] CVE-2025-37948
by Pu Lehui 10 Jun '25

10 Jun '25

Douglas Anderson (5): arm64: errata: Add QCOM_KRYO_4XX_GOLD to the spectre_bhb_k24_list arm64: errata: Assume that unknown CPUs _are_ vulnerable to Spectre BHB arm64: errata: Add KRYO 2XX/3XX/4XX silver cores to Spectre BHB safe list arm64: cputype: Add MIDR_CORTEX_A76AE arm64: errata: Add newer ARM cores to the spectre_bhb_loop_affected() lists James Morse (6): arm64: insn: Add support for encoding DSB arm64: proton-pack: Expose whether the platform is mitigated by firmware arm64: proton-pack: Expose whether the branchy loop k value arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users arm64: proton-pack: Add new CPUs 'k' values for branch mitigation arch/arm64/include/asm/cputype.h | 4 + arch/arm64/include/asm/insn.h | 1 + arch/arm64/include/asm/spectre.h | 4 +- arch/arm64/kernel/proton-pack.c | 229 +++++++++++++++++-------------- arch/arm64/lib/insn.c | 60 ++++---- arch/arm64/net/bpf_jit_comp.c | 57 +++++++- 6 files changed, 227 insertions(+), 128 deletions(-) -- 2.34.1

2 12

[openeuler:OLK-6.6 2380/2380] mm/mem_sampling.c:35:18: warning: unused variable 'mem_sampling_min_value'
by kernel test robot 10 Jun '25

10 Jun '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: a7f4bf73c34996ee6cdda292e8f906a9c30879de commit: 390982f28c5796a1e590381044630b768e6b9696 [2380/2380] mm/mem_sampling: Add sysctl control for NUMA balancing integration config: arm64-randconfig-r112-20250610 (https://download.01.org/0day-ci/archive/20250610/202506101037.VkwcnAFd-lkp@…) compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff) reproduce: (https://download.01.org/0day-ci/archive/20250610/202506101037.VkwcnAFd-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202506101037.VkwcnAFd-lkp@intel.com/ All warnings (new ones prefixed by >>): mm/mem_sampling.c:68:6: warning: no previous prototype for function 'mem_sampling_record_cb_register' [-Wmissing-prototypes] 68 | void mem_sampling_record_cb_register(mem_sampling_record_cb_type cb) | ^ mm/mem_sampling.c:68:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 68 | void mem_sampling_record_cb_register(mem_sampling_record_cb_type cb) | ^ | static mm/mem_sampling.c:85:6: warning: no previous prototype for function 'mem_sampling_record_cb_unregister' [-Wmissing-prototypes] 85 | void mem_sampling_record_cb_unregister(mem_sampling_record_cb_type cb) | ^ mm/mem_sampling.c:85:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 85 | void mem_sampling_record_cb_unregister(mem_sampling_record_cb_type cb) | ^ | static >> mm/mem_sampling.c:35:18: warning: unused variable 'mem_sampling_min_value' [-Wunused-const-variable] 35 | static const int mem_sampling_min_value = MEM_SAMPLING_MIN_VALUE; | ^~~~~~~~~~~~~~~~~~~~~~ >> mm/mem_sampling.c:36:18: warning: unused variable 'mem_sampling_max_value' [-Wunused-const-variable] 36 | static const int mem_sampling_max_value = MEM_SAMPLING_MAX_VALUE; | ^~~~~~~~~~~~~~~~~~~~~~ 4 warnings generated. vim +/mem_sampling_min_value +35 mm/mem_sampling.c 34 > 35 static const int mem_sampling_min_value = MEM_SAMPLING_MIN_VALUE; > 36 static const int mem_sampling_max_value = MEM_SAMPLING_MAX_VALUE; 37 38 /* keep track of who use the SPE */ 39 DEFINE_PER_CPU(enum arm_spe_user_e, arm_spe_user); 40 EXPORT_PER_CPU_SYMBOL_GPL(arm_spe_user); 41 42 enum mem_sampling_saved_state_e { 43 MEM_SAMPLING_STATE_ENABLE, 44 MEM_SAMPLING_STATE_DISABLE, 45 MEM_SAMPLING_STATE_EMPTY, 46 }; 47 enum mem_sampling_saved_state_e mem_sampling_saved_state = MEM_SAMPLING_STATE_EMPTY; 48 49 /* 50 * Callbacks should be registered using mem_sampling_record_cb_register() 51 * by NUMA, DAMON and etc during their initialisation. 52 * Callbacks will be invoked on new hardware pmu records caputured. 53 */ 54 typedef void (*mem_sampling_record_cb_type)(struct mem_sampling_record *record); 55 56 struct mem_sampling_record_cb_list_entry { 57 struct list_head list; 58 mem_sampling_record_cb_type cb; 59 }; 60 LIST_HEAD(mem_sampling_record_cb_list); 61 62 struct mem_sampling_numa_access_work { 63 struct callback_head work; 64 u64 vaddr, paddr; 65 int cpu; 66 }; 67 68 void mem_sampling_record_cb_register(mem_sampling_record_cb_type cb) 69 { 70 struct mem_sampling_record_cb_list_entry *cb_entry, *tmp; 71 72 list_for_each_entry_safe(cb_entry, tmp, &mem_sampling_record_cb_list, list) { 73 if (cb_entry->cb == cb) 74 return; 75 } 76 77 cb_entry = kmalloc(sizeof(struct mem_sampling_record_cb_list_entry), GFP_KERNEL); 78 if (!cb_entry) 79 return; 80 81 cb_entry->cb = cb; 82 list_add(&(cb_entry->list), &mem_sampling_record_cb_list); 83 } 84 > 85 void mem_sampling_record_cb_unregister(mem_sampling_record_cb_type cb) 86 { 87 struct mem_sampling_record_cb_list_entry *cb_entry, *tmp; 88 89 list_for_each_entry_safe(cb_entry, tmp, &mem_sampling_record_cb_list, list) { 90 if (cb_entry->cb == cb) { 91 list_del(&cb_entry->list); 92 kfree(cb_entry); 93 return; 94 } 95 } 96 } 97 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0