- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] tracing: Fix hist trigger timestamps for buffered events
by Tengda Wu 08 Oct '26

08 Oct '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/10071 ---------------------------------------- Syzkaller triggered a WARN_ON_ONCE(!nest) warning: WARNING: kernel/trace/ring_buffer.c:821 at ring_buffer_event_time_stamp Call trace: ring_buffer_event_time_stamp hist_field_timestamp hist_fn_call event_hist_trigger event_triggers_call __event_trigger_test_discard trace_event_buffer_commit do_trace_event_raw_event_sched_switch trace_event_raw_event_sched_switch The warning is probabilistically reproducible and is related to syzkaller executing the following commands: echo 'prev_pid == 999999' > events/sched/sched_switch/filter echo 'hist:keys=common_timestamp' > events/sched/sched_switch/trigger The specific triggering process is as follows: CPU 0 CPU 1 (context switching) (echo 'hist:keys=common_timestamp' > \ events/sched/sched_switch/trigger) do_trace_event_raw_event_##call trace_event_buffer_lock_reserve if (!tr->no_filter_buffering_ref && trace_file->flags & EVENT_FILE_FL_FILTERED) return entry; // return directly event_hist_trigger_parse hist_register_trigger tracing_set_filter_buffering(file->tr, true); tr->no_filter_buffering_ref++; __trace_buffer_lock_reserve rb_start_commit local_inc(&cpu_buffer->committing); // skipped and not executed trace_event_buffer_commit __event_trigger_test_discard event_triggers_call event_hist_trigger hist_fn_call hist_field_timestamp ring_buffer_event_time_stamp nest = local_read(&cpu_buffer->committing); WARN_ON_ONCE(!nest) // trigger warning The root cause is that when an event file has a filter attached and the hist trigger has not yet been attached, trace_event_buffer_lock_reserve() writes the event into the per-CPU trace_buffered_event temp buffer instead of reserving it in the ring buffer, so cpu_buffer->committing is not incremented. When the event is later processed at commit time by a hist trigger, hist_field_timestamp() -> ring_buffer_event_time_stamp() sees a zero committing count, triggering WARN_ON_ONCE(!nest). tracing_event_time_stamp() was added by commit d8279bfc5e959 ("tracing: Add tracing_event_time_stamp() API") for exactly this case: if the event is the per-CPU trace_buffered_event, it returns the current ring buffer timestamp. But it never gained a caller. Use it in hist_field_timestamp(), so that a hist trigger that races onto a buffered event records the current time, which is only marginally later than when the event was recorded, instead of warning and recording a bogus timestamp. Fixes: b94bc80df648 ("tracing: Use a no_filter_buffering_ref to stop using the filter buffer") Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/trace/trace_events_hist.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c index d5602a4c6eb5..856d75942581 100644 --- a/kernel/trace/trace_events_hist.c +++ b/kernel/trace/trace_events_hist.c @@ -874,7 +874,7 @@ static u64 hist_field_timestamp(struct hist_field *hist_field, struct hist_trigger_data *hist_data = hist_field->hist_data; struct trace_array *tr = hist_data->event_file->tr; - u64 ts = ring_buffer_event_time_stamp(buffer, rbe); + u64 ts = tracing_event_time_stamp(buffer, rbe); if (hist_data->attrs->ts_in_usecs && trace_clock_in_ns(tr)) ts = ns2usecs(ts); -- 2.34.1

2 1

[PATCH OLK-6.6] nfsd: fix redeclaration of 'clp' in nfs4_laundromat()
by Tengda Wu 08 Oct '26

08 Oct '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/10070 -------------------------------- Commit db4cef375f33 ("NFSD: Prevent client use-after-free during delegation revoke") introduced a second declaration of 'clp' in nfs4_laundromat(), causing a compilation error: fs/nfsd/nfs4state.c: In function ‘nfs4_laundromat’: fs/nfsd/nfs4state.c:6325:29: error: redeclaration of ‘clp’ with no linkage 6325 | struct nfs4_client *clp; | ^~~ fs/nfsd/nfs4state.c:6314:29: note: previous declaration of ‘clp’ with type ‘struct nfs4_client *’ 6314 | struct nfs4_client *clp; | ^~~ Remove the redundant declaration. Fixes: db4cef375f33 ("NFSD: Prevent client use-after-free during delegation revoke") Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- fs/nfsd/nfs4state.c | 1 - 1 file changed, 1 deletion(-) diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c index 775beac19656..770f9a8a18ce 100644 --- a/fs/nfsd/nfs4state.c +++ b/fs/nfsd/nfs4state.c @@ -6311,7 +6311,6 @@ nfs4_process_client_reaplist(struct list_head *reaplist) static time64_t nfs4_laundromat(struct nfsd_net *nn) { - struct nfs4_client *clp; struct nfs4_openowner *oo; struct nfs4_delegation *dp; struct nfs4_ol_stateid *stp; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] [Backport] iommu/vt-d: Force requesting ACS when tboot is enabled
by Jiacheng Yu 08 Oct '26

08 Oct '26

From: Kevin Tian <kevin.tian(a)intel.com> mainline inclusion from mainline-v7.3-rc1 commit 607432b2618b61df81134be0ef2562b8300c1216 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18838 CVE: CVE-2026-89448 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Currently the conditions of requesting ACS in detect_intel_iommu() don't include tboot, leading to a possible misconfiguration with ACS disabled (e.g. due to user opts) while iommu is later forced on by tboot_force_iommu(). Fix it by checking tboot in detect_intel_iommu(). Fixes: 5d990b627537 ("PCI: add pci_request_acs") Cc: stable(a)vger.kernel.org Signed-off-by: Kevin Tian <kevin.tian(a)intel.com> Signed-off-by: Lu Baolu <baolu.lu(a)linux.intel.com> Signed-off-by: Joerg Roedel <joerg.roedel(a)amd.com> Conflicts: drivers/iommu/intel/dmar.c drivers/iommu/dmar.c drivers/iommu/intel/iommu.c drivers/iommu/intel/iommu.h include/linux/dma_remapping.h [1. The upstream patch lives under drivers/iommu/intel/; this tree keeps the Intel IOMMU code at drivers/iommu/dmar.c and drivers/iommu/intel-iommu.c. 2. This tree has no dmar_platform_optin() in the detect_intel_iommu() condition, so dmar_required() keeps only the !dmar_disabled check to preserve the original behavior. 3. intel_iommu_tboot_noforce is already non-static in intel-iommu.c, so the drivers/iommu/intel/iommu.c change is dropped. 4. The extern int intel_iommu_tboot_noforce and the intel_iommu_tboot_noforce (0) fallback live in include/linux/dma_remapping.h instead of the upstream Intel IOMMU header.] Signed-off-by: Jiacheng Yu <yujiacheng3(a)huawei.com> --- drivers/iommu/dmar.c | 14 +++++++++++++- include/linux/dma_remapping.h | 1 + 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c index 6d608f71867c..27fdd4f220db 100644 --- a/drivers/iommu/dmar.c +++ b/drivers/iommu/dmar.c @@ -898,6 +898,18 @@ dmar_validate_one_drhd(struct acpi_dmar_header *entry, void *arg) return 0; } +static bool dmar_required(void) +{ + /* tboot supersedes any user/platform opt */ + if (!intel_iommu_tboot_noforce && tboot_enabled()) + return true; + + if (!no_iommu && !dmar_disabled) + return true; + + return false; +} + int __init detect_intel_iommu(void) { int ret; @@ -911,7 +923,7 @@ int __init detect_intel_iommu(void) if (!ret) ret = dmar_walk_dmar_table((struct acpi_table_dmar *)dmar_tbl, &validate_drhd_cb); - if (!ret && !no_iommu && !iommu_detected && !dmar_disabled) { + if (!ret && !iommu_detected && dmar_required()) { iommu_detected = 1; /* Make sure ACS will be enabled */ pci_request_acs(); diff --git a/include/linux/dma_remapping.h b/include/linux/dma_remapping.h index 21b3e7d33d68..5ce02d0f4688 100644 --- a/include/linux/dma_remapping.h +++ b/include/linux/dma_remapping.h @@ -52,6 +52,7 @@ static inline int iommu_calculate_max_sagaw(struct intel_iommu *iommu) } #define dmar_disabled (1) #define intel_iommu_enabled (0) +#define intel_iommu_tboot_noforce (0) #endif -- 2.34.1

2 1

[PATCH OLK-6.6] Fix duplicate variable definition in nfs4_laundromat()
by Zizhi Wo 08 Oct '26

08 Oct '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/10070 -------------------------------- Fix duplicate variable definition in nfs4_laundromat(), and modify the comment to adapt mainline. Fixes: db4cef375f330 ("[Backport] NFSD: Prevent client use-after-free during delegation revoke") Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/nfsd/netns.h | 3 ++- fs/nfsd/nfs4state.c | 1 - 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/nfsd/netns.h b/fs/nfsd/netns.h index eb8b8ebcb8b7..4a41645bb592 100644 --- a/fs/nfsd/netns.h +++ b/fs/nfsd/netns.h @@ -104,11 +104,12 @@ struct nfsd_net { /* protected by blocked_locks_lock */ struct list_head blocked_locks_lru; struct delayed_work laundromat_work; - /* client_lock protects the client lru list and session hash table */ + /* client_lock protects the client lru list and session hash + * table; nests inside deleg_lock */ spinlock_t client_lock; /* protects blocked_locks_lru */ spinlock_t blocked_locks_lock; diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c index 775beac19656..770f9a8a18ce 100644 --- a/fs/nfsd/nfs4state.c +++ b/fs/nfsd/nfs4state.c @@ -6309,11 +6309,10 @@ nfs4_process_client_reaplist(struct list_head *reaplist) } static time64_t nfs4_laundromat(struct nfsd_net *nn) { - struct nfs4_client *clp; struct nfs4_openowner *oo; struct nfs4_delegation *dp; struct nfs4_ol_stateid *stp; struct nfsd4_blocked_lock *nbl; struct list_head *pos, *next, reaplist; -- 2.52.0

2 1

[PATCH OLK-5.10 0/2] Backport tracing mainline patches
by Tengda Wu 08 Oct '26

08 Oct '26

Backport tracing mainline patches. Steven Rostedt (1): tracing: Take trace_array reference when opening a tracer options file Tengda Wu (1): tracing: tracing: Fix KABI breakage from trace_options nr_topts field kernel/trace/trace.c | 52 +++++++++++++++++++++++++++++++++++++++++++- kernel/trace/trace.h | 1 + 2 files changed, 52 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH OLK-6.6 00/16] CVE-2026-74559
by Zhang Changzhong 30 Sep '26

30 Sep '26

Albert Huang (1): xsk: Avoid starving the xsk further down the list Fernando Fernandez Mancera (1): xsk: avoid data corruption on cq descriptor number Jason Xing (7): xsk: prevent CQ desync when freeing half-built skbs in xsk_build_skb() xsk: fix use-after-free of xs->skb in xsk_build_skb() free_err path xsk: fix u64 descriptor address truncation on 32-bit architectures xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx net: xsk: update tx queue consumer immediately after transmission xsk: drain continuation descs after overflow in xsk_build_skb() xsk: fix xsk_addrs slab leak on multi-buffer error path Maciej Fijalkowski (5): xsk: Use xsk_buff_pool directly for cq functions xsk: Fix immature cq descriptor production xsk: avoid overwriting skb fields for multi-buffer traffic xsk: provide sufficient space in pool->tx_descs xsk: reclaim invalid Tx descriptors in ZC batch path Wang Liang (1): xsk: Fix __xsk_generic_xmit() error code when cq is full Zhang Changzhong (1): Revert "xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx" Documentation/networking/af_xdp.rst | 54 ++-- include/net/xdp_sock.h | 8 + include/net/xsk_buff_pool.h | 9 +- net/xdp/xsk.c | 483 +++++++++++++++++++++++++++++++----- net/xdp/xsk_buff_pool.c | 13 +- net/xdp/xsk_queue.h | 77 ++++-- 6 files changed, 533 insertions(+), 111 deletions(-) -- 2.9.5

2 17

[PATCH OLK-5.10 00/14] CVE-2026-74724
by Zhang Changzhong 30 Sep '26

30 Sep '26

Florian Westphal (4): netfilter: ipvs: prepare for hook function reduction netfilter: ipvs: remove unneeded output wrappers netfilter: ipvs: remove unneeded input wrappers netfilter: ipvs: merge ipv4 + ipv6 icmp reply handlers Julian Anastasov (9): ipvs: skip ipv6 extension headers for csum checks ipvs: fix the checksum validations ipvs: fix more places with wrong ipv6 transport offsets ipvs: ensure inner headers in ICMP errors are in headroom ipvs: fix places with wrong packet offsets ipvs: do not mangle ICMP replies for non-first fragments ipvs: avoid out-of-bounds write in ip_vs_nat_icmp ipvs: return the csum validation for forward hook ipvs: revalidate ihl to prevent out-of-bounds access Yizhou Zhao (1): ipvs: fix PMTU for GUE/GRE tunnel ICMP errors include/net/ip6_fib.h | 2 + include/net/ip_vs.h | 38 +++- net/netfilter/ipvs/ip_vs_app.c | 10 +- net/netfilter/ipvs/ip_vs_core.c | 416 +++++++++++++--------------------- net/netfilter/ipvs/ip_vs_proto_sctp.c | 29 ++- net/netfilter/ipvs/ip_vs_proto_tcp.c | 59 +---- net/netfilter/ipvs/ip_vs_proto_udp.c | 64 ++---- net/netfilter/ipvs/ip_vs_xmit.c | 43 +++- 8 files changed, 268 insertions(+), 393 deletions(-) -- 2.9.5

2 15

[PATCH OLK-6.6 0/2] *** CVE-2026-89929 ***
by Zhang Kunbo 30 Sep '26

30 Sep '26

*** BLURB HERE *** Sean Christopherson (1): KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02 Yosry Ahmed (1): KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU arch/x86/kvm/vmx/nested.c | 52 +++++++++++++++++---------------------- 1 file changed, 22 insertions(+), 30 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS 0/2] Optimize checkpatch
by Tengda Wu 30 Sep '26

30 Sep '26

Optimize checkpatch to support recognition of Reference and Assisted-by tags. Sasha Levin (1): checkpatch: add support for Assisted-by tag Tengda Wu (1): checkpatch: Add Reference tag to the COMMIT_LOG_LONG_LINE exemption list scripts/checkpatch.pl | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS 0/5] CVE-2026-90049
by JiangJieHua 30 Sep '26

30 Sep '26

Mike Pattrick (2): openvswitch: Fix double reporting of drops in dropwatch openvswitch: Fix overreporting of drops in dropwatch Norbert Szetei (3): openvswitch: only skb_tx_error() a packet we are about to drop net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy() net: skbuff: don't touch shared zerocopy state in skb_tx_error() net/core/skbuff.c | 7 +++++-- net/openvswitch/datapath.c | 21 ++++++++++++++------- 2 files changed, 19 insertions(+), 9 deletions(-) -- 2.33.8

2 6