- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10 0/2] bpf selftest cross compile fixes
by Pu Lehui 05 Mar '26

05 Mar '26

Björn Töpel (1): selftests/bpf: Pass target triple to get_sys_includes macro Jean-Philippe Brucker (1): selftests/bpf: Enable cross-building tools/testing/selftests/bpf/Makefile | 58 +++++++++++++++++++++------- 1 file changed, 43 insertions(+), 15 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] net/sched: Reserve TC_H_INGRESS (TC_H_CLSACT) for ingress (clsact) Qdiscs
by Dong Chenchen 05 Mar '26

05 Mar '26

From: Peilin Ye <peilin.ye(a)bytedance.com> mainline inclusion from mainline-v6.4-rc5 commit f85fa45d4a9408d98c46c8fa45ba2e3b2f4bf219 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/7193 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Currently it is possible to add e.g. an HTB Qdisc under ffff:fff1 (TC_H_INGRESS, TC_H_CLSACT): $ ip link add name ifb0 type ifb $ tc qdisc add dev ifb0 parent ffff:fff1 htb $ tc qdisc add dev ifb0 clsact Error: Exclusivity flag on, cannot modify. $ drgn ... >>> ifb0 = netdev_get_by_name(prog, "ifb0") >>> qdisc = ifb0.ingress_queue.qdisc_sleeping >>> print(qdisc.ops.id.string_().decode()) htb >>> qdisc.flags.value_() # TCQ_F_INGRESS 2 Only allow ingress and clsact Qdiscs under ffff:fff1. Return -EINVAL for everything else. Make TCQ_F_INGRESS a static flag of ingress and clsact Qdiscs. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Fixes: 1f211a1b929c ("net, sched: add clsact qdisc") Tested-by: Pedro Tammela <pctammela(a)mojatatu.com> Acked-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Reviewed-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Reviewed-by: Vlad Buslov <vladbu(a)nvidia.com> Signed-off-by: Peilin Ye <peilin.ye(a)bytedance.com> Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/sched/sch_api.c [commit 8ecc7c8a1c16 is not backport] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/sched/sch_api.c | 7 ++++++- net/sched/sch_ingress.c | 4 ++-- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c index 2ea9e7753cb0..51f987df0ac7 100644 --- a/net/sched/sch_api.c +++ b/net/sched/sch_api.c @@ -1145,7 +1145,12 @@ static struct Qdisc *qdisc_create(struct net_device *dev, sch->parent = parent; if (handle == TC_H_INGRESS) { - sch->flags |= TCQ_F_INGRESS; + if (!(sch->flags & TCQ_F_INGRESS)) { + NL_SET_ERR_MSG(extack, + "Specified parent ID is reserved for ingress and clsact Qdiscs"); + err = -EINVAL; + goto err_out3; + } handle = TC_H_MAKE(TC_H_INGRESS, 0); lockdep_set_class(qdisc_lock(sch), &qdisc_rx_lock); } else { diff --git a/net/sched/sch_ingress.c b/net/sched/sch_ingress.c index ce3f55259d0d..238dacf41c22 100644 --- a/net/sched/sch_ingress.c +++ b/net/sched/sch_ingress.c @@ -130,7 +130,7 @@ static struct Qdisc_ops ingress_qdisc_ops __read_mostly = { .cl_ops = &ingress_class_ops, .id = "ingress", .priv_size = sizeof(struct ingress_sched_data), - .static_flags = TCQ_F_CPUSTATS, + .static_flags = TCQ_F_INGRESS | TCQ_F_CPUSTATS, .init = ingress_init, .destroy = ingress_destroy, .dump = ingress_dump, @@ -262,7 +262,7 @@ static struct Qdisc_ops clsact_qdisc_ops __read_mostly = { .cl_ops = &clsact_class_ops, .id = "clsact", .priv_size = sizeof(struct clsact_sched_data), - .static_flags = TCQ_F_CPUSTATS, + .static_flags = TCQ_F_INGRESS | TCQ_F_CPUSTATS, .init = clsact_init, .destroy = clsact_destroy, .dump = ingress_dump, -- 2.25.1

2 1

[PATCH OLK-6.6] bonding: fix use-after-free due to enslave fail after slave array update
by Dong Chenchen 05 Mar '26

05 Mar '26

From: Nikolay Aleksandrov <razor(a)blackwall.org> mainline inclusion from mainline-v6.19-rc8 commit e9acda52fd2ee0cdca332f996da7a95c5fd25294 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13721 CVE: CVE-2026-23171 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Fix a use-after-free which happens due to enslave failure after the new slave has been added to the array. Since the new slave can be used for Tx immediately, we can use it after it has been freed by the enslave error cleanup path which frees the allocated slave memory. Slave update array is supposed to be called last when further enslave failures are not expected. Move it after xdp setup to avoid any problems. It is very easy to reproduce the problem with a simple xdp_pass prog: ip l add bond1 type bond mode balance-xor ip l set bond1 up ip l set dev bond1 xdp object xdp_pass.o sec xdp_pass ip l add dumdum type dummy Then run in parallel: while :; do ip l set dumdum master bond1 1>/dev/null 2>&1; done; mausezahn bond1 -a own -b rand -A rand -B 1.1.1.1 -c 0 -t tcp "dp=1-1023, flags=syn" The crash happens almost immediately: [ 605.602850] Oops: general protection fault, probably for non-canonical address 0xe0e6fc2460000137: 0000 [#1] SMP KASAN NOPTI [ 605.602916] KASAN: maybe wild-memory-access in range [0x07380123000009b8-0x07380123000009bf] [ 605.602946] CPU: 0 UID: 0 PID: 2445 Comm: mausezahn Kdump: loaded Tainted: G B 6.19.0-rc6+ #21 PREEMPT(voluntary) [ 605.602979] Tainted: [B]=BAD_PAGE [ 605.602998] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 605.603032] RIP: 0010:netdev_core_pick_tx+0xcd/0x210 [ 605.603063] Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 3e 01 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 6b 08 49 8d 7d 30 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 25 01 00 00 49 8b 45 30 4c 89 e2 48 89 ee 48 89 [ 605.603111] RSP: 0018:ffff88817b9af348 EFLAGS: 00010213 [ 605.603145] RAX: dffffc0000000000 RBX: ffff88817d28b420 RCX: 0000000000000000 [ 605.603172] RDX: 00e7002460000137 RSI: 0000000000000008 RDI: 07380123000009be [ 605.603199] RBP: ffff88817b541a00 R08: 0000000000000001 R09: fffffbfff3ed8c0c [ 605.603226] R10: ffffffff9f6c6067 R11: 0000000000000001 R12: 0000000000000000 [ 605.603253] R13: 073801230000098e R14: ffff88817d28b448 R15: ffff88817b541a84 [ 605.603286] FS: 00007f6570ef67c0(0000) GS:ffff888221dfa000(0000) knlGS:0000000000000000 [ 605.603319] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 605.603343] CR2: 00007f65712fae40 CR3: 000000011371b000 CR4: 0000000000350ef0 [ 605.603373] Call Trace: [ 605.603392] <TASK> [ 605.603410] __dev_queue_xmit+0x448/0x32a0 [ 605.603434] ? __pfx_vprintk_emit+0x10/0x10 [ 605.603461] ? __pfx_vprintk_emit+0x10/0x10 [ 605.603484] ? __pfx___dev_queue_xmit+0x10/0x10 [ 605.603507] ? bond_start_xmit+0xbfb/0xc20 [bonding] [ 605.603546] ? _printk+0xcb/0x100 [ 605.603566] ? __pfx__printk+0x10/0x10 [ 605.603589] ? bond_start_xmit+0xbfb/0xc20 [bonding] [ 605.603627] ? add_taint+0x5e/0x70 [ 605.603648] ? add_taint+0x2a/0x70 [ 605.603670] ? end_report.cold+0x51/0x75 [ 605.603693] ? bond_start_xmit+0xbfb/0xc20 [bonding] [ 605.603731] bond_start_xmit+0x623/0xc20 [bonding] Fixes: 9e2ee5c7e7c3 ("net, bonding: Add XDP support to the bonding driver") Signed-off-by: Nikolay Aleksandrov <razor(a)blackwall.org> Reported-by: Chen Zhen <chenzhen126(a)huawei.com> Closes: https://lore.kernel.org/netdev/fae17c21-4940-5605-85b2-1d5e17342358@huawei.… CC: Jussi Maki <joamaki(a)gmail.com> CC: Daniel Borkmann <daniel(a)iogearbox.net> Acked-by: Daniel Borkmann <daniel(a)iogearbox.net> Link: https://patch.msgid.link/20260123120659.571187-1-razor@blackwall.org Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Conflicts: drivers/net/bonding/bond_main.c [commit e0caeb24f538 is not backport] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/net/bonding/bond_main.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c index 6dcb4e963044..172fdca5ce80 100644 --- a/drivers/net/bonding/bond_main.c +++ b/drivers/net/bonding/bond_main.c @@ -2296,9 +2296,6 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev, unblock_netpoll_tx(); } - if (bond_mode_can_use_xmit_hash(bond)) - bond_update_slave_arr(bond, NULL); - if (!slave_dev->netdev_ops->ndo_bpf || !slave_dev->netdev_ops->ndo_xdp_xmit) { if (bond->xdp_prog) { @@ -2332,6 +2329,9 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev, bpf_prog_inc(bond->xdp_prog); } + if (bond_mode_can_use_xmit_hash(bond)) + bond_update_slave_arr(bond, NULL); + bond_xdp_set_features(bond_dev); slave_info(bond_dev, slave_dev, "Enslaving as %s interface with %s link\n", -- 2.25.1

2 1

[PATCH OLK-6.6 0/2] net: Fix CVE-2026-23204
by Dong Chenchen 05 Mar '26

05 Mar '26

Fix CVE-2026-23204 Eric Dumazet (2): net: add skb_header_pointer_careful() helper net/sched: cls_u32: use skb_header_pointer_careful() include/linux/skbuff.h | 12 ++++++++++++ net/sched/cls_u32.c | 13 ++++++------- 2 files changed, 18 insertions(+), 7 deletions(-) -- 2.25.1

2 3

[PATCH v3 openEuler-26.09 0/4] Introduce xsched dmem
by Liu Kai 05 Mar '26

05 Mar '26

Introduce xsched dmem Alexander Pavlenko (4): xsched/dmem: set max region size of xsched dmem root group to physical XPU memory size xsched/dmem: init xsched dmem region xsched/dmem: introduce xsched_dmem_alloc() xsched/dmem: introduce xsched_dmem_free() include/linux/xsched.h | 16 ++++ include/uapi/linux/xcu_vstream.h | 8 ++ kernel/cgroup/dmem.c | 5 ++ kernel/xsched/Makefile | 1 + kernel/xsched/core.c | 4 + kernel/xsched/dmem.c | 135 +++++++++++++++++++++++++++++++ kernel/xsched/vstream.c | 42 ++++++++++ 7 files changed, 211 insertions(+) create mode 100644 kernel/xsched/dmem.c -- 2.34.1

2 5

[PATCH OLK-6.6] regmap: Fix race condition in hwspinlock irqsave routine
by Lin Ruifeng 05 Mar '26

05 Mar '26

From: Cheng-Yu Lee <cylee12(a)realtek.com> stable inclusion from stable-v6.6.122 commit 24f31be6ad70537fd7706269d99c92cade465a09 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13604 CVE: CVE-2026-23071 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4b58aac989c1e3fafb1c68a733811859df388250 ] Previously, the address of the shared member '&map->spinlock_flags' was passed directly to 'hwspin_lock_timeout_irqsave'. This creates a race condition where multiple contexts contending for the lock could overwrite the shared flags variable, potentially corrupting the state for the current lock owner. Fix this by using a local stack variable 'flags' to store the IRQ state temporarily. Fixes: 8698b9364710 ("regmap: Add hardware spinlock support") Signed-off-by: Cheng-Yu Lee <cylee12(a)realtek.com> Co-developed-by: Yu-Chun Lin <eleanor.lin(a)realtek.com> Signed-off-by: Yu-Chun Lin <eleanor.lin(a)realtek.com> Link: https://patch.msgid.link/20260109032633.8732-1-eleanor.lin@realtek.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/base/regmap/regmap.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c index 1209e01f8c7f..17c0c4412270 100644 --- a/drivers/base/regmap/regmap.c +++ b/drivers/base/regmap/regmap.c @@ -408,9 +408,11 @@ static void regmap_lock_hwlock_irq(void *__map) static void regmap_lock_hwlock_irqsave(void *__map) { struct regmap *map = __map; + unsigned long flags = 0; hwspin_lock_timeout_irqsave(map->hwlock, UINT_MAX, - &map->spinlock_flags); + &flags); + map->spinlock_flags = flags; } static void regmap_unlock_hwlock(void *__map) -- 2.43.0

2 1

[PATCH OLK-6.6] ceph: fix oops due to invalid pointer for kfree() in parse_longname()
by Pan Taixi 05 Mar '26

05 Mar '26

From: Daniel Vogelbacher <daniel(a)chaospixel.com> mainline inclusion from mainline-v6.19 commit bc8dedae022ce3058659c3addef3ec4b41d15e00 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13836/ CVE: CVE-2026-23201 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- This fixes a kernel oops when reading ceph snapshot directories (.snap), for example by simply running `ls /mnt/my_ceph/.snap`. The variable str is guarded by __free(kfree), but advanced by one for skipping the initial '_' in snapshot names. Thus, kfree() is called with an invalid pointer. This patch removes the need for advancing the pointer so kfree() is called with correct memory pointer. Steps to reproduce: 1. Create snapshots on a cephfs volume (I've 63 snaps in my testcase) 2. Add cephfs mount to fstab $ echo "samba-fileserver@.files=/volumes/datapool/stuff/3461082b-ecc9-4e82-8549-3fd2590d3fb6 /mnt/test/stuff ceph acl,noatime,_netdev 0 0" >> /etc/fstab 3. Reboot the system $ systemctl reboot 4. Check if it's really mounted $ mount | grep stuff 5. List snapshots (expected 63 snapshots on my system) $ ls /mnt/test/stuff/.snap Now ls hangs forever and the kernel log shows the oops. Cc: stable(a)vger.kernel.org Fixes: 101841c38346 ("[ceph] parse_longname(): strrchr() expects NUL-terminated string") Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220807 Suggested-by: Helge Deller <deller(a)gmx.de> Signed-off-by: Daniel Vogelbacher <daniel(a)chaospixel.com> Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko(a)ibm.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Conflicts: fs/ceph/crypto.c [Context conflicts due to unmmerged commit 38d46409c463 ("ceph: print cluster fsid and client global_id in all debug logs")] Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com> --- fs/ceph/crypto.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/fs/ceph/crypto.c b/fs/ceph/crypto.c index fa2aaf1d30f8..b0337c4b1bd7 100644 --- a/fs/ceph/crypto.c +++ b/fs/ceph/crypto.c @@ -215,12 +215,13 @@ static struct inode *parse_longname(const struct inode *parent, struct ceph_vino vino = { .snap = CEPH_NOSNAP }; char *name_end, *inode_number; int ret = -EIO; - /* NUL-terminate */ - char *str __free(kfree) = kmemdup_nul(name, *name_len, GFP_KERNEL); + /* Snapshot name must start with an underscore */ + if (*name_len <= 0 || name[0] != '_') + return ERR_PTR(-EIO); + /* Skip initial '_' and NUL-terminate */ + char *str __free(kfree) = kmemdup_nul(name + 1, *name_len - 1, GFP_KERNEL); if (!str) return ERR_PTR(-ENOMEM); - /* Skip initial '_' */ - str++; name_end = strrchr(str, '_'); if (!name_end) { dout("Failed to parse long snapshot name: %s\n", str); -- 2.34.1

2 1

[PATCH v3 openEuler-26.09 0/3] Introduce xsched dmem
by Liu Kai 04 Mar '26

04 Mar '26

Introduce xsched dmem Liu Kai (3): xsched: replace magic number with SCHED_CLASS_MAX_LENGTH for scheduler class string length xsched: simplify root group check by direct comparison with root_xcg xsched: add is_offline check in work function include/linux/xsched.h | 5 ++--- kernel/xsched/cfs_quota.c | 5 +++-- kernel/xsched/cgroup.c | 20 ++++++-------------- 3 files changed, 11 insertions(+), 19 deletions(-) -- 2.34.1

2 4

[PATCH v3 openEuler-26.09 0/4] Introduce xsched dmem
by Liu Kai 04 Mar '26

04 Mar '26

Introduce xsched dmem Alexander Pavlenko (4): xsched/dmem: set max region size of xsched dmem root group to physical XPU memory size xsched/dmem: init xsched dmem region xsched/dmem: introduce xsched_dmem_alloc() xsched/dmem: introduce xsched_dmem_free() include/linux/xsched.h | 16 ++++ include/uapi/linux/xcu_vstream.h | 8 ++ kernel/cgroup/dmem.c | 5 ++ kernel/xsched/Makefile | 1 + kernel/xsched/core.c | 4 + kernel/xsched/dmem.c | 135 +++++++++++++++++++++++++++++++ kernel/xsched/vstream.c | 42 ++++++++++ 7 files changed, 211 insertions(+) create mode 100644 kernel/xsched/dmem.c -- 2.34.1

2 5

[PATCH v6 openEuler-26.09 00/13] Introduce dmem cgroup
by Liu Kai 04 Mar '26

04 Mar '26

Introduce dmem cgroup Chen Ridong (4): cgroup/dmem: fix NULL pointer dereference when setting max cgroup/dmem: avoid rcu warning when unregister region cgroup/dmem: avoid pool UAF cgroup: increase maximum subsystem count from 16 to 32 Friedrich Vock (1): cgroup/dmem: Don't open-code css_for_each_descendant_pre Geert Uytterhoeven (1): cgroup/rdma: Drop bogus PAGE_COUNTER select Jiapeng Chong (1): kernel/cgroup: Remove the unused variable climit Maarten Lankhorst (2): mm/page_counter: move calculating protection values to page_counter kernel/cgroup: Add "dmem" memory accounting cgroup Maxime Ripard (3): cgroup/dmem: Select PAGE_COUNTER cgroup/dmem: Fix parameters documentation doc/cgroup: Fix title underline length Roman Gushchin (1): mm: page_counters: put page_counter_calculate_protection() under CONFIG_MEMCG Documentation/admin-guide/cgroup-v2.rst | 58 +- Documentation/core-api/cgroup.rst | 9 + Documentation/core-api/index.rst | 1 + Documentation/gpu/drm-compute.rst | 54 ++ include/linux/cgroup-defs.h | 8 +- include/linux/cgroup_dmem.h | 66 ++ include/linux/cgroup_subsys.h | 4 + include/linux/page_counter.h | 10 + include/trace/events/cgroup.h | 2 +- init/Kconfig | 10 + kernel/cgroup/Makefile | 1 + kernel/cgroup/cgroup-internal.h | 8 +- kernel/cgroup/cgroup-v1.c | 12 +- kernel/cgroup/cgroup.c | 46 +- kernel/cgroup/debug.c | 2 +- kernel/cgroup/dmem.c | 885 ++++++++++++++++++++++++ mm/memcontrol.c | 154 +---- mm/page_counter.c | 175 +++++ 18 files changed, 1308 insertions(+), 197 deletions(-) create mode 100644 Documentation/core-api/cgroup.rst create mode 100644 Documentation/gpu/drm-compute.rst create mode 100644 include/linux/cgroup_dmem.h create mode 100644 kernel/cgroup/dmem.c -- 2.34.1

2 14

[PATCH openEuler-1.0-LTS v6 00/10] support apei_page_offline_policy
by Qi Xi 04 Mar '26

04 Mar '26

Patches 1-4 with [Merged] prefix are four patches from the old page isolation solution (enable_soft_offline + panic prevention), already delivered to customers. Original PR: https://atomgit.com/openeuler/kernel/merge_requests/20004 Patches 5-9 are the new solution, enabling automated configuration in the new version: Patches 5-7 remove the redundant enable_soft_offline bit 1 huge page isolation switch from the old solution, and copy mc only supports THP and regular pages. Patch 8 adds sysctl_apei_page_offline_policy to support regular/huge page isolation policies and driver notification chain. Patch 9-10 fix bugs. Changes in v6: Fix panic casued by UCE in kernel context (!current->mm). Changes in v5: Change sysctl_apei_page_offline_policy bit0 to enable/disable driver notification. Backport some patches that have been merged. Since CONFIG_UCE_KERNEL_RECOVERY depends on CONFIG_ARM64, remove the redundant condition in migrate_page(). Changes in v4: Fix typo errors and backport bugfix for mc_copy. Changes in v3: Use bool rather than int as the return type of apei_page_should_offline(). Drop the PF_UCE_KERNEL_RECOVERY flag after soft-offlining the page. Changes in v2: Add a new sysctl_apei_page_offline_policy, instead of changing soft_offline_page. Jiaqi Yan (1): mm/memory-failure: userspace controls soft-offlining pages Kyle Meyer (1): mm/memory-failure: support disabling soft offline for HugeTLB pages Qi Xi (4): Revert "mm/memory-failure: support disabling soft offline for HugeTLB pages" Revert "arm64: mm: Add copy mc support for migrate_page" apei/ghes: Add sysctl interface to control soft-offline page isolation uce: Prevent kernel panic for kernel-context UCE with recovery path Wupeng Ma (3): uce: add copy_mc_highpage{s} arm64: mm: Add copy mc support for migrate_page arm64: mm: Add copy mc support for migrate_page Yongjian Sun (1): ext4: fix e4b bitmap inconsistency reports arch/arm64/mm/fault.c | 10 +++++- drivers/acpi/apei/ghes.c | 77 ++++++++++++++++++++++++++++++++++++++++ fs/ext4/mballoc.c | 21 +++++------ include/linux/highmem.h | 55 ++++++++++++++++++++++++++++ include/linux/mm.h | 7 ++++ kernel/sysctl.c | 21 +++++++++++ mm/memory-failure.c | 20 +++++++++-- mm/migrate.c | 58 ++++++++++++++++++++++++++++-- 8 files changed, 253 insertions(+), 16 deletions(-) -- 2.33.0

2 11

[PATCH OLK-6.6 v4 0/2] support apei_page_offline_policy
by Qi Xi 04 Mar '26

04 Mar '26

Changes in v4: Add function stubs when CONFIG_ACPI_APEI_MEMORY_FAILURE=n. Add log when sysctl_apei_page_offline_policy changed. Fix typos. Changes in v3: Fix compile error when CONFIG_ACPI_APEI_MEMORY_FAILURE=n Changes in v2: Refactor the code by moving apei policy control to the seperate file ghes-policy.c No need to enhance logging in do_sea() in this patch series. Automated configuration with enable_soft_offline as global master switch (default=1): enable_soft_offline = 0: Page isolation completely disabled enable_soft_offline = 1: Page isolation enabled, policy controlled by new interface New interface: sysctl_apei_page_offline_policy provides fine-grained control (default=2, isolating base pages only): bit 0: Notify BMC about soft_offline_page scanning bit 1: Control base page isolation bit 2: Control hugetlb page isolation Qi Xi (2): Revert "mm/memory-failure: support disabling soft offline for HugeTLB pages" apei/ghes: Add sysctl interface to control soft-offline page isolation .../ABI/testing/sysfs-memory-page-offline | 3 - drivers/acpi/apei/Makefile | 1 + drivers/acpi/apei/apei-internal.h | 8 ++ drivers/acpi/apei/ghes-policy.c | 102 ++++++++++++++++++ drivers/acpi/apei/ghes.c | 3 + include/linux/acpi.h | 13 +++ mm/memory-failure.c | 17 +-- 7 files changed, 130 insertions(+), 17 deletions(-) create mode 100644 drivers/acpi/apei/ghes-policy.c -- 2.33.0

2 3

[PATCH OLK-5.10 0/2] support apei_page_offline_policy
by Qi Xi 04 Mar '26

04 Mar '26

Automated configuration with enable_soft_offline as global master switch (default=1): enable_soft_offline = 0: Page isolation completely disabled enable_soft_offline = 1: Page isolation enabled, policy controlled by new interface New interface: sysctl_apei_page_offline_policy provides fine-grained control (default=2, isolating base pages only): bit 0: Notify BMC about soft_offline_page scanning bit 1: Control base page isolation bit 2: Control hugetlb page isolation Qi Xi (2): Revert "mm/memory-failure: support disabling soft offline for HugeTLB pages" apei/ghes: Add sysctl interface to control soft-offline page isolation .../ABI/testing/sysfs-memory-page-offline | 3 - drivers/acpi/apei/Makefile | 1 + drivers/acpi/apei/apei-internal.h | 8 ++ drivers/acpi/apei/ghes-policy.c | 102 ++++++++++++++++++ drivers/acpi/apei/ghes.c | 3 + include/linux/acpi.h | 14 +++ kernel/sysctl.c | 2 +- mm/memory-failure.c | 15 +-- 8 files changed, 131 insertions(+), 17 deletions(-) create mode 100644 drivers/acpi/apei/ghes-policy.c -- 2.33.0

2 3

[PATCH OLK-6.6 0/3] CVE-2026-23102
by Liu Mingrui 04 Mar '26

04 Mar '26

From: Mingrui Liu <liumingrui(a)huawei.com> CVE-2026-23102 Mark Rutland (3): arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state arm64/fpsimd: signal: Consistently read FPSIMD context arm64/fpsimd: signal: Fix restoration of SVE context arch/arm64/kernel/signal.c | 92 +++++++++++++++++++++++--------------- 1 file changed, 57 insertions(+), 35 deletions(-) -- 2.34.1

2 4

[PATCH v5 openEuler-26.09 00/12] Introduce dmem cgroup
by Liu Kai 04 Mar '26

04 Mar '26

Introduce dmem cgroup Chen Ridong (3): cgroup/dmem: fix NULL pointer dereference when setting max cgroup/dmem: avoid rcu warning when unregister region cgroup/dmem: avoid pool UAF Friedrich Vock (1): cgroup/dmem: Don't open-code css_for_each_descendant_pre Geert Uytterhoeven (1): cgroup/rdma: Drop bogus PAGE_COUNTER select Jiapeng Chong (1): kernel/cgroup: Remove the unused variable climit Maarten Lankhorst (2): mm/page_counter: move calculating protection values to page_counter kernel/cgroup: Add "dmem" memory accounting cgroup Maxime Ripard (3): cgroup/dmem: Select PAGE_COUNTER cgroup/dmem: Fix parameters documentation doc/cgroup: Fix title underline length Roman Gushchin (1): mm: page_counters: put page_counter_calculate_protection() under CONFIG_MEMCG Documentation/admin-guide/cgroup-v2.rst | 58 +- Documentation/core-api/cgroup.rst | 9 + Documentation/core-api/index.rst | 1 + Documentation/gpu/drm-compute.rst | 54 ++ include/linux/cgroup_dmem.h | 66 ++ include/linux/cgroup_subsys.h | 4 + include/linux/page_counter.h | 10 + init/Kconfig | 10 + kernel/cgroup/Makefile | 1 + kernel/cgroup/cgroup.c | 2 +- kernel/cgroup/dmem.c | 885 ++++++++++++++++++++++++ mm/memcontrol.c | 154 +---- mm/page_counter.c | 175 +++++ 13 files changed, 1270 insertions(+), 159 deletions(-) create mode 100644 Documentation/core-api/cgroup.rst create mode 100644 Documentation/gpu/drm-compute.rst create mode 100644 include/linux/cgroup_dmem.h create mode 100644 kernel/cgroup/dmem.c -- 2.34.1

2 13

[PATCH OLK-6.6] dmaengine: xilinx: xdma: Fix regmap max_register
by Yin Tirui 03 Mar '26

03 Mar '26

From: Anthony Brandon <anthony(a)amarulasolutions.com> stable inclusion from stable-v6.6.122 commit df8a131a41ff6202d47f59452735787f2b71dd2d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13577 CVE: CVE-2025-71195 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit c7d436a6c1a274c1ac28d5fb3b8eb8f03b6d0e10 ] The max_register field is assigned the size of the register memory region instead of the offset of the last register. The result is that reading from the regmap via debugfs can cause a segmentation fault: tail /sys/kernel/debug/regmap/xdma.1.auto/registers Unable to handle kernel paging request at virtual address ffff800082f70000 Mem abort info: ESR = 0x0000000096000007 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x07: level 3 translation fault [...] Call trace: regmap_mmio_read32le+0x10/0x30 _regmap_bus_reg_read+0x74/0xc0 _regmap_read+0x68/0x198 regmap_read+0x54/0x88 regmap_read_debugfs+0x140/0x380 regmap_map_read_file+0x30/0x48 full_proxy_read+0x68/0xc8 vfs_read+0xcc/0x310 ksys_read+0x7c/0x120 __arm64_sys_read+0x24/0x40 invoke_syscall.constprop.0+0x64/0x108 do_el0_svc+0xb0/0xd8 el0_svc+0x38/0x130 el0t_64_sync_handler+0x120/0x138 el0t_64_sync+0x194/0x198 Code: aa1e03e9 d503201f f9400000 8b214000 (b9400000) ---[ end trace 0000000000000000 ]--- note: tail[1217] exited with irqs disabled note: tail[1217] exited with preempt_count 1 Segmentation fault Fixes: 17ce252266c7 ("dmaengine: xilinx: xdma: Add xilinx xdma driver") Reviewed-by: Lizhi Hou <lizhi.hou(a)amd.com> Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey(a)amd.com> Reviewed-by: Alexander Stein <alexander.stein(a)ew.tq-group.com> Signed-off-by: Anthony Brandon <anthony(a)amarulasolutions.com> Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yin Tirui <yintirui(a)huawei.com> --- drivers/dma/xilinx/xdma-regs.h | 1 + drivers/dma/xilinx/xdma.c | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/dma/xilinx/xdma-regs.h b/drivers/dma/xilinx/xdma-regs.h index dd98b4526b90..b19c173d8bfc 100644 --- a/drivers/dma/xilinx/xdma-regs.h +++ b/drivers/dma/xilinx/xdma-regs.h @@ -9,6 +9,7 @@ /* The length of register space exposed to host */ #define XDMA_REG_SPACE_LEN 65536 +#define XDMA_MAX_REG_OFFSET (XDMA_REG_SPACE_LEN - 4) /* * maximum number of DMA channels for each direction: diff --git a/drivers/dma/xilinx/xdma.c b/drivers/dma/xilinx/xdma.c index e0bfd129d563..dbab4c449914 100644 --- a/drivers/dma/xilinx/xdma.c +++ b/drivers/dma/xilinx/xdma.c @@ -38,7 +38,7 @@ static const struct regmap_config xdma_regmap_config = { .reg_bits = 32, .val_bits = 32, .reg_stride = 4, - .max_register = XDMA_REG_SPACE_LEN, + .max_register = XDMA_MAX_REG_OFFSET, }; /** -- 2.43.0

2 1

[PATCH OLK-5.10 0/3] CVE-2025-39967
by Zicheng Qu 03 Mar '26

03 Mar '26

Kees Cook (1): overflow: Allow mixed type arguments Samasth Norway Ananda (1): fbcon: fix integer overflow in fbcon_do_set_font Thomas Zimmermann (1): fbcon: Fix OOB access in font allocation drivers/video/fbdev/core/fbcon.c | 13 ++++-- include/linux/overflow.h | 72 ++++++++++++++++++-------------- 2 files changed, 51 insertions(+), 34 deletions(-) -- 2.34.1

2 4

[PATCH v2 openEuler-26.09 0/3] Introduce xsched dmem
by Liu Kai 03 Mar '26

03 Mar '26

Introduce xsched dmem Alexander Pavlenko (3): xsched/dmem: init xsched dmem region xsched/dmem: introduce xsched_dmem_alloc() xsched/dmem: introduce xsched_dmem_free() include/linux/xsched.h | 16 ++++ include/uapi/linux/xcu_vstream.h | 8 ++ kernel/xsched/Makefile | 1 + kernel/xsched/core.c | 4 + kernel/xsched/dmem.c | 135 +++++++++++++++++++++++++++++++ kernel/xsched/vstream.c | 42 ++++++++++ 6 files changed, 206 insertions(+) create mode 100644 kernel/xsched/dmem.c -- 2.34.1

2 4

[PATCH OLK-5.10] hwmon: (acpi_power_meter) Fix deadlocks related to acpi_power_meter_notify()
by Yin Tirui 03 Mar '26

03 Mar '26

From: "Rafael J. Wysocki" <rafael.j.wysocki(a)intel.com> mainline inclusion from mainline-v6.19 commit 615901b57b7ef8eb655f71358f7e956e42bcd16b category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13743 CVE: CVE-2026-23186 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- The acpi_power_meter driver's .notify() callback function, acpi_power_meter_notify(), calls hwmon_device_unregister() under a lock that is also acquired by callbacks in sysfs attributes of the device being unregistered which is prone to deadlocks between sysfs access and device removal. Address this by moving the hwmon device removal in acpi_power_meter_notify() outside the lock in question, but notice that doing it alone is not sufficient because two concurrent METER_NOTIFY_CONFIG notifications may be attempting to remove the same device at the same time. To prevent that from happening, add a new lock serializing the execution of the switch () statement in acpi_power_meter_notify(). For simplicity, it is a static mutex which should not be a problem from the performance perspective. The new lock also allows the hwmon_device_register_with_info() in acpi_power_meter_notify() to be called outside the inner lock because it prevents the other notifications handled by that function from manipulating the "resource" object while the hwmon device based on it is being registered. The sending of ACPI netlink messages from acpi_power_meter_notify() is serialized by the new lock too which generally helps to ensure that the order of handling firmware notifications is the same as the order of sending netlink messages related to them. In addition, notice that hwmon_device_register_with_info() may fail in which case resource->hwmon_dev will become an error pointer, so add checks to avoid attempting to unregister the hwmon device pointer to by it in that case to acpi_power_meter_notify() and acpi_power_meter_remove(). Fixes: 16746ce8adfe ("hwmon: (acpi_power_meter) Replace the deprecated hwmon_device_register") Closes: https://lore.kernel.org/linux-hwmon/CAK8fFZ58fidGUCHi5WFX0uoTPzveUUDzT=k=AA… Reported-by: Jaroslav Pulchart <jaroslav.pulchart(a)gooddata.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Signed-off-by: Guenter Roeck <linux(a)roeck-us.net> Signed-off-by: Yin Tirui <yintirui(a)huawei.com> --- drivers/hwmon/acpi_power_meter.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/drivers/hwmon/acpi_power_meter.c b/drivers/hwmon/acpi_power_meter.c index 95d0d39738a1..02a57ea3e566 100644 --- a/drivers/hwmon/acpi_power_meter.c +++ b/drivers/hwmon/acpi_power_meter.c @@ -47,6 +47,8 @@ static int cap_in_hardware; static bool force_cap_on; +static DEFINE_MUTEX(acpi_notify_lock); + static int can_cap_in_hardware(void) { return force_cap_on || cap_in_hardware; @@ -826,18 +828,26 @@ static void acpi_power_meter_notify(struct acpi_device *device, u32 event) resource = acpi_driver_data(device); + guard(mutex)(&acpi_notify_lock); + switch (event) { case METER_NOTIFY_CONFIG: + if (!IS_ERR(resource->hwmon_dev)) + hwmon_device_unregister(resource->hwmon_dev); + mutex_lock(&resource->lock); + free_capabilities(resource); remove_domain_devices(resource); - hwmon_device_unregister(resource->hwmon_dev); res = read_capabilities(resource); if (res) dev_err_once(&device->dev, "read capabilities failed.\n"); res = read_domain_devices(resource); if (res && res != -ENODEV) dev_err_once(&device->dev, "read domain devices failed.\n"); + + mutex_unlock(&resource->lock); + resource->hwmon_dev = hwmon_device_register_with_info(&device->dev, ACPI_POWER_METER_NAME, @@ -846,7 +856,7 @@ static void acpi_power_meter_notify(struct acpi_device *device, u32 event) power_extra_groups); if (IS_ERR(resource->hwmon_dev)) dev_err_once(&device->dev, "register hwmon device failed.\n"); - mutex_unlock(&resource->lock); + break; case METER_NOTIFY_TRIP: sysfs_notify(&device->dev.kobj, NULL, POWER_AVERAGE_NAME); @@ -956,7 +966,8 @@ static int acpi_power_meter_remove(struct acpi_device *device) return -EINVAL; resource = acpi_driver_data(device); - hwmon_device_unregister(resource->hwmon_dev); + if (!IS_ERR(resource->hwmon_dev)) + hwmon_device_unregister(resource->hwmon_dev); remove_domain_devices(resource); free_capabilities(resource); -- 2.43.0

2 1

[PATCH OLK-5.10 0/3] CVE-2025-39967
by Zicheng Qu 03 Mar '26

03 Mar '26

Kees Cook (1): overflow: Allow mixed type arguments Samasth Norway Ananda (1): fbcon: fix integer overflow in fbcon_do_set_font Thomas Zimmermann (1): fbcon: Fix OOB access in font allocation drivers/video/fbdev/core/fbcon.c | 13 ++++-- include/linux/overflow.h | 72 ++++++++++++++++++-------------- 2 files changed, 51 insertions(+), 34 deletions(-) -- 2.34.1

2 4

[PATCH v4 OLK-6.6 0/8] arm64: Add memory poison recovery support for various paths
by Wupeng Ma 03 Mar '26

03 Mar '26

This series enhances the arm64 kernel's ability to recover from memory poison (hardware memory errors) encountered during common I/O and data copy operations. The work extends the existing RAS error handling framework to gracefully handle poison in scenarios that previously could lead to kernel panics or silent data corruption. Memory errors are increasingly common in large-scale deployments; recovering from them where possible improves system reliability and availability. The patches implement recovery in key paths such as copy_{from/to}_user, iov_iter, __kernel_read, and shmem_file_read_iter, ensuring that when poison is consumed, the kernel can either complete the operation safely (by returning an error) or deliver the appropriate signal to the affected user process. Additionally, the series refines the SEA (Synchronous External Abort) handling path: it moves siaddr extraction earlier for accurate signal info, adds RAS logging for better diagnostics, and ensures a SIGBUS is sent to user tasks when APEI claims fail. The series has been tested on ARM64 platforms with RAS capabilities, using error injection to verify that poison is correctly handled and that appropriate errors or signals are delivered. Feedback and review are appreciated. Changelog since v1: - use correct issue Changelog since v2: - fix compile error on arm Linus Torvalds (1): iov_iter: get rid of 'copy_mc' flag Wupeng Ma (7): arm64: mm: support recovery from copy_{from/to}_user_page() iov_iter: add mc support for copy_page_to_iter arm64: fs: support poison recovery from __kernel_read() arm64: mm: shmem: support poison recovery from shmem_file_read_iter() arm64: move getting valid siaddr to the top of do_sea arm64: add ras log during do_sea arm64: send sig fault for user task when apei_claim_sea fails arch/arm/include/asm/cacheflush.h | 24 +++++++++++++++ arch/arm64/include/asm/cacheflush.h | 7 +++++ arch/arm64/kernel/acpi.c | 2 ++ arch/arm64/mm/extable.c | 5 +++- arch/arm64/mm/fault.c | 46 ++++++++++++++++++++++------- arch/arm64/mm/flush.c | 11 +++++++ fs/coredump.c | 45 ++++++++++++++++++++++++++-- include/asm-generic/cacheflush.h | 24 +++++++++++++++ lib/iov_iter.c | 16 ++++++++-- mm/filemap.c | 3 ++ mm/memory.c | 15 +++++++--- mm/shmem.c | 4 +++ 12 files changed, 182 insertions(+), 20 deletions(-) -- 2.43.0

2 9

[PATCH v4 openEuler-26.09 00/13] Introduce dmem cgroup
by Liu Kai 03 Mar '26

03 Mar '26

Introduce dmem cgroup Alexander Pavlenko (1): xsched/dmem: set max region size of xsched dmem root group to physical XPU memory size Chen Ridong (3): cgroup/dmem: fix NULL pointer dereference when setting max cgroup/dmem: avoid rcu warning when unregister region cgroup/dmem: avoid pool UAF Friedrich Vock (1): cgroup/dmem: Don't open-code css_for_each_descendant_pre Geert Uytterhoeven (1): cgroup/rdma: Drop bogus PAGE_COUNTER select Jiapeng Chong (1): kernel/cgroup: Remove the unused variable climit Maarten Lankhorst (2): mm/page_counter: move calculating protection values to page_counter kernel/cgroup: Add "dmem" memory accounting cgroup Maxime Ripard (3): cgroup/dmem: Select PAGE_COUNTER cgroup/dmem: Fix parameters documentation doc/cgroup: Fix title underline length Roman Gushchin (1): mm: page_counters: put page_counter_calculate_protection() under CONFIG_MEMCG Documentation/admin-guide/cgroup-v2.rst | 58 +- Documentation/core-api/cgroup.rst | 9 + Documentation/core-api/index.rst | 1 + Documentation/gpu/drm-compute.rst | 54 ++ include/linux/cgroup_dmem.h | 66 ++ include/linux/cgroup_subsys.h | 4 + include/linux/page_counter.h | 10 + init/Kconfig | 10 + kernel/cgroup/Makefile | 1 + kernel/cgroup/cgroup.c | 2 +- kernel/cgroup/dmem.c | 888 ++++++++++++++++++++++++ mm/memcontrol.c | 154 +--- mm/page_counter.c | 175 +++++ 13 files changed, 1273 insertions(+), 159 deletions(-) create mode 100644 Documentation/core-api/cgroup.rst create mode 100644 Documentation/gpu/drm-compute.rst create mode 100644 include/linux/cgroup_dmem.h create mode 100644 kernel/cgroup/dmem.c -- 2.34.1

2 14

[PATCH OLK-6.6 0/3] CVE-2026-23102
by Liu Mingrui 03 Mar '26

03 Mar '26

From: Mingrui Liu <liumingrui(a)huawei.com> CVE-2026-23102 Mark Rutland (3): arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state arm64/fpsimd: signal: Consistently read FPSIMD context arm64/fpsimd: signal: Fix restoration of SVE context arch/arm64/kernel/signal.c | 92 +++++++++++++++++++++++--------------- 1 file changed, 57 insertions(+), 35 deletions(-) -- 2.34.1

2 4

[PATCH OLK-6.6 0/3] CVE-2026-23102
by Liu Mingrui 03 Mar '26

03 Mar '26

From: Mingrui Liu <liumingrui(a)huawei.com> CVE-2026-23102 Mark Rutland (3): arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state arm64/fpsimd: signal: Consistently read FPSIMD context arm64/fpsimd: signal: Fix restoration of SVE context arch/arm64/kernel/signal.c | 92 +++++++++++++++++++++++--------------- 1 file changed, 57 insertions(+), 35 deletions(-) -- 2.34.1

1 3

[PATCH OLK-6.6 0/3] CVE-2026-23102
by Liu Mingrui 03 Mar '26

03 Mar '26

From: Mingrui Liu <liumingrui(a)huawei.com> CVE-2026-23102 Mark Rutland (3): arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state arm64/fpsimd: signal: Consistently read FPSIMD context arm64/fpsimd: signal: Fix restoration of SVE context arch/arm64/kernel/signal.c | 92 +++++++++++++++++++++++--------------- 1 file changed, 57 insertions(+), 35 deletions(-) -- 2.34.1

2 4

[PATCH v3 OLK-6.6 0/8] arm64: Add memory poison recovery support for various paths
by Wupeng Ma 03 Mar '26

03 Mar '26

This series enhances the arm64 kernel's ability to recover from memory poison (hardware memory errors) encountered during common I/O and data copy operations. The work extends the existing RAS error handling framework to gracefully handle poison in scenarios that previously could lead to kernel panics or silent data corruption. Memory errors are increasingly common in large-scale deployments; recovering from them where possible improves system reliability and availability. The patches implement recovery in key paths such as copy_{from/to}_user, iov_iter, __kernel_read, and shmem_file_read_iter, ensuring that when poison is consumed, the kernel can either complete the operation safely (by returning an error) or deliver the appropriate signal to the affected user process. Additionally, the series refines the SEA (Synchronous External Abort) handling path: it moves siaddr extraction earlier for accurate signal info, adds RAS logging for better diagnostics, and ensures a SIGBUS is sent to user tasks when APEI claims fail. The series has been tested on ARM64 platforms with RAS capabilities, using error injection to verify that poison is correctly handled and that appropriate errors or signals are delivered. Feedback and review are appreciated. Changelog since v1: - use correct issue Changelog since v2: - fix compile error on arm Linus Torvalds (1): iov_iter: get rid of 'copy_mc' flag Wupeng Ma (7): arm64: mm: support recovery from copy_{from/to}_user_page() iov_iter: add mc support for copy_page_to_iter arm64: fs: support poison recovery from __kernel_read() arm64: mm: shmem: support poison recovery from shmem_file_read_iter() arm64: move getting valid siaddr to the top of do_sea arm64: add ras log during do_sea arm64: send sig fault for user task when apei_claim_sea fails arch/arm/include/asm/cacheflush.h | 2 ++ arch/arm64/include/asm/cacheflush.h | 7 +++++ arch/arm64/kernel/acpi.c | 2 ++ arch/arm64/mm/extable.c | 5 +++- arch/arm64/mm/fault.c | 46 ++++++++++++++++++++++------- arch/arm64/mm/flush.c | 11 +++++++ fs/coredump.c | 45 ++++++++++++++++++++++++++-- include/asm-generic/cacheflush.h | 24 +++++++++++++++ lib/iov_iter.c | 16 ++++++++-- mm/filemap.c | 3 ++ mm/memory.c | 15 +++++++--- mm/shmem.c | 4 +++ 12 files changed, 160 insertions(+), 20 deletions(-) -- 2.43.0

2 9

[PATCH OLK-6.6 0/3] CVE-2026-23102
by Liu Mingrui 03 Mar '26

03 Mar '26

From: Mingrui Liu <liumingrui(a)huawei.com> CVE-2026-23102 Mark Rutland (3): arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state arm64/fpsimd: signal: Consistently read FPSIMD context arm64/fpsimd: signal: Fix restoration of SVE context arch/arm64/kernel/signal.c | 92 +++++++++++++++++++++++--------------- 1 file changed, 57 insertions(+), 35 deletions(-) -- 2.34.1

2 4

[PATCH OLK-6.6 0/3] CVE-2026-23102
by Liu Mingrui 03 Mar '26

03 Mar '26

From: Mingrui Liu <liumingrui(a)huawei.com> CVE-2026-23102 Mark Rutland (3): arm64/fpsimd: signal: Mandate SVE payload for streaming-mode state arm64/fpsimd: signal: Consistently read FPSIMD context arm64/fpsimd: signal: Fix restoration of SVE context arch/arm64/kernel/signal.c | 92 +++++++++++++++++++++++--------------- 1 file changed, 57 insertions(+), 35 deletions(-) -- 2.34.1

1 0

[PATCH OLK-6.6] smb/server: fix refcount leak in parse_durable_handle_context()
by Li Lingfeng 03 Mar '26

03 Mar '26

From: ZhangGuoDong <zhangguodong(a)kylinos.cn> stable inclusion from stable-v6.6.124 commit 07df5ff4f6490a5c96715b7c562e0b2908422e04 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13725 CVE: CVE-2025-71204 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3296c3012a9d9a27e81e34910384e55a6ff3cff0 ] When the command is a replay operation and -ENOEXEC is returned, the refcount of ksmbd_file must be released. Signed-off-by: ZhangGuoDong <zhangguodong(a)kylinos.cn> Signed-off-by: ChenXiaoSong <chenxiaosong(a)kylinos.cn> Acked-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/smb/server/smb2pdu.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c index 04273f309330..b0b7c5e509aa 100644 --- a/fs/smb/server/smb2pdu.c +++ b/fs/smb/server/smb2pdu.c @@ -2795,6 +2795,7 @@ static int parse_durable_handle_context(struct ksmbd_work *work, SMB2_CLIENT_GUID_SIZE)) { if (!(req->hdr.Flags & SMB2_FLAGS_REPLAY_OPERATION)) { err = -ENOEXEC; + ksmbd_put_durable_fd(dh_info->fp); goto out; } -- 2.52.0

2 1

[PATCH v4 openEuler-26.09 00/13] Introduce dmem cgroup
by Liu Kai 03 Mar '26

03 Mar '26

Introduce dmem cgroup Alexander Pavlenko (p00812954) (1): xsched/dmem: set max region size of xsched dmem root group to physical XPU memory size Chen Ridong (3): cgroup/dmem: fix NULL pointer dereference when setting max cgroup/dmem: avoid rcu warning when unregister region cgroup/dmem: avoid pool UAF Friedrich Vock (1): cgroup/dmem: Don't open-code css_for_each_descendant_pre Geert Uytterhoeven (1): cgroup/rdma: Drop bogus PAGE_COUNTER select Jiapeng Chong (1): kernel/cgroup: Remove the unused variable climit Maarten Lankhorst (2): mm/page_counter: move calculating protection values to page_counter kernel/cgroup: Add "dmem" memory accounting cgroup Maxime Ripard (3): cgroup/dmem: Select PAGE_COUNTER cgroup/dmem: Fix parameters documentation doc/cgroup: Fix title underline length Roman Gushchin (1): mm: page_counters: put page_counter_calculate_protection() under CONFIG_MEMCG Documentation/admin-guide/cgroup-v2.rst | 58 +- Documentation/core-api/cgroup.rst | 9 + Documentation/core-api/index.rst | 1 + Documentation/gpu/drm-compute.rst | 54 ++ include/linux/cgroup_dmem.h | 66 ++ include/linux/cgroup_subsys.h | 4 + include/linux/page_counter.h | 10 + init/Kconfig | 10 + kernel/cgroup/Makefile | 1 + kernel/cgroup/cgroup.c | 2 +- kernel/cgroup/dmem.c | 888 ++++++++++++++++++++++++ mm/memcontrol.c | 154 +--- mm/page_counter.c | 175 +++++ 13 files changed, 1273 insertions(+), 159 deletions(-) create mode 100644 Documentation/core-api/cgroup.rst create mode 100644 Documentation/gpu/drm-compute.rst create mode 100644 include/linux/cgroup_dmem.h create mode 100644 kernel/cgroup/dmem.c -- 2.34.1

2 14

openEuler Kernel SIG双周例会
by openEuler conference 03 Mar '26

03 Mar '26

您好！ Kernel 邀请您参加 2026-03-06 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议发起人： LiaoTao_Wave 会议内容： 1. 进展update 2. 议题征集中，新增议题可直接填报至会议纪要看板会议链接：https://meeting.huaweicloud.com:36443/#/j/963264350 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2026-03-06 14:00 The subject of the conference is openEuler Kernel SIG双周例会 The sponsor of the conference is LiaoTao_Wave Summary: 1. 进展update 2. 议题征集中，新增议题可直接填报至会议纪要看板 You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/963264350 Add topics at https://etherpad.openeuler.org/p/Kernel-meetings More information: https://www.openeuler.org/en/

1 0

[PATCH OLK-6.6] PCI: Fix NVMe link speed downgrade to 2.5GT/s during hotplug
by Hongtao Zhang 03 Mar '26

03 Mar '26

From: Jinhui Guo <guojinhui.liam(a)bytedance.com> maillist inclusion category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13837 Reference: https://lore.kernel.org/all/20241107143758.12643-1-guojinhui.liam@bytedance… ------------------------------------------- During extreme hotplug stress tests (e.g., NVMe insertions 50 times), the link speed is permanently downgraded to 2.5 GT/s. "Card present" is reported twice via external interrupts due to a slight tremor when the NVMe device is plugged in. The failure of the link activation for the first time leads to the link speed of the root port being mistakenly downgraded to 2.5GT/s by the ASMedia workaround. If the link subsequently trains successfully at 2.5GT/s, the device gets trapped at Gen1 speed because the recovery logic only applies to ASMedia chips. Upstream community addressed this by relying on the newly introduced pci/bwctrl subsystem (Commit de9a6c8d5dbf), which is not present in stable kernels like 6.6. Backporting the mainline fix would require pulling in massive architectural changes and risking system stability. This patch adopts the RFC approach to avoid wrongly setting the link speed to 2.5GT/s by moving the whitelist check to the very beginning. Only allow the specific ASMedia PCIe switches to perform link retrain. Fixes: a89c82249c37 ("PCI: Work around PCIe link training failures") Signed-off-by: Jinhui Guo <guojinhui.liam(a)bytedance.com> Signed-off-by: Zhang Hongtao <zhanghongtao35(a)huawei.com> --- drivers/pci/quirks.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c index a2a2bde69a026..fbdd54cc81c71 100644 --- a/drivers/pci/quirks.c +++ b/drivers/pci/quirks.c @@ -94,7 +94,8 @@ int pcie_failed_link_retrain(struct pci_dev *dev) int ret = -ENOTTY; if (!pci_is_pcie(dev) || !pcie_downstream_port(dev) || - !pcie_cap_has_lnkctl2(dev) || !dev->link_active_reporting) + !pcie_cap_has_lnkctl2(dev) || !dev->link_active_reporting || + !pci_match_id(ids, dev)) return ret; pcie_capability_read_word(dev, PCI_EXP_LNKCTL2, &lnkctl2); @@ -122,8 +123,7 @@ int pcie_failed_link_retrain(struct pci_dev *dev) } if ((lnksta & PCI_EXP_LNKSTA_DLLLA) && - (lnkctl2 & PCI_EXP_LNKCTL2_TLS) == PCI_EXP_LNKCTL2_TLS_2_5GT && - pci_match_id(ids, dev)) { + (lnkctl2 & PCI_EXP_LNKCTL2_TLS) == PCI_EXP_LNKCTL2_TLS_2_5GT) { u32 lnkcap; pci_info(dev, "removing 2.5GT/s downstream link speed restriction\n"); -- 2.43.0

2 1

[PATCH v2 OLK-6.6 0/8] arm64: Add memory poison recovery support for various paths
by Wupeng Ma 02 Mar '26

02 Mar '26

This series enhances the arm64 kernel's ability to recover from memory poison (hardware memory errors) encountered during common I/O and data copy operations. The work extends the existing RAS error handling framework to gracefully handle poison in scenarios that previously could lead to kernel panics or silent data corruption. Memory errors are increasingly common in large-scale deployments; recovering from them where possible improves system reliability and availability. The patches implement recovery in key paths such as copy_{from/to}_user, iov_iter, __kernel_read, and shmem_file_read_iter, ensuring that when poison is consumed, the kernel can either complete the operation safely (by returning an error) or deliver the appropriate signal to the affected user process. Additionally, the series refines the SEA (Synchronous External Abort) handling path: it moves siaddr extraction earlier for accurate signal info, adds RAS logging for better diagnostics, and ensures a SIGBUS is sent to user tasks when APEI claims fail. The series has been tested on ARM64 platforms with RAS capabilities, using error injection to verify that poison is correctly handled and that appropriate errors or signals are delivered. Feedback and review are appreciated. Changelog since v1: - use correct issue Linus Torvalds (1): iov_iter: get rid of 'copy_mc' flag Wupeng Ma (7): arm64: mm: support recovery from copy_{from/to}_user_page() iov_iter: add mc support for copy_page_to_iter arm64: fs: support poison recovery from __kernel_read() arm64: mm: shmem: support poison recovery from shmem_file_read_iter() arm64: move getting valid siaddr to the top of do_sea arm64: add ras log during do_sea arm64: send sig fault for user task when apei_claim_sea fails arch/arm64/include/asm/cacheflush.h | 7 +++++ arch/arm64/kernel/acpi.c | 2 ++ arch/arm64/mm/extable.c | 5 +++- arch/arm64/mm/fault.c | 46 ++++++++++++++++++++++------- arch/arm64/mm/flush.c | 11 +++++++ fs/coredump.c | 45 ++++++++++++++++++++++++++-- include/asm-generic/cacheflush.h | 24 +++++++++++++++ lib/iov_iter.c | 16 ++++++++-- mm/filemap.c | 3 ++ mm/memory.c | 15 +++++++--- mm/shmem.c | 4 +++ 11 files changed, 158 insertions(+), 20 deletions(-) -- 2.43.0

2 9

[PATCH OLK-6.6 0/8] arm64: Add memory poison recovery support for various paths
by Wupeng Ma 02 Mar '26

02 Mar '26

This series enhances the arm64 kernel's ability to recover from memory poison (hardware memory errors) encountered during common I/O and data copy operations. The work extends the existing RAS error handling framework to gracefully handle poison in scenarios that previously could lead to kernel panics or silent data corruption. Memory errors are increasingly common in large-scale deployments; recovering from them where possible improves system reliability and availability. The patches implement recovery in key paths such as copy_{from/to}_user, iov_iter, __kernel_read, and shmem_file_read_iter, ensuring that when poison is consumed, the kernel can either complete the operation safely (by returning an error) or deliver the appropriate signal to the affected user process. Additionally, the series refines the SEA (Synchronous External Abort) handling path: it moves siaddr extraction earlier for accurate signal info, adds RAS logging for better diagnostics, and ensures a SIGBUS is sent to user tasks when APEI claims fail. The series has been tested on ARM64 platforms with RAS capabilities, using error injection to verify that poison is correctly handled and that appropriate errors or signals are delivered. Feedback and review are appreciated. Linus Torvalds (1): iov_iter: get rid of 'copy_mc' flag Wupeng Ma (7): arm64: mm: support recovery from copy_{from/to}_user_page() iov_iter: add mc support for copy_page_to_iter arm64: fs: support poison recovery from __kernel_read() arm64: mm: shmem: support poison recovery from shmem_file_read_iter() arm64: move getting valid siaddr to the top of do_sea arm64: add ras log during do_sea arm64: send sig fault for user task when apei_claim_sea fails arch/arm64/include/asm/cacheflush.h | 7 +++++ arch/arm64/kernel/acpi.c | 2 ++ arch/arm64/mm/extable.c | 5 +++- arch/arm64/mm/fault.c | 46 ++++++++++++++++++++++------- arch/arm64/mm/flush.c | 11 +++++++ fs/coredump.c | 45 ++++++++++++++++++++++++++-- include/asm-generic/cacheflush.h | 24 +++++++++++++++ lib/iov_iter.c | 16 ++++++++-- mm/filemap.c | 3 ++ mm/memory.c | 15 +++++++--- mm/shmem.c | 4 +++ 11 files changed, 158 insertions(+), 20 deletions(-) -- 2.43.0

2 9

[PATCH openEuler-1.0-LTS] PCI: Fix pci_slot_trylock() error handling
by Ziming Du 02 Mar '26

02 Mar '26

From: Jinhui Guo <guojinhui.liam(a)bytedance.com> mainline inclusion from mainline-v7.0-rc1 commit 9368d1ee62829b08aa31836b3ca003803caf0b72 category: bugfix bugzilla: 190823 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Commit a4e772898f8b ("PCI: Add missing bridge lock to pci_bus_lock()") delegates the bridge device's pci_dev_trylock() to pci_bus_trylock() in pci_slot_trylock(), but it forgets to remove the corresponding pci_dev_unlock() when pci_bus_trylock() fails. Before a4e772898f8b, the code did: if (!pci_dev_trylock(dev)) /* <- lock bridge device */ goto unlock; if (dev->subordinate) { if (!pci_bus_trylock(dev->subordinate)) { pci_dev_unlock(dev); /* <- unlock bridge device */ goto unlock; } } After a4e772898f8b the bridge-device lock is no longer taken, but the pci_dev_unlock(dev) on the failure path was left in place, leading to the bug. This yields one of two errors: 1. A warning that the lock is being unlocked when no one holds it. 2. An incorrect unlock of a lock that belongs to another thread. Fix it by removing the now-redundant pci_dev_unlock(dev) on the failure path. [Same patch later posted by Keith at https://patch.msgid.link/20260116184150.3013258-1-kbusch@meta.com] Fixes: a4e772898f8b ("PCI: Add missing bridge lock to pci_bus_lock()") Signed-off-by: Jinhui Guo <guojinhui.liam(a)bytedance.com> Signed-off-by: Bjorn Helgaas <bhelgaas(a)google.com> Reviewed-by: Dan Williams <dan.j.williams(a)intel.com> Cc: stable(a)vger.kernel.org Link: https://patch.msgid.link/20251212145528.2555-1-guojinhui.liam@bytedance.com Signed-off-by: Ziming Du <duziming2(a)huawei.com> --- drivers/pci/pci.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c index b93605616d4e4..fbef3c37f37fa 100644 --- a/drivers/pci/pci.c +++ b/drivers/pci/pci.c @@ -5144,10 +5144,8 @@ static int pci_slot_trylock(struct pci_slot *slot) if (!dev->slot || dev->slot != slot) continue; if (dev->subordinate) { - if (!pci_bus_trylock(dev->subordinate)) { - pci_dev_unlock(dev); + if (!pci_bus_trylock(dev->subordinate)) goto unlock; - } } else if (!pci_dev_trylock(dev)) goto unlock; } -- 2.43.0

2 1

[PATCH OLK-6.6 v2] KVM: arm64: Fix softirq masking in FPSIMD register saving sequence
by Yipeng Zou 02 Mar '26

02 Mar '26

From: Will Deacon <will(a)kernel.org> stable inclusion from stable-v6.6.111 commit 250b6e009ff97f69411aa109116ac720d54f45ec category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8596 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Stable commit 28b82be094e2 ("KVM: arm64: Fix kernel BUG() due to bad backport of FPSIMD/SVE/SME fix") fixed a kernel BUG() caused by a bad backport of upstream commit fbc7e61195e2 ("KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state") by ensuring that softirqs are disabled/enabled across the fpsimd register save operation. Unfortunately, although this fixes the original issue, it can now lead to deadlock when re-enabling softirqs causes pending softirqs to be handled with locks already held: | BUG: spinlock recursion on CPU#7, CPU 3/KVM/57616 | lock: 0xffff3045ef850240, .magic: dead4ead, .owner: CPU 3/KVM/57616, .owner_cpu: 7 | CPU: 7 PID: 57616 Comm: CPU 3/KVM Tainted: G O 6.1.152 #1 | Hardware name: SoftIron SoftIron Platform Mainboard/SoftIron Platform Mainboard, BIOS 1.31 May 11 2023 | Call trace: | dump_backtrace+0xe4/0x110 | show_stack+0x20/0x30 | dump_stack_lvl+0x6c/0x88 | dump_stack+0x18/0x34 | spin_dump+0x98/0xac | do_raw_spin_lock+0x70/0x128 | _raw_spin_lock+0x18/0x28 | raw_spin_rq_lock_nested+0x18/0x28 | update_blocked_averages+0x70/0x550 | run_rebalance_domains+0x50/0x70 | handle_softirqs+0x198/0x328 | __do_softirq+0x1c/0x28 | ____do_softirq+0x18/0x28 | call_on_irq_stack+0x30/0x48 | do_softirq_own_stack+0x24/0x30 | do_softirq+0x74/0x90 | __local_bh_enable_ip+0x64/0x80 | fpsimd_save_and_flush_cpu_state+0x5c/0x68 | kvm_arch_vcpu_put_fp+0x4c/0x88 | kvm_arch_vcpu_put+0x28/0x88 | kvm_sched_out+0x38/0x58 | __schedule+0x55c/0x6c8 | schedule+0x60/0xa8 Take a tiny step towards the upstream fix in 9b19700e623f ("arm64: fpsimd: Drop unneeded 'busy' flag") by additionally disabling hardirqs while saving the fpsimd registers. Cc: Ard Biesheuvel <ardb(a)kernel.org> Cc: Lee Jones <lee(a)kernel.org> Cc: Sasha Levin <sashal(a)kernel.org> Cc: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Cc: <stable(a)vger.kernel.org> # 6.6.y Fixes: 208d4f745a52 ("KVM: arm64: Fix kernel BUG() due to bad backport of FPSIMD/SVE/SME fix") Reported-by: Kenneth Van Alstyne <kvanals(a)kvanals.org> Link: https://lore.kernel.org/r/010001999bae0958-4d80d25d-8dda-4006-a6b9-798f3e77… Signed-off-by: Will Deacon <will(a)kernel.org> Acked-by: Ard Biesheuvel <ardb(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- arch/arm64/kernel/fpsimd.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/arch/arm64/kernel/fpsimd.c b/arch/arm64/kernel/fpsimd.c index 75344016b14c..9da29ae8a045 100644 --- a/arch/arm64/kernel/fpsimd.c +++ b/arch/arm64/kernel/fpsimd.c @@ -1870,13 +1870,17 @@ static void fpsimd_flush_cpu_state(void) */ void fpsimd_save_and_flush_cpu_state(void) { + unsigned long flags; + if (!system_supports_fpsimd()) return; WARN_ON(preemptible()); - get_cpu_fpsimd_context(); + local_irq_save(flags); + __get_cpu_fpsimd_context(); fpsimd_save(); fpsimd_flush_cpu_state(); - put_cpu_fpsimd_context(); + __put_cpu_fpsimd_context(); + local_irq_restore(flags); } #ifdef CONFIG_KERNEL_MODE_NEON -- 2.34.1

2 1

[PATCH OLK-6.6] KVM: arm64: Fix softirq masking in FPSIMD register saving sequence
by Yipeng Zou 02 Mar '26

02 Mar '26

From: Will Deacon <will(a)kernel.org> stable inclusion from stable-v6.6.111 commit 250b6e009ff97f69411aa109116ac720d54f45ec category: bugfix bugzilla: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Stable commit 28b82be094e2 ("KVM: arm64: Fix kernel BUG() due to bad backport of FPSIMD/SVE/SME fix") fixed a kernel BUG() caused by a bad backport of upstream commit fbc7e61195e2 ("KVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state") by ensuring that softirqs are disabled/enabled across the fpsimd register save operation. Unfortunately, although this fixes the original issue, it can now lead to deadlock when re-enabling softirqs causes pending softirqs to be handled with locks already held: | BUG: spinlock recursion on CPU#7, CPU 3/KVM/57616 | lock: 0xffff3045ef850240, .magic: dead4ead, .owner: CPU 3/KVM/57616, .owner_cpu: 7 | CPU: 7 PID: 57616 Comm: CPU 3/KVM Tainted: G O 6.1.152 #1 | Hardware name: SoftIron SoftIron Platform Mainboard/SoftIron Platform Mainboard, BIOS 1.31 May 11 2023 | Call trace: | dump_backtrace+0xe4/0x110 | show_stack+0x20/0x30 | dump_stack_lvl+0x6c/0x88 | dump_stack+0x18/0x34 | spin_dump+0x98/0xac | do_raw_spin_lock+0x70/0x128 | _raw_spin_lock+0x18/0x28 | raw_spin_rq_lock_nested+0x18/0x28 | update_blocked_averages+0x70/0x550 | run_rebalance_domains+0x50/0x70 | handle_softirqs+0x198/0x328 | __do_softirq+0x1c/0x28 | ____do_softirq+0x18/0x28 | call_on_irq_stack+0x30/0x48 | do_softirq_own_stack+0x24/0x30 | do_softirq+0x74/0x90 | __local_bh_enable_ip+0x64/0x80 | fpsimd_save_and_flush_cpu_state+0x5c/0x68 | kvm_arch_vcpu_put_fp+0x4c/0x88 | kvm_arch_vcpu_put+0x28/0x88 | kvm_sched_out+0x38/0x58 | __schedule+0x55c/0x6c8 | schedule+0x60/0xa8 Take a tiny step towards the upstream fix in 9b19700e623f ("arm64: fpsimd: Drop unneeded 'busy' flag") by additionally disabling hardirqs while saving the fpsimd registers. Cc: Ard Biesheuvel <ardb(a)kernel.org> Cc: Lee Jones <lee(a)kernel.org> Cc: Sasha Levin <sashal(a)kernel.org> Cc: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Cc: <stable(a)vger.kernel.org> # 6.6.y Fixes: 208d4f745a52 ("KVM: arm64: Fix kernel BUG() due to bad backport of FPSIMD/SVE/SME fix") Reported-by: Kenneth Van Alstyne <kvanals(a)kvanals.org> Link: https://lore.kernel.org/r/010001999bae0958-4d80d25d-8dda-4006-a6b9-798f3e77… Signed-off-by: Will Deacon <will(a)kernel.org> Acked-by: Ard Biesheuvel <ardb(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- arch/arm64/kernel/fpsimd.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/arch/arm64/kernel/fpsimd.c b/arch/arm64/kernel/fpsimd.c index 75344016b14c..9da29ae8a045 100644 --- a/arch/arm64/kernel/fpsimd.c +++ b/arch/arm64/kernel/fpsimd.c @@ -1870,13 +1870,17 @@ static void fpsimd_flush_cpu_state(void) */ void fpsimd_save_and_flush_cpu_state(void) { + unsigned long flags; + if (!system_supports_fpsimd()) return; WARN_ON(preemptible()); - get_cpu_fpsimd_context(); + local_irq_save(flags); + __get_cpu_fpsimd_context(); fpsimd_save(); fpsimd_flush_cpu_state(); - put_cpu_fpsimd_context(); + __put_cpu_fpsimd_context(); + local_irq_restore(flags); } #ifdef CONFIG_KERNEL_MODE_NEON -- 2.34.1

2 1

[PATCH OLK-6.6] scsi: qla2xxx: Free sp in error path to fix system crash
by Zheng Qixing 02 Mar '26

02 Mar '26

From: Anil Gurumurthy <agurumurthy(a)marvell.com> stable inclusion from stable-v6.6.125 commit aed16d37696f494288a291b4b477484ed0be774b category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13785 CVE: CVE-2025-71232 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------ commit 7adbd2b7809066c75f0433e5e2a8e114b429f30f upstream. System crash seen during load/unload test in a loop, [61110.449331] qla2xxx [0000:27:00.0]-0042:0: Disabled MSI-X. [61110.467494] ============================================================================= [61110.467498] BUG qla2xxx_srbs (Tainted: G OE -------- --- ): Objects remaining in qla2xxx_srbs on __kmem_cache_shutdown() [61110.467501] ----------------------------------------------------------------------------- [61110.467502] Slab 0x000000000ffc8162 objects=51 used=1 fp=0x00000000e25d3d85 flags=0x57ffffc0010200(slab|head|node=1|zone=2|lastcpupid=0x1fffff) [61110.467509] CPU: 53 PID: 455206 Comm: rmmod Kdump: loaded Tainted: G OE -------- --- 5.14.0-284.11.1.el9_2.x86_64 #1 [61110.467513] Hardware name: HPE ProLiant DL385 Gen10 Plus v2/ProLiant DL385 Gen10 Plus v2, BIOS A42 08/17/2023 [61110.467515] Call Trace: [61110.467516] <TASK> [61110.467519] dump_stack_lvl+0x34/0x48 [61110.467526] slab_err.cold+0x53/0x67 [61110.467534] __kmem_cache_shutdown+0x16e/0x320 [61110.467540] kmem_cache_destroy+0x51/0x160 [61110.467544] qla2x00_module_exit+0x93/0x99 [qla2xxx] [61110.467607] ? __do_sys_delete_module.constprop.0+0x178/0x280 [61110.467613] ? syscall_trace_enter.constprop.0+0x145/0x1d0 [61110.467616] ? do_syscall_64+0x5c/0x90 [61110.467619] ? exc_page_fault+0x62/0x150 [61110.467622] ? entry_SYSCALL_64_after_hwframe+0x63/0xcd [61110.467626] </TASK> [61110.467627] Disabling lock debugging due to kernel taint [61110.467635] Object 0x0000000026f7e6e6 @offset=16000 [61110.467639] ------------[ cut here ]------------ [61110.467639] kmem_cache_destroy qla2xxx_srbs: Slab cache still has objects when called from qla2x00_module_exit+0x93/0x99 [qla2xxx] [61110.467659] WARNING: CPU: 53 PID: 455206 at mm/slab_common.c:520 kmem_cache_destroy+0x14d/0x160 [61110.467718] CPU: 53 PID: 455206 Comm: rmmod Kdump: loaded Tainted: G B OE -------- --- 5.14.0-284.11.1.el9_2.x86_64 #1 [61110.467720] Hardware name: HPE ProLiant DL385 Gen10 Plus v2/ProLiant DL385 Gen10 Plus v2, BIOS A42 08/17/2023 [61110.467721] RIP: 0010:kmem_cache_destroy+0x14d/0x160 [61110.467724] Code: 99 7d 07 00 48 89 ef e8 e1 6a 07 00 eb b3 48 8b 55 60 48 8b 4c 24 20 48 c7 c6 70 fc 66 90 48 c7 c7 f8 ef a1 90 e8 e1 ed 7c 00 <0f> 0b eb 93 c3 cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 [61110.467725] RSP: 0018:ffffa304e489fe80 EFLAGS: 00010282 [61110.467727] RAX: 0000000000000000 RBX: ffffffffc0d9a860 RCX: 0000000000000027 [61110.467729] RDX: ffff8fd5ff9598a8 RSI: 0000000000000001 RDI: ffff8fd5ff9598a0 [61110.467730] RBP: ffff8fb6aaf78700 R08: 0000000000000000 R09: 0000000100d863b7 [61110.467731] R10: ffffa304e489fd20 R11: ffffffff913bef48 R12: 0000000040002000 [61110.467731] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [61110.467733] FS: 00007f64c89fb740(0000) GS:ffff8fd5ff940000(0000) knlGS:0000000000000000 [61110.467734] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [61110.467735] CR2: 00007f0f02bfe000 CR3: 00000020ad6dc005 CR4: 0000000000770ee0 [61110.467736] PKRU: 55555554 [61110.467737] Call Trace: [61110.467738] <TASK> [61110.467739] qla2x00_module_exit+0x93/0x99 [qla2xxx] [61110.467755] ? __do_sys_delete_module.constprop.0+0x178/0x280 Free sp in the error path to fix the crash. Fixes: f352eeb75419 ("scsi: qla2xxx: Add ability to use GPNFT/GNNFT for RSCN handling") Cc: stable(a)vger.kernel.org Signed-off-by: Anil Gurumurthy <agurumurthy(a)marvell.com> Signed-off-by: Nilesh Javali <njavali(a)marvell.com> Reviewed-by: Himanshu Madhani <hmadhani2024(a)gmail.com> Link: https://patch.msgid.link/20251210101604.431868-9-njavali@marvell.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/scsi/qla2xxx/qla_gs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/qla2xxx/qla_gs.c b/drivers/scsi/qla2xxx/qla_gs.c index c09229b7c516..821e22731fed 100644 --- a/drivers/scsi/qla2xxx/qla_gs.c +++ b/drivers/scsi/qla2xxx/qla_gs.c @@ -3625,8 +3625,8 @@ int qla_fab_async_scan(scsi_qla_host_t *vha, srb_t *sp) if (vha->scan.scan_flags & SF_SCANNING) { spin_unlock_irqrestore(&vha->work_lock, flags); ql_dbg(ql_dbg_disc + ql_dbg_verbose, vha, 0x2012, - "%s: scan active\n", __func__); - return rval; + "%s: scan active for sp:%p\n", __func__, sp); + goto done_free_sp; } vha->scan.scan_flags |= SF_SCANNING; if (!sp) -- 2.39.2

2 1

[PATCH OLK-6.6] scsi: qla2xxx: Delay module unload while fabric scan in progress
by Zheng Qixing 02 Mar '26

02 Mar '26

From: Anil Gurumurthy <agurumurthy(a)marvell.com> stable inclusion from stable-v6.6.125 commit 528b2f1027edfb52af0171f0f4b227fb356dde05 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13782 CVE: CVE-2025-71235 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------ commit 8890bf450e0b6b283f48ac619fca5ac2f14ddd62 upstream. System crash seen during load/unload test in a loop. [105954.384919] RBP: ffff914589838dc0 R08: 0000000000000000 R09: 0000000000000086 [105954.384920] R10: 000000000000000f R11: ffffa31240904be5 R12: ffff914605f868e0 [105954.384921] R13: ffff914605f86910 R14: 0000000000008010 R15: 00000000ddb7c000 [105954.384923] FS: 0000000000000000(0000) GS:ffff9163fec40000(0000) knlGS:0000000000000000 [105954.384925] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [105954.384926] CR2: 000055d31ce1d6a0 CR3: 0000000119f5e001 CR4: 0000000000770ee0 [105954.384928] PKRU: 55555554 [105954.384929] Call Trace: [105954.384931] <IRQ> [105954.384934] qla24xx_sp_unmap+0x1f3/0x2a0 [qla2xxx] [105954.384962] ? qla_async_scan_sp_done+0x114/0x1f0 [qla2xxx] [105954.384980] ? qla24xx_els_ct_entry+0x4de/0x760 [qla2xxx] [105954.384999] ? __wake_up_common+0x80/0x190 [105954.385004] ? qla24xx_process_response_queue+0xc2/0xaa0 [qla2xxx] [105954.385023] ? qla24xx_msix_rsp_q+0x44/0xb0 [qla2xxx] [105954.385040] ? __handle_irq_event_percpu+0x3d/0x190 [105954.385044] ? handle_irq_event+0x58/0xb0 [105954.385046] ? handle_edge_irq+0x93/0x240 [105954.385050] ? __common_interrupt+0x41/0xa0 [105954.385055] ? common_interrupt+0x3e/0xa0 [105954.385060] ? asm_common_interrupt+0x22/0x40 The root cause of this was that there was a free (dma_free_attrs) in the interrupt context. There was a device discovery/fabric scan in progress. A module unload was issued which set the UNLOADING flag. As part of the discovery, after receiving an interrupt a work queue was scheduled (which involved a work to be queued). Since the UNLOADING flag is set, the work item was not allocated and the mapped memory had to be freed. The free occurred in interrupt context leading to system crash. Delay the driver unload until the fabric scan is complete to avoid the crash. Reported-by: kernel test robot <lkp(a)intel.com> Reported-by: Dan Carpenter <dan.carpenter(a)linaro.org> Closes: https://lore.kernel.org/all/202512090414.07Waorz0-lkp@intel.com/ Fixes: 783e0dc4f66a ("qla2xxx: Check for device state before unloading the driver.") Cc: stable(a)vger.kernel.org Signed-off-by: Anil Gurumurthy <agurumurthy(a)marvell.com> Signed-off-by: Nilesh Javali <njavali(a)marvell.com> Reviewed-by: Himanshu Madhani <hmadhani2024(a)gmail.com> Link: https://patch.msgid.link/20251210101604.431868-8-njavali@marvell.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/scsi/qla2xxx/qla_os.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c index 7fa7a658ba19..609acc97e887 100644 --- a/drivers/scsi/qla2xxx/qla_os.c +++ b/drivers/scsi/qla2xxx/qla_os.c @@ -1194,7 +1194,8 @@ qla2x00_wait_for_hba_ready(scsi_qla_host_t *vha) while ((qla2x00_reset_active(vha) || ha->dpc_active || ha->flags.mbox_busy) || test_bit(FX00_RESET_RECOVERY, &vha->dpc_flags) || - test_bit(FX00_TARGET_SCAN, &vha->dpc_flags)) { + test_bit(FX00_TARGET_SCAN, &vha->dpc_flags) || + (vha->scan.scan_flags & SF_SCANNING)) { if (test_bit(UNLOADING, &base_vha->dpc_flags)) break; msleep(1000); -- 2.39.2

2 1

[PATCH OLK-6.6] scsi: qla2xxx: Validate sp before freeing associated memory
by Zheng Qixing 02 Mar '26

02 Mar '26

From: Anil Gurumurthy <agurumurthy(a)marvell.com> stable inclusion from stable-v6.6.125 commit 949010291bb941d53733ed08a33454254d9afb1b category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13781 CVE: CVE-2025-71236 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------ commit b6df15aec8c3441357d4da0eaf4339eb20f5999f upstream. System crash with the following signature [154563.214890] nvme nvme2: NVME-FC{1}: controller connect complete [154564.169363] qla2xxx [0000:b0:00.1]-3002:2: nvme: Sched: Set ZIO exchange threshold to 3. [154564.169405] qla2xxx [0000:b0:00.1]-ffffff:2: SET ZIO Activity exchange threshold to 5. [154565.539974] qla2xxx [0000:b0:00.1]-5013:2: RSCN database changed – 0078 0080 0000. [154565.545744] qla2xxx [0000:b0:00.1]-5013:2: RSCN database changed – 0078 00a0 0000. [154565.545857] qla2xxx [0000:b0:00.1]-11a2:2: FEC=enabled (data rate). [154565.552760] qla2xxx [0000:b0:00.1]-11a2:2: FEC=enabled (data rate). [154565.553079] BUG: kernel NULL pointer dereference, address: 00000000000000f8 [154565.553080] #PF: supervisor read access in kernel mode [154565.553082] #PF: error_code(0x0000) - not-present page [154565.553084] PGD 80000010488ab067 P4D 80000010488ab067 PUD 104978a067 PMD 0 [154565.553089] Oops: 0000 1 PREEMPT SMP PTI [154565.553092] CPU: 10 PID: 858 Comm: qla2xxx_2_dpc Kdump: loaded Tainted: G OE ------- --- 5.14.0-503.11.1.el9_5.x86_64 #1 [154565.553096] Hardware name: HPE Synergy 660 Gen10/Synergy 660 Gen10 Compute Module, BIOS I43 09/30/2024 [154565.553097] RIP: 0010:qla_fab_async_scan.part.0+0x40b/0x870 [qla2xxx] [154565.553141] Code: 00 00 e8 58 a3 ec d4 49 89 e9 ba 12 20 00 00 4c 89 e6 49 c7 c0 00 ee a8 c0 48 c7 c1 66 c0 a9 c0 bf 00 80 00 10 e8 15 69 00 00 <4c> 8b 8d f8 00 00 00 4d 85 c9 74 35 49 8b 84 24 00 19 00 00 48 8b [154565.553143] RSP: 0018:ffffb4dbc8aebdd0 EFLAGS: 00010286 [154565.553145] RAX: 0000000000000000 RBX: ffff8ec2cf0908d0 RCX: 0000000000000002 [154565.553147] RDX: 0000000000000000 RSI: ffffffffc0a9c896 RDI: ffffb4dbc8aebd47 [154565.553148] RBP: 0000000000000000 R08: ffffb4dbc8aebd45 R09: 0000000000ffff0a [154565.553150] R10: 0000000000000000 R11: 000000000000000f R12: ffff8ec2cf0908d0 [154565.553151] R13: ffff8ec2cf090900 R14: 0000000000000102 R15: ffff8ec2cf084000 [154565.553152] FS: 0000000000000000(0000) GS:ffff8ed27f800000(0000) knlGS:0000000000000000 [154565.553154] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [154565.553155] CR2: 00000000000000f8 CR3: 000000113ae0a005 CR4: 00000000007706f0 [154565.553157] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [154565.553158] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [154565.553159] PKRU: 55555554 [154565.553160] Call Trace: [154565.553162] <TASK> [154565.553165] ? show_trace_log_lvl+0x1c4/0x2df [154565.553172] ? show_trace_log_lvl+0x1c4/0x2df [154565.553177] ? qla_fab_async_scan.part.0+0x40b/0x870 [qla2xxx] [154565.553215] ? __die_body.cold+0x8/0xd [154565.553218] ? page_fault_oops+0x134/0x170 [154565.553223] ? snprintf+0x49/0x70 [154565.553229] ? exc_page_fault+0x62/0x150 [154565.553238] ? asm_exc_page_fault+0x22/0x30 Check for sp being non NULL before freeing any associated memory Fixes: a4239945b8ad ("scsi: qla2xxx: Add switch command to simplify fabric discovery") Cc: stable(a)vger.kernel.org Signed-off-by: Anil Gurumurthy <agurumurthy(a)marvell.com> Signed-off-by: Nilesh Javali <njavali(a)marvell.com> Reviewed-by: Himanshu Madhani <hmadhani2024(a)gmail.com> Link: https://patch.msgid.link/20251210101604.431868-10-njavali@marvell.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/scsi/qla2xxx/qla_gs.c | 34 ++++++++++++++++++---------------- 1 file changed, 18 insertions(+), 16 deletions(-) diff --git a/drivers/scsi/qla2xxx/qla_gs.c b/drivers/scsi/qla2xxx/qla_gs.c index d2bddca7045a..c09229b7c516 100644 --- a/drivers/scsi/qla2xxx/qla_gs.c +++ b/drivers/scsi/qla2xxx/qla_gs.c @@ -3791,23 +3791,25 @@ int qla_fab_async_scan(scsi_qla_host_t *vha, srb_t *sp) return rval; done_free_sp: - if (sp->u.iocb_cmd.u.ctarg.req) { - dma_free_coherent(&vha->hw->pdev->dev, - sp->u.iocb_cmd.u.ctarg.req_allocated_size, - sp->u.iocb_cmd.u.ctarg.req, - sp->u.iocb_cmd.u.ctarg.req_dma); - sp->u.iocb_cmd.u.ctarg.req = NULL; - } - if (sp->u.iocb_cmd.u.ctarg.rsp) { - dma_free_coherent(&vha->hw->pdev->dev, - sp->u.iocb_cmd.u.ctarg.rsp_allocated_size, - sp->u.iocb_cmd.u.ctarg.rsp, - sp->u.iocb_cmd.u.ctarg.rsp_dma); - sp->u.iocb_cmd.u.ctarg.rsp = NULL; - } + if (sp) { + if (sp->u.iocb_cmd.u.ctarg.req) { + dma_free_coherent(&vha->hw->pdev->dev, + sp->u.iocb_cmd.u.ctarg.req_allocated_size, + sp->u.iocb_cmd.u.ctarg.req, + sp->u.iocb_cmd.u.ctarg.req_dma); + sp->u.iocb_cmd.u.ctarg.req = NULL; + } + if (sp->u.iocb_cmd.u.ctarg.rsp) { + dma_free_coherent(&vha->hw->pdev->dev, + sp->u.iocb_cmd.u.ctarg.rsp_allocated_size, + sp->u.iocb_cmd.u.ctarg.rsp, + sp->u.iocb_cmd.u.ctarg.rsp_dma); + sp->u.iocb_cmd.u.ctarg.rsp = NULL; + } - /* ref: INIT */ - kref_put(&sp->cmd_kref, qla2x00_sp_release); + /* ref: INIT */ + kref_put(&sp->cmd_kref, qla2x00_sp_release); + } spin_lock_irqsave(&vha->work_lock, flags); vha->scan.scan_flags &= ~SF_SCANNING; -- 2.39.2

2 1

[PATCH OLK-6.6] dcache: Limit the minimal number of bucket to two
by Zhihao Cheng 02 Mar '26

02 Mar '26

mailist inclusion category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13644 Reference: https://lore.kernel.org/linux-fsdevel/20260130034853.215819-1-chengzhihao1@… -------------------------------- There is an OOB read problem on dentry_hashtable when user sets 'dhash_entries=1': BUG: unable to handle page fault for address: ffff888b30b774b0 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page Oops: Oops: 0000 [#1] SMP PTI RIP: 0010:__d_lookup+0x56/0x120 Call Trace: d_lookup.cold+0x16/0x5d lookup_dcache+0x27/0xf0 lookup_one_qstr_excl+0x2a/0x180 start_dirop+0x55/0xa0 simple_start_creating+0x8d/0xa0 debugfs_start_creating+0x8c/0x180 debugfs_create_dir+0x1d/0x1c0 pinctrl_init+0x6d/0x140 do_one_initcall+0x6d/0x3d0 kernel_init_freeable+0x39f/0x460 kernel_init+0x2a/0x260 There will be only one bucket in dentry_hashtable when dhash_entries is set as one, and d_hash_shift is calculated as 32 by dcache_init(). Then, following process will access more than one buckets(which memory region is not allocated) in dentry_hashtable: d_lookup b = d_hash(hash) dentry_hashtable + ((u32)hashlen >> d_hash_shift) // The C standard defines the behavior of right shift amounts // exceeding the bit width of the operand as undefined. The // result of '(u32)hashlen >> d_hash_shift' becomes 'hashlen', // so 'b' will point to an unallocated memory region. hlist_bl_for_each_entry_rcu(b) hlist_bl_first_rcu(head) h->first // read OOB! Fix it by limiting the minimal number of dentry_hashtable bucket to two, so that 'd_hash_shift' won't exceeds the bit width of type u32. Fixes: ceb5bdc2d246 ("fs: dcache per-bucket dcache hash locking") Cc: stable(a)vger.kernel.org Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> --- fs/dcache.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/dcache.c b/fs/dcache.c index e0f476c567b0..ea0154f81497 100644 --- a/fs/dcache.c +++ b/fs/dcache.c @@ -3394,7 +3394,7 @@ static void __init dcache_init_early(void) HASH_EARLY | HASH_ZERO, &d_hash_shift, NULL, - 0, + 2, 0); d_hash_shift = 32 - d_hash_shift; } @@ -3422,7 +3422,7 @@ static void __init dcache_init(void) HASH_ZERO, &d_hash_shift, NULL, - 0, + 2, 0); d_hash_shift = 32 - d_hash_shift; } -- 2.52.0

2 1

[PATCH OLK-5.10] dcache: Limit the minimal number of bucket to two
by Zhihao Cheng 02 Mar '26

02 Mar '26

mailist inclusion category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13644 Reference: https://lore.kernel.org/linux-fsdevel/20260130034853.215819-1-chengzhihao1@… -------------------------------- There is an OOB read problem on dentry_hashtable when user sets 'dhash_entries=1': BUG: unable to handle page fault for address: ffff888b30b774b0 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page Oops: Oops: 0000 [#1] SMP PTI RIP: 0010:__d_lookup+0x56/0x120 Call Trace: d_lookup.cold+0x16/0x5d lookup_dcache+0x27/0xf0 lookup_one_qstr_excl+0x2a/0x180 start_dirop+0x55/0xa0 simple_start_creating+0x8d/0xa0 debugfs_start_creating+0x8c/0x180 debugfs_create_dir+0x1d/0x1c0 pinctrl_init+0x6d/0x140 do_one_initcall+0x6d/0x3d0 kernel_init_freeable+0x39f/0x460 kernel_init+0x2a/0x260 There will be only one bucket in dentry_hashtable when dhash_entries is set as one, and d_hash_shift is calculated as 32 by dcache_init(). Then, following process will access more than one buckets(which memory region is not allocated) in dentry_hashtable: d_lookup b = d_hash(hash) dentry_hashtable + ((u32)hashlen >> d_hash_shift) // The C standard defines the behavior of right shift amounts // exceeding the bit width of the operand as undefined. The // result of '(u32)hashlen >> d_hash_shift' becomes 'hashlen', // so 'b' will point to an unallocated memory region. hlist_bl_for_each_entry_rcu(b) hlist_bl_first_rcu(head) h->first // read OOB! Fix it by limiting the minimal number of dentry_hashtable bucket to two, so that 'd_hash_shift' won't exceeds the bit width of type u32. Fixes: ceb5bdc2d246 ("fs: dcache per-bucket dcache hash locking") Cc: stable(a)vger.kernel.org Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> --- fs/dcache.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/dcache.c b/fs/dcache.c index a316a1b2e144..72b6e6e968cf 100644 --- a/fs/dcache.c +++ b/fs/dcache.c @@ -3270,7 +3270,7 @@ static void __init dcache_init_early(void) HASH_EARLY | HASH_ZERO, &d_hash_shift, NULL, - 0, + 2, 0); d_hash_shift = 32 - d_hash_shift; } @@ -3298,7 +3298,7 @@ static void __init dcache_init(void) HASH_ZERO, &d_hash_shift, NULL, - 0, + 2, 0); d_hash_shift = 32 - d_hash_shift; } -- 2.52.0

2 1

[PATCH OLK-6.6 00/13] HiSock Enhancement
by Pu Lehui 28 Feb '26

28 Feb '26

Liu Jian (1): cgroup: make cgroup_bpf_prog_attach work when cgroup2 is not mounted Pu Lehui (12): bpf: Add BPF_HISOCK_INGRESS attach type bpf: Add bpf_set_ingress_dst kfunc bpf: Add bpf_set_ingress/egress_dev kfunc bpf: Add bpf_get_skb_ethhdr kfunc bpf: Add bpf_handle_ingress/egress_ptype kfunc bpf: Apply BPF_HISOCK_INGRESS to hisock ingress bpf: Only deploy hisock in server bpf: Add multi port parse to hisock_cmd bpf: Add target comm parse to hisock_cmd bpf: Add ipv4-mapped ipv6 addr support for hisock bpf: Add local connect support for hisock bpf: Deprecate hisock unused kfuncs and orig ingress logic include/linux/cgroup.h | 1 + include/linux/filter.h | 24 ++ include/linux/netdevice.h | 4 + include/net/xdp.h | 5 - include/uapi/linux/bpf.h | 2 +- kernel/bpf/cgroup.c | 8 +- kernel/bpf/syscall.c | 33 ++- kernel/bpf/verifier.c | 47 ++++ kernel/cgroup/cgroup.c | 22 ++ net/Kconfig | 1 + net/core/dev.c | 54 +++-- net/core/filter.c | 201 +++++++++++----- net/ipv4/ip_output.c | 31 +-- samples/bpf/hisock/bpf.c | 395 ++++++++++++++++++++++++-------- samples/bpf/hisock/hisock_cmd.c | 198 +++++++++++----- tools/include/uapi/linux/bpf.h | 2 +- tools/lib/bpf/libbpf.c | 4 +- 17 files changed, 750 insertions(+), 282 deletions(-) -- 2.34.1

2 14

[PATCH OLK-5.10 00/13] HiSock Enhancement
by Pu Lehui 28 Feb '26

28 Feb '26

Pu Lehui (12): bpf: Add BPF_HISOCK_INGRESS attach type bpf: Add bpf_set_ingress_dst helper function bpf: Add bpf_get_skb_ethhdr helper function bpf: Add bpf_set_ingress/egress_dev helper function bpf: Add bpf_handle_ingress/egress_ptype helper function bpf: Apply BPF_HISOCK_INGRESS to hisock ingress bpf: Only deploy hisock in server bpf: Add multi port parse to hisock_cmd bpf: Add target comm parse to hisock_cmd bpf: Add ipv4-mapped ipv6 addr support for hisock bpf: Add local connect support for hisock bpf: Deprecate hisock unused helpers and orig ingress logic Vladimir Oltean (1): net: move the ptype_all and ptype_base declarations to include/linux/netdevice.h arch/arm64/include/asm/insn.h | 4 - arch/arm64/kernel/insn.c | 8 - arch/arm64/net/bpf_jit.h | 15 -- arch/arm64/net/bpf_jit_comp.c | 266 ---------------------- include/linux/filter.h | 27 ++- include/linux/netdevice.h | 7 + include/net/xdp.h | 5 - include/uapi/linux/bpf.h | 51 +++-- kernel/bpf/core.c | 7 - kernel/bpf/helpers.c | 27 --- kernel/bpf/syscall.c | 33 ++- kernel/bpf/verifier.c | 25 -- net/Kconfig | 1 + net/core/dev.c | 53 +++-- net/core/filter.c | 322 +++++++++++++++++--------- net/core/net-procfs.c | 3 - net/ipv4/ip_output.c | 31 +-- samples/bpf/hisock/bpf.c | 391 ++++++++++++++++++++++++-------- samples/bpf/hisock/hisock_cmd.c | 198 +++++++++++----- tools/bpf/bpftool/common.c | 1 + tools/include/uapi/linux/bpf.h | 53 +++-- tools/lib/bpf/libbpf.c | 4 +- 22 files changed, 803 insertions(+), 729 deletions(-) -- 2.34.1

2 14

[PATCH OLK-6.6 0/2] Fix CVE-2026-23205
by Zizhi Wo 28 Feb '26

28 Feb '26

Fix CVE-2026-23205 ChenXiaoSong (1): smb/client: fix memory leak in smb2_open_file() Paulo Alcantara (1): smb: client: fix potential UAF and double free in smb2_open_file() fs/smb/client/smb2file.c | 3 +++ 1 file changed, 3 insertions(+) -- 2.39.2

2 3

[PATCH OLK-5.10] nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec
by Zizhi Wo 28 Feb '26

28 Feb '26

From: YunJe Shin <yjshin0438(a)gmail.com> stable inclusion from stable-v5.10.250 commit 043b4307a99f902697349128fde93b2ddde4686c category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13660 CVE: CVE-2026-23112 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 52a0a98549344ca20ad81a4176d68d28e3c05a5c ] nvmet_tcp_build_pdu_iovec() could walk past cmd->req.sg when a PDU length or offset exceeds sg_cnt and then use bogus sg->length/offset values, leading to _copy_to_iter() GPF/KASAN. Guard sg_idx, remaining entries, and sg->length/offset before building the bvec. Fixes: 872d26a391da ("nvmet-tcp: add NVMe over TCP target driver") Signed-off-by: YunJe Shin <ioerts(a)kookmin.ac.kr> Reviewed-by: Sagi Grimberg <sagi(a)grimberg.me> Reviewed-by: Joonkyo Jung <joonkyoj(a)yonsei.ac.kr> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/nvme/target/tcp.c [Due to commit 5bfaba275ae6 ("nvmet-tcp: don't map pages which can't come from HIGHMEM") not been merged, which is not related to this patch.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- drivers/nvme/target/tcp.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c index da2f9c9e0a6d..a470ffb93f66 100644 --- a/drivers/nvme/target/tcp.c +++ b/drivers/nvme/target/tcp.c @@ -286,6 +286,8 @@ static int nvmet_tcp_check_ddgst(struct nvmet_tcp_queue *queue, void *pdu) return 0; } +static void nvmet_tcp_fatal_error(struct nvmet_tcp_queue *queue); + static void nvmet_tcp_unmap_pdu_iovec(struct nvmet_tcp_cmd *cmd) { struct scatterlist *sg; @@ -302,22 +304,38 @@ static void nvmet_tcp_map_pdu_iovec(struct nvmet_tcp_cmd *cmd) struct kvec *iov = cmd->iov; struct scatterlist *sg; u32 length, offset, sg_offset; + unsigned int sg_remaining; length = cmd->pdu_len; cmd->nr_mapped = DIV_ROUND_UP(length, PAGE_SIZE); offset = cmd->rbytes_done; cmd->sg_idx = offset / PAGE_SIZE; sg_offset = offset % PAGE_SIZE; + if (!cmd->req.sg_cnt || cmd->sg_idx >= cmd->req.sg_cnt) { + nvmet_tcp_fatal_error(cmd->queue); + return; + } sg = &cmd->req.sg[cmd->sg_idx]; + sg_remaining = cmd->req.sg_cnt - cmd->sg_idx; while (length) { u32 iov_len = min_t(u32, length, sg->length - sg_offset); + if (!sg_remaining) { + nvmet_tcp_fatal_error(cmd->queue); + return; + } + if (!sg->length || sg->length <= sg_offset) { + nvmet_tcp_fatal_error(cmd->queue); + return; + } + iov->iov_base = kmap(sg_page(sg)) + sg->offset + sg_offset; iov->iov_len = iov_len; length -= iov_len; sg = sg_next(sg); + sg_remaining--; iov++; sg_offset = 0; } -- 2.39.2

2 1

[PATCH OLK-6.6] ksmbd: add chann_lock to protect ksmbd_chann_list xarray
by Long Li 28 Feb '26

28 Feb '26

From: Namjae Jeon <linkinjeon(a)kernel.org> stable inclusion from stable-v6.18.10 commit e4a8a96a93d08570e0405cfd989a8a07e5b6ff33 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13791 CVE: CVE-2026-23226 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 4f3a06cc57976cafa8c6f716646be6c79a99e485 upstream. ksmbd_chann_list xarray lacks synchronization, allowing use-after-free in multi-channel sessions (between lookup_chann_list() and ksmbd_chann_del). Adds rw_semaphore chann_lock to struct ksmbd_session and protects all xa_load/xa_store/xa_erase accesses. Cc: stable(a)vger.kernel.org Reported-by: Igor Stepansky <igor.stepansky(a)orca.security> Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/smb/server/smb2pdu.c [Context conflicts] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/smb/server/mgmt/user_session.c | 5 +++++ fs/smb/server/mgmt/user_session.h | 1 + fs/smb/server/smb2pdu.c | 12 +++++++++++- 3 files changed, 17 insertions(+), 1 deletion(-) diff --git a/fs/smb/server/mgmt/user_session.c b/fs/smb/server/mgmt/user_session.c index 123e00c0ee3a..6cde4acb84b8 100644 --- a/fs/smb/server/mgmt/user_session.c +++ b/fs/smb/server/mgmt/user_session.c @@ -32,12 +32,14 @@ static void free_channel_list(struct ksmbd_session *sess) struct channel *chann; unsigned long index; + down_write(&sess->chann_lock); xa_for_each(&sess->ksmbd_chann_list, index, chann) { xa_erase(&sess->ksmbd_chann_list, index); kfree(chann); } xa_destroy(&sess->ksmbd_chann_list); + up_write(&sess->chann_lock); } static void __session_rpc_close(struct ksmbd_session *sess, @@ -214,7 +216,9 @@ static int ksmbd_chann_del(struct ksmbd_conn *conn, struct ksmbd_session *sess) { struct channel *chann; + down_write(&sess->chann_lock); chann = xa_erase(&sess->ksmbd_chann_list, (long)conn); + up_write(&sess->chann_lock); if (!chann) return -ENOENT; @@ -446,6 +450,7 @@ static struct ksmbd_session *__session_create(int protocol) rwlock_init(&sess->tree_conns_lock); atomic_set(&sess->refcnt, 2); init_rwsem(&sess->rpc_lock); + init_rwsem(&sess->chann_lock); ret = __init_smb2_session(sess); if (ret) diff --git a/fs/smb/server/mgmt/user_session.h b/fs/smb/server/mgmt/user_session.h index c5749d6ec715..cba7f688f6b5 100644 --- a/fs/smb/server/mgmt/user_session.h +++ b/fs/smb/server/mgmt/user_session.h @@ -49,6 +49,7 @@ struct ksmbd_session { char sess_key[CIFS_KEY_SIZE]; struct hlist_node hlist; + struct rw_semaphore chann_lock; struct xarray ksmbd_chann_list; struct xarray tree_conns; struct ida tree_conn_ida; diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c index 1ec50a9272ea..010f0d777e83 100644 --- a/fs/smb/server/smb2pdu.c +++ b/fs/smb/server/smb2pdu.c @@ -77,7 +77,13 @@ static inline bool check_session_id(struct ksmbd_conn *conn, u64 id) struct channel *lookup_chann_list(struct ksmbd_session *sess, struct ksmbd_conn *conn) { - return xa_load(&sess->ksmbd_chann_list, (long)conn); + struct channel *chann; + + down_read(&sess->chann_lock); + chann = xa_load(&sess->ksmbd_chann_list, (long)conn); + up_read(&sess->chann_lock); + + return chann; } /** @@ -1556,7 +1562,9 @@ static int ntlm_authenticate(struct ksmbd_work *work, return -ENOMEM; chann->conn = conn; + down_write(&sess->chann_lock); xa_store(&sess->ksmbd_chann_list, (long)conn, chann, GFP_KERNEL); + up_write(&sess->chann_lock); } } @@ -1649,7 +1657,9 @@ static int krb5_authenticate(struct ksmbd_work *work, return -ENOMEM; chann->conn = conn; + down_write(&sess->chann_lock); xa_store(&sess->ksmbd_chann_list, (long)conn, chann, GFP_KERNEL); + up_write(&sess->chann_lock); } } -- 2.39.2

2 1

[PATCH OLK-5.10] RDMA/rxe: Fix the failure of ibv_query_device() and ibv_query_device_ex() tests
by Li Xiasong 28 Feb '26

28 Feb '26

From: Zhu Yanjun <yanjun.zhu(a)linux.dev> mainline inclusion from mainline-v6.14 commit 8ce2eb9dfac8743d1c423b86339336a5b6a6069e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13658 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In rdma-core, the following failures appear. " $ ./build/bin/run_tests.py -k device ssssssss....FF........s ====================================================================== FAIL: test_query_device (tests.test_device.DeviceTest.test_query_device) Test ibv_query_device() ---------------------------------------------------------------------- Traceback (most recent call last): File "/home/ubuntu/rdma-core/tests/test_device.py", line 63, in test_query_device self.verify_device_attr(attr, dev) File "/home/ubuntu/rdma-core/tests/test_device.py", line 200, in verify_device_attr assert attr.sys_image_guid != 0 ^^^^^^^^^^^^^^^^^^^^^^^^ AssertionError ====================================================================== FAIL: test_query_device_ex (tests.test_device.DeviceTest.test_query_device_ex) Test ibv_query_device_ex() ---------------------------------------------------------------------- Traceback (most recent call last): File "/home/ubuntu/rdma-core/tests/test_device.py", line 222, in test_query_device_ex self.verify_device_attr(attr_ex.orig_attr, dev) File "/home/ubuntu/rdma-core/tests/test_device.py", line 200, in verify_device_attr assert attr.sys_image_guid != 0 ^^^^^^^^^^^^^^^^^^^^^^^^ AssertionError " The root cause is: before a net device is set with rxe, this net device is used to generate a sys_image_guid. Fixes: 2ac5415022d1 ("RDMA/rxe: Remove the direct link to net_device") Signed-off-by: Zhu Yanjun <yanjun.zhu(a)linux.dev> Link: https://patch.msgid.link/20250302215444.3742072-1-yanjun.zhu@linux.dev Reviewed-by: Daisuke Matsuda <matsuda-daisuke(a)fujitsu.com> Tested-by: Daisuke Matsuda <matsuda-daisuke(a)fujitsu.com> Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Conflicts: drivers/infiniband/sw/rxe/rxe.c [conflicts due to not merge 3225717f6dfa ("RDMA/rxe: Replace red-black trees by xarrays").] Signed-off-by: Li Xiasong <lixiasong1(a)huawei.com> --- drivers/infiniband/sw/rxe/rxe.c | 25 ++++++------------------- 1 file changed, 6 insertions(+), 19 deletions(-) diff --git a/drivers/infiniband/sw/rxe/rxe.c b/drivers/infiniband/sw/rxe/rxe.c index 79740ec28399..3e8ab4563253 100644 --- a/drivers/infiniband/sw/rxe/rxe.c +++ b/drivers/infiniband/sw/rxe/rxe.c @@ -40,10 +40,8 @@ void rxe_dealloc(struct ib_device *ib_dev) } /* initialize rxe device parameters */ -static void rxe_init_device_param(struct rxe_dev *rxe) +static void rxe_init_device_param(struct rxe_dev *rxe, struct net_device *ndev) { - struct net_device *ndev; - rxe->max_inline_data = RXE_MAX_INLINE_DATA; rxe->attr.vendor_id = RXE_VENDOR_ID; @@ -74,15 +72,9 @@ static void rxe_init_device_param(struct rxe_dev *rxe) rxe->attr.max_pkeys = RXE_MAX_PKEYS; rxe->attr.local_ca_ack_delay = RXE_LOCAL_CA_ACK_DELAY; - ndev = rxe_ib_device_get_netdev(&rxe->ib_dev); - if (!ndev) - return; - addrconf_addr_eui48((unsigned char *)&rxe->attr.sys_image_guid, ndev->dev_addr); - dev_put(ndev); - rxe->max_ucontext = RXE_MAX_UCONTEXT; } @@ -115,18 +107,13 @@ static void rxe_init_port_param(struct rxe_port *port) /* initialize port state, note IB convention that HCA ports are always * numbered from 1 */ -static void rxe_init_ports(struct rxe_dev *rxe) +static void rxe_init_ports(struct rxe_dev *rxe, struct net_device *ndev) { struct rxe_port *port = &rxe->port; - struct net_device *ndev; rxe_init_port_param(port); - ndev = rxe_ib_device_get_netdev(&rxe->ib_dev); - if (!ndev) - return; addrconf_addr_eui48((unsigned char *)&port->port_guid, ndev->dev_addr); - dev_put(ndev); spin_lock_init(&port->port_lock); } @@ -210,14 +197,14 @@ static int rxe_init_pools(struct rxe_dev *rxe) } /* initialize rxe device state */ -static int rxe_init(struct rxe_dev *rxe) +static int rxe_init(struct rxe_dev *rxe, struct net_device *ndev) { int err; /* init default device parameters */ - rxe_init_device_param(rxe); + rxe_init_device_param(rxe, ndev); - rxe_init_ports(rxe); + rxe_init_ports(rxe, ndev); err = rxe_init_pools(rxe); if (err) @@ -255,7 +242,7 @@ int rxe_add(struct rxe_dev *rxe, unsigned int mtu, const char *ibdev_name, { int err; - err = rxe_init(rxe); + err = rxe_init(rxe, ndev); if (err) return err; -- 2.34.1

2 1

[PATCH OLK-6.6] ipvlan: Make the addrs_lock be per port
by Li Xiasong 28 Feb '26

28 Feb '26

From: Dmitry Skorodumov <dskr99(a)gmail.com> stable inclusion from stable-v6.6.122 commit 04ba6de6eff61238e5397c14ac26a6578c7735a5 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13636 CVE: CVE-2026-23103 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d3ba32162488283c0a4c5bedd8817aec91748802 ] Make the addrs_lock be per port, not per ipvlan dev. Initial code seems to be written in the assumption, that any address change must occur under RTNL. But it is not so for the case of IPv6. So 1) Introduce per-port addrs_lock. 2) It was needed to fix places where it was forgotten to take lock (ipvlan_open/ipvlan_close) This appears to be a very minor problem though. Since it's highly unlikely that ipvlan_add_addr() will be called on 2 CPU simultaneously. But nevertheless, this could cause: 1) False-negative of ipvlan_addr_busy(): one interface iterated through all port->ipvlans + ipvlan->addrs under some ipvlan spinlock, and another added IP under its own lock. Though this is only possible for IPv6, since looks like only ipvlan_addr6_event() can be called without rtnl_lock. 2) Race since ipvlan_ht_addr_add(port) is called under different ipvlan->addrs_lock locks This should not affect performance, since add/remove IP is a rare situation and spinlock is not taken on fast paths. Fixes: 8230819494b3 ("ipvlan: use per device spinlock to protect addrs list updates") Signed-off-by: Dmitry Skorodumov <skorodumov.dmitry(a)huawei.com> Reviewed-by: Paolo Abeni <pabeni(a)redhat.com> Link: https://patch.msgid.link/20260112142417.4039566-2-skorodumov.dmitry@huawei.… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/net/ipvlan/ipvlan.h drivers/net/ipvlan/ipvlan_main.c [conflicts due to merged 513b49cadd13 ("ipvlan: Introduce local xmit queue for l2e mode")] Signed-off-by: Li Xiasong <lixiasong1(a)huawei.com> --- drivers/net/ipvlan/ipvlan.h | 2 +- drivers/net/ipvlan/ipvlan_core.c | 16 +++++------ drivers/net/ipvlan/ipvlan_main.c | 49 +++++++++++++++++++------------- 3 files changed, 37 insertions(+), 30 deletions(-) diff --git a/drivers/net/ipvlan/ipvlan.h b/drivers/net/ipvlan/ipvlan.h index 4cf12fbe8f62..85a1fc8e1597 100644 --- a/drivers/net/ipvlan/ipvlan.h +++ b/drivers/net/ipvlan/ipvlan.h @@ -74,7 +74,6 @@ struct ipvl_dev { DECLARE_BITMAP(mac_filters, IPVLAN_MAC_FILTER_SIZE); netdev_features_t sfeatures; u32 msg_enable; - spinlock_t addrs_lock; #if IS_ENABLED(CONFIG_IPVLAN_L2E) int local_packets_cached; unsigned long local_timeout; @@ -101,6 +100,7 @@ struct ipvl_port { struct net_device *dev; possible_net_t pnet; struct hlist_head hlhead[IPVLAN_HASH_SIZE]; + spinlock_t addrs_lock; /* guards hash-table and addrs */ struct list_head ipvlans; u16 mode; u16 flags; diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c index 65da4c23f528..802b90919304 100644 --- a/drivers/net/ipvlan/ipvlan_core.c +++ b/drivers/net/ipvlan/ipvlan_core.c @@ -104,17 +104,15 @@ void ipvlan_ht_addr_del(struct ipvl_addr *addr) struct ipvl_addr *ipvlan_find_addr(const struct ipvl_dev *ipvlan, const void *iaddr, bool is_v6) { - struct ipvl_addr *addr, *ret = NULL; + struct ipvl_addr *addr; - rcu_read_lock(); - list_for_each_entry_rcu(addr, &ipvlan->addrs, anode) { - if (addr_equal(is_v6, addr, iaddr)) { - ret = addr; - break; - } + assert_spin_locked(&ipvlan->port->addrs_lock); + + list_for_each_entry(addr, &ipvlan->addrs, anode) { + if (addr_equal(is_v6, addr, iaddr)) + return addr; } - rcu_read_unlock(); - return ret; + return NULL; } bool ipvlan_addr_busy(struct ipvl_port *port, void *iaddr, bool is_v6) diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c index 3870d7b2b652..ab56bebe2de7 100644 --- a/drivers/net/ipvlan/ipvlan_main.c +++ b/drivers/net/ipvlan/ipvlan_main.c @@ -128,6 +128,7 @@ static int ipvlan_port_create(struct net_device *dev) for (idx = 0; idx < IPVLAN_HASH_SIZE; idx++) INIT_HLIST_HEAD(&port->hlhead[idx]); + spin_lock_init(&port->addrs_lock); skb_queue_head_init(&port->backlog); INIT_WORK(&port->wq, ipvlan_process_multicast); ida_init(&port->ida); @@ -261,6 +262,7 @@ static void ipvlan_uninit(struct net_device *dev) static int ipvlan_open(struct net_device *dev) { struct ipvl_dev *ipvlan = netdev_priv(dev); + struct ipvl_port *port = ipvlan->port; struct ipvl_addr *addr; if (ipvlan->port->mode == IPVLAN_MODE_L3 || @@ -272,10 +274,10 @@ static int ipvlan_open(struct net_device *dev) #if IS_ENABLED(CONFIG_IPVLAN_L2E) ipvlan_local_init(dev); #endif - rcu_read_lock(); - list_for_each_entry_rcu(addr, &ipvlan->addrs, anode) + spin_lock_bh(&port->addrs_lock); + list_for_each_entry(addr, &ipvlan->addrs, anode) ipvlan_ht_addr_add(ipvlan, addr); - rcu_read_unlock(); + spin_unlock_bh(&port->addrs_lock); return 0; } @@ -291,10 +293,10 @@ static int ipvlan_stop(struct net_device *dev) #if IS_ENABLED(CONFIG_IPVLAN_L2E) ipvlan_local_uninit(dev); #endif - rcu_read_lock(); - list_for_each_entry_rcu(addr, &ipvlan->addrs, anode) + spin_lock_bh(&ipvlan->port->addrs_lock); + list_for_each_entry(addr, &ipvlan->addrs, anode) ipvlan_ht_addr_del(addr); - rcu_read_unlock(); + spin_unlock_bh(&ipvlan->port->addrs_lock); return 0; } @@ -665,7 +667,6 @@ int ipvlan_link_new(struct net *src_net, struct net_device *dev, if (!tb[IFLA_MTU]) ipvlan_adjust_mtu(ipvlan, phy_dev); INIT_LIST_HEAD(&ipvlan->addrs); - spin_lock_init(&ipvlan->addrs_lock); /* TODO Probably put random address here to be presented to the * world but keep using the physical-dev address for the outgoing @@ -743,13 +744,13 @@ void ipvlan_link_delete(struct net_device *dev, struct list_head *head) struct ipvl_dev *ipvlan = netdev_priv(dev); struct ipvl_addr *addr, *next; - spin_lock_bh(&ipvlan->addrs_lock); + spin_lock_bh(&ipvlan->port->addrs_lock); list_for_each_entry_safe(addr, next, &ipvlan->addrs, anode) { ipvlan_ht_addr_del(addr); list_del_rcu(&addr->anode); kfree_rcu(addr, rcu); } - spin_unlock_bh(&ipvlan->addrs_lock); + spin_unlock_bh(&ipvlan->port->addrs_lock); ida_simple_remove(&ipvlan->port->ida, dev->dev_id); list_del_rcu(&ipvlan->pnode); @@ -896,6 +897,8 @@ static int ipvlan_add_addr(struct ipvl_dev *ipvlan, void *iaddr, bool is_v6) { struct ipvl_addr *addr; + assert_spin_locked(&ipvlan->port->addrs_lock); + addr = kzalloc(sizeof(struct ipvl_addr), GFP_ATOMIC); if (!addr) return -ENOMEM; @@ -926,16 +929,16 @@ static void ipvlan_del_addr(struct ipvl_dev *ipvlan, void *iaddr, bool is_v6) { struct ipvl_addr *addr; - spin_lock_bh(&ipvlan->addrs_lock); + spin_lock_bh(&ipvlan->port->addrs_lock); addr = ipvlan_find_addr(ipvlan, iaddr, is_v6); if (!addr) { - spin_unlock_bh(&ipvlan->addrs_lock); + spin_unlock_bh(&ipvlan->port->addrs_lock); return; } ipvlan_ht_addr_del(addr); list_del_rcu(&addr->anode); - spin_unlock_bh(&ipvlan->addrs_lock); + spin_unlock_bh(&ipvlan->port->addrs_lock); kfree_rcu(addr, rcu); } @@ -957,14 +960,14 @@ static int ipvlan_add_addr6(struct ipvl_dev *ipvlan, struct in6_addr *ip6_addr) { int ret = -EINVAL; - spin_lock_bh(&ipvlan->addrs_lock); + spin_lock_bh(&ipvlan->port->addrs_lock); if (ipvlan_addr_busy(ipvlan->port, ip6_addr, true)) netif_err(ipvlan, ifup, ipvlan->dev, "Failed to add IPv6=%pI6c addr for %s intf\n", ip6_addr, ipvlan->dev->name); else ret = ipvlan_add_addr(ipvlan, ip6_addr, true); - spin_unlock_bh(&ipvlan->addrs_lock); + spin_unlock_bh(&ipvlan->port->addrs_lock); return ret; } @@ -1003,21 +1006,24 @@ static int ipvlan_addr6_validator_event(struct notifier_block *unused, struct in6_validator_info *i6vi = (struct in6_validator_info *)ptr; struct net_device *dev = (struct net_device *)i6vi->i6vi_dev->dev; struct ipvl_dev *ipvlan = netdev_priv(dev); + int ret = NOTIFY_OK; if (!ipvlan_is_valid_dev(dev)) return NOTIFY_DONE; switch (event) { case NETDEV_UP: + spin_lock_bh(&ipvlan->port->addrs_lock); if (ipvlan_addr_busy(ipvlan->port, &i6vi->i6vi_addr, true)) { NL_SET_ERR_MSG(i6vi->extack, "Address already assigned to an ipvlan device"); - return notifier_from_errno(-EADDRINUSE); + ret = notifier_from_errno(-EADDRINUSE); } + spin_unlock_bh(&ipvlan->port->addrs_lock); break; } - return NOTIFY_OK; + return ret; } #endif @@ -1025,14 +1031,14 @@ static int ipvlan_add_addr4(struct ipvl_dev *ipvlan, struct in_addr *ip4_addr) { int ret = -EINVAL; - spin_lock_bh(&ipvlan->addrs_lock); + spin_lock_bh(&ipvlan->port->addrs_lock); if (ipvlan_addr_busy(ipvlan->port, ip4_addr, false)) netif_err(ipvlan, ifup, ipvlan->dev, "Failed to add IPv4=%pI4 on %s intf.\n", ip4_addr, ipvlan->dev->name); else ret = ipvlan_add_addr(ipvlan, ip4_addr, false); - spin_unlock_bh(&ipvlan->addrs_lock); + spin_unlock_bh(&ipvlan->port->addrs_lock); return ret; } @@ -1074,21 +1080,24 @@ static int ipvlan_addr4_validator_event(struct notifier_block *unused, struct in_validator_info *ivi = (struct in_validator_info *)ptr; struct net_device *dev = (struct net_device *)ivi->ivi_dev->dev; struct ipvl_dev *ipvlan = netdev_priv(dev); + int ret = NOTIFY_OK; if (!ipvlan_is_valid_dev(dev)) return NOTIFY_DONE; switch (event) { case NETDEV_UP: + spin_lock_bh(&ipvlan->port->addrs_lock); if (ipvlan_addr_busy(ipvlan->port, &ivi->ivi_addr, false)) { NL_SET_ERR_MSG(ivi->extack, "Address already assigned to an ipvlan device"); - return notifier_from_errno(-EADDRINUSE); + ret = notifier_from_errno(-EADDRINUSE); } + spin_unlock_bh(&ipvlan->port->addrs_lock); break; } - return NOTIFY_OK; + return ret; } static struct notifier_block ipvlan_addr4_notifier_block __read_mostly = { -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] net/sched: Reserve TC_H_INGRESS (TC_H_CLSACT) for ingress (clsact) Qdiscs
by Dong Chenchen 28 Feb '26

28 Feb '26

From: Peilin Ye <peilin.ye(a)bytedance.com> mainline inclusion from mainline-v6.4-rc5 commit f85fa45d4a9408d98c46c8fa45ba2e3b2f4bf219 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICMJHK Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Currently it is possible to add e.g. an HTB Qdisc under ffff:fff1 (TC_H_INGRESS, TC_H_CLSACT): $ ip link add name ifb0 type ifb $ tc qdisc add dev ifb0 parent ffff:fff1 htb $ tc qdisc add dev ifb0 clsact Error: Exclusivity flag on, cannot modify. $ drgn ... >>> ifb0 = netdev_get_by_name(prog, "ifb0") >>> qdisc = ifb0.ingress_queue.qdisc_sleeping >>> print(qdisc.ops.id.string_().decode()) htb >>> qdisc.flags.value_() # TCQ_F_INGRESS 2 Only allow ingress and clsact Qdiscs under ffff:fff1. Return -EINVAL for everything else. Make TCQ_F_INGRESS a static flag of ingress and clsact Qdiscs. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Fixes: 1f211a1b929c ("net, sched: add clsact qdisc") Tested-by: Pedro Tammela <pctammela(a)mojatatu.com> Acked-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Reviewed-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Reviewed-by: Vlad Buslov <vladbu(a)nvidia.com> Signed-off-by: Peilin Ye <peilin.ye(a)bytedance.com> Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/sched/sch_api.c [commit 8ecc7c8a1c16 is not backport] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/sched/sch_api.c | 7 ++++++- net/sched/sch_ingress.c | 4 ++-- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c index 2ea9e7753cb0..51f987df0ac7 100644 --- a/net/sched/sch_api.c +++ b/net/sched/sch_api.c @@ -1145,7 +1145,12 @@ static struct Qdisc *qdisc_create(struct net_device *dev, sch->parent = parent; if (handle == TC_H_INGRESS) { - sch->flags |= TCQ_F_INGRESS; + if (!(sch->flags & TCQ_F_INGRESS)) { + NL_SET_ERR_MSG(extack, + "Specified parent ID is reserved for ingress and clsact Qdiscs"); + err = -EINVAL; + goto err_out3; + } handle = TC_H_MAKE(TC_H_INGRESS, 0); lockdep_set_class(qdisc_lock(sch), &qdisc_rx_lock); } else { diff --git a/net/sched/sch_ingress.c b/net/sched/sch_ingress.c index ce3f55259d0d..238dacf41c22 100644 --- a/net/sched/sch_ingress.c +++ b/net/sched/sch_ingress.c @@ -130,7 +130,7 @@ static struct Qdisc_ops ingress_qdisc_ops __read_mostly = { .cl_ops = &ingress_class_ops, .id = "ingress", .priv_size = sizeof(struct ingress_sched_data), - .static_flags = TCQ_F_CPUSTATS, + .static_flags = TCQ_F_INGRESS | TCQ_F_CPUSTATS, .init = ingress_init, .destroy = ingress_destroy, .dump = ingress_dump, @@ -262,7 +262,7 @@ static struct Qdisc_ops clsact_qdisc_ops __read_mostly = { .cl_ops = &clsact_class_ops, .id = "clsact", .priv_size = sizeof(struct clsact_sched_data), - .static_flags = TCQ_F_CPUSTATS, + .static_flags = TCQ_F_INGRESS | TCQ_F_CPUSTATS, .init = clsact_init, .destroy = clsact_destroy, .dump = ingress_dump, -- 2.25.1

2 1

[PATCH OLK-6.6 0/2] CVE-2026-23096
by Wang Tao 28 Feb '26

28 Feb '26

CVE-2026-23096 Wang Tao (1): Revert "uacce: fix for cdev memory leak" Wenkai Lin (1): uacce: fix cdev handling in the cleanup path drivers/misc/uacce/uacce.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure
by Chen Jinghuang 28 Feb '26

28 Feb '26

hulk inclusion category: perf bugzilla: https://atomgit.com/openeuler/kernel/issues/8555 -------------------------------- Implement fast load balancing with steal-task mechanism within the LLC domain; if task pulling fails, fall back to the native newidle_balance mechanism on LLC and upper scheduling domains. This optimization prioritizes task scheduling within the LLC domain to improve cache hit rate, while mitigating system load imbalance issues. Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- kernel/sched/fair.c | 21 +++++++++++++++++++-- kernel/sched/features.h | 1 + 2 files changed, 20 insertions(+), 2 deletions(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index e60f19cb0fee..a4592d35da8b 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -5236,6 +5236,11 @@ static inline bool steal_enabled(void) return sched_feat(STEAL) && allow; } +static inline bool steal_fail_ni_enabled(void) +{ + return sched_feat(STEAL_FAIL_NI); +} + static void overload_clear(struct rq *rq) { struct sparsemask *overload_cpus; @@ -5275,6 +5280,7 @@ static int try_steal(struct rq *this_rq, struct rq_flags *rf); static inline int try_steal(struct rq *this_rq, struct rq_flags *rf) { return 0; } static inline void overload_clear(struct rq *rq) {} static inline void overload_set(struct rq *rq) {} +static inline bool steal_fail_ni_enabled(void) { return false; } #endif #else /* CONFIG_SMP */ @@ -10343,9 +10349,15 @@ done: __maybe_unused; */ rq_idle_stamp_update(rq); - new_tasks = newidle_balance(rq, rf); - if (new_tasks == 0) + if (steal_fail_ni_enabled()) { new_tasks = try_steal(rq, rf); + if (new_tasks == 0) + new_tasks = newidle_balance(rq, rf); + } else { + new_tasks = newidle_balance(rq, rf); + if (new_tasks == 0) + new_tasks = try_steal(rq, rf); + } schedstat_end_time(rq, time); if (new_tasks) @@ -14313,6 +14325,11 @@ static int newidle_balance(struct rq *this_rq, struct rq_flags *rf) int continue_balancing = 1; u64 domain_cost; + if (steal_fail_ni_enabled()) { + if (sd->flags & SD_SHARE_PKG_RESOURCES) + continue; + } + update_next_balance(sd, &next_balance); if (this_rq->avg_idle < curr_cost + sd->max_newidle_lb_cost) diff --git a/kernel/sched/features.h b/kernel/sched/features.h index 1f665fbf0137..52ea0097c513 100644 --- a/kernel/sched/features.h +++ b/kernel/sched/features.h @@ -63,6 +63,7 @@ SCHED_FEAT(SIS_UTIL, true) * Improves CPU utilization. */ SCHED_FEAT(STEAL, false) +SCHED_FEAT(STEAL_FAIL_NI, false) #endif #ifdef CONFIG_SCHED_PARAL -- 2.33.0

2 1

[PATCH v8 0/5] arm64/riscv: Add support for crashkernel CMA reservation
by Jinjie Ruan 28 Feb '26

28 Feb '26

The crash memory allocation, and the exclude of crashk_res, crashk_low_res and crashk_cma memory are almost identical across different architectures, This patch set handle them in crash core in a general way, which eliminate a lot of duplication code. And add support for crashkernel CMA reservation for arm64 and riscv. Rebased on v7.0-rc1. Basic second kernel boot test were performed on QEMU platforms for x86, ARM64, and RISC-V architectures with the following parameters: "cma=256M crashkernel=256M crashkernel=64M,cma" Changes in v8: - Fix the build issues reported by kernel test robot and Sourabh. - Link to v7: https://lore.kernel.org/all/20260226130437.1867658-1-ruanjinjie@huawei.com/ Changes in v7: - Correct the inclusion of CMA-reserved ranges for kdump kernel in of/kexec for arm64 and riscv. - Add Acked-by. - Link to v6: https://lore.kernel.org/all/20260224085342.387996-1-ruanjinjie@huawei.com/ Changes in v6: - Update the crash core exclude code as Mike suggested. - Rebased on v7.0-rc1. - Add acked-by. - Link to v5: https://lore.kernel.org/all/20260212101001.343158-1-ruanjinjie@huawei.com/ Changes in v5: - Fix the kernel test robot build warnings. - Sort crash memory ranges before preparing elfcorehdr for powerpc - Link to v4: https://lore.kernel.org/all/20260209095931.2813152-1-ruanjinjie@huawei.com/ Changes in v4: - Move the size calculation (and the realloc if needed) into the generic crash. - Link to v3: https://lore.kernel.org/all/20260204093728.1447527-1-ruanjinjie@huawei.com/ Jinjie Ruan (4): crash: Exclude crash kernel memory in crash core crash: Use crash_exclude_core_ranges() on powerpc arm64: kexec: Add support for crashkernel CMA reservation riscv: kexec: Add support for crashkernel CMA reservation Sourabh Jain (1): powerpc/crash: sort crash memory ranges before preparing elfcorehdr .../admin-guide/kernel-parameters.txt | 16 +-- arch/arm64/kernel/machine_kexec_file.c | 39 +++---- arch/arm64/mm/init.c | 5 +- arch/loongarch/kernel/machine_kexec_file.c | 39 +++---- arch/powerpc/include/asm/kexec_ranges.h | 1 - arch/powerpc/kexec/crash.c | 5 +- arch/powerpc/kexec/ranges.c | 101 +----------------- arch/riscv/kernel/machine_kexec_file.c | 38 +++---- arch/riscv/mm/init.c | 5 +- arch/x86/kernel/crash.c | 89 +++------------ drivers/of/fdt.c | 9 +- drivers/of/kexec.c | 9 ++ include/linux/crash_core.h | 9 ++ kernel/crash_core.c | 89 ++++++++++++++- 14 files changed, 178 insertions(+), 276 deletions(-) -- 2.34.1

1 5

[PATCH OLK-6.6] sched/fair: Prefer steal within LLC and fallback to newidle_balance
by Chen Jinghuang 28 Feb '26

28 Feb '26

hulk inclusion category: perf bugzilla: https://atomgit.com/openeuler/kernel/issues/8555 -------------------------------- Implement fast load balancing with steal-task mechanism within the LLC domain; if task pulling fails, fall back to the native newidle_balance mechanism on LLC and upper scheduling domains. This optimization prioritizes task scheduling within the LLC domain to improve cache hit rate, while mitigating system load imbalance issues. Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- kernel/sched/fair.c | 15 +++++++++++++-- kernel/sched/features.h | 1 + 2 files changed, 14 insertions(+), 2 deletions(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index e60f19cb0fee..fd37f7648c86 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -10343,9 +10343,15 @@ done: __maybe_unused; */ rq_idle_stamp_update(rq); - new_tasks = newidle_balance(rq, rf); - if (new_tasks == 0) + if (sched_feat(STEAL_FAIL_NI)) { new_tasks = try_steal(rq, rf); + if (new_tasks == 0) + new_tasks = newidle_balance(rq, rf); + } else { + new_tasks = newidle_balance(rq, rf); + if (new_tasks == 0) + new_tasks = try_steal(rq, rf); + } schedstat_end_time(rq, time); if (new_tasks) @@ -14313,6 +14319,11 @@ static int newidle_balance(struct rq *this_rq, struct rq_flags *rf) int continue_balancing = 1; u64 domain_cost; + if (sched_feat(STEAL_FAIL_NI)) { + if (sd->flags & SD_SHARE_PKG_RESOURCES) + continue; + } + update_next_balance(sd, &next_balance); if (this_rq->avg_idle < curr_cost + sd->max_newidle_lb_cost) diff --git a/kernel/sched/features.h b/kernel/sched/features.h index 1f665fbf0137..52ea0097c513 100644 --- a/kernel/sched/features.h +++ b/kernel/sched/features.h @@ -63,6 +63,7 @@ SCHED_FEAT(SIS_UTIL, true) * Improves CPU utilization. */ SCHED_FEAT(STEAL, false) +SCHED_FEAT(STEAL_FAIL_NI, false) #endif #ifdef CONFIG_SCHED_PARAL -- 2.34.1

2 1

[PATCH OLK-6.6] sched/fair: Prefer steal within LLC and fallback to newidle_balance
by Chen Jinghuang 28 Feb '26

28 Feb '26

Offering: HULK hulk inclusion category: perf bugzilla: https://atomgit.com/openeuler/kernel/issues/8555 -------------------------------- Implement fast load balancing with steal-task mechanism within the LLC domain; if task pulling fails, fall back to the native newidle_balance mechanism on LLC and upper scheduling domains. This optimization prioritizes task scheduling within the LLC domain to improve cache hit rate, while mitigating system load imbalance issues. Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- kernel/sched/fair.c | 15 +++++++++++++-- kernel/sched/features.h | 1 + 2 files changed, 14 insertions(+), 2 deletions(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index e60f19cb0fee..fd37f7648c86 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -10343,9 +10343,15 @@ done: __maybe_unused; */ rq_idle_stamp_update(rq); - new_tasks = newidle_balance(rq, rf); - if (new_tasks == 0) + if (sched_feat(STEAL_FAIL_NI)) { new_tasks = try_steal(rq, rf); + if (new_tasks == 0) + new_tasks = newidle_balance(rq, rf); + } else { + new_tasks = newidle_balance(rq, rf); + if (new_tasks == 0) + new_tasks = try_steal(rq, rf); + } schedstat_end_time(rq, time); if (new_tasks) @@ -14313,6 +14319,11 @@ static int newidle_balance(struct rq *this_rq, struct rq_flags *rf) int continue_balancing = 1; u64 domain_cost; + if (sched_feat(STEAL_FAIL_NI)) { + if (sd->flags & SD_SHARE_PKG_RESOURCES) + continue; + } + update_next_balance(sd, &next_balance); if (this_rq->avg_idle < curr_cost + sd->max_newidle_lb_cost) diff --git a/kernel/sched/features.h b/kernel/sched/features.h index 1f665fbf0137..52ea0097c513 100644 --- a/kernel/sched/features.h +++ b/kernel/sched/features.h @@ -63,6 +63,7 @@ SCHED_FEAT(SIS_UTIL, true) * Improves CPU utilization. */ SCHED_FEAT(STEAL, false) +SCHED_FEAT(STEAL_FAIL_NI, false) #endif #ifdef CONFIG_SCHED_PARAL -- 2.34.1

2 1

[PATCH OLK-6.6] [Huawei] sched/fair: Prefer steal within LLC and fallback to newidle_balance
by Chen Jinghuang 28 Feb '26

28 Feb '26

Offering: HULK hulk inclusion category: perf bugzilla: https://atomgit.com/openeuler/kernel/issues/8555 -------------------------------- Implement fast load balancing with steal-task mechanism within the LLC domain; if task pulling fails, fall back to the native newidle_balance mechanism on LLC and upper scheduling domains. This optimization prioritizes task scheduling within the LLC domain to improve cache hit rate, while mitigating system load imbalance issues. Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- kernel/sched/fair.c | 15 +++++++++++++-- kernel/sched/features.h | 1 + 2 files changed, 14 insertions(+), 2 deletions(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index e60f19cb0fee..fd37f7648c86 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -10343,9 +10343,15 @@ done: __maybe_unused; */ rq_idle_stamp_update(rq); - new_tasks = newidle_balance(rq, rf); - if (new_tasks == 0) + if (sched_feat(STEAL_FAIL_NI)) { new_tasks = try_steal(rq, rf); + if (new_tasks == 0) + new_tasks = newidle_balance(rq, rf); + } else { + new_tasks = newidle_balance(rq, rf); + if (new_tasks == 0) + new_tasks = try_steal(rq, rf); + } schedstat_end_time(rq, time); if (new_tasks) @@ -14313,6 +14319,11 @@ static int newidle_balance(struct rq *this_rq, struct rq_flags *rf) int continue_balancing = 1; u64 domain_cost; + if (sched_feat(STEAL_FAIL_NI)) { + if (sd->flags & SD_SHARE_PKG_RESOURCES) + continue; + } + update_next_balance(sd, &next_balance); if (this_rq->avg_idle < curr_cost + sd->max_newidle_lb_cost) diff --git a/kernel/sched/features.h b/kernel/sched/features.h index 1f665fbf0137..52ea0097c513 100644 --- a/kernel/sched/features.h +++ b/kernel/sched/features.h @@ -63,6 +63,7 @@ SCHED_FEAT(SIS_UTIL, true) * Improves CPU utilization. */ SCHED_FEAT(STEAL, false) +SCHED_FEAT(STEAL_FAIL_NI, false) #endif #ifdef CONFIG_SCHED_PARAL -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] CVE-2026-23163
by Hongtao Zhang 28 Feb '26

28 Feb '26

*** BLURB HERE *** Jon Doron (1): [Backport] drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove Philip Yang (1): [Backport] drm/amdkfd: Don't use sw fault filter if retry cam enabled drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) -- 2.43.0

2 3

[PATCH OLK-6.6] sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure
by Chen Jinghuang 27 Feb '26

27 Feb '26

Offering: HULK hulk inclusion category: perf bugzilla: https://atomgit.com/openeuler/kernel/issues/8555 -------------------------------- Implement fast load balancing with steal-task mechanism within the LLC domain; if task pulling fails, fall back to the native newidle_balance mechanism on LLC and upper scheduling domains. This optimization prioritizes task scheduling within the LLC domain to improve cache hit rate, while mitigating system load imbalance issues. Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- kernel/sched/fair.c | 21 +++++++++++++++++++-- kernel/sched/features.h | 1 + 2 files changed, 20 insertions(+), 2 deletions(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index e60f19cb0fee..a4592d35da8b 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -5236,6 +5236,11 @@ static inline bool steal_enabled(void) return sched_feat(STEAL) && allow; } +static inline bool steal_fail_ni_enabled(void) +{ + return sched_feat(STEAL_FAIL_NI); +} + static void overload_clear(struct rq *rq) { struct sparsemask *overload_cpus; @@ -5275,6 +5280,7 @@ static int try_steal(struct rq *this_rq, struct rq_flags *rf); static inline int try_steal(struct rq *this_rq, struct rq_flags *rf) { return 0; } static inline void overload_clear(struct rq *rq) {} static inline void overload_set(struct rq *rq) {} +static inline bool steal_fail_ni_enabled(void) { return false; } #endif #else /* CONFIG_SMP */ @@ -10343,9 +10349,15 @@ done: __maybe_unused; */ rq_idle_stamp_update(rq); - new_tasks = newidle_balance(rq, rf); - if (new_tasks == 0) + if (steal_fail_ni_enabled()) { new_tasks = try_steal(rq, rf); + if (new_tasks == 0) + new_tasks = newidle_balance(rq, rf); + } else { + new_tasks = newidle_balance(rq, rf); + if (new_tasks == 0) + new_tasks = try_steal(rq, rf); + } schedstat_end_time(rq, time); if (new_tasks) @@ -14313,6 +14325,11 @@ static int newidle_balance(struct rq *this_rq, struct rq_flags *rf) int continue_balancing = 1; u64 domain_cost; + if (steal_fail_ni_enabled()) { + if (sd->flags & SD_SHARE_PKG_RESOURCES) + continue; + } + update_next_balance(sd, &next_balance); if (this_rq->avg_idle < curr_cost + sd->max_newidle_lb_cost) diff --git a/kernel/sched/features.h b/kernel/sched/features.h index 1f665fbf0137..52ea0097c513 100644 --- a/kernel/sched/features.h +++ b/kernel/sched/features.h @@ -63,6 +63,7 @@ SCHED_FEAT(SIS_UTIL, true) * Improves CPU utilization. */ SCHED_FEAT(STEAL, false) +SCHED_FEAT(STEAL_FAIL_NI, false) #endif #ifdef CONFIG_SCHED_PARAL -- 2.33.0

2 1

[PATCH openEuler-1.0-LTS v5 0/9] support apei_page_offline_policy
by Qi Xi 27 Feb '26

27 Feb '26

Changes in v5: Change sysctl_apei_page_offline_policy bit0 to enable/disable driver notification. Backport some patches that have been merged. Since CONFIG_UCE_KERNEL_RECOVERY depends on CONFIG_ARM64, remove the redundant condition in migrate_page(). Changes in v4: Fix typo errors and backport bugfix for mc_copy. Changes in v3: Use bool rather than int as the return type of apei_page_should_offline(). Drop the PF_UCE_KERNEL_RECOVERY flag after soft-offlining the page. Changes in v2: Add a new sysctl_apei_page_offline_policy, instead of changing soft_offline_page. Jiaqi Yan (1): mm/memory-failure: userspace controls soft-offlining pages Kyle Meyer (1): mm/memory-failure: support disabling soft offline for HugeTLB pages Qi Xi (3): Revert "mm/memory-failure: support disabling soft offline for HugeTLB pages" Revert "arm64: mm: Add copy mc support for migrate_page" apei/ghes: Add sysctl interface to control soft-offline page isolation Wupeng Ma (3): uce: add copy_mc_highpage{s} arm64: mm: Add copy mc support for migrate_page arm64: mm: Add copy mc support for migrate_page Yongjian Sun (1): ext4: fix e4b bitmap inconsistency reports drivers/acpi/apei/ghes.c | 77 ++++++++++++++++++++++++++++++++++++++++ fs/ext4/mballoc.c | 21 +++++------ include/linux/highmem.h | 55 ++++++++++++++++++++++++++++ include/linux/mm.h | 7 ++++ kernel/sysctl.c | 21 +++++++++++ mm/memory-failure.c | 20 +++++++++-- mm/migrate.c | 58 ++++++++++++++++++++++++++++-- 7 files changed, 244 insertions(+), 15 deletions(-) -- 2.33.0

2 10

[PATCH OLK-6.6] ASoC: amd: fix memory leak in acp3x pdm dma ops
by Zhang Yuwei 27 Feb '26

27 Feb '26

From: Chris Bainbridge <chris.bainbridge(a)gmail.com> mainline inclusion from mainline-v6.19 commit 7f67ba5413f98d93116a756e7f17cd2c1d6c2bd6 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13747 CVE: CVE-2026-23190 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Fixes: 4a767b1d039a8 ("ASoC: amd: add acp3x pdm driver dma ops") Signed-off-by: Chris Bainbridge <chris.bainbridge(a)gmail.com> Link: https://patch.msgid.link/20260202205034.7697-1-chris.bainbridge@gmail.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> --- sound/soc/amd/renoir/acp3x-pdm-dma.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sound/soc/amd/renoir/acp3x-pdm-dma.c b/sound/soc/amd/renoir/acp3x-pdm-dma.c index c3b47e9bd239..39223ff37b14 100644 --- a/sound/soc/amd/renoir/acp3x-pdm-dma.c +++ b/sound/soc/amd/renoir/acp3x-pdm-dma.c @@ -301,9 +301,11 @@ static int acp_pdm_dma_close(struct snd_soc_component *component, struct snd_pcm_substream *substream) { struct pdm_dev_data *adata = dev_get_drvdata(component->dev); + struct pdm_stream_instance *rtd = substream->runtime->private_data; disable_pdm_interrupts(adata->acp_base); adata->capture_stream = NULL; + kfree(rtd); return 0; } -- 2.22.0

2 1

[PATCH OLK-6.6] [Huawei] sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure
by Chen Jinghuang 27 Feb '26

27 Feb '26

Offering: HULK hulk inclusion category: perf bugzilla: https://atomgit.com/openeuler/kernel/issues/8555 -------------------------------- Implement fast load balancing with steal-task mechanism within the LLC domain; if task pulling fails, fall back to the native newidle_balance mechanism on LLC and upper scheduling domains. This optimization prioritizes task scheduling within the LLC domain to improve cache hit rate, while mitigating system load imbalance issues. Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- kernel/sched/fair.c | 15 +++++++++++++-- kernel/sched/features.h | 1 + 2 files changed, 14 insertions(+), 2 deletions(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index e60f19cb0fee..fd37f7648c86 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -10343,9 +10343,15 @@ done: __maybe_unused; */ rq_idle_stamp_update(rq); - new_tasks = newidle_balance(rq, rf); - if (new_tasks == 0) + if (sched_feat(STEAL_FAIL_NI)) { new_tasks = try_steal(rq, rf); + if (new_tasks == 0) + new_tasks = newidle_balance(rq, rf); + } else { + new_tasks = newidle_balance(rq, rf); + if (new_tasks == 0) + new_tasks = try_steal(rq, rf); + } schedstat_end_time(rq, time); if (new_tasks) @@ -14313,6 +14319,11 @@ static int newidle_balance(struct rq *this_rq, struct rq_flags *rf) int continue_balancing = 1; u64 domain_cost; + if (sched_feat(STEAL_FAIL_NI)) { + if (sd->flags & SD_SHARE_PKG_RESOURCES) + continue; + } + update_next_balance(sd, &next_balance); if (this_rq->avg_idle < curr_cost + sd->max_newidle_lb_cost) diff --git a/kernel/sched/features.h b/kernel/sched/features.h index 1f665fbf0137..52ea0097c513 100644 --- a/kernel/sched/features.h +++ b/kernel/sched/features.h @@ -63,6 +63,7 @@ SCHED_FEAT(SIS_UTIL, true) * Improves CPU utilization. */ SCHED_FEAT(STEAL, false) +SCHED_FEAT(STEAL_FAIL_NI, false) #endif #ifdef CONFIG_SCHED_PARAL -- 2.34.1

3 2

[PATCH OLK-6.6] sched/fair: Prefer steal within LLC and fallback to upper LLC newidle_balance on failure
by Chen Jinghuang 27 Feb '26

27 Feb '26

Offering: HULK hulk inclusion category: perf bugzilla: https://atomgit.com/openeuler/kernel/issues/8555 -------------------------------- Implement fast load balancing with steal-task mechanism within the LLC domain; if task pulling fails, fall back to the native newidle_balance mechanism on LLC and upper scheduling domains. This optimization prioritizes task scheduling within the LLC domain to improve cache hit rate, while mitigating system load imbalance issues. Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- kernel/sched/fair.c | 15 +++++++++++++-- kernel/sched/features.h | 1 + 2 files changed, 14 insertions(+), 2 deletions(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index e60f19cb0fee..fd37f7648c86 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -10343,9 +10343,15 @@ done: __maybe_unused; */ rq_idle_stamp_update(rq); - new_tasks = newidle_balance(rq, rf); - if (new_tasks == 0) + if (sched_feat(STEAL_FAIL_NI)) { new_tasks = try_steal(rq, rf); + if (new_tasks == 0) + new_tasks = newidle_balance(rq, rf); + } else { + new_tasks = newidle_balance(rq, rf); + if (new_tasks == 0) + new_tasks = try_steal(rq, rf); + } schedstat_end_time(rq, time); if (new_tasks) @@ -14313,6 +14319,11 @@ static int newidle_balance(struct rq *this_rq, struct rq_flags *rf) int continue_balancing = 1; u64 domain_cost; + if (sched_feat(STEAL_FAIL_NI)) { + if (sd->flags & SD_SHARE_PKG_RESOURCES) + continue; + } + update_next_balance(sd, &next_balance); if (this_rq->avg_idle < curr_cost + sd->max_newidle_lb_cost) diff --git a/kernel/sched/features.h b/kernel/sched/features.h index 1f665fbf0137..52ea0097c513 100644 --- a/kernel/sched/features.h +++ b/kernel/sched/features.h @@ -63,6 +63,7 @@ SCHED_FEAT(SIS_UTIL, true) * Improves CPU utilization. */ SCHED_FEAT(STEAL, false) +SCHED_FEAT(STEAL_FAIL_NI, false) #endif #ifdef CONFIG_SCHED_PARAL -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] bpf, cpumap: Make sure kthread is running before map update returns
by Pu Lehui 27 Feb '26

27 Feb '26

From: Hou Tao <houtao1(a)huawei.com> mainline inclusion from mainline-v6.5-rc5 commit 640a604585aa30f93e39b17d4d6ba69fcb1e66c9 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/8156 CVE: CVE-2023-53577 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The following warning was reported when running stress-mode enabled xdp_redirect_cpu with some RT threads: ------------[ cut here ]------------ WARNING: CPU: 4 PID: 65 at kernel/bpf/cpumap.c:135 CPU: 4 PID: 65 Comm: kworker/4:1 Not tainted 6.5.0-rc2+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) Workqueue: events cpu_map_kthread_stop RIP: 0010:put_cpu_map_entry+0xda/0x220 ...... Call Trace: <TASK> ? show_regs+0x65/0x70 ? __warn+0xa5/0x240 ...... ? put_cpu_map_entry+0xda/0x220 cpu_map_kthread_stop+0x41/0x60 process_one_work+0x6b0/0xb80 worker_thread+0x96/0x720 kthread+0x1a5/0x1f0 ret_from_fork+0x3a/0x70 ret_from_fork_asm+0x1b/0x30 </TASK> The root cause is the same as commit 436901649731 ("bpf: cpumap: Fix memory leak in cpu_map_update_elem"). The kthread is stopped prematurely by kthread_stop() in cpu_map_kthread_stop(), and kthread() doesn't call cpu_map_kthread_run() at all but XDP program has already queued some frames or skbs into ptr_ring. So when __cpu_map_ring_cleanup() checks the ptr_ring, it will find it was not emptied and report a warning. An alternative fix is to use __cpu_map_ring_cleanup() to drop these pending frames or skbs when kthread_stop() returns -EINTR, but it may confuse the user, because these frames or skbs have been handled correctly by XDP program. So instead of dropping these frames or skbs, just make sure the per-cpu kthread is running before __cpu_map_entry_alloc() returns. After apply the fix, the error handle for kthread_stop() will be unnecessary because it will always return 0, so just remove it. Fixes: 6710e1126934 ("bpf: introduce new bpf cpu map type BPF_MAP_TYPE_CPUMAP") Signed-off-by: Hou Tao <houtao1(a)huawei.com> Reviewed-by: Pu Lehui <pulehui(a)huawei.com> Acked-by: Jesper Dangaard Brouer <hawk(a)kernel.org> Link: https://lore.kernel.org/r/20230729095107.1722450-2-houtao@huaweicloud.com Signed-off-by: Martin KaFai Lau <martin.lau(a)kernel.org> Conflicts: kernel/bpf/cpumap.c [ctx conflicts] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/cpumap.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/kernel/bpf/cpumap.c b/kernel/bpf/cpumap.c index 31faabe4cd26..7d8646688f4e 100644 --- a/kernel/bpf/cpumap.c +++ b/kernel/bpf/cpumap.c @@ -25,6 +25,7 @@ #include <linux/workqueue.h> #include <linux/kthread.h> #include <linux/capability.h> +#include <linux/completion.h> #include <trace/events/xdp.h> #include <linux/netdevice.h> /* netif_receive_skb_core */ @@ -56,6 +57,7 @@ struct bpf_cpu_map_entry { struct ptr_ring *queue; struct task_struct *kthread; struct work_struct kthread_stop_wq; + struct completion kthread_running; atomic_t refcnt; /* Control when this struct can be free'ed */ struct rcu_head rcu; @@ -228,7 +230,6 @@ static void put_cpu_map_entry(struct bpf_cpu_map_entry *rcpu) static void cpu_map_kthread_stop(struct work_struct *work) { struct bpf_cpu_map_entry *rcpu; - int err; rcpu = container_of(work, struct bpf_cpu_map_entry, kthread_stop_wq); @@ -238,20 +239,14 @@ static void cpu_map_kthread_stop(struct work_struct *work) rcu_barrier(); /* kthread_stop will wake_up_process and wait for it to complete */ - err = kthread_stop(rcpu->kthread); - if (err) { - /* kthread_stop may be called before cpu_map_kthread_run - * is executed, so we need to release the memory related - * to rcpu. - */ - put_cpu_map_entry(rcpu); - } + kthread_stop(rcpu->kthread); } static int cpu_map_kthread_run(void *data) { struct bpf_cpu_map_entry *rcpu = data; + complete(&rcpu->kthread_running); set_current_state(TASK_INTERRUPTIBLE); /* When kthread gives stop order, then rcpu have been disconnected @@ -348,6 +343,7 @@ static struct bpf_cpu_map_entry *__cpu_map_entry_alloc(u32 qsize, u32 cpu, rcpu->qsize = qsize; /* Setup kthread */ + init_completion(&rcpu->kthread_running); rcpu->kthread = kthread_create_on_node(cpu_map_kthread_run, rcpu, numa, "cpumap/%d/map:%d", cpu, map_id); if (IS_ERR(rcpu->kthread)) @@ -360,6 +356,12 @@ static struct bpf_cpu_map_entry *__cpu_map_entry_alloc(u32 qsize, u32 cpu, kthread_bind(rcpu->kthread, cpu); wake_up_process(rcpu->kthread); + /* Make sure kthread has been running, so kthread_stop() will not + * stop the kthread prematurely and all pending frames or skbs + * will be handled by the kthread before kthread_stop() returns. + */ + wait_for_completion(&rcpu->kthread_running); + return rcpu; free_ptr_ring: -- 2.34.1

2 1

[PATCH OLK-5.10] bpf, cpumap: Make sure kthread is running before map update returns
by Pu Lehui 27 Feb '26

27 Feb '26

From: Hou Tao <houtao1(a)huawei.com> mainline inclusion from mainline-v6.5-rc5 commit 640a604585aa30f93e39b17d4d6ba69fcb1e66c9 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/8156 CVE: CVE-2023-53577 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The following warning was reported when running stress-mode enabled xdp_redirect_cpu with some RT threads: ------------[ cut here ]------------ WARNING: CPU: 4 PID: 65 at kernel/bpf/cpumap.c:135 CPU: 4 PID: 65 Comm: kworker/4:1 Not tainted 6.5.0-rc2+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) Workqueue: events cpu_map_kthread_stop RIP: 0010:put_cpu_map_entry+0xda/0x220 ...... Call Trace: <TASK> ? show_regs+0x65/0x70 ? __warn+0xa5/0x240 ...... ? put_cpu_map_entry+0xda/0x220 cpu_map_kthread_stop+0x41/0x60 process_one_work+0x6b0/0xb80 worker_thread+0x96/0x720 kthread+0x1a5/0x1f0 ret_from_fork+0x3a/0x70 ret_from_fork_asm+0x1b/0x30 </TASK> The root cause is the same as commit 436901649731 ("bpf: cpumap: Fix memory leak in cpu_map_update_elem"). The kthread is stopped prematurely by kthread_stop() in cpu_map_kthread_stop(), and kthread() doesn't call cpu_map_kthread_run() at all but XDP program has already queued some frames or skbs into ptr_ring. So when __cpu_map_ring_cleanup() checks the ptr_ring, it will find it was not emptied and report a warning. An alternative fix is to use __cpu_map_ring_cleanup() to drop these pending frames or skbs when kthread_stop() returns -EINTR, but it may confuse the user, because these frames or skbs have been handled correctly by XDP program. So instead of dropping these frames or skbs, just make sure the per-cpu kthread is running before __cpu_map_entry_alloc() returns. After apply the fix, the error handle for kthread_stop() will be unnecessary because it will always return 0, so just remove it. Fixes: 6710e1126934 ("bpf: introduce new bpf cpu map type BPF_MAP_TYPE_CPUMAP") Signed-off-by: Hou Tao <houtao1(a)huawei.com> Reviewed-by: Pu Lehui <pulehui(a)huawei.com> Acked-by: Jesper Dangaard Brouer <hawk(a)kernel.org> Link: https://lore.kernel.org/r/20230729095107.1722450-2-houtao@huaweicloud.com Signed-off-by: Martin KaFai Lau <martin.lau(a)kernel.org> Conflicts: kernel/bpf/cpumap.c [ctx conflicts] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/cpumap.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/kernel/bpf/cpumap.c b/kernel/bpf/cpumap.c index 918202cdff16..1c4c2312bf4d 100644 --- a/kernel/bpf/cpumap.c +++ b/kernel/bpf/cpumap.c @@ -25,6 +25,7 @@ #include <linux/workqueue.h> #include <linux/kthread.h> #include <linux/capability.h> +#include <linux/completion.h> #include <trace/events/xdp.h> #include <linux/netdevice.h> /* netif_receive_skb_core */ @@ -69,6 +70,7 @@ struct bpf_cpu_map_entry { struct rcu_head rcu; struct work_struct kthread_stop_wq; + struct completion kthread_running; }; struct bpf_cpu_map { @@ -213,7 +215,6 @@ static void put_cpu_map_entry(struct bpf_cpu_map_entry *rcpu) static void cpu_map_kthread_stop(struct work_struct *work) { struct bpf_cpu_map_entry *rcpu; - int err; rcpu = container_of(work, struct bpf_cpu_map_entry, kthread_stop_wq); @@ -223,14 +224,7 @@ static void cpu_map_kthread_stop(struct work_struct *work) rcu_barrier(); /* kthread_stop will wake_up_process and wait for it to complete */ - err = kthread_stop(rcpu->kthread); - if (err) { - /* kthread_stop may be called before cpu_map_kthread_run - * is executed, so we need to release the memory related - * to rcpu. - */ - put_cpu_map_entry(rcpu); - } + kthread_stop(rcpu->kthread); } static int cpu_map_bpf_prog_run_xdp(struct bpf_cpu_map_entry *rcpu, @@ -308,6 +302,7 @@ static int cpu_map_kthread_run(void *data) { struct bpf_cpu_map_entry *rcpu = data; + complete(&rcpu->kthread_running); set_current_state(TASK_INTERRUPTIBLE); /* When kthread gives stop order, then rcpu have been disconnected @@ -464,6 +459,7 @@ __cpu_map_entry_alloc(struct bpf_map *map, struct bpf_cpumap_val *value, u32 cpu goto free_ptr_ring; /* Setup kthread */ + init_completion(&rcpu->kthread_running); rcpu->kthread = kthread_create_on_node(cpu_map_kthread_run, rcpu, numa, "cpumap/%d/map:%d", cpu, map->id); if (IS_ERR(rcpu->kthread)) @@ -476,6 +472,12 @@ __cpu_map_entry_alloc(struct bpf_map *map, struct bpf_cpumap_val *value, u32 cpu kthread_bind(rcpu->kthread, cpu); wake_up_process(rcpu->kthread); + /* Make sure kthread has been running, so kthread_stop() will not + * stop the kthread prematurely and all pending frames or skbs + * will be handled by the kthread before kthread_stop() returns. + */ + wait_for_completion(&rcpu->kthread_running); + return rcpu; free_prog: -- 2.34.1

2 1

[PATCH OLK-6.6] ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref
by Yongjian Sun 26 Feb '26

26 Feb '26

From: Yang Erkun <yangerkun(a)huawei.com> mainline inclusion from mainline-v6.19-rc6 commit d250bdf531d9cd4096fedbb9f172bb2ca660c868 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13461 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- The error branch for ext4_xattr_inode_update_ref forget to release the refcount for iloc.bh. Find this when review code. Fixes: 57295e835408 ("ext4: guard against EA inode refcount underflow in xattr update") Signed-off-by: Yang Erkun <yangerkun(a)huawei.com> Reviewed-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Link: https://patch.msgid.link/20251213055706.3417529-1-yangerkun@huawei.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Cc: stable(a)kernel.org Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/ext4/xattr.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c index cd906aa08afa..96810af688f5 100644 --- a/fs/ext4/xattr.c +++ b/fs/ext4/xattr.c @@ -1047,6 +1047,7 @@ static int ext4_xattr_inode_update_ref(handle_t *handle, struct inode *ea_inode, ext4_error_inode(ea_inode, __func__, __LINE__, 0, "EA inode %lu ref wraparound: ref_count=%lld ref_change=%d", ea_inode->i_ino, ref_count, ref_change); + brelse(iloc.bh); ret = -EFSCORRUPTED; goto out; } -- 2.39.2

2 1

[PATCH v7 0/5] arm64/riscv: Add support for crashkernel CMA reservation
by Jinjie Ruan 26 Feb '26

26 Feb '26

The crash memory allocation, and the exclude of crashk_res, crashk_low_res and crashk_cma memory are almost identical across different architectures, This patch set handle them in crash core in a general way, which eliminate a lot of duplication code. And add support for crashkernel CMA reservation for arm64 and riscv. Rebased on v7.0-rc1. Basic test were performed on QEMU platforms for x86, ARM64, and RISC-V architectures with the following parameters: "cma=256M crashkernel=256M crashkernel=64M,cma" Changes in v7: - Correct the inclusion of CMA-reserved ranges for kdump kernel in of/kexec for arm64 and riscv. - Add Acked-by. Changes in v6: - Update the crash core exclude code as Mike suggested. - Rebased on v7.0-rc1. - Add acked-by. - Link to v5: https://lore.kernel.org/all/20260212101001.343158-1-ruanjinjie@huawei.com/ Changes in v5: - Fix the kernel test robot build warnings. - Sort crash memory ranges before preparing elfcorehdr for powerpc - Link to v4: https://lore.kernel.org/all/20260209095931.2813152-1-ruanjinjie@huawei.com/ Changes in v4: - Move the size calculation (and the realloc if needed) into the generic crash. - Link to v3: https://lore.kernel.org/all/20260204093728.1447527-1-ruanjinjie@huawei.com/ Jinjie Ruan (4): crash: Exclude crash kernel memory in crash core crash: Use crash_exclude_core_ranges() on powerpc arm64: kexec: Add support for crashkernel CMA reservation riscv: kexec: Add support for crashkernel CMA reservation Sourabh Jain (1): powerpc/crash: sort crash memory ranges before preparing elfcorehdr .../admin-guide/kernel-parameters.txt | 16 +-- arch/arm64/kernel/machine_kexec_file.c | 39 +++---- arch/arm64/mm/init.c | 5 +- arch/loongarch/kernel/machine_kexec_file.c | 39 +++---- arch/powerpc/include/asm/kexec_ranges.h | 4 +- arch/powerpc/kexec/crash.c | 5 +- arch/powerpc/kexec/ranges.c | 101 +----------------- arch/riscv/kernel/machine_kexec_file.c | 38 +++---- arch/riscv/mm/init.c | 5 +- arch/x86/kernel/crash.c | 89 +++------------ drivers/of/kexec.c | 9 ++ include/linux/crash_core.h | 9 ++ kernel/crash_core.c | 89 ++++++++++++++- 13 files changed, 176 insertions(+), 272 deletions(-) -- 2.34.1

1 5

[PATCH OLK-6.6] sched/soft_domain: Increasing NR_MAX_CLUSTER to 32
by Zhang Qiao 25 Feb '26

25 Feb '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8540 -------------------------------- Bumped the maximum number of clusters per node from 16 to 32 to resolve an out-of-bounds/array overflow issue. Fixes: 645a1ba256ef ("sched: topology: Build soft domain for LLC") Signed-off-by: Zhang Qiao <zhangqiao22(a)huawei.com> --- kernel/sched/soft_domain.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/kernel/sched/soft_domain.c b/kernel/sched/soft_domain.c index 3c52680ca82f..7b569fdb2c6e 100644 --- a/kernel/sched/soft_domain.c +++ b/kernel/sched/soft_domain.c @@ -17,6 +17,8 @@ #include <linux/sort.h> +#define NR_MAX_CLUSTER 32 + static DEFINE_STATIC_KEY_TRUE(__soft_domain_switch); static int __init soft_domain_switch_setup(char *str) @@ -50,6 +52,7 @@ static int build_soft_sub_domain(int nid, struct cpumask *cpus) const struct cpumask *span = cpumask_of_node(nid); struct soft_domain *sf_d = NULL; int i; + int cls_cnt = 0; sf_d = kzalloc_node(sizeof(struct soft_domain) + cpumask_size(), GFP_KERNEL, nid); @@ -63,6 +66,12 @@ static int build_soft_sub_domain(int nid, struct cpumask *cpus) for_each_cpu_and(i, span, cpus) { struct soft_subdomain *sub_d = NULL; + cls_cnt++; + if (cls_cnt > NR_MAX_CLUSTER) { + pr_info("clsuter number > %d, unsupport soft domain.\n", NR_MAX_CLUSTER); + return -EINVAL; + } + sub_d = kzalloc_node(sizeof(struct soft_subdomain) + cpumask_size(), GFP_KERNEL, nid); if (!sub_d) { @@ -138,8 +147,6 @@ void build_soft_domain(void) static DEFINE_MUTEX(soft_domain_mutex); -#define NR_MAX_CLUSTER 16 - struct domain_node { struct soft_subdomain *sud_d; unsigned int attached; -- 2.18.0.huawei.25

1 0

[PATCH OLK-6.6] sched/soft_domain: Increasing NR_MAX_CLUSTER to 32
by Zhang Qiao 25 Feb '26

25 Feb '26

hulk inclusion category: bugfix bugzilla: https://gitcode.com/openeuler/kernel/issues/8540 -------------------------------- Bumped the maximum number of clusters per node from 16 to 32 to resolve an out-of-bounds/array overflow issue. Fixes: 645a1ba256ef ("sched: topology: Build soft domain for LLC") Signed-off-by: Zhang Qiao <zhangqiao22(a)huawei.com> --- kernel/sched/soft_domain.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/kernel/sched/soft_domain.c b/kernel/sched/soft_domain.c index 3c52680ca82f..7b569fdb2c6e 100644 --- a/kernel/sched/soft_domain.c +++ b/kernel/sched/soft_domain.c @@ -17,6 +17,8 @@ #include <linux/sort.h> +#define NR_MAX_CLUSTER 32 + static DEFINE_STATIC_KEY_TRUE(__soft_domain_switch); static int __init soft_domain_switch_setup(char *str) @@ -50,6 +52,7 @@ static int build_soft_sub_domain(int nid, struct cpumask *cpus) const struct cpumask *span = cpumask_of_node(nid); struct soft_domain *sf_d = NULL; int i; + int cls_cnt = 0; sf_d = kzalloc_node(sizeof(struct soft_domain) + cpumask_size(), GFP_KERNEL, nid); @@ -63,6 +66,12 @@ static int build_soft_sub_domain(int nid, struct cpumask *cpus) for_each_cpu_and(i, span, cpus) { struct soft_subdomain *sub_d = NULL; + cls_cnt++; + if (cls_cnt > NR_MAX_CLUSTER) { + pr_info("clsuter number > %d, unsupport soft domain.\n", NR_MAX_CLUSTER); + return -EINVAL; + } + sub_d = kzalloc_node(sizeof(struct soft_subdomain) + cpumask_size(), GFP_KERNEL, nid); if (!sub_d) { @@ -138,8 +147,6 @@ void build_soft_domain(void) static DEFINE_MUTEX(soft_domain_mutex); -#define NR_MAX_CLUSTER 16 - struct domain_node { struct soft_subdomain *sud_d; unsigned int attached; -- 2.18.0.huawei.25

1 0

[PATCH openEuler-1.0-LTS] squashfs: fix memory leak in squashfs_fill_super
by Long Li 25 Feb '26

25 Feb '26

From: Phillip Lougher <phillip(a)squashfs.org.uk> stable inclusion from stable-v5.10.240 commit 9bdb2e7f9b11a1c9bb7096d5726fe5a738fa5d73 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/9383 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit b64700d41bdc4e9f82f1346c15a3678ebb91a89c upstream. If sb_min_blocksize returns 0, squashfs_fill_super exits without freeing allocated memory (sb->s_fs_info). Fix this by moving the call to sb_min_blocksize to before memory is allocated. Link: https://lkml.kernel.org/r/20250811223740.110392-1-phillip@squashfs.org.uk Fixes: 734aa85390ea ("Squashfs: check return result of sb_min_blocksize") Signed-off-by: Phillip Lougher <phillip(a)squashfs.org.uk> Reported-by: Scott GUO <scottzhguo(a)tencent.com> Closes: https://lore.kernel.org/all/20250811061921.3807353-1-scott_gzh@163.com Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/squashfs/super.c [Context conflicts] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/squashfs/super.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/fs/squashfs/super.c b/fs/squashfs/super.c index 41756ca57ff2..119c0d63dafc 100644 --- a/fs/squashfs/super.c +++ b/fs/squashfs/super.c @@ -85,10 +85,15 @@ static int squashfs_fill_super(struct super_block *sb, void *data, int silent) unsigned short flags; unsigned int fragments; u64 lookup_table_start, xattr_id_table_start, next_table; - int err; + int err, devblksize = sb_min_blocksize(sb, SQUASHFS_DEVBLK_SIZE); TRACE("Entered squashfs_fill_superblock\n"); + if (!devblksize) { + ERROR("squashfs: unable to set blocksize\n"); + return -EINVAL; + } + sb->s_fs_info = kzalloc(sizeof(*msblk), GFP_KERNEL); if (sb->s_fs_info == NULL) { ERROR("Failed to allocate squashfs_sb_info\n"); @@ -96,12 +101,7 @@ static int squashfs_fill_super(struct super_block *sb, void *data, int silent) } msblk = sb->s_fs_info; - msblk->devblksize = sb_min_blocksize(sb, SQUASHFS_DEVBLK_SIZE); - if (!msblk->devblksize) { - ERROR("squashfs: unable to set blocksize\n"); - return -EINVAL; - } - + msblk->devblksize = devblksize; msblk->devblksize_log2 = ffz(~msblk->devblksize); mutex_init(&msblk->meta_index_mutex); -- 2.39.2

2 1

[PATCH OLK-6.6] efivarfs: fix error propagation in efivar_entry_get()
by Yongjian Sun 25 Feb '26

25 Feb '26

From: Kohei Enju <kohei(a)enjuk.jp> mainline inclusion from mainline-v6.19-rc8 commit 4b22ec1685ce1fc0d862dcda3225d852fb107995 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13706 CVE: CVE-2026-23156 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- efivar_entry_get() always returns success even if the underlying __efivar_entry_get() fails, masking errors. This may result in uninitialized heap memory being copied to userspace in the efivarfs_file_read() path. Fix it by returning the error from __efivar_entry_get(). Fixes: 2d82e6227ea1 ("efi: vars: Move efivar caching layer into efivarfs") Cc: <stable(a)vger.kernel.org> # v6.1+ Signed-off-by: Kohei Enju <kohei(a)enjuk.jp> Signed-off-by: Ard Biesheuvel <ardb(a)kernel.org> Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/efivarfs/vars.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/efivarfs/vars.c b/fs/efivarfs/vars.c index 13bc60698955..b10aa5afd7f7 100644 --- a/fs/efivarfs/vars.c +++ b/fs/efivarfs/vars.c @@ -609,7 +609,7 @@ int efivar_entry_get(struct efivar_entry *entry, u32 *attributes, err = __efivar_entry_get(entry, attributes, size, data); efivar_unlock(); - return 0; + return err; } /** -- 2.39.2

2 1

[PATCH OLK-6.6] io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop
by Yongjian Sun 25 Feb '26

25 Feb '26

From: Jens Axboe <axboe(a)kernel.dk> mainline inclusion from mainline-v6.19-rc7 commit 10dc959398175736e495f71c771f8641e1ca1907 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13663 CVE: CVE-2026-23113 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Currently this is checked before running the pending work. Normally this is quite fine, as work items either end up blocking (which will create a new worker for other items), or they complete fairly quickly. But syzbot reports an issue where io-wq takes seemingly forever to exit, and with a bit of debugging, this turns out to be because it queues a bunch of big (2GB - 4096b) reads with a /dev/msr* file. Since this file type doesn't support ->read_iter(), loop_rw_iter() ends up handling them. Each read returns 16MB of data read, which takes 20 (!!) seconds. With a bunch of these pending, processing the whole chain can take a long time. Easily longer than the syzbot uninterruptible sleep timeout of 140 seconds. This then triggers a complaint off the io-wq exit path: INFO: task syz.4.135:6326 blocked for more than 143 seconds. Not tainted syzkaller #0 Blocked by coredump. "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.4.135 state:D stack:26824 pid:6326 tgid:6324 ppid:5957 task_flags:0x400548 flags:0x00080000 Call Trace: <TASK> context_switch kernel/sched/core.c:5256 [inline] __schedule+0x1139/0x6150 kernel/sched/core.c:6863 __schedule_loop kernel/sched/core.c:6945 [inline] schedule+0xe7/0x3a0 kernel/sched/core.c:6960 schedule_timeout+0x257/0x290 kernel/time/sleep_timeout.c:75 do_wait_for_common kernel/sched/completion.c:100 [inline] __wait_for_common+0x2fc/0x4e0 kernel/sched/completion.c:121 io_wq_exit_workers io_uring/io-wq.c:1328 [inline] io_wq_put_and_exit+0x271/0x8a0 io_uring/io-wq.c:1356 io_uring_clean_tctx+0x10d/0x190 io_uring/tctx.c:203 io_uring_cancel_generic+0x69c/0x9a0 io_uring/cancel.c:651 io_uring_files_cancel include/linux/io_uring.h:19 [inline] do_exit+0x2ce/0x2bd0 kernel/exit.c:911 do_group_exit+0xd3/0x2a0 kernel/exit.c:1112 get_signal+0x2671/0x26d0 kernel/signal.c:3034 arch_do_signal_or_restart+0x8f/0x7e0 arch/x86/kernel/signal.c:337 __exit_to_user_mode_loop kernel/entry/common.c:41 [inline] exit_to_user_mode_loop+0x8c/0x540 kernel/entry/common.c:75 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline] do_syscall_64+0x4ee/0xf80 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fa02738f749 RSP: 002b:00007fa0281ae0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 00007fa0275e6098 RCX: 00007fa02738f749 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fa0275e6098 RBP: 00007fa0275e6090 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fa0275e6128 R14: 00007fff14e4fcb0 R15: 00007fff14e4fd98 There's really nothing wrong here, outside of processing these reads will take a LONG time. However, we can speed up the exit by checking the IO_WQ_BIT_EXIT inside the io_worker_handle_work() loop, as syzbot will exit the ring after queueing up all of these reads. Then once the first item is processed, io-wq will simply cancel the rest. That should avoid syzbot running into this complaint again. Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/all/68a2decc.050a0220.e29e5.0099.GAE@google.com/ Reported-by: syzbot+4eb282331cab6d5b6588(a)syzkaller.appspotmail.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- io_uring/io-wq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/io_uring/io-wq.c b/io_uring/io-wq.c index 1c4ef4e4eb52..c848a5018d12 100644 --- a/io_uring/io-wq.c +++ b/io_uring/io-wq.c @@ -554,9 +554,9 @@ static void io_worker_handle_work(struct io_wq_acct *acct, __releases(&acct->lock) { struct io_wq *wq = worker->wq; - bool do_kill = test_bit(IO_WQ_BIT_EXIT, &wq->state); do { + bool do_kill = test_bit(IO_WQ_BIT_EXIT, &wq->state); struct io_wq_work *work; /* -- 2.39.2

2 1

[PATCH OLK-6.6] dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue()
by Zhang Yuwei 25 Feb '26

25 Feb '26

From: Guodong Xu <guodong(a)riscstar.com> mainline inclusion from mainline-v6.19-rc6 commit a143545855bc2c6e1330f6f57ae375ac44af00a7 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13727 CVE: CVE-2025-71221 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Add proper locking in mmp_pdma_residue() to prevent use-after-free when accessing descriptor list and descriptor contents. The race occurs when multiple threads call tx_status() while the tasklet on another CPU is freeing completed descriptors: CPU 0 CPU 1 ----- ----- mmp_pdma_tx_status() mmp_pdma_residue() -> NO LOCK held list_for_each_entry(sw, ..) DMA interrupt dma_do_tasklet() -> spin_lock(&desc_lock) list_move(sw->node, ...) spin_unlock(&desc_lock) | dma_pool_free(sw) <- FREED! -> access sw->desc <- UAF! This issue can be reproduced when running dmatest on the same channel with multiple threads (threads_per_chan > 1). Fix by protecting the chain_running list iteration and descriptor access with the chan->desc_lock spinlock. Signed-off-by: Juan Li <lijuan(a)linux.spacemit.com> Signed-off-by: Guodong Xu <guodong(a)riscstar.com> Link: https://patch.msgid.link/20251216-mmp-pdma-race-v1-1-976a224bb622@riscstar.… Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Conflicts: drivers/dma/mmp_pdma.c [commit 35e40bf761fcb not merged] Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> --- drivers/dma/mmp_pdma.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/dma/mmp_pdma.c b/drivers/dma/mmp_pdma.c index ebdfdcbb4f7a..3a035a31bec5 100644 --- a/drivers/dma/mmp_pdma.c +++ b/drivers/dma/mmp_pdma.c @@ -763,6 +763,7 @@ static unsigned int mmp_pdma_residue(struct mmp_pdma_chan *chan, dma_cookie_t cookie) { struct mmp_pdma_desc_sw *sw; + unsigned long flags; u32 curr, residue = 0; bool passed = false; bool cyclic = chan->cyclic_first != NULL; @@ -779,6 +780,8 @@ static unsigned int mmp_pdma_residue(struct mmp_pdma_chan *chan, else curr = readl(chan->phy->base + DSADR(chan->phy->idx)); + spin_lock_irqsave(&chan->desc_lock, flags); + list_for_each_entry(sw, &chan->chain_running, node) { u32 start, end, len; @@ -822,6 +825,7 @@ static unsigned int mmp_pdma_residue(struct mmp_pdma_chan *chan, continue; if (sw->async_tx.cookie == cookie) { + spin_unlock_irqrestore(&chan->desc_lock, flags); return residue; } else { residue = 0; @@ -829,6 +833,8 @@ static unsigned int mmp_pdma_residue(struct mmp_pdma_chan *chan, } } + spin_unlock_irqrestore(&chan->desc_lock, flags); + /* We should only get here in case of cyclic transactions */ return residue; } -- 2.22.0

2 1

[PATCH OLK-5.10] dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue()
by Zhang Yuwei 25 Feb '26

25 Feb '26

From: Guodong Xu <guodong(a)riscstar.com> mainline inclusion from mainline-v6.19-rc6 commit a143545855bc2c6e1330f6f57ae375ac44af00a7 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13727 CVE: CVE-2025-71221 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Add proper locking in mmp_pdma_residue() to prevent use-after-free when accessing descriptor list and descriptor contents. The race occurs when multiple threads call tx_status() while the tasklet on another CPU is freeing completed descriptors: CPU 0 CPU 1 ----- ----- mmp_pdma_tx_status() mmp_pdma_residue() -> NO LOCK held list_for_each_entry(sw, ..) DMA interrupt dma_do_tasklet() -> spin_lock(&desc_lock) list_move(sw->node, ...) spin_unlock(&desc_lock) | dma_pool_free(sw) <- FREED! -> access sw->desc <- UAF! This issue can be reproduced when running dmatest on the same channel with multiple threads (threads_per_chan > 1). Fix by protecting the chain_running list iteration and descriptor access with the chan->desc_lock spinlock. Signed-off-by: Juan Li <lijuan(a)linux.spacemit.com> Signed-off-by: Guodong Xu <guodong(a)riscstar.com> Link: https://patch.msgid.link/20251216-mmp-pdma-race-v1-1-976a224bb622@riscstar.… Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Conflicts: drivers/dma/mmp_pdma.c [commit 35e40bf761fcb not merged] Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> --- drivers/dma/mmp_pdma.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/dma/mmp_pdma.c b/drivers/dma/mmp_pdma.c index 4eb63f1ad224..c56cb954b392 100644 --- a/drivers/dma/mmp_pdma.c +++ b/drivers/dma/mmp_pdma.c @@ -764,6 +764,7 @@ static unsigned int mmp_pdma_residue(struct mmp_pdma_chan *chan, dma_cookie_t cookie) { struct mmp_pdma_desc_sw *sw; + unsigned long flags; u32 curr, residue = 0; bool passed = false; bool cyclic = chan->cyclic_first != NULL; @@ -780,6 +781,8 @@ static unsigned int mmp_pdma_residue(struct mmp_pdma_chan *chan, else curr = readl(chan->phy->base + DSADR(chan->phy->idx)); + spin_lock_irqsave(&chan->desc_lock, flags); + list_for_each_entry(sw, &chan->chain_running, node) { u32 start, end, len; @@ -823,6 +826,7 @@ static unsigned int mmp_pdma_residue(struct mmp_pdma_chan *chan, continue; if (sw->async_tx.cookie == cookie) { + spin_unlock_irqrestore(&chan->desc_lock, flags); return residue; } else { residue = 0; @@ -830,6 +834,8 @@ static unsigned int mmp_pdma_residue(struct mmp_pdma_chan *chan, } } + spin_unlock_irqrestore(&chan->desc_lock, flags); + /* We should only get here in case of cyclic transactions */ return residue; } -- 2.22.0

2 1

[PATCH] Prefer steal task within LLC and fallback to native newidle_balance on failure
by Chen Jinghuang 25 Feb '26

25 Feb '26

--- kernel/sched/fair.c | 15 +++++++++++++-- kernel/sched/features.h | 1 + 2 files changed, 14 insertions(+), 2 deletions(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index e60f19cb0fee..70ba6ee3c058 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -10343,9 +10343,15 @@ done: __maybe_unused; */ rq_idle_stamp_update(rq); - new_tasks = newidle_balance(rq, rf); - if (new_tasks == 0) + if (sched_feat(STEALPOC)) { new_tasks = try_steal(rq, rf); + if (new_tasks == 0) + new_tasks = newidle_balance(rq, rf); + } else { + new_tasks = newidle_balance(rq, rf); + if (new_tasks == 0) + new_tasks = try_steal(rq, rf); + } schedstat_end_time(rq, time); if (new_tasks) @@ -14313,6 +14319,11 @@ static int newidle_balance(struct rq *this_rq, struct rq_flags *rf) int continue_balancing = 1; u64 domain_cost; + if (sched_feat(STEALPOC)) { + if (sd->flags & SD_SHARE_PKG_RESOURCES) + continue; + } + update_next_balance(sd, &next_balance); if (this_rq->avg_idle < curr_cost + sd->max_newidle_lb_cost) diff --git a/kernel/sched/features.h b/kernel/sched/features.h index 1f665fbf0137..c74329fd86b9 100644 --- a/kernel/sched/features.h +++ b/kernel/sched/features.h @@ -63,6 +63,7 @@ SCHED_FEAT(SIS_UTIL, true) * Improves CPU utilization. */ SCHED_FEAT(STEAL, false) +SCHED_FEAT(STEALPOC, false) #endif #ifdef CONFIG_SCHED_PARAL -- 2.34.1

1 0

[PATCH OLK-6.6 0/2] CVE-2026-23094
by Liu Kai 25 Feb '26

25 Feb '26

CVE-2026-23094 Chenghai Huang (1): uacce: fix isolate sysfs check condition Liu Kai (1): Revert "uacce: fix isolate sysfs check condition" drivers/misc/uacce/uacce.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH OLK-5.10] migrate: correct lock ordering for hugetlb file folios
by Jinjiang Tu 24 Feb '26

24 Feb '26

From: "Matthew Wilcox (Oracle)" <willy(a)infradead.org> stable inclusion from stable-v5.10.249 commit e7396d23f9d5739f56cf9ab430c3a169f5508394 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13630 CVE: CVE-2026-23097 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit b7880cb166ab62c2409046b2347261abf701530e upstream. Syzbot has found a deadlock (analyzed by Lance Yang): 1) Task (5749): Holds folio_lock, then tries to acquire i_mmap_rwsem(read lock). 2) Task (5754): Holds i_mmap_rwsem(write lock), then tries to acquire folio_lock. migrate_pages() -> migrate_hugetlbs() -> unmap_and_move_huge_page() <- Takes folio_lock! -> remove_migration_ptes() -> __rmap_walk_file() -> i_mmap_lock_read() <- Waits for i_mmap_rwsem(read lock)! hugetlbfs_fallocate() -> hugetlbfs_punch_hole() <- Takes i_mmap_rwsem(write lock)! -> hugetlbfs_zero_partial_page() -> filemap_lock_hugetlb_folio() -> filemap_lock_folio() -> __filemap_get_folio <- Waits for folio_lock! The migration path is the one taking locks in the wrong order according to the documentation at the top of mm/rmap.c. So expand the scope of the existing i_mmap_lock to cover the calls to remove_migration_ptes() too. This is (mostly) how it used to be after commit c0d0381ade79. That was removed by 336bf30eb765 for both file & anon hugetlb pages when it should only have been removed for anon hugetlb pages. Link: https://lkml.kernel.org/r/20260109041345.3863089-2-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) <willy(a)infradead.org> Fixes: 336bf30eb765 ("hugetlbfs: fix anon huge page migration race") Reported-by: syzbot+2d9c96466c978346b55f(a)syzkaller.appspotmail.com Link: https://lore.kernel.org/all/68e9715a.050a0220.1186a4.000d.GAE@google.com Debugged-by: Lance Yang <lance.yang(a)linux.dev> Acked-by: David Hildenbrand (Red Hat) <david(a)kernel.org> Acked-by: Zi Yan <ziy(a)nvidia.com> Cc: Alistair Popple <apopple(a)nvidia.com> Cc: Byungchul Park <byungchul(a)sk.com> Cc: Gregory Price <gourry(a)gourry.net> Cc: Jann Horn <jannh(a)google.com> Cc: Joshua Hahn <joshua.hahnjy(a)gmail.com> Cc: Liam Howlett <liam.howlett(a)oracle.com> Cc: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Cc: Matthew Brost <matthew.brost(a)intel.com> Cc: Rakie Kim <rakie.kim(a)sk.com> Cc: Rik van Riel <riel(a)surriel.com> Cc: Vlastimil Babka <vbabka(a)suse.cz> Cc: Ying Huang <ying.huang(a)linux.alibaba.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- mm/migrate.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/mm/migrate.c b/mm/migrate.c index cf8c05ea821e..7dc6846af90e 100644 --- a/mm/migrate.c +++ b/mm/migrate.c @@ -1342,6 +1342,7 @@ static int unmap_and_move_huge_page(new_page_t get_new_page, struct page *new_hpage; struct anon_vma *anon_vma = NULL; struct address_space *mapping = NULL; + enum ttu_flags ttu = TTU_MIGRATION|TTU_IGNORE_MLOCK; /* * Migratability of hugepages depends on architectures and their size. @@ -1389,9 +1390,6 @@ static int unmap_and_move_huge_page(new_page_t get_new_page, goto put_anon; if (page_mapped(hpage)) { - bool mapping_locked = false; - enum ttu_flags ttu = TTU_MIGRATION|TTU_IGNORE_MLOCK; - if (!PageAnon(hpage)) { /* * In shared mappings, try_to_unmap could potentially @@ -1403,15 +1401,11 @@ static int unmap_and_move_huge_page(new_page_t get_new_page, if (unlikely(!mapping)) goto unlock_put_anon; - mapping_locked = true; ttu |= TTU_RMAP_LOCKED; } try_to_unmap(hpage, ttu); page_was_mapped = 1; - - if (mapping_locked) - i_mmap_unlock_write(mapping); } if (!page_mapped(hpage)) @@ -1419,7 +1413,11 @@ static int unmap_and_move_huge_page(new_page_t get_new_page, if (page_was_mapped) remove_migration_ptes(hpage, - rc == MIGRATEPAGE_SUCCESS ? new_hpage : hpage, false); + rc == MIGRATEPAGE_SUCCESS ? new_hpage : hpage, + (ttu & TTU_RMAP_LOCKED) ? true : false); + + if (ttu & TTU_RMAP_LOCKED) + i_mmap_unlock_write(mapping); unlock_put_anon: unlock_page(new_hpage); -- 2.43.0

2 1

[PATCH OLK-6.6] migrate: correct lock ordering for hugetlb file folios
by Jinjiang Tu 24 Feb '26

24 Feb '26

From: "Matthew Wilcox (Oracle)" <willy(a)infradead.org> stable inclusion from stable-v6.6.122 commit 526394af4e8ade89cacd1a9ce2b97712712fcc34 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13630 CVE: CVE-2026-23097 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit b7880cb166ab62c2409046b2347261abf701530e upstream. Syzbot has found a deadlock (analyzed by Lance Yang): 1) Task (5749): Holds folio_lock, then tries to acquire i_mmap_rwsem(read lock). 2) Task (5754): Holds i_mmap_rwsem(write lock), then tries to acquire folio_lock. migrate_pages() -> migrate_hugetlbs() -> unmap_and_move_huge_page() <- Takes folio_lock! -> remove_migration_ptes() -> __rmap_walk_file() -> i_mmap_lock_read() <- Waits for i_mmap_rwsem(read lock)! hugetlbfs_fallocate() -> hugetlbfs_punch_hole() <- Takes i_mmap_rwsem(write lock)! -> hugetlbfs_zero_partial_page() -> filemap_lock_hugetlb_folio() -> filemap_lock_folio() -> __filemap_get_folio <- Waits for folio_lock! The migration path is the one taking locks in the wrong order according to the documentation at the top of mm/rmap.c. So expand the scope of the existing i_mmap_lock to cover the calls to remove_migration_ptes() too. This is (mostly) how it used to be after commit c0d0381ade79. That was removed by 336bf30eb765 for both file & anon hugetlb pages when it should only have been removed for anon hugetlb pages. Link: https://lkml.kernel.org/r/20260109041345.3863089-2-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) <willy(a)infradead.org> Fixes: 336bf30eb765 ("hugetlbfs: fix anon huge page migration race") Reported-by: syzbot+2d9c96466c978346b55f(a)syzkaller.appspotmail.com Link: https://lore.kernel.org/all/68e9715a.050a0220.1186a4.000d.GAE@google.com Debugged-by: Lance Yang <lance.yang(a)linux.dev> Acked-by: David Hildenbrand (Red Hat) <david(a)kernel.org> Acked-by: Zi Yan <ziy(a)nvidia.com> Cc: Alistair Popple <apopple(a)nvidia.com> Cc: Byungchul Park <byungchul(a)sk.com> Cc: Gregory Price <gourry(a)gourry.net> Cc: Jann Horn <jannh(a)google.com> Cc: Joshua Hahn <joshua.hahnjy(a)gmail.com> Cc: Liam Howlett <liam.howlett(a)oracle.com> Cc: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Cc: Matthew Brost <matthew.brost(a)intel.com> Cc: Rakie Kim <rakie.kim(a)sk.com> Cc: Rik van Riel <riel(a)surriel.com> Cc: Vlastimil Babka <vbabka(a)suse.cz> Cc: Ying Huang <ying.huang(a)linux.alibaba.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: mm/migrate.c [Context conflicts due to 3f6171ebb378 ("mm: try skipping pinned page before unmapping in migration").] Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- mm/migrate.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/mm/migrate.c b/mm/migrate.c index 216f45c9570f..2ca451efaaad 100644 --- a/mm/migrate.c +++ b/mm/migrate.c @@ -1438,6 +1438,7 @@ static int unmap_and_move_huge_page(new_folio_t get_new_folio, int page_was_mapped = 0; struct anon_vma *anon_vma = NULL; struct address_space *mapping = NULL; + enum ttu_flags ttu = 0; if (folio_ref_count(src) == 1) { /* page was freed from under us. So we are done. */ @@ -1479,8 +1480,6 @@ static int unmap_and_move_huge_page(new_folio_t get_new_folio, goto put_anon; if (folio_mapped(src)) { - enum ttu_flags ttu = 0; - /* * Racy check folio is pinned, try to avoid unnecessary page * table unmapping and restoring, because the subsequent @@ -1505,9 +1504,6 @@ static int unmap_and_move_huge_page(new_folio_t get_new_folio, try_to_migrate(src, ttu); page_was_mapped = 1; - - if (ttu & TTU_RMAP_LOCKED) - i_mmap_unlock_write(mapping); } if (!folio_mapped(src)) @@ -1515,7 +1511,11 @@ static int unmap_and_move_huge_page(new_folio_t get_new_folio, if (page_was_mapped) remove_migration_ptes(src, - rc == MIGRATEPAGE_SUCCESS ? dst : src, false); + rc == MIGRATEPAGE_SUCCESS ? dst : src, + ttu ? true : false); + + if (ttu & TTU_RMAP_LOCKED) + i_mmap_unlock_write(mapping); unlock_put_anon: folio_unlock(dst); -- 2.43.0

2 1

[PATCH OLK-6.6] libceph: make calc_target() set t->paused, not just clear it
by Jinjiang Tu 24 Feb '26

24 Feb '26

From: Ilya Dryomov <idryomov(a)gmail.com> stable inclusion from stable-v6.6.121 commit 4ebc711b738d139cabe2fc9e7e7749847676a342 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13573 CVE: CVE-2026-23047 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c0fe2994f9a9d0a2ec9e42441ea5ba74b6a16176 upstream. Currently calc_target() clears t->paused if the request shouldn't be paused anymore, but doesn't ever set t->paused even though it's able to determine when the request should be paused. Setting t->paused is left to __submit_request() which is fine for regular requests but doesn't work for linger requests -- since __submit_request() doesn't operate on linger requests, there is nowhere for lreq->t.paused to be set. One consequence of this is that watches don't get reestablished on paused -> unpaused transitions in cases where requests have been paused long enough for the (paused) unwatch request to time out and for the subsequent (re)watch request to enter the paused state. On top of the watch not getting reestablished, rbd_reregister_watch() gets stuck with rbd_dev->watch_mutex held: rbd_register_watch __rbd_register_watch ceph_osdc_watch linger_reg_commit_wait It's waiting for lreq->reg_commit_wait to be completed, but for that to happen the respective request needs to end up on need_resend_linger list and be kicked when requests are unpaused. There is no chance for that if the request in question is never marked paused in the first place. The fact that rbd_dev->watch_mutex remains taken out forever then prevents the image from getting unmapped -- "rbd unmap" would inevitably hang in D state on an attempt to grab the mutex. Cc: stable(a)vger.kernel.org Reported-by: Raphael Zimmer <raphael.zimmer(a)tu-ilmenau.de> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko(a)ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- net/ceph/osd_client.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c index 0b6a8bb0642f..866cef26ce2a 100644 --- a/net/ceph/osd_client.c +++ b/net/ceph/osd_client.c @@ -1611,6 +1611,7 @@ static enum calc_target_result calc_target(struct ceph_osd_client *osdc, struct ceph_pg_pool_info *pi; struct ceph_pg pgid, last_pgid; struct ceph_osds up, acting; + bool should_be_paused; bool is_read = t->flags & CEPH_OSD_FLAG_READ; bool is_write = t->flags & CEPH_OSD_FLAG_WRITE; bool force_resend = false; @@ -1679,10 +1680,16 @@ static enum calc_target_result calc_target(struct ceph_osd_client *osdc, &last_pgid)) force_resend = true; - if (t->paused && !target_should_be_paused(osdc, t, pi)) { - t->paused = false; + should_be_paused = target_should_be_paused(osdc, t, pi); + if (t->paused && !should_be_paused) { unpaused = true; } + if (t->paused != should_be_paused) { + dout("%s t %p paused %d -> %d\n", __func__, t, t->paused, + should_be_paused); + t->paused = should_be_paused; + } + legacy_change = ceph_pg_compare(&t->pgid, &pgid) || ceph_osds_changed(&t->acting, &acting, t->used_replica || any_change); -- 2.43.0

2 1

[PATCH OLK-6.6] smb/server: fix refcount leak in smb2_open()
by Li Lingfeng 24 Feb '26

24 Feb '26

From: ZhangGuoDong <zhangguodong(a)kylinos.cn> stable inclusion from stable-v6.6.124 commit 2456fde2b137703328f1695f60c68fe488d17e36 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13729 CVE: CVE-2025-71223 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f416c556997aa56ec4384c6b6efd6a0e6ac70aa7 ] When ksmbd_vfs_getattr() fails, the reference count of ksmbd_file must be released. Suggested-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: ZhangGuoDong <zhangguodong(a)kylinos.cn> Signed-off-by: ChenXiaoSong <chenxiaosong(a)kylinos.cn> Acked-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/smb/server/smb2pdu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c index 1ec50a9272ea..6ac7efc835de 100644 --- a/fs/smb/server/smb2pdu.c +++ b/fs/smb/server/smb2pdu.c @@ -2986,10 +2986,10 @@ int smb2_open(struct ksmbd_work *work) file_info = FILE_OPENED; rc = ksmbd_vfs_getattr(&fp->filp->f_path, &stat); + ksmbd_put_durable_fd(fp); if (rc) goto err_out2; - ksmbd_put_durable_fd(fp); goto reconnected_fp; } } else if (req_op_level == SMB2_OPLOCK_LEVEL_LEASE) -- 2.52.0

2 1

[PATCH OLK-6.6] smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe()
by Li Lingfeng 24 Feb '26

24 Feb '26

From: ZhangGuoDong <zhangguodong(a)kylinos.cn> stable inclusion from stable-v6.6.124 commit 04dd114b682a4ccaeba2c2bad049c8b50ce740d8 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13726 CVE: CVE-2025-71220 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 7c28f8eef5ac5312794d8a52918076dcd787e53b ] When ksmbd_iov_pin_rsp() fails, we should call ksmbd_session_rpc_close(). Signed-off-by: ZhangGuoDong <zhangguodong(a)kylinos.cn> Signed-off-by: ChenXiaoSong <chenxiaosong(a)kylinos.cn> Acked-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/smb/server/smb2pdu.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/fs/smb/server/smb2pdu.c b/fs/smb/server/smb2pdu.c index 1ec50a9272ea..4fd2d02acacd 100644 --- a/fs/smb/server/smb2pdu.c +++ b/fs/smb/server/smb2pdu.c @@ -2264,7 +2264,7 @@ static noinline int create_smb2_pipe(struct ksmbd_work *work) { struct smb2_create_rsp *rsp; struct smb2_create_req *req; - int id; + int id = -1; int err; char *name; @@ -2321,6 +2321,9 @@ static noinline int create_smb2_pipe(struct ksmbd_work *work) break; } + if (id >= 0) + ksmbd_session_rpc_close(work->sess, id); + if (!IS_ERR(name)) kfree(name); -- 2.52.0

2 1

[PATCH OLK-6.6] smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection()
by Li Lingfeng 24 Feb '26

24 Feb '26

From: Henrique Carvalho <henrique.carvalho(a)suse.com> stable inclusion from stable-v6.6.125 commit 787769c8cc50416af7b8b1a36e6bcd6aaa7680aa category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13789 CVE: CVE-2026-23228 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 77ffbcac4e569566d0092d5f22627dfc0896b553 upstream. On kthread_run() failure in ksmbd_tcp_new_connection(), the transport is freed via free_transport(), which does not decrement active_num_conn, leaking this counter. Replace free_transport() with ksmbd_tcp_disconnect(). Fixes: 0d0d4680db22e ("ksmbd: add max connections parameter") Cc: stable(a)vger.kernel.org Signed-off-by: Henrique Carvalho <henrique.carvalho(a)suse.com> Acked-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/smb/server/transport_tcp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/smb/server/transport_tcp.c b/fs/smb/server/transport_tcp.c index c43a46511428..ee881e8f027f 100644 --- a/fs/smb/server/transport_tcp.c +++ b/fs/smb/server/transport_tcp.c @@ -41,6 +41,7 @@ static struct ksmbd_transport_ops ksmbd_tcp_transport_ops; static void tcp_stop_kthread(struct task_struct *kthread); static struct interface *alloc_iface(char *ifname); +static void ksmbd_tcp_disconnect(struct ksmbd_transport *t); #define KSMBD_TRANS(t) (&(t)->transport) #define TCP_TRANS(t) ((struct tcp_transport *)container_of(t, \ @@ -219,7 +220,7 @@ static int ksmbd_tcp_new_connection(struct socket *client_sk) if (IS_ERR(handler)) { pr_err("cannot start conn thread\n"); rc = PTR_ERR(handler); - free_transport(t); + ksmbd_tcp_disconnect(KSMBD_TRANS(t)); } return rc; -- 2.52.0

2 1

[PATCH OLK-5.10] nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec
by Zizhi Wo 24 Feb '26

24 Feb '26

From: YunJe Shin <yjshin0438(a)gmail.com> stable inclusion from stable-v5.10.250 commit 043b4307a99f902697349128fde93b2ddde4686c category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13660 CVE: CVE-2026-23112 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 52a0a98549344ca20ad81a4176d68d28e3c05a5c ] nvmet_tcp_build_pdu_iovec() could walk past cmd->req.sg when a PDU length or offset exceeds sg_cnt and then use bogus sg->length/offset values, leading to _copy_to_iter() GPF/KASAN. Guard sg_idx, remaining entries, and sg->length/offset before building the bvec. Fixes: 872d26a391da ("nvmet-tcp: add NVMe over TCP target driver") Signed-off-by: YunJe Shin <ioerts(a)kookmin.ac.kr> Reviewed-by: Sagi Grimberg <sagi(a)grimberg.me> Reviewed-by: Joonkyo Jung <joonkyoj(a)yonsei.ac.kr> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/nvme/target/tcp.c [Due to commit 5bfaba275ae6 ("nvmet-tcp: don't map pages which can't come from HIGHMEM") not been merged, which is not related to this patch.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- drivers/nvme/target/tcp.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c index da2f9c9e0a6d..a470ffb93f66 100644 --- a/drivers/nvme/target/tcp.c +++ b/drivers/nvme/target/tcp.c @@ -286,6 +286,8 @@ static int nvmet_tcp_check_ddgst(struct nvmet_tcp_queue *queue, void *pdu) return 0; } +static void nvmet_tcp_fatal_error(struct nvmet_tcp_queue *queue); + static void nvmet_tcp_unmap_pdu_iovec(struct nvmet_tcp_cmd *cmd) { struct scatterlist *sg; @@ -302,22 +304,38 @@ static void nvmet_tcp_map_pdu_iovec(struct nvmet_tcp_cmd *cmd) struct kvec *iov = cmd->iov; struct scatterlist *sg; u32 length, offset, sg_offset; + unsigned int sg_remaining; length = cmd->pdu_len; cmd->nr_mapped = DIV_ROUND_UP(length, PAGE_SIZE); offset = cmd->rbytes_done; cmd->sg_idx = offset / PAGE_SIZE; sg_offset = offset % PAGE_SIZE; + if (!cmd->req.sg_cnt || cmd->sg_idx >= cmd->req.sg_cnt) { + nvmet_tcp_fatal_error(cmd->queue); + return; + } sg = &cmd->req.sg[cmd->sg_idx]; + sg_remaining = cmd->req.sg_cnt - cmd->sg_idx; while (length) { u32 iov_len = min_t(u32, length, sg->length - sg_offset); + if (!sg_remaining) { + nvmet_tcp_fatal_error(cmd->queue); + return; + } + if (!sg->length || sg->length <= sg_offset) { + nvmet_tcp_fatal_error(cmd->queue); + return; + } + iov->iov_base = kmap(sg_page(sg)) + sg->offset + sg_offset; iov->iov_len = iov_len; length -= iov_len; sg = sg_next(sg); + sg_remaining--; iov++; sg_offset = 0; } -- 2.39.2

2 1

[PATCH OLK-6.6] net: hv_netvsc: reject RSS hash key programming without RX indirection table
by Wupeng Ma 24 Feb '26

24 Feb '26

From: Aditya Garg <gargaditya(a)linux.microsoft.com> stable inclusion from stable-v6.6.122 commit 82c9039c8ebb715753a40434df714f865a3aec9c category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13587 CVE: CVE-2026-23054 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d23564955811da493f34412d7de60fa268c8cb50 ] RSS configuration requires a valid RX indirection table. When the device reports a single receive queue, rndis_filter_device_add() does not allocate an indirection table, accepting RSS hash key updates in this state leads to a hang. Fix this by gating netvsc_set_rxfh() on ndc->rx_table_sz and return -EOPNOTSUPP when the table is absent. This aligns set_rxfh with the device capabilities and prevents incorrect behavior. Fixes: 962f3fee83a4 ("netvsc: add ethtool ops to get/set RSS key") Signed-off-by: Aditya Garg <gargaditya(a)linux.microsoft.com> Reviewed-by: Dipayaan Roy <dipayanroy(a)linux.microsoft.com> Reviewed-by: Haiyang Zhang <haiyangz(a)microsoft.com> Link: https://patch.msgid.link/1768212093-1594-1-git-send-email-gargaditya@linux.… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- drivers/net/hyperv/netvsc_drv.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c index aa114240e340d..af001e2e688b2 100644 --- a/drivers/net/hyperv/netvsc_drv.c +++ b/drivers/net/hyperv/netvsc_drv.c @@ -1762,6 +1762,9 @@ static int netvsc_set_rxfh(struct net_device *dev, const u32 *indir, if (hfunc != ETH_RSS_HASH_NO_CHANGE && hfunc != ETH_RSS_HASH_TOP) return -EOPNOTSUPP; + if (!ndc->rx_table_sz) + return -EOPNOTSUPP; + rndis_dev = ndev->extension; if (indir) { for (i = 0; i < ndc->rx_table_sz; i++) -- 2.43.0

2 1

[PATCH OLK-5.10 0/2] ACPI/IORT: Add PMCG platform information for 162001900
by Zeng Heng 24 Feb '26

24 Feb '26

Qinxin Xia (2): arm-smmu-v3: add HIP09A, HIP09B, HIP10C, HIP10CA for 162100602 errata ACPI/IORT: Add PMCG platform information for 162001900 Documentation/arm64/silicon-errata.rst | 6 +++--- drivers/acpi/arm64/iort.c | 4 ++++ drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 8 ++++++++ 3 files changed, 15 insertions(+), 3 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10 0/2] fix CVE-2026-23054
by Wupeng Ma 24 Feb '26

24 Feb '26

fix CVE-2026-23054. Aditya Garg (1): net: hv_netvsc: reject RSS hash key programming without RX indirection table Shradha Gupta (1): hv_netvsc: Allocate rx indirection table size dynamically drivers/net/hyperv/hyperv_net.h | 5 ++++- drivers/net/hyperv/netvsc_drv.c | 13 +++++++++---- drivers/net/hyperv/rndis_filter.c | 28 ++++++++++++++++++++++++---- 3 files changed, 37 insertions(+), 9 deletions(-) -- 2.43.0

2 3

[PATCH OLK-5.10] ACPI/IORT: Add PMCG platform information for 162001900
by Zeng Heng 12 Feb '26

12 Feb '26

From: Qinxin Xia <xiaqinxin(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/7640 ------------------ Some HiSilicon platforms using the same SMMU PMCG with HIP09 and thus suffers the same erratum. List them in the PMCG platform information list without introducing a new SMMU PMCG Model. Update the silicon-errata.rst as well. Fixes: 28396fe25d85 ("Add PMCG platform information for HiSilicon HIP09A") Signed-off-by: Qinxin Xia <xiaqinxin(a)huawei.com> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- Documentation/arm64/silicon-errata.rst | 6 +++--- drivers/acpi/arm64/iort.c | 4 ++++ 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/Documentation/arm64/silicon-errata.rst b/Documentation/arm64/silicon-errata.rst index 65c5c284893c..f8857b6698cc 100644 --- a/Documentation/arm64/silicon-errata.rst +++ b/Documentation/arm64/silicon-errata.rst @@ -147,9 +147,9 @@ stable kernels. +----------------+-----------------+-----------------+-----------------------------+ | Hisilicon | Hip08 SMMU PMCG | #162001800 | N/A | +----------------+-----------------+-----------------+-----------------------------+ -| Hisilicon | Hip{08,09,09A,10| #162001900 | N/A | -| | ,10C,11} | | | -| | SMMU PMCG | | | +| Hisilicon | Hip{08,09,09A, | #162001900 | N/A | +| | 09B,10,10C,10CA,| | | +| | 11} SMMU PMCG | | | +----------------+-----------------+-----------------+-----------------------------+ | Hisilicon | TSV{110,200} | #1980005 | HISILICON_ERRATUM_1980005 | +----------------+-----------------+-----------------+-----------------------------+ diff --git a/drivers/acpi/arm64/iort.c b/drivers/acpi/arm64/iort.c index f3e44b95368a..c8b20e4589a0 100644 --- a/drivers/acpi/arm64/iort.c +++ b/drivers/acpi/arm64/iort.c @@ -1567,11 +1567,15 @@ static struct acpi_platform_list pmcg_plat_info[] __initdata = { "Erratum #162001900", IORT_SMMU_V3_PMCG_HISI_HIP09}, {"HISI ", "HIP09A ", 0, ACPI_SIG_IORT, greater_than_or_equal, "Erratum #162001900", IORT_SMMU_V3_PMCG_HISI_HIP09}, + {"HISI ", "HIP09B ", 0, ACPI_SIG_IORT, greater_than_or_equal, + "Erratum #162001900", IORT_SMMU_V3_PMCG_HISI_HIP09}, /* HiSilicon Hip10/11 Platform uses the same SMMU IP with Hip09 */ {"HISI ", "HIP10 ", 0, ACPI_SIG_IORT, greater_than_or_equal, "Erratum #162001900", IORT_SMMU_V3_PMCG_HISI_HIP09}, {"HISI ", "HIP10C ", 0, ACPI_SIG_IORT, greater_than_or_equal, "Erratum #162001900", IORT_SMMU_V3_PMCG_HISI_HIP09}, + {"HISI ", "HIP10CA ", 0, ACPI_SIG_IORT, greater_than_or_equal, + "Erratum #162001900", IORT_SMMU_V3_PMCG_HISI_HIP09}, {"HISI ", "HIP11 ", 0, ACPI_SIG_IORT, greater_than_or_equal, "Erratum #162001900", IORT_SMMU_V3_PMCG_HISI_HIP09}, { } -- 2.25.1

2 1

[PATCH OLK-5.10] arm-smmu-v3: add HIP09A, HIP09B, HIP10C, HIP10CA for 162100602 errata
by Zeng Heng 12 Feb '26

12 Feb '26

From: Qinxin Xia <xiaqinxin(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/7640 ------------------ Add HIP09A, HIP09B, HIP10C, HIP10CA for 162100602 errata Fixes: c20cd1f88a57 ("iommu/arm-smmu-v3: Change the style to identify the the hisi_platform") Signed-off-by: Qinxin Xia <xiaqinxin(a)huawei.com> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c index e67c1feeca5f..1528661f98dd 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c @@ -5265,8 +5265,16 @@ static struct acpi_platform_list arm_smmu_v3_plat_info[] = { /* HiSilicon Hip09 Platform */ {"HISI ", "HIP09 ", 0, ACPI_SIG_IORT, greater_than_or_equal, "Erratum #162100602", 0}, + {"HISI ", "HIP09A ", 0, ACPI_SIG_IORT, greater_than_or_equal, + "Erratum #162100602", 0}, + {"HISI ", "HIP09B ", 0, ACPI_SIG_IORT, greater_than_or_equal, + "Erratum #162100602", 0}, {"HISI ", "HIP10 ", 0, ACPI_SIG_IORT, greater_than_or_equal, "Erratum #162100602", 0}, + {"HISI ", "HIP10C ", 0, ACPI_SIG_IORT, greater_than_or_equal, + "Erratum #162100602", 0}, + {"HISI ", "HIP10CA ", 0, ACPI_SIG_IORT, greater_than_or_equal, + "Erratum #162100602", 0}, {"HISI ", "HIP11 ", 0, ACPI_SIG_IORT, greater_than_or_equal, "Erratum #162100602", 0}, { } -- 2.25.1

2 1

[PATCH v5 0/4] arm64/riscv: Add support for crashkernel CMA reservation
by Jinjie Ruan 12 Feb '26

12 Feb '26

Exclude crash kernel memory in crash core to avoid duplication. Also move the size calculation (and the realloc if needed) into crash core. And add support for crashkernel CMA reservation for arm64 and riscv. Changes in v5: - Fix the kernel test robot build warnings. - Sort crash memory ranges before preparing elfcorehdr for powerpc - Link to v4: https://lore.kernel.org/all/20260209095931.2813152-1-ruanjinjie@huawei.com/ Changes in v4: - Move the size calculation (and the realloc if needed) into the generic crash. - Link to v3: https://lore.kernel.org/all/20260204093728.1447527-1-ruanjinjie@huawei.com/ Changs in v3: - Exclude crash kernel memory in crash core as Mike suggested. - Add acked-by. Jinjie Ruan (3): crash: Exclude crash kernel memory in crash core arm64: kexec: Add support for crashkernel CMA reservation riscv: kexec: Add support for crashkernel CMA reservation Sourabh Jain (1): powerpc/crash: sort crash memory ranges before preparing elfcorehdr .../admin-guide/kernel-parameters.txt | 16 +-- arch/arm64/include/asm/kexec.h | 9 +- arch/arm64/kernel/machine_kexec_file.c | 43 +++----- arch/arm64/mm/init.c | 5 +- arch/loongarch/include/asm/kexec.h | 9 +- arch/loongarch/kernel/machine_kexec_file.c | 41 +++---- arch/powerpc/include/asm/kexec.h | 13 +++ arch/powerpc/include/asm/kexec_ranges.h | 1 - arch/powerpc/kexec/crash.c | 67 ++++++----- arch/powerpc/kexec/file_load_64.c | 17 +-- arch/powerpc/kexec/ranges.c | 103 +---------------- arch/riscv/include/asm/kexec.h | 9 +- arch/riscv/kernel/machine_kexec_file.c | 39 +++---- arch/riscv/mm/init.c | 5 +- arch/x86/include/asm/kexec.h | 9 ++ arch/x86/kernel/crash.c | 104 ++---------------- include/linux/crash_core.h | 75 ++++++++++++- kernel/crash_core.c | 85 ++++++++++++-- 18 files changed, 314 insertions(+), 336 deletions(-) -- 2.34.1

1 4

[PATCH OLK-6.6] dm: use bio_clone_blkg_association
by Zhihao Cheng 12 Feb '26

12 Feb '26

From: Mikulas Patocka <mpatocka(a)redhat.com> mainline inclusion from mainline-v7.0-rc1 commit 2df8b310bcfe76827fd71092f58a2493ee6590b0 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13467 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The origin bio carries blk-cgroup information which could be set from foreground(task_css(css) - wbc->wb->blkcg_css), so the blkcg won't control buffer io since commit ca522482e3eaf ("dm: pass NULL bdev to bio_alloc_clone"). The synchronous io is still under control by blkcg, because 'bio->bi_blkg' is set by io submitting task which has been added into 'cgroup.procs'. Fix it by using bio_clone_blkg_association when submitting a cloned bio. Link: https://bugzilla.kernel.org/show_bug.cgi?id=220985 Fixes: ca522482e3eaf ("dm: pass NULL bdev to bio_alloc_clone") Reported-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Tested-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> --- drivers/md/dm.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/md/dm.c b/drivers/md/dm.c index 96f050891ec0..670460ade280 100644 --- a/drivers/md/dm.c +++ b/drivers/md/dm.c @@ -1365,6 +1365,8 @@ void dm_submit_bio_remap(struct bio *clone, struct bio *tgt_clone) if (!tgt_clone) tgt_clone = clone; + bio_clone_blkg_association(tgt_clone, io->orig_bio); + /* * Account io->origin_bio to DM dev on behalf of target * that took ownership of IO with DM_MAPIO_SUBMITTED. -- 2.52.0

2 1

[PATCH OLK-6.6] gic: Add hip09 support for HISILICON_ERRATUM_165010801
by Zeng Heng 12 Feb '26

12 Feb '26

From: Yifan Wu <wuyifan50(a)huawei.com> driver inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/7023 ---------------------------------------------------------------------- Add hip09 support for HISILICON_ERRATUM_165010801 Fixes: f0f9be237c22 ("gic: increase the arch_timer priority to avoid hardlockup") Signed-off-by: Yifan Wu <wuyifan50(a)huawei.com> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/arm64/Kconfig | 11 ++++++----- drivers/clocksource/arm_arch_timer.c | 5 +++++ 2 files changed, 11 insertions(+), 5 deletions(-) diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index ef8c524a296d..2a4a729ef8f7 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -1309,11 +1309,12 @@ config HISILICON_ERRATUM_165010801 depends on ARCH_HISI default y help - On HIP12, when GIC receives multiple interrupts of the same priority and - different types, the interrupts are selected in the following sequence: - SPI > LPI > SGI > PPI. This scheduling rule may cause PPI starvation. - To prevent starvation from triggering system watchdog hardlockup, the - interrupt priority is explicitly increased in the arch_timer driver. + On HIP09/12 hardware, observations indicate that the GIC's handling of + equal-priority interrupts across different interrupt types may not always + provide balanced servicing. In some cases, this could result in prolonged + service delays for particular interrupt types, creating conditions where + system watchdog hardlockup detection might be triggered. The arch_timer + driver addresses this by proactively increasing affected interrupt priorities. config QCOM_FALKOR_ERRATUM_1003 bool "Falkor E1003: Incorrect translation due to ASID change" diff --git a/drivers/clocksource/arm_arch_timer.c b/drivers/clocksource/arm_arch_timer.c index 095238032ac0..7ffca7cc5c53 100644 --- a/drivers/clocksource/arm_arch_timer.c +++ b/drivers/clocksource/arm_arch_timer.c @@ -369,6 +369,11 @@ static struct ate_acpi_oem_info hisi_161010101_oem_info[] = { #ifdef CONFIG_HISILICON_ERRATUM_165010801 static struct ate_acpi_oem_info hisi_165010801_oem_info[] = { + { + .oem_id = "HISI ", + .oem_table_id = "HIP09 ", + .oem_revision = 0, + }, { .oem_id = "HISI ", .oem_table_id = "HIP12 ", -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] irqchip/gic-v3-its: Avoid truncating memory addresses
by Jinjie Ruan 12 Feb '26

12 Feb '26

From: Arnd Bergmann <arnd(a)arndb.de> stable inclusion from stable-v6.6.122 commit 1b323391560354d8c515de8658b057a1daa82adb category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13618 CVE: CVE-2026-23085 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 8d76a7d89c12d08382b66e2f21f20d0627d14859 upstream. On 32-bit machines with CONFIG_ARM_LPAE, it is possible for lowmem allocations to be backed by addresses physical memory above the 32-bit address limit, as found while experimenting with larger VMSPLIT configurations. This caused the qemu virt model to crash in the GICv3 driver, which allocates the 'itt' object using GFP_KERNEL. Since all memory below the 4GB physical address limit is in ZONE_DMA in this configuration, kmalloc() defaults to higher addresses for ZONE_NORMAL, and the ITS driver stores the physical address in a 32-bit 'unsigned long' variable. Change the itt_addr variable to the correct phys_addr_t type instead, along with all other variables in this driver that hold a physical address. The gicv5 driver correctly uses u64 variables, while all other irqchip drivers don't call virt_to_phys or similar interfaces. It's expected that other device drivers have similar issues, but fixing this one is sufficient for booting a virtio based guest. Fixes: cc2d3216f53c ("irqchip: GICv3: ITS command queue") Signed-off-by: Arnd Bergmann <arnd(a)arndb.de> Signed-off-by: Thomas Gleixner <tglx(a)kernel.org> Reviewed-by: Marc Zyngier <maz(a)kernel.org> Cc: stable(a)vger.kernel.org Link: https://patch.msgid.link/20260119201603.2713066-1-arnd@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/irqchip/irq-gic-v3-its.c [ Conflict because 64edfaa9a234 ("irqchip/gic-v4.1: Implement the v4.1 flavour of VMAPP") not merged. ] Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- drivers/irqchip/irq-gic-v3-its.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c index 65306a1ed3dc..750fcb25574a 100644 --- a/drivers/irqchip/irq-gic-v3-its.c +++ b/drivers/irqchip/irq-gic-v3-its.c @@ -459,7 +459,7 @@ static struct its_collection *its_build_mapd_cmd(struct its_node *its, struct its_cmd_block *cmd, struct its_cmd_desc *desc) { - unsigned long itt_addr; + phys_addr_t itt_addr; u8 size = ilog2(desc->its_mapd_cmd.dev->nr_ites); itt_addr = virt_to_phys(desc->its_mapd_cmd.dev->itt); @@ -629,7 +629,7 @@ static struct its_vpe *its_build_vmapp_cmd(struct its_node *its, struct its_cmd_block *cmd, struct its_cmd_desc *desc) { - unsigned long vpt_addr; + phys_addr_t vpt_addr; u64 target; vpt_addr = virt_to_phys(page_address(desc->its_vmapp_cmd.vpe->vpt_page)); @@ -2023,10 +2023,10 @@ static int its_setup_baser(struct its_node *its, struct its_baser *baser, baser->psz = psz; tmp = indirect ? GITS_LVL1_ENTRY_SIZE : esz; - pr_info("ITS@%pa: allocated %d %s @%lx (%s, esz %d, psz %dK, shr %d)\n", + pr_info("ITS@%pa: allocated %d %s @%llx (%s, esz %d, psz %dK, shr %d)\n", &its->phys_base, (int)(PAGE_ORDER_TO_SIZE(order) / (int)tmp), its_base_type_string[type], - (unsigned long)virt_to_phys(base), + (u64)virt_to_phys(base), indirect ? "indirect" : "flat", (int)esz, psz / SZ_1K, (int)shr >> GITS_BASER_SHAREABILITY_SHIFT); -- 2.34.1

2 1

[PATCH OLK-6.6] tracing: Fix soft lockup when lseeking trace file
by Tengda Wu 12 Feb '26

12 Feb '26

From: Tengda Wu <wutengda(a)huaweicloud.com> maillist inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8522 Reference: https://lore.kernel.org/all/20260209093101.1623454-1-wutengda@huaweicloud.c… -------------------------------- A soft lockup may occur when accessing trace file via lseek while tracing is active and a large offset is provided. The call trace is shown below: watchdog: BUG: soft lockup - CPU#3 stuck for 26s! [poc:141] CPU: 3 UID: 0 PID: 141 Comm: poc Not tainted 6.19.0 #1 PREEMPT(none) Call Trace: ring_buffer_iter_peek peek_next_entry __find_next_entry trace_find_next_entry_inc s_next traverse.part.0 seq_lseek tracing_lseek __x64_sys_lseek do_syscall_64 entry_SYSCALL_64_after_hwframe The root cause is that the lseek implementation for trace files is based on seq_lseek, which contains a loop that repeatedly calls show() and next() functions until the position reaches the target offset. Since no scheduling point is set within this loop, a large offset can cause the CPU to be stuck in the loop for an extended period, triggering the soft lockup detector. Fixed by adding cond_resched() in s_next(). Fixes: bc0c38d139ec ("ftrace: latency tracer infrastructure") Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/trace/trace.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c index b0751e52d40e..95ede691941c 100644 --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -4037,6 +4037,8 @@ static void *s_next(struct seq_file *m, void *v, loff_t *pos) iter->pos = *pos; + cond_resched(); + return ent; } -- 2.34.1

2 1

[PATCH OLK-5.10] tracing: Fix soft lockup when lseeking trace file
by Tengda Wu 12 Feb '26

12 Feb '26

From: Tengda Wu <wutengda(a)huaweicloud.com> maillist inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8522 Reference: https://lore.kernel.org/all/20260209093101.1623454-1-wutengda@huaweicloud.c… -------------------------------- A soft lockup may occur when accessing trace file via lseek while tracing is active and a large offset is provided. The call trace is shown below: watchdog: BUG: soft lockup - CPU#3 stuck for 26s! [poc:141] CPU: 3 UID: 0 PID: 141 Comm: poc Not tainted 6.19.0 #1 PREEMPT(none) Call Trace: ring_buffer_iter_peek peek_next_entry __find_next_entry trace_find_next_entry_inc s_next traverse.part.0 seq_lseek tracing_lseek __x64_sys_lseek do_syscall_64 entry_SYSCALL_64_after_hwframe The root cause is that the lseek implementation for trace files is based on seq_lseek, which contains a loop that repeatedly calls show() and next() functions until the position reaches the target offset. Since no scheduling point is set within this loop, a large offset can cause the CPU to be stuck in the loop for an extended period, triggering the soft lockup detector. Fixed by adding cond_resched() in s_next(). Fixes: bc0c38d139ec ("ftrace: latency tracer infrastructure") Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/trace/trace.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c index 6c5a503987e7..631a9d263e57 100644 --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -3678,6 +3678,8 @@ static void *s_next(struct seq_file *m, void *v, loff_t *pos) iter->pos = *pos; + cond_resched(); + return ent; } -- 2.34.1

2 1

[PATCH OLK-5.10] uacce: fix cdev handling in the cleanup path
by Wang Tao 11 Feb '26

11 Feb '26

From: Wenkai Lin <linwenkai6(a)hisilicon.com> mainline inclusion from mainline-v6.19-rc7 commit a3bece3678f6c88db1f44c602b2a63e84b4040ac category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13629 CVE: CVE-2026-23096 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When cdev_device_add fails, it internally releases the cdev memory, and if cdev_device_del is then executed, it will cause a hang error. To fix it, we check the return value of cdev_device_add() and clear uacce->cdev to avoid calling cdev_device_del in the uacce_remove. Fixes: 015d239ac014 ("uacce: add uacce driver") Cc: stable(a)vger.kernel.org Signed-off-by: Wenkai Lin <linwenkai6(a)hisilicon.com> Signed-off-by: Chenghai Huang <huangchenghai2(a)huawei.com> Acked-by: Zhangfei Gao <zhangfei.gao(a)linaro.org> Link: https://patch.msgid.link/20251202061256.4158641-2-huangchenghai2@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Tao <wangtao554(a)huawei.com> --- drivers/misc/uacce/uacce.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/misc/uacce/uacce.c b/drivers/misc/uacce/uacce.c index 687b7fad9a29..b50ddd46fd72 100644 --- a/drivers/misc/uacce/uacce.c +++ b/drivers/misc/uacce/uacce.c @@ -982,6 +982,8 @@ EXPORT_SYMBOL_GPL(uacce_alloc); */ int uacce_register(struct uacce_device *uacce) { + int ret; + if (!uacce) return -ENODEV; @@ -992,7 +994,11 @@ int uacce_register(struct uacce_device *uacce) uacce->cdev->ops = &uacce_fops; uacce->cdev->owner = THIS_MODULE; - return cdev_device_add(uacce->cdev, &uacce->dev); + ret = cdev_device_add(uacce->cdev, &uacce->dev); + if (ret) + uacce->cdev = NULL; + + return ret; } EXPORT_SYMBOL_GPL(uacce_register); -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] Revert hibmc patches to fix null-ptr-deref
by Tengda Wu 11 Feb '26

11 Feb '26

This patch series is going to revert pull requests: !19950 and !20738. Tengda Wu (2): Revert "!20738 drm/hisilicon: Using the to_hibmc_drm_private to convert" Revert "!19950 【OLK-5.10】 Drivers GPU Patches from 6.6" drivers/gpu/drm/drm_connector.c | 9 - drivers/gpu/drm/drm_internal.h | 2 - drivers/gpu/drm/drm_probe_helper.c | 29 -- drivers/gpu/drm/drm_sysfs.c | 17 +- drivers/gpu/drm/hisilicon/hibmc/Kconfig | 2 - drivers/gpu/drm/hisilicon/hibmc/Makefile | 4 +- drivers/gpu/drm/hisilicon/hibmc/dp/dp_aux.c | 167 ------- drivers/gpu/drm/hisilicon/hibmc/dp/dp_comm.h | 73 --- .../gpu/drm/hisilicon/hibmc/dp/dp_config.h | 21 - drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.c | 338 -------------- drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.h | 74 ---- drivers/gpu/drm/hisilicon/hibmc/dp/dp_link.c | 415 ------------------ drivers/gpu/drm/hisilicon/hibmc/dp/dp_reg.h | 140 ------ .../gpu/drm/hisilicon/hibmc/dp/dp_serdes.c | 59 --- .../gpu/drm/hisilicon/hibmc/hibmc_drm_de.c | 24 +- .../drm/hisilicon/hibmc/hibmc_drm_debugfs.c | 149 ------- .../gpu/drm/hisilicon/hibmc/hibmc_drm_dp.c | 257 ----------- .../gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c | 176 +++----- .../gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h | 35 +- .../gpu/drm/hisilicon/hibmc/hibmc_drm_i2c.c | 48 +- .../gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c | 64 +-- drivers/gpu/drm/hisilicon/hibmc/hibmc_ttm.c | 8 +- include/drm/drm_probe_helper.h | 3 - 23 files changed, 126 insertions(+), 1988 deletions(-) delete mode 100644 drivers/gpu/drm/hisilicon/hibmc/dp/dp_aux.c delete mode 100644 drivers/gpu/drm/hisilicon/hibmc/dp/dp_comm.h delete mode 100644 drivers/gpu/drm/hisilicon/hibmc/dp/dp_config.h delete mode 100644 drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.c delete mode 100644 drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.h delete mode 100644 drivers/gpu/drm/hisilicon/hibmc/dp/dp_link.c delete mode 100644 drivers/gpu/drm/hisilicon/hibmc/dp/dp_reg.h delete mode 100644 drivers/gpu/drm/hisilicon/hibmc/dp/dp_serdes.c delete mode 100644 drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_debugfs.c delete mode 100644 drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_dp.c -- 2.34.1

2 3

[PATCH OLK-6.6] net: usb: asix: validate PHY address before use
by Wupeng Ma 11 Feb '26

11 Feb '26

From: Deepanshu Kartikey <kartikey406(a)gmail.com> stable inclusion from stable-v6.6.120 commit 38722e69ee64dbb020028c93898d25d6f4c0e0b2 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/8372 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a1e077a3f76eea0dc671ed6792e7d543946227e8 ] The ASIX driver reads the PHY address from the USB device via asix_read_phy_addr(). A malicious or faulty device can return an invalid address (>= PHY_MAX_ADDR), which causes a warning in mdiobus_get_phy(): addr 207 out of range WARNING: drivers/net/phy/mdio_bus.c:76 Validate the PHY address in asix_read_phy_addr() and remove the now-redundant check in ax88172a.c. Reported-by: syzbot+3d43c9066a5b54902232(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3d43c9066a5b54902232 Tested-by: syzbot+3d43c9066a5b54902232(a)syzkaller.appspotmail.com Fixes: 7e88b11a862a ("net: usb: asix: refactor asix_read_phy_addr() and handle errors on return") Link: https://lore.kernel.org/all/20251217085057.270704-1-kartikey406@gmail.com/T/ [v1] Signed-off-by: Deepanshu Kartikey <kartikey406(a)gmail.com> Reviewed-by: Andrew Lunn <andrew(a)lunn.ch> Link: https://patch.msgid.link/20251218011156.276824-1-kartikey406@gmail.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yuan can <yuancan(a)huawei.com> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- drivers/net/usb/asix_common.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/net/usb/asix_common.c b/drivers/net/usb/asix_common.c index 7fd763917ae2c..6ab3486072cb0 100644 --- a/drivers/net/usb/asix_common.c +++ b/drivers/net/usb/asix_common.c @@ -335,6 +335,11 @@ int asix_read_phy_addr(struct usbnet *dev, bool internal) offset = (internal ? 1 : 0); ret = buf[offset]; + if (ret >= PHY_MAX_ADDR) { + netdev_err(dev->net, "invalid PHY address: %d\n", ret); + return -ENODEV; + } + netdev_dbg(dev->net, "%s PHY address 0x%x\n", internal ? "internal" : "external", ret); -- 2.43.0

2 1

[PATCH OLK-6.6] smc91x: fix broken irq-context in PREEMPT_RT
by Wupeng Ma 11 Feb '26

11 Feb '26

From: Yeoreum Yun <yeoreum.yun(a)arm.com> stable inclusion from stable-v6.6.120 commit ef277ae121b3249c99994652210a326b52d527b0 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/8372 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 6402078bd9d1ed46e79465e1faaa42e3458f8a33 ] When smc91x.c is built with PREEMPT_RT, the following splat occurs in FVP_RevC: [ 13.055000] smc91x LNRO0003:00 eth0: link up, 10Mbps, half-duplex, lpa 0x0000 [ 13.062137] BUG: workqueue leaked atomic, lock or RCU: kworker/2:1[106] [ 13.062137] preempt=0x00000000 lock=0->0 RCU=0->1 workfn=mld_ifc_work [ 13.062266] C ** replaying previous printk message ** [ 13.062266] CPU: 2 UID: 0 PID: 106 Comm: kworker/2:1 Not tainted 6.18.0-dirty #179 PREEMPT_{RT,(full)} [ 13.062353] Hardware name: , BIOS [ 13.062382] Workqueue: mld mld_ifc_work [ 13.062469] Call trace: [ 13.062494] show_stack+0x24/0x40 (C) [ 13.062602] __dump_stack+0x28/0x48 [ 13.062710] dump_stack_lvl+0x7c/0xb0 [ 13.062818] dump_stack+0x18/0x34 [ 13.062926] process_scheduled_works+0x294/0x450 [ 13.063043] worker_thread+0x260/0x3d8 [ 13.063124] kthread+0x1c4/0x228 [ 13.063235] ret_from_fork+0x10/0x20 This happens because smc_special_trylock() disables IRQs even on PREEMPT_RT, but smc_special_unlock() does not restore IRQs on PREEMPT_RT. The reason is that smc_special_unlock() calls spin_unlock_irqrestore(), and rcu_read_unlock_bh() in __dev_queue_xmit() cannot invoke rcu_read_unlock() through __local_bh_enable_ip() when current->softirq_disable_cnt becomes zero. To address this issue, replace smc_special_trylock() with spin_trylock_irqsave(). Fixes: 342a93247e08 ("locking/spinlock: Provide RT variant header: <linux/spinlock_rt.h>") Signed-off-by: Yeoreum Yun <yeoreum.yun(a)arm.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://patch.msgid.link/20251217085115.1730036-1-yeoreum.yun@arm.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yuan can <yuancan(a)huawei.com> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- drivers/net/ethernet/smsc/smc91x.c | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c index 032eccf8eb428..7c2fdd02f1d34 100644 --- a/drivers/net/ethernet/smsc/smc91x.c +++ b/drivers/net/ethernet/smsc/smc91x.c @@ -515,15 +515,7 @@ static inline void smc_rcv(struct net_device *dev) * any other concurrent access and C would always interrupt B. But life * isn't that easy in a SMP world... */ -#define smc_special_trylock(lock, flags) \ -({ \ - int __ret; \ - local_irq_save(flags); \ - __ret = spin_trylock(lock); \ - if (!__ret) \ - local_irq_restore(flags); \ - __ret; \ -}) +#define smc_special_trylock(lock, flags) spin_trylock_irqsave(lock, flags) #define smc_special_lock(lock, flags) spin_lock_irqsave(lock, flags) #define smc_special_unlock(lock, flags) spin_unlock_irqrestore(lock, flags) #else -- 2.43.0

2 1

[PATCH OLK-6.6] dm-thin: Add support for split cache
by Zhang Zekun 11 Feb '26

11 Feb '26

hulk inclusion category: feature bugzilla: NA CVE: NA -------------------------------------------------------- The cache of dm-thin is common used for first level btree and the second level btree, however the first level btree has less dm-buffer than the second level btree, which might cause extra look up steps for the first level btree when accessing the cache of the dm pool. Thus, add support for spliting the first level btree and the second level btree' cache, which might speed up the look up process of the first level btree routine. Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/md/dm-bufio.c | 167 ++++++++++++++---- drivers/md/dm-thin-metadata.c | 4 + drivers/md/dm.h | 17 +- drivers/md/persistent-data/dm-block-manager.c | 11 ++ drivers/md/persistent-data/dm-block-manager.h | 2 + include/linux/dm-bufio.h | 4 + 6 files changed, 174 insertions(+), 31 deletions(-) diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c index 8ce77aec05d2..206c7c00be88 100644 --- a/drivers/md/dm-bufio.c +++ b/drivers/md/dm-bufio.c @@ -254,9 +254,9 @@ enum evict_result { ER_STOP, /* stop looking for something to evict */ }; -typedef enum evict_result (*le_predicate)(struct lru_entry *le, void *context); +typedef enum evict_result (*le_predicate)(struct lru_entry *le, void *context, void *bc); -static struct lru_entry *lru_evict(struct lru *lru, le_predicate pred, void *context, bool no_sleep) +static struct lru_entry *lru_evict(struct lru *lru, le_predicate pred, void *context, bool no_sleep, void *bc) { unsigned long tested = 0; struct list_head *h = lru->cursor; @@ -276,7 +276,7 @@ static struct lru_entry *lru_evict(struct lru *lru, le_predicate pred, void *con atomic_set(&le->referenced, 0); } else { tested++; - switch (pred(le, context)) { + switch (pred(le, context, bc)) { case ER_EVICT: /* * Adjust the cursor, so we start the next @@ -362,6 +362,7 @@ struct dm_buffer { unsigned int stack_len; unsigned long stack_entries[MAX_STACK]; #endif + bool special; }; /*--------------------------------------------------------------*/ @@ -399,47 +400,93 @@ struct dm_buffer_cache { * on the locks. */ unsigned int num_locks; + unsigned long special; bool no_sleep; struct buffer_tree trees[]; }; static DEFINE_STATIC_KEY_FALSE(no_sleep_enabled); +static inline unsigned int cache_index_special(sector_t block, unsigned int num_locks, unsigned long special) +{ + return dm_hash_locks_index_special(block, num_locks, special); +} + static inline unsigned int cache_index(sector_t block, unsigned int num_locks) { return dm_hash_locks_index(block, num_locks); } +static inline void cache_read_lock_special(struct dm_buffer_cache *bc, sector_t block, bool special) +{ + sector_t nb = special ? block : ULONG_MAX; + + if (static_branch_unlikely(&no_sleep_enabled) && bc->no_sleep) + read_lock_bh(&bc->trees[cache_index_special(block, bc->num_locks, nb)].u.spinlock); + else + down_read(&bc->trees[cache_index_special(block, bc->num_locks, nb)].u.lock); +} + static inline void cache_read_lock(struct dm_buffer_cache *bc, sector_t block) { if (static_branch_unlikely(&no_sleep_enabled) && bc->no_sleep) - read_lock_bh(&bc->trees[cache_index(block, bc->num_locks)].u.spinlock); + read_lock_bh(&bc->trees[cache_index_special(block, bc->num_locks, bc->special)].u.spinlock); else - down_read(&bc->trees[cache_index(block, bc->num_locks)].u.lock); + down_read(&bc->trees[cache_index_special(block, bc->num_locks, bc->special)].u.lock); } static inline void cache_read_unlock(struct dm_buffer_cache *bc, sector_t block) { if (static_branch_unlikely(&no_sleep_enabled) && bc->no_sleep) - read_unlock_bh(&bc->trees[cache_index(block, bc->num_locks)].u.spinlock); + read_unlock_bh(&bc->trees[cache_index_special(block, bc->num_locks, bc->special)].u.spinlock); + else + up_read(&bc->trees[cache_index_special(block, bc->num_locks, bc->special)].u.lock); +} + +static inline void cache_read_unlock_special(struct dm_buffer_cache *bc, sector_t block, bool special) +{ + sector_t nb = special ? block : ULONG_MAX; + + if (static_branch_unlikely(&no_sleep_enabled) && bc->no_sleep) + read_unlock_bh(&bc->trees[cache_index_special(block, bc->num_locks, nb)].u.spinlock); + else + up_read(&bc->trees[cache_index_special(block, bc->num_locks, nb)].u.lock); +} + +static inline void cache_write_lock_special(struct dm_buffer_cache *bc, sector_t block, bool special) +{ + sector_t nb = special ? block : ULONG_MAX; + + if (static_branch_unlikely(&no_sleep_enabled) && bc->no_sleep) + write_lock_bh(&bc->trees[cache_index_special(block, bc->num_locks, nb)].u.spinlock); else - up_read(&bc->trees[cache_index(block, bc->num_locks)].u.lock); + down_write(&bc->trees[cache_index_special(block, bc->num_locks, nb)].u.lock); } static inline void cache_write_lock(struct dm_buffer_cache *bc, sector_t block) { if (static_branch_unlikely(&no_sleep_enabled) && bc->no_sleep) - write_lock_bh(&bc->trees[cache_index(block, bc->num_locks)].u.spinlock); + write_lock_bh(&bc->trees[cache_index_special(block, bc->num_locks, bc->special)].u.spinlock); else - down_write(&bc->trees[cache_index(block, bc->num_locks)].u.lock); + down_write(&bc->trees[cache_index_special(block, bc->num_locks, bc->special)].u.lock); +} + +static inline void cache_write_unlock_special(struct dm_buffer_cache *bc, sector_t block, bool special) +{ + sector_t nb = special ? block : ULONG_MAX; + + if (static_branch_unlikely(&no_sleep_enabled) && bc->no_sleep) + write_unlock_bh(&bc->trees[cache_index_special(block, bc->num_locks, nb)].u.spinlock); + else + up_write(&bc->trees[cache_index_special(block, bc->num_locks, nb)].u.lock); } static inline void cache_write_unlock(struct dm_buffer_cache *bc, sector_t block) { if (static_branch_unlikely(&no_sleep_enabled) && bc->no_sleep) - write_unlock_bh(&bc->trees[cache_index(block, bc->num_locks)].u.spinlock); + write_unlock_bh(&bc->trees[cache_index_special(block, bc->num_locks, bc->special)].u.spinlock); else - up_write(&bc->trees[cache_index(block, bc->num_locks)].u.lock); + up_write(&bc->trees[cache_index_special(block, bc->num_locks, bc->special)].u.lock); } /* @@ -506,9 +553,9 @@ static void lh_exit(struct lock_history *lh) * Named 'next' because there is no corresponding * 'up/unlock' call since it's done automatically. */ -static void lh_next(struct lock_history *lh, sector_t b) +static void lh_next(struct lock_history *lh, sector_t b, unsigned long special) { - unsigned int index = cache_index(b, lh->no_previous); /* no_previous is num_locks */ + unsigned int index = cache_index_special(b, lh->no_previous, special); /* no_previous is num_locks */ if (lh->previous != lh->no_previous) { if (lh->previous != index) { @@ -614,12 +661,23 @@ static void __cache_inc_buffer(struct dm_buffer *b) WRITE_ONCE(b->last_accessed, jiffies); } +static struct dm_buffer *cache_get_noref(struct dm_buffer_cache *bc, sector_t block) +{ + struct dm_buffer *b; + + cache_read_lock(bc, block); + b = __cache_get(&bc->trees[cache_index_special(block, bc->num_locks, bc->special)].root, block); + cache_read_unlock(bc, block); + + return b; +} + static struct dm_buffer *cache_get(struct dm_buffer_cache *bc, sector_t block) { struct dm_buffer *b; cache_read_lock(bc, block); - b = __cache_get(&bc->trees[cache_index(block, bc->num_locks)].root, block); + b = __cache_get(&bc->trees[cache_index_special(block, bc->num_locks, bc->special)].root, block); if (b) { lru_reference(&b->lru); __cache_inc_buffer(b); @@ -666,12 +724,13 @@ struct evict_wrapper { * Wraps the buffer predicate turning it into an lru predicate. Adds * extra test for hold_count. */ -static enum evict_result __evict_pred(struct lru_entry *le, void *context) +static enum evict_result __evict_pred(struct lru_entry *le, void *context, void *bc) { struct evict_wrapper *w = context; struct dm_buffer *b = le_to_buffer(le); + struct dm_buffer_cache *bcc = (struct dm_buffer_cache *)bc; - lh_next(w->lh, b->block); + lh_next(w->lh, b->block, b->special ? b->block : bcc->special); if (atomic_read(&b->hold_count)) return ER_DONT_EVICT; @@ -687,13 +746,13 @@ static struct dm_buffer *__cache_evict(struct dm_buffer_cache *bc, int list_mode struct lru_entry *le; struct dm_buffer *b; - le = lru_evict(&bc->lru[list_mode], __evict_pred, &w, bc->no_sleep); + le = lru_evict(&bc->lru[list_mode], __evict_pred, &w, bc->no_sleep, (void *) bc); if (!le) return NULL; b = le_to_buffer(le); /* __evict_pred will have locked the appropriate tree. */ - rb_erase(&b->node, &bc->trees[cache_index(b->block, bc->num_locks)].root); + rb_erase(&b->node, &bc->trees[cache_index_special(b->block, bc->num_locks, b->special ? b->block : bc->special)].root); return b; } @@ -741,7 +800,7 @@ static void __cache_mark_many(struct dm_buffer_cache *bc, int old_mode, int new_ struct evict_wrapper w = {.lh = lh, .pred = pred, .context = context}; while (true) { - le = lru_evict(&bc->lru[old_mode], __evict_pred, &w, bc->no_sleep); + le = lru_evict(&bc->lru[old_mode], __evict_pred, &w, bc->no_sleep, (void *)bc); if (!le) break; @@ -792,7 +851,7 @@ static void __cache_iterate(struct dm_buffer_cache *bc, int list_mode, do { struct dm_buffer *b = le_to_buffer(le); - lh_next(lh, b->block); + lh_next(lh, b->block, bc->special); switch (fn(b, context)) { case IT_NEXT: @@ -858,8 +917,8 @@ static bool cache_insert(struct dm_buffer_cache *bc, struct dm_buffer *b) return false; cache_write_lock(bc, b->block); - BUG_ON(atomic_read(&b->hold_count) != 1); - r = __cache_insert(&bc->trees[cache_index(b->block, bc->num_locks)].root, b); + //BUG_ON(atomic_read(&b->hold_count) != 1); + r = __cache_insert(&bc->trees[cache_index_special(b->block, bc->num_locks, bc->special)].root, b); if (r) lru_insert(&bc->lru[b->list_mode], &b->lru); cache_write_unlock(bc, b->block); @@ -867,14 +926,42 @@ static bool cache_insert(struct dm_buffer_cache *bc, struct dm_buffer *b) return r; } -/*--------------*/ +static bool cache_remove_nolru_new(struct dm_buffer_cache *bc, struct dm_buffer *b) +{ + bool r; + + cache_write_lock_special(bc, b->block, false); + cache_write_lock_special(bc, b->block, true); + + rb_erase(&b->node, &bc->trees[cache_index_special(b->block, bc->num_locks, bc->special)].root); + bc->special = b->block; + b->special = true; + r = __cache_insert(&bc->trees[cache_index_special(b->block, bc->num_locks, bc->special)].root, b); + + cache_write_unlock_special(bc, b->block, true); + cache_write_unlock_special(bc, b->block, false); + + return r; +} + +static bool cache_remove_nolru_old(struct dm_buffer_cache *bc, struct dm_buffer *b) +{ + bool r; + + cache_write_lock_special(bc, b->block, true); + cache_write_lock_special(bc, b->block, false); + + rb_erase(&b->node, &bc->trees[cache_index_special(b->block, bc->num_locks, bc->special)].root); + bc->special = ULONG_MAX; + b->special = false; + r = __cache_insert(&bc->trees[cache_index_special(b->block, bc->num_locks, bc->special)].root, b); + + cache_write_unlock_special(bc, b->block, false); + cache_write_unlock_special(bc, b->block, true); + + return r; +} -/* - * Removes buffer from cache, ownership of the buffer passes back to the caller. - * Fails if the hold_count is not one (ie. the caller holds the only reference). - * - * Not threadsafe. - */ static bool cache_remove(struct dm_buffer_cache *bc, struct dm_buffer *b) { bool r; @@ -885,7 +972,7 @@ static bool cache_remove(struct dm_buffer_cache *bc, struct dm_buffer *b) r = false; } else { r = true; - rb_erase(&b->node, &bc->trees[cache_index(b->block, bc->num_locks)].root); + rb_erase(&b->node, &bc->trees[cache_index_special(b->block, bc->num_locks, bc->special)].root); lru_remove(&bc->lru[b->list_mode], &b->lru); } @@ -1019,6 +1106,12 @@ struct dm_bufio_client { struct dm_buffer_cache cache; /* must be last member */ }; +void dm_setup_buffer_cache(struct dm_bufio_client *bc, unsigned long block) +{ + bc->cache.special = block; +} +EXPORT_SYMBOL_GPL(dm_setup_buffer_cache); + /*----------------------------------------------------------------*/ #define dm_bufio_in_request() (!!current->bio_list) @@ -1792,6 +1885,7 @@ static struct dm_buffer *__bufio_new(struct dm_bufio_client *c, sector_t block, b->read_error = 0; b->write_error = 0; b->list_mode = LIST_CLEAN; + b->special = (block == c->cache.special); if (nf == NF_FRESH) b->state = 0; @@ -2642,6 +2736,19 @@ void dm_bufio_set_sector_offset(struct dm_bufio_client *c, sector_t start) } EXPORT_SYMBOL_GPL(dm_bufio_set_sector_offset); +void dm_move_cache(struct dm_bufio_client *bc, unsigned long new) +{ + struct dm_buffer *b; + unsigned long old = bc->cache.special; + + b = cache_get_noref(&bc->cache, old); + cache_remove_nolru_old(&bc->cache, b); + + b = cache_get_noref(&bc->cache, new); + cache_remove_nolru_new(&bc->cache, b); +} +EXPORT_SYMBOL_GPL(dm_move_cache); + /*--------------------------------------------------------------*/ static unsigned int get_max_age_hz(void) diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c index 6022189c1388..f485504d40f3 100644 --- a/drivers/md/dm-thin-metadata.c +++ b/drivers/md/dm-thin-metadata.c @@ -747,6 +747,7 @@ static int __open_metadata(struct dm_pool_metadata *pmd) * root to avoid accessing broken btree. */ pmd->root = le64_to_cpu(disk_super->data_mapping_root); + dm_setup_bm_cache(pmd->bm, pmd->root); pmd->details_root = le64_to_cpu(disk_super->device_details_root); __setup_btree_details(pmd); @@ -837,6 +838,7 @@ static int __begin_transaction(struct dm_pool_metadata *pmd) disk_super = dm_block_data(sblock); pmd->time = le32_to_cpu(disk_super->time); pmd->root = le64_to_cpu(disk_super->data_mapping_root); + dm_setup_bm_cache(pmd->bm, pmd->root); pmd->details_root = le64_to_cpu(disk_super->device_details_root); pmd->trans_id = le64_to_cpu(disk_super->trans_id); pmd->flags = le32_to_cpu(disk_super->flags); @@ -1678,6 +1680,8 @@ static int __insert(struct dm_thin_device *td, dm_block_t block, if (r) return r; + dm_move_bm_cache(pmd->bm, pmd->root); + td->changed = true; if (inserted) td->mapped_blocks++; diff --git a/drivers/md/dm.h b/drivers/md/dm.h index f682295af91f..1b2da00d9016 100644 --- a/drivers/md/dm.h +++ b/drivers/md/dm.h @@ -232,12 +232,27 @@ static inline unsigned int dm_num_hash_locks(void) { unsigned int num_locks = roundup_pow_of_two(num_online_cpus()) << 1; - return min_t(unsigned int, num_locks, DM_HASH_LOCKS_MAX); + return min_t(unsigned int, num_locks, DM_HASH_LOCKS_MAX) + 32; } #define DM_HASH_LOCKS_MULT 4294967291ULL #define DM_HASH_LOCKS_SHIFT 6 +static inline unsigned int dm_hash_locks_index_special(sector_t block, + unsigned int num_locks, + unsigned long special) +{ + + + sector_t h1 = (block * DM_HASH_LOCKS_MULT) >> DM_HASH_LOCKS_SHIFT; + sector_t h2 = h1 >> DM_HASH_LOCKS_SHIFT; + + if (block == special) + return ((h1 ^ h2) & 31) + num_locks - 32; + + return (h1 ^ h2) & (num_locks - 33); +} + static inline unsigned int dm_hash_locks_index(sector_t block, unsigned int num_locks) { diff --git a/drivers/md/persistent-data/dm-block-manager.c b/drivers/md/persistent-data/dm-block-manager.c index 0e010e1204aa..da560f825298 100644 --- a/drivers/md/persistent-data/dm-block-manager.c +++ b/drivers/md/persistent-data/dm-block-manager.c @@ -414,6 +414,17 @@ struct dm_block_manager *dm_block_manager_create(struct block_device *bdev, } EXPORT_SYMBOL_GPL(dm_block_manager_create); +void dm_setup_bm_cache(struct dm_block_manager *bm, unsigned long block) +{ + dm_setup_buffer_cache(bm->bufio, block); +} +EXPORT_SYMBOL_GPL(dm_setup_bm_cache); + +void dm_move_bm_cache(struct dm_block_manager *bm, unsigned long block) +{ + dm_move_cache(bm->bufio, block); +} + void dm_block_manager_destroy(struct dm_block_manager *bm) { dm_bufio_client_destroy(bm->bufio); diff --git a/drivers/md/persistent-data/dm-block-manager.h b/drivers/md/persistent-data/dm-block-manager.h index f706d3de8d5a..25121bbc58d7 100644 --- a/drivers/md/persistent-data/dm-block-manager.h +++ b/drivers/md/persistent-data/dm-block-manager.h @@ -35,7 +35,9 @@ struct dm_block_manager; struct dm_block_manager *dm_block_manager_create( struct block_device *bdev, unsigned int block_size, unsigned int max_held_per_thread); +void dm_move_bm_cache(struct dm_block_manager *bm, unsigned long block); void dm_block_manager_destroy(struct dm_block_manager *bm); +void dm_setup_bm_cache(struct dm_block_manager *bm, unsigned long block); void dm_block_manager_reset(struct dm_block_manager *bm); unsigned int dm_bm_block_size(struct dm_block_manager *bm); diff --git a/include/linux/dm-bufio.h b/include/linux/dm-bufio.h index 75e7d8cbb532..d7d7a33cc685 100644 --- a/include/linux/dm-bufio.h +++ b/include/linux/dm-bufio.h @@ -71,6 +71,8 @@ void *dm_bufio_read(struct dm_bufio_client *c, sector_t block, void *dm_bufio_get(struct dm_bufio_client *c, sector_t block, struct dm_buffer **bp); +void dm_setup_buffer_cache(struct dm_bufio_client *bc, unsigned long block); + /* * Like dm_bufio_read, but don't read anything from the disk. It is * expected that the caller initializes the buffer and marks it dirty. @@ -139,6 +141,8 @@ int dm_bufio_issue_discard(struct dm_bufio_client *c, sector_t block, sector_t c */ void dm_bufio_forget(struct dm_bufio_client *c, sector_t block); +void dm_move_cache(struct dm_bufio_client *bc, unsigned long block); + /* * Free the given range of buffers. * This is just a hint, if the buffer is in use or dirty, this function -- 2.43.0

2 1

[PATCH OLK-6.6] dm-thin: Add support for split cache
by Zhang Zekun 11 Feb '26

11 Feb '26

hulk inclusion category: feature bugzilla: NA CVE: NA -------------------------------------------------------- The cache of dm-thin is common used for first level btree and the second level btree, however the first level btree has less dm-buffer than the second level btree, which might cause extra look up steps for the first level btree when accessing the cache of the dm pool. Thus, add support for spliting the first level btree and the second level btree' cache, which might speed up the look up process of the first level btree routine. Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/md/dm-bufio.c | 167 ++++++++++++++---- drivers/md/dm-thin-metadata.c | 4 + drivers/md/dm.h | 17 +- drivers/md/persistent-data/dm-block-manager.c | 11 ++ drivers/md/persistent-data/dm-block-manager.h | 2 + include/linux/dm-bufio.h | 4 + 6 files changed, 174 insertions(+), 31 deletions(-) diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c index 8ce77aec05d2..206c7c00be88 100644 --- a/drivers/md/dm-bufio.c +++ b/drivers/md/dm-bufio.c @@ -254,9 +254,9 @@ enum evict_result { ER_STOP, /* stop looking for something to evict */ }; -typedef enum evict_result (*le_predicate)(struct lru_entry *le, void *context); +typedef enum evict_result (*le_predicate)(struct lru_entry *le, void *context, void *bc); -static struct lru_entry *lru_evict(struct lru *lru, le_predicate pred, void *context, bool no_sleep) +static struct lru_entry *lru_evict(struct lru *lru, le_predicate pred, void *context, bool no_sleep, void *bc) { unsigned long tested = 0; struct list_head *h = lru->cursor; @@ -276,7 +276,7 @@ static struct lru_entry *lru_evict(struct lru *lru, le_predicate pred, void *con atomic_set(&le->referenced, 0); } else { tested++; - switch (pred(le, context)) { + switch (pred(le, context, bc)) { case ER_EVICT: /* * Adjust the cursor, so we start the next @@ -362,6 +362,7 @@ struct dm_buffer { unsigned int stack_len; unsigned long stack_entries[MAX_STACK]; #endif + bool special; }; /*--------------------------------------------------------------*/ @@ -399,47 +400,93 @@ struct dm_buffer_cache { * on the locks. */ unsigned int num_locks; + unsigned long special; bool no_sleep; struct buffer_tree trees[]; }; static DEFINE_STATIC_KEY_FALSE(no_sleep_enabled); +static inline unsigned int cache_index_special(sector_t block, unsigned int num_locks, unsigned long special) +{ + return dm_hash_locks_index_special(block, num_locks, special); +} + static inline unsigned int cache_index(sector_t block, unsigned int num_locks) { return dm_hash_locks_index(block, num_locks); } +static inline void cache_read_lock_special(struct dm_buffer_cache *bc, sector_t block, bool special) +{ + sector_t nb = special ? block : ULONG_MAX; + + if (static_branch_unlikely(&no_sleep_enabled) && bc->no_sleep) + read_lock_bh(&bc->trees[cache_index_special(block, bc->num_locks, nb)].u.spinlock); + else + down_read(&bc->trees[cache_index_special(block, bc->num_locks, nb)].u.lock); +} + static inline void cache_read_lock(struct dm_buffer_cache *bc, sector_t block) { if (static_branch_unlikely(&no_sleep_enabled) && bc->no_sleep) - read_lock_bh(&bc->trees[cache_index(block, bc->num_locks)].u.spinlock); + read_lock_bh(&bc->trees[cache_index_special(block, bc->num_locks, bc->special)].u.spinlock); else - down_read(&bc->trees[cache_index(block, bc->num_locks)].u.lock); + down_read(&bc->trees[cache_index_special(block, bc->num_locks, bc->special)].u.lock); } static inline void cache_read_unlock(struct dm_buffer_cache *bc, sector_t block) { if (static_branch_unlikely(&no_sleep_enabled) && bc->no_sleep) - read_unlock_bh(&bc->trees[cache_index(block, bc->num_locks)].u.spinlock); + read_unlock_bh(&bc->trees[cache_index_special(block, bc->num_locks, bc->special)].u.spinlock); + else + up_read(&bc->trees[cache_index_special(block, bc->num_locks, bc->special)].u.lock); +} + +static inline void cache_read_unlock_special(struct dm_buffer_cache *bc, sector_t block, bool special) +{ + sector_t nb = special ? block : ULONG_MAX; + + if (static_branch_unlikely(&no_sleep_enabled) && bc->no_sleep) + read_unlock_bh(&bc->trees[cache_index_special(block, bc->num_locks, nb)].u.spinlock); + else + up_read(&bc->trees[cache_index_special(block, bc->num_locks, nb)].u.lock); +} + +static inline void cache_write_lock_special(struct dm_buffer_cache *bc, sector_t block, bool special) +{ + sector_t nb = special ? block : ULONG_MAX; + + if (static_branch_unlikely(&no_sleep_enabled) && bc->no_sleep) + write_lock_bh(&bc->trees[cache_index_special(block, bc->num_locks, nb)].u.spinlock); else - up_read(&bc->trees[cache_index(block, bc->num_locks)].u.lock); + down_write(&bc->trees[cache_index_special(block, bc->num_locks, nb)].u.lock); } static inline void cache_write_lock(struct dm_buffer_cache *bc, sector_t block) { if (static_branch_unlikely(&no_sleep_enabled) && bc->no_sleep) - write_lock_bh(&bc->trees[cache_index(block, bc->num_locks)].u.spinlock); + write_lock_bh(&bc->trees[cache_index_special(block, bc->num_locks, bc->special)].u.spinlock); else - down_write(&bc->trees[cache_index(block, bc->num_locks)].u.lock); + down_write(&bc->trees[cache_index_special(block, bc->num_locks, bc->special)].u.lock); +} + +static inline void cache_write_unlock_special(struct dm_buffer_cache *bc, sector_t block, bool special) +{ + sector_t nb = special ? block : ULONG_MAX; + + if (static_branch_unlikely(&no_sleep_enabled) && bc->no_sleep) + write_unlock_bh(&bc->trees[cache_index_special(block, bc->num_locks, nb)].u.spinlock); + else + up_write(&bc->trees[cache_index_special(block, bc->num_locks, nb)].u.lock); } static inline void cache_write_unlock(struct dm_buffer_cache *bc, sector_t block) { if (static_branch_unlikely(&no_sleep_enabled) && bc->no_sleep) - write_unlock_bh(&bc->trees[cache_index(block, bc->num_locks)].u.spinlock); + write_unlock_bh(&bc->trees[cache_index_special(block, bc->num_locks, bc->special)].u.spinlock); else - up_write(&bc->trees[cache_index(block, bc->num_locks)].u.lock); + up_write(&bc->trees[cache_index_special(block, bc->num_locks, bc->special)].u.lock); } /* @@ -506,9 +553,9 @@ static void lh_exit(struct lock_history *lh) * Named 'next' because there is no corresponding * 'up/unlock' call since it's done automatically. */ -static void lh_next(struct lock_history *lh, sector_t b) +static void lh_next(struct lock_history *lh, sector_t b, unsigned long special) { - unsigned int index = cache_index(b, lh->no_previous); /* no_previous is num_locks */ + unsigned int index = cache_index_special(b, lh->no_previous, special); /* no_previous is num_locks */ if (lh->previous != lh->no_previous) { if (lh->previous != index) { @@ -614,12 +661,23 @@ static void __cache_inc_buffer(struct dm_buffer *b) WRITE_ONCE(b->last_accessed, jiffies); } +static struct dm_buffer *cache_get_noref(struct dm_buffer_cache *bc, sector_t block) +{ + struct dm_buffer *b; + + cache_read_lock(bc, block); + b = __cache_get(&bc->trees[cache_index_special(block, bc->num_locks, bc->special)].root, block); + cache_read_unlock(bc, block); + + return b; +} + static struct dm_buffer *cache_get(struct dm_buffer_cache *bc, sector_t block) { struct dm_buffer *b; cache_read_lock(bc, block); - b = __cache_get(&bc->trees[cache_index(block, bc->num_locks)].root, block); + b = __cache_get(&bc->trees[cache_index_special(block, bc->num_locks, bc->special)].root, block); if (b) { lru_reference(&b->lru); __cache_inc_buffer(b); @@ -666,12 +724,13 @@ struct evict_wrapper { * Wraps the buffer predicate turning it into an lru predicate. Adds * extra test for hold_count. */ -static enum evict_result __evict_pred(struct lru_entry *le, void *context) +static enum evict_result __evict_pred(struct lru_entry *le, void *context, void *bc) { struct evict_wrapper *w = context; struct dm_buffer *b = le_to_buffer(le); + struct dm_buffer_cache *bcc = (struct dm_buffer_cache *)bc; - lh_next(w->lh, b->block); + lh_next(w->lh, b->block, b->special ? b->block : bcc->special); if (atomic_read(&b->hold_count)) return ER_DONT_EVICT; @@ -687,13 +746,13 @@ static struct dm_buffer *__cache_evict(struct dm_buffer_cache *bc, int list_mode struct lru_entry *le; struct dm_buffer *b; - le = lru_evict(&bc->lru[list_mode], __evict_pred, &w, bc->no_sleep); + le = lru_evict(&bc->lru[list_mode], __evict_pred, &w, bc->no_sleep, (void *) bc); if (!le) return NULL; b = le_to_buffer(le); /* __evict_pred will have locked the appropriate tree. */ - rb_erase(&b->node, &bc->trees[cache_index(b->block, bc->num_locks)].root); + rb_erase(&b->node, &bc->trees[cache_index_special(b->block, bc->num_locks, b->special ? b->block : bc->special)].root); return b; } @@ -741,7 +800,7 @@ static void __cache_mark_many(struct dm_buffer_cache *bc, int old_mode, int new_ struct evict_wrapper w = {.lh = lh, .pred = pred, .context = context}; while (true) { - le = lru_evict(&bc->lru[old_mode], __evict_pred, &w, bc->no_sleep); + le = lru_evict(&bc->lru[old_mode], __evict_pred, &w, bc->no_sleep, (void *)bc); if (!le) break; @@ -792,7 +851,7 @@ static void __cache_iterate(struct dm_buffer_cache *bc, int list_mode, do { struct dm_buffer *b = le_to_buffer(le); - lh_next(lh, b->block); + lh_next(lh, b->block, bc->special); switch (fn(b, context)) { case IT_NEXT: @@ -858,8 +917,8 @@ static bool cache_insert(struct dm_buffer_cache *bc, struct dm_buffer *b) return false; cache_write_lock(bc, b->block); - BUG_ON(atomic_read(&b->hold_count) != 1); - r = __cache_insert(&bc->trees[cache_index(b->block, bc->num_locks)].root, b); + //BUG_ON(atomic_read(&b->hold_count) != 1); + r = __cache_insert(&bc->trees[cache_index_special(b->block, bc->num_locks, bc->special)].root, b); if (r) lru_insert(&bc->lru[b->list_mode], &b->lru); cache_write_unlock(bc, b->block); @@ -867,14 +926,42 @@ static bool cache_insert(struct dm_buffer_cache *bc, struct dm_buffer *b) return r; } -/*--------------*/ +static bool cache_remove_nolru_new(struct dm_buffer_cache *bc, struct dm_buffer *b) +{ + bool r; + + cache_write_lock_special(bc, b->block, false); + cache_write_lock_special(bc, b->block, true); + + rb_erase(&b->node, &bc->trees[cache_index_special(b->block, bc->num_locks, bc->special)].root); + bc->special = b->block; + b->special = true; + r = __cache_insert(&bc->trees[cache_index_special(b->block, bc->num_locks, bc->special)].root, b); + + cache_write_unlock_special(bc, b->block, true); + cache_write_unlock_special(bc, b->block, false); + + return r; +} + +static bool cache_remove_nolru_old(struct dm_buffer_cache *bc, struct dm_buffer *b) +{ + bool r; + + cache_write_lock_special(bc, b->block, true); + cache_write_lock_special(bc, b->block, false); + + rb_erase(&b->node, &bc->trees[cache_index_special(b->block, bc->num_locks, bc->special)].root); + bc->special = ULONG_MAX; + b->special = false; + r = __cache_insert(&bc->trees[cache_index_special(b->block, bc->num_locks, bc->special)].root, b); + + cache_write_unlock_special(bc, b->block, false); + cache_write_unlock_special(bc, b->block, true); + + return r; +} -/* - * Removes buffer from cache, ownership of the buffer passes back to the caller. - * Fails if the hold_count is not one (ie. the caller holds the only reference). - * - * Not threadsafe. - */ static bool cache_remove(struct dm_buffer_cache *bc, struct dm_buffer *b) { bool r; @@ -885,7 +972,7 @@ static bool cache_remove(struct dm_buffer_cache *bc, struct dm_buffer *b) r = false; } else { r = true; - rb_erase(&b->node, &bc->trees[cache_index(b->block, bc->num_locks)].root); + rb_erase(&b->node, &bc->trees[cache_index_special(b->block, bc->num_locks, bc->special)].root); lru_remove(&bc->lru[b->list_mode], &b->lru); } @@ -1019,6 +1106,12 @@ struct dm_bufio_client { struct dm_buffer_cache cache; /* must be last member */ }; +void dm_setup_buffer_cache(struct dm_bufio_client *bc, unsigned long block) +{ + bc->cache.special = block; +} +EXPORT_SYMBOL_GPL(dm_setup_buffer_cache); + /*----------------------------------------------------------------*/ #define dm_bufio_in_request() (!!current->bio_list) @@ -1792,6 +1885,7 @@ static struct dm_buffer *__bufio_new(struct dm_bufio_client *c, sector_t block, b->read_error = 0; b->write_error = 0; b->list_mode = LIST_CLEAN; + b->special = (block == c->cache.special); if (nf == NF_FRESH) b->state = 0; @@ -2642,6 +2736,19 @@ void dm_bufio_set_sector_offset(struct dm_bufio_client *c, sector_t start) } EXPORT_SYMBOL_GPL(dm_bufio_set_sector_offset); +void dm_move_cache(struct dm_bufio_client *bc, unsigned long new) +{ + struct dm_buffer *b; + unsigned long old = bc->cache.special; + + b = cache_get_noref(&bc->cache, old); + cache_remove_nolru_old(&bc->cache, b); + + b = cache_get_noref(&bc->cache, new); + cache_remove_nolru_new(&bc->cache, b); +} +EXPORT_SYMBOL_GPL(dm_move_cache); + /*--------------------------------------------------------------*/ static unsigned int get_max_age_hz(void) diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c index 6022189c1388..f485504d40f3 100644 --- a/drivers/md/dm-thin-metadata.c +++ b/drivers/md/dm-thin-metadata.c @@ -747,6 +747,7 @@ static int __open_metadata(struct dm_pool_metadata *pmd) * root to avoid accessing broken btree. */ pmd->root = le64_to_cpu(disk_super->data_mapping_root); + dm_setup_bm_cache(pmd->bm, pmd->root); pmd->details_root = le64_to_cpu(disk_super->device_details_root); __setup_btree_details(pmd); @@ -837,6 +838,7 @@ static int __begin_transaction(struct dm_pool_metadata *pmd) disk_super = dm_block_data(sblock); pmd->time = le32_to_cpu(disk_super->time); pmd->root = le64_to_cpu(disk_super->data_mapping_root); + dm_setup_bm_cache(pmd->bm, pmd->root); pmd->details_root = le64_to_cpu(disk_super->device_details_root); pmd->trans_id = le64_to_cpu(disk_super->trans_id); pmd->flags = le32_to_cpu(disk_super->flags); @@ -1678,6 +1680,8 @@ static int __insert(struct dm_thin_device *td, dm_block_t block, if (r) return r; + dm_move_bm_cache(pmd->bm, pmd->root); + td->changed = true; if (inserted) td->mapped_blocks++; diff --git a/drivers/md/dm.h b/drivers/md/dm.h index f682295af91f..1b2da00d9016 100644 --- a/drivers/md/dm.h +++ b/drivers/md/dm.h @@ -232,12 +232,27 @@ static inline unsigned int dm_num_hash_locks(void) { unsigned int num_locks = roundup_pow_of_two(num_online_cpus()) << 1; - return min_t(unsigned int, num_locks, DM_HASH_LOCKS_MAX); + return min_t(unsigned int, num_locks, DM_HASH_LOCKS_MAX) + 32; } #define DM_HASH_LOCKS_MULT 4294967291ULL #define DM_HASH_LOCKS_SHIFT 6 +static inline unsigned int dm_hash_locks_index_special(sector_t block, + unsigned int num_locks, + unsigned long special) +{ + + + sector_t h1 = (block * DM_HASH_LOCKS_MULT) >> DM_HASH_LOCKS_SHIFT; + sector_t h2 = h1 >> DM_HASH_LOCKS_SHIFT; + + if (block == special) + return ((h1 ^ h2) & 31) + num_locks - 32; + + return (h1 ^ h2) & (num_locks - 33); +} + static inline unsigned int dm_hash_locks_index(sector_t block, unsigned int num_locks) { diff --git a/drivers/md/persistent-data/dm-block-manager.c b/drivers/md/persistent-data/dm-block-manager.c index 0e010e1204aa..da560f825298 100644 --- a/drivers/md/persistent-data/dm-block-manager.c +++ b/drivers/md/persistent-data/dm-block-manager.c @@ -414,6 +414,17 @@ struct dm_block_manager *dm_block_manager_create(struct block_device *bdev, } EXPORT_SYMBOL_GPL(dm_block_manager_create); +void dm_setup_bm_cache(struct dm_block_manager *bm, unsigned long block) +{ + dm_setup_buffer_cache(bm->bufio, block); +} +EXPORT_SYMBOL_GPL(dm_setup_bm_cache); + +void dm_move_bm_cache(struct dm_block_manager *bm, unsigned long block) +{ + dm_move_cache(bm->bufio, block); +} + void dm_block_manager_destroy(struct dm_block_manager *bm) { dm_bufio_client_destroy(bm->bufio); diff --git a/drivers/md/persistent-data/dm-block-manager.h b/drivers/md/persistent-data/dm-block-manager.h index f706d3de8d5a..25121bbc58d7 100644 --- a/drivers/md/persistent-data/dm-block-manager.h +++ b/drivers/md/persistent-data/dm-block-manager.h @@ -35,7 +35,9 @@ struct dm_block_manager; struct dm_block_manager *dm_block_manager_create( struct block_device *bdev, unsigned int block_size, unsigned int max_held_per_thread); +void dm_move_bm_cache(struct dm_block_manager *bm, unsigned long block); void dm_block_manager_destroy(struct dm_block_manager *bm); +void dm_setup_bm_cache(struct dm_block_manager *bm, unsigned long block); void dm_block_manager_reset(struct dm_block_manager *bm); unsigned int dm_bm_block_size(struct dm_block_manager *bm); diff --git a/include/linux/dm-bufio.h b/include/linux/dm-bufio.h index 75e7d8cbb532..d7d7a33cc685 100644 --- a/include/linux/dm-bufio.h +++ b/include/linux/dm-bufio.h @@ -71,6 +71,8 @@ void *dm_bufio_read(struct dm_bufio_client *c, sector_t block, void *dm_bufio_get(struct dm_bufio_client *c, sector_t block, struct dm_buffer **bp); +void dm_setup_buffer_cache(struct dm_bufio_client *bc, unsigned long block); + /* * Like dm_bufio_read, but don't read anything from the disk. It is * expected that the caller initializes the buffer and marks it dirty. @@ -139,6 +141,8 @@ int dm_bufio_issue_discard(struct dm_bufio_client *c, sector_t block, sector_t c */ void dm_bufio_forget(struct dm_bufio_client *c, sector_t block); +void dm_move_cache(struct dm_bufio_client *bc, unsigned long block); + /* * Free the given range of buffers. * This is just a hint, if the buffer is in use or dirty, this function -- 2.43.0

2 1

[PATCH OLK-6.6 0/3] fix CVE-2025-38449
by Wupeng Ma 10 Feb '26

10 Feb '26

fix CVE-2025-38449. Thomas Zimmermann (2): drm/gem: Acquire references on GEM handles for framebuffers drm/framebuffer: Acquire internal references on GEM handles Wupeng Ma (1): drm: fix kabi for struct drm_framebuffer drivers/gpu/drm/drm_framebuffer.c | 31 ++++++++++++++- drivers/gpu/drm/drm_gem.c | 64 ++++++++++++++++++++++++++----- drivers/gpu/drm/drm_internal.h | 2 + include/drm/drm_framebuffer.h | 9 +++++ 4 files changed, 95 insertions(+), 11 deletions(-) -- 2.43.0

2 4

[PATCH OLK-6.6] mm: slub: avoid wake up kswapd in set_track_prepare
by Wupeng Ma 10 Feb '26

10 Feb '26

From: yangshiguang <yangshiguang(a)xiaomi.com> stable inclusion from stable-v6.6.105 commit 522ffe298627cfe72539d72167c2e20e72b5e856 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/8442 CVE: CVE-2025-39843 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 850470a8413a8a78e772c4f6bd9fe81ec6bd5b0f ] set_track_prepare() can incur lock recursion. The issue is that it is called from hrtimer_start_range_ns holding the per_cpu(hrtimer_bases)[n].lock, but when enabled CONFIG_DEBUG_OBJECTS_TIMERS, may wake up kswapd in set_track_prepare, and try to hold the per_cpu(hrtimer_bases)[n].lock. Avoid deadlock caused by implicitly waking up kswapd by passing in allocation flags, which do not contain __GFP_KSWAPD_RECLAIM in the debug_objects_fill_pool() case. Inside stack depot they are processed by gfp_nested_mask(). Since ___slab_alloc() has preemption disabled, we mask out __GFP_DIRECT_RECLAIM from the flags there. The oops looks something like: BUG: spinlock recursion on CPU#3, swapper/3/0 lock: 0xffffff8a4bf29c80, .magic: dead4ead, .owner: swapper/3/0, .owner_cpu: 3 Hardware name: Qualcomm Technologies, Inc. Popsicle based on SM8850 (DT) Call trace: spin_bug+0x0 _raw_spin_lock_irqsave+0x80 hrtimer_try_to_cancel+0x94 task_contending+0x10c enqueue_dl_entity+0x2a4 dl_server_start+0x74 enqueue_task_fair+0x568 enqueue_task+0xac do_activate_task+0x14c ttwu_do_activate+0xcc try_to_wake_up+0x6c8 default_wake_function+0x20 autoremove_wake_function+0x1c __wake_up+0xac wakeup_kswapd+0x19c wake_all_kswapds+0x78 __alloc_pages_slowpath+0x1ac __alloc_pages_noprof+0x298 stack_depot_save_flags+0x6b0 stack_depot_save+0x14 set_track_prepare+0x5c ___slab_alloc+0xccc __kmalloc_cache_noprof+0x470 __set_page_owner+0x2bc post_alloc_hook[jt]+0x1b8 prep_new_page+0x28 get_page_from_freelist+0x1edc __alloc_pages_noprof+0x13c alloc_slab_page+0x244 allocate_slab+0x7c ___slab_alloc+0x8e8 kmem_cache_alloc_noprof+0x450 debug_objects_fill_pool+0x22c debug_object_activate+0x40 enqueue_hrtimer[jt]+0xdc hrtimer_start_range_ns+0x5f8 ... Signed-off-by: yangshiguang <yangshiguang(a)xiaomi.com> Fixes: 5cf909c553e9 ("mm/slub: use stackdepot to save stack trace in objects") Cc: stable(a)vger.kernel.org Signed-off-by: Vlastimil Babka <vbabka(a)suse.cz> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: mm/slub.c [Wupeng Ma: context conflicts] Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- mm/slub.c | 30 ++++++++++++++++++++---------- 1 file changed, 20 insertions(+), 10 deletions(-) diff --git a/mm/slub.c b/mm/slub.c index 25516a5cbf04d..7458569c81400 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -830,19 +830,19 @@ static struct track *get_track(struct kmem_cache *s, void *object, } #ifdef CONFIG_STACKDEPOT -static noinline depot_stack_handle_t set_track_prepare(void) +static noinline depot_stack_handle_t set_track_prepare(gfp_t gfp_flags) { depot_stack_handle_t handle; unsigned long entries[TRACK_ADDRS_COUNT]; unsigned int nr_entries; nr_entries = stack_trace_save(entries, ARRAY_SIZE(entries), 3); - handle = stack_depot_save(entries, nr_entries, GFP_NOWAIT); + handle = stack_depot_save(entries, nr_entries, gfp_flags); return handle; } #else -static inline depot_stack_handle_t set_track_prepare(void) +static inline depot_stack_handle_t set_track_prepare(gfp_t gfp_flags) { return 0; } @@ -864,9 +864,9 @@ static void set_track_update(struct kmem_cache *s, void *object, } static __always_inline void set_track(struct kmem_cache *s, void *object, - enum track_item alloc, unsigned long addr) + enum track_item alloc, unsigned long addr, gfp_t gfp_flags) { - depot_stack_handle_t handle = set_track_prepare(); + depot_stack_handle_t handle = set_track_prepare(gfp_flags); set_track_update(s, object, alloc, addr, handle); } @@ -1748,9 +1748,9 @@ static inline bool free_debug_processing(struct kmem_cache *s, static inline void slab_pad_check(struct kmem_cache *s, struct slab *slab) {} static inline int check_object(struct kmem_cache *s, struct slab *slab, void *object, u8 val) { return 1; } -static inline depot_stack_handle_t set_track_prepare(void) { return 0; } +static inline depot_stack_handle_t set_track_prepare(gfp_t gfp_flags) { return 0; } static inline void set_track(struct kmem_cache *s, void *object, - enum track_item alloc, unsigned long addr) {} + enum track_item alloc, unsigned long addr, gfp_t gfp_flags) {} static inline void add_full(struct kmem_cache *s, struct kmem_cache_node *n, struct slab *slab) {} static inline void remove_full(struct kmem_cache *s, struct kmem_cache_node *n, @@ -3232,9 +3232,14 @@ static void *___slab_alloc(struct kmem_cache *s, gfp_t gfpflags, int node, * For debug caches here we had to go through * alloc_single_from_partial() so just store the * tracking info and return the object. + * + * Due to disabled preemption we need to disallow + * blocking. The flags are further adjusted by + * gfp_nested_mask() in stack_depot itself. */ if (s->flags & SLAB_STORE_USER) - set_track(s, freelist, TRACK_ALLOC, addr); + set_track(s, freelist, TRACK_ALLOC, addr, + gfpflags & ~(__GFP_DIRECT_RECLAIM)); return freelist; } @@ -3266,7 +3271,8 @@ static void *___slab_alloc(struct kmem_cache *s, gfp_t gfpflags, int node, goto new_objects; if (s->flags & SLAB_STORE_USER) - set_track(s, freelist, TRACK_ALLOC, addr); + set_track(s, freelist, TRACK_ALLOC, addr, + gfpflags & ~(__GFP_DIRECT_RECLAIM)); return freelist; } @@ -3553,8 +3559,12 @@ static noinline void free_to_partial_list( unsigned long flags; depot_stack_handle_t handle = 0; + /* + * We cannot use GFP_NOWAIT as there are callsites where waking up + * kswapd could deadlock + */ if (s->flags & SLAB_STORE_USER) - handle = set_track_prepare(); + handle = set_track_prepare(__GFP_NOWARN); spin_lock_irqsave(&n->list_lock, flags); -- 2.43.0

2 1

[PATCH OLK-6.6] scsi: qla2xxx: Sanitize payload size to prevent member overflow
by Yongjian Sun 10 Feb '26

10 Feb '26

From: Jiasheng Jiang <jiashengjiangcool(a)gmail.com> mainline inclusion from mainline-v6.19-rc7 commit 19bc5f2a6962dfaa0e32d0e0bc2271993d85d414 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13592 CVE: CVE-2026-23059 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In qla27xx_copy_fpin_pkt() and qla27xx_copy_multiple_pkt(), the frame_size reported by firmware is used to calculate the copy length into item->iocb. However, the iocb member is defined as a fixed-size 64-byte array within struct purex_item. If the reported frame_size exceeds 64 bytes, subsequent memcpy calls will overflow the iocb member boundary. While extra memory might be allocated, this cross-member write is unsafe and triggers warnings under CONFIG_FORTIFY_SOURCE. Fix this by capping total_bytes to the size of the iocb member (64 bytes) before allocation and copying. This ensures all copies remain within the bounds of the destination structure member. Fixes: 875386b98857 ("scsi: qla2xxx: Add Unsolicited LS Request and Response Support for NVMe") Signed-off-by: Jiasheng Jiang <jiashengjiangcool(a)gmail.com> Reviewed-by: Himanshu Madhani <hmadhani2024(a)gmail.com> Link: https://patch.msgid.link/20260106205344.18031-1-jiashengjiangcool@gmail.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- drivers/scsi/qla2xxx/qla_isr.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c index d48007e18288..c025e853101d 100644 --- a/drivers/scsi/qla2xxx/qla_isr.c +++ b/drivers/scsi/qla2xxx/qla_isr.c @@ -878,6 +878,9 @@ qla27xx_copy_multiple_pkt(struct scsi_qla_host *vha, void **pkt, payload_size = sizeof(purex->els_frame_payload); } + if (total_bytes > sizeof(item->iocb.iocb)) + total_bytes = sizeof(item->iocb.iocb); + pending_bytes = total_bytes; no_bytes = (pending_bytes > payload_size) ? payload_size : pending_bytes; @@ -1163,6 +1166,10 @@ qla27xx_copy_fpin_pkt(struct scsi_qla_host *vha, void **pkt, total_bytes = (le16_to_cpu(purex->frame_size) & 0x0FFF) - PURX_ELS_HEADER_SIZE; + + if (total_bytes > sizeof(item->iocb.iocb)) + total_bytes = sizeof(item->iocb.iocb); + pending_bytes = total_bytes; entry_count = entry_count_remaining = purex->entry_count; no_bytes = (pending_bytes > sizeof(purex->els_frame_payload)) ? -- 2.39.2

2 1

[PATCH OLK-5.10] pNFS: Fix a deadlock when returning a delegation during open()
by Li Lingfeng 10 Feb '26

10 Feb '26

From: Trond Myklebust <trond.myklebust(a)hammerspace.com> mainline inclusion from mainline-v6.19-rc6 commit 857bf9056291a16785ae3be1d291026b2437fc48 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13583 CVE: CVE-2026-23050 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Ben Coddington reports seeing a hang in the following stack trace: 0 [ffffd0b50e1774e0] __schedule at ffffffff9ca05415 1 [ffffd0b50e177548] schedule at ffffffff9ca05717 2 [ffffd0b50e177558] bit_wait at ffffffff9ca061e1 3 [ffffd0b50e177568] __wait_on_bit at ffffffff9ca05cfb 4 [ffffd0b50e1775c8] out_of_line_wait_on_bit at ffffffff9ca05ea5 5 [ffffd0b50e177618] pnfs_roc at ffffffffc154207b [nfsv4] 6 [ffffd0b50e1776b8] _nfs4_proc_delegreturn at ffffffffc1506586 [nfsv4] 7 [ffffd0b50e177788] nfs4_proc_delegreturn at ffffffffc1507480 [nfsv4] 8 [ffffd0b50e1777f8] nfs_do_return_delegation at ffffffffc1523e41 [nfsv4] 9 [ffffd0b50e177838] nfs_inode_set_delegation at ffffffffc1524a75 [nfsv4] 10 [ffffd0b50e177888] nfs4_process_delegation at ffffffffc14f41dd [nfsv4] 11 [ffffd0b50e1778a0] _nfs4_opendata_to_nfs4_state at ffffffffc1503edf [nfsv4] 12 [ffffd0b50e1778c0] _nfs4_open_and_get_state at ffffffffc1504e56 [nfsv4] 13 [ffffd0b50e177978] _nfs4_do_open at ffffffffc15051b8 [nfsv4] 14 [ffffd0b50e1779f8] nfs4_do_open at ffffffffc150559c [nfsv4] 15 [ffffd0b50e177a80] nfs4_atomic_open at ffffffffc15057fb [nfsv4] 16 [ffffd0b50e177ad0] nfs4_file_open at ffffffffc15219be [nfsv4] 17 [ffffd0b50e177b78] do_dentry_open at ffffffff9c09e6ea 18 [ffffd0b50e177ba8] vfs_open at ffffffff9c0a082e 19 [ffffd0b50e177bd0] dentry_open at ffffffff9c0a0935 The issue is that the delegreturn is being asked to wait for a layout return that cannot complete because a state recovery was initiated. The state recovery cannot complete until the open() finishes processing the delegations it was given. The solution is to propagate the existing flags that indicate a non-blocking call to the function pnfs_roc(), so that it knows not to wait in this situation. Reported-by: Benjamin Coddington <bcodding(a)hammerspace.com> Fixes: 29ade5db1293 ("pNFS: Wait on outstanding layoutreturns to complete in pnfs_roc()") Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Conflicts: fs/nfs/pnfs.c [Commit 5468fc8298a9 ("NFSv4/pNFS: Do layout state recovery upon reboot") add definition of pnfs_layout_return_on_reboot() before pnfs_roc().] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfs/nfs4proc.c | 6 ++--- fs/nfs/pnfs.c | 58 +++++++++++++++++++++++++++++++++-------------- fs/nfs/pnfs.h | 17 ++++++-------- 3 files changed, 51 insertions(+), 30 deletions(-) diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c index 39a337c00c5a..4b3c614361bd 100644 --- a/fs/nfs/nfs4proc.c +++ b/fs/nfs/nfs4proc.c @@ -3771,8 +3771,8 @@ int nfs4_do_close(struct nfs4_state *state, gfp_t gfp_mask, int wait) calldata->res.seqid = calldata->arg.seqid; calldata->res.server = server; calldata->res.lr_ret = -NFS4ERR_NOMATCHING_LAYOUT; - calldata->lr.roc = pnfs_roc(state->inode, - &calldata->lr.arg, &calldata->lr.res, msg.rpc_cred); + calldata->lr.roc = pnfs_roc(state->inode, &calldata->lr.arg, + &calldata->lr.res, msg.rpc_cred, wait); if (calldata->lr.roc) { calldata->arg.lr_args = &calldata->lr.arg; calldata->res.lr_res = &calldata->lr.res; @@ -6566,7 +6566,7 @@ static int _nfs4_proc_delegreturn(struct inode *inode, const struct cred *cred, data->inode = nfs_igrab_and_active(inode); if (data->inode || issync) { data->lr.roc = pnfs_roc(inode, &data->lr.arg, &data->lr.res, - cred); + cred, issync); if (data->lr.roc) { data->args.lr_args = &data->lr.arg; data->res.lr_res = &data->lr.res; diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c index 47787a5f999d..de00ef7484d8 100644 --- a/fs/nfs/pnfs.c +++ b/fs/nfs/pnfs.c @@ -1420,10 +1420,9 @@ pnfs_commit_and_return_layout(struct inode *inode) return ret; } -bool pnfs_roc(struct inode *ino, - struct nfs4_layoutreturn_args *args, - struct nfs4_layoutreturn_res *res, - const struct cred *cred) +bool pnfs_roc(struct inode *ino, struct nfs4_layoutreturn_args *args, + struct nfs4_layoutreturn_res *res, const struct cred *cred, + bool sync) { struct nfs_inode *nfsi = NFS_I(ino); struct nfs_open_context *ctx; @@ -1434,7 +1433,7 @@ bool pnfs_roc(struct inode *ino, nfs4_stateid stateid; enum pnfs_iomode iomode = 0; bool layoutreturn = false, roc = false; - bool skip_read = false; + bool skip_read; if (!nfs_have_layout(ino)) return false; @@ -1447,20 +1446,14 @@ bool pnfs_roc(struct inode *ino, lo = NULL; goto out_noroc; } - pnfs_get_layout_hdr(lo); - if (test_bit(NFS_LAYOUT_RETURN_LOCK, &lo->plh_flags)) { - spin_unlock(&ino->i_lock); - rcu_read_unlock(); - wait_on_bit(&lo->plh_flags, NFS_LAYOUT_RETURN, - TASK_UNINTERRUPTIBLE); - pnfs_put_layout_hdr(lo); - goto retry; - } /* no roc if we hold a delegation */ + skip_read = false; if (nfs4_check_delegation(ino, FMODE_READ)) { - if (nfs4_check_delegation(ino, FMODE_WRITE)) + if (nfs4_check_delegation(ino, FMODE_WRITE)) { + lo = NULL; goto out_noroc; + } skip_read = true; } @@ -1469,12 +1462,43 @@ bool pnfs_roc(struct inode *ino, if (state == NULL) continue; /* Don't return layout if there is open file state */ - if (state->state & FMODE_WRITE) + if (state->state & FMODE_WRITE) { + lo = NULL; goto out_noroc; + } if (state->state & FMODE_READ) skip_read = true; } + if (skip_read) { + bool writes = false; + + list_for_each_entry(lseg, &lo->plh_segs, pls_list) { + if (lseg->pls_range.iomode != IOMODE_READ) { + writes = true; + break; + } + } + if (!writes) { + lo = NULL; + goto out_noroc; + } + } + + pnfs_get_layout_hdr(lo); + if (test_bit(NFS_LAYOUT_RETURN_LOCK, &lo->plh_flags)) { + if (!sync) { + pnfs_set_plh_return_info( + lo, skip_read ? IOMODE_RW : IOMODE_ANY, 0); + goto out_noroc; + } + spin_unlock(&ino->i_lock); + rcu_read_unlock(); + wait_on_bit(&lo->plh_flags, NFS_LAYOUT_RETURN, + TASK_UNINTERRUPTIBLE); + pnfs_put_layout_hdr(lo); + goto retry; + } list_for_each_entry_safe(lseg, next, &lo->plh_segs, pls_list) { if (skip_read && lseg->pls_range.iomode == IOMODE_READ) @@ -1514,7 +1538,7 @@ bool pnfs_roc(struct inode *ino, out_noroc: spin_unlock(&ino->i_lock); rcu_read_unlock(); - pnfs_layoutcommit_inode(ino, true); + pnfs_layoutcommit_inode(ino, sync); if (roc) { struct pnfs_layoutdriver_type *ld = NFS_SERVER(ino)->pnfs_curr_ld; if (ld->prepare_layoutreturn) diff --git a/fs/nfs/pnfs.h b/fs/nfs/pnfs.h index a7cf84a6673b..5adb7aad89a3 100644 --- a/fs/nfs/pnfs.h +++ b/fs/nfs/pnfs.h @@ -294,10 +294,9 @@ int pnfs_mark_matching_lsegs_return(struct pnfs_layout_hdr *lo, u32 seq); int pnfs_mark_layout_stateid_invalid(struct pnfs_layout_hdr *lo, struct list_head *lseg_list); -bool pnfs_roc(struct inode *ino, - struct nfs4_layoutreturn_args *args, - struct nfs4_layoutreturn_res *res, - const struct cred *cred); +bool pnfs_roc(struct inode *ino, struct nfs4_layoutreturn_args *args, + struct nfs4_layoutreturn_res *res, const struct cred *cred, + bool sync); int pnfs_roc_done(struct rpc_task *task, struct nfs4_layoutreturn_args **argpp, struct nfs4_layoutreturn_res **respp, int *ret); void pnfs_roc_release(struct nfs4_layoutreturn_args *args, @@ -760,12 +759,10 @@ pnfs_layoutcommit_outstanding(struct inode *inode) return false; } - -static inline bool -pnfs_roc(struct inode *ino, - struct nfs4_layoutreturn_args *args, - struct nfs4_layoutreturn_res *res, - const struct cred *cred) +static inline bool pnfs_roc(struct inode *ino, + struct nfs4_layoutreturn_args *args, + struct nfs4_layoutreturn_res *res, + const struct cred *cred, bool sync) { return false; } -- 2.52.0

2 1

[PATCH OLK-6.6] netfilter: nf_tables: remove redundant chain validation on register store
by Dong Chenchen 10 Feb '26

10 Feb '26

From: Pablo Neira Ayuso <pablo(a)netfilter.org> stable inclusion from stable-v6.6.119 commit a9c87779df20f0e07c0354aeecc52fc1a30ae798 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8497 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a67fd55f6a09f4119b7232c19e0f348fe31ab0db ] This validation predates the introduction of the state machine that determines when to enter slow path validation for error reporting. Currently, table validation is perform when: - new rule contains expressions that need validation. - new set element with jump/goto verdict. Validation on register store skips most checks with no basechains, still this walks the graph searching for loops and ensuring expressions are called from the right hook. Remove this. Fixes: a654de8fdc18 ("netfilter: nf_tables: fix chain dependency validation") Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: net/netfilter/nf_tables_api.c [commit 14fb07130c7d and 7ea0522ef81a are not backport] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/nf_tables_api.c | 11 ----------- 1 file changed, 11 deletions(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index ae06f28f0c55..0f0648986710 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -11007,21 +11007,10 @@ static int nft_validate_register_store(const struct nft_ctx *ctx, enum nft_data_types type, unsigned int len) { - int err; - switch (reg) { case NFT_REG_VERDICT: if (type != NFT_DATA_VERDICT) return -EINVAL; - - if (data != NULL && - (data->verdict.code == NFT_GOTO || - data->verdict.code == NFT_JUMP)) { - err = nft_chain_validate(ctx, data->verdict.chain); - if (err < 0) - return err; - } - return 0; default: if (type != NFT_DATA_VALUE) -- 2.25.1

2 1

[PATCH OLK-6.6] smc91x: fix broken irq-context in PREEMPT_RT
by Wupeng Ma 10 Feb '26

10 Feb '26

From: Yeoreum Yun <yeoreum.yun(a)arm.com> stable inclusion from stable-v6.6.120 commit ef277ae121b3249c99994652210a326b52d527b0 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8372 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 6402078bd9d1ed46e79465e1faaa42e3458f8a33 ] When smc91x.c is built with PREEMPT_RT, the following splat occurs in FVP_RevC: [ 13.055000] smc91x LNRO0003:00 eth0: link up, 10Mbps, half-duplex, lpa 0x0000 [ 13.062137] BUG: workqueue leaked atomic, lock or RCU: kworker/2:1[106] [ 13.062137] preempt=0x00000000 lock=0->0 RCU=0->1 workfn=mld_ifc_work [ 13.062266] C ** replaying previous printk message ** [ 13.062266] CPU: 2 UID: 0 PID: 106 Comm: kworker/2:1 Not tainted 6.18.0-dirty #179 PREEMPT_{RT,(full)} [ 13.062353] Hardware name: , BIOS [ 13.062382] Workqueue: mld mld_ifc_work [ 13.062469] Call trace: [ 13.062494] show_stack+0x24/0x40 (C) [ 13.062602] __dump_stack+0x28/0x48 [ 13.062710] dump_stack_lvl+0x7c/0xb0 [ 13.062818] dump_stack+0x18/0x34 [ 13.062926] process_scheduled_works+0x294/0x450 [ 13.063043] worker_thread+0x260/0x3d8 [ 13.063124] kthread+0x1c4/0x228 [ 13.063235] ret_from_fork+0x10/0x20 This happens because smc_special_trylock() disables IRQs even on PREEMPT_RT, but smc_special_unlock() does not restore IRQs on PREEMPT_RT. The reason is that smc_special_unlock() calls spin_unlock_irqrestore(), and rcu_read_unlock_bh() in __dev_queue_xmit() cannot invoke rcu_read_unlock() through __local_bh_enable_ip() when current->softirq_disable_cnt becomes zero. To address this issue, replace smc_special_trylock() with spin_trylock_irqsave(). Fixes: 342a93247e08 ("locking/spinlock: Provide RT variant header: <linux/spinlock_rt.h>") Signed-off-by: Yeoreum Yun <yeoreum.yun(a)arm.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://patch.msgid.link/20251217085115.1730036-1-yeoreum.yun@arm.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yuan can <yuancan(a)huawei.com> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- drivers/net/ethernet/smsc/smc91x.c | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c index 032eccf8eb428..7c2fdd02f1d34 100644 --- a/drivers/net/ethernet/smsc/smc91x.c +++ b/drivers/net/ethernet/smsc/smc91x.c @@ -515,15 +515,7 @@ static inline void smc_rcv(struct net_device *dev) * any other concurrent access and C would always interrupt B. But life * isn't that easy in a SMP world... */ -#define smc_special_trylock(lock, flags) \ -({ \ - int __ret; \ - local_irq_save(flags); \ - __ret = spin_trylock(lock); \ - if (!__ret) \ - local_irq_restore(flags); \ - __ret; \ -}) +#define smc_special_trylock(lock, flags) spin_trylock_irqsave(lock, flags) #define smc_special_lock(lock, flags) spin_lock_irqsave(lock, flags) #define smc_special_unlock(lock, flags) spin_unlock_irqrestore(lock, flags) #else -- 2.43.0

2 1

[PATCH OLK-6.6] net: usb: asix: validate PHY address before use
by Wupeng Ma 10 Feb '26

10 Feb '26

From: Deepanshu Kartikey <kartikey406(a)gmail.com> stable inclusion from stable-v6.6.120 commit 38722e69ee64dbb020028c93898d25d6f4c0e0b2 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8372 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a1e077a3f76eea0dc671ed6792e7d543946227e8 ] The ASIX driver reads the PHY address from the USB device via asix_read_phy_addr(). A malicious or faulty device can return an invalid address (>= PHY_MAX_ADDR), which causes a warning in mdiobus_get_phy(): addr 207 out of range WARNING: drivers/net/phy/mdio_bus.c:76 Validate the PHY address in asix_read_phy_addr() and remove the now-redundant check in ax88172a.c. Reported-by: syzbot+3d43c9066a5b54902232(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3d43c9066a5b54902232 Tested-by: syzbot+3d43c9066a5b54902232(a)syzkaller.appspotmail.com Fixes: 7e88b11a862a ("net: usb: asix: refactor asix_read_phy_addr() and handle errors on return") Link: https://lore.kernel.org/all/20251217085057.270704-1-kartikey406@gmail.com/T/ [v1] Signed-off-by: Deepanshu Kartikey <kartikey406(a)gmail.com> Reviewed-by: Andrew Lunn <andrew(a)lunn.ch> Link: https://patch.msgid.link/20251218011156.276824-1-kartikey406@gmail.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yuan can <yuancan(a)huawei.com> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- drivers/net/usb/asix_common.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/net/usb/asix_common.c b/drivers/net/usb/asix_common.c index 7fd763917ae2c..6ab3486072cb0 100644 --- a/drivers/net/usb/asix_common.c +++ b/drivers/net/usb/asix_common.c @@ -335,6 +335,11 @@ int asix_read_phy_addr(struct usbnet *dev, bool internal) offset = (internal ? 1 : 0); ret = buf[offset]; + if (ret >= PHY_MAX_ADDR) { + netdev_err(dev->net, "invalid PHY address: %d\n", ret); + return -ENODEV; + } + netdev_dbg(dev->net, "%s PHY address 0x%x\n", internal ? "internal" : "external", ret); -- 2.43.0

2 1

[PATCH OLK-6.6] mm: slub: avoid wake up kswapd in set_track_prepare
by Wupeng Ma 10 Feb '26

10 Feb '26

From: yangshiguang <yangshiguang(a)xiaomi.com> stable inclusion from stable-v6.6.105 commit 522ffe298627cfe72539d72167c2e20e72b5e856 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICYXVB CVE: CVE-2025-39843 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 850470a8413a8a78e772c4f6bd9fe81ec6bd5b0f ] set_track_prepare() can incur lock recursion. The issue is that it is called from hrtimer_start_range_ns holding the per_cpu(hrtimer_bases)[n].lock, but when enabled CONFIG_DEBUG_OBJECTS_TIMERS, may wake up kswapd in set_track_prepare, and try to hold the per_cpu(hrtimer_bases)[n].lock. Avoid deadlock caused by implicitly waking up kswapd by passing in allocation flags, which do not contain __GFP_KSWAPD_RECLAIM in the debug_objects_fill_pool() case. Inside stack depot they are processed by gfp_nested_mask(). Since ___slab_alloc() has preemption disabled, we mask out __GFP_DIRECT_RECLAIM from the flags there. The oops looks something like: BUG: spinlock recursion on CPU#3, swapper/3/0 lock: 0xffffff8a4bf29c80, .magic: dead4ead, .owner: swapper/3/0, .owner_cpu: 3 Hardware name: Qualcomm Technologies, Inc. Popsicle based on SM8850 (DT) Call trace: spin_bug+0x0 _raw_spin_lock_irqsave+0x80 hrtimer_try_to_cancel+0x94 task_contending+0x10c enqueue_dl_entity+0x2a4 dl_server_start+0x74 enqueue_task_fair+0x568 enqueue_task+0xac do_activate_task+0x14c ttwu_do_activate+0xcc try_to_wake_up+0x6c8 default_wake_function+0x20 autoremove_wake_function+0x1c __wake_up+0xac wakeup_kswapd+0x19c wake_all_kswapds+0x78 __alloc_pages_slowpath+0x1ac __alloc_pages_noprof+0x298 stack_depot_save_flags+0x6b0 stack_depot_save+0x14 set_track_prepare+0x5c ___slab_alloc+0xccc __kmalloc_cache_noprof+0x470 __set_page_owner+0x2bc post_alloc_hook[jt]+0x1b8 prep_new_page+0x28 get_page_from_freelist+0x1edc __alloc_pages_noprof+0x13c alloc_slab_page+0x244 allocate_slab+0x7c ___slab_alloc+0x8e8 kmem_cache_alloc_noprof+0x450 debug_objects_fill_pool+0x22c debug_object_activate+0x40 enqueue_hrtimer[jt]+0xdc hrtimer_start_range_ns+0x5f8 ... Signed-off-by: yangshiguang <yangshiguang(a)xiaomi.com> Fixes: 5cf909c553e9 ("mm/slub: use stackdepot to save stack trace in objects") Cc: stable(a)vger.kernel.org Signed-off-by: Vlastimil Babka <vbabka(a)suse.cz> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: mm/slub.c [Wupeng Ma: context conflicts] Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- mm/slub.c | 30 ++++++++++++++++++++---------- 1 file changed, 20 insertions(+), 10 deletions(-) diff --git a/mm/slub.c b/mm/slub.c index 25516a5cbf04d..7458569c81400 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -830,19 +830,19 @@ static struct track *get_track(struct kmem_cache *s, void *object, } #ifdef CONFIG_STACKDEPOT -static noinline depot_stack_handle_t set_track_prepare(void) +static noinline depot_stack_handle_t set_track_prepare(gfp_t gfp_flags) { depot_stack_handle_t handle; unsigned long entries[TRACK_ADDRS_COUNT]; unsigned int nr_entries; nr_entries = stack_trace_save(entries, ARRAY_SIZE(entries), 3); - handle = stack_depot_save(entries, nr_entries, GFP_NOWAIT); + handle = stack_depot_save(entries, nr_entries, gfp_flags); return handle; } #else -static inline depot_stack_handle_t set_track_prepare(void) +static inline depot_stack_handle_t set_track_prepare(gfp_t gfp_flags) { return 0; } @@ -864,9 +864,9 @@ static void set_track_update(struct kmem_cache *s, void *object, } static __always_inline void set_track(struct kmem_cache *s, void *object, - enum track_item alloc, unsigned long addr) + enum track_item alloc, unsigned long addr, gfp_t gfp_flags) { - depot_stack_handle_t handle = set_track_prepare(); + depot_stack_handle_t handle = set_track_prepare(gfp_flags); set_track_update(s, object, alloc, addr, handle); } @@ -1748,9 +1748,9 @@ static inline bool free_debug_processing(struct kmem_cache *s, static inline void slab_pad_check(struct kmem_cache *s, struct slab *slab) {} static inline int check_object(struct kmem_cache *s, struct slab *slab, void *object, u8 val) { return 1; } -static inline depot_stack_handle_t set_track_prepare(void) { return 0; } +static inline depot_stack_handle_t set_track_prepare(gfp_t gfp_flags) { return 0; } static inline void set_track(struct kmem_cache *s, void *object, - enum track_item alloc, unsigned long addr) {} + enum track_item alloc, unsigned long addr, gfp_t gfp_flags) {} static inline void add_full(struct kmem_cache *s, struct kmem_cache_node *n, struct slab *slab) {} static inline void remove_full(struct kmem_cache *s, struct kmem_cache_node *n, @@ -3232,9 +3232,14 @@ static void *___slab_alloc(struct kmem_cache *s, gfp_t gfpflags, int node, * For debug caches here we had to go through * alloc_single_from_partial() so just store the * tracking info and return the object. + * + * Due to disabled preemption we need to disallow + * blocking. The flags are further adjusted by + * gfp_nested_mask() in stack_depot itself. */ if (s->flags & SLAB_STORE_USER) - set_track(s, freelist, TRACK_ALLOC, addr); + set_track(s, freelist, TRACK_ALLOC, addr, + gfpflags & ~(__GFP_DIRECT_RECLAIM)); return freelist; } @@ -3266,7 +3271,8 @@ static void *___slab_alloc(struct kmem_cache *s, gfp_t gfpflags, int node, goto new_objects; if (s->flags & SLAB_STORE_USER) - set_track(s, freelist, TRACK_ALLOC, addr); + set_track(s, freelist, TRACK_ALLOC, addr, + gfpflags & ~(__GFP_DIRECT_RECLAIM)); return freelist; } @@ -3553,8 +3559,12 @@ static noinline void free_to_partial_list( unsigned long flags; depot_stack_handle_t handle = 0; + /* + * We cannot use GFP_NOWAIT as there are callsites where waking up + * kswapd could deadlock + */ if (s->flags & SLAB_STORE_USER) - handle = set_track_prepare(); + handle = set_track_prepare(__GFP_NOWARN); spin_lock_irqsave(&n->list_lock, flags); -- 2.43.0

2 1

[PATCH OLK-6.6] libceph: return the handler error from mon_handle_auth_done()
by Wupeng Ma 10 Feb '26

10 Feb '26

From: Ilya Dryomov <idryomov(a)gmail.com> stable inclusion from stable-v6.6.121 commit e097cd858196b1914309e7e3d79b4fa79383754d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13501 CVE: CVE-2026-22992 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e84b48d31b5008932c0a0902982809fbaa1d3b70 upstream. Currently any error from ceph_auth_handle_reply_done() is propagated via finish_auth() but isn't returned from mon_handle_auth_done(). This results in higher layers learning that (despite the monitor considering us to be successfully authenticated) something went wrong in the authentication phase and reacting accordingly, but msgr2 still trying to proceed with establishing the session in the background. In the case of secure mode this can trigger a WARN in setup_crypto() and later lead to a NULL pointer dereference inside of prepare_auth_signature(). Cc: stable(a)vger.kernel.org Fixes: cd1a677cad99 ("libceph, ceph: implement msgr2.1 protocol (crc and secure modes)") Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko(a)ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- net/ceph/mon_client.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ceph/mon_client.c b/net/ceph/mon_client.c index 68f9552931776..0f8b8335981cf 100644 --- a/net/ceph/mon_client.c +++ b/net/ceph/mon_client.c @@ -1417,7 +1417,7 @@ static int mon_handle_auth_done(struct ceph_connection *con, if (!ret) finish_hunting(monc); mutex_unlock(&monc->mutex); - return 0; + return ret; } static int mon_handle_auth_bad_method(struct ceph_connection *con, -- 2.43.0

2 1

[PATCH OLK-6.6] devlink: rate: Unset parent pointer in devl_rate_nodes_destroy
by Wupeng Ma 10 Feb '26

10 Feb '26

From: Shay Drory <shayd(a)nvidia.com> stable inclusion from stable-v6.6.118 commit 715d9cda646a8a38ea8b2bb5afb679a7464055e2 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/11217 CVE: CVE-2025-40251 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f94c1a114ac209977bdf5ca841b98424295ab1f0 ] The function devl_rate_nodes_destroy is documented to "Unset parent for all rate objects". However, it was only calling the driver-specific `rate_leaf_parent_set` or `rate_node_parent_set` ops and decrementing the parent's refcount, without actually setting the `devlink_rate->parent` pointer to NULL. This leaves a dangling pointer in the `devlink_rate` struct, which cause refcount error in netdevsim[1] and mlx5[2]. In addition, this is inconsistent with the behavior of `devlink_nl_rate_parent_node_set`, where the parent pointer is correctly cleared. This patch fixes the issue by explicitly setting `devlink_rate->parent` to NULL after notifying the driver, thus fulfilling the function's documented behavior for all rate objects. [1] repro steps: echo 1 > /sys/bus/netdevsim/new_device devlink dev eswitch set netdevsim/netdevsim1 mode switchdev echo 1 > /sys/bus/netdevsim/devices/netdevsim1/sriov_numvfs devlink port function rate add netdevsim/netdevsim1/test_node devlink port function rate set netdevsim/netdevsim1/128 parent test_node echo 1 > /sys/bus/netdevsim/del_device dmesg: refcount_t: decrement hit 0; leaking memory. WARNING: CPU: 8 PID: 1530 at lib/refcount.c:31 refcount_warn_saturate+0x42/0xe0 CPU: 8 UID: 0 PID: 1530 Comm: bash Not tainted 6.18.0-rc4+ #1 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:refcount_warn_saturate+0x42/0xe0 Call Trace: <TASK> devl_rate_leaf_destroy+0x8d/0x90 __nsim_dev_port_del+0x6c/0x70 [netdevsim] nsim_dev_reload_destroy+0x11c/0x140 [netdevsim] nsim_drv_remove+0x2b/0xb0 [netdevsim] device_release_driver_internal+0x194/0x1f0 bus_remove_device+0xc6/0x130 device_del+0x159/0x3c0 device_unregister+0x1a/0x60 del_device_store+0x111/0x170 [netdevsim] kernfs_fop_write_iter+0x12e/0x1e0 vfs_write+0x215/0x3d0 ksys_write+0x5f/0xd0 do_syscall_64+0x55/0x10f0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 [2] devlink dev eswitch set pci/0000:08:00.0 mode switchdev devlink port add pci/0000:08:00.0 flavour pcisf pfnum 0 sfnum 1000 devlink port function rate add pci/0000:08:00.0/group1 devlink port function rate set pci/0000:08:00.0/32768 parent group1 modprobe -r mlx5_ib mlx5_fwctl mlx5_core dmesg: refcount_t: decrement hit 0; leaking memory. WARNING: CPU: 7 PID: 16151 at lib/refcount.c:31 refcount_warn_saturate+0x42/0xe0 CPU: 7 UID: 0 PID: 16151 Comm: bash Not tainted 6.17.0-rc7_for_upstream_min_debug_2025_10_02_12_44 #1 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 RIP: 0010:refcount_warn_saturate+0x42/0xe0 Call Trace: <TASK> devl_rate_leaf_destroy+0x8d/0x90 mlx5_esw_offloads_devlink_port_unregister+0x33/0x60 [mlx5_core] mlx5_esw_offloads_unload_rep+0x3f/0x50 [mlx5_core] mlx5_eswitch_unload_sf_vport+0x40/0x90 [mlx5_core] mlx5_sf_esw_event+0xc4/0x120 [mlx5_core] notifier_call_chain+0x33/0xa0 blocking_notifier_call_chain+0x3b/0x50 mlx5_eswitch_disable_locked+0x50/0x110 [mlx5_core] mlx5_eswitch_disable+0x63/0x90 [mlx5_core] mlx5_unload+0x1d/0x170 [mlx5_core] mlx5_uninit_one+0xa2/0x130 [mlx5_core] remove_one+0x78/0xd0 [mlx5_core] pci_device_remove+0x39/0xa0 device_release_driver_internal+0x194/0x1f0 unbind_store+0x99/0xa0 kernfs_fop_write_iter+0x12e/0x1e0 vfs_write+0x215/0x3d0 ksys_write+0x5f/0xd0 do_syscall_64+0x53/0x1f0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 Fixes: d75559845078 ("devlink: Allow setting parent node of rate objects") Signed-off-by: Shay Drory <shayd(a)nvidia.com> Reviewed-by: Carolina Jubran <cjubran(a)nvidia.com> Signed-off-by: Tariq Toukan <tariqt(a)nvidia.com> Link: https://patch.msgid.link/1763381149-1234377-1-git-send-email-tariqt@nvidia.… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- net/devlink/rate.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/devlink/rate.c b/net/devlink/rate.c index dff1593b8406a..e7e80af4abaf6 100644 --- a/net/devlink/rate.c +++ b/net/devlink/rate.c @@ -702,13 +702,15 @@ void devl_rate_nodes_destroy(struct devlink *devlink) if (!devlink_rate->parent) continue; - refcount_dec(&devlink_rate->parent->refcnt); if (devlink_rate_is_leaf(devlink_rate)) ops->rate_leaf_parent_set(devlink_rate, NULL, devlink_rate->priv, NULL, NULL); else if (devlink_rate_is_node(devlink_rate)) ops->rate_node_parent_set(devlink_rate, NULL, devlink_rate->priv, NULL, NULL); + + refcount_dec(&devlink_rate->parent->refcnt); + devlink_rate->parent = NULL; } list_for_each_entry_safe(devlink_rate, tmp, &devlink->rate_list, list) { if (devlink_rate_is_node(devlink_rate)) { -- 2.43.0

2 1

[PATCH OLK-6.6 0/3] fix CVE-2025-38449
by Wupeng Ma 10 Feb '26

10 Feb '26

fix CVE-2025-38449. Thomas Zimmermann (2): drm/gem: Acquire references on GEM handles for framebuffers drm/framebuffer: Acquire internal references on GEM handles Wupeng Ma (1): drm: fix kabi for struct drm_framebuffer drivers/gpu/drm/drm_framebuffer.c | 31 ++++++++++++++- drivers/gpu/drm/drm_gem.c | 64 ++++++++++++++++++++++++++----- drivers/gpu/drm/drm_internal.h | 2 + include/drm/drm_framebuffer.h | 9 +++++ 4 files changed, 95 insertions(+), 11 deletions(-) -- 2.43.0

2 4

[PATCH OLK-6.6 v2 0/4] bpf: sockmap fixes
by Dong Chenchen 10 Feb '26

10 Feb '26

patch of sockmap fixes Dong Chenchen (1): Revert "bpf, sockmap: Add sk_rmem_alloc check for sockmap" Levi Zim (2): skmsg: Return copied bytes in sk_msg_memcopy_from_iter tcp_bpf: Fix copied value in tcp_bpf_sendmsg Zijian Zhang (1): tcp_bpf: Add sk_rmem_alloc related logic for tcp_bpf ingress redirection include/linux/skmsg.h | 11 ++++++++--- net/core/skmsg.c | 11 ++++------- net/ipv4/tcp_bpf.c | 23 +++++++---------------- 3 files changed, 19 insertions(+), 26 deletions(-) -- 2.25.1

2 5

[PATCH OLK-6.6] tracing: Add recursion protection in kernel stack trace recording
by Tengda Wu 10 Feb '26

10 Feb '26

From: Steven Rostedt <rostedt(a)goodmis.org> mainline inclusion from mainline-v6.19-rc5 commit 5f1ef0dfcb5b7f4a91a9b0e0ba533efd9f7e2cdb category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8496 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- A bug was reported about an infinite recursion caused by tracing the rcu events with the kernel stack trace trigger enabled. The stack trace code called back into RCU which then called the stack trace again. Expand the ftrace recursion protection to add a set of bits to protect events from recursion. Each bit represents the context that the event is in (normal, softirq, interrupt and NMI). Have the stack trace code use the interrupt context to protect against recursion. Note, the bug showed an issue in both the RCU code as well as the tracing stacktrace code. This only handles the tracing stack trace side of the bug. The RCU fix will be handled separately. Link: https://lore.kernel.org/all/20260102122807.7025fc87@gandalf.local.home/ Cc: stable(a)vger.kernel.org Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Cc: Joel Fernandes <joel(a)joelfernandes.org> Cc: "Paul E. McKenney" <paulmck(a)kernel.org> Cc: Boqun Feng <boqun.feng(a)gmail.com> Link: https://patch.msgid.link/20260105203141.515cd49f@gandalf.local.home Reported-by: Yao Kai <yaokai34(a)huawei.com> Tested-by: Yao Kai <yaokai34(a)huawei.com> Fixes: 5f5fa7ea89dc ("rcu: Don't use negative nesting depth in __rcu_read_unlock()") Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Conflicts: kernel/trace/trace.c [Context conflict] Signed-off-by: Tengda Wu <wutengda(a)huaweicloud.com> --- include/linux/trace_recursion.h | 9 +++++++++ kernel/trace/trace.c | 6 ++++++ 2 files changed, 15 insertions(+) diff --git a/include/linux/trace_recursion.h b/include/linux/trace_recursion.h index d48cd92d2364..67e6a9923d56 100644 --- a/include/linux/trace_recursion.h +++ b/include/linux/trace_recursion.h @@ -34,6 +34,13 @@ enum { TRACE_INTERNAL_SIRQ_BIT, TRACE_INTERNAL_TRANSITION_BIT, + /* Internal event use recursion bits */ + TRACE_INTERNAL_EVENT_BIT, + TRACE_INTERNAL_EVENT_NMI_BIT, + TRACE_INTERNAL_EVENT_IRQ_BIT, + TRACE_INTERNAL_EVENT_SIRQ_BIT, + TRACE_INTERNAL_EVENT_TRANSITION_BIT, + TRACE_BRANCH_BIT, /* * Abuse of the trace_recursion. @@ -97,6 +104,8 @@ enum { #define TRACE_LIST_START TRACE_INTERNAL_BIT +#define TRACE_EVENT_START TRACE_INTERNAL_EVENT_BIT + #define TRACE_CONTEXT_MASK ((1 << (TRACE_LIST_START + TRACE_CONTEXT_BITS)) - 1) /* diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c index b0751e52d40e..4c9bcb08d947 100644 --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -3126,6 +3126,11 @@ static void __ftrace_trace_stack(struct trace_buffer *buffer, struct ftrace_stack *fstack; struct stack_entry *entry; int stackidx; + int bit; + + bit = trace_test_and_set_recursion(_THIS_IP_, _RET_IP_, TRACE_EVENT_START); + if (bit < 0) + return; /* * Add one, for this function and the call to save_stack_trace() @@ -3181,6 +3186,7 @@ static void __ftrace_trace_stack(struct trace_buffer *buffer, /* Again, don't let gcc optimize things here */ barrier(); __this_cpu_dec(ftrace_stack_reserve); + trace_clear_recursion(bit); preempt_enable_notrace(); } -- 2.34.1

2 2

[PATCH OLK-5.10] tracing: Add recursion protection in kernel stack trace recording
by Tengda Wu 10 Feb '26

10 Feb '26

From: Steven Rostedt <rostedt(a)goodmis.org> mainline inclusion from mainline-v6.19-rc5 commit 5f1ef0dfcb5b7f4a91a9b0e0ba533efd9f7e2cdb category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8496 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- A bug was reported about an infinite recursion caused by tracing the rcu events with the kernel stack trace trigger enabled. The stack trace code called back into RCU which then called the stack trace again. Expand the ftrace recursion protection to add a set of bits to protect events from recursion. Each bit represents the context that the event is in (normal, softirq, interrupt and NMI). Have the stack trace code use the interrupt context to protect against recursion. Note, the bug showed an issue in both the RCU code as well as the tracing stacktrace code. This only handles the tracing stack trace side of the bug. The RCU fix will be handled separately. Link: https://lore.kernel.org/all/20260102122807.7025fc87@gandalf.local.home/ Cc: stable(a)vger.kernel.org Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Cc: Joel Fernandes <joel(a)joelfernandes.org> Cc: "Paul E. McKenney" <paulmck(a)kernel.org> Cc: Boqun Feng <boqun.feng(a)gmail.com> Link: https://patch.msgid.link/20260105203141.515cd49f@gandalf.local.home Reported-by: Yao Kai <yaokai34(a)huawei.com> Tested-by: Yao Kai <yaokai34(a)huawei.com> Fixes: 5f5fa7ea89dc ("rcu: Don't use negative nesting depth in __rcu_read_unlock()") Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Conflicts: kernel/trace/trace.c kernel/trace/trace.h include/linux/trace_recursion.h [The conflicts are due to we did not backport 0264c8c9e1b5 ("ftrace: Move the recursion testing into global headers"), which is a cleanup patch] Signed-off-by: Tengda Wu <wutengda(a)huaweicloud.com> --- kernel/trace/trace.c | 6 ++++++ kernel/trace/trace.h | 9 +++++++++ 2 files changed, 15 insertions(+) diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c index 6c5a503987e7..50dda48f6e6b 100644 --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -2994,6 +2994,11 @@ static void __ftrace_trace_stack(struct trace_buffer *buffer, struct ftrace_stack *fstack; struct stack_entry *entry; int stackidx; + int bit; + + bit = trace_test_and_set_recursion(TRACE_EVENT_START); + if (bit < 0) + return; /* * Add one, for this function and the call to save_stack_trace() @@ -3049,6 +3054,7 @@ static void __ftrace_trace_stack(struct trace_buffer *buffer, /* Again, don't let gcc optimize things here */ barrier(); __this_cpu_dec(ftrace_stack_reserve); + trace_clear_recursion(bit); preempt_enable_notrace(); } diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h index 139d4e47489d..27e9d7659a48 100644 --- a/kernel/trace/trace.h +++ b/kernel/trace/trace.h @@ -599,6 +599,13 @@ enum { TRACE_INTERNAL_SIRQ_BIT, TRACE_INTERNAL_TRANSITION_BIT, + /* Internal event use recursion bits */ + TRACE_INTERNAL_EVENT_BIT, + TRACE_INTERNAL_EVENT_NMI_BIT, + TRACE_INTERNAL_EVENT_IRQ_BIT, + TRACE_INTERNAL_EVENT_SIRQ_BIT, + TRACE_INTERNAL_EVENT_TRANSITION_BIT, + TRACE_BRANCH_BIT, /* * Abuse of the trace_recursion. @@ -659,6 +666,8 @@ enum { #define TRACE_LIST_START TRACE_INTERNAL_BIT +#define TRACE_EVENT_START TRACE_INTERNAL_EVENT_BIT + #define TRACE_CONTEXT_MASK ((1 << (TRACE_LIST_START + TRACE_CONTEXT_BITS)) - 1) enum { -- 2.34.1

2 1

[PATCH OLK-6.6 00/12] arm_mpam: Introduce the Narrow-PARTID feature for MPAM driver
by Zeng Heng 09 Feb '26

09 Feb '26

The narrow-partid feature in MPAM allows for a more efficient use of PARTIDs by enabling a many-to-one mapping of reqpartids (requested PARTIDs) to intpartids (internal PARTIDs). This mapping reduces the number of unique PARTIDs needed, thus allowing more tasks or processes to be monitored and managed with the available resources. For a mixture of MSCs system, for MSCs that do not support narrow-partid, we use the PARTIDs exceeding the number of closids as reqPARTIDs for expanding the monitoring groups. Therefore, we will expand the information contained in the RMID, so that it includes not only PMG, but also reqPARTIDs information. The new RMID would be like: RMID = (reqPARTID << shift | PMG). Each control group has m (req)PARTIDs, which are used to expand the number of monitoring groups under one control group. Therefore, the number of monitoring groups is no longer limited by the range of MPAM's PMG, which enhances the extensibility of the system's monitoring capabilities. Dave Martin (1): arm_mpam: Set INTERNAL as needed when setting MSC controls Zeng Heng (11): arm_mpam: Introduce the definitions of intPARTID and reqPARTID arm_mpam: Expand the composition of RMID arm_mpam: Automatically synchronize the configuration of all sub-monitoring groups fs/resctrl: Implementing the dynamic allocation of reqPARTIDs fs/resctrl: Deploy resctrl_arch_expand_rmid() arm64/mpam: Add limitation for the Narrow-PARTID feature fs/resctrl: Fix limit of root group Revert "fs/resctrl: Fix configuration to wrong control group when CDP is enabled" arm64/mpam: Fix rdtgroup_init_res() arm64/mpam: Add mpam_sync_config() fs/resctrl: rdt_destroy_limbo() after umount arch/x86/include/asm/resctrl.h | 11 +- drivers/platform/mpam/mpam_devices.c | 86 ++++- drivers/platform/mpam/mpam_internal.h | 7 +- drivers/platform/mpam/mpam_resctrl.c | 454 +++++++++++++++++++++----- fs/resctrl/ctrlmondata.c | 28 +- fs/resctrl/monitor.c | 50 ++- fs/resctrl/rdtgroup.c | 38 ++- include/linux/arm_mpam.h | 17 +- include/linux/resctrl.h | 18 + 9 files changed, 569 insertions(+), 140 deletions(-) -- 2.25.1

2 13

[PATCH v3 OLK-6.6 0/4] Fix CVE-2025-21696
by Ze Zuo 09 Feb '26

09 Feb '26

Fix CVE-2025-21696. change since v2: - add debug fix patch for second patch. David Hildenbrand (1): mm/mremap: fix WARN with uffd that has remap events disabled Lokesh Gidra (1): userfaultfd: move userfaultfd_ctx struct to header file Ryan Roberts (1): mm: clear uffd-wp PTE/PMD state on mremap() Ze Zuo (1): userfaultfd: fix kabi breakage due to struct userfaultfd_ctx fs/userfaultfd.c | 39 ------------------- include/linux/userfaultfd_k.h | 53 +++++++++++++++++++++++++ mm/huge_memory.c | 12 ++++++ mm/hugetlb.c | 14 ++++++- mm/mremap.c | 73 ++++++++++++++++++++++++++--------- 5 files changed, 132 insertions(+), 59 deletions(-) -- 2.25.1

2 5

[PATCH v4 0/3] arm64/riscv: Add support for crashkernel CMA reservation
by Jinjie Ruan 09 Feb '26

09 Feb '26

Add support for crashkernel CMA reservation for arm64 and riscv. By the way, exclude crash kernel memory in crash core to avoid duplication. Changes in v4: - Move the size calculation (and the realloc if needed) into the generic crash. Changs in v3: - Exclude crash kernel memory in crash core as Mike suggested. - Add acked-by. Jinjie Ruan (3): crash: Exclude crash kernel memory in crash core arm64: kexec: Add support for crashkernel CMA reservation riscv: kexec: Add support for crashkernel CMA reservation .../admin-guide/kernel-parameters.txt | 16 ++-- arch/arm64/include/asm/kexec.h | 9 ++ arch/arm64/kernel/machine_kexec_file.c | 43 ++++----- arch/arm64/mm/init.c | 5 +- arch/loongarch/include/asm/kexec.h | 9 +- arch/loongarch/kernel/machine_kexec_file.c | 41 +++----- arch/powerpc/include/asm/kexec.h | 13 +++ arch/powerpc/kexec/crash.c | 48 ++++++---- arch/powerpc/kexec/file_load_64.c | 17 ++-- arch/powerpc/kexec/ranges.c | 18 +--- arch/riscv/include/asm/kexec.h | 8 ++ arch/riscv/kernel/machine_kexec_file.c | 39 ++++---- arch/riscv/mm/init.c | 5 +- arch/x86/include/asm/kexec.h | 7 ++ arch/x86/kernel/crash.c | 95 ++----------------- include/linux/crash_core.h | 89 ++++++++++++++++- kernel/crash_core.c | 71 ++++++++++++-- 17 files changed, 307 insertions(+), 226 deletions(-) -- 2.34.1

1 3

[PATCH OLK-6.6 0/3] CVE-2025-38491
by Zhang Changzhong 07 Feb '26

07 Feb '26

Paolo Abeni (3): mptcp: make fallback action and fallback decision atomic mptcp: plug races between subflow fail and subflow creation mptcp: avoid deadlock on fallback while reinjecting net/mptcp/options.c | 3 ++- net/mptcp/pm.c | 8 +++++++- net/mptcp/protocol.c | 50 ++++++++++++++++++++++++++++++++++++++++++-------- net/mptcp/protocol.h | 29 ++++++++++++++++++++++------- net/mptcp/subflow.c | 30 +++++++++++++++++++----------- 5 files changed, 92 insertions(+), 28 deletions(-) -- 2.9.5

2 4

[PATCH OLK-6.6 0/5] CVE-2025-39948
by Zhang Changzhong 07 Feb '26

07 Feb '26

Jacob Keller (1): ice: fix Rx page leak on multi-buffer frames Larysa Zaremba (1): ice: Introduce ice_xdp_buff Maciej Fijalkowski (2): ice: gather page_count()'s of each frag right before XDP prog call ice: stop storing XDP verdict within ice_rx_buf Michal Kubiak (1): ice: fix incorrect counter for buffer allocation failures drivers/net/ethernet/intel/ice/ice_txrx.c | 122 ++++++++++++++++---------- drivers/net/ethernet/intel/ice/ice_txrx.h | 20 +++-- drivers/net/ethernet/intel/ice/ice_txrx_lib.h | 53 +++-------- 3 files changed, 99 insertions(+), 96 deletions(-) -- 2.9.5

2 6

[PATCH OLK-6.6] netfilter: ctnetlink: remove refcounting in expectation dumpers
by Zhang Changzhong 07 Feb '26

07 Feb '26

From: Florian Westphal <fw(a)strlen.de> mainline inclusion from mainline-v6.17-rc2 commit 1492e3dcb2be3aa46d1963da96aa9593e4e4db5a category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/8961 CVE: CVE-2025-39764 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Same pattern as previous patch: do not keep the expectation object alive via refcount, only store a cookie value and then use that as the skip hint for dump resumption. AFAICS this has the same issue as the one resolved in the conntrack dumper, when we do if (!refcount_inc_not_zero(&exp->use)) to increment the refcount, there is a chance that exp == last, which causes a double-increment of the refcount and subsequent memory leak. Fixes: cf6994c2b981 ("[NETFILTER]: nf_conntrack_netlink: sync expectation dumping with conntrack table dumping") Fixes: e844a928431f ("netfilter: ctnetlink: allow to dump expectation per master conntrack") Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/netfilter/nf_conntrack_netlink.c | 41 +++++++++++++++--------------------- 1 file changed, 17 insertions(+), 24 deletions(-) diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c index 282e964..698e79c 100644 --- a/net/netfilter/nf_conntrack_netlink.c +++ b/net/netfilter/nf_conntrack_netlink.c @@ -3138,23 +3138,27 @@ ctnetlink_expect_event(unsigned int events, const struct nf_exp_event *item) return 0; } #endif -static int ctnetlink_exp_done(struct netlink_callback *cb) + +static unsigned long ctnetlink_exp_id(const struct nf_conntrack_expect *exp) { - if (cb->args[1]) - nf_ct_expect_put((struct nf_conntrack_expect *)cb->args[1]); - return 0; + unsigned long id = (unsigned long)exp; + + id += nf_ct_get_id(exp->master); + id += exp->class; + + return id ? id : 1; } static int ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb) { struct net *net = sock_net(skb->sk); - struct nf_conntrack_expect *exp, *last; struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); u_int8_t l3proto = nfmsg->nfgen_family; + unsigned long last_id = cb->args[1]; + struct nf_conntrack_expect *exp; rcu_read_lock(); - last = (struct nf_conntrack_expect *)cb->args[1]; for (; cb->args[0] < nf_ct_expect_hsize; cb->args[0]++) { restart: hlist_for_each_entry_rcu(exp, &nf_ct_expect_hash[cb->args[0]], @@ -3166,7 +3170,7 @@ ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb) continue; if (cb->args[1]) { - if (exp != last) + if (ctnetlink_exp_id(exp) != last_id) continue; cb->args[1] = 0; } @@ -3175,9 +3179,7 @@ ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb) cb->nlh->nlmsg_seq, IPCTNL_MSG_EXP_NEW, exp) < 0) { - if (!refcount_inc_not_zero(&exp->use)) - continue; - cb->args[1] = (unsigned long)exp; + cb->args[1] = ctnetlink_exp_id(exp); goto out; } } @@ -3188,32 +3190,30 @@ ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb) } out: rcu_read_unlock(); - if (last) - nf_ct_expect_put(last); - return skb->len; } static int ctnetlink_exp_ct_dump_table(struct sk_buff *skb, struct netlink_callback *cb) { - struct nf_conntrack_expect *exp, *last; struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); struct nf_conn *ct = cb->data; struct nf_conn_help *help = nfct_help(ct); u_int8_t l3proto = nfmsg->nfgen_family; + unsigned long last_id = cb->args[1]; + struct nf_conntrack_expect *exp; if (cb->args[0]) return 0; rcu_read_lock(); - last = (struct nf_conntrack_expect *)cb->args[1]; + restart: hlist_for_each_entry_rcu(exp, &help->expectations, lnode) { if (l3proto && exp->tuple.src.l3num != l3proto) continue; if (cb->args[1]) { - if (exp != last) + if (ctnetlink_exp_id(exp) != last_id) continue; cb->args[1] = 0; } @@ -3221,9 +3221,7 @@ ctnetlink_exp_ct_dump_table(struct sk_buff *skb, struct netlink_callback *cb) cb->nlh->nlmsg_seq, IPCTNL_MSG_EXP_NEW, exp) < 0) { - if (!refcount_inc_not_zero(&exp->use)) - continue; - cb->args[1] = (unsigned long)exp; + cb->args[1] = ctnetlink_exp_id(exp); goto out; } } @@ -3234,9 +3232,6 @@ ctnetlink_exp_ct_dump_table(struct sk_buff *skb, struct netlink_callback *cb) cb->args[0] = 1; out: rcu_read_unlock(); - if (last) - nf_ct_expect_put(last); - return skb->len; } @@ -3255,7 +3250,6 @@ static int ctnetlink_dump_exp_ct(struct net *net, struct sock *ctnl, struct nf_conntrack_zone zone; struct netlink_dump_control c = { .dump = ctnetlink_exp_ct_dump_table, - .done = ctnetlink_exp_done, }; err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_MASTER, @@ -3305,7 +3299,6 @@ static int ctnetlink_get_expect(struct sk_buff *skb, else { struct netlink_dump_control c = { .dump = ctnetlink_exp_dump_table, - .done = ctnetlink_exp_done, }; return netlink_dump_start(info->sk, skb, info->nlh, &c); } -- 2.9.5

2 1

[PATCH OLK-6.6 0/4] CVE-2025-38678
by Zhang Changzhong 07 Feb '26

07 Feb '26

Pablo Neira Ayuso (1): netfilter: nf_tables: reject duplicate device on updates Phil Sutter (1): netfilter: nf_tables: Introduce functions freeing nft_hook objects Uros Bizjak (2): err.h: add ERR_PTR_PCPU(), PTR_ERR_PCPU() and IS_ERR_PCPU() macros netfilter: nf_tables: Fix percpu address space issues in nf_tables_api.c include/linux/err.h | 9 +++++ net/netfilter/nf_tables_api.c | 84 +++++++++++++++++++++++++++++++------------ 2 files changed, 71 insertions(+), 22 deletions(-) -- 2.9.5

2 5

[PATCH OLK-5.10] sctp: linearize cloned gso packets in sctp_rcv
by Zhang Changzhong 07 Feb '26

07 Feb '26

From: Xin Long <lucien.xin(a)gmail.com> stable inclusion from stable-v5.10.241 commit 03d0cc6889e02420125510b5444b570f4bbf53d5 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/9113 CVE: CVE-2025-38718 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fd60d8a086191fe33c2d719732d2482052fa6805 ] A cloned head skb still shares these frag skbs in fraglist with the original head skb. It's not safe to access these frag skbs. syzbot reported two use-of-uninitialized-memory bugs caused by this: BUG: KMSAN: uninit-value in sctp_inq_pop+0x15b7/0x1920 net/sctp/inqueue.c:211 sctp_inq_pop+0x15b7/0x1920 net/sctp/inqueue.c:211 sctp_assoc_bh_rcv+0x1a7/0xc50 net/sctp/associola.c:998 sctp_inq_push+0x2ef/0x380 net/sctp/inqueue.c:88 sctp_backlog_rcv+0x397/0xdb0 net/sctp/input.c:331 sk_backlog_rcv+0x13b/0x420 include/net/sock.h:1122 __release_sock+0x1da/0x330 net/core/sock.c:3106 release_sock+0x6b/0x250 net/core/sock.c:3660 sctp_wait_for_connect+0x487/0x820 net/sctp/socket.c:9360 sctp_sendmsg_to_asoc+0x1ec1/0x1f00 net/sctp/socket.c:1885 sctp_sendmsg+0x32b9/0x4a80 net/sctp/socket.c:2031 inet_sendmsg+0x25a/0x280 net/ipv4/af_inet.c:851 sock_sendmsg_nosec net/socket.c:718 [inline] and BUG: KMSAN: uninit-value in sctp_assoc_bh_rcv+0x34e/0xbc0 net/sctp/associola.c:987 sctp_assoc_bh_rcv+0x34e/0xbc0 net/sctp/associola.c:987 sctp_inq_push+0x2a3/0x350 net/sctp/inqueue.c:88 sctp_backlog_rcv+0x3c7/0xda0 net/sctp/input.c:331 sk_backlog_rcv+0x142/0x420 include/net/sock.h:1148 __release_sock+0x1d3/0x330 net/core/sock.c:3213 release_sock+0x6b/0x270 net/core/sock.c:3767 sctp_wait_for_connect+0x458/0x820 net/sctp/socket.c:9367 sctp_sendmsg_to_asoc+0x223a/0x2260 net/sctp/socket.c:1886 sctp_sendmsg+0x3910/0x49f0 net/sctp/socket.c:2032 inet_sendmsg+0x269/0x2a0 net/ipv4/af_inet.c:851 sock_sendmsg_nosec net/socket.c:712 [inline] This patch fixes it by linearizing cloned gso packets in sctp_rcv(). Fixes: 90017accff61 ("sctp: Add GSO support") Reported-by: syzbot+773e51afe420baaf0e2b(a)syzkaller.appspotmail.com Reported-by: syzbot+70a42f45e76bede082be(a)syzkaller.appspotmail.com Signed-off-by: Xin Long <lucien.xin(a)gmail.com> Reviewed-by: Marcelo Ricardo Leitner <marcelo.leitner(a)gmail.com> Link: https://patch.msgid.link/dd7dc337b99876d4132d0961f776913719f7d225.175459561… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/sctp/input.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/sctp/input.c b/net/sctp/input.c index 8fe1a74..079b1bf 100644 --- a/net/sctp/input.c +++ b/net/sctp/input.c @@ -114,7 +114,7 @@ int sctp_rcv(struct sk_buff *skb) * it's better to just linearize it otherwise crc computing * takes longer. */ - if ((!is_gso && skb_linearize(skb)) || + if (((!is_gso || skb_cloned(skb)) && skb_linearize(skb)) || !pskb_may_pull(skb, sizeof(struct sctphdr))) goto discard_it; -- 2.9.5

2 1

[PATCH OLK-5.10] libceph: fix potential use-after-free in have_mon_and_osd_map()
by Zhang Changzhong 07 Feb '26

07 Feb '26

From: Ilya Dryomov <idryomov(a)gmail.com> stable inclusion from stable-v5.10.247 commit bb4910c5fd436701faf367e1b5476a5a6d2aff1c category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/11584 CVE: CVE-2025-68285 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 076381c261374c587700b3accf410bdd2dba334e upstream. The wait loop in __ceph_open_session() can race with the client receiving a new monmap or osdmap shortly after the initial map is received. Both ceph_monc_handle_map() and handle_one_map() install a new map immediately after freeing the old one kfree(monc->monmap); monc->monmap = monmap; ceph_osdmap_destroy(osdc->osdmap); osdc->osdmap = newmap; under client->monc.mutex and client->osdc.lock respectively, but because neither is taken in have_mon_and_osd_map() it's possible for client->monc.monmap->epoch and client->osdc.osdmap->epoch arms in client->monc.monmap && client->monc.monmap->epoch && client->osdc.osdmap && client->osdc.osdmap->epoch; condition to dereference an already freed map. This happens to be reproducible with generic/395 and generic/397 with KASAN enabled: BUG: KASAN: slab-use-after-free in have_mon_and_osd_map+0x56/0x70 Read of size 4 at addr ffff88811012d810 by task mount.ceph/13305 CPU: 2 UID: 0 PID: 13305 Comm: mount.ceph Not tainted 6.14.0-rc2-build2+ #1266 ... Call Trace: <TASK> have_mon_and_osd_map+0x56/0x70 ceph_open_session+0x182/0x290 ceph_get_tree+0x333/0x680 vfs_get_tree+0x49/0x180 do_new_mount+0x1a3/0x2d0 path_mount+0x6dd/0x730 do_mount+0x99/0xe0 __do_sys_mount+0x141/0x180 do_syscall_64+0x9f/0x100 entry_SYSCALL_64_after_hwframe+0x76/0x7e </TASK> Allocated by task 13305: ceph_osdmap_alloc+0x16/0x130 ceph_osdc_init+0x27a/0x4c0 ceph_create_client+0x153/0x190 create_fs_client+0x50/0x2a0 ceph_get_tree+0xff/0x680 vfs_get_tree+0x49/0x180 do_new_mount+0x1a3/0x2d0 path_mount+0x6dd/0x730 do_mount+0x99/0xe0 __do_sys_mount+0x141/0x180 do_syscall_64+0x9f/0x100 entry_SYSCALL_64_after_hwframe+0x76/0x7e Freed by task 9475: kfree+0x212/0x290 handle_one_map+0x23c/0x3b0 ceph_osdc_handle_map+0x3c9/0x590 mon_dispatch+0x655/0x6f0 ceph_con_process_message+0xc3/0xe0 ceph_con_v1_try_read+0x614/0x760 ceph_con_workfn+0x2de/0x650 process_one_work+0x486/0x7c0 process_scheduled_works+0x73/0x90 worker_thread+0x1c8/0x2a0 kthread+0x2ec/0x300 ret_from_fork+0x24/0x40 ret_from_fork_asm+0x1a/0x30 Rewrite the wait loop to check the above condition directly with client->monc.mutex and client->osdc.lock taken as appropriate. While at it, improve the timeout handling (previously mount_timeout could be exceeded in case wait_event_interruptible_timeout() slept more than once) and access client->auth_err under client->monc.mutex to match how it's set in finish_auth(). monmap_show() and osdmap_show() now take the respective lock before accessing the map as well. Cc: stable(a)vger.kernel.org Reported-by: David Howells <dhowells(a)redhat.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko(a)ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/ceph/ceph_common.c | 53 ++++++++++++++++++++++++++++++-------------------- net/ceph/debugfs.c | 14 +++++++++---- 2 files changed, 42 insertions(+), 25 deletions(-) diff --git a/net/ceph/ceph_common.c b/net/ceph/ceph_common.c index 4e7edd7..c3bee8f 100644 --- a/net/ceph/ceph_common.c +++ b/net/ceph/ceph_common.c @@ -750,41 +750,52 @@ void ceph_reset_client_addr(struct ceph_client *client) EXPORT_SYMBOL(ceph_reset_client_addr); /* - * true if we have the mon map (and have thus joined the cluster) - */ -static bool have_mon_and_osd_map(struct ceph_client *client) -{ - return client->monc.monmap && client->monc.monmap->epoch && - client->osdc.osdmap && client->osdc.osdmap->epoch; -} - -/* * mount: join the ceph cluster, and open root directory. */ int __ceph_open_session(struct ceph_client *client, unsigned long started) { - unsigned long timeout = client->options->mount_timeout; - long err; + DEFINE_WAIT_FUNC(wait, woken_wake_function); + long timeout = ceph_timeout_jiffies(client->options->mount_timeout); + bool have_monmap, have_osdmap; + int err; /* open session, and wait for mon and osd maps */ err = ceph_monc_open_session(&client->monc); if (err < 0) return err; - while (!have_mon_and_osd_map(client)) { - if (timeout && time_after_eq(jiffies, started + timeout)) - return -ETIMEDOUT; + add_wait_queue(&client->auth_wq, &wait); + for (;;) { + mutex_lock(&client->monc.mutex); + err = client->auth_err; + have_monmap = client->monc.monmap && client->monc.monmap->epoch; + mutex_unlock(&client->monc.mutex); + + down_read(&client->osdc.lock); + have_osdmap = client->osdc.osdmap && client->osdc.osdmap->epoch; + up_read(&client->osdc.lock); + + if (err || (have_monmap && have_osdmap)) + break; + + if (signal_pending(current)) { + err = -ERESTARTSYS; + break; + } + + if (!timeout) { + err = -ETIMEDOUT; + break; + } /* wait */ dout("mount waiting for mon_map\n"); - err = wait_event_interruptible_timeout(client->auth_wq, - have_mon_and_osd_map(client) || (client->auth_err < 0), - ceph_timeout_jiffies(timeout)); - if (err < 0) - return err; - if (client->auth_err < 0) - return client->auth_err; + timeout = wait_woken(&wait, TASK_INTERRUPTIBLE, timeout); } + remove_wait_queue(&client->auth_wq, &wait); + + if (err) + return err; pr_info("client%llu fsid %pU\n", ceph_client_gid(client), &client->fsid); diff --git a/net/ceph/debugfs.c b/net/ceph/debugfs.c index 2110439..83c270b 100644 --- a/net/ceph/debugfs.c +++ b/net/ceph/debugfs.c @@ -36,8 +36,9 @@ static int monmap_show(struct seq_file *s, void *p) int i; struct ceph_client *client = s->private; + mutex_lock(&client->monc.mutex); if (client->monc.monmap == NULL) - return 0; + goto out_unlock; seq_printf(s, "epoch %d\n", client->monc.monmap->epoch); for (i = 0; i < client->monc.monmap->num_mon; i++) { @@ -48,6 +49,9 @@ static int monmap_show(struct seq_file *s, void *p) ENTITY_NAME(inst->name), ceph_pr_addr(&inst->addr)); } + +out_unlock: + mutex_unlock(&client->monc.mutex); return 0; } @@ -56,13 +60,14 @@ static int osdmap_show(struct seq_file *s, void *p) int i; struct ceph_client *client = s->private; struct ceph_osd_client *osdc = &client->osdc; - struct ceph_osdmap *map = osdc->osdmap; + struct ceph_osdmap *map; struct rb_node *n; + down_read(&osdc->lock); + map = osdc->osdmap; if (map == NULL) - return 0; + goto out_unlock; - down_read(&osdc->lock); seq_printf(s, "epoch %u barrier %u flags 0x%x\n", map->epoch, osdc->epoch_barrier, map->flags); @@ -131,6 +136,7 @@ static int osdmap_show(struct seq_file *s, void *p) seq_printf(s, "]\n"); } +out_unlock: up_read(&osdc->lock); return 0; } -- 2.9.5

2 1

[PATCH OLK-5.10] tipc: Fix use-after-free in tipc_mon_reinit_self().
by Zhang Changzhong 07 Feb '26

07 Feb '26

From: Kuniyuki Iwashima <kuniyu(a)google.com> stable inclusion from stable-v5.10.247 commit b2e77c789c234e7fe49057d2ced8f32e2d2c7901 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/11246 CVE: CVE-2025-40280 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 0725e6afb55128be21a2ca36e9674f573ccec173 ] syzbot reported use-after-free of tipc_net(net)->monitors[] in tipc_mon_reinit_self(). [0] The array is protected by RTNL, but tipc_mon_reinit_self() iterates over it without RTNL. tipc_mon_reinit_self() is called from tipc_net_finalize(), which is always under RTNL except for tipc_net_finalize_work(). Let's hold RTNL in tipc_net_finalize_work(). [0]: BUG: KASAN: slab-use-after-free in __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] BUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave+0xa7/0xf0 kernel/locking/spinlock.c:162 Read of size 1 at addr ffff88805eae1030 by task kworker/0:7/5989 CPU: 0 UID: 0 PID: 5989 Comm: kworker/0:7 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 Workqueue: events tipc_net_finalize_work Call Trace: <TASK> dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xca/0x240 mm/kasan/report.c:482 kasan_report+0x118/0x150 mm/kasan/report.c:595 __kasan_check_byte+0x2a/0x40 mm/kasan/common.c:568 kasan_check_byte include/linux/kasan.h:399 [inline] lock_acquire+0x8d/0x360 kernel/locking/lockdep.c:5842 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xa7/0xf0 kernel/locking/spinlock.c:162 rtlock_slowlock kernel/locking/rtmutex.c:1894 [inline] rwbase_rtmutex_lock_state kernel/locking/spinlock_rt.c:160 [inline] rwbase_write_lock+0xd3/0x7e0 kernel/locking/rwbase_rt.c:244 rt_write_lock+0x76/0x110 kernel/locking/spinlock_rt.c:243 write_lock_bh include/linux/rwlock_rt.h:99 [inline] tipc_mon_reinit_self+0x79/0x430 net/tipc/monitor.c:718 tipc_net_finalize+0x115/0x190 net/tipc/net.c:140 process_one_work kernel/workqueue.c:3236 [inline] process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3319 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400 kthread+0x70e/0x8a0 kernel/kthread.c:463 ret_from_fork+0x439/0x7d0 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> Allocated by task 6089: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:388 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:405 kasan_kmalloc include/linux/kasan.h:260 [inline] __kmalloc_cache_noprof+0x1a8/0x320 mm/slub.c:4407 kmalloc_noprof include/linux/slab.h:905 [inline] kzalloc_noprof include/linux/slab.h:1039 [inline] tipc_mon_create+0xc3/0x4d0 net/tipc/monitor.c:657 tipc_enable_bearer net/tipc/bearer.c:357 [inline] __tipc_nl_bearer_enable+0xe16/0x13f0 net/tipc/bearer.c:1047 __tipc_nl_compat_doit net/tipc/netlink_compat.c:371 [inline] tipc_nl_compat_doit+0x3bc/0x5f0 net/tipc/netlink_compat.c:393 tipc_nl_compat_handle net/tipc/netlink_compat.c:-1 [inline] tipc_nl_compat_recv+0x83c/0xbe0 net/tipc/netlink_compat.c:1321 genl_family_rcv_msg_doit+0x215/0x300 net/netlink/genetlink.c:1115 genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline] genl_rcv_msg+0x60e/0x790 net/netlink/genetlink.c:1210 netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2552 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline] netlink_unicast+0x846/0xa10 net/netlink/af_netlink.c:1346 netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1896 sock_sendmsg_nosec net/socket.c:714 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:729 ____sys_sendmsg+0x508/0x820 net/socket.c:2614 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668 __sys_sendmsg net/socket.c:2700 [inline] __do_sys_sendmsg net/socket.c:2705 [inline] __se_sys_sendmsg net/socket.c:2703 [inline] __x64_sys_sendmsg+0x1a1/0x260 net/socket.c:2703 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 6088: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576 poison_slab_object mm/kasan/common.c:243 [inline] __kasan_slab_free+0x5b/0x80 mm/kasan/common.c:275 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2422 [inline] slab_free mm/slub.c:4695 [inline] kfree+0x195/0x550 mm/slub.c:4894 tipc_l2_device_event+0x380/0x650 net/tipc/bearer.c:-1 notifier_call_chain+0x1b3/0x3e0 kernel/notifier.c:85 call_netdevice_notifiers_extack net/core/dev.c:2267 [inline] call_netdevice_notifiers net/core/dev.c:2281 [inline] unregister_netdevice_many_notify+0x14d7/0x1fe0 net/core/dev.c:12166 unregister_netdevice_many net/core/dev.c:12229 [inline] unregister_netdevice_queue+0x33c/0x380 net/core/dev.c:12073 unregister_netdevice include/linux/netdevice.h:3385 [inline] __tun_detach+0xe4d/0x1620 drivers/net/tun.c:621 tun_detach drivers/net/tun.c:637 [inline] tun_chr_close+0x10d/0x1c0 drivers/net/tun.c:3433 __fput+0x458/0xa80 fs/file_table.c:468 task_work_run+0x1d4/0x260 kernel/task_work.c:227 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop+0xec/0x110 kernel/entry/common.c:43 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline] do_syscall_64+0x2bd/0x3b0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f Fixes: 46cb01eeeb86 ("tipc: update mon's self addr when node addr generated") Reported-by: syzbot+d7dad7fd4b3921104957(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/690c323a.050a0220.baf87.007f.GAE@google.com/ Signed-off-by: Kuniyuki Iwashima <kuniyu(a)google.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://patch.msgid.link/20251107064038.2361188-1-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/tipc/net.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/tipc/net.c b/net/tipc/net.c index 671cb4f..95aa3a9 100644 --- a/net/tipc/net.c +++ b/net/tipc/net.c @@ -141,7 +141,9 @@ void tipc_net_finalize_work(struct work_struct *work) { struct tipc_net *tn = container_of(work, struct tipc_net, work); + rtnl_lock(); tipc_net_finalize(tipc_link_net(tn->bcl), tn->trial_addr); + rtnl_unlock(); } void tipc_net_stop(struct net *net) -- 2.9.5

2 1

[PATCH OLK-6.6 0/5] CVE-2025-39948
by Zhang Changzhong 07 Feb '26

07 Feb '26

Jacob Keller (1): ice: fix Rx page leak on multi-buffer frames Larysa Zaremba (1): ice: Introduce ice_xdp_buff Maciej Fijalkowski (2): ice: gather page_count()'s of each frag right before XDP prog call ice: stop storing XDP verdict within ice_rx_buf Michal Kubiak (1): ice: fix incorrect counter for buffer allocation failures drivers/net/ethernet/intel/ice/ice_txrx.c | 122 ++++++++++++++++---------- drivers/net/ethernet/intel/ice/ice_txrx.h | 20 +++-- drivers/net/ethernet/intel/ice/ice_txrx_lib.h | 53 +++-------- 3 files changed, 99 insertions(+), 96 deletions(-) -- 2.9.5

2 6

[PATCH OLK-6.6] netfilter: ctnetlink: remove refcounting in expectation dumpers
by Zhang Changzhong 07 Feb '26

07 Feb '26

From: Florian Westphal <fw(a)strlen.de> mainline inclusion from mainline-v6.17-rc2 commit 1492e3dcb2be3aa46d1963da96aa9593e4e4db5a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICXMC9 CVE: CVE-2025-39764 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Same pattern as previous patch: do not keep the expectation object alive via refcount, only store a cookie value and then use that as the skip hint for dump resumption. AFAICS this has the same issue as the one resolved in the conntrack dumper, when we do if (!refcount_inc_not_zero(&exp->use)) to increment the refcount, there is a chance that exp == last, which causes a double-increment of the refcount and subsequent memory leak. Fixes: cf6994c2b981 ("[NETFILTER]: nf_conntrack_netlink: sync expectation dumping with conntrack table dumping") Fixes: e844a928431f ("netfilter: ctnetlink: allow to dump expectation per master conntrack") Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/netfilter/nf_conntrack_netlink.c | 41 +++++++++++++++--------------------- 1 file changed, 17 insertions(+), 24 deletions(-) diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c index 282e964..698e79c 100644 --- a/net/netfilter/nf_conntrack_netlink.c +++ b/net/netfilter/nf_conntrack_netlink.c @@ -3138,23 +3138,27 @@ ctnetlink_expect_event(unsigned int events, const struct nf_exp_event *item) return 0; } #endif -static int ctnetlink_exp_done(struct netlink_callback *cb) + +static unsigned long ctnetlink_exp_id(const struct nf_conntrack_expect *exp) { - if (cb->args[1]) - nf_ct_expect_put((struct nf_conntrack_expect *)cb->args[1]); - return 0; + unsigned long id = (unsigned long)exp; + + id += nf_ct_get_id(exp->master); + id += exp->class; + + return id ? id : 1; } static int ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb) { struct net *net = sock_net(skb->sk); - struct nf_conntrack_expect *exp, *last; struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); u_int8_t l3proto = nfmsg->nfgen_family; + unsigned long last_id = cb->args[1]; + struct nf_conntrack_expect *exp; rcu_read_lock(); - last = (struct nf_conntrack_expect *)cb->args[1]; for (; cb->args[0] < nf_ct_expect_hsize; cb->args[0]++) { restart: hlist_for_each_entry_rcu(exp, &nf_ct_expect_hash[cb->args[0]], @@ -3166,7 +3170,7 @@ ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb) continue; if (cb->args[1]) { - if (exp != last) + if (ctnetlink_exp_id(exp) != last_id) continue; cb->args[1] = 0; } @@ -3175,9 +3179,7 @@ ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb) cb->nlh->nlmsg_seq, IPCTNL_MSG_EXP_NEW, exp) < 0) { - if (!refcount_inc_not_zero(&exp->use)) - continue; - cb->args[1] = (unsigned long)exp; + cb->args[1] = ctnetlink_exp_id(exp); goto out; } } @@ -3188,32 +3190,30 @@ ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb) } out: rcu_read_unlock(); - if (last) - nf_ct_expect_put(last); - return skb->len; } static int ctnetlink_exp_ct_dump_table(struct sk_buff *skb, struct netlink_callback *cb) { - struct nf_conntrack_expect *exp, *last; struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); struct nf_conn *ct = cb->data; struct nf_conn_help *help = nfct_help(ct); u_int8_t l3proto = nfmsg->nfgen_family; + unsigned long last_id = cb->args[1]; + struct nf_conntrack_expect *exp; if (cb->args[0]) return 0; rcu_read_lock(); - last = (struct nf_conntrack_expect *)cb->args[1]; + restart: hlist_for_each_entry_rcu(exp, &help->expectations, lnode) { if (l3proto && exp->tuple.src.l3num != l3proto) continue; if (cb->args[1]) { - if (exp != last) + if (ctnetlink_exp_id(exp) != last_id) continue; cb->args[1] = 0; } @@ -3221,9 +3221,7 @@ ctnetlink_exp_ct_dump_table(struct sk_buff *skb, struct netlink_callback *cb) cb->nlh->nlmsg_seq, IPCTNL_MSG_EXP_NEW, exp) < 0) { - if (!refcount_inc_not_zero(&exp->use)) - continue; - cb->args[1] = (unsigned long)exp; + cb->args[1] = ctnetlink_exp_id(exp); goto out; } } @@ -3234,9 +3232,6 @@ ctnetlink_exp_ct_dump_table(struct sk_buff *skb, struct netlink_callback *cb) cb->args[0] = 1; out: rcu_read_unlock(); - if (last) - nf_ct_expect_put(last); - return skb->len; } @@ -3255,7 +3250,6 @@ static int ctnetlink_dump_exp_ct(struct net *net, struct sock *ctnl, struct nf_conntrack_zone zone; struct netlink_dump_control c = { .dump = ctnetlink_exp_ct_dump_table, - .done = ctnetlink_exp_done, }; err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_MASTER, @@ -3305,7 +3299,6 @@ static int ctnetlink_get_expect(struct sk_buff *skb, else { struct netlink_dump_control c = { .dump = ctnetlink_exp_dump_table, - .done = ctnetlink_exp_done, }; return netlink_dump_start(info->sk, skb, info->nlh, &c); } -- 2.9.5

2 1

[PATCH OLK-6.6 0/4] CVE-2025-38678
by Zhang Changzhong 07 Feb '26

07 Feb '26

Pablo Neira Ayuso (1): netfilter: nf_tables: reject duplicate device on updates Phil Sutter (1): netfilter: nf_tables: Introduce functions freeing nft_hook objects Uros Bizjak (2): err.h: add ERR_PTR_PCPU(), PTR_ERR_PCPU() and IS_ERR_PCPU() macros netfilter: nf_tables: Fix percpu address space issues in nf_tables_api.c include/linux/err.h | 9 +++++ net/netfilter/nf_tables_api.c | 84 +++++++++++++++++++++++++++++++------------ 2 files changed, 71 insertions(+), 22 deletions(-) -- 2.9.5

2 5

[PATCH OLK-6.6] mptcp: make fallback action and fallback decision atomic
by Zhang Changzhong 07 Feb '26

07 Feb '26

From: Paolo Abeni <pabeni(a)redhat.com> mainline inclusion from mainline-v6.16-rc7 commit f8a1d9b18c5efc76784f5a326e905f641f839894 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/9321 CVE: CVE-2025-38491 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Syzkaller reported the following splat: WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 __mptcp_do_fallback net/mptcp/protocol.h:1223 [inline] WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 mptcp_do_fallback net/mptcp/protocol.h:1244 [inline] WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 check_fully_established net/mptcp/options.c:982 [inline] WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 mptcp_incoming_options+0x21a8/0x2510 net/mptcp/options.c:1153 Modules linked in: CPU: 1 UID: 0 PID: 7704 Comm: syz.3.1419 Not tainted 6.16.0-rc3-gbd5ce2324dba #20 PREEMPT(voluntary) Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:__mptcp_do_fallback net/mptcp/protocol.h:1223 [inline] RIP: 0010:mptcp_do_fallback net/mptcp/protocol.h:1244 [inline] RIP: 0010:check_fully_established net/mptcp/options.c:982 [inline] RIP: 0010:mptcp_incoming_options+0x21a8/0x2510 net/mptcp/options.c:1153 Code: 24 18 e8 bb 2a 00 fd e9 1b df ff ff e8 b1 21 0f 00 e8 ec 5f c4 fc 44 0f b7 ac 24 b0 00 00 00 e9 54 f1 ff ff e8 d9 5f c4 fc 90 <0f> 0b 90 e9 b8 f4 ff ff e8 8b 2a 00 fd e9 8d e6 ff ff e8 81 2a 00 RSP: 0018:ffff8880a3f08448 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff8880180a8000 RCX: ffffffff84afcf45 RDX: ffff888090223700 RSI: ffffffff84afdaa7 RDI: 0000000000000001 RBP: ffff888017955780 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: ffff8880180a8910 R14: ffff8880a3e9d058 R15: 0000000000000000 FS: 00005555791b8500(0000) GS:ffff88811c495000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000110c2800b7 CR3: 0000000058e44000 CR4: 0000000000350ef0 Call Trace: <IRQ> tcp_reset+0x26f/0x2b0 net/ipv4/tcp_input.c:4432 tcp_validate_incoming+0x1057/0x1b60 net/ipv4/tcp_input.c:5975 tcp_rcv_established+0x5b5/0x21f0 net/ipv4/tcp_input.c:6166 tcp_v4_do_rcv+0x5dc/0xa70 net/ipv4/tcp_ipv4.c:1925 tcp_v4_rcv+0x3473/0x44a0 net/ipv4/tcp_ipv4.c:2363 ip_protocol_deliver_rcu+0xba/0x480 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x2f1/0x500 net/ipv4/ip_input.c:233 NF_HOOK include/linux/netfilter.h:317 [inline] NF_HOOK include/linux/netfilter.h:311 [inline] ip_local_deliver+0x1be/0x560 net/ipv4/ip_input.c:254 dst_input include/net/dst.h:469 [inline] ip_rcv_finish net/ipv4/ip_input.c:447 [inline] NF_HOOK include/linux/netfilter.h:317 [inline] NF_HOOK include/linux/netfilter.h:311 [inline] ip_rcv+0x514/0x810 net/ipv4/ip_input.c:567 __netif_receive_skb_one_core+0x197/0x1e0 net/core/dev.c:5975 __netif_receive_skb+0x1f/0x120 net/core/dev.c:6088 process_backlog+0x301/0x1360 net/core/dev.c:6440 __napi_poll.constprop.0+0xba/0x550 net/core/dev.c:7453 napi_poll net/core/dev.c:7517 [inline] net_rx_action+0xb44/0x1010 net/core/dev.c:7644 handle_softirqs+0x1d0/0x770 kernel/softirq.c:579 do_softirq+0x3f/0x90 kernel/softirq.c:480 </IRQ> <TASK> __local_bh_enable_ip+0xed/0x110 kernel/softirq.c:407 local_bh_enable include/linux/bottom_half.h:33 [inline] inet_csk_listen_stop+0x2c5/0x1070 net/ipv4/inet_connection_sock.c:1524 mptcp_check_listen_stop.part.0+0x1cc/0x220 net/mptcp/protocol.c:2985 mptcp_check_listen_stop net/mptcp/mib.h:118 [inline] __mptcp_close+0x9b9/0xbd0 net/mptcp/protocol.c:3000 mptcp_close+0x2f/0x140 net/mptcp/protocol.c:3066 inet_release+0xed/0x200 net/ipv4/af_inet.c:435 inet6_release+0x4f/0x70 net/ipv6/af_inet6.c:487 __sock_release+0xb3/0x270 net/socket.c:649 sock_close+0x1c/0x30 net/socket.c:1439 __fput+0x402/0xb70 fs/file_table.c:465 task_work_run+0x150/0x240 kernel/task_work.c:227 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop+0xd4/0xe0 kernel/entry/common.c:114 exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:414 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:449 [inline] do_syscall_64+0x245/0x360 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fc92f8a36ad Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffcf52802d8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007ffcf52803a8 RCX: 00007fc92f8a36ad RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00007fc92fae7ba0 R08: 0000000000000001 R09: 0000002800000000 R10: 00007fc92f700000 R11: 0000000000000246 R12: 00007fc92fae5fac R13: 00007fc92fae5fa0 R14: 0000000000026d00 R15: 0000000000026c51 </TASK> irq event stamp: 4068 hardirqs last enabled at (4076): [<ffffffff81544816>] __up_console_sem+0x76/0x80 kernel/printk/printk.c:344 hardirqs last disabled at (4085): [<ffffffff815447fb>] __up_console_sem+0x5b/0x80 kernel/printk/printk.c:342 softirqs last enabled at (3096): [<ffffffff840e1be0>] local_bh_enable include/linux/bottom_half.h:33 [inline] softirqs last enabled at (3096): [<ffffffff840e1be0>] inet_csk_listen_stop+0x2c0/0x1070 net/ipv4/inet_connection_sock.c:1524 softirqs last disabled at (3097): [<ffffffff813b6b9f>] do_softirq+0x3f/0x90 kernel/softirq.c:480 Since we need to track the 'fallback is possible' condition and the fallback status separately, there are a few possible races open between the check and the actual fallback action. Add a spinlock to protect the fallback related information and use it close all the possible related races. While at it also remove the too-early clearing of allow_infinite_fallback in __mptcp_subflow_connect(): the field will be correctly cleared by subflow_finish_connect() if/when the connection will complete successfully. If fallback is not possible, as per RFC, reset the current subflow. Since the fallback operation can now fail and return value should be checked, rename the helper accordingly. Fixes: 0530020a7c8f ("mptcp: track and update contiguous data status") Cc: stable(a)vger.kernel.org Reported-by: Matthieu Baerts <matttbe(a)kernel.org> Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/570 Reported-by: syzbot+5cf807c20386d699b524(a)syzkaller.appspotmail.com Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/555 Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Reviewed-by: Matthieu Baerts (NGI0) <matttbe(a)kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe(a)kernel.org> Link: https://patch.msgid.link/20250714-net-mptcp-fallback-races-v1-1-391aff96332… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/mptcp/options.c | 3 ++- net/mptcp/protocol.c | 40 +++++++++++++++++++++++++++++++++++----- net/mptcp/protocol.h | 26 +++++++++++++++++++------- net/mptcp/subflow.c | 11 +++++------ 4 files changed, 61 insertions(+), 19 deletions(-) diff --git a/net/mptcp/options.c b/net/mptcp/options.c index fc277026..96049db 100644 --- a/net/mptcp/options.c +++ b/net/mptcp/options.c @@ -979,8 +979,9 @@ static bool check_fully_established(struct mptcp_sock *msk, struct sock *ssk, if (subflow->mp_join) goto reset; subflow->mp_capable = 0; + if (!mptcp_try_fallback(ssk)) + goto reset; pr_fallback(msk); - mptcp_do_fallback(ssk); return false; } diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index 9f08fca..b5c2b2d 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -624,10 +624,9 @@ static bool mptcp_check_data_fin(struct sock *sk) static void mptcp_dss_corruption(struct mptcp_sock *msk, struct sock *ssk) { - if (READ_ONCE(msk->allow_infinite_fallback)) { + if (mptcp_try_fallback(ssk)) { MPTCP_INC_STATS(sock_net(ssk), MPTCP_MIB_DSSCORRUPTIONFALLBACK); - mptcp_do_fallback(ssk); } else { MPTCP_INC_STATS(sock_net(ssk), MPTCP_MIB_DSSCORRUPTIONRESET); mptcp_subflow_reset(ssk); @@ -890,6 +889,14 @@ static bool __mptcp_finish_join(struct mptcp_sock *msk, struct sock *ssk) if (sk->sk_state != TCP_ESTABLISHED) return false; + spin_lock_bh(&msk->fallback_lock); + if (__mptcp_check_fallback(msk)) { + spin_unlock_bh(&msk->fallback_lock); + return false; + } + mptcp_subflow_joined(msk, ssk); + spin_unlock_bh(&msk->fallback_lock); + /* attach to msk socket only after we are sure we will deal with it * at close time */ @@ -898,7 +905,6 @@ static bool __mptcp_finish_join(struct mptcp_sock *msk, struct sock *ssk) mptcp_subflow_ctx(ssk)->subflow_id = msk->subflow_id++; mptcp_sockopt_sync_locked(msk, ssk); - mptcp_subflow_joined(msk, ssk); mptcp_stop_tout_timer(sk); __mptcp_propagate_sndbuf(sk, ssk); return true; @@ -1237,10 +1243,14 @@ static void mptcp_update_infinite_map(struct mptcp_sock *msk, mpext->infinite_map = 1; mpext->data_len = 0; + if (!mptcp_try_fallback(ssk)) { + mptcp_subflow_reset(ssk); + return; + } + MPTCP_INC_STATS(sock_net(ssk), MPTCP_MIB_INFINITEMAPTX); mptcp_subflow_ctx(ssk)->send_infinite_map = 0; pr_fallback(msk); - mptcp_do_fallback(ssk); } #define MPTCP_MAX_GSO_SIZE (GSO_LEGACY_MAX_SIZE - (MAX_TCP_HEADER + 1)) @@ -2644,9 +2654,9 @@ static void mptcp_check_fastclose(struct mptcp_sock *msk) static void __mptcp_retrans(struct sock *sk) { + struct mptcp_sendmsg_info info = { .data_lock_held = true, }; struct mptcp_sock *msk = mptcp_sk(sk); struct mptcp_subflow_context *subflow; - struct mptcp_sendmsg_info info = {}; struct mptcp_data_frag *dfrag; struct sock *ssk; int ret, err; @@ -2691,6 +2701,18 @@ static void __mptcp_retrans(struct sock *sk) info.sent = 0; info.limit = READ_ONCE(msk->csum_enabled) ? dfrag->data_len : dfrag->already_sent; + + /* + * make the whole retrans decision, xmit, disallow + * fallback atomic + */ + spin_lock_bh(&msk->fallback_lock); + if (__mptcp_check_fallback(msk)) { + spin_unlock_bh(&msk->fallback_lock); + release_sock(ssk); + return; + } + while (info.sent < info.limit) { ret = mptcp_sendmsg_frag(sk, ssk, dfrag, &info); if (ret <= 0) @@ -2706,6 +2728,7 @@ static void __mptcp_retrans(struct sock *sk) info.size_goal); WRITE_ONCE(msk->allow_infinite_fallback, false); } + spin_unlock_bh(&msk->fallback_lock); release_sock(ssk); } @@ -2842,6 +2865,7 @@ static void __mptcp_init_sock(struct sock *sk) msk->last_ack_recv = tcp_jiffies32; mptcp_pm_data_init(msk); + spin_lock_init(&msk->fallback_lock); /* re-use the csk retrans timer for MPTCP-level retrans */ timer_setup(&msk->sk.icsk_retransmit_timer, mptcp_retransmit_timer, 0); @@ -3638,7 +3662,13 @@ bool mptcp_finish_join(struct sock *ssk) /* active subflow, already present inside the conn_list */ if (!list_empty(&subflow->node)) { + spin_lock_bh(&msk->fallback_lock); + if (__mptcp_check_fallback(msk)) { + spin_unlock_bh(&msk->fallback_lock); + return false; + } mptcp_subflow_joined(msk, ssk); + spin_unlock_bh(&msk->fallback_lock); mptcp_propagate_sndbuf(parent, ssk); return true; } diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h index 2de9dce..a644427 100644 --- a/net/mptcp/protocol.h +++ b/net/mptcp/protocol.h @@ -345,6 +345,10 @@ struct mptcp_sock { u32 subflow_id; u32 setsockopt_seq; char ca_name[TCP_CA_NAME_MAX]; + + spinlock_t fallback_lock; /* protects fallback and + * allow_infinite_fallback + */ }; #define mptcp_data_lock(sk) spin_lock_bh(&(sk)->sk_lock.slock) @@ -1150,15 +1154,21 @@ static inline bool mptcp_check_fallback(const struct sock *sk) return __mptcp_check_fallback(msk); } -static inline void __mptcp_do_fallback(struct mptcp_sock *msk) +static inline bool __mptcp_try_fallback(struct mptcp_sock *msk) { if (__mptcp_check_fallback(msk)) { pr_debug("TCP fallback already done (msk=%p)\n", msk); - return; + return true; } - if (WARN_ON_ONCE(!READ_ONCE(msk->allow_infinite_fallback))) - return; + spin_lock_bh(&msk->fallback_lock); + if (!msk->allow_infinite_fallback) { + spin_unlock_bh(&msk->fallback_lock); + return false; + } + set_bit(MPTCP_FALLBACK_DONE, &msk->flags); + spin_unlock_bh(&msk->fallback_lock); + return true; } static inline bool __mptcp_has_initial_subflow(const struct mptcp_sock *msk) @@ -1170,14 +1180,15 @@ static inline bool __mptcp_has_initial_subflow(const struct mptcp_sock *msk) TCPF_SYN_RECV | TCPF_LISTEN)); } -static inline void mptcp_do_fallback(struct sock *ssk) +static inline bool mptcp_try_fallback(struct sock *ssk) { struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(ssk); struct sock *sk = subflow->conn; struct mptcp_sock *msk; msk = mptcp_sk(sk); - __mptcp_do_fallback(msk); + if (!__mptcp_try_fallback(msk)) + return false; if (READ_ONCE(msk->snd_data_fin_enable) && !(ssk->sk_shutdown & SEND_SHUTDOWN)) { gfp_t saved_allocation = ssk->sk_allocation; @@ -1189,6 +1200,7 @@ static inline void mptcp_do_fallback(struct sock *ssk) tcp_shutdown(ssk, SEND_SHUTDOWN); ssk->sk_allocation = saved_allocation; } + return true; } #define pr_fallback(a) pr_debug("%s:fallback to TCP (msk=%p)\n", __func__, a) @@ -1198,7 +1210,7 @@ static inline void mptcp_subflow_early_fallback(struct mptcp_sock *msk, { pr_fallback(msk); subflow->request_mptcp = 0; - __mptcp_do_fallback(msk); + WARN_ON_ONCE(!__mptcp_try_fallback(msk)); } static inline bool mptcp_check_infinite_map(struct sk_buff *skb) diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c index f277ec5..f052ea1 100644 --- a/net/mptcp/subflow.c +++ b/net/mptcp/subflow.c @@ -523,9 +523,11 @@ static void subflow_finish_connect(struct sock *sk, const struct sk_buff *skb) mptcp_get_options(skb, &mp_opt); if (subflow->request_mptcp) { if (!(mp_opt.suboptions & OPTION_MPTCP_MPC_SYNACK)) { + if (!mptcp_try_fallback(sk)) + goto do_reset; + MPTCP_INC_STATS(sock_net(sk), MPTCP_MIB_MPCAPABLEACTIVEFALLBACK); - mptcp_do_fallback(sk); pr_fallback(msk); goto fallback; } @@ -1353,7 +1355,7 @@ static bool subflow_check_data_avail(struct sock *ssk) return true; } - if (!READ_ONCE(msk->allow_infinite_fallback)) { + if (!mptcp_try_fallback(ssk)) { /* fatal protocol error, close the socket. * subflow_error_report() will introduce the appropriate barriers */ @@ -1369,8 +1371,6 @@ static bool subflow_check_data_avail(struct sock *ssk) WRITE_ONCE(subflow->data_avail, false); return false; } - - mptcp_do_fallback(ssk); } skb = skb_peek(&ssk->sk_receive_queue); @@ -1635,7 +1635,6 @@ int __mptcp_subflow_connect(struct sock *sk, const struct mptcp_pm_local *local, /* discard the subflow socket */ mptcp_sock_graft(ssk, sk->sk_socket); iput(SOCK_INODE(sf)); - WRITE_ONCE(msk->allow_infinite_fallback, false); mptcp_stop_tout_timer(sk); return 0; @@ -1812,7 +1811,7 @@ static void subflow_state_change(struct sock *sk) msk = mptcp_sk(parent); if (subflow_simultaneous_connect(sk)) { - mptcp_do_fallback(sk); + WARN_ON_ONCE(!mptcp_try_fallback(sk)); pr_fallback(msk); subflow->conn_finished = 1; mptcp_propagate_state(parent, sk, subflow, NULL); -- 2.9.5

2 1

[PATCH OLK-5.10] ipv6: sr: Fix MAC comparison to be constant-time
by Zhang Changzhong 07 Feb '26

07 Feb '26

From: Eric Biggers <ebiggers(a)kernel.org> mainline inclusion from mainline-v6.17-rc3 commit a458b2902115b26a25d67393b12ddd57d1216aaa category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/9027 CVE: CVE-2025-39702 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this. Fixes: bf355b8d2c30 ("ipv6: sr: add core files for SR HMAC support") Cc: stable(a)vger.kernel.org Signed-off-by: Eric Biggers <ebiggers(a)kernel.org> Reviewed-by: Andrea Mayer <andrea.mayer(a)uniroma2.it> Link: https://patch.msgid.link/20250818202724.15713-1-ebiggers@kernel.org Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv6/seg6_hmac.c [conflicts due to not merge c616fb0cbae8 ("crypto: lib/utils - Move utilities into new header")] Signed-off-by: Wang Liang <wangliang74(a)huawei.com> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> --- net/ipv6/seg6_hmac.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/ipv6/seg6_hmac.c b/net/ipv6/seg6_hmac.c index 3c38002..dd7406a 100644 --- a/net/ipv6/seg6_hmac.c +++ b/net/ipv6/seg6_hmac.c @@ -35,6 +35,7 @@ #include <net/xfrm.h> #include <crypto/hash.h> +#include <crypto/algapi.h> #include <net/seg6.h> #include <net/genetlink.h> #include <net/seg6_hmac.h> @@ -269,7 +270,7 @@ bool seg6_hmac_validate_skb(struct sk_buff *skb) if (seg6_hmac_compute(hinfo, srh, &ipv6_hdr(skb)->saddr, hmac_output)) return false; - if (memcmp(hmac_output, tlv->hmac, SEG6_HMAC_FIELD_LEN) != 0) + if (crypto_memneq(hmac_output, tlv->hmac, SEG6_HMAC_FIELD_LEN)) return false; return true; -- 2.9.5

2 1

[PATCH OLK-5.10] ipv6: sr: Fix MAC comparison to be constant-time
by Zhang Changzhong 07 Feb '26

07 Feb '26

From: Eric Biggers <ebiggers(a)kernel.org> stable inclusion from stable-v6.6.103 commit 3ddd55cf19ed6cc62def5e3af10c2a9df1b861c3 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/9027 CVE: CVE-2025-39702 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit a458b2902115b26a25d67393b12ddd57d1216aaa upstream. To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this. Fixes: bf355b8d2c30 ("ipv6: sr: add core files for SR HMAC support") Cc: stable(a)vger.kernel.org Signed-off-by: Eric Biggers <ebiggers(a)kernel.org> Reviewed-by: Andrea Mayer <andrea.mayer(a)uniroma2.it> Link: https://patch.msgid.link/20250818202724.15713-1-ebiggers@kernel.org Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/ipv6/seg6_hmac.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/ipv6/seg6_hmac.c b/net/ipv6/seg6_hmac.c index 3c38002..22a5006 100644 --- a/net/ipv6/seg6_hmac.c +++ b/net/ipv6/seg6_hmac.c @@ -35,6 +35,7 @@ #include <net/xfrm.h> #include <crypto/hash.h> +#include <crypto/utils.h> #include <net/seg6.h> #include <net/genetlink.h> #include <net/seg6_hmac.h> @@ -269,7 +270,7 @@ bool seg6_hmac_validate_skb(struct sk_buff *skb) if (seg6_hmac_compute(hinfo, srh, &ipv6_hdr(skb)->saddr, hmac_output)) return false; - if (memcmp(hmac_output, tlv->hmac, SEG6_HMAC_FIELD_LEN) != 0) + if (crypto_memneq(hmac_output, tlv->hmac, SEG6_HMAC_FIELD_LEN)) return false; return true; -- 2.9.5

2 1

[PATCH OLK-6.6] tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork.
by Zhang Changzhong 07 Feb '26

07 Feb '26

From: Kuniyuki Iwashima <kuniyu(a)google.com> stable inclusion from stable-v6.6.107 commit 66bcb04a441fbf15d66834b7e3eefb313dd750c8 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/8357 CVE: CVE-2025-39913 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a3967baad4d533dc254c31e0d221e51c8d223d58 ] syzbot reported the splat below. [0] The repro does the following: 1. Load a sk_msg prog that calls bpf_msg_cork_bytes(msg, cork_bytes) 2. Attach the prog to a SOCKMAP 3. Add a socket to the SOCKMAP 4. Activate fault injection 5. Send data less than cork_bytes At 5., the data is carried over to the next sendmsg() as it is smaller than the cork_bytes specified by bpf_msg_cork_bytes(). Then, tcp_bpf_send_verdict() tries to allocate psock->cork to hold the data, but this fails silently due to fault injection + __GFP_NOWARN. If the allocation fails, we need to revert the sk->sk_forward_alloc change done by sk_msg_alloc(). Let's call sk_msg_free() when tcp_bpf_send_verdict fails to allocate psock->cork. The "*copied" also needs to be updated such that a proper error can be returned to the caller, sendmsg. It fails to allocate psock->cork. Nothing has been corked so far, so this patch simply sets "*copied" to 0. [0]: WARNING: net/ipv4/af_inet.c:156 at inet_sock_destruct+0x623/0x730 net/ipv4/af_inet.c:156, CPU#1: syz-executor/5983 Modules linked in: CPU: 1 UID: 0 PID: 5983 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:inet_sock_destruct+0x623/0x730 net/ipv4/af_inet.c:156 Code: 0f 0b 90 e9 62 fe ff ff e8 7a db b5 f7 90 0f 0b 90 e9 95 fe ff ff e8 6c db b5 f7 90 0f 0b 90 e9 bb fe ff ff e8 5e db b5 f7 90 <0f> 0b 90 e9 e1 fe ff ff 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 9f fc RSP: 0018:ffffc90000a08b48 EFLAGS: 00010246 RAX: ffffffff8a09d0b2 RBX: dffffc0000000000 RCX: ffff888024a23c80 RDX: 0000000000000100 RSI: 0000000000000fff RDI: 0000000000000000 RBP: 0000000000000fff R08: ffff88807e07c627 R09: 1ffff1100fc0f8c4 R10: dffffc0000000000 R11: ffffed100fc0f8c5 R12: ffff88807e07c380 R13: dffffc0000000000 R14: ffff88807e07c60c R15: 1ffff1100fc0f872 FS: 00005555604c4500(0000) GS:ffff888125af1000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005555604df5c8 CR3: 0000000032b06000 CR4: 00000000003526f0 Call Trace: <IRQ> __sk_destruct+0x86/0x660 net/core/sock.c:2339 rcu_do_batch kernel/rcu/tree.c:2605 [inline] rcu_core+0xca8/0x1770 kernel/rcu/tree.c:2861 handle_softirqs+0x286/0x870 kernel/softirq.c:579 __do_softirq kernel/softirq.c:613 [inline] invoke_softirq kernel/softirq.c:453 [inline] __irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:680 irq_exit_rcu+0x9/0x30 kernel/softirq.c:696 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1052 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1052 </IRQ> Fixes: 4f738adba30a ("bpf: create tcp_bpf_ulp allowing BPF to monitor socket TX/RX data") Reported-by: syzbot+4cabd1d2fa917a456db8(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/68c0b6b5.050a0220.3c6139.0013.GAE@google.com/ Signed-off-by: Kuniyuki Iwashima <kuniyu(a)google.com> Signed-off-by: Martin KaFai Lau <martin.lau(a)kernel.org> Link: https://patch.msgid.link/20250909232623.4151337-1-kuniyu@google.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/ipv4/tcp_bpf.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c index e5845d0..72974e4 100644 --- a/net/ipv4/tcp_bpf.c +++ b/net/ipv4/tcp_bpf.c @@ -417,8 +417,11 @@ static int tcp_bpf_send_verdict(struct sock *sk, struct sk_psock *psock, if (!psock->cork) { psock->cork = kzalloc(sizeof(*psock->cork), GFP_ATOMIC | __GFP_NOWARN); - if (!psock->cork) + if (!psock->cork) { + sk_msg_free(sk, msg); + *copied = 0; return -ENOMEM; + } } memcpy(psock->cork, msg, sizeof(*msg)); return 0; -- 2.9.5

2 1

[PATCH OLK-5.10] tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork.
by Zhang Changzhong 07 Feb '26

07 Feb '26

From: Kuniyuki Iwashima <kuniyu(a)google.com> stable inclusion from stable-v5.10.245 commit 05366527f44cf4b884f3d9462ae8009be9665856 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/8357 CVE: CVE-2025-39913 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a3967baad4d533dc254c31e0d221e51c8d223d58 ] syzbot reported the splat below. [0] The repro does the following: 1. Load a sk_msg prog that calls bpf_msg_cork_bytes(msg, cork_bytes) 2. Attach the prog to a SOCKMAP 3. Add a socket to the SOCKMAP 4. Activate fault injection 5. Send data less than cork_bytes At 5., the data is carried over to the next sendmsg() as it is smaller than the cork_bytes specified by bpf_msg_cork_bytes(). Then, tcp_bpf_send_verdict() tries to allocate psock->cork to hold the data, but this fails silently due to fault injection + __GFP_NOWARN. If the allocation fails, we need to revert the sk->sk_forward_alloc change done by sk_msg_alloc(). Let's call sk_msg_free() when tcp_bpf_send_verdict fails to allocate psock->cork. The "*copied" also needs to be updated such that a proper error can be returned to the caller, sendmsg. It fails to allocate psock->cork. Nothing has been corked so far, so this patch simply sets "*copied" to 0. [0]: WARNING: net/ipv4/af_inet.c:156 at inet_sock_destruct+0x623/0x730 net/ipv4/af_inet.c:156, CPU#1: syz-executor/5983 Modules linked in: CPU: 1 UID: 0 PID: 5983 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:inet_sock_destruct+0x623/0x730 net/ipv4/af_inet.c:156 Code: 0f 0b 90 e9 62 fe ff ff e8 7a db b5 f7 90 0f 0b 90 e9 95 fe ff ff e8 6c db b5 f7 90 0f 0b 90 e9 bb fe ff ff e8 5e db b5 f7 90 <0f> 0b 90 e9 e1 fe ff ff 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 9f fc RSP: 0018:ffffc90000a08b48 EFLAGS: 00010246 RAX: ffffffff8a09d0b2 RBX: dffffc0000000000 RCX: ffff888024a23c80 RDX: 0000000000000100 RSI: 0000000000000fff RDI: 0000000000000000 RBP: 0000000000000fff R08: ffff88807e07c627 R09: 1ffff1100fc0f8c4 R10: dffffc0000000000 R11: ffffed100fc0f8c5 R12: ffff88807e07c380 R13: dffffc0000000000 R14: ffff88807e07c60c R15: 1ffff1100fc0f872 FS: 00005555604c4500(0000) GS:ffff888125af1000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005555604df5c8 CR3: 0000000032b06000 CR4: 00000000003526f0 Call Trace: <IRQ> __sk_destruct+0x86/0x660 net/core/sock.c:2339 rcu_do_batch kernel/rcu/tree.c:2605 [inline] rcu_core+0xca8/0x1770 kernel/rcu/tree.c:2861 handle_softirqs+0x286/0x870 kernel/softirq.c:579 __do_softirq kernel/softirq.c:613 [inline] invoke_softirq kernel/softirq.c:453 [inline] __irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:680 irq_exit_rcu+0x9/0x30 kernel/softirq.c:696 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1052 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1052 </IRQ> Fixes: 4f738adba30a ("bpf: create tcp_bpf_ulp allowing BPF to monitor socket TX/RX data") Reported-by: syzbot+4cabd1d2fa917a456db8(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/68c0b6b5.050a0220.3c6139.0013.GAE@google.com/ Signed-off-by: Kuniyuki Iwashima <kuniyu(a)google.com> Signed-off-by: Martin KaFai Lau <martin.lau(a)kernel.org> Link: https://patch.msgid.link/20250909232623.4151337-1-kuniyu@google.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/ipv4/tcp_bpf.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c index 3841214..f780ba0 100644 --- a/net/ipv4/tcp_bpf.c +++ b/net/ipv4/tcp_bpf.c @@ -412,8 +412,11 @@ static int tcp_bpf_send_verdict(struct sock *sk, struct sk_psock *psock, if (!psock->cork) { psock->cork = kzalloc(sizeof(*psock->cork), GFP_ATOMIC | __GFP_NOWARN); - if (!psock->cork) + if (!psock->cork) { + sk_msg_free(sk, msg); + *copied = 0; return -ENOMEM; + } } memcpy(psock->cork, msg, sizeof(*msg)); return 0; -- 2.9.5

2 1

[PATCH OLK-5.10] i40e: Fix potential invalid access when MAC list is empty
by Zhang Changzhong 07 Feb '26

07 Feb '26

From: Zhen Ni <zhen.ni(a)easystack.cn> stable inclusion from stable-v5.10.243 commit 3c6fb929afa313d9d11f780451d113f73922fe5d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/8427 CVE: CVE-2025-39853 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a556f06338e1d5a85af0e32ecb46e365547f92b9 ] list_first_entry() never returns NULL - if the list is empty, it still returns a pointer to an invalid object, leading to potential invalid memory access when dereferenced. Fix this by using list_first_entry_or_null instead of list_first_entry. Fixes: e3219ce6a775 ("i40e: Add support for client interface for IWARP driver") Signed-off-by: Zhen Ni <zhen.ni(a)easystack.cn> Reviewed-by: Paul Menzel <pmenzel(a)molgen.mpg.de> Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/net/ethernet/intel/i40e/i40e_client.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/intel/i40e/i40e_client.c b/drivers/net/ethernet/intel/i40e/i40e_client.c index b3cb5d1..af65321 100644 --- a/drivers/net/ethernet/intel/i40e/i40e_client.c +++ b/drivers/net/ethernet/intel/i40e/i40e_client.c @@ -318,8 +318,8 @@ static void i40e_client_add_instance(struct i40e_pf *pf) return; } - mac = list_first_entry(&cdev->lan_info.netdev->dev_addrs.list, - struct netdev_hw_addr, list); + mac = list_first_entry_or_null(&cdev->lan_info.netdev->dev_addrs.list, + struct netdev_hw_addr, list); if (mac) ether_addr_copy(cdev->lan_info.lanmac, mac->addr); else -- 2.9.5

2 1

[PATCH OLK-5.10] Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen()
by Zhang Changzhong 07 Feb '26

07 Feb '26

From: Kuniyuki Iwashima <kuniyu(a)google.com> stable inclusion from stable-v5.10.243 commit 83e1d9892ef51785cf0760b7681436760dda435a category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/8438 CVE: CVE-2025-39860 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 862c628108562d8c7a516a900034823b381d3cba ] syzbot reported the splat below without a repro. In the splat, a single thread calling bt_accept_dequeue() freed sk and touched it after that. The root cause would be the racy l2cap_sock_cleanup_listen() call added by the cited commit. bt_accept_dequeue() is called under lock_sock() except for l2cap_sock_release(). Two threads could see the same socket during the list iteration in bt_accept_dequeue(): CPU1 CPU2 (close()) ---- ---- sock_hold(sk) sock_hold(sk); lock_sock(sk) <-- block close() sock_put(sk) bt_accept_unlink(sk) sock_put(sk) <-- refcnt by bt_accept_enqueue() release_sock(sk) lock_sock(sk) sock_put(sk) bt_accept_unlink(sk) sock_put(sk) <-- last refcnt bt_accept_unlink(sk) <-- UAF Depending on the timing, the other thread could show up in the "Freed by task" part. Let's call l2cap_sock_cleanup_listen() under lock_sock() in l2cap_sock_release(). [0]: BUG: KASAN: slab-use-after-free in debug_spin_lock_before kernel/locking/spinlock_debug.c:86 [inline] BUG: KASAN: slab-use-after-free in do_raw_spin_lock+0x26f/0x2b0 kernel/locking/spinlock_debug.c:115 Read of size 4 at addr ffff88803b7eb1c4 by task syz.5.3276/16995 CPU: 3 UID: 0 PID: 16995 Comm: syz.5.3276 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xcd/0x630 mm/kasan/report.c:482 kasan_report+0xe0/0x110 mm/kasan/report.c:595 debug_spin_lock_before kernel/locking/spinlock_debug.c:86 [inline] do_raw_spin_lock+0x26f/0x2b0 kernel/locking/spinlock_debug.c:115 spin_lock_bh include/linux/spinlock.h:356 [inline] release_sock+0x21/0x220 net/core/sock.c:3746 bt_accept_dequeue+0x505/0x600 net/bluetooth/af_bluetooth.c:312 l2cap_sock_cleanup_listen+0x5c/0x2a0 net/bluetooth/l2cap_sock.c:1451 l2cap_sock_release+0x5c/0x210 net/bluetooth/l2cap_sock.c:1425 __sock_release+0xb3/0x270 net/socket.c:649 sock_close+0x1c/0x30 net/socket.c:1439 __fput+0x3ff/0xb70 fs/file_table.c:468 task_work_run+0x14d/0x240 kernel/task_work.c:227 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop+0xeb/0x110 kernel/entry/common.c:43 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline] do_syscall_64+0x3f6/0x4c0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2accf8ebe9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffdb6cb1378 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00000000000426fb RCX: 00007f2accf8ebe9 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00007f2acd1b7da0 R08: 0000000000000001 R09: 00000012b6cb166f R10: 0000001b30e20000 R11: 0000000000000246 R12: 00007f2acd1b609c R13: 00007f2acd1b6090 R14: ffffffffffffffff R15: 00007ffdb6cb1490 </TASK> Allocated by task 5326: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:388 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:405 kasan_kmalloc include/linux/kasan.h:260 [inline] __do_kmalloc_node mm/slub.c:4365 [inline] __kmalloc_noprof+0x223/0x510 mm/slub.c:4377 kmalloc_noprof include/linux/slab.h:909 [inline] sk_prot_alloc+0x1a8/0x2a0 net/core/sock.c:2239 sk_alloc+0x36/0xc20 net/core/sock.c:2295 bt_sock_alloc+0x3b/0x3a0 net/bluetooth/af_bluetooth.c:151 l2cap_sock_alloc.constprop.0+0x33/0x1d0 net/bluetooth/l2cap_sock.c:1894 l2cap_sock_new_connection_cb+0x101/0x240 net/bluetooth/l2cap_sock.c:1482 l2cap_connect_cfm+0x4c4/0xf80 net/bluetooth/l2cap_core.c:7287 hci_connect_cfm include/net/bluetooth/hci_core.h:2050 [inline] hci_remote_features_evt+0x4dd/0x970 net/bluetooth/hci_event.c:3712 hci_event_func net/bluetooth/hci_event.c:7519 [inline] hci_event_packet+0xa0d/0x11c0 net/bluetooth/hci_event.c:7573 hci_rx_work+0x2c5/0x16b0 net/bluetooth/hci_core.c:4071 process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3236 process_scheduled_works kernel/workqueue.c:3319 [inline] worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400 kthread+0x3c2/0x780 kernel/kthread.c:463 ret_from_fork+0x5d7/0x6f0 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Freed by task 16995: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:576 poison_slab_object mm/kasan/common.c:243 [inline] __kasan_slab_free+0x60/0x70 mm/kasan/common.c:275 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2417 [inline] slab_free mm/slub.c:4680 [inline] kfree+0x2b4/0x4d0 mm/slub.c:4879 sk_prot_free net/core/sock.c:2278 [inline] __sk_destruct+0x75f/0x9a0 net/core/sock.c:2373 sk_destruct+0xc2/0xf0 net/core/sock.c:2401 __sk_free+0xf4/0x3e0 net/core/sock.c:2412 sk_free+0x6a/0x90 net/core/sock.c:2423 sock_put include/net/sock.h:1960 [inline] bt_accept_unlink+0x245/0x2e0 net/bluetooth/af_bluetooth.c:262 bt_accept_dequeue+0x517/0x600 net/bluetooth/af_bluetooth.c:308 l2cap_sock_cleanup_listen+0x5c/0x2a0 net/bluetooth/l2cap_sock.c:1451 l2cap_sock_release+0x5c/0x210 net/bluetooth/l2cap_sock.c:1425 __sock_release+0xb3/0x270 net/socket.c:649 sock_close+0x1c/0x30 net/socket.c:1439 __fput+0x3ff/0xb70 fs/file_table.c:468 task_work_run+0x14d/0x240 kernel/task_work.c:227 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop+0xeb/0x110 kernel/entry/common.c:43 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline] do_syscall_64+0x3f6/0x4c0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f Fixes: 1728137b33c0 ("Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb") Reported-by: syzbot+e5e64cdf8e92046dd3e1(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-bluetooth/68af6b9d.a70a0220.3cafd4.0032.GAE@g… Signed-off-by: Kuniyuki Iwashima <kuniyu(a)google.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/bluetooth/l2cap_sock.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c index 6537d08..86bd815 100644 --- a/net/bluetooth/l2cap_sock.c +++ b/net/bluetooth/l2cap_sock.c @@ -1408,7 +1408,10 @@ static int l2cap_sock_release(struct socket *sock) if (!sk) return 0; + lock_sock_nested(sk, L2CAP_NESTING_PARENT); l2cap_sock_cleanup_listen(sk); + release_sock(sk); + bt_sock_unlink(&l2cap_sk_list, sk); err = l2cap_sock_shutdown(sock, SHUT_RDWR); -- 2.9.5

2 1

[PATCH OLK-6.6] x86/CPU/AMD: Add RDSEED fix for Zen5
by Bowen You 06 Feb '26

06 Feb '26

From: Gregory Price <gourry(a)gourry.net> stable inclusion from stable-v6.12.57 commit e980de2ff109dacb6d9d3a77f01b27c467115ecb category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/11500 CVE: CVE-2025-68313 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 607b9fb2ce248cc5b633c5949e0153838992c152 upstream. There's an issue with RDSEED's 16-bit and 32-bit register output variants on Zen5 which return a random value of 0 "at a rate inconsistent with randomness while incorrectly signaling success (CF=1)". Search the web for AMD-SB-7055 for more detail. Add a fix glue which checks microcode revisions. [ bp: Add microcode revisions checking, rewrite. ] Cc: stable(a)vger.kernel.org Signed-off-by: Gregory Price <gourry(a)gourry.net> Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Link: https://lore.kernel.org/r/20251018024010.4112396-1-gourry@gourry.net [ bp: 6.12 backport: use the alternative microcode version checking. ] Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: arch/x86/include/asm/cpu.h arch/x86/kernel/cpu/microcode/amd.c [move the definition of zen_patch_rev] Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- arch/x86/include/asm/cpu.h | 12 ++++++++++ arch/x86/kernel/cpu/amd.c | 35 +++++++++++++++++++++++++++++ arch/x86/kernel/cpu/microcode/amd.c | 12 ---------- 3 files changed, 47 insertions(+), 12 deletions(-) diff --git a/arch/x86/include/asm/cpu.h b/arch/x86/include/asm/cpu.h index 43a228e11209..d252aa7f04fb 100644 --- a/arch/x86/include/asm/cpu.h +++ b/arch/x86/include/asm/cpu.h @@ -84,4 +84,16 @@ int intel_microcode_sanity_check(void *mc, bool print_err, int hdr_type); extern struct cpumask cpus_stop_mask; +union zen_patch_rev { + struct { + __u32 rev : 8, + stepping : 4, + model : 4, + __reserved : 4, + ext_model : 4, + ext_fam : 8; + }; + __u32 ucode_rev; +}; + #endif /* _ASM_X86_CPU_H */ diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c index f89dbe6f48e6..5a46bf0cce5d 100644 --- a/arch/x86/kernel/cpu/amd.c +++ b/arch/x86/kernel/cpu/amd.c @@ -1135,8 +1135,43 @@ static void init_amd_zen4(struct cpuinfo_x86 *c) } } +static bool check_rdseed_microcode(void) +{ + struct cpuinfo_x86 *c = &boot_cpu_data; + union zen_patch_rev p; + u32 min_rev = 0; + + p.ext_fam = c->x86 - 0xf; + p.model = c->x86_model; + p.ext_model = c->x86_model >> 4; + p.stepping = c->x86_stepping; + /* reserved bits are expected to be 0 in test below */ + p.__reserved = 0; + + if (cpu_has(c, X86_FEATURE_ZEN5)) { + switch (p.ucode_rev >> 8) { + case 0xb0021: min_rev = 0xb00215a; break; + case 0xb1010: min_rev = 0xb101054; break; + default: + pr_debug("%s: ucode_rev: 0x%x, current revision: 0x%x\n", + __func__, p.ucode_rev, c->microcode); + return false; + } + } + + if (!min_rev) + return false; + + return c->microcode >= min_rev; +} + static void init_amd_zen5(struct cpuinfo_x86 *c) { + if (!check_rdseed_microcode()) { + clear_cpu_cap(c, X86_FEATURE_RDSEED); + msr_clear_bit(MSR_AMD64_CPUID_FN_7, 18); + pr_emerg_once("RDSEED32 is broken. Disabling the corresponding CPUID bit.\n"); + } } static void init_amd(struct cpuinfo_x86 *c) diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c index b6990dc26274..75746a991f8e 100644 --- a/arch/x86/kernel/cpu/microcode/amd.c +++ b/arch/x86/kernel/cpu/microcode/amd.c @@ -96,18 +96,6 @@ static struct equiv_cpu_table { struct equiv_cpu_entry *entry; } equiv_table; -union zen_patch_rev { - struct { - __u32 rev : 8, - stepping : 4, - model : 4, - __reserved : 4, - ext_model : 4, - ext_fam : 8; - }; - __u32 ucode_rev; -}; - union cpuid_1_eax { struct { __u32 stepping : 4, -- 2.34.1

2 1

[PATCH OLK-5.10] fbdev: Fix vmalloc out-of-bounds write in fast_imageblit
by Jiacheng Yu 06 Feb '26

06 Feb '26

From: Sravan Kumar Gundu <sravankumarlpu(a)gmail.com> mainline inclusion from mainline-v6.17-rc1 commit af0db3c1f898144846d4c172531a199bb3ca375d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/9085 CVE: CVE-2025-38685 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- This issue triggers when a userspace program does an ioctl FBIOPUT_CON2FBMAP by passing console number and frame buffer number. Ideally this maps console to frame buffer and updates the screen if console is visible. As part of mapping it has to do resize of console according to frame buffer info. if this resize fails and returns from vc_do_resize() and continues further. At this point console and new frame buffer are mapped and sets display vars. Despite failure still it continue to proceed updating the screen at later stages where vc_data is related to previous frame buffer and frame buffer info and display vars are mapped to new frame buffer and eventully leading to out-of-bounds write in fast_imageblit(). This bheviour is excepted only when fg_console is equal to requested console which is a visible console and updates screen with invalid struct references in fbcon_putcs(). Reported-and-tested-by: syzbot+c4b7aa0513823e2ea880(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=c4b7aa0513823e2ea880 Signed-off-by: Sravan Kumar Gundu <sravankumarlpu(a)gmail.com> Cc: stable(a)vger.kernel.org Signed-off-by: Helge Deller <deller(a)gmx.de> Conflicts: drivers/video/fbdev/core/fbcon.c [Context conflicts.] Signed-off-by: Jiacheng Yu <yujiacheng3(a)huawei.com> --- drivers/video/fbdev/core/fbcon.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c index 81bf4f7bd9e8..66ecb2a044c6 100644 --- a/drivers/video/fbdev/core/fbcon.c +++ b/drivers/video/fbdev/core/fbcon.c @@ -827,7 +827,8 @@ static void con2fb_init_display(struct vc_data *vc, struct fb_info *info, fg_vc->vc_rows); } - update_screen(vc_cons[fg_console].d); + if (fg_console != unit) + update_screen(vc_cons[fg_console].d); } /** @@ -1366,6 +1367,7 @@ static void fbcon_set_disp(struct fb_info *info, struct fb_var_screeninfo *var, struct vc_data *svc; struct fbcon_ops *ops = info->fbcon_par; int rows, cols, charcnt = 256; + unsigned long ret = 0; p = &fb_display[unit]; @@ -1417,11 +1419,10 @@ static void fbcon_set_disp(struct fb_info *info, struct fb_var_screeninfo *var, rows = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres); cols /= vc->vc_font.width; rows /= vc->vc_font.height; - vc_resize(vc, cols, rows); + ret = vc_resize(vc, cols, rows); - if (con_is_visible(vc)) { + if (con_is_visible(vc) && !ret) update_screen(vc); - } } static __inline__ void ywrap_up(struct vc_data *vc, int count) -- 2.43.0

2 1

[PATCH OLK-5.10] Revert "!19950 [OLK-5.10] Drivers GPU Patches from 6.6"
by Tengda Wu 06 Feb '26

06 Feb '26

This reverts commit 84c1c0818c45cdfbbaa4b5ba4b8a552a52f5760e, reversing changes made to 67fd5a0f7d0f1baceab00f0d3901a94803f0aee1. Commit 70dcc68078ac introduced a null-pointer dereference exception, causing kernel boot failure: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000048 Call trace: hibmc_debugfs_init+0x38/0x68 [hibmc_drm] hibmc_pci_probe+0xdc/0x1ac [hibmc_drm] local_pci_probe+0x48/0xb0 work_for_cpu_fn+0x24/0x50 process_one_work+0x1d8/0x4c0 worker_thread+0x25c/0x470 kthread+0x108/0x150 Temporarily revert the entire associated patch series as a precautionary measure to circumvent the issue. Fixes: 70dcc68078ac ("drm/hisilicon/hibmc: hibmc-drm bugfix for DP") Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- drivers/gpu/drm/drm_connector.c | 9 - drivers/gpu/drm/drm_internal.h | 2 - drivers/gpu/drm/drm_probe_helper.c | 29 -- drivers/gpu/drm/drm_sysfs.c | 17 +- drivers/gpu/drm/hisilicon/hibmc/Kconfig | 2 - drivers/gpu/drm/hisilicon/hibmc/Makefile | 4 +- drivers/gpu/drm/hisilicon/hibmc/dp/dp_aux.c | 167 ------- drivers/gpu/drm/hisilicon/hibmc/dp/dp_comm.h | 73 --- .../gpu/drm/hisilicon/hibmc/dp/dp_config.h | 21 - drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.c | 338 -------------- drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.h | 74 ---- drivers/gpu/drm/hisilicon/hibmc/dp/dp_link.c | 415 ------------------ drivers/gpu/drm/hisilicon/hibmc/dp/dp_reg.h | 140 ------ .../gpu/drm/hisilicon/hibmc/dp/dp_serdes.c | 59 --- .../drm/hisilicon/hibmc/hibmc_drm_debugfs.c | 149 ------- .../gpu/drm/hisilicon/hibmc/hibmc_drm_dp.c | 257 ----------- .../gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c | 127 ++---- .../gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h | 31 +- .../gpu/drm/hisilicon/hibmc/hibmc_drm_i2c.c | 48 +- .../gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c | 60 +-- include/drm/drm_probe_helper.h | 3 - 21 files changed, 79 insertions(+), 1946 deletions(-) delete mode 100644 drivers/gpu/drm/hisilicon/hibmc/dp/dp_aux.c delete mode 100644 drivers/gpu/drm/hisilicon/hibmc/dp/dp_comm.h delete mode 100644 drivers/gpu/drm/hisilicon/hibmc/dp/dp_config.h delete mode 100644 drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.c delete mode 100644 drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.h delete mode 100644 drivers/gpu/drm/hisilicon/hibmc/dp/dp_link.c delete mode 100644 drivers/gpu/drm/hisilicon/hibmc/dp/dp_reg.h delete mode 100644 drivers/gpu/drm/hisilicon/hibmc/dp/dp_serdes.c delete mode 100644 drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_debugfs.c delete mode 100644 drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_dp.c diff --git a/drivers/gpu/drm/drm_connector.c b/drivers/gpu/drm/drm_connector.c index fa9675396287..9c3bbe2c3e6f 100644 --- a/drivers/gpu/drm/drm_connector.c +++ b/drivers/gpu/drm/drm_connector.c @@ -525,10 +525,6 @@ int drm_connector_register(struct drm_connector *connector) goto err_debugfs; } - ret = drm_sysfs_connector_add_late(connector); - if (ret) - goto err_late_register; - drm_mode_object_register(connector->dev, &connector->base); connector->registration_state = DRM_CONNECTOR_REGISTERED; @@ -538,9 +534,6 @@ int drm_connector_register(struct drm_connector *connector) goto unlock; -err_late_register: - if (connector->funcs->early_unregister) - connector->funcs->early_unregister(connector); err_debugfs: drm_debugfs_connector_remove(connector); drm_sysfs_connector_remove(connector); @@ -567,8 +560,6 @@ void drm_connector_unregister(struct drm_connector *connector) return; } - drm_sysfs_connector_remove_early(connector); - if (connector->funcs->early_unregister) connector->funcs->early_unregister(connector); diff --git a/drivers/gpu/drm/drm_internal.h b/drivers/gpu/drm/drm_internal.h index fbad756446a2..41efe40bc70f 100644 --- a/drivers/gpu/drm/drm_internal.h +++ b/drivers/gpu/drm/drm_internal.h @@ -165,8 +165,6 @@ int drm_sysfs_init(void); void drm_sysfs_destroy(void); struct device *drm_sysfs_minor_alloc(struct drm_minor *minor); int drm_sysfs_connector_add(struct drm_connector *connector); -int drm_sysfs_connector_add_late(struct drm_connector *connector); -void drm_sysfs_connector_remove_early(struct drm_connector *connector); void drm_sysfs_connector_remove(struct drm_connector *connector); void drm_sysfs_lease_event(struct drm_device *dev); diff --git a/drivers/gpu/drm/drm_probe_helper.c b/drivers/gpu/drm/drm_probe_helper.c index ef4eb87fa599..d3f0d048594e 100644 --- a/drivers/gpu/drm/drm_probe_helper.c +++ b/drivers/gpu/drm/drm_probe_helper.c @@ -875,32 +875,3 @@ bool drm_helper_hpd_irq_event(struct drm_device *dev) return changed; } EXPORT_SYMBOL(drm_helper_hpd_irq_event); - -/** - * drm_connector_helper_detect_from_ddc - Read EDID and detect connector status. - * @connector: The connector - * @ctx: Acquire context - * @force: Perform screen-destructive operations, if necessary - * - * Detects the connector status by reading the EDID using drm_probe_ddc(), - * which requires connector->ddc to be set. Returns connector_status_connected - * on success or connector_status_disconnected on failure. - * - * Returns: - * The connector status as defined by enum drm_connector_status. - */ -int drm_connector_helper_detect_from_ddc(struct drm_connector *connector, - struct drm_modeset_acquire_ctx *ctx, - bool force) -{ - struct i2c_adapter *ddc = connector->ddc; - - if (!ddc) - return connector_status_unknown; - - if (drm_probe_ddc(ddc)) - return connector_status_connected; - - return connector_status_disconnected; -} -EXPORT_SYMBOL(drm_connector_helper_detect_from_ddc); diff --git a/drivers/gpu/drm/drm_sysfs.c b/drivers/gpu/drm/drm_sysfs.c index 5f65981bdaf4..f0336c804639 100644 --- a/drivers/gpu/drm/drm_sysfs.c +++ b/drivers/gpu/drm/drm_sysfs.c @@ -291,29 +291,20 @@ int drm_sysfs_connector_add(struct drm_connector *connector) return PTR_ERR(connector->kdev); } - return 0; -} - -int drm_sysfs_connector_add_late(struct drm_connector *connector) -{ if (connector->ddc) return sysfs_create_link(&connector->kdev->kobj, - &connector->ddc->dev.kobj, "ddc"); - + &connector->ddc->dev.kobj, "ddc"); return 0; } -void drm_sysfs_connector_remove_early(struct drm_connector *connector) -{ - if (connector->ddc) - sysfs_remove_link(&connector->kdev->kobj, "ddc"); -} - void drm_sysfs_connector_remove(struct drm_connector *connector) { if (!connector->kdev) return; + if (connector->ddc) + sysfs_remove_link(&connector->kdev->kobj, "ddc"); + DRM_DEBUG("removing \"%s\" from sysfs\n", connector->name); diff --git a/drivers/gpu/drm/hisilicon/hibmc/Kconfig b/drivers/gpu/drm/hisilicon/hibmc/Kconfig index 44c83c80aa68..4e41c144a290 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/Kconfig +++ b/drivers/gpu/drm/hisilicon/hibmc/Kconfig @@ -3,8 +3,6 @@ config DRM_HISI_HIBMC tristate "DRM Support for Hisilicon Hibmc" depends on DRM && PCI && (ARM64 || COMPILE_TEST) depends on MMU - select DRM_DISPLAY_HELPER - select DRM_DISPLAY_DP_HELPER select DRM_KMS_HELPER select DRM_VRAM_HELPER select DRM_TTM diff --git a/drivers/gpu/drm/hisilicon/hibmc/Makefile b/drivers/gpu/drm/hisilicon/hibmc/Makefile index 43fe471caee3..684ef794eb7c 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/Makefile +++ b/drivers/gpu/drm/hisilicon/hibmc/Makefile @@ -1,6 +1,4 @@ # SPDX-License-Identifier: GPL-2.0-only -hibmc-drm-y := hibmc_drm_drv.o hibmc_drm_de.o hibmc_drm_vdac.o hibmc_ttm.o hibmc_drm_i2c.o \ - dp/dp_aux.o dp/dp_link.o dp/dp_hw.o dp/dp_serdes.o hibmc_drm_dp.o \ - hibmc_drm_debugfs.o +hibmc-drm-y := hibmc_drm_drv.o hibmc_drm_de.o hibmc_drm_vdac.o hibmc_ttm.o hibmc_drm_i2c.o obj-$(CONFIG_DRM_HISI_HIBMC) += hibmc-drm.o diff --git a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_aux.c b/drivers/gpu/drm/hisilicon/hibmc/dp/dp_aux.c deleted file mode 100644 index 533611a211ad..000000000000 --- a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_aux.c +++ /dev/null @@ -1,167 +0,0 @@ -// SPDX-License-Identifier: GPL-2.0-or-later -// Copyright (c) 2024 Hisilicon Limited. - -#include <linux/io.h> -#include <linux/iopoll.h> -#include <linux/minmax.h> -#include <drm/drm_device.h> -#include <drm/drm_print.h> -#include "dp_comm.h" -#include "dp_reg.h" -#include "dp_hw.h" - -#define HIBMC_AUX_CMD_REQ_LEN GENMASK(7, 4) -#define HIBMC_AUX_CMD_ADDR GENMASK(27, 8) -#define HIBMC_AUX_CMD_I2C_ADDR_ONLY BIT(28) -#define HIBMC_BYTES_IN_U32 4 -#define HIBMC_AUX_I2C_WRITE_SUCCESS 0x1 -#define HIBMC_DP_MIN_PULSE_NUM 0x9 -#define BITS_IN_U8 8 - -static inline void hibmc_dp_aux_reset(struct hibmc_dp_dev *dp) -{ - hibmc_dp_reg_write_field(dp, HIBMC_DP_DPTX_RST_CTRL, HIBMC_DP_CFG_AUX_RST_N, 0x0); - usleep_range(10, 15); - hibmc_dp_reg_write_field(dp, HIBMC_DP_DPTX_RST_CTRL, HIBMC_DP_CFG_AUX_RST_N, 0x1); -} - -static void hibmc_dp_aux_read_data(struct hibmc_dp_dev *dp, u8 *buf, u8 size) -{ - u32 reg_num; - u32 value; - u32 num; - u8 i, j; - - reg_num = DIV_ROUND_UP(size, HIBMC_BYTES_IN_U32); - for (i = 0; i < reg_num; i++) { - /* number of bytes read from a single register */ - num = min(size - i * HIBMC_BYTES_IN_U32, HIBMC_BYTES_IN_U32); - value = readl(dp->base + HIBMC_DP_AUX_RD_DATA0 + i * HIBMC_BYTES_IN_U32); - /* convert the 32-bit value of the register to the buffer. */ - for (j = 0; j < num; j++) - buf[i * HIBMC_BYTES_IN_U32 + j] = value >> (j * BITS_IN_U8); - } -} - -static void hibmc_dp_aux_write_data(struct hibmc_dp_dev *dp, u8 *buf, u8 size) -{ - u32 reg_num; - u32 value; - u32 num; - u8 i, j; - - reg_num = DIV_ROUND_UP(size, HIBMC_BYTES_IN_U32); - for (i = 0; i < reg_num; i++) { - /* number of bytes written to a single register */ - num = min_t(u8, size - i * HIBMC_BYTES_IN_U32, HIBMC_BYTES_IN_U32); - value = 0; - /* obtain the 32-bit value written to a single register. */ - for (j = 0; j < num; j++) - value |= buf[i * HIBMC_BYTES_IN_U32 + j] << (j * BITS_IN_U8); - /* writing data to a single register */ - writel(value, dp->base + HIBMC_DP_AUX_WR_DATA0 + i * HIBMC_BYTES_IN_U32); - } -} - -static u32 hibmc_dp_aux_build_cmd(const struct drm_dp_aux_msg *msg) -{ - u32 aux_cmd = msg->request; - - if (msg->size) - aux_cmd |= FIELD_PREP(HIBMC_AUX_CMD_REQ_LEN, (msg->size - 1)); - else - aux_cmd |= FIELD_PREP(HIBMC_AUX_CMD_I2C_ADDR_ONLY, 1); - - aux_cmd |= FIELD_PREP(HIBMC_AUX_CMD_ADDR, msg->address); - - return aux_cmd; -} - -/* ret >= 0, ret is size; ret < 0, ret is err code */ -static int hibmc_dp_aux_parse_xfer(struct hibmc_dp_dev *dp, struct drm_dp_aux_msg *msg) -{ - u32 buf_data_cnt; - u32 aux_status; - - aux_status = readl(dp->base + HIBMC_DP_AUX_STATUS); - msg->reply = FIELD_GET(HIBMC_DP_CFG_AUX_STATUS, aux_status); - - if (aux_status & HIBMC_DP_CFG_AUX_TIMEOUT) - return -ETIMEDOUT; - - /* only address */ - if (!msg->size) - return 0; - - if (msg->reply != DP_AUX_NATIVE_REPLY_ACK) - return -EIO; - - buf_data_cnt = FIELD_GET(HIBMC_DP_CFG_AUX_READY_DATA_BYTE, aux_status); - - switch (msg->request) { - case DP_AUX_NATIVE_WRITE: - return msg->size; - case DP_AUX_I2C_WRITE | DP_AUX_I2C_MOT: - if (buf_data_cnt == HIBMC_AUX_I2C_WRITE_SUCCESS) - return msg->size; - else - return FIELD_GET(HIBMC_DP_CFG_AUX, aux_status); - case DP_AUX_NATIVE_READ: - case DP_AUX_I2C_READ | DP_AUX_I2C_MOT: - buf_data_cnt--; - if (buf_data_cnt != msg->size) { - /* only the successful part of data is read */ - return -EBUSY; - } - - /* all data is successfully read */ - hibmc_dp_aux_read_data(dp, msg->buffer, msg->size); - return msg->size; - default: - return -EINVAL; - } -} - -/* ret >= 0 ,ret is size; ret < 0, ret is err code */ -static ssize_t hibmc_dp_aux_xfer(struct drm_dp_aux *aux, struct drm_dp_aux_msg *msg) -{ - struct hibmc_dp *dp_priv = container_of(aux, struct hibmc_dp, aux); - struct hibmc_dp_dev *dp = dp_priv->dp_dev; - u32 aux_cmd; - int ret; - u32 val; /* val will be assigned at the beginning of readl_poll_timeout function */ - - writel(0, dp->base + HIBMC_DP_AUX_WR_DATA0); - writel(0, dp->base + HIBMC_DP_AUX_WR_DATA1); - writel(0, dp->base + HIBMC_DP_AUX_WR_DATA2); - writel(0, dp->base + HIBMC_DP_AUX_WR_DATA3); - - hibmc_dp_aux_write_data(dp, msg->buffer, msg->size); - - aux_cmd = hibmc_dp_aux_build_cmd(msg); - writel(aux_cmd, dp->base + HIBMC_DP_AUX_CMD_ADDR); - - /* enable aux transfer */ - hibmc_dp_reg_write_field(dp, HIBMC_DP_AUX_REQ, HIBMC_DP_CFG_AUX_REQ, 0x1); - ret = readl_poll_timeout(dp->base + HIBMC_DP_AUX_REQ, val, - !(val & HIBMC_DP_CFG_AUX_REQ), 50, 5000); - if (ret) { - hibmc_dp_aux_reset(dp); - return ret; - } - - return hibmc_dp_aux_parse_xfer(dp, msg); -} - -void hibmc_dp_aux_init(struct hibmc_dp *dp) -{ - hibmc_dp_reg_write_field(dp->dp_dev, HIBMC_DP_AUX_REQ, HIBMC_DP_CFG_AUX_SYNC_LEN_SEL, 0x0); - hibmc_dp_reg_write_field(dp->dp_dev, HIBMC_DP_AUX_REQ, HIBMC_DP_CFG_AUX_TIMER_TIMEOUT, 0x1); - hibmc_dp_reg_write_field(dp->dp_dev, HIBMC_DP_AUX_REQ, HIBMC_DP_CFG_AUX_MIN_PULSE_NUM, - HIBMC_DP_MIN_PULSE_NUM); - - dp->aux.transfer = hibmc_dp_aux_xfer; - dp->aux.name = "HIBMC DRM dp aux"; - drm_dp_aux_init(&dp->aux); - dp->dp_dev->aux = &dp->aux; -} diff --git a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_comm.h b/drivers/gpu/drm/hisilicon/hibmc/dp/dp_comm.h deleted file mode 100644 index 1107e10b2047..000000000000 --- a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_comm.h +++ /dev/null @@ -1,73 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0-or-later */ -/* Copyright (c) 2024 Hisilicon Limited. */ - -#ifndef DP_COMM_H -#define DP_COMM_H - -#include <linux/types.h> -#include <linux/bitops.h> -#include <linux/errno.h> -#include <linux/mutex.h> -#include <linux/kernel.h> -#include <linux/bitfield.h> -#include <linux/io.h> -#include <drm/drm_dp_helper.h> - -#include "dp_hw.h" - -#define HIBMC_DP_LINK_RATE_CAL 27 -#define HIBMC_DP_LANE_NUM_MAX 2 - -struct hibmc_link_status { - bool clock_recovered; - bool channel_equalized; -}; - -struct hibmc_link_cap { - u8 link_rate; - u8 lanes; - int rx_dpcd_revision; - bool is_tps3; - bool is_tps4; -}; - -struct hibmc_dp_link { - struct hibmc_link_status status; - u8 train_set[HIBMC_DP_LANE_NUM_MAX]; - struct hibmc_link_cap cap; -}; - -struct hibmc_dp_dev { - struct drm_dp_aux *aux; - struct drm_device *dev; - void __iomem *base; - struct mutex lock; /* protects concurrent RW in hibmc_dp_reg_write_field() */ - struct hibmc_dp_link link; - u8 dpcd[DP_RECEIVER_CAP_SIZE]; - void __iomem *serdes_base; -}; - -#define dp_field_modify(reg_value, mask, val) \ - do { \ - (reg_value) &= ~(mask); \ - (reg_value) |= FIELD_PREP(mask, val); \ - } while (0) \ - -#define hibmc_dp_reg_write_field(dp, offset, mask, val) \ - do { \ - u32 reg_value; \ - typeof(dp) _dp = dp; \ - typeof(_dp->base) addr = (_dp->base + (offset)); \ - mutex_lock(&_dp->lock); \ - reg_value = readl(addr); \ - dp_field_modify(reg_value, mask, val); \ - writel(reg_value, addr); \ - mutex_unlock(&_dp->lock); \ - } while (0) - -void hibmc_dp_aux_init(struct hibmc_dp *dp); -int hibmc_dp_link_training(struct hibmc_dp_dev *dp); -int hibmc_dp_serdes_rate_switch(u8 rate, struct hibmc_dp_dev *dp); -int hibmc_dp_serdes_set_tx_cfg(struct hibmc_dp_dev *dp, u8 train_set[HIBMC_DP_LANE_NUM_MAX]); - -#endif diff --git a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_config.h b/drivers/gpu/drm/hisilicon/hibmc/dp/dp_config.h deleted file mode 100644 index 08f9e1caf7fc..000000000000 --- a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_config.h +++ /dev/null @@ -1,21 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0-or-later */ -/* Copyright (c) 2024 Hisilicon Limited. */ - -#ifndef DP_CONFIG_H -#define DP_CONFIG_H - -#define HIBMC_DP_BPP 24 -#define HIBMC_DP_SYMBOL_PER_FCLK 4 -#define HIBMC_DP_MSA1 0x20 -#define HIBMC_DP_MSA2 0x845c00 -#define HIBMC_DP_OFFSET 0x1e0000 -#define HIBMC_DP_HDCP 0x2 -#define HIBMC_DP_INT_RST 0xffff -#define HIBMC_DP_DPTX_RST 0x3ff -#define HIBMC_DP_CLK_EN 0x7 -#define HIBMC_DP_SYNC_EN_MASK 0x3 -#define HIBMC_DP_LINK_RATE_CAL 27 -#define HIBMC_DP_SYNC_DELAY(lanes) ((lanes) == 0x2 ? 86 : 46) -#define HIBMC_DP_INT_ENABLE 0xc - -#endif diff --git a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.c b/drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.c deleted file mode 100644 index 9e8f95d957f2..000000000000 --- a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.c +++ /dev/null @@ -1,338 +0,0 @@ -// SPDX-License-Identifier: GPL-2.0-or-later -// Copyright (c) 2024 Hisilicon Limited. - -#include <linux/io.h> -#include <linux/delay.h> -#include "dp_config.h" -#include "dp_comm.h" -#include "dp_reg.h" -#include "dp_hw.h" - -static void hibmc_dp_set_tu(struct hibmc_dp_dev *dp, struct drm_display_mode *mode) -{ - u32 tu_symbol_frac_size; - u32 tu_symbol_size; - u32 rate_ks; - u8 lane_num; - u32 value; - u32 bpp; - - lane_num = dp->link.cap.lanes; - if (lane_num == 0) { - drm_err(dp->dev, "set tu failed, lane num cannot be 0!\n"); - return; - } - - bpp = HIBMC_DP_BPP; - rate_ks = dp->link.cap.link_rate * HIBMC_DP_LINK_RATE_CAL; - value = (mode->clock * bpp * 5) / (61 * lane_num * rate_ks); - - if (value % 10 == 9) { /* 9 carry */ - tu_symbol_size = value / 10 + 1; - tu_symbol_frac_size = 0; - } else { - tu_symbol_size = value / 10; - tu_symbol_frac_size = value % 10 + 1; - } - - drm_dbg_dp(dp->dev, "tu value: %u.%u value: %u\n", - tu_symbol_size, tu_symbol_frac_size, value); - - hibmc_dp_reg_write_field(dp, HIBMC_DP_VIDEO_PACKET, - HIBMC_DP_CFG_STREAM_TU_SYMBOL_SIZE, tu_symbol_size); - hibmc_dp_reg_write_field(dp, HIBMC_DP_VIDEO_PACKET, - HIBMC_DP_CFG_STREAM_TU_SYMBOL_FRAC_SIZE, tu_symbol_frac_size); -} - -static void hibmc_dp_set_sst(struct hibmc_dp_dev *dp, struct drm_display_mode *mode) -{ - u32 hblank_size; - u32 htotal_size; - u32 htotal_int; - u32 hblank_int; - u32 fclk; /* flink_clock */ - - fclk = dp->link.cap.link_rate * HIBMC_DP_LINK_RATE_CAL; - - /* Considering the effect of spread spectrum, the value may be deviated. - * The coefficient (0.9947) is used to offset the deviation. - */ - htotal_int = mode->htotal * 9947 / 10000; - htotal_size = htotal_int * fclk / (HIBMC_DP_SYMBOL_PER_FCLK * (mode->clock / 1000)); - - hblank_int = mode->htotal - mode->hdisplay - mode->hdisplay * 53 / 10000; - hblank_size = hblank_int * fclk * 9947 / - (mode->clock * 10 * HIBMC_DP_SYMBOL_PER_FCLK); - - drm_dbg_dp(dp->dev, "h_active %u v_active %u htotal_size %u hblank_size %u", - mode->hdisplay, mode->vdisplay, htotal_size, hblank_size); - drm_dbg_dp(dp->dev, "flink_clock %u pixel_clock %d", fclk, mode->clock / 1000); - - hibmc_dp_reg_write_field(dp, HIBMC_DP_VIDEO_HORIZONTAL_SIZE, - HIBMC_DP_CFG_STREAM_HTOTAL_SIZE, htotal_size); - hibmc_dp_reg_write_field(dp, HIBMC_DP_VIDEO_HORIZONTAL_SIZE, - HIBMC_DP_CFG_STREAM_HBLANK_SIZE, hblank_size); - hibmc_dp_reg_write_field(dp, HIBMC_DP_VIDEO_PACKET, - HIBMC_DP_CFG_STREAM_SYNC_CALIBRATION, - HIBMC_DP_SYNC_DELAY(dp->link.cap.lanes)); -} - -static void hibmc_dp_link_cfg(struct hibmc_dp_dev *dp, struct drm_display_mode *mode) -{ - u32 timing_delay; - u32 vblank; - u32 hstart; - u32 vstart; - - vblank = mode->vtotal - mode->vdisplay; - timing_delay = mode->htotal - mode->hsync_start; - hstart = mode->htotal - mode->hsync_start; - vstart = mode->vtotal - mode->vsync_start; - - hibmc_dp_reg_write_field(dp, HIBMC_DP_TIMING_GEN_CONFIG0, - HIBMC_DP_CFG_TIMING_GEN0_HBLANK, mode->htotal - mode->hdisplay); - hibmc_dp_reg_write_field(dp, HIBMC_DP_TIMING_GEN_CONFIG0, - HIBMC_DP_CFG_TIMING_GEN0_HACTIVE, mode->hdisplay); - - hibmc_dp_reg_write_field(dp, HIBMC_DP_TIMING_GEN_CONFIG2, - HIBMC_DP_CFG_TIMING_GEN0_VBLANK, vblank); - hibmc_dp_reg_write_field(dp, HIBMC_DP_TIMING_GEN_CONFIG2, - HIBMC_DP_CFG_TIMING_GEN0_VACTIVE, mode->vdisplay); - hibmc_dp_reg_write_field(dp, HIBMC_DP_TIMING_GEN_CONFIG3, - HIBMC_DP_CFG_TIMING_GEN0_VFRONT_PORCH, - mode->vsync_start - mode->vdisplay); - - hibmc_dp_reg_write_field(dp, HIBMC_DP_VIDEO_CONFIG0, - HIBMC_DP_CFG_STREAM_HACTIVE, mode->hdisplay); - hibmc_dp_reg_write_field(dp, HIBMC_DP_VIDEO_CONFIG0, - HIBMC_DP_CFG_STREAM_HBLANK, mode->htotal - mode->hdisplay); - hibmc_dp_reg_write_field(dp, HIBMC_DP_VIDEO_CONFIG2, - HIBMC_DP_CFG_STREAM_HSYNC_WIDTH, - mode->hsync_end - mode->hsync_start); - - hibmc_dp_reg_write_field(dp, HIBMC_DP_VIDEO_CONFIG1, - HIBMC_DP_CFG_STREAM_VACTIVE, mode->vdisplay); - hibmc_dp_reg_write_field(dp, HIBMC_DP_VIDEO_CONFIG1, - HIBMC_DP_CFG_STREAM_VBLANK, vblank); - hibmc_dp_reg_write_field(dp, HIBMC_DP_VIDEO_CONFIG3, - HIBMC_DP_CFG_STREAM_VFRONT_PORCH, - mode->vsync_start - mode->vdisplay); - hibmc_dp_reg_write_field(dp, HIBMC_DP_VIDEO_CONFIG3, - HIBMC_DP_CFG_STREAM_VSYNC_WIDTH, - mode->vsync_end - mode->vsync_start); - - hibmc_dp_reg_write_field(dp, HIBMC_DP_VIDEO_MSA0, - HIBMC_DP_CFG_STREAM_VSTART, vstart); - hibmc_dp_reg_write_field(dp, HIBMC_DP_VIDEO_MSA0, - HIBMC_DP_CFG_STREAM_HSTART, hstart); - - hibmc_dp_reg_write_field(dp, HIBMC_DP_VIDEO_CTRL, HIBMC_DP_CFG_STREAM_VSYNC_POLARITY, - mode->flags & DRM_MODE_FLAG_PVSYNC ? 1 : 0); - hibmc_dp_reg_write_field(dp, HIBMC_DP_VIDEO_CTRL, HIBMC_DP_CFG_STREAM_HSYNC_POLARITY, - mode->flags & DRM_MODE_FLAG_PHSYNC ? 1 : 0); - - /* MSA mic 0 and 1 */ - writel(HIBMC_DP_MSA1, dp->base + HIBMC_DP_VIDEO_MSA1); - writel(HIBMC_DP_MSA2, dp->base + HIBMC_DP_VIDEO_MSA2); - - hibmc_dp_set_tu(dp, mode); - - hibmc_dp_reg_write_field(dp, HIBMC_DP_VIDEO_CTRL, HIBMC_DP_CFG_STREAM_RGB_ENABLE, 0x1); - hibmc_dp_reg_write_field(dp, HIBMC_DP_VIDEO_CTRL, HIBMC_DP_CFG_STREAM_VIDEO_MAPPING, 0); - - /* divide 2: up even */ - if (timing_delay % 2) - timing_delay++; - - hibmc_dp_reg_write_field(dp, HIBMC_DP_TIMING_MODEL_CTRL, - HIBMC_DP_CFG_PIXEL_NUM_TIMING_MODE_SEL1, timing_delay); - - hibmc_dp_set_sst(dp, mode); -} - -int hibmc_dp_hw_init(struct hibmc_dp *dp) -{ - struct drm_device *drm_dev = dp->drm_dev; - struct hibmc_dp_dev *dp_dev; - - dp_dev = devm_kzalloc(drm_dev->dev, sizeof(struct hibmc_dp_dev), GFP_KERNEL); - if (!dp_dev) - return -ENOMEM; - - mutex_init(&dp_dev->lock); - - dp->dp_dev = dp_dev; - - dp_dev->dev = drm_dev; - dp_dev->base = dp->mmio + HIBMC_DP_OFFSET; - dp_dev->serdes_base = dp_dev->base + HIBMC_DP_HOST_OFFSET; - - hibmc_dp_aux_init(dp); - - dp_dev->link.cap.lanes = 0x2; - dp_dev->link.cap.link_rate = DP_LINK_BW_8_1; - - /* int init */ - writel(0, dp_dev->base + HIBMC_DP_INTR_ENABLE); - writel(HIBMC_DP_INT_RST, dp_dev->base + HIBMC_DP_INTR_ORIGINAL_STATUS); - /* rst */ - writel(0, dp_dev->base + HIBMC_DP_DPTX_RST_CTRL); - usleep_range(30, 50); - writel(HIBMC_DP_DPTX_RST, dp_dev->base + HIBMC_DP_DPTX_RST_CTRL); - /* hdcp data */ - writel(HIBMC_DP_HDCP, dp_dev->base + HIBMC_DP_HDCP_CFG); - /* clock enable */ - writel(HIBMC_DP_CLK_EN, dp_dev->base + HIBMC_DP_DPTX_CLK_CTRL); - - return 0; -} - -void hibmc_dp_enable_int(struct hibmc_dp *dp) -{ - struct hibmc_dp_dev *dp_dev = dp->dp_dev; - - writel(HIBMC_DP_INT_ENABLE, dp_dev->base + HIBMC_DP_INTR_ENABLE); -} - -void hibmc_dp_disable_int(struct hibmc_dp *dp) -{ - struct hibmc_dp_dev *dp_dev = dp->dp_dev; - - writel(0, dp_dev->base + HIBMC_DP_INTR_ENABLE); - writel(HIBMC_DP_INT_RST, dp_dev->base + HIBMC_DP_INTR_ORIGINAL_STATUS); -} - -void hibmc_dp_hpd_cfg(struct hibmc_dp *dp) -{ - struct hibmc_dp_dev *dp_dev = dp->dp_dev; - - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_AUX_REQ, HIBMC_DP_CFG_AUX_SYNC_LEN_SEL, 0x0); - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_AUX_REQ, HIBMC_DP_CFG_AUX_TIMER_TIMEOUT, 0x1); - hibmc_dp_reg_write_field(dp->dp_dev, HIBMC_DP_AUX_REQ, HIBMC_DP_CFG_AUX_MIN_PULSE_NUM, 0x9); - writel(HIBMC_DP_HDCP, dp_dev->base + HIBMC_DP_HDCP_CFG); - writel(0, dp_dev->base + HIBMC_DP_INTR_ENABLE); - writel(HIBMC_DP_INT_RST, dp_dev->base + HIBMC_DP_INTR_ORIGINAL_STATUS); - writel(HIBMC_DP_INT_ENABLE, dp_dev->base + HIBMC_DP_INTR_ENABLE); - writel(HIBMC_DP_DPTX_RST, dp_dev->base + HIBMC_DP_DPTX_RST_CTRL); - writel(HIBMC_DP_CLK_EN, dp_dev->base + HIBMC_DP_DPTX_CLK_CTRL); -} - -void hibmc_dp_display_en(struct hibmc_dp *dp, bool enable) -{ - struct hibmc_dp_dev *dp_dev = dp->dp_dev; - - if (enable) { - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_VIDEO_CTRL, - HIBMC_DP_CFG_MST_ENABLE, 0x1); - writel(HIBMC_DP_SYNC_EN_MASK, dp_dev->base + HIBMC_DP_TIMING_SYNC_CTRL); - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_DPTX_GCTL0, - HIBMC_DP_CFG_TIMING_GEN_ENABLE, 0x1); - writel(HIBMC_DP_SYNC_EN_MASK, dp_dev->base + HIBMC_DP_TIMING_SYNC_CTRL); - } else { - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_DPTX_GCTL0, - HIBMC_DP_CFG_TIMING_GEN_ENABLE, 0); - writel(HIBMC_DP_SYNC_EN_MASK, dp_dev->base + HIBMC_DP_TIMING_SYNC_CTRL); - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_VIDEO_CTRL, HIBMC_DP_CFG_MST_ENABLE, 0); - writel(HIBMC_DP_SYNC_EN_MASK, dp_dev->base + HIBMC_DP_TIMING_SYNC_CTRL); - } - - msleep(50); -} - -int hibmc_dp_mode_set(struct hibmc_dp *dp, struct drm_display_mode *mode) -{ - struct hibmc_dp_dev *dp_dev = dp->dp_dev; - int ret; - - if (!dp_dev->link.status.channel_equalized) { - ret = hibmc_dp_link_training(dp_dev); - if (ret) { - drm_err(dp->drm_dev, "dp link training failed, ret: %d\n", ret); - return ret; - } - } - - hibmc_dp_display_en(dp, false); - hibmc_dp_link_cfg(dp_dev, mode); - - return 0; -} - -u8 hibmc_dp_get_link_rate(struct hibmc_dp *dp) -{ - if (!dp->dp_dev) - return 0; - - return dp->dp_dev->link.cap.link_rate; -} - -u8 hibmc_dp_get_lanes(struct hibmc_dp *dp) -{ - if (!dp->dp_dev) - return 0; - - return dp->dp_dev->link.cap.lanes; -} - -int hibmc_dp_get_dpcd(struct hibmc_dp *dp) -{ - if (!dp->dp_dev) - return 0; - - return dp->dp_dev->link.cap.rx_dpcd_revision; -} - -void hibmc_dp_reset_link(struct hibmc_dp *dp) -{ - if (dp->dp_dev) { - dp->dp_dev->link.status.clock_recovered = false; - dp->dp_dev->link.status.channel_equalized = false; - } -} - -static const struct hibmc_dp_color_raw g_rgb_raw[] = { - {CBAR_COLOR_BAR, 0x000, 0x000, 0x000}, - {CBAR_WHITE, 0xfff, 0xfff, 0xfff}, - {CBAR_RED, 0xfff, 0x000, 0x000}, - {CBAR_ORANGE, 0xfff, 0x800, 0x000}, - {CBAR_YELLOW, 0xfff, 0xfff, 0x000}, - {CBAR_GREEN, 0x000, 0xfff, 0x000}, - {CBAR_CYAN, 0x000, 0x800, 0x800}, - {CBAR_BLUE, 0x000, 0x000, 0xfff}, - {CBAR_PURPLE, 0x800, 0x000, 0x800}, - {CBAR_BLACK, 0x000, 0x000, 0x000}, -}; - -void hibmc_dp_set_cbar(struct hibmc_dp *dp, const struct hibmc_dp_cbar_cfg *cfg) -{ - struct hibmc_dp_dev *dp_dev = dp->dp_dev; - struct hibmc_dp_color_raw raw_data; - - if (cfg->enable) { - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL, - HIBMC_DP_COLOR_BAR_TIMING_SEL_M, cfg->self_timing); - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL, - HIBMC_DP_COLOR_BAR_CTRL_M, cfg->dynamic_rate); - if (cfg->pattern == CBAR_COLOR_BAR) { - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL, - HIBMC_DP_COLOR_BAR_PATTERN_SEL_M, 0); - } else { - raw_data = g_rgb_raw[cfg->pattern]; - drm_dbg_dp(dp->drm_dev, "r:%x g:%x b:%x\n", raw_data.r_value, - raw_data.g_value, raw_data.b_value); - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL, - HIBMC_DP_COLOR_BAR_PATTERN_SEL_M, 1); - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL, - HIBMC_DP_COLOR_BAR_DATA_R_M, raw_data.r_value); - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL1, - HIBMC_DP_COLOR_BAR_DATA_G_M, raw_data.g_value); - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL1, - HIBMC_DP_COLOR_BAR_DATA_B_M, raw_data.b_value); - } - } - - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL, - HIBMC_DP_COLOR_BAR_ENABLE_M, cfg->enable); - writel(HIBMC_DP_SYNC_EN_MASK, dp_dev->base + HIBMC_DP_TIMING_SYNC_CTRL); -} - diff --git a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.h b/drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.h deleted file mode 100644 index 4740db06e1b0..000000000000 --- a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.h +++ /dev/null @@ -1,74 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0-or-later */ -/* Copyright (c) 2024 Hisilicon Limited. */ - -#ifndef DP_KAPI_H -#define DP_KAPI_H - -#include <linux/types.h> -#include <linux/delay.h> -#include <drm/drm_device.h> -#include <drm/drm_encoder.h> -#include <drm/drm_connector.h> -#include <drm/drm_print.h> -#include <drm/drm_dp_helper.h> - -// 27 * 10000000 * 80% = 216000000 -#define DP_MODE_VALI_CAL 216000000 -#define BPP_24 24 - -struct hibmc_dp_dev; - -enum hibmc_dp_cbar_pattern { - CBAR_COLOR_BAR, - CBAR_WHITE, - CBAR_RED, - CBAR_ORANGE, - CBAR_YELLOW, - CBAR_GREEN, - CBAR_CYAN, - CBAR_BLUE, - CBAR_PURPLE, - CBAR_BLACK, -}; - -struct hibmc_dp_color_raw { - enum hibmc_dp_cbar_pattern pattern; - u32 r_value; - u32 g_value; - u32 b_value; -}; - -struct hibmc_dp_cbar_cfg { - u8 enable; - u8 self_timing; - u8 dynamic_rate; /* 0:static, 1-255(frame):dynamic */ - enum hibmc_dp_cbar_pattern pattern; -}; - -struct hibmc_dp { - struct hibmc_dp_dev *dp_dev; - struct drm_device *drm_dev; - struct drm_encoder encoder; - struct drm_connector connector; - void __iomem *mmio; - struct drm_dp_aux aux; - struct hibmc_dp_cbar_cfg cfg; - u32 irq_status; - int hpd_status; - bool is_connected; -}; - -int hibmc_dp_hw_init(struct hibmc_dp *dp); -int hibmc_dp_mode_set(struct hibmc_dp *dp, struct drm_display_mode *mode); -void hibmc_dp_display_en(struct hibmc_dp *dp, bool enable); -struct edid *hibmc_dp_get_edid(struct hibmc_dp *dp); -int hibmc_dp_get_dpcd(struct hibmc_dp *dp); -u8 hibmc_dp_get_link_rate(struct hibmc_dp *dp); -u8 hibmc_dp_get_lanes(struct hibmc_dp *dp); -void hibmc_dp_set_cbar(struct hibmc_dp *dp, const struct hibmc_dp_cbar_cfg *cfg); -void hibmc_dp_reset_link(struct hibmc_dp *dp); -void hibmc_dp_hpd_cfg(struct hibmc_dp *dp); -void hibmc_dp_enable_int(struct hibmc_dp *dp); -void hibmc_dp_disable_int(struct hibmc_dp *dp); - -#endif diff --git a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_link.c b/drivers/gpu/drm/hisilicon/hibmc/dp/dp_link.c deleted file mode 100644 index 9b632428fec6..000000000000 --- a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_link.c +++ /dev/null @@ -1,415 +0,0 @@ -// SPDX-License-Identifier: GPL-2.0-or-later -// Copyright (c) 2024 Hisilicon Limited. - -#include <linux/delay.h> -#include <drm/drm_device.h> -#include <drm/drm_print.h> -#include "dp_comm.h" -#include "dp_reg.h" - -#define HIBMC_EQ_MAX_RETRY 5 - -static inline int hibmc_dp_get_serdes_rate_cfg(struct hibmc_dp_dev *dp) -{ - switch (dp->link.cap.link_rate) { - case DP_LINK_BW_1_62: - return DP_SERDES_BW_1_62; - case DP_LINK_BW_2_7: - return DP_SERDES_BW_2_7; - case DP_LINK_BW_5_4: - return DP_SERDES_BW_5_4; - case DP_LINK_BW_8_1: - return DP_SERDES_BW_8_1; - default: - return -EINVAL; - } -} - -static int hibmc_dp_link_training_configure(struct hibmc_dp_dev *dp) -{ - u8 buf[2]; - int ret; - - /* DP 2 lane */ - hibmc_dp_reg_write_field(dp, HIBMC_DP_PHYIF_CTRL0, HIBMC_DP_CFG_LANE_DATA_EN, - dp->link.cap.lanes == 0x2 ? 0x3 : 0x1); - hibmc_dp_reg_write_field(dp, HIBMC_DP_DPTX_GCTL0, HIBMC_DP_CFG_PHY_LANE_NUM, - dp->link.cap.lanes == 0x2 ? 0x1 : 0); - - /* enhanced frame */ - hibmc_dp_reg_write_field(dp, HIBMC_DP_VIDEO_CTRL, HIBMC_DP_CFG_STREAM_FRAME_MODE, 0x1); - - ret = hibmc_dp_get_serdes_rate_cfg(dp); - if (ret < 0) - return ret; - - ret = hibmc_dp_serdes_rate_switch(ret, dp); - if (ret) - return ret; - - /* set rate and lane count */ - buf[0] = dp->link.cap.link_rate; - buf[1] = DP_LANE_COUNT_ENHANCED_FRAME_EN | dp->link.cap.lanes; - ret = drm_dp_dpcd_write(dp->aux, DP_LINK_BW_SET, buf, sizeof(buf)); - if (ret != sizeof(buf)) { - drm_dbg_dp(dp->dev, "dp aux write link rate and lanes failed, ret: %d\n", ret); - return ret >= 0 ? -EIO : ret; - } - - /* set 8b/10b and downspread */ - buf[0] = DP_SPREAD_AMP_0_5; - buf[1] = DP_SET_ANSI_8B10B; - ret = drm_dp_dpcd_write(dp->aux, DP_DOWNSPREAD_CTRL, buf, sizeof(buf)); - if (ret != sizeof(buf)) { - drm_dbg_dp(dp->dev, "dp aux write 8b/10b and downspread failed, ret: %d\n", ret); - return ret >= 0 ? -EIO : ret; - } - - return 0; -} - -static int hibmc_dp_link_set_pattern(struct hibmc_dp_dev *dp, int pattern) -{ - int ret; - u8 val; - u8 buf; - - buf = (u8)pattern; - if (pattern != DP_TRAINING_PATTERN_DISABLE && pattern != DP_TRAINING_PATTERN_4) { - buf |= DP_LINK_SCRAMBLING_DISABLE; - hibmc_dp_reg_write_field(dp, HIBMC_DP_PHYIF_CTRL0, HIBMC_DP_CFG_SCRAMBLE_EN, 0x1); - } else { - hibmc_dp_reg_write_field(dp, HIBMC_DP_PHYIF_CTRL0, HIBMC_DP_CFG_SCRAMBLE_EN, 0); - } - - switch (pattern) { - case DP_TRAINING_PATTERN_DISABLE: - val = 0; - break; - case DP_TRAINING_PATTERN_1: - val = 1; - break; - case DP_TRAINING_PATTERN_2: - val = 2; - break; - case DP_TRAINING_PATTERN_3: - val = 3; - break; - case DP_TRAINING_PATTERN_4: - val = 4; - break; - default: - return -EINVAL; - } - - hibmc_dp_reg_write_field(dp, HIBMC_DP_PHYIF_CTRL0, HIBMC_DP_CFG_PAT_SEL, val); - - ret = drm_dp_dpcd_write(dp->aux, DP_TRAINING_PATTERN_SET, &buf, sizeof(buf)); - if (ret != sizeof(buf)) { - drm_dbg_dp(dp->dev, "dp aux write training pattern set failed\n"); - return ret >= 0 ? -EIO : ret; - } - - return 0; -} - -static int hibmc_dp_link_training_cr_pre(struct hibmc_dp_dev *dp) -{ - u8 *train_set = dp->link.train_set; - int ret; - u8 i; - - ret = hibmc_dp_link_training_configure(dp); - if (ret) - return ret; - - ret = hibmc_dp_link_set_pattern(dp, DP_TRAINING_PATTERN_1); - if (ret) - return ret; - - for (i = 0; i < dp->link.cap.lanes; i++) - train_set[i] = DP_TRAIN_VOLTAGE_SWING_LEVEL_0; - - ret = hibmc_dp_serdes_set_tx_cfg(dp, dp->link.train_set); - if (ret) - return ret; - - ret = drm_dp_dpcd_write(dp->aux, DP_TRAINING_LANE0_SET, train_set, dp->link.cap.lanes); - if (ret != dp->link.cap.lanes) { - drm_dbg_dp(dp->dev, "dp aux write training lane set failed\n"); - return ret >= 0 ? -EIO : ret; - } - - return 0; -} - -static bool hibmc_dp_link_get_adjust_train(struct hibmc_dp_dev *dp, - u8 lane_status[DP_LINK_STATUS_SIZE]) -{ - u8 train_set[HIBMC_DP_LANE_NUM_MAX] = {0}; - u8 lane; - - for (lane = 0; lane < dp->link.cap.lanes; lane++) - train_set[lane] = drm_dp_get_adjust_request_voltage(lane_status, lane) | - drm_dp_get_adjust_request_pre_emphasis(lane_status, lane); - - if (memcmp(dp->link.train_set, train_set, HIBMC_DP_LANE_NUM_MAX)) { - memcpy(dp->link.train_set, train_set, HIBMC_DP_LANE_NUM_MAX); - return true; - } - - return false; -} - -static int hibmc_dp_link_reduce_rate(struct hibmc_dp_dev *dp) -{ - int ret; - - switch (dp->link.cap.link_rate) { - case DP_LINK_BW_2_7: - dp->link.cap.link_rate = DP_LINK_BW_1_62; - break; - case DP_LINK_BW_5_4: - dp->link.cap.link_rate = DP_LINK_BW_2_7; - break; - case DP_LINK_BW_8_1: - dp->link.cap.link_rate = DP_LINK_BW_5_4; - break; - default: - return -EINVAL; - } - - ret = hibmc_dp_get_serdes_rate_cfg(dp); - if (ret < 0) - return ret; - - return hibmc_dp_serdes_rate_switch(ret, dp); -} - -static inline int hibmc_dp_link_reduce_lane(struct hibmc_dp_dev *dp) -{ - switch (dp->link.cap.lanes) { - case 0x2: - dp->link.cap.lanes--; - drm_dbg_dp(dp->dev, "dp link training reduce to 1 lane\n"); - break; - case 0x1: - drm_err(dp->dev, "dp link training reduce lane failed, already reach minimum\n"); - return -EIO; - default: - return -EINVAL; - } - - return 0; -} - -static int hibmc_dp_link_training_cr(struct hibmc_dp_dev *dp) -{ - u8 lane_status[DP_LINK_STATUS_SIZE] = {0}; - bool level_changed; - u32 voltage_tries; - u32 cr_tries; - u32 max_cr; - int ret; - - /* - * DP 1.4 spec define 10 for maxtries value, for pre DP 1.4 version set a limit of 80 - * (4 voltage levels x 4 preemphasis levels x 5 identical voltage retries) - */ - max_cr = dp->link.cap.rx_dpcd_revision >= DP_DPCD_REV_14 ? 10 : 80; - - voltage_tries = 1; - for (cr_tries = 0; cr_tries < max_cr; cr_tries++) { - drm_dp_link_train_clock_recovery_delay(dp->dpcd); - - ret = drm_dp_dpcd_read_link_status(dp->aux, lane_status); - if (ret != DP_LINK_STATUS_SIZE) { - drm_err(dp->dev, "Get lane status failed, ret: %d\n", ret); - return ret >= 0 ? -EIO : ret; - } - - if (drm_dp_clock_recovery_ok(lane_status, dp->link.cap.lanes)) { - drm_dbg_dp(dp->dev, "dp link training cr done\n"); - dp->link.status.clock_recovered = true; - return 0; - } - - if (voltage_tries == 5) { - drm_dbg_dp(dp->dev, "same voltage tries 5 times\n"); - dp->link.status.clock_recovered = false; - return 0; - } - - level_changed = hibmc_dp_link_get_adjust_train(dp, lane_status); - - ret = hibmc_dp_serdes_set_tx_cfg(dp, dp->link.train_set); - if (ret) - return ret; - - ret = drm_dp_dpcd_write(dp->aux, DP_TRAINING_LANE0_SET, dp->link.train_set, - dp->link.cap.lanes); - if (ret != dp->link.cap.lanes) { - drm_dbg_dp(dp->dev, "Update link training failed\n"); - return ret >= 0 ? -EIO : ret; - } - - voltage_tries = level_changed ? 1 : voltage_tries + 1; - } - - drm_err(dp->dev, "dp link training clock recovery %u timers failed\n", max_cr); - dp->link.status.clock_recovered = false; - - return 0; -} - -static int hibmc_dp_link_training_channel_eq(struct hibmc_dp_dev *dp) -{ - u8 lane_status[DP_LINK_STATUS_SIZE] = {0}; - u8 eq_tries; - int tps; - int ret; - - if (dp->link.cap.is_tps4) - tps = DP_TRAINING_PATTERN_4; - else if (dp->link.cap.is_tps3) - tps = DP_TRAINING_PATTERN_3; - else - tps = DP_TRAINING_PATTERN_2; - - ret = hibmc_dp_link_set_pattern(dp, tps); - if (ret) - return ret; - - for (eq_tries = 0; eq_tries < HIBMC_EQ_MAX_RETRY; eq_tries++) { - drm_dp_link_train_channel_eq_delay(dp->dpcd); - - ret = drm_dp_dpcd_read_link_status(dp->aux, lane_status); - if (ret != DP_LINK_STATUS_SIZE) { - drm_err(dp->dev, "get lane status failed\n"); - break; - } - - if (!drm_dp_clock_recovery_ok(lane_status, dp->link.cap.lanes)) { - drm_dbg_dp(dp->dev, "clock recovery check failed\n"); - drm_dbg_dp(dp->dev, "cannot continue channel equalization\n"); - dp->link.status.clock_recovered = false; - break; - } - - if (drm_dp_channel_eq_ok(lane_status, dp->link.cap.lanes)) { - dp->link.status.channel_equalized = true; - drm_dbg_dp(dp->dev, "dp link training eq done\n"); - break; - } - - hibmc_dp_link_get_adjust_train(dp, lane_status); - - ret = hibmc_dp_serdes_set_tx_cfg(dp, dp->link.train_set); - if (ret) - break; - - ret = drm_dp_dpcd_write(dp->aux, DP_TRAINING_LANE0_SET, - dp->link.train_set, dp->link.cap.lanes); - if (ret != dp->link.cap.lanes) { - drm_dbg_dp(dp->dev, "Update link training failed\n"); - ret = (ret >= 0) ? -EIO : ret; - break; - } - } - - if (eq_tries == HIBMC_EQ_MAX_RETRY) - drm_err(dp->dev, "channel equalization failed %u times\n", eq_tries); - - hibmc_dp_link_set_pattern(dp, DP_TRAINING_PATTERN_DISABLE); - - return ret < 0 ? ret : 0; -} - -static int hibmc_dp_link_downgrade_training_cr(struct hibmc_dp_dev *dp) -{ - if (hibmc_dp_link_reduce_rate(dp)) - return hibmc_dp_link_reduce_lane(dp); - - return 0; -} - -static int hibmc_dp_link_downgrade_training_eq(struct hibmc_dp_dev *dp) -{ - u8 status[DP_LINK_STATUS_SIZE] = {0}; - int ret; - - ret = drm_dp_dpcd_read_link_status(dp->aux, status); - if (ret != DP_LINK_STATUS_SIZE) { - drm_err(dp->dev, "get lane status failed\n"); - return ret >= 0 ? -EIO : ret; - } - - if ((dp->link.status.clock_recovered && !dp->link.status.channel_equalized) || - (status[0] != 0 && !dp->link.status.clock_recovered)) { // at least one cr_done - if (!hibmc_dp_link_reduce_lane(dp)) - return 0; - } - - return hibmc_dp_link_reduce_rate(dp); -} - -static void hibmc_dp_update_caps(struct hibmc_dp_dev *dp) -{ - dp->link.cap.rx_dpcd_revision = dp->dpcd[DP_DPCD_REV]; - - dp->link.cap.is_tps3 = (dp->dpcd[DP_DPCD_REV] >= DP_DPCD_REV_13) && - (dp->dpcd[DP_MAX_LANE_COUNT] & DP_TPS3_SUPPORTED); - dp->link.cap.is_tps4 = (dp->dpcd[DP_DPCD_REV] >= DP_DPCD_REV_14) && - (dp->dpcd[DP_MAX_DOWNSPREAD] & DP_TPS4_SUPPORTED); - dp->link.cap.link_rate = dp->dpcd[DP_MAX_LINK_RATE]; - dp->link.cap.lanes = dp->dpcd[DP_MAX_LANE_COUNT] & DP_MAX_LANE_COUNT_MASK; - if (dp->link.cap.lanes > HIBMC_DP_LANE_NUM_MAX) - dp->link.cap.lanes = HIBMC_DP_LANE_NUM_MAX; -} - -int hibmc_dp_link_training(struct hibmc_dp_dev *dp) -{ - struct hibmc_dp_link *link = &dp->link; - int ret; - - ret = drm_dp_read_dpcd_caps(dp->aux, dp->dpcd); - if (ret) - drm_err(dp->dev, "dp aux read dpcd failed, ret: %d\n", ret); - - hibmc_dp_update_caps(dp); - - while (true) { - ret = hibmc_dp_link_training_cr_pre(dp); - if (ret) - goto err; - - ret = hibmc_dp_link_training_cr(dp); - if (ret) - goto err; - - if (!link->status.clock_recovered) { - ret = hibmc_dp_link_downgrade_training_cr(dp); - if (ret) - goto err; - continue; - } - - ret = hibmc_dp_link_training_channel_eq(dp); - if (ret) - goto err; - - if (!link->status.channel_equalized) { - ret = hibmc_dp_link_downgrade_training_eq(dp); - if (ret) - goto err; - continue; - } - - return 0; - } - -err: - hibmc_dp_link_set_pattern(dp, DP_TRAINING_PATTERN_DISABLE); - - return ret; -} diff --git a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_reg.h b/drivers/gpu/drm/hisilicon/hibmc/dp/dp_reg.h deleted file mode 100644 index 156e5d63c47f..000000000000 --- a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_reg.h +++ /dev/null @@ -1,140 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0-or-later */ -/* Copyright (c) 2024 Hisilicon Limited. */ - -#ifndef DP_REG_H -#define DP_REG_H - -#define HIBMC_DP_AUX_CMD_ADDR 0x50 - -#define HIBMC_DP_AUX_WR_DATA0 0x54 -#define HIBMC_DP_AUX_WR_DATA1 0x58 -#define HIBMC_DP_AUX_WR_DATA2 0x5c -#define HIBMC_DP_AUX_WR_DATA3 0x60 -#define HIBMC_DP_AUX_RD_DATA0 0x64 - -#define HIBMC_DP_AUX_REQ 0x74 -#define HIBMC_DP_CFG_AUX_REQ BIT(0) -#define HIBMC_DP_CFG_AUX_SYNC_LEN_SEL BIT(1) -#define HIBMC_DP_CFG_AUX_TIMER_TIMEOUT BIT(2) -#define HIBMC_DP_CFG_AUX_MIN_PULSE_NUM GENMASK(13, 9) - -#define HIBMC_DP_AUX_STATUS 0x78 -#define HIBMC_DP_CFG_AUX_TIMEOUT BIT(0) -#define HIBMC_DP_CFG_AUX_STATUS GENMASK(11, 4) -#define HIBMC_DP_CFG_AUX_READY_DATA_BYTE GENMASK(16, 12) -#define HIBMC_DP_CFG_AUX GENMASK(24, 17) - -#define HIBMC_DP_PHYIF_CTRL0 0xa0 -#define HIBMC_DP_CFG_SCRAMBLE_EN BIT(0) -#define HIBMC_DP_CFG_PAT_SEL GENMASK(7, 4) -#define HIBMC_DP_CFG_LANE_DATA_EN GENMASK(11, 8) - -#define HIBMC_DP_VIDEO_CTRL 0x100 -#define HIBMC_DP_CFG_STREAM_RGB_ENABLE BIT(1) -#define HIBMC_DP_CFG_STREAM_VIDEO_MAPPING GENMASK(5, 2) -#define HIBMC_DP_CFG_STREAM_FRAME_MODE BIT(6) -#define HIBMC_DP_CFG_STREAM_HSYNC_POLARITY BIT(7) -#define HIBMC_DP_CFG_STREAM_VSYNC_POLARITY BIT(8) - -#define HIBMC_DP_VIDEO_CONFIG0 0x104 -#define HIBMC_DP_CFG_STREAM_HACTIVE GENMASK(31, 16) -#define HIBMC_DP_CFG_STREAM_HBLANK GENMASK(15, 0) - -#define HIBMC_DP_VIDEO_CONFIG1 0x108 -#define HIBMC_DP_CFG_STREAM_VACTIVE GENMASK(31, 16) -#define HIBMC_DP_CFG_STREAM_VBLANK GENMASK(15, 0) - -#define HIBMC_DP_VIDEO_CONFIG2 0x10c -#define HIBMC_DP_CFG_STREAM_HSYNC_WIDTH GENMASK(15, 0) - -#define HIBMC_DP_VIDEO_CONFIG3 0x110 -#define HIBMC_DP_CFG_STREAM_VSYNC_WIDTH GENMASK(15, 0) -#define HIBMC_DP_CFG_STREAM_VFRONT_PORCH GENMASK(31, 16) - -#define HIBMC_DP_VIDEO_PACKET 0x114 -#define HIBMC_DP_CFG_STREAM_TU_SYMBOL_SIZE GENMASK(5, 0) -#define HIBMC_DP_CFG_STREAM_TU_SYMBOL_FRAC_SIZE GENMASK(9, 6) -#define HIBMC_DP_CFG_STREAM_SYNC_CALIBRATION GENMASK(31, 20) - -#define HIBMC_DP_VIDEO_MSA0 0x118 -#define HIBMC_DP_CFG_STREAM_VSTART GENMASK(31, 16) -#define HIBMC_DP_CFG_STREAM_HSTART GENMASK(15, 0) - -#define HIBMC_DP_VIDEO_MSA1 0x11c -#define HIBMC_DP_VIDEO_MSA2 0x120 - -#define HIBMC_DP_VIDEO_HORIZONTAL_SIZE 0X124 -#define HIBMC_DP_CFG_STREAM_HTOTAL_SIZE GENMASK(31, 16) -#define HIBMC_DP_CFG_STREAM_HBLANK_SIZE GENMASK(15, 0) - -#define HIBMC_DP_COLOR_BAR_CTRL 0x260 -#define HIBMC_DP_COLOR_BAR_ENABLE_M BIT(0) -#define HIBMC_DP_COLOR_BAR_CTRL_M GENMASK(8, 1) -#define HIBMC_DP_COLOR_BAR_TIMING_SEL_M BIT(9) -#define HIBMC_DP_COLOR_BAR_PATTERN_SEL_M BIT(10) -#define HIBMC_DP_COLOR_BAR_DATA_R_M GENMASK(23, 12) -#define HIBMC_DP_COLOR_BAR_CTRL1 0x264 -#define HIBMC_DP_COLOR_BAR_DATA_B_M GENMASK(11, 0) -#define HIBMC_DP_COLOR_BAR_DATA_G_M GENMASK(23, 12) -#define HIBMC_DP_TIMING_GEN_CONFIG0 0x26c -#define HIBMC_DP_CFG_TIMING_GEN0_HACTIVE GENMASK(31, 16) -#define HIBMC_DP_CFG_TIMING_GEN0_HBLANK GENMASK(15, 0) - -#define HIBMC_DP_TIMING_GEN_CONFIG2 0x274 -#define HIBMC_DP_CFG_TIMING_GEN0_VACTIVE GENMASK(31, 16) -#define HIBMC_DP_CFG_TIMING_GEN0_VBLANK GENMASK(15, 0) - -#define HIBMC_DP_TIMING_GEN_CONFIG3 0x278 -#define HIBMC_DP_CFG_TIMING_GEN0_VFRONT_PORCH GENMASK(31, 16) - -#define HIBMC_DP_HDCP_CFG 0x600 - -#define HIBMC_DP_DPTX_RST_CTRL 0x700 -#define HIBMC_DP_CFG_AUX_RST_N BIT(4) - -#define HIBMC_DP_DPTX_CLK_CTRL 0x704 - -#define HIBMC_DP_DPTX_GCTL0 0x708 -#define HIBMC_DP_CFG_PHY_LANE_NUM GENMASK(2, 1) -#define HIBMC_DP_CFG_TIMING_GEN_ENABLE BIT(10) -#define HIBMC_DP_CFG_MST_ENABLE BIT(0) - -#define HIBMC_DP_INTR_ENABLE 0x720 -#define HIBMC_DP_INTR_ORIGINAL_STATUS 0x728 - -#define HIBMC_DP_TIMING_MODEL_CTRL 0x884 -#define HIBMC_DP_CFG_PIXEL_NUM_TIMING_MODE_SEL1 GENMASK(31, 16) - -#define HIBMC_DP_TIMING_SYNC_CTRL 0xFF0 - -#define HIBMC_DP_INTSTAT 0x1e0724 -#define HIBMC_DP_INTCLR 0x1e0728 - -/* dp serdes reg */ -#define HIBMC_DP_HOST_OFFSET 0x10000 -#define HIBMC_DP_LANE0_RATE_OFFSET 0x4 -#define HIBMC_DP_LANE1_RATE_OFFSET 0xc -#define HIBMC_DP_LANE_STATUS_OFFSET 0x10 -#define HIBMC_DP_PMA_LANE0_OFFSET 0x18 -#define HIBMC_DP_PMA_LANE1_OFFSET 0x1c -#define HIBMC_DP_HOST_SERDES_CTRL 0x1f001c -#define HIBMC_DP_PMA_TXDEEMPH GENMASK(18, 1) -#define DP_SERDES_DONE 0x3 - -/* dp serdes TX-Deempth Configuration */ -#define DP_SERDES_VOL0_PRE0 0x280 -#define DP_SERDES_VOL0_PRE1 0x2300 -#define DP_SERDES_VOL0_PRE2 0x53c0 -#define DP_SERDES_VOL0_PRE3 0x8400 -#define DP_SERDES_VOL1_PRE0 0x380 -#define DP_SERDES_VOL1_PRE1 0x3440 -#define DP_SERDES_VOL1_PRE2 0x6480 -#define DP_SERDES_VOL2_PRE0 0x4c1 -#define DP_SERDES_VOL2_PRE1 0x4500 -#define DP_SERDES_VOL3_PRE0 0x600 -#define DP_SERDES_BW_8_1 0x3 -#define DP_SERDES_BW_5_4 0x2 -#define DP_SERDES_BW_2_7 0x1 -#define DP_SERDES_BW_1_62 0x0 - -#endif diff --git a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_serdes.c b/drivers/gpu/drm/hisilicon/hibmc/dp/dp_serdes.c deleted file mode 100644 index 8191233aa965..000000000000 --- a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_serdes.c +++ /dev/null @@ -1,59 +0,0 @@ -// SPDX-License-Identifier: GPL-2.0-or-later -// Copyright (c) 2025 Hisilicon Limited. - -#include <linux/delay.h> -#include <drm/drm_device.h> -#include <drm/drm_print.h> -#include "dp_comm.h" -#include "dp_config.h" -#include "dp_reg.h" - -int hibmc_dp_serdes_set_tx_cfg(struct hibmc_dp_dev *dp, u8 train_set[HIBMC_DP_LANE_NUM_MAX]) -{ - static const u32 serdes_tx_cfg[4][4] = { {DP_SERDES_VOL0_PRE0, DP_SERDES_VOL0_PRE1, - DP_SERDES_VOL0_PRE2, DP_SERDES_VOL0_PRE3}, - {DP_SERDES_VOL1_PRE0, DP_SERDES_VOL1_PRE1, - DP_SERDES_VOL1_PRE2}, {DP_SERDES_VOL2_PRE0, - DP_SERDES_VOL2_PRE1}, {DP_SERDES_VOL3_PRE0}}; - int cfg[2]; - int i; - - for (i = 0; i < HIBMC_DP_LANE_NUM_MAX; i++) { - cfg[i] = serdes_tx_cfg[FIELD_GET(DP_TRAIN_VOLTAGE_SWING_MASK, train_set[i])] - [FIELD_GET(DP_TRAIN_PRE_EMPHASIS_MASK, train_set[i])]; - if (!cfg[i]) - return -EINVAL; - - /* lane1 offset is 4 */ - writel(FIELD_PREP(HIBMC_DP_PMA_TXDEEMPH, cfg[i]), - dp->serdes_base + HIBMC_DP_PMA_LANE0_OFFSET + i * 4); - } - - usleep_range(300, 500); - - if (readl(dp->serdes_base + HIBMC_DP_LANE_STATUS_OFFSET) != DP_SERDES_DONE) { - drm_dbg_dp(dp->dev, "dp serdes cfg failed\n"); - return -EAGAIN; - } - - return 0; -} - -int hibmc_dp_serdes_rate_switch(u8 rate, struct hibmc_dp_dev *dp) -{ - writel(rate, dp->serdes_base + HIBMC_DP_LANE0_RATE_OFFSET); - writel(rate, dp->serdes_base + HIBMC_DP_LANE1_RATE_OFFSET); - - usleep_range(300, 500); - - if (readl(dp->serdes_base + HIBMC_DP_LANE_STATUS_OFFSET) != DP_SERDES_DONE) { - drm_dbg_dp(dp->dev, "dp serdes rate switching failed\n"); - return -EAGAIN; - } - - if (rate < DP_SERDES_BW_8_1) - drm_dbg_dp(dp->dev, "reducing serdes rate to :%d\n", - rate ? rate * HIBMC_DP_LINK_RATE_CAL * 10 : 162); - - return 0; -} diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_debugfs.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_debugfs.c deleted file mode 100644 index 6c6ff3255d15..000000000000 --- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_debugfs.c +++ /dev/null @@ -1,149 +0,0 @@ -// SPDX-License-Identifier: GPL-2.0-or-later -// Copyright (c) 2024 Hisilicon Limited. - -#include <linux/debugfs.h> -#include <linux/device.h> -#include <linux/seq_file.h> -#include <linux/pci.h> - -#include <drm/drm_drv.h> -#include <drm/drm_file.h> -#include <drm/drm_debugfs.h> -#include <drm/drm_edid.h> - -#include "hibmc_drm_drv.h" - -#define MAX_BUF_SIZE 12 - -static int hibmc_dp_show(struct seq_file *m, void *arg) -{ - struct drm_info_node *node = m->private; - struct drm_device *dev = node->minor->dev; - struct hibmc_drm_private *priv = to_hibmc_drm_private(dev); - int idx, rate; - - if (!drm_dev_enter(dev, &idx)) - return -ENODEV; - - switch (hibmc_dp_get_link_rate(&priv->dp)) { - case 0x1e: - rate = 810; // 8.1Gbps - break; - case 0x14: - rate = 540; // 5.4Gbps - break; - case 0xA: - rate = 270; // 2.7Gbps - break; - case 0x6: - rate = 162; // 1.62Gbps - break; - default: - rate = 0; - } - - seq_printf(m, "enable lanes: %u\n", hibmc_dp_get_lanes(&priv->dp)); - seq_printf(m, "link rate: %d\n", rate); - seq_printf(m, "vfresh: %d\n", drm_mode_vrefresh(&priv->crtc.mode)); - seq_printf(m, "dpcd version: 0x%x\n", hibmc_dp_get_dpcd(&priv->dp)); - seq_printf(m, "hpd status: %d\n", priv->dp.hpd_status); - - drm_dev_exit(idx); - - return 0; -} - -static ssize_t hibmc_control_write(struct file *file, const char __user *user_buf, - size_t count, loff_t *ppos) -{ - struct hibmc_drm_private *priv = file_inode(file)->i_private; - struct hibmc_dp_cbar_cfg *cfg = &priv->dp.cfg; - int ret, idx; - u8 buf[MAX_BUF_SIZE]; - - if (count >= MAX_BUF_SIZE) - return -EINVAL; - - if (copy_from_user(buf, user_buf, count)) - return -EFAULT; - - buf[count] = '\0'; - - /* Only 4 parameters is allowed, the ranger are as follow: - * [0] enable/disable colorbar feature - 0: enable colorbar, 1: disable colorbar - * [1] the timing source of colorbar displaying - 0: timing follows XDP, 1: internal self timing - * [2] the movment of colorbar displaying - 0: static colorbar image, - * 1~255: right shifting a type of color per (1~255)frames - * [3] the color type of colorbar displaying - 0~9: color bar, white, red, orange, - * yellow, green, cyan, bule, pupper, black - */ - if (sscanf(buf, "%hhu %hhu %hhu %u", &cfg->enable, &cfg->self_timing, - &cfg->dynamic_rate, &cfg->pattern) != 4) { - return -EINVAL; - } - - if (cfg->pattern > 9 || cfg->enable > 1 || cfg->self_timing > 1) - return -EINVAL; - - ret = drm_dev_enter(priv->dev, &idx); - if (!ret) - return -ENODEV; - - hibmc_dp_set_cbar(&priv->dp, cfg); - - drm_dev_exit(idx); - - return count; -} - -static int hibmc_dp_dbgfs_show(struct seq_file *m, void *arg) -{ - struct hibmc_drm_private *priv = m->private; - struct hibmc_dp_cbar_cfg *cfg = &priv->dp.cfg; - int idx; - - if (!drm_dev_enter(priv->dev, &idx)) - return -ENODEV; - - seq_printf(m, "hibmc dp colorbar cfg: %u %u %u %u\n", cfg->enable, cfg->self_timing, - cfg->dynamic_rate, cfg->pattern); - - drm_dev_exit(idx); - - return 0; -} - -static int hibmc_open(struct inode *inode, struct file *filp) -{ - return single_open(filp, hibmc_dp_dbgfs_show, inode->i_private); -} - -static const struct file_operations hibmc_dbg_fops = { - .owner = THIS_MODULE, - .write = hibmc_control_write, - .read = seq_read, - .open = hibmc_open, - .llseek = seq_lseek, - .release = single_release, -}; - -static struct drm_info_list hibmc_debugfs_list[] = { - { "hibmc-dp", hibmc_dp_show }, -}; - -void hibmc_debugfs_init(struct drm_connector *connector, struct dentry *root) -{ - struct drm_device *dev = connector->dev; - struct hibmc_drm_private *priv = to_hibmc_drm_private(dev); - struct drm_minor *minor = dev->primary; - - /* create the file in drm directory, so we don't need to remove manually */ - debugfs_create_file("colorbar-cfg", 0200, root, priv, &hibmc_dbg_fops); - - drm_debugfs_create_files(hibmc_debugfs_list, ARRAY_SIZE(hibmc_debugfs_list), - minor->debugfs_root, minor); -} diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_dp.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_dp.c deleted file mode 100644 index ae6f5c235e02..000000000000 --- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_dp.c +++ /dev/null @@ -1,257 +0,0 @@ -// SPDX-License-Identifier: GPL-2.0-or-later -// Copyright (c) 2024 Hisilicon Limited. - -#include <linux/io.h> - -#include <drm/drm_probe_helper.h> -#include <drm/drm_simple_kms_helper.h> -#include <drm/drm_atomic_helper.h> -#include <drm/drm_modes.h> -#include <drm/drm_drv.h> -#include <drm/drm_edid.h> - -#include "hibmc_drm_drv.h" -#include "hibmc_drm_regs.h" -#include "dp/dp_hw.h" - -#define HIBMC_DP_MASKED_SINK_HPD_PLUG_INT BIT(2) -#define HIBMC_DP_MASKED_SINK_HPD_UNPLUG_INT BIT(3) - -static int hibmc_dp_connector_get_modes(struct drm_connector *connector) -{ - int count; - struct hibmc_dp *dp = to_hibmc_dp(connector); - struct edid *edid; - - - edid = drm_get_edid(connector, &dp->aux.ddc); - if (edid) { - drm_connector_update_edid_property(connector, edid); - count = drm_add_edid_modes(connector, edid); - if (count) { - dp->is_connected = true; - goto out; - } - } - - - dp->is_connected = false; - - count = drm_add_modes_noedid(connector, connector->dev->mode_config.max_width, - connector->dev->mode_config.max_height); - drm_set_preferred_mode(connector, 1024, 768); // temporary implementation - -out: - kfree(edid); - - return count; -} - -static int hibmc_dp_mode_valid(struct drm_connector *connector, - struct drm_display_mode *mode, - struct drm_modeset_acquire_ctx *ctx, - enum drm_mode_status *status) -{ - struct hibmc_dp *dp = to_hibmc_dp(connector); - u64 cur_val, max_val; - - if (!dp->is_connected) { - *status = MODE_OK; - return 0; - } - - cur_val = (u64)mode->htotal * mode->vtotal * drm_mode_vrefresh(mode) * BPP_24; - max_val = (u64)hibmc_dp_get_link_rate(dp) * DP_MODE_VALI_CAL * hibmc_dp_get_lanes(dp); - if (cur_val > max_val) - *status = MODE_CLOCK_HIGH; - else - *status = MODE_OK; - - return 0; -} - -static int hibmc_dp_detect(struct drm_connector *connector, - struct drm_modeset_acquire_ctx *ctx, bool force) -{ - struct hibmc_dp *dp = to_hibmc_dp(connector); - - if (dp->hpd_status) - return connector_status_connected; - else - return connector_status_disconnected; -} - -static const struct drm_connector_helper_funcs hibmc_dp_conn_helper_funcs = { - .get_modes = hibmc_dp_connector_get_modes, - .mode_valid_ctx = hibmc_dp_mode_valid, - .detect_ctx = hibmc_dp_detect, -}; - -static int hibmc_dp_late_register(struct drm_connector *connector) -{ - struct hibmc_dp *dp = to_hibmc_dp(connector); - - hibmc_dp_enable_int(dp); - - return drm_dp_aux_register(&dp->aux); -} - -static void hibmc_dp_early_unregister(struct drm_connector *connector) -{ - struct hibmc_dp *dp = to_hibmc_dp(connector); - - drm_dp_aux_unregister(&dp->aux); - - hibmc_dp_disable_int(dp); -} - -static const struct drm_connector_funcs hibmc_dp_conn_funcs = { - .reset = drm_atomic_helper_connector_reset, - .fill_modes = drm_helper_probe_single_connector_modes, - .destroy = drm_connector_cleanup, - .atomic_duplicate_state = drm_atomic_helper_connector_duplicate_state, - .atomic_destroy_state = drm_atomic_helper_connector_destroy_state, - .late_register = hibmc_dp_late_register, - .early_unregister = hibmc_dp_early_unregister, -}; - -static inline int hibmc_dp_prepare(struct hibmc_dp *dp, struct drm_display_mode *mode) -{ - int ret; - - hibmc_dp_display_en(dp, false); - - ret = hibmc_dp_mode_set(dp, mode); - if (ret) - drm_err(dp->drm_dev, "hibmc dp mode set failed: %d\n", ret); - - return ret; -} - -static void hibmc_dp_encoder_enable(struct drm_encoder *drm_encoder, - struct drm_atomic_state *state) -{ - struct hibmc_dp *dp = container_of(drm_encoder, struct hibmc_dp, encoder); - struct drm_display_mode *mode = &drm_encoder->crtc->state->mode; - - if (hibmc_dp_prepare(dp, mode)) - return; - - hibmc_dp_display_en(dp, true); -} - -static void hibmc_dp_encoder_disable(struct drm_encoder *drm_encoder, - struct drm_atomic_state *state) -{ - struct hibmc_dp *dp = container_of(drm_encoder, struct hibmc_dp, encoder); - - hibmc_dp_display_en(dp, false); -} - -static void hibmc_dp_encoder_mode_set(struct drm_encoder *encoder, - struct drm_crtc_state *crtc_state, - struct drm_connector_state *conn_state) -{ - u32 reg; - struct drm_device *dev = encoder->dev; - struct hibmc_drm_private *priv = to_hibmc_drm_private(dev); - - reg = readl(priv->mmio + HIBMC_DISPLAY_CONTROL_HISILE); - reg |= HIBMC_DISPLAY_CONTROL_FPVDDEN(1); - reg |= HIBMC_DISPLAY_CONTROL_PANELDATE(1); - reg |= HIBMC_DISPLAY_CONTROL_FPEN(1); - reg |= HIBMC_DISPLAY_CONTROL_VBIASEN(1); - writel(reg, priv->mmio + HIBMC_DISPLAY_CONTROL_HISILE); -} - -static const struct drm_encoder_helper_funcs hibmc_dp_encoder_helper_funcs = { - .atomic_enable = hibmc_dp_encoder_enable, - .atomic_disable = hibmc_dp_encoder_disable, - .atomic_mode_set = hibmc_dp_encoder_mode_set, -}; - -static const struct drm_encoder_funcs hibmc_encoder_funcs = { - .destroy = drm_encoder_cleanup, -}; - -irqreturn_t hibmc_dp_hpd_isr(int irq, void *arg) -{ - struct drm_device *dev = (struct drm_device *)arg; - struct hibmc_drm_private *priv = to_hibmc_drm_private(dev); - struct hibmc_dp *dp = &priv->dp; - int idx; - - if (!drm_dev_enter(dev, &idx)) - return -ENODEV; - - if (dp->hpd_status) { /* only check unplug int when the last status is HPD in */ - if ((dp->irq_status & HIBMC_DP_MASKED_SINK_HPD_UNPLUG_INT)) { - drm_dbg_dp(dev, "HPD OUT isr occur!\n"); - hibmc_dp_reset_link(dp); - dp->hpd_status = 0; - if (dev->registered) - drm_helper_hpd_irq_event(dev); - } else { - drm_dbg_dp(dev, "HPD OUT occur but err!\n"); - } - } else { - if (dp->irq_status & HIBMC_DP_MASKED_SINK_HPD_PLUG_INT) { - drm_dbg_dp(priv->dev, "HPD IN isr occur!\n"); - hibmc_dp_hpd_cfg(dp); - dp->hpd_status = 1; - if (dev->registered) - drm_helper_hpd_irq_event(dev); - } else { - drm_dbg_dp(dev, "HPD IN occur but err!\n"); - } - } - - drm_dev_exit(idx); - - return IRQ_HANDLED; -} - -int hibmc_dp_init(struct hibmc_drm_private *priv) -{ - struct drm_device *dev = priv->dev; - struct drm_crtc *crtc = &priv->crtc; - struct hibmc_dp *dp = &priv->dp; - struct drm_connector *connector = &dp->connector; - struct drm_encoder *encoder = &dp->encoder; - int ret; - - dp->mmio = priv->mmio; - dp->drm_dev = dev; - - ret = hibmc_dp_hw_init(&priv->dp); - if (ret) { - drm_err(dev, "hibmc dp hw init failed: %d\n", ret); - return ret; - } - - hibmc_dp_display_en(&priv->dp, false); - - encoder->possible_crtcs = drm_crtc_mask(crtc); - ret = drm_encoder_init(dev, encoder, &hibmc_encoder_funcs, DRM_MODE_ENCODER_TMDS, NULL); - if (ret) { - drm_err(dev, "init dp encoder failed: %d\n", ret); - return ret; - } - - drm_encoder_helper_add(encoder, &hibmc_dp_encoder_helper_funcs); - - ret = drm_connector_init_with_ddc(dev, connector, &hibmc_dp_conn_funcs, - DRM_MODE_CONNECTOR_DisplayPort, &dp->aux.ddc); - if (ret) { - drm_err(dev, "init dp connector failed: %d\n", ret); - return ret; - } - - drm_connector_helper_add(connector, &hibmc_dp_conn_helper_funcs); - - drm_connector_attach_encoder(connector, encoder); - - connector->polled = DRM_CONNECTOR_POLL_HPD; - - return 0; -} diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c index b9398a78c26c..2723b4ae9856 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c +++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c @@ -20,17 +20,12 @@ #include <drm/drm_irq.h> #include <drm/drm_managed.h> #include <drm/drm_vblank.h> -#include <drm/drm_probe_helper.h> #include "hibmc_drm_drv.h" #include "hibmc_drm_regs.h" -#include "dp/dp_reg.h" - DEFINE_DRM_GEM_FOPS(hibmc_fops); -static const char *g_irqs_names_map[HIBMC_MAX_VECTORS] = { "hibmc-vblank", "hibmc-hpd" }; - static irqreturn_t hibmc_drm_interrupt(int irq, void *arg) { struct drm_device *dev = (struct drm_device *)arg; @@ -49,22 +44,6 @@ static irqreturn_t hibmc_drm_interrupt(int irq, void *arg) return IRQ_HANDLED; } -static irqreturn_t hibmc_dp_interrupt(int irq, void *arg) -{ - struct drm_device *dev = (struct drm_device *)arg; - struct hibmc_drm_private *priv = to_hibmc_drm_private(dev); - u32 status; - - status = readl(priv->mmio + HIBMC_DP_INTSTAT); - if (status) { - priv->dp.irq_status = status; - writel(status, priv->mmio + HIBMC_DP_INTCLR); - return IRQ_WAKE_THREAD; - } - - return IRQ_HANDLED; -} - static struct drm_driver hibmc_driver = { .driver_features = DRIVER_GEM | DRIVER_MODESET | DRIVER_ATOMIC, .fops = &hibmc_fops, @@ -120,35 +99,16 @@ static int hibmc_kms_init(struct hibmc_drm_private *priv) ret = hibmc_de_init(priv); if (ret) { drm_err(priv->dev, "failed to init de: %d\n", ret); - goto err; - } - - /* - * If the serdes reg is readable and is not equal to 0, - * DP block exists and initializes it. - */ - ret = readl(priv->mmio + HIBMC_DP_HOST_SERDES_CTRL); - if (ret) { - ret = hibmc_dp_init(priv); - if (ret) { - drm_err(priv->dev, "failed to init dp: %d\n", ret); - goto err; - } + return ret; } ret = hibmc_vdac_init(priv); if (ret) { drm_err(priv->dev, "failed to init vdac: %d\n", ret); - goto err; + return ret; } - drm_kms_helper_poll_init(priv->dev); return 0; - -err: - drm_atomic_helper_shutdown(priv->dev); - - return ret; } static void hibmc_kms_fini(struct hibmc_drm_private *priv) @@ -297,47 +257,20 @@ static int hibmc_hw_init(struct hibmc_drm_private *priv) return 0; } -static void hibmc_unload(struct drm_device *dev) -{ - drm_atomic_helper_shutdown(dev); - drm_kms_helper_poll_fini(dev); -} - -static int hibmc_msi_init(struct drm_device *dev) +static int hibmc_unload(struct drm_device *dev) { - struct pci_dev *pdev = to_pci_dev(dev->dev); - int valid_irq_num; - int irq; - int ret; - int i; + struct hibmc_drm_private *priv = dev->dev_private; - ret = pci_alloc_irq_vectors(pdev, HIBMC_MIN_VECTORS, - HIBMC_MAX_VECTORS, PCI_IRQ_MSI); - if (ret < 0) { - drm_err(dev, "enabling MSI failed: %d\n", ret); - return ret; - } + drm_atomic_helper_shutdown(dev); - valid_irq_num = ret; - - for (i = 0; i < valid_irq_num; i++) { - irq = pci_irq_vector(pdev, i); - - if (i) - /* PCI devices require shared interrupts. */ - ret = devm_request_threaded_irq(&pdev->dev, irq, - hibmc_dp_interrupt, - hibmc_dp_hpd_isr, - IRQF_SHARED, g_irqs_names_map[i], dev); - else - ret = devm_request_irq(&pdev->dev, irq, hibmc_drm_interrupt, - IRQF_SHARED, g_irqs_names_map[i], dev); - if (ret) { - drm_err(dev, "install irq failed: %d\n", ret); - return ret; - } - } + if (dev->irq_enabled) + drm_irq_uninstall(dev); + pci_disable_msi(dev->pdev); + hibmc_kms_fini(priv); + hibmc_mm_fini(priv); + hibmc_hw_unmap(priv); + dev->dev_private = NULL; return 0; } @@ -355,19 +288,21 @@ static int hibmc_load(struct drm_device *dev) priv->dev = dev; ret = hibmc_hw_init(priv); - if (ret) - return ret; + if (ret) { + drm_err(dev, "failed to initialize hardware: %d\n", ret); + goto err_alloc; + } ret = hibmc_mm_init(priv); if (ret) { - drm_err(dev, "Error initializing VRAM MM; %d\n", ret); - return ret; + drm_err(dev, "failed to initialize mm: %d\n", ret); + goto err_hw; } ret = hibmc_kms_init(priv); if (ret) { - drm_err(dev, "hibmc kms init failed, ret:%d\n", ret); - return ret; + drm_err(dev, "failed to initialize kms: %d\n", ret); + goto err_mm; } ret = drm_vblank_init(dev, dev->mode_config.num_crtc); @@ -376,10 +311,13 @@ static int hibmc_load(struct drm_device *dev) goto err_kms; } - ret = hibmc_msi_init(dev); + ret = pci_enable_msi(dev->pdev); if (ret) { - drm_err(dev, "hibmc msi init failed, ret:%d\n", ret); - goto err_kms; + drm_warn(dev, "enabling MSI failed: %d\n", ret); + } else { + ret = drm_irq_install(dev, dev->pdev->irq); + if (ret) + drm_warn(dev, "install irq failed: %d\n", ret); } /* reset all the states of crtc/plane/encoder/connector */ @@ -389,8 +327,11 @@ static int hibmc_load(struct drm_device *dev) err_kms: hibmc_kms_fini(priv); +err_mm: hibmc_mm_fini(priv); +err_hw: hibmc_hw_unmap(priv); +err_alloc: dev->dev_private = NULL; return ret; @@ -400,7 +341,6 @@ static int hibmc_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) { struct drm_device *dev; - struct hibmc_drm_private *priv; int ret; ret = drm_fb_helper_remove_conflicting_pci_framebuffers(pdev, @@ -423,8 +363,6 @@ static int hibmc_pci_probe(struct pci_dev *pdev, goto err_free; } - pci_set_master(pdev); - ret = hibmc_load(dev); if (ret) { drm_err(dev, "failed to load hibmc: %d\n", ret); @@ -440,9 +378,6 @@ static int hibmc_pci_probe(struct pci_dev *pdev, drm_fbdev_generic_setup(dev, dev->mode_config.preferred_depth); - priv = to_hibmc_drm_private(dev); - hibmc_debugfs_init(&priv->dp.connector, dev->primary->debugfs_root); - return 0; err_unload: @@ -480,8 +415,8 @@ static struct pci_driver hibmc_pci_driver = { .id_table = hibmc_pci_table, .probe = hibmc_pci_probe, .remove = hibmc_pci_remove, - .shutdown = hibmc_pci_shutdown, - .driver.pm = &hibmc_pm_ops, + .shutdown = hibmc_pci_shutdown, + .driver.pm = &hibmc_pm_ops, }; module_pci_driver(hibmc_pci_driver); diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h index 617585268009..87d2aad0bb5e 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h +++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h @@ -21,16 +21,12 @@ #include <drm/drm_edid.h> #include <drm/drm_fb_helper.h> #include <drm/drm_framebuffer.h> -#include "dp/dp_hw.h" struct drm_device; -#define HIBMC_MIN_VECTORS 1 -#define HIBMC_MAX_VECTORS 2 -struct hibmc_vdac { - struct drm_device *dev; - struct drm_encoder encoder; - struct drm_connector connector; +struct hibmc_connector { + struct drm_connector base; + struct i2c_adapter adapter; struct i2c_algo_bit_data bit_data; }; @@ -46,19 +42,14 @@ struct hibmc_drm_private { struct drm_device *dev; struct drm_plane primary_plane; struct drm_crtc crtc; + struct drm_encoder encoder; + struct hibmc_connector connector; bool mode_config_initialized; - struct hibmc_vdac vdac; - struct hibmc_dp dp; }; -static inline struct hibmc_vdac *to_hibmc_vdac(struct drm_connector *connector) -{ - return container_of(connector, struct hibmc_vdac, connector); -} - -static inline struct hibmc_dp *to_hibmc_dp(struct drm_connector *connector) +static inline struct hibmc_connector *to_hibmc_connector(struct drm_connector *connector) { - return container_of(connector, struct hibmc_dp, connector); + return container_of(connector, struct hibmc_connector, base); } static inline struct hibmc_drm_private *to_hibmc_drm_private(struct drm_device *dev) @@ -78,14 +69,8 @@ int hibmc_mm_init(struct hibmc_drm_private *hibmc); void hibmc_mm_fini(struct hibmc_drm_private *hibmc); int hibmc_dumb_create(struct drm_file *file, struct drm_device *dev, struct drm_mode_create_dumb *args); -int hibmc_ddc_create(struct drm_device *drm_dev, struct hibmc_vdac *connector); -void hibmc_ddc_del(struct hibmc_vdac *vdac); -int hibmc_dp_init(struct hibmc_drm_private *priv); +int hibmc_ddc_create(struct drm_device *drm_dev, struct hibmc_connector *connector); extern const struct drm_mode_config_funcs hibmc_mode_funcs; -void hibmc_debugfs_init(struct drm_connector *connector, struct dentry *root); - -irqreturn_t hibmc_dp_hpd_isr(int irq, void *arg); - #endif diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_i2c.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_i2c.c index 2e0fcd2b3bc1..86d712090d87 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_i2c.c +++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_i2c.c @@ -25,8 +25,8 @@ static void hibmc_set_i2c_signal(void *data, u32 mask, int value) { - struct hibmc_vdac *vdac = data; - struct hibmc_drm_private *priv = to_hibmc_drm_private(vdac->connector.dev); + struct hibmc_connector *hibmc_connector = data; + struct hibmc_drm_private *priv = to_hibmc_drm_private(hibmc_connector->base.dev); u32 tmp_dir = readl(priv->mmio + GPIO_DATA_DIRECTION); if (value) { @@ -45,8 +45,8 @@ static void hibmc_set_i2c_signal(void *data, u32 mask, int value) static int hibmc_get_i2c_signal(void *data, u32 mask) { - struct hibmc_vdac *vdac = data; - struct hibmc_drm_private *priv = to_hibmc_drm_private(vdac->connector.dev); + struct hibmc_connector *hibmc_connector = data; + struct hibmc_drm_private *priv = to_hibmc_drm_private(hibmc_connector->base.dev); u32 tmp_dir = readl(priv->mmio + GPIO_DATA_DIRECTION); if ((tmp_dir & mask) != mask) { @@ -77,27 +77,23 @@ static int hibmc_ddc_getscl(void *data) return hibmc_get_i2c_signal(data, I2C_SCL_MASK); } -int hibmc_ddc_create(struct drm_device *drm_dev, struct hibmc_vdac *vdac) +int hibmc_ddc_create(struct drm_device *drm_dev, + struct hibmc_connector *connector) { - vdac->adapter.owner = THIS_MODULE; - vdac->adapter.class = I2C_CLASS_DDC; - snprintf(vdac->adapter.name, I2C_NAME_SIZE, "HIS i2c bit bus"); - vdac->adapter.dev.parent = drm_dev->dev; - i2c_set_adapdata(&vdac->adapter, vdac); - vdac->adapter.algo_data = &vdac->bit_data; - - vdac->bit_data.udelay = 20; - vdac->bit_data.timeout = usecs_to_jiffies(2000); - vdac->bit_data.data = vdac; - vdac->bit_data.setsda = hibmc_ddc_setsda; - vdac->bit_data.setscl = hibmc_ddc_setscl; - vdac->bit_data.getsda = hibmc_ddc_getsda; - vdac->bit_data.getscl = hibmc_ddc_getscl; - - return i2c_bit_add_bus(&vdac->adapter); -} - -void hibmc_ddc_del(struct hibmc_vdac *vdac) -{ - i2c_del_adapter(&vdac->adapter); + connector->adapter.owner = THIS_MODULE; + connector->adapter.class = I2C_CLASS_DDC; + snprintf(connector->adapter.name, I2C_NAME_SIZE, "HIS i2c bit bus"); + connector->adapter.dev.parent = &drm_dev->pdev->dev; + i2c_set_adapdata(&connector->adapter, connector); + connector->adapter.algo_data = &connector->bit_data; + + connector->bit_data.udelay = 20; + connector->bit_data.timeout = usecs_to_jiffies(2000); + connector->bit_data.data = connector; + connector->bit_data.setsda = hibmc_ddc_setsda; + connector->bit_data.setscl = hibmc_ddc_setscl; + connector->bit_data.getsda = hibmc_ddc_getsda; + connector->bit_data.getscl = hibmc_ddc_getscl; + + return i2c_bit_add_bus(&connector->adapter); } diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c index 9c0ec6e54df0..fb761853289c 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c +++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c @@ -42,9 +42,9 @@ static int hibmc_connector_get_modes(struct drm_connector *connector) { int count; void *edid; - struct hibmc_vdac *vdac = to_hibmc_vdac(connector); + struct hibmc_connector *hibmc_connector = to_hibmc_connector(connector); - edid = drm_get_edid(connector, &vdac->adapter); + edid = drm_get_edid(connector, &hibmc_connector->adapter); if (edid) { drm_connector_update_edid_property(connector, edid); count = drm_add_edid_modes(connector, edid); @@ -88,53 +88,26 @@ static enum drm_mode_status hibmc_connector_mode_valid( return hibmc_valid_mode(mode->hdisplay, mode->vdisplay); } -static void hibmc_vdac_connector_destroy(struct drm_connector *connector) +static void hibmc_connector_destroy(struct drm_connector *connector) { - struct hibmc_vdac *vdac = to_hibmc_vdac(connector); + struct hibmc_connector *hibmc_connector = to_hibmc_connector(connector); - i2c_del_adapter(&vdac->adapter); + i2c_del_adapter(&hibmc_connector->adapter); drm_connector_cleanup(connector); } -static int hibmc_vdac_detect(struct drm_connector *connector, struct drm_modeset_acquire_ctx *ctx, - bool force) -{ - struct hibmc_drm_private *priv = to_hibmc_drm_private(connector->dev); - struct hibmc_dp *dp = &priv->dp; - - if (dp->hpd_status) - return connector_status_disconnected; - - return connector_status_connected; -} - static const struct drm_connector_helper_funcs hibmc_connector_helper_funcs = { .get_modes = hibmc_connector_get_modes, .mode_valid = hibmc_connector_mode_valid, - .detect_ctx = hibmc_vdac_detect, }; -static void hibmc_vdac_force(struct drm_connector *connector) -{ - struct hibmc_drm_private *priv = to_hibmc_drm_private(connector->dev); - struct hibmc_dp *dp = &priv->dp; - - if (dp->hpd_status) { - connector->status = connector_status_disconnected; - return; - } - - connector->status = connector_status_connected; -} - static const struct drm_connector_funcs hibmc_connector_funcs = { .fill_modes = drm_helper_probe_single_connector_modes, - .destroy = hibmc_vdac_connector_destroy, + .destroy = hibmc_connector_destroy, .reset = drm_atomic_helper_connector_reset, .atomic_duplicate_state = drm_atomic_helper_connector_duplicate_state, .atomic_destroy_state = drm_atomic_helper_connector_destroy_state, - .force = hibmc_vdac_force, }; static void hibmc_encoder_mode_set(struct drm_encoder *encoder, @@ -164,12 +137,12 @@ static const struct drm_encoder_funcs hibmc_encoder_funcs = { int hibmc_vdac_init(struct hibmc_drm_private *priv) { struct drm_device *dev = priv->dev; - struct hibmc_vdac *vdac = &priv->vdac; - struct drm_encoder *encoder = &vdac->encoder; - struct drm_connector *connector = &vdac->connector; + struct hibmc_connector *hibmc_connector = &priv->connector; + struct drm_encoder *encoder = &priv->encoder; + struct drm_connector *connector = &hibmc_connector->base; int ret; - ret = hibmc_ddc_create(dev, vdac); + ret = hibmc_ddc_create(dev, hibmc_connector); if (ret) { drm_err(dev, "failed to create ddc: %d\n", ret); return ret; @@ -180,7 +153,7 @@ int hibmc_vdac_init(struct hibmc_drm_private *priv) DRM_MODE_ENCODER_DAC, NULL); if (ret) { drm_err(dev, "failed to init encoder: %d\n", ret); - goto err; + return ret; } drm_encoder_helper_add(encoder, &hibmc_encoder_helper_funcs); @@ -188,21 +161,14 @@ int hibmc_vdac_init(struct hibmc_drm_private *priv) ret = drm_connector_init_with_ddc(dev, connector, &hibmc_connector_funcs, DRM_MODE_CONNECTOR_VGA, - &vdac->adapter); + &hibmc_connector->adapter); if (ret) { drm_err(dev, "failed to init connector: %d\n", ret); - goto err; + return ret; } drm_connector_helper_add(connector, &hibmc_connector_helper_funcs); drm_connector_attach_encoder(connector, encoder); - connector->polled = DRM_CONNECTOR_POLL_CONNECT | DRM_CONNECTOR_POLL_DISCONNECT; - return 0; - -err: - hibmc_ddc_del(vdac); - - return ret; } diff --git a/include/drm/drm_probe_helper.h b/include/drm/drm_probe_helper.h index 621885d5de84..8d3ed2834d34 100644 --- a/include/drm/drm_probe_helper.h +++ b/include/drm/drm_probe_helper.h @@ -24,7 +24,4 @@ void drm_kms_helper_poll_disable(struct drm_device *dev); void drm_kms_helper_poll_enable(struct drm_device *dev); bool drm_kms_helper_is_poll_worker(void); -int drm_connector_helper_detect_from_ddc(struct drm_connector *connector, - struct drm_modeset_acquire_ctx *ctx, - bool force); #endif -- 2.34.1

2 1

[PATCH OLK-6.6] x86/CPU/AMD: Add RDSEED fix for Zen5
by Bowen You 06 Feb '26

06 Feb '26

From: Gregory Price <gourry(a)gourry.net> stable inclusion from stable-v6.12.57 commit e980de2ff109dacb6d9d3a77f01b27c467115ecb category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/11500 CVE: CVE-2025-68313 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 607b9fb2ce248cc5b633c5949e0153838992c152 upstream. There's an issue with RDSEED's 16-bit and 32-bit register output variants on Zen5 which return a random value of 0 "at a rate inconsistent with randomness while incorrectly signaling success (CF=1)". Search the web for AMD-SB-7055 for more detail. Add a fix glue which checks microcode revisions. [ bp: Add microcode revisions checking, rewrite. ] Cc: stable(a)vger.kernel.org Signed-off-by: Gregory Price <gourry(a)gourry.net> Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Link: https://lore.kernel.org/r/20251018024010.4112396-1-gourry@gourry.net [ bp: 6.12 backport: use the alternative microcode version checking. ] Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: arch/x86/include/asm/cpu.h arch/x86/kernel/cpu/microcode/amd.c [move the definition of zen_patch_rev] Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- arch/x86/include/asm/cpu.h | 12 ++++++++++ arch/x86/kernel/cpu/amd.c | 35 +++++++++++++++++++++++++++++ arch/x86/kernel/cpu/microcode/amd.c | 12 ---------- 3 files changed, 47 insertions(+), 12 deletions(-) diff --git a/arch/x86/include/asm/cpu.h b/arch/x86/include/asm/cpu.h index 43a228e11209..d252aa7f04fb 100644 --- a/arch/x86/include/asm/cpu.h +++ b/arch/x86/include/asm/cpu.h @@ -84,4 +84,16 @@ int intel_microcode_sanity_check(void *mc, bool print_err, int hdr_type); extern struct cpumask cpus_stop_mask; +union zen_patch_rev { + struct { + __u32 rev : 8, + stepping : 4, + model : 4, + __reserved : 4, + ext_model : 4, + ext_fam : 8; + }; + __u32 ucode_rev; +}; + #endif /* _ASM_X86_CPU_H */ diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c index f89dbe6f48e6..5a46bf0cce5d 100644 --- a/arch/x86/kernel/cpu/amd.c +++ b/arch/x86/kernel/cpu/amd.c @@ -1135,8 +1135,43 @@ static void init_amd_zen4(struct cpuinfo_x86 *c) } } +static bool check_rdseed_microcode(void) +{ + struct cpuinfo_x86 *c = &boot_cpu_data; + union zen_patch_rev p; + u32 min_rev = 0; + + p.ext_fam = c->x86 - 0xf; + p.model = c->x86_model; + p.ext_model = c->x86_model >> 4; + p.stepping = c->x86_stepping; + /* reserved bits are expected to be 0 in test below */ + p.__reserved = 0; + + if (cpu_has(c, X86_FEATURE_ZEN5)) { + switch (p.ucode_rev >> 8) { + case 0xb0021: min_rev = 0xb00215a; break; + case 0xb1010: min_rev = 0xb101054; break; + default: + pr_debug("%s: ucode_rev: 0x%x, current revision: 0x%x\n", + __func__, p.ucode_rev, c->microcode); + return false; + } + } + + if (!min_rev) + return false; + + return c->microcode >= min_rev; +} + static void init_amd_zen5(struct cpuinfo_x86 *c) { + if (!check_rdseed_microcode()) { + clear_cpu_cap(c, X86_FEATURE_RDSEED); + msr_clear_bit(MSR_AMD64_CPUID_FN_7, 18); + pr_emerg_once("RDSEED32 is broken. Disabling the corresponding CPUID bit.\n"); + } } static void init_amd(struct cpuinfo_x86 *c) diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c index b6990dc26274..75746a991f8e 100644 --- a/arch/x86/kernel/cpu/microcode/amd.c +++ b/arch/x86/kernel/cpu/microcode/amd.c @@ -96,18 +96,6 @@ static struct equiv_cpu_table { struct equiv_cpu_entry *entry; } equiv_table; -union zen_patch_rev { - struct { - __u32 rev : 8, - stepping : 4, - model : 4, - __reserved : 4, - ext_model : 4, - ext_fam : 8; - }; - __u32 ucode_rev; -}; - union cpuid_1_eax { struct { __u32 stepping : 4, -- 2.34.1

2 1

[PATCH OLK-5.10] Revert "drm/hisilicon/hibmc: hibmc-drm bugfix for DP"
by Tengda Wu 06 Feb '26

06 Feb '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13655 ------------------------------------------ This reverts commit 70dcc68078ac0303c412b9dedfddcc0a850e29f1. Commit 70dcc68078ac introduced a null-pointer dereference exception, causing kernel boot failure: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000048 Call trace: hibmc_debugfs_init+0x38/0x68 [hibmc_drm] hibmc_pci_probe+0xdc/0x1ac [hibmc_drm] local_pci_probe+0x48/0xb0 work_for_cpu_fn+0x24/0x50 process_one_work+0x1d8/0x4c0 worker_thread+0x25c/0x470 kthread+0x108/0x150 Temporarily revert this patch to circumvent the issue. Fixes: 70dcc68078ac ("drm/hisilicon/hibmc: hibmc-drm bugfix for DP") Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- drivers/gpu/drm/hisilicon/hibmc/dp/dp_comm.h | 5 +- drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.c | 83 ++++++------------- drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.h | 9 -- drivers/gpu/drm/hisilicon/hibmc/dp/dp_link.c | 67 ++++----------- drivers/gpu/drm/hisilicon/hibmc/dp/dp_reg.h | 10 +-- .../gpu/drm/hisilicon/hibmc/dp/dp_serdes.c | 12 +++ .../drm/hisilicon/hibmc/hibmc_drm_debugfs.c | 49 +---------- .../gpu/drm/hisilicon/hibmc/hibmc_drm_dp.c | 65 --------------- .../gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c | 37 ++++----- .../gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h | 1 - .../gpu/drm/hisilicon/hibmc/hibmc_drm_i2c.c | 5 -- .../gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c | 13 +-- 12 files changed, 77 insertions(+), 279 deletions(-) diff --git a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_comm.h b/drivers/gpu/drm/hisilicon/hibmc/dp/dp_comm.h index 1107e10b2047..4bbe6b567056 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_comm.h +++ b/drivers/gpu/drm/hisilicon/hibmc/dp/dp_comm.h @@ -15,7 +15,6 @@ #include "dp_hw.h" -#define HIBMC_DP_LINK_RATE_CAL 27 #define HIBMC_DP_LANE_NUM_MAX 2 struct hibmc_link_status { @@ -26,9 +25,6 @@ struct hibmc_link_status { struct hibmc_link_cap { u8 link_rate; u8 lanes; - int rx_dpcd_revision; - bool is_tps3; - bool is_tps4; }; struct hibmc_dp_link { @@ -67,6 +63,7 @@ struct hibmc_dp_dev { void hibmc_dp_aux_init(struct hibmc_dp *dp); int hibmc_dp_link_training(struct hibmc_dp_dev *dp); +int hibmc_dp_serdes_init(struct hibmc_dp_dev *dp); int hibmc_dp_serdes_rate_switch(u8 rate, struct hibmc_dp_dev *dp); int hibmc_dp_serdes_set_tx_cfg(struct hibmc_dp_dev *dp, u8 train_set[HIBMC_DP_LANE_NUM_MAX]); diff --git a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.c b/drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.c index 9e8f95d957f2..8f0daec7d174 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.c +++ b/drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.c @@ -154,6 +154,7 @@ int hibmc_dp_hw_init(struct hibmc_dp *dp) { struct drm_device *drm_dev = dp->drm_dev; struct hibmc_dp_dev *dp_dev; + int ret; dp_dev = devm_kzalloc(drm_dev->dev, sizeof(struct hibmc_dp_dev), GFP_KERNEL); if (!dp_dev) @@ -165,22 +166,23 @@ int hibmc_dp_hw_init(struct hibmc_dp *dp) dp_dev->dev = drm_dev; dp_dev->base = dp->mmio + HIBMC_DP_OFFSET; - dp_dev->serdes_base = dp_dev->base + HIBMC_DP_HOST_OFFSET; hibmc_dp_aux_init(dp); + ret = hibmc_dp_serdes_init(dp_dev); + if (ret) + return ret; + dp_dev->link.cap.lanes = 0x2; dp_dev->link.cap.link_rate = DP_LINK_BW_8_1; + /* hdcp data */ + writel(HIBMC_DP_HDCP, dp_dev->base + HIBMC_DP_HDCP_CFG); /* int init */ writel(0, dp_dev->base + HIBMC_DP_INTR_ENABLE); writel(HIBMC_DP_INT_RST, dp_dev->base + HIBMC_DP_INTR_ORIGINAL_STATUS); /* rst */ - writel(0, dp_dev->base + HIBMC_DP_DPTX_RST_CTRL); - usleep_range(30, 50); writel(HIBMC_DP_DPTX_RST, dp_dev->base + HIBMC_DP_DPTX_RST_CTRL); - /* hdcp data */ - writel(HIBMC_DP_HDCP, dp_dev->base + HIBMC_DP_HDCP_CFG); /* clock enable */ writel(HIBMC_DP_CLK_EN, dp_dev->base + HIBMC_DP_DPTX_CLK_CTRL); @@ -222,17 +224,14 @@ void hibmc_dp_display_en(struct hibmc_dp *dp, bool enable) struct hibmc_dp_dev *dp_dev = dp->dp_dev; if (enable) { - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_VIDEO_CTRL, - HIBMC_DP_CFG_MST_ENABLE, 0x1); + hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_VIDEO_CTRL, BIT(0), 0x1); writel(HIBMC_DP_SYNC_EN_MASK, dp_dev->base + HIBMC_DP_TIMING_SYNC_CTRL); - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_DPTX_GCTL0, - HIBMC_DP_CFG_TIMING_GEN_ENABLE, 0x1); + hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_DPTX_GCTL0, BIT(10), 0x1); writel(HIBMC_DP_SYNC_EN_MASK, dp_dev->base + HIBMC_DP_TIMING_SYNC_CTRL); } else { - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_DPTX_GCTL0, - HIBMC_DP_CFG_TIMING_GEN_ENABLE, 0); + hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_DPTX_GCTL0, BIT(10), 0); writel(HIBMC_DP_SYNC_EN_MASK, dp_dev->base + HIBMC_DP_TIMING_SYNC_CTRL); - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_VIDEO_CTRL, HIBMC_DP_CFG_MST_ENABLE, 0); + hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_VIDEO_CTRL, BIT(0), 0); writel(HIBMC_DP_SYNC_EN_MASK, dp_dev->base + HIBMC_DP_TIMING_SYNC_CTRL); } @@ -258,36 +257,10 @@ int hibmc_dp_mode_set(struct hibmc_dp *dp, struct drm_display_mode *mode) return 0; } -u8 hibmc_dp_get_link_rate(struct hibmc_dp *dp) -{ - if (!dp->dp_dev) - return 0; - - return dp->dp_dev->link.cap.link_rate; -} - -u8 hibmc_dp_get_lanes(struct hibmc_dp *dp) -{ - if (!dp->dp_dev) - return 0; - - return dp->dp_dev->link.cap.lanes; -} - -int hibmc_dp_get_dpcd(struct hibmc_dp *dp) -{ - if (!dp->dp_dev) - return 0; - - return dp->dp_dev->link.cap.rx_dpcd_revision; -} - void hibmc_dp_reset_link(struct hibmc_dp *dp) { - if (dp->dp_dev) { - dp->dp_dev->link.status.clock_recovered = false; - dp->dp_dev->link.status.channel_equalized = false; - } + dp->dp_dev->link.status.clock_recovered = false; + dp->dp_dev->link.status.channel_equalized = false; } static const struct hibmc_dp_color_raw g_rgb_raw[] = { @@ -309,30 +282,26 @@ void hibmc_dp_set_cbar(struct hibmc_dp *dp, const struct hibmc_dp_cbar_cfg *cfg) struct hibmc_dp_color_raw raw_data; if (cfg->enable) { - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL, - HIBMC_DP_COLOR_BAR_TIMING_SEL_M, cfg->self_timing); - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL, - HIBMC_DP_COLOR_BAR_CTRL_M, cfg->dynamic_rate); + hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL, BIT(9), + cfg->self_timing); + hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL, GENMASK(8, 1), + cfg->dynamic_rate); if (cfg->pattern == CBAR_COLOR_BAR) { - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL, - HIBMC_DP_COLOR_BAR_PATTERN_SEL_M, 0); + hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL, BIT(10), 0); } else { raw_data = g_rgb_raw[cfg->pattern]; drm_dbg_dp(dp->drm_dev, "r:%x g:%x b:%x\n", raw_data.r_value, raw_data.g_value, raw_data.b_value); - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL, - HIBMC_DP_COLOR_BAR_PATTERN_SEL_M, 1); - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL, - HIBMC_DP_COLOR_BAR_DATA_R_M, raw_data.r_value); - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL1, - HIBMC_DP_COLOR_BAR_DATA_G_M, raw_data.g_value); - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL1, - HIBMC_DP_COLOR_BAR_DATA_B_M, raw_data.b_value); + hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL, BIT(10), 1); + hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL, GENMASK(23, 12), + raw_data.r_value); + hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL1, GENMASK(23, 12), + raw_data.g_value); + hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL1, GENMASK(11, 0), + raw_data.b_value); } } - hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL, - HIBMC_DP_COLOR_BAR_ENABLE_M, cfg->enable); + hibmc_dp_reg_write_field(dp_dev, HIBMC_DP_COLOR_BAR_CTRL, BIT(0), cfg->enable); writel(HIBMC_DP_SYNC_EN_MASK, dp_dev->base + HIBMC_DP_TIMING_SYNC_CTRL); } - diff --git a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.h b/drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.h index 4740db06e1b0..f55d78d266f2 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.h +++ b/drivers/gpu/drm/hisilicon/hibmc/dp/dp_hw.h @@ -12,10 +12,6 @@ #include <drm/drm_print.h> #include <drm/drm_dp_helper.h> -// 27 * 10000000 * 80% = 216000000 -#define DP_MODE_VALI_CAL 216000000 -#define BPP_24 24 - struct hibmc_dp_dev; enum hibmc_dp_cbar_pattern { @@ -55,16 +51,11 @@ struct hibmc_dp { struct hibmc_dp_cbar_cfg cfg; u32 irq_status; int hpd_status; - bool is_connected; }; int hibmc_dp_hw_init(struct hibmc_dp *dp); int hibmc_dp_mode_set(struct hibmc_dp *dp, struct drm_display_mode *mode); void hibmc_dp_display_en(struct hibmc_dp *dp, bool enable); -struct edid *hibmc_dp_get_edid(struct hibmc_dp *dp); -int hibmc_dp_get_dpcd(struct hibmc_dp *dp); -u8 hibmc_dp_get_link_rate(struct hibmc_dp *dp); -u8 hibmc_dp_get_lanes(struct hibmc_dp *dp); void hibmc_dp_set_cbar(struct hibmc_dp *dp, const struct hibmc_dp_cbar_cfg *cfg); void hibmc_dp_reset_link(struct hibmc_dp *dp); void hibmc_dp_hpd_cfg(struct hibmc_dp *dp); diff --git a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_link.c b/drivers/gpu/drm/hisilicon/hibmc/dp/dp_link.c index 9b632428fec6..c3e648e2f1a8 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_link.c +++ b/drivers/gpu/drm/hisilicon/hibmc/dp/dp_link.c @@ -39,14 +39,6 @@ static int hibmc_dp_link_training_configure(struct hibmc_dp_dev *dp) /* enhanced frame */ hibmc_dp_reg_write_field(dp, HIBMC_DP_VIDEO_CTRL, HIBMC_DP_CFG_STREAM_FRAME_MODE, 0x1); - ret = hibmc_dp_get_serdes_rate_cfg(dp); - if (ret < 0) - return ret; - - ret = hibmc_dp_serdes_rate_switch(ret, dp); - if (ret) - return ret; - /* set rate and lane count */ buf[0] = dp->link.cap.link_rate; buf[1] = DP_LANE_COUNT_ENHANCED_FRAME_EN | dp->link.cap.lanes; @@ -209,23 +201,21 @@ static int hibmc_dp_link_training_cr(struct hibmc_dp_dev *dp) bool level_changed; u32 voltage_tries; u32 cr_tries; - u32 max_cr; int ret; /* * DP 1.4 spec define 10 for maxtries value, for pre DP 1.4 version set a limit of 80 * (4 voltage levels x 4 preemphasis levels x 5 identical voltage retries) */ - max_cr = dp->link.cap.rx_dpcd_revision >= DP_DPCD_REV_14 ? 10 : 80; voltage_tries = 1; - for (cr_tries = 0; cr_tries < max_cr; cr_tries++) { + for (cr_tries = 0; cr_tries < 80; cr_tries++) { drm_dp_link_train_clock_recovery_delay(dp->dpcd); ret = drm_dp_dpcd_read_link_status(dp->aux, lane_status); if (ret != DP_LINK_STATUS_SIZE) { - drm_err(dp->dev, "Get lane status failed, ret: %d\n", ret); - return ret >= 0 ? -EIO : ret; + drm_err(dp->dev, "Get lane status failed\n"); + return ret; } if (drm_dp_clock_recovery_ok(lane_status, dp->link.cap.lanes)) { @@ -256,7 +246,7 @@ static int hibmc_dp_link_training_cr(struct hibmc_dp_dev *dp) voltage_tries = level_changed ? 1 : voltage_tries + 1; } - drm_err(dp->dev, "dp link training clock recovery %u timers failed\n", max_cr); + drm_err(dp->dev, "dp link training clock recovery 80 times failed\n"); dp->link.status.clock_recovered = false; return 0; @@ -266,17 +256,9 @@ static int hibmc_dp_link_training_channel_eq(struct hibmc_dp_dev *dp) { u8 lane_status[DP_LINK_STATUS_SIZE] = {0}; u8 eq_tries; - int tps; int ret; - if (dp->link.cap.is_tps4) - tps = DP_TRAINING_PATTERN_4; - else if (dp->link.cap.is_tps3) - tps = DP_TRAINING_PATTERN_3; - else - tps = DP_TRAINING_PATTERN_2; - - ret = hibmc_dp_link_set_pattern(dp, tps); + ret = hibmc_dp_link_set_pattern(dp, DP_TRAINING_PATTERN_2); if (ret) return ret; @@ -306,7 +288,7 @@ static int hibmc_dp_link_training_channel_eq(struct hibmc_dp_dev *dp) ret = hibmc_dp_serdes_set_tx_cfg(dp, dp->link.train_set); if (ret) - break; + return ret; ret = drm_dp_dpcd_write(dp->aux, DP_TRAINING_LANE0_SET, dp->link.train_set, dp->link.cap.lanes); @@ -335,17 +317,7 @@ static int hibmc_dp_link_downgrade_training_cr(struct hibmc_dp_dev *dp) static int hibmc_dp_link_downgrade_training_eq(struct hibmc_dp_dev *dp) { - u8 status[DP_LINK_STATUS_SIZE] = {0}; - int ret; - - ret = drm_dp_dpcd_read_link_status(dp->aux, status); - if (ret != DP_LINK_STATUS_SIZE) { - drm_err(dp->dev, "get lane status failed\n"); - return ret >= 0 ? -EIO : ret; - } - - if ((dp->link.status.clock_recovered && !dp->link.status.channel_equalized) || - (status[0] != 0 && !dp->link.status.clock_recovered)) { // at least one cr_done + if ((dp->link.status.clock_recovered && !dp->link.status.channel_equalized)) { if (!hibmc_dp_link_reduce_lane(dp)) return 0; } @@ -353,20 +325,6 @@ static int hibmc_dp_link_downgrade_training_eq(struct hibmc_dp_dev *dp) return hibmc_dp_link_reduce_rate(dp); } -static void hibmc_dp_update_caps(struct hibmc_dp_dev *dp) -{ - dp->link.cap.rx_dpcd_revision = dp->dpcd[DP_DPCD_REV]; - - dp->link.cap.is_tps3 = (dp->dpcd[DP_DPCD_REV] >= DP_DPCD_REV_13) && - (dp->dpcd[DP_MAX_LANE_COUNT] & DP_TPS3_SUPPORTED); - dp->link.cap.is_tps4 = (dp->dpcd[DP_DPCD_REV] >= DP_DPCD_REV_14) && - (dp->dpcd[DP_MAX_DOWNSPREAD] & DP_TPS4_SUPPORTED); - dp->link.cap.link_rate = dp->dpcd[DP_MAX_LINK_RATE]; - dp->link.cap.lanes = dp->dpcd[DP_MAX_LANE_COUNT] & DP_MAX_LANE_COUNT_MASK; - if (dp->link.cap.lanes > HIBMC_DP_LANE_NUM_MAX) - dp->link.cap.lanes = HIBMC_DP_LANE_NUM_MAX; -} - int hibmc_dp_link_training(struct hibmc_dp_dev *dp) { struct hibmc_dp_link *link = &dp->link; @@ -376,7 +334,16 @@ int hibmc_dp_link_training(struct hibmc_dp_dev *dp) if (ret) drm_err(dp->dev, "dp aux read dpcd failed, ret: %d\n", ret); - hibmc_dp_update_caps(dp); + dp->link.cap.link_rate = dp->dpcd[DP_MAX_LINK_RATE]; + dp->link.cap.lanes = 0x2; + + ret = hibmc_dp_get_serdes_rate_cfg(dp); + if (ret < 0) + return ret; + + ret = hibmc_dp_serdes_rate_switch(ret, dp); + if (ret) + return ret; while (true) { ret = hibmc_dp_link_training_cr_pre(dp); diff --git a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_reg.h b/drivers/gpu/drm/hisilicon/hibmc/dp/dp_reg.h index 156e5d63c47f..394b1e933c3a 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_reg.h +++ b/drivers/gpu/drm/hisilicon/hibmc/dp/dp_reg.h @@ -68,14 +68,8 @@ #define HIBMC_DP_CFG_STREAM_HBLANK_SIZE GENMASK(15, 0) #define HIBMC_DP_COLOR_BAR_CTRL 0x260 -#define HIBMC_DP_COLOR_BAR_ENABLE_M BIT(0) -#define HIBMC_DP_COLOR_BAR_CTRL_M GENMASK(8, 1) -#define HIBMC_DP_COLOR_BAR_TIMING_SEL_M BIT(9) -#define HIBMC_DP_COLOR_BAR_PATTERN_SEL_M BIT(10) -#define HIBMC_DP_COLOR_BAR_DATA_R_M GENMASK(23, 12) #define HIBMC_DP_COLOR_BAR_CTRL1 0x264 -#define HIBMC_DP_COLOR_BAR_DATA_B_M GENMASK(11, 0) -#define HIBMC_DP_COLOR_BAR_DATA_G_M GENMASK(23, 12) + #define HIBMC_DP_TIMING_GEN_CONFIG0 0x26c #define HIBMC_DP_CFG_TIMING_GEN0_HACTIVE GENMASK(31, 16) #define HIBMC_DP_CFG_TIMING_GEN0_HBLANK GENMASK(15, 0) @@ -96,8 +90,6 @@ #define HIBMC_DP_DPTX_GCTL0 0x708 #define HIBMC_DP_CFG_PHY_LANE_NUM GENMASK(2, 1) -#define HIBMC_DP_CFG_TIMING_GEN_ENABLE BIT(10) -#define HIBMC_DP_CFG_MST_ENABLE BIT(0) #define HIBMC_DP_INTR_ENABLE 0x720 #define HIBMC_DP_INTR_ORIGINAL_STATUS 0x728 diff --git a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_serdes.c b/drivers/gpu/drm/hisilicon/hibmc/dp/dp_serdes.c index 8191233aa965..676059d4c1e6 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/dp/dp_serdes.c +++ b/drivers/gpu/drm/hisilicon/hibmc/dp/dp_serdes.c @@ -57,3 +57,15 @@ int hibmc_dp_serdes_rate_switch(u8 rate, struct hibmc_dp_dev *dp) return 0; } + +int hibmc_dp_serdes_init(struct hibmc_dp_dev *dp) +{ + dp->serdes_base = dp->base + HIBMC_DP_HOST_OFFSET; + + writel(FIELD_PREP(HIBMC_DP_PMA_TXDEEMPH, DP_SERDES_VOL0_PRE0), + dp->serdes_base + HIBMC_DP_PMA_LANE0_OFFSET); + writel(FIELD_PREP(HIBMC_DP_PMA_TXDEEMPH, DP_SERDES_VOL0_PRE0), + dp->serdes_base + HIBMC_DP_PMA_LANE1_OFFSET); + + return hibmc_dp_serdes_rate_switch(DP_SERDES_BW_8_1, dp); +} diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_debugfs.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_debugfs.c index 6c6ff3255d15..83d2cd48f81c 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_debugfs.c +++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_debugfs.c @@ -15,44 +15,6 @@ #define MAX_BUF_SIZE 12 -static int hibmc_dp_show(struct seq_file *m, void *arg) -{ - struct drm_info_node *node = m->private; - struct drm_device *dev = node->minor->dev; - struct hibmc_drm_private *priv = to_hibmc_drm_private(dev); - int idx, rate; - - if (!drm_dev_enter(dev, &idx)) - return -ENODEV; - - switch (hibmc_dp_get_link_rate(&priv->dp)) { - case 0x1e: - rate = 810; // 8.1Gbps - break; - case 0x14: - rate = 540; // 5.4Gbps - break; - case 0xA: - rate = 270; // 2.7Gbps - break; - case 0x6: - rate = 162; // 1.62Gbps - break; - default: - rate = 0; - } - - seq_printf(m, "enable lanes: %u\n", hibmc_dp_get_lanes(&priv->dp)); - seq_printf(m, "link rate: %d\n", rate); - seq_printf(m, "vfresh: %d\n", drm_mode_vrefresh(&priv->crtc.mode)); - seq_printf(m, "dpcd version: 0x%x\n", hibmc_dp_get_dpcd(&priv->dp)); - seq_printf(m, "hpd status: %d\n", priv->dp.hpd_status); - - drm_dev_exit(idx); - - return 0; -} - static ssize_t hibmc_control_write(struct file *file, const char __user *user_buf, size_t count, loff_t *ppos) { @@ -131,19 +93,12 @@ static const struct file_operations hibmc_dbg_fops = { .release = single_release, }; -static struct drm_info_list hibmc_debugfs_list[] = { - { "hibmc-dp", hibmc_dp_show }, -}; - void hibmc_debugfs_init(struct drm_connector *connector, struct dentry *root) { struct drm_device *dev = connector->dev; struct hibmc_drm_private *priv = to_hibmc_drm_private(dev); - struct drm_minor *minor = dev->primary; /* create the file in drm directory, so we don't need to remove manually */ - debugfs_create_file("colorbar-cfg", 0200, root, priv, &hibmc_dbg_fops); - - drm_debugfs_create_files(hibmc_debugfs_list, ARRAY_SIZE(hibmc_debugfs_list), - minor->debugfs_root, minor); + debugfs_create_file("colorbar-cfg", 0200, + root, priv, &hibmc_dbg_fops); } diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_dp.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_dp.c index ae6f5c235e02..c2cda042c736 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_dp.c +++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_dp.c @@ -11,7 +11,6 @@ #include <drm/drm_edid.h> #include "hibmc_drm_drv.h" -#include "hibmc_drm_regs.h" #include "dp/dp_hw.h" #define HIBMC_DP_MASKED_SINK_HPD_PLUG_INT BIT(2) @@ -20,56 +19,14 @@ static int hibmc_dp_connector_get_modes(struct drm_connector *connector) { int count; - struct hibmc_dp *dp = to_hibmc_dp(connector); - struct edid *edid; - - - edid = drm_get_edid(connector, &dp->aux.ddc); - if (edid) { - drm_connector_update_edid_property(connector, edid); - count = drm_add_edid_modes(connector, edid); - if (count) { - dp->is_connected = true; - goto out; - } - } - - - dp->is_connected = false; count = drm_add_modes_noedid(connector, connector->dev->mode_config.max_width, connector->dev->mode_config.max_height); drm_set_preferred_mode(connector, 1024, 768); // temporary implementation -out: - kfree(edid); - return count; } -static int hibmc_dp_mode_valid(struct drm_connector *connector, - struct drm_display_mode *mode, - struct drm_modeset_acquire_ctx *ctx, - enum drm_mode_status *status) -{ - struct hibmc_dp *dp = to_hibmc_dp(connector); - u64 cur_val, max_val; - - if (!dp->is_connected) { - *status = MODE_OK; - return 0; - } - - cur_val = (u64)mode->htotal * mode->vtotal * drm_mode_vrefresh(mode) * BPP_24; - max_val = (u64)hibmc_dp_get_link_rate(dp) * DP_MODE_VALI_CAL * hibmc_dp_get_lanes(dp); - if (cur_val > max_val) - *status = MODE_CLOCK_HIGH; - else - *status = MODE_OK; - - return 0; -} - static int hibmc_dp_detect(struct drm_connector *connector, struct drm_modeset_acquire_ctx *ctx, bool force) { @@ -83,7 +40,6 @@ static int hibmc_dp_detect(struct drm_connector *connector, static const struct drm_connector_helper_funcs hibmc_dp_conn_helper_funcs = { .get_modes = hibmc_dp_connector_get_modes, - .mode_valid_ctx = hibmc_dp_mode_valid, .detect_ctx = hibmc_dp_detect, }; @@ -148,26 +104,9 @@ static void hibmc_dp_encoder_disable(struct drm_encoder *drm_encoder, hibmc_dp_display_en(dp, false); } -static void hibmc_dp_encoder_mode_set(struct drm_encoder *encoder, - struct drm_crtc_state *crtc_state, - struct drm_connector_state *conn_state) -{ - u32 reg; - struct drm_device *dev = encoder->dev; - struct hibmc_drm_private *priv = to_hibmc_drm_private(dev); - - reg = readl(priv->mmio + HIBMC_DISPLAY_CONTROL_HISILE); - reg |= HIBMC_DISPLAY_CONTROL_FPVDDEN(1); - reg |= HIBMC_DISPLAY_CONTROL_PANELDATE(1); - reg |= HIBMC_DISPLAY_CONTROL_FPEN(1); - reg |= HIBMC_DISPLAY_CONTROL_VBIASEN(1); - writel(reg, priv->mmio + HIBMC_DISPLAY_CONTROL_HISILE); -} - static const struct drm_encoder_helper_funcs hibmc_dp_encoder_helper_funcs = { .atomic_enable = hibmc_dp_encoder_enable, .atomic_disable = hibmc_dp_encoder_disable, - .atomic_mode_set = hibmc_dp_encoder_mode_set, }; static const struct drm_encoder_funcs hibmc_encoder_funcs = { @@ -191,8 +130,6 @@ irqreturn_t hibmc_dp_hpd_isr(int irq, void *arg) dp->hpd_status = 0; if (dev->registered) drm_helper_hpd_irq_event(dev); - } else { - drm_dbg_dp(dev, "HPD OUT occur but err!\n"); } } else { if (dp->irq_status & HIBMC_DP_MASKED_SINK_HPD_PLUG_INT) { @@ -201,8 +138,6 @@ irqreturn_t hibmc_dp_hpd_isr(int irq, void *arg) dp->hpd_status = 1; if (dev->registered) drm_helper_hpd_irq_event(dev); - } else { - drm_dbg_dp(dev, "HPD IN occur but err!\n"); } } diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c index b9398a78c26c..147354daed84 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c +++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c @@ -20,7 +20,6 @@ #include <drm/drm_irq.h> #include <drm/drm_managed.h> #include <drm/drm_vblank.h> -#include <drm/drm_probe_helper.h> #include "hibmc_drm_drv.h" #include "hibmc_drm_regs.h" @@ -120,7 +119,7 @@ static int hibmc_kms_init(struct hibmc_drm_private *priv) ret = hibmc_de_init(priv); if (ret) { drm_err(priv->dev, "failed to init de: %d\n", ret); - goto err; + return ret; } /* @@ -130,25 +129,17 @@ static int hibmc_kms_init(struct hibmc_drm_private *priv) ret = readl(priv->mmio + HIBMC_DP_HOST_SERDES_CTRL); if (ret) { ret = hibmc_dp_init(priv); - if (ret) { + if (ret) drm_err(priv->dev, "failed to init dp: %d\n", ret); - goto err; - } } ret = hibmc_vdac_init(priv); if (ret) { drm_err(priv->dev, "failed to init vdac: %d\n", ret); - goto err; + return ret; } - drm_kms_helper_poll_init(priv->dev); return 0; - -err: - drm_atomic_helper_shutdown(priv->dev); - - return ret; } static void hibmc_kms_fini(struct hibmc_drm_private *priv) @@ -300,7 +291,6 @@ static int hibmc_hw_init(struct hibmc_drm_private *priv) static void hibmc_unload(struct drm_device *dev) { drm_atomic_helper_shutdown(dev); - drm_kms_helper_poll_fini(dev); } static int hibmc_msi_init(struct drm_device *dev) @@ -355,19 +345,21 @@ static int hibmc_load(struct drm_device *dev) priv->dev = dev; ret = hibmc_hw_init(priv); - if (ret) - return ret; + if (ret) { + drm_err(dev, "failed to initialize hardware: %d\n", ret); + goto err_alloc; + } ret = hibmc_mm_init(priv); if (ret) { - drm_err(dev, "Error initializing VRAM MM; %d\n", ret); - return ret; + drm_err(dev, "failed to initialize mm: %d\n", ret); + goto err_hw; } ret = hibmc_kms_init(priv); if (ret) { - drm_err(dev, "hibmc kms init failed, ret:%d\n", ret); - return ret; + drm_err(dev, "failed to initialize kms: %d\n", ret); + goto err_mm; } ret = drm_vblank_init(dev, dev->mode_config.num_crtc); @@ -389,8 +381,11 @@ static int hibmc_load(struct drm_device *dev) err_kms: hibmc_kms_fini(priv); +err_mm: hibmc_mm_fini(priv); +err_hw: hibmc_hw_unmap(priv); +err_alloc: dev->dev_private = NULL; return ret; @@ -400,7 +395,6 @@ static int hibmc_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) { struct drm_device *dev; - struct hibmc_drm_private *priv; int ret; ret = drm_fb_helper_remove_conflicting_pci_framebuffers(pdev, @@ -440,9 +434,6 @@ static int hibmc_pci_probe(struct pci_dev *pdev, drm_fbdev_generic_setup(dev, dev->mode_config.preferred_depth); - priv = to_hibmc_drm_private(dev); - hibmc_debugfs_init(&priv->dp.connector, dev->primary->debugfs_root); - return 0; err_unload: diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h index 617585268009..0b0addca37f9 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h +++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.h @@ -79,7 +79,6 @@ void hibmc_mm_fini(struct hibmc_drm_private *hibmc); int hibmc_dumb_create(struct drm_file *file, struct drm_device *dev, struct drm_mode_create_dumb *args); int hibmc_ddc_create(struct drm_device *drm_dev, struct hibmc_vdac *connector); -void hibmc_ddc_del(struct hibmc_vdac *vdac); int hibmc_dp_init(struct hibmc_drm_private *priv); extern const struct drm_mode_config_funcs hibmc_mode_funcs; diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_i2c.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_i2c.c index 2e0fcd2b3bc1..4f801c0fbd96 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_i2c.c +++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_i2c.c @@ -96,8 +96,3 @@ int hibmc_ddc_create(struct drm_device *drm_dev, struct hibmc_vdac *vdac) return i2c_bit_add_bus(&vdac->adapter); } - -void hibmc_ddc_del(struct hibmc_vdac *vdac) -{ - i2c_del_adapter(&vdac->adapter); -} diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c index 9c0ec6e54df0..f183dd819daf 100644 --- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c +++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_vdac.c @@ -88,7 +88,7 @@ static enum drm_mode_status hibmc_connector_mode_valid( return hibmc_valid_mode(mode->hdisplay, mode->vdisplay); } -static void hibmc_vdac_connector_destroy(struct drm_connector *connector) +static void hibmc_connector_destroy(struct drm_connector *connector) { struct hibmc_vdac *vdac = to_hibmc_vdac(connector); @@ -130,7 +130,7 @@ static void hibmc_vdac_force(struct drm_connector *connector) static const struct drm_connector_funcs hibmc_connector_funcs = { .fill_modes = drm_helper_probe_single_connector_modes, - .destroy = hibmc_vdac_connector_destroy, + .destroy = hibmc_connector_destroy, .reset = drm_atomic_helper_connector_reset, .atomic_duplicate_state = drm_atomic_helper_connector_duplicate_state, .atomic_destroy_state = drm_atomic_helper_connector_destroy_state, @@ -180,7 +180,7 @@ int hibmc_vdac_init(struct hibmc_drm_private *priv) DRM_MODE_ENCODER_DAC, NULL); if (ret) { drm_err(dev, "failed to init encoder: %d\n", ret); - goto err; + return ret; } drm_encoder_helper_add(encoder, &hibmc_encoder_helper_funcs); @@ -191,7 +191,7 @@ int hibmc_vdac_init(struct hibmc_drm_private *priv) &vdac->adapter); if (ret) { drm_err(dev, "failed to init connector: %d\n", ret); - goto err; + return ret; } drm_connector_helper_add(connector, &hibmc_connector_helper_funcs); @@ -200,9 +200,4 @@ int hibmc_vdac_init(struct hibmc_drm_private *priv) connector->polled = DRM_CONNECTOR_POLL_CONNECT | DRM_CONNECTOR_POLL_DISCONNECT; return 0; - -err: - hibmc_ddc_del(vdac); - - return ret; } -- 2.34.1

2 1

[PATCH v2 OLK-6.6 0/3] Fix CVE-2025-21696
by Ze Zuo 06 Feb '26

06 Feb '26

Fix CVE-2025-21696. change since v1: - fix kabi breakage due to first patch. Lokesh Gidra (1): userfaultfd: move userfaultfd_ctx struct to header file Ryan Roberts (1): mm: clear uffd-wp PTE/PMD state on mremap() Ze Zuo (1): userfaultfd: fix kabi breakage due to struct userfaultfd_ctx fs/userfaultfd.c | 39 -------------------------- include/linux/userfaultfd_k.h | 53 +++++++++++++++++++++++++++++++++++ mm/huge_memory.c | 12 ++++++++ mm/hugetlb.c | 14 ++++++++- mm/mremap.c | 32 ++++++++++++++++++++- 5 files changed, 109 insertions(+), 41 deletions(-) -- 2.25.1

2 4

[PATCH OLK-6.6] x86/CPU/AMD: Add RDSEED fix for Zen5
by Bowen You 06 Feb '26

06 Feb '26

From: Gregory Price <gourry(a)gourry.net> stable inclusion from stable-v6.12.57 commit e980de2ff109dacb6d9d3a77f01b27c467115ecb category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/11500 CVE: CVE-2025-68313 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 607b9fb2ce248cc5b633c5949e0153838992c152 upstream. There's an issue with RDSEED's 16-bit and 32-bit register output variants on Zen5 which return a random value of 0 "at a rate inconsistent with randomness while incorrectly signaling success (CF=1)". Search the web for AMD-SB-7055 for more detail. Add a fix glue which checks microcode revisions. [ bp: Add microcode revisions checking, rewrite. ] Cc: stable(a)vger.kernel.org Signed-off-by: Gregory Price <gourry(a)gourry.net> Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Link: https://lore.kernel.org/r/20251018024010.4112396-1-gourry@gourry.net [ bp: 6.12 backport: use the alternative microcode version checking. ] Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: arch/x86/include/asm/cpu.h [Add the definition of zen_patch_rev] Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- arch/x86/kernel/cpu/amd.c | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c index f89dbe6f48e6..5a46bf0cce5d 100644 --- a/arch/x86/kernel/cpu/amd.c +++ b/arch/x86/kernel/cpu/amd.c @@ -1135,8 +1135,43 @@ static void init_amd_zen4(struct cpuinfo_x86 *c) } } +static bool check_rdseed_microcode(void) +{ + struct cpuinfo_x86 *c = &boot_cpu_data; + union zen_patch_rev p; + u32 min_rev = 0; + + p.ext_fam = c->x86 - 0xf; + p.model = c->x86_model; + p.ext_model = c->x86_model >> 4; + p.stepping = c->x86_stepping; + /* reserved bits are expected to be 0 in test below */ + p.__reserved = 0; + + if (cpu_has(c, X86_FEATURE_ZEN5)) { + switch (p.ucode_rev >> 8) { + case 0xb0021: min_rev = 0xb00215a; break; + case 0xb1010: min_rev = 0xb101054; break; + default: + pr_debug("%s: ucode_rev: 0x%x, current revision: 0x%x\n", + __func__, p.ucode_rev, c->microcode); + return false; + } + } + + if (!min_rev) + return false; + + return c->microcode >= min_rev; +} + static void init_amd_zen5(struct cpuinfo_x86 *c) { + if (!check_rdseed_microcode()) { + clear_cpu_cap(c, X86_FEATURE_RDSEED); + msr_clear_bit(MSR_AMD64_CPUID_FN_7, 18); + pr_emerg_once("RDSEED32 is broken. Disabling the corresponding CPUID bit.\n"); + } } static void init_amd(struct cpuinfo_x86 *c) -- 2.34.1

2 1

[PATCH OLK-5.10] arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA
by Jinjie Ruan 06 Feb '26

06 Feb '26

From: Mark Rutland <mark.rutland(a)arm.com> stable inclusion from stable-v6.6.122 commit 19b2c3f3ca1b4b6dccd2a42aca2692d8c79c4214 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13639 CVE: CVE-2026-23107 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit ea8ccfddbce0bee6310da4f3fc560ad520f5e6b4 upstream. The code to restore a ZA context doesn't attempt to allocate the task's sve_state before setting TIF_SME. Consequently, restoring a ZA context can place a task into an invalid state where TIF_SME is set but the task's sve_state is NULL. In legitimate but uncommon cases where the ZA signal context was NOT created by the kernel in the context of the same task (e.g. if the task is saved/restored with something like CRIU), we have no guarantee that sve_state had been allocated previously. In these cases, userspace can enter streaming mode without trapping while sve_state is NULL, causing a later NULL pointer dereference when the kernel attempts to store the register state: | # ./sigreturn-za | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 | Mem abort info: | ESR = 0x0000000096000046 | EC = 0x25: DABT (current EL), IL = 32 bits | SET = 0, FnV = 0 | EA = 0, S1PTW = 0 | FSC = 0x06: level 2 translation fault | Data abort info: | ISV = 0, ISS = 0x00000046, ISS2 = 0x00000000 | CM = 0, WnR = 1, TnD = 0, TagAccess = 0 | GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 | user pgtable: 4k pages, 52-bit VAs, pgdp=0000000101f47c00 | [0000000000000000] pgd=08000001021d8403, p4d=0800000102274403, pud=0800000102275403, pmd=0000000000000000 | Internal error: Oops: 0000000096000046 [#1] SMP | Modules linked in: | CPU: 0 UID: 0 PID: 153 Comm: sigreturn-za Not tainted 6.19.0-rc1 #1 PREEMPT | Hardware name: linux,dummy-virt (DT) | pstate: 214000c9 (nzCv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--) | pc : sve_save_state+0x4/0xf0 | lr : fpsimd_save_user_state+0xb0/0x1c0 | sp : ffff80008070bcc0 | x29: ffff80008070bcc0 x28: fff00000c1ca4c40 x27: 63cfa172fb5cf658 | x26: fff00000c1ca5228 x25: 0000000000000000 x24: 0000000000000000 | x23: 0000000000000000 x22: fff00000c1ca4c40 x21: fff00000c1ca4c40 | x20: 0000000000000020 x19: fff00000ff6900f0 x18: 0000000000000000 | x17: fff05e8e0311f000 x16: 0000000000000000 x15: 028fca8f3bdaf21c | x14: 0000000000000212 x13: fff00000c0209f10 x12: 0000000000000020 | x11: 0000000000200b20 x10: 0000000000000000 x9 : fff00000ff69dcc0 | x8 : 00000000000003f2 x7 : 0000000000000001 x6 : fff00000c1ca5b48 | x5 : fff05e8e0311f000 x4 : 0000000008000000 x3 : 0000000000000000 | x2 : 0000000000000001 x1 : fff00000c1ca5970 x0 : 0000000000000440 | Call trace: | sve_save_state+0x4/0xf0 (P) | fpsimd_thread_switch+0x48/0x198 | __switch_to+0x20/0x1c0 | __schedule+0x36c/0xce0 | schedule+0x34/0x11c | exit_to_user_mode_loop+0x124/0x188 | el0_interrupt+0xc8/0xd8 | __el0_irq_handler_common+0x18/0x24 | el0t_64_irq_handler+0x10/0x1c | el0t_64_irq+0x198/0x19c | Code: 54000040 d51b4408 d65f03c0 d503245f (e5bb5800) | ---[ end trace 0000000000000000 ]--- Fix this by having restore_za_context() ensure that the task's sve_state is allocated, matching what we do when taking an SME trap. Any live SVE/SSVE state (which is restored earlier from a separate signal context) must be preserved, and hence this is not zeroed. Fixes: 39782210eb7e ("arm64/sme: Implement ZA signal handling") Signed-off-by: Mark Rutland <mark.rutland(a)arm.com> Cc: <stable(a)vger.kernel.org> Cc: Mark Brown <broonie(a)kernel.org> Cc: Will Deacon <will(a)kernel.org> Reviewed-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: arch/arm64/kernel/signal.c [conflict because ce514000da4f ("arm64/sme: Rename za_state to sme_state")] Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- arch/arm64/kernel/signal.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/arch/arm64/kernel/signal.c b/arch/arm64/kernel/signal.c index a0c85bb01751..d8c9434f975e 100644 --- a/arch/arm64/kernel/signal.c +++ b/arch/arm64/kernel/signal.c @@ -363,6 +363,10 @@ int restore_za_context(struct user_ctxs *user) fpsimd_flush_task_state(current); /* From now, fpsimd_thread_switch() won't touch thread.sve_state */ + sve_alloc(current, false); + if (!current->thread.sve_state) + return -ENOMEM; + sme_alloc(current, true); if (!current->thread.za_state) { current->thread.svcr &= ~SVCR_ZA_MASK; -- 2.34.1

2 1

[PATCH OLK-6.6] x86/CPU/AMD: Add RDSEED fix for Zen5
by Bowen You 06 Feb '26

06 Feb '26

From: Gregory Price <gourry(a)gourry.net> stable inclusion from stable-v6.12.57 commit e980de2ff109dacb6d9d3a77f01b27c467115ecb category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/11500 CVE: CVE-2025-68313 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 607b9fb2ce248cc5b633c5949e0153838992c152 upstream. There's an issue with RDSEED's 16-bit and 32-bit register output variants on Zen5 which return a random value of 0 "at a rate inconsistent with randomness while incorrectly signaling success (CF=1)". Search the web for AMD-SB-7055 for more detail. Add a fix glue which checks microcode revisions. [ bp: Add microcode revisions checking, rewrite. ] Cc: stable(a)vger.kernel.org Signed-off-by: Gregory Price <gourry(a)gourry.net> Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Link: https://lore.kernel.org/r/20251018024010.4112396-1-gourry@gourry.net [ bp: 6.12 backport: use the alternative microcode version checking. ] Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: arch/x86/include/asm/cpu.h [Add the definition of zen_patch_rev] Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- arch/x86/kernel/cpu/amd.c | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c index f89dbe6f48e6..5a46bf0cce5d 100644 --- a/arch/x86/kernel/cpu/amd.c +++ b/arch/x86/kernel/cpu/amd.c @@ -1135,8 +1135,43 @@ static void init_amd_zen4(struct cpuinfo_x86 *c) } } +static bool check_rdseed_microcode(void) +{ + struct cpuinfo_x86 *c = &boot_cpu_data; + union zen_patch_rev p; + u32 min_rev = 0; + + p.ext_fam = c->x86 - 0xf; + p.model = c->x86_model; + p.ext_model = c->x86_model >> 4; + p.stepping = c->x86_stepping; + /* reserved bits are expected to be 0 in test below */ + p.__reserved = 0; + + if (cpu_has(c, X86_FEATURE_ZEN5)) { + switch (p.ucode_rev >> 8) { + case 0xb0021: min_rev = 0xb00215a; break; + case 0xb1010: min_rev = 0xb101054; break; + default: + pr_debug("%s: ucode_rev: 0x%x, current revision: 0x%x\n", + __func__, p.ucode_rev, c->microcode); + return false; + } + } + + if (!min_rev) + return false; + + return c->microcode >= min_rev; +} + static void init_amd_zen5(struct cpuinfo_x86 *c) { + if (!check_rdseed_microcode()) { + clear_cpu_cap(c, X86_FEATURE_RDSEED); + msr_clear_bit(MSR_AMD64_CPUID_FN_7, 18); + pr_emerg_once("RDSEED32 is broken. Disabling the corresponding CPUID bit.\n"); + } } static void init_amd(struct cpuinfo_x86 *c) -- 2.34.1

2 1

[PATCH OLK-5.10] irqchip/gic-v3-its: Avoid truncating memory addresses
by Jinjie Ruan 06 Feb '26

06 Feb '26

From: Arnd Bergmann <arnd(a)arndb.de> stable inclusion from stable-v6.6.122 commit 1b323391560354d8c515de8658b057a1daa82adb category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13618 CVE: CVE-2026-23085 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 8d76a7d89c12d08382b66e2f21f20d0627d14859 upstream. On 32-bit machines with CONFIG_ARM_LPAE, it is possible for lowmem allocations to be backed by addresses physical memory above the 32-bit address limit, as found while experimenting with larger VMSPLIT configurations. This caused the qemu virt model to crash in the GICv3 driver, which allocates the 'itt' object using GFP_KERNEL. Since all memory below the 4GB physical address limit is in ZONE_DMA in this configuration, kmalloc() defaults to higher addresses for ZONE_NORMAL, and the ITS driver stores the physical address in a 32-bit 'unsigned long' variable. Change the itt_addr variable to the correct phys_addr_t type instead, along with all other variables in this driver that hold a physical address. The gicv5 driver correctly uses u64 variables, while all other irqchip drivers don't call virt_to_phys or similar interfaces. It's expected that other device drivers have similar issues, but fixing this one is sufficient for booting a virtio based guest. Fixes: cc2d3216f53c ("irqchip: GICv3: ITS command queue") Signed-off-by: Arnd Bergmann <arnd(a)arndb.de> Signed-off-by: Thomas Gleixner <tglx(a)kernel.org> Reviewed-by: Marc Zyngier <maz(a)kernel.org> Cc: stable(a)vger.kernel.org Link: https://patch.msgid.link/20260119201603.2713066-1-arnd@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/irqchip/irq-gic-v3-its.c [ conflict becasue 5ddbc909f82a ("[Backport] irqchip/gic-v3-its: Fix VSYNC referencing an unmapped VPE on GIC v4.1") not merged. ] Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- drivers/irqchip/irq-gic-v3-its.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c index fbe83b657dcc..8cac29a0996c 100644 --- a/drivers/irqchip/irq-gic-v3-its.c +++ b/drivers/irqchip/irq-gic-v3-its.c @@ -954,7 +954,7 @@ static struct its_collection *its_build_mapd_cmd(struct its_node *its, struct its_cmd_block *cmd, struct its_cmd_desc *desc) { - unsigned long itt_addr; + phys_addr_t itt_addr; u8 size = ilog2(desc->its_mapd_cmd.dev->nr_ites); itt_addr = virt_to_phys(desc->its_mapd_cmd.dev->itt); @@ -1184,7 +1184,7 @@ static struct its_vpe *its_build_vmapp_cmd(struct its_node *its, struct its_cmd_block *cmd, struct its_cmd_desc *desc) { - unsigned long vpt_addr, vconf_addr; + phys_addr_t vpt_addr, vconf_addr; u64 target; bool alloc; @@ -2891,10 +2891,10 @@ static int its_setup_baser(struct its_node *its, struct its_baser *baser, baser->psz = psz; tmp = indirect ? GITS_LVL1_ENTRY_SIZE : esz; - pr_info("ITS@%pa: allocated %d %s @%lx (%s, esz %d, psz %dK, shr %d)\n", + pr_info("ITS@%pa: allocated %d %s @%llx (%s, esz %d, psz %dK, shr %d)\n", &its->phys_base, (int)(PAGE_ORDER_TO_SIZE(order) / (int)tmp), its_base_type_string[type], - (unsigned long)virt_to_phys(base), + (u64)virt_to_phys(base), indirect ? "indirect" : "flat", (int)esz, psz / SZ_1K, (int)shr >> GITS_BASER_SHAREABILITY_SHIFT); -- 2.34.1

2 1

[PATCH OLK-6.6] irqchip/gic-v3-its: Avoid truncating memory addresses
by Jinjie Ruan 06 Feb '26

06 Feb '26

From: Arnd Bergmann <arnd(a)arndb.de> stable inclusion from stable-v6.6.122 commit 1b323391560354d8c515de8658b057a1daa82adb category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13618 CVE: CVE-2026-23085 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 8d76a7d89c12d08382b66e2f21f20d0627d14859 upstream. On 32-bit machines with CONFIG_ARM_LPAE, it is possible for lowmem allocations to be backed by addresses physical memory above the 32-bit address limit, as found while experimenting with larger VMSPLIT configurations. This caused the qemu virt model to crash in the GICv3 driver, which allocates the 'itt' object using GFP_KERNEL. Since all memory below the 4GB physical address limit is in ZONE_DMA in this configuration, kmalloc() defaults to higher addresses for ZONE_NORMAL, and the ITS driver stores the physical address in a 32-bit 'unsigned long' variable. Change the itt_addr variable to the correct phys_addr_t type instead, along with all other variables in this driver that hold a physical address. The gicv5 driver correctly uses u64 variables, while all other irqchip drivers don't call virt_to_phys or similar interfaces. It's expected that other device drivers have similar issues, but fixing this one is sufficient for booting a virtio based guest. Fixes: cc2d3216f53c ("irqchip: GICv3: ITS command queue") Signed-off-by: Arnd Bergmann <arnd(a)arndb.de> Signed-off-by: Thomas Gleixner <tglx(a)kernel.org> Reviewed-by: Marc Zyngier <maz(a)kernel.org> Cc: stable(a)vger.kernel.org Link: https://patch.msgid.link/20260119201603.2713066-1-arnd@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- drivers/irqchip/irq-gic-v3-its.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c index c8e327f96303..a9802a3870db 100644 --- a/drivers/irqchip/irq-gic-v3-its.c +++ b/drivers/irqchip/irq-gic-v3-its.c @@ -978,7 +978,7 @@ static struct its_collection *its_build_mapd_cmd(struct its_node *its, struct its_cmd_block *cmd, struct its_cmd_desc *desc) { - unsigned long itt_addr; + phys_addr_t itt_addr; u8 size = ilog2(desc->its_mapd_cmd.dev->nr_ites); itt_addr = virt_to_phys(desc->its_mapd_cmd.dev->itt); @@ -1208,7 +1208,7 @@ static struct its_vpe *its_build_vmapp_cmd(struct its_node *its, struct its_cmd_desc *desc) { struct its_vpe *vpe = valid_vpe(its, desc->its_vmapp_cmd.vpe); - unsigned long vpt_addr, vconf_addr; + phys_addr_t vpt_addr, vconf_addr; u64 target; bool alloc; @@ -2836,10 +2836,10 @@ static int its_setup_baser(struct its_node *its, struct its_baser *baser, baser->psz = psz; tmp = indirect ? GITS_LVL1_ENTRY_SIZE : esz; - pr_info("ITS@%pa: allocated %d %s @%lx (%s, esz %d, psz %dK, shr %d)\n", + pr_info("ITS@%pa: allocated %d %s @%llx (%s, esz %d, psz %dK, shr %d)\n", &its->phys_base, (int)(PAGE_ORDER_TO_SIZE(order) / (int)tmp), its_base_type_string[type], - (unsigned long)virt_to_phys(base), + (u64)virt_to_phys(base), indirect ? "indirect" : "flat", (int)esz, psz / SZ_1K, (int)shr >> GITS_BASER_SHAREABILITY_SHIFT); -- 2.34.1

2 1

[PATCH OLK-6.6 00/10] fix CVE-2024-50102
by Qi Xi 06 Feb '26

06 Feb '26

*** BLURB HERE *** David Gow (1): x86/uaccess: Zero the 8-byte get_range case on failure on 32-bit David Laight (1): x86: fix off-by-one in access_ok() Linus Torvalds (6): runtime constants: deal with old decrepit linkers runtime constants: add x86 architecture support x86: fix whitespace in runtime-const assembler output x86/uaccess: Improve the 8-byte getuser() case x86: fix user address masking non-canonical speculation issue x86: uaccess: don't use runtime-const rewriting in modules Stephen Brennan (1): dcache: keep dentry_hashtable or d_hash_shift even when not used Thomas Gleixner (1): x86/uaccess: Add missing __force to casts in __access_ok() and valid_user_address() arch/x86/include/asm/runtime-const.h | 65 ++++++++++++++++++++++ arch/x86/include/asm/uaccess_64.h | 49 ++++++++++------- arch/x86/kernel/cpu/common.c | 14 +++++ arch/x86/kernel/vmlinux.lds.S | 4 ++ arch/x86/lib/getuser.S | 80 ++++++++++------------------ fs/dcache.c | 9 +++- include/asm-generic/vmlinux.lds.h | 7 +++ 7 files changed, 157 insertions(+), 71 deletions(-) create mode 100644 arch/x86/include/asm/runtime-const.h -- 2.33.0

2 11

[PATCH OLK-5.10 0/1] CVE-2023-53712
by Liu Mingrui 06 Feb '26

06 Feb '26

From: Mingrui Liu <liumingrui(a)huawei.com> CVE-2023-53712 Mårten Lindahl (1): ARM: 9317/1: kexec: Make smp stop calls asynchronous arch/arm/kernel/machine_kexec.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH OLK-6.6 00/17] backport some net bugfix from 6.6 lts
by Zhang Changzhong 06 Feb '26

06 Feb '26

Alexey Simakov (1): sctp: avoid NULL dereference when chunk data buffer is missing Eric Dumazet (2): sctp: initialize more fields in sctp_v6_from_sk() sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto Hans de Goede (1): net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer Ido Schimmel (1): nexthop: Forbid FDB status change while nexthop is in a group Ilya Dryomov (1): libceph: fix potential use-after-free in have_mon_and_osd_map() Kuniyuki Iwashima (3): tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). tipc: Fix use-after-free in tipc_mon_reinit_self(). tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). Paul Chaignon (1): bpf: Explicitly check accesses to bpf_sock_addr Slavin Liu (1): ipvs: Defer ip_vs_ftp unregister during netns cleanup Stefan Wiehler (3): sctp: Hold RCU read lock while iterating over address list sctp: Prevent TOCTOU out-of-bounds write sctp: Hold sock lock while iterating over address list Wang Liang (1): netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm ziming zhang (2): libceph: prevent potential out-of-bounds writes in handle_auth_session_key() libceph: replace BUG_ON with bounds check for map->max_osd net/bridge/br_netfilter_hooks.c | 3 --- net/ceph/auth_x.c | 2 ++ net/ceph/ceph_common.c | 53 +++++++++++++++++++++++++---------------- net/ceph/debugfs.c | 14 +++++++---- net/ceph/osdmap.c | 18 ++++++++------ net/core/filter.c | 16 ++++++++----- net/ipv4/nexthop.c | 7 ++++++ net/ipv4/tcp.c | 5 ++++ net/ipv4/tcp_input.c | 1 - net/netfilter/ipvs/ip_vs_ftp.c | 4 +++- net/rfkill/rfkill-gpio.c | 4 ++-- net/sctp/diag.c | 21 ++++++++++++---- net/sctp/inqueue.c | 13 +++++----- net/sctp/ipv6.c | 2 ++ net/sctp/transport.c | 13 ++++++---- net/tipc/net.c | 2 ++ 16 files changed, 118 insertions(+), 60 deletions(-) -- 2.9.5

2 18

[PATCH OLK-6.6] pNFS: Fix a deadlock when returning a delegation during open()
by Li Lingfeng 06 Feb '26

06 Feb '26

From: Trond Myklebust <trond.myklebust(a)hammerspace.com> mainline inclusion from mainline-v6.19-rc6 commit 857bf9056291a16785ae3be1d291026b2437fc48 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13583 CVE: CVE-2026-23050 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Ben Coddington reports seeing a hang in the following stack trace: 0 [ffffd0b50e1774e0] __schedule at ffffffff9ca05415 1 [ffffd0b50e177548] schedule at ffffffff9ca05717 2 [ffffd0b50e177558] bit_wait at ffffffff9ca061e1 3 [ffffd0b50e177568] __wait_on_bit at ffffffff9ca05cfb 4 [ffffd0b50e1775c8] out_of_line_wait_on_bit at ffffffff9ca05ea5 5 [ffffd0b50e177618] pnfs_roc at ffffffffc154207b [nfsv4] 6 [ffffd0b50e1776b8] _nfs4_proc_delegreturn at ffffffffc1506586 [nfsv4] 7 [ffffd0b50e177788] nfs4_proc_delegreturn at ffffffffc1507480 [nfsv4] 8 [ffffd0b50e1777f8] nfs_do_return_delegation at ffffffffc1523e41 [nfsv4] 9 [ffffd0b50e177838] nfs_inode_set_delegation at ffffffffc1524a75 [nfsv4] 10 [ffffd0b50e177888] nfs4_process_delegation at ffffffffc14f41dd [nfsv4] 11 [ffffd0b50e1778a0] _nfs4_opendata_to_nfs4_state at ffffffffc1503edf [nfsv4] 12 [ffffd0b50e1778c0] _nfs4_open_and_get_state at ffffffffc1504e56 [nfsv4] 13 [ffffd0b50e177978] _nfs4_do_open at ffffffffc15051b8 [nfsv4] 14 [ffffd0b50e1779f8] nfs4_do_open at ffffffffc150559c [nfsv4] 15 [ffffd0b50e177a80] nfs4_atomic_open at ffffffffc15057fb [nfsv4] 16 [ffffd0b50e177ad0] nfs4_file_open at ffffffffc15219be [nfsv4] 17 [ffffd0b50e177b78] do_dentry_open at ffffffff9c09e6ea 18 [ffffd0b50e177ba8] vfs_open at ffffffff9c0a082e 19 [ffffd0b50e177bd0] dentry_open at ffffffff9c0a0935 The issue is that the delegreturn is being asked to wait for a layout return that cannot complete because a state recovery was initiated. The state recovery cannot complete until the open() finishes processing the delegations it was given. The solution is to propagate the existing flags that indicate a non-blocking call to the function pnfs_roc(), so that it knows not to wait in this situation. Reported-by: Benjamin Coddington <bcodding(a)hammerspace.com> Fixes: 29ade5db1293 ("pNFS: Wait on outstanding layoutreturns to complete in pnfs_roc()") Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Conflicts: fs/nfs/pnfs.c [Commit 5468fc8298a9 ("NFSv4/pNFS: Do layout state recovery upon reboot") add definition of pnfs_layout_return_on_reboot() before pnfs_roc().] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfs/nfs4proc.c | 6 ++--- fs/nfs/pnfs.c | 58 +++++++++++++++++++++++++++++++++-------------- fs/nfs/pnfs.h | 17 ++++++-------- 3 files changed, 51 insertions(+), 30 deletions(-) diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c index 4410e2ad8f39..54ce1f41eb53 100644 --- a/fs/nfs/nfs4proc.c +++ b/fs/nfs/nfs4proc.c @@ -3783,8 +3783,8 @@ int nfs4_do_close(struct nfs4_state *state, gfp_t gfp_mask, int wait) calldata->res.seqid = calldata->arg.seqid; calldata->res.server = server; calldata->res.lr_ret = -NFS4ERR_NOMATCHING_LAYOUT; - calldata->lr.roc = pnfs_roc(state->inode, - &calldata->lr.arg, &calldata->lr.res, msg.rpc_cred); + calldata->lr.roc = pnfs_roc(state->inode, &calldata->lr.arg, + &calldata->lr.res, msg.rpc_cred, wait); if (calldata->lr.roc) { calldata->arg.lr_args = &calldata->lr.arg; calldata->res.lr_res = &calldata->lr.res; @@ -6729,7 +6729,7 @@ static int _nfs4_proc_delegreturn(struct inode *inode, const struct cred *cred, data->inode = nfs_igrab_and_active(inode); if (data->inode || issync) { data->lr.roc = pnfs_roc(inode, &data->lr.arg, &data->lr.res, - cred); + cred, issync); if (data->lr.roc) { data->args.lr_args = &data->lr.arg; data->res.lr_res = &data->lr.res; diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c index 0737d9a15d86..6dbfae295f76 100644 --- a/fs/nfs/pnfs.c +++ b/fs/nfs/pnfs.c @@ -1426,10 +1426,9 @@ pnfs_commit_and_return_layout(struct inode *inode) return ret; } -bool pnfs_roc(struct inode *ino, - struct nfs4_layoutreturn_args *args, - struct nfs4_layoutreturn_res *res, - const struct cred *cred) +bool pnfs_roc(struct inode *ino, struct nfs4_layoutreturn_args *args, + struct nfs4_layoutreturn_res *res, const struct cred *cred, + bool sync) { struct nfs_inode *nfsi = NFS_I(ino); struct nfs_open_context *ctx; @@ -1440,7 +1439,7 @@ bool pnfs_roc(struct inode *ino, nfs4_stateid stateid; enum pnfs_iomode iomode = 0; bool layoutreturn = false, roc = false; - bool skip_read = false; + bool skip_read; if (!nfs_have_layout(ino)) return false; @@ -1453,20 +1452,14 @@ bool pnfs_roc(struct inode *ino, lo = NULL; goto out_noroc; } - pnfs_get_layout_hdr(lo); - if (test_bit(NFS_LAYOUT_RETURN_LOCK, &lo->plh_flags)) { - spin_unlock(&ino->i_lock); - rcu_read_unlock(); - wait_on_bit(&lo->plh_flags, NFS_LAYOUT_RETURN, - TASK_UNINTERRUPTIBLE); - pnfs_put_layout_hdr(lo); - goto retry; - } /* no roc if we hold a delegation */ + skip_read = false; if (nfs4_check_delegation(ino, FMODE_READ)) { - if (nfs4_check_delegation(ino, FMODE_WRITE)) + if (nfs4_check_delegation(ino, FMODE_WRITE)) { + lo = NULL; goto out_noroc; + } skip_read = true; } @@ -1475,12 +1468,43 @@ bool pnfs_roc(struct inode *ino, if (state == NULL) continue; /* Don't return layout if there is open file state */ - if (state->state & FMODE_WRITE) + if (state->state & FMODE_WRITE) { + lo = NULL; goto out_noroc; + } if (state->state & FMODE_READ) skip_read = true; } + if (skip_read) { + bool writes = false; + + list_for_each_entry(lseg, &lo->plh_segs, pls_list) { + if (lseg->pls_range.iomode != IOMODE_READ) { + writes = true; + break; + } + } + if (!writes) { + lo = NULL; + goto out_noroc; + } + } + + pnfs_get_layout_hdr(lo); + if (test_bit(NFS_LAYOUT_RETURN_LOCK, &lo->plh_flags)) { + if (!sync) { + pnfs_set_plh_return_info( + lo, skip_read ? IOMODE_RW : IOMODE_ANY, 0); + goto out_noroc; + } + spin_unlock(&ino->i_lock); + rcu_read_unlock(); + wait_on_bit(&lo->plh_flags, NFS_LAYOUT_RETURN, + TASK_UNINTERRUPTIBLE); + pnfs_put_layout_hdr(lo); + goto retry; + } list_for_each_entry_safe(lseg, next, &lo->plh_segs, pls_list) { if (skip_read && lseg->pls_range.iomode == IOMODE_READ) @@ -1520,7 +1544,7 @@ bool pnfs_roc(struct inode *ino, out_noroc: spin_unlock(&ino->i_lock); rcu_read_unlock(); - pnfs_layoutcommit_inode(ino, true); + pnfs_layoutcommit_inode(ino, sync); if (roc) { struct pnfs_layoutdriver_type *ld = NFS_SERVER(ino)->pnfs_curr_ld; if (ld->prepare_layoutreturn) diff --git a/fs/nfs/pnfs.h b/fs/nfs/pnfs.h index 79996d7dad0f..a613466f6f22 100644 --- a/fs/nfs/pnfs.h +++ b/fs/nfs/pnfs.h @@ -295,10 +295,9 @@ int pnfs_mark_matching_lsegs_return(struct pnfs_layout_hdr *lo, u32 seq); int pnfs_mark_layout_stateid_invalid(struct pnfs_layout_hdr *lo, struct list_head *lseg_list); -bool pnfs_roc(struct inode *ino, - struct nfs4_layoutreturn_args *args, - struct nfs4_layoutreturn_res *res, - const struct cred *cred); +bool pnfs_roc(struct inode *ino, struct nfs4_layoutreturn_args *args, + struct nfs4_layoutreturn_res *res, const struct cred *cred, + bool sync); int pnfs_roc_done(struct rpc_task *task, struct nfs4_layoutreturn_args **argpp, struct nfs4_layoutreturn_res **respp, int *ret); void pnfs_roc_release(struct nfs4_layoutreturn_args *args, @@ -769,12 +768,10 @@ pnfs_layoutcommit_outstanding(struct inode *inode) return false; } - -static inline bool -pnfs_roc(struct inode *ino, - struct nfs4_layoutreturn_args *args, - struct nfs4_layoutreturn_res *res, - const struct cred *cred) +static inline bool pnfs_roc(struct inode *ino, + struct nfs4_layoutreturn_args *args, + struct nfs4_layoutreturn_res *res, + const struct cred *cred, bool sync) { return false; } -- 2.52.0

2 1

[PATCH OLK-6.6] Input: alps - fix use-after-free bugs caused by dev3_register_work
by Xia Fukun 06 Feb '26

06 Feb '26

From: Duoming Zhou <duoming(a)zju.edu.cn> mainline inclusion from mainline-v6.19-rc2 commit bf40644ef8c8a288742fa45580897ed0e0289474 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13374 CVE: CVE-2025-68822 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The dev3_register_work delayed work item is initialized within alps_reconnect() and scheduled upon receipt of the first bare PS/2 packet from an external PS/2 device connected to the ALPS touchpad. During device detachment, the original implementation calls flush_workqueue() in psmouse_disconnect() to ensure completion of dev3_register_work. However, the flush_workqueue() in psmouse_disconnect() only blocks and waits for work items that were already queued to the workqueue prior to its invocation. Any work items submitted after flush_workqueue() is called are not included in the set of tasks that the flush operation awaits. This means that after flush_workqueue() has finished executing, the dev3_register_work could still be scheduled. Although the psmouse state is set to PSMOUSE_CMD_MODE in psmouse_disconnect(), the scheduling of dev3_register_work remains unaffected. The race condition can occur as follows: CPU 0 (cleanup path) | CPU 1 (delayed work) psmouse_disconnect() | psmouse_set_state() | flush_workqueue() | alps_report_bare_ps2_packet() alps_disconnect() | psmouse_queue_work() kfree(priv); // FREE | alps_register_bare_ps2_mouse() | priv = container_of(work...); // USE | priv->dev3 // USE Add disable_delayed_work_sync() in alps_disconnect() to ensure that dev3_register_work is properly canceled and prevented from executing after the alps_data structure has been deallocated. This bug is identified by static analysis. Fixes: 04aae283ba6a ("Input: ALPS - do not mix trackstick and external PS/2 mouse data") Cc: stable(a)kernel.org Signed-off-by: Duoming Zhou <duoming(a)zju.edu.cn> Link: https://patch.msgid.link/b57b0a9ccca51a3f06be141bfc02b9ffe69d1845.176593939… Signed-off-by: Dmitry Torokhov <dmitry.torokhov(a)gmail.com> Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- drivers/input/mouse/alps.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c index e2c11d9f3868..4952fca027d9 100644 --- a/drivers/input/mouse/alps.c +++ b/drivers/input/mouse/alps.c @@ -2971,6 +2971,7 @@ static void alps_disconnect(struct psmouse *psmouse) psmouse_reset(psmouse); timer_shutdown_sync(&priv->timer); + disable_delayed_work_sync(&priv->dev3_register_work); if (priv->dev2) input_unregister_device(priv->dev2); if (!IS_ERR_OR_NULL(priv->dev3)) -- 2.34.1

2 1

[PATCH OLK-5.10 0/1] CVE-2023-53712
by Liu Mingrui 06 Feb '26

06 Feb '26

From: Mingrui Liu <liumingrui(a)huawei.com> CVE-2023-53712 Mårten Lindahl (1): ARM: 9317/1: kexec: Make smp stop calls asynchronous arch/arm/kernel/machine_kexec.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH v2 OLK-6.6 0/3] Fix CVE-2025-22090
by Ze Zuo 06 Feb '26

06 Feb '26

Fix CVE-2025-22090. change since v1: - add fix patch for first patch. David Hildenbrand (3): x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() mm: (un)track_pfn_copy() fix + doc improvements kernel/fork: only call untrack_pfn_clear() on VMAs duplicated for fork() arch/x86/mm/pat/memtype.c | 52 +++++++++++++++++++++------------------ include/linux/pgtable.h | 31 ++++++++++++++++++----- kernel/fork.c | 5 ++++ mm/memory.c | 11 +++------ 4 files changed, 62 insertions(+), 37 deletions(-) -- 2.25.1

2 4

[PATCH openEuler-1.0-LTS] media: av7110: prevent underflow in write_ts_to_decoder()
by Lin Ruifeng 06 Feb '26

06 Feb '26

From: Dan Carpenter <error27(a)gmail.com> stable inclusion from stable-v4.19.283 commit 6606e2404ee9e20a3ae5b42fc3660d41b739ed3e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13080 CVE: CVE-2023-54284 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit eed9496a0501357aa326ddd6b71408189ed872eb ] The buf[4] value comes from the user via ts_play(). It is a value in the u8 range. The final length we pass to av7110_ipack_instant_repack() is "len - (buf[4] + 1) - 4" so add a check to ensure that the length is not negative. It's not clear that passing a negative len value does anything bad necessarily, but it's not best practice. With the new bounds checking the "if (!len)" condition is no longer possible or required so remove that. Fixes: fd46d16d602a ("V4L/DVB (11759): dvb-ttpci: Add TS replay capability") Signed-off-by: Dan Carpenter <error27(a)gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/media/pci/ttpci/av7110_av.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/media/pci/ttpci/av7110_av.c b/drivers/media/pci/ttpci/av7110_av.c index ef1bc17cdc4d..03d1d1fba8bc 100644 --- a/drivers/media/pci/ttpci/av7110_av.c +++ b/drivers/media/pci/ttpci/av7110_av.c @@ -836,10 +836,10 @@ static int write_ts_to_decoder(struct av7110 *av7110, int type, const u8 *buf, s av7110_ipack_flush(ipack); if (buf[3] & ADAPT_FIELD) { + if (buf[4] > len - 1 - 4) + return 0; len -= buf[4] + 1; buf += buf[4] + 1; - if (!len) - return 0; } av7110_ipack_instant_repack(buf + 4, len - 4, ipack); -- 2.43.0

2 1

[PATCH OLK-5.10] firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle
by Zhang Qilong 06 Feb '26

06 Feb '26

From: Chen Zhongjin <chenzhongjin(a)huawei.com> stable inclusion from stable-v5.15.99 commit b4fe158259fb5fead52ff2b55841ec5c39492604 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/8734 CVE: CVE-2023-53250 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 18e126e97c961f7a93823795c879d7c085fe5098 ] KASAN reported a null-ptr-deref error: KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 0 PID: 1373 Comm: modprobe Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) RIP: 0010:dmi_sysfs_entry_release ... Call Trace: <TASK> kobject_put dmi_sysfs_register_handle (drivers/firmware/dmi-sysfs.c:540) dmi_sysfs dmi_decode_table (drivers/firmware/dmi_scan.c:133) dmi_walk (drivers/firmware/dmi_scan.c:1115) dmi_sysfs_init (drivers/firmware/dmi-sysfs.c:149) dmi_sysfs do_one_initcall (init/main.c:1296) ... Kernel panic - not syncing: Fatal exception Kernel Offset: 0x4000000 from 0xffffffff81000000 ---[ end Kernel panic - not syncing: Fatal exception ]--- It is because previous patch added kobject_put() to release the memory which will call dmi_sysfs_entry_release() and list_del(). However, list_add_tail(entry->list) is called after the error block, so the list_head is uninitialized and cannot be deleted. Move error handling to after list_add_tail to fix this. Fixes: 660ba678f999 ("firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle") Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> Link: https://lore.kernel.org/r/20221111015326.251650-2-chenzhongjin@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/firmware/dmi-sysfs.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/firmware/dmi-sysfs.c b/drivers/firmware/dmi-sysfs.c index 4a93fb490cb4..3d57b08320df 100644 --- a/drivers/firmware/dmi-sysfs.c +++ b/drivers/firmware/dmi-sysfs.c @@ -600,20 +600,20 @@ static void __init dmi_sysfs_register_handle(const struct dmi_header *dh, entry->kobj.kset = dmi_kset; *ret = kobject_init_and_add(&entry->kobj, &dmi_sysfs_entry_ktype, NULL, "%d-%d", dh->type, entry->instance); - if (*ret) { - kobject_put(&entry->kobj); - return; - } - /* Thread on the global list for cleanup */ spin_lock(&entry_list_lock); list_add_tail(&entry->list, &entry_list); spin_unlock(&entry_list_lock); + if (*ret) { + kobject_put(&entry->kobj); + return; + } + /* Handle specializations by type */ switch (dh->type) { case DMI_ENTRY_SYSTEM_EVENT_LOG: *ret = dmi_system_event_log(entry); break; -- 2.43.0

2 1

[PATCH OLK-5.10] mm/slub: avoid accessing metadata when pointer is invalid in object_err()
by Zhang Qilong 06 Feb '26

06 Feb '26

From: Li Qiong <liqiong(a)nfschina.com> stable inclusion from stable-v5.10.243 commit f66012909e7bf383fcdc5850709ed5716073fdc4 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/8393 CVE: CVE-2025-39902 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b4efccec8d06ceb10a7d34d7b1c449c569d53770 ] object_err() reports details of an object for further debugging, such as the freelist pointer, redzone, etc. However, if the pointer is invalid, attempting to access object metadata can lead to a crash since it does not point to a valid object. One known path to the crash is when alloc_consistency_checks() determines the pointer to the allocated object is invalid because of a freelist corruption, and calls object_err() to report it. The debug code should report and handle the corruption gracefully and not crash in the process. In case the pointer is NULL or check_valid_pointer() returns false for the pointer, only print the pointer value and skip accessing metadata. Fixes: 81819f0fc828 ("SLUB core") Cc: <stable(a)vger.kernel.org> Signed-off-by: Li Qiong <liqiong(a)nfschina.com> Reviewed-by: Harry Yoo <harry.yoo(a)oracle.com> Reviewed-by: Matthew Wilcox (Oracle) <willy(a)infradead.org> Signed-off-by: Vlastimil Babka <vbabka(a)suse.cz> [ struct page + print_page_info() ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- mm/slub.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/mm/slub.c b/mm/slub.c index bcc00a95c368..88024a7ebeb0 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -751,11 +751,16 @@ static void print_trailer(struct kmem_cache *s, struct page *page, u8 *p) void object_err(struct kmem_cache *s, struct page *page, u8 *object, char *reason) { slab_bug(s, "%s", reason); - print_trailer(s, page, object); + if (!object || !check_valid_pointer(s, page, object)) { + print_page_info(page); + pr_err("Invalid pointer 0x%p\n", object); + } else { + print_trailer(s, page, object); + } } static __printf(3, 4) void slab_err(struct kmem_cache *s, struct page *page, const char *fmt, ...) { -- 2.43.0

2 1

[PATCH OLK-5.10] scsi: qla4xxx: Prevent a potential error pointer dereference
by Zhang Qilong 06 Feb '26

06 Feb '26

From: Dan Carpenter <dan.carpenter(a)linaro.org> stable inclusion from stable-v5.10.241 commit ad8a9d38d30c691a77c456e72b78f7932d4f234d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/9005 CVE: CVE-2025-39676 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9dcf111dd3e7ed5fce82bb108e3a3fc001c07225 ] The qla4xxx_get_ep_fwdb() function is supposed to return NULL on error, but qla4xxx_ep_connect() returns error pointers. Propagating the error pointers will lead to an Oops in the caller, so change the error pointers to NULL. Fixes: 13483730a13b ("[SCSI] qla4xxx: fix flash/ddb support") Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Link: https://lore.kernel.org/r/aJwnVKS9tHsw1tEu@stanley.mountain Reviewed-by: Chris Leech <cleech(a)redhat.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- drivers/scsi/qla4xxx/ql4_os.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c index 15146e8be675..23bdd21ccc83 100644 --- a/drivers/scsi/qla4xxx/ql4_os.c +++ b/drivers/scsi/qla4xxx/ql4_os.c @@ -6614,10 +6614,12 @@ static struct iscsi_endpoint *qla4xxx_get_ep_fwdb(struct scsi_qla_host *ha, addr->sin_port = htons(le16_to_cpu(fw_ddb_entry->port)); } ep = qla4xxx_ep_connect(ha->host, (struct sockaddr *)dst_addr, 0); vfree(dst_addr); + if (IS_ERR(ep)) + return NULL; return ep; } static int qla4xxx_verify_boot_idx(struct scsi_qla_host *ha, uint16_t idx) { -- 2.43.0

2 1

[PATCH OLK-5.10] bpf: drop unnecessary user-triggerable WARN_ONCE in verifierl log
by Zhang Qilong 06 Feb '26

06 Feb '26

From: Andrii Nakryiko <andrii(a)kernel.org> stable inclusion from stable-v6.1.107 commit 40c88c429a598006f91ad7a2b89856cd50b3a008 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13001 CVE: CVE-2023-54145 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit cff36398bd4c7d322d424433db437f3c3391c491 ] It's trivial for user to trigger "verifier log line truncated" warning, as verifier has a fixed-sized buffer of 1024 bytes (as of now), and there are at least two pieces of user-provided information that can be output through this buffer, and both can be arbitrarily sized by user: - BTF names; - BTF.ext source code lines strings. Verifier log buffer should be properly sized for typical verifier state output. But it's sort-of expected that this buffer won't be long enough in some circumstances. So let's drop the check. In any case code will work correctly, at worst truncating a part of a single line output. Reported-by: syzbot+8b2a08dfbd25fd933d75(a)syzkaller.appspotmail.com Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Link: https://lore.kernel.org/r/20230516180409.3549088-1-andrii@kernel.org Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Conflicts: kernel/bpf/verifier.c kernel/bpf/log.c [Conflicts due to not merge 4294a0a7ab62 ("bpf: Split off basic BPF verifier log into separate file")] Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- kernel/bpf/verifier.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 13849004ae38..fe05d95569d8 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -273,13 +273,10 @@ void bpf_verifier_vlog(struct bpf_verifier_log *log, const char *fmt, { unsigned int n; n = vscnprintf(log->kbuf, BPF_VERIFIER_TMP_LOG_SIZE, fmt, args); - WARN_ONCE(n >= BPF_VERIFIER_TMP_LOG_SIZE - 1, - "verifier log line truncated - local buffer too short\n"); - n = min(log->len_total - log->len_used - 1, n); log->kbuf[n] = '\0'; if (log->level == BPF_LOG_KERNEL) { pr_err("BPF:%s\n", log->kbuf); -- 2.43.0

2 1

[PATCH OLK-6.6] mm/vmalloc: fix data race in show_numa_info()
by Zhang Qilong 06 Feb '26

06 Feb '26

From: Jeongjun Park <aha310510(a)gmail.com> mainline inclusion from mainline-v6.16-rc1 commit 5c5f0468d172ddec2e333d738d2a1f85402cf0bc category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/9408 CVE: CVE-2025-38383 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The following data-race was found in show_numa_info(): ================================================================== BUG: KCSAN: data-race in vmalloc_info_show / vmalloc_info_show read to 0xffff88800971fe30 of 4 bytes by task 8289 on cpu 0: show_numa_info mm/vmalloc.c:4936 [inline] vmalloc_info_show+0x5a8/0x7e0 mm/vmalloc.c:5016 seq_read_iter+0x373/0xb40 fs/seq_file.c:230 proc_reg_read_iter+0x11e/0x170 fs/proc/inode.c:299 .... write to 0xffff88800971fe30 of 4 bytes by task 8287 on cpu 1: show_numa_info mm/vmalloc.c:4934 [inline] vmalloc_info_show+0x38f/0x7e0 mm/vmalloc.c:5016 seq_read_iter+0x373/0xb40 fs/seq_file.c:230 proc_reg_read_iter+0x11e/0x170 fs/proc/inode.c:299 .... value changed: 0x0000008f -> 0x00000000 ================================================================== According to this report,there is a read/write data-race because m->private is accessible to multiple CPUs. To fix this, instead of allocating the heap in proc_vmalloc_init() and passing the heap address to m->private, vmalloc_info_show() should allocate the heap. Link: https://lkml.kernel.org/r/20250508165620.15321-1-aha310510@gmail.com Fixes: 8e1d743f2c26 ("mm: vmalloc: support multiple nodes in vmallocinfo") Signed-off-by: Jeongjun Park <aha310510(a)gmail.com> Suggested-by: Eric Dumazet <edumazet(a)google.com> Suggested-by: Andrew Morton <akpm(a)linux-foundation.org> Reviewed-by: "Uladzislau Rezki (Sony)" <urezki(a)gmail.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: mm/vmalloc.c [conflicts due to merge 8e63c98d86f61 ("mm: vmalloc: support multiple nodes in vmallocinfo")] Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- mm/vmalloc.c | 63 +++++++++++++++++++++++++++++----------------------- 1 file changed, 35 insertions(+), 28 deletions(-) diff --git a/mm/vmalloc.c b/mm/vmalloc.c index 375b0782353f..1455393eec23 100644 --- a/mm/vmalloc.c +++ b/mm/vmalloc.c @@ -3094,11 +3094,11 @@ void __init vm_area_register_early(struct vm_struct *vm, size_t align) static void clear_vm_uninitialized_flag(struct vm_struct *vm) { /* * Before removing VM_UNINITIALIZED, * we should make sure that vm has proper values. - * Pair with smp_rmb() in show_numa_info(). + * Pair with smp_rmb() in vread_iter() and vmalloc_info_show(). */ smp_wmb(); vm->flags &= ~VM_UNINITIALIZED; } @@ -5049,32 +5049,33 @@ int remap_vmalloc_hugepage_range(struct vm_area_struct *vma, void *addr, } EXPORT_SYMBOL(remap_vmalloc_hugepage_range); #endif #ifdef CONFIG_PROC_FS -static void show_numa_info(struct seq_file *m, struct vm_struct *v) -{ - if (IS_ENABLED(CONFIG_NUMA)) { - unsigned int nr, *counters = m->private; - unsigned int step = 1U << vm_area_page_order(v); - if (!counters) - return; +/* + * Print number of pages allocated on each memory node. + * + * This function can only be called if CONFIG_NUMA is enabled + * and VM_UNINITIALIZED bit in v->flags is disabled. + */ +static void show_numa_info(struct seq_file *m, struct vm_struct *v, + unsigned int *counters) +{ + unsigned int nr; + unsigned int step = 1U << vm_area_page_order(v); - if (v->flags & VM_UNINITIALIZED) - return; - /* Pair with smp_wmb() in clear_vm_uninitialized_flag() */ - smp_rmb(); + if (!counters) + return; - memset(counters, 0, nr_node_ids * sizeof(unsigned int)); + memset(counters, 0, nr_node_ids * sizeof(unsigned int)); - for (nr = 0; nr < v->nr_pages; nr += step) - counters[page_to_nid(v->pages[nr])] += step; - for_each_node_state(nr, N_HIGH_MEMORY) - if (counters[nr]) - seq_printf(m, " N%u=%u", nr, counters[nr]); - } + for (nr = 0; nr < v->nr_pages; nr += step) + counters[page_to_nid(v->pages[nr])] += step; + for_each_node_state(nr, N_HIGH_MEMORY) + if (counters[nr]) + seq_printf(m, " N%u=%u", nr, counters[nr]); } static void show_purge_info(struct seq_file *m) { struct vmap_node *vn; @@ -5098,10 +5099,14 @@ static int vmalloc_info_show(struct seq_file *m, void *p) { struct vmap_node *vn; struct vmap_area *va; struct vm_struct *v; int i; + unsigned int *counters; + + if (IS_ENABLED(CONFIG_NUMA)) + counters = kmalloc(nr_node_ids * sizeof(unsigned int), GFP_KERNEL); for (i = 0; i < nr_vmap_nodes; i++) { vn = &vmap_nodes[i]; spin_lock(&vn->busy.lock); @@ -5114,10 +5119,15 @@ static int vmalloc_info_show(struct seq_file *m, void *p) continue; } v = va->vm; + if (v->flags & VM_UNINITIALIZED) + continue; + + /* Pair with smp_wmb() in clear_vm_uninitialized_flag() */ + smp_rmb(); seq_printf(m, "0x%pK-0x%pK %7ld", v->addr, v->addr + v->size, v->size); if (v->caller) @@ -5148,33 +5158,30 @@ static int vmalloc_info_show(struct seq_file *m, void *p) seq_puts(m, " dma-coherent"); if (is_vmalloc_addr(v->pages)) seq_puts(m, " vpages"); - show_numa_info(m, v); + if (IS_ENABLED(CONFIG_NUMA)) + show_numa_info(m, v, counters); + seq_putc(m, '\n'); } spin_unlock(&vn->busy.lock); } /* * As a final step, dump "unpurged" areas. */ show_purge_info(m); + if (IS_ENABLED(CONFIG_NUMA)) + kfree(counters); return 0; } static int __init proc_vmalloc_init(void) { - void *priv_data = NULL; - - if (IS_ENABLED(CONFIG_NUMA)) - priv_data = kmalloc(nr_node_ids * sizeof(unsigned int), GFP_KERNEL); - - proc_create_single_data("vmallocinfo", - 0400, NULL, vmalloc_info_show, priv_data); - + proc_create_single("vmallocinfo", 0400, NULL, vmalloc_info_show); return 0; } module_init(proc_vmalloc_init); #endif -- 2.43.0

2 1

[PATCH OLK-6.6] scsi: qla4xxx: Prevent a potential error pointer dereference
by Zhang Qilong 06 Feb '26

06 Feb '26

From: Dan Carpenter <dan.carpenter(a)linaro.org> stable inclusion from stable-v6.6.103 commit f5ad0819f902b4b33591791b92a0350fb3692a6b category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/9005 CVE: CVE-2025-39676 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9dcf111dd3e7ed5fce82bb108e3a3fc001c07225 ] The qla4xxx_get_ep_fwdb() function is supposed to return NULL on error, but qla4xxx_ep_connect() returns error pointers. Propagating the error pointers will lead to an Oops in the caller, so change the error pointers to NULL. Fixes: 13483730a13b ("[SCSI] qla4xxx: fix flash/ddb support") Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Link: https://lore.kernel.org/r/aJwnVKS9tHsw1tEu@stanley.mountain Reviewed-by: Chris Leech <cleech(a)redhat.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- drivers/scsi/qla4xxx/ql4_os.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c index 675332e49a7b..4cbeeaab63d7 100644 --- a/drivers/scsi/qla4xxx/ql4_os.c +++ b/drivers/scsi/qla4xxx/ql4_os.c @@ -6602,10 +6602,12 @@ static struct iscsi_endpoint *qla4xxx_get_ep_fwdb(struct scsi_qla_host *ha, addr->sin_port = htons(le16_to_cpu(fw_ddb_entry->port)); } ep = qla4xxx_ep_connect(ha->host, (struct sockaddr *)dst_addr, 0); vfree(dst_addr); + if (IS_ERR(ep)) + return NULL; return ep; } static int qla4xxx_verify_boot_idx(struct scsi_qla_host *ha, uint16_t idx) { -- 2.43.0

2 1

[PATCH OLK-6.6] mm/slub: avoid accessing metadata when pointer is invalid in object_err()
by Zhang Qilong 06 Feb '26

06 Feb '26

From: Li Qiong <liqiong(a)nfschina.com> stable inclusion from stable-v6.6.105 commit 0ef7058b4dc6fcef622ac23b45225db57f17b83f category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/8393 CVE: CVE-2025-39902 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b4efccec8d06ceb10a7d34d7b1c449c569d53770 ] object_err() reports details of an object for further debugging, such as the freelist pointer, redzone, etc. However, if the pointer is invalid, attempting to access object metadata can lead to a crash since it does not point to a valid object. One known path to the crash is when alloc_consistency_checks() determines the pointer to the allocated object is invalid because of a freelist corruption, and calls object_err() to report it. The debug code should report and handle the corruption gracefully and not crash in the process. In case the pointer is NULL or check_valid_pointer() returns false for the pointer, only print the pointer value and skip accessing metadata. Fixes: 81819f0fc828 ("SLUB core") Cc: <stable(a)vger.kernel.org> Signed-off-by: Li Qiong <liqiong(a)nfschina.com> Reviewed-by: Harry Yoo <harry.yoo(a)oracle.com> Reviewed-by: Matthew Wilcox (Oracle) <willy(a)infradead.org> Signed-off-by: Vlastimil Babka <vbabka(a)suse.cz> [ Adjust context ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- mm/slub.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/mm/slub.c b/mm/slub.c index 25516a5cbf04..fc1636d1be03 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -1001,11 +1001,16 @@ static void object_err(struct kmem_cache *s, struct slab *slab, { if (slab_add_kunit_errors()) return; slab_bug(s, "%s", reason); - print_trailer(s, slab, object); + if (!object || !check_valid_pointer(s, slab, object)) { + print_slab_info(slab); + pr_err("Invalid pointer 0x%p\n", object); + } else { + print_trailer(s, slab, object); + } add_taint(TAINT_BAD_PAGE, LOCKDEP_NOW_UNRELIABLE); } static bool freelist_corrupted(struct kmem_cache *s, struct slab *slab, void **freelist, void *nextfree) -- 2.43.0

2 1

[PATCH OLK-6.6 0/4] fix cve-2025-40300
by Bowen You 06 Feb '26

06 Feb '26

*** BLURB HERE *** Bowen You (1): config: enable CONFIG_MITIGATION_VMESCAPE by default on x86 Pawan Gupta (3): x86/vmscape: Add conditional IBPB mitigation x86/vmscape: Enumerate VMSCAPE bug x86/vmscape: Enable the mitigation .../ABI/testing/sysfs-devices-system-cpu | 1 + .../admin-guide/kernel-parameters.txt | 11 +++ arch/x86/Kconfig | 9 ++ arch/x86/configs/openeuler_defconfig | 1 + arch/x86/include/asm/cpufeatures.h | 2 + arch/x86/include/asm/entry-common.h | 7 ++ arch/x86/include/asm/nospec-branch.h | 2 + arch/x86/kernel/cpu/bugs.c | 85 +++++++++++++++++++ arch/x86/kernel/cpu/common.c | 58 +++++++++---- arch/x86/kvm/x86.c | 9 ++ drivers/base/cpu.c | 3 + include/linux/cpu.h | 1 + 12 files changed, 171 insertions(+), 18 deletions(-) -- 2.34.1

2 5

[PATCH OLK-6.6] drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb
by Zhang Qilong 06 Feb '26

06 Feb '26

From: Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer(a)amd.com> stable inclusion from stable-v6.6.117 commit 70150b9443dddf02157d821c68abf438f55a2e8e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/11434 CVE: CVE-2025-40329 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 487df8b698345dd5a91346335f05170ed5f29d4e upstream. The Mesa issue referenced below pointed out a possible deadlock: [ 1231.611031] Possible interrupt unsafe locking scenario: [ 1231.611033] CPU0 CPU1 [ 1231.611034] ---- ---- [ 1231.611035] lock(&xa->xa_lock#17); [ 1231.611038] local_irq_disable(); [ 1231.611039] lock(&fence->lock); [ 1231.611041] lock(&xa->xa_lock#17); [ 1231.611044] <Interrupt> [ 1231.611045] lock(&fence->lock); [ 1231.611047] *** DEADLOCK *** In this example, CPU0 would be any function accessing job->dependencies through the xa_* functions that don't disable interrupts (eg: drm_sched_job_add_dependency(), drm_sched_entity_kill_jobs_cb()). CPU1 is executing drm_sched_entity_kill_jobs_cb() as a fence signalling callback so in an interrupt context. It will deadlock when trying to grab the xa_lock which is already held by CPU0. Replacing all xa_* usage by their xa_*_irq counterparts would fix this issue, but Christian pointed out another issue: dma_fence_signal takes fence.lock and so does dma_fence_add_callback. dma_fence_signal() // locks f1.lock -> drm_sched_entity_kill_jobs_cb() -> foreach dependencies -> dma_fence_add_callback() // locks f2.lock This will deadlock if f1 and f2 share the same spinlock. To fix both issues, the code iterating on dependencies and re-arming them is moved out to drm_sched_entity_kill_jobs_work(). Cc: stable(a)vger.kernel.org # v6.2+ Fixes: 2fdb8a8f07c2 ("drm/scheduler: rework entity flush, kill and fini") Link: https://gitlab.freedesktop.org/mesa/mesa/-/issues/13908 Reported-by: Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> Suggested-by: Christian König <christian.koenig(a)amd.com> Reviewed-by: Christian König <christian.koenig(a)amd.com> Signed-off-by: Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer(a)amd.com> [phasta: commit message nits] Signed-off-by: Philipp Stanner <phasta(a)kernel.org> Link: https://patch.msgid.link/20251104095358.15092-1-pierre-eric.pelloux-prayer@… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- drivers/gpu/drm/scheduler/sched_entity.c | 34 +++++++++++++----------- 1 file changed, 19 insertions(+), 15 deletions(-) diff --git a/drivers/gpu/drm/scheduler/sched_entity.c b/drivers/gpu/drm/scheduler/sched_entity.c index eed3b8bed9e4..01de4f072b68 100644 --- a/drivers/gpu/drm/scheduler/sched_entity.c +++ b/drivers/gpu/drm/scheduler/sched_entity.c @@ -161,30 +161,19 @@ int drm_sched_entity_error(struct drm_sched_entity *entity) return r; } EXPORT_SYMBOL(drm_sched_entity_error); +static void drm_sched_entity_kill_jobs_cb(struct dma_fence *f, + struct dma_fence_cb *cb); + static void drm_sched_entity_kill_jobs_work(struct work_struct *wrk) { struct drm_sched_job *job = container_of(wrk, typeof(*job), work); - - drm_sched_fence_scheduled(job->s_fence, NULL); - drm_sched_fence_finished(job->s_fence, -ESRCH); - WARN_ON(job->s_fence->parent); - job->sched->ops->free_job(job); -} - -/* Signal the scheduler finished fence when the entity in question is killed. */ -static void drm_sched_entity_kill_jobs_cb(struct dma_fence *f, - struct dma_fence_cb *cb) -{ - struct drm_sched_job *job = container_of(cb, struct drm_sched_job, - finish_cb); + struct dma_fence *f; unsigned long index; - dma_fence_put(f); - /* Wait for all dependencies to avoid data corruptions */ xa_for_each(&job->dependencies, index, f) { struct drm_sched_fence *s_fence = to_drm_sched_fence(f); if (s_fence && f == &s_fence->scheduled) { @@ -208,10 +197,25 @@ static void drm_sched_entity_kill_jobs_cb(struct dma_fence *f, return; dma_fence_put(f); } + drm_sched_fence_scheduled(job->s_fence, NULL); + drm_sched_fence_finished(job->s_fence, -ESRCH); + WARN_ON(job->s_fence->parent); + job->sched->ops->free_job(job); +} + +/* Signal the scheduler finished fence when the entity in question is killed. */ +static void drm_sched_entity_kill_jobs_cb(struct dma_fence *f, + struct dma_fence_cb *cb) +{ + struct drm_sched_job *job = container_of(cb, struct drm_sched_job, + finish_cb); + + dma_fence_put(f); + INIT_WORK(&job->work, drm_sched_entity_kill_jobs_work); schedule_work(&job->work); } /* Remove the entity from the scheduler and kill all pending jobs */ -- 2.43.0

2 1

[PATCH OLK-6.6] parse_longname(): strrchr() expects NUL-terminated string
by Quanmin Yan 06 Feb '26

06 Feb '26

From: Al Viro <viro(a)zeniv.linux.org.uk> stable inclusion from stable-v6.12.42 commit bb80f7618832d26f7e395f52f82b1dac76223e5f category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/9111 CVE: CVE-2025-38660 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------ [ Upstream commit 101841c38346f4ca41dc1802c867da990ffb32eb ] ... and parse_longname() is not guaranteed that. That's the reason why it uses kmemdup_nul() to build the argument for kstrtou64(); the problem is, kstrtou64() is not the only thing that need it. Just get a NUL-terminated copy of the entire thing and be done with that... Fixes: dd66df0053ef ("ceph: add support for encrypted snapshot names") Tested-by: Viacheslav Dubeyko <Slava.Dubeyko(a)ibm.com> Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko(a)ibm.com> Signed-off-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Quanmin Yan <yanquanmin1(a)huawei.com> --- fs/ceph/crypto.c | 31 ++++++++++++------------------- 1 file changed, 12 insertions(+), 19 deletions(-) diff --git a/fs/ceph/crypto.c b/fs/ceph/crypto.c index 08c385610731..fa2aaf1d30f8 100644 --- a/fs/ceph/crypto.c +++ b/fs/ceph/crypto.c @@ -213,35 +213,31 @@ static struct inode *parse_longname(const struct inode *parent, { struct inode *dir = NULL; struct ceph_vino vino = { .snap = CEPH_NOSNAP }; - char *inode_number; - char *name_end; - int orig_len = *name_len; + char *name_end, *inode_number; int ret = -EIO; - + /* NUL-terminate */ + char *str __free(kfree) = kmemdup_nul(name, *name_len, GFP_KERNEL); + if (!str) + return ERR_PTR(-ENOMEM); /* Skip initial '_' */ - name++; - name_end = strrchr(name, '_'); + str++; + name_end = strrchr(str, '_'); if (!name_end) { - dout("Failed to parse long snapshot name: %s\n", name); + dout("Failed to parse long snapshot name: %s\n", str); return ERR_PTR(-EIO); } - *name_len = (name_end - name); + *name_len = (name_end - str); if (*name_len <= 0) { pr_err("Failed to parse long snapshot name\n"); return ERR_PTR(-EIO); } /* Get the inode number */ - inode_number = kmemdup_nul(name_end + 1, - orig_len - *name_len - 2, - GFP_KERNEL); - if (!inode_number) - return ERR_PTR(-ENOMEM); + inode_number = name_end + 1; ret = kstrtou64(inode_number, 10, &vino.ino); if (ret) { - dout("Failed to parse inode number: %s\n", name); - dir = ERR_PTR(ret); - goto out; + dout("Failed to parse inode number: %s\n", str); + return ERR_PTR(ret); } /* And finally the inode */ @@ -252,9 +248,6 @@ static struct inode *parse_longname(const struct inode *parent, if (IS_ERR(dir)) dout("Can't find inode %s (%s)\n", inode_number, name); } - -out: - kfree(inode_number); return dir; } -- 2.43.0

2 1

[PATCH OLK-6.6] media: imon: make send_packet() more robust
by Quanmin Yan 06 Feb '26

06 Feb '26

From: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> stable inclusion from stable-v6.6.117 commit 8231e80118463be5598daaf266c1c83650f1948b category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/11614 CVE: CVE-2025-68194 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit eecd203ada43a4693ce6fdd3a58ae10c7819252c ] syzbot is reporting that imon has three problems which result in hung tasks due to forever holding device lock [1]. First problem is that when usb_rx_callback_intf0() once got -EPROTO error after ictx->dev_present_intf0 became true, usb_rx_callback_intf0() resubmits urb after printk(), and resubmitted urb causes usb_rx_callback_intf0() to again get -EPROTO error. This results in printk() flooding (RCU stalls). Alan Stern commented [2] that In theory it's okay to resubmit _if_ the driver has a robust error-recovery scheme (such as giving up after some fixed limit on the number of errors or after some fixed time has elapsed, perhaps with a time delay to prevent a flood of errors). Most drivers don't bother to do this; they simply give up right away. This makes them more vulnerable to short-term noise interference during USB transfers, but in reality such interference is quite rare. There's nothing really wrong with giving up right away. but imon has a poor error-recovery scheme which just retries forever; this behavior should be fixed. Since I'm not sure whether it is safe for imon users to give up upon any error code, this patch takes care of only union of error codes chosen from modules in drivers/media/rc/ directory which handle -EPROTO error (i.e. ir_toy, mceusb and igorplugusb). Second problem is that when usb_rx_callback_intf0() once got -EPROTO error before ictx->dev_present_intf0 becomes true, usb_rx_callback_intf0() always resubmits urb due to commit 8791d63af0cf ("[media] imon: don't wedge hardware after early callbacks"). Move the ictx->dev_present_intf0 test introduced by commit 6f6b90c9231a ("[media] imon: don't parse scancodes until intf configured") to immediately before imon_incoming_packet(), or the first problem explained above happens without printk() flooding (i.e. hung task). Third problem is that when usb_rx_callback_intf0() is not called for some reason (e.g. flaky hardware; the reproducer for this problem sometimes prevents usb_rx_callback_intf0() from being called), wait_for_completion_interruptible() in send_packet() never returns (i.e. hung task). As a workaround for such situation, change send_packet() to wait for completion with timeout of 10 seconds. Link: https://syzkaller.appspot.com/bug?extid=592e2ab8775dbe0bf09a [1] Link: https://lkml.kernel.org/r/d6da6709-d799-4be3-a695-850bddd6eb24@rowland.harv… [2] Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Signed-off-by: Sean Young <sean(a)mess.org> Signed-off-by: Hans Verkuil <hverkuil+cisco(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Quanmin Yan <yanquanmin1(a)huawei.com> --- drivers/media/rc/imon.c | 61 +++++++++++++++++++++++++---------------- 1 file changed, 37 insertions(+), 24 deletions(-) diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c index f4deca8894e0..bb4aabb08c06 100644 --- a/drivers/media/rc/imon.c +++ b/drivers/media/rc/imon.c @@ -650,12 +650,15 @@ static int send_packet(struct imon_context *ictx) smp_rmb(); /* ensure later readers know we're not busy */ pr_err_ratelimited("error submitting urb(%d)\n", retval); } else { - /* Wait for transmission to complete (or abort) */ - retval = wait_for_completion_interruptible( - &ictx->tx.finished); - if (retval) { + /* Wait for transmission to complete (or abort or timeout) */ + retval = wait_for_completion_interruptible_timeout(&ictx->tx.finished, 10 * HZ); + if (retval <= 0) { usb_kill_urb(ictx->tx_urb); pr_err_ratelimited("task interrupted\n"); + if (retval < 0) + ictx->tx.status = retval; + else + ictx->tx.status = -ETIMEDOUT; } ictx->tx.busy = false; @@ -1754,14 +1757,6 @@ static void usb_rx_callback_intf0(struct urb *urb) if (!ictx) return; - /* - * if we get a callback before we're done configuring the hardware, we - * can't yet process the data, as there's nowhere to send it, but we - * still need to submit a new rx URB to avoid wedging the hardware - */ - if (!ictx->dev_present_intf0) - goto out; - switch (urb->status) { case -ENOENT: /* usbcore unlink successful! */ return; @@ -1770,16 +1765,29 @@ static void usb_rx_callback_intf0(struct urb *urb) break; case 0: - imon_incoming_packet(ictx, urb, intfnum); + /* + * if we get a callback before we're done configuring the hardware, we + * can't yet process the data, as there's nowhere to send it, but we + * still need to submit a new rx URB to avoid wedging the hardware + */ + if (ictx->dev_present_intf0) + imon_incoming_packet(ictx, urb, intfnum); break; + case -ECONNRESET: + case -EILSEQ: + case -EPROTO: + case -EPIPE: + dev_warn(ictx->dev, "imon %s: status(%d)\n", + __func__, urb->status); + return; + default: dev_warn(ictx->dev, "imon %s: status(%d): ignored\n", __func__, urb->status); break; } -out: usb_submit_urb(ictx->rx_urb_intf0, GFP_ATOMIC); } @@ -1795,14 +1803,6 @@ static void usb_rx_callback_intf1(struct urb *urb) if (!ictx) return; - /* - * if we get a callback before we're done configuring the hardware, we - * can't yet process the data, as there's nowhere to send it, but we - * still need to submit a new rx URB to avoid wedging the hardware - */ - if (!ictx->dev_present_intf1) - goto out; - switch (urb->status) { case -ENOENT: /* usbcore unlink successful! */ return; @@ -1811,16 +1811,29 @@ static void usb_rx_callback_intf1(struct urb *urb) break; case 0: - imon_incoming_packet(ictx, urb, intfnum); + /* + * if we get a callback before we're done configuring the hardware, we + * can't yet process the data, as there's nowhere to send it, but we + * still need to submit a new rx URB to avoid wedging the hardware + */ + if (ictx->dev_present_intf1) + imon_incoming_packet(ictx, urb, intfnum); break; + case -ECONNRESET: + case -EILSEQ: + case -EPROTO: + case -EPIPE: + dev_warn(ictx->dev, "imon %s: status(%d)\n", + __func__, urb->status); + return; + default: dev_warn(ictx->dev, "imon %s: status(%d): ignored\n", __func__, urb->status); break; } -out: usb_submit_urb(ictx->rx_urb_intf1, GFP_ATOMIC); } -- 2.43.0

2 1

[PATCH OLK-6.6] ksm: use range-walk function to jump over holes in scan_get_next_rmap_item
by Quanmin Yan 06 Feb '26

06 Feb '26

From: Pedro Demarchi Gomes <pedrodemargomes(a)gmail.com> stable inclusion from stable-v6.6.121 commit 9c2f8a9b68024e5ebb4813665845ec0a95f2eac3 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/11569 CVE: CVE-2025-68211 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f5548c318d6520d4fa3c5ed6003eeb710763cbc5 upstream. Currently, scan_get_next_rmap_item() walks every page address in a VMA to locate mergeable pages. This becomes highly inefficient when scanning large virtual memory areas that contain mostly unmapped regions, causing ksmd to use large amount of cpu without deduplicating much pages. This patch replaces the per-address lookup with a range walk using walk_page_range(). The range walker allows KSM to skip over entire unmapped holes in a VMA, avoiding unnecessary lookups. This problem was previously discussed in [1]. Consider the following test program which creates a 32 TiB mapping in the virtual address space but only populates a single page: /* 32 TiB */ const size_t size = 32ul * 1024 * 1024 * 1024 * 1024; int main() { char *area = mmap(NULL, size, PROT_READ | PROT_WRITE, MAP_NORESERVE | MAP_PRIVATE | MAP_ANON, -1, 0); if (area == MAP_FAILED) { perror("mmap() failed\n"); return -1; } /* Populate a single page such that we get an anon_vma. */ *area = 0; /* Enable KSM. */ madvise(area, size, MADV_MERGEABLE); pause(); return 0; } $ ./ksm-sparse & $ echo 1 > /sys/kernel/mm/ksm/run Without this patch ksmd uses 100% of the cpu for a long time (more then 1 hour in my test machine) scanning all the 32 TiB virtual address space that contain only one mapped page. This makes ksmd essentially deadlocked not able to deduplicate anything of value. With this patch ksmd walks only the one mapped page and skips the rest of the 32 TiB virtual address space, making the scan fast using little cpu. Link: https://lkml.kernel.org/r/20251023035841.41406-1-pedrodemargomes@gmail.com Link: https://lkml.kernel.org/r/20251022153059.22763-1-pedrodemargomes@gmail.com Link: https://lore.kernel.org/linux-mm/423de7a3-1c62-4e72-8e79-19a6413e420c@redha… [1] Fixes: 31dbd01f3143 ("ksm: Kernel SamePage Merging") Signed-off-by: Pedro Demarchi Gomes <pedrodemargomes(a)gmail.com> Co-developed-by: David Hildenbrand <david(a)redhat.com> Signed-off-by: David Hildenbrand <david(a)redhat.com> Reported-by: craftfever <craftfever(a)airmail.cc> Closes: https://lkml.kernel.org/r/020cf8de6e773bb78ba7614ef250129f11a63781@murena.io Suggested-by: David Hildenbrand <david(a)redhat.com> Acked-by: David Hildenbrand <david(a)redhat.com> Cc: Chengming Zhou <chengming.zhou(a)linux.dev> Cc: xu xin <xu.xin16(a)zte.com.cn> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> [ change page to folios ] Signed-off-by: Pedro Demarchi Gomes <pedrodemargomes(a)gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Quanmin Yan <yanquanmin1(a)huawei.com> --- mm/ksm.c | 126 +++++++++++++++++++++++++++++++++++++++++++++++++------ 1 file changed, 113 insertions(+), 13 deletions(-) diff --git a/mm/ksm.c b/mm/ksm.c index eca4c3078383..0cf19d0647b4 100644 --- a/mm/ksm.c +++ b/mm/ksm.c @@ -2310,6 +2310,95 @@ static struct ksm_rmap_item *get_next_rmap_item(struct ksm_mm_slot *mm_slot, return rmap_item; } +struct ksm_next_page_arg { + struct folio *folio; + struct page *page; + unsigned long addr; +}; + +static int ksm_next_page_pmd_entry(pmd_t *pmdp, unsigned long addr, unsigned long end, + struct mm_walk *walk) +{ + struct ksm_next_page_arg *private = walk->private; + struct vm_area_struct *vma = walk->vma; + pte_t *start_ptep = NULL, *ptep, pte; + struct mm_struct *mm = walk->mm; + struct folio *folio; + struct page *page; + spinlock_t *ptl; + pmd_t pmd; + + if (ksm_test_exit(mm)) + return 0; + + cond_resched(); + + pmd = pmdp_get_lockless(pmdp); + if (!pmd_present(pmd)) + return 0; + + if (IS_ENABLED(CONFIG_TRANSPARENT_HUGEPAGE) && pmd_leaf(pmd)) { + ptl = pmd_lock(mm, pmdp); + pmd = pmdp_get(pmdp); + + if (!pmd_present(pmd)) { + goto not_found_unlock; + } else if (pmd_leaf(pmd)) { + page = vm_normal_page_pmd(vma, addr, pmd); + if (!page) + goto not_found_unlock; + folio = page_folio(page); + + if (folio_is_zone_device(folio) || !folio_test_anon(folio)) + goto not_found_unlock; + + page += ((addr & (PMD_SIZE - 1)) >> PAGE_SHIFT); + goto found_unlock; + } + spin_unlock(ptl); + } + + start_ptep = pte_offset_map_lock(mm, pmdp, addr, &ptl); + if (!start_ptep) + return 0; + + for (ptep = start_ptep; addr < end; ptep++, addr += PAGE_SIZE) { + pte = ptep_get(ptep); + + if (!pte_present(pte)) + continue; + + page = vm_normal_page(vma, addr, pte); + if (!page) + continue; + folio = page_folio(page); + + if (folio_is_zone_device(folio) || !folio_test_anon(folio)) + continue; + goto found_unlock; + } + +not_found_unlock: + spin_unlock(ptl); + if (start_ptep) + pte_unmap(start_ptep); + return 0; +found_unlock: + folio_get(folio); + spin_unlock(ptl); + if (start_ptep) + pte_unmap(start_ptep); + private->page = page; + private->folio = folio; + private->addr = addr; + return 1; +} + +static struct mm_walk_ops ksm_next_page_ops = { + .pmd_entry = ksm_next_page_pmd_entry, + .walk_lock = PGWALK_RDLOCK, +}; + static struct ksm_rmap_item *scan_get_next_rmap_item(struct page **page) { struct mm_struct *mm; @@ -2396,32 +2485,43 @@ static struct ksm_rmap_item *scan_get_next_rmap_item(struct page **page) ksm_scan.address = vma->vm_end; while (ksm_scan.address < vma->vm_end) { + struct ksm_next_page_arg ksm_next_page_arg; + struct page *tmp_page = NULL; + struct folio *folio; + if (ksm_test_exit(mm)) break; - *page = follow_page(vma, ksm_scan.address, FOLL_GET); - if (IS_ERR_OR_NULL(*page)) { - ksm_scan.address += PAGE_SIZE; - cond_resched(); - continue; + + int found; + + found = walk_page_range_vma(vma, ksm_scan.address, + vma->vm_end, + &ksm_next_page_ops, + &ksm_next_page_arg); + + if (found > 0) { + folio = ksm_next_page_arg.folio; + tmp_page = ksm_next_page_arg.page; + ksm_scan.address = ksm_next_page_arg.addr; + } else { + VM_WARN_ON_ONCE(found < 0); + ksm_scan.address = vma->vm_end - PAGE_SIZE; } - if (is_zone_device_page(*page)) - goto next_page; - if (PageAnon(*page)) { - flush_anon_page(vma, *page, ksm_scan.address); - flush_dcache_page(*page); + if (tmp_page) { + flush_anon_page(vma, tmp_page, ksm_scan.address); + flush_dcache_page(tmp_page); rmap_item = get_next_rmap_item(mm_slot, ksm_scan.rmap_list, ksm_scan.address); if (rmap_item) { ksm_scan.rmap_list = &rmap_item->rmap_list; ksm_scan.address += PAGE_SIZE; + *page = tmp_page; } else - put_page(*page); + folio_put(folio); mmap_read_unlock(mm); return rmap_item; } -next_page: - put_page(*page); ksm_scan.address += PAGE_SIZE; cond_resched(); } -- 2.43.0

2 1

[PATCH OLK-6.6] fbcon: Set fb_display[i]->mode to NULL when the mode is released
by Quanmin Yan 06 Feb '26

06 Feb '26

stable inclusion from stable-v6.6.117 commit 468f78276a37f4c6499385a4ce28f4f57be6655d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/11306 CVE: CVE-2025-40323 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit a1f3058930745d2b938b6b4f5bd9630dc74b26b7 upstream. Recently, we discovered the following issue through syzkaller: BUG: KASAN: slab-use-after-free in fb_mode_is_equal+0x285/0x2f0 Read of size 4 at addr ff11000001b3c69c by task syz.xxx ... Call Trace: <TASK> dump_stack_lvl+0xab/0xe0 print_address_description.constprop.0+0x2c/0x390 print_report+0xb9/0x280 kasan_report+0xb8/0xf0 fb_mode_is_equal+0x285/0x2f0 fbcon_mode_deleted+0x129/0x180 fb_set_var+0xe7f/0x11d0 do_fb_ioctl+0x6a0/0x750 fb_ioctl+0xe0/0x140 __x64_sys_ioctl+0x193/0x210 do_syscall_64+0x5f/0x9c0 entry_SYSCALL_64_after_hwframe+0x76/0x7e Based on experimentation and analysis, during framebuffer unregistration, only the memory of fb_info->modelist is freed, without setting the corresponding fb_display[i]->mode to NULL for the freed modes. This leads to UAF issues during subsequent accesses. Here's an example of reproduction steps: 1. With /dev/fb0 already registered in the system, load a kernel module to register a new device /dev/fb1; 2. Set fb1's mode to the global fb_display[] array (via FBIOPUT_CON2FBMAP); 3. Switch console from fb to VGA (to allow normal rmmod of the ko); 4. Unload the kernel module, at this point fb1's modelist is freed, leaving a wild pointer in fb_display[]; 5. Trigger the bug via system calls through fb0 attempting to delete a mode from fb0. Add a check in do_unregister_framebuffer(): if the mode to be freed exists in fb_display[], set the corresponding mode pointer to NULL. Signed-off-by: Quanmin Yan <yanquanmin1(a)huawei.com> Reviewed-by: Thomas Zimmermann <tzimmermann(a)suse.de> Signed-off-by: Helge Deller <deller(a)gmx.de> Cc: stable(a)vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/video/fbdev/core/fbcon.c | 19 +++++++++++++++++++ drivers/video/fbdev/core/fbmem.c | 1 + include/linux/fbcon.h | 2 ++ 3 files changed, 22 insertions(+) diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c index 9757276e8182..fc9df4accd47 100644 --- a/drivers/video/fbdev/core/fbcon.c +++ b/drivers/video/fbdev/core/fbcon.c @@ -2825,6 +2825,25 @@ int fbcon_mode_deleted(struct fb_info *info, return found; } +static void fbcon_delete_mode(struct fb_videomode *m) +{ + struct fbcon_display *p; + + for (int i = first_fb_vc; i <= last_fb_vc; i++) { + p = &fb_display[i]; + if (p->mode == m) + p->mode = NULL; + } +} + +void fbcon_delete_modelist(struct list_head *head) +{ + struct fb_modelist *modelist; + + list_for_each_entry(modelist, head, list) + fbcon_delete_mode(&modelist->mode); +} + #ifdef CONFIG_VT_HW_CONSOLE_BINDING static void fbcon_unbind(void) { diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c index 515a9ab711ec..aad127738272 100644 --- a/drivers/video/fbdev/core/fbmem.c +++ b/drivers/video/fbdev/core/fbmem.c @@ -1027,6 +1027,7 @@ static void do_unregister_framebuffer(struct fb_info *fb_info) fb_info->pixmap.addr = NULL; } + fbcon_delete_modelist(&fb_info->modelist); fb_destroy_modelist(&fb_info->modelist); registered_fb[fb_info->node] = NULL; num_registered_fb--; diff --git a/include/linux/fbcon.h b/include/linux/fbcon.h index 2382dec6d6ab..fb0fc2736b80 100644 --- a/include/linux/fbcon.h +++ b/include/linux/fbcon.h @@ -11,6 +11,7 @@ void fbcon_suspended(struct fb_info *info); void fbcon_resumed(struct fb_info *info); int fbcon_mode_deleted(struct fb_info *info, struct fb_videomode *mode); +void fbcon_delete_modelist(struct list_head *head); void fbcon_new_modelist(struct fb_info *info); void fbcon_get_requirement(struct fb_info *info, struct fb_blit_caps *caps); @@ -31,6 +32,7 @@ static inline void fbcon_suspended(struct fb_info *info) {} static inline void fbcon_resumed(struct fb_info *info) {} static inline int fbcon_mode_deleted(struct fb_info *info, struct fb_videomode *mode) { return 0; } +static inline void fbcon_delete_modelist(struct list_head *head) {} static inline void fbcon_new_modelist(struct fb_info *info) {} static inline void fbcon_get_requirement(struct fb_info *info, struct fb_blit_caps *caps) {} -- 2.43.0

2 1

[PATCH OLK-5.10 0/1] CVE-2025-39957
by Yongqiang Liu 06 Feb '26

06 Feb '26

Lachlan Hodges (1): wifi: mac80211: increase scan_ies_len for S1G net/mac80211/main.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) -- 2.43.0

2 2

[PATCH OLK-6.6] x86/CPU/AMD: Add RDSEED fix for Zen5
by Bowen You 06 Feb '26

06 Feb '26

From: Gregory Price <gourry(a)gourry.net> stable inclusion from stable-v6.12.57 commit e980de2ff109dacb6d9d3a77f01b27c467115ecb category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/11500 CVE: CVE-2025-68313 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 607b9fb2ce248cc5b633c5949e0153838992c152 upstream. There's an issue with RDSEED's 16-bit and 32-bit register output variants on Zen5 which return a random value of 0 "at a rate inconsistent with randomness while incorrectly signaling success (CF=1)". Search the web for AMD-SB-7055 for more detail. Add a fix glue which checks microcode revisions. [ bp: Add microcode revisions checking, rewrite. ] Cc: stable(a)vger.kernel.org Signed-off-by: Gregory Price <gourry(a)gourry.net> Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Link: https://lore.kernel.org/r/20251018024010.4112396-1-gourry@gourry.net [ bp: 6.12 backport: use the alternative microcode version checking. ] Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- arch/x86/kernel/cpu/amd.c | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c index d7a8f8bb9026..1c7e60b5a7cb 100644 --- a/arch/x86/kernel/cpu/amd.c +++ b/arch/x86/kernel/cpu/amd.c @@ -1128,8 +1128,43 @@ static void init_amd_zen4(struct cpuinfo_x86 *c) } } +static bool check_rdseed_microcode(void) +{ + struct cpuinfo_x86 *c = &boot_cpu_data; + union zen_patch_rev p; + u32 min_rev = 0; + + p.ext_fam = c->x86 - 0xf; + p.model = c->x86_model; + p.ext_model = c->x86_model >> 4; + p.stepping = c->x86_stepping; + /* reserved bits are expected to be 0 in test below */ + p.__reserved = 0; + + if (cpu_has(c, X86_FEATURE_ZEN5)) { + switch (p.ucode_rev >> 8) { + case 0xb0021: min_rev = 0xb00215a; break; + case 0xb1010: min_rev = 0xb101054; break; + default: + pr_debug("%s: ucode_rev: 0x%x, current revision: 0x%x\n", + __func__, p.ucode_rev, c->microcode); + return false; + } + } + + if (!min_rev) + return false; + + return c->microcode >= min_rev; +} + static void init_amd_zen5(struct cpuinfo_x86 *c) { + if (!check_rdseed_microcode()) { + clear_cpu_cap(c, X86_FEATURE_RDSEED); + msr_clear_bit(MSR_AMD64_CPUID_FN_7, 18); + pr_emerg_once("RDSEED32 is broken. Disabling the corresponding CPUID bit.\n"); + } } static void init_amd(struct cpuinfo_x86 *c) -- 2.34.1

2 1

[PATCH OLK-6.6] mtdchar: fix integer overflow in read/write ioctls
by Cui GaoSheng 06 Feb '26

06 Feb '26

From: Dan Carpenter <dan.carpenter(a)linaro.org> stable inclusion from stable-v6.6.118 commit 457376c6fbf0c69326a9bf1f72416225f681192b category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/11582 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e4185bed738da755b191aa3f2e16e8b48450e1b8 upstream. The "req.start" and "req.len" variables are u64 values that come from the user at the start of the function. We mask away the high 32 bits of "req.len" so that's capped at U32_MAX but the "req.start" variable can go up to U64_MAX which means that the addition can still integer overflow. Use check_add_overflow() to fix this bug. Fixes: 095bb6e44eb1 ("mtdchar: add MEMREAD ioctl") Fixes: 6420ac0af95d ("mtdchar: prevent unbounded allocation in MEMWRITE ioctl") Cc: stable(a)vger.kernel.org Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Signed-off-by: Miquel Raynal <miquel.raynal(a)bootlin.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Cui GaoSheng <cuigaosheng1(a)huawei.com> --- drivers/mtd/mtdchar.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c index 8dc4f5c493fc..335c702633ff 100644 --- a/drivers/mtd/mtdchar.c +++ b/drivers/mtd/mtdchar.c @@ -599,6 +599,7 @@ mtdchar_write_ioctl(struct mtd_info *mtd, struct mtd_write_req __user *argp) uint8_t *datbuf = NULL, *oobbuf = NULL; size_t datbuf_len, oobbuf_len; int ret = 0; + u64 end; if (copy_from_user(&req, argp, sizeof(req))) return -EFAULT; @@ -618,7 +619,7 @@ mtdchar_write_ioctl(struct mtd_info *mtd, struct mtd_write_req __user *argp) req.len &= 0xffffffff; req.ooblen &= 0xffffffff; - if (req.start + req.len > mtd->size) + if (check_add_overflow(req.start, req.len, &end) || end > mtd->size) return -EINVAL; datbuf_len = min_t(size_t, req.len, mtd->erasesize); @@ -698,6 +699,7 @@ mtdchar_read_ioctl(struct mtd_info *mtd, struct mtd_read_req __user *argp) size_t datbuf_len, oobbuf_len; size_t orig_len, orig_ooblen; int ret = 0; + u64 end; if (copy_from_user(&req, argp, sizeof(req))) return -EFAULT; @@ -724,7 +726,7 @@ mtdchar_read_ioctl(struct mtd_info *mtd, struct mtd_read_req __user *argp) req.len &= 0xffffffff; req.ooblen &= 0xffffffff; - if (req.start + req.len > mtd->size) { + if (check_add_overflow(req.start, req.len, &end) || end > mtd->size) { ret = -EINVAL; goto out; } -- 2.34.1

2 1

[PATCH OLK-6.6] iio: common: st_sensors: Fix use of uninitialize device structs
by Wang Hai 05 Feb '26

05 Feb '26

From: Maud Spierings <maudspierings(a)gocontroll.com> mainline inclusion from mainline-v6.16-rc7 commit 9f92e93e257b33e73622640a9205f8642ec16ddd category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/9273 CVE: CVE-2025-38531 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Throughout the various probe functions &indio_dev->dev is used before it is initialized. This caused a kernel panic in st_sensors_power_enable() when the call to devm_regulator_bulk_get_enable() fails and then calls dev_err_probe() with the uninitialized device. This seems to only cause a panic with dev_err_probe(), dev_err(), dev_warn() and dev_info() don't seem to cause a panic, but are fixed as well. The issue is reported and traced here: [1] Link: https://lore.kernel.org/all/AM7P189MB100986A83D2F28AF3FFAF976E39EA@AM7P189M… [1] Cc: stable(a)vger.kernel.org Signed-off-by: Maud Spierings <maudspierings(a)gocontroll.com> Reviewed-by: Andy Shevchenko <andy(a)kernel.org> Link: https://... [1] Link: https://patch.msgid.link/20250527-st_iio_fix-v4-1-12d89801c761@gocontroll.c… Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Conflicts: drivers/iio/common/st_sensors/st_sensors_core.c drivers/iio/common/st_sensors/st_sensors_trigger.c [just context conflicts] Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/iio/accel/st_accel_core.c | 10 +++--- .../iio/common/st_sensors/st_sensors_core.c | 36 +++++++++---------- .../common/st_sensors/st_sensors_trigger.c | 20 +++++------ 3 files changed, 31 insertions(+), 35 deletions(-) diff --git a/drivers/iio/accel/st_accel_core.c b/drivers/iio/accel/st_accel_core.c index d2104e14e255..6c031accad86 100644 --- a/drivers/iio/accel/st_accel_core.c +++ b/drivers/iio/accel/st_accel_core.c @@ -1270,10 +1270,11 @@ static int apply_acpi_orientation(struct iio_dev *indio_dev) struct acpi_buffer buffer = {ACPI_ALLOCATE_BUFFER, NULL}; struct acpi_device *adev; union acpi_object *ont; union acpi_object *elements; acpi_status status; + struct device *parent = indio_dev->dev.parent; int ret = -EINVAL; unsigned int val; int i, j; int final_ont[3][3] = { { 0 }, }; @@ -1288,21 +1289,20 @@ static int apply_acpi_orientation(struct iio_dev *indio_dev) { -1, 0, 0 }, { 0, 0, -1 }, }; - adev = ACPI_COMPANION(indio_dev->dev.parent); + adev = ACPI_COMPANION(parent); if (!adev) return -ENXIO; /* Read _ONT data, which should be a package of 6 integers. */ status = acpi_evaluate_object(adev->handle, "_ONT", NULL, &buffer); if (status == AE_NOT_FOUND) { return -ENXIO; } else if (ACPI_FAILURE(status)) { - dev_warn(&indio_dev->dev, "failed to execute _ONT: %d\n", - status); + dev_warn(parent, "failed to execute _ONT: %d\n", status); return status; } ont = buffer.pointer; if (ont->type != ACPI_TYPE_PACKAGE || ont->package.count != 6) @@ -1374,16 +1374,16 @@ static int apply_acpi_orientation(struct iio_dev *indio_dev) adata->mount_matrix.rotation[i * 3 + j] = str_value; } } ret = 0; - dev_info(&indio_dev->dev, "computed mount matrix from ACPI\n"); + dev_info(parent, "computed mount matrix from ACPI\n"); out: kfree(buffer.pointer); if (ret) - dev_dbg(&indio_dev->dev, + dev_dbg(parent, "failed to apply ACPI orientation data: %d\n", ret); return ret; } #else /* !CONFIG_ACPI */ diff --git a/drivers/iio/common/st_sensors/st_sensors_core.c b/drivers/iio/common/st_sensors/st_sensors_core.c index c77d7bdcc121..dc2aeda4e472 100644 --- a/drivers/iio/common/st_sensors/st_sensors_core.c +++ b/drivers/iio/common/st_sensors/st_sensors_core.c @@ -152,11 +152,11 @@ static int st_sensors_set_fullscale(struct iio_dev *indio_dev, unsigned int fs) sdata->current_fullscale = &sdata->sensor_settings->fs.fs_avl[i]; return err; st_accel_set_fullscale_error: - dev_err(&indio_dev->dev, "failed to set new fullscale.\n"); + dev_err(indio_dev->dev.parent, "failed to set new fullscale.\n"); return err; } int st_sensors_set_enable(struct iio_dev *indio_dev, bool enable) { @@ -229,58 +229,56 @@ int st_sensors_power_enable(struct iio_dev *indio_dev) /* Regulators not mandatory, but if requested we should enable them. */ err = devm_regulator_bulk_get_enable(parent, ARRAY_SIZE(regulator_names), regulator_names); if (err) - return dev_err_probe(&indio_dev->dev, err, - "unable to enable supplies\n"); + return dev_err_probe(parent, err, "unable to enable supplies\n"); return 0; } EXPORT_SYMBOL_NS(st_sensors_power_enable, IIO_ST_SENSORS); static int st_sensors_set_drdy_int_pin(struct iio_dev *indio_dev, struct st_sensors_platform_data *pdata) { + struct device *parent = indio_dev->dev.parent; struct st_sensor_data *sdata = iio_priv(indio_dev); /* Sensor does not support interrupts */ if (!sdata->sensor_settings->drdy_irq.int1.addr && !sdata->sensor_settings->drdy_irq.int2.addr) { if (pdata->drdy_int_pin) - dev_info(&indio_dev->dev, + dev_info(parent, "DRDY on pin INT%d specified, but sensor does not support interrupts\n", pdata->drdy_int_pin); return 0; } switch (pdata->drdy_int_pin) { case 1: if (!sdata->sensor_settings->drdy_irq.int1.mask) { - dev_err(&indio_dev->dev, - "DRDY on INT1 not available.\n"); + dev_err(parent, "DRDY on INT1 not available.\n"); return -EINVAL; } sdata->drdy_int_pin = 1; break; case 2: if (!sdata->sensor_settings->drdy_irq.int2.mask) { - dev_err(&indio_dev->dev, - "DRDY on INT2 not available.\n"); + dev_err(parent, "DRDY on INT2 not available.\n"); return -EINVAL; } sdata->drdy_int_pin = 2; break; default: - dev_err(&indio_dev->dev, "DRDY on pdata not valid.\n"); + dev_err(parent, "DRDY on pdata not valid.\n"); return -EINVAL; } if (pdata->open_drain) { if (!sdata->sensor_settings->drdy_irq.int1.addr_od && !sdata->sensor_settings->drdy_irq.int2.addr_od) - dev_err(&indio_dev->dev, + dev_err(parent, "open drain requested but unsupported.\n"); else sdata->int_pin_open_drain = true; } @@ -334,18 +332,19 @@ void st_sensors_dev_name_probe(struct device *dev, char *name, int len) EXPORT_SYMBOL_NS(st_sensors_dev_name_probe, IIO_ST_SENSORS); int st_sensors_init_sensor(struct iio_dev *indio_dev, struct st_sensors_platform_data *pdata) { + struct device *parent = indio_dev->dev.parent; struct st_sensor_data *sdata = iio_priv(indio_dev); struct st_sensors_platform_data *of_pdata; int err = 0; mutex_init(&sdata->odr_lock); /* If OF/DT pdata exists, it will take precedence of anything else */ - of_pdata = st_sensors_dev_probe(indio_dev->dev.parent, pdata); + of_pdata = st_sensors_dev_probe(parent, pdata); if (IS_ERR(of_pdata)) return PTR_ERR(of_pdata); if (of_pdata) pdata = of_pdata; @@ -368,11 +367,11 @@ int st_sensors_init_sensor(struct iio_dev *indio_dev, err = st_sensors_set_fullscale(indio_dev, sdata->current_fullscale->num); if (err < 0) return err; } else - dev_info(&indio_dev->dev, "Full-scale not possible\n"); + dev_info(parent, "Full-scale not possible\n"); err = st_sensors_set_odr(indio_dev, sdata->odr); if (err < 0) return err; @@ -403,11 +402,11 @@ int st_sensors_init_sensor(struct iio_dev *indio_dev, } else { addr = sdata->sensor_settings->drdy_irq.int2.addr_od; mask = sdata->sensor_settings->drdy_irq.int2.mask_od; } - dev_info(&indio_dev->dev, + dev_info(parent, "set interrupt line to open drain mode on pin %d\n", sdata->drdy_int_pin); err = st_sensors_write_data_with_mask(indio_dev, addr, mask, 1); if (err < 0) @@ -592,25 +591,24 @@ EXPORT_SYMBOL_NS(st_sensors_get_settings_index, IIO_ST_SENSORS); * Return: 0 on success (valid sensor ID), else a negative error code. */ int st_sensors_verify_id(struct iio_dev *indio_dev) { struct st_sensor_data *sdata = iio_priv(indio_dev); + struct device *parent = indio_dev->dev.parent; int wai, err; if (sdata->sensor_settings->wai_addr) { err = regmap_read(sdata->regmap, sdata->sensor_settings->wai_addr, &wai); if (err < 0) { - dev_err(&indio_dev->dev, - "failed to read Who-Am-I register.\n"); - return err; + return dev_err_probe(parent, err, + "failed to read Who-Am-I register.\n"); } if (sdata->sensor_settings->wai != wai) { - dev_err(&indio_dev->dev, - "%s: WhoAmI mismatch (0x%x).\n", - indio_dev->name, wai); + dev_err(parent, "%s: WhoAmI mismatch (0x%x).\n", + indio_dev->name, wai); return -EINVAL; } } return 0; diff --git a/drivers/iio/common/st_sensors/st_sensors_trigger.c b/drivers/iio/common/st_sensors/st_sensors_trigger.c index a0df9250a69f..b900acd471bd 100644 --- a/drivers/iio/common/st_sensors/st_sensors_trigger.c +++ b/drivers/iio/common/st_sensors/st_sensors_trigger.c @@ -125,11 +125,11 @@ int st_sensors_allocate_trigger(struct iio_dev *indio_dev, int err; sdata->trig = devm_iio_trigger_alloc(parent, "%s-trigger", indio_dev->name); if (sdata->trig == NULL) { - dev_err(&indio_dev->dev, "failed to allocate iio trigger.\n"); + dev_err(parent, "failed to allocate iio trigger.\n"); return -ENOMEM; } iio_trigger_set_drvdata(sdata->trig, indio_dev); sdata->trig->ops = trigger_ops; @@ -141,11 +141,11 @@ int st_sensors_allocate_trigger(struct iio_dev *indio_dev, */ switch(irq_trig) { case IRQF_TRIGGER_FALLING: case IRQF_TRIGGER_LOW: if (!sdata->sensor_settings->drdy_irq.addr_ihl) { - dev_err(&indio_dev->dev, + dev_err(parent, "falling/low specified for IRQ but hardware supports only rising/high: will request rising/high\n"); if (irq_trig == IRQF_TRIGGER_FALLING) irq_trig = IRQF_TRIGGER_RISING; if (irq_trig == IRQF_TRIGGER_LOW) irq_trig = IRQF_TRIGGER_HIGH; @@ -154,34 +154,32 @@ int st_sensors_allocate_trigger(struct iio_dev *indio_dev, err = st_sensors_write_data_with_mask(indio_dev, sdata->sensor_settings->drdy_irq.addr_ihl, sdata->sensor_settings->drdy_irq.mask_ihl, 1); if (err < 0) return err; - dev_info(&indio_dev->dev, + dev_info(parent, "interrupts on the falling edge or active low level\n"); } break; case IRQF_TRIGGER_RISING: - dev_info(&indio_dev->dev, - "interrupts on the rising edge\n"); + dev_info(parent, "interrupts on the rising edge\n"); break; case IRQF_TRIGGER_HIGH: - dev_info(&indio_dev->dev, - "interrupts active high level\n"); + dev_info(parent, "interrupts active high level\n"); break; default: /* This is the most preferred mode, if possible */ - dev_err(&indio_dev->dev, + dev_err(parent, "unsupported IRQ trigger specified (%lx), enforce rising edge\n", irq_trig); irq_trig = IRQF_TRIGGER_RISING; } /* Tell the interrupt handler that we're dealing with edges */ if (irq_trig == IRQF_TRIGGER_FALLING || irq_trig == IRQF_TRIGGER_RISING) { if (!sdata->sensor_settings->drdy_irq.stat_drdy.addr) { - dev_err(&indio_dev->dev, + dev_err(parent, "edge IRQ not supported w/o stat register.\n"); return -EOPNOTSUPP; } sdata->edge_irq = true; } else { @@ -212,17 +210,17 @@ int st_sensors_allocate_trigger(struct iio_dev *indio_dev, st_sensors_irq_thread, irq_trig, sdata->trig->name, sdata->trig); if (err) { - dev_err(&indio_dev->dev, "failed to request trigger IRQ.\n"); + dev_err(parent, "failed to request trigger IRQ.\n"); return err; } err = devm_iio_trigger_register(parent, sdata->trig); if (err < 0) { - dev_err(&indio_dev->dev, "failed to register iio trigger.\n"); + dev_err(parent, "failed to register iio trigger.\n"); return err; } indio_dev->trig = iio_trigger_get(sdata->trig); return 0; -- 2.17.1

2 1

[PATCH OLK-5.10] ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr()
by Dong Chenchen 05 Feb '26

05 Feb '26

From: Will Rosenberg <whrosenb(a)asu.edu> stable inclusion from stable-v5.10.248 commit 86f365897068d09418488165a68b23cb5baa37f2 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13396 CVE: CVE-2025-71085 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 58fc7342b529803d3c221101102fe913df7adb83 ] There exists a kernel oops caused by a BUG_ON(nhead < 0) at net/core/skbuff.c:2232 in pskb_expand_head(). This bug is triggered as part of the calipso_skbuff_setattr() routine when skb_cow() is passed headroom > INT_MAX (i.e. (int)(skb_headroom(skb) + len_delta) < 0). The root cause of the bug is due to an implicit integer cast in __skb_cow(). The check (headroom > skb_headroom(skb)) is meant to ensure that delta = headroom - skb_headroom(skb) is never negative, otherwise we will trigger a BUG_ON in pskb_expand_head(). However, if headroom > INT_MAX and delta <= -NET_SKB_PAD, the check passes, delta becomes negative, and pskb_expand_head() is passed a negative value for nhead. Fix the trigger condition in calipso_skbuff_setattr(). Avoid passing "negative" headroom sizes to skb_cow() within calipso_skbuff_setattr() by only using skb_cow() to grow headroom. PoC: Using `netlabelctl` tool: netlabelctl map del default netlabelctl calipso add pass doi:7 netlabelctl map add default address:0::1/128 protocol:calipso,7 Then run the following PoC: int fd = socket(AF_INET6, SOCK_DGRAM, IPPROTO_UDP); // setup msghdr int cmsg_size = 2; int cmsg_len = 0x60; struct msghdr msg; struct sockaddr_in6 dest_addr; struct cmsghdr * cmsg = (struct cmsghdr *) calloc(1, sizeof(struct cmsghdr) + cmsg_len); msg.msg_name = &dest_addr; msg.msg_namelen = sizeof(dest_addr); msg.msg_iov = NULL; msg.msg_iovlen = 0; msg.msg_control = cmsg; msg.msg_controllen = cmsg_len; msg.msg_flags = 0; // setup sockaddr dest_addr.sin6_family = AF_INET6; dest_addr.sin6_port = htons(31337); dest_addr.sin6_flowinfo = htonl(31337); dest_addr.sin6_addr = in6addr_loopback; dest_addr.sin6_scope_id = 31337; // setup cmsghdr cmsg->cmsg_len = cmsg_len; cmsg->cmsg_level = IPPROTO_IPV6; cmsg->cmsg_type = IPV6_HOPOPTS; char * hop_hdr = (char *)cmsg + sizeof(struct cmsghdr); hop_hdr[1] = 0x9; //set hop size - (0x9 + 1) * 8 = 80 sendmsg(fd, &msg, 0); Fixes: 2917f57b6bc1 ("calipso: Allow the lsm to label the skbuff directly.") Suggested-by: Paul Moore <paul(a)paul-moore.com> Signed-off-by: Will Rosenberg <whrosenb(a)asu.edu> Acked-by: Paul Moore <paul(a)paul-moore.com> Link: https://patch.msgid.link/20251219173637.797418-1-whrosenb@asu.edu Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Yujun <linyujun809(a)h-partners.com> --- net/ipv6/calipso.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/ipv6/calipso.c b/net/ipv6/calipso.c index b24afbf3dbe4..23304346b537 100644 --- a/net/ipv6/calipso.c +++ b/net/ipv6/calipso.c @@ -1330,7 +1330,8 @@ static int calipso_skbuff_setattr(struct sk_buff *skb, /* At this point new_end aligns to 4n, so (new_end & 4) pads to 8n */ pad = ((new_end & 4) + (end & 7)) & 7; len_delta = new_end - (int)end + pad; - ret_val = skb_cow(skb, skb_headroom(skb) + len_delta); + ret_val = skb_cow(skb, + skb_headroom(skb) + (len_delta > 0 ? len_delta : 0)); if (ret_val < 0) return ret_val; -- 2.25.1

2 1

[PATCH OLK-5.10] net/sched: sch_qfq: do not free existing class in qfq_change_class()
by Dong Chenchen 05 Feb '26

05 Feb '26

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.19-rc6 commit 3879cffd9d07aa0377c4b8835c4f64b4fb24ac78 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13510 CVE: CVE-2026-22999 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Fixes qfq_change_class() error case. cl->qdisc and cl should only be freed if a new class and qdisc were allocated, or we risk various UAF. Fixes: 462dbc9101ac ("pkt_sched: QFQ Plus: fair-queueing service at DRR cost") Reported-by: syzbot+07f3f38f723c335f106d(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/6965351d.050a0220.eaf7.00c5.GAE@google.com/T… Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Link: https://patch.msgid.link/20260112175656.17605-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/sched/sch_qfq.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c index e90cbc47414c..e24b88869e52 100644 --- a/net/sched/sch_qfq.c +++ b/net/sched/sch_qfq.c @@ -532,8 +532,10 @@ static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid, return 0; destroy_class: - qdisc_put(cl->qdisc); - kfree(cl); + if (!existing) { + qdisc_put(cl->qdisc); + kfree(cl); + } return err; } -- 2.25.1

2 1

[PATCH OLK-5.10 v2] macvlan: fix possible UAF in macvlan_forward_source()
by Dong Chenchen 05 Feb '26

05 Feb '26

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.19-rc6 commit 7470a7a63dc162f07c26dbf960e41ee1e248d80e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13512 CVE: CVE-2026-23001 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Add RCU protection on (struct macvlan_source_entry)->vlan. Whenever macvlan_hash_del_source() is called, we must clear entry->vlan pointer before RCU grace period starts. This allows macvlan_forward_source() to skip over entries queued for freeing. Note that macvlan_dev are already RCU protected, as they are embedded in a standard netdev (netdev_priv(ndev)). Fixes: 79cf79abce71 ("macvlan: add source mode") Reported-by: syzbot+7182fbe91e58602ec1fe(a)syzkaller.appspotmail.com https: //lore.kernel.org/netdev/695fb1e8.050a0220.1c677c.039f.GAE(a)google.com/T/#u Signed-off-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20260108133651.1130486-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: drivers/net/macvlan.c [commit bb23ffa1015c is not backport] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/net/macvlan.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c index 9c77e6ab2b30..2ed99251d5e0 100644 --- a/drivers/net/macvlan.c +++ b/drivers/net/macvlan.c @@ -55,7 +55,7 @@ struct macvlan_port { struct macvlan_source_entry { struct hlist_node hlist; - struct macvlan_dev *vlan; + struct macvlan_dev __rcu *vlan; unsigned char addr[6+2] __aligned(sizeof(u16)); struct rcu_head rcu; }; @@ -141,7 +141,7 @@ static struct macvlan_source_entry *macvlan_hash_lookup_source( hlist_for_each_entry_rcu(entry, h, hlist, lockdep_rtnl_is_held()) { if (ether_addr_equal_64bits(entry->addr, addr) && - entry->vlan == vlan) + rcu_access_pointer(entry->vlan) == vlan) return entry; } return NULL; @@ -163,7 +163,7 @@ static int macvlan_hash_add_source(struct macvlan_dev *vlan, return -ENOMEM; ether_addr_copy(entry->addr, addr); - entry->vlan = vlan; + RCU_INIT_POINTER(entry->vlan, vlan); h = &port->vlan_source_hash[macvlan_eth_hash(addr)]; hlist_add_head_rcu(&entry->hlist, h); vlan->macaddr_count++; @@ -182,6 +182,7 @@ static void macvlan_hash_add(struct macvlan_dev *vlan) static void macvlan_hash_del_source(struct macvlan_source_entry *entry) { + RCU_INIT_POINTER(entry->vlan, NULL); hlist_del_rcu(&entry->hlist); kfree_rcu(entry, rcu); } @@ -388,7 +389,7 @@ static void macvlan_flush_sources(struct macvlan_port *port, entry = hlist_entry(h, struct macvlan_source_entry, hlist); - if (entry->vlan == vlan) + if (rcu_access_pointer(entry->vlan) == vlan) macvlan_hash_del_source(entry); } } @@ -430,8 +431,13 @@ static void macvlan_forward_source(struct sk_buff *skb, struct hlist_head *h = &port->vlan_source_hash[idx]; hlist_for_each_entry_rcu(entry, h, hlist) { - if (ether_addr_equal_64bits(entry->addr, addr)) - macvlan_forward_source_one(skb, entry->vlan); + if (ether_addr_equal_64bits(entry->addr, addr)) { + struct macvlan_dev *vlan = rcu_dereference(entry->vlan); + + if (!vlan) + continue; + macvlan_forward_source_one(skb, vlan); + } } } @@ -1615,7 +1621,7 @@ static int macvlan_fill_info_macaddr(struct sk_buff *skb, struct macvlan_source_entry *entry; hlist_for_each_entry_rcu(entry, h, hlist, lockdep_rtnl_is_held()) { - if (entry->vlan != vlan) + if (rcu_access_pointer(entry->vlan) != vlan) continue; if (nla_put(skb, IFLA_MACVLAN_MACADDR, ETH_ALEN, entry->addr)) return 1; -- 2.25.1

2 1

[PATCH OLK-6.6 0/3] fix CVE-2025-68231
by Qi Xi 05 Feb '26

05 Feb '26

Fabio M. De Francesco (2): mm/mempool: replace kmap_atomic() with kmap_local_page() mm/page_poison: replace kmap_atomic() with kmap_local_page() Vlastimil Babka (1): mm/mempool: fix poisoning order>0 pages with HIGHMEM mm/mempool.c | 35 +++++++++++++++++++++++++++++------ mm/page_poison.c | 8 ++++---- 2 files changed, 33 insertions(+), 10 deletions(-) -- 2.33.0

2 4

[PATCH OLK-6.6] usb: gadget: udc: fix use-after-free in usb_gadget_state_work
by Qi Xi 05 Feb '26

05 Feb '26

From: Jimmy Hu <hhhuuu(a)google.com> mainline inclusion from mainline-v6.18 commit baeb66fbd4201d1c4325074e78b1f557dff89b5b category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/11530 CVE: CVE-2025-68282 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- A race condition during gadget teardown can lead to a use-after-free in usb_gadget_state_work(), as reported by KASAN: BUG: KASAN: invalid-access in sysfs_notify+0x2c/0xd0 Workqueue: events usb_gadget_state_work The fundamental race occurs because a concurrent event (e.g., an interrupt) can call usb_gadget_set_state() and schedule gadget->work at any time during the cleanup process in usb_del_gadget(). Commit 399a45e5237c ("usb: gadget: core: flush gadget workqueue after device removal") attempted to fix this by moving flush_work() to after device_del(). However, this does not fully solve the race, as a new work item can still be scheduled *after* flush_work() completes but before the gadget's memory is freed, leading to the same use-after-free. This patch fixes the race condition robustly by introducing a 'teardown' flag and a 'state_lock' spinlock to the usb_gadget struct. The flag is set during cleanup in usb_del_gadget() *before* calling flush_work() to prevent any new work from being scheduled once cleanup has commenced. The scheduling site, usb_gadget_set_state(), now checks this flag under the lock before queueing the work, thus safely closing the race window. Fixes: 5702f75375aa9 ("usb: gadget: udc-core: move sysfs_notify() to a workqueue") Cc: stable <stable(a)kernel.org> Signed-off-by: Jimmy Hu <hhhuuu(a)google.com> Link: https://patch.msgid.link/20251023054945.233861-1-hhhuuu@google.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/usb/gadget/udc/core.c [Context conflicts] Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- drivers/usb/gadget/udc/core.c | 17 ++++++++++++++++- include/linux/usb/gadget.h | 5 +++++ 2 files changed, 21 insertions(+), 1 deletion(-) diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c index a4120a25428e..00362ec876a4 100644 --- a/drivers/usb/gadget/udc/core.c +++ b/drivers/usb/gadget/udc/core.c @@ -1118,8 +1118,13 @@ static void usb_gadget_state_work(struct work_struct *work) void usb_gadget_set_state(struct usb_gadget *gadget, enum usb_device_state state) { + unsigned long flags; + + spin_lock_irqsave(&gadget->state_lock, flags); gadget->state = state; - schedule_work(&gadget->work); + if (!gadget->teardown) + schedule_work(&gadget->work); + spin_unlock_irqrestore(&gadget->state_lock, flags); } EXPORT_SYMBOL_GPL(usb_gadget_set_state); @@ -1352,6 +1357,8 @@ static void usb_udc_nop_release(struct device *dev) void usb_initialize_gadget(struct device *parent, struct usb_gadget *gadget, void (*release)(struct device *dev)) { + spin_lock_init(&gadget->state_lock); + gadget->teardown = false; INIT_WORK(&gadget->work, usb_gadget_state_work); gadget->dev.parent = parent; @@ -1526,6 +1533,7 @@ EXPORT_SYMBOL_GPL(usb_add_gadget_udc); void usb_del_gadget(struct usb_gadget *gadget) { struct usb_udc *udc = gadget->udc; + unsigned long flags; if (!udc) return; @@ -1539,6 +1547,13 @@ void usb_del_gadget(struct usb_gadget *gadget) kobject_uevent(&udc->dev.kobj, KOBJ_REMOVE); sysfs_remove_link(&udc->dev.kobj, "gadget"); device_del(&gadget->dev); + /* + * Set the teardown flag before flushing the work to prevent new work + * from being scheduled while we are cleaning up. + */ + spin_lock_irqsave(&gadget->state_lock, flags); + gadget->teardown = true; + spin_unlock_irqrestore(&gadget->state_lock, flags); flush_work(&gadget->work); ida_free(&gadget_id_numbers, gadget->id_number); cancel_work_sync(&udc->vbus_work); diff --git a/include/linux/usb/gadget.h b/include/linux/usb/gadget.h index 75bda0783395..2548ccf72222 100644 --- a/include/linux/usb/gadget.h +++ b/include/linux/usb/gadget.h @@ -349,6 +349,9 @@ struct usb_gadget_ops { * can handle. The UDC must support this and all slower speeds and lower * number of lanes. * @state: the state we are now (attached, suspended, configured, etc) + * @state_lock: Spinlock protecting the `state` and `teardown` members. + * @teardown: True if the device is undergoing teardown, used to prevent + * new work from being scheduled during cleanup. * @name: Identifies the controller hardware type. Used in diagnostics * and sometimes configuration. * @dev: Driver model state for this abstract device. @@ -424,6 +427,8 @@ struct usb_gadget { enum usb_ssp_rate max_ssp_rate; enum usb_device_state state; + spinlock_t state_lock; + bool teardown; const char *name; struct device dev; unsigned isoch_delay; -- 2.33.0

2 1

[PATCH OLK-6.6] net: dsa: properly keep track of conduit reference
by Qi Xi 05 Feb '26

05 Feb '26

From: Vladimir Oltean <vladimir.oltean(a)nxp.com> mainline inclusion from mainline-v6.19-rc4 commit 06e219f6a706c367c93051f408ac61417643d2f9 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13476 CVE: CVE-2025-71152 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Problem description ------------------- DSA has a mumbo-jumbo of reference handling of the conduit net device and its kobject which, sadly, is just wrong and doesn't make sense. There are two distinct problems. 1. The OF path, which uses of_find_net_device_by_node(), never releases the elevated refcount on the conduit's kobject. Nominally, the OF and non-OF paths should result in objects having identical reference counts taken, and it is already suspicious that dsa_dev_to_net_device() has a put_device() call which is missing in dsa_port_parse_of(), but we can actually even verify that an issue exists. With CONFIG_DEBUG_KOBJECT_RELEASE=y, if we run this command "before" and "after" applying this patch: (unbind the conduit driver for net device eno2) echo 0000:00:00.2 > /sys/bus/pci/drivers/fsl_enetc/unbind we see these lines in the output diff which appear only with the patch applied: kobject: 'eno2' (ffff002009a3a6b8): kobject_release, parent 0000000000000000 (delayed 1000) kobject: '109' (ffff0020099d59a0): kobject_release, parent 0000000000000000 (delayed 1000) 2. After we find the conduit interface one way (OF) or another (non-OF), it can get unregistered at any time, and DSA remains with a long-lived, but in this case stale, cpu_dp->conduit pointer. Holding the net device's underlying kobject isn't actually of much help, it just prevents it from being freed (but we never need that kobject directly). What helps us to prevent the net device from being unregistered is the parallel netdev reference mechanism (dev_hold() and dev_put()). Actually we actually use that netdev tracker mechanism implicitly on user ports since commit 2f1e8ea726e9 ("net: dsa: link interfaces with the DSA master to get rid of lockdep warnings"), via netdev_upper_dev_link(). But time still passes at DSA switch probe time between the initial of_find_net_device_by_node() code and the user port creation time, time during which the conduit could unregister itself and DSA wouldn't know about it. So we have to run of_find_net_device_by_node() under rtnl_lock() to prevent that from happening, and release the lock only with the netdev tracker having acquired the reference. Do we need to keep the reference until dsa_unregister_switch() / dsa_switch_shutdown()? 1: Maybe yes. A switch device will still be registered even if all user ports failed to probe, see commit 86f8b1c01a0a ("net: dsa: Do not make user port errors fatal"), and the cpu_dp->conduit pointers remain valid. I haven't audited all call paths to see whether they will actually use the conduit in lack of any user port, but if they do, it seems safer to not rely on user ports for that reference. 2. Definitely yes. We support changing the conduit which a user port is associated to, and we can get into a situation where we've moved all user ports away from a conduit, thus no longer hold any reference to it via the net device tracker. But we shouldn't let it go nonetheless - see the next change in relation to dsa_tree_find_first_conduit() and LAG conduits which disappear. We have to be prepared to return to the physical conduit, so the CPU port must explicitly keep another reference to it. This is also to say: the user ports and their CPU ports may not always keep a reference to the same conduit net device, and both are needed. As for the conduit's kobject for the /sys/class/net/ entry, we don't care about it, we can release it as soon as we hold the net device object itself. History and blame attribution ----------------------------- The code has been refactored so many times, it is very difficult to follow and properly attribute a blame, but I'll try to make a short history which I hope to be correct. We have two distinct probing paths: - one for OF, introduced in 2016 in commit 83c0afaec7b7 ("net: dsa: Add new binding implementation") - one for non-OF, introduced in 2017 in commit 71e0bbde0d88 ("net: dsa: Add support for platform data") These are both complete rewrites of the original probing paths (which used struct dsa_switch_driver and other weird stuff, instead of regular devices on their respective buses for register access, like MDIO, SPI, I2C etc): - one for OF, introduced in 2013 in commit 5e95329b701c ("dsa: add device tree bindings to register DSA switches") - one for non-OF, introduced in 2008 in commit 91da11f870f0 ("net: Distributed Switch Architecture protocol support") except for tiny bits and pieces like dsa_dev_to_net_device() which were seemingly carried over since the original commit, and used to this day. The point is that the original probing paths received a fix in 2015 in the form of commit 679fb46c5785 ("net: dsa: Add missing master netdev dev_put() calls"), but the fix never made it into the "new" (dsa2) probing paths that can still be traced to today, and the fixed probing path was later deleted in 2019 in commit 93e86b3bc842 ("net: dsa: Remove legacy probing support"). That is to say, the new probing paths were never quite correct in this area. The existence of the legacy probing support which was deleted in 2019 explains why dsa_dev_to_net_device() returns a conduit with elevated refcount (because it was supposed to be released during dsa_remove_dst()). After the removal of the legacy code, the only user of dsa_dev_to_net_device() calls dev_put(conduit) immediately after this function returns. This pattern makes no sense today, and can only be interpreted historically to understand why dev_hold() was there in the first place. Change details -------------- Today we have a better netdev tracking infrastructure which we should use. Logically netdev_hold() belongs in common code (dsa_port_parse_cpu(), where dp->conduit is assigned), but there is a tradeoff to be made with the rtnl_lock() section which would become a bit too long if we did that - dsa_port_parse_cpu() also calls request_module(). So we duplicate a bit of logic in order for the callers of dsa_port_parse_cpu() to be the ones responsible of holding the conduit reference and releasing it on error. This shortens the rtnl_lock() section significantly. In the dsa_switch_probe() error path, dsa_switch_release_ports() will be called in a number of situations, one being where dsa_port_parse_cpu() maybe didn't get the chance to run at all (a different port failed earlier, etc). So we have to test for the conduit being NULL prior to calling netdev_put(). There have still been so many transformations to the code since the blamed commits (rename master -> conduit, commit 0650bf52b31f ("net: dsa: be compatible with masters which unregister on shutdown")), that it only makes sense to fix the code using the best methods available today and see how it can be backported to stable later. I suspect the fix cannot even be backported to kernels which lack dsa_switch_shutdown(), and I suspect this is also maybe why the long-lived conduit reference didn't make it into the new DSA probing paths at the time (problems during shutdown). Because dsa_dev_to_net_device() has a single call site and has to be changed anyway, the logic was just absorbed into the non-OF dsa_port_parse(). Tested on the ocelot/felix switch and on dsa_loop, both on the NXP LS1028A with CONFIG_DEBUG_KOBJECT_RELEASE=y. Reported-by: Ma Ke <make24(a)iscas.ac.cn> Closes: https://lore.kernel.org/netdev/20251214131204.4684-1-make24@iscas.ac.cn/ Fixes: 83c0afaec7b7 ("net: dsa: Add new binding implementation") Fixes: 71e0bbde0d88 ("net: dsa: Add support for platform data") Reviewed-by: Jonas Gorski <jonas.gorski(a)gmail.com> Signed-off-by: Vladimir Oltean <vladimir.oltean(a)nxp.com> Link: https://patch.msgid.link/20251215150236.3931670-1-vladimir.oltean@nxp.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Conflicts: net/dsa/dsa.c [Context conflicts] Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- include/net/dsa.h | 1 + net/dsa/dsa.c | 59 +++++++++++++++++++++++++++-------------------- 2 files changed, 35 insertions(+), 25 deletions(-) diff --git a/include/net/dsa.h b/include/net/dsa.h index 0b9c6aa27047..3b9cb8e7e25f 100644 --- a/include/net/dsa.h +++ b/include/net/dsa.h @@ -297,6 +297,7 @@ struct dsa_port { struct devlink_port devlink_port; struct phylink *pl; struct phylink_config pl_config; + netdevice_tracker conduit_tracker; struct dsa_lag *lag; struct net_device *hsr_dev; diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c index c9bf1a9a6c99..291efcaf75ab 100644 --- a/net/dsa/dsa.c +++ b/net/dsa/dsa.c @@ -1257,14 +1257,25 @@ static int dsa_port_parse_of(struct dsa_port *dp, struct device_node *dn) if (ethernet) { struct net_device *master; const char *user_protocol; + int err; + rtnl_lock(); master = of_find_net_device_by_node(ethernet); of_node_put(ethernet); - if (!master) + if (!master) { + rtnl_unlock(); return -EPROBE_DEFER; + } + + netdev_hold(master, &dp->conduit_tracker, GFP_KERNEL); + put_device(&master->dev); + rtnl_unlock(); user_protocol = of_get_property(dn, "dsa-tag-protocol", NULL); - return dsa_port_parse_cpu(dp, master, user_protocol); + err = dsa_port_parse_cpu(dp, master, user_protocol); + if (err) + netdev_put(master, &dp->conduit_tracker); + return err; } if (link) @@ -1397,37 +1408,30 @@ static struct device *dev_find_class(struct device *parent, char *class) return device_find_child(parent, class, dev_is_class); } -static struct net_device *dsa_dev_to_net_device(struct device *dev) -{ - struct device *d; - - d = dev_find_class(dev, "net"); - if (d != NULL) { - struct net_device *nd; - - nd = to_net_dev(d); - dev_hold(nd); - put_device(d); - - return nd; - } - - return NULL; -} - static int dsa_port_parse(struct dsa_port *dp, const char *name, struct device *dev) { if (!strcmp(name, "cpu")) { struct net_device *master; + struct device *d; + int err; - master = dsa_dev_to_net_device(dev); - if (!master) + rtnl_lock(); + d = dev_find_class(dev, "net"); + if (!d) { + rtnl_unlock(); return -EPROBE_DEFER; + } - dev_put(master); + master = to_net_dev(d); + netdev_hold(master, &dp->conduit_tracker, GFP_KERNEL); + put_device(d); + rtnl_unlock(); - return dsa_port_parse_cpu(dp, master, NULL); + err = dsa_port_parse_cpu(dp, master, NULL); + if (err) + netdev_put(master, &dp->conduit_tracker); + return err; } if (!strcmp(name, "dsa")) @@ -1495,6 +1499,9 @@ static void dsa_switch_release_ports(struct dsa_switch *ds) struct dsa_vlan *v, *n; dsa_switch_for_each_port_safe(dp, next, ds) { + if (dsa_port_is_cpu(dp) && dp->master) + netdev_put(dp->master, &dp->conduit_tracker); + /* These are either entries that upper layers lost track of * (probably due to bugs), or installed through interfaces * where one does not necessarily have to remove them, like @@ -1639,8 +1646,10 @@ void dsa_switch_shutdown(struct dsa_switch *ds) /* Disconnect from further netdevice notifiers on the master, * since netdev_uses_dsa() will now return false. */ - dsa_switch_for_each_cpu_port(dp, ds) + dsa_switch_for_each_cpu_port(dp, ds) { dp->master->dsa_ptr = NULL; + netdev_put(dp->master, &dp->conduit_tracker); + } rtnl_unlock(); out: -- 2.33.0

2 1

[PATCH OLK-6.6] net/sched: sch_qfq: do not free existing class in qfq_change_class()
by Dong Chenchen 05 Feb '26

05 Feb '26

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.19-rc6 commit 3879cffd9d07aa0377c4b8835c4f64b4fb24ac78 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13510 CVE: CVE-2026-22999 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Fixes qfq_change_class() error case. cl->qdisc and cl should only be freed if a new class and qdisc were allocated, or we risk various UAF. Fixes: 462dbc9101ac ("pkt_sched: QFQ Plus: fair-queueing service at DRR cost") Reported-by: syzbot+07f3f38f723c335f106d(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/6965351d.050a0220.eaf7.00c5.GAE@google.com/T… Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Link: https://patch.msgid.link/20260112175656.17605-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/sched/sch_qfq.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c index 2e91207dabf0..59d21b5e8ad1 100644 --- a/net/sched/sch_qfq.c +++ b/net/sched/sch_qfq.c @@ -532,8 +532,10 @@ static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid, return 0; destroy_class: - qdisc_put(cl->qdisc); - kfree(cl); + if (!existing) { + qdisc_put(cl->qdisc); + kfree(cl); + } return err; } -- 2.25.1

2 1

[PATCH OLK-6.6] macvlan: fix possible UAF in macvlan_forward_source()
by Dong Chenchen 05 Feb '26

05 Feb '26

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.19-rc6 commit 7470a7a63dc162f07c26dbf960e41ee1e248d80e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13512 CVE: CVE-2026-23001 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Add RCU protection on (struct macvlan_source_entry)->vlan. Whenever macvlan_hash_del_source() is called, we must clear entry->vlan pointer before RCU grace period starts. This allows macvlan_forward_source() to skip over entries queued for freeing. Note that macvlan_dev are already RCU protected, as they are embedded in a standard netdev (netdev_priv(ndev)). Fixes: 79cf79abce71 ("macvlan: add source mode") Reported-by: syzbot+7182fbe91e58602ec1fe(a)syzkaller.appspotmail.com https: //lore.kernel.org/netdev/695fb1e8.050a0220.1c677c.039f.GAE(a)google.com/T/#u Signed-off-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20260108133651.1130486-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/net/macvlan.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c index c8da94af4161..09db43ce3176 100644 --- a/drivers/net/macvlan.c +++ b/drivers/net/macvlan.c @@ -58,7 +58,7 @@ struct macvlan_port { struct macvlan_source_entry { struct hlist_node hlist; - struct macvlan_dev *vlan; + struct macvlan_dev __rcu *vlan; unsigned char addr[6+2] __aligned(sizeof(u16)); struct rcu_head rcu; }; @@ -145,7 +145,7 @@ static struct macvlan_source_entry *macvlan_hash_lookup_source( hlist_for_each_entry_rcu(entry, h, hlist, lockdep_rtnl_is_held()) { if (ether_addr_equal_64bits(entry->addr, addr) && - entry->vlan == vlan) + rcu_access_pointer(entry->vlan) == vlan) return entry; } return NULL; @@ -167,7 +167,7 @@ static int macvlan_hash_add_source(struct macvlan_dev *vlan, return -ENOMEM; ether_addr_copy(entry->addr, addr); - entry->vlan = vlan; + RCU_INIT_POINTER(entry->vlan, vlan); h = &port->vlan_source_hash[macvlan_eth_hash(addr)]; hlist_add_head_rcu(&entry->hlist, h); vlan->macaddr_count++; @@ -186,6 +186,7 @@ static void macvlan_hash_add(struct macvlan_dev *vlan) static void macvlan_hash_del_source(struct macvlan_source_entry *entry) { + RCU_INIT_POINTER(entry->vlan, NULL); hlist_del_rcu(&entry->hlist); kfree_rcu(entry, rcu); } @@ -389,7 +390,7 @@ static void macvlan_flush_sources(struct macvlan_port *port, int i; hash_for_each_safe(port->vlan_source_hash, i, next, entry, hlist) - if (entry->vlan == vlan) + if (rcu_access_pointer(entry->vlan) == vlan) macvlan_hash_del_source(entry); vlan->macaddr_count = 0; @@ -432,9 +433,14 @@ static bool macvlan_forward_source(struct sk_buff *skb, hlist_for_each_entry_rcu(entry, h, hlist) { if (ether_addr_equal_64bits(entry->addr, addr)) { - if (entry->vlan->flags & MACVLAN_FLAG_NODST) + struct macvlan_dev *vlan = rcu_dereference(entry->vlan); + + if (!vlan) + continue; + + if (vlan->flags & MACVLAN_FLAG_NODST) consume = true; - macvlan_forward_source_one(skb, entry->vlan); + macvlan_forward_source_one(skb, vlan); } } @@ -1685,7 +1691,7 @@ static int macvlan_fill_info_macaddr(struct sk_buff *skb, struct macvlan_source_entry *entry; hlist_for_each_entry_rcu(entry, h, hlist, lockdep_rtnl_is_held()) { - if (entry->vlan != vlan) + if (rcu_access_pointer(entry->vlan) != vlan) continue; if (nla_put(skb, IFLA_MACVLAN_MACADDR, ETH_ALEN, entry->addr)) return 1; -- 2.25.1

2 1

[PATCH OLK-6.6 00/11] net: LTS-6.6 bugfix backport
by Dong Chenchen 05 Feb '26

05 Feb '26

net LTS-6.6 patches backport Dong Chenchen (1): Revert "netfilter: nft_objref: validate objref and objrefmap expressions" Eric Dumazet (2): ip6_gre: make ip6gre_header() robust arp: do not assume dev_hard_header() does not change skb->head Fernando Fernandez Mancera (1): netfilter: nft_objref: validate objref and objrefmap expressions Florian Westphal (2): netfilter: nf_tables: drop unused 3rd argument from validate callback ops netfilter: nf_tables: avoid chain re-validation if possible Gal Pressman (1): ethtool: Avoid overflowing userspace buffer on stats query Slavin Liu (1): ipvs: fix ipv4 null-ptr-deref in route error path Tetsuo Handa (1): bpf: Fix reference count leak in bpf_prog_test_run_xdp() Will Rosenberg (1): ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() Xiang Mei (1): net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset include/net/netfilter/nf_tables.h | 37 ++++++++---- include/net/netfilter/nft_fib.h | 4 +- include/net/netfilter/nft_meta.h | 3 +- include/net/netfilter/nft_reject.h | 3 +- net/bpf/test_run.c | 7 ++- net/bridge/netfilter/nft_meta_bridge.c | 5 +- net/bridge/netfilter/nft_reject_bridge.c | 3 +- net/ethtool/ioctl.c | 30 ++++++++-- net/ipv4/arp.c | 7 ++- net/ipv6/calipso.c | 3 +- net/ipv6/ip6_gre.c | 9 ++- net/netfilter/ipvs/ip_vs_xmit.c | 3 + net/netfilter/nf_tables_api.c | 72 ++++++++++++++++++++++-- net/netfilter/nft_compat.c | 6 +- net/netfilter/nft_fib.c | 3 +- net/netfilter/nft_flow_offload.c | 3 +- net/netfilter/nft_fwd_netdev.c | 3 +- net/netfilter/nft_immediate.c | 3 +- net/netfilter/nft_lookup.c | 3 +- net/netfilter/nft_masq.c | 3 +- net/netfilter/nft_meta.c | 6 +- net/netfilter/nft_nat.c | 3 +- net/netfilter/nft_objref.c | 6 +- net/netfilter/nft_osf.c | 3 +- net/netfilter/nft_queue.c | 3 +- net/netfilter/nft_redir.c | 3 +- net/netfilter/nft_reject.c | 3 +- net/netfilter/nft_reject_inet.c | 3 +- net/netfilter/nft_reject_netdev.c | 3 +- net/netfilter/nft_rt.c | 3 +- net/netfilter/nft_socket.c | 3 +- net/netfilter/nft_synproxy.c | 3 +- net/netfilter/nft_tproxy.c | 3 +- net/netfilter/nft_xfrm.c | 3 +- net/sched/sch_qfq.c | 2 +- 35 files changed, 169 insertions(+), 91 deletions(-) -- 2.25.1

2 12

[PATCH OLK-6.6 0/9] CVE-2024-50102
by Qi Xi 05 Feb '26

05 Feb '26

David Gow (1): x86/uaccess: Zero the 8-byte get_range case on failure on 32-bit David Laight (1): x86: fix off-by-one in access_ok() Linus Torvalds (5): runtime constants: deal with old decrepit linkers runtime constants: add x86 architecture support x86: fix whitespace in runtime-const assembler output x86/uaccess: Improve the 8-byte getuser() case x86: fix user address masking non-canonical speculation issue Stephen Brennan (1): dcache: keep dentry_hashtable or d_hash_shift even when not used Thomas Gleixner (1): x86/uaccess: Add missing __force to casts in __access_ok() and valid_user_address() arch/x86/include/asm/runtime-const.h | 61 +++++++++++++++++++++ arch/x86/include/asm/uaccess_64.h | 49 ++++++++++------- arch/x86/kernel/cpu/common.c | 10 ++++ arch/x86/kernel/vmlinux.lds.S | 4 ++ arch/x86/lib/getuser.S | 80 ++++++++++------------------ fs/dcache.c | 9 +++- include/asm-generic/vmlinux.lds.h | 7 +++ 7 files changed, 149 insertions(+), 71 deletions(-) create mode 100644 arch/x86/include/asm/runtime-const.h -- 2.33.0

2 10

[PATCH OLK-6.6 0/2] Fix CVE-2025-39910
by Ze Zuo 05 Feb '26

05 Feb '26

Fix CVE-2025-39910. Alexander Gordeev (1): kasan: avoid sleepable page allocation from atomic context Uladzislau Rezki (Sony) (1): mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc() include/linux/kasan.h | 6 +-- mm/kasan/shadow.c | 111 ++++++++++++++++++++++++++++++++++++------ mm/vmalloc.c | 8 +-- 3 files changed, 103 insertions(+), 22 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6 0/2] Fixes CVE-2025-38627
by Ze Zuo 05 Feb '26

05 Feb '26

Fixes CVE-2025-38627. Zhiguo Niu (2): f2fs: compress: change the first parameter of page_array_{alloc,free} to sbi f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic fs/f2fs/compress.c | 74 +++++++++++++++++++++++----------------------- fs/f2fs/f2fs.h | 2 ++ 2 files changed, 39 insertions(+), 37 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6 0/2] Fixs CVE-2025-22090
by Ze Zuo 05 Feb '26

05 Feb '26

Fixs CVE-2025-22090 David Hildenbrand (2): x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() mm: (un)track_pfn_copy() fix + doc improvements arch/x86/mm/pat/memtype.c | 52 +++++++++++++++++++++------------------ include/linux/pgtable.h | 31 ++++++++++++++++++----- kernel/fork.c | 4 +++ mm/memory.c | 11 +++------ 4 files changed, 61 insertions(+), 37 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6 0/9] CVE-2024-50102
by Qi Xi 05 Feb '26

05 Feb '26

David Gow (1): x86/uaccess: Zero the 8-byte get_range case on failure on 32-bit David Laight (1): x86: fix off-by-one in access_ok() Linus Torvalds (5): runtime constants: deal with old decrepit linkers runtime constants: add x86 architecture support x86: fix whitespace in runtime-const assembler output x86/uaccess: Improve the 8-byte getuser() case x86: fix user address masking non-canonical speculation issue Stephen Brennan (1): dcache: keep dentry_hashtable or d_hash_shift even when not used Thomas Gleixner (1): x86/uaccess: Add missing __force to casts in __access_ok() and valid_user_address() arch/x86/include/asm/runtime-const.h | 61 +++++++++++++++++++++ arch/x86/include/asm/uaccess_64.h | 49 ++++++++++------- arch/x86/kernel/cpu/common.c | 10 ++++ arch/x86/kernel/vmlinux.lds.S | 4 ++ arch/x86/lib/getuser.S | 80 ++++++++++------------------ fs/dcache.c | 9 +++- include/asm-generic/vmlinux.lds.h | 7 +++ 7 files changed, 149 insertions(+), 71 deletions(-) create mode 100644 arch/x86/include/asm/runtime-const.h -- 2.33.0

2 10

[PATCH OLK-6.6 0/2] Fix CVE-2025-21696
by Ze Zuo 05 Feb '26

05 Feb '26

Fix CVE-2025-21696. Lokesh Gidra (1): userfaultfd: move userfaultfd_ctx struct to header file Ryan Roberts (1): mm: clear uffd-wp PTE/PMD state on mremap() fs/userfaultfd.c | 39 --------------------------- include/linux/userfaultfd_k.h | 51 +++++++++++++++++++++++++++++++++++ mm/huge_memory.c | 12 +++++++++ mm/hugetlb.c | 14 +++++++++- mm/mremap.c | 32 +++++++++++++++++++++- 5 files changed, 107 insertions(+), 41 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6 00/18] backport some net bugfix from 6.6 lts
by Zhang Changzhong 05 Feb '26

05 Feb '26

Alexey Simakov (1): sctp: avoid NULL dereference when chunk data buffer is missing Eric Dumazet (2): sctp: initialize more fields in sctp_v6_from_sk() sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto Hans de Goede (1): net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer Ido Schimmel (1): nexthop: Forbid FDB status change while nexthop is in a group Ilya Dryomov (1): libceph: fix potential use-after-free in have_mon_and_osd_map() Jakub Kicinski (1): tls: fix handling of zero-length records on the rx_list Jakub Ramaseuski (1): net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM Kuniyuki Iwashima (2): tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). tipc: Fix use-after-free in tipc_mon_reinit_self(). Paul Chaignon (1): bpf: Explicitly check accesses to bpf_sock_addr Slavin Liu (1): ipvs: Defer ip_vs_ftp unregister during netns cleanup Stefan Wiehler (3): sctp: Hold RCU read lock while iterating over address list sctp: Prevent TOCTOU out-of-bounds write sctp: Hold sock lock while iterating over address list Wang Liang (1): netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm ziming zhang (2): libceph: prevent potential out-of-bounds writes in handle_auth_session_key() libceph: replace BUG_ON with bounds check for map->max_osd net/bridge/br_netfilter_hooks.c | 3 --- net/ceph/auth_x.c | 2 ++ net/ceph/ceph_common.c | 53 +++++++++++++++++++++++++---------------- net/ceph/debugfs.c | 14 +++++++---- net/ceph/osdmap.c | 18 ++++++++------ net/core/dev.c | 12 ++++++++++ net/core/filter.c | 16 ++++++++----- net/ipv4/nexthop.c | 7 ++++++ net/ipv4/tcp.c | 5 ++++ net/netfilter/ipvs/ip_vs_ftp.c | 4 +++- net/rfkill/rfkill-gpio.c | 4 ++-- net/sctp/diag.c | 21 ++++++++++++---- net/sctp/inqueue.c | 13 +++++----- net/sctp/ipv6.c | 2 ++ net/sctp/transport.c | 13 ++++++---- net/tipc/net.c | 2 ++ net/tls/tls_sw.c | 7 +++++- 17 files changed, 136 insertions(+), 60 deletions(-) -- 2.9.5

2 19

[PATCH OLK-6.6] x86/CPU/AMD: Add RDSEED fix for Zen5
by Bowen You 05 Feb '26

05 Feb '26

From: Gregory Price <gourry(a)gourry.net> mainline inclusion from mainline-v6.18-rc3 commit 607b9fb2ce248cc5b633c5949e0153838992c152 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/11500 CVE: CVE-2025-68313 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… There's an issue with RDSEED's 16-bit and 32-bit register output variants on Zen5 which return a random value of 0 "at a rate inconsistent with randomness while incorrectly signaling success (CF=1)". Search the web for AMD-SB-7055 for more detail. Add a fix glue which checks microcode revisions. [ bp: Add microcode revisions checking, rewrite. ] Cc: stable(a)vger.kernel.org Signed-off-by: Gregory Price <gourry(a)gourry.net> Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Link: https://lore.kernel.org/r/20251018024010.4112396-1-gourry@gourry.net Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- arch/x86/kernel/cpu/amd.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c index d7a8f8bb9026..9990e058b6e8 100644 --- a/arch/x86/kernel/cpu/amd.c +++ b/arch/x86/kernel/cpu/amd.c @@ -1128,8 +1128,18 @@ static void init_amd_zen4(struct cpuinfo_x86 *c) } } +static const struct x86_cpu_id zen5_rdseed_microcode[] = { + ZEN_MODEL_STEP_UCODE(0x1a, 0x02, 0x1, 0x0b00215a), + ZEN_MODEL_STEP_UCODE(0x1a, 0x11, 0x0, 0x0b101054), +}; + static void init_amd_zen5(struct cpuinfo_x86 *c) { + if (!x86_match_min_microcode_rev(zen5_rdseed_microcode)) { + clear_cpu_cap(c, X86_FEATURE_RDSEED); + msr_clear_bit(MSR_AMD64_CPUID_FN_7, 18); + pr_emerg_once("RDSEED32 is broken. Disabling the corresponding CPUID bit.\n"); + } } static void init_amd(struct cpuinfo_x86 *c) -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/2] nohz_full stall
by Zicheng Qu 05 Feb '26

05 Feb '26

Vincent Guittot (1): sched/fair: Prevent unlimited runtime on throttled group Zicheng Qu (1): sched: Re-evaluate scheduling when migrating queued tasks out of throttled cgroups kernel/sched/core.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] x86/CPU/AMD: Add RDSEED fix for Zen5
by Bowen You 05 Feb '26

05 Feb '26

From: Gregory Price <gourry(a)gourry.net> stable inclusion from stable-v6.12.57 commit e980de2ff109dacb6d9d3a77f01b27c467115ecb category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/11500 CVE: CVE-2025-68313 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… There's an issue with RDSEED's 16-bit and 32-bit register output variants on Zen5 which return a random value of 0 "at a rate inconsistent with randomness while incorrectly signaling success (CF=1)". Search the web for AMD-SB-7055 for more detail. Add a fix glue which checks microcode revisions. [ bp: Add microcode revisions checking, rewrite. ] Cc: stable(a)vger.kernel.org Signed-off-by: Gregory Price <gourry(a)gourry.net> Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Link: https://lore.kernel.org/r/20251018024010.4112396-1-gourry@gourry.net Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- arch/x86/kernel/cpu/amd.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c index d7a8f8bb9026..9990e058b6e8 100644 --- a/arch/x86/kernel/cpu/amd.c +++ b/arch/x86/kernel/cpu/amd.c @@ -1128,8 +1128,18 @@ static void init_amd_zen4(struct cpuinfo_x86 *c) } } +static const struct x86_cpu_id zen5_rdseed_microcode[] = { + ZEN_MODEL_STEP_UCODE(0x1a, 0x02, 0x1, 0x0b00215a), + ZEN_MODEL_STEP_UCODE(0x1a, 0x11, 0x0, 0x0b101054), +}; + static void init_amd_zen5(struct cpuinfo_x86 *c) { + if (!x86_match_min_microcode_rev(zen5_rdseed_microcode)) { + clear_cpu_cap(c, X86_FEATURE_RDSEED); + msr_clear_bit(MSR_AMD64_CPUID_FN_7, 18); + pr_emerg_once("RDSEED32 is broken. Disabling the corresponding CPUID bit.\n"); + } } static void init_amd(struct cpuinfo_x86 *c) -- 2.34.1

2 1

[PATCH OLK-6.6] pmdomain: arm: scmi: Fix genpd leak on provider registration failure
by Bowen You 05 Feb '26

05 Feb '26

From: Sudeep Holla <sudeep.holla(a)arm.com> stable inclusion from stable-v6.6.118 commit ad120c08b89a81d41d091490bbe150343473b659 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/11572 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- If of_genpd_add_provider_onecell() fails during probe, the previously created generic power domains are not removed, leading to a memory leak and potential kernel crash later in genpd_debug_add(). Add proper error handling to unwind the initialized domains before returning from probe to ensure all resources are correctly released on failure. Example crash trace observed without this fix: | Unable to handle kernel paging request at virtual address fffffffffffffc70 | CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.18.0-rc1 #405 PREEMPT | Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development Platform | pstate: 00000005 (nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) | pc : genpd_debug_add+0x2c/0x160 | lr : genpd_debug_init+0x74/0x98 | Call trace: | genpd_debug_add+0x2c/0x160 (P) | genpd_debug_init+0x74/0x98 | do_one_initcall+0xd0/0x2d8 | do_initcall_level+0xa0/0x140 | do_initcalls+0x60/0xa8 | do_basic_setup+0x28/0x40 | kernel_init_freeable+0xe8/0x170 | kernel_init+0x2c/0x140 | ret_from_fork+0x10/0x20 Fixes: 898216c97ed2 ("firmware: arm_scmi: add device power domain support using genpd") Signed-off-by: Sudeep Holla <sudeep.holla(a)arm.com> Reviewed-by: Peng Fan <peng.fan(a)nxp.com> Cc: stable(a)vger.kernel.org Signed-off-by: Ulf Hansson <ulf.hansson(a)linaro.org> Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- drivers/firmware/arm_scmi/scmi_pm_domain.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/drivers/firmware/arm_scmi/scmi_pm_domain.c b/drivers/firmware/arm_scmi/scmi_pm_domain.c index 0e05a79de82d..82d923a9d75d 100644 --- a/drivers/firmware/arm_scmi/scmi_pm_domain.c +++ b/drivers/firmware/arm_scmi/scmi_pm_domain.c @@ -54,7 +54,7 @@ static int scmi_pd_power_off(struct generic_pm_domain *domain) static int scmi_pm_domain_probe(struct scmi_device *sdev) { - int num_domains, i; + int num_domains, i, ret; struct device *dev = &sdev->dev; struct device_node *np = dev->of_node; struct scmi_pm_domain *scmi_pd; @@ -112,9 +112,18 @@ static int scmi_pm_domain_probe(struct scmi_device *sdev) scmi_pd_data->domains = domains; scmi_pd_data->num_domains = num_domains; + ret = of_genpd_add_provider_onecell(np, scmi_pd_data); + if (ret) + goto err_rm_genpds; + dev_set_drvdata(dev, scmi_pd_data); - return of_genpd_add_provider_onecell(np, scmi_pd_data); + return 0; +err_rm_genpds: + for (i = num_domains - 1; i >= 0; i--) + pm_genpd_remove(domains[i]); + + return ret; } static void scmi_pm_domain_remove(struct scmi_device *sdev) -- 2.34.1

2 1

[PATCH OLK-6.6] powerpc/64s/slb: Fix SLB multihit issue during SLB preload
by Zeng Heng 05 Feb '26

05 Feb '26

From: Donet Tom <donettom(a)linux.ibm.com> stable inclusion from stable-v6.6.120 commit b13a3dbfa196af68eae2031f209743735ad416bf category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/13389 CVE: CVE-2025-71078 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 00312419f0863964625d6dcda8183f96849412c6 upstream. On systems using the hash MMU, there is a software SLB preload cache that mirrors the entries loaded into the hardware SLB buffer. This preload cache is subject to periodic eviction — typically after every 256 context switches — to remove old entry. To optimize performance, the kernel skips switch_mmu_context() in switch_mm_irqs_off() when the prev and next mm_struct are the same. However, on hash MMU systems, this can lead to inconsistencies between the hardware SLB and the software preload cache. If an SLB entry for a process is evicted from the software cache on one CPU, and the same process later runs on another CPU without executing switch_mmu_context(), the hardware SLB may retain stale entries. If the kernel then attempts to reload that entry, it can trigger an SLB multi-hit error. The following timeline shows how stale SLB entries are created and can cause a multi-hit error when a process moves between CPUs without a MMU context switch. CPU 0 CPU 1 ----- ----- Process P exec swapper/1 load_elf_binary begin_new_exc activate_mm switch_mm_irqs_off switch_mmu_context switch_slb /* * This invalidates all * the entries in the HW * and setup the new HW * SLB entries as per the * preload cache. */ context_switch sched_migrate_task migrates process P to cpu-1 Process swapper/0 context switch (to process P) (uses mm_struct of Process P) switch_mm_irqs_off() switch_slb load_slb++ /* * load_slb becomes 0 here * and we evict an entry from * the preload cache with * preload_age(). We still * keep HW SLB and preload * cache in sync, that is * because all HW SLB entries * anyways gets evicted in * switch_slb during SLBIA. * We then only add those * entries back in HW SLB, * which are currently * present in preload_cache * (after eviction). */ load_elf_binary continues... setup_new_exec() slb_setup_new_exec() sched_switch event sched_migrate_task migrates process P to cpu-0 context_switch from swapper/0 to Process P switch_mm_irqs_off() /* * Since both prev and next mm struct are same we don't call * switch_mmu_context(). This will cause the HW SLB and SW preload * cache to go out of sync in preload_new_slb_context. Because there * was an SLB entry which was evicted from both HW and preload cache * on cpu-1. Now later in preload_new_slb_context(), when we will try * to add the same preload entry again, we will add this to the SW * preload cache and then will add it to the HW SLB. Since on cpu-0 * this entry was never invalidated, hence adding this entry to the HW * SLB will cause a SLB multi-hit error. */ load_elf_binary continues... START_THREAD start_thread preload_new_slb_context /* * This tries to add a new EA to preload cache which was earlier * evicted from both cpu-1 HW SLB and preload cache. This caused the * HW SLB of cpu-0 to go out of sync with the SW preload cache. The * reason for this was, that when we context switched back on CPU-0, * we should have ideally called switch_mmu_context() which will * bring the HW SLB entries on CPU-0 in sync with SW preload cache * entries by setting up the mmu context properly. But we didn't do * that since the prev mm_struct running on cpu-0 was same as the * next mm_struct (which is true for swapper / kernel threads). So * now when we try to add this new entry into the HW SLB of cpu-0, * we hit a SLB multi-hit error. */ WARNING: CPU: 0 PID: 1810970 at arch/powerpc/mm/book3s64/slb.c:62 assert_slb_presence+0x2c/0x50(48 results) 02:47:29 [20157/42149] Modules linked in: CPU: 0 UID: 0 PID: 1810970 Comm: dd Not tainted 6.16.0-rc3-dirty #12 VOLUNTARY Hardware name: IBM pSeries (emulated by qemu) POWER8 (architected) 0x4d0200 0xf000004 of:SLOF,HEAD hv:linux,kvm pSeries NIP: c00000000015426c LR: c0000000001543b4 CTR: 0000000000000000 REGS: c0000000497c77e0 TRAP: 0700 Not tainted (6.16.0-rc3-dirty) MSR: 8000000002823033 <SF,VEC,VSX,FP,ME,IR,DR,RI,LE> CR: 28888482 XER: 00000000 CFAR: c0000000001543b0 IRQMASK: 3 <...> NIP [c00000000015426c] assert_slb_presence+0x2c/0x50 LR [c0000000001543b4] slb_insert_entry+0x124/0x390 Call Trace: 0x7fffceb5ffff (unreliable) preload_new_slb_context+0x100/0x1a0 start_thread+0x26c/0x420 load_elf_binary+0x1b04/0x1c40 bprm_execve+0x358/0x680 do_execveat_common+0x1f8/0x240 sys_execve+0x58/0x70 system_call_exception+0x114/0x300 system_call_common+0x160/0x2c4 >From the above analysis, during early exec the hardware SLB is cleared, and entries from the software preload cache are reloaded into hardware by switch_slb. However, preload_new_slb_context and slb_setup_new_exec also attempt to load some of the same entries, which can trigger a multi-hit. In most cases, these additional preloads simply hit existing entries and add nothing new. Removing these functions avoids redundant preloads and eliminates the multi-hit issue. This patch removes these two functions. We tested process switching performance using the context_switch benchmark on POWER9/hash, and observed no regression. Without this patch: 129041 ops/sec With this patch: 129341 ops/sec We also measured SLB faults during boot, and the counts are essentially the same with and without this patch. SLB faults without this patch: 19727 SLB faults with this patch: 19786 Fixes: 5434ae74629a ("powerpc/64s/hash: Add a SLB preload cache") cc: stable(a)vger.kernel.org Suggested-by: Nicholas Piggin <npiggin(a)gmail.com> Signed-off-by: Donet Tom <donettom(a)linux.ibm.com> Signed-off-by: Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> Signed-off-by: Madhavan Srinivasan <maddy(a)linux.ibm.com> Link: https://patch.msgid.link/0ac694ae683494fe8cadbd911a1a5018d5d3c541.176183416… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuan can <yuancan(a)huawei.com> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/powerpc/include/asm/book3s/64/mmu-hash.h | 1 - arch/powerpc/kernel/process.c | 5 -- arch/powerpc/mm/book3s64/internal.h | 2 - arch/powerpc/mm/book3s64/mmu_context.c | 2 - arch/powerpc/mm/book3s64/slb.c | 88 ------------------- 5 files changed, 98 deletions(-) diff --git a/arch/powerpc/include/asm/book3s/64/mmu-hash.h b/arch/powerpc/include/asm/book3s/64/mmu-hash.h index 1c4eebbc69c9..e1f77e2eead4 100644 --- a/arch/powerpc/include/asm/book3s/64/mmu-hash.h +++ b/arch/powerpc/include/asm/book3s/64/mmu-hash.h @@ -524,7 +524,6 @@ void slb_save_contents(struct slb_entry *slb_ptr); void slb_dump_contents(struct slb_entry *slb_ptr); extern void slb_vmalloc_update(void); -void preload_new_slb_context(unsigned long start, unsigned long sp); #ifdef CONFIG_PPC_64S_HASH_MMU void slb_set_size(u16 size); diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c index 9452a54d356c..dd23025ef2e1 100644 --- a/arch/powerpc/kernel/process.c +++ b/arch/powerpc/kernel/process.c @@ -1882,8 +1882,6 @@ int copy_thread(struct task_struct *p, const struct kernel_clone_args *args) return 0; } -void preload_new_slb_context(unsigned long start, unsigned long sp); - /* * Set up a thread for executing a new program */ @@ -1891,9 +1889,6 @@ void start_thread(struct pt_regs *regs, unsigned long start, unsigned long sp) { #ifdef CONFIG_PPC64 unsigned long load_addr = regs->gpr[2]; /* saved by ELF_PLAT_INIT */ - - if (IS_ENABLED(CONFIG_PPC_BOOK3S_64) && !radix_enabled()) - preload_new_slb_context(start, sp); #endif #ifdef CONFIG_PPC_TRANSACTIONAL_MEM diff --git a/arch/powerpc/mm/book3s64/internal.h b/arch/powerpc/mm/book3s64/internal.h index a57a25f06a21..c26a6f0c90fc 100644 --- a/arch/powerpc/mm/book3s64/internal.h +++ b/arch/powerpc/mm/book3s64/internal.h @@ -24,8 +24,6 @@ static inline bool stress_hpt(void) void hpt_do_stress(unsigned long ea, unsigned long hpte_group); -void slb_setup_new_exec(void); - void exit_lazy_flush_tlb(struct mm_struct *mm, bool always_flush); #endif /* ARCH_POWERPC_MM_BOOK3S64_INTERNAL_H */ diff --git a/arch/powerpc/mm/book3s64/mmu_context.c b/arch/powerpc/mm/book3s64/mmu_context.c index 1715b07c630c..997bc13a690e 100644 --- a/arch/powerpc/mm/book3s64/mmu_context.c +++ b/arch/powerpc/mm/book3s64/mmu_context.c @@ -150,8 +150,6 @@ static int hash__init_new_context(struct mm_struct *mm) void hash__setup_new_exec(void) { slice_setup_new_exec(); - - slb_setup_new_exec(); } #else static inline int hash__init_new_context(struct mm_struct *mm) diff --git a/arch/powerpc/mm/book3s64/slb.c b/arch/powerpc/mm/book3s64/slb.c index f2708c8629a5..8e8d5da7b482 100644 --- a/arch/powerpc/mm/book3s64/slb.c +++ b/arch/powerpc/mm/book3s64/slb.c @@ -328,94 +328,6 @@ static void preload_age(struct thread_info *ti) ti->slb_preload_tail = (ti->slb_preload_tail + 1) % SLB_PRELOAD_NR; } -void slb_setup_new_exec(void) -{ - struct thread_info *ti = current_thread_info(); - struct mm_struct *mm = current->mm; - unsigned long exec = 0x10000000; - - WARN_ON(irqs_disabled()); - - /* - * preload cache can only be used to determine whether a SLB - * entry exists if it does not start to overflow. - */ - if (ti->slb_preload_nr + 2 > SLB_PRELOAD_NR) - return; - - hard_irq_disable(); - - /* - * We have no good place to clear the slb preload cache on exec, - * flush_thread is about the earliest arch hook but that happens - * after we switch to the mm and have already preloaded the SLBEs. - * - * For the most part that's probably okay to use entries from the - * previous exec, they will age out if unused. It may turn out to - * be an advantage to clear the cache before switching to it, - * however. - */ - - /* - * preload some userspace segments into the SLB. - * Almost all 32 and 64bit PowerPC executables are linked at - * 0x10000000 so it makes sense to preload this segment. - */ - if (!is_kernel_addr(exec)) { - if (preload_add(ti, exec)) - slb_allocate_user(mm, exec); - } - - /* Libraries and mmaps. */ - if (!is_kernel_addr(mm->mmap_base)) { - if (preload_add(ti, mm->mmap_base)) - slb_allocate_user(mm, mm->mmap_base); - } - - /* see switch_slb */ - asm volatile("isync" : : : "memory"); - - local_irq_enable(); -} - -void preload_new_slb_context(unsigned long start, unsigned long sp) -{ - struct thread_info *ti = current_thread_info(); - struct mm_struct *mm = current->mm; - unsigned long heap = mm->start_brk; - - WARN_ON(irqs_disabled()); - - /* see above */ - if (ti->slb_preload_nr + 3 > SLB_PRELOAD_NR) - return; - - hard_irq_disable(); - - /* Userspace entry address. */ - if (!is_kernel_addr(start)) { - if (preload_add(ti, start)) - slb_allocate_user(mm, start); - } - - /* Top of stack, grows down. */ - if (!is_kernel_addr(sp)) { - if (preload_add(ti, sp)) - slb_allocate_user(mm, sp); - } - - /* Bottom of heap, grows up. */ - if (heap && !is_kernel_addr(heap)) { - if (preload_add(ti, heap)) - slb_allocate_user(mm, heap); - } - - /* see switch_slb */ - asm volatile("isync" : : : "memory"); - - local_irq_enable(); -} - static void slb_cache_slbie_kernel(unsigned int index) { unsigned long slbie_data = get_paca()->slb_cache[index]; -- 2.25.1

2 1

[PATCH OLK-6.6] mm/huge_memory: fix NULL pointer deference when splitting folio
by Zeng Heng 05 Feb '26

05 Feb '26

From: Wei Yang <richard.weiyang(a)gmail.com> mainline inclusion from mainline-v6.18 commit cff47b9e39a6abf03dde5f4f156f841b0c54bba0 category: bugfix bugzilla: https://gitcode.com/src-openeuler/kernel/issues/11518 CVE: CVE-2025-68293 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Commit c010d47f107f ("mm: thp: split huge page to any lower order pages") introduced an early check on the folio's order via mapping->flags before proceeding with the split work. This check introduced a bug: for shmem folios in the swap cache and truncated folios, the mapping pointer can be NULL. Accessing mapping->flags in this state leads directly to a NULL pointer dereference. This commit fixes the issue by moving the check for mapping != NULL before any attempt to access mapping->flags. Link: https://lkml.kernel.org/r/20251119235302.24773-1-richard.weiyang@gmail.com Fixes: c010d47f107f ("mm: thp: split huge page to any lower order pages") Signed-off-by: Wei Yang <richard.weiyang(a)gmail.com> Reviewed-by: Zi Yan <ziy(a)nvidia.com> Acked-by: David Hildenbrand (Red Hat) <david(a)kernel.org> Reviewed-by: Baolin Wang <baolin.wang(a)linux.alibaba.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: mm/huge_memory.c [Fix context conflicts.] Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- mm/huge_memory.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/mm/huge_memory.c b/mm/huge_memory.c index 2bd84157869e..8ed51bf8a3b4 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -3599,6 +3599,16 @@ int split_huge_page_to_list_to_order(struct page *page, struct list_head *list, VM_BUG_ON_FOLIO(!folio_test_locked(folio), folio); VM_BUG_ON_FOLIO(!folio_test_large(folio), folio); + /* + * Folios that just got truncated cannot get split. Signal to the + * caller that there was a race. + * + * TODO: this will also currently refuse shmem folios that are in the + * swapcache. + */ + if (!is_anon && !folio->mapping) + return -EBUSY; + if (new_order >= folio_order(folio)) return -EINVAL; @@ -3664,12 +3674,6 @@ int split_huge_page_to_list_to_order(struct page *page, struct list_head *list, mapping = folio->mapping; - /* Truncated ? */ - if (!mapping) { - ret = -EBUSY; - goto out; - } - gfp = current_gfp_context(mapping_gfp_mask(mapping) & GFP_RECLAIM_MASK); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/2] nohz_full stall
by Zicheng Qu 05 Feb '26

05 Feb '26

Vincent Guittot (1): sched/fair: Prevent unlimited runtime on throttled group Zicheng Qu (1): sched: Re-evaluate scheduling when migrating queued tasks out of throttled cgroups kernel/sched/core.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] team: fix check for port enabled in team_queue_override_port_prio_changed()
by Ze Zuo 05 Feb '26

05 Feb '26

From: Jiri Pirko <jiri(a)nvidia.com> stable inclusion from stable-v6.6.120 commit 6bfb62b6010a16112dcae52f490e5e0e6abe12a3 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13402 CVE: CVE-2025-71091 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 932ac51d9953eaf77a1252f79b656d4ca86163c6 ] There has been a syzkaller bug reported recently with the following trace: list_del corruption, ffff888058bea080->prev is LIST_POISON2 (dead000000000122) ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:59! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 3 UID: 0 PID: 21246 Comm: syz.0.2928 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:__list_del_entry_valid_or_report+0x13e/0x200 lib/list_debug.c:59 Code: 48 c7 c7 e0 71 f0 8b e8 30 08 ef fc 90 0f 0b 48 89 ef e8 a5 02 55 fd 48 89 ea 48 89 de 48 c7 c7 40 72 f0 8b e8 13 08 ef fc 90 <0f> 0b 48 89 ef e8 88 02 55 fd 48 89 ea 48 b8 00 00 00 00 00 fc ff RSP: 0018:ffffc9000d49f370 EFLAGS: 00010286 RAX: 000000000000004e RBX: ffff888058bea080 RCX: ffffc9002817d000 RDX: 0000000000000000 RSI: ffffffff819becc6 RDI: 0000000000000005 RBP: dead000000000122 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000080000000 R11: 0000000000000001 R12: ffff888039e9c230 R13: ffff888058bea088 R14: ffff888058bea080 R15: ffff888055461480 FS: 00007fbbcfe6f6c0(0000) GS:ffff8880d6d0a000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000110c3afcb0 CR3: 00000000382c7000 CR4: 0000000000352ef0 Call Trace: <TASK> __list_del_entry_valid include/linux/list.h:132 [inline] __list_del_entry include/linux/list.h:223 [inline] list_del_rcu include/linux/rculist.h:178 [inline] __team_queue_override_port_del drivers/net/team/team_core.c:826 [inline] __team_queue_override_port_del drivers/net/team/team_core.c:821 [inline] team_queue_override_port_prio_changed drivers/net/team/team_core.c:883 [inline] team_priority_option_set+0x171/0x2f0 drivers/net/team/team_core.c:1534 team_option_set drivers/net/team/team_core.c:376 [inline] team_nl_options_set_doit+0x8ae/0xe60 drivers/net/team/team_core.c:2653 genl_family_rcv_msg_doit+0x209/0x2f0 net/netlink/genetlink.c:1115 genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline] genl_rcv_msg+0x55c/0x800 net/netlink/genetlink.c:1210 netlink_rcv_skb+0x158/0x420 net/netlink/af_netlink.c:2552 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline] netlink_unicast+0x5aa/0x870 net/netlink/af_netlink.c:1346 netlink_sendmsg+0x8c8/0xdd0 net/netlink/af_netlink.c:1896 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg net/socket.c:742 [inline] ____sys_sendmsg+0xa98/0xc70 net/socket.c:2630 ___sys_sendmsg+0x134/0x1d0 net/socket.c:2684 __sys_sendmsg+0x16d/0x220 net/socket.c:2716 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f The problem is in this flow: 1) Port is enabled, queue_id != 0, in qom_list 2) Port gets disabled -> team_port_disable() -> team_queue_override_port_del() -> del (removed from list) 3) Port is disabled, queue_id != 0, not in any list 4) Priority changes -> team_queue_override_port_prio_changed() -> checks: port disabled && queue_id != 0 -> calls del - hits the BUG as it is removed already To fix this, change the check in team_queue_override_port_prio_changed() so it returns early if port is not enabled. Reported-by: syzbot+422806e5f4cce722a71f(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=422806e5f4cce722a71f Fixes: 6c31ff366c11 ("team: remove synchronize_rcu() called during queue override change") Signed-off-by: Jiri Pirko <jiri(a)nvidia.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://patch.msgid.link/20251212102953.167287-1-jiri@resnulli.us Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- drivers/net/team/team.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c index 1ce3bccd4ebd..9baa13808933 100644 --- a/drivers/net/team/team.c +++ b/drivers/net/team/team.c @@ -876,7 +876,7 @@ static void __team_queue_override_enabled_check(struct team *team) static void team_queue_override_port_prio_changed(struct team *team, struct team_port *port) { - if (!port->queue_id || team_port_enabled(port)) + if (!port->queue_id || !team_port_enabled(port)) return; __team_queue_override_port_del(team, port); __team_queue_override_port_add(team, port); -- 2.25.1

2 1

[PATCH OLK-5.10] team: fix check for port enabled in team_queue_override_port_prio_changed()
by Ze Zuo 05 Feb '26

05 Feb '26

From: Jiri Pirko <jiri(a)nvidia.com> stable inclusion from stable-v6.6.120 commit 6bfb62b6010a16112dcae52f490e5e0e6abe12a3 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13402 CVE: CVE-2025-71091 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 932ac51d9953eaf77a1252f79b656d4ca86163c6 ] There has been a syzkaller bug reported recently with the following trace: list_del corruption, ffff888058bea080->prev is LIST_POISON2 (dead000000000122) ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:59! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 3 UID: 0 PID: 21246 Comm: syz.0.2928 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:__list_del_entry_valid_or_report+0x13e/0x200 lib/list_debug.c:59 Code: 48 c7 c7 e0 71 f0 8b e8 30 08 ef fc 90 0f 0b 48 89 ef e8 a5 02 55 fd 48 89 ea 48 89 de 48 c7 c7 40 72 f0 8b e8 13 08 ef fc 90 <0f> 0b 48 89 ef e8 88 02 55 fd 48 89 ea 48 b8 00 00 00 00 00 fc ff RSP: 0018:ffffc9000d49f370 EFLAGS: 00010286 RAX: 000000000000004e RBX: ffff888058bea080 RCX: ffffc9002817d000 RDX: 0000000000000000 RSI: ffffffff819becc6 RDI: 0000000000000005 RBP: dead000000000122 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000080000000 R11: 0000000000000001 R12: ffff888039e9c230 R13: ffff888058bea088 R14: ffff888058bea080 R15: ffff888055461480 FS: 00007fbbcfe6f6c0(0000) GS:ffff8880d6d0a000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000110c3afcb0 CR3: 00000000382c7000 CR4: 0000000000352ef0 Call Trace: <TASK> __list_del_entry_valid include/linux/list.h:132 [inline] __list_del_entry include/linux/list.h:223 [inline] list_del_rcu include/linux/rculist.h:178 [inline] __team_queue_override_port_del drivers/net/team/team_core.c:826 [inline] __team_queue_override_port_del drivers/net/team/team_core.c:821 [inline] team_queue_override_port_prio_changed drivers/net/team/team_core.c:883 [inline] team_priority_option_set+0x171/0x2f0 drivers/net/team/team_core.c:1534 team_option_set drivers/net/team/team_core.c:376 [inline] team_nl_options_set_doit+0x8ae/0xe60 drivers/net/team/team_core.c:2653 genl_family_rcv_msg_doit+0x209/0x2f0 net/netlink/genetlink.c:1115 genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline] genl_rcv_msg+0x55c/0x800 net/netlink/genetlink.c:1210 netlink_rcv_skb+0x158/0x420 net/netlink/af_netlink.c:2552 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline] netlink_unicast+0x5aa/0x870 net/netlink/af_netlink.c:1346 netlink_sendmsg+0x8c8/0xdd0 net/netlink/af_netlink.c:1896 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg net/socket.c:742 [inline] ____sys_sendmsg+0xa98/0xc70 net/socket.c:2630 ___sys_sendmsg+0x134/0x1d0 net/socket.c:2684 __sys_sendmsg+0x16d/0x220 net/socket.c:2716 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f The problem is in this flow: 1) Port is enabled, queue_id != 0, in qom_list 2) Port gets disabled -> team_port_disable() -> team_queue_override_port_del() -> del (removed from list) 3) Port is disabled, queue_id != 0, not in any list 4) Priority changes -> team_queue_override_port_prio_changed() -> checks: port disabled && queue_id != 0 -> calls del - hits the BUG as it is removed already To fix this, change the check in team_queue_override_port_prio_changed() so it returns early if port is not enabled. Reported-by: syzbot+422806e5f4cce722a71f(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=422806e5f4cce722a71f Fixes: 6c31ff366c11 ("team: remove synchronize_rcu() called during queue override change") Signed-off-by: Jiri Pirko <jiri(a)nvidia.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://patch.msgid.link/20251212102953.167287-1-jiri@resnulli.us Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- drivers/net/team/team.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c index 49d7030ddc1b..ea5a75e7ee53 100644 --- a/drivers/net/team/team.c +++ b/drivers/net/team/team.c @@ -872,7 +872,7 @@ static void __team_queue_override_enabled_check(struct team *team) static void team_queue_override_port_prio_changed(struct team *team, struct team_port *port) { - if (!port->queue_id || team_port_enabled(port)) + if (!port->queue_id || !team_port_enabled(port)) return; __team_queue_override_port_del(team, port); __team_queue_override_port_add(team, port); -- 2.25.1

2 1

[PATCH OLK-6.6] mm/page_alloc: prevent pcp corruption with SMP=n
by Ze Zuo 05 Feb '26

05 Feb '26

From: Vlastimil Babka <vbabka(a)suse.cz> stable inclusion from stable-v6.6.122 commit 4a04ff9cd816e7346fcc8126f00ed80481f6569d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13530 CVE: CVE-2026-23025 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 038a102535eb49e10e93eafac54352fcc5d78847 ] The kernel test robot has reported: BUG: spinlock trylock failure on UP on CPU#0, kcompactd0/28 lock: 0xffff888807e35ef0, .magic: dead4ead, .owner: kcompactd0/28, .owner_cpu: 0 CPU: 0 UID: 0 PID: 28 Comm: kcompactd0 Not tainted 6.18.0-rc5-00127-ga06157804399 #1 PREEMPT 8cc09ef94dcec767faa911515ce9e609c45db470 Call Trace: <IRQ> __dump_stack (lib/dump_stack.c:95) dump_stack_lvl (lib/dump_stack.c:123) dump_stack (lib/dump_stack.c:130) spin_dump (kernel/locking/spinlock_debug.c:71) do_raw_spin_trylock (kernel/locking/spinlock_debug.c:?) _raw_spin_trylock (include/linux/spinlock_api_smp.h:89 kernel/locking/spinlock.c:138) __free_frozen_pages (mm/page_alloc.c:2973) ___free_pages (mm/page_alloc.c:5295) __free_pages (mm/page_alloc.c:5334) tlb_remove_table_rcu (include/linux/mm.h:? include/linux/mm.h:3122 include/asm-generic/tlb.h:220 mm/mmu_gather.c:227 mm/mmu_gather.c:290) ? __cfi_tlb_remove_table_rcu (mm/mmu_gather.c:289) ? rcu_core (kernel/rcu/tree.c:?) rcu_core (include/linux/rcupdate.h:341 kernel/rcu/tree.c:2607 kernel/rcu/tree.c:2861) rcu_core_si (kernel/rcu/tree.c:2879) handle_softirqs (arch/x86/include/asm/jump_label.h:36 include/trace/events/irq.h:142 kernel/softirq.c:623) __irq_exit_rcu (arch/x86/include/asm/jump_label.h:36 kernel/softirq.c:725) irq_exit_rcu (kernel/softirq.c:741) sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1052) </IRQ> <TASK> RIP: 0010:_raw_spin_unlock_irqrestore (arch/x86/include/asm/preempt.h:95 include/linux/spinlock_api_smp.h:152 kernel/locking/spinlock.c:194) free_pcppages_bulk (mm/page_alloc.c:1494) drain_pages_zone (include/linux/spinlock.h:391 mm/page_alloc.c:2632) __drain_all_pages (mm/page_alloc.c:2731) drain_all_pages (mm/page_alloc.c:2747) kcompactd (mm/compaction.c:3115) kthread (kernel/kthread.c:465) ? __cfi_kcompactd (mm/compaction.c:3166) ? __cfi_kthread (kernel/kthread.c:412) ret_from_fork (arch/x86/kernel/process.c:164) ? __cfi_kthread (kernel/kthread.c:412) ret_from_fork_asm (arch/x86/entry/entry_64.S:255) </TASK> Matthew has analyzed the report and identified that in drain_page_zone() we are in a section protected by spin_lock(&pcp->lock) and then get an interrupt that attempts spin_trylock() on the same lock. The code is designed to work this way without disabling IRQs and occasionally fail the trylock with a fallback. However, the SMP=n spinlock implementation assumes spin_trylock() will always succeed, and thus it's normally a no-op. Here the enabled lock debugging catches the problem, but otherwise it could cause a corruption of the pcp structure. The problem has been introduced by commit 574907741599 ("mm/page_alloc: leave IRQs enabled for per-cpu page allocations"). The pcp locking scheme recognizes the need for disabling IRQs to prevent nesting spin_trylock() sections on SMP=n, but the need to prevent the nesting in spin_lock() has not been recognized. Fix it by introducing local wrappers that change the spin_lock() to spin_lock_iqsave() with SMP=n and use them in all places that do spin_lock(&pcp->lock). [vbabka(a)suse.cz: add pcp_ prefix to the spin_lock_irqsave wrappers, per Steven] Link: https://lkml.kernel.org/r/20260105-fix-pcp-up-v1-1-5579662d2071@suse.cz Fixes: 574907741599 ("mm/page_alloc: leave IRQs enabled for per-cpu page allocations") Signed-off-by: Vlastimil Babka <vbabka(a)suse.cz> Reported-by: kernel test robot <oliver.sang(a)intel.com> Closes: https://lore.kernel.org/oe-lkp/202512101320.e2f2dd6f-lkp@intel.com Analyzed-by: Matthew Wilcox <willy(a)infradead.org> Link: https://lore.kernel.org/all/aUW05pyc9nZkvY-1@casper.infradead.org/ Acked-by: Mel Gorman <mgorman(a)techsingularity.net> Cc: Brendan Jackman <jackmanb(a)google.com> Cc: Johannes Weiner <hannes(a)cmpxchg.org> Cc: Michal Hocko <mhocko(a)suse.com> Cc: Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> Cc: Steven Rostedt <rostedt(a)goodmis.org> Cc: Suren Baghdasaryan <surenb(a)google.com> Cc: Zi Yan <ziy(a)nvidia.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> [ drop changes to decay_pcp_high() and zone_pcp_update_cacheinfo() ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- mm/page_alloc.c | 37 +++++++++++++++++++++++++++++++++---- 1 file changed, 33 insertions(+), 4 deletions(-) diff --git a/mm/page_alloc.c b/mm/page_alloc.c index 2bc511aa784c..aeb4ad15f751 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -164,6 +164,33 @@ static DEFINE_MUTEX(pcp_batch_high_lock); #define pcp_spin_unlock(ptr) \ pcpu_spin_unlock(lock, ptr) +/* + * With the UP spinlock implementation, when we spin_lock(&pcp->lock) (for i.e. + * a potentially remote cpu drain) and get interrupted by an operation that + * attempts pcp_spin_trylock(), we can't rely on the trylock failure due to UP + * spinlock assumptions making the trylock a no-op. So we have to turn that + * spin_lock() to a spin_lock_irqsave(). This works because on UP there are no + * remote cpu's so we can only be locking the only existing local one. + */ +#if defined(CONFIG_SMP) || defined(CONFIG_PREEMPT_RT) +static inline void __flags_noop(unsigned long *flags) { } +#define pcp_spin_lock_maybe_irqsave(ptr, flags) \ +({ \ + __flags_noop(&(flags)); \ + spin_lock(&(ptr)->lock); \ +}) +#define pcp_spin_unlock_maybe_irqrestore(ptr, flags) \ +({ \ + spin_unlock(&(ptr)->lock); \ + __flags_noop(&(flags)); \ +}) +#else +#define pcp_spin_lock_maybe_irqsave(ptr, flags) \ + spin_lock_irqsave(&(ptr)->lock, flags) +#define pcp_spin_unlock_maybe_irqrestore(ptr, flags) \ + spin_unlock_irqrestore(&(ptr)->lock, flags) +#endif + #ifdef CONFIG_USE_PERCPU_NUMA_NODE_ID DEFINE_PER_CPU(int, numa_node); EXPORT_PER_CPU_SYMBOL(numa_node); @@ -2391,14 +2418,15 @@ int decay_pcp_high(struct zone *zone, struct per_cpu_pages *pcp) */ void drain_zone_pages(struct zone *zone, struct per_cpu_pages *pcp) { + unsigned long UP_flags; int to_drain, batch; batch = READ_ONCE(pcp->batch); to_drain = min(pcp->count, batch); if (to_drain > 0) { - spin_lock(&pcp->lock); + pcp_spin_lock_maybe_irqsave(pcp, UP_flags); free_pcppages_bulk(zone, to_drain, pcp, 0); - spin_unlock(&pcp->lock); + pcp_spin_unlock_maybe_irqrestore(pcp, UP_flags); } } #endif @@ -2409,10 +2437,11 @@ void drain_zone_pages(struct zone *zone, struct per_cpu_pages *pcp) static void drain_pages_zone(unsigned int cpu, struct zone *zone) { struct per_cpu_pages *pcp = per_cpu_ptr(zone->per_cpu_pageset, cpu); + unsigned long UP_flags; int count; do { - spin_lock(&pcp->lock); + pcp_spin_lock_maybe_irqsave(pcp, UP_flags); count = pcp->count; if (count) { int to_drain = min(count, @@ -2421,7 +2450,7 @@ static void drain_pages_zone(unsigned int cpu, struct zone *zone) free_pcppages_bulk(zone, to_drain, pcp, 0); count -= to_drain; } - spin_unlock(&pcp->lock); + pcp_spin_unlock_maybe_irqrestore(pcp, UP_flags); } while (count); } -- 2.25.1

2 1

[PATCH OLK-6.6 0/4] fix cve-2025-40300
by Bowen You 05 Feb '26

05 Feb '26

*** BLURB HERE *** Bowen You (1): config: enable CONFIG_MITIGATION_VMESCAPE by default on x86 Pawan Gupta (3): x86/vmscape: Add conditional IBPB mitigation x86/vmscape: Enumerate VMSCAPE bug x86/vmscape: Enable the mitigation .../ABI/testing/sysfs-devices-system-cpu | 1 + .../admin-guide/kernel-parameters.txt | 11 +++ arch/x86/Kconfig | 9 ++ arch/x86/configs/openeuler_defconfig | 1 + arch/x86/include/asm/cpufeatures.h | 2 + arch/x86/include/asm/entry-common.h | 7 ++ arch/x86/include/asm/nospec-branch.h | 2 + arch/x86/kernel/cpu/bugs.c | 85 +++++++++++++++++++ arch/x86/kernel/cpu/common.c | 58 +++++++++---- arch/x86/kvm/x86.c | 9 ++ drivers/base/cpu.c | 3 + 11 files changed, 170 insertions(+), 18 deletions(-) -- 2.34.1

2 5

[PATCH OLK-6.6 0/2] CVE-2025-39744 fixup
by Jiacheng Yu 04 Feb '26

04 Feb '26

*** BLURB HERE *** Frederic Weisbecker (1): rcu: Fix racy re-initialization of irq_work causing hangs Joel Fernandes (1): rcu: Fix rcu_read_unlock() deadloop due to IRQ work kernel/rcu/tree.c | 2 ++ kernel/rcu/tree.h | 14 +++++++++++++- kernel/rcu/tree_plugin.h | 41 +++++++++++++++++++++++++++++----------- 3 files changed, 45 insertions(+), 12 deletions(-) -- 2.43.0

2 3

[PATCH OLK-5.10 0/3] CVE-2025-39744 fixup
by Jiacheng Yu 04 Feb '26

04 Feb '26

*** BLURB HERE *** Frederic Weisbecker (1): rcu: Fix racy re-initialization of irq_work causing hangs Joel Fernandes (1): rcu: Fix rcu_read_unlock() deadloop due to IRQ work Zqiang (1): rcu: Use IRQ_WORK_INIT_HARD() to avoid rcu_read_unlock() hangs kernel/rcu/tree.c | 1 + kernel/rcu/tree.h | 14 +++++++++++++- kernel/rcu/tree_plugin.h | 36 ++++++++++++++++++++++++++++++------ 3 files changed, 44 insertions(+), 7 deletions(-) -- 2.43.0

2 4

[PATCH OLK-6.6 0/2] CVE-2025-71141 fixup
by Jiacheng Yu 04 Feb '26

04 Feb '26

*** BLURB HERE *** Kory Maincent (TI.com) (1): drm/tilcdc: Fix removal actions in case of failed probe Philipp Stanner (1): drm/tilcdc: request and mapp iomem with devres drivers/gpu/drm/tilcdc/tilcdc_crtc.c | 2 +- drivers/gpu/drm/tilcdc/tilcdc_drv.c | 72 +++++++++++++++------------- drivers/gpu/drm/tilcdc/tilcdc_drv.h | 2 +- 3 files changed, 41 insertions(+), 35 deletions(-) -- 2.43.0

2 3

[PATCH OLK-6.6] dmaengine: stm32: dmamux: fix device leak on route allocation
by Yin Tirui 04 Feb '26

04 Feb '26

From: Johan Hovold <johan(a)kernel.org> stable inclusion from stable-v6.6.122 commit 1a179ac01ff3993ab97e33cc77c316ed7415cda1 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13527 CVE: CVE-2025-71186 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit dd6e4943889fb354efa3f700e42739da9bddb6ef ] Make sure to drop the reference taken when looking up the DMA mux platform device during route allocation. Note that holding a reference to a device does not prevent its driver data from going away so there is no point in keeping the reference. Fixes: df7e762db5f6 ("dmaengine: Add STM32 DMAMUX driver") Cc: stable(a)vger.kernel.org # 4.15 Cc: Pierre-Yves MORDRET <pierre-yves.mordret(a)foss.st.com> Signed-off-by: Johan Hovold <johan(a)kernel.org> Reviewed-by: Amelie Delaunay <amelie.delaunay(a)foss.st.com> Link: https://patch.msgid.link/20251117161258.10679-11-johan@kernel.org Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yin Tirui <yintirui(a)huawei.com> --- drivers/dma/stm32-dmamux.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/drivers/dma/stm32-dmamux.c b/drivers/dma/stm32-dmamux.c index 8d77e2a7939a..791179760782 100644 --- a/drivers/dma/stm32-dmamux.c +++ b/drivers/dma/stm32-dmamux.c @@ -90,23 +90,25 @@ static void *stm32_dmamux_route_allocate(struct of_phandle_args *dma_spec, struct stm32_dmamux_data *dmamux = platform_get_drvdata(pdev); struct stm32_dmamux *mux; u32 i, min, max; - int ret; + int ret = -EINVAL; unsigned long flags; if (dma_spec->args_count != 3) { dev_err(&pdev->dev, "invalid number of dma mux args\n"); - return ERR_PTR(-EINVAL); + goto err_put_pdev; } if (dma_spec->args[0] > dmamux->dmamux_requests) { dev_err(&pdev->dev, "invalid mux request number: %d\n", dma_spec->args[0]); - return ERR_PTR(-EINVAL); + goto err_put_pdev; } mux = kzalloc(sizeof(*mux), GFP_KERNEL); - if (!mux) - return ERR_PTR(-ENOMEM); + if (!mux) { + ret = -ENOMEM; + goto err_put_pdev; + } spin_lock_irqsave(&dmamux->lock, flags); mux->chan_id = find_first_zero_bit(dmamux->dma_inuse, @@ -133,7 +135,6 @@ static void *stm32_dmamux_route_allocate(struct of_phandle_args *dma_spec, dma_spec->np = of_parse_phandle(ofdma->of_node, "dma-masters", i - 1); if (!dma_spec->np) { dev_err(&pdev->dev, "can't get dma master\n"); - ret = -EINVAL; goto error; } @@ -160,6 +161,8 @@ static void *stm32_dmamux_route_allocate(struct of_phandle_args *dma_spec, dev_dbg(&pdev->dev, "Mapping DMAMUX(%u) to DMA%u(%u)\n", mux->request, mux->master, mux->chan_id); + put_device(&pdev->dev); + return mux; error: @@ -167,6 +170,9 @@ static void *stm32_dmamux_route_allocate(struct of_phandle_args *dma_spec, error_chan_id: kfree(mux); +err_put_pdev: + put_device(&pdev->dev); + return ERR_PTR(ret); } -- 2.43.0

2 1