- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] tipc: fix an information leak in tipc_topsrv_kern_subscr
by Wang Liang 29 Oct '25

29 Oct '25

From: Alexander Potapenko <glider(a)google.com> stable inclusion from stable-v4.19.264 commit 3d1b83ff7b6575a4e41283203e6b2e25ea700cd7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID0VFZ CVE: CVE-2022-50531 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 777ecaabd614d47c482a5c9031579e66da13989a ] Use a 8-byte write to initialize sub.usr_handle in tipc_topsrv_kern_subscr(), otherwise four bytes remain uninitialized when issuing setsockopt(..., SOL_TIPC, ...). This resulted in an infoleak reported by KMSAN when the packet was received: ===================================================== BUG: KMSAN: kernel-infoleak in copyout+0xbc/0x100 lib/iov_iter.c:169 instrument_copy_to_user ./include/linux/instrumented.h:121 copyout+0xbc/0x100 lib/iov_iter.c:169 _copy_to_iter+0x5c0/0x20a0 lib/iov_iter.c:527 copy_to_iter ./include/linux/uio.h:176 simple_copy_to_iter+0x64/0xa0 net/core/datagram.c:513 __skb_datagram_iter+0x123/0xdc0 net/core/datagram.c:419 skb_copy_datagram_iter+0x58/0x200 net/core/datagram.c:527 skb_copy_datagram_msg ./include/linux/skbuff.h:3903 packet_recvmsg+0x521/0x1e70 net/packet/af_packet.c:3469 ____sys_recvmsg+0x2c4/0x810 net/socket.c:? ___sys_recvmsg+0x217/0x840 net/socket.c:2743 __sys_recvmsg net/socket.c:2773 __do_sys_recvmsg net/socket.c:2783 __se_sys_recvmsg net/socket.c:2780 __x64_sys_recvmsg+0x364/0x540 net/socket.c:2780 do_syscall_x64 arch/x86/entry/common.c:50 do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd arch/x86/entry/entry_64.S:120 ... Uninit was stored to memory at: tipc_sub_subscribe+0x42d/0xb50 net/tipc/subscr.c:156 tipc_conn_rcv_sub+0x246/0x620 net/tipc/topsrv.c:375 tipc_topsrv_kern_subscr+0x2e8/0x400 net/tipc/topsrv.c:579 tipc_group_create+0x4e7/0x7d0 net/tipc/group.c:190 tipc_sk_join+0x2a8/0x770 net/tipc/socket.c:3084 tipc_setsockopt+0xae5/0xe40 net/tipc/socket.c:3201 __sys_setsockopt+0x87f/0xdc0 net/socket.c:2252 __do_sys_setsockopt net/socket.c:2263 __se_sys_setsockopt net/socket.c:2260 __x64_sys_setsockopt+0xe0/0x160 net/socket.c:2260 do_syscall_x64 arch/x86/entry/common.c:50 do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd arch/x86/entry/entry_64.S:120 Local variable sub created at: tipc_topsrv_kern_subscr+0x57/0x400 net/tipc/topsrv.c:562 tipc_group_create+0x4e7/0x7d0 net/tipc/group.c:190 Bytes 84-87 of 88 are uninitialized Memory access of size 88 starts at ffff88801ed57cd0 Data copied to user address 0000000020000400 ... ===================================================== Signed-off-by: Alexander Potapenko <glider(a)google.com> Fixes: 026321c6d056a5 ("tipc: rename tipc_server to tipc_topsrv") Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: net/tipc/topsrv.c [conflicts due to merged c0464c490f2b ("tipc: set con sock in tipc_conn_alloc")] Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/tipc/topsrv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/tipc/topsrv.c b/net/tipc/topsrv.c index 5f704c76827b..d6d7adee0466 100644 --- a/net/tipc/topsrv.c +++ b/net/tipc/topsrv.c @@ -577,7 +577,7 @@ bool tipc_topsrv_kern_subscr(struct net *net, u32 port, u32 type, u32 lower, sub.seq.upper = upper; sub.timeout = TIPC_WAIT_FOREVER; sub.filter = filter; - *(u32 *)&sub.usr_handle = port; + *(u64 *)&sub.usr_handle = (u64)port; con = tipc_conn_alloc(tipc_topsrv(net), NULL); if (IS_ERR(con)) -- 2.34.1

2 1

[PATCH OLK-6.6 V3 00/12] Errata management for VM Live migration
by Jinqian Yang 29 Oct '25

29 Oct '25

v1: https://gitee.com/openeuler/kernel/pulls/18596 v2: https://gitee.com/openeuler/kernel/pulls/18616 v1->v2 changes: 1、Patch#2与Patch#7的KABI修改合并后放到最后一个patch; 2、Patch#5中ERRATUM_1980005的is_midr_in_range_list函数添加static inline; 3、按照主线的合入顺序进行patches的排序。 v2->v3 changes: 1、解决编译错误。 Patch#1 KVM: arm64: Set HCR_EL2.TID1 unconditionally Patch#2 KVM: arm64: Maintain per-VM copy of implementation ID regs Patch#3 KVM: arm64: Load VPIDR_EL2 with the VM's MIDR_EL1 value Patch#4 KVM: arm64: Allow userspace to change the implementation ID registers Reference: https://lore.kernel.org/all/20250225005401.679536-1-oliver.upton@linux.dev/ selftest相关未合入 Patch#5 arm64: Modify _midr_range() functions to read MIDR/REVIDR internally Patch#6 KVM: arm64: Specify hypercall ABI for retrieving target implementations Patch#7 KVM: arm64: Introduce KVM_REG_ARM_VENDOR_HYP_BMAP_2 Patch#8 arm64: Make _midr_in_range_list() an exported function Patch#9 smccc/kvm_guest: Enable errata based on implementation CPUs Reference: https://lore.kernel.org/all/20250221140229.12588-1-shameerali.kolothum.thod… selftest相关未合入 Patch#10 smccc: kvm_guest: Fix kernel builds for 32 bit arm Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… 单patch合入 Patch#11 smccc: kvm_guest: Align with DISCOVER_IMPL_CPUS ABI Reference: https://lore.kernel.org/all/20250327163613.2516073-1-oliver.upton@linux.dev/ 单patch合入 Patch#12 KVM: arm64: fix kvm kabi conflict KABI屏蔽, Patch#2与Patch#7引入, 使用KABI_EXTEND屏蔽。 Jinqian Yang (1): KVM: arm64: fix kvm kabi conflict Oliver Upton (3): KVM: arm64: Set HCR_EL2.TID1 unconditionally KVM: arm64: Load VPIDR_EL2 with the VM's MIDR_EL1 value smccc: kvm_guest: Align with DISCOVER_IMPL_CPUS ABI Sebastian Ott (2): KVM: arm64: Maintain per-VM copy of implementation ID regs KVM: arm64: Allow userspace to change the implementation ID registers Shameer Kolothum (6): arm64: Modify _midr_range() functions to read MIDR/REVIDR internally KVM: arm64: Specify hypercall ABI for retrieving target implementations KVM: arm64: Introduce KVM_REG_ARM_VENDOR_HYP_BMAP_2 arm64: Make _midr_in_range_list() an exported function smccc/kvm_guest: Enable errata based on implementation CPUs smccc: kvm_guest: Fix kernel builds for 32 bit arm Documentation/virt/kvm/api.rst | 18 ++ arch/arm64/include/asm/cache.h | 2 +- arch/arm64/include/asm/cputype.h | 39 ++-- arch/arm64/include/asm/hypervisor.h | 1 + arch/arm64/include/asm/kvm_arm.h | 4 +- arch/arm64/include/asm/kvm_host.h | 13 ++ arch/arm64/include/uapi/asm/kvm.h | 12 + arch/arm64/kernel/cpu_errata.c | 75 ++++++- arch/arm64/kernel/cpufeature.c | 12 +- arch/arm64/kernel/proton-pack.c | 20 +- arch/arm64/kvm/arm.c | 9 + arch/arm64/kvm/hyp/include/hyp/sysreg-sr.h | 30 ++- arch/arm64/kvm/hyp/nvhe/sysreg-sr.c | 4 +- arch/arm64/kvm/hyp/vhe/sysreg-sr.c | 2 +- arch/arm64/kvm/hypercalls.c | 13 ++ arch/arm64/kvm/sys_regs.c | 245 ++++++++++++--------- arch/arm64/kvm/vgic/vgic-v3.c | 2 +- drivers/clocksource/arm_arch_timer.c | 2 +- drivers/firmware/smccc/kvm_guest.c | 66 ++++++ drivers/perf/arm_pmuv3.c | 2 +- drivers/platform/mpam/mpam_devices.c | 6 +- include/linux/arm-smccc.h | 16 ++ include/uapi/linux/kvm.h | 3 + 23 files changed, 438 insertions(+), 158 deletions(-) -- 2.33.0

2 13

[PATCH OLK-6.6 0/1] CVE-2025-39982
by Yongqiang Liu 29 Oct '25

29 Oct '25

Luiz Augusto von Dentz (1): Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync include/net/bluetooth/hci_core.h | 21 +++++++++++++++++++++ net/bluetooth/hci_event.c | 26 +++++++++++++++++++++++--- 2 files changed, 44 insertions(+), 3 deletions(-) -- 2.43.0

2 2

[openeuler:OLK-6.6 2972/2972] versioncheck: ./drivers/gpu/drm/phytium/phytium_gem.c: 9 linux/version.h not needed.
by kernel test robot 29 Oct '25

29 Oct '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: ab8573e771fc00691b546bfb1b7432ed6b19f9bc commit: b80df10f845813bb4fc2002b5386ecdfa8be5f6c [2972/2972] DRM: Phytium display DRM driver reproduce: (https://download.01.org/0day-ci/archive/20251029/202510290415.MIZDNB9I-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202510290415.MIZDNB9I-lkp@intel.com/ versioncheck warnings: (new ones prefixed by >>) INFO PATH=/opt/cross/clang-20/bin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin /usr/bin/timeout -k 100 3h /usr/bin/make KCFLAGS= -fno-crash-diagnostics -Wno-error=return-type -Wreturn-type -funsigned-char -Wundef W=1 --keep-going LLVM=1 -j32 ARCH=x86_64 versioncheck find ./* \( -name SCCS -o -name BitKeeper -o -name .svn -o -name CVS -o -name .pc -o -name .hg -o -name .git \) -prune -o \ -name '*.[hcS]' -type f -print | sort \ | xargs perl -w ./scripts/checkversion.pl ./drivers/accessibility/speakup/genmap.c: 13 linux/version.h not needed. ./drivers/accessibility/speakup/makemapdata.c: 13 linux/version.h not needed. ./drivers/char/ipmi/ipmi_si_ls2k500.c: 19 linux/version.h not needed. >> ./drivers/gpu/drm/phytium/phytium_gem.c: 9 linux/version.h not needed. ./drivers/i2c/busses/i2c-zhaoxin.c: 15 linux/version.h not needed. ./drivers/staging/media/atomisp/include/linux/atomisp.h: 23 linux/version.h not needed. ./fs/proc/etmem_scan.c: 13 linux/version.h not needed. ./samples/bpf/spintest.bpf.c: 8 linux/version.h not needed. ./samples/trace_events/trace_custom_sched.c: 11 linux/version.h not needed. ./sound/soc/codecs/cs42l42.c: 14 linux/version.h not needed. ./tools/lib/bpf/bpf_helpers.h: 402: need linux/version.h ./tools/testing/selftests/bpf/progs/dev_cgroup.c: 9 linux/version.h not needed. ./tools/testing/selftests/bpf/progs/netcnt_prog.c: 3 linux/version.h not needed. ./tools/testing/selftests/bpf/progs/test_map_lock.c: 4 linux/version.h not needed. ./tools/testing/selftests/bpf/progs/test_send_signal_kern.c: 4 linux/version.h not needed. ./tools/testing/selftests/bpf/progs/test_spin_lock.c: 4 linux/version.h not needed. ./tools/testing/selftests/bpf/progs/test_tcp_estats.c: 37 linux/version.h not needed. ./tools/testing/selftests/wireguard/qemu/init.c: 27 linux/version.h not needed. -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3058/3058] drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_dev_user.c:458:13: error: assignment to 'struct eventfd_ctx *' from 'int' makes pointer from integer without a cast
by kernel test robot 29 Oct '25

29 Oct '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: ab8573e771fc00691b546bfb1b7432ed6b19f9bc commit: 69181c3c9413ccaa4dab458057d13efda520cb60 [3058/3058] Net: nebula_matrix: fix ci build warning config: x86_64-randconfig-001-20251029 (https://download.01.org/0day-ci/archive/20251029/202510291008.soJ2OPQm-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251029/202510291008.soJ2OPQm-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202510291008.soJ2OPQm-lkp@intel.com/ All errors (new ones prefixed by >>): drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_dev_user.c: In function 'nbl_userdev_set_eventfd': drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_dev_user.c:458:15: error: implicit declaration of function 'eventfd_ctx_fileget'; did you mean 'eventfd_ctx_fdget'? [-Wimplicit-function-declaration] 458 | ctx = eventfd_ctx_fileget(eventfd.file); | ^~~~~~~~~~~~~~~~~~~ | eventfd_ctx_fdget >> drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_dev_user.c:458:13: error: assignment to 'struct eventfd_ctx *' from 'int' makes pointer from integer without a cast [-Wint-conversion] 458 | ctx = eventfd_ctx_fileget(eventfd.file); | ^ drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_dev_user.c: In function 'nbl_userdev_get_bar_size': drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_dev_user.c:475:21: warning: variable 'hw_addr' set but not used [-Wunused-but-set-variable] 475 | u8 __iomem *hw_addr; | ^~~~~~~ drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_dev_user.c: In function 'nbl_userdev_dma_map_ioctl': drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_dev_user.c:676:30: warning: variable 'vfn' set but not used [-Wunused-but-set-variable] 676 | unsigned long vaddr, vfn; | ^~~ vim +458 drivers/net/ethernet/nebula-matrix/nbl/nbl_core/nbl_dev_user.c bad535d287c9c1 Bennie Yan 2024-09-24 436 bad535d287c9c1 Bennie Yan 2024-09-24 437 static long nbl_userdev_set_eventfd(struct nbl_adapter *adapter, unsigned long arg) bad535d287c9c1 Bennie Yan 2024-09-24 438 { bad535d287c9c1 Bennie Yan 2024-09-24 439 struct nbl_dev_mgt *dev_mgt = (struct nbl_dev_mgt *)NBL_ADAPTER_TO_DEV_MGT(adapter); bad535d287c9c1 Bennie Yan 2024-09-24 440 struct nbl_dev_user *user = NBL_DEV_MGT_TO_USER_DEV(dev_mgt); bad535d287c9c1 Bennie Yan 2024-09-24 441 struct nbl_channel_ops *chan_ops = NBL_DEV_MGT_TO_CHAN_OPS(dev_mgt); bad535d287c9c1 Bennie Yan 2024-09-24 442 struct eventfd_ctx *ctx; bad535d287c9c1 Bennie Yan 2024-09-24 443 struct fd eventfd; bad535d287c9c1 Bennie Yan 2024-09-24 444 int fd; bad535d287c9c1 Bennie Yan 2024-09-24 445 long ret = 0; bad535d287c9c1 Bennie Yan 2024-09-24 446 bad535d287c9c1 Bennie Yan 2024-09-24 447 if (get_user(fd, (unsigned long __user *)arg)) { bad535d287c9c1 Bennie Yan 2024-09-24 448 dev_err(NBL_ADAPTER_TO_DEV(adapter), "get user fd failed\n"); bad535d287c9c1 Bennie Yan 2024-09-24 449 return -EFAULT; bad535d287c9c1 Bennie Yan 2024-09-24 450 } bad535d287c9c1 Bennie Yan 2024-09-24 451 bad535d287c9c1 Bennie Yan 2024-09-24 452 eventfd = fdget(fd); bad535d287c9c1 Bennie Yan 2024-09-24 453 if (!eventfd.file) { bad535d287c9c1 Bennie Yan 2024-09-24 454 dev_err(NBL_ADAPTER_TO_DEV(adapter), "get eventfd failed\n"); bad535d287c9c1 Bennie Yan 2024-09-24 455 return -EBADF; bad535d287c9c1 Bennie Yan 2024-09-24 456 } bad535d287c9c1 Bennie Yan 2024-09-24 457 bad535d287c9c1 Bennie Yan 2024-09-24 @458 ctx = eventfd_ctx_fileget(eventfd.file); bad535d287c9c1 Bennie Yan 2024-09-24 459 if (IS_ERR(ctx)) { bad535d287c9c1 Bennie Yan 2024-09-24 460 ret = PTR_ERR(ctx); bad535d287c9c1 Bennie Yan 2024-09-24 461 dev_err(NBL_ADAPTER_TO_DEV(adapter), "get eventfd ctx failed\n"); bad535d287c9c1 Bennie Yan 2024-09-24 462 return ret; bad535d287c9c1 Bennie Yan 2024-09-24 463 } bad535d287c9c1 Bennie Yan 2024-09-24 464 bad535d287c9c1 Bennie Yan 2024-09-24 465 chan_ops->set_listener_info(NBL_DEV_MGT_TO_CHAN_PRIV(dev_mgt), user->shm_msg_ring, ctx); bad535d287c9c1 Bennie Yan 2024-09-24 466 bad535d287c9c1 Bennie Yan 2024-09-24 467 return ret; bad535d287c9c1 Bennie Yan 2024-09-24 468 } bad535d287c9c1 Bennie Yan 2024-09-24 469 :::::: The code at line 458 was first introduced by commit :::::: bad535d287c9c1056d99de3666be7da84de4a8fc Net:nbl_core: Add nbl_core-driver for nebula-matrix S1055AS series smart NIC. :::::: TO: Bennie Yan <bennie.yan(a)nebula-matrix.com> :::::: CC: Bennie Yan <bennie.yan(a)nebula-matrix.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2972/2972] versioncheck: ./drivers/i2c/busses/i2c-zhaoxin.c: 15 linux/version.h not needed.
by kernel test robot 29 Oct '25

29 Oct '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: f974d7dec2997dfe2d417f1c9cc0e2a6adb2d25c commit: 7d6424d8bc9f404652b44c12a5c0b6f52521d514 [2972/2972] Add support for Zhaoxin I2C controller reproduce: (https://download.01.org/0day-ci/archive/20251029/202510290332.JOR51z6Z-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202510290332.JOR51z6Z-lkp@intel.com/ versioncheck warnings: (new ones prefixed by >>) INFO PATH=/opt/cross/clang-20/bin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin /usr/bin/timeout -k 100 3h /usr/bin/make KCFLAGS= -fno-crash-diagnostics -Wno-error=return-type -Wreturn-type -funsigned-char -Wundef W=1 --keep-going LLVM=1 -j32 ARCH=x86_64 versioncheck find ./* \( -name SCCS -o -name BitKeeper -o -name .svn -o -name CVS -o -name .pc -o -name .hg -o -name .git \) -prune -o \ -name '*.[hcS]' -type f -print | sort \ | xargs perl -w ./scripts/checkversion.pl ./drivers/accessibility/speakup/genmap.c: 13 linux/version.h not needed. ./drivers/accessibility/speakup/makemapdata.c: 13 linux/version.h not needed. >> ./drivers/i2c/busses/i2c-zhaoxin.c: 15 linux/version.h not needed. ./drivers/staging/media/atomisp/include/linux/atomisp.h: 23 linux/version.h not needed. ./samples/bpf/spintest.bpf.c: 8 linux/version.h not needed. ./samples/trace_events/trace_custom_sched.c: 11 linux/version.h not needed. ./sound/soc/codecs/cs42l42.c: 14 linux/version.h not needed. ./tools/lib/bpf/bpf_helpers.h: 402: need linux/version.h ./tools/testing/selftests/bpf/progs/dev_cgroup.c: 9 linux/version.h not needed. ./tools/testing/selftests/bpf/progs/netcnt_prog.c: 3 linux/version.h not needed. ./tools/testing/selftests/bpf/progs/test_map_lock.c: 4 linux/version.h not needed. ./tools/testing/selftests/bpf/progs/test_send_signal_kern.c: 4 linux/version.h not needed. ./tools/testing/selftests/bpf/progs/test_spin_lock.c: 4 linux/version.h not needed. ./tools/testing/selftests/bpf/progs/test_tcp_estats.c: 37 linux/version.h not needed. ./tools/testing/selftests/wireguard/qemu/init.c: 27 linux/version.h not needed. -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] tracing: dynevent: Add a missing lockdown check on dynevent
by Tengda Wu 29 Oct '25

29 Oct '25

From: "Masami Hiramatsu (Google)" <mhiramat(a)kernel.org> stable inclusion from stable-v6.6.114 commit 3887f3814c0e770e6b73567fe0f83a2c01a6470c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID3FR6 CVE: CVE-2025-40021 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 456c32e3c4316654f95f9d49c12cbecfb77d5660 upstream. Since dynamic_events interface on tracefs is compatible with kprobe_events and uprobe_events, it should also check the lockdown status and reject if it is set. Link: https://lore.kernel.org/all/175824455687.45175.3734166065458520748.stgit@de… Fixes: 17911ff38aa5 ("tracing: Add locked_down checks to the open calls of files created for tracefs") Signed-off-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org> Cc: stable(a)vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/trace/trace_dynevent.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/kernel/trace/trace_dynevent.c b/kernel/trace/trace_dynevent.c index c9b0533407ed..76737492e750 100644 --- a/kernel/trace/trace_dynevent.c +++ b/kernel/trace/trace_dynevent.c @@ -239,6 +239,10 @@ static int dyn_event_open(struct inode *inode, struct file *file) { int ret; + ret = security_locked_down(LOCKDOWN_TRACEFS); + if (ret) + return ret; + ret = tracing_check_open_get_tr(NULL); if (ret) return ret; -- 2.34.1

2 1

[PATCH OLK-5.10] tracing: dynevent: Add a missing lockdown check on dynevent
by Tengda Wu 29 Oct '25

29 Oct '25

From: "Masami Hiramatsu (Google)" <mhiramat(a)kernel.org> stable inclusion from stable-v5.10.245 commit f3ac1f4eaba58e57943efa3e8b8d71fa7aab0abf category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID3FR6 CVE: CVE-2025-40021 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 456c32e3c4316654f95f9d49c12cbecfb77d5660 upstream. Since dynamic_events interface on tracefs is compatible with kprobe_events and uprobe_events, it should also check the lockdown status and reject if it is set. Link: https://lore.kernel.org/all/175824455687.45175.3734166065458520748.stgit@de… Fixes: 17911ff38aa5 ("tracing: Add locked_down checks to the open calls of files created for tracefs") Signed-off-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org> Cc: stable(a)vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/trace/trace_dynevent.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/kernel/trace/trace_dynevent.c b/kernel/trace/trace_dynevent.c index 33d7057d83b0..a10e2f2de70f 100644 --- a/kernel/trace/trace_dynevent.c +++ b/kernel/trace/trace_dynevent.c @@ -190,6 +190,10 @@ static int dyn_event_open(struct inode *inode, struct file *file) { int ret; + ret = security_locked_down(LOCKDOWN_TRACEFS); + if (ret) + return ret; + ret = tracing_check_open_get_tr(NULL); if (ret) return ret; -- 2.34.1

2 1

[PATCH OLK-6.6 v3 00/12] Errata management for VM Live migration
by Jinqian Yang 29 Oct '25

29 Oct '25

v1: https://gitee.com/openeuler/kernel/pulls/18596 v2: https://gitee.com/openeuler/kernel/pulls/18616 v1->v2 changes: 1、Patch#2与Patch#7的KABI修改合并后放到最后一个patch; 2、Patch#5中ERRATUM_1980005的is_midr_in_range_list函数添加static inline; 3、按照主线的合入顺序进行patches的排序。 v2->v3 changes: 1、解决编译错误。 Patch#1 KVM: arm64: Set HCR_EL2.TID1 unconditionally Patch#2 KVM: arm64: Maintain per-VM copy of implementation ID regs Patch#3 KVM: arm64: Load VPIDR_EL2 with the VM's MIDR_EL1 value Patch#4 KVM: arm64: Allow userspace to change the implementation ID registers Reference: https://lore.kernel.org/all/20250225005401.679536-1-oliver.upton@linux.dev/ selftest相关未合入 Patch#5 arm64: Modify _midr_range() functions to read MIDR/REVIDR internally Patch#6 KVM: arm64: Specify hypercall ABI for retrieving target implementations Patch#7 KVM: arm64: Introduce KVM_REG_ARM_VENDOR_HYP_BMAP_2 Patch#8 arm64: Make _midr_in_range_list() an exported function Patch#9 smccc/kvm_guest: Enable errata based on implementation CPUs Reference: https://lore.kernel.org/all/20250221140229.12588-1-shameerali.kolothum.thod… selftest相关未合入 Patch#10 smccc: kvm_guest: Fix kernel builds for 32 bit arm Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… 单patch合入 Patch#11 smccc: kvm_guest: Align with DISCOVER_IMPL_CPUS ABI Reference: https://lore.kernel.org/all/20250327163613.2516073-1-oliver.upton@linux.dev/ 单patch合入 Patch#12 KVM: arm64: fix kvm kabi conflict KABI屏蔽, Patch#2与Patch#7引入, 使用KABI_EXTEND屏蔽。 Jinqian Yang (1): KVM: arm64: fix kvm kabi conflict Oliver Upton (3): KVM: arm64: Set HCR_EL2.TID1 unconditionally KVM: arm64: Load VPIDR_EL2 with the VM's MIDR_EL1 value smccc: kvm_guest: Align with DISCOVER_IMPL_CPUS ABI Sebastian Ott (2): KVM: arm64: Maintain per-VM copy of implementation ID regs KVM: arm64: Allow userspace to change the implementation ID registers Shameer Kolothum (6): arm64: Modify _midr_range() functions to read MIDR/REVIDR internally KVM: arm64: Specify hypercall ABI for retrieving target implementations KVM: arm64: Introduce KVM_REG_ARM_VENDOR_HYP_BMAP_2 arm64: Make _midr_in_range_list() an exported function smccc/kvm_guest: Enable errata based on implementation CPUs smccc: kvm_guest: Fix kernel builds for 32 bit arm Documentation/virt/kvm/api.rst | 18 ++ arch/arm64/include/asm/cache.h | 2 +- arch/arm64/include/asm/cputype.h | 40 ++-- arch/arm64/include/asm/hypervisor.h | 1 + arch/arm64/include/asm/kvm_arm.h | 4 +- arch/arm64/include/asm/kvm_host.h | 13 ++ arch/arm64/include/uapi/asm/kvm.h | 12 + arch/arm64/kernel/cpu_errata.c | 75 ++++++- arch/arm64/kernel/cpufeature.c | 12 +- arch/arm64/kernel/proton-pack.c | 20 +- arch/arm64/kvm/arm.c | 9 + arch/arm64/kvm/hyp/include/hyp/sysreg-sr.h | 30 ++- arch/arm64/kvm/hyp/nvhe/sysreg-sr.c | 4 +- arch/arm64/kvm/hyp/vhe/sysreg-sr.c | 2 +- arch/arm64/kvm/hypercalls.c | 13 ++ arch/arm64/kvm/sys_regs.c | 245 ++++++++++++--------- arch/arm64/kvm/vgic/vgic-v3.c | 2 +- drivers/clocksource/arm_arch_timer.c | 2 +- drivers/firmware/efi/libstub/arm64.c | 17 ++ drivers/firmware/smccc/kvm_guest.c | 66 ++++++ drivers/perf/arm_pmuv3.c | 2 +- drivers/platform/mpam/mpam_devices.c | 6 +- include/linux/arm-smccc.h | 16 ++ include/uapi/linux/kvm.h | 3 + 24 files changed, 447 insertions(+), 167 deletions(-) -- 2.33.0

2 13

[openeuler:openEuler-1.0-LTS 1890/1890] arch/x86/events/zhaoxin/uncore.c:2789:36-50: opportunity for str_enabled_disabled(uncore_enabled)
by kernel test robot 29 Oct '25

29 Oct '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3749a0fa9e1453451f807b1ca86250ed77c17f05 commit: 80e508024be6ebad4efb6e9c0f2cc273e6ce3ce2 [1890/1890] perf/zhaoxin/uncore: Enhance uncore support and fix related bugs config: x86_64-randconfig-r062-20251028 (https://download.01.org/0day-ci/archive/20251029/202510290723.7bXIAhsR-lkp@…) compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202510290723.7bXIAhsR-lkp@intel.com/ cocci warnings: (new ones prefixed by >>) >> arch/x86/events/zhaoxin/uncore.c:2789:36-50: opportunity for str_enabled_disabled(uncore_enabled) vim +2789 arch/x86/events/zhaoxin/uncore.c 2775 2776 /* 2777 * Process kernel command-line parameter at boot time. 2778 * zhaoxin_pmc_uncore={0|off} or zhaoxin_pmc_uncore={1|on} 2779 */ 2780 static int __init zhaoxin_uncore_enable(char *str) 2781 { 2782 if (!strcasecmp(str, "off") || !strcmp(str, "0")) 2783 uncore_enabled = 0; 2784 else if (!strcasecmp(str, "on") || !strcmp(str, "1")) 2785 uncore_enabled = 1; 2786 else 2787 pr_err("zhaoxin_pmc_uncore: invalid parameter value (%s)\n", str); 2788 > 2789 pr_info("Zhaoxin PMC uncore %s\n", uncore_enabled ? "enabled" : "disabled"); 2790 2791 return 1; 2792 } 2793 __setup("zhaoxin_pmc_uncore=", zhaoxin_uncore_enable); 2794 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0