- Kernel - mailweb.openeuler.org

[openeuler:openEuler-1.0-LTS 1591/1591] mm/.tmp_memblock.o: warning: objtool: missing symbol for section .text.unlikely
by kernel test robot 23 Apr '25

23 Apr '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: a92bdca2eb7009cae80d7e42f4e8573d27cb19be commit: 775947c125d5bd6e00e0dcf9d12c57fd5d44d07f [1591/1591] asm-generic: fix -Wtype-limits compiler warnings config: x86_64-buildonly-randconfig-003-20250423 (https://download.01.org/0day-ci/archive/20250423/202504231901.3Ew1u0FK-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250423/202504231901.3Ew1u0FK-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504231901.3Ew1u0FK-lkp@intel.com/ All warnings (new ones prefixed by >>): >> mm/.tmp_memblock.o: warning: objtool: missing symbol for section .text.unlikely -- >> arch/x86/kernel/.tmp_e820.o: warning: objtool: missing symbol for section .text.unlikely -- >> drivers/thermal/.tmp_x86_pkg_temp_thermal.o: warning: objtool: missing symbol for section .text.unlikely -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 0/4] Backport the perf fix patch
by Li Huafei 23 Apr '25

23 Apr '25

Chengming Zhou (1): perf/core: Fix perf_cgroup_switch() Haifeng Xu (1): perf/core: Fix missing wakeup when waiting for context reference Namhyung Kim (1): perf: Really fix event_function_call() locking Peter Zijlstra (1): perf: Fix event_function_call() locking kernel/events/core.c | 163 +++++++++++++------------------------------ 1 file changed, 49 insertions(+), 114 deletions(-) -- 2.43.0

2 5

[PATCH OLK-6.6 0/3] CVE-2025-22121
by Yongjian Sun 23 Apr '25

23 Apr '25

Ye Bin (2): ext4: introduce ITAIL helper ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() Yongjian Sun (1): ext4: Restore the deleted check paths of the xattr. fs/ext4/inode.c | 5 +++++ fs/ext4/xattr.c | 15 ++++++--------- fs/ext4/xattr.h | 10 ++++++++++ 3 files changed, 21 insertions(+), 9 deletions(-) -- 2.39.2

2 5

[PATCH OLK-6.6 0/6] arm64/mpam: Create l2 cache monitors
by Zeng Heng 23 Apr '25

23 Apr '25

James Morse (2): arm64: mpam: Add cpu_pm notifier to restore MPAM sysregs arm64: mpam: Restore the expected MPAM sysregs on cpuhp Zeng Heng (4): arm64/mpam: Create l2 cache monitors fs/resctrl: Add l2 mount option to enable L2 msc arm64/mpam: Refuse cpu offline when L2 msc is enabled arm64/mpam: Refuse to enter powerdown state after L2 msc updated arch/arm64/kernel/cpufeature.c | 6 +++ arch/arm64/kernel/mpam.c | 41 +++++++++++++++ drivers/platform/mpam/mpam_devices.c | 6 ++- drivers/platform/mpam/mpam_internal.h | 2 + drivers/platform/mpam/mpam_resctrl.c | 76 ++++++++++++++++++++++++--- fs/resctrl/ctrlmondata.c | 6 +++ fs/resctrl/internal.h | 2 +- fs/resctrl/rdtgroup.c | 16 ++++++ include/linux/arm_mpam.h | 2 + include/linux/resctrl.h | 4 ++ include/linux/resctrl_types.h | 2 + 11 files changed, 155 insertions(+), 8 deletions(-) -- 2.25.1

2 7

[PATCH OLK-6.6 00/11] fs/resctrl: Fix configuration to wrong control group when CDP is enabled
by Zeng Heng 23 Apr '25

23 Apr '25

Zeng Heng (11): arm64/mpam: fix memleak in resctrl_arch_mon_ctx_alloc_no_wait() arm64/mpam: fix impossible condition in get_cpumask_from_cache_id() arm64/mpam: fix impossible condition in resctrl_arch_rmid_read() arm64/mpam: Optimize CSU/MBWU monitor multiplexing fs/resctrl: Determine whether the MBM monitors require overflow checking arm64/mpam: Set the cpbm width of msc class with the minimum arm64/mpam: Correct the judgment condition of the CMAX feature fs/resctrl: Fix kmemleak caused by closid_init() arm64/mpam: Fix allocated cache size information arm64/mpam: Add debugging information about CDP monitor value fs/resctrl: Fix configuration to wrong control group when CDP is enabled arch/x86/include/asm/resctrl.h | 6 ++ drivers/platform/mpam/mpam_devices.c | 20 ++++-- drivers/platform/mpam/mpam_internal.h | 5 +- drivers/platform/mpam/mpam_resctrl.c | 88 +++++++++++---------------- fs/resctrl/ctrlmondata.c | 28 ++++++++- fs/resctrl/rdtgroup.c | 28 +++++---- include/linux/arm_mpam.h | 2 + 7 files changed, 103 insertions(+), 74 deletions(-) -- 2.25.1

2 12

[PATCH OLK-6.6 v12 0/7] Add support for IPIv
by Jinqian Yang 23 Apr '25

23 Apr '25

Patch#1 Allocate VM table and save vpeid in it Patch#2 avoid sending multi-SGIs in IPIV Patch#3 Set base address of vm table and targe ITS when vpe schedule and deschedule Patch#4 Register ipiv exception interrupt Patch#5 Add interface KVM_CAP_ARM_IPIV_MODE Patch#6 Probe and configure IPIV capacity on HIP12 Patch#7 Use KABI_EXTEND to perform kabi repair for IPIV Jinqian Yang (2): kvm: arm64: avoid sending multi-SGIs in IPIV kabi: Use KABI_EXTEND to perform kabi repair for IPIV Xiang Chen (5): kvm: hisi_virt: Allocate VM table and save vpeid in it irqchip: gicv3-its: Set base address of vm table and targe ITS when vpe schedule and deschedule kvm: hisi_virt: Register ipiv exception interrupt kvm: arm64: Add interface KVM_CAP_ARM_IPIV_MODE kvm: hisi_virt: Probe and configure IPIV capacity on HIP12 .../admin-guide/kernel-parameters.txt | 3 + arch/arm64/include/asm/kvm_host.h | 1 + arch/arm64/kvm/arm.c | 16 +++ arch/arm64/kvm/hisilicon/hisi_virt.c | 37 +++++++ arch/arm64/kvm/hisilicon/hisi_virt.h | 11 ++ arch/arm64/kvm/sys_regs.c | 11 ++ arch/arm64/kvm/vgic/vgic-init.c | 36 +++++++ arch/arm64/kvm/vgic/vgic-mmio-v3.c | 1 + drivers/irqchip/irq-gic-v3-its.c | 101 +++++++++++++++++- drivers/irqchip/irq-gic-v3.c | 33 ++++++ include/linux/irqchip/arm-gic-v3.h | 27 +++++ include/linux/irqchip/arm-gic-v4.h | 2 + include/uapi/linux/kvm.h | 1 + 13 files changed, 278 insertions(+), 2 deletions(-) -- 2.33.0

2 8

[PATCH OLK-6.6] RDMA/hns: Fix the compatibility between the kernel mode and user mode
by Junxian Huang 23 Apr '25

23 Apr '25

From: Yuyu Li <liyuyu6(a)huawei.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IC1T6B ---------------------------------------------------------------------- This patch modifies the hns-abi.h file and fixes the inconsistency between the kernel-mode ABI and user-mode ABI. Fixes: 0e6c7aaae120 ("RDMA/hns: Optimize user DCA perfermance by sharing DCA status") Signed-off-by: Yuyu Li <liyuyu6(a)huawei.com> Signed-off-by: Xinghai Cen <cenxinghai(a)h-partners.com> --- include/uapi/rdma/hns-abi.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/uapi/rdma/hns-abi.h b/include/uapi/rdma/hns-abi.h index c73ff42c49bf..8a8f2e4f1bea 100644 --- a/include/uapi/rdma/hns-abi.h +++ b/include/uapi/rdma/hns-abi.h @@ -157,9 +157,9 @@ enum hns_roce_uctx_comp_mask { struct hns_roce_ib_alloc_ucontext { __u32 config; - __u32 reserved; __u32 comp; /* use hns_roce_uctx_comp_mask */ __u32 dca_max_qps; + __u32 reserved; }; struct hns_roce_ib_alloc_pd_resp { -- 2.33.0

2 1

[PATCH OLK-6.6 v11 0/7] Add support for IPIv
by Jinqian Yang 23 Apr '25

23 Apr '25

Patch#1 Allocate VM table and save vpeid in it Patch#2 avoid sending multi-SGIs in IPIV Patch#3 Set base address of vm table and targe ITS when vpe schedule and deschedule Patch#4 Register ipiv exception interrupt Patch#5 Add interface KVM_CAP_ARM_IPIV_MODE Patch#6 Probe and configure IPIV capacity on HIP12 Patch#7 Use KABI_EXTEND to perform kabi repair for IPIV Jinqian Yang (2): kvm: arm64: avoid sending multi-SGIs in IPIV kabi: Use KABI_EXTEND to perform kabi repair for IPIV Xiang Chen (5): kvm: hisi_virt: Allocate VM table and save vpeid in it irqchip: gicv3-its: Set base address of vm table and targe ITS when vpe schedule and deschedule kvm: hisi_virt: Register ipiv exception interrupt kvm: arm64: Add interface KVM_CAP_ARM_IPIV_MODE kvm: hisi_virt: Probe and configure IPIV capacity on HIP12 .../admin-guide/kernel-parameters.txt | 3 + arch/arm64/include/asm/kvm_host.h | 1 + arch/arm64/kvm/arm.c | 16 +++ arch/arm64/kvm/hisilicon/hisi_virt.c | 37 +++++++ arch/arm64/kvm/hisilicon/hisi_virt.h | 11 ++ arch/arm64/kvm/sys_regs.c | 11 ++ arch/arm64/kvm/vgic/vgic-init.c | 34 ++++++ arch/arm64/kvm/vgic/vgic-mmio-v3.c | 1 + drivers/irqchip/irq-gic-v3-its.c | 101 +++++++++++++++++- drivers/irqchip/irq-gic-v3.c | 33 ++++++ include/linux/irqchip/arm-gic-v3.h | 27 +++++ include/linux/irqchip/arm-gic-v4.h | 2 + include/uapi/linux/kvm.h | 1 + 13 files changed, 276 insertions(+), 2 deletions(-) -- 2.33.0

2 8

[PATCH openEuler-1.0-LTS] vlan: enforce underlying device type
by Wang Liang 23 Apr '25

23 Apr '25

From: Oscar Maes <oscmaes92(a)gmail.com> mainline inclusion from mainline-v6.14-rc6 commit b33a534610067ade2bdaf2052900aaad99701353 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBVPBN Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Currently, VLAN devices can be created on top of non-ethernet devices. Besides the fact that it doesn't make much sense, this also causes a bug which leaks the address of a kernel function to usermode. When creating a VLAN device, we initialize GARP (garp_init_applicant) and MRP (mrp_init_applicant) for the underlying device. As part of the initialization process, we add the multicast address of each applicant to the underlying device, by calling dev_mc_add. __dev_mc_add uses dev->addr_len to determine the length of the new multicast address. This causes an out-of-bounds read if dev->addr_len is greater than 6, since the multicast addresses provided by GARP and MRP are only 6 bytes long. This behaviour can be reproduced using the following commands: ip tunnel add gretest mode ip6gre local ::1 remote ::2 dev lo ip l set up dev gretest ip link add link gretest name vlantest type vlan id 100 Then, the following command will display the address of garp_pdu_rcv: ip maddr show | grep 01:80:c2:00:00:21 Fix the bug by enforcing the type of the underlying device during VLAN device initialization. Fixes: 22bedad3ce11 ("net: convert multicast list to list_head") Reported-by: syzbot+91161fe81857b396c8a0(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/000000000000ca9a81061a01ec20@google.com/ Signed-off-by: Oscar Maes <oscmaes92(a)gmail.com> Reviewed-by: Jiri Pirko <jiri(a)nvidia.com> Link: https://patch.msgid.link/20250303155619.8918-1-oscmaes92@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/8021q/vlan.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c index 512ada90657b..531faf370bc4 100644 --- a/net/8021q/vlan.c +++ b/net/8021q/vlan.c @@ -123,7 +123,8 @@ int vlan_check_real_dev(struct net_device *real_dev, { const char *name = real_dev->name; - if (real_dev->features & NETIF_F_VLAN_CHALLENGED) { + if (real_dev->features & NETIF_F_VLAN_CHALLENGED || + real_dev->type != ARPHRD_ETHER) { pr_info("VLANs not supported on %s\n", name); NL_SET_ERR_MSG_MOD(extack, "VLANs not supported on device"); return -EOPNOTSUPP; -- 2.34.1

2 2

[PATCH OLK-6.6 v10 0/7] Add support for IPIv
by Jinqian Yang 23 Apr '25

23 Apr '25

Patch#1 Allocate VM table and save vpeid in it Patch#2 avoid sending multi-SGIs in IPIV Patch#3 Set base address of vm table and targe ITS when vpe schedule and deschedule Patch#4 Register ipiv exception interrupt Patch#5 Add interface KVM_CAP_ARM_IPIV_MODE Patch#6 Probe and configure IPIV capacity on HIP12 Patch#7 Use KABI_EXTEND to perform kabi repair for IPIV Jinqian Yang (2): kvm: arm64: avoid sending multi-SGIs in IPIV kabi: Use KABI_EXTEND to perform kabi repair for IPIV Xiang Chen (5): kvm: hisi_virt: Allocate VM table and save vpeid in it irqchip: gicv3-its: Set base address of vm table and targe ITS when vpe schedule and deschedule kvm: hisi_virt: Register ipiv exception interrupt kvm: arm64: Add interface KVM_CAP_ARM_IPIV_MODE kvm: hisi_virt: Probe and configure IPIV capacity on HIP12 .../admin-guide/kernel-parameters.txt | 3 + arch/arm64/include/asm/kvm_host.h | 1 + arch/arm64/kvm/arm.c | 16 +++ arch/arm64/kvm/hisilicon/hisi_virt.c | 38 +++++++ arch/arm64/kvm/hisilicon/hisi_virt.h | 10 ++ arch/arm64/kvm/sys_regs.c | 11 ++ arch/arm64/kvm/vgic/vgic-init.c | 34 ++++++ arch/arm64/kvm/vgic/vgic-mmio-v3.c | 1 + drivers/irqchip/irq-gic-v3-its.c | 101 +++++++++++++++++- drivers/irqchip/irq-gic-v3.c | 24 +++++ include/linux/irqchip/arm-gic-v3.h | 27 +++++ include/linux/irqchip/arm-gic-v4.h | 2 + include/uapi/linux/kvm.h | 1 + 13 files changed, 267 insertions(+), 2 deletions(-) -- 2.33.0

2 8

[PATCH v4 OLK-6.6 00/10] arm64/mpam: Fix allocated cache size information
by Zeng Heng 23 Apr '25

23 Apr '25

Zeng Heng (10): arm64/mpam: fix memleak in resctrl_arch_mon_ctx_alloc_no_wait() arm64/mpam: fix impossible condition in get_cpumask_from_cache_id() arm64/mpam: fix impossible condition in resctrl_arch_rmid_read() arm64/mpam: Optimize CSU/MBWU monitor multiplexing fs/resctrl: Determine whether the MBM monitors require overflow checking arm64/mpam: Set the cpbm width of msc class with the minimum arm64/mpam: Correct the judgment condition of the CMAX feature fs/resctrl: Fix kmemleak caused by closid_init() arm64/mpam: Fix allocated cache size information arm64/mpam: Add debugging information about CDP monitor value arch/x86/include/asm/resctrl.h | 2 + drivers/platform/mpam/mpam_devices.c | 20 +++++++--- drivers/platform/mpam/mpam_internal.h | 5 ++- drivers/platform/mpam/mpam_resctrl.c | 57 +++++++++++---------------- fs/resctrl/rdtgroup.c | 28 +++++++------ include/linux/arm_mpam.h | 1 + 6 files changed, 61 insertions(+), 52 deletions(-) -- 2.25.1

2 11

[PATCH OLK-6.6] LoongArch: BPF: Fix off-by-one error in build_prologue()
by Huang Xiaojia 23 Apr '25

23 Apr '25

From: Hengqi Chen <hengqi.chen(a)gmail.com> stable inclusion from stable-v6.6.87 commit b3ffad2f02db4aace6799fe0049508b8925eae45 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC2CC7 CVE: CVE-2025-37893 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 7e2586991e36663c9bc48c828b83eab180ad30a9 upstream. Vincent reported that running BPF progs with tailcalls on LoongArch causes kernel hard lockup. Debugging the issues shows that the JITed image missing a jirl instruction at the end of the epilogue. There are two passes in JIT compiling, the first pass set the flags and the second pass generates JIT code based on those flags. With BPF progs mixing bpf2bpf and tailcalls, build_prologue() generates N insns in the first pass and then generates N+1 insns in the second pass. This makes epilogue_offset off by one and we will jump to some unexpected insn and cause lockup. Fix this by inserting a nop insn. Cc: stable(a)vger.kernel.org Fixes: 5dc615520c4d ("LoongArch: Add BPF JIT support") Fixes: bb035ef0cc91 ("LoongArch: BPF: Support mixing bpf2bpf and tailcalls") Reported-by: Vincent Li <vincent.mc.li(a)gmail.com> Tested-by: Vincent Li <vincent.mc.li(a)gmail.com> Closes: https://lore.kernel.org/loongarch/CAK3+h2w6WESdBN3UCr3WKHByD7D6Q_Ve1EDAjotV… Closes: https://lore.kernel.org/bpf/CAK3+h2woEjG_N=-XzqEGaAeCmgu2eTCUc7p6bP4u8Q+DFH… Signed-off-by: Hengqi Chen <hengqi.chen(a)gmail.com> Signed-off-by: Huacai Chen <chenhuacai(a)loongson.cn> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Huang Xiaojia <huangxiaojia2(a)huawei.com> --- arch/loongarch/net/bpf_jit.c | 2 ++ arch/loongarch/net/bpf_jit.h | 5 +++++ 2 files changed, 7 insertions(+) diff --git a/arch/loongarch/net/bpf_jit.c b/arch/loongarch/net/bpf_jit.c index 525fc03d7056..8312887eccaa 100644 --- a/arch/loongarch/net/bpf_jit.c +++ b/arch/loongarch/net/bpf_jit.c @@ -142,6 +142,8 @@ static void build_prologue(struct jit_ctx *ctx) */ if (seen_tail_call(ctx) && seen_call(ctx)) move_reg(ctx, TCC_SAVED, REG_TCC); + else + emit_insn(ctx, nop); ctx->stack_size = stack_adjust; } diff --git a/arch/loongarch/net/bpf_jit.h b/arch/loongarch/net/bpf_jit.h index 68586338ecf8..f9c569f53949 100644 --- a/arch/loongarch/net/bpf_jit.h +++ b/arch/loongarch/net/bpf_jit.h @@ -27,6 +27,11 @@ struct jit_data { struct jit_ctx ctx; }; +static inline void emit_nop(union loongarch_instruction *insn) +{ + insn->word = INSN_NOP; +} + #define emit_insn(ctx, func, ...) \ do { \ if (ctx->image != NULL) { \ -- 2.34.1

2 1

[PATCH OLK-6.6] ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans
by Xiaomeng Zhang 23 Apr '25

23 Apr '25

From: Yajun Deng <yajun.deng(a)linux.dev> stable inclusion from stable-v6.6.87 commit de203da734fae00e75be50220ba5391e7beecdf9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QP4 CVE: CVE-2023-53034 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit de203da734fae00e75be50220ba5391e7beecdf9 ] There is a kernel API ntb_mw_clear_trans() would pass 0 to both addr and size. This would make xlate_pos negative. [ 23.734156] switchtec switchtec0: MW 0: part 0 addr 0x0000000000000000 size 0x0000000000000000 [ 23.734158] ================================================================================ [ 23.734172] UBSAN: shift-out-of-bounds in drivers/ntb/hw/mscc/ntb_hw_switchtec.c:293:7 [ 23.734418] shift exponent -1 is negative Ensuring xlate_pos is a positive or zero before BIT. Fixes: 1e2fd202f859 ("ntb_hw_switchtec: Check for alignment of the buffer in mw_set_trans()") Signed-off-by: Yajun Deng <yajun.deng(a)linux.dev> Reviewed-by: Logan Gunthorpe <logang(a)deltatee.com> Signed-off-by: Jon Mason <jdmason(a)kudzu.us> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/ntb/hw/mscc/ntb_hw_switchtec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c index 0a94c634ddc2..b5f93f07e22a 100644 --- a/drivers/ntb/hw/mscc/ntb_hw_switchtec.c +++ b/drivers/ntb/hw/mscc/ntb_hw_switchtec.c @@ -288,7 +288,7 @@ static int switchtec_ntb_mw_set_trans(struct ntb_dev *ntb, int pidx, int widx, if (size != 0 && xlate_pos < 12) return -EINVAL; - if (!IS_ALIGNED(addr, BIT_ULL(xlate_pos))) { + if (xlate_pos >= 0 && !IS_ALIGNED(addr, BIT_ULL(xlate_pos))) { /* * In certain circumstances we can get a buffer that is * not aligned to its size. (Most of the time -- 2.34.1

2 1

[PATCH OLK-6.6] thermal: int340x: Add NULL check for adev
by Xiaomeng Zhang 23 Apr '25

23 Apr '25

From: Chenyuan Yang <chenyuan0y(a)gmail.com> stable inclusion from stable-v6.6.87 commit 2542a3f70e563a9e70e7ded314286535a3321bdb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QSY CVE: CVE-2025-23136 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2542a3f70e563a9e70e7ded314286535a3321bdb ] Not all devices have an ACPI companion fwnode, so adev might be NULL. This is similar to the commit cd2fd6eab480 ("platform/x86: int3472: Check for adev == NULL"). Add a check for adev not being set and return -ENODEV in that case to avoid a possible NULL pointer deref in int3402_thermal_probe(). Note, under the same directory, int3400_thermal_probe() has such a check. Fixes: 77e337c6e23e ("Thermal: introduce INT3402 thermal driver") Signed-off-by: Chenyuan Yang <chenyuan0y(a)gmail.com> Acked-by: Uwe Kleine-König <u.kleine-koenig(a)baylibre.com> Link: https://patch.msgid.link/20250313043611.1212116-1-chenyuan0y@gmail.com [ rjw: Subject edit, added Fixes: ] Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/thermal/intel/int340x_thermal/int3402_thermal.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/thermal/intel/int340x_thermal/int3402_thermal.c b/drivers/thermal/intel/int340x_thermal/int3402_thermal.c index 43fa351e2b9e..b7fdf25bfd23 100644 --- a/drivers/thermal/intel/int340x_thermal/int3402_thermal.c +++ b/drivers/thermal/intel/int340x_thermal/int3402_thermal.c @@ -45,6 +45,9 @@ static int int3402_thermal_probe(struct platform_device *pdev) struct int3402_thermal_data *d; int ret; + if (!adev) + return -ENODEV; + if (!acpi_has_method(adev->handle, "_TMP")) return -ENODEV; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] tracing: Fix use-after-free in print_graph_function_flags during tracer switching
by Tengda Wu 23 Apr '25

23 Apr '25

From: Tengda Wu <wutengda(a)huaweicloud.com> mainline inclusion from mainline-v6.15 commit 7f81f27b1093e4895e87b74143c59c055c3b1906 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QR9 CVE: CVE-2025-22035 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Kairui reported a UAF issue in print_graph_function_flags() during ftrace stress testing [1]. This issue can be reproduced if puting a 'mdelay(10)' after 'mutex_unlock(&trace_types_lock)' in s_start(), and executing the following script: $ echo function_graph > current_tracer $ cat trace > /dev/null & $ sleep 5 # Ensure the 'cat' reaches the 'mdelay(10)' point $ echo timerlat > current_tracer The root cause lies in the two calls to print_graph_function_flags within print_trace_line during each s_show(): * One through 'iter->trace->print_line()'; * Another through 'event->funcs->trace()', which is hidden in print_trace_fmt() before print_trace_line returns. Tracer switching only updates the former, while the latter continues to use the print_line function of the old tracer, which in the script above is print_graph_function_flags. Moreover, when switching from the 'function_graph' tracer to the 'timerlat' tracer, s_start only calls graph_trace_close of the 'function_graph' tracer to free 'iter->private', but does not set it to NULL. This provides an opportunity for 'event->funcs->trace()' to use an invalid 'iter->private'. To fix this issue, set 'iter->private' to NULL immediately after freeing it in graph_trace_close(), ensuring that an invalid pointer is not passed to other tracers. Additionally, clean up the unnecessary 'iter->private = NULL' during each 'cat trace' when using wakeup and irqsoff tracers. [1] https://lore.kernel.org/all/20231112150030.84609-1-ryncsn@gmail.com/ Cc: stable(a)vger.kernel.org Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Cc: Zheng Yejian <zhengyejian1(a)huawei.com> Link: https://lore.kernel.org/20250320122137.23635-1-wutengda@huaweicloud.com Fixes: eecb91b9f98d ("tracing: Fix memleak due to race between current_tracer and trace") Closes: https://lore.kernel.org/all/CAMgjq7BW79KDSCyp+tZHjShSzHsScSiJxn5ffskp-QzVM0… Reported-by: Kairui Song <kasong(a)tencent.com> Signed-off-by: Tengda Wu <wutengda(a)huaweicloud.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/trace/trace_functions_graph.c | 1 + kernel/trace/trace_irqsoff.c | 2 -- kernel/trace/trace_sched_wakeup.c | 2 -- 3 files changed, 1 insertion(+), 4 deletions(-) diff --git a/kernel/trace/trace_functions_graph.c b/kernel/trace/trace_functions_graph.c index 086af4f5c3e8..20ce7b6bd5ea 100644 --- a/kernel/trace/trace_functions_graph.c +++ b/kernel/trace/trace_functions_graph.c @@ -1473,6 +1473,7 @@ void graph_trace_close(struct trace_iterator *iter) if (data) { free_percpu(data->cpu_data); kfree(data); + iter->private = NULL; } } diff --git a/kernel/trace/trace_irqsoff.c b/kernel/trace/trace_irqsoff.c index 0f36bb59970d..58b2d1932337 100644 --- a/kernel/trace/trace_irqsoff.c +++ b/kernel/trace/trace_irqsoff.c @@ -222,8 +222,6 @@ static void irqsoff_trace_open(struct trace_iterator *iter) { if (is_graph(iter->tr)) graph_trace_open(iter); - else - iter->private = NULL; } static void irqsoff_trace_close(struct trace_iterator *iter) diff --git a/kernel/trace/trace_sched_wakeup.c b/kernel/trace/trace_sched_wakeup.c index 8041bd5e4262..11f4dbd9526b 100644 --- a/kernel/trace/trace_sched_wakeup.c +++ b/kernel/trace/trace_sched_wakeup.c @@ -287,8 +287,6 @@ static void wakeup_trace_open(struct trace_iterator *iter) { if (is_graph(iter->tr)) graph_trace_open(iter); - else - iter->private = NULL; } static void wakeup_trace_close(struct trace_iterator *iter) -- 2.34.1

2 1

[PATCH] LoongArch: BPF: Fix off-by-one error in build_prologue()
by Huang Xiaojia 23 Apr '25

23 Apr '25

From: Hengqi Chen <hengqi.chen(a)gmail.com> stable inclusion from stable-v6.6.87 commit b3ffad2f02db4aace6799fe0049508b8925eae45 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC2CC7 CVE: CVE-2025-37893 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 7e2586991e36663c9bc48c828b83eab180ad30a9 upstream. Vincent reported that running BPF progs with tailcalls on LoongArch causes kernel hard lockup. Debugging the issues shows that the JITed image missing a jirl instruction at the end of the epilogue. There are two passes in JIT compiling, the first pass set the flags and the second pass generates JIT code based on those flags. With BPF progs mixing bpf2bpf and tailcalls, build_prologue() generates N insns in the first pass and then generates N+1 insns in the second pass. This makes epilogue_offset off by one and we will jump to some unexpected insn and cause lockup. Fix this by inserting a nop insn. Cc: stable(a)vger.kernel.org Fixes: 5dc615520c4d ("LoongArch: Add BPF JIT support") Fixes: bb035ef0cc91 ("LoongArch: BPF: Support mixing bpf2bpf and tailcalls") Reported-by: Vincent Li <vincent.mc.li(a)gmail.com> Tested-by: Vincent Li <vincent.mc.li(a)gmail.com> Closes: https://lore.kernel.org/loongarch/CAK3+h2w6WESdBN3UCr3WKHByD7D6Q_Ve1EDAjotV… Closes: https://lore.kernel.org/bpf/CAK3+h2woEjG_N=-XzqEGaAeCmgu2eTCUc7p6bP4u8Q+DFH… Signed-off-by: Hengqi Chen <hengqi.chen(a)gmail.com> Signed-off-by: Huacai Chen <chenhuacai(a)loongson.cn> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Huang Xiaojia <huangxiaojia2(a)huawei.com> --- arch/loongarch/net/bpf_jit.c | 2 ++ arch/loongarch/net/bpf_jit.h | 5 +++++ 2 files changed, 7 insertions(+) diff --git a/arch/loongarch/net/bpf_jit.c b/arch/loongarch/net/bpf_jit.c index 525fc03d7056..8312887eccaa 100644 --- a/arch/loongarch/net/bpf_jit.c +++ b/arch/loongarch/net/bpf_jit.c @@ -142,6 +142,8 @@ static void build_prologue(struct jit_ctx *ctx) */ if (seen_tail_call(ctx) && seen_call(ctx)) move_reg(ctx, TCC_SAVED, REG_TCC); + else + emit_insn(ctx, nop); ctx->stack_size = stack_adjust; } diff --git a/arch/loongarch/net/bpf_jit.h b/arch/loongarch/net/bpf_jit.h index 68586338ecf8..f9c569f53949 100644 --- a/arch/loongarch/net/bpf_jit.h +++ b/arch/loongarch/net/bpf_jit.h @@ -27,6 +27,11 @@ struct jit_data { struct jit_ctx ctx; }; +static inline void emit_nop(union loongarch_instruction *insn) +{ + insn->word = INSN_NOP; +} + #define emit_insn(ctx, func, ...) \ do { \ if (ctx->image != NULL) { \ -- 2.34.1

1 0

[PATCH OLK-6.6] Revert "perf/x86: Fix low freqency setting issue"
by Luo Gengkun 23 Apr '25

23 Apr '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC0AJF CVE: NA -------------------------------- This reverts commit 4fa4f2aef6549f05e766b8bf46978ed659875b5f. This patch makes perf stat failed, so revert it. Fixes: 88ec7eedbbd2 ("perf/x86: Fix low freqency setting issue") Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- arch/x86/events/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c index c1a93fcd0b7a..ad0932f84094 100644 --- a/arch/x86/events/core.c +++ b/arch/x86/events/core.c @@ -623,7 +623,7 @@ int x86_pmu_hw_config(struct perf_event *event) if (event->attr.type == event->pmu->type) event->hw.config |= event->attr.config & X86_RAW_EVENT_MASK; - if (!event->attr.freq && x86_pmu.limit_period) { + if (event->attr.sample_period && x86_pmu.limit_period) { s64 left = event->attr.sample_period; x86_pmu.limit_period(event, &left); if (left > event->attr.sample_period) -- 2.34.1

2 1

[openeuler:OLK-6.6 2153/2153] arch/arm64/kvm/arm.c:1037:11: error: no member named 'irq_level' in 'struct kvm_pmu'
by kernel test robot 23 Apr '25

23 Apr '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: dabd2f7c9c1d6b9dad214ea61407781e0439d85d commit: 1182be89002c268a781bd90b25f18da76cfea732 [2153/2153] pmu: enable pmu phys irq inject for cvm config: arm64-randconfig-r062-20250423 (https://download.01.org/0day-ci/archive/20250423/202504230942.5dFQC7IQ-lkp@…) compiler: clang version 21.0.0git (https://github.com/llvm/llvm-project f819f46284f2a79790038e1f6649172789734ae8) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250423/202504230942.5dFQC7IQ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504230942.5dFQC7IQ-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from arch/arm64/kvm/arm.c:9: In file included from include/linux/entry-kvm.h:6: In file included from include/linux/resume_user_mode.h:8: In file included from include/linux/memcontrol.h:20: In file included from include/linux/mm.h:2242: include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ arch/arm64/kvm/arm.c:139:7: warning: variable 'r' is used uninitialized whenever 'if' condition is false [-Wsometimes-uninitialized] 139 | if (static_branch_unlikely(&virtcca_cvm_is_available)) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/jump_label.h:504:40: note: expanded from macro 'static_branch_unlikely' 504 | #define static_branch_unlikely(x) \ | ^ 505 | ({ \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 506 | bool branch; \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 507 | if (__builtin_types_compatible_p(typeof(*x), struct static_key_true)) \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 508 | branch = arch_static_branch_jump(&(x)->key, false); \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 509 | else if (__builtin_types_compatible_p(typeof(*x), struct static_key_false)) \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 510 | branch = arch_static_branch(&(x)->key, false); \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 511 | else \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 512 | branch = ____wrong_branch_error(); \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 513 | unlikely_notrace(branch); \ | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 514 | }) | ~~ arch/arm64/kvm/arm.c:148:9: note: uninitialized use occurs here 148 | return r; | ^ arch/arm64/kvm/arm.c:139:3: note: remove the 'if' if its condition is always true 139 | if (static_branch_unlikely(&virtcca_cvm_is_available)) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 140 | r = kvm_cvm_enable_cap(kvm, cap); arch/arm64/kvm/arm.c:93:7: note: initialize the variable 'r' to silence this warning 93 | int r; | ^ | = 0 >> arch/arm64/kvm/arm.c:1037:11: error: no member named 'irq_level' in 'struct kvm_pmu' 1037 | if (pmu->irq_level) { | ~~~ ^ arch/arm64/kvm/arm.c:1039:3: error: call to undeclared function 'arm_pmu_set_phys_irq'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 1039 | arm_pmu_set_phys_irq(false); | ^ arch/arm64/kvm/arm.c:1242:4: error: call to undeclared function 'arm_pmu_set_phys_irq'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 1242 | arm_pmu_set_phys_irq(true); | ^ 2 warnings and 3 errors generated. Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for RESCTRL_FS Depends on [n]: MISC_FILESYSTEMS [=n] && ARCH_HAS_CPU_RESCTRL [=y] Selected by [y]: - ARM64_MPAM [=y] vim +1037 arch/arm64/kvm/arm.c 1031 1032 #ifdef CONFIG_HISI_VIRTCCA_HOST 1033 static inline void update_pmu_phys_irq(struct kvm_vcpu *vcpu, bool *pmu_stopped) 1034 { 1035 struct kvm_pmu *pmu = &vcpu->arch.pmu; 1036 > 1037 if (pmu->irq_level) { 1038 *pmu_stopped = true; 1039 arm_pmu_set_phys_irq(false); 1040 } 1041 } 1042 #endif 1043 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] perf/x86: Fix open counting event error
by Luo Gengkun 23 Apr '25

23 Apr '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC0AJF CVE: NA -------------------------------- Perf doesn't work at perf stat for hardware events: $perf stat -- sleep 1 Performance counter stats for 'sleep 1': 16.44 msec task-clock # 0.016 CPUs utilized 2 context-switches # 121.691 /sec 0 cpu-migrations # 0.000 /sec 54 page-faults # 3.286 K/sec <not supported> cycles <not supported> instructions <not supported> branches <not supported> branch-misses The reason is that the check in x86_pmu_hw_config for sampling event is unexpectedly applied to the counting event. Fixes: 88ec7eedbbd2 ("perf/x86: Fix low freqency setting issue") Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- arch/x86/events/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c index c1a93fcd0b7a..0b24fc9d2735 100644 --- a/arch/x86/events/core.c +++ b/arch/x86/events/core.c @@ -623,7 +623,7 @@ int x86_pmu_hw_config(struct perf_event *event) if (event->attr.type == event->pmu->type) event->hw.config |= event->attr.config & X86_RAW_EVENT_MASK; - if (!event->attr.freq && x86_pmu.limit_period) { + if (is_sampling_event(event) && !event->attr.freq && x86_pmu.limit_period) { s64 left = event->attr.sample_period; x86_pmu.limit_period(event, &left); if (left > event->attr.sample_period) -- 2.34.1

2 1

[PATCH OLK-6.6] RDMA/bnxt_re: Fix the page details for the srq created by kernel consumers
by Zhang Changzhong 22 Apr '25

22 Apr '25

From: Kashyap Desai <kashyap.desai(a)broadcom.com> mainline inclusion from mainline-v6.14-rc5 commit b66535356a4834a234f99e16a97eb51f2c6c5a7d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVSU CVE: CVE-2025-21885 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- While using nvme target with use_srq on, below kernel panic is noticed. [ 549.698111] bnxt_en 0000:41:00.0 enp65s0np0: FEC autoneg off encoding: Clause 91 RS(544,514) [ 566.393619] Oops: divide error: 0000 [#1] PREEMPT SMP NOPTI .. [ 566.393799] <TASK> [ 566.393807] ? __die_body+0x1a/0x60 [ 566.393823] ? die+0x38/0x60 [ 566.393835] ? do_trap+0xe4/0x110 [ 566.393847] ? bnxt_qplib_alloc_init_hwq+0x1d4/0x580 [bnxt_re] [ 566.393867] ? bnxt_qplib_alloc_init_hwq+0x1d4/0x580 [bnxt_re] [ 566.393881] ? do_error_trap+0x7c/0x120 [ 566.393890] ? bnxt_qplib_alloc_init_hwq+0x1d4/0x580 [bnxt_re] [ 566.393911] ? exc_divide_error+0x34/0x50 [ 566.393923] ? bnxt_qplib_alloc_init_hwq+0x1d4/0x580 [bnxt_re] [ 566.393939] ? asm_exc_divide_error+0x16/0x20 [ 566.393966] ? bnxt_qplib_alloc_init_hwq+0x1d4/0x580 [bnxt_re] [ 566.393997] bnxt_qplib_create_srq+0xc9/0x340 [bnxt_re] [ 566.394040] bnxt_re_create_srq+0x335/0x3b0 [bnxt_re] [ 566.394057] ? srso_return_thunk+0x5/0x5f [ 566.394068] ? __init_swait_queue_head+0x4a/0x60 [ 566.394090] ib_create_srq_user+0xa7/0x150 [ib_core] [ 566.394147] nvmet_rdma_queue_connect+0x7d0/0xbe0 [nvmet_rdma] [ 566.394174] ? lock_release+0x22c/0x3f0 [ 566.394187] ? srso_return_thunk+0x5/0x5f Page size and shift info is set only for the user space SRQs. Set page size and page shift for kernel space SRQs also. Fixes: 0c4dcd602817 ("RDMA/bnxt_re: Refactor hardware queue memory allocation") Signed-off-by: Kashyap Desai <kashyap.desai(a)broadcom.com> Signed-off-by: Selvin Xavier <selvin.xavier(a)broadcom.com> Link: https://patch.msgid.link/1740237621-29291-1-git-send-email-selvin.xavier@br… Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Conflicts: drivers/infiniband/hw/bnxt_re/ib_verbs.c [commit 30b871338c3e ("RDMA/bnxt_re: Refactor NQ allocation") not merged] Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c index f7345e4..98ddc06 100644 --- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c +++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c @@ -1775,6 +1775,8 @@ int bnxt_re_create_srq(struct ib_srq *ib_srq, srq->qplib_srq.threshold = srq_init_attr->attr.srq_limit; srq->srq_limit = srq_init_attr->attr.srq_limit; srq->qplib_srq.eventq_hw_ring_id = rdev->nq[0].ring_id; + srq->qplib_srq.sg_info.pgsize = PAGE_SIZE; + srq->qplib_srq.sg_info.pgshft = PAGE_SHIFT; nq = &rdev->nq[0]; if (udata) { -- 2.9.5

2 1

[PATCH OLK-6.6] Revert "perf/x86: Fix low freqency setting issue"
by Luo Gengkun 22 Apr '25

22 Apr '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC0AJF CVE: NA -------------------------------- This reverts commit 4fa4f2aef6549f05e766b8bf46978ed659875b5f. This patch makes perf stat failed, so revert it. Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- arch/x86/events/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c index c1a93fcd0b7a..ad0932f84094 100644 --- a/arch/x86/events/core.c +++ b/arch/x86/events/core.c @@ -623,7 +623,7 @@ int x86_pmu_hw_config(struct perf_event *event) if (event->attr.type == event->pmu->type) event->hw.config |= event->attr.config & X86_RAW_EVENT_MASK; - if (!event->attr.freq && x86_pmu.limit_period) { + if (event->attr.sample_period && x86_pmu.limit_period) { s64 left = event->attr.sample_period; x86_pmu.limit_period(event, &left); if (left > event->attr.sample_period) -- 2.34.1

2 1

[PATCH v4 OLK-6.6 00/18] fs/resctrl: Introduce the resctrl_feat_type
by Zeng Heng 22 Apr '25

22 Apr '25

Compare to v3: Patch 09: Add comments for the enum resctrl_feat_type and make modifications based on community feedback. Compare to v2: Patch 09: Merge the changes related to the impact on the common layer in Patch 10. Patch 18: New patch added. Compare to v1: Patch 5: Update the condition for MPAM to determine whether to perform MBM overflow checking. Patch 15: Split the original patch and merge part of the fix content into Patch 9. Zeng Heng (18): arm64/mpam: fix memleak in resctrl_arch_mon_ctx_alloc_no_wait() arm64/mpam: fix impossible condition in get_cpumask_from_cache_id() arm64/mpam: fix impossible condition in resctrl_arch_rmid_read() arm64/mpam: Optimize CSU/MBWU monitor multiplexing fs/resctrl: Determine whether the MBM monitors require overflow checking arm64/mpam: Set the cpbm width of msc class with the minimum arm64/mpam: Correct the judgment condition of the CMAX feature fs/resctrl: Fix kmemleak caused by closid_init() fs/resctrl: Introduce the resctrl_feat_type arm64/mpam: Add mbw_min and cmin features arm64/mpam: Add PRIO feature arm64/mpam: Add CMAX feature arm64/mpam: Add PBM feature arm64/mpam: Add limit feature arm64/mpam: Fix allocated cache size information fs/resctrl: Fix configuration to wrong control group when CDP is enabled arm64/mpam: Add debugging information about CDP monitor value fs/resctrl: Support arch specific struct resctrl_arch_staged_config arch/x86/include/asm/resctrl.h | 33 ++ arch/x86/kernel/cpu/resctrl/ctrlmondata.c | 16 +- drivers/platform/mpam/mpam_devices.c | 111 +++++-- drivers/platform/mpam/mpam_internal.h | 23 +- drivers/platform/mpam/mpam_resctrl.c | 355 +++++++++++++++++----- fs/resctrl/ctrlmondata.c | 138 ++++++++- fs/resctrl/monitor.c | 5 +- fs/resctrl/rdtgroup.c | 146 ++++++--- include/linux/arm_mpam.h | 11 + include/linux/resctrl.h | 36 ++- include/linux/resctrl_types.h | 30 ++ 11 files changed, 716 insertions(+), 188 deletions(-) -- 2.25.1

2 19

[PATCH v4 OLK-6.6 00/18] fs/resctrl: Introduce the resctrl_feat_type
by Zeng Heng 22 Apr '25

22 Apr '25

Compare to v3: Patch 09: Add comments for the enum resctrl_feat_type and make modifications based on community feedback. Compare to v2: Patch 09: Merge the changes related to the impact on the common layer in Patch 10. Patch 18: New patch added. Compare to v1: Patch 5: Update the condition for MPAM to determine whether to perform MBM overflow checking. Patch 15: Split the original patch and merge part of the fix content into Patch 9. Zeng Heng (18): arm64/mpam: fix memleak in resctrl_arch_mon_ctx_alloc_no_wait() arm64/mpam: fix impossible condition in get_cpumask_from_cache_id() arm64/mpam: fix impossible condition in resctrl_arch_rmid_read() arm64/mpam: Optimize CSU/MBWU monitor multiplexing fs/resctrl: Determine whether the MBM monitors require overflow checking arm64/mpam: Set the cpbm width of msc class with the minimum arm64/mpam: Correct the judgment condition of the CMAX feature fs/resctrl: Fix kmemleak caused by closid_init() fs/resctrl: Introduce the resctrl_feat_type arm64/mpam: Add mbw_min and cmin features arm64/mpam: Add PRIO feature arm64/mpam: Add CMAX feature arm64/mpam: Add PBM feature arm64/mpam: Add limit feature arm64/mpam: Fix allocated cache size information fs/resctrl: Fix configuration to wrong control group when CDP is enabled arm64/mpam: Add debugging information about CDP monitor value fs/resctrl: Support arch specific struct resctrl_arch_staged_config arch/x86/include/asm/resctrl.h | 33 ++ arch/x86/kernel/cpu/resctrl/ctrlmondata.c | 16 +- drivers/platform/mpam/mpam_devices.c | 111 +++++-- drivers/platform/mpam/mpam_internal.h | 23 +- drivers/platform/mpam/mpam_resctrl.c | 355 +++++++++++++++++----- fs/resctrl/ctrlmondata.c | 138 ++++++++- fs/resctrl/monitor.c | 5 +- fs/resctrl/rdtgroup.c | 146 ++++++--- include/linux/arm_mpam.h | 11 + include/linux/resctrl.h | 36 ++- include/linux/resctrl_types.h | 30 ++ 11 files changed, 716 insertions(+), 188 deletions(-) -- 2.25.1

2 19

[PATCH OLK-6.6] erofs/cachefiles: Change the unmark inuse sequence in erofs ondemand mode
by Zizhi Wo 22 Apr '25

22 Apr '25

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IC349R -------------------------------- In the current erofs ondemand loading mode, the close request is sent to userspace before calling the unmark inuse interface. This means userspace cannot reliably perform culling immediately upon receiving the close req. To address this, a new cookie flag is introduced to allow calling cachefiles_unmark_inode_in_use() before sending the close request. This enables userspace to safely perform culling after the notification. Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/cachefiles/interface.c | 15 ++++++++++----- fs/erofs/fscache.c | 2 ++ include/linux/fscache-cache.h | 24 ++++++++++++++++++++++++ 3 files changed, 36 insertions(+), 5 deletions(-) diff --git a/fs/cachefiles/interface.c b/fs/cachefiles/interface.c index 4d44e74c22fd..c384b6939a3e 100644 --- a/fs/cachefiles/interface.c +++ b/fs/cachefiles/interface.c @@ -338,6 +338,9 @@ static void cachefiles_clean_up_object(struct cachefiles_object *object, struct cachefiles_cache *cache) { struct file *file; + const struct cred *saved_cred; + + cachefiles_begin_secure(cache, &saved_cred); if (test_bit(FSCACHE_COOKIE_RETIRED, &object->cookie->flags)) { if (!test_bit(CACHEFILES_OBJECT_USING_TMPFILE, &object->flags)) { @@ -362,6 +365,8 @@ static void cachefiles_clean_up_object(struct cachefiles_object *object, if (file) fput(file); + + cachefiles_end_secure(cache, saved_cred); } /* @@ -371,7 +376,7 @@ static void cachefiles_withdraw_cookie(struct fscache_cookie *cookie) { struct cachefiles_object *object = cookie->cache_priv; struct cachefiles_cache *cache = object->volume->cache; - const struct cred *saved_cred; + bool unmark_early = fscache_test_inode_unmark_early(cache->cache); _enter("o=%x", object->debug_id); cachefiles_see_object(object, cachefiles_obj_see_withdraw_cookie); @@ -383,13 +388,13 @@ static void cachefiles_withdraw_cookie(struct fscache_cookie *cookie) spin_unlock(&cache->object_list_lock); } + if (unmark_early && object->file) + cachefiles_clean_up_object(object, cache); + cachefiles_ondemand_clean_object(object); - if (object->file) { - cachefiles_begin_secure(cache, &saved_cred); + if (!unmark_early && object->file) cachefiles_clean_up_object(object, cache); - cachefiles_end_secure(cache, saved_cred); - } cookie->cache_priv = NULL; cachefiles_put_object(object, cachefiles_obj_put_detach); diff --git a/fs/erofs/fscache.c b/fs/erofs/fscache.c index 7bcd1d261e7d..37289680888a 100644 --- a/fs/erofs/fscache.c +++ b/fs/erofs/fscache.c @@ -370,6 +370,8 @@ static int erofs_fscache_register_volume(struct super_block *sb) } else { /* enable synchronous unhashing for the associated volumes */ fscache_set_sync_volume_unhash(volume->cache); + /* enable to set inode unmark inuse early before send close req */ + fscache_set_inode_unmark_early(volume->cache); } sbi->volume = volume; diff --git a/include/linux/fscache-cache.h b/include/linux/fscache-cache.h index 642fc1276c63..a1c5fa1a5214 100644 --- a/include/linux/fscache-cache.h +++ b/include/linux/fscache-cache.h @@ -46,6 +46,7 @@ struct fscache_cache { char *name; KABI_USE(1, unsigned long flags) #define FSCACHE_CACHE_SYNC_VOLUME_UNHASH 0 /* Mark to enable volume sync unhash */ +#define FSCACHE_CACHE_EARLY_UNMARK_INUSE 1 /* Need to unmark earlier */ KABI_RESERVE(2) KABI_RESERVE(3) @@ -225,6 +226,29 @@ static inline bool fscache_test_sync_volume_unhash(struct fscache_cache *cache) return test_bit(FSCACHE_CACHE_SYNC_VOLUME_UNHASH, &cache->flags); } +/** + * fscache_set_inode_unmark_early - Early unmark the inode inuse + * @cache: The cache to set + * + * Unmark the inode inuse before send close req. + */ +static inline void fscache_set_inode_unmark_early(struct fscache_cache *cache) +{ + set_bit(FSCACHE_CACHE_EARLY_UNMARK_INUSE, &cache->flags); +} + +/** + * fscache_test_inode_unmark_early - Check whether the inode need to + * unmark early + * @cache: The cache to query + * + * Indicates whether we need to unmark the inode inuse early. + */ +static inline bool fscache_test_inode_unmark_early(struct fscache_cache *cache) +{ + return test_bit(FSCACHE_CACHE_EARLY_UNMARK_INUSE, &cache->flags); +} + #ifdef CONFIG_FSCACHE_STATS extern atomic_t fscache_n_read; extern atomic_t fscache_n_write; -- 2.39.2

2 1

[PATCH OLK-6.6] efi: Don't map the entire mokvar table to determine its size
by Kaixiong Yu 22 Apr '25

22 Apr '25

From: Peter Jones <pjones(a)redhat.com> stable inclusion from stable-v6.6.83 commit ea3f0b362dfe4ef885ef812bfaf4088176422c91 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVU7 CVE: CVE-2025-21872 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 2b90e7ace79774a3540ce569e000388f8d22c9e0 upstream. Currently, when validating the mokvar table, we (re)map the entire table on each iteration of the loop, adding space as we discover new entries. If the table grows over a certain size, this fails due to limitations of early_memmap(), and we get a failure and traceback: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 0 at mm/early_ioremap.c:139 __early_ioremap+0xef/0x220 ... Call Trace: <TASK> ? __early_ioremap+0xef/0x220 ? __warn.cold+0x93/0xfa ? __early_ioremap+0xef/0x220 ? report_bug+0xff/0x140 ? early_fixup_exception+0x5d/0xb0 ? early_idt_handler_common+0x2f/0x3a ? __early_ioremap+0xef/0x220 ? efi_mokvar_table_init+0xce/0x1d0 ? setup_arch+0x864/0xc10 ? start_kernel+0x6b/0xa10 ? x86_64_start_reservations+0x24/0x30 ? x86_64_start_kernel+0xed/0xf0 ? common_startup_64+0x13e/0x141 </TASK> ---[ end trace 0000000000000000 ]--- mokvar: Failed to map EFI MOKvar config table pa=0x7c4c3000, size=265187. Mapping the entire structure isn't actually necessary, as we don't ever need more than one entry header mapped at once. Changes efi_mokvar_table_init() to only map each entry header, not the entire table, when determining the table size. Since we're not mapping any data past the variable name, it also changes the code to enforce that each variable name is NUL terminated, rather than attempting to verify it in place. Cc: <stable(a)vger.kernel.org> Signed-off-by: Peter Jones <pjones(a)redhat.com> Signed-off-by: Ard Biesheuvel <ardb(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- drivers/firmware/efi/mokvar-table.c | 42 +++++++++-------------------- 1 file changed, 13 insertions(+), 29 deletions(-) diff --git a/drivers/firmware/efi/mokvar-table.c b/drivers/firmware/efi/mokvar-table.c index 5ed0602c2f75..4eb0dff4dfaf 100644 --- a/drivers/firmware/efi/mokvar-table.c +++ b/drivers/firmware/efi/mokvar-table.c @@ -103,9 +103,7 @@ void __init efi_mokvar_table_init(void) void *va = NULL; unsigned long cur_offset = 0; unsigned long offset_limit; - unsigned long map_size = 0; unsigned long map_size_needed = 0; - unsigned long size; struct efi_mokvar_table_entry *mokvar_entry; int err; @@ -134,48 +132,34 @@ void __init efi_mokvar_table_init(void) */ err = -EINVAL; while (cur_offset + sizeof(*mokvar_entry) <= offset_limit) { - mokvar_entry = va + cur_offset; - map_size_needed = cur_offset + sizeof(*mokvar_entry); - if (map_size_needed > map_size) { - if (va) - early_memunmap(va, map_size); - /* - * Map a little more than the fixed size entry - * header, anticipating some data. It's safe to - * do so as long as we stay within current memory - * descriptor. - */ - map_size = min(map_size_needed + 2*EFI_PAGE_SIZE, - offset_limit); - va = early_memremap(efi.mokvar_table, map_size); - if (!va) { - pr_err("Failed to map EFI MOKvar config table pa=0x%lx, size=%lu.\n", - efi.mokvar_table, map_size); - return; - } - mokvar_entry = va + cur_offset; + if (va) + early_memunmap(va, sizeof(*mokvar_entry)); + va = early_memremap(efi.mokvar_table + cur_offset, sizeof(*mokvar_entry)); + if (!va) { + pr_err("Failed to map EFI MOKvar config table pa=0x%lx, size=%zu.\n", + efi.mokvar_table + cur_offset, sizeof(*mokvar_entry)); + return; } + mokvar_entry = va; /* Check for last sentinel entry */ if (mokvar_entry->name[0] == '\0') { if (mokvar_entry->data_size != 0) break; err = 0; + map_size_needed = cur_offset + sizeof(*mokvar_entry); break; } - /* Sanity check that the name is null terminated */ - size = strnlen(mokvar_entry->name, - sizeof(mokvar_entry->name)); - if (size >= sizeof(mokvar_entry->name)) - break; + /* Enforce that the name is NUL terminated */ + mokvar_entry->name[sizeof(mokvar_entry->name) - 1] = '\0'; /* Advance to the next entry */ - cur_offset = map_size_needed + mokvar_entry->data_size; + cur_offset += sizeof(*mokvar_entry) + mokvar_entry->data_size; } if (va) - early_memunmap(va, map_size); + early_memunmap(va, sizeof(*mokvar_entry)); if (err) { pr_err("EFI MOKvar config table is not valid\n"); return; -- 2.34.1

2 1

[PATCH V3 OLK-6.6 0/4] Backport mainline patches to avoid crash caused by rsize being 0
by Wang Zhaolong 22 Apr '25

22 Apr '25

vi -> V2 Revert temporary solution V2 -> V3 commit message adjust for checkpatch warning Wang Zhaolong (4): Revert "cifs: Prevent NULL pointer dereference caused by cifs_sb->rsize is 0" smb:client: smb: client: Add reverse mapping from tcon to superblocks smb: client: Store original IO parameters and prevent zero IO sizes smb: client: Update IO sizes after reconnection fs/smb/client/cifs_fs_sb.h | 1 + fs/smb/client/cifsglob.h | 3 ++- fs/smb/client/connect.c | 20 +++++++++++++++----- fs/smb/client/fs_context.c | 2 ++ fs/smb/client/fs_context.h | 3 +++ fs/smb/client/misc.c | 2 ++ fs/smb/client/smb1ops.c | 6 +++--- fs/smb/client/smb2ops.c | 27 +++++++++++++++++++-------- fs/smb/client/smb2pdu.c | 24 ++++++++++++++++++++++-- fs/smb/common/smb2pdu.h | 3 +++ 10 files changed, 72 insertions(+), 19 deletions(-) -- 2.34.3

2 5

[PATCH OLK-5.10 0/8] arm64: Support xcall prefetch
by Jinjie Ruan 22 Apr '25

22 Apr '25

Support xcall prefetch. Jinjie Ruan (2): arm64: Introduce Xint software solution arm64: Add debugfs dir for xint Liao Chen (1): revert kpti bypass Yipeng Zou (5): arm64: Introduce xcall a faster svc exception handling arm64: Faster SVC exception handler with xcall xcall: introduce xcall_select to implement a custom xcall function eventpoll: xcall: Support sync and async prefetch data in epoll xcall: eventpoll: add tracepoint arch/Kconfig | 64 ++++++ arch/arm64/Kconfig | 2 + arch/arm64/configs/openeuler_defconfig | 4 + arch/arm64/include/asm/cpucaps.h | 2 + arch/arm64/include/asm/exception.h | 6 + arch/arm64/include/asm/syscall.h | 14 ++ arch/arm64/include/asm/syscall_wrapper.h | 25 +++ arch/arm64/kernel/asm-offsets.c | 3 + arch/arm64/kernel/cpufeature.c | 54 +++++ arch/arm64/kernel/entry-common.c | 22 ++ arch/arm64/kernel/entry.S | 183 ++++++++++++++- arch/arm64/kernel/sys.c | 20 ++ arch/arm64/kernel/syscall.c | 69 ++++++ drivers/irqchip/irq-gic-v3.c | 123 ++++++++++ fs/eventpoll.c | 275 ++++++++++++++++++++++- fs/open.c | 4 + fs/proc/base.c | 201 +++++++++++++++++ fs/read_write.c | 65 +++++- include/linux/fs.h | 30 +++ include/linux/hardirq.h | 5 + include/linux/irqchip/arm-gic-v3.h | 13 ++ include/linux/sched.h | 8 + include/linux/sched/task.h | 8 + include/linux/syscalls.h | 19 ++ include/trace/events/fs.h | 91 ++++++++ include/uapi/asm-generic/unistd.h | 11 + kernel/fork.c | 45 ++++ kernel/irq/debugfs.c | 33 +++ kernel/irq/internals.h | 18 ++ kernel/irq/irqdesc.c | 19 ++ kernel/irq/proc.c | 10 + kernel/softirq.c | 73 ++++++ kernel/sysctl.c | 36 +++ 33 files changed, 1548 insertions(+), 7 deletions(-) -- 2.34.1

2 9

[PATCH V2 OLK-6.6 0/4] Backport mainline patches to avoid crash caused by rsize being 0
by Wang Zhaolong 22 Apr '25

22 Apr '25

vi -> V2 Revert temporary solution Wang Zhaolong (4): Revert "cifs: Prevent NULL pointer dereference caused by cifs_sb->rsize is 0" smb:client: smb: client: Add reverse mapping from tcon to superblocks smb: client: Store original IO parameters and prevent zero IO sizes smb: client: Update IO sizes after reconnection fs/smb/client/cifs_fs_sb.h | 1 + fs/smb/client/cifsglob.h | 3 ++- fs/smb/client/connect.c | 20 +++++++++++++++----- fs/smb/client/fs_context.c | 2 ++ fs/smb/client/fs_context.h | 3 +++ fs/smb/client/misc.c | 2 ++ fs/smb/client/smb1ops.c | 6 +++--- fs/smb/client/smb2ops.c | 27 +++++++++++++++++++-------- fs/smb/client/smb2pdu.c | 24 ++++++++++++++++++++++-- fs/smb/common/smb2pdu.h | 3 +++ 10 files changed, 72 insertions(+), 19 deletions(-) -- 2.34.3

2 5

[PATCH V2 OLK-6.6 0/4] Backport mainline patches to avoid crash caused by rsize being 0
by Wang Zhaolong 22 Apr '25

22 Apr '25

vi -> V2 Revert temporary solution Wang Zhaolong (4): Revert "cifs: Prevent NULL pointer dereference caused by cifs_sb->rsize is 0" smb:client: smb: client: Add reverse mapping from tcon to superblocks smb: client: Store original IO parameters and prevent zero IO sizes smb: client: Update IO sizes after reconnection fs/smb/client/cifs_fs_sb.h | 1 + fs/smb/client/cifsglob.h | 3 ++- fs/smb/client/connect.c | 20 +++++++++++++++----- fs/smb/client/fs_context.c | 2 ++ fs/smb/client/fs_context.h | 3 +++ fs/smb/client/misc.c | 2 ++ fs/smb/client/smb1ops.c | 6 +++--- fs/smb/client/smb2ops.c | 27 +++++++++++++++++++-------- fs/smb/client/smb2pdu.c | 24 ++++++++++++++++++++++-- fs/smb/common/smb2pdu.h | 3 +++ 10 files changed, 72 insertions(+), 19 deletions(-) -- 2.34.3

2 5

[PATCH OLK-6.6] LoongArch: BPF: Don't override subprog's return value
by Ye Bin 22 Apr '25

22 Apr '25

From: Hengqi Chen <hengqi.chen(a)gmail.com> mainline inclusion from mainline-v6.15-rc1 commit 60f3caff1492e5b8616b9578c4bedb5c0a88ed14 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QR7 CVE: CVE-2025-22048 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The verifier test `calls: div by 0 in subprog` triggers a panic at the ld.bu instruction. The ld.bu insn is trying to load byte from memory address returned by the subprog. The subprog actually set the correct address at the a5 register (dedicated register for BPF return values). But at commit 73c359d1d356 ("LoongArch: BPF: Sign-extend return values") we also sign extended a5 to the a0 register (return value in LoongArch). For function call insn, we later propagate the a0 register back to a5 register. This is right for native calls but wrong for bpf2bpf calls which expect zero-extended return value in a5 register. So only move a0 to a5 for native calls (i.e. non-BPF_PSEUDO_CALL). Cc: stable(a)vger.kernel.org Fixes: 73c359d1d356 ("LoongArch: BPF: Sign-extend return values") Signed-off-by: Hengqi Chen <hengqi.chen(a)gmail.com> Signed-off-by: Huacai Chen <chenhuacai(a)loongson.cn> Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- arch/loongarch/net/bpf_jit.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/arch/loongarch/net/bpf_jit.c b/arch/loongarch/net/bpf_jit.c index 525fc03d7056..31063433a597 100644 --- a/arch/loongarch/net/bpf_jit.c +++ b/arch/loongarch/net/bpf_jit.c @@ -842,7 +842,10 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx, bool ext move_addr(ctx, t1, func_addr); emit_insn(ctx, jirl, LOONGARCH_GPR_RA, t1, 0); - move_reg(ctx, regmap[BPF_REG_0], LOONGARCH_GPR_A0); + + if (insn->src_reg != BPF_PSEUDO_CALL) + move_reg(ctx, regmap[BPF_REG_0], LOONGARCH_GPR_A0); + break; /* tail call */ -- 2.34.1

2 1

[PATCH OLK-6.6] drm/mediatek: dp: drm_err => dev_err in HPD path to avoid NULL ptr
by Tengda Wu 21 Apr '25

21 Apr '25

From: Douglas Anderson <dianders(a)chromium.org> stable inclusion from stable-6.6.87 commit 13ec849fd2eab808ee8eba2625df7ebea3b85edf category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC2CCA CVE: CVE-2025-38240 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 106a6de46cf4887d535018185ec528ce822d6d84 ] The function mtk_dp_wait_hpd_asserted() may be called before the `mtk_dp->drm_dev` pointer is assigned in mtk_dp_bridge_attach(). Specifically it can be called via this callpath: - mtk_edp_wait_hpd_asserted - [panel probe] - dp_aux_ep_probe Using "drm" level prints anywhere in this callpath causes a NULL pointer dereference. Change the error message directly in mtk_dp_wait_hpd_asserted() to dev_err() to avoid this. Also change the error messages in mtk_dp_parse_capabilities(), which is called by mtk_dp_wait_hpd_asserted(). While touching these prints, also add the error code to them to make future debugging easier. Fixes: 7eacba9a083b ("drm/mediatek: dp: Add .wait_hpd_asserted() for AUX bus") Signed-off-by: Douglas Anderson <dianders(a)chromium.org> Reviewed-by: CK Hu <ck.hu(a)mediatek.com> Link: https://patchwork.kernel.org/project/dri-devel/patch/20250116094249.1.I29b0… Signed-off-by: Chun-Kuang Hu <chunkuang.hu(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- drivers/gpu/drm/mediatek/mtk_dp.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/mediatek/mtk_dp.c b/drivers/gpu/drm/mediatek/mtk_dp.c index be4de26c77f9..199527643093 100644 --- a/drivers/gpu/drm/mediatek/mtk_dp.c +++ b/drivers/gpu/drm/mediatek/mtk_dp.c @@ -1648,7 +1648,7 @@ static int mtk_dp_parse_capabilities(struct mtk_dp *mtk_dp) ret = drm_dp_dpcd_readb(&mtk_dp->aux, DP_MSTM_CAP, &val); if (ret < 1) { - drm_err(mtk_dp->drm_dev, "Read mstm cap failed\n"); + dev_err(mtk_dp->dev, "Read mstm cap failed: %zd\n", ret); return ret == 0 ? -EIO : ret; } @@ -1658,7 +1658,7 @@ static int mtk_dp_parse_capabilities(struct mtk_dp *mtk_dp) DP_DEVICE_SERVICE_IRQ_VECTOR_ESI0, &val); if (ret < 1) { - drm_err(mtk_dp->drm_dev, "Read irq vector failed\n"); + dev_err(mtk_dp->dev, "Read irq vector failed: %zd\n", ret); return ret == 0 ? -EIO : ret; } @@ -1941,7 +1941,7 @@ static int mtk_dp_wait_hpd_asserted(struct drm_dp_aux *mtk_aux, unsigned long wa ret = mtk_dp_parse_capabilities(mtk_dp); if (ret) { - drm_err(mtk_dp->drm_dev, "Can't parse capabilities\n"); + dev_err(mtk_dp->dev, "Can't parse capabilities: %d\n", ret); return ret; } -- 2.34.1

2 1

[PATCH OLK-6.6] iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
by Wang Zhaolong 21 Apr '25

21 Apr '25

From: Chengen Du <chengen.du(a)canonical.com> mainline inclusion from mainline-v6.14-rc2 commit 07e0d99a2f701123ad3104c0f1a1e66bce74d6e5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBYE6H CVE: CVE-2025-21993 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- When performing an iSCSI boot using IPv6, iscsistart still reads the /sys/firmware/ibft/ethernetX/subnet-mask entry. Since the IPv6 prefix length is 64, this causes the shift exponent to become negative, triggering a UBSAN warning. As the concept of a subnet mask does not apply to IPv6, the value is set to ~0 to suppress the warning message. Signed-off-by: Chengen Du <chengen.du(a)canonical.com> Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk(a)oracle.com> Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- drivers/firmware/iscsi_ibft.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/firmware/iscsi_ibft.c b/drivers/firmware/iscsi_ibft.c index 6e9788324fea..371f24569b3b 100644 --- a/drivers/firmware/iscsi_ibft.c +++ b/drivers/firmware/iscsi_ibft.c @@ -308,11 +308,14 @@ static ssize_t ibft_attr_show_nic(void *data, int type, char *buf) break; case ISCSI_BOOT_ETH_IP_ADDR: str += sprintf_ipaddr(str, nic->ip_addr); break; case ISCSI_BOOT_ETH_SUBNET_MASK: - val = cpu_to_be32(~((1 << (32-nic->subnet_mask_prefix))-1)); + if (nic->subnet_mask_prefix > 32) + val = cpu_to_be32(~0); + else + val = cpu_to_be32(~((1 << (32-nic->subnet_mask_prefix))-1)); str += sprintf(str, "%pI4", &val); break; case ISCSI_BOOT_ETH_PREFIX_LEN: str += sprintf(str, "%d\n", nic->subnet_mask_prefix); break; -- 2.34.3

2 1

[PATCH OLK-5.10] iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
by Wang Zhaolong 21 Apr '25

21 Apr '25

From: Chengen Du <chengen.du(a)canonical.com> mainline inclusion from mainline-v6.14-rc2 commit 07e0d99a2f701123ad3104c0f1a1e66bce74d6e5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBYE6H CVE: CVE-2025-21993 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- When performing an iSCSI boot using IPv6, iscsistart still reads the /sys/firmware/ibft/ethernetX/subnet-mask entry. Since the IPv6 prefix length is 64, this causes the shift exponent to become negative, triggering a UBSAN warning. As the concept of a subnet mask does not apply to IPv6, the value is set to ~0 to suppress the warning message. Signed-off-by: Chengen Du <chengen.du(a)canonical.com> Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk(a)oracle.com> Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- drivers/firmware/iscsi_ibft.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/firmware/iscsi_ibft.c b/drivers/firmware/iscsi_ibft.c index 7127a04bca19..0d96dbbba74e 100644 --- a/drivers/firmware/iscsi_ibft.c +++ b/drivers/firmware/iscsi_ibft.c @@ -310,11 +310,14 @@ static ssize_t ibft_attr_show_nic(void *data, int type, char *buf) break; case ISCSI_BOOT_ETH_IP_ADDR: str += sprintf_ipaddr(str, nic->ip_addr); break; case ISCSI_BOOT_ETH_SUBNET_MASK: - val = cpu_to_be32(~((1 << (32-nic->subnet_mask_prefix))-1)); + if (nic->subnet_mask_prefix > 32) + val = cpu_to_be32(~0); + else + val = cpu_to_be32(~((1 << (32-nic->subnet_mask_prefix))-1)); str += sprintf(str, "%pI4", &val); break; case ISCSI_BOOT_ETH_PREFIX_LEN: str += sprintf(str, "%d\n", nic->subnet_mask_prefix); break; -- 2.34.3

2 1

[PATCH] cpufreq: governor: Fix negative 'idle_time' handling in dbs_update()
by Lifeng Zheng 21 Apr '25

21 Apr '25

From: Jie Zhan <zhanjie9(a)hisilicon.com> mainline inclusion from mainline-v6.14-rc3 commit 3698dd6b139dc37b35a9ad83d9330c1f99666c02 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IC29P3 CVE: NA Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm… --------------------------------------------------------------------- We observed an issue that the CPU frequency can't raise up with a 100% CPU load when NOHZ is off and the 'conservative' governor is selected. 'idle_time' can be negative if it's obtained from get_cpu_idle_time_jiffy() when NOHZ is off. This was found and explained in commit 9485e4ca0b48 ("cpufreq: governor: Fix handling of special cases in dbs_update()"). However, commit 7592019634f8 ("cpufreq: governors: Fix long idle detection logic in load calculation") introduced a comparison between 'idle_time' and 'samling_rate' to detect a long idle interval. While 'idle_time' is converted to int before comparison, it's actually promoted to unsigned again when compared with an unsigned 'sampling_rate'. Hence, this leads to wrong idle interval detection when it's in fact 100% busy and sets policy_dbs->idle_periods to a very large value. 'conservative' adjusts the frequency to minimum because of the large 'idle_periods', such that the frequency can't raise up. 'Ondemand' doesn't use policy_dbs->idle_periods so it fortunately avoids the issue. Correct negative 'idle_time' to 0 before any use of it in dbs_update(). Fixes: 7592019634f8 ("cpufreq: governors: Fix long idle detection logic in load calculation") Signed-off-by: Jie Zhan <zhanjie9(a)hisilicon.com> Reviewed-by: Chen Yu <yu.c.chen(a)intel.com> Link: https://patch.msgid.link/20250213035510.2402076-1-zhanjie9@hisilicon.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Signed-off-by: Xinghai Cen <cenxinghai(a)h-partners.com> --- drivers/cpufreq/cpufreq_governor.c | 45 +++++++++++++++--------------- 1 file changed, 23 insertions(+), 22 deletions(-) diff --git a/drivers/cpufreq/cpufreq_governor.c b/drivers/cpufreq/cpufreq_governor.c index af44ee6a6430..1a7fcaf39cc9 100644 --- a/drivers/cpufreq/cpufreq_governor.c +++ b/drivers/cpufreq/cpufreq_governor.c @@ -145,7 +145,23 @@ unsigned int dbs_update(struct cpufreq_policy *policy) time_elapsed = update_time - j_cdbs->prev_update_time; j_cdbs->prev_update_time = update_time; - idle_time = cur_idle_time - j_cdbs->prev_cpu_idle; + /* + * cur_idle_time could be smaller than j_cdbs->prev_cpu_idle if + * it's obtained from get_cpu_idle_time_jiffy() when NOHZ is + * off, where idle_time is calculated by the difference between + * time elapsed in jiffies and "busy time" obtained from CPU + * statistics. If a CPU is 100% busy, the time elapsed and busy + * time should grow with the same amount in two consecutive + * samples, but in practice there could be a tiny difference, + * making the accumulated idle time decrease sometimes. Hence, + * in this case, idle_time should be regarded as 0 in order to + * make the further process correct. + */ + if (cur_idle_time > j_cdbs->prev_cpu_idle) + idle_time = cur_idle_time - j_cdbs->prev_cpu_idle; + else + idle_time = 0; + j_cdbs->prev_cpu_idle = cur_idle_time; if (ignore_nice) { @@ -162,7 +178,7 @@ unsigned int dbs_update(struct cpufreq_policy *policy) * calls, so the previous load value can be used then. */ load = j_cdbs->prev_load; - } else if (unlikely((int)idle_time > 2 * sampling_rate && + } else if (unlikely(idle_time > 2 * sampling_rate && j_cdbs->prev_load)) { /* * If the CPU had gone completely idle and a task has @@ -189,30 +205,15 @@ unsigned int dbs_update(struct cpufreq_policy *policy) load = j_cdbs->prev_load; j_cdbs->prev_load = 0; } else { - if (time_elapsed >= idle_time) { + if (time_elapsed > idle_time) load = 100 * (time_elapsed - idle_time) / time_elapsed; - } else { - /* - * That can happen if idle_time is returned by - * get_cpu_idle_time_jiffy(). In that case - * idle_time is roughly equal to the difference - * between time_elapsed and "busy time" obtained - * from CPU statistics. Then, the "busy time" - * can end up being greater than time_elapsed - * (for example, if jiffies_64 and the CPU - * statistics are updated by different CPUs), - * so idle_time may in fact be negative. That - * means, though, that the CPU was busy all - * the time (on the rough average) during the - * last sampling interval and 100 can be - * returned as the load. - */ - load = (int)idle_time < 0 ? 100 : 0; - } + else + load = 0; + j_cdbs->prev_load = load; } - if (unlikely((int)idle_time > 2 * sampling_rate)) { + if (unlikely(idle_time > 2 * sampling_rate)) { unsigned int periods = idle_time / sampling_rate; if (periods < idle_periods) -- 2.33.0

1 0

[PATCH openEuler-1.0-LTS] iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
by Wang Zhaolong 21 Apr '25

21 Apr '25

From: Chengen Du <chengen.du(a)canonical.com> mainline inclusion from mainline-v6.14-rc2 commit 07e0d99a2f701123ad3104c0f1a1e66bce74d6e5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBYE6H CVE: CVE-2025-21993 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- When performing an iSCSI boot using IPv6, iscsistart still reads the /sys/firmware/ibft/ethernetX/subnet-mask entry. Since the IPv6 prefix length is 64, this causes the shift exponent to become negative, triggering a UBSAN warning. As the concept of a subnet mask does not apply to IPv6, the value is set to ~0 to suppress the warning message. Signed-off-by: Chengen Du <chengen.du(a)canonical.com> Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk(a)oracle.com> Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- drivers/firmware/iscsi_ibft.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/firmware/iscsi_ibft.c b/drivers/firmware/iscsi_ibft.c index 966aef334c42..cbe96c33d97e 100644 --- a/drivers/firmware/iscsi_ibft.c +++ b/drivers/firmware/iscsi_ibft.c @@ -318,11 +318,14 @@ static ssize_t ibft_attr_show_nic(void *data, int type, char *buf) break; case ISCSI_BOOT_ETH_IP_ADDR: str += sprintf_ipaddr(str, nic->ip_addr); break; case ISCSI_BOOT_ETH_SUBNET_MASK: - val = cpu_to_be32(~((1 << (32-nic->subnet_mask_prefix))-1)); + if (nic->subnet_mask_prefix > 32) + val = cpu_to_be32(~0); + else + val = cpu_to_be32(~((1 << (32-nic->subnet_mask_prefix))-1)); str += sprintf(str, "%pI4", &val); break; case ISCSI_BOOT_ETH_PREFIX_LEN: str += sprintf(str, "%d\n", nic->subnet_mask_prefix); break; -- 2.39.2

2 1

[PATCH OLK-5.10] drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table()
by Wang Zhaolong 21 Apr '25

21 Apr '25

From: Jiang Liu <gerry(a)linux.alibaba.com> mainline inclusion from mainline-v6.14-rc3 commit 1abb2648698bf10783d2236a6b4a7ca5e8021699 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC78 CVE: CVE-2025-21780 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- It malicious user provides a small pptable through sysfs and then a bigger pptable, it may cause buffer overflow attack in function smu_sys_set_pp_table(). Reviewed-by: Lijo Lazar <lijo.lazar(a)amd.com> Signed-off-by: Jiang Liu <gerry(a)linux.alibaba.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Cc: stable(a)vger.kernel.org Conflicts: drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c [The smu->mutex in the context has not been removed.] Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c index ee27970cfff9..98c9ac875daa 100644 --- a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c +++ b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c @@ -325,12 +325,14 @@ int smu_sys_set_pp_table(struct smu_context *smu, void *buf, size_t size) dev_err(smu->adev->dev, "pp table size not matched !\n"); return -EIO; } mutex_lock(&smu->mutex); - if (!smu_table->hardcode_pptable) + if (!smu_table->hardcode_pptable || smu_table->power_play_table_size < size) { + kfree(smu_table->hardcode_pptable); smu_table->hardcode_pptable = kzalloc(size, GFP_KERNEL); + } if (!smu_table->hardcode_pptable) { ret = -ENOMEM; goto failed; } -- 2.34.3

2 1

[PATCH OLK-6.6 v3 00/18] fs/resctrl: Introduce the resctrl_feat_type
by Zeng Heng 21 Apr '25

21 Apr '25

Compare to v2: Patch 09: Merge the changes related to the impact on the common layer in Patch 10. Patch 18: New patch added. Compare to v1: Patch 5: Update the condition for MPAM to determine whether to perform MBM overflow checking. Patch 15: Split the original patch and merge part of the fix content into Patch 9. Jason Zeng (1): fs/resctrl: Support arch specific struct resctrl_arch_staged_config Zeng Heng (17): arm64/mpam: fix memleak in resctrl_arch_mon_ctx_alloc_no_wait() arm64/mpam: fix impossible condition in get_cpumask_from_cache_id() arm64/mpam: fix impossible condition in resctrl_arch_rmid_read() arm64/mpam: Optimize CSU/MBWU monitor multiplexing fs/resctrl: Determine whether the MBM monitors require overflow checking arm64/mpam: Set the cpbm width of msc class with the minimum arm64/mpam: Correct the judgment condition of the CMAX feature fs/resctrl: Fix kmemleak caused by closid_init() fs/resctrl: Introduce the resctrl_feat_type arm64/mpam: Add mbw_min and cmin features arm64/mpam: Add PRIO feature arm64/mpam: Add CMAX feature arm64/mpam: Add PBM feature arm64/mpam: Add limit feature arm64/mpam: Fix allocated cache size information fs/resctrl: Fix configuration to wrong control group when CDP is enabled arm64/mpam: Add debugging information about CDP monitor value arch/x86/include/asm/resctrl.h | 33 ++ arch/x86/kernel/cpu/resctrl/ctrlmondata.c | 16 +- drivers/platform/mpam/mpam_devices.c | 111 +++++-- drivers/platform/mpam/mpam_internal.h | 25 +- drivers/platform/mpam/mpam_resctrl.c | 355 +++++++++++++++++----- fs/resctrl/ctrlmondata.c | 141 ++++++++- fs/resctrl/monitor.c | 5 +- fs/resctrl/rdtgroup.c | 149 +++++---- include/linux/arm_mpam.h | 11 + include/linux/resctrl.h | 34 ++- include/linux/resctrl_types.h | 20 ++ 11 files changed, 708 insertions(+), 192 deletions(-) -- 2.25.1

2 19

[PATCH openEuler-1.0-LTS 0/1] Fix CVE-2020-36789
by Hongbo Li 21 Apr '25

21 Apr '25

Fix CVE-2020-36789. Hongbo Li (1): can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context drivers/net/can/dev/dev.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH OLK-6.6] ksmbd: validate zero num_subauth before sub_auth is accessed
by Yifan Qiao 21 Apr '25

21 Apr '25

From: Norbert Szetei <norbert(a)doyensec.com> mainline inclusion from mainline-v6.15-rc1 commit bf21e29d78cd2c2371023953d9c82dfef82ebb36 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QOW CVE: CVE-2025-22038 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Access psid->sub_auth[psid->num_subauth - 1] without checking if num_subauth is non-zero leads to an out-of-bounds read. This patch adds a validation step to ensure num_subauth != 0 before sub_auth is accessed. Cc: stable(a)vger.kernel.org Signed-off-by: Norbert Szetei <norbert(a)doyensec.com> Acked-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/smb/server/smbacl.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/fs/smb/server/smbacl.c b/fs/smb/server/smbacl.c index be76e642ca70..4870348f0dd9 100644 --- a/fs/smb/server/smbacl.c +++ b/fs/smb/server/smbacl.c @@ -270,6 +270,11 @@ static int sid_to_id(struct mnt_idmap *idmap, return -EIO; } + if (psid->num_subauth == 0) { + pr_err("%s: zero subauthorities!\n", __func__); + return -EIO; + } + if (sidtype == SIDOWNER) { kuid_t uid; uid_t id; -- 2.39.2

2 1

[PATCH OLK-6.6] ksmbd: fix overflow in dacloffset bounds check
by Yifan Qiao 21 Apr '25

21 Apr '25

From: Norbert Szetei <norbert(a)doyensec.com> mainline inclusion from mainline-v6.15-rc1 commit beff0bc9d69bc8e733f9bca28e2d3df5b3e10e42 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QQK CVE: CVE-2025-22039 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The dacloffset field was originally typed as int and used in an unchecked addition, which could overflow and bypass the existing bounds check in both smb_check_perm_dacl() and smb_inherit_dacl(). This could result in out-of-bounds memory access and a kernel crash when dereferencing the DACL pointer. This patch converts dacloffset to unsigned int and uses check_add_overflow() to validate access to the DACL. Cc: stable(a)vger.kernel.org Signed-off-by: Norbert Szetei <norbert(a)doyensec.com> Acked-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/server/smbacl.c [Just context differences.] Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/smb/server/smbacl.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/fs/smb/server/smbacl.c b/fs/smb/server/smbacl.c index 1c9775f1efa5..0038aed5333e 100644 --- a/fs/smb/server/smbacl.c +++ b/fs/smb/server/smbacl.c @@ -1007,7 +1007,9 @@ int smb_inherit_dacl(struct ksmbd_conn *conn, struct dentry *parent = path->dentry->d_parent; struct mnt_idmap *idmap = mnt_idmap(path->mnt); int inherited_flags = 0, flags = 0, i, ace_cnt = 0, nt_size = 0, pdacl_size; - int rc = 0, num_aces, dacloffset, pntsd_type, pntsd_size, acl_len, aces_size; + int rc = 0, num_aces, pntsd_type, pntsd_size, acl_len, aces_size; + unsigned int dacloffset; + size_t dacl_struct_end; char *aces_base; bool is_dir = S_ISDIR(d_inode(path->dentry)->i_mode); @@ -1015,8 +1017,11 @@ int smb_inherit_dacl(struct ksmbd_conn *conn, parent, &parent_pntsd); if (pntsd_size <= 0) return -ENOENT; + dacloffset = le32_to_cpu(parent_pntsd->dacloffset); - if (!dacloffset || (dacloffset + sizeof(struct smb_acl) > pntsd_size)) { + if (!dacloffset || + check_add_overflow(dacloffset, sizeof(struct smb_acl), &dacl_struct_end) || + dacl_struct_end > (size_t)pntsd_size) { rc = -EINVAL; goto free_parent_pntsd; } @@ -1219,7 +1224,9 @@ int smb_check_perm_dacl(struct ksmbd_conn *conn, const struct path *path, struct smb_ntsd *pntsd = NULL; struct smb_acl *pdacl; struct posix_acl *posix_acls; - int rc = 0, pntsd_size, acl_size, aces_size, pdacl_size, dacl_offset; + int rc = 0, pntsd_size, acl_size, aces_size, pdacl_size; + unsigned int dacl_offset; + size_t dacl_struct_end; struct smb_sid sid; int granted = le32_to_cpu(*pdaccess & ~FILE_MAXIMAL_ACCESS_LE); struct smb_ace *ace; @@ -1238,7 +1245,8 @@ int smb_check_perm_dacl(struct ksmbd_conn *conn, const struct path *path, dacl_offset = le32_to_cpu(pntsd->dacloffset); if (!dacl_offset || - (dacl_offset + sizeof(struct smb_acl) > pntsd_size)) + check_add_overflow(dacl_offset, sizeof(struct smb_acl), &dacl_struct_end) || + dacl_struct_end > (size_t)pntsd_size) goto err_out; pdacl = (struct smb_acl *)((char *)pntsd + le32_to_cpu(pntsd->dacloffset)); -- 2.39.2

2 1

[PATCH OLK-6.6] drm/hyperv: Fix address space leak when Hyper-V DRM device is removed
by Yifan Qiao 21 Apr '25

21 Apr '25

From: Michael Kelley <mhklinux(a)outlook.com> mainline inclusion from mainline-v6.14-rc7 commit aed709355fd05ef747e1af24a1d5d78cd7feb81e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBY42I CVE: CVE-2025-21978 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When a Hyper-V DRM device is probed, the driver allocates MMIO space for the vram, and maps it cacheable. If the device removed, or in the error path for device probing, the MMIO space is released but no unmap is done. Consequently the kernel address space for the mapping is leaked. Fix this by adding iounmap() calls in the device removal path, and in the error path during device probing. Fixes: f1f63cbb705d ("drm/hyperv: Fix an error handling path in hyperv_vmbus_probe()") Fixes: a0ab5abced55 ("drm/hyperv : Removing the restruction of VRAM allocation with PCI bar size") Signed-off-by: Michael Kelley <mhklinux(a)outlook.com> Reviewed-by: Saurabh Sengar <ssengar(a)linux.microsoft.com> Tested-by: Saurabh Sengar <ssengar(a)linux.microsoft.com> Link: https://lore.kernel.org/r/20250210193441.2414-1-mhklinux@outlook.com Signed-off-by: Wei Liu <wei.liu(a)kernel.org> Message-ID: <20250210193441.2414-1-mhklinux(a)outlook.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- drivers/gpu/drm/hyperv/hyperv_drm_drv.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/hyperv/hyperv_drm_drv.c b/drivers/gpu/drm/hyperv/hyperv_drm_drv.c index 8026118c6e03..8a7933f5c6eb 100644 --- a/drivers/gpu/drm/hyperv/hyperv_drm_drv.c +++ b/drivers/gpu/drm/hyperv/hyperv_drm_drv.c @@ -157,6 +157,7 @@ static int hyperv_vmbus_probe(struct hv_device *hdev, return 0; err_free_mmio: + iounmap(hv->vram); vmbus_free_mmio(hv->mem->start, hv->fb_size); err_vmbus_close: vmbus_close(hdev->channel); @@ -175,6 +176,7 @@ static void hyperv_vmbus_remove(struct hv_device *hdev) vmbus_close(hdev->channel); hv_set_drvdata(hdev, NULL); + iounmap(hv->vram); vmbus_free_mmio(hv->mem->start, hv->fb_size); } -- 2.39.2

2 1

[PATCH OLK-6.6 0/5] drm: LoongArch: fix rx550/gfx6/gfx7/gfx8 error
by Hongchen Zhang 21 Apr '25

21 Apr '25

Tianrui Zhao (3): drm/amdgpu: Fix pcie order dislocation drm/amdgpu: make duplicated EOP packet for GFX6 have real content drm/amdgpu: Fix RX550 pcie order dislocation. lvjianmin (2): drm/radeon: repeat the same EOP packet for EOP workaround on CIK drm/amdgpu: make duplicated EOP packet for GFX7/8 have real content drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 5 + drivers/gpu/drm/amd/amdgpu/amdgpu_ih.c | 159 ++++++++++++++++++++++++ drivers/gpu/drm/amd/amdgpu/amdgpu_ih.h | 6 + drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c | 4 + drivers/gpu/drm/amd/amdgpu/amdgpu_irq.h | 3 + drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c | 19 +++ drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c | 13 +- drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 13 +- drivers/gpu/drm/radeon/cik.c | 9 +- 9 files changed, 216 insertions(+), 15 deletions(-) -- 2.33.0

2 6

[PATCH OLK-6.6 0/5] drm: LoongArch: fix rx550/gfx6/gfx7/gfx8 error
by Hongchen Zhang 21 Apr '25

21 Apr '25

Tianrui Zhao (3): drm/amdgpu: Fix pcie order dislocation drm/amdgpu: make duplicated EOP packet for GFX6 have real content drm/amdgpu: Fix RX550 pcie order dislocation. lvjianmin (2): drm/radeon: repeat the same EOP packet for EOP workaround on CIK drm/amdgpu: make duplicated EOP packet for GFX7/8 have real content drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 5 + drivers/gpu/drm/amd/amdgpu/amdgpu_ih.c | 159 ++++++++++++++++++++++++ drivers/gpu/drm/amd/amdgpu/amdgpu_ih.h | 6 + drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c | 4 + drivers/gpu/drm/amd/amdgpu/amdgpu_irq.h | 3 + drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c | 19 +++ drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c | 13 +- drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 13 +- drivers/gpu/drm/radeon/cik.c | 9 +- 9 files changed, 216 insertions(+), 15 deletions(-) -- 2.33.0

2 6

[PATCH OLK-6.6 v3 00/18] fs/resctrl: Introduce the resctrl_feat_type
by Zeng Heng 21 Apr '25

21 Apr '25

Compare to v2: Patch 09: Merge the changes related to the impact on the common layer in Patch 10. Patch 18: New patch added. Compare to v1: Patch 5: Update the condition for MPAM to determine whether to perform MBM overflow checking. Patch 15: Split the original patch and merge part of the fix content into Patch 9. Jason Zeng (1): fs/resctrl: Support arch specific struct resctrl_arch_staged_config Zeng Heng (17): arm64/mpam: fix memleak in resctrl_arch_mon_ctx_alloc_no_wait() arm64/mpam: fix impossible condition in get_cpumask_from_cache_id() arm64/mpam: fix impossible condition in resctrl_arch_rmid_read() arm64/mpam: Optimize CSU/MBWU monitor multiplexing fs/resctrl: Determine whether the MBM monitors require overflow checking arm64/mpam: Set the cpbm width of msc class with the minimum arm64/mpam: Correct the judgment condition of the CMAX feature fs/resctrl: Fix kmemleak caused by closid_init() fs/resctrl: Introduce the resctrl_feat_type arm64/mpam: Add mbw_min and cmin features arm64/mpam: Add PRIO feature arm64/mpam: Add CMAX feature arm64/mpam: Add PBM feature arm64/mpam: Add limit feature arm64/mpam: Fix allocated cache size information fs/resctrl: Fix configuration to wrong control group when CDP is enabled arm64/mpam: Add debugging information about CDP monitor value arch/x86/include/asm/resctrl.h | 33 ++ arch/x86/kernel/cpu/resctrl/ctrlmondata.c | 16 +- drivers/platform/mpam/mpam_devices.c | 111 +++++-- drivers/platform/mpam/mpam_internal.h | 25 +- drivers/platform/mpam/mpam_resctrl.c | 355 +++++++++++++++++----- fs/resctrl/ctrlmondata.c | 141 ++++++++- fs/resctrl/monitor.c | 5 +- fs/resctrl/rdtgroup.c | 135 ++++---- include/linux/arm_mpam.h | 11 + include/linux/resctrl.h | 32 +- include/linux/resctrl_types.h | 20 ++ 11 files changed, 692 insertions(+), 192 deletions(-) -- 2.25.1

2 19

[openeuler:OLK-6.6 2139/2139] drivers/cpufreq/cppc_cpufreq.c:852:19: error: dereferencing pointer to incomplete type 'struct fb_ctr_pair'
by kernel test robot 21 Apr '25

21 Apr '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: bf197758b04f43e61ebab66520f1420c1b64853c commit: 12f136b2134d4ded731c3ef23ac08c85b9c0b1fa [2139/2139] cpufreq: CPPC: Keep the target core awake when reading its cpufreq rate config: arm64-randconfig-002-20250421 (https://download.01.org/0day-ci/archive/20250421/202504211352.ik4vkTIa-lkp@…) compiler: aarch64-linux-gcc (GCC) 7.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250421/202504211352.ik4vkTIa-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504211352.ik4vkTIa-lkp@intel.com/ All errors (new ones prefixed by >>): drivers/cpufreq/cppc_cpufreq.c: In function 'cppc_get_perf_ctrs_pair': >> drivers/cpufreq/cppc_cpufreq.c:852:19: error: dereferencing pointer to incomplete type 'struct fb_ctr_pair' int cpu = fb_ctrs->cpu; ^~ drivers/cpufreq/cppc_cpufreq.c: In function 'cppc_cpufreq_get_rate': drivers/cpufreq/cppc_cpufreq.c:866:9: error: variable 'fb_ctrs' has initializer but incomplete type struct fb_ctr_pair fb_ctrs = { .cpu = cpu, }; ^~~~~~~~~~~ drivers/cpufreq/cppc_cpufreq.c:866:34: error: 'struct fb_ctr_pair' has no member named 'cpu' struct fb_ctr_pair fb_ctrs = { .cpu = cpu, }; ^~~ drivers/cpufreq/cppc_cpufreq.c:866:40: warning: excess elements in struct initializer struct fb_ctr_pair fb_ctrs = { .cpu = cpu, }; ^~~ drivers/cpufreq/cppc_cpufreq.c:866:40: note: (near initialization for 'fb_ctrs') drivers/cpufreq/cppc_cpufreq.c:866:21: error: storage size of 'fb_ctrs' isn't known struct fb_ctr_pair fb_ctrs = { .cpu = cpu, }; ^~~~~~~ drivers/cpufreq/cppc_cpufreq.c:866:21: warning: unused variable 'fb_ctrs' [-Wunused-variable] vim +852 drivers/cpufreq/cppc_cpufreq.c 848 849 static int cppc_get_perf_ctrs_pair(void *val) 850 { 851 struct fb_ctr_pair *fb_ctrs = val; > 852 int cpu = fb_ctrs->cpu; 853 int ret; 854 855 ret = cppc_get_perf_ctrs(cpu, &fb_ctrs->fb_ctrs_t0); 856 if (ret) 857 return ret; 858 859 udelay(2); /* 2usec delay between sampling */ 860 861 return cppc_get_perf_ctrs(cpu, &fb_ctrs->fb_ctrs_t1); 862 } 863 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[OLK-6.6 00/10] crypto: hisilicon - some bugfix
by Weili Qian 21 Apr '25

21 Apr '25

From: JiangShui Yang <yangjiangshui(a)h-partners.com> Weili Qian (8): crypto: hisilicon/sec2: fix memory use-after-free issue crypto: hisilicon/qm - invalidate queues in use crypto: hisilicon/qm - mask axi error before memory init crypto: hisilicon/qm - modify interrupt processing resource application crypto: hisilicon/qm - fix the pf2vf timeout when global reset crypto: hisilicon/qm - obtain the mailbox configuration at one time hisi_acc_vfio_pci: obtain the mailbox configuration at one time crypto: hisilicon/qm - disable error report before flr Wenkai Lin (1): crypto: hisilicon/sec2 - fix for gcm spec check Zhiqi Song (1): crypto: hisilicon/hpre - fix dma unmap sequence drivers/crypto/hisilicon/hpre/hpre_crypto.c | 8 +- drivers/crypto/hisilicon/hpre/hpre_main.c | 103 ++-- drivers/crypto/hisilicon/qm.c | 561 ++++++++++++------ drivers/crypto/hisilicon/sec2/sec_crypto.c | 53 +- drivers/crypto/hisilicon/sec2/sec_main.c | 92 ++- drivers/crypto/hisilicon/zip/zip_main.c | 104 ++-- .../vfio/pci/hisilicon/hisi_acc_vfio_pci.c | 45 +- include/linux/hisi_acc_qm.h | 33 +- 8 files changed, 604 insertions(+), 395 deletions(-) -- 2.43.0

1 10

[PATCH OLK-6.6 v3 00/18] fs/resctrl: Introduce the resctrl_feat_type
by Zeng Heng 21 Apr '25

21 Apr '25

Compare to v2: Patch 09: Merge the changes related to the impact on the common layer in Patch 10. Patch 18: New patch added. Compare to v1: Patch 5: Update the condition for MPAM to determine whether to perform MBM overflow checking. Patch 15: Split the original patch and merge part of the fix content into Patch 9. Jason Zeng (1): fs/resctrl: Support arch specific struct resctrl_arch_staged_config Zeng Heng (17): arm64/mpam: fix memleak in resctrl_arch_mon_ctx_alloc_no_wait() arm64/mpam: fix impossible condition in get_cpumask_from_cache_id() arm64/mpam: fix impossible condition in resctrl_arch_rmid_read() arm64/mpam: Optimize CSU/MBWU monitor multiplexing fs/resctrl: Determine whether the MBM monitors require overflow checking arm64/mpam: Set the cpbm width of msc class with the minimum arm64/mpam: Correct the judgment condition of the CMAX feature fs/resctrl: Fix kmemleak caused by closid_init() fs/resctrl: Introduce the resctrl_feat_type arm64/mpam: Add mbw_min and cmin features arm64/mpam: Add PRIO feature arm64/mpam: Add CMAX feature arm64/mpam: Add PBM feature arm64/mpam: Add limit feature arm64/mpam: Fix allocated cache size information fs/resctrl: Fix configuration to wrong control group when CDP is enabled arm64/mpam: Add debugging information about CDP monitor value arch/x86/include/asm/resctrl.h | 33 ++ arch/x86/kernel/cpu/resctrl/ctrlmondata.c | 16 +- drivers/platform/mpam/mpam_devices.c | 111 +++++-- drivers/platform/mpam/mpam_internal.h | 25 +- drivers/platform/mpam/mpam_resctrl.c | 355 +++++++++++++++++----- fs/resctrl/ctrlmondata.c | 141 ++++++++- fs/resctrl/monitor.c | 5 +- fs/resctrl/rdtgroup.c | 135 ++++---- include/linux/arm_mpam.h | 11 + include/linux/resctrl.h | 32 +- include/linux/resctrl_types.h | 20 ++ 11 files changed, 692 insertions(+), 192 deletions(-) -- 2.25.1

2 19

[PATCH OLK-6.6 v3 00/18] fs/resctrl: Introduce the resctrl_feat_type
by Zeng Heng 21 Apr '25

21 Apr '25

Compare to v2: Patch 09: Merge the changes related to the impact on the common layer in Patch 10. Patch 18: New patch added. Compare to v1: Patch 5: Update the condition for MPAM to determine whether to perform MBM overflow checking. Patch 15: Split the original patch and merge part of the fix content into Patch 9. Jason Zeng (1): fs/resctrl: Support arch specific struct resctrl_arch_staged_config Zeng Heng (17): arm64/mpam: fix memleak in resctrl_arch_mon_ctx_alloc_no_wait() arm64/mpam: fix impossible condition in get_cpumask_from_cache_id() arm64/mpam: fix impossible condition in resctrl_arch_rmid_read() arm64/mpam: Optimize CSU/MBWU monitor multiplexing fs/resctrl: Determine whether the MBM monitors require overflow checking arm64/mpam: Set the cpbm width of msc class with the minimum arm64/mpam: Correct the judgment condition of the CMAX feature fs/resctrl: Fix kmemleak caused by closid_init() fs/resctrl: Introduce the resctrl_feat_type arm64/mpam: Add mbw_min and cmin features arm64/mpam: Add PRIO feature arm64/mpam: Add CMAX feature arm64/mpam: Add PBM feature arm64/mpam: Add limit feature arm64/mpam: Fix allocated cache size information fs/resctrl: Fix configuration to wrong control group when CDP is enabled arm64/mpam: Add debugging information about CDP monitor value arch/x86/include/asm/resctrl.h | 33 ++ arch/x86/kernel/cpu/resctrl/ctrlmondata.c | 16 +- drivers/platform/mpam/mpam_devices.c | 111 +++++-- drivers/platform/mpam/mpam_internal.h | 25 +- drivers/platform/mpam/mpam_resctrl.c | 355 +++++++++++++++++----- fs/resctrl/ctrlmondata.c | 141 ++++++++- fs/resctrl/monitor.c | 5 +- fs/resctrl/rdtgroup.c | 135 ++++---- include/linux/arm_mpam.h | 11 + include/linux/resctrl.h | 32 +- include/linux/resctrl_types.h | 20 ++ 11 files changed, 692 insertions(+), 192 deletions(-) -- 2.25.1

2 19

[PATCH OLK-5.10 0/4] block: fix UAF in blk_mq_has_sqsched()
by Zheng Qixing 21 Apr '25

21 Apr '25

The issue occurs in blk_mq_has_sqsched() function which accesses q->elevator pointer and its members without any protection. During device state changes, related memory structures might be freed, causing a Use-After-Free vulnerability. This patch introduces a QUEUE_FLAG_SQ_SCHED flag that is set during scheduler initialization, eliminating the need for runtime checks of scheduler features. This removes the need to access q->elevator at unsafe moments, resolving the UAF issue. Bart Van Assche (1): block: Decode all flag names in the debugfs output Christoph Hellwig (1): block: remove QUEUE_FLAG_DEAD Ming Lei (2): blk-mq: protect q->elevator by ->sysfs_lock in blk_mq_elv_switch_none blk-mq: avoid to touch q->elevator without any protection block/bfq-iosched.c | 3 +++ block/blk-core.c | 2 -- block/blk-mq-debugfs.c | 9 ++++----- block/blk-mq-sched.c | 1 + block/blk-mq.c | 22 +++++----------------- block/kyber-iosched.c | 3 ++- block/mq-deadline.c | 3 +++ drivers/block/mtip32xx/mtip32xx.c | 2 +- include/linux/blkdev.h | 4 ++-- include/linux/elevator.h | 2 -- 10 files changed, 21 insertions(+), 30 deletions(-) -- 2.39.2

2 5

[PATCH OLK-5.10] md/raid1: fix bitmap update when all write requests fail
by Zheng Qixing 21 Apr '25

21 Apr '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBKHTZ ------------------------ When writing to a RAID1 array where all member disks have bad sectors at the target location, the bitmap update is skipped because all bios[] are NULL, leading to bitmap counter inconsistency. This can cause subsequent I/O operations to hang while waiting for bitmap counter to reach the expected value. Fix this by updating the bitmap when all member disks have bad sectors. Fixes: 1f68f0c4b677 ("md/raid1: avoid writing to known-bad blocks on known-bad drives.") Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/md/raid1.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c index 7c9155a5a468..11f649ed2466 100644 --- a/drivers/md/raid1.c +++ b/drivers/md/raid1.c @@ -1537,6 +1537,13 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio, } } + /* + * Corresponding to md_bitmap_endwrite() from close_write(), in the case + * io range from all member disks are badblocks. + */ + if (first_clone) + md_bitmap_startwrite(bitmap, r1_bio->sector, r1_bio->sectors, 0); + r1_bio_write_done(r1_bio); /* In case raid1d snuck in to freeze_array */ -- 2.39.2

2 1