- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] tracing: Rebuild full_name on each hist_field_name() call
by Tengda Wu 25 May '26

25 May '26

From: Pengpeng Hou <pengpeng(a)iscas.ac.cn> mainline inclusion from mainline-v7.1-rc1 commit 5ec1d1e97de134beed3a5b08235a60fc1c51af96 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9232 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- hist_field_name() uses a static MAX_FILTER_STR_VAL buffer for fully qualified variable-reference names, but it currently appends into that buffer with strcat() without rebuilding it first. As a result, repeated calls append a new "system.event.field" name onto the previous one, which can eventually run past the end of full_name. Build the name with snprintf() on each call and return NULL if the fully qualified name does not fit in MAX_FILTER_STR_VAL. Link: https://patch.msgid.link/20260401112224.85582-1-pengpeng@iscas.ac.cn Fixes: 067fe038e70f ("tracing: Add variable reference handling to hist triggers") Reviewed-by: Tom Zanussi <zanussi(a)kernel.org> Tested-by: Tom Zanussi <zanussi(a)kernel.org> Signed-off-by: Pengpeng Hou <pengpeng(a)iscas.ac.cn> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Tengda Wu <wutengda(a)huaweicloud.com> --- kernel/trace/trace_events_hist.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c index 557b8c28faf4..f67367e487cb 100644 --- a/kernel/trace/trace_events_hist.c +++ b/kernel/trace/trace_events_hist.c @@ -1104,12 +1104,14 @@ static const char *hist_field_name(struct hist_field *field, field->flags & HIST_FIELD_FL_VAR_REF) { if (field->system) { static char full_name[MAX_FILTER_STR_VAL]; + int len; + + len = snprintf(full_name, sizeof(full_name), "%s.%s.%s", + field->system, field->event_name, + field->name); + if (len >= sizeof(full_name)) + return NULL; - strcat(full_name, field->system); - strcat(full_name, "."); - strcat(full_name, field->event_name); - strcat(full_name, "."); - strcat(full_name, field->name); field_name = full_name; } else field_name = field->name; -- 2.34.1

2 1

[PATCH OLK-5.10] tracing/probe: reject non-closed empty immediate strings
by Tengda Wu 25 May '26

25 May '26

From: Pengpeng Hou <pengpeng(a)iscas.ac.cn> mainline inclusion from mainline-v7.0 commit 4346be6577aaa04586167402ae87bbdbe32484a4 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9232 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- parse_probe_arg() accepts quoted immediate strings and passes the body after the opening quote to __parse_imm_string(). That helper currently computes strlen(str) and immediately dereferences str[len - 1], which underflows when the body is empty and not closed with double-quotation. Reject empty non-closed immediate strings before checking for the closing quote. Link: https://lore.kernel.org/all/20260401160315.88518-1-pengpeng@iscas.ac.cn/ Fixes: a42e3c4de964 ("tracing/probe: Add immediate string parameter support") Signed-off-by: Pengpeng Hou <pengpeng(a)iscas.ac.cn> Reviewed-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org> Signed-off-by: Tengda Wu <wutengda(a)huaweicloud.com> --- kernel/trace/trace_probe.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c index 3e020511885c..f2ced0ac04eb 100644 --- a/kernel/trace/trace_probe.c +++ b/kernel/trace/trace_probe.c @@ -352,7 +352,7 @@ static int __parse_imm_string(char *str, char **pbuf, int offs) { size_t len = strlen(str); - if (str[len - 1] != '"') { + if (!len || str[len - 1] != '"') { trace_probe_log_err(offs + len, IMMSTR_NO_CLOSE); return -EINVAL; } -- 2.34.1

2 2

[PATCH OLK-6.6] tracing/probe: reject non-closed empty immediate strings
by Tengda Wu 25 May '26

25 May '26

From: Pengpeng Hou <pengpeng(a)iscas.ac.cn> stable inclusion from stable-v6.6.136 commit feba4907c30284b6d1ec0b350320242d4f288fc9 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9232 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4346be6577aaa04586167402ae87bbdbe32484a4 ] parse_probe_arg() accepts quoted immediate strings and passes the body after the opening quote to __parse_imm_string(). That helper currently computes strlen(str) and immediately dereferences str[len - 1], which underflows when the body is empty and not closed with double-quotation. Reject empty non-closed immediate strings before checking for the closing quote. Link: https://lore.kernel.org/all/20260401160315.88518-1-pengpeng@iscas.ac.cn/ Fixes: a42e3c4de964 ("tracing/probe: Add immediate string parameter support") Signed-off-by: Pengpeng Hou <pengpeng(a)iscas.ac.cn> Reviewed-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/trace/trace_probe.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c index b168d6dd0773..6a96b03aae62 100644 --- a/kernel/trace/trace_probe.c +++ b/kernel/trace/trace_probe.c @@ -886,7 +886,7 @@ static int __parse_imm_string(char *str, char **pbuf, int offs) { size_t len = strlen(str); - if (str[len - 1] != '"') { + if (!len || str[len - 1] != '"') { trace_probe_log_err(offs + len, IMMSTR_NO_CLOSE); return -EINVAL; } -- 2.34.1

2 2

[PATCH OLK-6.6] tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func()
by Tengda Wu 25 May '26

25 May '26

From: David Carlier <devnexen(a)gmail.com> stable inclusion from stable-v6.6.140 commit 247ed8a969f981bfba3112fd4bb441eaa6cef59c category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9232 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fad217e16fded7f3c09f8637b0f6a224d58b5f2e ] When a tracepoint goes through the 0 -> 1 transition, tracepoint_add_func() invokes the subsystem's ext->regfunc() before attempting to install the new probe via func_add(). If func_add() then fails (for example, when allocate_probes() cannot allocate a new probe array under memory pressure and returns -ENOMEM), the function returns the error without calling the matching ext->unregfunc(), leaving the side effects of regfunc() behind with no installed probe to justify them. For syscall tracepoints this is particularly unpleasant: syscall_regfunc() bumps sys_tracepoint_refcount and sets SYSCALL_TRACEPOINT on every task. After a leaked failure, the refcount is stuck at a non-zero value with no consumer, and every task continues paying the syscall trace entry/exit overhead until reboot. Other subsystems providing regfunc()/unregfunc() pairs exhibit similarly scoped persistent state. Mirror the existing 1 -> 0 cleanup and call ext->unregfunc() in the func_add() error path, gated on the same condition used there so the unwind is symmetric with the registration. Fixes: 8cf868affdc4 ("tracing: Have the reg function allow to fail") Cc: stable(a)vger.kernel.org Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Link: https://patch.msgid.link/20260413190601.21993-1-devnexen@gmail.com Signed-off-by: David Carlier <devnexen(a)gmail.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> [ changed `tp->ext->unregfunc` to `tp->unregfunc` to match older struct layout ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/tracepoint.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/tracepoint.c b/kernel/tracepoint.c index 8d1507dd0724..f7a4210d5d5e 100644 --- a/kernel/tracepoint.c +++ b/kernel/tracepoint.c @@ -337,6 +337,8 @@ static int tracepoint_add_func(struct tracepoint *tp, lockdep_is_held(&tracepoints_mutex)); old = func_add(&tp_funcs, func, prio); if (IS_ERR(old)) { + if (tp->unregfunc && !static_key_enabled(&tp->key)) + tp->unregfunc(); WARN_ON_ONCE(warn && PTR_ERR(old) != -ENOMEM); return PTR_ERR(old); } -- 2.34.1

2 1

[PATCH OLK-5.10] tracepoint: balance regfunc() on func_add() failure in tracepoint_add_func()
by Tengda Wu 25 May '26

25 May '26

From: David Carlier <devnexen(a)gmail.com> mainline inclusion from mainline-v7.1-rc1 commit fad217e16fded7f3c09f8637b0f6a224d58b5f2e category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9232 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When a tracepoint goes through the 0 -> 1 transition, tracepoint_add_func() invokes the subsystem's ext->regfunc() before attempting to install the new probe via func_add(). If func_add() then fails (for example, when allocate_probes() cannot allocate a new probe array under memory pressure and returns -ENOMEM), the function returns the error without calling the matching ext->unregfunc(), leaving the side effects of regfunc() behind with no installed probe to justify them. For syscall tracepoints this is particularly unpleasant: syscall_regfunc() bumps sys_tracepoint_refcount and sets SYSCALL_TRACEPOINT on every task. After a leaked failure, the refcount is stuck at a non-zero value with no consumer, and every task continues paying the syscall trace entry/exit overhead until reboot. Other subsystems providing regfunc()/unregfunc() pairs exhibit similarly scoped persistent state. Mirror the existing 1 -> 0 cleanup and call ext->unregfunc() in the func_add() error path, gated on the same condition used there so the unwind is symmetric with the registration. Fixes: 8cf868affdc4 ("tracing: Have the reg function allow to fail") Cc: stable(a)vger.kernel.org Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Link: https://patch.msgid.link/20260413190601.21993-1-devnexen@gmail.com Signed-off-by: David Carlier <devnexen(a)gmail.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Tengda Wu <wutengda(a)huaweicloud.com> --- kernel/tracepoint.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/tracepoint.c b/kernel/tracepoint.c index 2dff7f1a27ec..33017d6806d2 100644 --- a/kernel/tracepoint.c +++ b/kernel/tracepoint.c @@ -358,6 +358,8 @@ static int tracepoint_add_func(struct tracepoint *tp, lockdep_is_held(&tracepoints_mutex)); old = func_add(&tp_funcs, func, prio); if (IS_ERR(old)) { + if (tp->ext && tp->ext->unregfunc && !static_key_enabled(&tp->key)) + tp->ext->unregfunc(); WARN_ON_ONCE(warn && PTR_ERR(old) != -ENOMEM); return PTR_ERR(old); } -- 2.34.1

2 1

[PATCH OLK-6.6] net: yt6801: fix link info for yt6801
by Frank_Sae 25 May '26

25 May '26

yt6801 inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/7229 -------------------------------------------------------------------- fix the link info is not update on os installation. Fixes: 6460d9d3c42d ("yt6801: Add Motorcomm yt6801 PCIe driver") Signed-off-by: Frank_Sae <Frank.Sae(a)motor-comm.com> --- .../net/ethernet/motorcomm/yt6801/yt6801_main.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) mode change 100644 => 100755 drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c diff --git a/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c b/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c old mode 100644 new mode 100755 index 01eed3ace3c6..93b7f41a2cb9 --- a/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c +++ b/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c @@ -27,6 +27,18 @@ const struct net_device_ops *fxgmac_get_netdev_ops(void); static void fxgmac_napi_enable(struct fxgmac_pdata *priv); +const struct ethtool_ops *fxgmac_get_ethtool_ops(void); + +static const struct ethtool_ops fxgmac_ethtool_ops = { + .get_link = ethtool_op_get_link, + .get_link_ksettings = phy_ethtool_get_link_ksettings, + .set_link_ksettings = phy_ethtool_set_link_ksettings +}; + +const struct ethtool_ops *fxgmac_get_ethtool_ops(void) +{ + return &fxgmac_ethtool_ops; +} #define PHY_WR_CONFIG(reg_offset) (0x8000205 + ((reg_offset) * 0x10000)) static int fxgmac_phy_write_reg(struct fxgmac_pdata *priv, u32 reg_id, u32 data) @@ -1898,7 +1910,9 @@ static int fxgmac_init(struct fxgmac_pdata *priv, bool save_private_reg) ndev->max_mtu = FXGMAC_JUMBO_PACKET_MTU + (ETH_HLEN + VLAN_HLEN + ETH_FCS_LEN); + ndev->netdev_ops = fxgmac_get_netdev_ops();/* Set device operations */ + ndev->ethtool_ops = fxgmac_get_ethtool_ops();/* Set device operations */ /* Set device features */ if (priv->hw_feat.tso) { -- 2.34.1

2 1

[PATCH OLK-5.10] tracing: branch: Fix inverted check on stat tracer registration
by Tengda Wu 25 May '26

25 May '26

From: Breno Leitao <leitao(a)debian.org> mainline inclusion from mainline-v7.1-rc2 commit 3b75dd76e64a04771861bb5647951c264919e563 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9232 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- init_annotated_branch_stats() and all_annotated_branch_stats() check the return value of register_stat_tracer() with "if (!ret)", but register_stat_tracer() returns 0 on success and a negative errno on failure. The inverted check causes the warning to be printed on every successful registration, e.g.: Warning: could not register annotated branches stats while leaving real failures silent. The initcall also returned a hard-coded 1 instead of the actual error. Invert the check and propagate ret so that the warning fires on real errors and the initcall reports the correct status. Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Cc: Ingo Molnar <mingo(a)elte.hu> Cc: Frederic Weisbecker <fweisbec(a)gmail.com> Link: https://patch.msgid.link/20260420-tracing-v1-1-d8f4cd0d6af1@debian.org Fixes: 002bb86d8d42 ("tracing/ftrace: separate events tracing and stats tracing engine") Signed-off-by: Breno Leitao <leitao(a)debian.org> Acked-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org> Signed-off-by: Steven Rostedt <rostedt(a)goodmis.org> Signed-off-by: Tengda Wu <wutengda(a)huaweicloud.com> --- kernel/trace/trace_branch.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/kernel/trace/trace_branch.c b/kernel/trace/trace_branch.c index e47fdb4c92fb..30f72e0ecb5d 100644 --- a/kernel/trace/trace_branch.c +++ b/kernel/trace/trace_branch.c @@ -379,10 +379,10 @@ __init static int init_annotated_branch_stats(void) int ret; ret = register_stat_tracer(&annotated_branch_stats); - if (!ret) { + if (ret) { printk(KERN_WARNING "Warning: could not register " "annotated branches stats\n"); - return 1; + return ret; } return 0; } @@ -444,10 +444,10 @@ __init static int all_annotated_branch_stats(void) int ret; ret = register_stat_tracer(&all_branch_stats); - if (!ret) { + if (ret) { printk(KERN_WARNING "Warning: could not register " "all branches stats\n"); - return 1; + return ret; } return 0; } -- 2.34.1

2 1

[PATCH OLK-6.6] tracing: branch: Fix inverted check on stat tracer registration
by Tengda Wu 25 May '26

25 May '26

From: Breno Leitao <leitao(a)debian.org> stable inclusion from stable-v6.6.141 commit cbf460bf94921b1b07160cce6818d785af116bc8 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9232 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3b75dd76e64a04771861bb5647951c264919e563 ] init_annotated_branch_stats() and all_annotated_branch_stats() check the return value of register_stat_tracer() with "if (!ret)", but register_stat_tracer() returns 0 on success and a negative errno on failure. The inverted check causes the warning to be printed on every successful registration, e.g.: Warning: could not register annotated branches stats while leaving real failures silent. The initcall also returned a hard-coded 1 instead of the actual error. Invert the check and propagate ret so that the warning fires on real errors and the initcall reports the correct status. Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Cc: Ingo Molnar <mingo(a)elte.hu> Cc: Frederic Weisbecker <fweisbec(a)gmail.com> Link: https://patch.msgid.link/20260420-tracing-v1-1-d8f4cd0d6af1@debian.org Fixes: 002bb86d8d42 ("tracing/ftrace: separate events tracing and stats tracing engine") Signed-off-by: Breno Leitao <leitao(a)debian.org> Acked-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org> Signed-off-by: Steven Rostedt <rostedt(a)goodmis.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/trace/trace_branch.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/kernel/trace/trace_branch.c b/kernel/trace/trace_branch.c index e47fdb4c92fb..30f72e0ecb5d 100644 --- a/kernel/trace/trace_branch.c +++ b/kernel/trace/trace_branch.c @@ -379,10 +379,10 @@ __init static int init_annotated_branch_stats(void) int ret; ret = register_stat_tracer(&annotated_branch_stats); - if (!ret) { + if (ret) { printk(KERN_WARNING "Warning: could not register " "annotated branches stats\n"); - return 1; + return ret; } return 0; } @@ -444,10 +444,10 @@ __init static int all_annotated_branch_stats(void) int ret; ret = register_stat_tracer(&all_branch_stats); - if (!ret) { + if (ret) { printk(KERN_WARNING "Warning: could not register " "all branches stats\n"); - return 1; + return ret; } return 0; } -- 2.34.1

2 1

[PATCH OLK-5.10] crypto: pcrypt - Fix handling of MAY_BACKLOG requests
by Cai Xinchen 25 May '26

25 May '26

From: Herbert Xu <herbert(a)gondor.apana.org.au> mainline inclusion from mainline-v7.1-rc1 commit 915b692e6cb723aac658c25eb82c58fd81235110 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15062 CVE: CVE-2026-43493 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- MAY_BACKLOG requests can return EBUSY. Handle them by checking for that value and filtering out EINPROGRESS notifications. Reported-by: Yiming Qian <yimingqian591(a)gmail.com> Fixes: 5a1436beec57 ("crypto: pcrypt - call the complete function on error") Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Conflicts: crypto/pcrypt.c [Only context conflicts.] Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- crypto/pcrypt.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/crypto/pcrypt.c b/crypto/pcrypt.c index 2d7f98709e97..d545549e7a1a 100644 --- a/crypto/pcrypt.c +++ b/crypto/pcrypt.c @@ -69,6 +69,9 @@ static void pcrypt_aead_done(struct crypto_async_request *areq, int err) struct pcrypt_request *preq = aead_request_ctx(req); struct padata_priv *padata = pcrypt_request_padata(preq); + if (err == -EINPROGRESS) + return; + padata->info = err; padata_do_serial(padata); @@ -82,7 +85,7 @@ static void pcrypt_aead_enc(struct padata_priv *padata) ret = crypto_aead_encrypt(req); - if (ret == -EINPROGRESS) + if (ret == -EINPROGRESS || ret == -EBUSY) return; padata->info = ret; @@ -133,7 +136,7 @@ static void pcrypt_aead_dec(struct padata_priv *padata) ret = crypto_aead_decrypt(req); - if (ret == -EINPROGRESS) + if (ret == -EINPROGRESS || ret == -EBUSY) return; padata->info = ret; -- 2.34.1

2 1

内核崩溃协助排查 - openEuler 5.10.0-60.18.0.50.oe2203.x86_64
by 张宝 25 May '26

25 May '26

您好 openEuler 内核sig团队：       我司一台服务器（openEuler 22.03 LTS，内核 5.10.0-60.18.0.50.oe2203.x86_64，运行 342 天）发生内核崩溃，已收集到 vmcore。根据openEuler Witty智能诊断Agent 诊断报告，发现内核可能存在bug，恳请协助排查。当前状况我们已在 openEuler 社区提交 Issue（链接：https://gitcode.com/openeuler/kernel/issues/9047），待明确根因和解决方案。谢谢！附 1. 内核日志片段 [29613041.914241] ------------[ cut here ]------------ [29613041.914241] kernel BUG at kernel/entry/common.c:427! ... [29613041.914259] BUG: stack guard page was hit at 00000000089c7912 [29613041.914260] NMI watchdog: Watchdog detected hard LOCKUP on cpu 8 [29613041.914272] CPU: 8 PID: 1249797 Comm: lurker Kdump: loaded Not tainted 5.10.0-60.18.0.50.oe2203.x86_64 #1 [29613041.914273] RIP: 0010:native_queued_spin_lock_slowpath+0x5c/0x1b0 ... [29613041.914325] traps: PANIC: double fault, error_code: 0x0 2. PID 1249797 (lurker) 的堆栈回溯 PID: 1249797  TASK: ffff9c26fc228000  CPU: 8   COMMAND: "lurker"  #0 [fffffe00001e2ee8] die at ffffffffa5e25b4a  #1 [fffffe00001e2f10] handle_stack_overflow at ffffffffa67dca7b  #2 [fffffe00001e2f28] exc_double_fault at ffffffffa6827a08  #3 [fffffe00001e2f50] asm_exc_double_fault at ffffffffa6a00b7e     [exception RIP: bsearch+2] ...  #160 [ffffa93bcf3b7958] no_context at ffffffffa5e71c37  #161 [ffffa93bcf3b7990] __bad_area_nosemaphore at ffffffffa5e71e62  #162 [ffffa93bcf3b79d8] exc_page_fault at ffffffffa682a565  #163 [ffffa93bcf3b7a30] asm_exc_page_fault at ffffffffa6a00ace     [exception RIP: vma_dump_size+39]     RIP: ffffffffa61d4fa7  RSP: ffffa93bcf3b7ae8  RFLAGS: 00010286     RAX: ffffffffb750aba0  RBX: ffff9c264e92f5c0 ...  #164 [ffffa93bcf3b7af8] dump_vma_snapshot at ffffffffa61d6461  #165 [ffffa93bcf3b7b60] elf_core_dump at ffffffffa61cefc9  #166 [ffffa93bcf3b7d40] do_coredump at ffffffffa61d5e81  #167 [ffffa93bcf3b7e38] get_signal at ffffffffa5eefd6f  #168 [ffffa93bcf3b7e88] arch_do_signal at ffffffffa5e21cda  #169 [ffffa93bcf3b7f10] exit_to_user_mode_loop at ffffffffa5f6f309  #170 [ffffa93bcf3b7f30] exit_to_user_mode_prepare at ffffffffa5f6f3a2  #171 [ffffa93bcf3b7f48] irqentry_exit_to_user_mode at ffffffffa682ac65  #172 [ffffa93bcf3b7f50] asm_exc_page_fault at ffffffffa6a00ace 3. 其他 CPU 的部分堆栈（CPU 1, 2, 7, 10, 14 均出现异常） CPU 1 (postgres):  #3 [fffffe0000045f50] asm_exc_double_fault     [exception RIP: do_error_trap+53] ...  #8 [ffffa93bcd274170] do_error_trap  #9 [ffffa93bcd2741b0] exc_invalid_op  #10 [ffffa93bcd2741d0] asm_exc_invalid_op     [exception RIP: fixup_exception+35] CPU 2 (log_server):  #3 [ffffa93bcef97ce0] native_queued_spin_lock_slowpath ...  #9 [ffffa93bcef97dc0] asm_exc_general_protection     [exception RIP: do_renameat2+50]     RIP: ffffffffa615e252 CPU 10 (df):  #2 [fffffe0000258f50] asm_exc_double_fault     [exception RIP: mmap_base+155]     RIP: ffffffffa5e732eb  RSP: 00000000029de8c0 4. 智能Agent 工具分析结果   ZDNS 张宝

1 0

[PATCH OLK-6.6] pstore/ram: fix resource leak when ioremap() fails
by Luo Gengkun 25 May '26

25 May '26

From: Cole Leavitt <cole(a)unwrap.rs> mainline inclusion from mainline-v7.1-rc1 commit 2ddb69f686ef7a621645e97fc7329c50edf5d0e5 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15064 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- In persistent_ram_iomap(), ioremap() or ioremap_wc() may return NULL on failure. Currently, if this happens, the function returns NULL without releasing the memory region acquired by request_mem_region(). This leads to a resource leak where the memory region remains reserved but unusable. Additionally, the caller persistent_ram_buffer_map() handles NULL correctly by returning -ENOMEM, but without this check, a NULL return combined with request_mem_region() succeeding leaves resources in an inconsistent state. This is the ioremap() counterpart to commit 05363abc7625 ("pstore: ram_core: fix incorrect success return when vmap() fails") which fixed a similar issue in the vmap() path. Fixes: 404a6043385d ("staging: android: persistent_ram: handle reserving and mapping memory") Signed-off-by: Cole Leavitt <cole(a)unwrap.rs> Link: https://patch.msgid.link/20260225235406.11790-1-cole@unwrap.rs Signed-off-by: Kees Cook <kees(a)kernel.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- fs/pstore/ram_core.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c index 7b6d6378a3b8..95675d4bab14 100644 --- a/fs/pstore/ram_core.c +++ b/fs/pstore/ram_core.c @@ -489,6 +489,10 @@ static void *persistent_ram_iomap(phys_addr_t start, size_t size, else va = ioremap_wc(start, size); + /* We must release the mem region if ioremap fails. */ + if (!va) + release_mem_region(start, size); + /* * Since request_mem_region() and ioremap() are byte-granularity * there is no need handle anything special like we do when the -- 2.34.1

2 1

Re: [PATCH OLK-6.6 4/4] iommu/arm-smmu-v3: Fix pgsize_bit for sva domains
by Qinxin Xia 25 May '26

25 May '26

On 2026/5/25 13:57:56, Greg KH <greg(a)kroah.com> wrote: > On Mon, May 25, 2026 at 10:35:39AM +0800, Qinxin Xia wrote: >> From: Balbir Singh <balbirs(a)nvidia.com> >> >> mainline inclusion >> from mainline-v6.15-rc5 >> commit 12f78021973ae422564b234136c702a305932d73 >> category: bugfix >> bugzilla: https://atomgit.com/openeuler/kernel/issues/9215 >> CVE: NA >> >> Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm… > > What is this for? > > confused, > > greg k-h Sorry for the noise – I forgot to use --suppress-cc=all when sending the patch. Please ignore the previous email. Thanks. -- Thanks, Qinxin

1 0

[PATCH OLK-6.6] net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode
by Zhang Qilong 25 May '26

25 May '26

From: Ziyi Guo <n7l8m4(a)u.northwestern.edu> stable inclusion from stable-v6.6.128 commit ef9b10a020503888eb6c8ed85a3d901a624ede4c category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14726 CVE: CVE-2026-43180 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 64868f5ecadeb359a49bc4485bfa7c497047f13a ] kaweth_set_rx_mode(), the ndo_set_rx_mode callback, calls netif_stop_queue() and netif_wake_queue(). These are TX queue flow control functions unrelated to RX multicast configuration. The premature netif_wake_queue() can re-enable TX while tx_urb is still in-flight, leading to a double usb_submit_urb() on the same URB: kaweth_start_xmit() { netif_stop_queue(); usb_submit_urb(kaweth->tx_urb); } kaweth_set_rx_mode() { netif_stop_queue(); netif_wake_queue(); // wakes TX queue before URB is done } kaweth_start_xmit() { netif_stop_queue(); usb_submit_urb(kaweth->tx_urb); // URB submitted while active } This triggers the WARN in usb_submit_urb(): "URB submitted while active" This is a similar class of bug fixed in rtl8150 by - commit 958baf5eaee3 ("net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast"). Also kaweth_set_rx_mode() is already functionally broken, the real set_rx_mode action is performed by kaweth_async_set_rx_mode(), which in turn is not a no-op only at ndo_open() time. Suggested-by: Paolo Abeni <pabeni(a)redhat.com> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Ziyi Guo <n7l8m4(a)u.northwestern.edu> Link: https://patch.msgid.link/20260217175012.1234494-1-n7l8m4@u.northwestern.edu Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- drivers/net/usb/kaweth.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/net/usb/kaweth.c b/drivers/net/usb/kaweth.c index a8c3ecf7d810..cb2472b59e10 100644 --- a/drivers/net/usb/kaweth.c +++ b/drivers/net/usb/kaweth.c @@ -763,21 +763,19 @@ static void kaweth_set_rx_mode(struct net_device *net) KAWETH_PACKET_FILTER_BROADCAST | KAWETH_PACKET_FILTER_MULTICAST; netdev_dbg(net, "Setting Rx mode to %d\n", packet_filter_bitmap); - netif_stop_queue(net); if (net->flags & IFF_PROMISC) { packet_filter_bitmap |= KAWETH_PACKET_FILTER_PROMISCUOUS; } else if (!netdev_mc_empty(net) || (net->flags & IFF_ALLMULTI)) { packet_filter_bitmap |= KAWETH_PACKET_FILTER_ALL_MULTICAST; } kaweth->packet_filter_bitmap = packet_filter_bitmap; - netif_wake_queue(net); } /**************************************************************** * kaweth_async_set_rx_mode ****************************************************************/ -- 2.43.0

2 1

[PATCH OLK-5.10] net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode
by Zhang Qilong 25 May '26

25 May '26

From: Ziyi Guo <n7l8m4(a)u.northwestern.edu> stable inclusion from stable-v5.10.252 commit 443a830b1dc4f85c7560da59d4494b629feee215 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14726 CVE: CVE-2026-43180 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 64868f5ecadeb359a49bc4485bfa7c497047f13a ] kaweth_set_rx_mode(), the ndo_set_rx_mode callback, calls netif_stop_queue() and netif_wake_queue(). These are TX queue flow control functions unrelated to RX multicast configuration. The premature netif_wake_queue() can re-enable TX while tx_urb is still in-flight, leading to a double usb_submit_urb() on the same URB: kaweth_start_xmit() { netif_stop_queue(); usb_submit_urb(kaweth->tx_urb); } kaweth_set_rx_mode() { netif_stop_queue(); netif_wake_queue(); // wakes TX queue before URB is done } kaweth_start_xmit() { netif_stop_queue(); usb_submit_urb(kaweth->tx_urb); // URB submitted while active } This triggers the WARN in usb_submit_urb(): "URB submitted while active" This is a similar class of bug fixed in rtl8150 by - commit 958baf5eaee3 ("net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast"). Also kaweth_set_rx_mode() is already functionally broken, the real set_rx_mode action is performed by kaweth_async_set_rx_mode(), which in turn is not a no-op only at ndo_open() time. Suggested-by: Paolo Abeni <pabeni(a)redhat.com> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Ziyi Guo <n7l8m4(a)u.northwestern.edu> Link: https://patch.msgid.link/20260217175012.1234494-1-n7l8m4@u.northwestern.edu Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- drivers/net/usb/kaweth.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/net/usb/kaweth.c b/drivers/net/usb/kaweth.c index a8c3ecf7d810..cb2472b59e10 100644 --- a/drivers/net/usb/kaweth.c +++ b/drivers/net/usb/kaweth.c @@ -763,21 +763,19 @@ static void kaweth_set_rx_mode(struct net_device *net) KAWETH_PACKET_FILTER_BROADCAST | KAWETH_PACKET_FILTER_MULTICAST; netdev_dbg(net, "Setting Rx mode to %d\n", packet_filter_bitmap); - netif_stop_queue(net); if (net->flags & IFF_PROMISC) { packet_filter_bitmap |= KAWETH_PACKET_FILTER_PROMISCUOUS; } else if (!netdev_mc_empty(net) || (net->flags & IFF_ALLMULTI)) { packet_filter_bitmap |= KAWETH_PACKET_FILTER_ALL_MULTICAST; } kaweth->packet_filter_bitmap = packet_filter_bitmap; - netif_wake_queue(net); } /**************************************************************** * kaweth_async_set_rx_mode ****************************************************************/ -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode
by Zhang Qilong 25 May '26

25 May '26

From: Ziyi Guo <n7l8m4(a)u.northwestern.edu> stable inclusion from stable-v5.10.252 commit 443a830b1dc4f85c7560da59d4494b629feee215 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14726 CVE: CVE-2026-43180 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 64868f5ecadeb359a49bc4485bfa7c497047f13a ] kaweth_set_rx_mode(), the ndo_set_rx_mode callback, calls netif_stop_queue() and netif_wake_queue(). These are TX queue flow control functions unrelated to RX multicast configuration. The premature netif_wake_queue() can re-enable TX while tx_urb is still in-flight, leading to a double usb_submit_urb() on the same URB: kaweth_start_xmit() { netif_stop_queue(); usb_submit_urb(kaweth->tx_urb); } kaweth_set_rx_mode() { netif_stop_queue(); netif_wake_queue(); // wakes TX queue before URB is done } kaweth_start_xmit() { netif_stop_queue(); usb_submit_urb(kaweth->tx_urb); // URB submitted while active } This triggers the WARN in usb_submit_urb(): "URB submitted while active" This is a similar class of bug fixed in rtl8150 by - commit 958baf5eaee3 ("net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast"). Also kaweth_set_rx_mode() is already functionally broken, the real set_rx_mode action is performed by kaweth_async_set_rx_mode(), which in turn is not a no-op only at ndo_open() time. Suggested-by: Paolo Abeni <pabeni(a)redhat.com> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Ziyi Guo <n7l8m4(a)u.northwestern.edu> Link: https://patch.msgid.link/20260217175012.1234494-1-n7l8m4@u.northwestern.edu Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- drivers/net/usb/kaweth.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/net/usb/kaweth.c b/drivers/net/usb/kaweth.c index 913e50bab0a2..4e53512c87a0 100644 --- a/drivers/net/usb/kaweth.c +++ b/drivers/net/usb/kaweth.c @@ -853,21 +853,19 @@ static void kaweth_set_rx_mode(struct net_device *net) KAWETH_PACKET_FILTER_BROADCAST | KAWETH_PACKET_FILTER_MULTICAST; netdev_dbg(net, "Setting Rx mode to %d\n", packet_filter_bitmap); - netif_stop_queue(net); if (net->flags & IFF_PROMISC) { packet_filter_bitmap |= KAWETH_PACKET_FILTER_PROMISCUOUS; } else if (!netdev_mc_empty(net) || (net->flags & IFF_ALLMULTI)) { packet_filter_bitmap |= KAWETH_PACKET_FILTER_ALL_MULTICAST; } kaweth->packet_filter_bitmap = packet_filter_bitmap; - netif_wake_queue(net); } /**************************************************************** * kaweth_async_set_rx_mode ****************************************************************/ -- 2.43.0

2 1

[PATCH OLK-6.6 0/4] backport dma map and smmu patches from linux mainline
by Qinxin Xia 25 May '26

25 May '26

From: Hongye Lin <linhongye(a)h-partners.com> driver inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9215 ---------------------------------------------------------------------- Balbir Singh (1): iommu/arm-smmu-v3: Fix pgsize_bit for sva domains Qinxin Xia (3): dma-mapping: benchmark: modify the framework to adapt to more map modes dma-mapping: benchmark: add support for dma_map_sg tools/dma: Add dma_map_sg support .../iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c | 6 + include/linux/map_benchmark.h | 13 +- kernel/dma/map_benchmark.c | 246 ++++++++++++++++-- .../testing/selftests/dma/dma_map_benchmark.c | 23 +- 4 files changed, 260 insertions(+), 28 deletions(-) -- 2.33.0

2 5

[PATCH OLK-6.6 00/34] perf arm-spe: Extend branch operations
by Yushan Wang 25 May '26

25 May '26

From: jiangying123456 <jiangying44(a)h-partners.com> In Arm ARM (ARM DDI 0487, L.a), the section "D18.2.7 Operation Type packet", the branch subclass is extended for Call Return (CR), Guarded control stack data access (GCS). This commit adds support CR and GCS operations. The IND (indirect) operation is defined only in bit [1], its macro is updated accordingly. Move the COND (Conditional) macro into the same group with other operations for better maintenance. Anshuman Khandual (9): arm64: Handle BRBE booting requirements arm64/sysreg: Update register fields for ID_AA64MMFR0_EL1 arm64/sysreg: Add register fields for HDFGRTR2_EL2 arm64/sysreg: Add register fields for HDFGWTR2_EL2 arm64/sysreg: Add register fields for HFGITR2_EL2 arm64/sysreg: Add register fields for HFGRTR2_EL2 arm64/sysreg: Add register fields for HFGWTR2_EL2 arm64/sysreg: Update ID_DFR0_EL1 register fields arm64/boot: Enable EL2 requirements for FEAT_PMUv3p9 Dave Martin (1): arm64: el2_setup.h: Rename some labels to be more diff-friendly James Clark (12): perf: arm_spe: Add format option for discard mode arm64: sysreg: Add new PMSFCR_EL1 fields and PMSDSFR_EL1 register perf: arm_spe: Support FEAT_SPEv1p4 filters perf: arm_spe: Add support for FEAT_SPE_EFT extended filtering arm64/boot: Factor out a macro to check SPE version arm64/boot: Enable EL2 requirements for SPE_FEAT_FDS KVM: arm64: Add trap configs for PMSDSFR_EL1 perf: Add perf_event_attr::config4 perf: arm_spe: Add support for filtering on data source tools headers UAPI: Sync linux/perf_event.h with the kernel sources perf tools: Add support for perf_event_attr::config4 perf docs: arm-spe: Document new SPE filtering features Leo Yan (1): perf: arm_spe: Expose event filter Marc Zyngier (5): KVM: arm64: Shave a few bytes from the EL2 idmap code arm64/sysreg: Allow a 'Mapping' descriptor for system registers arm64: sysreg: Add registers trapped by HDFG{R,W}TR2_EL2 KVM: arm64: nv: Add include containing the VNCR_EL2 offsets arm64: sysreg: Update PMSIDR_EL1 description Rob Herring (Arm) (5): arm64: el2_setup.h: Make __init_el2_fgt labels consistent, again perf/arm_pmuv3: Add PMUv3.9 per counter EL0 access control perf: arm_pmu: Use of_property_present() perf: arm_pmu: Remove event index to counter remapping ARM: pmuv3: Add missing write_pmuacr() Yushan Wang (1): Revert "arm64/boot: Enable EL2 requirements for BRBE" Documentation/arch/arm64/booting.rst | 75 +++- arch/arm/include/asm/arm_pmuv3.h | 2 + arch/arm64/include/asm/el2_setup.h | 130 +++--- arch/arm64/include/asm/kvm_asm.h | 1 + arch/arm64/include/asm/sysreg.h | 19 +- arch/arm64/include/asm/vncr_mapping.h | 105 +++++ arch/arm64/kernel/asm-offsets.c | 1 + arch/arm64/kvm/emulate-nested.c | 1 + arch/arm64/kvm/hyp/nvhe/hyp-init.S | 52 ++- arch/arm64/kvm/pmu-emul.c | 6 +- arch/arm64/kvm/sys_regs.c | 1 + arch/arm64/tools/gen-sysreg.awk | 2 +- arch/arm64/tools/sysreg | 502 +++++++++++++++++++++- drivers/perf/apple_m1_cpu_pmu.c | 4 +- drivers/perf/arm_pmu.c | 11 +- drivers/perf/arm_pmu_platform.c | 2 +- drivers/perf/arm_pmuv3.c | 61 +-- drivers/perf/arm_spe_pmu.c | 170 +++++++- include/linux/perf/arm_pmu.h | 2 +- include/linux/perf/arm_pmuv3.h | 1 + include/uapi/linux/perf_event.h | 4 + tools/include/uapi/linux/perf_event.h | 2 + tools/perf/Documentation/perf-arm-spe.txt | 103 ++++- tools/perf/tests/parse-events.c | 14 +- tools/perf/util/parse-events.c | 11 + tools/perf/util/parse-events.h | 1 + tools/perf/util/parse-events.l | 1 + tools/perf/util/pmu.c | 3 + tools/perf/util/pmu.h | 1 + 29 files changed, 1098 insertions(+), 190 deletions(-) create mode 100644 arch/arm64/include/asm/vncr_mapping.h -- 2.33.0

1 37

[PATCH OLK-6.6 00/34] perf arm-spe: Extend branch operations
by Yushan Wang 22 May '26

22 May '26

From: jiangying123456 <jiangying44(a)h-partners.com> In Arm ARM (ARM DDI 0487, L.a), the section "D18.2.7 Operation Type packet", the branch subclass is extended for Call Return (CR), Guarded control stack data access (GCS). This commit adds support CR and GCS operations. The IND (indirect) operation is defined only in bit [1], its macro is updated accordingly. Move the COND (Conditional) macro into the same group with other operations for better maintenance. Anshuman Khandual (9): arm64: Handle BRBE booting requirements arm64/sysreg: Update register fields for ID_AA64MMFR0_EL1 arm64/sysreg: Add register fields for HDFGRTR2_EL2 arm64/sysreg: Add register fields for HDFGWTR2_EL2 arm64/sysreg: Add register fields for HFGITR2_EL2 arm64/sysreg: Add register fields for HFGRTR2_EL2 arm64/sysreg: Add register fields for HFGWTR2_EL2 arm64/sysreg: Update ID_DFR0_EL1 register fields arm64/boot: Enable EL2 requirements for FEAT_PMUv3p9 Dave Martin (1): arm64: el2_setup.h: Rename some labels to be more diff-friendly James Clark (12): perf: arm_spe: Add format option for discard mode arm64: sysreg: Add new PMSFCR_EL1 fields and PMSDSFR_EL1 register perf: arm_spe: Support FEAT_SPEv1p4 filters perf: arm_spe: Add support for FEAT_SPE_EFT extended filtering arm64/boot: Factor out a macro to check SPE version arm64/boot: Enable EL2 requirements for SPE_FEAT_FDS KVM: arm64: Add trap configs for PMSDSFR_EL1 perf: Add perf_event_attr::config4 perf: arm_spe: Add support for filtering on data source tools headers UAPI: Sync linux/perf_event.h with the kernel sources perf tools: Add support for perf_event_attr::config4 perf docs: arm-spe: Document new SPE filtering features Leo Yan (1): perf: arm_spe: Expose event filter Marc Zyngier (5): KVM: arm64: Shave a few bytes from the EL2 idmap code arm64/sysreg: Allow a 'Mapping' descriptor for system registers arm64: sysreg: Add registers trapped by HDFG{R,W}TR2_EL2 KVM: arm64: nv: Add include containing the VNCR_EL2 offsets arm64: sysreg: Update PMSIDR_EL1 description Rob Herring (Arm) (5): arm64: el2_setup.h: Make __init_el2_fgt labels consistent, again perf/arm_pmuv3: Add PMUv3.9 per counter EL0 access control perf: arm_pmu: Use of_property_present() perf: arm_pmu: Remove event index to counter remapping ARM: pmuv3: Add missing write_pmuacr() Yushan Wang (1): Revert "arm64/boot: Enable EL2 requirements for BRBE" Documentation/arch/arm64/booting.rst | 75 +++- arch/arm/include/asm/arm_pmuv3.h | 2 + arch/arm64/include/asm/el2_setup.h | 130 +++--- arch/arm64/include/asm/kvm_asm.h | 1 + arch/arm64/include/asm/sysreg.h | 19 +- arch/arm64/include/asm/vncr_mapping.h | 105 +++++ arch/arm64/kernel/asm-offsets.c | 1 + arch/arm64/kvm/emulate-nested.c | 1 + arch/arm64/kvm/hyp/nvhe/hyp-init.S | 52 ++- arch/arm64/kvm/pmu-emul.c | 6 +- arch/arm64/kvm/sys_regs.c | 1 + arch/arm64/tools/gen-sysreg.awk | 2 +- arch/arm64/tools/sysreg | 502 +++++++++++++++++++++- drivers/perf/apple_m1_cpu_pmu.c | 4 +- drivers/perf/arm_pmu.c | 11 +- drivers/perf/arm_pmu_platform.c | 2 +- drivers/perf/arm_pmuv3.c | 61 +-- drivers/perf/arm_spe_pmu.c | 170 +++++++- include/linux/perf/arm_pmu.h | 2 +- include/linux/perf/arm_pmuv3.h | 1 + include/uapi/linux/perf_event.h | 4 + tools/include/uapi/linux/perf_event.h | 2 + tools/perf/Documentation/perf-arm-spe.txt | 103 ++++- tools/perf/tests/parse-events.c | 14 +- tools/perf/util/parse-events.c | 11 + tools/perf/util/parse-events.h | 1 + tools/perf/util/parse-events.l | 1 + tools/perf/util/pmu.c | 3 + tools/perf/util/pmu.h | 1 + 29 files changed, 1098 insertions(+), 190 deletions(-) create mode 100644 arch/arm64/include/asm/vncr_mapping.h -- 2.33.0

1 37

[PATCH OLK-6.6] usb: gadget: f_ncm: Fix net_device lifecycle with device_move
by Xinyu Zheng 22 May '26

22 May '26

From: Kuen-Han Tsai <khtsai(a)google.com> mainline inclusion from mainline-v7.0-rc4 commit ec35c1969650e7cb6c8a91020e568ed46e3551b0 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14979 CVE: CVE-2026-43421 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The network device outlived its parent gadget device during disconnection, resulting in dangling sysfs links and null pointer dereference problems. A prior attempt to solve this by removing SET_NETDEV_DEV entirely [1] was reverted due to power management ordering concerns and a NO-CARRIER regression. A subsequent attempt to defer net_device allocation to bind [2] broke 1:1 mapping between function instance and network device, making it impossible for configfs to report the resolved interface name. This results in a regression where the DHCP server fails on pmOS. Use device_move to reparent the net_device between the gadget device and /sys/devices/virtual/ across bind/unbind cycles. This preserves the network interface across USB reconnection, allowing the DHCP server to retain their binding. Introduce gether_attach_gadget()/gether_detach_gadget() helpers and use __free(detach_gadget) macro to undo attachment on bind failure. The bind_count ensures device_move executes only on the first bind. [1] https://lore.kernel.org/lkml/f2a4f9847617a0929d62025748384092e5f35cce.camel… [2] https://lore.kernel.org/linux-usb/795ea759-7eaf-4f78-81f4-01ffbf2d7961@ixit… Fixes: 40d133d7f542 ("usb: gadget: f_ncm: convert to new function interface with backward compatibility") Cc: stable <stable(a)kernel.org> Signed-off-by: Kuen-Han Tsai <khtsai(a)google.com> Link: https://patch.msgid.link/20260309-f-ncm-revert-v2-7-ea2afbc7d9b2@google.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/usb/gadget/function/f_ncm.c [zxy: context conflict] Signed-off-by: Xinyu Zheng <zhengxinyu6(a)huawei.com> --- drivers/usb/gadget/function/f_ncm.c | 36 +++++++++++++++++++-------- drivers/usb/gadget/function/u_ether.c | 22 ++++++++++++++++ drivers/usb/gadget/function/u_ether.h | 26 +++++++++++++++++++ drivers/usb/gadget/function/u_ncm.h | 2 +- 4 files changed, 74 insertions(+), 12 deletions(-) diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c index 1da4e59338c5..56af3e57a07f 100644 --- a/drivers/usb/gadget/function/f_ncm.c +++ b/drivers/usb/gadget/function/f_ncm.c @@ -1425,6 +1425,7 @@ static int ncm_bind(struct usb_configuration *c, struct usb_function *f) struct f_ncm_opts *ncm_opts; struct usb_os_desc_table *os_desc_table __free(kfree) = NULL; + struct net_device *net __free(detach_gadget) = NULL; struct usb_request *request __free(free_usb_request) = NULL; if (!can_support_ecm(cdev->gadget)) @@ -1438,16 +1439,19 @@ static int ncm_bind(struct usb_configuration *c, struct usb_function *f) return -ENOMEM; } - mutex_lock(&ncm_opts->lock); - gether_set_gadget(ncm_opts->net, cdev->gadget); - if (!ncm_opts->bound) - status = gether_register_netdev(ncm_opts->net); - mutex_unlock(&ncm_opts->lock); - - if (status) - return status; - - ncm_opts->bound = true; + scoped_guard(mutex, &ncm_opts->lock) + if (ncm_opts->bind_count == 0) { + if (!device_is_registered(&ncm_opts->net->dev)) { + ncm_opts->net->mtu = (ncm_opts->max_segment_size - ETH_HLEN); + gether_set_gadget(ncm_opts->net, cdev->gadget); + status = gether_register_netdev(ncm_opts->net); + } else + status = gether_attach_gadget(ncm_opts->net, cdev->gadget); + + if (status) + return status; + net = ncm_opts->net; + } ncm_string_defs[1].s = ncm->ethaddr; @@ -1547,6 +1551,9 @@ static int ncm_bind(struct usb_configuration *c, struct usb_function *f) } ncm->notify_req = no_free_ptr(request); + ncm_opts->bind_count++; + retain_and_null_ptr(net); + DBG(cdev, "CDC Network: IN/%s OUT/%s NOTIFY/%s\n", ncm->port.in_ep->name, ncm->port.out_ep->name, ncm->notify->name); @@ -1593,7 +1600,7 @@ static void ncm_free_inst(struct usb_function_instance *f) struct f_ncm_opts *opts; opts = container_of(f, struct f_ncm_opts, func_inst); - if (opts->bound) + if (device_is_registered(&opts->net->dev)) gether_cleanup(netdev_priv(opts->net)); else free_netdev(opts->net); @@ -1655,9 +1662,12 @@ static void ncm_free(struct usb_function *f) static void ncm_unbind(struct usb_configuration *c, struct usb_function *f) { struct f_ncm *ncm = func_to_ncm(f); + struct f_ncm_opts *ncm_opts; DBG(c->cdev, "ncm unbind\n"); + ncm_opts = container_of(f->fi, struct f_ncm_opts, func_inst); + hrtimer_cancel(&ncm->task_timer); kfree(f->os_desc_table); @@ -1673,6 +1683,10 @@ static void ncm_unbind(struct usb_configuration *c, struct usb_function *f) kfree(ncm->notify_req->buf); usb_ep_free_request(ncm->notify, ncm->notify_req); + + ncm_opts->bind_count--; + if (ncm_opts->bind_count == 0) + gether_detach_gadget(ncm_opts->net); } static struct usb_function *ncm_alloc(struct usb_function_instance *fi) diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c index 2da2db5e15a3..fae3cd49e0f8 100644 --- a/drivers/usb/gadget/function/u_ether.c +++ b/drivers/usb/gadget/function/u_ether.c @@ -896,6 +896,28 @@ void gether_set_gadget(struct net_device *net, struct usb_gadget *g) } EXPORT_SYMBOL_GPL(gether_set_gadget); +int gether_attach_gadget(struct net_device *net, struct usb_gadget *g) +{ + int ret; + + ret = device_move(&net->dev, &g->dev, DPM_ORDER_DEV_AFTER_PARENT); + if (ret) + return ret; + + gether_set_gadget(net, g); + return 0; +} +EXPORT_SYMBOL_GPL(gether_attach_gadget); + +void gether_detach_gadget(struct net_device *net) +{ + struct eth_dev *dev = netdev_priv(net); + + device_move(&net->dev, NULL, DPM_ORDER_NONE); + dev->gadget = NULL; +} +EXPORT_SYMBOL_GPL(gether_detach_gadget); + int gether_set_dev_addr(struct net_device *net, const char *dev_addr) { struct eth_dev *dev; diff --git a/drivers/usb/gadget/function/u_ether.h b/drivers/usb/gadget/function/u_ether.h index 34be220cef77..c85a1cf3c115 100644 --- a/drivers/usb/gadget/function/u_ether.h +++ b/drivers/usb/gadget/function/u_ether.h @@ -150,6 +150,32 @@ static inline struct net_device *gether_setup_default(void) */ void gether_set_gadget(struct net_device *net, struct usb_gadget *g); +/** + * gether_attach_gadget - Reparent net_device to the gadget device. + * @net: The network device to reparent. + * @g: The target USB gadget device to parent to. + * + * This function moves the network device to be a child of the USB gadget + * device in the device hierarchy. This is typically done when the function + * is bound to a configuration. + * + * Returns 0 on success, or a negative error code on failure. + */ +int gether_attach_gadget(struct net_device *net, struct usb_gadget *g); + +/** + * gether_detach_gadget - Detach net_device from its gadget parent. + * @net: The network device to detach. + * + * This function moves the network device to be a child of the virtual + * devices parent, effectively detaching it from the USB gadget device + * hierarchy. This is typically done when the function is unbound + * from a configuration but the instance is not yet freed. + */ +void gether_detach_gadget(struct net_device *net); + +DEFINE_FREE(detach_gadget, struct net_device *, if (_T) gether_detach_gadget(_T)) + /** * gether_set_dev_addr - initialize an ethernet-over-usb link with eth address * @net: device representing this link diff --git a/drivers/usb/gadget/function/u_ncm.h b/drivers/usb/gadget/function/u_ncm.h index 5408854d8407..297e5087872f 100644 --- a/drivers/usb/gadget/function/u_ncm.h +++ b/drivers/usb/gadget/function/u_ncm.h @@ -18,7 +18,7 @@ struct f_ncm_opts { struct usb_function_instance func_inst; struct net_device *net; - bool bound; + int bind_count; struct config_group *ncm_interf_group; struct usb_os_desc ncm_os_desc; -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] arm64/mm: Enable batched TLB flush in unmap_hotplug_range()
by Wupeng Ma 22 May '26

22 May '26

Enable batched TLB flush in unmap_hotplug_range(). Anshuman Khandual (1): arm64/mm: Enable batched TLB flush in unmap_hotplug_range() Peter Zijlstra (1): arm64/mm: Implement pXX_leaf_size() support arch/arm64/include/asm/pgtable.h | 4 ++++ arch/arm64/mm/mmu.c | 36 ++++++++++++++++++-------------- 2 files changed, 24 insertions(+), 16 deletions(-) -- 2.43.0

2 3

[PATCH OLK-6.6] sched/fair: Do not send IPI if WFI timeout is 0
by Jinjie Ruan 22 May '26

22 May '26

hulk inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/8929 ---------------------------------------- When the WFI timeout is configured to 0, no WFI suppression will be applied to offline tasks and no IPI is needed, and no IPI will eliminate the background noise. Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- arch/arm64/include/asm/xint.h | 2 ++ arch/arm64/kernel/smt_qos.c | 2 +- kernel/sched/smt_qos.c | 2 +- 3 files changed, 4 insertions(+), 2 deletions(-) diff --git a/arch/arm64/include/asm/xint.h b/arch/arm64/include/asm/xint.h index 2a63c663988e..7d89280a53f8 100644 --- a/arch/arm64/include/asm/xint.h +++ b/arch/arm64/include/asm/xint.h @@ -5,6 +5,8 @@ #define NR_IPI_USER 7 // SGI #ifndef __ASSEMBLY__ +extern unsigned int sysctl_sched_wfi_timeout; + extern void gic_handle_irq_noack(struct pt_regs *regs); extern void gic_handle_nmi_noack(struct pt_regs *regs); extern void arch_smp_send_ipi_user(int cpu); diff --git a/arch/arm64/kernel/smt_qos.c b/arch/arm64/kernel/smt_qos.c index 7e1a8e1121da..9f113c50d389 100644 --- a/arch/arm64/kernel/smt_qos.c +++ b/arch/arm64/kernel/smt_qos.c @@ -11,7 +11,7 @@ #include <vdso/time64.h> -static unsigned int sysctl_sched_wfi_timeout = 50; +unsigned int sysctl_sched_wfi_timeout = 50; static DEFINE_STATIC_KEY_TRUE(split_mode); static u32 arch_timer_freq; diff --git a/kernel/sched/smt_qos.c b/kernel/sched/smt_qos.c index 8f3eead1b179..c07c279ab0f7 100644 --- a/kernel/sched/smt_qos.c +++ b/kernel/sched/smt_qos.c @@ -123,7 +123,7 @@ static inline void send_ipi_throttle_smt(int this_cpu) { int cpu; - if (!system_uses_xint()) + if (!system_uses_xint() || !sysctl_sched_wfi_timeout) return; for_each_cpu(cpu, cpu_smt_mask(this_cpu)) { -- 2.34.1

2 1

[PATCH OLK-5.10] arm64/mm: Enable batched TLB flush in unmap_hotplug_range()
by Wupeng Ma 22 May '26

22 May '26

From: Anshuman Khandual <anshuman.khandual(a)arm.com> stable inclusion from stable-v6.12.86 commit 7260b0ec7a84023412f8c26a456ee9a23e29bdb6 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9219 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 48478b9f791376b4b89018d7afdfd06865498f65 upstream. During a memory hot remove operation, both linear and vmemmap mappings for the memory range being removed, get unmapped via unmap_hotplug_range() but mapped pages get freed only for vmemmap mapping. This is just a sequential operation where each table entry gets cleared, followed by a leaf specific TLB flush, and then followed by memory free operation when applicable. This approach was simple and uniform both for vmemmap and linear mappings. But linear mapping might contain CONT marked block memory where it becomes necessary to first clear out all entire in the range before a TLB flush. This is as per the architecture requirement. Hence batch all TLB flushes during the table tear down walk and finally do it in unmap_hotplug_range(). Prior to this fix, it was hypothetically possible for a speculative access to a higher address in the contiguous block to fill the TLB with shattered entries for the entire contiguous range after a lower address had already been cleared and invalidated. Due to the table entries being shattered, the subsequent TLB invalidation for the higher address would not then clear the TLB entries for the lower address, meaning stale TLB entries could persist. Besides it also helps in improving the performance via TLBI range operation along with reduced synchronization instructions. The time spent executing unmap_hotplug_range() improved 97% measured over a 2GB memory hot removal in KVM guest. This scheme is not applicable during vmemmap mapping tear down where memory needs to be freed and hence a TLB flush is required after clearing out page table entry. Cc: Will Deacon <will(a)kernel.org> Cc: linux-arm-kernel(a)lists.infradead.org Cc: linux-kernel(a)vger.kernel.org Closes: https://lore.kernel.org/all/aWZYXhrT6D2M-7-N@willie-the-truck/ Fixes: bbd6ec605c0f ("arm64/mm: Enable memory hot remove") Cc: stable(a)vger.kernel.org Reviewed-by: David Hildenbrand (Arm) <david(a)kernel.org> Reviewed-by: Ryan Roberts <ryan.roberts(a)arm.com> Signed-off-by: Ryan Roberts <ryan.roberts(a)arm.com> Signed-off-by: Anshuman Khandual <anshuman.khandual(a)arm.com> Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: arch/arm64/mm/mmu.c [Conflicts due to commit 5a00bfd6a52c ("arm64/mm: new ptep layer to manage contig bit") update pte_clear to __pte_clear, that is fine.] Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- arch/arm64/mm/mmu.c | 36 ++++++++++++++++++++---------------- 1 file changed, 20 insertions(+), 16 deletions(-) diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c index adaca1fd5a277..a1f7080643a86 100644 --- a/arch/arm64/mm/mmu.c +++ b/arch/arm64/mm/mmu.c @@ -874,10 +874,14 @@ static void unmap_hotplug_pte_range(pmd_t *pmdp, unsigned long addr, WARN_ON(!pte_present(pte)); pte_clear(&init_mm, addr, ptep); - flush_tlb_kernel_range(addr, addr + PAGE_SIZE); - if (free_mapped) + if (free_mapped) { + /* CONT blocks are not supported in the vmemmap */ + WARN_ON(pte_cont(pte)); + flush_tlb_kernel_range(addr, addr + PAGE_SIZE); free_hotplug_page_range(pte_page(pte), PAGE_SIZE, altmap); + } + /* unmap_hotplug_range() flushes TLB for !free_mapped */ } while (addr += PAGE_SIZE, addr < end); } @@ -898,15 +902,14 @@ static void unmap_hotplug_pmd_range(pud_t *pudp, unsigned long addr, WARN_ON(!pmd_present(pmd)); if (pmd_sect(pmd)) { pmd_clear(pmdp); - - /* - * One TLBI should be sufficient here as the PMD_SIZE - * range is mapped with a single block entry. - */ - flush_tlb_kernel_range(addr, addr + PAGE_SIZE); - if (free_mapped) + if (free_mapped) { + /* CONT blocks are not supported in the vmemmap */ + WARN_ON(pmd_cont(pmd)); + flush_tlb_kernel_range(addr, addr + PMD_SIZE); free_hotplug_page_range(pmd_page(pmd), PMD_SIZE, altmap); + } + /* unmap_hotplug_range() flushes TLB for !free_mapped */ continue; } WARN_ON(!pmd_table(pmd)); @@ -931,15 +934,12 @@ static void unmap_hotplug_pud_range(p4d_t *p4dp, unsigned long addr, WARN_ON(!pud_present(pud)); if (pud_sect(pud)) { pud_clear(pudp); - - /* - * One TLBI should be sufficient here as the PUD_SIZE - * range is mapped with a single block entry. - */ - flush_tlb_kernel_range(addr, addr + PAGE_SIZE); - if (free_mapped) + if (free_mapped) { + flush_tlb_kernel_range(addr, addr + PUD_SIZE); free_hotplug_page_range(pud_page(pud), PUD_SIZE, altmap); + } + /* unmap_hotplug_range() flushes TLB for !free_mapped */ continue; } WARN_ON(!pud_table(pud)); @@ -969,6 +969,7 @@ static void unmap_hotplug_p4d_range(pgd_t *pgdp, unsigned long addr, static void unmap_hotplug_range(unsigned long addr, unsigned long end, bool free_mapped, struct vmem_altmap *altmap) { + unsigned long start = addr; unsigned long next; pgd_t *pgdp, pgd; @@ -990,6 +991,9 @@ static void unmap_hotplug_range(unsigned long addr, unsigned long end, WARN_ON(!pgd_present(pgd)); unmap_hotplug_p4d_range(pgdp, addr, next, free_mapped, altmap); } while (addr = next, addr < end); + + if (!free_mapped) + flush_tlb_kernel_range(start, end); } static void free_empty_pte_table(pmd_t *pmdp, unsigned long addr, -- 2.43.0

2 2

[PATCH OLK-6.6] arm64/mm: Enable batched TLB flush in unmap_hotplug_range()
by Wupeng Ma 22 May '26

22 May '26

From: Anshuman Khandual <anshuman.khandual(a)arm.com> stable inclusion from stable-v6.12.86 commit 7260b0ec7a84023412f8c26a456ee9a23e29bdb6 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9219 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 48478b9f791376b4b89018d7afdfd06865498f65 upstream. During a memory hot remove operation, both linear and vmemmap mappings for the memory range being removed, get unmapped via unmap_hotplug_range() but mapped pages get freed only for vmemmap mapping. This is just a sequential operation where each table entry gets cleared, followed by a leaf specific TLB flush, and then followed by memory free operation when applicable. This approach was simple and uniform both for vmemmap and linear mappings. But linear mapping might contain CONT marked block memory where it becomes necessary to first clear out all entire in the range before a TLB flush. This is as per the architecture requirement. Hence batch all TLB flushes during the table tear down walk and finally do it in unmap_hotplug_range(). Prior to this fix, it was hypothetically possible for a speculative access to a higher address in the contiguous block to fill the TLB with shattered entries for the entire contiguous range after a lower address had already been cleared and invalidated. Due to the table entries being shattered, the subsequent TLB invalidation for the higher address would not then clear the TLB entries for the lower address, meaning stale TLB entries could persist. Besides it also helps in improving the performance via TLBI range operation along with reduced synchronization instructions. The time spent executing unmap_hotplug_range() improved 97% measured over a 2GB memory hot removal in KVM guest. This scheme is not applicable during vmemmap mapping tear down where memory needs to be freed and hence a TLB flush is required after clearing out page table entry. Cc: Will Deacon <will(a)kernel.org> Cc: linux-arm-kernel(a)lists.infradead.org Cc: linux-kernel(a)vger.kernel.org Closes: https://lore.kernel.org/all/aWZYXhrT6D2M-7-N@willie-the-truck/ Fixes: bbd6ec605c0f ("arm64/mm: Enable memory hot remove") Cc: stable(a)vger.kernel.org Reviewed-by: David Hildenbrand (Arm) <david(a)kernel.org> Reviewed-by: Ryan Roberts <ryan.roberts(a)arm.com> Signed-off-by: Ryan Roberts <ryan.roberts(a)arm.com> Signed-off-by: Anshuman Khandual <anshuman.khandual(a)arm.com> Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- arch/arm64/mm/mmu.c | 36 ++++++++++++++++++++---------------- 1 file changed, 20 insertions(+), 16 deletions(-) diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c index b2ef6c56db749..f65dbd76e2567 100644 --- a/arch/arm64/mm/mmu.c +++ b/arch/arm64/mm/mmu.c @@ -876,10 +876,14 @@ static void unmap_hotplug_pte_range(pmd_t *pmdp, unsigned long addr, WARN_ON(!pte_present(pte)); __pte_clear(&init_mm, addr, ptep); - flush_tlb_kernel_range(addr, addr + PAGE_SIZE); - if (free_mapped) + if (free_mapped) { + /* CONT blocks are not supported in the vmemmap */ + WARN_ON(pte_cont(pte)); + flush_tlb_kernel_range(addr, addr + PAGE_SIZE); free_hotplug_page_range(pte_page(pte), PAGE_SIZE, altmap); + } + /* unmap_hotplug_range() flushes TLB for !free_mapped */ } while (addr += PAGE_SIZE, addr < end); } @@ -900,15 +904,14 @@ static void unmap_hotplug_pmd_range(pud_t *pudp, unsigned long addr, WARN_ON(!pmd_present(pmd)); if (pmd_sect(pmd)) { pmd_clear(pmdp); - - /* - * One TLBI should be sufficient here as the PMD_SIZE - * range is mapped with a single block entry. - */ - flush_tlb_kernel_range(addr, addr + PAGE_SIZE); - if (free_mapped) + if (free_mapped) { + /* CONT blocks are not supported in the vmemmap */ + WARN_ON(pmd_cont(pmd)); + flush_tlb_kernel_range(addr, addr + PMD_SIZE); free_hotplug_page_range(pmd_page(pmd), PMD_SIZE, altmap); + } + /* unmap_hotplug_range() flushes TLB for !free_mapped */ continue; } WARN_ON(!pmd_table(pmd)); @@ -933,15 +936,12 @@ static void unmap_hotplug_pud_range(p4d_t *p4dp, unsigned long addr, WARN_ON(!pud_present(pud)); if (pud_sect(pud)) { pud_clear(pudp); - - /* - * One TLBI should be sufficient here as the PUD_SIZE - * range is mapped with a single block entry. - */ - flush_tlb_kernel_range(addr, addr + PAGE_SIZE); - if (free_mapped) + if (free_mapped) { + flush_tlb_kernel_range(addr, addr + PUD_SIZE); free_hotplug_page_range(pud_page(pud), PUD_SIZE, altmap); + } + /* unmap_hotplug_range() flushes TLB for !free_mapped */ continue; } WARN_ON(!pud_table(pud)); @@ -971,6 +971,7 @@ static void unmap_hotplug_p4d_range(pgd_t *pgdp, unsigned long addr, static void unmap_hotplug_range(unsigned long addr, unsigned long end, bool free_mapped, struct vmem_altmap *altmap) { + unsigned long start = addr; unsigned long next; pgd_t *pgdp, pgd; @@ -992,6 +993,9 @@ static void unmap_hotplug_range(unsigned long addr, unsigned long end, WARN_ON(!pgd_present(pgd)); unmap_hotplug_p4d_range(pgdp, addr, next, free_mapped, altmap); } while (addr = next, addr < end); + + if (!free_mapped) + flush_tlb_kernel_range(start, end); } static void free_empty_pte_table(pmd_t *pmdp, unsigned long addr, -- 2.43.0

2 1

[PATCH OLK-6.6 0/2] tracepoints: get correct superblock from dentry in event btrfs_sync_file()
by Pan Taixi 22 May '26

22 May '26

[ Upstream commit a85b46db143fda5869e7d8df8f258ccef5fa1719 ] If overlay is used on top of btrfs, dentry->d_sb translates to overlay's super block and fsid assignment will lead to a crash. Use file_inode(file)->i_sb to always get btrfs_sb. The patch above introduced another problem and is fixed in the following patch: The trace event btrfs_sync_file() is called in an atomic context (all trace events are) and its call to dput(), which is needed due to the call to dget_parent(), can sleep, triggering a kernel splat. This can be reproduced by enabling the trace event and running btrfs/056 from fstests for example. The splat shown in dmesg is the following: [53.919] BUG: sleeping function called from invalid context at fs/dcache.c:970 [53.947] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 32773, name: xfs_io [53.988] preempt_count: 2, expected: 0 [53.967] RCU nest depth: 0, expected: 0 [53.943] Preemption disabled at: [53.944] [<0000000000000000>] 0x0 [54.078] CPU: 0 UID: 0 PID: 32773 Comm: xfs_io Tainted: G W 7.1.0-rc1-btrfs-next-232+ #1 PREEMPT(full) [54.070] Tainted: [W]=WARN [54.071] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014 [54.072] Call Trace: [54.074] <TASK> [54.076] dump_stack_lvl+0x56/0x80 [54.079] __might_resched.cold+0xd6/0x10f [54.072] dput.part.0+0x24/0x110 [54.078] trace_event_raw_event_btrfs_sync_file+0x75/0x140 [btrfs] [54.089] btrfs_sync_file+0x1ed/0x530 [btrfs] [54.087] ? __handle_mm_fault+0x8ae/0xed0 [54.089] btrfs_do_write_iter+0x172/0x210 [btrfs] [54.091] vfs_write+0x21f/0x450 [54.094] __x64_sys_pwrite64+0x8d/0xc0 [54.096] ? do_user_addr_fault+0x20c/0x670 [54.099] do_syscall_64+0x60/0xf20 [54.092] ? clear_bhb_loop+0x60/0xb0 [54.094] entry_SYSCALL_64_after_hwframe+0x76/0x7e So stop using dget_parent() and dput() and access the parent dentry directly as dentry->d_parent. This is also what ext4 is doing in its equivalent trace event ext4_sync_file_enter(). Filipe Manana (1): btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() Goldwyn Rodrigues (1): btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file() include/trace/events/btrfs.h | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10 0/2] tracepoints: get correct superblock from dentry in event btrfs_sync_file()
by Pan Taixi 22 May '26

22 May '26

[ Upstream commit a85b46db143fda5869e7d8df8f258ccef5fa1719 ] If overlay is used on top of btrfs, dentry->d_sb translates to overlay's super block and fsid assignment will lead to a crash. Use file_inode(file)->i_sb to always get btrfs_sb. The patch above introduced another problem and is fixed in the following patch: The trace event btrfs_sync_file() is called in an atomic context (all trace events are) and its call to dput(), which is needed due to the call to dget_parent(), can sleep, triggering a kernel splat. This can be reproduced by enabling the trace event and running btrfs/056 from fstests for example. The splat shown in dmesg is the following: [53.919] BUG: sleeping function called from invalid context at fs/dcache.c:970 [53.947] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 32773, name: xfs_io [53.988] preempt_count: 2, expected: 0 [53.967] RCU nest depth: 0, expected: 0 [53.943] Preemption disabled at: [53.944] [<0000000000000000>] 0x0 [54.078] CPU: 0 UID: 0 PID: 32773 Comm: xfs_io Tainted: G W 7.1.0-rc1-btrfs-next-232+ #1 PREEMPT(full) [54.070] Tainted: [W]=WARN [54.071] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014 [54.072] Call Trace: [54.074] <TASK> [54.076] dump_stack_lvl+0x56/0x80 [54.079] __might_resched.cold+0xd6/0x10f [54.072] dput.part.0+0x24/0x110 [54.078] trace_event_raw_event_btrfs_sync_file+0x75/0x140 [btrfs] [54.089] btrfs_sync_file+0x1ed/0x530 [btrfs] [54.087] ? __handle_mm_fault+0x8ae/0xed0 [54.089] btrfs_do_write_iter+0x172/0x210 [btrfs] [54.091] vfs_write+0x21f/0x450 [54.094] __x64_sys_pwrite64+0x8d/0xc0 [54.096] ? do_user_addr_fault+0x20c/0x670 [54.099] do_syscall_64+0x60/0xf20 [54.092] ? clear_bhb_loop+0x60/0xb0 [54.094] entry_SYSCALL_64_after_hwframe+0x76/0x7e So stop using dget_parent() and dput() and access the parent dentry directly as dentry->d_parent. This is also what ext4 is doing in its equivalent trace event ext4_sync_file_enter(). Filipe Manana (1): btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() Goldwyn Rodrigues (1): btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file() include/trace/events/btrfs.h | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) -- 2.34.1

2 3

[PATCH v2 OLK-6.6 0/5] Fix NULL pointer dereference
by Liu Kai 22 May '26

22 May '26

Fix NULL pointer dereference Liu Kai (5): xSched/cgroup: remove legacy cftypes due to cgroup v1 incompatibility xSched: fix incorrect error returns in vstream allocation xSched: prevent HBM allocation for non-AI tasks xSched/dmem: memory allocation size must larger than 0 xSched: fix NULL pointer dereference in cfs_rq during class switch include/linux/xsched.h | 30 ++++++++++++++++++++++++------ kernel/xsched/cgroup.c | 3 +-- kernel/xsched/core.c | 12 ++++-------- kernel/xsched/vstream.c | 27 +++++++++------------------ 4 files changed, 38 insertions(+), 34 deletions(-) -- 2.34.1

2 6

[PATCH 00/23] KVM: arm64: rVIC/rVID PV interrupt controller
by Kunkun Jiang 21 May '26

21 May '26

https://lore.kernel.org/all/20200903152610.1078827-1-maz@kernel.org/ Marc Zyngier (5): irqchip/rvic: Add support for untrusted interrupt allocation irqchip: Add Reduced Virtual Interrupt Distributor support irqchip/rvid: Add PCI MSI support KVM: arm64: Tighten msis_require_devid reporting KVM: arm64: Add debugfs files for the rVIC/rVID implementation wanghaibin (18): irqchip: Add Reduced Virtual Interrupt Controller driver KVM: arm64: Move GIC model out of the distributor KVM: arm64: vgic-v3: Move early init to kvm_vgic_create() KVM: arm64: Add irqchip callback structure to kvm_arch KVM: arm64: Move kvm_vgic_destroy to kvm_irqchip_flow KVM: arm64: Move kvm_vgic_vcpu_init() to irqchip_flow KVM: arm64: Move kvm_vgic_vcpu_[un]blocking() to irqchip_flow KVM: arm64: Move kvm_vgic_vcpu_load/put() to irqchip_flow KVM: arm64: Move kvm_vgic_vcpu_pending_irq() to irqchip_flow KVM: arm64: Move vgic resource mapping on first run to irqchip_flow KVM: arm64: Move kvm_vgic_vcpu_{sync, flush}_hwstate() to irqchip_flow KVM: arm64: nVHE: Only save/restore GICv3 state if modeling a GIC KVM: arm64: Move interrupt injection to irqchip_flow KVM: arm64: Move mapping of HW interrupts into irqchip_flow KVM: arm64: Move set_owner into irqchip_flow KVM: arm64: Turn vgic_initialized into irqchip_finalized KVM: arm64: Move irqfd routing to irqchip_flow KVM: arm64: Add a rVIC/rVID in-kernel implementation arch/arm64/include/asm/kvm_host.h | 12 +- arch/arm64/include/asm/kvm_irq.h | 142 +++ arch/arm64/include/uapi/asm/kvm.h | 10 + arch/arm64/kvm/Makefile | 2 +- arch/arm64/kvm/arch_timer.c | 55 +- arch/arm64/kvm/arm.c | 128 ++- arch/arm64/kvm/hyp/nvhe/switch.c | 10 +- arch/arm64/kvm/hypercalls.c | 13 + arch/arm64/kvm/pmu-emul.c | 10 +- arch/arm64/kvm/rvic-cpu.c | 1217 +++++++++++++++++++++++++ arch/arm64/kvm/vgic/vgic-debug.c | 7 +- arch/arm64/kvm/vgic/vgic-init.c | 122 ++- arch/arm64/kvm/vgic/vgic-irqfd.c | 72 +- arch/arm64/kvm/vgic/vgic-its.c | 2 +- arch/arm64/kvm/vgic/vgic-kvm-device.c | 18 +- arch/arm64/kvm/vgic/vgic-mmio-v3.c | 2 +- arch/arm64/kvm/vgic/vgic-mmio.c | 14 +- arch/arm64/kvm/vgic/vgic-v3.c | 24 +- arch/arm64/kvm/vgic/vgic.c | 55 +- arch/arm64/kvm/vgic/vgic.h | 41 +- arch/arm64/kvm/virtcca_cvm.c | 2 +- drivers/irqchip/Kconfig | 12 + drivers/irqchip/Makefile | 2 + drivers/irqchip/irq-rvic.c | 595 ++++++++++++ drivers/irqchip/irq-rvid.c | 440 +++++++++ include/kvm/arm_rvic.h | 41 + include/kvm/arm_vgic.h | 32 - include/linux/cpuhotplug.h | 1 + include/linux/irqchip/irq-rvic.h | 100 ++ include/uapi/linux/kvm.h | 3 +- 30 files changed, 2945 insertions(+), 239 deletions(-) create mode 100644 arch/arm64/include/asm/kvm_irq.h create mode 100644 arch/arm64/kvm/rvic-cpu.c create mode 100644 drivers/irqchip/irq-rvic.c create mode 100644 drivers/irqchip/irq-rvid.c create mode 100644 include/kvm/arm_rvic.h create mode 100644 include/linux/irqchip/irq-rvic.h -- 2.33.0

1 23

[PATCH openEuler-1.0-LTS v7 00/11] support apei_page_offline_policy
by Qi Xi 21 May '26

21 May '26

Patches 1-4 are the old page isolation solution (enable_soft_offline + panic prevention), already delivered to customers. Original PR: https://atomgit.com/openeuler/kernel/merge_requests/20004 Patches 5-11 are the new solution, enabling automated configuration in the new version: Patches 5-7 remove the redundant enable_soft_offline bit 1 huge page isolation switch from the old solution, and copy mc only supports THP and regular pages. Patch 8 adds sysctl_apei_page_offline_policy to support regular/huge page isolation policies and driver notification chain. Patch 9-11 fix bugs. Changes in v7: Use blocking notifier for page offline policy chain Changes in v6: Fix panic casued by UCE in kernel context (!current->mm). Changes in v5: Change sysctl_apei_page_offline_policy bit0 to enable/disable driver notification. Backport some patches that have been merged. Since CONFIG_UCE_KERNEL_RECOVERY depends on CONFIG_ARM64, remove the redundant condition in migrate_page(). Changes in v4: Fix typo errors and backport bugfix for mc_copy. Changes in v3: Use bool rather than int as the return type of apei_page_should_offline(). Drop the PF_UCE_KERNEL_RECOVERY flag after soft-offlining the page. Changes in v2: Add a new sysctl_apei_page_offline_policy, instead of changing soft_offline_page. Jiaqi Yan (1): mm/memory-failure: userspace controls soft-offlining pages Kyle Meyer (1): mm/memory-failure: support disabling soft offline for HugeTLB pages Qi Xi (5): Revert "mm/memory-failure: support disabling soft offline for HugeTLB pages" Revert "arm64: mm: Add copy mc support for migrate_page" apei/ghes: Add sysctl interface to control soft-offline page isolation uce: Prevent kernel panic for kernel-context UCE with recovery path apei: use blocking notifier for page offline policy chain Wupeng Ma (3): uce: add copy_mc_highpage{s} arm64: mm: Add copy mc support for migrate_page arm64: mm: Add copy mc support for migrate_page Yongjian Sun (1): ext4: fix e4b bitmap inconsistency reports arch/arm64/mm/fault.c | 10 +++++- drivers/acpi/apei/ghes.c | 77 ++++++++++++++++++++++++++++++++++++++++ fs/ext4/mballoc.c | 21 +++++------ include/linux/highmem.h | 55 ++++++++++++++++++++++++++++ include/linux/mm.h | 7 ++++ kernel/sysctl.c | 21 +++++++++++ mm/memory-failure.c | 20 +++++++++-- mm/migrate.c | 58 ++++++++++++++++++++++++++++-- 8 files changed, 253 insertions(+), 16 deletions(-) -- 2.33.0

2 12

[PATCH OLK-5.10] apei: use blocking notifier for page offline policy chain
by Qi Xi 21 May '26

21 May '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9170 ------------------------------------------------------- atomic_notifier_call_chain() holds rcu_read_lock() over callbacks, which prevents sleeping. Notifier callbacks such as ipmi_pso_notifier_call() need to sleep for IPMI completion, triggering a BUG: sleeping function called from invalid context. Switch apei_page_offline_notifier_chain to a blocking notifier to allow callbacks to safely sleep when invoked from sysctl write path. Fixes: 543fadb5575a ("apei/ghes: Add sysctl interface to control soft-offline page isolation") Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- drivers/acpi/apei/ghes-policy.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/acpi/apei/ghes-policy.c b/drivers/acpi/apei/ghes-policy.c index 87c611f2cbaa..0bc12b0ba32b 100644 --- a/drivers/acpi/apei/ghes-policy.c +++ b/drivers/acpi/apei/ghes-policy.c @@ -17,18 +17,18 @@ int sysctl_apei_page_offline_policy __read_mostly = APEI_PAGE_OFFLINE_ALLOW_BASE_PAGE; EXPORT_SYMBOL(sysctl_apei_page_offline_policy); -static ATOMIC_NOTIFIER_HEAD(apei_page_offline_notifier_chain); +static BLOCKING_NOTIFIER_HEAD(apei_page_offline_notifier_chain); int register_apei_page_offline_notifier(struct notifier_block *nb) { - return atomic_notifier_chain_register( + return blocking_notifier_chain_register( &apei_page_offline_notifier_chain, nb); } EXPORT_SYMBOL(register_apei_page_offline_notifier); int unregister_apei_page_offline_notifier(struct notifier_block *nb) { - return atomic_notifier_chain_unregister( + return blocking_notifier_chain_unregister( &apei_page_offline_notifier_chain, nb); } EXPORT_SYMBOL(unregister_apei_page_offline_notifier); @@ -48,7 +48,7 @@ static int apei_page_offline_policy_handler(struct ctl_table *table, pr_debug("APEI policy: 0x%x -> 0x%x\n", old_val, new_val); if ((old_val ^ new_val) & APEI_PAGE_OFFLINE_NOTIFY) - atomic_notifier_call_chain( + blocking_notifier_call_chain( &apei_page_offline_notifier_chain, 0, &new_val); } -- 2.33.0

2 1

[PATCH OLK-5.10 0/2] tracepoints: get correct superblock from dentry in event btrfs_sync_file()
by Pan Taixi 21 May '26

21 May '26

[ Upstream commit a85b46db143fda5869e7d8df8f258ccef5fa1719 ] If overlay is used on top of btrfs, dentry->d_sb translates to overlay's super block and fsid assignment will lead to a crash. Use file_inode(file)->i_sb to always get btrfs_sb. The patch above introduced another problem and is fixed in the following patch: The trace event btrfs_sync_file() is called in an atomic context (all trace events are) and its call to dput(), which is needed due to the call to dget_parent(), can sleep, triggering a kernel splat. This can be reproduced by enabling the trace event and running btrfs/056 from fstests for example. The splat shown in dmesg is the following: [53.919] BUG: sleeping function called from invalid context at fs/dcache.c:970 [53.947] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 32773, name: xfs_io [53.988] preempt_count: 2, expected: 0 [53.967] RCU nest depth: 0, expected: 0 [53.943] Preemption disabled at: [53.944] [<0000000000000000>] 0x0 [54.078] CPU: 0 UID: 0 PID: 32773 Comm: xfs_io Tainted: G W 7.1.0-rc1-btrfs-next-232+ #1 PREEMPT(full) [54.070] Tainted: [W]=WARN [54.071] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014 [54.072] Call Trace: [54.074] <TASK> [54.076] dump_stack_lvl+0x56/0x80 [54.079] __might_resched.cold+0xd6/0x10f [54.072] dput.part.0+0x24/0x110 [54.078] trace_event_raw_event_btrfs_sync_file+0x75/0x140 [btrfs] [54.089] btrfs_sync_file+0x1ed/0x530 [btrfs] [54.087] ? __handle_mm_fault+0x8ae/0xed0 [54.089] btrfs_do_write_iter+0x172/0x210 [btrfs] [54.091] vfs_write+0x21f/0x450 [54.094] __x64_sys_pwrite64+0x8d/0xc0 [54.096] ? do_user_addr_fault+0x20c/0x670 [54.099] do_syscall_64+0x60/0xf20 [54.092] ? clear_bhb_loop+0x60/0xb0 [54.094] entry_SYSCALL_64_after_hwframe+0x76/0x7e So stop using dget_parent() and dput() and access the parent dentry directly as dentry->d_parent. This is also what ext4 is doing in its equivalent trace event ext4_sync_file_enter(). Filipe Manana (1): btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() Goldwyn Rodrigues (1): btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file() include/trace/events/btrfs.h | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/1] mfs: fix inode resource leak when cache object fd is zero
by Hongbo Li 21 May '26

21 May '26

Fix inode resource leak when cache object fd is zero. Hongbo Li (1): mfs: fix inode resource leak when cache object fd is zero fs/mfs/cache.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) -- 2.34.1

2 2

[PATCH OLK-6.6 00/10] bpf mainline for olk-6.6
by Pu Lehui 21 May '26

21 May '26

Daniel Borkmann (1): bpf, arm64: Fix off-by-one in check_imm signed range check David Carlier (1): bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path Jiayuan Chen (2): bpf: Fix use-after-free in offloaded map/prog info fill bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks Lang Xu (1): bpf: Fix OOB in pcpu_init_value MingTao Huang (1): bpf: Fix stale offload->prog pointer after constant blinding Mykyta Yatsenko (2): bpf: Fix NULL deref in map_kptr_match_type for scalar regs bpf: Use copy_map_value_locked() in alloc_htab_elem() for BPF_F_LOCK Sechang Lim (1): bpf: Fix RCU stall in bpf_fd_array_map_clear() Weiming Shi (1): bpf: fix end-of-list detection in cgroup_storage_get_next_key() arch/arm64/net/bpf_jit_comp.c | 4 ++-- kernel/bpf/arraymap.c | 4 +++- kernel/bpf/bpf_lsm.c | 2 -- kernel/bpf/core.c | 2 ++ kernel/bpf/devmap.c | 5 ++--- kernel/bpf/hashtab.c | 12 ++++++++---- kernel/bpf/local_storage.c | 2 +- kernel/bpf/offload.c | 10 ++++------ kernel/bpf/verifier.c | 5 ++++- 9 files changed, 26 insertions(+), 20 deletions(-) -- 2.34.1

2 12

[PATCH v2 OLK-6.6 0/5] Fix NULL pointer dereference
by Liu Kai 21 May '26

21 May '26

Fix NULL pointer dereference Liu Kai (5): xSched/cgroup: remove legacy cftypes due to cgroup v1 incompatibility xSched: fix incorrect error returns in vstream allocation xSched: prevent HBM allocation for non-AI tasks xSched/dmem: memory allocation size must larger than 0 xSched: fix NULL pointer dereference in cfs_rq during class switch include/linux/xsched.h | 26 ++++++++++++++++++++------ kernel/xsched/cgroup.c | 2 -- kernel/xsched/vstream.c | 27 +++++++++------------------ 3 files changed, 29 insertions(+), 26 deletions(-) -- 2.34.1

2 6

[PATCH OLK-6.6] Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists
by Liu Kai 21 May '26

21 May '26

From: Pauli Virtanen <pav(a)iki.fi> mainline inclusion from mainline-v7.0-rc7 commit 2969554bcfccb5c609f6b6cd4a014933f3a66dd0 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14554 CVE: CVE-2026-43022 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- hci_cmd_sync_queue_once() needs to indicate whether a queue item was added, so caller can know if callbacks are called, so it can avoid leaking resources. Change the function to return -EEXIST if queue item already exists. Modify all callsites to handle that. Signed-off-by: Pauli Virtanen <pav(a)iki.fi> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Conflicts: net/bluetooth/hci_sync.c [hci_connect_pa_sync(), hci_connect_big_sync(), hci_past_sync(), hci_le_read_remote_features(), hci_acl_change_pkt_type(), hci_le_set_phy() are not introduced, so some changes are not applied] Signed-off-by: Liu Kai <liukai284(a)huawei.com> --- net/bluetooth/hci_sync.c | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-) diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c index f4066b8e95da..0648cebf0865 100644 --- a/net/bluetooth/hci_sync.c +++ b/net/bluetooth/hci_sync.c @@ -798,7 +798,7 @@ int hci_cmd_sync_queue_once(struct hci_dev *hdev, hci_cmd_sync_work_func_t func, void *data, hci_cmd_sync_work_destroy_t destroy) { if (hci_cmd_sync_lookup_entry(hdev, func, data, destroy)) - return 0; + return -EEXIST; return hci_cmd_sync_queue(hdev, func, data, destroy); } @@ -3266,6 +3266,8 @@ static int update_passive_scan_sync(struct hci_dev *hdev, void *data) int hci_update_passive_scan(struct hci_dev *hdev) { + int err; + /* Only queue if it would have any effect */ if (!test_bit(HCI_UP, &hdev->flags) || test_bit(HCI_INIT, &hdev->flags) || @@ -3275,8 +3277,9 @@ int hci_update_passive_scan(struct hci_dev *hdev) hci_dev_test_flag(hdev, HCI_UNREGISTER)) return 0; - return hci_cmd_sync_queue_once(hdev, update_passive_scan_sync, NULL, - NULL); + err = hci_cmd_sync_queue_once(hdev, update_passive_scan_sync, NULL, + NULL); + return (err == -EEXIST) ? 0 : err; } int hci_write_sc_support_sync(struct hci_dev *hdev, u8 val) @@ -6904,8 +6907,11 @@ static int hci_acl_create_conn_sync(struct hci_dev *hdev, void *data) int hci_connect_acl_sync(struct hci_dev *hdev, struct hci_conn *conn) { - return hci_cmd_sync_queue_once(hdev, hci_acl_create_conn_sync, conn, - NULL); + int err; + + err = hci_cmd_sync_queue_once(hdev, hci_acl_create_conn_sync, conn, + NULL); + return (err == -EEXIST) ? 0 : err; } static void create_le_conn_complete(struct hci_dev *hdev, void *data, int err) @@ -6941,8 +6947,11 @@ static void create_le_conn_complete(struct hci_dev *hdev, void *data, int err) int hci_connect_le_sync(struct hci_dev *hdev, struct hci_conn *conn) { - return hci_cmd_sync_queue_once(hdev, hci_le_create_conn_sync, conn, - create_le_conn_complete); + int err; + + err = hci_cmd_sync_queue_once(hdev, hci_le_create_conn_sync, conn, + create_le_conn_complete); + return (err == -EEXIST) ? 0 : err; } int hci_cancel_connect_sync(struct hci_dev *hdev, struct hci_conn *conn) -- 2.34.1

2 1

[PATCH openEuler-24.03-LTS_SP3] tracing: test ci
by Tengda Wu 20 May '26

20 May '26

hulk inclusion category: feature bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14259 -------------------------------- This is a test. Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/trace/trace.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c index 39bef9ddc5ae..affd03dd969c 100644 --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -106,6 +106,8 @@ dummy_set_flag(struct trace_array *tr, u32 old_flags, u32 bit, int set) return 0; } +/* This is a test */ + /* * To prevent the comm cache from being overwritten when no * tracing is active, only save the comm when a trace event -- 2.34.1

1 0

[PATCH OLK-6.6 0/5] Fix NULL pointer dereference
by Liu Kai 20 May '26

20 May '26

Fix NULL pointer dereference Liu Kai (5): xSched/cgroup: remove legacy cftypes due to cgroup v1 incompatibility xSched: fix incorrect error returns in vstream allocation xSched: prevent HBM allocation for non-AI tasks xSched/dmem: memory allocation size must larger than 0 xSched: fix NULL pointer dereference in cfs_rq during class switch include/linux/xsched.h | 7 ++++++- kernel/xsched/cgroup.c | 2 -- kernel/xsched/vstream.c | 27 +++++++++------------------ 3 files changed, 15 insertions(+), 21 deletions(-) -- 2.34.1

2 6

[PATCH OLK-6.6 00/10] backport cpuidle patches from linux mainline
by Lifeng Zheng 20 May '26

20 May '26

From: Hongye Lin <linhongye(a)h-partners.com> driver inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9163 ---------------------------------------------------------------------- backport cpuidle patches from linux mainline Bowen Yu (3): update to sysfs_emit() for safer buffer handling cpufreq: Update sscanf() to kstrtouint() cpufreq: Replace magic number Hongye Lin (1): Revert "cpufreq: CPPC: Don't warn on failing to read perf counters on offline cpus" Jie Zhan (4): cpufreq: CPPC: Don't warn if FIE init fails to read counters ACPI: CPPC: Factor out and export per-cpu cppc_perf_ctrs_in_pcc_cpu() cpufreq: CPPC: Factor out cppc_fie_kworker_init() cpufreq: CPPC: Update FIE arch_freq_scale in ticks for non-PCC regs Pengjie Zhang (1): PM / devfreq: use _visible attribute to replace create/remove_sysfs_files() Sumit Gupta (1): arm64: topology: Fix false warning in counters_read_on_cpu() for same-CPU reads arch/arm64/kernel/topology.c | 21 +++++-- drivers/acpi/cppc_acpi.c | 48 ++++++++------- drivers/cpufreq/cppc_cpufreq.c | 105 ++++++++++++++++++++++----------- drivers/cpufreq/cpufreq.c | 14 ++--- drivers/devfreq/devfreq.c | 99 ++++++++++++++++++------------- include/acpi/cppc_acpi.h | 5 ++ 6 files changed, 181 insertions(+), 111 deletions(-) -- 2.33.0

2 11

[PATCH OLK-6.6 0/2] tracepoints: get correct superblock from dentry in event btrfs_sync_file()
by Pan Taixi 20 May '26

20 May '26

[ Upstream commit a85b46db143fda5869e7d8df8f258ccef5fa1719 ] If overlay is used on top of btrfs, dentry->d_sb translates to overlay's super block and fsid assignment will lead to a crash. Use file_inode(file)->i_sb to always get btrfs_sb. The patch above introduced another problem and is fixed in the following patch: The trace event btrfs_sync_file() is called in an atomic context (all trace events are) and its call to dput(), which is needed due to the call to dget_parent(), can sleep, triggering a kernel splat. This can be reproduced by enabling the trace event and running btrfs/056 from fstests for example. The splat shown in dmesg is the following: [53.919] BUG: sleeping function called from invalid context at fs/dcache.c:970 [53.947] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 32773, name: xfs_io [53.988] preempt_count: 2, expected: 0 [53.967] RCU nest depth: 0, expected: 0 [53.943] Preemption disabled at: [53.944] [<0000000000000000>] 0x0 [54.078] CPU: 0 UID: 0 PID: 32773 Comm: xfs_io Tainted: G W 7.1.0-rc1-btrfs-next-232+ #1 PREEMPT(full) [54.070] Tainted: [W]=WARN [54.071] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014 [54.072] Call Trace: [54.074] <TASK> [54.076] dump_stack_lvl+0x56/0x80 [54.079] __might_resched.cold+0xd6/0x10f [54.072] dput.part.0+0x24/0x110 [54.078] trace_event_raw_event_btrfs_sync_file+0x75/0x140 [btrfs] [54.089] btrfs_sync_file+0x1ed/0x530 [btrfs] [54.087] ? __handle_mm_fault+0x8ae/0xed0 [54.089] btrfs_do_write_iter+0x172/0x210 [btrfs] [54.091] vfs_write+0x21f/0x450 [54.094] __x64_sys_pwrite64+0x8d/0xc0 [54.096] ? do_user_addr_fault+0x20c/0x670 [54.099] do_syscall_64+0x60/0xf20 [54.092] ? clear_bhb_loop+0x60/0xb0 [54.094] entry_SYSCALL_64_after_hwframe+0x76/0x7e So stop using dget_parent() and dput() and access the parent dentry directly as dentry->d_parent. This is also what ext4 is doing in its equivalent trace event ext4_sync_file_enter(). Filipe Manana (1): btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file() Goldwyn Rodrigues (1): btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file() include/trace/events/btrfs.h | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/3]Backport per-vma locks in userfaultfd for OLK 6.6
by Wupeng Ma 20 May '26

20 May '26

Backport per-vma locks in userfaultfd[1] for OLK 6.6 Lokesh Gidra (3): userfaultfd: protect mmap_changing with rw_sem in userfaulfd_ctx mm: add vma_assert_locked() for !CONFIG_PER_VMA_LOCK userfaultfd: use per-vma locks in userfaultfd operations fs/userfaultfd.c | 35 ++-- include/linux/mm.h | 5 + include/linux/userfaultfd_k.h | 24 ++- include/linux/userfaultfd_k_ext.h | 7 + mm/userfaultfd.c | 273 ++++++++++++++++++++---------- 5 files changed, 226 insertions(+), 118 deletions(-) -- 2.43.0

2 4

[PATCH OLK-5.10] Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ
by Liu Kai 20 May '26

20 May '26

From: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> stable inclusion from stable-v5.10.252 commit 335071c0c3637064ec250481f589075db44fe4e6 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14681 CVE: CVE-2026-43134 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 138d7eca445ef37a0333425d269ee59900ca1104 ] This adds a check for encryption key size upon receiving L2CAP_LE_CONN_REQ which is required by L2CAP/LE/CFC/BV-15-C which expects L2CAP_CR_LE_BAD_KEY_SIZE. Link: https://lore.kernel.org/linux-bluetooth/5782243.rdbgypaU67@n9w6sw14/ Fixes: 27e2d4c8d28b ("Bluetooth: Add basic LE L2CAP connect request receiving support") Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Tested-by: Christian Eggers <ceggers(a)arri.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: net/bluetooth/l2cap_core.c [delete parameter "pchan" of l2cap_check_enc_key_size()] Signed-off-by: Liu Kai <liukai284(a)huawei.com> --- net/bluetooth/l2cap_core.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index d97f29f7218a..cbe8dcc2b5f0 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -5860,6 +5860,13 @@ static int l2cap_le_connect_req(struct l2cap_conn *conn, goto response_unlock; } + /* Check if Key Size is sufficient for the security level */ + if (!l2cap_check_enc_key_size(conn->hcon)) { + result = L2CAP_CR_LE_BAD_KEY_SIZE; + chan = NULL; + goto response_unlock; + } + /* Check for valid dynamic CID range */ if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_LE_DYN_END) { result = L2CAP_CR_LE_INVALID_SCID; -- 2.34.1

2 1

[PATCH OLK-5.10] Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ
by Liu Kai 20 May '26

20 May '26

From: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> stable inclusion from stable-v5.10.252 commit 335071c0c3637064ec250481f589075db44fe4e6 category: bugfix bugzilla: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 138d7eca445ef37a0333425d269ee59900ca1104 ] This adds a check for encryption key size upon receiving L2CAP_LE_CONN_REQ which is required by L2CAP/LE/CFC/BV-15-C which expects L2CAP_CR_LE_BAD_KEY_SIZE. Link: https://lore.kernel.org/linux-bluetooth/5782243.rdbgypaU67@n9w6sw14/ Fixes: 27e2d4c8d28b ("Bluetooth: Add basic LE L2CAP connect request receiving support") Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Tested-by: Christian Eggers <ceggers(a)arri.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: net/bluetooth/l2cap_core.c [delete parameter "pchan" of l2cap_check_enc_key_size()] Signed-off-by: Liu Kai <liukai284(a)huawei.com> --- net/bluetooth/l2cap_core.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index d97f29f7218a..cbe8dcc2b5f0 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -5860,6 +5860,13 @@ static int l2cap_le_connect_req(struct l2cap_conn *conn, goto response_unlock; } + /* Check if Key Size is sufficient for the security level */ + if (!l2cap_check_enc_key_size(conn->hcon)) { + result = L2CAP_CR_LE_BAD_KEY_SIZE; + chan = NULL; + goto response_unlock; + } + /* Check for valid dynamic CID range */ if (scid < L2CAP_CID_DYN_START || scid > L2CAP_CID_LE_DYN_END) { result = L2CAP_CR_LE_INVALID_SCID; -- 2.34.1

2 1

[PATCH OLK-5.10 0/3] CVE-2026-43134
by Liu Kai 20 May '26

20 May '26

CVE-2026-43134 Archie Pusaka (1): Bluetooth: Enforce key size of 16 bytes on FIPS level Frédéric Danis (1): Bluetooth: l2cap: Check encryption key size on incoming connection Luiz Augusto von Dentz (1): Bluetooth: L2CAP: Fix not checking l2cap_chan security level net/bluetooth/l2cap_core.c | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-) -- 2.34.1

2 4

openEuler Kernel SIG双周例会
by openEuler conference 20 May '26

20 May '26

您好！ Kernel 邀请您参加 2026-05-22 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议发起人： LiaoTao_Wave 会议内容： 1. 进展update 2. 议题征集中（新增议题可回复本邮件，或直接填报至会议纪要看板）会议链接：https://meeting.huaweicloud.com:36443/#/j/985166233 会议纪要&签到链接：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2026-05-22 14:00 The subject of the conference is openEuler Kernel SIG双周例会 The sponsor of the conference is LiaoTao_Wave Summary: 1. 进展update 2. 议题征集中（新增议题可回复本邮件，或直接填报至会议纪要看板） You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/985166233 Add topics at https://etherpad.openeuler.org/p/Kernel-meetings More information: https://www.openeuler.org/en/

1 0

[PATCH OLK-6.6] config: x86: Fix CI "checkdefconfig" warning by updating defconfig
by Tengda Wu 19 May '26

19 May '26

hulk inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/9203 CVE: NA --------------------------- When building the x86_64 kernel, the CI robot complains: [WARNING] x86_64 checkdefconfig fail - CONFIG_DEBUG_INFO_BTF_MODULES=y - CONFIG_MODULE_ALLOW_BTF_MISMATCH=n The configs listed above are introduced but the openeuler_defconfig for x86_64 is not updated, you can configure and run 'make update_oedefconfig' to update it. After investigation, it was found that one of these two configs has existed since the 6.6 baseline version, so just run 'make update_oedefconfig' to stop the complaint. Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- arch/x86/configs/openeuler_defconfig | 35 ++++++++++++++-------------- 1 file changed, 17 insertions(+), 18 deletions(-) diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index 73302f391cd7..08126a9363ef 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -7,7 +7,7 @@ CONFIG_TOOLS_SUPPORT_RELR=y CONFIG_IRQ_WORK=y CONFIG_BUILDTIME_TABLE_SORT=y CONFIG_THREAD_INFO_IN_TASK=y -CONFIG_DRM_PHYTIUM=y + # # General setup # @@ -198,6 +198,7 @@ CONFIG_BLK_CGROUP=y CONFIG_CGROUP_WRITEBACK=y CONFIG_CGROUP_V1_WRITEBACK=y CONFIG_CGROUP_SCHED=y +CONFIG_QOS_LEVEL=y CONFIG_QOS_SCHED=y CONFIG_QOS_SCHED_SMT_EXPELLER=y CONFIG_QOS_SCHED_PRIO_LB=y @@ -1054,6 +1055,7 @@ CONFIG_MQ_IOSCHED_KYBER=y CONFIG_IOSCHED_BFQ=y CONFIG_BFQ_GROUP_IOSCHED=y # CONFIG_BFQ_CGROUP_DEBUG is not set +CONFIG_BPF_RVI_BLK_BFQ=y # end of IO Schedulers CONFIG_PREEMPT_NOTIFIERS=y @@ -1179,6 +1181,7 @@ CONFIG_READ_ONLY_THP_FOR_FS=y CONFIG_PGTABLE_HAS_HUGE_LEAVES=y CONFIG_ARCH_SUPPORTS_HUGE_PFNMAP=y CONFIG_ARCH_SUPPORTS_PMD_PFNMAP=y +CONFIG_ARCH_SUPPORTS_PUD_PFNMAP=y CONFIG_NEED_PER_CPU_EMBED_FIRST_CHUNK=y CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK=y CONFIG_USE_PERCPU_NUMA_NODE_ID=y @@ -1224,7 +1227,6 @@ CONFIG_LRU_GEN=y # CONFIG_LRU_GEN_STATS is not set CONFIG_ARCH_SUPPORTS_PER_VMA_LOCK=y CONFIG_PER_VMA_LOCK=y -CONFIG_GMEM=y CONFIG_LOCK_MM_AND_FIND_VMA=y CONFIG_IOMMU_MM_DATA=y CONFIG_PAGE_CACHE_LIMIT=y @@ -1233,6 +1235,7 @@ CONFIG_ETMEM_SCAN=m CONFIG_ETMEM_SWAP=m CONFIG_ETMEM=y # CONFIG_BPF_READAHEAD is not set +CONFIG_GMEM=y # # Data Access Monitoring @@ -1263,7 +1266,6 @@ CONFIG_SKB_EXTENSIONS=y CONFIG_PACKET=y CONFIG_PACKET_DIAG=m CONFIG_UNIX=y -CONFIG_UNIX_SCM=y CONFIG_AF_UNIX_OOB=y CONFIG_UNIX_DIAG=m CONFIG_TLS=m @@ -1286,11 +1288,11 @@ CONFIG_NET_KEY_MIGRATE=y CONFIG_SMC=m CONFIG_SMC_DIAG=m CONFIG_SMC_LO=y -CONFIG_UB_UMS=m -CONFIG_UB_SOCKET_HANDSHAKE=y CONFIG_XDP_SOCKETS=y CONFIG_XDP_SOCKETS_DIAG=y # CONFIG_OENETCLS is not set +CONFIG_UB_UMS=m +CONFIG_UB_SOCKET_HANDSHAKE=y CONFIG_NET_HANDSHAKE=y CONFIG_INET=y CONFIG_IP_MULTICAST=y @@ -1920,7 +1922,6 @@ CONFIG_CGROUP_NET_CLASSID=y CONFIG_NET_RX_BUSY_POLL=y CONFIG_BQL=y CONFIG_BPF_STREAM_PARSER=y -# CONFIG_HISOCK is not set CONFIG_NET_FLOW_LIMIT=y # @@ -2045,8 +2046,6 @@ CONFIG_NETACC_TERRACE=y # # Device Drivers # -CONFIG_HAVE_EISA=y -# CONFIG_EISA is not set CONFIG_HAVE_PCI=y CONFIG_PCI=y CONFIG_PCI_DOMAINS=y @@ -2177,9 +2176,6 @@ CONFIG_FW_CACHE=y CONFIG_FW_UPLOAD=y # end of Firmware loader -# fwctl -CONFIG_FWCTL=m - CONFIG_WANT_DEV_COREDUMP=y CONFIG_ALLOW_DEV_COREDUMP=y CONFIG_DEV_COREDUMP=y @@ -2271,6 +2267,7 @@ CONFIG_UEFI_CPER_X86=y # end of Tegra firmware driver # end of Firmware Drivers +CONFIG_FWCTL=m # CONFIG_GNSS is not set CONFIG_MTD=m # CONFIG_MTD_TESTS is not set @@ -3142,7 +3139,6 @@ CONFIG_NET_VENDOR_VERTEXCOM=y # CONFIG_MSE102X is not set # CONFIG_NET_VENDOR_VIA is not set CONFIG_NET_VENDOR_WANGXUN=y -CONFIG_LIBWX=m CONFIG_NGBE=m CONFIG_TXGBE=m # CONFIG_NET_VENDOR_WIZNET is not set @@ -3292,7 +3288,6 @@ CONFIG_MDIO_THUNDER=m # # PCS device drivers # -CONFIG_PCS_XPCS=m # end of PCS device drivers # CONFIG_PLIP is not set @@ -5780,6 +5775,7 @@ CONFIG_DRM_CIRRUS_QEMU=m # CONFIG_DRM_VBOXVIDEO is not set # CONFIG_DRM_GUD is not set # CONFIG_DRM_SSD130X is not set +CONFIG_DRM_PHYTIUM=m # CONFIG_DRM_HYPERV is not set # CONFIG_DRM_LEGACY is not set CONFIG_DRM_PANEL_ORIENTATION_QUIRKS=y @@ -8333,6 +8329,7 @@ CONFIG_OVERLAY_FS=m # CONFIG_OVERLAY_FS_XINO_AUTO is not set # CONFIG_OVERLAY_FS_METACOPY is not set # CONFIG_OVERLAY_FS_DEBUG is not set + # # Caches # @@ -8397,9 +8394,9 @@ CONFIG_TMPFS_XATTR=y # CONFIG_TMPFS_INODE64 is not set # CONFIG_TMPFS_QUOTA is not set CONFIG_HUGETLBFS=y +# CONFIG_HUGETLB_PAGE_OPTIMIZE_VMEMMAP_DEFAULT_ON is not set CONFIG_HUGETLB_PAGE=y CONFIG_HUGETLB_PAGE_OPTIMIZE_VMEMMAP=y -# CONFIG_HUGETLB_PAGE_OPTIMIZE_VMEMMAP_DEFAULT_ON is not set CONFIG_HUGETLB_ALLOC_LIMIT=y CONFIG_ARCH_HAS_GIGANTIC_PAGE=y CONFIG_CONFIGFS_FS=y @@ -8486,6 +8483,7 @@ CONFIG_NFS_USE_KERNEL_DNS=y CONFIG_NFS_DEBUG=y # CONFIG_NFS_DISABLE_UDP_SUPPORT is not set # CONFIG_NFS_V4_2_READ_PLUS is not set +CONFIG_ENFS=m CONFIG_NFSD=m # CONFIG_NFSD_V2 is not set CONFIG_NFSD_V3_ACL=y @@ -8502,8 +8500,6 @@ CONFIG_LOCKD_V4=y CONFIG_NFS_ACL_SUPPORT=m CONFIG_NFS_COMMON=y CONFIG_NFS_V4_2_SSC_HELPER=y -CONFIG_ENFS=m -CONFIG_SUNRPC_ENFS=y CONFIG_SUNRPC=m CONFIG_SUNRPC_GSS=m CONFIG_SUNRPC_BACKCHANNEL=y @@ -8513,6 +8509,7 @@ CONFIG_RPCSEC_GSS_KRB5_ENCTYPES_AES_SHA1=y # CONFIG_RPCSEC_GSS_KRB5_ENCTYPES_AES_SHA2 is not set CONFIG_SUNRPC_DEBUG=y CONFIG_SUNRPC_XPRT_RDMA=m +CONFIG_SUNRPC_ENFS=y CONFIG_CEPH_FS=m # CONFIG_CEPH_FSCACHE is not set CONFIG_CEPH_FS_POSIX_ACL=y @@ -8710,8 +8707,6 @@ CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity,selinux,smack,tomoyo,appar # Memory initialization # CONFIG_INIT_STACK_NONE=y -# CONFIG_INIT_STACK_ALL_PATTERN is not set -# CONFIG_INIT_STACK_ALL_ZERO is not set # CONFIG_INIT_ON_ALLOC_DEFAULT_ON is not set # CONFIG_INIT_ON_FREE_DEFAULT_ON is not set # CONFIG_ZERO_CALL_USED_REGS is not set @@ -9231,6 +9226,10 @@ CONFIG_DEBUG_INFO_COMPRESSED_NONE=y # CONFIG_DEBUG_INFO_COMPRESSED_ZLIB is not set # CONFIG_DEBUG_INFO_SPLIT is not set CONFIG_DEBUG_INFO_BTF=y +CONFIG_PAHOLE_HAS_SPLIT_BTF=y +CONFIG_PAHOLE_HAS_LANG_EXCLUDE=y +CONFIG_DEBUG_INFO_BTF_MODULES=y +# CONFIG_MODULE_ALLOW_BTF_MISMATCH is not set # CONFIG_GDB_SCRIPTS is not set CONFIG_FRAME_WARN=2048 CONFIG_STRIP_ASM_SYMS=y -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] CVEs
by Liu Kai 19 May '26

19 May '26

CVEs Andrey Vatoropin (1): fbcon: check return value of con2fb_acquire_newinfo() Luiz Augusto von Dentz (1): Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ drivers/video/fbdev/core/fbcon.c | 3 ++- net/bluetooth/l2cap_core.c | 7 +++++++ 2 files changed, 9 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH OLK-5.10] mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()
by Yi Yang 19 May '26

19 May '26

From: Joonwon Kang <joonwonkang(a)google.com> mainline inclusion from mainline-v7.0-rc1 commit fcd7f96c783626c07ee3ed75fa3739a8a2052310 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14824 CVE: CVE-2026-43281 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Although it is guided that `#mbox-cells` must be at least 1, there are many instances of `#mbox-cells = <0>;` in the device tree. If that is the case and the corresponding mailbox controller does not provide `fw_xlate` and of_xlate` function pointers, `fw_mbox_index_xlate()` will be used by default and out-of-bounds accesses could occur due to lack of bounds check in that function. Cc: stable(a)vger.kernel.org Signed-off-by: Joonwon Kang <joonwonkang(a)google.com> Signed-off-by: Jassi Brar <jassisinghbrar(a)gmail.com> Conflicts: drivers/mailbox/mailbox.c [Commit ba879dfc0574 ("mailbox: Allow controller specific mapping using fwnode") was not merged. Context conflicts.] Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/mailbox/mailbox.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/drivers/mailbox/mailbox.c b/drivers/mailbox/mailbox.c index adf36c05fa43..19eefdf99058 100644 --- a/drivers/mailbox/mailbox.c +++ b/drivers/mailbox/mailbox.c @@ -507,12 +507,10 @@ static struct mbox_chan * of_mbox_index_xlate(struct mbox_controller *mbox, const struct of_phandle_args *sp) { - int ind = sp->args[0]; - - if (ind >= mbox->num_chans) + if (sp->args_count < 1 || sp->args[0] >= mbox->num_chans) return ERR_PTR(-EINVAL); - return &mbox->chans[ind]; + return &mbox->chans[sp->args[0]]; } /** -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate()
by Yi Yang 19 May '26

19 May '26

From: Joonwon Kang <joonwonkang(a)google.com> mainline inclusion from mainline-v7.0-rc1 commit fcd7f96c783626c07ee3ed75fa3739a8a2052310 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14824 CVE: CVE-2026-43281 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Although it is guided that `#mbox-cells` must be at least 1, there are many instances of `#mbox-cells = <0>;` in the device tree. If that is the case and the corresponding mailbox controller does not provide `fw_xlate` and of_xlate` function pointers, `fw_mbox_index_xlate()` will be used by default and out-of-bounds accesses could occur due to lack of bounds check in that function. Cc: stable(a)vger.kernel.org Signed-off-by: Joonwon Kang <joonwonkang(a)google.com> Signed-off-by: Jassi Brar <jassisinghbrar(a)gmail.com> Conflicts: drivers/mailbox/mailbox.c [Commit ba879dfc0574 ("mailbox: Allow controller specific mapping using fwnode") was not merged. Context conflicts.] Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/mailbox/mailbox.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/drivers/mailbox/mailbox.c b/drivers/mailbox/mailbox.c index 055c90b8253c..275119136bde 100644 --- a/drivers/mailbox/mailbox.c +++ b/drivers/mailbox/mailbox.c @@ -432,12 +432,10 @@ static struct mbox_chan * of_mbox_index_xlate(struct mbox_controller *mbox, const struct of_phandle_args *sp) { - int ind = sp->args[0]; - - if (ind >= mbox->num_chans) + if (sp->args_count < 1 || sp->args[0] >= mbox->num_chans) return ERR_PTR(-EINVAL); - return &mbox->chans[ind]; + return &mbox->chans[sp->args[0]]; } /** -- 2.25.1

2 2

[PATCH OLK-5.10 0/2] *** Fix CVE-2026-43428 ***
by Zhang Kunbo 19 May '26

19 May '26

*** Fix CVE-2026-43428 *** Alan Stern (2): USB: usbcore: Introduce usb_bulk_msg_killable() USB: core: Limit the length of unkillable synchronous timeouts drivers/usb/core/message.c | 97 ++++++++++++++++++++++++++++++-------- include/linux/usb.h | 8 +++- 2 files changed, 84 insertions(+), 21 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] USB: core: Limit the length of unkillable synchronous timeouts
by Zhang Kunbo 19 May '26

19 May '26

From: Alan Stern <stern(a)rowland.harvard.edu> stable inclusion from stable-v6.6.130 commit 659c0c7d50a4b0f6aa197c4c098cfd91daf63862 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14986 CVE: CVE-2026-43428 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 1015c27a5e1a63efae2b18a9901494474b4d1dc3 upstream. The usb_control_msg(), usb_bulk_msg(), and usb_interrupt_msg() APIs in usbcore allow unlimited timeout durations. And since they use uninterruptible waits, this leaves open the possibility of hanging a task for an indefinitely long time, with no way to kill it short of unplugging the target device. To prevent this sort of problem, enforce a maximum limit on the length of these unkillable timeouts. The limit chosen here, somewhat arbitrarily, is 60 seconds. On many systems (although not all) this is short enough to avoid triggering the kernel's hung-task detector. In addition, clear up the ambiguity of negative timeout values by treating them the same as 0, i.e., using the maximum allowed timeout. Signed-off-by: Alan Stern <stern(a)rowland.harvard.edu> Link: https://lore.kernel.org/linux-usb/3acfe838-6334-4f6d-be7c-4bb01704b33d@rowl… Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") CC: stable(a)vger.kernel.org Link: https://patch.msgid.link/15fc9773-a007-47b0-a703-df89a8cf83dd@rowland.harva… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- drivers/usb/core/message.c | 27 +++++++++++++-------------- include/linux/usb.h | 3 +++ 2 files changed, 16 insertions(+), 14 deletions(-) diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c index 858436862cbf..119d07c4c62b 100644 --- a/drivers/usb/core/message.c +++ b/drivers/usb/core/message.c @@ -45,6 +45,8 @@ static void usb_api_blocking_completion(struct urb *urb) * Starts urb and waits for completion or timeout. * Whether or not the wait is killable depends on the flag passed in. * For example, compare usb_bulk_msg() and usb_bulk_msg_killable(). + * + * For non-killable waits, we enforce a maximum limit on the timeout value. */ static int usb_start_wait_urb(struct urb *urb, int timeout, int *actual_length, bool killable) @@ -61,7 +63,9 @@ static int usb_start_wait_urb(struct urb *urb, int timeout, int *actual_length, if (unlikely(retval)) goto out; - expire = timeout ? msecs_to_jiffies(timeout) : MAX_SCHEDULE_TIMEOUT; + if (!killable && (timeout <= 0 || timeout > USB_MAX_SYNCHRONOUS_TIMEOUT)) + timeout = USB_MAX_SYNCHRONOUS_TIMEOUT; + expire = (timeout > 0) ? msecs_to_jiffies(timeout) : MAX_SCHEDULE_TIMEOUT; if (killable) rc = wait_for_completion_killable_timeout(&ctx.done, expire); else @@ -127,8 +131,7 @@ static int usb_internal_control_msg(struct usb_device *usb_dev, * @index: USB message index value * @data: pointer to the data to send * @size: length in bytes of the data to send - * @timeout: time in msecs to wait for the message to complete before timing - * out (if 0 the wait is forever) + * @timeout: time in msecs to wait for the message to complete before timing out * * Context: task context, might sleep. * @@ -183,8 +186,7 @@ EXPORT_SYMBOL_GPL(usb_control_msg); * @index: USB message index value * @driver_data: pointer to the data to send * @size: length in bytes of the data to send - * @timeout: time in msecs to wait for the message to complete before timing - * out (if 0 the wait is forever) + * @timeout: time in msecs to wait for the message to complete before timing out * @memflags: the flags for memory allocation for buffers * * Context: !in_interrupt () @@ -242,8 +244,7 @@ EXPORT_SYMBOL_GPL(usb_control_msg_send); * @index: USB message index value * @driver_data: pointer to the data to be filled in by the message * @size: length in bytes of the data to be received - * @timeout: time in msecs to wait for the message to complete before timing - * out (if 0 the wait is forever) + * @timeout: time in msecs to wait for the message to complete before timing out * @memflags: the flags for memory allocation for buffers * * Context: !in_interrupt () @@ -314,8 +315,7 @@ EXPORT_SYMBOL_GPL(usb_control_msg_recv); * @len: length in bytes of the data to send * @actual_length: pointer to a location to put the actual length transferred * in bytes - * @timeout: time in msecs to wait for the message to complete before - * timing out (if 0 the wait is forever) + * @timeout: time in msecs to wait for the message to complete before timing out * * Context: task context, might sleep. * @@ -347,8 +347,7 @@ EXPORT_SYMBOL_GPL(usb_interrupt_msg); * @len: length in bytes of the data to send * @actual_length: pointer to a location to put the actual length transferred * in bytes - * @timeout: time in msecs to wait for the message to complete before - * timing out (if 0 the wait is forever) + * @timeout: time in msecs to wait for the message to complete before timing out * * Context: task context, might sleep. * @@ -408,12 +407,12 @@ EXPORT_SYMBOL_GPL(usb_bulk_msg); * @actual_length: pointer to a location to put the actual length transferred * in bytes * @timeout: time in msecs to wait for the message to complete before - * timing out (if 0 the wait is forever) + * timing out (if <= 0, the wait is as long as possible) * * Context: task context, might sleep. * - * This function is just like usb_blk_msg() except that it waits in a - * killable state. + * This function is just like usb_blk_msg(), except that it waits in a + * killable state and there is no limit on the timeout length. * * Return: * If successful, 0. Otherwise a negative error number. The number of actual diff --git a/include/linux/usb.h b/include/linux/usb.h index a3261427d6e0..6e6e32067148 100644 --- a/include/linux/usb.h +++ b/include/linux/usb.h @@ -1843,6 +1843,9 @@ void usb_buffer_unmap_sg(const struct usb_device *dev, int is_in, * SYNCHRONOUS CALL SUPPORT * *-------------------------------------------------------------------*/ +/* Maximum value allowed for timeout in synchronous routines below */ +#define USB_MAX_SYNCHRONOUS_TIMEOUT 60000 /* ms */ + extern int usb_control_msg(struct usb_device *dev, unsigned int pipe, __u8 request, __u8 requesttype, __u16 value, __u16 index, void *data, __u16 size, int timeout); -- 2.34.1

2 1

[PATCH OLK-6.6 00/24] backport cpuidle patches from linux mainline
by Huisong Li 19 May '26

19 May '26

From: Hongye Lin <linhongye(a)h-partners.com> driver inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9134 ---------------------------------------------------------------------- backport cpuidle patches from linux mainline Andy Shevchenko (1): ACPI: processor: idle: Replace strlcat() with better alternative Breno Leitao (1): ACPI: arm64: cpuidle: Tolerate platforms with no deep PSCI idle states Huisong Li (18): ACPI: processor: idle: Relocate state flags initialization ACPI: processor: idle: Drop redundant C-state count checks ACPI: processor: idle: Optimize ACPI idle driver registration ACPI: processor: Remove unused empty stubs of some functions ACPI: processor: idle: Rearrange declarations in header file ACPI: processor: Do not expose global variable acpi_idle_driver ACPI: processor: idle: Add debug log for states with invalid entry methods ACPI: processor: idle: Convert acpi_processor_setup_cpuidle_states() to void ACPI: processor: idle: Convert acpi_processor_setup_cpuidle_dev() to void ACPI: processor: idle: Rework the handling of acpi_processor_ffh_lpi_probe() ACPI: processor: idle: Remove redundant cstate check in acpi_processor_power_init ACPI: processor: idle: Move max_cstate update out of the loop ACPI: processor: idle: Remove redundant static variable and rename cstate check function ACPI: processor: idle: Reset power_setup_done flag on initialization failure ACPI: processor: idle: Fix NULL pointer dereference in hotplug path cpuidle: Simplify cpuidle_register_device() with guard() cpuidle: Extract and export no-lock variants of cpuidle_unregister_device() ACPI: processor: idle: Reset cpuidle on C-state list changes Jingkai Tan (1): ACPI: processor: idle: Add missing bounds check in flatten_lpi_states() Rafael J. Wysocki (3): ACPI: processor: idle: Eliminate static ACPI: processor: idle: Redefine two functions as void ACPI: processor: Update cpuidle driver check in __acpi_processor_start() arch/arm64/kernel/cpuidle.c | 10 +- drivers/acpi/processor_driver.c | 12 +- drivers/acpi/processor_idle.c | 297 +++++++++++++++++--------------- drivers/cpuidle/cpuidle.c | 34 ++-- include/acpi/processor.h | 35 +--- include/linux/cpuidle.h | 2 + 6 files changed, 200 insertions(+), 190 deletions(-) -- 2.33.0

2 25