- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] gic: Add hip09 support for HISILICON_ERRATUM_165010801
by Zeng Heng 10 Mar '26

10 Mar '26

From: Yifan Wu <wuyifan50(a)huawei.com> driver inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/7023 ---------------------------------------------------------------------- Add hip09 support for HISILICON_ERRATUM_165010801 Fixes: f0f9be237c22 ("gic: increase the arch_timer priority to avoid hardlockup") Signed-off-by: Yifan Wu <wuyifan50(a)huawei.com> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/arm64/Kconfig | 11 ++++++----- drivers/clocksource/arm_arch_timer.c | 5 +++++ 2 files changed, 11 insertions(+), 5 deletions(-) diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index 715c2810a43d..48fc9c71ed31 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -878,11 +878,12 @@ config HISILICON_ERRATUM_165010801 depends on ARCH_HISI default y help - On HIP12, when GIC receives multiple interrupts of the same priority and - different types, the interrupts are selected in the following sequence: - SPI > LPI > SGI > PPI. This scheduling rule may cause PPI starvation. - To prevent starvation from triggering system watchdog hardlockup, the - interrupt priority is explicitly increased in the arch_timer driver. + On HIP09/12 hardware, observations indicate that the GIC's handling of + equal-priority interrupts across different interrupt types may not always + provide balanced servicing. In some cases, this could result in prolonged + service delays for particular interrupt types, creating conditions where + system watchdog hardlockup detection might be triggered. The arch_timer + driver addresses this by proactively increasing affected interrupt priorities. config QCOM_FALKOR_ERRATUM_1003 bool "Falkor E1003: Incorrect translation due to ASID change" diff --git a/drivers/clocksource/arm_arch_timer.c b/drivers/clocksource/arm_arch_timer.c index 7f29ee39af3a..c6664d435921 100644 --- a/drivers/clocksource/arm_arch_timer.c +++ b/drivers/clocksource/arm_arch_timer.c @@ -340,6 +340,11 @@ static struct ate_acpi_oem_info hisi_161010101_oem_info[] = { #ifdef CONFIG_HISILICON_ERRATUM_165010801 static struct ate_acpi_oem_info hisi_165010801_oem_info[] = { + { + .oem_id = "HISI ", + .oem_table_id = "HIP09 ", + .oem_revision = 0, + }, { .oem_id = "HISI ", .oem_table_id = "HIP12 ", -- 2.25.1

2 1

[PATCH OLK-6.6] net: yt6801: add link info for yt6801
by Frank_Sae 10 Mar '26

10 Mar '26

yt6801 inclusion category: bugfix bugzilla: https://https://atomgit.com/openeuler/kernel/issues/7229 -------------------------------------------------------------------- add link info for yt6801 to fix that the link info is not update on os installation. Fixes: b9f5c0893d16 ("net: yt6801: add link info for yt6801") Signed-off-by: Frank_Sae <Frank.Sae(a)motor-comm.com> --- .../ethernet/motorcomm/yt6801/yt6801_main.c | 90 +++++++++++++++++++ 1 file changed, 90 insertions(+) diff --git a/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c b/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c index 01eed3ace..cb54329ef 100644 --- a/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c +++ b/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c @@ -27,6 +27,95 @@ const struct net_device_ops *fxgmac_get_netdev_ops(void); static void fxgmac_napi_enable(struct fxgmac_pdata *priv); +const struct ethtool_ops *fxgmac_get_ethtool_ops(void); + +#define MII_SPEC_STATUS 0x11 /* PHY specific status */ +#define FXGMAC_EPHY_LINK_STATUS BIT(10) +#define PHY_MII_SPEC_DUPLEX BIT(13) + +static int fxgmac_get_link_ksettings(struct net_device *netdev, + struct ethtool_link_ksettings *cmd) +{ + struct fxgmac_pdata *pdata = netdev_priv(netdev); + struct phy_device *phydev = netdev->phydev; + u32 duplex, regval, link_status; + u32 adv = 0xFFFFFFFF; + + ethtool_link_ksettings_zero_link_mode(cmd, supported); + ethtool_link_ksettings_zero_link_mode(cmd, advertising); + + /* set the supported link speeds */ + ethtool_link_ksettings_add_link_mode(cmd, supported, 1000baseT_Full); + ethtool_link_ksettings_add_link_mode(cmd, supported, 100baseT_Full); + ethtool_link_ksettings_add_link_mode(cmd, supported, 100baseT_Half); + ethtool_link_ksettings_add_link_mode(cmd, supported, 10baseT_Full); + ethtool_link_ksettings_add_link_mode(cmd, supported, 10baseT_Half); + + /* Indicate pause support */ + ethtool_link_ksettings_add_link_mode(cmd, supported, Pause); + ethtool_link_ksettings_add_link_mode(cmd, supported, Asym_Pause); + + regval = phy_read(phydev, MII_ADVERTISE); + + if (field_get(ADVERTISE_PAUSE_CAP, regval)) + ethtool_link_ksettings_add_link_mode(cmd, advertising, Pause); + + if (field_get(ADVERTISE_PAUSE_ASYM, regval)) + ethtool_link_ksettings_add_link_mode(cmd, advertising, Asym_Pause); + + ethtool_link_ksettings_add_link_mode(cmd, supported, MII); + cmd->base.port = PORT_MII; + + ethtool_link_ksettings_add_link_mode(cmd, supported, Autoneg); + regval = phy_read(phydev, MII_BMCR); + + regval = field_get(BMCR_ANENABLE, regval); + if (regval) { + ethtool_link_ksettings_add_link_mode(cmd, advertising, Autoneg); + + regval = phy_read(phydev, MII_ADVERTISE); + + if (adv & ADVERTISE_10HALF) + ethtool_link_ksettings_add_link_mode(cmd, advertising, 10baseT_Half); + if (adv & ADVERTISE_10FULL) + ethtool_link_ksettings_add_link_mode(cmd, advertising, 10baseT_Full); + if (adv & ADVERTISE_100HALF) + ethtool_link_ksettings_add_link_mode(cmd, advertising, 100baseT_Half); + if (adv & ADVERTISE_100FULL) + ethtool_link_ksettings_add_link_mode(cmd, advertising, 100baseT_Full); + + adv = phy_read(phydev, MII_CTRL1000); + + if (adv & ADVERTISE_1000FULL) + ethtool_link_ksettings_add_link_mode(cmd, advertising, 1000baseT_Full); + } + + cmd->base.autoneg = 1; + + regval = phy_read(phydev, MII_SPEC_STATUS); + + link_status = field_get(FXGMAC_EPHY_LINK_STATUS, regval); + if (link_status) { + duplex = field_get(PHY_MII_SPEC_DUPLEX, regval); + cmd->base.duplex = duplex; + cmd->base.speed = pdata->mac_speed; + } else { + cmd->base.duplex = DUPLEX_UNKNOWN; + cmd->base.speed = SPEED_UNKNOWN; + } + + return 0; +} + +static const struct ethtool_ops fxgmac_ethtool_ops = { + .get_link = ethtool_op_get_link, + .get_link_ksettings = fxgmac_get_link_ksettings, +}; + +const struct ethtool_ops *fxgmac_get_ethtool_ops(void) +{ + return &fxgmac_ethtool_ops; +} #define PHY_WR_CONFIG(reg_offset) (0x8000205 + ((reg_offset) * 0x10000)) static int fxgmac_phy_write_reg(struct fxgmac_pdata *priv, u32 reg_id, u32 data) @@ -1899,6 +1988,7 @@ static int fxgmac_init(struct fxgmac_pdata *priv, bool save_private_reg) FXGMAC_JUMBO_PACKET_MTU + (ETH_HLEN + VLAN_HLEN + ETH_FCS_LEN); ndev->netdev_ops = fxgmac_get_netdev_ops();/* Set device operations */ + ndev->ethtool_ops = fxgmac_get_ethtool_ops();/* Set device operations */ /* Set device features */ if (priv->hw_feat.tso) { -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] Fix TLBI broadcast optimization loss and incorrect dvmbm handling
by Tian Zheng 10 Mar '26

10 Mar '26

Fix 1 In the TLBI broadcast-optimization feature, the SYS_LSUDVM_CTRL_EL2 register controls whether the feature is enabled. When LPI low-power mode is enabled, this register is cleared as the pCPU powers down into LPI mode, causing the TLBI broadcast optimization to stop working. The fix saves and restores this control register in the callbacks for entering and exiting LPI mode. Fix 2 The current TLBI broadcast-optimization logic only supports normal VMs. If the feature is enabled globally, VMs that are not yet adapted for it, such as CCA will use an incorrect TLBI broadcast bitmap, which can cause a panic in CCA VMs. The fix moves the actual enable/disable of the dvmbm functionality into the vcpu load and vcpu put functions. Tian Zheng (2): KVM: arm64: Fix TLBI optimization broken in LPI mode KVM: arm64: Fix CCA guest panic when dvmbm is enabled arch/arm64/kvm/arm.c | 6 ++++++ arch/arm64/kvm/hisilicon/hisi_virt.c | 9 ++++----- arch/arm64/kvm/hisilicon/hisi_virt.h | 19 +++++++++++++++++++ 3 files changed, 29 insertions(+), 5 deletions(-) -- 2.33.0

1 2

[PATCH openEuler-1.0-LTS] [Huawei] PCI: Fix AB-BA deadlock between aer_isr() and device_shutdown()
by Hongtao Zhang 10 Mar '26

10 Mar '26

From: Ziming Du <duziming2(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13854 CVE: NA Reference: NA -------------------------------- During system shutdown, a deadlock may occur between AER recovery process and device shutdown as follows: The device_shutdown path holds the device_lock throughout the entire process and waits for the irq handlers to complete when release nodes: device_shutdown device_lock # A hold device_lock pci_device_shutdown pcie_port_device_remove remove_iter device_unregister device_del bus_remove_device device_release_driver devres_release_all release_nodes # B wait for irq handlers The aer_isr path will acquire device_lock in pci_bus_reset(): aer_isr # B execute irq process aer_isr_one_error aer_process_err_devices handle_error_source pcie_do_recovery aer_root_reset pci_bus_error_reset pci_bus_reset # A acquire device_lock The circular dependency causes system hang. Fix it by using pci_bus_trylock() instead of pci_bus_lock() in pci_bus_reset(). When the lock is unavailable, return -EAGAIN, as in similar cases. Fixes: c4eed62a2143 ("PCI/ERR: Use slot reset if available") Signed-off-by: Ziming Du <duziming2(a)huawei.com> Signed-off-by: Zhang Hongtao <zhanghongtao35(a)huawei.com> --- drivers/pci/pci.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c index b93605616d4e4..d1a8531df0271 100644 --- a/drivers/pci/pci.c +++ b/drivers/pci/pci.c @@ -5309,15 +5309,21 @@ static int pci_bus_reset(struct pci_bus *bus, int probe) if (probe) return 0; - pci_bus_lock(bus); + /* + * Replace blocking lock with trylock to prevent deadlock during bus reset. + * Same as above except return -EAGAIN if the bus cannot be locked. + */ + if (pci_bus_trylock(bus)) { + might_sleep(); - might_sleep(); + ret = pci_bridge_secondary_bus_reset(bus->self); - ret = pci_bridge_secondary_bus_reset(bus->self); + pci_bus_unlock(bus); - pci_bus_unlock(bus); + return ret; + } - return ret; + return -EAGAIN; } /** -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] [Huawei] PCI: Fix AB-BA deadlock between aer_isr() and device_shutdown()
by Hongtao Zhang 10 Mar '26

10 Mar '26

From: Ziming Du <duziming2(a)huawei.com> Offering: HULK hulk inclusion category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13854 -------------------------------- During system shutdown, a deadlock may occur between AER recovery process and device shutdown as follows: The device_shutdown path holds the device_lock throughout the entire process and waits for the irq handlers to complete when release nodes: device_shutdown device_lock # A hold device_lock pci_device_shutdown pcie_port_device_remove remove_iter device_unregister device_del bus_remove_device device_release_driver devres_release_all release_nodes # B wait for irq handlers The aer_isr path will acquire device_lock in pci_bus_reset(): aer_isr # B execute irq process aer_isr_one_error aer_process_err_devices handle_error_source pcie_do_recovery aer_root_reset pci_bus_error_reset pci_bus_reset # A acquire device_lock The circular dependency causes system hang. Fix it by using pci_bus_trylock() instead of pci_bus_lock() in pci_bus_reset(). When the lock is unavailable, return -EAGAIN, as in similar cases. Fixes: c4eed62a2143 ("PCI/ERR: Use slot reset if available") Signed-off-by: Ziming Du <duziming2(a)huawei.com> Signed-off-by: Zhang Hongtao <zhanghongtao35(a)huawei.com> --- drivers/pci/pci.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c index b93605616d4e4..d1a8531df0271 100644 --- a/drivers/pci/pci.c +++ b/drivers/pci/pci.c @@ -5309,15 +5309,21 @@ static int pci_bus_reset(struct pci_bus *bus, int probe) if (probe) return 0; - pci_bus_lock(bus); + /* + * Replace blocking lock with trylock to prevent deadlock during bus reset. + * Same as above except return -EAGAIN if the bus cannot be locked. + */ + if (pci_bus_trylock(bus)) { + might_sleep(); - might_sleep(); + ret = pci_bridge_secondary_bus_reset(bus->self); - ret = pci_bridge_secondary_bus_reset(bus->self); + pci_bus_unlock(bus); - pci_bus_unlock(bus); + return ret; + } - return ret; + return -EAGAIN; } /** -- 2.43.0

2 1

[PATCH OLK-6.6] sched: Add SOFT_DOMAIN feature interface for cgroup2
by Wang Tao 10 Mar '26

10 Mar '26

hulk inclusion category: other bugzilla: https://atomgit.com/openeuler/kernel/issues/8692 -------------------------------- Adapt interfaces 'soft_domain', 'soft_domain_nr_cpu', 'soft_domain_cpu_list' for the SOFT_DOMAIN feature to cgroup2. Signed-off-by: Wang Tao <wangtao554(a)huawei.com> --- kernel/sched/core.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/kernel/sched/core.c b/kernel/sched/core.c index bf8022acd6ad..69d10fdb84d8 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -12292,6 +12292,25 @@ static struct cftype cpu_files[] = { .write = cpu_uclamp_max_write, }, #endif +#ifdef CONFIG_SCHED_SOFT_DOMAIN + { + .name = "soft_domain", + .flags = CFTYPE_NOT_ON_ROOT, + .read_s64 = cpu_soft_domain_read_s64, + .write_s64 = cpu_soft_domain_write_s64, + }, + { + .name = "soft_domain_nr_cpu", + .flags = CFTYPE_NOT_ON_ROOT, + .read_u64 = cpu_soft_domain_quota_read_u64, + .write_u64 = cpu_soft_domain_quota_write_u64, + }, + { + .name = "soft_domain_cpu_list", + .flags = CFTYPE_NOT_ON_ROOT, + .seq_show = soft_domain_cpu_list_seq_show, + }, +#endif #ifdef CONFIG_SCHED_SOFT_QUOTA { .name = "soft_quota", -- 2.34.1

2 1

[PATCH OLK-6.6 0/8] fix CVE-2025-39981
by Jiacheng Yu 09 Mar '26

09 Mar '26

CVE-2025-39981 Gustavo A. R. Silva (1): overflow: Fix direct struct member initialization in _DEFINE_FLEX() Jianpeng Chang (1): Bluetooth: MGMT: Fix memory leak in set_ssp_complete Kees Cook (2): overflow: Change DEFINE_FLEX to take __counted_by member overflow: Introduce __DEFINE_FLEX for having no initializer Luiz Augusto von Dentz (1): Bluetooth: MGMT: Fix possible UAFs Pauli Virtanen (1): Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete Przemek Kitszel (1): overflow: add DEFINE_FLEX() for on-stack allocs Roman Smirnov (1): Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() include/linux/compiler_types.h | 32 ++-- include/linux/fortify-string.h | 4 - include/linux/overflow.h | 65 ++++++++ include/net/bluetooth/mgmt.h | 2 +- lib/overflow_kunit.c | 19 +++ net/bluetooth/mgmt.c | 263 +++++++++++++++++++++++---------- net/bluetooth/mgmt_util.c | 46 ++++++ net/bluetooth/mgmt_util.h | 3 + 8 files changed, 342 insertions(+), 92 deletions(-) -- 2.43.0

2 9

[PATCH OLK-6.6 0/8] fix CVE-2025-39981
by Jiacheng Yu 09 Mar '26

09 Mar '26

CVE-2025-39981 Gustavo A. R. Silva (1): overflow: Fix direct struct member initialization in _DEFINE_FLEX() Jianpeng Chang (1): Bluetooth: MGMT: Fix memory leak in set_ssp_complete Kees Cook (2): overflow: Change DEFINE_FLEX to take __counted_by member overflow: Introduce __DEFINE_FLEX for having no initializer Luiz Augusto von Dentz (1): Bluetooth: MGMT: Fix possible UAFs Pauli Virtanen (1): Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete Przemek Kitszel (1): overflow: add DEFINE_FLEX() for on-stack allocs Roman Smirnov (1): Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() include/linux/compiler_types.h | 36 +++-- include/linux/fortify-string.h | 4 - include/linux/overflow.h | 65 ++++++++ include/net/bluetooth/mgmt.h | 2 +- lib/overflow_kunit.c | 19 +++ net/bluetooth/mgmt.c | 263 +++++++++++++++++++++++---------- net/bluetooth/mgmt_util.c | 46 ++++++ net/bluetooth/mgmt_util.h | 3 + 8 files changed, 346 insertions(+), 92 deletions(-) -- 2.43.0

2 9

[PATCH OLK-6.6] tools/interference: add ifstool utility for kernel interference statistics
by Tengda Wu 09 Mar '26

09 Mar '26

hulk inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/7429 -------------------------------- As real-time and high-performance workloads become more sensitive to execution jitter, observability into kernel-induced "noise" is critical. The CONFIG_IFS infrastructure provides this telemetry, but raw data from cgroups is difficult to parse and visualize manually. Introduce ifstool, a userspace utility to monitor and analyze the interference.stat interface. Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- tools/Makefile | 11 +- tools/kspect/Makefile | 28 +++ tools/kspect/README | 64 ++++++ tools/kspect/ifstool | 396 ++++++++++++++++++++++++++++++++++ tools/kspect/ifstool.1 | 81 +++++++ tools/kspect/requirements.txt | 2 + 6 files changed, 578 insertions(+), 4 deletions(-) create mode 100644 tools/kspect/Makefile create mode 100644 tools/kspect/README create mode 100644 tools/kspect/ifstool create mode 100644 tools/kspect/ifstool.1 create mode 100644 tools/kspect/requirements.txt diff --git a/tools/Makefile b/tools/Makefile index 37e9f6804832..153817f0cc17 100644 --- a/tools/Makefile +++ b/tools/Makefile @@ -22,6 +22,7 @@ help: @echo ' hv - tools used when in Hyper-V clients' @echo ' iio - IIO tools' @echo ' intel-speed-select - Intel Speed Select tool' + @echo ' kspect - KSPECT tools' @echo ' kvm_stat - top-like utility for displaying kvm statistics' @echo ' leds - LEDs tools' @echo ' nolibc - nolibc headers testing and installation' @@ -69,7 +70,7 @@ acpi: FORCE cpupower: FORCE $(call descend,power/$@) -cgroup counter firewire hv guest bootconfig spi usb virtio mm bpf iio gpio objtool leds wmi pci firmware debugging tracing: FORCE +cgroup counter firewire hv guest bootconfig spi usb virtio mm bpf iio gpio objtool leds wmi pci firmware debugging tracing kspect: FORCE $(call descend,$@) bpf/%: FORCE @@ -120,7 +121,8 @@ all: acpi cgroup counter cpupower gpio hv firewire \ perf selftests bootconfig spi turbostat usb \ virtio mm bpf x86_energy_perf_policy \ tmon freefall iio objtool kvm_stat wmi \ - pci debugging tracing thermal thermometer thermal-engine + pci debugging tracing thermal thermometer thermal-engine \ + kspect acpi_install: $(call descend,power/$(@:_install=),install) @@ -128,7 +130,7 @@ acpi_install: cpupower_install: $(call descend,power/$(@:_install=),install) -cgroup_install counter_install firewire_install gpio_install hv_install iio_install perf_install bootconfig_install spi_install usb_install virtio_install mm_install bpf_install objtool_install wmi_install pci_install debugging_install tracing_install: +cgroup_install counter_install firewire_install gpio_install hv_install iio_install perf_install bootconfig_install spi_install usb_install virtio_install mm_install bpf_install objtool_install wmi_install pci_install debugging_install tracing_install kspect_install: $(call descend,$(@:_install=),install) selftests_install: @@ -161,7 +163,8 @@ install: acpi_install cgroup_install counter_install cpupower_install gpio_insta virtio_install mm_install bpf_install x86_energy_perf_policy_install \ tmon_install freefall_install objtool_install kvm_stat_install \ wmi_install pci_install debugging_install intel-speed-select_install \ - tracing_install thermometer_install thermal-engine_install + tracing_install thermometer_install thermal-engine_install \ + kspect_install acpi_clean: $(call descend,power/acpi,clean) diff --git a/tools/kspect/Makefile b/tools/kspect/Makefile new file mode 100644 index 000000000000..ffb380ddc885 --- /dev/null +++ b/tools/kspect/Makefile @@ -0,0 +1,28 @@ +# SPDX-License-Identifier: GPL-2.0 + +PREFIX ?= /usr/local +BINDIR = $(PREFIX)/bin +MANDIR = $(PREFIX)/share/man/man1 + +MAN1 = ifstool.1 +TARGET = ifstool + +all: man + +man: $(MAN1) + +install-man: + install -d $(MANDIR) + install -m 0644 $(MAN1) $(MANDIR) + +install-tools: + install -d $(BINDIR) + install -m 0755 $(TARGET) $(BINDIR) + +install: install-tools install-man + +uninstall: + rm -f $(BINDIR)/$(TARGET) + rm -f $(MANDIR)/$(MAN1) + +.PHONY: all install-tools install-man install diff --git a/tools/kspect/README b/tools/kspect/README new file mode 100644 index 000000000000..afb92a7f98d0 --- /dev/null +++ b/tools/kspect/README @@ -0,0 +1,64 @@ +IFSTOOL - Interference Statistics Analytical Utility + +Overview +======== +IFSTOOL is a specialized userspace utility designed to facilitate the +monitoring and analysis of Interference Statistics (CONFIG_IFS). + +The IFS infrastructure is a kernel-level framework that provides critical +observability into execution jitter (noise) that disrupts task determinism. +It monitors and quantifies the CPU time stolen by kernel-level activities, +such as: interrupt handling, softirqs, and lock contention. The framework +exposes this telemetry via the interference.stat control file within the +cgroup hierarchy. + +IFSTOOL interfaces with the interference.stat file to export raw metrics +into structured CSV data and interactive HTML-based distribution reports. + +Setup +===== +The host environment must meet the following criteria: + +* Kernel: Compiled with `CONFIG_IFS=y`. +* Boot Parameters: `cgroup_ifs=1` added to the kernel command line. +* Python Runtime: Python 3.x with `pandas` and `plotly` libraries. +* Cgroup Hierarchy: Either v2 unified or v1 with the cpu subsystem mounted. + +Build +===== +IFSTOOL provides a Makefile to streamline the installation of the +executable and its documentation. + + $ make install + +Run +=== +IFSTOOL operates via two primary functional modes: monitor and report. + +1. **Monitor:** Capture raw interference data from a target cgroup. + + $ ifstool monitor --cgroup docker/<cid> --interval 1 --output capture.csv + +2. **Report:** Transform captured CSV data into an interactive HTML dashboard. + + - Provide only --base for a single-session deep dive: + + $ ifstool report --base capture.csv + + - Provide both --base and --curr to render a differential report, + ideal for validating optimizations: + + $ ifstool report --base baseline.csv --curr current.csv + +HTML Description +================ +The generated HTML report provides a multi-dimensional view of kernel noise: + +- Total Time Delta Trend: A time-series line chart illustrating the incremental + nanoseconds of interference per category (e.g., irq, spinlock). +- Latency Heatmaps: A frequency-domain visualization of the kernel's internal + histogram. + - X-axis: Wall-clock time of the trace. + - Y-axis: Latency magnitude (logarithmic buckets from ns to s). + - Color Intensity: Represents the density (event count) of interference + within that specific latency window. diff --git a/tools/kspect/ifstool b/tools/kspect/ifstool new file mode 100644 index 000000000000..dcaa8a84272d --- /dev/null +++ b/tools/kspect/ifstool @@ -0,0 +1,396 @@ +#!/usr/bin/env python3 +# SPDX-License-Identifier: GPL-2.0-only +# +# ifstool: A tool to monitor and report interference statistics (CONFIG_IFS). +# +# Copyright(c) 2026. Huawei Technologies Co., Ltd +# +# Authors: +# Tengda Wu <wutengda2(a)huawei.com> + +import os +import time +import re +import csv +import argparse +import pandas as pd +import plotly.graph_objects as go +from plotly.subplots import make_subplots + + +class InterferenceTool: + """ + A utility class to monitor Linux cgroup interference statistics (CONFIG_IFS) + and generate visual comparison reports between baseline and current data. + """ + + def __init__(self): + # Default path for cgroup v2 interference stats + self.base_path = "/sys/fs/cgroup" + + def parse_stat(self, content): + """ + Parses the raw content of the interference.stat file. + + Args: + content (str): Raw string content from the stat file. + Returns: + tuple: (total_times dict, distributions dict) + """ + + total_times, distributions = {}, {} + + # Split content into sections: Top-level totals and various distributions + # Uses positive lookahead to split before a word followed by ' distribution' + sections = re.split(r"\n(?=[a-z]+ distribution)", content) + + # Parse global total times (first section) + for line in sections[0].strip().split("\n"): + match = re.match(r"^([a-z]+)\s+(\d+)$", line.strip()) + if match: + total_times[match.group(1)] = int(match.group(2)) + + # Parse histogram distributions (subsequent sections) + for section in sections[1:]: + lines = section.strip().split("\n") + # Extract header name (e.g., 'spinlock distribution') + header = lines[0].replace(" distribution", "").strip() + # Parse bucket key-value pairs (e.g., '[64 ns, 128 ns) : 143791') + dist_data = { + l.split(":")[0].strip(): int(l.split(":")[1].strip()) + for l in lines[1:] + if ":" in l + } + distributions[header] = dist_data + + return total_times, distributions + + def monitor(self, cgroup_id, interval, duration, output_csv): + """ + Periodically samples interference stats and saves results to a CSV file. + + Args: + cgroup_id (str): The specific cgroup folder name. + interval (float): Seconds between samples. + duration (int): Total monitoring time in seconds. + output_csv (str): Filename to save sampled data. + """ + + candidates = [ + os.path.join(self.base_path, cgroup_id), + os.path.join(self.base_path, "cpu", cgroup_id), # cgroup v1 + ] + path = next((p for p in candidates if os.path.exists(p)), None) + + if not path: + print( + f"\n[!] No access to cgroup: {os.path.join(self.base_path, cgroup_id)}" + ) + print(" Hint: You can find the correct cid by executing:") + print(" cat /proc/<PID>/cgroup") + return + + path = os.path.join(path, "interference.stat") + if not os.path.exists(path): + print(f"\n[!] Interface file '{path}' not found.") + print(" This usually happens due to one of the following:") + print(" 1. Kernel is not compiled with CONFIG_IFS=y") + print(" 2. Kernel boot parameter 'cgroup_ifs=1' is missing") + print(" 3. The current cgroup is not managed by the IFS controller") + return + + print( + f"[*] Starting monitor: {cgroup_id}, interval: {interval}s, duration: {duration}s" + ) + + data_list = [] + start_time = time.time() + + try: + while (time.time() - start_time) < duration: + ts = time.strftime("%H:%M:%S") + # Using fractional seconds in timestamp for sub-second intervals + if interval < 1.0: + ts = time.strftime("%H:%M:%S") + f".{int((time.time()%1)*100):02d}" + + with open(path, "r") as f: + total_times, dists = self.parse_stat(f.read()) + + # Append total time metrics + for cat, val in total_times.items(): + data_list.append([ts, cgroup_id, cat, "total_time_ns", val]) + + # Append bucket distribution metrics + for cat, dist in dists.items(): + for b, c in dist.items(): + data_list.append([ts, cgroup_id, cat, f"bucket_{b}", c]) + + time.sleep(interval) + except KeyboardInterrupt: + print("\n[!] Monitoring interrupted by user.") + + # Write buffered data to CSV + with open(output_csv, "w", newline="") as f: + writer = csv.writer(f) + writer.writerow( + ["timestamp", "cgroup_id", "category", "metric_type", "value"] + ) + writer.writerows(data_list) + print(f"[+] Data exported successfully: {output_csv}") + + def bucket_key(self, bucket_str): + """ + Parsing logic for histogram bucket labels to enable correct numerical sorting. + Example input: "bucket_[67.10 ms, 134.21 ms)" + + Returns: + float: The value converted to nanoseconds (ns). + """ + try: + # Regex to capture the first number and its unit (ns|us|ms|s) + match = re.search(r"(\d+\.?\d*)\s*(ns|us|ms|s)", bucket_str) + if not match: + return 0 + + value = float(match.group(1)) + unit = match.group(2).lower() + + # Conversion factors to nanoseconds + factors = {"ns": 1, "us": 1000, "ms": 1000000, "s": 1000000000} + + return value * factors.get(unit, 1) + except Exception: + return 0 + + def report(self, base_csv, curr_csv, output_html): + """ + Loads two CSV files and generates an interactive HTML dashboard. + + Args: + base_csv (str): Path to baseline data. + curr_csv (str): Path to current data. + output_html (str): Path to generate the HTML report. + """ + + df_b = pd.read_csv(base_csv) + single_mode = curr_csv is None or base_csv == curr_csv + df_c = None if single_mode else pd.read_csv(curr_csv) + + # Get unique union of categories present in both datasets + all_dfs = [df_b] if single_mode else [df_b, df_c] + categories = sorted( + list(set().union(*(df.category.unique() for df in all_dfs))) + ) + + # Color mapping to ensure consistent colors for categories across plots + color_sequence = [ + "#636EFA", + "#EF553B", + "#00CC96", + "#AB63FA", + "#FFA15A", + "#19D3F3", + "#FF6692", + "#B6E880", + "#FF97FF", + "#FECB52", + ] + color_map = { + cat: color_sequence[i % len(color_sequence)] + for i, cat in enumerate(categories) + } + + # Build HTML content with CSS for layout + html_parts = ["<html><head><title>IFS Analysis Dashboard</title>"] + col_width = "100%" if single_mode else "49.5%" + html_parts.append( + f"""<style> + body{{font-family:'Segoe UI',sans-serif; background:#f0f2f5; padding:20px; color:#333;}} + .card{{background:white; padding:15px; margin-bottom:20px; border-radius:10px; box-shadow:0 2px 5px rgba(0,0,0,0.05);}} + .row-container{{display:flex; gap:15px; justify-content:space-between;}} + .col-item{{width:{col_width}; min-width:0;}} + .stat-box{{display:flex; gap:10px; margin:5px 0; font-size:0.85em; color:#555;}} + .stat-item{{background:#f1f3f5; padding:4px 8px; border-radius:4px; border-left:3px solid #007bff;}} + .section-header{{margin:30px 0 15px 0; padding-bottom:10px; border-bottom:2px solid #ddd;}} + </style></head><body>""" + ) + + title = "Performance Analysis" if single_mode else "Performance Comparison" + html_parts.append(f"<h2>{title} (CONFIG_IFS)</h2>") + info = ( + f"File: {base_csv}" + if single_mode + else f"Baseline: {base_csv} | Current: {curr_csv}" + ) + html_parts.append(f"<p style='color:#666;'>{info}</p>") + + # --- Part 1: Total Time Trends (Line Charts) --- + html_parts.append("<div class='card'>") + html_parts.append("<h3 style='margin-top:0;'>Total Time Delta (ns) Trend</h3>") + + # Subplots ensure Y-axis can be matched for direct visual comparison + fig_line = make_subplots( + rows=1, + cols=1 if single_mode else 2, + horizontal_spacing=0.05, + subplot_titles=("Latency",) if single_mode else ("Baseline", "Current"), + ) + + plot_configs = ( + [("Data", df_b)] if single_mode else [("Baseline", df_b), ("Current", df_c)] + ) + for i, (name, df) in enumerate(plot_configs, 1): + for cat in categories: + sub = df[ + (df["category"] == cat) & (df["metric_type"] == "total_time_ns") + ].sort_values("timestamp") + if not sub.empty: + y_val = sub["value"].diff().fillna(0) + fig_line.add_trace( + go.Scatter( + x=sub["timestamp"], + y=y_val, + name=f"{cat} ({name})", + legendgroup=cat, + mode="lines+markers", + line=dict(color=color_map[cat], width=2), + marker=dict(color=color_map[cat], size=6), + ), + row=1, + col=i, + ) + + # Sync Y-axes scale for baseline and current plots + if not single_mode: + fig_line.update_yaxes(matches="y", row=1, col=2) + fig_line.update_layout( + height=500, template="plotly_white", margin=dict(t=50, b=20) + ) + html_parts.append(fig_line.to_html(full_html=False, include_plotlyjs="cdn")) + html_parts.append("</div>") + + html_parts.append( + "<h3 class='section-header'>Detailed Latency Distribution</h3>" + ) + + # --- Part 2: Distribution Heatmaps --- + for cat in categories: + + def get_m_and_stats(df): + """Processes raw metrics into a delta-count matrix for heatmap visualization.""" + sub = df[ + (df["category"] == cat) + & (df["metric_type"].str.startswith("bucket_")) + ] + if sub.empty: + return pd.DataFrame(), {} + + # Transform to matrix (Buckets vs Time) + p = sub.pivot( + index="metric_type", columns="timestamp", values="value" + ).sort_index(axis=1) + # Sort Y-axis buckets based on numerical time value + p = p.reindex(sorted(p.index, key=self.bucket_key)) + # Calculate incremental change (delta) + delta = p.diff(axis=1).fillna(0) + return delta, { + "Total": int(delta.values.sum()), + "Peak": int(delta.values.max()), + } + + m_b, stats_b = get_m_and_stats(df_b) + m_c, stats_c = (None, None) if single_mode else get_m_and_stats(df_c) + + # Determine global max for heatmap color scaling consistency + z_vals = [m_b.values.max() if not m_b.empty else 0] + if not single_mode: + z_vals.append(m_c.values.max() if not m_c.empty else 0) + global_max_z = max(z_vals + [1]) + + html_parts.append(f"<div class='card'><h4>Category: {cat.upper()}</h4>") + html_parts.append("<div class='row-container'>") + + configs = ( + [("Data", m_b, stats_b)] + if single_mode + else [("Baseline", m_b, stats_b), ("Current", m_c, stats_c)] + ) + for name, m, stats in configs: + html_parts.append("<div class='col-item'>") + if not m.empty: + # Display summary statistics + html_parts.append("<div class='stat-box'>") + for k, v in stats.items(): + html_parts.append( + f"<div class='stat-item'><b>{k}:</b> {v}</div>" + ) + html_parts.append("</div>") + + # Generate Heatmap + fig = go.Figure( + data=go.Heatmap( + z=m.values, + x=m.columns, + y=m.index, + colorscale="Viridis", + zmin=0, + zmax=global_max_z, + colorbar=dict(title="Count", thickness=10, len=0.7), + ) + ) + fig.update_layout( + height=400, + margin=dict(l=120, r=0, t=10, b=30), + template="plotly_white", + ) + html_parts.append( + fig.to_html(full_html=False, include_plotlyjs="cdn") + ) + else: + html_parts.append( + "<div style='height:100px; display:flex; align-items:center; justify-content:center; background:#fafafa; color:#ccc;'>No Data</div>" + ) + html_parts.append("</div>") + + html_parts.append("</div></div>") # end row-container & card + + # Save the final HTML report + with open(output_html, "w") as f: + f.writelines(html_parts + ["</body></html>"]) + print(f"[+] Comparison report generated: {output_html}") + + +if __name__ == "__main__": + parser = argparse.ArgumentParser() + sub = parser.add_subparsers(dest="mode") + + # Monitor Mode Arguments + p_mon = sub.add_parser("monitor") + p_mon.add_argument( + "-G", "--cgroup", required=True, help="Cgroup name (e.g. 'docker/cid'" + ) + p_mon.add_argument( + "-i", "--interval", type=float, default=1.0, help="Sampling interval (sec)" + ) + p_mon.add_argument( + "-d", "--duration", type=int, default=30, help="Sampling duration (sec)" + ) + p_mon.add_argument("-o", "--output", default="capture.csv") + + # Report Mode Arguments + p_comp = sub.add_parser("report") + p_comp.add_argument("-b", "--base", required=True, help="Baseline CSV file") + p_comp.add_argument( + "-c", "--curr", default=None, help="Current CSV file (optional, for comparison)" + ) + p_comp.add_argument("-o", "--output", default="report.html") + + args = parser.parse_args() + tool = InterferenceTool() + + if args.mode == "monitor": + tool.monitor(args.cgroup, args.interval, args.duration, args.output) + elif args.mode == "report": + tool.report(args.base, args.curr, args.output) + else: + parser.print_help() diff --git a/tools/kspect/ifstool.1 b/tools/kspect/ifstool.1 new file mode 100644 index 000000000000..347d54f36bec --- /dev/null +++ b/tools/kspect/ifstool.1 @@ -0,0 +1,81 @@ +.TH IFSTOOL 1 "March 2026" "Linux" "User Commands" +.SH NAME +ifstool \- Analyze kernel interference statistics (CONFIG_IFS) +.SH SYNOPSIS +.B ifstool monitor +[\fB\-G\fR|\fB\-\-cgroup\fR \fICGROUP_ID\fR] [\fB\-d\fR|\fB\-\-duration\fR \fISEC\fR] [\fB\-i\fR|\fB\-\-interval\fR \fISEC\fR] [\fB\-o\fR|\fB\-\-output\fR \fICSV\fR] +.br +.B ifstool report +[\fB\-b\fR|\fB\-\-base\fR \fICSV\fR] [\fB\-c\fR|\fB\-\-curr\fR \fICSV\fR] [\fB\-o\fR|\fB\-\-output\fR \fIHTML\fR] + +.SH DESCRIPTION +.B IFSTOOL +is a specialized userspace utility designed to facilitate the monitoring and analysis of Interference Statistics (\fBCONFIG_IFS\fR). + +The \fBIFS infrastructure\fR is a kernel-level framework providing critical observability into execution jitter (noise) that disrupts task determinism. It quantifies CPU time stolen by kernel activities such as interrupt handling, softirqs, and lock contention. This telemetry is exposed via the \fBinterference.stat\fR control file within the cgroup hierarchy. + +\fBIFSTOOL\fR interfaces with this file to export raw metrics into structured CSV data and interactive HTML-based distribution reports. + +.SH SETUP +The host environment must meet the following criteria: +.IP \[bu] 2 +\fBKernel:\fR Compiled with \fBCONFIG_IFS=y\fR. +.IP \[bu] 2 +\fBBoot Parameters:\fR \fBcgroup_ifs=1\fR must be added to the kernel command line. +.IP \[bu] 2 +\fBPython Runtime:\fR Python 3.x with \fBpandas\fR and \fBplotly\fR libraries. +.IP \[bu] 2 +\fBCgroup Hierarchy:\fR Either v2 unified or v1 (with the \fBcpu\fR subsystem mounted). + +.SH COMMANDS +.SS monitor +Capture raw interference data from a target cgroup. +.TP +\fB\-G, \-\-cgroup\fR \fICGROUP_ID\fR +Specify the cgroup identifier (e.g., \fIdocker/<cid>\fR or \fIsystem.slice\fR). +.TP +\fB\-d, \-\-duration\fR \fISEC\fR +Total collection time in seconds (default: 30). +.TP +\fB\-i, \-\-interval\fR \fISEC\fR +Sampling interval in seconds; supports floating point (default: 1.0). + +.SS report +Transform captured CSV data into an interactive HTML dashboard. +.TP +\fB\-b, \-\-base\fR \fICSV\fR +Primary capture file for analysis. +.TP +\fB\-c, \-\-curr\fR \fICSV\fR +Optional secondary file for differential (comparison) analysis. + +.SH HTML REPORT STRUCTURE +The generated HTML report provides a multi-dimensional view of kernel noise: +.IP "Total Time Delta Trend" 4 +A time-series line chart illustrating the incremental nanoseconds of interference per category (e.g., irq, spinlock). +.IP "Latency Heatmaps" 4 +A frequency-domain visualization of the kernel's internal histogram: +.RS 8 +.IP "X-axis:" 8 +Wall-clock time of the trace. +.IP "Y-axis:" 8 +Latency magnitude (logarithmic buckets from ns to s). +.IP "Color Intensity:" 8 +Represents the event count (density) of interference within that specific latency window. +.RE + +.SH EXAMPLES +Monitor a Docker container for 10 seconds: +.IP +.B $ ifstool monitor \-\-cgroup docker/<cid> \-\-duration 10 \-\-interval 1 +.PP +Generate a single-session deep dive: +.IP +.B $ ifstool report \-\-base capture.csv +.PP +Generate a differential report between two traces: +.IP +.B $ ifstool report \-\-base baseline.csv \-\-curr current.csv + +.SH AUTHOR +Tengda Wu <wutengda2(a)huawei.com> \ No newline at end of file diff --git a/tools/kspect/requirements.txt b/tools/kspect/requirements.txt new file mode 100644 index 000000000000..8e5e376a0e9a --- /dev/null +++ b/tools/kspect/requirements.txt @@ -0,0 +1,2 @@ +pandas==3.* +plotly==6.* -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] [Huawei] PCI: Fix AB-BA deadlock between aer_isr() and device_shutdown()
by Hongtao Zhang 09 Mar '26

09 Mar '26

From: Ziming Du <duziming2(a)huawei.com> Offering: HULK hulk inclusion category: bugfix bugzilla: 190803 -------------------------------- During system shutdown, a deadlock may occur between AER recovery process and device shutdown as follows: The device_shutdown path holds the device_lock throughout the entire process and waits for the irq handlers to complete when release nodes: device_shutdown device_lock # A hold device_lock pci_device_shutdown pcie_port_device_remove remove_iter device_unregister device_del bus_remove_device device_release_driver devres_release_all release_nodes # B wait for irq handlers The aer_isr path will acquire device_lock in pci_bus_reset(): aer_isr # B execute irq process aer_isr_one_error aer_process_err_devices handle_error_source pcie_do_recovery aer_root_reset pci_bus_error_reset pci_bus_reset # A acquire device_lock The circular dependency causes system hang. Fix it by using pci_bus_trylock() instead of pci_bus_lock() in pci_bus_reset(). When the lock is unavailable, return -EAGAIN, as in similar cases. Fixes: c4eed62a2143 ("PCI/ERR: Use slot reset if available") Signed-off-by: Ziming Du <duziming2(a)huawei.com> Signed-off-by: Zhang Hongtao <zhanghongtao35(a)huawei.com> --- drivers/pci/pci.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c index b93605616d4e4..d1a8531df0271 100644 --- a/drivers/pci/pci.c +++ b/drivers/pci/pci.c @@ -5309,15 +5309,21 @@ static int pci_bus_reset(struct pci_bus *bus, int probe) if (probe) return 0; - pci_bus_lock(bus); + /* + * Replace blocking lock with trylock to prevent deadlock during bus reset. + * Same as above except return -EAGAIN if the bus cannot be locked. + */ + if (pci_bus_trylock(bus)) { + might_sleep(); - might_sleep(); + ret = pci_bridge_secondary_bus_reset(bus->self); - ret = pci_bridge_secondary_bus_reset(bus->self); + pci_bus_unlock(bus); - pci_bus_unlock(bus); + return ret; + } - return ret; + return -EAGAIN; } /** -- 2.43.0

2 1

[PATCH OLK-6.6 0/4] fixup CVE-2025-39981
by Jiacheng Yu 09 Mar '26

09 Mar '26

CVE-2025-39981 Jianpeng Chang (1): Bluetooth: MGMT: Fix memory leak in set_ssp_complete Luiz Augusto von Dentz (1): Bluetooth: MGMT: Fix possible UAFs Pauli Virtanen (1): Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete Roman Smirnov (1): Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() include/net/bluetooth/mgmt.h | 2 +- net/bluetooth/mgmt.c | 263 +++++++++++++++++++++++++---------- net/bluetooth/mgmt_util.c | 46 ++++++ net/bluetooth/mgmt_util.h | 3 + 4 files changed, 237 insertions(+), 77 deletions(-) -- 2.43.0

2 5

[PATCH OLK-6.6] net: yt6801: add link info for yt6801
by Frank_Sae 09 Mar '26

09 Mar '26

yt6801 inclusion category: bugfix bugzilla: https://https://atomgit.com/openeuler/kernel/issues/7229 -------------------------------------------------------------------- add link info for yt6801 to fix that the link info is not update on os installation. Signed-off-by: Frank_Sae <Frank.Sae(a)motor-comm.com> --- .../ethernet/motorcomm/yt6801/yt6801_main.c | 90 +++++++++++++++++++ 1 file changed, 90 insertions(+) diff --git a/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c b/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c index 01eed3ace..cb54329ef 100644 --- a/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c +++ b/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c @@ -27,6 +27,95 @@ const struct net_device_ops *fxgmac_get_netdev_ops(void); static void fxgmac_napi_enable(struct fxgmac_pdata *priv); +const struct ethtool_ops *fxgmac_get_ethtool_ops(void); + +#define MII_SPEC_STATUS 0x11 /* PHY specific status */ +#define FXGMAC_EPHY_LINK_STATUS BIT(10) +#define PHY_MII_SPEC_DUPLEX BIT(13) + +static int fxgmac_get_link_ksettings(struct net_device *netdev, + struct ethtool_link_ksettings *cmd) +{ + struct fxgmac_pdata *pdata = netdev_priv(netdev); + struct phy_device *phydev = netdev->phydev; + u32 duplex, regval, link_status; + u32 adv = 0xFFFFFFFF; + + ethtool_link_ksettings_zero_link_mode(cmd, supported); + ethtool_link_ksettings_zero_link_mode(cmd, advertising); + + /* set the supported link speeds */ + ethtool_link_ksettings_add_link_mode(cmd, supported, 1000baseT_Full); + ethtool_link_ksettings_add_link_mode(cmd, supported, 100baseT_Full); + ethtool_link_ksettings_add_link_mode(cmd, supported, 100baseT_Half); + ethtool_link_ksettings_add_link_mode(cmd, supported, 10baseT_Full); + ethtool_link_ksettings_add_link_mode(cmd, supported, 10baseT_Half); + + /* Indicate pause support */ + ethtool_link_ksettings_add_link_mode(cmd, supported, Pause); + ethtool_link_ksettings_add_link_mode(cmd, supported, Asym_Pause); + + regval = phy_read(phydev, MII_ADVERTISE); + + if (field_get(ADVERTISE_PAUSE_CAP, regval)) + ethtool_link_ksettings_add_link_mode(cmd, advertising, Pause); + + if (field_get(ADVERTISE_PAUSE_ASYM, regval)) + ethtool_link_ksettings_add_link_mode(cmd, advertising, Asym_Pause); + + ethtool_link_ksettings_add_link_mode(cmd, supported, MII); + cmd->base.port = PORT_MII; + + ethtool_link_ksettings_add_link_mode(cmd, supported, Autoneg); + regval = phy_read(phydev, MII_BMCR); + + regval = field_get(BMCR_ANENABLE, regval); + if (regval) { + ethtool_link_ksettings_add_link_mode(cmd, advertising, Autoneg); + + regval = phy_read(phydev, MII_ADVERTISE); + + if (adv & ADVERTISE_10HALF) + ethtool_link_ksettings_add_link_mode(cmd, advertising, 10baseT_Half); + if (adv & ADVERTISE_10FULL) + ethtool_link_ksettings_add_link_mode(cmd, advertising, 10baseT_Full); + if (adv & ADVERTISE_100HALF) + ethtool_link_ksettings_add_link_mode(cmd, advertising, 100baseT_Half); + if (adv & ADVERTISE_100FULL) + ethtool_link_ksettings_add_link_mode(cmd, advertising, 100baseT_Full); + + adv = phy_read(phydev, MII_CTRL1000); + + if (adv & ADVERTISE_1000FULL) + ethtool_link_ksettings_add_link_mode(cmd, advertising, 1000baseT_Full); + } + + cmd->base.autoneg = 1; + + regval = phy_read(phydev, MII_SPEC_STATUS); + + link_status = field_get(FXGMAC_EPHY_LINK_STATUS, regval); + if (link_status) { + duplex = field_get(PHY_MII_SPEC_DUPLEX, regval); + cmd->base.duplex = duplex; + cmd->base.speed = pdata->mac_speed; + } else { + cmd->base.duplex = DUPLEX_UNKNOWN; + cmd->base.speed = SPEED_UNKNOWN; + } + + return 0; +} + +static const struct ethtool_ops fxgmac_ethtool_ops = { + .get_link = ethtool_op_get_link, + .get_link_ksettings = fxgmac_get_link_ksettings, +}; + +const struct ethtool_ops *fxgmac_get_ethtool_ops(void) +{ + return &fxgmac_ethtool_ops; +} #define PHY_WR_CONFIG(reg_offset) (0x8000205 + ((reg_offset) * 0x10000)) static int fxgmac_phy_write_reg(struct fxgmac_pdata *priv, u32 reg_id, u32 data) @@ -1899,6 +1988,7 @@ static int fxgmac_init(struct fxgmac_pdata *priv, bool save_private_reg) FXGMAC_JUMBO_PACKET_MTU + (ETH_HLEN + VLAN_HLEN + ETH_FCS_LEN); ndev->netdev_ops = fxgmac_get_netdev_ops();/* Set device operations */ + ndev->ethtool_ops = fxgmac_get_ethtool_ops();/* Set device operations */ /* Set device features */ if (priv->hw_feat.tso) { -- 2.34.1

2 1

[PATCH OLK-5.10] ksmbd: fix use-after-free in kerberos authentication
by Yongjian Sun 09 Mar '26

09 Mar '26

From: Sean Heelan <seanheelan(a)gmail.com> mainline inclusion from mainline-v6.15-rc5 commit e86e9134e1d1c90a960dd57f59ce574d27b9a124 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/10609 CVE: CVE-2025-37778 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Setting sess->user = NULL was introduced to fix the dangling pointer created by ksmbd_free_user. However, it is possible another thread could be operating on the session and make use of sess->user after it has been passed to ksmbd_free_user but before sess->user is set to NULL. Cc: stable(a)vger.kernel.org Signed-off-by: Sean Heelan <seanheelan(a)gmail.com> Acked-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/server/smb2pdu.c fs/ksmbd/smb2pdu.c fs/smb/server/auth.c fs/ksmbd/auth.c [mainline commit 38c8a9a52082 changed the file name] [mainline commit 1e440d5b25b7 still has issues] Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/ksmbd/auth.c | 14 +++++++++++++- fs/ksmbd/smb2pdu.c | 3 --- 2 files changed, 13 insertions(+), 4 deletions(-) diff --git a/fs/ksmbd/auth.c b/fs/ksmbd/auth.c index d8dabd19823f..c5916064b85e 100644 --- a/fs/ksmbd/auth.c +++ b/fs/ksmbd/auth.c @@ -514,7 +514,19 @@ int ksmbd_krb5_authenticate(struct ksmbd_session *sess, char *in_blob, retval = -ENOMEM; goto out; } - sess->user = user; + + if (!sess->user) { + /* First successful authentication */ + sess->user = user; + } else { + if (!ksmbd_compare_user(sess->user, user)) { + ksmbd_debug(AUTH, "different user tried to reuse session\n"); + retval = -EPERM; + ksmbd_free_user(user); + goto out; + } + ksmbd_free_user(user); + } memcpy(sess->sess_key, resp->payload, resp->session_key_len); memcpy(out_blob, resp->payload + resp->session_key_len, diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c index 13f2a81d3621..1588867b4e71 100644 --- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -1612,9 +1612,6 @@ static int krb5_authenticate(struct ksmbd_work *work, if (prev_sess_id && prev_sess_id != sess->id) destroy_previous_session(conn, sess->user, prev_sess_id); - if (sess->state == SMB2_SESSION_VALID) - ksmbd_free_user(sess->user); - retval = ksmbd_krb5_authenticate(sess, in_blob, in_len, out_blob, &out_len); if (retval) { -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] PCI: Fix pci_slot_trylock() error handling
by Ziming Du 09 Mar '26

09 Mar '26

From: Jinhui Guo <guojinhui.liam(a)bytedance.com> mainline inclusion from mainline-v7.0-rc1 commit 9368d1ee62829b08aa31836b3ca003803caf0b72 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8599 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Commit a4e772898f8b ("PCI: Add missing bridge lock to pci_bus_lock()") delegates the bridge device's pci_dev_trylock() to pci_bus_trylock() in pci_slot_trylock(), but it forgets to remove the corresponding pci_dev_unlock() when pci_bus_trylock() fails. Before a4e772898f8b, the code did: if (!pci_dev_trylock(dev)) /* <- lock bridge device */ goto unlock; if (dev->subordinate) { if (!pci_bus_trylock(dev->subordinate)) { pci_dev_unlock(dev); /* <- unlock bridge device */ goto unlock; } } After a4e772898f8b the bridge-device lock is no longer taken, but the pci_dev_unlock(dev) on the failure path was left in place, leading to the bug. This yields one of two errors: 1. A warning that the lock is being unlocked when no one holds it. 2. An incorrect unlock of a lock that belongs to another thread. Fix it by removing the now-redundant pci_dev_unlock(dev) on the failure path. [Same patch later posted by Keith at https://patch.msgid.link/20260116184150.3013258-1-kbusch@meta.com] Fixes: a4e772898f8b ("PCI: Add missing bridge lock to pci_bus_lock()") Signed-off-by: Jinhui Guo <guojinhui.liam(a)bytedance.com> Signed-off-by: Bjorn Helgaas <bhelgaas(a)google.com> Reviewed-by: Dan Williams <dan.j.williams(a)intel.com> Cc: stable(a)vger.kernel.org Link: https://patch.msgid.link/20251212145528.2555-1-guojinhui.liam@bytedance.com Signed-off-by: Ziming Du <duziming2(a)huawei.com> --- drivers/pci/pci.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c index b93605616d4e4..fbef3c37f37fa 100644 --- a/drivers/pci/pci.c +++ b/drivers/pci/pci.c @@ -5144,10 +5144,8 @@ static int pci_slot_trylock(struct pci_slot *slot) if (!dev->slot || dev->slot != slot) continue; if (dev->subordinate) { - if (!pci_bus_trylock(dev->subordinate)) { - pci_dev_unlock(dev); + if (!pci_bus_trylock(dev->subordinate)) goto unlock; - } } else if (!pci_dev_trylock(dev)) goto unlock; } -- 2.43.0

2 1

[PATCH OLK-5.10] [Backport] sched/rt: Skip currently executing CPU in rto_next_cpu()
by Chen Jinghuang 09 Mar '26

09 Mar '26

mainline inclusion from mainline-v7.0-rc1 commit 94894c9c477e53bcea052e075c53f89df3d2a33e category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8689 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- CPU0 becomes overloaded when hosting a CPU-bound RT task, a non-CPU-bound RT task, and a CFS task stuck in kernel space. When other CPUs switch from RT to non-RT tasks, RT load balancing (LB) is triggered; with HAVE_RT_PUSH_IPI enabled, they send IPIs to CPU0 to drive the execution of rto_push_irq_work_func. During push_rt_task on CPU0, if next_task->prio < rq->donor->prio, resched_curr() sets NEED_RESCHED and after the push operation completes, CPU0 calls rto_next_cpu(). Since only CPU0 is overloaded in this scenario, rto_next_cpu() should ideally return -1 (no further IPI needed). However, multiple CPUs invoking tell_cpu_to_push() during LB increments rd->rto_loop_next. Even when rd->rto_cpu is set to -1, the mismatch between rd->rto_loop and rd->rto_loop_next forces rto_next_cpu() to restart its search from -1. With CPU0 remaining overloaded (satisfying rt_nr_migratory && rt_nr_total > 1), it gets reselected, causing CPU0 to queue irq_work to itself and send self-IPIs repeatedly. As long as CPU0 stays overloaded and other CPUs run pull_rt_tasks(), it falls into an infinite self-IPI loop, which triggers a CPU hardlockup due to continuous self-interrupts. The trigging scenario is as follows: cpu0 cpu1 cpu2 pull_rt_task tell_cpu_to_push <------------irq_work_queue_on rto_push_irq_work_func push_rt_task resched_curr(rq) pull_rt_task rto_next_cpu tell_cpu_to_push <-------------------------- atomic_inc(rto_loop_next) rd->rto_loop != next rto_next_cpu irq_work_queue_on rto_push_irq_work_func Fix redundant self-IPI by filtering the initiating CPU in rto_next_cpu(). This solution has been verified to effectively eliminate spurious self-IPIs and prevent CPU hardlockup scenarios. Fixes: 4bdced5c9a29 ("sched/rt: Simplify the IPI based RT balancing logic") Suggested-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Suggested-by: K Prateek Nayak <kprateek.nayak(a)amd.com> Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Reviewed-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Reviewed-by: Valentin Schneider <vschneid(a)redhat.com> Link: https://patch.msgid.link/20260122012533.673768-1-chenjinghuang2@huawei.com Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- kernel/sched/rt.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c index ddbc857a28b8..dbc3a40a68fa 100644 --- a/kernel/sched/rt.c +++ b/kernel/sched/rt.c @@ -2013,6 +2013,7 @@ static void push_rt_tasks(struct rq *rq) */ static int rto_next_cpu(struct root_domain *rd) { + int this_cpu = smp_processor_id(); int next; int cpu; @@ -2036,6 +2037,10 @@ static int rto_next_cpu(struct root_domain *rd) rd->rto_cpu = cpu; + /* Do not send IPI to self */ + if (cpu == this_cpu) + continue; + if (cpu < nr_cpu_ids) return cpu; -- 2.34.1

2 1

[PATCH OLK-6.6] arm64/mpam: Fix warning of schedule state in resctrl_arch_mon_ctx_alloc()
by Zeng Heng 09 Mar '26

09 Mar '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8686 ------------------ resctrl_arch_mon_ctx_alloc() triggers a scheduling state warning when calling kmalloc() while the task is in a non-running state: do not call blocking ops when !TASK_RUNNING; state=1 set at prepare_to_wait WARNING: CPU: 78 PID: 12592 at kernel/sched/core.c:10584 _might_sleep Call trace: _might_sleep+0x1cc/0xf8 _kmalloc_cache_alloc_node+0x3a0/0x4e0 kmalloc_trace+0x44/0x120 resctrl_arch_mon_ctx_alloc+0xf0/0x178 mon_event_read+0xa0/0x308 mkdir_mondata_subdir+0x24c/0x330 mkdir_mondata_all+0x17c/0x248 rdt_get_tree+0x2e8/0x680 vfs_get_tree+0x5c/0x190 do_new_mount+0x27c/0x408 path_mount+0x2ac/0x448 arm64_sys_mount+0x1d4/0x228 Refactor the call sequence in resctrl_arch_mon_ctx_alloc() and ensure the allocation is performed in TASK_RUNNING state to avoid schedule state corrupted. Fixes: 9119da143939 ("arm_mpam: resctrl: Allow resctrl to allocate monitors") Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/platform/mpam/mpam_resctrl.c | 24 +++++++++++------------- 1 file changed, 11 insertions(+), 13 deletions(-) diff --git a/drivers/platform/mpam/mpam_resctrl.c b/drivers/platform/mpam/mpam_resctrl.c index 9950cc4eebf4..a33957651732 100644 --- a/drivers/platform/mpam/mpam_resctrl.c +++ b/drivers/platform/mpam/mpam_resctrl.c @@ -388,32 +388,30 @@ struct rdt_resource *resctrl_arch_get_resource(enum resctrl_res_level l) return &mpam_resctrl_exports[l].resctrl_res; } -static void *resctrl_arch_mon_ctx_alloc_no_wait(struct rdt_resource *r, - int evtid) +static u32 resctrl_arch_mon_ctx_alloc_no_wait(struct rdt_resource *r, + int evtid) { - u32 *ret = kmalloc(sizeof(*ret), GFP_KERNEL); - - if (!ret) - return ERR_PTR(-ENOMEM); - - *ret = __mon_is_rmid_idx; - return ret; + return __mon_is_rmid_idx; } void *resctrl_arch_mon_ctx_alloc(struct rdt_resource *r, int evtid) { DEFINE_WAIT(wait); - void *ret; + u32 *ret; + + ret = kmalloc(sizeof(*ret), GFP_KERNEL); + if (!ret) + return ERR_PTR(-ENOMEM); might_sleep(); do { prepare_to_wait(&resctrl_mon_ctx_waiters, &wait, TASK_INTERRUPTIBLE); - ret = resctrl_arch_mon_ctx_alloc_no_wait(r, evtid); - if (PTR_ERR(ret) == -ENOSPC) + *ret = resctrl_arch_mon_ctx_alloc_no_wait(r, evtid); + if (*ret == -ENOSPC) schedule(); - } while (PTR_ERR(ret) == -ENOSPC && !signal_pending(current)); + } while (*ret == -ENOSPC && !signal_pending(current)); finish_wait(&resctrl_mon_ctx_waiters, &wait); return ret; -- 2.25.1

2 1

[PATCH OLK-6.6 0/2] Fix TLBI broadcast optimization loss and incorrect dvmbm handling
by Tian Zheng 09 Mar '26

09 Mar '26

Fix 1 In the TLBI broadcast-optimization feature, the SYS_LSUDVM_CTRL_EL2 register controls whether the feature is enabled. When LPI low-power mode is enabled, this register is cleared as the pCPU powers down into LPI mode, causing the TLBI broadcast optimization to stop working. The fix saves and restores this control register in the callbacks for entering and exiting LPI mode. Fix 2 The current TLBI broadcast-optimization logic only supports normal VMs. If the feature is enabled globally, VMs that are not yet adapted for it, such as CCA will use an incorrect TLBI broadcast bitmap, which can cause a panic in CCA VMs. The fix moves the actual enable/disable of the dvmbm functionality into the vcpu load and vcpu put functions. Tian Zheng (2): KVM: arm64: Fix TLBI optimization broken in LPI mode KVM: arm64: Fix CCA guest panic when dvmbm is enabled arch/arm64/kvm/arm.c | 6 ++++++ arch/arm64/kvm/hisilicon/hisi_virt.c | 8 +++----- arch/arm64/kvm/hisilicon/hisi_virt.h | 19 +++++++++++++++++++ 3 files changed, 28 insertions(+), 5 deletions(-) -- 2.33.0

1 2

[PATCH OLK-5.10] SUNRPC: Ensure the transport backchannel association
by Dong Chenchen 09 Mar '26

09 Mar '26

From: Benjamin Coddington <bcodding(a)redhat.com> mainline inclusion from mainline-v5.12-rc6 commit 98b5cee37389b899de044bc4aac56e6ff33dbd4d category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8655 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If the server sends CB_ calls on a connection that is not associated with the backchannel, refuse to process the call and shut down the connection. This avoids a NULL dereference crash in xprt_complete_bc_request(). There's not much more we can do in this situation unless we want to look into allowing all connections to be associated with the fore and back channel. Signed-off-by: Benjamin Coddington <bcodding(a)redhat.com> Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/sunrpc/xprtsock.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c index 1ef469ddea89..a6580946ab69 100644 --- a/net/sunrpc/xprtsock.c +++ b/net/sunrpc/xprtsock.c @@ -558,6 +558,10 @@ xs_read_stream_call(struct sock_xprt *transport, struct msghdr *msg, int flags) struct rpc_rqst *req; ssize_t ret; + /* Is this transport associated with the backchannel? */ + if (!xprt->bc_serv) + return -ESHUTDOWN; + /* Look up and lock the request corresponding to the given XID */ req = xprt_lookup_bc_request(xprt, transport->recv.xid); if (!req) { -- 2.25.1

2 1

[PATCH OLK-5.10] [Backport] procfs: fix missing RCU protection when reading real_parent in do_task_stat()
by Chen Jinghuang 09 Mar '26

09 Mar '26

From: Jinliang Zheng <alexjlzheng(a)tencent.com> stable inclusion from stable-v5.10.252 commit fefa0fcd78be465b7ad4c497fa6ec90d64194c04 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8688 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 76149d53502cf17ef3ae454ff384551236fba867 ] When reading /proc/[pid]/stat, do_task_stat() accesses task->real_parent without proper RCU protection, which leads to: cpu 0 cpu 1 ----- ----- do_task_stat var = task->real_parent release_task call_rcu(delayed_put_task_struct) task_tgid_nr_ns(var) rcu_read_lock <--- Too late to protect task->real_parent! task_pid_ptr <--- UAF! rcu_read_unlock This patch uses task_ppid_nr_ns() instead of task_tgid_nr_ns() to add proper RCU protection for accessing task->real_parent. Link: https://lkml.kernel.org/r/20260128083007.3173016-1-alexjlzheng@tencent.com Fixes: 06fffb1267c9 ("do_task_stat: don't take rcu_read_lock()") Signed-off-by: Jinliang Zheng <alexjlzheng(a)tencent.com> Acked-by: Oleg Nesterov <oleg(a)redhat.com> Cc: David Hildenbrand <david(a)kernel.org> Cc: Ingo Molnar <mingo(a)kernel.org> Cc: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Cc: Mateusz Guzik <mjguzik(a)gmail.com> Cc: ruippan <ruippan(a)tencent.com> Cc: Usama Arif <usamaarif642(a)gmail.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/proc/array.c [context conflict] Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- fs/proc/array.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/proc/array.c b/fs/proc/array.c index d5fed9281863..6bb4c81ba66e 100644 --- a/fs/proc/array.c +++ b/fs/proc/array.c @@ -510,7 +510,7 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns, } sid = task_session_nr_ns(task, ns); - ppid = task_tgid_nr_ns(task->real_parent, ns); + ppid = task_ppid_nr_ns(task, ns); pgid = task_pgrp_nr_ns(task, ns); unlock_task_sighand(task, &flags); -- 2.34.1

2 1

[PATCH OLK-6.6] [Backport] procfs: fix missing RCU protection when reading real_parent in do_task_stat()
by Chen Jinghuang 09 Mar '26

09 Mar '26

From: Jinliang Zheng <alexjlzheng(a)tencent.com> stable inclusion from stable-v6.6.128 commit 0e64bd46a04a4fd61279aca9f53a664e9e5f7e7e category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8688 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 76149d53502cf17ef3ae454ff384551236fba867 ] When reading /proc/[pid]/stat, do_task_stat() accesses task->real_parent without proper RCU protection, which leads to: cpu 0 cpu 1 ----- ----- do_task_stat var = task->real_parent release_task call_rcu(delayed_put_task_struct) task_tgid_nr_ns(var) rcu_read_lock <--- Too late to protect task->real_parent! task_pid_ptr <--- UAF! rcu_read_unlock This patch uses task_ppid_nr_ns() instead of task_tgid_nr_ns() to add proper RCU protection for accessing task->real_parent. Link: https://lkml.kernel.org/r/20260128083007.3173016-1-alexjlzheng@tencent.com Fixes: 06fffb1267c9 ("do_task_stat: don't take rcu_read_lock()") Signed-off-by: Jinliang Zheng <alexjlzheng(a)tencent.com> Acked-by: Oleg Nesterov <oleg(a)redhat.com> Cc: David Hildenbrand <david(a)kernel.org> Cc: Ingo Molnar <mingo(a)kernel.org> Cc: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Cc: Mateusz Guzik <mjguzik(a)gmail.com> Cc: ruippan <ruippan(a)tencent.com> Cc: Usama Arif <usamaarif642(a)gmail.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/proc/array.c [Context Conflicts] Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- fs/proc/array.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/proc/array.c b/fs/proc/array.c index 6a4b0a850dce..288f19956e04 100644 --- a/fs/proc/array.c +++ b/fs/proc/array.c @@ -544,7 +544,7 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns, } sid = task_session_nr_ns(task, ns); - ppid = task_tgid_nr_ns(task->real_parent, ns); + ppid = task_ppid_nr_ns(task, ns); pgid = task_pgrp_nr_ns(task, ns); unlock_task_sighand(task, &flags); -- 2.34.1

2 1

[PATCH OLK-6.6] [Backport] sched/rt: Skip currently executing CPU in rto_next_cpu()
by Chen Jinghuang 09 Mar '26

09 Mar '26

mainline inclusion from mainline-v7.0-rc1 commit 94894c9c477e53bcea052e075c53f89df3d2a33e category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8689 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 94894c9c477e53bcea052e075c53f89df3d2a33e ] CPU0 becomes overloaded when hosting a CPU-bound RT task, a non-CPU-bound RT task, and a CFS task stuck in kernel space. When other CPUs switch from RT to non-RT tasks, RT load balancing (LB) is triggered; with HAVE_RT_PUSH_IPI enabled, they send IPIs to CPU0 to drive the execution of rto_push_irq_work_func. During push_rt_task on CPU0, if next_task->prio < rq->donor->prio, resched_curr() sets NEED_RESCHED and after the push operation completes, CPU0 calls rto_next_cpu(). Since only CPU0 is overloaded in this scenario, rto_next_cpu() should ideally return -1 (no further IPI needed). However, multiple CPUs invoking tell_cpu_to_push() during LB increments rd->rto_loop_next. Even when rd->rto_cpu is set to -1, the mismatch between rd->rto_loop and rd->rto_loop_next forces rto_next_cpu() to restart its search from -1. With CPU0 remaining overloaded (satisfying rt_nr_migratory && rt_nr_total > 1), it gets reselected, causing CPU0 to queue irq_work to itself and send self-IPIs repeatedly. As long as CPU0 stays overloaded and other CPUs run pull_rt_tasks(), it falls into an infinite self-IPI loop, which triggers a CPU hardlockup due to continuous self-interrupts. The trigging scenario is as follows: cpu0 cpu1 cpu2 pull_rt_task tell_cpu_to_push <------------irq_work_queue_on rto_push_irq_work_func push_rt_task resched_curr(rq) pull_rt_task rto_next_cpu tell_cpu_to_push <-------------------------- atomic_inc(rto_loop_next) rd->rto_loop != next rto_next_cpu irq_work_queue_on rto_push_irq_work_func Fix redundant self-IPI by filtering the initiating CPU in rto_next_cpu(). This solution has been verified to effectively eliminate spurious self-IPIs and prevent CPU hardlockup scenarios. Fixes: 4bdced5c9a29 ("sched/rt: Simplify the IPI based RT balancing logic") Suggested-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Suggested-by: K Prateek Nayak <kprateek.nayak(a)amd.com> Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Reviewed-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Reviewed-by: Valentin Schneider <vschneid(a)redhat.com> Link: https://patch.msgid.link/20260122012533.673768-1-chenjinghuang2@huawei.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- kernel/sched/rt.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c index 549b9ecfda7d..48d53bf0161b 100644 --- a/kernel/sched/rt.c +++ b/kernel/sched/rt.c @@ -2231,6 +2231,7 @@ static void push_rt_tasks(struct rq *rq) */ static int rto_next_cpu(struct root_domain *rd) { + int this_cpu = smp_processor_id(); int next; int cpu; @@ -2254,6 +2255,10 @@ static int rto_next_cpu(struct root_domain *rd) rd->rto_cpu = cpu; + /* Do not send IPI to self */ + if (cpu == this_cpu) + continue; + if (cpu < nr_cpu_ids) return cpu; -- 2.34.1

2 1

[PATCH OLK-6.6] [Backport] procfs: fix missing RCU protection when reading real_parent in do_task_stat()
by Chen Jinghuang 09 Mar '26

09 Mar '26

From: Jinliang Zheng <alexjlzheng(a)tencent.com> stable inclusion from stable-v6.6.128 commit 0e64bd46a04a4fd61279aca9f53a664e9e5f7e7e category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8688 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 76149d53502cf17ef3ae454ff384551236fba867 ] When reading /proc/[pid]/stat, do_task_stat() accesses task->real_parent without proper RCU protection, which leads to: cpu 0 cpu 1 ----- ----- do_task_stat var = task->real_parent release_task call_rcu(delayed_put_task_struct) task_tgid_nr_ns(var) rcu_read_lock <--- Too late to protect task->real_parent! task_pid_ptr <--- UAF! rcu_read_unlock This patch uses task_ppid_nr_ns() instead of task_tgid_nr_ns() to add proper RCU protection for accessing task->real_parent. Link: https://lkml.kernel.org/r/20260128083007.3173016-1-alexjlzheng@tencent.com Fixes: 06fffb1267c9 ("do_task_stat: don't take rcu_read_lock()") Signed-off-by: Jinliang Zheng <alexjlzheng(a)tencent.com> Acked-by: Oleg Nesterov <oleg(a)redhat.com> Cc: David Hildenbrand <david(a)kernel.org> Cc: Ingo Molnar <mingo(a)kernel.org> Cc: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Cc: Mateusz Guzik <mjguzik(a)gmail.com> Cc: ruippan <ruippan(a)tencent.com> Cc: Usama Arif <usamaarif642(a)gmail.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- fs/proc/array.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/proc/array.c b/fs/proc/array.c index 6a4b0a850dce..288f19956e04 100644 --- a/fs/proc/array.c +++ b/fs/proc/array.c @@ -544,7 +544,7 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns, } sid = task_session_nr_ns(task, ns); - ppid = task_tgid_nr_ns(task->real_parent, ns); + ppid = task_ppid_nr_ns(task, ns); pgid = task_pgrp_nr_ns(task, ns); unlock_task_sighand(task, &flags); -- 2.34.1

2 1

[PATCH OLK-6.6] [Backport] procfs: fix missing RCU protection when reading real_parent in do_task_stat()
by Chen Jinghuang 09 Mar '26

09 Mar '26

From: Jinliang Zheng <alexjlzheng(a)tencent.com> stable inclusion from stable-v6.6.128 commit 0e64bd46a04a4fd61279aca9f53a664e9e5f7e7e category: bugfix bugzilla: AR.SR.IR20250327002298.006.012 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 76149d53502cf17ef3ae454ff384551236fba867 ] When reading /proc/[pid]/stat, do_task_stat() accesses task->real_parent without proper RCU protection, which leads to: cpu 0 cpu 1 ----- ----- do_task_stat var = task->real_parent release_task call_rcu(delayed_put_task_struct) task_tgid_nr_ns(var) rcu_read_lock <--- Too late to protect task->real_parent! task_pid_ptr <--- UAF! rcu_read_unlock This patch uses task_ppid_nr_ns() instead of task_tgid_nr_ns() to add proper RCU protection for accessing task->real_parent. Link: https://lkml.kernel.org/r/20260128083007.3173016-1-alexjlzheng@tencent.com Fixes: 06fffb1267c9 ("do_task_stat: don't take rcu_read_lock()") Signed-off-by: Jinliang Zheng <alexjlzheng(a)tencent.com> Acked-by: Oleg Nesterov <oleg(a)redhat.com> Cc: David Hildenbrand <david(a)kernel.org> Cc: Ingo Molnar <mingo(a)kernel.org> Cc: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Cc: Mateusz Guzik <mjguzik(a)gmail.com> Cc: ruippan <ruippan(a)tencent.com> Cc: Usama Arif <usamaarif642(a)gmail.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- fs/proc/array.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/proc/array.c b/fs/proc/array.c index 6a4b0a850dce..288f19956e04 100644 --- a/fs/proc/array.c +++ b/fs/proc/array.c @@ -544,7 +544,7 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns, } sid = task_session_nr_ns(task, ns); - ppid = task_tgid_nr_ns(task->real_parent, ns); + ppid = task_ppid_nr_ns(task, ns); pgid = task_pgrp_nr_ns(task, ns); unlock_task_sighand(task, &flags); -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] CVE-2024-57979
by Wang Hai 09 Mar '26

09 Mar '26

Calvin Owens (1): [Backport] pps: Fix a use-after-free Wang Hai (1): pps: Fix a use-after-free - fix kabi drivers/pps/clients/pps-gpio.c | 4 +- drivers/pps/clients/pps-ktimer.c | 4 +- drivers/pps/clients/pps-ldisc.c | 2 +- drivers/pps/kapi.c | 2 +- drivers/pps/pps.c | 84 +++++++++++++++++--------------- 5 files changed, 51 insertions(+), 45 deletions(-) -- 2.17.1

2 3

[PATCH OLK-6.6] iommu: disable SVA when CONFIG_X86 is set
by Zhang Yuwei 07 Mar '26

07 Mar '26

From: Lu Baolu <baolu.lu(a)linux.intel.com> mainline inclusion from mainline-v6.19-rc1 commit 72f98ef9a4be30d2a60136dd6faee376f780d06c category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13400 CVE: CVE-2025-71089 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Patch series "Fix stale IOTLB entries for kernel address space", v7. This proposes a fix for a security vulnerability related to IOMMU Shared Virtual Addressing (SVA). In an SVA context, an IOMMU can cache kernel page table entries. When a kernel page table page is freed and reallocated for another purpose, the IOMMU might still hold stale, incorrect entries. This can be exploited to cause a use-after-free or write-after-free condition, potentially leading to privilege escalation or data corruption. This solution introduces a deferred freeing mechanism for kernel page table pages, which provides a safe window to notify the IOMMU to invalidate its caches before the page is reused. This patch (of 8): In the IOMMU Shared Virtual Addressing (SVA) context, the IOMMU hardware shares and walks the CPU's page tables. The x86 architecture maps the kernel's virtual address space into the upper portion of every process's page table. Consequently, in an SVA context, the IOMMU hardware can walk and cache kernel page table entries. The Linux kernel currently lacks a notification mechanism for kernel page table changes, specifically when page table pages are freed and reused. The IOMMU driver is only notified of changes to user virtual address mappings. This can cause the IOMMU's internal caches to retain stale entries for kernel VA. Use-After-Free (UAF) and Write-After-Free (WAF) conditions arise when kernel page table pages are freed and later reallocated. The IOMMU could misinterpret the new data as valid page table entries. The IOMMU might then walk into attacker-controlled memory, leading to arbitrary physical memory DMA access or privilege escalation. This is also a Write-After-Free issue, as the IOMMU will potentially continue to write Accessed and Dirty bits to the freed memory while attempting to walk the stale page tables. Currently, SVA contexts are unprivileged and cannot access kernel mappings. However, the IOMMU will still walk kernel-only page tables all the way down to the leaf entries, where it realizes the mapping is for the kernel and errors out. This means the IOMMU still caches these intermediate page table entries, making the described vulnerability a real concern. Disable SVA on x86 architecture until the IOMMU can receive notification to flush the paging cache before freeing the CPU kernel page table pages. Link: https://lkml.kernel.org/r/20251022082635.2462433-1-baolu.lu@linux.intel.com Link: https://lkml.kernel.org/r/20251022082635.2462433-2-baolu.lu@linux.intel.com Fixes: 26b25a2b98e4 ("iommu: Bind process address spaces to devices") Signed-off-by: Lu Baolu <baolu.lu(a)linux.intel.com> Suggested-by: Jason Gunthorpe <jgg(a)nvidia.com> Reviewed-by: Jason Gunthorpe <jgg(a)nvidia.com> Cc: Alistair Popple <apopple(a)nvidia.com> Cc: Andy Lutomirski <luto(a)kernel.org> Cc: Borislav Betkov <bp(a)alien8.de> Cc: Dave Hansen <dave.hansen(a)intel.com> Cc: David Hildenbrand <david(a)redhat.com> Cc: Ingo Molnar <mingo(a)redhat.com> Cc: Jann Horn <jannh(a)google.com> Cc: Jean-Philippe Brucker <jean-philippe(a)linaro.org> Cc: Joerg Roedel <joro(a)8bytes.org> Cc: Kevin Tian <kevin.tian(a)intel.com> Cc: Liam Howlett <liam.howlett(a)oracle.com> Cc: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Cc: Matthew Wilcox (Oracle) <willy(a)infradead.org> Cc: Michal Hocko <mhocko(a)kernel.org> Cc: Mike Rapoport <rppt(a)kernel.org> Cc: Peter Zijlstra <peterz(a)infradead.org> Cc: Robin Murohy <robin.murphy(a)arm.com> Cc: Thomas Gleinxer <tglx(a)linutronix.de> Cc: "Uladzislau Rezki (Sony)" <urezki(a)gmail.com> Cc: Vasant Hegde <vasant.hegde(a)amd.com> Cc: Vinicius Costa Gomes <vinicius.gomes(a)intel.com> Cc: Vlastimil Babka <vbabka(a)suse.cz> Cc: Will Deacon <will(a)kernel.org> Cc: Yi Lai <yi1.lai(a)intel.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> --- drivers/iommu/iommu-sva.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/iommu/iommu-sva.c b/drivers/iommu/iommu-sva.c index 96c77d43928a..b65177bbd75f 100644 --- a/drivers/iommu/iommu-sva.c +++ b/drivers/iommu/iommu-sva.c @@ -81,6 +81,9 @@ struct iommu_sva *iommu_sva_bind_device(struct device *dev, struct mm_struct *mm if (!group) return ERR_PTR(-ENODEV); + if (IS_ENABLED(CONFIG_X86)) + return ERR_PTR(-EOPNOTSUPP); + mutex_lock(&iommu_sva_lock); /* Allocate mm->pasid if necessary. */ -- 2.22.0

2 1

[PATCH OLK-5.10 0/2] CVE-2024-57979
by Wang Hai 07 Mar '26

07 Mar '26

Calvin Owens (1): pps: Fix a use-after-free Wang Hai (1): pps: Fix kabi in pps_device drivers/pps/clients/pps-gpio.c | 4 +- drivers/pps/clients/pps-ktimer.c | 4 +- drivers/pps/clients/pps-ldisc.c | 2 +- drivers/pps/kapi.c | 2 +- drivers/pps/pps.c | 84 +++++++++++++++++--------------- 5 files changed, 51 insertions(+), 45 deletions(-) -- 2.17.1

2 3

[PATCH OLK-5.10] ALSA: aloop: Fix racy access at PCM trigger
by Lin Ruifeng 07 Mar '26

07 Mar '26

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v6.12.70 commit bad15420050db1803767e58756114800cce91ea4 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13748 CVE: CVE-2026-23191 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 826af7fa62e347464b1b4e0ba2fe19a92438084f upstream. The PCM trigger callback of aloop driver tries to check the PCM state and stop the stream of the tied substream in the corresponding cable. Since both check and stop operations are performed outside the cable lock, this may result in UAF when a program attempts to trigger frequently while opening/closing the tied stream, as spotted by fuzzers. For addressing the UAF, this patch changes two things: - It covers the most of code in loopback_check_format() with cable->lock spinlock, and add the proper NULL checks. This avoids already some racy accesses. - In addition, now we try to check the state of the capture PCM stream that may be stopped in this function, which was the major pain point leading to UAF. Reported-by: syzbot+5f8f3acdee1ec7a7ef7b(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/69783ba1.050a0220.c9109.0011.GAE@google.com Cc: <stable(a)vger.kernel.org> Link: https://patch.msgid.link/20260203141003.116584-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: sound/drivers/aloop.c [Context Conflicts] Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- sound/drivers/aloop.c | 89 +++++++++++++++++++++++++++---------------- 1 file changed, 56 insertions(+), 33 deletions(-) diff --git a/sound/drivers/aloop.c b/sound/drivers/aloop.c index fb45a32d99cd..b8ea26719bbc 100644 --- a/sound/drivers/aloop.c +++ b/sound/drivers/aloop.c @@ -320,51 +320,74 @@ static int loopback_snd_timer_close_cable(struct loopback_pcm *dpcm) static int loopback_check_format(struct loopback_cable *cable, int stream) { + struct loopback_pcm *dpcm_play, *dpcm_capt; struct snd_pcm_runtime *runtime, *cruntime; struct loopback_setup *setup; struct snd_card *card; + bool stop_capture = false; int check; + unsigned long flags; + + spin_lock_irqsave(&cable->lock, flags); + + dpcm_play = cable->streams[SNDRV_PCM_STREAM_PLAYBACK]; + dpcm_capt = cable->streams[SNDRV_PCM_STREAM_CAPTURE]; if (cable->valid != CABLE_VALID_BOTH) { - if (stream == SNDRV_PCM_STREAM_PLAYBACK) - goto __notify; - return 0; - } - runtime = cable->streams[SNDRV_PCM_STREAM_PLAYBACK]-> - substream->runtime; - cruntime = cable->streams[SNDRV_PCM_STREAM_CAPTURE]-> - substream->runtime; - check = runtime->format != cruntime->format || + if (stream == SNDRV_PCM_STREAM_CAPTURE || !dpcm_play) { + spin_unlock_irqrestore(&cable->lock, flags); + return 0; + } + } else { + if (!dpcm_play || !dpcm_capt) { + spin_unlock_irqrestore(&cable->lock, flags); + return -EIO; + } + runtime = dpcm_play->substream->runtime; + cruntime = dpcm_capt->substream->runtime; + if (!runtime || !cruntime) { + spin_unlock_irqrestore(&cable->lock, flags); + return -EIO; + } + check = runtime->format != cruntime->format || runtime->rate != cruntime->rate || runtime->channels != cruntime->channels; - if (!check) - return 0; - if (stream == SNDRV_PCM_STREAM_CAPTURE) { - return -EIO; - } else { - snd_pcm_stop(cable->streams[SNDRV_PCM_STREAM_CAPTURE]-> - substream, SNDRV_PCM_STATE_DRAINING); - __notify: - runtime = cable->streams[SNDRV_PCM_STREAM_PLAYBACK]-> - substream->runtime; - setup = get_setup(cable->streams[SNDRV_PCM_STREAM_PLAYBACK]); - card = cable->streams[SNDRV_PCM_STREAM_PLAYBACK]->loopback->card; - if (setup->format != runtime->format) { - snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE, - &setup->format_id); - setup->format = runtime->format; + if (!check) { + spin_unlock_irqrestore(&cable->lock, flags); + return 0; } - if (setup->rate != runtime->rate) { - snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE, - &setup->rate_id); - setup->rate = runtime->rate; + if (stream == SNDRV_PCM_STREAM_CAPTURE) { + spin_unlock_irqrestore(&cable->lock, flags); + return -EIO; } - if (setup->channels != runtime->channels) { - snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE, - &setup->channels_id); - setup->channels = runtime->channels; + else if (cruntime->status->state == SNDRV_PCM_STATE_RUNNING) { + stop_capture = true; } } + + setup = get_setup(dpcm_play); + card = dpcm_play->loopback->card; + runtime = dpcm_play->substream->runtime; + if (setup->format != runtime->format) { + snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE, + &setup->format_id); + setup->format = runtime->format; + } + if (setup->rate != runtime->rate) { + snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE, + &setup->rate_id); + setup->rate = runtime->rate; + } + if (setup->channels != runtime->channels) { + snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE, + &setup->channels_id); + setup->channels = runtime->channels; + } + spin_unlock_irqrestore(&cable->lock, flags); + + if (stop_capture) + snd_pcm_stop(dpcm_capt->substream, SNDRV_PCM_STATE_DRAINING); + return 0; } -- 2.43.0

2 1

[PATCH OLK-6.6 0/3] *** fix CVE-2026-23207 ***
by Lin Ruifeng 07 Mar '26

07 Mar '26

*** fix CVE-2026-23207 *** Breno Leitao (2): spi: tegra210-quad: Move curr_xfer read inside spinlock spi: tegra210-quad: Protect curr_xfer check in IRQ handler Vishwaroop A (1): spi: tegra210-quad: Fix timeout handling drivers/spi/spi-tegra210-quad.c | 49 ++++++++++++++++++++++++++++++--- 1 file changed, 45 insertions(+), 4 deletions(-) -- 2.43.0

2 4

[PATCH OLK-5.10 0/2] CVE-2024-57979
by Wang Hai 07 Mar '26

07 Mar '26

Calvin Owens (1): pps: Fix a use-after-free Wang Hai (1): pps: Fix kabi in pps_device drivers/pps/clients/pps-gpio.c | 4 +- drivers/pps/clients/pps-ktimer.c | 4 +- drivers/pps/clients/pps-ldisc.c | 2 +- drivers/pps/kapi.c | 2 +- drivers/pps/pps.c | 84 +++++++++++++++++--------------- 5 files changed, 51 insertions(+), 45 deletions(-) -- 2.17.1

2 3

[PATCH OLK-6.6 0/2] CVE-2024-57979
by Wang Hai 07 Mar '26

07 Mar '26

Calvin Owens (1): [Backport] pps: Fix a use-after-free Wang Hai (1): pps: Fix a use-after-free - fix kabi drivers/pps/clients/pps-gpio.c | 4 +- drivers/pps/clients/pps-ktimer.c | 4 +- drivers/pps/clients/pps-ldisc.c | 2 +- drivers/pps/kapi.c | 2 +- drivers/pps/pps.c | 84 +++++++++++++++++--------------- 5 files changed, 51 insertions(+), 45 deletions(-) -- 2.17.1

2 3

[PATCH OLK-6.6] platform/x86: classmate-laptop: Add missing NULL pointer checks
by Zeng Heng 07 Mar '26

07 Mar '26

From: "Rafael J. Wysocki" <rafael.j.wysocki(a)intel.com> mainline inclusion from mainline-v6.19 commit fe747d7112283f47169e9c16e751179a9b38611e category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/13842 CVE: CVE-2026-23237 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- In a few places in the Classmate laptop driver, code using the accel object may run before that object's address is stored in the driver data of the input device using it. For example, cmpc_accel_sensitivity_store_v4() is the "show" method of cmpc_accel_sensitivity_attr_v4 which is added in cmpc_accel_add_v4(), before calling dev_set_drvdata() for inputdev->dev. If the sysfs attribute is accessed prematurely, the dev_get_drvdata(&inputdev->dev) call in in cmpc_accel_sensitivity_store_v4() returns NULL which leads to a NULL pointer dereference going forward. Moreover, sysfs attributes using the input device are added before initializing that device by cmpc_add_acpi_notify_device() and if one of them is accessed before running that function, a NULL pointer dereference will occur. For example, cmpc_accel_sensitivity_attr_v4 is added before calling cmpc_add_acpi_notify_device() and if it is read prematurely, the dev_get_drvdata(&acpi->dev) call in cmpc_accel_sensitivity_show_v4() returns NULL which leads to a NULL pointer dereference going forward. Fix this by adding NULL pointer checks in all of the relevant places. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Link: https://patch.msgid.link/12825381.O9o76ZdvQC@rafael.j.wysocki Reviewed-by: Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> Conflicts: drivers/platform/x86/classmate-laptop.c [Context conflicts.] Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/platform/x86/classmate-laptop.c | 32 +++++++++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/drivers/platform/x86/classmate-laptop.c b/drivers/platform/x86/classmate-laptop.c index 2edaea2492df..053c8a86d5ec 100644 --- a/drivers/platform/x86/classmate-laptop.c +++ b/drivers/platform/x86/classmate-laptop.c @@ -208,7 +208,12 @@ static ssize_t cmpc_accel_sensitivity_show_v4(struct device *dev, acpi = to_acpi_device(dev); inputdev = dev_get_drvdata(&acpi->dev); + if (!inputdev) + return -ENXIO; + accel = dev_get_drvdata(&inputdev->dev); + if (!accel) + return -ENXIO; return sprintf(buf, "%d\n", accel->sensitivity); } @@ -225,7 +230,12 @@ static ssize_t cmpc_accel_sensitivity_store_v4(struct device *dev, acpi = to_acpi_device(dev); inputdev = dev_get_drvdata(&acpi->dev); + if (!inputdev) + return -ENXIO; + accel = dev_get_drvdata(&inputdev->dev); + if (!accel) + return -ENXIO; r = kstrtoul(buf, 0, &sensitivity); if (r) @@ -257,7 +267,12 @@ static ssize_t cmpc_accel_g_select_show_v4(struct device *dev, acpi = to_acpi_device(dev); inputdev = dev_get_drvdata(&acpi->dev); + if (!inputdev) + return -ENXIO; + accel = dev_get_drvdata(&inputdev->dev); + if (!accel) + return -ENXIO; return sprintf(buf, "%d\n", accel->g_select); } @@ -274,7 +289,12 @@ static ssize_t cmpc_accel_g_select_store_v4(struct device *dev, acpi = to_acpi_device(dev); inputdev = dev_get_drvdata(&acpi->dev); + if (!inputdev) + return -ENXIO; + accel = dev_get_drvdata(&inputdev->dev); + if (!accel) + return -ENXIO; r = kstrtoul(buf, 0, &g_select); if (r) @@ -303,6 +323,8 @@ static int cmpc_accel_open_v4(struct input_dev *input) acpi = to_acpi_device(input->dev.parent); accel = dev_get_drvdata(&input->dev); + if (!accel) + return -ENXIO; cmpc_accel_set_sensitivity_v4(acpi->handle, accel->sensitivity); cmpc_accel_set_g_select_v4(acpi->handle, accel->g_select); @@ -551,7 +573,12 @@ static ssize_t cmpc_accel_sensitivity_show(struct device *dev, acpi = to_acpi_device(dev); inputdev = dev_get_drvdata(&acpi->dev); + if (!inputdev) + return -ENXIO; + accel = dev_get_drvdata(&inputdev->dev); + if (!accel) + return -ENXIO; return sprintf(buf, "%d\n", accel->sensitivity); } @@ -568,7 +595,12 @@ static ssize_t cmpc_accel_sensitivity_store(struct device *dev, acpi = to_acpi_device(dev); inputdev = dev_get_drvdata(&acpi->dev); + if (!inputdev) + return -ENXIO; + accel = dev_get_drvdata(&inputdev->dev); + if (!accel) + return -ENXIO; r = kstrtoul(buf, 0, &sensitivity); if (r) -- 2.25.1

2 1

[PATCH OLK-6.6] platform/x86: classmate-laptop: Add missing NULL pointer checks
by Zeng Heng 07 Mar '26

07 Mar '26

From: "Rafael J. Wysocki" <rafael.j.wysocki(a)intel.com> mainline inclusion from mainline-v6.19 commit fe747d7112283f47169e9c16e751179a9b38611e category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/13842 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- In a few places in the Classmate laptop driver, code using the accel object may run before that object's address is stored in the driver data of the input device using it. For example, cmpc_accel_sensitivity_store_v4() is the "show" method of cmpc_accel_sensitivity_attr_v4 which is added in cmpc_accel_add_v4(), before calling dev_set_drvdata() for inputdev->dev. If the sysfs attribute is accessed prematurely, the dev_get_drvdata(&inputdev->dev) call in in cmpc_accel_sensitivity_store_v4() returns NULL which leads to a NULL pointer dereference going forward. Moreover, sysfs attributes using the input device are added before initializing that device by cmpc_add_acpi_notify_device() and if one of them is accessed before running that function, a NULL pointer dereference will occur. For example, cmpc_accel_sensitivity_attr_v4 is added before calling cmpc_add_acpi_notify_device() and if it is read prematurely, the dev_get_drvdata(&acpi->dev) call in cmpc_accel_sensitivity_show_v4() returns NULL which leads to a NULL pointer dereference going forward. Fix this by adding NULL pointer checks in all of the relevant places. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Link: https://patch.msgid.link/12825381.O9o76ZdvQC@rafael.j.wysocki Reviewed-by: Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> Conflicts: drivers/platform/x86/classmate-laptop.c [Context conflicts.] Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/platform/x86/classmate-laptop.c | 32 +++++++++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/drivers/platform/x86/classmate-laptop.c b/drivers/platform/x86/classmate-laptop.c index 2edaea2492df..053c8a86d5ec 100644 --- a/drivers/platform/x86/classmate-laptop.c +++ b/drivers/platform/x86/classmate-laptop.c @@ -208,7 +208,12 @@ static ssize_t cmpc_accel_sensitivity_show_v4(struct device *dev, acpi = to_acpi_device(dev); inputdev = dev_get_drvdata(&acpi->dev); + if (!inputdev) + return -ENXIO; + accel = dev_get_drvdata(&inputdev->dev); + if (!accel) + return -ENXIO; return sprintf(buf, "%d\n", accel->sensitivity); } @@ -225,7 +230,12 @@ static ssize_t cmpc_accel_sensitivity_store_v4(struct device *dev, acpi = to_acpi_device(dev); inputdev = dev_get_drvdata(&acpi->dev); + if (!inputdev) + return -ENXIO; + accel = dev_get_drvdata(&inputdev->dev); + if (!accel) + return -ENXIO; r = kstrtoul(buf, 0, &sensitivity); if (r) @@ -257,7 +267,12 @@ static ssize_t cmpc_accel_g_select_show_v4(struct device *dev, acpi = to_acpi_device(dev); inputdev = dev_get_drvdata(&acpi->dev); + if (!inputdev) + return -ENXIO; + accel = dev_get_drvdata(&inputdev->dev); + if (!accel) + return -ENXIO; return sprintf(buf, "%d\n", accel->g_select); } @@ -274,7 +289,12 @@ static ssize_t cmpc_accel_g_select_store_v4(struct device *dev, acpi = to_acpi_device(dev); inputdev = dev_get_drvdata(&acpi->dev); + if (!inputdev) + return -ENXIO; + accel = dev_get_drvdata(&inputdev->dev); + if (!accel) + return -ENXIO; r = kstrtoul(buf, 0, &g_select); if (r) @@ -303,6 +323,8 @@ static int cmpc_accel_open_v4(struct input_dev *input) acpi = to_acpi_device(input->dev.parent); accel = dev_get_drvdata(&input->dev); + if (!accel) + return -ENXIO; cmpc_accel_set_sensitivity_v4(acpi->handle, accel->sensitivity); cmpc_accel_set_g_select_v4(acpi->handle, accel->g_select); @@ -551,7 +573,12 @@ static ssize_t cmpc_accel_sensitivity_show(struct device *dev, acpi = to_acpi_device(dev); inputdev = dev_get_drvdata(&acpi->dev); + if (!inputdev) + return -ENXIO; + accel = dev_get_drvdata(&inputdev->dev); + if (!accel) + return -ENXIO; return sprintf(buf, "%d\n", accel->sensitivity); } @@ -568,7 +595,12 @@ static ssize_t cmpc_accel_sensitivity_store(struct device *dev, acpi = to_acpi_device(dev); inputdev = dev_get_drvdata(&acpi->dev); + if (!inputdev) + return -ENXIO; + accel = dev_get_drvdata(&inputdev->dev); + if (!accel) + return -ENXIO; r = kstrtoul(buf, 0, &sensitivity); if (r) -- 2.25.1

2 1

[PATCH v2 OLK-6.6] vsock/virtio: cap TX credit to local buffer size
by Ze Zuo 07 Mar '26

07 Mar '26

From: Melbin K Mathew <mlbnkm1(a)gmail.com> stable inclusion from stable-v6.6.122 commit d9d5f222558b42f6277eafaaa6080966faf37676 category: feature bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13619 CVE: CVE-2026-23086 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 8ee784fdf006cbe8739cfa093f54d326cbf54037 ] The virtio transports derives its TX credit directly from peer_buf_alloc, which is set from the remote endpoint's SO_VM_SOCKETS_BUFFER_SIZE value. On the host side this means that the amount of data we are willing to queue for a connection is scaled by a guest-chosen buffer size, rather than the host's own vsock configuration. A malicious guest can advertise a large buffer and read slowly, causing the host to allocate a correspondingly large amount of sk_buff memory. The same thing would happen in the guest with a malicious host, since virtio transports share the same code base. Introduce a small helper, virtio_transport_tx_buf_size(), that returns min(peer_buf_alloc, buf_alloc), and use it wherever we consume peer_buf_alloc. This ensures the effective TX window is bounded by both the peer's advertised buffer and our own buf_alloc (already clamped to buffer_max_size via SO_VM_SOCKETS_BUFFER_MAX_SIZE), so a remote peer cannot force the other to queue more data than allowed by its own vsock settings. On an unpatched Ubuntu 22.04 host (~64 GiB RAM), running a PoC with 32 guest vsock connections advertising 2 GiB each and reading slowly drove Slab/SUnreclaim from ~0.5 GiB to ~57 GiB; the system only recovered after killing the QEMU process. That said, if QEMU memory is limited with cgroups, the maximum memory used will be limited. With this patch applied: Before: MemFree: ~61.6 GiB Slab: ~142 MiB SUnreclaim: ~117 MiB After 32 high-credit connections: MemFree: ~61.5 GiB Slab: ~178 MiB SUnreclaim: ~152 MiB Only ~35 MiB increase in Slab/SUnreclaim, no host OOM, and the guest remains responsive. Compatibility with non-virtio transports: - VMCI uses the AF_VSOCK buffer knobs to size its queue pairs per socket based on the local vsk->buffer_* values; the remote side cannot enlarge those queues beyond what the local endpoint configured. - Hyper-V's vsock transport uses fixed-size VMBus ring buffers and an MTU bound; there is no peer-controlled credit field comparable to peer_buf_alloc, and the remote endpoint cannot drive in-flight kernel memory above those ring sizes. - The loopback path reuses virtio_transport_common.c, so it naturally follows the same semantics as the virtio transport. This change is limited to virtio_transport_common.c and thus affects virtio-vsock, vhost-vsock, and loopback, bringing them in line with the "remote window intersected with local policy" behaviour that VMCI and Hyper-V already effectively have. Fixes: 06a8fc78367d ("VSOCK: Introduce virtio_vsock_common.ko") Suggested-by: Stefano Garzarella <sgarzare(a)redhat.com> Signed-off-by: Melbin K Mathew <mlbnkm1(a)gmail.com> [Stefano: small adjustments after changing the previous patch] [Stefano: tweak the commit message] Signed-off-by: Stefano Garzarella <sgarzare(a)redhat.com> Reviewed-by: Luigi Leonardi <leonardi(a)redhat.com> Link: https://patch.msgid.link/20260121093628.9941-4-sgarzare@redhat.com Acked-by: Michael S. Tsirkin <mst(a)redhat.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: net/vmw_vsock/virtio_transport_common.c [Conflicts due to context.] Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- change since v1: -- fix patch merge conflict. --- net/vmw_vsock/virtio_transport_common.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c index 1401177e2622..4c374c36c29d 100644 --- a/net/vmw_vsock/virtio_transport_common.c +++ b/net/vmw_vsock/virtio_transport_common.c @@ -628,6 +628,15 @@ virtio_transport_seqpacket_dequeue(struct vsock_sock *vsk, } EXPORT_SYMBOL_GPL(virtio_transport_seqpacket_dequeue); +static u32 virtio_transport_tx_buf_size(struct virtio_vsock_sock *vvs) +{ + /* The peer advertises its receive buffer via peer_buf_alloc, but we + * cap it to our local buf_alloc so a remote peer cannot force us to + * queue more data than our own buffer configuration allows. + */ + return min(vvs->peer_buf_alloc, vvs->buf_alloc); +} + int virtio_transport_seqpacket_enqueue(struct vsock_sock *vsk, struct msghdr *msg, @@ -637,7 +646,7 @@ virtio_transport_seqpacket_enqueue(struct vsock_sock *vsk, spin_lock_bh(&vvs->tx_lock); - if (len > vvs->peer_buf_alloc) { + if (len > virtio_transport_tx_buf_size(vvs)) { spin_unlock_bh(&vvs->tx_lock); return -EMSGSIZE; } @@ -691,7 +700,8 @@ static s64 virtio_transport_has_space(struct virtio_vsock_sock *vvs) * we have bytes in flight (tx_cnt - peer_fwd_cnt), the subtraction * does not underflow. */ - bytes = (s64)vvs->peer_buf_alloc - (vvs->tx_cnt - vvs->peer_fwd_cnt); + bytes = (s64)virtio_transport_tx_buf_size(vvs) - + (vvs->tx_cnt - vvs->peer_fwd_cnt); if (bytes < 0) bytes = 0; -- 2.25.1

2 1

[PATCH OLK-6.6] Revert "mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()"
by Ze Zuo 07 Mar '26

07 Mar '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13853 -------------------------------- This reverts commit 00b50cbb31ad11c0896355e351f961b1b586797f. Before this patch commit 00b50cbb31ad ("mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()") was merged, setting cache_limit_mbytes to 0 meant that periodic reclaim could reclaim page cache without limitation. After the patch was merged, page cache is no longer reclaimed when cache_limit_mbytes is set to 0. As a result, periodic reclaim becomes ineffective. Revert this patch. Fixes: 00b50cbb31ad ("mm: Move vm_cache_limit_mbytes check to page_cache_over_limit()") Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- mm/page_cache_limit.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/mm/page_cache_limit.c b/mm/page_cache_limit.c index 677ead24d27f..fe67b8b804f0 100644 --- a/mm/page_cache_limit.c +++ b/mm/page_cache_limit.c @@ -38,9 +38,6 @@ static bool page_cache_over_limit(void) unsigned long lru_file; unsigned long limit; - if (!vm_cache_limit_mbytes) - return false; - limit = vm_cache_limit_mbytes << (20 - PAGE_SHIFT); lru_file = global_node_page_state(NR_ACTIVE_FILE) + global_node_page_state(NR_INACTIVE_FILE); @@ -50,6 +47,17 @@ static bool page_cache_over_limit(void) return false; } +static bool should_reclaim_page_cache(void) +{ + if (!should_periodical_reclaim()) + return false; + + if (!vm_cache_limit_mbytes) + return false; + + return true; +} + int cache_reclaim_enable_handler(struct ctl_table *table, int write, void *buffer, size_t *length, loff_t *ppos) { @@ -102,7 +110,7 @@ int cache_limit_mbytes_sysctl_handler(struct ctl_table *table, int write, } if (write) { - while (should_periodical_reclaim() && page_cache_over_limit() && + while (should_reclaim_page_cache() && page_cache_over_limit() && nr_retries--) { if (signal_pending(current)) return -EINTR; -- 2.25.1

2 1

[PATCH OLK-5.10] kexec: derive purgatory entry from symbol
by Tengda Wu 06 Mar '26

06 Mar '26

From: Li Chen <me(a)linux.beauty> stable inclusion from stable-v5.10.252 commit 027797595a108726f4a0a45d225f603b0ffbd22b category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8682 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 480e1d5c64bb14441f79f2eb9421d5e26f91ea3d ] kexec_load_purgatory() derives image->start by locating e_entry inside an SHF_EXECINSTR section. If the purgatory object contains multiple executable sections with overlapping sh_addr, the entrypoint check can match more than once and trigger a WARN. Derive the entry section from the purgatory_start symbol when present and compute image->start from its final placement. Keep the existing e_entry fallback for purgatories that do not expose the symbol. WARNING: kernel/kexec_file.c:1009 at kexec_load_purgatory+0x395/0x3c0, CPU#10: kexec/1784 Call Trace: <TASK> bzImage64_load+0x133/0xa00 __do_sys_kexec_file_load+0x2b3/0x5c0 do_syscall_64+0x81/0x610 entry_SYSCALL_64_after_hwframe+0x76/0x7e [me(a)linux.beauty: move helper to avoid forward declaration, per Baoquan] Link: https://lkml.kernel.org/r/20260128043511.316860-1-me@linux.beauty Link: https://lkml.kernel.org/r/20260120124005.148381-1-me@linux.beauty Fixes: 8652d44f466a ("kexec: support purgatories with .text.hot sections") Signed-off-by: Li Chen <me(a)linux.beauty> Acked-by: Baoquan He <bhe(a)redhat.com> Cc: Alexander Graf <graf(a)amazon.com> Cc: Eric Biggers <ebiggers(a)kernel.org> Cc: Li Chen <me(a)linux.beauty> Cc: Philipp Rudo <prudo(a)redhat.com> Cc: Ricardo Ribalda Delgado <ribalda(a)chromium.org> Cc: Ross Zwisler <zwisler(a)google.com> Cc: Sourabh Jain <sourabhjain(a)linux.ibm.com> Cc: Steven Rostedt <rostedt(a)goodmis.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/kexec_file.c | 131 +++++++++++++++++++++++++------------------- 1 file changed, 74 insertions(+), 57 deletions(-) diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c index a0919955a00b..ed372103b2f2 100644 --- a/kernel/kexec_file.c +++ b/kernel/kexec_file.c @@ -834,6 +834,60 @@ static int kexec_calculate_store_digests(struct kimage *image) } #ifdef CONFIG_ARCH_HAS_KEXEC_PURGATORY +/* + * kexec_purgatory_find_symbol - find a symbol in the purgatory + * @pi: Purgatory to search in. + * @name: Name of the symbol. + * + * Return: pointer to symbol in read-only symtab on success, NULL on error. + */ +static const Elf_Sym *kexec_purgatory_find_symbol(struct purgatory_info *pi, + const char *name) +{ + const Elf_Shdr *sechdrs; + const Elf_Ehdr *ehdr; + const Elf_Sym *syms; + const char *strtab; + int i, k; + + if (!pi->ehdr) + return NULL; + + ehdr = pi->ehdr; + sechdrs = (void *)ehdr + ehdr->e_shoff; + + for (i = 0; i < ehdr->e_shnum; i++) { + if (sechdrs[i].sh_type != SHT_SYMTAB) + continue; + + if (sechdrs[i].sh_link >= ehdr->e_shnum) + /* Invalid strtab section number */ + continue; + strtab = (void *)ehdr + sechdrs[sechdrs[i].sh_link].sh_offset; + syms = (void *)ehdr + sechdrs[i].sh_offset; + + /* Go through symbols for a match */ + for (k = 0; k < sechdrs[i].sh_size/sizeof(Elf_Sym); k++) { + if (ELF_ST_BIND(syms[k].st_info) != STB_GLOBAL) + continue; + + if (strcmp(strtab + syms[k].st_name, name) != 0) + continue; + + if (syms[k].st_shndx == SHN_UNDEF || + syms[k].st_shndx >= ehdr->e_shnum) { + pr_debug("Symbol: %s has bad section index %d.\n", + name, syms[k].st_shndx); + return NULL; + } + + /* Found the symbol we are looking for */ + return &syms[k]; + } + } + + return NULL; +} /* * kexec_purgatory_setup_kbuf - prepare buffer to load purgatory. * @pi: Purgatory to be loaded. @@ -911,6 +965,10 @@ static int kexec_purgatory_setup_sechdrs(struct purgatory_info *pi, unsigned long bss_addr; unsigned long offset; Elf_Shdr *sechdrs; + const Elf_Sym *entry_sym; + u16 entry_shndx = 0; + unsigned long entry_off = 0; + bool start_fixed = false; int i; /* @@ -928,6 +986,12 @@ static int kexec_purgatory_setup_sechdrs(struct purgatory_info *pi, bss_addr = kbuf->mem + kbuf->bufsz; kbuf->image->start = pi->ehdr->e_entry; + entry_sym = kexec_purgatory_find_symbol(pi, "purgatory_start"); + if (entry_sym) { + entry_shndx = entry_sym->st_shndx; + entry_off = entry_sym->st_value; + } + for (i = 0; i < pi->ehdr->e_shnum; i++) { unsigned long align; void *src, *dst; @@ -945,6 +1009,13 @@ static int kexec_purgatory_setup_sechdrs(struct purgatory_info *pi, offset = ALIGN(offset, align); + if (!start_fixed && entry_sym && i == entry_shndx && + (sechdrs[i].sh_flags & SHF_EXECINSTR) && + entry_off < sechdrs[i].sh_size) { + kbuf->image->start = kbuf->mem + offset + entry_off; + start_fixed = true; + } + /* * Check if the segment contains the entry point, if so, * calculate the value of image->start based on it. @@ -955,13 +1026,14 @@ static int kexec_purgatory_setup_sechdrs(struct purgatory_info *pi, * is not set to the initial value, and warn the user so they * have a chance to fix their purgatory's linker script. */ - if (sechdrs[i].sh_flags & SHF_EXECINSTR && + if (!start_fixed && sechdrs[i].sh_flags & SHF_EXECINSTR && pi->ehdr->e_entry >= sechdrs[i].sh_addr && pi->ehdr->e_entry < (sechdrs[i].sh_addr + sechdrs[i].sh_size) && - !WARN_ON(kbuf->image->start != pi->ehdr->e_entry)) { + kbuf->image->start == pi->ehdr->e_entry) { kbuf->image->start -= sechdrs[i].sh_addr; kbuf->image->start += kbuf->mem + offset; + start_fixed = true; } src = (void *)pi->ehdr + sechdrs[i].sh_offset; @@ -1079,61 +1151,6 @@ int kexec_load_purgatory(struct kimage *image, struct kexec_buf *kbuf) return ret; } -/* - * kexec_purgatory_find_symbol - find a symbol in the purgatory - * @pi: Purgatory to search in. - * @name: Name of the symbol. - * - * Return: pointer to symbol in read-only symtab on success, NULL on error. - */ -static const Elf_Sym *kexec_purgatory_find_symbol(struct purgatory_info *pi, - const char *name) -{ - const Elf_Shdr *sechdrs; - const Elf_Ehdr *ehdr; - const Elf_Sym *syms; - const char *strtab; - int i, k; - - if (!pi->ehdr) - return NULL; - - ehdr = pi->ehdr; - sechdrs = (void *)ehdr + ehdr->e_shoff; - - for (i = 0; i < ehdr->e_shnum; i++) { - if (sechdrs[i].sh_type != SHT_SYMTAB) - continue; - - if (sechdrs[i].sh_link >= ehdr->e_shnum) - /* Invalid strtab section number */ - continue; - strtab = (void *)ehdr + sechdrs[sechdrs[i].sh_link].sh_offset; - syms = (void *)ehdr + sechdrs[i].sh_offset; - - /* Go through symbols for a match */ - for (k = 0; k < sechdrs[i].sh_size/sizeof(Elf_Sym); k++) { - if (ELF_ST_BIND(syms[k].st_info) != STB_GLOBAL) - continue; - - if (strcmp(strtab + syms[k].st_name, name) != 0) - continue; - - if (syms[k].st_shndx == SHN_UNDEF || - syms[k].st_shndx >= ehdr->e_shnum) { - pr_debug("Symbol: %s has bad section index %d.\n", - name, syms[k].st_shndx); - return NULL; - } - - /* Found the symbol we are looking for */ - return &syms[k]; - } - } - - return NULL; -} - void *kexec_purgatory_get_symbol_addr(struct kimage *image, const char *name) { struct purgatory_info *pi = &image->purgatory_info; -- 2.34.1

2 1

[PATCH OLK-6.6] kexec: derive purgatory entry from symbol
by Tengda Wu 06 Mar '26

06 Mar '26

From: Li Chen <me(a)linux.beauty> stable inclusion from stable-v6.6.129 commit cfccd3b8c51bc57a8a6fcb2fd30453afae5bc0d2 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8682 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 480e1d5c64bb14441f79f2eb9421d5e26f91ea3d ] kexec_load_purgatory() derives image->start by locating e_entry inside an SHF_EXECINSTR section. If the purgatory object contains multiple executable sections with overlapping sh_addr, the entrypoint check can match more than once and trigger a WARN. Derive the entry section from the purgatory_start symbol when present and compute image->start from its final placement. Keep the existing e_entry fallback for purgatories that do not expose the symbol. WARNING: kernel/kexec_file.c:1009 at kexec_load_purgatory+0x395/0x3c0, CPU#10: kexec/1784 Call Trace: <TASK> bzImage64_load+0x133/0xa00 __do_sys_kexec_file_load+0x2b3/0x5c0 do_syscall_64+0x81/0x610 entry_SYSCALL_64_after_hwframe+0x76/0x7e [me(a)linux.beauty: move helper to avoid forward declaration, per Baoquan] Link: https://lkml.kernel.org/r/20260128043511.316860-1-me@linux.beauty Link: https://lkml.kernel.org/r/20260120124005.148381-1-me@linux.beauty Fixes: 8652d44f466a ("kexec: support purgatories with .text.hot sections") Signed-off-by: Li Chen <me(a)linux.beauty> Acked-by: Baoquan He <bhe(a)redhat.com> Cc: Alexander Graf <graf(a)amazon.com> Cc: Eric Biggers <ebiggers(a)kernel.org> Cc: Li Chen <me(a)linux.beauty> Cc: Philipp Rudo <prudo(a)redhat.com> Cc: Ricardo Ribalda Delgado <ribalda(a)chromium.org> Cc: Ross Zwisler <zwisler(a)google.com> Cc: Sourabh Jain <sourabhjain(a)linux.ibm.com> Cc: Steven Rostedt <rostedt(a)goodmis.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/kexec_file.c | 131 +++++++++++++++++++++++++------------------- 1 file changed, 74 insertions(+), 57 deletions(-) diff --git a/kernel/kexec_file.c b/kernel/kexec_file.c index 830344627e9f..92a169f0b2b5 100644 --- a/kernel/kexec_file.c +++ b/kernel/kexec_file.c @@ -797,6 +797,60 @@ static int kexec_calculate_store_digests(struct kimage *image) } #ifdef CONFIG_ARCH_SUPPORTS_KEXEC_PURGATORY +/* + * kexec_purgatory_find_symbol - find a symbol in the purgatory + * @pi: Purgatory to search in. + * @name: Name of the symbol. + * + * Return: pointer to symbol in read-only symtab on success, NULL on error. + */ +static const Elf_Sym *kexec_purgatory_find_symbol(struct purgatory_info *pi, + const char *name) +{ + const Elf_Shdr *sechdrs; + const Elf_Ehdr *ehdr; + const Elf_Sym *syms; + const char *strtab; + int i, k; + + if (!pi->ehdr) + return NULL; + + ehdr = pi->ehdr; + sechdrs = (void *)ehdr + ehdr->e_shoff; + + for (i = 0; i < ehdr->e_shnum; i++) { + if (sechdrs[i].sh_type != SHT_SYMTAB) + continue; + + if (sechdrs[i].sh_link >= ehdr->e_shnum) + /* Invalid strtab section number */ + continue; + strtab = (void *)ehdr + sechdrs[sechdrs[i].sh_link].sh_offset; + syms = (void *)ehdr + sechdrs[i].sh_offset; + + /* Go through symbols for a match */ + for (k = 0; k < sechdrs[i].sh_size/sizeof(Elf_Sym); k++) { + if (ELF_ST_BIND(syms[k].st_info) != STB_GLOBAL) + continue; + + if (strcmp(strtab + syms[k].st_name, name) != 0) + continue; + + if (syms[k].st_shndx == SHN_UNDEF || + syms[k].st_shndx >= ehdr->e_shnum) { + pr_debug("Symbol: %s has bad section index %d.\n", + name, syms[k].st_shndx); + return NULL; + } + + /* Found the symbol we are looking for */ + return &syms[k]; + } + } + + return NULL; +} /* * kexec_purgatory_setup_kbuf - prepare buffer to load purgatory. * @pi: Purgatory to be loaded. @@ -875,6 +929,10 @@ static int kexec_purgatory_setup_sechdrs(struct purgatory_info *pi, unsigned long offset; size_t sechdrs_size; Elf_Shdr *sechdrs; + const Elf_Sym *entry_sym; + u16 entry_shndx = 0; + unsigned long entry_off = 0; + bool start_fixed = false; int i; /* @@ -892,6 +950,12 @@ static int kexec_purgatory_setup_sechdrs(struct purgatory_info *pi, bss_addr = kbuf->mem + kbuf->bufsz; kbuf->image->start = pi->ehdr->e_entry; + entry_sym = kexec_purgatory_find_symbol(pi, "purgatory_start"); + if (entry_sym) { + entry_shndx = entry_sym->st_shndx; + entry_off = entry_sym->st_value; + } + for (i = 0; i < pi->ehdr->e_shnum; i++) { unsigned long align; void *src, *dst; @@ -909,6 +973,13 @@ static int kexec_purgatory_setup_sechdrs(struct purgatory_info *pi, offset = ALIGN(offset, align); + if (!start_fixed && entry_sym && i == entry_shndx && + (sechdrs[i].sh_flags & SHF_EXECINSTR) && + entry_off < sechdrs[i].sh_size) { + kbuf->image->start = kbuf->mem + offset + entry_off; + start_fixed = true; + } + /* * Check if the segment contains the entry point, if so, * calculate the value of image->start based on it. @@ -919,13 +990,14 @@ static int kexec_purgatory_setup_sechdrs(struct purgatory_info *pi, * is not set to the initial value, and warn the user so they * have a chance to fix their purgatory's linker script. */ - if (sechdrs[i].sh_flags & SHF_EXECINSTR && + if (!start_fixed && sechdrs[i].sh_flags & SHF_EXECINSTR && pi->ehdr->e_entry >= sechdrs[i].sh_addr && pi->ehdr->e_entry < (sechdrs[i].sh_addr + sechdrs[i].sh_size) && - !WARN_ON(kbuf->image->start != pi->ehdr->e_entry)) { + kbuf->image->start == pi->ehdr->e_entry) { kbuf->image->start -= sechdrs[i].sh_addr; kbuf->image->start += kbuf->mem + offset; + start_fixed = true; } src = (void *)pi->ehdr + sechdrs[i].sh_offset; @@ -1043,61 +1115,6 @@ int kexec_load_purgatory(struct kimage *image, struct kexec_buf *kbuf) return ret; } -/* - * kexec_purgatory_find_symbol - find a symbol in the purgatory - * @pi: Purgatory to search in. - * @name: Name of the symbol. - * - * Return: pointer to symbol in read-only symtab on success, NULL on error. - */ -static const Elf_Sym *kexec_purgatory_find_symbol(struct purgatory_info *pi, - const char *name) -{ - const Elf_Shdr *sechdrs; - const Elf_Ehdr *ehdr; - const Elf_Sym *syms; - const char *strtab; - int i, k; - - if (!pi->ehdr) - return NULL; - - ehdr = pi->ehdr; - sechdrs = (void *)ehdr + ehdr->e_shoff; - - for (i = 0; i < ehdr->e_shnum; i++) { - if (sechdrs[i].sh_type != SHT_SYMTAB) - continue; - - if (sechdrs[i].sh_link >= ehdr->e_shnum) - /* Invalid strtab section number */ - continue; - strtab = (void *)ehdr + sechdrs[sechdrs[i].sh_link].sh_offset; - syms = (void *)ehdr + sechdrs[i].sh_offset; - - /* Go through symbols for a match */ - for (k = 0; k < sechdrs[i].sh_size/sizeof(Elf_Sym); k++) { - if (ELF_ST_BIND(syms[k].st_info) != STB_GLOBAL) - continue; - - if (strcmp(strtab + syms[k].st_name, name) != 0) - continue; - - if (syms[k].st_shndx == SHN_UNDEF || - syms[k].st_shndx >= ehdr->e_shnum) { - pr_debug("Symbol: %s has bad section index %d.\n", - name, syms[k].st_shndx); - return NULL; - } - - /* Found the symbol we are looking for */ - return &syms[k]; - } - } - - return NULL; -} - void *kexec_purgatory_get_symbol_addr(struct kimage *image, const char *name) { struct purgatory_info *pi = &image->purgatory_info; -- 2.34.1

2 1

[PATCH OLK-6.6] ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref
by Yongjian Sun 06 Mar '26

06 Mar '26

From: Yang Erkun <yangerkun(a)huawei.com> mainline inclusion from mainline-v6.19-rc6 commit d250bdf531d9cd4096fedbb9f172bb2ca660c868 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13696 CVE: CVE-2026-23145 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- The error branch for ext4_xattr_inode_update_ref forget to release the refcount for iloc.bh. Find this when review code. Fixes: 57295e835408 ("ext4: guard against EA inode refcount underflow in xattr update") Signed-off-by: Yang Erkun <yangerkun(a)huawei.com> Reviewed-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Link: https://patch.msgid.link/20251213055706.3417529-1-yangerkun@huawei.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Cc: stable(a)kernel.org Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/ext4/xattr.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c index cd906aa08afa..96810af688f5 100644 --- a/fs/ext4/xattr.c +++ b/fs/ext4/xattr.c @@ -1047,6 +1047,7 @@ static int ext4_xattr_inode_update_ref(handle_t *handle, struct inode *ea_inode, ext4_error_inode(ea_inode, __func__, __LINE__, 0, "EA inode %lu ref wraparound: ref_count=%lld ref_change=%d", ea_inode->i_ino, ref_count, ref_change); + brelse(iloc.bh); ret = -EFSCORRUPTED; goto out; } -- 2.39.2

2 1

[PATCH OLK-6.6] bus: fsl-mc: fix use-after-free in driver_override_show()
by Lin Ruifeng 06 Mar '26

06 Mar '26

From: Gui-Dong Han <hanguidong02(a)gmail.com> stable inclusion from stable-v6.18.11 commit 1d6bd6183e723a7b256ff34bbb5b498b5f4f2ec0 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13796 CVE: CVE-2026-23221 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 148891e95014b5dc5878acefa57f1940c281c431 upstream. The driver_override_show() function reads the driver_override string without holding the device_lock. However, driver_override_store() uses driver_set_override(), which modifies and frees the string while holding the device_lock. This can result in a concurrent use-after-free if the string is freed by the store function while being read by the show function. Fix this by holding the device_lock around the read operation. Fixes: 1f86a00c1159 ("bus/fsl-mc: add support for 'driver_override' in the mc-bus") Cc: stable(a)vger.kernel.org Signed-off-by: Gui-Dong Han <hanguidong02(a)gmail.com> Reviewed-by: Ioana Ciornei <ioana.ciornei(a)nxp.com> Link: https://lore.kernel.org/r/20251202174438.12658-1-hanguidong02@gmail.com Signed-off-by: Christophe Leroy (CS GROUP) <chleroy(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/bus/fsl-mc/fsl-mc-bus.c [Context Conflicts] Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/bus/fsl-mc/fsl-mc-bus.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/bus/fsl-mc/fsl-mc-bus.c b/drivers/bus/fsl-mc/fsl-mc-bus.c index 350e7b24ee2b..4291b286ec90 100644 --- a/drivers/bus/fsl-mc/fsl-mc-bus.c +++ b/drivers/bus/fsl-mc/fsl-mc-bus.c @@ -201,8 +201,12 @@ static ssize_t driver_override_show(struct device *dev, struct device_attribute *attr, char *buf) { struct fsl_mc_device *mc_dev = to_fsl_mc_device(dev); + ssize_t len; - return snprintf(buf, PAGE_SIZE, "%s\n", mc_dev->driver_override); + device_lock(dev); + len = snprintf(buf, PAGE_SIZE, "%s\n", mc_dev->driver_override); + device_unlock(dev); + return len; } static DEVICE_ATTR_RW(driver_override); -- 2.43.0

2 1

[PATCH OLK-6.6] ALSA: aloop: Fix racy access at PCM trigger
by Lin Ruifeng 06 Mar '26

06 Mar '26

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v6.12.70 commit bad15420050db1803767e58756114800cce91ea4 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13748 CVE: CVE-2026-23191 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 826af7fa62e347464b1b4e0ba2fe19a92438084f upstream. The PCM trigger callback of aloop driver tries to check the PCM state and stop the stream of the tied substream in the corresponding cable. Since both check and stop operations are performed outside the cable lock, this may result in UAF when a program attempts to trigger frequently while opening/closing the tied stream, as spotted by fuzzers. For addressing the UAF, this patch changes two things: - It covers the most of code in loopback_check_format() with cable->lock spinlock, and add the proper NULL checks. This avoids already some racy accesses. - In addition, now we try to check the state of the capture PCM stream that may be stopped in this function, which was the major pain point leading to UAF. Reported-by: syzbot+5f8f3acdee1ec7a7ef7b(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/69783ba1.050a0220.c9109.0011.GAE@google.com Cc: <stable(a)vger.kernel.org> Link: https://patch.msgid.link/20260203141003.116584-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: sound/drivers/aloop.c [Context Conflicts] Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- sound/drivers/aloop.c | 58 +++++++++++++++++++++++++------------------ 1 file changed, 34 insertions(+), 24 deletions(-) diff --git a/sound/drivers/aloop.c b/sound/drivers/aloop.c index a38e602b4fc6..8a8f416567e4 100644 --- a/sound/drivers/aloop.c +++ b/sound/drivers/aloop.c @@ -319,35 +319,41 @@ static int loopback_snd_timer_close_cable(struct loopback_pcm *dpcm) static int loopback_check_format(struct loopback_cable *cable, int stream) { + struct loopback_pcm *dpcm_play, *dpcm_capt; struct snd_pcm_runtime *runtime, *cruntime; struct loopback_setup *setup; struct snd_card *card; + bool stop_capture = false; int check; - if (cable->valid != CABLE_VALID_BOTH) { - if (stream == SNDRV_PCM_STREAM_PLAYBACK) - goto __notify; - return 0; - } - runtime = cable->streams[SNDRV_PCM_STREAM_PLAYBACK]-> - substream->runtime; - cruntime = cable->streams[SNDRV_PCM_STREAM_CAPTURE]-> - substream->runtime; - check = runtime->format != cruntime->format || - runtime->rate != cruntime->rate || - runtime->channels != cruntime->channels; - if (!check) - return 0; - if (stream == SNDRV_PCM_STREAM_CAPTURE) { - return -EIO; - } else { - snd_pcm_stop(cable->streams[SNDRV_PCM_STREAM_CAPTURE]-> - substream, SNDRV_PCM_STATE_DRAINING); - __notify: - runtime = cable->streams[SNDRV_PCM_STREAM_PLAYBACK]-> - substream->runtime; - setup = get_setup(cable->streams[SNDRV_PCM_STREAM_PLAYBACK]); - card = cable->streams[SNDRV_PCM_STREAM_PLAYBACK]->loopback->card; + scoped_guard(spinlock_irqsave, &cable->lock) { + dpcm_play = cable->streams[SNDRV_PCM_STREAM_PLAYBACK]; + dpcm_capt = cable->streams[SNDRV_PCM_STREAM_CAPTURE]; + + if (cable->valid != CABLE_VALID_BOTH) { + if (stream == SNDRV_PCM_STREAM_CAPTURE || !dpcm_play) + return 0; + } else { + if (!dpcm_play || !dpcm_capt) + return -EIO; + runtime = dpcm_play->substream->runtime; + cruntime = dpcm_capt->substream->runtime; + if (!runtime || !cruntime) + return -EIO; + check = runtime->format != cruntime->format || + runtime->rate != cruntime->rate || + runtime->channels != cruntime->channels; + if (!check) + return 0; + if (stream == SNDRV_PCM_STREAM_CAPTURE) + return -EIO; + else if (cruntime->state == SNDRV_PCM_STATE_RUNNING) + stop_capture = true; + } + + setup = get_setup(dpcm_play); + card = dpcm_play->loopback->card; + runtime = dpcm_play->substream->runtime; if (setup->format != runtime->format) { snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE, &setup->format_id); @@ -364,6 +370,10 @@ static int loopback_check_format(struct loopback_cable *cable, int stream) setup->channels = runtime->channels; } } + + if (stop_capture) + snd_pcm_stop(dpcm_capt->substream, SNDRV_PCM_STATE_DRAINING); + return 0; } -- 2.43.0

2 1

[PATCH OLK-6.6 0/3] *** fix CVE-2026-23208 ***
by Lin Ruifeng 06 Mar '26

06 Mar '26

*** fix CVE-2026-23208 *** Breno Leitao (2): spi: tegra210-quad: Move curr_xfer read inside spinlock spi: tegra210-quad: Protect curr_xfer check in IRQ handler Vishwaroop A (1): spi: tegra210-quad: Fix timeout handling drivers/spi/spi-tegra210-quad.c | 49 ++++++++++++++++++++++++++++++--- 1 file changed, 45 insertions(+), 4 deletions(-) -- 2.43.0

2 4

[PATCH OLK-6.6 0/2] *** fix CVE-2026-23208 ***
by Lin Ruifeng 06 Mar '26

06 Mar '26

*** fix CVE-2026-23208 *** Edward Adam Davis (1): ALSA: usb-audio: Prevent excessive number of frames Takashi Iwai (1): ALSA: usb-audio: Use the right limit for PCM OOB check sound/usb/pcm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) -- 2.43.0

2 3

[PATCH OLK-6.6] of: unittest: Fix memory leak in unittest_data_add()
by Lin Ruifeng 06 Mar '26

06 Mar '26

From: Zilin Guan <zilin(a)seu.edu.cn> stable inclusion from stable-v6.18.6 commit f09b0f705bd7197863b90256ef533a6414d1db2c category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13687 CVE: CVE-2026-23137 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 235a1eb8d2dcc49a6cf0a5ee1aa85544a5d0054b ] In unittest_data_add(), if of_resolve_phandles() fails, the allocated unittest_data is not freed, leading to a memory leak. Fix this by using scope-based cleanup helper __free(kfree) for automatic resource cleanup. This ensures unittest_data is automatically freed when it goes out of scope in error paths. For the success path, use retain_and_null_ptr() to transfer ownership of the memory to the device tree and prevent double freeing. Fixes: 2eb46da2a760 ("of/selftest: Use the resolver to fixup phandles") Suggested-by: Rob Herring <robh(a)kernel.org> Co-developed-by: Jianhao Xu <jianhao.xu(a)seu.edu.cn> Signed-off-by: Jianhao Xu <jianhao.xu(a)seu.edu.cn> Signed-off-by: Zilin Guan <zilin(a)seu.edu.cn> Link: https://patch.msgid.link/20251231114915.234638-1-zilin@seu.edu.cn Signed-off-by: Rob Herring (Arm) <robh(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/of/unittest.c [092d00ead733 ("cleanup: Provide retain_and_null_ptr()") was not merged] Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/of/unittest.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c index 5bfec440b4fd..4824dd78e0fd 100644 --- a/drivers/of/unittest.c +++ b/drivers/of/unittest.c @@ -1680,6 +1680,7 @@ static int __init unittest_data_add(void) rc = of_resolve_phandles(unittest_data_node); if (rc) { pr_err("%s: Failed to resolve phandles (rc=%i)\n", __func__, rc); + kfree(unittest_data); of_overlay_mutex_unlock(); return -EINVAL; } -- 2.43.0

2 1

[PATCH OLK-6.6] scsi: qla2xxx: Fix bsg_done() causing double free
by Long Li 06 Mar '26

06 Mar '26

From: Anil Gurumurthy <agurumurthy(a)marvell.com> stable inclusion from stable-v6.6.126 commit 74e7458537cd9349cf019862e51491f670871707 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13846 CVE: CVE-2025-71238 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit c2c68225b1456f4d0d393b5a8778d51bb0d5b1d0 upstream. Kernel panic observed on system, [5353358.825191] BUG: unable to handle page fault for address: ff5f5e897b024000 [5353358.825194] #PF: supervisor write access in kernel mode [5353358.825195] #PF: error_code(0x0002) - not-present page [5353358.825196] PGD 100006067 P4D 0 [5353358.825198] Oops: 0002 [#1] PREEMPT SMP NOPTI [5353358.825200] CPU: 5 PID: 2132085 Comm: qlafwupdate.sub Kdump: loaded Tainted: G W L ------- --- 5.14.0-503.34.1.el9_5.x86_64 #1 [5353358.825203] Hardware name: HPE ProLiant DL360 Gen11/ProLiant DL360 Gen11, BIOS 2.44 01/17/2025 [5353358.825204] RIP: 0010:memcpy_erms+0x6/0x10 [5353358.825211] RSP: 0018:ff591da8f4f6b710 EFLAGS: 00010246 [5353358.825212] RAX: ff5f5e897b024000 RBX: 0000000000007090 RCX: 0000000000001000 [5353358.825213] RDX: 0000000000001000 RSI: ff591da8f4fed090 RDI: ff5f5e897b024000 [5353358.825214] RBP: 0000000000010000 R08: ff5f5e897b024000 R09: 0000000000000000 [5353358.825215] R10: ff46cf8c40517000 R11: 0000000000000001 R12: 0000000000008090 [5353358.825216] R13: ff591da8f4f6b720 R14: 0000000000001000 R15: 0000000000000000 [5353358.825218] FS: 00007f1e88d47740(0000) GS:ff46cf935f940000(0000) knlGS:0000000000000000 [5353358.825219] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [5353358.825220] CR2: ff5f5e897b024000 CR3: 0000000231532004 CR4: 0000000000771ef0 [5353358.825221] PKRU: 55555554 [5353358.825222] Call Trace: [5353358.825223] <TASK> [5353358.825224] ? show_trace_log_lvl+0x1c4/0x2df [5353358.825229] ? show_trace_log_lvl+0x1c4/0x2df [5353358.825232] ? sg_copy_buffer+0xc8/0x110 [5353358.825236] ? __die_body.cold+0x8/0xd [5353358.825238] ? page_fault_oops+0x134/0x170 [5353358.825242] ? kernelmode_fixup_or_oops+0x84/0x110 [5353358.825244] ? exc_page_fault+0xa8/0x150 [5353358.825247] ? asm_exc_page_fault+0x22/0x30 [5353358.825252] ? memcpy_erms+0x6/0x10 [5353358.825253] sg_copy_buffer+0xc8/0x110 [5353358.825259] qla2x00_process_vendor_specific+0x652/0x1320 [qla2xxx] [5353358.825317] qla24xx_bsg_request+0x1b2/0x2d0 [qla2xxx] Most routines in qla_bsg.c call bsg_done() only for success cases. However a few invoke it for failure case as well leading to a double free. Validate before calling bsg_done(). Cc: stable(a)vger.kernel.org Signed-off-by: Anil Gurumurthy <agurumurthy(a)marvell.com> Signed-off-by: Nilesh Javali <njavali(a)marvell.com> Reviewed-by: Himanshu Madhani <hmadhani2024(a)gmail.com> Link: https://patch.msgid.link/20251210101604.431868-12-njavali@marvell.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- drivers/scsi/qla2xxx/qla_bsg.c | 28 +++++++++++++++++----------- 1 file changed, 17 insertions(+), 11 deletions(-) diff --git a/drivers/scsi/qla2xxx/qla_bsg.c b/drivers/scsi/qla2xxx/qla_bsg.c index 10431a67d202..f43969ed87bf 100644 --- a/drivers/scsi/qla2xxx/qla_bsg.c +++ b/drivers/scsi/qla2xxx/qla_bsg.c @@ -1546,8 +1546,9 @@ qla2x00_update_optrom(struct bsg_job *bsg_job) ha->optrom_buffer = NULL; ha->optrom_state = QLA_SWAITING; mutex_unlock(&ha->optrom_mutex); - bsg_job_done(bsg_job, bsg_reply->result, - bsg_reply->reply_payload_rcv_len); + if (!rval) + bsg_job_done(bsg_job, bsg_reply->result, + bsg_reply->reply_payload_rcv_len); return rval; } @@ -2612,8 +2613,9 @@ qla2x00_manage_host_stats(struct bsg_job *bsg_job) sizeof(struct ql_vnd_mng_host_stats_resp)); bsg_reply->result = DID_OK; - bsg_job_done(bsg_job, bsg_reply->result, - bsg_reply->reply_payload_rcv_len); + if (!ret) + bsg_job_done(bsg_job, bsg_reply->result, + bsg_reply->reply_payload_rcv_len); return ret; } @@ -2702,8 +2704,9 @@ qla2x00_get_host_stats(struct bsg_job *bsg_job) bsg_job->reply_payload.sg_cnt, data, response_len); bsg_reply->result = DID_OK; - bsg_job_done(bsg_job, bsg_reply->result, - bsg_reply->reply_payload_rcv_len); + if (!ret) + bsg_job_done(bsg_job, bsg_reply->result, + bsg_reply->reply_payload_rcv_len); kfree(data); host_stat_out: @@ -2802,8 +2805,9 @@ qla2x00_get_tgt_stats(struct bsg_job *bsg_job) bsg_job->reply_payload.sg_cnt, data, response_len); bsg_reply->result = DID_OK; - bsg_job_done(bsg_job, bsg_reply->result, - bsg_reply->reply_payload_rcv_len); + if (!ret) + bsg_job_done(bsg_job, bsg_reply->result, + bsg_reply->reply_payload_rcv_len); tgt_stat_out: kfree(data); @@ -2864,8 +2868,9 @@ qla2x00_manage_host_port(struct bsg_job *bsg_job) bsg_job->reply_payload.sg_cnt, &rsp_data, sizeof(struct ql_vnd_mng_host_port_resp)); bsg_reply->result = DID_OK; - bsg_job_done(bsg_job, bsg_reply->result, - bsg_reply->reply_payload_rcv_len); + if (!ret) + bsg_job_done(bsg_job, bsg_reply->result, + bsg_reply->reply_payload_rcv_len); return ret; } @@ -3240,7 +3245,8 @@ int qla2x00_mailbox_passthru(struct bsg_job *bsg_job) bsg_job->reply_len = sizeof(*bsg_job->reply); bsg_reply->result = DID_OK << 16; - bsg_job_done(bsg_job, bsg_reply->result, bsg_reply->reply_payload_rcv_len); + if (!ret) + bsg_job_done(bsg_job, bsg_reply->result, bsg_reply->reply_payload_rcv_len); kfree(req_data); -- 2.39.2

2 1

[PATCH v2 OLK-5.10 0/4] arm64/mpam: enable MPAM feature and
by Quanmin Yan 06 Mar '26

06 Mar '26

Enabling the MPAM feature and some bugfixes in OLK-5.10. Quanmin Yan (2): arm64/mpam: only allow L3 cache MPAM device created arm64/mpam: fix the bitmap written during mpam device reset Zeng Heng (2): arm64/mpam: set default feedback of last_cmd_status interface as null string arm64/mpam: fix inadvertently updating after repeatedly updating arch/arm64/kernel/mpam/mpam_ctrlmon.c | 2 +- arch/arm64/kernel/mpam/mpam_device.c | 10 +++++++--- arch/arm64/kernel/mpam/mpam_resctrl.c | 2 +- arch/x86/kernel/cpu/resctrl/rdtgroup.c | 2 +- drivers/acpi/arm64/mpam_v2.c | 8 ++++++++ 5 files changed, 18 insertions(+), 6 deletions(-) -- 2.43.0

2 5

[PATCH OLK-6.6] vsock/virtio: cap TX credit to local buffer size
by Ze Zuo 06 Mar '26

06 Mar '26

From: Melbin K Mathew <mlbnkm1(a)gmail.com> stable inclusion from stable-v6.6.122 commit d9d5f222558b42f6277eafaaa6080966faf37676 category: feature bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13619 CVE: CVE-2026-23086 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 8ee784fdf006cbe8739cfa093f54d326cbf54037 ] The virtio transports derives its TX credit directly from peer_buf_alloc, which is set from the remote endpoint's SO_VM_SOCKETS_BUFFER_SIZE value. On the host side this means that the amount of data we are willing to queue for a connection is scaled by a guest-chosen buffer size, rather than the host's own vsock configuration. A malicious guest can advertise a large buffer and read slowly, causing the host to allocate a correspondingly large amount of sk_buff memory. The same thing would happen in the guest with a malicious host, since virtio transports share the same code base. Introduce a small helper, virtio_transport_tx_buf_size(), that returns min(peer_buf_alloc, buf_alloc), and use it wherever we consume peer_buf_alloc. This ensures the effective TX window is bounded by both the peer's advertised buffer and our own buf_alloc (already clamped to buffer_max_size via SO_VM_SOCKETS_BUFFER_MAX_SIZE), so a remote peer cannot force the other to queue more data than allowed by its own vsock settings. On an unpatched Ubuntu 22.04 host (~64 GiB RAM), running a PoC with 32 guest vsock connections advertising 2 GiB each and reading slowly drove Slab/SUnreclaim from ~0.5 GiB to ~57 GiB; the system only recovered after killing the QEMU process. That said, if QEMU memory is limited with cgroups, the maximum memory used will be limited. With this patch applied: Before: MemFree: ~61.6 GiB Slab: ~142 MiB SUnreclaim: ~117 MiB After 32 high-credit connections: MemFree: ~61.5 GiB Slab: ~178 MiB SUnreclaim: ~152 MiB Only ~35 MiB increase in Slab/SUnreclaim, no host OOM, and the guest remains responsive. Compatibility with non-virtio transports: - VMCI uses the AF_VSOCK buffer knobs to size its queue pairs per socket based on the local vsk->buffer_* values; the remote side cannot enlarge those queues beyond what the local endpoint configured. - Hyper-V's vsock transport uses fixed-size VMBus ring buffers and an MTU bound; there is no peer-controlled credit field comparable to peer_buf_alloc, and the remote endpoint cannot drive in-flight kernel memory above those ring sizes. - The loopback path reuses virtio_transport_common.c, so it naturally follows the same semantics as the virtio transport. This change is limited to virtio_transport_common.c and thus affects virtio-vsock, vhost-vsock, and loopback, bringing them in line with the "remote window intersected with local policy" behaviour that VMCI and Hyper-V already effectively have. Fixes: 06a8fc78367d ("VSOCK: Introduce virtio_vsock_common.ko") Suggested-by: Stefano Garzarella <sgarzare(a)redhat.com> Signed-off-by: Melbin K Mathew <mlbnkm1(a)gmail.com> [Stefano: small adjustments after changing the previous patch] [Stefano: tweak the commit message] Signed-off-by: Stefano Garzarella <sgarzare(a)redhat.com> Reviewed-by: Luigi Leonardi <leonardi(a)redhat.com> Link: https://patch.msgid.link/20260121093628.9941-4-sgarzare@redhat.com Acked-by: Michael S. Tsirkin <mst(a)redhat.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: net/vmw_vsock/virtio_transport_common.c [Conflicts due to context.] Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- net/vmw_vsock/virtio_transport_common.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c index c57fe7ddcf73..3a755a32f403 100644 --- a/net/vmw_vsock/virtio_transport_common.c +++ b/net/vmw_vsock/virtio_transport_common.c @@ -629,6 +629,15 @@ virtio_transport_seqpacket_dequeue(struct vsock_sock *vsk, } EXPORT_SYMBOL_GPL(virtio_transport_seqpacket_dequeue); +static u32 virtio_transport_tx_buf_size(struct virtio_vsock_sock *vvs) +{ + /* The peer advertises its receive buffer via peer_buf_alloc, but we + * cap it to our local buf_alloc so a remote peer cannot force us to + * queue more data than our own buffer configuration allows. + */ + return min(vvs->peer_buf_alloc, vvs->buf_alloc); +} + int virtio_transport_seqpacket_enqueue(struct vsock_sock *vsk, struct msghdr *msg, @@ -638,7 +647,7 @@ virtio_transport_seqpacket_enqueue(struct vsock_sock *vsk, spin_lock_bh(&vvs->tx_lock); - if (len > vvs->peer_buf_alloc) { + if (len > virtio_transport_tx_buf_size(vvs)) { spin_unlock_bh(&vvs->tx_lock); return -EMSGSIZE; } @@ -689,7 +698,8 @@ static s64 virtio_transport_has_space(struct vsock_sock *vsk) struct virtio_vsock_sock *vvs = vsk->trans; s64 bytes; - bytes = (s64)vvs->peer_buf_alloc - (vvs->tx_cnt - vvs->peer_fwd_cnt); + bytes = (s64)virtio_transport_tx_buf_size(vvs) - + (vvs->tx_cnt - vvs->peer_fwd_cnt); if (bytes < 0) bytes = 0; -- 2.25.1

2 1

[PATCH OLK-6.6 0/4] Fixes CVE-2026-23100
by Ze Zuo 06 Mar '26

06 Mar '26

Fixes CVE-2026-23100. David Hildenbrand (Red Hat) (3): mm/hugetlb: fix hugetlb_pmd_shared() mm/hugetlb: fix two comments related to huge_pmd_unshare() mm/rmap: fix two comments related to huge_pmd_unshare() Jane Chu (1): mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count include/linux/hugetlb.h | 2 +- include/linux/mm_types.h | 5 +++++ mm/hugetlb.c | 39 +++++++++++++-------------------------- mm/rmap.c | 20 ++++---------------- 4 files changed, 23 insertions(+), 43 deletions(-) -- 2.25.1

2 5

[PATCH v4 OLK-6.6 00/20] Support multi-level cgroup
by Liu Kai 06 Mar '26

06 Mar '26

Support multi-level cgroup Liu Kai (20): xsched: add has_running hook to xsched classes for wake-up eligibility check xsched/cfs: move xruntime updates to pick/put paths xsched/cfs: propagate group activation/deactivation up the hierarchy xsched: delete unused code xsched: update group shares using xcu_grp_shares_add/sub helpers xsched: remove redundant xcu parameter from dequeue_ctx xsched/quota: support multi-level cgroup xsched/quota: add throttled flag to cfs_rq for robust hierarchical enqueue under throttling xsched: move throttling-related fields from xsched_group_xcu_priv to xsched_rq_cfs xsched: harden and clarify xcu_move_task() logic xsched: change rq_init() parameter from struct xsched_cu to struct xsched_rq xsched: refactor xsched_entity initialization xsched: modify xcu_cg_initialize_components helper xsched: add init_fair_xsched_group() for XCU-specific fair group initialization xsched/core: immediate cleanup of remaining operators on task exit xsched: replace magic number with SCHED_CLASS_MAX_LENGTH for scheduler class string length xsched: simplify root group check by direct comparison with root_xcg xsched: restructure xcu_cgrp_subsys teardown to align with cpu_cgrp_subsys lifecycle xsched: remove the standalone xcu_cfs_cg_deinit() helper xsched: fix potential NULL dereference in xsched_quota_timeout_update drivers/xcu/xcu_group.c | 2 +- include/linux/xsched.h | 92 +++++++++------- kernel/xsched/cfs.c | 208 ++++++++++++++++++----------------- kernel/xsched/cfs_quota.c | 79 +++++++++----- kernel/xsched/cgroup.c | 221 ++++++++++++++++++-------------------- kernel/xsched/core.c | 121 ++++++++++----------- kernel/xsched/rt.c | 44 ++++---- kernel/xsched/vstream.c | 25 +++-- 8 files changed, 413 insertions(+), 379 deletions(-) -- 2.34.1

2 21

[PATCH OLK-6.6] scsi: hisi_sas: Fix NULL pointer exception when do user_scan()
by Xingui Yang 05 Mar '26

05 Mar '26

mailist inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8659 Reference: https://lore.kernel.org/linux-scsi/20260305064039.4096775-1-liyihang9@huawe… -------------------------------- user_scan() invokes updated sas_user_scan() for channel 0, and if successful, iteratively scans remaining channels (1 to shost->max_channel) via scsi_scan_host_selected() in commit 37c4e72b0651 ("scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans"). However, hisi_sas supports only one channel, and the current value of max_channel is 1. sas_user_scan() for channel 1 will trigger the following NULL pointer exception: [ 441.554662] Unable to handle kernel NULL pointer dereference at virtual address 00000000000008b0 [ 441.554699] Mem abort info: [ 441.554710] ESR = 0x0000000096000004 [ 441.554718] EC = 0x25: DABT (current EL), IL = 32 bits [ 441.554723] SET = 0, FnV = 0 [ 441.554726] EA = 0, S1PTW = 0 [ 441.554730] FSC = 0x04: level 0 translation fault [ 441.554735] Data abort info: [ 441.554737] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 [ 441.554742] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 441.554747] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 441.554752] user pgtable: 4k pages, 48-bit VAs, pgdp=00000828377a6000 [ 441.554757] [00000000000008b0] pgd=0000000000000000, p4d=0000000000000000 [ 441.554769] Internal error: Oops: 0000000096000004 [#1] SMP [ 441.629589] Modules linked in: arm_spe_pmu arm_smmuv3_pmu tpm_tis_spi hisi_uncore_sllc_pmu hisi_uncore_pa_pmu hisi_uncore_l3c_pmu hisi_uncore_hha_pmu hisi_uncore_ddrc_pmu hisi_uncore_cpa_pmu hns3_pmu hisi_ptt hisi_pcie_pmu tpm_tis_core spidev spi_hisi_sfc_v3xx hisi_uncore_pmu spi_dw_mmio fuse hclge hclge_common hisi_sec2 hisi_hpre hisi_zip hisi_qm hns3 hisi_sas_v3_hw sm3_ce sbsa_gwdt hnae3 hisi_sas_main uacce hisi_dma i2c_hisi dm_mirror dm_region_hash dm_log dm_mod [ 441.670819] CPU: 46 UID: 0 PID: 6994 Comm: bash Kdump: loaded Not tainted 7.0.0-rc2+ #84 PREEMPT [ 441.691327] pstate: 81400009 (Nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) [ 441.698277] pc : sas_find_dev_by_rphy+0x44/0x118 [ 441.702896] lr : sas_find_dev_by_rphy+0x3c/0x118 [ 441.707502] sp : ffff80009abbba40 [ 441.710805] x29: ffff80009abbba40 x28: ffff082819a40008 x27: ffff082810c37c08 [ 441.717930] x26: ffff082810c37c28 x25: ffff082819a40290 x24: ffff082810c37c00 [ 441.725054] x23: 0000000000000000 x22: 0000000000000001 x21: ffff082819a40000 [ 441.732179] x20: ffff082819a40290 x19: 0000000000000000 x18: 0000000000000020 [ 441.739304] x17: 0000000000000000 x16: ffffb5dad6bda690 x15: 00000000ffffffff [ 441.746428] x14: ffff082814c3b26c x13: 00000000ffffffff x12: ffff082814c3b26a [ 441.753553] x11: 00000000000000c0 x10: 000000000000003a x9 : ffffb5dad5ea94f4 [ 441.760678] x8 : 000000000000003a x7 : ffff80009abbbab0 x6 : 0000000000000030 [ 441.767802] x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 [ 441.774926] x2 : ffff08280f35a300 x1 : ffffb5dad7127180 x0 : 0000000000000000 [ 441.782053] Call trace: [ 441.784488] sas_find_dev_by_rphy+0x44/0x118 (P) [ 441.789095] sas_target_alloc+0x24/0xb0 [ 441.792920] scsi_alloc_target+0x290/0x330 [ 441.797010] __scsi_scan_target+0x88/0x258 [ 441.801096] scsi_scan_channel+0x74/0xb8 [ 441.805008] scsi_scan_host_selected+0x170/0x188 [ 441.809615] sas_user_scan+0xfc/0x148 [ 441.813267] store_scan+0x10c/0x180 [ 441.816743] dev_attr_store+0x20/0x40 [ 441.820398] sysfs_kf_write+0x84/0xa8 [ 441.824054] kernfs_fop_write_iter+0x130/0x1c8 [ 441.828487] vfs_write+0x2c0/0x370 [ 441.831880] ksys_write+0x74/0x118 [ 441.835271] __arm64_sys_write+0x24/0x38 [ 441.839182] invoke_syscall+0x50/0x120 [ 441.842919] el0_svc_common.constprop.0+0xc8/0xf0 [ 441.847611] do_el0_svc+0x24/0x38 [ 441.850913] el0_svc+0x38/0x158 [ 441.854043] el0t_64_sync_handler+0xa0/0xe8 [ 441.858214] el0t_64_sync+0x1ac/0x1b0 [ 441.861865] Code: aa1303e0 97ff70a8 34ffff80 d10a4273 (f9445a75) [ 441.867946] ---[ end trace 0000000000000000 ]--- Therefore, set max_channel to 0. Fixes: e21fe3a52692 ("scsi: hisi_sas: add initialisation for v3 pci-based controller") Signed-off-by: Xingui Yang <yangxingui(a)huawei.com> Signed-off-by: Yihang Li <liyihang9(a)huawei.com> --- drivers/scsi/hisi_sas/hisi_sas_main.c | 2 +- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/hisi_sas/hisi_sas_main.c b/drivers/scsi/hisi_sas/hisi_sas_main.c index 00e4b59ff711..944ce19ae2fc 100644 --- a/drivers/scsi/hisi_sas/hisi_sas_main.c +++ b/drivers/scsi/hisi_sas/hisi_sas_main.c @@ -2578,7 +2578,7 @@ int hisi_sas_probe(struct platform_device *pdev, shost->transportt = hisi_sas_stt; shost->max_id = HISI_SAS_MAX_DEVICES; shost->max_lun = ~0; - shost->max_channel = 1; + shost->max_channel = 0; shost->max_cmd_len = HISI_SAS_MAX_CDB_LEN; if (hisi_hba->hw->slot_index_alloc) { shost->can_queue = HISI_SAS_MAX_COMMANDS; diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c index ba9d6877483a..fda07b193137 100644 --- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c @@ -4993,7 +4993,7 @@ hisi_sas_v3_probe(struct pci_dev *pdev, const struct pci_device_id *id) shost->transportt = hisi_sas_stt; shost->max_id = HISI_SAS_MAX_DEVICES; shost->max_lun = ~0; - shost->max_channel = 1; + shost->max_channel = 0; shost->max_cmd_len = HISI_SAS_MAX_CDB_LEN; shost->can_queue = HISI_SAS_UNRESERVED_IPTT; shost->cmd_per_lun = HISI_SAS_UNRESERVED_IPTT; -- 2.33.0

2 1

[PATCH OLK-6.6] scsi: hisi_sas: Fix NULL pointer exception when do user_scan()
by Xingui Yang 05 Mar '26

05 Mar '26

user_scan() invokes updated sas_user_scan() for channel 0, and if successful, iteratively scans remaining channels (1 to shost->max_channel) via scsi_scan_host_selected() in commit 37c4e72b0651 ("scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans"). However, hisi_sas supports only one channel, and the current value of max_channel is 1. sas_user_scan() for channel 1 will trigger the following NULL pointer exception: [ 441.554662] Unable to handle kernel NULL pointer dereference at virtual address 00000000000008b0 [ 441.554699] Mem abort info: [ 441.554710] ESR = 0x0000000096000004 [ 441.554718] EC = 0x25: DABT (current EL), IL = 32 bits [ 441.554723] SET = 0, FnV = 0 [ 441.554726] EA = 0, S1PTW = 0 [ 441.554730] FSC = 0x04: level 0 translation fault [ 441.554735] Data abort info: [ 441.554737] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 [ 441.554742] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 441.554747] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 441.554752] user pgtable: 4k pages, 48-bit VAs, pgdp=00000828377a6000 [ 441.554757] [00000000000008b0] pgd=0000000000000000, p4d=0000000000000000 [ 441.554769] Internal error: Oops: 0000000096000004 [#1] SMP [ 441.629589] Modules linked in: arm_spe_pmu arm_smmuv3_pmu tpm_tis_spi hisi_uncore_sllc_pmu hisi_uncore_pa_pmu hisi_uncore_l3c_pmu hisi_uncore_hha_pmu hisi_uncore_ddrc_pmu hisi_uncore_cpa_pmu hns3_pmu hisi_ptt hisi_pcie_pmu tpm_tis_core spidev spi_hisi_sfc_v3xx hisi_uncore_pmu spi_dw_mmio fuse hclge hclge_common hisi_sec2 hisi_hpre hisi_zip hisi_qm hns3 hisi_sas_v3_hw sm3_ce sbsa_gwdt hnae3 hisi_sas_main uacce hisi_dma i2c_hisi dm_mirror dm_region_hash dm_log dm_mod [ 441.670819] CPU: 46 UID: 0 PID: 6994 Comm: bash Kdump: loaded Not tainted 7.0.0-rc2+ #84 PREEMPT [ 441.691327] pstate: 81400009 (Nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) [ 441.698277] pc : sas_find_dev_by_rphy+0x44/0x118 [ 441.702896] lr : sas_find_dev_by_rphy+0x3c/0x118 [ 441.707502] sp : ffff80009abbba40 [ 441.710805] x29: ffff80009abbba40 x28: ffff082819a40008 x27: ffff082810c37c08 [ 441.717930] x26: ffff082810c37c28 x25: ffff082819a40290 x24: ffff082810c37c00 [ 441.725054] x23: 0000000000000000 x22: 0000000000000001 x21: ffff082819a40000 [ 441.732179] x20: ffff082819a40290 x19: 0000000000000000 x18: 0000000000000020 [ 441.739304] x17: 0000000000000000 x16: ffffb5dad6bda690 x15: 00000000ffffffff [ 441.746428] x14: ffff082814c3b26c x13: 00000000ffffffff x12: ffff082814c3b26a [ 441.753553] x11: 00000000000000c0 x10: 000000000000003a x9 : ffffb5dad5ea94f4 [ 441.760678] x8 : 000000000000003a x7 : ffff80009abbbab0 x6 : 0000000000000030 [ 441.767802] x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 [ 441.774926] x2 : ffff08280f35a300 x1 : ffffb5dad7127180 x0 : 0000000000000000 [ 441.782053] Call trace: [ 441.784488] sas_find_dev_by_rphy+0x44/0x118 (P) [ 441.789095] sas_target_alloc+0x24/0xb0 [ 441.792920] scsi_alloc_target+0x290/0x330 [ 441.797010] __scsi_scan_target+0x88/0x258 [ 441.801096] scsi_scan_channel+0x74/0xb8 [ 441.805008] scsi_scan_host_selected+0x170/0x188 [ 441.809615] sas_user_scan+0xfc/0x148 [ 441.813267] store_scan+0x10c/0x180 [ 441.816743] dev_attr_store+0x20/0x40 [ 441.820398] sysfs_kf_write+0x84/0xa8 [ 441.824054] kernfs_fop_write_iter+0x130/0x1c8 [ 441.828487] vfs_write+0x2c0/0x370 [ 441.831880] ksys_write+0x74/0x118 [ 441.835271] __arm64_sys_write+0x24/0x38 [ 441.839182] invoke_syscall+0x50/0x120 [ 441.842919] el0_svc_common.constprop.0+0xc8/0xf0 [ 441.847611] do_el0_svc+0x24/0x38 [ 441.850913] el0_svc+0x38/0x158 [ 441.854043] el0t_64_sync_handler+0xa0/0xe8 [ 441.858214] el0t_64_sync+0x1ac/0x1b0 [ 441.861865] Code: aa1303e0 97ff70a8 34ffff80 d10a4273 (f9445a75) [ 441.867946] ---[ end trace 0000000000000000 ]--- Therefore, set max_channel to 0. Fixes: e21fe3a52692 ("scsi: hisi_sas: add initialisation for v3 pci-based controller") Signed-off-by: Xingui Yang <yangxingui(a)huawei.com> Signed-off-by: Yihang Li <liyihang9(a)huawei.com> --- drivers/scsi/hisi_sas/hisi_sas_main.c | 2 +- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/hisi_sas/hisi_sas_main.c b/drivers/scsi/hisi_sas/hisi_sas_main.c index 00e4b59ff711..944ce19ae2fc 100644 --- a/drivers/scsi/hisi_sas/hisi_sas_main.c +++ b/drivers/scsi/hisi_sas/hisi_sas_main.c @@ -2578,7 +2578,7 @@ int hisi_sas_probe(struct platform_device *pdev, shost->transportt = hisi_sas_stt; shost->max_id = HISI_SAS_MAX_DEVICES; shost->max_lun = ~0; - shost->max_channel = 1; + shost->max_channel = 0; shost->max_cmd_len = HISI_SAS_MAX_CDB_LEN; if (hisi_hba->hw->slot_index_alloc) { shost->can_queue = HISI_SAS_MAX_COMMANDS; diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c index ba9d6877483a..fda07b193137 100644 --- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c @@ -4993,7 +4993,7 @@ hisi_sas_v3_probe(struct pci_dev *pdev, const struct pci_device_id *id) shost->transportt = hisi_sas_stt; shost->max_id = HISI_SAS_MAX_DEVICES; shost->max_lun = ~0; - shost->max_channel = 1; + shost->max_channel = 0; shost->max_cmd_len = HISI_SAS_MAX_CDB_LEN; shost->can_queue = HISI_SAS_UNRESERVED_IPTT; shost->cmd_per_lun = HISI_SAS_UNRESERVED_IPTT; -- 2.33.0

2 1

[PATCH v4 OLK-6.6 00/20] Support multi-level cgroup
by Liu Kai 05 Mar '26

05 Mar '26

Support multi-level cgroup Liu Kai (20): xsched: add has_running hook to xsched classes for wake-up eligibility check xsched/cfs: move xruntime updates to pick/put paths xsched/cfs: propagate group activation/deactivation up the hierarchy xsched: delete unused code xsched: update group shares using xcu_grp_shares_add/sub helpers xsched: remove redundant xcu parameter from dequeue_ctx xsched/quota: support multi-level cgroup xsched/quota: add throttled flag to cfs_rq for robust hierarchical enqueue under throttling xsched: move throttling-related fields from xsched_group_xcu_priv to xsched_rq_cfs xsched: harden and clarify xcu_move_task() logic xsched: change rq_init() parameter from struct xsched_cu to struct xsched_rq xsched: refactor xsched_entity initialization xsched: modify xcu_cg_initialize_components helper xsched: add init_fair_xsched_group() for XCU-specific fair group initialization xsched/core: immediate cleanup of remaining operators on task exit xsched: replace magic number with SCHED_CLASS_MAX_LENGTH for scheduler class string length xsched: simplify root group check by direct comparison with root_xcg xsched: restructure xcu_cgrp_subsys teardown to align with cpu_cgrp_subsys lifecycle xsched: remove the standalone xcu_cfs_cg_deinit() helper xsched: fix potential NULL dereference in xsched_quota_timeout_update drivers/xcu/xcu_group.c | 2 +- include/linux/xsched.h | 92 +++++++++------- kernel/xsched/cfs.c | 208 ++++++++++++++++++----------------- kernel/xsched/cfs_quota.c | 79 +++++++++----- kernel/xsched/cgroup.c | 223 ++++++++++++++++++-------------------- kernel/xsched/core.c | 121 ++++++++++----------- kernel/xsched/rt.c | 44 ++++---- kernel/xsched/vstream.c | 25 +++-- 8 files changed, 414 insertions(+), 380 deletions(-) -- 2.34.1

2 21