- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] usb: xhci: Prevent interrupt storm on host controller error (HCE)
by Jinjie Ruan 15 May '26

15 May '26

From: Dayu Jiang <jiangdayu(a)xiaomi.com> stable inclusion from stable-v6.6.130 commit b2dd9abf8c06cfcbcf242321fd54ae51a4807705 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15046 CVE: CVE-2026-43488 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit d6d5febd12452b7fd951fdd15c3ec262f01901a4 upstream. The xHCI controller reports a Host Controller Error (HCE) in UAS Storage Device plug/unplug scenarios on Android devices. HCE is checked in xhci_irq() function and causes an interrupt storm (since the interrupt isn’t cleared), leading to severe system-level faults. When the xHC controller reports HCE in the interrupt handler, the driver only logs a warning and assumes xHC activity will stop as stated in xHCI specification. An interrupt storm does however continue on some hosts even after HCE, and only ceases after manually disabling xHC interrupt and stopping the controller by calling xhci_halt(). Add xhci_halt() to xhci_irq() function where STS_HCE status is checked, mirroring the existing error handling pattern used for STS_FATAL errors. This only fixes the interrupt storm. Proper HCE recovery requires resetting and re-initializing the xHC. CC: stable(a)vger.kernel.org Signed-off-by: Dayu Jiang <jiangdayu(a)xiaomi.com> Signed-off-by: Mathias Nyman <mathias.nyman(a)linux.intel.com> Link: https://patch.msgid.link/20260304223639.3882398-3-mathias.nyman@linux.intel… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- drivers/usb/host/xhci-ring.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c index 24d045889c6e..e804aea23063 100644 --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -3221,6 +3221,7 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd) if (status & STS_HCE) { xhci_warn(xhci, "WARNING: Host Controller Error\n"); + xhci_halt(xhci); goto out; } -- 2.34.1

2 1

[PATCH OLK-5.10] usb: xhci: Prevent interrupt storm on host controller error (HCE)
by Jinjie Ruan 15 May '26

15 May '26

From: Dayu Jiang <jiangdayu(a)xiaomi.com> stable inclusion from stable-v6.6.130 commit b2dd9abf8c06cfcbcf242321fd54ae51a4807705 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15046 CVE: CVE-2026-43488 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit d6d5febd12452b7fd951fdd15c3ec262f01901a4 upstream. The xHCI controller reports a Host Controller Error (HCE) in UAS Storage Device plug/unplug scenarios on Android devices. HCE is checked in xhci_irq() function and causes an interrupt storm (since the interrupt isn’t cleared), leading to severe system-level faults. When the xHC controller reports HCE in the interrupt handler, the driver only logs a warning and assumes xHC activity will stop as stated in xHCI specification. An interrupt storm does however continue on some hosts even after HCE, and only ceases after manually disabling xHC interrupt and stopping the controller by calling xhci_halt(). Add xhci_halt() to xhci_irq() function where STS_HCE status is checked, mirroring the existing error handling pattern used for STS_FATAL errors. This only fixes the interrupt storm. Proper HCE recovery requires resetting and re-initializing the xHC. CC: stable(a)vger.kernel.org Signed-off-by: Dayu Jiang <jiangdayu(a)xiaomi.com> Signed-off-by: Mathias Nyman <mathias.nyman(a)linux.intel.com> Link: https://patch.msgid.link/20260304223639.3882398-3-mathias.nyman@linux.intel… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- drivers/usb/host/xhci-ring.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c index 747403de8cb2..4aca4b517005 100644 --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -3163,6 +3163,7 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd) if (status & STS_HCE) { xhci_warn(xhci, "WARNING: Host Controller Error\n"); + xhci_halt(xhci); goto out; } -- 2.34.1

2 1

[PATCH OLK-6.6] KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated
by Jinjie Ruan 15 May '26

15 May '26

From: Sean Christopherson <seanjc(a)google.com> stable inclusion from stable-v6.6.130 commit 816fa1dfae4532e851b1fe6b2434c753ecbd86c7 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15045 CVE: CVE-2026-43483 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 87d0f901a9bd8ae6be57249c737f20ac0cace93d ] Explicitly set/clear CR8 write interception when AVIC is (de)activated to fix a bug where KVM leaves the interception enabled after AVIC is activated. E.g. if KVM emulates INIT=>WFS while AVIC is deactivated, CR8 will remain intercepted in perpetuity. On its own, the dangling CR8 intercept is "just" a performance issue, but combined with the TPR sync bug fixed by commit d02e48830e3f ("KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active"), the danging intercept is fatal to Windows guests as the TPR seen by hardware gets wildly out of sync with reality. Note, VMX isn't affected by the bug as TPR_THRESHOLD is explicitly ignored when Virtual Interrupt Delivery is enabled, i.e. when APICv is active in KVM's world. I.e. there's no need to trigger update_cr8_intercept(), this is firmly an SVM implementation flaw/detail. WARN if KVM gets a CR8 write #VMEXIT while AVIC is active, as KVM should never enter the guest with AVIC enabled and CR8 writes intercepted. Fixes: 3bbf3565f48c ("svm: Do not intercept CR8 when enable AVIC") Cc: stable(a)vger.kernel.org Cc: Jim Mattson <jmattson(a)google.com> Cc: Naveen N Rao (AMD) <naveen(a)kernel.org> Cc: Maciej S. Szmigiero <maciej.szmigiero(a)oracle.com> Reviewed-by: Naveen N Rao (AMD) <naveen(a)kernel.org> Reviewed-by: Jim Mattson <jmattson(a)google.com> Link: https://patch.msgid.link/20260203190711.458413-3-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc(a)google.com> [Squash fix to avic_deactivate_vmcb. - Paolo] Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> conflict: arch/x86/kvm/svm/avic.c [Conflict conflicts.] Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- arch/x86/kvm/svm/avic.c | 6 +++++- arch/x86/kvm/svm/svm.c | 7 ++++--- 2 files changed, 9 insertions(+), 4 deletions(-) diff --git a/arch/x86/kvm/svm/avic.c b/arch/x86/kvm/svm/avic.c index 6970b11a6b4c..5d4d1d2ebba9 100644 --- a/arch/x86/kvm/svm/avic.c +++ b/arch/x86/kvm/svm/avic.c @@ -88,9 +88,10 @@ static void avic_activate_vmcb(struct vcpu_svm *svm) vmcb->control.int_ctl &= ~(AVIC_ENABLE_MASK | X2APIC_MODE_MASK); vmcb->control.avic_physical_id &= ~AVIC_PHYSICAL_MAX_INDEX_MASK; - vmcb->control.int_ctl |= AVIC_ENABLE_MASK; + svm_clr_intercept(svm, INTERCEPT_CR8_WRITE); + /* * Note: KVM supports hybrid-AVIC mode, where KVM emulates x2APIC MSR * accesses, while interrupt injection to a running vCPU can be @@ -124,6 +125,9 @@ static void avic_deactivate_vmcb(struct vcpu_svm *svm) vmcb->control.int_ctl &= ~(AVIC_ENABLE_MASK | X2APIC_MODE_MASK); vmcb->control.avic_physical_id &= ~AVIC_PHYSICAL_MAX_INDEX_MASK; + if (!sev_es_guest(svm->vcpu.kvm)) + svm_set_intercept(svm, INTERCEPT_CR8_WRITE); + /* * If running nested and the guest uses its own MSR bitmap, there * is no need to update L0's msr bitmap diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index e365c50b6d92..ad25a6995ee6 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -1279,8 +1279,7 @@ static void init_vmcb(struct kvm_vcpu *vcpu) svm_set_intercept(svm, INTERCEPT_CR0_WRITE); svm_set_intercept(svm, INTERCEPT_CR3_WRITE); svm_set_intercept(svm, INTERCEPT_CR4_WRITE); - if (!kvm_vcpu_apicv_active(vcpu)) - svm_set_intercept(svm, INTERCEPT_CR8_WRITE); + svm_set_intercept(svm, INTERCEPT_CR8_WRITE); set_dr_intercepts(svm); @@ -2836,9 +2835,11 @@ static int dr_interception(struct kvm_vcpu *vcpu) static int cr8_write_interception(struct kvm_vcpu *vcpu) { + u8 cr8_prev = kvm_get_cr8(vcpu); int r; - u8 cr8_prev = kvm_get_cr8(vcpu); + WARN_ON_ONCE(kvm_vcpu_apicv_active(vcpu)); + /* instruction emulation calls kvm_set_cr8() */ r = cr_interception(vcpu); if (lapic_in_kernel(vcpu)) -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] Fix CVE-2026-31709
by Li Lingfeng 15 May '26

15 May '26

Michael Bommarito (2): smb: client: validate the whole DACL before rewriting it in cifsacl smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl fs/smb/client/cifsacl.c | 115 +++++++++++++++++++++++++++++----------- 1 file changed, 85 insertions(+), 30 deletions(-) -- 2.52.0

2 3

[PATCH OLK-5.10] ksmbd: validate EaNameLength in smb2_get_ea()
by Li Lingfeng 15 May '26

15 May '26

From: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> mainline inclusion from mainline-v7.1-rc1 commit 66751841212c2cc196577453c37f7774ff363f02 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14355 CVE: CVE-2026-31612 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- smb2_get_ea() reads ea_req->EaNameLength from the client request and passes it directly to strncmp() as the comparison length without verifying that the length of the name really is the size of the input buffer received. Fix this up by properly checking the size of the name based on the value received and the overall size of the request, to prevent a later strncmp() call to use the length as a "trusted" size of the buffer. Without this check, uninitialized heap values might be slowly leaked to the client. Cc: Namjae Jeon <linkinjeon(a)kernel.org> Cc: Steve French <smfrench(a)gmail.com> Cc: Sergey Senozhatsky <senozhatsky(a)chromium.org> Cc: Tom Talpey <tom(a)talpey.com> Cc: linux-cifs(a)vger.kernel.org Cc: <stable(a)kernel.org> Assisted-by: gregkh_clanker_t1000 Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Acked-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/server/smb2pdu.c [File Path Difference] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/ksmbd/smb2pdu.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c index 176a6a51be6d..d259201edbf6 100644 --- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -4243,6 +4243,11 @@ static int smb2_get_ea(struct ksmbd_work *work, struct ksmbd_file *fp, ea_req = (struct smb2_ea_info_req *)((char *)req + le16_to_cpu(req->InputBufferOffset)); + + if (le32_to_cpu(req->InputBufferLength) < + offsetof(struct smb2_ea_info_req, name) + + ea_req->EaNameLength) + return -EINVAL; } else { /* need to send all EAs, if no specific EA is requested*/ if (le32_to_cpu(req->Flags) & SL_RETURN_SINGLE_ENTRY) -- 2.52.0

2 2

[PATCH OLK-5.10] ksmbd: fix memory leaks and NULL deref in smb2_lock()
by Li Lingfeng 15 May '26

15 May '26

From: Werner Kasselman <werner(a)verivus.com> mainline inclusion from mainline-v7.0-rc6 commit 309b44ed684496ed3f9c5715d10b899338623512 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14218 CVE: CVE-2026-31477 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- smb2_lock() has three error handling issues after list_del() detaches smb_lock from lock_list at no_check_cl: 1) If vfs_lock_file() returns an unexpected error in the non-UNLOCK path, goto out leaks smb_lock and its flock because the out: handler only iterates lock_list and rollback_list, neither of which contains the detached smb_lock. 2) If vfs_lock_file() returns -ENOENT in the UNLOCK path, goto out leaks smb_lock and flock for the same reason. The error code returned to the dispatcher is also stale. 3) In the rollback path, smb_flock_init() can return NULL on allocation failure. The result is dereferenced unconditionally, causing a kernel NULL pointer dereference. Add a NULL check to prevent the crash and clean up the bookkeeping; the VFS lock itself cannot be rolled back without the allocation and will be released at file or connection teardown. Fix cases 1 and 2 by hoisting the locks_free_lock()/kfree() to before the if(!rc) check in the UNLOCK branch so all exit paths share one free site, and by freeing smb_lock and flock before goto out in the non-UNLOCK branch. Propagate the correct error code in both cases. Fix case 3 by wrapping the VFS unlock in an if(rlock) guard and adding a NULL check for locks_free_lock(rlock) in the shared cleanup. Found via call-graph analysis using sqry. Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") Cc: stable(a)vger.kernel.org Suggested-by: ChenXiaoSong <chenxiaosong(a)kylinos.cn> Signed-off-by: Werner Kasselman <werner(a)verivus.com> Reviewed-by: ChenXiaoSong <chenxiaosong(a)kylinos.cn> Acked-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/server/smb2pdu.c [File Path Difference] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/ksmbd/smb2pdu.c | 27 ++++++++++++++++++--------- 1 file changed, 18 insertions(+), 9 deletions(-) diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c index 176a6a51be6d..e27022b9481a 100644 --- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -7071,14 +7071,15 @@ int smb2_lock(struct ksmbd_work *work) rc = vfs_lock_file(filp, smb_lock->cmd, flock, NULL); skip: if (flags & SMB2_LOCKFLAG_UNLOCK) { + locks_free_lock(flock); + kfree(smb_lock); if (!rc) { ksmbd_debug(SMB, "File unlocked\n"); } else if (rc == -ENOENT) { rsp->hdr.Status = STATUS_NOT_LOCKED; + err = rc; goto out; } - locks_free_lock(flock); - kfree(smb_lock); } else { if (rc == FILE_LOCK_DEFERRED) { void **argv; @@ -7158,6 +7159,9 @@ int smb2_lock(struct ksmbd_work *work) list_add(&smb_lock->llist, &rollback_list); ksmbd_debug(SMB, "successful in taking lock\n"); } else { + locks_free_lock(flock); + kfree(smb_lock); + err = rc; goto out; } } @@ -7185,13 +7189,17 @@ int smb2_lock(struct ksmbd_work *work) struct file_lock *rlock = NULL; rlock = smb_flock_init(filp); - rlock->fl_type = F_UNLCK; - rlock->fl_start = smb_lock->start; - rlock->fl_end = smb_lock->end; + if (rlock) { + rlock->fl_type = F_UNLCK; + rlock->fl_start = smb_lock->start; + rlock->fl_end = smb_lock->end; - rc = vfs_lock_file(filp, 0, rlock, NULL); - if (rc) - pr_err("rollback unlock fail : %d\n", rc); + rc = vfs_lock_file(filp, F_SETLK, rlock, NULL); + if (rc) + pr_err("rollback unlock fail : %d\n", rc); + } else { + pr_err("rollback unlock alloc failed\n"); + } list_del(&smb_lock->llist); spin_lock(&work->conn->llist_lock); @@ -7201,7 +7209,8 @@ int smb2_lock(struct ksmbd_work *work) spin_unlock(&work->conn->llist_lock); locks_free_lock(smb_lock->fl); - locks_free_lock(rlock); + if (rlock) + locks_free_lock(rlock); kfree(smb_lock); } out2: -- 2.52.0

2 1

[PATCH OLK-5.10] ksmbd: require 3 sub-authorities before reading sub_auth[2]
by Li Lingfeng 15 May '26

15 May '26

From: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> mainline inclusion from mainline-v7.1-rc1 commit 53370cf9090777774e07fd9a8ebce67c6cc333ab category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14354 CVE: CVE-2026-31611 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ksmbd: require 3 sub-authorities before reading sub_auth[2] parse_dacl() compares each ACE SID against sid_unix_NFS_mode and on match reads sid.sub_auth[2] as the file mode. If sid_unix_NFS_mode is the prefix S-1-5-88-3 with num_subauth = 2 then compare_sids() compares only min(num_subauth, 2) sub-authorities so a client SID with num_subauth = 2 and sub_auth = {88, 3} will match. If num_subauth = 2 and the ACE is placed at the very end of the security descriptor, sub_auth[2] will be 4 bytes past end_of_acl. The out-of-band bytes will then be masked to the low 9 bits and applied as the file's POSIX mode, probably not something that is good to have happen. Fix this up by forcing the SID to actually carry a third sub-authority before reading it at all. Cc: Namjae Jeon <linkinjeon(a)kernel.org> Cc: Steve French <smfrench(a)gmail.com> Cc: Sergey Senozhatsky <senozhatsky(a)chromium.org> Cc: Tom Talpey <tom(a)talpey.com> Cc: linux-cifs(a)vger.kernel.org Cc: <stable(a)kernel.org> Assisted-by: gregkh_clanker_t1000 Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Acked-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/server/smbacl.c fs/ksmbd/smbacl.c [File Path Difference] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/ksmbd/smbacl.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/ksmbd/smbacl.c b/fs/ksmbd/smbacl.c index 3368a4e73773..859b88f0de88 100644 --- a/fs/ksmbd/smbacl.c +++ b/fs/ksmbd/smbacl.c @@ -439,7 +439,8 @@ static void parse_dacl(struct smb_acl *pdacl, char *end_of_acl, ppace[i]->access_req = smb_map_generic_desired_access(ppace[i]->access_req); - if (!(compare_sids(&ppace[i]->sid, &sid_unix_NFS_mode))) { + if (ppace[i]->sid.num_subauth >= 3 && + !(compare_sids(&ppace[i]->sid, &sid_unix_NFS_mode))) { fattr->cf_mode = le32_to_cpu(ppace[i]->sid.sub_auth[2]); break; -- 2.52.0

2 1

[PATCH OLK-6.6 v12 0/6] SMT QOS
by Jinjie Ruan 15 May '26

15 May '26

Cloud Service Provider deploy Best-Effort and Latency Sensitive tasks on the same physical core to maximize the resource utilization. We observe the LS task needs more cycles to complete the same workload due to the Microarchitectural resource contention. This feature control the instruction throughput of BE task into pipeline, so that the other SMT running LS task could occupy more uarch resources to reach better IPC. First split out QOS_LABEL from QOS_SCHED for SMT QoS reuse. The test results on HIP12: | 1. online 30% | 基线 | 混布基线 | SMT QoS | | ---------------------------- | ------ | -------- | ------- | | sched_wfi_timeout_us | \ | \ | 50 | | sched_smt_offline_util_pct | \ | \ | 50 | | P99 | 0.2 | 0.303 | 0.21 | | CPU utilization | 28.9% | 66.70% | 64.7% | | P99 regression percentage | \ | 51.5% | 5.00% | | spark CPEMAN | \ | 1.29 | 0.967 | | spark CPEMAN> regression | \ | \ | 25.04% | | 2. online 40% | 基线 | 混布基线 | SMT QoS | | ---------------------------- | ------ | -------- | ------- | | sched_wfi_timeout_us | \ | \ | 50 | | sched_smt_offline_util_pct | \ | \ | 50 | | P99 | 0.21 | 0.286 | 0.206 | | CPU utilization | 40.0% | 69.30% | 65.5% | | P99 regression percentage | \ | 36.19% | -1.9% | | spark CPEMAN | \ | 1.03 | 0.661 | | spark CPEMAN> regression | \ | \ | 35.83% | | 3. online 48% | 基线 | 混布基线 | SMT QoS | | ---------------------------- | ------ | -------- | ------- | | sched_wfi_timeout_us | \ | \ | 50 | | sched_smt_offline_util_pct | \ | \ | 50 | | P99 | 0.209 | 0.275 | 0.202 | | CPU utilization | 40.0% | 74.60% | 64.9% | | P99 regression percentage | \ | 31.58% | -3.35% | | spark CPEMAN | \ | 0.92 | 0.503 | | spark CPEMAN> regression | \ | \ | 45.33% | Changes in v12: - Fix backup_select_cpus not set NULL. - Use separate patch to move dynamic affinity helper functions to sched.h - include smt_qos.c in build_policy.c. - Simplify set_qos_task_select_cpus(). Changes in v11: - Fix `mrs x21,icc_iar1_el1' build issue. - Fix set_qos_task_select_cpus() "idlest_cpu" bug. - Fix restore_qos_task_select_cpus() smt_qos_enabled() check. - Use regs->orig_x0 instead of percpu cpu_iar. - Call arch_timer_get_cntfrq() once initially. - Remove extra qos_sched_enabled() check in qos_schedule_throttle(). - Move most smt qos code in fair.c to smt_qos.c. - Add smt_qos_enabled() check in smt_qos_update_sg_lb_stats() - Remove extra cpumask_copy() in set_qos_task_select_cpus(). - Add boundary case handling for when prefer_cpus is empty. Changes in v10: - Decouple QOS_SCHED_SMT_EXPELLER and QOS_SCHED scheduling logic with SMT_QOS. - Some cleanup. Changes in v9: - Also use SMT sibling CPU utilization NUMA level watermark for offline task cpu select to improve the 920G CPU utilization. Chanegs in v8: - Use SMT sibling CPU utilization NUMA level watermark instead of src cpu offline tasks migrate watermark on every load balance. Changes in v7: - Fix the prefer_cpu and select_cpus save/restore. - Extract can_smt_qos_migrate_task() helper from can_migrate_task(). - Update the names. - Update the arch code and remove the pmu code. - Add some comment. Changes in v6: - Rename QOS_LABEL to QOS_LEVEL. - Rename USER_WFXT to SMT_QOS. - Rename TAG_PULL to SMT_TAG_PULL. - Adjust the select cpu code which depends on QOS_SCHED_DYNAMIC_AFFINITY. - Distribute offline tasks to SMT sibling cores based on the configured proportion move to a separate patch. - Use cpumask_t for even_cpu_mask. - smt_throttle move to the arch patch. - pmu_smt_update_status() -> smt_update_qos_level(). - >> smt_task_imbalance instead of / 1000. - Remove the limit for odd -> even load balance, which solve the one NUMA load very high problem. - Rebased on the newest OLK-6.6 code. - Fix the build issue for QOS_LEVEL selected but CGROUP_SCHED or CFS_BANDWIDTH not selected. Jinjie Ruan (6): sched: Split out QOS_LEVEL from QOS_SCHED for reuse sched: Add qos_sched_enabled() helper for future expansion sched/fair: Move dynamic affinity helper functions to sched.h sched/fair: Add SMT QoS sched core code arm64: Add arch code for SMT QoS config: Enable SMT_QOS arch/arm64/Kconfig.turbo | 17 ++ arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/cpufeature.h | 5 + arch/arm64/include/asm/xint.h | 13 ++ arch/arm64/kernel/Makefile | 1 + arch/arm64/kernel/entry-common.c | 13 ++ arch/arm64/kernel/entry.S | 14 +- arch/arm64/kernel/smp.c | 23 +++ arch/arm64/kernel/smt_qos.c | 87 ++++++++++ arch/arm64/kernel/xcall/entry.S | 77 +++++++++ drivers/irqchip/irq-gic-v3.c | 38 +++++ include/linux/sched.h | 20 +++ init/Kconfig | 5 + kernel/sched/build_policy.c | 4 + kernel/sched/core.c | 20 +-- kernel/sched/fair.c | 107 ++++++++----- kernel/sched/features.h | 4 + kernel/sched/sched.h | 86 ++++++++-- kernel/sched/smt_qos.c | 209 +++++++++++++++++++++++++ 19 files changed, 676 insertions(+), 68 deletions(-) create mode 100644 arch/arm64/include/asm/xint.h create mode 100644 arch/arm64/kernel/smt_qos.c create mode 100644 kernel/sched/smt_qos.c -- 2.34.1

2 7

[PATCH OLK-6.6 v12 0/6] SMT QOS
by Jinjie Ruan 15 May '26

15 May '26

Cloud Service Provider deploy Best-Effort and Latency Sensitive tasks on the same physical core to maximize the resource utilization. We observe the LS task needs more cycles to complete the same workload due to the Microarchitectural resource contention. This feature control the instruction throughput of BE task into pipeline, so that the other SMT running LS task could occupy more uarch resources to reach better IPC. First split out QOS_LABEL from QOS_SCHED for SMT QoS reuse. The test results on HIP12: | 1. online 30% | 基线 | 混布基线 | SMT QoS | | sched_wfi_timeout_us | \ | \ | 50 | | sched_smt_offline_util_pct | \ | \ | 50 | | P99 | 0.2 | 0.303 | 0.21 | | CPU utilization | 28.9% | 66.70% | 64.7% | | P99 regression percentage | \ | 51.5% | 5.00% | | spark CPEMAN | \ | 1.29 | 0.967 | | spark CPEMAN> regression | \ | \ | 25.04% | | 2. online 40% | 基线 | 混布基线 | SMT QoS | | sched_wfi_timeout_us | \ | \ | 50 | | sched_smt_offline_util_pct | \ | \ | 50 | | P99 | 0.21 | 0.286 | 0.206 | | CPU utilization | 40.0% | 69.30% | 65.5% | | P99 regression percentage | \ | 36.19% | -1.9% | | spark CPEMAN | \ | 1.03 | 0.661 | | spark CPEMAN> regression | \ | \ | 35.83% | | 3. online 48% | 基线 | 混布基线 | SMT QoS | | sched_wfi_timeout_us | \ | \ | 50 | | sched_smt_offline_util_pct | \ | \ | 50 | | P99 | 0.209 | 0.275 | 0.202 | | CPU utilization | 40.0% | 74.60% | 64.9% | | P99 regression percentage | \ | 31.58% | -3.35% | | spark CPEMAN | \ | 0.92 | 0.503 | | spark CPEMAN> regression | \ | \ | 45.33% | Changes in v12: - Fix backup_select_cpus not set NULL. - Use separate patch to move dynamic affinity helper functions to sched.h - include smt_qos.c in build_policy.c. - Simplify set_qos_task_select_cpus(). Changes in v11: - Fix `mrs x21,icc_iar1_el1' build issue. - Fix set_qos_task_select_cpus() "idlest_cpu" bug. - Fix restore_qos_task_select_cpus() smt_qos_enabled() check. - Use regs->orig_x0 instead of percpu cpu_iar. - Call arch_timer_get_cntfrq() once initially. - Remove extra qos_sched_enabled() check in qos_schedule_throttle(). - Move most smt qos code in fair.c to smt_qos.c. - Add smt_qos_enabled() check in smt_qos_update_sg_lb_stats() - Remove extra cpumask_copy() in set_qos_task_select_cpus(). - Add boundary case handling for when prefer_cpus is empty. Changes in v10: - Decouple QOS_SCHED_SMT_EXPELLER and QOS_SCHED scheduling logic with SMT_QOS. - Some cleanup. Changes in v9: - Also use SMT sibling CPU utilization NUMA level watermark for offline task cpu select to improve the 920G CPU utilization. Chanegs in v8: - Use SMT sibling CPU utilization NUMA level watermark instead of src cpu offline tasks migrate watermark on every load balance. Changes in v7: - Fix the prefer_cpu and select_cpus save/restore. - Extract can_smt_qos_migrate_task() helper from can_migrate_task(). - Update the names. - Update the arch code and remove the pmu code. - Add some comment. Changes in v6: - Rename QOS_LABEL to QOS_LEVEL. - Rename USER_WFXT to SMT_QOS. - Rename TAG_PULL to SMT_TAG_PULL. - Adjust the select cpu code which depends on QOS_SCHED_DYNAMIC_AFFINITY. - Distribute offline tasks to SMT sibling cores based on the configured proportion move to a separate patch. - Use cpumask_t for even_cpu_mask. - smt_throttle move to the arch patch. - pmu_smt_update_status() -> smt_update_qos_level(). - >> smt_task_imbalance instead of / 1000. - Remove the limit for odd -> even load balance, which solve the one NUMA load very high problem. - Rebased on the newest OLK-6.6 code. - Fix the build issue for QOS_LEVEL selected but CGROUP_SCHED or CFS_BANDWIDTH not selected. Jinjie Ruan (6): sched: Split out QOS_LEVEL from QOS_SCHED for reuse sched: Add qos_sched_enabled() helper for future expansion sched/fair: Move dynamic affinity helper functions to sched.h sched/fair: Add SMT QoS sched core code arm64: Add arch code for SMT QoS config: Enable SMT_QOS arch/arm64/Kconfig.turbo | 17 ++ arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/cpufeature.h | 5 + arch/arm64/include/asm/xint.h | 13 ++ arch/arm64/kernel/Makefile | 1 + arch/arm64/kernel/entry-common.c | 13 ++ arch/arm64/kernel/entry.S | 14 +- arch/arm64/kernel/smp.c | 23 +++ arch/arm64/kernel/smt_qos.c | 87 ++++++++++ arch/arm64/kernel/xcall/entry.S | 77 +++++++++ drivers/irqchip/irq-gic-v3.c | 38 +++++ include/linux/sched.h | 20 +++ init/Kconfig | 5 + kernel/sched/build_policy.c | 4 + kernel/sched/core.c | 20 +-- kernel/sched/fair.c | 114 ++++++++------ kernel/sched/features.h | 4 + kernel/sched/sched.h | 93 +++++++++-- kernel/sched/smt_qos.c | 209 +++++++++++++++++++++++++ 19 files changed, 683 insertions(+), 75 deletions(-) create mode 100644 arch/arm64/include/asm/xint.h create mode 100644 arch/arm64/kernel/smt_qos.c create mode 100644 kernel/sched/smt_qos.c -- 2.34.1

2 7

[PATCH OLK-6.6] ceph: add a bunch of missing ceph_path_info initializers
by Pan Taixi 15 May '26

15 May '26

From: Max Kellermann <max.kellermann(a)ionos.com> mainline inclusion from mainline-v7.0-rc4 commit 43323a5934b660afae687e8e4e95ac328615a5c4 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14967 CVE: CVE-2026-43408 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ceph_mdsc_build_path() must be called with a zero-initialized ceph_path_info parameter, or else the following ceph_mdsc_free_path_info() may crash. Example crash (on Linux 6.18.12): virt_to_cache: Object is not a Slab page! WARNING: CPU: 184 PID: 2871736 at mm/slub.c:6732 kmem_cache_free+0x316/0x400 [...] Call Trace: [...] ceph_open+0x13d/0x3e0 do_dentry_open+0x134/0x480 vfs_open+0x2a/0xe0 path_openat+0x9a3/0x1160 [...] cache_from_obj: Wrong slab cache. names_cache but object is from ceph_inode_info WARNING: CPU: 184 PID: 2871736 at mm/slub.c:6746 kmem_cache_free+0x2dd/0x400 [...] kernel BUG at mm/slub.c:634! Oops: invalid opcode: 0000 [#1] SMP NOPTI RIP: 0010:__slab_free+0x1a4/0x350 Some of the ceph_mdsc_build_path() callers had initializers, but others had not, even though they were all added by commit 15f519e9f883 ("ceph: fix race condition validating r_parent before applying state"). The ones without initializer are suspectible to random crashes. (I can imagine it could even be possible to exploit this bug to elevate privileges.) Unfortunately, these Ceph functions are undocumented and its semantics can only be derived from the code. I see that ceph_mdsc_build_path() initializes the structure only on success, but not on error. Calling ceph_mdsc_free_path_info() after a failed ceph_mdsc_build_path() call does not even make sense, but that's what all callers do, and for it to be safe, the structure must be zero-initialized. The least intrusive approach to fix this is therefore to add initializers everywhere. Cc: stable(a)vger.kernel.org Fixes: 15f519e9f883 ("ceph: fix race condition validating r_parent before applying state") Signed-off-by: Max Kellermann <max.kellermann(a)ionos.com> Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko(a)ibm.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Conflicts: fs/ceph/debugfs.c fs/ceph/dir.c fs/ceph/file.c fs/ceph/inode.c [Context conflicts in fs/ceph/debugfs.c. For other files, struct ceph_path_info path_info are all properly initialized to {0}] Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com> --- fs/ceph/debugfs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/ceph/debugfs.c b/fs/ceph/debugfs.c index f00b333676d9..b44e44709e0a 100644 --- a/fs/ceph/debugfs.c +++ b/fs/ceph/debugfs.c @@ -79,7 +79,7 @@ static int mdsc_show(struct seq_file *s, void *p) if (req->r_inode) { seq_printf(s, " #%llx", ceph_ino(req->r_inode)); } else if (req->r_dentry) { - struct ceph_path_info path_info; + struct ceph_path_info path_info = {0}; path = ceph_mdsc_build_path(mdsc, req->r_dentry, &path_info, 0); if (IS_ERR(path)) @@ -99,7 +99,7 @@ static int mdsc_show(struct seq_file *s, void *p) } if (req->r_old_dentry) { - struct ceph_path_info path_info; + struct ceph_path_info path_info = {0}; path = ceph_mdsc_build_path(mdsc, req->r_old_dentry, &path_info, 0); if (IS_ERR(path)) -- 2.34.1

2 1

[PATCH OLK-6.6] apei: use blocking notifier for page offline policy chain
by Qi Xi 15 May '26

15 May '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9170 ------------------------------------------------------- atomic_notifier_call_chain() holds rcu_read_lock() over callbacks, which prevents sleeping. Notifier callbacks such as ipmi_pso_notifier_call() need to sleep for IPMI completion, triggering a BUG: sleeping function called from invalid context. Switch apei_page_offline_notifier_chain to a blocking notifier to allow callbacks to safely sleep when invoked from sysctl write path. Fixes: 543fadb5575a ("apei/ghes: Add sysctl interface to control soft-offline page isolation") Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- drivers/acpi/apei/ghes-policy.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/acpi/apei/ghes-policy.c b/drivers/acpi/apei/ghes-policy.c index 87c611f2cbaa..0bc12b0ba32b 100644 --- a/drivers/acpi/apei/ghes-policy.c +++ b/drivers/acpi/apei/ghes-policy.c @@ -17,18 +17,18 @@ int sysctl_apei_page_offline_policy __read_mostly = APEI_PAGE_OFFLINE_ALLOW_BASE_PAGE; EXPORT_SYMBOL(sysctl_apei_page_offline_policy); -static ATOMIC_NOTIFIER_HEAD(apei_page_offline_notifier_chain); +static BLOCKING_NOTIFIER_HEAD(apei_page_offline_notifier_chain); int register_apei_page_offline_notifier(struct notifier_block *nb) { - return atomic_notifier_chain_register( + return blocking_notifier_chain_register( &apei_page_offline_notifier_chain, nb); } EXPORT_SYMBOL(register_apei_page_offline_notifier); int unregister_apei_page_offline_notifier(struct notifier_block *nb) { - return atomic_notifier_chain_unregister( + return blocking_notifier_chain_unregister( &apei_page_offline_notifier_chain, nb); } EXPORT_SYMBOL(unregister_apei_page_offline_notifier); @@ -48,7 +48,7 @@ static int apei_page_offline_policy_handler(struct ctl_table *table, pr_debug("APEI policy: 0x%x -> 0x%x\n", old_val, new_val); if ((old_val ^ new_val) & APEI_PAGE_OFFLINE_NOTIFY) - atomic_notifier_call_chain( + blocking_notifier_call_chain( &apei_page_offline_notifier_chain, 0, &new_val); } -- 2.33.0

2 1

[PATCH OLK-6.6] dm: clear cloned request bio pointer when last clone bio completes
by Li Lingfeng 14 May '26

14 May '26

From: Michael Liang <mliang(a)purestorage.com> stable inclusion from stable-v6.6.128 commit 7daf279c674d515fb22a727a7bbc92aeb35c5442 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14830 CVE: CVE-2026-43278 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fb8a6c18fb9a6561f7a15b58b272442b77a242dd ] Stale rq->bio values have been observed to cause double-initialization of cloned bios in request-based device-mapper targets, leading to use-after-free and double-free scenarios. One such case occurs when using dm-multipath on top of a PCIe NVMe namespace, where cloned request bios are freed during blk_complete_request(), but rq->bio is left intact. Subsequent clone teardown then attempts to free the same bios again via blk_rq_unprep_clone(). The resulting double-free path looks like: nvme_pci_complete_batch() nvme_complete_batch() blk_mq_end_request_batch() blk_complete_request() // called on a DM clone request bio_endio() // first free of all clone bios ... rq->end_io() // end_clone_request() dm_complete_request(tio->orig) dm_softirq_done() dm_done() dm_end_request() blk_rq_unprep_clone() // second free of clone bios Fix this by clearing the clone request's bio pointer when the last cloned bio completes, ensuring that later teardown paths do not attempt to free already-released bios. Signed-off-by: Michael Liang <mliang(a)purestorage.com> Reviewed-by: Mohamed Khalfella <mkhalfella(a)purestorage.com> Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Cc: stable(a)vger.kernel.org Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/md/dm-rq.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c index 499f8cc8a39f..5bcf020df856 100644 --- a/drivers/md/dm-rq.c +++ b/drivers/md/dm-rq.c @@ -109,14 +109,21 @@ static void end_clone_bio(struct bio *clone) */ tio->completed += nr_bytes; + if (!is_last) + return; + /* + * At this moment we know this is the last bio of the cloned request, + * and all cloned bios have been released, so reset the clone request's + * bio pointer to avoid double free. + */ + tio->clone->bio = NULL; + exit: /* * Update the original request. * Do not use blk_mq_end_request() here, because it may complete * the original request before the clone, and break the ordering. */ - if (is_last) - exit: - blk_update_request(tio->orig, BLK_STS_OK, tio->completed); + blk_update_request(tio->orig, BLK_STS_OK, tio->completed); } static struct dm_rq_target_io *tio_from_request(struct request *rq) -- 2.52.0

2 1

[PATCH OLK-6.6] dm: clear cloned request bio pointer when last clone bio completes
by Li Lingfeng 14 May '26

14 May '26

From: Michael Liang <mliang(a)purestorage.com> stable inclusion from stable-v6.6.128 commit 7daf279c674d515fb22a727a7bbc92aeb35c5442 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8792 CVE: CVE-2026-43278 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fb8a6c18fb9a6561f7a15b58b272442b77a242dd ] Stale rq->bio values have been observed to cause double-initialization of cloned bios in request-based device-mapper targets, leading to use-after-free and double-free scenarios. One such case occurs when using dm-multipath on top of a PCIe NVMe namespace, where cloned request bios are freed during blk_complete_request(), but rq->bio is left intact. Subsequent clone teardown then attempts to free the same bios again via blk_rq_unprep_clone(). The resulting double-free path looks like: nvme_pci_complete_batch() nvme_complete_batch() blk_mq_end_request_batch() blk_complete_request() // called on a DM clone request bio_endio() // first free of all clone bios ... rq->end_io() // end_clone_request() dm_complete_request(tio->orig) dm_softirq_done() dm_done() dm_end_request() blk_rq_unprep_clone() // second free of clone bios Fix this by clearing the clone request's bio pointer when the last cloned bio completes, ensuring that later teardown paths do not attempt to free already-released bios. Signed-off-by: Michael Liang <mliang(a)purestorage.com> Reviewed-by: Mohamed Khalfella <mkhalfella(a)purestorage.com> Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Cc: stable(a)vger.kernel.org Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/md/dm-rq.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c index 499f8cc8a39f..5bcf020df856 100644 --- a/drivers/md/dm-rq.c +++ b/drivers/md/dm-rq.c @@ -109,14 +109,21 @@ static void end_clone_bio(struct bio *clone) */ tio->completed += nr_bytes; + if (!is_last) + return; + /* + * At this moment we know this is the last bio of the cloned request, + * and all cloned bios have been released, so reset the clone request's + * bio pointer to avoid double free. + */ + tio->clone->bio = NULL; + exit: /* * Update the original request. * Do not use blk_mq_end_request() here, because it may complete * the original request before the clone, and break the ordering. */ - if (is_last) - exit: - blk_update_request(tio->orig, BLK_STS_OK, tio->completed); + blk_update_request(tio->orig, BLK_STS_OK, tio->completed); } static struct dm_rq_target_io *tio_from_request(struct request *rq) -- 2.52.0

2 1

[PATCH OLK-6.6] smb: client: prevent races in ->query_interfaces()
by Li Lingfeng 14 May '26

14 May '26

From: Henrique Carvalho <henrique.carvalho(a)suse.com> stable inclusion from stable-v6.6.128 commit 93e8e3ee165ae4609a1222b516b573837103d2c3 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14783 CVE: CVE-2026-43239 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit c3c06e42e1527716c54f3ad2ced6a034b5f3a489 ] It was possible for two query interface works to be concurrently trying to update the interfaces. Prevent this by checking and updating iface_last_update under iface_lock. Signed-off-by: Henrique Carvalho <henrique.carvalho(a)suse.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/smb/client/smb2ops.c | 19 ++++++++----------- 1 file changed, 8 insertions(+), 11 deletions(-) diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c index 40eea0b2f48b..a051f205589a 100644 --- a/fs/smb/client/smb2ops.c +++ b/fs/smb/client/smb2ops.c @@ -595,13 +595,6 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf, p = buf; spin_lock(&ses->iface_lock); - /* do not query too frequently, this time with lock held */ - if (ses->iface_last_update && - time_before(jiffies, ses->iface_last_update + - (SMB_INTERFACE_POLL_INTERVAL * HZ))) { - spin_unlock(&ses->iface_lock); - return 0; - } /* * Go through iface_list and mark them as inactive @@ -624,7 +617,6 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf, "Empty network interface list returned by server %s\n", ses->server->hostname); rc = -EOPNOTSUPP; - ses->iface_last_update = jiffies; goto out; } @@ -753,8 +745,6 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf, + sizeof(p->Next) && p->Next)) cifs_dbg(VFS, "%s: incomplete interface info\n", __func__); - ses->iface_last_update = jiffies; - out: /* * Go through the list again and put the inactive entries @@ -783,10 +773,17 @@ SMB3_request_interfaces(const unsigned int xid, struct cifs_tcon *tcon, bool in_ struct TCP_Server_Info *pserver; /* do not query too frequently */ + spin_lock(&ses->iface_lock); if (ses->iface_last_update && time_before(jiffies, ses->iface_last_update + - (SMB_INTERFACE_POLL_INTERVAL * HZ))) + (SMB_INTERFACE_POLL_INTERVAL * HZ))) { + spin_unlock(&ses->iface_lock); return 0; + } + + ses->iface_last_update = jiffies; + + spin_unlock(&ses->iface_lock); rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID, FSCTL_QUERY_NETWORK_INTERFACE_INFO, -- 2.52.0

2 1

[PATCH OLK-5.10] ksmbd: use check_add_overflow() to prevent u16 DACL size overflow
by Li Lingfeng 14 May '26

14 May '26

From: Tristan Madani <tristan(a)talencesecurity.com> mainline inclusion from mainline-v7.1-rc1 commit 299f962c0b02d048fb45d248b4da493d03f3175d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14454 CVE: CVE-2026-31704 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- set_posix_acl_entries_dacl() and set_ntacl_dacl() accumulate ACE sizes in u16 variables. When a file has many POSIX ACL entries, the accumulated size can wrap past 65535, causing the pointer arithmetic (char *)pndace + *size to land within already-written ACEs. Subsequent writes then overwrite earlier entries, and pndacl->size gets a truncated value. Use check_add_overflow() at each accumulation point to detect the wrap before it corrupts the buffer, consistent with existing check_mul_overflow() usage elsewhere in smbacl.c. Cc: stable(a)vger.kernel.org Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") Signed-off-by: Tristan Madani <tristan(a)talencesecurity.com> Acked-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/server/smbacl.c [Commit 38c8a9a52082 ("smb: move client and server files to common directory fs/smb") move smbacl.c to fs/smb/server/.] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/ksmbd/smbacl.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/fs/ksmbd/smbacl.c b/fs/ksmbd/smbacl.c index 3368a4e73773..44485451a6f0 100644 --- a/fs/ksmbd/smbacl.c +++ b/fs/ksmbd/smbacl.c @@ -582,6 +582,7 @@ static void set_posix_acl_entries_dacl(struct smb_ace *pndace, struct smb_sid *sid; struct smb_ace *ntace; int i, j; + u16 ace_sz; if (!fattr->cf_acls) goto posix_default_acl; @@ -626,8 +627,10 @@ static void set_posix_acl_entries_dacl(struct smb_ace *pndace, flags = 0x03; ntace = (struct smb_ace *)((char *)pndace + *size); - *size += fill_ace_for_sid(ntace, sid, ACCESS_ALLOWED, flags, + ace_sz = fill_ace_for_sid(ntace, sid, ACCESS_ALLOWED, flags, pace->e_perm, 0777); + if (check_add_overflow(*size, ace_sz, size)) + break; (*num_aces)++; if (pace->e_tag == ACL_USER) ntace->access_req |= @@ -636,8 +639,10 @@ static void set_posix_acl_entries_dacl(struct smb_ace *pndace, if (S_ISDIR(fattr->cf_mode) && (pace->e_tag == ACL_USER || pace->e_tag == ACL_GROUP)) { ntace = (struct smb_ace *)((char *)pndace + *size); - *size += fill_ace_for_sid(ntace, sid, ACCESS_ALLOWED, + ace_sz = fill_ace_for_sid(ntace, sid, ACCESS_ALLOWED, 0x03, pace->e_perm, 0777); + if (check_add_overflow(*size, ace_sz, size)) + break; (*num_aces)++; if (pace->e_tag == ACL_USER) ntace->access_req |= @@ -677,8 +682,10 @@ static void set_posix_acl_entries_dacl(struct smb_ace *pndace, } ntace = (struct smb_ace *)((char *)pndace + *size); - *size += fill_ace_for_sid(ntace, sid, ACCESS_ALLOWED, 0x0b, + ace_sz = fill_ace_for_sid(ntace, sid, ACCESS_ALLOWED, 0x0b, pace->e_perm, 0777); + if (check_add_overflow(*size, ace_sz, size)) + break; (*num_aces)++; if (pace->e_tag == ACL_USER) ntace->access_req |= @@ -712,7 +719,8 @@ static void set_ntacl_dacl(struct smb_acl *pndacl, struct smb_acl *nt_dacl, break; memcpy((char *)pndace + size, ntace, nt_ace_size); - size += nt_ace_size; + if (check_add_overflow(size, nt_ace_size, &size)) + break; aces_size -= nt_ace_size; ntace = (struct smb_ace *)((char *)ntace + nt_ace_size); num_aces++; -- 2.52.0

2 1

[PATCH OLK-6.6] smb: client: prevent races in ->query_interfaces()
by Li Lingfeng 14 May '26

14 May '26

From: Henrique Carvalho <henrique.carvalho(a)suse.com> stable inclusion from stable-v6.6.128 commit 93e8e3ee165ae4609a1222b516b573837103d2c3 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8792 CVE: CVE-2026-43239 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit c3c06e42e1527716c54f3ad2ced6a034b5f3a489 ] It was possible for two query interface works to be concurrently trying to update the interfaces. Prevent this by checking and updating iface_last_update under iface_lock. Signed-off-by: Henrique Carvalho <henrique.carvalho(a)suse.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/smb/client/smb2ops.c | 19 ++++++++----------- 1 file changed, 8 insertions(+), 11 deletions(-) diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c index 40eea0b2f48b..a051f205589a 100644 --- a/fs/smb/client/smb2ops.c +++ b/fs/smb/client/smb2ops.c @@ -595,13 +595,6 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf, p = buf; spin_lock(&ses->iface_lock); - /* do not query too frequently, this time with lock held */ - if (ses->iface_last_update && - time_before(jiffies, ses->iface_last_update + - (SMB_INTERFACE_POLL_INTERVAL * HZ))) { - spin_unlock(&ses->iface_lock); - return 0; - } /* * Go through iface_list and mark them as inactive @@ -624,7 +617,6 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf, "Empty network interface list returned by server %s\n", ses->server->hostname); rc = -EOPNOTSUPP; - ses->iface_last_update = jiffies; goto out; } @@ -753,8 +745,6 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf, + sizeof(p->Next) && p->Next)) cifs_dbg(VFS, "%s: incomplete interface info\n", __func__); - ses->iface_last_update = jiffies; - out: /* * Go through the list again and put the inactive entries @@ -783,10 +773,17 @@ SMB3_request_interfaces(const unsigned int xid, struct cifs_tcon *tcon, bool in_ struct TCP_Server_Info *pserver; /* do not query too frequently */ + spin_lock(&ses->iface_lock); if (ses->iface_last_update && time_before(jiffies, ses->iface_last_update + - (SMB_INTERFACE_POLL_INTERVAL * HZ))) + (SMB_INTERFACE_POLL_INTERVAL * HZ))) { + spin_unlock(&ses->iface_lock); return 0; + } + + ses->iface_last_update = jiffies; + + spin_unlock(&ses->iface_lock); rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID, FSCTL_QUERY_NETWORK_INTERFACE_INFO, -- 2.52.0

2 1

[PATCH OLK-6.6 v11 0/5] SMT QOS
by Jinjie Ruan 14 May '26

14 May '26

Cloud Service Provider deploy Best-Effort and Latency Sensitive tasks on the same physical core to maximize the resource utilization. We observe the LS task needs more cycles to complete the same workload due to the Microarchitectural resource contention. This feature control the instruction throughput of BE task into pipeline, so that the other SMT running LS task could occupy more uarch resources to reach better IPC. First split out QOS_LABEL from QOS_SCHED for SMT QoS reuse. The test results on HIP12: | 1. online 30% | 基线 | 混布基线 | SMT QoS | | sched_wfi_timeout_us | \ | \ | 50 | | sched_smt_offline_util_pct | \ | \ | 50 | | P99 | 0.2 | 0.303 | 0.21 | | CPU utilization | 28.9% | 66.70% | 64.7% | | P99 regression percentage | \ | 51.5% | 5.00% | | spark CPEMAN | \ | 1.29 | 0.967 | | spark CPEMAN> regression | \ | \ | 25.04% | | 2. online 40% | 基线 | 混布基线 | SMT QoS | | sched_wfi_timeout_us | \ | \ | 50 | | sched_smt_offline_util_pct | \ | \ | 50 | | P99 | 0.21 | 0.286 | 0.206 | | CPU utilization | 40.0% | 69.30% | 65.5% | | P99 regression percentage | \ | 36.19% | -1.9% | | spark CPEMAN | \ | 1.03 | 0.661 | | spark CPEMAN> regression | \ | \ | 35.83% | | 3. online 48% | 基线 | 混布基线 | SMT QoS | | sched_wfi_timeout_us | \ | \ | 50 | | sched_smt_offline_util_pct | \ | \ | 50 | | P99 | 0.209 | 0.275 | 0.202 | | CPU utilization | 40.0% | 74.60% | 64.9% | | P99 regression percentage | \ | 31.58% | -3.35% | | spark CPEMAN | \ | 0.92 | 0.503 | | spark CPEMAN> regression | \ | \ | 45.33% | Changes in v11: - Fix `mrs x21,icc_iar1_el1' build issue. - Fix set_qos_task_select_cpus() "idlest_cpu" bug. - Fix restore_qos_task_select_cpus() smt_qos_enabled() check. - Use regs->orig_x0 instead of percpu cpu_iar. - Call arch_timer_get_cntfrq() once initially. - Remove extra qos_sched_enabled() check in qos_schedule_throttle(). - Move most smt qos code in fair.c to smt_qos.c. - Add smt_qos_enabled() check in smt_qos_update_sg_lb_stats() - Remove extra cpumask_copy() in set_qos_task_select_cpus(). - Add boundary case handling for when prefer_cpus is empty. Changes in v10: - Decouple QOS_SCHED_SMT_EXPELLER and QOS_SCHED scheduling logic with SMT_QOS. - Some cleanup. Changes in v9: - Also use SMT sibling CPU utilization NUMA level watermark for offline task cpu select to improve the 920G CPU utilization. Chanegs in v8: - Use SMT sibling CPU utilization NUMA level watermark instead of src cpu offline tasks migrate watermark on every load balance. Changes in v7: - Fix the prefer_cpu and select_cpus save/restore. - Extract can_smt_qos_migrate_task() helper from can_migrate_task(). - Update the names. - Update the arch code and remove the pmu code. - Add some comment. Changes in v6: - Rename QOS_LABEL to QOS_LEVEL. - Rename USER_WFXT to SMT_QOS. - Rename TAG_PULL to SMT_TAG_PULL. - Adjust the select cpu code which depends on QOS_SCHED_DYNAMIC_AFFINITY. - Distribute offline tasks to SMT sibling cores based on the configured proportion move to a separate patch. - Use cpumask_t for even_cpu_mask. - smt_throttle move to the arch patch. - pmu_smt_update_status() -> smt_update_qos_level(). - >> smt_task_imbalance instead of / 1000. - Remove the limit for odd -> even load balance, which solve the one NUMA load very high problem. - Rebased on the newest OLK-6.6 code. - Fix the build issue for QOS_LEVEL selected but CGROUP_SCHED or CFS_BANDWIDTH not selected. Jinjie Ruan (5): sched: Split out QOS_LEVEL from QOS_SCHED for reuse sched: Add qos_sched_enabled() helper for future expansion sched/fair: Add SMT QoS sched core code arm64: Add arch code for SMT QoS config: Enable SMT_QOS arch/arm64/Kconfig.turbo | 17 ++ arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/cpufeature.h | 5 + arch/arm64/include/asm/xint.h | 15 ++ arch/arm64/kernel/Makefile | 1 + arch/arm64/kernel/entry-common.c | 13 ++ arch/arm64/kernel/entry.S | 14 +- arch/arm64/kernel/smp.c | 23 +++ arch/arm64/kernel/smt_qos.c | 87 ++++++++++ arch/arm64/kernel/xcall/entry.S | 77 +++++++++ drivers/irqchip/irq-gic-v3.c | 38 +++++ include/linux/sched.h | 20 +++ init/Kconfig | 5 + kernel/sched/Makefile | 1 + kernel/sched/core.c | 20 +-- kernel/sched/fair.c | 83 ++++++++-- kernel/sched/features.h | 4 + kernel/sched/sched.h | 56 +++++-- kernel/sched/smt_qos.c | 216 +++++++++++++++++++++++++ 19 files changed, 655 insertions(+), 41 deletions(-) create mode 100644 arch/arm64/include/asm/xint.h create mode 100644 arch/arm64/kernel/smt_qos.c create mode 100644 kernel/sched/smt_qos.c -- 2.34.1

2 6

[PATCH OLK-6.6] bpf-rvi: Fix possible AA deadlock pidns_list_lock
by Gu Bowen 14 May '26

14 May '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9171 -------------------------------- Spin lock pidns_list_lock is used in both process context and bottom half, which may cause the AA deadlock issue. Replace spin_lock with spin_lock_bh to resolve this problem. Call trace: native_queued_spin_lock_slowpath+0x71/0x428 destroy_pid_namespace+0x100/0x110 put_pid_ns+0x90/0xc8 put_pid+0x8c/0xc8 delayed_put_pid+0x1c/0x30 rcu_do_batch+0x164/0x580 rcu_core+0x130/0x2b8 rcu_core_si+0x18/0x30 handle_softirqs+0x120/0x328 __do_softirq+0x1c/0x28 ____do_softirq+0x18/0x30 call_on_irq_stack+0x30/0x48 do_softirq_own_stack+0x24/0x38 irq_exit_rcu+0x108/0x130 el1_interrupt+0x54/0x130 el1h_64_irq_handler+0x24/0x30 el1h_64_irq+0x78/0x80 create_pid_namespace+0x214/0x3c0 copy_pid_ns+0x90/0xf0 create_new_namespaces+0xc8/0x368 unshare_nsproxy_namespaces+0x6c/0xc0 ksys_unshare+0x130/0x418 __arm64_sys_unshare+0x1c/0x38 invoke_syscall+0x50/0x128 el0_svc_common.constprop.0+0x48/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x44/0x1e8 el0t_64_sync_handler+0xc0/0xc8 el0t_64_sync+0x3c8/0x3d0 Fixes: d758abf3762c ("bpf-rvi: pidns: Calculate loadavg for each pid namespace") Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- kernel/pid_namespace.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c index b321c02f382e..0bfd9ff3a6b8 100644 --- a/kernel/pid_namespace.c +++ b/kernel/pid_namespace.c @@ -128,9 +128,9 @@ static struct pid_namespace *create_pid_namespace(struct user_namespace *user_ns ns->loadavg = kmem_cache_zalloc(pidns_loadavg_cachep, GFP_KERNEL); if (ns->loadavg == NULL) goto out_free_idr; - spin_lock(&pidns_list_lock); + spin_lock_bh(&pidns_list_lock); list_add_tail(&ns->loadavg->list, &init_pidns_loadavg.list); - spin_unlock(&pidns_list_lock); + spin_unlock_bh(&pidns_list_lock); #endif return ns; @@ -164,9 +164,9 @@ static void destroy_pid_namespace(struct pid_namespace *ns) * ns->loadavg's lifecycle aligns precisely with ns, * so don't need RCU delayed free. */ - spin_lock(&pidns_list_lock); + spin_lock_bh(&pidns_list_lock); list_del(&ns->loadavg->list); - spin_unlock(&pidns_list_lock); + spin_unlock_bh(&pidns_list_lock); kmem_cache_free(pidns_loadavg_cachep, ns->loadavg); #endif call_rcu(&ns->rcu, delayed_free_pidns); @@ -537,13 +537,13 @@ static void pidns_list_reset(void) { struct list_head *pos, *tmp; - spin_lock(&pidns_list_lock); + spin_lock_bh(&pidns_list_lock); list_for_each_safe(pos, tmp, &init_pidns_loadavg.list) { struct pidns_loadavg *entry = list_entry(pos, struct pidns_loadavg, list); entry->load_tasks = 0; // reset } - spin_unlock(&pidns_list_lock); + spin_unlock_bh(&pidns_list_lock); } static void pidns_update_load_tasks(void) @@ -574,7 +574,7 @@ static void pidns_calc_avenrun(void) { struct list_head *pos; - spin_lock(&pidns_list_lock); + spin_lock_bh(&pidns_list_lock); /* * As the loadavg of init_pid_ns is exactly /proc/loadavg, avoid redundant * re-calculation for init_pid_ns, and reuse init_pidns_loadavg.list as the @@ -590,7 +590,7 @@ static void pidns_calc_avenrun(void) entry->avenrun[1] = calc_load(entry->avenrun[1], EXP_5, active); entry->avenrun[2] = calc_load(entry->avenrun[2], EXP_15, active); } - spin_unlock(&pidns_list_lock); + spin_unlock_bh(&pidns_list_lock); } static void pidns_calc_loadavg_workfn(struct work_struct *work) -- 2.43.0

2 1

[PATCH OLK-6.6 0/2] Fix CVE-2026-31709
by Li Lingfeng 14 May '26

14 May '26

Michael Bommarito (2): smb: client: validate the whole DACL before rewriting it in cifsacl smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl fs/smb/client/cifsacl.c | 114 +++++++++++++++++++++++++++++----------- 1 file changed, 84 insertions(+), 30 deletions(-) -- 2.52.0

2 3

[PATCH OLK-6.6 v11 0/5] SMT QOS
by Jinjie Ruan 14 May '26

14 May '26

Cloud Service Provider deploy Best-Effort and Latency Sensitive tasks on the same physical core to maximize the resource utilization. We observe the LS task needs more cycles to complete the same workload due to the Microarchitectural resource contention. This feature control the instruction throughput of BE task into pipeline, so that the other SMT running LS task could occupy more uarch resources to reach better IPC. First split out QOS_LABEL from QOS_SCHED for SMT QoS reuse. The test results on HIP12: | 1. online 30% | 基线 | 混布基线 | SMT QoS | | sched_wfi_timeout_us | \ | \ | 50 | | sched_smt_offline_util_pct | \ | \ | 50 | | P99 | 0.2 | 0.303 | 0.21 | | CPU utilization | 28.9% | 66.70% | 64.7% | | P99 regression percentage | \ | 51.5% | 5.00% | | spark CPEMAN | \ | 1.29 | 0.967 | | spark CPEMAN> regression | \ | \ | 25.04% | | 2. online 40% | 基线 | 混布基线 | SMT QoS | | sched_wfi_timeout_us | \ | \ | 50 | | sched_smt_offline_util_pct | \ | \ | 50 | | P99 | 0.21 | 0.286 | 0.206 | | CPU utilization | 40.0% | 69.30% | 65.5% | | P99 regression percentage | \ | 36.19% | -1.9% | | spark CPEMAN | \ | 1.03 | 0.661 | | spark CPEMAN> regression | \ | \ | 35.83% | | 3. online 48% | 基线 | 混布基线 | SMT QoS | | sched_wfi_timeout_us | \ | \ | 50 | | sched_smt_offline_util_pct | \ | \ | 50 | | P99 | 0.209 | 0.275 | 0.202 | | CPU utilization | 40.0% | 74.60% | 64.9% | | P99 regression percentage | \ | 31.58% | -3.35% | | spark CPEMAN | \ | 0.92 | 0.503 | | spark CPEMAN> regression | \ | \ | 45.33% | Changes in v11: - Fix `mrs x21,icc_iar1_el1' build issue. - Fix set_qos_task_select_cpus() "idlest_cpu" bug. - Fix restore_qos_task_select_cpus() smt_qos_enabled() check. - Use regs->orig_x0 instead of percpu cpu_iar. - Call arch_timer_get_cntfrq() once initially. - Remove extra qos_sched_enabled() check in qos_schedule_throttle(). - Move most smt qos code in fair.c to smt_qos.c. - Add smt_qos_enabled() check in smt_qos_update_sg_lb_stats() - Remove extra cpumask_copy() in set_qos_task_select_cpus(). - Add boundary case handling for when prefer_cpus is empty. Changes in v10: - Decouple QOS_SCHED_SMT_EXPELLER and QOS_SCHED scheduling logic with SMT_QOS. - Some cleanup. Changes in v9: - Also use SMT sibling CPU utilization NUMA level watermark for offline task cpu select to improve the 920G CPU utilization. Chanegs in v8: - Use SMT sibling CPU utilization NUMA level watermark instead of src cpu offline tasks migrate watermark on every load balance. Changes in v7: - Fix the prefer_cpu and select_cpus save/restore. - Extract can_smt_qos_migrate_task() helper from can_migrate_task(). - Update the names. - Update the arch code and remove the pmu code. - Add some comment. Changes in v6: - Rename QOS_LABEL to QOS_LEVEL. - Rename USER_WFXT to SMT_QOS. - Rename TAG_PULL to SMT_TAG_PULL. - Adjust the select cpu code which depends on QOS_SCHED_DYNAMIC_AFFINITY. - Distribute offline tasks to SMT sibling cores based on the configured proportion move to a separate patch. - Use cpumask_t for even_cpu_mask. - smt_throttle move to the arch patch. - pmu_smt_update_status() -> smt_update_qos_level(). - >> smt_task_imbalance instead of / 1000. - Remove the limit for odd -> even load balance, which solve the one NUMA load very high problem. - Rebased on the newest OLK-6.6 code. - Fix the build issue for QOS_LEVEL selected but CGROUP_SCHED or CFS_BANDWIDTH not selected. Jinjie Ruan (5): sched: Split out QOS_LEVEL from QOS_SCHED for reuse sched: Add qos_sched_enabled() helper for future expansion sched/fair: Add SMT QoS sched core code arm64: Add arch code for SMT QoS config: Enable SMT_QOS arch/arm64/Kconfig.turbo | 17 ++ arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/cpufeature.h | 5 + arch/arm64/include/asm/xint.h | 15 ++ arch/arm64/kernel/Makefile | 1 + arch/arm64/kernel/entry-common.c | 13 ++ arch/arm64/kernel/entry.S | 14 +- arch/arm64/kernel/smp.c | 23 +++ arch/arm64/kernel/smt_qos.c | 87 ++++++++++ arch/arm64/kernel/xcall/entry.S | 77 +++++++++ drivers/irqchip/irq-gic-v3.c | 38 +++++ include/linux/sched.h | 20 +++ init/Kconfig | 5 + kernel/sched/Makefile | 1 + kernel/sched/core.c | 20 +-- kernel/sched/fair.c | 83 ++++++++-- kernel/sched/features.h | 4 + kernel/sched/sched.h | 56 +++++-- kernel/sched/smt_qos.c | 216 +++++++++++++++++++++++++ 19 files changed, 655 insertions(+), 41 deletions(-) create mode 100644 arch/arm64/include/asm/xint.h create mode 100644 arch/arm64/kernel/smt_qos.c create mode 100644 kernel/sched/smt_qos.c -- 2.34.1

2 6

[PATCH OLK-6.6 v11 0/5] SMT QOS
by Jinjie Ruan 14 May '26

14 May '26

Cloud Service Provider deploy Best-Effort and Latency Sensitive tasks on the same physical core to maximize the resource utilization. We observe the LS task needs more cycles to complete the same workload due to the Microarchitectural resource contention. This feature control the instruction throughput of BE task into pipeline, so that the other SMT running LS task could occupy more uarch resources to reach better IPC. First split out QOS_LABEL from QOS_SCHED for SMT QoS reuse. The test results on 920G: | 1. online 30% | 基线 | 混布基线 | SMT QoS | | sched_wfi_timeout_us | \ | \ | 50 | | sched_smt_offline_util_pct | \ | \ | 50 | | P99 | 0.2 | 0.303 | 0.21 | | CPU utilization | 28.9% | 66.70% | 64.7% | | P99 regression percentage | \ | 51.5% | 5.00% | | spark CPEMAN | \ | 1.29 | 0.967 | | spark CPEMAN> regression | \ | \ | 25.04% | | 2. online 40% | 基线 | 混布基线 | SMT QoS | | sched_wfi_timeout_us | \ | \ | 50 | | sched_smt_offline_util_pct | \ | \ | 50 | | P99 | 0.21 | 0.286 | 0.206 | | CPU utilization | 40.0% | 69.30% | 65.5% | | P99 regression percentage | \ | 36.19% | -1.9% | | spark CPEMAN | \ | 1.03 | 0.661 | | spark CPEMAN> regression | \ | \ | 35.83% | | 3. online 48% | 基线 | 混布基线 | SMT QoS | | sched_wfi_timeout_us | \ | \ | 50 | | sched_smt_offline_util_pct | \ | \ | 50 | | P99 | 0.209 | 0.275 | 0.202 | | CPU utilization | 40.0% | 74.60% | 64.9% | | P99 regression percentage | \ | 31.58% | -3.35% | | spark CPEMAN | \ | 0.92 | 0.503 | | spark CPEMAN> regression | \ | \ | 45.33% | Changes in v11: - Fix `mrs x21,icc_iar1_el1' build issue. - Fix set_qos_task_select_cpus() "idlest_cpu" bug. - Fix restore_qos_task_select_cpus() smt_qos_enabled() check. - Use regs->orig_x0 instead of percpu cpu_iar. - Call arch_timer_get_cntfrq() once initially. - Remove extra qos_sched_enabled() check in qos_schedule_throttle(). - Move most smt qos code in fair.c to smt_qos.c. - Add smt_qos_enabled() check in smt_qos_update_sg_lb_stats() - Remove extra cpumask_copy() in set_qos_task_select_cpus(). - Add boundary case handling for when prefer_cpus is empty. Changes in v10: - Decouple QOS_SCHED_SMT_EXPELLER and QOS_SCHED scheduling logic with SMT_QOS. - Some cleanup. Changes in v9: - Also use SMT sibling CPU utilization NUMA level watermark for offline task cpu select to improve the 920G CPU utilization. Chanegs in v8: - Use SMT sibling CPU utilization NUMA level watermark instead of src cpu offline tasks migrate watermark on every load balance. Changes in v7: - Fix the prefer_cpu and select_cpus save/restore. - Extract can_smt_qos_migrate_task() helper from can_migrate_task(). - Update the names. - Update the arch code and remove the pmu code. - Add some comment. Changes in v6: - Rename QOS_LABEL to QOS_LEVEL. - Rename USER_WFXT to SMT_QOS. - Rename TAG_PULL to SMT_TAG_PULL. - Adjust the select cpu code which depends on QOS_SCHED_DYNAMIC_AFFINITY. - Distribute offline tasks to SMT sibling cores based on the configured proportion move to a separate patch. - Use cpumask_t for even_cpu_mask. - smt_throttle move to the arch patch. - pmu_smt_update_status() -> smt_update_qos_level(). - >> smt_task_imbalance instead of / 1000. - Remove the limit for odd -> even load balance, which solve the one NUMA load very high problem. - Rebased on the newest OLK-6.6 code. - Fix the build issue for QOS_LEVEL selected but CGROUP_SCHED or CFS_BANDWIDTH not selected. Jinjie Ruan (5): sched: Split out QOS_LEVEL from QOS_SCHED for reuse sched: Add qos_sched_enabled() helper for future expansion sched/fair: Add SMT QoS sched core code arm64: Add arch code for SMT QoS config: Enable SMT_QOS arch/arm64/Kconfig.turbo | 17 ++ arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/cpufeature.h | 5 + arch/arm64/include/asm/xint.h | 15 ++ arch/arm64/kernel/Makefile | 1 + arch/arm64/kernel/entry-common.c | 14 ++ arch/arm64/kernel/entry.S | 14 +- arch/arm64/kernel/smp.c | 23 +++ arch/arm64/kernel/smt_qos.c | 87 ++++++++++ arch/arm64/kernel/xcall/entry.S | 77 +++++++++ drivers/irqchip/irq-gic-v3.c | 38 +++++ include/linux/sched.h | 20 +++ init/Kconfig | 5 + kernel/sched/Makefile | 1 + kernel/sched/core.c | 20 +-- kernel/sched/fair.c | 83 ++++++++-- kernel/sched/features.h | 4 + kernel/sched/sched.h | 56 +++++-- kernel/sched/smt_qos.c | 216 +++++++++++++++++++++++++ 19 files changed, 656 insertions(+), 41 deletions(-) create mode 100644 arch/arm64/include/asm/xint.h create mode 100644 arch/arm64/kernel/smt_qos.c create mode 100644 kernel/sched/smt_qos.c -- 2.34.1

2 6

[PATCH OLK-5.10] ksmbd: require minimum ACE size in smb_check_perm_dacl()
by Li Lingfeng 14 May '26

14 May '26

From: Michael Bommarito <michael.bommarito(a)gmail.com> mainline inclusion from mainline-v7.1-rc1 commit d07b26f39246a82399661936dd0c853983cfade7 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14462 CVE: CVE-2026-31712 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Both ACE-walk loops in smb_check_perm_dacl() only guard against an under-sized remaining buffer, not against an ACE whose declared `ace->size` is smaller than the struct it claims to describe: if (offsetof(struct smb_ace, access_req) > aces_size) break; ace_size = le16_to_cpu(ace->size); if (ace_size > aces_size) break; The first check only requires the 4-byte ACE header to be in bounds; it does not require access_req (4 bytes at offset 4) to be readable. An attacker who has set a crafted DACL on a file they own can declare ace->size == 4 with aces_size == 4, pass both checks, and then granted |= le32_to_cpu(ace->access_req); /* upper loop */ compare_sids(&sid, &ace->sid); /* lower loop */ reads access_req at offset 4 (OOB by up to 4 bytes) and ace->sid at offset 8 (OOB by up to CIFS_SID_BASE_SIZE + SID_MAX_SUB_AUTHORITIES * 4 bytes). Tighten both loops to require ace_size >= offsetof(struct smb_ace, sid) + CIFS_SID_BASE_SIZE which is the smallest valid on-wire ACE layout (4-byte header + 4-byte access_req + 8-byte sid base with zero sub-auths). Also reject ACEs whose sid.num_subauth exceeds SID_MAX_SUB_AUTHORITIES before letting compare_sids() dereference sub_auth[] entries. parse_sec_desc() already enforces an equivalent check (lines 441-448); smb_check_perm_dacl() simply grew weaker validation over time. Reachability: authenticated SMB client with permission to set an ACL on a file. On a subsequent CREATE against that file, the kernel walks the stored DACL via smb_check_perm_dacl() and triggers the OOB read. Not pre-auth, and the OOB read is not reflected to the attacker, but KASAN reports and kernel state corruption are possible. Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") Cc: stable(a)vger.kernel.org Assisted-by: Claude:claude-opus-4-6 Assisted-by: Codex:gpt-5-4 Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Acked-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/server/smbacl.c [Commit 62e7dd0a39c2d0d7ff03274c36df971f1b3d2d0d ("smb: common: change the data type of num_aces to le16") change the data type of num_aces to le16.] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/ksmbd/smbacl.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/fs/ksmbd/smbacl.c b/fs/ksmbd/smbacl.c index 3368a4e73773..b23b725cf8c3 100644 --- a/fs/ksmbd/smbacl.c +++ b/fs/ksmbd/smbacl.c @@ -1258,10 +1258,13 @@ int smb_check_perm_dacl(struct ksmbd_conn *conn, struct path *path, ace = (struct smb_ace *)((char *)pdacl + sizeof(struct smb_acl)); aces_size = acl_size - sizeof(struct smb_acl); for (i = 0; i < le32_to_cpu(pdacl->num_aces); i++) { - if (offsetof(struct smb_ace, access_req) > aces_size) + if (offsetof(struct smb_ace, sid) + + aces_size < CIFS_SID_BASE_SIZE) break; ace_size = le16_to_cpu(ace->size); - if (ace_size > aces_size) + if (ace_size > aces_size || + ace_size < offsetof(struct smb_ace, sid) + + CIFS_SID_BASE_SIZE) break; aces_size -= ace_size; granted |= le32_to_cpu(ace->access_req); @@ -1279,13 +1282,19 @@ int smb_check_perm_dacl(struct ksmbd_conn *conn, struct path *path, ace = (struct smb_ace *)((char *)pdacl + sizeof(struct smb_acl)); aces_size = acl_size - sizeof(struct smb_acl); for (i = 0; i < le32_to_cpu(pdacl->num_aces); i++) { - if (offsetof(struct smb_ace, access_req) > aces_size) + if (offsetof(struct smb_ace, sid) + + aces_size < CIFS_SID_BASE_SIZE) break; ace_size = le16_to_cpu(ace->size); - if (ace_size > aces_size) + if (ace_size > aces_size || + ace_size < offsetof(struct smb_ace, sid) + + CIFS_SID_BASE_SIZE) break; aces_size -= ace_size; + if (ace->sid.num_subauth > SID_MAX_SUB_AUTHORITIES) + break; + if (!compare_sids(&sid, &ace->sid) || !compare_sids(&sid_unix_NFS_mode, &ace->sid)) { found = 1; -- 2.52.0

2 1

[PATCH OLK-6.6] bpf-rvi: Fix possible AA deadlock pidns_list_lock
by Gu Bowen 14 May '26

14 May '26

hulk inclusion category: bugfix bugzilla: -------------------------------- Spin lock pidns_list_lock is used in both process context and bottom half, which may cause the AA deadlock issue. Replace spin_lock with spin_lock_bh to resolve this problem. Call trace: native_queued_spin_lock_slowpath+0x71/0x428 destroy_pid_namespace+0x100/0x110 put_pid_ns+0x90/0xc8 put_pid+0x8c/0xc8 delayed_put_pid+0x1c/0x30 rcu_do_batch+0x164/0x580 rcu_core+0x130/0x2b8 rcu_core_si+0x18/0x30 handle_softirqs+0x120/0x328 __do_softirq+0x1c/0x28 ____do_softirq+0x18/0x30 call_on_irq_stack+0x30/0x48 do_softirq_own_stack+0x24/0x38 irq_exit_rcu+0x108/0x130 el1_interrupt+0x54/0x130 el1h_64_irq_handler+0x24/0x30 el1h_64_irq+0x78/0x80 create_pid_namespace+0x214/0x3c0 copy_pid_ns+0x90/0xf0 create_new_namespaces+0xc8/0x368 unshare_nsproxy_namespaces+0x6c/0xc0 ksys_unshare+0x130/0x418 __arm64_sys_unshare+0x1c/0x38 invoke_syscall+0x50/0x128 el0_svc_common.constprop.0+0x48/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x44/0x1e8 el0t_64_sync_handler+0xc0/0xc8 el0t_64_sync+0x3c8/0x3d0 Fixes: d758abf3762c ("bpf-rvi: pidns: Calculate loadavg for each pid namespace") Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- kernel/pid_namespace.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c index b321c02f382e..0bfd9ff3a6b8 100644 --- a/kernel/pid_namespace.c +++ b/kernel/pid_namespace.c @@ -128,9 +128,9 @@ static struct pid_namespace *create_pid_namespace(struct user_namespace *user_ns ns->loadavg = kmem_cache_zalloc(pidns_loadavg_cachep, GFP_KERNEL); if (ns->loadavg == NULL) goto out_free_idr; - spin_lock(&pidns_list_lock); + spin_lock_bh(&pidns_list_lock); list_add_tail(&ns->loadavg->list, &init_pidns_loadavg.list); - spin_unlock(&pidns_list_lock); + spin_unlock_bh(&pidns_list_lock); #endif return ns; @@ -164,9 +164,9 @@ static void destroy_pid_namespace(struct pid_namespace *ns) * ns->loadavg's lifecycle aligns precisely with ns, * so don't need RCU delayed free. */ - spin_lock(&pidns_list_lock); + spin_lock_bh(&pidns_list_lock); list_del(&ns->loadavg->list); - spin_unlock(&pidns_list_lock); + spin_unlock_bh(&pidns_list_lock); kmem_cache_free(pidns_loadavg_cachep, ns->loadavg); #endif call_rcu(&ns->rcu, delayed_free_pidns); @@ -537,13 +537,13 @@ static void pidns_list_reset(void) { struct list_head *pos, *tmp; - spin_lock(&pidns_list_lock); + spin_lock_bh(&pidns_list_lock); list_for_each_safe(pos, tmp, &init_pidns_loadavg.list) { struct pidns_loadavg *entry = list_entry(pos, struct pidns_loadavg, list); entry->load_tasks = 0; // reset } - spin_unlock(&pidns_list_lock); + spin_unlock_bh(&pidns_list_lock); } static void pidns_update_load_tasks(void) @@ -574,7 +574,7 @@ static void pidns_calc_avenrun(void) { struct list_head *pos; - spin_lock(&pidns_list_lock); + spin_lock_bh(&pidns_list_lock); /* * As the loadavg of init_pid_ns is exactly /proc/loadavg, avoid redundant * re-calculation for init_pid_ns, and reuse init_pidns_loadavg.list as the @@ -590,7 +590,7 @@ static void pidns_calc_avenrun(void) entry->avenrun[1] = calc_load(entry->avenrun[1], EXP_5, active); entry->avenrun[2] = calc_load(entry->avenrun[2], EXP_15, active); } - spin_unlock(&pidns_list_lock); + spin_unlock_bh(&pidns_list_lock); } static void pidns_calc_loadavg_workfn(struct work_struct *work) -- 2.43.0

2 1

[PATCH OLK-6.6] cifs: some missing initializations on replay
by Li Lingfeng 14 May '26

14 May '26

From: Shyam Prasad N <sprasad(a)microsoft.com> stable inclusion from stable-v6.6.128 commit c854ab481ece4b3e5f4c2e8b22824f015ff874a5 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14443 CVE: CVE-2026-31693 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 14f66f44646333d2bfd7ece36585874fd72f8286 ] In several places in the code, we have a label to signify the start of the code where a request can be replayed if necessary. However, some of these places were missing the necessary reinitializations of certain local variables before replay. This change makes sure that these variables get initialized after the label. Cc: stable(a)vger.kernel.org Reported-by: Yuchan Nam <entropy1110(a)gmail.com> Tested-by: Yuchan Nam <entropy1110(a)gmail.com> Signed-off-by: Shyam Prasad N <sprasad(a)microsoft.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/smb/client/smb2ops.c | 2 ++ fs/smb/client/smb2pdu.c | 1 + 2 files changed, 3 insertions(+) diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c index 40eea0b2f48b..324d2382dfef 100644 --- a/fs/smb/client/smb2ops.c +++ b/fs/smb/client/smb2ops.c @@ -1147,6 +1147,7 @@ smb2_set_ea(const unsigned int xid, struct cifs_tcon *tcon, replay_again: /* reinitialize for possible replay */ + used_len = 0; flags = CIFS_CP_CREATE_CLOSE_OP; oplock = SMB2_OPLOCK_LEVEL_NONE; server = cifs_pick_channel(ses); @@ -1545,6 +1546,7 @@ smb2_ioctl_query_info(const unsigned int xid, replay_again: /* reinitialize for possible replay */ + buffer = NULL; flags = CIFS_CP_CREATE_CLOSE_OP; oplock = SMB2_OPLOCK_LEVEL_NONE; server = cifs_pick_channel(ses); diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c index 493e4ae3842a..dbee701a478a 100644 --- a/fs/smb/client/smb2pdu.c +++ b/fs/smb/client/smb2pdu.c @@ -2851,6 +2851,7 @@ int smb311_posix_mkdir(const unsigned int xid, struct inode *inode, replay_again: /* reinitialize for possible replay */ + pc_buf = NULL; flags = 0; n_iov = 2; server = cifs_pick_channel(ses); -- 2.52.0

2 1

[PATCH OLK-6.6 v3 0/3] optimize copy_from_user
by Qi Xi 14 May '26

14 May '26

This patchset adds an optimized copy_from_user path for Hisilicon HIP11/HIP12/Linxicore9100, using ldp/stp instructions with PAN temporarily disabled during the copy. Patch 1 adds the HIP11 MIDR definition. Patch 2 implements the optimized path and the raw_copy_from_user routing. Patch 3 adds CONFIG_ARM64_COPY_FROM_USER_OPT compile-time gating. v3 changes: - add CONFIG_ARM64_COPY_FROM_USER_OPT to openeuler_defconfig v2 changes: - add HISI_CPU_PART_HIP11 - merge the asm implementation and the uaccess.h routing into a single patch to avoid bisect breakage - fix compile error when CONFIG_ARM64_COPY_FROM_USER_OPT=n Qi Xi (3): arm64: cputype: Add CPU type for HISI_CPU_PART_HIP11 arm64: uaccess: add optimized copy_from_user for Hisilicon platforms arm64: uaccess: add CONFIG control for copy_from_user_opt .../admin-guide/kernel-parameters.txt | 6 + arch/arm64/Kconfig.turbo | 11 + arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/asm-uaccess.h | 11 + arch/arm64/include/asm/cputype.h | 2 + arch/arm64/include/asm/uaccess.h | 30 ++- arch/arm64/kernel/cpufeature.c | 36 ++++ arch/arm64/lib/copy_from_user.S | 36 ++++ arch/arm64/lib/copy_template_opt.S | 189 ++++++++++++++++++ arch/arm64/tools/cpucaps | 2 +- tools/arch/arm64/include/asm/cputype.h | 2 + 11 files changed, 323 insertions(+), 3 deletions(-) create mode 100644 arch/arm64/lib/copy_template_opt.S -- 2.33.0

2 4

[PATCH OLK-6.6] cifs: some missing initializations on replay
by Li Lingfeng 14 May '26

14 May '26

From: Shyam Prasad N <sprasad(a)microsoft.com> stable inclusion from stable-v6.6.128 commit c854ab481ece4b3e5f4c2e8b22824f015ff874a5 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8792 CVE: CVE-2026-31693 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 14f66f44646333d2bfd7ece36585874fd72f8286 ] In several places in the code, we have a label to signify the start of the code where a request can be replayed if necessary. However, some of these places were missing the necessary reinitializations of certain local variables before replay. This change makes sure that these variables get initialized after the label. Cc: stable(a)vger.kernel.org Reported-by: Yuchan Nam <entropy1110(a)gmail.com> Tested-by: Yuchan Nam <entropy1110(a)gmail.com> Signed-off-by: Shyam Prasad N <sprasad(a)microsoft.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/smb/client/smb2ops.c | 2 ++ fs/smb/client/smb2pdu.c | 1 + 2 files changed, 3 insertions(+) diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c index 40eea0b2f48b..324d2382dfef 100644 --- a/fs/smb/client/smb2ops.c +++ b/fs/smb/client/smb2ops.c @@ -1147,6 +1147,7 @@ smb2_set_ea(const unsigned int xid, struct cifs_tcon *tcon, replay_again: /* reinitialize for possible replay */ + used_len = 0; flags = CIFS_CP_CREATE_CLOSE_OP; oplock = SMB2_OPLOCK_LEVEL_NONE; server = cifs_pick_channel(ses); @@ -1545,6 +1546,7 @@ smb2_ioctl_query_info(const unsigned int xid, replay_again: /* reinitialize for possible replay */ + buffer = NULL; flags = CIFS_CP_CREATE_CLOSE_OP; oplock = SMB2_OPLOCK_LEVEL_NONE; server = cifs_pick_channel(ses); diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c index 493e4ae3842a..dbee701a478a 100644 --- a/fs/smb/client/smb2pdu.c +++ b/fs/smb/client/smb2pdu.c @@ -2851,6 +2851,7 @@ int smb311_posix_mkdir(const unsigned int xid, struct inode *inode, replay_again: /* reinitialize for possible replay */ + pc_buf = NULL; flags = 0; n_iov = 2; server = cifs_pick_channel(ses); -- 2.52.0

2 1

[PATCH OLK-5.10] smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path
by Li Lingfeng 14 May '26

14 May '26

From: Michael Bommarito <michael.bommarito(a)gmail.com> mainline inclusion from mainline-v7.1-rc1 commit a58c5af19ff0d6f44f6e9fe31e33a2c92223f77e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14458 CVE: CVE-2026-31708 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- smb2_ioctl_query_info() has two response-copy branches: PASSTHRU_FSCTL and the default QUERY_INFO path. The QUERY_INFO branch clamps qi.input_buffer_length to the server-reported OutputBufferLength and then copies qi.input_buffer_length bytes from qi_rsp->Buffer to userspace, but it never verifies that the flexible-array payload actually fits within rsp_iov[1].iov_len. A malicious server can return OutputBufferLength larger than the actual QUERY_INFO response, causing copy_to_user() to walk past the response buffer and expose adjacent kernel heap to userspace. Guard the QUERY_INFO copy with a bounds check on the actual Buffer payload. Use struct_size(qi_rsp, Buffer, qi.input_buffer_length) rather than an open-coded addition so the guard cannot overflow on 32-bit builds. Fixes: f5778c398713 ("SMB3: Allow SMB3 FSCTL queries to be sent to server from tools") Cc: stable(a)vger.kernel.org Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Assisted-by: Claude:claude-opus-4-6 Assisted-by: Codex:gpt-5-4 Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/client/smb2ops.c [Commit 38c8a9a52082579090e34c033d439ed2cd1a462d ("smb: move client and server files to common directory fs/smb") move fs/cifs/smb2ops.c to fs/smb/client/smb2ops.c.] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/cifs/smb2ops.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c index e3f96a99a4d5..f46c99b61c04 100644 --- a/fs/cifs/smb2ops.c +++ b/fs/cifs/smb2ops.c @@ -1731,6 +1731,12 @@ smb2_ioctl_query_info(const unsigned int xid, qi_rsp = (struct smb2_query_info_rsp *)rsp_iov[1].iov_base; if (le32_to_cpu(qi_rsp->OutputBufferLength) < qi.input_buffer_length) qi.input_buffer_length = le32_to_cpu(qi_rsp->OutputBufferLength); + if (qi.input_buffer_length > 0 && + struct_size(qi_rsp, Buffer, qi.input_buffer_length) > + rsp_iov[1].iov_len) { + rc = -EFAULT; + goto out; + } if (copy_to_user(&pqi->input_buffer_length, &qi.input_buffer_length, sizeof(qi.input_buffer_length))) { -- 2.52.0

2 1

[PATCH OLK-6.6] smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path
by Li Lingfeng 14 May '26

14 May '26

From: Michael Bommarito <michael.bommarito(a)gmail.com> stable inclusion from stable-v6.6.136 commit a34d456934fe42e4da5d2cc07787bf418bee99c6 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14458 CVE: CVE-2026-31708 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit a58c5af19ff0d6f44f6e9fe31e33a2c92223f77e upstream. smb2_ioctl_query_info() has two response-copy branches: PASSTHRU_FSCTL and the default QUERY_INFO path. The QUERY_INFO branch clamps qi.input_buffer_length to the server-reported OutputBufferLength and then copies qi.input_buffer_length bytes from qi_rsp->Buffer to userspace, but it never verifies that the flexible-array payload actually fits within rsp_iov[1].iov_len. A malicious server can return OutputBufferLength larger than the actual QUERY_INFO response, causing copy_to_user() to walk past the response buffer and expose adjacent kernel heap to userspace. Guard the QUERY_INFO copy with a bounds check on the actual Buffer payload. Use struct_size(qi_rsp, Buffer, qi.input_buffer_length) rather than an open-coded addition so the guard cannot overflow on 32-bit builds. Fixes: f5778c398713 ("SMB3: Allow SMB3 FSCTL queries to be sent to server from tools") Cc: stable(a)vger.kernel.org Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Assisted-by: Claude:claude-opus-4-6 Assisted-by: Codex:gpt-5-4 Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/smb/client/smb2ops.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c index 40eea0b2f48b..b833bbf8e7fa 100644 --- a/fs/smb/client/smb2ops.c +++ b/fs/smb/client/smb2ops.c @@ -1730,6 +1730,12 @@ smb2_ioctl_query_info(const unsigned int xid, qi_rsp = (struct smb2_query_info_rsp *)rsp_iov[1].iov_base; if (le32_to_cpu(qi_rsp->OutputBufferLength) < qi.input_buffer_length) qi.input_buffer_length = le32_to_cpu(qi_rsp->OutputBufferLength); + if (qi.input_buffer_length > 0 && + struct_size(qi_rsp, Buffer, qi.input_buffer_length) > + rsp_iov[1].iov_len) { + rc = -EFAULT; + goto out; + } if (copy_to_user(&pqi->input_buffer_length, &qi.input_buffer_length, sizeof(qi.input_buffer_length))) { -- 2.52.0

2 1

[PATCH OLK-6.6] net: ipa: fix event ring index not programmed for IPA v5.0+
by Wupeng Ma 14 May '26

14 May '26

From: Alexander Koskovich <akoskovich(a)pm.me> stable inclusion from stable-v6.6.136 commit ae8343a19ccb051d519dbb3a9082ddea9f0551d3 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14903 CVE: CVE-2026-43345 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 56007972c0b1e783ca714d6f1f4d6e66e531d21f ] For IPA v5.0+, the event ring index field moved from CH_C_CNTXT_0 to CH_C_CNTXT_1. The v5.0 register definition intended to define this field in the CH_C_CNTXT_1 fmask array but used the old identifier of ERINDEX instead of CH_ERINDEX. Without a valid event ring, GSI channels could never signal transfer completions. This caused gsi_channel_trans_quiesce() to block forever in wait_for_completion(). At least for IPA v5.2 this resolves an issue seen where runtime suspend, system suspend, and remoteproc stop all hanged forever. It also meant the IPA data path was completely non functional. Fixes: faf0678ec8a0 ("net: ipa: add IPA v5.0 GSI register definitions") Signed-off-by: Alexander Koskovich <akoskovich(a)pm.me> Signed-off-by: Luca Weiss <luca.weiss(a)fairphone.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://patch.msgid.link/20260403-milos-ipa-v1-2-01e9e4e03d3e@fairphone.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- drivers/net/ipa/reg/gsi_reg-v5.0.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ipa/reg/gsi_reg-v5.0.c b/drivers/net/ipa/reg/gsi_reg-v5.0.c index 145eb0bd096d..ff71a95557c7 100644 --- a/drivers/net/ipa/reg/gsi_reg-v5.0.c +++ b/drivers/net/ipa/reg/gsi_reg-v5.0.c @@ -28,7 +28,7 @@ REG_STRIDE_FIELDS(CH_C_CNTXT_0, ch_c_cntxt_0, static const u32 reg_ch_c_cntxt_1_fmask[] = { [CH_R_LENGTH] = GENMASK(23, 0), - [ERINDEX] = GENMASK(31, 24), + [CH_ERINDEX] = GENMASK(31, 24), }; REG_STRIDE_FIELDS(CH_C_CNTXT_1, ch_c_cntxt_1, -- 2.43.0

2 1

[PATCH OLK-6.6 v2 0/3] optimize copy_from_user
by Qi Xi 14 May '26

14 May '26

This patchset adds an optimized copy_from_user path for Hisilicon HIP11/HIP12/Linxicore9100, using ldp/stp instructions with PAN temporarily disabled during the copy. Patch 1 adds the HIP11 MIDR definition. Patch 2 implements the optimized path and the raw_copy_from_user routing. Patch 3 adds CONFIG_ARM64_COPY_FROM_USER_OPT compile-time gating. v2 changes: - add HISI_CPU_PART_HIP11 - merge the asm implementation and the uaccess.h routing into a single patch to avoid bisect breakage - fix compile error when CONFIG_ARM64_COPY_FROM_USER_OPT=n Qi Xi (3): arm64: cputype: Add CPU type for HISI_CPU_PART_HIP11 arm64: uaccess: add optimized copy_from_user for Hisilicon platforms arm64: uaccess: add CONFIG control for copy_from_user_opt .../admin-guide/kernel-parameters.txt | 6 + arch/arm64/Kconfig | 11 + arch/arm64/include/asm/asm-uaccess.h | 11 + arch/arm64/include/asm/cputype.h | 2 + arch/arm64/include/asm/uaccess.h | 30 ++- arch/arm64/kernel/cpufeature.c | 36 ++++ arch/arm64/lib/copy_from_user.S | 36 ++++ arch/arm64/lib/copy_template_opt.S | 189 ++++++++++++++++++ arch/arm64/tools/cpucaps | 2 +- tools/arch/arm64/include/asm/cputype.h | 2 + 10 files changed, 322 insertions(+), 3 deletions(-) create mode 100644 arch/arm64/lib/copy_template_opt.S -- 2.33.0

2 4

[PATCH OLK-6.6 00/36] perf arm-spe: Extend branch operations
by Yushan Wang 14 May '26

14 May '26

From: Ying Jiang<jiangying44(a)h-partners.com> In Arm ARM (ARM DDI 0487, L.a), the section "D18.2.7 Operation Type packet", the branch subclass is extended for Call Return (CR), Guarded control stack data access (GCS). This commit adds support CR and GCS operations. The IND (indirect) operation is defined only in bit [1], its macro is updated accordingly. Move the COND (Conditional) macro into the same group with other operations for better maintenance. Anshuman Khandual (9): arm64: Handle BRBE booting requirements arm64/sysreg: Update register fields for ID_AA64MMFR0_EL1 arm64/sysreg: Add register fields for HDFGRTR2_EL2 arm64/sysreg: Add register fields for HDFGWTR2_EL2 arm64/sysreg: Add register fields for HFGITR2_EL2 arm64/sysreg: Add register fields for HFGRTR2_EL2 arm64/sysreg: Add register fields for HFGWTR2_EL2 arm64/sysreg: Update ID_DFR0_EL1 register fields arm64/boot: Enable EL2 requirements for FEAT_PMUv3p9 Dave Martin (1): arm64: el2_setup.h: Rename some labels to be more diff-friendly James Clark (12): perf: arm_spe: Add format option for discard mode arm64: sysreg: Add new PMSFCR_EL1 fields and PMSDSFR_EL1 register perf: arm_spe: Support FEAT_SPEv1p4 filters perf: arm_spe: Add support for FEAT_SPE_EFT extended filtering arm64/boot: Factor out a macro to check SPE version arm64/boot: Enable EL2 requirements for SPE_FEAT_FDS KVM: arm64: Add trap configs for PMSDSFR_EL1 perf: Add perf_event_attr::config4 perf: arm_spe: Add support for filtering on data source tools headers UAPI: Sync linux/perf_event.h with the kernel sources perf tools: Add support for perf_event_attr::config4 perf docs: arm-spe: Document new SPE filtering features Leo Yan (1): perf: arm_spe: Expose event filter Marc Zyngier (5): KVM: arm64: Shave a few bytes from the EL2 idmap code arm64/sysreg: Allow a 'Mapping' descriptor for system registers arm64: sysreg: Add registers trapped by HDFG{R,W}TR2_EL2 KVM: arm64: nv: Add include containing the VNCR_EL2 offsets arm64: sysreg: Update PMSIDR_EL1 description Rob Herring (Arm) (4): arm64: el2_setup.h: Make __init_el2_fgt labels consistent, again perf/arm_pmuv3: Add PMUv3.9 per counter EL0 access control perf: arm_pmu: Use of_property_present() perf: arm_pmu: Remove event index to counter remapping Yushan Wang (4): Revert "arm64/boot: Enable EL2 requirements for BRBE" perf: Fix hw_metric event idx config perf: Keep event consistency of hw_metric events arm_pmuv3: hw_metric: Remove unnecessary check of event type Documentation/arch/arm64/booting.rst | 75 +++- arch/arm64/include/asm/el2_setup.h | 130 +++--- arch/arm64/include/asm/kvm_asm.h | 1 + arch/arm64/include/asm/sysreg.h | 19 +- arch/arm64/include/asm/vncr_mapping.h | 105 +++++ arch/arm64/kernel/asm-offsets.c | 1 + arch/arm64/kvm/emulate-nested.c | 1 + arch/arm64/kvm/hyp/nvhe/hyp-init.S | 52 ++- arch/arm64/kvm/pmu-emul.c | 6 +- arch/arm64/kvm/sys_regs.c | 1 + arch/arm64/tools/gen-sysreg.awk | 2 +- arch/arm64/tools/sysreg | 502 +++++++++++++++++++++- drivers/perf/apple_m1_cpu_pmu.c | 4 +- drivers/perf/arm_pmu.c | 11 +- drivers/perf/arm_pmu_platform.c | 2 +- drivers/perf/arm_pmuv3.c | 68 +-- drivers/perf/arm_spe_pmu.c | 170 +++++++- include/linux/perf/arm_pmu.h | 2 +- include/linux/perf/arm_pmuv3.h | 1 + include/uapi/linux/perf_event.h | 4 + tools/include/uapi/linux/perf_event.h | 2 + tools/perf/Documentation/perf-arm-spe.txt | 103 ++++- tools/perf/tests/parse-events.c | 14 +- tools/perf/util/parse-events.c | 11 + tools/perf/util/parse-events.h | 1 + tools/perf/util/parse-events.l | 1 + tools/perf/util/pmu.c | 3 + tools/perf/util/pmu.h | 1 + 28 files changed, 1098 insertions(+), 195 deletions(-) create mode 100644 arch/arm64/include/asm/vncr_mapping.h -- 2.33.0

2 37

[PATCH OLK-5.10 0/7] net/oenetcls: RPS enhancements and bug fixes
by Li Xiasong 13 May '26

13 May '26

This series introduces several RPS (Receive Packet Steering) enhancements for oenetcls, including NUMA-aware flow scheduling, IPv6 ntuple support, RXQ multiplexing, and phy NIC policy switch, along with bug fixes for hash collision and limiting rxqs against combined_channels. Yue Haibing (7): net/oenetcls: Fix possible hash collision issue net/oenetcls: Add local flow NUMA-aware rps net/oenetcls: Supports rxq multiplexing net/oenetcls: Support ipv6 for ntuple mode net/oenetcls: Make OENETCLS default as module net/oenetcls: Add rps policy switch for phy NIC net/oenetcls: Limit rxqs against combined_channels include/linux/oenetcls.h | 38 ++++- include/linux/skbuff.h | 4 + include/net/sock.h | 4 + net/core/dev.c | 8 + net/core/sock.c | 3 + net/ipv4/tcp.c | 5 +- net/oenetcls/Kconfig | 11 +- net/oenetcls/oenetcls.h | 28 +++- net/oenetcls/oenetcls_flow.c | 284 ++++++++++++++++++++++++--------- net/oenetcls/oenetcls_main.c | 154 +++++++++++++----- net/oenetcls/oenetcls_ntuple.c | 255 ++++++++++++++++++----------- 11 files changed, 567 insertions(+), 227 deletions(-) -- 2.34.1

2 8

[PATCH OLK-6.6 v7 0/4] optimize copy_from_user
by Qi Xi 13 May '26

13 May '26

v7 changes: - add HISI_CPU_PART_HIP11 v6 changes: - rename cmdline param "copy_opt=off" to "copy_opt_disable" v5 changes: - replace cpus_have_const_cap with alternative_has_cap_unlikely v4 changes: - handle copy_opt=off via has_copy_opt() to clear ARM64_HAS_COPY_OPT v3 changes: - Introduce CONFIG_ARM64_COPY_FROM_USER_OPT and a "copy_opt=off" cmdline parameter to disable it. v2 changes: - Merge patch 1 and 2 into a single feature patch that adds the optimized copy_from_user implementation. - Change cpufeature description and delete unnecessary pr_info. Qi Xi (4): arm64: cputype: Add CPU type for HISI_CPU_PART_HIP11 arm64: lib: add __arch_copy_from_user_opt with index-addressed ldp/stp arm64: uaccess: enable optimized copy_from_user for >= 4kb copies arm64: uaccess: add CONFIG control for copy_from_user_opt .../admin-guide/kernel-parameters.txt | 6 + arch/arm64/Kconfig | 11 + arch/arm64/include/asm/asm-uaccess.h | 7 + arch/arm64/include/asm/cputype.h | 2 + arch/arm64/include/asm/uaccess.h | 31 ++- arch/arm64/kernel/cpufeature.c | 35 ++++ arch/arm64/lib/copy_from_user.S | 36 ++++ arch/arm64/lib/copy_template_opt.S | 189 ++++++++++++++++++ arch/arm64/tools/cpucaps | 2 +- tools/arch/arm64/include/asm/cputype.h | 2 + 10 files changed, 318 insertions(+), 3 deletions(-) create mode 100644 arch/arm64/lib/copy_template_opt.S -- 2.33.0

2 5

[PATCH OLK-6.6] Revert "!21796 [OLK-6.6] x86/mce/zhaoxin: Enable mcelog to decode PCIE, ZDI/ZPI, and DRAM errors"
by Tengda Wu 13 May '26

13 May '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9160 -------------------------------- This reverts commit f9b4fa77d0c477fbaebfdebd1259e387b88824da, reversing changes made to 6bcb72eb0f8795e6d0f89c92d5797672c28ab641. The commit 6bcb72eb0f87 has introduced a kernel build error: In function ‘zx_apei_mce_report_mem_error’: arch/x86/kernel/cpu/mce/apei.c:79:9: error: implicit declaration of function ‘mce_setup’; did you mean ‘memset_p’? [-Werror=implicit-function-declaration] 79 | mce_setup(&m); | ^~~~~~~~~ | memset_p arch/x86/kernel/cpu/mce/apei.c:130:17: error: passing argument 1 of ‘mce_log’ from incompatible pointer type [-Werror=incompatible-pointer-types] 130 | mce_log(&m); | ^~ | | | struct mce * Temporarily revert to mitigate. Fixes: 6bcb72eb0f87 ("!21795 [OLK-6.6] efi/cper: Add Zhaoxin mem error decode for KH-50000") Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- arch/x86/include/asm/mce.h | 6 -- arch/x86/kernel/acpi/apei.c | 28 +----- arch/x86/kernel/cpu/mce/apei.c | 167 --------------------------------- drivers/acpi/apei/apei-base.c | 11 --- drivers/acpi/apei/ghes.c | 34 +------ include/acpi/apei.h | 2 - 6 files changed, 5 insertions(+), 243 deletions(-) diff --git a/arch/x86/include/asm/mce.h b/arch/x86/include/asm/mce.h index ce4ffe3d844c..a795f963da1f 100644 --- a/arch/x86/include/asm/mce.h +++ b/arch/x86/include/asm/mce.h @@ -336,12 +336,6 @@ struct cper_sec_mem_err; extern void apei_mce_report_mem_error(int corrected, struct cper_sec_mem_err *mem_err); -extern void zx_apei_mce_report_mem_error(struct cper_sec_mem_err *mem_err); -struct cper_sec_pcie; -extern void zx_apei_mce_report_pcie_error(int corrected, struct cper_sec_pcie *pcie_err); -struct cper_sec_proc_generic; -extern void zx_apei_mce_report_zdi_error(struct cper_sec_proc_generic *zdi_err); - /* * Enumerate new IP types and HWID values in AMD processors which support * Scalable MCA. diff --git a/arch/x86/kernel/acpi/apei.c b/arch/x86/kernel/acpi/apei.c index 7cb88cd5b9d3..e21419e686eb 100644 --- a/arch/x86/kernel/acpi/apei.c +++ b/arch/x86/kernel/acpi/apei.c @@ -42,36 +42,10 @@ int arch_apei_enable_cmcff(struct acpi_hest_header *hest_hdr, void *data) void arch_apei_report_mem_error(int sev, struct cper_sec_mem_err *mem_err) { #ifdef CONFIG_X86_MCE - if (boot_cpu_data.x86_vendor == X86_VENDOR_ZHAOXIN || - boot_cpu_data.x86_vendor == X86_VENDOR_CENTAUR) - zx_apei_mce_report_mem_error(mem_err); - else - apei_mce_report_mem_error(sev, mem_err); + apei_mce_report_mem_error(sev, mem_err); #endif } -void arch_apei_report_pcie_error(int sev, struct cper_sec_pcie *pcie_err) -{ -#ifdef CONFIG_X86_MCE - if (boot_cpu_data.x86_vendor == X86_VENDOR_ZHAOXIN || - boot_cpu_data.x86_vendor == X86_VENDOR_CENTAUR) - zx_apei_mce_report_pcie_error(sev, pcie_err); -#endif -} - -bool arch_apei_report_zdi_error(guid_t *sec_type, struct cper_sec_proc_generic *zdi_err) -{ -#ifdef CONFIG_X86_MCE - if ((boot_cpu_data.x86_vendor == X86_VENDOR_CENTAUR || - boot_cpu_data.x86_vendor == X86_VENDOR_ZHAOXIN) && - (guid_equal(sec_type, &CPER_SEC_PROC_GENERIC))) { - zx_apei_mce_report_zdi_error(zdi_err); - return true; - } -#endif - return false; -} - int arch_apei_report_x86_error(struct cper_ia_proc_ctx *ctx_info, u64 lapic_id) { return apei_smca_report_x86_error(ctx_info, lapic_id); diff --git a/arch/x86/kernel/cpu/mce/apei.c b/arch/x86/kernel/cpu/mce/apei.c index bdf895a7c38e..7f582b4ca1ca 100644 --- a/arch/x86/kernel/cpu/mce/apei.c +++ b/arch/x86/kernel/cpu/mce/apei.c @@ -65,173 +65,6 @@ void apei_mce_report_mem_error(int severity, struct cper_sec_mem_err *mem_err) } EXPORT_SYMBOL_GPL(apei_mce_report_mem_error); -void zx_apei_mce_report_mem_error(struct cper_sec_mem_err *mem_err) -{ - struct mce m; - int apei_error = 0; - - if (boot_cpu_data.x86 != 7 || boot_cpu_data.x86_model != 91) - return; - - if (!(mem_err->validation_bits & CPER_MEM_VALID_PA)) - return; - - mce_setup(&m); - m.misc = 0; - m.misc = mem_err->module; - m.addr = mem_err->physical_addr; - if (mem_err->card == 0) - m.bank = 9; - else - m.bank = 10; - - switch (mem_err->error_type) { - case 2: - m.status = 0x9c20004000010080; - break; - case 3: - m.status = 0xbe40000000020090; - apei_error = apei_write_mce(&m); - break; - case 8: - if (mem_err->requestor_id == 2) { - m.status = 0x98200040000400b0; - } else if (mem_err->requestor_id == 3) { - m.status = 0xba400000000600a0; - apei_error = apei_write_mce(&m); - } else if (mem_err->requestor_id == 4) { - m.status = 0x98200100000300b0; - } else if (mem_err->requestor_id == 5) { - m.status = 0xba000000000500b0; - apei_error = apei_write_mce(&m); - } else { - pr_info("Undefined Parity error\n"); - } - break; - case 10: - if (mem_err->requestor_id == 6) { - m.status = 0xba400000000700a0; - apei_error = apei_write_mce(&m); - } else if (mem_err->requestor_id == 7) { - m.status = 0xba000000000800b0; - apei_error = apei_write_mce(&m); - } else { - pr_info("Undefined dvad error\n"); - } - break; - case 13: - m.status = 0x9c200040000100c0; - break; - case 14: - m.status = 0xbd000000000200c0; - apei_error = apei_write_mce(&m); - break; - } - mce_log(&m); -} -EXPORT_SYMBOL_GPL(zx_apei_mce_report_mem_error); - -void zx_apei_mce_report_pcie_error(int severity, struct cper_sec_pcie *pcie_err) -{ - struct mce m; - int apei_error = 0; - - if (boot_cpu_data.x86 != 7 || boot_cpu_data.x86_model != 91) - return; - - mce_setup(&m); - m.addr = 0; - m.misc = 0; - m.misc |= (u64)pcie_err->device_id.segment << 32; - m.misc |= pcie_err->device_id.bus << 24; - m.misc |= pcie_err->device_id.device << 19; - m.misc |= pcie_err->device_id.function << 16; - m.bank = 6; - - switch (severity) { - case 1: - m.status = 0x9820004000020e0b; - break; - case 2: - m.status = 0xba20000000010e0b; - break; - case 3: - m.status = 0xbd20000000000e0b; - apei_error = apei_write_mce(&m); - break; - default: - pr_info("Undefine pcie error\n"); - break; - } - mce_log(&m); -} -EXPORT_SYMBOL_GPL(zx_apei_mce_report_pcie_error); - -void zx_apei_mce_report_zdi_error(struct cper_sec_proc_generic *zdi_err) -{ - struct mce m; - int apei_error = 0; - - if (boot_cpu_data.x86 != 7 || boot_cpu_data.x86_model != 91) - return; - - mce_setup(&m); - m.misc = 0; - m.misc |= (zdi_err->requestor_id & 0xff) << 19; - m.misc |= ((zdi_err->requestor_id & 0xff00) >> 8) >> 24; - m.bank = 5; - switch (zdi_err->responder_id) { - case 2: - m.status = 0xba00000000040e0f; - apei_error = apei_write_mce(&m); - break; - case 3: - m.status = 0xba00000000030e0f; - apei_error = apei_write_mce(&m); - break; - case 4: - m.status = 0xba00000000020e0f; - apei_error = apei_write_mce(&m); - break; - case 5: - m.status = 0xba00000000010e0f; - apei_error = apei_write_mce(&m); - break; - case 6: - m.status = 0x9820004000090e0f; - break; - case 7: - m.status = 0x9820004000080e0f; - break; - case 8: - m.status = 0x9820004000070e0f; - break; - case 9: - m.status = 0x9820004000060e0f; - break; - case 10: - m.status = 0x9820004000050e0f; - break; - case 11: - case 12: - case 13: - case 14: - case 15: - m.status = 0x98200040000b0e0f; - break; - case 16: - case 17: - case 18: - m.status = 0x98200040000c0e0f; - break; - default: - pr_info("Undefined ZDI Error\n"); - break; - } - mce_log(&m); -} -EXPORT_SYMBOL_GPL(zx_apei_mce_report_zdi_error); - int apei_smca_report_x86_error(struct cper_ia_proc_ctx *ctx_info, u64 lapic_id) { const u64 *i_mce = ((const u64 *) (ctx_info + 1)); diff --git a/drivers/acpi/apei/apei-base.c b/drivers/acpi/apei/apei-base.c index ad8d5d5e97cc..c7c26872f4ce 100644 --- a/drivers/acpi/apei/apei-base.c +++ b/drivers/acpi/apei/apei-base.c @@ -773,17 +773,6 @@ void __weak arch_apei_report_mem_error(int sev, } EXPORT_SYMBOL_GPL(arch_apei_report_mem_error); -void __weak arch_apei_report_pcie_error(int sev, struct cper_sec_pcie *pcie_err) -{ -} -EXPORT_SYMBOL_GPL(arch_apei_report_pcie_error); - -bool __weak arch_apei_report_zdi_error(guid_t *sec_type, struct cper_sec_proc_generic *zdi_err) -{ - return false; -} -EXPORT_SYMBOL_GPL(arch_apei_report_zdi_error); - int apei_osc_setup(void) { static u8 whea_uuid_str[] = "ed855e0c-6c90-47bf-a62a-26de0fc5ad5c"; diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c index b5a382d7a3f2..88b78124a359 100644 --- a/drivers/acpi/apei/ghes.c +++ b/drivers/acpi/apei/ghes.c @@ -797,9 +797,6 @@ static void ghes_do_proc(struct ghes *ghes, queued = ghes_handle_memory_failure(gdata, sev, sync); } else if (guid_equal(sec_type, &CPER_SEC_PCIE)) { - struct cper_sec_pcie *pcie_err = acpi_hest_get_payload(gdata); - - arch_apei_report_pcie_error(sec_sev, pcie_err); ghes_handle_aer(gdata); } else if (guid_equal(sec_type, &CPER_SEC_UBUS)) { ghes_handle_ubus_err(gdata); @@ -807,16 +804,12 @@ static void ghes_do_proc(struct ghes *ghes, queued = ghes_handle_arm_hw_error(gdata, sev, sync); } else { void *err = acpi_hest_get_payload(gdata); - - if (!arch_apei_report_zdi_error(sec_type, - (struct cper_sec_proc_generic *)err)) { #ifndef CONFIG_ACPI_APEI_GHES_NOTIFY_ALL_RAS_ERR - ghes_defer_non_standard_event(gdata, sev); + ghes_defer_non_standard_event(gdata, sev); #endif - log_non_standard_event(sec_type, fru_id, fru_text, - sec_sev, err, - gdata->error_data_length); - } + log_non_standard_event(sec_type, fru_id, fru_text, + sec_sev, err, + gdata->error_data_length); } #ifdef CONFIG_ACPI_APEI_GHES_NOTIFY_ALL_RAS_ERR @@ -1199,8 +1192,6 @@ static int ghes_in_nmi_queue_one_entry(struct ghes *ghes, u32 len, node_len; u64 buf_paddr; int sev, rc; - struct acpi_hest_generic_data *gdata; - guid_t *sec_type; if (!IS_ENABLED(CONFIG_ARCH_HAVE_NMI_SAFE_CMPXCHG)) return -EOPNOTSUPP; @@ -1235,23 +1226,6 @@ static int ghes_in_nmi_queue_one_entry(struct ghes *ghes, sev = ghes_severity(estatus->error_severity); if (sev >= GHES_SEV_PANIC) { - apei_estatus_for_each_section(estatus, gdata) { - sec_type = (guid_t *)gdata->section_type; - if (guid_equal(sec_type, &CPER_SEC_PLATFORM_MEM)) { - struct cper_sec_mem_err *mem_err = acpi_hest_get_payload(gdata); - - arch_apei_report_mem_error(sev, mem_err); - } else if (guid_equal(sec_type, &CPER_SEC_PCIE)) { - struct cper_sec_pcie *pcie_err = acpi_hest_get_payload(gdata); - - arch_apei_report_pcie_error(sev, pcie_err); - } else if (guid_equal(sec_type, &CPER_SEC_PROC_GENERIC)) { - struct cper_sec_proc_generic *zdi_err = - acpi_hest_get_payload(gdata); - - arch_apei_report_zdi_error(sec_type, zdi_err); - } - } ghes_print_queued_estatus(); __ghes_panic(ghes, estatus, buf_paddr, fixmap_idx); } diff --git a/include/acpi/apei.h b/include/acpi/apei.h index 808cfa7d16b1..dc60f7db5524 100644 --- a/include/acpi/apei.h +++ b/include/acpi/apei.h @@ -52,8 +52,6 @@ int erst_clear(u64 record_id); int arch_apei_enable_cmcff(struct acpi_hest_header *hest_hdr, void *data); void arch_apei_report_mem_error(int sev, struct cper_sec_mem_err *mem_err); -void arch_apei_report_pcie_error(int sev, struct cper_sec_pcie *pcie_err); -bool arch_apei_report_zdi_error(guid_t *sec_type, struct cper_sec_proc_generic *zdi_err); #endif #endif -- 2.34.1

2 1

[PATCH OLK-6.6 0/8] net/oenetcls: RPS enhancements and bug fixes
by Li Xiasong 13 May '26

13 May '26

This series introduces several RPS (Receive Packet Steering) enhancements for oenetcls, including NUMA-aware flow scheduling, IPv6 ntuple support, RXQ multiplexing, and phy NIC policy switch, along with bug fixes for hash collision. Yue Haibing (8): net/oenetcls: Add mode 2 for rps numa affinity net/oenetcls: Prioritize oenetcls hooks over rps net/oenetcls: Fix possible hash collision issue net/oenetcls: Add local flow NUMA-aware rps net/oenetcls: Supports rxq multiplexing net/oenetcls: Support ipv6 for ntuple mode net/oenetcls: Make OENETCLS default as module net/oenetcls: Add rps policy switch for phy NIC include/linux/oenetcls.h | 38 ++++- include/linux/skbuff.h | 4 + include/net/sock.h | 4 + net/core/dev.c | 37 ++-- net/core/sock.c | 3 + net/ipv4/tcp.c | 5 +- net/oenetcls/Kconfig | 10 +- net/oenetcls/oenetcls.h | 30 +++- net/oenetcls/oenetcls_flow.c | 300 +++++++++++++++++++++++++-------- net/oenetcls/oenetcls_main.c | 188 ++++++++++++++++----- net/oenetcls/oenetcls_ntuple.c | 257 +++++++++++++++++----------- 11 files changed, 632 insertions(+), 244 deletions(-) -- 2.34.1

2 9

[PATCH OLK-6.6 0/3] optimize copy_from_user
by Qi Xi 13 May '26

13 May '26

Qi Xi (3): arm64: lib: add __arch_copy_from_user_opt with index-addressed ldp/stp arm64: uaccess: enable optimized copy_from_user for >= 4kb copies arm64: uaccess: add CONFIG and cmdline control for copy_from_user_opt .../admin-guide/kernel-parameters.txt | 6 + arch/arm64/Kconfig | 11 + arch/arm64/include/asm/asm-uaccess.h | 7 + arch/arm64/include/asm/uaccess.h | 31 ++- arch/arm64/kernel/cpufeature.c | 35 ++++ arch/arm64/lib/copy_from_user.S | 36 ++++ arch/arm64/lib/copy_template_opt.S | 189 ++++++++++++++++++ arch/arm64/tools/cpucaps | 2 +- 8 files changed, 314 insertions(+), 3 deletions(-) create mode 100644 arch/arm64/lib/copy_template_opt.S -- 2.33.0

2 4

[PATCH v4 OLK-6.6 0/4] arm64/ras: Firmware-first SEI error handling with ESB synchronization
by Wupeng Ma 13 May '26

13 May '26

This series introduces firmware-first RAS (Reliability, Availability, and Serviceability) error handling for ARM64 SEI (Synchronous External Interrupt) errors, with support for ESB (Error Synchronization Barrier) synchronization. The implementation includes: - Boot parameter to enable/disable ESB synchronization for SEI - Entry code patching to use ESB instruction for SEI handling - Vendor-specific SEI error handling via APEI/GHES - Sysctl interface for runtime control of vendor SEI handling Liao Chang (1): arm64/entry: Add support to synchronize SEI at the exception boundary Wupeng Ma (2): ACPI/APEI/arm64: add vendor SEI handling for firmware-first RAS arm64: openeuler_defconfig: enable CONFIG_ARM64_SYNC_SEI by default Zheng Chuan (1): arm64: Add runtime switch to control ESB for SEI synchronization Documentation/admin-guide/sysctl/kernel.rst | 27 ++++ arch/arm64/Kconfig | 14 ++ arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/acpi.h | 2 + arch/arm64/include/asm/setup.h | 11 ++ arch/arm64/kernel/Makefile | 1 + arch/arm64/kernel/arm64_sync_sei.c | 124 +++++++++++++++ arch/arm64/kernel/entry.S | 64 ++++++++ arch/arm64/kernel/traps.c | 16 ++ arch/arm64/kernel/vmlinux.lds.S | 9 ++ arch/arm64/kernel/xcall/entry.S | 6 +- drivers/acpi/apei/apei-internal.h | 2 + drivers/acpi/apei/ghes-vendor-info.c | 162 +++++++++++++++++++- drivers/acpi/apei/ghes.c | 5 + 14 files changed, 441 insertions(+), 3 deletions(-) create mode 100644 arch/arm64/kernel/arm64_sync_sei.c -- 2.43.0

2 5

[PATCH OLK-6.6] sched: task_struct kabi test
by Hui Tang 13 May '26

13 May '26

hulk inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/8422 ---------------------------------------- Signed-off-by: Hui Tang <tanghui20(a)huawei.com> --- include/linux/sched.h | 1 + 1 file changed, 1 insertion(+) diff --git a/include/linux/sched.h b/include/linux/sched.h index a4f1c5e6e013..388cabe57c8b 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -1663,6 +1663,7 @@ struct task_struct { * * Do not put anything below here! */ + int sched_ext_test; }; static inline struct pid *task_pid(struct task_struct *task) -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] spi: Adapt downstream drivers to generic driver_override infrastructure
by Zhang Yuwei 13 May '26

13 May '26

The SPI subsystem fixed a Use-After-Free vulnerability by switching to the generic bus-level driver_override infrastructure and removing the driver_override field from struct spi_device. As a result, downstream drivers can no longer access this field directly. Danilo Krummrich (1): spi: use generic driver_override infrastructure Krzysztof Kozlowski (1): spi: Use helper for safer setting of driver_override drivers/spi/spi.c | 43 ++++++++++------------------------------- include/linux/spi/spi.h | 4 +--- 2 files changed, 11 insertions(+), 36 deletions(-) -- 2.22.0

2 3

[PATCH OLK-6.6 0/4] nbd: replace socks pointer array with xarray to eliminate queue freeze
by Long Li 13 May '26

13 May '26

Hi, Commit b98e762e3d ("nbd: freeze the queue while we're adding connections") introduced blk_mq_freeze_queue() in the add-socket path to prevent use-after-free when krealloc() relocates the config->socks array while I/O is in flight. However, freezing the queue on every connection setup introduces significant latency when establishing a large number of connections. This series eliminates the queue freeze by replacing the krealloc-based struct nbd_sock **socks array with a struct xarray. The xarray provides RCU-safe pointer publishing: each nbd_sock is fully initialized before being stored via xa_store(), and concurrent readers access individual entries through xa_load() without ever holding a reference to the array itself. This removes the possibility of UAF on array reallocation, making the queue freeze unnecessary. The following test was performed with 256 connections on a local nbd-server: nbd-server -M 256 -C /etc/nbd-server/config time nbd-client 127.0.0.1 10809 /dev/nbd0 -N myexport -C 256 Before: real 4.510s user 0.004s sys 0.038s After: real 0.263s user 0.009s sys 0.032s Connection setup time is reduced by ~94%. Long Li (4): nbd: simplify find_fallback() by removing redundant logic nbd: replace socks pointer array with xarray nbd: remove redundant num_connections boundary checks nbd: remove queue freeze in nbd_add_socket drivers/block/nbd.c | 200 +++++++++++++++++++++++--------------------- 1 file changed, 106 insertions(+), 94 deletions(-) -- 2.52.0

2 5

[PATCH OLK-6.6 v5 00/35] ext4 hardware atomic write support
by Long Li 13 May '26

13 May '26

This patch set support ext4 hardware atomic write. Alan Adamson (1): nvme: Atomic write support Bagas Sanjaya (2): Documentation: ext4: atomic_writes: Demote last three sections Documentation: ext4: Convert includes into toctrees John Garry (13): block: Pass blk_queue_get_max_sectors() a request pointer block: Generalize chunk_sectors support as boundary support block: Add core atomic write support block: Call blkdev_dio_unaligned() from blkdev_direct_IO() block: Add fops atomic write support block/fs: Pass an iocb to generic_atomic_write_valid() fs/block: Check for IOCB_DIRECT in generic_atomic_write_valid() block: Add bdev atomic write limits helpers fs: Export generic_atomic_write_valid() fs: iomap: Atomic write support block: Fix blk_validate_atomic_write_limits() build for arm32 nvme: stop using AWUPF block: Don't allow an atomic write be truncated in blkdev_write_iter() Long Li (3): block: fix kabi broken in struct queue_limits fs: fix kabi broken in struct kstat block: fix kabi broken in enum req_flag_bits Prasad Singamsetty (2): fs: Initial atomic write support fs: Add initial atomic write support info to statx Ritesh Harjani (IBM) (14): ext4: Add statx support for atomic writes ext4: Check for atomic writes support in write iter ext4: Support setting FMODE_CAN_ATOMIC_WRITE ext4: Do not fallback to buffered-io for DIO atomic write ext4: Document an edge case for overwrites ext4: Check if inode uses extents in ext4_inode_can_atomic_write() ext4: Make ext4_meta_trans_blocks() non-static for later use ext4: Add support for EXT4_GET_BLOCKS_QUERY_LEAF_BLOCKS ext4: Add multi-fsblock atomic write support with bigalloc ext4: Enable support for ext4 multi-fsblock atomic write using bigalloc ext4: Add atomic block write documentation iomap: Lift blocksize restriction on atomic writes ext4: Unwritten to written conversion requires EXT4_EX_NOCACHE ext4: Simplify last in leaf check in ext4_map_query_blocks Documentation/ABI/stable/sysfs-block | 53 +++ .../filesystems/ext4/atomic_writes.rst | 225 ++++++++++++ Documentation/filesystems/ext4/dynamic.rst | 10 +- Documentation/filesystems/ext4/globals.rst | 14 +- Documentation/filesystems/ext4/overview.rst | 21 +- block/blk-core.c | 19 + block/blk-merge.c | 67 +++- block/blk-mq.c | 2 +- block/blk-settings.c | 86 +++++ block/blk-sysfs.c | 33 ++ block/blk.h | 9 +- block/fops.c | 54 ++- drivers/md/dm.c | 2 +- drivers/nvme/host/core.c | 64 +++- fs/aio.c | 8 +- fs/btrfs/ioctl.c | 2 +- fs/ext4/ext4.h | 35 +- fs/ext4/extents.c | 99 +++++ fs/ext4/file.c | 31 +- fs/ext4/inode.c | 345 ++++++++++++++++-- fs/ext4/super.c | 34 ++ fs/iomap/direct-io.c | 38 +- fs/iomap/trace.h | 3 +- fs/read_write.c | 22 +- fs/stat.c | 34 ++ include/linux/blk_types.h | 8 +- include/linux/blkdev.h | 84 ++++- include/linux/fs.h | 18 +- include/linux/iomap.h | 1 + include/linux/stat.h | 5 +- include/uapi/linux/fs.h | 5 +- include/uapi/linux/stat.h | 11 +- io_uring/rw.c | 8 +- 33 files changed, 1341 insertions(+), 109 deletions(-) create mode 100644 Documentation/filesystems/ext4/atomic_writes.rst -- 2.52.0

2 36

[PATCH OLK-5.10 0/2] spi: Adapt downstream drivers to generic driver_override infrastructure
by Zhang Yuwei 13 May '26

13 May '26

The SPI subsystem fixed a Use-After-Free vulnerability by switching to the generic bus-level driver_override infrastructure and removing the driver_override field from struct spi_device. As a result, downstream drivers can no longer access this field directly. Danilo Krummrich (1): spi: use generic driver_override infrastructure Krzysztof Kozlowski (1): spi: Use helper for safer setting of driver_override drivers/spi/spi.c | 43 ++++++++++------------------------------- include/linux/spi/spi.h | 4 +--- 2 files changed, 11 insertions(+), 36 deletions(-) -- 2.22.0

2 3

[PATCH OLK-6.6] spi: use generic driver_override infrastructure
by Zhang Yuwei 13 May '26

13 May '26

From: Danilo Krummrich <dakr(a)kernel.org> mainline inclusion from mainline-v7.0-rc6 commit cc34d77dd48708d810c12bfd6f5bf03304f6c824 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14224 CVE: CVE-2026-31487 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF. Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally. Note that calling match() from __driver_attach() without the device lock held is intentional. [1] Also note that we do not enable the driver_override feature of struct bus_type, as SPI - in contrast to most other buses - passes "" to sysfs_emit() when the driver_override pointer is NULL. Thus, printing "\n" instead of "(null)\n". Link: https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/ [1] Reported-by: Gui-Dong Han <hanguidong02(a)gmail.com> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220789 Fixes: 5039563e7c25 ("spi: Add driver_override SPI device attribute") Signed-off-by: Danilo Krummrich <dakr(a)kernel.org> Link: https://patch.msgid.link/20260324005919.2408620-12-dakr@kernel.org Signed-off-by: Mark Brown <broonie(a)kernel.org> Conflicts: include/linux/spi/spi.h drivers/spi/spi.c [commit 702ca0269ed56 merged] Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> --- drivers/spi/spi.c | 19 +++++++------------ include/linux/spi/spi.h | 5 ----- 2 files changed, 7 insertions(+), 17 deletions(-) diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c index 2ca4ea45e3b2..b9774bcaa678 100644 --- a/drivers/spi/spi.c +++ b/drivers/spi/spi.c @@ -49,7 +49,6 @@ static void spidev_release(struct device *dev) struct spi_device *spi = to_spi_device(dev); spi_controller_put(spi->controller); - kfree(spi->driver_override); free_percpu(spi->pcpu_statistics); kfree(spi); } @@ -72,10 +71,9 @@ static ssize_t driver_override_store(struct device *dev, struct device_attribute *a, const char *buf, size_t count) { - struct spi_device *spi = to_spi_device(dev); int ret; - ret = driver_set_override(dev, &spi->driver_override, buf, count); + ret = __device_set_driver_override(dev, buf, count); if (ret) return ret; @@ -85,13 +83,8 @@ static ssize_t driver_override_store(struct device *dev, static ssize_t driver_override_show(struct device *dev, struct device_attribute *a, char *buf) { - const struct spi_device *spi = to_spi_device(dev); - ssize_t len; - - device_lock(dev); - len = sysfs_emit(buf, "%s\n", spi->driver_override ? : ""); - device_unlock(dev); - return len; + guard(spinlock)(&dev->driver_override.lock); + return sysfs_emit(buf, "%s\n", dev->driver_override.name ?: ""); } static DEVICE_ATTR_RW(driver_override); @@ -377,10 +370,12 @@ static int spi_match_device(struct device *dev, struct device_driver *drv) { const struct spi_device *spi = to_spi_device(dev); const struct spi_driver *sdrv = to_spi_driver(drv); + int ret; /* Check override first, and if set, only use the named driver */ - if (spi->driver_override) - return strcmp(spi->driver_override, drv->name) == 0; + ret = device_match_driver_override(dev, drv); + if (ret >= 0) + return ret; /* Attempt an OF style match */ if (of_driver_match_device(dev, drv)) diff --git a/include/linux/spi/spi.h b/include/linux/spi/spi.h index e5baf43bcfbb..3f6ca8052f63 100644 --- a/include/linux/spi/spi.h +++ b/include/linux/spi/spi.h @@ -153,10 +153,6 @@ extern void spi_transfer_cs_change_delay_exec(struct spi_message *msg, * @modalias: Name of the driver to use with this device, or an alias * for that name. This appears in the sysfs "modalias" attribute * for driver coldplugging, and in uevents used for hotplugging - * @driver_override: If the name of a driver is written to this attribute, then - * the device will bind to the named driver and only the named driver. - * Do not set directly, because core frees it; use driver_set_override() to - * set or clear it. * @cs_gpiod: GPIO descriptor of the chipselect line (optional, NULL when * not using a GPIO line) * @word_delay: delay to be inserted between consecutive @@ -212,7 +208,6 @@ struct spi_device { void *controller_state; void *controller_data; char modalias[SPI_NAME_SIZE]; - const char *driver_override; struct gpio_desc *cs_gpiod; /* Chip select GPIO descriptor */ struct spi_delay word_delay; /* Inter-word delay */ /* CS delays */ -- 2.22.0

2 1

[PATCH openEuler-1.0-LTS 0/3] bugfix set of CVEs
by Liu Kai 13 May '26

13 May '26

bugfix set of CVEs Lee Jones (2): HID: core: Mitigate potential OOB by removing bogus memset() HID: multitouch: Check to ensure report responses match the request Vicki Pfau (1): HID: core: Add printk_ratelimited variants to hid_warn() etc drivers/hid/hid-core.c | 7 ++++--- drivers/hid/hid-multitouch.c | 7 +++++++ include/linux/hid.h | 11 +++++++++++ 3 files changed, 22 insertions(+), 3 deletions(-) -- 2.34.1

2 4

[PATCH OLK-5.10] Bluetooth: hci_event: move wake reason storage into validated event handlers
by Chen Jinghuang 13 May '26

13 May '26

From: Oleh Konko <security(a)1seal.org> mainline inclusion from mainline-v7.0-rc7 commit 2b2bf47cd75518c36fa2d41380e4a40641cc89cd category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14521 CVE: CVE-2026-31771 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------------------------------------- hci_store_wake_reason() is called from hci_event_packet() immediately after stripping the HCI event header but before hci_event_func() enforces the per-event minimum payload length from hci_ev_table. This means a short HCI event frame can reach bacpy() before any bounds check runs. Rather than duplicating skb parsing and per-event length checks inside hci_store_wake_reason(), move wake-address storage into the individual event handlers after their existing event-length validation has succeeded. Convert hci_store_wake_reason() into a small helper that only stores an already-validated bdaddr while the caller holds hci_dev_lock(). Use the same helper after hci_event_func() with a NULL address to preserve the existing unexpected-wake fallback semantics when no validated event handler records a wake address. Annotate the helper with __must_hold(&hdev->lock) and add lockdep_assert_held(&hdev->lock) so future call paths keep the lock contract explicit. Call the helper from hci_conn_request_evt(), hci_conn_complete_evt(), hci_sync_conn_complete_evt(), le_conn_complete_evt(), hci_le_adv_report_evt(), hci_le_ext_adv_report_evt(), hci_le_direct_adv_report_evt(), hci_le_pa_sync_established_evt(), and hci_le_past_received_evt(). Fixes: 2f20216c1d6f ("Bluetooth: Emit controller suspend and resume events") Cc: stable(a)vger.kernel.org Signed-off-by: Oleh Konko <security(a)1seal.org> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- net/bluetooth/hci_event.c | 100 +++++++++++++++----------------------- 1 file changed, 38 insertions(+), 62 deletions(-) diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c index 509ec9fd4865..8fe811cc6e17 100644 --- a/net/bluetooth/hci_event.c +++ b/net/bluetooth/hci_event.c @@ -42,6 +42,10 @@ #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \ "\x00\x00\x00\x00\x00\x00\x00\x00" +static void hci_store_wake_reason(struct hci_dev *hdev, + const bdaddr_t *bdaddr, u8 addr_type) + __must_hold(&hdev->lock); + /* Handle HCI Event packets */ static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb, @@ -2588,6 +2592,7 @@ static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb) BT_DBG("%s", hdev->name); hci_dev_lock(hdev); + hci_store_wake_reason(hdev, &ev->bdaddr, BDADDR_BREDR); conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr); if (!conn) { @@ -2740,6 +2745,10 @@ static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb) BT_DBG("%s bdaddr %pMR type 0x%x", hdev->name, &ev->bdaddr, ev->link_type); + hci_dev_lock(hdev); + hci_store_wake_reason(hdev, &ev->bdaddr, BDADDR_BREDR); + hci_dev_unlock(hdev); + /* Reject incoming connection from device with same BD ADDR against * CVE-2020-26555 */ @@ -4374,6 +4383,7 @@ static void hci_sync_conn_complete_evt(struct hci_dev *hdev, BT_DBG("%s status 0x%2.2x", hdev->name, ev->status); hci_dev_lock(hdev); + hci_store_wake_reason(hdev, &ev->bdaddr, BDADDR_BREDR); conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr); if (!conn) { @@ -5206,6 +5216,7 @@ static void le_conn_complete_evt(struct hci_dev *hdev, u8 status, u8 addr_type; hci_dev_lock(hdev); + hci_store_wake_reason(hdev, bdaddr, bdaddr_type); /* All controllers implicitly stop advertising in the event of a * connection, so ensure that the state bit is cleared. @@ -5737,6 +5748,8 @@ static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb) break; } + hci_store_wake_reason(hdev, &ev->bdaddr, ev->bdaddr_type); + if (ev->length <= HCI_MAX_AD_LENGTH && ev->data + ev->length <= skb_tail_pointer(skb)) { rssi = ev->data[ev->length]; @@ -5809,6 +5822,8 @@ static void hci_le_ext_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb) u8 legacy_evt_type; u16 evt_type; + hci_store_wake_reason(hdev, &ev->bdaddr, ev->bdaddr_type); + evt_type = __le16_to_cpu(ev->evt_type); legacy_evt_type = ext_evt_type_to_legacy(hdev, evt_type); if (legacy_evt_type != LE_ADV_INVALID) { @@ -6015,11 +6030,14 @@ static void hci_le_direct_adv_report_evt(struct hci_dev *hdev, hci_dev_lock(hdev); - for (; num_reports; num_reports--, ev++) + for (; num_reports; num_reports--, ev++) { + hci_store_wake_reason(hdev, &ev->bdaddr, ev->bdaddr_type); + process_adv_report(hdev, ev->evt_type, &ev->bdaddr, - ev->bdaddr_type, &ev->direct_addr, - ev->direct_addr_type, ev->rssi, NULL, 0, - false); + ev->bdaddr_type, &ev->direct_addr, + ev->direct_addr_type, ev->rssi, NULL, 0, + false); + } hci_dev_unlock(hdev); } @@ -6155,73 +6173,30 @@ static bool hci_get_cmd_complete(struct hci_dev *hdev, u16 opcode, return true; } -static void hci_store_wake_reason(struct hci_dev *hdev, u8 event, - struct sk_buff *skb) +static void hci_store_wake_reason(struct hci_dev *hdev, + const bdaddr_t *bdaddr, u8 addr_type) + __must_hold(&hdev->lock) { - struct hci_ev_le_advertising_info *adv; - struct hci_ev_le_direct_adv_info *direct_adv; - struct hci_ev_le_ext_adv_report *ext_adv; - const struct hci_ev_conn_complete *conn_complete = (void *)skb->data; - const struct hci_ev_conn_request *conn_request = (void *)skb->data; - - hci_dev_lock(hdev); + lockdep_assert_held(&hdev->lock); /* If we are currently suspended and this is the first BT event seen, * save the wake reason associated with the event. */ if (!hdev->suspended || hdev->wake_reason) - goto unlock; + return; + + if (!bdaddr) { + hdev->wake_reason = MGMT_WAKE_REASON_UNEXPECTED; + return; + } /* Default to remote wake. Values for wake_reason are documented in the * Bluez mgmt api docs. */ hdev->wake_reason = MGMT_WAKE_REASON_REMOTE_WAKE; - /* Once configured for remote wakeup, we should only wake up for - * reconnections. It's useful to see which device is waking us up so - * keep track of the bdaddr of the connection event that woke us up. - */ - if (event == HCI_EV_CONN_REQUEST) { - bacpy(&hdev->wake_addr, &conn_request->bdaddr); - hdev->wake_addr_type = BDADDR_BREDR; - } else if (event == HCI_EV_CONN_COMPLETE) { - bacpy(&hdev->wake_addr, &conn_complete->bdaddr); - hdev->wake_addr_type = BDADDR_BREDR; - } else if (event == HCI_EV_LE_META) { - struct hci_ev_le_meta *le_ev = (void *)skb->data; - u8 subevent = le_ev->subevent; - u8 *ptr = &skb->data[sizeof(*le_ev)]; - u8 num_reports = *ptr; - - if ((subevent == HCI_EV_LE_ADVERTISING_REPORT || - subevent == HCI_EV_LE_DIRECT_ADV_REPORT || - subevent == HCI_EV_LE_EXT_ADV_REPORT) && - num_reports) { - adv = (void *)(ptr + 1); - direct_adv = (void *)(ptr + 1); - ext_adv = (void *)(ptr + 1); - - switch (subevent) { - case HCI_EV_LE_ADVERTISING_REPORT: - bacpy(&hdev->wake_addr, &adv->bdaddr); - hdev->wake_addr_type = adv->bdaddr_type; - break; - case HCI_EV_LE_DIRECT_ADV_REPORT: - bacpy(&hdev->wake_addr, &direct_adv->bdaddr); - hdev->wake_addr_type = direct_adv->bdaddr_type; - break; - case HCI_EV_LE_EXT_ADV_REPORT: - bacpy(&hdev->wake_addr, &ext_adv->bdaddr); - hdev->wake_addr_type = ext_adv->bdaddr_type; - break; - } - } - } else { - hdev->wake_reason = MGMT_WAKE_REASON_UNEXPECTED; - } - -unlock: - hci_dev_unlock(hdev); + bacpy(&hdev->wake_addr, bdaddr); + hdev->wake_addr_type = addr_type; } void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb) @@ -6257,9 +6232,6 @@ void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb) skb_pull(skb, HCI_EVENT_HDR_SIZE); - /* Store wake reason if we're suspended */ - hci_store_wake_reason(hdev, event, skb); - switch (event) { case HCI_EV_INQUIRY_COMPLETE: hci_inquiry_complete_evt(hdev, skb); @@ -6446,6 +6418,10 @@ void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb) break; } + hci_dev_lock(hdev); + hci_store_wake_reason(hdev, NULL, 0); + hci_dev_unlock(hdev); + if (req_complete) { req_complete(hdev, status, opcode); } else if (req_complete_skb) { -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] ALSA: ctxfi: fix SPDIF1 mismatched
by Zhang Yuwei 13 May '26

13 May '26

The previous fix addressed the crash symptom by adding a fallback index mapping for SPDIFI1 on hw20k2 devices. However, SPDIFI1 is a special DAIO type intended only for the hw20k1 CTSB073X model and should never be enumerated on hw20k2 in the first place. The real regression was introduced by the sparse DAIO mapping refactoring, which changed the DAIO initialization loop to iterate over all DAIOTYP entries, including SPDIFI1. As hw20k2 lacks a valid SPDIFI1 definition, this eventually led to invalid index handling and out-of-bounds access. Instead of adding special-case index handling for an invalid DAIO type, fix the root cause by skipping SPDIFI1 during generic DAIO enumeration and only mapping SPDIFIO to SPDIFI1 for the CTSB073X model as originally intended. With this change applied, the earlier workaround patch is no longer needed. Takashi Iwai (2): ALSA: ctxfi: Fix missing SPDIFI1 index handling ALSA: ctxfi: Don't enumerate SPDIF1 at DAIO initialization sound/pci/ctxfi/ctatc.c | 8 ++++++-- sound/pci/ctxfi/ctdaio.c | 1 + 2 files changed, 7 insertions(+), 2 deletions(-) -- 2.22.0

2 3

[PATCH openEuler-1.0-LTS 0/2] CVE-2026-43048
by Liu Kai 13 May '26

13 May '26

CVE-2026-43048 Lee Jones (1): HID: core: Mitigate potential OOB by removing bogus memset() Vicki Pfau (1): HID: core: Add printk_ratelimited variants to hid_warn() etc drivers/hid/hid-core.c | 7 ++++--- include/linux/hid.h | 11 +++++++++++ 2 files changed, 15 insertions(+), 3 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] perf/x86/intel/uncore: Fix die ID init and look up bugs
by Luo Gengkun 13 May '26

13 May '26

From: Zide Chen <zide.chen(a)intel.com> mainline inclusion from mainline-v7.0 commit a16d1ec4dd0cdcf689f324adde6067083bce9099 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14902 CVE: CVE-2026-43344 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- In snbep_pci2phy_map_init(), in the nr_node_ids > 8 path, uncore_device_to_die() may return -1 when all CPUs associated with the UBOX device are offline. Remove the WARN_ON_ONCE(die_id == -1) check for two reasons: - The current code breaks out of the loop. This is incorrect because pci_get_device() does not guarantee iteration in domain or bus order, so additional UBOX devices may be skipped during the scan. - Returning -EINVAL is incorrect, since marking offline buses with die_id == -1 is expected and should not be treated as an error. Separately, when NUMA is disabled on a NUMA-capable platform, pcibus_to_node() returns NUMA_NO_NODE, causing uncore_device_to_die() to return -1 for all PCI devices. As a result, spr_update_device_location(), used on Intel SPR and EMR, ignores the corresponding PMON units and does not add them to the RB tree. Fix this by using uncore_pcibus_to_dieid(), which retrieves topology from the UBOX GIDNIDMAP register and works regardless of whether NUMA is enabled in Linux. This requires snbep_pci2phy_map_init() to be added in spr_uncore_pci_init(). Keep uncore_device_to_die() only for the nr_node_ids > 8 case, where NUMA is expected to be enabled. Fixes: 9a7832ce3d92 ("perf/x86/intel/uncore: With > 8 nodes, get pci bus die id from NUMA info") Fixes: 65248a9a9ee1 ("perf/x86/uncore: Add a quirk for UPI on SPR") Signed-off-by: Zide Chen <zide.chen(a)intel.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Reviewed-by: Dapeng Mi <dapeng1.mi(a)linux.intel.com> Tested-by: Steve Wahl <steve.wahl(a)hpe.com> Link: https://patch.msgid.link/20260313174050.171704-4-zide.chen@intel.com Conflicts: arch/x86/events/intel/uncore_snbep.c [Fix context diff.] Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- arch/x86/events/intel/uncore.c | 1 + arch/x86/events/intel/uncore_snbep.c | 13 ++++++------- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/arch/x86/events/intel/uncore.c b/arch/x86/events/intel/uncore.c index 56ad62097c80..377adddcca5f 100644 --- a/arch/x86/events/intel/uncore.c +++ b/arch/x86/events/intel/uncore.c @@ -66,6 +66,7 @@ int uncore_die_to_segment(int die) return bus ? pci_domain_nr(bus) : -EINVAL; } +/* Note: This API can only be used when NUMA information is available. */ int uncore_device_to_die(struct pci_dev *dev) { int node = pcibus_to_node(dev->bus); diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c index 08faac369397..f66ffc3b66ea 100644 --- a/arch/x86/events/intel/uncore_snbep.c +++ b/arch/x86/events/intel/uncore_snbep.c @@ -1465,13 +1465,7 @@ static int snbep_pci2phy_map_init(int devid, int nodeid_loc, int idmap_loc, bool } map->pbus_to_dieid[bus] = die_id = uncore_device_to_die(ubox_dev); - raw_spin_unlock(&pci2phy_map_lock); - - if (WARN_ON_ONCE(die_id == -1)) { - err = -EINVAL; - break; - } } } @@ -6528,7 +6522,7 @@ static void spr_update_device_location(int type_id) while ((dev = pci_get_device(PCI_VENDOR_ID_INTEL, device, dev)) != NULL) { - die = uncore_device_to_die(dev); + die = uncore_pcibus_to_dieid(dev->bus); if (die < 0) continue; @@ -6552,6 +6546,11 @@ static void spr_update_device_location(int type_id) int spr_uncore_pci_init(void) { + int ret = snbep_pci2phy_map_init(0x3250, SKX_CPUNODEID, SKX_GIDNIDMAP, true); + + if (ret) + return ret; + /* * The discovery table of UPI on some SPR variant is broken, * which impacts the detection of both UPI and M3UPI uncore PMON. -- 2.34.1

2 1

[PATCH OLK-6.6] smb: client: prevent races in ->query_interfaces()
by Li Lingfeng 13 May '26

13 May '26

From: Henrique Carvalho <henrique.carvalho(a)suse.com> stable inclusion from stable-v6.6.128 commit 93e8e3ee165ae4609a1222b516b573837103d2c3 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14783 CVE: CVE-2026-43239 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit c3c06e42e1527716c54f3ad2ced6a034b5f3a489 ] It was possible for two query interface works to be concurrently trying to update the interfaces. Prevent this by checking and updating iface_last_update under iface_lock. Signed-off-by: Henrique Carvalho <henrique.carvalho(a)suse.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/smb/client/smb2ops.c | 19 ++++++++----------- 1 file changed, 8 insertions(+), 11 deletions(-) diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c index b6528b81cd78..68378a27a489 100644 --- a/fs/smb/client/smb2ops.c +++ b/fs/smb/client/smb2ops.c @@ -595,13 +595,6 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf, p = buf; spin_lock(&ses->iface_lock); - /* do not query too frequently, this time with lock held */ - if (ses->iface_last_update && - time_before(jiffies, ses->iface_last_update + - (SMB_INTERFACE_POLL_INTERVAL * HZ))) { - spin_unlock(&ses->iface_lock); - return 0; - } /* * Go through iface_list and mark them as inactive @@ -624,7 +617,6 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf, "Empty network interface list returned by server %s\n", ses->server->hostname); rc = -EOPNOTSUPP; - ses->iface_last_update = jiffies; goto out; } @@ -753,8 +745,6 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf, + sizeof(p->Next) && p->Next)) cifs_dbg(VFS, "%s: incomplete interface info\n", __func__); - ses->iface_last_update = jiffies; - out: /* * Go through the list again and put the inactive entries @@ -783,10 +773,17 @@ SMB3_request_interfaces(const unsigned int xid, struct cifs_tcon *tcon, bool in_ struct TCP_Server_Info *pserver; /* do not query too frequently */ + spin_lock(&ses->iface_lock); if (ses->iface_last_update && time_before(jiffies, ses->iface_last_update + - (SMB_INTERFACE_POLL_INTERVAL * HZ))) + (SMB_INTERFACE_POLL_INTERVAL * HZ))) { + spin_unlock(&ses->iface_lock); return 0; + } + + ses->iface_last_update = jiffies; + + spin_unlock(&ses->iface_lock); rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID, FSCTL_QUERY_NETWORK_INTERFACE_INFO, -- 2.52.0

2 1

[PATCH] Bluetooth: hci_event: move wake reason storage into validated event handlers
by Chen Jinghuang 13 May '26

13 May '26

From: Oleh Konko <security(a)1seal.org> hci_store_wake_reason() is called from hci_event_packet() immediately after stripping the HCI event header but before hci_event_func() enforces the per-event minimum payload length from hci_ev_table. This means a short HCI event frame can reach bacpy() before any bounds check runs. Rather than duplicating skb parsing and per-event length checks inside hci_store_wake_reason(), move wake-address storage into the individual event handlers after their existing event-length validation has succeeded. Convert hci_store_wake_reason() into a small helper that only stores an already-validated bdaddr while the caller holds hci_dev_lock(). Use the same helper after hci_event_func() with a NULL address to preserve the existing unexpected-wake fallback semantics when no validated event handler records a wake address. Annotate the helper with __must_hold(&hdev->lock) and add lockdep_assert_held(&hdev->lock) so future call paths keep the lock contract explicit. Call the helper from hci_conn_request_evt(), hci_conn_complete_evt(), hci_sync_conn_complete_evt(), le_conn_complete_evt(), hci_le_adv_report_evt(), hci_le_ext_adv_report_evt(), hci_le_direct_adv_report_evt(), hci_le_pa_sync_established_evt(), and hci_le_past_received_evt(). Fixes: 2f20216c1d6f ("Bluetooth: Emit controller suspend and resume events") Cc: stable(a)vger.kernel.org Signed-off-by: Oleh Konko <security(a)1seal.org> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> --- net/bluetooth/hci_event.c.rej | 195 ++++++++++++++++++++++++++++++++++ 1 file changed, 195 insertions(+) create mode 100644 net/bluetooth/hci_event.c.rej diff --git a/net/bluetooth/hci_event.c.rej b/net/bluetooth/hci_event.c.rej new file mode 100644 index 000000000000..99f9b2368f7d --- /dev/null +++ b/net/bluetooth/hci_event.c.rej @@ -0,0 +1,195 @@ +diff a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c (rejected hunks) +@@ -80,6 +80,10 @@ static void *hci_le_ev_skb_pull(struct hci_dev *hdev, struct sk_buff *skb, + return data; + } + ++static void hci_store_wake_reason(struct hci_dev *hdev, ++ const bdaddr_t *bdaddr, u8 addr_type) ++ __must_hold(&hdev->lock); ++ + static u8 hci_cc_inquiry_cancel(struct hci_dev *hdev, void *data, + struct sk_buff *skb) + { +@@ -3111,6 +3115,7 @@ static void hci_conn_complete_evt(struct hci_dev *hdev, void *data, + bt_dev_dbg(hdev, "status 0x%2.2x", status); + + hci_dev_lock(hdev); ++ hci_store_wake_reason(hdev, &ev->bdaddr, BDADDR_BREDR); + + /* Check for existing connection: + * +@@ -3274,6 +3279,10 @@ static void hci_conn_request_evt(struct hci_dev *hdev, void *data, + + bt_dev_dbg(hdev, "bdaddr %pMR type 0x%x", &ev->bdaddr, ev->link_type); + ++ hci_dev_lock(hdev); ++ hci_store_wake_reason(hdev, &ev->bdaddr, BDADDR_BREDR); ++ hci_dev_unlock(hdev); ++ + /* Reject incoming connection from device with same BD ADDR against + * CVE-2020-26555 + */ +@@ -5021,6 +5030,7 @@ static void hci_sync_conn_complete_evt(struct hci_dev *hdev, void *data, + bt_dev_dbg(hdev, "status 0x%2.2x", status); + + hci_dev_lock(hdev); ++ hci_store_wake_reason(hdev, &ev->bdaddr, BDADDR_BREDR); + + conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr); + if (!conn) { +@@ -5713,6 +5723,7 @@ static void le_conn_complete_evt(struct hci_dev *hdev, u8 status, + int err; + + hci_dev_lock(hdev); ++ hci_store_wake_reason(hdev, bdaddr, bdaddr_type); + + /* All controllers implicitly stop advertising in the event of a + * connection, so ensure that the state bit is cleared. +@@ -6005,6 +6016,7 @@ static void hci_le_past_received_evt(struct hci_dev *hdev, void *data, + bt_dev_dbg(hdev, "status 0x%2.2x", ev->status); + + hci_dev_lock(hdev); ++ hci_store_wake_reason(hdev, &ev->bdaddr, ev->bdaddr_type); + + hci_dev_clear_flag(hdev, HCI_PA_SYNC); + +@@ -6403,6 +6415,8 @@ static void hci_le_adv_report_evt(struct hci_dev *hdev, void *data, + info->length + 1)) + break; + ++ hci_store_wake_reason(hdev, &info->bdaddr, info->bdaddr_type); ++ + if (info->length <= max_adv_len(hdev)) { + rssi = info->data[info->length]; + process_adv_report(hdev, info->type, &info->bdaddr, +@@ -6491,6 +6505,8 @@ static void hci_le_ext_adv_report_evt(struct hci_dev *hdev, void *data, + info->length)) + break; + ++ hci_store_wake_reason(hdev, &info->bdaddr, info->bdaddr_type); ++ + evt_type = __le16_to_cpu(info->type) & LE_EXT_ADV_EVT_TYPE_MASK; + legacy_evt_type = ext_evt_type_to_legacy(hdev, evt_type); + +@@ -6536,6 +6552,7 @@ static void hci_le_pa_sync_established_evt(struct hci_dev *hdev, void *data, + bt_dev_dbg(hdev, "status 0x%2.2x", ev->status); + + hci_dev_lock(hdev); ++ hci_store_wake_reason(hdev, &ev->bdaddr, ev->bdaddr_type); + + hci_dev_clear_flag(hdev, HCI_PA_SYNC); + +@@ -6834,6 +6851,8 @@ static void hci_le_direct_adv_report_evt(struct hci_dev *hdev, void *data, + for (i = 0; i < ev->num; i++) { + struct hci_ev_le_direct_adv_info *info = &ev->info[i]; + ++ hci_store_wake_reason(hdev, &info->bdaddr, info->bdaddr_type); ++ + process_adv_report(hdev, info->type, &info->bdaddr, + info->bdaddr_type, &info->direct_addr, + info->direct_addr_type, HCI_ADV_PHY_1M, 0, +@@ -7517,73 +7536,29 @@ static bool hci_get_cmd_complete(struct hci_dev *hdev, u16 opcode, + return true; + } + +-static void hci_store_wake_reason(struct hci_dev *hdev, u8 event, +- struct sk_buff *skb) ++static void hci_store_wake_reason(struct hci_dev *hdev, ++ const bdaddr_t *bdaddr, u8 addr_type) ++ __must_hold(&hdev->lock) + { +- struct hci_ev_le_advertising_info *adv; +- struct hci_ev_le_direct_adv_info *direct_adv; +- struct hci_ev_le_ext_adv_info *ext_adv; +- const struct hci_ev_conn_complete *conn_complete = (void *)skb->data; +- const struct hci_ev_conn_request *conn_request = (void *)skb->data; +- +- hci_dev_lock(hdev); ++ lockdep_assert_held(&hdev->lock); + + /* If we are currently suspended and this is the first BT event seen, + * save the wake reason associated with the event. + */ + if (!hdev->suspended || hdev->wake_reason) +- goto unlock; ++ return; ++ ++ if (!bdaddr) { ++ hdev->wake_reason = MGMT_WAKE_REASON_UNEXPECTED; ++ return; ++ } + + /* Default to remote wake. Values for wake_reason are documented in the + * Bluez mgmt api docs. + */ + hdev->wake_reason = MGMT_WAKE_REASON_REMOTE_WAKE; +- +- /* Once configured for remote wakeup, we should only wake up for +- * reconnections. It's useful to see which device is waking us up so +- * keep track of the bdaddr of the connection event that woke us up. +- */ +- if (event == HCI_EV_CONN_REQUEST) { +- bacpy(&hdev->wake_addr, &conn_request->bdaddr); +- hdev->wake_addr_type = BDADDR_BREDR; +- } else if (event == HCI_EV_CONN_COMPLETE) { +- bacpy(&hdev->wake_addr, &conn_complete->bdaddr); +- hdev->wake_addr_type = BDADDR_BREDR; +- } else if (event == HCI_EV_LE_META) { +- struct hci_ev_le_meta *le_ev = (void *)skb->data; +- u8 subevent = le_ev->subevent; +- u8 *ptr = &skb->data[sizeof(*le_ev)]; +- u8 num_reports = *ptr; +- +- if ((subevent == HCI_EV_LE_ADVERTISING_REPORT || +- subevent == HCI_EV_LE_DIRECT_ADV_REPORT || +- subevent == HCI_EV_LE_EXT_ADV_REPORT) && +- num_reports) { +- adv = (void *)(ptr + 1); +- direct_adv = (void *)(ptr + 1); +- ext_adv = (void *)(ptr + 1); +- +- switch (subevent) { +- case HCI_EV_LE_ADVERTISING_REPORT: +- bacpy(&hdev->wake_addr, &adv->bdaddr); +- hdev->wake_addr_type = adv->bdaddr_type; +- break; +- case HCI_EV_LE_DIRECT_ADV_REPORT: +- bacpy(&hdev->wake_addr, &direct_adv->bdaddr); +- hdev->wake_addr_type = direct_adv->bdaddr_type; +- break; +- case HCI_EV_LE_EXT_ADV_REPORT: +- bacpy(&hdev->wake_addr, &ext_adv->bdaddr); +- hdev->wake_addr_type = ext_adv->bdaddr_type; +- break; +- } +- } +- } else { +- hdev->wake_reason = MGMT_WAKE_REASON_UNEXPECTED; +- } +- +-unlock: +- hci_dev_unlock(hdev); ++ bacpy(&hdev->wake_addr, bdaddr); ++ hdev->wake_addr_type = addr_type; + } + + #define HCI_EV_VL(_op, _func, _min_len, _max_len) \ +@@ -7830,14 +7805,15 @@ void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb) + + skb_pull(skb, HCI_EVENT_HDR_SIZE); + +- /* Store wake reason if we're suspended */ +- hci_store_wake_reason(hdev, event, skb); +- + bt_dev_dbg(hdev, "event 0x%2.2x", event); + + hci_event_func(hdev, event, skb, &opcode, &status, &req_complete, + &req_complete_skb); + ++ hci_dev_lock(hdev); ++ hci_store_wake_reason(hdev, NULL, 0); ++ hci_dev_unlock(hdev); ++ + if (req_complete) { + req_complete(hdev, status, opcode); + } else if (req_complete_skb) { -- 2.34.1

1 0