- Kernel - mailweb.openeuler.org

[openeuler:OLK-5.10 3358/3358] include/linux/minmax.h:20:35: warning: comparison of distinct pointer types lacks a cast
by kernel test robot 03 Dec '25

03 Dec '25

Hi SeongJae, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 03e082d09650967490d956864473e92a29ee350f commit: 83b931be40b2829e20f38356509d8706ea6b6238 [3358/3358] mm/damon/core-test: test damon_set_regions config: x86_64-randconfig-001-20251203 (https://download.01.org/0day-ci/archive/20251203/202512030654.YOYxPYw8-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251203/202512030654.YOYxPYw8-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512030654.YOYxPYw8-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from include/linux/kernel.h:14, from arch/x86/include/asm/percpu.h:27, from arch/x86/include/asm/current.h:6, from include/linux/mutex.h:14, from include/linux/damon.h:11, from mm/damon/core.c:10: mm/damon/core-test.h: In function 'damon_test_set_regions': >> include/linux/minmax.h:20:35: warning: comparison of distinct pointer types lacks a cast [-Wcompare-distinct-pointer-types] 20 | (!!(sizeof((typeof(x) *)1 == (typeof(y) *)1))) | ^~ include/kunit/test.h:748:16: note: in expansion of macro '__typecheck' 748 | ((void)__typecheck(__left, __right)); \ | ^~~~~~~~~~~ include/kunit/test.h:772:9: note: in expansion of macro 'KUNIT_BASE_BINARY_ASSERTION' 772 | KUNIT_BASE_BINARY_ASSERTION(test, \ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ include/kunit/test.h:861:9: note: in expansion of macro 'KUNIT_BASE_EQ_MSG_ASSERTION' 861 | KUNIT_BASE_EQ_MSG_ASSERTION(test, \ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ include/kunit/test.h:871:9: note: in expansion of macro 'KUNIT_BINARY_EQ_MSG_ASSERTION' 871 | KUNIT_BINARY_EQ_MSG_ASSERTION(test, \ | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/kunit/test.h:1234:9: note: in expansion of macro 'KUNIT_BINARY_EQ_ASSERTION' 1234 | KUNIT_BINARY_EQ_ASSERTION(test, KUNIT_EXPECTATION, left, right) | ^~~~~~~~~~~~~~~~~~~~~~~~~ mm/damon/core-test.h:284:9: note: in expansion of macro 'KUNIT_EXPECT_EQ' 284 | KUNIT_EXPECT_EQ(test, damon_nr_regions(t), 3); | ^~~~~~~~~~~~~~~ vim +20 include/linux/minmax.h cffb222bc2e032 Rikard Falkeborn 2021-06-07 6 b296a6d53339a7 Andy Shevchenko 2020-10-15 7 /* b296a6d53339a7 Andy Shevchenko 2020-10-15 8 * min()/max()/clamp() macros must accomplish three things: b296a6d53339a7 Andy Shevchenko 2020-10-15 9 * b296a6d53339a7 Andy Shevchenko 2020-10-15 10 * - avoid multiple evaluations of the arguments (so side-effects like b296a6d53339a7 Andy Shevchenko 2020-10-15 11 * "x++" happen only once) when non-constant. b296a6d53339a7 Andy Shevchenko 2020-10-15 12 * - perform strict type-checking (to generate warnings instead of b296a6d53339a7 Andy Shevchenko 2020-10-15 13 * nasty runtime surprises). See the "unnecessary" pointer comparison b296a6d53339a7 Andy Shevchenko 2020-10-15 14 * in __typecheck(). b296a6d53339a7 Andy Shevchenko 2020-10-15 15 * - retain result as a constant expressions when called with only b296a6d53339a7 Andy Shevchenko 2020-10-15 16 * constant expressions (to avoid tripping VLA warnings in stack b296a6d53339a7 Andy Shevchenko 2020-10-15 17 * allocation usage). b296a6d53339a7 Andy Shevchenko 2020-10-15 18 */ b296a6d53339a7 Andy Shevchenko 2020-10-15 19 #define __typecheck(x, y) \ b296a6d53339a7 Andy Shevchenko 2020-10-15 @20 (!!(sizeof((typeof(x) *)1 == (typeof(y) *)1))) b296a6d53339a7 Andy Shevchenko 2020-10-15 21 :::::: The code at line 20 was first introduced by commit :::::: b296a6d53339a79082c1d2c1761e948e8b3def69 kernel.h: split out min()/max() et al. helpers :::::: TO: Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> :::::: CC: Linus Torvalds <torvalds(a)linux-foundation.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] Revert "PCI/MSI: Set device flag indicating only 32-bit MSI support"
by Tengda Wu 02 Dec '25

02 Dec '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IDA4OZ -------------------------------- This reverts commit 9b0bfa99350a6049471b37927d7b941f61dd5edb. The commit causes the CX6 NIC to be unrecognized, so revert it to temporarily avoid this issue. Fixes: 9b0bfa99350a ("PCI/MSI: Set device flag indicating only 32-bit MSI support") Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- drivers/pci/msi.c | 8 ++++---- drivers/pci/probe.c | 6 ------ 2 files changed, 4 insertions(+), 10 deletions(-) diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c index 0d6711e07bca..edbb05145479 100644 --- a/drivers/pci/msi.c +++ b/drivers/pci/msi.c @@ -624,11 +624,11 @@ static int msi_verify_entries(struct pci_dev *dev) struct msi_desc *entry; for_each_pci_msi_entry(entry, dev) { - if (entry->msg.address_hi && dev->no_64bit_msi) { - pci_err(dev, "arch assigned 64-bit MSI address %#x%08x but device only supports 32 bits\n", - entry->msg.address_hi, entry->msg.address_lo); + if (!dev->no_64bit_msi || !entry->msg.address_hi) + continue; + pci_err(dev, "Device has broken 64-bit MSI but arch" + " tried to assign one above 4G\n"); return -EIO; - } } return 0; } diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c index d41f5fd2c205..77772e6f4e35 100644 --- a/drivers/pci/probe.c +++ b/drivers/pci/probe.c @@ -1724,8 +1724,6 @@ static u8 pci_hdr_type(struct pci_dev *dev) static void pci_msi_setup_pci_dev(struct pci_dev *dev) { - u16 ctrl; - /* * Disable the MSI hardware to avoid screaming interrupts * during boot. This is the power on reset default so @@ -1735,10 +1733,6 @@ static void pci_msi_setup_pci_dev(struct pci_dev *dev) if (dev->msi_cap) pci_msi_set_enable(dev, 0); - pci_read_config_word(dev, dev->msi_cap + PCI_MSI_FLAGS, &ctrl); - if (!(ctrl & PCI_MSI_FLAGS_64BIT)) - dev->no_64bit_msi = 1; - dev->msix_cap = pci_find_capability(dev, PCI_CAP_ID_MSIX); if (dev->msix_cap) pci_msix_clear_and_set_ctrl(dev, PCI_MSIX_FLAGS_ENABLE, 0); -- 2.34.1

2 1

[PATCH OLK-5.10] memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove
by Jiacheng Yu 02 Dec '25

02 Dec '25

From: Luo Qiu <luoqiu(a)kylinsec.com.cn> stable inclusion from stable-v5.10.236 commit 9dfaf4d723c62bda8d9d1340e2e78acf0c190439 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1PGY CVE: CVE-2025-22020 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 4676741a3464b300b486e70585c3c9b692be1632 upstream. This fixes the following crash: ================================================================== BUG: KASAN: slab-use-after-free in rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms] Read of size 8 at addr ffff888136335380 by task kworker/6:0/140241 CPU: 6 UID: 0 PID: 140241 Comm: kworker/6:0 Kdump: loaded Tainted: G E 6.14.0-rc6+ #1 Tainted: [E]=UNSIGNED_MODULE Hardware name: LENOVO 30FNA1V7CW/1057, BIOS S0EKT54A 07/01/2024 Workqueue: events rtsx_usb_ms_poll_card [rtsx_usb_ms] Call Trace: <TASK> dump_stack_lvl+0x51/0x70 print_address_description.constprop.0+0x27/0x320 ? rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms] print_report+0x3e/0x70 kasan_report+0xab/0xe0 ? rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms] rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms] ? __pfx_rtsx_usb_ms_poll_card+0x10/0x10 [rtsx_usb_ms] ? __pfx___schedule+0x10/0x10 ? kick_pool+0x3b/0x270 process_one_work+0x357/0x660 worker_thread+0x390/0x4c0 ? __pfx_worker_thread+0x10/0x10 kthread+0x190/0x1d0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2d/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 161446: kasan_save_stack+0x20/0x40 kasan_save_track+0x10/0x30 __kasan_kmalloc+0x7b/0x90 __kmalloc_noprof+0x1a7/0x470 memstick_alloc_host+0x1f/0xe0 [memstick] rtsx_usb_ms_drv_probe+0x47/0x320 [rtsx_usb_ms] platform_probe+0x60/0xe0 call_driver_probe+0x35/0x120 really_probe+0x123/0x410 __driver_probe_device+0xc7/0x1e0 driver_probe_device+0x49/0xf0 __device_attach_driver+0xc6/0x160 bus_for_each_drv+0xe4/0x160 __device_attach+0x13a/0x2b0 bus_probe_device+0xbd/0xd0 device_add+0x4a5/0x760 platform_device_add+0x189/0x370 mfd_add_device+0x587/0x5e0 mfd_add_devices+0xb1/0x130 rtsx_usb_probe+0x28e/0x2e0 [rtsx_usb] usb_probe_interface+0x15c/0x460 call_driver_probe+0x35/0x120 really_probe+0x123/0x410 __driver_probe_device+0xc7/0x1e0 driver_probe_device+0x49/0xf0 __device_attach_driver+0xc6/0x160 bus_for_each_drv+0xe4/0x160 __device_attach+0x13a/0x2b0 rebind_marked_interfaces.isra.0+0xcc/0x110 usb_reset_device+0x352/0x410 usbdev_do_ioctl+0xe5c/0x1860 usbdev_ioctl+0xa/0x20 __x64_sys_ioctl+0xc5/0xf0 do_syscall_64+0x59/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e Freed by task 161506: kasan_save_stack+0x20/0x40 kasan_save_track+0x10/0x30 kasan_save_free_info+0x36/0x60 __kasan_slab_free+0x34/0x50 kfree+0x1fd/0x3b0 device_release+0x56/0xf0 kobject_cleanup+0x73/0x1c0 rtsx_usb_ms_drv_remove+0x13d/0x220 [rtsx_usb_ms] platform_remove+0x2f/0x50 device_release_driver_internal+0x24b/0x2e0 bus_remove_device+0x124/0x1d0 device_del+0x239/0x530 platform_device_del.part.0+0x19/0xe0 platform_device_unregister+0x1c/0x40 mfd_remove_devices_fn+0x167/0x170 device_for_each_child_reverse+0xc9/0x130 mfd_remove_devices+0x6e/0xa0 rtsx_usb_disconnect+0x2e/0xd0 [rtsx_usb] usb_unbind_interface+0xf3/0x3f0 device_release_driver_internal+0x24b/0x2e0 proc_disconnect_claim+0x13d/0x220 usbdev_do_ioctl+0xb5e/0x1860 usbdev_ioctl+0xa/0x20 __x64_sys_ioctl+0xc5/0xf0 do_syscall_64+0x59/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e Last potentially related work creation: kasan_save_stack+0x20/0x40 kasan_record_aux_stack+0x85/0x90 insert_work+0x29/0x100 __queue_work+0x34a/0x540 call_timer_fn+0x2a/0x160 expire_timers+0x5f/0x1f0 __run_timer_base.part.0+0x1b6/0x1e0 run_timer_softirq+0x8b/0xe0 handle_softirqs+0xf9/0x360 __irq_exit_rcu+0x114/0x130 sysvec_apic_timer_interrupt+0x72/0x90 asm_sysvec_apic_timer_interrupt+0x16/0x20 Second to last potentially related work creation: kasan_save_stack+0x20/0x40 kasan_record_aux_stack+0x85/0x90 insert_work+0x29/0x100 __queue_work+0x34a/0x540 call_timer_fn+0x2a/0x160 expire_timers+0x5f/0x1f0 __run_timer_base.part.0+0x1b6/0x1e0 run_timer_softirq+0x8b/0xe0 handle_softirqs+0xf9/0x360 __irq_exit_rcu+0x114/0x130 sysvec_apic_timer_interrupt+0x72/0x90 asm_sysvec_apic_timer_interrupt+0x16/0x20 The buggy address belongs to the object at ffff888136335000 which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 896 bytes inside of freed 2048-byte region [ffff888136335000, ffff888136335800) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x136330 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0x17ffffc0000040(head|node=0|zone=2|lastcpupid=0x1fffff) page_type: f5(slab) raw: 0017ffffc0000040 ffff888100042f00 ffffea000417a000 dead000000000002 raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 head: 0017ffffc0000040 ffff888100042f00 ffffea000417a000 dead000000000002 head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 head: 0017ffffc0000003 ffffea0004d8cc01 ffffffffffffffff 0000000000000000 head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888136335280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888136335300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888136335380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888136335400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888136335480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Fixes: 6827ca573c03 ("memstick: rtsx_usb_ms: Support runtime power management") Signed-off-by: Luo Qiu <luoqiu(a)kylinsec.com.cn> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/4B7BC3E6E291E6F2+20250317101438.25650-1-luoqiu@ky… Signed-off-by: Ulf Hansson <ulf.hansson(a)linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jiacheng Yu <yujiacheng3(a)huawei.com> --- drivers/memstick/host/rtsx_usb_ms.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/memstick/host/rtsx_usb_ms.c b/drivers/memstick/host/rtsx_usb_ms.c index 29271ad4728a..dec279845a75 100644 --- a/drivers/memstick/host/rtsx_usb_ms.c +++ b/drivers/memstick/host/rtsx_usb_ms.c @@ -813,6 +813,7 @@ static int rtsx_usb_ms_drv_remove(struct platform_device *pdev) host->eject = true; cancel_work_sync(&host->handle_req); + cancel_delayed_work_sync(&host->poll_card); mutex_lock(&host->host_mutex); if (host->req) { -- 2.43.0

2 1

[PATCH OLK-5.10] Revert "PCI/MSI: Set device flag indicating only 32-bit MSI support"
by Tengda Wu 02 Dec '25

02 Dec '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IDA4OZ -------------------------------- This reverts commit 9b0bfa99350a6049471b37927d7b941f61dd5edb. The commit causes the CX6 NIC to be unrecognized, so revert it to temporarily avoid this issue. Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- drivers/pci/msi.c | 8 ++++---- drivers/pci/probe.c | 6 ------ 2 files changed, 4 insertions(+), 10 deletions(-) diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c index 0d6711e07bca..edbb05145479 100644 --- a/drivers/pci/msi.c +++ b/drivers/pci/msi.c @@ -624,11 +624,11 @@ static int msi_verify_entries(struct pci_dev *dev) struct msi_desc *entry; for_each_pci_msi_entry(entry, dev) { - if (entry->msg.address_hi && dev->no_64bit_msi) { - pci_err(dev, "arch assigned 64-bit MSI address %#x%08x but device only supports 32 bits\n", - entry->msg.address_hi, entry->msg.address_lo); + if (!dev->no_64bit_msi || !entry->msg.address_hi) + continue; + pci_err(dev, "Device has broken 64-bit MSI but arch" + " tried to assign one above 4G\n"); return -EIO; - } } return 0; } diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c index d41f5fd2c205..77772e6f4e35 100644 --- a/drivers/pci/probe.c +++ b/drivers/pci/probe.c @@ -1724,8 +1724,6 @@ static u8 pci_hdr_type(struct pci_dev *dev) static void pci_msi_setup_pci_dev(struct pci_dev *dev) { - u16 ctrl; - /* * Disable the MSI hardware to avoid screaming interrupts * during boot. This is the power on reset default so @@ -1735,10 +1733,6 @@ static void pci_msi_setup_pci_dev(struct pci_dev *dev) if (dev->msi_cap) pci_msi_set_enable(dev, 0); - pci_read_config_word(dev, dev->msi_cap + PCI_MSI_FLAGS, &ctrl); - if (!(ctrl & PCI_MSI_FLAGS_64BIT)) - dev->no_64bit_msi = 1; - dev->msix_cap = pci_find_capability(dev, PCI_CAP_ID_MSIX); if (dev->msix_cap) pci_msix_clear_and_set_ctrl(dev, PCI_MSIX_FLAGS_ENABLE, 0); -- 2.34.1

2 1

[PATCH OLK-6.6] net/sched: Abort __tc_modify_qdisc if parent class does not exist
by Dong Chenchen 02 Dec '25

02 Dec '25

From: Victor Nogueira <victor(a)mojatatu.com> mainline inclusion from mainline-v6.16-rc6 commit ffdde7bf5a439aaa1955ebd581f5c64ab1533963 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICOXOM CVE: CVE-2025-38457 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Lion's patch [1] revealed an ancient bug in the qdisc API. Whenever a user creates/modifies a qdisc specifying as a parent another qdisc, the qdisc API will, during grafting, detect that the user is not trying to attach to a class and reject. However grafting is performed after qdisc_create (and thus the qdiscs' init callback) is executed. In qdiscs that eventually call qdisc_tree_reduce_backlog during init or change (such as fq, hhf, choke, etc), an issue arises. For example, executing the following commands: sudo tc qdisc add dev lo root handle a: htb default 2 sudo tc qdisc add dev lo parent a: handle beef fq Qdiscs such as fq, hhf, choke, etc unconditionally invoke qdisc_tree_reduce_backlog() in their control path init() or change() which then causes a failure to find the child class; however, that does not stop the unconditional invocation of the assumed child qdisc's qlen_notify with a null class. All these qdiscs make the assumption that class is non-null. The solution is ensure that qdisc_leaf() which looks up the parent class, and is invoked prior to qdisc_create(), should return failure on not finding the class. In this patch, we leverage qdisc_leaf to return ERR_PTRs whenever the parentid doesn't correspond to a class, so that we can detect it earlier on and abort before qdisc_create is called. [1] https://lore.kernel.org/netdev/d912cbd7-193b-4269-9857-525bee8bbb6a@gmail.c… Fixes: 5e50da01d0ce ("[NET_SCHED]: Fix endless loops (part 2): "simple" qdiscs") Reported-by: syzbot+d8b58d7b0ad89a678a16(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/68663c93.a70a0220.5d25f.0857.GAE@google.com/ Reported-by: syzbot+5eccb463fa89309d8bdc(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/68663c94.a70a0220.5d25f.0858.GAE@google.com/ Reported-by: syzbot+1261670bbdefc5485a06(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/686764a5.a00a0220.c7b3.0013.GAE@google.com/ Reported-by: syzbot+15b96fc3aac35468fe77(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/686764a5.a00a0220.c7b3.0014.GAE@google.com/ Reported-by: syzbot+4dadc5aecf80324d5a51(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/68679e81.a70a0220.29cf51.0016.GAE@google.com/ Acked-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Reviewed-by: Cong Wang <xiyou.wangcong(a)gmail.com> Signed-off-by: Victor Nogueira <victor(a)mojatatu.com> Link: https://patch.msgid.link/20250707210801.372995-1-victor@mojatatu.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/sched/sch_api.c [commit 7c79cff95535 is not backport] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/sched/sch_api.c | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-) diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c index 7528354abc3c..13055d6069b3 100644 --- a/net/sched/sch_api.c +++ b/net/sched/sch_api.c @@ -334,17 +334,22 @@ struct Qdisc *qdisc_lookup_rcu(struct net_device *dev, u32 handle) return q; } -static struct Qdisc *qdisc_leaf(struct Qdisc *p, u32 classid) +static struct Qdisc *qdisc_leaf(struct Qdisc *p, u32 classid, + struct netlink_ext_ack *extack) { unsigned long cl; const struct Qdisc_class_ops *cops = p->ops->cl_ops; - if (cops == NULL) - return NULL; + if (cops == NULL) { + NL_SET_ERR_MSG(extack, "Parent qdisc is not classful"); + return ERR_PTR(-EOPNOTSUPP); + } cl = cops->find(p, classid); - if (cl == 0) - return NULL; + if (cl == 0) { + NL_SET_ERR_MSG(extack, "Specified class not found"); + return ERR_PTR(-ENOENT); + } return cops->leaf(p, cl); } @@ -1496,7 +1501,7 @@ static int tc_get_qdisc(struct sk_buff *skb, struct nlmsghdr *n, NL_SET_ERR_MSG(extack, "Failed to find qdisc with specified classid"); return -ENOENT; } - q = qdisc_leaf(p, clid); + q = qdisc_leaf(p, clid, extack); } else if (dev_ingress_queue(dev)) { q = rtnl_dereference(dev_ingress_queue(dev)->qdisc_sleeping); } @@ -1507,6 +1512,8 @@ static int tc_get_qdisc(struct sk_buff *skb, struct nlmsghdr *n, NL_SET_ERR_MSG(extack, "Cannot find specified qdisc on specified device"); return -ENOENT; } + if (IS_ERR(q)) + return PTR_ERR(q); if (tcm->tcm_handle && q->handle != tcm->tcm_handle) { NL_SET_ERR_MSG(extack, "Invalid handle"); @@ -1600,7 +1607,9 @@ static int tc_modify_qdisc(struct sk_buff *skb, struct nlmsghdr *n, NL_SET_ERR_MSG(extack, "Failed to find specified qdisc"); return -ENOENT; } - q = qdisc_leaf(p, clid); + q = qdisc_leaf(p, clid, extack); + if (IS_ERR(q)) + return PTR_ERR(q); } else if (dev_ingress_queue_create(dev)) { q = rtnl_dereference(dev_ingress_queue(dev)->qdisc_sleeping); } -- 2.25.1

2 1

[PATCH OLK-5.10] Bluetooth: hci_core: Fix use-after-free in vhci_flush()
by Dong Chenchen 02 Dec '25

02 Dec '25

From: Kuniyuki Iwashima <kuniyu(a)google.com> mainline inclusion from mainline-v6.16-rc4 commit 1d6123102e9fbedc8d25bf4731da6d513173e49e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICL7Y3 CVE: CVE-2025-38250 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzbot reported use-after-free in vhci_flush() without repro. [0] From the splat, a thread close()d a vhci file descriptor while its device was being used by iotcl() on another thread. Once the last fd refcnt is released, vhci_release() calls hci_unregister_dev(), hci_free_dev(), and kfree() for struct vhci_data, which is set to hci_dev->dev->driver_data. The problem is that there is no synchronisation after unlinking hdev from hci_dev_list in hci_unregister_dev(). There might be another thread still accessing the hdev which was fetched before the unlink operation. We can use SRCU for such synchronisation. Let's run hci_dev_reset() under SRCU and wait for its completion in hci_unregister_dev(). Another option would be to restore hci_dev->destruct(), which was removed in commit 587ae086f6e4 ("Bluetooth: Remove unused hci-destruct cb"). However, this would not be a good solution, as we should not run hci_unregister_dev() while there are in-flight ioctl() requests, which could lead to another data-race KCSAN splat. Note that other drivers seem to have the same problem, for exmaple, virtbt_remove(). [0]: BUG: KASAN: slab-use-after-free in skb_queue_empty_lockless include/linux/skbuff.h:1891 [inline] BUG: KASAN: slab-use-after-free in skb_queue_purge_reason+0x99/0x360 net/core/skbuff.c:3937 Read of size 8 at addr ffff88807cb8d858 by task syz.1.219/6718 CPU: 1 UID: 0 PID: 6718 Comm: syz.1.219 Not tainted 6.16.0-rc1-syzkaller-00196-g08207f42d3ff #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Call Trace: <TASK> dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0xd2/0x2b0 mm/kasan/report.c:521 kasan_report+0x118/0x150 mm/kasan/report.c:634 skb_queue_empty_lockless include/linux/skbuff.h:1891 [inline] skb_queue_purge_reason+0x99/0x360 net/core/skbuff.c:3937 skb_queue_purge include/linux/skbuff.h:3368 [inline] vhci_flush+0x44/0x50 drivers/bluetooth/hci_vhci.c:69 hci_dev_do_reset net/bluetooth/hci_core.c:552 [inline] hci_dev_reset+0x420/0x5c0 net/bluetooth/hci_core.c:592 sock_do_ioctl+0xd9/0x300 net/socket.c:1190 sock_ioctl+0x576/0x790 net/socket.c:1311 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fcf5b98e929 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fcf5c7b9038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007fcf5bbb6160 RCX: 00007fcf5b98e929 RDX: 0000000000000000 RSI: 00000000400448cb RDI: 0000000000000009 RBP: 00007fcf5ba10b39 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fcf5bbb6160 R15: 00007ffd6353d528 </TASK> Allocated by task 6535: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __kmalloc_cache_noprof+0x230/0x3d0 mm/slub.c:4359 kmalloc_noprof include/linux/slab.h:905 [inline] kzalloc_noprof include/linux/slab.h:1039 [inline] vhci_open+0x57/0x360 drivers/bluetooth/hci_vhci.c:635 misc_open+0x2bc/0x330 drivers/char/misc.c:161 chrdev_open+0x4c9/0x5e0 fs/char_dev.c:414 do_dentry_open+0xdf0/0x1970 fs/open.c:964 vfs_open+0x3b/0x340 fs/open.c:1094 do_open fs/namei.c:3887 [inline] path_openat+0x2ee5/0x3830 fs/namei.c:4046 do_filp_open+0x1fa/0x410 fs/namei.c:4073 do_sys_openat2+0x121/0x1c0 fs/open.c:1437 do_sys_open fs/open.c:1452 [inline] __do_sys_openat fs/open.c:1468 [inline] __se_sys_openat fs/open.c:1463 [inline] __x64_sys_openat+0x138/0x170 fs/open.c:1463 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 6535: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x62/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2381 [inline] slab_free mm/slub.c:4643 [inline] kfree+0x18e/0x440 mm/slub.c:4842 vhci_release+0xbc/0xd0 drivers/bluetooth/hci_vhci.c:671 __fput+0x44c/0xa70 fs/file_table.c:465 task_work_run+0x1d1/0x260 kernel/task_work.c:227 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0x6ad/0x22e0 kernel/exit.c:955 do_group_exit+0x21c/0x2d0 kernel/exit.c:1104 __do_sys_exit_group kernel/exit.c:1115 [inline] __se_sys_exit_group kernel/exit.c:1113 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1113 x64_sys_call+0x21ba/0x21c0 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff88807cb8d800 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 88 bytes inside of freed 1024-byte region [ffff88807cb8d800, ffff88807cb8dc00) Fixes: bf18c7118cf8 ("Bluetooth: vhci: Free driver_data on file release") Reported-by: syzbot+2faa4825e556199361f9(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=f62d64848fc4c7c30cd6 Signed-off-by: Kuniyuki Iwashima <kuniyu(a)google.com> Acked-by: Paul Menzel <pmenzel(a)molgen.mpg.de> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Conflicts: include/net/bluetooth/hci_core.h net/bluetooth/hci_core.c [commit 04425292a62c and 989fa5171f00 are not backport] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- include/net/bluetooth/hci_core.h | 2 ++ net/bluetooth/hci_core.c | 34 ++++++++++++++++++++++++++++---- 2 files changed, 32 insertions(+), 4 deletions(-) diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h index 40981e4d8176..e3f98bd831e0 100644 --- a/include/net/bluetooth/hci_core.h +++ b/include/net/bluetooth/hci_core.h @@ -28,6 +28,7 @@ #include <linux/idr.h> #include <linux/leds.h> #include <linux/rculist.h> +#include <linux/srcu.h> #include <net/bluetooth/hci.h> #include <net/bluetooth/hci_sock.h> @@ -290,6 +291,7 @@ struct amp_assoc { struct hci_dev { struct list_head list; + struct srcu_struct srcu; struct mutex lock; const char *name; diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c index e5654f88bb17..0a517bdf2de6 100644 --- a/net/bluetooth/hci_core.c +++ b/net/bluetooth/hci_core.c @@ -1040,7 +1040,7 @@ static int hci_linkpol_req(struct hci_request *req, unsigned long opt) /* Get HCI device by index. * Device is held on return. */ -struct hci_dev *hci_dev_get(int index) +static struct hci_dev *__hci_dev_get(int index, int *srcu_index) { struct hci_dev *hdev = NULL, *d; @@ -1053,6 +1053,8 @@ struct hci_dev *hci_dev_get(int index) list_for_each_entry(d, &hci_dev_list, list) { if (d->id == index) { hdev = hci_dev_hold(d); + if (srcu_index) + *srcu_index = srcu_read_lock(&d->srcu); break; } } @@ -1060,6 +1062,22 @@ struct hci_dev *hci_dev_get(int index) return hdev; } +struct hci_dev *hci_dev_get(int index) +{ + return __hci_dev_get(index, NULL); +} + +static struct hci_dev *hci_dev_get_srcu(int index, int *srcu_index) +{ + return __hci_dev_get(index, srcu_index); +} + +static void hci_dev_put_srcu(struct hci_dev *hdev, int srcu_index) +{ + srcu_read_unlock(&hdev->srcu, srcu_index); + hci_dev_put(hdev); +} + /* ---- Inquiry support ---- */ bool hci_discovery_active(struct hci_dev *hdev) @@ -1906,9 +1924,9 @@ static int hci_dev_do_reset(struct hci_dev *hdev) int hci_dev_reset(__u16 dev) { struct hci_dev *hdev; - int err; + int err, srcu_index; - hdev = hci_dev_get(dev); + hdev = hci_dev_get_srcu(dev, &srcu_index); if (!hdev) return -ENODEV; @@ -1930,7 +1948,7 @@ int hci_dev_reset(__u16 dev) err = hci_dev_do_reset(hdev); done: - hci_dev_put(hdev); + hci_dev_put_srcu(hdev, srcu_index); return err; } @@ -3596,6 +3614,11 @@ struct hci_dev *hci_alloc_dev(void) if (!hdev) return NULL; + if (init_srcu_struct(&hdev->srcu)) { + kfree(hdev); + return NULL; + } + hdev->pkt_type = (HCI_DM1 | HCI_DH1 | HCI_HV1); hdev->esco_type = (ESCO_HV1); hdev->link_mode = (HCI_LM_ACCEPT); @@ -3840,6 +3863,9 @@ void hci_unregister_dev(struct hci_dev *hdev) list_del(&hdev->list); write_unlock(&hci_dev_list_lock); + synchronize_srcu(&hdev->srcu); + cleanup_srcu_struct(&hdev->srcu); + cancel_work_sync(&hdev->rx_work); cancel_work_sync(&hdev->cmd_work); cancel_work_sync(&hdev->tx_work); -- 2.25.1

2 1

[PATCH OLK-5.10] netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX
by Dong Chenchen 02 Dec '25

02 Dec '25

From: Pablo Neira Ayuso <pablo(a)netfilter.org> mainline inclusion from mainline-v6.16-rc1 commit b85e3367a5716ed3662a4fe266525190d2af76df category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICK4OD CVE: CVE-2025-38201 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Otherwise, it is possible to hit WARN_ON_ONCE in __kvmalloc_node_noprof() when resizing hashtable because __GFP_NOWARN is unset. Similar to: b541ba7d1f5a ("netfilter: conntrack: clamp maximum hashtable size to INT_MAX") Reviewed-by: Stefano Brivio <sbrivio(a)redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/nft_set_pipapo.c [commit 07ace0bbe03b and 9f439bd6ef4f are not backport] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/nft_set_pipapo.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c index 1a76c9bf8fb9..c2d568259928 100644 --- a/net/netfilter/nft_set_pipapo.c +++ b/net/netfilter/nft_set_pipapo.c @@ -665,6 +665,11 @@ static int pipapo_resize(struct nft_pipapo_field *f, int old_rules, int rules) } mt: + if (rules > (INT_MAX / sizeof(*new_mt))) { + kvfree(new_lt); + return -ENOMEM; + } + new_mt = kvmalloc(rules * sizeof(*new_mt), GFP_KERNEL); if (!new_mt) { kvfree(new_lt); @@ -1358,6 +1363,9 @@ static struct nft_pipapo_match *pipapo_clone(struct nft_pipapo_match *old) src->bsize * sizeof(*dst->lt) * src->groups * NFT_PIPAPO_BUCKETS(src->bb)); + if (src->rules > (INT_MAX / sizeof(*src->mt))) + goto out_mt; + dst->mt = kvmalloc(src->rules * sizeof(*src->mt), GFP_KERNEL); if (!dst->mt) goto out_mt; -- 2.25.1

2 1

[PATCH OLK-5.10] RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem
by Dong Chenchen 02 Dec '25

02 Dec '25

From: Zhu Yanjun <yanjun.zhu(a)linux.dev> mainline inclusion from mainline-v6.15-rc1 commit d0706bfd3ee40923c001c6827b786a309e2a8713 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICGALO CVE: CVE-2025-38022 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0xc3/0x670 mm/kasan/report.c:521 kasan_report+0xe0/0x110 mm/kasan/report.c:634 strlen+0x93/0xa0 lib/string.c:420 __fortify_strlen include/linux/fortify-string.h:268 [inline] get_kobj_path_length lib/kobject.c:118 [inline] kobject_get_path+0x3f/0x2a0 lib/kobject.c:158 kobject_uevent_env+0x289/0x1870 lib/kobject_uevent.c:545 ib_register_device drivers/infiniband/core/device.c:1472 [inline] ib_register_device+0x8cf/0xe00 drivers/infiniband/core/device.c:1393 rxe_register_device+0x275/0x320 drivers/infiniband/sw/rxe/rxe_verbs.c:1552 rxe_net_add+0x8e/0xe0 drivers/infiniband/sw/rxe/rxe_net.c:550 rxe_newlink+0x70/0x190 drivers/infiniband/sw/rxe/rxe.c:225 nldev_newlink+0x3a3/0x680 drivers/infiniband/core/nldev.c:1796 rdma_nl_rcv_msg+0x387/0x6e0 drivers/infiniband/core/netlink.c:195 rdma_nl_rcv_skb.constprop.0.isra.0+0x2e5/0x450 netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline] netlink_unicast+0x53a/0x7f0 net/netlink/af_netlink.c:1339 netlink_sendmsg+0x8d1/0xdd0 net/netlink/af_netlink.c:1883 sock_sendmsg_nosec net/socket.c:712 [inline] __sock_sendmsg net/socket.c:727 [inline] ____sys_sendmsg+0xa95/0xc70 net/socket.c:2566 ___sys_sendmsg+0x134/0x1d0 net/socket.c:2620 __sys_sendmsg+0x16d/0x220 net/socket.c:2652 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f This problem is similar to the problem that the commit 1d6a9e7449e2 ("RDMA/core: Fix use-after-free when rename device name") fixes. The root cause is: the function ib_device_rename() renames the name with lock. But in the function kobject_uevent(), this name is accessed without lock protection at the same time. The solution is to add the lock protection when this name is accessed in the function kobject_uevent(). Fixes: 779e0bf47632 ("RDMA/core: Do not indicate device ready when device enablement fails") Link: https://patch.msgid.link/r/20250506151008.75701-1-yanjun.zhu@linux.dev Reported-by: syzbot+e2ce9e275ecc70a30b72(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=e2ce9e275ecc70a30b72 Signed-off-by: Zhu Yanjun <yanjun.zhu(a)linux.dev> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Conflicts: drivers/infiniband/core/device.c [commit 1d6a9e7449e2 is not backport] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/infiniband/core/device.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c index da0d3eda4cc2..68b5973ea525 100644 --- a/drivers/infiniband/core/device.c +++ b/drivers/infiniband/core/device.c @@ -1385,8 +1385,10 @@ int ib_register_device(struct ib_device *device, const char *name, return ret; } dev_set_uevent_suppress(&device->dev, false); + down_read(&devices_rwsem); /* Mark for userspace that device is ready */ kobject_uevent(&device->dev.kobj, KOBJ_ADD); + up_read(&devices_rwsem); ib_device_put(device); return 0; -- 2.25.1

2 1

[PATCH OLK-5.10] net: openvswitch: fix nested key length validation in the set() action
by Dong Chenchen 02 Dec '25

02 Dec '25

From: Ilya Maximets <i.maximets(a)ovn.org> stable inclusion from stable-v5.10.237 commit 7fcaec0b2ab8fa5fbf0b45e5512364a168f445bd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC5BN0 CVE: CVE-2025-37789 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 65d91192aa66f05710cfddf6a14b5a25ee554dba ] It's not safe to access nla_len(ovs_key) if the data is smaller than the netlink header. Check that the attribute is OK first. Fixes: ccb1352e76cf ("net: Add Open vSwitch kernel components.") Reported-by: syzbot+b07a9da40df1576b8048(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b07a9da40df1576b8048 Tested-by: syzbot+b07a9da40df1576b8048(a)syzkaller.appspotmail.com Signed-off-by: Ilya Maximets <i.maximets(a)ovn.org> Reviewed-by: Eelco Chaudron <echaudro(a)redhat.com> Acked-by: Aaron Conole <aconole(a)redhat.com> Link: https://patch.msgid.link/20250412104052.2073688-1-i.maximets@ovn.org Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/openvswitch/flow_netlink.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c index cff18a5bbf38..3f8f43dbf44f 100644 --- a/net/openvswitch/flow_netlink.c +++ b/net/openvswitch/flow_netlink.c @@ -2834,7 +2834,8 @@ static int validate_set(const struct nlattr *a, size_t key_len; /* There can be only one key in a action */ - if (nla_total_size(nla_len(ovs_key)) != nla_len(a)) + if (!nla_ok(ovs_key, nla_len(a)) || + nla_total_size(nla_len(ovs_key)) != nla_len(a)) return -EINVAL; key_len = nla_len(ovs_key); -- 2.25.1

2 1

[PATCH] media: venus: hfi: add check to handle incorrect queue size
by Jiacheng Yu 02 Dec '25

02 Dec '25

From: Vikash Garodia <quic_vgarodia(a)quicinc.com> commit 69baf245b23e20efda0079238b27fc63ecf13de1 upstream. qsize represents size of shared queued between driver and video firmware. Firmware can modify this value to an invalid large value. In such situation, empty_space will be bigger than the space actually available. Since new_wr_idx is not checked, so the following code will result in an OOB write. ... qsize = qhdr->q_size if (wr_idx >= rd_idx) empty_space = qsize - (wr_idx - rd_idx) .... if (new_wr_idx < qsize) { memcpy(wr_ptr, packet, dwords << 2) --> OOB write Add check to ensure qsize is within the allocated size while reading and writing packets into the queue. Cc: stable(a)vger.kernel.org Fixes: d96d3f30c0f2 ("[media] media: venus: hfi: add Venus HFI files") Reviewed-by: Bryan O'Donoghue <bryan.odonoghue(a)linaro.org> Signed-off-by: Vikash Garodia <quic_vgarodia(a)quicinc.com> Signed-off-by: Hans Verkuil <hverkuil(a)xs4all.nl> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/media/platform/qcom/venus/hfi_venus.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/media/platform/qcom/venus/hfi_venus.c b/drivers/media/platform/qcom/venus/hfi_venus.c index cfd9471560cc..ab93757fff4b 100644 --- a/drivers/media/platform/qcom/venus/hfi_venus.c +++ b/drivers/media/platform/qcom/venus/hfi_venus.c @@ -187,6 +187,9 @@ static int venus_write_queue(struct venus_hfi_device *hdev, /* ensure rd/wr indices's are read from memory */ rmb(); + if (qsize > IFACEQ_QUEUE_SIZE / 4) + return -EINVAL; + if (wr_idx >= rd_idx) empty_space = qsize - (wr_idx - rd_idx); else @@ -255,6 +258,9 @@ static int venus_read_queue(struct venus_hfi_device *hdev, wr_idx = qhdr->write_idx; qsize = qhdr->q_size; + if (qsize > IFACEQ_QUEUE_SIZE / 4) + return -EINVAL; + /* make sure data is valid before using it */ rmb(); -- 2.43.0

1 0

[PATCH OLK-5.10] net: ppp: Add bound checking for skb data on ppp_sync_txmung
by Dong Chenchen 02 Dec '25

02 Dec '25

From: Arnaud Lecomte <contact(a)arnaud-lcm.com> stable inclusion from stable-v5.10.237 commit de5a4f0cba58625e88b7bebd88f780c8c0150997 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC5BHL CVE: CVE-2025-37749 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit aabc6596ffb377c4c9c8f335124b92ea282c9821 ] Ensure we have enough data in linear buffer from skb before accessing initial bytes. This prevents potential out-of-bounds accesses when processing short packets. When ppp_sync_txmung receives an incoming package with an empty payload: (remote) gef➤ p *(struct pppoe_hdr *) (skb->head + skb->network_header) $18 = { type = 0x1, ver = 0x1, code = 0x0, sid = 0x2, length = 0x0, tag = 0xffff8880371cdb96 } from the skb struct (trimmed) tail = 0x16, end = 0x140, head = 0xffff88803346f400 "4", data = 0xffff88803346f416 ":\377", truesize = 0x380, len = 0x0, data_len = 0x0, mac_len = 0xe, hdr_len = 0x0, it is not safe to access data[2]. Reported-by: syzbot+29fc8991b0ecb186cf40(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=29fc8991b0ecb186cf40 Tested-by: syzbot+29fc8991b0ecb186cf40(a)syzkaller.appspotmail.com Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Arnaud Lecomte <contact(a)arnaud-lcm.com> Link: https://patch.msgid.link/20250408-bound-checking-ppp_txmung-v2-1-94bb6e1b92… [pabeni(a)redhat.com: fixed subj typo] Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/net/ppp/ppp_synctty.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/net/ppp/ppp_synctty.c b/drivers/net/ppp/ppp_synctty.c index 717431636275..11725cab4912 100644 --- a/drivers/net/ppp/ppp_synctty.c +++ b/drivers/net/ppp/ppp_synctty.c @@ -517,6 +517,11 @@ ppp_sync_txmunge(struct syncppp *ap, struct sk_buff *skb) unsigned char *data; int islcp; + /* Ensure we can safely access protocol field and LCP code */ + if (!pskb_may_pull(skb, 3)) { + kfree_skb(skb); + return NULL; + } data = skb->data; proto = get_unaligned_be16(data); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint
by Jiacheng Yu 02 Dec '25

02 Dec '25

From: Mike Christie <michael.christie(a)oracle.com> stable inclusion from stable-v6.6.87 commit 2b34bdc42df047794542f3e220fe989124e4499a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QRK CVE: CVE-2025-22083 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5dd639a1646ef5fe8f4bf270fad47c5c3755b9b6 ] If vhost_scsi_set_endpoint is called multiple times without a vhost_scsi_clear_endpoint between them, we can hit multiple bugs found by Haoran Zhang: 1. Use-after-free when no tpgs are found: This fixes a use after free that occurs when vhost_scsi_set_endpoint is called more than once and calls after the first call do not find any tpgs to add to the vs_tpg. When vhost_scsi_set_endpoint first finds tpgs to add to the vs_tpg array match=true, so we will do: vhost_vq_set_backend(vq, vs_tpg); ... kfree(vs->vs_tpg); vs->vs_tpg = vs_tpg; If vhost_scsi_set_endpoint is called again and no tpgs are found match=false so we skip the vhost_vq_set_backend call leaving the pointer to the vs_tpg we then free via: kfree(vs->vs_tpg); vs->vs_tpg = vs_tpg; If a scsi request is then sent we do: vhost_scsi_handle_vq -> vhost_scsi_get_req -> vhost_vq_get_backend which sees the vs_tpg we just did a kfree on. 2. Tpg dir removal hang: This patch fixes an issue where we cannot remove a LIO/target layer tpg (and structs above it like the target) dir due to the refcount dropping to -1. The problem is that if vhost_scsi_set_endpoint detects a tpg is already in the vs->vs_tpg array or if the tpg has been removed so target_depend_item fails, the undepend goto handler will do target_undepend_item on all tpgs in the vs_tpg array dropping their refcount to 0. At this time vs_tpg contains both the tpgs we have added in the current vhost_scsi_set_endpoint call as well as tpgs we added in previous calls which are also in vs->vs_tpg. Later, when vhost_scsi_clear_endpoint runs it will do target_undepend_item on all the tpgs in the vs->vs_tpg which will drop their refcount to -1. Userspace will then not be able to remove the tpg and will hang when it tries to do rmdir on the tpg dir. 3. Tpg leak: This fixes a bug where we can leak tpgs and cause them to be un-removable because the target name is overwritten when vhost_scsi_set_endpoint is called multiple times but with different target names. The bug occurs if a user has called VHOST_SCSI_SET_ENDPOINT and setup a vhost-scsi device to target/tpg mapping, then calls VHOST_SCSI_SET_ENDPOINT again with a new target name that has tpgs we haven't seen before (target1 has tpg1 but target2 has tpg2). When this happens we don't teardown the old target tpg mapping and just overwrite the target name and the vs->vs_tpg array. Later when we do vhost_scsi_clear_endpoint, we are passed in either target1 or target2's name and we will only match that target's tpgs when we loop over the vs->vs_tpg. We will then return from the function without doing target_undepend_item on the tpgs. Because of all these bugs, it looks like being able to call vhost_scsi_set_endpoint multiple times was never supported. The major user, QEMU, already has checks to prevent this use case. So to fix the issues, this patch prevents vhost_scsi_set_endpoint from being called if it's already successfully added tpgs. To add, remove or change the tpg config or target name, you must do a vhost_scsi_clear_endpoint first. Fixes: 25b98b64e284 ("vhost scsi: alloc cmds per vq instead of session") Fixes: 4f7f46d32c98 ("tcm_vhost: Use vq->private_data to indicate if the endpoint is setup") Reported-by: Haoran Zhang <wh1sper(a)zju.edu.cn> Closes: https://lore.kernel.org/virtualization/e418a5ee-45ca-4d18-9b5d-6f8b6b1add8e… Signed-off-by: Mike Christie <michael.christie(a)oracle.com> Reviewed-by: Stefan Hajnoczi <stefanha(a)redhat.com> Message-Id: <20250129210922.121533-1-michael.christie(a)oracle.com> Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Acked-by: Stefano Garzarella <sgarzare(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/vhost/scsi.c [commit 25b98b64e284 is not backport.] Signed-off-by: Jiacheng Yu <yujiacheng3(a)huawei.com> --- drivers/vhost/scsi.c | 27 +++++++++++++++------------ 1 file changed, 15 insertions(+), 12 deletions(-) diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c index 0535f4abd37d..c485cb9d4f52 100644 --- a/drivers/vhost/scsi.c +++ b/drivers/vhost/scsi.c @@ -1181,14 +1181,19 @@ vhost_scsi_set_endpoint(struct vhost_scsi *vs, } } + if (vs->vs_tpg) { + pr_err("vhost-scsi endpoint already set for %s.\n", + vs->vs_vhost_wwpn); + ret = -EEXIST; + goto out; + } + len = sizeof(vs_tpg[0]) * VHOST_SCSI_MAX_TARGET; vs_tpg = kzalloc(len, GFP_KERNEL); if (!vs_tpg) { ret = -ENOMEM; goto out; } - if (vs->vs_tpg) - memcpy(vs_tpg, vs->vs_tpg, len); list_for_each_entry(tpg, &vhost_scsi_list, tv_tpg_list) { mutex_lock(&tpg->tv_tpg_mutex); @@ -1203,12 +1208,6 @@ vhost_scsi_set_endpoint(struct vhost_scsi *vs, tv_tport = tpg->tport; if (!strcmp(tv_tport->tport_name, t->vhost_wwpn)) { - if (vs->vs_tpg && vs->vs_tpg[tpg->tport_tpgt]) { - kfree(vs_tpg); - mutex_unlock(&tpg->tv_tpg_mutex); - ret = -EEXIST; - goto out; - } /* * In order to ensure individual vhost-scsi configfs * groups cannot be removed while in use by vhost ioctl, @@ -1244,17 +1243,20 @@ vhost_scsi_set_endpoint(struct vhost_scsi *vs, } ret = 0; } else { - ret = -EEXIST; + ret = -ENODEV; + goto free_tpg; } /* - * Act as synchronize_rcu to make sure access to - * old vs->vs_tpg is finished. + * Act as synchronize_rcu to make sure requests after this point + * see a fully setup device. */ vhost_scsi_flush(vs); - kfree(vs->vs_tpg); vs->vs_tpg = vs_tpg; + goto out; +free_tpg: + kfree(vs_tpg); out: mutex_unlock(&vs->dev.mutex); mutex_unlock(&vhost_scsi_mutex); @@ -1336,6 +1338,7 @@ vhost_scsi_clear_endpoint(struct vhost_scsi *vs, vhost_scsi_flush(vs); kfree(vs->vs_tpg); vs->vs_tpg = NULL; + memset(vs->vs_vhost_wwpn, 0, sizeof(vs->vs_vhost_wwpn)); WARN_ON(vs->vs_events_nr); mutex_unlock(&vs->dev.mutex); mutex_unlock(&vhost_scsi_mutex); -- 2.43.0

2 1

[PATCH OLK-5.10] memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove
by Jiacheng Yu 02 Dec '25

02 Dec '25

From: Luo Qiu <luoqiu(a)kylinsec.com.cn> stable inclusion from stable=v5.10.236 commit 9dfaf4d723c62bda8d9d1340e2e78acf0c190439 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1PGY CVE: CVE-2025-22020 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 4676741a3464b300b486e70585c3c9b692be1632 upstream. This fixes the following crash: ================================================================== BUG: KASAN: slab-use-after-free in rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms] Read of size 8 at addr ffff888136335380 by task kworker/6:0/140241 CPU: 6 UID: 0 PID: 140241 Comm: kworker/6:0 Kdump: loaded Tainted: G E 6.14.0-rc6+ #1 Tainted: [E]=UNSIGNED_MODULE Hardware name: LENOVO 30FNA1V7CW/1057, BIOS S0EKT54A 07/01/2024 Workqueue: events rtsx_usb_ms_poll_card [rtsx_usb_ms] Call Trace: <TASK> dump_stack_lvl+0x51/0x70 print_address_description.constprop.0+0x27/0x320 ? rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms] print_report+0x3e/0x70 kasan_report+0xab/0xe0 ? rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms] rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms] ? __pfx_rtsx_usb_ms_poll_card+0x10/0x10 [rtsx_usb_ms] ? __pfx___schedule+0x10/0x10 ? kick_pool+0x3b/0x270 process_one_work+0x357/0x660 worker_thread+0x390/0x4c0 ? __pfx_worker_thread+0x10/0x10 kthread+0x190/0x1d0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2d/0x50 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 161446: kasan_save_stack+0x20/0x40 kasan_save_track+0x10/0x30 __kasan_kmalloc+0x7b/0x90 __kmalloc_noprof+0x1a7/0x470 memstick_alloc_host+0x1f/0xe0 [memstick] rtsx_usb_ms_drv_probe+0x47/0x320 [rtsx_usb_ms] platform_probe+0x60/0xe0 call_driver_probe+0x35/0x120 really_probe+0x123/0x410 __driver_probe_device+0xc7/0x1e0 driver_probe_device+0x49/0xf0 __device_attach_driver+0xc6/0x160 bus_for_each_drv+0xe4/0x160 __device_attach+0x13a/0x2b0 bus_probe_device+0xbd/0xd0 device_add+0x4a5/0x760 platform_device_add+0x189/0x370 mfd_add_device+0x587/0x5e0 mfd_add_devices+0xb1/0x130 rtsx_usb_probe+0x28e/0x2e0 [rtsx_usb] usb_probe_interface+0x15c/0x460 call_driver_probe+0x35/0x120 really_probe+0x123/0x410 __driver_probe_device+0xc7/0x1e0 driver_probe_device+0x49/0xf0 __device_attach_driver+0xc6/0x160 bus_for_each_drv+0xe4/0x160 __device_attach+0x13a/0x2b0 rebind_marked_interfaces.isra.0+0xcc/0x110 usb_reset_device+0x352/0x410 usbdev_do_ioctl+0xe5c/0x1860 usbdev_ioctl+0xa/0x20 __x64_sys_ioctl+0xc5/0xf0 do_syscall_64+0x59/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e Freed by task 161506: kasan_save_stack+0x20/0x40 kasan_save_track+0x10/0x30 kasan_save_free_info+0x36/0x60 __kasan_slab_free+0x34/0x50 kfree+0x1fd/0x3b0 device_release+0x56/0xf0 kobject_cleanup+0x73/0x1c0 rtsx_usb_ms_drv_remove+0x13d/0x220 [rtsx_usb_ms] platform_remove+0x2f/0x50 device_release_driver_internal+0x24b/0x2e0 bus_remove_device+0x124/0x1d0 device_del+0x239/0x530 platform_device_del.part.0+0x19/0xe0 platform_device_unregister+0x1c/0x40 mfd_remove_devices_fn+0x167/0x170 device_for_each_child_reverse+0xc9/0x130 mfd_remove_devices+0x6e/0xa0 rtsx_usb_disconnect+0x2e/0xd0 [rtsx_usb] usb_unbind_interface+0xf3/0x3f0 device_release_driver_internal+0x24b/0x2e0 proc_disconnect_claim+0x13d/0x220 usbdev_do_ioctl+0xb5e/0x1860 usbdev_ioctl+0xa/0x20 __x64_sys_ioctl+0xc5/0xf0 do_syscall_64+0x59/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e Last potentially related work creation: kasan_save_stack+0x20/0x40 kasan_record_aux_stack+0x85/0x90 insert_work+0x29/0x100 __queue_work+0x34a/0x540 call_timer_fn+0x2a/0x160 expire_timers+0x5f/0x1f0 __run_timer_base.part.0+0x1b6/0x1e0 run_timer_softirq+0x8b/0xe0 handle_softirqs+0xf9/0x360 __irq_exit_rcu+0x114/0x130 sysvec_apic_timer_interrupt+0x72/0x90 asm_sysvec_apic_timer_interrupt+0x16/0x20 Second to last potentially related work creation: kasan_save_stack+0x20/0x40 kasan_record_aux_stack+0x85/0x90 insert_work+0x29/0x100 __queue_work+0x34a/0x540 call_timer_fn+0x2a/0x160 expire_timers+0x5f/0x1f0 __run_timer_base.part.0+0x1b6/0x1e0 run_timer_softirq+0x8b/0xe0 handle_softirqs+0xf9/0x360 __irq_exit_rcu+0x114/0x130 sysvec_apic_timer_interrupt+0x72/0x90 asm_sysvec_apic_timer_interrupt+0x16/0x20 The buggy address belongs to the object at ffff888136335000 which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 896 bytes inside of freed 2048-byte region [ffff888136335000, ffff888136335800) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x136330 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0x17ffffc0000040(head|node=0|zone=2|lastcpupid=0x1fffff) page_type: f5(slab) raw: 0017ffffc0000040 ffff888100042f00 ffffea000417a000 dead000000000002 raw: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 head: 0017ffffc0000040 ffff888100042f00 ffffea000417a000 dead000000000002 head: 0000000000000000 0000000000080008 00000000f5000000 0000000000000000 head: 0017ffffc0000003 ffffea0004d8cc01 ffffffffffffffff 0000000000000000 head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888136335280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888136335300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888136335380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888136335400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888136335480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Fixes: 6827ca573c03 ("memstick: rtsx_usb_ms: Support runtime power management") Signed-off-by: Luo Qiu <luoqiu(a)kylinsec.com.cn> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/4B7BC3E6E291E6F2+20250317101438.25650-1-luoqiu@ky… Signed-off-by: Ulf Hansson <ulf.hansson(a)linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jiacheng Yu <yujiacheng3(a)huawei.com> --- drivers/memstick/host/rtsx_usb_ms.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/memstick/host/rtsx_usb_ms.c b/drivers/memstick/host/rtsx_usb_ms.c index 29271ad4728a..dec279845a75 100644 --- a/drivers/memstick/host/rtsx_usb_ms.c +++ b/drivers/memstick/host/rtsx_usb_ms.c @@ -813,6 +813,7 @@ static int rtsx_usb_ms_drv_remove(struct platform_device *pdev) host->eject = true; cancel_work_sync(&host->handle_req); + cancel_delayed_work_sync(&host->poll_card); mutex_lock(&host->host_mutex); if (host->req) { -- 2.43.0

2 1

[PATCH OLK-5.10] vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint
by Jiacheng Yu 02 Dec '25

02 Dec '25

From: Mike Christie <michael.christie(a)oracle.com> stable inclusion from stable-v6.6.87 commit 2b34bdc42df047794542f3e220fe989124e4499a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QRK CVE: CVE-2025-22083 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5dd639a1646ef5fe8f4bf270fad47c5c3755b9b6 ] If vhost_scsi_set_endpoint is called multiple times without a vhost_scsi_clear_endpoint between them, we can hit multiple bugs found by Haoran Zhang: 1. Use-after-free when no tpgs are found: This fixes a use after free that occurs when vhost_scsi_set_endpoint is called more than once and calls after the first call do not find any tpgs to add to the vs_tpg. When vhost_scsi_set_endpoint first finds tpgs to add to the vs_tpg array match=true, so we will do: vhost_vq_set_backend(vq, vs_tpg); ... kfree(vs->vs_tpg); vs->vs_tpg = vs_tpg; If vhost_scsi_set_endpoint is called again and no tpgs are found match=false so we skip the vhost_vq_set_backend call leaving the pointer to the vs_tpg we then free via: kfree(vs->vs_tpg); vs->vs_tpg = vs_tpg; If a scsi request is then sent we do: vhost_scsi_handle_vq -> vhost_scsi_get_req -> vhost_vq_get_backend which sees the vs_tpg we just did a kfree on. 2. Tpg dir removal hang: This patch fixes an issue where we cannot remove a LIO/target layer tpg (and structs above it like the target) dir due to the refcount dropping to -1. The problem is that if vhost_scsi_set_endpoint detects a tpg is already in the vs->vs_tpg array or if the tpg has been removed so target_depend_item fails, the undepend goto handler will do target_undepend_item on all tpgs in the vs_tpg array dropping their refcount to 0. At this time vs_tpg contains both the tpgs we have added in the current vhost_scsi_set_endpoint call as well as tpgs we added in previous calls which are also in vs->vs_tpg. Later, when vhost_scsi_clear_endpoint runs it will do target_undepend_item on all the tpgs in the vs->vs_tpg which will drop their refcount to -1. Userspace will then not be able to remove the tpg and will hang when it tries to do rmdir on the tpg dir. 3. Tpg leak: This fixes a bug where we can leak tpgs and cause them to be un-removable because the target name is overwritten when vhost_scsi_set_endpoint is called multiple times but with different target names. The bug occurs if a user has called VHOST_SCSI_SET_ENDPOINT and setup a vhost-scsi device to target/tpg mapping, then calls VHOST_SCSI_SET_ENDPOINT again with a new target name that has tpgs we haven't seen before (target1 has tpg1 but target2 has tpg2). When this happens we don't teardown the old target tpg mapping and just overwrite the target name and the vs->vs_tpg array. Later when we do vhost_scsi_clear_endpoint, we are passed in either target1 or target2's name and we will only match that target's tpgs when we loop over the vs->vs_tpg. We will then return from the function without doing target_undepend_item on the tpgs. Because of all these bugs, it looks like being able to call vhost_scsi_set_endpoint multiple times was never supported. The major user, QEMU, already has checks to prevent this use case. So to fix the issues, this patch prevents vhost_scsi_set_endpoint from being called if it's already successfully added tpgs. To add, remove or change the tpg config or target name, you must do a vhost_scsi_clear_endpoint first. Fixes: 25b98b64e284 ("vhost scsi: alloc cmds per vq instead of session") Fixes: 4f7f46d32c98 ("tcm_vhost: Use vq->private_data to indicate if the endpoint is setup") Reported-by: Haoran Zhang <wh1sper(a)zju.edu.cn> Closes: https://lore.kernel.org/virtualization/e418a5ee-45ca-4d18-9b5d-6f8b6b1add8e… Signed-off-by: Mike Christie <michael.christie(a)oracle.com> Reviewed-by: Stefan Hajnoczi <stefanha(a)redhat.com> Message-Id: <20250129210922.121533-1-michael.christie(a)oracle.com> Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com> Acked-by: Stefano Garzarella <sgarzare(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/vhost/scsi.c [Context conflicts.] Signed-off-by: Jiacheng Yu <yujiacheng3(a)huawei.com> --- drivers/vhost/scsi.c | 24 +++++++++++++----------- 1 file changed, 13 insertions(+), 11 deletions(-) diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c index da38525d2e60..190c601c7fc4 100644 --- a/drivers/vhost/scsi.c +++ b/drivers/vhost/scsi.c @@ -1594,14 +1594,19 @@ vhost_scsi_set_endpoint(struct vhost_scsi *vs, } } + if (vs->vs_tpg) { + pr_err("vhost-scsi endpoint already set for %s.\n", + vs->vs_vhost_wwpn); + ret = -EEXIST; + goto out; + } + len = sizeof(vs_tpg[0]) * VHOST_SCSI_MAX_TARGET; vs_tpg = kzalloc(len, GFP_KERNEL); if (!vs_tpg) { ret = -ENOMEM; goto out; } - if (vs->vs_tpg) - memcpy(vs_tpg, vs->vs_tpg, len); list_for_each_entry(tpg, &vhost_scsi_list, tv_tpg_list) { mutex_lock(&tpg->tv_tpg_mutex); @@ -1616,11 +1621,6 @@ vhost_scsi_set_endpoint(struct vhost_scsi *vs, tv_tport = tpg->tport; if (!strcmp(tv_tport->tport_name, t->vhost_wwpn)) { - if (vs->vs_tpg && vs->vs_tpg[tpg->tport_tpgt]) { - mutex_unlock(&tpg->tv_tpg_mutex); - ret = -EEXIST; - goto undepend; - } /* * In order to ensure individual vhost-scsi configfs * groups cannot be removed while in use by vhost ioctl, @@ -1665,15 +1665,15 @@ vhost_scsi_set_endpoint(struct vhost_scsi *vs, } ret = 0; } else { - ret = -EEXIST; + ret = -ENODEV; + goto free_tpg; } /* - * Act as synchronize_rcu to make sure access to - * old vs->vs_tpg is finished. + * Act as synchronize_rcu to make sure requests after this point + * see a fully setup device. */ vhost_scsi_flush(vs); - kfree(vs->vs_tpg); vs->vs_tpg = vs_tpg; goto out; @@ -1690,6 +1690,7 @@ vhost_scsi_set_endpoint(struct vhost_scsi *vs, target_undepend_item(&tpg->se_tpg.tpg_group.cg_item); } } +free_tpg: kfree(vs_tpg); out: mutex_unlock(&vs->dev.mutex); @@ -1778,6 +1779,7 @@ vhost_scsi_clear_endpoint(struct vhost_scsi *vs, vhost_scsi_flush(vs); kfree(vs->vs_tpg); vs->vs_tpg = NULL; + memset(vs->vs_vhost_wwpn, 0, sizeof(vs->vs_vhost_wwpn)); WARN_ON(vs->vs_events_nr); mutex_unlock(&vs->dev.mutex); mutex_unlock(&vhost_scsi_mutex); -- 2.43.0

2 1

[PATCH OLK-5.10] media: venus: hfi: add check to handle incorrect queue size
by Jiacheng Yu 02 Dec '25

02 Dec '25

From: Vikash Garodia <quic_vgarodia(a)quicinc.com> stable inclusion from stable-v6.6.88 commit 40084302f639b3fe954398c5ba5ee556b7242b54 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC5BJU CVE: CVE-2025-23158 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 69baf245b23e20efda0079238b27fc63ecf13de1 upstream. qsize represents size of shared queued between driver and video firmware. Firmware can modify this value to an invalid large value. In such situation, empty_space will be bigger than the space actually available. Since new_wr_idx is not checked, so the following code will result in an OOB write. ... qsize = qhdr->q_size if (wr_idx >= rd_idx) empty_space = qsize - (wr_idx - rd_idx) .... if (new_wr_idx < qsize) { memcpy(wr_ptr, packet, dwords << 2) --> OOB write Add check to ensure qsize is within the allocated size while reading and writing packets into the queue. Cc: stable(a)vger.kernel.org Fixes: d96d3f30c0f2 ("[media] media: venus: hfi: add Venus HFI files") Reviewed-by: Bryan O'Donoghue <bryan.odonoghue(a)linaro.org> Signed-off-by: Vikash Garodia <quic_vgarodia(a)quicinc.com> Signed-off-by: Hans Verkuil <hverkuil(a)xs4all.nl> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jiacheng Yu <yujiacheng3(a)huawei.com> --- drivers/media/platform/qcom/venus/hfi_venus.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/media/platform/qcom/venus/hfi_venus.c b/drivers/media/platform/qcom/venus/hfi_venus.c index 8b1375c97c81..d3f1efabbfd6 100644 --- a/drivers/media/platform/qcom/venus/hfi_venus.c +++ b/drivers/media/platform/qcom/venus/hfi_venus.c @@ -188,6 +188,9 @@ static int venus_write_queue(struct venus_hfi_device *hdev, /* ensure rd/wr indices's are read from memory */ rmb(); + if (qsize > IFACEQ_QUEUE_SIZE / 4) + return -EINVAL; + if (wr_idx >= rd_idx) empty_space = qsize - (wr_idx - rd_idx); else @@ -256,6 +259,9 @@ static int venus_read_queue(struct venus_hfi_device *hdev, wr_idx = qhdr->write_idx; qsize = qhdr->q_size; + if (qsize > IFACEQ_QUEUE_SIZE / 4) + return -EINVAL; + /* make sure data is valid before using it */ rmb(); -- 2.43.0

2 1

[PATCH OLK-5.10] iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid
by Jiacheng Yu 02 Dec '25

02 Dec '25

From: Pavel Paklov <Pavel.Paklov(a)cyberprotect.ru> stable inclusion from stable-v5.15.182 commit 466d9da267079a8d3b69fa72dfa3a732e1f6dbb5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC991Z CVE: CVE-2025-37927 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 8dee308e4c01dea48fc104d37f92d5b58c50b96c upstream. There is a string parsing logic error which can lead to an overflow of hid or uid buffers. Comparing ACPIID_LEN against a total string length doesn't take into account the lengths of individual hid and uid buffers so the check is insufficient in some cases. For example if the length of hid string is 4 and the length of the uid string is 260, the length of str will be equal to ACPIID_LEN + 1 but uid string will overflow uid buffer which size is 256. The same applies to the hid string with length 13 and uid string with length 250. Check the length of hid and uid strings separately to prevent buffer overflow. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: ca3bf5d47cec ("iommu/amd: Introduces ivrs_acpihid kernel parameter") Cc: stable(a)vger.kernel.org Signed-off-by: Pavel Paklov <Pavel.Paklov(a)cyberprotect.ru> Link: https://lore.kernel.org/r/20250325092259.392844-1-Pavel.Paklov@cyberprotect… Signed-off-by: Joerg Roedel <jroedel(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jiacheng Yu <yujiacheng3(a)huawei.com> --- drivers/iommu/amd/init.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c index 3c9e01a5a558..d0a4ec42fd12 100644 --- a/drivers/iommu/amd/init.c +++ b/drivers/iommu/amd/init.c @@ -3280,6 +3280,14 @@ static int __init parse_ivrs_acpihid(char *str) while (*uid == '0' && *(uid + 1)) uid++; + if (strlen(hid) >= ACPIHID_HID_LEN) { + pr_err("Invalid command line: hid is too long\n"); + return 1; + } else if (strlen(uid) >= ACPIHID_UID_LEN) { + pr_err("Invalid command line: uid is too long\n"); + return 1; + } + i = early_acpihid_map_size++; memcpy(early_acpihid_map[i].hid, hid, strlen(hid)); memcpy(early_acpihid_map[i].uid, uid, strlen(uid)); -- 2.43.0

2 1

[PATCH OLK-6.6] media: tuner: xc5000: Fix use-after-free in xc5000_release
by Jiacheng Yu 02 Dec '25

02 Dec '25

From: Duoming Zhou <duoming(a)zju.edu.cn> stable inclusion from stable-v6.6.111 commit 71ed8b81a4906cb785966910f39cf7f5ad60a69e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID22QL CVE: CVE-2025-39994 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 40b7a19f321e65789612ebaca966472055dab48c ] The original code uses cancel_delayed_work() in xc5000_release(), which does not guarantee that the delayed work item timer_sleep has fully completed if it was already running. This leads to use-after-free scenarios where xc5000_release() may free the xc5000_priv while timer_sleep is still active and attempts to dereference the xc5000_priv. A typical race condition is illustrated below: CPU 0 (release thread) | CPU 1 (delayed work callback) xc5000_release() | xc5000_do_timer_sleep() cancel_delayed_work() | hybrid_tuner_release_state(priv) | kfree(priv) | | priv = container_of() // UAF Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure that the timer_sleep is properly canceled before the xc5000_priv memory is deallocated. A deadlock concern was considered: xc5000_release() is called in a process context and is not holding any locks that the timer_sleep work item might also need. Therefore, the use of the _sync() variant is safe here. This bug was initially identified through static analysis. Fixes: f7a27ff1fb77 ("[media] xc5000: delay tuner sleep to 5 seconds") Cc: stable(a)vger.kernel.org Signed-off-by: Duoming Zhou <duoming(a)zju.edu.cn> Signed-off-by: Hans Verkuil <hverkuil+cisco(a)kernel.org> [hverkuil: fix typo in Subject: tunner -> tuner] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/media/tuners/xc5000.c [commit f82dc869220d has not been backported.] Signed-off-by: Jiacheng Yu <yujiacheng3(a)huawei.com> --- drivers/media/tuners/xc5000.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/tuners/xc5000.c b/drivers/media/tuners/xc5000.c index 2182e5b7b606..de34fc9a9f2f 100644 --- a/drivers/media/tuners/xc5000.c +++ b/drivers/media/tuners/xc5000.c @@ -1305,7 +1305,7 @@ static void xc5000_release(struct dvb_frontend *fe) mutex_lock(&xc5000_list_mutex); if (priv) { - cancel_delayed_work(&priv->timer_sleep); + cancel_delayed_work_sync(&priv->timer_sleep); if (priv->firmware) { release_firmware(priv->firmware); priv->firmware = NULL; -- 2.43.0

2 1

[PATCH OLK-6.6] iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid
by Jiacheng Yu 02 Dec '25

02 Dec '25

From: Pavel Paklov <Pavel.Paklov(a)cyberprotect.ru> stable inclusion from stable-v6.6.90 commit 13d67528e1ae4486e9ab24b70122fab104c73c29 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC991Z CVE: CVE-2025-37927 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 8dee308e4c01dea48fc104d37f92d5b58c50b96c upstream. There is a string parsing logic error which can lead to an overflow of hid or uid buffers. Comparing ACPIID_LEN against a total string length doesn't take into account the lengths of individual hid and uid buffers so the check is insufficient in some cases. For example if the length of hid string is 4 and the length of the uid string is 260, the length of str will be equal to ACPIID_LEN + 1 but uid string will overflow uid buffer which size is 256. The same applies to the hid string with length 13 and uid string with length 250. Check the length of hid and uid strings separately to prevent buffer overflow. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: ca3bf5d47cec ("iommu/amd: Introduces ivrs_acpihid kernel parameter") Cc: stable(a)vger.kernel.org Signed-off-by: Pavel Paklov <Pavel.Paklov(a)cyberprotect.ru> Link: https://lore.kernel.org/r/20250325092259.392844-1-Pavel.Paklov@cyberprotect… Signed-off-by: Joerg Roedel <jroedel(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jiacheng Yu <yujiacheng3(a)huawei.com> --- drivers/iommu/amd/init.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c index 4beddd8cc420..e3d4a23b66fd 100644 --- a/drivers/iommu/amd/init.c +++ b/drivers/iommu/amd/init.c @@ -3690,6 +3690,14 @@ static int __init parse_ivrs_acpihid(char *str) while (*uid == '0' && *(uid + 1)) uid++; + if (strlen(hid) >= ACPIHID_HID_LEN) { + pr_err("Invalid command line: hid is too long\n"); + return 1; + } else if (strlen(uid) >= ACPIHID_UID_LEN) { + pr_err("Invalid command line: uid is too long\n"); + return 1; + } + i = early_acpihid_map_size++; memcpy(early_acpihid_map[i].hid, hid, strlen(hid)); memcpy(early_acpihid_map[i].uid, uid, strlen(uid)); -- 2.43.0

2 1

[PATCH OLK-6.6] kernfs: Fix UAF in polling when open file is released
by Long Li 02 Dec '25

02 Dec '25

From: Chen Ridong <chenridong(a)huawei.com> stable inclusion from stable-v6.6.106 commit 854baafc00c433cccbe0ab4231b77aeb9b637b77 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICZCIL CVE: CVE-2025-39881 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 3c9ba2777d6c86025e1ba4186dc5cd930e40ec5f upstream. A use-after-free (UAF) vulnerability was identified in the PSI (Pressure Stall Information) monitoring mechanism: BUG: KASAN: slab-use-after-free in psi_trigger_poll+0x3c/0x140 Read of size 8 at addr ffff3de3d50bd308 by task systemd/1 psi_trigger_poll+0x3c/0x140 cgroup_pressure_poll+0x70/0xa0 cgroup_file_poll+0x8c/0x100 kernfs_fop_poll+0x11c/0x1c0 ep_item_poll.isra.0+0x188/0x2c0 Allocated by task 1: cgroup_file_open+0x88/0x388 kernfs_fop_open+0x73c/0xaf0 do_dentry_open+0x5fc/0x1200 vfs_open+0xa0/0x3f0 do_open+0x7e8/0xd08 path_openat+0x2fc/0x6b0 do_filp_open+0x174/0x368 Freed by task 8462: cgroup_file_release+0x130/0x1f8 kernfs_drain_open_files+0x17c/0x440 kernfs_drain+0x2dc/0x360 kernfs_show+0x1b8/0x288 cgroup_file_show+0x150/0x268 cgroup_pressure_write+0x1dc/0x340 cgroup_file_write+0x274/0x548 Reproduction Steps: 1. Open test/cpu.pressure and establish epoll monitoring 2. Disable monitoring: echo 0 > test/cgroup.pressure 3. Re-enable monitoring: echo 1 > test/cgroup.pressure The race condition occurs because: 1. When cgroup.pressure is disabled (echo 0 > cgroup.pressure), it: - Releases PSI triggers via cgroup_file_release() - Frees of->priv through kernfs_drain_open_files() 2. While epoll still holds reference to the file and continues polling 3. Re-enabling (echo 1 > cgroup.pressure) accesses freed of->priv epolling disable/enable cgroup.pressure fd=open(cpu.pressure) while(1) ... epoll_wait kernfs_fop_poll kernfs_get_active = true echo 0 > cgroup.pressure ... cgroup_file_show kernfs_show // inactive kn kernfs_drain_open_files cft->release(of); kfree(ctx); ... kernfs_get_active = false echo 1 > cgroup.pressure kernfs_show kernfs_activate_one(kn); kernfs_fop_poll kernfs_get_active = true cgroup_file_poll psi_trigger_poll // UAF ... end: close(fd) To address this issue, introduce kernfs_get_active_of() for kernfs open files to obtain active references. This function will fail if the open file has been released. Replace kernfs_get_active() with kernfs_get_active_of() to prevent further operations on released file descriptors. Fixes: 34f26a15611a ("sched/psi: Per-cgroup PSI accounting disable/re-enable interface") Cc: stable <stable(a)kernel.org> Reported-by: Zhang Zhaotian <zhangzhaotian(a)huawei.com> Signed-off-by: Chen Ridong <chenridong(a)huawei.com> Acked-by: Tejun Heo <tj(a)kernel.org> Link: https://lore.kernel.org/r/20250822070715.1565236-2-chenridong@huaweicloud.c… [ Drop llseek bits ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/kernfs/file.c | 54 ++++++++++++++++++++++++++++++++---------------- 1 file changed, 36 insertions(+), 18 deletions(-) diff --git a/fs/kernfs/file.c b/fs/kernfs/file.c index 9107151b6cfa..245b215cdda8 100644 --- a/fs/kernfs/file.c +++ b/fs/kernfs/file.c @@ -74,6 +74,24 @@ static struct kernfs_open_node *of_on(struct kernfs_open_file *of) !list_empty(&of->list)); } +/* Get active reference to kernfs node for an open file */ +static struct kernfs_open_file *kernfs_get_active_of(struct kernfs_open_file *of) +{ + /* Skip if file was already released */ + if (unlikely(of->released)) + return NULL; + + if (!kernfs_get_active(of->kn)) + return NULL; + + return of; +} + +static void kernfs_put_active_of(struct kernfs_open_file *of) +{ + return kernfs_put_active(of->kn); +} + /** * kernfs_deref_open_node_locked - Get kernfs_open_node corresponding to @kn * @@ -143,7 +161,7 @@ static void kernfs_seq_stop_active(struct seq_file *sf, void *v) if (ops->seq_stop) ops->seq_stop(sf, v); - kernfs_put_active(of->kn); + kernfs_put_active_of(of); } static void *kernfs_seq_start(struct seq_file *sf, loff_t *ppos) @@ -156,7 +174,7 @@ static void *kernfs_seq_start(struct seq_file *sf, loff_t *ppos) * the ops aren't called concurrently for the same open file. */ mutex_lock(&of->mutex); - if (!kernfs_get_active(of->kn)) + if (!kernfs_get_active_of(of)) return ERR_PTR(-ENODEV); ops = kernfs_ops(of->kn); @@ -242,7 +260,7 @@ static ssize_t kernfs_file_read_iter(struct kiocb *iocb, struct iov_iter *iter) * the ops aren't called concurrently for the same open file. */ mutex_lock(&of->mutex); - if (!kernfs_get_active(of->kn)) { + if (!kernfs_get_active_of(of)) { len = -ENODEV; mutex_unlock(&of->mutex); goto out_free; @@ -256,7 +274,7 @@ static ssize_t kernfs_file_read_iter(struct kiocb *iocb, struct iov_iter *iter) else len = -EINVAL; - kernfs_put_active(of->kn); + kernfs_put_active_of(of); mutex_unlock(&of->mutex); if (len < 0) @@ -327,7 +345,7 @@ static ssize_t kernfs_fop_write_iter(struct kiocb *iocb, struct iov_iter *iter) * the ops aren't called concurrently for the same open file. */ mutex_lock(&of->mutex); - if (!kernfs_get_active(of->kn)) { + if (!kernfs_get_active_of(of)) { mutex_unlock(&of->mutex); len = -ENODEV; goto out_free; @@ -339,7 +357,7 @@ static ssize_t kernfs_fop_write_iter(struct kiocb *iocb, struct iov_iter *iter) else len = -EINVAL; - kernfs_put_active(of->kn); + kernfs_put_active_of(of); mutex_unlock(&of->mutex); if (len > 0) @@ -361,13 +379,13 @@ static void kernfs_vma_open(struct vm_area_struct *vma) if (!of->vm_ops) return; - if (!kernfs_get_active(of->kn)) + if (!kernfs_get_active_of(of)) return; if (of->vm_ops->open) of->vm_ops->open(vma); - kernfs_put_active(of->kn); + kernfs_put_active_of(of); } static vm_fault_t kernfs_vma_fault(struct vm_fault *vmf) @@ -379,14 +397,14 @@ static vm_fault_t kernfs_vma_fault(struct vm_fault *vmf) if (!of->vm_ops) return VM_FAULT_SIGBUS; - if (!kernfs_get_active(of->kn)) + if (!kernfs_get_active_of(of)) return VM_FAULT_SIGBUS; ret = VM_FAULT_SIGBUS; if (of->vm_ops->fault) ret = of->vm_ops->fault(vmf); - kernfs_put_active(of->kn); + kernfs_put_active_of(of); return ret; } @@ -399,7 +417,7 @@ static vm_fault_t kernfs_vma_page_mkwrite(struct vm_fault *vmf) if (!of->vm_ops) return VM_FAULT_SIGBUS; - if (!kernfs_get_active(of->kn)) + if (!kernfs_get_active_of(of)) return VM_FAULT_SIGBUS; ret = 0; @@ -408,7 +426,7 @@ static vm_fault_t kernfs_vma_page_mkwrite(struct vm_fault *vmf) else file_update_time(file); - kernfs_put_active(of->kn); + kernfs_put_active_of(of); return ret; } @@ -422,14 +440,14 @@ static int kernfs_vma_access(struct vm_area_struct *vma, unsigned long addr, if (!of->vm_ops) return -EINVAL; - if (!kernfs_get_active(of->kn)) + if (!kernfs_get_active_of(of)) return -EINVAL; ret = -EINVAL; if (of->vm_ops->access) ret = of->vm_ops->access(vma, addr, buf, len, write); - kernfs_put_active(of->kn); + kernfs_put_active_of(of); return ret; } @@ -459,7 +477,7 @@ static int kernfs_fop_mmap(struct file *file, struct vm_area_struct *vma) mutex_lock(&of->mutex); rc = -ENODEV; - if (!kernfs_get_active(of->kn)) + if (!kernfs_get_active_of(of)) goto out_unlock; ops = kernfs_ops(of->kn); @@ -494,7 +512,7 @@ static int kernfs_fop_mmap(struct file *file, struct vm_area_struct *vma) } vma->vm_ops = &kernfs_vm_ops; out_put: - kernfs_put_active(of->kn); + kernfs_put_active_of(of); out_unlock: mutex_unlock(&of->mutex); @@ -848,7 +866,7 @@ static __poll_t kernfs_fop_poll(struct file *filp, poll_table *wait) struct kernfs_node *kn = kernfs_dentry_node(filp->f_path.dentry); __poll_t ret; - if (!kernfs_get_active(kn)) + if (!kernfs_get_active_of(of)) return DEFAULT_POLLMASK|EPOLLERR|EPOLLPRI; if (kn->attr.ops->poll) @@ -856,7 +874,7 @@ static __poll_t kernfs_fop_poll(struct file *filp, poll_table *wait) else ret = kernfs_generic_poll(of, wait); - kernfs_put_active(kn); + kernfs_put_active_of(of); return ret; } -- 2.39.2

2 1

[PATCH OLK-6.6] smb: client: fix race with concurrent opens in rename(2)
by Long Li 02 Dec '25

02 Dec '25

From: Paulo Alcantara <pc(a)manguebit.org> stable inclusion from stable-v6.6.103 commit 24b9ed739c8c5b464d983e12cf308982f3ae93c2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICYBJ6 CVE: CVE-2025-39825 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit d84291fc7453df7881a970716f8256273aca5747 ] Besides sending the rename request to the server, the rename process also involves closing any deferred close, waiting for outstanding I/O to complete as well as marking all existing open handles as deleted to prevent them from deferring closes, which increases the race window for potential concurrent opens on the target file. Fix this by unhashing the dentry in advance to prevent any concurrent opens on the target. Signed-off-by: Paulo Alcantara (Red Hat) <pc(a)manguebit.org> Reviewed-by: David Howells <dhowells(a)redhat.com> Cc: Al Viro <viro(a)zeniv.linux.org.uk> Cc: linux-cifs(a)vger.kernel.org Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/smb/client/inode.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/fs/smb/client/inode.c b/fs/smb/client/inode.c index d93ebd58ecae..84d35a7c4e3b 100644 --- a/fs/smb/client/inode.c +++ b/fs/smb/client/inode.c @@ -2367,6 +2367,7 @@ cifs_rename2(struct mnt_idmap *idmap, struct inode *source_dir, struct cifs_sb_info *cifs_sb; struct tcon_link *tlink; struct cifs_tcon *tcon; + bool rehash = false; unsigned int xid; int rc, tmprc; int retry_count = 0; @@ -2382,6 +2383,17 @@ cifs_rename2(struct mnt_idmap *idmap, struct inode *source_dir, if (unlikely(cifs_forced_shutdown(cifs_sb))) return -EIO; + /* + * Prevent any concurrent opens on the target by unhashing the dentry. + * VFS already unhashes the target when renaming directories. + */ + if (d_is_positive(target_dentry) && !d_is_dir(target_dentry)) { + if (!d_unhashed(target_dentry)) { + d_drop(target_dentry); + rehash = true; + } + } + tlink = cifs_sb_tlink(cifs_sb); if (IS_ERR(tlink)) return PTR_ERR(tlink); @@ -2421,6 +2433,8 @@ cifs_rename2(struct mnt_idmap *idmap, struct inode *source_dir, } } + if (!rc) + rehash = false; /* * No-replace is the natural behavior for CIFS, so skip unlink hacks. */ @@ -2479,12 +2493,16 @@ cifs_rename2(struct mnt_idmap *idmap, struct inode *source_dir, goto cifs_rename_exit; rc = cifs_do_rename(xid, source_dentry, from_name, target_dentry, to_name); + if (!rc) + rehash = false; } /* force revalidate to go get info when needed */ CIFS_I(source_dir)->time = CIFS_I(target_dir)->time = 0; cifs_rename_exit: + if (rehash) + d_rehash(target_dentry); kfree(info_buf_source); free_dentry_path(page2); free_dentry_path(page1); -- 2.39.2

2 1

[PATCH OLK-6.6] xsched: fix compile error when CONFIG_XCU_SCHEDULER is disabled
by Liu Kai 02 Dec '25

02 Dec '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID9IFI ----------------------------------------- If CONFIG_XCU_SCHEDULER is not enabled, these two system calls sys_xsched_getattr and sys_xsched_setattr will not be defined, causing compilation errors. ld: vmlinux.o: in function `x64_sys_call': (.text+0x169b): undefined reference to `__x64_sys_xsched_getattr' ld: (.text+0x29f8): undefined reference to `__x64_sys_xsched_setattr' ld: vmlinux.o:(.rodata+0x1078): undefined reference to `__x64_sys_xsched_setattr' ld: vmlinux.o:(.rodata+0x1080): undefined reference to `__x64_sys_xsched_getattr' make[2]: *** [scripts/Makefile.vmlinux:37: vmlinux] Error 1 Therefore, it is necessary to add stub functions for these two system calls to avoid errors. Fixes: 832cfa264d7c ("xsched: add xsched_{set,get}attr syscall") Signed-off-by: Liu Kai <liukai284(a)huawei.com> --- kernel/xsched/vstream.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/kernel/xsched/vstream.c b/kernel/xsched/vstream.c index d0815e33e081..b9c4715c1061 100644 --- a/kernel/xsched/vstream.c +++ b/kernel/xsched/vstream.c @@ -656,4 +656,14 @@ SYSCALL_DEFINE2(vstream_manage, struct vstream_args __user *, arg, int, cmd) { return 0; } + +SYSCALL_DEFINE2(xsched_setattr, pid_t, pid, struct xsched_attr __user *, arg) +{ + return 0; +} + +SYSCALL_DEFINE2(xsched_getattr, pid_t, pid, struct xsched_attr __user *, arg) +{ + return 0; +} #endif -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] Fix CVE-2025-39994
by Wang Wensheng 02 Dec '25

02 Dec '25

Duoming Zhou (1): media: tuner: xc5000: Fix use-after-free in xc5000_release Ricardo Ribalda (1): media: tunner: xc5000: Refactor firmware load drivers/media/tuners/xc5000.c | 41 +++++++++++++++-------------------- 1 file changed, 18 insertions(+), 23 deletions(-) -- 2.22.0

2 3

[PATCH OLK-6.6] sunrpc: fix handling of server side tls alerts
by Wang Liang 02 Dec '25

02 Dec '25

From: Olga Kornievskaia <okorniev(a)redhat.com> stable inclusion from stable-v6.6.102 commit b1df394621710b312f0393e3f240fdac0764f968 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICU6FG CVE: CVE-2025-38566 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit bee47cb026e762841f3faece47b51f985e215edb upstream. Scott Mayhew discovered a security exploit in NFS over TLS in tls_alert_recv() due to its assumption it can read data from the msg iterator's kvec.. kTLS implementation splits TLS non-data record payload between the control message buffer (which includes the type such as TLS aler or TLS cipher change) and the rest of the payload (say TLS alert's level/description) which goes into the msg payload buffer. This patch proposes to rework how control messages are setup and used by sock_recvmsg(). If no control message structure is setup, kTLS layer will read and process TLS data record types. As soon as it encounters a TLS control message, it would return an error. At that point, NFS can setup a kvec backed msg buffer and read in the control message such as a TLS alert. Msg iterator can advance the kvec pointer as a part of the copy process thus we need to revert the iterator before calling into the tls_alert_recv. Reported-by: Scott Mayhew <smayhew(a)redhat.com> Fixes: 5e052dda121e ("SUNRPC: Recognize control messages in server-side TCP socket code") Suggested-by: Trond Myklebust <trondmy(a)hammerspace.com> Cc: stable(a)vger.kernel.org Signed-off-by: Olga Kornievskaia <okorniev(a)redhat.com> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/sunrpc/svcsock.c | 43 +++++++++++++++++++++++++++++++++++-------- 1 file changed, 35 insertions(+), 8 deletions(-) diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c index f591ead0d961..78b139d8c1f3 100644 --- a/net/sunrpc/svcsock.c +++ b/net/sunrpc/svcsock.c @@ -257,20 +257,47 @@ svc_tcp_sock_process_cmsg(struct socket *sock, struct msghdr *msg, } static int -svc_tcp_sock_recv_cmsg(struct svc_sock *svsk, struct msghdr *msg) +svc_tcp_sock_recv_cmsg(struct socket *sock, unsigned int *msg_flags) { union { struct cmsghdr cmsg; u8 buf[CMSG_SPACE(sizeof(u8))]; } u; - struct socket *sock = svsk->sk_sock; + u8 alert[2]; + struct kvec alert_kvec = { + .iov_base = alert, + .iov_len = sizeof(alert), + }; + struct msghdr msg = { + .msg_flags = *msg_flags, + .msg_control = &u, + .msg_controllen = sizeof(u), + }; + int ret; + + iov_iter_kvec(&msg.msg_iter, ITER_DEST, &alert_kvec, 1, + alert_kvec.iov_len); + ret = sock_recvmsg(sock, &msg, MSG_DONTWAIT); + if (ret > 0 && + tls_get_record_type(sock->sk, &u.cmsg) == TLS_RECORD_TYPE_ALERT) { + iov_iter_revert(&msg.msg_iter, ret); + ret = svc_tcp_sock_process_cmsg(sock, &msg, &u.cmsg, -EAGAIN); + } + return ret; +} + +static int +svc_tcp_sock_recvmsg(struct svc_sock *svsk, struct msghdr *msg) +{ int ret; + struct socket *sock = svsk->sk_sock; - msg->msg_control = &u; - msg->msg_controllen = sizeof(u); ret = sock_recvmsg(sock, msg, MSG_DONTWAIT); - if (unlikely(msg->msg_controllen != sizeof(u))) - ret = svc_tcp_sock_process_cmsg(sock, msg, &u.cmsg, ret); + if (msg->msg_flags & MSG_CTRUNC) { + msg->msg_flags &= ~(MSG_CTRUNC | MSG_EOR); + if (ret == 0 || ret == -EIO) + ret = svc_tcp_sock_recv_cmsg(sock, &msg->msg_flags); + } return ret; } @@ -321,7 +348,7 @@ static ssize_t svc_tcp_read_msg(struct svc_rqst *rqstp, size_t buflen, iov_iter_advance(&msg.msg_iter, seek); buflen -= seek; } - len = svc_tcp_sock_recv_cmsg(svsk, &msg); + len = svc_tcp_sock_recvmsg(svsk, &msg); if (len > 0) svc_flush_bvec(bvec, len, seek); @@ -1019,7 +1046,7 @@ static ssize_t svc_tcp_read_marker(struct svc_sock *svsk, iov.iov_base = ((char *)&svsk->sk_marker) + svsk->sk_tcplen; iov.iov_len = want; iov_iter_kvec(&msg.msg_iter, ITER_DEST, &iov, 1, want); - len = svc_tcp_sock_recv_cmsg(svsk, &msg); + len = svc_tcp_sock_recvmsg(svsk, &msg); if (len < 0) return len; svsk->sk_tcplen += len; -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] CVE-2025-39697
by Li Lingfeng 02 Dec '25

02 Dec '25

Fix CVE-2025-39697. Christoph Hellwig (1): nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests Trond Myklebust (1): NFS: Fix a race when updating an existing write fs/nfs/pagelist.c | 86 ++--------------------- fs/nfs/write.c | 146 +++++++++++++++++++++++++-------------- include/linux/nfs_page.h | 2 +- 3 files changed, 100 insertions(+), 134 deletions(-) -- 2.46.1

2 3

[PATCH OLK-6.6 0/2] Fix CVE-2025-39994
by Wang Wensheng 02 Dec '25

02 Dec '25

Duoming Zhou (1): media: tuner: xc5000: Fix use-after-free in xc5000_release Ricardo Ribalda (1): media: tunner: xc5000: Refactor firmware load drivers/media/tuners/xc5000.c | 41 +++++++++++++++-------------------- 1 file changed, 18 insertions(+), 23 deletions(-) -- 2.22.0

2 3

[PATCH 0/2] Fix CVE-2025-39994
by Wang Wensheng 02 Dec '25

02 Dec '25

Duoming Zhou (1): media: tuner: xc5000: Fix use-after-free in xc5000_release Ricardo Ribalda (1): media: tunner: xc5000: Refactor firmware load drivers/media/tuners/xc5000.c | 41 +++++++++++++++-------------------- 1 file changed, 18 insertions(+), 23 deletions(-) -- 2.22.0

1 2

[PATCH OLK-6.6] smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set().
by Wang Liang 02 Dec '25

02 Dec '25

From: Kuniyuki Iwashima <kuniyu(a)google.com> mainline inclusion from mainline-v6.18-rc1 commit 935d783e5de9b64587f3adb25641dd8385e64ddb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6B6A CVE: CVE-2025-40139 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- smc_clc_prfx_set() is called during connect() and not under RCU nor RTNL. Using sk_dst_get(sk)->dev could trigger UAF. Let's use __sk_dst_get() and dev_dst_rcu() under rcu_read_lock() after kernel_getsockname(). Note that the returned value of smc_clc_prfx_set() is not used in the caller. While at it, we change the 1st arg of smc_clc_prfx_set[46]_rcu() not to touch dst there. Fixes: a046d57da19f ("smc: CLC handshake (incl. preparation steps)") Signed-off-by: Kuniyuki Iwashima <kuniyu(a)google.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20250916214758.650211-3-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/smc/smc_clc.c | 41 ++++++++++++++++++++++------------------- 1 file changed, 22 insertions(+), 19 deletions(-) diff --git a/net/smc/smc_clc.c b/net/smc/smc_clc.c index ad1c6694f1c5..cb11d1d85438 100644 --- a/net/smc/smc_clc.c +++ b/net/smc/smc_clc.c @@ -511,10 +511,10 @@ static bool smc_clc_msg_hdr_valid(struct smc_clc_msg_hdr *clcm, bool check_trl) } /* find ipv4 addr on device and get the prefix len, fill CLC proposal msg */ -static int smc_clc_prfx_set4_rcu(struct dst_entry *dst, __be32 ipv4, +static int smc_clc_prfx_set4_rcu(struct net_device *dev, __be32 ipv4, struct smc_clc_msg_proposal_prefix *prop) { - struct in_device *in_dev = __in_dev_get_rcu(dst->dev); + struct in_device *in_dev = __in_dev_get_rcu(dev); const struct in_ifaddr *ifa; if (!in_dev) @@ -532,12 +532,12 @@ static int smc_clc_prfx_set4_rcu(struct dst_entry *dst, __be32 ipv4, } /* fill CLC proposal msg with ipv6 prefixes from device */ -static int smc_clc_prfx_set6_rcu(struct dst_entry *dst, +static int smc_clc_prfx_set6_rcu(struct net_device *dev, struct smc_clc_msg_proposal_prefix *prop, struct smc_clc_ipv6_prefix *ipv6_prfx) { #if IS_ENABLED(CONFIG_IPV6) - struct inet6_dev *in6_dev = __in6_dev_get(dst->dev); + struct inet6_dev *in6_dev = __in6_dev_get(dev); struct inet6_ifaddr *ifa; int cnt = 0; @@ -566,41 +566,44 @@ static int smc_clc_prfx_set(struct socket *clcsock, struct smc_clc_msg_proposal_prefix *prop, struct smc_clc_ipv6_prefix *ipv6_prfx) { - struct dst_entry *dst = sk_dst_get(clcsock->sk); struct sockaddr_storage addrs; struct sockaddr_in6 *addr6; struct sockaddr_in *addr; + struct net_device *dev; + struct dst_entry *dst; int rc = -ENOENT; - if (!dst) { - rc = -ENOTCONN; - goto out; - } - if (!dst->dev) { - rc = -ENODEV; - goto out_rel; - } /* get address to which the internal TCP socket is bound */ if (kernel_getsockname(clcsock, (struct sockaddr *)&addrs) < 0) - goto out_rel; + goto out; + /* analyze IP specific data of net_device belonging to TCP socket */ addr6 = (struct sockaddr_in6 *)&addrs; + rcu_read_lock(); + + dst = __sk_dst_get(clcsock->sk); + dev = dst ? dst_dev_rcu(dst) : NULL; + if (!dev) { + rc = -ENODEV; + goto out_unlock; + } + if (addrs.ss_family == PF_INET) { /* IPv4 */ addr = (struct sockaddr_in *)&addrs; - rc = smc_clc_prfx_set4_rcu(dst, addr->sin_addr.s_addr, prop); + rc = smc_clc_prfx_set4_rcu(dev, addr->sin_addr.s_addr, prop); } else if (ipv6_addr_v4mapped(&addr6->sin6_addr)) { /* mapped IPv4 address - peer is IPv4 only */ - rc = smc_clc_prfx_set4_rcu(dst, addr6->sin6_addr.s6_addr32[3], + rc = smc_clc_prfx_set4_rcu(dev, addr6->sin6_addr.s6_addr32[3], prop); } else { /* IPv6 */ - rc = smc_clc_prfx_set6_rcu(dst, prop, ipv6_prfx); + rc = smc_clc_prfx_set6_rcu(dev, prop, ipv6_prfx); } + +out_unlock: rcu_read_unlock(); -out_rel: - dst_release(dst); out: return rc; } -- 2.34.1

2 1

[PATCH OLK-5.10] smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set().
by Wang Liang 02 Dec '25

02 Dec '25

From: Kuniyuki Iwashima <kuniyu(a)google.com> mainline inclusion from mainline-v6.18-rc1 commit 935d783e5de9b64587f3adb25641dd8385e64ddb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6B6A CVE: CVE-2025-40139 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- smc_clc_prfx_set() is called during connect() and not under RCU nor RTNL. Using sk_dst_get(sk)->dev could trigger UAF. Let's use __sk_dst_get() and dev_dst_rcu() under rcu_read_lock() after kernel_getsockname(). Note that the returned value of smc_clc_prfx_set() is not used in the caller. While at it, we change the 1st arg of smc_clc_prfx_set[46]_rcu() not to touch dst there. Fixes: a046d57da19f ("smc: CLC handshake (incl. preparation steps)") Signed-off-by: Kuniyuki Iwashima <kuniyu(a)google.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20250916214758.650211-3-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/smc/smc_clc.c | 41 ++++++++++++++++++++++------------------- 1 file changed, 22 insertions(+), 19 deletions(-) diff --git a/net/smc/smc_clc.c b/net/smc/smc_clc.c index 038fd3caf133..0aedee04f4bb 100644 --- a/net/smc/smc_clc.c +++ b/net/smc/smc_clc.c @@ -511,10 +511,10 @@ static bool smc_clc_msg_hdr_valid(struct smc_clc_msg_hdr *clcm, bool check_trl) } /* find ipv4 addr on device and get the prefix len, fill CLC proposal msg */ -static int smc_clc_prfx_set4_rcu(struct dst_entry *dst, __be32 ipv4, +static int smc_clc_prfx_set4_rcu(struct net_device *dev, __be32 ipv4, struct smc_clc_msg_proposal_prefix *prop) { - struct in_device *in_dev = __in_dev_get_rcu(dst->dev); + struct in_device *in_dev = __in_dev_get_rcu(dev); const struct in_ifaddr *ifa; if (!in_dev) @@ -532,12 +532,12 @@ static int smc_clc_prfx_set4_rcu(struct dst_entry *dst, __be32 ipv4, } /* fill CLC proposal msg with ipv6 prefixes from device */ -static int smc_clc_prfx_set6_rcu(struct dst_entry *dst, +static int smc_clc_prfx_set6_rcu(struct net_device *dev, struct smc_clc_msg_proposal_prefix *prop, struct smc_clc_ipv6_prefix *ipv6_prfx) { #if IS_ENABLED(CONFIG_IPV6) - struct inet6_dev *in6_dev = __in6_dev_get(dst->dev); + struct inet6_dev *in6_dev = __in6_dev_get(dev); struct inet6_ifaddr *ifa; int cnt = 0; @@ -566,41 +566,44 @@ static int smc_clc_prfx_set(struct socket *clcsock, struct smc_clc_msg_proposal_prefix *prop, struct smc_clc_ipv6_prefix *ipv6_prfx) { - struct dst_entry *dst = sk_dst_get(clcsock->sk); struct sockaddr_storage addrs; struct sockaddr_in6 *addr6; struct sockaddr_in *addr; + struct net_device *dev; + struct dst_entry *dst; int rc = -ENOENT; - if (!dst) { - rc = -ENOTCONN; - goto out; - } - if (!dst->dev) { - rc = -ENODEV; - goto out_rel; - } /* get address to which the internal TCP socket is bound */ if (kernel_getsockname(clcsock, (struct sockaddr *)&addrs) < 0) - goto out_rel; + goto out; + /* analyze IP specific data of net_device belonging to TCP socket */ addr6 = (struct sockaddr_in6 *)&addrs; + rcu_read_lock(); + + dst = __sk_dst_get(clcsock->sk); + dev = dst ? dst_dev_rcu(dst) : NULL; + if (!dev) { + rc = -ENODEV; + goto out_unlock; + } + if (addrs.ss_family == PF_INET) { /* IPv4 */ addr = (struct sockaddr_in *)&addrs; - rc = smc_clc_prfx_set4_rcu(dst, addr->sin_addr.s_addr, prop); + rc = smc_clc_prfx_set4_rcu(dev, addr->sin_addr.s_addr, prop); } else if (ipv6_addr_v4mapped(&addr6->sin6_addr)) { /* mapped IPv4 address - peer is IPv4 only */ - rc = smc_clc_prfx_set4_rcu(dst, addr6->sin6_addr.s6_addr32[3], + rc = smc_clc_prfx_set4_rcu(dev, addr6->sin6_addr.s6_addr32[3], prop); } else { /* IPv6 */ - rc = smc_clc_prfx_set6_rcu(dst, prop, ipv6_prfx); + rc = smc_clc_prfx_set6_rcu(dev, prop, ipv6_prfx); } + +out_unlock: rcu_read_unlock(); -out_rel: - dst_release(dst); out: return rc; } -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] CVE-2025-37786
by Wang Liang 02 Dec '25

02 Dec '25

Vladimir Oltean (2): net: dsa: rename teardown_default_cpu to teardown_cpu_ports net: dsa: free routing table on probe failure net/dsa/dsa2.c | 31 +++++++++++++++++++------------ 1 file changed, 19 insertions(+), 12 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10] sctp: Fix MAC comparison to be constant-time
by Wang Liang 02 Dec '25

02 Dec '25

From: Eric Biggers <ebiggers(a)kernel.org> mainline inclusion from mainline-v6.18-rc1 commit dd91c79e4f58fbe2898dac84858033700e0e99fb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6BW6 CVE: CVE-2025-40204 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this. Fixes: bbd0d59809f9 ("[SCTP]: Implement the receive and verification of AUTH chunk") Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable(a)vger.kernel.org Signed-off-by: Eric Biggers <ebiggers(a)kernel.org> Link: https://patch.msgid.link/20250818205426.30222-3-ebiggers@kernel.org Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/sctp/sm_make_chunk.c net/sctp/sm_statefuns.c [conflicts due to not merge c616fb0cbae8 ("crypto: lib/utils - Move utilities into new header")] Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/sctp/sm_make_chunk.c | 3 ++- net/sctp/sm_statefuns.c | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c index 64e0f4864b73..cf77c4693b91 100644 --- a/net/sctp/sm_make_chunk.c +++ b/net/sctp/sm_make_chunk.c @@ -31,6 +31,7 @@ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt #include <crypto/hash.h> +#include <crypto/algapi.h> #include <linux/types.h> #include <linux/kernel.h> #include <linux/ip.h> @@ -1751,7 +1752,7 @@ struct sctp_association *sctp_unpack_cookie( } } - if (memcmp(digest, cookie->signature, SCTP_SIGNATURE_SIZE)) { + if (crypto_memneq(digest, cookie->signature, SCTP_SIGNATURE_SIZE)) { *error = -SCTP_IERROR_BAD_SIG; goto fail; } diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c index 93ebd14b48ed..9f2aa475c291 100644 --- a/net/sctp/sm_statefuns.c +++ b/net/sctp/sm_statefuns.c @@ -30,6 +30,7 @@ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt +#include <crypto/algapi.h> #include <linux/types.h> #include <linux/kernel.h> #include <linux/ip.h> @@ -4302,7 +4303,7 @@ static enum sctp_ierror sctp_sf_authenticate( sh_key, GFP_ATOMIC); /* Discard the packet if the digests do not match */ - if (memcmp(save_digest, digest, sig_len)) { + if (crypto_memneq(save_digest, digest, sig_len)) { kfree(save_digest); return SCTP_IERROR_BAD_SIG; } -- 2.34.1

2 1

[PATCH OLK-6.6] sched: Fix incorrect cluster mask
by Zhang Qiao 02 Dec '25

02 Dec '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID89XG -------------------------------- The cpu_clustergroup_mask() does not represent the actual CPU topology. Fixes: a042432f1f90 ("sched: topology: Build soft domain for LLC") Signed-off-by: Zhang Qiao <zhangqiao22(a)huawei.com> --- kernel/sched/soft_domain.c | 25 ++++++++++--------------- 1 file changed, 10 insertions(+), 15 deletions(-) diff --git a/kernel/sched/soft_domain.c b/kernel/sched/soft_domain.c index c34be1fee3e0..3c52680ca82f 100644 --- a/kernel/sched/soft_domain.c +++ b/kernel/sched/soft_domain.c @@ -45,10 +45,9 @@ static DEFINE_PER_CPU(struct soft_domain *, g_sf_d); static void free_sub_soft_domain(struct soft_domain *sf_d); -static int build_soft_sub_domain(struct sched_domain *sd, struct cpumask *cpus) +static int build_soft_sub_domain(int nid, struct cpumask *cpus) { - struct cpumask *span = sched_domain_span(sd); - int nid = cpu_to_node(cpumask_first(span)); + const struct cpumask *span = cpumask_of_node(nid); struct soft_domain *sf_d = NULL; int i; @@ -71,8 +70,8 @@ static int build_soft_sub_domain(struct sched_domain *sd, struct cpumask *cpus) return -ENOMEM; } list_add_tail(&sub_d->node, &sf_d->child_domain); - cpumask_and(soft_domain_span(sub_d->span), span, cpu_clustergroup_mask(i)); - cpumask_andnot(cpus, cpus, cpu_clustergroup_mask(i)); + cpumask_and(soft_domain_span(sub_d->span), span, topology_cluster_cpumask(i)); + cpumask_andnot(cpus, cpus, topology_cluster_cpumask(i)); } for_each_cpu(i, span) { @@ -116,7 +115,6 @@ static void free_soft_domain(void) void build_soft_domain(void) { - struct sched_domain *sd; static struct cpumask cpus; int i, ret; @@ -125,15 +123,12 @@ void build_soft_domain(void) cpumask_copy(&cpus, cpu_active_mask); rcu_read_lock(); - for_each_cpu(i, &cpus) { - /* build soft domain for each llc domain. */ - sd = rcu_dereference(per_cpu(sd_llc, i)); - if (sd) { - ret = build_soft_sub_domain(sd, &cpus); - if (ret) { - free_soft_domain(); - goto out; - } + for (i = 0; i < nr_node_ids; i++) { + /* build soft domain for each numa domain. */ + ret = build_soft_sub_domain(i, &cpus); + if (ret) { + free_soft_domain(); + goto out; } } -- 2.18.0.huawei.25

1 0

[PATCH OLK-5.10] ARM: 9317/1: kexec: Make smp stop calls asynchronous
by Liu Mingrui 02 Dec '25

02 Dec '25

From: Mårten Lindahl <marten.lindahl(a)axis.com> mainline inclusion from mainline-v6.6-rc1 commit 8922ba71c969d2a0c01a94372a71477d879470de category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID33ED CVE: CVE-2023-53712 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If a panic is triggered by a hrtimer interrupt all online cpus will be notified and set offline. But as highlighted by commit 19dbdcb8039c ("smp: Warn on function calls from softirq context") this call should not be made synchronous with disabled interrupts: softdog: Initiating panic Kernel panic - not syncing: Software Watchdog Timer expired WARNING: CPU: 1 PID: 0 at kernel/smp.c:753 smp_call_function_many_cond unwind_backtrace: show_stack dump_stack_lvl __warn warn_slowpath_fmt smp_call_function_many_cond smp_call_function crash_smp_send_stop.part.0 machine_crash_shutdown __crash_kexec panic softdog_fire __hrtimer_run_queues hrtimer_interrupt Make the smp call for machine_crash_nonpanic_core() asynchronous. Signed-off-by: Mårten Lindahl <marten.lindahl(a)axis.com> Signed-off-by: Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> Conflicts: arch/arm/kernel/machine_kexec.c [just context conflicts] Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> --- arch/arm/kernel/machine_kexec.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/arch/arm/kernel/machine_kexec.c b/arch/arm/kernel/machine_kexec.c index 91045135aadd..ba2dfbd21580 100644 --- a/arch/arm/kernel/machine_kexec.c +++ b/arch/arm/kernel/machine_kexec.c @@ -93,16 +93,28 @@ void machine_crash_nonpanic_core(void *unused) } } +static DEFINE_PER_CPU(call_single_data_t, cpu_stop_csd) = + CSD_INIT(machine_crash_nonpanic_core, NULL); + void crash_smp_send_stop(void) { static int cpus_stopped; unsigned long msecs; + call_single_data_t *csd; + int cpu, this_cpu = raw_smp_processor_id(); if (cpus_stopped) return; atomic_set(&waiting_for_crash_ipi, num_online_cpus() - 1); - smp_call_function(machine_crash_nonpanic_core, NULL, false); + for_each_online_cpu(cpu) { + if (cpu == this_cpu) + continue; + + csd = &per_cpu(cpu_stop_csd, cpu); + smp_call_function_single_async(cpu, csd); + } + msecs = 1000; /* Wait at most a second for the other cpus to stop */ while ((atomic_read(&waiting_for_crash_ipi) > 0) && msecs) { mdelay(1); -- 2.25.1

2 1

[PATCH OLK-6.6] smb: client: fix crypto buffers in non-linear memory
by Wang Zhaolong 02 Dec '25

02 Dec '25

From: Enzo Matsumiya <ematsumiya(a)suse.de> mainline inclusion from mainline-v6.18-rc1 commit 998a67b954680f26f3734040aeeed08642d49721 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID3WD1 CVE: CVE-2025-40052 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The crypto API, through the scatterlist API, expects input buffers to be in linear memory. We handle this with the cifs_sg_set_buf() helper that converts vmalloc'd memory to their corresponding pages. However, when we allocate our aead_request buffer (@creq in smb2ops.c::crypt_message()), we do so with kvzalloc(), which possibly puts aead_request->__ctx in vmalloc area. AEAD algorithm then uses ->__ctx for its private/internal data and operations, and uses sg_set_buf() for such data on a few places. This works fine as long as @creq falls into kmalloc zone (small requests) or vmalloc'd memory is still within linear range. Tasks' stacks are vmalloc'd by default (CONFIG_VMAP_STACK=y), so too many tasks will increment the base stacks' addresses to a point where virt_addr_valid(buf) will fail (BUG() in sg_set_buf()) when that happens. In practice: too many parallel reads and writes on an encrypted mount will trigger this bug. To fix this, always alloc @creq with kmalloc() instead. Also drop the @sensitive_size variable/arguments since kfree_sensitive() doesn't need it. Backtrace: [ 945.272081] ------------[ cut here ]------------ [ 945.272774] kernel BUG at include/linux/scatterlist.h:209! [ 945.273520] Oops: invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC NOPTI [ 945.274412] CPU: 7 UID: 0 PID: 56 Comm: kworker/u33:0 Kdump: loaded Not tainted 6.15.0-lku-11779-g8e9d6efccdd7-dirty #1 PREEMPT(voluntary) [ 945.275736] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-2-gc13ff2cd-prebuilt.qemu.org 04/01/2014 [ 945.276877] Workqueue: writeback wb_workfn (flush-cifs-2) [ 945.277457] RIP: 0010:crypto_gcm_init_common+0x1f9/0x220 [ 945.278018] Code: b0 00 00 00 48 83 c4 08 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 48 c7 c0 00 00 00 80 48 2b 05 5c 58 e5 00 e9 58 ff ff ff <0f> 0b 0f 0b 0f 0b 0f 0b 0f 0b 0f 0b 48 c7 04 24 01 00 00 00 48 8b [ 945.279992] RSP: 0018:ffffc90000a27360 EFLAGS: 00010246 [ 945.280578] RAX: 0000000000000000 RBX: ffffc90001d85060 RCX: 0000000000000030 [ 945.281376] RDX: 0000000000080000 RSI: 0000000000000000 RDI: ffffc90081d85070 [ 945.282145] RBP: ffffc90001d85010 R08: ffffc90001d85000 R09: 0000000000000000 [ 945.282898] R10: ffffc90001d85090 R11: 0000000000001000 R12: ffffc90001d85070 [ 945.283656] R13: ffff888113522948 R14: ffffc90001d85060 R15: ffffc90001d85010 [ 945.284407] FS: 0000000000000000(0000) GS:ffff8882e66cf000(0000) knlGS:0000000000000000 [ 945.285262] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 945.285884] CR2: 00007fa7ffdd31f4 CR3: 000000010540d000 CR4: 0000000000350ef0 [ 945.286683] Call Trace: [ 945.286952] <TASK> [ 945.287184] ? crypt_message+0x33f/0xad0 [cifs] [ 945.287719] crypto_gcm_encrypt+0x36/0xe0 [ 945.288152] crypt_message+0x54a/0xad0 [cifs] [ 945.288724] smb3_init_transform_rq+0x277/0x300 [cifs] [ 945.289300] smb_send_rqst+0xa3/0x160 [cifs] [ 945.289944] cifs_call_async+0x178/0x340 [cifs] [ 945.290514] ? __pfx_smb2_writev_callback+0x10/0x10 [cifs] [ 945.291177] smb2_async_writev+0x3e3/0x670 [cifs] [ 945.291759] ? find_held_lock+0x32/0x90 [ 945.292212] ? netfs_advance_write+0xf2/0x310 [ 945.292723] netfs_advance_write+0xf2/0x310 [ 945.293210] netfs_write_folio+0x346/0xcc0 [ 945.293689] ? __pfx__raw_spin_unlock_irq+0x10/0x10 [ 945.294250] netfs_writepages+0x117/0x460 [ 945.294724] do_writepages+0xbe/0x170 [ 945.295152] ? find_held_lock+0x32/0x90 [ 945.295600] ? kvm_sched_clock_read+0x11/0x20 [ 945.296103] __writeback_single_inode+0x56/0x4b0 [ 945.296643] writeback_sb_inodes+0x229/0x550 [ 945.297140] __writeback_inodes_wb+0x4c/0xe0 [ 945.297642] wb_writeback+0x2f1/0x3f0 [ 945.298069] wb_workfn+0x300/0x490 [ 945.298472] process_one_work+0x1fe/0x590 [ 945.298949] worker_thread+0x1ce/0x3c0 [ 945.299397] ? __pfx_worker_thread+0x10/0x10 [ 945.299900] kthread+0x119/0x210 [ 945.300285] ? __pfx_kthread+0x10/0x10 [ 945.300729] ret_from_fork+0x119/0x1b0 [ 945.301163] ? __pfx_kthread+0x10/0x10 [ 945.301601] ret_from_fork_asm+0x1a/0x30 [ 945.302055] </TASK> Fixes: d08089f649a0 ("cifs: Change the I/O paths to use an iterator rather than a page list") Signed-off-by: Enzo Matsumiya <ematsumiya(a)suse.de> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/client/smb2ops.c [Conflicts with commit a2906d3316fc1 ("cifs: Switch crypto buffer to use a folio_queue rather than an xarray").] Signed-off-by: Wang Zhaolong <wangzhaolong(a)huaweicloud.com> --- fs/smb/client/smb2ops.c | 17 ++++++----------- 1 file changed, 6 insertions(+), 11 deletions(-) diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c index 8c76d6ce5a25..c19643a37fa0 100644 --- a/fs/smb/client/smb2ops.c +++ b/fs/smb/client/smb2ops.c @@ -4144,11 +4144,11 @@ fill_transform_hdr(struct smb2_transform_hdr *tr_hdr, unsigned int orig_len, } static void *smb2_aead_req_alloc(struct crypto_aead *tfm, const struct smb_rqst *rqst, int num_rqst, const u8 *sig, u8 **iv, struct aead_request **req, struct sg_table *sgt, - unsigned int *num_sgs, size_t *sensitive_size) + unsigned int *num_sgs) { unsigned int req_size = sizeof(**req) + crypto_aead_reqsize(tfm); unsigned int iv_size = crypto_aead_ivsize(tfm); unsigned int len; u8 *p; @@ -4161,13 +4161,12 @@ static void *smb2_aead_req_alloc(struct crypto_aead *tfm, const struct smb_rqst len += crypto_aead_alignmask(tfm) & ~(crypto_tfm_ctx_alignment() - 1); len = ALIGN(len, crypto_tfm_ctx_alignment()); len += req_size; len = ALIGN(len, __alignof__(struct scatterlist)); len += array_size(*num_sgs, sizeof(struct scatterlist)); - *sensitive_size = len; - p = kvzalloc(len, GFP_NOFS); + p = kzalloc(len, GFP_NOFS); if (!p) return ERR_PTR(-ENOMEM); *iv = (u8 *)PTR_ALIGN(p, crypto_aead_alignmask(tfm) + 1); *req = (struct aead_request *)PTR_ALIGN(*iv + iv_size, @@ -4177,20 +4176,18 @@ static void *smb2_aead_req_alloc(struct crypto_aead *tfm, const struct smb_rqst return p; } static void *smb2_get_aead_req(struct crypto_aead *tfm, struct smb_rqst *rqst, int num_rqst, const u8 *sig, u8 **iv, - struct aead_request **req, struct scatterlist **sgl, - size_t *sensitive_size) + struct aead_request **req, struct scatterlist **sgl) { struct sg_table sgtable = {}; unsigned int skip, num_sgs, i, j; ssize_t rc; void *p; - p = smb2_aead_req_alloc(tfm, rqst, num_rqst, sig, iv, req, &sgtable, - &num_sgs, sensitive_size); + p = smb2_aead_req_alloc(tfm, rqst, num_rqst, sig, iv, req, &sgtable, &num_sgs); if (IS_ERR(p)) return ERR_CAST(p); sg_init_marker(sgtable.sgl, num_sgs); @@ -4275,11 +4272,10 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst, struct aead_request *req; u8 *iv; DECLARE_CRYPTO_WAIT(wait); unsigned int crypt_len = le32_to_cpu(tr_hdr->OriginalMessageSize); void *creq; - size_t sensitive_size; rc = smb2_get_enc_key(server, le64_to_cpu(tr_hdr->SessionId), enc, key); if (rc) { cifs_server_dbg(FYI, "%s: Could not get %scryption key. sid: 0x%llx\n", __func__, enc ? "en" : "de", le64_to_cpu(tr_hdr->SessionId)); @@ -4301,12 +4297,11 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst, if (rc) { cifs_server_dbg(VFS, "%s: Failed to set authsize %d\n", __func__, rc); return rc; } - creq = smb2_get_aead_req(tfm, rqst, num_rqst, sign, &iv, &req, &sg, - &sensitive_size); + creq = smb2_get_aead_req(tfm, rqst, num_rqst, sign, &iv, &req, &sg); if (IS_ERR(creq)) return PTR_ERR(creq); if (!enc) { memcpy(sign, &tr_hdr->Signature, SMB2_SIGNATURE_SIZE); @@ -4332,11 +4327,11 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst, : crypto_aead_decrypt(req), &wait); if (!rc && enc) memcpy(&tr_hdr->Signature, sign, SMB2_SIGNATURE_SIZE); - kvfree_sensitive(creq, sensitive_size); + kfree_sensitive(creq); return rc; } /* * Clear a read buffer, discarding the folios which have XA_MARK_0 set. -- 2.34.3

2 1

[PATCH OLK-6.6] smb: client: fix mid_q_entry memleak leak with per-mid locking
by Wang Zhaolong 02 Dec '25

02 Dec '25

mainline inclusion from mainline-v6.17-rc2 commit e3835731e169a48a2c73018d135b5c08c39ea61d category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID5RU9 CVE: NA Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm… ------------------------------- This is step 4/4 of a patch series to fix mid_q_entry memory leaks caused by race conditions in callback execution. In compound_send_recv(), when wait_for_response() is interrupted by signals, the code attempts to cancel pending requests by changing their callbacks to cifs_cancelled_callback. However, there's a race condition between signal interruption and network response processing that causes both mid_q_entry and server buffer leaks: ``` User foreground process cifsd cifs_readdir open_cached_dir cifs_send_recv compound_send_recv smb2_setup_request smb2_mid_entry_alloc smb2_get_mid_entry smb2_mid_entry_alloc mempool_alloc // alloc mid kref_init(&temp->refcount); // refcount = 1 mid[0]->callback = cifs_compound_callback; mid[1]->callback = cifs_compound_last_callback; smb_send_rqst rc = wait_for_response wait_event_state TASK_KILLABLE cifs_demultiplex_thread allocate_buffers server->bigbuf = cifs_buf_get() standard_receive3 ->find_mid() smb2_find_mid __smb2_find_mid kref_get(&mid->refcount) // +1 cifs_handle_standard handle_mid /* bigbuf will also leak */ mid->resp_buf = server->bigbuf server->bigbuf = NULL; dequeue_mid /* in for loop */ mids[0]->callback cifs_compound_callback /* Signal interrupts wait: rc = -ERESTARTSYS */ /* if (... || midQ[i]->mid_state == MID_RESPONSE_RECEIVED) *? midQ[0]->callback = cifs_cancelled_callback; cancelled_mid[i] = true; /* The change comes too late */ mid->mid_state = MID_RESPONSE_READY release_mid // -1 /* cancelled_mid[i] == true causes mid won't be released in compound_send_recv cleanup */ /* cifs_cancelled_callback won't executed to release mid */ ``` The root cause is that there's a race between callback assignment and execution. Fix this by introducing per-mid locking: - Add spinlock_t mid_lock to struct mid_q_entry - Add mid_execute_callback() for atomic callback execution - Use mid_lock in cancellation paths to ensure atomicity This ensures that either the original callback or the cancellation callback executes atomically, preventing reference count leaks when requests are interrupted by signals. Link: https://bugzilla.kernel.org/show_bug.cgi?id=220404 Fixes: ee258d79159a ("CIFS: Move credit processing to mid callbacks for SMB3") Signed-off-by: Wang Zhaolong <wangzhaolong(a)huaweicloud.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/client/cifsglob.h fs/smb/client/connect.c fs/smb/client/smb2ops.c fs/smb/client/transport.c fs/smb/client/cifstransport.c [Conflict with code context.] Signed-off-by: Wang Zhaolong <wangzhaolong(a)huaweicloud.com> --- fs/smb/client/cifsglob.h | 20 ++++++++++++++++++++ fs/smb/client/connect.c | 6 +++--- fs/smb/client/smb2ops.c | 4 ++-- fs/smb/client/smb2transport.c | 1 + fs/smb/client/transport.c | 26 ++++++++++++-------------- 5 files changed, 38 insertions(+), 19 deletions(-) diff --git a/fs/smb/client/cifsglob.h b/fs/smb/client/cifsglob.h index 8dbc93bdd013..1e6d0c87346c 100644 --- a/fs/smb/client/cifsglob.h +++ b/fs/smb/client/cifsglob.h @@ -1729,10 +1729,11 @@ struct mid_q_entry { unsigned int resp_buf_size; int mid_state; /* wish this were enum but can not pass to wait_event */ unsigned int mid_flags; __le16 command; /* smb command code */ unsigned int optype; /* operation type */ + spinlock_t mid_lock; bool large_buf:1; /* if valid response, is pointer to large buf */ bool multiRsp:1; /* multiple trans2 responses for one request */ bool multiEnd:1; /* both received */ bool decrypted:1; /* decrypted entry */ }; @@ -2030,10 +2031,13 @@ require use of the stronger protocol */ * cifsFileInfo->fh_mutex cifsFileInfo cifs_new_fileinfo * cifsFileInfo->file_info_lock cifsFileInfo->count cifs_new_fileinfo * ->invalidHandle initiate_cifs_search * ->oplock_break_cancelled * cifs_aio_ctx->aio_mutex cifs_aio_ctx cifs_aio_ctx_alloc + * mid_q_entry->mid_lock mid_q_entry->callback alloc_mid + * smb2_mid_entry_alloc + * (Any fields of mid_q_entry that will need protection) ****************************************************************************/ #ifdef DECLARE_GLOBALS_HERE #define GLOBAL_EXTERN #else @@ -2345,6 +2349,22 @@ static inline bool cifs_ses_exiting(struct cifs_ses *ses) ret = ses->ses_status == SES_EXITING; spin_unlock(&ses->ses_lock); return ret; } +/* + * Execute mid callback atomically - ensures callback runs exactly once + * and prevents sleeping in atomic context. + */ +static inline void mid_execute_callback(struct mid_q_entry *mid) +{ + void (*callback)(struct mid_q_entry *mid); + + spin_lock(&mid->mid_lock); + callback = mid->callback; + mid->callback = NULL; /* Mark as executed, */ + spin_unlock(&mid->mid_lock); + + if (callback) + callback(mid); +} #endif /* _CIFS_GLOB_H */ diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c index 4c730e1fde20..23e0b902239a 100644 --- a/fs/smb/client/connect.c +++ b/fs/smb/client/connect.c @@ -339,11 +339,11 @@ cifs_abort_connection(struct TCP_Server_Info *server) cifs_server_unlock(server); cifs_dbg(FYI, "%s: issuing mid callbacks\n", __func__); list_for_each_entry_safe(mid, nmid, &retry_list, qhead) { list_del_init(&mid->qhead); - mid->callback(mid); + mid_execute_callback(mid); release_mid(mid); } if (cifs_rdma_enabled(server)) { cifs_server_lock(server); @@ -1028,11 +1028,11 @@ clean_demultiplex_info(struct TCP_Server_Info *server) /* now walk dispose list and issue callbacks */ list_for_each_safe(tmp, tmp2, &dispose_list) { mid_entry = list_entry(tmp, struct mid_q_entry, qhead); cifs_dbg(FYI, "Callback mid %llu\n", mid_entry->mid); list_del_init(&mid_entry->qhead); - mid_entry->callback(mid_entry); + mid_execute_callback(mid_entry); release_mid(mid_entry); } /* 1/8th of sec is more than enough time for them to exit */ msleep(125); } @@ -1305,11 +1305,11 @@ cifs_demultiplex_thread(void *p) "Share deleted. Reconnect needed"); } } if (!mids[i]->multiRsp || mids[i]->multiEnd) - mids[i]->callback(mids[i]); + mid_execute_callback(mids[i]); release_mid(mids[i]); } else if (server->ops->is_oplock_break && server->ops->is_oplock_break(bufs[i], server)) { diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c index ce1fb2f3e095..8c76d6ce5a25 100644 --- a/fs/smb/client/smb2ops.c +++ b/fs/smb/client/smb2ops.c @@ -4727,19 +4727,19 @@ static void smb2_decrypt_offload(struct work_struct *work) #endif if (dw->server->ops->is_network_name_deleted) dw->server->ops->is_network_name_deleted(dw->buf, dw->server); - mid->callback(mid); + mid_execute_callback(mid); } else { spin_lock(&dw->server->srv_lock); if (dw->server->tcpStatus == CifsNeedReconnect) { spin_lock(&dw->server->mid_lock); mid->mid_state = MID_RETRY_NEEDED; spin_unlock(&dw->server->mid_lock); spin_unlock(&dw->server->srv_lock); - mid->callback(mid); + mid_execute_callback(mid); } else { spin_lock(&dw->server->mid_lock); mid->mid_state = MID_REQUEST_SUBMITTED; mid->mid_flags &= ~(MID_DELETED); list_add_tail(&mid->qhead, diff --git a/fs/smb/client/smb2transport.c b/fs/smb/client/smb2transport.c index 4a43802375b3..7f21e6ae8c5b 100644 --- a/fs/smb/client/smb2transport.c +++ b/fs/smb/client/smb2transport.c @@ -769,10 +769,11 @@ smb2_mid_entry_alloc(const struct smb2_hdr *shdr, } temp = mempool_alloc(cifs_mid_poolp, GFP_NOFS); memset(temp, 0, sizeof(struct mid_q_entry)); kref_init(&temp->refcount); + spin_lock_init(&temp->mid_lock); temp->mid = le64_to_cpu(shdr->MessageId); temp->credits = credits > 0 ? credits : 1; temp->pid = current->pid; temp->command = shdr->Command; /* Always LE */ temp->when_alloc = jiffies; diff --git a/fs/smb/client/transport.c b/fs/smb/client/transport.c index ddf1a3aafee5..8f045db44319 100644 --- a/fs/smb/client/transport.c +++ b/fs/smb/client/transport.c @@ -51,10 +51,11 @@ alloc_mid(const struct smb_hdr *smb_buffer, struct TCP_Server_Info *server) } temp = mempool_alloc(cifs_mid_poolp, GFP_NOFS); memset(temp, 0, sizeof(struct mid_q_entry)); kref_init(&temp->refcount); + spin_lock_init(&temp->mid_lock); temp->mid = get_mid(smb_buffer); temp->pid = current->pid; temp->command = cpu_to_le16(smb_buffer->Command); cifs_dbg(FYI, "For smb_command %d\n", smb_buffer->Command); /* easier to use jiffies */ @@ -1218,19 +1219,18 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, if (rc != 0) { for (; i < num_rqst; i++) { cifs_server_dbg(FYI, "Cancelling wait for mid %llu cmd: %d\n", midQ[i]->mid, le16_to_cpu(midQ[i]->command)); send_cancel(server, &rqst[i], midQ[i]); - spin_lock(&server->mid_lock); + spin_lock(&midQ[i]->mid_lock); midQ[i]->mid_flags |= MID_WAIT_CANCELLED; - if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED || - midQ[i]->mid_state == MID_RESPONSE_RECEIVED) { + if (midQ[i]->callback) { midQ[i]->callback = cifs_cancelled_callback; cancelled_mid[i] = true; credits[i].value = 0; } - spin_unlock(&server->mid_lock); + spin_unlock(&midQ[i]->mid_lock); } } for (i = 0; i < num_rqst; i++) { if (rc < 0) @@ -1428,20 +1428,19 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses, goto out; rc = wait_for_response(server, midQ); if (rc != 0) { send_cancel(server, &rqst, midQ); - spin_lock(&server->mid_lock); - if (midQ->mid_state == MID_REQUEST_SUBMITTED || - midQ->mid_state == MID_RESPONSE_RECEIVED) { + spin_lock(&midQ->mid_lock); + if (midQ->callback) { /* no longer considered to be "in-flight" */ midQ->callback = release_mid; - spin_unlock(&server->mid_lock); + spin_unlock(&midQ->mid_lock); add_credits(server, &credits, 0); return rc; } - spin_unlock(&server->mid_lock); + spin_unlock(&midQ->mid_lock); } rc = cifs_sync_mid_result(midQ, server); if (rc != 0) { add_credits(server, &credits, 0); @@ -1610,19 +1609,18 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, } rc = wait_for_response(server, midQ); if (rc) { send_cancel(server, &rqst, midQ); - spin_lock(&server->mid_lock); - if (midQ->mid_state == MID_REQUEST_SUBMITTED || - midQ->mid_state == MID_RESPONSE_RECEIVED) { + spin_lock(&midQ->mid_lock); + if (midQ->callback) { /* no longer considered to be "in-flight" */ midQ->callback = release_mid; - spin_unlock(&server->mid_lock); + spin_unlock(&midQ->mid_lock); return rc; } - spin_unlock(&server->mid_lock); + spin_unlock(&midQ->mid_lock); } /* We got the response - restart system call. */ rstart = 1; spin_lock(&server->srv_lock); -- 2.34.3

2 1

[PATCH OLK-5.10] smb: client: fix mid_q_entry memleak leak with per-mid locking
by Wang Zhaolong 02 Dec '25

02 Dec '25

mainline inclusion from mainline-v6.17-rc2 commit e3835731e169a48a2c73018d135b5c08c39ea61d category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID5RU9 CVE: NA Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm… ------------------------------- This is step 4/4 of a patch series to fix mid_q_entry memory leaks caused by race conditions in callback execution. In compound_send_recv(), when wait_for_response() is interrupted by signals, the code attempts to cancel pending requests by changing their callbacks to cifs_cancelled_callback. However, there's a race condition between signal interruption and network response processing that causes both mid_q_entry and server buffer leaks: ``` User foreground process cifsd cifs_readdir open_cached_dir cifs_send_recv compound_send_recv smb2_setup_request smb2_mid_entry_alloc smb2_get_mid_entry smb2_mid_entry_alloc mempool_alloc // alloc mid kref_init(&temp->refcount); // refcount = 1 mid[0]->callback = cifs_compound_callback; mid[1]->callback = cifs_compound_last_callback; smb_send_rqst rc = wait_for_response wait_event_state TASK_KILLABLE cifs_demultiplex_thread allocate_buffers server->bigbuf = cifs_buf_get() standard_receive3 ->find_mid() smb2_find_mid __smb2_find_mid kref_get(&mid->refcount) // +1 cifs_handle_standard handle_mid /* bigbuf will also leak */ mid->resp_buf = server->bigbuf server->bigbuf = NULL; dequeue_mid /* in for loop */ mids[0]->callback cifs_compound_callback /* Signal interrupts wait: rc = -ERESTARTSYS */ /* if (... || midQ[i]->mid_state == MID_RESPONSE_RECEIVED) *? midQ[0]->callback = cifs_cancelled_callback; cancelled_mid[i] = true; /* The change comes too late */ mid->mid_state = MID_RESPONSE_READY release_mid // -1 /* cancelled_mid[i] == true causes mid won't be released in compound_send_recv cleanup */ /* cifs_cancelled_callback won't executed to release mid */ ``` The root cause is that there's a race between callback assignment and execution. Fix this by introducing per-mid locking: - Add spinlock_t mid_lock to struct mid_q_entry - Add mid_execute_callback() for atomic callback execution - Use mid_lock in cancellation paths to ensure atomicity This ensures that either the original callback or the cancellation callback executes atomically, preventing reference count leaks when requests are interrupted by signals. Link: https://bugzilla.kernel.org/show_bug.cgi?id=220404 Fixes: ee258d79159a ("CIFS: Move credit processing to mid callbacks for SMB3") Signed-off-by: Wang Zhaolong <wangzhaolong(a)huaweicloud.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/client/cifsglob.h fs/smb/client/connect.c fs/smb/client/smb2ops.c fs/smb/client/smb2transport.c fs/smb/client/transport.c fs/smb/client/cifstransport.c fs/cifs/cifsglob.h fs/cifs/connect.c fs/cifs/smb2ops.c fs/cifs/smb2transport.c fs/cifs/transport.c [The location of the code file has changed, and there is a context conflict in the code.] Signed-off-by: Wang Zhaolong <wangzhaolong(a)huaweicloud.com> --- fs/cifs/cifsglob.h | 17 +++++++++++++++++ fs/cifs/connect.c | 6 +++--- fs/cifs/smb2ops.c | 4 ++-- fs/cifs/smb2transport.c | 1 + fs/cifs/transport.c | 26 ++++++++++++-------------- 5 files changed, 35 insertions(+), 19 deletions(-) diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h index 7d1f68008435..d84389a88244 100644 --- a/fs/cifs/cifsglob.h +++ b/fs/cifs/cifsglob.h @@ -1617,10 +1617,11 @@ struct mid_q_entry { unsigned int resp_buf_size; int mid_state; /* wish this were enum but can not pass to wait_event */ unsigned int mid_flags; __le16 command; /* smb command code */ unsigned int optype; /* operation type */ + spinlock_t mid_lock; bool large_buf:1; /* if valid response, is pointer to large buf */ bool multiRsp:1; /* multiple trans2 responses for one request */ bool multiEnd:1; /* both received */ bool decrypted:1; /* decrypted entry */ }; @@ -2120,6 +2121,22 @@ static inline struct scatterlist *cifs_sg_set_buf(struct scatterlist *sg, sg_set_page(sg++, virt_to_page(addr), buflen, off); } return sg; } +/* + * Execute mid callback atomically - ensures callback runs exactly once + * and prevents sleeping in atomic context. + */ +static inline void mid_execute_callback(struct mid_q_entry *mid) +{ + void (*callback)(struct mid_q_entry *mid); + + spin_lock(&mid->mid_lock); + callback = mid->callback; + mid->callback = NULL; /* Mark as executed, */ + spin_unlock(&mid->mid_lock); + + if (callback) + callback(mid); +} #endif /* _CIFS_GLOB_H */ diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c index 23798ab5d5f1..287230b70e51 100644 --- a/fs/cifs/connect.c +++ b/fs/cifs/connect.c @@ -502,11 +502,11 @@ cifs_reconnect(struct TCP_Server_Info *server) cifs_dbg(FYI, "%s: issuing mid callbacks\n", __func__); list_for_each_safe(tmp, tmp2, &retry_list) { mid_entry = list_entry(tmp, struct mid_q_entry, qhead); list_del_init(&mid_entry->qhead); - mid_entry->callback(mid_entry); + mid_execute_callback(mid_entry); cifs_mid_q_entry_release(mid_entry); } if (cifs_rdma_enabled(server)) { mutex_lock(&server->srv_mutex); @@ -942,11 +942,11 @@ static void clean_demultiplex_info(struct TCP_Server_Info *server) /* now walk dispose list and issue callbacks */ list_for_each_safe(tmp, tmp2, &dispose_list) { mid_entry = list_entry(tmp, struct mid_q_entry, qhead); cifs_dbg(FYI, "Callback mid 0x%llx\n", mid_entry->mid); list_del_init(&mid_entry->qhead); - mid_entry->callback(mid_entry); + mid_execute_callback(mid_entry); cifs_mid_q_entry_release(mid_entry); } /* 1/8th of sec is more than enough time for them to exit */ msleep(125); } @@ -1193,11 +1193,11 @@ cifs_demultiplex_thread(void *p) for (i = 0; i < num_mids; i++) { if (mids[i] != NULL) { mids[i]->resp_buf_size = server->pdu_size; if (!mids[i]->multiRsp || mids[i]->multiEnd) - mids[i]->callback(mids[i]); + mid_execute_callback(mids[i]); cifs_mid_q_entry_release(mids[i]); } else if (server->ops->is_oplock_break && server->ops->is_oplock_break(bufs[i], server)) { diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c index 16245e8b6f28..2bc268401d91 100644 --- a/fs/cifs/smb2ops.c +++ b/fs/cifs/smb2ops.c @@ -4786,17 +4786,17 @@ static void smb2_decrypt_offload(struct work_struct *work) true); if (rc >= 0) { #ifdef CONFIG_CIFS_STATS2 mid->when_received = jiffies; #endif - mid->callback(mid); + mid_execute_callback(mid); } else { spin_lock(&GlobalMid_Lock); if (dw->server->tcpStatus == CifsNeedReconnect) { mid->mid_state = MID_RETRY_NEEDED; spin_unlock(&GlobalMid_Lock); - mid->callback(mid); + mid_execute_callback(mid); } else { mid->mid_state = MID_REQUEST_SUBMITTED; mid->mid_flags &= ~(MID_DELETED); list_add_tail(&mid->qhead, &dw->server->pending_mid_q); diff --git a/fs/cifs/smb2transport.c b/fs/cifs/smb2transport.c index d659eb70df76..d76e2c3d6b29 100644 --- a/fs/cifs/smb2transport.c +++ b/fs/cifs/smb2transport.c @@ -714,10 +714,11 @@ smb2_mid_entry_alloc(const struct smb2_sync_hdr *shdr, } temp = mempool_alloc(cifs_mid_poolp, GFP_NOFS); memset(temp, 0, sizeof(struct mid_q_entry)); kref_init(&temp->refcount); + spin_lock_init(&temp->mid_lock); temp->mid = le64_to_cpu(shdr->MessageId); temp->credits = credits > 0 ? credits : 1; temp->pid = current->pid; temp->command = shdr->Command; /* Always LE */ temp->when_alloc = jiffies; diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c index d634a7692e13..b5b17aa2fac4 100644 --- a/fs/cifs/transport.c +++ b/fs/cifs/transport.c @@ -63,10 +63,11 @@ AllocMidQEntry(const struct smb_hdr *smb_buffer, struct TCP_Server_Info *server) } temp = mempool_alloc(cifs_mid_poolp, GFP_NOFS); memset(temp, 0, sizeof(struct mid_q_entry)); kref_init(&temp->refcount); + spin_lock_init(&temp->mid_lock); temp->mid = get_mid(smb_buffer); temp->pid = current->pid; temp->command = cpu_to_le16(smb_buffer->Command); cifs_dbg(FYI, "For smb_command %d\n", smb_buffer->Command); /* do_gettimeofday(&temp->when_sent);*/ /* easier to use jiffies */ @@ -1171,19 +1172,18 @@ compound_send_recv(const unsigned int xid, struct cifs_ses *ses, if (rc != 0) { for (; i < num_rqst; i++) { cifs_server_dbg(FYI, "Cancelling wait for mid %llu cmd: %d\n", midQ[i]->mid, le16_to_cpu(midQ[i]->command)); send_cancel(server, &rqst[i], midQ[i]); - spin_lock(&GlobalMid_Lock); + spin_lock(&midQ[i]->mid_lock); midQ[i]->mid_flags |= MID_WAIT_CANCELLED; - if (midQ[i]->mid_state == MID_REQUEST_SUBMITTED || - midQ[i]->mid_state == MID_RESPONSE_RECEIVED) { + if (midQ[i]->callback) { midQ[i]->callback = cifs_cancelled_callback; cancelled_mid[i] = true; credits[i].value = 0; } - spin_unlock(&GlobalMid_Lock); + spin_unlock(&midQ[i]->mid_lock); } } for (i = 0; i < num_rqst; i++) { if (rc < 0) @@ -1373,20 +1373,19 @@ SendReceive(const unsigned int xid, struct cifs_ses *ses, goto out; rc = wait_for_response(server, midQ); if (rc != 0) { send_cancel(server, &rqst, midQ); - spin_lock(&GlobalMid_Lock); - if (midQ->mid_state == MID_REQUEST_SUBMITTED || - midQ->mid_state == MID_RESPONSE_RECEIVED) { + spin_lock(&midQ->mid_lock); + if (midQ->callback) { /* no longer considered to be "in-flight" */ midQ->callback = DeleteMidQEntry; - spin_unlock(&GlobalMid_Lock); + spin_unlock(&midQ->mid_lock); add_credits(server, &credits, 0); return rc; } - spin_unlock(&GlobalMid_Lock); + spin_unlock(&midQ->mid_lock); } rc = cifs_sync_mid_result(midQ, server); if (rc != 0) { add_credits(server, &credits, 0); @@ -1549,19 +1548,18 @@ SendReceiveBlockingLock(const unsigned int xid, struct cifs_tcon *tcon, } rc = wait_for_response(server, midQ); if (rc) { send_cancel(server, &rqst, midQ); - spin_lock(&GlobalMid_Lock); - if (midQ->mid_state == MID_REQUEST_SUBMITTED || - midQ->mid_state == MID_RESPONSE_RECEIVED) { + spin_lock(&midQ->mid_lock); + if (midQ->callback) { /* no longer considered to be "in-flight" */ midQ->callback = DeleteMidQEntry; - spin_unlock(&GlobalMid_Lock); + spin_unlock(&midQ->mid_lock); return rc; } - spin_unlock(&GlobalMid_Lock); + spin_unlock(&midQ->mid_lock); } /* We got the response - restart system call. */ rstart = 1; } -- 2.34.3

2 1

[PATCH OLK-6.6 v2 0/3] bugfix for xcall2.0
by Xinyu Zheng 02 Dec '25

02 Dec '25

Changes in v2: - move all pux_xcall() out of spinlock context Xinyu Zheng (3): xcall2.0: prefetch: get prefetch_mm_data once in get_pfi() xcall2.0: prefetch: fix access NULL ptr in __do_sys_epoll_pwait() xcall2.0: fix panic while detaching xcall found in DT case arch/arm64/kernel/xcall/core.c | 7 +++++-- drivers/staging/xcall/prefetch.c | 6 +++--- 2 files changed, 8 insertions(+), 5 deletions(-) -- 2.34.1

2 4

[PATCH OLK-6.6] drm/scheduler: signal scheduled fence when kill job
by Yao Kai 02 Dec '25

02 Dec '25

From: "Lin.Cao" <lincao12(a)amd.com> stable inclusion from stable-v6.6.96 commit c5734f9bab6f0d40577ad0633af4090a5fda2407 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICOE0M CVE: CVE-2025-38436 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 471db2c2d4f80ee94225a1ef246e4f5011733e50 ] When an entity from application B is killed, drm_sched_entity_kill() removes all jobs belonging to that entity through drm_sched_entity_kill_jobs_work(). If application A's job depends on a scheduled fence from application B's job, and that fence is not properly signaled during the killing process, application A's dependency cannot be cleared. This leads to application A hanging indefinitely while waiting for a dependency that will never be resolved. Fix this issue by ensuring that scheduled fences are properly signaled when an entity is killed, allowing dependent applications to continue execution. Signed-off-by: Lin.Cao <lincao12(a)amd.com> Reviewed-by: Philipp Stanner <phasta(a)kernel.org> Signed-off-by: Christian König <christian.koenig(a)amd.com> Link: https://lore.kernel.org/r/20250515020713.1110476-1-lincao12@amd.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yao Kai <yaokai34(a)huawei.com> --- drivers/gpu/drm/scheduler/sched_entity.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/scheduler/sched_entity.c b/drivers/gpu/drm/scheduler/sched_entity.c index 53130a50584c..eed3b8bed9e4 100644 --- a/drivers/gpu/drm/scheduler/sched_entity.c +++ b/drivers/gpu/drm/scheduler/sched_entity.c @@ -167,6 +167,7 @@ static void drm_sched_entity_kill_jobs_work(struct work_struct *wrk) { struct drm_sched_job *job = container_of(wrk, typeof(*job), work); + drm_sched_fence_scheduled(job->s_fence, NULL); drm_sched_fence_finished(job->s_fence, -ESRCH); WARN_ON(job->s_fence->parent); job->sched->ops->free_job(job); -- 2.43.0

2 1

[PATCH OLK-5.10] Bluetooth: btmtksdio: fix use-after-free at btmtksdio_recv_event
by Yao Kai 02 Dec '25

02 Dec '25

From: Sean Wang <sean.wang(a)mediatek.com> mainline inclusion from mainline-v5.19-rc1 commit 0fab6361c4ba17d1b43a991bef4238a3c1754d35 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP74Z CVE: CVE-2022-49470 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- We should not access skb buffer data anymore after hci_recv_frame was called. [ 39.634809] BUG: KASAN: use-after-free in btmtksdio_recv_event+0x1b0 [ 39.634855] Read of size 1 at addr ffffff80cf28a60d by task kworker [ 39.634962] Call trace: [ 39.634974] dump_backtrace+0x0/0x3b8 [ 39.634999] show_stack+0x20/0x2c [ 39.635016] dump_stack_lvl+0x60/0x78 [ 39.635040] print_address_description+0x70/0x2f0 [ 39.635062] kasan_report+0x154/0x194 [ 39.635079] __asan_report_load1_noabort+0x44/0x50 [ 39.635099] btmtksdio_recv_event+0x1b0/0x1c4 [ 39.635129] btmtksdio_txrx_work+0x6cc/0xac4 [ 39.635157] process_one_work+0x560/0xc5c [ 39.635177] worker_thread+0x7ec/0xcc0 [ 39.635195] kthread+0x2d0/0x3d0 [ 39.635215] ret_from_fork+0x10/0x20 [ 39.635247] Allocated by task 0: [ 39.635260] (stack is not available) [ 39.635281] Freed by task 2392: [ 39.635295] kasan_save_stack+0x38/0x68 [ 39.635319] kasan_set_track+0x28/0x3c [ 39.635338] kasan_set_free_info+0x28/0x4c [ 39.635357] ____kasan_slab_free+0x104/0x150 [ 39.635374] __kasan_slab_free+0x18/0x28 [ 39.635391] slab_free_freelist_hook+0x114/0x248 [ 39.635410] kfree+0xf8/0x2b4 [ 39.635427] skb_free_head+0x58/0x98 [ 39.635447] skb_release_data+0x2f4/0x410 [ 39.635464] skb_release_all+0x50/0x60 [ 39.635481] kfree_skb+0xc8/0x25c [ 39.635498] hci_event_packet+0x894/0xca4 [bluetooth] [ 39.635721] hci_rx_work+0x1c8/0x68c [bluetooth] [ 39.635925] process_one_work+0x560/0xc5c [ 39.635951] worker_thread+0x7ec/0xcc0 [ 39.635970] kthread+0x2d0/0x3d0 [ 39.635990] ret_from_fork+0x10/0x20 [ 39.636021] The buggy address belongs to the object at ffffff80cf28a600 which belongs to the cache kmalloc-512 of size 512 [ 39.636039] The buggy address is located 13 bytes inside of 512-byte region [ffffff80cf28a600, ffffff80cf28a800) Fixes: 9aebfd4a2200 ("Bluetooth: mediatek: add support for MediaTek MT7663S and MT7668S SDIO devices") Co-developed-by: Yake Yang <yake.yang(a)mediatek.com> Signed-off-by: Yake Yang <yake.yang(a)mediatek.com> Signed-off-by: Sean Wang <sean.wang(a)mediatek.com> Signed-off-by: Marcel Holtmann <marcel(a)holtmann.org> Conflicts: drivers/bluetooth/btmtksdio.c [conflicts because commit e4412654e260 ("Bluetooth: mediatek: fix the conflict between mtk and msft vendor event") is not merged] Signed-off-by: Yao Kai <yaokai34(a)huawei.com> --- drivers/bluetooth/btmtksdio.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/bluetooth/btmtksdio.c b/drivers/bluetooth/btmtksdio.c index c41560be39fb..99446083482b 100644 --- a/drivers/bluetooth/btmtksdio.c +++ b/drivers/bluetooth/btmtksdio.c @@ -331,6 +331,7 @@ static int btmtksdio_recv_event(struct hci_dev *hdev, struct sk_buff *skb) { struct btmtksdio_dev *bdev = hci_get_drvdata(hdev); struct hci_event_hdr *hdr = (void *)skb->data; + u8 evt; int err; /* Fix up the vendor event id with 0xff for vendor specific instead @@ -339,6 +340,7 @@ static int btmtksdio_recv_event(struct hci_dev *hdev, struct sk_buff *skb) */ if (hdr->evt == 0xe4) hdr->evt = HCI_EV_VENDOR; + evt = hdr->evt; /* When someone waits for the WMT event, the skb is being cloned * and being processed the events from there then. @@ -355,7 +357,7 @@ static int btmtksdio_recv_event(struct hci_dev *hdev, struct sk_buff *skb) if (err < 0) goto err_free_skb; - if (hdr->evt == HCI_EV_VENDOR) { + if (evt == HCI_EV_VENDOR) { if (test_and_clear_bit(BTMTKSDIO_TX_WAIT_VND_EVT, &bdev->tx_state)) { /* Barrier to sync with other CPUs */ -- 2.43.0

2 1

[PATCH OLK-5.10] soc: qcom: socinfo: Avoid out of bounds read of serial number
by Yao Kai 02 Dec '25

02 Dec '25

mainline inclusion from mainline-v6.14-rc1 commit 22cf4fae6660b6e1a583a41cbf84e3046ca9ccd0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC4I CVE: CVE-2024-58007 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- On MSM8916 devices, the serial number exposed in sysfs is constant and does not change across individual devices. It's always: db410c:/sys/devices/soc0$ cat serial_number 2644893864 The firmware used on MSM8916 exposes SOCINFO_VERSION(0, 8), which does not have support for the serial_num field in the socinfo struct. There is an existing check to avoid exposing the serial number in that case, but it's not correct: When checking the item_size returned by SMEM, we need to make sure the *end* of the serial_num is within bounds, instead of comparing with the *start* offset. The serial_number currently exposed on MSM8916 devices is just an out of bounds read of whatever comes after the socinfo struct in SMEM. Fix this by changing offsetof() to offsetofend(), so that the size of the field is also taken into account. Cc: stable(a)vger.kernel.org Fixes: efb448d0a3fc ("soc: qcom: Add socinfo driver") Signed-off-by: Stephan Gerhold <stephan.gerhold(a)linaro.org> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Link: https://lore.kernel.org/r/20241230-qcom-socinfo-serialno-oob-v1-1-9b7a890da… Signed-off-by: Bjorn Andersson <andersson(a)kernel.org> Conflicts: drivers/soc/qcom/socinfo.c [context conflicts] Signed-off-by: Yao Kai <yaokai34(a)huawei.com> --- drivers/soc/qcom/socinfo.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/soc/qcom/socinfo.c b/drivers/soc/qcom/socinfo.c index 60c82dcaa8d1..1d695697980a 100644 --- a/drivers/soc/qcom/socinfo.c +++ b/drivers/soc/qcom/socinfo.c @@ -507,7 +507,7 @@ static int qcom_socinfo_probe(struct platform_device *pdev) qs->attr.revision = devm_kasprintf(&pdev->dev, GFP_KERNEL, "%u.%u", SOCINFO_MAJOR(le32_to_cpu(info->ver)), SOCINFO_MINOR(le32_to_cpu(info->ver))); - if (offsetof(struct socinfo, serial_num) <= item_size) + if (offsetofend(struct socinfo, serial_num) <= item_size) qs->attr.serial_number = devm_kasprintf(&pdev->dev, GFP_KERNEL, "%u", le32_to_cpu(info->serial_num)); -- 2.43.0

2 1

[PATCH OLK-5.10] usb: typec: ucsi: displayport: Fix NULL pointer access
by Yao Kai 02 Dec '25

02 Dec '25

From: Andrei Kuchynski <akuchynski(a)chromium.org> mainline inclusion from mainline-v6.15-rc1 commit 312d79669e71283d05c05cc49a1a31e59e3d9e0e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICBIZT CVE: CVE-2025-37994 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- This patch ensures that the UCSI driver waits for all pending tasks in the ucsi_displayport_work workqueue to finish executing before proceeding with the partner removal. Cc: stable <stable(a)kernel.org> Fixes: af8622f6a585 ("usb: typec: ucsi: Support for DisplayPort alt mode") Signed-off-by: Andrei Kuchynski <akuchynski(a)chromium.org> Reviewed-by: Heikki Krogerus <heikki.krogerus(a)linux.intel.com> Reviewed-by: Benson Leung <bleung(a)chromium.org> Link: https://lore.kernel.org/r/20250424084429.3220757-3-akuchynski@chromium.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yao Kai <yaokai34(a)huawei.com> --- drivers/usb/typec/ucsi/displayport.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/usb/typec/ucsi/displayport.c b/drivers/usb/typec/ucsi/displayport.c index 4446c4066679..60c871fa58d6 100644 --- a/drivers/usb/typec/ucsi/displayport.c +++ b/drivers/usb/typec/ucsi/displayport.c @@ -270,6 +270,8 @@ void ucsi_displayport_remove_partner(struct typec_altmode *alt) if (!dp) return; + cancel_work_sync(&dp->work); + dp->data.conf = 0; dp->data.status = 0; dp->initialized = false; -- 2.43.0

2 1

[PATCH OLK-6.6] usb: typec: ucsi: displayport: Fix NULL pointer access
by Yao Kai 02 Dec '25

02 Dec '25

From: Andrei Kuchynski <akuchynski(a)chromium.org> mainline inclusion from mainline-v6.15-rc1 commit 312d79669e71283d05c05cc49a1a31e59e3d9e0e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICBIZT CVE: CVE-2025-37994 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- This patch ensures that the UCSI driver waits for all pending tasks in the ucsi_displayport_work workqueue to finish executing before proceeding with the partner removal. Cc: stable <stable(a)kernel.org> Fixes: af8622f6a585 ("usb: typec: ucsi: Support for DisplayPort alt mode") Signed-off-by: Andrei Kuchynski <akuchynski(a)chromium.org> Reviewed-by: Heikki Krogerus <heikki.krogerus(a)linux.intel.com> Reviewed-by: Benson Leung <bleung(a)chromium.org> Link: https://lore.kernel.org/r/20250424084429.3220757-3-akuchynski@chromium.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yao Kai <yaokai34(a)huawei.com> --- drivers/usb/typec/ucsi/displayport.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/usb/typec/ucsi/displayport.c b/drivers/usb/typec/ucsi/displayport.c index 2431febc4615..8c19081c3255 100644 --- a/drivers/usb/typec/ucsi/displayport.c +++ b/drivers/usb/typec/ucsi/displayport.c @@ -296,6 +296,8 @@ void ucsi_displayport_remove_partner(struct typec_altmode *alt) if (!dp) return; + cancel_work_sync(&dp->work); + dp->data.conf = 0; dp->data.status = 0; dp->initialized = false; -- 2.43.0

2 1

[openeuler:OLK-6.6 3415/3415] drivers/iommu/hisilicon/ummu_main.c:267:2: warning: unannotated fall-through between switch labels
by kernel test robot 02 Dec '25

02 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 118b4e18ae4e19cd4e1245306fe243d21aee3d82 commit: 0db2fc397b9d432df0233d7bed29df427df74aac [3415/3415] iommu/ummu: Support UMMU device config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20251202/202512020558.hXS2BgSg-lkp@…) compiler: clang version 19.1.7 (https://github.com/llvm/llvm-project cd708029e0b2869e80abe31ddb175f7c35361f90) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251202/202512020558.hXS2BgSg-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512020558.hXS2BgSg-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/iommu/hisilicon/ummu_main.c:267:2: warning: unannotated fall-through between switch labels [-Wimplicit-fallthrough] 267 | default: | ^ drivers/iommu/hisilicon/ummu_main.c:267:2: note: insert 'break;' to avoid fall-through 267 | default: | ^ | break; drivers/iommu/hisilicon/ummu_main.c:280:2: warning: unannotated fall-through between switch labels [-Wimplicit-fallthrough] 280 | default: | ^ drivers/iommu/hisilicon/ummu_main.c:280:2: note: insert 'break;' to avoid fall-through 280 | default: | ^ | break; 2 warnings generated. vim +267 drivers/iommu/hisilicon/ummu_main.c 258 259 static void ummu_device_get_stall_model(struct ummu_device *ummu, u32 reg) 260 { 261 switch (FIELD_GET(CAP3_STALL_MODEL_MASK, reg)) { 262 case CAP3_STALL_MODE_FORCE: 263 ummu->cap.features |= UMMU_FEAT_STALL_FORCE; 264 fallthrough; 265 case CAP3_STALL_MODE: 266 ummu->cap.features |= UMMU_FEAT_STALLS; > 267 default: 268 break; 269 } 270 } 271 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/3] Fixes and cleanup of page cache limit
by Zhang Qilong 01 Dec '25

01 Dec '25

Zhang Qilong (3): mm: Replace deferrable timer with delay timer for shrink worker mm: Move vm_cache_limit_mbytes check to page_cache_over_limit() mm: Add page cache limit check before queueing shrink worker mm/page_cache_limit.c | 26 ++++++++++---------------- 1 file changed, 10 insertions(+), 16 deletions(-) -- 2.43.0

2 4

[PATCH v3 OLK-6.6] xsched: add xsched_{set,get}attr syscall
by Liu Kai 01 Dec '25

01 Dec '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID9IFI ----------------------------------------- If CONFIG_CGROUP_XCU is not enabled, the xsched defaults to the RT scheduling class, and there is no interface available to configure the RT priority. Therefore, two new syscalls are added to set and get the configuration of the RT scheduling class. The default priority for RT is 4 (the lowest priority) in the kernel. In contrast, user-configured values work the opposity way: the smaller the value, the lower the priority. The child process inherits the priority configuration of the parent process during fork. If pid=0, it indicates that the configuration is applied to the current process. Additionally, an interface is reserved for configuring the xsched scheduling class, which will be used to support CFS in the future. Currently, these system calls are only available for ARM64 and x86_64 architectures. Fixes: 832ec54e11a0 ("xsched: Add xsched RT class") Signed-off-by: Liu Kai <liukai284(a)huawei.com> --- arch/arm/tools/syscall.tbl | 4 +- arch/powerpc/kernel/syscalls/syscall.tbl | 4 +- arch/x86/entry/syscalls/syscall_32.tbl | 4 +- arch/x86/entry/syscalls/syscall_64.tbl | 4 +- include/linux/sched.h | 8 ++ include/linux/syscalls.h | 3 + include/linux/xsched.h | 19 +--- include/linux/xsched_types.h | 27 ++++++ include/uapi/asm-generic/unistd.h | 8 +- init/init_task.c | 6 ++ kernel/fork.c | 3 + kernel/xsched/core.c | 79 +++++++++++++++ kernel/xsched/rt.c | 96 ++----------------- .../arch/powerpc/entry/syscalls/syscall.tbl | 4 +- .../arch/x86/entry/syscalls/syscall_64.tbl | 4 +- 15 files changed, 152 insertions(+), 121 deletions(-) create mode 100644 include/linux/xsched_types.h diff --git a/arch/arm/tools/syscall.tbl b/arch/arm/tools/syscall.tbl index 5127af69471c..c707bea6232b 100644 --- a/arch/arm/tools/syscall.tbl +++ b/arch/arm/tools/syscall.tbl @@ -480,5 +480,5 @@ 464 common kabi_reserved464 sys_ni_syscall 465 common kabi_reserved465 sys_ni_syscall 466 common kabi_reserved466 sys_ni_syscall -467 common kabi_reserved467 sys_ni_syscall -468 common kabi_reserved468 sys_ni_syscall +467 common xsched_setattr sys_ni_syscall +468 common xsched_getattr sys_ni_syscall diff --git a/arch/powerpc/kernel/syscalls/syscall.tbl b/arch/powerpc/kernel/syscalls/syscall.tbl index 3378482bcf6f..822e08438e2d 100644 --- a/arch/powerpc/kernel/syscalls/syscall.tbl +++ b/arch/powerpc/kernel/syscalls/syscall.tbl @@ -557,5 +557,5 @@ 464 common kabi_reserved464 sys_ni_syscall 465 common kabi_reserved465 sys_ni_syscall 466 common kabi_reserved466 sys_ni_syscall -467 common kabi_reserved467 sys_ni_syscall -468 common kabi_reserved468 sys_ni_syscall +467 common xsched_setattr sys_ni_syscall +468 common xsched_getattr sys_ni_syscall diff --git a/arch/x86/entry/syscalls/syscall_32.tbl b/arch/x86/entry/syscalls/syscall_32.tbl index e14ce1f6b1ec..d97a7da65e49 100644 --- a/arch/x86/entry/syscalls/syscall_32.tbl +++ b/arch/x86/entry/syscalls/syscall_32.tbl @@ -471,5 +471,5 @@ 464 i386 kabi_reserved464 sys_ni_syscall 465 i386 kabi_reserved465 sys_ni_syscall 466 i386 kabi_reserved466 sys_ni_syscall -467 i386 kabi_reserved467 sys_ni_syscall -468 i386 kabi_reserved468 sys_ni_syscall +467 i386 xsched_setattr sys_ni_syscall +468 i386 xsched_getattr sys_ni_syscall diff --git a/arch/x86/entry/syscalls/syscall_64.tbl b/arch/x86/entry/syscalls/syscall_64.tbl index 162517343cb1..a538ce360e7d 100644 --- a/arch/x86/entry/syscalls/syscall_64.tbl +++ b/arch/x86/entry/syscalls/syscall_64.tbl @@ -388,8 +388,8 @@ 464 common kabi_reserved464 sys_ni_syscall 465 common kabi_reserved465 sys_ni_syscall 466 common kabi_reserved466 sys_ni_syscall -467 common kabi_reserved467 sys_ni_syscall -468 common kabi_reserved468 sys_ni_syscall +467 common xsched_setattr sys_xsched_setattr +468 common xsched_getattr sys_xsched_getattr # # Due to a historical design error, certain syscalls are numbered differently diff --git a/include/linux/sched.h b/include/linux/sched.h index e0afdc2dad2c..bb23790fd2d3 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -41,6 +41,10 @@ #include <linux/thread_bits.h> #include <linux/kabi.h> +#ifdef CONFIG_XCU_SCHEDULER +#include <linux/xsched_types.h> +#endif + /* task_struct member predeclarations (sorted alphabetically): */ struct audit_context; struct bio_list; @@ -776,6 +780,10 @@ struct kmap_ctrl { struct task_struct_resvd { /* pointer back to the main task_struct */ struct task_struct *task; + +#ifdef CONFIG_XCU_SCHEDULER + struct xsched_attr xse_attr; +#endif }; struct task_struct { diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h index 119aabc72a2d..2e7b2c57c8c0 100644 --- a/include/linux/syscalls.h +++ b/include/linux/syscalls.h @@ -950,6 +950,9 @@ asmlinkage long sys_cachestat(unsigned int fd, asmlinkage long sys_map_shadow_stack(unsigned long addr, unsigned long size, unsigned int flags); asmlinkage long sys_vstream_manage(struct vstream_args __user *arg, int cmd); + +asmlinkage long sys_xsched_setattr(pid_t pid, struct xsched_attr __user *arg); +asmlinkage long sys_xsched_getattr(pid_t pid, struct xsched_attr __user *arg); /* * Architecture-specific system calls */ diff --git a/include/linux/xsched.h b/include/linux/xsched.h index 38db18c0d570..60cb43b4631f 100644 --- a/include/linux/xsched.h +++ b/include/linux/xsched.h @@ -6,6 +6,7 @@ #include <linux/kref.h> #include <linux/vstream.h> #include <linux/xcu_group.h> +#include <linux/xsched_types.h> #ifndef pr_fmt #define pr_fmt(fmt) fmt @@ -53,20 +54,6 @@ extern struct xsched_cu *xsched_cu_mgr[XSCHED_NR_CUS]; -enum xcu_sched_type { - XSCHED_TYPE_RT = 0, - XSCHED_TYPE_CFS = 1, - XSCHED_TYPE_NUM, - XSCHED_TYPE_DFLT = XSCHED_TYPE_RT -}; - -enum xse_prio { - XSE_PRIO_HIGH = 0, - XSE_PRIO_LOW = 4, - NR_XSE_PRIO, - XSE_PRIO_DFLT = XSE_PRIO_LOW -}; - extern struct xsched_class rt_xsched_class; extern struct xsched_class fair_xsched_class; @@ -406,7 +393,7 @@ static inline u64 gcd(u64 a, u64 b) } struct xsched_class { - enum xcu_sched_type class_id; + enum xcu_sched_class class_id; size_t kick_slice; struct list_head node; @@ -456,7 +443,7 @@ int xsched_init_entity(struct xsched_context *ctx, struct vstream_info *vs); int ctx_bind_to_xcu(vstream_info_t *vstream_info, struct xsched_context *ctx); int xsched_vsm_add_tail(struct vstream_info *vs, vstream_args_t *arg); struct vstream_metadata *xsched_vsm_fetch_first(struct vstream_info *vs); -int xsched_rt_prio_set(pid_t tgid, unsigned int prio); +void xsched_rt_prio_set(pid_t tgid, unsigned int prio); void enqueue_ctx(struct xsched_entity *xse, struct xsched_cu *xcu); void dequeue_ctx(struct xsched_entity *xse, struct xsched_cu *xcu); int delete_ctx(struct xsched_context *ctx); diff --git a/include/linux/xsched_types.h b/include/linux/xsched_types.h new file mode 100644 index 000000000000..f52fe32d5198 --- /dev/null +++ b/include/linux/xsched_types.h @@ -0,0 +1,27 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef _XSCHED_TYPE_H +#define _XSCHED_TYPE_H + +struct xsched_attr { + /* Scheduling class type, from enum xcu_sched_class */ + unsigned int xsched_class; + + /* RT scheduling priority, from enum xse_prio */ + unsigned int xsched_priority; +}; + +enum xcu_sched_class { + XSCHED_TYPE_RT = 0, + XSCHED_TYPE_CFS = 1, + XSCHED_TYPE_NUM, + XSCHED_TYPE_DFLT = XSCHED_TYPE_RT +}; + +enum xse_prio { + XSE_PRIO_HIGH = 0, + XSE_PRIO_LOW = 4, + NR_XSE_PRIO, + XSE_PRIO_DFLT = XSE_PRIO_LOW +}; + +#endif /* ! _XSCHED_TYPE_H */ diff --git a/include/uapi/asm-generic/unistd.h b/include/uapi/asm-generic/unistd.h index f015a3987255..154e0ecc946c 100644 --- a/include/uapi/asm-generic/unistd.h +++ b/include/uapi/asm-generic/unistd.h @@ -853,10 +853,10 @@ __SYSCALL(__NR_kabi_reserved464, sys_ni_syscall) __SYSCALL(__NR_kabi_reserved465, sys_ni_syscall) #define __NR_kabi_reserved466 466 __SYSCALL(__NR_kabi_reserved466, sys_ni_syscall) -#define __NR_kabi_reserved467 467 -__SYSCALL(__NR_kabi_reserved467, sys_ni_syscall) -#define __NR_kabi_reserved468 468 -__SYSCALL(__NR_kabi_reserved468, sys_ni_syscall) +#define __NR_xsched_setattr 467 +__SYSCALL(__NR_xsched_setattr, sys_xsched_setattr) +#define __NR_xsched_getattr 468 +__SYSCALL(__NR_xsched_getattr, sys_xsched_getattr) #undef __NR_syscalls #define __NR_syscalls 469 diff --git a/init/init_task.c b/init/init_task.c index 1adc17149558..61a6345708c8 100644 --- a/init/init_task.c +++ b/init/init_task.c @@ -14,6 +14,9 @@ #include <linux/scs.h> #include <linux/uaccess.h> +#ifdef CONFIG_XCU_SCHEDULER +#include <linux/xsched_types.h> +#endif static struct signal_struct init_signals = { .nr_threads = 1, @@ -59,6 +62,9 @@ unsigned long init_shadow_call_stack[SCS_SIZE / sizeof(long)] static struct task_struct_resvd init_task_struct_resvd = { .task = &init_task, +#ifdef CONFIG_XCU_SCHEDULER + .xse_attr = { .xsched_priority = XSE_PRIO_DFLT }, +#endif }; /* diff --git a/kernel/fork.c b/kernel/fork.c index 328bbf6a36d2..f3c663602345 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -1165,6 +1165,9 @@ static bool dup_resvd_task_struct(struct task_struct *dst, return false; dst->_resvd->task = dst; +#ifdef CONFIG_XCU_SCHEDULER + dst->_resvd->xse_attr = orig->_resvd->xse_attr; +#endif return true; } diff --git a/kernel/xsched/core.c b/kernel/xsched/core.c index 69f1a442f985..b23f2ca7820b 100644 --- a/kernel/xsched/core.c +++ b/kernel/xsched/core.c @@ -20,6 +20,7 @@ #include <linux/kthread.h> #include <linux/slab.h> #include <linux/spinlock_types.h> +#include <linux/syscalls.h> #include <linux/types.h> #include <linux/xsched.h> @@ -533,3 +534,81 @@ __init int xsched_sched_init(void) } late_initcall(xsched_sched_init); +static int xsched_setattr(struct task_struct *p, const struct xsched_attr *attr) +{ + struct xsched_attr *old_attr = &p->_resvd->xse_attr; + + if (old_attr->xsched_class == attr->xsched_class && + old_attr->xsched_priority == attr->xsched_priority) + return 0; + + old_attr->xsched_class = attr->xsched_class; + old_attr->xsched_priority = attr->xsched_priority; + xsched_rt_prio_set(p->pid, old_attr->xsched_priority); + + return 0; +} + +SYSCALL_DEFINE2(xsched_setattr, pid_t, pid, struct xsched_attr __user *, arg) +{ + struct xsched_attr kattr; + struct task_struct *p; + int rt_prio, retval; + + if (pid < 0 || !arg) + return -EINVAL; + + if (copy_from_user(&kattr, arg, sizeof(*arg))) { + XSCHED_ERR("Fail to copy_from_user @ %s\n", __func__); + return -EFAULT; + } + + rt_prio = NR_XSE_PRIO - kattr.xsched_priority; + /* Only support RT */ + if (rt_prio < XSE_PRIO_HIGH || rt_prio > XSE_PRIO_LOW || + kattr.xsched_class != XSCHED_TYPE_RT) + return -EINVAL; + + kattr.xsched_priority = rt_prio; + + rcu_read_lock(); + retval = -ESRCH; + p = pid ? find_task_by_vpid(pid) : current; + if (likely(p)) + get_task_struct(p); + rcu_read_unlock(); + + if (likely(p)) { + retval = xsched_setattr(p, &kattr); + put_task_struct(p); + } + + return retval; +} + +SYSCALL_DEFINE2(xsched_getattr, pid_t, pid, struct xsched_attr __user *, arg) +{ + struct xsched_attr kattr = { }; + struct task_struct *p; + + if (pid < 0 || !arg) + return -EINVAL; + + rcu_read_lock(); + p = pid ? find_task_by_vpid(pid) : current; + if (!p) { + rcu_read_unlock(); + return -ESRCH; + } + kattr = p->_resvd->xse_attr; + rcu_read_unlock(); + + kattr.xsched_priority = NR_XSE_PRIO - kattr.xsched_priority; + + if (copy_to_user(arg, &kattr, sizeof(kattr))) { + XSCHED_ERR("Fail to copy_to_user @ %s\n", __func__); + return -EFAULT; + } + + return 0; +} diff --git a/kernel/xsched/rt.c b/kernel/xsched/rt.c index 41b60e341679..e2ce1ebb8a7a 100644 --- a/kernel/xsched/rt.c +++ b/kernel/xsched/rt.c @@ -25,76 +25,6 @@ #define XSCHED_RT_TIMESLICE (10 * NSEC_PER_MSEC) -#define TGID_HASH_BITS 8 - -/* Mapping between tgid and context */ -struct tgid_prio { - pid_t tgid; - int32_t prio; - struct hlist_node hnode; -}; - -static DEFINE_HASHTABLE(tgid_prio_map, TGID_HASH_BITS); -static DEFINE_SPINLOCK(tgid_prio_lock); - -static int tgid_prio_insert(pid_t tgid, int32_t prio) -{ - struct tgid_prio *new_map; - unsigned int hash_key; - - if (prio >= NR_XSE_PRIO) - return -EINVAL; - - new_map = kzalloc(sizeof(struct tgid_prio), GFP_KERNEL); - if (!new_map) { - XSCHED_ERR("Fail to alloc mapping (tgid=%d) @ %s\n", - tgid, __func__); - return -ENOMEM; - } - - new_map->tgid = tgid; - new_map->prio = prio; - - hash_key = hash_32(tgid, TGID_HASH_BITS); - - spin_lock(&tgid_prio_lock); - hash_add_rcu(tgid_prio_map, &new_map->hnode, hash_key); - spin_unlock(&tgid_prio_lock); - - return 0; -} - -static struct tgid_prio *tgid_prio_find(pid_t tgid) -{ - struct tgid_prio *map = NULL; - unsigned int hash_key = hash_32(tgid, TGID_HASH_BITS); - - rcu_read_lock(); - hash_for_each_possible_rcu(tgid_prio_map, map, hnode, hash_key) { - if (map->tgid == tgid) - break; - } - rcu_read_unlock(); - return map; -} - -static void tgid_prio_delete(pid_t tgid) -{ - struct tgid_prio *map; - unsigned int hash_key = hash_32(tgid, TGID_HASH_BITS); - - spin_lock(&tgid_prio_lock); - hash_for_each_possible(tgid_prio_map, map, hnode, hash_key) { - if (map->tgid == tgid) { - hash_del_rcu(&map->hnode); - spin_unlock(&tgid_prio_lock); - kfree(map); - return; - } - } - spin_unlock(&tgid_prio_lock); -} - static inline void xse_rt_add(struct xsched_entity *xse, struct xsched_cu *xcu) { @@ -115,7 +45,7 @@ static inline void xse_rt_move_tail(struct xsched_entity *xse) /* Increase RT runqueue total and per prio nr_running stat. */ static inline void xrq_inc_nr_running(struct xsched_entity *xse, - struct xsched_cu *xcu) + struct xsched_cu *xcu) { xcu->xrq.rt.nr_running++; } @@ -143,7 +73,7 @@ static void enqueue_ctx_rt(struct xsched_entity *xse, struct xsched_cu *xcu) } static inline struct xsched_entity *xrq_next_xse(struct xsched_cu *xcu, - int prio) + int prio) { return list_first_entry(&xcu->xrq.rt.rq[prio], struct xsched_entity, rt.list_node); @@ -217,23 +147,16 @@ void rq_init_rt(struct xsched_cu *xcu) void xse_init_rt(struct xsched_entity *xse) { - struct tgid_prio *map = tgid_prio_find(xse->tgid); + struct task_struct *p; - xse->rt.prio = (map) ? map->prio : XSE_PRIO_DFLT; + p = find_task_by_vpid(xse->tgid); + xse->rt.prio = p->_resvd->xse_attr.xsched_priority; XSCHED_DEBUG("Xse init: set priority=%d.\n", xse->rt.prio); xse->rt.timeslice = XSCHED_RT_TIMESLICE; INIT_LIST_HEAD(&xse->rt.list_node); } -void xse_deinit_rt(struct xsched_entity *xse) -{ - struct tgid_prio *map = tgid_prio_find(xse->tgid); - - if (map) { - tgid_prio_delete(xse->tgid); - XSCHED_DEBUG("Map deleted: tgid=%d\n", xse->tgid); - } -} +void xse_deinit_rt(struct xsched_entity *xse) { } struct xsched_class rt_xsched_class = { .class_id = XSCHED_TYPE_RT, @@ -248,16 +171,13 @@ struct xsched_class rt_xsched_class = { .check_preempt = check_preempt_ctx_rt }; -int xsched_rt_prio_set(pid_t tgid, unsigned int prio) +void xsched_rt_prio_set(pid_t tgid, unsigned int prio) { unsigned int id; struct xsched_cu *xcu; struct xsched_context *ctx; struct xsched_entity *xse; - tgid_prio_delete(tgid); - tgid_prio_insert(tgid, prio); - for_each_active_xcu(xcu, id) { mutex_lock(&xcu->ctx_list_lock); mutex_lock(&xcu->xcu_lock); @@ -275,7 +195,5 @@ int xsched_rt_prio_set(pid_t tgid, unsigned int prio) mutex_unlock(&xcu->xcu_lock); mutex_unlock(&xcu->ctx_list_lock); } - - return 0; } diff --git a/tools/perf/arch/powerpc/entry/syscalls/syscall.tbl b/tools/perf/arch/powerpc/entry/syscalls/syscall.tbl index 4d76d8970013..8ed79b4b20e3 100644 --- a/tools/perf/arch/powerpc/entry/syscalls/syscall.tbl +++ b/tools/perf/arch/powerpc/entry/syscalls/syscall.tbl @@ -553,5 +553,5 @@ 464 common kabi_reserved464 sys_ni_syscall 465 common kabi_reserved465 sys_ni_syscall 466 common kabi_reserved466 sys_ni_syscall -467 common kabi_reserved467 sys_ni_syscall -468 common kabi_reserved468 sys_ni_syscall +467 common xsched_setattr sys_ni_syscall +468 common xsched_getattr sys_ni_syscall diff --git a/tools/perf/arch/x86/entry/syscalls/syscall_64.tbl b/tools/perf/arch/x86/entry/syscalls/syscall_64.tbl index 65004179e548..9cc0623ee8e5 100644 --- a/tools/perf/arch/x86/entry/syscalls/syscall_64.tbl +++ b/tools/perf/arch/x86/entry/syscalls/syscall_64.tbl @@ -388,8 +388,8 @@ 464 common kabi_reserved464 sys_ni_syscall 465 common kabi_reserved465 sys_ni_syscall 466 common kabi_reserved466 sys_ni_syscall -467 common kabi_reserved467 sys_ni_syscall -468 common kabi_reserved468 sys_ni_syscall +467 common xsched_setattr sys_ni_syscall +468 common xsched_getattr sys_ni_syscall # # Due to a historical design error, certain syscalls are numbered differently -- 2.34.1

2 1

[PATCH v2 0/2] syscall: Cleanup and improve syscall_get_arguments()
by Jinjie Ruan 01 Dec '25

01 Dec '25

Remove unused SYSCALL_MAX_ARGS and avoid memcpy() for syscall_get_arguments() for arm64. Jinjie Ruan (2): syscall.h: Remove unused SYSCALL_MAX_ARGS arm64: Avoid memcpy() for syscall_get_arguments() arch/arm/include/asm/syscall.h | 2 -- arch/arm64/include/asm/syscall.h | 18 ++++++++++++------ arch/xtensa/include/asm/syscall.h | 1 - 3 files changed, 12 insertions(+), 9 deletions(-) -- 2.34.1

1 2

[PATCH OLK-6.6] x86/mm: Check return value from memblock_phys_alloc_range()
by Ze Zuo 01 Dec '25

01 Dec '25

From: Philip Redkin <me(a)rarity.fan> stable inclusion from stable-v6.6.93 commit bffd5f2815c5234d609725cd0dc2f4bc5de2fc67 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICG782 CVE: CVE-2025-38071 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 631ca8909fd5c62b9fda9edda93924311a78a9c4 ] At least with CONFIG_PHYSICAL_START=0x100000, if there is < 4 MiB of contiguous free memory available at this point, the kernel will crash and burn because memblock_phys_alloc_range() returns 0 on failure, which leads memblock_phys_free() to throw the first 4 MiB of physical memory to the wolves. At a minimum it should fail gracefully with a meaningful diagnostic, but in fact everything seems to work fine without the weird reserve allocation. Signed-off-by: Philip Redkin <me(a)rarity.fan> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Cc: Dave Hansen <dave.hansen(a)linux.intel.com> Cc: Rik van Riel <riel(a)surriel.com> Cc: "H. Peter Anvin" <hpa(a)zytor.com> Link: https://lore.kernel.org/r/94b3e98f-96a7-3560-1f76-349eb95ccf7f@rarity.fan Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- arch/x86/mm/init.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c index 71d29dd7ad76..6cbb5974e4f9 100644 --- a/arch/x86/mm/init.c +++ b/arch/x86/mm/init.c @@ -644,8 +644,13 @@ static void __init memory_map_top_down(unsigned long map_start, */ addr = memblock_phys_alloc_range(PMD_SIZE, PMD_SIZE, map_start, map_end); - memblock_phys_free(addr, PMD_SIZE); - real_end = addr + PMD_SIZE; + if (!addr) { + pr_warn("Failed to release memory for alloc_low_pages()"); + real_end = max(map_start, ALIGN_DOWN(map_end, PMD_SIZE)); + } else { + memblock_phys_free(addr, PMD_SIZE); + real_end = addr + PMD_SIZE; + } /* step_size need to be small so pgt_buf from BRK could cover it */ step_size = PMD_SIZE; -- 2.33.0

2 1

[PATCH v2 OLK-6.6] xsched: add xsched_{set,get}attr syscall
by Liu Kai 01 Dec '25

01 Dec '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID9IFI ----------------------------------------- If CONFIG_XCU_CGROUP is not enabled, the xsched kernel defaults to only the RT scheduling class, and there is no interface available to configure the RT priority. Therefore, two new syscalls are added to set and get the configuration of the RT scheduling class. The default priority for RT is 4 (the lowest priority) in the kernel. In contrast, user-configured values work the opposity way: the smaller the value, the lower the priority. The child process inherits the priority configuration of the parent process during fork. If pid=0, it indicates that the configuration is applied to the current process. Additionally, an interface is reserved for configuring the xsched scheduling class, which will be used to support CFS in the future. Currently, these system calls are only available for ARM64 and x86_64 architectures. Fixes: 832ec54e11a0 ("xsched: Add xsched RT class") Signed-off-by: Liu Kai <liukai284(a)huawei.com> --- arch/arm/tools/syscall.tbl | 4 +- arch/powerpc/kernel/syscalls/syscall.tbl | 4 +- arch/x86/entry/syscalls/syscall_32.tbl | 4 +- arch/x86/entry/syscalls/syscall_64.tbl | 4 +- include/linux/sched.h | 8 ++ include/linux/syscalls.h | 3 + include/linux/xsched.h | 19 +--- include/linux/xsched_types.h | 27 ++++++ include/uapi/asm-generic/unistd.h | 8 +- init/init_task.c | 6 ++ kernel/fork.c | 3 + kernel/xsched/core.c | 74 ++++++++++++++ kernel/xsched/rt.c | 96 ++----------------- .../arch/powerpc/entry/syscalls/syscall.tbl | 4 +- .../arch/x86/entry/syscalls/syscall_64.tbl | 4 +- 15 files changed, 147 insertions(+), 121 deletions(-) create mode 100644 include/linux/xsched_types.h diff --git a/arch/arm/tools/syscall.tbl b/arch/arm/tools/syscall.tbl index 5127af69471c..c707bea6232b 100644 --- a/arch/arm/tools/syscall.tbl +++ b/arch/arm/tools/syscall.tbl @@ -480,5 +480,5 @@ 464 common kabi_reserved464 sys_ni_syscall 465 common kabi_reserved465 sys_ni_syscall 466 common kabi_reserved466 sys_ni_syscall -467 common kabi_reserved467 sys_ni_syscall -468 common kabi_reserved468 sys_ni_syscall +467 common xsched_setattr sys_ni_syscall +468 common xsched_getattr sys_ni_syscall diff --git a/arch/powerpc/kernel/syscalls/syscall.tbl b/arch/powerpc/kernel/syscalls/syscall.tbl index 3378482bcf6f..822e08438e2d 100644 --- a/arch/powerpc/kernel/syscalls/syscall.tbl +++ b/arch/powerpc/kernel/syscalls/syscall.tbl @@ -557,5 +557,5 @@ 464 common kabi_reserved464 sys_ni_syscall 465 common kabi_reserved465 sys_ni_syscall 466 common kabi_reserved466 sys_ni_syscall -467 common kabi_reserved467 sys_ni_syscall -468 common kabi_reserved468 sys_ni_syscall +467 common xsched_setattr sys_ni_syscall +468 common xsched_getattr sys_ni_syscall diff --git a/arch/x86/entry/syscalls/syscall_32.tbl b/arch/x86/entry/syscalls/syscall_32.tbl index e14ce1f6b1ec..d97a7da65e49 100644 --- a/arch/x86/entry/syscalls/syscall_32.tbl +++ b/arch/x86/entry/syscalls/syscall_32.tbl @@ -471,5 +471,5 @@ 464 i386 kabi_reserved464 sys_ni_syscall 465 i386 kabi_reserved465 sys_ni_syscall 466 i386 kabi_reserved466 sys_ni_syscall -467 i386 kabi_reserved467 sys_ni_syscall -468 i386 kabi_reserved468 sys_ni_syscall +467 i386 xsched_setattr sys_ni_syscall +468 i386 xsched_getattr sys_ni_syscall diff --git a/arch/x86/entry/syscalls/syscall_64.tbl b/arch/x86/entry/syscalls/syscall_64.tbl index 162517343cb1..a538ce360e7d 100644 --- a/arch/x86/entry/syscalls/syscall_64.tbl +++ b/arch/x86/entry/syscalls/syscall_64.tbl @@ -388,8 +388,8 @@ 464 common kabi_reserved464 sys_ni_syscall 465 common kabi_reserved465 sys_ni_syscall 466 common kabi_reserved466 sys_ni_syscall -467 common kabi_reserved467 sys_ni_syscall -468 common kabi_reserved468 sys_ni_syscall +467 common xsched_setattr sys_xsched_setattr +468 common xsched_getattr sys_xsched_getattr # # Due to a historical design error, certain syscalls are numbered differently diff --git a/include/linux/sched.h b/include/linux/sched.h index e0afdc2dad2c..bb23790fd2d3 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -41,6 +41,10 @@ #include <linux/thread_bits.h> #include <linux/kabi.h> +#ifdef CONFIG_XCU_SCHEDULER +#include <linux/xsched_types.h> +#endif + /* task_struct member predeclarations (sorted alphabetically): */ struct audit_context; struct bio_list; @@ -776,6 +780,10 @@ struct kmap_ctrl { struct task_struct_resvd { /* pointer back to the main task_struct */ struct task_struct *task; + +#ifdef CONFIG_XCU_SCHEDULER + struct xsched_attr xse_attr; +#endif }; struct task_struct { diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h index 119aabc72a2d..2e7b2c57c8c0 100644 --- a/include/linux/syscalls.h +++ b/include/linux/syscalls.h @@ -950,6 +950,9 @@ asmlinkage long sys_cachestat(unsigned int fd, asmlinkage long sys_map_shadow_stack(unsigned long addr, unsigned long size, unsigned int flags); asmlinkage long sys_vstream_manage(struct vstream_args __user *arg, int cmd); + +asmlinkage long sys_xsched_setattr(pid_t pid, struct xsched_attr __user *arg); +asmlinkage long sys_xsched_getattr(pid_t pid, struct xsched_attr __user *arg); /* * Architecture-specific system calls */ diff --git a/include/linux/xsched.h b/include/linux/xsched.h index 38db18c0d570..60cb43b4631f 100644 --- a/include/linux/xsched.h +++ b/include/linux/xsched.h @@ -6,6 +6,7 @@ #include <linux/kref.h> #include <linux/vstream.h> #include <linux/xcu_group.h> +#include <linux/xsched_types.h> #ifndef pr_fmt #define pr_fmt(fmt) fmt @@ -53,20 +54,6 @@ extern struct xsched_cu *xsched_cu_mgr[XSCHED_NR_CUS]; -enum xcu_sched_type { - XSCHED_TYPE_RT = 0, - XSCHED_TYPE_CFS = 1, - XSCHED_TYPE_NUM, - XSCHED_TYPE_DFLT = XSCHED_TYPE_RT -}; - -enum xse_prio { - XSE_PRIO_HIGH = 0, - XSE_PRIO_LOW = 4, - NR_XSE_PRIO, - XSE_PRIO_DFLT = XSE_PRIO_LOW -}; - extern struct xsched_class rt_xsched_class; extern struct xsched_class fair_xsched_class; @@ -406,7 +393,7 @@ static inline u64 gcd(u64 a, u64 b) } struct xsched_class { - enum xcu_sched_type class_id; + enum xcu_sched_class class_id; size_t kick_slice; struct list_head node; @@ -456,7 +443,7 @@ int xsched_init_entity(struct xsched_context *ctx, struct vstream_info *vs); int ctx_bind_to_xcu(vstream_info_t *vstream_info, struct xsched_context *ctx); int xsched_vsm_add_tail(struct vstream_info *vs, vstream_args_t *arg); struct vstream_metadata *xsched_vsm_fetch_first(struct vstream_info *vs); -int xsched_rt_prio_set(pid_t tgid, unsigned int prio); +void xsched_rt_prio_set(pid_t tgid, unsigned int prio); void enqueue_ctx(struct xsched_entity *xse, struct xsched_cu *xcu); void dequeue_ctx(struct xsched_entity *xse, struct xsched_cu *xcu); int delete_ctx(struct xsched_context *ctx); diff --git a/include/linux/xsched_types.h b/include/linux/xsched_types.h new file mode 100644 index 000000000000..f52fe32d5198 --- /dev/null +++ b/include/linux/xsched_types.h @@ -0,0 +1,27 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef _XSCHED_TYPE_H +#define _XSCHED_TYPE_H + +struct xsched_attr { + /* Scheduling class type, from enum xcu_sched_class */ + unsigned int xsched_class; + + /* RT scheduling priority, from enum xse_prio */ + unsigned int xsched_priority; +}; + +enum xcu_sched_class { + XSCHED_TYPE_RT = 0, + XSCHED_TYPE_CFS = 1, + XSCHED_TYPE_NUM, + XSCHED_TYPE_DFLT = XSCHED_TYPE_RT +}; + +enum xse_prio { + XSE_PRIO_HIGH = 0, + XSE_PRIO_LOW = 4, + NR_XSE_PRIO, + XSE_PRIO_DFLT = XSE_PRIO_LOW +}; + +#endif /* ! _XSCHED_TYPE_H */ diff --git a/include/uapi/asm-generic/unistd.h b/include/uapi/asm-generic/unistd.h index f015a3987255..154e0ecc946c 100644 --- a/include/uapi/asm-generic/unistd.h +++ b/include/uapi/asm-generic/unistd.h @@ -853,10 +853,10 @@ __SYSCALL(__NR_kabi_reserved464, sys_ni_syscall) __SYSCALL(__NR_kabi_reserved465, sys_ni_syscall) #define __NR_kabi_reserved466 466 __SYSCALL(__NR_kabi_reserved466, sys_ni_syscall) -#define __NR_kabi_reserved467 467 -__SYSCALL(__NR_kabi_reserved467, sys_ni_syscall) -#define __NR_kabi_reserved468 468 -__SYSCALL(__NR_kabi_reserved468, sys_ni_syscall) +#define __NR_xsched_setattr 467 +__SYSCALL(__NR_xsched_setattr, sys_xsched_setattr) +#define __NR_xsched_getattr 468 +__SYSCALL(__NR_xsched_getattr, sys_xsched_getattr) #undef __NR_syscalls #define __NR_syscalls 469 diff --git a/init/init_task.c b/init/init_task.c index 1adc17149558..61a6345708c8 100644 --- a/init/init_task.c +++ b/init/init_task.c @@ -14,6 +14,9 @@ #include <linux/scs.h> #include <linux/uaccess.h> +#ifdef CONFIG_XCU_SCHEDULER +#include <linux/xsched_types.h> +#endif static struct signal_struct init_signals = { .nr_threads = 1, @@ -59,6 +62,9 @@ unsigned long init_shadow_call_stack[SCS_SIZE / sizeof(long)] static struct task_struct_resvd init_task_struct_resvd = { .task = &init_task, +#ifdef CONFIG_XCU_SCHEDULER + .xse_attr = { .xsched_priority = XSE_PRIO_DFLT }, +#endif }; /* diff --git a/kernel/fork.c b/kernel/fork.c index 328bbf6a36d2..f3c663602345 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -1165,6 +1165,9 @@ static bool dup_resvd_task_struct(struct task_struct *dst, return false; dst->_resvd->task = dst; +#ifdef CONFIG_XCU_SCHEDULER + dst->_resvd->xse_attr = orig->_resvd->xse_attr; +#endif return true; } diff --git a/kernel/xsched/core.c b/kernel/xsched/core.c index 69f1a442f985..5638b254b9ce 100644 --- a/kernel/xsched/core.c +++ b/kernel/xsched/core.c @@ -20,6 +20,7 @@ #include <linux/kthread.h> #include <linux/slab.h> #include <linux/spinlock_types.h> +#include <linux/syscalls.h> #include <linux/types.h> #include <linux/xsched.h> @@ -533,3 +534,76 @@ __init int xsched_sched_init(void) } late_initcall(xsched_sched_init); +static int xsched_setattr(struct task_struct *p, const struct xsched_attr *attr) +{ + struct xsched_attr *old_attr = &p->_resvd->xse_attr; + + if (old_attr->xsched_class == attr->xsched_class && + old_attr->xsched_priority == attr->xsched_priority) + return 0; + + old_attr->xsched_class = attr->xsched_class; + old_attr->xsched_priority = attr->xsched_priority; + xsched_rt_prio_set(p->pid, old_attr->xsched_priority); + + return 0; +} + +SYSCALL_DEFINE2(xsched_setattr, pid_t, pid, struct xsched_attr __user *, arg) +{ + struct xsched_attr kattr; + struct task_struct *p; + int rt_prio, retval = 0; + + if (pid < 0 || !arg) + return -EINVAL; + + if (copy_from_user(&kattr, arg, sizeof(*arg))) { + XSCHED_ERR("Fail to copy_from_user @ %s\n", __func__); + return -EFAULT; + } + + rt_prio = NR_XSE_PRIO - kattr.xsched_priority; + /* Only support RT */ + if (rt_prio < XSE_PRIO_HIGH || rt_prio > XSE_PRIO_LOW || + kattr.xsched_class != XSCHED_TYPE_RT) + return -EINVAL; + + kattr.xsched_priority = rt_prio; + + rcu_read_lock(); + p = pid ? find_task_by_vpid(pid) : current; + if (likely(p)) + get_task_struct(p); + rcu_read_unlock(); + + if (likely(p)) { + retval = xsched_setattr(p, &kattr); + put_task_struct(p); + } + + return retval; +} + +SYSCALL_DEFINE2(xsched_getattr, pid_t, pid, struct xsched_attr __user *, arg) +{ + struct xsched_attr kattr = { }; + struct task_struct *p; + + if (pid < 0 || !arg) + return -EINVAL; + + rcu_read_lock(); + p = pid ? find_task_by_vpid(pid) : current; + kattr = p->_resvd->xse_attr; + rcu_read_unlock(); + + kattr.xsched_priority = NR_XSE_PRIO - kattr.xsched_priority; + + if (copy_to_user(arg, &kattr, sizeof(kattr))) { + XSCHED_ERR("Fail to copy_to_user @ %s\n", __func__); + return -EFAULT; + } + + return 0; +} diff --git a/kernel/xsched/rt.c b/kernel/xsched/rt.c index 41b60e341679..e2ce1ebb8a7a 100644 --- a/kernel/xsched/rt.c +++ b/kernel/xsched/rt.c @@ -25,76 +25,6 @@ #define XSCHED_RT_TIMESLICE (10 * NSEC_PER_MSEC) -#define TGID_HASH_BITS 8 - -/* Mapping between tgid and context */ -struct tgid_prio { - pid_t tgid; - int32_t prio; - struct hlist_node hnode; -}; - -static DEFINE_HASHTABLE(tgid_prio_map, TGID_HASH_BITS); -static DEFINE_SPINLOCK(tgid_prio_lock); - -static int tgid_prio_insert(pid_t tgid, int32_t prio) -{ - struct tgid_prio *new_map; - unsigned int hash_key; - - if (prio >= NR_XSE_PRIO) - return -EINVAL; - - new_map = kzalloc(sizeof(struct tgid_prio), GFP_KERNEL); - if (!new_map) { - XSCHED_ERR("Fail to alloc mapping (tgid=%d) @ %s\n", - tgid, __func__); - return -ENOMEM; - } - - new_map->tgid = tgid; - new_map->prio = prio; - - hash_key = hash_32(tgid, TGID_HASH_BITS); - - spin_lock(&tgid_prio_lock); - hash_add_rcu(tgid_prio_map, &new_map->hnode, hash_key); - spin_unlock(&tgid_prio_lock); - - return 0; -} - -static struct tgid_prio *tgid_prio_find(pid_t tgid) -{ - struct tgid_prio *map = NULL; - unsigned int hash_key = hash_32(tgid, TGID_HASH_BITS); - - rcu_read_lock(); - hash_for_each_possible_rcu(tgid_prio_map, map, hnode, hash_key) { - if (map->tgid == tgid) - break; - } - rcu_read_unlock(); - return map; -} - -static void tgid_prio_delete(pid_t tgid) -{ - struct tgid_prio *map; - unsigned int hash_key = hash_32(tgid, TGID_HASH_BITS); - - spin_lock(&tgid_prio_lock); - hash_for_each_possible(tgid_prio_map, map, hnode, hash_key) { - if (map->tgid == tgid) { - hash_del_rcu(&map->hnode); - spin_unlock(&tgid_prio_lock); - kfree(map); - return; - } - } - spin_unlock(&tgid_prio_lock); -} - static inline void xse_rt_add(struct xsched_entity *xse, struct xsched_cu *xcu) { @@ -115,7 +45,7 @@ static inline void xse_rt_move_tail(struct xsched_entity *xse) /* Increase RT runqueue total and per prio nr_running stat. */ static inline void xrq_inc_nr_running(struct xsched_entity *xse, - struct xsched_cu *xcu) + struct xsched_cu *xcu) { xcu->xrq.rt.nr_running++; } @@ -143,7 +73,7 @@ static void enqueue_ctx_rt(struct xsched_entity *xse, struct xsched_cu *xcu) } static inline struct xsched_entity *xrq_next_xse(struct xsched_cu *xcu, - int prio) + int prio) { return list_first_entry(&xcu->xrq.rt.rq[prio], struct xsched_entity, rt.list_node); @@ -217,23 +147,16 @@ void rq_init_rt(struct xsched_cu *xcu) void xse_init_rt(struct xsched_entity *xse) { - struct tgid_prio *map = tgid_prio_find(xse->tgid); + struct task_struct *p; - xse->rt.prio = (map) ? map->prio : XSE_PRIO_DFLT; + p = find_task_by_vpid(xse->tgid); + xse->rt.prio = p->_resvd->xse_attr.xsched_priority; XSCHED_DEBUG("Xse init: set priority=%d.\n", xse->rt.prio); xse->rt.timeslice = XSCHED_RT_TIMESLICE; INIT_LIST_HEAD(&xse->rt.list_node); } -void xse_deinit_rt(struct xsched_entity *xse) -{ - struct tgid_prio *map = tgid_prio_find(xse->tgid); - - if (map) { - tgid_prio_delete(xse->tgid); - XSCHED_DEBUG("Map deleted: tgid=%d\n", xse->tgid); - } -} +void xse_deinit_rt(struct xsched_entity *xse) { } struct xsched_class rt_xsched_class = { .class_id = XSCHED_TYPE_RT, @@ -248,16 +171,13 @@ struct xsched_class rt_xsched_class = { .check_preempt = check_preempt_ctx_rt }; -int xsched_rt_prio_set(pid_t tgid, unsigned int prio) +void xsched_rt_prio_set(pid_t tgid, unsigned int prio) { unsigned int id; struct xsched_cu *xcu; struct xsched_context *ctx; struct xsched_entity *xse; - tgid_prio_delete(tgid); - tgid_prio_insert(tgid, prio); - for_each_active_xcu(xcu, id) { mutex_lock(&xcu->ctx_list_lock); mutex_lock(&xcu->xcu_lock); @@ -275,7 +195,5 @@ int xsched_rt_prio_set(pid_t tgid, unsigned int prio) mutex_unlock(&xcu->xcu_lock); mutex_unlock(&xcu->ctx_list_lock); } - - return 0; } diff --git a/tools/perf/arch/powerpc/entry/syscalls/syscall.tbl b/tools/perf/arch/powerpc/entry/syscalls/syscall.tbl index 4d76d8970013..8ed79b4b20e3 100644 --- a/tools/perf/arch/powerpc/entry/syscalls/syscall.tbl +++ b/tools/perf/arch/powerpc/entry/syscalls/syscall.tbl @@ -553,5 +553,5 @@ 464 common kabi_reserved464 sys_ni_syscall 465 common kabi_reserved465 sys_ni_syscall 466 common kabi_reserved466 sys_ni_syscall -467 common kabi_reserved467 sys_ni_syscall -468 common kabi_reserved468 sys_ni_syscall +467 common xsched_setattr sys_ni_syscall +468 common xsched_getattr sys_ni_syscall diff --git a/tools/perf/arch/x86/entry/syscalls/syscall_64.tbl b/tools/perf/arch/x86/entry/syscalls/syscall_64.tbl index 65004179e548..9cc0623ee8e5 100644 --- a/tools/perf/arch/x86/entry/syscalls/syscall_64.tbl +++ b/tools/perf/arch/x86/entry/syscalls/syscall_64.tbl @@ -388,8 +388,8 @@ 464 common kabi_reserved464 sys_ni_syscall 465 common kabi_reserved465 sys_ni_syscall 466 common kabi_reserved466 sys_ni_syscall -467 common kabi_reserved467 sys_ni_syscall -468 common kabi_reserved468 sys_ni_syscall +467 common xsched_setattr sys_ni_syscall +468 common xsched_getattr sys_ni_syscall # # Due to a historical design error, certain syscalls are numbered differently -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] net/sched: Abort __tc_modify_qdisc if parent is a clsact/ingress qdisc
by Wang Liang 01 Dec '25

01 Dec '25

From: Victor Nogueira <victor(a)mojatatu.com> mainline inclusion from mainline-v6.18-rc6 commit e781122d76f018ad17752ab1018b3ffbf7fad84e category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID64WJ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Wang reported an illegal configuration [1] where the user attempts to add a child qdisc to the ingress qdisc as follows: tc qdisc add dev eth0 handle ffff:0 ingress tc qdisc add dev eth0 handle ffe0:0 parent ffff:a fq To solve this, we reject any configuration attempt to add a child qdisc to ingress or clsact. [1] https://lore.kernel.org/netdev/20251105022213.1981982-1-wangliang74@huawei.… Fixes: 5e50da01d0ce ("[NET_SCHED]: Fix endless loops (part 2): "simple" qdiscs") Reported-by: Wang Liang <wangliang74(a)huawei.com> Closes: https://lore.kernel.org/netdev/20251105022213.1981982-1-wangliang74@huawei.… Reviewed-by: Pedro Tammela <pctammela(a)mojatatu.ai> Acked-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Signed-off-by: Victor Nogueira <victor(a)mojatatu.com> Reviewed-by: Cong Wang <cwang(a)multikernel.io> Link: https://patch.msgid.link/20251106205621.3307639-1-victor@mojatatu.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/sched/sch_api.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c index 05bed30b0a6a..2ea9e7753cb0 100644 --- a/net/sched/sch_api.c +++ b/net/sched/sch_api.c @@ -1492,6 +1492,11 @@ static int tc_modify_qdisc(struct sk_buff *skb, struct nlmsghdr *n, NL_SET_ERR_MSG(extack, "Failed to find specified qdisc"); return -ENOENT; } + if (p->flags & TCQ_F_INGRESS) { + NL_SET_ERR_MSG(extack, + "Cannot add children to ingress/clsact qdisc"); + return -EOPNOTSUPP; + } q = qdisc_leaf(p, clid, extack); if (IS_ERR(q)) return PTR_ERR(q); -- 2.34.1

2 1

[PATCH OLK-5.10] mmc: core: use sysfs_emit() instead of sprintf()
by Cui GaoSheng 01 Dec '25

01 Dec '25

From: Sergey Shtylyov <s.shtylyov(a)omp.ru> mainline inclusion from mainline-v5.18-rc1 commit f5d8a5fe77ce933f53eb8f2e22bb7a1a2019ea11 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP448 CVE: CVE-2022-49267 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- sprintf() (still used in the MMC core for the sysfs output) is vulnerable to the buffer overflow. Use the new-fangled sysfs_emit() instead. Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool. Signed-off-by: Sergey Shtylyov <s.shtylyov(a)omp.ru> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/717729b2-d65b-c72e-9fac-471d28d00b5a@omp.ru Signed-off-by: Ulf Hansson <ulf.hansson(a)linaro.org> Conflicts: drivers/mmc/core/sd.c [commit 24b83deb29b7f ("block: move struct request to blk-mq.h") was not commit] Signed-off-by: Cui GaoSheng <cuigaosheng1(a)huawei.com> --- drivers/mmc/core/bus.c | 9 +++++---- drivers/mmc/core/bus.h | 3 ++- drivers/mmc/core/mmc.c | 16 ++++++++-------- drivers/mmc/core/sd.c | 25 ++++++++++++------------- drivers/mmc/core/sdio.c | 5 +++-- drivers/mmc/core/sdio_bus.c | 7 ++++--- 6 files changed, 34 insertions(+), 31 deletions(-) diff --git a/drivers/mmc/core/bus.c b/drivers/mmc/core/bus.c index 4383c262b3f5..ca54f1c81d1c 100644 --- a/drivers/mmc/core/bus.c +++ b/drivers/mmc/core/bus.c @@ -15,6 +15,7 @@ #include <linux/stat.h> #include <linux/of.h> #include <linux/pm_runtime.h> +#include <linux/sysfs.h> #include <linux/mmc/card.h> #include <linux/mmc/host.h> @@ -34,13 +35,13 @@ static ssize_t type_show(struct device *dev, switch (card->type) { case MMC_TYPE_MMC: - return sprintf(buf, "MMC\n"); + return sysfs_emit(buf, "MMC\n"); case MMC_TYPE_SD: - return sprintf(buf, "SD\n"); + return sysfs_emit(buf, "SD\n"); case MMC_TYPE_SDIO: - return sprintf(buf, "SDIO\n"); + return sysfs_emit(buf, "SDIO\n"); case MMC_TYPE_SD_COMBO: - return sprintf(buf, "SDcombo\n"); + return sysfs_emit(buf, "SDcombo\n"); default: return -EFAULT; } diff --git a/drivers/mmc/core/bus.h b/drivers/mmc/core/bus.h index 8105852c4b62..3996b191b68d 100644 --- a/drivers/mmc/core/bus.h +++ b/drivers/mmc/core/bus.h @@ -9,6 +9,7 @@ #define _MMC_CORE_BUS_H #include <linux/device.h> +#include <linux/sysfs.h> struct mmc_host; struct mmc_card; @@ -17,7 +18,7 @@ struct mmc_card; static ssize_t mmc_##name##_show (struct device *dev, struct device_attribute *attr, char *buf) \ { \ struct mmc_card *card = mmc_dev_to_card(dev); \ - return sprintf(buf, fmt, args); \ + return sysfs_emit(buf, fmt, args); \ } \ static DEVICE_ATTR(name, S_IRUGO, mmc_##name##_show, NULL) diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c index 2059cd226cbd..81abbc212ea5 100644 --- a/drivers/mmc/core/mmc.c +++ b/drivers/mmc/core/mmc.c @@ -12,6 +12,7 @@ #include <linux/slab.h> #include <linux/stat.h> #include <linux/pm_runtime.h> +#include <linux/sysfs.h> #include <linux/mmc/host.h> #include <linux/mmc/card.h> @@ -809,12 +810,11 @@ static ssize_t mmc_fwrev_show(struct device *dev, { struct mmc_card *card = mmc_dev_to_card(dev); - if (card->ext_csd.rev < 7) { - return sprintf(buf, "0x%x\n", card->cid.fwrev); - } else { - return sprintf(buf, "0x%*phN\n", MMC_FIRMWARE_LEN, - card->ext_csd.fwrev); - } + if (card->ext_csd.rev < 7) + return sysfs_emit(buf, "0x%x\n", card->cid.fwrev); + else + return sysfs_emit(buf, "0x%*phN\n", MMC_FIRMWARE_LEN, + card->ext_csd.fwrev); } static DEVICE_ATTR(fwrev, S_IRUGO, mmc_fwrev_show, NULL); @@ -827,10 +827,10 @@ static ssize_t mmc_dsr_show(struct device *dev, struct mmc_host *host = card->host; if (card->csd.dsr_imp && host->dsr_req) - return sprintf(buf, "0x%x\n", host->dsr); + return sysfs_emit(buf, "0x%x\n", host->dsr); else /* return default DSR value */ - return sprintf(buf, "0x%x\n", 0x404); + return sysfs_emit(buf, "0x%x\n", 0x404); } static DEVICE_ATTR(dsr, S_IRUGO, mmc_dsr_show, NULL); diff --git a/drivers/mmc/core/sd.c b/drivers/mmc/core/sd.c index 868b121ce4f3..f0d65cab58c6 100644 --- a/drivers/mmc/core/sd.c +++ b/drivers/mmc/core/sd.c @@ -12,6 +12,7 @@ #include <linux/slab.h> #include <linux/stat.h> #include <linux/pm_runtime.h> +#include <linux/sysfs.h> #include <linux/mmc/host.h> #include <linux/mmc/card.h> @@ -697,18 +698,16 @@ MMC_DEV_ATTR(ocr, "0x%08x\n", card->ocr); MMC_DEV_ATTR(rca, "0x%04x\n", card->rca); -static ssize_t mmc_dsr_show(struct device *dev, - struct device_attribute *attr, - char *buf) +static ssize_t mmc_dsr_show(struct device *dev, struct device_attribute *attr, + char *buf) { - struct mmc_card *card = mmc_dev_to_card(dev); - struct mmc_host *host = card->host; - - if (card->csd.dsr_imp && host->dsr_req) - return sprintf(buf, "0x%x\n", host->dsr); - else - /* return default DSR value */ - return sprintf(buf, "0x%x\n", 0x404); + struct mmc_card *card = mmc_dev_to_card(dev); + struct mmc_host *host = card->host; + + if (card->csd.dsr_imp && host->dsr_req) + return sysfs_emit(buf, "0x%x\n", host->dsr); + /* return default DSR value */ + return sysfs_emit(buf, "0x%x\n", 0x404); } static DEVICE_ATTR(dsr, S_IRUGO, mmc_dsr_show, NULL); @@ -724,9 +723,9 @@ static ssize_t info##num##_show(struct device *dev, struct device_attribute *att \ if (num > card->num_info) \ return -ENODATA; \ - if (!card->info[num-1][0]) \ + if (!card->info[num - 1][0]) \ return 0; \ - return sprintf(buf, "%s\n", card->info[num-1]); \ + return sysfs_emit(buf, "%s\n", card->info[num - 1]); \ } \ static DEVICE_ATTR_RO(info##num) diff --git a/drivers/mmc/core/sdio.c b/drivers/mmc/core/sdio.c index 85c2947ed45e..0088ff6381b7 100644 --- a/drivers/mmc/core/sdio.c +++ b/drivers/mmc/core/sdio.c @@ -7,6 +7,7 @@ #include <linux/err.h> #include <linux/pm_runtime.h> +#include <linux/sysfs.h> #include <linux/mmc/host.h> #include <linux/mmc/card.h> @@ -40,9 +41,9 @@ static ssize_t info##num##_show(struct device *dev, struct device_attribute *att \ if (num > card->num_info) \ return -ENODATA; \ - if (!card->info[num-1][0]) \ + if (!card->info[num - 1][0]) \ return 0; \ - return sprintf(buf, "%s\n", card->info[num-1]); \ + return sysfs_emit(buf, "%s\n", card->info[num - 1]); \ } \ static DEVICE_ATTR_RO(info##num) diff --git a/drivers/mmc/core/sdio_bus.c b/drivers/mmc/core/sdio_bus.c index 89dd49260080..74670db18b0d 100644 --- a/drivers/mmc/core/sdio_bus.c +++ b/drivers/mmc/core/sdio_bus.c @@ -14,6 +14,7 @@ #include <linux/pm_runtime.h> #include <linux/pm_domain.h> #include <linux/acpi.h> +#include <linux/sysfs.h> #include <linux/mmc/card.h> #include <linux/mmc/host.h> @@ -35,7 +36,7 @@ field##_show(struct device *dev, struct device_attribute *attr, char *buf) \ struct sdio_func *func; \ \ func = dev_to_sdio_func (dev); \ - return sprintf(buf, format_string, args); \ + return sysfs_emit(buf, format_string, args); \ } \ static DEVICE_ATTR_RO(field) @@ -52,9 +53,9 @@ static ssize_t info##num##_show(struct device *dev, struct device_attribute *att \ if (num > func->num_info) \ return -ENODATA; \ - if (!func->info[num-1][0]) \ + if (!func->info[num - 1][0]) \ return 0; \ - return sprintf(buf, "%s\n", func->info[num-1]); \ + return sysfs_emit(buf, "%s\n", func->info[num - 1]); \ } \ static DEVICE_ATTR_RO(info##num) -- 2.34.1

2 1

[PATCH OLK-5.10 00/10] libsas bugfix for OLK-5.10
by Li Lingfeng 01 Dec '25

01 Dec '25

Jason Yan (7): scsi: libsas: reset the negotiated_linkrate when phy is down scsi: libsas: optimize the debug print of the revalidate process scsi: libsas: split the replacement of sas disks in two steps scsi: libsas: check if the same device when flutter scsi: libsas: reset the phy address if discover failed scsi: libsas: fix issue of swapping two sas disks scsi: libsas: do not add end deivces to wide port Luo Jiaxing (1): scsi: libsas: move abnormal scenario handle of flutter before linkrate change check Xiang Chen (2): scsi: libsas: recover attached_sas_addr and phy_change_count after update empty PHY info scsi: libsas: delete sas port out of the disco mutex drivers/ata/libata-core.c | 3 +- drivers/scsi/libsas/sas_ata.c | 18 ++ drivers/scsi/libsas/sas_discover.c | 27 ++- drivers/scsi/libsas/sas_expander.c | 293 ++++++++++++++++++++++------- drivers/scsi/libsas/sas_internal.h | 6 + include/linux/libata.h | 2 + include/scsi/libsas.h | 6 +- 7 files changed, 277 insertions(+), 78 deletions(-) -- 2.46.1

2 11