- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] net/mlx5e: Move representor vnic reporter to eswitch devlink port
by Cai Xinchen 15 Oct '26

15 Oct '26

From: Carolina Jubran <cjubran(a)nvidia.com> mainline inclusion from mainline-v7.3-rc3 commit 7f26a5e8040b4957ef4dbdfcde6cc7ba2db53937 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20184 CVE: CVE-2026-97962 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- The representor vnic devlink health reporter is created and destroyed along the representor netdev (un)load path, which is not serialized by the devlink instance lock. Destroying the reporter from there triggers a devl_assert_locked() splat on driver unbind: WARNING: net/devlink/core.c:259 at devl_assert_locked+0x54/0x70, CPU#2: bash/3758 Modules linked in: mlx5_vdpa vringh vdpa mlx5_ib mlx5_fwctl mlx5_core ... CPU: 2 UID: 0 PID: 3758 Comm: bash Tainted: G W 6.19.0+ #1 PREEMPT Tainted: [W]=WARN Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), ... RIP: 0010:devl_assert_locked+0x54/0x70 Call Trace: <TASK> devl_health_reporter_destroy+0x3a/0x1b0 mlx5e_vport_rep_unload+0x12d/0x2b0 [mlx5_core] mlx5_eswitch_unregister_vport_reps+0x1b8/0x220 [mlx5_core] ? __esw_offloads_unload_rep+0x190/0x190 [mlx5_core] ? kernfs_remove_by_name_ns+0xc3/0xf0 device_release_driver_internal+0x3b2/0x560 unbind_store+0xce/0xf0 Move the reporter's lifecycle to the eswitch devlink port (un)register paths, which are already serialized by the devlink instance lock, and store the handle on mlx5_devlink_port. Use the port's mlx5_vport as the reporter priv since the diagnose callback only needs a device handle and a vport number, and mlx5_vport carries both and is initialized before any representor driver probes. Fixes: cf14af140a5a ("net/mlx5e: Add vnic devlink health reporter to representors") Signed-off-by: Carolina Jubran <cjubran(a)nvidia.com> Reviewed-by: Cosmin Ratiu <cratiu(a)nvidia.com> Signed-off-by: Tariq Toukan <tariqt(a)nvidia.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://patch.msgid.link/20260906090700.3761260-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: drivers/net/ethernet/mellanox/mlx5/core/en_rep.c drivers/net/ethernet/mellanox/mlx5/core/esw/devlink_port.c [Commit 7f26a5e8040b4 built on newer mainline context not present in this tree: devl_port_health_reporter_create() still takes a graceful_period argument in 6.6, so pass 0 like the old en_rep.c code did, and the mlx5_esw_devlink_port_res_register/unregister() calls in the upstream context do not exist here, so drop them; the local "devlink.h" include is not needed either.] Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- .../net/ethernet/mellanox/mlx5/core/en_rep.c | 51 +------------------ .../net/ethernet/mellanox/mlx5/core/en_rep.h | 1 - .../mellanox/mlx5/core/esw/devlink_port.c | 36 +++++++++++++ .../net/ethernet/mellanox/mlx5/core/eswitch.h | 1 + 4 files changed, 38 insertions(+), 51 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c index ce2151d98af9..71b7aff78ccd 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c @@ -54,7 +54,6 @@ #include "lib/vxlan.h" #define CREATE_TRACE_POINTS #include "diag/en_rep_tracepoint.h" -#include "diag/reporter_vnic.h" #include "en_accel/ipsec.h" #include "en/tc/int_port.h" #include "en/ptp.h" @@ -1364,50 +1363,6 @@ static unsigned int mlx5e_ul_rep_stats_grps_num(struct mlx5e_priv *priv) return ARRAY_SIZE(mlx5e_ul_rep_stats_grps); } -static int -mlx5e_rep_vnic_reporter_diagnose(struct devlink_health_reporter *reporter, - struct devlink_fmsg *fmsg, - struct netlink_ext_ack *extack) -{ - struct mlx5e_rep_priv *rpriv = devlink_health_reporter_priv(reporter); - struct mlx5_eswitch_rep *rep = rpriv->rep; - - return mlx5_reporter_vnic_diagnose_counters(rep->esw->dev, fmsg, - rep->vport, true); -} - -static const struct devlink_health_reporter_ops mlx5_rep_vnic_reporter_ops = { - .name = "vnic", - .diagnose = mlx5e_rep_vnic_reporter_diagnose, -}; - -static void mlx5e_rep_vnic_reporter_create(struct mlx5e_priv *priv, - struct devlink_port *dl_port) -{ - struct mlx5e_rep_priv *rpriv = priv->ppriv; - struct devlink_health_reporter *reporter; - - reporter = devl_port_health_reporter_create(dl_port, - &mlx5_rep_vnic_reporter_ops, - 0, rpriv); - if (IS_ERR(reporter)) { - mlx5_core_err(priv->mdev, - "Failed to create representor vnic reporter, err = %ld\n", - PTR_ERR(reporter)); - return; - } - - rpriv->rep_vnic_reporter = reporter; -} - -static void mlx5e_rep_vnic_reporter_destroy(struct mlx5e_priv *priv) -{ - struct mlx5e_rep_priv *rpriv = priv->ppriv; - - if (!IS_ERR_OR_NULL(rpriv->rep_vnic_reporter)) - devl_health_reporter_destroy(rpriv->rep_vnic_reporter); -} - static const struct mlx5e_profile mlx5e_rep_profile = { .init = mlx5e_init_rep, .cleanup = mlx5e_cleanup_rep, @@ -1516,10 +1471,8 @@ mlx5e_vport_vf_rep_load(struct mlx5_core_dev *dev, struct mlx5_eswitch_rep *rep) dl_port = mlx5_esw_offloads_devlink_port(dev->priv.eswitch, rpriv->rep->vport); - if (!IS_ERR(dl_port)) { + if (!IS_ERR(dl_port)) SET_NETDEV_DEVLINK_PORT(netdev, dl_port); - mlx5e_rep_vnic_reporter_create(priv, dl_port); - } err = register_netdev(netdev); if (err) { @@ -1532,7 +1485,6 @@ mlx5e_vport_vf_rep_load(struct mlx5_core_dev *dev, struct mlx5_eswitch_rep *rep) return 0; err_detach_netdev: - mlx5e_rep_vnic_reporter_destroy(priv); mlx5e_detach_netdev(netdev_priv(netdev)); err_cleanup_profile: priv->profile->cleanup(priv); @@ -1590,7 +1542,6 @@ mlx5e_vport_rep_unload(struct mlx5_eswitch_rep *rep) } unregister_netdev(netdev); - mlx5e_rep_vnic_reporter_destroy(priv); mlx5e_detach_netdev(priv); priv->profile->cleanup(priv); mlx5e_destroy_netdev(netdev); diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.h b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.h index 70640fa1ad7b..bcd7b4e814d0 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.h +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.h @@ -118,7 +118,6 @@ struct mlx5e_rep_priv { struct rtnl_link_stats64 prev_vf_vport_stats; struct mlx5_flow_handle *send_to_vport_meta_rule; struct rhashtable tc_ht; - struct devlink_health_reporter *rep_vnic_reporter; }; static inline diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/devlink_port.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/devlink_port.c index 91319b5acd3d..4c4cdd62f5dc 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/esw/devlink_port.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/devlink_port.c @@ -3,6 +3,26 @@ #include <linux/mlx5/driver.h> #include "eswitch.h" +#include "diag/reporter_vnic.h" + +static int +mlx5_esw_rep_vnic_reporter_diagnose(struct devlink_health_reporter *reporter, + struct devlink_fmsg *fmsg, + struct netlink_ext_ack *extack) +{ + struct mlx5_vport *vport = devlink_health_reporter_priv(reporter); + + mlx5_reporter_vnic_diagnose_counters(vport->dev, fmsg, vport->vport, + true); + + return 0; +} + +static const +struct devlink_health_reporter_ops mlx5_esw_rep_vnic_reporter_ops = { + .name = "vnic", + .diagnose = mlx5_esw_rep_vnic_reporter_diagnose, +}; static void mlx5_esw_get_port_parent_id(struct mlx5_core_dev *dev, struct netdev_phys_item_id *ppid) @@ -149,6 +169,7 @@ static const struct devlink_port_ops mlx5_esw_dl_sf_port_ops = { int mlx5_esw_offloads_devlink_port_register(struct mlx5_eswitch *esw, struct mlx5_vport *vport) { + struct devlink_health_reporter *reporter; struct mlx5_core_dev *dev = esw->dev; const struct devlink_port_ops *ops; struct mlx5_devlink_port *dl_port; @@ -178,6 +199,16 @@ int mlx5_esw_offloads_devlink_port_register(struct mlx5_eswitch *esw, struct mlx if (err) goto rate_err; + reporter = devl_port_health_reporter_create( + &dl_port->dl_port, &mlx5_esw_rep_vnic_reporter_ops, + 0, vport); + if (IS_ERR(reporter)) + mlx5_core_err(dev, + "Failed to create vnic health reporter for vport %d: %pe\n", + vport_num, reporter); + else + dl_port->vnic_reporter = reporter; + return 0; rate_err: @@ -193,6 +224,11 @@ void mlx5_esw_offloads_devlink_port_unregister(struct mlx5_eswitch *esw, struct return; dl_port = vport->dl_port; + if (dl_port->vnic_reporter) { + devl_health_reporter_destroy(dl_port->vnic_reporter); + dl_port->vnic_reporter = NULL; + } + mlx5_esw_qos_vport_update_group(esw, vport, NULL, NULL); devl_rate_leaf_destroy(&dl_port->dl_port); diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h index d5ebd4f01103..a47692141f8f 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h +++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h @@ -179,6 +179,7 @@ struct mlx5_vport; struct mlx5_devlink_port { struct devlink_port dl_port; struct mlx5_vport *vport; + struct devlink_health_reporter *vnic_reporter; }; static inline void mlx5_devlink_port_init(struct mlx5_devlink_port *dl_port, -- 2.18.0.huawei.25

2 1

[PATCH OLK-6.6] nfsd: split nfsd4_copy into transient and durable async copy objects
by Lu Jialin 15 Oct '26

15 Oct '26

From: Jeff Layton <jlayton(a)kernel.org> mainline inclusion from mainline-v7.3-rc1 commit f307b4f7ed174a3252d2f292904fd276c78c77de category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18939 CVE: CVE-2026-89676 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- struct nfsd4_copy served two roles: as &u->copy it is a transient per-COMPOUND argument in the request buffer; as the heap async_copy it is a durable object (worker kthread, reaper linkage, CB_OFFLOAD callback, IDR stateid) that outlives the COMPOUND, with dup_copy_fields() shuttling state between them. That dual identity was the root of the recent lifetime bugs. Introduce struct nfsd4_async_copy for the durable object. It embeds a struct nfsd4_copy (cp_copy) for the operation parameters/result and adds the durable-only fields: async_copies linkage, task_struct, refcount, reaper TTL, copy stateid, and CB_OFFLOAD callback. The durable object therefore never points into the request buffer. cp_clp stays in nfsd4_copy -- it is a request property read by the sync-copy tracepoints on the transient object. Mechanical split, no intended behavioral change; a step toward folding the copy stateids into the common nfs4_stid infrastructure. Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Jeff Layton <jlayton(a)kernel.org> Link: https://patch.msgid.link/20260710-nfsd-testing-v3-8-a0ff7db6aa3e@kernel.org Signed-off-by: Chuck Lever <cel(a)kernel.org> Conflicts: fs/nfsd/nfs4proc.c [OLK-6.6 is a v6.6-era baseline that lacks the nfsd async-copy prerequisites present in the mainline base (v7.3-rc1): there is no nfsd4_has_active_async_copies(), nfsd4_async_copy_reaper() or nfsd4_cancel_copy_by_sb() to repoint and no cp_ttl reaper, so those hunks do not apply; nfs4_put_copy()/nfsd4_stop_copy()/ nfsd4_unhash_copy() keep OLK-6.6's earlier forms (no task_struct pinning in nfs4_put_copy(), plain cp_clp store, no CB_ERROR/COMPLETED handling) with only the type and cp_copy field paths adjusted; cleanup_async_copy() additionally keeps OLK-6.6's 'if (cp_copy.cp_clp) list_del' block] fs/nfsd/nfs4state.c [nfs4_init_copy_state()/nfs4_free_copy_state() repointed to struct nfsd4_async_copy; nfs4_init_cp_state() keeps the 3-argument form used by OLK-6.6 (mainline's base added a struct nfs4_stid *p_stid param)] fs/nfsd/state.h [forward declaration added for struct nfsd4_async_copy and the two nfs4_*_copy_state() prototypes repointed to it] fs/nfsd/xdr4.h [OLK-6.6's struct nfsd4_copy has no cp_cb_offload, cp_ttl or attr_update (mainline added them in earlier patches), so only copies/copy_task/refcount/cp_stateid move into the new struct nfsd4_async_copy; OLK-6.6 still heap-allocates the CB_OFFLOAD with kzalloc() and uses nfsd4_send_cb_offload(copy, nfserr), so cp_cb_offload is not embedded and nfsd4_cb_offload_release() needs no change] Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- fs/nfsd/nfs4proc.c | 89 ++++++++++++++++++++++++--------------------- fs/nfsd/nfs4state.c | 6 +-- fs/nfsd/state.h | 5 ++- fs/nfsd/xdr4.h | 23 +++++++++--- 4 files changed, 70 insertions(+), 53 deletions(-) diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c index c74aedc1d2c6..ae3ad8afaffd 100644 --- a/fs/nfsd/nfs4proc.c +++ b/fs/nfsd/nfs4proc.c @@ -1274,32 +1274,32 @@ nfsd4_clone(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, return status; } -static void nfs4_put_copy(struct nfsd4_copy *copy) +static void nfs4_put_copy(struct nfsd4_async_copy *copy) { if (!refcount_dec_and_test(&copy->refcount)) return; - atomic_dec(&copy->cp_nn->pending_async_copies); - kfree(copy->cp_src); + atomic_dec(&copy->cp_copy.cp_nn->pending_async_copies); + kfree(copy->cp_copy.cp_src); kfree(copy); } -static void nfsd4_stop_copy(struct nfsd4_copy *copy) +static void nfsd4_stop_copy(struct nfsd4_async_copy *copy) { - if (!test_and_set_bit(NFSD4_COPY_F_STOPPED, &copy->cp_flags)) + if (!test_and_set_bit(NFSD4_COPY_F_STOPPED, &copy->cp_copy.cp_flags)) kthread_stop(copy->copy_task); nfs4_put_copy(copy); } -static struct nfsd4_copy *nfsd4_unhash_copy(struct nfs4_client *clp) +static struct nfsd4_async_copy *nfsd4_unhash_copy(struct nfs4_client *clp) { - struct nfsd4_copy *copy = NULL; + struct nfsd4_async_copy *copy = NULL; spin_lock(&clp->async_lock); if (!list_empty(&clp->async_copies)) { - copy = list_first_entry(&clp->async_copies, struct nfsd4_copy, - copies); + copy = list_first_entry(&clp->async_copies, + struct nfsd4_async_copy, copies); refcount_inc(&copy->refcount); - copy->cp_clp = NULL; + copy->cp_copy.cp_clp = NULL; if (!list_empty(&copy->copies)) list_del_init(&copy->copies); } @@ -1309,7 +1309,7 @@ static struct nfsd4_copy *nfsd4_unhash_copy(struct nfs4_client *clp) void nfsd4_shutdown_copy(struct nfs4_client *clp) { - struct nfsd4_copy *copy; + struct nfsd4_async_copy *copy; while ((copy = nfsd4_unhash_copy(clp)) != NULL) nfsd4_stop_copy(copy); @@ -1702,7 +1702,6 @@ static void dup_copy_fields(struct nfsd4_copy *src, struct nfsd4_copy *dst) if (!nfsd4_ssc_is_inter(src)) dst->nf_src = nfsd_file_get(src->nf_src); - memcpy(&dst->cp_stateid, &src->cp_stateid, sizeof(src->cp_stateid)); memcpy(dst->cp_src, src->cp_src, sizeof(struct nl4_server)); memcpy(&dst->stateid, &src->stateid, sizeof(src->stateid)); memcpy(&dst->c_fh, &src->c_fh, sizeof(src->c_fh)); @@ -1717,20 +1716,20 @@ static void release_copy_files(struct nfsd4_copy *copy) nfsd_file_put(copy->nf_dst); } -static void cleanup_async_copy(struct nfsd4_copy *copy) +static void cleanup_async_copy(struct nfsd4_async_copy *copy) { nfs4_free_copy_state(copy); - release_copy_files(copy); - if (copy->cp_clp) { - spin_lock(&copy->cp_clp->async_lock); + release_copy_files(&copy->cp_copy); + if (copy->cp_copy.cp_clp) { + spin_lock(&copy->cp_copy.cp_clp->async_lock); if (!list_empty(&copy->copies)) list_del_init(&copy->copies); - spin_unlock(&copy->cp_clp->async_lock); + spin_unlock(&copy->cp_copy.cp_clp->async_lock); } nfs4_put_copy(copy); } -static void nfsd4_send_cb_offload(struct nfsd4_copy *copy, __be32 nfserr) +static void nfsd4_send_cb_offload(struct nfsd4_async_copy *copy, __be32 nfserr) { struct nfsd4_cb_offload *cbo; @@ -1738,14 +1737,14 @@ static void nfsd4_send_cb_offload(struct nfsd4_copy *copy, __be32 nfserr) if (!cbo) return; - memcpy(&cbo->co_res, &copy->cp_res, sizeof(copy->cp_res)); - memcpy(&cbo->co_fh, &copy->fh, sizeof(copy->fh)); + memcpy(&cbo->co_res, &copy->cp_copy.cp_res, sizeof(copy->cp_copy.cp_res)); + memcpy(&cbo->co_fh, &copy->cp_copy.fh, sizeof(copy->cp_copy.fh)); cbo->co_nfserr = nfserr; - nfsd4_init_cb(&cbo->co_cb, copy->cp_clp, &nfsd4_cb_offload_ops, + nfsd4_init_cb(&cbo->co_cb, copy->cp_copy.cp_clp, &nfsd4_cb_offload_ops, NFSPROC4_CLNT_CB_OFFLOAD); - trace_nfsd_cb_offload(copy->cp_clp, &cbo->co_res.cb_stateid, - &cbo->co_fh, copy->cp_count, nfserr); + trace_nfsd_cb_offload(copy->cp_copy.cp_clp, &cbo->co_res.cb_stateid, + &cbo->co_fh, copy->cp_copy.cp_count, nfserr); nfsd4_run_cb(&cbo->co_cb); } @@ -1758,7 +1757,8 @@ static void nfsd4_send_cb_offload(struct nfsd4_copy *copy, __be32 nfserr) */ static int nfsd4_do_async_copy(void *data) { - struct nfsd4_copy *copy = (struct nfsd4_copy *)data; + struct nfsd4_async_copy *async = data; + struct nfsd4_copy *copy = &async->cp_copy; __be32 nfserr; if (nfsd4_ssc_is_inter(copy)) { @@ -1786,8 +1786,8 @@ static int nfsd4_do_async_copy(void *data) } do_callback: - nfsd4_send_cb_offload(copy, nfserr); - cleanup_async_copy(copy); + nfsd4_send_cb_offload(async, nfserr); + cleanup_async_copy(async); return 0; } @@ -1796,7 +1796,7 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, union nfsd4_op_u *u) { struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id); - struct nfsd4_copy *async_copy = NULL; + struct nfsd4_async_copy *async_copy = NULL; struct nfsd4_copy *copy = &u->copy; struct nfsd42_write_res *result; __be32 status; @@ -1822,33 +1822,38 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, memcpy(&copy->fh, &cstate->current_fh.fh_handle, sizeof(struct knfsd_fh)); if (nfsd4_copy_is_async(copy)) { - async_copy = kzalloc(sizeof(struct nfsd4_copy), GFP_KERNEL); + async_copy = kzalloc(sizeof(struct nfsd4_async_copy), GFP_KERNEL); if (!async_copy) goto out_err; - async_copy->cp_nn = nn; + async_copy->cp_copy.cp_nn = nn; INIT_LIST_HEAD(&async_copy->copies); refcount_set(&async_copy->refcount, 1); /* Arbitrary cap on number of pending async copy operations */ if (atomic_inc_return(&nn->pending_async_copies) > (int)rqstp->rq_pool->sp_nrthreads) goto out_err; - async_copy->cp_src = kmalloc(sizeof(*async_copy->cp_src), GFP_KERNEL); - if (!async_copy->cp_src) + async_copy->cp_copy.cp_src = + kmalloc(sizeof(*async_copy->cp_copy.cp_src), GFP_KERNEL); + if (!async_copy->cp_copy.cp_src) goto out_err; - dup_copy_fields(copy, async_copy); if (!nfs4_init_copy_state(nn, async_copy)) goto out_err; memcpy(&result->cb_stateid, &async_copy->cp_stateid.cs_stid, sizeof(result->cb_stateid)); + /* + * dup after writing cb_stateid; duplicating first would leave + * the callback stateid zeroed. + */ + dup_copy_fields(copy, &async_copy->cp_copy); async_copy->copy_task = kthread_create(nfsd4_do_async_copy, async_copy, "%s", "copy thread"); if (IS_ERR(async_copy->copy_task)) goto out_err; - spin_lock(&async_copy->cp_clp->async_lock); + spin_lock(&async_copy->cp_copy.cp_clp->async_lock); list_add(&async_copy->copies, - &async_copy->cp_clp->async_copies); - spin_unlock(&async_copy->cp_clp->async_lock); + &async_copy->cp_copy.cp_clp->async_copies); + spin_unlock(&async_copy->cp_copy.cp_clp->async_lock); wake_up_process(async_copy->copy_task); status = nfs_ok; } else { @@ -1873,10 +1878,10 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, goto out; } -static struct nfsd4_copy * +static struct nfsd4_async_copy * find_async_copy_locked(struct nfs4_client *clp, stateid_t *stateid) { - struct nfsd4_copy *copy; + struct nfsd4_async_copy *copy; lockdep_assert_held(&clp->async_lock); @@ -1888,10 +1893,10 @@ find_async_copy_locked(struct nfs4_client *clp, stateid_t *stateid) return NULL; } -static struct nfsd4_copy * +static struct nfsd4_async_copy * find_async_copy(struct nfs4_client *clp, stateid_t *stateid) { - struct nfsd4_copy *copy; + struct nfsd4_async_copy *copy; spin_lock(&clp->async_lock); copy = find_async_copy_locked(clp, stateid); @@ -1907,7 +1912,7 @@ nfsd4_offload_cancel(struct svc_rqst *rqstp, union nfsd4_op_u *u) { struct nfsd4_offload_status *os = &u->offload_status; - struct nfsd4_copy *copy; + struct nfsd4_async_copy *copy; struct nfs4_client *clp = cstate->clp; copy = find_async_copy(clp, &os->stateid); @@ -1995,13 +2000,13 @@ nfsd4_offload_status(struct svc_rqst *rqstp, { struct nfsd4_offload_status *os = &u->offload_status; __be32 status = nfs_ok; - struct nfsd4_copy *copy; + struct nfsd4_async_copy *copy; struct nfs4_client *clp = cstate->clp; spin_lock(&clp->async_lock); copy = find_async_copy_locked(clp, &os->stateid); if (copy) - os->count = copy->cp_res.wr_bytes_written; + os->count = copy->cp_copy.cp_res.wr_bytes_written; else status = nfserr_bad_stateid; spin_unlock(&clp->async_lock); diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c index 5140197771ad..0d62c65ae4d4 100644 --- a/fs/nfsd/nfs4state.c +++ b/fs/nfsd/nfs4state.c @@ -1034,7 +1034,7 @@ static int nfs4_init_cp_state(struct nfsd_net *nn, copy_stateid_t *stid, return 1; } -int nfs4_init_copy_state(struct nfsd_net *nn, struct nfsd4_copy *copy) +int nfs4_init_copy_state(struct nfsd_net *nn, struct nfsd4_async_copy *copy) { return nfs4_init_cp_state(nn, &copy->cp_stateid, NFS4_COPY_STID); } @@ -1068,13 +1068,13 @@ struct nfs4_cpntf_state *nfs4_alloc_init_cpntf_state(struct nfsd_net *nn, return NULL; } -void nfs4_free_copy_state(struct nfsd4_copy *copy) +void nfs4_free_copy_state(struct nfsd4_async_copy *copy) { struct nfsd_net *nn; if (copy->cp_stateid.cs_type != NFS4_COPY_STID) return; - nn = net_generic(copy->cp_clp->net, nfsd_net_id); + nn = net_generic(copy->cp_copy.cp_clp->net, nfsd_net_id); spin_lock(&nn->s2s_cp_lock); idr_remove(&nn->s2s_cp_stateids, copy->cp_stateid.cs_stid.si_opaque.so_id); diff --git a/fs/nfsd/state.h b/fs/nfsd/state.h index 4dd8ade17446..d62faf4f183a 100644 --- a/fs/nfsd/state.h +++ b/fs/nfsd/state.h @@ -676,6 +676,7 @@ struct nfsd4_blocked_lock { struct nfsd4_compound_state; struct nfsd_net; struct nfsd4_copy; +struct nfsd4_async_copy; extern __be32 nfs4_preprocess_stateid_op(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, struct svc_fh *fhp, @@ -686,8 +687,8 @@ __be32 nfsd4_lookup_stateid(struct nfsd4_compound_state *cstate, struct nfs4_stid **s, struct nfsd_net *nn); struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl, struct kmem_cache *slab, void (*sc_free)(struct nfs4_stid *)); -int nfs4_init_copy_state(struct nfsd_net *nn, struct nfsd4_copy *copy); -void nfs4_free_copy_state(struct nfsd4_copy *copy); +int nfs4_init_copy_state(struct nfsd_net *nn, struct nfsd4_async_copy *copy); +void nfs4_free_copy_state(struct nfsd4_async_copy *copy); struct nfs4_cpntf_state *nfs4_alloc_init_cpntf_state(struct nfsd_net *nn, struct nfs4_stid *p_stid); void nfs4_unhash_stid(struct nfs4_stid *s); diff --git a/fs/nfsd/xdr4.h b/fs/nfsd/xdr4.h index a83a52b0f518..4ac30b2ec7c5 100644 --- a/fs/nfsd/xdr4.h +++ b/fs/nfsd/xdr4.h @@ -599,18 +599,29 @@ struct nfsd4_copy { struct nfsd_file *nf_src; struct nfsd_file *nf_dst; - copy_stateid_t cp_stateid; - - struct list_head copies; - struct task_struct *copy_task; - refcount_t refcount; - struct nfsd4_ssc_umount_item *ss_nsui; struct nfs_fh c_fh; nfs4_stateid stateid; struct nfsd_net *cp_nn; }; +/* + * Durable state for an async (background) server-side COPY. + * + * struct nfsd4_copy is transient: it lives in the COMPOUND argument buffer + * and is reused once the op returns. An async COPY outlives the COMPOUND + * (worker kthread, reaper linkage), so its params and result are snapshotted + * into the embedded cp_copy and it never points into the request buffer. + */ +struct nfsd4_async_copy { + struct nfsd4_copy cp_copy; /* operation params + result */ + + struct list_head copies; /* nfs4_client.async_copies */ + struct task_struct *copy_task; + refcount_t refcount; + copy_stateid_t cp_stateid; /* s2s_cp_stateids IDR entry */ +}; + static inline void nfsd4_copy_set_sync(struct nfsd4_copy *copy, bool sync) { if (sync) -- 2.34.1

2 1

[PATCH OLK-6.6] kabi: Add a Python3 port of check-kabi
by GONG Ruiqi 15 Oct '26

15 Oct '26

hulk inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/10129 ---------------------------------------- scripts/check-kabi is written in Python 2, which has long been in End-Of-Life[1], and its runtime environment is becoming increasingly difficult to obtain. Port it as scripts/check-kabi-py3 with the behavior kept identical: the same -k/-s options, the same output text and the same exit codes (0 on a clean check, 1 on kABI breakage, moved symbols or usage errors). The two byte-identical loaders of the original are folded into a single load_table() helper and the unused os/re imports are dropped along the way; neither change is observable from outside. Link: https://devguide.python.org/versions/ [1] Assisted-by: ZCode:GLM-5.3 Signed-off-by: GONG Ruiqi <gongruiqi1(a)huawei.com> --- scripts/check-kabi-py3 | 114 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 114 insertions(+) create mode 100755 scripts/check-kabi-py3 diff --git a/scripts/check-kabi-py3 b/scripts/check-kabi-py3 new file mode 100755 index 000000000000..3dac8fdda950 --- /dev/null +++ b/scripts/check-kabi-py3 @@ -0,0 +1,114 @@ +#!/usr/bin/env python3 +# SPDX-License-Identifier: GPL-2.0 +# +# check-kabi - Red Hat kABI reference checking tool +# +# We use this script to check against reference Module.kabi files. +# +# Author: Jon Masters <jcm(a)redhat.com> +# Copyright (C) 2007-2009 Red Hat, Inc. +# +# Python 2 is no longer maintained, hence the port to Python 3. +# +# Author: GONG Ruiqi <gongruiqi1(a)huawei.com> +# Copyright (C) 2026 Huawei Technologies Co., Ltd. +# +# This software may be freely redistributed under the terms of the GNU +# General Public License (GPL). + +import getopt +import sys + +def load_table(table, filename): + """Load a Module.symvers or Module.kabi file.""" + + with open(filename, "r") as f: + for in_line in f: + if in_line == "\n": + continue + checksum, symbol, directory, type, namespace = in_line.split("\t") + table[symbol] = in_line[0:-1] + +def check_kabi(symvers, kabi): + """Check Module.kabi and Module.symvers files.""" + + fail = False + warn = False + changed_symbols = [] + moved_symbols = [] + + for symbol, line in kabi.items(): + abi_hash, _, abi_dir, _, _ = line.split("\t") + if symbol in symvers: + sym_hash, _, sym_dir, _, _ = symvers[symbol].split("\t") + if abi_hash != sym_hash: + fail = True + changed_symbols.append(symbol) + + if abi_dir != sym_dir: + warn = True + moved_symbols.append(symbol) + else: + fail = True + changed_symbols.append(symbol) + + if fail: + print("*** ERROR - ABI BREAKAGE WAS DETECTED ***") + print("") + print("The following symbols have been changed (this will cause an ABI breakage):") + print("") + for symbol in changed_symbols: + print(symbol) + print("") + + if warn: + print("*** WARNING - ABI SYMBOLS MOVED ***") + print("") + print("The following symbols moved (typically caused by moving a symbol from being") + print("provided by the kernel vmlinux out to a loadable module):") + print("") + for symbol in moved_symbols: + print(symbol) + print("") + + # Halt the build, if we got errors and/or warnings. In either case, + # double-checking is required to avoid introducing / concealing + # KABI inconsistencies. + if fail or warn: + sys.exit(1) + sys.exit(0) + +def usage(): + print(""" +check-kabi-py3: check Module.kabi and Module.symvers files. + + check-kabi-py3 [ -k Module.kabi ] [ -s Module.symvers ] + +""") + +if __name__ == "__main__": + + symvers_file = "" + kabi_file = "" + + opts, args = getopt.getopt(sys.argv[1:], "hk:s:") + + for o, v in opts: + if o == "-s": + symvers_file = v + if o == "-h": + usage() + sys.exit(0) + if o == "-k": + kabi_file = v + + if (symvers_file == "") or (kabi_file == ""): + usage() + sys.exit(1) + + symvers = {} + kabi = {} + + load_table(symvers, symvers_file) + load_table(kabi, kabi_file) + check_kabi(symvers, kabi) -- 2.43.0

2 1

[PATCH OLK-6.6] ALSA: pcm: set timer->private_data before registering the PCM timer
by Pan Taixi 15 Oct '26

15 Oct '26

From: Nguyen Ngoc Thang <ngocthang2710.1999(a)gmail.com> stable inclusion from stable-v6.6.158 commit 686c7a6af1eea8d2a919303e4c6bbec3de79dbdc category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20047 CVE: CVE-2026-98314 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- ALSA: pcm: set timer->private_data before registering the PCM timer [ Upstream commit 1e713f9bb2ac583521f06b0eb4e22440b1e3d078 ] snd_pcm_timer_init() calls snd_device_register() to link the new struct snd_timer into the global timer list while it still carries hw.c_resolution = snd_pcm_timer_resolution (and hw.start/hw.stop), and only afterwards sets timer->private_data = substream. Once the timer is on the list under register_mutex, a concurrent reader can already reach it through the same mutex and invoke these callbacks. /proc/asound/timers does this via c_resolution(), and snd_timer_open()+snd_timer_start() reach start()/stop() the same way. All three dereference timer->private_data, which for this brief window is NULL, giving a NULL-pointer dereference: substream = timer->private_data; return substream->runtime ? ... // substream is NULL Move the private_data/private_free assignment before snd_device_register() so the timer is never visible on the list without its private_data set. On the snd_device_register() failure path, private_free() (snd_pcm_timer_free()) can now run, but it only does substream->timer = NULL, which is already NULL at that point since substream->timer is set to the new timer just once, after a successful registration -- so the failure path stays safe. Reported-by: syzbot+19da64013c46df87f971(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=19da64013c46df87f971 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Nguyen Ngoc Thang <ngocthang2710.1999(a)gmail.com> Link: https://patch.msgid.link/20260913134446.114724-1-ngocthang2710.1999@gmail.c… Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com> --- sound/core/pcm_timer.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/sound/core/pcm_timer.c b/sound/core/pcm_timer.c index c43484b22b34..725a7272cd07 100644 --- a/sound/core/pcm_timer.c +++ b/sound/core/pcm_timer.c @@ -110,16 +110,19 @@ void snd_pcm_timer_init(struct snd_pcm_substream *substream) sprintf(timer->name, "PCM %s %i-%i-%i", substream->stream == SNDRV_PCM_STREAM_CAPTURE ? "capture" : "playback", tid.card, tid.device, tid.subdevice); timer->hw = snd_pcm_timer; + /* Set before registering: a concurrent reader can invoke our hw + * callbacks as soon as the timer is on the global list. + */ + timer->private_data = substream; + timer->private_free = snd_pcm_timer_free; if (snd_device_register(timer->card, timer) < 0) { snd_device_free(timer->card, timer); return; } - timer->private_data = substream; - timer->private_free = snd_pcm_timer_free; substream->timer = timer; } void snd_pcm_timer_done(struct snd_pcm_substream *substream) { -- 2.34.1

2 1

[PATCH OLK-5.10] ALSA: pcm: set timer->private_data before registering the PCM timer
by Pan Taixi 15 Oct '26

15 Oct '26

From: Nguyen Ngoc Thang <ngocthang2710.1999(a)gmail.com> stable inclusion from stable-v5.10.271 commit 27f167e117eca310661fbcbacb352ea08face067 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20047 CVE: CVE-2026-98314 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- ALSA: pcm: set timer->private_data before registering the PCM timer [ Upstream commit 1e713f9bb2ac583521f06b0eb4e22440b1e3d078 ] snd_pcm_timer_init() calls snd_device_register() to link the new struct snd_timer into the global timer list while it still carries hw.c_resolution = snd_pcm_timer_resolution (and hw.start/hw.stop), and only afterwards sets timer->private_data = substream. Once the timer is on the list under register_mutex, a concurrent reader can already reach it through the same mutex and invoke these callbacks. /proc/asound/timers does this via c_resolution(), and snd_timer_open()+snd_timer_start() reach start()/stop() the same way. All three dereference timer->private_data, which for this brief window is NULL, giving a NULL-pointer dereference: substream = timer->private_data; return substream->runtime ? ... // substream is NULL Move the private_data/private_free assignment before snd_device_register() so the timer is never visible on the list without its private_data set. On the snd_device_register() failure path, private_free() (snd_pcm_timer_free()) can now run, but it only does substream->timer = NULL, which is already NULL at that point since substream->timer is set to the new timer just once, after a successful registration -- so the failure path stays safe. Reported-by: syzbot+19da64013c46df87f971(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=19da64013c46df87f971 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Nguyen Ngoc Thang <ngocthang2710.1999(a)gmail.com> Link: https://patch.msgid.link/20260913134446.114724-1-ngocthang2710.1999@gmail.c… Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com> --- sound/core/pcm_timer.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/sound/core/pcm_timer.c b/sound/core/pcm_timer.c index c43484b22b34..725a7272cd07 100644 --- a/sound/core/pcm_timer.c +++ b/sound/core/pcm_timer.c @@ -110,16 +110,19 @@ void snd_pcm_timer_init(struct snd_pcm_substream *substream) sprintf(timer->name, "PCM %s %i-%i-%i", substream->stream == SNDRV_PCM_STREAM_CAPTURE ? "capture" : "playback", tid.card, tid.device, tid.subdevice); timer->hw = snd_pcm_timer; + /* Set before registering: a concurrent reader can invoke our hw + * callbacks as soon as the timer is on the global list. + */ + timer->private_data = substream; + timer->private_free = snd_pcm_timer_free; if (snd_device_register(timer->card, timer) < 0) { snd_device_free(timer->card, timer); return; } - timer->private_data = substream; - timer->private_free = snd_pcm_timer_free; substream->timer = timer; } void snd_pcm_timer_done(struct snd_pcm_substream *substream) { -- 2.34.1

2 1

openEuler Kernel SIG双周例会
by openEuler conference 14 Oct '26

14 Oct '26

您好！ Kernel 邀请您参加 2026-10-16 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议发起人： LiaoTao_Wave 会议内容： 1. 进展update 2. 议题征集中（新增议题可直接填报至会议纪要看板）会议链接：https://meeting.huaweicloud.com:36443/#/j/986389680 会议纪要&签到链接：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2026-10-16 14:00 The subject of the conference is openEuler Kernel SIG双周例会 The sponsor of the conference is LiaoTao_Wave Summary: 1. 进展update 2. 议题征集中（新增议题可直接填报至会议纪要看板） You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/986389680 Add topics at https://etherpad.openeuler.org/p/Kernel-meetings More information: https://www.openeuler.org/en/

1 0

[PATCH OLK-6.6 0/8] Add support for vTLBID
by Jinqian Yang 14 Oct '26

14 Oct '26

This series adds KVM/arm64 support for the ARM TLB invalidation domain (TLBID) extension. With TLBID a guest can scope its TLB invalidation broadcasts to a virtual domain (vDomain). User space discovers the feature through the new KVM_CAP_ARM_TLBIDOMAIN capability. The number of supported vDomains is queried with the new VM ioctl KVM_ARM_GET_VDOMAIN_NUM, and the per-vCPU ioctl KVM_ARM_VCPU_SET_VDOMAIN tells KVM which vDomains each vCPU belongs to, via a vDomain bitmap. KVM maintains a per-VM mapping from vDomains to the physical CPUs that run their member vCPUs, and reprogrammes the VTLBID(n)_EL2 registers on every vCPU load, so that a guest TLBI tagged with a vDomain ID only reaches the physical CPUs currently running that vDomain's vCPUs. Because DVMBM and TLBID are mutually exclusive, DVMBM is force-disabled once TLBID is enabled for a VM. On the guest side, TLBIDIDR_EL1 is emulated with virtual domain counts clamped to the hardware limits, the ID_AA64MMFR4_EL1.TLBID field is exposed only when the feature is active for the VM, and guest accesses to TLBIDIDR_EL1 are trapped and handled by KVM. The feature is gated behind CONFIG_KVM_ARM_VTLBID \and additionally requires hardware TLBID support at run time. Tracepoints are added for the vCPU load path so that the vDomain-to-pCPU mapping can be observed. Jinqian Yang (8): KVM: arm64: Introduce TLBID virtualization infrastructure KVM: arm64: Add VTLBID sysregs and update VTLBID(n) on vCPU load KVM: arm64: Wire up TLBID vDomain configuration ioctls KVM: arm64: Ensure DVMBM is disabled when TLBID is enabled KVM: arm64: Emulate TLBIDIDR_EL1 with virtual domain counts KVM: arm64: Conditionally expose ID_AA64MMFR4_EL1.TLBID to guest KVM: arm64: Enable TLBIDIDR_EL1 access trap in guest KVM: arm64: Add tracepoints for TLBID vDomain load events Documentation/virt/kvm/api.rst | 58 +++ arch/arm64/include/asm/kvm_host.h | 53 +++ arch/arm64/include/uapi/asm/kvm.h | 2 + arch/arm64/kvm/Kconfig | 12 + arch/arm64/kvm/arm.c | 530 ++++++++++++++++++++++++++- arch/arm64/kvm/hisilicon/hisi_virt.c | 9 + arch/arm64/kvm/sys_regs.c | 76 +++- arch/arm64/kvm/sys_regs.h | 6 + arch/arm64/kvm/trace_arm.h | 47 +++ arch/arm64/tools/sysreg | 23 +- include/uapi/linux/kvm.h | 14 + 11 files changed, 826 insertions(+), 4 deletions(-) -- 2.33.0

2 9

[PATCH OLK-6.6] Add NI_RANDOM
by Luo Gengkun 14 Oct '26

14 Oct '26

Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- ...ed-fair-Proportional-newidle-balance.patch | 208 ++++++++++++++++++ ...complex-proportional-newidle-balance.patch | 133 +++++++++++ 2 files changed, 341 insertions(+) create mode 100644 NI/0001-sched-fair-Proportional-newidle-balance.patch create mode 100644 NI/0002-sched-fair-More-complex-proportional-newidle-balance.patch diff --git a/NI/0001-sched-fair-Proportional-newidle-balance.patch b/NI/0001-sched-fair-Proportional-newidle-balance.patch new file mode 100644 index 000000000000..09ab81d809ff --- /dev/null +++ b/NI/0001-sched-fair-Proportional-newidle-balance.patch @@ -0,0 +1,208 @@ +From ccfc9b017997ffc44398363c85721a67c56533df Mon Sep 17 00:00:00 2001 +From: Peter Zijlstra <peterz(a)infradead.org> +Date: Fri, 7 Nov 2025 17:01:31 +0100 +Subject: [PATCH OLK-6.6 1/2] sched/fair: Proportional newidle balance + +Add a randomized algorithm that runs newidle balancing proportional to +its success rate. + +This improves schbench significantly: + + 6.18-rc4: 2.22 Mrps/s + 6.18-rc4+revert: 2.04 Mrps/s + 6.18-rc4+revert+random: 2.18 Mrps/S + +Conversely, per Adam Li this affects SpecJBB slightly, reducing it by 1%: + + 6.17: -6% + 6.17+revert: 0% + 6.17+revert+random: -1% + +Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> +Reviewed-by: Dietmar Eggemann <dietmar.eggemann(a)arm.com> +Tested-by: Dietmar Eggemann <dietmar.eggemann(a)arm.com> +Tested-by: Chris Mason <clm(a)meta.com> +Link: https://lkml.kernel.org/r/6825c50d-7fa7-45d8-9b81-c6e7e25738e2@meta.com +Link: https://patch.msgid.link/20251107161739.770122091@infradead.org +Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> +--- + include/linux/sched/topology.h | 3 +++ + kernel/sched/core.c | 3 +++ + kernel/sched/fair.c | 43 ++++++++++++++++++++++++++++++---- + kernel/sched/features.h | 5 ++++ + kernel/sched/sched.h | 7 ++++++ + kernel/sched/topology.c | 6 +++++ + 6 files changed, 63 insertions(+), 4 deletions(-) + +diff --git a/include/linux/sched/topology.h b/include/linux/sched/topology.h +index f0caa9e1a3c2..ab45a04061fb 100644 +--- a/include/linux/sched/topology.h ++++ b/include/linux/sched/topology.h +@@ -131,6 +131,9 @@ struct sched_domain { + unsigned int nr_balance_failed; /* initialise to 0 */ + + /* idle_balance() stats */ ++ unsigned int newidle_call; ++ unsigned int newidle_success; ++ unsigned int newidle_ratio; + u64 max_newidle_lb_cost; + unsigned long last_decay_max_lb_cost; + +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index 981652b0d14c..5b486736bd5d 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -46,6 +46,7 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(sched_util_est_se_tp); + EXPORT_TRACEPOINT_SYMBOL_GPL(sched_update_nr_running_tp); + + DEFINE_PER_CPU_SHARED_ALIGNED(struct rq, runqueues); ++DEFINE_PER_CPU(struct rnd_state, sched_rnd_state); + + #ifdef CONFIG_SCHED_DEBUG + /* +@@ -9335,6 +9336,8 @@ void __init sched_init_smp(void) + { + sched_init_numa(); + ++ prandom_init_once(&sched_rnd_state); ++ + /* + * There's no userspace yet to cause hotplug operations; hence all the + * CPU masks are stable and all blatant races in the below code cannot +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index fb01890861eb..31a1f7734332 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -11840,8 +11840,23 @@ void update_max_interval(void) + max_load_balance_interval = HZ*num_online_cpus()/10; + } + +-static inline bool update_newidle_cost(struct sched_domain *sd, u64 cost) ++static inline void update_newidle_stats(struct sched_domain *sd, unsigned int success) + { ++ sd->newidle_call++; ++ sd->newidle_success += success; ++ ++ if (sd->newidle_call >= 1024) { ++ sd->newidle_ratio = sd->newidle_success; ++ sd->newidle_call /= 2; ++ sd->newidle_success /= 2; ++ } ++} ++ ++static inline bool update_newidle_cost(struct sched_domain *sd, u64 cost, unsigned int success) ++{ ++ if (cost) ++ update_newidle_stats(sd, success); ++ + if (cost > sd->max_newidle_lb_cost) { + /* + * Track max cost of a domain to make sure to not delay the +@@ -11889,7 +11904,7 @@ static void rebalance_domains(struct rq *rq, enum cpu_idle_type idle) + * Decay the newidle max times here because this is a regular + * visit to all the domains. + */ +- need_decay = update_newidle_cost(sd, 0); ++ need_decay = update_newidle_cost(sd, 0, 0); + max_cost += sd->max_newidle_lb_cost; + + /* +@@ -12527,6 +12542,22 @@ static int newidle_balance(struct rq *this_rq, struct rq_flags *rf) + break; + + if (sd->flags & SD_BALANCE_NEWIDLE) { ++ unsigned int weight = 1; ++ ++ if (sched_feat(NI_RANDOM)) { ++ /* ++ * Throw a 1k sided dice; and only run ++ * newidle_balance according to the success ++ * rate. ++ */ ++ u32 d1k = sched_rng() % 1024; ++ weight = 1 + sd->newidle_ratio; ++ if (d1k > weight) { ++ update_newidle_stats(sd, 0); ++ continue; ++ } ++ weight = (1024 + weight/2) / weight; ++ } + + pulled_task = load_balance(this_cpu, this_rq, + sd, CPU_NEWLY_IDLE, +@@ -12534,10 +12565,14 @@ static int newidle_balance(struct rq *this_rq, struct rq_flags *rf) + + t1 = sched_clock_cpu(this_cpu); + domain_cost = t1 - t0; +- update_newidle_cost(sd, domain_cost); +- + curr_cost += domain_cost; + t0 = t1; ++ ++ /* ++ * Track max cost of a domain to make sure to not delay the ++ * next wakeup on the CPU. ++ */ ++ update_newidle_cost(sd, domain_cost, weight * !!pulled_task); + } + + /* +diff --git a/kernel/sched/features.h b/kernel/sched/features.h +index 578cd5ed2b93..0198f4e97d24 100644 +--- a/kernel/sched/features.h ++++ b/kernel/sched/features.h +@@ -117,3 +117,8 @@ SCHED_FEAT(STEAL, false) + SCHED_FEAT(SIS_NODE, false) + SCHED_FEAT(TEST_STEAL_PLUS, false) + SCHED_FEAT(TEST_STEAL_PLUS_IDLE, false) ++ ++/* ++ * Do newidle balancing proportional to its success rate using randomization. ++ */ ++SCHED_FEAT(NI_RANDOM, true) +\ No newline at end of file +diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h +index 8940656dac3d..1f5ea2538515 100644 +--- a/kernel/sched/sched.h ++++ b/kernel/sched/sched.h +@@ -4,6 +4,7 @@ + */ + #include <linux/sched.h> + ++#include <linux/prandom.h> + #include <linux/sched/autogroup.h> + #include <linux/sched/clock.h> + #include <linux/sched/coredump.h> +@@ -1196,6 +1197,12 @@ static inline bool is_migration_disabled(struct task_struct *p) + } + + DECLARE_PER_CPU_SHARED_ALIGNED(struct rq, runqueues); ++DECLARE_PER_CPU(struct rnd_state, sched_rnd_state); ++ ++static inline u32 sched_rng(void) ++{ ++ return prandom_u32_state(this_cpu_ptr(&sched_rnd_state)); ++} + + #define cpu_rq(cpu) (&per_cpu(runqueues, (cpu))) + #define this_rq() this_cpu_ptr(&runqueues) +diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c +index 6576bf380086..cb82bbc4fb41 100644 +--- a/kernel/sched/topology.c ++++ b/kernel/sched/topology.c +@@ -1822,6 +1822,12 @@ sd_init(struct sched_domain_topology_level *tl, + + .last_balance = jiffies, + .balance_interval = sd_weight, ++ ++ /* 50% success rate */ ++ .newidle_call = 512, ++ .newidle_success = 256, ++ .newidle_ratio = 512, ++ + .max_newidle_lb_cost = 0, + .last_decay_max_lb_cost = jiffies, + .child = child, +-- +2.34.1 + diff --git a/NI/0002-sched-fair-More-complex-proportional-newidle-balance.patch b/NI/0002-sched-fair-More-complex-proportional-newidle-balance.patch new file mode 100644 index 000000000000..4ab477726400 --- /dev/null +++ b/NI/0002-sched-fair-More-complex-proportional-newidle-balance.patch @@ -0,0 +1,133 @@ +From 069a09a4f06e2a05e933dc58bbeb8c66fcd75572 Mon Sep 17 00:00:00 2001 +From: Peter Zijlstra <peterz(a)infradead.org> +Date: Tue, 27 Jan 2026 16:17:48 +0100 +Subject: [PATCH OLK-6.6 2/2] sched/fair: More complex proportional newidle + balance + +It turns out that a few workloads (easyWave, fio) have a fairly low +success rate on newidle balance, but still benefit greatly from having +it anyway. + +Luckliky these workloads have a faily low newidle rate, so the cost if +doing the newidle is relatively low, even if unsuccessfull. + +Add a simple rate based part to the newidle ratio compute, such that +low rate newidle will still have a high newidle ratio. + +This cures the easyWave and fio workloads while not affecting the +schbench numbers either (which have a very high newidle rate). + +Reported-by: Mario Roy <marioeroy(a)gmail.com> +Reported-by: "Mohamed Abuelfotoh, Hazem" <abuehaze(a)amazon.com> +Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> +Tested-by: Mario Roy <marioeroy(a)gmail.com> +Tested-by: "Mohamed Abuelfotoh, Hazem" <abuehaze(a)amazon.com> +Link: https://patch.msgid.link/20260127151748.GA1079264@noisy.programming.kicks-a… +Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> +--- + include/linux/sched/topology.h | 1 + + kernel/sched/fair.c | 27 +++++++++++++++++++++++++-- + kernel/sched/features.h | 3 ++- + kernel/sched/topology.c | 3 +++ + 4 files changed, 31 insertions(+), 3 deletions(-) + +diff --git a/include/linux/sched/topology.h b/include/linux/sched/topology.h +index ab45a04061fb..d66e6c6c2cdf 100644 +--- a/include/linux/sched/topology.h ++++ b/include/linux/sched/topology.h +@@ -134,6 +134,7 @@ struct sched_domain { + unsigned int newidle_call; + unsigned int newidle_success; + unsigned int newidle_ratio; ++ u64 newidle_stamp; + u64 max_newidle_lb_cost; + unsigned long last_decay_max_lb_cost; + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 31a1f7734332..ec40e79802bd 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -11846,7 +11846,30 @@ static inline void update_newidle_stats(struct sched_domain *sd, unsigned int su + sd->newidle_success += success; + + if (sd->newidle_call >= 1024) { +- sd->newidle_ratio = sd->newidle_success; ++ u64 now = sched_clock(); ++ s64 delta = now - sd->newidle_stamp; ++ sd->newidle_stamp = now; ++ int ratio = 0; ++ ++ if (delta < 0) ++ delta = 0; ++ ++ if (sched_feat(NI_RATE)) { ++ /* ++ * ratio delta freq ++ * ++ * 1024 - 4 s - 128 Hz ++ * 512 - 2 s - 256 Hz ++ * 256 - 1 s - 512 Hz ++ * 128 - .5 s - 1024 Hz ++ * 64 - .25 s - 2048 Hz ++ */ ++ ratio = delta >> 22; ++ } ++ ++ ratio += sd->newidle_success; ++ ++ sd->newidle_ratio = min(1024, ratio); + sd->newidle_call /= 2; + sd->newidle_success /= 2; + } +@@ -12544,7 +12567,7 @@ static int newidle_balance(struct rq *this_rq, struct rq_flags *rf) + if (sd->flags & SD_BALANCE_NEWIDLE) { + unsigned int weight = 1; + +- if (sched_feat(NI_RANDOM)) { ++ if (sched_feat(NI_RANDOM) && sd->newidle_ratio < 1024) { + /* + * Throw a 1k sided dice; and only run + * newidle_balance according to the success +diff --git a/kernel/sched/features.h b/kernel/sched/features.h +index 0198f4e97d24..9a8b6f41f4cb 100644 +--- a/kernel/sched/features.h ++++ b/kernel/sched/features.h +@@ -121,4 +121,5 @@ SCHED_FEAT(TEST_STEAL_PLUS_IDLE, false) + /* + * Do newidle balancing proportional to its success rate using randomization. + */ +-SCHED_FEAT(NI_RANDOM, true) +\ No newline at end of file ++SCHED_FEAT(NI_RANDOM, true) ++SCHED_FEAT(NI_RATE, true) +diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c +index cb82bbc4fb41..ac198e940978 100644 +--- a/kernel/sched/topology.c ++++ b/kernel/sched/topology.c +@@ -4,6 +4,7 @@ + */ + #include "sched.h" + #include "sparsemask.h" ++#include <linux/sched/clock.h> + + DEFINE_MUTEX(sched_domains_mutex); + +@@ -1783,6 +1784,7 @@ sd_init(struct sched_domain_topology_level *tl, + struct sched_domain *sd = *per_cpu_ptr(sdd->sd, cpu); + int sd_id, sd_weight, sd_flags = 0; + struct cpumask *sd_span; ++ u64 now = sched_clock(); + + #ifdef CONFIG_NUMA + /* +@@ -1827,6 +1829,7 @@ sd_init(struct sched_domain_topology_level *tl, + .newidle_call = 512, + .newidle_success = 256, + .newidle_ratio = 512, ++ .newidle_stamp = now, + + .max_newidle_lb_cost = 0, + .last_decay_max_lb_cost = jiffies, +-- +2.34.1 + -- 2.34.1

2 1

[PATCH OLK-6.6] Add NI_RANDOM
by Luo Gengkun 14 Oct '26

14 Oct '26

Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- NI/0000-cover-letter.patch | 21 ++ ...ed-fair-Proportional-newidle-balance.patch | 208 ++++++++++++++++++ ...complex-proportional-newidle-balance.patch | 133 +++++++++++ 3 files changed, 362 insertions(+) create mode 100644 NI/0000-cover-letter.patch create mode 100644 NI/0001-sched-fair-Proportional-newidle-balance.patch create mode 100644 NI/0002-sched-fair-More-complex-proportional-newidle-balance.patch diff --git a/NI/0000-cover-letter.patch b/NI/0000-cover-letter.patch new file mode 100644 index 000000000000..b66e2ead869c --- /dev/null +++ b/NI/0000-cover-letter.patch @@ -0,0 +1,21 @@ +From 069a09a4f06e2a05e933dc58bbeb8c66fcd75572 Mon Sep 17 00:00:00 2001 +From: Luo Gengkun <luogengkun2(a)huawei.com> +Date: Wed, 14 Oct 2026 01:35:24 +0000 +Subject: [PATCH OLK-6.6 0/2] Backport NI_RANDOM for 5.15 + + +Peter Zijlstra (2): + sched/fair: Proportional newidle balance + sched/fair: More complex proportional newidle balance + + include/linux/sched/topology.h | 4 +++ + kernel/sched/core.c | 3 ++ + kernel/sched/fair.c | 66 +++++++++++++++++++++++++++++++--- + kernel/sched/features.h | 6 ++++ + kernel/sched/sched.h | 7 ++++ + kernel/sched/topology.c | 9 +++++ + 6 files changed, 91 insertions(+), 4 deletions(-) + +-- +2.34.1 + diff --git a/NI/0001-sched-fair-Proportional-newidle-balance.patch b/NI/0001-sched-fair-Proportional-newidle-balance.patch new file mode 100644 index 000000000000..09ab81d809ff --- /dev/null +++ b/NI/0001-sched-fair-Proportional-newidle-balance.patch @@ -0,0 +1,208 @@ +From ccfc9b017997ffc44398363c85721a67c56533df Mon Sep 17 00:00:00 2001 +From: Peter Zijlstra <peterz(a)infradead.org> +Date: Fri, 7 Nov 2025 17:01:31 +0100 +Subject: [PATCH OLK-6.6 1/2] sched/fair: Proportional newidle balance + +Add a randomized algorithm that runs newidle balancing proportional to +its success rate. + +This improves schbench significantly: + + 6.18-rc4: 2.22 Mrps/s + 6.18-rc4+revert: 2.04 Mrps/s + 6.18-rc4+revert+random: 2.18 Mrps/S + +Conversely, per Adam Li this affects SpecJBB slightly, reducing it by 1%: + + 6.17: -6% + 6.17+revert: 0% + 6.17+revert+random: -1% + +Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> +Reviewed-by: Dietmar Eggemann <dietmar.eggemann(a)arm.com> +Tested-by: Dietmar Eggemann <dietmar.eggemann(a)arm.com> +Tested-by: Chris Mason <clm(a)meta.com> +Link: https://lkml.kernel.org/r/6825c50d-7fa7-45d8-9b81-c6e7e25738e2@meta.com +Link: https://patch.msgid.link/20251107161739.770122091@infradead.org +Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> +--- + include/linux/sched/topology.h | 3 +++ + kernel/sched/core.c | 3 +++ + kernel/sched/fair.c | 43 ++++++++++++++++++++++++++++++---- + kernel/sched/features.h | 5 ++++ + kernel/sched/sched.h | 7 ++++++ + kernel/sched/topology.c | 6 +++++ + 6 files changed, 63 insertions(+), 4 deletions(-) + +diff --git a/include/linux/sched/topology.h b/include/linux/sched/topology.h +index f0caa9e1a3c2..ab45a04061fb 100644 +--- a/include/linux/sched/topology.h ++++ b/include/linux/sched/topology.h +@@ -131,6 +131,9 @@ struct sched_domain { + unsigned int nr_balance_failed; /* initialise to 0 */ + + /* idle_balance() stats */ ++ unsigned int newidle_call; ++ unsigned int newidle_success; ++ unsigned int newidle_ratio; + u64 max_newidle_lb_cost; + unsigned long last_decay_max_lb_cost; + +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index 981652b0d14c..5b486736bd5d 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -46,6 +46,7 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(sched_util_est_se_tp); + EXPORT_TRACEPOINT_SYMBOL_GPL(sched_update_nr_running_tp); + + DEFINE_PER_CPU_SHARED_ALIGNED(struct rq, runqueues); ++DEFINE_PER_CPU(struct rnd_state, sched_rnd_state); + + #ifdef CONFIG_SCHED_DEBUG + /* +@@ -9335,6 +9336,8 @@ void __init sched_init_smp(void) + { + sched_init_numa(); + ++ prandom_init_once(&sched_rnd_state); ++ + /* + * There's no userspace yet to cause hotplug operations; hence all the + * CPU masks are stable and all blatant races in the below code cannot +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index fb01890861eb..31a1f7734332 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -11840,8 +11840,23 @@ void update_max_interval(void) + max_load_balance_interval = HZ*num_online_cpus()/10; + } + +-static inline bool update_newidle_cost(struct sched_domain *sd, u64 cost) ++static inline void update_newidle_stats(struct sched_domain *sd, unsigned int success) + { ++ sd->newidle_call++; ++ sd->newidle_success += success; ++ ++ if (sd->newidle_call >= 1024) { ++ sd->newidle_ratio = sd->newidle_success; ++ sd->newidle_call /= 2; ++ sd->newidle_success /= 2; ++ } ++} ++ ++static inline bool update_newidle_cost(struct sched_domain *sd, u64 cost, unsigned int success) ++{ ++ if (cost) ++ update_newidle_stats(sd, success); ++ + if (cost > sd->max_newidle_lb_cost) { + /* + * Track max cost of a domain to make sure to not delay the +@@ -11889,7 +11904,7 @@ static void rebalance_domains(struct rq *rq, enum cpu_idle_type idle) + * Decay the newidle max times here because this is a regular + * visit to all the domains. + */ +- need_decay = update_newidle_cost(sd, 0); ++ need_decay = update_newidle_cost(sd, 0, 0); + max_cost += sd->max_newidle_lb_cost; + + /* +@@ -12527,6 +12542,22 @@ static int newidle_balance(struct rq *this_rq, struct rq_flags *rf) + break; + + if (sd->flags & SD_BALANCE_NEWIDLE) { ++ unsigned int weight = 1; ++ ++ if (sched_feat(NI_RANDOM)) { ++ /* ++ * Throw a 1k sided dice; and only run ++ * newidle_balance according to the success ++ * rate. ++ */ ++ u32 d1k = sched_rng() % 1024; ++ weight = 1 + sd->newidle_ratio; ++ if (d1k > weight) { ++ update_newidle_stats(sd, 0); ++ continue; ++ } ++ weight = (1024 + weight/2) / weight; ++ } + + pulled_task = load_balance(this_cpu, this_rq, + sd, CPU_NEWLY_IDLE, +@@ -12534,10 +12565,14 @@ static int newidle_balance(struct rq *this_rq, struct rq_flags *rf) + + t1 = sched_clock_cpu(this_cpu); + domain_cost = t1 - t0; +- update_newidle_cost(sd, domain_cost); +- + curr_cost += domain_cost; + t0 = t1; ++ ++ /* ++ * Track max cost of a domain to make sure to not delay the ++ * next wakeup on the CPU. ++ */ ++ update_newidle_cost(sd, domain_cost, weight * !!pulled_task); + } + + /* +diff --git a/kernel/sched/features.h b/kernel/sched/features.h +index 578cd5ed2b93..0198f4e97d24 100644 +--- a/kernel/sched/features.h ++++ b/kernel/sched/features.h +@@ -117,3 +117,8 @@ SCHED_FEAT(STEAL, false) + SCHED_FEAT(SIS_NODE, false) + SCHED_FEAT(TEST_STEAL_PLUS, false) + SCHED_FEAT(TEST_STEAL_PLUS_IDLE, false) ++ ++/* ++ * Do newidle balancing proportional to its success rate using randomization. ++ */ ++SCHED_FEAT(NI_RANDOM, true) +\ No newline at end of file +diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h +index 8940656dac3d..1f5ea2538515 100644 +--- a/kernel/sched/sched.h ++++ b/kernel/sched/sched.h +@@ -4,6 +4,7 @@ + */ + #include <linux/sched.h> + ++#include <linux/prandom.h> + #include <linux/sched/autogroup.h> + #include <linux/sched/clock.h> + #include <linux/sched/coredump.h> +@@ -1196,6 +1197,12 @@ static inline bool is_migration_disabled(struct task_struct *p) + } + + DECLARE_PER_CPU_SHARED_ALIGNED(struct rq, runqueues); ++DECLARE_PER_CPU(struct rnd_state, sched_rnd_state); ++ ++static inline u32 sched_rng(void) ++{ ++ return prandom_u32_state(this_cpu_ptr(&sched_rnd_state)); ++} + + #define cpu_rq(cpu) (&per_cpu(runqueues, (cpu))) + #define this_rq() this_cpu_ptr(&runqueues) +diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c +index 6576bf380086..cb82bbc4fb41 100644 +--- a/kernel/sched/topology.c ++++ b/kernel/sched/topology.c +@@ -1822,6 +1822,12 @@ sd_init(struct sched_domain_topology_level *tl, + + .last_balance = jiffies, + .balance_interval = sd_weight, ++ ++ /* 50% success rate */ ++ .newidle_call = 512, ++ .newidle_success = 256, ++ .newidle_ratio = 512, ++ + .max_newidle_lb_cost = 0, + .last_decay_max_lb_cost = jiffies, + .child = child, +-- +2.34.1 + diff --git a/NI/0002-sched-fair-More-complex-proportional-newidle-balance.patch b/NI/0002-sched-fair-More-complex-proportional-newidle-balance.patch new file mode 100644 index 000000000000..4ab477726400 --- /dev/null +++ b/NI/0002-sched-fair-More-complex-proportional-newidle-balance.patch @@ -0,0 +1,133 @@ +From 069a09a4f06e2a05e933dc58bbeb8c66fcd75572 Mon Sep 17 00:00:00 2001 +From: Peter Zijlstra <peterz(a)infradead.org> +Date: Tue, 27 Jan 2026 16:17:48 +0100 +Subject: [PATCH OLK-6.6 2/2] sched/fair: More complex proportional newidle + balance + +It turns out that a few workloads (easyWave, fio) have a fairly low +success rate on newidle balance, but still benefit greatly from having +it anyway. + +Luckliky these workloads have a faily low newidle rate, so the cost if +doing the newidle is relatively low, even if unsuccessfull. + +Add a simple rate based part to the newidle ratio compute, such that +low rate newidle will still have a high newidle ratio. + +This cures the easyWave and fio workloads while not affecting the +schbench numbers either (which have a very high newidle rate). + +Reported-by: Mario Roy <marioeroy(a)gmail.com> +Reported-by: "Mohamed Abuelfotoh, Hazem" <abuehaze(a)amazon.com> +Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> +Tested-by: Mario Roy <marioeroy(a)gmail.com> +Tested-by: "Mohamed Abuelfotoh, Hazem" <abuehaze(a)amazon.com> +Link: https://patch.msgid.link/20260127151748.GA1079264@noisy.programming.kicks-a… +Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> +--- + include/linux/sched/topology.h | 1 + + kernel/sched/fair.c | 27 +++++++++++++++++++++++++-- + kernel/sched/features.h | 3 ++- + kernel/sched/topology.c | 3 +++ + 4 files changed, 31 insertions(+), 3 deletions(-) + +diff --git a/include/linux/sched/topology.h b/include/linux/sched/topology.h +index ab45a04061fb..d66e6c6c2cdf 100644 +--- a/include/linux/sched/topology.h ++++ b/include/linux/sched/topology.h +@@ -134,6 +134,7 @@ struct sched_domain { + unsigned int newidle_call; + unsigned int newidle_success; + unsigned int newidle_ratio; ++ u64 newidle_stamp; + u64 max_newidle_lb_cost; + unsigned long last_decay_max_lb_cost; + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 31a1f7734332..ec40e79802bd 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -11846,7 +11846,30 @@ static inline void update_newidle_stats(struct sched_domain *sd, unsigned int su + sd->newidle_success += success; + + if (sd->newidle_call >= 1024) { +- sd->newidle_ratio = sd->newidle_success; ++ u64 now = sched_clock(); ++ s64 delta = now - sd->newidle_stamp; ++ sd->newidle_stamp = now; ++ int ratio = 0; ++ ++ if (delta < 0) ++ delta = 0; ++ ++ if (sched_feat(NI_RATE)) { ++ /* ++ * ratio delta freq ++ * ++ * 1024 - 4 s - 128 Hz ++ * 512 - 2 s - 256 Hz ++ * 256 - 1 s - 512 Hz ++ * 128 - .5 s - 1024 Hz ++ * 64 - .25 s - 2048 Hz ++ */ ++ ratio = delta >> 22; ++ } ++ ++ ratio += sd->newidle_success; ++ ++ sd->newidle_ratio = min(1024, ratio); + sd->newidle_call /= 2; + sd->newidle_success /= 2; + } +@@ -12544,7 +12567,7 @@ static int newidle_balance(struct rq *this_rq, struct rq_flags *rf) + if (sd->flags & SD_BALANCE_NEWIDLE) { + unsigned int weight = 1; + +- if (sched_feat(NI_RANDOM)) { ++ if (sched_feat(NI_RANDOM) && sd->newidle_ratio < 1024) { + /* + * Throw a 1k sided dice; and only run + * newidle_balance according to the success +diff --git a/kernel/sched/features.h b/kernel/sched/features.h +index 0198f4e97d24..9a8b6f41f4cb 100644 +--- a/kernel/sched/features.h ++++ b/kernel/sched/features.h +@@ -121,4 +121,5 @@ SCHED_FEAT(TEST_STEAL_PLUS_IDLE, false) + /* + * Do newidle balancing proportional to its success rate using randomization. + */ +-SCHED_FEAT(NI_RANDOM, true) +\ No newline at end of file ++SCHED_FEAT(NI_RANDOM, true) ++SCHED_FEAT(NI_RATE, true) +diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c +index cb82bbc4fb41..ac198e940978 100644 +--- a/kernel/sched/topology.c ++++ b/kernel/sched/topology.c +@@ -4,6 +4,7 @@ + */ + #include "sched.h" + #include "sparsemask.h" ++#include <linux/sched/clock.h> + + DEFINE_MUTEX(sched_domains_mutex); + +@@ -1783,6 +1784,7 @@ sd_init(struct sched_domain_topology_level *tl, + struct sched_domain *sd = *per_cpu_ptr(sdd->sd, cpu); + int sd_id, sd_weight, sd_flags = 0; + struct cpumask *sd_span; ++ u64 now = sched_clock(); + + #ifdef CONFIG_NUMA + /* +@@ -1827,6 +1829,7 @@ sd_init(struct sched_domain_topology_level *tl, + .newidle_call = 512, + .newidle_success = 256, + .newidle_ratio = 512, ++ .newidle_stamp = now, + + .max_newidle_lb_cost = 0, + .last_decay_max_lb_cost = jiffies, +-- +2.34.1 + -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] Backport NI_RANDOM for 5.15
by Luo Gengkun 14 Oct '26

14 Oct '26

Peter Zijlstra (2): sched/fair: Proportional newidle balance sched/fair: More complex proportional newidle balance include/linux/sched/topology.h | 4 +++ kernel/sched/core.c | 3 ++ kernel/sched/fair.c | 66 +++++++++++++++++++++++++++++++--- kernel/sched/features.h | 6 ++++ kernel/sched/sched.h | 7 ++++ kernel/sched/topology.c | 9 +++++ 6 files changed, 91 insertions(+), 4 deletions(-) -- 2.34.1

1 0

[PATCH OLK-6.6 0/1] KVM: arm64: Fix kernel panic due to uninitialized fpmr pointer
by Qinxin Xia 14 Oct '26

14 Oct '26

From: Hongye Lin <linhongye(a)h-partners.com> driver inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8904 ---------------------------------------------------------------------- When the hardware implements FEAT_FPMR but CONFIG_ENABLE_KVM_FPMR is not set in the kernel config, starting a VM crashes the host with the following panic: | Unable to handle kernel paging request at virtual address d6d0b7173a7d8b80 | Mem abort info: | ESR = 0x0000000096000044 | EC = 0x25: DABT (current EL), IL = 32 bits | FSC = 0x04: level 0 translation fault | CM = 0, WnR = 1, TnD = 0, TagAccess = 0 | [d6d0b7173a7d8b80] address between user and kernel address ranges | pc : fpsimd_save+0xd0/0x160 | lr : fpsimd_save+0x38/0x160 | Call trace: | fpsimd_save+0xd0/0x160 | fpsimd_save_and_flush_cpu_state+0x34/0xa8 | kvm_arch_vcpu_put_fp+0xf0/0x250 | kvm_arch_vcpu_put+0x44/0xf0 | vcpu_put+0x20/0x50 | kvm_arch_vcpu_ioctl_run+0x70/0x630 | Kernel panic - not syncing: Oops: Fatal exception The root cause is an asymmetric gating of the FPMR context switch introduced when backporting upstream FPMR support: - The consumer side (fpsimd_save()) saves FPMR whenever the hardware capability is detected at runtime: if (system_supports_fpmr()) *(last->fpmr) = read_sysreg_s(SYS_FPMR); - The producer side (kvm_arch_vcpu_ctxsync_fp()) only assigns fp_state.fpmr under #ifdef CONFIG_ENABLE_KVM_FPMR, while the struct cpu_fp_state stack variable is left uninitialized. With the config disabled, fpsimd_bind_state_to_cpu() binds stack garbage into the per-CPU fpsimd_last_state.fpmr, and the first guest exit writes FPMR to this garbage pointer, causing the above level 0 translation fault. Qinxin Xia (1): KVM: arm64: Fix kernel panic due to uninitialized fpmr pointer arch/arm64/kernel/fpsimd.c | 2 +- arch/arm64/kvm/fpsimd.c | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) -- 2.33.0

2 2

[PATCH OLK-6.6 0/2] Backport NI_RANDOM for 5.15
by Luo Gengkun 14 Oct '26

14 Oct '26

Peter Zijlstra (2): sched/fair: Proportional newidle balance sched/fair: More complex proportional newidle balance include/linux/sched/topology.h | 4 +++ kernel/sched/core.c | 3 ++ kernel/sched/fair.c | 66 +++++++++++++++++++++++++++++++--- kernel/sched/features.h | 6 ++++ kernel/sched/sched.h | 7 ++++ kernel/sched/topology.c | 9 +++++ 6 files changed, 91 insertions(+), 4 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 NI_RANDOM patchs 0/2] Introduce NI_RANDOM for 5.15
by Luo Gengkun 13 Oct '26

13 Oct '26

Peter Zijlstra (2): sched/fair: Proportional newidle balance sched/fair: More complex proportional newidle balance include/linux/sched/topology.h | 4 +++ kernel/sched/core.c | 3 ++ kernel/sched/fair.c | 66 +++++++++++++++++++++++++++++++--- kernel/sched/features.h | 6 ++++ kernel/sched/sched.h | 7 ++++ kernel/sched/topology.c | 9 +++++ 6 files changed, 91 insertions(+), 4 deletions(-) -- 2.34.1

1 2

[PATCH OLK-6.6 0/2] CVE-2026-100074
by Pu Lehui 13 Oct '26

13 Oct '26

Kumar Kartikeya Dwivedi (1): bpf: Mark bpf_refcount field as unique Mykyta Yatsenko (1): bpf: refactor special field-type detection kernel/bpf/btf.c | 59 ++++++++++++++++++++++++------------------------ 1 file changed, 29 insertions(+), 30 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] bpf: check_cond_jmp_op(): properly infer if register is null
by Pu Lehui 13 Oct '26

13 Oct '26

From: Eduard Zingerman <eddyz87(a)gmail.com> mainline inclusion from mainline-v7.3-rc2 commit d3ef6c097ba078e1f8c7239d76a0ce8b61e75095 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19697 CVE: CVE-2026-98134 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Nicholas Carlini reported a bug when verifier can incorrectly infer that a pointer is non-null. The bug occurs when two pointers are compared and one of them has a type w/o PTR_MAYBE_NULL flag, but which allows a value to be NULL at runtime. Here is an example: // `a` is PTR_TO_MEM | MEM_RDONLY | PTR_UNTRUSTED // `a` is 0 at runtime. // `b` is PTR_TO_MAP_VALUE | PTR_MAYBE_NULL void *a = bpf_rdonly_cast(0, 0); int *b = bpf_map_lookup_elem(...); if (a == b) *b = 42; // verifier does not catch null pointer dereference This happens because of a special case in check_cond_jmp_op(), which attempts to strip PTR_MAYBE_NULL flags from pointer types, when processing comparisons like `rA == rB`, if either rA or rB can't be null. The non-null property is derived based on the absence of PTR_MAYBE_NULL flag on rA's or rB's type. But that is not sufficient for types like PTR_TO_MEM, as in the example. This patch replaces type_may_be_null() call with reg_not_null(), which contains an allowlist of types for which absence of PTR_MAYBE_NULL actually means that the value can't be NULL at runtime. At the moment, the list in the reg_not_null() omits two types for which PTR_MAYBE_NULL is applicable: PTR_TO_XDP_SOCK and PTR_TO_BUF. In order to remain backward compatible, and assuming that only comparison between pointers of the same type makes sense, this commit extends reg_not_null(). W/o such an extension e.g. verifier_jeq_infer_not_null/null_ptr_to_map_value fails. reg_not_null() can be extended further, but I deem that out of scope for the fix at hand. Explicit base_type(...) != PTR_TO_BTF_ID checks in the check_cond_jmp_op() can be removed with migration to reg_not_null(), but that is a behavioural change, as the special case would start matching for PTR_TO_BTF_ID that is also is_trusted_reg(). I omit the behavioural change from this commit. Fixes: befae75856ab ("bpf: propagate nullness information for reg to reg comparisons") Suggested-by: Nicholas Carlini <npc(a)anthropic.com> Signed-off-by: Eduard Zingerman <eddyz87(a)gmail.com> Link: https://lore.kernel.org/r/20260826-bug-029-bad-non-null-inference-v2-1-1367… Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Conflicts: kernel/bpf/verifier.c [reg_not_null has no env arg] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/verifier.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index b796d985e420..55c470694a80 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -470,6 +470,8 @@ static bool reg_not_null(const struct bpf_reg_state *reg) type = base_type(type); return type == PTR_TO_SOCKET || type == PTR_TO_TCP_SOCK || + type == PTR_TO_XDP_SOCK || + type == PTR_TO_BUF || type == PTR_TO_MAP_VALUE || type == PTR_TO_MAP_KEY || type == PTR_TO_SOCK_COMMON || @@ -15170,7 +15172,6 @@ static int check_cond_jmp_op(struct bpf_verifier_env *env, */ if (!is_jmp32 && BPF_SRC(insn->code) == BPF_X && __is_pointer_value(false, src_reg) && __is_pointer_value(false, dst_reg) && - type_may_be_null(src_reg->type) != type_may_be_null(dst_reg->type) && base_type(src_reg->type) != PTR_TO_BTF_ID && base_type(dst_reg->type) != PTR_TO_BTF_ID) { eq_branch_regs = NULL; @@ -15186,9 +15187,11 @@ static int check_cond_jmp_op(struct bpf_verifier_env *env, break; } if (eq_branch_regs) { - if (type_may_be_null(src_reg->type)) + /* src == dst && dst != NULL => src != NULL */ + if (reg_not_null(dst_reg) && type_may_be_null(src_reg->type)) mark_ptr_not_null_reg(&eq_branch_regs[insn->src_reg]); - else + /* src == dst && src != NULL => dst != NULL */ + if (reg_not_null(src_reg) && type_may_be_null(dst_reg->type)) mark_ptr_not_null_reg(&eq_branch_regs[insn->dst_reg]); } } -- 2.34.1

2 1

[PATCH OLK-6.6] bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks
by Pu Lehui 13 Oct '26

13 Oct '26

From: Eduard Zingerman <eddyz87(a)gmail.com> mainline inclusion from mainline-v7.3-rc2 commit e3e4f66cc4b72333d0886ae2673c360248987889 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19752 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- When processing calls to bpf_loop() verifier marks R1 (and R4) as precise. R1 tracks loop iterations number and because of the 'callback_depth < R1' mechanics in check_helper_call() must be marked precise. However, precision propagation for R1 was broken, when bpf_loop() call was verified on a second iteration. Consider the following verification trace: - main: bpf_loop(nr_loops, callback ...) - callback: BPF_EXIT - main: bpf_loop(nr_loops, callback ...) - ... While the first visit of the call to bpf_loop() propagated R1 precision as expected, the second call to mark_chain_precision() in the check_helper_call() set R1, but it was immediately reset when backtrack_insn() processed preceding BPF_EXIT in the loop deleted in this patch. Because of that, the second visit of the call to bpf_loop() injected checkpoint with R1 not marked as precise. Which could trick the verifier into accepting unsafe programs. See the next patch for an example of such program. Commit is structured in a way to minimize conflicts when 'bpf' would be eventually merged with 'bpf-next'. Fixes: ab5cfac139ab ("bpf: verify callbacks as if they are called unknown number of times") Reported-by: Nicholas Carlini <npc(a)anthropic.com> Suggested-by: Nicholas Carlini <npc(a)anthropic.com> Signed-off-by: Eduard Zingerman <eddyz87(a)gmail.com> Link: https://lore.kernel.org/r/20260831-bug-015-backtrack-cb-args-precise-v1-1-6… Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Conflicts: kernel/bpf/verifier.c [ctx conflicts] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/verifier.c | 37 +++++++++++++++++-------------------- 1 file changed, 17 insertions(+), 20 deletions(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index b796d985e420..98454d1d1358 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -3997,37 +3997,34 @@ static int backtrack_insn(struct bpf_verifier_env *env, int idx, int subseq_idx, return -EFAULT; } } else if (opcode == BPF_EXIT) { - bool r0_precise; + bool from_subprog_call, r0_precise; + + /* BPF_EXIT in subprog or callback always returns + * right after the call instruction, so by checking + * whether the instruction at subseq_idx-1 is subprog + * call or not we can distinguish actual exit from + * *subprog* from exit from *callback*. In the former + * case, we need to propagate r0 precision, if + * necessary. In the former we never do that. + */ + from_subprog_call = subseq_idx - 1 >= 0 && + bpf_pseudo_call(&env->prog->insnsi[subseq_idx - 1]); + + r0_precise = from_subprog_call && bt_is_reg_set(bt, BPF_REG_0); /* Backtracking to a nested function call, 'idx' is a part of * the inner frame 'subseq_idx' is a part of the outer frame. * In case of a regular function call, instructions giving * precision to registers R1-R5 should have been found already. - * In case of a callback, it is ok to have R1-R5 marked for - * backtracking, as these registers are set by the function - * invoking callback. + * In case of a callback from bpf_loop(), R{1,4} in the calling + * frame would be set as precise and that is correct. */ - if (subseq_idx >= 0 && calls_callback(env, subseq_idx)) - for (i = BPF_REG_1; i <= BPF_REG_5; i++) - bt_clear_reg(bt, i); - if (bt_reg_mask(bt) & BPF_REGMASK_ARGS) { + if (from_subprog_call && (bt_reg_mask(bt) & BPF_REGMASK_ARGS)) { verbose(env, "BUG regs %x\n", bt_reg_mask(bt)); WARN_ONCE(1, "verifier backtracking bug"); return -EFAULT; } - /* BPF_EXIT in subprog or callback always returns - * right after the call instruction, so by checking - * whether the instruction at subseq_idx-1 is subprog - * call or not we can distinguish actual exit from - * *subprog* from exit from *callback*. In the former - * case, we need to propagate r0 precision, if - * necessary. In the former we never do that. - */ - r0_precise = subseq_idx - 1 >= 0 && - bpf_pseudo_call(&env->prog->insnsi[subseq_idx - 1]) && - bt_is_reg_set(bt, BPF_REG_0); - bt_clear_reg(bt, BPF_REG_0); if (bt_subprog_enter(bt)) return -EFAULT; -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] Fix the perf tool cs-etm-decoder compilation issue
by Tengda Wu 13 Oct '26

13 Oct '26

Fix the perf tool cs-etm-decoder compilation issue. This issue was introduced by the stable-v6.6.157 version and has not yet been resolved, so temporarily revert it as a workaround. Tengda Wu (2): Revert "perf cs-etm: Fix thread leaks on trace queue init failure" Revert "perf cs-etm: Queue context packets for frontend" .../perf/util/cs-etm-decoder/cs-etm-decoder.c | 21 +- tools/perf/util/cs-etm.c | 240 +++++++----------- tools/perf/util/cs-etm.h | 8 +- 3 files changed, 102 insertions(+), 167 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/2] Fix the perf tool cs-etm-decoder compilation issue.
by Tengda Wu 13 Oct '26

13 Oct '26

Fix the perf tool cs-etm-decoder compilation issue. This issue was introduced by the stable-v6.6.157 version and has not yet been resolved, so temporarily revert it as a workaround. Tengda Wu (2): Revert "perf cs-etm: Fix thread leaks on trace queue init failure" Revert "perf cs-etm: Queue context packets for frontend" .../perf/util/cs-etm-decoder/cs-etm-decoder.c | 21 +- tools/perf/util/cs-etm.c | 240 +++++++----------- tools/perf/util/cs-etm.h | 8 +- 3 files changed, 102 insertions(+), 167 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/2] CVE-2026-100074
by Pu Lehui 13 Oct '26

13 Oct '26

Kumar Kartikeya Dwivedi (1): bpf: Mark bpf_refcount field as unique Mykyta Yatsenko (1): bpf: refactor special field-type detection kernel/bpf/btf.c | 59 ++++++++++++++++++++++++------------------------ 1 file changed, 29 insertions(+), 30 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] mm/huge_memory: fix unconditional pgtable deposit for special huge PMD in copy_huge_pmd()
by Jinjiang Tu 13 Oct '26

13 Oct '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/10116 -------------------------------- In copy_huge_pmd(), the special huge PMD path unconditionally allocates a pgtable and deposits it to the destination PMD. However, the pgtable withdraw in zap_huge_pmd() is guarded by arch_needs_pgtable_deposit(), which returns false on x86. This asymmetry causes a 4KB pgtable page and an mm->nr_ptes counter increment to leak on every fork+zap cycle of a special huge PMD on x86. Guard the deposit for special huge PMD in copy_huge_pmd() with the same arch_needs_pgtable_deposit() check, matching what vmf_insert_pfn_pmd() already does at insertion time and what zap_huge_pmd() does at teardown. Fixes: 923e224a1246 ("mm: introduce remap_pfn_range_try_pmd() for PMD-level hugepage mapping") Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- mm/huge_memory.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/mm/huge_memory.c b/mm/huge_memory.c index 805a903d8423..d423824dc67a 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -1834,9 +1834,11 @@ int copy_huge_pmd(struct mm_struct *dst_mm, struct mm_struct *src_mm, pmd = pmdp_get_lockless(src_pmd); if (unlikely(pmd_present(pmd) && pmd_special(pmd))) { - pgtable = pte_alloc_one(dst_mm); - if (unlikely(!pgtable)) - goto out; + if (arch_needs_pgtable_deposit(dst_vma)) { + pgtable = pte_alloc_one(dst_mm); + if (unlikely(!pgtable)) + goto out; + } dst_ptl = pmd_lock(dst_mm, dst_pmd); src_ptl = pmd_lockptr(src_mm, src_pmd); spin_lock_nested(src_ptl, SINGLE_DEPTH_NESTING); @@ -1854,8 +1856,10 @@ int copy_huge_pmd(struct mm_struct *dst_mm, struct mm_struct *src_mm, /* dax won't reach here, it will be intercepted at vma_needs_copy() */ VM_WARN_ON_ONCE(vma_is_dax(src_vma)); - mm_inc_nr_ptes(dst_mm); - pgtable_trans_huge_deposit(dst_mm, dst_pmd, pgtable); + if (pgtable) { + mm_inc_nr_ptes(dst_mm); + pgtable_trans_huge_deposit(dst_mm, dst_pmd, pgtable); + } goto set_pmd; } -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters
by Xia Fukun 13 Oct '26

13 Oct '26

From: TanZheng <tanzheng(a)kylinos.cn> mainline inclusion from mainline-v7.3-rc1 commit b38f98e176050850f41bb6415f3a71400056623e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19940 CVE: CVE-2026-100075 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When srpt_alloc_rw_ctxs() fails partway through a multi-buffer indirect descriptor, the unwind path destroys RDMA contexts but leaves stale n_rw_ctx and n_rdma values (and a dangling rw_ctxs pointer). Later sq_wr_avail accounting in srpt_queue_response() or srpt_write_pending() can then subtract the wrong number of send queue credits. Reset the counters and clear rw_ctxs after freeing the heap allocation before returning an error. Fixes: b99f8e4d7bcd ("IB/srpt: convert to the generic RDMA READ/WRITE API") Signed-off-by: TanZheng <tanzheng(a)kylinos.cn> Link: https://patch.msgid.link/20260715101550.45345-1-kensanya@163.com Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- drivers/infiniband/ulp/srpt/ib_srpt.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c index 4948d5b446b6..e72e112ebf2e 100644 --- a/drivers/infiniband/ulp/srpt/ib_srpt.c +++ b/drivers/infiniband/ulp/srpt/ib_srpt.c @@ -891,6 +891,7 @@ static int srpt_alloc_rw_ctxs(struct srpt_send_ioctx *ioctx, struct srpt_rdma_ch *ch = ioctx->ch; struct scatterlist *prev = NULL; unsigned prev_nents; + u8 n_rdma, n_rw_ctx; int ret, i; if (nbufs == 1) { @@ -902,6 +903,9 @@ static int srpt_alloc_rw_ctxs(struct srpt_send_ioctx *ioctx, return -ENOMEM; } + n_rw_ctx = ioctx->n_rw_ctx; + n_rdma = ioctx->n_rdma; + for (i = ioctx->n_rw_ctx; i < nbufs; i++, db++) { struct srpt_rw_ctx *ctx = &ioctx->rw_ctxs[i]; u64 remote_addr = be64_to_cpu(db->va); @@ -948,6 +952,9 @@ static int srpt_alloc_rw_ctxs(struct srpt_send_ioctx *ioctx, } if (ioctx->rw_ctxs != &ioctx->s_rw_ctx) kfree(ioctx->rw_ctxs); + ioctx->rw_ctxs = NULL; + ioctx->n_rw_ctx = n_rw_ctx; + ioctx->n_rdma = n_rdma; return ret; } -- 2.34.1

2 1

[PATCH OLK-6.6] mm/huge_memory: fix unconditional pgtable deposit for special huge PMD in copy_huge_pmd()
by Jinjiang Tu 13 Oct '26

13 Oct '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/10116 -------------------------------- In copy_huge_pmd(), the special huge PMD path unconditionally allocates a pgtable and deposits it to the destination PMD. However, the corresponding withdraw in zap_huge_pmd() is guarded by arch_needs_pgtable_deposit(), which returns false on x86 and powerpc64 radix. This asymmetry causes a 4KB pgtable page and an mm->nr_ptes counter increment to leak on every fork+zap cycle of a special huge PMD on those architectures. Guard the deposit in copy_huge_pmd() with the same arch_needs_pgtable_deposit(dst_vma) check, matching what vmf_insert_pfn_pmd() already does at insertion time and what zap_huge_pmd() does at teardown. Fixes: 923e224a1246 ("mm: introduce remap_pfn_range_try_pmd() for PMD-level hugepage mapping") Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- mm/huge_memory.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/mm/huge_memory.c b/mm/huge_memory.c index 805a903d8423..d423824dc67a 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -1834,9 +1834,11 @@ int copy_huge_pmd(struct mm_struct *dst_mm, struct mm_struct *src_mm, pmd = pmdp_get_lockless(src_pmd); if (unlikely(pmd_present(pmd) && pmd_special(pmd))) { - pgtable = pte_alloc_one(dst_mm); - if (unlikely(!pgtable)) - goto out; + if (arch_needs_pgtable_deposit(dst_vma)) { + pgtable = pte_alloc_one(dst_mm); + if (unlikely(!pgtable)) + goto out; + } dst_ptl = pmd_lock(dst_mm, dst_pmd); src_ptl = pmd_lockptr(src_mm, src_pmd); spin_lock_nested(src_ptl, SINGLE_DEPTH_NESTING); @@ -1854,8 +1856,10 @@ int copy_huge_pmd(struct mm_struct *dst_mm, struct mm_struct *src_mm, /* dax won't reach here, it will be intercepted at vma_needs_copy() */ VM_WARN_ON_ONCE(vma_is_dax(src_vma)); - mm_inc_nr_ptes(dst_mm); - pgtable_trans_huge_deposit(dst_mm, dst_pmd, pgtable); + if (pgtable) { + mm_inc_nr_ptes(dst_mm); + pgtable_trans_huge_deposit(dst_mm, dst_pmd, pgtable); + } goto set_pmd; } -- 2.43.0

2 1

[PATCH OLK-6.6 1/1] KVM: arm64: Fix kernel panic due to uninitialized fpmr pointer
by Qinxin Xia 13 Oct '26

13 Oct '26

driver inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8904 ---------------------------------------------------------------------- When the hardware implements FEAT_FPMR but CONFIG_ENABLE_KVM_FPMR is not set in the kernel config, starting a VM crashes the host with the following panic: | Unable to handle kernel paging request at virtual address d6d0b7173a7d8b80 | Mem abort info: | ESR = 0x0000000096000044 | EC = 0x25: DABT (current EL), IL = 32 bits | FSC = 0x04: level 0 translation fault | CM = 0, WnR = 1, TnD = 0, TagAccess = 0 | [d6d0b7173a7d8b80] address between user and kernel address ranges | pc : fpsimd_save+0xd0/0x160 | lr : fpsimd_save+0x38/0x160 | Call trace: | fpsimd_save+0xd0/0x160 | fpsimd_save_and_flush_cpu_state+0x34/0xa8 | kvm_arch_vcpu_put_fp+0xf0/0x250 | kvm_arch_vcpu_put+0x44/0xf0 | vcpu_put+0x20/0x50 | kvm_arch_vcpu_ioctl_run+0x70/0x630 | Kernel panic - not syncing: Oops: Fatal exception The root cause is an asymmetric gating of the FPMR context switch introduced when backporting upstream FPMR support: - The consumer side (fpsimd_save()) saves FPMR whenever the hardware capability is detected at runtime: if (system_supports_fpmr()) *(last->fpmr) = read_sysreg_s(SYS_FPMR); - The producer side (kvm_arch_vcpu_ctxsync_fp()) only assigns fp_state.fpmr under #ifdef CONFIG_ENABLE_KVM_FPMR, while the struct cpu_fp_state stack variable is left uninitialized. With the config disabled, fpsimd_bind_state_to_cpu() binds stack garbage into the per-CPU fpsimd_last_state.fpmr, and the first guest exit writes FPMR to this garbage pointer, causing the above level 0 translation fault. Fixes: 17d5edd67293d ("KVM: arm64: Add save/restore support for FPMR") Signed-off-by: Qinxin Xia <xiaqinxin(a)huawei.com> Signed-off-by: Hongye Lin <linhongye(a)h-partners.com> --- arch/arm64/kernel/fpsimd.c | 2 +- arch/arm64/kvm/fpsimd.c | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/arch/arm64/kernel/fpsimd.c b/arch/arm64/kernel/fpsimd.c index a81103cdcbdb..49b5f70f41a5 100644 --- a/arch/arm64/kernel/fpsimd.c +++ b/arch/arm64/kernel/fpsimd.c @@ -478,7 +478,7 @@ static void fpsimd_save(void) if (test_thread_flag(TIF_FOREIGN_FPSTATE)) return; - if (system_supports_fpmr()) + if (system_supports_fpmr() && last->fpmr) *(last->fpmr) = read_sysreg_s(SYS_FPMR); /* diff --git a/arch/arm64/kvm/fpsimd.c b/arch/arm64/kvm/fpsimd.c index 90fb893e47ba..0100acc69964 100644 --- a/arch/arm64/kvm/fpsimd.c +++ b/arch/arm64/kvm/fpsimd.c @@ -122,7 +122,7 @@ void kvm_arch_vcpu_ctxflush_fp(struct kvm_vcpu *vcpu) */ void kvm_arch_vcpu_ctxsync_fp(struct kvm_vcpu *vcpu) { - struct cpu_fp_state fp_state; + struct cpu_fp_state fp_state = { }; WARN_ON_ONCE(!irqs_disabled()); @@ -139,6 +139,8 @@ void kvm_arch_vcpu_ctxsync_fp(struct kvm_vcpu *vcpu) fp_state.svcr = &vcpu->arch.svcr; #ifdef CONFIG_ENABLE_KVM_FPMR fp_state.fpmr = &__vcpu_sys_reg(vcpu, FPMR); +#else + fp_state.fpmr = NULL; #endif fp_state.fp_type = &vcpu->arch.fp_type; -- 2.33.0

2 1

[PATCH openEuler-1.0-LTS v3] netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types
by superdcc97＠163.com 12 Oct '26

12 Oct '26

From: Jozsef Kadlecsik <kadlec(a)netfilter.org> mainline inclusion from mainline-v7.2-rc1 commit e4b4984e28c16406ecb318444dea4a8bf47def3e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17399 CVE: CVE-2026-72436 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Sashiko pointed out that there are a few lockless RCU readers using test_bit() which is a relaxed atomic operation and provides no memory barrier guarantees. Use test_bit_acquire() instead where the operation may run parallel with add/del/gc, i.e. is not one from the next cases - protected by region lock - in a set destroy phase - in a new/temporary set creation phase Fixes: 18f84d41d34f ("netfilter: ipset: Introduce RCU locking in hash:* types") Signed-off-by: Jozsef Kadlecsik <kadlec(a)netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/ipset/ip_set_hash_gen.h [context differences from mainline: f66ee0410b1c: resize still holds set->lock; mtype_ext_size() is absent. 7f7445840b77: bucket position accesses are not annotated. 8238b4579866: test_bit_acquire() is absent; use its generic acquire-load and bit-mask semantics at the lockless readers. Add comment for memory barrier to fix checkpatch warning] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/ipset/ip_set_hash_gen.h | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h index 154b40f2f2a8..305e900b5882 100644 --- a/net/netfilter/ipset/ip_set_hash_gen.h +++ b/net/netfilter/ipset/ip_set_hash_gen.h @@ -588,7 +588,9 @@ mtype_resize(struct ip_set *set, bool retried) if (!n) continue; for (j = 0; j < n->pos; j++) { - if (!test_bit(j, n->used)) + /* Pairs with mtype_add()'s smp_mb__before_atomic(). */ + if (!(smp_load_acquire(&n->used[BIT_WORD(j)]) & + BIT_MASK(j))) continue; data = ahash_data(n, j, dsize); #ifdef IP_SET_HASH_WITH_NETS @@ -947,7 +949,9 @@ mtype_test_cidrs(struct ip_set *set, struct mtype_elem *d, if (!n) continue; for (i = 0; i < n->pos; i++) { - if (!test_bit(i, n->used)) + /* Pairs with mtype_add()'s smp_mb__before_atomic(). */ + if (!(smp_load_acquire(&n->used[BIT_WORD(i)]) & + BIT_MASK(i))) continue; data = ahash_data(n, i, set->dsize); if (!mtype_data_equal(data, d, &multi)) @@ -1002,7 +1006,9 @@ mtype_test(struct ip_set *set, void *value, const struct ip_set_ext *ext, goto out; } for (i = 0; i < n->pos; i++) { - if (!test_bit(i, n->used)) + /* Pairs with mtype_add()'s smp_mb__before_atomic(). */ + if (!(smp_load_acquire(&n->used[BIT_WORD(i)]) & + BIT_MASK(i))) continue; data = ahash_data(n, i, set->dsize); if (!mtype_data_equal(data, d, &multi)) @@ -1128,7 +1134,9 @@ mtype_list(const struct ip_set *set, if (!n) continue; for (i = 0; i < n->pos; i++) { - if (!test_bit(i, n->used)) + /* Pairs with mtype_add()'s smp_mb__before_atomic(). */ + if (!(smp_load_acquire(&n->used[BIT_WORD(i)]) & + BIT_MASK(i))) continue; e = ahash_data(n, i, set->dsize); if (SET_WITH_TIMEOUT(set) && -- 2.43.0

2 1

[PATCH OLK-6.6] bpf: reject BPF_PSEUDO_FUNC reference to the main program
by Pu Lehui 12 Oct '26

12 Oct '26

From: Eduard Zingerman <eddyz87(a)gmail.com> stable inclusion from stable-v6.6.158 commit 8cb75f7ada25b1cf25f2f74dec3ba649b9064a09 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19759 CVE: CVE-2026-98075 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 374b2c5561db80fcdd7cdce44af37a49416f61c7 ] fixups.c:jit_subprogs() rewrites BPF_PSEUDO_FUNC loads to contain real function addresses. This function is invoked from bpf_jit_subprogs() only when env->subprog_cnt > 1. Meaning that for any program like below: int main(void *ctx) { void *ptr = main; ... bpf_timer_set_callback(..., ptr); ... } The 'ptr' won't be ever converted to contain an address. In combination with e.g. bpf_timer_set_callback() this would lead to a function call at a bogus address. Instead of complicating the implementation, just assume that no useful program needs main to be a sync or async callback and reject BPF_PSEUDO_FUNC loads for the main subprogram. Fixes: 69c087ba6225 ("bpf: Add bpf_for_each_map_elem() helper") Reported-by: Nicholas Carlini <npc(a)anthropic.com> Suggested-by: Nicholas Carlini <npc(a)anthropic.com> Signed-off-by: Eduard Zingerman <eddyz87(a)gmail.com> Link: https://lore.kernel.org/r/20260902233658.1186477-1-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/verifier.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index c9921971950d..b796d985e420 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -15286,6 +15286,15 @@ static int check_ld_imm(struct bpf_verifier_env *env, struct bpf_insn *insn) verbose(env, "callback function not static\n"); return -EINVAL; } + /* + * When env->subprog_cnt == 1 this instruction won't be rewritten + * to hold a real function address. Assume that no usable program + * combines e.g. main and timer callback and just reject here. + */ + if (subprogno == 0) { + verbose(env, "callback function cannot be the main program\n"); + return -EINVAL; + } dst_reg->type = PTR_TO_FUNC; dst_reg->subprogno = subprogno; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS v2] netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types
by superdcc97＠163.com 12 Oct '26

12 Oct '26

From: Jozsef Kadlecsik <kadlec(a)netfilter.org> mainline inclusion from mainline-v7.2-rc1 commit e4b4984e28c16406ecb318444dea4a8bf47def3e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17399 CVE: CVE-2026-72436 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Sashiko pointed out that there are a few lockless RCU readers using test_bit() which is a relaxed atomic operation and provides no memory barrier guarantees. Use test_bit_acquire() instead where the operation may run parallel with add/del/gc, i.e. is not one from the next cases - protected by region lock - in a set destroy phase - in a new/temporary set creation phase Fixes: 18f84d41d34f ("netfilter: ipset: Introduce RCU locking in hash:* types") Signed-off-by: Jozsef Kadlecsik <kadlec(a)netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/ipset/ip_set_hash_gen.h [context differences from mainline: f66ee0410b1c: resize still holds set->lock; mtype_ext_size() is absent. 7f7445840b77: bucket position accesses are not annotated. 8238b4579866: test_bit_acquire() is absent; use its generic acquire-load and bit-mask semantics at the three lockless readers. Add comment for memory barrier to fix checkpatch warning] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/ipset/ip_set_hash_gen.h | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h index 154b40f2f2a8..10c6af0f4984 100644 --- a/net/netfilter/ipset/ip_set_hash_gen.h +++ b/net/netfilter/ipset/ip_set_hash_gen.h @@ -588,7 +588,9 @@ mtype_resize(struct ip_set *set, bool retried) if (!n) continue; for (j = 0; j < n->pos; j++) { - if (!test_bit(j, n->used)) + /* Pairs with mtype_add()'s smp_mb__before_atomic(). */ + if (!(smp_load_acquire(&n->used[BIT_WORD(i)]) & + BIT_MASK(i))) continue; data = ahash_data(n, j, dsize); #ifdef IP_SET_HASH_WITH_NETS @@ -947,7 +949,9 @@ mtype_test_cidrs(struct ip_set *set, struct mtype_elem *d, if (!n) continue; for (i = 0; i < n->pos; i++) { - if (!test_bit(i, n->used)) + /* Pairs with mtype_add()'s smp_mb__before_atomic(). */ + if (!(smp_load_acquire(&n->used[BIT_WORD(i)]) & + BIT_MASK(i))) continue; data = ahash_data(n, i, set->dsize); if (!mtype_data_equal(data, d, &multi)) @@ -1002,7 +1006,9 @@ mtype_test(struct ip_set *set, void *value, const struct ip_set_ext *ext, goto out; } for (i = 0; i < n->pos; i++) { - if (!test_bit(i, n->used)) + /* Pairs with mtype_add()'s smp_mb__before_atomic(). */ + if (!(smp_load_acquire(&n->used[BIT_WORD(i)]) & + BIT_MASK(i))) continue; data = ahash_data(n, i, set->dsize); if (!mtype_data_equal(data, d, &multi)) @@ -1128,7 +1134,9 @@ mtype_list(const struct ip_set *set, if (!n) continue; for (i = 0; i < n->pos; i++) { - if (!test_bit(i, n->used)) + /* Pairs with mtype_add()'s smp_mb__before_atomic(). */ + if (!(smp_load_acquire(&n->used[BIT_WORD(i)]) & + BIT_MASK(i))) continue; e = ahash_data(n, i, set->dsize); if (SET_WITH_TIMEOUT(set) && -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types
by superdcc97＠163.com 12 Oct '26

12 Oct '26

From: Jozsef Kadlecsik <kadlec(a)netfilter.org> mainline inclusion from mainline-v7.2-rc1 commit e4b4984e28c16406ecb318444dea4a8bf47def3e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17399 CVE: CVE-2026-72436 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Sashiko pointed out that there are a few lockless RCU readers using test_bit() which is a relaxed atomic operation and provides no memory barrier guarantees. Use test_bit_acquire() instead where the operation may run parallel with add/del/gc, i.e. is not one from the next cases - protected by region lock - in a set destroy phase - in a new/temporary set creation phase Fixes: 18f84d41d34f ("netfilter: ipset: Introduce RCU locking in hash:* types") Signed-off-by: Jozsef Kadlecsik <kadlec(a)netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/ipset/ip_set_hash_gen.h [context differences from mainline: f66ee0410b1c: resize still holds set->lock; mtype_ext_size() is absent. 7f7445840b77: bucket position accesses are not annotated. 8238b4579866: test_bit_acquire() is absent; use its generic acquire-load and bit-mask semantics at the three lockless readers.] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/ipset/ip_set_hash_gen.h | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h index 154b40f2f2a8..1cb7e5c1fc61 100644 --- a/net/netfilter/ipset/ip_set_hash_gen.h +++ b/net/netfilter/ipset/ip_set_hash_gen.h @@ -947,7 +947,9 @@ mtype_test_cidrs(struct ip_set *set, struct mtype_elem *d, if (!n) continue; for (i = 0; i < n->pos; i++) { - if (!test_bit(i, n->used)) + /* Pairs with mtype_add()'s smp_mb__before_atomic(). */ + if (!(smp_load_acquire(&n->used[BIT_WORD(i)]) & + BIT_MASK(i))) continue; data = ahash_data(n, i, set->dsize); if (!mtype_data_equal(data, d, &multi)) @@ -1002,7 +1004,9 @@ mtype_test(struct ip_set *set, void *value, const struct ip_set_ext *ext, goto out; } for (i = 0; i < n->pos; i++) { - if (!test_bit(i, n->used)) + /* Pairs with mtype_add()'s smp_mb__before_atomic(). */ + if (!(smp_load_acquire(&n->used[BIT_WORD(i)]) & + BIT_MASK(i))) continue; data = ahash_data(n, i, set->dsize); if (!mtype_data_equal(data, d, &multi)) @@ -1128,7 +1132,9 @@ mtype_list(const struct ip_set *set, if (!n) continue; for (i = 0; i < n->pos; i++) { - if (!test_bit(i, n->used)) + /* Pairs with mtype_add()'s smp_mb__before_atomic(). */ + if (!(smp_load_acquire(&n->used[BIT_WORD(i)]) & + BIT_MASK(i))) continue; e = ahash_data(n, i, set->dsize); if (SET_WITH_TIMEOUT(set) && -- 2.43.0

2 1

[PATCH OLK-5.10 0/2] Fix KASAN: slab-use-after-free Read in r1buf_pool_alloc
by Zhou Minqiang 12 Oct '26

12 Oct '26

Fix KASAN: slab-use-after-free Read in r1buf_pool_alloc Zhou Minqiang (2): md/raid1: change r1conf->r1bio_pool to a pointer type md/raid1: remove struct pool_info and related code drivers/md/raid1.c | 84 +++++++++++++++++----------------------------- drivers/md/raid1.h | 22 +----------- 2 files changed, 31 insertions(+), 75 deletions(-) -- 2.52.0

2 4

[PATCH OLK-6.6] procfs: move dropping pde and pid from ->evict_inode() to ->free_inode()
by Zhou Minqiang 12 Oct '26

12 Oct '26

mainline inclusion from mainline-v6.8-rc6 commit 47458802f6606f652cd0f6dc38cd52ce60ec0145 category: bugfix bugzilla: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- that keeps both around until struct inode is freed, making access to them safe from rcu-pathwalk Acked-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Zhou Minqiang <zhouminqiang2(a)huawei.com> --- fs/proc/base.c | 2 -- fs/proc/inode.c | 19 ++++++++----------- 2 files changed, 8 insertions(+), 13 deletions(-) diff --git a/fs/proc/base.c b/fs/proc/base.c index 7ee2285910bb..f34e357e9f97 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -1932,8 +1932,6 @@ void proc_pid_evict_inode(struct proc_inode *ei) hlist_del_init_rcu(&ei->sibling_inodes); spin_unlock(&pid->lock); } - - put_pid(pid); } struct inode *proc_pid_make_inode(struct super_block *sb, diff --git a/fs/proc/inode.c b/fs/proc/inode.c index 92772702d369..85a09918507e 100644 --- a/fs/proc/inode.c +++ b/fs/proc/inode.c @@ -30,7 +30,6 @@ static void proc_evict_inode(struct inode *inode) { - struct proc_dir_entry *de; struct ctl_table_header *head; struct proc_inode *ei = PROC_I(inode); @@ -38,17 +37,8 @@ static void proc_evict_inode(struct inode *inode) clear_inode(inode); /* Stop tracking associated processes */ - if (ei->pid) { + if (ei->pid) proc_pid_evict_inode(ei); - ei->pid = NULL; - } - - /* Let go of any associated proc directory entry */ - de = ei->pde; - if (de) { - pde_put(de); - ei->pde = NULL; - } head = ei->sysctl; if (head) { @@ -80,6 +70,13 @@ static struct inode *proc_alloc_inode(struct super_block *sb) static void proc_free_inode(struct inode *inode) { + struct proc_inode *ei = PROC_I(inode); + + if (ei->pid) + put_pid(ei->pid); + /* Let go of any associated proc directory entry */ + if (ei->pde) + pde_put(ei->pde); kmem_cache_free(proc_inode_cachep, PROC_I(inode)); } -- 2.52.0

2 1

[PATCH OLK-6.6 0/2] Fix KASAN: slab-use-after-free Read in r1buf_pool_alloc
by Zhou Minqiang 12 Oct '26

12 Oct '26

Fix KASAN: slab-use-after-free Read in r1buf_pool_alloc Zhou Minqiang (2): md/raid1: change r1conf->r1bio_pool to a pointer type md/raid1: remove struct pool_info and related code drivers/md/raid1.c | 86 +++++++++++++++++----------------------------- drivers/md/raid1.h | 22 +----------- 2 files changed, 32 insertions(+), 76 deletions(-) -- 2.52.0

2 3

[PATCH OLK-5.10] procfs: move dropping pde and pid from ->evict_inode() to ->free_inode()
by Zhou Minqiang 12 Oct '26

12 Oct '26

mainline inclusion from mainline-v6.8-rc6 commit 47458802f6606f652cd0f6dc38cd52ce60ec0145 category: bugfix bugzilla: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- that keeps both around until struct inode is freed, making access to them safe from rcu-pathwalk Acked-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Zhou Minqiang <zhouminqiang2(a)huawei.com> --- fs/proc/base.c | 2 -- fs/proc/inode.c | 19 ++++++++----------- 2 files changed, 8 insertions(+), 13 deletions(-) diff --git a/fs/proc/base.c b/fs/proc/base.c index 845897ca7e54..7fa69a84899d 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -2082,8 +2082,6 @@ void proc_pid_evict_inode(struct proc_inode *ei) hlist_del_init_rcu(&ei->sibling_inodes); spin_unlock(&pid->lock); } - - put_pid(pid); } struct inode *proc_pid_make_inode(struct super_block *sb, diff --git a/fs/proc/inode.c b/fs/proc/inode.c index ba35ffc426ea..df934ded1bf2 100644 --- a/fs/proc/inode.c +++ b/fs/proc/inode.c @@ -32,7 +32,6 @@ static void proc_evict_inode(struct inode *inode) { - struct proc_dir_entry *de; struct ctl_table_header *head; struct proc_inode *ei = PROC_I(inode); @@ -40,17 +39,8 @@ static void proc_evict_inode(struct inode *inode) clear_inode(inode); /* Stop tracking associated processes */ - if (ei->pid) { + if (ei->pid) proc_pid_evict_inode(ei); - ei->pid = NULL; - } - - /* Let go of any associated proc directory entry */ - de = ei->pde; - if (de) { - pde_put(de); - ei->pde = NULL; - } head = ei->sysctl; if (head) { @@ -82,6 +72,13 @@ static struct inode *proc_alloc_inode(struct super_block *sb) static void proc_free_inode(struct inode *inode) { + struct proc_inode *ei = PROC_I(inode); + + if (ei->pid) + put_pid(ei->pid); + /* Let go of any associated proc directory entry */ + if (ei->pde) + pde_put(ei->pde); kmem_cache_free(proc_inode_cachep, PROC_I(inode)); } -- 2.52.0

2 1

[PATCH OLK-5.10] bpf: Don't predict JMP32 pointer vs zero comparisons
by Chen Yuxi 12 Oct '26

12 Oct '26

From: Eduard Zingerman <eddyz87(a)gmail.com> mainline inclusion from mainline-v7.3-rc2 commit e51179a4e09846f8fd0f26a05068520de2b301bf category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19773 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Consider the following program: r1 = map_value; /* low 32 bits are zero at runtime */ r6 = 0xdead000000000000; if w1 != 0 goto l1; l0: r1 += r6; r2 = *(u64 *)(r1 + 0); exit; l1: r6 = 0; goto l0; At the moment is_branch_taken() reports the jump as always taken, because it does not distinguish between BPF_JMP and BPF_JMP32 comparisons when processing 'if w1 != 0 ...'. Fixes: cac616db39c2 ("bpf: Verifier track null pointer branch_taken with JNE and JEQ") Reported-by: Nicholas Carlini <npc(a)anthropic.com> Suggested-by: Nicholas Carlini <npc(a)anthropic.com> Signed-off-by: Eduard Zingerman <eddyz87(a)gmail.com> Link: https://lore.kernel.org/bpf/20260904083325.2083493-5-eddyz87@gmail.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor(a)gmail.com> Conflicts: kernel/bpf/verifier.c [commit b254c6d816e53ca02856b6f46b4dc56caf6e7713 not backport] Signed-off-by: Chen Yuxi <chenyuxi19(a)huawei.com> --- kernel/bpf/verifier.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index d75b3aa76dfc..80fe5730da51 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -7909,6 +7909,13 @@ static int is_branch_taken(struct bpf_reg_state *reg, u64 val, u8 opcode, bool is_jmp32) { if (__is_pointer_value(false, reg)) { + /* + * The low 32 bits of a valid pointer may well be zero, hence + * nothing below applies to a 32-bit comparison. + */ + if (is_jmp32) + return -1; + if (!reg_type_not_null(reg->type)) return -1; -- 2.34.1

2 1

[PATCH OLK-5.10] bpf: mark a NULL call argument precise
by Chen Yuxi 12 Oct '26

12 Oct '26

From: Eduard Zingerman <eddyz87(a)gmail.com> mainline inclusion from mainline-v7.3-rc2 commit 1a3a10b030c96ea88868ccc060a16827c01eaa5a category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19832 CVE: CVE-2026-98019 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- check_func_arg() allows bpf_register_is_null() for nullable arguments w/o marking the underlying scalar register precise. Hence a checkpoint created on such a path would prune against arbitrary scalar value. check_helper_call() enforces second parameter of the bpf_get_local_storage() to be zero, w/o marking the underlying scalar register precise. Hence a checkpoint created on such a path would prune against arbitrary scalar value. Grouping these two into one patch, as they share the same fixes tag. Fixes: b5dc0163d8fd ("bpf: precise scalar_value tracking") Signed-off-by: Eduard Zingerman <eddyz87(a)gmail.com> Link: https://lore.kernel.org/r/20260904-register-is-null-precise-fixes-v1-1-0f5a… Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Conflicts: kernel/bpf/verifier.c, tools/testing/selftests/bpf/progs/verifier_subprog_precision.c [verifier_subprog_precision.c does not exist in 5.10.] Signed-off-by: Chen Yuxi <chenyuxi19(a)huawei.com> --- kernel/bpf/verifier.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index d75b3aa76dfc..3af71ac0da16 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -4926,11 +4926,15 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg, return err; } - if (register_is_null(reg) && type_may_be_null(arg_type)) + if (register_is_null(reg) && type_may_be_null(arg_type)) { /* A NULL register has a SCALAR_VALUE type, so skip * type checking. */ + err = mark_chain_precision(env, regno); + if (err) + return err; goto skip_type_check; + } /* arg_btf_id and arg_size are in a union. */ if (base_type(arg_type) == ARG_PTR_TO_BTF_ID) @@ -5891,10 +5895,14 @@ static int check_helper_call(struct bpf_verifier_env *env, int func_id, int insn /* check that flags argument in get_local_storage(map, flags) is 0, * this is required because get_local_storage() can't return an error. */ - if (func_id == BPF_FUNC_get_local_storage && - !register_is_null(&regs[BPF_REG_2])) { - verbose(env, "get_local_storage() doesn't support non-zero flags\n"); - return -EINVAL; + if (func_id == BPF_FUNC_get_local_storage) { + if (!register_is_null(&regs[BPF_REG_2])) { + verbose(env, "get_local_storage() doesn't support non-zero flags\n"); + return -EINVAL; + } + err = mark_chain_precision(env, BPF_REG_2); + if (err) + return err; } /* reset caller saved regs */ -- 2.34.1

2 1

[PATCH OLK-6.6] bpf: mark a NULL call argument precise
by Chen Yuxi 12 Oct '26

12 Oct '26

From: Eduard Zingerman <eddyz87(a)gmail.com> mainline inclusion from mainline-v7.3-rc2 commit 1a3a10b030c96ea88868ccc060a16827c01eaa5a category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19832 CVE: CVE-2026-98019 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- check_func_arg() allows bpf_register_is_null() for nullable arguments w/o marking the underlying scalar register precise. Hence a checkpoint created on such a path would prune against arbitrary scalar value. check_helper_call() enforces second parameter of the bpf_get_local_storage() to be zero, w/o marking the underlying scalar register precise. Hence a checkpoint created on such a path would prune against arbitrary scalar value. Grouping these two into one patch, as they share the same fixes tag. Fixes: b5dc0163d8fd ("bpf: precise scalar_value tracking") Signed-off-by: Eduard Zingerman <eddyz87(a)gmail.com> Link: https://lore.kernel.org/r/20260904-register-is-null-precise-fixes-v1-1-0f5a… Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Conflicts: kernel/bpf/verifier.c [ctx conflict] Signed-off-by: Chen Yuxi <chenyuxi19(a)huawei.com> --- kernel/bpf/verifier.c | 9 ++++++++- .../selftests/bpf/progs/verifier_subprog_precision.c | 12 ++++++------ 2 files changed, 14 insertions(+), 7 deletions(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 6150ee2a1633..b27408fec62a 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -8692,11 +8692,15 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg, return err; } - if (register_is_null(reg) && type_may_be_null(arg_type)) + if (register_is_null(reg) && type_may_be_null(arg_type)) { /* A NULL register has a SCALAR_VALUE type, so skip * type checking. */ + err = mark_chain_precision(env, regno); + if (err) + return err; goto skip_type_check; + } /* arg_btf_id and arg_size are in a union. */ if (base_type(arg_type) == ARG_PTR_TO_BTF_ID || @@ -10369,6 +10373,9 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn verbose(env, "get_local_storage() doesn't support non-zero flags\n"); return -EINVAL; } + err = mark_chain_precision(env, BPF_REG_2); + if (err) + return err; break; case BPF_FUNC_for_each_map_elem: err = push_callback_call(env, insn, insn_idx, meta.subprogno, diff --git a/tools/testing/selftests/bpf/progs/verifier_subprog_precision.c b/tools/testing/selftests/bpf/progs/verifier_subprog_precision.c index 83d187de7f6b..d444b32d0af3 100644 --- a/tools/testing/selftests/bpf/progs/verifier_subprog_precision.c +++ b/tools/testing/selftests/bpf/progs/verifier_subprog_precision.c @@ -150,9 +150,9 @@ __msg("17: (b7) r0 = 0") __msg("18: (95) exit") __msg("returning from callee:") __msg("to caller at 9:") -__msg("frame 0: propagating r1,r4") +__msg("frame 0: propagating r1,r3,r4") __msg("mark_precise: frame0: last_idx 9 first_idx 9 subseq_idx -1") -__msg("mark_precise: frame0: regs=r1,r4 stack= before 18: (95) exit") +__msg("mark_precise: frame0: regs=r1,r3,r4 stack= before 18: (95) exit") __msg("from 18 to 9: safe") __naked int callback_result_precise(void) { @@ -282,9 +282,9 @@ __msg("to caller at 9:") /* r1, r4 are always precise for bpf_loop(), * r6 was marked before backtracking to callback body. */ -__msg("frame 0: propagating r1,r4,r6") +__msg("frame 0: propagating r1,r3,r4,r6") __msg("mark_precise: frame0: last_idx 9 first_idx 9 subseq_idx -1") -__msg("mark_precise: frame0: regs=r1,r4,r6 stack= before 16: (95) exit") +__msg("mark_precise: frame0: regs=r1,r3,r4,r6 stack= before 16: (95) exit") __msg("mark_precise: frame1: regs= stack= before 15: (b7) r0 = 0") __msg("mark_precise: frame1: regs= stack= before 9: (85) call bpf_loop") __msg("mark_precise: frame0: parent state regs= stack=:") @@ -438,9 +438,9 @@ __msg("to caller at 10:") /* r1, r4 are always precise for bpf_loop(), * fp-8 was marked before backtracking to callback body. */ -__msg("frame 0: propagating r1,r4,fp-8") +__msg("frame 0: propagating r1,r3,r4,fp-8") __msg("mark_precise: frame0: last_idx 10 first_idx 10 subseq_idx -1") -__msg("mark_precise: frame0: regs=r1,r4 stack=-8 before 18: (95) exit") +__msg("mark_precise: frame0: regs=r1,r3,r4 stack=-8 before 18: (95) exit") __msg("mark_precise: frame1: regs= stack= before 17: (b7) r0 = 0") __msg("mark_precise: frame1: regs= stack= before 10: (85) call bpf_loop#181") __msg("mark_precise: frame0: parent state regs= stack=:") -- 2.34.1

2 1

[PATCH OLK-6.6 0/9] cache: Support cache maintenance for HiSilicon
by Yushan Wang 12 Oct '26

12 Oct '26

From: Hongye Lin <linhongye(a)h-partners.com> driver inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/10043 ---------------------------------------------------------------------- Jonathan Cameron (4): memregion: Drop unused IORES_DESC_* parameter from cpu_cache_invalidate_memregion() arm64: Select GENERIC_CPU_CACHE_MAINTENANCE MAINTAINERS: Add Jonathan Cameron to drivers/cache and add lib/cache_maint.c + header cache: Make top level Kconfig menu a boolean dependent on RISCV Yicong Yang (2): memregion: Support fine grained invalidate by cpu_cache_invalidate_memregion() lib: Support ARCH_HAS_CPU_CACHE_INVALIDATE_MEMREGION Yushan Wang (3): soc cache: remove old cache maintain cache: Support cache maintenance for HiSilicon SoC Hydra Home Agent defconfig: Add cache maintain related config MAINTAINERS | 4 +- arch/arm64/Kconfig | 2 + arch/arm64/configs/openeuler_defconfig | 9 +- arch/x86/mm/pat/set_memory.c | 2 +- drivers/cache/Kconfig | 28 +++- drivers/cache/Makefile | 2 + .../{soc/hisilicon => cache}/hisi_soc_hha.c | 152 +++++++++--------- drivers/cxl/core/region.c | 5 +- drivers/nvdimm/region.c | 2 +- drivers/nvdimm/region_devs.c | 2 +- drivers/soc/hisilicon/Kconfig | 12 -- drivers/soc/hisilicon/Makefile | 1 - .../soc/hisilicon/hisi_soc_cache_framework.c | 112 ------------- .../soc/hisilicon/hisi_soc_cache_framework.h | 10 -- include/linux/cache_coherency.h | 61 +++++++ include/linux/memregion.h | 16 +- .../uapi/misc/hisi_soc_cache/hisi_soc_cache.h | 37 ----- lib/Kconfig | 3 + lib/Makefile | 2 + lib/cache_maint.c | 138 ++++++++++++++++ 20 files changed, 338 insertions(+), 262 deletions(-) rename drivers/{soc/hisilicon => cache}/hisi_soc_hha.c (50%) create mode 100644 include/linux/cache_coherency.h delete mode 100644 include/uapi/misc/hisi_soc_cache/hisi_soc_cache.h create mode 100644 lib/cache_maint.c -- 2.33.0

2 10

[PATCH OLK-6.6 00/10] cache: Support cache maintenance for HiSilicon
by Yushan Wang 12 Oct '26

12 Oct '26

From: Hongye Lin <linhongye(a)h-partners.com> driver inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/10043 ---------------------------------------------------------------------- Jonathan Cameron (4): memregion: Drop unused IORES_DESC_* parameter from cpu_cache_invalidate_memregion() arm64: Select GENERIC_CPU_CACHE_MAINTENANCE MAINTAINERS: Add Jonathan Cameron to drivers/cache and add lib/cache_maint.c + header cache: Make top level Kconfig menu a boolean dependent on RISCV Yicong Yang (2): memregion: Support fine grained invalidate by cpu_cache_invalidate_memregion() lib: Support ARCH_HAS_CPU_CACHE_INVALIDATE_MEMREGION Yushan Wang (4): mm: reclaim_notify: move struct reclaim_notify_data out of CONFIG_RECLAIM_NOTIFY soc cache: remove old cache maintain cache: Support cache maintenance for HiSilicon SoC Hydra Home Agent defconfig: Add cache maintain related config MAINTAINERS | 4 +- arch/arm64/Kconfig | 2 + arch/arm64/configs/openeuler_defconfig | 9 +- arch/x86/mm/pat/set_memory.c | 2 +- drivers/cache/Kconfig | 28 +++- drivers/cache/Makefile | 2 + .../{soc/hisilicon => cache}/hisi_soc_hha.c | 152 +++++++++--------- drivers/cxl/core/region.c | 5 +- drivers/nvdimm/region.c | 2 +- drivers/nvdimm/region_devs.c | 2 +- drivers/soc/hisilicon/Kconfig | 12 -- drivers/soc/hisilicon/Makefile | 1 - .../soc/hisilicon/hisi_soc_cache_framework.c | 112 ------------- .../soc/hisilicon/hisi_soc_cache_framework.h | 10 -- include/linux/cache_coherency.h | 61 +++++++ include/linux/memregion.h | 16 +- include/linux/mm.h | 3 +- .../uapi/misc/hisi_soc_cache/hisi_soc_cache.h | 37 ----- lib/Kconfig | 3 + lib/Makefile | 2 + lib/cache_maint.c | 138 ++++++++++++++++ 21 files changed, 339 insertions(+), 264 deletions(-) rename drivers/{soc/hisilicon => cache}/hisi_soc_hha.c (50%) create mode 100644 include/linux/cache_coherency.h delete mode 100644 include/uapi/misc/hisi_soc_cache/hisi_soc_cache.h create mode 100644 lib/cache_maint.c -- 2.33.0

2 11

[PATCH OLK-5.10] openvswitch: Fix CT limit teardown use-after-free
by Gu Bowen 10 Oct '26

10 Oct '26

From: Yuqi Xu <xuyuqiabc(a)gmail.com> stable inclusion from stable-v5.10.270 commit 239f26589a6926db28c436e14f28517581ef1385 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18852 CVE: CVE-2026-89488 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 403f96c32c9e24600093d7d0c61c17daeedca957 ] Packet processing uses CT limit state under RCU, while netns teardown frees that state under ovs_mutex. The CT limit pointer was neither removed from readers nor protected by a grace period, allowing packet processing to dereference the freed state. An unprivileged user can trigger this bug from a user and network namespace, causing a slab-use-after-free in ovs_ct_execute() when the netns is torn down. Publish the CT limit pointer through RCU, remove it before teardown, and wait for readers before freeing its contents. Keep ovs_mutex around individual CT limit updates, and use the RCU read-side lock while GET traverses the RCU-protected limit lists. Netns teardown detaches the RCU-protected CT limit state in the pernet .pre_exit callback while holding ovs_mutex. The pernet core guarantees an RCU grace period between the .pre_exit and .exit callbacks, so the .exit callback completes the teardown without adding any extra synchronization. The netlink command handlers do not need NULL checks because the userspace netlink socket holds an active reference to its network namespace while a request is processed. The per-netns exit path therefore cannot run concurrently with SET, DEL, or GET for that socket's namespace. Fixes: 11efd5cb04a1 ("openvswitch: Support conntrack zone limit") Cc: stable(a)vger.kernel.org Reported-by: Vega <vega(a)nebusec.ai> Link: https://lore.kernel.org/all/cover.1784711445.git.xuyuqiabc@gmail.com Co-developed-by: Nan Li <tonanli66(a)gmail.com> Signed-off-by: Nan Li <tonanli66(a)gmail.com> Signed-off-by: Yuqi Xu <xuyuqiabc(a)gmail.com> Reviewed-by: Ren Wei <enjou1224z(a)gmail.com> Reviewed-by: Ilya Maximets <i.maximets(a)ovn.org> Link: https://patch.msgid.link/288fbd5459d92b9dd0dcc6faf625f04819161ff3.178728029… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> [ 7.0+ uses kmalloc_obj[s] while older versions use kmalloc[_array] 6.12+ doesn't have a 'family' argument in nf_conncount_init/destroy ] Signed-off-by: Ilya Maximets <i.maximets(a)ovn.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: net/openvswitch/conntrack.c net/openvswitch/datapath.h [Context conflicts.] Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- net/openvswitch/conntrack.c | 122 +++++++++++++++++++++++------------- net/openvswitch/conntrack.h | 6 +- net/openvswitch/datapath.c | 10 ++- net/openvswitch/datapath.h | 7 ++- 4 files changed, 98 insertions(+), 47 deletions(-) diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c index 30f5e414018b..c52818a9f38d 100644 --- a/net/openvswitch/conntrack.c +++ b/net/openvswitch/conntrack.c @@ -1156,10 +1156,14 @@ static int ovs_ct_check_limit(struct net *net, const struct nf_conntrack_tuple *tuple) { struct ovs_net *ovs_net = net_generic(net, ovs_net_id); - const struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info; + const struct ovs_ct_limit_info *ct_limit_info; u32 per_zone_limit, connections; u32 conncount_key; + ct_limit_info = rcu_dereference(ovs_net->ct_limit_info); + if (!ct_limit_info) + return 0; + conncount_key = info->zone.id; per_zone_limit = ct_limit_get(ct_limit_info, info->zone.id); @@ -1861,43 +1865,56 @@ static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info) #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) static int ovs_ct_limit_init(struct net *net, struct ovs_net *ovs_net) { + struct ovs_ct_limit_info *info; int i, err; - ovs_net->ct_limit_info = kmalloc(sizeof(*ovs_net->ct_limit_info), - GFP_KERNEL); - if (!ovs_net->ct_limit_info) + info = kmalloc(sizeof(*info), GFP_KERNEL); + if (!info) return -ENOMEM; - ovs_net->ct_limit_info->default_limit = OVS_CT_LIMIT_DEFAULT; - ovs_net->ct_limit_info->limits = + info->default_limit = OVS_CT_LIMIT_DEFAULT; + info->limits = kmalloc_array(CT_LIMIT_HASH_BUCKETS, sizeof(struct hlist_head), GFP_KERNEL); - if (!ovs_net->ct_limit_info->limits) { - kfree(ovs_net->ct_limit_info); + if (!info->limits) { + kfree(info); return -ENOMEM; } for (i = 0; i < CT_LIMIT_HASH_BUCKETS; i++) - INIT_HLIST_HEAD(&ovs_net->ct_limit_info->limits[i]); + INIT_HLIST_HEAD(&info->limits[i]); - ovs_net->ct_limit_info->data = - nf_conncount_init(net, NFPROTO_INET, sizeof(u32)); + info->data = nf_conncount_init(net, NFPROTO_INET, sizeof(u32)); - if (IS_ERR(ovs_net->ct_limit_info->data)) { - err = PTR_ERR(ovs_net->ct_limit_info->data); - kfree(ovs_net->ct_limit_info->limits); - kfree(ovs_net->ct_limit_info); + if (IS_ERR(info->data)) { + err = PTR_ERR(info->data); + kfree(info->limits); + kfree(info); pr_err("openvswitch: failed to init nf_conncount %d\n", err); return err; } + rcu_assign_pointer(ovs_net->ct_limit_info, info); return 0; } -static void ovs_ct_limit_exit(struct net *net, struct ovs_net *ovs_net) +static void *ovs_ct_limit_exit_start(struct ovs_net *ovs_net) +{ + return rcu_replace_pointer(ovs_net->ct_limit_info, NULL, + lockdep_ovsl_is_held()); +} + +/* The CT limit state must be detached by ovs_ct_limit_exit_start() and an + * RCU grace period must elapse before this function runs. The pernet core + * guarantees the grace period between the .pre_exit and .exit callbacks. + */ +static void ovs_ct_limit_exit_finish(struct net *net, void *data) { - const struct ovs_ct_limit_info *info = ovs_net->ct_limit_info; + const struct ovs_ct_limit_info *info = data; int i; + if (!info) + return; + nf_conncount_destroy(net, NFPROTO_INET, info->data); for (i = 0; i < CT_LIMIT_HASH_BUCKETS; ++i) { struct hlist_head *head = &info->limits[i]; @@ -1905,7 +1922,7 @@ static void ovs_ct_limit_exit(struct net *net, struct ovs_net *ovs_net) struct hlist_node *next; hlist_for_each_entry_safe(ct_limit, next, head, hlist_node) - kfree_rcu(ct_limit, rcu); + kfree(ct_limit); } kfree(info->limits); kfree(info); @@ -1944,12 +1961,13 @@ static bool check_zone_id(int zone_id, u16 *pzone) return false; } -static int ovs_ct_limit_set_zone_limit(struct nlattr *nla_zone_limit, - struct ovs_ct_limit_info *info) +static int ovs_ct_limit_set_zone_limit(struct ovs_net *ovs_net, + struct nlattr *nla_zone_limit) { struct ovs_zone_limit *zone_limit; - int rem; + struct ovs_ct_limit_info *info; u16 zone; + int rem; rem = NLA_ALIGN(nla_len(nla_zone_limit)); zone_limit = (struct ovs_zone_limit *)nla_data(nla_zone_limit); @@ -1958,6 +1976,7 @@ static int ovs_ct_limit_set_zone_limit(struct nlattr *nla_zone_limit, if (unlikely(zone_limit->zone_id == OVS_ZONE_LIMIT_DEFAULT_ZONE)) { ovs_lock(); + info = ovsl_dereference(ovs_net->ct_limit_info); info->default_limit = zone_limit->limit; ovs_unlock(); } else if (unlikely(!check_zone_id( @@ -1974,6 +1993,7 @@ static int ovs_ct_limit_set_zone_limit(struct nlattr *nla_zone_limit, ct_limit->limit = zone_limit->limit; ovs_lock(); + info = ovsl_dereference(ovs_net->ct_limit_info); ct_limit_set(info, ct_limit); ovs_unlock(); } @@ -1988,12 +2008,13 @@ static int ovs_ct_limit_set_zone_limit(struct nlattr *nla_zone_limit, return 0; } -static int ovs_ct_limit_del_zone_limit(struct nlattr *nla_zone_limit, - struct ovs_ct_limit_info *info) +static int ovs_ct_limit_del_zone_limit(struct ovs_net *ovs_net, + struct nlattr *nla_zone_limit) { struct ovs_zone_limit *zone_limit; - int rem; + struct ovs_ct_limit_info *info; u16 zone; + int rem; rem = NLA_ALIGN(nla_len(nla_zone_limit)); zone_limit = (struct ovs_zone_limit *)nla_data(nla_zone_limit); @@ -2002,6 +2023,7 @@ static int ovs_ct_limit_del_zone_limit(struct nlattr *nla_zone_limit, if (unlikely(zone_limit->zone_id == OVS_ZONE_LIMIT_DEFAULT_ZONE)) { ovs_lock(); + info = ovsl_dereference(ovs_net->ct_limit_info); info->default_limit = OVS_CT_LIMIT_DEFAULT; ovs_unlock(); } else if (unlikely(!check_zone_id( @@ -2009,6 +2031,7 @@ static int ovs_ct_limit_del_zone_limit(struct nlattr *nla_zone_limit, OVS_NLERR(true, "zone id is out of range"); } else { ovs_lock(); + info = ovsl_dereference(ovs_net->ct_limit_info); ct_limit_del(info, zone); ovs_unlock(); } @@ -2052,6 +2075,7 @@ static int __ovs_ct_limit_get_zone_limit(struct net *net, return nla_put_nohdr(reply, sizeof(zone_limit), &zone_limit); } +/* Called with RCU read lock held. */ static int ovs_ct_limit_get_zone_limit(struct net *net, struct nlattr *nla_zone_limit, struct ovs_ct_limit_info *info, @@ -2075,9 +2099,7 @@ static int ovs_ct_limit_get_zone_limit(struct net *net, &zone))) { OVS_NLERR(true, "zone id is out of range"); } else { - rcu_read_lock(); limit = ct_limit_get(info, zone); - rcu_read_unlock(); err = __ovs_ct_limit_get_zone_limit( net, info->data, zone, limit, reply); @@ -2095,6 +2117,7 @@ static int ovs_ct_limit_get_zone_limit(struct net *net, return 0; } +/* Called with RCU read lock held. */ static int ovs_ct_limit_get_all_zone_limit(struct net *net, struct ovs_ct_limit_info *info, struct sk_buff *reply) @@ -2107,19 +2130,16 @@ static int ovs_ct_limit_get_all_zone_limit(struct net *net, if (err) return err; - rcu_read_lock(); for (i = 0; i < CT_LIMIT_HASH_BUCKETS; ++i) { head = &info->limits[i]; hlist_for_each_entry_rcu(ct_limit, head, hlist_node) { err = __ovs_ct_limit_get_zone_limit(net, info->data, ct_limit->zone, ct_limit->limit, reply); if (err) - goto exit_err; + return err; } } -exit_err: - rcu_read_unlock(); return err; } @@ -2129,7 +2149,6 @@ static int ovs_ct_limit_cmd_set(struct sk_buff *skb, struct genl_info *info) struct sk_buff *reply; struct ovs_header *ovs_reply_header; struct ovs_net *ovs_net = net_generic(sock_net(skb->sk), ovs_net_id); - struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info; int err; reply = ovs_ct_limit_cmd_reply_start(info, OVS_CT_LIMIT_CMD_SET, @@ -2142,8 +2161,8 @@ static int ovs_ct_limit_cmd_set(struct sk_buff *skb, struct genl_info *info) goto exit_err; } - err = ovs_ct_limit_set_zone_limit(a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT], - ct_limit_info); + err = ovs_ct_limit_set_zone_limit(ovs_net, + a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]); if (err) goto exit_err; @@ -2163,7 +2182,6 @@ static int ovs_ct_limit_cmd_del(struct sk_buff *skb, struct genl_info *info) struct sk_buff *reply; struct ovs_header *ovs_reply_header; struct ovs_net *ovs_net = net_generic(sock_net(skb->sk), ovs_net_id); - struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info; int err; reply = ovs_ct_limit_cmd_reply_start(info, OVS_CT_LIMIT_CMD_DEL, @@ -2176,8 +2194,8 @@ static int ovs_ct_limit_cmd_del(struct sk_buff *skb, struct genl_info *info) goto exit_err; } - err = ovs_ct_limit_del_zone_limit(a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT], - ct_limit_info); + err = ovs_ct_limit_del_zone_limit(ovs_net, + a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]); if (err) goto exit_err; @@ -2197,7 +2215,7 @@ static int ovs_ct_limit_cmd_get(struct sk_buff *skb, struct genl_info *info) struct ovs_header *ovs_reply_header; struct net *net = sock_net(skb->sk); struct ovs_net *ovs_net = net_generic(net, ovs_net_id); - struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info; + struct ovs_ct_limit_info *ct_limit_info; int err; reply = ovs_ct_limit_cmd_reply_start(info, OVS_CT_LIMIT_CMD_GET, @@ -2211,18 +2229,19 @@ static int ovs_ct_limit_cmd_get(struct sk_buff *skb, struct genl_info *info) goto exit_err; } + rcu_read_lock(); + ct_limit_info = rcu_dereference(ovs_net->ct_limit_info); if (a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]) { err = ovs_ct_limit_get_zone_limit( net, a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT], ct_limit_info, reply); - if (err) - goto exit_err; } else { err = ovs_ct_limit_get_all_zone_limit(net, ct_limit_info, reply); - if (err) - goto exit_err; } + rcu_read_unlock(); + if (err) + goto exit_err; nla_nest_end(reply, nla_reply); genlmsg_end(reply, ovs_reply_header); @@ -2292,12 +2311,29 @@ int ovs_ct_init(struct net *net) #endif } -void ovs_ct_exit(struct net *net) +/* Must be called with ovs_mutex held. Detaches the RCU-protected + * ct_limit_info and stores it in ovs_net->ct_limit_exit_data for + * ovs_ct_exit_finish() to complete the teardown after an RCU grace period. + */ +void ovs_ct_exit_start(struct net *net __maybe_unused) +{ +#if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) + struct ovs_net *ovs_net = net_generic(net, ovs_net_id); + + ovs_net->ct_limit_exit_data = ovs_ct_limit_exit_start(ovs_net); +#endif +} + +/* Completes the CT limit teardown. The pernet core guarantees an RCU + * grace period between detaching the state in ovs_ct_exit_start() and + * this call, so no RCU readers remain. + */ +void ovs_ct_exit_finish(struct net *net) { struct ovs_net *ovs_net = net_generic(net, ovs_net_id); #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) - ovs_ct_limit_exit(net, ovs_net); + ovs_ct_limit_exit_finish(net, ovs_net->ct_limit_exit_data); #endif if (ovs_net->xt_label) diff --git a/net/openvswitch/conntrack.h b/net/openvswitch/conntrack.h index 59dc32761b91..ad9081d7023d 100644 --- a/net/openvswitch/conntrack.h +++ b/net/openvswitch/conntrack.h @@ -14,7 +14,8 @@ enum ovs_key_attr; #if IS_ENABLED(CONFIG_NF_CONNTRACK) int ovs_ct_init(struct net *); -void ovs_ct_exit(struct net *); +void ovs_ct_exit_start(struct net *net); +void ovs_ct_exit_finish(struct net *net); bool ovs_ct_verify(struct net *, enum ovs_key_attr attr); int ovs_ct_copy_action(struct net *, const struct nlattr *, const struct sw_flow_key *, struct sw_flow_actions **, @@ -39,7 +40,8 @@ void ovs_ct_free_action(const struct nlattr *a); static inline int ovs_ct_init(struct net *net) { return 0; } -static inline void ovs_ct_exit(struct net *net) { } +static inline void ovs_ct_exit_start(struct net *net) { } +static inline void ovs_ct_exit_finish(struct net *net) { } static inline bool ovs_ct_verify(struct net *net, int attr) { diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c index ec1e4af1dec0..34170c744cc3 100644 --- a/net/openvswitch/datapath.c +++ b/net/openvswitch/datapath.c @@ -2575,6 +2575,13 @@ static void __net_exit list_vports_from_net(struct net *net, struct net *dnet, } } +static void __net_exit ovs_pre_exit_net(struct net *dnet) +{ + ovs_lock(); + ovs_ct_exit_start(dnet); + ovs_unlock(); +} + static void __net_exit ovs_exit_net(struct net *dnet) { struct datapath *dp, *dp_next; @@ -2585,7 +2592,7 @@ static void __net_exit ovs_exit_net(struct net *dnet) ovs_lock(); - ovs_ct_exit(dnet); + ovs_ct_exit_finish(dnet); list_for_each_entry_safe(dp, dp_next, &ovs_net->dps, list_node) __dp_destroy(dp); @@ -2609,6 +2616,7 @@ static void __net_exit ovs_exit_net(struct net *dnet) static struct pernet_operations ovs_net_ops = { .init = ovs_init_net, + .pre_exit = ovs_pre_exit_net, .exit = ovs_exit_net, .id = &ovs_net_id, .size = sizeof(struct ovs_net), diff --git a/net/openvswitch/datapath.h b/net/openvswitch/datapath.h index 62e7ad32f837..a796a60fea2f 100644 --- a/net/openvswitch/datapath.h +++ b/net/openvswitch/datapath.h @@ -131,13 +131,18 @@ struct dp_upcall_info { * struct ovs_net - Per net-namespace data for ovs. * @dps: List of datapaths to enable dumping them all out. * Protected by genl_mutex. + * @ct_limit_info: Hash table of conntrack zone connection limits. Protected + * by RCU; updates and teardown are serialized by ovs_mutex. May be NULL during + * netns teardown. + * @ct_limit_exit_data: CT limit state detached at .pre_exit, freed at .exit. */ struct ovs_net { struct list_head dps; struct work_struct dp_notify_work; struct delayed_work masks_rebalance; #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) - struct ovs_ct_limit_info *ct_limit_info; + struct ovs_ct_limit_info __rcu *ct_limit_info; + struct ovs_ct_limit_info *ct_limit_exit_data; #endif /* Module reference for configuring conntrack. */ -- 2.43.0

2 1

[PATCH OLK-5.10] openvswitch: Fix CT limit teardown use-after-free
by Gu Bowen 10 Oct '26

10 Oct '26

From: Yuqi Xu <xuyuqiabc(a)gmail.com> [ Upstream commit 403f96c32c9e24600093d7d0c61c17daeedca957 ] Packet processing uses CT limit state under RCU, while netns teardown frees that state under ovs_mutex. The CT limit pointer was neither removed from readers nor protected by a grace period, allowing packet processing to dereference the freed state. An unprivileged user can trigger this bug from a user and network namespace, causing a slab-use-after-free in ovs_ct_execute() when the netns is torn down. Publish the CT limit pointer through RCU, remove it before teardown, and wait for readers before freeing its contents. Keep ovs_mutex around individual CT limit updates, and use the RCU read-side lock while GET traverses the RCU-protected limit lists. Netns teardown detaches the RCU-protected CT limit state in the pernet .pre_exit callback while holding ovs_mutex. The pernet core guarantees an RCU grace period between the .pre_exit and .exit callbacks, so the .exit callback completes the teardown without adding any extra synchronization. The netlink command handlers do not need NULL checks because the userspace netlink socket holds an active reference to its network namespace while a request is processed. The per-netns exit path therefore cannot run concurrently with SET, DEL, or GET for that socket's namespace. Fixes: 11efd5cb04a1 ("openvswitch: Support conntrack zone limit") Cc: stable(a)vger.kernel.org Reported-by: Vega <vega(a)nebusec.ai> Link: https://lore.kernel.org/all/cover.1784711445.git.xuyuqiabc@gmail.com Co-developed-by: Nan Li <tonanli66(a)gmail.com> Signed-off-by: Nan Li <tonanli66(a)gmail.com> Signed-off-by: Yuqi Xu <xuyuqiabc(a)gmail.com> Reviewed-by: Ren Wei <enjou1224z(a)gmail.com> Reviewed-by: Ilya Maximets <i.maximets(a)ovn.org> Link: https://patch.msgid.link/288fbd5459d92b9dd0dcc6faf625f04819161ff3.178728029… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> [ 7.0+ uses kmalloc_obj[s] while older versions use kmalloc[_array] 6.12+ doesn't have a 'family' argument in nf_conncount_init/destroy ] Signed-off-by: Ilya Maximets <i.maximets(a)ovn.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- net/openvswitch/conntrack.c | 122 +++++++++++++++++++++++------------- net/openvswitch/conntrack.h | 6 +- net/openvswitch/datapath.c | 10 ++- net/openvswitch/datapath.h | 7 ++- 4 files changed, 98 insertions(+), 47 deletions(-) diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c index 30f5e414018b..c52818a9f38d 100644 --- a/net/openvswitch/conntrack.c +++ b/net/openvswitch/conntrack.c @@ -1156,10 +1156,14 @@ static int ovs_ct_check_limit(struct net *net, const struct nf_conntrack_tuple *tuple) { struct ovs_net *ovs_net = net_generic(net, ovs_net_id); - const struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info; + const struct ovs_ct_limit_info *ct_limit_info; u32 per_zone_limit, connections; u32 conncount_key; + ct_limit_info = rcu_dereference(ovs_net->ct_limit_info); + if (!ct_limit_info) + return 0; + conncount_key = info->zone.id; per_zone_limit = ct_limit_get(ct_limit_info, info->zone.id); @@ -1861,43 +1865,56 @@ static void __ovs_ct_free_action(struct ovs_conntrack_info *ct_info) #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) static int ovs_ct_limit_init(struct net *net, struct ovs_net *ovs_net) { + struct ovs_ct_limit_info *info; int i, err; - ovs_net->ct_limit_info = kmalloc(sizeof(*ovs_net->ct_limit_info), - GFP_KERNEL); - if (!ovs_net->ct_limit_info) + info = kmalloc(sizeof(*info), GFP_KERNEL); + if (!info) return -ENOMEM; - ovs_net->ct_limit_info->default_limit = OVS_CT_LIMIT_DEFAULT; - ovs_net->ct_limit_info->limits = + info->default_limit = OVS_CT_LIMIT_DEFAULT; + info->limits = kmalloc_array(CT_LIMIT_HASH_BUCKETS, sizeof(struct hlist_head), GFP_KERNEL); - if (!ovs_net->ct_limit_info->limits) { - kfree(ovs_net->ct_limit_info); + if (!info->limits) { + kfree(info); return -ENOMEM; } for (i = 0; i < CT_LIMIT_HASH_BUCKETS; i++) - INIT_HLIST_HEAD(&ovs_net->ct_limit_info->limits[i]); + INIT_HLIST_HEAD(&info->limits[i]); - ovs_net->ct_limit_info->data = - nf_conncount_init(net, NFPROTO_INET, sizeof(u32)); + info->data = nf_conncount_init(net, NFPROTO_INET, sizeof(u32)); - if (IS_ERR(ovs_net->ct_limit_info->data)) { - err = PTR_ERR(ovs_net->ct_limit_info->data); - kfree(ovs_net->ct_limit_info->limits); - kfree(ovs_net->ct_limit_info); + if (IS_ERR(info->data)) { + err = PTR_ERR(info->data); + kfree(info->limits); + kfree(info); pr_err("openvswitch: failed to init nf_conncount %d\n", err); return err; } + rcu_assign_pointer(ovs_net->ct_limit_info, info); return 0; } -static void ovs_ct_limit_exit(struct net *net, struct ovs_net *ovs_net) +static void *ovs_ct_limit_exit_start(struct ovs_net *ovs_net) +{ + return rcu_replace_pointer(ovs_net->ct_limit_info, NULL, + lockdep_ovsl_is_held()); +} + +/* The CT limit state must be detached by ovs_ct_limit_exit_start() and an + * RCU grace period must elapse before this function runs. The pernet core + * guarantees the grace period between the .pre_exit and .exit callbacks. + */ +static void ovs_ct_limit_exit_finish(struct net *net, void *data) { - const struct ovs_ct_limit_info *info = ovs_net->ct_limit_info; + const struct ovs_ct_limit_info *info = data; int i; + if (!info) + return; + nf_conncount_destroy(net, NFPROTO_INET, info->data); for (i = 0; i < CT_LIMIT_HASH_BUCKETS; ++i) { struct hlist_head *head = &info->limits[i]; @@ -1905,7 +1922,7 @@ static void ovs_ct_limit_exit(struct net *net, struct ovs_net *ovs_net) struct hlist_node *next; hlist_for_each_entry_safe(ct_limit, next, head, hlist_node) - kfree_rcu(ct_limit, rcu); + kfree(ct_limit); } kfree(info->limits); kfree(info); @@ -1944,12 +1961,13 @@ static bool check_zone_id(int zone_id, u16 *pzone) return false; } -static int ovs_ct_limit_set_zone_limit(struct nlattr *nla_zone_limit, - struct ovs_ct_limit_info *info) +static int ovs_ct_limit_set_zone_limit(struct ovs_net *ovs_net, + struct nlattr *nla_zone_limit) { struct ovs_zone_limit *zone_limit; - int rem; + struct ovs_ct_limit_info *info; u16 zone; + int rem; rem = NLA_ALIGN(nla_len(nla_zone_limit)); zone_limit = (struct ovs_zone_limit *)nla_data(nla_zone_limit); @@ -1958,6 +1976,7 @@ static int ovs_ct_limit_set_zone_limit(struct nlattr *nla_zone_limit, if (unlikely(zone_limit->zone_id == OVS_ZONE_LIMIT_DEFAULT_ZONE)) { ovs_lock(); + info = ovsl_dereference(ovs_net->ct_limit_info); info->default_limit = zone_limit->limit; ovs_unlock(); } else if (unlikely(!check_zone_id( @@ -1974,6 +1993,7 @@ static int ovs_ct_limit_set_zone_limit(struct nlattr *nla_zone_limit, ct_limit->limit = zone_limit->limit; ovs_lock(); + info = ovsl_dereference(ovs_net->ct_limit_info); ct_limit_set(info, ct_limit); ovs_unlock(); } @@ -1988,12 +2008,13 @@ static int ovs_ct_limit_set_zone_limit(struct nlattr *nla_zone_limit, return 0; } -static int ovs_ct_limit_del_zone_limit(struct nlattr *nla_zone_limit, - struct ovs_ct_limit_info *info) +static int ovs_ct_limit_del_zone_limit(struct ovs_net *ovs_net, + struct nlattr *nla_zone_limit) { struct ovs_zone_limit *zone_limit; - int rem; + struct ovs_ct_limit_info *info; u16 zone; + int rem; rem = NLA_ALIGN(nla_len(nla_zone_limit)); zone_limit = (struct ovs_zone_limit *)nla_data(nla_zone_limit); @@ -2002,6 +2023,7 @@ static int ovs_ct_limit_del_zone_limit(struct nlattr *nla_zone_limit, if (unlikely(zone_limit->zone_id == OVS_ZONE_LIMIT_DEFAULT_ZONE)) { ovs_lock(); + info = ovsl_dereference(ovs_net->ct_limit_info); info->default_limit = OVS_CT_LIMIT_DEFAULT; ovs_unlock(); } else if (unlikely(!check_zone_id( @@ -2009,6 +2031,7 @@ static int ovs_ct_limit_del_zone_limit(struct nlattr *nla_zone_limit, OVS_NLERR(true, "zone id is out of range"); } else { ovs_lock(); + info = ovsl_dereference(ovs_net->ct_limit_info); ct_limit_del(info, zone); ovs_unlock(); } @@ -2052,6 +2075,7 @@ static int __ovs_ct_limit_get_zone_limit(struct net *net, return nla_put_nohdr(reply, sizeof(zone_limit), &zone_limit); } +/* Called with RCU read lock held. */ static int ovs_ct_limit_get_zone_limit(struct net *net, struct nlattr *nla_zone_limit, struct ovs_ct_limit_info *info, @@ -2075,9 +2099,7 @@ static int ovs_ct_limit_get_zone_limit(struct net *net, &zone))) { OVS_NLERR(true, "zone id is out of range"); } else { - rcu_read_lock(); limit = ct_limit_get(info, zone); - rcu_read_unlock(); err = __ovs_ct_limit_get_zone_limit( net, info->data, zone, limit, reply); @@ -2095,6 +2117,7 @@ static int ovs_ct_limit_get_zone_limit(struct net *net, return 0; } +/* Called with RCU read lock held. */ static int ovs_ct_limit_get_all_zone_limit(struct net *net, struct ovs_ct_limit_info *info, struct sk_buff *reply) @@ -2107,19 +2130,16 @@ static int ovs_ct_limit_get_all_zone_limit(struct net *net, if (err) return err; - rcu_read_lock(); for (i = 0; i < CT_LIMIT_HASH_BUCKETS; ++i) { head = &info->limits[i]; hlist_for_each_entry_rcu(ct_limit, head, hlist_node) { err = __ovs_ct_limit_get_zone_limit(net, info->data, ct_limit->zone, ct_limit->limit, reply); if (err) - goto exit_err; + return err; } } -exit_err: - rcu_read_unlock(); return err; } @@ -2129,7 +2149,6 @@ static int ovs_ct_limit_cmd_set(struct sk_buff *skb, struct genl_info *info) struct sk_buff *reply; struct ovs_header *ovs_reply_header; struct ovs_net *ovs_net = net_generic(sock_net(skb->sk), ovs_net_id); - struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info; int err; reply = ovs_ct_limit_cmd_reply_start(info, OVS_CT_LIMIT_CMD_SET, @@ -2142,8 +2161,8 @@ static int ovs_ct_limit_cmd_set(struct sk_buff *skb, struct genl_info *info) goto exit_err; } - err = ovs_ct_limit_set_zone_limit(a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT], - ct_limit_info); + err = ovs_ct_limit_set_zone_limit(ovs_net, + a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]); if (err) goto exit_err; @@ -2163,7 +2182,6 @@ static int ovs_ct_limit_cmd_del(struct sk_buff *skb, struct genl_info *info) struct sk_buff *reply; struct ovs_header *ovs_reply_header; struct ovs_net *ovs_net = net_generic(sock_net(skb->sk), ovs_net_id); - struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info; int err; reply = ovs_ct_limit_cmd_reply_start(info, OVS_CT_LIMIT_CMD_DEL, @@ -2176,8 +2194,8 @@ static int ovs_ct_limit_cmd_del(struct sk_buff *skb, struct genl_info *info) goto exit_err; } - err = ovs_ct_limit_del_zone_limit(a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT], - ct_limit_info); + err = ovs_ct_limit_del_zone_limit(ovs_net, + a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]); if (err) goto exit_err; @@ -2197,7 +2215,7 @@ static int ovs_ct_limit_cmd_get(struct sk_buff *skb, struct genl_info *info) struct ovs_header *ovs_reply_header; struct net *net = sock_net(skb->sk); struct ovs_net *ovs_net = net_generic(net, ovs_net_id); - struct ovs_ct_limit_info *ct_limit_info = ovs_net->ct_limit_info; + struct ovs_ct_limit_info *ct_limit_info; int err; reply = ovs_ct_limit_cmd_reply_start(info, OVS_CT_LIMIT_CMD_GET, @@ -2211,18 +2229,19 @@ static int ovs_ct_limit_cmd_get(struct sk_buff *skb, struct genl_info *info) goto exit_err; } + rcu_read_lock(); + ct_limit_info = rcu_dereference(ovs_net->ct_limit_info); if (a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT]) { err = ovs_ct_limit_get_zone_limit( net, a[OVS_CT_LIMIT_ATTR_ZONE_LIMIT], ct_limit_info, reply); - if (err) - goto exit_err; } else { err = ovs_ct_limit_get_all_zone_limit(net, ct_limit_info, reply); - if (err) - goto exit_err; } + rcu_read_unlock(); + if (err) + goto exit_err; nla_nest_end(reply, nla_reply); genlmsg_end(reply, ovs_reply_header); @@ -2292,12 +2311,29 @@ int ovs_ct_init(struct net *net) #endif } -void ovs_ct_exit(struct net *net) +/* Must be called with ovs_mutex held. Detaches the RCU-protected + * ct_limit_info and stores it in ovs_net->ct_limit_exit_data for + * ovs_ct_exit_finish() to complete the teardown after an RCU grace period. + */ +void ovs_ct_exit_start(struct net *net __maybe_unused) +{ +#if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) + struct ovs_net *ovs_net = net_generic(net, ovs_net_id); + + ovs_net->ct_limit_exit_data = ovs_ct_limit_exit_start(ovs_net); +#endif +} + +/* Completes the CT limit teardown. The pernet core guarantees an RCU + * grace period between detaching the state in ovs_ct_exit_start() and + * this call, so no RCU readers remain. + */ +void ovs_ct_exit_finish(struct net *net) { struct ovs_net *ovs_net = net_generic(net, ovs_net_id); #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) - ovs_ct_limit_exit(net, ovs_net); + ovs_ct_limit_exit_finish(net, ovs_net->ct_limit_exit_data); #endif if (ovs_net->xt_label) diff --git a/net/openvswitch/conntrack.h b/net/openvswitch/conntrack.h index 59dc32761b91..ad9081d7023d 100644 --- a/net/openvswitch/conntrack.h +++ b/net/openvswitch/conntrack.h @@ -14,7 +14,8 @@ enum ovs_key_attr; #if IS_ENABLED(CONFIG_NF_CONNTRACK) int ovs_ct_init(struct net *); -void ovs_ct_exit(struct net *); +void ovs_ct_exit_start(struct net *net); +void ovs_ct_exit_finish(struct net *net); bool ovs_ct_verify(struct net *, enum ovs_key_attr attr); int ovs_ct_copy_action(struct net *, const struct nlattr *, const struct sw_flow_key *, struct sw_flow_actions **, @@ -39,7 +40,8 @@ void ovs_ct_free_action(const struct nlattr *a); static inline int ovs_ct_init(struct net *net) { return 0; } -static inline void ovs_ct_exit(struct net *net) { } +static inline void ovs_ct_exit_start(struct net *net) { } +static inline void ovs_ct_exit_finish(struct net *net) { } static inline bool ovs_ct_verify(struct net *net, int attr) { diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c index ec1e4af1dec0..34170c744cc3 100644 --- a/net/openvswitch/datapath.c +++ b/net/openvswitch/datapath.c @@ -2575,6 +2575,13 @@ static void __net_exit list_vports_from_net(struct net *net, struct net *dnet, } } +static void __net_exit ovs_pre_exit_net(struct net *dnet) +{ + ovs_lock(); + ovs_ct_exit_start(dnet); + ovs_unlock(); +} + static void __net_exit ovs_exit_net(struct net *dnet) { struct datapath *dp, *dp_next; @@ -2585,7 +2592,7 @@ static void __net_exit ovs_exit_net(struct net *dnet) ovs_lock(); - ovs_ct_exit(dnet); + ovs_ct_exit_finish(dnet); list_for_each_entry_safe(dp, dp_next, &ovs_net->dps, list_node) __dp_destroy(dp); @@ -2609,6 +2616,7 @@ static void __net_exit ovs_exit_net(struct net *dnet) static struct pernet_operations ovs_net_ops = { .init = ovs_init_net, + .pre_exit = ovs_pre_exit_net, .exit = ovs_exit_net, .id = &ovs_net_id, .size = sizeof(struct ovs_net), diff --git a/net/openvswitch/datapath.h b/net/openvswitch/datapath.h index 62e7ad32f837..a796a60fea2f 100644 --- a/net/openvswitch/datapath.h +++ b/net/openvswitch/datapath.h @@ -131,13 +131,18 @@ struct dp_upcall_info { * struct ovs_net - Per net-namespace data for ovs. * @dps: List of datapaths to enable dumping them all out. * Protected by genl_mutex. + * @ct_limit_info: Hash table of conntrack zone connection limits. Protected + * by RCU; updates and teardown are serialized by ovs_mutex. May be NULL during + * netns teardown. + * @ct_limit_exit_data: CT limit state detached at .pre_exit, freed at .exit. */ struct ovs_net { struct list_head dps; struct work_struct dp_notify_work; struct delayed_work masks_rebalance; #if IS_ENABLED(CONFIG_NETFILTER_CONNCOUNT) - struct ovs_ct_limit_info *ct_limit_info; + struct ovs_ct_limit_info __rcu *ct_limit_info; + struct ovs_ct_limit_info *ct_limit_exit_data; #endif /* Module reference for configuring conntrack. */ -- 2.43.0

2 1

[PATCH OLK-6.6] bpf: Reject dev-bound-only programs on other devices
by Pu Lehui 10 Oct '26

10 Oct '26

From: Weiming Shi <bestswngs(a)gmail.com> stable inclusion from stable-v6.6.158 commit e57f04194361574493e3e6cf0b9e9c69e4ae9791 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20235 CVE: CVE-2026-98382 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 6db1ce73e9853f533eb7f413f14ba00f8ec6f80d ] __bpf_offload_dev_match() falls back to comparing offdev pointers after an exact netdev mismatch. Bound-only programs normally have NULL offdevs, so unrelated netdevs compare equal. A bound-only program on an offload-registered netdev can instead inherit a real offdev and match a sibling port. With CAP_BPF and CAP_NET_ADMIN, a caller can use bpf(BPF_LINK_CREATE) with a different target ifindex to run metadata kfuncs specialized for the bound driver on the target driver's xdp_buff. Running a veth-bound program on tun reads beyond tun's bare stack xdp_buff as a veth_xdp_buff. Oops: general protection fault, probably for non-canonical address KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] RIP: 0010:veth_xdp_rx_timestamp (drivers/net/veth.c:1673) Call Trace: ... tun_build_skb (drivers/net/tun.c:1739) tun_get_user (drivers/net/tun.c:1856) tun_chr_write_iter (drivers/net/tun.c:2091) vfs_write (fs/read_write.c:595 fs/read_write.c:687) ksys_write (fs/read_write.c:739) do_syscall_64 (arch/x86/entry/syscall_64.c:84) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Kernel panic - not syncing: Fatal exception in interrupt Restrict non-offloaded programs to exact netdev matches and retain the shared-offdev fallback only for genuinely offloaded multi-port programs. Fixes: 2b3486bc2d23 ("bpf: Introduce device-bound XDP programs") Reported-by: <co+ac0a8c41de69121d(a)bugs.sh> Signed-off-by: Weiming Shi <bestswngs(a)gmail.com> Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Link: https://lore.kernel.org/bpf/20260917161335.1020405-2-bestswngs@gmail.com/ Link: https://patch.msgid.link/20260920132303.4109240-3-bestswngs@gmail.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/offload.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/bpf/offload.c b/kernel/bpf/offload.c index 60c82c328d42..3345de2da15d 100644 --- a/kernel/bpf/offload.c +++ b/kernel/bpf/offload.c @@ -696,6 +696,8 @@ static bool __bpf_offload_dev_match(struct bpf_prog *prog, return false; if (offload->netdev == netdev) return true; + if (!bpf_prog_is_offloaded(prog->aux)) + return false; ondev1 = bpf_offload_find_netdev(offload->netdev); ondev2 = bpf_offload_find_netdev(netdev); -- 2.34.1

2 1

[PATCH OLK-5.10] NFSD: Prevent lock owner use-after-free during client teardown
by Lu Jialin 10 Oct '26

10 Oct '26

From: Chuck Lever <cel(a)kernel.org> stable inclusion from stable-v5.10.270 commit 42d7954b0a1907d4ef122aef94561952a033cdc3 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18929 CVE: CVE-2026-89662 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 5e2fa29d223a9a1e6a948e40b109d09081d1decd upstream. __destroy_client() releases a client's open owners, but a lock owner whose only reference is a blocked lock (nbl) stays on cl_ownerstr_hashtbl. client_has_state() does not count a bare owner, so DESTROY_CLIENTID can reach __destroy_client() with such owners present. __destroy_client() then walks the table, calling remove_blocked_locks() on each owner without a reference. Freeing a blocked lock drops the owner reference held via flc_owner. The per-net laundromat reaps blocked locks from nn->blocked_locks_lru independently of client state. The two paths share blocked_locks_lock only for the list splice, not the owner's lifetime. The laundromat therefore frees the owner as __destroy_client() dereferences it, a NULL dereference in remove_blocked_locks(). nfsd4_release_lockowner() holds a reference across the same call; __destroy_client() does not. Hold cl_lock across the walk, taking a reference and unhashing each owner, then drop it before remove_blocked_locks() and nfs4_put_stateowner(), which take blocked_locks_lock and cl_lock. Reported-by: Wolfgang Walter <linux(a)stwm.de> Closes: https://lore.kernel.org/linux-nfs/6eccafaaaa60651ef091257c3439c46b@stwm.de/ Fixes: 68ef3bc31664 ("nfsd: remove blocked locks on client teardown") Cc: stable(a)vger.kernel.org Reviewed-by: NeilBrown <neil(a)brown.name> Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Link: https://patch.msgid.link/20260709-cel-v4-1-1d519d9be0cb@kernel.org Signed-off-by: Chuck Lever <cel(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- fs/nfsd/nfs4state.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c index 7bfe0a6bc5fd..f1eef728f157 100644 --- a/fs/nfsd/nfs4state.c +++ b/fs/nfsd/nfs4state.c @@ -2197,14 +2197,24 @@ __destroy_client(struct nfs4_client *clp) release_openowner(oo); } for (i = 0; i < OWNER_HASH_SIZE; i++) { - struct nfs4_stateowner *so, *tmp; + struct nfs4_stateowner *so; - list_for_each_entry_safe(so, tmp, &clp->cl_ownerstr_hashtbl[i], - so_strhash) { + spin_lock(&clp->cl_lock); + while (!list_empty(&clp->cl_ownerstr_hashtbl[i])) { + so = list_first_entry(&clp->cl_ownerstr_hashtbl[i], + struct nfs4_stateowner, so_strhash); /* Should be no openowners at this point */ WARN_ON_ONCE(so->so_is_open_owner); + nfs4_get_stateowner(so); + unhash_lockowner_locked(lockowner(so)); + spin_unlock(&clp->cl_lock); + remove_blocked_locks(lockowner(so)); + nfs4_put_stateowner(so); + + spin_lock(&clp->cl_lock); } + spin_unlock(&clp->cl_lock); } nfsd4_return_all_client_layouts(clp); nfsd4_shutdown_copy(clp); -- 2.34.1

2 1

[PATCH OLK-5.10] nfsd: initialize copy-notify stateid before publishing it
by Lu Jialin 10 Oct '26

10 Oct '26

From: Jeff Layton <jlayton(a)kernel.org> stable inclusion from stable-v5.10.270 commit 863b6e995665472f2af5be2436a874ab6a9e5ac6 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18933 CVE: CVE-2026-89669 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 129643893b79f8a3c6b72045f933fbab5ee424ca upstream. nfsd4_copy_notify() finished initializing the cpntf state after nfs4_alloc_init_cpntf_state() had already linked it into the s2s_cp_stateids IDR and the parent's sc_cp_list, with cs_count == 1 (the membership reference) and none held for the caller. A racing OFFLOAD_CANCEL (crafted cl_id == nn->s2s_cp_cl_id plus the guessable so_id) could reach manage_cpntf_state() and free the entry, turning the caller's subsequent cpn_cnr_stateid read and cp_p_stateid/cp_p_clid writes into use-after-free. The owning clientid was also only recorded after publication, so it could not gate an ownership check in that window. Record cp_p_stateid and cp_p_clid inside nfs4_alloc_init_cpntf_state() before nfs4_init_cp_state() publishes the entry, and return it with an extra reference. The caller reads the stateid under that reference and drops it with nfs4_put_cpntf_state(); on a late error the laundromat reaps the entry. Fixes: 624322f1adc5 ("NFSD add COPY_NOTIFY operation") Cc: stable(a)vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Jeff Layton <jlayton(a)kernel.org> Link: https://patch.msgid.link/20260710-nfsd-testing-v3-4-a0ff7db6aa3e@kernel.org Signed-off-by: Chuck Lever <cel(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/nfsd/nfs4proc.c fs/nfsd/nfs4state.c [Context conflicts] Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- fs/nfsd/nfs4proc.c | 16 +++++++++------- fs/nfsd/nfs4state.c | 10 +++++++++- 2 files changed, 18 insertions(+), 8 deletions(-) diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c index ecbde42093d5..5beabc0ced52 100644 --- a/fs/nfsd/nfs4proc.c +++ b/fs/nfsd/nfs4proc.c @@ -1613,7 +1613,6 @@ nfsd4_copy_notify(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id); struct nfs4_stid *stid; struct nfs4_cpntf_state *cps; - struct nfs4_client *clp = cstate->clp; status = nfs4_preprocess_stateid_op(rqstp, cstate, &cstate->current_fh, &cn->cpn_src_stateid, RD_STATE, NULL, @@ -1625,12 +1624,14 @@ nfsd4_copy_notify(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, cn->cpn_nsec = 0; status = nfserrno(-ENOMEM); + /* + * The returned cps is published and fully initialized, and carries an + * extra reference for us; drop it once we are done with it. + */ cps = nfs4_alloc_init_cpntf_state(nn, stid); if (!cps) goto out; memcpy(&cn->cpn_cnr_stateid, &cps->cp_stateid.stid, sizeof(stateid_t)); - memcpy(&cps->cp_p_stateid, &stid->sc_stateid, sizeof(stateid_t)); - memcpy(&cps->cp_p_clid, &clp->cl_clientid, sizeof(clientid_t)); /* For now, only return one server address in cpn_src, the * address used by the client to connect to this server. @@ -1639,10 +1640,11 @@ nfsd4_copy_notify(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, status = nfsd4_set_netaddr((struct sockaddr *)&rqstp->rq_daddr, &cn->cpn_src.u.nl4_addr); WARN_ON_ONCE(status); - if (status) { - nfs4_put_cpntf_state(nn, cps); - goto out; - } + /* + * Drop our extra reference. The membership reference keeps the entry + * alive for a later inter-server READ, or until the laundromat reaps it. + */ + nfs4_put_cpntf_state(nn, cps); out: nfs4_put_stid(stid); return status; diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c index 7bfe0a6bc5fd..d930100afdd6 100644 --- a/fs/nfsd/nfs4state.c +++ b/fs/nfsd/nfs4state.c @@ -834,7 +834,15 @@ struct nfs4_cpntf_state *nfs4_alloc_init_cpntf_state(struct nfsd_net *nn, if (!cps) return NULL; cps->cpntf_time = ktime_get_boottime_seconds(); - refcount_set(&cps->cp_stateid.sc_count, 1); + /* + * Fully initialize the entry before nfs4_init_cp_state() publishes it, + * since a concurrent OFFLOAD_CANCEL could then free it. Take an extra + * reference for the caller (dropped with nfs4_put_cpntf_state()). + */ + memcpy(&cps->cp_p_stateid, &p_stid->sc_stateid, sizeof(stateid_t)); + memcpy(&cps->cp_p_clid, &p_stid->sc_client->cl_clientid, + sizeof(clientid_t)); + refcount_set(&cps->cp_stateid.sc_count, 2); if (!nfs4_init_cp_state(nn, &cps->cp_stateid, NFS4_COPYNOTIFY_STID)) goto out_free; spin_lock(&nn->s2s_cp_lock); -- 2.34.1

2 1

[PATCH OLK-5.10] nfsd: gate nfs3 setacl by argp->mask
by Lu Jialin 10 Oct '26

10 Oct '26

From: Chris Mason <clm(a)meta.com> mainline inclusion from mainline-v7.3-rc1 commit 453d7198a0ab07a12d46e0575861ac7b932da17e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18934 CVE: CVE-2026-89671 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- nfsd3_proc_setacl() calls set_posix_acl() unconditionally for both ACL_TYPE_ACCESS and ACL_TYPE_DEFAULT, passing argp->acl_access and argp->acl_default verbatim. The NFSv3 ACL decoder only populates those pointers when the corresponding mask bit is set: nfs3svc_decode_setaclargs() if (args->mask & NFS_ACL) decode into acl_access if (args->mask & NFS_DFACL) decode into acl_default /* otherwise the pointer stays NULL (pc_argzero) */ nfsd3_proc_setacl() set_posix_acl(.., ACL_TYPE_ACCESS, argp->acl_access) set_posix_acl(.., ACL_TYPE_DEFAULT, argp->acl_default) set_posix_acl(idmap, dentry, type, NULL) is the VFS "remove this ACL type" operation. A NULL pointer that means "the client did not send this arm" is therefore indistinguishable from "the client asked to remove this ACL". A SETACL with mask=NFS_ACL silently drops the directory's default ACL; mask=0 drops both. The sibling nfsd3_proc_getacl() already consults argp->mask before touching each arm; mirror that in setacl. Fix by wrapping each set_posix_acl() call in the matching mask bit check and initializing error to 0 before inode_lock so that a request with neither bit set leaves the on-disk ACLs untouched and returns nfs_ok. The out_drop_lock path and the unconditional posix_acl_release() at out: are preserved; both NULL-tolerate the skipped arms. Fixes: a257cdd0e217 ("[PATCH] NFSD: Add server support for NFSv3 ACLs.") Cc: stable(a)vger.kernel.org Assisted-by: kres:claude-opus-4-7 Reported-by: Chris Mason <clm(a)meta.com> Signed-off-by: Chris Mason <clm(a)meta.com> Link: https://patch.msgid.link/20260530-nfsd-fixes-v2-5-f27e8eb4d974@kernel.org Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Conflicts: fs/nfsd/nfs3acl.c [Commit 453d7198a0ab wraps set_posix_acl() with argp->mask gates but calls it as set_posix_acl(&nop_mnt_idmap, fh->fh_dentry, type, acl). This tree predates the idmap conversion, so keep the old set_posix_acl(inode, type, acl) form while adding the same mask gates.] Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- fs/nfsd/nfs3acl.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/fs/nfsd/nfs3acl.c b/fs/nfsd/nfs3acl.c index 80aa209fd046..fe864cba6282 100644 --- a/fs/nfsd/nfs3acl.c +++ b/fs/nfsd/nfs3acl.c @@ -103,10 +103,15 @@ static __be32 nfsd3_proc_setacl(struct svc_rqst *rqstp) fh_lock(fh); - error = set_posix_acl(inode, ACL_TYPE_ACCESS, argp->acl_access); - if (error) - goto out_drop_lock; - error = set_posix_acl(inode, ACL_TYPE_DEFAULT, argp->acl_default); + error = 0; + if (argp->mask & NFS_ACL) { + error = set_posix_acl(inode, ACL_TYPE_ACCESS, argp->acl_access); + if (error) + goto out_drop_lock; + } + if (argp->mask & NFS_DFACL) { + error = set_posix_acl(inode, ACL_TYPE_DEFAULT, argp->acl_default); + } out_drop_lock: fh_unlock(fh); -- 2.34.1

2 1

[PATCH OLK-5.10] nfsd: fix XDR length calculation in nfsd4_ff_encode_layoutget
by Lu Jialin 10 Oct '26

10 Oct '26

From: Jeff Layton <jlayton(a)kernel.org> stable inclusion from stable-v5.10.270 commit 3a7fd224df0fbb42167eb1b77be45d72fe0b1098 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18937 CVE: CVE-2026-89674 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f9868174af49d207fbaf0c5e055d088a983684af upstream. The XDR buffer size calculation in nfsd4_ff_encode_layoutget() has multiple errors that can result in either an out-of-bounds write or leaking uninitialized kernel memory to the client: - fh_len doesn't account for XDR padding on the file handle data - uid and gid lengths use "8 + len" but xdr_encode_opaque() actually writes "4 + xdr_align_size(len)" bytes - ds_len omits the flags and stats_collect_hint fields (8 bytes), while len's header constant overestimates by 8 bytes -- these partially cancel but leave a net mismatch The worst case occurs with short strings (e.g. uid=0, gid=0 with an odd-sized file handle), where the function writes up to 5 bytes past the reserved XDR buffer. Conversely, when string lengths happen to be 4-byte aligned, the reservation is too large and stale buffer content is sent to the client. Fix this by breaking out every encoded field explicitly in the ds_len calculation, using xdr_align_size() for all variable-length opaque fields, and correcting the header constants. Fixes: 9b9960a0ca47 ("nfsd: Add a super simple flex file server") Cc: stable(a)vger.kernel.org Assisted-by: kres:claude-opus-4-7 Signed-off-by: Jeff Layton <jlayton(a)kernel.org> Link: https://patch.msgid.link/20260528-pnfs-fixes-v1-1-8a1255ae2f16@kernel.org Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- fs/nfsd/flexfilelayoutxdr.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/fs/nfsd/flexfilelayoutxdr.c b/fs/nfsd/flexfilelayoutxdr.c index bb205328e043..920239dfdc25 100644 --- a/fs/nfsd/flexfilelayoutxdr.c +++ b/fs/nfsd/flexfilelayoutxdr.c @@ -30,19 +30,24 @@ nfsd4_ff_encode_layoutget(struct xdr_stream *xdr, struct ff_idmap uid; struct ff_idmap gid; - fh_len = 4 + fl->fh.size; + fh_len = 4 + xdr_align_size(fl->fh.size); uid.len = sprintf(uid.buf, "%u", from_kuid(&init_user_ns, fl->uid)); gid.len = sprintf(gid.buf, "%u", from_kgid(&init_user_ns, fl->gid)); - /* 8 + len for recording the length, name, and padding */ - ds_len = 20 + sizeof(stateid_opaque_t) + 4 + fh_len + - 8 + uid.len + 8 + gid.len; + /* data server entry: deviceid + efficiency + stateid + fh list + + * user + group + flags + stats_collect_hint + */ + ds_len = 16 + 4 + 4 + sizeof(stateid_opaque_t) + 4 + fh_len + + 4 + xdr_align_size(uid.len) + + 4 + xdr_align_size(gid.len) + + 4 + 4; + /* mirror: ds_count + ds */ mirror_len = 4 + ds_len; - /* The layout segment */ - len = 20 + mirror_len; + /* stripe_unit + mirror_count + mirror */ + len = 12 + mirror_len; p = xdr_reserve_space(xdr, sizeof(__be32) + len); if (!p) -- 2.34.1

2 1

[PATCH OLK-6.6] nfsd: fix UAF in async copy cancel and shutdown
by Lu Jialin 10 Oct '26

10 Oct '26

From: Jeff Layton <jlayton(a)kernel.org> mainline inclusion from mainline-v7.3-rc1 commit 62c0f6eaf050bb9284c1f9cac6ed1770092e6b95 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18938 CVE: CVE-2026-89675 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- An async copy could be freed or used after free while a teardown caller (OFFLOAD_CANCEL, nfsd4_shutdown_copy, nfsd4_cancel_copy_by_sb) raced the copy kthread: - find_async_copy() bumped copy->refcount but left the copy on clp->async_copies, so the reaper's cleanup_async_copy() could run release_copy_files() concurrently with a cancel/shutdown caller. Both put and NULL nf_src/nf_dst without a common lock, double-putting the nfsd_file and freeing it early. - nfsd4_do_async_copy() set NFSD4_COPY_F_STOPPED before its final uses of the copy (nfsd_update_cmtime_attr() on copy->nf_dst, nfsd4_send_cb_offload()). nfsd4_stop_copy() treats a set STOPPED bit as "kthread done, skip kthread_stop()", so a teardown caller ran release_copy_files() -- which puts and NULLs nf_dst -- while the kthread still dereferenced it (NULL/UAF). - copy->copy_task was never pinned. The one-shot kthread self-reaps on return, so kthread_stop()'s get_task_struct() could touch a freed task_struct. - co_cb is embedded in the copy, but nfsd4_send_cb_offload() held a reference only on the client, so a concurrent teardown could free the copy while the CB_OFFLOAD callback was in flight. Fix the teardown lifetime as a whole: - find_async_copy() unlinks the copy (clear cp_clp, list_del_init) under async_lock; the cancel, shutdown, and sb-cancel paths drop the list-membership reference via nfs4_put_copy() after nfsd4_stop_copy(). Drop the now-redundant list_del fixup from cleanup_async_copy(). - Because unlinking hides the copy from the reaper, its cleanup_async_copy() can no longer remove the copy's s2s_cp_stateids entry; the cancel/shutdown/sb-cancel paths now call nfs4_free_copy_state() themselves (while cp_clp is still valid) so the entry does not dangle at freed memory for the laundromat and manage_cpntf_state() to dereference. - Give the kthread its own reference, taken in nfsd4_copy() before wake_up_process() and dropped at the end of nfsd4_do_async_copy(); call wake_up_process() before list_add(). - Pin the task_struct with get_task_struct() in nfsd4_copy(), released in nfs4_put_copy(), so kthread_stop() is safe whenever the kthread exits. Set NFSD4_COPY_F_STOPPED only in nfsd4_stop_copy(), which now always kthread_stop()s before release_copy_files(); completion is still reported via NFSD4_COPY_F_COMPLETED, so nfsd4_has_active_async_copies() is unaffected. Each teardown caller removes the copy from clp->async_copies first, so kthread_stop() runs exactly once. - Take a copy reference in nfsd4_send_cb_offload(), dropped in nfsd4_cb_offload_release(). The kthread still holds its own reference there, so the refcount_inc() cannot race the final free. - Read cp_clp with smp_load_acquire() to pair with the unordered set_bit()/clear_bit() writers (Documentation/atomic_bitops.rst). Fixes: e0639dc5805a ("NFSD introduce async copy feature") Cc: stable(a)vger.kernel.org Fixes: ac0514f4d198 ("NFSD: Add a laundromat reaper for async copy state") Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Jeff Layton <jlayton(a)kernel.org> Link: https://patch.msgid.link/20260710-nfsd-testing-v3-2-a0ff7db6aa3e@kernel.org Signed-off-by: Chuck Lever <cel(a)kernel.org> Conflicts: fs/nfsd/nfs4proc.c [partial backport of 62c0f6eaf050; adapted so copy_task is assigned only after the kthread_create() IS_ERR() check passes] Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- fs/nfsd/nfs4proc.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c index 546d2a0900ab..d103858a67f6 100644 --- a/fs/nfsd/nfs4proc.c +++ b/fs/nfsd/nfs4proc.c @@ -1279,6 +1279,9 @@ static void nfs4_put_copy(struct nfsd4_copy *copy) if (!refcount_dec_and_test(&copy->refcount)) return; atomic_dec(&copy->cp_nn->pending_async_copies); + /* Drop the task_struct pinned in nfsd4_copy(); NULL on error paths. */ + if (copy->copy_task) + put_task_struct(copy->copy_task); kfree(copy->cp_src); kfree(copy); } @@ -1820,6 +1823,8 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, memcpy(&copy->fh, &cstate->current_fh.fh_handle, sizeof(struct knfsd_fh)); if (nfsd4_copy_is_async(copy)) { + struct task_struct *task; + async_copy = kzalloc(sizeof(struct nfsd4_copy), GFP_KERNEL); if (!async_copy) goto out_err; @@ -1839,10 +1844,16 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, goto out_err; memcpy(&result->cb_stateid, &async_copy->cp_stateid.cs_stid, sizeof(result->cb_stateid)); - async_copy->copy_task = kthread_create(nfsd4_do_async_copy, - async_copy, "%s", "copy thread"); - if (IS_ERR(async_copy->copy_task)) + task = kthread_create(nfsd4_do_async_copy, async_copy, + "%s", "copy thread"); + if (IS_ERR(task)) goto out_err; + /* + * Pin the task_struct so kthread_stop() is safe even after + * this one-shot kthread exits. Released by nfs4_put_copy(). + */ + get_task_struct(task); + async_copy->copy_task = task; spin_lock(&async_copy->cp_clp->async_lock); list_add(&async_copy->copies, &async_copy->cp_clp->async_copies); -- 2.34.1

2 1

[PATCH OLK-5.10] nfsd: fix UAF in async copy cancel and shutdown
by Lu Jialin 10 Oct '26

10 Oct '26

From: Jeff Layton <jlayton(a)kernel.org> mainline inclusion from mainline-v7.3-rc1 commit 62c0f6eaf050bb9284c1f9cac6ed1770092e6b95 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18938 CVE: CVE-2026-89675 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------- An async copy could be freed or used after free while a teardown caller (OFFLOAD_CANCEL, nfsd4_shutdown_copy, nfsd4_cancel_copy_by_sb) raced the copy kthread: - find_async_copy() bumped copy->refcount but left the copy on clp->async_copies, so the reaper's cleanup_async_copy() could run release_copy_files() concurrently with a cancel/shutdown caller. Both put and NULL nf_src/nf_dst without a common lock, double-putting the nfsd_file and freeing it early. - nfsd4_do_async_copy() set NFSD4_COPY_F_STOPPED before its final uses of the copy (nfsd_update_cmtime_attr() on copy->nf_dst, nfsd4_send_cb_offload()). nfsd4_stop_copy() treats a set STOPPED bit as "kthread done, skip kthread_stop()", so a teardown caller ran release_copy_files() -- which puts and NULLs nf_dst -- while the kthread still dereferenced it (NULL/UAF). - copy->copy_task was never pinned. The one-shot kthread self-reaps on return, so kthread_stop()'s get_task_struct() could touch a freed task_struct. - co_cb is embedded in the copy, but nfsd4_send_cb_offload() held a reference only on the client, so a concurrent teardown could free the copy while the CB_OFFLOAD callback was in flight. Fix the teardown lifetime as a whole: - find_async_copy() unlinks the copy (clear cp_clp, list_del_init) under async_lock; the cancel, shutdown, and sb-cancel paths drop the list-membership reference via nfs4_put_copy() after nfsd4_stop_copy(). Drop the now-redundant list_del fixup from cleanup_async_copy(). - Because unlinking hides the copy from the reaper, its cleanup_async_copy() can no longer remove the copy's s2s_cp_stateids entry; the cancel/shutdown/sb-cancel paths now call nfs4_free_copy_state() themselves (while cp_clp is still valid) so the entry does not dangle at freed memory for the laundromat and manage_cpntf_state() to dereference. - Give the kthread its own reference, taken in nfsd4_copy() before wake_up_process() and dropped at the end of nfsd4_do_async_copy(); call wake_up_process() before list_add(). - Pin the task_struct with get_task_struct() in nfsd4_copy(), released in nfs4_put_copy(), so kthread_stop() is safe whenever the kthread exits. Set NFSD4_COPY_F_STOPPED only in nfsd4_stop_copy(), which now always kthread_stop()s before release_copy_files(); completion is still reported via NFSD4_COPY_F_COMPLETED, so nfsd4_has_active_async_copies() is unaffected. Each teardown caller removes the copy from clp->async_copies first, so kthread_stop() runs exactly once. - Take a copy reference in nfsd4_send_cb_offload(), dropped in nfsd4_cb_offload_release(). The kthread still holds its own reference there, so the refcount_inc() cannot race the final free. - Read cp_clp with smp_load_acquire() to pair with the unordered set_bit()/clear_bit() writers (Documentation/atomic_bitops.rst). Fixes: e0639dc5805a ("NFSD introduce async copy feature") Cc: stable(a)vger.kernel.org Fixes: ac0514f4d198 ("NFSD: Add a laundromat reaper for async copy state") Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Jeff Layton <jlayton(a)kernel.org> Link: https://patch.msgid.link/20260710-nfsd-testing-v3-2-a0ff7db6aa3e@kernel.org Signed-off-by: Chuck Lever <cel(a)kernel.org> Conflicts: fs/nfsd/nfs4proc.c [partial backport of 62c0f6eaf050; adapted so copy_task is assigned only after the kthread_create() IS_ERR() check passes] Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- fs/nfsd/nfs4proc.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c index ecbde42093d5..9d1fc070beea 100644 --- a/fs/nfsd/nfs4proc.c +++ b/fs/nfsd/nfs4proc.c @@ -1114,6 +1114,9 @@ void nfs4_put_copy(struct nfsd4_copy *copy) { if (!refcount_dec_and_test(&copy->refcount)) return; + /* Drop the task_struct pinned in nfsd4_copy(); NULL on error paths. */ + if (copy->copy_task) + put_task_struct(copy->copy_task); atomic_dec(&copy->cp_nn->pending_async_copies); kfree(copy); } @@ -1525,6 +1528,7 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, sizeof(struct knfsd_fh)); if (!copy->cp_synchronous) { struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id); + struct task_struct *task; async_copy = kzalloc(sizeof(struct nfsd4_copy), GFP_KERNEL); if (!async_copy) @@ -1541,10 +1545,16 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, goto out_err; memcpy(&copy->cp_res.cb_stateid, &async_copy->cp_stateid.stid, sizeof(copy->cp_res.cb_stateid)); - async_copy->copy_task = kthread_create(nfsd4_do_async_copy, - async_copy, "%s", "copy thread"); - if (IS_ERR(async_copy->copy_task)) + task = kthread_create(nfsd4_do_async_copy, async_copy, + "%s", "copy thread"); + if (IS_ERR(task)) goto out_err; + /* + * Pin the task_struct so kthread_stop() is safe even after + * this one-shot kthread exits. Released by nfs4_put_copy(). + */ + get_task_struct(task); + async_copy->copy_task = task; spin_lock(&async_copy->cp_clp->async_lock); list_add(&async_copy->copies, &async_copy->cp_clp->async_copies); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()
by superdcc97＠163.com 09 Oct '26

09 Oct '26

From: Xiang Mei <xmei5(a)asu.edu> mainline inclusion from mainline-v7.2-rc6 commit db3d0e0e5d4bc5ab4fe445b9f413d1b486508ca5 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17349 CVE: CVE-2026-74569 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- sip_help_tcp() stores the size change of each NAT-rewritten SIP message in s16 diff and accumulates it in s16 tdiff, but a single message can grow by more than S16_MAX while the packet stays under the 65535 enlarge_skb() limit: nf_nat_sip() rewrites every matching URI, and a long Contact list expands the message by tens of kilobytes. diff then wraps, and "datalen = datalen + diff - msglen" yields a huge unsigned datalen, so the next iteration's ct_sip_get_header() reads past the linearized skb tail. Widen diff, tdiff and the seq_adjust hook to s32. Both are bounded by the 65535 byte packet limit, and the seqadj core is already s32 (nf_ct_seqadj_set() takes s32), so no previously accepted input is rejected. BUG: KASAN: use-after-free in ct_sip_get_header (net/netfilter/nf_conntrack_sip.c:464) Read of size 1 at addr ffff888010800000 by task ksoftirqd/1/25 ct_sip_get_header (net/netfilter/nf_conntrack_sip.c:464) sip_help_tcp (net/netfilter/nf_conntrack_sip.c:1694) nf_confirm (net/netfilter/nf_conntrack_proto.c:183) nf_hook_slow (net/netfilter/core.c:619) ip6_output (net/ipv6/ip6_output.c:246) ip6_forward (net/ipv6/ip6_output.c:690) ipv6_rcv (net/ipv6/ip6_input.c:351) __netif_receive_skb_one_core (net/core/dev.c:6212) process_backlog (net/core/dev.c:6676) __napi_poll (net/core/dev.c:7735) net_rx_action (net/core/dev.c:7955) handle_softirqs (kernel/softirq.c:622) run_ksoftirqd (kernel/softirq.c:1076) ... Fixes: f5b321bd37fb ("netfilter: nf_conntrack_sip: add TCP support") Reported-by: Weiming Shi <bestswngs(a)gmail.com> Link: https://patch.msgid.link/netfilter-devel/20260712234201.3213635-1-xmei5@asu… Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Xiang Mei <xmei5(a)asu.edu> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/nf_conntrack_sip.c [context conflicts] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- include/linux/netfilter/nf_conntrack_sip.h | 2 +- net/netfilter/nf_conntrack_sip.c | 2 +- net/netfilter/nf_nat_sip.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/include/linux/netfilter/nf_conntrack_sip.h b/include/linux/netfilter/nf_conntrack_sip.h index c7fc38807a33..833054fd491c 100644 --- a/include/linux/netfilter/nf_conntrack_sip.h +++ b/include/linux/netfilter/nf_conntrack_sip.h @@ -116,7 +116,7 @@ struct nf_nat_sip_hooks { unsigned int *datalen); void (*seq_adjust)(struct sk_buff *skb, - unsigned int protoff, s16 off); + unsigned int protoff, s32 off); unsigned int (*expect)(struct sk_buff *skb, unsigned int protoff, diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c index c5817df62d79..e08ffc759e7d 100644 --- a/net/netfilter/nf_conntrack_sip.c +++ b/net/netfilter/nf_conntrack_sip.c @@ -1576,7 +1576,7 @@ static int sip_help_tcp(struct sk_buff *skb, unsigned int protoff, unsigned int matchoff, matchlen, clen; unsigned int msglen, origlen; const char *dptr, *end; - s16 diff, tdiff = 0; + s32 diff, tdiff = 0; int ret = NF_ACCEPT; bool term; diff --git a/net/netfilter/nf_nat_sip.c b/net/netfilter/nf_nat_sip.c index 41dbf9726796..3ff5663e1b97 100644 --- a/net/netfilter/nf_nat_sip.c +++ b/net/netfilter/nf_nat_sip.c @@ -314,7 +314,7 @@ static unsigned int nf_nat_sip(struct sk_buff *skb, unsigned int protoff, } static void nf_nat_sip_seq_adjust(struct sk_buff *skb, unsigned int protoff, - s16 off) + s32 off) { enum ip_conntrack_info ctinfo; struct nf_conn *ct = nf_ct_get(skb, &ctinfo); -- 2.43.0

2 1

[PATCH OLK-5.10] tracing: Set the trace clock before registering the histogram trigger
by Tengda Wu 09 Oct '26

09 Oct '26

From: Donggeun Yoo <donggeunyoo.kernel(a)gmail.com> mainline inclusion from mainline-v7.3-rc3 commit 6ede78d0563a2a3ae3e46f9c07cedb5d79645429 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20176 CVE: CVE-2026-97935 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- hist_register_trigger() puts the trigger on the global named_triggers list in cmd_ops->init(), and only then sets the trace clock: if (data->cmd_ops->init) { ret = data->cmd_ops->init(data); if (ret < 0) goto out; } if (hist_data->enable_timestamps) { ret = tracing_set_clock(file->tr, hist_data->attrs->clock); if (ret) { hist_err(tr, HIST_ERR_SET_CLOCK_FAIL, errpos(clock)); goto out; } The clock string is not checked anywhere before that call, so a named trigger using common_timestamp with an unknown clock fails after it has already become findable. event_hist_trigger_parse() then frees it without taking it off the list, and the next lookup by name reads the freed object: ~# cd /sys/kernel/tracing/events/sched/sched_switch ~# echo 'hist:name=foo:keys=common_pid:ts=common_timestamp:clock=bogus' > trigger bash: echo: write error: Invalid argument ~# echo 'hist:name=foo:keys=common_pid' > trigger BUG: KASAN: slab-use-after-free in find_named_trigger+0xac/0xc0 Read of size 8 at addr ffff88800915d760 by task init/1 find_named_trigger+0xac/0xc0 hist_register_trigger+0xc1/0x900 event_hist_trigger_parse+0x3146/0x6af0 event_trigger_write+0xce/0x160 Freed by task 63: kfree+0x154/0x420 trigger_kthread_fn+0xfd/0x160 Set the clock before the trigger is registered, so that nothing which can fail runs after it is published, the way commit 6f86bdeab633 ("tracing: Fix bad hist from corrupting named_triggers list") moved the registration below the rest of the setup. tracing_set_filter_buffering() is reference counted, so the init failure path has to drop the reference that the clock block now takes first. Cc: stable(a)vger.kernel.org Fixes: a4072fe85ba3 ("tracing: Add a clock attribute for hist triggers") Link: https://patch.msgid.link/20260907091415.554535-1-donggeunyoo.kernel@gmail.c… Signed-off-by: Donggeun Yoo <donggeunyoo.kernel(a)gmail.com> Signed-off-by: Steven Rostedt <rostedt(a)goodmis.org> Conflicts: kernel/trace/trace_events_hist.c [Two minimal adaptations are needed: 1) Replace cmd_ops with ops; 2) Replace tracing_set_filter_buffering with tracing_set_time_stamp_abs.] Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/trace/trace_events_hist.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c index 557b8c28faf4..0fc7c59af276 100644 --- a/kernel/trace/trace_events_hist.c +++ b/kernel/trace/trace_events_hist.c @@ -5577,12 +5577,6 @@ static int hist_register_trigger(char *glob, struct event_trigger_ops *ops, data->ops = &event_hist_trigger_named_ops; } - if (data->ops->init) { - ret = data->ops->init(data->ops, data); - if (ret < 0) - goto out; - } - if (hist_data->enable_timestamps) { char *clock = hist_data->attrs->clock; @@ -5595,6 +5589,15 @@ static int hist_register_trigger(char *glob, struct event_trigger_ops *ops, tracing_set_time_stamp_abs(file->tr, true); } + if (data->ops->init) { + ret = data->ops->init(data->ops, data); + if (ret < 0) { + if (hist_data->enable_timestamps) + tracing_set_time_stamp_abs(file->tr, false); + goto out; + } + } + if (named_data) destroy_hist_data(hist_data); -- 2.34.1

2 1

[PATCH OLK-6.6] nfsd: fix UAF in async copy cancel and shutdown
by Lu Jialin 09 Oct '26

09 Oct '26

From: Jeff Layton <jlayton(a)kernel.org> mainline inclusion from mainline-v7.3-rc1 commit62c0f6eaf050bb9284c1f9cac6ed1770092e6b95 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18938 CVE: CVE-2026-89675 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- An async copy could be freed or used after free while a teardown caller (OFFLOAD_CANCEL, nfsd4_shutdown_copy, nfsd4_cancel_copy_by_sb) raced the copy kthread: - find_async_copy() bumped copy->refcount but left the copy on clp->async_copies, so the reaper's cleanup_async_copy() could run release_copy_files() concurrently with a cancel/shutdown caller. Both put and NULL nf_src/nf_dst without a common lock, double-putting the nfsd_file and freeing it early. - nfsd4_do_async_copy() set NFSD4_COPY_F_STOPPED before its final uses of the copy (nfsd_update_cmtime_attr() on copy->nf_dst, nfsd4_send_cb_offload()). nfsd4_stop_copy() treats a set STOPPED bit as "kthread done, skip kthread_stop()", so a teardown caller ran release_copy_files() -- which puts and NULLs nf_dst -- while the kthread still dereferenced it (NULL/UAF). - copy->copy_task was never pinned. The one-shot kthread self-reaps on return, so kthread_stop()'s get_task_struct() could touch a freed task_struct. - co_cb is embedded in the copy, but nfsd4_send_cb_offload() held a reference only on the client, so a concurrent teardown could free the copy while the CB_OFFLOAD callback was in flight. Fix the teardown lifetime as a whole: - find_async_copy() unlinks the copy (clear cp_clp, list_del_init) under async_lock; the cancel, shutdown, and sb-cancel paths drop the list-membership reference via nfs4_put_copy() after nfsd4_stop_copy(). Drop the now-redundant list_del fixup from cleanup_async_copy(). - Because unlinking hides the copy from the reaper, its cleanup_async_copy() can no longer remove the copy's s2s_cp_stateids entry; the cancel/shutdown/sb-cancel paths now call nfs4_free_copy_state() themselves (while cp_clp is still valid) so the entry does not dangle at freed memory for the laundromat and manage_cpntf_state() to dereference. - Give the kthread its own reference, taken in nfsd4_copy() before wake_up_process() and dropped at the end of nfsd4_do_async_copy(); call wake_up_process() before list_add(). - Pin the task_struct with get_task_struct() in nfsd4_copy(), released in nfs4_put_copy(), so kthread_stop() is safe whenever the kthread exits. Set NFSD4_COPY_F_STOPPED only in nfsd4_stop_copy(), which now always kthread_stop()s before release_copy_files(); completion is still reported via NFSD4_COPY_F_COMPLETED, so nfsd4_has_active_async_copies() is unaffected. Each teardown caller removes the copy from clp->async_copies first, so kthread_stop() runs exactly once. - Take a copy reference in nfsd4_send_cb_offload(), dropped in nfsd4_cb_offload_release(). The kthread still holds its own reference there, so the refcount_inc() cannot race the final free. - Read cp_clp with smp_load_acquire() to pair with the unordered set_bit()/clear_bit() writers (Documentation/atomic_bitops.rst). Fixes: e0639dc5805a ("NFSD introduce async copy feature") Cc: stable(a)vger.kernel.org Fixes: ac0514f4d198 ("NFSD: Add a laundromat reaper for async copy state") Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Jeff Layton <jlayton(a)kernel.org> Link: https://patch.msgid.link/20260710-nfsd-testing-v3-2-a0ff7db6aa3e@kernel.org Signed-off-by: Chuck Lever <cel(a)kernel.org> Conflicts: fs/nfsd/nfs4proc.c [partial backport of 62c0f6eaf050; adapted so copy_task is assigned only after the kthread_create() IS_ERR() check passes] Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- fs/nfsd/nfs4proc.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c index 546d2a0900ab..d103858a67f6 100644 --- a/fs/nfsd/nfs4proc.c +++ b/fs/nfsd/nfs4proc.c @@ -1279,6 +1279,9 @@ static void nfs4_put_copy(struct nfsd4_copy *copy) if (!refcount_dec_and_test(&copy->refcount)) return; atomic_dec(&copy->cp_nn->pending_async_copies); + /* Drop the task_struct pinned in nfsd4_copy(); NULL on error paths. */ + if (copy->copy_task) + put_task_struct(copy->copy_task); kfree(copy->cp_src); kfree(copy); } @@ -1820,6 +1823,8 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, memcpy(&copy->fh, &cstate->current_fh.fh_handle, sizeof(struct knfsd_fh)); if (nfsd4_copy_is_async(copy)) { + struct task_struct *task; + async_copy = kzalloc(sizeof(struct nfsd4_copy), GFP_KERNEL); if (!async_copy) goto out_err; @@ -1839,10 +1844,16 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, goto out_err; memcpy(&result->cb_stateid, &async_copy->cp_stateid.cs_stid, sizeof(result->cb_stateid)); - async_copy->copy_task = kthread_create(nfsd4_do_async_copy, - async_copy, "%s", "copy thread"); - if (IS_ERR(async_copy->copy_task)) + task = kthread_create(nfsd4_do_async_copy, async_copy, + "%s", "copy thread"); + if (IS_ERR(task)) goto out_err; + /* + * Pin the task_struct so kthread_stop() is safe even after + * this one-shot kthread exits. Released by nfs4_put_copy(). + */ + get_task_struct(task); + async_copy->copy_task = task; spin_lock(&async_copy->cp_clp->async_lock); list_add(&async_copy->copies, &async_copy->cp_clp->async_copies); -- 2.34.1

2 1

[PATCH OLK-6.6 0/3] arm64: Fix NMI/DAIF handling in hibernate, suspend and kprobes
by Qinxin Xia 09 Oct '26

09 Oct '26

From: Hongye Lin <linhongye(a)h-partners.com> driver inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/10041 ---------------------------------------------------------------------- arm64: Fix NMI/DAIF handling in hibernate, suspend and kprobes Ada Couprie Diaz (1): arm64: hibernate: mask DAIF before restoring hibernated kernel Vladimir Murzin (2): arm64: suspend: Always initialise PSTATE.ALLINT arm64: kprobes: Disable NMIs arch/arm64/include/asm/daifflags.h | 1 + arch/arm64/include/asm/ptrace.h | 2 +- arch/arm64/kernel/hibernate.c | 12 ++++++++++++ arch/arm64/kernel/probes/kprobes.c | 8 +++++--- 4 files changed, 19 insertions(+), 4 deletions(-) -- 2.33.0

2 4

[PATCH 0/3] sched/numa: Keep communicating task pairs local on multi-level NUMA
by Zhang Qiao 09 Oct '26

09 Oct '26

On topologies where sched_groups inside a NUMA domain have different weights (e.g. a 4-node Arm system with 3 NUMA domain levels), the NUMA load balancer tears a pair of communicating tasks (lmbench bw_pipe -P 1) apart even on an otherwise idle system: ~760 MB/s when split vs ~1500 MB/s when the pair stays on one node. The unequal weights are a property of the distance matrix: with a non-uniform "diameter 3" NUMA topology, e.g. node 0 1 2 3 0: 10 12 35 37 1: 12 10 37 40 2: 35 37 10 12 3: 37 40 12 10 the kernel builds several NUMA sched_domain levels, and inside a level the groups are built by build_overlap_sched_groups() from the spans of the lower-level domains. Because each distance level covers a different set of nodes, some groups end up spanning two nodes while others span only one, so group_weight differs within a single domain (this is the diameter-3 case already documented in the comment above build_overlap_sched_groups()). Two defects are involved: 1. The imbalance is measured in idle-CPU differences. Between groups of different weight this counts capacity, not load, so an idle system computes a large phantom imbalance that actively splits the pair. Patches 1 and 2 fix the periodic and wake paths by comparing busy CPUs instead (no-op when weights are equal). 2. The floating imbalance tolerance is a fixed 2, which is below the busy-CPU difference the scheduler actually observes for a bare pair (2) plus kernel-thread noise (1-2): 3-4 in any balance snapshot. The split is executed by active balance, since the pair is always running and cannot be passively detached. Patch 3 caps the allowance at 4 (pair + noise) instead of scaling it with imb_numa_nr, whose uncapped use regressed large machines in 0-day testing (unixbench fstime -6.8% / fsdisk-w -26.7%) by letting independent throughput tasks accumulate. Measured on a 4-node Arm server (`lmbench bw_pipe -P 1`). The bandwidth is ~1500 MB/s when the reader/writer pair stays on one NUMA node, but drops to ~700 MB/s if split across nodes. * Upstream: Split in 8/10 runs (~760 MB/s). * Patches 1+2: Split in 4/10 runs (~1170 MB/s). However, running completely alone still resulted in 23/23 splits due to the kernel-thread noise mentioned above. * Patches 1+2+3: Zero splits (0/10 with noise, 0/12 alone). Bandwidth stabilized at ~1484 MB/s. All combinations of numa_balancing on/off and background system load present/removed were covered. On an equal-weight-group topology (2-socket x86 server) patches 1-2 are bit-identical no-ops, and patch 3 only raises the tolerance from 2 to at most 4 (versus 6-12 for the uncapped version rejected by 0-day). This is a reworked version of [1]: - the measurement fix is retained (patch 1, hunk 2 of [1]), and extended to the wake path (patch 2, new); - the threshold change (hunk 1 of [1]) is replaced by a capped allowance in patch 3: the uncapped version let large groups of independent throughput tasks accumulate, which 0-day measured as unixbench fstime -6.8% and fsdisk-w -26.7% [2]; - the dst_running change (hunk 3 of [1]) was dropped; no scenario was observed that requires it. [1] https://lore.kernel.org/all/20240524035438.2701479-1-zhangqiao22@huawei.com/ [2] https://lore.kernel.org/all/202406031516.a1956bdc-oliver.sang@intel.com/ Zhang Qiao (3): sched/numa: Use busy CPUs for imbalance with unequal group weights sched/numa: Use busy CPUs for wake-path imbalance with unequal group weights sched/numa: Cap the floating imbalance allowance at pair size kernel/sched/fair.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) -- 2.18.0

1 3