- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] apparmor: fix: limit the number of levels of policy namespaces
by Cui GaoSheng 07 Apr '26

07 Apr '26

From: John Johansen <john.johansen(a)canonical.com> stable inclusion from stable-v6.6.130 commit 3f8699b3ee0c04b4b9bc27b82cd89a40e81e1d2e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14047 CVE: CVE-2026-23405 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 306039414932c80f8420695a24d4fe10c84ccfb2 upstream. Currently the number of policy namespaces is not bounded relying on the user namespace limit. However policy namespaces aren't strictly tied to user namespaces and it is possible to create them and nest them arbitrarily deep which can be used to exhaust system resource. Hard cap policy namespaces to the same depth as user namespaces. Fixes: c88d4c7b049e8 ("AppArmor: core policy routines") Reported-by: Qualys Security Advisory <qsa(a)qualys.com> Reviewed-by: Ryan Lee <ryan.lee(a)canonical.com> Reviewed-by: Cengiz Can <cengiz.can(a)canonical.com> Signed-off-by: John Johansen <john.johansen(a)canonical.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Cui GaoSheng <cuigaosheng1(a)huawei.com> --- security/apparmor/include/policy_ns.h | 2 ++ security/apparmor/policy_ns.c | 2 ++ 2 files changed, 4 insertions(+) diff --git a/security/apparmor/include/policy_ns.h b/security/apparmor/include/policy_ns.h index 3df6f804922d..e5704947e86e 100644 --- a/security/apparmor/include/policy_ns.h +++ b/security/apparmor/include/policy_ns.h @@ -18,6 +18,8 @@ #include "label.h" #include "policy.h" +/* Match max depth of user namespaces */ +#define MAX_NS_DEPTH 32 /* struct aa_ns_acct - accounting of profiles in namespace * @max_size: maximum space allowed for all profiles in namespace diff --git a/security/apparmor/policy_ns.c b/security/apparmor/policy_ns.c index 53d24cf63893..5d342ef078e9 100644 --- a/security/apparmor/policy_ns.c +++ b/security/apparmor/policy_ns.c @@ -249,6 +249,8 @@ static struct aa_ns *__aa_create_ns(struct aa_ns *parent, const char *name, AA_BUG(!name); AA_BUG(!mutex_is_locked(&parent->lock)); + if (parent->level > MAX_NS_DEPTH) + return ERR_PTR(-ENOSPC); ns = alloc_ns(parent->base.hname, name); if (!ns) return ERR_PTR(-ENOMEM); -- 2.34.1

2 1

[PATCH OLK-5.10] apparmor: replace recursive profile removal with iterative approach
by Cui GaoSheng 07 Apr '26

07 Apr '26

From: Massimiliano Pellizzer <massimiliano.pellizzer(a)canonical.com> stable inclusion from stable-v6.6.130 commit 33959a491e9fd557abfa5fce5ae4637d400915d3 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14038 CVE: CVE-2026-23404 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit ab09264660f9de5d05d1ef4e225aa447c63a8747 upstream. The profile removal code uses recursion when removing nested profiles, which can lead to kernel stack exhaustion and system crashes. Reproducer: $ pf='a'; for ((i=0; i<1024; i++)); do echo -e "profile $pf { \n }" | apparmor_parser -K -a; pf="$pf//x"; done $ echo -n a > /sys/kernel/security/apparmor/.remove Replace the recursive __aa_profile_list_release() approach with an iterative approach in __remove_profile(). The function repeatedly finds and removes leaf profiles until the entire subtree is removed, maintaining the same removal semantic without recursion. Fixes: c88d4c7b049e ("AppArmor: core policy routines") Reported-by: Qualys Security Advisory <qsa(a)qualys.com> Tested-by: Salvatore Bonaccorso <carnil(a)debian.org> Reviewed-by: Georgia Garcia <georgia.garcia(a)canonical.com> Reviewed-by: Cengiz Can <cengiz.can(a)canonical.com> Signed-off-by: Massimiliano Pellizzer <massimiliano.pellizzer(a)canonical.com> Signed-off-by: John Johansen <john.johansen(a)canonical.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Cui GaoSheng <cuigaosheng1(a)huawei.com> --- security/apparmor/policy.c | 30 +++++++++++++++++++++++++++--- 1 file changed, 27 insertions(+), 3 deletions(-) diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c index e5f501f89803..57be581980b3 100644 --- a/security/apparmor/policy.c +++ b/security/apparmor/policy.c @@ -146,19 +146,43 @@ static void __list_remove_profile(struct aa_profile *profile) } /** - * __remove_profile - remove old profile, and children - * @profile: profile to be replaced (NOT NULL) + * __remove_profile - remove profile, and children + * @profile: profile to be removed (NOT NULL) * * Requires: namespace list lock be held, or list not be shared */ static void __remove_profile(struct aa_profile *profile) { + struct aa_profile *curr, *to_remove; + AA_BUG(!profile); AA_BUG(!profile->ns); AA_BUG(!mutex_is_locked(&profile->ns->lock)); /* release any children lists first */ - __aa_profile_list_release(&profile->base.profiles); + if (!list_empty(&profile->base.profiles)) { + curr = list_first_entry(&profile->base.profiles, struct aa_profile, base.list); + + while (curr != profile) { + + while (!list_empty(&curr->base.profiles)) + curr = list_first_entry(&curr->base.profiles, + struct aa_profile, base.list); + + to_remove = curr; + if (!list_is_last(&to_remove->base.list, + &aa_deref_parent(curr)->base.profiles)) + curr = list_next_entry(to_remove, base.list); + else + curr = aa_deref_parent(curr); + + /* released by free_profile */ + aa_label_remove(&to_remove->label); + __aafs_profile_rmdir(to_remove); + __list_remove_profile(to_remove); + } + } + /* released by free_profile */ aa_label_remove(&profile->label); __aafs_profile_rmdir(profile); -- 2.34.1

2 1

[PATCH OLK-6.6 v6 0/2] kvm: arm64: Transition from CPU Type to MIDR Register for Virtualization Feature Detection
by liqiqi 07 Apr '26

07 Apr '26

Currently, there are two methods for determining whether a chip supports specific virtualization features: 1. Reading the chip's CPU type from BIOS 2. Reading the value of the MIDR register The issue with the first method is that each time a new chip is introduced, the new CPU type must be defined, which leads to poor code portability and maintainability. Therefore, the second method has been adopted to replace the first. This approach eliminates the dependency on CPU type by using the MIDR register. liqiqi (2): kvm: arm64: Add MIDR definitions and use MIDR to determine whether features are supported kvm: arm64: Remove cpu_type definition and it's related interfaces arch/arm64/include/asm/cache.h | 2 +- arch/arm64/include/asm/cputype.h | 8 +- arch/arm64/kernel/cpu_errata.c | 4 +- arch/arm64/kernel/cpufeature.c | 2 +- arch/arm64/kernel/proton-pack.c | 4 +- arch/arm64/kvm/arm.c | 1 - arch/arm64/kvm/hisilicon/hisi_virt.c | 110 +++-------------------- arch/arm64/kvm/hisilicon/hisi_virt.h | 12 --- drivers/perf/hisilicon/hisi_uncore_pmu.c | 2 +- tools/arch/arm64/include/asm/cputype.h | 4 +- 10 files changed, 25 insertions(+), 124 deletions(-) -- 2.43.0

2 3

[PATCH OLK-6.6] nf_tables: nft_dynset: fix possible stateful expression memleak in error path
by Dong Chenchen 07 Apr '26

07 Apr '26

From: Pablo Neira Ayuso <pablo(a)netfilter.org> mainline inclusion from mainline-v7.0-rc3 commit 0548a13b5a145b16e4da0628b5936baf35f51b43 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14034 CVE: CVE-2026-23399 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If cloning the second stateful expression in the element via GFP_ATOMIC fails, then the first stateful expression remains in place without being released. unreferenced object (percpu) 0x607b97e9cab8 (size 16): comm "softirq", pid 0, jiffies 4294931867 hex dump (first 16 bytes on cpu 3): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 backtrace (crc 0): pcpu_alloc_noprof+0x453/0xd80 nft_counter_clone+0x9c/0x190 [nf_tables] nft_expr_clone+0x8f/0x1b0 [nf_tables] nft_dynset_new+0x2cb/0x5f0 [nf_tables] nft_rhash_update+0x236/0x11c0 [nf_tables] nft_dynset_eval+0x11f/0x670 [nf_tables] nft_do_chain+0x253/0x1700 [nf_tables] nft_do_chain_ipv4+0x18d/0x270 [nf_tables] nf_hook_slow+0xaa/0x1e0 ip_local_deliver+0x209/0x330 Fixes: 563125a73ac3 ("netfilter: nftables: generalize set extension to support for several expressions") Reported-by: Gurpreet Shergill <giki.shergill(a)proton.me> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Florian Westphal <fw(a)strlen.de> Conflicts: include/net/netfilter/nf_tables.h net/netfilter/nft_dynset.c [commit 9dad402b89e8 is not backport] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- include/net/netfilter/nf_tables.h | 2 ++ net/netfilter/nf_tables_api.c | 4 ++-- net/netfilter/nft_dynset.c | 10 +++++++++- 3 files changed, 13 insertions(+), 3 deletions(-) diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h index e1c4d903f39b..0f890ff1769b 100644 --- a/include/net/netfilter/nf_tables.h +++ b/include/net/netfilter/nf_tables.h @@ -859,6 +859,8 @@ void *nft_set_elem_init(const struct nft_set *set, u64 timeout, u64 expiration, gfp_t gfp); int nft_set_elem_expr_clone(const struct nft_ctx *ctx, struct nft_set *set, struct nft_expr *expr_array[]); +void nft_set_elem_expr_destroy(const struct nft_ctx *ctx, + struct nft_set_elem_expr *elem_expr); void nft_set_elem_destroy(const struct nft_set *set, void *elem, bool destroy_expr); void nf_tables_set_elem_destroy(const struct nft_ctx *ctx, diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 98d3156179ee..9d5f7bafa4d6 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -6471,8 +6471,8 @@ static void __nft_set_elem_expr_destroy(const struct nft_ctx *ctx, } } -static void nft_set_elem_expr_destroy(const struct nft_ctx *ctx, - struct nft_set_elem_expr *elem_expr) +void nft_set_elem_expr_destroy(const struct nft_ctx *ctx, + struct nft_set_elem_expr *elem_expr) { struct nft_expr *expr; u32 size; diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c index a81bd69b059b..8ea45d61ed88 100644 --- a/net/netfilter/nft_dynset.c +++ b/net/netfilter/nft_dynset.c @@ -30,18 +30,26 @@ static int nft_dynset_expr_setup(const struct nft_dynset *priv, const struct nft_set_ext *ext) { struct nft_set_elem_expr *elem_expr = nft_set_ext_expr(ext); + struct nft_ctx ctx = { + .net = read_pnet(&priv->set->net), + .family = priv->set->table->family, + }; struct nft_expr *expr; int i; for (i = 0; i < priv->num_exprs; i++) { expr = nft_setelem_expr_at(elem_expr, elem_expr->size); if (nft_expr_clone(expr, priv->expr_array[i], GFP_ATOMIC) < 0) - return -1; + goto err_out; elem_expr->size += priv->expr_array[i]->ops->size; } return 0; +err_out: + nft_set_elem_expr_destroy(&ctx, elem_expr); + + return -1; } static void *nft_dynset_new(struct nft_set *set, const struct nft_expr *expr, -- 2.25.1

2 1

[PATCH OLK-6.6 0/2] xdp: Fix CVE-2026-23343
by Dong Chenchen 07 Apr '26

07 Apr '26

Fix CVE-2026-23343 Larysa Zaremba (2): xdp: use modulo operation to calculate XDP frag tailroom xdp: produce a warning when calculated tailroom is negative net/core/filter.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10 1/3] xen/privcmd: restrict usage in unprivileged domU
by Zhang Yuwei 07 Apr '26

07 Apr '26

From: Juergen Gross <jgross(a)suse.com> mainline inclusion from mainline-v7.0-rc6 commit 453b8fb68f3641fea970db88b7d9a153ed2a37e8 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14027 CVE: CVE-2026-31788 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The Xen privcmd driver allows to issue arbitrary hypercalls from user space processes. This is normally no problem, as access is usually limited to root and the hypervisor will deny any hypercalls affecting other domains. In case the guest is booted using secure boot, however, the privcmd driver would be enabling a root user process to modify e.g. kernel memory contents, thus breaking the secure boot feature. The only known case where an unprivileged domU is really needing to use the privcmd driver is the case when it is acting as the device model for another guest. In this case all hypercalls issued via the privcmd driver will target that other guest. Fortunately the privcmd driver can already be locked down to allow only hypercalls targeting a specific domain, but this mode can be activated from user land only today. The target domain can be obtained from Xenstore, so when not running in dom0 restrict the privcmd driver to that target domain from the beginning, resolving the potential problem of breaking secure boot. This is XSA-482 Reported-by: Teddy Astie <teddy.astie(a)vates.tech> Fixes: 1c5de1939c20 ("xen: add privcmd driver") Signed-off-by: Juergen Gross <jgross(a)suse.com> Conflicts: drivers/xen/privcmd.c [commit bf4afc53b77ae not merged] Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> it push" to publish your local commits) --- drivers/xen/privcmd.c | 62 +++++++++++++++++++++++++++++++++++++++---- 1 file changed, 57 insertions(+), 5 deletions(-) diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c index 28537a1a0e0b..cb50038c0c9c 100644 --- a/drivers/xen/privcmd.c +++ b/drivers/xen/privcmd.c @@ -10,6 +10,7 @@ #define pr_fmt(fmt) "xen:" KBUILD_MODNAME ": " fmt #include <linux/kernel.h> +#include <linux/kstrtox.h> #include <linux/module.h> #include <linux/sched.h> #include <linux/slab.h> @@ -24,7 +25,8 @@ #include <linux/seq_file.h> #include <linux/miscdevice.h> #include <linux/moduleparam.h> - +#include <linux/notifier.h> +#include <linux/wait.h> #include <asm/xen/hypervisor.h> #include <asm/xen/hypercall.h> @@ -37,7 +39,7 @@ #include <xen/page.h> #include <xen/xen-ops.h> #include <xen/balloon.h> - +#include <xen/xenbus.h> #include "privcmd.h" MODULE_LICENSE("GPL"); @@ -59,6 +61,11 @@ struct privcmd_data { domid_t domid; }; +/* DOMID_INVALID implies no restriction */ +static domid_t target_domain = DOMID_INVALID; +static bool restrict_wait; +static DECLARE_WAIT_QUEUE_HEAD(restrict_wait_wq); + static int privcmd_vma_range_is_mapped( struct vm_area_struct *vma, unsigned long addr, @@ -878,13 +885,16 @@ static long privcmd_ioctl(struct file *file, static int privcmd_open(struct inode *ino, struct file *file) { - struct privcmd_data *data = kzalloc(sizeof(*data), GFP_KERNEL); + struct privcmd_data *data; + if (wait_event_interruptible(restrict_wait_wq, !restrict_wait) < 0) + return -EINTR; + + data = kzalloc(sizeof(*data), GFP_KERNEL); if (!data) return -ENOMEM; - /* DOMID_INVALID implies no restriction */ - data->domid = DOMID_INVALID; + data->domid = target_domain; file->private_data = data; return 0; @@ -977,6 +987,45 @@ static struct miscdevice privcmd_dev = { .fops = &xen_privcmd_fops, }; +static int init_restrict(struct notifier_block *notifier, + unsigned long event, + void *data) +{ + char *target; + unsigned int domid; + + /* Default to an guaranteed unused domain-id. */ + target_domain = DOMID_IDLE; + + target = xenbus_read(XBT_NIL, "target", "", NULL); + if (IS_ERR(target) || kstrtouint(target, 10, &domid)) { + pr_err("No target domain found, blocking all hypercalls\n"); + goto out; + } + + target_domain = domid; + + out: + if (!IS_ERR(target)) + kfree(target); + + restrict_wait = false; + wake_up_all(&restrict_wait_wq); + + return NOTIFY_DONE; +} + +static struct notifier_block xenstore_notifier = { + .notifier_call = init_restrict, +}; + +static void __init restrict_driver(void) +{ + restrict_wait = true; + + register_xenstore_notifier(&xenstore_notifier); +} + static int __init privcmd_init(void) { int err; @@ -984,6 +1033,9 @@ static int __init privcmd_init(void) if (!xen_domain()) return -ENODEV; + if (!xen_initial_domain()) + restrict_driver(); + err = misc_register(&privcmd_dev); if (err != 0) { pr_err("Could not register Xen privcmd device\n"); -- 2.22.0

2 3

[PATCH OLK-6.6 1/3] xen/privcmd: restrict usage in unprivileged domU
by Zhang Yuwei 07 Apr '26

07 Apr '26

From: Juergen Gross <jgross(a)suse.com> mainline inclusion from mainline-v7.0-rc6 commit 453b8fb68f3641fea970db88b7d9a153ed2a37e8 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14027 CVE: CVE-2026-31788 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The Xen privcmd driver allows to issue arbitrary hypercalls from user space processes. This is normally no problem, as access is usually limited to root and the hypervisor will deny any hypercalls affecting other domains. In case the guest is booted using secure boot, however, the privcmd driver would be enabling a root user process to modify e.g. kernel memory contents, thus breaking the secure boot feature. The only known case where an unprivileged domU is really needing to use the privcmd driver is the case when it is acting as the device model for another guest. In this case all hypercalls issued via the privcmd driver will target that other guest. Fortunately the privcmd driver can already be locked down to allow only hypercalls targeting a specific domain, but this mode can be activated from user land only today. The target domain can be obtained from Xenstore, so when not running in dom0 restrict the privcmd driver to that target domain from the beginning, resolving the potential problem of breaking secure boot. This is XSA-482 Reported-by: Teddy Astie <teddy.astie(a)vates.tech> Fixes: 1c5de1939c20 ("xen: add privcmd driver") Signed-off-by: Juergen Gross <jgross(a)suse.com> Conflicts: drivers/xen/privcmd.c [commit bf4afc53b77ae not merged] Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> --- drivers/xen/privcmd.c | 62 +++++++++++++++++++++++++++++++++++++++---- 1 file changed, 57 insertions(+), 5 deletions(-) diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c index 61aaded483e1..3c97710fc094 100644 --- a/drivers/xen/privcmd.c +++ b/drivers/xen/privcmd.c @@ -12,6 +12,7 @@ #include <linux/eventfd.h> #include <linux/file.h> #include <linux/kernel.h> +#include <linux/kstrtox.h> #include <linux/module.h> #include <linux/mutex.h> #include <linux/poll.h> @@ -30,7 +31,8 @@ #include <linux/seq_file.h> #include <linux/miscdevice.h> #include <linux/moduleparam.h> - +#include <linux/notifier.h> +#include <linux/wait.h> #include <asm/xen/hypervisor.h> #include <asm/xen/hypercall.h> @@ -43,7 +45,7 @@ #include <xen/page.h> #include <xen/xen-ops.h> #include <xen/balloon.h> - +#include <xen/xenbus.h> #include "privcmd.h" MODULE_LICENSE("GPL"); @@ -65,6 +67,11 @@ struct privcmd_data { domid_t domid; }; +/* DOMID_INVALID implies no restriction */ +static domid_t target_domain = DOMID_INVALID; +static bool restrict_wait; +static DECLARE_WAIT_QUEUE_HEAD(restrict_wait_wq); + static int privcmd_vma_range_is_mapped( struct vm_area_struct *vma, unsigned long addr, @@ -1156,13 +1163,16 @@ static long privcmd_ioctl(struct file *file, static int privcmd_open(struct inode *ino, struct file *file) { - struct privcmd_data *data = kzalloc(sizeof(*data), GFP_KERNEL); + struct privcmd_data *data; + if (wait_event_interruptible(restrict_wait_wq, !restrict_wait) < 0) + return -EINTR; + + data = kzalloc(sizeof(*data), GFP_KERNEL); if (!data) return -ENOMEM; - /* DOMID_INVALID implies no restriction */ - data->domid = DOMID_INVALID; + data->domid = target_domain; file->private_data = data; return 0; @@ -1255,6 +1265,45 @@ static struct miscdevice privcmd_dev = { .fops = &xen_privcmd_fops, }; +static int init_restrict(struct notifier_block *notifier, + unsigned long event, + void *data) +{ + char *target; + unsigned int domid; + + /* Default to an guaranteed unused domain-id. */ + target_domain = DOMID_IDLE; + + target = xenbus_read(XBT_NIL, "target", "", NULL); + if (IS_ERR(target) || kstrtouint(target, 10, &domid)) { + pr_err("No target domain found, blocking all hypercalls\n"); + goto out; + } + + target_domain = domid; + + out: + if (!IS_ERR(target)) + kfree(target); + + restrict_wait = false; + wake_up_all(&restrict_wait_wq); + + return NOTIFY_DONE; +} + +static struct notifier_block xenstore_notifier = { + .notifier_call = init_restrict, +}; + +static void __init restrict_driver(void) +{ + restrict_wait = true; + + register_xenstore_notifier(&xenstore_notifier); +} + static int __init privcmd_init(void) { int err; @@ -1262,6 +1311,9 @@ static int __init privcmd_init(void) if (!xen_domain()) return -ENODEV; + if (!xen_initial_domain()) + restrict_driver(); + err = misc_register(&privcmd_dev); if (err != 0) { pr_err("Could not register Xen privcmd device\n"); -- 2.22.0

2 3

[PATCH OLK-6.6] sched/fair: scale wake_wide() threshold by SMT width
by Zhang Qiao 07 Apr '26

07 Apr '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8882 -------------------------------- wake_wide() uses sd_llc_size as the spreading threshold to detect wide waker/wakee relationships and to disable wake_affine() for those cases. On SMT systems, sd_llc_size counts logical CPUs rather than physical cores. This inflates the wake_wide() threshold, allowing wake_affine() to pack more tasks into one LLC domain than the actual compute capacity of its physical cores can sustain. The resulting SMT interference may cost more than the cache-locality benefit wake_affine() intends to gain. Scale the factor by the SMT width of the current CPU so that it approximates the number of independent physical cores in the LLC domain, making wake_wide() more likely to kick in before SMT interference becomes significant. On non-SMT systems the SMT width is 1 and behaviour is unchanged. Signed-off-by: Zhang Qiao <zhangqiao22(a)huawei.com> --- kernel/sched/fair.c | 5 +++++ kernel/sched/features.h | 2 ++ 2 files changed, 7 insertions(+) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index ad30bb800961..4100998e18cd 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -7850,6 +7850,11 @@ static int wake_wide(struct task_struct *p) unsigned int slave = p->wakee_flips; int factor = __this_cpu_read(sd_llc_size); + /* Scale factor to physical-core count to account for SMT interference. */ + if (sched_feat(WA_SMT)) + factor = DIV_ROUND_UP(factor, + cpumask_weight(cpu_smt_mask(smp_processor_id()))); + if (master < slave) swap(master, slave); if (slave < factor || master < slave * factor) diff --git a/kernel/sched/features.h b/kernel/sched/features.h index 24a0c853a8a0..c9ad8e72ecd0 100644 --- a/kernel/sched/features.h +++ b/kernel/sched/features.h @@ -128,3 +128,5 @@ SCHED_FEAT(SOFT_DOMAIN, false) #ifdef CONFIG_SCHED_SOFT_QUOTA SCHED_FEAT(SOFT_QUOTA, false) #endif + +SCHED_FEAT(WA_SMT, false) -- 2.18.0

2 1

[PATCH OLK-6.6] sched/fair: scale wake_wide() threshold by SMT width
by Zhang Qiao 07 Apr '26

07 Apr '26

hulk inclusion category: perfermance bugzilla: https://atomgit.com/openeuler/kernel/issues/8882 -------------------------------- wake_wide() uses sd_llc_size as the spreading threshold to detect wide waker/wakee relationships and to disable wake_affine() for those cases. On SMT systems, sd_llc_size counts logical CPUs rather than physical cores. This inflates the wake_wide() threshold, allowing wake_affine() to pack more tasks into one LLC domain than the actual compute capacity of its physical cores can sustain. The resulting SMT interference may cost more than the cache-locality benefit wake_affine() intends to gain. Scale the factor by the SMT width of the current CPU so that it approximates the number of independent physical cores in the LLC domain, making wake_wide() more likely to kick in before SMT interference becomes significant. On non-SMT systems the SMT width is 1 and behaviour is unchanged. Signed-off-by: Zhang Qiao <zhangqiao22(a)huawei.com> --- kernel/sched/fair.c | 5 +++++ kernel/sched/features.h | 2 ++ 2 files changed, 7 insertions(+) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index ad30bb800961..4100998e18cd 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -7850,6 +7850,11 @@ static int wake_wide(struct task_struct *p) unsigned int slave = p->wakee_flips; int factor = __this_cpu_read(sd_llc_size); + /* Scale factor to physical-core count to account for SMT interference. */ + if (sched_feat(WA_SMT)) + factor = DIV_ROUND_UP(factor, + cpumask_weight(cpu_smt_mask(smp_processor_id()))); + if (master < slave) swap(master, slave); if (slave < factor || master < slave * factor) diff --git a/kernel/sched/features.h b/kernel/sched/features.h index 24a0c853a8a0..c9ad8e72ecd0 100644 --- a/kernel/sched/features.h +++ b/kernel/sched/features.h @@ -128,3 +128,5 @@ SCHED_FEAT(SOFT_DOMAIN, false) #ifdef CONFIG_SCHED_SOFT_QUOTA SCHED_FEAT(SOFT_QUOTA, false) #endif + +SCHED_FEAT(WA_SMT, false) -- 2.18.0

2 1

[PATCH OLK-6.6 0/2] Fix riscv check-build warning
by Tengda Wu 07 Apr '26

07 Apr '26

Fix rsicv check-build warning. Björn Töpel (1): riscv: Replace function-like macro by static inline function Tengda Wu (1): Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" arch/riscv/include/asm/cacheflush.h | 15 ++++++++++----- arch/riscv/kernel/stacktrace.c | 16 ---------------- 2 files changed, 10 insertions(+), 21 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] ice: Fix memory leak in ice_set_ringparam()
by Pan Taixi 07 Apr '26

07 Apr '26

From: Zilin Guan <zilin(a)seu.edu.cn> mainline inclusion from mainline-v7.0-rc3 commit fe868b499d16f55bbeea89992edb98043c9de416 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14020/ CVE: CVE-2026-23389 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In ice_set_ringparam, tx_rings and xdp_rings are allocated before rx_rings. If the allocation of rx_rings fails, the code jumps to the done label leaking both tx_rings and xdp_rings. Furthermore, if the setup of an individual Rx ring fails during the loop, the code jumps to the free_tx label which releases tx_rings but leaks xdp_rings. Fix this by introducing a free_xdp label and updating the error paths to ensure both xdp_rings and tx_rings are properly freed if rx_rings allocation or setup fails. Compile tested only. Issue found using a prototype static analysis tool and code review. Fixes: fcea6f3da546 ("ice: Add stats and ethtool support") Fixes: efc2214b6047 ("ice: Add support for XDP") Signed-off-by: Zilin Guan <zilin(a)seu.edu.cn> Reviewed-by: Paul Menzel <pmenzel(a)molgen.mpg.de> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov(a)intel.com> Tested-by: Rinitha S <sx.rinitha(a)intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com> Conflicts: drivers/net/ethernet/intel/ice/ice_ethtool.c [Context conflicts due to different memory allocation function used] Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com> --- drivers/net/ethernet/intel/ice/ice_ethtool.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c b/drivers/net/ethernet/intel/ice/ice_ethtool.c index dd58b2372dc0..bab857a6dc18 100644 --- a/drivers/net/ethernet/intel/ice/ice_ethtool.c +++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c @@ -2839,7 +2839,7 @@ ice_set_ringparam(struct net_device *netdev, struct ethtool_ringparam *ring, rx_rings = kcalloc(vsi->num_rxq, sizeof(*rx_rings), GFP_KERNEL); if (!rx_rings) { err = -ENOMEM; - goto done; + goto free_xdp; } ice_for_each_rxq(vsi, i) { @@ -2869,7 +2869,7 @@ ice_set_ringparam(struct net_device *netdev, struct ethtool_ringparam *ring, } kfree(rx_rings); err = -ENOMEM; - goto free_tx; + goto free_xdp; } } @@ -2920,6 +2920,13 @@ ice_set_ringparam(struct net_device *netdev, struct ethtool_ringparam *ring, } goto done; +free_xdp: + if (xdp_rings) { + ice_for_each_xdp_txq(vsi, i) + ice_free_tx_ring(&xdp_rings[i]); + kfree(xdp_rings); + } + free_tx: /* error cleanup if the Rx allocations failed after getting Tx */ if (tx_rings) { -- 2.34.1

2 1

[PATCH OLK-5.10] ice: Fix memory leak in ice_set_ringparam()
by Pan Taixi 07 Apr '26

07 Apr '26

From: Zilin Guan <zilin(a)seu.edu.cn> mainline inclusion from mainline-v7.0-rc3 commit fe868b499d16f55bbeea89992edb98043c9de416 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14020/ CVE: CVE-2026-23389 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In ice_set_ringparam, tx_rings and xdp_rings are allocated before rx_rings. If the allocation of rx_rings fails, the code jumps to the done label leaking both tx_rings and xdp_rings. Furthermore, if the setup of an individual Rx ring fails during the loop, the code jumps to the free_tx label which releases tx_rings but leaks xdp_rings. Fix this by introducing a free_xdp label and updating the error paths to ensure both xdp_rings and tx_rings are properly freed if rx_rings allocation or setup fails. Compile tested only. Issue found using a prototype static analysis tool and code review. Fixes: fcea6f3da546 ("ice: Add stats and ethtool support") Fixes: efc2214b6047 ("ice: Add support for XDP") Signed-off-by: Zilin Guan <zilin(a)seu.edu.cn> Reviewed-by: Paul Menzel <pmenzel(a)molgen.mpg.de> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov(a)intel.com> Tested-by: Rinitha S <sx.rinitha(a)intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com> Conflicts: drivers/net/ethernet/intel/ice/ice_ethtool.c [ Context conflicts due to different memory allocation function used. Also, ice_for_each_xdp_txq is introduced in unmmerged commit 2faf63b650bb ("ice: make use of ice_for_each_* macros"), use normal for loops here instead. ] Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com> --- drivers/net/ethernet/intel/ice/ice_ethtool.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c b/drivers/net/ethernet/intel/ice/ice_ethtool.c index 9659668279dc..585ae5e92558 100644 --- a/drivers/net/ethernet/intel/ice/ice_ethtool.c +++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c @@ -2865,7 +2865,7 @@ ice_set_ringparam(struct net_device *netdev, struct ethtool_ringparam *ring, rx_rings = kcalloc(vsi->num_rxq, sizeof(*rx_rings), GFP_KERNEL); if (!rx_rings) { err = -ENOMEM; - goto done; + goto free_xdp; } ice_for_each_rxq(vsi, i) { @@ -2894,7 +2894,7 @@ ice_set_ringparam(struct net_device *netdev, struct ethtool_ringparam *ring, } kfree(rx_rings); err = -ENOMEM; - goto free_tx; + goto free_xdp; } } @@ -2945,6 +2945,13 @@ ice_set_ringparam(struct net_device *netdev, struct ethtool_ringparam *ring, } goto done; +free_xdp: + if (xdp_rings) { + for (i = 0; i < vsi->num_xdp_txq; i++) + ice_free_tx_ring(&xdp_rings[i]); + kfree(xdp_rings); + } + free_tx: /* error cleanup if the Rx allocations failed after getting Tx */ if (tx_rings) { -- 2.34.1

2 1

[PATCH OLK-6.6] pstore/ram: fix buffer overflow in persistent_ram_save_old()
by Pan Taixi 07 Apr '26

07 Apr '26

From: Sai Ritvik Tanksalkar <stanksal(a)purdue.edu> stable inclusion from stable-v6.6.128 commit cff0ef043e16feb5a02307c8f9d0117a96c5587c category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8792 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5669645c052f235726a85f443769b6fc02f66762 ] persistent_ram_save_old() can be called multiple times for the same persistent_ram_zone (e.g., via ramoops_pstore_read -> ramoops_get_next_prz for PSTORE_TYPE_DMESG records). Currently, the function only allocates prz->old_log when it is NULL, but it unconditionally updates prz->old_log_size to the current buffer size and then performs memcpy_fromio() using this new size. If the buffer size has grown since the first allocation (which can happen across different kernel boot cycles), this leads to: 1. A heap buffer overflow (OOB write) in the memcpy_fromio() calls 2. A subsequent OOB read when ramoops_pstore_read() accesses the buffer using the incorrect (larger) old_log_size The KASAN splat would look similar to: BUG: KASAN: slab-out-of-bounds in ramoops_pstore_read+0x... Read of size N at addr ... by task ... The conditions are likely extremely hard to hit: 0. Crash with a ramoops write of less-than-record-max-size bytes. 1. Reboot: ramoops registers, pstore_get_records(0) reads old crash, allocates old_log with size X 2. Crash handler registered, timer started (if pstore_update_ms >= 0) 3. Oops happens (non-fatal, system continues) 4. pstore_dump() writes oops via ramoops_pstore_write() size Y (>X) 5. pstore_new_entry = 1, pstore_timer_kick() called 6. System continues running (not a panic oops) 7. Timer fires after pstore_update_ms milliseconds 8. pstore_timefunc() → schedule_work() → pstore_dowork() → pstore_get_records(1) 9. ramoops_get_next_prz() → persistent_ram_save_old() 10. buffer_size() returns Y, but old_log is X bytes 11. Y > X: memcpy_fromio() overflows heap Requirements: - a prior crash record exists that did not fill the record size (almost impossible since the crash handler writes as much as it can possibly fit into the record, capped by max record size and the kmsg buffer almost always exceeds the max record size) - pstore_update_ms >= 0 (disabled by default) - Non-fatal oops (system survives) Free and reallocate the buffer when the new size differs from the previously allocated size. This ensures old_log always has sufficient space for the data being copied. Fixes: 201e4aca5aa1 ("pstore/ram: Should update old dmesg buffer before reading") Signed-off-by: Sai Ritvik Tanksalkar <stanksal(a)purdue.edu> Link: https://patch.msgid.link/20260201132240.2948732-1-stanksal@purdue.edu Signed-off-by: Kees Cook <kees(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yuan can <yuancan(a)huawei.com> Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com> --- fs/pstore/ram_core.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c index f1848cdd6d34..c9eaacdec37e 100644 --- a/fs/pstore/ram_core.c +++ b/fs/pstore/ram_core.c @@ -298,6 +298,17 @@ void persistent_ram_save_old(struct persistent_ram_zone *prz) if (!size) return; + /* + * If the existing buffer is differently sized, free it so a new + * one is allocated. This can happen when persistent_ram_save_old() + * is called early in boot and later for a timer-triggered + * survivable crash when the crash dumps don't match in size + * (which would be extremely unlikely given kmsg buffers usually + * exceed prz buffer sizes). + */ + if (prz->old_log && prz->old_log_size != size) + persistent_ram_free_old(prz); + if (!prz->old_log) { persistent_ram_ecc_old(prz); prz->old_log = kvzalloc(size, GFP_KERNEL); -- 2.34.1

2 1

[PATCH OLK-5.10] pstore/ram: fix buffer overflow in persistent_ram_save_old()
by Pan Taixi 07 Apr '26

07 Apr '26

From: Sai Ritvik Tanksalkar <stanksal(a)purdue.edu> stable inclusion from stable-v5.10.252 commit 58bda5a1d1ee98254383ef34f76b2c35140513ea category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14048/ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5669645c052f235726a85f443769b6fc02f66762 ] persistent_ram_save_old() can be called multiple times for the same persistent_ram_zone (e.g., via ramoops_pstore_read -> ramoops_get_next_prz for PSTORE_TYPE_DMESG records). Currently, the function only allocates prz->old_log when it is NULL, but it unconditionally updates prz->old_log_size to the current buffer size and then performs memcpy_fromio() using this new size. If the buffer size has grown since the first allocation (which can happen across different kernel boot cycles), this leads to: 1. A heap buffer overflow (OOB write) in the memcpy_fromio() calls 2. A subsequent OOB read when ramoops_pstore_read() accesses the buffer using the incorrect (larger) old_log_size The KASAN splat would look similar to: BUG: KASAN: slab-out-of-bounds in ramoops_pstore_read+0x... Read of size N at addr ... by task ... The conditions are likely extremely hard to hit: 0. Crash with a ramoops write of less-than-record-max-size bytes. 1. Reboot: ramoops registers, pstore_get_records(0) reads old crash, allocates old_log with size X 2. Crash handler registered, timer started (if pstore_update_ms >= 0) 3. Oops happens (non-fatal, system continues) 4. pstore_dump() writes oops via ramoops_pstore_write() size Y (>X) 5. pstore_new_entry = 1, pstore_timer_kick() called 6. System continues running (not a panic oops) 7. Timer fires after pstore_update_ms milliseconds 8. pstore_timefunc() → schedule_work() → pstore_dowork() → pstore_get_records(1) 9. ramoops_get_next_prz() → persistent_ram_save_old() 10. buffer_size() returns Y, but old_log is X bytes 11. Y > X: memcpy_fromio() overflows heap Requirements: - a prior crash record exists that did not fill the record size (almost impossible since the crash handler writes as much as it can possibly fit into the record, capped by max record size and the kmsg buffer almost always exceeds the max record size) - pstore_update_ms >= 0 (disabled by default) - Non-fatal oops (system survives) Free and reallocate the buffer when the new size differs from the previously allocated size. This ensures old_log always has sufficient space for the data being copied. Fixes: 201e4aca5aa1 ("pstore/ram: Should update old dmesg buffer before reading") Signed-off-by: Sai Ritvik Tanksalkar <stanksal(a)purdue.edu> Link: https://patch.msgid.link/20260201132240.2948732-1-stanksal@purdue.edu Signed-off-by: Kees Cook <kees(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Yujun <linyujun809(a)h-partners.com> Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com> --- fs/pstore/ram_core.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c index 5ac9b1f155a8..97ec9041b9b9 100644 --- a/fs/pstore/ram_core.c +++ b/fs/pstore/ram_core.c @@ -298,6 +298,17 @@ void persistent_ram_save_old(struct persistent_ram_zone *prz) if (!size) return; + /* + * If the existing buffer is differently sized, free it so a new + * one is allocated. This can happen when persistent_ram_save_old() + * is called early in boot and later for a timer-triggered + * survivable crash when the crash dumps don't match in size + * (which would be extremely unlikely given kmsg buffers usually + * exceed prz buffer sizes). + */ + if (prz->old_log && prz->old_log_size != size) + persistent_ram_free_old(prz); + if (!prz->old_log) { persistent_ram_ecc_old(prz); prz->old_log = kmalloc(size, GFP_KERNEL); -- 2.34.1

2 1

[PATCH OLK-6.6] x86/uprobes: Fix XOL allocation failure for 32-bit tasks
by Pan Taixi 07 Apr '26

07 Apr '26

From: Oleg Nesterov <oleg(a)redhat.com> stable inclusion from stable-v6.6.130 commit 9c05cd8f42325a53474093f372f6c08a56ae18d1 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14049/ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d55c571e4333fac71826e8db3b9753fadfbead6a ] This script #!/usr/bin/bash echo 0 > /proc/sys/kernel/randomize_va_space echo 'void main(void) {}' > TEST.c # -fcf-protection to ensure that the 1st endbr32 insn can't be emulated gcc -m32 -fcf-protection=branch TEST.c -o test bpftrace -e 'uprobe:./test:main {}' -c ./test "hangs", the probed ./test task enters an endless loop. The problem is that with randomize_va_space == 0 get_unmapped_area(TASK_SIZE - PAGE_SIZE) called by xol_add_vma() can not just return the "addr == TASK_SIZE - PAGE_SIZE" hint, this addr is used by the stack vma. arch_get_unmapped_area_topdown() doesn't take TIF_ADDR32 into account and in_32bit_syscall() is false, this leads to info.high_limit > TASK_SIZE. vm_unmapped_area() happily returns the high address > TASK_SIZE and then get_unmapped_area() returns -ENOMEM after the "if (addr > TASK_SIZE - len)" check. handle_swbp() doesn't report this failure (probably it should) and silently restarts the probed insn. Endless loop. I think that the right fix should change the x86 get_unmapped_area() paths to rely on TIF_ADDR32 rather than in_32bit_syscall(). Note also that if CONFIG_X86_X32_ABI=y, in_x32_syscall() falsely returns true in this case because ->orig_ax = -1. But we need a simple fix for -stable, so this patch just sets TS_COMPAT if the probed task is 32-bit to make in_ia32_syscall() true. Fixes: 1b028f784e8c ("x86/mm: Introduce mmap_compat_base() for 32-bit mmap()") Reported-by: Paulo Andrade <pandrade(a)redhat.com> Signed-off-by: Oleg Nesterov <oleg(a)redhat.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Link: https://lore.kernel.org/all/aV5uldEvV7pb4RA8@redhat.com/ Cc: stable(a)vger.kernel.org Link: https://patch.msgid.link/aWO7Fdxn39piQnxu@redhat.com Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com> --- arch/x86/kernel/uprobes.c | 24 ++++++++++++++++++++++++ include/linux/uprobes.h | 1 + kernel/events/uprobes.c | 10 +++++++--- 3 files changed, 32 insertions(+), 3 deletions(-) diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c index 6402fb3089d2..aac2a2c5c6c5 100644 --- a/arch/x86/kernel/uprobes.c +++ b/arch/x86/kernel/uprobes.c @@ -1102,3 +1102,27 @@ bool arch_uretprobe_is_alive(struct return_instance *ret, enum rp_check ctx, else return regs->sp <= ret->stack; } + +#ifdef CONFIG_IA32_EMULATION +unsigned long arch_uprobe_get_xol_area(void) +{ + struct thread_info *ti = current_thread_info(); + unsigned long vaddr; + + /* + * HACK: we are not in a syscall, but x86 get_unmapped_area() paths + * ignore TIF_ADDR32 and rely on in_32bit_syscall() to calculate + * vm_unmapped_area_info.high_limit. + * + * The #ifdef above doesn't cover the CONFIG_X86_X32_ABI=y case, + * but in this case in_32bit_syscall() -> in_x32_syscall() always + * (falsely) returns true because ->orig_ax == -1. + */ + if (test_thread_flag(TIF_ADDR32)) + ti->status |= TS_COMPAT; + vaddr = get_unmapped_area(NULL, TASK_SIZE - PAGE_SIZE, PAGE_SIZE, 0, 0); + ti->status &= ~TS_COMPAT; + + return vaddr; +} +#endif diff --git a/include/linux/uprobes.h b/include/linux/uprobes.h index b0c15a04adcc..7c63f47a497d 100644 --- a/include/linux/uprobes.h +++ b/include/linux/uprobes.h @@ -147,6 +147,7 @@ extern bool arch_uretprobe_is_alive(struct return_instance *ret, enum rp_check c extern bool arch_uprobe_ignore(struct arch_uprobe *aup, struct pt_regs *regs); extern void arch_uprobe_copy_ixol(struct page *page, unsigned long vaddr, void *src, unsigned long len); +extern unsigned long arch_uprobe_get_xol_area(void); #else /* !CONFIG_UPROBES */ struct uprobes_state { }; diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c index 9d2d68d171e9..8f73ab934c38 100644 --- a/kernel/events/uprobes.c +++ b/kernel/events/uprobes.c @@ -1478,6 +1478,12 @@ void uprobe_munmap(struct vm_area_struct *vma, unsigned long start, unsigned lon set_bit(MMF_RECALC_UPROBES, &vma->vm_mm->flags); } +unsigned long __weak arch_uprobe_get_xol_area(void) +{ + /* Try to map as high as possible, this is only a hint. */ + return get_unmapped_area(NULL, TASK_SIZE - PAGE_SIZE, PAGE_SIZE, 0, 0); +} + /* Slot allocation for XOL */ static int xol_add_vma(struct mm_struct *mm, struct xol_area *area) { @@ -1493,9 +1499,7 @@ static int xol_add_vma(struct mm_struct *mm, struct xol_area *area) } if (!area->vaddr) { - /* Try to map as high as possible, this is only a hint. */ - area->vaddr = get_unmapped_area(NULL, TASK_SIZE - PAGE_SIZE, - PAGE_SIZE, 0, 0); + area->vaddr = arch_uprobe_get_xol_area(); if (IS_ERR_VALUE(area->vaddr)) { ret = area->vaddr; goto fail; -- 2.34.1

2 1

[PATCH OLK-5.10] x86/uprobes: Fix XOL allocation failure for 32-bit tasks
by Pan Taixi 07 Apr '26

07 Apr '26

From: Oleg Nesterov <oleg(a)redhat.com> mainline inclusion from mainline-v7.0-rc1 commit d55c571e4333fac71826e8db3b9753fadfbead6a category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14049/ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- This script #!/usr/bin/bash echo 0 > /proc/sys/kernel/randomize_va_space echo 'void main(void) {}' > TEST.c # -fcf-protection to ensure that the 1st endbr32 insn can't be emulated gcc -m32 -fcf-protection=branch TEST.c -o test bpftrace -e 'uprobe:./test:main {}' -c ./test "hangs", the probed ./test task enters an endless loop. The problem is that with randomize_va_space == 0 get_unmapped_area(TASK_SIZE - PAGE_SIZE) called by xol_add_vma() can not just return the "addr == TASK_SIZE - PAGE_SIZE" hint, this addr is used by the stack vma. arch_get_unmapped_area_topdown() doesn't take TIF_ADDR32 into account and in_32bit_syscall() is false, this leads to info.high_limit > TASK_SIZE. vm_unmapped_area() happily returns the high address > TASK_SIZE and then get_unmapped_area() returns -ENOMEM after the "if (addr > TASK_SIZE - len)" check. handle_swbp() doesn't report this failure (probably it should) and silently restarts the probed insn. Endless loop. I think that the right fix should change the x86 get_unmapped_area() paths to rely on TIF_ADDR32 rather than in_32bit_syscall(). Note also that if CONFIG_X86_X32_ABI=y, in_x32_syscall() falsely returns true in this case because ->orig_ax = -1. But we need a simple fix for -stable, so this patch just sets TS_COMPAT if the probed task is 32-bit to make in_ia32_syscall() true. Fixes: 1b028f784e8c ("x86/mm: Introduce mmap_compat_base() for 32-bit mmap()") Reported-by: Paulo Andrade <pandrade(a)redhat.com> Signed-off-by: Oleg Nesterov <oleg(a)redhat.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Link: https://lore.kernel.org/all/aV5uldEvV7pb4RA8@redhat.com/ Cc: stable(a)vger.kernel.org Link: https://patch.msgid.link/aWO7Fdxn39piQnxu@redhat.com Conflicts: arch/x86/kernel/uprobes.c include/linux/uprobes.h kernel/events/uprobes.c [Context conflicts only] Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com> --- arch/x86/kernel/uprobes.c | 24 ++++++++++++++++++++++++ include/linux/uprobes.h | 1 + kernel/events/uprobes.c | 10 +++++++--- 3 files changed, 32 insertions(+), 3 deletions(-) diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c index 9f948b2d26f6..099ca674e3de 100644 --- a/arch/x86/kernel/uprobes.c +++ b/arch/x86/kernel/uprobes.c @@ -1095,3 +1095,27 @@ bool arch_uretprobe_is_alive(struct return_instance *ret, enum rp_check ctx, else return regs->sp <= ret->stack; } + +#ifdef CONFIG_IA32_EMULATION +unsigned long arch_uprobe_get_xol_area(void) +{ + struct thread_info *ti = current_thread_info(); + unsigned long vaddr; + + /* + * HACK: we are not in a syscall, but x86 get_unmapped_area() paths + * ignore TIF_ADDR32 and rely on in_32bit_syscall() to calculate + * vm_unmapped_area_info.high_limit. + * + * The #ifdef above doesn't cover the CONFIG_X86_X32_ABI=y case, + * but in this case in_32bit_syscall() -> in_x32_syscall() always + * (falsely) returns true because ->orig_ax == -1. + */ + if (test_thread_flag(TIF_ADDR32)) + ti->status |= TS_COMPAT; + vaddr = get_unmapped_area(NULL, TASK_SIZE - PAGE_SIZE, PAGE_SIZE, 0, 0); + ti->status &= ~TS_COMPAT; + + return vaddr; +} +#endif diff --git a/include/linux/uprobes.h b/include/linux/uprobes.h index 2c693d6eb9cb..568c211b617e 100644 --- a/include/linux/uprobes.h +++ b/include/linux/uprobes.h @@ -144,6 +144,7 @@ extern bool arch_uretprobe_is_alive(struct return_instance *ret, enum rp_check c extern bool arch_uprobe_ignore(struct arch_uprobe *aup, struct pt_regs *regs); extern void arch_uprobe_copy_ixol(struct page *page, unsigned long vaddr, void *src, unsigned long len); +extern unsigned long arch_uprobe_get_xol_area(void); #else /* !CONFIG_UPROBES */ struct uprobes_state { }; diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c index e51dbb0e8a56..fe518be0615f 100644 --- a/kernel/events/uprobes.c +++ b/kernel/events/uprobes.c @@ -1443,6 +1443,12 @@ void uprobe_munmap(struct vm_area_struct *vma, unsigned long start, unsigned lon set_bit(MMF_RECALC_UPROBES, &vma->vm_mm->flags); } +unsigned long __weak arch_uprobe_get_xol_area(void) +{ + /* Try to map as high as possible, this is only a hint. */ + return get_unmapped_area(NULL, TASK_SIZE - PAGE_SIZE, PAGE_SIZE, 0, 0); +} + /* Slot allocation for XOL */ static int xol_add_vma(struct mm_struct *mm, struct xol_area *area) { @@ -1458,9 +1464,7 @@ static int xol_add_vma(struct mm_struct *mm, struct xol_area *area) } if (!area->vaddr) { - /* Try to map as high as possible, this is only a hint. */ - area->vaddr = get_unmapped_area(NULL, TASK_SIZE - PAGE_SIZE, - PAGE_SIZE, 0, 0); + area->vaddr = arch_uprobe_get_xol_area(); if (IS_ERR_VALUE(area->vaddr)) { ret = area->vaddr; goto fail; -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] Fix riscv compiling error
by Tengda Wu 07 Apr '26

07 Apr '26

Fix riscv compiling error. Björn Töpel (1): riscv: Replace function-like macro by static inline function Tengda Wu (1): Revert "riscv: stacktrace: Disable KASAN checks for non-current tasks" arch/riscv/include/asm/cacheflush.h | 15 ++++++++++----- arch/riscv/kernel/stacktrace.c | 19 ++----------------- 2 files changed, 12 insertions(+), 22 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] net: yt6801: fix link info for yt6801
by Frank_Sae 07 Apr '26

07 Apr '26

yt6801 inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/7229 -------------------------------------------------------------------- fix the link info is not update on os installation. Fixes: b9f5c0893d16 ("net: yt6801: add link info for yt6801") Signed-off-by: Frank_Sae <Frank.Sae(a)motor-comm.com> --- .../net/ethernet/motorcomm/yt6801/yt6801_main.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c b/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c index 01eed3ace..3fcb6f853 100644 --- a/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c +++ b/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c @@ -27,6 +27,18 @@ const struct net_device_ops *fxgmac_get_netdev_ops(void); static void fxgmac_napi_enable(struct fxgmac_pdata *priv); +const struct ethtool_ops *fxgmac_get_ethtool_ops(void); + +static const struct ethtool_ops fxgmac_ethtool_ops = { + .get_link = ethtool_op_get_link, + .get_link_ksettings = phy_ethtool_get_link_ksettings, + .set_link_ksettings = phy_ethtool_set_link_ksettings +}; + +const struct ethtool_ops *fxgmac_get_ethtool_ops(void) +{ + return &fxgmac_ethtool_ops; +} #define PHY_WR_CONFIG(reg_offset) (0x8000205 + ((reg_offset) * 0x10000)) static int fxgmac_phy_write_reg(struct fxgmac_pdata *priv, u32 reg_id, u32 data) @@ -1898,7 +1910,9 @@ static int fxgmac_init(struct fxgmac_pdata *priv, bool save_private_reg) ndev->max_mtu = FXGMAC_JUMBO_PACKET_MTU + (ETH_HLEN + VLAN_HLEN + ETH_FCS_LEN); + ndev->netdev_ops = fxgmac_get_netdev_ops();/* Set device operations */ + ndev->ethtool_ops = fxgmac_get_ethtool_ops();/* Set device operations */ /* Set device features */ if (priv->hw_feat.tso) { -- 2.34.1

2 1

[PATCH OLK-6.6] riscv: Replace function-like macro by static inline function
by Tengda Wu 07 Apr '26

07 Apr '26

From: Björn Töpel <bjorn(a)rivosinc.com> stable inclusion from stable-v6.6.133 commit 0b1ac9743f3d9cfced2ac3cb9f274c0675bd4189 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8883 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 121f34341d396b666d8a90b24768b40e08ca0d61 upstream. The flush_icache_range() function is implemented as a "function-like macro with unused parameters", which can result in "unused variables" warnings. Replace the macro with a static inline function, as advised by Documentation/process/coding-style.rst. Fixes: 08f051eda33b ("RISC-V: Flush I$ when making a dirty page executable") Signed-off-by: Björn Töpel <bjorn(a)rivosinc.com> Link: https://lore.kernel.org/r/20250419111402.1660267-1-bjorn@kernel.org Signed-off-by: Palmer Dabbelt <palmer(a)rivosinc.com> Signed-off-by: Ron Economos <re(a)w6rz.net> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- arch/riscv/include/asm/cacheflush.h | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/arch/riscv/include/asm/cacheflush.h b/arch/riscv/include/asm/cacheflush.h index 3f65acd0ef75..2b7f5da96c50 100644 --- a/arch/riscv/include/asm/cacheflush.h +++ b/arch/riscv/include/asm/cacheflush.h @@ -34,11 +34,6 @@ static inline void flush_dcache_page(struct page *page) flush_dcache_folio(page_folio(page)); } -/* - * RISC-V doesn't have an instruction to flush parts of the instruction cache, - * so instead we just flush the whole thing. - */ -#define flush_icache_range(start, end) flush_icache_all() #define flush_icache_user_page(vma, pg, addr, len) \ flush_icache_mm(vma->vm_mm, 0) @@ -59,6 +54,16 @@ void flush_icache_mm(struct mm_struct *mm, bool local); #endif /* CONFIG_SMP */ +/* + * RISC-V doesn't have an instruction to flush parts of the instruction cache, + * so instead we just flush the whole thing. + */ +#define flush_icache_range flush_icache_range +static inline void flush_icache_range(unsigned long start, unsigned long end) +{ + flush_icache_all(); +} + extern unsigned int riscv_cbom_block_size; extern unsigned int riscv_cboz_block_size; void riscv_init_cbo_blocksizes(void); -- 2.34.1

2 1

[PATCH OLK-6.6 v5 0/2] kvm: arm64: Transition from CPU Type to MIDR Register for Virtualization Feature Detection
by liqiqi 07 Apr '26

07 Apr '26

Currently, there are two methods for determining whether a chip supports specific virtualization features: 1. Reading the chip's CPU type from BIOS 2. Reading the value of the MIDR register The issue with the first method is that each time a new chip is introduced, the new CPU type must be defined, which leads to poor code portability and maintainability. Therefore, the second method has been adopted to replace the first. This approach eliminates the dependency on CPU type by using the MIDR register. liqiqi (2): kvm: arm64: Add MIDR definitions and use MIDR to determine whether features are supported kvm: arm64: Remove cpu_type definition and it's related interfaces arch/arm64/include/asm/cache.h | 2 +- arch/arm64/include/asm/cputype.h | 8 +- arch/arm64/kernel/cpu_errata.c | 4 +- arch/arm64/kernel/cpufeature.c | 2 +- arch/arm64/kernel/proton-pack.c | 4 +- arch/arm64/kvm/arm.c | 1 - arch/arm64/kvm/hisilicon/hisi_virt.c | 110 +++-------------------- arch/arm64/kvm/hisilicon/hisi_virt.h | 12 --- drivers/perf/hisilicon/hisi_uncore_pmu.c | 2 +- tools/arch/arm64/include/asm/cputype.h | 4 +- 10 files changed, 25 insertions(+), 124 deletions(-) -- 2.43.0

2 3

[PATCH OLK-5.10] apparmor: fix unprivileged local user can do privileged policy management
by Yi Yang 07 Apr '26

07 Apr '26

From: John Johansen <john.johansen(a)canonical.com> mainline inclusion from mainline-v7.0-rc4 commit 6601e13e82841879406bf9f369032656f441a425 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13879 CVE: CVE-2026-23268 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- An unprivileged local user can load, replace, and remove profiles by opening the apparmorfs interfaces, via a confused deputy attack, by passing the opened fd to a privileged process, and getting the privileged process to write to the interface. This does require a privileged target that can be manipulated to do the write for the unprivileged process, but once such access is achieved full policy management is possible and all the possible implications that implies: removing confinement, DoS of system or target applications by denying all execution, by-passing the unprivileged user namespace restriction, to exploiting kernel bugs for a local privilege escalation. The policy management interface can not have its permissions simply changed from 0666 to 0600 because non-root processes need to be able to load policy to different policy namespaces. Instead ensure the task writing the interface has privileges that are a subset of the task that opened the interface. This is already done via policy for confined processes, but unconfined can delegate access to the opened fd, by-passing the usual policy check. Fixes: b7fd2c0340eac ("apparmor: add per policy ns .load, .replace, .remove interface files") Reported-by: Qualys Security Advisory <qsa(a)qualys.com> Tested-by: Salvatore Bonaccorso <carnil(a)debian.org> Reviewed-by: Georgia Garcia <georgia.garcia(a)canonical.com> Reviewed-by: Cengiz Can <cengiz.can(a)canonical.com> Signed-off-by: John Johansen <john.johansen(a)canonical.com> Conflicts: security/apparmor/apparmorfs.c security/apparmor/include/policy.h security/apparmor/policy.c [Commit 90c436a64a6e ("apparmor: pass cred through to audit info.") was not merged. The aa_may_manage_policy function is different.] Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- security/apparmor/apparmorfs.c | 19 +++++++++------ security/apparmor/include/policy.h | 2 +- security/apparmor/policy.c | 37 ++++++++++++++++++++++++++++-- 3 files changed, 48 insertions(+), 10 deletions(-) diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c index 06eac2266565..0900fd07def7 100644 --- a/security/apparmor/apparmorfs.c +++ b/security/apparmor/apparmorfs.c @@ -409,7 +409,8 @@ static struct aa_loaddata *aa_simple_write_to_buffer(const char __user *userbuf, } static ssize_t policy_update(u32 mask, const char __user *buf, size_t size, - loff_t *pos, struct aa_ns *ns) + loff_t *pos, struct aa_ns *ns, + const struct cred *ocred) { struct aa_loaddata *data; struct aa_label *label; @@ -420,7 +421,7 @@ static ssize_t policy_update(u32 mask, const char __user *buf, size_t size, /* high level check about policy management - fine grained in * below after unpack */ - error = aa_may_manage_policy(label, ns, mask); + error = aa_may_manage_policy(label, ns, ocred, mask); if (error) goto end_section; @@ -441,7 +442,8 @@ static ssize_t profile_load(struct file *f, const char __user *buf, size_t size, loff_t *pos) { struct aa_ns *ns = aa_get_ns(f->f_inode->i_private); - int error = policy_update(AA_MAY_LOAD_POLICY, buf, size, pos, ns); + int error = policy_update(AA_MAY_LOAD_POLICY, buf, size, pos, ns, + f->f_cred); aa_put_ns(ns); @@ -459,7 +461,7 @@ static ssize_t profile_replace(struct file *f, const char __user *buf, { struct aa_ns *ns = aa_get_ns(f->f_inode->i_private); int error = policy_update(AA_MAY_LOAD_POLICY | AA_MAY_REPLACE_POLICY, - buf, size, pos, ns); + buf, size, pos, ns, f->f_cred); aa_put_ns(ns); return error; @@ -483,7 +485,8 @@ static ssize_t profile_remove(struct file *f, const char __user *buf, /* high level check about policy management - fine grained in * below after unpack */ - error = aa_may_manage_policy(label, ns, AA_MAY_REMOVE_POLICY); + error = aa_may_manage_policy(label, ns, f->f_cred, + AA_MAY_REMOVE_POLICY); if (error) goto out; @@ -1787,7 +1790,8 @@ static int ns_mkdir_op(struct inode *dir, struct dentry *dentry, umode_t mode) int error; label = begin_current_label_crit_section(); - error = aa_may_manage_policy(label, NULL, AA_MAY_LOAD_POLICY); + error = aa_may_manage_policy(label, NULL, NULL, + AA_MAY_LOAD_POLICY); end_current_label_crit_section(label); if (error) return error; @@ -1836,7 +1840,8 @@ static int ns_rmdir_op(struct inode *dir, struct dentry *dentry) int error; label = begin_current_label_crit_section(); - error = aa_may_manage_policy(label, NULL, AA_MAY_LOAD_POLICY); + error = aa_may_manage_policy(label, NULL, NULL, + AA_MAY_LOAD_POLICY); end_current_label_crit_section(label); if (error) return error; diff --git a/security/apparmor/include/policy.h b/security/apparmor/include/policy.h index b5aa4231af68..f6682a31df23 100644 --- a/security/apparmor/include/policy.h +++ b/security/apparmor/include/policy.h @@ -304,6 +304,6 @@ static inline int AUDIT_MODE(struct aa_profile *profile) bool policy_view_capable(struct aa_ns *ns); bool policy_admin_capable(struct aa_ns *ns); int aa_may_manage_policy(struct aa_label *label, struct aa_ns *ns, - u32 mask); + const struct cred *ocred, u32 mask); #endif /* __AA_POLICY_H */ diff --git a/security/apparmor/policy.c b/security/apparmor/policy.c index fcf22577f606..e5f501f89803 100644 --- a/security/apparmor/policy.c +++ b/security/apparmor/policy.c @@ -671,14 +671,42 @@ bool policy_admin_capable(struct aa_ns *ns) return policy_view_capable(ns) && capable && !aa_g_lock_policy; } +static bool is_subset_of_obj_privilege(const struct cred *cred, + struct aa_label *label, + const struct cred *ocred) +{ + if (cred == ocred) + return true; + + if (!aa_label_is_subset(label, cred_label(ocred))) + return false; + /* don't allow crossing userns for now */ + if (cred->user_ns != ocred->user_ns) + return false; + if (!cap_issubset(cred->cap_inheritable, ocred->cap_inheritable)) + return false; + if (!cap_issubset(cred->cap_permitted, ocred->cap_permitted)) + return false; + if (!cap_issubset(cred->cap_effective, ocred->cap_effective)) + return false; + if (!cap_issubset(cred->cap_bset, ocred->cap_bset)) + return false; + if (!cap_issubset(cred->cap_ambient, ocred->cap_ambient)) + return false; + return true; +} + /** * aa_may_manage_policy - can the current task manage policy * @label: label to check if it can manage policy - * @op: the policy manipulation operation being done + * @ns: namespace being managed by @label (may be NULL if @label's ns) + * @ocred: object cred if request is coming from an open object + * @mask: contains the policy manipulation operation being done * * Returns: 0 if the task is allowed to manipulate policy else error */ -int aa_may_manage_policy(struct aa_label *label, struct aa_ns *ns, u32 mask) +int aa_may_manage_policy(struct aa_label *label, struct aa_ns *ns, + const struct cred *ocred, u32 mask) { const char *op; @@ -694,6 +722,11 @@ int aa_may_manage_policy(struct aa_label *label, struct aa_ns *ns, u32 mask) return audit_policy(label, op, NULL, NULL, "policy_locked", -EACCES); + if (ocred && !is_subset_of_obj_privilege(current_cred(), label, ocred)) + return audit_policy(label, op, NULL, NULL, + "not privileged for target profile", + -EACCES); + if (!policy_admin_capable(ns)) return audit_policy(label, op, NULL, NULL, "not policy admin", -EACCES); -- 2.25.1

2 1

[PATCH OLK-5.10] ksmbd: Compare MACs in constant time
by Li Lingfeng 07 Apr '26

07 Apr '26

From: Eric Biggers <ebiggers(a)kernel.org> mainline inclusion from mainline-v7.0-rc2 commit c5794709bc9105935dbedef8b9cf9c06f2b559fa category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13917 CVE: CVE-2026-23364 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- To prevent timing attacks, MAC comparisons need to be constant-time. Replace the memcmp() with the correct function, crypto_memneq(). Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") Cc: stable(a)vger.kernel.org Signed-off-by: Eric Biggers <ebiggers(a)kernel.org> Acked-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/server/Kconfig fs/smb/server/auth.c fs/smb/server/smb2pdu.c [Commit 38c8a9a52082 ("smb: move client and server files to common directory fs/smb") move client and server files to common directory fs/smb; commit 7033b937e21b ("crypto: lib - create utils module and move __crypto_memneq into it") change the config of memneq.c.] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/ksmbd/Kconfig | 1 + fs/ksmbd/auth.c | 4 +++- fs/ksmbd/smb2pdu.c | 5 +++-- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/fs/ksmbd/Kconfig b/fs/ksmbd/Kconfig index e1fe17747ed6..832c6a0dd327 100644 --- a/fs/ksmbd/Kconfig +++ b/fs/ksmbd/Kconfig @@ -11,6 +11,7 @@ config SMB_SERVER select CRYPTO_ECB select CRYPTO_LIB_DES select CRYPTO_SHA256 + select LIB_MEMNEQ select CRYPTO_CMAC select CRYPTO_SHA512 select CRYPTO_AEAD2 diff --git a/fs/ksmbd/auth.c b/fs/ksmbd/auth.c index c5916064b85e..fb4a6f9e4e98 100644 --- a/fs/ksmbd/auth.c +++ b/fs/ksmbd/auth.c @@ -13,6 +13,7 @@ #include <linux/xattr.h> #include <crypto/hash.h> #include <crypto/aead.h> +#include <crypto/algapi.h> #include <linux/random.h> #include <linux/scatterlist.h> @@ -280,7 +281,8 @@ int ksmbd_auth_ntlmv2(struct ksmbd_conn *conn, struct ksmbd_session *sess, goto out; } - if (memcmp(ntlmv2->ntlmv2_hash, ntlmv2_rsp, CIFS_HMAC_MD5_HASH_SIZE) != 0) + if (crypto_memneq(ntlmv2->ntlmv2_hash, ntlmv2_rsp, + CIFS_HMAC_MD5_HASH_SIZE)) rc = -EINVAL; out: if (ctx) diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c index 1588867b4e71..d75de3035327 100644 --- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -4,6 +4,7 @@ * Copyright (C) 2018 Samsung Electronics Co., Ltd. */ +#include <crypto/algapi.h> #include <linux/inetdevice.h> #include <net/addrconf.h> #include <linux/syscalls.h> @@ -8344,7 +8345,7 @@ int smb2_check_sign_req(struct ksmbd_work *work) signature)) return 0; - if (memcmp(signature, signature_req, SMB2_SIGNATURE_SIZE)) { + if (crypto_memneq(signature, signature_req, SMB2_SIGNATURE_SIZE)) { pr_err("bad smb2 signature\n"); return 0; } @@ -8456,7 +8457,7 @@ int smb3_check_sign_req(struct ksmbd_work *work) if (ksmbd_sign_smb3_pdu(conn, signing_key, iov, 1, signature)) return 0; - if (memcmp(signature, signature_req, SMB2_SIGNATURE_SIZE)) { + if (crypto_memneq(signature, signature_req, SMB2_SIGNATURE_SIZE)) { pr_err("bad smb2 signature\n"); return 0; } -- 2.52.0

2 1

[PATCH OLK-5.10 0/2] *** fix CVE-2026-23208 ***
by Lin Ruifeng 07 Apr '26

07 Apr '26

*** fix CVE-2026-23208 *** Edward Adam Davis (1): ALSA: usb-audio: Prevent excessive number of frames Takashi Iwai (1): ALSA: usb-audio: Use the right limit for PCM OOB check sound/usb/pcm.c | 3 +++ 1 file changed, 3 insertions(+) -- 2.43.0

2 3

[PATCH OLK-6.6] net: yt6801: fix link info for yt6801
by Frank_Sae 07 Apr '26

07 Apr '26

yt6801 inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/7229 -------------------------------------------------------------------- fix the link info is not update on os installation. Fixes: b9f5c0893d16 ("net: yt6801: add link info for yt6801") Signed-off-by: Frank_Sae <Frank.Sae(a)motor-comm.com> --- .../ethernet/motorcomm/yt6801/yt6801_main.c | 91 +++++++++++++++++++ 1 file changed, 91 insertions(+) diff --git a/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c b/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c index 01eed3ace..83b5ab258 100644 --- a/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c +++ b/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c @@ -27,6 +27,95 @@ const struct net_device_ops *fxgmac_get_netdev_ops(void); static void fxgmac_napi_enable(struct fxgmac_pdata *priv); +const struct ethtool_ops *fxgmac_get_ethtool_ops(void); + +#define MII_SPEC_STATUS 0x11 /* PHY specific status */ +#define FXGMAC_EPHY_LINK_STATUS BIT(10) +#define PHY_MII_SPEC_DUPLEX BIT(13) + +static int fxgmac_get_link_ksettings(struct net_device *netdev, + struct ethtool_link_ksettings *cmd) +{ + struct fxgmac_pdata *pdata = netdev_priv(netdev); + struct phy_device *phydev = netdev->phydev; + u32 duplex, regval, link_status; + u32 adv = 0xFFFFFFFF; + + ethtool_link_ksettings_zero_link_mode(cmd, supported); + ethtool_link_ksettings_zero_link_mode(cmd, advertising); + + /* set the supported link speeds */ + ethtool_link_ksettings_add_link_mode(cmd, supported, 1000baseT_Full); + ethtool_link_ksettings_add_link_mode(cmd, supported, 100baseT_Full); + ethtool_link_ksettings_add_link_mode(cmd, supported, 100baseT_Half); + ethtool_link_ksettings_add_link_mode(cmd, supported, 10baseT_Full); + ethtool_link_ksettings_add_link_mode(cmd, supported, 10baseT_Half); + + /* Indicate pause support */ + ethtool_link_ksettings_add_link_mode(cmd, supported, Pause); + ethtool_link_ksettings_add_link_mode(cmd, supported, Asym_Pause); + + adv = phy_read(phydev, MII_ADVERTISE); + + if (field_get(ADVERTISE_PAUSE_CAP, adv)) + ethtool_link_ksettings_add_link_mode(cmd, advertising, Pause); + + if (field_get(ADVERTISE_PAUSE_ASYM, adv)) + ethtool_link_ksettings_add_link_mode(cmd, advertising, Asym_Pause); + + ethtool_link_ksettings_add_link_mode(cmd, supported, MII); + cmd->base.port = PORT_MII; + + ethtool_link_ksettings_add_link_mode(cmd, supported, Autoneg); + regval = phy_read(phydev, MII_BMCR); + + regval = field_get(BMCR_ANENABLE, regval); + if (regval) { + ethtool_link_ksettings_add_link_mode(cmd, advertising, Autoneg); + + adv = phy_read(phydev, MII_ADVERTISE); + + if (adv & ADVERTISE_10HALF) + ethtool_link_ksettings_add_link_mode(cmd, advertising, 10baseT_Half); + if (adv & ADVERTISE_10FULL) + ethtool_link_ksettings_add_link_mode(cmd, advertising, 10baseT_Full); + if (adv & ADVERTISE_100HALF) + ethtool_link_ksettings_add_link_mode(cmd, advertising, 100baseT_Half); + if (adv & ADVERTISE_100FULL) + ethtool_link_ksettings_add_link_mode(cmd, advertising, 100baseT_Full); + + adv = phy_read(phydev, MII_CTRL1000); + + if (adv & ADVERTISE_1000FULL) + ethtool_link_ksettings_add_link_mode(cmd, advertising, 1000baseT_Full); + } + + cmd->base.autoneg = 1; + + regval = phy_read(phydev, MII_SPEC_STATUS); + + link_status = field_get(FXGMAC_EPHY_LINK_STATUS, regval); + if (link_status) { + duplex = field_get(PHY_MII_SPEC_DUPLEX, regval); + cmd->base.duplex = duplex; + cmd->base.speed = pdata->mac_speed; + } else { + cmd->base.duplex = DUPLEX_UNKNOWN; + cmd->base.speed = SPEED_UNKNOWN; + } + + return 0; +} + +static const struct ethtool_ops fxgmac_ethtool_ops = { + .get_link = ethtool_op_get_link, + .get_link_ksettings = fxgmac_get_link_ksettings, +}; + +const struct ethtool_ops *fxgmac_get_ethtool_ops(void) +{ + return &fxgmac_ethtool_ops; +} #define PHY_WR_CONFIG(reg_offset) (0x8000205 + ((reg_offset) * 0x10000)) static int fxgmac_phy_write_reg(struct fxgmac_pdata *priv, u32 reg_id, u32 data) @@ -1898,7 +1987,9 @@ static int fxgmac_init(struct fxgmac_pdata *priv, bool save_private_reg) ndev->max_mtu = FXGMAC_JUMBO_PACKET_MTU + (ETH_HLEN + VLAN_HLEN + ETH_FCS_LEN); + ndev->netdev_ops = fxgmac_get_netdev_ops();/* Set device operations */ + ndev->ethtool_ops = fxgmac_get_ethtool_ops();/* Set device operations */ /* Set device features */ if (priv->hw_feat.tso) { -- 2.34.1

2 1

[PATCH OLK-6.6 000/452] sched_ext v1
by Zicheng Qu 03 Apr '26

03 Apr '26

Aboorva Devarajan (2): sched_ext: Documentation: Remove mentions of scx_bpf_switch_all sched: Pass correct scheduling policy to __setscheduler_class Alan Maguire (16): kbuild,bpf: Switch to using --btf_features for pahole v1.26 and later kbuild, bpf: Use test-ge check for v1.25-only pahole libbpf: Add btf__distill_base() creating split BTF with distilled base BTF selftests/bpf: Test distilled base, split BTF generation libbpf: Split BTF relocation selftests/bpf: Extend distilled BTF tests to cover BTF relocation resolve_btfids: Handle presence of .BTF.base section libbpf: BTF relocation followup fixing naming, loop logic module, bpf: Store BTF base pointer in struct module libbpf: Split field iter code into its own file kernel libbpf,bpf: Share BTF relocate-related code with kernel kbuild,bpf: Add module-specific pahole flags for distilled base BTF selftests/bpf: Add kfunc_call test for simple dtor in bpf_testmod bpf: fix build when CONFIG_DEBUG_INFO_BTF[_MODULES] is undefined libbpf: Fix error handling in btf__distill_base() libbpf: Fix license for btf_relocate.c Alexander Lobakin (1): bitops: make BYTES_TO_BITS() treewide-available Alexei Starovoitov (2): s390/bpf: Fix indirect trampoline generation bpf: Introduce "volatile compare" macros Andrea Righi (33): sched_ext: fix typo in set_weight() description sched_ext: add CONFIG_DEBUG_INFO_BTF dependency sched_ext: Provide a sysfs enable_seq counter sched_ext: improve WAKE_SYNC behavior for default idle CPU selection sched_ext: Clarify ops.select_cpu() for single-CPU tasks sched_ext: Introduce LLC awareness to the default idle selection policy sched_ext: Introduce NUMA awareness to the default idle selection policy sched_ext: Do not enable LLC/NUMA optimizations when domains overlap sched_ext: Fix incorrect use of bitwise AND MAINTAINERS: add self as reviewer for sched_ext sched_ext: idle: Refresh idle masks during idle-to-idle transitions sched_ext: Use the NUMA scheduling domain for NUMA optimizations sched_ext: idle: use assign_cpu() to update the idle cpumask sched_ext: idle: clarify comments sched_ext: idle: introduce check_builtin_idle_enabled() helper sched_ext: idle: small CPU iteration refactoring sched_ext: update scx_bpf_dsq_insert() doc for SCX_DSQ_LOCAL_ON sched_ext: Include remaining task time slice in error state dump sched_ext: Include task weight in the error state dump selftests/sched_ext: Fix enum resolution tools/sched_ext: Add helper to check task migration state sched_ext: selftests/dsp_local_on: Fix selftest on UP systems sched_ext: Fix lock imbalance in dispatch_to_local_dsq() selftests/sched_ext: Fix exit selftest hang on UP sched_ext: Move built-in idle CPU selection policy to a separate file sched_ext: Track currently locked rq sched_ext: Make scx_locked_rq() inline sched_ext: Fix missing rq lock in scx_bpf_cpuperf_set() sched/ext: Fix invalid task state transitions on class switch sched_ext: Make scx_kf_allowed_if_unlocked() available outside ext.c sched_ext: Remove duplicate BTF_ID_FLAGS definitions sched_ext: Fix rq lock state in hotplug ops sched_ext: Validate prev_cpu in scx_bpf_select_cpu_dfl() Andrii Nakryiko (14): bpf: Emit global subprog name in verifier logs bpf: Validate global subprogs lazily selftests/bpf: Add lazy global subprog validation tests libbpf: Add btf__new_split() API that was declared but not implemented bpf: move sleepable flag from bpf_prog_aux to bpf_prog libbpf: Add BTF field iterator libbpf: Make use of BTF field iterator in BPF linker code libbpf: Make use of BTF field iterator in BTF handling code bpftool: Use BTF field iterator in btfgen libbpf: Remove callback-based type/string BTF field visitor helpers bpf: extract iterator argument type and name validation logic bpf: allow passing struct bpf_iter_<type> as kfunc arguments selftests/bpf: test passing iterator to a kfunc selftests/bpf: validate eliminated global subprog is not freplaceable Arnaldo Carvalho de Melo (1): tools include UAPI: Sync linux/sched.h copy with the kernel sources Atul Kumar Pant (1): sched_ext: Fixes typos in comments Benjamin Tissoires (1): bpf: introduce in_sleepable() helper Bitao Hu (4): genirq: Convert kstat_irqs to a struct genirq: Provide a snapshot mechanism for interrupt statistics watchdog/softlockup: Low-overhead detection of interrupt storm watchdog/softlockup: Report the most frequent interrupts Björn Töpel (1): selftests: sched_ext: Add sched_ext as proper selftest target Breno Leitao (3): rhashtable: Fix potential deadlock by moving schedule_work outside lock sched_ext: Use kvzalloc for large exit_dump allocation sched/ext: Prevent update_locked_rq() calls with NULL rq Changwoo Min (12): sched_ext: Clarify sched_ext_ops table for userland scheduler sched_ext: add a missing rcu_read_lock/unlock pair at scx_select_cpu_dfl() MAINTAINERS: add me as reviewer for sched_ext sched_ext: Replace rq_lock() to raw_spin_rq_lock() in scx_ops_bypass() sched_ext: Relocate scx_enabled() related code sched_ext: Implement scx_bpf_now() sched_ext: Add scx_bpf_now() for BPF scheduler sched_ext: Add time helpers for BPF schedulers sched_ext: Replace bpf_ktime_get_ns() to scx_bpf_now() sched_ext: Use time helpers in BPF schedulers sched_ext: Fix incorrect time delta calculation in time_delta() sched_ext: Add scx_bpf_events() and scx_read_event() for BPF schedulers Cheng-Yang Chou (1): sched_ext: Always use SMP versions in kernel/sched/ext.c Christian Brauner (1): file: add take_fd() cleanup helper Christian Loehle (1): sched/fair: Remove stale FREQUENCY_UTIL comment Christophe Leroy (2): bpf: Remove arch_unprotect_bpf_trampoline() bpf: Check return from set_memory_rox() Chuyi Zhou (15): cgroup: Prepare for using css_task_iter_*() in BPF bpf: Introduce css_task open-coded iterator kfuncs bpf: Introduce task open coded iterator kfuncs bpf: Introduce css open-coded iterator kfuncs bpf: teach the verifier to enforce css_iter and task_iter in RCU CS bpf: Let bpf_iter_task_new accept null task ptr selftests/bpf: rename bpf_iter_task.c to bpf_iter_tasks.c selftests/bpf: Add tests for open-coded task and css iter bpf: Relax allowlist for css_task iter selftests/bpf: Add tests for css_task iter combining with cgroup iter selftests/bpf: Add test for using css_task iter in sleepable progs bpf: Let verifier consider {task,cgroup} is trusted in bpf_iter_reg selftests/bpf: get trusted cgrp from bpf_iter__cgroup directly sched_ext: Fix the incorrect bpf_list kfunc API in common.bpf.h. sched_ext: Use SCX_CALL_OP_TASK in task_tick_scx Colin Ian King (1): sched_ext: Fix spelling mistake: "intead" -> "instead" Daniel Xu (3): bpf: btf: Support flags for BTF_SET8 sets bpf: btf: Add BTF_KFUNCS_START/END macro pair bpf: treewide: Annotate BPF kfuncs in BTF Dave Marchevsky (6): bpf: Don't explicitly emit BTF for struct btf_iter_num selftests/bpf: Rename bpf_iter_task_vma.c to bpf_iter_task_vmas.c bpf: Introduce task_vma open-coded iterator kfuncs selftests/bpf: Add tests for open-coded task_vma iter bpf: Add __bpf_kfunc_{start,end}_defs macros bpf: Add __bpf_hook_{start,end} macros David Vernet (15): bpf: Add ability to pin bpf timer to calling CPU selftests/bpf: Test pinning bpf timer to a core sched_ext: Implement runnable task stall watchdog sched_ext: Print sched_ext info when dumping stack sched_ext: Implement SCX_KICK_WAIT sched_ext: Implement sched_ext_ops.cpu_acquire/release() sched_ext: Add selftests bpf: Load vmlinux btf for any struct_ops map sched_ext: Make scx_bpf_cpuperf_set() @cpu arg signed scx: Allow calling sleepable kfuncs from BPF_PROG_TYPE_SYSCALL scx/selftests: Verify we can call create_dsq from prog_run sched_ext: Remove unnecessary cpu_relax() scx: Fix exit selftest to use custom DSQ scx: Fix raciness in scx_ops_bypass() scx: Fix maximal BPF selftest prog Dawei Li (1): genirq: Deduplicate interrupt descriptor initialization Devaansh Kumar (1): sched_ext: selftests: Fix grammar in tests description Devaansh-Kumar (1): sched_ext: Documentation: Update instructions for running example schedulers Eduard Zingerman (2): libbpf: Make btf_parse_elf process .BTF.base transparently selftests/bpf: Check if distilled base inherits source endianness Geliang Tang (1): bpf, btf: Check btf for register_bpf_struct_ops Henry Huang (2): sched_ext: initialize kit->cursor.flags sched_ext: keep running prev when prev->scx.slice != 0 Herbert Xu (1): rhashtable: Fix rhashtable_try_insert test Honglei Wang (3): sched_ext: use correct function name in pick_task_scx() warning message sched_ext: Add __weak to fix the build errors sched_ext: switch class when preempted by higher priority scheduler Hongyan Xia (1): sched/ext: Add BPF function to fetch rq Hou Tao (7): bpf: Free dynamically allocated bits in bpf_iter_bits_destroy() bpf: Add bpf_mem_alloc_check_size() helper bpf: Check the validity of nr_words in bpf_iter_bits_new() bpf: Use __u64 to save the bits in bits iterator selftests/bpf: Add three test cases for bits_iter selftests/bpf: Use -4095 as the bad address for bits iterator selftests/bpf: Export map_update_retriable() Ihor Solodrai (2): selftests/sched_ext: add order-only dependency of runner.o on BPFOBJ selftests/sched_ext: fix build after renames in sched_ext API Ilpo Järvinen (1): <linux/cleanup.h>: Allow the passing of both iomem and non-iomem pointers to no_free_ptr() Ingo Molnar (3): sched/syscalls: Split out kernel/sched/syscalls.c from kernel/sched/core.c sched/fair: Rename check_preempt_wakeup() to check_preempt_wakeup_fair() sched/fair: Rename check_preempt_curr() to wakeup_preempt() Jake Hillion (2): sched_ext: create_dsq: Return -EEXIST on duplicate request sched_ext: Drop kfuncs marked for removal in 6.15 Jiapeng Chong (1): sched_ext: Fixes incorrect type in bpf_scx_init() Jiayuan Chen (1): selftests/bpf: Fixes for test_maps test Kui-Feng Lee (29): bpf: refactory struct_ops type initialization to a function. bpf: get type information with BTF_ID_LIST bpf, net: introduce bpf_struct_ops_desc. bpf: add struct_ops_tab to btf. bpf: make struct_ops_map support btfs other than btf_vmlinux. bpf: pass btf object id in bpf_map_info. bpf: lookup struct_ops types from a given module BTF. bpf: pass attached BTF to the bpf_struct_ops subsystem bpf: hold module refcnt in bpf_struct_ops map creation and prog verification. bpf: validate value_type bpf, net: switch to dynamic registration libbpf: Find correct module BTFs for struct_ops maps and progs. bpf: export btf_ctx_access to modules. selftests/bpf: test case for register_bpf_struct_ops(). bpf: Fix error checks against bpf_get_btf_vmlinux(). bpf: Remove an unnecessary check. selftests/bpf: Suppress warning message of an unused variable. bpf: add btf pointer to struct bpf_ctx_arg_aux. bpf: Move __kfunc_param_match_suffix() to btf.c. bpf: Create argument information for nullable arguments. selftests/bpf: Test PTR_MAYBE_NULL arguments of struct_ops operators. libbpf: Set btf_value_type_id of struct bpf_map for struct_ops. libbpf: Convert st_ops->data to shadow type. bpftool: Generated shadow variables for struct_ops maps. bpftool: Add an example for struct_ops map and shadow type. selftests/bpf: Test if shadow types work correctly. bpf, net: validate struct_ops when updating value. bpf: struct_ops supports more than one page for trampolines. selftests/bpf: Test struct_ops maps with a large number of struct_ops program. Kumar Kartikeya Dwivedi (4): bpf: Allow calling static subprogs while holding a bpf_spin_lock selftests/bpf: Add test for static subprog call in lock cs bpf: Transfer RCU lock state between subprog calls selftests/bpf: Add tests for RCU lock transfer between subprogs Liang Jie (1): sched_ext: Use sizeof_field for key_len in dsq_hash_params Luo Gengkun (7): bpf: Fix kabi-breakage for bpf_func_info_aux bpf: Fix kabi-breakage for bpf_tramp_image bpf: Fix kabi for bpf_attr bpf_verifier: Fix kabi for bpf_verifier_env bpf: Fix kabi for bpf_ctx_arg_aux bpf: Fix kabi for bpf_prog_aux and bpf_prog selftests/bpf: modify test_loader that didn't support running bpf_prog_type_syscall programs Manu Bretelle (1): sched_ext: define missing cfi stubs for sched_ext Martin KaFai Lau (5): libbpf: Ensure undefined bpf_attr field stays 0 bpf: Remove unnecessary err < 0 check in bpf_struct_ops_map_update_elem bpf: Fix a crash when btf_parse_base() returns an error pointer bpf: Reject struct_ops registration that uses module ptr and the module btf_id is missing bpf: Use kallsyms to find the function name of a struct_ops's stub function Masahiro Yamada (1): kbuild: avoid too many execution of scripts/pahole-flags.sh Matthieu Baerts (1): bpf: fix compilation error without CGROUPS Peter Zijlstra (26): cfi: Flip headers x86/cfi,bpf: Fix BPF JIT call x86/cfi,bpf: Fix bpf_callback_t CFI x86/cfi,bpf: Fix bpf_struct_ops CFI cfi: Add CFI_NOSEAL() bpf: Fix dtor CFI cleanup: Make no_free_ptr() __must_check sched: Simplify set_user_nice() sched: Simplify syscalls sched: Simplify sched_{set,get}affinity() sched: Simplify yield_to() sched: Simplify sched_rr_get_interval() sched: Simplify sched_move_task() sched: Misc cleanups sched/deadline: Move bandwidth accounting into {en,de}queue_dl_entity sched: Allow sched_class::dequeue_task() to fail sched: Unify runtime accounting across classes sched: Use set_next_task(.first) where required sched/fair: Cleanup pick_task_fair() vs throttle sched/fair: Cleanup pick_task_fair()'s curr sched/fair: Unify pick_{,next_}_task_fair() sched: Fixup set_next_task() implementations sched: Split up put_prev_task_balance() sched: Rework pick_next_task() sched: Combine the last put_prev_task() and the first set_next_task() sched: Add put_prev_task(.next) Pu Lehui (8): riscv, bpf: Fix unpredictable kernel crash about RV64 struct_ops bpf: Fix kabi breakage in struct module riscv, bpf: Fix out-of-bounds issue when preparing trampoline image selftests/bpf: Fix btf leak on new btf alloc failure in btf_distill test libbpf: Fix return zero when elf_begin failed libbpf: Fix incorrect traversal end type ID when marking BTF_IS_EMBEDDED selftests/bpf: Add distilled BTF test about marking BTF_IS_EMBEDDED selftests/bpf: Add file_read_pattern to gitignore Randy Dunlap (1): sched_ext: fix kernel-doc warnings Shizhao Chen (1): sched_ext: Add option -l in selftest runner to list all available tests Song Liu (8): bpf: Charge modmem for struct_ops trampoline bpf: Let bpf_prog_pack_free handle any pointer bpf: Adjust argument names of arch_prepare_bpf_trampoline() bpf: Add helpers for trampoline image management bpf, x86: Adjust arch_prepare_bpf_trampoline return value bpf: Add arch_bpf_trampoline_size() bpf: Use arch_bpf_trampoline_size x86, bpf: Use bpf_prog_pack for bpf trampoline T.J. Mercier (1): bpf, docs: Fix broken link to renamed bpf_iter_task_vmas.c Tejun Heo (152): sched: Restructure sched_class order sanity checks in sched_init() sched: Allow sched_cgroup_fork() to fail and introduce sched_cancel_fork() sched: Add sched_class->reweight_task() sched: Add sched_class->switching_to() and expose check_class_changing/changed() sched: Factor out cgroup weight conversion functions sched: Factor out update_other_load_avgs() from __update_blocked_others() sched: Add normal_policy() sched_ext: Add boilerplate for extensible scheduler class sched_ext: Implement BPF extensible scheduler class sched_ext: Add scx_simple and scx_example_qmap example schedulers sched_ext: Add sysrq-S which disables the BPF scheduler sched_ext: Allow BPF schedulers to disallow specific tasks from joining SCHED_EXT sched_ext: Print debug dump after an error exit tools/sched_ext: Add scx_show_state.py sched_ext: Implement scx_bpf_kick_cpu() and task preemption support sched_ext: Add a central scheduler which makes all scheduling decisions on one CPU sched_ext: Make watchdog handle ops.dispatch() looping stall sched_ext: Add task state tracking operations sched_ext: Implement tickless support sched_ext: Track tasks that are subjects of the in-flight SCX operation sched_ext: Implement sched_ext_ops.cpu_online/offline() sched_ext: Bypass BPF scheduler while PM events are in progress sched_ext: Implement core-sched support sched_ext: Add vtime-ordered priority queue to dispatch_q's sched_ext: Documentation: scheduler: Document extensible scheduler class sched, sched_ext: Replace scx_next_task_picked() with sched_class->switch_class() cpufreq_schedutil: Refactor sugov_cpu_is_busy() sched_ext: Add cpuperf support sched_ext: Drop tools_clean target from the top-level Makefile sched_ext: Swap argument positions in kcalloc() call to avoid compiler warning sched, sched_ext: Simplify dl_prio() case handling in sched_fork() sched_ext: Account for idle policy when setting p->scx.weight in scx_ops_enable_task() sched_ext: Disallow loading BPF scheduler if isolcpus= domain isolation is in effect sched_ext: Minor cleanups in kernel/sched/ext.h sched, sched_ext: Open code for_balance_class_range() sched, sched_ext: Move some declarations from kernel/sched/ext.h to sched.h sched_ext: Take out ->priq and ->flags from scx_dsq_node sched_ext: Implement DSQ iterator sched_ext/scx_qmap: Add an example usage of DSQ iterator sched_ext: Reimplement scx_bpf_reenqueue_local() sched_ext: Make scx_bpf_reenqueue_local() skip tasks that are being migrated sched: Move struct balance_callback definition upward sched_ext: Unpin and repin rq lock from balance_scx() sched_ext: s/SCX_RQ_BALANCING/SCX_RQ_IN_BALANCE/ and add SCX_RQ_IN_WAKEUP sched_ext: Allow SCX_DSQ_LOCAL_ON for direct dispatches sched_ext/scx_qmap: Pick idle CPU for direct dispatch on !wakeup enqueues sched_ext: Build fix on !CONFIG_STACKTRACE[_SUPPORT] sched_ext: Allow p->scx.disallow only while loading sched_ext: Simplify scx_can_stop_tick() invocation in sched_can_stop_tick() sched_ext: Add scx_enabled() test to @start_class promotion in put_prev_task_balance() sched_ext: Use update_curr_common() in update_curr_scx() sched_ext: Simplify UP support by enabling sched_class->balance() in UP sched_ext: Improve comment on idle_sched_class exception in scx_task_iter_next_locked() sched_ext: Make task_can_run_on_remote_rq() use common task_allowed_on_cpu() sched_ext: Fix unsafe list iteration in process_ddsp_deferred_locals() sched_ext: Make scx_rq_online() also test cpu_active() in addition to SCX_RQ_ONLINE sched_ext: Improve logging around enable/disable sched_ext: Don't use double locking to migrate tasks across CPUs scx_central: Fix smatch checker warning sched_ext: Add missing cfi stub for ops.tick sched_ext: Use task_can_run_on_remote_rq() test in dispatch_to_local_dsq() sched_ext: Use sched_clock_cpu() instead of rq_clock_task() in touch_core_sched() sched_ext: Don't call put_prev_task_scx() before picking the next task sched_ext: Replace SCX_TASK_BAL_KEEP with SCX_RQ_BAL_KEEP sched_ext: Unify regular and core-sched pick task paths sched_ext: Relocate functions in kernel/sched/ext.c sched_ext: Remove switch_class_scx() sched_ext: Remove sched_class->switch_class() sched_ext: TASK_DEAD tasks must be switched out of SCX on ops_disable sched_ext: TASK_DEAD tasks must be switched into SCX on ops_enable sched: Expose css_tg() sched: Make cpu_shares_read_u64() use tg_weight() sched: Introduce CONFIG_GROUP_SCHED_WEIGHT sched_ext: Add cgroup support sched_ext: Add a cgroup scheduler which uses flattened hierarchy sched_ext: Temporarily work around pick_task_scx() being called without balance_scx() sched_ext: Add missing static to scx_has_op[] sched_ext: Add missing static to scx_dump_data sched_ext: Rename scx_kfunc_set_sleepable to unlocked and relocate sched_ext: Refactor consume_remote_task() sched_ext: Make find_dsq_for_dispatch() handle SCX_DSQ_LOCAL_ON sched_ext: Fix processs_ddsp_deferred_locals() by unifying DTL_INVALID handling sched_ext: Restructure dispatch_to_local_dsq() sched_ext: Reorder args for consume_local/remote_task() sched_ext: Move sanity check and dsq_mod_nr() into task_unlink_from_dsq() sched_ext: Move consume_local_task() upward sched_ext: Replace consume_local_task() with move_local_task_to_local_dsq() sched_ext: Compact struct bpf_iter_scx_dsq_kern sched_ext: Implement scx_bpf_dispatch[_vtime]_from_dsq() scx_qmap: Implement highpri boosting sched_ext: Synchronize bypass state changes with rq lock sched_ext: Don't trigger ops.quiescent/runnable() on migrations sched_ext: Fix build when !CONFIG_STACKTRACE sched_ext: Build fix for !CONFIG_SMP sched_ext: Add __COMPAT helpers for features added during v6.12 devel cycle tools/sched_ext: Receive misc updates from SCX repo scx_flatcg: Use a user DSQ for fallback instead of SCX_DSQ_GLOBAL sched_ext: Allow only user DSQs for scx_bpf_consume(), scx_bpf_dsq_nr_queued() and bpf_iter_scx_dsq_new() sched_ext: Relocate find_user_dsq() sched_ext: Split the global DSQ per NUMA node sched_ext: Use shorter slice while bypassing sched_ext: Relocate check_hotplug_seq() call in scx_ops_enable() sched_ext: Remove SCX_OPS_PREPPING sched_ext: Initialize in bypass mode sched_ext: Fix SCX_TASK_INIT -> SCX_TASK_READY transitions in scx_ops_enable() sched_ext: Enable scx_ops_init_task() separately sched_ext: Add scx_cgroup_enabled to gate cgroup operations and fix scx_tg_online() sched_ext: Decouple locks in scx_ops_disable_workfn() sched_ext: Decouple locks in scx_ops_enable() sched_ext: Improve error reporting during loading sched_ext: scx_cgroup_exit() may be called without successful scx_cgroup_init() sched/core: Make select_task_rq() take the pointer to wake_flags instead of value sched/core: Add ENQUEUE_RQ_SELECTED to indicate whether ->select_task_rq() was called sched_ext, scx_qmap: Add and use SCX_ENQ_CPU_SELECTED Revert "sched_ext: Use shorter slice while bypassing" sched_ext: Start schedulers with consistent p->scx.slice values sched_ext: Move scx_buildin_idle_enabled check to scx_bpf_select_cpu_dfl() sched_ext: bypass mode shouldn't depend on ops.select_cpu() sched_ext: Move scx_tasks_lock handling into scx_task_iter helpers sched_ext: Don't hold scx_tasks_lock for too long sched_ext: Make cast_mask() inline sched_ext: Fix enq_last_no_enq_fails selftest sched_ext: Add a missing newline at the end of an error message sched_ext: Update scx_show_state.py to match scx_ops_bypass_depth's new type sched_ext: Handle cases where pick_task_scx() is called without preceding balance_scx() sched_ext: ops.cpu_acquire() should be called with SCX_KF_REST sched_ext: Factor out move_task_between_dsqs() from scx_dispatch_from_dsq() sched_ext: Rename CFI stubs to names that are recognized by BPF sched_ext: Replace set_arg_maybe_null() with __nullable CFI stub tags sched_ext: Avoid live-locking bypass mode switching sched_ext: Enable the ops breather and eject BPF scheduler on softlockup sched_ext: scx_bpf_dispatch_from_dsq_set_*() are allowed from unlocked context sched_ext: Rename scx_bpf_dispatch[_vtime]() to scx_bpf_dsq_insert[_vtime]() sched_ext: Rename scx_bpf_consume() to scx_bpf_dsq_move_to_local() sched_ext: Rename scx_bpf_dispatch[_vtime]_from_dsq*() -> scx_bpf_dsq_move[_vtime]*() sched_ext: Fix invalid irq restore in scx_ops_bypass() sched_ext: Fix dsq_local_on selftest tools/sched_ext: Receive updates from SCX repo sched_ext: selftests/dsp_local_on: Fix sporadic failures sched_ext: Fix incorrect autogroup migration detection sched_ext: Implement auto local dispatching of migration disabled tasks sched_ext: Fix migration disabled handling in targeted dispatches sched_ext: Fix incorrect assumption about migration disabled tasks in task_can_run_on_remote_rq() sched_ext: Fix pick_task_scx() picking non-queued tasks when it's called without balance() sched_ext: Implement SCX_OPS_ALLOW_QUEUED_WAKEUP sched_ext: bpf_iter_scx_dsq_new() should always initialize iterator sched_ext: Make scx_group_set_weight() always update tg->scx.weight sched_ext, sched/core: Don't call scx_group_set_weight() prematurely from sched_create_group() sched_ext: Mark scx_bpf_dsq_move_set_[slice|vtime]() with KF_RCU sched_ext: Don't kick CPUs running higher classes sched_ext: Use SCX_TASK_READY test instead of tryget_task_struct() during class switch tools/sched_ext: Sync with scx repo Thomas Gleixner (1): sched/ext: Remove sched_fork() hack Thorsten Blum (1): sched_ext: Use str_enabled_disabled() helper in update_selcpu_topology() Tianchen Ding (1): sched_ext: Use btf_ids to resolve task_struct Tony Ambardar (1): libbpf: Ensure new BTF objects inherit input endianness Vincent Guittot (2): sched/cpufreq: Rework schedutil governor performance estimation sched/fair: Fix sched_can_stop_tick() for fair tasks Vishal Chourasia (2): sched_ext: Add __weak markers to BPF helper function decalarations sched_ext: Fix function pointer type mismatches in BPF selftests Wenyu Huang (1): sched/doc: Update documentation after renames and synchronize Chinese version Yafang Shao (2): bpf: Add bits iterator selftests/bpf: Add selftest for bits iter Yipeng Zou (1): sched_ext: Allow dequeue_task_scx to fail Yiwei Lin (1): sched/fair: Remove unused 'curr' argument from pick_next_entity() Yu Liao (2): sched: Put task_group::idle under CONFIG_GROUP_SCHED_WEIGHT sched: Add dummy version of sched_group_set_idle() Yury Norov (1): cpumask: introduce assign_cpu() macro Zhang Qiao (3): sched_ext: Remove redundant p->nr_cpus_allowed checker sched/ext: Fix unmatch trailing comment of CONFIG_EXT_GROUP_SCHED sched/ext: Use tg_cgroup() to elieminate duplicate code Zhao Mengmeng (1): sched_ext: Replace scx_next_task_picked() with switch_class() in comment Zicheng Qu (18): sched: Fix kabi for reweight_task in struct sched_class Revert "sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting" sched/syscalls: Fix kabi for EXPORT_SYMBOL moved from core.c to syscalls.c sched: Fix kabi for switching_to in struct sched_class sched/fair: Fix kabi for check_preempt_curr and wakeup_preempt in struct sched_class sched: Fix kabi for dequeue_task in struct sched_class sched_ext: Fix kabi for scx in struct task_struct sched_ext: Fix kabi for switch_class in struct sched_class sched: Fix kabi for exec_max in struct sched_statistics sched_ext: Fix kabi for balance in struct sched_class sched_ext: Fix kabi for header in kernel/sched/sched.h sched: Fix kabi pick_task in struct sched_class sched: Fix kabi for put_prev_task in struct sched_class sched_ext: Fix kabi for scx_flags and scx_weight in struct task_group sched: Fix kabi for int idle in struct task_group sched: Add __setscheduler_class() for sched_ext genirq: Fix kabi for kstat_irqs in struct irq_desc sched_ext: Enable and disable sched_ext configs Zqiang (1): sched_ext: Fix unsafe locking in the scx_dump_state() guanjing (1): sched_ext: fix application of sizeof to pointer Documentation/bpf/bpf_iterators.rst | 2 +- Documentation/bpf/kfuncs.rst | 14 +- Documentation/scheduler/index.rst | 1 + Documentation/scheduler/sched-design-CFS.rst | 8 +- Documentation/scheduler/sched-ext.rst | 325 + .../zh_CN/scheduler/sched-design-CFS.rst | 8 +- MAINTAINERS | 16 +- Makefile | 4 +- arch/arm64/configs/openeuler_defconfig | 3 + arch/arm64/kernel/bpf-rvi.c | 4 +- arch/arm64/net/bpf_jit_comp.c | 55 +- arch/mips/dec/setup.c | 2 +- arch/parisc/kernel/smp.c | 2 +- arch/powerpc/kvm/book3s_hv_rm_xics.c | 2 +- arch/riscv/include/asm/cfi.h | 3 +- arch/riscv/kernel/cfi.c | 2 +- arch/riscv/net/bpf_jit_comp64.c | 48 +- arch/s390/net/bpf_jit_comp.c | 59 +- arch/x86/configs/openeuler_defconfig | 2 + arch/x86/include/asm/cfi.h | 126 +- arch/x86/kernel/alternative.c | 87 +- arch/x86/kernel/cfi.c | 4 +- arch/x86/net/bpf_jit_comp.c | 261 +- block/blk-cgroup.c | 4 +- drivers/hid/bpf/hid_bpf_dispatch.c | 12 +- drivers/tty/sysrq.c | 1 + fs/proc/stat.c | 4 +- include/asm-generic/Kbuild | 1 + include/asm-generic/cfi.h | 5 + include/asm-generic/vmlinux.lds.h | 1 + include/linux/bitops.h | 2 + include/linux/bpf.h | 130 +- include/linux/bpf_mem_alloc.h | 3 + include/linux/bpf_verifier.h | 21 +- include/linux/btf.h | 105 + include/linux/btf_ids.h | 21 +- include/linux/cfi.h | 12 + include/linux/cgroup.h | 14 +- include/linux/cleanup.h | 42 +- include/linux/cpumask.h | 41 +- include/linux/energy_model.h | 1 - include/linux/file.h | 20 + include/linux/filter.h | 2 +- include/linux/irqdesc.h | 17 +- include/linux/kernel_stat.h | 8 + include/linux/module.h | 8 +- include/linux/sched.h | 8 +- include/linux/sched/ext.h | 216 + include/linux/sched/task.h | 8 +- include/trace/events/sched_ext.h | 32 + include/uapi/linux/bpf.h | 16 +- include/uapi/linux/sched.h | 1 + init/Kconfig | 10 + init/init_task.c | 12 + kernel/Kconfig.preempt | 27 +- kernel/bpf-rvi/common_kfuncs.c | 4 +- kernel/bpf/Makefile | 8 +- kernel/bpf/bpf_iter.c | 12 +- kernel/bpf/bpf_struct_ops.c | 745 +- kernel/bpf/bpf_struct_ops_types.h | 12 - kernel/bpf/btf.c | 431 +- kernel/bpf/cgroup_iter.c | 65 +- kernel/bpf/core.c | 76 +- kernel/bpf/cpumask.c | 18 +- kernel/bpf/dispatcher.c | 7 +- kernel/bpf/helpers.c | 202 +- kernel/bpf/map_iter.c | 10 +- kernel/bpf/memalloc.c | 14 +- kernel/bpf/syscall.c | 12 +- kernel/bpf/task_iter.c | 242 +- kernel/bpf/trampoline.c | 99 +- kernel/bpf/verifier.c | 317 +- kernel/cgroup/cgroup.c | 18 +- kernel/cgroup/cpuset.c | 4 +- kernel/cgroup/rstat.c | 13 +- kernel/events/core.c | 2 +- kernel/fork.c | 17 +- kernel/irq/Kconfig | 4 + kernel/irq/internals.h | 2 +- kernel/irq/irqdesc.c | 144 +- kernel/irq/proc.c | 5 +- kernel/module/main.c | 5 +- kernel/sched/autogroup.c | 4 +- kernel/sched/bpf_sched.c | 8 +- kernel/sched/build_policy.c | 13 + kernel/sched/core.c | 2522 +----- kernel/sched/cpuacct.c | 4 +- kernel/sched/cpufreq_schedutil.c | 83 +- kernel/sched/deadline.c | 175 +- kernel/sched/debug.c | 3 + kernel/sched/ext.c | 7155 +++++++++++++++++ kernel/sched/ext.h | 119 + kernel/sched/ext_idle.c | 755 ++ kernel/sched/ext_idle.h | 39 + kernel/sched/fair.c | 306 +- kernel/sched/idle.c | 31 +- kernel/sched/rt.c | 40 +- kernel/sched/sched.h | 473 +- kernel/sched/stop_task.c | 35 +- kernel/sched/syscalls.c | 1713 ++++ kernel/trace/bpf_trace.c | 12 +- kernel/trace/trace_probe.c | 2 - kernel/watchdog.c | 223 +- lib/Kconfig.debug | 14 + lib/dump_stack.c | 1 + lib/rhashtable.c | 12 +- net/bpf/bpf_dummy_struct_ops.c | 72 +- net/bpf/test_run.c | 30 +- net/core/filter.c | 33 +- net/core/xdp.c | 10 +- net/ipv4/bpf_tcp_ca.c | 93 +- net/ipv4/fou_bpf.c | 10 +- net/ipv4/tcp_bbr.c | 4 +- net/ipv4/tcp_cong.c | 6 +- net/ipv4/tcp_cubic.c | 4 +- net/ipv4/tcp_dctcp.c | 4 +- net/netfilter/nf_conntrack_bpf.c | 10 +- net/netfilter/nf_nat_bpf.c | 10 +- net/socket.c | 8 +- net/xfrm/xfrm_interface_bpf.c | 10 +- scripts/Makefile.btf | 33 + scripts/Makefile.modfinal | 2 +- scripts/gdb/linux/interrupts.py | 6 +- scripts/pahole-flags.sh | 30 - tools/Makefile | 10 +- .../bpf/bpftool/Documentation/bpftool-gen.rst | 58 +- tools/bpf/bpftool/gen.c | 253 +- tools/bpf/resolve_btfids/main.c | 8 + tools/include/linux/bitops.h | 2 + tools/include/uapi/linux/bpf.h | 14 +- tools/include/uapi/linux/sched.h | 1 + tools/lib/bpf/Build | 2 +- tools/lib/bpf/bpf.c | 4 +- tools/lib/bpf/bpf.h | 4 +- tools/lib/bpf/btf.c | 704 +- tools/lib/bpf/btf.h | 36 + tools/lib/bpf/btf_iter.c | 177 + tools/lib/bpf/btf_relocate.c | 519 ++ tools/lib/bpf/libbpf.c | 97 +- tools/lib/bpf/libbpf.map | 4 +- tools/lib/bpf/libbpf_internal.h | 29 +- tools/lib/bpf/libbpf_probes.c | 1 + tools/lib/bpf/linker.c | 58 +- tools/perf/util/probe-finder.c | 4 +- tools/sched_ext/.gitignore | 2 + tools/sched_ext/Makefile | 246 + tools/sched_ext/README.md | 270 + .../sched_ext/include/bpf-compat/gnu/stubs.h | 11 + tools/sched_ext/include/scx/common.bpf.h | 647 ++ tools/sched_ext/include/scx/common.h | 81 + tools/sched_ext/include/scx/compat.bpf.h | 143 + tools/sched_ext/include/scx/compat.h | 187 + .../sched_ext/include/scx/enums.autogen.bpf.h | 105 + tools/sched_ext/include/scx/enums.autogen.h | 41 + tools/sched_ext/include/scx/enums.bpf.h | 12 + tools/sched_ext/include/scx/enums.h | 27 + tools/sched_ext/include/scx/user_exit_info.h | 118 + tools/sched_ext/scx_central.bpf.c | 356 + tools/sched_ext/scx_central.c | 145 + tools/sched_ext/scx_flatcg.bpf.c | 954 +++ tools/sched_ext/scx_flatcg.c | 234 + tools/sched_ext/scx_flatcg.h | 51 + tools/sched_ext/scx_qmap.bpf.c | 827 ++ tools/sched_ext/scx_qmap.c | 155 + tools/sched_ext/scx_show_state.py | 42 + tools/sched_ext/scx_simple.bpf.c | 151 + tools/sched_ext/scx_simple.c | 107 + tools/testing/selftests/Makefile | 9 +- tools/testing/selftests/bpf/.gitignore | 1 + .../testing/selftests/bpf/bpf_experimental.h | 96 + .../selftests/bpf/bpf_testmod/bpf_testmod.c | 160 +- .../selftests/bpf/bpf_testmod/bpf_testmod.h | 61 + .../bpf/bpf_testmod/bpf_testmod_kfunc.h | 9 + .../selftests/bpf/prog_tests/bpf_iter.c | 44 +- .../selftests/bpf/prog_tests/btf_distill.c | 692 ++ .../selftests/bpf/prog_tests/cgroup_iter.c | 33 + .../bpf/prog_tests/global_func_dead_code.c | 60 + .../testing/selftests/bpf/prog_tests/iters.c | 209 + .../selftests/bpf/prog_tests/kfunc_call.c | 1 + .../selftests/bpf/prog_tests/rcu_read_lock.c | 6 + .../selftests/bpf/prog_tests/spin_lock.c | 2 + .../prog_tests/test_struct_ops_maybe_null.c | 46 + .../bpf/prog_tests/test_struct_ops_module.c | 86 + .../prog_tests/test_struct_ops_multi_pages.c | 30 + .../testing/selftests/bpf/prog_tests/timer.c | 4 + .../selftests/bpf/prog_tests/verifier.c | 4 + ...f_iter_task_vma.c => bpf_iter_task_vmas.c} | 0 .../{bpf_iter_task.c => bpf_iter_tasks.c} | 0 .../bpf/progs/freplace_dead_global_func.c | 11 + tools/testing/selftests/bpf/progs/iters_css.c | 72 + .../selftests/bpf/progs/iters_css_task.c | 102 + .../testing/selftests/bpf/progs/iters_task.c | 41 + .../selftests/bpf/progs/iters_task_failure.c | 105 + .../selftests/bpf/progs/iters_task_vma.c | 43 + .../selftests/bpf/progs/iters_testmod_seq.c | 50 + .../selftests/bpf/progs/kfunc_call_test.c | 37 + .../selftests/bpf/progs/rcu_read_lock.c | 120 + .../bpf/progs/struct_ops_maybe_null.c | 29 + .../bpf/progs/struct_ops_maybe_null_fail.c | 24 + .../selftests/bpf/progs/struct_ops_module.c | 37 + .../bpf/progs/struct_ops_multi_pages.c | 102 + .../selftests/bpf/progs/test_global_func12.c | 4 +- .../selftests/bpf/progs/test_spin_lock.c | 65 + .../selftests/bpf/progs/test_spin_lock_fail.c | 44 + tools/testing/selftests/bpf/progs/timer.c | 63 +- .../selftests/bpf/progs/verifier_bits_iter.c | 232 + .../bpf/progs/verifier_global_subprogs.c | 101 + .../selftests/bpf/progs/verifier_spin_lock.c | 2 +- .../bpf/progs/verifier_subprog_precision.c | 4 +- tools/testing/selftests/bpf/test_loader.c | 10 +- tools/testing/selftests/bpf/test_maps.c | 18 +- tools/testing/selftests/bpf/test_maps.h | 5 + tools/testing/selftests/sched_ext/.gitignore | 6 + tools/testing/selftests/sched_ext/Makefile | 211 + tools/testing/selftests/sched_ext/config | 9 + .../selftests/sched_ext/create_dsq.bpf.c | 58 + .../testing/selftests/sched_ext/create_dsq.c | 57 + .../sched_ext/ddsp_bogus_dsq_fail.bpf.c | 42 + .../selftests/sched_ext/ddsp_bogus_dsq_fail.c | 60 + .../sched_ext/ddsp_vtimelocal_fail.bpf.c | 39 + .../sched_ext/ddsp_vtimelocal_fail.c | 59 + .../selftests/sched_ext/dsp_local_on.bpf.c | 68 + .../selftests/sched_ext/dsp_local_on.c | 60 + .../sched_ext/enq_last_no_enq_fails.bpf.c | 29 + .../sched_ext/enq_last_no_enq_fails.c | 64 + .../sched_ext/enq_select_cpu_fails.bpf.c | 43 + .../sched_ext/enq_select_cpu_fails.c | 61 + tools/testing/selftests/sched_ext/exit.bpf.c | 86 + tools/testing/selftests/sched_ext/exit.c | 64 + tools/testing/selftests/sched_ext/exit_test.h | 20 + .../testing/selftests/sched_ext/hotplug.bpf.c | 61 + tools/testing/selftests/sched_ext/hotplug.c | 170 + .../selftests/sched_ext/hotplug_test.h | 15 + .../sched_ext/init_enable_count.bpf.c | 53 + .../selftests/sched_ext/init_enable_count.c | 157 + .../testing/selftests/sched_ext/maximal.bpf.c | 166 + tools/testing/selftests/sched_ext/maximal.c | 54 + .../selftests/sched_ext/maybe_null.bpf.c | 36 + .../testing/selftests/sched_ext/maybe_null.c | 49 + .../sched_ext/maybe_null_fail_dsp.bpf.c | 25 + .../sched_ext/maybe_null_fail_yld.bpf.c | 28 + .../testing/selftests/sched_ext/minimal.bpf.c | 21 + tools/testing/selftests/sched_ext/minimal.c | 58 + .../selftests/sched_ext/prog_run.bpf.c | 33 + tools/testing/selftests/sched_ext/prog_run.c | 78 + .../testing/selftests/sched_ext/reload_loop.c | 74 + tools/testing/selftests/sched_ext/runner.c | 212 + tools/testing/selftests/sched_ext/scx_test.h | 131 + .../selftests/sched_ext/select_cpu_dfl.bpf.c | 40 + .../selftests/sched_ext/select_cpu_dfl.c | 75 + .../sched_ext/select_cpu_dfl_nodispatch.bpf.c | 89 + .../sched_ext/select_cpu_dfl_nodispatch.c | 75 + .../sched_ext/select_cpu_dispatch.bpf.c | 41 + .../selftests/sched_ext/select_cpu_dispatch.c | 73 + .../select_cpu_dispatch_bad_dsq.bpf.c | 37 + .../sched_ext/select_cpu_dispatch_bad_dsq.c | 59 + .../select_cpu_dispatch_dbl_dsp.bpf.c | 38 + .../sched_ext/select_cpu_dispatch_dbl_dsp.c | 59 + .../sched_ext/select_cpu_vtime.bpf.c | 92 + .../selftests/sched_ext/select_cpu_vtime.c | 62 + .../selftests/sched_ext/test_example.c | 49 + tools/testing/selftests/sched_ext/util.c | 71 + tools/testing/selftests/sched_ext/util.h | 13 + 263 files changed, 27732 insertions(+), 3817 deletions(-) create mode 100644 Documentation/scheduler/sched-ext.rst create mode 100644 include/asm-generic/cfi.h create mode 100644 include/linux/sched/ext.h create mode 100644 include/trace/events/sched_ext.h delete mode 100644 kernel/bpf/bpf_struct_ops_types.h create mode 100644 kernel/sched/ext.c create mode 100644 kernel/sched/ext.h create mode 100644 kernel/sched/ext_idle.c create mode 100644 kernel/sched/ext_idle.h create mode 100644 kernel/sched/syscalls.c create mode 100644 scripts/Makefile.btf delete mode 100755 scripts/pahole-flags.sh create mode 100644 tools/lib/bpf/btf_iter.c create mode 100644 tools/lib/bpf/btf_relocate.c create mode 100644 tools/sched_ext/.gitignore create mode 100644 tools/sched_ext/Makefile create mode 100644 tools/sched_ext/README.md create mode 100644 tools/sched_ext/include/bpf-compat/gnu/stubs.h create mode 100644 tools/sched_ext/include/scx/common.bpf.h create mode 100644 tools/sched_ext/include/scx/common.h create mode 100644 tools/sched_ext/include/scx/compat.bpf.h create mode 100644 tools/sched_ext/include/scx/compat.h create mode 100644 tools/sched_ext/include/scx/enums.autogen.bpf.h create mode 100644 tools/sched_ext/include/scx/enums.autogen.h create mode 100644 tools/sched_ext/include/scx/enums.bpf.h create mode 100644 tools/sched_ext/include/scx/enums.h create mode 100644 tools/sched_ext/include/scx/user_exit_info.h create mode 100644 tools/sched_ext/scx_central.bpf.c create mode 100644 tools/sched_ext/scx_central.c create mode 100644 tools/sched_ext/scx_flatcg.bpf.c create mode 100644 tools/sched_ext/scx_flatcg.c create mode 100644 tools/sched_ext/scx_flatcg.h create mode 100644 tools/sched_ext/scx_qmap.bpf.c create mode 100644 tools/sched_ext/scx_qmap.c create mode 100644 tools/sched_ext/scx_show_state.py create mode 100644 tools/sched_ext/scx_simple.bpf.c create mode 100644 tools/sched_ext/scx_simple.c create mode 100644 tools/testing/selftests/bpf/prog_tests/btf_distill.c create mode 100644 tools/testing/selftests/bpf/prog_tests/global_func_dead_code.c create mode 100644 tools/testing/selftests/bpf/prog_tests/test_struct_ops_maybe_null.c create mode 100644 tools/testing/selftests/bpf/prog_tests/test_struct_ops_module.c create mode 100644 tools/testing/selftests/bpf/prog_tests/test_struct_ops_multi_pages.c rename tools/testing/selftests/bpf/progs/{bpf_iter_task_vma.c => bpf_iter_task_vmas.c} (100%) rename tools/testing/selftests/bpf/progs/{bpf_iter_task.c => bpf_iter_tasks.c} (100%) create mode 100644 tools/testing/selftests/bpf/progs/freplace_dead_global_func.c create mode 100644 tools/testing/selftests/bpf/progs/iters_css.c create mode 100644 tools/testing/selftests/bpf/progs/iters_css_task.c create mode 100644 tools/testing/selftests/bpf/progs/iters_task.c create mode 100644 tools/testing/selftests/bpf/progs/iters_task_failure.c create mode 100644 tools/testing/selftests/bpf/progs/iters_task_vma.c create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_maybe_null.c create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_maybe_null_fail.c create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_module.c create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_multi_pages.c create mode 100644 tools/testing/selftests/bpf/progs/verifier_bits_iter.c create mode 100644 tools/testing/selftests/bpf/progs/verifier_global_subprogs.c create mode 100644 tools/testing/selftests/sched_ext/.gitignore create mode 100644 tools/testing/selftests/sched_ext/Makefile create mode 100644 tools/testing/selftests/sched_ext/config create mode 100644 tools/testing/selftests/sched_ext/create_dsq.bpf.c create mode 100644 tools/testing/selftests/sched_ext/create_dsq.c create mode 100644 tools/testing/selftests/sched_ext/ddsp_bogus_dsq_fail.bpf.c create mode 100644 tools/testing/selftests/sched_ext/ddsp_bogus_dsq_fail.c create mode 100644 tools/testing/selftests/sched_ext/ddsp_vtimelocal_fail.bpf.c create mode 100644 tools/testing/selftests/sched_ext/ddsp_vtimelocal_fail.c create mode 100644 tools/testing/selftests/sched_ext/dsp_local_on.bpf.c create mode 100644 tools/testing/selftests/sched_ext/dsp_local_on.c create mode 100644 tools/testing/selftests/sched_ext/enq_last_no_enq_fails.bpf.c create mode 100644 tools/testing/selftests/sched_ext/enq_last_no_enq_fails.c create mode 100644 tools/testing/selftests/sched_ext/enq_select_cpu_fails.bpf.c create mode 100644 tools/testing/selftests/sched_ext/enq_select_cpu_fails.c create mode 100644 tools/testing/selftests/sched_ext/exit.bpf.c create mode 100644 tools/testing/selftests/sched_ext/exit.c create mode 100644 tools/testing/selftests/sched_ext/exit_test.h create mode 100644 tools/testing/selftests/sched_ext/hotplug.bpf.c create mode 100644 tools/testing/selftests/sched_ext/hotplug.c create mode 100644 tools/testing/selftests/sched_ext/hotplug_test.h create mode 100644 tools/testing/selftests/sched_ext/init_enable_count.bpf.c create mode 100644 tools/testing/selftests/sched_ext/init_enable_count.c create mode 100644 tools/testing/selftests/sched_ext/maximal.bpf.c create mode 100644 tools/testing/selftests/sched_ext/maximal.c create mode 100644 tools/testing/selftests/sched_ext/maybe_null.bpf.c create mode 100644 tools/testing/selftests/sched_ext/maybe_null.c create mode 100644 tools/testing/selftests/sched_ext/maybe_null_fail_dsp.bpf.c create mode 100644 tools/testing/selftests/sched_ext/maybe_null_fail_yld.bpf.c create mode 100644 tools/testing/selftests/sched_ext/minimal.bpf.c create mode 100644 tools/testing/selftests/sched_ext/minimal.c create mode 100644 tools/testing/selftests/sched_ext/prog_run.bpf.c create mode 100644 tools/testing/selftests/sched_ext/prog_run.c create mode 100644 tools/testing/selftests/sched_ext/reload_loop.c create mode 100644 tools/testing/selftests/sched_ext/runner.c create mode 100644 tools/testing/selftests/sched_ext/scx_test.h create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dfl.bpf.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dfl.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dfl_nodispatch.bpf.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dfl_nodispatch.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dispatch.bpf.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dispatch.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dispatch_bad_dsq.bpf.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dispatch_bad_dsq.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dispatch_dbl_dsp.bpf.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dispatch_dbl_dsp.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_vtime.bpf.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_vtime.c create mode 100644 tools/testing/selftests/sched_ext/test_example.c create mode 100644 tools/testing/selftests/sched_ext/util.c create mode 100644 tools/testing/selftests/sched_ext/util.h -- 2.34.1

2 453

[PATCH OLK-6.6 0/2] CVE-2026-23296
by Li Lingfeng 03 Apr '26

03 Apr '26

Junxiao Bi (2): scsi: core: Fix refcount leak for tagset_refcnt scsi: core: Fix error handling for scsi_alloc_sdev() drivers/scsi/scsi_scan.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) -- 2.52.0

2 6

[PATCH OLK-6.6 000/451] sched_ext v1
by Zicheng Qu 03 Apr '26

03 Apr '26

Aboorva Devarajan (2): sched_ext: Documentation: Remove mentions of scx_bpf_switch_all sched: Pass correct scheduling policy to __setscheduler_class Alan Maguire (16): kbuild,bpf: Switch to using --btf_features for pahole v1.26 and later kbuild, bpf: Use test-ge check for v1.25-only pahole libbpf: Add btf__distill_base() creating split BTF with distilled base BTF selftests/bpf: Test distilled base, split BTF generation libbpf: Split BTF relocation selftests/bpf: Extend distilled BTF tests to cover BTF relocation resolve_btfids: Handle presence of .BTF.base section libbpf: BTF relocation followup fixing naming, loop logic module, bpf: Store BTF base pointer in struct module libbpf: Split field iter code into its own file kernel libbpf,bpf: Share BTF relocate-related code with kernel kbuild,bpf: Add module-specific pahole flags for distilled base BTF selftests/bpf: Add kfunc_call test for simple dtor in bpf_testmod bpf: fix build when CONFIG_DEBUG_INFO_BTF[_MODULES] is undefined libbpf: Fix error handling in btf__distill_base() libbpf: Fix license for btf_relocate.c Alexander Lobakin (1): bitops: make BYTES_TO_BITS() treewide-available Alexei Starovoitov (2): s390/bpf: Fix indirect trampoline generation bpf: Introduce "volatile compare" macros Andrea Righi (33): sched_ext: fix typo in set_weight() description sched_ext: add CONFIG_DEBUG_INFO_BTF dependency sched_ext: Provide a sysfs enable_seq counter sched_ext: improve WAKE_SYNC behavior for default idle CPU selection sched_ext: Clarify ops.select_cpu() for single-CPU tasks sched_ext: Introduce LLC awareness to the default idle selection policy sched_ext: Introduce NUMA awareness to the default idle selection policy sched_ext: Do not enable LLC/NUMA optimizations when domains overlap sched_ext: Fix incorrect use of bitwise AND MAINTAINERS: add self as reviewer for sched_ext sched_ext: idle: Refresh idle masks during idle-to-idle transitions sched_ext: Use the NUMA scheduling domain for NUMA optimizations sched_ext: idle: use assign_cpu() to update the idle cpumask sched_ext: idle: clarify comments sched_ext: idle: introduce check_builtin_idle_enabled() helper sched_ext: idle: small CPU iteration refactoring sched_ext: update scx_bpf_dsq_insert() doc for SCX_DSQ_LOCAL_ON sched_ext: Include remaining task time slice in error state dump sched_ext: Include task weight in the error state dump selftests/sched_ext: Fix enum resolution tools/sched_ext: Add helper to check task migration state sched_ext: selftests/dsp_local_on: Fix selftest on UP systems sched_ext: Fix lock imbalance in dispatch_to_local_dsq() selftests/sched_ext: Fix exit selftest hang on UP sched_ext: Move built-in idle CPU selection policy to a separate file sched_ext: Track currently locked rq sched_ext: Make scx_locked_rq() inline sched_ext: Fix missing rq lock in scx_bpf_cpuperf_set() sched/ext: Fix invalid task state transitions on class switch sched_ext: Make scx_kf_allowed_if_unlocked() available outside ext.c sched_ext: Remove duplicate BTF_ID_FLAGS definitions sched_ext: Fix rq lock state in hotplug ops sched_ext: Validate prev_cpu in scx_bpf_select_cpu_dfl() Andrii Nakryiko (14): bpf: Emit global subprog name in verifier logs bpf: Validate global subprogs lazily selftests/bpf: Add lazy global subprog validation tests libbpf: Add btf__new_split() API that was declared but not implemented bpf: move sleepable flag from bpf_prog_aux to bpf_prog libbpf: Add BTF field iterator libbpf: Make use of BTF field iterator in BPF linker code libbpf: Make use of BTF field iterator in BTF handling code bpftool: Use BTF field iterator in btfgen libbpf: Remove callback-based type/string BTF field visitor helpers bpf: extract iterator argument type and name validation logic bpf: allow passing struct bpf_iter_<type> as kfunc arguments selftests/bpf: test passing iterator to a kfunc selftests/bpf: validate eliminated global subprog is not freplaceable Arnaldo Carvalho de Melo (1): tools include UAPI: Sync linux/sched.h copy with the kernel sources Atul Kumar Pant (1): sched_ext: Fixes typos in comments Benjamin Tissoires (1): bpf: introduce in_sleepable() helper Bitao Hu (4): genirq: Convert kstat_irqs to a struct genirq: Provide a snapshot mechanism for interrupt statistics watchdog/softlockup: Low-overhead detection of interrupt storm watchdog/softlockup: Report the most frequent interrupts Björn Töpel (1): selftests: sched_ext: Add sched_ext as proper selftest target Breno Leitao (3): rhashtable: Fix potential deadlock by moving schedule_work outside lock sched_ext: Use kvzalloc for large exit_dump allocation sched/ext: Prevent update_locked_rq() calls with NULL rq Changwoo Min (12): sched_ext: Clarify sched_ext_ops table for userland scheduler sched_ext: add a missing rcu_read_lock/unlock pair at scx_select_cpu_dfl() MAINTAINERS: add me as reviewer for sched_ext sched_ext: Replace rq_lock() to raw_spin_rq_lock() in scx_ops_bypass() sched_ext: Relocate scx_enabled() related code sched_ext: Implement scx_bpf_now() sched_ext: Add scx_bpf_now() for BPF scheduler sched_ext: Add time helpers for BPF schedulers sched_ext: Replace bpf_ktime_get_ns() to scx_bpf_now() sched_ext: Use time helpers in BPF schedulers sched_ext: Fix incorrect time delta calculation in time_delta() sched_ext: Add scx_bpf_events() and scx_read_event() for BPF schedulers Cheng-Yang Chou (1): sched_ext: Always use SMP versions in kernel/sched/ext.c Christian Brauner (1): file: add take_fd() cleanup helper Christian Loehle (1): sched/fair: Remove stale FREQUENCY_UTIL comment Christophe Leroy (2): bpf: Remove arch_unprotect_bpf_trampoline() bpf: Check return from set_memory_rox() Chuyi Zhou (15): cgroup: Prepare for using css_task_iter_*() in BPF bpf: Introduce css_task open-coded iterator kfuncs bpf: Introduce task open coded iterator kfuncs bpf: Introduce css open-coded iterator kfuncs bpf: teach the verifier to enforce css_iter and task_iter in RCU CS bpf: Let bpf_iter_task_new accept null task ptr selftests/bpf: rename bpf_iter_task.c to bpf_iter_tasks.c selftests/bpf: Add tests for open-coded task and css iter bpf: Relax allowlist for css_task iter selftests/bpf: Add tests for css_task iter combining with cgroup iter selftests/bpf: Add test for using css_task iter in sleepable progs bpf: Let verifier consider {task,cgroup} is trusted in bpf_iter_reg selftests/bpf: get trusted cgrp from bpf_iter__cgroup directly sched_ext: Fix the incorrect bpf_list kfunc API in common.bpf.h. sched_ext: Use SCX_CALL_OP_TASK in task_tick_scx Colin Ian King (1): sched_ext: Fix spelling mistake: "intead" -> "instead" Daniel Xu (3): bpf: btf: Support flags for BTF_SET8 sets bpf: btf: Add BTF_KFUNCS_START/END macro pair bpf: treewide: Annotate BPF kfuncs in BTF Dave Marchevsky (6): bpf: Don't explicitly emit BTF for struct btf_iter_num selftests/bpf: Rename bpf_iter_task_vma.c to bpf_iter_task_vmas.c bpf: Introduce task_vma open-coded iterator kfuncs selftests/bpf: Add tests for open-coded task_vma iter bpf: Add __bpf_kfunc_{start,end}_defs macros bpf: Add __bpf_hook_{start,end} macros David Vernet (15): bpf: Add ability to pin bpf timer to calling CPU selftests/bpf: Test pinning bpf timer to a core sched_ext: Implement runnable task stall watchdog sched_ext: Print sched_ext info when dumping stack sched_ext: Implement SCX_KICK_WAIT sched_ext: Implement sched_ext_ops.cpu_acquire/release() sched_ext: Add selftests bpf: Load vmlinux btf for any struct_ops map sched_ext: Make scx_bpf_cpuperf_set() @cpu arg signed scx: Allow calling sleepable kfuncs from BPF_PROG_TYPE_SYSCALL scx/selftests: Verify we can call create_dsq from prog_run sched_ext: Remove unnecessary cpu_relax() scx: Fix exit selftest to use custom DSQ scx: Fix raciness in scx_ops_bypass() scx: Fix maximal BPF selftest prog Dawei Li (1): genirq: Deduplicate interrupt descriptor initialization Devaansh Kumar (1): sched_ext: selftests: Fix grammar in tests description Devaansh-Kumar (1): sched_ext: Documentation: Update instructions for running example schedulers Eduard Zingerman (2): libbpf: Make btf_parse_elf process .BTF.base transparently selftests/bpf: Check if distilled base inherits source endianness Geliang Tang (1): bpf, btf: Check btf for register_bpf_struct_ops Henry Huang (2): sched_ext: initialize kit->cursor.flags sched_ext: keep running prev when prev->scx.slice != 0 Herbert Xu (1): rhashtable: Fix rhashtable_try_insert test Honglei Wang (3): sched_ext: use correct function name in pick_task_scx() warning message sched_ext: Add __weak to fix the build errors sched_ext: switch class when preempted by higher priority scheduler Hongyan Xia (1): sched/ext: Add BPF function to fetch rq Hou Tao (7): bpf: Free dynamically allocated bits in bpf_iter_bits_destroy() bpf: Add bpf_mem_alloc_check_size() helper bpf: Check the validity of nr_words in bpf_iter_bits_new() bpf: Use __u64 to save the bits in bits iterator selftests/bpf: Add three test cases for bits_iter selftests/bpf: Use -4095 as the bad address for bits iterator selftests/bpf: Export map_update_retriable() Ihor Solodrai (2): selftests/sched_ext: add order-only dependency of runner.o on BPFOBJ selftests/sched_ext: fix build after renames in sched_ext API Ilpo Järvinen (1): <linux/cleanup.h>: Allow the passing of both iomem and non-iomem pointers to no_free_ptr() Ingo Molnar (3): sched/syscalls: Split out kernel/sched/syscalls.c from kernel/sched/core.c sched/fair: Rename check_preempt_wakeup() to check_preempt_wakeup_fair() sched/fair: Rename check_preempt_curr() to wakeup_preempt() Jake Hillion (2): sched_ext: create_dsq: Return -EEXIST on duplicate request sched_ext: Drop kfuncs marked for removal in 6.15 Jiapeng Chong (1): sched_ext: Fixes incorrect type in bpf_scx_init() Jiayuan Chen (1): selftests/bpf: Fixes for test_maps test Kui-Feng Lee (29): bpf: refactory struct_ops type initialization to a function. bpf: get type information with BTF_ID_LIST bpf, net: introduce bpf_struct_ops_desc. bpf: add struct_ops_tab to btf. bpf: make struct_ops_map support btfs other than btf_vmlinux. bpf: pass btf object id in bpf_map_info. bpf: lookup struct_ops types from a given module BTF. bpf: pass attached BTF to the bpf_struct_ops subsystem bpf: hold module refcnt in bpf_struct_ops map creation and prog verification. bpf: validate value_type bpf, net: switch to dynamic registration libbpf: Find correct module BTFs for struct_ops maps and progs. bpf: export btf_ctx_access to modules. selftests/bpf: test case for register_bpf_struct_ops(). bpf: Fix error checks against bpf_get_btf_vmlinux(). bpf: Remove an unnecessary check. selftests/bpf: Suppress warning message of an unused variable. bpf: add btf pointer to struct bpf_ctx_arg_aux. bpf: Move __kfunc_param_match_suffix() to btf.c. bpf: Create argument information for nullable arguments. selftests/bpf: Test PTR_MAYBE_NULL arguments of struct_ops operators. libbpf: Set btf_value_type_id of struct bpf_map for struct_ops. libbpf: Convert st_ops->data to shadow type. bpftool: Generated shadow variables for struct_ops maps. bpftool: Add an example for struct_ops map and shadow type. selftests/bpf: Test if shadow types work correctly. bpf, net: validate struct_ops when updating value. bpf: struct_ops supports more than one page for trampolines. selftests/bpf: Test struct_ops maps with a large number of struct_ops program. Kumar Kartikeya Dwivedi (4): bpf: Allow calling static subprogs while holding a bpf_spin_lock selftests/bpf: Add test for static subprog call in lock cs bpf: Transfer RCU lock state between subprog calls selftests/bpf: Add tests for RCU lock transfer between subprogs Liang Jie (1): sched_ext: Use sizeof_field for key_len in dsq_hash_params Luo Gengkun (7): bpf: Fix kabi-breakage for bpf_func_info_aux bpf: Fix kabi-breakage for bpf_tramp_image bpf: Fix kabi for bpf_attr bpf_verifier: Fix kabi for bpf_verifier_env bpf: Fix kabi for bpf_ctx_arg_aux bpf: Fix kabi for bpf_prog_aux and bpf_prog selftests/bpf: modify test_loader that didn't support running bpf_prog_type_syscall programs Manu Bretelle (1): sched_ext: define missing cfi stubs for sched_ext Martin KaFai Lau (5): libbpf: Ensure undefined bpf_attr field stays 0 bpf: Remove unnecessary err < 0 check in bpf_struct_ops_map_update_elem bpf: Fix a crash when btf_parse_base() returns an error pointer bpf: Reject struct_ops registration that uses module ptr and the module btf_id is missing bpf: Use kallsyms to find the function name of a struct_ops's stub function Masahiro Yamada (1): kbuild: avoid too many execution of scripts/pahole-flags.sh Matthieu Baerts (1): bpf: fix compilation error without CGROUPS Peter Zijlstra (26): cfi: Flip headers x86/cfi,bpf: Fix BPF JIT call x86/cfi,bpf: Fix bpf_callback_t CFI x86/cfi,bpf: Fix bpf_struct_ops CFI cfi: Add CFI_NOSEAL() bpf: Fix dtor CFI cleanup: Make no_free_ptr() __must_check sched: Simplify set_user_nice() sched: Simplify syscalls sched: Simplify sched_{set,get}affinity() sched: Simplify yield_to() sched: Simplify sched_rr_get_interval() sched: Simplify sched_move_task() sched: Misc cleanups sched/deadline: Move bandwidth accounting into {en,de}queue_dl_entity sched: Allow sched_class::dequeue_task() to fail sched: Unify runtime accounting across classes sched: Use set_next_task(.first) where required sched/fair: Cleanup pick_task_fair() vs throttle sched/fair: Cleanup pick_task_fair()'s curr sched/fair: Unify pick_{,next_}_task_fair() sched: Fixup set_next_task() implementations sched: Split up put_prev_task_balance() sched: Rework pick_next_task() sched: Combine the last put_prev_task() and the first set_next_task() sched: Add put_prev_task(.next) Pu Lehui (8): riscv, bpf: Fix unpredictable kernel crash about RV64 struct_ops bpf: Fix kabi breakage in struct module riscv, bpf: Fix out-of-bounds issue when preparing trampoline image selftests/bpf: Fix btf leak on new btf alloc failure in btf_distill test libbpf: Fix return zero when elf_begin failed libbpf: Fix incorrect traversal end type ID when marking BTF_IS_EMBEDDED selftests/bpf: Add distilled BTF test about marking BTF_IS_EMBEDDED selftests/bpf: Add file_read_pattern to gitignore Randy Dunlap (1): sched_ext: fix kernel-doc warnings Shizhao Chen (1): sched_ext: Add option -l in selftest runner to list all available tests Song Liu (8): bpf: Charge modmem for struct_ops trampoline bpf: Let bpf_prog_pack_free handle any pointer bpf: Adjust argument names of arch_prepare_bpf_trampoline() bpf: Add helpers for trampoline image management bpf, x86: Adjust arch_prepare_bpf_trampoline return value bpf: Add arch_bpf_trampoline_size() bpf: Use arch_bpf_trampoline_size x86, bpf: Use bpf_prog_pack for bpf trampoline T.J. Mercier (1): bpf, docs: Fix broken link to renamed bpf_iter_task_vmas.c Tejun Heo (152): sched: Restructure sched_class order sanity checks in sched_init() sched: Allow sched_cgroup_fork() to fail and introduce sched_cancel_fork() sched: Add sched_class->reweight_task() sched: Add sched_class->switching_to() and expose check_class_changing/changed() sched: Factor out cgroup weight conversion functions sched: Factor out update_other_load_avgs() from __update_blocked_others() sched: Add normal_policy() sched_ext: Add boilerplate for extensible scheduler class sched_ext: Implement BPF extensible scheduler class sched_ext: Add scx_simple and scx_example_qmap example schedulers sched_ext: Add sysrq-S which disables the BPF scheduler sched_ext: Allow BPF schedulers to disallow specific tasks from joining SCHED_EXT sched_ext: Print debug dump after an error exit tools/sched_ext: Add scx_show_state.py sched_ext: Implement scx_bpf_kick_cpu() and task preemption support sched_ext: Add a central scheduler which makes all scheduling decisions on one CPU sched_ext: Make watchdog handle ops.dispatch() looping stall sched_ext: Add task state tracking operations sched_ext: Implement tickless support sched_ext: Track tasks that are subjects of the in-flight SCX operation sched_ext: Implement sched_ext_ops.cpu_online/offline() sched_ext: Bypass BPF scheduler while PM events are in progress sched_ext: Implement core-sched support sched_ext: Add vtime-ordered priority queue to dispatch_q's sched_ext: Documentation: scheduler: Document extensible scheduler class sched, sched_ext: Replace scx_next_task_picked() with sched_class->switch_class() cpufreq_schedutil: Refactor sugov_cpu_is_busy() sched_ext: Add cpuperf support sched_ext: Drop tools_clean target from the top-level Makefile sched_ext: Swap argument positions in kcalloc() call to avoid compiler warning sched, sched_ext: Simplify dl_prio() case handling in sched_fork() sched_ext: Account for idle policy when setting p->scx.weight in scx_ops_enable_task() sched_ext: Disallow loading BPF scheduler if isolcpus= domain isolation is in effect sched_ext: Minor cleanups in kernel/sched/ext.h sched, sched_ext: Open code for_balance_class_range() sched, sched_ext: Move some declarations from kernel/sched/ext.h to sched.h sched_ext: Take out ->priq and ->flags from scx_dsq_node sched_ext: Implement DSQ iterator sched_ext/scx_qmap: Add an example usage of DSQ iterator sched_ext: Reimplement scx_bpf_reenqueue_local() sched_ext: Make scx_bpf_reenqueue_local() skip tasks that are being migrated sched: Move struct balance_callback definition upward sched_ext: Unpin and repin rq lock from balance_scx() sched_ext: s/SCX_RQ_BALANCING/SCX_RQ_IN_BALANCE/ and add SCX_RQ_IN_WAKEUP sched_ext: Allow SCX_DSQ_LOCAL_ON for direct dispatches sched_ext/scx_qmap: Pick idle CPU for direct dispatch on !wakeup enqueues sched_ext: Build fix on !CONFIG_STACKTRACE[_SUPPORT] sched_ext: Allow p->scx.disallow only while loading sched_ext: Simplify scx_can_stop_tick() invocation in sched_can_stop_tick() sched_ext: Add scx_enabled() test to @start_class promotion in put_prev_task_balance() sched_ext: Use update_curr_common() in update_curr_scx() sched_ext: Simplify UP support by enabling sched_class->balance() in UP sched_ext: Improve comment on idle_sched_class exception in scx_task_iter_next_locked() sched_ext: Make task_can_run_on_remote_rq() use common task_allowed_on_cpu() sched_ext: Fix unsafe list iteration in process_ddsp_deferred_locals() sched_ext: Make scx_rq_online() also test cpu_active() in addition to SCX_RQ_ONLINE sched_ext: Improve logging around enable/disable sched_ext: Don't use double locking to migrate tasks across CPUs scx_central: Fix smatch checker warning sched_ext: Add missing cfi stub for ops.tick sched_ext: Use task_can_run_on_remote_rq() test in dispatch_to_local_dsq() sched_ext: Use sched_clock_cpu() instead of rq_clock_task() in touch_core_sched() sched_ext: Don't call put_prev_task_scx() before picking the next task sched_ext: Replace SCX_TASK_BAL_KEEP with SCX_RQ_BAL_KEEP sched_ext: Unify regular and core-sched pick task paths sched_ext: Relocate functions in kernel/sched/ext.c sched_ext: Remove switch_class_scx() sched_ext: Remove sched_class->switch_class() sched_ext: TASK_DEAD tasks must be switched out of SCX on ops_disable sched_ext: TASK_DEAD tasks must be switched into SCX on ops_enable sched: Expose css_tg() sched: Make cpu_shares_read_u64() use tg_weight() sched: Introduce CONFIG_GROUP_SCHED_WEIGHT sched_ext: Add cgroup support sched_ext: Add a cgroup scheduler which uses flattened hierarchy sched_ext: Temporarily work around pick_task_scx() being called without balance_scx() sched_ext: Add missing static to scx_has_op[] sched_ext: Add missing static to scx_dump_data sched_ext: Rename scx_kfunc_set_sleepable to unlocked and relocate sched_ext: Refactor consume_remote_task() sched_ext: Make find_dsq_for_dispatch() handle SCX_DSQ_LOCAL_ON sched_ext: Fix processs_ddsp_deferred_locals() by unifying DTL_INVALID handling sched_ext: Restructure dispatch_to_local_dsq() sched_ext: Reorder args for consume_local/remote_task() sched_ext: Move sanity check and dsq_mod_nr() into task_unlink_from_dsq() sched_ext: Move consume_local_task() upward sched_ext: Replace consume_local_task() with move_local_task_to_local_dsq() sched_ext: Compact struct bpf_iter_scx_dsq_kern sched_ext: Implement scx_bpf_dispatch[_vtime]_from_dsq() scx_qmap: Implement highpri boosting sched_ext: Synchronize bypass state changes with rq lock sched_ext: Don't trigger ops.quiescent/runnable() on migrations sched_ext: Fix build when !CONFIG_STACKTRACE sched_ext: Build fix for !CONFIG_SMP sched_ext: Add __COMPAT helpers for features added during v6.12 devel cycle tools/sched_ext: Receive misc updates from SCX repo scx_flatcg: Use a user DSQ for fallback instead of SCX_DSQ_GLOBAL sched_ext: Allow only user DSQs for scx_bpf_consume(), scx_bpf_dsq_nr_queued() and bpf_iter_scx_dsq_new() sched_ext: Relocate find_user_dsq() sched_ext: Split the global DSQ per NUMA node sched_ext: Use shorter slice while bypassing sched_ext: Relocate check_hotplug_seq() call in scx_ops_enable() sched_ext: Remove SCX_OPS_PREPPING sched_ext: Initialize in bypass mode sched_ext: Fix SCX_TASK_INIT -> SCX_TASK_READY transitions in scx_ops_enable() sched_ext: Enable scx_ops_init_task() separately sched_ext: Add scx_cgroup_enabled to gate cgroup operations and fix scx_tg_online() sched_ext: Decouple locks in scx_ops_disable_workfn() sched_ext: Decouple locks in scx_ops_enable() sched_ext: Improve error reporting during loading sched_ext: scx_cgroup_exit() may be called without successful scx_cgroup_init() sched/core: Make select_task_rq() take the pointer to wake_flags instead of value sched/core: Add ENQUEUE_RQ_SELECTED to indicate whether ->select_task_rq() was called sched_ext, scx_qmap: Add and use SCX_ENQ_CPU_SELECTED Revert "sched_ext: Use shorter slice while bypassing" sched_ext: Start schedulers with consistent p->scx.slice values sched_ext: Move scx_buildin_idle_enabled check to scx_bpf_select_cpu_dfl() sched_ext: bypass mode shouldn't depend on ops.select_cpu() sched_ext: Move scx_tasks_lock handling into scx_task_iter helpers sched_ext: Don't hold scx_tasks_lock for too long sched_ext: Make cast_mask() inline sched_ext: Fix enq_last_no_enq_fails selftest sched_ext: Add a missing newline at the end of an error message sched_ext: Update scx_show_state.py to match scx_ops_bypass_depth's new type sched_ext: Handle cases where pick_task_scx() is called without preceding balance_scx() sched_ext: ops.cpu_acquire() should be called with SCX_KF_REST sched_ext: Factor out move_task_between_dsqs() from scx_dispatch_from_dsq() sched_ext: Rename CFI stubs to names that are recognized by BPF sched_ext: Replace set_arg_maybe_null() with __nullable CFI stub tags sched_ext: Avoid live-locking bypass mode switching sched_ext: Enable the ops breather and eject BPF scheduler on softlockup sched_ext: scx_bpf_dispatch_from_dsq_set_*() are allowed from unlocked context sched_ext: Rename scx_bpf_dispatch[_vtime]() to scx_bpf_dsq_insert[_vtime]() sched_ext: Rename scx_bpf_consume() to scx_bpf_dsq_move_to_local() sched_ext: Rename scx_bpf_dispatch[_vtime]_from_dsq*() -> scx_bpf_dsq_move[_vtime]*() sched_ext: Fix invalid irq restore in scx_ops_bypass() sched_ext: Fix dsq_local_on selftest tools/sched_ext: Receive updates from SCX repo sched_ext: selftests/dsp_local_on: Fix sporadic failures sched_ext: Fix incorrect autogroup migration detection sched_ext: Implement auto local dispatching of migration disabled tasks sched_ext: Fix migration disabled handling in targeted dispatches sched_ext: Fix incorrect assumption about migration disabled tasks in task_can_run_on_remote_rq() sched_ext: Fix pick_task_scx() picking non-queued tasks when it's called without balance() sched_ext: Implement SCX_OPS_ALLOW_QUEUED_WAKEUP sched_ext: bpf_iter_scx_dsq_new() should always initialize iterator sched_ext: Make scx_group_set_weight() always update tg->scx.weight sched_ext, sched/core: Don't call scx_group_set_weight() prematurely from sched_create_group() sched_ext: Mark scx_bpf_dsq_move_set_[slice|vtime]() with KF_RCU sched_ext: Don't kick CPUs running higher classes sched_ext: Use SCX_TASK_READY test instead of tryget_task_struct() during class switch tools/sched_ext: Sync with scx repo Thomas Gleixner (1): sched/ext: Remove sched_fork() hack Thorsten Blum (1): sched_ext: Use str_enabled_disabled() helper in update_selcpu_topology() Tianchen Ding (1): sched_ext: Use btf_ids to resolve task_struct Tony Ambardar (1): libbpf: Ensure new BTF objects inherit input endianness Vincent Guittot (2): sched/cpufreq: Rework schedutil governor performance estimation sched/fair: Fix sched_can_stop_tick() for fair tasks Vishal Chourasia (2): sched_ext: Add __weak markers to BPF helper function decalarations sched_ext: Fix function pointer type mismatches in BPF selftests Wenyu Huang (1): sched/doc: Update documentation after renames and synchronize Chinese version Yafang Shao (2): bpf: Add bits iterator selftests/bpf: Add selftest for bits iter Yipeng Zou (1): sched_ext: Allow dequeue_task_scx to fail Yiwei Lin (1): sched/fair: Remove unused 'curr' argument from pick_next_entity() Yu Liao (2): sched: Put task_group::idle under CONFIG_GROUP_SCHED_WEIGHT sched: Add dummy version of sched_group_set_idle() Yury Norov (1): cpumask: introduce assign_cpu() macro Zhang Qiao (3): sched_ext: Remove redundant p->nr_cpus_allowed checker sched/ext: Fix unmatch trailing comment of CONFIG_EXT_GROUP_SCHED sched/ext: Use tg_cgroup() to elieminate duplicate code Zhao Mengmeng (1): sched_ext: Replace scx_next_task_picked() with switch_class() in comment Zicheng Qu (17): sched: Fix kabi for reweight_task in struct sched_class sched/syscalls: Fix kabi for EXPORT_SYMBOL moved from core.c to syscalls.c sched: Fix kabi for switching_to in struct sched_class sched/fair: Fix kabi for check_preempt_curr and wakeup_preempt in struct sched_class sched: Fix kabi for dequeue_task in struct sched_class sched_ext: Fix kabi for scx in struct task_struct sched_ext: Fix kabi for switch_class in struct sched_class sched: Fix kabi for exec_max in struct sched_statistics sched_ext: Fix kabi for balance in struct sched_class sched_ext: Fix kabi for header in kernel/sched/sched.h sched: Fix kabi pick_task in struct sched_class sched: Fix kabi for put_prev_task in struct sched_class sched_ext: Fix kabi for scx_flags and scx_weight in struct task_group sched: Fix kabi for int idle in struct task_group sched: Add __setscheduler_class() for sched_ext genirq: Fix kabi for kstat_irqs in struct irq_desc sched_ext: Enable and disable sched_ext configs Zqiang (1): sched_ext: Fix unsafe locking in the scx_dump_state() guanjing (1): sched_ext: fix application of sizeof to pointer Documentation/bpf/bpf_iterators.rst | 2 +- Documentation/bpf/kfuncs.rst | 14 +- Documentation/scheduler/index.rst | 1 + Documentation/scheduler/sched-design-CFS.rst | 8 +- Documentation/scheduler/sched-ext.rst | 325 + .../zh_CN/scheduler/sched-design-CFS.rst | 8 +- MAINTAINERS | 16 +- Makefile | 4 +- arch/arm64/configs/openeuler_defconfig | 3 + arch/arm64/kernel/bpf-rvi.c | 4 +- arch/arm64/net/bpf_jit_comp.c | 55 +- arch/mips/dec/setup.c | 2 +- arch/parisc/kernel/smp.c | 2 +- arch/powerpc/kvm/book3s_hv_rm_xics.c | 2 +- arch/riscv/include/asm/cfi.h | 3 +- arch/riscv/kernel/cfi.c | 2 +- arch/riscv/net/bpf_jit_comp64.c | 48 +- arch/s390/net/bpf_jit_comp.c | 59 +- arch/x86/configs/openeuler_defconfig | 2 + arch/x86/include/asm/cfi.h | 126 +- arch/x86/kernel/alternative.c | 87 +- arch/x86/kernel/cfi.c | 4 +- arch/x86/net/bpf_jit_comp.c | 261 +- block/blk-cgroup.c | 4 +- drivers/hid/bpf/hid_bpf_dispatch.c | 12 +- drivers/tty/sysrq.c | 1 + fs/proc/stat.c | 4 +- include/asm-generic/Kbuild | 1 + include/asm-generic/cfi.h | 5 + include/asm-generic/vmlinux.lds.h | 1 + include/linux/bitops.h | 2 + include/linux/bpf.h | 130 +- include/linux/bpf_mem_alloc.h | 3 + include/linux/bpf_verifier.h | 21 +- include/linux/btf.h | 105 + include/linux/btf_ids.h | 21 +- include/linux/cfi.h | 12 + include/linux/cgroup.h | 14 +- include/linux/cleanup.h | 42 +- include/linux/cpumask.h | 41 +- include/linux/energy_model.h | 1 - include/linux/file.h | 20 + include/linux/filter.h | 2 +- include/linux/irqdesc.h | 17 +- include/linux/kernel_stat.h | 8 + include/linux/module.h | 8 +- include/linux/sched.h | 8 +- include/linux/sched/ext.h | 216 + include/linux/sched/task.h | 8 +- include/trace/events/sched_ext.h | 32 + include/uapi/linux/bpf.h | 16 +- include/uapi/linux/sched.h | 1 + init/Kconfig | 10 + init/init_task.c | 12 + kernel/Kconfig.preempt | 27 +- kernel/bpf-rvi/common_kfuncs.c | 4 +- kernel/bpf/Makefile | 8 +- kernel/bpf/bpf_iter.c | 12 +- kernel/bpf/bpf_struct_ops.c | 745 +- kernel/bpf/bpf_struct_ops_types.h | 12 - kernel/bpf/btf.c | 431 +- kernel/bpf/cgroup_iter.c | 65 +- kernel/bpf/core.c | 76 +- kernel/bpf/cpumask.c | 18 +- kernel/bpf/dispatcher.c | 7 +- kernel/bpf/helpers.c | 202 +- kernel/bpf/map_iter.c | 10 +- kernel/bpf/memalloc.c | 14 +- kernel/bpf/syscall.c | 12 +- kernel/bpf/task_iter.c | 242 +- kernel/bpf/trampoline.c | 99 +- kernel/bpf/verifier.c | 317 +- kernel/cgroup/cgroup.c | 18 +- kernel/cgroup/cpuset.c | 4 +- kernel/cgroup/rstat.c | 13 +- kernel/events/core.c | 2 +- kernel/fork.c | 17 +- kernel/irq/Kconfig | 4 + kernel/irq/internals.h | 2 +- kernel/irq/irqdesc.c | 144 +- kernel/irq/proc.c | 5 +- kernel/module/main.c | 5 +- kernel/sched/autogroup.c | 4 +- kernel/sched/bpf_sched.c | 8 +- kernel/sched/build_policy.c | 13 + kernel/sched/core.c | 2492 +----- kernel/sched/cpuacct.c | 4 +- kernel/sched/cpufreq_schedutil.c | 83 +- kernel/sched/deadline.c | 175 +- kernel/sched/debug.c | 3 + kernel/sched/ext.c | 7155 +++++++++++++++++ kernel/sched/ext.h | 119 + kernel/sched/ext_idle.c | 755 ++ kernel/sched/ext_idle.h | 39 + kernel/sched/fair.c | 306 +- kernel/sched/idle.c | 31 +- kernel/sched/rt.c | 40 +- kernel/sched/sched.h | 473 +- kernel/sched/stop_task.c | 35 +- kernel/sched/syscalls.c | 1713 ++++ kernel/trace/bpf_trace.c | 12 +- kernel/trace/trace_probe.c | 2 - kernel/watchdog.c | 223 +- lib/Kconfig.debug | 14 + lib/dump_stack.c | 1 + lib/rhashtable.c | 12 +- net/bpf/bpf_dummy_struct_ops.c | 72 +- net/bpf/test_run.c | 30 +- net/core/filter.c | 33 +- net/core/xdp.c | 10 +- net/ipv4/bpf_tcp_ca.c | 93 +- net/ipv4/fou_bpf.c | 10 +- net/ipv4/tcp_bbr.c | 4 +- net/ipv4/tcp_cong.c | 6 +- net/ipv4/tcp_cubic.c | 4 +- net/ipv4/tcp_dctcp.c | 4 +- net/netfilter/nf_conntrack_bpf.c | 10 +- net/netfilter/nf_nat_bpf.c | 10 +- net/socket.c | 8 +- net/xfrm/xfrm_interface_bpf.c | 10 +- scripts/Makefile.btf | 33 + scripts/Makefile.modfinal | 2 +- scripts/gdb/linux/interrupts.py | 6 +- scripts/pahole-flags.sh | 30 - tools/Makefile | 10 +- .../bpf/bpftool/Documentation/bpftool-gen.rst | 58 +- tools/bpf/bpftool/gen.c | 253 +- tools/bpf/resolve_btfids/main.c | 8 + tools/include/linux/bitops.h | 2 + tools/include/uapi/linux/bpf.h | 14 +- tools/include/uapi/linux/sched.h | 1 + tools/lib/bpf/Build | 2 +- tools/lib/bpf/bpf.c | 4 +- tools/lib/bpf/bpf.h | 4 +- tools/lib/bpf/btf.c | 704 +- tools/lib/bpf/btf.h | 36 + tools/lib/bpf/btf_iter.c | 177 + tools/lib/bpf/btf_relocate.c | 519 ++ tools/lib/bpf/libbpf.c | 97 +- tools/lib/bpf/libbpf.map | 4 +- tools/lib/bpf/libbpf_internal.h | 29 +- tools/lib/bpf/libbpf_probes.c | 1 + tools/lib/bpf/linker.c | 58 +- tools/perf/util/probe-finder.c | 4 +- tools/sched_ext/.gitignore | 2 + tools/sched_ext/Makefile | 246 + tools/sched_ext/README.md | 270 + .../sched_ext/include/bpf-compat/gnu/stubs.h | 11 + tools/sched_ext/include/scx/common.bpf.h | 647 ++ tools/sched_ext/include/scx/common.h | 81 + tools/sched_ext/include/scx/compat.bpf.h | 143 + tools/sched_ext/include/scx/compat.h | 187 + .../sched_ext/include/scx/enums.autogen.bpf.h | 105 + tools/sched_ext/include/scx/enums.autogen.h | 41 + tools/sched_ext/include/scx/enums.bpf.h | 12 + tools/sched_ext/include/scx/enums.h | 27 + tools/sched_ext/include/scx/user_exit_info.h | 118 + tools/sched_ext/scx_central.bpf.c | 356 + tools/sched_ext/scx_central.c | 145 + tools/sched_ext/scx_flatcg.bpf.c | 954 +++ tools/sched_ext/scx_flatcg.c | 234 + tools/sched_ext/scx_flatcg.h | 51 + tools/sched_ext/scx_qmap.bpf.c | 827 ++ tools/sched_ext/scx_qmap.c | 155 + tools/sched_ext/scx_show_state.py | 42 + tools/sched_ext/scx_simple.bpf.c | 151 + tools/sched_ext/scx_simple.c | 107 + tools/testing/selftests/Makefile | 9 +- tools/testing/selftests/bpf/.gitignore | 1 + .../testing/selftests/bpf/bpf_experimental.h | 96 + .../selftests/bpf/bpf_testmod/bpf_testmod.c | 160 +- .../selftests/bpf/bpf_testmod/bpf_testmod.h | 61 + .../bpf/bpf_testmod/bpf_testmod_kfunc.h | 9 + .../selftests/bpf/prog_tests/bpf_iter.c | 44 +- .../selftests/bpf/prog_tests/btf_distill.c | 692 ++ .../selftests/bpf/prog_tests/cgroup_iter.c | 33 + .../bpf/prog_tests/global_func_dead_code.c | 60 + .../testing/selftests/bpf/prog_tests/iters.c | 209 + .../selftests/bpf/prog_tests/kfunc_call.c | 1 + .../selftests/bpf/prog_tests/rcu_read_lock.c | 6 + .../selftests/bpf/prog_tests/spin_lock.c | 2 + .../prog_tests/test_struct_ops_maybe_null.c | 46 + .../bpf/prog_tests/test_struct_ops_module.c | 86 + .../prog_tests/test_struct_ops_multi_pages.c | 30 + .../testing/selftests/bpf/prog_tests/timer.c | 4 + .../selftests/bpf/prog_tests/verifier.c | 4 + ...f_iter_task_vma.c => bpf_iter_task_vmas.c} | 0 .../{bpf_iter_task.c => bpf_iter_tasks.c} | 0 .../bpf/progs/freplace_dead_global_func.c | 11 + tools/testing/selftests/bpf/progs/iters_css.c | 72 + .../selftests/bpf/progs/iters_css_task.c | 102 + .../testing/selftests/bpf/progs/iters_task.c | 41 + .../selftests/bpf/progs/iters_task_failure.c | 105 + .../selftests/bpf/progs/iters_task_vma.c | 43 + .../selftests/bpf/progs/iters_testmod_seq.c | 50 + .../selftests/bpf/progs/kfunc_call_test.c | 37 + .../selftests/bpf/progs/rcu_read_lock.c | 120 + .../bpf/progs/struct_ops_maybe_null.c | 29 + .../bpf/progs/struct_ops_maybe_null_fail.c | 24 + .../selftests/bpf/progs/struct_ops_module.c | 37 + .../bpf/progs/struct_ops_multi_pages.c | 102 + .../selftests/bpf/progs/test_global_func12.c | 4 +- .../selftests/bpf/progs/test_spin_lock.c | 65 + .../selftests/bpf/progs/test_spin_lock_fail.c | 44 + tools/testing/selftests/bpf/progs/timer.c | 63 +- .../selftests/bpf/progs/verifier_bits_iter.c | 232 + .../bpf/progs/verifier_global_subprogs.c | 101 + .../selftests/bpf/progs/verifier_spin_lock.c | 2 +- .../bpf/progs/verifier_subprog_precision.c | 4 +- tools/testing/selftests/bpf/test_loader.c | 10 +- tools/testing/selftests/bpf/test_maps.c | 18 +- tools/testing/selftests/bpf/test_maps.h | 5 + tools/testing/selftests/sched_ext/.gitignore | 6 + tools/testing/selftests/sched_ext/Makefile | 211 + tools/testing/selftests/sched_ext/config | 9 + .../selftests/sched_ext/create_dsq.bpf.c | 58 + .../testing/selftests/sched_ext/create_dsq.c | 57 + .../sched_ext/ddsp_bogus_dsq_fail.bpf.c | 42 + .../selftests/sched_ext/ddsp_bogus_dsq_fail.c | 60 + .../sched_ext/ddsp_vtimelocal_fail.bpf.c | 39 + .../sched_ext/ddsp_vtimelocal_fail.c | 59 + .../selftests/sched_ext/dsp_local_on.bpf.c | 68 + .../selftests/sched_ext/dsp_local_on.c | 60 + .../sched_ext/enq_last_no_enq_fails.bpf.c | 29 + .../sched_ext/enq_last_no_enq_fails.c | 64 + .../sched_ext/enq_select_cpu_fails.bpf.c | 43 + .../sched_ext/enq_select_cpu_fails.c | 61 + tools/testing/selftests/sched_ext/exit.bpf.c | 86 + tools/testing/selftests/sched_ext/exit.c | 64 + tools/testing/selftests/sched_ext/exit_test.h | 20 + .../testing/selftests/sched_ext/hotplug.bpf.c | 61 + tools/testing/selftests/sched_ext/hotplug.c | 170 + .../selftests/sched_ext/hotplug_test.h | 15 + .../sched_ext/init_enable_count.bpf.c | 53 + .../selftests/sched_ext/init_enable_count.c | 157 + .../testing/selftests/sched_ext/maximal.bpf.c | 166 + tools/testing/selftests/sched_ext/maximal.c | 54 + .../selftests/sched_ext/maybe_null.bpf.c | 36 + .../testing/selftests/sched_ext/maybe_null.c | 49 + .../sched_ext/maybe_null_fail_dsp.bpf.c | 25 + .../sched_ext/maybe_null_fail_yld.bpf.c | 28 + .../testing/selftests/sched_ext/minimal.bpf.c | 21 + tools/testing/selftests/sched_ext/minimal.c | 58 + .../selftests/sched_ext/prog_run.bpf.c | 33 + tools/testing/selftests/sched_ext/prog_run.c | 78 + .../testing/selftests/sched_ext/reload_loop.c | 74 + tools/testing/selftests/sched_ext/runner.c | 212 + tools/testing/selftests/sched_ext/scx_test.h | 131 + .../selftests/sched_ext/select_cpu_dfl.bpf.c | 40 + .../selftests/sched_ext/select_cpu_dfl.c | 75 + .../sched_ext/select_cpu_dfl_nodispatch.bpf.c | 89 + .../sched_ext/select_cpu_dfl_nodispatch.c | 75 + .../sched_ext/select_cpu_dispatch.bpf.c | 41 + .../selftests/sched_ext/select_cpu_dispatch.c | 73 + .../select_cpu_dispatch_bad_dsq.bpf.c | 37 + .../sched_ext/select_cpu_dispatch_bad_dsq.c | 59 + .../select_cpu_dispatch_dbl_dsp.bpf.c | 38 + .../sched_ext/select_cpu_dispatch_dbl_dsp.c | 59 + .../sched_ext/select_cpu_vtime.bpf.c | 92 + .../selftests/sched_ext/select_cpu_vtime.c | 62 + .../selftests/sched_ext/test_example.c | 49 + tools/testing/selftests/sched_ext/util.c | 71 + tools/testing/selftests/sched_ext/util.h | 13 + 263 files changed, 27732 insertions(+), 3787 deletions(-) create mode 100644 Documentation/scheduler/sched-ext.rst create mode 100644 include/asm-generic/cfi.h create mode 100644 include/linux/sched/ext.h create mode 100644 include/trace/events/sched_ext.h delete mode 100644 kernel/bpf/bpf_struct_ops_types.h create mode 100644 kernel/sched/ext.c create mode 100644 kernel/sched/ext.h create mode 100644 kernel/sched/ext_idle.c create mode 100644 kernel/sched/ext_idle.h create mode 100644 kernel/sched/syscalls.c create mode 100644 scripts/Makefile.btf delete mode 100755 scripts/pahole-flags.sh create mode 100644 tools/lib/bpf/btf_iter.c create mode 100644 tools/lib/bpf/btf_relocate.c create mode 100644 tools/sched_ext/.gitignore create mode 100644 tools/sched_ext/Makefile create mode 100644 tools/sched_ext/README.md create mode 100644 tools/sched_ext/include/bpf-compat/gnu/stubs.h create mode 100644 tools/sched_ext/include/scx/common.bpf.h create mode 100644 tools/sched_ext/include/scx/common.h create mode 100644 tools/sched_ext/include/scx/compat.bpf.h create mode 100644 tools/sched_ext/include/scx/compat.h create mode 100644 tools/sched_ext/include/scx/enums.autogen.bpf.h create mode 100644 tools/sched_ext/include/scx/enums.autogen.h create mode 100644 tools/sched_ext/include/scx/enums.bpf.h create mode 100644 tools/sched_ext/include/scx/enums.h create mode 100644 tools/sched_ext/include/scx/user_exit_info.h create mode 100644 tools/sched_ext/scx_central.bpf.c create mode 100644 tools/sched_ext/scx_central.c create mode 100644 tools/sched_ext/scx_flatcg.bpf.c create mode 100644 tools/sched_ext/scx_flatcg.c create mode 100644 tools/sched_ext/scx_flatcg.h create mode 100644 tools/sched_ext/scx_qmap.bpf.c create mode 100644 tools/sched_ext/scx_qmap.c create mode 100644 tools/sched_ext/scx_show_state.py create mode 100644 tools/sched_ext/scx_simple.bpf.c create mode 100644 tools/sched_ext/scx_simple.c create mode 100644 tools/testing/selftests/bpf/prog_tests/btf_distill.c create mode 100644 tools/testing/selftests/bpf/prog_tests/global_func_dead_code.c create mode 100644 tools/testing/selftests/bpf/prog_tests/test_struct_ops_maybe_null.c create mode 100644 tools/testing/selftests/bpf/prog_tests/test_struct_ops_module.c create mode 100644 tools/testing/selftests/bpf/prog_tests/test_struct_ops_multi_pages.c rename tools/testing/selftests/bpf/progs/{bpf_iter_task_vma.c => bpf_iter_task_vmas.c} (100%) rename tools/testing/selftests/bpf/progs/{bpf_iter_task.c => bpf_iter_tasks.c} (100%) create mode 100644 tools/testing/selftests/bpf/progs/freplace_dead_global_func.c create mode 100644 tools/testing/selftests/bpf/progs/iters_css.c create mode 100644 tools/testing/selftests/bpf/progs/iters_css_task.c create mode 100644 tools/testing/selftests/bpf/progs/iters_task.c create mode 100644 tools/testing/selftests/bpf/progs/iters_task_failure.c create mode 100644 tools/testing/selftests/bpf/progs/iters_task_vma.c create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_maybe_null.c create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_maybe_null_fail.c create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_module.c create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_multi_pages.c create mode 100644 tools/testing/selftests/bpf/progs/verifier_bits_iter.c create mode 100644 tools/testing/selftests/bpf/progs/verifier_global_subprogs.c create mode 100644 tools/testing/selftests/sched_ext/.gitignore create mode 100644 tools/testing/selftests/sched_ext/Makefile create mode 100644 tools/testing/selftests/sched_ext/config create mode 100644 tools/testing/selftests/sched_ext/create_dsq.bpf.c create mode 100644 tools/testing/selftests/sched_ext/create_dsq.c create mode 100644 tools/testing/selftests/sched_ext/ddsp_bogus_dsq_fail.bpf.c create mode 100644 tools/testing/selftests/sched_ext/ddsp_bogus_dsq_fail.c create mode 100644 tools/testing/selftests/sched_ext/ddsp_vtimelocal_fail.bpf.c create mode 100644 tools/testing/selftests/sched_ext/ddsp_vtimelocal_fail.c create mode 100644 tools/testing/selftests/sched_ext/dsp_local_on.bpf.c create mode 100644 tools/testing/selftests/sched_ext/dsp_local_on.c create mode 100644 tools/testing/selftests/sched_ext/enq_last_no_enq_fails.bpf.c create mode 100644 tools/testing/selftests/sched_ext/enq_last_no_enq_fails.c create mode 100644 tools/testing/selftests/sched_ext/enq_select_cpu_fails.bpf.c create mode 100644 tools/testing/selftests/sched_ext/enq_select_cpu_fails.c create mode 100644 tools/testing/selftests/sched_ext/exit.bpf.c create mode 100644 tools/testing/selftests/sched_ext/exit.c create mode 100644 tools/testing/selftests/sched_ext/exit_test.h create mode 100644 tools/testing/selftests/sched_ext/hotplug.bpf.c create mode 100644 tools/testing/selftests/sched_ext/hotplug.c create mode 100644 tools/testing/selftests/sched_ext/hotplug_test.h create mode 100644 tools/testing/selftests/sched_ext/init_enable_count.bpf.c create mode 100644 tools/testing/selftests/sched_ext/init_enable_count.c create mode 100644 tools/testing/selftests/sched_ext/maximal.bpf.c create mode 100644 tools/testing/selftests/sched_ext/maximal.c create mode 100644 tools/testing/selftests/sched_ext/maybe_null.bpf.c create mode 100644 tools/testing/selftests/sched_ext/maybe_null.c create mode 100644 tools/testing/selftests/sched_ext/maybe_null_fail_dsp.bpf.c create mode 100644 tools/testing/selftests/sched_ext/maybe_null_fail_yld.bpf.c create mode 100644 tools/testing/selftests/sched_ext/minimal.bpf.c create mode 100644 tools/testing/selftests/sched_ext/minimal.c create mode 100644 tools/testing/selftests/sched_ext/prog_run.bpf.c create mode 100644 tools/testing/selftests/sched_ext/prog_run.c create mode 100644 tools/testing/selftests/sched_ext/reload_loop.c create mode 100644 tools/testing/selftests/sched_ext/runner.c create mode 100644 tools/testing/selftests/sched_ext/scx_test.h create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dfl.bpf.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dfl.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dfl_nodispatch.bpf.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dfl_nodispatch.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dispatch.bpf.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dispatch.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dispatch_bad_dsq.bpf.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dispatch_bad_dsq.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dispatch_dbl_dsp.bpf.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dispatch_dbl_dsp.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_vtime.bpf.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_vtime.c create mode 100644 tools/testing/selftests/sched_ext/test_example.c create mode 100644 tools/testing/selftests/sched_ext/util.c create mode 100644 tools/testing/selftests/sched_ext/util.h -- 2.34.1

2 452

[PATCH OLK-6.6] wifi: libertas: fix use-after-free in lbs_free_adapter()
by Wupeng Ma 03 Apr '26

03 Apr '26

From: Daniel Hodges <git(a)danielhodges.dev> stable inclusion from stable-v6.6.130 commit 3c5c818c78b03a1725f3dcd566865c77b48dd3a6 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13984 CVE: CVE-2026-23281 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 03cc8f90d0537fcd4985c3319b4fafbf2e3fb1f0 ] The lbs_free_adapter() function uses timer_delete() (non-synchronous) for both command_timer and tx_lockup_timer before the structure is freed. This is incorrect because timer_delete() does not wait for any running timer callback to complete. If a timer callback is executing when lbs_free_adapter() is called, the callback will access freed memory since lbs_cfg_free() frees the containing structure immediately after lbs_free_adapter() returns. Both timer callbacks (lbs_cmd_timeout_handler and lbs_tx_lockup_handler) access priv->driver_lock, priv->cur_cmd, priv->dev, and other fields, which would all be use-after-free violations. Use timer_delete_sync() instead to ensure any running timer callback has completed before returning. This bug was introduced in commit 8f641d93c38a ("libertas: detect TX lockups and reset hardware") where del_timer() was used instead of del_timer_sync() in the cleanup path. The command_timer has had the same issue since the driver was first written. Fixes: 8f641d93c38a ("libertas: detect TX lockups and reset hardware") Fixes: 954ee164f4f4 ("[PATCH] libertas: reorganize and simplify init sequence") Cc: stable(a)vger.kernel.org Signed-off-by: Daniel Hodges <git(a)danielhodges.dev> Link: https://patch.msgid.link/20260206195356.15647-1-git@danielhodges.dev Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> [ del_timer() => timer_delete_sync() ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- drivers/net/wireless/marvell/libertas/main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/marvell/libertas/main.c b/drivers/net/wireless/marvell/libertas/main.c index 78e8b5aecec0e..91b9501c6d8cb 100644 --- a/drivers/net/wireless/marvell/libertas/main.c +++ b/drivers/net/wireless/marvell/libertas/main.c @@ -881,8 +881,8 @@ static void lbs_free_adapter(struct lbs_private *priv) { lbs_free_cmd_buffer(priv); kfifo_free(&priv->event_fifo); - del_timer(&priv->command_timer); - del_timer(&priv->tx_lockup_timer); + timer_delete_sync(&priv->command_timer); + timer_delete_sync(&priv->tx_lockup_timer); del_timer(&priv->auto_deepsleep_timer); } -- 2.43.0

2 1

[PATCH OLK-6.6 0/2] ip6_tunnel: fix skb_vlan_inet_prepare() return value handling regression
by Li Xiasong 03 Apr '26

03 Apr '26

This patchset contains a backport of the upstream change that introduced the issue, followed by the fix. Patch 1 is a backport of upstream commit f478b8239d65 ("net: tunnel: make skb_vlan_inet_prepare() return drop reasons") which changed the return value semantics of skb_vlan_inet_prepare(). Patch 2 adapts the return value handling in __ip6_tnl_rcv() to match the new semantics, fixing the regression. Including the upstream change as patch 1 ensures that applying both patches together does not introduce the issue that would occur if only patch 1 were merged. Li Xiasong (1): ip6_tunnel: adapt to skb_vlan_inet_prepare() return value change Menglong Dong (1): net: tunnel: make skb_vlan_inet_prepare() return drop reasons drivers/net/bareudp.c | 4 ++-- drivers/net/geneve.c | 4 ++-- include/net/ip_tunnels.h | 13 ++++++++----- net/ipv6/ip6_tunnel.c | 2 +- 4 files changed, 13 insertions(+), 10 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] can: usb: etas_es58x: correctly anchor the urb in the read bulk callback
by Wupeng Ma 03 Apr '26

03 Apr '26

From: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> stable inclusion from stable-v6.6.130 commit f6e90c113c92e83fc0963d5e60e16b0e8a268981 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13957 CVE: CVE-2026-23324 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 5eaad4f768266f1f17e01232ffe2ef009f8129b7 upstream. When submitting an urb, that is using the anchor pattern, it needs to be anchored before submitting it otherwise it could be leaked if usb_kill_anchored_urbs() is called. This logic is correctly done elsewhere in the driver, except in the read bulk callback so do that here also. Cc: Vincent Mailhol <mailhol(a)kernel.org> Cc: Marc Kleine-Budde <mkl(a)pengutronix.de> Cc: stable(a)kernel.org Assisted-by: gkh_clanker_2000 Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Reviewed-by: Vincent Mailhol <mailhol(a)kernel.org> Tested-by: Vincent Mailhol <mailhol(a)kernel.org> Link: https://patch.msgid.link/2026022320-poser-stiffly-9d84@gregkh Fixes: 8537257874e9 ("can: etas_es58x: add core support for ETAS ES58X CAN USB interfaces") Signed-off-by: Marc Kleine-Budde <mkl(a)pengutronix.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- drivers/net/can/usb/etas_es58x/es58x_core.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/net/can/usb/etas_es58x/es58x_core.c b/drivers/net/can/usb/etas_es58x/es58x_core.c index bb49a2c0a9a5c..3edf06106f9d3 100644 --- a/drivers/net/can/usb/etas_es58x/es58x_core.c +++ b/drivers/net/can/usb/etas_es58x/es58x_core.c @@ -1461,12 +1461,18 @@ static void es58x_read_bulk_callback(struct urb *urb) } resubmit_urb: + usb_anchor_urb(urb, &es58x_dev->rx_urbs); ret = usb_submit_urb(urb, GFP_ATOMIC); + if (!ret) + return; + + usb_unanchor_urb(urb); + if (ret == -ENODEV) { for (i = 0; i < es58x_dev->num_can_ch; i++) if (es58x_dev->netdev[i]) netif_device_detach(es58x_dev->netdev[i]); - } else if (ret) + } else dev_err_ratelimited(dev, "Failed resubmitting read bulk urb: %pe\n", ERR_PTR(ret)); -- 2.43.0

2 1

[PATCH OLK-6.6 000/451] sched_ext v1
by Zicheng Qu 03 Apr '26

03 Apr '26

Aboorva Devarajan (2): sched_ext: Documentation: Remove mentions of scx_bpf_switch_all sched: Pass correct scheduling policy to __setscheduler_class Alan Maguire (16): kbuild,bpf: Switch to using --btf_features for pahole v1.26 and later kbuild, bpf: Use test-ge check for v1.25-only pahole libbpf: Add btf__distill_base() creating split BTF with distilled base BTF selftests/bpf: Test distilled base, split BTF generation libbpf: Split BTF relocation selftests/bpf: Extend distilled BTF tests to cover BTF relocation resolve_btfids: Handle presence of .BTF.base section libbpf: BTF relocation followup fixing naming, loop logic module, bpf: Store BTF base pointer in struct module libbpf: Split field iter code into its own file kernel libbpf,bpf: Share BTF relocate-related code with kernel kbuild,bpf: Add module-specific pahole flags for distilled base BTF selftests/bpf: Add kfunc_call test for simple dtor in bpf_testmod bpf: fix build when CONFIG_DEBUG_INFO_BTF[_MODULES] is undefined libbpf: Fix error handling in btf__distill_base() libbpf: Fix license for btf_relocate.c Alexander Lobakin (1): bitops: make BYTES_TO_BITS() treewide-available Alexei Starovoitov (2): s390/bpf: Fix indirect trampoline generation bpf: Introduce "volatile compare" macros Andrea Righi (33): sched_ext: fix typo in set_weight() description sched_ext: add CONFIG_DEBUG_INFO_BTF dependency sched_ext: Provide a sysfs enable_seq counter sched_ext: improve WAKE_SYNC behavior for default idle CPU selection sched_ext: Clarify ops.select_cpu() for single-CPU tasks sched_ext: Introduce LLC awareness to the default idle selection policy sched_ext: Introduce NUMA awareness to the default idle selection policy sched_ext: Do not enable LLC/NUMA optimizations when domains overlap sched_ext: Fix incorrect use of bitwise AND MAINTAINERS: add self as reviewer for sched_ext sched_ext: idle: Refresh idle masks during idle-to-idle transitions sched_ext: Use the NUMA scheduling domain for NUMA optimizations sched_ext: idle: use assign_cpu() to update the idle cpumask sched_ext: idle: clarify comments sched_ext: idle: introduce check_builtin_idle_enabled() helper sched_ext: idle: small CPU iteration refactoring sched_ext: update scx_bpf_dsq_insert() doc for SCX_DSQ_LOCAL_ON sched_ext: Include remaining task time slice in error state dump sched_ext: Include task weight in the error state dump selftests/sched_ext: Fix enum resolution tools/sched_ext: Add helper to check task migration state sched_ext: selftests/dsp_local_on: Fix selftest on UP systems sched_ext: Fix lock imbalance in dispatch_to_local_dsq() selftests/sched_ext: Fix exit selftest hang on UP sched_ext: Move built-in idle CPU selection policy to a separate file sched_ext: Track currently locked rq sched_ext: Make scx_locked_rq() inline sched_ext: Fix missing rq lock in scx_bpf_cpuperf_set() sched/ext: Fix invalid task state transitions on class switch sched_ext: Make scx_kf_allowed_if_unlocked() available outside ext.c sched_ext: Remove duplicate BTF_ID_FLAGS definitions sched_ext: Fix rq lock state in hotplug ops sched_ext: Validate prev_cpu in scx_bpf_select_cpu_dfl() Andrii Nakryiko (14): bpf: Emit global subprog name in verifier logs bpf: Validate global subprogs lazily selftests/bpf: Add lazy global subprog validation tests libbpf: Add btf__new_split() API that was declared but not implemented bpf: move sleepable flag from bpf_prog_aux to bpf_prog libbpf: Add BTF field iterator libbpf: Make use of BTF field iterator in BPF linker code libbpf: Make use of BTF field iterator in BTF handling code bpftool: Use BTF field iterator in btfgen libbpf: Remove callback-based type/string BTF field visitor helpers bpf: extract iterator argument type and name validation logic bpf: allow passing struct bpf_iter_<type> as kfunc arguments selftests/bpf: test passing iterator to a kfunc selftests/bpf: validate eliminated global subprog is not freplaceable Arnaldo Carvalho de Melo (1): tools include UAPI: Sync linux/sched.h copy with the kernel sources Atul Kumar Pant (1): sched_ext: Fixes typos in comments Benjamin Tissoires (1): bpf: introduce in_sleepable() helper Bitao Hu (4): genirq: Convert kstat_irqs to a struct genirq: Provide a snapshot mechanism for interrupt statistics watchdog/softlockup: Low-overhead detection of interrupt storm watchdog/softlockup: Report the most frequent interrupts Björn Töpel (1): selftests: sched_ext: Add sched_ext as proper selftest target Breno Leitao (3): rhashtable: Fix potential deadlock by moving schedule_work outside lock sched_ext: Use kvzalloc for large exit_dump allocation sched/ext: Prevent update_locked_rq() calls with NULL rq Changwoo Min (12): sched_ext: Clarify sched_ext_ops table for userland scheduler sched_ext: add a missing rcu_read_lock/unlock pair at scx_select_cpu_dfl() MAINTAINERS: add me as reviewer for sched_ext sched_ext: Replace rq_lock() to raw_spin_rq_lock() in scx_ops_bypass() sched_ext: Relocate scx_enabled() related code sched_ext: Implement scx_bpf_now() sched_ext: Add scx_bpf_now() for BPF scheduler sched_ext: Add time helpers for BPF schedulers sched_ext: Replace bpf_ktime_get_ns() to scx_bpf_now() sched_ext: Use time helpers in BPF schedulers sched_ext: Fix incorrect time delta calculation in time_delta() sched_ext: Add scx_bpf_events() and scx_read_event() for BPF schedulers Cheng-Yang Chou (1): sched_ext: Always use SMP versions in kernel/sched/ext.c Christian Brauner (1): file: add take_fd() cleanup helper Christian Loehle (1): sched/fair: Remove stale FREQUENCY_UTIL comment Christophe Leroy (2): bpf: Remove arch_unprotect_bpf_trampoline() bpf: Check return from set_memory_rox() Chuyi Zhou (15): cgroup: Prepare for using css_task_iter_*() in BPF bpf: Introduce css_task open-coded iterator kfuncs bpf: Introduce task open coded iterator kfuncs bpf: Introduce css open-coded iterator kfuncs bpf: teach the verifier to enforce css_iter and task_iter in RCU CS bpf: Let bpf_iter_task_new accept null task ptr selftests/bpf: rename bpf_iter_task.c to bpf_iter_tasks.c selftests/bpf: Add tests for open-coded task and css iter bpf: Relax allowlist for css_task iter selftests/bpf: Add tests for css_task iter combining with cgroup iter selftests/bpf: Add test for using css_task iter in sleepable progs bpf: Let verifier consider {task,cgroup} is trusted in bpf_iter_reg selftests/bpf: get trusted cgrp from bpf_iter__cgroup directly sched_ext: Fix the incorrect bpf_list kfunc API in common.bpf.h. sched_ext: Use SCX_CALL_OP_TASK in task_tick_scx Colin Ian King (1): sched_ext: Fix spelling mistake: "intead" -> "instead" Daniel Xu (3): bpf: btf: Support flags for BTF_SET8 sets bpf: btf: Add BTF_KFUNCS_START/END macro pair bpf: treewide: Annotate BPF kfuncs in BTF Dave Marchevsky (6): bpf: Don't explicitly emit BTF for struct btf_iter_num selftests/bpf: Rename bpf_iter_task_vma.c to bpf_iter_task_vmas.c bpf: Introduce task_vma open-coded iterator kfuncs selftests/bpf: Add tests for open-coded task_vma iter bpf: Add __bpf_kfunc_{start,end}_defs macros bpf: Add __bpf_hook_{start,end} macros David Vernet (15): bpf: Add ability to pin bpf timer to calling CPU selftests/bpf: Test pinning bpf timer to a core sched_ext: Implement runnable task stall watchdog sched_ext: Print sched_ext info when dumping stack sched_ext: Implement SCX_KICK_WAIT sched_ext: Implement sched_ext_ops.cpu_acquire/release() sched_ext: Add selftests bpf: Load vmlinux btf for any struct_ops map sched_ext: Make scx_bpf_cpuperf_set() @cpu arg signed scx: Allow calling sleepable kfuncs from BPF_PROG_TYPE_SYSCALL scx/selftests: Verify we can call create_dsq from prog_run sched_ext: Remove unnecessary cpu_relax() scx: Fix exit selftest to use custom DSQ scx: Fix raciness in scx_ops_bypass() scx: Fix maximal BPF selftest prog Dawei Li (1): genirq: Deduplicate interrupt descriptor initialization Devaansh Kumar (1): sched_ext: selftests: Fix grammar in tests description Devaansh-Kumar (1): sched_ext: Documentation: Update instructions for running example schedulers Eduard Zingerman (2): libbpf: Make btf_parse_elf process .BTF.base transparently selftests/bpf: Check if distilled base inherits source endianness Geliang Tang (1): bpf, btf: Check btf for register_bpf_struct_ops Henry Huang (2): sched_ext: initialize kit->cursor.flags sched_ext: keep running prev when prev->scx.slice != 0 Herbert Xu (1): rhashtable: Fix rhashtable_try_insert test Honglei Wang (3): sched_ext: use correct function name in pick_task_scx() warning message sched_ext: Add __weak to fix the build errors sched_ext: switch class when preempted by higher priority scheduler Hongyan Xia (1): sched/ext: Add BPF function to fetch rq Hou Tao (7): bpf: Free dynamically allocated bits in bpf_iter_bits_destroy() bpf: Add bpf_mem_alloc_check_size() helper bpf: Check the validity of nr_words in bpf_iter_bits_new() bpf: Use __u64 to save the bits in bits iterator selftests/bpf: Add three test cases for bits_iter selftests/bpf: Use -4095 as the bad address for bits iterator selftests/bpf: Export map_update_retriable() Ihor Solodrai (2): selftests/sched_ext: add order-only dependency of runner.o on BPFOBJ selftests/sched_ext: fix build after renames in sched_ext API Ilpo Järvinen (1): <linux/cleanup.h>: Allow the passing of both iomem and non-iomem pointers to no_free_ptr() Ingo Molnar (3): sched/syscalls: Split out kernel/sched/syscalls.c from kernel/sched/core.c sched/fair: Rename check_preempt_wakeup() to check_preempt_wakeup_fair() sched/fair: Rename check_preempt_curr() to wakeup_preempt() Jake Hillion (2): sched_ext: create_dsq: Return -EEXIST on duplicate request sched_ext: Drop kfuncs marked for removal in 6.15 Jiapeng Chong (1): sched_ext: Fixes incorrect type in bpf_scx_init() Jiayuan Chen (1): selftests/bpf: Fixes for test_maps test Kui-Feng Lee (29): bpf: refactory struct_ops type initialization to a function. bpf: get type information with BTF_ID_LIST bpf, net: introduce bpf_struct_ops_desc. bpf: add struct_ops_tab to btf. bpf: make struct_ops_map support btfs other than btf_vmlinux. bpf: pass btf object id in bpf_map_info. bpf: lookup struct_ops types from a given module BTF. bpf: pass attached BTF to the bpf_struct_ops subsystem bpf: hold module refcnt in bpf_struct_ops map creation and prog verification. bpf: validate value_type bpf, net: switch to dynamic registration libbpf: Find correct module BTFs for struct_ops maps and progs. bpf: export btf_ctx_access to modules. selftests/bpf: test case for register_bpf_struct_ops(). bpf: Fix error checks against bpf_get_btf_vmlinux(). bpf: Remove an unnecessary check. selftests/bpf: Suppress warning message of an unused variable. bpf: add btf pointer to struct bpf_ctx_arg_aux. bpf: Move __kfunc_param_match_suffix() to btf.c. bpf: Create argument information for nullable arguments. selftests/bpf: Test PTR_MAYBE_NULL arguments of struct_ops operators. libbpf: Set btf_value_type_id of struct bpf_map for struct_ops. libbpf: Convert st_ops->data to shadow type. bpftool: Generated shadow variables for struct_ops maps. bpftool: Add an example for struct_ops map and shadow type. selftests/bpf: Test if shadow types work correctly. bpf, net: validate struct_ops when updating value. bpf: struct_ops supports more than one page for trampolines. selftests/bpf: Test struct_ops maps with a large number of struct_ops program. Kumar Kartikeya Dwivedi (4): bpf: Allow calling static subprogs while holding a bpf_spin_lock selftests/bpf: Add test for static subprog call in lock cs bpf: Transfer RCU lock state between subprog calls selftests/bpf: Add tests for RCU lock transfer between subprogs Liang Jie (1): sched_ext: Use sizeof_field for key_len in dsq_hash_params Luo Gengkun (7): bpf: Fix kabi-breakage for bpf_func_info_aux bpf: Fix kabi-breakage for bpf_tramp_image bpf: Fix kabi for bpf_attr bpf_verifier: Fix kabi for bpf_verifier_env bpf: Fix kabi for bpf_ctx_arg_aux bpf: Fix kabi for bpf_prog_aux and bpf_prog selftests/bpf: modify test_loader that didn't support running bpf_prog_type_syscall programs Manu Bretelle (1): sched_ext: define missing cfi stubs for sched_ext Martin KaFai Lau (5): libbpf: Ensure undefined bpf_attr field stays 0 bpf: Remove unnecessary err < 0 check in bpf_struct_ops_map_update_elem bpf: Fix a crash when btf_parse_base() returns an error pointer bpf: Reject struct_ops registration that uses module ptr and the module btf_id is missing bpf: Use kallsyms to find the function name of a struct_ops's stub function Masahiro Yamada (1): kbuild: avoid too many execution of scripts/pahole-flags.sh Matthieu Baerts (1): bpf: fix compilation error without CGROUPS Peter Zijlstra (26): cfi: Flip headers x86/cfi,bpf: Fix BPF JIT call x86/cfi,bpf: Fix bpf_callback_t CFI x86/cfi,bpf: Fix bpf_struct_ops CFI cfi: Add CFI_NOSEAL() bpf: Fix dtor CFI cleanup: Make no_free_ptr() __must_check sched: Simplify set_user_nice() sched: Simplify syscalls sched: Simplify sched_{set,get}affinity() sched: Simplify yield_to() sched: Simplify sched_rr_get_interval() sched: Simplify sched_move_task() sched: Misc cleanups sched/deadline: Move bandwidth accounting into {en,de}queue_dl_entity sched: Allow sched_class::dequeue_task() to fail sched: Unify runtime accounting across classes sched: Use set_next_task(.first) where required sched/fair: Cleanup pick_task_fair() vs throttle sched/fair: Cleanup pick_task_fair()'s curr sched/fair: Unify pick_{,next_}_task_fair() sched: Fixup set_next_task() implementations sched: Split up put_prev_task_balance() sched: Rework pick_next_task() sched: Combine the last put_prev_task() and the first set_next_task() sched: Add put_prev_task(.next) Pu Lehui (8): riscv, bpf: Fix unpredictable kernel crash about RV64 struct_ops bpf: Fix kabi breakage in struct module riscv, bpf: Fix out-of-bounds issue when preparing trampoline image selftests/bpf: Fix btf leak on new btf alloc failure in btf_distill test libbpf: Fix return zero when elf_begin failed libbpf: Fix incorrect traversal end type ID when marking BTF_IS_EMBEDDED selftests/bpf: Add distilled BTF test about marking BTF_IS_EMBEDDED selftests/bpf: Add file_read_pattern to gitignore Randy Dunlap (1): sched_ext: fix kernel-doc warnings Shizhao Chen (1): sched_ext: Add option -l in selftest runner to list all available tests Song Liu (8): bpf: Charge modmem for struct_ops trampoline bpf: Let bpf_prog_pack_free handle any pointer bpf: Adjust argument names of arch_prepare_bpf_trampoline() bpf: Add helpers for trampoline image management bpf, x86: Adjust arch_prepare_bpf_trampoline return value bpf: Add arch_bpf_trampoline_size() bpf: Use arch_bpf_trampoline_size x86, bpf: Use bpf_prog_pack for bpf trampoline T.J. Mercier (1): bpf, docs: Fix broken link to renamed bpf_iter_task_vmas.c Tejun Heo (152): sched: Restructure sched_class order sanity checks in sched_init() sched: Allow sched_cgroup_fork() to fail and introduce sched_cancel_fork() sched: Add sched_class->reweight_task() sched: Add sched_class->switching_to() and expose check_class_changing/changed() sched: Factor out cgroup weight conversion functions sched: Factor out update_other_load_avgs() from __update_blocked_others() sched: Add normal_policy() sched_ext: Add boilerplate for extensible scheduler class sched_ext: Implement BPF extensible scheduler class sched_ext: Add scx_simple and scx_example_qmap example schedulers sched_ext: Add sysrq-S which disables the BPF scheduler sched_ext: Allow BPF schedulers to disallow specific tasks from joining SCHED_EXT sched_ext: Print debug dump after an error exit tools/sched_ext: Add scx_show_state.py sched_ext: Implement scx_bpf_kick_cpu() and task preemption support sched_ext: Add a central scheduler which makes all scheduling decisions on one CPU sched_ext: Make watchdog handle ops.dispatch() looping stall sched_ext: Add task state tracking operations sched_ext: Implement tickless support sched_ext: Track tasks that are subjects of the in-flight SCX operation sched_ext: Implement sched_ext_ops.cpu_online/offline() sched_ext: Bypass BPF scheduler while PM events are in progress sched_ext: Implement core-sched support sched_ext: Add vtime-ordered priority queue to dispatch_q's sched_ext: Documentation: scheduler: Document extensible scheduler class sched, sched_ext: Replace scx_next_task_picked() with sched_class->switch_class() cpufreq_schedutil: Refactor sugov_cpu_is_busy() sched_ext: Add cpuperf support sched_ext: Drop tools_clean target from the top-level Makefile sched_ext: Swap argument positions in kcalloc() call to avoid compiler warning sched, sched_ext: Simplify dl_prio() case handling in sched_fork() sched_ext: Account for idle policy when setting p->scx.weight in scx_ops_enable_task() sched_ext: Disallow loading BPF scheduler if isolcpus= domain isolation is in effect sched_ext: Minor cleanups in kernel/sched/ext.h sched, sched_ext: Open code for_balance_class_range() sched, sched_ext: Move some declarations from kernel/sched/ext.h to sched.h sched_ext: Take out ->priq and ->flags from scx_dsq_node sched_ext: Implement DSQ iterator sched_ext/scx_qmap: Add an example usage of DSQ iterator sched_ext: Reimplement scx_bpf_reenqueue_local() sched_ext: Make scx_bpf_reenqueue_local() skip tasks that are being migrated sched: Move struct balance_callback definition upward sched_ext: Unpin and repin rq lock from balance_scx() sched_ext: s/SCX_RQ_BALANCING/SCX_RQ_IN_BALANCE/ and add SCX_RQ_IN_WAKEUP sched_ext: Allow SCX_DSQ_LOCAL_ON for direct dispatches sched_ext/scx_qmap: Pick idle CPU for direct dispatch on !wakeup enqueues sched_ext: Build fix on !CONFIG_STACKTRACE[_SUPPORT] sched_ext: Allow p->scx.disallow only while loading sched_ext: Simplify scx_can_stop_tick() invocation in sched_can_stop_tick() sched_ext: Add scx_enabled() test to @start_class promotion in put_prev_task_balance() sched_ext: Use update_curr_common() in update_curr_scx() sched_ext: Simplify UP support by enabling sched_class->balance() in UP sched_ext: Improve comment on idle_sched_class exception in scx_task_iter_next_locked() sched_ext: Make task_can_run_on_remote_rq() use common task_allowed_on_cpu() sched_ext: Fix unsafe list iteration in process_ddsp_deferred_locals() sched_ext: Make scx_rq_online() also test cpu_active() in addition to SCX_RQ_ONLINE sched_ext: Improve logging around enable/disable sched_ext: Don't use double locking to migrate tasks across CPUs scx_central: Fix smatch checker warning sched_ext: Add missing cfi stub for ops.tick sched_ext: Use task_can_run_on_remote_rq() test in dispatch_to_local_dsq() sched_ext: Use sched_clock_cpu() instead of rq_clock_task() in touch_core_sched() sched_ext: Don't call put_prev_task_scx() before picking the next task sched_ext: Replace SCX_TASK_BAL_KEEP with SCX_RQ_BAL_KEEP sched_ext: Unify regular and core-sched pick task paths sched_ext: Relocate functions in kernel/sched/ext.c sched_ext: Remove switch_class_scx() sched_ext: Remove sched_class->switch_class() sched_ext: TASK_DEAD tasks must be switched out of SCX on ops_disable sched_ext: TASK_DEAD tasks must be switched into SCX on ops_enable sched: Expose css_tg() sched: Make cpu_shares_read_u64() use tg_weight() sched: Introduce CONFIG_GROUP_SCHED_WEIGHT sched_ext: Add cgroup support sched_ext: Add a cgroup scheduler which uses flattened hierarchy sched_ext: Temporarily work around pick_task_scx() being called without balance_scx() sched_ext: Add missing static to scx_has_op[] sched_ext: Add missing static to scx_dump_data sched_ext: Rename scx_kfunc_set_sleepable to unlocked and relocate sched_ext: Refactor consume_remote_task() sched_ext: Make find_dsq_for_dispatch() handle SCX_DSQ_LOCAL_ON sched_ext: Fix processs_ddsp_deferred_locals() by unifying DTL_INVALID handling sched_ext: Restructure dispatch_to_local_dsq() sched_ext: Reorder args for consume_local/remote_task() sched_ext: Move sanity check and dsq_mod_nr() into task_unlink_from_dsq() sched_ext: Move consume_local_task() upward sched_ext: Replace consume_local_task() with move_local_task_to_local_dsq() sched_ext: Compact struct bpf_iter_scx_dsq_kern sched_ext: Implement scx_bpf_dispatch[_vtime]_from_dsq() scx_qmap: Implement highpri boosting sched_ext: Synchronize bypass state changes with rq lock sched_ext: Don't trigger ops.quiescent/runnable() on migrations sched_ext: Fix build when !CONFIG_STACKTRACE sched_ext: Build fix for !CONFIG_SMP sched_ext: Add __COMPAT helpers for features added during v6.12 devel cycle tools/sched_ext: Receive misc updates from SCX repo scx_flatcg: Use a user DSQ for fallback instead of SCX_DSQ_GLOBAL sched_ext: Allow only user DSQs for scx_bpf_consume(), scx_bpf_dsq_nr_queued() and bpf_iter_scx_dsq_new() sched_ext: Relocate find_user_dsq() sched_ext: Split the global DSQ per NUMA node sched_ext: Use shorter slice while bypassing sched_ext: Relocate check_hotplug_seq() call in scx_ops_enable() sched_ext: Remove SCX_OPS_PREPPING sched_ext: Initialize in bypass mode sched_ext: Fix SCX_TASK_INIT -> SCX_TASK_READY transitions in scx_ops_enable() sched_ext: Enable scx_ops_init_task() separately sched_ext: Add scx_cgroup_enabled to gate cgroup operations and fix scx_tg_online() sched_ext: Decouple locks in scx_ops_disable_workfn() sched_ext: Decouple locks in scx_ops_enable() sched_ext: Improve error reporting during loading sched_ext: scx_cgroup_exit() may be called without successful scx_cgroup_init() sched/core: Make select_task_rq() take the pointer to wake_flags instead of value sched/core: Add ENQUEUE_RQ_SELECTED to indicate whether ->select_task_rq() was called sched_ext, scx_qmap: Add and use SCX_ENQ_CPU_SELECTED Revert "sched_ext: Use shorter slice while bypassing" sched_ext: Start schedulers with consistent p->scx.slice values sched_ext: Move scx_buildin_idle_enabled check to scx_bpf_select_cpu_dfl() sched_ext: bypass mode shouldn't depend on ops.select_cpu() sched_ext: Move scx_tasks_lock handling into scx_task_iter helpers sched_ext: Don't hold scx_tasks_lock for too long sched_ext: Make cast_mask() inline sched_ext: Fix enq_last_no_enq_fails selftest sched_ext: Add a missing newline at the end of an error message sched_ext: Update scx_show_state.py to match scx_ops_bypass_depth's new type sched_ext: Handle cases where pick_task_scx() is called without preceding balance_scx() sched_ext: ops.cpu_acquire() should be called with SCX_KF_REST sched_ext: Factor out move_task_between_dsqs() from scx_dispatch_from_dsq() sched_ext: Rename CFI stubs to names that are recognized by BPF sched_ext: Replace set_arg_maybe_null() with __nullable CFI stub tags sched_ext: Avoid live-locking bypass mode switching sched_ext: Enable the ops breather and eject BPF scheduler on softlockup sched_ext: scx_bpf_dispatch_from_dsq_set_*() are allowed from unlocked context sched_ext: Rename scx_bpf_dispatch[_vtime]() to scx_bpf_dsq_insert[_vtime]() sched_ext: Rename scx_bpf_consume() to scx_bpf_dsq_move_to_local() sched_ext: Rename scx_bpf_dispatch[_vtime]_from_dsq*() -> scx_bpf_dsq_move[_vtime]*() sched_ext: Fix invalid irq restore in scx_ops_bypass() sched_ext: Fix dsq_local_on selftest tools/sched_ext: Receive updates from SCX repo sched_ext: selftests/dsp_local_on: Fix sporadic failures sched_ext: Fix incorrect autogroup migration detection sched_ext: Implement auto local dispatching of migration disabled tasks sched_ext: Fix migration disabled handling in targeted dispatches sched_ext: Fix incorrect assumption about migration disabled tasks in task_can_run_on_remote_rq() sched_ext: Fix pick_task_scx() picking non-queued tasks when it's called without balance() sched_ext: Implement SCX_OPS_ALLOW_QUEUED_WAKEUP sched_ext: bpf_iter_scx_dsq_new() should always initialize iterator sched_ext: Make scx_group_set_weight() always update tg->scx.weight sched_ext, sched/core: Don't call scx_group_set_weight() prematurely from sched_create_group() sched_ext: Mark scx_bpf_dsq_move_set_[slice|vtime]() with KF_RCU sched_ext: Don't kick CPUs running higher classes sched_ext: Use SCX_TASK_READY test instead of tryget_task_struct() during class switch tools/sched_ext: Sync with scx repo Thomas Gleixner (1): sched/ext: Remove sched_fork() hack Thorsten Blum (1): sched_ext: Use str_enabled_disabled() helper in update_selcpu_topology() Tianchen Ding (1): sched_ext: Use btf_ids to resolve task_struct Tony Ambardar (1): libbpf: Ensure new BTF objects inherit input endianness Vincent Guittot (2): sched/cpufreq: Rework schedutil governor performance estimation sched/fair: Fix sched_can_stop_tick() for fair tasks Vishal Chourasia (2): sched_ext: Add __weak markers to BPF helper function decalarations sched_ext: Fix function pointer type mismatches in BPF selftests Wenyu Huang (1): sched/doc: Update documentation after renames and synchronize Chinese version Yafang Shao (2): bpf: Add bits iterator selftests/bpf: Add selftest for bits iter Yipeng Zou (1): sched_ext: Allow dequeue_task_scx to fail Yiwei Lin (1): sched/fair: Remove unused 'curr' argument from pick_next_entity() Yu Liao (2): sched: Put task_group::idle under CONFIG_GROUP_SCHED_WEIGHT sched: Add dummy version of sched_group_set_idle() Yury Norov (1): cpumask: introduce assign_cpu() macro Zhang Qiao (3): sched_ext: Remove redundant p->nr_cpus_allowed checker sched/ext: Fix unmatch trailing comment of CONFIG_EXT_GROUP_SCHED sched/ext: Use tg_cgroup() to elieminate duplicate code Zhao Mengmeng (1): sched_ext: Replace scx_next_task_picked() with switch_class() in comment Zicheng Qu (17): sched: Fix kabi for reweight_task in struct sched_class sched/syscalls: Fix kabi for EXPORT_SYMBOL moved from core.c to syscalls.c sched: Fix kabi for switching_to in struct sched_class sched/fair: Fix kabi for check_preempt_curr and wakeup_preempt in struct sched_class sched: Fix kabi for dequeue_task in struct sched_class sched_ext: Fix kabi for scx in struct task_struct sched_ext: Fix kabi for switch_class in struct sched_class sched: Fix kabi for exec_max in struct sched_statistics sched_ext: Fix kabi for balance in struct sched_class sched_ext: Fix kabi for header in kernel/sched/sched.h sched: Fix kabi pick_task in struct sched_class sched: Fix kabi for put_prev_task in struct sched_class sched_ext: Fix kabi for scx_flags and scx_weight in struct task_group sched: Fix kabi for int idle in struct task_group sched: Add __setscheduler_class() for sched_ext genirq: Fix kabi for kstat_irqs in struct irq_desc sched_ext: Enable and disable sched_ext configs Zqiang (1): sched_ext: Fix unsafe locking in the scx_dump_state() guanjing (1): sched_ext: fix application of sizeof to pointer Documentation/bpf/bpf_iterators.rst | 2 +- Documentation/bpf/kfuncs.rst | 14 +- Documentation/scheduler/index.rst | 1 + Documentation/scheduler/sched-design-CFS.rst | 8 +- Documentation/scheduler/sched-ext.rst | 325 + .../zh_CN/scheduler/sched-design-CFS.rst | 8 +- MAINTAINERS | 16 +- Makefile | 4 +- arch/arm64/configs/openeuler_defconfig | 3 + arch/arm64/kernel/bpf-rvi.c | 4 +- arch/arm64/net/bpf_jit_comp.c | 55 +- arch/mips/dec/setup.c | 2 +- arch/parisc/kernel/smp.c | 2 +- arch/powerpc/kvm/book3s_hv_rm_xics.c | 2 +- arch/riscv/include/asm/cfi.h | 3 +- arch/riscv/kernel/cfi.c | 2 +- arch/riscv/net/bpf_jit_comp64.c | 48 +- arch/s390/net/bpf_jit_comp.c | 59 +- arch/x86/configs/openeuler_defconfig | 2 + arch/x86/include/asm/cfi.h | 126 +- arch/x86/kernel/alternative.c | 87 +- arch/x86/kernel/cfi.c | 4 +- arch/x86/net/bpf_jit_comp.c | 261 +- block/blk-cgroup.c | 4 +- drivers/hid/bpf/hid_bpf_dispatch.c | 12 +- drivers/tty/sysrq.c | 1 + fs/proc/stat.c | 4 +- include/asm-generic/Kbuild | 1 + include/asm-generic/cfi.h | 5 + include/asm-generic/vmlinux.lds.h | 1 + include/linux/bitops.h | 2 + include/linux/bpf.h | 130 +- include/linux/bpf_mem_alloc.h | 3 + include/linux/bpf_verifier.h | 21 +- include/linux/btf.h | 105 + include/linux/btf_ids.h | 21 +- include/linux/cfi.h | 12 + include/linux/cgroup.h | 14 +- include/linux/cleanup.h | 42 +- include/linux/cpumask.h | 41 +- include/linux/energy_model.h | 1 - include/linux/file.h | 20 + include/linux/filter.h | 2 +- include/linux/irqdesc.h | 17 +- include/linux/kernel_stat.h | 8 + include/linux/module.h | 8 +- include/linux/sched.h | 8 +- include/linux/sched/ext.h | 216 + include/linux/sched/task.h | 8 +- include/trace/events/sched_ext.h | 32 + include/uapi/linux/bpf.h | 16 +- include/uapi/linux/sched.h | 1 + init/Kconfig | 10 + init/init_task.c | 12 + kernel/Kconfig.preempt | 27 +- kernel/bpf-rvi/common_kfuncs.c | 4 +- kernel/bpf/Makefile | 8 +- kernel/bpf/bpf_iter.c | 12 +- kernel/bpf/bpf_struct_ops.c | 745 +- kernel/bpf/bpf_struct_ops_types.h | 12 - kernel/bpf/btf.c | 431 +- kernel/bpf/cgroup_iter.c | 65 +- kernel/bpf/core.c | 76 +- kernel/bpf/cpumask.c | 18 +- kernel/bpf/dispatcher.c | 7 +- kernel/bpf/helpers.c | 202 +- kernel/bpf/map_iter.c | 10 +- kernel/bpf/memalloc.c | 14 +- kernel/bpf/syscall.c | 12 +- kernel/bpf/task_iter.c | 242 +- kernel/bpf/trampoline.c | 99 +- kernel/bpf/verifier.c | 317 +- kernel/cgroup/cgroup.c | 18 +- kernel/cgroup/cpuset.c | 4 +- kernel/cgroup/rstat.c | 13 +- kernel/events/core.c | 2 +- kernel/fork.c | 17 +- kernel/irq/Kconfig | 4 + kernel/irq/internals.h | 2 +- kernel/irq/irqdesc.c | 144 +- kernel/irq/proc.c | 5 +- kernel/module/main.c | 5 +- kernel/sched/autogroup.c | 4 +- kernel/sched/bpf_sched.c | 8 +- kernel/sched/build_policy.c | 13 + kernel/sched/core.c | 2492 +----- kernel/sched/cpuacct.c | 4 +- kernel/sched/cpufreq_schedutil.c | 83 +- kernel/sched/deadline.c | 175 +- kernel/sched/debug.c | 3 + kernel/sched/ext.c | 7155 +++++++++++++++++ kernel/sched/ext.h | 119 + kernel/sched/ext_idle.c | 755 ++ kernel/sched/ext_idle.h | 39 + kernel/sched/fair.c | 306 +- kernel/sched/idle.c | 31 +- kernel/sched/rt.c | 40 +- kernel/sched/sched.h | 473 +- kernel/sched/stop_task.c | 35 +- kernel/sched/syscalls.c | 1713 ++++ kernel/trace/bpf_trace.c | 12 +- kernel/trace/trace_probe.c | 2 - kernel/watchdog.c | 223 +- lib/Kconfig.debug | 14 + lib/dump_stack.c | 1 + lib/rhashtable.c | 12 +- net/bpf/bpf_dummy_struct_ops.c | 72 +- net/bpf/test_run.c | 30 +- net/core/filter.c | 33 +- net/core/xdp.c | 10 +- net/ipv4/bpf_tcp_ca.c | 93 +- net/ipv4/fou_bpf.c | 10 +- net/ipv4/tcp_bbr.c | 4 +- net/ipv4/tcp_cong.c | 6 +- net/ipv4/tcp_cubic.c | 4 +- net/ipv4/tcp_dctcp.c | 4 +- net/netfilter/nf_conntrack_bpf.c | 10 +- net/netfilter/nf_nat_bpf.c | 10 +- net/socket.c | 8 +- net/xfrm/xfrm_interface_bpf.c | 10 +- scripts/Makefile.btf | 33 + scripts/Makefile.modfinal | 2 +- scripts/gdb/linux/interrupts.py | 6 +- scripts/pahole-flags.sh | 30 - tools/Makefile | 10 +- .../bpf/bpftool/Documentation/bpftool-gen.rst | 58 +- tools/bpf/bpftool/gen.c | 253 +- tools/bpf/resolve_btfids/main.c | 8 + tools/include/linux/bitops.h | 2 + tools/include/uapi/linux/bpf.h | 14 +- tools/include/uapi/linux/sched.h | 1 + tools/lib/bpf/Build | 2 +- tools/lib/bpf/bpf.c | 4 +- tools/lib/bpf/bpf.h | 4 +- tools/lib/bpf/btf.c | 704 +- tools/lib/bpf/btf.h | 36 + tools/lib/bpf/btf_iter.c | 177 + tools/lib/bpf/btf_relocate.c | 519 ++ tools/lib/bpf/libbpf.c | 97 +- tools/lib/bpf/libbpf.map | 4 +- tools/lib/bpf/libbpf_internal.h | 29 +- tools/lib/bpf/libbpf_probes.c | 1 + tools/lib/bpf/linker.c | 58 +- tools/perf/util/probe-finder.c | 4 +- tools/sched_ext/.gitignore | 2 + tools/sched_ext/Makefile | 246 + tools/sched_ext/README.md | 270 + .../sched_ext/include/bpf-compat/gnu/stubs.h | 11 + tools/sched_ext/include/scx/common.bpf.h | 647 ++ tools/sched_ext/include/scx/common.h | 81 + tools/sched_ext/include/scx/compat.bpf.h | 143 + tools/sched_ext/include/scx/compat.h | 187 + .../sched_ext/include/scx/enums.autogen.bpf.h | 105 + tools/sched_ext/include/scx/enums.autogen.h | 41 + tools/sched_ext/include/scx/enums.bpf.h | 12 + tools/sched_ext/include/scx/enums.h | 27 + tools/sched_ext/include/scx/user_exit_info.h | 118 + tools/sched_ext/scx_central.bpf.c | 356 + tools/sched_ext/scx_central.c | 145 + tools/sched_ext/scx_flatcg.bpf.c | 954 +++ tools/sched_ext/scx_flatcg.c | 234 + tools/sched_ext/scx_flatcg.h | 51 + tools/sched_ext/scx_qmap.bpf.c | 827 ++ tools/sched_ext/scx_qmap.c | 155 + tools/sched_ext/scx_show_state.py | 42 + tools/sched_ext/scx_simple.bpf.c | 151 + tools/sched_ext/scx_simple.c | 107 + tools/testing/selftests/Makefile | 9 +- tools/testing/selftests/bpf/.gitignore | 1 + .../testing/selftests/bpf/bpf_experimental.h | 96 + .../selftests/bpf/bpf_testmod/bpf_testmod.c | 160 +- .../selftests/bpf/bpf_testmod/bpf_testmod.h | 61 + .../bpf/bpf_testmod/bpf_testmod_kfunc.h | 9 + .../selftests/bpf/prog_tests/bpf_iter.c | 44 +- .../selftests/bpf/prog_tests/btf_distill.c | 692 ++ .../selftests/bpf/prog_tests/cgroup_iter.c | 33 + .../bpf/prog_tests/global_func_dead_code.c | 60 + .../testing/selftests/bpf/prog_tests/iters.c | 209 + .../selftests/bpf/prog_tests/kfunc_call.c | 1 + .../selftests/bpf/prog_tests/rcu_read_lock.c | 6 + .../selftests/bpf/prog_tests/spin_lock.c | 2 + .../prog_tests/test_struct_ops_maybe_null.c | 46 + .../bpf/prog_tests/test_struct_ops_module.c | 86 + .../prog_tests/test_struct_ops_multi_pages.c | 30 + .../testing/selftests/bpf/prog_tests/timer.c | 4 + .../selftests/bpf/prog_tests/verifier.c | 4 + ...f_iter_task_vma.c => bpf_iter_task_vmas.c} | 0 .../{bpf_iter_task.c => bpf_iter_tasks.c} | 0 .../bpf/progs/freplace_dead_global_func.c | 11 + tools/testing/selftests/bpf/progs/iters_css.c | 72 + .../selftests/bpf/progs/iters_css_task.c | 102 + .../testing/selftests/bpf/progs/iters_task.c | 41 + .../selftests/bpf/progs/iters_task_failure.c | 105 + .../selftests/bpf/progs/iters_task_vma.c | 43 + .../selftests/bpf/progs/iters_testmod_seq.c | 50 + .../selftests/bpf/progs/kfunc_call_test.c | 37 + .../selftests/bpf/progs/rcu_read_lock.c | 120 + .../bpf/progs/struct_ops_maybe_null.c | 29 + .../bpf/progs/struct_ops_maybe_null_fail.c | 24 + .../selftests/bpf/progs/struct_ops_module.c | 37 + .../bpf/progs/struct_ops_multi_pages.c | 102 + .../selftests/bpf/progs/test_global_func12.c | 4 +- .../selftests/bpf/progs/test_spin_lock.c | 65 + .../selftests/bpf/progs/test_spin_lock_fail.c | 44 + tools/testing/selftests/bpf/progs/timer.c | 63 +- .../selftests/bpf/progs/verifier_bits_iter.c | 232 + .../bpf/progs/verifier_global_subprogs.c | 101 + .../selftests/bpf/progs/verifier_spin_lock.c | 2 +- .../bpf/progs/verifier_subprog_precision.c | 4 +- tools/testing/selftests/bpf/test_loader.c | 10 +- tools/testing/selftests/bpf/test_maps.c | 18 +- tools/testing/selftests/bpf/test_maps.h | 5 + tools/testing/selftests/sched_ext/.gitignore | 6 + tools/testing/selftests/sched_ext/Makefile | 211 + tools/testing/selftests/sched_ext/config | 9 + .../selftests/sched_ext/create_dsq.bpf.c | 58 + .../testing/selftests/sched_ext/create_dsq.c | 57 + .../sched_ext/ddsp_bogus_dsq_fail.bpf.c | 42 + .../selftests/sched_ext/ddsp_bogus_dsq_fail.c | 60 + .../sched_ext/ddsp_vtimelocal_fail.bpf.c | 39 + .../sched_ext/ddsp_vtimelocal_fail.c | 59 + .../selftests/sched_ext/dsp_local_on.bpf.c | 68 + .../selftests/sched_ext/dsp_local_on.c | 60 + .../sched_ext/enq_last_no_enq_fails.bpf.c | 29 + .../sched_ext/enq_last_no_enq_fails.c | 64 + .../sched_ext/enq_select_cpu_fails.bpf.c | 43 + .../sched_ext/enq_select_cpu_fails.c | 61 + tools/testing/selftests/sched_ext/exit.bpf.c | 86 + tools/testing/selftests/sched_ext/exit.c | 64 + tools/testing/selftests/sched_ext/exit_test.h | 20 + .../testing/selftests/sched_ext/hotplug.bpf.c | 61 + tools/testing/selftests/sched_ext/hotplug.c | 170 + .../selftests/sched_ext/hotplug_test.h | 15 + .../sched_ext/init_enable_count.bpf.c | 53 + .../selftests/sched_ext/init_enable_count.c | 157 + .../testing/selftests/sched_ext/maximal.bpf.c | 166 + tools/testing/selftests/sched_ext/maximal.c | 54 + .../selftests/sched_ext/maybe_null.bpf.c | 36 + .../testing/selftests/sched_ext/maybe_null.c | 49 + .../sched_ext/maybe_null_fail_dsp.bpf.c | 25 + .../sched_ext/maybe_null_fail_yld.bpf.c | 28 + .../testing/selftests/sched_ext/minimal.bpf.c | 21 + tools/testing/selftests/sched_ext/minimal.c | 58 + .../selftests/sched_ext/prog_run.bpf.c | 33 + tools/testing/selftests/sched_ext/prog_run.c | 78 + .../testing/selftests/sched_ext/reload_loop.c | 74 + tools/testing/selftests/sched_ext/runner.c | 212 + tools/testing/selftests/sched_ext/scx_test.h | 131 + .../selftests/sched_ext/select_cpu_dfl.bpf.c | 40 + .../selftests/sched_ext/select_cpu_dfl.c | 75 + .../sched_ext/select_cpu_dfl_nodispatch.bpf.c | 89 + .../sched_ext/select_cpu_dfl_nodispatch.c | 75 + .../sched_ext/select_cpu_dispatch.bpf.c | 41 + .../selftests/sched_ext/select_cpu_dispatch.c | 73 + .../select_cpu_dispatch_bad_dsq.bpf.c | 37 + .../sched_ext/select_cpu_dispatch_bad_dsq.c | 59 + .../select_cpu_dispatch_dbl_dsp.bpf.c | 38 + .../sched_ext/select_cpu_dispatch_dbl_dsp.c | 59 + .../sched_ext/select_cpu_vtime.bpf.c | 92 + .../selftests/sched_ext/select_cpu_vtime.c | 62 + .../selftests/sched_ext/test_example.c | 49 + tools/testing/selftests/sched_ext/util.c | 71 + tools/testing/selftests/sched_ext/util.h | 13 + 263 files changed, 27732 insertions(+), 3787 deletions(-) create mode 100644 Documentation/scheduler/sched-ext.rst create mode 100644 include/asm-generic/cfi.h create mode 100644 include/linux/sched/ext.h create mode 100644 include/trace/events/sched_ext.h delete mode 100644 kernel/bpf/bpf_struct_ops_types.h create mode 100644 kernel/sched/ext.c create mode 100644 kernel/sched/ext.h create mode 100644 kernel/sched/ext_idle.c create mode 100644 kernel/sched/ext_idle.h create mode 100644 kernel/sched/syscalls.c create mode 100644 scripts/Makefile.btf delete mode 100755 scripts/pahole-flags.sh create mode 100644 tools/lib/bpf/btf_iter.c create mode 100644 tools/lib/bpf/btf_relocate.c create mode 100644 tools/sched_ext/.gitignore create mode 100644 tools/sched_ext/Makefile create mode 100644 tools/sched_ext/README.md create mode 100644 tools/sched_ext/include/bpf-compat/gnu/stubs.h create mode 100644 tools/sched_ext/include/scx/common.bpf.h create mode 100644 tools/sched_ext/include/scx/common.h create mode 100644 tools/sched_ext/include/scx/compat.bpf.h create mode 100644 tools/sched_ext/include/scx/compat.h create mode 100644 tools/sched_ext/include/scx/enums.autogen.bpf.h create mode 100644 tools/sched_ext/include/scx/enums.autogen.h create mode 100644 tools/sched_ext/include/scx/enums.bpf.h create mode 100644 tools/sched_ext/include/scx/enums.h create mode 100644 tools/sched_ext/include/scx/user_exit_info.h create mode 100644 tools/sched_ext/scx_central.bpf.c create mode 100644 tools/sched_ext/scx_central.c create mode 100644 tools/sched_ext/scx_flatcg.bpf.c create mode 100644 tools/sched_ext/scx_flatcg.c create mode 100644 tools/sched_ext/scx_flatcg.h create mode 100644 tools/sched_ext/scx_qmap.bpf.c create mode 100644 tools/sched_ext/scx_qmap.c create mode 100644 tools/sched_ext/scx_show_state.py create mode 100644 tools/sched_ext/scx_simple.bpf.c create mode 100644 tools/sched_ext/scx_simple.c create mode 100644 tools/testing/selftests/bpf/prog_tests/btf_distill.c create mode 100644 tools/testing/selftests/bpf/prog_tests/global_func_dead_code.c create mode 100644 tools/testing/selftests/bpf/prog_tests/test_struct_ops_maybe_null.c create mode 100644 tools/testing/selftests/bpf/prog_tests/test_struct_ops_module.c create mode 100644 tools/testing/selftests/bpf/prog_tests/test_struct_ops_multi_pages.c rename tools/testing/selftests/bpf/progs/{bpf_iter_task_vma.c => bpf_iter_task_vmas.c} (100%) rename tools/testing/selftests/bpf/progs/{bpf_iter_task.c => bpf_iter_tasks.c} (100%) create mode 100644 tools/testing/selftests/bpf/progs/freplace_dead_global_func.c create mode 100644 tools/testing/selftests/bpf/progs/iters_css.c create mode 100644 tools/testing/selftests/bpf/progs/iters_css_task.c create mode 100644 tools/testing/selftests/bpf/progs/iters_task.c create mode 100644 tools/testing/selftests/bpf/progs/iters_task_failure.c create mode 100644 tools/testing/selftests/bpf/progs/iters_task_vma.c create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_maybe_null.c create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_maybe_null_fail.c create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_module.c create mode 100644 tools/testing/selftests/bpf/progs/struct_ops_multi_pages.c create mode 100644 tools/testing/selftests/bpf/progs/verifier_bits_iter.c create mode 100644 tools/testing/selftests/bpf/progs/verifier_global_subprogs.c create mode 100644 tools/testing/selftests/sched_ext/.gitignore create mode 100644 tools/testing/selftests/sched_ext/Makefile create mode 100644 tools/testing/selftests/sched_ext/config create mode 100644 tools/testing/selftests/sched_ext/create_dsq.bpf.c create mode 100644 tools/testing/selftests/sched_ext/create_dsq.c create mode 100644 tools/testing/selftests/sched_ext/ddsp_bogus_dsq_fail.bpf.c create mode 100644 tools/testing/selftests/sched_ext/ddsp_bogus_dsq_fail.c create mode 100644 tools/testing/selftests/sched_ext/ddsp_vtimelocal_fail.bpf.c create mode 100644 tools/testing/selftests/sched_ext/ddsp_vtimelocal_fail.c create mode 100644 tools/testing/selftests/sched_ext/dsp_local_on.bpf.c create mode 100644 tools/testing/selftests/sched_ext/dsp_local_on.c create mode 100644 tools/testing/selftests/sched_ext/enq_last_no_enq_fails.bpf.c create mode 100644 tools/testing/selftests/sched_ext/enq_last_no_enq_fails.c create mode 100644 tools/testing/selftests/sched_ext/enq_select_cpu_fails.bpf.c create mode 100644 tools/testing/selftests/sched_ext/enq_select_cpu_fails.c create mode 100644 tools/testing/selftests/sched_ext/exit.bpf.c create mode 100644 tools/testing/selftests/sched_ext/exit.c create mode 100644 tools/testing/selftests/sched_ext/exit_test.h create mode 100644 tools/testing/selftests/sched_ext/hotplug.bpf.c create mode 100644 tools/testing/selftests/sched_ext/hotplug.c create mode 100644 tools/testing/selftests/sched_ext/hotplug_test.h create mode 100644 tools/testing/selftests/sched_ext/init_enable_count.bpf.c create mode 100644 tools/testing/selftests/sched_ext/init_enable_count.c create mode 100644 tools/testing/selftests/sched_ext/maximal.bpf.c create mode 100644 tools/testing/selftests/sched_ext/maximal.c create mode 100644 tools/testing/selftests/sched_ext/maybe_null.bpf.c create mode 100644 tools/testing/selftests/sched_ext/maybe_null.c create mode 100644 tools/testing/selftests/sched_ext/maybe_null_fail_dsp.bpf.c create mode 100644 tools/testing/selftests/sched_ext/maybe_null_fail_yld.bpf.c create mode 100644 tools/testing/selftests/sched_ext/minimal.bpf.c create mode 100644 tools/testing/selftests/sched_ext/minimal.c create mode 100644 tools/testing/selftests/sched_ext/prog_run.bpf.c create mode 100644 tools/testing/selftests/sched_ext/prog_run.c create mode 100644 tools/testing/selftests/sched_ext/reload_loop.c create mode 100644 tools/testing/selftests/sched_ext/runner.c create mode 100644 tools/testing/selftests/sched_ext/scx_test.h create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dfl.bpf.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dfl.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dfl_nodispatch.bpf.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dfl_nodispatch.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dispatch.bpf.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dispatch.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dispatch_bad_dsq.bpf.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dispatch_bad_dsq.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dispatch_dbl_dsp.bpf.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_dispatch_dbl_dsp.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_vtime.bpf.c create mode 100644 tools/testing/selftests/sched_ext/select_cpu_vtime.c create mode 100644 tools/testing/selftests/sched_ext/test_example.c create mode 100644 tools/testing/selftests/sched_ext/util.c create mode 100644 tools/testing/selftests/sched_ext/util.h -- 2.34.1

1 294

[PATCH OLK-6.6] nvme-fc: release admin tagset if init fails
by Zheng Qixing 03 Apr '26

03 Apr '26

From: Chaitanya Kulkarni <ckulkarnilinux(a)gmail.com> stable inclusion from stable-v6.6.124 commit 7c54d3f5ebbc5982daaa004260242dc07ac943ea category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13892 CVE: CVE-2026-23261 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d1877cc7270302081a315a81a0ee8331f19f95c8 ] nvme_fabrics creates an NVMe/FC controller in following path: nvmf_dev_write() -> nvmf_create_ctrl() -> nvme_fc_create_ctrl() -> nvme_fc_init_ctrl() nvme_fc_init_ctrl() allocates the admin blk-mq resources right after nvme_add_ctrl() succeeds. If any of the subsequent steps fail (changing the controller state, scheduling connect work, etc.), we jump to the fail_ctrl path, which tears down the controller references but never frees the admin queue/tag set. The leaked blk-mq allocations match the kmemleak report seen during blktests nvme/fc. Check ctrl->ctrl.admin_tagset in the fail_ctrl path and call nvme_remove_admin_tag_set() when it is set so that all admin queue allocations are reclaimed whenever controller setup aborts. Reported-by: Yi Zhang <yi.zhang(a)redhat.com> Reviewed-by: Justin Tee <justin.tee(a)broadcom.com> Signed-off-by: Chaitanya Kulkarni <ckulkarnilinux(a)gmail.com> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/nvme/host/fc.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c index db339f72ce62..745b3babb849 100644 --- a/drivers/nvme/host/fc.c +++ b/drivers/nvme/host/fc.c @@ -3546,6 +3546,8 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts, ctrl->ctrl.opts = NULL; + if (ctrl->ctrl.admin_tagset) + nvme_remove_admin_tag_set(&ctrl->ctrl); /* initiate nvme ctrl ref counting teardown */ nvme_uninit_ctrl(&ctrl->ctrl); -- 2.39.2

2 1

[PATCH OLK-6.6] wifi: libertas: fix use-after-free in lbs_free_adapter()
by Wupeng Ma 03 Apr '26

03 Apr '26

From: Daniel Hodges <git(a)danielhodges.dev> stable inclusion from stable-v6.6.130 commit 3c5c818c78b03a1725f3dcd566865c77b48dd3a6 category: bugfix bugzilla: 13984 CVE: CVE-2026-23281 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 03cc8f90d0537fcd4985c3319b4fafbf2e3fb1f0 ] The lbs_free_adapter() function uses timer_delete() (non-synchronous) for both command_timer and tx_lockup_timer before the structure is freed. This is incorrect because timer_delete() does not wait for any running timer callback to complete. If a timer callback is executing when lbs_free_adapter() is called, the callback will access freed memory since lbs_cfg_free() frees the containing structure immediately after lbs_free_adapter() returns. Both timer callbacks (lbs_cmd_timeout_handler and lbs_tx_lockup_handler) access priv->driver_lock, priv->cur_cmd, priv->dev, and other fields, which would all be use-after-free violations. Use timer_delete_sync() instead to ensure any running timer callback has completed before returning. This bug was introduced in commit 8f641d93c38a ("libertas: detect TX lockups and reset hardware") where del_timer() was used instead of del_timer_sync() in the cleanup path. The command_timer has had the same issue since the driver was first written. Fixes: 8f641d93c38a ("libertas: detect TX lockups and reset hardware") Fixes: 954ee164f4f4 ("[PATCH] libertas: reorganize and simplify init sequence") Cc: stable(a)vger.kernel.org Signed-off-by: Daniel Hodges <git(a)danielhodges.dev> Link: https://patch.msgid.link/20260206195356.15647-1-git@danielhodges.dev Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> [ del_timer() => timer_delete_sync() ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- drivers/net/wireless/marvell/libertas/main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/marvell/libertas/main.c b/drivers/net/wireless/marvell/libertas/main.c index 78e8b5aecec0e..91b9501c6d8cb 100644 --- a/drivers/net/wireless/marvell/libertas/main.c +++ b/drivers/net/wireless/marvell/libertas/main.c @@ -881,8 +881,8 @@ static void lbs_free_adapter(struct lbs_private *priv) { lbs_free_cmd_buffer(priv); kfifo_free(&priv->event_fifo); - del_timer(&priv->command_timer); - del_timer(&priv->tx_lockup_timer); + timer_delete_sync(&priv->command_timer); + timer_delete_sync(&priv->tx_lockup_timer); del_timer(&priv->auto_deepsleep_timer); } -- 2.43.0

2 1

[PATCH OLK-6.6] can: usb: etas_es58x: correctly anchor the urb in the read bulk callback
by Wupeng Ma 03 Apr '26

03 Apr '26

From: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> stable inclusion from stable-v6.6.130 commit f6e90c113c92e83fc0963d5e60e16b0e8a268981 category: bugfix bugzilla: 13957 CVE: CVE-2026-23324 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 5eaad4f768266f1f17e01232ffe2ef009f8129b7 upstream. When submitting an urb, that is using the anchor pattern, it needs to be anchored before submitting it otherwise it could be leaked if usb_kill_anchored_urbs() is called. This logic is correctly done elsewhere in the driver, except in the read bulk callback so do that here also. Cc: Vincent Mailhol <mailhol(a)kernel.org> Cc: Marc Kleine-Budde <mkl(a)pengutronix.de> Cc: stable(a)kernel.org Assisted-by: gkh_clanker_2000 Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Reviewed-by: Vincent Mailhol <mailhol(a)kernel.org> Tested-by: Vincent Mailhol <mailhol(a)kernel.org> Link: https://patch.msgid.link/2026022320-poser-stiffly-9d84@gregkh Fixes: 8537257874e9 ("can: etas_es58x: add core support for ETAS ES58X CAN USB interfaces") Signed-off-by: Marc Kleine-Budde <mkl(a)pengutronix.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- drivers/net/can/usb/etas_es58x/es58x_core.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/net/can/usb/etas_es58x/es58x_core.c b/drivers/net/can/usb/etas_es58x/es58x_core.c index bb49a2c0a9a5c..3edf06106f9d3 100644 --- a/drivers/net/can/usb/etas_es58x/es58x_core.c +++ b/drivers/net/can/usb/etas_es58x/es58x_core.c @@ -1461,12 +1461,18 @@ static void es58x_read_bulk_callback(struct urb *urb) } resubmit_urb: + usb_anchor_urb(urb, &es58x_dev->rx_urbs); ret = usb_submit_urb(urb, GFP_ATOMIC); + if (!ret) + return; + + usb_unanchor_urb(urb); + if (ret == -ENODEV) { for (i = 0; i < es58x_dev->num_can_ch; i++) if (es58x_dev->netdev[i]) netif_device_detach(es58x_dev->netdev[i]); - } else if (ret) + } else dev_err_ratelimited(dev, "Failed resubmitting read bulk urb: %pe\n", ERR_PTR(ret)); -- 2.43.0

2 1

openEuler Kernel SIG双周例会
by openEuler conference 03 Apr '26

03 Apr '26

您好！ Kernel 邀请您参加 2026-04-03 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议发起人： LiaoTao_Wave 会议内容： 1. 进展update 2. 议题征集中（新增议题可直接填写至会议看板）会议链接：https://meeting.huaweicloud.com:36443/#/j/981797149 会议纪要&签到链接：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2026-04-03 14:00 The subject of the conference is openEuler Kernel SIG双周例会 The sponsor of the conference is LiaoTao_Wave Summary: 1. 进展update 2. 议题征集中（新增议题可直接填写至会议看板） You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/981797149 Add topics at https://etherpad.openeuler.org/p/Kernel-meetings More information: https://www.openeuler.org/en/

1 0

[PATCH OLK-6.6 0/2] ACPI/IORT: Add PMCG platform information for 162001900
by Zeng Heng 03 Apr '26

03 Apr '26

Qinxin Xia (2): arm-smmu-v3: add HIP09A, HIP09B, HIP10C, HIP10CA for 162100602 errata ACPI/IORT: Add PMCG platform information for 162001900 drivers/acpi/arm64/iort.c | 4 ++++ drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 6 ++++++ 2 files changed, 10 insertions(+) -- 2.25.1

2 3

[PATCH v3 OLK-6.6 0/5] Reuse SUBSYS for xcu and freezer to preserve KABI
by Liu Kai 02 Apr '26

02 Apr '26

Reuse SUBSYS for xcu and freezer to preserve KABI Liu Kai (5): xSched/cgroup: reuse SUBSYS for xcu and freezer to preserve KABI xSched/cgroup: make xcu.stat invisible at root cgroup cgroup: sync CGROUP_SUBSYS_COUNT limit with upstream to 16 xSched: enable CONFIG_CGROUP_XCU and CONFIG_XCU_SCHED_CFS in arm64/x86 defconfig xSched: update xSched manual for xcu cmdline enable option Documentation/scheduler/xsched.md | 6 +- arch/arm64/configs/openeuler_defconfig | 3 +- arch/x86/configs/openeuler_defconfig | 3 +- include/linux/cgroup_subsys.h | 8 +- include/linux/freezer.h | 24 ++++ kernel/cgroup/cgroup.c | 2 +- kernel/cgroup/legacy_freezer.c | 25 +++- kernel/xsched/cgroup.c | 174 +++++++++++++++++++++++-- 8 files changed, 217 insertions(+), 28 deletions(-) -- 2.34.1

2 6

[PATCH OLK-6.6 0/2] CVE-2026-23276
by Li Xiasong 02 Apr '26

02 Apr '26

Eric Dumazet (1): net: prevent NULL deref in ip[6]tunnel_xmit() Weiming Shi (1): net: add xmit recursion limit to tunnel xmit functions include/net/ip6_tunnel.h | 14 ++++++++++++++ include/net/ip_tunnels.h | 7 +++++++ net/ipv4/ip_tunnel_core.c | 15 +++++++++++++++ 3 files changed, 36 insertions(+) -- 2.34.1

2 3

[PATCH OLK-6.6] tcp: secure_seq: add back ports to TS offset
by Li Xiasong 02 Apr '26

02 Apr '26

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v7.0-rc3 commit 165573e41f2f66ef98940cf65f838b2cb575d9d1 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13867 CVE: CVE-2026-23247 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- This reverts 28ee1b746f49 ("secure_seq: downgrade to per-host timestamp offsets") tcp_tw_recycle went away in 2017. Zhouyan Deng reported off-path TCP source port leakage via SYN cookie side-channel that can be fixed in multiple ways. One of them is to bring back TCP ports in TS offset randomization. As a bonus, we perform a single siphash() computation to provide both an ISN and a TS offset. Fixes: 28ee1b746f49 ("secure_seq: downgrade to per-host timestamp offsets") Reported-by: Zhouyan Deng <dengzhouyan_nwpu(a)163.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)google.com> Acked-by: Florian Westphal <fw(a)strlen.de> Link: https://patch.msgid.link/20260302205527.1982836-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: include/net/secure_seq.h include/net/tcp.h net/core/secure_seq.c net/ipv4/syncookies.c net/ipv4/tcp_input.c net/ipv4/tcp_ipv4.c net/ipv6/syncookies.c net/ipv6/tcp_ipv6.c [conflicts due to merged bf8317ce3910 ("net: use __GENKSYMS__ to revert the kabi change") and not merge 2a63dd0edf38 ("net: Retire DCCP socket.") and 6dc4c2526f6d ("tcp: use EXPORT_IPV6_MOD[_GPL]()") and 8e7bab6b9652 ("tcp: Factorise cookie-independent fields initialisation in cookie_v[46]_check()") and cdbab6236605 ("tcp: fix fastopen code vs usec TS") and 449f68f8fffa ("net: Convert proto callbacks from sockaddr to sockaddr_unsized").] Signed-off-by: Li Xiasong <lixiasong1(a)huawei.com> --- include/net/secure_seq.h | 45 ++++++++++++++++++---- include/net/tcp.h | 6 ++- net/core/secure_seq.c | 80 +++++++++++++++------------------------- net/ipv4/syncookies.c | 11 ++++-- net/ipv4/tcp_input.c | 10 +++-- net/ipv4/tcp_ipv4.c | 37 +++++++++---------- net/ipv6/syncookies.c | 11 ++++-- net/ipv6/tcp_ipv6.c | 37 +++++++++---------- 8 files changed, 128 insertions(+), 109 deletions(-) diff --git a/include/net/secure_seq.h b/include/net/secure_seq.h index 21e7fa2a1813..e4ad681a2a12 100644 --- a/include/net/secure_seq.h +++ b/include/net/secure_seq.h @@ -5,20 +5,51 @@ #include <linux/types.h> struct net; +extern struct net init_net; + +union tcp_seq_and_ts_off { + struct { + u32 seq; + u32 ts_off; + }; + u64 hash64; +}; u64 secure_ipv4_port_ephemeral(__be32 saddr, __be32 daddr, __be16 dport); u64 secure_ipv6_port_ephemeral(const __be32 *saddr, const __be32 *daddr, __be16 dport); -u32 secure_tcp_seq(__be32 saddr, __be32 daddr, - __be16 sport, __be16 dport); -u32 secure_tcp_ts_off(const struct net *net, __be32 saddr, __be32 daddr); -u32 secure_tcpv6_seq(const __be32 *saddr, const __be32 *daddr, - __be16 sport, __be16 dport); -u32 secure_tcpv6_ts_off(const struct net *net, - const __be32 *saddr, const __be32 *daddr); u64 secure_dccp_sequence_number(__be32 saddr, __be32 daddr, __be16 sport, __be16 dport); u64 secure_dccpv6_sequence_number(__be32 *saddr, __be32 *daddr, __be16 sport, __be16 dport); +union tcp_seq_and_ts_off +secure_tcp_seq_and_ts_off(const struct net *net, __be32 saddr, __be32 daddr, + __be16 sport, __be16 dport); + +static inline u32 secure_tcp_seq(__be32 saddr, __be32 daddr, + __be16 sport, __be16 dport) +{ + union tcp_seq_and_ts_off ts; + + ts = secure_tcp_seq_and_ts_off(&init_net, saddr, daddr, + sport, dport); + + return ts.seq; +} + +union tcp_seq_and_ts_off +secure_tcpv6_seq_and_ts_off(const struct net *net, const __be32 *saddr, + const __be32 *daddr, + __be16 sport, __be16 dport); + +static inline u32 secure_tcpv6_seq(const __be32 *saddr, const __be32 *daddr, + __be16 sport, __be16 dport) +{ + union tcp_seq_and_ts_off ts; + + ts = secure_tcpv6_seq_and_ts_off(&init_net, saddr, daddr, + sport, dport); + return ts.seq; +} #endif /* _NET_SECURE_SEQ */ diff --git a/include/net/tcp.h b/include/net/tcp.h index e8f81924defc..f0a6468a1c34 100644 --- a/include/net/tcp.h +++ b/include/net/tcp.h @@ -44,6 +44,7 @@ #ifndef __GENKSYMS__ #include <net/xfrm.h> #endif +#include <net/secure_seq.h> #include <linux/seq_file.h> #include <linux/memcontrol.h> @@ -2180,8 +2181,9 @@ struct tcp_request_sock_ops { struct sk_buff *skb, struct flowi *fl, struct request_sock *req); - u32 (*init_seq)(const struct sk_buff *skb); - u32 (*init_ts_off)(const struct net *net, const struct sk_buff *skb); + union tcp_seq_and_ts_off (*init_seq_and_ts_off)( + const struct net *net, + const struct sk_buff *skb); int (*send_synack)(const struct sock *sk, struct dst_entry *dst, struct flowi *fl, struct request_sock *req, struct tcp_fastopen_cookie *foc, diff --git a/net/core/secure_seq.c b/net/core/secure_seq.c index b0ff6153be62..740642aeaf76 100644 --- a/net/core/secure_seq.c +++ b/net/core/secure_seq.c @@ -20,7 +20,6 @@ #include <net/tcp.h> static siphash_aligned_key_t net_secret; -static siphash_aligned_key_t ts_secret; #define EPHEMERAL_PORT_SHUFFLE_PERIOD (10 * HZ) @@ -28,11 +27,6 @@ static __always_inline void net_secret_init(void) { net_get_random_once(&net_secret, sizeof(net_secret)); } - -static __always_inline void ts_secret_init(void) -{ - net_get_random_once(&ts_secret, sizeof(ts_secret)); -} #endif #ifdef CONFIG_INET @@ -53,28 +47,9 @@ static u32 seq_scale(u32 seq) #endif #if IS_ENABLED(CONFIG_IPV6) -u32 secure_tcpv6_ts_off(const struct net *net, - const __be32 *saddr, const __be32 *daddr) -{ - const struct { - struct in6_addr saddr; - struct in6_addr daddr; - } __aligned(SIPHASH_ALIGNMENT) combined = { - .saddr = *(struct in6_addr *)saddr, - .daddr = *(struct in6_addr *)daddr, - }; - - if (READ_ONCE(net->ipv4.sysctl_tcp_timestamps) != 1) - return 0; - - ts_secret_init(); - return siphash(&combined, offsetofend(typeof(combined), daddr), - &ts_secret); -} -EXPORT_SYMBOL(secure_tcpv6_ts_off); - -u32 secure_tcpv6_seq(const __be32 *saddr, const __be32 *daddr, - __be16 sport, __be16 dport) +union tcp_seq_and_ts_off +secure_tcpv6_seq_and_ts_off(const struct net *net, const __be32 *saddr, + const __be32 *daddr, __be16 sport, __be16 dport) { const struct { struct in6_addr saddr; @@ -87,14 +62,20 @@ u32 secure_tcpv6_seq(const __be32 *saddr, const __be32 *daddr, .sport = sport, .dport = dport }; - u32 hash; + union tcp_seq_and_ts_off st; net_secret_init(); - hash = siphash(&combined, offsetofend(typeof(combined), dport), - &net_secret); - return seq_scale(hash); + + st.hash64 = siphash(&combined, offsetofend(typeof(combined), dport), + &net_secret); + + if (READ_ONCE(net->ipv4.sysctl_tcp_timestamps) != 1) + st.ts_off = 0; + + st.seq = seq_scale(st.seq); + return st; } -EXPORT_SYMBOL(secure_tcpv6_seq); +EXPORT_SYMBOL(secure_tcpv6_seq_and_ts_off); u64 secure_ipv6_port_ephemeral(const __be32 *saddr, const __be32 *daddr, __be16 dport) @@ -118,33 +99,30 @@ EXPORT_SYMBOL(secure_ipv6_port_ephemeral); #endif #ifdef CONFIG_INET -u32 secure_tcp_ts_off(const struct net *net, __be32 saddr, __be32 daddr) -{ - if (READ_ONCE(net->ipv4.sysctl_tcp_timestamps) != 1) - return 0; - - ts_secret_init(); - return siphash_2u32((__force u32)saddr, (__force u32)daddr, - &ts_secret); -} - /* secure_tcp_seq_and_tsoff(a, b, 0, d) == secure_ipv4_port_ephemeral(a, b, d), * but fortunately, `sport' cannot be 0 in any circumstances. If this changes, * it would be easy enough to have the former function use siphash_4u32, passing * the arguments as separate u32. */ -u32 secure_tcp_seq(__be32 saddr, __be32 daddr, - __be16 sport, __be16 dport) +union tcp_seq_and_ts_off +secure_tcp_seq_and_ts_off(const struct net *net, __be32 saddr, __be32 daddr, + __be16 sport, __be16 dport) { - u32 hash; + u32 ports = (__force u32)sport << 16 | (__force u32)dport; + union tcp_seq_and_ts_off st; net_secret_init(); - hash = siphash_3u32((__force u32)saddr, (__force u32)daddr, - (__force u32)sport << 16 | (__force u32)dport, - &net_secret); - return seq_scale(hash); + + st.hash64 = siphash_3u32((__force u32)saddr, (__force u32)daddr, + ports, &net_secret); + + if (READ_ONCE(net->ipv4.sysctl_tcp_timestamps) != 1) + st.ts_off = 0; + + st.seq = seq_scale(st.seq); + return st; } -EXPORT_SYMBOL_GPL(secure_tcp_seq); +EXPORT_SYMBOL_GPL(secure_tcp_seq_and_ts_off); u64 secure_ipv4_port_ephemeral(__be32 saddr, __be32 daddr, __be16 dport) { diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c index 64f098d127ac..b8f7e2b0b4f3 100644 --- a/net/ipv4/syncookies.c +++ b/net/ipv4/syncookies.c @@ -353,9 +353,14 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb) tcp_parse_options(sock_net(sk), skb, &tcp_opt, 0, NULL); if (tcp_opt.saw_tstamp && tcp_opt.rcv_tsecr) { - tsoff = secure_tcp_ts_off(sock_net(sk), - ip_hdr(skb)->daddr, - ip_hdr(skb)->saddr); + union tcp_seq_and_ts_off st; + + st = secure_tcp_seq_and_ts_off(sock_net(sk), + ip_hdr(skb)->daddr, + ip_hdr(skb)->saddr, + tcp_hdr(skb)->dest, + tcp_hdr(skb)->source); + tsoff = st.ts_off; tcp_opt.rcv_tsecr -= tsoff; } diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c index 8d6757ec06aa..9ca0a78d5a4b 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -7165,6 +7165,7 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops, struct tcp_sock *tp = tcp_sk(sk); struct net *net = sock_net(sk); struct sock *fastopen_sk = NULL; + union tcp_seq_and_ts_off st; struct request_sock *req; bool want_cookie = false; struct dst_entry *dst; @@ -7227,9 +7228,12 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops, if (!dst) goto drop_and_free; - if (tmp_opt.tstamp_ok) - tcp_rsk(req)->ts_off = af_ops->init_ts_off(net, skb); + if (tmp_opt.tstamp_ok || (!want_cookie && !isn)) + st = af_ops->init_seq_and_ts_off(net, skb); + if (tmp_opt.tstamp_ok) { + tcp_rsk(req)->ts_off = st.ts_off; + } if (!want_cookie && !isn) { int max_syn_backlog = READ_ONCE(net->ipv4.sysctl_max_syn_backlog); @@ -7250,7 +7254,7 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops, goto drop_and_release; } - isn = af_ops->init_seq(skb); + isn = st.seq; } tcp_ecn_create_request(req, skb, sk, dst); diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c index 56d00db07d12..ceb34b30218b 100644 --- a/net/ipv4/tcp_ipv4.c +++ b/net/ipv4/tcp_ipv4.c @@ -96,17 +96,14 @@ static DEFINE_PER_CPU(struct sock *, ipv4_tcp_sk); static DEFINE_MUTEX(tcp_exit_batch_mutex); -static u32 tcp_v4_init_seq(const struct sk_buff *skb) +static union tcp_seq_and_ts_off +tcp_v4_init_seq_and_ts_off(const struct net *net, const struct sk_buff *skb) { - return secure_tcp_seq(ip_hdr(skb)->daddr, - ip_hdr(skb)->saddr, - tcp_hdr(skb)->dest, - tcp_hdr(skb)->source); -} - -static u32 tcp_v4_init_ts_off(const struct net *net, const struct sk_buff *skb) -{ - return secure_tcp_ts_off(net, ip_hdr(skb)->daddr, ip_hdr(skb)->saddr); + return secure_tcp_seq_and_ts_off(net, + ip_hdr(skb)->daddr, + ip_hdr(skb)->saddr, + tcp_hdr(skb)->dest, + tcp_hdr(skb)->source); } int tcp_twsk_unique(struct sock *sk, struct sock *sktw, void *twp) @@ -313,15 +310,16 @@ int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len) rt = NULL; if (likely(!tp->repair)) { + union tcp_seq_and_ts_off st; + + st = secure_tcp_seq_and_ts_off(net, + inet->inet_saddr, + inet->inet_daddr, + inet->inet_sport, + usin->sin_port); if (!tp->write_seq) - WRITE_ONCE(tp->write_seq, - secure_tcp_seq(inet->inet_saddr, - inet->inet_daddr, - inet->inet_sport, - usin->sin_port)); - WRITE_ONCE(tp->tsoffset, - secure_tcp_ts_off(net, inet->inet_saddr, - inet->inet_daddr)); + WRITE_ONCE(tp->write_seq, st.seq); + WRITE_ONCE(tp->tsoffset, st.ts_off); } atomic_set(&inet->inet_id, get_random_u16()); @@ -1535,8 +1533,7 @@ const struct tcp_request_sock_ops tcp_request_sock_ipv4_ops = { .cookie_init_seq = cookie_v4_init_sequence, #endif .route_req = tcp_v4_route_req, - .init_seq = tcp_v4_init_seq, - .init_ts_off = tcp_v4_init_ts_off, + .init_seq_and_ts_off = tcp_v4_init_seq_and_ts_off, .send_synack = tcp_v4_send_synack, }; diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c index a6cefee15005..bdbd3fd20448 100644 --- a/net/ipv6/syncookies.c +++ b/net/ipv6/syncookies.c @@ -161,9 +161,14 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb) tcp_parse_options(sock_net(sk), skb, &tcp_opt, 0, NULL); if (tcp_opt.saw_tstamp && tcp_opt.rcv_tsecr) { - tsoff = secure_tcpv6_ts_off(sock_net(sk), - ipv6_hdr(skb)->daddr.s6_addr32, - ipv6_hdr(skb)->saddr.s6_addr32); + union tcp_seq_and_ts_off st; + + st = secure_tcpv6_seq_and_ts_off(sock_net(sk), + ipv6_hdr(skb)->daddr.s6_addr32, + ipv6_hdr(skb)->saddr.s6_addr32, + tcp_hdr(skb)->dest, + tcp_hdr(skb)->source); + tsoff = st.ts_off; tcp_opt.rcv_tsecr -= tsoff; } diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c index f285e52b8b85..793e644fa750 100644 --- a/net/ipv6/tcp_ipv6.c +++ b/net/ipv6/tcp_ipv6.c @@ -107,18 +107,14 @@ static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb) } } -static u32 tcp_v6_init_seq(const struct sk_buff *skb) +static union tcp_seq_and_ts_off +tcp_v6_init_seq_and_ts_off(const struct net *net, const struct sk_buff *skb) { - return secure_tcpv6_seq(ipv6_hdr(skb)->daddr.s6_addr32, - ipv6_hdr(skb)->saddr.s6_addr32, - tcp_hdr(skb)->dest, - tcp_hdr(skb)->source); -} - -static u32 tcp_v6_init_ts_off(const struct net *net, const struct sk_buff *skb) -{ - return secure_tcpv6_ts_off(net, ipv6_hdr(skb)->daddr.s6_addr32, - ipv6_hdr(skb)->saddr.s6_addr32); + return secure_tcpv6_seq_and_ts_off(net, + ipv6_hdr(skb)->daddr.s6_addr32, + ipv6_hdr(skb)->saddr.s6_addr32, + tcp_hdr(skb)->dest, + tcp_hdr(skb)->source); } static int tcp_v6_pre_connect(struct sock *sk, struct sockaddr *uaddr, @@ -318,14 +314,16 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr, sk_set_txhash(sk); if (likely(!tp->repair)) { + union tcp_seq_and_ts_off st; + + st = secure_tcpv6_seq_and_ts_off(net, + np->saddr.s6_addr32, + sk->sk_v6_daddr.s6_addr32, + inet->inet_sport, + inet->inet_dport); if (!tp->write_seq) - WRITE_ONCE(tp->write_seq, - secure_tcpv6_seq(np->saddr.s6_addr32, - sk->sk_v6_daddr.s6_addr32, - inet->inet_sport, - inet->inet_dport)); - tp->tsoffset = secure_tcpv6_ts_off(net, np->saddr.s6_addr32, - sk->sk_v6_daddr.s6_addr32); + WRITE_ONCE(tp->write_seq, st.seq); + tp->tsoffset = st.ts_off; } if (tcp_fastopen_defer_connect(sk, &err)) @@ -831,8 +829,7 @@ const struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = { .cookie_init_seq = cookie_v6_init_sequence, #endif .route_req = tcp_v6_route_req, - .init_seq = tcp_v6_init_seq, - .init_ts_off = tcp_v6_init_ts_off, + .init_seq_and_ts_off = tcp_v6_init_seq_and_ts_off, .send_synack = tcp_v6_send_synack, }; -- 2.34.1

2 1

[PATCH OLK-6.6] net: gro: fix outer network offset
by Li Xiasong 02 Apr '26

02 Apr '26

From: Paolo Abeni <pabeni(a)redhat.com> stable inclusion from stable-v6.6.124 commit 9d40a85138568696387ef04cd004c64612a70874 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13895 CVE: CVE-2026-23254 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5c2c3c38be396257a6a2e55bd601a12bb9781507 ] The udp GRO complete stage assumes that all the packets inserted the RX have the `encapsulation` flag zeroed. Such assumption is not true, as a few H/W NICs can set such flag when H/W offloading the checksum for an UDP encapsulated traffic, the tun driver can inject GSO packets with UDP encapsulation and the problematic layout can also be created via a veth based setup. Due to the above, in the problematic scenarios, udp4_gro_complete() uses the wrong network offset (inner instead of outer) to compute the outer UDP header pseudo checksum, leading to csum validation errors later on in packet processing. Address the issue always clearing the encapsulation flag at GRO completion time. Such flag will be set again as needed for encapsulated packets by udp_gro_complete(). Fixes: 5ef31ea5d053 ("net: gro: fix udp bad offset in socket lookup by adding {inner_}network_offset to napi_gro_cb") Reviewed-by: Willem de Bruijn <willemb(a)google.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/562638dbebb3b15424220e26a180274b387e2a88.177003208… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Li Xiasong <lixiasong1(a)huawei.com> --- net/core/gro.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/core/gro.c b/net/core/gro.c index 2f72cce0b219..98f47ff5837b 100644 --- a/net/core/gro.c +++ b/net/core/gro.c @@ -242,6 +242,8 @@ static void napi_gro_complete(struct napi_struct *napi, struct sk_buff *skb) goto out; } + /* NICs can feed encapsulated packets into GRO */ + skb->encapsulation = 0; rcu_read_lock(); list_for_each_entry_rcu(ptype, head, list) { if (ptype->type != type || !ptype->callbacks.gro_complete) -- 2.34.1

2 1

[PATCH OLK-6.6] net: annotate data-races around sk->sk_{data_ready,write_space}
by Li Xiasong 02 Apr '26

02 Apr '26

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v7.0-rc3 commit 2ef2b20cf4e04ac8a6ba68493f8780776ff84300 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13979 CVE: CVE-2026-23302 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- skmsg (and probably other layers) are changing these pointers while other cpus might read them concurrently. Add corresponding READ_ONCE()/WRITE_ONCE() annotations for UDP, TCP and AF_UNIX. Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface") Reported-by: syzbot+87f770387a9e5dc6b79b(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/699ee9fc.050a0220.1cd54b.0009.GAE@google.com/ Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Daniel Borkmann <daniel(a)iogearbox.net> Cc: John Fastabend <john.fastabend(a)gmail.com> Cc: Jakub Sitnicki <jakub(a)cloudflare.com> Cc: Willem de Bruijn <willemdebruijn.kernel(a)gmail.com> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)google.com> Link: https://patch.msgid.link/20260225131547.1085509-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv4/udp.c net/ipv4/tcp.c net/ipv4/tcp_input.c net/ipv4/tcp_minisocks.c net/unix/af_unix.c [conflicts due to not merge bd61848900bf ("net: devmem: Implement TX path") and 95b9a87c6a6b ("tcp: record last received ipv6 flowlabel") and f0db2bca0cf9 ("tcp: rework {__,}tcp_ecn_check_ce() -> tcp_data_ecn_check()") and 2bd99aef1b19 ("tcp: accept bare FIN packets under memory pressure") and b98256959305 ("tcp: make the dropreason really work when calling tcp_rcv_state_process()") and 85cb0757d7e1 ("net: Convert proto_ops connect() callbacks to use sockaddr_unsized") and f4e1fb04c123 ("af_unix: Use cached value for SOCK_STREAM in unix_inq_len().") and b650bf0977d3 ("udp: remove busylock and add per NUMA queues").] Signed-off-by: Li Xiasong <lixiasong1(a)huawei.com> --- net/core/skmsg.c | 14 +++++++------- net/ipv4/tcp.c | 4 ++-- net/ipv4/tcp_bpf.c | 2 +- net/ipv4/tcp_input.c | 14 ++++++++------ net/ipv4/tcp_minisocks.c | 2 +- net/ipv4/udp.c | 3 ++- net/ipv4/udp_bpf.c | 2 +- net/unix/af_unix.c | 8 ++++---- 8 files changed, 26 insertions(+), 23 deletions(-) diff --git a/net/core/skmsg.c b/net/core/skmsg.c index 3429c6e2ce21..e3696d510eec 100644 --- a/net/core/skmsg.c +++ b/net/core/skmsg.c @@ -1174,8 +1174,8 @@ void sk_psock_start_strp(struct sock *sk, struct sk_psock *psock) return; psock->saved_data_ready = sk->sk_data_ready; - sk->sk_data_ready = sk_psock_strp_data_ready; - sk->sk_write_space = sk_psock_write_space; + WRITE_ONCE(sk->sk_data_ready, sk_psock_strp_data_ready); + WRITE_ONCE(sk->sk_write_space, sk_psock_write_space); } void sk_psock_stop_strp(struct sock *sk, struct sk_psock *psock) @@ -1185,8 +1185,8 @@ void sk_psock_stop_strp(struct sock *sk, struct sk_psock *psock) if (!psock->saved_data_ready) return; - sk->sk_data_ready = psock->saved_data_ready; - psock->saved_data_ready = NULL; + WRITE_ONCE(sk->sk_data_ready, psock->saved_data_ready); + WRITE_ONCE(psock->saved_data_ready, NULL); strp_stop(&psock->strp); } @@ -1265,8 +1265,8 @@ void sk_psock_start_verdict(struct sock *sk, struct sk_psock *psock) return; psock->saved_data_ready = sk->sk_data_ready; - sk->sk_data_ready = sk_psock_verdict_data_ready; - sk->sk_write_space = sk_psock_write_space; + WRITE_ONCE(sk->sk_data_ready, sk_psock_verdict_data_ready); + WRITE_ONCE(sk->sk_write_space, sk_psock_write_space); } void sk_psock_stop_verdict(struct sock *sk, struct sk_psock *psock) @@ -1277,6 +1277,6 @@ void sk_psock_stop_verdict(struct sock *sk, struct sk_psock *psock) if (!psock->saved_data_ready) return; - sk->sk_data_ready = psock->saved_data_ready; + WRITE_ONCE(sk->sk_data_ready, psock->saved_data_ready); psock->saved_data_ready = NULL; } diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c index bf23aa827031..1fe89e742f75 100644 --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c @@ -1342,7 +1342,7 @@ int tcp_sendmsg_locked(struct sock *sk, struct msghdr *msg, size_t size) err = sk_stream_error(sk, flags, err); /* make sure we wake any epoll edge trigger waiter */ if (unlikely(tcp_rtx_and_write_queues_empty(sk) && err == -EAGAIN)) { - sk->sk_write_space(sk); + READ_ONCE(sk->sk_write_space)(sk); tcp_chrono_stop(sk, TCP_CHRONO_SNDBUF_LIMITED); } return err; @@ -3705,7 +3705,7 @@ int do_tcp_setsockopt(struct sock *sk, int level, int optname, break; case TCP_NOTSENT_LOWAT: WRITE_ONCE(tp->notsent_lowat, val); - sk->sk_write_space(sk); + READ_ONCE(sk->sk_write_space)(sk); break; case TCP_INQ: if (val > 1 || val < 0) diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c index 0e56f3baf98a..9ceb6e0c8b00 100644 --- a/net/ipv4/tcp_bpf.c +++ b/net/ipv4/tcp_bpf.c @@ -668,7 +668,7 @@ int tcp_bpf_update_proto(struct sock *sk, struct sk_psock *psock, bool restore) WRITE_ONCE(sk->sk_prot->unhash, psock->saved_unhash); tcp_update_ulp(sk, psock->sk_proto, psock->saved_write_space); } else { - sk->sk_write_space = psock->saved_write_space; + WRITE_ONCE(sk->sk_write_space, psock->saved_write_space); /* Pairs with lockless read in sk_clone_lock() */ sock_replace_proto(sk, psock->sk_proto); } diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c index 8d6757ec06aa..a10e7da1a612 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -4985,7 +4985,7 @@ static void tcp_data_queue_ofo(struct sock *sk, struct sk_buff *skb) if (unlikely(tcp_try_rmem_schedule(sk, skb, skb->truesize))) { NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPOFODROP); - sk->sk_data_ready(sk); + READ_ONCE(sk->sk_data_ready)(sk); tcp_drop_reason(sk, skb, SKB_DROP_REASON_PROTO_MEM); return; } @@ -5192,7 +5192,7 @@ int tcp_send_rcvq(struct sock *sk, struct msghdr *msg, size_t size) void tcp_data_ready(struct sock *sk) { if (tcp_epollin_ready(sk, sk->sk_rcvlowat) || sock_flag(sk, SOCK_DONE)) - sk->sk_data_ready(sk); + READ_ONCE(sk->sk_data_ready)(sk); } static void tcp_data_queue(struct sock *sk, struct sk_buff *skb) @@ -5238,7 +5238,7 @@ static void tcp_data_queue(struct sock *sk, struct sk_buff *skb) inet_csk(sk)->icsk_ack.pending |= (ICSK_ACK_NOMEM | ICSK_ACK_NOW); inet_csk_schedule_ack(sk); - sk->sk_data_ready(sk); + READ_ONCE(sk->sk_data_ready)(sk); if (skb_queue_len(&sk->sk_receive_queue)) { reason = SKB_DROP_REASON_PROTO_MEM; @@ -5675,7 +5675,9 @@ static void tcp_new_space(struct sock *sk) tp->snd_cwnd_stamp = tcp_jiffies32; } - INDIRECT_CALL_1(sk->sk_write_space, sk_stream_write_space, sk); + INDIRECT_CALL_1(READ_ONCE(sk->sk_write_space), + sk_stream_write_space, + sk); } /* Caller made space either from: @@ -5873,7 +5875,7 @@ static void tcp_urg(struct sock *sk, struct sk_buff *skb, const struct tcphdr *t BUG(); WRITE_ONCE(tp->urg_data, TCP_URG_VALID | tmp); if (!sock_flag(sk, SOCK_DEAD)) - sk->sk_data_ready(sk); + READ_ONCE(sk->sk_data_ready)(sk); } } } @@ -7279,7 +7281,7 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops, sock_put(fastopen_sk); goto drop_and_free; } - sk->sk_data_ready(sk); + READ_ONCE(sk->sk_data_ready)(sk); bh_unlock_sock(fastopen_sk); sock_put(fastopen_sk); } else { diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c index 770b1ffb2e22..8d72532143bf 100644 --- a/net/ipv4/tcp_minisocks.c +++ b/net/ipv4/tcp_minisocks.c @@ -900,7 +900,7 @@ int tcp_child_process(struct sock *parent, struct sock *child, ret = tcp_rcv_state_process(child, skb); /* Wakeup parent, send SIGIO */ if (state == TCP_SYN_RECV && child->sk_state != state) - parent->sk_data_ready(parent); + READ_ONCE(parent->sk_data_ready)(parent); } else { /* Alas, it is possible again, because we do lookup * in main socket hash table and lock on listening diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c index 4c1f82f6777f..40100fed5c67 100644 --- a/net/ipv4/udp.c +++ b/net/ipv4/udp.c @@ -1618,7 +1618,8 @@ int __udp_enqueue_schedule_skb(struct sock *sk, struct sk_buff *skb) spin_unlock(&list->lock); if (!sock_flag(sk, SOCK_DEAD)) - INDIRECT_CALL_1(sk->sk_data_ready, sock_def_readable, sk); + INDIRECT_CALL_1(READ_ONCE(sk->sk_data_ready), + sock_def_readable, sk); busylock_release(busy); return 0; diff --git a/net/ipv4/udp_bpf.c b/net/ipv4/udp_bpf.c index 0735d820e413..44271ba1adec 100644 --- a/net/ipv4/udp_bpf.c +++ b/net/ipv4/udp_bpf.c @@ -143,7 +143,7 @@ int udp_bpf_update_proto(struct sock *sk, struct sk_psock *psock, bool restore) int family = sk->sk_family == AF_INET ? UDP_BPF_IPV4 : UDP_BPF_IPV6; if (restore) { - sk->sk_write_space = psock->saved_write_space; + WRITE_ONCE(sk->sk_write_space, psock->saved_write_space); sock_replace_proto(sk, psock->sk_proto); return 0; } diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c index abf9fe35e620..51f444ecebf6 100644 --- a/net/unix/af_unix.c +++ b/net/unix/af_unix.c @@ -1678,7 +1678,7 @@ static int unix_stream_connect(struct socket *sock, struct sockaddr *uaddr, __skb_queue_tail(&other->sk_receive_queue, skb); spin_unlock(&other->sk_receive_queue.lock); unix_state_unlock(other); - other->sk_data_ready(other); + READ_ONCE(other->sk_data_ready)(other); sock_put(other); return 0; @@ -2138,7 +2138,7 @@ static int unix_dgram_sendmsg(struct socket *sock, struct msghdr *msg, scm_stat_add(other, skb); skb_queue_tail(&other->sk_receive_queue, skb); unix_state_unlock(other); - other->sk_data_ready(other); + READ_ONCE(other->sk_data_ready)(other); sock_put(other); scm_destroy(&scm); return len; @@ -2206,7 +2206,7 @@ static int queue_oob(struct socket *sock, struct msghdr *msg, struct sock *other sk_send_sigurg(other); unix_state_unlock(other); - other->sk_data_ready(other); + READ_ONCE(other->sk_data_ready)(other); return err; } @@ -2317,7 +2317,7 @@ static int unix_stream_sendmsg(struct socket *sock, struct msghdr *msg, scm_stat_add(other, skb); skb_queue_tail(&other->sk_receive_queue, skb); unix_state_unlock(other); - other->sk_data_ready(other); + READ_ONCE(other->sk_data_ready)(other); sent += size; } -- 2.34.1

2 1

[PATCH OLK-6.6] net: add proper RCU protection to /proc/net/ptype
by Li Xiasong 02 Apr '26

02 Apr '26

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.19 commit f613e8b4afea0cd17c7168e8b00e25bc8d33175d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13893 CVE: CVE-2026-23255 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Yin Fengwei reported an RCU stall in ptype_seq_show() and provided a patch. Real issue is that ptype_seq_next() and ptype_seq_show() violate RCU rules. ptype_seq_show() runs under rcu_read_lock(), and reads pt->dev to get device name without any barrier. At the same time, concurrent writers can remove a packet_type structure (which is correctly freed after an RCU grace period) and clear pt->dev without an RCU grace period. Define ptype_iter_state to carry a dev pointer along seq_net_private: struct ptype_iter_state { struct seq_net_private p; struct net_device *dev; // added in this patch }; We need to record the device pointer in ptype_get_idx() and ptype_seq_next() so that ptype_seq_show() is safe against concurrent pt->dev changes. We also need to add full RCU protection in ptype_seq_next(). (Missing READ_ONCE() when reading list.next values) Many thanks to Dong Chenchen for providing a repro. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Fixes: 1d10f8a1f40b ("net-procfs: show net devices bound packet types") Fixes: c353e8983e0d ("net: introduce per netns packet chains") Reported-by: Yin Fengwei <fengwei_yin(a)linux.alibaba.com> Reported-by: Dong Chenchen <dongchenchen2(a)huawei.com> Closes: https://lore.kernel.org/netdev/CANn89iKRRKPnWjJmb-_3a=sq+9h6DvTQM4DBZHT5ZRG… Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Willem de Bruijn <willemb(a)google.com> Tested-by: Yin Fengwei <fengwei_yin(a)linux.alibaba.com> Link: https://patch.msgid.link/20260202205217.2881198-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/core/net-procfs.c [conflicts due to not merge c353e8983e0d ("net: introduce per netns packet chains").] Signed-off-by: Li Xiasong <lixiasong1(a)huawei.com> --- net/core/net-procfs.c | 48 +++++++++++++++++++++++++++++-------------- 1 file changed, 33 insertions(+), 15 deletions(-) diff --git a/net/core/net-procfs.c b/net/core/net-procfs.c index 09f7ed1a04e8..caad20464a4d 100644 --- a/net/core/net-procfs.c +++ b/net/core/net-procfs.c @@ -200,8 +200,14 @@ static const struct seq_operations softnet_seq_ops = { .show = softnet_seq_show, }; +struct ptype_iter_state { + struct seq_net_private p; + struct net_device *dev; +}; + static void *ptype_get_idx(struct seq_file *seq, loff_t pos) { + struct ptype_iter_state *iter = seq->private; struct list_head *ptype_list = NULL; struct packet_type *pt = NULL; struct net_device *dev; @@ -211,12 +217,16 @@ static void *ptype_get_idx(struct seq_file *seq, loff_t pos) for_each_netdev_rcu(seq_file_net(seq), dev) { ptype_list = &dev->ptype_all; list_for_each_entry_rcu(pt, ptype_list, list) { - if (i == pos) + if (i == pos) { + iter->dev = dev; return pt; + } ++i; } } + iter->dev = NULL; + list_for_each_entry_rcu(pt, &ptype_all, list) { if (i == pos) return pt; @@ -242,6 +252,7 @@ static void *ptype_seq_start(struct seq_file *seq, loff_t *pos) static void *ptype_seq_next(struct seq_file *seq, void *v, loff_t *pos) { + struct ptype_iter_state *iter = seq->private; struct net_device *dev; struct packet_type *pt; struct list_head *nxt; @@ -252,20 +263,22 @@ static void *ptype_seq_next(struct seq_file *seq, void *v, loff_t *pos) return ptype_get_idx(seq, 0); pt = v; - nxt = pt->list.next; - if (pt->dev) { - if (nxt != &pt->dev->ptype_all) + nxt = READ_ONCE(pt->list.next); + dev = iter->dev; + if (dev) { + if (nxt != &dev->ptype_all) goto found; - dev = pt->dev; for_each_netdev_continue_rcu(seq_file_net(seq), dev) { - if (!list_empty(&dev->ptype_all)) { - nxt = dev->ptype_all.next; + nxt = READ_ONCE(dev->ptype_all.next); + if (nxt != &dev->ptype_all) { + iter->dev = dev; goto found; } } - nxt = ptype_all.next; + iter->dev = NULL; + nxt = READ_ONCE(ptype_all.next); goto ptype_all; } @@ -274,14 +287,14 @@ static void *ptype_seq_next(struct seq_file *seq, void *v, loff_t *pos) if (nxt != &ptype_all) goto found; hash = 0; - nxt = ptype_base[0].next; + nxt = READ_ONCE(ptype_base[0].next); } else hash = ntohs(pt->type) & PTYPE_HASH_MASK; while (nxt == &ptype_base[hash]) { if (++hash >= PTYPE_HASH_SIZE) return NULL; - nxt = ptype_base[hash].next; + nxt = READ_ONCE(ptype_base[hash].next); } found: return list_entry(nxt, struct packet_type, list); @@ -295,19 +308,24 @@ static void ptype_seq_stop(struct seq_file *seq, void *v) static int ptype_seq_show(struct seq_file *seq, void *v) { + struct ptype_iter_state *iter = seq->private; struct packet_type *pt = v; + struct net_device *dev; - if (v == SEQ_START_TOKEN) + if (v == SEQ_START_TOKEN) { seq_puts(seq, "Type Device Function\n"); - else if ((!pt->af_packet_net || net_eq(pt->af_packet_net, seq_file_net(seq))) && - (!pt->dev || net_eq(dev_net(pt->dev), seq_file_net(seq)))) { + return 0; + } + dev = iter->dev; + if ((!pt->af_packet_net || net_eq(pt->af_packet_net, seq_file_net(seq))) && + (!dev || net_eq(dev_net(dev), seq_file_net(seq)))) { if (pt->type == htons(ETH_P_ALL)) seq_puts(seq, "ALL "); else seq_printf(seq, "%04x", ntohs(pt->type)); seq_printf(seq, " %-8s %ps\n", - pt->dev ? pt->dev->name : "", pt->func); + dev ? dev->name : "", pt->func); } return 0; @@ -331,7 +349,7 @@ static int __net_init dev_proc_net_init(struct net *net) &softnet_seq_ops)) goto out_dev; if (!proc_create_net("ptype", 0444, net->proc_net, &ptype_seq_ops, - sizeof(struct seq_net_private))) + sizeof(struct ptype_iter_state))) goto out_softnet; if (wext_proc_init(net)) -- 2.34.1

2 1

[PATCH OLK-6.6] af_unix: Give up GC if MSG_PEEK intervened.
by Li Xiasong 02 Apr '26

02 Apr '26

From: Kuniyuki Iwashima <kuniyu(a)google.com> mainline inclusion from mainline-v7.0-rc5 commit e5b31d988a41549037b8d8721a3c3cae893d8670 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14025 CVE: CVE-2026-23394 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Igor Ushakov reported that GC purged the receive queue of an alive socket due to a race with MSG_PEEK with a nice repro. This is the exact same issue previously fixed by commit cbcf01128d0a ("af_unix: fix garbage collect vs MSG_PEEK"). After GC was replaced with the current algorithm, the cited commit removed the locking dance in unix_peek_fds() and reintroduced the same issue. The problem is that MSG_PEEK bumps a file refcount without interacting with GC. Consider an SCC containing sk-A and sk-B, where sk-A is close()d but can be recv()ed via sk-B. The bad thing happens if sk-A is recv()ed with MSG_PEEK from sk-B and sk-B is close()d while GC is checking unix_vertex_dead() for sk-A and sk-B. GC thread User thread --------- ----------- unix_vertex_dead(sk-A) -> true <------. \ `------ recv(sk-B, MSG_PEEK) invalidate !! -> sk-A's file refcount : 1 -> 2 close(sk-B) -> sk-B's file refcount : 2 -> 1 unix_vertex_dead(sk-B) -> true Initially, sk-A's file refcount is 1 by the inflight fd in sk-B recvq. GC thinks sk-A is dead because the file refcount is the same as the number of its inflight fds. However, sk-A's file refcount is bumped silently by MSG_PEEK, which invalidates the previous evaluation. At this moment, sk-B's file refcount is 2; one by the open fd, and one by the inflight fd in sk-A. The subsequent close() releases one refcount by the former. Finally, GC incorrectly concludes that both sk-A and sk-B are dead. One option is to restore the locking dance in unix_peek_fds(), but we can resolve this more elegantly thanks to the new algorithm. The point is that the issue does not occur without the subsequent close() and we actually do not need to synchronise MSG_PEEK with the dead SCC detection. When the issue occurs, close() and GC touch the same file refcount. If GC sees the refcount being decremented by close(), it can just give up garbage-collecting the SCC. Therefore, we only need to signal the race during MSG_PEEK with a proper memory barrier to make it visible to the GC. Let's use seqcount_t to notify GC when MSG_PEEK occurs and let it defer the SCC to the next run. This way no locking is needed on the MSG_PEEK side, and we can avoid imposing a penalty on every MSG_PEEK unnecessarily. Note that we can retry within unix_scc_dead() if MSG_PEEK is detected, but we do not do so to avoid hung task splat from abusive MSG_PEEK calls. Fixes: 118f457da9ed ("af_unix: Remove lock dance in unix_peek_fds().") Reported-by: Igor Ushakov <sysroot314(a)gmail.com> Signed-off-by: Kuniyuki Iwashima <kuniyu(a)google.com> Link: https://patch.msgid.link/20260311054043.1231316-1-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/unix/af_unix.h include/net/af_unix.h net/unix/garbage.c [conflicts due to not merge 58b47c713711 ("af_unix: Count cyclic SCC.") and da8fc7a39be8 ("af_unix: Don't trigger GC from close() if unnecessary.") and 84960bf24031 ("af_unix: Move internal definitions to net/unix/.").] Signed-off-by: Li Xiasong <lixiasong1(a)huawei.com> --- include/net/af_unix.h | 1 + net/unix/af_unix.c | 2 ++ net/unix/garbage.c | 79 ++++++++++++++++++++++++++++--------------- 3 files changed, 54 insertions(+), 28 deletions(-) diff --git a/include/net/af_unix.h b/include/net/af_unix.h index b6eedf7650da..d2fa6d9f1e97 100644 --- a/include/net/af_unix.h +++ b/include/net/af_unix.h @@ -23,6 +23,7 @@ void unix_del_edges(struct scm_fp_list *fpl); void unix_update_edges(struct unix_sock *receiver); int unix_prepare_fpl(struct scm_fp_list *fpl); void unix_destroy_fpl(struct scm_fp_list *fpl); +void unix_peek_fpl(struct scm_fp_list *fpl); void unix_gc(void); void wait_for_unix_gc(struct scm_fp_list *fpl); diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c index abf9fe35e620..4407d4fedb02 100644 --- a/net/unix/af_unix.c +++ b/net/unix/af_unix.c @@ -1848,6 +1848,8 @@ static void unix_detach_fds(struct scm_cookie *scm, struct sk_buff *skb) static void unix_peek_fds(struct scm_cookie *scm, struct sk_buff *skb) { scm->fp = scm_fp_dup(UNIXCB(skb).fp); + + unix_peek_fpl(scm->fp); } static void unix_destruct_scm(struct sk_buff *skb) diff --git a/net/unix/garbage.c b/net/unix/garbage.c index 66fd606c43f4..1cdb54c61619 100644 --- a/net/unix/garbage.c +++ b/net/unix/garbage.c @@ -306,6 +306,25 @@ void unix_destroy_fpl(struct scm_fp_list *fpl) unix_free_vertices(fpl); } +static bool gc_in_progress; +static seqcount_t unix_peek_seq = SEQCNT_ZERO(unix_peek_seq); + +void unix_peek_fpl(struct scm_fp_list *fpl) +{ + static DEFINE_SPINLOCK(unix_peek_lock); + + if (!fpl || !fpl->count_unix) + return; + + if (!READ_ONCE(gc_in_progress)) + return; + + /* Invalidate the final refcnt check in unix_vertex_dead(). */ + spin_lock(&unix_peek_lock); + raw_write_seqcount_barrier(&unix_peek_seq); + spin_unlock(&unix_peek_lock); +} + static bool unix_vertex_dead(struct unix_vertex *vertex) { struct unix_edge *edge; @@ -339,6 +358,36 @@ static bool unix_vertex_dead(struct unix_vertex *vertex) return true; } +static LIST_HEAD(unix_visited_vertices); +static unsigned long unix_vertex_grouped_index = UNIX_VERTEX_INDEX_MARK2; + +static bool unix_scc_dead(struct list_head *scc, bool fast) +{ + struct unix_vertex *vertex; + bool scc_dead = true; + unsigned int seq; + + seq = read_seqcount_begin(&unix_peek_seq); + + list_for_each_entry_reverse(vertex, scc, scc_entry) { + /* Don't restart DFS from this vertex. */ + list_move_tail(&vertex->entry, &unix_visited_vertices); + + /* Mark vertex as off-stack for __unix_walk_scc(). */ + if (!fast) + vertex->index = unix_vertex_grouped_index; + + if (scc_dead) + scc_dead = unix_vertex_dead(vertex); + } + + /* If MSG_PEEK intervened, defer this SCC to the next round. */ + if (read_seqcount_retry(&unix_peek_seq, seq)) + return false; + + return scc_dead; +} + static void unix_collect_skb(struct list_head *scc, struct sk_buff_head *hitlist) { struct unix_vertex *vertex; @@ -392,9 +441,6 @@ static bool unix_scc_cyclic(struct list_head *scc) return false; } -static LIST_HEAD(unix_visited_vertices); -static unsigned long unix_vertex_grouped_index = UNIX_VERTEX_INDEX_MARK2; - static void __unix_walk_scc(struct unix_vertex *vertex, unsigned long *last_index, struct sk_buff_head *hitlist) { @@ -460,9 +506,7 @@ static void __unix_walk_scc(struct unix_vertex *vertex, unsigned long *last_inde } if (vertex->index == vertex->scc_index) { - struct unix_vertex *v; struct list_head scc; - bool scc_dead = true; /* SCC finalised. * @@ -471,18 +515,7 @@ static void __unix_walk_scc(struct unix_vertex *vertex, unsigned long *last_inde */ __list_cut_position(&scc, &vertex_stack, &vertex->scc_entry); - list_for_each_entry_reverse(v, &scc, scc_entry) { - /* Don't restart DFS from this vertex in unix_walk_scc(). */ - list_move_tail(&v->entry, &unix_visited_vertices); - - /* Mark vertex as off-stack. */ - v->index = unix_vertex_grouped_index; - - if (scc_dead) - scc_dead = unix_vertex_dead(v); - } - - if (scc_dead) { + if (unix_scc_dead(&scc, false)) { unix_collect_skb(&scc, hitlist); } else { if (unix_vertex_max_scc_index < vertex->scc_index) @@ -530,19 +563,11 @@ static void unix_walk_scc_fast(struct sk_buff_head *hitlist) while (!list_empty(&unix_unvisited_vertices)) { struct unix_vertex *vertex; struct list_head scc; - bool scc_dead = true; vertex = list_first_entry(&unix_unvisited_vertices, typeof(*vertex), entry); list_add(&scc, &vertex->scc_entry); - list_for_each_entry_reverse(vertex, &scc, scc_entry) { - list_move_tail(&vertex->entry, &unix_visited_vertices); - - if (scc_dead) - scc_dead = unix_vertex_dead(vertex); - } - - if (scc_dead) + if (unix_scc_dead(&scc, true)) unix_collect_skb(&scc, hitlist); else if (!unix_graph_maybe_cyclic) unix_graph_maybe_cyclic = unix_scc_cyclic(&scc); @@ -553,8 +578,6 @@ static void unix_walk_scc_fast(struct sk_buff_head *hitlist) list_replace_init(&unix_visited_vertices, &unix_unvisited_vertices); } -static bool gc_in_progress; - static void __unix_gc(struct work_struct *work) { struct sk_buff_head hitlist; -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] ip6_tunnel: fix skb_vlan_inet_prepare() return value handling regression
by Li Xiasong 02 Apr '26

02 Apr '26

This patchset contains a backport of the upstream change that introduced the issue, followed by the fix. Patch 1 is a backport of upstream commit f478b8239d65 ("net: tunnel: make skb_vlan_inet_prepare() return drop reasons") which changed the return value semantics of skb_vlan_inet_prepare(). Patch 2 adapts the return value handling in __ip6_tnl_rcv() to match the new semantics, fixing the regression. Including the upstream change as patch 1 ensures that applying both patches together does not introduce the issue that would occur if only patch 1 were merged. Li Xiasong (1): ip6_tunnel: adapt to skb_vlan_inet_prepare() return value change Menglong Dong (1): net: tunnel: make skb_vlan_inet_prepare() return drop reasons drivers/net/bareudp.c | 4 ++-- drivers/net/geneve.c | 4 ++-- include/net/ip_tunnels.h | 13 ++++++++----- net/ipv6/ip6_tunnel.c | 2 +- 4 files changed, 13 insertions(+), 10 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10] KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE
by Zhang Kunbo 02 Apr '26

02 Apr '26

From: Sean Christopherson <seanjc(a)google.com> mainline inclusion from mainline-v7.0-rc6 commit aad885e774966e97b675dfe928da164214a71605 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14045 CVE: CVE-2026-23401 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- When installing an emulated MMIO SPTE, do so *after* dropping/zapping the existing SPTE (if it's shadow-present). While commit a54aa15c6bda3 was right about it being impossible to convert a shadow-present SPTE to an MMIO SPTE due to a _guest_ write, it failed to account for writes to guest memory that are outside the scope of KVM. E.g. if host userspace modifies a shadowed gPTE to switch from a memslot to emulted MMIO and then the guest hits a relevant page fault, KVM will install the MMIO SPTE without first zapping the shadow-present SPTE. ------------[ cut here ]------------ is_shadow_present_pte(*sptep) WARNING: arch/x86/kvm/mmu/mmu.c:484 at mark_mmio_spte+0xb2/0xc0 [kvm], CPU#0: vmx_ept_stale_r/4292 Modules linked in: kvm_intel kvm irqbypass CPU: 0 UID: 1000 PID: 4292 Comm: vmx_ept_stale_r Not tainted 7.0.0-rc2-eafebd2d2ab0-sink-vm #319 PREEMPT Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:mark_mmio_spte+0xb2/0xc0 [kvm] Call Trace: <TASK> mmu_set_spte+0x237/0x440 [kvm] ept_page_fault+0x535/0x7f0 [kvm] kvm_mmu_do_page_fault+0xee/0x1f0 [kvm] kvm_mmu_page_fault+0x8d/0x620 [kvm] vmx_handle_exit+0x18c/0x5a0 [kvm_intel] kvm_arch_vcpu_ioctl_run+0xc55/0x1c20 [kvm] kvm_vcpu_ioctl+0x2d5/0x980 [kvm] __x64_sys_ioctl+0x8a/0xd0 do_syscall_64+0xb5/0x730 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x47fa3f </TASK> ---[ end trace 0000000000000000 ]--- Reported-by: Alexander Bulekov <bkov(a)amazon.com> Debugged-by: Alexander Bulekov <bkov(a)amazon.com> Suggested-by: Fred Griffoul <fgriffo(a)amazon.co.uk> Fixes: a54aa15c6bda3 ("KVM: x86/mmu: Handle MMIO SPTEs directly in mmu_set_spte()") Cc: stable(a)vger.kernel.org Signed-off-by: Sean Christopherson <seanjc(a)google.com> Conflicts: arch/x86/kvm/mmu/mmu.c [1075d41-not-merged,-and-context-conflicts] Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- arch/x86/kvm/mmu/mmu.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c index 0fee502a5f29..6ee54414295b 100755 --- a/arch/x86/kvm/mmu/mmu.c +++ b/arch/x86/kvm/mmu/mmu.c @@ -2820,11 +2820,6 @@ static int mmu_set_spte(struct kvm_vcpu *vcpu, struct kvm_memory_slot *slot, pgprintk("%s: spte %llx write_fault %d gfn %llx\n", __func__, *sptep, write_fault, gfn); - if (unlikely(is_noslot_pfn(pfn))) { - mark_mmio_spte(vcpu, sptep, gfn, pte_access); - return RET_PF_EMULATE; - } - if (is_shadow_present_pte(*sptep)) { /* * If we overwrite a PTE page pointer with a 2MB PMD, unlink @@ -2846,6 +2841,13 @@ static int mmu_set_spte(struct kvm_vcpu *vcpu, struct kvm_memory_slot *slot, was_rmapped = 1; } + if (unlikely(is_noslot_pfn(pfn))) { + mark_mmio_spte(vcpu, sptep, gfn, pte_access); + if (flush) + kvm_flush_remote_tlbs_gfn(vcpu->kvm, gfn, level); + return RET_PF_EMULATE; + } + wrprot = make_spte(vcpu, sp, slot, pte_access, gfn, pfn, *sptep, prefetch, true, host_writable, &spte); -- 2.34.1

2 1

[PATCH OLK-6.6] KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE
by Zhang Kunbo 02 Apr '26

02 Apr '26

From: Sean Christopherson <seanjc(a)google.com> mainline inclusion from mainline-v7.0-rc6 commit aad885e774966e97b675dfe928da164214a71605 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14045 CVE: CVE-2026-23401 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- When installing an emulated MMIO SPTE, do so *after* dropping/zapping the existing SPTE (if it's shadow-present). While commit a54aa15c6bda3 was right about it being impossible to convert a shadow-present SPTE to an MMIO SPTE due to a _guest_ write, it failed to account for writes to guest memory that are outside the scope of KVM. E.g. if host userspace modifies a shadowed gPTE to switch from a memslot to emulted MMIO and then the guest hits a relevant page fault, KVM will install the MMIO SPTE without first zapping the shadow-present SPTE. ------------[ cut here ]------------ is_shadow_present_pte(*sptep) WARNING: arch/x86/kvm/mmu/mmu.c:484 at mark_mmio_spte+0xb2/0xc0 [kvm], CPU#0: vmx_ept_stale_r/4292 Modules linked in: kvm_intel kvm irqbypass CPU: 0 UID: 1000 PID: 4292 Comm: vmx_ept_stale_r Not tainted 7.0.0-rc2-eafebd2d2ab0-sink-vm #319 PREEMPT Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:mark_mmio_spte+0xb2/0xc0 [kvm] Call Trace: <TASK> mmu_set_spte+0x237/0x440 [kvm] ept_page_fault+0x535/0x7f0 [kvm] kvm_mmu_do_page_fault+0xee/0x1f0 [kvm] kvm_mmu_page_fault+0x8d/0x620 [kvm] vmx_handle_exit+0x18c/0x5a0 [kvm_intel] kvm_arch_vcpu_ioctl_run+0xc55/0x1c20 [kvm] kvm_vcpu_ioctl+0x2d5/0x980 [kvm] __x64_sys_ioctl+0x8a/0xd0 do_syscall_64+0xb5/0x730 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x47fa3f </TASK> ---[ end trace 0000000000000000 ]--- Reported-by: Alexander Bulekov <bkov(a)amazon.com> Debugged-by: Alexander Bulekov <bkov(a)amazon.com> Suggested-by: Fred Griffoul <fgriffo(a)amazon.co.uk> Fixes: a54aa15c6bda ("KVM: x86/mmu: Handle MMIO SPTEs directly in mmu_set_spte()") Cc: stable(a)vger.kernel.org Signed-off-by: Sean Christopherson <seanjc(a)google.com> Conflicts: arch/x86/kvm/mmu/mmu.c [Context conflicts.] Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- arch/x86/kvm/mmu/mmu.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c index c54c8385b16d..2837f83b807d 100644 --- a/arch/x86/kvm/mmu/mmu.c +++ b/arch/x86/kvm/mmu/mmu.c @@ -2914,12 +2914,6 @@ static int mmu_set_spte(struct kvm_vcpu *vcpu, struct kvm_memory_slot *slot, bool prefetch = !fault || fault->prefetch; bool write_fault = fault && fault->write; - if (unlikely(is_noslot_pfn(pfn))) { - vcpu->stat.pf_mmio_spte_created++; - mark_mmio_spte(vcpu, sptep, gfn, pte_access); - return RET_PF_EMULATE; - } - if (is_shadow_present_pte(*sptep)) { /* * If we overwrite a PTE page pointer with a 2MB PMD, unlink @@ -2939,6 +2933,14 @@ static int mmu_set_spte(struct kvm_vcpu *vcpu, struct kvm_memory_slot *slot, was_rmapped = 1; } + if (unlikely(is_noslot_pfn(pfn))) { + vcpu->stat.pf_mmio_spte_created++; + mark_mmio_spte(vcpu, sptep, gfn, pte_access); + if (flush) + kvm_flush_remote_tlbs_gfn(vcpu->kvm, gfn, level); + return RET_PF_EMULATE; + } + wrprot = make_spte(vcpu, sp, slot, pte_access, gfn, pfn, *sptep, prefetch, true, host_writable, &spte); -- 2.34.1

2 1

[PATCH OLK-6.6] KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE
by Zhang Kunbo 02 Apr '26

02 Apr '26

From: Sean Christopherson <seanjc(a)google.com> stable inclusion from stable-v7.0-rc6 commit aad885e774966e97b675dfe928da164214a71605 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14045 CVE: CVE-2026-23401 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- When installing an emulated MMIO SPTE, do so *after* dropping/zapping the existing SPTE (if it's shadow-present). While commit a54aa15c6bda3 was right about it being impossible to convert a shadow-present SPTE to an MMIO SPTE due to a _guest_ write, it failed to account for writes to guest memory that are outside the scope of KVM. E.g. if host userspace modifies a shadowed gPTE to switch from a memslot to emulted MMIO and then the guest hits a relevant page fault, KVM will install the MMIO SPTE without first zapping the shadow-present SPTE. ------------[ cut here ]------------ is_shadow_present_pte(*sptep) WARNING: arch/x86/kvm/mmu/mmu.c:484 at mark_mmio_spte+0xb2/0xc0 [kvm], CPU#0: vmx_ept_stale_r/4292 Modules linked in: kvm_intel kvm irqbypass CPU: 0 UID: 1000 PID: 4292 Comm: vmx_ept_stale_r Not tainted 7.0.0-rc2-eafebd2d2ab0-sink-vm #319 PREEMPT Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:mark_mmio_spte+0xb2/0xc0 [kvm] Call Trace: <TASK> mmu_set_spte+0x237/0x440 [kvm] ept_page_fault+0x535/0x7f0 [kvm] kvm_mmu_do_page_fault+0xee/0x1f0 [kvm] kvm_mmu_page_fault+0x8d/0x620 [kvm] vmx_handle_exit+0x18c/0x5a0 [kvm_intel] kvm_arch_vcpu_ioctl_run+0xc55/0x1c20 [kvm] kvm_vcpu_ioctl+0x2d5/0x980 [kvm] __x64_sys_ioctl+0x8a/0xd0 do_syscall_64+0xb5/0x730 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x47fa3f </TASK> ---[ end trace 0000000000000000 ]--- Reported-by: Alexander Bulekov <bkov(a)amazon.com> Debugged-by: Alexander Bulekov <bkov(a)amazon.com> Suggested-by: Fred Griffoul <fgriffo(a)amazon.co.uk> Fixes: a54aa15c6bda ("KVM: x86/mmu: Handle MMIO SPTEs directly in mmu_set_spte()") Cc: stable(a)vger.kernel.org Signed-off-by: Sean Christopherson <seanjc(a)google.com> Conflicts: arch/x86/kvm/mmu/mmu.c [Context conflicts.] Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- arch/x86/kvm/mmu/mmu.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c index c54c8385b16d..2837f83b807d 100644 --- a/arch/x86/kvm/mmu/mmu.c +++ b/arch/x86/kvm/mmu/mmu.c @@ -2914,12 +2914,6 @@ static int mmu_set_spte(struct kvm_vcpu *vcpu, struct kvm_memory_slot *slot, bool prefetch = !fault || fault->prefetch; bool write_fault = fault && fault->write; - if (unlikely(is_noslot_pfn(pfn))) { - vcpu->stat.pf_mmio_spte_created++; - mark_mmio_spte(vcpu, sptep, gfn, pte_access); - return RET_PF_EMULATE; - } - if (is_shadow_present_pte(*sptep)) { /* * If we overwrite a PTE page pointer with a 2MB PMD, unlink @@ -2939,6 +2933,14 @@ static int mmu_set_spte(struct kvm_vcpu *vcpu, struct kvm_memory_slot *slot, was_rmapped = 1; } + if (unlikely(is_noslot_pfn(pfn))) { + vcpu->stat.pf_mmio_spte_created++; + mark_mmio_spte(vcpu, sptep, gfn, pte_access); + if (flush) + kvm_flush_remote_tlbs_gfn(vcpu->kvm, gfn, level); + return RET_PF_EMULATE; + } + wrprot = make_spte(vcpu, sp, slot, pte_access, gfn, pfn, *sptep, prefetch, true, host_writable, &spte); -- 2.34.1

2 1

[PATCH OLK-6.6] KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE
by Zhang Kunbo 02 Apr '26

02 Apr '26

From: Sean Christopherson <seanjc(a)google.com> stable inclusion from stable-v7.0-rc6 commit aad885e774966e97b675dfe928da164214a71605 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14045 CVE: CVE-2026-23401 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- When installing an emulated MMIO SPTE, do so *after* dropping/zapping the existing SPTE (if it's shadow-present). While commit a54aa15c6bda3 was right about it being impossible to convert a shadow-present SPTE to an MMIO SPTE due to a _guest_ write, it failed to account for writes to guest memory that are outside the scope of KVM. E.g. if host userspace modifies a shadowed gPTE to switch from a memslot to emulted MMIO and then the guest hits a relevant page fault, KVM will install the MMIO SPTE without first zapping the shadow-present SPTE. ------------[ cut here ]------------ is_shadow_present_pte(*sptep) WARNING: arch/x86/kvm/mmu/mmu.c:484 at mark_mmio_spte+0xb2/0xc0 [kvm], CPU#0: vmx_ept_stale_r/4292 Modules linked in: kvm_intel kvm irqbypass CPU: 0 UID: 1000 PID: 4292 Comm: vmx_ept_stale_r Not tainted 7.0.0-rc2-eafebd2d2ab0-sink-vm #319 PREEMPT Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:mark_mmio_spte+0xb2/0xc0 [kvm] Call Trace: <TASK> mmu_set_spte+0x237/0x440 [kvm] ept_page_fault+0x535/0x7f0 [kvm] kvm_mmu_do_page_fault+0xee/0x1f0 [kvm] kvm_mmu_page_fault+0x8d/0x620 [kvm] vmx_handle_exit+0x18c/0x5a0 [kvm_intel] kvm_arch_vcpu_ioctl_run+0xc55/0x1c20 [kvm] kvm_vcpu_ioctl+0x2d5/0x980 [kvm] __x64_sys_ioctl+0x8a/0xd0 do_syscall_64+0xb5/0x730 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x47fa3f </TASK> ---[ end trace 0000000000000000 ]--- Reported-by: Alexander Bulekov <bkov(a)amazon.com> Debugged-by: Alexander Bulekov <bkov(a)amazon.com> Suggested-by: Fred Griffoul <fgriffo(a)amazon.co.uk> Fixes: a54aa15c6bda3 ("KVM: x86/mmu: Handle MMIO SPTEs directly in mmu_set_spte()") Cc: stable(a)vger.kernel.org Signed-off-by: Sean Christopherson <seanjc(a)google.com> Conflicts: arch/x86/kvm/mmu/mmu.c [Context conflicts.] Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- arch/x86/kvm/mmu/mmu.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c index c54c8385b16d..2837f83b807d 100644 --- a/arch/x86/kvm/mmu/mmu.c +++ b/arch/x86/kvm/mmu/mmu.c @@ -2914,12 +2914,6 @@ static int mmu_set_spte(struct kvm_vcpu *vcpu, struct kvm_memory_slot *slot, bool prefetch = !fault || fault->prefetch; bool write_fault = fault && fault->write; - if (unlikely(is_noslot_pfn(pfn))) { - vcpu->stat.pf_mmio_spte_created++; - mark_mmio_spte(vcpu, sptep, gfn, pte_access); - return RET_PF_EMULATE; - } - if (is_shadow_present_pte(*sptep)) { /* * If we overwrite a PTE page pointer with a 2MB PMD, unlink @@ -2939,6 +2933,14 @@ static int mmu_set_spte(struct kvm_vcpu *vcpu, struct kvm_memory_slot *slot, was_rmapped = 1; } + if (unlikely(is_noslot_pfn(pfn))) { + vcpu->stat.pf_mmio_spte_created++; + mark_mmio_spte(vcpu, sptep, gfn, pte_access); + if (flush) + kvm_flush_remote_tlbs_gfn(vcpu->kvm, gfn, level); + return RET_PF_EMULATE; + } + wrprot = make_spte(vcpu, sp, slot, pte_access, gfn, pfn, *sptep, prefetch, true, host_writable, &spte); -- 2.34.1

2 1

[PATCH OLK-5.10] KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE
by Zhang Kunbo 02 Apr '26

02 Apr '26

From: Sean Christopherson <seanjc(a)google.com> stable inclusion from stable-v6.6.130 commit 3990f352bb0adc8688d0949a9c13e3110570eb61 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13978 CVE: CVE-2026-23303 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- When installing an emulated MMIO SPTE, do so *after* dropping/zapping the existing SPTE (if it's shadow-present). While commit a54aa15c6bda3 was right about it being impossible to convert a shadow-present SPTE to an MMIO SPTE due to a _guest_ write, it failed to account for writes to guest memory that are outside the scope of KVM. E.g. if host userspace modifies a shadowed gPTE to switch from a memslot to emulted MMIO and then the guest hits a relevant page fault, KVM will install the MMIO SPTE without first zapping the shadow-present SPTE. ------------[ cut here ]------------ is_shadow_present_pte(*sptep) WARNING: arch/x86/kvm/mmu/mmu.c:484 at mark_mmio_spte+0xb2/0xc0 [kvm], CPU#0: vmx_ept_stale_r/4292 Modules linked in: kvm_intel kvm irqbypass CPU: 0 UID: 1000 PID: 4292 Comm: vmx_ept_stale_r Not tainted 7.0.0-rc2-eafebd2d2ab0-sink-vm #319 PREEMPT Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:mark_mmio_spte+0xb2/0xc0 [kvm] Call Trace: <TASK> mmu_set_spte+0x237/0x440 [kvm] ept_page_fault+0x535/0x7f0 [kvm] kvm_mmu_do_page_fault+0xee/0x1f0 [kvm] kvm_mmu_page_fault+0x8d/0x620 [kvm] vmx_handle_exit+0x18c/0x5a0 [kvm_intel] kvm_arch_vcpu_ioctl_run+0xc55/0x1c20 [kvm] kvm_vcpu_ioctl+0x2d5/0x980 [kvm] __x64_sys_ioctl+0x8a/0xd0 do_syscall_64+0xb5/0x730 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x47fa3f </TASK> ---[ end trace 0000000000000000 ]--- Reported-by: Alexander Bulekov <bkov(a)amazon.com> Debugged-by: Alexander Bulekov <bkov(a)amazon.com> Suggested-by: Fred Griffoul <fgriffo(a)amazon.co.uk> Fixes: a54aa15c6bda3 ("KVM: x86/mmu: Handle MMIO SPTEs directly in mmu_set_spte()") Cc: stable(a)vger.kernel.org Signed-off-by: Sean Christopherson <seanjc(a)google.com> Conflicts: arch/x86/kvm/mmu/mmu.c [1075d41 not merged, and context conflicts] Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- arch/x86/kvm/mmu/mmu.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c index 0fee502a5f29..8d6f331d3a8f 100755 --- a/arch/x86/kvm/mmu/mmu.c +++ b/arch/x86/kvm/mmu/mmu.c @@ -2820,11 +2820,6 @@ static int mmu_set_spte(struct kvm_vcpu *vcpu, struct kvm_memory_slot *slot, pgprintk("%s: spte %llx write_fault %d gfn %llx\n", __func__, *sptep, write_fault, gfn); - if (unlikely(is_noslot_pfn(pfn))) { - mark_mmio_spte(vcpu, sptep, gfn, pte_access); - return RET_PF_EMULATE; - } - if (is_shadow_present_pte(*sptep)) { /* * If we overwrite a PTE page pointer with a 2MB PMD, unlink @@ -2846,6 +2841,14 @@ static int mmu_set_spte(struct kvm_vcpu *vcpu, struct kvm_memory_slot *slot, was_rmapped = 1; } + if (unlikely(is_noslot_pfn(pfn))) { + vcpu->stat.pf_mmio_spte_created++; + mark_mmio_spte(vcpu, sptep, gfn, pte_access); + if (flush) + kvm_flush_remote_tlbs_gfn(vcpu->kvm, gfn, level); + return RET_PF_EMULATE; + } + wrprot = make_spte(vcpu, sp, slot, pte_access, gfn, pfn, *sptep, prefetch, true, host_writable, &spte); -- 2.34.1

2 1

[PATCH OLK-5.10] ice: Fix memory leak in ice_set_ringparam()
by Pan Taixi 02 Apr '26

02 Apr '26

From: Zilin Guan <zilin(a)seu.edu.cn> mainline inclusion from mainline-v7.0-rc3 commit fe868b499d16f55bbeea89992edb98043c9de416 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14020/ CVE: CVE-2026-23389 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In ice_set_ringparam, tx_rings and xdp_rings are allocated before rx_rings. If the allocation of rx_rings fails, the code jumps to the done label leaking both tx_rings and xdp_rings. Furthermore, if the setup of an individual Rx ring fails during the loop, the code jumps to the free_tx label which releases tx_rings but leaks xdp_rings. Fix this by introducing a free_xdp label and updating the error paths to ensure both xdp_rings and tx_rings are properly freed if rx_rings allocation or setup fails. Compile tested only. Issue found using a prototype static analysis tool and code review. Fixes: fcea6f3da546 ("ice: Add stats and ethtool support") Fixes: efc2214b6047 ("ice: Add support for XDP") Signed-off-by: Zilin Guan <zilin(a)seu.edu.cn> Reviewed-by: Paul Menzel <pmenzel(a)molgen.mpg.de> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov(a)intel.com> Tested-by: Rinitha S <sx.rinitha(a)intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com> Conflicts: drivers/net/ethernet/intel/ice/ice_ethtool.c [ Context conflicts due to different memory allocation function used. Also, ice_for_each_xdp_txq is introduced in unmmerged commit 2faf63b650bb ("ice: make use of ice_for_each_* macros"), use normal for loops here instead. ] Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com> --- drivers/net/ethernet/intel/ice/ice_ethtool.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c b/drivers/net/ethernet/intel/ice/ice_ethtool.c index 9659668279dc..0d6965b5deb4 100644 --- a/drivers/net/ethernet/intel/ice/ice_ethtool.c +++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c @@ -2865,7 +2865,7 @@ ice_set_ringparam(struct net_device *netdev, struct ethtool_ringparam *ring, rx_rings = kcalloc(vsi->num_rxq, sizeof(*rx_rings), GFP_KERNEL); if (!rx_rings) { err = -ENOMEM; - goto done; + goto free_xdp; } ice_for_each_rxq(vsi, i) { @@ -2894,7 +2894,7 @@ ice_set_ringparam(struct net_device *netdev, struct ethtool_ringparam *ring, } kfree(rx_rings); err = -ENOMEM; - goto free_tx; + goto free_xdp; } } @@ -2945,6 +2945,14 @@ ice_set_ringparam(struct net_device *netdev, struct ethtool_ringparam *ring, } goto done; +free_xdp: + if (xdp_rings) { + for (i = 0; i < vsi->num_xdp_txq; i++) { + ice_free_tx_ring(vsi->xdp_rings[i]); + } + kfree(xdp_rings); + } + free_tx: /* error cleanup if the Rx allocations failed after getting Tx */ if (tx_rings) { -- 2.34.1

2 1