- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] crash: fix crashkernel resource shrink
by Tengda Wu 20 Nov '25

20 Nov '25

From: Sourabh Jain <sourabhjain(a)linux.ibm.com> mainline inclusion from mainline-v6.18-rc6 commit 00fbff75c5acb4755f06f08bd1071879c63940c5 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID7OIL Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When crashkernel is configured with a high reservation, shrinking its value below the low crashkernel reservation causes two issues: 1. Invalid crashkernel resource objects 2. Kernel crash if crashkernel shrinking is done twice For example, with crashkernel=200M,high, the kernel reserves 200MB of high memory and some default low memory (say 256MB). The reservation appears as: cat /proc/iomem | grep -i crash af000000-beffffff : Crash kernel 433000000-43f7fffff : Crash kernel If crashkernel is then shrunk to 50MB (echo 52428800 > /sys/kernel/kexec_crash_size), /proc/iomem still shows 256MB reserved: af000000-beffffff : Crash kernel Instead, it should show 50MB: af000000-b21fffff : Crash kernel Further shrinking crashkernel to 40MB causes a kernel crash with the following trace (x86): BUG: kernel NULL pointer dereference, address: 0000000000000038 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI <snip...> Call Trace: <TASK> ? __die_body.cold+0x19/0x27 ? page_fault_oops+0x15a/0x2f0 ? search_module_extables+0x19/0x60 ? search_bpf_extables+0x5f/0x80 ? exc_page_fault+0x7e/0x180 ? asm_exc_page_fault+0x26/0x30 ? __release_resource+0xd/0xb0 release_resource+0x26/0x40 __crash_shrink_memory+0xe5/0x110 crash_shrink_memory+0x12a/0x190 kexec_crash_size_store+0x41/0x80 kernfs_fop_write_iter+0x141/0x1f0 vfs_write+0x294/0x460 ksys_write+0x6d/0xf0 <snip...> This happens because __crash_shrink_memory()/kernel/crash_core.c incorrectly updates the crashk_res resource object even when crashk_low_res should be updated. Fix this by ensuring the correct crashkernel resource object is updated when shrinking crashkernel memory. Link: https://lkml.kernel.org/r/20251101193741.289252-1-sourabhjain@linux.ibm.com Fixes: 16c6006af4d4 ("kexec: enable kexec_crash_size to support two crash kernel regions") Signed-off-by: Sourabh Jain <sourabhjain(a)linux.ibm.com> Acked-by: Baoquan He <bhe(a)redhat.com> Cc: Zhen Lei <thunder.leizhen(a)huawei.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: kernel/kexec_core.c [The commit 02aff8480533 ("crash: split crash dumping code out from kexec_core.c") for reorgnizing code is not merged yet] Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/kexec_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/kexec_core.c b/kernel/kexec_core.c index b7246b7171b7..88024cb22a9d 100644 --- a/kernel/kexec_core.c +++ b/kernel/kexec_core.c @@ -1132,7 +1132,7 @@ static int __crash_shrink_memory(struct resource *old_res, old_res->start = 0; old_res->end = 0; } else { - crashk_res.end = ram_res->start - 1; + old_res->end = ram_res->start - 1; } crash_free_reserved_phys_range(ram_res->start, ram_res->end); -- 2.34.1

2 1

[PATCH OLK-6.6 0/7] xcall2.0: bugfix for prefetch ko
by Xinyu Zheng 20 Nov '25

20 Nov '25

Xinyu Zheng (7): xcall2.0: fix value name typos in __do_sys_epoll_pwait xcall2.0: prefetch: keep prefetch module name same with file name xcall2.0: prefetch: fix memory leak when release prefetch item through mmu notifier xcall2.0: add a per xcall_area mmu notifier for kernel module to do release callback xcall2.0: prefetch: set MAX support prefetch fd number to 1024 xcall2.0: prefetch: epoll_ctl no need to occupy a file refcount xcall2.0: add xcall_subdir_create and xcall_proc_create arch/arm64/include/asm/xcall.h | 2 + arch/arm64/kernel/xcall/core.c | 3 + arch/arm64/kernel/xcall/proc.c | 17 ++++- drivers/staging/xcall/prefetch.c | 109 +++++++++++++++++++------------ include/linux/xcall.h | 4 ++ 5 files changed, 90 insertions(+), 45 deletions(-) -- 2.34.1

2 8

[OLK-6.6 0/7] xcall2.0: bugfix for prefetch ko
by Xinyu Zheng 20 Nov '25

20 Nov '25

Xinyu Zheng (7): xcall2.0: fix value name typos in __do_sys_epoll_pwait xcall2.0: prefetch: keep prefetch module name same with file name xcall2.0: prefetch: fix memory leak when release prefetch item through mmu notifier xcall2.0: add a per xcall_area mmu notifier for kernel module to do release callback xcall2.0: prefetch: set MAX support prefetch fd number to 1024 xcall2.0: prefetch: epoll_ctl no need to occupy a file refcount xcall2.0: add xcall_subdir_create and xcall_proc_create arch/arm64/include/asm/xcall.h | 2 + arch/arm64/kernel/xcall/core.c | 3 + arch/arm64/kernel/xcall/proc.c | 17 ++++- drivers/staging/xcall/prefetch.c | 109 +++++++++++++++++++------------ include/linux/xcall.h | 4 ++ 5 files changed, 90 insertions(+), 45 deletions(-) -- 2.34.1

1 7

[PATCH OLK-6.6] ext4: guard against EA inode refcount underflow in xattr update
by Zizhi Wo 20 Nov '25

20 Nov '25

From: Ahmet Eray Karadag <eraykrdg1(a)gmail.com> stable inclusion from stable-v6.6.113 commit 79ea7f3e11effe1bd9e753172981d9029133a278 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6BVW CVE: CVE-2025-40190 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 57295e835408d8d425bef58da5253465db3d6888 upstream. syzkaller found a path where ext4_xattr_inode_update_ref() reads an EA inode refcount that is already <= 0 and then applies ref_change (often -1). That lets the refcount underflow and we proceed with a bogus value, triggering errors like: EXT4-fs error: EA inode <n> ref underflow: ref_count=-1 ref_change=-1 EXT4-fs warning: ea_inode dec ref err=-117 Make the invariant explicit: if the current refcount is non-positive, treat this as on-disk corruption, emit ext4_error_inode(), and fail the operation with -EFSCORRUPTED instead of updating the refcount. Delete the WARN_ONCE() as negative refcounts are now impossible; keep error reporting in ext4_error_inode(). This prevents the underflow and the follow-on orphan/cleanup churn. Reported-by: syzbot+0be4f339a8218d2a5bb1(a)syzkaller.appspotmail.com Fixes: https://syzbot.org/bug?extid=0be4f339a8218d2a5bb1 Cc: stable(a)kernel.org Co-developed-by: Albin Babu Varghese <albinbabuvarghese20(a)gmail.com> Signed-off-by: Albin Babu Varghese <albinbabuvarghese20(a)gmail.com> Signed-off-by: Ahmet Eray Karadag <eraykrdg1(a)gmail.com> Message-ID: <20250920021342.45575-1-eraykrdg1(a)gmail.com> Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/ext4/xattr.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c index b6bdb253ad34..6ef8820625b9 100644 --- a/fs/ext4/xattr.c +++ b/fs/ext4/xattr.c @@ -1033,7 +1033,7 @@ static int ext4_xattr_inode_update_ref(handle_t *handle, struct inode *ea_inode, int ref_change) { struct ext4_iloc iloc; - s64 ref_count; + u64 ref_count; int ret; inode_lock_nested(ea_inode, I_MUTEX_XATTR); @@ -1043,13 +1043,17 @@ static int ext4_xattr_inode_update_ref(handle_t *handle, struct inode *ea_inode, goto out; ref_count = ext4_xattr_inode_get_ref(ea_inode); + if ((ref_count == 0 && ref_change < 0) || (ref_count == U64_MAX && ref_change > 0)) { + ext4_error_inode(ea_inode, __func__, __LINE__, 0, + "EA inode %lu ref wraparound: ref_count=%lld ref_change=%d", + ea_inode->i_ino, ref_count, ref_change); + ret = -EFSCORRUPTED; + goto out; + } ref_count += ref_change; ext4_xattr_inode_set_ref(ea_inode, ref_count); if (ref_change > 0) { - WARN_ONCE(ref_count <= 0, "EA inode %lu ref_count=%lld", - ea_inode->i_ino, ref_count); - if (ref_count == 1) { WARN_ONCE(ea_inode->i_nlink, "EA inode %lu i_nlink=%u", ea_inode->i_ino, ea_inode->i_nlink); @@ -1058,9 +1062,6 @@ static int ext4_xattr_inode_update_ref(handle_t *handle, struct inode *ea_inode, ext4_orphan_del(handle, ea_inode); } } else { - WARN_ONCE(ref_count < 0, "EA inode %lu ref_count=%lld", - ea_inode->i_ino, ref_count); - if (ref_count == 0) { WARN_ONCE(ea_inode->i_nlink != 1, "EA inode %lu i_nlink=%u", -- 2.46.1

2 1

[OLK-6.6 0/7] xcall2.0: bugfix for prefetch ko
by Xinyu Zheng 20 Nov '25

20 Nov '25

*** BLURB HERE *** Xinyu Zheng (7): xcall2.0: fix value name typos in __do_sys_epoll_pwait xcall2.0: prefetch: keep prefetch module name same with file name xcall2.0: prefetch: fix memory leak when release prefetch item through mmu notifier xcall2.0: add a per xcall_area mmu notifier for kernel module to do release callback xcall2.0: prefetch: set MAX support prefetch fd number to 1024 xcall2.0: prefetch: epoll_ctl no need to occupy a file refcount xcall2.0: add xcall_subdir_create and xcall_proc_create arch/arm64/include/asm/xcall.h | 2 + arch/arm64/kernel/xcall/core.c | 3 + arch/arm64/kernel/xcall/proc.c | 17 ++++- drivers/staging/xcall/prefetch.c | 109 +++++++++++++++++++------------ include/linux/xcall.h | 4 ++ 5 files changed, 90 insertions(+), 45 deletions(-) -- 2.34.1

1 0

[PATCH OLK-6.6] ext4: detect invalid INLINE_DATA + EXTENTS flag combination
by Zizhi Wo 20 Nov '25

20 Nov '25

From: Deepanshu Kartikey <kartikey406(a)gmail.com> stable inclusion from stable-v6.6.114 commit cb6039b68efa547b676a8a10fc4618d9d1865c23 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6BAP CVE: CVE-2025-40167 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 1d3ad183943b38eec2acf72a0ae98e635dc8456b upstream. syzbot reported a BUG_ON in ext4_es_cache_extent() when opening a verity file on a corrupted ext4 filesystem mounted without a journal. The issue is that the filesystem has an inode with both the INLINE_DATA and EXTENTS flags set: EXT4-fs error (device loop0): ext4_cache_extents:545: inode #15: comm syz.0.17: corrupted extent tree: lblk 0 < prev 66 Investigation revealed that the inode has both flags set: DEBUG: inode 15 - flag=1, i_inline_off=164, has_inline=1, extents_flag=1 This is an invalid combination since an inode should have either: - INLINE_DATA: data stored directly in the inode - EXTENTS: data stored in extent-mapped blocks Having both flags causes ext4_has_inline_data() to return true, skipping extent tree validation in __ext4_iget(). The unvalidated out-of-order extents then trigger a BUG_ON in ext4_es_cache_extent() due to integer underflow when calculating hole sizes. Fix this by detecting this invalid flag combination early in ext4_iget() and rejecting the corrupted inode. Cc: stable(a)kernel.org Reported-and-tested-by: syzbot+038b7bf43423e132b308(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=038b7bf43423e132b308 Suggested-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Deepanshu Kartikey <kartikey406(a)gmail.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Message-ID: <20250930112810.315095-1-kartikey406(a)gmail.com> Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/ext4/inode.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c index 045a7213d6b6..f09c64c5c76c 100644 --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -5528,6 +5528,14 @@ struct inode *__ext4_iget(struct super_block *sb, unsigned long ino, } ei->i_flags = le32_to_cpu(raw_inode->i_flags); ext4_set_inode_flags(inode, true); + /* Detect invalid flag combination - can't have both inline data and extents */ + if (ext4_test_inode_flag(inode, EXT4_INODE_INLINE_DATA) && + ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)) { + ext4_error_inode(inode, function, line, 0, + "inode has both inline data and extents flags"); + ret = -EFSCORRUPTED; + goto bad_inode; + } inode->i_blocks = ext4_inode_blocks(raw_inode, ei); ei->i_file_acl = le32_to_cpu(raw_inode->i_file_acl_lo); if (ext4_has_feature_64bit(sb)) -- 2.46.1

2 1

[PATCH OLK-6.6] [Backport] Bluetooth: ISO: Fix possible UAF on iso_conn_free
by Chen Jinghuang 20 Nov '25

20 Nov '25

From: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> stable inclusion from stable-v6.6.112 commit 5319145a07d8bf5b0782b25cb3115825689d42bb category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID6B6G CVE: CVE-2025-40141 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9950f095d6c875dbe0c9ebfcf972ec88fdf26fc8 ] This attempt to fix similar issue to sco_conn_free where if the conn->sk is not set to NULL may lead to UAF on iso_conn_free. Fixes: ccf74f2390d6 ("Bluetooth: Add BTPROTO_ISO socket type") Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- net/bluetooth/iso.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c index b94d202bf374..be71082d9eaf 100644 --- a/net/bluetooth/iso.c +++ b/net/bluetooth/iso.c @@ -718,6 +718,13 @@ static void iso_sock_kill(struct sock *sk) BT_DBG("sk %p state %d", sk, sk->sk_state); + /* Sock is dead, so set conn->sk to NULL to avoid possible UAF */ + if (iso_pi(sk)->conn) { + iso_conn_lock(iso_pi(sk)->conn); + iso_pi(sk)->conn->sk = NULL; + iso_conn_unlock(iso_pi(sk)->conn); + } + /* Kill poor orphan */ bt_sock_unlink(&iso_sk_list, sk); sock_set_flag(sk, SOCK_DEAD); -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] IPIV: fix bug in live migration
by Jinqian Yang 20 Nov '25

20 Nov '25

Patch#1: Change parameter from vcpu to kvm. IPIV is a per-VM feature. When checking whether IPIV is supported, it is more appropriate to use kvm as the input parameter. This change is also in preparation for the Patch#2 Patch#2: fix bug in live migration. If an environment has IPIV enabled and a VM also has IPIV enabled, when this VM is migrated to a host environment where IPIV is not enabled, the host will continuously print "vSGI trap! IPIV disabled!" This is because the destination host enabled the VM's IPIV without checking for IPIV support. Jinqian Yang (2): KVM: arm64: ipiv: Change parameter from vcpu to kvm KVM: arm64: ipiv: fix bug in live migration arch/arm64/kvm/hisilicon/hisi_virt.c | 10 +++++----- arch/arm64/kvm/hisilicon/hisi_virt.h | 4 ++-- arch/arm64/kvm/hypercalls.c | 6 +++--- arch/arm64/kvm/vgic/vgic-its.c | 4 +++- 4 files changed, 13 insertions(+), 11 deletions(-) -- 2.33.0

2 3

[PATCH OLK-6.6] crypto: rng - Ensure set_ent is always present
by Gu Bowen 20 Nov '25

20 Nov '25

From: Herbert Xu <herbert(a)gondor.apana.org.au> stable inclusion from stable-v6.6.111 commit ab172f4f42626549b02bada05f09e3f2b0cc26ec category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID5OZT CVE: CVE-2025-40109 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c0d36727bf39bb16ef0a67ed608e279535ebf0da upstream. Ensure that set_ent is always set since only drbg provides it. Fixes: 77ebdabe8de7 ("crypto: af_alg - add extra parameters for DRBG interface") Reported-by: Yiqi Sun <sunyiqixm(a)gmail.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- crypto/rng.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/crypto/rng.c b/crypto/rng.c index 279dffdebf59..e462031fef68 100644 --- a/crypto/rng.c +++ b/crypto/rng.c @@ -197,6 +197,11 @@ int crypto_del_default_rng(void) EXPORT_SYMBOL_GPL(crypto_del_default_rng); #endif +static void rng_default_set_ent(struct crypto_rng *tfm, const u8 *data, + unsigned int len) +{ +} + int crypto_register_rng(struct rng_alg *alg) { struct crypto_istat_rng *istat = rng_get_stat(alg); @@ -212,6 +217,9 @@ int crypto_register_rng(struct rng_alg *alg) if (IS_ENABLED(CONFIG_CRYPTO_STATS)) memset(istat, 0, sizeof(*istat)); + if (!alg->set_ent) + alg->set_ent = rng_default_set_ent; + return crypto_register_alg(base); } EXPORT_SYMBOL_GPL(crypto_register_rng); -- 2.43.0

2 1

[PATCH OLK-6.6] KVM: arm64: Fix access_actlr() build warning
by Jinjie Ruan 20 Nov '25

20 Nov '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/release-management/issues/IBV2E4 -------------------------------- If ACTLR_XCALL_XINT not set, the following issue occurs as val is not used without ACTLR_XCALL_XINT, so fix it by moving it into CONFIG_ACTLR_XCALL_XINT controlled code. arch/arm64/kvm/sys_regs.c: In function ‘access_actlr’: arch/arm64/kvm/sys_regs.c:283:26: warning: unused variable ‘val’ [-Wunused-variable] 283 | u64 mask, shift, val; | ^~~ Fixes: bd2967e62cdf ("arm64: Fix actlr_el1 can not set problem in guest") Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- arch/arm64/kvm/sys_regs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c index 73d5102e7a10..ded8d28d10a8 100644 --- a/arch/arm64/kvm/sys_regs.c +++ b/arch/arm64/kvm/sys_regs.c @@ -280,11 +280,11 @@ static bool access_actlr(struct kvm_vcpu *vcpu, struct sys_reg_params *p, const struct sys_reg_desc *r) { - u64 mask, shift, val; + u64 mask, shift; #ifdef CONFIG_ACTLR_XCALL_XINT if (p->is_write) { - val = vcpu_read_sys_reg(vcpu, r->reg); + u64 val = vcpu_read_sys_reg(vcpu, r->reg); val &= ~(ACTLR_ELx_XCALL | ACTLR_ELx_XINT); val |= (p->regval & (ACTLR_ELx_XCALL | ACTLR_ELx_XINT)); vcpu_write_sys_reg(vcpu, val, r->reg); -- 2.34.1

2 1