- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 v11 0/5] SMT QOS
by Jinjie Ruan 14 May '26

14 May '26

Cloud Service Provider deploy Best-Effort and Latency Sensitive tasks on the same physical core to maximize the resource utilization. We observe the LS task needs more cycles to complete the same workload due to the Microarchitectural resource contention. This feature control the instruction throughput of BE task into pipeline, so that the other SMT running LS task could occupy more uarch resources to reach better IPC. First split out QOS_LABEL from QOS_SCHED for SMT QoS reuse. The test results on 920G: | 1. online 30% | 基线 | 混布基线 | SMT QoS | | sched_wfi_timeout_us | \ | \ | 50 | | sched_smt_offline_util_pct | \ | \ | 50 | | P99 | 0.2 | 0.303 | 0.21 | | CPU utilization | 28.9% | 66.70% | 64.7% | | P99 regression percentage | \ | 51.5% | 5.00% | | spark CPEMAN | \ | 1.29 | 0.967 | | spark CPEMAN> regression | \ | \ | 25.04% | | 2. online 40% | 基线 | 混布基线 | SMT QoS | | sched_wfi_timeout_us | \ | \ | 50 | | sched_smt_offline_util_pct | \ | \ | 50 | | P99 | 0.21 | 0.286 | 0.206 | | CPU utilization | 40.0% | 69.30% | 65.5% | | P99 regression percentage | \ | 36.19% | -1.9% | | spark CPEMAN | \ | 1.03 | 0.661 | | spark CPEMAN> regression | \ | \ | 35.83% | | 3. online 48% | 基线 | 混布基线 | SMT QoS | | sched_wfi_timeout_us | \ | \ | 50 | | sched_smt_offline_util_pct | \ | \ | 50 | | P99 | 0.209 | 0.275 | 0.202 | | CPU utilization | 40.0% | 74.60% | 64.9% | | P99 regression percentage | \ | 31.58% | -3.35% | | spark CPEMAN | \ | 0.92 | 0.503 | | spark CPEMAN> regression | \ | \ | 45.33% | Changes in v11: - Fix `mrs x21,icc_iar1_el1' build issue. - Fix set_qos_task_select_cpus() "idlest_cpu" bug. - Fix restore_qos_task_select_cpus() smt_qos_enabled() check. - Use regs->orig_x0 instead of percpu cpu_iar. - Call arch_timer_get_cntfrq() once initially. - Remove extra qos_sched_enabled() check in qos_schedule_throttle(). - Move most smt qos code in fair.c to smt_qos.c. - Add smt_qos_enabled() check in smt_qos_update_sg_lb_stats() - Remove extra cpumask_copy() in set_qos_task_select_cpus(). - Add boundary case handling for when prefer_cpus is empty. Changes in v10: - Decouple QOS_SCHED_SMT_EXPELLER and QOS_SCHED scheduling logic with SMT_QOS. - Some cleanup. Changes in v9: - Also use SMT sibling CPU utilization NUMA level watermark for offline task cpu select to improve the 920G CPU utilization. Chanegs in v8: - Use SMT sibling CPU utilization NUMA level watermark instead of src cpu offline tasks migrate watermark on every load balance. Changes in v7: - Fix the prefer_cpu and select_cpus save/restore. - Extract can_smt_qos_migrate_task() helper from can_migrate_task(). - Update the names. - Update the arch code and remove the pmu code. - Add some comment. Changes in v6: - Rename QOS_LABEL to QOS_LEVEL. - Rename USER_WFXT to SMT_QOS. - Rename TAG_PULL to SMT_TAG_PULL. - Adjust the select cpu code which depends on QOS_SCHED_DYNAMIC_AFFINITY. - Distribute offline tasks to SMT sibling cores based on the configured proportion move to a separate patch. - Use cpumask_t for even_cpu_mask. - smt_throttle move to the arch patch. - pmu_smt_update_status() -> smt_update_qos_level(). - >> smt_task_imbalance instead of / 1000. - Remove the limit for odd -> even load balance, which solve the one NUMA load very high problem. - Rebased on the newest OLK-6.6 code. - Fix the build issue for QOS_LEVEL selected but CGROUP_SCHED or CFS_BANDWIDTH not selected. Jinjie Ruan (5): sched: Split out QOS_LEVEL from QOS_SCHED for reuse sched: Add qos_sched_enabled() helper for future expansion sched/fair: Add SMT QoS sched core code arm64: Add arch code for SMT QoS config: Enable SMT_QOS arch/arm64/Kconfig.turbo | 17 ++ arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/cpufeature.h | 5 + arch/arm64/include/asm/xint.h | 15 ++ arch/arm64/kernel/Makefile | 1 + arch/arm64/kernel/entry-common.c | 14 ++ arch/arm64/kernel/entry.S | 14 +- arch/arm64/kernel/smp.c | 23 +++ arch/arm64/kernel/smt_qos.c | 87 ++++++++++ arch/arm64/kernel/xcall/entry.S | 77 +++++++++ drivers/irqchip/irq-gic-v3.c | 38 +++++ include/linux/sched.h | 20 +++ init/Kconfig | 5 + kernel/sched/Makefile | 1 + kernel/sched/core.c | 20 +-- kernel/sched/fair.c | 83 ++++++++-- kernel/sched/features.h | 4 + kernel/sched/sched.h | 56 +++++-- kernel/sched/smt_qos.c | 216 +++++++++++++++++++++++++ 19 files changed, 656 insertions(+), 41 deletions(-) create mode 100644 arch/arm64/include/asm/xint.h create mode 100644 arch/arm64/kernel/smt_qos.c create mode 100644 kernel/sched/smt_qos.c -- 2.34.1

2 6

[PATCH OLK-5.10] ksmbd: require minimum ACE size in smb_check_perm_dacl()
by Li Lingfeng 14 May '26

14 May '26

From: Michael Bommarito <michael.bommarito(a)gmail.com> mainline inclusion from mainline-v7.1-rc1 commit d07b26f39246a82399661936dd0c853983cfade7 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14462 CVE: CVE-2026-31712 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Both ACE-walk loops in smb_check_perm_dacl() only guard against an under-sized remaining buffer, not against an ACE whose declared `ace->size` is smaller than the struct it claims to describe: if (offsetof(struct smb_ace, access_req) > aces_size) break; ace_size = le16_to_cpu(ace->size); if (ace_size > aces_size) break; The first check only requires the 4-byte ACE header to be in bounds; it does not require access_req (4 bytes at offset 4) to be readable. An attacker who has set a crafted DACL on a file they own can declare ace->size == 4 with aces_size == 4, pass both checks, and then granted |= le32_to_cpu(ace->access_req); /* upper loop */ compare_sids(&sid, &ace->sid); /* lower loop */ reads access_req at offset 4 (OOB by up to 4 bytes) and ace->sid at offset 8 (OOB by up to CIFS_SID_BASE_SIZE + SID_MAX_SUB_AUTHORITIES * 4 bytes). Tighten both loops to require ace_size >= offsetof(struct smb_ace, sid) + CIFS_SID_BASE_SIZE which is the smallest valid on-wire ACE layout (4-byte header + 4-byte access_req + 8-byte sid base with zero sub-auths). Also reject ACEs whose sid.num_subauth exceeds SID_MAX_SUB_AUTHORITIES before letting compare_sids() dereference sub_auth[] entries. parse_sec_desc() already enforces an equivalent check (lines 441-448); smb_check_perm_dacl() simply grew weaker validation over time. Reachability: authenticated SMB client with permission to set an ACL on a file. On a subsequent CREATE against that file, the kernel walks the stored DACL via smb_check_perm_dacl() and triggers the OOB read. Not pre-auth, and the OOB read is not reflected to the attacker, but KASAN reports and kernel state corruption are possible. Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") Cc: stable(a)vger.kernel.org Assisted-by: Claude:claude-opus-4-6 Assisted-by: Codex:gpt-5-4 Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Acked-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/server/smbacl.c [Commit 62e7dd0a39c2d0d7ff03274c36df971f1b3d2d0d ("smb: common: change the data type of num_aces to le16") change the data type of num_aces to le16.] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/ksmbd/smbacl.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/fs/ksmbd/smbacl.c b/fs/ksmbd/smbacl.c index 3368a4e73773..b23b725cf8c3 100644 --- a/fs/ksmbd/smbacl.c +++ b/fs/ksmbd/smbacl.c @@ -1258,10 +1258,13 @@ int smb_check_perm_dacl(struct ksmbd_conn *conn, struct path *path, ace = (struct smb_ace *)((char *)pdacl + sizeof(struct smb_acl)); aces_size = acl_size - sizeof(struct smb_acl); for (i = 0; i < le32_to_cpu(pdacl->num_aces); i++) { - if (offsetof(struct smb_ace, access_req) > aces_size) + if (offsetof(struct smb_ace, sid) + + aces_size < CIFS_SID_BASE_SIZE) break; ace_size = le16_to_cpu(ace->size); - if (ace_size > aces_size) + if (ace_size > aces_size || + ace_size < offsetof(struct smb_ace, sid) + + CIFS_SID_BASE_SIZE) break; aces_size -= ace_size; granted |= le32_to_cpu(ace->access_req); @@ -1279,13 +1282,19 @@ int smb_check_perm_dacl(struct ksmbd_conn *conn, struct path *path, ace = (struct smb_ace *)((char *)pdacl + sizeof(struct smb_acl)); aces_size = acl_size - sizeof(struct smb_acl); for (i = 0; i < le32_to_cpu(pdacl->num_aces); i++) { - if (offsetof(struct smb_ace, access_req) > aces_size) + if (offsetof(struct smb_ace, sid) + + aces_size < CIFS_SID_BASE_SIZE) break; ace_size = le16_to_cpu(ace->size); - if (ace_size > aces_size) + if (ace_size > aces_size || + ace_size < offsetof(struct smb_ace, sid) + + CIFS_SID_BASE_SIZE) break; aces_size -= ace_size; + if (ace->sid.num_subauth > SID_MAX_SUB_AUTHORITIES) + break; + if (!compare_sids(&sid, &ace->sid) || !compare_sids(&sid_unix_NFS_mode, &ace->sid)) { found = 1; -- 2.52.0

2 1

[PATCH OLK-6.6] bpf-rvi: Fix possible AA deadlock pidns_list_lock
by Gu Bowen 14 May '26

14 May '26

hulk inclusion category: bugfix bugzilla: -------------------------------- Spin lock pidns_list_lock is used in both process context and bottom half, which may cause the AA deadlock issue. Replace spin_lock with spin_lock_bh to resolve this problem. Call trace: native_queued_spin_lock_slowpath+0x71/0x428 destroy_pid_namespace+0x100/0x110 put_pid_ns+0x90/0xc8 put_pid+0x8c/0xc8 delayed_put_pid+0x1c/0x30 rcu_do_batch+0x164/0x580 rcu_core+0x130/0x2b8 rcu_core_si+0x18/0x30 handle_softirqs+0x120/0x328 __do_softirq+0x1c/0x28 ____do_softirq+0x18/0x30 call_on_irq_stack+0x30/0x48 do_softirq_own_stack+0x24/0x38 irq_exit_rcu+0x108/0x130 el1_interrupt+0x54/0x130 el1h_64_irq_handler+0x24/0x30 el1h_64_irq+0x78/0x80 create_pid_namespace+0x214/0x3c0 copy_pid_ns+0x90/0xf0 create_new_namespaces+0xc8/0x368 unshare_nsproxy_namespaces+0x6c/0xc0 ksys_unshare+0x130/0x418 __arm64_sys_unshare+0x1c/0x38 invoke_syscall+0x50/0x128 el0_svc_common.constprop.0+0x48/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x44/0x1e8 el0t_64_sync_handler+0xc0/0xc8 el0t_64_sync+0x3c8/0x3d0 Fixes: d758abf3762c ("bpf-rvi: pidns: Calculate loadavg for each pid namespace") Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- kernel/pid_namespace.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c index b321c02f382e..0bfd9ff3a6b8 100644 --- a/kernel/pid_namespace.c +++ b/kernel/pid_namespace.c @@ -128,9 +128,9 @@ static struct pid_namespace *create_pid_namespace(struct user_namespace *user_ns ns->loadavg = kmem_cache_zalloc(pidns_loadavg_cachep, GFP_KERNEL); if (ns->loadavg == NULL) goto out_free_idr; - spin_lock(&pidns_list_lock); + spin_lock_bh(&pidns_list_lock); list_add_tail(&ns->loadavg->list, &init_pidns_loadavg.list); - spin_unlock(&pidns_list_lock); + spin_unlock_bh(&pidns_list_lock); #endif return ns; @@ -164,9 +164,9 @@ static void destroy_pid_namespace(struct pid_namespace *ns) * ns->loadavg's lifecycle aligns precisely with ns, * so don't need RCU delayed free. */ - spin_lock(&pidns_list_lock); + spin_lock_bh(&pidns_list_lock); list_del(&ns->loadavg->list); - spin_unlock(&pidns_list_lock); + spin_unlock_bh(&pidns_list_lock); kmem_cache_free(pidns_loadavg_cachep, ns->loadavg); #endif call_rcu(&ns->rcu, delayed_free_pidns); @@ -537,13 +537,13 @@ static void pidns_list_reset(void) { struct list_head *pos, *tmp; - spin_lock(&pidns_list_lock); + spin_lock_bh(&pidns_list_lock); list_for_each_safe(pos, tmp, &init_pidns_loadavg.list) { struct pidns_loadavg *entry = list_entry(pos, struct pidns_loadavg, list); entry->load_tasks = 0; // reset } - spin_unlock(&pidns_list_lock); + spin_unlock_bh(&pidns_list_lock); } static void pidns_update_load_tasks(void) @@ -574,7 +574,7 @@ static void pidns_calc_avenrun(void) { struct list_head *pos; - spin_lock(&pidns_list_lock); + spin_lock_bh(&pidns_list_lock); /* * As the loadavg of init_pid_ns is exactly /proc/loadavg, avoid redundant * re-calculation for init_pid_ns, and reuse init_pidns_loadavg.list as the @@ -590,7 +590,7 @@ static void pidns_calc_avenrun(void) entry->avenrun[1] = calc_load(entry->avenrun[1], EXP_5, active); entry->avenrun[2] = calc_load(entry->avenrun[2], EXP_15, active); } - spin_unlock(&pidns_list_lock); + spin_unlock_bh(&pidns_list_lock); } static void pidns_calc_loadavg_workfn(struct work_struct *work) -- 2.43.0

2 1

[PATCH OLK-6.6] cifs: some missing initializations on replay
by Li Lingfeng 14 May '26

14 May '26

From: Shyam Prasad N <sprasad(a)microsoft.com> stable inclusion from stable-v6.6.128 commit c854ab481ece4b3e5f4c2e8b22824f015ff874a5 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14443 CVE: CVE-2026-31693 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 14f66f44646333d2bfd7ece36585874fd72f8286 ] In several places in the code, we have a label to signify the start of the code where a request can be replayed if necessary. However, some of these places were missing the necessary reinitializations of certain local variables before replay. This change makes sure that these variables get initialized after the label. Cc: stable(a)vger.kernel.org Reported-by: Yuchan Nam <entropy1110(a)gmail.com> Tested-by: Yuchan Nam <entropy1110(a)gmail.com> Signed-off-by: Shyam Prasad N <sprasad(a)microsoft.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/smb/client/smb2ops.c | 2 ++ fs/smb/client/smb2pdu.c | 1 + 2 files changed, 3 insertions(+) diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c index 40eea0b2f48b..324d2382dfef 100644 --- a/fs/smb/client/smb2ops.c +++ b/fs/smb/client/smb2ops.c @@ -1147,6 +1147,7 @@ smb2_set_ea(const unsigned int xid, struct cifs_tcon *tcon, replay_again: /* reinitialize for possible replay */ + used_len = 0; flags = CIFS_CP_CREATE_CLOSE_OP; oplock = SMB2_OPLOCK_LEVEL_NONE; server = cifs_pick_channel(ses); @@ -1545,6 +1546,7 @@ smb2_ioctl_query_info(const unsigned int xid, replay_again: /* reinitialize for possible replay */ + buffer = NULL; flags = CIFS_CP_CREATE_CLOSE_OP; oplock = SMB2_OPLOCK_LEVEL_NONE; server = cifs_pick_channel(ses); diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c index 493e4ae3842a..dbee701a478a 100644 --- a/fs/smb/client/smb2pdu.c +++ b/fs/smb/client/smb2pdu.c @@ -2851,6 +2851,7 @@ int smb311_posix_mkdir(const unsigned int xid, struct inode *inode, replay_again: /* reinitialize for possible replay */ + pc_buf = NULL; flags = 0; n_iov = 2; server = cifs_pick_channel(ses); -- 2.52.0

2 1

[PATCH OLK-6.6 v3 0/3] optimize copy_from_user
by Qi Xi 14 May '26

14 May '26

This patchset adds an optimized copy_from_user path for Hisilicon HIP11/HIP12/Linxicore9100, using ldp/stp instructions with PAN temporarily disabled during the copy. Patch 1 adds the HIP11 MIDR definition. Patch 2 implements the optimized path and the raw_copy_from_user routing. Patch 3 adds CONFIG_ARM64_COPY_FROM_USER_OPT compile-time gating. v3 changes: - add CONFIG_ARM64_COPY_FROM_USER_OPT to openeuler_defconfig v2 changes: - add HISI_CPU_PART_HIP11 - merge the asm implementation and the uaccess.h routing into a single patch to avoid bisect breakage - fix compile error when CONFIG_ARM64_COPY_FROM_USER_OPT=n Qi Xi (3): arm64: cputype: Add CPU type for HISI_CPU_PART_HIP11 arm64: uaccess: add optimized copy_from_user for Hisilicon platforms arm64: uaccess: add CONFIG control for copy_from_user_opt .../admin-guide/kernel-parameters.txt | 6 + arch/arm64/Kconfig.turbo | 11 + arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/asm-uaccess.h | 11 + arch/arm64/include/asm/cputype.h | 2 + arch/arm64/include/asm/uaccess.h | 30 ++- arch/arm64/kernel/cpufeature.c | 36 ++++ arch/arm64/lib/copy_from_user.S | 36 ++++ arch/arm64/lib/copy_template_opt.S | 189 ++++++++++++++++++ arch/arm64/tools/cpucaps | 2 +- tools/arch/arm64/include/asm/cputype.h | 2 + 11 files changed, 323 insertions(+), 3 deletions(-) create mode 100644 arch/arm64/lib/copy_template_opt.S -- 2.33.0

2 4

[PATCH OLK-6.6] cifs: some missing initializations on replay
by Li Lingfeng 14 May '26

14 May '26

From: Shyam Prasad N <sprasad(a)microsoft.com> stable inclusion from stable-v6.6.128 commit c854ab481ece4b3e5f4c2e8b22824f015ff874a5 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8792 CVE: CVE-2026-31693 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 14f66f44646333d2bfd7ece36585874fd72f8286 ] In several places in the code, we have a label to signify the start of the code where a request can be replayed if necessary. However, some of these places were missing the necessary reinitializations of certain local variables before replay. This change makes sure that these variables get initialized after the label. Cc: stable(a)vger.kernel.org Reported-by: Yuchan Nam <entropy1110(a)gmail.com> Tested-by: Yuchan Nam <entropy1110(a)gmail.com> Signed-off-by: Shyam Prasad N <sprasad(a)microsoft.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/smb/client/smb2ops.c | 2 ++ fs/smb/client/smb2pdu.c | 1 + 2 files changed, 3 insertions(+) diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c index 40eea0b2f48b..324d2382dfef 100644 --- a/fs/smb/client/smb2ops.c +++ b/fs/smb/client/smb2ops.c @@ -1147,6 +1147,7 @@ smb2_set_ea(const unsigned int xid, struct cifs_tcon *tcon, replay_again: /* reinitialize for possible replay */ + used_len = 0; flags = CIFS_CP_CREATE_CLOSE_OP; oplock = SMB2_OPLOCK_LEVEL_NONE; server = cifs_pick_channel(ses); @@ -1545,6 +1546,7 @@ smb2_ioctl_query_info(const unsigned int xid, replay_again: /* reinitialize for possible replay */ + buffer = NULL; flags = CIFS_CP_CREATE_CLOSE_OP; oplock = SMB2_OPLOCK_LEVEL_NONE; server = cifs_pick_channel(ses); diff --git a/fs/smb/client/smb2pdu.c b/fs/smb/client/smb2pdu.c index 493e4ae3842a..dbee701a478a 100644 --- a/fs/smb/client/smb2pdu.c +++ b/fs/smb/client/smb2pdu.c @@ -2851,6 +2851,7 @@ int smb311_posix_mkdir(const unsigned int xid, struct inode *inode, replay_again: /* reinitialize for possible replay */ + pc_buf = NULL; flags = 0; n_iov = 2; server = cifs_pick_channel(ses); -- 2.52.0

2 1

[PATCH OLK-5.10] smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path
by Li Lingfeng 14 May '26

14 May '26

From: Michael Bommarito <michael.bommarito(a)gmail.com> mainline inclusion from mainline-v7.1-rc1 commit a58c5af19ff0d6f44f6e9fe31e33a2c92223f77e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14458 CVE: CVE-2026-31708 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- smb2_ioctl_query_info() has two response-copy branches: PASSTHRU_FSCTL and the default QUERY_INFO path. The QUERY_INFO branch clamps qi.input_buffer_length to the server-reported OutputBufferLength and then copies qi.input_buffer_length bytes from qi_rsp->Buffer to userspace, but it never verifies that the flexible-array payload actually fits within rsp_iov[1].iov_len. A malicious server can return OutputBufferLength larger than the actual QUERY_INFO response, causing copy_to_user() to walk past the response buffer and expose adjacent kernel heap to userspace. Guard the QUERY_INFO copy with a bounds check on the actual Buffer payload. Use struct_size(qi_rsp, Buffer, qi.input_buffer_length) rather than an open-coded addition so the guard cannot overflow on 32-bit builds. Fixes: f5778c398713 ("SMB3: Allow SMB3 FSCTL queries to be sent to server from tools") Cc: stable(a)vger.kernel.org Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Assisted-by: Claude:claude-opus-4-6 Assisted-by: Codex:gpt-5-4 Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/client/smb2ops.c [Commit 38c8a9a52082579090e34c033d439ed2cd1a462d ("smb: move client and server files to common directory fs/smb") move fs/cifs/smb2ops.c to fs/smb/client/smb2ops.c.] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/cifs/smb2ops.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c index e3f96a99a4d5..f46c99b61c04 100644 --- a/fs/cifs/smb2ops.c +++ b/fs/cifs/smb2ops.c @@ -1731,6 +1731,12 @@ smb2_ioctl_query_info(const unsigned int xid, qi_rsp = (struct smb2_query_info_rsp *)rsp_iov[1].iov_base; if (le32_to_cpu(qi_rsp->OutputBufferLength) < qi.input_buffer_length) qi.input_buffer_length = le32_to_cpu(qi_rsp->OutputBufferLength); + if (qi.input_buffer_length > 0 && + struct_size(qi_rsp, Buffer, qi.input_buffer_length) > + rsp_iov[1].iov_len) { + rc = -EFAULT; + goto out; + } if (copy_to_user(&pqi->input_buffer_length, &qi.input_buffer_length, sizeof(qi.input_buffer_length))) { -- 2.52.0

2 1

[PATCH OLK-6.6] smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path
by Li Lingfeng 14 May '26

14 May '26

From: Michael Bommarito <michael.bommarito(a)gmail.com> stable inclusion from stable-v6.6.136 commit a34d456934fe42e4da5d2cc07787bf418bee99c6 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14458 CVE: CVE-2026-31708 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit a58c5af19ff0d6f44f6e9fe31e33a2c92223f77e upstream. smb2_ioctl_query_info() has two response-copy branches: PASSTHRU_FSCTL and the default QUERY_INFO path. The QUERY_INFO branch clamps qi.input_buffer_length to the server-reported OutputBufferLength and then copies qi.input_buffer_length bytes from qi_rsp->Buffer to userspace, but it never verifies that the flexible-array payload actually fits within rsp_iov[1].iov_len. A malicious server can return OutputBufferLength larger than the actual QUERY_INFO response, causing copy_to_user() to walk past the response buffer and expose adjacent kernel heap to userspace. Guard the QUERY_INFO copy with a bounds check on the actual Buffer payload. Use struct_size(qi_rsp, Buffer, qi.input_buffer_length) rather than an open-coded addition so the guard cannot overflow on 32-bit builds. Fixes: f5778c398713 ("SMB3: Allow SMB3 FSCTL queries to be sent to server from tools") Cc: stable(a)vger.kernel.org Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Assisted-by: Claude:claude-opus-4-6 Assisted-by: Codex:gpt-5-4 Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/smb/client/smb2ops.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c index 40eea0b2f48b..b833bbf8e7fa 100644 --- a/fs/smb/client/smb2ops.c +++ b/fs/smb/client/smb2ops.c @@ -1730,6 +1730,12 @@ smb2_ioctl_query_info(const unsigned int xid, qi_rsp = (struct smb2_query_info_rsp *)rsp_iov[1].iov_base; if (le32_to_cpu(qi_rsp->OutputBufferLength) < qi.input_buffer_length) qi.input_buffer_length = le32_to_cpu(qi_rsp->OutputBufferLength); + if (qi.input_buffer_length > 0 && + struct_size(qi_rsp, Buffer, qi.input_buffer_length) > + rsp_iov[1].iov_len) { + rc = -EFAULT; + goto out; + } if (copy_to_user(&pqi->input_buffer_length, &qi.input_buffer_length, sizeof(qi.input_buffer_length))) { -- 2.52.0

2 1

[PATCH OLK-6.6] net: ipa: fix event ring index not programmed for IPA v5.0+
by Wupeng Ma 14 May '26

14 May '26

From: Alexander Koskovich <akoskovich(a)pm.me> stable inclusion from stable-v6.6.136 commit ae8343a19ccb051d519dbb3a9082ddea9f0551d3 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14903 CVE: CVE-2026-43345 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 56007972c0b1e783ca714d6f1f4d6e66e531d21f ] For IPA v5.0+, the event ring index field moved from CH_C_CNTXT_0 to CH_C_CNTXT_1. The v5.0 register definition intended to define this field in the CH_C_CNTXT_1 fmask array but used the old identifier of ERINDEX instead of CH_ERINDEX. Without a valid event ring, GSI channels could never signal transfer completions. This caused gsi_channel_trans_quiesce() to block forever in wait_for_completion(). At least for IPA v5.2 this resolves an issue seen where runtime suspend, system suspend, and remoteproc stop all hanged forever. It also meant the IPA data path was completely non functional. Fixes: faf0678ec8a0 ("net: ipa: add IPA v5.0 GSI register definitions") Signed-off-by: Alexander Koskovich <akoskovich(a)pm.me> Signed-off-by: Luca Weiss <luca.weiss(a)fairphone.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://patch.msgid.link/20260403-milos-ipa-v1-2-01e9e4e03d3e@fairphone.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- drivers/net/ipa/reg/gsi_reg-v5.0.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ipa/reg/gsi_reg-v5.0.c b/drivers/net/ipa/reg/gsi_reg-v5.0.c index 145eb0bd096d..ff71a95557c7 100644 --- a/drivers/net/ipa/reg/gsi_reg-v5.0.c +++ b/drivers/net/ipa/reg/gsi_reg-v5.0.c @@ -28,7 +28,7 @@ REG_STRIDE_FIELDS(CH_C_CNTXT_0, ch_c_cntxt_0, static const u32 reg_ch_c_cntxt_1_fmask[] = { [CH_R_LENGTH] = GENMASK(23, 0), - [ERINDEX] = GENMASK(31, 24), + [CH_ERINDEX] = GENMASK(31, 24), }; REG_STRIDE_FIELDS(CH_C_CNTXT_1, ch_c_cntxt_1, -- 2.43.0

2 1

[PATCH OLK-6.6 v2 0/3] optimize copy_from_user
by Qi Xi 14 May '26

14 May '26

This patchset adds an optimized copy_from_user path for Hisilicon HIP11/HIP12/Linxicore9100, using ldp/stp instructions with PAN temporarily disabled during the copy. Patch 1 adds the HIP11 MIDR definition. Patch 2 implements the optimized path and the raw_copy_from_user routing. Patch 3 adds CONFIG_ARM64_COPY_FROM_USER_OPT compile-time gating. v2 changes: - add HISI_CPU_PART_HIP11 - merge the asm implementation and the uaccess.h routing into a single patch to avoid bisect breakage - fix compile error when CONFIG_ARM64_COPY_FROM_USER_OPT=n Qi Xi (3): arm64: cputype: Add CPU type for HISI_CPU_PART_HIP11 arm64: uaccess: add optimized copy_from_user for Hisilicon platforms arm64: uaccess: add CONFIG control for copy_from_user_opt .../admin-guide/kernel-parameters.txt | 6 + arch/arm64/Kconfig | 11 + arch/arm64/include/asm/asm-uaccess.h | 11 + arch/arm64/include/asm/cputype.h | 2 + arch/arm64/include/asm/uaccess.h | 30 ++- arch/arm64/kernel/cpufeature.c | 36 ++++ arch/arm64/lib/copy_from_user.S | 36 ++++ arch/arm64/lib/copy_template_opt.S | 189 ++++++++++++++++++ arch/arm64/tools/cpucaps | 2 +- tools/arch/arm64/include/asm/cputype.h | 2 + 10 files changed, 322 insertions(+), 3 deletions(-) create mode 100644 arch/arm64/lib/copy_template_opt.S -- 2.33.0

2 4