- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS 0/6] squashfs: add more sanity checks
by Long Li 14 Oct '25

14 Oct '25

add more sanity checks. Phillip Lougher (5): squashfs: add more sanity checks in id lookup squashfs: add more sanity checks in xattr id lookup squashfs: add more sanity checks in inode lookup squashfs: fix xattr id and id lookup sanity checks Squashfs: fix handling and sanity checking of xattr_ids count Sean Nyekjaer (1): squashfs: fix inode lookup sanity checks fs/squashfs/export.c | 45 ++++++++++++++++++----- fs/squashfs/id.c | 42 +++++++++++++++++----- fs/squashfs/squashfs_fs.h | 3 +- fs/squashfs/squashfs_fs_sb.h | 3 +- fs/squashfs/super.c | 6 ++-- fs/squashfs/xattr.h | 14 ++++++-- fs/squashfs/xattr_id.c | 70 ++++++++++++++++++++++++++++++------ 7 files changed, 149 insertions(+), 34 deletions(-) -- 2.39.2

2 7

[PATCH openEuler-1.0-LTS] Enable Huawei Intelligent Network Card Driver: hinic3
by LinKun 14 Oct '25

14 Oct '25

From: zhoubin <zhoubin120(a)h-partners.com> driver inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/ID1L0L?from=project-issue CVE: NA -------------------------------- Enable Huawei Intelligent Network Card Driver: hinic3 Signed-off-by: zhoubin <zhoubin120(a)h-partners.com> Signed-off-by: zhuyikai <zhuyikai1(a)h-partners.com> Signed-off-by: zhengjiezhen <zhengjiezhen(a)h-partners.com> Signed-off-by: shijing <shijing34(a)huawei.com> --- Documentation/networking/hinic3.txt | 140 +++++++++++++++++++++++++ MAINTAINERS | 7 ++ arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + drivers/net/ethernet/huawei/Kconfig | 1 + drivers/net/ethernet/huawei/Makefile | 1 + 6 files changed, 151 insertions(+) create mode 100644 Documentation/networking/hinic3.txt diff --git a/Documentation/networking/hinic3.txt b/Documentation/networking/hinic3.txt new file mode 100644 index 000000000000..be7803301e80 --- /dev/null +++ b/Documentation/networking/hinic3.txt @@ -0,0 +1,140 @@ +Linux Kernel Driver for Huawei Intelligent NIC(HiNIC3) family +============================================================ + +Overview: +========= +HiNIC3 is a network interface card for the Data Center Area. + +The driver supports a range of link-speed devices (10GbE, 25GbE, 40GbE, etc.). +The driver supports also a negotiated and extendable feature set. + +Some HiNIC3 devices support SR-IOV. This driver is used for Physical Function +(PF). + +HiNIC3 devices support MSI-X interrupt vector for each Tx/Rx queue and +adaptive interrupt moderation. + +HiNIC3 devices support also various offload features such as checksum offload, +TCP Transmit Segmentation Offload(TSO), Receive-Side Scaling(RSS) and +LRO(Large Receive Offload). + + +Supported PCI vendor ID/device IDs: +=================================== + +19e5:1822 - HiNIC3 PF + + +Driver Architecture and Source Code: +==================================== + +hinic3_dev - Implement a Logical Network device that is independent from +specific HW details about HW data structure formats. + +hinic3_hwdev - Implement the HW details of the device and include the components +for accessing the PCI NIC. + +hinic3_hwdev contains the following components: +=============================================== + +HW Interface: +============= + +The interface for accessing the pci device (DMA memory and PCI BARs). +(hinic3_hw_if.c, hinic3_hw_if.h) + +Configuration Status Registers Area that describes the HW Registers on the +configuration and status BAR0. (hinic3_hw_csr.h) + +MGMT components: +================ + +Asynchronous Event Queues(AEQs) - The event queues for receiving messages from +the MGMT modules on the cards. (hinic3_hw_eqs.c, hinic3_hw_eqs.h) + +Application Programmable Interface commands(API CMD) - Interface for sending +MGMT commands to the card. (hinic3_hw_api_cmd.c, hinic3_hw_api_cmd.h) + +Management (MGMT) - the PF to MGMT channel that uses API CMD for sending MGMT +commands to the card and receives notifications from the MGMT modules on the +card by AEQs. Also set the addresses of the IO CMDQs in HW. +(hinic3_hw_mgmt.c, hinic3_hw_mgmt.h) + +IO components: +============== + +Completion Event Queues(CEQs) - The completion Event Queues that describe IO +tasks that are finished. (hinic3_hw_eqs.c, hinic3_hw_eqs.h) + +Work Queues(WQ) - Contain the memory and operations for use by CMD queues and +the Queue Pairs. The WQ is a Memory Block in a Page. The Block contains +pointers to Memory Areas that are the Memory for the Work Queue Elements(WQEs). +(hinic3_hw_wq.c, hinic3_hw_wq.h) + +Command Queues(CMDQ) - The queues for sending commands for IO management and is +used to set the QPs addresses in HW. The commands completion events are +accumulated on the CEQ that is configured to receive the CMDQ completion events. +(hinic3_hw_cmdq.c, hinic3_hw_cmdq.h) + +Queue Pairs(QPs) - The HW Receive and Send queues for Receiving and Transmitting +Data. (hinic3_hw_qp.c, hinic3_hw_qp.h, hinic3_hw_qp_ctxt.h) + +IO - de/constructs all the IO components. (hinic3_hw_io.c, hinic3_hw_io.h) + +CQM components: +========== + +The CQM module organizes the memory in the large system in a format (CLA table) +and allocates the memory to the chip (BAT table). The chip can use the memory in +the large system to save context information and queue information (SCQ\SRQ). +(cqm_bat_cla.c, cqm_bat_cla.h, cqm_bitmap_table.c, cqm_bitmap_table.h) + +When a packet is transmitted from the PCIe link, the chip parses the 5-tuple +such as sid, did, and hostid. Fill the parsed data in the queue +(in the form of scqe). In this way, the driver can directly obtain data from the +queue (through MPDK polling) and then process the data. In this way, the +uninstallation is implemented. +(cqm_main.c, cqm_main.h, cqm_db.c, cqm_db.h) + +HW device: +========== + +HW device - de/constructs the HW Interface, the MGMT components on the +initialization of the driver and the IO components on the case of Interface +UP/DOWN Events. (hinic3_hw_dev.c, hinic3_hw_dev.h) + + +hinic3_dev contains the following components: +=============================================== + +PCI ID table - Contains the supported PCI Vendor/Device IDs. +(hinic3_pci_tbl.h) + +Port Commands - Send commands to the HW device for port management +(MAC, Vlan, MTU, ...). (hinic3_port.c, hinic3_port.h) + +Tx Queues - Logical Tx Queues that use the HW Send Queues for transmit. +The Logical Tx queue is not dependent on the format of the HW Send Queue. +(hinic3_tx.c, hinic3_tx.h) + +Rx Queues - Logical Rx Queues that use the HW Receive Queues for receive. +The Logical Rx queue is not dependent on the format of the HW Receive Queue. +(hinic3_rx.c, hinic3_rx.h) + +hinic_dev - de/constructs the Logical Tx and Rx Queues. +(hinic3_main.c, hinic3_dev.h) + + +Miscellaneous: +============= + +Common functions that are used by HW and Logical Device. +(hinic3_common.c, hinic3_common.h) + + +Support +======= + +If an issue is identified with the released source code on the supported kernel +with a supported adapter, email the specific information related to the issue to +wulike1(a)huawei.com. diff --git a/MAINTAINERS b/MAINTAINERS index 986bb37e8cbc..1507d82a582d 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -6784,6 +6784,13 @@ S: Supported F: Documentation/networking/hinic.txt F: drivers/net/ethernet/huawei/hinic/ +HUAWEI ETHERNET DRIVER +M: Wulike(Collin) <wulike1(a)huawei.com> +L: netdev(a)vger.kernel.org +S: Supported +F: Documentation/networking/hinic3.txt +F: drivers/net/ethernet/huawei/hinic3/ + HUGETLB FILESYSTEM M: Mike Kravetz <mike.kravetz(a)oracle.com> L: linux-mm(a)kvack.org diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 71e12eb64467..e74e58cc01e2 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -2498,6 +2498,7 @@ CONFIG_HNS3_CAE=m # CONFIG_NET_VENDOR_HP is not set CONFIG_NET_VENDOR_HUAWEI=y CONFIG_HINIC=m +CONFIG_HINIC3=m CONFIG_BMA=m # CONFIG_NET_VENDOR_I825XX is not set CONFIG_NET_VENDOR_INTEL=y diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index 8e0386b7dbcd..2524affde87a 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -2543,6 +2543,7 @@ CONFIG_BE2NET_SKYHAWK=y # CONFIG_NET_VENDOR_HP is not set CONFIG_NET_VENDOR_HUAWEI=y CONFIG_HINIC=m +CONFIG_HINIC3=m CONFIG_BMA=m # CONFIG_NET_VENDOR_I825XX is not set CONFIG_NET_VENDOR_INTEL=y diff --git a/drivers/net/ethernet/huawei/Kconfig b/drivers/net/ethernet/huawei/Kconfig index eb9a4e45a8a2..3d75dfbaf559 100644 --- a/drivers/net/ethernet/huawei/Kconfig +++ b/drivers/net/ethernet/huawei/Kconfig @@ -15,6 +15,7 @@ config NET_VENDOR_HUAWEI if NET_VENDOR_HUAWEI source "drivers/net/ethernet/huawei/hinic/Kconfig" +source "drivers/net/ethernet/huawei/hinic3/Kconfig" source "drivers/net/ethernet/huawei/bma/Kconfig" endif # NET_VENDOR_HUAWEI diff --git a/drivers/net/ethernet/huawei/Makefile b/drivers/net/ethernet/huawei/Makefile index b80925adee07..84d5739e5cfe 100644 --- a/drivers/net/ethernet/huawei/Makefile +++ b/drivers/net/ethernet/huawei/Makefile @@ -3,4 +3,5 @@ # obj-$(CONFIG_HINIC) += hinic/ +obj-$(CONFIG_HINIC3) += hinic3/ obj-$(CONFIG_BMA) += bma/ -- 2.43.0

2 1

[PATCH OLK-6.6] comedi: pcl726: Prevent invalid irq number
by Bowen You 14 Oct '25

14 Oct '25

From: Edward Adam Davis <eadavis(a)qq.com> stable inclusion from stable-v6.6.103 commit 0eb4ed2aa261dee228f1668dbfa6d87353e8162d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICWO2V CVE: CVE-2025-39685 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 96cb948408b3adb69df7e451ba7da9d21f814d00 upstream. The reproducer passed in an irq number(0x80008000) that was too large, which triggered the oob. Added an interrupt number check to prevent users from passing in an irq number that was too large. If `it->options[1]` is 31, then `1 << it->options[1]` is still invalid because it shifts a 1-bit into the sign bit (which is UB in C). Possible solutions include reducing the upper bound on the `it->options[1]` value to 30 or lower, or using `1U << it->options[1]`. The old code would just not attempt to request the IRQ if the `options[1]` value were invalid. And it would still configure the device without interrupts even if the call to `request_irq` returned an error. So it would be better to combine this test with the test below. Fixes: fff46207245c ("staging: comedi: pcl726: enable the interrupt support code") Cc: stable <stable(a)kernel.org> # 5.13+ Reported-by: syzbot+5cd373521edd68bebcb3(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=5cd373521edd68bebcb3 Tested-by: syzbot+5cd373521edd68bebcb3(a)syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis <eadavis(a)qq.com> Reviewed-by: Ian Abbott <abbotti(a)mev.co.uk> Link: https://lore.kernel.org/r/tencent_3C66983CC1369E962436264A50759176BF09@qq.c… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Bowen You <youbowen2(a)huawei.com> --- drivers/comedi/drivers/pcl726.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/comedi/drivers/pcl726.c b/drivers/comedi/drivers/pcl726.c index 0430630e6ebb..b542896fa0e4 100644 --- a/drivers/comedi/drivers/pcl726.c +++ b/drivers/comedi/drivers/pcl726.c @@ -328,7 +328,8 @@ static int pcl726_attach(struct comedi_device *dev, * Hook up the external trigger source interrupt only if the * user config option is valid and the board supports interrupts. */ - if (it->options[1] && (board->irq_mask & (1 << it->options[1]))) { + if (it->options[1] > 0 && it->options[1] < 16 && + (board->irq_mask & (1U << it->options[1]))) { ret = request_irq(it->options[1], pcl726_interrupt, 0, dev->board_name, dev); if (ret == 0) { -- 2.34.1

2 1

[PATCH OLK-6.6 0/3] umount performance fix
by Yang Erkun 14 Oct '25

14 Oct '25

umount performance fix Al Viro (3): change_mnt_propagation() cleanups, step 1 change_mnt_propagation(): do_make_slave() is a no-op unless IS_MNT_SHARED() do_make_slave(): choose new master sanely fs/pnode.c | 73 ++++++++++++++++++++++++++++++------------------------ 1 file changed, 40 insertions(+), 33 deletions(-) -- 2.46.1

2 4

[PATCH OLK-5.10 0/3] umount performance fix
by Yang Erkun 14 Oct '25

14 Oct '25

umount performance fix Al Viro (3): change_mnt_propagation() cleanups, step 1 change_mnt_propagation(): do_make_slave() is a no-op unless IS_MNT_SHARED() do_make_slave(): choose new master sanely fs/pnode.c | 73 ++++++++++++++++++++++++++++++------------------------ 1 file changed, 40 insertions(+), 33 deletions(-) -- 2.46.1

2 4

[PATCH OLK-6.6 0/3] CVE-2025-40300
by Bowen You 14 Oct '25

14 Oct '25

CVE-2025-40300 Pawan Gupta (3): x86/vmscape: Add conditional IBPB mitigation x86/vmscape: Enumerate VMSCAPE bug x86/vmscape: Enable the mitigation .../ABI/testing/sysfs-devices-system-cpu | 1 + .../admin-guide/kernel-parameters.txt | 11 +++ arch/x86/Kconfig | 8 ++ arch/x86/include/asm/cpufeatures.h | 2 + arch/x86/include/asm/entry-common.h | 7 ++ arch/x86/include/asm/nospec-branch.h | 2 + arch/x86/kernel/cpu/bugs.c | 86 +++++++++++++++++++ arch/x86/kernel/cpu/common.c | 58 +++++++++---- arch/x86/kvm/x86.c | 9 ++ drivers/base/cpu.c | 3 + include/linux/cpu.h | 1 + 11 files changed, 170 insertions(+), 18 deletions(-) -- 2.34.1

2 4

[PATCH openEuler-1.0-LTS 0/2] CVE-2022-50341
by Li Lingfeng 14 Oct '25

14 Oct '25

Paulo Alcantara (1): cifs: fix oops during encryption Yang Li (1): cifs: Remove duplicated include in cifsglob.h fs/cifs/cifsglob.h | 69 ++++++++++++++++++++++ fs/cifs/cifsproto.h | 4 +- fs/cifs/misc.c | 4 +- fs/cifs/smb2ops.c | 139 +++++++++++++++++++++----------------------- 4 files changed, 140 insertions(+), 76 deletions(-) -- 2.31.1

2 3

[PATCH openEuler-1.0-LTS] cifs: fix oops during encryption
by Li Lingfeng 14 Oct '25

14 Oct '25

From: Paulo Alcantara <pc(a)cjr.nz> mainline inclusion from mainline-v6.2-rc1 commit f7f291e14dde32a07b1f0aa06921d28f875a7b54 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICYBW6 CVE: CVE-2022-50341 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When running xfstests against Azure the following oops occurred on an arm64 system Unable to handle kernel write to read-only memory at virtual address ffff0001221cf000 Mem abort info: ESR = 0x9600004f EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x0f: level 3 permission fault Data abort info: ISV = 0, ISS = 0x0000004f CM = 0, WnR = 1 swapper pgtable: 4k pages, 48-bit VAs, pgdp=00000000294f3000 [ffff0001221cf000] pgd=18000001ffff8003, p4d=18000001ffff8003, pud=18000001ff82e003, pmd=18000001ff71d003, pte=00600001221cf787 Internal error: Oops: 9600004f [#1] PREEMPT SMP ... pstate: 80000005 (Nzcv daif -PAN -UAO -TCO BTYPE=--) pc : __memcpy+0x40/0x230 lr : scatterwalk_copychunks+0xe0/0x200 sp : ffff800014e92de0 x29: ffff800014e92de0 x28: ffff000114f9de80 x27: 0000000000000008 x26: 0000000000000008 x25: ffff800014e92e78 x24: 0000000000000008 x23: 0000000000000001 x22: 0000040000000000 x21: ffff000000000000 x20: 0000000000000001 x19: ffff0001037c4488 x18: 0000000000000014 x17: 235e1c0d6efa9661 x16: a435f9576b6edd6c x15: 0000000000000058 x14: 0000000000000001 x13: 0000000000000008 x12: ffff000114f2e590 x11: ffffffffffffffff x10: 0000040000000000 x9 : ffff8000105c3580 x8 : 2e9413b10000001a x7 : 534b4410fb86b005 x6 : 534b4410fb86b005 x5 : ffff0001221cf008 x4 : ffff0001037c4490 x3 : 0000000000000001 x2 : 0000000000000008 x1 : ffff0001037c4488 x0 : ffff0001221cf000 Call trace: __memcpy+0x40/0x230 scatterwalk_map_and_copy+0x98/0x100 crypto_ccm_encrypt+0x150/0x180 crypto_aead_encrypt+0x2c/0x40 crypt_message+0x750/0x880 smb3_init_transform_rq+0x298/0x340 smb_send_rqst.part.11+0xd8/0x180 smb_send_rqst+0x3c/0x100 compound_send_recv+0x534/0xbc0 smb2_query_info_compound+0x32c/0x440 smb2_set_ea+0x438/0x4c0 cifs_xattr_set+0x5d4/0x7c0 This is because in scatterwalk_copychunks(), we attempted to write to a buffer (@sign) that was allocated in the stack (vmalloc area) by crypt_message() and thus accessing its remaining 8 (x2) bytes ended up crossing a page boundary. To simply fix it, we could just pass @sign kmalloc'd from crypt_message() and then we're done. Luckily, we don't seem to pass any other vmalloc'd buffers in smb_rqst::rq_iov... Instead, let's map the correct pages and offsets from vmalloc buffers as well in cifs_sg_set_buf() and then avoiding such oopses. Signed-off-by: Paulo Alcantara (SUSE) <pc(a)cjr.nz> Cc: stable(a)vger.kernel.org Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/cifs/cifsglob.h fs/cifs/cifsproto.h fs/cifs/misc.c fs/cifs/smb2ops.c [Commit 49bd49f983b5 ("cifs: send workstation name during ntlmssp session setup") added inclusion of utsname.h in cifsglob.h; commit 76894f3e2f71 ("cifs: improve symlink handling for smb2+") added definition of move_cifs_info_to_smb2 in cifsglob.h; commit 2f5896797940 ("cifs: multichannel: try to rebind when reconnecting a channel") add definition of cifs_ses_find_chan in cifsproto.h; commit 03ab9cb982b6 ("cifs: Deal with some warnings from W=1") changed the comment of rqst_page_get_length; commit 070fb21e5912 ("cifsd: Alignment should match open parenthesis") modified the parameter indentation of smb2_sg_set_buf; commit 5a0ca7700591 ("cifsd: add support for AES256 encryption") SMB3_SIGN_KEY_SIZE by SMB3_ENC_DEC_KEY_SIZE in crypt_message; commit 2b2f75480762 ("SMB3.1.1: Add GCM crypto to the encrypt and decrypt functions") modified the initialization method of iv; commit a4e430c8c8ba ("cifs: replace kfree() with kfree_sensitive() for sensitive data") change the way to free iv/sg/req in crypt_message.] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/cifs/cifsglob.h | 70 ++++++++++++++++++++++ fs/cifs/cifsproto.h | 4 +- fs/cifs/misc.c | 4 +- fs/cifs/smb2ops.c | 139 +++++++++++++++++++++----------------------- 4 files changed, 141 insertions(+), 76 deletions(-) diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h index 08e9edbd8337..3a5ad0add234 100644 --- a/fs/cifs/cifsglob.h +++ b/fs/cifs/cifsglob.h @@ -22,6 +22,8 @@ #include <linux/in.h> #include <linux/in6.h> #include <linux/slab.h> +#include <linux/scatterlist.h> +#include <linux/mm.h> #include <linux/mempool.h> #include <linux/workqueue.h> #include "cifs_fs_sb.h" @@ -29,6 +31,7 @@ #include <crypto/internal/hash.h> #include <linux/scatterlist.h> #include <uapi/linux/cifs/cifs_mount.h> +#include "smb2glob.h" #include "smb2pdu.h" #define CIFS_MAGIC_NUMBER 0xFF534D42 /* the first four bytes of SMB PDUs */ @@ -1835,4 +1838,71 @@ extern struct smb_version_values smb302_values; #define ALT_SMB311_VERSION_STRING "3.11" extern struct smb_version_operations smb311_operations; extern struct smb_version_values smb311_values; + +static inline unsigned int cifs_get_num_sgs(const struct smb_rqst *rqst, + int num_rqst, + const u8 *sig) +{ + unsigned int len, skip; + unsigned int nents = 0; + unsigned long addr; + int i, j; + + /* Assumes the first rqst has a transform header as the first iov. + * I.e. + * rqst[0].rq_iov[0] is transform header + * rqst[0].rq_iov[1+] data to be encrypted/decrypted + * rqst[1+].rq_iov[0+] data to be encrypted/decrypted + */ + for (i = 0; i < num_rqst; i++) { + /* + * The first rqst has a transform header where the + * first 20 bytes are not part of the encrypted blob. + */ + for (j = 0; j < rqst[i].rq_nvec; j++) { + struct kvec *iov = &rqst[i].rq_iov[j]; + + skip = (i == 0) && (j == 0) ? 20 : 0; + addr = (unsigned long)iov->iov_base + skip; + if (unlikely(is_vmalloc_addr((void *)addr))) { + len = iov->iov_len - skip; + nents += DIV_ROUND_UP(offset_in_page(addr) + len, + PAGE_SIZE); + } else { + nents++; + } + } + nents += rqst[i].rq_npages; + } + nents += DIV_ROUND_UP(offset_in_page(sig) + SMB2_SIGNATURE_SIZE, PAGE_SIZE); + return nents; +} + +/* We can not use the normal sg_set_buf() as we will sometimes pass a + * stack object as buf. + */ +static inline struct scatterlist *cifs_sg_set_buf(struct scatterlist *sg, + const void *buf, + unsigned int buflen) +{ + unsigned long addr = (unsigned long)buf; + unsigned int off = offset_in_page(addr); + + addr &= PAGE_MASK; + if (unlikely(is_vmalloc_addr((void *)addr))) { + do { + unsigned int len = min_t(unsigned int, buflen, PAGE_SIZE - off); + + sg_set_page(sg++, vmalloc_to_page((void *)addr), len, off); + + off = 0; + addr += PAGE_SIZE; + buflen -= len; + } while (buflen); + } else { + sg_set_page(sg++, virt_to_page(addr), buflen, off); + } + return sg; +} + #endif /* _CIFS_GLOB_H */ diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h index bd97f2abeee8..357d8f32583b 100644 --- a/fs/cifs/cifsproto.h +++ b/fs/cifs/cifsproto.h @@ -562,7 +562,7 @@ int cifs_alloc_hash(const char *name, struct crypto_shash **shash, struct sdesc **sdesc); void cifs_free_hash(struct crypto_shash **shash, struct sdesc **sdesc); -extern void rqst_page_get_length(struct smb_rqst *rqst, unsigned int page, - unsigned int *len, unsigned int *offset); +void rqst_page_get_length(const struct smb_rqst *rqst, unsigned int page, + unsigned int *len, unsigned int *offset); #endif /* _CIFSPROTO_H */ diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c index 006f05ad2b80..17bd7901c4b7 100644 --- a/fs/cifs/misc.c +++ b/fs/cifs/misc.c @@ -954,8 +954,8 @@ cifs_free_hash(struct crypto_shash **shash, struct sdesc **sdesc) * Input: rqst - a smb_rqst, page - a page index for rqst * Output: *len - the length for this page, *offset - the offset for this page */ -void rqst_page_get_length(struct smb_rqst *rqst, unsigned int page, - unsigned int *len, unsigned int *offset) +void rqst_page_get_length(const struct smb_rqst *rqst, unsigned int page, + unsigned int *len, unsigned int *offset) { *len = rqst->rq_pagesz; *offset = (page == 0) ? rqst->rq_offset : 0; diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c index 193bfdc9d1d7..fe6d5d0e93f6 100644 --- a/fs/cifs/smb2ops.c +++ b/fs/cifs/smb2ops.c @@ -2603,69 +2603,83 @@ fill_transform_hdr(struct smb2_transform_hdr *tr_hdr, unsigned int orig_len, memcpy(&tr_hdr->SessionId, &shdr->SessionId, 8); } -/* We can not use the normal sg_set_buf() as we will sometimes pass a - * stack object as buf. - */ -static inline void smb2_sg_set_buf(struct scatterlist *sg, const void *buf, - unsigned int buflen) +static void *smb2_aead_req_alloc(struct crypto_aead *tfm, const struct smb_rqst *rqst, + int num_rqst, const u8 *sig, u8 **iv, + struct aead_request **req, struct scatterlist **sgl, + unsigned int *num_sgs) { - void *addr; - /* - * VMAP_STACK (at least) puts stack into the vmalloc address space - */ - if (is_vmalloc_addr(buf)) - addr = vmalloc_to_page(buf); - else - addr = virt_to_page(buf); - sg_set_page(sg, addr, buflen, offset_in_page(buf)); + unsigned int req_size = sizeof(**req) + crypto_aead_reqsize(tfm); + unsigned int iv_size = crypto_aead_ivsize(tfm); + unsigned int len; + u8 *p; + + *num_sgs = cifs_get_num_sgs(rqst, num_rqst, sig); + + len = iv_size; + len += crypto_aead_alignmask(tfm) & ~(crypto_tfm_ctx_alignment() - 1); + len = ALIGN(len, crypto_tfm_ctx_alignment()); + len += req_size; + len = ALIGN(len, __alignof__(struct scatterlist)); + len += *num_sgs * sizeof(**sgl); + + p = kmalloc(len, GFP_ATOMIC); + if (!p) + return NULL; + + *iv = (u8 *)PTR_ALIGN(p, crypto_aead_alignmask(tfm) + 1); + *req = (struct aead_request *)PTR_ALIGN(*iv + iv_size, + crypto_tfm_ctx_alignment()); + *sgl = (struct scatterlist *)PTR_ALIGN((u8 *)*req + req_size, + __alignof__(struct scatterlist)); + return p; } -/* Assumes the first rqst has a transform header as the first iov. - * I.e. - * rqst[0].rq_iov[0] is transform header - * rqst[0].rq_iov[1+] data to be encrypted/decrypted - * rqst[1+].rq_iov[0+] data to be encrypted/decrypted - */ -static struct scatterlist * -init_sg(int num_rqst, struct smb_rqst *rqst, u8 *sign) +static void *smb2_get_aead_req(struct crypto_aead *tfm, const struct smb_rqst *rqst, + int num_rqst, const u8 *sig, u8 **iv, + struct aead_request **req, struct scatterlist **sgl) { - unsigned int sg_len; + unsigned int off, len, skip; struct scatterlist *sg; - unsigned int i; - unsigned int j; - unsigned int idx = 0; - int skip; - - sg_len = 1; - for (i = 0; i < num_rqst; i++) - sg_len += rqst[i].rq_nvec + rqst[i].rq_npages; + unsigned int num_sgs; + unsigned long addr; + int i, j; + void *p; - sg = kmalloc_array(sg_len, sizeof(struct scatterlist), GFP_KERNEL); - if (!sg) + p = smb2_aead_req_alloc(tfm, rqst, num_rqst, sig, iv, req, sgl, &num_sgs); + if (!p) return NULL; - sg_init_table(sg, sg_len); + sg_init_table(*sgl, num_sgs); + sg = *sgl; + + /* Assumes the first rqst has a transform header as the first iov. + * I.e. + * rqst[0].rq_iov[0] is transform header + * rqst[0].rq_iov[1+] data to be encrypted/decrypted + * rqst[1+].rq_iov[0+] data to be encrypted/decrypted + */ for (i = 0; i < num_rqst; i++) { + /* + * The first rqst has a transform header where the + * first 20 bytes are not part of the encrypted blob. + */ for (j = 0; j < rqst[i].rq_nvec; j++) { - /* - * The first rqst has a transform header where the - * first 20 bytes are not part of the encrypted blob - */ + struct kvec *iov = &rqst[i].rq_iov[j]; + skip = (i == 0) && (j == 0) ? 20 : 0; - smb2_sg_set_buf(&sg[idx++], - rqst[i].rq_iov[j].iov_base + skip, - rqst[i].rq_iov[j].iov_len - skip); + addr = (unsigned long)iov->iov_base + skip; + len = iov->iov_len - skip; + sg = cifs_sg_set_buf(sg, (void *)addr, len); } for (j = 0; j < rqst[i].rq_npages; j++) { - unsigned int len, offset; - - rqst_page_get_length(&rqst[i], j, &len, &offset); - sg_set_page(&sg[idx++], rqst[i].rq_pages[j], len, offset); + rqst_page_get_length(&rqst[i], j, &len, &off); + sg_set_page(sg++, rqst[i].rq_pages[j], len, off); } } - smb2_sg_set_buf(&sg[idx], sign, SMB2_SIGNATURE_SIZE); - return sg; + cifs_sg_set_buf(sg, sig, SMB2_SIGNATURE_SIZE); + + return p; } static int @@ -2707,11 +2721,11 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst, u8 sign[SMB2_SIGNATURE_SIZE] = {}; u8 key[SMB3_SIGN_KEY_SIZE]; struct aead_request *req; - char *iv; - unsigned int iv_len; + u8 *iv; DECLARE_CRYPTO_WAIT(wait); struct crypto_aead *tfm; unsigned int crypt_len = le32_to_cpu(tr_hdr->OriginalMessageSize); + void *creq; rc = smb2_get_enc_key(server, tr_hdr->SessionId, enc, key); if (rc) { @@ -2740,34 +2754,19 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst, return rc; } - req = aead_request_alloc(tfm, GFP_KERNEL); - if (!req) { - cifs_dbg(VFS, "%s: Failed to alloc aead request", __func__); + creq = smb2_get_aead_req(tfm, rqst, num_rqst, sign, &iv, &req, &sg); + if (unlikely(!creq)) return -ENOMEM; - } if (!enc) { memcpy(sign, &tr_hdr->Signature, SMB2_SIGNATURE_SIZE); crypt_len += SMB2_SIGNATURE_SIZE; } - sg = init_sg(num_rqst, rqst, sign); - if (!sg) { - cifs_dbg(VFS, "%s: Failed to init sg", __func__); - rc = -ENOMEM; - goto free_req; - } - - iv_len = crypto_aead_ivsize(tfm); - iv = kzalloc(iv_len, GFP_KERNEL); - if (!iv) { - cifs_dbg(VFS, "%s: Failed to alloc IV", __func__); - rc = -ENOMEM; - goto free_sg; - } iv[0] = 3; memcpy(iv + 1, (char *)tr_hdr->Nonce, SMB3_AES128CMM_NONCE); + aead_request_set_tfm(req, tfm); aead_request_set_crypt(req, sg, sg, crypt_len, iv); aead_request_set_ad(req, assoc_data_len); @@ -2780,11 +2779,7 @@ crypt_message(struct TCP_Server_Info *server, int num_rqst, if (!rc && enc) memcpy(&tr_hdr->Signature, sign, SMB2_SIGNATURE_SIZE); - kfree(iv); -free_sg: - kfree(sg); -free_req: - kfree(req); + kfree(creq); return rc; } -- 2.31.1

2 1

[PATCH OLK-6.6 0/3] *** OLK-6.6-fix-CVE-2025-39787 ***
by Chen Jinghuang 14 Oct '25

14 Oct '25

*** BLURB HERE *** Bjorn Andersson (2): [Backport] soc: qcom: mdt_loader: Ensure we don't read past the ELF header [Backport] soc: qcom: mdt_loader: Deal with zero e_shentsize Dan Carpenter (1): [Backport] soc: qcom: mdt_loader: Fix error return values in mdt_header_valid() drivers/soc/qcom/mdt_loader.c | 45 +++++++++++++++++++++++++++++++++++ 1 file changed, 45 insertions(+) -- 2.34.1

2 4

[PATCH v6 openEuler-25.03 00/16] Xsched Kernel Patch
by Xia Fukun 14 Oct '25

14 Oct '25

Xsched Kernel Patch Alekseev Dmitry (3): xsched: Add XCU control group implementation and its backend in xsched CFS xsched: Add support for CFS quota for cgroups xsched/core: Add xcu_wait() implementation Konstantin Meskhidze (11): xsched: Add base vstream support xcu: Add base NPU driver support xsched: Add debug prints in XSched mechanism xsched: Add XCU initialization support xsched: Introduce vstream management xsched: Add vstream_kick() implementation xsched: Add xsched_ctx_init_xse() implementation xsched: Add XCU xsched_schedule() implementation xsched: Add xsched RT class xsched: Add xsched_submit() implementation xsched: Add xsched CFS class Liu Kai (1): xsched/core: Add multi-card support for xsched Xia Fukun (1): XSched driver patch arch/arm/include/uapi/asm/unistd.h | 1 + arch/arm64/configs/openeuler_defconfig | 1 + arch/powerpc/include/uapi/asm/unistd.h | 1 + arch/x86/configs/openeuler_defconfig | 1 + arch/x86/entry/syscalls/syscall_64.tbl | 2 +- arch/x86/include/uapi/asm/unistd.h | 1 + drivers/Makefile | 1 + .../0001-Adapt-910b-npu-driver-for-xsched.txt | 917 ++++++++++++++++++ drivers/xcu/Makefile | 2 + drivers/xcu/xcu_group.c | 246 +++++ include/linux/cgroup_subsys.h | 4 + include/linux/syscalls.h | 2 + include/linux/vstream.h | 86 ++ include/linux/xcu_group.h | 112 +++ include/linux/xsched.h | 625 ++++++++++++ include/uapi/asm-generic/unistd.h | 5 +- include/uapi/linux/xcu_vstream.h | 57 ++ init/Kconfig | 1 + kernel/Makefile | 1 + kernel/cgroup/cgroup.c | 2 +- kernel/xsched/Kconfig | 51 + kernel/xsched/Makefile | 4 + kernel/xsched/cfs.c | 227 +++++ kernel/xsched/cfs_quota.c | 92 ++ kernel/xsched/cgroup.c | 680 +++++++++++++ kernel/xsched/core.c | 752 ++++++++++++++ kernel/xsched/rt.c | 242 +++++ kernel/xsched/vstream.c | 502 ++++++++++ 28 files changed, 4614 insertions(+), 4 deletions(-) create mode 100644 drivers/xcu/0001-Adapt-910b-npu-driver-for-xsched.txt create mode 100644 drivers/xcu/Makefile create mode 100644 drivers/xcu/xcu_group.c create mode 100644 include/linux/vstream.h create mode 100644 include/linux/xcu_group.h create mode 100644 include/linux/xsched.h create mode 100644 include/uapi/linux/xcu_vstream.h create mode 100644 kernel/xsched/Kconfig create mode 100644 kernel/xsched/Makefile create mode 100644 kernel/xsched/cfs.c create mode 100644 kernel/xsched/cfs_quota.c create mode 100644 kernel/xsched/cgroup.c create mode 100644 kernel/xsched/core.c create mode 100644 kernel/xsched/rt.c create mode 100644 kernel/xsched/vstream.c -- 2.34.1

2 17