- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] PM: sleep: core: Clear power.must_resume in noirq suspend error path
by Xinyu Zheng 05 Nov '25

05 Nov '25

From: "Rafael J. Wysocki" <rafael.j.wysocki(a)intel.com> mainline inclusion from mainline-v6.18-rc1 commit be82483d1b60baf6747884bd74cb7de484deaf76 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID4AQL Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------------------------------------- If system suspend is aborted in the "noirq" phase (for instance, due to an error returned by one of the device callbacks), power.is_noirq_suspended will not be set for some devices and device_resume_noirq() will return early for them. Consequently, noirq resume callbacks will not run for them at all because the noirq suspend callbacks have not run for them yet. If any of them has power.must_resume set and late suspend has been skipped for it (due to power.smart_suspend), early resume should be skipped for it either, or its state may become inconsistent (for instance, if the early resume assumes that it will always follow noirq resume). Make that happen by clearing power.must_resume in device_resume_noirq() for devices with power.is_noirq_suspended clear that have been left in suspend by device_suspend_late(), which will subsequently cause device_resume_early() to leave the device in suspend and avoid changing its state. Fixes: 0d4b54c6fee8 ("PM / core: Add LEAVE_SUSPENDED driver flag") Link: https://lore.kernel.org/linux-pm/5d692b81-6f58-4e86-9cb0-ede69a09d799@rowla… Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Reviewed-by: Ulf Hansson <ulf.hansson(a)linaro.org> Link: https://patch.msgid.link/3381776.aeNJFYEL58@rafael.j.wysocki Conflicts: drivers/base/power/main.c [context conflict and function rename] Signed-off-by: Xinyu Zheng <zhengxinyu6(a)huawei.com> --- drivers/base/power/main.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c index fe7506aae13c..703de8f203a6 100644 --- a/drivers/base/power/main.c +++ b/drivers/base/power/main.c @@ -625,8 +625,20 @@ static int device_resume_noirq(struct device *dev, pm_message_t state, bool asyn if (dev->power.syscore || dev->power.direct_complete) goto Out; - if (!dev->power.is_noirq_suspended) + if (!dev->power.is_noirq_suspended) { + /* + * This means that system suspend has been aborted in the noirq + * phase before invoking the noirq suspend callback for the + * device, so if device_suspend_late() has left it in suspend, + * device_resume_early() should leave it in suspend either in + * case the early resume of it depends on the noirq resume that + * has not run. + */ + if (dev_pm_smart_suspend_and_suspended(dev)) + dev->power.must_resume = false; + goto Out; + } dpm_wait_for_superior(dev, async); -- 2.34.1

2 1

[PATCH OLK-6.6] mm: swap: check for stable address space before operating on the VMA
by Ze Zuo 05 Nov '25

05 Nov '25

From: Charan Teja Kalla <charan.kalla(a)oss.qualcomm.com> mainline inclusion from mainline-v6.18-rc1 commit 1367da7eb875d01102d2ed18654b24d261ff5393 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID22QV CVE: CVE-2025-39992 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- It is possible to hit a zero entry while traversing the vmas in unuse_mm() called from swapoff path and accessing it causes the OOPS: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000446--> Loading the memory from offset 0x40 on the XA_ZERO_ENTRY as address. Mem abort info: ESR = 0x0000000096000005 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x05: level 1 translation fault The issue is manifested from the below race between the fork() on a process and swapoff: fork(dup_mmap()) swapoff(unuse_mm) --------------- ----------------- 1) Identical mtree is built using __mt_dup(). 2) copy_pte_range()--> copy_nonpresent_pte(): The dst mm is added into the mmlist to be visible to the swapoff operation. 3) Fatal signal is sent to the parent process(which is the current during the fork) thus skip the duplication of the vmas and mark the vma range with XA_ZERO_ENTRY as a marker for this process that helps during exit_mmap(). 4) swapoff is tried on the 'mm' added to the 'mmlist' as part of the 2. 5) unuse_mm(), that iterates through the vma's of this 'mm' will hit the non-NULL zero entry and operating on this zero entry as a vma is resulting into the oops. The proper fix would be around not exposing this partially-valid tree to others when droping the mmap lock, which is being solved with [1]. A simpler solution would be checking for MMF_UNSTABLE, as it is set if mm_struct is not fully initialized in dup_mmap(). Thanks to Liam/Lorenzo/David for all the suggestions in fixing this issue. Link: https://lkml.kernel.org/r/20250924181138.1762750-1-charan.kalla@oss.qualcom… Link: https://lore.kernel.org/all/20250815191031.3769540-1-Liam.Howlett@oracle.co… [1] Fixes: d24062914837 ("fork: use __mt_dup() to duplicate maple tree in dup_mmap()") Signed-off-by: Charan Teja Kalla <charan.kalla(a)oss.qualcomm.com> Suggested-by: David Hildenbrand <david(a)redhat.com> Cc: Baoquan He <bhe(a)redhat.com> Cc: Barry Song <baohua(a)kernel.org> Cc: Chris Li <chrisl(a)kernel.org> Cc: Kairui Song <kasong(a)tencent.com> Cc: Kemeng Shi <shikemeng(a)huaweicloud.com> Cc: Liam Howlett <liam.howlett(a)oracle.com> Cc: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Cc: Nhat Pham <nphamcs(a)gmail.com> Cc: Peng Zhang <zhangpeng.00(a)bytedance.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- mm/swapfile.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/mm/swapfile.c b/mm/swapfile.c index 5e77c6417ec6..3c98e0447994 100644 --- a/mm/swapfile.c +++ b/mm/swapfile.c @@ -2190,6 +2190,8 @@ static int unuse_mm(struct mm_struct *mm, unsigned int type) VMA_ITERATOR(vmi, mm, 0); mmap_read_lock(mm); + if (check_stable_address_space(mm)) + goto unlock; for_each_vma(vmi, vma) { if (vma->anon_vma && !is_vm_hugetlb_page(vma)) { ret = unuse_vma(vma, type); @@ -2199,6 +2201,7 @@ static int unuse_mm(struct mm_struct *mm, unsigned int type) cond_resched(); } +unlock: mmap_read_unlock(mm); return ret; } -- 2.25.1

2 1

[PATCH OLK-6.6 0/3] CVE-2025-39910
by Ze Zuo 05 Nov '25

05 Nov '25

CVE-2025-39910 Alexander Gordeev (1): kasan: avoid sleepable page allocation from atomic context Andrey Konovalov (1): kasan: use unchecked __memset internally Uladzislau Rezki (Sony) (1): mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc() include/linux/kasan.h | 6 +-- mm/kasan/report.c | 4 +- mm/kasan/shadow.c | 111 ++++++++++++++++++++++++++++++++++++------ mm/vmalloc.c | 8 +-- 4 files changed, 105 insertions(+), 24 deletions(-) -- 2.25.1

2 4

[PATCH OLK-6.6 0/2] CVE-2025-38627
by Ze Zuo 05 Nov '25

05 Nov '25

CVE-2025-38627 Zhiguo Niu (2): f2fs: compress: change the first parameter of page_array_{alloc,free} to sbi f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic fs/f2fs/compress.c | 76 +++++++++++++++++++++++----------------------- fs/f2fs/f2fs.h | 2 ++ 2 files changed, 40 insertions(+), 38 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6] KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls
by Ze Zuo 05 Nov '25

05 Nov '25

From: Manuel Andreas <manuel.andreas(a)tum.de> mainline inclusion from mainline-v6.16-rc1 commit 5a53249d149f48b558368c5338b9921b76a12f8c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICPD7K CVE: CVE-2025-38469 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- kvm_xen_schedop_poll does a kmalloc_array() when a VM polls the host for more than one event channel potr (nr_ports > 1). After the kmalloc_array(), the error paths need to go through the "out" label, but the call to kvm_read_guest_virt() does not. Fixes: 92c58965e965 ("KVM: x86/xen: Use kvm_read_guest_virt() instead of open-coding it badly") Reviewed-by: David Woodhouse <dwmw(a)amazon.co.uk> Signed-off-by: Manuel Andreas <manuel.andreas(a)tum.de> [Adjusted commit message. - Paolo] Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com> Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- arch/x86/kvm/xen.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/kvm/xen.c b/arch/x86/kvm/xen.c index 0ea6016ad132..eb62e05e8e63 100644 --- a/arch/x86/kvm/xen.c +++ b/arch/x86/kvm/xen.c @@ -1260,7 +1260,7 @@ static bool kvm_xen_schedop_poll(struct kvm_vcpu *vcpu, bool longmode, if (kvm_read_guest_virt(vcpu, (gva_t)sched_poll.ports, ports, sched_poll.nr_ports * sizeof(*ports), &e)) { *r = -EFAULT; - return true; + goto out; } for (i = 0; i < sched_poll.nr_ports; i++) { -- 2.25.1

2 1

[PATCH OLK-6.6] maple_tree: fix MA_STATE_PREALLOC flag in mas_preallocate()
by Ze Zuo 05 Nov '25

05 Nov '25

From: "Liam R. Howlett" <Liam.Howlett(a)oracle.com> stable inclusion from stable-v6.6.99 commit e63032e66bca1d06e600033f3369ba3db3af0870 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICOXDR CVE: CVE-2025-38364 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit fba46a5d83ca8decb338722fb4899026d8d9ead2 upstream. Temporarily clear the preallocation flag when explicitly requesting allocations. Pre-existing allocations are already counted against the request through mas_node_count_gfp(), but the allocations will not happen if the MA_STATE_PREALLOC flag is set. This flag is meant to avoid re-allocating in bulk allocation mode, and to detect issues with preallocation calculations. The MA_STATE_PREALLOC flag should also always be set on zero allocations so that detection of underflow allocations will print a WARN_ON() during consumption. User visible effect of this flaw is a WARN_ON() followed by a null pointer dereference when subsequent requests for larger number of nodes is ignored, such as the vma merge retry in mmap_region() caused by drivers altering the vma flags (which happens in v6.6, at least) Link: https://lkml.kernel.org/r/20250616184521.3382795-3-Liam.Howlett@oracle.com Fixes: 54a611b60590 ("Maple Tree: add new data structure") Signed-off-by: Liam R. Howlett <Liam.Howlett(a)oracle.com> Reported-by: Zhaoyang Huang <zhaoyang.huang(a)unisoc.com> Reported-by: Hailong Liu <hailong.liu(a)oppo.com> Link: https://lore.kernel.org/all/1652f7eb-a51b-4fee-8058-c73af63bacd1@oppo.com/ Link: https://lore.kernel.org/all/20250428184058.1416274-1-Liam.Howlett@oracle.co… Link: https://lore.kernel.org/all/20250429014754.1479118-1-Liam.Howlett@oracle.co… Cc: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Cc: Suren Baghdasaryan <surenb(a)google.com> Cc: Hailong Liu <hailong.liu(a)oppo.com> Cc: zhangpeng.00(a)bytedance.com <zhangpeng.00(a)bytedance.com> Cc: Steve Kang <Steve.Kang(a)unisoc.com> Cc: Matthew Wilcox <willy(a)infradead.org> Cc: Sidhartha Kumar <sidhartha.kumar(a)oracle.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Liam R. Howlett <Liam.Howlett(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: lib/maple_tree.c [context conflicts due to merged mainline 5143eecd2af2 ("lib/maple_tree.c: fix build error due to hotfix alteration")] Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- lib/maple_tree.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/lib/maple_tree.c b/lib/maple_tree.c index 88e478d6840c..cdec348e7820 100644 --- a/lib/maple_tree.c +++ b/lib/maple_tree.c @@ -5571,7 +5571,7 @@ int mas_preallocate(struct ma_state *mas, void *entry, gfp_t gfp) /* At this point, we are at the leaf node that needs to be altered. */ /* Exact fit, no nodes needed. */ if (wr_mas.r_min == mas->index && wr_mas.r_max == mas->last) - return 0; + goto set_flag; mas_wr_end_piv(&wr_mas); node_size = mas_wr_new_end(&wr_mas); @@ -5580,10 +5580,10 @@ int mas_preallocate(struct ma_state *mas, void *entry, gfp_t gfp) if (node_size == mas->end) { /* reuse node */ if (!mt_in_rcu(mas->tree)) - return 0; + goto set_flag; /* shifting boundary */ if (wr_mas.offset_end - mas->offset == 1) - return 0; + goto set_flag; } if (node_size >= mt_slots[wr_mas.type]) { @@ -5602,10 +5602,13 @@ int mas_preallocate(struct ma_state *mas, void *entry, gfp_t gfp) /* node store, slot store needs one node */ ask_now: + mas->mas_flags &= ~MA_STATE_PREALLOC; mas_node_count_gfp(mas, request, gfp); - mas->mas_flags |= MA_STATE_PREALLOC; - if (likely(!mas_is_err(mas))) + if (likely(!mas_is_err(mas))) { +set_flag: + mas->mas_flags |= MA_STATE_PREALLOC; return 0; + } mas_set_alloc_req(mas, 0); ret = xa_err(mas->node); -- 2.25.1

2 1

[PATCH OLK-6.6] ASoC: Intel: avs: Fix null-ptr-deref in avs_component_probe()
by Ze Zuo 05 Nov '25

05 Nov '25

From: Henry Martin <bsdhenrymartin(a)gmail.com> mainline inclusion from mainline-v6.15-rc3 commit 95f723cf141b95e3b3a5b92cf2ea98a863fe7275 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IC8J7I CVE: CVE-2025-37793 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 95f723cf141b95e3b3a5b92cf2ea98a863fe7275 ] devm_kasprintf() returns NULL when memory allocation fails. Currently, avs_component_probe() does not check for this case, which results in a NULL pointer dereference. Fixes: 739c031110da ("ASoC: Intel: avs: Provide support for fallback topology") Reviewed-by: Cezary Rojewski <cezary.rojewski(a)intel.com> Reviewed-by: Ethan Carter Edwards <ethan(a)ethancedwards.com> Signed-off-by: Henry Martin <bsdhenrymartin(a)gmail.com> Link: https://patch.msgid.link/20250402141411.44972-1-bsdhenrymartin@gmail.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- sound/soc/intel/avs/pcm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/sound/soc/intel/avs/pcm.c b/sound/soc/intel/avs/pcm.c index bb1e77ac78e0..781019685b94 100644 --- a/sound/soc/intel/avs/pcm.c +++ b/sound/soc/intel/avs/pcm.c @@ -808,7 +808,8 @@ static int avs_component_probe(struct snd_soc_component *component) else mach->tplg_filename = devm_kasprintf(adev->dev, GFP_KERNEL, "hda-generic-tplg.bin"); - + if (!mach->tplg_filename) + return -ENOMEM; filename = kasprintf(GFP_KERNEL, "%s/%s", component->driver->topology_name_prefix, mach->tplg_filename); if (!filename) -- 2.25.1

2 1

[PATCH OLK-6.6 0/2] CVE-2025-22090
by Ze Zuo 05 Nov '25

05 Nov '25

CVE-2025-22090 David Hildenbrand (2): x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() mm: (un)track_pfn_copy() fix + doc improvements arch/x86/mm/pat/memtype.c | 52 +++++++++++++++++++++------------------ include/linux/pgtable.h | 31 ++++++++++++++++++----- kernel/fork.c | 4 +++ mm/memory.c | 11 +++------ 4 files changed, 61 insertions(+), 37 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6] hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio
by Ze Zuo 05 Nov '25

05 Nov '25

From: Ma Wupeng <mawupeng1(a)huawei.com> mainline inclusion from mainline-v6.14-rc6 commit af288a426c3e3552b62595c6138ec6371a17dbba category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBY42N CVE: CVE-2025-21931 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Commit b15c87263a69 ("hwpoison, memory_hotplug: allow hwpoisoned pages to be offlined) add page poison checks in do_migrate_range in order to make offline hwpoisoned page possible by introducing isolate_lru_page and try_to_unmap for hwpoisoned page. However folio lock must be held before calling try_to_unmap. Add it to fix this problem. Warning will be produced if folio is not locked during unmap: ------------[ cut here ]------------ kernel BUG at ./include/linux/swapops.h:400! Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP Modules linked in: CPU: 4 UID: 0 PID: 411 Comm: bash Tainted: G W 6.13.0-rc1-00016-g3c434c7ee82a-dirty #41 Tainted: [W]=WARN Hardware name: QEMU QEMU Virtual Machine, BIOS 0.0.0 02/06/2015 pstate: 40400005 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : try_to_unmap_one+0xb08/0xd3c lr : try_to_unmap_one+0x3dc/0xd3c Call trace: try_to_unmap_one+0xb08/0xd3c (P) try_to_unmap_one+0x3dc/0xd3c (L) rmap_walk_anon+0xdc/0x1f8 rmap_walk+0x3c/0x58 try_to_unmap+0x88/0x90 unmap_poisoned_folio+0x30/0xa8 do_migrate_range+0x4a0/0x568 offline_pages+0x5a4/0x670 memory_block_action+0x17c/0x374 memory_subsys_offline+0x3c/0x78 device_offline+0xa4/0xd0 state_store+0x8c/0xf0 dev_attr_store+0x18/0x2c sysfs_kf_write+0x44/0x54 kernfs_fop_write_iter+0x118/0x1a8 vfs_write+0x3a8/0x4bc ksys_write+0x6c/0xf8 __arm64_sys_write+0x1c/0x28 invoke_syscall+0x44/0x100 el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x30/0xd0 el0t_64_sync_handler+0xc8/0xcc el0t_64_sync+0x198/0x19c Code: f9407be0 b5fff320 d4210000 17ffff97 (d4210000) ---[ end trace 0000000000000000 ]--- Link: https://lkml.kernel.org/r/20250217014329.3610326-4-mawupeng1@huawei.com Fixes: b15c87263a69 ("hwpoison, memory_hotplug: allow hwpoisoned pages to be offlined") Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> Acked-by: David Hildenbrand <david(a)redhat.com> Acked-by: Miaohe Lin <linmiaohe(a)huawei.com> Cc: Michal Hocko <mhocko(a)suse.com> Cc: Naoya Horiguchi <nao.horiguchi(a)gmail.com> Cc: Oscar Salvador <osalvador(a)suse.de> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: mm/memory_hotplug.c [Wupeng Ma: Fix this based on ideas since too much conflicts] Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- mm/memory_hotplug.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c index 074ec691e892..cd67b161189b 100644 --- a/mm/memory_hotplug.c +++ b/mm/memory_hotplug.c @@ -1762,8 +1762,12 @@ void do_migrate_range(unsigned long start_pfn, unsigned long end_pfn) if (PageHWPoison(page)) { if (WARN_ON(folio_test_lru(folio))) folio_isolate_lru(folio); - if (folio_mapped(folio)) + if (folio_mapped(folio)) { + folio_lock(folio); try_to_unmap(folio, TTU_IGNORE_MLOCK | TTU_HWPOISON); + folio_unlock(folio); + } + continue; } -- 2.25.1

2 1

[PATCH OLK-6.6 0/2] CVE-2025-21696
by Ze Zuo 05 Nov '25

05 Nov '25

CVE-2025-21696 Lokesh Gidra (1): userfaultfd: move userfaultfd_ctx struct to header file Ryan Roberts (1): mm: clear uffd-wp PTE/PMD state on mremap() fs/userfaultfd.c | 39 --------------------------- include/linux/userfaultfd_k.h | 51 +++++++++++++++++++++++++++++++++++ mm/huge_memory.c | 12 +++++++++ mm/hugetlb.c | 14 +++++++++- mm/mremap.c | 32 +++++++++++++++++++++- 5 files changed, 107 insertions(+), 41 deletions(-) -- 2.25.1

2 3