- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] irqchip/gic-v3: Fix xint sleeping function called from invalid context
by Jinjie Ruan 11 Jun '25

11 Jun '25

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICEDX1 ------------------ disable_irq() and debugfs_create_symlink() might sleep, local_irq_disable() will mask IRQS on current PE. Because sleep is not allowed when interrupts are disabled, the following bug occurs. So move them out of local_irq_disable/enable() to fix it. BUG: sleeping function called from invalid context at kernel/irq/manage.c:737 in_atomic(): 0, irqs_disabled(): 1, non_block: 0, pid: 1033, name: bash preempt_count: 0, expected: 0 CPU: 1 PID: 1033 Comm: bash Not tainted 6.6.0+ #1 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0xf8/0x290 show_stack+0x3c/0x70 dump_stack_lvl+0x1a8/0x2e8 dump_stack+0x34/0x50 __might_resched+0x31c/0x5f8 __might_sleep+0xc8/0x1d8 disable_irq+0x48/0xb8 xint_proc_write+0x1b0/0x3f8 proc_reg_write+0x218/0x348 vfs_write+0x244/0xfd0 ksys_write+0x11c/0x290 __arm64_sys_write+0x8c/0xd8 invoke_syscall+0xb4/0x300 el0_svc_common.constprop.0+0x1f8/0x310 do_el0_svc+0x5c/0x88 el0_svc+0x44/0x200 el0t_64_sync_handler+0xc0/0xc8 el0t_64_sync+0x3b8/0x3c0 BUG: sleeping function called from invalid context at mm/slab.h:494 in_atomic(): 0, irqs_disabled(): 128, non_block: 0, pid: 414, name: bash CPU: 0 PID: 414 Comm: bash Tainted: G W 5.10.0-00033-gee505d161ada #4 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x0/0x430 show_stack+0x34/0x4c dump_stack+0x1d0/0x248 ___might_sleep+0x15c/0x1bc __might_sleep+0x7c/0x114 __kmalloc_track_caller+0x198/0x87c kstrdup+0x134/0x1d0 debugfs_create_symlink+0x3c/0x250 xint_add_debugfs_entry+0xd4/0x140 xint_transform+0x1f4/0x210 xint_proc_write+0x26c/0x344 proc_reg_write+0x184/0x210 vfs_write+0x17c/0x634 ksys_write+0x104/0x230 __arm64_sys_write+0x54/0x80 invoke_syscall+0x84/0x230 el0_xcall_common.constprop.0+0x1ec/0x204 do_el0_xcall+0x98/0x18c el0_xcall_handler+0x24/0x3c el0_sync+0x17c/0x194 Fixes: 63f9ef213a47 ("arm64: Add debugfs dir for xint") Fixes: 3053668e6b21 ("arm64: Introduce Xint software solution") Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- drivers/irqchip/irq-gic-v3.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c index 9d2a5cc50c33..4805b3280acc 100644 --- a/drivers/irqchip/irq-gic-v3.c +++ b/drivers/irqchip/irq-gic-v3.c @@ -1030,11 +1030,9 @@ static bool xint_transform(int irqno, enum xint_op op) switch (op) { case IRQ_TO_XINT: set_bit(hwirq, irqnr_xint_map); - xint_add_debugfs_entry(irqno); return true; case XINT_TO_IRQ: clear_bit(hwirq, irqnr_xint_map); - xint_remove_debugfs_entry(irqno); return false; case XINT_SET_CHECK: return test_bit(hwirq, irqnr_xint_map); @@ -1049,6 +1047,7 @@ static ssize_t xint_proc_write(struct file *file, const char __user *buffer, size_t count, loff_t *pos) { int irq = (int)(long)pde_data(file_inode(file)); + enum xint_op switch_type; bool xint_state = false; unsigned long val; char *buf = NULL; @@ -1071,13 +1070,21 @@ static ssize_t xint_proc_write(struct file *file, return -EBUSY; } - local_irq_disable(); + if (xint_state) { + switch_type = XINT_TO_IRQ; + xint_remove_debugfs_entry(irq); + } else { + switch_type = IRQ_TO_XINT; + xint_add_debugfs_entry(irq); + } + disable_irq(irq); + local_irq_disable(); - xint_transform(irq, xint_state ? XINT_TO_IRQ : IRQ_TO_XINT); + xint_transform(irq, switch_type); - enable_irq(irq); local_irq_enable(); + enable_irq(irq); kfree(buf); -- 2.34.1

2 1

[openeuler:OLK-5.10 2954/2954] arch/arm64/net/bpf_jit_comp.c:1514:29: sparse: sparse: incorrect type in assignment (different base types)
by kernel test robot 11 Jun '25

11 Jun '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 90ff3e07cc268a8e40bd578dcc4907a3db419c52 commit: 2a5ab77af7f94dc99ac894566927f4f934ed675b [2954/2954] bpf, arm64: Add bpf trampoline for arm64 config: arm64-randconfig-r133-20250610 (https://download.01.org/0day-ci/archive/20250611/202506111719.ynqhjFZY-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.3.0 reproduce: (https://download.01.org/0day-ci/archive/20250611/202506111719.ynqhjFZY-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202506111719.ynqhjFZY-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> arch/arm64/net/bpf_jit_comp.c:1514:29: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] * @@ got restricted __le32 [usertype] * @@ arch/arm64/net/bpf_jit_comp.c:1514:29: sparse: expected unsigned int [usertype] * arch/arm64/net/bpf_jit_comp.c:1514:29: sparse: got restricted __le32 [usertype] * arch/arm64/net/bpf_jit_comp.c:1663:52: sparse: sparse: subtraction of different types can't work (different base types) vim +1514 arch/arm64/net/bpf_jit_comp.c 1495 1496 static void invoke_bpf_mod_ret(struct jit_ctx *ctx, struct bpf_tramp_progs *tp, 1497 int args_off, int retval_off, u32 **branches) 1498 { 1499 int i; 1500 1501 /* The first fmod_ret program will receive a garbage return value. 1502 * Set this to 0 to avoid confusing the program. 1503 */ 1504 emit(A64_STR64I(A64_ZR, A64_SP, retval_off), ctx); 1505 for (i = 0; i < tp->nr_progs; i++) { 1506 invoke_bpf_prog(ctx, tp->progs[i], args_off, retval_off, true); 1507 /* if (*(u64 *)(sp + retval_off) != 0) 1508 * goto do_fexit; 1509 */ 1510 emit(A64_LDR64I(A64_R(10), A64_SP, retval_off), ctx); 1511 /* Save the location of branch, and generate a nop. 1512 * This nop will be replaced with a cbnz later. 1513 */ > 1514 branches[i] = ctx->image + ctx->idx; 1515 emit(A64_NOP, ctx); 1516 } 1517 } 1518 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] mm: slub: add __GFP_NOWARN when allocations with GFP_NOWAIT
by Nanyong Sun 11 Jun '25

11 Jun '25

From: Kaixiong Yu <yukaixiong(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICAVPP -------------------------------- GFP_NOWAIT callers are always prepared for their allocations to fail because they fail so frequently. In such case, don't need to generate a warning. So, add __GFP_NOWARN to flag when allocations. Fixes: 76e3125423ba ("mm/slub: Reduce memory consumption in extreme scenarios") Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- mm/slub.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/slub.c b/mm/slub.c index d4e7e88df7ff..bcc00a95c368 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -2782,7 +2782,7 @@ static void *___slab_alloc(struct kmem_cache *s, gfp_t gfpflags, int node, */ if (unlikely(node != NUMA_NO_NODE && !(gfpflags & __GFP_THISNODE) && try_thisnode)) - pc_gfpflags = GFP_NOWAIT | __GFP_THISNODE; + pc_gfpflags = GFP_NOWAIT | __GFP_THISNODE | __GFP_NOWARN; freelist = new_slab_objects(s, pc_gfpflags, node, &c); -- 2.34.1

2 1

[PATCH OLK-5.10] KVM: Explicitly verify target vCPU is online in kvm_get_vcpu()
by Nanyong Sun 11 Jun '25

11 Jun '25

From: Sean Christopherson <seanjc(a)google.com> stable inclusion from stable-v6.1.129 commit d817e510662fd1c9797952408d94806f97a5fffd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBRED7 CVE: CVE-2024-58083 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 1e7381f3617d14b3c11da80ff5f8a93ab14cfc46 upstream. Explicitly verify the target vCPU is fully online _prior_ to clamping the index in kvm_get_vcpu(). If the index is "bad", the nospec clamping will generate '0', i.e. KVM will return vCPU0 instead of NULL. In practice, the bug is unlikely to cause problems, as it will only come into play if userspace or the guest is buggy or misbehaving, e.g. KVM may send interrupts to vCPU0 instead of dropping them on the floor. However, returning vCPU0 when it shouldn't exist per online_vcpus is problematic now that KVM uses an xarray for the vCPUs array, as KVM needs to insert into the xarray before publishing the vCPU to userspace (see commit c5b077549136 ("KVM: Convert the kvm->vcpus array to a xarray")), i.e. before vCPU creation is guaranteed to succeed. As a result, incorrectly providing access to vCPU0 will trigger a use-after-free if vCPU0 is dereferenced and kvm_vm_ioctl_create_vcpu() bails out of vCPU creation due to an error and frees vCPU0. Commit afb2acb2e3a3 ("KVM: Fix vcpu_array[0] races") papered over that issue, but in doing so introduced an unsolvable teardown conundrum. Preventing accesses to vCPU0 before it's fully online will allow reverting commit afb2acb2e3a3, without re-introducing the vcpu_array[0] UAF race. Fixes: 1d487e9bf8ba ("KVM: fix spectrev1 gadgets") Cc: stable(a)vger.kernel.org Cc: Will Deacon <will(a)kernel.org> Cc: Michal Luczaj <mhal(a)rbox.co> Reviewed-by: Pankaj Gupta <pankaj.gupta(a)amd.com> Acked-by: Will Deacon <will(a)kernel.org> Link: https://lore.kernel.org/r/20241009150455.1057573-2-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- include/linux/kvm_host.h | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h index b8ae37549e2a..0bbfd625dd6c 100644 --- a/include/linux/kvm_host.h +++ b/include/linux/kvm_host.h @@ -670,6 +670,15 @@ static inline struct kvm_io_bus *kvm_get_bus(struct kvm *kvm, enum kvm_bus idx) static inline struct kvm_vcpu *kvm_get_vcpu(struct kvm *kvm, int i) { int num_vcpus = atomic_read(&kvm->online_vcpus); + + /* + * Explicitly verify the target vCPU is online, as the anti-speculation + * logic only limits the CPU's ability to speculate, e.g. given a "bad" + * index, clamping the index to 0 would return vCPU0, not NULL. + */ + if (i >= num_vcpus) + return NULL; + i = array_index_nospec(i, num_vcpus); /* Pairs with smp_wmb() in kvm_vm_ioctl_create_vcpu. */ -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] CVE-2023-53039
by Xiaomeng Zhang 11 Jun '25

11 Jun '25

Reka Norman (1): HID: intel-ish-hid: ipc: Fix potential use-after-free in work function Zhang Lixu (1): HID: intel-ish-hid: ipc: Fix dev_err usage with uninitialized dev->devc drivers/hid/intel-ish-hid/ipc/ipc.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10] cifs: fix mount deadlock by avoiding super block iteration in DFS reconnect
by Wang Zhaolong 11 Jun '25

11 Jun '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICE4PV CVE: NA -------------------------------- A deadlock issue occurs when network interruption during mount triggers DFS reconnection logic that calls iterate_supers_type(). The detailed call process is as follows: mount.cifs cifsd path_mount do_new_mount vfs_get_tree legacy_get_tree cifs_smb3_do_mount sget alloc_super down_write_nested(&s->s_umount, ..); // hold lock cifs_read_super cifs_root_iget cifs_get_inode_info smb2_query_path_info smb2_compound_op compound_send_recv wait_for_response // wait for cifsd to wake it up cifs_demultiplex_thread cifs_read_from_socket cifs_readv_from_socket server_unresponsive cifs_reconnect cifs_get_tcp_super __cifs_get_super iterate_supers_type down_read(&sb->s_umount); // block mid->callback() cifs_wake_up_task wake_up_process // won't be executed do_new_mount_fc up_write(&sb->s_umount); // release lock here This patch fixes the problem by doing the following: - Add vfs_sb back-pointer to cifs_sb_info for direct access - Protect list traversal with existing tcon->sb_list_lock - Use atomic operations to safely manage super block references - Remove complex callback-based iteration in favor of simple loop Fixes: 93d5cb517db3 ("cifs: Add support for failover in cifs_reconnect()") Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- fs/cifs/cifs_fs_sb.h | 1 + fs/cifs/cifsfs.c | 1 + fs/cifs/connect.c | 10 ++-- fs/cifs/misc.c | 121 +++++++++++++++++++++---------------------- 4 files changed, 66 insertions(+), 67 deletions(-) diff --git a/fs/cifs/cifs_fs_sb.h b/fs/cifs/cifs_fs_sb.h index d14002d67b6a..d180ef3f9d89 100644 --- a/fs/cifs/cifs_fs_sb.h +++ b/fs/cifs/cifs_fs_sb.h @@ -58,10 +58,11 @@ struct cifs_sb_info { struct rb_root tlink_tree; struct list_head tcon_sb_link; spinlock_t tlink_tree_lock; + struct super_block *vfs_sb; struct tcon_link *master_tlink; struct nls_table *local_nls; unsigned int bsize; unsigned int rsize; unsigned int wsize; diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c index dac20bbc2786..a86a1fb34e59 100644 --- a/fs/cifs/cifsfs.c +++ b/fs/cifs/cifsfs.c @@ -778,10 +778,11 @@ cifs_get_root(struct smb_vol *vol, struct super_block *sb) static int cifs_set_super(struct super_block *sb, void *data) { struct cifs_mnt_data *mnt_data = data; sb->s_fs_info = mnt_data->cifs_sb; + mnt_data->cifs_sb->vfs_sb = sb; return set_anon_super(sb, NULL); } static struct dentry * cifs_smb3_do_mount(struct file_system_type *fs_type, diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c index 56afed6d9ef8..23798ab5d5f1 100644 --- a/fs/cifs/connect.c +++ b/fs/cifs/connect.c @@ -405,16 +405,11 @@ cifs_reconnect(struct TCP_Server_Info *server) spin_lock(&GlobalMid_Lock); server->nr_targets = 1; #ifdef CONFIG_CIFS_DFS_UPCALL spin_unlock(&GlobalMid_Lock); sb = cifs_get_tcp_super(server); - if (IS_ERR(sb)) { - rc = PTR_ERR(sb); - cifs_dbg(FYI, "%s: will not do DFS failover: rc = %d\n", - __func__, rc); - sb = NULL; - } else { + if (sb) { cifs_sb = CIFS_SB(sb); rc = reconn_setup_dfs_targets(cifs_sb, &tgt_list); if (rc) { cifs_sb = NULL; if (rc != -EOPNOTSUPP) { @@ -422,10 +417,13 @@ cifs_reconnect(struct TCP_Server_Info *server) __func__); } } else { server->nr_targets = dfs_cache_get_nr_tgts(&tgt_list); } + } else { + cifs_dbg(FYI, "%s: will not do DFS failover\n", __func__); + rc = -EINVAL; } cifs_dbg(FYI, "%s: will retry %d target(s)\n", __func__, server->nr_targets); spin_lock(&GlobalMid_Lock); #endif diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c index 12131a5d5073..2b52750acc07 100644 --- a/fs/cifs/misc.c +++ b/fs/cifs/misc.c @@ -1034,66 +1034,52 @@ int copy_path_name(char *dst, const char *src) struct super_cb_data { void *data; struct super_block *sb; }; -static void tcp_super_cb(struct super_block *sb, void *arg) +struct super_block *cifs_get_tcp_super(struct TCP_Server_Info *server) { - struct super_cb_data *sd = arg; - struct TCP_Server_Info *server = sd->data; - struct cifs_sb_info *cifs_sb; + struct super_block *sb; + struct cifs_ses *ses; struct cifs_tcon *tcon; + struct cifs_sb_info *cifs_sb; - if (sd->sb) - return; - - cifs_sb = CIFS_SB(sb); - tcon = cifs_sb_master_tcon(cifs_sb); - if (tcon->ses->server == server) - sd->sb = sb; -} + if (!server) + return NULL; -static struct super_block *__cifs_get_super(void (*f)(struct super_block *, void *), - void *data) -{ - struct super_cb_data sd = { - .data = data, - .sb = NULL, - }; - struct file_system_type **fs_type = (struct file_system_type *[]) { - &cifs_fs_type, &smb3_fs_type, NULL, - }; - - for (; *fs_type; fs_type++) { - iterate_supers_type(*fs_type, f, &sd); - if (sd.sb) { - /* - * Grab an active reference in order to prevent automounts (DFS links) - * of expiring and then freeing up our cifs superblock pointer while - * we're doing failover. - */ - cifs_sb_active(sd.sb); - return sd.sb; + spin_lock(&cifs_tcp_ses_lock); + list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) { + list_for_each_entry(tcon, &ses->tcon_list, tcon_list) { + spin_lock(&tcon->sb_list_lock); + list_for_each_entry(cifs_sb, &tcon->cifs_sb_list, tcon_sb_link) { + sb = cifs_sb->vfs_sb; + + /* Safely increment s_active only if it's not zero. + * + * When s_active == 0, the super block is being deactivated + * and should not be used. This prevents UAF scenarios + * where we might grab a reference to a super block that's + * in the middle of destruction. + */ + if (!atomic_add_unless(&sb->s_active, 1, 0)) + continue; + spin_unlock(&tcon->sb_list_lock); + spin_unlock(&cifs_tcp_ses_lock); + return sb; + } + spin_unlock(&tcon->sb_list_lock); } } - return ERR_PTR(-EINVAL); -} - -static void __cifs_put_super(struct super_block *sb) -{ - if (!IS_ERR_OR_NULL(sb)) - cifs_sb_deactive(sb); -} + spin_unlock(&cifs_tcp_ses_lock); -struct super_block *cifs_get_tcp_super(struct TCP_Server_Info *server) -{ - return __cifs_get_super(tcp_super_cb, server); + return NULL; } void cifs_put_tcp_super(struct super_block *sb) { - __cifs_put_super(sb); + if (!IS_ERR_OR_NULL(sb)) + cifs_sb_deactive(sb); } #ifdef CONFIG_CIFS_DFS_UPCALL int match_target_ip(struct TCP_Server_Info *server, const char *share, size_t share_len, @@ -1138,33 +1124,46 @@ int match_target_ip(struct TCP_Server_Info *server, kfree(tip); return rc; } -static void tcon_super_cb(struct super_block *sb, void *arg) +static inline struct super_block *cifs_get_tcon_super(struct cifs_tcon *tcon) { - struct super_cb_data *sd = arg; - struct cifs_tcon *tcon = sd->data; struct cifs_sb_info *cifs_sb; + struct super_block *sb = ERR_PTR(-EINVAL); + + if (!tcon && list_empty(&tcon->cifs_sb_list)) + return sb; + + spin_lock(&tcon->sb_list_lock); + list_for_each_entry(cifs_sb, &tcon->cifs_sb_list, tcon_sb_link) { + sb = cifs_sb->vfs_sb; + + if (!tcon->dfs_path) + continue; + if (!cifs_sb->origin_fullpath) + continue; + if (strcasecmp(tcon->dfs_path, cifs_sb->origin_fullpath)) + continue; + /* + * Use atomic_add_unless to safely increment s_active. + * This ensures we don't add a reference to a super block + * that has s_active == 0 (being destroyed). + */ + if (!atomic_add_unless(&sb->s_active, 1, 0)) + continue; + break; + } + spin_unlock(&tcon->sb_list_lock); - if (sd->sb) - return; - - cifs_sb = CIFS_SB(sb); - if (tcon->dfs_path && cifs_sb->origin_fullpath && - !strcasecmp(tcon->dfs_path, cifs_sb->origin_fullpath)) - sd->sb = sb; -} - -static inline struct super_block *cifs_get_tcon_super(struct cifs_tcon *tcon) -{ - return __cifs_get_super(tcon_super_cb, tcon); + return sb; } static inline void cifs_put_tcon_super(struct super_block *sb) { - __cifs_put_super(sb); + if (!IS_ERR_OR_NULL(sb)) + cifs_sb_deactive(sb); } #else static inline struct super_block *cifs_get_tcon_super(struct cifs_tcon *tcon) { return ERR_PTR(-EOPNOTSUPP); -- 2.34.3

2 1

[PATCH OLK-5.10 0/2] CVE-2023-53039
by Xiaomeng Zhang 11 Jun '25

11 Jun '25

Reka Norman (1): HID: intel-ish-hid: ipc: Fix potential use-after-free in work function Zhang Lixu (1): HID: intel-ish-hid: ipc: Fix dev_err usage with uninitialized dev->devc drivers/hid/intel-ish-hid/ipc/ipc.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10 v8 00/12] arm64: Support xcall prefetch
by Jinjie Ruan 11 Jun '25

11 Jun '25

Support xcall prefetch. Changes in v8: - Support xcall prefetch on and off runtime. - Refactor the xcall proc interface code, move to /fs/proc/proc_xcall.c. - Fix xint irqnr_xint_map array out of bounds access problem in __handle_domain_irq() by introducing is_hwirq_xint() helper. - Introduce system_supports_xint() and system_supports_xcall() to reduce the overhead, and remove fast_syscall_enabeld(), remove extern is_xint_support. - Limit the task xinfo alloc and xcall prefetch init by system_supports_xcall() to reduce the overhead. Changes in v7: - Remove "echo @xxx > /proc/$PID/xcall" usage, replace with "echo 1 > /proc/$PID/prefetch". Now the xcall enable and prefetch can be enabled separately. Changes in v6: - Only use one reserved kabi in task_struct for xcall. - Free prefetch item after eventpoll_release_file() to avoid possible competition between ep_prefetch_item_enqueue() and pfi free. - Fix "echo > /proc/xcall/cpu_list" show problem. Changes in v5: - Fix dentry free before free_prefetch_item() and then UAF in prefetch work by cancel_work_sync() before free pfi and move free_prefetch_item() to the first of __fput(). - Fix __queue_work() oops bug. - /proc/xcall/mask_list -> /proc/xcall/cpu_list - Fix xcall_prefetch print data type. - Update prefetch tracepoint, move xcall points definition to separete header file. - Make xcall_prefetch depends on EPOLL. - Adjust xcall prefetch buf to 16KB by default. - Add xcall_prefetch_init() function. - Only use write lock in free_prefetch_item(). - Simplify xcall_read() and add some comment. - Update commit message. Changes in v4: - Enable FAST_SYSCALL/IRQ and XCALL_PREFETCH by default. - Fix xint sleeping function called from invalid context bug. - free_prefetch_item() in file_free() instead of filp_close(), which fix the alloc-queue and free competition. - Fix kernel_read() warning for FMODE_READ not set. - Add sock_from_file() limit for prefetch. - Check NULL for rc_work. - Simplfy the cpumask interface code, and rename to "/proc/xcall/mask_list". - Remove the xcall_cache_pages_order interface. - tracepoint update: fd -> file. - Simplify the xcall_read() function again. - Handle copy_to_user() return value. - Remove unused XCALL_CACHE_QUEUED. - Update the commit message. Changes in v3: - Add XCALL_PREFETCH config to isolate feature code. - Split the /proc/xxx interface code out to independent patches, which will make it clear. - Update the cpumask interface to "/proc/xcall/numa_mask", and it can set the numa mask of all numas one time. - Add xcall select count to make xcall_cache_pages_order adjust safe. - Introduce xcall_read_start/end() to make it clear. - Simplify the xcall_read() function. - Use cpumask_next() instead of get_nth_cpu_in_cpumask() function. - Use independent cpu select policy function. - Remove some unnecessary pr_err(). - Update the commit message. Changes in v2: - Upadte the xcall prefetch state machine, remove the queued state and add prefetch, cancel states. - Remove the pfi lock and use atomic variables. - Change the 'xcall select' semantics and simplify the code a lot. - Remove keep_running, remove unrelated code. - Remove the count in struct read_cache_entry, and use percpu hit/miss count. - Remove sync mode, so remove struct read_cache_entry in struct task_struct. - Use hash table to find prefetch item for a file, which will not change the file struct KABI. - Use rwlock instead of spinlock for hash table. - Use alloc_page() instead kmalloc() to align 4KB. - Update the commit message. Jinjie Ruan (9): arm64: Introduce Xint software solution arm64: Add debugfs dir for xint arm64: Reserve a kabi in task_struct exclusively for xcall arm64: Introduce xcall prefetch enable interface eventpoll: Support xcall async prefetch eventpoll: Add /proc/xcall/prefetch dir for performance tuning eventpoll: Add /proc/xcall/cpu_list for performance tuning xcall: Add tracepoints for different prefetching stages config: Enable FAST_SYSCALL/IRQ and XCALL_PREFETCH by default Liao Chen (1): arm64: revert kpti bypass Yipeng Zou (2): arm64: Introduce xcall a faster svc exception handling arm64: Faster SVC exception handler with xcall arch/Kconfig | 81 +++++ arch/arm64/Kconfig | 2 + arch/arm64/configs/openeuler_defconfig | 7 + arch/arm64/include/asm/cpucaps.h | 2 + arch/arm64/include/asm/cpufeature.h | 12 + arch/arm64/include/asm/exception.h | 3 + arch/arm64/include/asm/xcall.h | 18 ++ arch/arm64/kernel/Makefile | 1 + arch/arm64/kernel/asm-offsets.c | 3 + arch/arm64/kernel/cpufeature.c | 49 +++ arch/arm64/kernel/entry-common.c | 22 ++ arch/arm64/kernel/entry.S | 183 ++++++++++- arch/arm64/kernel/syscall.c | 57 ++++ arch/arm64/kernel/xcall.c | 38 +++ drivers/irqchip/irq-gic-v3.c | 145 +++++++++ fs/eventpoll.c | 412 +++++++++++++++++++++++++ fs/file_table.c | 1 + fs/proc/Makefile | 1 + fs/proc/base.c | 6 + fs/proc/internal.h | 7 + fs/proc/proc_xcall.c | 181 +++++++++++ fs/read_write.c | 10 +- include/linux/fs.h | 35 +++ include/linux/hardirq.h | 5 + include/linux/irqchip/arm-gic-v3.h | 12 + include/linux/sched.h | 4 + include/trace/events/xcall.h | 106 +++++++ kernel/fork.c | 19 ++ kernel/irq/debugfs.c | 36 +++ kernel/irq/internals.h | 16 + kernel/irq/irqdesc.c | 19 ++ kernel/irq/proc.c | 10 + kernel/softirq.c | 73 +++++ 33 files changed, 1573 insertions(+), 3 deletions(-) create mode 100644 arch/arm64/include/asm/xcall.h create mode 100644 arch/arm64/kernel/xcall.c create mode 100644 fs/proc/proc_xcall.c create mode 100644 include/trace/events/xcall.h -- 2.34.1

2 13

[PATCH OLK-5.10] HID: intel-ish-hid: ipc: Fix potential use-after-free in work function
by Xiaomeng Zhang 11 Jun '25

11 Jun '25

From: Reka Norman <rekanorman(a)chromium.org> mainline inclusion from mainline-v6.3-rc2 commit 8ae2f2b0a28416ed2f6d8478ac8b9f7862f36785 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC5DGB CVE: CVE-2023-53039 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When a reset notify IPC message is received, the ISR schedules a work function and passes the ISHTP device to it via a global pointer ishtp_dev. If ish_probe() fails, the devm-managed device resources including ishtp_dev are freed, but the work is not cancelled, causing a use-after-free when the work function tries to access ishtp_dev. Use devm_work_autocancel() instead, so that the work is automatically cancelled if probe fails. Signed-off-by: Reka Norman <rekanorman(a)chromium.org> Acked-by: Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> Signed-off-by: Jiri Kosina <jkosina(a)suse.cz> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- drivers/hid/intel-ish-hid/ipc/ipc.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/hid/intel-ish-hid/ipc/ipc.c b/drivers/hid/intel-ish-hid/ipc/ipc.c index a45ac7fa417b..b950873c300b 100644 --- a/drivers/hid/intel-ish-hid/ipc/ipc.c +++ b/drivers/hid/intel-ish-hid/ipc/ipc.c @@ -5,6 +5,7 @@ * Copyright (c) 2014-2016, Intel Corporation. */ +#include <linux/devm-helpers.h> #include <linux/sched.h> #include <linux/spinlock.h> #include <linux/delay.h> @@ -594,7 +595,6 @@ static void recv_ipc(struct ishtp_device *dev, uint32_t doorbell_val) case MNG_RESET_NOTIFY: if (!ishtp_dev) { ishtp_dev = dev; - INIT_WORK(&fw_reset_work, fw_reset_work_fn); } schedule_work(&fw_reset_work); break; @@ -885,6 +885,7 @@ struct ishtp_device *ish_dev_init(struct pci_dev *pdev) { struct ishtp_device *dev; int i; + int ret; dev = devm_kzalloc(&pdev->dev, sizeof(struct ishtp_device) + sizeof(struct ish_hw), @@ -920,6 +921,12 @@ struct ishtp_device *ish_dev_init(struct pci_dev *pdev) list_add_tail(&tx_buf->link, &dev->wr_free_list); } + ret = devm_work_autocancel(&pdev->dev, &fw_reset_work, fw_reset_work_fn); + if (ret) { + dev_err(dev->devc, "Failed to initialise FW reset work\n"); + return NULL; + } + dev->ops = &ish_hw_ops; dev->devc = &pdev->dev; dev->mtu = IPC_PAYLOAD_SIZE - sizeof(struct ishtp_msg_hdr); -- 2.34.1

2 1

[PATCH OLK-6.6] mm/mm_spe.c: remove redundant checks and debug prints in mm_spe probe
by Ze Zuo 11 Jun '25

11 Jun '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICC3QM CVE: NA -------------------------------- The pdev and dev pointers are already registered and validated in arm_spe_pmu, so additional checks in the mm_spe driver are redundant. Similarly, the kpti=off condition is implicitly handled because the mm_spe driver cannot be enabled if arm_spe_pmu registration fails. Remove these unnecessary checks to simplify the code. Fixes: b8a759002c48 ("mm_monitor/mm_spe: Introduce standalone SPE profiling framework") Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- drivers/arm/mm_monitor/mm_spe.c | 18 ------------------ 1 file changed, 18 deletions(-) diff --git a/drivers/arm/mm_monitor/mm_spe.c b/drivers/arm/mm_monitor/mm_spe.c index 3acfd47c545f..192f1f9c6adb 100644 --- a/drivers/arm/mm_monitor/mm_spe.c +++ b/drivers/arm/mm_monitor/mm_spe.c @@ -473,25 +473,7 @@ static int mm_spe_device_probe(struct platform_device *pdev) struct device *dev; - /* - * If kernelspace is unmapped when running at EL0, then the SPE - * buffer will fault and prematurely terminate the AUX session. - */ - if (arm64_kernel_unmapped_at_el0()) { - dev_warn_once(dev, "buffer inaccessible. Try passing \"kpti=off\" on the kernel command line\n"); - return -EPERM; - } - - if (!pdev) { - pr_err("pdev is NULL!\n"); - return -ENODEV; - } - dev = &pdev->dev; - if (!dev) { - pr_err("dev is NULL!\n"); - return -ENODEV; - } spe = devm_kzalloc(dev, sizeof(*spe), GFP_KERNEL); if (!spe) -- 2.25.1

2 1