- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] net: hv_netvsc: reject RSS hash key programming without RX indirection table
by Wupeng Ma 24 Feb '26

24 Feb '26

From: Aditya Garg <gargaditya(a)linux.microsoft.com> stable inclusion from stable-v6.6.122 commit 82c9039c8ebb715753a40434df714f865a3aec9c category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13587 CVE: CVE-2026-23054 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d23564955811da493f34412d7de60fa268c8cb50 ] RSS configuration requires a valid RX indirection table. When the device reports a single receive queue, rndis_filter_device_add() does not allocate an indirection table, accepting RSS hash key updates in this state leads to a hang. Fix this by gating netvsc_set_rxfh() on ndc->rx_table_sz and return -EOPNOTSUPP when the table is absent. This aligns set_rxfh with the device capabilities and prevents incorrect behavior. Fixes: 962f3fee83a4 ("netvsc: add ethtool ops to get/set RSS key") Signed-off-by: Aditya Garg <gargaditya(a)linux.microsoft.com> Reviewed-by: Dipayaan Roy <dipayanroy(a)linux.microsoft.com> Reviewed-by: Haiyang Zhang <haiyangz(a)microsoft.com> Link: https://patch.msgid.link/1768212093-1594-1-git-send-email-gargaditya@linux.… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- drivers/net/hyperv/netvsc_drv.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c index aa114240e340d..af001e2e688b2 100644 --- a/drivers/net/hyperv/netvsc_drv.c +++ b/drivers/net/hyperv/netvsc_drv.c @@ -1762,6 +1762,9 @@ static int netvsc_set_rxfh(struct net_device *dev, const u32 *indir, if (hfunc != ETH_RSS_HASH_NO_CHANGE && hfunc != ETH_RSS_HASH_TOP) return -EOPNOTSUPP; + if (!ndc->rx_table_sz) + return -EOPNOTSUPP; + rndis_dev = ndev->extension; if (indir) { for (i = 0; i < ndc->rx_table_sz; i++) -- 2.43.0

2 1

[PATCH OLK-5.10 0/2] ACPI/IORT: Add PMCG platform information for 162001900
by Zeng Heng 24 Feb '26

24 Feb '26

Qinxin Xia (2): arm-smmu-v3: add HIP09A, HIP09B, HIP10C, HIP10CA for 162100602 errata ACPI/IORT: Add PMCG platform information for 162001900 Documentation/arm64/silicon-errata.rst | 6 +++--- drivers/acpi/arm64/iort.c | 4 ++++ drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 8 ++++++++ 3 files changed, 15 insertions(+), 3 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10 0/2] fix CVE-2026-23054
by Wupeng Ma 24 Feb '26

24 Feb '26

fix CVE-2026-23054. Aditya Garg (1): net: hv_netvsc: reject RSS hash key programming without RX indirection table Shradha Gupta (1): hv_netvsc: Allocate rx indirection table size dynamically drivers/net/hyperv/hyperv_net.h | 5 ++++- drivers/net/hyperv/netvsc_drv.c | 13 +++++++++---- drivers/net/hyperv/rndis_filter.c | 28 ++++++++++++++++++++++++---- 3 files changed, 37 insertions(+), 9 deletions(-) -- 2.43.0

2 3

[PATCH OLK-5.10] ACPI/IORT: Add PMCG platform information for 162001900
by Zeng Heng 12 Feb '26

12 Feb '26

From: Qinxin Xia <xiaqinxin(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/7640 ------------------ Some HiSilicon platforms using the same SMMU PMCG with HIP09 and thus suffers the same erratum. List them in the PMCG platform information list without introducing a new SMMU PMCG Model. Update the silicon-errata.rst as well. Fixes: 28396fe25d85 ("Add PMCG platform information for HiSilicon HIP09A") Signed-off-by: Qinxin Xia <xiaqinxin(a)huawei.com> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- Documentation/arm64/silicon-errata.rst | 6 +++--- drivers/acpi/arm64/iort.c | 4 ++++ 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/Documentation/arm64/silicon-errata.rst b/Documentation/arm64/silicon-errata.rst index 65c5c284893c..f8857b6698cc 100644 --- a/Documentation/arm64/silicon-errata.rst +++ b/Documentation/arm64/silicon-errata.rst @@ -147,9 +147,9 @@ stable kernels. +----------------+-----------------+-----------------+-----------------------------+ | Hisilicon | Hip08 SMMU PMCG | #162001800 | N/A | +----------------+-----------------+-----------------+-----------------------------+ -| Hisilicon | Hip{08,09,09A,10| #162001900 | N/A | -| | ,10C,11} | | | -| | SMMU PMCG | | | +| Hisilicon | Hip{08,09,09A, | #162001900 | N/A | +| | 09B,10,10C,10CA,| | | +| | 11} SMMU PMCG | | | +----------------+-----------------+-----------------+-----------------------------+ | Hisilicon | TSV{110,200} | #1980005 | HISILICON_ERRATUM_1980005 | +----------------+-----------------+-----------------+-----------------------------+ diff --git a/drivers/acpi/arm64/iort.c b/drivers/acpi/arm64/iort.c index f3e44b95368a..c8b20e4589a0 100644 --- a/drivers/acpi/arm64/iort.c +++ b/drivers/acpi/arm64/iort.c @@ -1567,11 +1567,15 @@ static struct acpi_platform_list pmcg_plat_info[] __initdata = { "Erratum #162001900", IORT_SMMU_V3_PMCG_HISI_HIP09}, {"HISI ", "HIP09A ", 0, ACPI_SIG_IORT, greater_than_or_equal, "Erratum #162001900", IORT_SMMU_V3_PMCG_HISI_HIP09}, + {"HISI ", "HIP09B ", 0, ACPI_SIG_IORT, greater_than_or_equal, + "Erratum #162001900", IORT_SMMU_V3_PMCG_HISI_HIP09}, /* HiSilicon Hip10/11 Platform uses the same SMMU IP with Hip09 */ {"HISI ", "HIP10 ", 0, ACPI_SIG_IORT, greater_than_or_equal, "Erratum #162001900", IORT_SMMU_V3_PMCG_HISI_HIP09}, {"HISI ", "HIP10C ", 0, ACPI_SIG_IORT, greater_than_or_equal, "Erratum #162001900", IORT_SMMU_V3_PMCG_HISI_HIP09}, + {"HISI ", "HIP10CA ", 0, ACPI_SIG_IORT, greater_than_or_equal, + "Erratum #162001900", IORT_SMMU_V3_PMCG_HISI_HIP09}, {"HISI ", "HIP11 ", 0, ACPI_SIG_IORT, greater_than_or_equal, "Erratum #162001900", IORT_SMMU_V3_PMCG_HISI_HIP09}, { } -- 2.25.1

2 1

[PATCH OLK-5.10] arm-smmu-v3: add HIP09A, HIP09B, HIP10C, HIP10CA for 162100602 errata
by Zeng Heng 12 Feb '26

12 Feb '26

From: Qinxin Xia <xiaqinxin(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/7640 ------------------ Add HIP09A, HIP09B, HIP10C, HIP10CA for 162100602 errata Fixes: c20cd1f88a57 ("iommu/arm-smmu-v3: Change the style to identify the the hisi_platform") Signed-off-by: Qinxin Xia <xiaqinxin(a)huawei.com> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c index e67c1feeca5f..1528661f98dd 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c @@ -5265,8 +5265,16 @@ static struct acpi_platform_list arm_smmu_v3_plat_info[] = { /* HiSilicon Hip09 Platform */ {"HISI ", "HIP09 ", 0, ACPI_SIG_IORT, greater_than_or_equal, "Erratum #162100602", 0}, + {"HISI ", "HIP09A ", 0, ACPI_SIG_IORT, greater_than_or_equal, + "Erratum #162100602", 0}, + {"HISI ", "HIP09B ", 0, ACPI_SIG_IORT, greater_than_or_equal, + "Erratum #162100602", 0}, {"HISI ", "HIP10 ", 0, ACPI_SIG_IORT, greater_than_or_equal, "Erratum #162100602", 0}, + {"HISI ", "HIP10C ", 0, ACPI_SIG_IORT, greater_than_or_equal, + "Erratum #162100602", 0}, + {"HISI ", "HIP10CA ", 0, ACPI_SIG_IORT, greater_than_or_equal, + "Erratum #162100602", 0}, {"HISI ", "HIP11 ", 0, ACPI_SIG_IORT, greater_than_or_equal, "Erratum #162100602", 0}, { } -- 2.25.1

2 1

[PATCH v5 0/4] arm64/riscv: Add support for crashkernel CMA reservation
by Jinjie Ruan 12 Feb '26

12 Feb '26

Exclude crash kernel memory in crash core to avoid duplication. Also move the size calculation (and the realloc if needed) into crash core. And add support for crashkernel CMA reservation for arm64 and riscv. Changes in v5: - Fix the kernel test robot build warnings. - Sort crash memory ranges before preparing elfcorehdr for powerpc - Link to v4: https://lore.kernel.org/all/20260209095931.2813152-1-ruanjinjie@huawei.com/ Changes in v4: - Move the size calculation (and the realloc if needed) into the generic crash. - Link to v3: https://lore.kernel.org/all/20260204093728.1447527-1-ruanjinjie@huawei.com/ Changs in v3: - Exclude crash kernel memory in crash core as Mike suggested. - Add acked-by. Jinjie Ruan (3): crash: Exclude crash kernel memory in crash core arm64: kexec: Add support for crashkernel CMA reservation riscv: kexec: Add support for crashkernel CMA reservation Sourabh Jain (1): powerpc/crash: sort crash memory ranges before preparing elfcorehdr .../admin-guide/kernel-parameters.txt | 16 +-- arch/arm64/include/asm/kexec.h | 9 +- arch/arm64/kernel/machine_kexec_file.c | 43 +++----- arch/arm64/mm/init.c | 5 +- arch/loongarch/include/asm/kexec.h | 9 +- arch/loongarch/kernel/machine_kexec_file.c | 41 +++---- arch/powerpc/include/asm/kexec.h | 13 +++ arch/powerpc/include/asm/kexec_ranges.h | 1 - arch/powerpc/kexec/crash.c | 67 ++++++----- arch/powerpc/kexec/file_load_64.c | 17 +-- arch/powerpc/kexec/ranges.c | 103 +---------------- arch/riscv/include/asm/kexec.h | 9 +- arch/riscv/kernel/machine_kexec_file.c | 39 +++---- arch/riscv/mm/init.c | 5 +- arch/x86/include/asm/kexec.h | 9 ++ arch/x86/kernel/crash.c | 104 ++---------------- include/linux/crash_core.h | 75 ++++++++++++- kernel/crash_core.c | 85 ++++++++++++-- 18 files changed, 314 insertions(+), 336 deletions(-) -- 2.34.1

1 4

[PATCH OLK-6.6] dm: use bio_clone_blkg_association
by Zhihao Cheng 12 Feb '26

12 Feb '26

From: Mikulas Patocka <mpatocka(a)redhat.com> mainline inclusion from mainline-v7.0-rc1 commit 2df8b310bcfe76827fd71092f58a2493ee6590b0 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13467 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The origin bio carries blk-cgroup information which could be set from foreground(task_css(css) - wbc->wb->blkcg_css), so the blkcg won't control buffer io since commit ca522482e3eaf ("dm: pass NULL bdev to bio_alloc_clone"). The synchronous io is still under control by blkcg, because 'bio->bi_blkg' is set by io submitting task which has been added into 'cgroup.procs'. Fix it by using bio_clone_blkg_association when submitting a cloned bio. Link: https://bugzilla.kernel.org/show_bug.cgi?id=220985 Fixes: ca522482e3eaf ("dm: pass NULL bdev to bio_alloc_clone") Reported-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Tested-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> --- drivers/md/dm.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/md/dm.c b/drivers/md/dm.c index 96f050891ec0..670460ade280 100644 --- a/drivers/md/dm.c +++ b/drivers/md/dm.c @@ -1365,6 +1365,8 @@ void dm_submit_bio_remap(struct bio *clone, struct bio *tgt_clone) if (!tgt_clone) tgt_clone = clone; + bio_clone_blkg_association(tgt_clone, io->orig_bio); + /* * Account io->origin_bio to DM dev on behalf of target * that took ownership of IO with DM_MAPIO_SUBMITTED. -- 2.52.0

2 1

[PATCH OLK-6.6] gic: Add hip09 support for HISILICON_ERRATUM_165010801
by Zeng Heng 12 Feb '26

12 Feb '26

From: Yifan Wu <wuyifan50(a)huawei.com> driver inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/7023 ---------------------------------------------------------------------- Add hip09 support for HISILICON_ERRATUM_165010801 Fixes: f0f9be237c22 ("gic: increase the arch_timer priority to avoid hardlockup") Signed-off-by: Yifan Wu <wuyifan50(a)huawei.com> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/arm64/Kconfig | 11 ++++++----- drivers/clocksource/arm_arch_timer.c | 5 +++++ 2 files changed, 11 insertions(+), 5 deletions(-) diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index ef8c524a296d..2a4a729ef8f7 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -1309,11 +1309,12 @@ config HISILICON_ERRATUM_165010801 depends on ARCH_HISI default y help - On HIP12, when GIC receives multiple interrupts of the same priority and - different types, the interrupts are selected in the following sequence: - SPI > LPI > SGI > PPI. This scheduling rule may cause PPI starvation. - To prevent starvation from triggering system watchdog hardlockup, the - interrupt priority is explicitly increased in the arch_timer driver. + On HIP09/12 hardware, observations indicate that the GIC's handling of + equal-priority interrupts across different interrupt types may not always + provide balanced servicing. In some cases, this could result in prolonged + service delays for particular interrupt types, creating conditions where + system watchdog hardlockup detection might be triggered. The arch_timer + driver addresses this by proactively increasing affected interrupt priorities. config QCOM_FALKOR_ERRATUM_1003 bool "Falkor E1003: Incorrect translation due to ASID change" diff --git a/drivers/clocksource/arm_arch_timer.c b/drivers/clocksource/arm_arch_timer.c index 095238032ac0..7ffca7cc5c53 100644 --- a/drivers/clocksource/arm_arch_timer.c +++ b/drivers/clocksource/arm_arch_timer.c @@ -369,6 +369,11 @@ static struct ate_acpi_oem_info hisi_161010101_oem_info[] = { #ifdef CONFIG_HISILICON_ERRATUM_165010801 static struct ate_acpi_oem_info hisi_165010801_oem_info[] = { + { + .oem_id = "HISI ", + .oem_table_id = "HIP09 ", + .oem_revision = 0, + }, { .oem_id = "HISI ", .oem_table_id = "HIP12 ", -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] irqchip/gic-v3-its: Avoid truncating memory addresses
by Jinjie Ruan 12 Feb '26

12 Feb '26

From: Arnd Bergmann <arnd(a)arndb.de> stable inclusion from stable-v6.6.122 commit 1b323391560354d8c515de8658b057a1daa82adb category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13618 CVE: CVE-2026-23085 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 8d76a7d89c12d08382b66e2f21f20d0627d14859 upstream. On 32-bit machines with CONFIG_ARM_LPAE, it is possible for lowmem allocations to be backed by addresses physical memory above the 32-bit address limit, as found while experimenting with larger VMSPLIT configurations. This caused the qemu virt model to crash in the GICv3 driver, which allocates the 'itt' object using GFP_KERNEL. Since all memory below the 4GB physical address limit is in ZONE_DMA in this configuration, kmalloc() defaults to higher addresses for ZONE_NORMAL, and the ITS driver stores the physical address in a 32-bit 'unsigned long' variable. Change the itt_addr variable to the correct phys_addr_t type instead, along with all other variables in this driver that hold a physical address. The gicv5 driver correctly uses u64 variables, while all other irqchip drivers don't call virt_to_phys or similar interfaces. It's expected that other device drivers have similar issues, but fixing this one is sufficient for booting a virtio based guest. Fixes: cc2d3216f53c ("irqchip: GICv3: ITS command queue") Signed-off-by: Arnd Bergmann <arnd(a)arndb.de> Signed-off-by: Thomas Gleixner <tglx(a)kernel.org> Reviewed-by: Marc Zyngier <maz(a)kernel.org> Cc: stable(a)vger.kernel.org Link: https://patch.msgid.link/20260119201603.2713066-1-arnd@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/irqchip/irq-gic-v3-its.c [ Conflict because 64edfaa9a234 ("irqchip/gic-v4.1: Implement the v4.1 flavour of VMAPP") not merged. ] Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- drivers/irqchip/irq-gic-v3-its.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c index 65306a1ed3dc..750fcb25574a 100644 --- a/drivers/irqchip/irq-gic-v3-its.c +++ b/drivers/irqchip/irq-gic-v3-its.c @@ -459,7 +459,7 @@ static struct its_collection *its_build_mapd_cmd(struct its_node *its, struct its_cmd_block *cmd, struct its_cmd_desc *desc) { - unsigned long itt_addr; + phys_addr_t itt_addr; u8 size = ilog2(desc->its_mapd_cmd.dev->nr_ites); itt_addr = virt_to_phys(desc->its_mapd_cmd.dev->itt); @@ -629,7 +629,7 @@ static struct its_vpe *its_build_vmapp_cmd(struct its_node *its, struct its_cmd_block *cmd, struct its_cmd_desc *desc) { - unsigned long vpt_addr; + phys_addr_t vpt_addr; u64 target; vpt_addr = virt_to_phys(page_address(desc->its_vmapp_cmd.vpe->vpt_page)); @@ -2023,10 +2023,10 @@ static int its_setup_baser(struct its_node *its, struct its_baser *baser, baser->psz = psz; tmp = indirect ? GITS_LVL1_ENTRY_SIZE : esz; - pr_info("ITS@%pa: allocated %d %s @%lx (%s, esz %d, psz %dK, shr %d)\n", + pr_info("ITS@%pa: allocated %d %s @%llx (%s, esz %d, psz %dK, shr %d)\n", &its->phys_base, (int)(PAGE_ORDER_TO_SIZE(order) / (int)tmp), its_base_type_string[type], - (unsigned long)virt_to_phys(base), + (u64)virt_to_phys(base), indirect ? "indirect" : "flat", (int)esz, psz / SZ_1K, (int)shr >> GITS_BASER_SHAREABILITY_SHIFT); -- 2.34.1

2 1

[PATCH OLK-6.6] tracing: Fix soft lockup when lseeking trace file
by Tengda Wu 12 Feb '26

12 Feb '26

From: Tengda Wu <wutengda(a)huaweicloud.com> maillist inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8522 Reference: https://lore.kernel.org/all/20260209093101.1623454-1-wutengda@huaweicloud.c… -------------------------------- A soft lockup may occur when accessing trace file via lseek while tracing is active and a large offset is provided. The call trace is shown below: watchdog: BUG: soft lockup - CPU#3 stuck for 26s! [poc:141] CPU: 3 UID: 0 PID: 141 Comm: poc Not tainted 6.19.0 #1 PREEMPT(none) Call Trace: ring_buffer_iter_peek peek_next_entry __find_next_entry trace_find_next_entry_inc s_next traverse.part.0 seq_lseek tracing_lseek __x64_sys_lseek do_syscall_64 entry_SYSCALL_64_after_hwframe The root cause is that the lseek implementation for trace files is based on seq_lseek, which contains a loop that repeatedly calls show() and next() functions until the position reaches the target offset. Since no scheduling point is set within this loop, a large offset can cause the CPU to be stuck in the loop for an extended period, triggering the soft lockup detector. Fixed by adding cond_resched() in s_next(). Fixes: bc0c38d139ec ("ftrace: latency tracer infrastructure") Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/trace/trace.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c index b0751e52d40e..95ede691941c 100644 --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -4037,6 +4037,8 @@ static void *s_next(struct seq_file *m, void *v, loff_t *pos) iter->pos = *pos; + cond_resched(); + return ent; } -- 2.34.1

2 1