- Kernel - mailweb.openeuler.org

[PATCH] usb: ulpi: fix double free in ulpi_register_interface() error path
by Liu Mingrui 30 May '26

30 May '26

From: Guangshuo Li <lgs201920130244(a)gmail.com> stable inclusion from stable-v6.6.134 commit aaeae6533d77e6ed4def85baec01e2815ebbef61 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14509 CVE: CVE-2026-31759 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 01af542392b5d41fd659d487015a71f627accce3 upstream. When device_register() fails, ulpi_register() calls put_device() on ulpi->dev. The device release callback ulpi_dev_release() drops the OF node reference and frees ulpi, but the current error path in ulpi_register_interface() then calls kfree(ulpi) again, causing a double free. Let put_device() handle the cleanup through ulpi_dev_release() and avoid freeing ulpi again in ulpi_register_interface(). Fixes: 289fcff4bcdb1 ("usb: add bus type for USB ULPI") Cc: stable <stable(a)kernel.org> Signed-off-by: Guangshuo Li <lgs201920130244(a)gmail.com> Reviewed-by: Heikki Krogerus <heikki.krogerus(a)linux.intel.com> Link: https://patch.msgid.link/20260401025142.1398996-1-lgs201920130244@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> --- drivers/usb/common/ulpi.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/usb/common/ulpi.c b/drivers/usb/common/ulpi.c index 3c705f1bead8..ddb316dd2a82 100644 --- a/drivers/usb/common/ulpi.c +++ b/drivers/usb/common/ulpi.c @@ -288,10 +288,9 @@ struct ulpi *ulpi_register_interface(struct device *dev, ulpi->ops = ops; ret = ulpi_register(dev, ulpi); - if (ret) { - kfree(ulpi); + if (ret) return ERR_PTR(ret); - } + return ulpi; } -- 2.34.1

1 0

[PATCH OLK-5.10 0/1] CVE-2023-53712
by Liu Mingrui 30 May '26

30 May '26

From: Mingrui Liu <liumingrui(a)huawei.com> CVE-2023-53712 Mårten Lindahl (1): ARM: 9317/1: kexec: Make smp stop calls asynchronous arch/arm/kernel/machine_kexec.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) -- 2.34.1

1 0

[PATCH OLK-5.10] xfrm: always flush state and policy upon NETDEV_UNREGISTER event
by superdcc97＠163.com 29 May '26

29 May '26

From: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> mainline inclusion from mainline-v7.0-rc2 commit 4efa91a28576054aae0e6dad9cba8fed8293aef8 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14713 CVE: CVE-2026-43167 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzbot is reporting that "struct xfrm_state" refcount is leaking. unregister_netdevice: waiting for netdevsim0 to become free. Usage count = 2 ref_tracker: netdev@ffff888052f24618 has 1/1 users at __netdev_tracker_alloc include/linux/netdevice.h:4400 [inline] netdev_tracker_alloc include/linux/netdevice.h:4412 [inline] xfrm_dev_state_add+0x3a5/0x1080 net/xfrm/xfrm_device.c:316 xfrm_state_construct net/xfrm/xfrm_user.c:986 [inline] xfrm_add_sa+0x34ff/0x5fa0 net/xfrm/xfrm_user.c:1022 xfrm_user_rcv_msg+0x58e/0xc00 net/xfrm/xfrm_user.c:3507 netlink_rcv_skb+0x158/0x420 net/netlink/af_netlink.c:2550 xfrm_netlink_rcv+0x71/0x90 net/xfrm/xfrm_user.c:3529 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x5aa/0x870 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x8c8/0xdd0 net/netlink/af_netlink.c:1894 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg net/socket.c:742 [inline] ____sys_sendmsg+0xa5d/0xc30 net/socket.c:2592 ___sys_sendmsg+0x134/0x1d0 net/socket.c:2646 __sys_sendmsg+0x16d/0x220 net/socket.c:2678 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f This is because commit d77e38e612a0 ("xfrm: Add an IPsec hardware offloading API") implemented xfrm_dev_unregister() as no-op despite xfrm_dev_state_add() from xfrm_state_construct() acquires a reference to "struct net_device". I guess that that commit expected that NETDEV_DOWN event is fired before NETDEV_UNREGISTER event fires, and also assumed that xfrm_dev_state_add() is called only if (dev->features & NETIF_F_HW_ESP) != 0. Sabrina Dubroca identified steps to reproduce the same symptoms as below. echo 0 > /sys/bus/netdevsim/new_device dev=$(ls -1 /sys/bus/netdevsim/devices/netdevsim0/net/) ip xfrm state add src 192.168.13.1 dst 192.168.13.2 proto esp \ spi 0x1000 mode tunnel aead 'rfc4106(gcm(aes))' $key 128 \ offload crypto dev $dev dir out ethtool -K $dev esp-hw-offload off echo 0 > /sys/bus/netdevsim/del_device Like these steps indicate, the NETIF_F_HW_ESP bit can be cleared after xfrm_dev_state_add() acquired a reference to "struct net_device". Also, xfrm_dev_state_add() does not check for the NETIF_F_HW_ESP bit when acquiring a reference to "struct net_device". Commit 03891f820c21 ("xfrm: handle NETDEV_UNREGISTER for xfrm device") re-introduced the NETDEV_UNREGISTER event to xfrm_dev_event(), but that commit for unknown reason chose to share xfrm_dev_down() between the NETDEV_DOWN event and the NETDEV_UNREGISTER event. I guess that that commit missed the behavior in the previous paragraph. Therefore, we need to re-introduce xfrm_dev_unregister() in order to release the reference to "struct net_device" by unconditionally flushing state and policy. Reported-by: syzbot+881d65229ca4f9ae8c84(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=881d65229ca4f9ae8c84 Fixes: d77e38e612a0 ("xfrm: Add an IPsec hardware offloading API") Cc: Sabrina Dubroca <sd(a)queasysnail.net> Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Signed-off-by: Steffen Klassert <steffen.klassert(a)secunet.com> Conflicts: net/xfrm/xfrm_device.c [OLK-5.10: xfrm_dev_policy_flush() does not exist because xfrm policy offload was added in later kernels. Only call xfrm_dev_state_flush() in xfrm_dev_unregister().] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/xfrm/xfrm_device.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/net/xfrm/xfrm_device.c b/net/xfrm/xfrm_device.c index 8b8e957a69c3..0e7424b8a5fa 100644 --- a/net/xfrm/xfrm_device.c +++ b/net/xfrm/xfrm_device.c @@ -414,6 +414,13 @@ static int xfrm_dev_down(struct net_device *dev) return NOTIFY_DONE; } +static int xfrm_dev_unregister(struct net_device *dev) +{ + xfrm_dev_state_flush(dev_net(dev), dev, true); + + return NOTIFY_DONE; +} + static int xfrm_dev_event(struct notifier_block *this, unsigned long event, void *ptr) { struct net_device *dev = netdev_notifier_info_to_dev(ptr); @@ -426,8 +433,10 @@ static int xfrm_dev_event(struct notifier_block *this, unsigned long event, void return xfrm_dev_feat_change(dev); case NETDEV_DOWN: - case NETDEV_UNREGISTER: return xfrm_dev_down(dev); + + case NETDEV_UNREGISTER: + return xfrm_dev_unregister(dev); } return NOTIFY_DONE; } -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] smb: client: reject userspace cifs.spnego descriptions
by Zizhi Wo 29 May '26

29 May '26

From: Asim Viladi Oglu Manizada <manizada(a)pm.me> mainline inclusion from mainline-v7.1-rc5 commit 3da1fdf4efbc490041eb4f836bf596201203f8f2 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9294 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- cifs.spnego key descriptions contain authority-bearing fields such as pid, uid, creduid, and upcall_target that cifs.upcall treats as kernel-originating inputs. However, userspace can also create keys of this type through request_key(2) or add_key(2), allowing those fields to be supplied without CIFS origin. Only accept cifs.spnego descriptions while CIFS is using its private spnego_cred to request the key. Fixes: f1d662a7d5e5 ("[CIFS] Add upcall files for cifs to use spnego/kerberos") Assisted-by: avom-custom-harness:gpt-5.5-qwen3.6-mod-mix Reviewed-by: David Howells <dhowells(a)redhat.com> Signed-off-by: Asim Viladi Oglu Manizada <manizada(a)pm.me> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/cifs/cifs_spnego.c fs/smb/client/cifs_spnego.c [File locations are inconsistent, not affect this patch.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/cifs/cifs_spnego.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/fs/cifs/cifs_spnego.c b/fs/cifs/cifs_spnego.c index 7f01c6e60791..288d3ccfa231 100644 --- a/fs/cifs/cifs_spnego.c +++ b/fs/cifs/cifs_spnego.c @@ -18,10 +18,11 @@ * along with this library; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ #include <linux/list.h> +#include <linux/cred.h> #include <linux/slab.h> #include <linux/string.h> #include <keys/user-type.h> #include <linux/key-type.h> #include <linux/keyctl.h> @@ -56,16 +57,31 @@ static void cifs_spnego_key_destroy(struct key *key) { kfree(key->payload.data[0]); } +static int +cifs_spnego_key_vet_description(const char *description) +{ + /* + * cifs.spnego descriptions are authority-bearing inputs to cifs.upcall. + * They are only valid when produced by CIFS while using the private + * spnego_cred installed below. Do not let userspace create this type + * of key through request_key(2)/add_key(2), since the helper treats + * pid/uid/creduid/upcall_target as kernel-originating fields. + */ + if (current_cred() != spnego_cred) + return -EPERM; + return 0; +} /* * keytype for CIFS spnego keys */ struct key_type cifs_spnego_key_type = { .name = "cifs.spnego", + .vet_description = cifs_spnego_key_vet_description, .instantiate = cifs_spnego_key_instantiate, .destroy = cifs_spnego_key_destroy, .describe = user_describe, }; -- 2.52.0

2 1

[PATCH OLK-6.6 0/1] Fix CVE-2026-45943
by Hongbo Li 29 May '26

29 May '26

Fix CVE-2026-45943. Gao Xiang (1): erofs: fix inline data read failure for ztailpacking pclusters fs/erofs/zdata.c | 26 ++++++++++++++------------ 1 file changed, 14 insertions(+), 12 deletions(-) -- 2.34.1

2 2

[PATCH OLK-6.6] usb: ulpi: fix double free in ulpi_register_interface() error path
by Liu Mingrui 29 May '26

29 May '26

From: Guangshuo Li <lgs201920130244(a)gmail.com> stable inclusion from stable-v6.6.134 commit aaeae6533d77e6ed4def85baec01e2815ebbef61 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14509 CVE: CVE-2026-31759 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 01af542392b5d41fd659d487015a71f627accce3 upstream. When device_register() fails, ulpi_register() calls put_device() on ulpi->dev. The device release callback ulpi_dev_release() drops the OF node reference and frees ulpi, but the current error path in ulpi_register_interface() then calls kfree(ulpi) again, causing a double free. Let put_device() handle the cleanup through ulpi_dev_release() and avoid freeing ulpi again in ulpi_register_interface(). Fixes: 289fcff4bcdb1 ("usb: add bus type for USB ULPI") Cc: stable <stable(a)kernel.org> Signed-off-by: Guangshuo Li <lgs201920130244(a)gmail.com> Reviewed-by: Heikki Krogerus <heikki.krogerus(a)linux.intel.com> Link: https://patch.msgid.link/20260401025142.1398996-1-lgs201920130244@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> --- drivers/usb/common/ulpi.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/usb/common/ulpi.c b/drivers/usb/common/ulpi.c index 0886b19d2e1c..c9f52cd1cfb2 100644 --- a/drivers/usb/common/ulpi.c +++ b/drivers/usb/common/ulpi.c @@ -331,10 +331,9 @@ struct ulpi *ulpi_register_interface(struct device *dev, ulpi->ops = ops; ret = ulpi_register(dev, ulpi); - if (ret) { - kfree(ulpi); + if (ret) return ERR_PTR(ret); - } + return ulpi; } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/2] smb: client: reject userspace cifs.spnego descriptions
by Zizhi Wo 29 May '26

29 May '26

From: Asim Viladi Oglu Manizada <manizada(a)pm.me> mainline inclusion from mainline-v7.1-rc5 commit 3da1fdf4efbc490041eb4f836bf596201203f8f2 category: bugfix bugzilla: NA CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- cifs.spnego key descriptions contain authority-bearing fields such as pid, uid, creduid, and upcall_target that cifs.upcall treats as kernel-originating inputs. However, userspace can also create keys of this type through request_key(2) or add_key(2), allowing those fields to be supplied without CIFS origin. Only accept cifs.spnego descriptions while CIFS is using its private spnego_cred to request the key. Fixes: f1d662a7d5e5 ("[CIFS] Add upcall files for cifs to use spnego/kerberos") Assisted-by: avom-custom-harness:gpt-5.5-qwen3.6-mod-mix Reviewed-by: David Howells <dhowells(a)redhat.com> Signed-off-by: Asim Viladi Oglu Manizada <manizada(a)pm.me> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/cifs/cifs_spnego.c fs/smb/client/cifs_spnego.c [File locations are inconsistent, not affect this patch.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/cifs/cifs_spnego.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/fs/cifs/cifs_spnego.c b/fs/cifs/cifs_spnego.c index 7f01c6e60791..288d3ccfa231 100644 --- a/fs/cifs/cifs_spnego.c +++ b/fs/cifs/cifs_spnego.c @@ -18,10 +18,11 @@ * along with this library; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ #include <linux/list.h> +#include <linux/cred.h> #include <linux/slab.h> #include <linux/string.h> #include <keys/user-type.h> #include <linux/key-type.h> #include <linux/keyctl.h> @@ -56,16 +57,31 @@ static void cifs_spnego_key_destroy(struct key *key) { kfree(key->payload.data[0]); } +static int +cifs_spnego_key_vet_description(const char *description) +{ + /* + * cifs.spnego descriptions are authority-bearing inputs to cifs.upcall. + * They are only valid when produced by CIFS while using the private + * spnego_cred installed below. Do not let userspace create this type + * of key through request_key(2)/add_key(2), since the helper treats + * pid/uid/creduid/upcall_target as kernel-originating fields. + */ + if (current_cred() != spnego_cred) + return -EPERM; + return 0; +} /* * keytype for CIFS spnego keys */ struct key_type cifs_spnego_key_type = { .name = "cifs.spnego", + .vet_description = cifs_spnego_key_vet_description, .instantiate = cifs_spnego_key_instantiate, .destroy = cifs_spnego_key_destroy, .describe = user_describe, }; -- 2.52.0

1 0

[PATCH OLK-5.10] cgroup/cpuset.c: Comment out early when prefer_cpus cpumask equals
by Chen Jinghuang 29 May '26

29 May '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8397 CVE: NA ---------------------------------------- The current logic skips updating task's prefer_cpus in a cgroup when the cgroup's prefer_cpus is unchanged. However, task's prefer_cpus may mismatch the cgroup config in some cases, causing inconsistent CPU affinity. Comment out the early return logic to ensure task's prefer_cpus are always updated on cgroup.prefer_cpus writes, aligning task and cgroup settings. Fixes: 243865da2684 ("cpuset: Introduce new interface for scheduler dynamic affinity") Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- kernel/cgroup/cpuset.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c index 1f6ed08af9f5..60c5ee2bc463 100644 --- a/kernel/cgroup/cpuset.c +++ b/kernel/cgroup/cpuset.c @@ -748,10 +748,6 @@ static int update_prefer_cpumask(struct cpuset *cs, struct cpuset *trialcs, return retval; } - /* Nothing to do if the cpus didn't change */ - if (cpumask_equal(cs->prefer_cpus, trialcs->prefer_cpus)) - return 0; - if (!cpumask_subset(trialcs->prefer_cpus, cs->cpus_allowed)) return -EINVAL; -- 2.34.1

2 2

[PATCH OLK-6.6 0/6] mainline for bpf
by Pu Lehui 29 May '26

29 May '26

Alexei Starovoitov (1): bpf: Fix variable length stack write over spilled pointers Amery Hung (5): bpf: Select bpf_local_storage_map_bucket based on bpf_local_storage bpf: Convert bpf_selem_unlink_map to failable bpf: Convert bpf_selem_link_map to failable bpf: Convert bpf_selem_unlink to failable bpf: Do not allow deleting local storage in NMI include/linux/bpf_local_storage.h | 7 +- kernel/bpf/bpf_cgrp_storage.c | 3 +- kernel/bpf/bpf_inode_storage.c | 4 +- kernel/bpf/bpf_local_storage.c | 149 +++++++++++++++++------------- kernel/bpf/bpf_task_storage.c | 4 +- kernel/bpf/verifier.c | 28 ++++-- net/core/bpf_sk_storage.c | 13 ++- 7 files changed, 122 insertions(+), 86 deletions(-) -- 2.34.1

2 7

[PATCH OLK-6.6 V4 0/2] Support open_tree OPEN_TREE_NAMESPACE
by Zizhi Wo 28 May '26

28 May '26

Changes since V3: Delete overmount logic to fix KABI broken. Changes since V2: Add KABI_EXTEND to fix KABI broken. Changes since V1: The position of unlock_mount_hash() has been adjusted to align with the mainline. Christian Brauner (2): mount: add OPEN_TREE_NAMESPACE mount: hold namespace_sem across copy in create_new_namespace() fs/internal.h | 2 + fs/namespace.c | 174 ++++++++++++++++++++++++++++++++++--- fs/nsfs.c | 32 +++++++ include/uapi/linux/mount.h | 3 +- 4 files changed, 198 insertions(+), 13 deletions(-) -- 2.52.0

2 3