- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1
by Zhang Kunbo 01 Jun '26

01 Jun '26

From: Kevin Cheng <chengkev(a)google.com> stable inclusion from stable-v6.12.86 commit 924d721fae95687acedbaf624a094ed0e8b67104 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15318 CVE: CVE-2026-46076 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c36991c6f8d2ab56ee67aff04e3c357f45cfc76c upstream. Explicitly synthesize a #UD for VMMCALL if L2 is active, L1 does NOT want to intercept VMMCALL, nested_svm_l2_tlb_flush_enabled() is true, and the hypercall is something other than one of the supported Hyper-V hypercalls. When all of the above conditions are met, KVM will intercept VMMCALL but never forward it to L1, i.e. will let L2 make hypercalls as if it were L1. The TLFS says a whole lot of nothing about this scenario, so go with the architectural behavior, which says that VMMCALL #UDs if it's not intercepted. Opportunistically do a 2-for-1 stub trade by stub-ifying the new API instead of the helpers it uses. The last remaining "single" stub will soon be dropped as well. Suggested-by: Sean Christopherson <seanjc(a)google.com> Fixes: 3f4a812edf5c ("KVM: nSVM: hyper-v: Enable L2 TLB flush") Cc: Vitaly Kuznetsov <vkuznets(a)redhat.com> Cc: stable(a)vger.kernel.org Signed-off-by: Kevin Cheng <chengkev(a)google.com> Link: https://patch.msgid.link/20260228033328.2285047-5-chengkev@google.com [sean: rewrite changelog and comment, tag for stable, remove defunct stubs] Reviewed-by: Yosry Ahmed <yosry(a)kernel.org> Reviewed-by: Vitaly Kuznetsov <vkuznets(a)redhat.com> Link: https://patch.msgid.link/20260304002223.1105129-2-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- arch/x86/kvm/hyperv.h | 8 -------- arch/x86/kvm/svm/hyperv.h | 11 +++++++++++ arch/x86/kvm/svm/nested.c | 4 +--- arch/x86/kvm/svm/svm.c | 19 ++++++++++++++++++- 4 files changed, 30 insertions(+), 12 deletions(-) diff --git a/arch/x86/kvm/hyperv.h b/arch/x86/kvm/hyperv.h index a643e11c894d..a0c5f6165b2c 100644 --- a/arch/x86/kvm/hyperv.h +++ b/arch/x86/kvm/hyperv.h @@ -277,14 +277,6 @@ static inline bool kvm_hv_has_stimer_pending(struct kvm_vcpu *vcpu) { return false; } -static inline bool kvm_hv_is_tlb_flush_hcall(struct kvm_vcpu *vcpu) -{ - return false; -} -static inline bool guest_hv_cpuid_has_l2_tlb_flush(struct kvm_vcpu *vcpu) -{ - return false; -} static inline int kvm_hv_verify_vp_assist(struct kvm_vcpu *vcpu) { return 0; diff --git a/arch/x86/kvm/svm/hyperv.h b/arch/x86/kvm/svm/hyperv.h index d3f8bfc05832..9af03970d40c 100644 --- a/arch/x86/kvm/svm/hyperv.h +++ b/arch/x86/kvm/svm/hyperv.h @@ -41,6 +41,13 @@ static inline bool nested_svm_l2_tlb_flush_enabled(struct kvm_vcpu *vcpu) return hv_vcpu->vp_assist_page.nested_control.features.directhypercall; } +static inline bool nested_svm_is_l2_tlb_flush_hcall(struct kvm_vcpu *vcpu) +{ + return guest_hv_cpuid_has_l2_tlb_flush(vcpu) && + nested_svm_l2_tlb_flush_enabled(vcpu) && + kvm_hv_is_tlb_flush_hcall(vcpu); +} + void svm_hv_inject_synthetic_vmexit_post_tlb_flush(struct kvm_vcpu *vcpu); #else /* CONFIG_KVM_HYPERV */ static inline void nested_svm_hv_update_vm_vp_ids(struct kvm_vcpu *vcpu) {} @@ -48,6 +55,10 @@ static inline bool nested_svm_l2_tlb_flush_enabled(struct kvm_vcpu *vcpu) { return false; } +static inline bool nested_svm_is_l2_tlb_flush_hcall(struct kvm_vcpu *vcpu) +{ + return false; +} static inline void svm_hv_inject_synthetic_vmexit_post_tlb_flush(struct kvm_vcpu *vcpu) {} #endif /* CONFIG_KVM_HYPERV */ diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c index f47242a1e602..319f73df03ba 100644 --- a/arch/x86/kvm/svm/nested.c +++ b/arch/x86/kvm/svm/nested.c @@ -1521,9 +1521,7 @@ int nested_svm_exit_special(struct vcpu_svm *svm) } case SVM_EXIT_VMMCALL: /* Hyper-V L2 TLB flush hypercall is handled by L0 */ - if (guest_hv_cpuid_has_l2_tlb_flush(vcpu) && - nested_svm_l2_tlb_flush_enabled(vcpu) && - kvm_hv_is_tlb_flush_hcall(vcpu)) + if (nested_svm_is_l2_tlb_flush_hcall(vcpu)) return NESTED_EXIT_HOST; break; default: diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index ad25a6995ee6..433bbaf6ed66 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -51,6 +51,7 @@ #include "svm.h" #include "svm_ops.h" +#include "hyperv.h" #include "kvm_onhyperv.h" #include "svm_onhyperv.h" @@ -3350,6 +3351,22 @@ static int invpcid_interception(struct kvm_vcpu *vcpu) return kvm_handle_invpcid(vcpu, type, gva); } +static int vmmcall_interception(struct kvm_vcpu *vcpu) +{ + /* + * Inject a #UD if L2 is active and the VMMCALL isn't a Hyper-V TLB + * hypercall, as VMMCALL #UDs if it's not intercepted, and this path is + * reachable if and only if L1 doesn't want to intercept VMMCALL or has + * enabled L0 (KVM) handling of Hyper-V L2 TLB flush hypercalls. + */ + if (is_guest_mode(vcpu) && !nested_svm_is_l2_tlb_flush_hcall(vcpu)) { + kvm_queue_exception(vcpu, UD_VECTOR); + return 1; + } + + return kvm_emulate_hypercall(vcpu); +} + static int (*const svm_exit_handlers[])(struct kvm_vcpu *vcpu) = { [SVM_EXIT_READ_CR0] = cr_interception, [SVM_EXIT_READ_CR3] = cr_interception, @@ -3400,7 +3417,7 @@ static int (*const svm_exit_handlers[])(struct kvm_vcpu *vcpu) = { [SVM_EXIT_TASK_SWITCH] = task_switch_interception, [SVM_EXIT_SHUTDOWN] = shutdown_interception, [SVM_EXIT_VMRUN] = vmrun_interception, - [SVM_EXIT_VMMCALL] = kvm_emulate_hypercall, + [SVM_EXIT_VMMCALL] = vmmcall_interception, [SVM_EXIT_VMLOAD] = vmload_interception, [SVM_EXIT_VMSAVE] = vmsave_interception, [SVM_EXIT_STGI] = stgi_interception, -- 2.34.1

1 0

[PATCH OLK-6.6 0/2] Disable userswap by default
by Wupeng Ma 01 Jun '26

01 Jun '26

Disable userswap by default. Wupeng Ma (2): mm/userswap: remove boot param openeuler_defconfig: disable CONFIG_USERSWAP by default arch/arm64/configs/openeuler_defconfig | 2 +- arch/x86/configs/openeuler_defconfig | 2 +- mm/userswap.c | 7 ------- 3 files changed, 2 insertions(+), 9 deletions(-) -- 2.43.0

1 2

[PATCH OLK-5.10 0/2] CVE-2026-31759
by Liu Mingrui 01 Jun '26

01 Jun '26

CVE-2026-31759 Felix Gu (1): usb: ulpi: fix memory leak on ulpi_register() error paths Guangshuo Li (1): usb: ulpi: fix double free in ulpi_register_interface() error path drivers/usb/common/ulpi.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/2] CVE-2026-31759
by Liu Mingrui 01 Jun '26

01 Jun '26

CVE-2026-31759 Felix Gu (1): usb: ulpi: fix memory leak on ulpi_register() error paths Guangshuo Li (1): usb: ulpi: fix double free in ulpi_register_interface() error path drivers/usb/common/ulpi.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) -- 2.34.1

2 3

[PATCH] usb: ulpi: fix double free in ulpi_register_interface() error path
by Liu Mingrui 30 May '26

30 May '26

From: Guangshuo Li <lgs201920130244(a)gmail.com> stable inclusion from stable-v6.6.134 commit aaeae6533d77e6ed4def85baec01e2815ebbef61 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14509 CVE: CVE-2026-31759 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 01af542392b5d41fd659d487015a71f627accce3 upstream. When device_register() fails, ulpi_register() calls put_device() on ulpi->dev. The device release callback ulpi_dev_release() drops the OF node reference and frees ulpi, but the current error path in ulpi_register_interface() then calls kfree(ulpi) again, causing a double free. Let put_device() handle the cleanup through ulpi_dev_release() and avoid freeing ulpi again in ulpi_register_interface(). Fixes: 289fcff4bcdb1 ("usb: add bus type for USB ULPI") Cc: stable <stable(a)kernel.org> Signed-off-by: Guangshuo Li <lgs201920130244(a)gmail.com> Reviewed-by: Heikki Krogerus <heikki.krogerus(a)linux.intel.com> Link: https://patch.msgid.link/20260401025142.1398996-1-lgs201920130244@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuan Can <yuancan(a)huawei.com> Signed-off-by: Liu Mingrui <liumingrui(a)huawei.com> --- drivers/usb/common/ulpi.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/usb/common/ulpi.c b/drivers/usb/common/ulpi.c index 3c705f1bead8..ddb316dd2a82 100644 --- a/drivers/usb/common/ulpi.c +++ b/drivers/usb/common/ulpi.c @@ -288,10 +288,9 @@ struct ulpi *ulpi_register_interface(struct device *dev, ulpi->ops = ops; ret = ulpi_register(dev, ulpi); - if (ret) { - kfree(ulpi); + if (ret) return ERR_PTR(ret); - } + return ulpi; } -- 2.34.1

1 0

[PATCH OLK-5.10 0/2] netfilter: nft_ct: Fix CVE-2026-43060
by superdcc97＠163.com 30 May '26

30 May '26

From: Dong Chenchen <dongchenchen2(a)huawei.com> This patch series fixes CVE-2026-43060 in the OLK-5.10 branch. * Patch 1: Add seqadj extension for natted connections (stable-dep) * Patch 2: Drop pending enqueued packets on removal (CVE fix) Andrii Melnychenko (1): netfilter: nft_ct: add seqadj extension for natted connections Pablo Neira Ayuso (1): netfilter: nft_ct: drop pending enqueued packets on removal net/netfilter/nft_ct.c | 9 +++++++++ 1 file changed, 9 insertions(+) -- 2.43.0

2 3

[PATCH OLK-6.6] netfilter: nft_ct: drop pending enqueued packets on removal
by superdcc97＠163.com 30 May '26

30 May '26

From: Pablo Neira Ayuso <pablo(a)netfilter.org> stable inclusion from stable-v6.6.130 commit e68a8db3a0546482b34e9ca5ca886bcf73eb37bb category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14592 CVE: CVE-2026-43060 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 36eae0956f659e48d5366d9b083d9417f3263ddc ] Packets sitting in nfqueue might hold a reference to: - templates that specify the conntrack zone, because a percpu area is used and module removal is possible. - conntrack timeout policies and helper, where object removal leave a stale reference. Since these objects can just go away, drop enqueued packets to avoid stale reference to them. If there is a need for finer grain removal, this logic can be revisited to make selective packet drop upon dependencies. Fixes: 7e0b2b57f01d ("netfilter: nft_ct: add ct timeout support") Reported-by: Yiming Qian <yimingqian591(a)gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: net/netfilter/nft_ct.c [context mismatch in nft_ct_timeout_obj_destroy due to kfree_rcu() instead of kfree() in target tree for f8dca15a1b19 has been merged; manual resolution applied] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/nft_ct.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c index eff5921bdea6..7ed103de9b76 100644 --- a/net/netfilter/nft_ct.c +++ b/net/netfilter/nft_ct.c @@ -23,6 +23,7 @@ #include <net/netfilter/nf_conntrack_l4proto.h> #include <net/netfilter/nf_conntrack_expect.h> #include <net/netfilter/nf_conntrack_seqadj.h> +#include "nf_internals.h" struct nft_ct_helper_obj { struct nf_conntrack_helper *helper4; @@ -527,6 +528,7 @@ static void __nft_ct_set_destroy(const struct nft_ctx *ctx, struct nft_ct *priv) #endif #ifdef CONFIG_NF_CONNTRACK_ZONES case NFT_CT_ZONE: + nf_queue_nf_hook_drop(ctx->net); mutex_lock(&nft_ct_pcpu_mutex); if (--nft_ct_pcpu_template_refcnt == 0) nft_ct_tmpl_put_pcpu(); @@ -997,6 +999,7 @@ static void nft_ct_timeout_obj_destroy(const struct nft_ctx *ctx, struct nft_ct_timeout_obj *priv = nft_obj_data(obj); struct nf_ct_timeout *timeout = priv->timeout; + nf_queue_nf_hook_drop(ctx->net); nf_ct_untimeout(ctx->net, timeout); nf_ct_netns_put(ctx->net, ctx->family); kfree_rcu(priv->timeout, rcu); @@ -1129,6 +1132,7 @@ static void nft_ct_helper_obj_destroy(const struct nft_ctx *ctx, { struct nft_ct_helper_obj *priv = nft_obj_data(obj); + nf_queue_nf_hook_drop(ctx->net); if (priv->helper4) nf_conntrack_helper_put(priv->helper4); if (priv->helper6) -- 2.43.0

2 1

[PATCH OLK-6.6] APEI/GHES: ARM processor Error: don't go past allocated memory
by Liu Mingrui 30 May '26

30 May '26

From: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> mainline inclusion from mainline-v7.0-rc1 commit 87880af2d24e62a84ed19943dbdd524f097172f2 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14747 CVE: CVE-2026-43201 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm… -------------------------------- If the BIOS generates a very small ARM Processor Error, or an incomplete one, the current logic will fail to deferrence err->section_length and ctx_info->size Add checks to avoid that. With such changes, such GHESv2 records won't cause OOPSes like this: [ 1.492129] Internal error: Oops: 0000000096000005 [#1] SMP [ 1.495449] Modules linked in: [ 1.495820] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:0 Not tainted 6.18.0-rc1-00017-gabadcc3553dd-dirty #18 PREEMPT [ 1.496125] Hardware name: QEMU QEMU Virtual Machine, BIOS unknown 02/02/2022 [ 1.496433] Workqueue: kacpi_notify acpi_os_execute_deferred [ 1.496967] pstate: 814000c5 (Nzcv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--) [ 1.497199] pc : log_arm_hw_error+0x5c/0x200 [ 1.497380] lr : ghes_handle_arm_hw_error+0x94/0x220 0xffff8000811c5324 is in log_arm_hw_error (../drivers/ras/ras.c:75). 70 err_info = (struct cper_arm_err_info *)(err + 1); 71 ctx_info = (struct cper_arm_ctx_info *)(err_info + err->err_info_num); 72 ctx_err = (u8 *)ctx_info; 73 74 for (n = 0; n < err->context_info_num; n++) { 75 sz = sizeof(struct cper_arm_ctx_info) + ctx_info->size; 76 ctx_info = (struct cper_arm_ctx_info *)((long)ctx_info + sz); 77 ctx_len += sz; 78 } 79 and similar ones while trying to access section_length on an error dump with too small size. Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> Reviewed-by: Jonathan Cameron <jonathan.cameron(a)huawei.com> Acked-by: Ard Biesheuvel <ardb(a)kernel.org> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> [ rjw: Subject tweaks ] Link: https://patch.msgid.link/7fd9f38413be05ee2d7cfdb0dc31ea2274cf1a54.176787195… Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Conflicts: drivers/acpi/apei/ghes.c drivers/ras/ras.c [conflicts due to not merged 96b010536ee0 ("efi/cper: align ARM CPER type with UEFI 2.9A/2.10 specs")] Signed-off-by: Mingrui Liu <liumingrui(a)huawei.com> --- drivers/acpi/apei/ghes.c | 34 +++++++++++++++++++++++++++++----- drivers/ras/ras.c | 6 +++++- 2 files changed, 34 insertions(+), 6 deletions(-) diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c index 48b94dff8029..d67618bc7017 100644 --- a/drivers/acpi/apei/ghes.c +++ b/drivers/acpi/apei/ghes.c @@ -607,27 +607,51 @@ static bool ghes_handle_arm_hw_error(struct acpi_hest_generic_data *gdata, { struct cper_sec_proc_arm *err = acpi_hest_get_payload(gdata); int flags = sync ? MF_ACTION_REQUIRED : 0; + int length = gdata->error_data_length; bool queued = false; int sec_sev, i; bool critical; char *p; sec_sev = ghes_severity(gdata->error_severity); + if (length >= sizeof(*err)) { #ifdef CONFIG_RAS_ARM_EVENT_INFO - log_arm_hw_error(err, sec_sev); + log_arm_hw_error(err, sec_sev); #else - log_arm_hw_error(err); + log_arm_hw_error(err); #endif + } else { + pr_warn(FW_BUG "arm error length: %d\n", length); + pr_warn(FW_BUG "length is too small\n"); + pr_warn(FW_BUG "firmware-generated error record is incorrect\n"); + return false; + } + if (sev != GHES_SEV_RECOVERABLE || sec_sev != GHES_SEV_RECOVERABLE) return false; p = (char *)(err + 1); critical = ghes_armp_vendor_critical_error(err, sync); + length -= sizeof(err); + for (i = 0; i < err->err_info_num; i++) { - struct cper_arm_err_info *err_info = (struct cper_arm_err_info *)p; - bool is_cache = (err_info->type == CPER_ARM_CACHE_ERROR); - bool has_pa = (err_info->validation_bits & CPER_ARM_INFO_VALID_PHYSICAL_ADDR); const char *error_type = "unknown error"; + struct cper_arm_err_info *err_info; + bool is_cache, has_pa; + + /* Ensure we have enough data for the error info header */ + if (length < sizeof(*err_info)) + break; + + err_info = (struct cper_arm_err_info *)p; + + /* Validate the claimed length before using it */ + length -= err_info->length; + if (length < 0) + break; + + is_cache = err_info->type & CPER_ARM_CACHE_ERROR; + has_pa = (err_info->validation_bits & CPER_ARM_INFO_VALID_PHYSICAL_ADDR); /* * The field (err_info->error_info & BIT(26)) is fixed to set to diff --git a/drivers/ras/ras.c b/drivers/ras/ras.c index 547e058e2d56..ecfaff12816c 100644 --- a/drivers/ras/ras.c +++ b/drivers/ras/ras.c @@ -77,7 +77,11 @@ void log_arm_hw_error(struct cper_sec_proc_arm *err) ctx_info = (struct cper_arm_ctx_info *)(err_info + err->err_info_num); ctx_err = (u8 *)ctx_info; for (n = 0; n < err->context_info_num; n++) { - sz = sizeof(struct cper_arm_ctx_info) + ctx_info->size; + sz = sizeof(struct cper_arm_ctx_info); + + if (sz + (long)ctx_info - (long)err >= err->section_length) + sz += ctx_info->size; + ctx_info = (struct cper_arm_ctx_info *)((long)ctx_info + sz); ctx_len += sz; } -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] CVE-2026-43240
by Liu Mingrui 30 May '26

30 May '26

CVE-2026-43240 Harshit Mogalapalli (2): ima: verify the previous kernel's IMA buffer lies in addressable RAM x86/kexec: add a sanity check on previous kernel's ima kexec buffer arch/x86/kernel/setup.c | 6 +++++ include/linux/ima.h | 1 + security/integrity/ima/ima_kexec.c | 35 ++++++++++++++++++++++++++++++ 3 files changed, 42 insertions(+) -- 2.34.1

2 3

[PATCH OLK-6.6 0/6] CVE-2026-43421
by Xinyu Zheng 30 May '26

30 May '26

Krishna Kurapati (2): usb: gadget: ncm: Add support to update wMaxSegmentSize via configfs usb: gadget: ncm: Fix endianness of wMaxSegmentSize variable in ecm_desc Kuen-Han Tsai (2): usb: gadget: f_ncm: Fix net_device lifecycle with device_move usb: gadget: u_ether: Fix NULL pointer deref in eth_get_drvinfo Thomas Gleixner (1): cleanup: Provide retain_and_null_ptr() Udipto Goswami (1): usb: gadget: ncm: Fix indentations in documentation of NCM section Documentation/usb/gadget-testing.rst | 20 ++--- drivers/usb/gadget/function/f_ncm.c | 101 ++++++++++++++++++++++---- drivers/usb/gadget/function/u_ether.c | 28 ++++++- drivers/usb/gadget/function/u_ether.h | 26 +++++++ drivers/usb/gadget/function/u_ncm.h | 4 +- include/linux/cleanup.h | 19 +++++ 6 files changed, 173 insertions(+), 25 deletions(-) -- 2.34.1

2 7