- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10 0/4] *** fix CVE-2026-31527 ***
by Lin Ruifeng 12 May '26

12 May '26

*** fix CVE-2026-31527 *** Danilo Krummrich (3): driver core: generalize driver_override in struct device hwmon: axi-fan: don't use driver_override as IRQ name driver core: platform: use generic driver_override infrastructure Lin Ruifeng (1): driver/core: Fix kabi broken of platform_device/device/bus_type drivers/base/bus.c | 49 +++++++++++++++++++++++- drivers/base/core.c | 2 + drivers/base/dd.c | 60 ++++++++++++++++++++++++++++++ drivers/base/platform.c | 57 +++------------------------- drivers/hwmon/axi-fan-control.c | 2 +- drivers/slimbus/qcom-ngd-ctrl.c | 12 +++++- include/linux/device.h | 66 +++++++++++++++++++++++++++++++++ include/linux/device/bus.h | 4 ++ include/linux/platform_device.h | 3 +- sound/soc/samsung/i2s.c | 6 ++- 10 files changed, 204 insertions(+), 57 deletions(-) -- 2.43.0

2 5

[PATCH openEuler-1.0-LTS 0/3] *** fix CVE-2026-31527 ***
by Lin Ruifeng 12 May '26

12 May '26

*** fix CVE-2026-31527 *** Danilo Krummrich (2): driver core: generalize driver_override in struct device driver core: platform: use generic driver_override infrastructure Lin Ruifeng (1): driver/core: Fix kabi broken of platform_device/device/bus_type drivers/base/bus.c | 49 +++++++++++++++++++++- drivers/base/core.c | 3 ++ drivers/base/dd.c | 61 ++++++++++++++++++++++++++++ drivers/base/platform.c | 57 +++----------------------- drivers/slimbus/qcom-ngd-ctrl.c | 12 +++++- include/linux/device.h | 72 +++++++++++++++++++++++++++++++++ include/linux/platform_device.h | 7 +++- 7 files changed, 206 insertions(+), 55 deletions(-) -- 2.43.0

2 4

[PATCH OLK-6.6 0/2] Fix CVE-2026-31486
by Yin Tirui 12 May '26

12 May '26

Fix CVE-2026-31486 Guenter Roeck (1): hwmon: (pmbus/core) Declare regulator notification function as void Yin Tirui (1): hwmon: (pmbus/core) Protect regulator operations with mutex drivers/hwmon/pmbus/pmbus_core.c | 121 +++++++++++++++++++++++-------- 1 file changed, 92 insertions(+), 29 deletions(-) -- 2.43.0

2 3

[PATCH OLK-6.6 0/4] *** fix CVE-2026-31527 ***
by Lin Ruifeng 12 May '26

12 May '26

*** fix CVE-2026-31527 *** Danilo Krummrich (3): driver core: generalize driver_override in struct device hwmon: axi-fan: don't use driver_override as IRQ name driver core: platform: use generic driver_override infrastructure Lin Ruifeng (1): driver/core: Fix kabi broken of platform_device/bus_type/device drivers/base/bus.c | 43 ++++++++++++++++++++++- drivers/base/core.c | 2 ++ drivers/base/dd.c | 60 +++++++++++++++++++++++++++++++++ drivers/base/platform.c | 37 +++----------------- drivers/bus/simple-pm-bus.c | 4 +-- drivers/clk/imx/clk-scu.c | 3 +- drivers/hwmon/axi-fan-control.c | 2 +- drivers/slimbus/qcom-ngd-ctrl.c | 6 ++-- include/linux/device.h | 57 +++++++++++++++++++++++++++++++ include/linux/device/bus.h | 5 ++- include/linux/platform_device.h | 7 ++-- sound/soc/samsung/i2s.c | 6 ++-- 12 files changed, 181 insertions(+), 51 deletions(-) -- 2.43.0

2 5

[PATCH OLK-5.10] fbdev: Fix vmalloc out-of-bounds write in fast_imageblit
by Jiacheng Yu 12 May '26

12 May '26

From: Sravan Kumar Gundu <sravankumarlpu(a)gmail.com> mainline inclusion from mainline-v6.17-rc1 commit af0db3c1f898144846d4c172531a199bb3ca375d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/9085 CVE: CVE-2025-38685 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- This issue triggers when a userspace program does an ioctl FBIOPUT_CON2FBMAP by passing console number and frame buffer number. Ideally this maps console to frame buffer and updates the screen if console is visible. As part of mapping it has to do resize of console according to frame buffer info. if this resize fails and returns from vc_do_resize() and continues further. At this point console and new frame buffer are mapped and sets display vars. Despite failure still it continue to proceed updating the screen at later stages where vc_data is related to previous frame buffer and frame buffer info and display vars are mapped to new frame buffer and eventully leading to out-of-bounds write in fast_imageblit(). This bheviour is excepted only when fg_console is equal to requested console which is a visible console and updates screen with invalid struct references in fbcon_putcs(). Reported-and-tested-by: syzbot+c4b7aa0513823e2ea880(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=c4b7aa0513823e2ea880 Signed-off-by: Sravan Kumar Gundu <sravankumarlpu(a)gmail.com> Cc: stable(a)vger.kernel.org Signed-off-by: Helge Deller <deller(a)gmx.de> Conflicts: drivers/video/fbdev/core/fbcon.c [Context conflicts.] Signed-off-by: Jiacheng Yu <yujiacheng3(a)huawei.com> --- drivers/video/fbdev/core/fbcon.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c index 3aaf0053c9fc9..d0a11b7543b64 100644 --- a/drivers/video/fbdev/core/fbcon.c +++ b/drivers/video/fbdev/core/fbcon.c @@ -827,7 +827,8 @@ static void con2fb_init_display(struct vc_data *vc, struct fb_info *info, fg_vc->vc_rows); } - update_screen(vc_cons[fg_console].d); + if (fg_console != unit) + update_screen(vc_cons[fg_console].d); } /** @@ -1366,6 +1367,7 @@ static void fbcon_set_disp(struct fb_info *info, struct fb_var_screeninfo *var, struct vc_data *svc; struct fbcon_ops *ops = info->fbcon_par; int rows, cols, charcnt = 256; + int ret = 0; p = &fb_display[unit]; @@ -1417,11 +1419,10 @@ static void fbcon_set_disp(struct fb_info *info, struct fb_var_screeninfo *var, rows = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres); cols /= vc->vc_font.width; rows /= vc->vc_font.height; - vc_resize(vc, cols, rows); + ret = vc_resize(vc, cols, rows); - if (con_is_visible(vc)) { + if (con_is_visible(vc) && !ret) update_screen(vc); - } } static __inline__ void ywrap_up(struct vc_data *vc, int count) -- 2.43.0

2 1

[PATCH OLK-5.10 0/4] *** fix CVE-2026-31527 ***
by Lin Ruifeng 12 May '26

12 May '26

*** fix CVE-2026-31527 *** Danilo Krummrich (3): driver core: generalize driver_override in struct device hwmon: axi-fan: don't use driver_override as IRQ name driver core: platform: use generic driver_override infrastructure Lin Ruifeng (1): driver/core: Fix kabi broken of platform_device/device/bus_type drivers/base/bus.c | 49 +++++++++++++++++++++++- drivers/base/core.c | 2 + drivers/base/dd.c | 60 ++++++++++++++++++++++++++++++ drivers/base/platform.c | 57 +++------------------------- drivers/hwmon/axi-fan-control.c | 2 +- drivers/slimbus/qcom-ngd-ctrl.c | 12 +++++- include/linux/device.h | 66 +++++++++++++++++++++++++++++++++ include/linux/device/bus.h | 4 ++ include/linux/platform_device.h | 3 +- sound/soc/samsung/i2s.c | 6 ++- 10 files changed, 204 insertions(+), 57 deletions(-) -- 2.43.0

2 5

[PATCH OLK-5.10 0/2] Fix CVE-2026-43409
by Tengda Wu 12 May '26

12 May '26

Fix CVE-2026-43409. Masami Hiramatsu (Google) (1): kprobes: avoid crash when rmmod/insmod after ftrace killed Stephen Brennan (1): kprobe/ftrace: bail out if ftrace was killed arch/csky/kernel/probes/ftrace.c | 3 +++ arch/parisc/kernel/ftrace.c | 3 +++ arch/powerpc/kernel/kprobes-ftrace.c | 3 +++ arch/s390/kernel/ftrace.c | 3 +++ arch/sw_64/kernel/kprobes/kprobes-ftrace.c | 3 +++ arch/x86/kernel/kprobes/ftrace.c | 3 +++ include/linux/kprobes.h | 8 ++++++++ kernel/kprobes.c | 11 +++++++++++ kernel/trace/ftrace.c | 1 + 9 files changed, 38 insertions(+) -- 2.34.1

2 3

[PATCH OLK-6.6] scsi: target: tcm_loop: Drain commands in target_reset handler
by Li Lingfeng 12 May '26

12 May '26

From: Josef Bacik <josef(a)toxicpanda.com> stable inclusion from stable-v6.6.134 commit 15f5241d5a52364a7e7867b49128b0442dbcad9d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14586 CVE: CVE-2026-43054 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1333eee56cdf3f0cf67c6ab4114c2c9e0a952026 ] tcm_loop_target_reset() violates the SCSI EH contract: it returns SUCCESS without draining any in-flight commands. The SCSI EH documentation (scsi_eh.rst) requires that when a reset handler returns SUCCESS the driver has made lower layers "forget about timed out scmds" and is ready for new commands. Every other SCSI LLD (virtio_scsi, mpt3sas, ipr, scsi_debug, mpi3mr) enforces this by draining or completing outstanding commands before returning SUCCESS. Because tcm_loop_target_reset() doesn't drain, the SCSI EH reuses in-flight scsi_cmnd structures for recovery commands (e.g. TUR) while the target core still has async completion work queued for the old se_cmd. The memset in queuecommand zeroes se_lun and lun_ref_active, causing transport_lun_remove_cmd() to skip its percpu_ref_put(). The leaked LUN reference prevents transport_clear_lun_ref() from completing, hanging configfs LUN unlink forever in D-state: INFO: task rm:264 blocked for more than 122 seconds. rm D 0 264 258 0x00004000 Call Trace: __schedule+0x3d0/0x8e0 schedule+0x36/0xf0 transport_clear_lun_ref+0x78/0x90 [target_core_mod] core_tpg_remove_lun+0x28/0xb0 [target_core_mod] target_fabric_port_unlink+0x50/0x60 [target_core_mod] configfs_unlink+0x156/0x1f0 [configfs] vfs_unlink+0x109/0x290 do_unlinkat+0x1d5/0x2d0 Fix this by making tcm_loop_target_reset() actually drain commands: 1. Issue TMR_LUN_RESET via tcm_loop_issue_tmr() to drain all commands that the target core knows about (those not yet CMD_T_COMPLETE). 2. Use blk_mq_tagset_busy_iter() to iterate all started requests and flush_work() on each se_cmd — this drains any deferred completion work for commands that already had CMD_T_COMPLETE set before the TMR (which the TMR skips via __target_check_io_state()). This is the same pattern used by mpi3mr, scsi_debug, and libsas to drain outstanding commands during reset. Fixes: e0eb5d38b732 ("scsi: target: tcm_loop: Use block cmd allocator for se_cmds") Cc: stable(a)vger.kernel.org Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Josef Bacik <josef(a)toxicpanda.com> Link: https://patch.msgid.link/27011aa34c8f6b1b94d2e3cf5655b6d037f53428.177370680… Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/target/loopback/tcm_loop.c | 52 ++++++++++++++++++++++++++---- 1 file changed, 46 insertions(+), 6 deletions(-) diff --git a/drivers/target/loopback/tcm_loop.c b/drivers/target/loopback/tcm_loop.c index db13c6a379d8..72d374c94ce2 100644 --- a/drivers/target/loopback/tcm_loop.c +++ b/drivers/target/loopback/tcm_loop.c @@ -26,6 +26,7 @@ #include <linux/slab.h> #include <linux/types.h> #include <linux/configfs.h> +#include <linux/blk-mq.h> #include <scsi/scsi.h> #include <scsi/scsi_tcq.h> #include <scsi/scsi_host.h> @@ -267,15 +268,27 @@ static int tcm_loop_device_reset(struct scsi_cmnd *sc) return (ret == TMR_FUNCTION_COMPLETE) ? SUCCESS : FAILED; } +static bool tcm_loop_flush_work_iter(struct request *rq, void *data) +{ + struct scsi_cmnd *sc = blk_mq_rq_to_pdu(rq); + struct tcm_loop_cmd *tl_cmd = scsi_cmd_priv(sc); + struct se_cmd *se_cmd = &tl_cmd->tl_se_cmd; + + flush_work(&se_cmd->work); + return true; +} + static int tcm_loop_target_reset(struct scsi_cmnd *sc) { struct tcm_loop_hba *tl_hba; struct tcm_loop_tpg *tl_tpg; + struct Scsi_Host *sh = sc->device->host; + int ret; /* * Locate the tcm_loop_hba_t pointer */ - tl_hba = *(struct tcm_loop_hba **)shost_priv(sc->device->host); + tl_hba = *(struct tcm_loop_hba **)shost_priv(sh); if (!tl_hba) { pr_err("Unable to perform device reset without active I_T Nexus\n"); return FAILED; @@ -284,11 +297,38 @@ static int tcm_loop_target_reset(struct scsi_cmnd *sc) * Locate the tl_tpg pointer from TargetID in sc->device->id */ tl_tpg = &tl_hba->tl_hba_tpgs[sc->device->id]; - if (tl_tpg) { - tl_tpg->tl_transport_status = TCM_TRANSPORT_ONLINE; - return SUCCESS; - } - return FAILED; + if (!tl_tpg) + return FAILED; + + /* + * Issue a LUN_RESET to drain all commands that the target core + * knows about. This handles commands not yet marked CMD_T_COMPLETE. + */ + ret = tcm_loop_issue_tmr(tl_tpg, sc->device->lun, 0, TMR_LUN_RESET); + if (ret != TMR_FUNCTION_COMPLETE) + return FAILED; + + /* + * Flush any deferred target core completion work that may still be + * queued. Commands that already had CMD_T_COMPLETE set before the TMR + * are skipped by the TMR drain, but their async completion work + * (transport_lun_remove_cmd → percpu_ref_put, release_cmd → scsi_done) + * may still be pending in target_completion_wq. + * + * The SCSI EH will reuse in-flight scsi_cmnd structures for recovery + * commands (e.g. TUR) immediately after this handler returns SUCCESS — + * if deferred work is still pending, the memset in queuecommand would + * zero the se_cmd while the work accesses it, leaking the LUN + * percpu_ref and hanging configfs unlink forever. + * + * Use blk_mq_tagset_busy_iter() to find all started requests and + * flush_work() on each — the same pattern used by mpi3mr, scsi_debug, + * and other SCSI drivers to drain outstanding commands during reset. + */ + blk_mq_tagset_busy_iter(&sh->tag_set, tcm_loop_flush_work_iter, NULL); + + tl_tpg->tl_transport_status = TCM_TRANSPORT_ONLINE; + return SUCCESS; } static const struct scsi_host_template tcm_loop_driver_template = { -- 2.52.0

2 1

[PATCH OLK-5.10] Bluetooth: SMP: derive legacy responder STK authentication from MITM state
by Chen Jinghuang 12 May '26

12 May '26

From: Oleh Konko <security(a)1seal.org> stable inclusion from stable-v5.10.253 commit 9a38659a3d06080715691bd3139f9c4b61f688e3 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14523 CVE: CVE-2026-31773 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- commit 20756fec2f0108cb88e815941f1ffff88dc286fe upstream. The legacy responder path in smp_random() currently labels the stored STK as authenticated whenever pending_sec_level is BT_SECURITY_HIGH. That reflects what the local service requested, not what the pairing flow actually achieved. For Just Works/Confirm legacy pairing, SMP_FLAG_MITM_AUTH stays clear and the resulting STK should remain unauthenticated even if the local side requested HIGH security. Use the established MITM state when storing the responder STK so the key metadata matches the pairing result. This also keeps the legacy path aligned with the Secure Connections code, which already treats JUST_WORKS/JUST_CFM as unauthenticated. Fixes: fff3490f4781 ("Bluetooth: Fix setting correct authentication information for SMP STK") Cc: stable(a)vger.kernel.org Signed-off-by: Oleh Konko <security(a)1seal.org> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- net/bluetooth/smp.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c index d9a378d12be6..d3bc89bbbeb9 100644 --- a/net/bluetooth/smp.c +++ b/net/bluetooth/smp.c @@ -1017,10 +1017,7 @@ static u8 smp_random(struct smp_chan *smp) smp_s1(smp->tk, smp->prnd, smp->rrnd, stk); - if (hcon->pending_sec_level == BT_SECURITY_HIGH) - auth = 1; - else - auth = 0; + auth = test_bit(SMP_FLAG_MITM_AUTH, &smp->flags) ? 1 : 0; /* Even though there's no _RESPONDER suffix this is the * responder STK we're adding for later lookup (the initiator -- 2.34.1

2 1

[PATCH OLK-6.6] Bluetooth: SMP: derive legacy responder STK authentication from MITM state
by Chen Jinghuang 12 May '26

12 May '26

From: Oleh Konko <security(a)1seal.org> stable inclusion from stable-v6.6.134 commit b1c6a8e554a39b222c0879a288ea98e338fc4d77 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14523 CVE: CVE-2026-31773 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- commit 20756fec2f0108cb88e815941f1ffff88dc286fe upstream. The legacy responder path in smp_random() currently labels the stored STK as authenticated whenever pending_sec_level is BT_SECURITY_HIGH. That reflects what the local service requested, not what the pairing flow actually achieved. For Just Works/Confirm legacy pairing, SMP_FLAG_MITM_AUTH stays clear and the resulting STK should remain unauthenticated even if the local side requested HIGH security. Use the established MITM state when storing the responder STK so the key metadata matches the pairing result. This also keeps the legacy path aligned with the Secure Connections code, which already treats JUST_WORKS/JUST_CFM as unauthenticated. Fixes: fff3490f4781 ("Bluetooth: Fix setting correct authentication information for SMP STK") Cc: stable(a)vger.kernel.org Signed-off-by: Oleh Konko <security(a)1seal.org> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- net/bluetooth/smp.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c index e7ee13fe83a7..101cc9007cf0 100644 --- a/net/bluetooth/smp.c +++ b/net/bluetooth/smp.c @@ -1019,10 +1019,7 @@ static u8 smp_random(struct smp_chan *smp) smp_s1(smp->tk, smp->prnd, smp->rrnd, stk); - if (hcon->pending_sec_level == BT_SECURITY_HIGH) - auth = 1; - else - auth = 0; + auth = test_bit(SMP_FLAG_MITM_AUTH, &smp->flags) ? 1 : 0; /* Even though there's no _RESPONDER suffix this is the * responder STK we're adding for later lookup (the initiator -- 2.34.1

2 1