July 2025 - Kernel - mailweb.openeuler.org

[openeuler:openEuler-1.0-LTS 1605/1605] net/netfilter/nf_conntrack_core.c:1017: warning: Function parameter or member 'reply_hash' not described in 'nf_ct_resolve_clash'
by kernel test robot 03 Jul '25

03 Jul '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 382711115afc1197da2c288679079946650ef017 commit: cc12c927ac504e99fc176ea49e85226b6aeadcd5 [1605/1605] netfilter: conntrack: allow insertion of clashing entries config: x86_64-buildonly-randconfig-2002-20250501 (https://download.01.org/0day-ci/archive/20250703/202507030549.czVv179y-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250703/202507030549.czVv179y-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507030549.czVv179y-lkp@intel.com/ All warnings (new ones prefixed by >>): >> net/netfilter/nf_conntrack_core.c:1017: warning: Function parameter or member 'reply_hash' not described in 'nf_ct_resolve_clash' >> net/netfilter/nf_conntrack_core.c:1017: warning: Excess function parameter 'hash_reply' description in 'nf_ct_resolve_clash' vim +1017 net/netfilter/nf_conntrack_core.c cc12c927ac504e Florian Westphal 2023-11-02 980 6199b71796bcaa Florian Westphal 2023-11-02 981 /** 6199b71796bcaa Florian Westphal 2023-11-02 982 * nf_ct_resolve_clash - attempt to handle clash without packet drop 6199b71796bcaa Florian Westphal 2023-11-02 983 * 6199b71796bcaa Florian Westphal 2023-11-02 984 * @skb: skb that causes the clash 6199b71796bcaa Florian Westphal 2023-11-02 985 * @h: tuplehash of the clashing entry already in table cc12c927ac504e Florian Westphal 2023-11-02 986 * @hash_reply: hash slot for reply direction 6199b71796bcaa Florian Westphal 2023-11-02 987 * 6199b71796bcaa Florian Westphal 2023-11-02 988 * A conntrack entry can be inserted to the connection tracking table 6199b71796bcaa Florian Westphal 2023-11-02 989 * if there is no existing entry with an identical tuple. 6199b71796bcaa Florian Westphal 2023-11-02 990 * 6199b71796bcaa Florian Westphal 2023-11-02 991 * If there is one, @skb (and the assocated, unconfirmed conntrack) has 6199b71796bcaa Florian Westphal 2023-11-02 992 * to be dropped. In case @skb is retransmitted, next conntrack lookup 6199b71796bcaa Florian Westphal 2023-11-02 993 * will find the already-existing entry. 6199b71796bcaa Florian Westphal 2023-11-02 994 * 6199b71796bcaa Florian Westphal 2023-11-02 995 * The major problem with such packet drop is the extra delay added by 6199b71796bcaa Florian Westphal 2023-11-02 996 * the packet loss -- it will take some time for a retransmit to occur 6199b71796bcaa Florian Westphal 2023-11-02 997 * (or the sender to time out when waiting for a reply). 6199b71796bcaa Florian Westphal 2023-11-02 998 * 6199b71796bcaa Florian Westphal 2023-11-02 999 * This function attempts to handle the situation without packet drop. 6199b71796bcaa Florian Westphal 2023-11-02 1000 * 6199b71796bcaa Florian Westphal 2023-11-02 1001 * If @skb has no NAT transformation or if the colliding entries are 6199b71796bcaa Florian Westphal 2023-11-02 1002 * exactly the same, only the to-be-confirmed conntrack entry is discarded 6199b71796bcaa Florian Westphal 2023-11-02 1003 * and @skb is associated with the conntrack entry already in the table. 6199b71796bcaa Florian Westphal 2023-11-02 1004 * cc12c927ac504e Florian Westphal 2023-11-02 1005 * Failing that, the new, unconfirmed conntrack is still added to the table cc12c927ac504e Florian Westphal 2023-11-02 1006 * provided that the collision only occurs in the ORIGINAL direction. cc12c927ac504e Florian Westphal 2023-11-02 1007 * The new entry will be added after the existing one in the hash list, cc12c927ac504e Florian Westphal 2023-11-02 1008 * so packets in the ORIGINAL direction will continue to match the existing cc12c927ac504e Florian Westphal 2023-11-02 1009 * entry. The new entry will also have a fixed timeout so it expires -- cc12c927ac504e Florian Westphal 2023-11-02 1010 * due to the collision, it will not see bidirectional traffic. cc12c927ac504e Florian Westphal 2023-11-02 1011 * 6199b71796bcaa Florian Westphal 2023-11-02 1012 * Returns NF_DROP if the clash could not be resolved. 6199b71796bcaa Florian Westphal 2023-11-02 1013 */ 115dffa33ea6f5 Florian Westphal 2023-11-02 1014 static __cold noinline int cc12c927ac504e Florian Westphal 2023-11-02 1015 nf_ct_resolve_clash(struct sk_buff *skb, struct nf_conntrack_tuple_hash *h, cc12c927ac504e Florian Westphal 2023-11-02 1016 u32 reply_hash) 71d8c47fc65371 Pablo Neira Ayuso 2016-05-01 @1017 { 71d8c47fc65371 Pablo Neira Ayuso 2016-05-01 1018 /* This is the conntrack entry already in hashes that won race. */ 71d8c47fc65371 Pablo Neira Ayuso 2016-05-01 1019 struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h); b3480fe059ac91 Florian Westphal 2017-08-12 1020 const struct nf_conntrack_l4proto *l4proto; 6199b71796bcaa Florian Westphal 2023-11-02 1021 enum ip_conntrack_info ctinfo; 6199b71796bcaa Florian Westphal 2023-11-02 1022 struct nf_conn *loser_ct; 6199b71796bcaa Florian Westphal 2023-11-02 1023 struct net *net; 94ebb264459f97 Florian Westphal 2023-11-02 1024 int ret; 6199b71796bcaa Florian Westphal 2023-11-02 1025 6199b71796bcaa Florian Westphal 2023-11-02 1026 loser_ct = nf_ct_get(skb, &ctinfo); 94ebb264459f97 Florian Westphal 2023-11-02 1027 net = nf_ct_net(loser_ct); 71d8c47fc65371 Pablo Neira Ayuso 2016-05-01 1028 71d8c47fc65371 Pablo Neira Ayuso 2016-05-01 1029 l4proto = __nf_ct_l4proto_find(nf_ct_l3num(ct), nf_ct_protonum(ct)); 6199b71796bcaa Florian Westphal 2023-11-02 1030 if (!l4proto->allow_clash) 6199b71796bcaa Florian Westphal 2023-11-02 1031 goto drop; 6199b71796bcaa Florian Westphal 2023-11-02 1032 94ebb264459f97 Florian Westphal 2023-11-02 1033 ret = __nf_ct_resolve_clash(skb, h); 94ebb264459f97 Florian Westphal 2023-11-02 1034 if (ret == NF_ACCEPT) 94ebb264459f97 Florian Westphal 2023-11-02 1035 return ret; 6199b71796bcaa Florian Westphal 2023-11-02 1036 cc12c927ac504e Florian Westphal 2023-11-02 1037 ret = nf_ct_resolve_clash_harder(skb, reply_hash); cc12c927ac504e Florian Westphal 2023-11-02 1038 if (ret == NF_ACCEPT) cc12c927ac504e Florian Westphal 2023-11-02 1039 return ret; cc12c927ac504e Florian Westphal 2023-11-02 1040 6199b71796bcaa Florian Westphal 2023-11-02 1041 drop: 94ebb264459f97 Florian Westphal 2023-11-02 1042 nf_ct_add_to_dying_list(loser_ct); 71d8c47fc65371 Pablo Neira Ayuso 2016-05-01 1043 NF_CT_STAT_INC(net, drop); 94ebb264459f97 Florian Westphal 2023-11-02 1044 NF_CT_STAT_INC(net, insert_failed); 71d8c47fc65371 Pablo Neira Ayuso 2016-05-01 1045 return NF_DROP; 71d8c47fc65371 Pablo Neira Ayuso 2016-05-01 1046 } 71d8c47fc65371 Pablo Neira Ayuso 2016-05-01 1047 :::::: The code at line 1017 was first introduced by commit :::::: 71d8c47fc653711c41bc3282e5b0e605b3727956 netfilter: conntrack: introduce clash resolution on insertion race :::::: TO: Pablo Neira Ayuso <pablo(a)netfilter.org> :::::: CC: Pablo Neira Ayuso <pablo(a)netfilter.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/6] OLK-6.6 Bperf
by Xiaomeng Zhang 03 Jul '25

03 Jul '25

Ian Rogers (1): perf test bpf-counters: Add test for BPF event modifier Tengda Wu (2): perf stat: Support inherit events during fork() for bperf perf test: Use sqrtloop workload to test bperf event Veronika Molnarova (1): perf test stat_bpf_counter.sh: Stabilize the test results Xiaomeng Zhang (2): perf stat: Increase perf_attr_map entries perf stat: Fix incorrect display of bperf when event count is 0 tools/lib/perf/include/perf/bpf_perf.h | 1 + tools/perf/builtin-stat.c | 1 + tools/perf/tests/shell/stat_bpf_counters.sh | 79 ++++++++++----- tools/perf/util/bpf_counter.c | 61 +++++++++--- tools/perf/util/bpf_skel/bperf_follower.bpf.c | 98 +++++++++++++++++-- tools/perf/util/bpf_skel/bperf_u.h | 5 + tools/perf/util/target.h | 1 + 7 files changed, 198 insertions(+), 48 deletions(-) -- 2.34.1

2 7

[openeuler:openEuler-1.0-LTS 1605/1605] fs/ocfs2/dlm/dlmcommon.h:709:9: warning: 'BITS_TO_BYTES' macro redefined
by kernel test robot 03 Jul '25

03 Jul '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: d96cd567c8d8d584405abe92c2576bf58202fa6e commit: 8f44df8094e0d4dcd28122eab732820e5c639ccd [1605/1605] net/netlink: fix NETLINK_LIST_MEMBERSHIPS length report config: x86_64-buildonly-randconfig-2002-20250501 (https://download.01.org/0day-ci/archive/20250703/202507030301.JSR1Dol1-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250703/202507030301.JSR1Dol1-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507030301.JSR1Dol1-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from fs/ocfs2/dlm/dlmdomain.c:43: >> fs/ocfs2/dlm/dlmcommon.h:709:9: warning: 'BITS_TO_BYTES' macro redefined [-Wmacro-redefined] 709 | #define BITS_TO_BYTES(bits) (((bits)+BITS_PER_BYTE-1)/BITS_PER_BYTE) | ^ include/linux/bitops.h:9:9: note: previous definition is here 9 | #define BITS_TO_BYTES(nr) DIV_ROUND_UP(nr, BITS_PER_TYPE(char)) | ^ 1 warning generated. -- In file included from fs/ocfs2/dlm/dlmthread.c:48: >> fs/ocfs2/dlm/dlmcommon.h:709:9: warning: 'BITS_TO_BYTES' macro redefined [-Wmacro-redefined] 709 | #define BITS_TO_BYTES(bits) (((bits)+BITS_PER_BYTE-1)/BITS_PER_BYTE) | ^ include/linux/bitops.h:9:9: note: previous definition is here 9 | #define BITS_TO_BYTES(nr) DIV_ROUND_UP(nr, BITS_PER_TYPE(char)) | ^ fs/ocfs2/dlm/dlmthread.c:534:18: warning: equality comparison with extraneous parentheses [-Wparentheses-equality] 534 | if ((res->owner == dlm->node_num)) { | ~~~~~~~~~~~^~~~~~~~~~~~~~~~ fs/ocfs2/dlm/dlmthread.c:534:18: note: remove extraneous parentheses around the comparison to silence this warning 534 | if ((res->owner == dlm->node_num)) { | ~ ^ ~ fs/ocfs2/dlm/dlmthread.c:534:18: note: use '=' to turn this equality comparison into an assignment 534 | if ((res->owner == dlm->node_num)) { | ^~ | = 2 warnings generated. vim +/BITS_TO_BYTES +709 fs/ocfs2/dlm/dlmcommon.h 6714d8e86bf443 Kurt Hackel 2005-12-15 706 6714d8e86bf443 Kurt Hackel 2005-12-15 707 1faf289454b9ee Srinivas Eeda 2007-01-29 708 #define BITS_PER_BYTE 8 1faf289454b9ee Srinivas Eeda 2007-01-29 @709 #define BITS_TO_BYTES(bits) (((bits)+BITS_PER_BYTE-1)/BITS_PER_BYTE) 1faf289454b9ee Srinivas Eeda 2007-01-29 710 :::::: The code at line 709 was first introduced by commit :::::: 1faf289454b9eeb6e463da3eee47f7009668370d ocfs2_dlm: disallow a domain join if node maps mismatch :::::: TO: Srinivas Eeda <srinivas.eeda(a)oracle.com> :::::: CC: Mark Fasheh <mark.fasheh(a)oracle.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] crypto: algif_hash - fix double free in hash_accept
by Gu Bowen 03 Jul '25

03 Jul '25

From: Ivan Pravdin <ipravdin.official(a)gmail.com> mainline inclusion from mainline-v6.15 commit b2df03ed4052e97126267e8c13ad4204ea6ba9b6 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICGACQ CVE: CVE-2025-38079 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If accept(2) is called on socket type algif_hash with MSG_MORE flag set and crypto_ahash_import fails, sk2 is freed. However, it is also freed in af_alg_release, leading to slab-use-after-free error. Fixes: fe869cdb89c9 ("crypto: algif_hash - User-space interface for hash operations") Cc: <stable(a)vger.kernel.org> Signed-off-by: Ivan Pravdin <ipravdin.official(a)gmail.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Conflicts: crypto/algif_hash.c [Context conflicts.] Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- crypto/algif_hash.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/crypto/algif_hash.c b/crypto/algif_hash.c index bfcf595fd8f9..3547db4ac4b2 100644 --- a/crypto/algif_hash.c +++ b/crypto/algif_hash.c @@ -267,10 +267,6 @@ static int hash_accept(struct socket *sock, struct socket *newsock, int flags, return err; err = crypto_ahash_import(&ctx2->req, state); - if (err) { - sock_orphan(sk2); - sock_put(sk2); - } return err; } -- 2.25.1

2 1

[PATCH OLK-6.6 V1] rseq: Fix segfault on registration when rseq_cs is non-zero
by Wang Tao 03 Jul '25

03 Jul '25

From: Michael Jeanson <mjeanson(a)efficios.com> mainline inclusion from mainline-v6.15-rc1 commit fd881d0a085fc54354414aed990ccf05f282ba53 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICGAFQ CVE: CVE-2025-38067 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The rseq_cs field is documented as being set to 0 by user-space prior to registration, however this is not currently enforced by the kernel. This can result in a segfault on return to user-space if the value stored in the rseq_cs field doesn't point to a valid struct rseq_cs. The correct solution to this would be to fail the rseq registration when the rseq_cs field is non-zero. However, some older versions of glibc will reuse the rseq area of previous threads without clearing the rseq_cs field and will also terminate the process if the rseq registration fails in a secondary thread. This wasn't caught in testing because in this case the leftover rseq_cs does point to a valid struct rseq_cs. What we can do is clear the rseq_cs field on registration when it's non-zero which will prevent segfaults on registration and won't break the glibc versions that reuse rseq areas on thread creation. Signed-off-by: Michael Jeanson <mjeanson(a)efficios.com> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Reviewed-by: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Cc: Peter Zijlstra <peterz(a)infradead.org> Cc: Linus Torvalds <torvalds(a)linux-foundation.org> Link: https://lore.kernel.org/r/20250306211223.109455-1-mjeanson@efficios.com Conflicts: kernel/rseq.c [In method SYSCALL_DEFINE4(), there are some code in mainline but OLK-6.6 has not merged] Signed-off-by: Wang Tao <wangtao554(a)huawei.com> --- kernel/rseq.c | 60 ++++++++++++++++++++++++++++++++++++++++----------- 1 file changed, 48 insertions(+), 12 deletions(-) diff --git a/kernel/rseq.c b/kernel/rseq.c index 9de6e35fe679..b4136ec87737 100644 --- a/kernel/rseq.c +++ b/kernel/rseq.c @@ -149,6 +149,29 @@ static int rseq_reset_rseq_cpu_node_id(struct task_struct *t) return 0; } +/* + * Get the user-space pointer value stored in the 'rseq_cs' field. + */ +static int rseq_get_rseq_cs_ptr_val(struct rseq __user *rseq, u64 *rseq_cs) +{ + if (!rseq_cs) + return -EFAULT; + +#ifdef CONFIG_64BIT + if (get_user(*rseq_cs, &rseq->rseq_cs)) + return -EFAULT; +#else + if (copy_from_user(rseq_cs, &rseq->rseq_cs, sizeof(*rseq_cs))) + return -EFAULT; +#endif + + return 0; +} + +/* + * If the rseq_cs field of 'struct rseq' contains a valid pointer to + * user-space, copy 'struct rseq_cs' from user-space and validate its fields. + */ static int rseq_get_rseq_cs(struct task_struct *t, struct rseq_cs *rseq_cs) { struct rseq_cs __user *urseq_cs; @@ -157,17 +180,16 @@ static int rseq_get_rseq_cs(struct task_struct *t, struct rseq_cs *rseq_cs) u32 sig; int ret; -#ifdef CONFIG_64BIT - if (get_user(ptr, &t->rseq->rseq_cs)) - return -EFAULT; -#else - if (copy_from_user(&ptr, &t->rseq->rseq_cs, sizeof(ptr))) - return -EFAULT; -#endif + ret = rseq_get_rseq_cs_ptr_val(t->rseq, &ptr); + if (ret) + return ret; + + /* If the rseq_cs pointer is NULL, return a cleared struct rseq_cs. */ if (!ptr) { memset(rseq_cs, 0, sizeof(*rseq_cs)); return 0; } + /* Check that the pointer value fits in the user-space process space. */ if (ptr >= TASK_SIZE) return -EINVAL; urseq_cs = (struct rseq_cs __user *)(unsigned long)ptr; @@ -243,7 +265,7 @@ static int rseq_need_restart(struct task_struct *t, u32 cs_flags) return !!event_mask; } -static int clear_rseq_cs(struct task_struct *t) +static int clear_rseq_cs(struct rseq __user *rseq) { /* * The rseq_cs field is set to NULL on preemption or signal @@ -254,9 +276,9 @@ static int clear_rseq_cs(struct task_struct *t) * Set rseq_cs to NULL. */ #ifdef CONFIG_64BIT - return put_user(0UL, &t->rseq->rseq_cs); + return put_user(0UL, &rseq->rseq_cs); #else - if (clear_user(&t->rseq->rseq_cs, sizeof(t->rseq->rseq_cs))) + if (clear_user(&rseq->rseq_cs, sizeof(rseq->rseq_cs))) return -EFAULT; return 0; #endif @@ -288,11 +310,11 @@ static int rseq_ip_fixup(struct pt_regs *regs) * Clear the rseq_cs pointer and return. */ if (!in_rseq_cs(ip, &rseq_cs)) - return clear_rseq_cs(t); + return clear_rseq_cs(t->rseq); ret = rseq_need_restart(t, rseq_cs.flags); if (ret <= 0) return ret; - ret = clear_rseq_cs(t); + ret = clear_rseq_cs(t->rseq); if (ret) return ret; trace_rseq_ip_fixup(ip, rseq_cs.start_ip, rseq_cs.post_commit_offset, @@ -366,6 +388,7 @@ SYSCALL_DEFINE4(rseq, struct rseq __user *, rseq, u32, rseq_len, int, flags, u32, sig) { int ret; + u64 rseq_cs; if (flags & RSEQ_FLAG_UNREGISTER) { if (flags & ~RSEQ_FLAG_UNREGISTER) @@ -420,6 +443,19 @@ SYSCALL_DEFINE4(rseq, struct rseq __user *, rseq, u32, rseq_len, return -EINVAL; if (!access_ok(rseq, rseq_len)) return -EFAULT; + + /* + * If the rseq_cs pointer is non-NULL on registration, clear it to + * avoid a potential segfault on return to user-space. The proper thing + * to do would have been to fail the registration but this would break + * older libcs that reuse the rseq area for new threads without + * clearing the fields. + */ + if (rseq_get_rseq_cs_ptr_val(rseq, &rseq_cs)) + return -EFAULT; + if (rseq_cs && clear_rseq_cs(rseq)) + return -EFAULT; + current->rseq = rseq; current->rseq_len = rseq_len; current->rseq_sig = sig; -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 1605/1605] drivers/pci/hotplug/pciehp_core.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 03 Jul '25

03 Jul '25

Hi Keith, First bad commit (maybe != root cause): tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: d96cd567c8d8d584405abe92c2576bf58202fa6e commit: 58d584102f06f870f118644f1022c751e015e7bb [1605/1605] PCI: portdrv: Initialize service drivers directly config: x86_64-buildonly-randconfig-2004-20250501 (https://download.01.org/0day-ci/archive/20250703/202507030314.c8FttoWL-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250703/202507030314.c8FttoWL-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507030314.c8FttoWL-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/pci/hotplug/pciehp_core.c:214: warning: Function parameter or member 'ctrl' not described in 'pciehp_check_presence' >> drivers/pci/hotplug/pciehp_core.o: warning: objtool: missing symbol for section .init.text -- drivers/pci/pcie/aer.c:217: warning: Function parameter or member 'str' not described in 'pcie_ecrc_get_policy' >> drivers/pci/pcie/aer.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] net: mdio: fix undefined behavior in bit shift for __mdiobus_register
by Zhang Changzhong 03 Jul '25

03 Jul '25

From: Cui GaoSheng <cuigaosheng1(a)huawei.com> stable inclusion from stable-v4.19.265 commit a3fafc974be37319679f36dc4e7cca7db1e02973 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC5BVD CVE: CVE-2022-49907 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 40e4eb324c59e11fcb927aa46742d28aba6ecb8a ] Shifting signed 32-bit value by 31 bits is undefined, so changing significant bit to unsigned. The UBSAN warning calltrace like below: UBSAN: shift-out-of-bounds in drivers/net/phy/mdio_bus.c:586:27 left shift of 1 by 31 places cannot be represented in type 'int' Call Trace: <TASK> dump_stack_lvl+0x7d/0xa5 dump_stack+0x15/0x1b ubsan_epilogue+0xe/0x4e __ubsan_handle_shift_out_of_bounds+0x1e7/0x20c __mdiobus_register+0x49d/0x4e0 fixed_mdio_bus_init+0xd8/0x12d do_one_initcall+0x76/0x430 kernel_init_freeable+0x3b3/0x422 kernel_init+0x24/0x1e0 ret_from_fork+0x1f/0x30 </TASK> Fixes: 4fd5f812c23c ("phylib: allow incremental scanning of an mii bus") Signed-off-by: Gaosheng Cui <cuigaosheng1(a)huawei.com> Reviewed-by: Andrew Lunn <andrew(a)lunn.ch> Link: https://lore.kernel.org/r/20221031132645.168421-1-cuigaosheng1@huawei.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/net/phy/mdio_bus.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c index 60c732d..0f0cdb4 100644 --- a/drivers/net/phy/mdio_bus.c +++ b/drivers/net/phy/mdio_bus.c @@ -416,7 +416,7 @@ int __mdiobus_register(struct mii_bus *bus, struct module *owner) bus->reset(bus); for (i = 0; i < PHY_MAX_ADDR; i++) { - if ((bus->phy_mask & (1 << i)) == 0) { + if ((bus->phy_mask & BIT(i)) == 0) { struct phy_device *phydev; phydev = mdiobus_scan(bus, i); -- 2.9.5

2 1

[PATCH openEuler-1.0-LTS] wifi: mac80211: Fix UAF in ieee80211_scan_rx()
by Wang Liang 03 Jul '25

03 Jul '25

From: Siddh Raman Pant <code(a)siddh.me> stable inclusion from stable-v4.19.260 commit 78a07732fbb0934d14827d8f09b9aa6a49ee1aa9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICG9IO CVE: CVE-2022-49934 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 60deb9f10eec5c6a20252ed36238b55d8b614a2c ] ieee80211_scan_rx() tries to access scan_req->flags after a null check, but a UAF is observed when the scan is completed and __ieee80211_scan_completed() executes, which then calls cfg80211_scan_done() leading to the freeing of scan_req. Since scan_req is rcu_dereference()'d, prevent the racing in __ieee80211_scan_completed() by ensuring that from mac80211's POV it is no longer accessed from an RCU read critical section before we call cfg80211_scan_done(). Cc: stable(a)vger.kernel.org Link: https://syzkaller.appspot.com/bug?extid=f9acff9bf08a845f225d Reported-by: syzbot+f9acff9bf08a845f225d(a)syzkaller.appspotmail.com Suggested-by: Johannes Berg <johannes(a)sipsolutions.net> Signed-off-by: Siddh Raman Pant <code(a)siddh.me> Link: https://lore.kernel.org/r/20220819200340.34826-1-code@siddh.me Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/mac80211/scan.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c index 5d2a11777718..af6c512bf71d 100644 --- a/net/mac80211/scan.c +++ b/net/mac80211/scan.c @@ -402,10 +402,6 @@ static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted) scan_req = rcu_dereference_protected(local->scan_req, lockdep_is_held(&local->mtx)); - if (scan_req != local->int_scan_req) { - local->scan_info.aborted = aborted; - cfg80211_scan_done(scan_req, &local->scan_info); - } RCU_INIT_POINTER(local->scan_req, NULL); scan_sdata = rcu_dereference_protected(local->scan_sdata, @@ -415,6 +411,13 @@ static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted) local->scanning = 0; local->scan_chandef.chan = NULL; + synchronize_rcu(); + + if (scan_req != local->int_scan_req) { + local->scan_info.aborted = aborted; + cfg80211_scan_done(scan_req, &local->scan_info); + } + /* Set power back to normal operating levels. */ ieee80211_hw_config(local, 0); -- 2.34.1

2 1

[PATCH OLK-6.6 0/4] some optimization patches for inet_diag dump
by Liu Jian 03 Jul '25

03 Jul '25

some optimization patches for inet_diag dump Eric Dumazet (4): inet_diag: add module pointer to "struct inet_diag_handler" inet_diag: allow concurrent operations sock_diag: remove sock_diag_mutex inet_diag: skip over empty buckets include/linux/inet_diag.h | 1 + net/core/sock_diag.c | 4 -- net/dccp/diag.c | 1 + net/ipv4/inet_diag.c | 84 ++++++++++++++++++++------------------- net/ipv4/raw_diag.c | 1 + net/ipv4/tcp_diag.c | 1 + net/ipv4/udp_diag.c | 2 + net/mptcp/mptcp_diag.c | 1 + net/sctp/diag.c | 1 + 9 files changed, 52 insertions(+), 44 deletions(-) -- 2.34.1

2 5

[PATCH OLK-6.6] cachefiles: Fix the incorrect return value in cachefiles_ondemand_fd_write_iter()
by Zizhi Wo 03 Jul '25

03 Jul '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICJHNT -------------------------------- In __cachefiles_write(), if the return value of the write operation > 0, it is set to 0. This makes it impossible to distinguish scenarios where a partial write has occurred, and causes the outer function cachefiles_ondemand_fd_write_iter() to unconditionally return the full length specified by user space. Fix it by modifying "ret" to reflect the actual number of bytes written. Furthermore, returning a value greater than 0 from __cachefiles_write() does not affect other call paths, such as fscache_write_to_cache() and fscache_write(). Fixes: c8383054506c ("cachefiles: notify the user daemon when looking up cookie") Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/cachefiles/io.c | 2 -- fs/cachefiles/ondemand.c | 4 +--- 2 files changed, 1 insertion(+), 5 deletions(-) diff --git a/fs/cachefiles/io.c b/fs/cachefiles/io.c index f7a507ddd668..2ba98f3861e8 100644 --- a/fs/cachefiles/io.c +++ b/fs/cachefiles/io.c @@ -357,8 +357,6 @@ int __cachefiles_write(struct cachefiles_object *object, default: ki->was_async = false; cachefiles_write_complete(&ki->iocb, ret); - if (ret > 0) - ret = 0; break; } diff --git a/fs/cachefiles/ondemand.c b/fs/cachefiles/ondemand.c index 6a0921f31a8a..8b0d123b51b1 100644 --- a/fs/cachefiles/ondemand.c +++ b/fs/cachefiles/ondemand.c @@ -84,10 +84,8 @@ static ssize_t cachefiles_ondemand_fd_write_iter(struct kiocb *kiocb, trace_cachefiles_ondemand_fd_write(object, file_inode(file), pos, len); ret = __cachefiles_write(object, file, pos, iter, NULL, NULL); - if (!ret) { - ret = len; + if (ret > 0) kiocb->ki_pos += ret; - } out: fput(file); return ret; -- 2.39.2

2 1