- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] Fix kfree mismatch reported by cocci
by Wang Zhaolong 25 Feb '25

25 Feb '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBNI18 CVE: NA -------------------------------- fs/cifs/cifssmb.c: warning: kfree_mismatch.cocci ./fs/cifs/cifssmb.c:2129:15-16: WARNING kmalloc is used to allocate this memory at line 2125 kcalloc() ends up using kmalloc() to allocate memory, so use kfree() instead of kvfree() to free memory. Fixes: 95621e78c9bf ("cifs: Fix pages leak when cifs_writedata allocate fails in cifs_writedata_direct_alloc()") Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- fs/cifs/cifssmb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c index 1a6c9ac25615..643729b498a0 100644 --- a/fs/cifs/cifssmb.c +++ b/fs/cifs/cifssmb.c @@ -2126,7 +2126,7 @@ cifs_writedata_alloc(unsigned int nr_pages, work_func_t complete) if (pages) { wdata = cifs_writedata_direct_alloc(pages, complete); if (!wdata) - kvfree(pages); + kfree(pages); } return wdata; -- 2.34.3

2 1

[PATCH v3 openEuler-25.03 00/20] mm: arm64: Add kernel replication feature
by Denis Darvish 25 Feb '25

25 Feb '25

This patchset implements initial support of kernel text and rodata replication for AArch64. openEuler 25.03 is used as a baseline. Current implementation supports next functionality: 1. Replicated kernel text and rodata per-NUMA node 2. Vmalloc is able to work with replicated areas, so kernel modules text and rodata also replicated during modules loading stage. 3. BPF handlers are not replicated by default, but this can be easily done by using existent APIs. 4. KPROBES, KGDB and all functionality that depends on kernel text patching work without any limitation. 5. KPTI, KASLR, and KASAN fully supported. 6. Replicates parts of translation table related to replicated text and rodata. 7. 4K and 64K pages are supported. Translation tables synchronization is necessary only in several special cases: 1. Kernel boot 2. Modules deployment 3. Any allocation in user space that require new PUD/P4D In current design mutable kernel data modifications don't require synchronization between translation tables due to on 64-bit platforms all physical memory already mapped in kernel space and this mapping is persistent. In user space the translation tables synchronizations are quite rare due to the only case is new PUD/P4D allocation. At the current stage only the PGD layer is replicated for the user space. Please refer to the next pics. TT overview: NODE 0 NODE 1 USER KERNEL USER KERNEL --------------------- --------------------- PGD | | | | | | | | |*| | | | | | | | | |*| --------------------- --------------------- | | ------------------- ------------------- | | --------------------- --------------------- PUD | | | | | | | |*|*| | | | | | | | |*|*| --------------------- --------------------- | | ------------------- ------------------- | | --------------------- --------------------- PMD |READ-ONLY|MUTABLE | |READ-ONLY|MUTABLE | --------------------- --------------------- | | | | | -------------------------- | | | -------- ------- -------- PHYS | | | | | | MEM -------- ------- -------- <------> <------> NODE 0 Shared NODE 1 between nodes * - entries unique in each table TT synchronization: NODE 0 NODE 1 USER KERNEL USER KERNEL --------------------- --------------------- PGD | | |0| | | | | | | | | |0| | | | | | | --------------------- --------------------- | | | | | PUD_ALLOC / P4D_ALLOC | | IN USERSPACE | \/ --------------------- --------------------- PGD | | |p| | | | | | | | | |p| | | | | | | --------------------- --------------------- | | | | --------------------------- | --------------------- PUD/P4D | | | | | | | | | | --------------------- Known problems: 1. Not all paging modes are supported, for example, the 16K 4-level table is not supported right now. 2. Replication support in vmalloc, possibly, can be optimized in future. 3. Module APIs currently have lack of memory policies support. This part will be fixed in future. Nikita Panov (20): mm: arm64 add Kconfig option for kernel replication arm64: align kernel text and rodata mm: allow per-NUMA node local P4D/PUD/PMD/PTE allocation arm64: add arch callbacks for kernel replication mm: per-NUMA node replication core infrastructure mm: add apply_to_page_range() for replicated memory mm: add support of memory protection for NUMA replicas arm64: add support of memory protection for NUMA replicas mm: set memory permissions for BPF handlers replicas arm64: bpf arch text poke support mm: add replicas allocation support for vmalloc arm64: enable per-NUMA node kernel text and rodata replication mm: enable per-NUMA node kernel text and rodata replication arm64: make power management aware about kernel replication arm64: make KASAN aware about kernel replication arm64: make kernel text patching aware about replicas arm64: add support of NUMA replication for efi page tables arm64: add support of NUMA replication for ptdump arm64: add kernel modules text and rodata replication support mm: init kernel modules with replication support arch/arm64/include/asm/efi.h | 18 +- arch/arm64/include/asm/mmu_context.h | 4 + arch/arm64/include/asm/numa_replication.h | 54 ++ arch/arm64/include/asm/pgtable.h | 13 + arch/arm64/kernel/alternative.c | 27 +- arch/arm64/kernel/cpufeature.c | 5 + arch/arm64/kernel/hibernate.c | 5 + arch/arm64/kernel/module.c | 36 +- arch/arm64/kernel/patching.c | 59 ++ arch/arm64/kernel/sleep.S | 8 + arch/arm64/kernel/smp.c | 8 + arch/arm64/kernel/suspend.c | 6 + arch/arm64/kernel/vmlinux.lds.S | 22 + arch/arm64/mm/context.c | 3 +- arch/arm64/mm/init.c | 49 ++ arch/arm64/mm/kasan_init.c | 68 +- arch/arm64/mm/mmu.c | 41 +- arch/arm64/mm/pageattr.c | 62 ++ arch/arm64/mm/pgd.c | 77 +++ arch/arm64/mm/ptdump.c | 17 +- arch/arm64/net/bpf_jit_comp.c | 4 +- drivers/firmware/efi/arm-runtime.c | 17 +- include/asm-generic/pgalloc.h | 78 +++ include/asm-generic/pgtable-nop4d.h | 5 + include/asm-generic/pgtable-nopmd.h | 5 + include/asm-generic/pgtable-nopud.h | 5 + include/asm-generic/set_memory.h | 12 + include/linux/gfp.h | 5 + include/linux/mm.h | 93 ++- include/linux/mm_types.h | 4 + include/linux/moduleloader.h | 6 + include/linux/numa_kernel_replication.h | 184 ++++++ include/linux/set_memory.h | 10 + include/linux/vmalloc.h | 19 + init/main.c | 17 + kernel/bpf/bpf_struct_ops.c | 8 +- kernel/bpf/core.c | 4 +- kernel/bpf/trampoline.c | 6 +- kernel/module/main.c | 32 + kernel/module/strict_rwx.c | 14 +- mm/Kconfig | 10 + mm/Makefile | 1 + mm/memory.c | 295 ++++++++- mm/mm_init.c | 1 + mm/numa_kernel_replication.c | 759 ++++++++++++++++++++++ mm/page_alloc.c | 20 + mm/vmalloc.c | 469 ++++++++++--- net/bpf/bpf_dummy_struct_ops.c | 2 +- 48 files changed, 2520 insertions(+), 147 deletions(-) create mode 100644 arch/arm64/include/asm/numa_replication.h create mode 100644 include/linux/numa_kernel_replication.h create mode 100644 mm/numa_kernel_replication.c -- 2.34.1

2 21

[PATCH OLK-6.6] USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb()
by Ye Bin 24 Feb '25

24 Feb '25

From: Qasim Ijaz <qasdev00(a)gmail.com> stable inclusion from stable-v6.6.75 commit 6377838560c03b36e1153a42ef727533def9b68f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBLDIN CVE: CVE-2025-21689 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 575a5adf48b06a2980c9eeffedf699ed5534fade upstream. This patch addresses a null-ptr-deref in qt2_process_read_urb() due to an incorrect bounds check in the following: if (newport > serial->num_ports) { dev_err(&port->dev, "%s - port change to invalid port: %i\n", __func__, newport); break; } The condition doesn't account for the valid range of the serial->port buffer, which is from 0 to serial->num_ports - 1. When newport is equal to serial->num_ports, the assignment of "port" in the following code is out-of-bounds and NULL: serial_priv->current_port = newport; port = serial->port[serial_priv->current_port]; The fix checks if newport is greater than or equal to serial->num_ports indicating it is out-of-bounds. Reported-by: syzbot <syzbot+506479ebf12fe435d01a(a)syzkaller.appspotmail.com> Closes: https://syzkaller.appspot.com/bug?extid=506479ebf12fe435d01a Fixes: f7a33e608d9a ("USB: serial: add quatech2 usb to serial driver") Cc: <stable(a)vger.kernel.org> # 3.5 Signed-off-by: Qasim Ijaz <qasdev00(a)gmail.com> Reviewed-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Johan Hovold <johan(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ye Bin <yebin10(a)huawei.com> --- drivers/usb/serial/quatech2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/serial/quatech2.c b/drivers/usb/serial/quatech2.c index 821f25e52ec2..4cde2bd3885f 100644 --- a/drivers/usb/serial/quatech2.c +++ b/drivers/usb/serial/quatech2.c @@ -503,7 +503,7 @@ static void qt2_process_read_urb(struct urb *urb) newport = *(ch + 3); - if (newport > serial->num_ports) { + if (newport >= serial->num_ports) { dev_err(&port->dev, "%s - port change to invalid port: %i\n", __func__, newport); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS_cifs_netns_leak] smb: client: Fix netns refcount imbalance causing leaks and use-after-free
by Wang Zhaolong 24 Feb '25

24 Feb '25

maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBNCLL CVE: NA Reference: https://lore.kernel.org/linux-cifs/CAH2r5muqxgPy=n4Aks_k-2goEZmmD10Dx3u3jgO… --------------------------------------------- Commit ef7134c7fc48 ("smb: client: Fix use-after-free of network namespace.") attempted to fix a netns use-after-free issue by manually adjusting reference counts via sk->sk_net_refcnt and sock_inuse_add(). However, a later commit e9f2517a3e18 ("smb: client: fix TCP timers deadlock after rmmod") pointed out that the approach of manually setting sk->sk_net_refcnt in the first commit was technically incorrect, as sk->sk_net_refcnt should only be set for user sockets. It led to issues like TCP timers not being cleared properly on close. The second commit moved to a model of just holding an extra netns reference for server->ssocket using get_net(), and dropping it when the server is torn down. But there remain some gaps in the get_net()/put_net() balancing added by these commits. The incomplete reference handling in these fixes results in two issues: 1. Netns refcount leaks[1] The problem process is as follows: ``` mount.cifs cifsd cifs_do_mount cifs_mount cifs_mount_get_session cifs_get_tcp_session get_net() /* First get net. */ ip_connect generic_ip_connect /* Try port 445 */ get_net() ->connect() /* Failed */ put_net() generic_ip_connect /* Try port 139 */ get_net() /* Missing matching put_net() for this get_net().*/ cifs_get_smb_ses cifs_negotiate_protocol smb2_negotiate SMB2_negotiate cifs_send_recv wait_for_response cifs_demultiplex_thread cifs_read_from_socket cifs_readv_from_socket cifs_reconnect cifs_abort_connection sock_release(); server->ssocket = NULL; /* Missing put_net() here. */ generic_ip_connect get_net() ->connect() /* Failed */ put_net() sock_release(); server->ssocket = NULL; free_rsp_buf ... clean_demultiplex_info /* It's only called once here. */ put_net() ``` When cifs_reconnect() is triggered, the server->ssocket is released without a corresponding put_net() for the reference acquired in generic_ip_connect() before. it ends up calling generic_ip_connect() again to retry get_net(). After that, server->ssocket is set to NULL in the error path of generic_ip_connect(), and the net count cannot be released in the final clean_demultiplex_info() function. 2. Potential use-after-free The current refcounting scheme can lead to a potential use-after-free issue in the following scenario: ``` cifs_do_mount cifs_mount cifs_mount_get_session cifs_get_tcp_session get_net() /* First get net */ ip_connect generic_ip_connect get_net() bind_socket kernel_bind /* failed */ put_net() /* after out_err_crypto_release label */ put_net() /* after out_err label */ put_net() ``` In the exception handling process where binding the socket fails, the get_net() and put_net() calls are unbalanced, which may cause the server->net reference count to drop to zero and be prematurely released. To address both issues, this patch ties the netns reference counting to the server->ssocket and server lifecycles. The extra reference is now acquired when the server or socket is created, and released when the socket is destroyed or the server is torn down. [1]: https://bugzilla.kernel.org/show_bug.cgi?id=219792 Fixes: ef7134c7fc48 ("smb: client: Fix use-after-free of network namespace.") Fixes: e9f2517a3e18 ("smb: client: fix TCP timers deadlock after rmmod") Conflicts: fs/cifs/connect.c fs/smb/client/connect.c [Conflicts due to fs/cifs move to fs/smb/client] Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- fs/cifs/connect.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c index ee9bdc4ca569..9543f59b7b25 100644 --- a/fs/cifs/connect.c +++ b/fs/cifs/connect.c @@ -429,6 +429,7 @@ cifs_reconnect(struct TCP_Server_Info *server) server->ssocket->state, server->ssocket->flags); sock_release(server->ssocket); server->ssocket = NULL; + put_net(cifs_net_ns(server)); } server->sequence_number = 0; server->session_estab = false; @@ -3650,8 +3651,12 @@ generic_ip_connect(struct TCP_Server_Info *server) /* * Grab netns reference for the socket. * - * It'll be released here, on error, or in clean_demultiplex_info() upon server - * teardown. + * This reference will be released in several situations: + * - In the failure path before the cifsd is started + * - In the all place where server->socket is released, it is + * also set to NULL. + * - Ultimately in clean_demultiplex_info(), during the final + * teardown. */ get_net(net); @@ -3666,10 +3671,8 @@ generic_ip_connect(struct TCP_Server_Info *server) } rc = bind_socket(server); - if (rc < 0) { - put_net(cifs_net_ns(server)); + if (rc < 0) return rc; - } /* * Eventually check for other socket options to change from @@ -3712,9 +3715,6 @@ generic_ip_connect(struct TCP_Server_Info *server) if (sport == htons(RFC1001_PORT)) rc = ip_rfc1001_connect(server); - if (rc < 0) - put_net(cifs_net_ns(server)); - return rc; } -- 2.39.2

1 0

[PATCH v2 openEuler-25.03 00/20] mm: arm64: Add kernel replication feature
by Denis Darvish 24 Feb '25

24 Feb '25

This patchset implements initial support of kernel text and rodata replication for AArch64. openEuler 25.03 is used as a baseline. Current implementation supports next functionality: 1. Replicated kernel text and rodata per-NUMA node 2. Vmalloc is able to work with replicated areas, so kernel modules text and rodata also replicated during modules loading stage. 3. BPF handlers are not replicated by default, but this can be easily done by using existent APIs. 4. KPROBES, KGDB and all functionality that depends on kernel text patching work without any limitation. 5. KPTI, KASLR, and KASAN fully supported. 6. Replicates parts of translation table related to replicated text and rodata. 7. 4K and 64K pages are supported. Translation tables synchronization is necessary only in several special cases: 1. Kernel boot 2. Modules deployment 3. Any allocation in user space that require new PUD/P4D In current design mutable kernel data modifications don't require synchronization between translation tables due to on 64-bit platforms all physical memory already mapped in kernel space and this mapping is persistent. In user space the translation tables synchronizations are quite rare due to the only case is new PUD/P4D allocation. At the current stage only the PGD layer is replicated for the user space. Please refer to the next pics. TT overview: NODE 0 NODE 1 USER KERNEL USER KERNEL --------------------- --------------------- PGD | | | | | | | | |*| | | | | | | | | |*| --------------------- --------------------- | | ------------------- ------------------- | | --------------------- --------------------- PUD | | | | | | | |*|*| | | | | | | | |*|*| --------------------- --------------------- | | ------------------- ------------------- | | --------------------- --------------------- PMD |READ-ONLY|MUTABLE | |READ-ONLY|MUTABLE | --------------------- --------------------- | | | | | -------------------------- | | | -------- ------- -------- PHYS | | | | | | MEM -------- ------- -------- <------> <------> NODE 0 Shared NODE 1 between nodes * - entries unique in each table TT synchronization: NODE 0 NODE 1 USER KERNEL USER KERNEL --------------------- --------------------- PGD | | |0| | | | | | | | | |0| | | | | | | --------------------- --------------------- | | | | | PUD_ALLOC / P4D_ALLOC | | IN USERSPACE | \/ --------------------- --------------------- PGD | | |p| | | | | | | | | |p| | | | | | | --------------------- --------------------- | | | | --------------------------- | --------------------- PUD/P4D | | | | | | | | | | --------------------- Known problems: 1. Not all paging modes are supported, for example, the 16K 4-level table is not supported right now. 2. Replication support in vmalloc, possibly, can be optimized in future. 3. Module APIs currently have lack of memory policies support. This part will be fixed in future. Nikita Panov (20): mm: arm64 add Kconfig option for kernel replication arm64: align kernel text and rodata mm: allow per-NUMA node local P4D/PUD/PMD/PTE allocation arm64: add arch callbacks for kernel replication mm: per-NUMA node replication core infrastructure mm: add apply_to_page_range() for replicated memory mm: add support of memory protection for NUMA replicas arm64: add support of memory protection for NUMA replicas mm: set memory permissions for BPF handlers replicas arm64: bpf arch text poke support mm: add replicas allocation support for vmalloc arm64: enable per-NUMA node kernel text and rodata replication mm: enable per-NUMA node kernel text and rodata replication arm64: make power management aware about kernel replication arm64: make KASAN aware about kernel replication arm64: make kernel text patching aware about replicas arm64: add support of NUMA replication for efi page tables arm64: add support of NUMA replication for ptdump arm64: add kernel modules text and rodata replication support mm: init kernel modules with replication support arch/arm64/include/asm/efi.h | 18 +- arch/arm64/include/asm/mmu_context.h | 4 + arch/arm64/include/asm/numa_replication.h | 54 ++ arch/arm64/include/asm/pgtable.h | 13 + arch/arm64/kernel/alternative.c | 27 +- arch/arm64/kernel/cpufeature.c | 5 + arch/arm64/kernel/hibernate.c | 5 + arch/arm64/kernel/module.c | 36 +- arch/arm64/kernel/patching.c | 59 ++ arch/arm64/kernel/sleep.S | 8 + arch/arm64/kernel/smp.c | 8 + arch/arm64/kernel/suspend.c | 6 + arch/arm64/kernel/vmlinux.lds.S | 22 + arch/arm64/mm/context.c | 3 +- arch/arm64/mm/init.c | 49 ++ arch/arm64/mm/kasan_init.c | 68 +- arch/arm64/mm/mmu.c | 41 +- arch/arm64/mm/pageattr.c | 62 ++ arch/arm64/mm/pgd.c | 77 +++ arch/arm64/mm/ptdump.c | 17 +- arch/arm64/net/bpf_jit_comp.c | 4 +- drivers/firmware/efi/arm-runtime.c | 17 +- include/asm-generic/pgalloc.h | 78 +++ include/asm-generic/pgtable-nop4d.h | 5 + include/asm-generic/pgtable-nopmd.h | 5 + include/asm-generic/pgtable-nopud.h | 5 + include/asm-generic/set_memory.h | 12 + include/linux/gfp.h | 5 + include/linux/mm.h | 93 ++- include/linux/mm_types.h | 4 + include/linux/moduleloader.h | 6 + include/linux/numa_kernel_replication.h | 184 ++++++ include/linux/set_memory.h | 10 + include/linux/vmalloc.h | 19 + init/main.c | 17 + kernel/bpf/bpf_struct_ops.c | 8 +- kernel/bpf/core.c | 4 +- kernel/bpf/trampoline.c | 6 +- kernel/module/main.c | 32 + kernel/module/strict_rwx.c | 14 +- mm/Kconfig | 10 + mm/Makefile | 1 + mm/memory.c | 295 ++++++++- mm/mm_init.c | 1 + mm/numa_kernel_replication.c | 759 ++++++++++++++++++++++ mm/page_alloc.c | 20 + mm/vmalloc.c | 469 ++++++++++--- net/bpf/bpf_dummy_struct_ops.c | 2 +- 48 files changed, 2520 insertions(+), 147 deletions(-) create mode 100644 arch/arm64/include/asm/numa_replication.h create mode 100644 include/linux/numa_kernel_replication.h create mode 100644 mm/numa_kernel_replication.c -- 2.34.1

2 21

[PATCH openEuler-1.0-LTS] cifs: Prevent NULL pointer dereference caused by cifs_sb->rsize is 0
by Wang Zhaolong 24 Feb '25

24 Feb '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBO3FG CVE: NA -------------------------------- When cifs_sb->rsize is 0, cifs_send_async_read() fails to allocate the pages array using iov_iter_get_pages_alloc(), resulting in data->pages being NULL. This eventually triggers a NULL pointer dereference in the callback function uncached_fill_pages(). cifs_sb->rsize is set to the minimum value between SMB3_DEFAULT_IOSIZE and server->max_read. SMB3_DEFAULT_IOSIZE is 4MB. There are two reasons that cause cifs_sb->rsize to be 0: 1. During the negotiation process, if the server returns an rsp->MaxReadSize of 0, server->max_read is assigned 0. And the calculated value of cifs_sb->rsize becomes 0. 2. In the cifsd thread, if cifs_reconnect() is invoked, server->max_read is set to 0. Prior to the completion of the reconnection process, the calculated value of cifs_sb->rsize becomes 0. It is important to note that cifs_sb->rsize is only set to 0 during the mount phase. Therefore, a straightforward approach to prevent potential NULL pointer dereferences in the future is to implement a check for cifs_sb->rsize during the mount stage. If the value is found to be 0, the mount process should exit early to avoid any subsequent NULL pointer dereferences. Fixes: aa24d1e96924 ("CIFS: Process reconnects for SMB2 shares") Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- fs/cifs/connect.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c index bd9365d375f9..a0a61dc752af 100644 --- a/fs/cifs/connect.c +++ b/fs/cifs/connect.c @@ -4243,6 +4243,11 @@ cifs_mount(struct cifs_sb_info *cifs_sb, struct smb_vol *volume_info) cifs_sb->wsize = server->ops->negotiate_wsize(tcon, volume_info); cifs_sb->rsize = server->ops->negotiate_rsize(tcon, volume_info); + if (cifs_sb->rsize == 0) { + cifs_dbg(VFS, "Negotiated rsize is 0, mount failed\n"); + rc = -EINVAL; + goto mount_fail_check; + } remote_path_check: #ifdef CONFIG_CIFS_DFS_UPCALL -- 2.34.3

2 1

[PATCH OLK-5.10] cifs: Prevent NULL pointer dereference caused by cifs_sb->rsize is 0
by Wang Zhaolong 24 Feb '25

24 Feb '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBO3FG CVE: NA -------------------------------- When cifs_sb->rsize is 0, cifs_send_async_read() fails to allocate the pages array using iov_iter_get_pages_alloc(), resulting in data->pages being NULL. This eventually triggers a NULL pointer dereference in the callback function uncached_fill_pages(). cifs_sb->rsize is set to the minimum value between SMB3_DEFAULT_IOSIZE and server->max_read. SMB3_DEFAULT_IOSIZE is 4MB. There are two reasons that cause cifs_sb->rsize to be 0: 1. During the negotiation process, if the server returns an rsp->MaxReadSize of 0, server->max_read is assigned 0. And the calculated value of cifs_sb->rsize becomes 0. 2. In the cifsd thread, if cifs_reconnect() is invoked, server->max_read is set to 0. Prior to the completion of the reconnection process, the calculated value of cifs_sb->rsize becomes 0. It is important to note that cifs_sb->rsize is only set to 0 during the mount phase. Therefore, a straightforward approach to prevent potential NULL pointer dereferences in the future is to implement a check for cifs_sb->rsize during the mount stage. If the value is found to be 0, the mount process should exit early to avoid any subsequent NULL pointer dereferences. Fixes: aa24d1e96924 ("CIFS: Process reconnects for SMB2 shares") Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- fs/cifs/connect.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c index d64e4a2b1a9b..0a31685cdf53 100644 --- a/fs/cifs/connect.c +++ b/fs/cifs/connect.c @@ -4192,6 +4192,10 @@ static int mount_get_conns(struct smb_vol *vol, struct cifs_sb_info *cifs_sb, cifs_sb->wsize = server->ops->negotiate_wsize(tcon, vol); cifs_sb->rsize = server->ops->negotiate_rsize(tcon, vol); + if (cifs_sb->rsize == 0) { + cifs_dbg(VFS, "Negotiated rsize is 0, get connect failed\n"); + return -EINVAL; + } return 0; } -- 2.34.3

2 1

[PATCH OLK-5.10 0/2] KVM: arm64: pvsched bugfix and module param
by Dongxu Sun 24 Feb '25

24 Feb '25

Jia Qingtong (1): KVM: arm64: save & restore pvsched's base addr when migrate Yanan Wang (1): KVM:arm64:Add a module param to enable/disable pv_preempted dynamically arch/arm64/include/asm/kvm_host.h | 5 +- arch/arm64/kvm/arm.c | 27 ++++++++- arch/arm64/kvm/pvsched.c | 2 + arch/arm64/kvm/vgic/vgic-its.c | 92 ++++++++++++++++++++++++++++++ arch/arm64/kvm/vgic/vgic-mmio-v3.c | 24 +++++++- include/linux/irqchip/arm-gic-v3.h | 1 + 6 files changed, 145 insertions(+), 6 deletions(-) -- 2.33.0

2 3

[PATCH openEuler-25.03 00/20] mm: arm64: Add kernel replication feature
by Denis Darvish 24 Feb '25

24 Feb '25

This patchset implements initial support of kernel text and rodata replication for AArch64. openEuler 25.03 is used as a baseline. Current implementation supports next functionality: 1. Replicated kernel text and rodata per-NUMA node 2. Vmalloc is able to work with replicated areas, so kernel modules text and rodata also replicated during modules loading stage. 3. BPF handlers are not replicated by default, but this can be easily done by using existent APIs. 4. KPROBES, KGDB and all functionality that depends on kernel text patching work without any limitation. 5. KPTI, KASLR, and KASAN fully supported. 6. Replicates parts of translation table related to replicated text and rodata. 7. 4K and 64K pages are supported. Translation tables synchronization is necessary only in several special cases: 1. Kernel boot 2. Modules deployment 3. Any allocation in user space that require new PUD/P4D In current design mutable kernel data modifications don't require synchronization between translation tables due to on 64-bit platforms all physical memory already mapped in kernel space and this mapping is persistent. In user space the translation tables synchronizations are quite rare due to the only case is new PUD/P4D allocation. At the current stage only the PGD layer is replicated for the user space. Please refer to the next pics. TT overview: NODE 0 NODE 1 USER KERNEL USER KERNEL --------------------- --------------------- PGD | | | | | | | | |*| | | | | | | | | |*| --------------------- --------------------- | | ------------------- ------------------- | | --------------------- --------------------- PUD | | | | | | | |*|*| | | | | | | | |*|*| --------------------- --------------------- | | ------------------- ------------------- | | --------------------- --------------------- PMD |READ-ONLY|MUTABLE | |READ-ONLY|MUTABLE | --------------------- --------------------- | | | | | -------------------------- | | | -------- ------- -------- PHYS | | | | | | MEM -------- ------- -------- <------> <------> NODE 0 Shared NODE 1 between nodes * - entries unique in each table TT synchronization: NODE 0 NODE 1 USER KERNEL USER KERNEL --------------------- --------------------- PGD | | |0| | | | | | | | | |0| | | | | | | --------------------- --------------------- | | | | | PUD_ALLOC / P4D_ALLOC | | IN USERSPACE | \/ --------------------- --------------------- PGD | | |p| | | | | | | | | |p| | | | | | | --------------------- --------------------- | | | | --------------------------- | --------------------- PUD/P4D | | | | | | | | | | --------------------- Known problems: 1. Not all paging modes are supported, for example, the 16K 4-level table is not supported right now. 2. Replication support in vmalloc, possibly, can be optimized in future. 3. Module APIs currently have lack of memory policies support. This part will be fixed in future. Nikita Panov (20): mm: arm64 add Kconfig option for kernel replication arm64: align kernel text and rodata mm: allow per-NUMA node local P4D/PUD/PMD/PTE allocation arm64: add arch callbacks for kernel replication mm: per-NUMA node replication core infrastructure mm: add apply_to_page_range() for replicated memory mm: add support of memory protection for NUMA replicas arm64: add support of memory protection for NUMA replicas mm: set memory permissions for BPF handlers replicas arm64: bpf arch text poke support mm: add replicas allocation support for vmalloc arm64: enable per-NUMA node kernel text and rodata replication mm: enable per-NUMA node kernel text and rodata replication arm64: make power management aware about kernel replication arm64: make KASAN aware about kernel replication arm64: make kernel text patching aware about replicas arm64: add support of NUMA replication for efi page tables arm64: add support of NUMA replication for ptdump arm64: add kernel modules text and rodata replication support mm: init kernel modules with replication support arch/arm64/include/asm/efi.h | 18 +- arch/arm64/include/asm/mmu_context.h | 4 + arch/arm64/include/asm/numa_replication.h | 54 ++ arch/arm64/include/asm/pgtable.h | 13 + arch/arm64/kernel/alternative.c | 27 +- arch/arm64/kernel/cpufeature.c | 5 + arch/arm64/kernel/hibernate.c | 5 + arch/arm64/kernel/module.c | 36 +- arch/arm64/kernel/patching.c | 59 ++ arch/arm64/kernel/sleep.S | 8 + arch/arm64/kernel/smp.c | 8 + arch/arm64/kernel/suspend.c | 6 + arch/arm64/kernel/vmlinux.lds.S | 22 + arch/arm64/mm/context.c | 3 +- arch/arm64/mm/init.c | 49 ++ arch/arm64/mm/kasan_init.c | 68 +- arch/arm64/mm/mmu.c | 41 +- arch/arm64/mm/pageattr.c | 62 ++ arch/arm64/mm/pgd.c | 77 +++ arch/arm64/mm/ptdump.c | 17 +- arch/arm64/net/bpf_jit_comp.c | 4 +- drivers/firmware/efi/arm-runtime.c | 17 +- include/asm-generic/pgalloc.h | 78 +++ include/asm-generic/pgtable-nop4d.h | 5 + include/asm-generic/pgtable-nopmd.h | 5 + include/asm-generic/pgtable-nopud.h | 5 + include/asm-generic/set_memory.h | 12 + include/linux/gfp.h | 5 + include/linux/mm.h | 93 ++- include/linux/mm_types.h | 4 + include/linux/moduleloader.h | 6 + include/linux/numa_kernel_replication.h | 184 ++++++ include/linux/set_memory.h | 10 + include/linux/vmalloc.h | 19 + init/main.c | 17 + kernel/bpf/bpf_struct_ops.c | 8 +- kernel/bpf/core.c | 4 +- kernel/bpf/trampoline.c | 6 +- kernel/module/main.c | 32 + kernel/module/strict_rwx.c | 14 +- mm/Kconfig | 10 + mm/Makefile | 1 + mm/memory.c | 295 ++++++++- mm/mm_init.c | 1 + mm/numa_kernel_replication.c | 759 ++++++++++++++++++++++ mm/page_alloc.c | 20 + mm/vmalloc.c | 469 ++++++++++--- net/bpf/bpf_dummy_struct_ops.c | 2 +- 48 files changed, 2520 insertions(+), 147 deletions(-) create mode 100644 arch/arm64/include/asm/numa_replication.h create mode 100644 include/linux/numa_kernel_replication.h create mode 100644 mm/numa_kernel_replication.c -- 2.34.1

2 21

[PATCH OLK-6.6] usb: cdc-acm: Check control transfer buffer size before access
by Yuntao Liu 24 Feb '25

24 Feb '25

From: Jann Horn <jannh(a)google.com> stable inclusion from stable-v6.6.79 commit 6abb510251e75f875797d8983a830e6731fa281c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBO4LT CVE: CVE-2025-21704 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e563b01208f4d1f609bcab13333b6c0e24ce6a01 upstream. If the first fragment is shorter than struct usb_cdc_notification, we can't calculate an expected_size. Log an error and discard the notification instead of reading lengths from memory outside the received data, which can lead to memory corruption when the expected_size decreases between fragments, causing `expected_size - acm->nb_index` to wrap. This issue has been present since the beginning of git history; however, it only leads to memory corruption since commit ea2583529cd1 ("cdc-acm: reassemble fragmented notifications"). A mitigating factor is that acm_ctrl_irq() can only execute after userspace has opened /dev/ttyACM*; but if ModemManager is running, ModemManager will do that automatically depending on the USB device's vendor/product IDs and its other interfaces. Cc: stable <stable(a)kernel.org> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Jann Horn <jannh(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuntao Liu <liuyuntao12(a)huawei.com> --- drivers/usb/class/cdc-acm.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c index 605fea461102..fcba1320be5b 100644 --- a/drivers/usb/class/cdc-acm.c +++ b/drivers/usb/class/cdc-acm.c @@ -371,7 +371,7 @@ static void acm_process_notification(struct acm *acm, unsigned char *buf) static void acm_ctrl_irq(struct urb *urb) { struct acm *acm = urb->context; - struct usb_cdc_notification *dr = urb->transfer_buffer; + struct usb_cdc_notification *dr; unsigned int current_size = urb->actual_length; unsigned int expected_size, copy_size, alloc_size; int retval; @@ -398,9 +398,20 @@ static void acm_ctrl_irq(struct urb *urb) usb_mark_last_busy(acm->dev); - if (acm->nb_index) + if (acm->nb_index == 0) { + /* + * The first chunk of a message must contain at least the + * notification header with the length field, otherwise we + * can't get an expected_size. + */ + if (current_size < sizeof(struct usb_cdc_notification)) { + dev_dbg(&acm->control->dev, "urb too short\n"); + goto exit; + } + dr = urb->transfer_buffer; + } else { dr = (struct usb_cdc_notification *)acm->notification_buffer; - + } /* size = notification-header + (optional) data */ expected_size = sizeof(struct usb_cdc_notification) + le16_to_cpu(dr->wLength); -- 2.34.1

2 1