- Kernel - mailweb.openeuler.org

[PATCH] erofs: fix stack-out-of-bounds in erofs_put_metabuf
by Liu Mingrui 10 Aug '26

10 Aug '26

From: Mingrui Liu <liumingrui(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16872 -------------------------------- Commit 1d4b040dd8ee moved erofs_put_metabuf() to out_unlock, but some error paths jump there before buf is initialized, unlike mainline where buf is always set. This triggers : BUG: KASAN: stack-out-of-bounds in erofs_put_metabuf+0x54/0x158 [erofs] Call Trace: dump_backtrace+0xa0/0x128 show_stack+0x20/0x38 dump_stack_lvl+0x78/0xc8 print_address_description.constprop.0+0x84/0x3c8 print_report+0xb0/0x280 kasan_report+0x84/0xd0 __asan_load8+0x9c/0xc0 erofs_put_metabuf+0x54/0x158 [erofs] erofs_init_inode_xattrs+0x194/0x560 [erofs] erofs_getxattr+0xc8/0x238 [erofs] erofs_get_acl+0x6c/0x150 [erofs] __get_acl.part.0+0x218/0x390 vfs_get_acl+0xd0/0x150 do_get_acl+0x38/0x2a0 do_getxattr+0x9c/0x250 getxattr+0xe0/0x148 path_getxattr+0xdc/0x150 __arm64_sys_getxattr+0x60/0x80 invoke_syscall+0x64/0x178 el0_svc_common.constprop.0+0x11c/0x150 do_el0_svc+0x38/0x50 el0_svc+0x44/0x228 el0t_64_sync_handler+0x100/0x130 el0t_64_sync+0x3c8/0x3d0 Fix by zero-initializing buf at declaration so erofs_put_metabuf() can safely handle it. Fixes: 6a89c63750cb ("erofs: fix metabuf leak in inode xattr initialization") Signed-off-by: Mingrui Liu <liumingrui(a)huawei.com> --- fs/erofs/xattr.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/erofs/xattr.c b/fs/erofs/xattr.c index b270226be379..abd23e990a3a 100644 --- a/fs/erofs/xattr.c +++ b/fs/erofs/xattr.c @@ -34,6 +34,8 @@ static int erofs_init_inode_xattrs(struct inode *inode) struct super_block *sb = inode->i_sb; int ret = 0; + it.buf = __EROFS_BUF_INITIALIZER; + /* the most case is that xattrs of this inode are initialized. */ if (test_bit(EROFS_I_EA_INITED_BIT, &vi->flags)) { /* @@ -76,7 +78,6 @@ static int erofs_init_inode_xattrs(struct inode *inode) goto out_unlock; } - it.buf = __EROFS_BUF_INITIALIZER; erofs_init_metabuf(&it.buf, sb); it.pos = erofs_iloc(inode) + vi->inode_isize; -- 2.34.1

1 0

[PATCH OLK-6.6 0/6] bonding: Fix CVE-2026-52975
by superdcc97＠163.com 10 Aug '26

10 Aug '26

From: Dong Chenchen <dongchenchen2(a)huawei.com> Fix CVE-2026-52975 Eric Dumazet (2): bonding: 3ad: implement proper RCU rules for port->aggregator bonding: annotate data-races arcound churn variables Hangbin Liu (3): bonding: add support for per-port LACP actor priority bonding: print churn state via netlink bonding: fix NULL pointer dereference in actor_port_prio setting Tonghao Zhang (1): net: bonding: add broadcast_neighbor option for 802.3ad Documentation/networking/bonding.rst | 15 +++ drivers/net/bonding/bond_3ad.c | 131 ++++++++++++++----------- drivers/net/bonding/bond_main.c | 67 +++++++++++-- drivers/net/bonding/bond_netlink.c | 37 ++++++- drivers/net/bonding/bond_options.c | 71 ++++++++++++++ drivers/net/bonding/bond_procfs.c | 11 ++- drivers/net/bonding/bond_sysfs_slave.c | 17 ++-- include/net/bond_3ad.h | 3 +- include/net/bond_options.h | 2 + include/net/bonding.h | 3 + include/uapi/linux/if_link.h | 3 + 11 files changed, 280 insertions(+), 80 deletions(-) -- 2.43.0

2 7

[PATCH OLK-6.6 0/8] net Fix CVE-2026-45905
by superdcc97＠163.com 10 Aug '26

10 Aug '26

From: Dong Chenchen <dongchenchen2(a)huawei.com> fix CVE-2026-45905 Dong Chenchen (1): net: Use __GENKSYMS__ to fix kabi breakage of icmp Guillaume Nault (2): ipv4: Convert icmp_route_lookup() to dscp_t. ipv4: Convert ip_route_input() to dscp_t. Ido Schimmel (2): ipv4: icmp: Pass full DS field to ip_route_input() ipv4: icmp: Unmask upper DSCP bits in icmp_route_lookup() Jiayuan Chen (1): xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path Peilin He (1): net/ipv4: add tracepoint for icmp_send Stanislav Fomichev (1): net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers include/net/ip.h | 5 +++ include/net/route.h | 5 ++- include/trace/events/icmp.h | 67 +++++++++++++++++++++++++++++++++ net/bridge/br_netfilter_hooks.c | 8 ++-- net/ipv4/icmp.c | 50 +++++++++++++++++------- net/ipv4/ip_options.c | 8 ++-- net/ipv6/ip6_tunnel.c | 4 +- 7 files changed, 123 insertions(+), 24 deletions(-) create mode 100644 include/trace/events/icmp.h -- 2.43.0

2 9

[PATCH OLK-6.6 0/2] net: core: synchronize link-watch when carrier is queried
by superdcc97＠163.com 10 Aug '26

10 Aug '26

From: Dong Chenchen <dongchenchen2(a)huawei.com> synchronize link-watch when carrier is queried Johannes Berg (2): net: core: synchronize link-watch when carrier is queried net: sysfs: fix locking in carrier read include/linux/netdevice.h | 9 +++++++++ net/core/dev.c | 2 +- net/core/dev.h | 1 - net/core/link_watch.c | 2 +- net/core/net-sysfs.c | 17 ++++++++++++++--- net/core/rtnetlink.c | 8 ++++++++ net/ethtool/ioctl.c | 3 +++ 7 files changed, 36 insertions(+), 6 deletions(-) -- 2.43.0

2 3

[PATCH OLK-6.6] net: core: synchronize link-watch when carrier is queried
by superdcc97＠163.com 10 Aug '26

10 Aug '26

From: Johannes Berg <johannes.berg(a)intel.com> mainline inclusion from mainline-v6.7-rc3 commit facd15dfd69122042502d99ab8c9f888b48ee994 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9743 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There are multiple ways to query for the carrier state: through rtnetlink, sysfs, and (possibly) ethtool. Synchronize linkwatch work before these operations so that we don't have a situation where userspace queries the carrier state between the driver's carrier off->on transition and linkwatch running and expects it to work, when really (at least) TX cannot work until linkwatch has run. I previously posted a longer explanation of how this applies to wireless [1] but with this wireless can simply query the state before sending data, to ensure the kernel is ready for it. [1] https://lore.kernel.org/all/346b21d87c69f817ea3c37caceb34f1f56255884.camel@… Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Reviewed-by: Jiri Pirko <jiri(a)nvidia.com> Link: https://lore.kernel.org/r/20231204214706.303c62768415.I1caedccae72ee5a45c90… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- include/linux/netdevice.h | 9 +++++++++ net/core/dev.c | 2 +- net/core/dev.h | 1 - net/core/link_watch.c | 2 +- net/core/net-sysfs.c | 8 +++++++- net/core/rtnetlink.c | 8 ++++++++ net/ethtool/ioctl.c | 3 +++ 7 files changed, 29 insertions(+), 4 deletions(-) diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h index 2bdce0b48965..2cda65c6006f 100644 --- a/include/linux/netdevice.h +++ b/include/linux/netdevice.h @@ -4245,18 +4245,27 @@ static inline void netdev_ref_replace(struct net_device *odev, * and _off may be called from IRQ context, but it is caller * who is responsible for serialization of these calls. * * The name carrier is inappropriate, these functions should really be * called netif_lowerlayer_*() because they represent the state of any * kind of lower layer not just hardware media. */ void linkwatch_fire_event(struct net_device *dev); +/** + * linkwatch_sync_dev - sync linkwatch for the given device + * @dev: network device to sync linkwatch for + * + * Sync linkwatch for the given device, removing it from the + * pending work list (if queued). + */ +void linkwatch_sync_dev(struct net_device *dev); + /** * netif_carrier_ok - test if carrier present * @dev: network device * * Check if carrier is present on device */ static inline bool netif_carrier_ok(const struct net_device *dev) { return !test_bit(__LINK_STATE_NOCARRIER, &dev->state); diff --git a/net/core/dev.c b/net/core/dev.c index a54d8761b86f..d21b3bf2700b 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -10751,19 +10751,19 @@ void netdev_run_todo(void) if (unlikely(dev->reg_state != NETREG_UNREGISTERING)) { netdev_WARN(dev, "run_todo but not unregistering\n"); list_del(&dev->todo_list); continue; } write_lock(&dev_base_lock); dev->reg_state = NETREG_UNREGISTERED; write_unlock(&dev_base_lock); - linkwatch_forget_dev(dev); + linkwatch_sync_dev(dev); } while (!list_empty(&list)) { dev = netdev_wait_allrefs_any(&list); list_del(&dev->todo_list); /* paranoia */ BUG_ON(netdev_refcnt_read(dev) != 1); BUG_ON(!list_empty(&dev->ptype_all)); diff --git a/net/core/dev.h b/net/core/dev.h index f2037d402144..8cb96532a7c7 100644 --- a/net/core/dev.h +++ b/net/core/dev.h @@ -24,19 +24,18 @@ struct sd_flow_limit { extern int netdev_flow_limit_table_len; #ifdef CONFIG_PROC_FS int __init dev_proc_init(void); #else #define dev_proc_init() 0 #endif void linkwatch_init_dev(struct net_device *dev); -void linkwatch_forget_dev(struct net_device *dev); void linkwatch_run_queue(void); void dev_addr_flush(struct net_device *dev); int dev_addr_init(struct net_device *dev); void dev_addr_check(struct net_device *dev); /* sysctls not referred to from outside net/core/ */ extern int netdev_budget; extern unsigned int netdev_budget_usecs; diff --git a/net/core/link_watch.c b/net/core/link_watch.c index e2e8a341318b..423f8583ebdd 100644 --- a/net/core/link_watch.c +++ b/net/core/link_watch.c @@ -248,19 +248,19 @@ static void __linkwatch_run_queue(int urgent_only) /* Add the remaining work back to lweventlist */ list_splice_init(&wrk, &lweventlist); if (!list_empty(&lweventlist)) linkwatch_schedule_work(0); spin_unlock_irq(&lweventlist_lock); } -void linkwatch_forget_dev(struct net_device *dev) +void linkwatch_sync_dev(struct net_device *dev) { unsigned long flags; int clean = 0; spin_lock_irqsave(&lweventlist_lock, flags); if (!list_empty(&dev->link_watch_list)) { list_del_init(&dev->link_watch_list); clean = 1; /* We must release netdev tracker under diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c index f7404bc67974..97582c1d01c2 100644 --- a/net/core/net-sysfs.c +++ b/net/core/net-sysfs.c @@ -188,20 +188,26 @@ static ssize_t carrier_store(struct device *dev, struct device_attribute *attr, return netdev_store(dev, attr, buf, len, change_carrier); } static ssize_t carrier_show(struct device *dev, struct device_attribute *attr, char *buf) { struct net_device *netdev = to_net_dev(dev); - if (netif_running(netdev)) + if (netif_running(netdev)) { + /* Synchronize carrier state with link watch, + * see also rtnl_getlink(). + */ + linkwatch_sync_dev(netdev); + return sysfs_emit(buf, fmt_dec, !!netif_carrier_ok(netdev)); + } return -EINVAL; } static DEVICE_ATTR_RW(carrier); static ssize_t speed_show(struct device *dev, struct device_attribute *attr, char *buf) { struct net_device *netdev = to_net_dev(dev); diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c index dc82b95bb245..2296b3052732 100644 --- a/net/core/rtnetlink.c +++ b/net/core/rtnetlink.c @@ -3863,18 +3863,26 @@ static int rtnl_getlink(struct sk_buff *skb, struct nlmsghdr *nlh, err = -ENODEV; if (dev == NULL) goto out; err = -ENOBUFS; nskb = nlmsg_new(if_nlmsg_size(dev, ext_filter_mask), GFP_KERNEL); if (nskb == NULL) goto out; + /* Synchronize the carrier state so we don't report a state + * that we're not actually going to honour immediately; if + * the driver just did a carrier off->on transition, we can + * only TX if link watch work has run, but without this we'd + * already report carrier on, even if it doesn't work yet. + */ + linkwatch_sync_dev(dev); + err = rtnl_fill_ifinfo(nskb, dev, net, RTM_NEWLINK, NETLINK_CB(skb).portid, nlh->nlmsg_seq, 0, 0, ext_filter_mask, 0, NULL, 0, netnsid, GFP_KERNEL); if (err < 0) { /* -EMSGSIZE implies BUG in if_nlmsg_size */ WARN_ON(err == -EMSGSIZE); kfree_skb(nskb); } else diff --git a/net/ethtool/ioctl.c b/net/ethtool/ioctl.c index 6258b4f1bc0d..22be4dd167bb 100644 --- a/net/ethtool/ioctl.c +++ b/net/ethtool/ioctl.c @@ -52,18 +52,21 @@ static struct devlink *netdev_to_devlink_get(struct net_device *dev) /* * Some useful ethtool_ops methods that're device independent. * If we find that all drivers want to do the same thing here, * we can turn these into dev_() function calls. */ u32 ethtool_op_get_link(struct net_device *dev) { + /* Synchronize carrier state with link watch, see also rtnl_getlink() */ + linkwatch_sync_dev(dev); + return netif_carrier_ok(dev) ? 1 : 0; } EXPORT_SYMBOL(ethtool_op_get_link); int ethtool_op_get_ts_info(struct net_device *dev, struct ethtool_ts_info *info) { info->so_timestamping = SOF_TIMESTAMPING_TX_SOFTWARE | SOF_TIMESTAMPING_RX_SOFTWARE | -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] drm/edid: fix OOB read in drm_parse_tiled_block()
by Hongtao Zhang 10 Aug '26

10 Aug '26

From: Xiang Mei <xmei5(a)asu.edu> stable inclusion from stable-v5.10.261 commit c4ab04ca1bbf87eefa9fec5c80e1880450d2e7c0 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16848 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit faaa1e1155833e7d4ce7e3cfaf64c0d636b190db ] drm_parse_tiled_block() casts the DisplayID block to a struct displayid_tiled_block and reads the full fixed layout up to tile->topology_id[7] without checking block->num_bytes. The DisplayID iterator only validates the declared payload length, so a crafted EDID can advertise a tiled-display block (tag DATA_BLOCK_TILED_DISPLAY, or DATA_BLOCK_2_TILED_DISPLAY_TOPOLOGY for v2.0) with a small num_bytes at the end of a DisplayID extension. The read then runs past the end of the exact-sized kmemdup()'d EDID allocation, a heap out-of-bounds read. Reject blocks shorter than the spec's 22-byte tiled payload before reading the fixed struct, as drm_parse_vesa_mso_data() already does. BUG: KASAN: slab-out-of-bounds in drm_edid_connector_update Read of size 2 at addr ffff888010077700 by task exploit/147 dump_stack_lvl (lib/dump_stack.c:94 ...) print_report (mm/kasan/report.c:378 ...) kasan_report (mm/kasan/report.c:595) drm_edid_connector_update (drivers/gpu/drm/drm_edid.c:7581) bochs_connector_helper_get_modes (drivers/gpu/drm/tiny/bochs.c:574) drm_helper_probe_single_connector_modes (drivers/gpu/drm/drm_probe_helper.c:426) status_store (drivers/gpu/drm/drm_sysfs.c:219) ... vfs_write (fs/read_write.c:595 fs/read_write.c:688) ksys_write (fs/read_write.c:740) Fixes: 40d9b043a89e ("drm/connector: store tile information from displayid (v3)") Reported-by: Weiming Shi <bestswngs(a)gmail.com> Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Xiang Mei <xmei5(a)asu.edu> Reviewed-by: Jani Nikula <jani.nikula(a)intel.com> Link: https://patch.msgid.link/20260615184737.899892-1-xmei5@asu.edu Signed-off-by: Jani Nikula <jani.nikula(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Hongtao <zhanghongtao35(a)huawei.com> --- drivers/gpu/drm/drm_edid.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c index f5926bf5dabd9..ad7e524d03037 100644 --- a/drivers/gpu/drm/drm_edid.c +++ b/drivers/gpu/drm/drm_edid.c @@ -5198,6 +5198,13 @@ static int drm_parse_tiled_block(struct drm_connector *connector, u8 num_v_tile, num_h_tile; struct drm_tile_group *tg; + /* tiled block payload per spec: cap 1 + topo 3 + size 4 + bezel 5 + id 9 = 22 */ + if (block->num_bytes < 22) { + DRM_DEBUG_KMS("[CONNECTOR:%d:%s] Unexpected tiled block size %u\n", + connector->base.id, connector->name, block->num_bytes); + return 0; + } + w = tile->tile_size[0] | tile->tile_size[1] << 8; h = tile->tile_size[2] | tile->tile_size[3] << 8; -- 2.43.0

2 1

[PATCH OLK-6.6] net: core: synchronize link-watch when carrier is queried
by superdcc97＠163.com 10 Aug '26

10 Aug '26

From: Johannes Berg <johannes.berg(a)intel.com> mainline inclusion from mainline-v6.7-rc3 commit facd15dfd69122042502d99ab8c9f888b48ee994 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9730 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There are multiple ways to query for the carrier state: through rtnetlink, sysfs, and (possibly) ethtool. Synchronize linkwatch work before these operations so that we don't have a situation where userspace queries the carrier state between the driver's carrier off->on transition and linkwatch running and expects it to work, when really (at least) TX cannot work until linkwatch has run. I previously posted a longer explanation of how this applies to wireless [1] but with this wireless can simply query the state before sending data, to ensure the kernel is ready for it. [1] https://lore.kernel.org/all/346b21d87c69f817ea3c37caceb34f1f56255884.camel@… Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Reviewed-by: Jiri Pirko <jiri(a)nvidia.com> Link: https://lore.kernel.org/r/20231204214706.303c62768415.I1caedccae72ee5a45c90… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- include/linux/netdevice.h | 9 +++++++++ net/core/dev.c | 2 +- net/core/dev.h | 1 - net/core/link_watch.c | 2 +- net/core/net-sysfs.c | 8 +++++++- net/core/rtnetlink.c | 8 ++++++++ net/ethtool/ioctl.c | 3 +++ 7 files changed, 29 insertions(+), 4 deletions(-) diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h index 2bdce0b48965..2cda65c6006f 100644 --- a/include/linux/netdevice.h +++ b/include/linux/netdevice.h @@ -4245,18 +4245,27 @@ static inline void netdev_ref_replace(struct net_device *odev, * and _off may be called from IRQ context, but it is caller * who is responsible for serialization of these calls. * * The name carrier is inappropriate, these functions should really be * called netif_lowerlayer_*() because they represent the state of any * kind of lower layer not just hardware media. */ void linkwatch_fire_event(struct net_device *dev); +/** + * linkwatch_sync_dev - sync linkwatch for the given device + * @dev: network device to sync linkwatch for + * + * Sync linkwatch for the given device, removing it from the + * pending work list (if queued). + */ +void linkwatch_sync_dev(struct net_device *dev); + /** * netif_carrier_ok - test if carrier present * @dev: network device * * Check if carrier is present on device */ static inline bool netif_carrier_ok(const struct net_device *dev) { return !test_bit(__LINK_STATE_NOCARRIER, &dev->state); diff --git a/net/core/dev.c b/net/core/dev.c index a54d8761b86f..d21b3bf2700b 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -10751,19 +10751,19 @@ void netdev_run_todo(void) if (unlikely(dev->reg_state != NETREG_UNREGISTERING)) { netdev_WARN(dev, "run_todo but not unregistering\n"); list_del(&dev->todo_list); continue; } write_lock(&dev_base_lock); dev->reg_state = NETREG_UNREGISTERED; write_unlock(&dev_base_lock); - linkwatch_forget_dev(dev); + linkwatch_sync_dev(dev); } while (!list_empty(&list)) { dev = netdev_wait_allrefs_any(&list); list_del(&dev->todo_list); /* paranoia */ BUG_ON(netdev_refcnt_read(dev) != 1); BUG_ON(!list_empty(&dev->ptype_all)); diff --git a/net/core/dev.h b/net/core/dev.h index f2037d402144..8cb96532a7c7 100644 --- a/net/core/dev.h +++ b/net/core/dev.h @@ -24,19 +24,18 @@ struct sd_flow_limit { extern int netdev_flow_limit_table_len; #ifdef CONFIG_PROC_FS int __init dev_proc_init(void); #else #define dev_proc_init() 0 #endif void linkwatch_init_dev(struct net_device *dev); -void linkwatch_forget_dev(struct net_device *dev); void linkwatch_run_queue(void); void dev_addr_flush(struct net_device *dev); int dev_addr_init(struct net_device *dev); void dev_addr_check(struct net_device *dev); /* sysctls not referred to from outside net/core/ */ extern int netdev_budget; extern unsigned int netdev_budget_usecs; diff --git a/net/core/link_watch.c b/net/core/link_watch.c index e2e8a341318b..423f8583ebdd 100644 --- a/net/core/link_watch.c +++ b/net/core/link_watch.c @@ -248,19 +248,19 @@ static void __linkwatch_run_queue(int urgent_only) /* Add the remaining work back to lweventlist */ list_splice_init(&wrk, &lweventlist); if (!list_empty(&lweventlist)) linkwatch_schedule_work(0); spin_unlock_irq(&lweventlist_lock); } -void linkwatch_forget_dev(struct net_device *dev) +void linkwatch_sync_dev(struct net_device *dev) { unsigned long flags; int clean = 0; spin_lock_irqsave(&lweventlist_lock, flags); if (!list_empty(&dev->link_watch_list)) { list_del_init(&dev->link_watch_list); clean = 1; /* We must release netdev tracker under diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c index f7404bc67974..97582c1d01c2 100644 --- a/net/core/net-sysfs.c +++ b/net/core/net-sysfs.c @@ -188,20 +188,26 @@ static ssize_t carrier_store(struct device *dev, struct device_attribute *attr, return netdev_store(dev, attr, buf, len, change_carrier); } static ssize_t carrier_show(struct device *dev, struct device_attribute *attr, char *buf) { struct net_device *netdev = to_net_dev(dev); - if (netif_running(netdev)) + if (netif_running(netdev)) { + /* Synchronize carrier state with link watch, + * see also rtnl_getlink(). + */ + linkwatch_sync_dev(netdev); + return sysfs_emit(buf, fmt_dec, !!netif_carrier_ok(netdev)); + } return -EINVAL; } static DEVICE_ATTR_RW(carrier); static ssize_t speed_show(struct device *dev, struct device_attribute *attr, char *buf) { struct net_device *netdev = to_net_dev(dev); diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c index dc82b95bb245..2296b3052732 100644 --- a/net/core/rtnetlink.c +++ b/net/core/rtnetlink.c @@ -3863,18 +3863,26 @@ static int rtnl_getlink(struct sk_buff *skb, struct nlmsghdr *nlh, err = -ENODEV; if (dev == NULL) goto out; err = -ENOBUFS; nskb = nlmsg_new(if_nlmsg_size(dev, ext_filter_mask), GFP_KERNEL); if (nskb == NULL) goto out; + /* Synchronize the carrier state so we don't report a state + * that we're not actually going to honour immediately; if + * the driver just did a carrier off->on transition, we can + * only TX if link watch work has run, but without this we'd + * already report carrier on, even if it doesn't work yet. + */ + linkwatch_sync_dev(dev); + err = rtnl_fill_ifinfo(nskb, dev, net, RTM_NEWLINK, NETLINK_CB(skb).portid, nlh->nlmsg_seq, 0, 0, ext_filter_mask, 0, NULL, 0, netnsid, GFP_KERNEL); if (err < 0) { /* -EMSGSIZE implies BUG in if_nlmsg_size */ WARN_ON(err == -EMSGSIZE); kfree_skb(nskb); } else diff --git a/net/ethtool/ioctl.c b/net/ethtool/ioctl.c index 6258b4f1bc0d..22be4dd167bb 100644 --- a/net/ethtool/ioctl.c +++ b/net/ethtool/ioctl.c @@ -52,18 +52,21 @@ static struct devlink *netdev_to_devlink_get(struct net_device *dev) /* * Some useful ethtool_ops methods that're device independent. * If we find that all drivers want to do the same thing here, * we can turn these into dev_() function calls. */ u32 ethtool_op_get_link(struct net_device *dev) { + /* Synchronize carrier state with link watch, see also rtnl_getlink() */ + linkwatch_sync_dev(dev); + return netif_carrier_ok(dev) ? 1 : 0; } EXPORT_SYMBOL(ethtool_op_get_link); int ethtool_op_get_ts_info(struct net_device *dev, struct ethtool_ts_info *info) { info->so_timestamping = SOF_TIMESTAMPING_TX_SOFTWARE | SOF_TIMESTAMPING_RX_SOFTWARE | -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] drm/edid: fix OOB read in drm_parse_tiled_block()
by Hongtao Zhang 10 Aug '26

10 Aug '26

From: Xiang Mei <xmei5(a)asu.edu> stable inclusion from stable-v5.10.261 commit c4ab04ca1bbf87eefa9fec5c80e1880450d2e7c0 category: bugfix bugzilla: 16848 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit faaa1e1155833e7d4ce7e3cfaf64c0d636b190db ] drm_parse_tiled_block() casts the DisplayID block to a struct displayid_tiled_block and reads the full fixed layout up to tile->topology_id[7] without checking block->num_bytes. The DisplayID iterator only validates the declared payload length, so a crafted EDID can advertise a tiled-display block (tag DATA_BLOCK_TILED_DISPLAY, or DATA_BLOCK_2_TILED_DISPLAY_TOPOLOGY for v2.0) with a small num_bytes at the end of a DisplayID extension. The read then runs past the end of the exact-sized kmemdup()'d EDID allocation, a heap out-of-bounds read. Reject blocks shorter than the spec's 22-byte tiled payload before reading the fixed struct, as drm_parse_vesa_mso_data() already does. BUG: KASAN: slab-out-of-bounds in drm_edid_connector_update Read of size 2 at addr ffff888010077700 by task exploit/147 dump_stack_lvl (lib/dump_stack.c:94 ...) print_report (mm/kasan/report.c:378 ...) kasan_report (mm/kasan/report.c:595) drm_edid_connector_update (drivers/gpu/drm/drm_edid.c:7581) bochs_connector_helper_get_modes (drivers/gpu/drm/tiny/bochs.c:574) drm_helper_probe_single_connector_modes (drivers/gpu/drm/drm_probe_helper.c:426) status_store (drivers/gpu/drm/drm_sysfs.c:219) ... vfs_write (fs/read_write.c:595 fs/read_write.c:688) ksys_write (fs/read_write.c:740) Fixes: 40d9b043a89e ("drm/connector: store tile information from displayid (v3)") Reported-by: Weiming Shi <bestswngs(a)gmail.com> Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Xiang Mei <xmei5(a)asu.edu> Reviewed-by: Jani Nikula <jani.nikula(a)intel.com> Link: https://patch.msgid.link/20260615184737.899892-1-xmei5@asu.edu Signed-off-by: Jani Nikula <jani.nikula(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Hongtao <zhanghongtao35(a)huawei.com> --- drivers/gpu/drm/drm_edid.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c index f5926bf5dabd9..ad7e524d03037 100644 --- a/drivers/gpu/drm/drm_edid.c +++ b/drivers/gpu/drm/drm_edid.c @@ -5198,6 +5198,13 @@ static int drm_parse_tiled_block(struct drm_connector *connector, u8 num_v_tile, num_h_tile; struct drm_tile_group *tg; + /* tiled block payload per spec: cap 1 + topo 3 + size 4 + bezel 5 + id 9 = 22 */ + if (block->num_bytes < 22) { + DRM_DEBUG_KMS("[CONNECTOR:%d:%s] Unexpected tiled block size %u\n", + connector->base.id, connector->name, block->num_bytes); + return 0; + } + w = tile->tile_size[0] | tile->tile_size[1] << 8; h = tile->tile_size[2] | tile->tile_size[3] << 8; -- 2.43.0

2 1

[PATCH OLK-5.10 0/2] Fix 2 CVE
by Xia Fukun 10 Aug '26

10 Aug '26

CVE-2026-63860 CVE-2026-64406 Florian Westphal (1): RDMA/core: Prefer NLA_NUL_STRING Yousef Alhouseen (1): Bluetooth: fix UAF in bt_accept_dequeue() drivers/infiniband/core/iwpm_msg.c | 6 +++--- net/bluetooth/af_bluetooth.c | 17 +++-------------- net/bluetooth/l2cap_sock.c | 4 ++-- 3 files changed, 8 insertions(+), 19 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] sched: Add the qos schduler's cgroup v2 interface
by Chen Jinghuang 10 Aug '26

10 Aug '26

hulk inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/9738 -------------------------------- Add the qos schduler's cgroup v2 interface. Cgroup v2 use the qos scheduler, as follows: offline group: echo -1 > /sys/fs/cgroup/xxxx/offline/cpu.qos_level online group: /sys/fs/cgroup/xxxx/online/cpu.qos_level Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- kernel/sched/core.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 98bd31a685a9..f1cc87792b1e 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -10661,6 +10661,14 @@ static struct cftype cpu_files[] = { .write = cpu_uclamp_max_write, }, #endif +#ifdef CONFIG_QOS_SCHED + { + .name = "qos_level", + .flags = CFTYPE_NOT_ON_ROOT, + .read_s64 = cpu_qos_read, + .write_s64 = cpu_qos_write, + }, +#endif #ifdef CONFIG_SCHED_SOFT_DOMAIN { .name = "soft_domain", -- 2.34.1

2 1