- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] crypto: qat - protect service table iterations with service_lock
by Cai Xinchen 05 Aug '26

05 Aug '26

From: Ahsan Atta <ahsan.atta(a)intel.com> mainline inclusion from mainline-v7.2-rc1 commit 5c6f845e77ec35f9b7b047cc8f9789bf397cdd3e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16601 CVE: CVE-2026-64305 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The service_table list is protected by service_lock when entries are added or removed (in adf_service_add() and adf_service_remove()), but several functions iterate over the list without holding this lock. A concurrent adf_service_register() or adf_service_unregister() call could modify the list during traversal, leading to list corruption or a use-after-free. Fix this by holding service_lock across all list_for_each_entry() iterations of service_table in adf_dev_init(), adf_dev_start(), adf_dev_stop(), adf_dev_shutdown(), adf_dev_restarting_notify(), adf_dev_restarted_notify(), and adf_error_notifier(). The lock ordering is safe: callers of the static helpers (adf_dev_up() and adf_dev_down()) acquire state_lock before service_lock, and no event_hld callback or service_lock holder ever acquires state_lock in the reverse order. Cc: stable(a)vger.kernel.org Fixes: d8cba25d2c68 ("crypto: qat - Intel(R) QAT driver framework") Signed-off-by: Ahsan Atta <ahsan.atta(a)intel.com> Co-developed-by: Maksim Lukoshkov <maksim.lukoshkov(a)intel.com> Signed-off-by: Maksim Lukoshkov <maksim.lukoshkov(a)intel.com> Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Conflicts: drivers/crypto/qat/qat_common/adf_init.c [There is no adf_error_notifier in 5.10 and file is drivers/crypto/qat/qat_common/adf_init.c instead of drivers/crypto/intel/qat/qat_common/adf_init.c] Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- drivers/crypto/qat/qat_common/adf_init.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/drivers/crypto/qat/qat_common/adf_init.c b/drivers/crypto/qat/qat_common/adf_init.c index 5c78433d19d4..59dfde7f761b 100644 --- a/drivers/crypto/qat/qat_common/adf_init.c +++ b/drivers/crypto/qat/qat_common/adf_init.c @@ -116,16 +116,19 @@ int adf_dev_init(struct adf_accel_dev *accel_dev) * This is to facilitate any ordering dependencies between services * prior to starting any of the accelerators. */ + mutex_lock(&service_lock); list_for_each(list_itr, &service_table) { service = list_entry(list_itr, struct service_hndl, list); if (service->event_hld(accel_dev, ADF_EVENT_INIT)) { dev_err(&GET_DEV(accel_dev), "Failed to initialise service %s\n", service->name); + mutex_unlock(&service_lock); return -EFAULT; } set_bit(accel_dev->accel_id, service->init_status); } + mutex_unlock(&service_lock); hw_data->enable_error_correction(accel_dev); ret = hw_data->enable_vf2pf_comms(accel_dev); @@ -163,16 +166,19 @@ int adf_dev_start(struct adf_accel_dev *accel_dev) return -EFAULT; } + mutex_lock(&service_lock); list_for_each(list_itr, &service_table) { service = list_entry(list_itr, struct service_hndl, list); if (service->event_hld(accel_dev, ADF_EVENT_START)) { dev_err(&GET_DEV(accel_dev), "Failed to start service %s\n", service->name); + mutex_unlock(&service_lock); return -EFAULT; } set_bit(accel_dev->accel_id, service->start_status); } + mutex_unlock(&service_lock); clear_bit(ADF_STATUS_STARTING, &accel_dev->status); set_bit(ADF_STATUS_STARTED, &accel_dev->status); @@ -218,6 +224,7 @@ void adf_dev_stop(struct adf_accel_dev *accel_dev) qat_asym_algs_unregister(); } + mutex_lock(&service_lock); list_for_each(list_itr, &service_table) { service = list_entry(list_itr, struct service_hndl, list); if (!test_bit(accel_dev->accel_id, service->start_status)) @@ -230,6 +237,7 @@ void adf_dev_stop(struct adf_accel_dev *accel_dev) clear_bit(accel_dev->accel_id, service->start_status); } } + mutex_unlock(&service_lock); if (wait) msleep(100); @@ -276,6 +284,7 @@ void adf_dev_shutdown(struct adf_accel_dev *accel_dev) &accel_dev->status); } + mutex_lock(&service_lock); list_for_each(list_itr, &service_table) { service = list_entry(list_itr, struct service_hndl, list); if (!test_bit(accel_dev->accel_id, service->init_status)) @@ -287,6 +296,7 @@ void adf_dev_shutdown(struct adf_accel_dev *accel_dev) else clear_bit(accel_dev->accel_id, service->init_status); } + mutex_unlock(&service_lock); hw_data->disable_iov(accel_dev); @@ -315,6 +325,7 @@ int adf_dev_restarting_notify(struct adf_accel_dev *accel_dev) struct service_hndl *service; struct list_head *list_itr; + mutex_lock(&service_lock); list_for_each(list_itr, &service_table) { service = list_entry(list_itr, struct service_hndl, list); if (service->event_hld(accel_dev, ADF_EVENT_RESTARTING)) @@ -322,6 +333,7 @@ int adf_dev_restarting_notify(struct adf_accel_dev *accel_dev) "Failed to restart service %s.\n", service->name); } + mutex_unlock(&service_lock); return 0; } @@ -330,6 +342,7 @@ int adf_dev_restarted_notify(struct adf_accel_dev *accel_dev) struct service_hndl *service; struct list_head *list_itr; + mutex_lock(&service_lock); list_for_each(list_itr, &service_table) { service = list_entry(list_itr, struct service_hndl, list); if (service->event_hld(accel_dev, ADF_EVENT_RESTARTED)) @@ -337,5 +350,6 @@ int adf_dev_restarted_notify(struct adf_accel_dev *accel_dev) "Failed to restart service %s.\n", service->name); } + mutex_unlock(&service_lock); return 0; } -- 2.18.0.huawei.25

2 1

[PATCH OLK-6.6 0/2] fix amdgpu_hmm_range_get_pages
by Jiacheng Yu 05 Aug '26

05 Aug '26

fix amdgpu_hmm_range_get_pages Christian König (1): drm/amdgpu: fix amdgpu_hmm_range_get_pages Honglei Huang (1): drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c | 30 +++++++------------------ 1 file changed, 8 insertions(+), 22 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] apparmor: advertise the tcp fast open fix is applied
by Lu Jialin 05 Aug '26

05 Aug '26

From: John Johansen <john.johansen(a)canonical.com> stable inclusion from stable-v6.6.145 commit 42726c616d958ca379cb47f97c63e76c2dc5b739 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16157 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2f6701a5ce6257ae7a64ddc6d89d0a08d2a034f8 ] The fix for tcp-fast-open ensures that the connect permission is being mediated correctly but it didn't add an artifact to the feature set to advertise the fix is available. Add an artifact so that the test suite can identify if the fix has not been properly applied or a new unexpected regression has occurred. Fixes: 4d587cd8a7215 ("apparmor: mediate the implicit connect of TCP fast open sendmsg") Signed-off-by: John Johansen <john.johansen(a)canonical.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- security/apparmor/net.c | 1 + 1 file changed, 1 insertion(+) diff --git a/security/apparmor/net.c b/security/apparmor/net.c index 814e8319d43e..d1ded97612c6 100644 --- a/security/apparmor/net.c +++ b/security/apparmor/net.c @@ -21,6 +21,7 @@ struct aa_sfs_entry aa_sfs_entry_network[] = { AA_SFS_FILE_STRING("af_mask", AA_SFS_AF_MASK), + AA_SFS_FILE_BOOLEAN("tcp-fast-open", 1), { } }; -- 2.34.1

2 1

[PATCH OLK-6.6] nbd: skip the capacity-change printk on device bringup and release
by Yang Erkun 05 Aug '26

05 Aug '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9724 ---------------------------------------- Before commit 2ebcabf3dba5 ("nbd: use set_capacity_and_notify"), nbd setup called nbd_set_size() to update the size and did not print "detected capacity change". On the release path nbd_config_put() calls invalidate_disk(), which calls set_capacity(), and that path did not print either. For a genuine size change like size1 -> size2 this printk should remain, but for nbd setup or release it should not be printed, especially since it adds latency to the setup path. Skip set_capacity_and_notify() and use the silent set_capacity() when either side of the change is 0, i.e. on bringup (0 -> size) . Runtime resizes keep set_capacity_and_notify() for the message and uevent, and the explicit kobject_uevent() preserves a uevent on every call as blktests expects. Fixes: 2ebcabf3dba5 ("nbd: use set_capacity_and_notify") Signed-off-by: Yang Erkun <yangerkun(a)huawei.com> --- drivers/block/nbd.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index f9b51b09730a..be2191f7c4c1 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -355,7 +355,11 @@ static int nbd_set_size(struct nbd_device *nbd, loff_t bytesize, if (max_part) set_bit(GD_NEED_PART_SCAN, &nbd->disk->state); - if (!set_capacity_and_notify(nbd->disk, bytesize >> 9)) + /* Avoid the capacity-change printk on probe (0 -> size) */ + if (!get_capacity(nbd->disk)) { + set_capacity(nbd->disk, bytesize >> 9); + kobject_uevent(&nbd_to_dev(nbd)->kobj, KOBJ_CHANGE); + } else if (!set_capacity_and_notify(nbd->disk, bytesize >> 9)) kobject_uevent(&nbd_to_dev(nbd)->kobj, KOBJ_CHANGE); return 0; } -- 2.52.0

2 3

[PATCH OLK-6.6 0/2] *** CVE-2026-64513 ***
by Zhang Kunbo 05 Aug '26

05 Aug '26

*** BLURB HERE *** Carlos López (1): KVM: x86: Unconditionally recompute CR8 intercept on PPR update Sean Christopherson (1): KVM: x86: Move update_cr8_intercept() to lapic.c arch/x86/kvm/lapic.c | 28 ++++++++++++++++++++++++++++ arch/x86/kvm/lapic.h | 1 + arch/x86/kvm/x86.c | 35 ++--------------------------------- 3 files changed, 31 insertions(+), 33 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] nfsd: release layout stid on setlease failure
by Ran Hongyun 05 Aug '26

05 Aug '26

mainline inclusion from mainline-v7.2-rc1 commit 30d55c8aabb261bc3f427d6b9aae7ef6206063f9 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16119 CVE: CVE-2026-53399 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm… -------------------------------- nfs4_alloc_stid() publishes the new stid into cl->cl_stateids via idr_alloc_cyclic() under cl_lock before returning to nfsd4_alloc_layout_stateid(). When nfsd4_layout_setlease() then fails, the error path frees the layout stateid directly with kmem_cache_free() without ever calling idr_remove(), leaving the IDR slot pointing at freed slab memory. Any subsequent IDR walker (states_show, client teardown) dereferences the dangling pointer. The correct teardown for an IDR-published stid is nfs4_put_stid(), which removes the IDR slot under cl_lock, dispatches sc_free (nfsd4_free_layout_stateid) to release ls->ls_file via nfsd4_close_layout(), and drops the nfs4_file reference in its tail. A second issue blocks that switch: nfsd4_free_layout_stateid() unconditionally inspects ls->ls_fence_work via delayed_work_pending() under ls_lock, but INIT_DELAYED_WORK(&ls->ls_fence_work, ...) currently runs only after the setlease call. On the setlease-failure path the destructor would touch an uninitialized delayed_work. nfsd4_alloc_layout_stateid() nfs4_alloc_stid() /* idr_alloc_cyclic under cl_lock */ nfsd4_layout_setlease() /* fails */ nfs4_put_stid() nfsd4_free_layout_stateid() delayed_work_pending(&ls->ls_fence_work) /* needs INIT */ nfsd4_close_layout() /* nfsd_file_put(ls->ls_file) */ put_nfs4_file() Fix by hoisting the ls_fenced / ls_fence_delay / INIT_DELAYED_WORK initialization above the nfsd4_layout_setlease() call, and replace the manual nfsd_file_put + put_nfs4_file + kmem_cache_free cleanup with a single nfs4_put_stid(stp). Fixes: c5c707f96fc9 ("nfsd: implement pNFS layout recalls") Cc: stable(a)vger.kernel.org Assisted-by: kres (claude-opus-4-7) Signed-off-by: Chris Mason <clm(a)meta.com> Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Conflicts: fs/nfsd/nfs4layouts.c [f52792f484ba ("NFSD: Enforce timeout on layout recall and integrate lease manager fencing" not merged.)] Signed-off-by: Ran Hongyun <ranhongyun1(a)huawei.com> --- fs/nfsd/nfs4layouts.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/fs/nfsd/nfs4layouts.c b/fs/nfsd/nfs4layouts.c index 44517fb5c0de..ff0fa9fff09a 100644 --- a/fs/nfsd/nfs4layouts.c +++ b/fs/nfsd/nfs4layouts.c @@ -242,9 +242,7 @@ nfsd4_alloc_layout_stateid(struct nfsd4_compound_state *cstate, BUG_ON(!ls->ls_file); if (nfsd4_layout_setlease(ls)) { - fput(ls->ls_file); - put_nfs4_file(fp); - kmem_cache_free(nfs4_layout_stateid_cache, ls); + nfs4_put_stid(stp); return NULL; } -- 2.52.0

2 1

[PATCH openEuler-1.0-LTS] fuse: re-lock request before returning from fuse_ref_folio()
by Ran Hongyun 05 Aug '26

05 Aug '26

mainline inclusion from mainline-v7.2-rc1 commit b5befa80fdbe287a98480effed9564712924add5 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16564 CVE: CVE-2026-64266 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm… -------------------------------- fuse_ref_folio() unlocks the request but does not re-lock it before returning. fuse_chan_abort() can end the request and the async end callback (eg fuse_writepage_free()) can free the args while the subsequent copy chain logic after fuse_ref_folio() accesses them, leading to use-after-free issues. Fix this by locking the request in fuse_ref_folio() before returning. Fixes: c3021629a0d8 ("fuse: support splice() reading from fuse device") Cc: stable(a)vger.kernel.org Signed-off-by: Joanne Koong <joannelkoong(a)gmail.com> Signed-off-by: Miklos Szeredi <mszeredi(a)redhat.com> Conflicts: fs/fuse/dev.c [394244b24fdd ("fuse: support copying large folios") not merged.] Signed-off-by: Ran Hongyun <ranhongyun1(a)huawei.com> --- fs/fuse/dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c index 6d6bf2e7bb9b..9e79f6f989cc 100644 --- a/fs/fuse/dev.c +++ b/fs/fuse/dev.c @@ -972,7 +972,7 @@ static int fuse_ref_page(struct fuse_copy_state *cs, struct page *page, cs->nr_segs++; cs->len = 0; - return 0; + return lock_request(cs->req); } /* -- 2.52.0

2 1

[PATCH OLK-5.10] nfsd: release layout stid on setlease failure
by Ran Hongyun 05 Aug '26

05 Aug '26

mainline inclusion from mainline-v7.2-rc1 commit 30d55c8aabb261bc3f427d6b9aae7ef6206063f9 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16119 CVE: CVE-2026-53399 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm… -------------------------------- nfs4_alloc_stid() publishes the new stid into cl->cl_stateids via idr_alloc_cyclic() under cl_lock before returning to nfsd4_alloc_layout_stateid(). When nfsd4_layout_setlease() then fails, the error path frees the layout stateid directly with kmem_cache_free() without ever calling idr_remove(), leaving the IDR slot pointing at freed slab memory. Any subsequent IDR walker (states_show, client teardown) dereferences the dangling pointer. The correct teardown for an IDR-published stid is nfs4_put_stid(), which removes the IDR slot under cl_lock, dispatches sc_free (nfsd4_free_layout_stateid) to release ls->ls_file via nfsd4_close_layout(), and drops the nfs4_file reference in its tail. A second issue blocks that switch: nfsd4_free_layout_stateid() unconditionally inspects ls->ls_fence_work via delayed_work_pending() under ls_lock, but INIT_DELAYED_WORK(&ls->ls_fence_work, ...) currently runs only after the setlease call. On the setlease-failure path the destructor would touch an uninitialized delayed_work. nfsd4_alloc_layout_stateid() nfs4_alloc_stid() /* idr_alloc_cyclic under cl_lock */ nfsd4_layout_setlease() /* fails */ nfs4_put_stid() nfsd4_free_layout_stateid() delayed_work_pending(&ls->ls_fence_work) /* needs INIT */ nfsd4_close_layout() /* nfsd_file_put(ls->ls_file) */ put_nfs4_file() Fix by hoisting the ls_fenced / ls_fence_delay / INIT_DELAYED_WORK initialization above the nfsd4_layout_setlease() call, and replace the manual nfsd_file_put + put_nfs4_file + kmem_cache_free cleanup with a single nfs4_put_stid(stp). Fixes: c5c707f96fc9 ("nfsd: implement pNFS layout recalls") Cc: stable(a)vger.kernel.org Assisted-by: kres (claude-opus-4-7) Signed-off-by: Chris Mason <clm(a)meta.com> Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Conflicts: fs/nfsd/nfs4layouts.c [f52792f484ba ("NFSD: Enforce timeout on layout recall and integrate lease manager fencing" not merged.)] Signed-off-by: Ran Hongyun <ranhongyun1(a)huawei.com> --- fs/nfsd/nfs4layouts.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/fs/nfsd/nfs4layouts.c b/fs/nfsd/nfs4layouts.c index 2673019d30ec..ce6fb5167534 100644 --- a/fs/nfsd/nfs4layouts.c +++ b/fs/nfsd/nfs4layouts.c @@ -242,9 +242,7 @@ nfsd4_alloc_layout_stateid(struct nfsd4_compound_state *cstate, BUG_ON(!ls->ls_file); if (nfsd4_layout_setlease(ls)) { - nfsd_file_put(ls->ls_file); - put_nfs4_file(fp); - kmem_cache_free(nfs4_layout_stateid_cache, ls); + nfs4_put_stid(stp); return NULL; } -- 2.52.0

2 1

[PATCH OLK-5.10 0/5] CVE-2026-63830: preserve sg.copy across SG transforms
by superdcc97＠163.com 05 Aug '26

05 Aug '26

From: Dong Chenchen <dongchenchen2(a)huawei.com> bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16159 CVE: CVE-2026-63830 This patchset fixes CVE-2026-63830 for OLK-5.10. The CVE fixes the sk_msg sg.copy bitmap handling across SG transforms. Eric Dumazet (1): skmsg: convert struct sk_msg_sg::copy to a bitmap Yiming Qian (1): net: skmsg: preserve sg.copy across SG transforms Yuqi Xu (1): bpf: sockmap: fix tail fragment offset in bpf_msg_push_data Zijian Zhang (2): bpf, sockmap: Several fixes to bpf_msg_push_data bpf, sockmap: Several fixes to bpf_msg_pop_data include/linux/skmsg.h | 22 +++++---- net/core/filter.c | 101 ++++++++++++++++++++++++++++++------------ net/core/skmsg.c | 2 + net/tls/tls_sw.c | 4 ++ 4 files changed, 92 insertions(+), 37 deletions(-) -- 2.43.0

2 6

openEuler Kernel SIG双周例会
by openEuler conference 05 Aug '26

05 Aug '26

您好！ Kernel 邀请您参加 2026-08-07 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议发起人： LiaoTao_Wave 会议内容： 1. 进展update 2. 议题征集中（新增议题请直接填报至本会议纪要看板）会议链接：https://meeting.huaweicloud.com:36443/#/j/987297110 会议纪要&签到链接：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2026-08-07 14:00 The subject of the conference is openEuler Kernel SIG双周例会 The sponsor of the conference is LiaoTao_Wave Summary: 1. 进展update 2. 议题征集中（新增议题请直接填报至本会议纪要看板） You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/987297110 Add topics at https://etherpad.openeuler.org/p/Kernel-meetings More information: https://www.openeuler.org/en/

1 0