- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] bcache: Fix __bch_btree_node_alloc to make the failure behavior consistent
by Xia Fukun 20 Oct '25

20 Oct '25

From: Zheng Wang <zyytlz.wz(a)163.com> stable inclusion from stable-v4.19.325 commit 587b4e8bb5dac682f09280ab35db4632b29d5ac4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID0VIM CVE: CVE-2023-53681 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 80fca8a10b604afad6c14213fdfd816c4eda3ee4 ] In some specific situations, the return value of __bch_btree_node_alloc may be NULL. This may lead to a potential NULL pointer dereference in caller function like a calling chain : btree_split->bch_btree_node_alloc->__bch_btree_node_alloc. Fix it by initializing the return value in __bch_btree_node_alloc. Fixes: cafe56359144 ("bcache: A block layer cache") Cc: stable(a)vger.kernel.org Signed-off-by: Zheng Wang <zyytlz.wz(a)163.com> Signed-off-by: Coly Li <colyli(a)suse.de> Link: https://lore.kernel.org/r/20230615121223.22502-6-colyli@suse.de Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/md/bcache/btree.c [Context differences.] Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- drivers/md/bcache/btree.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c index 24e70ee342f0..2b2621a6092c 100644 --- a/drivers/md/bcache/btree.c +++ b/drivers/md/bcache/btree.c @@ -1062,10 +1062,12 @@ struct btree *__bch_btree_node_alloc(struct cache_set *c, struct btree_op *op, struct btree *parent) { BKEY_PADDED(key) k; - struct btree *b = ERR_PTR(-EAGAIN); + struct btree *b; mutex_lock(&c->bucket_lock); retry: + /* return ERR_PTR(-EAGAIN) when it fails */ + b = ERR_PTR(-EAGAIN); if (__bch_bucket_alloc_set(c, RESERVE_BTREE, &k.key, 1, wait)) goto err; -- 2.34.1

2 1

[PATCH OLK-6.6] i40e: fix idx validation in config queues msg
by Fanhua Li 20 Oct '25

20 Oct '25

From: Lukasz Czapnik <lukasz.czapnik(a)intel.com> stable inclusion from stable-v6.6.109 commit 2cc26dac0518d2fa9b67ec813ee60e183480f98a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID2290 CVE: CVE-2025-39971 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f1ad24c5abe1eaef69158bac1405a74b3c365115 upstream. Ensure idx is within range of active/initialized TCs when iterating over vf->ch[idx] in i40e_vc_config_queues_msg(). Fixes: c27eac48160d ("i40e: Enable ADq and create queue channel/s on VF") Cc: stable(a)vger.kernel.org Signed-off-by: Lukasz Czapnik <lukasz.czapnik(a)intel.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov(a)intel.com> Signed-off-by: Przemek Kitszel <przemyslaw.kitszel(a)intel.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Tested-by: Kamakshi Nellore <nellorex.kamakshi(a)intel.com> (A Contingent Worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Fanhua Li <lifanhua5(a)huawei.com> --- drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c index d5509bc16d0d5..9a9195a7e5d46 100644 --- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c @@ -2390,7 +2390,7 @@ static int i40e_vc_config_queues_msg(struct i40e_vf *vf, u8 *msg) } if (vf->adq_enabled) { - if (idx >= ARRAY_SIZE(vf->ch)) { + if (idx >= vf->num_tc) { aq_ret = -ENODEV; goto error_param; } @@ -2411,7 +2411,7 @@ static int i40e_vc_config_queues_msg(struct i40e_vf *vf, u8 *msg) * to its appropriate VSIs based on TC mapping */ if (vf->adq_enabled) { - if (idx >= ARRAY_SIZE(vf->ch)) { + if (idx >= vf->num_tc) { aq_ret = -ENODEV; goto error_param; } -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path
by Xia Fukun 20 Oct '25

20 Oct '25

From: Mike Snitzer <snitzer(a)kernel.org> stable inclusion from stable-v4.19.283 commit ca8b634fdf07dee3f6dfde57079c4511480b525e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID0UC2 CVE: CVE-2023-53604 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 6b79a428c02769f2a11f8ae76bf866226d134887 upstream. Otherwise the journal_io_cache will leak if dm_register_target() fails. Cc: stable(a)vger.kernel.org Signed-off-by: Mike Snitzer <snitzer(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- drivers/md/dm-integrity.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c index db09e8748ec8..3f06aa909c01 100644 --- a/drivers/md/dm-integrity.c +++ b/drivers/md/dm-integrity.c @@ -3699,11 +3699,13 @@ int __init dm_integrity_init(void) } r = dm_register_target(&integrity_target); - - if (r < 0) + if (r < 0) { DMERR("register failed %d", r); + kmem_cache_destroy(journal_io_cache); + return r; + } - return r; + return 0; } void dm_integrity_exit(void) -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] Fix CVE-2025-39989
by Xinyu Zheng 20 Oct '25

20 Oct '25

*** BLURB HERE *** Shuai Xue (1): x86/mce: use is_copy_from_user() to determine copy-from-user context Tong Tiangen (1): x86/extable: Remove unused fixup type EX_TYPE_COPY arch/x86/include/asm/asm.h | 3 --- arch/x86/include/asm/extable_fixup_types.h | 2 +- arch/x86/kernel/cpu/mce/severity.c | 12 +++++------- arch/x86/mm/extable.c | 9 --------- 4 files changed, 6 insertions(+), 20 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10] net/hinic3: Modify driver version
by LinKun 20 Oct '25

20 Oct '25

From: zhuyikai <zhuyikai1(a)h-partners.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICGDO6?from=project-issue CVE: NA -------------------------------- Modify driver version. Fixes: 79871cd2cd72 ("net/hinic3: Synchronize new NIC features and bug fixes") Signed-off-by: zhuyikai <zhuyikai1(a)h-partners.com> --- drivers/net/ethernet/huawei/hinic3/hinic3_crm.h | 2 +- drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_crm.h b/drivers/net/ethernet/huawei/hinic3/hinic3_crm.h index 7979244..5a11331 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_crm.h +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_crm.h @@ -8,7 +8,7 @@ #include "mpu_cmd_base_defs.h" -#define HINIC3_DRV_VERSION "17.7.8.1" +#define HINIC3_DRV_VERSION "17.7.8.101" #define HINIC3_DRV_DESC "Intelligent Network Interface Card Driver" #define HIUDK_DRV_DESC "Intelligent Network Unified Driver" diff --git a/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h b/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h index 137098b..3d2a962 100644 --- a/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h +++ b/drivers/net/ethernet/huawei/hinic3/hinic3_nic_dev.h @@ -18,7 +18,7 @@ #include "vram_common.h" #define HINIC3_NIC_DRV_NAME "hinic3" -#define HINIC3_NIC_DRV_VERSION "17.7.8.1" +#define HINIC3_NIC_DRV_VERSION "17.7.8.101" #define HINIC3_FUNC_IS_VF(hwdev) (hinic3_func_type(hwdev) == TYPE_VF) -- 2.28.0.windows.1

2 3

[PATCH OLK-5.10] net/hinic3: Modify driver version
by LinKun 20 Oct '25

20 Oct '25

From: zhuyikai <zhuyikai1(a)h-partners.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICGDO6?from=project-issue CVE: NA -------------------------------- Modify driver version. Fixes: 79871cd2cd72 ("net/hinic3: Synchronize new NIC features and bug fixes") Signed-off-by: zhuyikai <zhuyikai1(a)h-partners.com> --- hinic3/hinic3_crm.h | 2 +- hinic3/hinic3_nic_dev.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/hinic3/hinic3_crm.h b/hinic3/hinic3_crm.h index 7979244..5a11331 100644 --- a/hinic3/hinic3_crm.h +++ b/hinic3/hinic3_crm.h @@ -8,7 +8,7 @@ #include "mpu_cmd_base_defs.h" -#define HINIC3_DRV_VERSION "17.7.8.1" +#define HINIC3_DRV_VERSION "17.7.8.101" #define HINIC3_DRV_DESC "Intelligent Network Interface Card Driver" #define HIUDK_DRV_DESC "Intelligent Network Unified Driver" diff --git a/hinic3/hinic3_nic_dev.h b/hinic3/hinic3_nic_dev.h index 137098b..3d2a962 100644 --- a/hinic3/hinic3_nic_dev.h +++ b/hinic3/hinic3_nic_dev.h @@ -18,7 +18,7 @@ #include "vram_common.h" #define HINIC3_NIC_DRV_NAME "hinic3" -#define HINIC3_NIC_DRV_VERSION "17.7.8.1" +#define HINIC3_NIC_DRV_VERSION "17.7.8.101" #define HINIC3_FUNC_IS_VF(hwdev) (hinic3_func_type(hwdev) == TYPE_VF) -- 2.28.0.windows.1

2 3

[PATCH openEuler-1.0-LTS 0/2] CVE-2023-53265
by Wang Zhaolong 20 Oct '25

20 Oct '25

George Kennedy (1): ubi: ensure that VID header offset + VID header size <= alloc, size Zhihao Cheng (1): ubi: Fix failure attaching when vid_hdr offset equals to (sub)page size drivers/mtd/ubi/build.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) -- 2.34.3

2 3

[PATCH OLK-6.6] sched/core: Add sched_change_qos_group() in sched_cgroup_fork()
by Wang Tao 20 Oct '25

20 Oct '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID23FN ------------------ We use sched_change_qos_group() to change task qos group for the new task in cgroup_post_fork() if we enable the qos sched feature. Since commit 39c4261191bf ("sched/fair: Remove redundant cpu_cgrp_subsys->fork()") has remove cpu_cgrp_subsys->fork(), if we enable qos sched feature, the function "sched_change_qos_group" is lost. cgroup_post_fork() ss->fork() := cpu_cgroup_fork() --> removed sched_change_group(..., TASK_SET_GROUP) #ifdef CONFIG_QOS_SCHED sched_change_qos_group(); --> lost #endif So this patch add the function "sched_change_qos_group" in sched_cgroup_fork(). Fixes: 39c4261191bf ("sched/fair: Remove redundant cpu_cgrp_subsys->fork()") Signed-off-by: Wang Tao <wangtao554(a)huawei.com> --- kernel/sched/core.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 47877f3b52f6..2740e9b918f5 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -120,6 +120,10 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(sched_update_nr_running_tp); DEFINE_PER_CPU_SHARED_ALIGNED(struct rq, runqueues); +#ifdef CONFIG_QOS_SCHED +static void sched_change_qos_group(struct task_struct *tsk, struct task_group *tg); +#endif + #ifdef CONFIG_SCHED_DEBUG /* * Debugging: various feature bits @@ -4863,6 +4867,7 @@ int sched_fork(unsigned long clone_flags, struct task_struct *p) void sched_cgroup_fork(struct task_struct *p, struct kernel_clone_args *kargs) { unsigned long flags; + struct task_group *tg_qos __maybe_unused = NULL; /* * Because we're not yet on the pid-hash, p->pi_lock isn't strictly @@ -4876,6 +4881,9 @@ void sched_cgroup_fork(struct task_struct *p, struct kernel_clone_args *kargs) struct task_group, css); tg = autogroup_task_group(p, tg); p->sched_task_group = tg; +#ifdef CONFIG_QOS_SCHED + tg_qos = tg; +#endif } #endif rseq_migrate(p); @@ -4884,6 +4892,10 @@ void sched_cgroup_fork(struct task_struct *p, struct kernel_clone_args *kargs) * so use __set_task_cpu(). */ __set_task_cpu(p, smp_processor_id()); +#ifdef CONFIG_QOS_SCHED + sched_change_qos_group(p, tg_qos); +#endif + if (p->sched_class->task_fork) p->sched_class->task_fork(p); raw_spin_unlock_irqrestore(&p->pi_lock, flags); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/2] CVE-2023-53271
by Wang Zhaolong 20 Oct '25

20 Oct '25

Li Zetao (2): ubi: Fix use-after-free when volume resizing failed ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume() drivers/mtd/ubi/vmt.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) -- 2.34.3

2 3

[PATCH openEuler-1.0-LTS] cifs: Fix warning and UAF when destroy the MR list
by Wang Zhaolong 20 Oct '25

20 Oct '25

From: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> stable inclusion from stable-v4.19.276 commit 275a3d2b9408fc4895e342f772cab9a89960546e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICYQRV CVE: CVE-2023-53427 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3e161c2791f8e661eed24a2c624087084d910215 ] If the MR allocate failed, the MR recovery work not initialized and list not cleared. Then will be warning and UAF when release the MR: WARNING: CPU: 4 PID: 824 at kernel/workqueue.c:3066 __flush_work.isra.0+0xf7/0x110 CPU: 4 PID: 824 Comm: mount.cifs Not tainted 6.1.0-rc5+ #82 RIP: 0010:__flush_work.isra.0+0xf7/0x110 Call Trace: <TASK> __cancel_work_timer+0x2ba/0x2e0 smbd_destroy+0x4e1/0x990 _smbd_get_connection+0x1cbd/0x2110 smbd_get_connection+0x21/0x40 cifs_get_tcp_session+0x8ef/0xda0 mount_get_conns+0x60/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 BUG: KASAN: use-after-free in smbd_destroy+0x4fc/0x990 Read of size 8 at addr ffff88810b156a08 by task mount.cifs/824 CPU: 4 PID: 824 Comm: mount.cifs Tainted: G W 6.1.0-rc5+ #82 Call Trace: dump_stack_lvl+0x34/0x44 print_report+0x171/0x472 kasan_report+0xad/0x130 smbd_destroy+0x4fc/0x990 _smbd_get_connection+0x1cbd/0x2110 smbd_get_connection+0x21/0x40 cifs_get_tcp_session+0x8ef/0xda0 mount_get_conns+0x60/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Allocated by task 824: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 __kasan_kmalloc+0x7a/0x90 _smbd_get_connection+0x1b6f/0x2110 smbd_get_connection+0x21/0x40 cifs_get_tcp_session+0x8ef/0xda0 mount_get_conns+0x60/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Freed by task 824: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_save_free_info+0x2a/0x40 ____kasan_slab_free+0x143/0x1b0 __kmem_cache_free+0xc8/0x330 _smbd_get_connection+0x1c6a/0x2110 smbd_get_connection+0x21/0x40 cifs_get_tcp_session+0x8ef/0xda0 mount_get_conns+0x60/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Let's initialize the MR recovery work before MR allocate to prevent the warning, remove the MRs from the list to prevent the UAF. Fixes: c7398583340a ("CIFS: SMBD: Implement RDMA memory registration") Acked-by: Paulo Alcantara (SUSE) <pc(a)cjr.nz> Reviewed-by: Tom Talpey <tom(a)talpey.com> Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Zhaolong <wangzhaolong(a)huaweicloud.com> --- fs/cifs/smbdirect.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/cifs/smbdirect.c b/fs/cifs/smbdirect.c index 784628ec4bc4..71b9be2159ed 100644 --- a/fs/cifs/smbdirect.c +++ b/fs/cifs/smbdirect.c @@ -2376,10 +2376,11 @@ static int allocate_mr_list(struct smbd_connection *info) init_waitqueue_head(&info->wait_mr); spin_lock_init(&info->mr_list_lock); atomic_set(&info->mr_ready_count, 0); atomic_set(&info->mr_used_count, 0); init_waitqueue_head(&info->wait_for_mr_cleanup); + INIT_WORK(&info->mr_recovery_work, smbd_mr_recovery_work); /* Allocate more MRs (2x) than hardware responder_resources */ for (i = 0; i < info->responder_resources * 2; i++) { smbdirect_mr = kzalloc(sizeof(*smbdirect_mr), GFP_KERNEL); if (!smbdirect_mr) goto out; @@ -2404,17 +2405,17 @@ static int allocate_mr_list(struct smbd_connection *info) smbdirect_mr->conn = info; list_add_tail(&smbdirect_mr->list, &info->mr_list); atomic_inc(&info->mr_ready_count); } - INIT_WORK(&info->mr_recovery_work, smbd_mr_recovery_work); return 0; out: kfree(smbdirect_mr); list_for_each_entry_safe(smbdirect_mr, tmp, &info->mr_list, list) { + list_del(&smbdirect_mr->list); ib_dereg_mr(smbdirect_mr->mr); kfree(smbdirect_mr->sgl); kfree(smbdirect_mr); } return -ENOMEM; -- 2.34.3

2 1