- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] ksmbd: fix use-after-free in smb_break_all_levII_oplock()
by Li Lingfeng 03 Dec '25

03 Dec '25

From: Namjae Jeon <linkinjeon(a)kernel.org> mainline inclusion from mainline-v6.15-rc3 commit 18b4fac5ef17f77fed9417d22210ceafd6525fc7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC5BMS CVE: CVE-2025-37776 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- There is a room in smb_break_all_levII_oplock that can cause racy issues when unlocking in the middle of the loop. This patch use read lock to protect whole loop. Cc: stable(a)vger.kernel.org Reported-by: Norbert Szetei <norbert(a)doyensec.com> Tested-by: Norbert Szetei <norbert(a)doyensec.com> Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/server/oplock.c fs/ksmbd/oplock.c fs/smb/server/oplock.h fs/ksmbd/oplock.h [Commit 38c8a9a52082 ("smb: move client and server files to common directory fs/smb") move fs/ksmbd/ to fs/smb/server/; commit 36322523dddb ("ksmbd: fix UAF issue from opinfo->conn") splits the judgment of opinfo and opinfo->refcount, add use of brk_op->conn in smb_break_all_levII_oplock(); commit d1c189c6cb8b ("ksmbd: use rwsem instead of rwlock for lease break") replace write_lock/write_unlock by down_write/up_write; commit c8efcc786146 ("ksmbd: add support for durable handles v1/v2") add check of brk_op->conn in smb_break_all_levII_oplock(); commit bb39ed470654 ("ksmbd: fix use-after-free in ksmbd_free_work_struct") add a parameter for oplock_break().] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/ksmbd/oplock.c | 28 +++++++++------------------- fs/ksmbd/oplock.h | 1 - 2 files changed, 9 insertions(+), 20 deletions(-) diff --git a/fs/ksmbd/oplock.c b/fs/ksmbd/oplock.c index 3324bb226c79..a3066d78e1de 100644 --- a/fs/ksmbd/oplock.c +++ b/fs/ksmbd/oplock.c @@ -126,14 +126,6 @@ static void free_opinfo(struct oplock_info *opinfo) kfree(opinfo); } -static inline void opinfo_free_rcu(struct rcu_head *rcu_head) -{ - struct oplock_info *opinfo; - - opinfo = container_of(rcu_head, struct oplock_info, rcu_head); - free_opinfo(opinfo); -} - struct oplock_info *opinfo_get(struct ksmbd_file *fp) { struct oplock_info *opinfo; @@ -154,12 +146,12 @@ static struct oplock_info *opinfo_get_list(struct ksmbd_inode *ci) if (list_empty(&ci->m_op_list)) return NULL; - rcu_read_lock(); - opinfo = list_first_or_null_rcu(&ci->m_op_list, struct oplock_info, + read_lock(&ci->m_lock); + opinfo = list_first_entry(&ci->m_op_list, struct oplock_info, op_entry); if (opinfo && !atomic_inc_not_zero(&opinfo->refcount)) opinfo = NULL; - rcu_read_unlock(); + read_unlock(&ci->m_lock); return opinfo; } @@ -169,7 +161,7 @@ void opinfo_put(struct oplock_info *opinfo) if (!atomic_dec_and_test(&opinfo->refcount)) return; - call_rcu(&opinfo->rcu_head, opinfo_free_rcu); + free_opinfo(opinfo); } static void opinfo_add(struct oplock_info *opinfo) @@ -177,7 +169,7 @@ static void opinfo_add(struct oplock_info *opinfo) struct ksmbd_inode *ci = opinfo->o_fp->f_ci; write_lock(&ci->m_lock); - list_add_rcu(&opinfo->op_entry, &ci->m_op_list); + list_add(&opinfo->op_entry, &ci->m_op_list); write_unlock(&ci->m_lock); } @@ -191,7 +183,7 @@ static void opinfo_del(struct oplock_info *opinfo) write_unlock(&lease_list_lock); } write_lock(&ci->m_lock); - list_del_rcu(&opinfo->op_entry); + list_del(&opinfo->op_entry); write_unlock(&ci->m_lock); } @@ -1259,11 +1251,10 @@ void smb_break_all_levII_oplock(struct ksmbd_work *work, struct ksmbd_file *fp, ci = fp->f_ci; op = opinfo_get(fp); - rcu_read_lock(); - list_for_each_entry_rcu(brk_op, &ci->m_op_list, op_entry) { + read_lock(&ci->m_lock); + list_for_each_entry(brk_op, &ci->m_op_list, op_entry) { if (!atomic_inc_not_zero(&brk_op->refcount)) continue; - rcu_read_unlock(); if (brk_op->is_lease && (brk_op->o_lease->state & (~(SMB2_LEASE_READ_CACHING_LE | SMB2_LEASE_HANDLE_CACHING_LE)))) { @@ -1293,9 +1284,8 @@ void smb_break_all_levII_oplock(struct ksmbd_work *work, struct ksmbd_file *fp, oplock_break(brk_op, SMB2_OPLOCK_LEVEL_NONE); next: opinfo_put(brk_op); - rcu_read_lock(); } - rcu_read_unlock(); + read_unlock(&ci->m_lock); if (op) opinfo_put(op); diff --git a/fs/ksmbd/oplock.h b/fs/ksmbd/oplock.h index e1ba363b412a..98872b7399e1 100644 --- a/fs/ksmbd/oplock.h +++ b/fs/ksmbd/oplock.h @@ -76,7 +76,6 @@ struct oplock_info { struct list_head lease_entry; wait_queue_head_t oplock_q; /* Other server threads */ wait_queue_head_t oplock_brk; /* oplock breaking wait */ - struct rcu_head rcu_head; }; struct lease_break_info { -- 2.46.1

2 1

[PATCH OLK-5.10] ksmbd: fix Preauh_HashValue race condition
by Li Lingfeng 03 Dec '25

03 Dec '25

From: Namjae Jeon <linkinjeon(a)kernel.org> mainline inclusion from mainline-v6.17-rc1 commit 44a3059c4c8cc635a1fb2afd692d0730ca1ba4b6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICTZ34 CVE: CVE-2025-38561 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- If client send multiple session setup requests to ksmbd, Preauh_HashValue race condition could happen. There is no need to free sess->Preauh_HashValue at session setup phase. It can be freed together with session at connection termination phase. Cc: stable(a)vger.kernel.org Reported-by: zdi-disclosures(a)trendmicro.com # ZDI-CAN-27661 Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/server/smb2pdu.c fs/ksmbd/smb2pdu.c [lc:file path is not same] Signed-off-by: XiongWei Yang <yangxiongwei6(a)huawei.com> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/ksmbd/smb2pdu.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c index 6c4ea5e3802c..13f2a81d3621 100644 --- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -1826,8 +1826,6 @@ int smb2_sess_setup(struct ksmbd_work *work) ksmbd_conn_set_good(conn); sess->state = SMB2_SESSION_VALID; } - kfree(sess->Preauth_HashValue); - sess->Preauth_HashValue = NULL; } else if (conn->preferred_auth_mech == KSMBD_AUTH_NTLMSSP) { if (negblob->MessageType == NtLmNegotiate) { rc = ntlm_negotiate(work, negblob, negblob_len, rsp); @@ -1861,8 +1859,6 @@ int smb2_sess_setup(struct ksmbd_work *work) kfree(preauth_sess); } } - kfree(sess->Preauth_HashValue); - sess->Preauth_HashValue = NULL; } else { pr_info_ratelimited("Unknown NTLMSSP message type : 0x%x\n", le32_to_cpu(negblob->MessageType)); -- 2.46.1

2 1

[PATCH openEuler-1.0-LTS 0/4] add mcs support for migrate pages
by Wupeng Ma 03 Dec '25

03 Dec '25

Add mcs support for migrate page & support disabling soft offline for HugeTLB pages. Since UCE kernel recovery is needed by this. This should be enable with the following step: - echo 1 > /proc/sys/kernel/uce_kernel_recovery Disable soft offline support for hugetlb with the following step: - echo 3 > /proc/sys/vm/enable_soft_offline Jiaqi Yan (1): mm/memory-failure: userspace controls soft-offlining pages Kyle Meyer (1): mm/memory-failure: support disabling soft offline for HugeTLB pages Wupeng Ma (2): uce: add copy_mc_highpage{s} arm64: mm: Add copy mc support for migrate_page .../ABI/testing/sysfs-memory-page-offline | 3 + include/linux/highmem.h | 55 +++++++++++++ include/linux/mm.h | 1 + kernel/sysctl.c | 9 +++ mm/memory-failure.c | 25 +++++- mm/migrate.c | 79 ++++++++++++++++--- 6 files changed, 162 insertions(+), 10 deletions(-) -- 2.43.0

2 5

[PATCH OLK-6.6] net/mlx5: Fix ECVF vports unload on shutdown flow
by Wupeng Ma 03 Dec '25

03 Dec '25

From: Amir Tzin <amirtz(a)nvidia.com> stable inclusion from stable-v6.6.94 commit 5953ae44dfe5dbad374318875be834c3b7b71ee6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICJT95 CVE: CVE-2025-38109 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 687560d8a9a2d654829ad0da1ec24242f1de711d ] Fix shutdown flow UAF when a virtual function is created on the embedded chip (ECVF) of a BlueField device. In such case the vport acl ingress table is not properly destroyed. ECVF functionality is independent of ecpf_vport_exists capability and thus functions mlx5_eswitch_(enable|disable)_pf_vf_vports() should not test it when enabling/disabling ECVF vports. kernel log: [] refcount_t: underflow; use-after-free. [] WARNING: CPU: 3 PID: 1 at lib/refcount.c:28 refcount_warn_saturate+0x124/0x220 ---------------- [] Call trace: [] refcount_warn_saturate+0x124/0x220 [] tree_put_node+0x164/0x1e0 [mlx5_core] [] mlx5_destroy_flow_table+0x98/0x2c0 [mlx5_core] [] esw_acl_ingress_table_destroy+0x28/0x40 [mlx5_core] [] esw_acl_ingress_lgcy_cleanup+0x80/0xf4 [mlx5_core] [] esw_legacy_vport_acl_cleanup+0x44/0x60 [mlx5_core] [] esw_vport_cleanup+0x64/0x90 [mlx5_core] [] mlx5_esw_vport_disable+0xc0/0x1d0 [mlx5_core] [] mlx5_eswitch_unload_ec_vf_vports+0xcc/0x150 [mlx5_core] [] mlx5_eswitch_disable_sriov+0x198/0x2a0 [mlx5_core] [] mlx5_device_disable_sriov+0xb8/0x1e0 [mlx5_core] [] mlx5_sriov_detach+0x40/0x50 [mlx5_core] [] mlx5_unload+0x40/0xc4 [mlx5_core] [] mlx5_unload_one_devl_locked+0x6c/0xe4 [mlx5_core] [] mlx5_unload_one+0x3c/0x60 [mlx5_core] [] shutdown+0x7c/0xa4 [mlx5_core] [] pci_device_shutdown+0x3c/0xa0 [] device_shutdown+0x170/0x340 [] __do_sys_reboot+0x1f4/0x2a0 [] __arm64_sys_reboot+0x2c/0x40 [] invoke_syscall+0x78/0x100 [] el0_svc_common.constprop.0+0x54/0x184 [] do_el0_svc+0x30/0xac [] el0_svc+0x48/0x160 [] el0t_64_sync_handler+0xa4/0x12c [] el0t_64_sync+0x1a4/0x1a8 [] --[ end trace 9c4601d68c70030e ]--- Fixes: a7719b29a821 ("net/mlx5: Add management of EC VF vports") Reviewed-by: Daniel Jurgens <danielj(a)nvidia.com> Reviewed-by: Moshe Shemesh <moshe(a)nvidia.com> Signed-off-by: Amir Tzin <amirtz(a)nvidia.com> Signed-off-by: Mark Bloch <mbloch(a)nvidia.com> Link: https://patch.msgid.link/20250610151514.1094735-3-mbloch@nvidia.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- .../net/ethernet/mellanox/mlx5/core/eswitch.c | 21 ++++++++++++------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c index f6022c135ec02..914b380fd3eeb 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c @@ -1295,12 +1295,15 @@ mlx5_eswitch_enable_pf_vf_vports(struct mlx5_eswitch *esw, ret = mlx5_eswitch_load_pf_vf_vport(esw, MLX5_VPORT_ECPF, enabled_events); if (ret) goto ecpf_err; - if (mlx5_core_ec_sriov_enabled(esw->dev)) { - ret = mlx5_eswitch_load_ec_vf_vports(esw, esw->esw_funcs.num_ec_vfs, - enabled_events); - if (ret) - goto ec_vf_err; - } + } + + /* Enable ECVF vports */ + if (mlx5_core_ec_sriov_enabled(esw->dev)) { + ret = mlx5_eswitch_load_ec_vf_vports(esw, + esw->esw_funcs.num_ec_vfs, + enabled_events); + if (ret) + goto ec_vf_err; } /* Enable VF vports */ @@ -1331,9 +1334,11 @@ void mlx5_eswitch_disable_pf_vf_vports(struct mlx5_eswitch *esw) { mlx5_eswitch_unload_vf_vports(esw, esw->esw_funcs.num_vfs); + if (mlx5_core_ec_sriov_enabled(esw->dev)) + mlx5_eswitch_unload_ec_vf_vports(esw, + esw->esw_funcs.num_ec_vfs); + if (mlx5_ecpf_vport_exists(esw->dev)) { - if (mlx5_core_ec_sriov_enabled(esw->dev)) - mlx5_eswitch_unload_ec_vf_vports(esw, esw->esw_funcs.num_vfs); mlx5_eswitch_unload_pf_vf_vport(esw, MLX5_VPORT_ECPF); } -- 2.43.0

2 1

[PATCH OLK-5.10] memory: tegra20-emc: fix an OF node reference bug in tegra_emc_find_node_by_ram_code()
by Wupeng Ma 03 Dec '25

03 Dec '25

From: Joe Hattori <joe(a)pf.is.s.u-tokyo.ac.jp> stable inclusion from stable-v6.1.129 commit e9d07e91de140679eeaf275f47ad154467cb9e05 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPLHK CVE: CVE-2024-58034 Reference: https://git.kernel.org/stable/c/e9d07e91de140679eeaf275f47ad154467cb9e05 -------------------------------- [ Upstream commit b9784e5cde1f9fb83661a70e580e381ae1264d12 ] As of_find_node_by_name() release the reference of the argument device node, tegra_emc_find_node_by_ram_code() releases some device nodes while still in use, resulting in possible UAFs. According to the bindings and the in-tree DTS files, the "emc-tables" node is always device's child node with the property "nvidia,use-ram-code", and the "lpddr2" node is a child of the "emc-tables" node. Thus utilize the for_each_child_of_node() macro and of_get_child_by_name() instead of of_find_node_by_name() to simplify the code. This bug was found by an experimental verification tool that I am developing. Fixes: 96e5da7c8424 ("memory: tegra: Introduce Tegra20 EMC driver") Signed-off-by: Joe Hattori <joe(a)pf.is.s.u-tokyo.ac.jp> Link: https://lore.kernel.org/r/20241217091434.1993597-1-joe@pf.is.s.u-tokyo.ac.jp Link: https://lore.kernel.org/r/20241218024415.2494267-3-joe@pf.is.s.u-tokyo.ac.jp [krzysztof: applied v1, adjust the commit msg to incorporate v2 parts] Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/memory/tegra/tegra20-emc.c [1. Context differences; 2. The current hulk-5.10 version does not introduce the function tegra_emc_find_node_by_ram_code and lpddr2 related queries, so CVE bugfix for this part does not involved.] Signed-off-by: Lulu Yao <yaolulu5(a)huawei.com> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- drivers/memory/tegra/tegra20-emc.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/memory/tegra/tegra20-emc.c b/drivers/memory/tegra/tegra20-emc.c index 027f46287dbf..a6f73c7521dc 100644 --- a/drivers/memory/tegra/tegra20-emc.c +++ b/drivers/memory/tegra/tegra20-emc.c @@ -388,8 +388,9 @@ tegra_emc_find_node_by_ram_code(struct device *dev) ram_code = tegra_read_ram_code(); - for (np = of_find_node_by_name(dev->of_node, "emc-tables"); np; - np = of_find_node_by_name(np, "emc-tables")) { + for_each_child_of_node(dev->of_node, np) { + if (!of_node_name_eq(np, "emc-tables")) + continue; err = of_property_read_u32(np, "nvidia,ram-code", &value); if (err || value != ram_code) { of_node_put(np); -- 2.43.0

2 1

[PATCH OLK-5.10 0/2] CVE-2025-22022
by Wang Hai 03 Dec '25

03 Dec '25

CVE-2025-22022 Michal Pecio (1): usb: xhci: Apply the link chain quirk on NEC isoc endpoints Niklas Neronin (1): usb: xhci: move link chain bit quirk checks into one helper function. drivers/usb/host/xhci-mem.c | 10 ++-------- drivers/usb/host/xhci-ring.c | 8 ++------ drivers/usb/host/xhci.h | 16 ++++++++++++++-- 3 files changed, 18 insertions(+), 16 deletions(-) -- 2.17.1

2 3

[PATCH OLK-6.6 0/2] CVE-2025-22022
by Wang Hai 03 Dec '25

03 Dec '25

Michal Pecio (1): usb: xhci: Apply the link chain quirk on NEC isoc endpoints Niklas Neronin (1): usb: xhci: move link chain bit quirk checks into one helper function. drivers/usb/host/xhci-mem.c | 10 ++-------- drivers/usb/host/xhci-ring.c | 8 ++------ drivers/usb/host/xhci.h | 16 ++++++++++++++-- 3 files changed, 18 insertions(+), 16 deletions(-) -- 2.17.1

2 3

[PATCH OLK-6.6] rv: Use strings in da monitors tracepoints
by Lin Ruifeng 03 Dec '25

03 Dec '25

From: Gabriele Monaco <gmonaco(a)redhat.com> mainline inclusion from mainline-v6.17-rc1 commit 7f904ff6e58d398c4336f3c19c42b338324451f7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICUC9E CVE: CVE-2025-38636 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Using DA monitors tracepoints with KASAN enabled triggers the following warning: BUG: KASAN: global-out-of-bounds in do_trace_event_raw_event_event_da_monitor+0xd6/0x1a0 Read of size 32 at addr ffffffffaada8980 by task ... Call Trace: <TASK> [...] do_trace_event_raw_event_event_da_monitor+0xd6/0x1a0 ? __pfx_do_trace_event_raw_event_event_da_monitor+0x10/0x10 ? trace_event_sncid+0x83/0x200 trace_event_sncid+0x163/0x200 [...] The buggy address belongs to the variable: automaton_snep+0x4e0/0x5e0 This is caused by the tracepoints reading 32 bytes __array instead of __string from the automata definition. Such strings are literals and reading 32 bytes ends up in out of bound memory accesses (e.g. the next automaton's data in this case). The error is harmless as, while printing the string, we stop at the null terminator, but it should still be fixed. Use the __string facilities while defining the tracepoints to avoid reading out of bound memory. Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Ingo Molnar <mingo(a)redhat.com> Cc: Peter Zijlstra <peterz(a)infradead.org> Cc: Tomas Glozar <tglozar(a)redhat.com> Cc: Juri Lelli <jlelli(a)redhat.com> Cc: Clark Williams <williams(a)redhat.com> Cc: John Kacur <jkacur(a)redhat.com> Link: https://lore.kernel.org/20250728135022.255578-4-gmonaco@redhat.com Fixes: 792575348ff7 ("rv/include: Add deterministic automata monitor definition via C macros") Reviewed-by: Nam Cao <namcao(a)linutronix.de> Signed-off-by: Gabriele Monaco <gmonaco(a)redhat.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Conflicts: include/trace/events/rv.h kernel/trace/rv/rv_trace.h [Context conflicts] Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- include/trace/events/rv.h | 76 +++++++++++++++++++-------------------- 1 file changed, 38 insertions(+), 38 deletions(-) diff --git a/include/trace/events/rv.h b/include/trace/events/rv.h index 56592da9301c..da213b91da33 100644 --- a/include/trace/events/rv.h +++ b/include/trace/events/rv.h @@ -16,23 +16,23 @@ DECLARE_EVENT_CLASS(event_da_monitor, TP_ARGS(state, event, next_state, final_state), TP_STRUCT__entry( - __array( char, state, MAX_DA_NAME_LEN ) - __array( char, event, MAX_DA_NAME_LEN ) - __array( char, next_state, MAX_DA_NAME_LEN ) - __field( bool, final_state ) + __string( state, state ) + __string( event, event ) + __string( next_state, next_state ) + __field( bool, final_state ) ), TP_fast_assign( - memcpy(__entry->state, state, MAX_DA_NAME_LEN); - memcpy(__entry->event, event, MAX_DA_NAME_LEN); - memcpy(__entry->next_state, next_state, MAX_DA_NAME_LEN); - __entry->final_state = final_state; + __assign_str(state, state); + __assign_str(event, event); + __assign_str(next_state, next_state); + __entry->final_state = final_state; ), TP_printk("%s x %s -> %s %s", - __entry->state, - __entry->event, - __entry->next_state, + __get_str(state), + __get_str(event), + __get_str(next_state), __entry->final_state ? "(final)" : "") ); @@ -43,18 +43,18 @@ DECLARE_EVENT_CLASS(error_da_monitor, TP_ARGS(state, event), TP_STRUCT__entry( - __array( char, state, MAX_DA_NAME_LEN ) - __array( char, event, MAX_DA_NAME_LEN ) + __string( state, state ) + __string( event, event ) ), TP_fast_assign( - memcpy(__entry->state, state, MAX_DA_NAME_LEN); - memcpy(__entry->event, event, MAX_DA_NAME_LEN); + __assign_str(state, state); + __assign_str(event, event); ), TP_printk("event %s not expected in the state %s", - __entry->event, - __entry->state) + __get_str(event), + __get_str(state)) ); #ifdef CONFIG_RV_MON_WIP @@ -76,26 +76,26 @@ DECLARE_EVENT_CLASS(event_da_monitor_id, TP_ARGS(id, state, event, next_state, final_state), TP_STRUCT__entry( - __field( int, id ) - __array( char, state, MAX_DA_NAME_LEN ) - __array( char, event, MAX_DA_NAME_LEN ) - __array( char, next_state, MAX_DA_NAME_LEN ) - __field( bool, final_state ) + __field( int, id ) + __string( state, state ) + __string( event, event ) + __string( next_state, next_state ) + __field( bool, final_state ) ), TP_fast_assign( - memcpy(__entry->state, state, MAX_DA_NAME_LEN); - memcpy(__entry->event, event, MAX_DA_NAME_LEN); - memcpy(__entry->next_state, next_state, MAX_DA_NAME_LEN); - __entry->id = id; - __entry->final_state = final_state; + __assign_str(state, state); + __assign_str(event, event); + __assign_str(next_state, next_state); + __entry->id = id; + __entry->final_state = final_state; ), TP_printk("%d: %s x %s -> %s %s", __entry->id, - __entry->state, - __entry->event, - __entry->next_state, + __get_str(state), + __get_str(event), + __get_str(next_state), __entry->final_state ? "(final)" : "") ); @@ -106,21 +106,21 @@ DECLARE_EVENT_CLASS(error_da_monitor_id, TP_ARGS(id, state, event), TP_STRUCT__entry( - __field( int, id ) - __array( char, state, MAX_DA_NAME_LEN ) - __array( char, event, MAX_DA_NAME_LEN ) + __field( int, id ) + __string( state, state ) + __string( event, event ) ), TP_fast_assign( - memcpy(__entry->state, state, MAX_DA_NAME_LEN); - memcpy(__entry->event, event, MAX_DA_NAME_LEN); - __entry->id = id; + __assign_str(state, state); + __assign_str(event, event); + __entry->id = id; ), TP_printk("%d: event %s not expected in the state %s", __entry->id, - __entry->event, - __entry->state) + __get_str(event), + __get_str(state)) ); #ifdef CONFIG_RV_MON_WWNR -- 2.43.0

2 1

[PATCH OLK-5.10] media: venus: hfi: add check to handle incorrect queue size
by Lin Ruifeng 03 Dec '25

03 Dec '25

From: Vikash Garodia <quic_vgarodia(a)quicinc.com> stable inclusion from stable-v5.10.237 commit a45957bcde529169188929816775a575de77d84f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC5BJU CVE: CVE-2025-23158 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 69baf245b23e20efda0079238b27fc63ecf13de1 upstream. qsize represents size of shared queued between driver and video firmware. Firmware can modify this value to an invalid large value. In such situation, empty_space will be bigger than the space actually available. Since new_wr_idx is not checked, so the following code will result in an OOB write. ... qsize = qhdr->q_size if (wr_idx >= rd_idx) empty_space = qsize - (wr_idx - rd_idx) .... if (new_wr_idx < qsize) { memcpy(wr_ptr, packet, dwords << 2) --> OOB write Add check to ensure qsize is within the allocated size while reading and writing packets into the queue. Cc: stable(a)vger.kernel.org Fixes: d96d3f30c0f2 ("[media] media: venus: hfi: add Venus HFI files") Reviewed-by: Bryan O'Donoghue <bryan.odonoghue(a)linaro.org> Signed-off-by: Vikash Garodia <quic_vgarodia(a)quicinc.com> Signed-off-by: Hans Verkuil <hverkuil(a)xs4all.nl> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/media/platform/qcom/venus/hfi_venus.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/media/platform/qcom/venus/hfi_venus.c b/drivers/media/platform/qcom/venus/hfi_venus.c index 8b1375c97c81..d3f1efabbfd6 100644 --- a/drivers/media/platform/qcom/venus/hfi_venus.c +++ b/drivers/media/platform/qcom/venus/hfi_venus.c @@ -188,6 +188,9 @@ static int venus_write_queue(struct venus_hfi_device *hdev, /* ensure rd/wr indices's are read from memory */ rmb(); + if (qsize > IFACEQ_QUEUE_SIZE / 4) + return -EINVAL; + if (wr_idx >= rd_idx) empty_space = qsize - (wr_idx - rd_idx); else @@ -256,6 +259,9 @@ static int venus_read_queue(struct venus_hfi_device *hdev, wr_idx = qhdr->write_idx; qsize = qhdr->q_size; + if (qsize > IFACEQ_QUEUE_SIZE / 4) + return -EINVAL; + /* make sure data is valid before using it */ rmb(); -- 2.43.0

2 1

[openeuler:OLK-6.6 3450/3450] include/linux/syscalls.h:246:25: error: conflicting types for 'sys_xsched_setattr'; have 'long int(pid_t, struct xsched_attr *)' {aka 'long int(int, struct xsched_attr *)'}
by kernel test robot 03 Dec '25

03 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 475ad739de0d59c667bb9fa8ab728d1d146c8e28 commit: 7d2bb3c7646cf1ebe76de965c3b31d7bc2b89845 [3450/3450] xsched: fix compile error when CONFIG_XCU_SCHEDULER is disabled config: loongarch-randconfig-002-20251203 (https://download.01.org/0day-ci/archive/20251203/202512031328.9eAOiuGN-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251203/202512031328.9eAOiuGN-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512031328.9eAOiuGN-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from kernel/xsched/vstream.c:21: include/linux/syscalls.h:954:54: warning: 'struct xsched_attr' declared inside parameter list will not be visible outside of this definition or declaration 954 | asmlinkage long sys_xsched_setattr(pid_t pid, struct xsched_attr __user *arg); | ^~~~~~~~~~~ include/linux/syscalls.h:955:54: warning: 'struct xsched_attr' declared inside parameter list will not be visible outside of this definition or declaration 955 | asmlinkage long sys_xsched_getattr(pid_t pid, struct xsched_attr __user *arg); | ^~~~~~~~~~~ >> include/linux/syscalls.h:246:25: error: conflicting types for 'sys_xsched_setattr'; have 'long int(pid_t, struct xsched_attr *)' {aka 'long int(int, struct xsched_attr *)'} 246 | asmlinkage long sys##name(__MAP(x,__SC_DECL,__VA_ARGS__)) \ | ^~~ include/linux/syscalls.h:232:9: note: in expansion of macro '__SYSCALL_DEFINEx' 232 | __SYSCALL_DEFINEx(x, sname, __VA_ARGS__) | ^~~~~~~~~~~~~~~~~ include/linux/syscalls.h:222:36: note: in expansion of macro 'SYSCALL_DEFINEx' 222 | #define SYSCALL_DEFINE2(name, ...) SYSCALL_DEFINEx(2, _##name, __VA_ARGS__) | ^~~~~~~~~~~~~~~ kernel/xsched/vstream.c:660:1: note: in expansion of macro 'SYSCALL_DEFINE2' 660 | SYSCALL_DEFINE2(xsched_setattr, pid_t, pid, struct xsched_attr __user *, arg) | ^~~~~~~~~~~~~~~ include/linux/syscalls.h:954:17: note: previous declaration of 'sys_xsched_setattr' with type 'long int(pid_t, struct xsched_attr *)' {aka 'long int(int, struct xsched_attr *)'} 954 | asmlinkage long sys_xsched_setattr(pid_t pid, struct xsched_attr __user *arg); | ^~~~~~~~~~~~~~~~~~ >> include/linux/syscalls.h:246:25: error: conflicting types for 'sys_xsched_getattr'; have 'long int(pid_t, struct xsched_attr *)' {aka 'long int(int, struct xsched_attr *)'} 246 | asmlinkage long sys##name(__MAP(x,__SC_DECL,__VA_ARGS__)) \ | ^~~ include/linux/syscalls.h:232:9: note: in expansion of macro '__SYSCALL_DEFINEx' 232 | __SYSCALL_DEFINEx(x, sname, __VA_ARGS__) | ^~~~~~~~~~~~~~~~~ include/linux/syscalls.h:222:36: note: in expansion of macro 'SYSCALL_DEFINEx' 222 | #define SYSCALL_DEFINE2(name, ...) SYSCALL_DEFINEx(2, _##name, __VA_ARGS__) | ^~~~~~~~~~~~~~~ kernel/xsched/vstream.c:665:1: note: in expansion of macro 'SYSCALL_DEFINE2' 665 | SYSCALL_DEFINE2(xsched_getattr, pid_t, pid, struct xsched_attr __user *, arg) | ^~~~~~~~~~~~~~~ include/linux/syscalls.h:955:17: note: previous declaration of 'sys_xsched_getattr' with type 'long int(pid_t, struct xsched_attr *)' {aka 'long int(int, struct xsched_attr *)'} 955 | asmlinkage long sys_xsched_getattr(pid_t pid, struct xsched_attr __user *arg); | ^~~~~~~~~~~~~~~~~~ vim +246 include/linux/syscalls.h 1bd21c6c21e848 Dominik Brodowski 2018-04-05 235 e145242ea0df6b Dominik Brodowski 2018-04-09 236 /* e145242ea0df6b Dominik Brodowski 2018-04-09 237 * The asmlinkage stub is aliased to a function named __se_sys_*() which e145242ea0df6b Dominik Brodowski 2018-04-09 238 * sign-extends 32-bit ints to longs whenever needed. The actual work is e145242ea0df6b Dominik Brodowski 2018-04-09 239 * done within __do_sys_*(). e145242ea0df6b Dominik Brodowski 2018-04-09 240 */ 1bd21c6c21e848 Dominik Brodowski 2018-04-05 241 #ifndef __SYSCALL_DEFINEx bed1ffca022cc8 Frederic Weisbecker 2009-03-13 242 #define __SYSCALL_DEFINEx(x, name, ...) \ bee20031772af3 Arnd Bergmann 2018-06-19 243 __diag_push(); \ bee20031772af3 Arnd Bergmann 2018-06-19 244 __diag_ignore(GCC, 8, "-Wattribute-alias", \ bee20031772af3 Arnd Bergmann 2018-06-19 245 "Type aliasing is used to sanitize syscall arguments");\ 83460ec8dcac14 Andi Kleen 2013-11-12 @246 asmlinkage long sys##name(__MAP(x,__SC_DECL,__VA_ARGS__)) \ e145242ea0df6b Dominik Brodowski 2018-04-09 247 __attribute__((alias(__stringify(__se_sys##name)))); \ c9a211951c7c79 Howard McLauchlan 2018-03-21 248 ALLOW_ERROR_INJECTION(sys##name, ERRNO); \ e145242ea0df6b Dominik Brodowski 2018-04-09 249 static inline long __do_sys##name(__MAP(x,__SC_DECL,__VA_ARGS__));\ e145242ea0df6b Dominik Brodowski 2018-04-09 250 asmlinkage long __se_sys##name(__MAP(x,__SC_LONG,__VA_ARGS__)); \ e145242ea0df6b Dominik Brodowski 2018-04-09 251 asmlinkage long __se_sys##name(__MAP(x,__SC_LONG,__VA_ARGS__)) \ 1a94bc34768e46 Heiko Carstens 2009-01-14 252 { \ e145242ea0df6b Dominik Brodowski 2018-04-09 253 long ret = __do_sys##name(__MAP(x,__SC_CAST,__VA_ARGS__));\ 07fe6e00f6cca6 Al Viro 2013-01-21 254 __MAP(x,__SC_TEST,__VA_ARGS__); \ 2cf0966683430b Al Viro 2013-01-21 255 __PROTECT(x, ret,__MAP(x,__SC_ARGS,__VA_ARGS__)); \ 2cf0966683430b Al Viro 2013-01-21 256 return ret; \ 1a94bc34768e46 Heiko Carstens 2009-01-14 257 } \ bee20031772af3 Arnd Bergmann 2018-06-19 258 __diag_pop(); \ e145242ea0df6b Dominik Brodowski 2018-04-09 259 static inline long __do_sys##name(__MAP(x,__SC_DECL,__VA_ARGS__)) 1bd21c6c21e848 Dominik Brodowski 2018-04-05 260 #endif /* __SYSCALL_DEFINEx */ 1a94bc34768e46 Heiko Carstens 2009-01-14 261 :::::: The code at line 246 was first introduced by commit :::::: 83460ec8dcac14142e7860a01fa59c267ac4657c syscalls.h: use gcc alias instead of assembler aliases for syscalls :::::: TO: Andi Kleen <ak(a)linux.intel.com> :::::: CC: Linus Torvalds <torvalds(a)linux-foundation.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0