- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking
by Zizhi Wo 23 Oct '26

23 Oct '26

From: Nilesh Javali <njavali(a)marvell.com> stable inclusion from stable-v6.6.160 commit 2e6f60adf609c77e828f64e0cd371920bef91c12 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20146 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit… -------------------------------- [ Upstream commit 34a40e0dff940ac5eba494a69b553ea571e24873 ] qla25xx_free_req_que() and qla25xx_free_rsp_que() have two pre-existing bugs exposed on the error path of qla25xx_create_{req,rsp}_que(): 1. When dma_alloc_coherent() fails during queue creation, the error path calls the free function with req->ring / rsp->ring still NULL (from kzalloc). The unconditional dma_free_coherent() with a NULL cpu_addr is undefined behavior and can panic. 2. The free functions clear req_qid_map / rsp_qid_map under vport_lock, but the create functions protect the same bitmaps with mq_lock. This provides no mutual exclusion. Additionally, the create error path clears the bit and releases mq_lock before calling the free function, creating a window where another thread can allocate the same que_id and have its ha->req_q_map entry clobbered by the subsequent lockless NULL assignment in the free function. Fix by: - Guarding dma_free_coherent() with a NULL check on the ring pointer. - Using mq_lock (the lock held by all creators) in the free functions to atomically NULL the map entry and clear the bitmap bit. - Removing the now-redundant clear_bit blocks from the create error paths since the free functions handle it atomically. Signed-off-by: Nilesh Javali <njavali(a)marvell.com> Reviewed-by: Hannes Reinecke <hare(a)kernel.org> Link: https://patch.msgid.link/20260723050413.3897522-41-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) <mkp(a)kernel.org> Backport adaptation for the stable tree: the 29xx IOCB size-selection helpers are absent, and queue creation still allocates fixed-size entries. Initialize the local req_entry_size and rsp_entry_size values with sizeof(request_t) and sizeof(response_t), respectively, so DMA freeing continues to match allocation without adding helper functions or 29xx support. Retain all NULL-ring guards, mq_lock protection, and removal of the premature bitmap clears. Keep the response-ring cleanup layout used by upstream so target commit 19788a55cab61d78e33e0914a5a31d27843e8a4a applies unchanged. Stable-dep-of: 19788a55cab6 ("scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown") Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/scsi/qla2xxx/qla_mid.c [Simple context conflicts.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- drivers/scsi/qla2xxx/qla_mid.c | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/drivers/scsi/qla2xxx/qla_mid.c b/drivers/scsi/qla2xxx/qla_mid.c index 4029b7942e21..86c0217d1763 100644 --- a/drivers/scsi/qla2xxx/qla_mid.c +++ b/drivers/scsi/qla2xxx/qla_mid.c @@ -572,30 +572,34 @@ qla24xx_create_vhost(struct fc_vport *fc_vport) static void qla25xx_free_req_que(struct scsi_qla_host *vha, struct req_que *req) { struct qla_hw_data *ha = vha->hw; uint16_t que_id = req->id; + size_t req_entry_size = sizeof(request_t); - dma_free_coherent(&ha->pdev->dev, (req->length + 1) * - sizeof(request_t), req->ring, req->dma); + if (req->ring) + dma_free_coherent(&ha->pdev->dev, + (req->length + 1) * req_entry_size, + req->ring, req->dma); req->ring = NULL; req->dma = 0; if (que_id) { + mutex_lock(&ha->mq_lock); ha->req_q_map[que_id] = NULL; - mutex_lock(&ha->vport_lock); clear_bit(que_id, ha->req_qid_map); - mutex_unlock(&ha->vport_lock); + mutex_unlock(&ha->mq_lock); } kfree(req->outstanding_cmds); kfree(req); } static void qla25xx_free_rsp_que(struct scsi_qla_host *vha, struct rsp_que *rsp) { struct qla_hw_data *ha = vha->hw; uint16_t que_id = rsp->id; + size_t rsp_entry_size = sizeof(response_t); if (rsp->msix && rsp->msix->have_irq) { free_irq(rsp->msix->vector, rsp->msix->handle); rsp->msix->have_irq = 0; rsp->msix->in_use = 0; @@ -604,19 +608,21 @@ qla25xx_free_rsp_que(struct scsi_qla_host *vha, struct rsp_que *rsp) /* Flush any queued response work before freeing the queue/qpair. */ if (rsp->qpair && ha->wq) cancel_work_sync(&rsp->qpair->q_work); - dma_free_coherent(&ha->pdev->dev, (rsp->length + 1) * - sizeof(response_t), rsp->ring, rsp->dma); + if (rsp->ring) + dma_free_coherent(&ha->pdev->dev, + (rsp->length + 1) * rsp_entry_size, + rsp->ring, rsp->dma); rsp->ring = NULL; rsp->dma = 0; if (que_id) { + mutex_lock(&ha->mq_lock); ha->rsp_q_map[que_id] = NULL; - mutex_lock(&ha->vport_lock); clear_bit(que_id, ha->rsp_qid_map); - mutex_unlock(&ha->vport_lock); + mutex_unlock(&ha->mq_lock); } kfree(rsp); } int @@ -797,13 +803,10 @@ qla25xx_create_req_que(struct qla_hw_data *ha, uint16_t options, if (startqp) { ret = qla25xx_init_req_que(base_vha, req); if (ret != QLA_SUCCESS) { ql_log(ql_log_fatal, base_vha, 0x00df, "%s failed.\n", __func__); - mutex_lock(&ha->mq_lock); - clear_bit(que_id, ha->req_qid_map); - mutex_unlock(&ha->mq_lock); goto que_failed; } vha->flags.qpairs_req_created = 1; } @@ -911,13 +914,10 @@ qla25xx_create_rsp_que(struct qla_hw_data *ha, uint16_t options, if (startqp) { ret = qla25xx_init_rsp_que(base_vha, rsp); if (ret != QLA_SUCCESS) { ql_log(ql_log_fatal, base_vha, 0x00e7, "%s failed.\n", __func__); - mutex_lock(&ha->mq_lock); - clear_bit(que_id, ha->rsp_qid_map); - mutex_unlock(&ha->mq_lock); goto que_failed; } vha->flags.qpairs_rsp_created = 1; } rsp->req = NULL; -- 2.52.0

2 1

[PATCH OLK-6.6 0/2] resolve hungtask
by Chen Jinghuang 23 Oct '26

23 Oct '26

*** BLURB HERE *** Chen Jinghuang (1): sched: Fix struct sched_entity kabi broken Ingo Molnar (1): sched/fair: Separate se->vlag from se->vprot include/linux/sched.h | 17 ++++------------- 1 file changed, 4 insertions(+), 13 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking
by Zizhi Wo 23 Oct '26

23 Oct '26

From: Nilesh Javali <njavali(a)marvell.com> stable inclusion from stable-v6.6.160 commit 2e6f60adf609c77e828f64e0cd371920bef91c12 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20146 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit… -------------------------------- [ Upstream commit 34a40e0dff940ac5eba494a69b553ea571e24873 ] qla25xx_free_req_que() and qla25xx_free_rsp_que() have two pre-existing bugs exposed on the error path of qla25xx_create_{req,rsp}_que(): 1. When dma_alloc_coherent() fails during queue creation, the error path calls the free function with req->ring / rsp->ring still NULL (from kzalloc). The unconditional dma_free_coherent() with a NULL cpu_addr is undefined behavior and can panic. 2. The free functions clear req_qid_map / rsp_qid_map under vport_lock, but the create functions protect the same bitmaps with mq_lock. This provides no mutual exclusion. Additionally, the create error path clears the bit and releases mq_lock before calling the free function, creating a window where another thread can allocate the same que_id and have its ha->req_q_map entry clobbered by the subsequent lockless NULL assignment in the free function. Fix by: - Guarding dma_free_coherent() with a NULL check on the ring pointer. - Using mq_lock (the lock held by all creators) in the free functions to atomically NULL the map entry and clear the bitmap bit. - Removing the now-redundant clear_bit blocks from the create error paths since the free functions handle it atomically. Signed-off-by: Nilesh Javali <njavali(a)marvell.com> Reviewed-by: Hannes Reinecke <hare(a)kernel.org> Link: https://patch.msgid.link/20260723050413.3897522-41-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) <mkp(a)kernel.org> Backport adaptation for the stable tree: the 29xx IOCB size-selection helpers are absent, and queue creation still allocates fixed-size entries. Initialize the local req_entry_size and rsp_entry_size values with sizeof(request_t) and sizeof(response_t), respectively, so DMA freeing continues to match allocation without adding helper functions or 29xx support. Retain all NULL-ring guards, mq_lock protection, and removal of the premature bitmap clears. Keep the response-ring cleanup layout used by upstream so target commit 19788a55cab61d78e33e0914a5a31d27843e8a4a applies unchanged. Stable-dep-of: 19788a55cab6 ("scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown") Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/scsi/qla2xxx/qla_mid.c [Simple context conflicts.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- drivers/scsi/qla2xxx/qla_mid.c | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/drivers/scsi/qla2xxx/qla_mid.c b/drivers/scsi/qla2xxx/qla_mid.c index 4029b7942e21..53a523adcd06 100644 --- a/drivers/scsi/qla2xxx/qla_mid.c +++ b/drivers/scsi/qla2xxx/qla_mid.c @@ -572,30 +572,34 @@ qla24xx_create_vhost(struct fc_vport *fc_vport) static void qla25xx_free_req_que(struct scsi_qla_host *vha, struct req_que *req) { struct qla_hw_data *ha = vha->hw; uint16_t que_id = req->id; + size_t req_entry_size = sizeof(request_t); - dma_free_coherent(&ha->pdev->dev, (req->length + 1) * - sizeof(request_t), req->ring, req->dma); + if (req->ring) + dma_free_coherent(&ha->pdev->dev, + (req->length + 1) * req_entry_size, + req->ring, req->dma); req->ring = NULL; req->dma = 0; if (que_id) { + mutex_lock(&ha->mq_lock); ha->req_q_map[que_id] = NULL; - mutex_lock(&ha->vport_lock); clear_bit(que_id, ha->req_qid_map); - mutex_unlock(&ha->vport_lock); + mutex_unlock(&ha->mq_lock); } kfree(req->outstanding_cmds); kfree(req); } static void qla25xx_free_rsp_que(struct scsi_qla_host *vha, struct rsp_que *rsp) { struct qla_hw_data *ha = vha->hw; uint16_t que_id = rsp->id; + size_t rsp_entry_size = sizeof(response_t); if (rsp->msix && rsp->msix->have_irq) { free_irq(rsp->msix->vector, rsp->msix->handle); rsp->msix->have_irq = 0; rsp->msix->in_use = 0; @@ -604,19 +608,21 @@ qla25xx_free_rsp_que(struct scsi_qla_host *vha, struct rsp_que *rsp) /* Flush any queued response work before freeing the queue/qpair. */ if (rsp->qpair && ha->wq) cancel_work_sync(&rsp->qpair->q_work); - dma_free_coherent(&ha->pdev->dev, (rsp->length + 1) * - sizeof(response_t), rsp->ring, rsp->dma); + if (req->ring) + dma_free_coherent(&ha->pdev->dev, + (req->length + 1) * req_entry_size, + req->ring, req->dma); rsp->ring = NULL; rsp->dma = 0; if (que_id) { + mutex_lock(&ha->mq_lock); ha->rsp_q_map[que_id] = NULL; - mutex_lock(&ha->vport_lock); clear_bit(que_id, ha->rsp_qid_map); - mutex_unlock(&ha->vport_lock); + mutex_unlock(&ha->mq_lock); } kfree(rsp); } int @@ -797,13 +803,10 @@ qla25xx_create_req_que(struct qla_hw_data *ha, uint16_t options, if (startqp) { ret = qla25xx_init_req_que(base_vha, req); if (ret != QLA_SUCCESS) { ql_log(ql_log_fatal, base_vha, 0x00df, "%s failed.\n", __func__); - mutex_lock(&ha->mq_lock); - clear_bit(que_id, ha->req_qid_map); - mutex_unlock(&ha->mq_lock); goto que_failed; } vha->flags.qpairs_req_created = 1; } @@ -911,13 +914,10 @@ qla25xx_create_rsp_que(struct qla_hw_data *ha, uint16_t options, if (startqp) { ret = qla25xx_init_rsp_que(base_vha, rsp); if (ret != QLA_SUCCESS) { ql_log(ql_log_fatal, base_vha, 0x00e7, "%s failed.\n", __func__); - mutex_lock(&ha->mq_lock); - clear_bit(que_id, ha->rsp_qid_map); - mutex_unlock(&ha->mq_lock); goto que_failed; } vha->flags.qpairs_rsp_created = 1; } rsp->req = NULL; -- 2.52.0

2 1

[PATCH OLK-6.6 0/2] resolve hungtask
by Chen Jinghuang 23 Oct '26

23 Oct '26

*** BLURB HERE *** Chen Jinghuang (1): sched: Fix struct sched_entity kabi broken Ingo Molnar (1): sched/fair: Separate se->vlag from se->vprot include/linux/sched.h | 17 ++++------------- 1 file changed, 4 insertions(+), 13 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 1/2] sched/fair: Separate se->vlag from se->vprot
by Chen Jinghuang 23 Oct '26

23 Oct '26

From: Ingo Molnar <mingo(a)kernel.org> mainline inclusion from mainline-v7.0-rc1 commit 80390ead2080071cbd6f427ff8deb94d10a4a50f category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/10165 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There's no real space concerns here and keeping these fields in a union makes reading (and tracing) the scheduler code harder. Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Link: https://patch.msgid.link/20251201064647.1851919-4-mingo@kernel.org Conflicts: include/linux/sched.h [a trival context conflict about kabi] Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- include/linux/sched.h | 16 ++++------------ 1 file changed, 4 insertions(+), 12 deletions(-) diff --git a/include/linux/sched.h b/include/linux/sched.h index c7229faef4c7..639851dbd85e 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -595,18 +595,10 @@ struct sched_entity { u64 sum_exec_runtime; u64 prev_sum_exec_runtime; u64 vruntime; - KABI_BROKEN_REPLACE( - s64 vlag, - union { - /* - * When !@on_rq this field is vlag. - * When cfs_rq->curr == se (which implies @on_rq) - * this field is vprot. See protect_slice(). - */ - s64 vlag; - u64 vprot; - } - ) + /* Approximated virtual lag: */ + s64 vlag; + /* 'Protected' deadline, to give out minimum quantums: */ + u64 vprot; u64 slice; u64 nr_migrations; -- 2.34.1

2 2

[PATCH OLK-6.6] drm/amdkfd: fix SMI event cross-process information leak
by Zhang Yuwei 22 Oct '26

22 Oct '26

From: Yongqiang Sun <Yongqiang.Sun(a)amd.com> mainline inclusion from mainline-v7.2-rc1 commit 92a8dba246d371fe268280e5fd74b0955688e6df category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19653 CVE: CVE-2026-97422 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- kfd_smi_ev_enabled() skips the suser privilege check when pid=0. PROCESS_START, PROCESS_END, and VMFAULT events are emitted with pid=0 while carrying another process's PID and command name, so any /dev/kfd user in the render group can monitor all GPU workloads. Pass the target process PID into kfd_smi_event_add() for these events so the existing per-client filter restricts delivery to the owning process or CAP_SYS_ADMIN subscribers. Signed-off-by: Yongqiang Sun <Yongqiang.Sun(a)amd.com> Acked-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Co-authored-by: BackportAgent(a)deepseek-v4.1-flash Signed-off-by: Hulk Robot <hulkrobot(a)huawei.com> Conflicts: drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c [Commit b8f67b9ddf4f changed vm->task_info to flat fields (task_info->pid/tgid/task_name), so pass task_info->tgid as the SMI client pid filter instead of task_info->task.tgid. The kfd_smi_event_process()/PROCESS_START|END path does not exist in this tree, so only the VMFAULT caller is adapted.] Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> --- drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c b/drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c index 06ac835190f9..4e374c0e5a52 100644 --- a/drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c +++ b/drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c @@ -244,8 +244,9 @@ void kfd_smi_event_update_vmfault(struct kfd_node *dev, uint16_t pasid) if (task_info) { /* Report VM faults from user applications, not retry from kernel */ if (task_info->pid) - kfd_smi_event_add(0, dev, KFD_SMI_EVENT_VMFAULT, "%x:%s\n", - task_info->pid, task_info->task_name); + kfd_smi_event_add(task_info->tgid, dev, + KFD_SMI_EVENT_VMFAULT, "%x:%s\n", + task_info->pid, task_info->task_name); amdgpu_vm_put_task_info(task_info); } } -- 2.22.0

2 1

[PATCH OLK-6.6] drm/amdkfd: fix SMI event cross-process information leak
by Zhang Yuwei 22 Oct '26

22 Oct '26

From: Yongqiang Sun <Yongqiang.Sun(a)amd.com> mainline inclusion from mainline-v7.2-rc1 commit 92a8dba246d371fe268280e5fd74b0955688e6df category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19653 CVE: CVE-2026-97422 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- kfd_smi_ev_enabled() skips the suser privilege check when pid=0. PROCESS_START, PROCESS_END, and VMFAULT events are emitted with pid=0 while carrying another process's PID and command name, so any /dev/kfd user in the render group can monitor all GPU workloads. Pass the target process PID into kfd_smi_event_add() for these events so the existing per-client filter restricts delivery to the owning process or CAP_SYS_ADMIN subscribers. Signed-off-by: Yongqiang Sun <Yongqiang.Sun(a)amd.com> Acked-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Conflicts: drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c [Commit b8f67b9ddf4f changed vm->task_info to flat fields (task_info->pid/tgid/task_name), so pass task_info->tgid as the SMI client pid filter instead of task_info->task.tgid. The kfd_smi_event_process()/PROCESS_START|END path does not exist in this tree, so only the VMFAULT caller is adapted.] Co-authored-by: BackportAgent(a)deepseek-v4.1-flash Signed-off-by: Hulk Robot <hulkrobot(a)huawei.com> Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> --- drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c b/drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c index 06ac835190f9..4e374c0e5a52 100644 --- a/drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c +++ b/drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c @@ -244,8 +244,9 @@ void kfd_smi_event_update_vmfault(struct kfd_node *dev, uint16_t pasid) if (task_info) { /* Report VM faults from user applications, not retry from kernel */ if (task_info->pid) - kfd_smi_event_add(0, dev, KFD_SMI_EVENT_VMFAULT, "%x:%s\n", - task_info->pid, task_info->task_name); + kfd_smi_event_add(task_info->tgid, dev, + KFD_SMI_EVENT_VMFAULT, "%x:%s\n", + task_info->pid, task_info->task_name); amdgpu_vm_put_task_info(task_info); } } -- 2.22.0

2 1

[PATCH OLK-5.10 0/2] CVE-2026-97563 and CVE-2026-97565
by Yifan Qiao 22 Oct '26

22 Oct '26

Diego Oliva (2): smb: client: reject short READ responses in CIFSSMBRead() smb: client: reject out-of-bounds DataOffset in CIFSSMBRead() fs/cifs/cifssmb.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) -- 2.52.0

2 3

[PATCH OLK-6.6] smb: client: reject out-of-bounds DataOffset in CIFSSMBRead()
by Yifan Qiao 22 Oct '26

22 Oct '26

From: Diego Oliva <diego(a)bynar.io> mainline inclusion from mainline-v7.3-rc3 commit 5be5bdda5863eacc964b609ba927764f253431b3 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20155 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- The SMB1 synchronous read helper CIFSSMBRead() validates the server's DataLength against CIFSMaxBufSize and the caller's count, but never validates DataOffset. The copy source is formed as &pSMBr->hdr.Protocol + le16_to_cpu(pSMBr->DataOffset) and memcpy()'d for DataLength bytes with no check that the [DataOffset, DataOffset + DataLength) range lies within the response actually received from the server. A malicious or compromised SMB1 server can return a response carrying an in-range DataLength and a large DataOffset, driving the source pointer past the end of the response buffer. The memcpy() then copies adjacent kernel heap into the caller's read buffer (information disclosure), or reads unmapped memory and oopses (denial of service). SMB1 is not negotiated by default; reaching this code requires an explicit vers=1.0 mount. Both DataOffset and the received response length recorded in rsp_iov.iov_len are relative to the start of the SMB header, so reject the response unless DataOffset + DataLength fits within that length, using overflow-safe arithmetic, before forming the source pointer. The response length has been validated by the previous patch, so the DataOffset and DataLength fields can be read safely here. While here, make data_length unsigned. It holds a length derived from unsigned on-the-wire fields and is only ever compared against unsigned quantities; print it with %u accordingly, and add __func__ to the cifs_dbg() calls in this function. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable(a)vger.kernel.org # 6.19.x Assisted-by: Bynario AI Signed-off-by: Diego Oliva <diego(a)bynar.io> Reviewed-by: David Howells <dhowells(a)redhat.com> Signed-off-by: Paulo Alcantara <pc(a)manguebit.org> Conflicts: fs/smb/client/cifssmb.c fs/smb/client/trace.h [Context differences.] Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/smb/client/cifssmb.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/fs/smb/client/cifssmb.c b/fs/smb/client/cifssmb.c index 60f333f6fa02..4c0a2d410f9a 100644 --- a/fs/smb/client/cifssmb.c +++ b/fs/smb/client/cifssmb.c @@ -1456,7 +1456,8 @@ CIFSSMBRead(const unsigned int xid, struct cifs_io_parms *io_parms, rc = -EIO; *nbytes = 0; } else { - int data_length = le16_to_cpu(pSMBr->DataLengthHigh); + unsigned int data_length = le16_to_cpu(pSMBr->DataLengthHigh); + __u16 data_offset = le16_to_cpu(pSMBr->DataOffset); data_length = data_length << 16; data_length += le16_to_cpu(pSMBr->DataLength); *nbytes = data_length; @@ -1464,13 +1465,19 @@ CIFSSMBRead(const unsigned int xid, struct cifs_io_parms *io_parms, /*check that DataLength would not go beyond end of SMB */ if ((data_length > CIFSMaxBufSize) || (data_length > count)) { - cifs_dbg(FYI, "bad length %d for count %d\n", - data_length, count); + cifs_dbg(FYI, "%s: bad length %u for count %u\n", + __func__, data_length, count); + rc = -EIO; + *nbytes = 0; + } else if (4 + data_offset < sizeof(*pSMBr) || + 4 + (size_t)data_offset + data_length > rsp_iov.iov_len) { + /* check that the data lies within the received response */ + cifs_dbg(FYI, "%s: bad data offset %u length %u for response of %zu\n", + __func__, data_offset, data_length, rsp_iov.iov_len); rc = -EIO; *nbytes = 0; } else { - pReadData = (char *) (&pSMBr->hdr.Protocol) + - le16_to_cpu(pSMBr->DataOffset); + pReadData = (char *) (&pSMBr->hdr.Protocol) + data_offset; /* if (rc = copy_to_user(buf, pReadData, data_length)) { cifs_dbg(VFS, "Faulting on read rc = %d\n",rc); rc = -EFAULT; -- 2.52.0

2 1

[PATCH OLK-6.6] io_uring/rw: end write accounting from ->ki_complete
by Yifan Qiao 22 Oct '26

22 Oct '26

From: Jens Axboe <axboe(a)kernel.dk> mainline inclusion from mainline-v7.3-rc3 commit 796aa0547557e63338657ed1c487906f9fac4c73 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20166 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Commit b000145e9907 moved both the fsnotify calls and the write accounting out of the kiocb completion handler and into the io_req_rw_complete() task_work. However, only the fsnotify part actually needed to move as it may sleep. Ending the write accounting is just a percpu_up_read() on the superblock writers sem. Deferring it is a problem, because it makes dropping SB_FREEZE_WRITE protection depend on the ring owner getting to running task_work. But the task may be blocked in freeze_super(), causing it to never get to that: task io-wq worker -------------------------------------------------------------- io_write() io_kiocb_start_write() (takes sb_writers, hidden from lockdep by __sb_writers_release) write_iter() -> -EIOCBQUEUED ioctl(FS_IOC_SHUTDOWN) bdev_freeze() freeze_super() percpu_down_write() <- waits for the reader above io_write() kiocb_start_write() percpu_down_read() <- queued behind the writer <bio completes> io_complete_rw() queues io_req_rw_complete() <- never runs, task is in D state End the write from io_complete_rw() instead, and leave only the fsnotify calls in task_work. Reported-by: syzbot+2eb3d983669d3e49d4fa(a)syzkaller.appspotmail.com Cc: stable(a)vger.kernel.org Fixes: b000145e9907 ("io_uring/rw: defer fsnotify calls to task context") Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: io_uring/rw.c [This tree still has io_req_io_end() (which ends write accounting) on the reissue branch of __io_complete_rw_common(), so the hoisted io_req_end_write() is placed after that branch instead of at the top of io_complete_rw(), avoiding a double sb_end_write() while still ending writes from ->ki_complete.] Co-authored-by: BackportAgent(a)deepseek-v4.1-flash Signed-off-by: Hulk Robot <hulkrobot(a)huawei.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- io_uring/rw.c | 31 +++++++++++++++++++++---------- 1 file changed, 21 insertions(+), 10 deletions(-) diff --git a/io_uring/rw.c b/io_uring/rw.c index e550f0618fd2..15dfb9c24613 100644 --- a/io_uring/rw.c +++ b/io_uring/rw.c @@ -244,20 +244,25 @@ static void io_req_end_write(struct io_kiocb *req) } } -/* - * Trigger the notifications after having done some IO, and finish the write - * accounting, if any. - */ -static void io_req_io_end(struct io_kiocb *req) +/* Trigger the notifications after having done some IO. */ +static void io_req_io_notify(struct io_kiocb *req) { struct io_rw *rw = io_kiocb_to_cmd(req, struct io_rw); - if (rw->kiocb.ki_flags & IOCB_WRITE) { - io_req_end_write(req); + if (rw->kiocb.ki_flags & IOCB_WRITE) fsnotify_modify(req->file); - } else { + else fsnotify_access(req->file); - } +} + +/* Finish write accounting and notify, for inline completions only. */ +static void io_req_io_end(struct io_kiocb *req) +{ + struct io_rw *rw = io_kiocb_to_cmd(req, struct io_rw); + + if (rw->kiocb.ki_flags & IOCB_WRITE) + io_req_end_write(req); + io_req_io_notify(req); } static bool __io_complete_rw_common(struct io_kiocb *req, long res) @@ -304,7 +309,7 @@ void io_req_rw_complete(struct io_kiocb *req, struct io_tw_state *ts) io_req_set_res(req, io_fixup_rw_res(req, res), 0); } - io_req_io_end(req); + io_req_io_notify(req); if (req->flags & (REQ_F_BUFFER_SELECTED|REQ_F_BUFFER_RING)) req->cqe.flags |= io_put_kbuf(req, 0); @@ -322,6 +327,12 @@ static void io_complete_rw(struct kiocb *kiocb, long res) return; io_req_set_res(req, io_fixup_rw_res(req, res), 0); } + /* + * End write accounting here rather than in task_work, as the ring + * owner may block in freeze_super() before that runs. + */ + if (kiocb->ki_flags & IOCB_WRITE) + io_req_end_write(req); req->io_task_work.func = io_req_rw_complete; __io_req_task_work_add(req, IOU_F_TWQ_LAZY_WAKE); } -- 2.52.0

2 1