- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] Revert "iomap: guard io_size EOF trim against concurrent truncate underflow"
by Ran Hongyun 16 Sep '26

16 Sep '26

Offering: HULK hulk inclusion category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17916 CVE: CVE-2026-72367 -------------------------------- This reverts commit 70ad22e4e8dfd119161fdaebc2bf4007f136516a. The upstream fix (55ec50d046c0) guards against unsigned underflow when `end_pos < io_offset` by clamping io_size to zero. In mainline, `end_pos` is a per-folio snapshot passed as a parameter. commit e728e754141f uses `isize = i_size_read(inode)` instead of `end_pos`: if (pos < isize && pos + len > isize) wpc->ioend->io_size = isize - wpc->ioend->io_offset; Since `io_offset <= pos < isize`, when the branch is taken, the subtraction cannot underflow. Fixes: 70ad22e4e8df ("iomap: guard io_size EOF trim against concurrent truncate underflow") Signed-off-by: Ran Hongyun <ranhongyun1(a)huawei.com> --- fs/iomap/buffered-io.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/fs/iomap/buffered-io.c b/fs/iomap/buffered-io.c index baa7bbe02fad..1b9177ad7cdd 100644 --- a/fs/iomap/buffered-io.c +++ b/fs/iomap/buffered-io.c @@ -2002,12 +2002,8 @@ static int iomap_add_to_ioend(struct iomap_writepage_ctx *wpc, * should not be trimmed in such cases. */ wpc->ioend->io_size += len; - if (wpc->ioend->io_offset + wpc->ioend->io_size > isize) { - if (wpc->ioend->io_offset >= isize) - wpc->ioend->io_size = 0; - else - wpc->ioend->io_size = isize - wpc->ioend->io_offset; - } + if (pos < isize && pos + len > isize) + wpc->ioend->io_size = isize - wpc->ioend->io_offset; wbc_account_cgroup_owner(wbc, &folio->page, len); return 0; -- 2.52.0

2 1

[PATCH openEuler-1.0-LTS] ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock
by Chen Yuxi 16 Sep '26

16 Sep '26

From: Xiubo Li <xiubo.li(a)clyso.com> mainline inclusion from mainline-v7.3-rc1 commit 7af4c4f01305b0935adf6d4301b1ec407025485d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19017 CVE: CVE-2026-89655 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm… -------------------------------- list_for_each_entry() iterates ci->i_cap_flush_list but drops i_ceph_lock to send cap messages. During the unlock window, handle_cap_flush_ack() can acquire i_ceph_lock, detach cf entries with tid <= flush_tid from the list, release i_ceph_lock, and free them via ceph_free_cap_flush() outside any lock. When the original thread reacquires i_ceph_lock and the for-loop macro advances via cf = list_next_entry(cf, i_list), it dereferences cf->i_list.next on freed memory. The race timeline: __kick_flushing_caps() handle_cap_flush_ack() ----------------------- ----------------------- holds i_ceph_lock <--- iterates to cf (tid=10) prepares FLUSH message drops i_ceph_lock <--- __send_cap() ── FLUSH(tid=10) MDS sends FLUSH_ACK(tid=10) ---> acquires i_ceph_lock cf->tid(10) <= flush_tid(10), detaches cf from i_cap_flush_list drops i_ceph_lock ceph_free_cap_flush(cf) <- frees it! acquires i_ceph_lock <--- for-loop advances: cf = list_next_entry(cf, i_list) -- UAF on freed cf->i_list.next The cf was just sent by __kick_flushing_caps itself via __send_cap(). The MDS may respond with FLUSH_ACK quickly enough that handle_cap_flush_ack() frees cf before __kick_flushing_caps can finish the iteration. Fix by converting to a manual while loop: save the next pointer under i_ceph_lock before dropping it, then use the saved pointer after reacquiring, so the potentially-freed cf is never accessed again. Cc: stable(a)vger.kernel.org Signed-off-by: Xiubo Li <xiubo.li(a)clyso.com> Reviewed-by: Viacheslav Dubeyko <slava(a)dubeyko.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Conflicts: fs/ceph/caps.c [commit b2f9fa1f3bd8846f50b355fc2168236975c4d264 not backport] Signed-off-by: Chen Yuxi <chenyuxi19(a)huawei.com> --- fs/ceph/caps.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c index 80591f37dd77..a89ca4d01f91 100644 --- a/fs/ceph/caps.c +++ b/fs/ceph/caps.c @@ -2303,9 +2303,14 @@ static void __kick_flushing_caps(struct ceph_mds_client *mdsc, int ret; u64 first_tid = 0; - list_for_each_entry(cf, &ci->i_cap_flush_list, i_list) { - if (cf->tid < first_tid) + cf = list_first_entry(&ci->i_cap_flush_list, struct ceph_cap_flush, i_list); + while (&cf->i_list != &ci->i_cap_flush_list) { + struct ceph_cap_flush *next; + + if (cf->tid < first_tid) { + cf = list_next_entry(cf, i_list); continue; + } cap = ci->i_auth_cap; if (!(cap && cap->session == session)) { @@ -2315,6 +2320,7 @@ static void __kick_flushing_caps(struct ceph_mds_client *mdsc, } first_tid = cf->tid + 1; + next = list_next_entry(cf, i_list); if (cf->caps) { dout("kick_flushing_caps %p cap %p tid %llu %s\n", @@ -2357,6 +2363,7 @@ static void __kick_flushing_caps(struct ceph_mds_client *mdsc, } spin_lock(&ci->i_ceph_lock); + cf = next; } } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS V1] HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature
by Yao Yiqi 16 Sep '26

16 Sep '26

From: Xingrui Li <baka9(a)bakabaka9.tech> stable inclusion from stable-v5.10.270 commit 1c0463f0f028801a933f090cd2695f132635b374 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18767 CVE: CVE-2026-89729 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------ commit c92693f3ed099401d0383ef35ca1fe1e6ba033de upstream. sensor_hub_get_feature() clamps its return value to the caller's buffer size, but the copy loop still copies field->report_size / 8 bytes for each report value. A malicious HID descriptor can advertise a large feature field size while an IIO caller supplies a small stack buffer, such as a single s32, causing an out-of-bounds write. HID core stores parsed report values in __s32 slots and clamps extracted values to 32 bits. Reject feature fields that require more than one slot per value, guard the total byte count calculation, and clamp each per-value copy to the remaining caller buffer. Fixes: 5459ada2b3cd69 ("HID: sensor-hub: Fix packing of result buffer for feature report") Cc: stable(a)kernel.org Assisted-by: OpenAI:GPT-5.5-Cyber Signed-off-by: Xingrui Li <baka9(a)bakabaka9.tech> Acked-by: Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> Signed-off-by: Jiri Kosina <jkosina(a)suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yao Yiqi <yaoyiqi3(a)huawei.com> --- drivers/hid/hid-sensor-hub.c | 42 +++++++++++++++++++++--------------- 1 file changed, 25 insertions(+), 17 deletions(-) diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c index 4256fdc5cd6d..22b9008a7ebb 100644 --- a/drivers/hid/hid-sensor-hub.c +++ b/drivers/hid/hid-sensor-hub.c @@ -248,12 +248,17 @@ int sensor_hub_get_feature(struct hid_sensor_hub_device *hsdev, u32 report_id, u32 field_index, int buffer_size, void *buffer) { struct hid_report *report; + struct hid_field *field; struct sensor_hub_data *data = hid_get_drvdata(hsdev->hdev); - int report_size; + size_t field_size; + size_t report_size; + size_t copied = 0; + size_t to_copy; int ret = 0; - u8 *val_ptr; - int buffer_index = 0; - int i; + unsigned int i; + + if (!buffer || buffer_size <= 0) + return -EINVAL; memset(buffer, 0, buffer_size); @@ -267,26 +272,29 @@ int sensor_hub_get_feature(struct hid_sensor_hub_device *hsdev, u32 report_id, hid_hw_request(hsdev->hdev, report, HID_REQ_GET_REPORT); hid_hw_wait(hsdev->hdev); + field = report->field[field_index]; + /* calculate number of bytes required to read this field */ - report_size = DIV_ROUND_UP(report->field[field_index]->report_size, - 8) * - report->field[field_index]->report_count; - if (!report_size) { + field_size = DIV_ROUND_UP(field->report_size, 8); + /* HID core stores each parsed report value in a __s32 slot. */ + if (!field_size || field_size > sizeof(field->value[0])) { + ret = -EINVAL; + goto done_proc; + } + if (field->report_count > SIZE_MAX / field_size) { ret = -EINVAL; goto done_proc; } - ret = min(report_size, buffer_size); - val_ptr = (u8 *)report->field[field_index]->value; - for (i = 0; i < report->field[field_index]->report_count; ++i) { - if (buffer_index >= ret) - break; + report_size = field_size * field->report_count; + report_size = min_t(size_t, report_size, buffer_size); - memcpy(&((u8 *)buffer)[buffer_index], val_ptr, - report->field[field_index]->report_size / 8); - val_ptr += sizeof(__s32); - buffer_index += (report->field[field_index]->report_size / 8); + for (i = 0; i < field->report_count && copied < report_size; ++i) { + to_copy = min(field_size, report_size - copied); + memcpy(&((u8 *)buffer)[copied], &field->value[i], to_copy); + copied += to_copy; } + ret = copied; done_proc: mutex_unlock(&data->mutex); -- 2.34.1

2 1

[PATCH OLK-6.6 00/12] KVM: arm64: Add support for vTLBID
by Jinqian Yang 16 Sep '26

16 Sep '26

This series adds KVM virtualization for TLBID so that a guest can use the feature. KVM maintains a vDomain-to-pDomain mapping and writes it into VTLBID(n) on vCPU load; the hardware then translates the guest's vDomain id into the corresponding pDomain id for TLBI broadcast. The series covers: - TLBID-related sysreg definitions (TLBIDIDR_EL1, VTLBIDn_EL2, HCRX_EL2). - KVM internal helpers for TLBID virtualization init/teardown and vDomain configuration. - VTLBID(n) map update on vCPU load/migration, with ioctls for QEMU to query max vDomains and set per-vCPU vDomain bitmaps. - Guest exposure of TLBIDIDR_EL1 and ID_AA64MMFR4_EL1.TLBID, with trap handling. - Optimizations: pCPU-to-vCPU reverse index to avoid vCPU traversal, skipping TLB flush/IPI when the domain map is unchanged, and a tracepoint to replace trace_printk. Jinqian Yang (10): KVM: arm64: Add internal helpers to support TLBID virtualization KVM: arm64: Update VTLBID(n) when vCPU load KVM: arm64: Add ioctls to support TLBID virtualzation KVM: arm64: Ensure DVMBM is disabled when TLBID is enabled KVM: arm64: Expose tlbididr_el1 to guest KVM: arm64: Expose ID_AA64MMFR4_EL1_TLBID to guest KVM: arm64: Enable read TLBIDIDR_EL1 trap in guest KVM: arm64: Use pCPU-to-vCPU reverse index to avoid vCPU traversal KVM: arm64: Skip TLB invalidation and vCPU IPI when domain map is unchanged KVM: arm64: Replace trace_printk with tracepoint in kvm_tlbidomain_vcpu_load Tian Zheng (1): KVM: arm64: Skip VM-level ID_AA64MMFR4 write on vCPU hotplug Zhou Wang (1): arm64/sysreg: Add TLBID sysreg Documentation/virt/kvm/api.rst | 62 ++++ arch/arm64/include/asm/kvm_host.h | 45 +++ arch/arm64/include/uapi/asm/kvm.h | 2 + arch/arm64/kvm/arm.c | 453 ++++++++++++++++++++++++++- arch/arm64/kvm/hisilicon/hisi_virt.c | 9 + arch/arm64/kvm/sys_regs.c | 67 +++- arch/arm64/kvm/sys_regs.h | 2 + arch/arm64/kvm/trace_arm.h | 47 +++ arch/arm64/tools/sysreg | 24 +- include/uapi/linux/kvm.h | 14 + 10 files changed, 721 insertions(+), 4 deletions(-) -- 2.33.0

2 13

[PATCH OLK-6.6 00/19] backport minios part4 patches from linux mainline on September 16th.
by Qinxin Xia 16 Sep '26

16 Sep '26

driver inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/8904 ---------------------------------------------------------------------- backport minios part4 patches from linux mainline on September 16th. Marc Zyngier (2): KVM: arm64: Properly save/restore HCRX_EL2 KVM: arm64: Kill HCRX_HOST_FLAGS Mark Brown (6): arm64/sysreg: Update HCRX_EL2 definition for DDI0601 2023-09 arm64/fpsimd: Enable host kernel access to FPMR arm64/fpsimd: Support FEAT_FPMR arm64/signal: Add FPMR signal handling arm64/ptrace: Expose FPMR via ptrace arm64/fpsimd: Don't corrupt FPMR when streaming mode changes Mark Rutland (10): arm64: ptrace: fix partial SETREGSET for NT_ARM_FPMR arm64/fpsimd: Add fpsimd_save_and_flush_current_state() arm64/fpsimd: Reset FPMR upon exec() arm64/fpsimd: signal32: Always save+flush state early arm64/fpsimd: signal: Always save+flush state early arm64/fpsimd: Avoid warning when sve_to_fpsimd() is unused arm64/fpsimd: Do not discard modified SVE state arm64/fpsimd: signal: Clear TPIDR2 when delivering signals arm64/fpsimd: signal: Use SMSTOP behaviour in setup_return() arm64/fpsimd: Add task_smstop_sm() Qinxin Xia (1): arm64/idreg: Add support "arm64.nocnp" for start option Documentation/arch/arm64/sme.rst | 2 +- arch/arm64/include/asm/cpufeature.h | 6 ++ arch/arm64/include/asm/el2_setup.h | 2 +- arch/arm64/include/asm/fpsimd.h | 9 +- arch/arm64/include/asm/kvm_arm.h | 1 - arch/arm64/include/asm/kvm_kabi.h | 18 ++++ arch/arm64/include/asm/processor.h | 2 +- arch/arm64/include/asm/signal_common.h | 20 +++- arch/arm64/include/uapi/asm/sigcontext.h | 8 ++ arch/arm64/kernel/cpufeature.c | 15 ++- arch/arm64/kernel/entry-common.c | 50 +++++++--- arch/arm64/kernel/fpsimd.c | 99 +++++++++++++------- arch/arm64/kernel/idreg-override.c | 11 +++ arch/arm64/kernel/ptrace.c | 46 +++++++++ arch/arm64/kernel/signal.c | 114 +++++++++++------------ arch/arm64/kernel/signal32.c | 11 ++- arch/arm64/kvm/arm.c | 3 +- arch/arm64/kvm/fpsimd.c | 2 + arch/arm64/kvm/hyp/include/hyp/switch.h | 13 ++- arch/arm64/tools/cpucaps | 2 +- arch/arm64/tools/sysreg | 4 +- include/uapi/linux/elf.h | 1 + 22 files changed, 308 insertions(+), 131 deletions(-) create mode 100644 arch/arm64/include/asm/kvm_kabi.h -- 2.33.0

2 20

[PATCH openEuler-1.0-LTS] ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock
by Chen Yuxi 16 Sep '26

16 Sep '26

From: Xiubo Li <xiubo.li(a)clyso.com> mainline inclusion from mainline-v7.3-rc1 commit 7af4c4f01305b0935adf6d4301b1ec407025485d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19017 CVE: CVE-2026-89655 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm… -------------------------------- list_for_each_entry() iterates ci->i_cap_flush_list but drops i_ceph_lock to send cap messages. During the unlock window, handle_cap_flush_ack() can acquire i_ceph_lock, detach cf entries with tid <= flush_tid from the list, release i_ceph_lock, and free them via ceph_free_cap_flush() outside any lock. When the original thread reacquires i_ceph_lock and the for-loop macro advances via cf = list_next_entry(cf, i_list), it dereferences cf->i_list.next on freed memory. The race timeline: __kick_flushing_caps() handle_cap_flush_ack() ----------------------- ----------------------- holds i_ceph_lock <--- iterates to cf (tid=10) prepares FLUSH message drops i_ceph_lock <--- __send_cap() ── FLUSH(tid=10) MDS sends FLUSH_ACK(tid=10) ---> acquires i_ceph_lock cf->tid(10) <= flush_tid(10), detaches cf from i_cap_flush_list drops i_ceph_lock ceph_free_cap_flush(cf) <- frees it! acquires i_ceph_lock <--- for-loop advances: cf = list_next_entry(cf, i_list) -- UAF on freed cf->i_list.next The cf was just sent by __kick_flushing_caps itself via __send_cap(). The MDS may respond with FLUSH_ACK quickly enough that handle_cap_flush_ack() frees cf before __kick_flushing_caps can finish the iteration. Fix by converting to a manual while loop: save the next pointer under i_ceph_lock before dropping it, then use the saved pointer after reacquiring, so the potentially-freed cf is never accessed again. Cc: stable(a)vger.kernel.org Signed-off-by: Xiubo Li <xiubo.li(a)clyso.com> Reviewed-by: Viacheslav Dubeyko <slava(a)dubeyko.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Signed-off-by: Chen Yuxi <chenyuxi19(a)huawei.com> --- fs/ceph/caps.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c index 80591f37dd77..a89ca4d01f91 100644 --- a/fs/ceph/caps.c +++ b/fs/ceph/caps.c @@ -2303,9 +2303,14 @@ static void __kick_flushing_caps(struct ceph_mds_client *mdsc, int ret; u64 first_tid = 0; - list_for_each_entry(cf, &ci->i_cap_flush_list, i_list) { - if (cf->tid < first_tid) + cf = list_first_entry(&ci->i_cap_flush_list, struct ceph_cap_flush, i_list); + while (&cf->i_list != &ci->i_cap_flush_list) { + struct ceph_cap_flush *next; + + if (cf->tid < first_tid) { + cf = list_next_entry(cf, i_list); continue; + } cap = ci->i_auth_cap; if (!(cap && cap->session == session)) { @@ -2315,6 +2320,7 @@ static void __kick_flushing_caps(struct ceph_mds_client *mdsc, } first_tid = cf->tid + 1; + next = list_next_entry(cf, i_list); if (cf->caps) { dout("kick_flushing_caps %p cap %p tid %llu %s\n", @@ -2357,6 +2363,7 @@ static void __kick_flushing_caps(struct ceph_mds_client *mdsc, } spin_lock(&ci->i_ceph_lock); + cf = next; } } -- 2.34.1

2 1

[PATCH OLK-5.10] ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock
by Chen Yuxi 16 Sep '26

16 Sep '26

From: Xiubo Li <xiubo.li(a)clyso.com> mainline inclusion from mainline-v7.3-rc1 commit 7af4c4f01305b0935adf6d4301b1ec407025485d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19017 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- list_for_each_entry() iterates ci->i_cap_flush_list but drops i_ceph_lock to send cap messages. During the unlock window, handle_cap_flush_ack() can acquire i_ceph_lock, detach cf entries with tid <= flush_tid from the list, release i_ceph_lock, and free them via ceph_free_cap_flush() outside any lock. When the original thread reacquires i_ceph_lock and the for-loop macro advances via cf = list_next_entry(cf, i_list), it dereferences cf->i_list.next on freed memory. The race timeline: __kick_flushing_caps() handle_cap_flush_ack() ----------------------- ----------------------- holds i_ceph_lock <--- iterates to cf (tid=10) prepares FLUSH message drops i_ceph_lock <--- __send_cap() ── FLUSH(tid=10) MDS sends FLUSH_ACK(tid=10) ---> acquires i_ceph_lock cf->tid(10) <= flush_tid(10), detaches cf from i_cap_flush_list drops i_ceph_lock ceph_free_cap_flush(cf) <- frees it! acquires i_ceph_lock <--- for-loop advances: cf = list_next_entry(cf, i_list) -- UAF on freed cf->i_list.next The cf was just sent by __kick_flushing_caps itself via __send_cap(). The MDS may respond with FLUSH_ACK quickly enough that handle_cap_flush_ack() frees cf before __kick_flushing_caps can finish the iteration. Fix by converting to a manual while loop: save the next pointer under i_ceph_lock before dropping it, then use the saved pointer after reacquiring, so the potentially-freed cf is never accessed again. Cc: stable(a)vger.kernel.org Signed-off-by: Xiubo Li <xiubo.li(a)clyso.com> Reviewed-by: Viacheslav Dubeyko <slava(a)dubeyko.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Signed-off-by: Chen Yuxi <chenyuxi19(a)huawei.com> --- fs/ceph/caps.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c index 9bebdafd5ec9..d709edea84ae 100644 --- a/fs/ceph/caps.c +++ b/fs/ceph/caps.c @@ -2513,9 +2513,14 @@ static void __kick_flushing_caps(struct ceph_mds_client *mdsc, } } - list_for_each_entry(cf, &ci->i_cap_flush_list, i_list) { - if (cf->tid < first_tid) + cf = list_first_entry(&ci->i_cap_flush_list, struct ceph_cap_flush, i_list); + while (&cf->i_list != &ci->i_cap_flush_list) { + struct ceph_cap_flush *next; + + if (cf->tid < first_tid) { + cf = list_next_entry(cf, i_list); continue; + } cap = ci->i_auth_cap; if (!(cap && cap->session == session)) { @@ -2525,6 +2530,7 @@ static void __kick_flushing_caps(struct ceph_mds_client *mdsc, } first_tid = cf->tid + 1; + next = list_next_entry(cf, i_list); if (!cf->is_capsnap) { struct cap_msg_args arg; @@ -2565,6 +2571,7 @@ static void __kick_flushing_caps(struct ceph_mds_client *mdsc, } spin_lock(&ci->i_ceph_lock); + cf = next; } } -- 2.34.1

2 1

[PATCH OLK-6.6] ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock
by Chen Yuxi 16 Sep '26

16 Sep '26

From: Xiubo Li <xiubo.li(a)clyso.com> mainline inclusion from mainline-v7.3-rc1 commit 7af4c4f01305b0935adf6d4301b1ec407025485d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19017 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- list_for_each_entry() iterates ci->i_cap_flush_list but drops i_ceph_lock to send cap messages. During the unlock window, handle_cap_flush_ack() can acquire i_ceph_lock, detach cf entries with tid <= flush_tid from the list, release i_ceph_lock, and free them via ceph_free_cap_flush() outside any lock. When the original thread reacquires i_ceph_lock and the for-loop macro advances via cf = list_next_entry(cf, i_list), it dereferences cf->i_list.next on freed memory. The race timeline: __kick_flushing_caps() handle_cap_flush_ack() ----------------------- ----------------------- holds i_ceph_lock <--- iterates to cf (tid=10) prepares FLUSH message drops i_ceph_lock <--- __send_cap() ── FLUSH(tid=10) MDS sends FLUSH_ACK(tid=10) ---> acquires i_ceph_lock cf->tid(10) <= flush_tid(10), detaches cf from i_cap_flush_list drops i_ceph_lock ceph_free_cap_flush(cf) <- frees it! acquires i_ceph_lock <--- for-loop advances: cf = list_next_entry(cf, i_list) -- UAF on freed cf->i_list.next The cf was just sent by __kick_flushing_caps itself via __send_cap(). The MDS may respond with FLUSH_ACK quickly enough that handle_cap_flush_ack() frees cf before __kick_flushing_caps can finish the iteration. Fix by converting to a manual while loop: save the next pointer under i_ceph_lock before dropping it, then use the saved pointer after reacquiring, so the potentially-freed cf is never accessed again. Cc: stable(a)vger.kernel.org Signed-off-by: Xiubo Li <xiubo.li(a)clyso.com> Reviewed-by: Viacheslav Dubeyko <slava(a)dubeyko.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Signed-off-by: Chen Yuxi <chenyuxi19(a)huawei.com> --- fs/ceph/caps.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c index 0ff68e63f5a6..c80a17f82f81 100644 --- a/fs/ceph/caps.c +++ b/fs/ceph/caps.c @@ -2534,9 +2534,14 @@ static void __kick_flushing_caps(struct ceph_mds_client *mdsc, } } - list_for_each_entry(cf, &ci->i_cap_flush_list, i_list) { - if (cf->tid < first_tid) + cf = list_first_entry(&ci->i_cap_flush_list, struct ceph_cap_flush, i_list); + while (&cf->i_list != &ci->i_cap_flush_list) { + struct ceph_cap_flush *next; + + if (cf->tid < first_tid) { + cf = list_next_entry(cf, i_list); continue; + } cap = ci->i_auth_cap; if (!(cap && cap->session == session)) { @@ -2546,6 +2551,7 @@ static void __kick_flushing_caps(struct ceph_mds_client *mdsc, } first_tid = cf->tid + 1; + next = list_next_entry(cf, i_list); if (!cf->is_capsnap) { struct cap_msg_args arg; @@ -2586,6 +2592,7 @@ static void __kick_flushing_caps(struct ceph_mds_client *mdsc, } spin_lock(&ci->i_ceph_lock); + cf = next; } } -- 2.34.1

2 1

[PATCH OLK-6.6] mm: fix double initialization race in mm_counter_try_switch_to_pcpu
by Jinjiang Tu 16 Sep '26

16 Sep '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9960 ---------------------------------------- When CONFIG_MM_COUNTER_ATOMIC is enabled, mm counters start in atomic mode (using count_atomic) for single-threaded processes and switch to percpu mode (using count) upon the first CLONE_THREAD. The switch is performed by mm_counter_try_switch_to_pcpu(), which calls percpu_counter_switch_to_pcpu_many() without any lock protection. If the first switch attempt fails (GFP_ATOMIC allocation failure under memory pressure), the mm remains in atomic mode while the process is now multi-threaded. Subsequent CLONE_THREAD calls from two threads can race into mm_counter_try_switch_to_pcpu() simultaneously: Thread A (CLONE_THREAD) Thread B (CLONE_THREAD) ------------------------- ------------------------- percpu_counter_switch_to_pcpu_many percpu_counter_switch_to_pcpu_many percpu_counter_initialized? false percpu_counter_initialized? false __percpu_counter_init_many __percpu_counter_init_many alloc counters (1st) alloc counters (2nd, leaked) fbc[i].counters = ptr1 fbc[i].counters = ptr2 (overwrite) list_add(&fbc[i].list) list_add(&fbc[i].list) (double add) Both threads pass the percpu_counter_initialized() check before either completes __percpu_counter_init_many(), leading to: - Double percpu memory allocation (first allocation leaked) - Concurrent re-init of fbc[i].lock - Same fbc[i].list node added twice to the global percpu_counters list, corrupting the list and potentially triggering a list_add BUG() Fix this by serializing the switch with mm->arg_lock. This ensures the check-then-init sequence in percpu_counter_switch_to_pcpu_many() is atomic across concurrent CLONE_THREAD callers: if the first caller succeeds, the second observes counters != NULL and returns early; if the first fails, the second retries safely without overlap. Fixes: 46213033b804 ("mm: add config option for atomic mode in mm counter") Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- include/linux/mm.h | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/include/linux/mm.h b/include/linux/mm.h index 5fc9092ea039..dd84843c3029 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -2793,10 +2793,16 @@ static inline s64 get_mm_counter_sum(struct mm_struct *mm, int member) static inline int mm_counter_try_switch_to_pcpu(struct mm_struct *mm) { + int ret; + if (!mm_counter_is_atomic()) return 0; - return percpu_counter_switch_to_pcpu_many(mm->rss_stat, NR_MM_COUNTERS); + spin_lock(&mm->arg_lock); + ret = percpu_counter_switch_to_pcpu_many(mm->rss_stat, NR_MM_COUNTERS); + spin_unlock(&mm->arg_lock); + + return ret; } static inline int mm_counter_init(struct mm_struct *mm) -- 2.43.0

2 1

[PATCH 01/19] arm64/sysreg: Update HCRX_EL2 definition for DDI0601 2023-09
by Qinxin Xia 16 Sep '26

16 Sep '26

From: Mark Brown <broonie(a)kernel.org> mainline inclusion from mainline-6.8 commit 126cb3a60d35cc2ce7db090b087e00ff85b12cfc category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/8904 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------------------------------------- DDI0601 2023-09 defines new fields in HCRX_EL2 controlling access to new system registers, update our definition of HCRX_EL2 to reflect this. Signed-off-by: Mark Brown <broonie(a)kernel.org> Reviewed-by: Fuad Tabba <tabba(a)google.com> Link: https://lore.kernel.org/r/20231209-b4-arm64-sysreg-additions-v1-11-45284e53… Signed-off-by: Will Deacon <will(a)kernel.org> Signed-off-by: Qinxin Xia <xiaqinxin(a)huawei.com> Signed-off-by: Hongye Lin <linhongye(a)h-partners.com> --- arch/arm64/tools/sysreg | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/arch/arm64/tools/sysreg b/arch/arm64/tools/sysreg index 4067136b8863..603456d5e469 100644 --- a/arch/arm64/tools/sysreg +++ b/arch/arm64/tools/sysreg @@ -3124,7 +3124,9 @@ Fields ZCR_ELx EndSysreg Sysreg HCRX_EL2 3 4 1 2 2 -Res0 63:23 +Res0 63:25 +Field 24 PACMEn +Field 23 EnFPM Field 22 GCSEn Field 21 EnIDCP128 Field 20 EnSDERR -- 2.33.0

1 18