- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 0/2] mainline patch
by Luo Gengkun 20 Jul '26

20 Jul '26

Aboorva Devarajan (1): powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del Zide Chen (1): perf/x86/intel/uncore: Fix PCI device refcount leak in UPI discovery arch/powerpc/perf/core-fsl-emb.c | 3 ++- arch/x86/events/intel/uncore_snbep.c | 6 +++--- 2 files changed, 5 insertions(+), 4 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] gcov: use atomic counter updates to fix concurrent access crashes
by Luo Gengkun 20 Jul '26

20 Jul '26

From: Konstantin Khorenko <khorenko(a)virtuozzo.com> mainline inclusion from mainline-v7.2-rc1 commit 56cb9b7d96b28a1173a510ab25354b6599ad3a33 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16154 CVE: CVE-2026-63825 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- GCC's GCOV instrumentation can merge global branch counters with loop induction variables as an optimization. In inflate_fast(), the inner copy loops get transformed so that the GCOV counter value is loaded multiple times to compute the loop base address, start index, and end bound. Since GCOV counters are global (not per-CPU), concurrent execution on different CPUs causes the counter to change between loads, producing inconsistent values and out-of-bounds memory writes. The crash manifests during IPComp (IP Payload Compression) processing when inflate_fast() runs concurrently on multiple CPUs: BUG: unable to handle page fault for address: ffffd0a3c0902ffa RIP: inflate_fast+1431 Call Trace: zlib_inflate __deflate_decompress crypto_comp_decompress ipcomp_decompress [xfrm_ipcomp] ipcomp_input [xfrm_ipcomp] xfrm_input At the crash point, the compiler generated three loads from the same global GCOV counter (__gcov0.inflate_fast+216) to compute base, start, and end for an indexed loop. Another CPU modified the counter between loads, making the values inconsistent - the write went 3.4 MB past a 65 KB buffer. Add -fprofile-update=prefer-atomic to CFLAGS_GCOV at the global level in the top-level Makefile, guarded by a try-run compile test. The test compiles a minimal program with and without -fprofile-update=prefer-atomic using the full KBUILD_CFLAGS, then compares undefined symbols in the resulting object files. If prefer-atomic introduces new undefined references (such as __atomic_fetch_add_8 on i386 or __aarch64_ldadd8_relax on arm64 with outline-atomics), the flag is not added -- the kernel does not link against libatomic. On architectures where GCC inlines 64-bit atomic counter updates (x86_64, s390, ...) the test passes and the flag is enabled, preventing the compiler from merging counters with loop induction variables and fixing the observed concurrent-access crash. On architectures where the flag would introduce libatomic dependencies, it is silently omitted and behaviour is no worse than before this patch. Move the CFLAGS_GCOV block from its original position (before the arch Makefile include) to after the core KBUILD_CFLAGS assignments but before the scripts/Makefile.gcc-plugins include. This placement ensures the try-run test sees arch-specific flags (-m32, -march=, -mno-outline-atomics) while avoiding GCC plugin flags (-fplugin=) that would break the test on clean builds when plugin shared objects do not yet exist. Link: https://lore.kernel.org/20260511105052.417187-2-khorenko@virtuozzo.com Signed-off-by: Konstantin Khorenko <khorenko(a)virtuozzo.com> Tested-by: Arnd Bergmann <arnd(a)arndb.de> Tested-by: Peter Oberparleiter <oberpar(a)linux.ibm.com> Reviewed-by: Peter Oberparleiter <oberpar(a)linux.ibm.com> Cc: Masahiro Yamada <masahiroy(a)kernel.org> Cc: Miguel Ojeda <ojeda(a)kernel.org> Cc: Mikhail Zaslonko <zaslonko(a)linux.ibm.com> Cc: Nathan Chancellor <nathan(a)kernel.org> Cc: Pavel Tikhomirov <ptikhomirov(a)virtuozzo.com> Cc: Thomas Weißschuh <linux(a)weissschuh.net> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: Makefile [Fix ctx diff.] Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- Makefile | 27 +++++++++++++++++++++------ 1 file changed, 21 insertions(+), 6 deletions(-) diff --git a/Makefile b/Makefile index 2920c35a0831..bd7e86c16447 100644 --- a/Makefile +++ b/Makefile @@ -753,12 +753,6 @@ all: vmlinux CFLAGS_PGO_CLANG := -fprofile-generate export CFLAGS_PGO_CLANG -CFLAGS_GCOV := -fprofile-arcs -ftest-coverage -ifdef CONFIG_CC_IS_GCC -CFLAGS_GCOV += -fno-tree-loop-im -endif -export CFLAGS_GCOV - # The arch Makefiles can override CC_FLAGS_FTRACE. We may also append it later. ifdef CONFIG_FUNCTION_TRACER CC_FLAGS_FTRACE := -pg @@ -1006,6 +1000,27 @@ endif # Ensure compilers do not transform certain loops into calls to wcslen() KBUILD_CFLAGS += -fno-builtin-wcslen +CFLAGS_GCOV := -fprofile-arcs -ftest-coverage +ifdef CONFIG_CC_IS_GCC +CFLAGS_GCOV += -fno-tree-loop-im +# Use atomic counter updates to avoid concurrent-access crashes in GCOV. +# Only enable if -fprofile-update=prefer-atomic does not introduce new +# undefined symbols (e.g. libatomic calls that the kernel cannot link). +CFLAGS_GCOV += $(call try-run,\ + echo 'long long x; void f(void){x++;}' | \ + $(CC) $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS) -w -fprofile-arcs \ + -ftest-coverage -x c - -c -o "$$TMP.base" && \ + echo 'long long x; void f(void){x++;}' | \ + $(CC) $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS) -w -fprofile-arcs \ + -ftest-coverage -fprofile-update=prefer-atomic \ + -x c - -c -o "$$TMP" && \ + $(NM) "$$TMP.base" | grep ' U ' > "$$TMP.ubase" || true ; \ + $(NM) "$$TMP" | grep ' U ' > "$$TMP.utest" || true ; \ + cmp -s "$$TMP.ubase" "$$TMP.utest",\ + -fprofile-update=prefer-atomic) +endif +export CFLAGS_GCOV + # change __FILE__ to the relative path from the srctree KBUILD_CPPFLAGS += $(call cc-option,-fmacro-prefix-map=$(srctree)/=) -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] mainline patch
by Luo Gengkun 20 Jul '26

20 Jul '26

Aboorva Devarajan (1): powerpc/perf: fix preempt count underflow in fsl_emb_pmu_del Zide Chen (1): perf/x86/intel/uncore: Fix PCI device refcount leak in UPI discovery arch/powerpc/perf/core-fsl-emb.c | 3 ++- arch/x86/events/intel/uncore_snbep.c | 6 +++--- 2 files changed, 5 insertions(+), 4 deletions(-) -- 2.34.1

1 0

[PATCH OLK-6.6 0/5] bonding: 3ad: fix data-race in port->aggregator (CVE-2026-52975)
by superdcc97＠163.com 20 Jul '26

20 Jul '26

From: Dong Chenchen <dongchenchen2(a)huawei.com> CVE-2026-52975: syzbot found a data-race in bond_3ad_get_active_agg_info / bond_3ad_state_machine_handler which hints at lack of proper RCU implementation. This series fixes the data-race by: 1. Adding per-port LACP actor priority support (Stable-dep-of prerequisite) 2. Adding churn state netlink support (Stable-dep-of prerequisite) 3. Adding broadcast_neighbor option for 802.3ad (Stable-dep-of prerequisite) 4. Implementing proper RCU rules for port->aggregator (CVE main fix) 5. Fixing NULL pointer dereference in actor_port_prio setting (bugfix for patch 1) Note: Patch "bonding: 802.3ad replace MAC_ADDRESS_EQUAL with __agg_has_partner" was skipped as the changes are already present in the OLK-6.6 target branch. Patch 3 has conflicts due to OLK-specific sysctl_bond_broadcast_arp_or_nd infrastructure which was replaced with the upstream broadcast_neighbor netlink option approach using static keys. The existing OLK-6.6 broadcast_neighbor bugfixes (commits 2d8fa9bb7154 and 9dda3abfbe01, adaptations of upstream e0caeb24f538 and 45fc134bcfad) are already present on the target branch and remain functional after the CVE adaptation. No re-adaptation of these bugfixes was necessary. Dong Chenchen (3): bonding: add support for per-port LACP actor priority net: bonding: add broadcast_neighbor option for 802.3ad bonding: fix NULL pointer dereference in actor_port_prio setting Eric Dumazet (1): bonding: 3ad: implement proper RCU rules for port->aggregator Hangbin Liu (1): bonding: print churn state via netlink Documentation/networking/bonding.rst | 15 ++++ drivers/net/bonding/bond_3ad.c | 113 ++++++++++++++----------- drivers/net/bonding/bond_main.c | 74 +++++++++++++--- drivers/net/bonding/bond_netlink.c | 37 +++++++- drivers/net/bonding/bond_options.c | 71 ++++++++++++++++ drivers/net/bonding/bond_procfs.c | 3 +- drivers/net/bonding/bond_sysfs_slave.c | 17 ++-- include/net/bond_3ad.h | 3 +- include/net/bond_options.h | 2 + include/net/bonding.h | 3 + include/uapi/linux/if_link.h | 3 + 11 files changed, 270 insertions(+), 71 deletions(-) -- 2.43.0

2 6

[PATCH OLK-6.6] perf/x86/intel/uncore: Fix PCI device refcount leak in UPI discovery
by Luo Gengkun 20 Jul '26

20 Jul '26

From: Zide Chen <zide.chen(a)intel.com> mainline inclusion from mainline-v7.2-rc1 commit 81ec618f59415bdcf3e8989e2691c1f240be27fb category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16325 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- pci_get_domain_bus_and_slot() increments the reference count of the returned PCI device and therefore requires a matching pci_dev_put(). In skx_upi_topology_cb() and discover_upi_topology(), the lookup is performed inside a loop, but pci_dev_put() is only called once after the loop. As a result, references from all previous iterations are leaked. Move pci_dev_put(dev) into the if (dev) block immediately after upi_fill_topology() returns. Opportunistically, fix uninitialized variable in skx_upi_topology_cb(). Fixes: 4cfce57fa42d ("perf/x86/intel/uncore: Enable UPI topology discovery for Skylake Server") Fixes: f680b6e6062e ("perf/x86/intel/uncore: Enable UPI topology discovery for Icelake Server") Signed-off-by: Zide Chen <zide.chen(a)intel.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Reviewed-by: Dapeng Mi <dapeng1.mi(a)linux.intel.com> Link: https://patch.msgid.link/20260602144908.263680-4-zide.chen@intel.com Conflicts: arch/x86/events/intel/uncore_snbep.c [Fix ctx diff.] Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- arch/x86/events/intel/uncore_snbep.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c index 65d30e7501e3..e696d13a578c 100644 --- a/arch/x86/events/intel/uncore_snbep.c +++ b/arch/x86/events/intel/uncore_snbep.c @@ -4326,7 +4326,7 @@ static int upi_fill_topology(struct pci_dev *dev, struct intel_uncore_topology * static int skx_upi_topology_cb(struct intel_uncore_type *type, int segment, int die, u64 cpu_bus_msr) { - int idx, ret; + int idx, ret = 0; struct intel_uncore_topology *upi; unsigned int devfn; struct pci_dev *dev = NULL; @@ -4339,12 +4339,12 @@ static int skx_upi_topology_cb(struct intel_uncore_type *type, int segment, dev = pci_get_domain_bus_and_slot(segment, bus, devfn); if (dev) { ret = upi_fill_topology(dev, upi, idx); + pci_dev_put(dev); if (ret) break; } } - pci_dev_put(dev); return ret; } @@ -5592,6 +5592,7 @@ static int discover_upi_topology(struct intel_uncore_type *type, int ubox_did, i devfn); if (dev) { ret = upi_fill_topology(dev, upi, idx); + pci_dev_put(dev); if (ret) goto err; } @@ -5601,7 +5602,6 @@ static int discover_upi_topology(struct intel_uncore_type *type, int ubox_did, i } err: pci_dev_put(ubox); - pci_dev_put(dev); return ret; } -- 2.34.1

2 1

[PATCH OLK-6.6 0/7] CVE-2026-45905: xfrm icmp_route_lookup reverse path race fix for OLK-6.6
by superdcc97＠163.com 20 Jul '26

20 Jul '26

From: Dong Chenchen <dongchenchen2(a)huawei.com> This series backports the CVE-2026-45905 fix and its required LTS-6.6 prerequisites to OLK-6.6. It converts ip_route_input() and icmp_route_lookup() to dscp_t, adds the skb_dstref_steal/restore helpers, and finally fixes the ip_rt_bug race in the XFRM ICMP reverse path. Because OLK-6.6 already contains an earlier partial backport of cve-001 ("ipvlan: ensure network headers are in skb linear part") and cve-010 ("net: Add skb_dstref_steal and skb_dstref_restore"), those two patches are omitted as redundant. The remaining ipvlan-specific prerequisites (cve-002 and cve-005) cannot be cleanly applied against the OLK-6.6 version of ipvlan_core.c without conflicting with the existing partial backport, so they are also skipped. The functional CVE-2026-45905 fix is fully applied. Guillaume Nault (2): ipv4: Convert icmp_route_lookup() to dscp_t. ipv4: Convert ip_route_input() to dscp_t. Ido Schimmel (2): ipv4: icmp: Pass full DS field to ip_route_input() ipv4: icmp: Unmask upper DSCP bits in icmp_route_lookup() Jiayuan Chen (1): xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path Peilin He (1): net/ipv4: add tracepoint for icmp_send Stanislav Fomichev (1): net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers include/net/ip.h | 5 +++ include/net/route.h | 5 ++- include/trace/events/icmp.h | 67 +++++++++++++++++++++++++++++++++ net/bridge/br_netfilter_hooks.c | 8 ++-- net/ipv4/icmp.c | 46 +++++++++++++++------- net/ipv4/ip_options.c | 8 ++-- net/ipv6/ip6_tunnel.c | 4 +- 7 files changed, 119 insertions(+), 24 deletions(-) create mode 100644 include/trace/events/icmp.h -- 2.43.0

2 8

[PATCH OLK-6.6] ixgbevf: fix use-after-free in VEPA multicast source pruning
by Luo Gengkun 20 Jul '26

20 Jul '26

From: Michael Bommarito <michael.bommarito(a)gmail.com> stable inclusion from stable-v6.6.142 commit add70e2682c0ad3be2a5810bcf1bc13963ba4df9 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16356 CVE: CVE-2026-64113 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- commit 5d49b568c188dc77199d8d2b959c91da8cc27cf1 upstream. ixgbevf_clean_rx_irq() prunes frames whose source MAC matches the VF's own address (VEPA multicast workaround) by freeing the skb and continuing to the next descriptor: dev_kfree_skb_irq(skb); continue; The skb pointer is declared outside the while loop and persists across iterations. Because the continue skips the "skb = NULL" reset at the bottom of the loop, the next iteration enters the "else if (skb)" path and calls ixgbevf_add_rx_frag() on the freed skb, dereferencing skb_shinfo(skb)->nr_frags - a use-after-free in NAPI softirq context. The sibling driver iavf already handles this correctly by nulling the pointer before continuing. Apply the same pattern here. I do not have ixgbevf hardware; the bug was found by static analysis (scan_drop_continue_loops.py + semgrep drop_continue_in_loop, multi-tool corroboration with the highest score in the scan). The UAF was confirmed under KASAN by loading a test module that reproduces the exact code pattern (alloc skb, kfree_skb, then read skb_shinfo(skb)->nr_frags): BUG: KASAN: slab-use-after-free in ixgbevf_uaf_test_init+0x100/0x1000 Read of size 8 at addr 000000006163ae78 by task insmod/30 freed 208-byte region [000000006163adc0, 000000006163ae90) QEMU emulates igb (82576) but not ixgbe (82599), and the igbvf VF driver does not include the VEPA source pruning path, so a full end-to-end reproduction with emulated hardware was not possible. Fixes: bad17234ba70 ("ixgbevf: Change receive model to use double buffered page based receives") Cc: stable(a)vger.kernel.org Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Tested-by: Rafal Romanowski <rafal.romanowski(a)intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com> Link: https://patch.msgid.link/20260515182419.1597859-8-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c index 72b17a0f052c..99d6aa03d4b6 100644 --- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c +++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c @@ -1225,6 +1225,7 @@ static int ixgbevf_clean_rx_irq(struct ixgbevf_q_vector *q_vector, ether_addr_equal(rx_ring->netdev->dev_addr, eth_hdr(skb)->h_source)) { dev_kfree_skb_irq(skb); + skb = NULL; continue; } -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] net: Fix CVE-2026-53264
by Dong Chenchen 20 Jul '26

20 Jul '26

net: Fix CVE-2026-53264 Dong Chenchen (1): net: Fix kabi breakage of struct tc_action Jamal Hadi Salim (1): net/sched: act_api: use RCU with deferred freeing for action lifecycle include/net/act_api.h | 7 +++++++ net/sched/act_api.c | 26 ++++++++++++++++++++------ 2 files changed, 27 insertions(+), 6 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6 0/3] bonding: Fix CVE-2026-43456
by Dong Chenchen 20 Jul '26

20 Jul '26

Fix CVE-2026-43456 Dong Chenchen (1): net: Fix kabi breakage of struct header_ops Eric Dumazet (1): bonding: prevent potential infinite loop in bond_header_parse() Jiayuan Chen (1): bonding: fix type confusion in bond_setup_by_slave() drivers/net/bonding/bond_main.c | 53 ++++++++++++++++++++++++++++++++- include/linux/netdevice.h | 15 +++++++--- 2 files changed, 63 insertions(+), 5 deletions(-) -- 2.25.1

2 4

[PATCH OLK-6.6 0/4] net: Fix CVE-2026-53091
by Dong Chenchen 20 Jul '26

20 Jul '26

Fix CVE-2026-53091 Cosmin Ratiu (1): xfrm: Don't clobber inner headers when already set Eric Dumazet (2): net: qdisc_pkt_len_segs_init() cleanup net: pull headers in qdisc_pkt_len_segs_init() Fengyuan Gong (1): net: account for encap headers in qdisc pkt len net/core/dev.c | 79 ++++++++++++++++++++++++++---------------- net/sched/sch_cake.c | 5 ++- net/xfrm/xfrm_output.c | 20 +++++++---- 3 files changed, 67 insertions(+), 37 deletions(-) -- 2.25.1

2 5