- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] tracing/probes: Reject $arg0 in meta argument expansion
by Chen Yuxi 21 Aug '26

21 Aug '26

mainline inclusion from mainline-v7.2-rc6 commit 00a8ce2a2a9fa17674e1feec4d9105c1a5d6a419 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9801 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm… -------------------------------- traceprobe_expand_meta_args() parses $argN with simple_strtoul() and calls sprint_nth_btf_arg(n - 1, ...). For $arg0, n is 0 so the index is -1. Because ctx->nr_params is signed, the "idx >= nr_params" guard in sprint_nth_btf_arg() does not catch the negative index, and ctx->params[-1].name_off is read out of bounds. The normal per-argument path (parse_probe_vars()) already rejects $arg0 via its argument-number check, but meta-argument expansion runs before per-argument parsing and substitutes the value first, bypassing that check. Reject $arg0 explicitly during expansion. Link: https://lore.kernel.org/all/20260724054435.146279-1-raushan.jhon@gmail.com/ Fixes: 18b1e870a496 ("tracing/probes: Add $arg* meta argument for all function args") Cc: stable(a)vger.kernel.org Signed-off-by: Raushan Patel <raushan.jhon(a)gmail.com> Signed-off-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org> Conflicts: kernel/trace/trace_probe.c [commit 4af0532a0f4799d5944ea966c10890dcb4390d19 is not backport] Signed-off-by: Chen Yuxi <chenyuxi19(a)huawei.com> --- kernel/trace/trace_probe.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c index 7a49f45d41a2..8980f4ecd020 100644 --- a/kernel/trace/trace_probe.c +++ b/kernel/trace/trace_probe.c @@ -1565,7 +1565,11 @@ const char **traceprobe_expand_meta_args(int argc, const char *argv[], ret = -ENOENT; goto error; } - /* Note: $argN starts from $arg1 */ + /* Note: $argN starts from $arg1, so $arg0 is invalid. */ + if (n == 0) { + trace_probe_log_err(0, BAD_ARG_NUM); + return ERR_PTR(-EINVAL); + } ret = sprint_nth_btf_arg(n - 1, type, buf + used, bufsize - used, ctx); if (ret < 0) -- 2.34.1

1 0

[PATCH openEuler-1.0-LTS 0/2] *** SUBJECT HERE ***
by Lai Zewei 21 Aug '26

21 Aug '26

*** BLURB HERE *** Lai Zewei (2): nfsd: fix heap overflow in NFSv4.0 LOCK replay cache nfsd: use dynamic allocation for oversized NFSv4.0 replay cache fs/nfsd/nfs4state.c | 16 ++++++++++++++++ fs/nfsd/nfs4xdr.c | 18 ++++++++++++++++-- fs/nfsd/state.h | 21 +++++++++++++++------ 3 files changed, 47 insertions(+), 8 deletions(-) -- 2.52.0

2 3

[PATCH OLK-6.6] binfmt_misc: reject a flag character as the field delimiter
by Luo Gengkun 21 Aug '26

21 Aug '26

From: Christian Brauner <brauner(a)kernel.org> stable inclusion from stable-v6.6.151 commit 1819f82dee766c58295ecaacdac02cdf6837d7a4 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17790 CVE: CVE-2026-74485 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- commit 8e85d50ba1117fd446bf9a250bd8a97d48384bdc upstream. The registration string starts with a user chosen delimiter that separates the individual fields. So that the field parsers terminate even on a truncated string create_entry() pads the buffer with that same delimiter: memset(buf + count, del, 8); Most fields are scanned for the delimiter with strchr()/scanarg() and happily stop on the padding. The flags field is different: instead of scanning for the delimiter check_special_flags() consumes the flag characters 'P', 'O', 'C' and 'F' and stops at the first byte that is none of them, relying on the trailing delimiter to end the scan. If the delimiter is itself a flag character the padding no longer acts as a terminator. The scan swallows all eight padding bytes and keeps reading past the end of the allocation until it hits a byte that is not a flag character. For example registering PaPEPPxPPiP with 'P' as the delimiter (name "a", type extension, magic "x", interpreter "i", empty flags) leaves the flag scan running off the end of the buffer. The registration is rejected in the end because the parser does not stop exactly at buf + count, but only after the out of bounds read has already happened. With an unlucky allocation layout the scan can walk into an unmapped page; under KASAN it is reported as a slab out of bounds read. binfmt_misc mounts are available to unprivileged users in a user namespace so the read is reachable without privileges. Reject a delimiter that is one of the flag characters up front. Such a registration was always rejected anyway, only after the out of bounds read, so no valid registration string changes meaning. Link: https://patch.msgid.link/20260710-work-binfmt_misc-locking-v3-3-a162f7cb58d… Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable(a)vger.kernel.org Signed-off-by: Christian Brauner (Amutable) <brauner(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- fs/binfmt_misc.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/binfmt_misc.c b/fs/binfmt_misc.c index bf954bac70a9..5f6e354cb565 100644 --- a/fs/binfmt_misc.c +++ b/fs/binfmt_misc.c @@ -349,6 +349,10 @@ static Node *create_entry(const char __user *buffer, size_t count) pr_debug("register: delim: %#x {%c}\n", del, del); + /* A flag-char delimiter runs the flag scan off the buffer. */ + if (del == 'P' || del == 'O' || del == 'C' || del == 'F') + goto einval; + /* Pad the buffer with the delim to simplify parsing below. */ memset(buf + count, del, 8); -- 2.34.1

2 1

[PATCH OLK-6.6] nvmet-tcp: fix page fragment cache leak in error path
by Lai Zewei 21 Aug '26

21 Aug '26

mainline inclusion from mainline-v7.2-rc1 commit 4dae393956093c807212918fd91a8fc70df15338 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17264 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In nvmet_tcp_alloc_queue(), when a connection is closed during the allocation process (e.g., nvmet_tcp_set_queue_sock() returns -ENOTCONN), the error handling jumps to out_destroy_sq and then to out_ida_remove without draining the page fragment cache. Although nvmet_tcp_free_cmd() is called in some error paths to release individual page fragments, the underlying page cache reference held by queue->pf_cache is never released. The first allocation using pf_cache is the call to nvmet_tcp_alloc_cmd() for queue->connect, which happens after ida_alloc() returns successfully. This results in a page leak each time a connection fails during allocation, which could lead to memory exhaustion over time if connections are repeatedly opened and closed. Fix this by calling page_frag_cache_drain() before freeing the queue structure in the out_ida_remove label. Fixes: 872d26a391da ("nvmet-tcp: add NVMe over TCP target driver") Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Geliang Tang <tanggeliang(a)kylinos.cn> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Conflicts: drivers/nvme/target/tcp.c [ctx conflicts] Signed-off-by: Lai Zewei <laizewei3(a)huawei.com> --- drivers/nvme/target/tcp.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c index 6c6197a53fa3..fb6af1be694f 100644 --- a/drivers/nvme/target/tcp.c +++ b/drivers/nvme/target/tcp.c @@ -1754,6 +1754,14 @@ static int nvmet_tcp_alloc_queue(struct nvmet_tcp_port *port, nvmet_tcp_free_cmd(&queue->connect); out_ida_remove: ida_free(&nvmet_tcp_queue_ida, queue->idx); + /* + * Drain the page fragment cache if any allocations were done. + * The first allocation using pf_cache is nvmet_tcp_alloc_cmd() + * for queue->connect after ida_alloc(). + */ + if (queue->pf_cache.va) + __page_frag_cache_drain(virt_to_head_page(queue->pf_cache.va), + queue->pf_cache.pagecnt_bias); out_free_queue: kfree(queue); return ret; -- 2.52.0

2 1

[PATCH openEuler-1.0-LTS 0/2] *** SUBJECT HERE ***
by Lai Zewei 20 Aug '26

20 Aug '26

*** BLURB HERE *** Lai Zewei (2): nfsd: fix heap overflow in NFSv4.0 LOCK replay cache nfsd: use dynamic allocation for oversized NFSv4.0 replay cache fs/nfsd/nfs4state.c | 16 ++++++++++++++++ fs/nfsd/nfs4xdr.c | 18 ++++++++++++++++-- fs/nfsd/state.h | 21 +++++++++++++++------ 3 files changed, 47 insertions(+), 8 deletions(-) -- 2.52.0

2 3

[PATCH openEuler-1.0-LTS 0/2] *** SUBJECT HERE ***
by Lai Zewei 20 Aug '26

20 Aug '26

*** BLURB HERE *** Lai Zewei (2): nfsd: fix heap overflow in NFSv4.0 LOCK replay cache nfsd: use dynamic allocation for oversized NFSv4.0 replay cache fs/nfsd/nfs4state.c | 16 ++++++++++++++++ fs/nfsd/nfs4xdr.c | 18 ++++++++++++++++-- fs/nfsd/state.h | 21 +++++++++++++++------ 3 files changed, 47 insertions(+), 8 deletions(-) -- 2.52.0

2 3

[PATCH OLK-6.6 0/4] *** SUBJECT HERE ***
by Lu Chentao 20 Aug '26

20 Aug '26

*** BLURB HERE *** Lu Chentao (4): [OLK-6.6] cifs: prevent readdir from changing file size due to stale directory metadata [OLK-6.6] cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths [OLK-6.6] cifs: consolidate time_last_write stamp into _cifsFileInfo_put() [OLK-6.6] cifs: fix time_last_write stamp placement in setattr/truncate paths fs/smb/client/cifsfs.c | 1 + fs/smb/client/cifsglob.h | 1 + fs/smb/client/file.c | 65 ++++++++++++++++++++++++++++++++++++---- fs/smb/client/inode.c | 25 +++++++++++++++- fs/smb/client/misc.c | 27 +++++++++++++---- 5 files changed, 106 insertions(+), 13 deletions(-) -- 2.52.0

2 5

[PATCH OLK-6.6 00/16] backport minios part3 patches from linux mainline
by Qinxin Xia 20 Aug '26

20 Aug '26

From: Hongye Lin <linhongye(a)h-partners.com> driver inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/8904 ---------------------------------------------------------------------- backport minios part3 patches from linux mainline Andre Przywara (1): kselftest/arm64: hwcap: fix f8dp2 cpuinfo name Mark Brown (14): kselftest/arm64: Handle FPMR context in generic signal frame parser kselftest/arm64: Add basic FPMR test kselftest/arm64: Add 2023 DPISA hwcap test coverage arm64/sve: Report FEAT_SVE_B16B16 to userspace arm64/sysreg: Update ID_AA64FPFR0_EL1 to DDI0601 2024-09 arm64/sysreg: Update ID_AA64ZFR0_EL1 to DDI0601 2024-09 arm64/sysreg: Update ID_AA64ISAR2_EL1 to DDI0601 2024-09 arm64/sysreg: Update ID_AA64SMFR0_EL1 to DDI0601 2024-12 arm64/hwcap: Describe 2024 dpISA extensions to userspace arm64/hwcap: Remove stray references to SF8MMx arm64: Add missing registrations of hwcaps kselftest/arm64: Verify HWCAP2_SVE_B16B16 kselftest/arm64: Fix encoding for SVE B16B16 test kselftest/arm64: Add 2024 dpISA extensions to hwcap test Yifan Wu (1): selftests/arm64: Implement cmpbr_sigill() to hwcap test .../arch/arm64/cpu-feature-registers.rst | 2 + Documentation/arch/arm64/elf_hwcaps.rst | 53 +++ arch/arm64/include/asm/hwcap.h | 16 + arch/arm64/include/uapi/asm/hwcap.h | 17 + arch/arm64/kernel/cpufeature.c | 35 ++ arch/arm64/kernel/hwcap_str.h | 16 + arch/arm64/tools/sysreg | 62 ++- tools/testing/selftests/arm64/abi/hwcap.c | 449 ++++++++++++++++++ .../testing/selftests/arm64/signal/.gitignore | 1 + .../arm64/signal/testcases/fpmr_siginfo.c | 82 ++++ .../arm64/signal/testcases/testcases.c | 8 + .../arm64/signal/testcases/testcases.h | 1 + 12 files changed, 735 insertions(+), 7 deletions(-) create mode 100644 tools/testing/selftests/arm64/signal/testcases/fpmr_siginfo.c -- 2.33.0

2 17

[PATCH openEuler-1.0-LTS 0/2] *** SUBJECT HERE ***
by Lai Zewei 20 Aug '26

20 Aug '26

*** BLURB HERE *** Lai Zewei (2): nfsd: fix heap overflow in NFSv4.0 LOCK replay cache nfsd: use dynamic allocation for oversized NFSv4.0 replay cache fs/nfsd/nfs4state.c | 16 ++++++++++++++++ fs/nfsd/nfs4xdr.c | 18 ++++++++++++++++-- fs/nfsd/state.h | 21 +++++++++++++++------ 3 files changed, 47 insertions(+), 8 deletions(-) -- 2.52.0

2 3

[PATCH OLK-6.6] bpf: Mask pseudo pointer values in verifier logs
by Pu Lehui 20 Aug '26

20 Aug '26

From: Nuoqi Gui <gnq25(a)mails.tsinghua.edu.cn> mainline inclusion from mainline-v7.2-rc2 commit 72a85e9464a5332fb2cd7efd26d9295275ceda2d category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9793 CVE: CVE-2026-72402 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- print_bpf_insn() masks ldimm64 immediates for pointer-bearing pseudo sources when pointer leaks are not allowed, but the mask only covers BPF_PSEUDO_MAP_FD and BPF_PSEUDO_MAP_VALUE. BPF_PSEUDO_MAP_IDX, BPF_PSEUDO_MAP_IDX_VALUE, and BPF_PSEUDO_BTF_ID can also be resolved to kernel pointer values before the verifier log prints the instruction. Include them in the existing pointer classification so the log prints 0x0 instead of the rewritten address. Fixes: 4976b718c355 ("bpf: Introduce pseudo_btf_id") Fixes: 387544bfa291 ("bpf: Introduce fd_idx") Signed-off-by: Nuoqi Gui <gnq25(a)mails.tsinghua.edu.cn> Link: https://lore.kernel.org/r/20260623-f01-13-pseudo-btf-id-cap-bpf-v2-1-a190eb… Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Acked-by: Eduard Zingerman <eddyz87(a)gmail.com> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/disasm.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/kernel/bpf/disasm.c b/kernel/bpf/disasm.c index 49940c26a227..cc3c9792c4a6 100644 --- a/kernel/bpf/disasm.c +++ b/kernel/bpf/disasm.c @@ -287,7 +287,10 @@ void print_bpf_insn(const struct bpf_insn_cbs *cbs, */ u64 imm = ((u64)(insn + 1)->imm << 32) | (u32)insn->imm; bool is_ptr = insn->src_reg == BPF_PSEUDO_MAP_FD || - insn->src_reg == BPF_PSEUDO_MAP_VALUE; + insn->src_reg == BPF_PSEUDO_MAP_VALUE || + insn->src_reg == BPF_PSEUDO_MAP_IDX || + insn->src_reg == BPF_PSEUDO_MAP_IDX_VALUE || + insn->src_reg == BPF_PSEUDO_BTF_ID; char tmp[64]; if (is_ptr && !allow_ptr_leaks) -- 2.34.1

2 1