- Kernel - mailweb.openeuler.org

[openeuler:OLK-6.6 3508/3508] htmldocs: ./include/net/cfg80211.h:5891: warning: Excess function parameter 'work' description in 'wiphy_delayed_work_flush'
by kernel test robot 10 Dec '25

10 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 413c8958a89da414e792cff13c7ddb1217f8a693 commit: 394bc797fb96f1eda8dac440dd97e673115d7c78 [3508/3508] wifi: cfg80211: fix kernel-doc for wiphy_delayed_work_flush() reproduce: (https://download.01.org/0day-ci/archive/20251210/202512101158.SZfSVzDP-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512101158.SZfSVzDP-lkp@intel.com/ All warnings (new ones prefixed by >>): Error: Cannot open file ./include/linux/of_graph.h Error: Cannot open file ./include/linux/of_device.h Error: Cannot open file ./include/linux/of_device.h Error: Cannot open file ./include/linux/of_platform.h Error: Cannot open file ./include/linux/of_platform.h >> ./include/net/cfg80211.h:5891: warning: Excess function parameter 'work' description in 'wiphy_delayed_work_flush' >> ./include/net/cfg80211.h:5891: warning: Excess function parameter 'work' description in 'wiphy_delayed_work_flush' >> ./include/net/cfg80211.h:5891: warning: Excess function parameter 'work' description in 'wiphy_delayed_work_flush' >> ./include/net/cfg80211.h:5891: warning: Excess function parameter 'work' description in 'wiphy_delayed_work_flush' >> ./include/net/cfg80211.h:5891: warning: Excess function parameter 'work' description in 'wiphy_delayed_work_flush' >> ./include/net/cfg80211.h:5891: warning: Excess function parameter 'work' description in 'wiphy_delayed_work_flush' >> ./include/net/cfg80211.h:5891: warning: Excess function parameter 'work' description in 'wiphy_delayed_work_flush' >> ./include/net/cfg80211.h:5891: warning: Excess function parameter 'work' description in 'wiphy_delayed_work_flush' >> ./include/net/cfg80211.h:5891: warning: Excess function parameter 'work' description in 'wiphy_delayed_work_flush' >> ./include/net/cfg80211.h:5891: warning: Excess function parameter 'work' description in 'wiphy_delayed_work_flush' >> ./include/net/cfg80211.h:5891: warning: Excess function parameter 'work' description in 'wiphy_delayed_work_flush' >> ./include/net/cfg80211.h:5891: warning: Excess function parameter 'work' description in 'wiphy_delayed_work_flush' >> ./include/net/cfg80211.h:5891: warning: Excess function parameter 'work' description in 'wiphy_delayed_work_flush' >> ./include/net/cfg80211.h:5891: warning: Excess function parameter 'work' description in 'wiphy_delayed_work_flush' >> ./include/net/cfg80211.h:5891: warning: Excess function parameter 'work' description in 'wiphy_delayed_work_flush' >> ./include/net/cfg80211.h:5891: warning: Excess function parameter 'work' description in 'wiphy_delayed_work_flush' >> ./include/net/cfg80211.h:5891: warning: Excess function parameter 'work' description in 'wiphy_delayed_work_flush' Error: Cannot open file ./include/linux/aperture.h Error: Cannot open file ./include/linux/aperture.h Error: Cannot open file ./include/linux/auxiliary_bus.h Error: Cannot open file ./include/linux/auxiliary_bus.h Error: Cannot open file ./include/linux/auxiliary_bus.h vim +5891 ./include/net/cfg80211.h a3ee4dc84c4e9d Johannes Berg 2023-06-06 5853 a3ee4dc84c4e9d Johannes Berg 2023-06-06 5854 /** a3ee4dc84c4e9d Johannes Berg 2023-06-06 5855 * wiphy_delayed_work_queue - queue delayed work for the wiphy a3ee4dc84c4e9d Johannes Berg 2023-06-06 5856 * @wiphy: the wiphy to queue for a3ee4dc84c4e9d Johannes Berg 2023-06-06 5857 * @dwork: the delayable worker a3ee4dc84c4e9d Johannes Berg 2023-06-06 5858 * @delay: number of jiffies to wait before queueing a3ee4dc84c4e9d Johannes Berg 2023-06-06 5859 * a3ee4dc84c4e9d Johannes Berg 2023-06-06 5860 * This is useful for work that must be done asynchronously, and work a3ee4dc84c4e9d Johannes Berg 2023-06-06 5861 * queued here has the special property that the wiphy mutex will be a3ee4dc84c4e9d Johannes Berg 2023-06-06 5862 * held as if wiphy_lock() was called, and that it cannot be running a3ee4dc84c4e9d Johannes Berg 2023-06-06 5863 * after wiphy_lock() was called. Therefore, wiphy_cancel_work() can a3ee4dc84c4e9d Johannes Berg 2023-06-06 5864 * use just cancel_work() instead of cancel_work_sync(), it requires a3ee4dc84c4e9d Johannes Berg 2023-06-06 5865 * being in a section protected by wiphy_lock(). a3ee4dc84c4e9d Johannes Berg 2023-06-06 5866 */ a3ee4dc84c4e9d Johannes Berg 2023-06-06 5867 void wiphy_delayed_work_queue(struct wiphy *wiphy, a3ee4dc84c4e9d Johannes Berg 2023-06-06 5868 struct wiphy_delayed_work *dwork, a3ee4dc84c4e9d Johannes Berg 2023-06-06 5869 unsigned long delay); a3ee4dc84c4e9d Johannes Berg 2023-06-06 5870 a3ee4dc84c4e9d Johannes Berg 2023-06-06 5871 /** a3ee4dc84c4e9d Johannes Berg 2023-06-06 5872 * wiphy_delayed_work_cancel - cancel previously queued delayed work a3ee4dc84c4e9d Johannes Berg 2023-06-06 5873 * @wiphy: the wiphy, for debug purposes a3ee4dc84c4e9d Johannes Berg 2023-06-06 5874 * @dwork: the delayed work to cancel a3ee4dc84c4e9d Johannes Berg 2023-06-06 5875 * a3ee4dc84c4e9d Johannes Berg 2023-06-06 5876 * Cancel the work *without* waiting for it, this assumes being a3ee4dc84c4e9d Johannes Berg 2023-06-06 5877 * called under the wiphy mutex acquired by wiphy_lock(). a3ee4dc84c4e9d Johannes Berg 2023-06-06 5878 */ a3ee4dc84c4e9d Johannes Berg 2023-06-06 5879 void wiphy_delayed_work_cancel(struct wiphy *wiphy, a3ee4dc84c4e9d Johannes Berg 2023-06-06 5880 struct wiphy_delayed_work *dwork); a3ee4dc84c4e9d Johannes Berg 2023-06-06 5881 8137a638e642a1 Johannes Berg 2023-11-23 5882 /** 394bc797fb96f1 Johannes Berg 2023-11-23 5883 * wiphy_delayed_work_flush - flush previously queued delayed work 8137a638e642a1 Johannes Berg 2023-11-23 5884 * @wiphy: the wiphy, for debug purposes 8137a638e642a1 Johannes Berg 2023-11-23 5885 * @work: the work to flush 8137a638e642a1 Johannes Berg 2023-11-23 5886 * 8137a638e642a1 Johannes Berg 2023-11-23 5887 * Flush the work (i.e. run it if pending). This must be called 8137a638e642a1 Johannes Berg 2023-11-23 5888 * under the wiphy mutex acquired by wiphy_lock(). 8137a638e642a1 Johannes Berg 2023-11-23 5889 */ 8137a638e642a1 Johannes Berg 2023-11-23 5890 void wiphy_delayed_work_flush(struct wiphy *wiphy, 8137a638e642a1 Johannes Berg 2023-11-23 @5891 struct wiphy_delayed_work *dwork); 8137a638e642a1 Johannes Berg 2023-11-23 5892 :::::: The code at line 5891 was first introduced by commit :::::: 8137a638e642a1f9d6511c3d2cb8d90bcfe45367 wifi: cfg80211: add flush functions for wiphy work :::::: TO: Johannes Berg <johannes.berg(a)intel.com> :::::: CC: Zheng Zengkai <zhengzengkai(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 3508/3508] drivers/ub/urma/ubcore/net/ubcore_sock.c:73:39: sparse: sparse: restricted __be32 degrades to integer
by kernel test robot 10 Dec '25

10 Dec '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 56da8c1ec8638f6ad4df737a133a41b106a3ce42 commit: fa2cd1217a55bfd5ad96e991f64f72d9692844e1 [3508/3508] urma: add network framework facilities for ubcore. config: arm64-randconfig-r112-20251210 (https://download.01.org/0day-ci/archive/20251210/202512101830.7qQXxUnc-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.4.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251210/202512101830.7qQXxUnc-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512101830.7qQXxUnc-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/ub/urma/ubcore/net/ubcore_sock.c:73:39: sparse: sparse: restricted __be32 degrades to integer >> drivers/ub/urma/ubcore/net/ubcore_sock.c:78:45: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be32 [usertype] s_addr @@ got unsigned int [usertype] addr @@ drivers/ub/urma/ubcore/net/ubcore_sock.c:78:45: sparse: expected restricted __be32 [usertype] s_addr drivers/ub/urma/ubcore/net/ubcore_sock.c:78:45: sparse: got unsigned int [usertype] addr >> drivers/ub/urma/ubcore/net/ubcore_sock.c:181:35: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned int [usertype] addr @@ got restricted __be32 [usertype] s_addr @@ drivers/ub/urma/ubcore/net/ubcore_sock.c:181:35: sparse: expected unsigned int [usertype] addr drivers/ub/urma/ubcore/net/ubcore_sock.c:181:35: sparse: got restricted __be32 [usertype] s_addr >> drivers/ub/urma/ubcore/net/ubcore_sock.c:348:24: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __poll_t [usertype] _key @@ got int @@ drivers/ub/urma/ubcore/net/ubcore_sock.c:348:24: sparse: expected restricted __poll_t [usertype] _key drivers/ub/urma/ubcore/net/ubcore_sock.c:348:24: sparse: got int >> drivers/ub/urma/ubcore/net/ubcore_sock.c:527:29: sparse: sparse: restricted __poll_t degrades to integer drivers/ub/urma/ubcore/net/ubcore_sock.c:529:34: sparse: sparse: restricted __poll_t degrades to integer -- >> drivers/ub/urma/ubcore/net/ubcore_session.c:38:31: sparse: sparse: symbol 'session_ctx' was not declared. Should it be static? vim +73 drivers/ub/urma/ubcore/net/ubcore_sock.c 68 69 static void k_parse_addr(union ubcore_net_addr_union *ub_addr, uint16_t port, 70 struct sockaddr *sk_addr, int *sk_addr_size) 71 { 72 if (ub_addr->in4.reserved1 == 0 && > 73 ub_addr->in4.reserved2 == htonl(IPV4_MAP_IPV6_PREFIX)) { 74 struct sockaddr_in *sk_addr_in = (struct sockaddr_in *)sk_addr; 75 76 sk_addr_in->sin_family = AF_INET; 77 sk_addr_in->sin_port = htons(port); > 78 sk_addr_in->sin_addr.s_addr = ub_addr->in4.addr; 79 80 *sk_addr_size = (int)sizeof(*sk_addr_in); 81 } else { 82 struct sockaddr_in6 *sk_addr_in6 = 83 (struct sockaddr_in6 *)sk_addr; 84 85 sk_addr_in6->sin6_family = AF_INET6; 86 sk_addr_in6->sin6_port = htons(port); 87 memcpy(&sk_addr_in6->sin6_addr, &ub_addr->in6, 88 sizeof(ub_addr->in6)); 89 90 *sk_addr_size = (int)sizeof(*sk_addr_in6); 91 } 92 } 93 94 static int k_setsockopt_keepalive(struct socket *sock) 95 { 96 int keepidle = 5; 97 int keepcnt = 3; 98 99 sock_set_keepalive(sock->sk); 100 tcp_sock_set_keepcnt(sock->sk, keepcnt); 101 tcp_sock_set_keepidle(sock->sk, keepidle); 102 tcp_sock_set_keepintvl(sock->sk, keepidle); 103 104 return 0; 105 } 106 107 static inline void k_setsockopt_reuse(struct socket *sock) 108 { 109 sock->sk->sk_reuse = true; 110 } 111 112 static inline void k_close(struct socket *sock) 113 { 114 sock_release(sock); 115 } 116 117 static struct socket *k_listen(union ubcore_net_addr_union *ub_addr, 118 uint16_t port) 119 { 120 struct socket *sock = NULL; 121 struct sockaddr_in6 sk_addr_inner = { 0 }; 122 struct sockaddr *sk_addr = (struct sockaddr *)&sk_addr_inner; 123 int sk_addr_size, backlog = 128; 124 int ret; 125 126 k_parse_addr(ub_addr, port, sk_addr, &sk_addr_size); 127 128 ret = sock_create(sk_addr->sa_family, SOCK_STREAM, 0, &sock); 129 if (ret < 0) { 130 ubcore_log_err("Failed to create socket"); 131 return NULL; 132 } 133 134 k_setsockopt_reuse(sock); 135 136 ret = kernel_bind(sock, sk_addr, sk_addr_size); 137 if (ret < 0) { 138 ubcore_log_err("Failed to call kernel_bind, ret: %d.\n", ret); 139 goto destroy_sock; 140 } 141 142 ret = kernel_listen(sock, backlog); 143 if (ret < 0) { 144 ubcore_log_err("Failed to call kernel_listen"); 145 goto destroy_sock; 146 } 147 148 return sock; 149 150 destroy_sock: 151 k_close(sock); 152 return NULL; 153 } 154 155 static struct socket *k_accept(struct socket *sock, 156 union ubcore_net_addr_union *ub_addr) 157 { 158 struct socket *newsock = NULL; 159 struct sockaddr_in6 sk_addr_inner = { 0 }; 160 struct sockaddr *sk_addr = (struct sockaddr *)&sk_addr_inner; 161 int ret; 162 163 ret = kernel_accept(sock, &newsock, 0); 164 if (ret < 0) { 165 ubcore_log_err("Failed to call kernel_accept"); 166 return NULL; 167 } 168 169 ret = kernel_getpeername(newsock, sk_addr); 170 if (ret == sizeof(struct sockaddr_in6) && 171 sk_addr->sa_family == AF_INET6) { 172 struct sockaddr_in6 *sk_addr_in6 = 173 (struct sockaddr_in6 *)sk_addr; 174 175 memcpy(&ub_addr->in6, &sk_addr_in6->sin6_addr, 176 sizeof(sk_addr_in6->sin6_addr)); 177 } else if (ret == sizeof(struct sockaddr_in) && 178 sk_addr->sa_family == AF_INET) { 179 struct sockaddr_in *sk_addr_in = (struct sockaddr_in *)sk_addr; 180 > 181 ub_addr->in4.addr = sk_addr_in->sin_addr.s_addr; 182 ub_addr->in4.reserved2 = IPV4_MAP_IPV6_PREFIX; 183 } else { 184 ubcore_log_err("Failed to call kernel_getpeername"); 185 goto destroy_sock; 186 } 187 188 ret = k_setsockopt_keepalive(newsock); 189 if (ret < 0) { 190 ubcore_log_err("Failed to set socket keepalive"); 191 goto destroy_sock; 192 } 193 194 return newsock; 195 196 destroy_sock: 197 k_close(newsock); 198 return NULL; 199 } 200 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/9] crypto: hisilicon - some bugfix
by Chenghai Huang 10 Dec '25

10 Dec '25

From: JiangShui Yang <yangjiangshui(a)h-partners.com> Chenghai Huang (4): crypto: hisilicon/sgl - fix inconsistent map/unmap direction issue crypto: hisilicon/zip - fix a callback problem crypto: hisilicon/zip - add algorithm check before soft tfm allocation crypto: hisilicon/zip - remove redundant callback validation and invocation in crypto_wait_req Weili Qian (3): crypto: hisilicon - mask all error type when uninit crypto: hisilicon/hpre - support curve25519 fallback for hardware queue unavailable crypto: hisilicon/qm - increment PM usage counter when handling the aeq interrupt Zhushuai Yin (1): crypto: hisilicon/qm - place the interrupt status interface after the PM usage counter lizhi (1): crypto: hisilicon - lower priority for hisilicon crypto implementations drivers/crypto/hisilicon/hpre/hpre_crypto.c | 72 ++++++++++++++++-- drivers/crypto/hisilicon/hpre/hpre_main.c | 9 +-- drivers/crypto/hisilicon/qm.c | 82 ++++++++++----------- drivers/crypto/hisilicon/sec2/sec_crypto.c | 2 +- drivers/crypto/hisilicon/sec2/sec_main.c | 3 +- drivers/crypto/hisilicon/sgl.c | 2 +- drivers/crypto/hisilicon/zip/zip_crypto.c | 20 ++--- drivers/crypto/hisilicon/zip/zip_main.c | 10 +-- include/linux/hisi_acc_qm.h | 1 - 9 files changed, 129 insertions(+), 72 deletions(-) -- 2.43.0

2 11

[PATCH OLK-6.6] ipv6: reject malicious packets in ipv6_gso_segment()
by Wang Liang 10 Dec '25

10 Dec '25

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v6.6.102 commit ef05007b403dcc21e701cb1f30d4572ac0a9da20 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICU6G7 CVE: CVE-2025-38572 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d45cf1e7d7180256e17c9ce88e32e8061a7887fe ] syzbot was able to craft a packet with very long IPv6 extension headers leading to an overflow of skb->transport_header. This 16bit field has a limited range. Add skb_reset_transport_header_careful() helper and use it from ipv6_gso_segment() WARNING: CPU: 0 PID: 5871 at ./include/linux/skbuff.h:3032 skb_reset_transport_header include/linux/skbuff.h:3032 [inline] WARNING: CPU: 0 PID: 5871 at ./include/linux/skbuff.h:3032 ipv6_gso_segment+0x15e2/0x21e0 net/ipv6/ip6_offload.c:151 Modules linked in: CPU: 0 UID: 0 PID: 5871 Comm: syz-executor211 Not tainted 6.16.0-rc6-syzkaller-g7abc678e3084 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:skb_reset_transport_header include/linux/skbuff.h:3032 [inline] RIP: 0010:ipv6_gso_segment+0x15e2/0x21e0 net/ipv6/ip6_offload.c:151 Call Trace: <TASK> skb_mac_gso_segment+0x31c/0x640 net/core/gso.c:53 nsh_gso_segment+0x54a/0xe10 net/nsh/nsh.c:110 skb_mac_gso_segment+0x31c/0x640 net/core/gso.c:53 __skb_gso_segment+0x342/0x510 net/core/gso.c:124 skb_gso_segment include/net/gso.h:83 [inline] validate_xmit_skb+0x857/0x11b0 net/core/dev.c:3950 validate_xmit_skb_list+0x84/0x120 net/core/dev.c:4000 sch_direct_xmit+0xd3/0x4b0 net/sched/sch_generic.c:329 __dev_xmit_skb net/core/dev.c:4102 [inline] __dev_queue_xmit+0x17b6/0x3a70 net/core/dev.c:4679 Fixes: d1da932ed4ec ("ipv6: Separate ipv6 offload support") Reported-by: syzbot+af43e647fd835acc02df(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/688a1a05.050a0220.5d226.0008.GAE@google.com/… Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Dawid Osuchowski <dawid.osuchowski(a)linux.intel.com> Reviewed-by: Willem de Bruijn <willemb(a)google.com> Link: https://patch.msgid.link/20250730131738.3385939-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- include/linux/skbuff.h | 23 +++++++++++++++++++++++ net/ipv6/ip6_offload.c | 4 +++- 2 files changed, 26 insertions(+), 1 deletion(-) diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h index 1597a5f9b5b8..68a236566458 100644 --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h @@ -2891,6 +2891,29 @@ static inline void skb_reset_transport_header(struct sk_buff *skb) skb->transport_header = skb->data - skb->head; } +/** + * skb_reset_transport_header_careful - conditionally reset transport header + * @skb: buffer to alter + * + * Hardened version of skb_reset_transport_header(). + * + * Returns: true if the operation was a success. + */ +static inline bool __must_check +skb_reset_transport_header_careful(struct sk_buff *skb) +{ + long offset = skb->data - skb->head; + + if (unlikely(offset != (typeof(skb->transport_header))offset)) + return false; + + if (unlikely(offset == (typeof(skb->transport_header))~0U)) + return false; + + skb->transport_header = offset; + return true; +} + static inline void skb_set_transport_header(struct sk_buff *skb, const int offset) { diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c index 7f014a8969fb..84b17eeaa57c 100644 --- a/net/ipv6/ip6_offload.c +++ b/net/ipv6/ip6_offload.c @@ -150,7 +150,9 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb, ops = rcu_dereference(inet6_offloads[proto]); if (likely(ops && ops->callbacks.gso_segment)) { - skb_reset_transport_header(skb); + if (!skb_reset_transport_header_careful(skb)) + goto out; + segs = ops->callbacks.gso_segment(skb, features); if (!segs) skb->network_header = skb_mac_header(skb) + nhoff - skb->head; -- 2.34.1

1 0

[PATCH OLK-6.6] vsock: Do not allow binding to VMADDR_PORT_ANY
by Wang Liang 10 Dec '25

10 Dec '25

From: Budimir Markovic <markovicbudimir(a)gmail.com> stable inclusion from stable-v6.6.102 commit 44bd006d5c93f6a8f28b106cbae2428c5d0275b7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICUC4U CVE: CVE-2025-38618 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit aba0c94f61ec05315fa7815d21aefa4c87f6a9f4 upstream. It is possible for a vsock to autobind to VMADDR_PORT_ANY. This can cause a use-after-free when a connection is made to the bound socket. The socket returned by accept() also has port VMADDR_PORT_ANY but is not on the list of unbound sockets. Binding it will result in an extra refcount decrement similar to the one fixed in fcdd2242c023 (vsock: Keep the binding until socket destruction). Modify the check in __vsock_bind_connectible() to also prevent binding to VMADDR_PORT_ANY. Fixes: d021c344051a ("VSOCK: Introduce VM Sockets") Reported-by: Budimir Markovic <markovicbudimir(a)gmail.com> Signed-off-by: Budimir Markovic <markovicbudimir(a)gmail.com> Reviewed-by: Stefano Garzarella <sgarzare(a)redhat.com> Link: https://patch.msgid.link/20250807041811.678-1-markovicbudimir@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/vmw_vsock/af_vsock.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c index f8f1a49689da..cdcffa01c230 100644 --- a/net/vmw_vsock/af_vsock.c +++ b/net/vmw_vsock/af_vsock.c @@ -654,7 +654,8 @@ static int __vsock_bind_connectible(struct vsock_sock *vsk, unsigned int i; for (i = 0; i < MAX_PORT_RETRIES; i++) { - if (port <= LAST_RESERVED_PORT) + if (port == VMADDR_PORT_ANY || + port <= LAST_RESERVED_PORT) port = LAST_RESERVED_PORT + 1; new_addr.svm_port = port++; -- 2.34.1

2 1

[PATCH OLK-6.6] netfilter: ctnetlink: fix refcount leak on table dump
by Wang Liang 10 Dec '25

10 Dec '25

From: Florian Westphal <fw(a)strlen.de> stable inclusion from stable-v6.6.103 commit 30cf811058552b8cd0e98dff677ef3f89d6d34ce category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICWGI3 CVE: CVE-2025-38721 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit de788b2e6227462b6dcd0e07474e72c089008f74 ] There is a reference count leak in ctnetlink_dump_table(): if (res < 0) { nf_conntrack_get(&ct->ct_general); // HERE cb->args[1] = (unsigned long)ct; ... While its very unlikely, its possible that ct == last. If this happens, then the refcount of ct was already incremented. This 2nd increment is never undone. This prevents the conntrack object from being released, which in turn keeps prevents cnet->count from dropping back to 0. This will then block the netns dismantle (or conntrack rmmod) as nf_conntrack_cleanup_net_list() will wait forever. This can be reproduced by running conntrack_resize.sh selftest in a loop. It takes ~20 minutes for me on a preemptible kernel on average before I see a runaway kworker spinning in nf_conntrack_cleanup_net_list. One fix would to change this to: if (res < 0) { if (ct != last) nf_conntrack_get(&ct->ct_general); But this reference counting isn't needed in the first place. We can just store a cookie value instead. A followup patch will do the same for ctnetlink_exp_dump_table, it looks to me as if this has the same problem and like ctnetlink_dump_table, we only need a 'skip hint', not the actual object so we can apply the same cookie strategy there as well. Fixes: d205dc40798d ("[NETFILTER]: ctnetlink: fix deadlock in table dumping") Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/netfilter/nf_conntrack_netlink.c | 24 +++++++++++++----------- 1 file changed, 13 insertions(+), 11 deletions(-) diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c index 282e9644f6fd..928bd2013289 100644 --- a/net/netfilter/nf_conntrack_netlink.c +++ b/net/netfilter/nf_conntrack_netlink.c @@ -859,8 +859,6 @@ ctnetlink_conntrack_event(unsigned int events, const struct nf_ct_event *item) static int ctnetlink_done(struct netlink_callback *cb) { - if (cb->args[1]) - nf_ct_put((struct nf_conn *)cb->args[1]); kfree(cb->data); return 0; } @@ -1175,19 +1173,26 @@ static int ctnetlink_filter_match(struct nf_conn *ct, void *data) return 0; } +static unsigned long ctnetlink_get_id(const struct nf_conn *ct) +{ + unsigned long id = nf_ct_get_id(ct); + + return id ? id : 1; +} + static int ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb) { unsigned int flags = cb->data ? NLM_F_DUMP_FILTERED : 0; struct net *net = sock_net(skb->sk); - struct nf_conn *ct, *last; + unsigned long last_id = cb->args[1]; struct nf_conntrack_tuple_hash *h; struct hlist_nulls_node *n; struct nf_conn *nf_ct_evict[8]; + struct nf_conn *ct; int res, i; spinlock_t *lockp; - last = (struct nf_conn *)cb->args[1]; i = 0; local_bh_disable(); @@ -1224,7 +1229,7 @@ ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb) continue; if (cb->args[1]) { - if (ct != last) + if (ctnetlink_get_id(ct) != last_id) continue; cb->args[1] = 0; } @@ -1237,8 +1242,7 @@ ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb) NFNL_MSG_TYPE(cb->nlh->nlmsg_type), ct, true, flags); if (res < 0) { - nf_conntrack_get(&ct->ct_general); - cb->args[1] = (unsigned long)ct; + cb->args[1] = ctnetlink_get_id(ct); spin_unlock(lockp); goto out; } @@ -1251,12 +1255,10 @@ ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb) } out: local_bh_enable(); - if (last) { + if (last_id) { /* nf ct hash resize happened, now clear the leftover. */ - if ((struct nf_conn *)cb->args[1] == last) + if (cb->args[1] == last_id) cb->args[1] = 0; - - nf_ct_put(last); } while (i) { -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] CVE-2025-38571
by Wang Liang 10 Dec '25

10 Dec '25

Justin Worrell (1): SUNRPC: call xs_sock_process_cmsg for all cmsg Olga Kornievskaia (1): sunrpc: fix client side handling of tls alerts net/sunrpc/xprtsock.c | 40 ++++++++++++++++++++++++++++++---------- 1 file changed, 30 insertions(+), 10 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] ipv6: fix possible infinite loop in fib6_info_uses_dev()
by Wang Liang 10 Dec '25

10 Dec '25

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v6.6.102 commit 9cb6de8ee144a94ae7a40bdb32560329ab7276f0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICU76Y CVE: CVE-2025-38587 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f8d8ce1b515a0a6af72b30502670a406cfb75073 ] fib6_info_uses_dev() seems to rely on RCU without an explicit protection. Like the prior fix in rt6_nlmsg_size(), we need to make sure fib6_del_route() or fib6_add_rt2node() have not removed the anchor from the list, or we risk an infinite loop. Fixes: d9ccb18f83ea ("ipv6: Fix soft lockups in fib6_select_path under high next hop churn") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20250725140725.3626540-4-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/ipv6/route.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/net/ipv6/route.c b/net/ipv6/route.c index 53197087353a..6f64fd9fe763 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -5863,16 +5863,21 @@ static bool fib6_info_uses_dev(const struct fib6_info *f6i, if (f6i->fib6_nh->fib_nh_dev == dev) return true; - if (f6i->fib6_nsiblings) { - struct fib6_info *sibling, *next_sibling; + if (READ_ONCE(f6i->fib6_nsiblings)) { + const struct fib6_info *sibling; - list_for_each_entry_safe(sibling, next_sibling, - &f6i->fib6_siblings, fib6_siblings) { - if (sibling->fib6_nh->fib_nh_dev == dev) + rcu_read_lock(); + list_for_each_entry_rcu(sibling, &f6i->fib6_siblings, + fib6_siblings) { + if (sibling->fib6_nh->fib_nh_dev == dev) { + rcu_read_unlock(); return true; + } + if (!READ_ONCE(f6i->fib6_nsiblings)) + break; } + rcu_read_unlock(); } - return false; } -- 2.34.1

2 1

[PATCH OLK-6.6 0/9] xsched: XCU Partition
by Zicheng Qu 10 Dec '25

10 Dec '25

Zicheng Qu (9): xsched: refactor CFS per-XCU rq init/deinit paths xsched: fix NULL pointer risk on attach entry allocation xsched: fix concurrent modification NULL pointer dereference in xcu.sched_class xsched: fix hung_task caused by cgroup_file_show and xcg_mutex deadlock xsched: prevent NULL deref by refcounting css and tracking offline state xsched: fix divide-by-zero caused by u64 overflow in CFS shares weight calculation xsched: DEBUG log cleanup xsched: prevent race between enqueue_ctx and xsched_task_free xsched: fix infinite loop caused by invalid CFS group vruntime update include/linux/xsched.h | 40 ++++++- kernel/xsched/cfs.c | 47 +++++--- kernel/xsched/cfs_quota.c | 9 ++ kernel/xsched/cgroup.c | 224 +++++++++++++++++++++----------------- kernel/xsched/core.c | 9 +- kernel/xsched/rt.c | 19 +--- kernel/xsched/vstream.c | 3 + 7 files changed, 210 insertions(+), 141 deletions(-) -- 2.34.1

2 10

[PATCH OLK-6.6 0/9] xsched: XCU Partition
by Zicheng Qu 10 Dec '25

10 Dec '25

Zicheng Qu (9): xsched: refactor CFS per-XCU rq init/deinit paths xsched: fix NULL pointer risk on attach entry allocation xsched: fix concurrent modification NULL pointer dereference in xcu.sched_class xsched: fix hung_task caused by cgroup_file_show and xcg_mutex deadlock xsched: prevent NULL deref by refcounting css and tracking offline state xsched: fix divide-by-zero caused by u64 overflow in CFS shares weight calculation xsched: DEBUG log cleanup xsched: prevent race between enqueue_ctx and xsched_task_free xsched: fix infinite loop caused by invalid CFS group vruntime update include/linux/xsched.h | 40 ++++++- kernel/xsched/cfs.c | 47 +++++--- kernel/xsched/cfs_quota.c | 9 ++ kernel/xsched/cgroup.c | 224 +++++++++++++++++++++----------------- kernel/xsched/core.c | 9 +- kernel/xsched/rt.c | 19 +--- kernel/xsched/vstream.c | 3 + 7 files changed, 210 insertions(+), 141 deletions(-) -- 2.34.1

2 10