- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] wifi: at76c50x: fix use after free access in at76_disconnect
by Dong Chenchen 14 Aug '25

14 Aug '25

From: Abdun Nihaal <abdun.nihaal(a)gmail.com> stable inclusion from stable-v5.10.237 commit 6e4ab3e574c2a335b40fa1f70d1c54fcb58ab33f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC5BMW CVE: CVE-2025-37796 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 27c7e63b3cb1a20bb78ed4a36c561ea4579fd7da ] The memory pointed to by priv is freed at the end of at76_delete_device function (using ieee80211_free_hw). But the code then accesses the udev field of the freed object to put the USB device. This may also lead to a memory leak of the usb device. Fix this by using udev from interface. Fixes: 29e20aa6c6af ("at76c50x-usb: fix use after free on failure path in at76_probe()") Signed-off-by: Abdun Nihaal <abdun.nihaal(a)gmail.com> Link: https://patch.msgid.link/20250330103110.44080-1-abdun.nihaal@gmail.com Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/net/wireless/atmel/at76c50x-usb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/atmel/at76c50x-usb.c b/drivers/net/wireless/atmel/at76c50x-usb.c index 404257800033..706de33d0ed4 100644 --- a/drivers/net/wireless/atmel/at76c50x-usb.c +++ b/drivers/net/wireless/atmel/at76c50x-usb.c @@ -2553,7 +2553,7 @@ static void at76_disconnect(struct usb_interface *interface) wiphy_info(priv->hw->wiphy, "disconnecting\n"); at76_delete_device(priv); - usb_put_dev(priv->udev); + usb_put_dev(interface_to_usbdev(interface)); dev_info(&interface->dev, "disconnected\n"); } -- 2.25.1

2 1

[PATCH OLK-6.6] wifi: at76c50x: fix use after free access in at76_disconnect
by Dong Chenchen 14 Aug '25

14 Aug '25

From: Abdun Nihaal <abdun.nihaal(a)gmail.com> stable inclusion from stable-v6.6.88 commit 7ca513631fa6ad3011b8b9197cdde0f351103704 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC5BMW CVE: CVE-2025-37796 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 27c7e63b3cb1a20bb78ed4a36c561ea4579fd7da ] The memory pointed to by priv is freed at the end of at76_delete_device function (using ieee80211_free_hw). But the code then accesses the udev field of the freed object to put the USB device. This may also lead to a memory leak of the usb device. Fix this by using udev from interface. Fixes: 29e20aa6c6af ("at76c50x-usb: fix use after free on failure path in at76_probe()") Signed-off-by: Abdun Nihaal <abdun.nihaal(a)gmail.com> Link: https://patch.msgid.link/20250330103110.44080-1-abdun.nihaal@gmail.com Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/net/wireless/atmel/at76c50x-usb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/atmel/at76c50x-usb.c b/drivers/net/wireless/atmel/at76c50x-usb.c index 447b51cff8f9..c1a92c7f0f8e 100644 --- a/drivers/net/wireless/atmel/at76c50x-usb.c +++ b/drivers/net/wireless/atmel/at76c50x-usb.c @@ -2554,7 +2554,7 @@ static void at76_disconnect(struct usb_interface *interface) wiphy_info(priv->hw->wiphy, "disconnecting\n"); at76_delete_device(priv); - usb_put_dev(priv->udev); + usb_put_dev(interface_to_usbdev(interface)); dev_info(&interface->dev, "disconnected\n"); } -- 2.25.1

2 1

[PATCH v8 0/8] arm64: entry: Convert to generic irq entry
by Jinjie Ruan 14 Aug '25

14 Aug '25

Currently, x86, Riscv, Loongarch use the generic entry which makes maintainers' work easier and codes more elegant. So also convert arm64 to use the generic entry infrastructure from kernel/entry/* by switching it to generic IRQ entry first, which will make PREEMPT_DYNAMIC and PREEMPT_LAZY use the generic entry common code and remove a lot of duplicate code. Since commit a70e9f647f50 ("entry: Split generic entry into generic exception and syscall entry") split the generic entry into generic irq entry and generic syscall entry, it is time to convert arm64 to use the generic irq entry. And ARM64 will be completely converted to generic entry in the upcoming patch series. The main convert steps are as follows: - Split generic entry into generic irq entry and generic syscall to make the single patch more concentrated in switching to one thing. - Make arm64 easier to use irqentry_enter/exit(). - Make arm64 closer to the PREEMPT_DYNAMIC code of generic entry. - Switch to generic irq entry. This patch set is rebased on 6.17-rc1. It was tested ok with following test cases on QEMU virt platform: - Perf tests. - Different `dynamic preempt` mode switch. - Pseudo NMI tests. - Stress-ng CPU stress test. - MTE test case in Documentation/arch/arm64/memory-tagging-extension.rst and all test cases in tools/testing/selftests/arm64/mte/*. The test QEMU configuration is as follows: qemu-system-aarch64 \ -M virt,gic-version=3,virtualization=on,mte=on \ -cpu max,pauth-impdef=on \ -kernel Image \ -smp 8,sockets=1,cores=4,threads=2 \ -m 512m \ -nographic \ -no-reboot \ -device virtio-rng-pci \ -append "root=/dev/vda rw console=ttyAMA0 kgdboc=ttyAMA0,115200 \ earlycon preempt=voluntary irqchip.gicv3_pseudo_nmi=1" \ -drive if=none,file=images/rootfs.ext4,format=raw,id=hd0 \ -device virtio-blk-device,drive=hd0 \ Changes in v8: - Update the comment. - Fix a typo, inerrupts_enabled(regs) -> interrupts_enabled(regs). - Consistently defined 'state' on a separate line, before the main block. - Split the "arch_irqentry_exit_need_resched()" patch. - Fix CONFIG_PREEMPTION not set build issue. - Remove do_signal() declaration in exception.h as there remains no users of `do_signal(). - Add asm/cpufeature.h header for entry-common.h - Add Reviewed-by, Acked-by and Tested-by. - Update the commit message. - Link to v7: https://lore.kernel.org/all/20250729015456.3411143-1-ruanjinjie@huawei.com/ Changes in v7: - Rebased on v6.16-rc7 and remove the merged first patch. - Update the commit message. - Link to v6: https://lore.kernel.org/all/20250213130007.1418890-1-ruanjinjie@huawei.com/ Changes in v6: - Rebased on 6.14 rc2 next. - Put the syscall bits aside and split it out. - Have the split patch before the arm64 changes. - Merge some tightly coupled patches. - Adjust the order of some patches to make them more reasonable. - Define regs_irqs_disabled() by inline function. - Define interrupts_enabled() in terms of regs_irqs_disabled(). - Delete the fast_interrupts_enabled() macro. - irqentry_state_t -> arm64_irqentry_state_t. - Remove arch_exit_to_user_mode_prepare() and pull local_daif_mask() later in the arm64 exit sequence - Update the commit message. - Link to v5: https://lkml.org/lkml/2024/12/6/609 Changes in v5: - Not change arm32 and keep inerrupts_enabled() macro for gicv3 driver. - Move irqentry_state definition into arch/arm64/kernel/entry-common.c. - Avoid removing the __enter_from_*() and __exit_to_*() wrappers. - Update "irqentry_state_t ret/irq_state" to "state" to keep it consistently. - Use generic irq entry header for PREEMPT_DYNAMIC after split the generic entry. - Also refactor the ARM64 syscall code. - Introduce arch_ptrace_report_syscall_entry/exit(), instead of arch_pre/post_report_syscall_entry/exit() to simplify code. - Make the syscall patches clear separation. - Update the commit message. Changes in v4: - Rework/cleanup split into a few patches as Mark suggested. - Replace interrupts_enabled() macro with regs_irqs_disabled(), instead of left it here. - Remove rcu and lockdep state in pt_regs by using temporary irqentry_state_t as Mark suggested. - Remove some unnecessary intermediate functions to make it clear. - Rework preempt irq and PREEMPT_DYNAMIC code to make the switch more clear. - arch_prepare_*_entry/exit() -> arch_pre_*_entry/exit(). - Expand the arch functions comment. - Make arch functions closer to its caller. - Declare saved_reg in for block. - Remove arch_exit_to_kernel_mode_prepare(), arch_enter_from_kernel_mode(). - Adjust "Add few arch functions to use generic entry" patch to be the penultimate. - Update the commit message. - Add suggested-by. Changes in v3: - Test the MTE test cases. - Handle forget_syscall() in arch_post_report_syscall_entry() - Make the arch funcs not use __weak as Thomas suggested, so move the arch funcs to entry-common.h, and make arch_forget_syscall() folded in arch_post_report_syscall_entry() as suggested. - Move report_single_step() to thread_info.h for arm64 - Change __always_inline() to inline, add inline for the other arch funcs. - Remove unused signal.h for entry-common.h. - Add Suggested-by. - Update the commit message. Changes in v2: - Add tested-by. - Fix a bug that not call arch_post_report_syscall_entry() in syscall_trace_enter() if ptrace_report_syscall_entry() return not zero. - Refactor report_syscall(). - Add comment for arch_prepare_report_syscall_exit(). - Adjust entry-common.h header file inclusion to alphabetical order. - Update the commit message. Jinjie Ruan (8): arm64: ptrace: Replace interrupts_enabled() with regs_irqs_disabled() arm64: entry: Refactor the entry and exit for exceptions from EL1 arm64: entry: Rework arm64_preempt_schedule_irq() arm64: entry: Use preempt_count() and need_resched() helper entry: Add arch_irqentry_exit_need_resched() for arm64 arm64: entry: Refactor preempt_schedule_irq() check code arm64: entry: Move arm64_preempt_schedule_irq() into __exit_to_kernel_mode() arm64: entry: Switch to generic IRQ entry arch/arm64/Kconfig | 1 + arch/arm64/include/asm/daifflags.h | 2 +- arch/arm64/include/asm/entry-common.h | 57 ++++ arch/arm64/include/asm/exception.h | 1 - arch/arm64/include/asm/preempt.h | 2 - arch/arm64/include/asm/ptrace.h | 13 +- arch/arm64/include/asm/xen/events.h | 2 +- arch/arm64/kernel/acpi.c | 2 +- arch/arm64/kernel/debug-monitors.c | 2 +- arch/arm64/kernel/entry-common.c | 423 +++++++++----------------- arch/arm64/kernel/sdei.c | 2 +- arch/arm64/kernel/signal.c | 3 +- kernel/entry/common.c | 16 +- 13 files changed, 230 insertions(+), 296 deletions(-) create mode 100644 arch/arm64/include/asm/entry-common.h -- 2.34.1

1 8

[PATCH OLK-6.6 0/2] net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime
by Dong Chenchen 14 Aug '25

14 Aug '25

Fix VLAN 0 refcount imbalance of toggling filtering during Dong Chenchen (2): net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime net: vlan: Fix kabi breakage of struct vlan_info net/8021q/vlan.c | 42 +++++++++++++++++++++++++++++++++--------- net/8021q/vlan.h | 1 + 2 files changed, 34 insertions(+), 9 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10 0/2] net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime
by Dong Chenchen 14 Aug '25

14 Aug '25

fix VLAN 0 refcount imbalance of toggling filtering during runtime Dong Chenchen (2): net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime net: vlan: Fix kabi breakage of struct vlan_info net/8021q/vlan.c | 42 +++++++++++++++++++++++++++++++++--------- net/8021q/vlan.h | 1 + 2 files changed, 34 insertions(+), 9 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS v2 0/2] net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime
by Dong Chenchen 14 Aug '25

14 Aug '25

Fix VLAN 0 refcount imbalance of toggling filtering during runtime. Dong Chenchen (2): net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime net: vlan: Fix kabi breakage of struct vlan_info net/8021q/vlan.c | 42 +++++++++++++++++++++++++++++++++--------- net/8021q/vlan.h | 3 +++ 2 files changed, 36 insertions(+), 9 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS 0/2] net/sched: sch_qfq: Fix CVE-2025-38477
by Dong Chenchen 14 Aug '25

14 Aug '25

Fix CVE-2025-38477 Xiang Mei (2): net/sched: sch_qfq: Fix race condition on qfq_aggregate net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class net/sched/sch_qfq.c | 33 ++++++++++++++++++++++----------- 1 file changed, 22 insertions(+), 11 deletions(-) -- 2.25.1

2 4

[openeuler:OLK-6.6 2679/2679] kernel/sched/cpuacct.c:412:18: warning: no previous prototype for function 'bpf_cpuacct_kcpustat_cpu_fetch'
by kernel test robot 14 Aug '25

14 Aug '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 43d8c124ec4624389b14d42595e5f0195e3e5a1d commit: 6ed308fc1d6f486c9e3c171b6b80c1c5f0f57df6 [2679/2679] bpf-rvi: cpuacct: Add bpf_cpuacct_kcpustat_cpu_fetch kfunc config: loongarch-allmodconfig (https://download.01.org/0day-ci/archive/20250814/202508142117.RpbHh5Ge-lkp@…) compiler: clang version 19.1.7 (https://github.com/llvm/llvm-project cd708029e0b2869e80abe31ddb175f7c35361f90) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250814/202508142117.RpbHh5Ge-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202508142117.RpbHh5Ge-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from kernel/sched/build_utility.c:61: >> kernel/sched/cpuacct.c:412:18: warning: no previous prototype for function 'bpf_cpuacct_kcpustat_cpu_fetch' [-Wmissing-prototypes] 412 | __bpf_kfunc void bpf_cpuacct_kcpustat_cpu_fetch(struct kernel_cpustat *dst, | ^ kernel/sched/cpuacct.c:412:13: note: declare 'static' if the function is not intended to be used outside of this translation unit 412 | __bpf_kfunc void bpf_cpuacct_kcpustat_cpu_fetch(struct kernel_cpustat *dst, | ^ | static In file included from kernel/sched/build_utility.c:73: kernel/sched/debug.c:102:12: warning: no previous prototype for function 'is_prefer_numa' [-Wmissing-prototypes] 102 | int __weak is_prefer_numa(void) | ^ kernel/sched/debug.c:102:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 102 | int __weak is_prefer_numa(void) | ^ | static In file included from kernel/sched/build_utility.c:113: kernel/sched/bpf_sched.c:186:17: warning: no previous prototype for function 'bpf_sched_entity_is_task' [-Wmissing-prototypes] 186 | __bpf_kfunc int bpf_sched_entity_is_task(struct sched_entity *se) | ^ kernel/sched/bpf_sched.c:186:13: note: declare 'static' if the function is not intended to be used outside of this translation unit 186 | __bpf_kfunc int bpf_sched_entity_is_task(struct sched_entity *se) | ^ | static kernel/sched/bpf_sched.c:194:33: warning: no previous prototype for function 'bpf_sched_entity_to_task' [-Wmissing-prototypes] 194 | __bpf_kfunc struct task_struct *bpf_sched_entity_to_task(struct sched_entity *se) | ^ kernel/sched/bpf_sched.c:194:13: note: declare 'static' if the function is not intended to be used outside of this translation unit 194 | __bpf_kfunc struct task_struct *bpf_sched_entity_to_task(struct sched_entity *se) | ^ | static kernel/sched/bpf_sched.c:202:18: warning: no previous prototype for function 'bpf_sched_tag_of_entity' [-Wmissing-prototypes] 202 | __bpf_kfunc long bpf_sched_tag_of_entity(struct sched_entity *se) | ^ kernel/sched/bpf_sched.c:202:13: note: declare 'static' if the function is not intended to be used outside of this translation unit 202 | __bpf_kfunc long bpf_sched_tag_of_entity(struct sched_entity *se) | ^ | static kernel/sched/bpf_sched.c:213:17: warning: no previous prototype for function 'bpf_sched_set_task_prefer_nid' [-Wmissing-prototypes] 213 | __bpf_kfunc int bpf_sched_set_task_prefer_nid(struct task_struct *task, int nid) | ^ kernel/sched/bpf_sched.c:213:13: note: declare 'static' if the function is not intended to be used outside of this translation unit 213 | __bpf_kfunc int bpf_sched_set_task_prefer_nid(struct task_struct *task, int nid) | ^ | static 6 warnings generated. vim +/bpf_cpuacct_kcpustat_cpu_fetch +412 kernel/sched/cpuacct.c 410 411 #ifdef CONFIG_BPF_RVI > 412 __bpf_kfunc void bpf_cpuacct_kcpustat_cpu_fetch(struct kernel_cpustat *dst, 413 struct cpuacct *ca, int cpu) 414 { 415 memcpy(dst, per_cpu_ptr(ca->cpustat, cpu), sizeof(struct kernel_cpustat)); 416 } 417 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2679/2679] fs/proc/stat.c:224:17: warning: no previous prototype for function 'bpf_get_idle_time'
by kernel test robot 14 Aug '25

14 Aug '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 43d8c124ec4624389b14d42595e5f0195e3e5a1d commit: 70780f6924c9b58d5a745d4e20e08e9ace28e711 [2679/2679] bpf-rvi: proc: add bpf_get_{idle,iowait}_time kfunc config: loongarch-allmodconfig (https://download.01.org/0day-ci/archive/20250814/202508141929.x8zAFTUd-lkp@…) compiler: clang version 19.1.7 (https://github.com/llvm/llvm-project cd708029e0b2869e80abe31ddb175f7c35361f90) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250814/202508141929.x8zAFTUd-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202508141929.x8zAFTUd-lkp@intel.com/ All warnings (new ones prefixed by >>): >> fs/proc/stat.c:224:17: warning: no previous prototype for function 'bpf_get_idle_time' [-Wmissing-prototypes] 224 | __bpf_kfunc u64 bpf_get_idle_time(struct kernel_cpustat *kcs, int cpu) | ^ fs/proc/stat.c:224:13: note: declare 'static' if the function is not intended to be used outside of this translation unit 224 | __bpf_kfunc u64 bpf_get_idle_time(struct kernel_cpustat *kcs, int cpu) | ^ | static >> fs/proc/stat.c:229:17: warning: no previous prototype for function 'bpf_get_iowait_time' [-Wmissing-prototypes] 229 | __bpf_kfunc u64 bpf_get_iowait_time(struct kernel_cpustat *kcs, int cpu) | ^ fs/proc/stat.c:229:13: note: declare 'static' if the function is not intended to be used outside of this translation unit 229 | __bpf_kfunc u64 bpf_get_iowait_time(struct kernel_cpustat *kcs, int cpu) | ^ | static 2 warnings generated. vim +/bpf_get_idle_time +224 fs/proc/stat.c 222 223 #ifdef CONFIG_BPF_RVI > 224 __bpf_kfunc u64 bpf_get_idle_time(struct kernel_cpustat *kcs, int cpu) 225 { 226 return get_idle_time(kcs, cpu); 227 } 228 > 229 __bpf_kfunc u64 bpf_get_iowait_time(struct kernel_cpustat *kcs, int cpu) 230 { 231 return get_iowait_time(kcs, cpu); 232 } 233 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2679/2679] kernel/bpf-rvi/common_kfuncs.c:12:32: warning: no previous prototype for function 'bpf_mem_cgroup_from_task'
by kernel test robot 14 Aug '25

14 Aug '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 43d8c124ec4624389b14d42595e5f0195e3e5a1d commit: ebd40bbe89d81531c7df459a827d7608c3de57bc [2679/2679] bpf-rvi: Add bpf_mem_cgroup_from_task() kfunc config: loongarch-allmodconfig (https://download.01.org/0day-ci/archive/20250814/202508141840.Hfv7lhHI-lkp@…) compiler: clang version 19.1.7 (https://github.com/llvm/llvm-project cd708029e0b2869e80abe31ddb175f7c35361f90) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250814/202508141840.Hfv7lhHI-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202508141840.Hfv7lhHI-lkp@intel.com/ All warnings (new ones prefixed by >>): >> kernel/bpf-rvi/common_kfuncs.c:12:32: warning: no previous prototype for function 'bpf_mem_cgroup_from_task' [-Wmissing-prototypes] 12 | __bpf_kfunc struct mem_cgroup *bpf_mem_cgroup_from_task(struct task_struct *p) | ^ kernel/bpf-rvi/common_kfuncs.c:12:13: note: declare 'static' if the function is not intended to be used outside of this translation unit 12 | __bpf_kfunc struct mem_cgroup *bpf_mem_cgroup_from_task(struct task_struct *p) | ^ | static 1 warning generated. vim +/bpf_mem_cgroup_from_task +12 kernel/bpf-rvi/common_kfuncs.c 7 8 /* 9 * Common support kfuncs 10 */ 11 > 12 __bpf_kfunc struct mem_cgroup *bpf_mem_cgroup_from_task(struct task_struct *p) 13 { 14 return mem_cgroup_from_task(p); 15 } 16 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0