- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 00/16] backport minios part4 patches from linux mainline
by Qinxin Xia 07 Sep '26

07 Sep '26

From: Hongye Lin <linhongye(a)h-partners.com> mainline inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/8904 ---------------------------------------------------------------------- backport minios part4 patches from linux mainline Mark Brown (6): arm64/sysreg: Update HCRX_EL2 definition for DDI0601 2023-09 arm64/fpsimd: Enable host kernel access to FPMR arm64/fpsimd: Support FEAT_FPMR arm64/signal: Add FPMR signal handling arm64/ptrace: Expose FPMR via ptrace arm64/fpsimd: Don't corrupt FPMR when streaming mode changes Mark Rutland (7): arm64: ptrace: fix partial SETREGSET for NT_ARM_FPMR arm64/fpsimd: Add fpsimd_save_and_flush_current_state() arm64/fpsimd: Reset FPMR upon exec() arm64/fpsimd: signal32: Always save+flush state early arm64/fpsimd: signal: Always save+flush state early arm64/fpsimd: Avoid warning when sve_to_fpsimd() is unused arm64/fpsimd: Do not discard modified SVE state Qinxin Xia (1): Add support "arm64.nocnp" for start option arch/arm64/include/asm/cpufeature.h | 6 ++ arch/arm64/include/asm/el2_setup.h | 2 +- arch/arm64/include/asm/fpsimd.h | 7 +- arch/arm64/include/asm/kvm_arm.h | 1 - arch/arm64/include/asm/kvm_host.h | 1 + arch/arm64/include/asm/processor.h | 4 + arch/arm64/include/asm/signal_common.h | 20 ++++- arch/arm64/include/uapi/asm/sigcontext.h | 8 ++ arch/arm64/kernel/cpufeature.c | 13 ++- arch/arm64/kernel/entry-common.c | 50 ++++++++--- arch/arm64/kernel/fpsimd.c | 74 ++++++++-------- arch/arm64/kernel/idreg-override.c | 11 +++ arch/arm64/kernel/ptrace.c | 44 ++++++++++ arch/arm64/kernel/signal.c | 103 ++++++++++++----------- arch/arm64/kernel/signal32.c | 11 ++- arch/arm64/kvm/fpsimd.c | 1 + arch/arm64/kvm/hyp/include/hyp/switch.h | 13 ++- arch/arm64/tools/cpucaps | 2 +- arch/arm64/tools/sysreg | 4 +- include/uapi/linux/elf.h | 1 + 20 files changed, 259 insertions(+), 117 deletions(-) -- 2.33.0

2 17

[PATCH OLK-6.6] net/mlx5: LAG, Fix off-by-one in single-FDB error rollback
by Yi Yang 07 Sep '26

07 Sep '26

From: Shay Drory <shayd(a)nvidia.com> mainline inclusion from mainline-v7.2-rc3 commit 0f0e4ae6975c773f7854fc48932a267f6c79088f category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17727 CVE: CVE-2026-72345 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- On failure at index i, the reverse cleanup loop in mlx5_lag_create_single_fdb() starts from i, so the failed index itself is rolled back. That can operate on uninitialized state or double-tear-down a rule the add_one path already self-rolled-back. Start the rollback from i - 1 so only successfully-installed entries are undone. Fixes: ddbb5ddc43ad ("net/mlx5: LAG, Refactor lag logic") Signed-off-by: Shay Drory <shayd(a)nvidia.com> Reviewed-by: Mark Bloch <mbloch(a)nvidia.com> Signed-off-by: Tariq Toukan <tariqt(a)nvidia.com> Link: https://patch.msgid.link/20260630112917.698313-2-tariqt@nvidia.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Conflicts: drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c [Commit 3b8b364f97f40 which factored shared FDB code into shared_fdb.c is not present in this tree; mlx5_lag_create_single_fdb() still lives in lag.c. Apply the same off-by-one rollback fix there by starting the reverse cleanup at i-1 instead of i.] Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c b/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c index f6b1ac80c0af..96b1eb0ec72d 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c @@ -570,7 +570,7 @@ static int mlx5_lag_create_single_fdb(struct mlx5_lag *ldev) } return 0; err: - for (; i > MLX5_LAG_P1; i--) + for (i--; i > MLX5_LAG_P1; i--) mlx5_eswitch_offloads_single_fdb_del_one(master_esw, ldev->pf[i].dev->priv.eswitch); return err; -- 2.25.1

2 1

[PATCH OLK-6.6] ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD
by Lu Chentao 07 Sep '26

07 Sep '26

mainline inclusion from mainline-v7.2-rc2 commit 462775c620197adaabc983ce847e5b9878ff4cb0 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17314 CVE: CVE-2026-72031 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The PNY CS900 1TB SSD (Phison PS3111-S11, DRAM-less) drops off the bus after entering Device-Initiated Slumber during idle. With the default med_power_with_dipm policy the link goes down (SStatus 1 SControl 300) and does not recover, forcing the filesystem read-only. Forcing max_performance keeps the link stable across prolonged idle. Add a NOLPM quirk so link power management is disabled for this drive specifically, leaving it intact for other devices on the host. Cc: stable(a)vger.kernel.org Signed-off-by: Bryam Vargas <hexlabsecurity(a)proton.me> Reviewed-by: Niklas Cassel <cassel(a)kernel.org> Signed-off-by: Damien Le Moal <dlemoal(a)kernel.org> Conflicts: drivers/ata/libata-core.c [5.10 didn't introduce __ata_dev_quirks and ATA_QUIRK_NOLPM, adapted with ATA_HORKAGE_NOLPM] Signed-off-by: Lu Chentao <luchentao1(a)huawei.com> --- drivers/ata/libata-core.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c index 0aac030532c3..9110e9b50b80 100644 --- a/drivers/ata/libata-core.c +++ b/drivers/ata/libata-core.c @@ -4232,10 +4232,13 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { ATA_HORKAGE_NOLPM }, { "Crucial_CT960M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | ATA_HORKAGE_ZERO_AFTER_TRIM | ATA_HORKAGE_NOLPM }, + /* PNY CS900 (Phison PS3111-S11, DRAM-less) drops the link on DIPM */ + { "PNY CS900 1TB SSD", NULL, ATA_HORKAGE_NOLPM }, + /* These specific Samsung models/firmware-revs do not handle LPM well */ { "SAMSUNG MZMPC128HBFU-000MV", "CXM14M1Q", ATA_HORKAGE_NOLPM }, { "SAMSUNG SSD PM830 mSATA *", "CXM13D1Q", ATA_HORKAGE_NOLPM }, { "SAMSUNG MZ7TD256HAFV-000L9", NULL, ATA_HORKAGE_NOLPM }, { "SAMSUNG MZ7TE512HMHP-000L1", "EXT06L0Q", ATA_HORKAGE_NOLPM }, -- 2.52.0

2 1

[PATCH OLK-6.6] ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD
by Lu Chentao 07 Sep '26

07 Sep '26

mainline inclusion from mainline-v7.2-rc2 commit 462775c620197adaabc983ce847e5b9878ff4cb0 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17314 CVE: CVE-2026-72031 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The PNY CS900 1TB SSD (Phison PS3111-S11, DRAM-less) drops off the bus after entering Device-Initiated Slumber during idle. With the default med_power_with_dipm policy the link goes down (SStatus 1 SControl 300) and does not recover, forcing the filesystem read-only. Forcing max_performance keeps the link stable across prolonged idle. Add a NOLPM quirk so link power management is disabled for this drive specifically, leaving it intact for other devices on the host. Cc: stable(a)vger.kernel.org Signed-off-by: Bryam Vargas <hexlabsecurity(a)proton.me> Reviewed-by: Niklas Cassel <cassel(a)kernel.org> Signed-off-by: Damien Le Moal <dlemoal(a)kernel.org> Conflicts: drivers/ata/libata-core.c [5.10 didn't introduce __ata_dev_quirks and ATA_QUIRK_NOLPM, adapted with ATA_HORKAGE_NOLPM] Signed-off-by: Lu Chentao <luchentao1(a)huawei.com> --- drivers/ata/libata-core.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c index 0aac030532c3..9110e9b50b80 100644 --- a/drivers/ata/libata-core.c +++ b/drivers/ata/libata-core.c @@ -4232,10 +4232,13 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { ATA_HORKAGE_NOLPM }, { "Crucial_CT960M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | ATA_HORKAGE_ZERO_AFTER_TRIM | ATA_HORKAGE_NOLPM }, + /* PNY CS900 (Phison PS3111-S11, DRAM-less) drops the link on DIPM */ + { "PNY CS900 1TB SSD", NULL, ATA_HORKAGE_NOLPM }, + /* These specific Samsung models/firmware-revs do not handle LPM well */ { "SAMSUNG MZMPC128HBFU-000MV", "CXM14M1Q", ATA_HORKAGE_NOLPM }, { "SAMSUNG SSD PM830 mSATA *", "CXM13D1Q", ATA_HORKAGE_NOLPM }, { "SAMSUNG MZ7TD256HAFV-000L9", NULL, ATA_HORKAGE_NOLPM }, { "SAMSUNG MZ7TE512HMHP-000L1", "EXT06L0Q", ATA_HORKAGE_NOLPM }, -- 2.52.0

2 1

[PATCH OLK-5.10] ocfs2: validate fast symlink target during inode read
by Lai Zewei 07 Sep '26

07 Sep '26

mainline inclusion from mainline-v7.2-rc1 commit e234973f286ed2e8961a24561ec91594ec3e3ff8 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18148 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ocfs2_validate_inode_block() already rejects several inconsistent self-contained dinodes before they are exposed to the rest of the filesystem. Fast symlinks need the same treatment. A zero-cluster symlink is treated as a fast symlink and later read through page_get_link() and ocfs2_fast_symlink_read_folio(). That path uses strnlen() on the inline payload and then copies len + 1 bytes into the folio. If a corrupt dinode stores an i_size that does not fit the inline area or omits the terminating NUL at i_size, that copy reads past the end of the inode block buffer. Reject zero-cluster symlink dinodes whose i_size exceeds the inline fast-symlink capacity or whose inline payload is not NUL-terminated exactly at i_size when the inode block is validated. This keeps malformed fast symlinks from reaching the read path. Validation reproduced this kernel report: KASAN use-after-free in ocfs2_fast_symlink_read_folio+0x12c/0x1f0 RIP: 0033:0x7f5c6d859aa7 Read of size 3905 Call trace: dump_stack_lvl+0x66/0xa0 (?:?) print_report+0xce/0x630 (?:?) ocfs2_fast_symlink_read_folio+0x12c/0x1f0 (fs/ocfs2/inode.c:?) srso_alias_return_thunk+0x5/0xfbef5 (?:?) __virt_addr_valid+0x19f/0x330 (?:?) kasan_report+0xe0/0x110 (?:?) kasan_check_range+0x105/0x1b0 (?:?) __asan_memcpy+0x23/0x60 (?:?) filemap_read_folio+0x27/0xe0 (?:?) filemap_read_folio+0x35/0xe0 (?:?) do_read_cache_folio+0x138/0x230 (?:?) __page_get_link+0x26/0x110 (?:?) page_get_link+0x2e/0x70 (?:?) vfs_readlink+0x15e/0x250 (?:?) touch_atime+0x4d/0x370 (?:?) do_readlinkat+0x186/0x200 (?:?) do_user_addr_fault+0x65a/0x890 (?:?) __x64_sys_readlink+0x46/0x60 (?:?) do_syscall_64+0x115/0x6a0 (arch/x86/entry/syscall_64.c:87) entry_SYSCALL_64_after_hwframe+0x77/0x7f (?:?) Link: https://lore.kernel.org/20260528151230.361127-1-rollkingzzc@gmail.com Fixes: ea022dfb3c2a ("ocfs: simplify symlink handling") Signed-off-by: Zhang Cen <rollkingzzc(a)gmail.com> Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Cc: Gui-Dong Han <2045gemini(a)gmail.com> Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Jun Piao <piaojun(a)huawei.com> Cc: Heming Zhao <heming.zhao(a)suse.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: fs/ocfs2/inode.c [ctx conflicts] Signed-off-by: Lai Zewei <laizewei3(a)huawei.com> --- fs/ocfs2/inode.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/fs/ocfs2/inode.c b/fs/ocfs2/inode.c index 7c9dfd50c1c1..e5fa0070016f 100644 --- a/fs/ocfs2/inode.c +++ b/fs/ocfs2/inode.c @@ -1418,6 +1418,29 @@ int ocfs2_validate_inode_block(struct super_block *sb, goto bail; } + if (S_ISLNK(le16_to_cpu(di->i_mode)) && + !le32_to_cpu(di->i_clusters)) { + int max_inline = ocfs2_fast_symlink_chars(sb); + u64 i_size = le64_to_cpu(di->i_size); + + if (i_size >= max_inline) { + rc = ocfs2_error(sb, + "Invalid dinode #%llu: fast symlink i_size %llu exceeds max %d\n", + (unsigned long long)bh->b_blocknr, + (unsigned long long)i_size, + max_inline - 1); + goto bail; + } + + if (strnlen((char *)di->id2.i_symlink, i_size + 1) != i_size) { + rc = ocfs2_error(sb, + "Invalid dinode #%llu: fast symlink is not NUL-terminated at i_size %llu\n", + (unsigned long long)bh->b_blocknr, + (unsigned long long)i_size); + goto bail; + } + } + rc = 0; bail: -- 2.52.0

2 1

[PATCH OLK-5.10] wifi: mac80211: validate extension-frame layout before RX
by Gaosheng Cui 07 Sep '26

07 Sep '26

From: Zhao Li <enderaoelyther(a)gmail.com> mainline inclusion from mainline-v7.2-rc4 commit 57d503ce32eccfa7650065ca4c560f7e29a2e676 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17512 CVE: CVE-2026-68470 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Extension frames only have the extension header at the regular 802.11 header offset. The generic RX path can still reach helpers and interface dispatch code that read regular header address fields before unsupported extension subtypes are dropped. mac80211 currently only handles S1G beacon extension frames. Drop other extension subtypes before they can reach regular-header RX processing. For S1G beacons, linearize the SKB with the management-frame path and require the fixed S1G beacon header, including optional fixed fields indicated by frame control, before generic RX dispatch. Route S1G beacons through the station/default-link RX path without regular-header station lookup. Avoid regular-header address reads in the mac80211 RX paths that process S1G extension beacons, including accept-frame, duplicate-detection, address-copy, and MLO address-translation paths. Also make ieee80211_get_bssid() length-safe before returning the S1G source-address pointer. Fixes: 09a740ce352e ("mac80211: receive and process S1G beacons") Cc: stable(a)vger.kernel.org Signed-off-by: Zhao Li <enderaoelyther(a)gmail.com> Link: https://patch.msgid.link/20260611161943.91069-5-enderaoelyther@gmail.com Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Conflicts: net/mac80211/rx.c [Commit 57d503ce32ec built the S1G-beacon handling on top of ieee80211_rx_for_interface() and ieee80211_s1g_optional_len(), which do not exist in this tree (no include/linux/ieee80211-s1g.h). The equivalent logic is inlined into __ieee80211_rx_handle_packet(): S1G beacons are dispatched with a NULL sta (skipping the regular-header addr2 station lookup), and the optional-header length check is expressed with the existing ieee80211_next_tbtt_present(). ieee80211_prepare_and_rx_handle() needs no S1G shortcut because this tree does not have the SW-crypto/MLO address-copy paths.] Co-authored-by: BackportAgent@deepseek-v4-flash Signed-off-by: Hulk Robot <hulkrobot(a)huawei.com> Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- net/mac80211/rx.c | 30 ++++++++++++++++++++++++++---- net/mac80211/util.c | 3 +++ 2 files changed, 29 insertions(+), 4 deletions(-) diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c index 65fea564c9c0..ba25540c4013 100644 --- a/net/mac80211/rx.c +++ b/net/mac80211/rx.c @@ -1429,6 +1429,9 @@ ieee80211_rx_h_check_dup(struct ieee80211_rx_data *rx) if (status->flag & RX_FLAG_DUP_VALIDATED) return RX_CONTINUE; + if (ieee80211_is_ext(hdr->frame_control)) + return RX_CONTINUE; + /* * Drop duplicate 802.11 retransmissions * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery") @@ -4051,8 +4054,12 @@ static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx) struct ieee80211_hdr *hdr = (void *)skb->data; struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); u8 *bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type); - bool multicast = is_multicast_ether_addr(hdr->addr1) || - ieee80211_is_s1g_beacon(hdr->frame_control); + bool multicast; + + if (ieee80211_is_s1g_beacon(hdr->frame_control)) + return sdata->vif.type == NL80211_IFTYPE_STATION && bssid; + + multicast = is_multicast_ether_addr(hdr->addr1); switch (sdata->vif.type) { case NL80211_IFTYPE_STATION: @@ -4639,6 +4646,19 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw, err = -ENOBUFS; else err = skb_linearize(skb); + } else if (ieee80211_is_s1g_beacon(fc)) { + size_t s1g_hdr_len = offsetof(struct ieee80211_ext, + u.s1g_beacon.variable); + + if (ieee80211_next_tbtt_present(fc)) + s1g_hdr_len += 3; + + if (skb->len < s1g_hdr_len) + err = -ENOBUFS; + else + err = skb_linearize(skb); + } else if (ieee80211_is_ext(fc)) { + err = -EINVAL; } else { err = !pskb_may_pull(skb, ieee80211_hdrlen(fc)); } @@ -4714,7 +4734,8 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw, continue; } - rx.sta = sta_info_get_bss(prev, hdr->addr2); + rx.sta = ieee80211_is_s1g_beacon(hdr->frame_control) ? + NULL : sta_info_get_bss(prev, hdr->addr2); rx.sdata = prev; ieee80211_prepare_and_rx_handle(&rx, skb, false); @@ -4722,7 +4743,8 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw, } if (prev) { - rx.sta = sta_info_get_bss(prev, hdr->addr2); + rx.sta = ieee80211_is_s1g_beacon(hdr->frame_control) ? + NULL : sta_info_get_bss(prev, hdr->addr2); rx.sdata = prev; if (ieee80211_prepare_and_rx_handle(&rx, skb, true)) diff --git a/net/mac80211/util.c b/net/mac80211/util.c index e49355cbb1ce..8e27e191945d 100644 --- a/net/mac80211/util.c +++ b/net/mac80211/util.c @@ -67,6 +67,9 @@ u8 *ieee80211_get_bssid(struct ieee80211_hdr *hdr, size_t len, if (ieee80211_is_s1g_beacon(fc)) { struct ieee80211_ext *ext = (void *) hdr; + if (len < offsetofend(struct ieee80211_ext, u.s1g_beacon.sa)) + return NULL; + return ext->u.s1g_beacon.sa; } -- 2.43.0

2 1

[PATCH OLK-6.6 00/24] arm64: support BBML2 noabort feature
by Jinjiang Tu 07 Sep '26

07 Sep '26

Anshuman Khandual (1): arm64/mm: Rename pte_mkpresent() as pte_mkvalid() Ard Biesheuvel (1): arm64: Avoid enabling KPTI unnecessarily Catalin Marinas (1): arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type Dev Jain (2): arm64: Enable permission change on arm64 kernel block mappings arm64/pageattr: Propagate return value from __change_memory_common Jeremy Linton (1): arm64: cpufeature: Display the set of cores with a feature Jinjiang Tu (1): arm64: cpufeature: add HISI_HIP13 to BBML2 allow list Kevin Brodsky (1): arm64: mm: Simplify check in arch_kfence_init_pool() Linu Cherian (3): arm64: sysreg: Add BBM_3 arm64: cpufeature: Rename BBML2_NOABORT as BBML3 arm64: cpufeature: Detect BBML3 based on ID_AA64MMFR2_EL1.BBM Lorenzo Stoakes (1): mm/pagewalk: split walk_page_range_novma() into kernel/user parts Mark Rutland (1): arm64: Split kpti_install_ng_mappings() Mikołaj Lenczewski (2): arm64: Add BBM Level 2 cpu feature arm64/mm: Elide tlbi in contpte_convert() under BBML2 Muchun Song (1): mm: pagewalk: assert write mmap lock only for walking the user page tables Ryan Roberts (7): arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context arm64: mm: Optimize range_split_to_ptes() arm64: mm: Tidy up force_pte_mapping() arm64: mm: Fix rodata=full block mapping support for realm guests arm64/mm: generalize PMD_PRESENT_INVALID for all levels arm64: mm: Handle invalid large leaf mappings correctly Yang Shi (1): arm64: mm: support large block mapping when rodata=full arch/arm64/include/asm/cpufeature.h | 32 ++ arch/arm64/include/asm/kfence.h | 3 +- arch/arm64/include/asm/mmu.h | 5 + arch/arm64/include/asm/pgtable-prot.h | 10 +- arch/arm64/include/asm/pgtable.h | 35 +- arch/arm64/kernel/cpufeature.c | 161 +++++++-- arch/arm64/mm/contpte.c | 134 +++++++- arch/arm64/mm/init.c | 6 +- arch/arm64/mm/mmu.c | 474 +++++++++++++++++++++++++- arch/arm64/mm/pageattr.c | 166 ++++++--- arch/arm64/mm/pfn_range_alloc.c | 6 +- arch/arm64/mm/proc.S | 27 +- arch/arm64/mm/trans_pgd.c | 40 +-- arch/arm64/tools/cpucaps | 2 +- arch/arm64/tools/sysreg | 1 + arch/openrisc/kernel/dma.c | 4 +- arch/riscv/mm/pageattr.c | 8 +- arch/sw_64/mm/pageattr.c | 2 +- include/linux/pagewalk.h | 10 +- mm/internal.h | 5 + mm/pagewalk.c | 82 ++++- mm/ptdump.c | 3 +- 22 files changed, 1047 insertions(+), 169 deletions(-) -- 2.43.0

2 25

[PATCH OLK-5.10] wifi: mac80211: validate extension-frame layout before RX
by Gaosheng Cui 07 Sep '26

07 Sep '26

From: Zhao Li <enderaoelyther(a)gmail.com> mainline inclusion from mainline-v7.2-rc4 commit 57d503ce32eccfa7650065ca4c560f7e29a2e676 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17512 CVE: CVE-2026-68470 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Extension frames only have the extension header at the regular 802.11 header offset. The generic RX path can still reach helpers and interface dispatch code that read regular header address fields before unsupported extension subtypes are dropped. mac80211 currently only handles S1G beacon extension frames. Drop other extension subtypes before they can reach regular-header RX processing. For S1G beacons, linearize the SKB with the management-frame path and require the fixed S1G beacon header, including optional fixed fields indicated by frame control, before generic RX dispatch. Route S1G beacons through the station/default-link RX path without regular-header station lookup. Avoid regular-header address reads in the mac80211 RX paths that process S1G extension beacons, including accept-frame, duplicate-detection, address-copy, and MLO address-translation paths. Also make ieee80211_get_bssid() length-safe before returning the S1G source-address pointer. Fixes: 09a740ce352e ("mac80211: receive and process S1G beacons") Cc: stable(a)vger.kernel.org Signed-off-by: Zhao Li <enderaoelyther(a)gmail.com> Link: https://patch.msgid.link/20260611161943.91069-5-enderaoelyther@gmail.com Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Conflicts: net/mac80211/rx.c [Commit 57d503ce32ec built the S1G-beacon handling on top of ieee80211_rx_for_interface() and ieee80211_s1g_optional_len(), which do not exist in this tree (no include/linux/ieee80211-s1g.h). The equivalent logic is inlined into __ieee80211_rx_handle_packet(): S1G beacons are dispatched with a NULL sta (skipping the regular-header addr2 station lookup), and the optional-header length check is expressed with the existing ieee80211_next_tbtt_present(). ieee80211_prepare_and_rx_handle() needs no S1G shortcut because this tree does not have the SW-crypto/MLO address-copy paths.] Co-authored-by: BackportAgent@deepseek-v4-flash Signed-off-by: Hulk Robot <hulkrobot(a)huawei.com> Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- net/mac80211/rx.c | 30 ++++++++++++++++++++++++++---- net/mac80211/util.c | 3 +++ 2 files changed, 29 insertions(+), 4 deletions(-) diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c index 65fea564c9c0..ba25540c4013 100644 --- a/net/mac80211/rx.c +++ b/net/mac80211/rx.c @@ -1429,6 +1429,9 @@ ieee80211_rx_h_check_dup(struct ieee80211_rx_data *rx) if (status->flag & RX_FLAG_DUP_VALIDATED) return RX_CONTINUE; + if (ieee80211_is_ext(hdr->frame_control)) + return RX_CONTINUE; + /* * Drop duplicate 802.11 retransmissions * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery") @@ -4051,8 +4054,12 @@ static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx) struct ieee80211_hdr *hdr = (void *)skb->data; struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); u8 *bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type); - bool multicast = is_multicast_ether_addr(hdr->addr1) || - ieee80211_is_s1g_beacon(hdr->frame_control); + bool multicast; + + if (ieee80211_is_s1g_beacon(hdr->frame_control)) + return sdata->vif.type == NL80211_IFTYPE_STATION && bssid; + + multicast = is_multicast_ether_addr(hdr->addr1); switch (sdata->vif.type) { case NL80211_IFTYPE_STATION: @@ -4639,6 +4646,19 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw, err = -ENOBUFS; else err = skb_linearize(skb); + } else if (ieee80211_is_s1g_beacon(fc)) { + size_t s1g_hdr_len = offsetof(struct ieee80211_ext, + u.s1g_beacon.variable); + + if (ieee80211_next_tbtt_present(fc)) + s1g_hdr_len += 3; + + if (skb->len < s1g_hdr_len) + err = -ENOBUFS; + else + err = skb_linearize(skb); + } else if (ieee80211_is_ext(fc)) { + err = -EINVAL; } else { err = !pskb_may_pull(skb, ieee80211_hdrlen(fc)); } @@ -4714,7 +4734,8 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw, continue; } - rx.sta = sta_info_get_bss(prev, hdr->addr2); + rx.sta = ieee80211_is_s1g_beacon(hdr->frame_control) ? + NULL : sta_info_get_bss(prev, hdr->addr2); rx.sdata = prev; ieee80211_prepare_and_rx_handle(&rx, skb, false); @@ -4722,7 +4743,8 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw, } if (prev) { - rx.sta = sta_info_get_bss(prev, hdr->addr2); + rx.sta = ieee80211_is_s1g_beacon(hdr->frame_control) ? + NULL : sta_info_get_bss(prev, hdr->addr2); rx.sdata = prev; if (ieee80211_prepare_and_rx_handle(&rx, skb, true)) diff --git a/net/mac80211/util.c b/net/mac80211/util.c index e49355cbb1ce..8e27e191945d 100644 --- a/net/mac80211/util.c +++ b/net/mac80211/util.c @@ -67,6 +67,9 @@ u8 *ieee80211_get_bssid(struct ieee80211_hdr *hdr, size_t len, if (ieee80211_is_s1g_beacon(fc)) { struct ieee80211_ext *ext = (void *) hdr; + if (len < offsetofend(struct ieee80211_ext, u.s1g_beacon.sa)) + return NULL; + return ext->u.s1g_beacon.sa; } -- 2.43.0

2 1

[PATCH OLK-5.10] drm/vmwgfx: validate DRAW_PRIMITIVES header size before division
by Hongtao Zhang 07 Sep '26

07 Sep '26

From: Zack Rusin <zack.rusin(a)broadcom.com> stable inclusion from stable-v6.6.151 commit 2666cddf0dd218aa9bd1f99db688d1b532eac21a category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17884 CVE: CVE-2026-74444 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 85891d174707d8bddcec7a888fb4e1d17def34f3 upstream. vmw_cmd_draw() computes maxnum = (header->size - sizeof(cmd->body)) / sizeof(*decl); where header->size is u32 and is taken straight from the user-supplied command stream. When header->size is less than sizeof(cmd->body) the unsigned subtraction wraps to nearly 4 GiB, producing a huge maxnum. Any user-controlled cmd->body.numVertexDecls then passes the bound and the loop dereferences decl[i] far past the end of the kernel command bounce buffer, producing an out-of-bounds read of kernel memory. Reject undersized headers up front. Fixes: 7a73ba7469cb ("drm/vmwgfx: Use TTM handles instead of SIDs as user-space surface handles.") Cc: stable(a)vger.kernel.org Assisted-by: Claude:claude-opus-4.7 Signed-off-by: Zack Rusin <zack.rusin(a)broadcom.com> Reviewed-by: Ian Forbes <ian.forbes(a)broadcom.com> Link: https://patch.msgid.link/20260505222728.519626-7-zack.rusin@broadcom.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Hongtao <zhanghongtao35(a)huawei.com> --- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c index 6e75adaae0bcd..e690751698307 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c @@ -1563,11 +1563,17 @@ static int vmw_cmd_draw(struct vmw_private *dev_priv, uint32_t maxnum; int ret; + cmd = container_of(header, typeof(*cmd), header); + + if (unlikely(header->size < sizeof(cmd->body))) { + VMW_DEBUG_USER("Illegal DRAW_PRIMITIVES header size.\n"); + return -EINVAL; + } + ret = vmw_cmd_cid_check(dev_priv, sw_context, header); if (unlikely(ret != 0)) return ret; - cmd = container_of(header, typeof(*cmd), header); maxnum = (header->size - sizeof(cmd->body)) / sizeof(*decl); if (unlikely(cmd->body.numVertexDecls > maxnum)) { -- 2.43.0

2 1

[PATCH OLK-6.6] serial: amba-pl011: synchronize DMA teardown
by Cai Xinchen 07 Sep '26

07 Sep '26

From: Fan Wu <fanwu01(a)zju.edu.cn> stable inclusion from stable-6.6.154 commit c8c8e895f65fbf71ea6224e27cf8dab91b776e0d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18582 CVE: CVE-2026-80737 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------ [ Upstream commit 440915499231e9db1c361aa45bb702e8fd3b4a32 ] dmaengine_terminate_all() does not wait for a running callback, so the TX callback can still touch the TX buffer after it is freed. The RX poll timer reads the RX buffers without the port lock. Switch to dmaengine_terminate_sync() and delete the RX timer before freeing the buffers. Fixes: ead76f329f77 ("ARM: 6763/1: pl011: add optional RX DMA to PL011 v2") Cc: stable <stable(a)kernel.org> Assisted-by: Codex:gpt-5.6 Signed-off-by: Fan Wu <fanwu01(a)zju.edu.cn> Link: https://patch.msgid.link/20260731085915.326775-4-fanwu01@zju.edu.cn Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> [ changed upstream's `timer_delete_sync()` deletion to match this tree's `del_timer_sync()` spelling at the old call site ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- drivers/tty/serial/amba-pl011.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c index 8aa71a51cdab..4c107556ae31 100644 --- a/drivers/tty/serial/amba-pl011.c +++ b/drivers/tty/serial/amba-pl011.c @@ -1193,7 +1193,7 @@ static void pl011_dma_shutdown(struct uart_amba_port *uap) if (uap->using_tx_dma) { /* In theory, this should already be done by pl011_dma_flush_buffer */ - dmaengine_terminate_all(uap->dmatx.chan); + dmaengine_terminate_sync(uap->dmatx.chan); if (uap->dmatx.queued) { dma_unmap_single(uap->dmatx.chan->device->dev, uap->dmatx.dma, uap->dmatx.len, @@ -1206,12 +1206,12 @@ static void pl011_dma_shutdown(struct uart_amba_port *uap) } if (uap->using_rx_dma) { - dmaengine_terminate_all(uap->dmarx.chan); + if (uap->dmarx.poll_rate) + timer_delete_sync(&uap->dmarx.timer); + dmaengine_terminate_sync(uap->dmarx.chan); /* Clean up the RX DMA */ pl011_dmabuf_free(uap->dmarx.chan, &uap->dmarx.dbuf_a, DMA_FROM_DEVICE); pl011_dmabuf_free(uap->dmarx.chan, &uap->dmarx.dbuf_b, DMA_FROM_DEVICE); - if (uap->dmarx.poll_rate) - del_timer_sync(&uap->dmarx.timer); uap->using_rx_dma = false; } } -- 2.18.0.huawei.25

2 1