- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] drm/amd/display: avoid divide-by-zero in __is_lut_linear()
by Zhang Yuwei 08 Oct '26

08 Oct '26

From: Harry Wentland <harry.wentland(a)amd.com> stable inclusion from stable-6.6.157 commit 4d5ee095a58461b2446d7a6eb0c14c2fe3eaab44 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19551 CVE: CVE-2026-89821 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------ commit 4f40873f8a4107df2b9c8e68c947c4fd0cd519d2 upstream. __is_lut_linear() computes the expected value of each entry with expected = i * MAX_DRM_LUT_VALUE / (size - 1); If it is ever called with a single-entry LUT, size - 1 is zero and the kernel takes a divide error (#DE). A LUT with fewer than two entries cannot describe a linear mapping anyway, so return false early instead of dividing by zero. Fixes: 086247a4b2fb ("drm/amd/display: Use 4096 lut entries") Cc: stable(a)vger.kernel.org Signed-off-by: Harry Wentland <harry.wentland(a)amd.com> Reviewed-by: Melissa Wen <mwen(a)igalia.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Hulk Robot <hulkrobot(a)huawei.com> --- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c index a4cb23d059bd..191a3c5cded5 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c @@ -118,6 +118,12 @@ static bool __is_lut_linear(const struct drm_color_lut *lut, uint32_t size) uint32_t expected; int delta; + /* A LUT with fewer than two entries can't be interpolated and would + * divide by zero below (size - 1); it can't be treated as linear. + */ + if (size < 2) + return false; + for (i = 0; i < size; i++) { /* All color values should equal */ if ((lut[i].red != lut[i].green) || (lut[i].green != lut[i].blue)) -- 2.22.0

2 1

[PATCH OLK-5.10] drm: fix race between partial drm_dev_register() failure and ioctl
by Zhang Yuwei 08 Oct '26

08 Oct '26

From: Danilo Krummrich <dakr(a)kernel.org> stable inclusion from stable-v5.10.270 commit 26d9162213952927cd59c0d94b7e0e992b347bec category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19060 CVE: CVE-2026-89823 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit eb197f7d60f00d0f5b1b3505dfc86a7e36045a3e upstream. If drm_dev_register() fails after registering a minor (e.g. render minor registered, primary minor fails), userspace could have opened the first minor and entered a drm_dev_enter() critical section. Since the unplugged flag was never set, the ioctl proceeds while the error path tears down device resources. Fix this by introducing drm_dev_synchronize_unplug(), which sets the unplugged flag and waits for the SRCU barrier, ensuring all in-flight drm_dev_enter() critical sections complete before cleanup proceeds; call it on the error path of drm_dev_register(). Fixes: bee330f3d672 ("drm: Use srcu to protect drm_device.unplugged") Cc: stable(a)vger.kernel.org Reported-by: sashiko-bot(a)kernel.org Closes: https://lore.kernel.org/all/20260620190648.2E9F61F000E9@smtp.kernel.org/ Reviewed-by: Alexandre Courbot <acourbot(a)nvidia.com> Reviewed-by: Lyude Paul <lyude(a)redhat.com> Tested-by: Deborah Brouwer <deborah.brouwer(a)collabora.com> Link: https://patch.msgid.link/20260628145406.2107056-17-dakr@kernel.org Signed-off-by: Danilo Krummrich <dakr(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Hulk Robot <hulkrobot(a)huawei.com> --- drivers/gpu/drm/drm_drv.c | 34 +++++++++++++++++++++++++--------- 1 file changed, 25 insertions(+), 9 deletions(-) diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c index 10831d8d7148..63a0fa8054b1 100644 --- a/drivers/gpu/drm/drm_drv.c +++ b/drivers/gpu/drm/drm_drv.c @@ -447,6 +447,22 @@ void drm_dev_exit(int idx) } EXPORT_SYMBOL(drm_dev_exit); +/* + * Mark the device as unplugged and wait for any in-flight drm_dev_enter() + * critical sections to complete. + */ +static void drm_dev_synchronize_unplug(struct drm_device *dev) +{ + /* + * After synchronizing any critical read section is guaranteed to see + * the new value of ->unplugged, and any critical section which might + * still have seen the old value of ->unplugged is guaranteed to have + * finished. + */ + dev->unplugged = true; + synchronize_srcu(&drm_unplug_srcu); +} + /** * drm_dev_unplug - unplug a DRM device * @dev: DRM device @@ -459,15 +475,7 @@ EXPORT_SYMBOL(drm_dev_exit); */ void drm_dev_unplug(struct drm_device *dev) { - /* - * After synchronizing any critical read section is guaranteed to see - * the new value of ->unplugged, and any critical section which might - * still have seen the old value of ->unplugged is guaranteed to have - * finished. - */ - dev->unplugged = true; - synchronize_srcu(&drm_unplug_srcu); - + drm_dev_synchronize_unplug(dev); drm_dev_unregister(dev); } EXPORT_SYMBOL(drm_dev_unplug); @@ -885,6 +893,7 @@ int drm_dev_register(struct drm_device *dev, unsigned long flags) goto err_minors; dev->registered = true; + dev->unplugged = false; if (dev->driver->load) { ret = dev->driver->load(dev, flags); @@ -912,6 +921,13 @@ int drm_dev_register(struct drm_device *dev, unsigned long flags) if (dev->driver->unload) dev->driver->unload(dev); err_minors: + /* + * If a minor was registered before the failure, userspace could have + * opened it and entered a drm_dev_enter() critical section. Ensure all + * such sections complete before we clean up. + */ + drm_dev_synchronize_unplug(dev); + remove_compat_control_link(dev); drm_minor_unregister(dev, DRM_MINOR_PRIMARY); drm_minor_unregister(dev, DRM_MINOR_RENDER); -- 2.22.0

2 1

[PATCH OLK-6.6] tracing: Fix hist trigger timestamps for buffered events
by Tengda Wu 08 Oct '26

08 Oct '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/10071 ---------------------------------------- Syzkaller triggered a WARN_ON_ONCE(!nest) warning: WARNING: kernel/trace/ring_buffer.c:821 at ring_buffer_event_time_stamp Call trace: ring_buffer_event_time_stamp hist_field_timestamp hist_fn_call event_hist_trigger event_triggers_call __event_trigger_test_discard trace_event_buffer_commit do_trace_event_raw_event_sched_switch trace_event_raw_event_sched_switch The warning is probabilistically reproducible and is related to syzkaller executing the following commands: echo 'prev_pid == 999999' > events/sched/sched_switch/filter echo 'hist:keys=common_timestamp' > events/sched/sched_switch/trigger The specific triggering process is as follows: CPU 0 CPU 1 (context switching) (echo 'hist:keys=common_timestamp' > \ events/sched/sched_switch/trigger) do_trace_event_raw_event_##call trace_event_buffer_lock_reserve if (!tr->no_filter_buffering_ref && trace_file->flags & EVENT_FILE_FL_FILTERED) return entry; // return directly event_hist_trigger_parse hist_register_trigger tracing_set_filter_buffering(file->tr, true); tr->no_filter_buffering_ref++; __trace_buffer_lock_reserve rb_start_commit local_inc(&cpu_buffer->committing); // skipped and not executed trace_event_buffer_commit __event_trigger_test_discard event_triggers_call event_hist_trigger hist_fn_call hist_field_timestamp ring_buffer_event_time_stamp nest = local_read(&cpu_buffer->committing); WARN_ON_ONCE(!nest) // trigger warning The root cause is that when an event file has a filter attached and the hist trigger has not yet been attached, trace_event_buffer_lock_reserve() writes the event into the per-CPU trace_buffered_event temp buffer instead of reserving it in the ring buffer, so cpu_buffer->committing is not incremented. When the event is later processed at commit time by a hist trigger, hist_field_timestamp() -> ring_buffer_event_time_stamp() sees a zero committing count, triggering WARN_ON_ONCE(!nest). tracing_event_time_stamp() was added by commit d8279bfc5e959 ("tracing: Add tracing_event_time_stamp() API") for exactly this case: if the event is the per-CPU trace_buffered_event, it returns the current ring buffer timestamp. But it never gained a caller. Use it in hist_field_timestamp(), so that a hist trigger that races onto a buffered event records the current time, which is only marginally later than when the event was recorded, instead of warning and recording a bogus timestamp. Fixes: b94bc80df648 ("tracing: Use a no_filter_buffering_ref to stop using the filter buffer") Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/trace/trace_events_hist.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c index d5602a4c6eb5..856d75942581 100644 --- a/kernel/trace/trace_events_hist.c +++ b/kernel/trace/trace_events_hist.c @@ -874,7 +874,7 @@ static u64 hist_field_timestamp(struct hist_field *hist_field, struct hist_trigger_data *hist_data = hist_field->hist_data; struct trace_array *tr = hist_data->event_file->tr; - u64 ts = ring_buffer_event_time_stamp(buffer, rbe); + u64 ts = tracing_event_time_stamp(buffer, rbe); if (hist_data->attrs->ts_in_usecs && trace_clock_in_ns(tr)) ts = ns2usecs(ts); -- 2.34.1

2 1

[PATCH OLK-6.6] nfsd: fix redeclaration of 'clp' in nfs4_laundromat()
by Tengda Wu 08 Oct '26

08 Oct '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/10070 -------------------------------- Commit db4cef375f33 ("NFSD: Prevent client use-after-free during delegation revoke") introduced a second declaration of 'clp' in nfs4_laundromat(), causing a compilation error: fs/nfsd/nfs4state.c: In function ‘nfs4_laundromat’: fs/nfsd/nfs4state.c:6325:29: error: redeclaration of ‘clp’ with no linkage 6325 | struct nfs4_client *clp; | ^~~ fs/nfsd/nfs4state.c:6314:29: note: previous declaration of ‘clp’ with type ‘struct nfs4_client *’ 6314 | struct nfs4_client *clp; | ^~~ Remove the redundant declaration. Fixes: db4cef375f33 ("NFSD: Prevent client use-after-free during delegation revoke") Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- fs/nfsd/nfs4state.c | 1 - 1 file changed, 1 deletion(-) diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c index 775beac19656..770f9a8a18ce 100644 --- a/fs/nfsd/nfs4state.c +++ b/fs/nfsd/nfs4state.c @@ -6311,7 +6311,6 @@ nfs4_process_client_reaplist(struct list_head *reaplist) static time64_t nfs4_laundromat(struct nfsd_net *nn) { - struct nfs4_client *clp; struct nfs4_openowner *oo; struct nfs4_delegation *dp; struct nfs4_ol_stateid *stp; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] [Backport] iommu/vt-d: Force requesting ACS when tboot is enabled
by Jiacheng Yu 08 Oct '26

08 Oct '26

From: Kevin Tian <kevin.tian(a)intel.com> mainline inclusion from mainline-v7.3-rc1 commit 607432b2618b61df81134be0ef2562b8300c1216 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18838 CVE: CVE-2026-89448 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Currently the conditions of requesting ACS in detect_intel_iommu() don't include tboot, leading to a possible misconfiguration with ACS disabled (e.g. due to user opts) while iommu is later forced on by tboot_force_iommu(). Fix it by checking tboot in detect_intel_iommu(). Fixes: 5d990b627537 ("PCI: add pci_request_acs") Cc: stable(a)vger.kernel.org Signed-off-by: Kevin Tian <kevin.tian(a)intel.com> Signed-off-by: Lu Baolu <baolu.lu(a)linux.intel.com> Signed-off-by: Joerg Roedel <joerg.roedel(a)amd.com> Conflicts: drivers/iommu/intel/dmar.c drivers/iommu/dmar.c drivers/iommu/intel/iommu.c drivers/iommu/intel/iommu.h include/linux/dma_remapping.h [1. The upstream patch lives under drivers/iommu/intel/; this tree keeps the Intel IOMMU code at drivers/iommu/dmar.c and drivers/iommu/intel-iommu.c. 2. This tree has no dmar_platform_optin() in the detect_intel_iommu() condition, so dmar_required() keeps only the !dmar_disabled check to preserve the original behavior. 3. intel_iommu_tboot_noforce is already non-static in intel-iommu.c, so the drivers/iommu/intel/iommu.c change is dropped. 4. The extern int intel_iommu_tboot_noforce and the intel_iommu_tboot_noforce (0) fallback live in include/linux/dma_remapping.h instead of the upstream Intel IOMMU header.] Signed-off-by: Jiacheng Yu <yujiacheng3(a)huawei.com> --- drivers/iommu/dmar.c | 14 +++++++++++++- include/linux/dma_remapping.h | 1 + 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c index 6d608f71867c..27fdd4f220db 100644 --- a/drivers/iommu/dmar.c +++ b/drivers/iommu/dmar.c @@ -898,6 +898,18 @@ dmar_validate_one_drhd(struct acpi_dmar_header *entry, void *arg) return 0; } +static bool dmar_required(void) +{ + /* tboot supersedes any user/platform opt */ + if (!intel_iommu_tboot_noforce && tboot_enabled()) + return true; + + if (!no_iommu && !dmar_disabled) + return true; + + return false; +} + int __init detect_intel_iommu(void) { int ret; @@ -911,7 +923,7 @@ int __init detect_intel_iommu(void) if (!ret) ret = dmar_walk_dmar_table((struct acpi_table_dmar *)dmar_tbl, &validate_drhd_cb); - if (!ret && !no_iommu && !iommu_detected && !dmar_disabled) { + if (!ret && !iommu_detected && dmar_required()) { iommu_detected = 1; /* Make sure ACS will be enabled */ pci_request_acs(); diff --git a/include/linux/dma_remapping.h b/include/linux/dma_remapping.h index 21b3e7d33d68..5ce02d0f4688 100644 --- a/include/linux/dma_remapping.h +++ b/include/linux/dma_remapping.h @@ -52,6 +52,7 @@ static inline int iommu_calculate_max_sagaw(struct intel_iommu *iommu) } #define dmar_disabled (1) #define intel_iommu_enabled (0) +#define intel_iommu_tboot_noforce (0) #endif -- 2.34.1

2 1

[PATCH OLK-6.6] Fix duplicate variable definition in nfs4_laundromat()
by Zizhi Wo 08 Oct '26

08 Oct '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/10070 -------------------------------- Fix duplicate variable definition in nfs4_laundromat(), and modify the comment to adapt mainline. Fixes: db4cef375f330 ("[Backport] NFSD: Prevent client use-after-free during delegation revoke") Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/nfsd/netns.h | 3 ++- fs/nfsd/nfs4state.c | 1 - 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/nfsd/netns.h b/fs/nfsd/netns.h index eb8b8ebcb8b7..4a41645bb592 100644 --- a/fs/nfsd/netns.h +++ b/fs/nfsd/netns.h @@ -104,11 +104,12 @@ struct nfsd_net { /* protected by blocked_locks_lock */ struct list_head blocked_locks_lru; struct delayed_work laundromat_work; - /* client_lock protects the client lru list and session hash table */ + /* client_lock protects the client lru list and session hash + * table; nests inside deleg_lock */ spinlock_t client_lock; /* protects blocked_locks_lru */ spinlock_t blocked_locks_lock; diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c index 775beac19656..770f9a8a18ce 100644 --- a/fs/nfsd/nfs4state.c +++ b/fs/nfsd/nfs4state.c @@ -6309,11 +6309,10 @@ nfs4_process_client_reaplist(struct list_head *reaplist) } static time64_t nfs4_laundromat(struct nfsd_net *nn) { - struct nfs4_client *clp; struct nfs4_openowner *oo; struct nfs4_delegation *dp; struct nfs4_ol_stateid *stp; struct nfsd4_blocked_lock *nbl; struct list_head *pos, *next, reaplist; -- 2.52.0

2 1

[PATCH OLK-5.10 0/2] Backport tracing mainline patches
by Tengda Wu 08 Oct '26

08 Oct '26

Backport tracing mainline patches. Steven Rostedt (1): tracing: Take trace_array reference when opening a tracer options file Tengda Wu (1): tracing: tracing: Fix KABI breakage from trace_options nr_topts field kernel/trace/trace.c | 52 +++++++++++++++++++++++++++++++++++++++++++- kernel/trace/trace.h | 1 + 2 files changed, 52 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH OLK-6.6 00/16] CVE-2026-74559
by Zhang Changzhong 30 Sep '26

30 Sep '26

Albert Huang (1): xsk: Avoid starving the xsk further down the list Fernando Fernandez Mancera (1): xsk: avoid data corruption on cq descriptor number Jason Xing (7): xsk: prevent CQ desync when freeing half-built skbs in xsk_build_skb() xsk: fix use-after-free of xs->skb in xsk_build_skb() free_err path xsk: fix u64 descriptor address truncation on 32-bit architectures xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx net: xsk: update tx queue consumer immediately after transmission xsk: drain continuation descs after overflow in xsk_build_skb() xsk: fix xsk_addrs slab leak on multi-buffer error path Maciej Fijalkowski (5): xsk: Use xsk_buff_pool directly for cq functions xsk: Fix immature cq descriptor production xsk: avoid overwriting skb fields for multi-buffer traffic xsk: provide sufficient space in pool->tx_descs xsk: reclaim invalid Tx descriptors in ZC batch path Wang Liang (1): xsk: Fix __xsk_generic_xmit() error code when cq is full Zhang Changzhong (1): Revert "xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx" Documentation/networking/af_xdp.rst | 54 ++-- include/net/xdp_sock.h | 8 + include/net/xsk_buff_pool.h | 9 +- net/xdp/xsk.c | 483 +++++++++++++++++++++++++++++++----- net/xdp/xsk_buff_pool.c | 13 +- net/xdp/xsk_queue.h | 77 ++++-- 6 files changed, 533 insertions(+), 111 deletions(-) -- 2.9.5

2 17

[PATCH OLK-5.10 00/14] CVE-2026-74724
by Zhang Changzhong 30 Sep '26

30 Sep '26

Florian Westphal (4): netfilter: ipvs: prepare for hook function reduction netfilter: ipvs: remove unneeded output wrappers netfilter: ipvs: remove unneeded input wrappers netfilter: ipvs: merge ipv4 + ipv6 icmp reply handlers Julian Anastasov (9): ipvs: skip ipv6 extension headers for csum checks ipvs: fix the checksum validations ipvs: fix more places with wrong ipv6 transport offsets ipvs: ensure inner headers in ICMP errors are in headroom ipvs: fix places with wrong packet offsets ipvs: do not mangle ICMP replies for non-first fragments ipvs: avoid out-of-bounds write in ip_vs_nat_icmp ipvs: return the csum validation for forward hook ipvs: revalidate ihl to prevent out-of-bounds access Yizhou Zhao (1): ipvs: fix PMTU for GUE/GRE tunnel ICMP errors include/net/ip6_fib.h | 2 + include/net/ip_vs.h | 38 +++- net/netfilter/ipvs/ip_vs_app.c | 10 +- net/netfilter/ipvs/ip_vs_core.c | 416 +++++++++++++--------------------- net/netfilter/ipvs/ip_vs_proto_sctp.c | 29 ++- net/netfilter/ipvs/ip_vs_proto_tcp.c | 59 +---- net/netfilter/ipvs/ip_vs_proto_udp.c | 64 ++---- net/netfilter/ipvs/ip_vs_xmit.c | 43 +++- 8 files changed, 268 insertions(+), 393 deletions(-) -- 2.9.5

2 15

[PATCH OLK-6.6 0/2] *** CVE-2026-89929 ***
by Zhang Kunbo 30 Sep '26

30 Sep '26

*** BLURB HERE *** Sean Christopherson (1): KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02 Yosry Ahmed (1): KVM: nVM: Ensure INVVPID is emulated on the correct physical CPU arch/x86/kvm/vmx/nested.c | 52 +++++++++++++++++---------------------- 1 file changed, 22 insertions(+), 30 deletions(-) -- 2.34.1

2 3