- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 0/2] *** CVE-2026-68081 ***
by Zhang Kunbo 29 Sep '26

29 Sep '26

*** BLURB HERE *** Sean Christopherson (2): KVM: nVMX: Add helper to put (unmap) vmcs12 pages KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state arch/x86/kvm/vmx/nested.c | 34 ++++++++++++++++++++-------------- 1 file changed, 20 insertions(+), 14 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/3] backport devfreq uncore DVFS governor patches
by Jie Zhan 29 Sep '26

29 Sep '26

driver inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/9163 ---------------------------------------------------------------------- backport devfreq uncore DVFS governor patches Jie Zhan (2): perf/core: Add perf_pmu_type_by_parent_dev() for in-kernel PMU lookup devfreq: hisi: Add devfreq-event support via L3C PMU Jonathan Cameron (1): perf/hisi-uncore: Assign parents for event_source devices drivers/devfreq/Kconfig | 3 +- drivers/devfreq/hisi_uncore_freq.c | 444 ++++++++++++++++++++++- drivers/perf/hisilicon/hisi_uncore_pmu.c | 1 + include/linux/perf_event.h | 2 + kernel/events/core.c | 28 ++ 5 files changed, 474 insertions(+), 4 deletions(-) -- 2.43.0

2 4

[PATCH OLK-6.6] cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0
by Lu Jialin 29 Sep '26

29 Sep '26

From: Frank Sorenson <sorenson(a)redhat.com> stable inclusion from stable-6.6.157 commit 7f62817fe049b0f3652518c1ba72631ec1e0a322 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18924 CVE: CVE-2026-89640 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------ commit 6c322f5cf7476ded7a9a20f7be72462065a03c68 upstream. With len == 0 (clone to EOF), the effective length is computed as: len = src_inode->i_size - off; If off > i_size, this is a negative loff_t, corrupting the ByteCount in the FSCTL_DUPLICATE_EXTENTS_TO_FILE request and inverting the range in filemap_write_and_wait_range(). The existing off >= i_size check fires only after the ioctl has already been sent. Snapshot i_size_read() once for both the bounds check and the length calculation, eliminating the TOCTOU and 32-bit torn-read risk. Reject off > src_size with -EINVAL. Treat off == src_size as a no-op, consistent with __generic_remap_file_range_prep(). Fixes: 04b38d601239 ("vfs: pull btrfs clone API to vfs layer") Cc: stable(a)vger.kernel.org Signed-off-by: Frank Sorenson <sorenson(a)redhat.com> Reviewed-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Paulo Alcantara <pc(a)manguebit.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- fs/smb/client/cifsfs.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/fs/smb/client/cifsfs.c b/fs/smb/client/cifsfs.c index 4d5f3a2c8e50..c19e7d16a13a 100644 --- a/fs/smb/client/cifsfs.c +++ b/fs/smb/client/cifsfs.c @@ -1327,8 +1327,19 @@ static loff_t cifs_remap_file_range(struct file *src_file, loff_t off, */ lock_two_nondirectories(target_inode, src_inode); - if (len == 0) - len = src_inode->i_size - off; + if (len == 0) { + loff_t src_size = i_size_read(src_inode); + + if (off > src_size) { + rc = -EINVAL; + goto unlock; + } + len = src_size - off; + if (!len) { + rc = 0; + goto unlock; + } + } cifs_dbg(FYI, "clone range\n"); -- 2.34.1

2 1

[PATCH OLK-6.6] ima: Check for ERR_PTR from dentry_path() in validate_hash_algo()
by Lu Jialin 29 Sep '26

29 Sep '26

From: Bradley Morgan <brads(a)mainlining.org> stable inclusion from stable-6.6.157 commit 30b5c0e17dcad72b6b2f987319aa645570e6376d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19109 CVE: CVE-2026-89989 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------ commit 8861f6d5c0678a7c5089c7b272509fc5931b8437 upstream. dentry_path() returns ERR_PTR(-ENAMETOOLONG) when the path exceeds the buffer. validate_hash_algo() passes the result straight to integrity_audit_msg() without checking. ERR_PTR is not NULL, so integrity_audit_message() sees a valid pointer and calls strlen() on it, which faults: BUG: unable to handle page fault for address: ffffffffffffffdc RIP: 0010:strlen+0x30/0xa0 Call Trace: audit_log_untrustedstring+0x19/0x30 integrity_audit_message+0x366/0x4f0 ima_inode_setxattr+0x512/0x5f0 Check for IS_ERR() and use NULL instead, which makes the audit message skip the name= field instead of crashing. Fixes: 4f2946aa0c45 ("IMA: introduce a new policy option func=SETXATTR_CHECK") Cc: stable(a)vger.kernel.org Reported-by: syzbot+5ebeb3089ea6439c37be(a)syzkaller.appspotmail.com Link: https://lore.kernel.org/all/6a8f89e5.1d9ded08.62e62.00bf.GAE@google.com/ Signed-off-by: Bradley Morgan <brads(a)mainlining.org> Signed-off-by: Mimi Zohar <zohar(a)linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- security/integrity/ima/ima_appraise.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c index 188f457f0e11..16437829a374 100644 --- a/security/integrity/ima/ima_appraise.c +++ b/security/integrity/ima/ima_appraise.c @@ -892,6 +892,8 @@ static int validate_hash_algo(struct dentry *dentry, return -EACCES; path = dentry_path(dentry, pathbuf, PATH_MAX); + if (IS_ERR(path)) + path = NULL; integrity_audit_msg(AUDIT_INTEGRITY_DATA, d_inode(dentry), path, "set_data", errmsg, -EACCES, 0); -- 2.34.1

2 1

[PATCH OLK-5.10] cifs: fix loff_t underflow in cifs_remap_file_range() when len == 0
by Lu Jialin 29 Sep '26

29 Sep '26

From: Frank Sorenson <sorenson(a)redhat.com> stable inclusion from stable-6.6.157 commit 7f62817fe049b0f3652518c1ba72631ec1e0a322 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18924 CVE: CVE-2026-89640 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------ commit 6c322f5cf7476ded7a9a20f7be72462065a03c68 upstream. With len == 0 (clone to EOF), the effective length is computed as: len = src_inode->i_size - off; If off > i_size, this is a negative loff_t, corrupting the ByteCount in the FSCTL_DUPLICATE_EXTENTS_TO_FILE request and inverting the range in filemap_write_and_wait_range(). The existing off >= i_size check fires only after the ioctl has already been sent. Snapshot i_size_read() once for both the bounds check and the length calculation, eliminating the TOCTOU and 32-bit torn-read risk. Reject off > src_size with -EINVAL. Treat off == src_size as a no-op, consistent with __generic_remap_file_range_prep(). Fixes: 04b38d601239 ("vfs: pull btrfs clone API to vfs layer") Cc: stable(a)vger.kernel.org Signed-off-by: Frank Sorenson <sorenson(a)redhat.com> Reviewed-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Paulo Alcantara <pc(a)manguebit.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/cifs/cifsfs.c fs/smb/client/cifsfs.c [5.10 keeps this file at fs/cifs/cifsfs.c and its cifs_remap_file_range() has no unlock label, which this fix references; add unlock: right before unlock_two_nondirectories() so the new error and zero-length exits release the locks and still free the xid via the existing out: path] Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- fs/cifs/cifsfs.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c index a86a1fb34e59..1d102d8c3ba6 100644 --- a/fs/cifs/cifsfs.c +++ b/fs/cifs/cifsfs.c @@ -1118,8 +1118,19 @@ static loff_t cifs_remap_file_range(struct file *src_file, loff_t off, */ lock_two_nondirectories(target_inode, src_inode); - if (len == 0) - len = src_inode->i_size - off; + if (len == 0) { + loff_t src_size = i_size_read(src_inode); + + if (off > src_size) { + rc = -EINVAL; + goto unlock; + } + len = src_size - off; + if (!len) { + rc = 0; + goto unlock; + } + } cifs_dbg(FYI, "about to flush pages\n"); /* should we flush first and last page first */ @@ -1135,6 +1146,7 @@ static loff_t cifs_remap_file_range(struct file *src_file, loff_t off, /* force revalidate of size and timestamps of target file now that target is updated on the server */ CIFS_I(target_inode)->time = 0; +unlock: /* although unlocking in the reverse order from locking is not strictly necessary here it is a little cleaner to be consistent */ unlock_two_nondirectories(src_inode, target_inode); -- 2.34.1

1 0

[PATCH openEuler-1.0-LTS] nfsd: gate nfs2 setacl by argp->mask
by Cai Xinchen 29 Sep '26

29 Sep '26

From: Chuck Lever <chuck.lever(a)oracle.com> mainline inclusion from mainline-v7.3-rc1 commit a3a7e20ed66d3f04d37883c398da8a113b430769 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18935 CVE: CVE-2026-89672 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The NFSACL v2 SETACL path shares the decoder convention used by its v3 sibling: nfsaclsvc_decode_setaclargs() fills in argp->acl_access only when NFS_ACL is set in the request mask and argp->acl_default only when NFS_DFACL is set, leaving the other pointer NULL because the argument buffer is zeroed up to pc_argzero before decode. nfsacld_proc_setacl() then hands both pointers to set_posix_acl() unconditionally. set_posix_acl(idmap, dentry, type, NULL) is the VFS "remove this ACL type" operation, so an omitted arm is indistinguishable from an explicit request to delete that ACL. A SETACL carrying only NFS_ACL silently strips the directory's default ACL; mask=0 strips both. This is the same defect just fixed in nfsd3_proc_setacl(); apply the same remedy. Gate each set_posix_acl() call on its mask bit and initialize error to 0 so that a request with neither bit set leaves the on-disk ACLs untouched and returns success. The out_drop_lock path and the unconditional posix_acl_release() in nfsaclsvc_release_setacl() already tolerate the skipped arms. Fixes: a257cdd0e217 ("[PATCH] NFSD: Add server support for NFSv3 ACLs.") Cc: stable(a)vger.kernel.org Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> conflicts: fs/nfsd/nfs2acl.c [This tree's set_posix_acl() takes (inode, type, acl) instead of the upstream (&nop_mnt_idmap, dentry, type, acl) form, so call it with the inode argument here.] Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- fs/nfsd/nfs2acl.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/fs/nfsd/nfs2acl.c b/fs/nfsd/nfs2acl.c index 7637646c9d8e..236b5b9d01ea 100644 --- a/fs/nfsd/nfs2acl.c +++ b/fs/nfsd/nfs2acl.c @@ -115,12 +115,17 @@ static __be32 nfsacld_proc_setacl(struct svc_rqst *rqstp) fh_lock(fh); - error = set_posix_acl(inode, ACL_TYPE_ACCESS, argp->acl_access); - if (error) - goto out_drop_lock; - error = set_posix_acl(inode, ACL_TYPE_DEFAULT, argp->acl_default); - if (error) - goto out_drop_lock; + error = 0; + if (argp->mask & NFS_ACL) { + error = set_posix_acl(inode, ACL_TYPE_ACCESS, argp->acl_access); + if (error) + goto out_drop_lock; + } + if (argp->mask & NFS_DFACL) { + error = set_posix_acl(inode, ACL_TYPE_DEFAULT, argp->acl_default); + if (error) + goto out_drop_lock; + } fh_unlock(fh); -- 2.34.1

2 1

[PATCH OLK-6.6] udf: reject VAT indexes equal to the entry count
by Lu Jialin 29 Sep '26

29 Sep '26

From: David Lee <david.lee(a)trailofbits.com> stable inclusion from stable-6.6.157 commit b77b83f5529a26d084d64ece98abd6f0cc86e053 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18864 CVE: CVE-2026-89525 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------ commit cac0cb07f29ccfb373fd4a36c81e908ef3ce608c upstream. UDF 1.50 virtual partition mapping uses the VAT as an array of physical block mappings. s_num_entries stores the number of entries in that array, not the highest valid index. The valid VAT indexes are therefore below s_num_entries. udf_get_pblock_virt15() currently rejects only indexes greater than s_num_entries. A crafted image can request index s_num_entries, pass the bounds check, and make the kernel read one entry past the allocated VAT table. Change the check to reject block >= s_num_entries, so the count is handled as an exclusive upper bound. A crafted UDF image reproduced this on origin/master commit 0e35b9b6ec0ffcc5e23cbdec09f5c622ad532b53 with a KASAN slab-out-of-bounds report in udf_get_pblock_virt15(). Trail of Bits has a reproducer that triggers kernel panic demonstrating the bug, and can share it if needed. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable(a)vger.kernel.org Signed-off-by: David Lee <david.lee(a)trailofbits.com> Assisted-by: Codex:gpt-5.5 Link: https://patch.msgid.link/20260708101712.1706564-1-david.lee@trailofbits.com Signed-off-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- fs/udf/partition.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/udf/partition.c b/fs/udf/partition.c index 2b85c9501bed..ad8dcedca263 100644 --- a/fs/udf/partition.c +++ b/fs/udf/partition.c @@ -55,7 +55,7 @@ uint32_t udf_get_pblock_virt15(struct super_block *sb, uint32_t block, map = &sbi->s_partmaps[partition]; vdata = &map->s_type_specific.s_virtual; - if (block > vdata->s_num_entries) { + if (block >= vdata->s_num_entries) { udf_debug("Trying to access block beyond end of VAT (%u max %u)\n", block, vdata->s_num_entries); return 0xFFFFFFFF; -- 2.34.1

2 1

[PATCH OLK-6.6] rtc: pcf8563: fix clock provider leak on unbind
by Jinjie Ruan 29 Sep '26

29 Sep '26

From: Yi Ding <yi.s.ding(a)gmail.com> stable inclusion from stable-6.6.157 commit 7afb8db47c4f107bce89cfe5115fb31ba7c94665 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19409 CVE: CVE-2026-90126 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------ [ Upstream commit 9c48a53685040bb0de45a640b34055cbbfc69d4f ] pcf8563_clkout_register_clk() registers the CLKOUT clock provider with of_clk_add_provider(), but nothing ever unwinds it: there is no of_clk_del_provider() call and the driver has no remove callback. Each of_clk_add_provider() allocates a struct of_clk_provider, takes a reference on the OF node and adds an entry to the global of_clk_providers list, none of which is released when the device is unbound. Every bind/unbind (or module reload) therefore leaks a provider structure and an of_node reference. The clock itself is already device-managed (devm_clk_register()); only the provider registration was not. Use devm_of_clk_add_hw_provider() so the provider is removed automatically on unbind. Tie it to the parent i2c device, whose OF node carries the #clock-cells and clock-output-names properties (the RTC class device has no OF node of its own). Fixes: a39a6405d5f9 ("rtc: pcf8563: add CLKOUT to common clock framework") Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Yi Ding <yi.s.ding(a)gmail.com> Link: https://patch.msgid.link/20260602035135.62264-1-yi.s.ding@gmail.com Signed-off-by: Alexandre Belloni <alexandre.belloni(a)bootlin.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- drivers/rtc/rtc-pcf8563.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/rtc/rtc-pcf8563.c b/drivers/rtc/rtc-pcf8563.c index 61be91c25cf1..f524e8c1df18 100644 --- a/drivers/rtc/rtc-pcf8563.c +++ b/drivers/rtc/rtc-pcf8563.c @@ -494,7 +494,9 @@ static struct clk *pcf8563_clkout_register_clk(struct pcf8563 *pcf8563) clk = devm_clk_register(&client->dev, &pcf8563->clkout_hw); if (!IS_ERR(clk)) - of_clk_add_provider(node, of_clk_src_simple_get, clk); + devm_of_clk_add_hw_provider(pcf8563->rtc->dev.parent, + of_clk_hw_simple_get, + &pcf8563->clkout_hw); return clk; } -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] *** CVE-2026-68081 ***
by Zhang Kunbo 29 Sep '26

29 Sep '26

*** BLURB HERE *** Sean Christopherson (2): KVM: nVMX: Add helper to put (unmap) vmcs12 pages KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state arch/x86/kvm/vmx/nested.c | 34 ++++++++++++++++++++-------------- 1 file changed, 20 insertions(+), 14 deletions(-) -- 2.34.1

1 2

[PATCH openEuler-1.0-LTS] nfsd: gate nfs2 setacl by argp->mask
by Cai Xinchen 29 Sep '26

29 Sep '26

From: Chuck Lever <chuck.lever(a)oracle.com> The NFSACL v2 SETACL path shares the decoder convention used by its v3 sibling: nfsaclsvc_decode_setaclargs() fills in argp->acl_access only when NFS_ACL is set in the request mask and argp->acl_default only when NFS_DFACL is set, leaving the other pointer NULL because the argument buffer is zeroed up to pc_argzero before decode. nfsacld_proc_setacl() then hands both pointers to set_posix_acl() unconditionally. set_posix_acl(idmap, dentry, type, NULL) is the VFS "remove this ACL type" operation, so an omitted arm is indistinguishable from an explicit request to delete that ACL. A SETACL carrying only NFS_ACL silently strips the directory's default ACL; mask=0 strips both. This is the same defect just fixed in nfsd3_proc_setacl(); apply the same remedy. Gate each set_posix_acl() call on its mask bit and initialize error to 0 so that a request with neither bit set leaves the on-disk ACLs untouched and returns success. The out_drop_lock path and the unconditional posix_acl_release() in nfsaclsvc_release_setacl() already tolerate the skipped arms. Fixes: a257cdd0e217 ("[PATCH] NFSD: Add server support for NFSv3 ACLs.") Cc: stable(a)vger.kernel.org Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- fs/nfsd/nfs2acl.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/fs/nfsd/nfs2acl.c b/fs/nfsd/nfs2acl.c index 7637646c9d8e..236b5b9d01ea 100644 --- a/fs/nfsd/nfs2acl.c +++ b/fs/nfsd/nfs2acl.c @@ -115,12 +115,17 @@ static __be32 nfsacld_proc_setacl(struct svc_rqst *rqstp) fh_lock(fh); - error = set_posix_acl(inode, ACL_TYPE_ACCESS, argp->acl_access); - if (error) - goto out_drop_lock; - error = set_posix_acl(inode, ACL_TYPE_DEFAULT, argp->acl_default); - if (error) - goto out_drop_lock; + error = 0; + if (argp->mask & NFS_ACL) { + error = set_posix_acl(inode, ACL_TYPE_ACCESS, argp->acl_access); + if (error) + goto out_drop_lock; + } + if (argp->mask & NFS_DFACL) { + error = set_posix_acl(inode, ACL_TYPE_DEFAULT, argp->acl_default); + if (error) + goto out_drop_lock; + } fh_unlock(fh); -- 2.34.1

2 1