- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] drm/dp/mst: fix buffer overflows in sideband chunk accumulation
by Hongtao Zhang 07 Sep '26

07 Sep '26

From: Ashutosh Desai <ashutoshdesai993(a)gmail.com> stable inclusion from stable-v5.10.266 commit ef2ecb6cf268debf3890df99fea01b6452dcf78e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17183 CVE: CVE-2026-68278 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 55bd5e685bda455b9b50c835f8c8442d52a344a3 ] drm_dp_sideband_append_payload() has three related bugs when processing device-provided sideband reply data: 1. Zero-length curchunk_len underflow: msg_len is a 6-bit field taken directly from the DP sideband header. If a device sends msg_len=0, curchunk_len is set to zero. The condition (curchunk_idx >= curchunk_len) is immediately true, and curchunk_len-1 wraps to 255 (u8 underflow). drm_dp_msg_data_crc4() reads 255 bytes from chunk[48], then memcpy() writes 255 bytes into msg[], both far out of bounds. 2. chunk[48] overflow: curchunk_len can reach 63 (6-bit field). chunk[] is only 48 bytes. Multi-iteration payload assembly appends 16-byte blocks until curchunk_idx reaches curchunk_len, writing up to 15 bytes past the end of chunk[] into msg[]. 3. msg[256] overflow: each chunk contributes (curchunk_len-1) bytes to msg[]. No check ensures curlen + (curchunk_len-1) stays within msg[256], so the memcpy can spill into adjacent struct fields. All three are reachable from any DP MST device that can forge sideband reply messages on a physical connection. Fixes: ad7f8a1f9ced ("drm/helper: add Displayport multi-stream helper (v0.6)") Cc: <stable(a)vger.kernel.org> # v3.17+ Signed-off-by: Ashutosh Desai <ashutoshdesai993(a)gmail.com> Reviewed-by: Lyude Paul <lyude(a)redhat.com> Signed-off-by: Lyude Paul <lyude(a)redhat.com> Link: https://patch.msgid.link/20260410041901.2438960-1-ashutoshdesai993@gmail.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Hulk Robot <hulkrobot(a)huawei.com> Signed-off-by: Zhang Hongtao <zhanghongtao35(a)huawei.com> --- drivers/gpu/drm/drm_dp_mst_topology.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c index e71d76daee748..0802ae9a43d0a 100644 --- a/drivers/gpu/drm/drm_dp_mst_topology.c +++ b/drivers/gpu/drm/drm_dp_mst_topology.c @@ -778,6 +778,12 @@ static bool drm_dp_sideband_append_payload(struct drm_dp_sideband_msg_rx *msg, { u8 crc4; + /* curchunk_len must be >= 1 (min 1 CRC byte) and fit in chunk[] */ + if (!msg->curchunk_len || + msg->curchunk_len > ARRAY_SIZE(msg->chunk) || + msg->curchunk_idx + replybuflen > ARRAY_SIZE(msg->chunk)) + return false; + memcpy(&msg->chunk[msg->curchunk_idx], replybuf, replybuflen); msg->curchunk_idx += replybuflen; @@ -788,6 +794,9 @@ static bool drm_dp_sideband_append_payload(struct drm_dp_sideband_msg_rx *msg, print_hex_dump(KERN_DEBUG, "wrong crc", DUMP_PREFIX_NONE, 16, 1, msg->chunk, msg->curchunk_len, false); + /* Guard against accumulated msg[] overflow */ + if (msg->curlen + msg->curchunk_len - 1 > ARRAY_SIZE(msg->msg)) + return false; /* copy chunk into bigger msg */ memcpy(&msg->msg[msg->curlen], msg->chunk, msg->curchunk_len - 1); msg->curlen += msg->curchunk_len - 1; -- 2.43.0

2 1

[PATCH OLK-5.10 0/1] CVE-2026-74549
by Yongqiang Liu 07 Sep '26

07 Sep '26

Guenter Roeck (1): hwmon: (nct6775-core) Prevent access to unsupported weight registers drivers/hwmon/nct6775.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) -- 2.43.0

2 2

[PATCH OLK-6.6 0/1] CVE-2026-72397
by Yongqiang Liu 07 Sep '26

07 Sep '26

Abdurrahman Hussain (1): hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid() drivers/hwmon/pmbus/pmbus_core.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) -- 2.43.0

2 2

[PATCH OLK-6.6 0/1] CVE-2026-72397
by Yongqiang Liu 07 Sep '26

07 Sep '26

Abdurrahman Hussain (1): hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid() drivers/hwmon/pmbus/pmbus_core.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) -- 2.43.0

2 2

[PATCH OLK-5.10 0/1] CVE-2026-72397
by Yongqiang Liu 07 Sep '26

07 Sep '26

Abdurrahman Hussain (1): hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid() drivers/hwmon/pmbus/pmbus_core.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) -- 2.43.0

2 2

[PATCH OLK-6.6 0/9] nbd: boost nbd setup
by Yang Erkun 07 Sep '26

07 Sep '26

Drop local patchset, using mainline pathset to do the same thing. Yang Erkun (9): Revert "nbd: remove queue freeze in nbd_add_socket" Revert "nbd: remove redundant num_connections boundary checks" Revert "nbd: replace socks pointer array with xarray" Revert "nbd: simplify find_fallback() by removing redundant logic" nbd: disallow NBD_SET_SOCK on an active device nbd: remove queue freeze in nbd_add_socket nbd: factor out a nbd_genl_foreach_sock nbd: remove queue freeze for newly created nbd from netlink path nbd: add pre_defined_connections module parameter for pre-created devices drivers/block/nbd.c | 350 ++++++++++++++++++++++---------------------- 1 file changed, 176 insertions(+), 174 deletions(-) -- 2.52.0

2 10

[PATCH OLK-6.6 00/16] backport minios part4 patches from linux mainline
by Qinxin Xia 07 Sep '26

07 Sep '26

From: Hongye Lin <linhongye(a)h-partners.com> mainline inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/8904 ---------------------------------------------------------------------- backport minios part4 patches from linux mainline Mark Brown (6): arm64/sysreg: Update HCRX_EL2 definition for DDI0601 2023-09 arm64/fpsimd: Enable host kernel access to FPMR arm64/fpsimd: Support FEAT_FPMR arm64/signal: Add FPMR signal handling arm64/ptrace: Expose FPMR via ptrace arm64/fpsimd: Don't corrupt FPMR when streaming mode changes Mark Rutland (7): arm64: ptrace: fix partial SETREGSET for NT_ARM_FPMR arm64/fpsimd: Add fpsimd_save_and_flush_current_state() arm64/fpsimd: Reset FPMR upon exec() arm64/fpsimd: signal32: Always save+flush state early arm64/fpsimd: signal: Always save+flush state early arm64/fpsimd: Avoid warning when sve_to_fpsimd() is unused arm64/fpsimd: Do not discard modified SVE state Qinxin Xia (1): Add support "arm64.nocnp" for start option arch/arm64/include/asm/cpufeature.h | 6 ++ arch/arm64/include/asm/el2_setup.h | 2 +- arch/arm64/include/asm/fpsimd.h | 7 +- arch/arm64/include/asm/kvm_arm.h | 1 - arch/arm64/include/asm/kvm_host.h | 1 + arch/arm64/include/asm/processor.h | 4 + arch/arm64/include/asm/signal_common.h | 20 ++++- arch/arm64/include/uapi/asm/sigcontext.h | 8 ++ arch/arm64/kernel/cpufeature.c | 13 ++- arch/arm64/kernel/entry-common.c | 50 ++++++++--- arch/arm64/kernel/fpsimd.c | 74 ++++++++-------- arch/arm64/kernel/idreg-override.c | 11 +++ arch/arm64/kernel/ptrace.c | 44 ++++++++++ arch/arm64/kernel/signal.c | 103 ++++++++++++----------- arch/arm64/kernel/signal32.c | 11 ++- arch/arm64/kvm/fpsimd.c | 1 + arch/arm64/kvm/hyp/include/hyp/switch.h | 13 ++- arch/arm64/tools/cpucaps | 2 +- arch/arm64/tools/sysreg | 4 +- include/uapi/linux/elf.h | 1 + 20 files changed, 259 insertions(+), 117 deletions(-) -- 2.33.0

2 17

[PATCH OLK-6.6] net/mlx5: LAG, Fix off-by-one in single-FDB error rollback
by Yi Yang 07 Sep '26

07 Sep '26

From: Shay Drory <shayd(a)nvidia.com> mainline inclusion from mainline-v7.2-rc3 commit 0f0e4ae6975c773f7854fc48932a267f6c79088f category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17727 CVE: CVE-2026-72345 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- On failure at index i, the reverse cleanup loop in mlx5_lag_create_single_fdb() starts from i, so the failed index itself is rolled back. That can operate on uninitialized state or double-tear-down a rule the add_one path already self-rolled-back. Start the rollback from i - 1 so only successfully-installed entries are undone. Fixes: ddbb5ddc43ad ("net/mlx5: LAG, Refactor lag logic") Signed-off-by: Shay Drory <shayd(a)nvidia.com> Reviewed-by: Mark Bloch <mbloch(a)nvidia.com> Signed-off-by: Tariq Toukan <tariqt(a)nvidia.com> Link: https://patch.msgid.link/20260630112917.698313-2-tariqt@nvidia.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Conflicts: drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c [Commit 3b8b364f97f40 which factored shared FDB code into shared_fdb.c is not present in this tree; mlx5_lag_create_single_fdb() still lives in lag.c. Apply the same off-by-one rollback fix there by starting the reverse cleanup at i-1 instead of i.] Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c b/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c index f6b1ac80c0af..96b1eb0ec72d 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c @@ -570,7 +570,7 @@ static int mlx5_lag_create_single_fdb(struct mlx5_lag *ldev) } return 0; err: - for (; i > MLX5_LAG_P1; i--) + for (i--; i > MLX5_LAG_P1; i--) mlx5_eswitch_offloads_single_fdb_del_one(master_esw, ldev->pf[i].dev->priv.eswitch); return err; -- 2.25.1

2 1

[PATCH OLK-6.6] ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD
by Lu Chentao 07 Sep '26

07 Sep '26

mainline inclusion from mainline-v7.2-rc2 commit 462775c620197adaabc983ce847e5b9878ff4cb0 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17314 CVE: CVE-2026-72031 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The PNY CS900 1TB SSD (Phison PS3111-S11, DRAM-less) drops off the bus after entering Device-Initiated Slumber during idle. With the default med_power_with_dipm policy the link goes down (SStatus 1 SControl 300) and does not recover, forcing the filesystem read-only. Forcing max_performance keeps the link stable across prolonged idle. Add a NOLPM quirk so link power management is disabled for this drive specifically, leaving it intact for other devices on the host. Cc: stable(a)vger.kernel.org Signed-off-by: Bryam Vargas <hexlabsecurity(a)proton.me> Reviewed-by: Niklas Cassel <cassel(a)kernel.org> Signed-off-by: Damien Le Moal <dlemoal(a)kernel.org> Conflicts: drivers/ata/libata-core.c [5.10 didn't introduce __ata_dev_quirks and ATA_QUIRK_NOLPM, adapted with ATA_HORKAGE_NOLPM] Signed-off-by: Lu Chentao <luchentao1(a)huawei.com> --- drivers/ata/libata-core.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c index 0aac030532c3..9110e9b50b80 100644 --- a/drivers/ata/libata-core.c +++ b/drivers/ata/libata-core.c @@ -4232,10 +4232,13 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { ATA_HORKAGE_NOLPM }, { "Crucial_CT960M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | ATA_HORKAGE_ZERO_AFTER_TRIM | ATA_HORKAGE_NOLPM }, + /* PNY CS900 (Phison PS3111-S11, DRAM-less) drops the link on DIPM */ + { "PNY CS900 1TB SSD", NULL, ATA_HORKAGE_NOLPM }, + /* These specific Samsung models/firmware-revs do not handle LPM well */ { "SAMSUNG MZMPC128HBFU-000MV", "CXM14M1Q", ATA_HORKAGE_NOLPM }, { "SAMSUNG SSD PM830 mSATA *", "CXM13D1Q", ATA_HORKAGE_NOLPM }, { "SAMSUNG MZ7TD256HAFV-000L9", NULL, ATA_HORKAGE_NOLPM }, { "SAMSUNG MZ7TE512HMHP-000L1", "EXT06L0Q", ATA_HORKAGE_NOLPM }, -- 2.52.0

2 1

[PATCH OLK-6.6] ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD
by Lu Chentao 07 Sep '26

07 Sep '26

mainline inclusion from mainline-v7.2-rc2 commit 462775c620197adaabc983ce847e5b9878ff4cb0 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17314 CVE: CVE-2026-72031 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The PNY CS900 1TB SSD (Phison PS3111-S11, DRAM-less) drops off the bus after entering Device-Initiated Slumber during idle. With the default med_power_with_dipm policy the link goes down (SStatus 1 SControl 300) and does not recover, forcing the filesystem read-only. Forcing max_performance keeps the link stable across prolonged idle. Add a NOLPM quirk so link power management is disabled for this drive specifically, leaving it intact for other devices on the host. Cc: stable(a)vger.kernel.org Signed-off-by: Bryam Vargas <hexlabsecurity(a)proton.me> Reviewed-by: Niklas Cassel <cassel(a)kernel.org> Signed-off-by: Damien Le Moal <dlemoal(a)kernel.org> Conflicts: drivers/ata/libata-core.c [5.10 didn't introduce __ata_dev_quirks and ATA_QUIRK_NOLPM, adapted with ATA_HORKAGE_NOLPM] Signed-off-by: Lu Chentao <luchentao1(a)huawei.com> --- drivers/ata/libata-core.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c index 0aac030532c3..9110e9b50b80 100644 --- a/drivers/ata/libata-core.c +++ b/drivers/ata/libata-core.c @@ -4232,10 +4232,13 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { ATA_HORKAGE_NOLPM }, { "Crucial_CT960M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | ATA_HORKAGE_ZERO_AFTER_TRIM | ATA_HORKAGE_NOLPM }, + /* PNY CS900 (Phison PS3111-S11, DRAM-less) drops the link on DIPM */ + { "PNY CS900 1TB SSD", NULL, ATA_HORKAGE_NOLPM }, + /* These specific Samsung models/firmware-revs do not handle LPM well */ { "SAMSUNG MZMPC128HBFU-000MV", "CXM14M1Q", ATA_HORKAGE_NOLPM }, { "SAMSUNG SSD PM830 mSATA *", "CXM13D1Q", ATA_HORKAGE_NOLPM }, { "SAMSUNG MZ7TD256HAFV-000L9", NULL, ATA_HORKAGE_NOLPM }, { "SAMSUNG MZ7TE512HMHP-000L1", "EXT06L0Q", ATA_HORKAGE_NOLPM }, -- 2.52.0

2 1