- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] drm/radeon: free iio for atombios when driver shutdown
by Cai Xinchen 23 Oct '25

23 Oct '25

From: Liwei Song <liwei.song(a)windriver.com> stable inclusion from stable-v4.19.276 commit 9cdb96b55651c92fc949cfd54124406c3c912b6b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID0RF4 CVE: CVE-2023-53453 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 4773fadedca918faec443daaca5e4ea1c0ced144 ] Fix below kmemleak when unload radeon driver: unreferenced object 0xffff9f8608ede200 (size 512): comm "systemd-udevd", pid 326, jiffies 4294682822 (age 716.338s) hex dump (first 32 bytes): 00 00 00 00 c4 aa ec aa 14 ab 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<0000000062fadebe>] kmem_cache_alloc_trace+0x2f1/0x500 [<00000000b6883cea>] atom_parse+0x117/0x230 [radeon] [<00000000158c23fd>] radeon_atombios_init+0xab/0x170 [radeon] [<00000000683f672e>] si_init+0x57/0x750 [radeon] [<00000000566cc31f>] radeon_device_init+0x559/0x9c0 [radeon] [<0000000046efabb3>] radeon_driver_load_kms+0xc1/0x1a0 [radeon] [<00000000b5155064>] drm_dev_register+0xdd/0x1d0 [<0000000045fec835>] radeon_pci_probe+0xbd/0x100 [radeon] [<00000000e69ecca3>] pci_device_probe+0xe1/0x160 [<0000000019484b76>] really_probe.part.0+0xc1/0x2c0 [<000000003f2649da>] __driver_probe_device+0x96/0x130 [<00000000231c5bb1>] driver_probe_device+0x24/0xf0 [<0000000000a42377>] __driver_attach+0x77/0x190 [<00000000d7574da6>] bus_for_each_dev+0x7f/0xd0 [<00000000633166d2>] driver_attach+0x1e/0x30 [<00000000313b05b8>] bus_add_driver+0x12c/0x1e0 iio was allocated in atom_index_iio() called by atom_parse(), but it doesn't got released when the dirver is shutdown. Fix this kmemleak by free it in radeon_atombios_fini(). Signed-off-by: Liwei Song <liwei.song(a)windriver.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- drivers/gpu/drm/radeon/radeon_device.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c index cc1c07963116..bcca0dd67fd1 100644 --- a/drivers/gpu/drm/radeon/radeon_device.c +++ b/drivers/gpu/drm/radeon/radeon_device.c @@ -1015,6 +1015,7 @@ void radeon_atombios_fini(struct radeon_device *rdev) { if (rdev->mode_info.atom_context) { kfree(rdev->mode_info.atom_context->scratch); + kfree(rdev->mode_info.atom_context->iio); } kfree(rdev->mode_info.atom_context); rdev->mode_info.atom_context = NULL; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/2] CVE-2023-53567
by Cai Xinchen 23 Oct '25

23 Oct '25

CVE-2023-53567 Uwe Kleine-König (1): spi: qup: Don't skip cleanup in remove's error path Wang Li (1): spi: qup: fix PM reference leak in spi_qup_remove() drivers/spi/spi-qup.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10] posix-timers: Ensure timer ID search-loop limit is valid
by Jinjie Ruan 23 Oct '25

23 Oct '25

From: Thomas Gleixner <tglx(a)linutronix.de> stable inclusion from stable-v5.10.188 commit 322377cc909defcca9451487484845e7e1d20d1b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID33F2 CVE: CVE-2023-53728 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 8ce8849dd1e78dadcee0ec9acbd259d239b7069f ] posix_timer_add() tries to allocate a posix timer ID by starting from the cached ID which was stored by the last successful allocation. This is done in a loop searching the ID space for a free slot one by one. The loop has to terminate when the search wrapped around to the starting point. But that's racy vs. establishing the starting point. That is read out lockless, which leads to the following problem: CPU0 CPU1 posix_timer_add() start = sig->posix_timer_id; lock(hash_lock); ... posix_timer_add() if (++sig->posix_timer_id < 0) start = sig->posix_timer_id; sig->posix_timer_id = 0; So CPU1 can observe a negative start value, i.e. -1, and the loop break never happens because the condition can never be true: if (sig->posix_timer_id == start) break; While this is unlikely to ever turn into an endless loop as the ID space is huge (INT_MAX), the racy read of the start value caught the attention of KCSAN and Dmitry unearthed that incorrectness. Rewrite it so that all id operations are under the hash lock. Reported-by: syzbot+5c54bd3eb218bb595aa9(a)syzkaller.appspotmail.com Reported-by: Dmitry Vyukov <dvyukov(a)google.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Reviewed-by: Frederic Weisbecker <frederic(a)kernel.org> Link: https://lore.kernel.org/r/87bkhzdn6g.ffs@tglx Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- include/linux/sched/signal.h | 2 +- kernel/time/posix-timers.c | 31 ++++++++++++++++++------------- 2 files changed, 19 insertions(+), 14 deletions(-) diff --git a/include/linux/sched/signal.h b/include/linux/sched/signal.h index 174735dbad31..42de31727538 100644 --- a/include/linux/sched/signal.h +++ b/include/linux/sched/signal.h @@ -126,7 +126,7 @@ struct signal_struct { #ifdef CONFIG_POSIX_TIMERS /* POSIX.1b Interval Timers */ - int posix_timer_id; + unsigned int next_posix_timer_id; struct list_head posix_timers; /* ITIMER_REAL timer for the process */ diff --git a/kernel/time/posix-timers.c b/kernel/time/posix-timers.c index 7f58959da1fb..159744905f03 100644 --- a/kernel/time/posix-timers.c +++ b/kernel/time/posix-timers.c @@ -140,25 +140,30 @@ static struct k_itimer *posix_timer_by_id(timer_t id) static int posix_timer_add(struct k_itimer *timer) { struct signal_struct *sig = current->signal; - int first_free_id = sig->posix_timer_id; struct hlist_head *head; - int ret = -ENOENT; + unsigned int cnt, id; - do { + /* + * FIXME: Replace this by a per signal struct xarray once there is + * a plan to handle the resulting CRIU regression gracefully. + */ + for (cnt = 0; cnt <= INT_MAX; cnt++) { spin_lock(&hash_lock); - head = &posix_timers_hashtable[hash(sig, sig->posix_timer_id)]; - if (!__posix_timers_find(head, sig, sig->posix_timer_id)) { + id = sig->next_posix_timer_id; + + /* Write the next ID back. Clamp it to the positive space */ + sig->next_posix_timer_id = (id + 1) & INT_MAX; + + head = &posix_timers_hashtable[hash(sig, id)]; + if (!__posix_timers_find(head, sig, id)) { hlist_add_head_rcu(&timer->t_hash, head); - ret = sig->posix_timer_id; + spin_unlock(&hash_lock); + return id; } - if (++sig->posix_timer_id < 0) - sig->posix_timer_id = 0; - if ((sig->posix_timer_id == first_free_id) && (ret == -ENOENT)) - /* Loop over all possible ids completed */ - ret = -EAGAIN; spin_unlock(&hash_lock); - } while (ret == -ENOENT); - return ret; + } + /* POSIX return code when no timer ID could be allocated */ + return -EAGAIN; } static inline void unlock_timer(struct k_itimer *timr, unsigned long flags) -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] posix-timers: Ensure timer ID search-loop limit is valid
by Jinjie Ruan 23 Oct '25

23 Oct '25

From: Thomas Gleixner <tglx(a)linutronix.de> stable inclusion from stable-v4.19.291 commit 9ea26a8494a0a9337e7415eafd6f3ed940327dc5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID33F2 CVE: CVE-2023-53728 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 8ce8849dd1e78dadcee0ec9acbd259d239b7069f ] posix_timer_add() tries to allocate a posix timer ID by starting from the cached ID which was stored by the last successful allocation. This is done in a loop searching the ID space for a free slot one by one. The loop has to terminate when the search wrapped around to the starting point. But that's racy vs. establishing the starting point. That is read out lockless, which leads to the following problem: CPU0 CPU1 posix_timer_add() start = sig->posix_timer_id; lock(hash_lock); ... posix_timer_add() if (++sig->posix_timer_id < 0) start = sig->posix_timer_id; sig->posix_timer_id = 0; So CPU1 can observe a negative start value, i.e. -1, and the loop break never happens because the condition can never be true: if (sig->posix_timer_id == start) break; While this is unlikely to ever turn into an endless loop as the ID space is huge (INT_MAX), the racy read of the start value caught the attention of KCSAN and Dmitry unearthed that incorrectness. Rewrite it so that all id operations are under the hash lock. Reported-by: syzbot+5c54bd3eb218bb595aa9(a)syzkaller.appspotmail.com Reported-by: Dmitry Vyukov <dvyukov(a)google.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Reviewed-by: Frederic Weisbecker <frederic(a)kernel.org> Link: https://lore.kernel.org/r/87bkhzdn6g.ffs@tglx Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- include/linux/sched/signal.h | 2 +- kernel/time/posix-timers.c | 31 ++++++++++++++++++------------- 2 files changed, 19 insertions(+), 14 deletions(-) diff --git a/include/linux/sched/signal.h b/include/linux/sched/signal.h index 8bde85ac0e77..85f03ad70e2c 100644 --- a/include/linux/sched/signal.h +++ b/include/linux/sched/signal.h @@ -128,7 +128,7 @@ struct signal_struct { #ifdef CONFIG_POSIX_TIMERS /* POSIX.1b Interval Timers */ - int posix_timer_id; + unsigned int next_posix_timer_id; struct list_head posix_timers; /* ITIMER_REAL timer for the process */ diff --git a/kernel/time/posix-timers.c b/kernel/time/posix-timers.c index d86fdabc5748..9b22171f7339 100644 --- a/kernel/time/posix-timers.c +++ b/kernel/time/posix-timers.c @@ -159,25 +159,30 @@ static struct k_itimer *posix_timer_by_id(timer_t id) static int posix_timer_add(struct k_itimer *timer) { struct signal_struct *sig = current->signal; - int first_free_id = sig->posix_timer_id; struct hlist_head *head; - int ret = -ENOENT; + unsigned int cnt, id; - do { + /* + * FIXME: Replace this by a per signal struct xarray once there is + * a plan to handle the resulting CRIU regression gracefully. + */ + for (cnt = 0; cnt <= INT_MAX; cnt++) { spin_lock(&hash_lock); - head = &posix_timers_hashtable[hash(sig, sig->posix_timer_id)]; - if (!__posix_timers_find(head, sig, sig->posix_timer_id)) { + id = sig->next_posix_timer_id; + + /* Write the next ID back. Clamp it to the positive space */ + sig->next_posix_timer_id = (id + 1) & INT_MAX; + + head = &posix_timers_hashtable[hash(sig, id)]; + if (!__posix_timers_find(head, sig, id)) { hlist_add_head_rcu(&timer->t_hash, head); - ret = sig->posix_timer_id; + spin_unlock(&hash_lock); + return id; } - if (++sig->posix_timer_id < 0) - sig->posix_timer_id = 0; - if ((sig->posix_timer_id == first_free_id) && (ret == -ENOENT)) - /* Loop over all possible ids completed */ - ret = -EAGAIN; spin_unlock(&hash_lock); - } while (ret == -ENOENT); - return ret; + } + /* POSIX return code when no timer ID could be allocated */ + return -EAGAIN; } static inline void unlock_timer(struct k_itimer *timr, unsigned long flags) -- 2.34.1

2 1

[PATCH OLK-6.6 00/40] Cross-Generation Live Migration
by Jinqian Yang 23 Oct '25

23 Oct '25

Part1: Make CPU ID registers writable by userspace ----------------------------------------------------------------- Patch#1 KVM: arm64: Allow userspace to get the writable masks for feature ID registers Patch#2 KVM: arm64: Document KVM_ARM_GET_REG_WRITABLE_MASKS Patch#3 KVM: arm64: Use guest ID register values for the sake of emulation Patch#4 KVM: arm64: Advertise selected DebugVer in DBGDIDR.Version Patch#5 KVM: arm64: Reject attempts to set invalid debug arch version Patch#6 KVM: arm64: Bump up the default KVM sanitised debug version to v8p8 Patch#7 KVM: arm64: Allow userspace to change ID_AA64ISAR{0-2}_EL1 Patch#8 KVM: arm64: Allow userspace to change ID_AA64MMFR{0-2}_EL1 Patch#9 KVM: arm64: Allow userspace to change ID_AA64PFR0_EL1 Patch#10 KVM: arm64: Allow userspace to change ID_AA64ZFR0_EL1 Patch#11 KVM: arm64: Document vCPU feature selection UAPIs Patch#12 KVM: arm64: Make the exposed feature bits in AA64DFR0_EL1 writable from userspace Patch#13 KVM: arm64: Disable MPAM visibility by default and ignore VMM writes Patch#14 KVM: arm64: Rename is_id_reg() to imply VM scope Patch#15 KVM: arm64: Reset VM feature ID regs from kvm_reset_sys_regs() Patch#16 KVM: arm64: Only reset vCPU-scoped feature ID regs once Patch#17 KVM: arm64: Use read-only helper for reading VM ID registers Patch#18 KVM: arm64: Add helper for writing ID regs Patch#19 KVM: arm64: Treat CTR_EL0 as a VM feature ID register Patch#20 KVM: arm64: rename functions for invariant sys regs Patch#21 KVM: arm64: Make the L1Ip feature bits in CTR_EL0 writable from userspace Patch#22 KVM: arm64: show writable masks for feature registers Patch#23 KVM: arm64: Make HCX writable from userspace Patch#24 KVM: arm64: Remove duplicated AA64MMFR1_EL1 XNX Patch#25 KVM: arm64: use KABI_EXTEND to revert struct kvm kabi change Patch#26 KVM: arm64: Do not allow ID_AA64MMFR0_EL1.ASIDbits to be overridden Patch#27 KVM: arm64: Sanitise ID_AA64MMFR3_EL1 Patch#28 KVM: arm64: Expose S1PIE to guests Patch#29 KVM: arm64: Make AA64PFR1_EL1.NMI writeable Part2: Writable MIDR/REVIDR (and associated baggage) ----------------------------------------------------------------- Patch#30 KVM: arm64: Set HCR_EL2.TID1 unconditionally Patch#31 KVM: arm64: Maintain per-VM copy of implementation ID regs Patch#32 KVM: arm64: Load VPIDR_EL2 with the VM's MIDR_EL1 value Patch#33 KVM: arm64: Allow userspace to change the implementation ID registers Part3: Errata management for VM Live migration ----------------------------------------------------------------- Patch#34 arm64: Modify _midr_range() functions to read MIDR/REVIDR internally Patch#35 KVM: arm64: Specify hypercall ABI for retrieving target implementations Patch#36 KVM: arm64: Introduce KVM_REG_ARM_VENDOR_HYP_BMAP_2 Patch#37 arm64: Make _midr_in_range_list() an exported function Patch#38 smccc/kvm_guest: Enable errata based on implementation CPUs Patch#39 smccc: kvm_guest: Align with DISCOVER_IMPL_CPUS ABI Patch#40 smccc: kvm_guest: Fix kernel builds for 32 bit arm James Morse (1): KVM: arm64: Disable MPAM visibility by default and ignore VMM writes Jing Zhang (5): KVM: arm64: Allow userspace to get the writable masks for feature ID registers KVM: arm64: Document KVM_ARM_GET_REG_WRITABLE_MASKS KVM: arm64: Use guest ID register values for the sake of emulation KVM: arm64: Allow userspace to change ID_AA64MMFR{0-2}_EL1 KVM: arm64: Allow userspace to change ID_AA64PFR0_EL1 Jinqian Yang (1): KVM: arm64: Make AA64PFR1_EL1.NMI writeable Joey Gouly (1): KVM: arm64: Sanitise ID_AA64MMFR3_EL1 Marc Zyngier (1): KVM: arm64: Do not allow ID_AA64MMFR0_EL1.ASIDbits to be overridden Mark Brown (1): KVM: arm64: Expose S1PIE to guests Oliver Upton (14): KVM: arm64: Advertise selected DebugVer in DBGDIDR.Version KVM: arm64: Reject attempts to set invalid debug arch version KVM: arm64: Bump up the default KVM sanitised debug version to v8p8 KVM: arm64: Allow userspace to change ID_AA64ISAR{0-2}_EL1 KVM: arm64: Allow userspace to change ID_AA64ZFR0_EL1 KVM: arm64: Document vCPU feature selection UAPIs KVM: arm64: Rename is_id_reg() to imply VM scope KVM: arm64: Reset VM feature ID regs from kvm_reset_sys_regs() KVM: arm64: Only reset vCPU-scoped feature ID regs once KVM: arm64: Use read-only helper for reading VM ID registers KVM: arm64: Add helper for writing ID regs KVM: arm64: Set HCR_EL2.TID1 unconditionally KVM: arm64: Load VPIDR_EL2 with the VM's MIDR_EL1 value smccc: kvm_guest: Align with DISCOVER_IMPL_CPUS ABI Russell King (1): KVM: arm64: Remove duplicated AA64MMFR1_EL1 XNX Sebastian Ott (5): KVM: arm64: Treat CTR_EL0 as a VM feature ID register KVM: arm64: rename functions for invariant sys regs KVM: arm64: show writable masks for feature registers KVM: arm64: Maintain per-VM copy of implementation ID regs KVM: arm64: Allow userspace to change the implementation ID registers Shameer Kolothum (8): KVM: arm64: Make the exposed feature bits in AA64DFR0_EL1 writable from userspace KVM: arm64: Make the L1Ip feature bits in CTR_EL0 writable from userspace arm64: Modify _midr_range() functions to read MIDR/REVIDR internally KVM: arm64: Specify hypercall ABI for retrieving target implementations KVM: arm64: Introduce KVM_REG_ARM_VENDOR_HYP_BMAP_2 arm64: Make _midr_in_range_list() an exported function smccc/kvm_guest: Enable errata based on implementation CPUs smccc: kvm_guest: Fix kernel builds for 32 bit arm yangjinqian (2): KVM: arm64: Make HCX writable from userspace KVM: arm64: use KABI_EXTEND to revert struct kvm kabi change Documentation/virt/kvm/api.rst | 70 +++ Documentation/virt/kvm/arm/index.rst | 1 + Documentation/virt/kvm/arm/vcpu-features.rst | 48 ++ arch/arm64/include/asm/cache.h | 2 +- arch/arm64/include/asm/cputype.h | 40 +- arch/arm64/include/asm/hypervisor.h | 1 + arch/arm64/include/asm/kvm_arm.h | 4 +- arch/arm64/include/asm/kvm_emulate.h | 3 +- arch/arm64/include/asm/kvm_host.h | 36 ++ arch/arm64/include/uapi/asm/kvm.h | 44 ++ arch/arm64/kernel/cpu_errata.c | 75 ++- arch/arm64/kernel/cpufeature.c | 12 +- arch/arm64/kernel/proton-pack.c | 20 +- arch/arm64/kvm/arm.c | 24 +- arch/arm64/kvm/hyp/include/hyp/sysreg-sr.h | 30 +- arch/arm64/kvm/hyp/nvhe/sysreg-sr.c | 4 +- arch/arm64/kvm/hyp/vhe/sysreg-sr.c | 2 +- arch/arm64/kvm/hypercalls.c | 13 + arch/arm64/kvm/pmu-emul.c | 2 +- arch/arm64/kvm/sys_regs.c | 589 +++++++++++++------ arch/arm64/kvm/vgic/vgic-v3.c | 2 +- drivers/clocksource/arm_arch_timer.c | 2 +- drivers/firmware/efi/libstub/arm64.c | 17 + drivers/firmware/smccc/kvm_guest.c | 66 +++ drivers/perf/arm_pmuv3.c | 2 +- drivers/platform/mpam/mpam_devices.c | 6 +- include/linux/arm-smccc.h | 16 + include/uapi/linux/kvm.h | 5 + 28 files changed, 891 insertions(+), 245 deletions(-) create mode 100644 Documentation/virt/kvm/arm/vcpu-features.rst -- 2.33.0

2 41

[PATCH OLK-6.6] media: rc: fix races with imon_disconnect()
by Yi Yang 23 Oct '25

23 Oct '25

From: Larshin Sergey <Sergey.Larshin(a)kaspersky.com> stable inclusion from stable-v6.6.110 commit 71da40648741d15b302700b68973fe8b382aef3c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID22QN CVE: CVE-2025-39993 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit fa0f61cc1d828178aa921475a9b786e7fbb65ccb upstream. Syzbot reports a KASAN issue as below: BUG: KASAN: use-after-free in __create_pipe include/linux/usb.h:1945 [inline] BUG: KASAN: use-after-free in send_packet+0xa2d/0xbc0 drivers/media/rc/imon.c:627 Read of size 4 at addr ffff8880256fb000 by task syz-executor314/4465 CPU: 2 PID: 4465 Comm: syz-executor314 Not tainted 6.0.0-rc1-syzkaller #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:317 [inline] print_report.cold+0x2ba/0x6e9 mm/kasan/report.c:433 kasan_report+0xb1/0x1e0 mm/kasan/report.c:495 __create_pipe include/linux/usb.h:1945 [inline] send_packet+0xa2d/0xbc0 drivers/media/rc/imon.c:627 vfd_write+0x2d9/0x550 drivers/media/rc/imon.c:991 vfs_write+0x2d7/0xdd0 fs/read_write.c:576 ksys_write+0x127/0x250 fs/read_write.c:631 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd The iMON driver improperly releases the usb_device reference in imon_disconnect without coordinating with active users of the device. Specifically, the fields usbdev_intf0 and usbdev_intf1 are not protected by the users counter (ictx->users). During probe, imon_init_intf0 or imon_init_intf1 increments the usb_device reference count depending on the interface. However, during disconnect, usb_put_dev is called unconditionally, regardless of actual usage. As a result, if vfd_write or other operations are still in progress after disconnect, this can lead to a use-after-free of the usb_device pointer. Thread 1 vfd_write Thread 2 imon_disconnect ... if usb_put_dev(ictx->usbdev_intf0) else usb_put_dev(ictx->usbdev_intf1) ... while send_packet if pipe = usb_sndintpipe( ictx->usbdev_intf0) UAF else pipe = usb_sndctrlpipe( ictx->usbdev_intf0, 0) UAF Guard access to usbdev_intf0 and usbdev_intf1 after disconnect by checking ictx->disconnected in all writer paths. Add early return with -ENODEV in send_packet(), vfd_write(), lcd_write() and display_open() if the device is no longer present. Set and read ictx->disconnected under ictx->lock to ensure memory synchronization. Acquire the lock in imon_disconnect() before setting the flag to synchronize with any ongoing operations. Ensure writers exit early and safely after disconnect before the USB core proceeds with cleanup. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Reported-by: syzbot+f1a69784f6efe748c3bf(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=f1a69784f6efe748c3bf Fixes: 21677cfc562a ("V4L/DVB: ir-core: add imon driver") Cc: stable(a)vger.kernel.org Signed-off-by: Larshin Sergey <Sergey.Larshin(a)kaspersky.com> Signed-off-by: Sean Young <sean(a)mess.org> Signed-off-by: Hans Verkuil <hverkuil+cisco(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/media/rc/imon.c | 27 ++++++++++++++++++++------- 1 file changed, 20 insertions(+), 7 deletions(-) diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c index e5590a708f1c..f4deca8894e0 100644 --- a/drivers/media/rc/imon.c +++ b/drivers/media/rc/imon.c @@ -536,7 +536,9 @@ static int display_open(struct inode *inode, struct file *file) mutex_lock(&ictx->lock); - if (!ictx->display_supported) { + if (ictx->disconnected) { + retval = -ENODEV; + } else if (!ictx->display_supported) { pr_err("display not supported by device\n"); retval = -ENODEV; } else if (ictx->display_isopen) { @@ -598,6 +600,9 @@ static int send_packet(struct imon_context *ictx) int retval = 0; struct usb_ctrlrequest *control_req = NULL; + if (ictx->disconnected) + return -ENODEV; + /* Check if we need to use control or interrupt urb */ if (!ictx->tx_control) { pipe = usb_sndintpipe(ictx->usbdev_intf0, @@ -949,12 +954,14 @@ static ssize_t vfd_write(struct file *file, const char __user *buf, static const unsigned char vfd_packet6[] = { 0x01, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF }; - if (ictx->disconnected) - return -ENODEV; - if (mutex_lock_interruptible(&ictx->lock)) return -ERESTARTSYS; + if (ictx->disconnected) { + retval = -ENODEV; + goto exit; + } + if (!ictx->dev_present_intf0) { pr_err_ratelimited("no iMON device present\n"); retval = -ENODEV; @@ -1029,11 +1036,13 @@ static ssize_t lcd_write(struct file *file, const char __user *buf, int retval = 0; struct imon_context *ictx = file->private_data; - if (ictx->disconnected) - return -ENODEV; - mutex_lock(&ictx->lock); + if (ictx->disconnected) { + retval = -ENODEV; + goto exit; + } + if (!ictx->display_supported) { pr_err_ratelimited("no iMON display present\n"); retval = -ENODEV; @@ -2499,7 +2508,11 @@ static void imon_disconnect(struct usb_interface *interface) int ifnum; ictx = usb_get_intfdata(interface); + + mutex_lock(&ictx->lock); ictx->disconnected = true; + mutex_unlock(&ictx->lock); + dev = ictx->dev; ifnum = interface->cur_altsetting->desc.bInterfaceNumber; -- 2.25.1

2 1

[PATCH OLK-6.6] arm64: Add support for HIP09 Spectre-BHB mitigation
by Jinqian Yang 23 Oct '25

23 Oct '25

From: yangjinqian <yangjinqian1(a)huawei.com> virt inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/IBN3WI ------------------------------------------------------------------------ The HIP09 processor is vulnerable to the Spectre-BHB (Branch History Buffer) attack, which can be exploited to leak information through branch prediction side channels. This commit adds the MIDR of HIP09 to the list for software mitigation. Signed-off-by: Jinqian Yang <yangjinqian1(a)huawei.com> Signed-off-by: Zhou Wang <wangzhou1(a)hisilicon.com> --- arch/arm64/kernel/proton-pack.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/arm64/kernel/proton-pack.c b/arch/arm64/kernel/proton-pack.c index ff7ba4f013c5..fc014ccf9034 100644 --- a/arch/arm64/kernel/proton-pack.c +++ b/arch/arm64/kernel/proton-pack.c @@ -904,6 +904,7 @@ static u8 spectre_bhb_loop_affected(void) MIDR_ALL_VERSIONS(MIDR_CORTEX_A77), MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N1), MIDR_ALL_VERSIONS(MIDR_QCOM_KRYO_4XX_GOLD), + MIDR_ALL_VERSIONS(MIDR_HISI_LINXICORE9100), {}, }; static const struct midr_range spectre_bhb_k11_list[] = { -- 2.33.0

2 1

[PATCH OLK-5.10] tracing: probes: Fix a possible race in trace_probe_log APIs
by Tengda Wu 23 Oct '25

23 Oct '25

From: "Masami Hiramatsu (Google)" <mhiramat(a)kernel.org> mainline inclusion from mainline-v6.15-rc7 commit fd837de3c9cb1a162c69bc1fb1f438467fe7f2f5 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID30XE Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Since the shared trace_probe_log variable can be accessed and modified via probe event create operation of kprobe_events, uprobe_events, and dynamic_events, it should be protected. In the dynamic_events, all operations are serialized by `dyn_event_ops_mutex`. But kprobe_events and uprobe_events interfaces are not serialized. To solve this issue, introduces dyn_event_create(), which runs create() operation under the mutex, for kprobe_events and uprobe_events. This also uses lockdep to check the mutex is held when using trace_probe_log* APIs. Link: https://lore.kernel.org/all/174684868120.551552.3068655787654268804.stgit@d… Reported-by: Paul Cacheux <paulcacheux(a)gmail.com> Closes: https://lore.kernel.org/all/20250510074456.805a16872b591e2971a4d221@kernel.… Fixes: ab105a4fb894 ("tracing: Use tracing error_log with probe events") Signed-off-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org> Conflicts: kernel/trace/trace_dynevent.c kernel/trace/trace_dynevent.h kernel/trace/trace_kprobe.c kernel/trace/trace_uprobe.c kernel/trace/trace_probe.c [The pre-patch d262271d0483 ("tracing/dynevent: Delegate parsing to create function") modified a lot of code unrelated to this issue, and since the pre-patch is part of a patch set with interdependencies, applying it could introduce risks. Therefore, skip the pre-patch, and apply direct adaptation here.] Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/trace/trace_dynevent.c | 16 +++++++++++++++- kernel/trace/trace_dynevent.h | 1 + kernel/trace/trace_kprobe.c | 2 +- kernel/trace/trace_probe.c | 9 +++++++++ kernel/trace/trace_uprobe.c | 2 +- 5 files changed, 27 insertions(+), 3 deletions(-) diff --git a/kernel/trace/trace_dynevent.c b/kernel/trace/trace_dynevent.c index 36dff580c79a..33d7057d83b0 100644 --- a/kernel/trace/trace_dynevent.c +++ b/kernel/trace/trace_dynevent.c @@ -15,7 +15,7 @@ #include "trace.h" #include "trace_dynevent.h" -static DEFINE_MUTEX(dyn_event_ops_mutex); +DEFINE_MUTEX(dyn_event_ops_mutex); static LIST_HEAD(dyn_event_ops_list); int dyn_event_register(struct dyn_event_operations *ops) @@ -76,6 +76,20 @@ int dyn_event_release(int argc, char **argv, struct dyn_event_operations *type) return ret; } +/* + * Locked version of event creation. The event creation must be protected by + * dyn_event_ops_mutex because of protecting trace_probe_log. + */ +int dyn_event_create(int argc, char **argv, struct dyn_event_operations *type) +{ + int ret; + + mutex_lock(&dyn_event_ops_mutex); + ret = type->create(argc, (const char **)argv); + mutex_unlock(&dyn_event_ops_mutex); + return ret; +} + static int create_dyn_event(int argc, char **argv) { struct dyn_event_operations *ops; diff --git a/kernel/trace/trace_dynevent.h b/kernel/trace/trace_dynevent.h index d6857a254ede..890cc4418842 100644 --- a/kernel/trace/trace_dynevent.h +++ b/kernel/trace/trace_dynevent.h @@ -98,6 +98,7 @@ void *dyn_event_seq_next(struct seq_file *m, void *v, loff_t *pos); void dyn_event_seq_stop(struct seq_file *m, void *v); int dyn_events_release_all(struct dyn_event_operations *type); int dyn_event_release(int argc, char **argv, struct dyn_event_operations *type); +int dyn_event_create(int argc, char **argv, struct dyn_event_operations *type); /* * for_each_dyn_event - iterate over the dyn_event list diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c index 7895b72d5b3c..557f92bcc7ff 100644 --- a/kernel/trace/trace_kprobe.c +++ b/kernel/trace/trace_kprobe.c @@ -928,7 +928,7 @@ static int create_or_delete_trace_kprobe(int argc, char **argv) if (argv[0][0] == '-') return dyn_event_release(argc, argv, &trace_kprobe_ops); - ret = trace_kprobe_create(argc, (const char **)argv); + ret = dyn_event_create(argc, argv, &trace_kprobe_ops); return ret == -ECANCELED ? -EINVAL : ret; } diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c index b0b9a093dcce..3e020511885c 100644 --- a/kernel/trace/trace_probe.c +++ b/kernel/trace/trace_probe.c @@ -143,9 +143,12 @@ static const struct fetch_type *find_fetch_type(const char *type) } static struct trace_probe_log trace_probe_log; +extern struct mutex dyn_event_ops_mutex; void trace_probe_log_init(const char *subsystem, int argc, const char **argv) { + lockdep_assert_held(&dyn_event_ops_mutex); + trace_probe_log.subsystem = subsystem; trace_probe_log.argc = argc; trace_probe_log.argv = argv; @@ -154,11 +157,15 @@ void trace_probe_log_init(const char *subsystem, int argc, const char **argv) void trace_probe_log_clear(void) { + lockdep_assert_held(&dyn_event_ops_mutex); + memset(&trace_probe_log, 0, sizeof(trace_probe_log)); } void trace_probe_log_set_index(int index) { + lockdep_assert_held(&dyn_event_ops_mutex); + trace_probe_log.index = index; } @@ -167,6 +174,8 @@ void __trace_probe_log_err(int offset, int err_type) char *command, *p; int i, len = 0, pos = 0; + lockdep_assert_held(&dyn_event_ops_mutex); + if (!trace_probe_log.argv) return; diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c index e12913203aa5..8a4e6e782d22 100644 --- a/kernel/trace/trace_uprobe.c +++ b/kernel/trace/trace_uprobe.c @@ -728,7 +728,7 @@ static int create_or_delete_trace_uprobe(int argc, char **argv) if (argv[0][0] == '-') return dyn_event_release(argc, argv, &trace_uprobe_ops); - ret = trace_uprobe_create(argc, (const char **)argv); + ret = dyn_event_create(argc, argv, &trace_uprobe_ops); return ret == -ECANCELED ? -EINVAL : ret; } -- 2.34.1

2 1

[PATCH OLK-6.6 0/1] Fix CVE-2025-39679
by Hongbo Li 23 Oct '25

23 Oct '25

Fix CVE-2025-39679. Fanhua Li (1): drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor(). drivers/gpu/drm/nouveau/nvif/vmm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH OLK-5.10] iio: adc: at91: call input_free_device() on allocated iio_dev
by Wupeng Ma 23 Oct '25

23 Oct '25

From: Joe Hattori <joe(a)pf.is.s.u-tokyo.ac.jp> stable inclusion from stable-v5.10.234 commit ac8d932e3214c10ec641ad45a253929a596ead62 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBIQWA CVE: CVE-2024-57904 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit de6a73bad1743e9e81ea5a24c178c67429ff510b upstream. Current implementation of at91_ts_register() calls input_free_deivce() on st->ts_input, however, the err label can be reached before the allocated iio_dev is stored to st->ts_input. Thus call input_free_device() on input instead of st->ts_input. Fixes: 84882b060301 ("iio: adc: at91_adc: Add support for touchscreens without TSMR") Signed-off-by: Joe Hattori <joe(a)pf.is.s.u-tokyo.ac.jp> Link: https://patch.msgid.link/20241207043045.1255409-1-joe@pf.is.s.u-tokyo.ac.jp Cc: <Stable(a)vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- drivers/iio/adc/at91_adc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c index 38d4a910bc52..aba206192455 100644 --- a/drivers/iio/adc/at91_adc.c +++ b/drivers/iio/adc/at91_adc.c @@ -1139,7 +1139,7 @@ static int at91_ts_register(struct iio_dev *idev, return ret; err: - input_free_device(st->ts_input); + input_free_device(input); return ret; } -- 2.43.0

2 1