- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] md: fix out-of-bound by adding checks at store
by Zhou Minqiang 03 Nov '26

03 Nov '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/10161 Reference: https://lore.kernel.org/all/e743762c-2ed0-465b-bfa1-57e75aabf034@fygo.io/ -------------------------------- syzbot reported array-index-out-of-bounds in super_90_sync() UBSAN: array-index-out-of-bounds in drivers/md/md.c:1697:17 index 124 is out of range for type 'mdp_disk_t [27]' CPU: 1 UID: 0 PID: 10197 Comm: syz.3.1362 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 ubsan_epilogue+0xa/0x30 lib/ubsan.c:233 __ubsan_handle_out_of_bounds+0xcc/0xf0 lib/ubsan.c:455 super_90_sync+0x1eed/0x1ff0 drivers/md/md.c:1697 ... super_90_sync() exists for older version 0.90, which supports up to 27 maximum disks (MD_SB_DISKS). This function doesn't contain any bound checks for raid disks. The repro wrote higher value (124) in raid_disks sysfs attribute to trigger this bug. Add bound checks in three entry points that can set raid_disks or major_version without validating against the v0.90 superblock limit: - raid_disks_store(): add max_disks check in the reshape branch and the else branch, mirroring the existing check in update_raid_disks(). - metadata_store(): reject major_version=0 when the existing raid_disks already exceeds MD_SB_DISKS. - md_set_array_info(): reject the creation path when persistent and raid_disks >= MD_SB_DISKS. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Zhou Minqiang <zhouminqiang2(a)huawei.com> --- drivers/md/md.c | 30 +++++++++++++++++++++++++++++- 1 file changed, 29 insertions(+), 1 deletion(-) diff --git a/drivers/md/md.c b/drivers/md/md.c index 80d2bddb9e46..b8ddc1959871 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -4357,11 +4357,20 @@ raid_disks_store(struct mddev *mddev, const char *buf, size_t len) goto out_unlock; } err = 0; + if (mddev->max_disks && n >= mddev->max_disks) { + err = -EINVAL; + goto out_unlock; + } mddev->delta_disks = n - olddisks; mddev->raid_disks = n; mddev->reshape_backwards = (mddev->delta_disks < 0); - } else + } else { + if (mddev->max_disks && n >= mddev->max_disks) { + err = -EINVAL; + goto out_unlock; + } mddev->raid_disks = n; + } out_unlock: mddev_unlock_and_resume(mddev); return err ? err : len; @@ -4912,6 +4921,7 @@ metadata_store(struct mddev *mddev, const char *buf, size_t len) mddev->external = 0; mddev->major_version = 0; mddev->minor_version = 90; + mddev->max_disks = 0; goto out_unlock; } if (strncmp(buf, "external:", 9) == 0) { @@ -4926,6 +4936,7 @@ metadata_store(struct mddev *mddev, const char *buf, size_t len) mddev->external = 1; mddev->major_version = 0; mddev->minor_version = 90; + mddev->max_disks = 0; goto out_unlock; } major = simple_strtoul(buf, &e, 10); @@ -4936,12 +4947,18 @@ metadata_store(struct mddev *mddev, const char *buf, size_t len) minor = simple_strtoul(buf, &e, 10); if (e==buf || (*e && *e != '\n') ) goto out_unlock; + if (major == 0 && mddev->raid_disks >= MD_SB_DISKS) + goto out_unlock; err = -ENOENT; if (major >= ARRAY_SIZE(super_types) || super_types[major].name == NULL) goto out_unlock; mddev->major_version = major; mddev->minor_version = minor; mddev->persistent = 1; + if (major == 0) + mddev->max_disks = MD_SB_DISKS; + else if (major == 1) + mddev->max_disks = (4096 - 256) / 2; mddev->external = 0; err = 0; out_unlock: @@ -7421,12 +7438,23 @@ int md_set_array_info(struct mddev *mddev, struct mdu_array_info_s *info) mddev->minor_version = info->minor_version; mddev->patch_version = info->patch_version; mddev->persistent = !info->not_persistent; + if (mddev->persistent == 1) { + if (mddev->major_version == 0) + mddev->max_disks = MD_SB_DISKS; + else if (mddev->major_version == 1) + mddev->max_disks = (4096 - 256) / 2; + } /* ensure mddev_put doesn't delete this now that there * is some minimal configuration. */ mddev->ctime = ktime_get_real_seconds(); return 0; } + if (!info->not_persistent && info->raid_disks >= MD_SB_DISKS) { + pr_warn("md: raid disks (%d) exceeds max disks (%d) for metadata version 0.90\n", + info->raid_disks, MD_SB_DISKS); + return -EINVAL; + } mddev->major_version = MD_MAJOR_VERSION; mddev->minor_version = MD_MINOR_VERSION; mddev->patch_version = MD_PATCHLEVEL_VERSION; -- 2.52.0

2 1

[PATCH OLK-5.10] md: fix out-of-bound by adding checks at store
by Zhou Minqiang 03 Nov '26

03 Nov '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/10161 Reference: https://lore.kernel.org/all/e743762c-2ed0-465b-bfa1-57e75aabf034@fygo.io/ -------------------------------- syzbot reported array-index-out-of-bounds in super_90_sync() UBSAN: array-index-out-of-bounds in drivers/md/md.c:1697:17 index 124 is out of range for type 'mdp_disk_t [27]' CPU: 1 UID: 0 PID: 10197 Comm: syz.3.1362 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 ubsan_epilogue+0xa/0x30 lib/ubsan.c:233 __ubsan_handle_out_of_bounds+0xcc/0xf0 lib/ubsan.c:455 super_90_sync+0x1eed/0x1ff0 drivers/md/md.c:1697 ... super_90_sync() exists for older version 0.90, which supports up to 27 maximum disks (MD_SB_DISKS). This function doesn't contain any bound checks for raid disks. The repro wrote higher value (124) in raid_disks sysfs attribute to trigger this bug. Add bound checks in three entry points that can set raid_disks or major_version without validating against the v0.90 superblock limit: - raid_disks_store(): add max_disks check in the reshape branch and the else branch, mirroring the existing check in update_raid_disks(). - metadata_store(): reject major_version=0 when the existing raid_disks already exceeds MD_SB_DISKS. - md_set_array_info(): reject the creation path when persistent and raid_disks >= MD_SB_DISKS. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Zhou Minqiang <zhouminqiang2(a)huawei.com> --- drivers/md/md.c | 30 +++++++++++++++++++++++++++++- 1 file changed, 29 insertions(+), 1 deletion(-) diff --git a/drivers/md/md.c b/drivers/md/md.c index 2952b178f016..c5f98bc89e0c 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -4278,11 +4278,20 @@ raid_disks_store(struct mddev *mddev, const char *buf, size_t len) goto out_unlock; } err = 0; + if (mddev->max_disks && n >= mddev->max_disks) { + err = -EINVAL; + goto out_unlock; + } mddev->delta_disks = n - olddisks; mddev->raid_disks = n; mddev->reshape_backwards = (mddev->delta_disks < 0); - } else + } else { + if (mddev->max_disks && n >= mddev->max_disks) { + err = -EINVAL; + goto out_unlock; + } mddev->raid_disks = n; + } out_unlock: mddev_unlock(mddev); return err ? err : len; @@ -4825,6 +4834,7 @@ metadata_store(struct mddev *mddev, const char *buf, size_t len) mddev->external = 0; mddev->major_version = 0; mddev->minor_version = 90; + mddev->max_disks = 0; goto out_unlock; } if (strncmp(buf, "external:", 9) == 0) { @@ -4839,6 +4849,7 @@ metadata_store(struct mddev *mddev, const char *buf, size_t len) mddev->external = 1; mddev->major_version = 0; mddev->minor_version = 90; + mddev->max_disks = 0; goto out_unlock; } major = simple_strtoul(buf, &e, 10); @@ -4849,12 +4860,18 @@ metadata_store(struct mddev *mddev, const char *buf, size_t len) minor = simple_strtoul(buf, &e, 10); if (e==buf || (*e && *e != '\n') ) goto out_unlock; + if (major == 0 && mddev->raid_disks >= MD_SB_DISKS) + goto out_unlock; err = -ENOENT; if (major >= ARRAY_SIZE(super_types) || super_types[major].name == NULL) goto out_unlock; mddev->major_version = major; mddev->minor_version = minor; mddev->persistent = 1; + if (major == 0) + mddev->max_disks = MD_SB_DISKS; + else if (major == 1) + mddev->max_disks = (4096 - 256) / 2; mddev->external = 0; err = 0; out_unlock: @@ -7288,12 +7305,23 @@ int md_set_array_info(struct mddev *mddev, struct mdu_array_info_s *info) mddev->minor_version = info->minor_version; mddev->patch_version = info->patch_version; mddev->persistent = !info->not_persistent; + if (mddev->persistent == 1) { + if (mddev->major_version == 0) + mddev->max_disks = MD_SB_DISKS; + else if (mddev->major_version == 1) + mddev->max_disks = (4096 - 256) / 2; + } /* ensure mddev_put doesn't delete this now that there * is some minimal configuration. */ mddev->ctime = ktime_get_real_seconds(); return 0; } + if (!info->not_persistent && info->raid_disks >= MD_SB_DISKS) { + pr_warn("md: raid disks (%d) exceeds max disks (%d) for metadata version 0.90\n", + info->raid_disks, MD_SB_DISKS); + return -EINVAL; + } mddev->major_version = MD_MAJOR_VERSION; mddev->minor_version = MD_MINOR_VERSION; mddev->patch_version = MD_PATCHLEVEL_VERSION; -- 2.52.0

2 1

[PATCH OLK-6.6] wifi: mac80211: minstrel_ht: validate fixed rate index
by Yi Yang 03 Nov '26

03 Nov '26

From: Yuqi Xu <xuyuqiabc(a)gmail.com> stable inclusion from stable-v6.6.160 commit eebc70f132041b35da9ec74d5d395083125289b2 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20518 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 15fb9e3cea55fbc378261ce35a32b0f8828f0000 upstream. The fixed_rate_idx debugfs file is a plain u32 attribute, so any value can be written to it. minstrel_ht_update_stats() then copies the value into mi->max_tp_rate[] and mi->max_prob_rate, and minstrel_ht_set_rate() uses MI_RATE_GROUP()/MI_RATE_IDX() to index minstrel_mcs_groups[] (42 entries) and mi->groups[].rates[] (10 entries) with it. Writing e.g. 65535 selects group 4095 and rate index 15, far outside both arrays. The out-of-bounds entries are dereferenced and updated as struct minstrel_rate_stats (retry counts, etc.), so the invalid index corrupts adjacent kernel memory. With CONFIG_UBSAN_BOUNDS the access is reported as an array-index-out-of-bounds in minstrel_ht_set_rate(). Only a valid group/rate pair, or U32_MAX to disable fixed rate processing, can be used safely, so reject any other value when the debugfs file is written. The file is only reachable through a root-only debugfs mount, so this is not a privilege boundary. The out-of-bounds access is still a bug that must not be reachable through a writable debugfs attribute. Fixes: 24f7580e852b ("minstrel_ht: fixed rate mode through debugfs") Cc: stable(a)vger.kernel.org Reported-by: Vega <vega(a)nebusec.ai> Assisted-by: LLM Signed-off-by: Yuqi Xu <xuyuqiabc(a)gmail.com> Reviewed-by: Ren Wei <weir(a)nebusec.ai> Link: https://patch.msgid.link/288e6f6d30dc82ff40da502755e6666982f6b735.178979800… Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- net/mac80211/rc80211_minstrel_ht.c | 30 ++++++++++++++++++++++++++++-- 1 file changed, 28 insertions(+), 2 deletions(-) diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c index 34eee00dac4f..737b1ad04366 100644 --- a/net/mac80211/rc80211_minstrel_ht.c +++ b/net/mac80211/rc80211_minstrel_ht.c @@ -7,6 +7,7 @@ #include <linux/types.h> #include <linux/skbuff.h> #include <linux/debugfs.h> +#include <linux/limits.h> #include <linux/random.h> #include <linux/moduleparam.h> #include <linux/ieee80211.h> @@ -2015,14 +2016,39 @@ minstrel_ht_alloc(struct ieee80211_hw *hw) } #ifdef CONFIG_MAC80211_DEBUGFS +static int minstrel_ht_fixed_rate_idx_get(void *data, u64 *val) +{ + *val = *(u32 *)data; + return 0; +} + +static int minstrel_ht_fixed_rate_idx_set(void *data, u64 val) +{ + u32 idx = val; + + /* U32_MAX is the default and keeps fixed rate processing disabled */ + if (val != U32_MAX && + (val > U16_MAX || + MI_RATE_GROUP(idx) >= ARRAY_SIZE(minstrel_mcs_groups) || + MI_RATE_IDX(idx) >= MCS_GROUP_RATES)) + return -EINVAL; + + *(u32 *)data = idx; + return 0; +} + +DEFINE_DEBUGFS_ATTRIBUTE(minstrel_ht_fixed_rate_idx_fops, + minstrel_ht_fixed_rate_idx_get, + minstrel_ht_fixed_rate_idx_set, "%llu\n"); + static void minstrel_ht_add_debugfs(struct ieee80211_hw *hw, void *priv, struct dentry *debugfsdir) { struct minstrel_priv *mp = priv; mp->fixed_rate_idx = (u32) -1; - debugfs_create_u32("fixed_rate_idx", S_IRUGO | S_IWUGO, debugfsdir, - &mp->fixed_rate_idx); + debugfs_create_file("fixed_rate_idx", S_IRUGO | S_IWUGO, debugfsdir, + &mp->fixed_rate_idx, &minstrel_ht_fixed_rate_idx_fops); } #endif -- 2.25.1

2 1

[PATCH OLK-6.6] net: ena: fix MMIO read buffer leak on probe failure
by Yi Yang 03 Nov '26

03 Nov '26

From: Guangshuo Li <lgs201920130244(a)gmail.com> stable inclusion from stable-v6.6.160 commit a0f5fd7a285f44fa402242f26feddfe1d4a0fc6c category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20691 CVE: CVE-2026-98486 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9476b4468862927297c94c440863cd8ed1e7cc83 ] ena_device_init() initializes the MMIO read mechanism with ena_com_mmio_reg_read_request_init(), which allocates a coherent DMA buffer for MMIO read responses. The normal removal path releases this buffer through ena_com_mmio_reg_read_request_destroy(). However, if ena_probe() fails after ena_device_init() succeeds, the error path destroys the admin resources and eventually frees ena_dev without destroying the MMIO read request, leaving the coherent DMA buffer allocated. Call ena_com_mmio_reg_read_request_destroy() in the probe error path before releasing the remaining device resources. This issue was found by manual code inspection. Fixes: 1738cd3ed342 ("net: ena: Add a driver for Amazon Elastic Network Adapters (ENA)") Cc: stable(a)vger.kernel.org Signed-off-by: Guangshuo Li <lgs201920130244(a)gmail.com> Link: https://patch.msgid.link/20260921154202.471662-3-lgs201920130244@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> [ Adjusted cleanup context due to missing PHC, devlink, and customer-metrics code. ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/net/ethernet/amazon/ena/ena_netdev.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c index 60d8d2d99af1..2242fb1f3e0d 100644 --- a/drivers/net/ethernet/amazon/ena/ena_netdev.c +++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c @@ -3990,6 +3990,7 @@ static int ena_probe(struct pci_dev *pdev, const struct pci_device_id *ent) err_device_destroy: ena_com_delete_host_info(ena_dev); ena_com_admin_destroy(ena_dev); + ena_com_mmio_reg_read_request_destroy(ena_dev); err_netdev_destroy: free_netdev(netdev); err_free_region: -- 2.25.1

2 1

[PATCH OLK-5.10 0/2] Fix CVE-2026-98490 for OLK-5.10
by Yi Yang 03 Nov '26

03 Nov '26

*** BLURB HERE *** Ilya Maximets (2): net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry net: openvswitch: conntrack: fix helper UAF due to extensions realloc include/net/netfilter/nf_conntrack.h | 5 ++++ net/openvswitch/conntrack.c | 34 ++++++++++++++++++++++------ 2 files changed, 32 insertions(+), 7 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6 0/5] fix CVE-2026-98490 for OLK-6.6
by Yi Yang 03 Nov '26

03 Nov '26

*** BLURB HERE *** Florian Westphal (1): openvswitch: prepare for stolen verdict coming from conntrack and nat engine Ilya Maximets (4): net/sched: act_ct: fix helper UAF due to extensions realloc net/sched: act_ct: avoid modifying shared unconfirmed ct entry net: openvswitch: conntrack: remove 'add_helper' dead code net: openvswitch: conntrack: fix helper UAF due to extensions realloc net/openvswitch/conntrack.c | 70 +++++++++++++++++++++++++++---------- net/sched/act_ct.c | 34 ++++++++++++++---- 2 files changed, 78 insertions(+), 26 deletions(-) -- 2.25.1

2 6

[PATCH v8 OLK-6.6 0/4] arm64: Allow CPU0 to be nohz_full
by Xia Fukun 03 Nov '26

03 Nov '26

The upstream commits 2f1a6fbbef77, 9ca12ac04bb7, 9219565aa890 and 08ae95f4fd3b provide the generic framework to allow the boot CPU to be nohz_full. x86 and PowerPC already benefit from it. However, on arm64, CPU0 still cannot be put into the nohz_full/isolcpus range due to two obstacles: 1. The cpu_present_mask of arm64 is populated rather late (in smp_prepare_cpus()), because only CPUs with GICC entries marked as ACPI_MADT_ENABLED can be marked present. When 'isolcpus=' or 'nohz_full=' is parsed during early boot, only CPU0 is present, so the present check in housekeeping_setup() forcibly pulls CPU0 back into the housekeeping mask, which breaks the isolation. 2. The framework requires the arch to declare ARCH_SUSPEND_NONZERO_CPU so that a non-zero CPU can act as the primary CPU for suspend/hibernate/kexec. arm64 did not define it. This series removes the two obstacles: Patch 1/4 skips the unreliable early present check (present does not guarantee the CPU will be brought up online) when the new boot param 'support_cpu0_nohz_full' is given, keeping only the "housekeeping mask must not be empty" fallback. Patch 2/4 adds check_housekeeping_cpu_online() at the end of smp_init() as the safety net: after all CPUs are onlined, it verifies that every configured housekeeping type has at least one CPU online, and BUG()s with a clear message otherwise ("early release, late check"). Patch 3/4 declares ARCH_SUSPEND_NONZERO_CPU for arm64 (PSCI does not restrict which CPU enters suspend), and gates the behavior change with the 'support_cpu0_nohz_full' boot param, so the default behavior is unchanged. Patch 4/4 enables the two configs in openeuler_defconfig explicitly. With "support_cpu0_nohz_full isolcpus=0-N nohz_full=0-N" on the kernel command line, all CPUs including CPU0 can be isolated for latency critical workloads, while the timekeeping, RCU and workqueue duties converge on the remaining housekeeping CPUs. This series is the OLK-6.6 adaptation of the same feature merged in OLK-5.10. Xiongfeng Wang (4): isolation: Do not check whether housekeeping CPUs are present isolation: Check whether there exists a housekeeping CPU online arm64: Allow boot CPU nohz_full to coexist with suspend and kexec arm64: defconfig: Enable CONFIG_PM_SLEEP_SMP_NONZERO_CPU and CONFIG_ARCH_SUSPEND_NONZERO_CPU arch/arm64/Kconfig | 3 ++ arch/arm64/configs/openeuler_defconfig | 2 + arch/arm64/kernel/process.c | 31 +++++++++++++- include/linux/cpu.h | 4 +- include/linux/sched/isolation.h | 2 + include/linux/tick.h | 4 ++ kernel/cpu.c | 14 +++++++ kernel/sched/isolation.c | 56 ++++++++++++++++++++++---- kernel/smp.c | 4 ++ kernel/time/tick-common.c | 9 +++++ kernel/time/tick-sched.c | 11 ++++- 11 files changed, 129 insertions(+), 11 deletions(-) -- 2.34.1

2 5

[PATCH OLK-6.6 0/2] fix CVE-2026-98722 for OLK-6.6
by Yi Yang 03 Nov '26

03 Nov '26

*** BLURB HERE *** Pei Xiao (1): mtd: block2mtd: Fix divide error when erase_size is zero Yu Kuai (1): block2mtd: prevent direct access of bd_inode drivers/mtd/devices/block2mtd.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6] tracing: Reject incomplete event filter expressions
by Pu Lehui 03 Nov '26

03 Nov '26

From: Kyle Zeng <kylebot(a)openai.com> stable inclusion from stable-v6.6.161 commit b205ff58e02922ac324f931cf9eb238a3acdb048 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/21084 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 1fdc4164e488916402badddbb1f51e9380dabb91 upstream. A non-empty expression normally finishes in predicate_parse()'s inner loop, which resolves the pending logical operators before jumping to finalization. If the input ends after an operator, possibly followed by unary '!' tokens, the outer loop instead falls through with unresolved operator state. For example, "common_pid == 1 || common_pid == 2 &&" leaves prog[0].target equal to -1. The second pass then reads prog[-1] before the forward-jump check can reject it. Depending on adjacent slab contents, it can also copy an out-of-bounds word into a branch target that passes the forward-only check. A self-targeted perf tracepoint counting event can reach this path through PERF_EVENT_IOC_SET_FILTER. Reject the outer-loop fallthrough when a predicate has already been parsed. This ensures that non-empty expressions only reach finalization after the inner loop has resolved their operators. Keep the existing no-filter error for input that has no predicates. Add a regression test for trailing logical operators and unary negations. Fixes: 80765597bc587 ("tracing: Rewrite filter logic to be simpler and faster") Cc: stable(a)vger.kernel.org Link: https://patch.msgid.link/20261023174620.91969-1-kylebot@openai.com Assisted-by: Codex:gpt-6-astra Acked-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org> Tested-by: JongHyuk Kim(MalHyuk) <malhyuk97(a)gmail.com> Signed-off-by: Kyle Zeng <kylebot(a)openai.com> Signed-off-by: Steven Rostedt <rostedt(a)goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Co-authored-by: BackportAgent(a)deepseek-v4.1-flash Signed-off-by: Hulk Robot <hulkrobot(a)huawei.com> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/trace/trace_events_filter.c | 6 +++++ .../test.d/filter/event-filter-incomplete.tc | 24 +++++++++++++++++++ 2 files changed, 30 insertions(+) create mode 100644 tools/testing/selftests/ftrace/test.d/filter/event-filter-incomplete.tc diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c index b6fc33ddb228..30be986d2184 100644 --- a/kernel/trace/trace_events_filter.c +++ b/kernel/trace/trace_events_filter.c @@ -596,6 +596,12 @@ predicate_parse(const char *str, int nr_parens, int nr_preds, top--; /* #12 */ } } + /* Only the inner loop can complete a non-empty expression. */ + if (N) { + ret = -EINVAL; + parse_error(pe, FILT_ERR_INVALID_FILTER, ptr - str); + goto out_free; + } out: if (top != op_stack) { /* Too many '(' */ diff --git a/tools/testing/selftests/ftrace/test.d/filter/event-filter-incomplete.tc b/tools/testing/selftests/ftrace/test.d/filter/event-filter-incomplete.tc new file mode 100644 index 000000000000..cc6df762845f --- /dev/null +++ b/tools/testing/selftests/ftrace/test.d/filter/event-filter-incomplete.tc @@ -0,0 +1,24 @@ +#!/bin/sh +# SPDX-License-Identifier: GPL-2.0 +# description: event filter - reject incomplete logical expressions +# requires: events/sched/sched_switch/filter +# flags: instance + +filter=events/sched/sched_switch/filter + +for base in \ + 'common_pid == 1' \ + 'common_pid == 1 || common_pid == 2' \ + 'common_pid == 1 && common_pid == 2' \ + '!(common_pid == 1 || common_pid == 2)' +do + printf '%s' "$base" > "$filter" + for tail in '&&' '||' '&& !' '|| !' '&& !! ' '|| !! '; do + if printf '%s' "$base $tail" > "$filter" 2>/dev/null; then + echo "Accepted incomplete filter: $base $tail" + exit_fail + fi + done +done + +echo 0 > "$filter" -- 2.34.1

2 1

[PATCH OLK-5.10] tracing: Reject incomplete event filter expressions
by Pu Lehui 03 Nov '26

03 Nov '26

From: Kyle Zeng <kylebot(a)openai.com> stable inclusion from stable-v5.10.273 commit 4a1a6d35359991c5d47f4bf101cfbe1475c94093 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/21084 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 1fdc4164e488916402badddbb1f51e9380dabb91 upstream. A non-empty expression normally finishes in predicate_parse()'s inner loop, which resolves the pending logical operators before jumping to finalization. If the input ends after an operator, possibly followed by unary '!' tokens, the outer loop instead falls through with unresolved operator state. For example, "common_pid == 1 || common_pid == 2 &&" leaves prog[0].target equal to -1. The second pass then reads prog[-1] before the forward-jump check can reject it. Depending on adjacent slab contents, it can also copy an out-of-bounds word into a branch target that passes the forward-only check. A self-targeted perf tracepoint counting event can reach this path through PERF_EVENT_IOC_SET_FILTER. Reject the outer-loop fallthrough when a predicate has already been parsed. This ensures that non-empty expressions only reach finalization after the inner loop has resolved their operators. Keep the existing no-filter error for input that has no predicates. Add a regression test for trailing logical operators and unary negations. Fixes: 80765597bc587 ("tracing: Rewrite filter logic to be simpler and faster") Cc: stable(a)vger.kernel.org Link: https://patch.msgid.link/20261023174620.91969-1-kylebot@openai.com Assisted-by: Codex:gpt-6-astra Acked-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org> Tested-by: JongHyuk Kim(MalHyuk) <malhyuk97(a)gmail.com> Signed-off-by: Kyle Zeng <kylebot(a)openai.com> Signed-off-by: Steven Rostedt <rostedt(a)goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Co-authored-by: BackportAgent(a)deepseek-v4.1-flash Signed-off-by: Hulk Robot <hulkrobot(a)huawei.com> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/trace/trace_events_filter.c | 6 +++++ .../test.d/filter/event-filter-incomplete.tc | 24 +++++++++++++++++++ 2 files changed, 30 insertions(+) create mode 100644 tools/testing/selftests/ftrace/test.d/filter/event-filter-incomplete.tc diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c index 8c38db5ed18f..a8c40238b1ba 100644 --- a/kernel/trace/trace_events_filter.c +++ b/kernel/trace/trace_events_filter.c @@ -537,6 +537,12 @@ predicate_parse(const char *str, int nr_parens, int nr_preds, top--; /* #12 */ } } + /* Only the inner loop can complete a non-empty expression. */ + if (N) { + ret = -EINVAL; + parse_error(pe, FILT_ERR_INVALID_FILTER, ptr - str); + goto out_free; + } out: if (top != op_stack) { /* Too many '(' */ diff --git a/tools/testing/selftests/ftrace/test.d/filter/event-filter-incomplete.tc b/tools/testing/selftests/ftrace/test.d/filter/event-filter-incomplete.tc new file mode 100644 index 000000000000..cc6df762845f --- /dev/null +++ b/tools/testing/selftests/ftrace/test.d/filter/event-filter-incomplete.tc @@ -0,0 +1,24 @@ +#!/bin/sh +# SPDX-License-Identifier: GPL-2.0 +# description: event filter - reject incomplete logical expressions +# requires: events/sched/sched_switch/filter +# flags: instance + +filter=events/sched/sched_switch/filter + +for base in \ + 'common_pid == 1' \ + 'common_pid == 1 || common_pid == 2' \ + 'common_pid == 1 && common_pid == 2' \ + '!(common_pid == 1 || common_pid == 2)' +do + printf '%s' "$base" > "$filter" + for tail in '&&' '||' '&& !' '|| !' '&& !! ' '|| !! '; do + if printf '%s' "$base $tail" > "$filter" 2>/dev/null; then + echo "Accepted incomplete filter: $base $tail" + exit_fail + fi + done +done + +echo 0 > "$filter" -- 2.34.1

2 1