- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] tracing: Fix enabling of tracing on file release
by Tengda Wu 20 Jan '26

20 Jan '26

From: Steven Rostedt <rostedt(a)goodmis.org> mainline inclusion from mainline-v6.19-rc1 commit 02e7769e38c87c92b82db59923d3b0598d153903 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8379 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The trace file will pause tracing if the tracing instance has the "pause-on-trace" option is set. This happens when the file is opened, and it is unpaused when the file is closed. When this was first added, there was only one user that paused tracing. On open, the check to pause was: if (!iter->snapshot && (tr->trace_flags & TRACE_ITER(PAUSE_ON_TRACE))) Where if it is not the snapshot tracer and the "pause-on-trace" option is set, then it increments a "stop_count" of the trace instance. On close, the check is: if (!iter->snapshot && tr->stop_count) That is, if it is not the snapshot buffer and it was stopped, it will re-enable tracing. Now there's more places that stop tracing. This means, if something else stops tracing the tr->stop_count will be non-zero, and that means if the trace file is closed, it will decrement the stop_count even though it never incremented it. This causes a warning because when the user that stopped tracing enables it again, the stop_count goes below zero. Instead of relying on the stop_count being set to know if the close of the trace file should enable tracing again, add a new flag to the trace iterator. The trace iterator is unique per open of the trace file, and if the open stops tracing set the trace iterator PAUSE flag. On close, if the PAUSE flag is set, then re-enable it again. Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Link: https://patch.msgid.link/20251202161751.24abaaf1@gandalf.local.home Fixes: 06e0a548bad0f ("tracing: Do not disable tracing when reading the trace file") Reported-by: syzbot+ccdec3bfe0beec58a38d(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/692f44a5.a70a0220.2ea503.00c8.GAE@google.com/ Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Conflicts: kernel/trace/trace.c [The conflict is due to we did not backport commit bbec8e28ca.] Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- include/linux/trace_events.h | 1 + kernel/trace/trace.c | 6 ++++-- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/include/linux/trace_events.h b/include/linux/trace_events.h index 9be53cc71a34..eb2504615874 100644 --- a/include/linux/trace_events.h +++ b/include/linux/trace_events.h @@ -115,6 +115,7 @@ enum trace_iter_flags { TRACE_FILE_LAT_FMT = 1, TRACE_FILE_ANNOTATE = 2, TRACE_FILE_TIME_IN_NS = 4, + TRACE_FILE_PAUSE = 8, }; diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c index 2a70761cbd35..6c5a503987e7 100644 --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -4428,8 +4428,10 @@ __tracing_open(struct inode *inode, struct file *file, bool snapshot) * If pause-on-trace is enabled, then stop the trace while * dumping, unless this is the "snapshot" file */ - if (!iter->snapshot && (tr->trace_flags & TRACE_ITER_PAUSE_ON_TRACE)) + if (!iter->snapshot && (tr->trace_flags & TRACE_ITER_PAUSE_ON_TRACE)) { + iter->iter_flags |= TRACE_FILE_PAUSE; tracing_stop_tr(tr); + } if (iter->cpu_file == RING_BUFFER_ALL_CPUS) { for_each_tracing_cpu(cpu) { @@ -4580,7 +4582,7 @@ static int tracing_release(struct inode *inode, struct file *file) if (iter->trace && iter->trace->close) iter->trace->close(iter); - if (!iter->snapshot && tr->stop_count) + if (iter->iter_flags & TRACE_FILE_PAUSE) /* reenable tracing if it was previously enabled */ tracing_start_tr(tr); -- 2.34.1

1 0

[PATCH OLK-6.6] tracing: Fix enabling of tracing on file release
by Tengda Wu 20 Jan '26

20 Jan '26

From: Steven Rostedt <rostedt(a)goodmis.org> mainline inclusion from mainline-v6.19-rc1 commit 02e7769e38c87c92b82db59923d3b0598d153903 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8379 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The trace file will pause tracing if the tracing instance has the "pause-on-trace" option is set. This happens when the file is opened, and it is unpaused when the file is closed. When this was first added, there was only one user that paused tracing. On open, the check to pause was: if (!iter->snapshot && (tr->trace_flags & TRACE_ITER(PAUSE_ON_TRACE))) Where if it is not the snapshot tracer and the "pause-on-trace" option is set, then it increments a "stop_count" of the trace instance. On close, the check is: if (!iter->snapshot && tr->stop_count) That is, if it is not the snapshot buffer and it was stopped, it will re-enable tracing. Now there's more places that stop tracing. This means, if something else stops tracing the tr->stop_count will be non-zero, and that means if the trace file is closed, it will decrement the stop_count even though it never incremented it. This causes a warning because when the user that stopped tracing enables it again, the stop_count goes below zero. Instead of relying on the stop_count being set to know if the close of the trace file should enable tracing again, add a new flag to the trace iterator. The trace iterator is unique per open of the trace file, and if the open stops tracing set the trace iterator PAUSE flag. On close, if the PAUSE flag is set, then re-enable it again. Cc: Masami Hiramatsu <mhiramat(a)kernel.org> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Link: https://patch.msgid.link/20251202161751.24abaaf1@gandalf.local.home Fixes: 06e0a548bad0f ("tracing: Do not disable tracing when reading the trace file") Reported-by: syzbot+ccdec3bfe0beec58a38d(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/692f44a5.a70a0220.2ea503.00c8.GAE@google.com/ Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Conflicts: kernel/trace/trace.c [The conflict is due to we did not backport commit bbec8e28ca.] Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- include/linux/trace_events.h | 1 + kernel/trace/trace.c | 6 ++++-- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/include/linux/trace_events.h b/include/linux/trace_events.h index 6d91ba4eb4f5..f7c6515cfa71 100644 --- a/include/linux/trace_events.h +++ b/include/linux/trace_events.h @@ -137,6 +137,7 @@ enum trace_iter_flags { TRACE_FILE_LAT_FMT = 1, TRACE_FILE_ANNOTATE = 2, TRACE_FILE_TIME_IN_NS = 4, + TRACE_FILE_PAUSE = 8, }; diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c index 645b52ede612..1ad1c18a34d5 100644 --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -4806,8 +4806,10 @@ __tracing_open(struct inode *inode, struct file *file, bool snapshot) * If pause-on-trace is enabled, then stop the trace while * dumping, unless this is the "snapshot" file */ - if (!iter->snapshot && (tr->trace_flags & TRACE_ITER_PAUSE_ON_TRACE)) + if (!iter->snapshot && (tr->trace_flags & TRACE_ITER_PAUSE_ON_TRACE)) { + iter->iter_flags |= TRACE_FILE_PAUSE; tracing_stop_tr(tr); + } if (iter->cpu_file == RING_BUFFER_ALL_CPUS) { for_each_tracing_cpu(cpu) { @@ -4955,7 +4957,7 @@ static int tracing_release(struct inode *inode, struct file *file) if (iter->trace && iter->trace->close) iter->trace->close(iter); - if (!iter->snapshot && tr->stop_count) + if (iter->iter_flags & TRACE_FILE_PAUSE) /* reenable tracing if it was previously enabled */ tracing_start_tr(tr); -- 2.34.1

1 0

[PATCH OLK-5.10] cifs: fix session state check in reconnect to avoid use-after-free issue
by Wang Zhaolong 20 Jan '26

20 Jan '26

From: Winston Wen <wentao(a)uniontech.com> mainline inclusion from mainline-v6.5-rc1 commit 99f280700b4cc02d5f141b8d15f8e9fad0418f65 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/11378 CVE: CVE-2023-53794 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Don't collect exiting session in smb2_reconnect_server(), because it will be released soon. Note that the exiting session will stay in server->smb_ses_list until it complete the cifs_free_ipc() and logoff() and then delete itself from the list. Signed-off-by: Winston Wen <wentao(a)uniontech.com> Reviewed-by: Shyam Prasad N <sprasad(a)microsoft.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/cifs/smb2pdu.c fs/smb/client/smb2pdu.c [The code has been refactored multiple times.] Signed-off-by: Wang Zhaolong <wangzhaolong(a)huaweicloud.com> --- fs/cifs/smb2pdu.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c index 696c84632617..ffc9ac29f40e 100644 --- a/fs/cifs/smb2pdu.c +++ b/fs/cifs/smb2pdu.c @@ -3712,10 +3712,17 @@ void smb2_reconnect_server(struct work_struct *work) INIT_LIST_HEAD(&tmp_list); cifs_dbg(FYI, "Need negotiate, reconnecting tcons\n"); spin_lock(&cifs_tcp_ses_lock); list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) { + spin_lock(&GlobalMid_Lock); + if (ses->status == CifsExiting) { + spin_unlock(&GlobalMid_Lock); + continue; + } + spin_unlock(&GlobalMid_Lock); + list_for_each_entry(tcon, &ses->tcon_list, tcon_list) { if (tcon->need_reconnect || tcon->need_reopen_files) { tcon->tc_count++; list_add_tail(&tcon->rlist, &tmp_list); tcon_exist = true; -- 2.34.3

2 1

[PATCH v3 OLK-6.6 0/8] CVE-2025-68304
by Yongqiang Liu 20 Jan '26

20 Jan '26

Edward Adam Davis (1): Bluetooth: SCO: remove the redundant sco_conn_put Luiz Augusto von Dentz (3): Bluetooth: hci_core: Fix not checking skb length on hci_scodata_packet Bluetooth: SCO: Use kref to track lifetime of sco_conn Bluetooth: ISO: Use kref to track lifetime of iso_conn Pauli Virtanen (4): Bluetooth: SCO: fix sco_conn refcounting on sco_conn_ready Bluetooth: ISO: free rx_skb if not consumed Bluetooth: ISO: don't leak skb in ISO_CONT RX Bluetooth: hci_core: lookup hci_conn on RX path on protocol side include/net/bluetooth/hci_core.h | 20 ++-- net/bluetooth/hci_core.c | 82 +++++++---------- net/bluetooth/iso.c | 152 +++++++++++++++++++++++-------- net/bluetooth/l2cap_core.c | 23 ++++- net/bluetooth/sco.c | 147 ++++++++++++++++++++++-------- 5 files changed, 287 insertions(+), 137 deletions(-) -- 2.43.0

2 9

[PATCH OLK-6.6 v2 0/2] oenetcls: add a switch to enable/disable checking NIC ntuple
by Liu Jian 20 Jan '26

20 Jan '26

oenetcls: add a switch to enable/disable checking NIC ntuple Liu Jian (1): net/oenetcls: add a switch to enable/disable checking NIC ntuple feature Yue Haibing (1): net/oenetcls: Balancing softirq to improve performance include/linux/oenetcls.h | 32 +++++++++++---- net/core/dev.c | 19 ++++++++- net/oenetcls/oenetcls.h | 1 + net/oenetcls/oenetcls_flow.c | 72 +++++++++++++++++++++++++++------- net/oenetcls/oenetcls_main.c | 17 +++++++- net/oenetcls/oenetcls_ntuple.c | 12 +++--- 6 files changed, 124 insertions(+), 29 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 v2 00/66] md: backport from mainline
by linan666＠huaweicloud.com 20 Jan '26

20 Jan '26

From: Li Nan <linan122(a)huawei.com> Benjamin Marzinski (2): dm-raid: Fix WARN_ON_ONCE check for sync_thread in raid_resume md/raid5: recheck if reshape has finished with device_lock held Christoph Hellwig (4): md: add a mddev_trace_remap helper md: add a mddev_add_trace_msg helper md: add a mddev_is_dm helper md/raid0: don't free conf on raid0_run failure Christophe JAILLET (1): md-cluster: Constify struct md_cluster_operations Florian-Ewald Mueller (1): md: add check for sleepers in md_wakeup_thread() Heming Zhao (2): md-cluster: fix hanging issue while a new disk adding md-cluster: fix no recovery job when adding/re-adding a disk Joel Granados (1): raid: Remove now superfluous sentinel element from ctl_table array Li Lingfeng (1): md: get rdev->mddev with READ_ONCE() Li Nan (13): md: merge the check of capabilities into md_ioctl_valid() md: changed the switch of RAID_VERSION to if md: return directly before setting did_set_md_closing md: factor out a helper to sync mddev md: sync blockdev before stopping raid or setting readonly md: clean up openers check in do_md_stop() and md_set_readonly() md: check mddev->pers before calling md_set_readonly() md: Fix overflow in is_mddev_idle md: don't account sync_io if iostats of the disk is disabled md: Revert "md: Fix overflow in is_mddev_idle" md: change the return value type of md_write_start to void md: make md_flush_request() more readable md: prevent incorrect update of resync/recovery offset Mateusz Jończyk (1): md/raid1: set max_sectors during early return from choose_slow_rdev() Mikulas Patocka (1): md: fix a suspicious RCU usage warning Yang Li (1): md: Remove unneeded semicolon Yu Kuai (38): md: remove redundant check of 'mddev->sync_thread' md: remove redundant md_wakeup_thread() md: Don't ignore suspended array in md_check_recovery() md: Don't ignore read-only array in md_check_recovery() md: Make sure md_do_sync() will set MD_RECOVERY_DONE md: Don't register sync_thread for reshape directly md: Don't suspend the array for interrupted reshape md: add a new helper rdev_has_badblock() md/raid1: factor out helpers to add rdev to conf md/raid1: record nonrot rdevs while adding/removing rdevs to conf md/raid1: fix choose next idle in read_balance() md/raid1-10: add a helper raid1_check_read_range() md/raid1-10: factor out a new helper raid1_should_read_first() md/raid1: factor out read_first_rdev() from read_balance() md/raid1: factor out choose_slow_rdev() from read_balance() md/raid1: factor out choose_bb_rdev() from read_balance() md/raid1: factor out the code to manage sequential IO md/raid1: factor out helpers to choose the best rdev from read_balance() md: don't clear MD_RECOVERY_FROZEN for new dm-raid until resume md: export helpers to stop sync_thread md: export helper md_is_rdwr() md: add a new helper reshape_interrupted() dm-raid: really frozen sync_thread during suspend dm-raid: add a new helper prepare_suspend() in md_personality dm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent with reshape md: rearrange recovery_flags md: add a new enum type sync_action md: add new helpers for sync_action md: factor out helper to start reshape from action_store() md: replace sysfs api sync_action with new helpers md: remove parameter check_seq for stop_sync_thread() md: don't fail action_store() if sync_thread is not registered md: use new helpers in md_do_sync() md: replace last_sync_action with new enum type md: factor out helpers for different sync_action in md_do_sync() md: pass in max_sectors for pers->sync_request() md/raid5: fix spares errors about rcu usage md/raid1: Fix data corruption for degraded array with slow disk drivers/md/md-cluster.h | 2 + drivers/md/md.h | 204 ++++++++-- drivers/md/raid1.h | 1 + drivers/md/dm-raid.c | 66 ++- drivers/md/md-bitmap.c | 9 +- drivers/md/md-cluster.c | 51 ++- drivers/md/md.c | 861 +++++++++++++++++++++++----------------- drivers/md/raid0.c | 24 +- drivers/md/raid1-10.c | 69 ++++ drivers/md/raid1.c | 601 ++++++++++++++++------------ drivers/md/raid10.c | 120 ++---- drivers/md/raid5.c | 215 +++++----- 12 files changed, 1346 insertions(+), 877 deletions(-) -- 2.39.2

2 67

[PATCH OLK-6.6 0/2] oenetcls: add a switch to enable/disable checking NIC ntuple feature
by Liu Jian 20 Jan '26

20 Jan '26

oenetcls: add a switch to enable/disable checking NIC ntuple feature Liu Jian (1): oenetcls: add a switch to enable/disable checking NIC ntuple feature Yue Haibing (1): net/oenetcls: Balancing softirq to improve performance include/linux/oenetcls.h | 32 +++++++++++---- net/core/dev.c | 19 ++++++++- net/oenetcls/oenetcls.h | 1 + net/oenetcls/oenetcls_flow.c | 72 +++++++++++++++++++++++++++------- net/oenetcls/oenetcls_main.c | 17 +++++++- net/oenetcls/oenetcls_ntuple.c | 12 +++--- 6 files changed, 124 insertions(+), 29 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] iavf: fix off-by-one issues in iavf_config_rss_reg()
by Pu Lehui 20 Jan '26

20 Jan '26

From: Kohei Enju <enjuk(a)amazon.com> stable inclusion from stable-v6.6.120 commit 18de0e41d69d97fab10b91fecf10ae78a5e43232 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13398 CVE: CVE-2025-71087 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 6daa2893f323981c7894c68440823326e93a7d61 ] There are off-by-one bugs when configuring RSS hash key and lookup table, causing out-of-bounds reads to memory [1] and out-of-bounds writes to device registers. Before commit 43a3d9ba34c9 ("i40evf: Allow PF driver to configure RSS"), the loop upper bounds were: i <= I40E_VFQF_{HKEY,HLUT}_MAX_INDEX which is safe since the value is the last valid index. That commit changed the bounds to: i <= adapter->rss_{key,lut}_size / 4 where `rss_{key,lut}_size / 4` is the number of dwords, so the last valid index is `(rss_{key,lut}_size / 4) - 1`. Therefore, using `<=` accesses one element past the end. Fix the issues by using `<` instead of `<=`, ensuring we do not exceed the bounds. [1] KASAN splat about rss_key_size off-by-one BUG: KASAN: slab-out-of-bounds in iavf_config_rss+0x619/0x800 Read of size 4 at addr ffff888102c50134 by task kworker/u8:6/63 CPU: 0 UID: 0 PID: 63 Comm: kworker/u8:6 Not tainted 6.18.0-rc2-enjuk-tnguy-00378-g3005f5b77652-dirty #156 PREEMPT(voluntary) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Workqueue: iavf iavf_watchdog_task Call Trace: <TASK> dump_stack_lvl+0x6f/0xb0 print_report+0x170/0x4f3 kasan_report+0xe1/0x1a0 iavf_config_rss+0x619/0x800 iavf_watchdog_task+0x2be7/0x3230 process_one_work+0x7fd/0x1420 worker_thread+0x4d1/0xd40 kthread+0x344/0x660 ret_from_fork+0x249/0x320 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 63: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x7f/0x90 __kmalloc_noprof+0x246/0x6f0 iavf_watchdog_task+0x28fc/0x3230 process_one_work+0x7fd/0x1420 worker_thread+0x4d1/0xd40 kthread+0x344/0x660 ret_from_fork+0x249/0x320 ret_from_fork_asm+0x1a/0x30 The buggy address belongs to the object at ffff888102c50100 which belongs to the cache kmalloc-64 of size 64 The buggy address is located 0 bytes to the right of allocated 52-byte region [ffff888102c50100, ffff888102c50134) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102c50 flags: 0x200000000000000(node=0|zone=2) page_type: f5(slab) raw: 0200000000000000 ffff8881000418c0 dead000000000122 0000000000000000 raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888102c50000: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc ffff888102c50080: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc >ffff888102c50100: 00 00 00 00 00 00 04 fc fc fc fc fc fc fc fc fc ^ ffff888102c50180: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc ffff888102c50200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc Fixes: 43a3d9ba34c9 ("i40evf: Allow PF driver to configure RSS") Signed-off-by: Kohei Enju <enjuk(a)amazon.com> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov(a)intel.com> Reviewed-by: Przemek Kitszel <przemyslaw.kitszel(a)intel.com> Tested-by: Rafal Romanowski <rafal.romanowski(a)intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- drivers/net/ethernet/intel/iavf/iavf_main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c index fde8d7b80ca6..f6a748ae1c95 100644 --- a/drivers/net/ethernet/intel/iavf/iavf_main.c +++ b/drivers/net/ethernet/intel/iavf/iavf_main.c @@ -1750,11 +1750,11 @@ static int iavf_config_rss_reg(struct iavf_adapter *adapter) u16 i; dw = (u32 *)adapter->rss_key; - for (i = 0; i <= adapter->rss_key_size / 4; i++) + for (i = 0; i < adapter->rss_key_size / 4; i++) wr32(hw, IAVF_VFQF_HKEY(i), dw[i]); dw = (u32 *)adapter->rss_lut; - for (i = 0; i <= adapter->rss_lut_size / 4; i++) + for (i = 0; i < adapter->rss_lut_size / 4; i++) wr32(hw, IAVF_VFQF_HLUT(i), dw[i]); iavf_flush(hw); -- 2.34.1

2 1

[PATCH OLK-6.6] e1000: fix OOB in e1000_tbi_should_accept()
by Pu Lehui 20 Jan '26

20 Jan '26

From: Guangshuo Li <lgs201920130244(a)gmail.com> stable inclusion from stable-v6.6.120 commit 2c4c0c09f9648ba766d399917d420d03e7b3e1f8 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13404 CVE: CVE-2025-71093 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 9c72a5182ed92904d01057f208c390a303f00a0f upstream. In e1000_tbi_should_accept() we read the last byte of the frame via 'data[length - 1]' to evaluate the TBI workaround. If the descriptor- reported length is zero or larger than the actual RX buffer size, this read goes out of bounds and can hit unrelated slab objects. The issue is observed from the NAPI receive path (e1000_clean_rx_irq): ================================================================== BUG: KASAN: slab-out-of-bounds in e1000_tbi_should_accept+0x610/0x790 Read of size 1 at addr ffff888014114e54 by task sshd/363 CPU: 0 PID: 363 Comm: sshd Not tainted 5.18.0-rc1 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 Call Trace: <IRQ> dump_stack_lvl+0x5a/0x74 print_address_description+0x7b/0x440 print_report+0x101/0x200 kasan_report+0xc1/0xf0 e1000_tbi_should_accept+0x610/0x790 e1000_clean_rx_irq+0xa8c/0x1110 e1000_clean+0xde2/0x3c10 __napi_poll+0x98/0x380 net_rx_action+0x491/0xa20 __do_softirq+0x2c9/0x61d do_softirq+0xd1/0x120 </IRQ> <TASK> __local_bh_enable_ip+0xfe/0x130 ip_finish_output2+0x7d5/0xb00 __ip_queue_xmit+0xe24/0x1ab0 __tcp_transmit_skb+0x1bcb/0x3340 tcp_write_xmit+0x175d/0x6bd0 __tcp_push_pending_frames+0x7b/0x280 tcp_sendmsg_locked+0x2e4f/0x32d0 tcp_sendmsg+0x24/0x40 sock_write_iter+0x322/0x430 vfs_write+0x56c/0xa60 ksys_write+0xd1/0x190 do_syscall_64+0x43/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f511b476b10 Code: 73 01 c3 48 8b 0d 88 d3 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d f9 2b 2c 00 00 75 10 b8 01 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 8e 9b 01 00 48 89 04 24 RSP: 002b:00007ffc9211d4e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000004024 RCX: 00007f511b476b10 RDX: 0000000000004024 RSI: 0000559a9385962c RDI: 0000000000000003 RBP: 0000559a9383a400 R08: fffffffffffffff0 R09: 0000000000004f00 R10: 0000000000000070 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffc9211d57f R14: 0000559a9347bde7 R15: 0000000000000003 </TASK> Allocated by task 1: __kasan_krealloc+0x131/0x1c0 krealloc+0x90/0xc0 add_sysfs_param+0xcb/0x8a0 kernel_add_sysfs_param+0x81/0xd4 param_sysfs_builtin+0x138/0x1a6 param_sysfs_init+0x57/0x5b do_one_initcall+0x104/0x250 do_initcall_level+0x102/0x132 do_initcalls+0x46/0x74 kernel_init_freeable+0x28f/0x393 kernel_init+0x14/0x1a0 ret_from_fork+0x22/0x30 The buggy address belongs to the object at ffff888014114000 which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 1620 bytes to the right of 2048-byte region [ffff888014114000, ffff888014114800] The buggy address belongs to the physical page: page:ffffea0000504400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14110 head:ffffea0000504400 order:3 compound_mapcount:0 compound_pincount:0 flags: 0x100000000010200(slab|head|node=0|zone=1) raw: 0100000000010200 0000000000000000 dead000000000001 ffff888013442000 raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected ================================================================== This happens because the TBI check unconditionally dereferences the last byte without validating the reported length first: u8 last_byte = *(data + length - 1); Fix by rejecting the frame early if the length is zero, or if it exceeds adapter->rx_buffer_len. This preserves the TBI workaround semantics for valid frames and prevents touching memory beyond the RX buffer. Fixes: 2037110c96d5 ("e1000: move tbi workaround code into helper function") Cc: stable(a)vger.kernel.org Signed-off-by: Guangshuo Li <lgs201920130244(a)gmail.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov(a)intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- drivers/net/ethernet/intel/e1000/e1000_main.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c index da6e303ad99b..d015a0a85f07 100644 --- a/drivers/net/ethernet/intel/e1000/e1000_main.c +++ b/drivers/net/ethernet/intel/e1000/e1000_main.c @@ -4091,7 +4091,15 @@ static bool e1000_tbi_should_accept(struct e1000_adapter *adapter, u32 length, const u8 *data) { struct e1000_hw *hw = &adapter->hw; - u8 last_byte = *(data + length - 1); + u8 last_byte; + + /* Guard against OOB on data[length - 1] */ + if (unlikely(!length)) + return false; + /* Upper bound: length must not exceed rx_buffer_len */ + if (unlikely(length > adapter->rx_buffer_len)) + return false; + last_byte = *(data + length - 1); if (TBI_ACCEPT(hw, status, errors, length, last_byte)) { unsigned long irq_flags; -- 2.34.1

2 1

[PATCH OLK-5.10 v2 0/3] Fix CVE-2025-40016
by Long Li 20 Jan '26

20 Jan '26

Fix CVE-2025-40016 Ricardo Ribalda (2): media: uvcvideo: Allow extra entities media: uvcvideo: Use heuristic to find stream entity Thadeu Lima de Souza Cascardo (1): media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID drivers/media/usb/uvc/uvc_driver.c | 81 +++++++++++++++++++++--------- drivers/media/usb/uvc/uvcvideo.h | 9 +++- 2 files changed, 63 insertions(+), 27 deletions(-) -- 2.39.2

2 4