- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 0/2] resolve hungtask
by Chen Jinghuang 23 Oct '26

23 Oct '26

*** BLURB HERE *** Chen Jinghuang (1): sched: Fix struct sched_entity kabi broken Ingo Molnar (1): sched/fair: Separate se->vlag from se->vprot include/linux/sched.h | 17 ++++------------- 1 file changed, 4 insertions(+), 13 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 1/2] sched/fair: Separate se->vlag from se->vprot
by Chen Jinghuang 23 Oct '26

23 Oct '26

From: Ingo Molnar <mingo(a)kernel.org> mainline inclusion from mainline-v7.0-rc1 commit 80390ead2080071cbd6f427ff8deb94d10a4a50f category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/10165 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- There's no real space concerns here and keeping these fields in a union makes reading (and tracing) the scheduler code harder. Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Link: https://patch.msgid.link/20251201064647.1851919-4-mingo@kernel.org Conflicts: include/linux/sched.h [a trival context conflict about kabi] Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- include/linux/sched.h | 16 ++++------------ 1 file changed, 4 insertions(+), 12 deletions(-) diff --git a/include/linux/sched.h b/include/linux/sched.h index c7229faef4c7..639851dbd85e 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -595,18 +595,10 @@ struct sched_entity { u64 sum_exec_runtime; u64 prev_sum_exec_runtime; u64 vruntime; - KABI_BROKEN_REPLACE( - s64 vlag, - union { - /* - * When !@on_rq this field is vlag. - * When cfs_rq->curr == se (which implies @on_rq) - * this field is vprot. See protect_slice(). - */ - s64 vlag; - u64 vprot; - } - ) + /* Approximated virtual lag: */ + s64 vlag; + /* 'Protected' deadline, to give out minimum quantums: */ + u64 vprot; u64 slice; u64 nr_migrations; -- 2.34.1

2 2

[PATCH OLK-6.6] drm/amdkfd: fix SMI event cross-process information leak
by Zhang Yuwei 22 Oct '26

22 Oct '26

From: Yongqiang Sun <Yongqiang.Sun(a)amd.com> mainline inclusion from mainline-v7.2-rc1 commit 92a8dba246d371fe268280e5fd74b0955688e6df category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19653 CVE: CVE-2026-97422 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- kfd_smi_ev_enabled() skips the suser privilege check when pid=0. PROCESS_START, PROCESS_END, and VMFAULT events are emitted with pid=0 while carrying another process's PID and command name, so any /dev/kfd user in the render group can monitor all GPU workloads. Pass the target process PID into kfd_smi_event_add() for these events so the existing per-client filter restricts delivery to the owning process or CAP_SYS_ADMIN subscribers. Signed-off-by: Yongqiang Sun <Yongqiang.Sun(a)amd.com> Acked-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Co-authored-by: BackportAgent(a)deepseek-v4.1-flash Signed-off-by: Hulk Robot <hulkrobot(a)huawei.com> Conflicts: drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c [Commit b8f67b9ddf4f changed vm->task_info to flat fields (task_info->pid/tgid/task_name), so pass task_info->tgid as the SMI client pid filter instead of task_info->task.tgid. The kfd_smi_event_process()/PROCESS_START|END path does not exist in this tree, so only the VMFAULT caller is adapted.] Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> --- drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c b/drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c index 06ac835190f9..4e374c0e5a52 100644 --- a/drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c +++ b/drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c @@ -244,8 +244,9 @@ void kfd_smi_event_update_vmfault(struct kfd_node *dev, uint16_t pasid) if (task_info) { /* Report VM faults from user applications, not retry from kernel */ if (task_info->pid) - kfd_smi_event_add(0, dev, KFD_SMI_EVENT_VMFAULT, "%x:%s\n", - task_info->pid, task_info->task_name); + kfd_smi_event_add(task_info->tgid, dev, + KFD_SMI_EVENT_VMFAULT, "%x:%s\n", + task_info->pid, task_info->task_name); amdgpu_vm_put_task_info(task_info); } } -- 2.22.0

2 1

[PATCH OLK-6.6] drm/amdkfd: fix SMI event cross-process information leak
by Zhang Yuwei 22 Oct '26

22 Oct '26

From: Yongqiang Sun <Yongqiang.Sun(a)amd.com> mainline inclusion from mainline-v7.2-rc1 commit 92a8dba246d371fe268280e5fd74b0955688e6df category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19653 CVE: CVE-2026-97422 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- kfd_smi_ev_enabled() skips the suser privilege check when pid=0. PROCESS_START, PROCESS_END, and VMFAULT events are emitted with pid=0 while carrying another process's PID and command name, so any /dev/kfd user in the render group can monitor all GPU workloads. Pass the target process PID into kfd_smi_event_add() for these events so the existing per-client filter restricts delivery to the owning process or CAP_SYS_ADMIN subscribers. Signed-off-by: Yongqiang Sun <Yongqiang.Sun(a)amd.com> Acked-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Conflicts: drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c [Commit b8f67b9ddf4f changed vm->task_info to flat fields (task_info->pid/tgid/task_name), so pass task_info->tgid as the SMI client pid filter instead of task_info->task.tgid. The kfd_smi_event_process()/PROCESS_START|END path does not exist in this tree, so only the VMFAULT caller is adapted.] Co-authored-by: BackportAgent(a)deepseek-v4.1-flash Signed-off-by: Hulk Robot <hulkrobot(a)huawei.com> Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> --- drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c b/drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c index 06ac835190f9..4e374c0e5a52 100644 --- a/drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c +++ b/drivers/gpu/drm/amd/amdkfd/kfd_smi_events.c @@ -244,8 +244,9 @@ void kfd_smi_event_update_vmfault(struct kfd_node *dev, uint16_t pasid) if (task_info) { /* Report VM faults from user applications, not retry from kernel */ if (task_info->pid) - kfd_smi_event_add(0, dev, KFD_SMI_EVENT_VMFAULT, "%x:%s\n", - task_info->pid, task_info->task_name); + kfd_smi_event_add(task_info->tgid, dev, + KFD_SMI_EVENT_VMFAULT, "%x:%s\n", + task_info->pid, task_info->task_name); amdgpu_vm_put_task_info(task_info); } } -- 2.22.0

2 1

[PATCH OLK-5.10 0/2] CVE-2026-97563 and CVE-2026-97565
by Yifan Qiao 22 Oct '26

22 Oct '26

Diego Oliva (2): smb: client: reject short READ responses in CIFSSMBRead() smb: client: reject out-of-bounds DataOffset in CIFSSMBRead() fs/cifs/cifssmb.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) -- 2.52.0

2 3

[PATCH OLK-6.6] smb: client: reject out-of-bounds DataOffset in CIFSSMBRead()
by Yifan Qiao 22 Oct '26

22 Oct '26

From: Diego Oliva <diego(a)bynar.io> mainline inclusion from mainline-v7.3-rc3 commit 5be5bdda5863eacc964b609ba927764f253431b3 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20155 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- The SMB1 synchronous read helper CIFSSMBRead() validates the server's DataLength against CIFSMaxBufSize and the caller's count, but never validates DataOffset. The copy source is formed as &pSMBr->hdr.Protocol + le16_to_cpu(pSMBr->DataOffset) and memcpy()'d for DataLength bytes with no check that the [DataOffset, DataOffset + DataLength) range lies within the response actually received from the server. A malicious or compromised SMB1 server can return a response carrying an in-range DataLength and a large DataOffset, driving the source pointer past the end of the response buffer. The memcpy() then copies adjacent kernel heap into the caller's read buffer (information disclosure), or reads unmapped memory and oopses (denial of service). SMB1 is not negotiated by default; reaching this code requires an explicit vers=1.0 mount. Both DataOffset and the received response length recorded in rsp_iov.iov_len are relative to the start of the SMB header, so reject the response unless DataOffset + DataLength fits within that length, using overflow-safe arithmetic, before forming the source pointer. The response length has been validated by the previous patch, so the DataOffset and DataLength fields can be read safely here. While here, make data_length unsigned. It holds a length derived from unsigned on-the-wire fields and is only ever compared against unsigned quantities; print it with %u accordingly, and add __func__ to the cifs_dbg() calls in this function. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable(a)vger.kernel.org # 6.19.x Assisted-by: Bynario AI Signed-off-by: Diego Oliva <diego(a)bynar.io> Reviewed-by: David Howells <dhowells(a)redhat.com> Signed-off-by: Paulo Alcantara <pc(a)manguebit.org> Conflicts: fs/smb/client/cifssmb.c fs/smb/client/trace.h [Context differences.] Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/smb/client/cifssmb.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/fs/smb/client/cifssmb.c b/fs/smb/client/cifssmb.c index 60f333f6fa02..4c0a2d410f9a 100644 --- a/fs/smb/client/cifssmb.c +++ b/fs/smb/client/cifssmb.c @@ -1456,7 +1456,8 @@ CIFSSMBRead(const unsigned int xid, struct cifs_io_parms *io_parms, rc = -EIO; *nbytes = 0; } else { - int data_length = le16_to_cpu(pSMBr->DataLengthHigh); + unsigned int data_length = le16_to_cpu(pSMBr->DataLengthHigh); + __u16 data_offset = le16_to_cpu(pSMBr->DataOffset); data_length = data_length << 16; data_length += le16_to_cpu(pSMBr->DataLength); *nbytes = data_length; @@ -1464,13 +1465,19 @@ CIFSSMBRead(const unsigned int xid, struct cifs_io_parms *io_parms, /*check that DataLength would not go beyond end of SMB */ if ((data_length > CIFSMaxBufSize) || (data_length > count)) { - cifs_dbg(FYI, "bad length %d for count %d\n", - data_length, count); + cifs_dbg(FYI, "%s: bad length %u for count %u\n", + __func__, data_length, count); + rc = -EIO; + *nbytes = 0; + } else if (4 + data_offset < sizeof(*pSMBr) || + 4 + (size_t)data_offset + data_length > rsp_iov.iov_len) { + /* check that the data lies within the received response */ + cifs_dbg(FYI, "%s: bad data offset %u length %u for response of %zu\n", + __func__, data_offset, data_length, rsp_iov.iov_len); rc = -EIO; *nbytes = 0; } else { - pReadData = (char *) (&pSMBr->hdr.Protocol) + - le16_to_cpu(pSMBr->DataOffset); + pReadData = (char *) (&pSMBr->hdr.Protocol) + data_offset; /* if (rc = copy_to_user(buf, pReadData, data_length)) { cifs_dbg(VFS, "Faulting on read rc = %d\n",rc); rc = -EFAULT; -- 2.52.0

2 1

[PATCH OLK-6.6] io_uring/rw: end write accounting from ->ki_complete
by Yifan Qiao 22 Oct '26

22 Oct '26

From: Jens Axboe <axboe(a)kernel.dk> mainline inclusion from mainline-v7.3-rc3 commit 796aa0547557e63338657ed1c487906f9fac4c73 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20166 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Commit b000145e9907 moved both the fsnotify calls and the write accounting out of the kiocb completion handler and into the io_req_rw_complete() task_work. However, only the fsnotify part actually needed to move as it may sleep. Ending the write accounting is just a percpu_up_read() on the superblock writers sem. Deferring it is a problem, because it makes dropping SB_FREEZE_WRITE protection depend on the ring owner getting to running task_work. But the task may be blocked in freeze_super(), causing it to never get to that: task io-wq worker -------------------------------------------------------------- io_write() io_kiocb_start_write() (takes sb_writers, hidden from lockdep by __sb_writers_release) write_iter() -> -EIOCBQUEUED ioctl(FS_IOC_SHUTDOWN) bdev_freeze() freeze_super() percpu_down_write() <- waits for the reader above io_write() kiocb_start_write() percpu_down_read() <- queued behind the writer <bio completes> io_complete_rw() queues io_req_rw_complete() <- never runs, task is in D state End the write from io_complete_rw() instead, and leave only the fsnotify calls in task_work. Reported-by: syzbot+2eb3d983669d3e49d4fa(a)syzkaller.appspotmail.com Cc: stable(a)vger.kernel.org Fixes: b000145e9907 ("io_uring/rw: defer fsnotify calls to task context") Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: io_uring/rw.c [This tree still has io_req_io_end() (which ends write accounting) on the reissue branch of __io_complete_rw_common(), so the hoisted io_req_end_write() is placed after that branch instead of at the top of io_complete_rw(), avoiding a double sb_end_write() while still ending writes from ->ki_complete.] Co-authored-by: BackportAgent(a)deepseek-v4.1-flash Signed-off-by: Hulk Robot <hulkrobot(a)huawei.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- io_uring/rw.c | 31 +++++++++++++++++++++---------- 1 file changed, 21 insertions(+), 10 deletions(-) diff --git a/io_uring/rw.c b/io_uring/rw.c index e550f0618fd2..15dfb9c24613 100644 --- a/io_uring/rw.c +++ b/io_uring/rw.c @@ -244,20 +244,25 @@ static void io_req_end_write(struct io_kiocb *req) } } -/* - * Trigger the notifications after having done some IO, and finish the write - * accounting, if any. - */ -static void io_req_io_end(struct io_kiocb *req) +/* Trigger the notifications after having done some IO. */ +static void io_req_io_notify(struct io_kiocb *req) { struct io_rw *rw = io_kiocb_to_cmd(req, struct io_rw); - if (rw->kiocb.ki_flags & IOCB_WRITE) { - io_req_end_write(req); + if (rw->kiocb.ki_flags & IOCB_WRITE) fsnotify_modify(req->file); - } else { + else fsnotify_access(req->file); - } +} + +/* Finish write accounting and notify, for inline completions only. */ +static void io_req_io_end(struct io_kiocb *req) +{ + struct io_rw *rw = io_kiocb_to_cmd(req, struct io_rw); + + if (rw->kiocb.ki_flags & IOCB_WRITE) + io_req_end_write(req); + io_req_io_notify(req); } static bool __io_complete_rw_common(struct io_kiocb *req, long res) @@ -304,7 +309,7 @@ void io_req_rw_complete(struct io_kiocb *req, struct io_tw_state *ts) io_req_set_res(req, io_fixup_rw_res(req, res), 0); } - io_req_io_end(req); + io_req_io_notify(req); if (req->flags & (REQ_F_BUFFER_SELECTED|REQ_F_BUFFER_RING)) req->cqe.flags |= io_put_kbuf(req, 0); @@ -322,6 +327,12 @@ static void io_complete_rw(struct kiocb *kiocb, long res) return; io_req_set_res(req, io_fixup_rw_res(req, res), 0); } + /* + * End write accounting here rather than in task_work, as the ring + * owner may block in freeze_super() before that runs. + */ + if (kiocb->ki_flags & IOCB_WRITE) + io_req_end_write(req); req->io_task_work.func = io_req_rw_complete; __io_req_task_work_add(req, IOU_F_TWQ_LAZY_WAKE); } -- 2.52.0

2 1

[PATCH OLK-6.6] iommu/amd: Do not reallocate GA log buffers on resume
by Zhang Yuwei 22 Oct '26

22 Oct '26

From: Karl Mehltretter <kmehltretter(a)gmail.com> mainline inclusion from mainline-v7.3-rc3 commit 00a7dd64888d6dd72110b40e2824a088cf7b7386 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19847 CVE: CVE-2026-98003 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Commit c5e1a1eb9279 ("iommu/amd: Simplify and Consolidate Virtual APIC (AVIC) Enablement") moved the GA log allocation from iommu_init_pci() to enable_iommus_vapic(), which is called on every resume. iommu_init_ga_log() assigns iommu->ga_log and iommu->ga_log_tail unconditionally. Each resume therefore replaces the boot-time pointers and leaks both old allocations. The function also uses GFP_KERNEL from a syscore resume callback, where interrupts are disabled and the non-boot CPUs are offline. Return early if both buffers are already allocated. Clear the pointers in free_ga_log() so a partial allocation failure cannot leave ga_log dangling. Fixes: c5e1a1eb9279 ("iommu/amd: Simplify and Consolidate Virtual APIC (AVIC) Enablement") Assisted-by: Claude:claude-opus-5 Signed-off-by: Karl Mehltretter <kmehltretter(a)gmail.com> Reviewed-by: Vasant Hegde <vasant.hegde(a)amd.com> Reviewed-by: Ankit Soni <Ankit.Soni(a)amd.com> Signed-off-by: Joerg Roedel <joerg.roedel(a)amd.com> Conflicts: drivers/iommu/amd/init.c [Upstream now uses iommu_alloc_pages_node_sz()/iommu_free_pages() (commit 1e0c8d6b69521 and follow-ups) and WARN_ON_ONCE() for the VAPIC check; this tree predates them, so keep the local __get_free_pages()/free_pages() helpers and the legacy silent !AMD_IOMMU_GUEST_IR_VAPIC() check. Only the early-return guard and the pointer NULLing after free are applied.] Co-authored-by: BackportAgent(a)GLM-5.3 Signed-off-by: Hulk Robot <hulkrobot(a)huawei.com> Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> --- drivers/iommu/amd/init.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c index f57e2a784da4..ff36f3c456fa 100644 --- a/drivers/iommu/amd/init.c +++ b/drivers/iommu/amd/init.c @@ -890,7 +890,9 @@ static void free_ga_log(struct amd_iommu *iommu) { #ifdef CONFIG_IRQ_REMAP iommu_free_pages(iommu->ga_log, get_order(GA_LOG_SIZE)); + iommu->ga_log = NULL; iommu_free_pages(iommu->ga_log_tail, get_order(8)); + iommu->ga_log_tail = NULL; #endif } @@ -935,6 +937,9 @@ static int iommu_init_ga_log(struct amd_iommu *iommu) if (!AMD_IOMMU_GUEST_IR_VAPIC(amd_iommu_guest_ir)) return 0; + if (iommu->ga_log && iommu->ga_log_tail) + return 0; + iommu->ga_log = iommu_alloc_pages(GFP_KERNEL, get_order(GA_LOG_SIZE)); if (!iommu->ga_log) goto err_out; -- 2.22.0

2 1

[PATCH OLK-6.6 00/17] hisilicon: HBM dev/cache fixes and sysfs cleanup
by Ziming Du 22 Oct '26

22 Oct '26

This series fixes several issues in the HiSilicon HBM device/cache drivers and cleans up the hisi_hbmdev sysfs interface. Highlights: - Serialize the ACPI device online/offline path to avoid races. - Protect the PCC operation region with locks in hbmdev/hbmcache. - Prevent hung task via mutex_trylock in hbmcache. - Don't poweroff when memory blocks failed to offline; fix NULL pointer dereference on the offline path. - Add missing locality information for hot-added ACPI/HMAT devices. - Revert the extra memory-topology and ACLS repair/query features and drop the now-unused memdev kobj / state-show sysfs. Bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20607 Dengdui Huang (1): arm64: openeuler_defconfig: add Kunpeng HCCS config Zhang Zekun (13): soc:hisilicon: Use _ON and _OFF in hbmcache hisilicon/hisi_hbmcache: Add a lock to protect pcc operation region hisilicon/hisi_hbmdev: Add lock to protect pcc operation region ACPI/HMAT: Add missing locality information for hot-added device hisilicon/hisi_hbmcache: Use mutex_trylock to prevent hung task soc: hisilicon: Don't poweroff if memblocks don't offlined soc: hisilicon: hisi_hbmdev: Notify the device in the ACPI soc: hisilicon: Setting the demand_offline in sysfs interface hisilicon/hisi_hbmdev: prevent NULL pointer dereference when corrently arm64: config: Open the hbmdev related config soc: hisilicon: hbmdev: Only support built-in soc/hisilicon: Clean the hbmcache state show sysfs soc/hisilicon: Remove the memdev kobj Ziming Du (3): soc: hisilicon: Serialize the online and onfline the acpi devices Revert "soc: hisilicon: hisi_hbmdev: Add hbm acls repair and query methods" Revert "soc: hisilicon: hisi_hbmdev: Provide extra memory topology information" arch/arm64/configs/openeuler_defconfig | 8 + drivers/acpi/acpi_memhotplug.c | 13 + drivers/acpi/device_sysfs.c | 8 + drivers/acpi/internal.h | 1 + drivers/acpi/numa/hmat.c | 17 ++ drivers/acpi/osl.c | 6 +- drivers/soc/hisilicon/Kconfig | 21 +- drivers/soc/hisilicon/hisi_hbmcache.c | 42 ++- drivers/soc/hisilicon/hisi_hbmdev.c | 346 ++++++------------------- include/linux/acpi.h | 2 + 10 files changed, 160 insertions(+), 304 deletions(-) -- 2.43.0

2 18

[PATCH OLK-6.6] smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr()
by Zizhi Wo 22 Oct '26

22 Oct '26

From: Paulo Alcantara <pc(a)manguebit.org> stable inclusion from stable-v6.6.160 commit 604feb3e8141bf11f5afd48d36d401fee5af9536 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20147 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit… -------------------------------- [ Upstream commit da6e25842431982d5a53cf00d925b98c690f4467 ] cifs_posix_to_fattr() ignores the return value of posix_info_parse(). When a malformed POSIX directory entry is encountered (e.g. invalid SID lengths from an untrusted server), posix_info_parse() returns -1 without populating the 'parsed' struct. The uninitialized stack memory in parsed.owner and parsed.group is then passed to sid_to_id(), which processes the garbage bytes and passes them to request_key() to construct a SID string, potentially leaking kernel stack contents to the userspace idmap daemon. Fix this by checking the return value and skipping the SID-to-id mapping when parsing fails. The remaining fattr fields (timestamps, mode, etc.) are populated directly from the 'info' pointer so they are unaffected. Closes: https://sashiko.dev/#/patchset/20260906172005.627163-1-pc%40manguebit.org Closes: https://sashiko.dev/#/patchset/20260906181540.647469-1-pc%40manguebit.org Reviewed-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Paulo Alcantara <pc(a)manguebit.org> Cc: Ronnie Sahlberg <ronniesahlberg(a)gmail.com> Cc: Shyam Prasad N <sprasad(a)microsoft.com> Cc: Tom Talpey <tom(a)talpey.com> Cc: Bharath SM <bharathsm(a)microsoft.com> Cc: stable(a)vger.kernel.org Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/smb/client/readdir.c [Due to commit d49df6ed234c ("smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid") has merged.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/smb/client/readdir.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/fs/smb/client/readdir.c b/fs/smb/client/readdir.c index 8e51a525ec81..7b7942f0f53e 100644 --- a/fs/smb/client/readdir.c +++ b/fs/smb/client/readdir.c @@ -241,12 +241,13 @@ static void cifs_posix_to_fattr(struct cifs_fattr *fattr, struct smb2_posix_info *info, struct cifs_sb_info *cifs_sb) { unsigned int sbflags = cifs_sb->mnt_cifs_flags; struct smb2_posix_info_parsed parsed; + int rc; - posix_info_parse(info, NULL, &parsed); + rc = posix_info_parse(info, NULL, &parsed); memset(fattr, 0, sizeof(*fattr)); fattr->cf_uniqueid = le64_to_cpu(info->Inode); fattr->cf_bytes = le64_to_cpu(info->AllocationSize); fattr->cf_eof = le64_to_cpu(info->EndOfFile); @@ -281,10 +282,15 @@ cifs_posix_to_fattr(struct cifs_fattr *fattr, struct smb2_posix_info *info, le32_to_cpu(info->ReparseTag), le32_to_cpu(info->Mode)); fattr->cf_uid = cifs_sb->ctx->linux_uid; fattr->cf_gid = cifs_sb->ctx->linux_gid; + if (rc < 0) { + cifs_dbg(VFS, "%s: failed to parse SIDs: %d\n", + __func__, rc); + return; + } if (!(sbflags & CIFS_MOUNT_OVERR_UID)) sid_to_id(cifs_sb, &parsed.owner, fattr, SIDOWNER); if (!(sbflags & CIFS_MOUNT_OVERR_GID)) sid_to_id(cifs_sb, &parsed.group, fattr, SIDGROUP); } -- 2.52.0

2 1