- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] drm/vmwgfx: bound DMA command body size against suffix pointer
by Ziming Du 04 Sep '26

04 Sep '26

From: Zack Rusin <zack.rusin(a)broadcom.com> stable inclusion from stable-v5.10.265 commit eb20f418933bea53375843b27b4022c1810be63b category: bugfix bugzilla: NA CVE: CVE-2026-74443 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f4f1db96bfd68b81053693ba53405b6f510ac16c upstream. vmw_cmd_dma() locates the DMA suffix at (unsigned long) &cmd->body + header->size - sizeof(*suffix) without checking that header->size is large enough to contain both cmd->body and the suffix. An undersized header makes the suffix pointer underflow back into the previous command in the bounce buffer. The verifier later writes suffix->maximumOffset, clobbering verified fields of an already-relocated earlier command -- a TOCTOU on the device-visible command stream that lets one command rewrite another's GMR id, surface id, or other authenticated fields. Reject the command if the body is too small for the suffix to fit. Fixes: 4e4ddd477743 ("drm/vmwgfx: Fix queries if no dma buffer thrashing is occuring.") Cc: stable(a)vger.kernel.org Assisted-by: Claude:claude-opus-4.7 Signed-off-by: Zack Rusin <zack.rusin(a)broadcom.com> Reviewed-by: Ian Forbes <ian.forbes(a)broadcom.com> Link: https://patch.msgid.link/20260505222728.519626-8-zack.rusin@broadcom.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ziming Du <duziming2(a)huawei.com> --- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c index 6e75adaae0bcd..2084b029920c3 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c @@ -1508,6 +1508,12 @@ static int vmw_cmd_dma(struct vmw_private *dev_priv, bool dirty; cmd = container_of(header, typeof(*cmd), header); + + if (unlikely(header->size < sizeof(cmd->body) + sizeof(*suffix))) { + VMW_DEBUG_USER("Illegal SVGA_3D_CMD_SURFACE_DMA size.\n"); + return -EINVAL; + } + suffix = (SVGA3dCmdSurfaceDMASuffix *)((unsigned long) &cmd->body + header->size - sizeof(*suffix)); -- 2.43.0

2 1

[PATCH OLK-5.10] drm/virtio: bound EDID block reads to the response buffer
by Ziming Du 04 Sep '26

04 Sep '26

From: Bryam Vargas <hexlabsecurity(a)proton.me> mainline inclusion from mainline-v7.2-rc2 commit 4e1a53892ba7f8a3e1da6bfc53c83ae7c812dccd category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17136 CVE: CVE-2026-68255 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- virtio_get_edid_block() validates the read offset only against the device-supplied resp->size field, never against the fixed-size resp->edid array. The EDID block index is driven by the device-supplied extension count, so a malicious virtio-gpu backend can advertise a large size together with a high block count and read far past the array into adjacent kernel memory, which is then surfaced in the parsed EDID (an out-of-bounds read / info leak). Also reject any read whose end exceeds the size of the edid array. Conforming EDID responses stay within the array and are unaffected. Fixes: b4b01b4995fb ("drm/virtio: add edid support") Cc: stable(a)vger.kernel.org Signed-off-by: Bryam Vargas <hexlabsecurity(a)proton.me> Signed-off-by: Dmitry Osipenko <dmitry.osipenko(a)collabora.com> Link: https://patch.msgid.link/20260620-b4-disp-22bba7bf-v1-1-b95924cee742@proton… Conflicts: drivers/gpu/drm/virtio/virtgpu_vq.c [Ziming Du: context conflict due to 4c703f5d6f776eaa6a98611c9b5dfe800fbeb0c8] Signed-off-by: Ziming Du <duziming2(a)huawei.com> --- drivers/gpu/drm/virtio/virtgpu_vq.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c index e98a29d243c08..3f75510bf2407 100644 --- a/drivers/gpu/drm/virtio/virtgpu_vq.c +++ b/drivers/gpu/drm/virtio/virtgpu_vq.c @@ -724,7 +724,8 @@ static int virtio_get_edid_block(void *data, u8 *buf, struct virtio_gpu_resp_edid *resp = data; size_t start = block * EDID_LENGTH; - if (start + len > le32_to_cpu(resp->size)) + if (start + len > le32_to_cpu(resp->size) || + start + len > sizeof(resp->edid)) return -1; memcpy(buf, resp->edid + start, len); return 0; -- 2.43.0

2 1

[PATCH OLK-6.6] cputype: add cputype for HIP13
by Jiacheng Yu 04 Sep '26

04 Sep '26

From: Yushan Wang <wangyushan12(a)huawei.com> driver inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/9850 ---------------------------------------------------------------------- Add new HiSilicon CPU type HIP13. Signed-off-by: Yushan Wang <wangyushan12(a)huawei.com> Signed-off-by: Jiacheng Yu <yujiacheng3(a)huawei.com> --- arch/arm64/include/asm/cputype.h | 2 ++ tools/arch/arm64/include/asm/cputype.h | 2 ++ 2 files changed, 4 insertions(+) diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h index 9cd4532daff3..32e610cb281a 100644 --- a/arch/arm64/include/asm/cputype.h +++ b/arch/arm64/include/asm/cputype.h @@ -147,6 +147,7 @@ #define HISI_CPU_PART_LINXICORE9100 0xD02 #define HISI_CPU_PART_HIP11 0xD22 #define HISI_CPU_PART_HIP12 0xD06 +#define HISI_CPU_PART_HIP13 0xD08 #define APPLE_CPU_PART_M1_ICESTORM 0x022 #define APPLE_CPU_PART_M1_FIRESTORM 0x023 @@ -239,6 +240,7 @@ #define MIDR_HISI_LINXICORE9100 MIDR_CPU_MODEL(ARM_CPU_IMP_HISI, HISI_CPU_PART_LINXICORE9100) #define MIDR_HISI_HIP11 MIDR_CPU_MODEL(ARM_CPU_IMP_HISI, HISI_CPU_PART_HIP11) #define MIDR_HISI_HIP12 MIDR_CPU_MODEL(ARM_CPU_IMP_HISI, HISI_CPU_PART_HIP12) +#define MIDR_HISI_HIP13 MIDR_CPU_MODEL(ARM_CPU_IMP_HISI, HISI_CPU_PART_HIP13) #define MIDR_APPLE_M1_ICESTORM MIDR_CPU_MODEL(ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_ICESTORM) #define MIDR_APPLE_M1_FIRESTORM MIDR_CPU_MODEL(ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_FIRESTORM) #define MIDR_APPLE_M1_ICESTORM_PRO MIDR_CPU_MODEL(ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_ICESTORM_PRO) diff --git a/tools/arch/arm64/include/asm/cputype.h b/tools/arch/arm64/include/asm/cputype.h index c269f3bc87b3..bacb39bd65a9 100644 --- a/tools/arch/arm64/include/asm/cputype.h +++ b/tools/arch/arm64/include/asm/cputype.h @@ -129,6 +129,7 @@ #define HISI_CPU_PART_TSV110 0xD01 #define HISI_CPU_PART_HIP11 0xD22 #define HISI_CPU_PART_HIP12 0xD06 +#define HISI_CPU_PART_HIP13 0xD08 #define APPLE_CPU_PART_M1_ICESTORM 0x022 #define APPLE_CPU_PART_M1_FIRESTORM 0x023 @@ -203,6 +204,7 @@ #define MIDR_HISI_TSV110 MIDR_CPU_MODEL(ARM_CPU_IMP_HISI, HISI_CPU_PART_TSV110) #define MIDR_HISI_HIP11 MIDR_CPU_MODEL(ARM_CPU_IMP_HISI, HISI_CPU_PART_HIP11) #define MIDR_HISI_HIP12 MIDR_CPU_MODEL(ARM_CPU_IMP_HISI, HISI_CPU_PART_HIP12) +#define MIDR_HISI_HIP13 MIDR_CPU_MODEL(ARM_CPU_IMP_HISI, HISI_CPU_PART_HIP13) #define MIDR_APPLE_M1_ICESTORM MIDR_CPU_MODEL(ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_ICESTORM) #define MIDR_APPLE_M1_FIRESTORM MIDR_CPU_MODEL(ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_FIRESTORM) #define MIDR_APPLE_M1_ICESTORM_PRO MIDR_CPU_MODEL(ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_ICESTORM_PRO) -- 2.34.1

2 1

[PATCH OLK-6.6 0/4] Fix CVE-2026-74264
by JiangJieHua 04 Sep '26

04 Sep '26

Eric Dumazet (3): net: watchdog: rename __dev_watchdog_up() and dev_watchdog_down() net: watchdog: fix refcount tracking races net: do not acquire dev->tx_global_lock in netdev_watchdog_up() JiangJieHua (1): net: watchdog: fix kabi breakage of struct net_device drivers/net/ethernet/freescale/ucc_geth.c | 2 +- include/linux/netdevice.h | 9 ++-- net/core/dev.c | 5 +- net/sched/sch_generic.c | 60 ++++++++++++++--------- 4 files changed, 46 insertions(+), 30 deletions(-) -- 2.33.8

2 5

[PATCH OLK-6.6 0/4] Fix CVE-2026-74264
by JiangJieHua 04 Sep '26

04 Sep '26

Eric Dumazet (3): net: watchdog: rename __dev_watchdog_up() and dev_watchdog_down() net: watchdog: fix refcount tracking races net: do not acquire dev->tx_global_lock in netdev_watchdog_up() JiangJieHua (1): net: watchdog: fix kabi breakage of struct net_device drivers/net/ethernet/freescale/ucc_geth.c | 2 +- include/linux/netdevice.h | 9 ++-- net/core/dev.c | 5 +- net/sched/sch_generic.c | 60 ++++++++++++++--------- 4 files changed, 46 insertions(+), 30 deletions(-) -- 2.33.8

2 5

[PATCH OLK-6.6 0/4] Fix CVE-2026-74264
by JiangJieHua 04 Sep '26

04 Sep '26

Eric Dumazet (3): net: watchdog: rename __dev_watchdog_up() and dev_watchdog_down() net: watchdog: fix refcount tracking races net: do not acquire dev->tx_global_lock in netdev_watchdog_up() JiangJieHua (1): net: watchdog: fix kabi breakage of struct net_device drivers/net/ethernet/freescale/ucc_geth.c | 2 +- include/linux/netdevice.h | 9 ++-- net/core/dev.c | 5 +- net/sched/sch_generic.c | 60 ++++++++++++++--------- 4 files changed, 46 insertions(+), 30 deletions(-) -- 2.33.8

2 5

[PATCH OLK-5.10 0/2] Fix CVE-2026-80619
by Yi Yang 04 Sep '26

04 Sep '26

The following patches are used to fix the CVE-2026-80619 vulnerability: John Johansen (1): apparmor: fix label can not be immediately before a declaration Maxime Bélair (1): apparmor: fix potential UAF in aa_replace_profiles security/apparmor/policy.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS] ipv4: validate IPV4_DEVCONF attributes properly
by JiangJieHua 04 Sep '26

04 Sep '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9803 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzbot reported a UBSAN undefined behavior issue in vif_delete(): UBSAN: Undefined behaviour in net/ipv4/ipmr.c:720:43 signed integer overflow: -2147483648 - 1 cannot be represented in type 'int' When vif_delete() is called with vifi = -2147483648 (INT_MIN), the operation "vifi - 1" causes a signed integer overflow, which is undefined behavior in C. This occurs because the function does not validate the vifi range before using it as an array index. Fix by adding a check in inet_validate_link_af() to reject IPV4_DEVCONF_MC_FORWARDING attribute, returning -EINVAL when userspace attempts to modify it through netlink. This prevents the overflow and eliminates the UBSAN warning. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: JiangJieHua <jiangjiehua1(a)huawei.com> --- net/ipv4/devinet.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c index 64f0fa0be370e..acf60f0a01a4a 100644 --- a/net/ipv4/devinet.c +++ b/net/ipv4/devinet.c @@ -1796,6 +1796,9 @@ static int inet_validate_link_af(const struct net_device *dev, if (cfgid <= 0 || cfgid > IPV4_DEVCONF_MAX) return -EINVAL; + + if (cfgid == IPV4_DEVCONF_MC_FORWARDING) + return -EINVAL; } } -- 2.33.8

2 1

[PATCH OLK-5.10 0/2] mainline patch submission for OLK-5.10
by Chen Yuxi 03 Sep '26

03 Sep '26

Zide Chen (2): perf/x86/intel/uncore: Keep PCI PMUs working when MMIO/MSR setup fails perf/x86/intel/uncore: Fix uncore_box ref/unref ordering arch/x86/events/intel/uncore.c | 48 ++++++++++++++-------------------- 1 file changed, 20 insertions(+), 28 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/2] mainline patch submission for OLK-6.6
by Chen Yuxi 03 Sep '26

03 Sep '26

Zide Chen (2): perf/x86/intel/uncore: Keep PCI PMUs working when MMIO/MSR setup fails perf/x86/intel/uncore: Fix uncore_box ref/unref ordering arch/x86/events/intel/uncore.c | 48 ++++++++++++++-------------------- 1 file changed, 20 insertions(+), 28 deletions(-) -- 2.34.1

2 3