- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 0/7] CVE-2026-45905: xfrm icmp_route_lookup reverse path race fix for OLK-6.6
by superdcc97＠163.com 20 Jul '26

20 Jul '26

From: Dong Chenchen <dongchenchen2(a)huawei.com> This series backports the CVE-2026-45905 fix and its required LTS-6.6 prerequisites to OLK-6.6. It converts ip_route_input() and icmp_route_lookup() to dscp_t, adds the skb_dstref_steal/restore helpers, and finally fixes the ip_rt_bug race in the XFRM ICMP reverse path. Because OLK-6.6 already contains an earlier partial backport of cve-001 ("ipvlan: ensure network headers are in skb linear part") and cve-010 ("net: Add skb_dstref_steal and skb_dstref_restore"), those two patches are omitted as redundant. The remaining ipvlan-specific prerequisites (cve-002 and cve-005) cannot be cleanly applied against the OLK-6.6 version of ipvlan_core.c without conflicting with the existing partial backport, so they are also skipped. The functional CVE-2026-45905 fix is fully applied. Guillaume Nault (2): ipv4: Convert icmp_route_lookup() to dscp_t. ipv4: Convert ip_route_input() to dscp_t. Ido Schimmel (2): ipv4: icmp: Pass full DS field to ip_route_input() ipv4: icmp: Unmask upper DSCP bits in icmp_route_lookup() Jiayuan Chen (1): xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path Peilin He (1): net/ipv4: add tracepoint for icmp_send Stanislav Fomichev (1): net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers include/net/ip.h | 5 +++ include/net/route.h | 5 ++- include/trace/events/icmp.h | 67 +++++++++++++++++++++++++++++++++ net/bridge/br_netfilter_hooks.c | 8 ++-- net/ipv4/icmp.c | 46 +++++++++++++++------- net/ipv4/ip_options.c | 8 ++-- net/ipv6/ip6_tunnel.c | 4 +- 7 files changed, 119 insertions(+), 24 deletions(-) create mode 100644 include/trace/events/icmp.h -- 2.43.0

2 8

[PATCH OLK-6.6] ixgbevf: fix use-after-free in VEPA multicast source pruning
by Luo Gengkun 20 Jul '26

20 Jul '26

From: Michael Bommarito <michael.bommarito(a)gmail.com> stable inclusion from stable-v6.6.142 commit add70e2682c0ad3be2a5810bcf1bc13963ba4df9 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16356 CVE: CVE-2026-64113 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- commit 5d49b568c188dc77199d8d2b959c91da8cc27cf1 upstream. ixgbevf_clean_rx_irq() prunes frames whose source MAC matches the VF's own address (VEPA multicast workaround) by freeing the skb and continuing to the next descriptor: dev_kfree_skb_irq(skb); continue; The skb pointer is declared outside the while loop and persists across iterations. Because the continue skips the "skb = NULL" reset at the bottom of the loop, the next iteration enters the "else if (skb)" path and calls ixgbevf_add_rx_frag() on the freed skb, dereferencing skb_shinfo(skb)->nr_frags - a use-after-free in NAPI softirq context. The sibling driver iavf already handles this correctly by nulling the pointer before continuing. Apply the same pattern here. I do not have ixgbevf hardware; the bug was found by static analysis (scan_drop_continue_loops.py + semgrep drop_continue_in_loop, multi-tool corroboration with the highest score in the scan). The UAF was confirmed under KASAN by loading a test module that reproduces the exact code pattern (alloc skb, kfree_skb, then read skb_shinfo(skb)->nr_frags): BUG: KASAN: slab-use-after-free in ixgbevf_uaf_test_init+0x100/0x1000 Read of size 8 at addr 000000006163ae78 by task insmod/30 freed 208-byte region [000000006163adc0, 000000006163ae90) QEMU emulates igb (82576) but not ixgbe (82599), and the igbvf VF driver does not include the VEPA source pruning path, so a full end-to-end reproduction with emulated hardware was not possible. Fixes: bad17234ba70 ("ixgbevf: Change receive model to use double buffered page based receives") Cc: stable(a)vger.kernel.org Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Tested-by: Rafal Romanowski <rafal.romanowski(a)intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com> Link: https://patch.msgid.link/20260515182419.1597859-8-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c index 72b17a0f052c..99d6aa03d4b6 100644 --- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c +++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c @@ -1225,6 +1225,7 @@ static int ixgbevf_clean_rx_irq(struct ixgbevf_q_vector *q_vector, ether_addr_equal(rx_ring->netdev->dev_addr, eth_hdr(skb)->h_source)) { dev_kfree_skb_irq(skb); + skb = NULL; continue; } -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] net: Fix CVE-2026-53264
by Dong Chenchen 20 Jul '26

20 Jul '26

net: Fix CVE-2026-53264 Dong Chenchen (1): net: Fix kabi breakage of struct tc_action Jamal Hadi Salim (1): net/sched: act_api: use RCU with deferred freeing for action lifecycle include/net/act_api.h | 7 +++++++ net/sched/act_api.c | 26 ++++++++++++++++++++------ 2 files changed, 27 insertions(+), 6 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6 0/3] bonding: Fix CVE-2026-43456
by Dong Chenchen 20 Jul '26

20 Jul '26

Fix CVE-2026-43456 Dong Chenchen (1): net: Fix kabi breakage of struct header_ops Eric Dumazet (1): bonding: prevent potential infinite loop in bond_header_parse() Jiayuan Chen (1): bonding: fix type confusion in bond_setup_by_slave() drivers/net/bonding/bond_main.c | 53 ++++++++++++++++++++++++++++++++- include/linux/netdevice.h | 15 +++++++--- 2 files changed, 63 insertions(+), 5 deletions(-) -- 2.25.1

2 4

[PATCH OLK-6.6 0/4] net: Fix CVE-2026-53091
by Dong Chenchen 20 Jul '26

20 Jul '26

Fix CVE-2026-53091 Cosmin Ratiu (1): xfrm: Don't clobber inner headers when already set Eric Dumazet (2): net: qdisc_pkt_len_segs_init() cleanup net: pull headers in qdisc_pkt_len_segs_init() Fengyuan Gong (1): net: account for encap headers in qdisc pkt len net/core/dev.c | 79 ++++++++++++++++++++++++++---------------- net/sched/sch_cake.c | 5 ++- net/xfrm/xfrm_output.c | 20 +++++++---- 3 files changed, 67 insertions(+), 37 deletions(-) -- 2.25.1

2 5

[PATCH OLK-6.6 0/2] net: Fix CVE-2026-53264
by Dong Chenchen 20 Jul '26

20 Jul '26

net: Fix CVE-2026-53264 Dong Chenchen (1): net: Fix kabi breakage of struct tc_action Jamal Hadi Salim (1): net/sched: act_api: use RCU with deferred freeing for action lifecycle include/net/act_api.h | 7 +++++++ net/sched/act_api.c | 26 ++++++++++++++++++++------ 2 files changed, 27 insertions(+), 6 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6 0/3] bonding: Fix CVE-2026-43456
by Dong Chenchen 20 Jul '26

20 Jul '26

Fix CVE-2026-43456 Dong Chenchen (1): net: Fix kabi breakage of struct header_ops Eric Dumazet (1): bonding: prevent potential infinite loop in bond_header_parse() Jiayuan Chen (1): bonding: fix type confusion in bond_setup_by_slave() drivers/net/bonding/bond_main.c | 53 ++++++++++++++++++++++++++++++++- include/linux/netdevice.h | 15 +++++++--- 2 files changed, 63 insertions(+), 5 deletions(-) -- 2.25.1

2 4

[PATCH OLK-5.10] Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()
by Chen Jinghuang 20 Jul '26

20 Jul '26

From: Siwei Zhang <oss(a)fourdim.xyz> stable inclusion from stable-v5.10.259 commit 3634cbdc2eb414b69ffa752ddbe5e0458518e321 category: bugfix bugzilla: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 8c8e620467a7b51562dbcefbd1f09f288d7d710d ] l2cap_chan_close() removes the channel from conn->chan_l, which must be done under conn->lock. cleanup_listen() runs under the parent sk_lock, so acquiring conn->lock would invert the established conn->lock -> chan->lock -> sk_lock order. Instead of calling l2cap_chan_close() directly, schedule l2cap_chan_timeout with delay 0 to close the channel asynchronously. The timeout handler already acquires conn->lock and chan->lock in the correct order. The timer is only armed when chan->conn is still set: if it is already NULL, l2cap_conn_del() has already processed this channel (l2cap_chan_del + l2cap_sock_teardown_cb + l2cap_sock_close_cb), so there is nothing left to do. If l2cap_conn_del() races in after the timer is armed, __clear_chan_timer() inside l2cap_chan_del() cancels it; if the timer has already fired, the handler returns harmlessly because chan->conn was cleared. Fixes: 3df91ea20e74 ("Bluetooth: Revert to mutexes from RCU list") Cc: <stable(a)vger.kernel.org> # 0b58004: Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() Signed-off-by: Siwei Zhang <oss(a)fourdim.xyz> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- net/bluetooth/l2cap_sock.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c index 644ec4bf06f0..4b4a9268f007 100644 --- a/net/bluetooth/l2cap_sock.c +++ b/net/bluetooth/l2cap_sock.c @@ -1441,6 +1441,10 @@ static void l2cap_sock_cleanup_listen(struct sock *parent) * pin it (hold_unless_zero() additionally skips a chan already past * its last reference). We then drop the sk lock before taking * chan->lock, so sk and chan locks are never held together. + * + * Since we cannot call l2cap_chan_close() without conn->lock, + * schedule l2cap_chan_timeout to close the channel; it already + * acquires conn->lock -> chan->lock in the correct order. */ while ((sk = bt_accept_dequeue(parent, NULL))) { struct l2cap_chan *chan; @@ -1458,14 +1462,12 @@ static void l2cap_sock_cleanup_listen(struct sock *parent) state_to_string(chan->state)); l2cap_chan_lock(chan); - __clear_chan_timer(chan); - l2cap_chan_close(chan, ECONNRESET); - /* l2cap_conn_del() may already have killed this socket - * (it sets SOCK_DEAD); skip the duplicate to avoid a - * double sock_put()/l2cap_chan_put(). + /* Since we cannot call l2cap_chan_close() without + * conn->lock, schedule its timer to trigger the close + * and cleanup of this channel. */ - if (!sock_flag(sk, SOCK_DEAD)) - l2cap_sock_kill(sk); + if (chan->conn) + __set_chan_timer(chan, 0); l2cap_chan_unlock(chan); l2cap_chan_put(chan); -- 2.34.1

2 1

[PATCH OLK-5.10] ceph: fix a buffer leak in __ceph_setxattr()
by Pan Taixi 20 Jul '26

20 Jul '26

From: Viacheslav Dubeyko <Slava.Dubeyko(a)ibm.com> stable inclusion from stable-v5.10.258 commit 521e5aba857fd267624892c8dd6295f22ce0267e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15664 CVE: CVE-2026-52962 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 5d3cc36b4e77a27ce7b686b7c59c7072bcb3fa8e upstream. The old_blob in __ceph_setxattr() can store ci->i_xattrs.prealloc_blob value during the retry. However, it is never called the ceph_buffer_put() for the old_blob object. This patch fixes the issue of the buffer leak. Cc: stable(a)vger.kernel.org Signed-off-by: Viacheslav Dubeyko <Slava.Dubeyko(a)ibm.com> Reviewed-by: Alex Markuze <amarkuze(a)redhat.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lin Yujun <linyujun809(a)h-partners.com> Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com> --- fs/ceph/xattr.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/ceph/xattr.c b/fs/ceph/xattr.c index 76322c0f6e5f..d1fd81b1b541 100644 --- a/fs/ceph/xattr.c +++ b/fs/ceph/xattr.c @@ -1130,10 +1130,11 @@ int __ceph_setxattr(struct inode *inode, const char *name, ceph_free_cap_flush(prealloc_cf); return err; do_sync: spin_unlock(&ci->i_ceph_lock); + ceph_buffer_put(old_blob); do_sync_unlocked: if (lock_snap_rwsem) up_read(&mdsc->snap_rwsem); /* security module set xattr while filling trace */ -- 2.34.1

2 1

[PATCH OLK-6.6] bpf: Free reuseport cBPF prog after RCU grace period.
by superdcc97＠163.com 17 Jul '26

17 Jul '26

From: Kuniyuki Iwashima <kuniyu(a)google.com> stable inclusion from stable-v6.6.143 commit f8b8f1d4bb76098e87b8269a0631019648330e6d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15607 CVE: CVE-2026-52910 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 18fc650ccd7fe3376eca89203668cfb8268f60df ] Eulgyu Kim reported the splat below with a repro. [0] The repro sets up a UDP reuseport group with a cBPF prog and replaces it with a new one while another thread is sending a UDP packet to the group. The reuseport prog is freed by sk_reuseport_prog_free(). bpf_prog_put() is called for "e"BPF prog to destruct through multiple stages while cBPF prog is freed immediately by bpf_release_orig_filter() and bpf_prog_free(). If a reuseport prog is detached from the setsockopt() path (reuseport_attach_prog() or reuseport_detach_prog()), sk_reuseport_prog_free() is called without waiting for RCU readers to complete, resulting in various bugs. Let's defer freeing the reuseport cBPF prog after one RCU grace period. Note "e"BPF prog is safe as is unless the fast path starts to touch fields destroyed in bpf_prog_put_deferred() and __bpf_prog_put_noref(). [0]: BUG: KASAN: vmalloc-out-of-bounds in reuseport_select_sock+0xedc/0x1220 net/core/sock_reuseport.c:596 Read of size 4 at addr ffffc9000051e004 by task slowme/10208 CPU: 6 UID: 1000 PID: 10208 Comm: slowme Not tainted 7.0.0-geb7ac95ff75e #32 PREEMPT(full) Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: <IRQ> dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xca/0x240 mm/kasan/report.c:482 kasan_report+0x118/0x150 mm/kasan/report.c:595 reuseport_select_sock+0xedc/0x1220 net/core/sock_reuseport.c:596 udp4_lib_lookup2+0x3bc/0x950 net/ipv4/udp.c:495 __udp4_lib_lookup+0x768/0xe20 net/ipv4/udp.c:723 __udp4_lib_lookup_skb+0x297/0x390 net/ipv4/udp.c:752 __udp4_lib_rcv+0x1312/0x2620 net/ipv4/udp.c:2752 ip_protocol_deliver_rcu+0x282/0x440 net/ipv4/ip_input.c:207 ip_local_deliver_finish+0x3bb/0x6f0 net/ipv4/ip_input.c:241 NF_HOOK+0x30c/0x3a0 include/linux/netfilter.h:318 NF_HOOK+0x30c/0x3a0 include/linux/netfilter.h:318 __netif_receive_skb_one_core net/core/dev.c:6181 [inline] __netif_receive_skb net/core/dev.c:6294 [inline] process_backlog+0xaa4/0x1960 net/core/dev.c:6645 __napi_poll+0xae/0x340 net/core/dev.c:7709 napi_poll net/core/dev.c:7772 [inline] net_rx_action+0x5d7/0xf50 net/core/dev.c:7929 handle_softirqs+0x22b/0x870 kernel/softirq.c:622 do_softirq+0x76/0xd0 kernel/softirq.c:523 </IRQ> <TASK> __local_bh_enable_ip+0xf8/0x130 kernel/softirq.c:450 local_bh_enable include/linux/bottom_half.h:33 [inline] rcu_read_unlock_bh include/linux/rcupdate.h:924 [inline] __dev_queue_xmit+0x1dd7/0x3710 net/core/dev.c:4890 neigh_output include/net/neighbour.h:556 [inline] ip_finish_output2+0xca9/0x1070 net/ipv4/ip_output.c:237 NF_HOOK_COND include/linux/netfilter.h:307 [inline] ip_output+0x29f/0x450 net/ipv4/ip_output.c:438 ip_send_skb+0x45/0xc0 net/ipv4/ip_output.c:1508 udp_send_skb+0xb04/0x1510 net/ipv4/udp.c:1195 udp_sendmsg+0x1a71/0x2350 net/ipv4/udp.c:1485 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg net/socket.c:742 [inline] __sys_sendto+0x554/0x680 net/socket.c:2206 __do_sys_sendto net/socket.c:2213 [inline] __se_sys_sendto net/socket.c:2209 [inline] __x64_sys_sendto+0xde/0x100 net/socket.c:2209 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x160/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x415a2d Code: b3 66 2e 0f 1f 84 00 00 00 00 00 66 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f6bc31e41e8 EFLAGS: 00000212 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007f6bc31e4cdc RCX: 0000000000415a2d RDX: 0000000000000001 RSI: 00007f6bc31e421f RDI: 0000000000000003 RBP: 00007f6bc31e4240 R08: 00007f6bc31e4220 R09: 0000000000000010 R10: 0000000000000000 R11: 0000000000000212 R12: 00007f6bc31e46c0 R13: ffffffffffffffb8 R14: 0000000000000000 R15: 00007ffc9b0d70b0 </TASK> Fixes: 538950a1b752 ("soreuseport: setsockopt SO_ATTACH_REUSEPORT_[CE]BPF") Reported-by: Eulgyu Kim <eulgyukim(a)snu.ac.kr> Reported-by: Taeyang Lee <0wn(a)theori.io> Signed-off-by: Kuniyuki Iwashima <kuniyu(a)google.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Acked-by: Daniel Borkmann <daniel(a)iogearbox.net> Link: https://lore.kernel.org/bpf/20260426012647.3233119-1-kuniyu@google.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/core/filter.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/net/core/filter.c b/net/core/filter.c index 26b715a89e29..50839a1f6548 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -1643,15 +1643,24 @@ int sk_reuseport_attach_bpf(u32 ufd, struct sock *sk) return err; } +static void sk_reuseport_prog_free_rcu(struct rcu_head *rcu) +{ + struct bpf_prog_aux *aux = container_of(rcu, struct bpf_prog_aux, rcu); + struct bpf_prog *prog = aux->prog; + + bpf_release_orig_filter(prog); + bpf_prog_free(prog); +} + void sk_reuseport_prog_free(struct bpf_prog *prog) { if (!prog) return; - if (prog->type == BPF_PROG_TYPE_SK_REUSEPORT) - bpf_prog_put(prog); + if (bpf_prog_was_classic(prog)) + call_rcu(&prog->aux->rcu, sk_reuseport_prog_free_rcu); else - bpf_prog_destroy(prog); + bpf_prog_put(prog); } struct bpf_scratchpad { -- 2.43.0

2 1

[PATCH OLK-6.6] netfilter: nf_tables: use list_del_rcu for netlink hooks
by superdcc97＠163.com 17 Jul '26

17 Jul '26

From: Florian Westphal <fw(a)strlen.de> mainline inclusion from mainline-v7.1-rc2 commit f3224ee463f8f6f6ced7dcdf6081add4f8128527 ("netfilter: nf_tables: use list_del_rcu for netlink hooks") category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15588 CVE: CVE-2026-46324 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- nft_netdev_unregister_hooks and __nft_unregister_flowtable_net_hooks need to use list_del_rcu(), this list can be walked by concurrent dumpers. Add a new helper and use it consistently. Fixes: f9a43007d3f7 ("netfilter: nf_tables: double hook unregistration in netns path") Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/nf_tables_api.c [commit 73319a8ee18b ("netfilter: nf_tables: Have a list of nf_hook_ops in nft_hook") introduced the ops_list structure and __nft_netdev_hook_free_rcu() helper which are not present in OLK-6.6. Adapted to use the single hook->ops and existing kfree_rcu()-based nft_netdev_hook_free_rcu() helper instead.] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/nf_tables_api.c | 44 ++++++++++++++--------------------- 1 file changed, 18 insertions(+), 26 deletions(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 919be34ac7a0..34b837976900 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -333,6 +333,12 @@ static void nft_netdev_hook_free_rcu(struct nft_hook *hook) kfree_rcu(hook, rcu); } +static void nft_netdev_hook_unlink_free_rcu(struct nft_hook *hook) +{ + list_del_rcu(&hook->list); + nft_netdev_hook_free_rcu(hook); +} + static void nft_netdev_unregister_hooks(struct net *net, struct list_head *hook_list, bool release_netdev) @@ -341,10 +347,8 @@ static void nft_netdev_unregister_hooks(struct net *net, list_for_each_entry_safe(hook, next, hook_list, list) { nf_unregister_net_hook(net, &hook->ops); - if (release_netdev) { - list_del(&hook->list); - nft_netdev_hook_free_rcu(hook); - } + if (release_netdev) + nft_netdev_hook_unlink_free_rcu(hook); } } @@ -2106,10 +2110,8 @@ void nf_tables_chain_destroy(struct nft_chain *chain) if (nft_base_chain_netdev(table->family, basechain->ops.hooknum)) { list_for_each_entry_safe(hook, next, - &basechain->hook_list, list) { - list_del_rcu(&hook->list); - nft_netdev_hook_free_rcu(hook); - } + &basechain->hook_list, list) + nft_netdev_hook_unlink_free_rcu(hook); } module_put(basechain->type->owner); if (rcu_access_pointer(basechain->stats)) { @@ -2784,6 +2786,7 @@ static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy, list_for_each_entry_safe(h, next, &hook.list, list) { if (unregister) nf_unregister_net_hook(ctx->net, &h->ops); + /* hook.list is on stack, no need for list_del_rcu() */ list_del(&h->list); nft_netdev_hook_free_rcu(h); } @@ -8495,10 +8498,8 @@ static void __nft_unregister_flowtable_net_hooks(struct net *net, nf_unregister_net_hook(net, &hook->ops); flowtable->data.type->setup(&flowtable->data, hook->ops.dev, FLOW_BLOCK_UNBIND); - if (release_netdev) { - list_del(&hook->list); - nft_netdev_hook_free_rcu(hook); - } + if (release_netdev) + nft_netdev_hook_unlink_free_rcu(hook); } } @@ -8557,8 +8558,7 @@ static int nft_register_flowtable_net_hooks(struct net *net, break; nft_unregister_flowtable_hook(net, flowtable, hook); - list_del_rcu(&hook->list); - nft_netdev_hook_free_rcu(hook); + nft_netdev_hook_unlink_free_rcu(hook); } return err; @@ -8568,10 +8568,8 @@ static void nft_hooks_destroy(struct list_head *hook_list) { struct nft_hook *hook, *next; - list_for_each_entry_safe(hook, next, hook_list, list) { - list_del_rcu(&hook->list); - nft_netdev_hook_free_rcu(hook); - } + list_for_each_entry_safe(hook, next, hook_list, list) + nft_netdev_hook_unlink_free_rcu(hook); } static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh, @@ -8655,8 +8653,7 @@ static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh, list_for_each_entry_safe(hook, next, &flowtable_hook.list, list) { if (unregister) nft_unregister_flowtable_hook(ctx->net, flowtable, hook); - list_del_rcu(&hook->list); - nft_netdev_hook_free_rcu(hook); + nft_netdev_hook_unlink_free_rcu(hook); } return err; @@ -9149,13 +9146,8 @@ static void nf_tables_flowtable_notify(struct nft_ctx *ctx, static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable) { - struct nft_hook *hook, *next; - flowtable->data.type->free(&flowtable->data); - list_for_each_entry_safe(hook, next, &flowtable->hook_list, list) { - list_del_rcu(&hook->list); - nft_netdev_hook_free_rcu(hook); - } + nft_hooks_destroy(&flowtable->hook_list); kfree(flowtable->name); module_put(flowtable->data.type->owner); kfree(flowtable); -- 2.43.0

2 1

[PATCH OLK-6.6 0/2] net: Fix CVE-2026-45905 ip_rt_bug race in ICMP reverse path
by superdcc97＠163.com 17 Jul '26

17 Jul '26

From: Dong Chenchen <dongchenchen2(a)huawei.com> net: Fix CVE-2026-45905 ip_rt_bug race in ICMP reverse path This patch series fixes CVE-2026-45905 in the OLK-6.6 branch. * Patch 1: Switch icmp_route_lookup and ip_options_rcv_srr to use skb_dstref_steal/skb_dstref_restore helpers (dependency for CVE fix) * Patch 2: Fix ip_rt_bug race condition in icmp_route_lookup reverse path by checking rt2->rt_type after ip_route_input() for RTN_LOCAL Jiayuan Chen (1): xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path Stanislav Fomichev (1): net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers net/ipv4/icmp.c | 22 +++++++++++++++++++--- net/ipv4/ip_options.c | 5 ++--- 2 files changed, 21 insertions(+), 6 deletions(-) -- 2.43.0

2 3

[PATCH OLK-6.6] udp: clear skb->dev before running a sockmap verdict
by superdcc97＠163.com 17 Jul '26

17 Jul '26

From: Sechang Lim <rhkrqnwk98(a)gmail.com> stable inclusion from stable-v6.6.143 commit 1b585673a2249f13678e7ac443ac683ba767e0b6 category: bugfix CVE: CVE-2026-53184 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 3c94f241f776562c489876ff506f366224565c21 upstream. On the UDP receive path skb->dev is repurposed as dev_scratch (the truesize/state cache set by udp_set_dev_scratch()), through the union { struct net_device *dev; unsigned long dev_scratch; } in sk_buff. When a UDP socket is in a sockmap, sk_data_ready is sk_psock_verdict_data_ready(), which calls udp_read_skb() -> recv_actor() (sk_psock_verdict_recv) to run the attached SK_SKB verdict program in softirq. If that program calls a socket-lookup helper (bpf_sk_lookup_tcp/udp, bpf_skc_lookup_tcp), bpf_skc_lookup() does: if (skb->dev) caller_net = dev_net(skb->dev); skb->dev still holds the dev_scratch value (a non-NULL integer), so dev_net() dereferences it as a struct net_device * and the kernel takes a general protection fault on a non-canonical address in softirq: Oops: general protection fault, probably for non-canonical address 0x1010000800004a0 CPU: 1 UID: 0 PID: 1406 Comm: syz.2.19 Not tainted 7.1.0-rc6 #1 PREEMPT(full) RIP: 0010:bpf_skc_lookup net/core/filter.c:7033 [inline] RIP: 0010:bpf_sk_lookup+0x45/0x160 net/core/filter.c:7047 Call Trace: <IRQ> bpf_prog_4675cb904b7071f8+0x12e/0x14e bpf_prog_run_pin_on_cpu+0xc6/0x1f0 sk_psock_verdict_recv+0x1ba/0x350 udp_read_skb+0x31a/0x370 sk_psock_verdict_data_ready+0x2e3/0x600 __udp_enqueue_schedule_skb+0x4c8/0x650 udpv6_queue_rcv_one_skb+0x3ec/0x740 udp6_unicast_rcv_skb+0x11d/0x140 ip6_protocol_deliver_rcu+0x61e/0x950 ip6_input_finish+0xa9/0x150 NF_HOOK+0x286/0x2f0 ip6_input+0x117/0x220 NF_HOOK+0x286/0x2f0 __netif_receive_skb+0x85/0x200 process_backlog+0x374/0x9a0 __napi_poll+0x4f/0x1c0 net_rx_action+0x3b0/0x770 handle_softirqs+0x15a/0x460 do_softirq+0x57/0x80 </IRQ> The rmem charge that dev_scratch accounted for is released by skb_recv_udp() on dequeue, just above, so the scratch is dead by the time recv_actor() runs. Clear skb->dev so bpf_skc_lookup() falls back to sock_net(skb->sk), which skb_set_owner_sk_safe() set just above. Fixes: 965b57b469a5 ("net: Introduce a new proto_ops ->read_skb()") Cc: stable(a)vger.kernel.org Signed-off-by: Sechang Lim <rhkrqnwk98(a)gmail.com> Reviewed-by: Jiayuan Chen <jiayuan.chen(a)linux.dev> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20260603162737.697215-1-rhkrqnwk98@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Co-Authored-By: CVE-Agent@kimi-for-coding Signed-off-by: Hulk Robot <hulkrobot(a)huawei.com> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ipv4/udp.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c index 52e6bf0d1b41..abfebac00f2c 100644 --- a/net/ipv4/udp.c +++ b/net/ipv4/udp.c @@ -1859,6 +1859,14 @@ int udp_read_skb(struct sock *sk, skb_read_actor_t recv_actor) } WARN_ON_ONCE(!skb_set_owner_sk_safe(skb, sk)); + + /* + * skb->dev still aliases the UDP rx dev_scratch (its charge was freed + * on dequeue above); a sockmap verdict program may deref it via + * bpf_sk_lookup_*(), so clear it -> bpf_skc_lookup() uses skb->sk + */ + skb->dev = NULL; + return recv_actor(sk, skb); } EXPORT_SYMBOL(udp_read_skb); -- 2.43.0

2 1

[PATCH OLK-6.6] netfilter: nft_fib: fix stale stack leak via the OIFNAME register
by superdcc97＠163.com 17 Jul '26

17 Jul '26

From: Davide Ornaghi <d.ornaghi97(a)gmail.com> stable inclusion from stable-v6.6.143 commit eb8a8124484dbc3c2b543e207da39bbccb703d31 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15828 CVE: CVE-2026-53134 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ab185e0c4fb82dfba6fb86f8271e06f931d9c64c ] For NFT_FIB_RESULT_OIFNAME the destination register is declared with len = IFNAMSIZ (four 32-bit registers), but on the lookup-fail, RTN_LOCAL and oif-mismatch paths nft_fib{4,6}_eval() only writes one register via "*dest = 0". The remaining three registers are left as whatever was on the stack in nft_do_chain()'s struct nft_regs, and a downstream expression that loads the register span can leak that uninitialised kernel stack to userspace. The NFTA_FIB_F_PRESENT existence check has the same shape: it is only meaningful for NFT_FIB_RESULT_OIF, yet it was accepted for any result type while the eval stores a single byte via nft_reg_store8(), leaving the rest of the declared span stale. Fix both: - replace the bare "*dest = 0" in the eval with nft_fib_store_result(), which strscpy_pad()s the whole IFNAMSIZ for OIFNAME (and is already used on the other early-return path), and - restrict NFTA_FIB_F_PRESENT to NFT_FIB_RESULT_OIF and declare its destination as a single u8, so the marked span matches the one byte the eval writes. Fixes: f6d0cbcf09c5 ("netfilter: nf_tables: add fib expression") Suggested-by: Florian Westphal <fw(a)strlen.de> Cc: stable(a)vger.kernel.org Signed-off-by: Davide Ornaghi <d.ornaghi97(a)gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> [ kept the tree's existing `ip6_route_lookup`/`rt6_info` machinery (missing `fib6_lookup` refactor) and changed only `*dest = 0;` to `nft_fib_store_result(dest, priv, NULL)` ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ipv4/netfilter/nft_fib_ipv4.c | 2 +- net/ipv6/netfilter/nft_fib_ipv6.c | 2 +- net/netfilter/nft_fib.c | 6 ++++++ 3 files changed, 8 insertions(+), 2 deletions(-) diff --git a/net/ipv4/netfilter/nft_fib_ipv4.c b/net/ipv4/netfilter/nft_fib_ipv4.c index ba233fdd8188..94931d52048f 100644 --- a/net/ipv4/netfilter/nft_fib_ipv4.c +++ b/net/ipv4/netfilter/nft_fib_ipv4.c @@ -122,7 +122,7 @@ void nft_fib4_eval(const struct nft_expr *expr, struct nft_regs *regs, fl4.saddr = get_saddr(iph->daddr); } - *dest = 0; + nft_fib_store_result(dest, priv, NULL); if (fib_lookup(nft_net(pkt), &fl4, &res, FIB_LOOKUP_IGNORE_LINKSTATE)) return; diff --git a/net/ipv6/netfilter/nft_fib_ipv6.c b/net/ipv6/netfilter/nft_fib_ipv6.c index a89ce0fbfe4b..da4a35c20f10 100644 --- a/net/ipv6/netfilter/nft_fib_ipv6.c +++ b/net/ipv6/netfilter/nft_fib_ipv6.c @@ -193,7 +193,7 @@ void nft_fib6_eval(const struct nft_expr *expr, struct nft_regs *regs, } } - *dest = 0; + nft_fib_store_result(dest, priv, NULL); rt = (void *)ip6_route_lookup(nft_net(pkt), &fl6, pkt->skb, lookup_flags); if (rt->dst.error) diff --git a/net/netfilter/nft_fib.c b/net/netfilter/nft_fib.c index 507b7eba9bcd..b4f49f65fc42 100644 --- a/net/netfilter/nft_fib.c +++ b/net/netfilter/nft_fib.c @@ -107,6 +107,12 @@ int nft_fib_init(const struct nft_ctx *ctx, const struct nft_expr *expr, return -EINVAL; } + if (priv->flags & NFTA_FIB_F_PRESENT) { + if (priv->result != NFT_FIB_RESULT_OIF) + return -EINVAL; + len = sizeof(u8); + } + err = nft_parse_register_store(ctx, tb[NFTA_FIB_DREG], &priv->dreg, NULL, NFT_DATA_VALUE, len); if (err < 0) -- 2.43.0

2 1

[PATCH OLK-5.10] ocfs2: validate bg_bits during freefrag scan
by Long Li 17 Jul '26

17 Jul '26

From: ZhengYuan Huang <gality369(a)gmail.com> stable inclusion from stable-v5.10.257 commit bb2906a1065ec28de021bac2ed03f2624edd7d07 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15742 CVE: CVE-2026-53040 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 8f687eeed3da3012152b0f9473f578869de0cd7b ] [BUG] A crafted filesystem can trigger an out-of-bounds bitmap walk when OCFS2_IOC_INFO is issued with OCFS2_INFO_FL_NON_COHERENT. BUG: KASAN: use-after-free in instrument_atomic_read include/linux/instrumented.h:68 [inline] BUG: KASAN: use-after-free in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] BUG: KASAN: use-after-free in test_bit_le include/asm-generic/bitops/le.h:21 [inline] BUG: KASAN: use-after-free in ocfs2_info_freefrag_scan_chain fs/ocfs2/ioctl.c:495 [inline] BUG: KASAN: use-after-free in ocfs2_info_freefrag_scan_bitmap fs/ocfs2/ioctl.c:588 [inline] BUG: KASAN: use-after-free in ocfs2_info_handle_freefrag fs/ocfs2/ioctl.c:662 [inline] BUG: KASAN: use-after-free in ocfs2_info_handle_request+0x1c66/0x3370 fs/ocfs2/ioctl.c:754 Read of size 8 at addr ffff888031bce000 by task syz.0.636/1435 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0xbe/0x130 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xd1/0x650 mm/kasan/report.c:482 kasan_report+0xfb/0x140 mm/kasan/report.c:595 check_region_inline mm/kasan/generic.c:186 [inline] kasan_check_range+0x11c/0x200 mm/kasan/generic.c:200 __kasan_check_read+0x11/0x20 mm/kasan/shadow.c:31 instrument_atomic_read include/linux/instrumented.h:68 [inline] _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] test_bit_le include/asm-generic/bitops/le.h:21 [inline] ocfs2_info_freefrag_scan_chain fs/ocfs2/ioctl.c:495 [inline] ocfs2_info_freefrag_scan_bitmap fs/ocfs2/ioctl.c:588 [inline] ocfs2_info_handle_freefrag fs/ocfs2/ioctl.c:662 [inline] ocfs2_info_handle_request+0x1c66/0x3370 fs/ocfs2/ioctl.c:754 ocfs2_info_handle+0x18d/0x2a0 fs/ocfs2/ioctl.c:828 ocfs2_ioctl+0x632/0x6e0 fs/ocfs2/ioctl.c:913 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x197/0x1e0 fs/ioctl.c:583 ... [CAUSE] ocfs2_info_freefrag_scan_chain() uses on-disk bg_bits directly as the bitmap scan limit. The coherent path reads group descriptors through ocfs2_read_group_descriptor(), which validates the descriptor before use. The non-coherent path uses ocfs2_read_blocks_sync() instead and skips that validation, so an impossible bg_bits value can drive the bitmap walk past the end of the block. [FIX] Compute the bitmap capacity from the filesystem format with ocfs2_group_bitmap_size(), report descriptors whose bg_bits exceeds that limit, and clamp the scan to the computed capacity. This keeps the freefrag report going while avoiding reads beyond the buffer. Link: https://lkml.kernel.org/r/20260410034220.3825769-1-gality369@gmail.com Fixes: d24a10b9f8ed ("Ocfs2: Add a new code 'OCFS2_INFO_FREEFRAG' for o2info ioctl.") Signed-off-by: ZhengYuan Huang <gality369(a)gmail.com> Reviewed-by: Heming Zhao <heming.zhao(a)suse.com> Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Jun Piao <piaojun(a)huawei.com> Cc: Heming Zhao <heming.zhao(a)suse.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/ocfs2/ioctl.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/fs/ocfs2/ioctl.c b/fs/ocfs2/ioctl.c index 89984172fc4a..b43d6c3586e0 100644 --- a/fs/ocfs2/ioctl.c +++ b/fs/ocfs2/ioctl.c @@ -438,13 +438,16 @@ static int ocfs2_info_freefrag_scan_chain(struct ocfs2_super *osb, struct buffer_head *bh = NULL; struct ocfs2_group_desc *bg = NULL; - unsigned int max_bits, num_clusters; + unsigned int max_bits, max_bitmap_bits, num_clusters; unsigned int offset = 0, cluster, chunk; unsigned int chunk_free, last_chunksize = 0; if (!le32_to_cpu(rec->c_free)) goto bail; + max_bitmap_bits = 8 * ocfs2_group_bitmap_size(osb->sb, 0, + osb->s_feature_incompat); + do { if (!bg) blkno = le64_to_cpu(rec->c_blkno); @@ -476,6 +479,19 @@ static int ocfs2_info_freefrag_scan_chain(struct ocfs2_super *osb, continue; max_bits = le16_to_cpu(bg->bg_bits); + + /* + * Non-coherent scans read raw blocks and do not get the + * bg_bits validation from + * ocfs2_read_group_descriptor(). + */ + if (max_bits > max_bitmap_bits) { + mlog(ML_ERROR, + "Group desc #%llu has %u bits, max bitmap bits %u\n", + (unsigned long long)blkno, max_bits, max_bitmap_bits); + max_bits = max_bitmap_bits; + } + offset = 0; for (chunk = 0; chunk < chunks_in_group; chunk++) { -- 2.52.0

2 1

[PATCH OLK-5.10] isofs: validate Rock Ridge CE continuation extent against volume size
by Long Li 17 Jul '26

17 Jul '26

From: Michael Bommarito <michael.bommarito(a)gmail.com> mainline inclusion from mainline-v7.0 commit a36d990f591320e9dd379ab30063ebfe91d47e1f category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15613 CVE: CVE-2026-46303 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- rock_continue() reads rs->cont_extent verbatim from the Rock Ridge CE record and passes it to sb_bread() without checking that the block number is within the mounted ISO 9660 volume. commit e595447e177b ("[PATCH] rock.c: handle corrupted directories") added cont_offset and cont_size rejection for the CE continuation but did not validate the extent block number itself. commit f54e18f1b831 ("isofs: Fix infinite looping over CE entries") later capped the CE chain length at RR_MAX_CE_ENTRIES = 32 but again left the block number unchecked. With a crafted ISO mounted via udisks2 (desktop optical auto-mount) or via CAP_SYS_ADMIN mount, rs->cont_extent can therefore point at an out-of-range block or at blocks belonging to an adjacent filesystem on the same block device. sb_bread() on an out-of-range block returns NULL cleanly via the block layer EIO path, so there is no memory-safety violation. For in-range reads of adjacent- filesystem data, the CE buffer is parsed as Rock Ridge records and only the text of SL sub-records reaches userspace through readlink(), which makes the info-leak channel narrow and difficult to exploit; still, rejecting the malformed CE outright matches the rejection shape already present in the same function for cont_offset and cont_size. Add an ISOFS_SB(sb)->s_nzones bounds check to rock_continue() next to the existing offset/size rejection, printing the same corrupted-directory-entry notice. Fixes: f54e18f1b831 ("isofs: Fix infinite looping over CE entries") Cc: stable(a)vger.kernel.org Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Link: https://patch.msgid.link/20260419212155.2169382-2-michael.bommarito@gmail.c… Signed-off-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/isofs/rock.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/fs/isofs/rock.c b/fs/isofs/rock.c index 94ef92fe806c..1efa3ae2f41e 100644 --- a/fs/isofs/rock.c +++ b/fs/isofs/rock.c @@ -101,6 +101,15 @@ static int rock_continue(struct rock_state *rs) goto out; } + if ((unsigned)rs->cont_extent >= ISOFS_SB(rs->inode->i_sb)->s_nzones) { + printk(KERN_NOTICE "rock: corrupted directory entry. " + "extent=%u out of volume (nzones=%lu)\n", + (unsigned)rs->cont_extent, + ISOFS_SB(rs->inode->i_sb)->s_nzones); + ret = -EIO; + goto out; + } + if (rs->cont_extent) { struct buffer_head *bh; -- 2.52.0

2 1

[PATCH OLK-5.10] sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks
by Jinjiang Tu 16 Jul '26

16 Jul '26

From: Michael Bommarito <michael.bommarito(a)gmail.com> stable inclusion from stable-v5.10.258 commit a132e199de69e2a45628aa8534df1bf5d44e1b6e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15706 CVE: CVE-2026-53004 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 0cf004ffb61cd32d140531c3a84afe975f9fc7ea ] sctp_getsockopt_peer_auth_chunks() checks that the caller's optval buffer is large enough for the peer AUTH chunk list with if (len < num_chunks) return -EINVAL; but then writes num_chunks bytes to p->gauth_chunks, which lives at offset offsetof(struct sctp_authchunks, gauth_chunks) == 8 inside optval. The check is missing the sizeof(struct sctp_authchunks) = 8-byte header. When the caller supplies len == num_chunks (for any num_chunks > 0) the test passes but copy_to_user() writes sizeof(struct sctp_authchunks) = 8 bytes past the declared buffer. The sibling function sctp_getsockopt_local_auth_chunks() at the next line already has the correct check: if (len < sizeof(struct sctp_authchunks) + num_chunks) return -EINVAL; Align the peer variant with its sibling. Reproducer confirms on v7.0-13-generic: an unprivileged userspace caller that opens a loopback SCTP association with AUTH enabled, queries num_chunks with a short optval, then issues the real getsockopt with len == num_chunks and sentinel bytes painted past the buffer observes those sentinel bytes overwritten with the peer's AUTH chunk type. The bytes written are under the peer's control but land in the caller's own userspace; this is not a kernel memory corruption, but it is a kernel-side contract violation that can silently corrupt adjacent userspace data. Fixes: 65b07e5d0d09 ("[SCTP]: API updates to suport SCTP-AUTH extensions.") Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Acked-by: Xin Long <lucien.xin(a)gmail.com> Link: https://patch.msgid.link/20260416031903.1447072-1-michael.bommarito@gmail.c… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- net/sctp/socket.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/sctp/socket.c b/net/sctp/socket.c index 279d5e9421d3..e20aa4dbf740 100644 --- a/net/sctp/socket.c +++ b/net/sctp/socket.c @@ -6863,7 +6863,7 @@ static int sctp_getsockopt_peer_auth_chunks(struct sock *sk, int len, /* See if the user provided enough room for all the data */ num_chunks = ntohs(ch->param_hdr.length) - sizeof(struct sctp_paramhdr); - if (len < num_chunks) + if (len < sizeof(struct sctp_authchunks) + num_chunks) return -EINVAL; if (copy_to_user(to, ch->chunks, num_chunks)) -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS 0/2] CVE-2025-10263
by Lin Yujun 16 Jul '26

16 Jul '26

*** BLURB HERE *** Lin Yujun (2): arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU arm64/openeuler_defconfig: add CONFIG_NVIDIA_OLYMPUS_ERRATUM_TLBI to openeuler_defconfig Documentation/arm64/silicon-errata.txt | 2 ++ arch/arm64/Kconfig | 15 +++++++++++++++ arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/cputype.h | 2 ++ arch/arm64/kernel/cpu_errata.c | 7 +++++++ 5 files changed, 27 insertions(+) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU
by Lin Yujun 16 Jul '26

16 Jul '26

mainline inclusion from mainline-v7.1 commit ec7216f92e4ebd485b1c6dc6aa3f6064b71a5768 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15600 CVE: CVE-2025-10263 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- NVIDIA Olympus cores are affected by the TLBI completion issue tracked as CVE-2025-10263. The existing ARM64_ERRATUM_4118414 handling already uses ARM64_WORKAROUND_REPEAT_TLBI to issue an additional broadcast TLBI;DSB sequence and ensure affected memory write effects are globally observed. Add MIDR_NVIDIA_OLYMPUS to the repeat-TLBI match list so the same mitigation is enabled on affected Olympus systems. Also document the NVIDIA Olympus erratum in the arm64 silicon errata table and list it in the Kconfig help text. [linyujun: 4.19 does not have ARM64_ERRATUM_4118414 or the arm64_repeat_tlbi_list[] array. Adapt using the existing per-vendor config pattern (same as QCOM_FALKOR_ERRATUM_1009) with ERRATA_MIDR_ALL_VERSIONS.] Signed-off-by: Shanker Donthineni <sdonthineni(a)nvidia.com> Acked-by: Mark Rutland <mark.rutland(a)arm.com> Signed-off-by: Will Deacon <will(a)kernel.org> Conflicts: Documentation/arm64/silicon-errata.txt arch/arm64/Kconfig arch/arm64/include/asm/cputype.h arch/arm64/kernel/cpu_errata.c [主线高版本有 ARM64_ERRATUM_4118414 通用配置和 arm64_repeat_tlbi_list[] 数组， 4.19上是每个厂商各自一个独立 Kconfig 选项（QCOM_FALKOR_ERRATUM_1009 模式）。所以这个补丁需要手动适配，按这个模式新增了NVIDIA_OLYMPUS_ERRATUM_TLBI, 并且新增对应的CPU ID 定义。] Signed-off-by: Lin Yujun <linyujun809(a)h-partners.com> --- Documentation/arm64/silicon-errata.txt | 2 ++ arch/arm64/Kconfig | 15 +++++++++++++++ arch/arm64/include/asm/cputype.h | 2 ++ arch/arm64/kernel/cpu_errata.c | 7 +++++++ 4 files changed, 26 insertions(+) diff --git a/Documentation/arm64/silicon-errata.txt b/Documentation/arm64/silicon-errata.txt index 5016158f5e67..430c0dfbeca1 100644 --- a/Documentation/arm64/silicon-errata.txt +++ b/Documentation/arm64/silicon-errata.txt @@ -82,5 +82,7 @@ stable kernels. | | | | | | Qualcomm Tech. | Kryo/Falkor v1 | E1003 | QCOM_FALKOR_ERRATUM_1003 | | Qualcomm Tech. | Falkor v1 | E1009 | QCOM_FALKOR_ERRATUM_1009 | | Qualcomm Tech. | QDF2400 ITS | E0065 | QCOM_QDF2400_ERRATUM_0065 | | Qualcomm Tech. | Falkor v{1,2} | E1041 | QCOM_FALKOR_ERRATUM_1041 | +| | | | | +| NVIDIA | Olympus Core | T410-OLY-1029 | NVIDIA_OLYMPUS_ERRATUM_TLBI | diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index 6498279140fc..3951b0cc8134 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -615,10 +615,25 @@ config QCOM_FALKOR_ERRATUM_1009 TLBI xxIS invalidate maintenance operation. Repeat the TLBI operation one more time to fix the issue. If unsure, say Y. +config NVIDIA_OLYMPUS_ERRATUM_TLBI + bool "NVIDIA Olympus: Completion of affected memory accesses might not be guaranteed by completion of a TLBI" + default y + select ARM64_WORKAROUND_REPEAT_TLBI + help + On NVIDIA Olympus CPU, the completion of a broadcast TLB + invalidation might not guarantee that the memory accesses + expected to be affected by it have completed. Work around + this by issuing an additional broadcast TLBI followed by DSB. + + This is erratum T410-OLY-1029 on the NVIDIA Olympus CPU, + also known as CVE-2025-10263. + + If unsure, say Y. + config QCOM_QDF2400_ERRATUM_0065 bool "QDF2400 E0065: Incorrect GITS_TYPER.ITT_Entry_size" default y help On Qualcomm Datacenter Technologies QDF2400 SoC, ITS hardware reports diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h index bdec50291017..c18e48628509 100644 --- a/arch/arm64/include/asm/cputype.h +++ b/arch/arm64/include/asm/cputype.h @@ -100,10 +100,11 @@ #define QCOM_CPU_PART_FALKOR 0xC00 #define QCOM_CPU_PART_KRYO 0x200 #define NVIDIA_CPU_PART_DENVER 0x003 #define NVIDIA_CPU_PART_CARMEL 0x004 +#define NVIDIA_CPU_PART_OLYMPUS 0x010 #define HISI_CPU_PART_TSV110 0xD01 #define HISI_CPU_PART_TSV200 0xD02 #define PHYTIUM_CPU_PART_1500A 0X660 @@ -135,10 +136,11 @@ #define MIDR_QCOM_FALKOR_V1 MIDR_CPU_MODEL(ARM_CPU_IMP_QCOM, QCOM_CPU_PART_FALKOR_V1) #define MIDR_QCOM_FALKOR MIDR_CPU_MODEL(ARM_CPU_IMP_QCOM, QCOM_CPU_PART_FALKOR) #define MIDR_QCOM_KRYO MIDR_CPU_MODEL(ARM_CPU_IMP_QCOM, QCOM_CPU_PART_KRYO) #define MIDR_NVIDIA_DENVER MIDR_CPU_MODEL(ARM_CPU_IMP_NVIDIA, NVIDIA_CPU_PART_DENVER) #define MIDR_NVIDIA_CARMEL MIDR_CPU_MODEL(ARM_CPU_IMP_NVIDIA, NVIDIA_CPU_PART_CARMEL) +#define MIDR_NVIDIA_OLYMPUS MIDR_CPU_MODEL(ARM_CPU_IMP_NVIDIA, NVIDIA_CPU_PART_OLYMPUS) #define MIDR_HISI_TSV110 MIDR_CPU_MODEL(ARM_CPU_IMP_HISI, HISI_CPU_PART_TSV110) #define MIDR_HISI_TSV200 MIDR_CPU_MODEL(ARM_CPU_IMP_HISI, HISI_CPU_PART_TSV200) #define MIDR_FT_1500A MIDR_CPU_MODEL(ARM_CPU_IMP_PHYTIUM, PHYTIUM_CPU_PART_1500A) #define MIDR_FT_2000AHK MIDR_CPU_MODEL(ARM_CPU_IMP_PHYTIUM, PHYTIUM_CPU_PART_2000AHK) #define MIDR_FT_2000PLUS MIDR_CPU_MODEL(ARM_CPU_IMP_PHYTIUM, PHYTIUM_CPU_PART_2000PLUS) diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c index 3b911e8964a7..9ba8cb0e1824 100644 --- a/arch/arm64/kernel/cpu_errata.c +++ b/arch/arm64/kernel/cpu_errata.c @@ -924,10 +924,17 @@ const struct arm64_cpu_capabilities arm64_errata[] = { .desc = "Qualcomm Technologies Falkor erratum 1009", .capability = ARM64_WORKAROUND_REPEAT_TLBI, ERRATA_MIDR_REV(MIDR_QCOM_FALKOR_V1, 0, 0), }, #endif +#ifdef CONFIG_NVIDIA_OLYMPUS_ERRATUM_TLBI + { + .desc = "NVIDIA Olympus erratum T410-OLY-1029", + .capability = ARM64_WORKAROUND_REPEAT_TLBI, + ERRATA_MIDR_ALL_VERSIONS(MIDR_NVIDIA_OLYMPUS), + }, +#endif #ifdef CONFIG_ARM64_ERRATUM_858921 { /* Cortex-A73 all versions */ .desc = "ARM erratum 858921", .capability = ARM64_WORKAROUND_858921, -- 2.34.1

2 1

[PATCH OLK-5.10] ice: fix double-free of tx_buf skb
by Tengda Wu 16 Jul '26

16 Jul '26

From: Michal Schmidt <mschmidt(a)redhat.com> mainline inclusion from mainline-v7.1-rc1 commit 1a303baa715e6b78d6a406aaf335f87ff35acfcd category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15711 CVE: CVE-2026-53009 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If ice_tso() or ice_tx_csum() fail, the error path in ice_xmit_frame_ring() frees the skb, but the 'first' tx_buf still points to it and is marked as valid (ICE_TX_BUF_SKB). 'next_to_use' remains unchanged, so the potential problem will likely fix itself when the next packet is transmitted and the tx_buf gets overwritten. But if there is no next packet and the interface is brought down instead, ice_clean_tx_ring() -> ice_unmap_and_free_tx_buf() will find the tx_buf and free the skb for the second time. The fix is to reset the tx_buf type to ICE_TX_BUF_EMPTY in the error path, so that ice_unmap_and_free_tx_buf(). Move the initialization of 'first' up, to ensure it's already valid in case we hit the linearization error path. The bug was spotted by AI while I had it looking for something else. It also proposed an initial version of the patch. I reproduced the bug and tested the fix by adding code to inject failures, on a build with KASAN. I looked for similar bugs in related Intel drivers and did not find any. Fixes: d76a60ba7afb ("ice: Add support for VLANs and offloads") Assisted-by: Claude:claude-4.6-opus-high Cursor Signed-off-by: Michal Schmidt <mschmidt(a)redhat.com> Signed-off-by: Jacob Keller <jacob.e.keller(a)intel.com> Link: https://patch.msgid.link/20260416-iwl-net-submission-2026-04-14-v2-4-686c33… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: drivers/net/ethernet/intel/ice/ice_txrx.c [commit aa1d3faf71a6 ("ice: Robustify cleaning/completing XDP Tx buffers") is not merged yet, so the `type` field doesn't exist in struct ice_tx_buf. Instead of introducing the `type` field via commit aa1d3faf71a6, just set skb to NULL to prevent double-free.] Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- drivers/net/ethernet/intel/ice/ice_txrx.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/intel/ice/ice_txrx.c b/drivers/net/ethernet/intel/ice/ice_txrx.c index 0fc891861a10..779881dfcce9 100644 --- a/drivers/net/ethernet/intel/ice/ice_txrx.c +++ b/drivers/net/ethernet/intel/ice/ice_txrx.c @@ -2369,6 +2369,9 @@ ice_xmit_frame_ring(struct sk_buff *skb, struct ice_ring *tx_ring) unsigned int count; int tso, csum; + /* record the location of the first descriptor for this packet */ + first = &tx_ring->tx_buf[tx_ring->next_to_use]; + count = ice_xmit_desc_count(skb); if (ice_chk_linearize(skb, count)) { if (__skb_linearize(skb)) @@ -2391,8 +2394,6 @@ ice_xmit_frame_ring(struct sk_buff *skb, struct ice_ring *tx_ring) offload.tx_ring = tx_ring; - /* record the location of the first descriptor for this packet */ - first = &tx_ring->tx_buf[tx_ring->next_to_use]; first->skb = skb; first->bytecount = max_t(unsigned int, skb->len, ETH_ZLEN); first->gso_segs = 1; @@ -2442,6 +2443,7 @@ ice_xmit_frame_ring(struct sk_buff *skb, struct ice_ring *tx_ring) out_drop: dev_kfree_skb_any(skb); + first->skb = NULL; return NETDEV_TX_OK; } -- 2.34.1

2 1

[PATCH OLK-5.10] IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
by Xia Fukun 15 Jul '26

15 Jul '26

From: Michael Bommarito <michael.bommarito(a)gmail.com> stable inclusion from stable-v5.10.259 commit 75ee6e4aa096aa9e7b2dd5c8ff98356e30aceefb category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15861 CVE: CVE-2026-53176 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 29e7b925ae6df64894e82ab6419994dc25580a8a upstream. In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added. Fixes: b8d26b3be8b3 ("iser-target: Add iSCSI Extensions for RDMA (iSER) target driver") Link: https://patch.msgid.link/r/20260602194642.2273217-1-michael.bommarito@gmail… Cc: stable(a)vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lin Yujun <linyujun809(a)h-partners.com> Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- drivers/infiniband/ulp/isert/ib_isert.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c index ed375f517e8a..9f8d6113efb4 100644 --- a/drivers/infiniband/ulp/isert/ib_isert.c +++ b/drivers/infiniband/ulp/isert/ib_isert.c @@ -1388,6 +1388,12 @@ isert_login_recv_done(struct ib_cq *cq, struct ib_wc *wc) ib_dma_sync_single_for_cpu(ib_dev, isert_conn->login_desc->dma_addr, ISER_RX_SIZE, DMA_FROM_DEVICE); + if (unlikely(wc->byte_len < ISER_HEADERS_LEN)) { + isert_dbg("login request length %u is too short\n", + wc->byte_len); + return; + } + isert_conn->login_req_len = wc->byte_len - ISER_HEADERS_LEN; if (isert_conn->conn) { -- 2.34.1

2 1

[PATCH OLK-6.6 0/3] fix CVE-2026-53132
by Jinjiang Tu 15 Jul '26

15 Jul '26

Eric Dumazet (1): vsock/virtio: fix potential unbounded skb queue Stefano Garzarella (2): vsock/virtio: fix skb overhead accounting to preserve full buf_alloc vsock/virtio: reset connection on receiving queue overflow net/vmw_vsock/virtio_transport_common.c | 31 ++++++++++++++++++++----- 1 file changed, 25 insertions(+), 6 deletions(-) -- 2.43.0

2 4

[PATCH openEuler-1.0-LTS] arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU
by Lin Yujun 15 Jul '26

15 Jul '26

mainline inclusion from mainline-v7.1 commit ec7216f92e4ebd485b1c6dc6aa3f6064b71a5768 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15600 CVE: CVE-2025-10263 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- NVIDIA Olympus cores are affected by the TLBI completion issue tracked as CVE-2025-10263. The existing ARM64_ERRATUM_4118414 handling already uses ARM64_WORKAROUND_REPEAT_TLBI to issue an additional broadcast TLBI;DSB sequence and ensure affected memory write effects are globally observed. Add MIDR_NVIDIA_OLYMPUS to the repeat-TLBI match list so the same mitigation is enabled on affected Olympus systems. Also document the NVIDIA Olympus erratum in the arm64 silicon errata table and list it in the Kconfig help text. [linyujun: 4.19 does not have ARM64_ERRATUM_4118414 or the arm64_repeat_tlbi_list[] array. Adapt using the existing per-vendor config pattern (same as QCOM_FALKOR_ERRATUM_1009) with ERRATA_MIDR_ALL_VERSIONS.] Signed-off-by: Shanker Donthineni <sdonthineni(a)nvidia.com> Acked-by: Mark Rutland <mark.rutland(a)arm.com> Signed-off-by: Will Deacon <will(a)kernel.org> Conflicts: Documentation/arm64/silicon-errata.txt arch/arm64/Kconfig arch/arm64/include/asm/cputype.h arch/arm64/kernel/cpu_errata.c [主线高版本有 ARM64_ERRATUM_4118414 通用配置和 arm64_repeat_tlbi_list[] 数组， 4.19上是每个厂商各自一个独立 Kconfig 选项（QCOM_FALKOR_ERRATUM_1009 模式）。所以这个补丁需要手动适配，按这个模式新增了NVIDIA_OLYMPUS_ERRATUM_TLBI, 并且新增对应的CPU ID 定义。] Signed-off-by: Lin Yujun <linyujun809(a)h-partners.com> --- Documentation/arm64/silicon-errata.txt | 2 ++ arch/arm64/Kconfig | 15 +++++++++++++++ arch/arm64/include/asm/cputype.h | 2 ++ arch/arm64/kernel/cpu_errata.c | 7 +++++++ 4 files changed, 26 insertions(+) diff --git a/Documentation/arm64/silicon-errata.txt b/Documentation/arm64/silicon-errata.txt index 5016158f5e67..430c0dfbeca1 100644 --- a/Documentation/arm64/silicon-errata.txt +++ b/Documentation/arm64/silicon-errata.txt @@ -82,5 +82,7 @@ stable kernels. | | | | | | Qualcomm Tech. | Kryo/Falkor v1 | E1003 | QCOM_FALKOR_ERRATUM_1003 | | Qualcomm Tech. | Falkor v1 | E1009 | QCOM_FALKOR_ERRATUM_1009 | | Qualcomm Tech. | QDF2400 ITS | E0065 | QCOM_QDF2400_ERRATUM_0065 | | Qualcomm Tech. | Falkor v{1,2} | E1041 | QCOM_FALKOR_ERRATUM_1041 | +| | | | | +| NVIDIA | Olympus Core | T410-OLY-1029 | NVIDIA_OLYMPUS_ERRATUM_TLBI | diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index 6498279140fc..3951b0cc8134 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -615,10 +615,25 @@ config QCOM_FALKOR_ERRATUM_1009 TLBI xxIS invalidate maintenance operation. Repeat the TLBI operation one more time to fix the issue. If unsure, say Y. +config NVIDIA_OLYMPUS_ERRATUM_TLBI + bool "NVIDIA Olympus: Completion of affected memory accesses might not be guaranteed by completion of a TLBI" + default y + select ARM64_WORKAROUND_REPEAT_TLBI + help + On NVIDIA Olympus CPU, the completion of a broadcast TLB + invalidation might not guarantee that the memory accesses + expected to be affected by it have completed. Work around + this by issuing an additional broadcast TLBI followed by DSB. + + This is erratum T410-OLY-1029 on the NVIDIA Olympus CPU, + also known as CVE-2025-10263. + + If unsure, say Y. + config QCOM_QDF2400_ERRATUM_0065 bool "QDF2400 E0065: Incorrect GITS_TYPER.ITT_Entry_size" default y help On Qualcomm Datacenter Technologies QDF2400 SoC, ITS hardware reports diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h index bdec50291017..c18e48628509 100644 --- a/arch/arm64/include/asm/cputype.h +++ b/arch/arm64/include/asm/cputype.h @@ -100,10 +100,11 @@ #define QCOM_CPU_PART_FALKOR 0xC00 #define QCOM_CPU_PART_KRYO 0x200 #define NVIDIA_CPU_PART_DENVER 0x003 #define NVIDIA_CPU_PART_CARMEL 0x004 +#define NVIDIA_CPU_PART_OLYMPUS 0x010 #define HISI_CPU_PART_TSV110 0xD01 #define HISI_CPU_PART_TSV200 0xD02 #define PHYTIUM_CPU_PART_1500A 0X660 @@ -135,10 +136,11 @@ #define MIDR_QCOM_FALKOR_V1 MIDR_CPU_MODEL(ARM_CPU_IMP_QCOM, QCOM_CPU_PART_FALKOR_V1) #define MIDR_QCOM_FALKOR MIDR_CPU_MODEL(ARM_CPU_IMP_QCOM, QCOM_CPU_PART_FALKOR) #define MIDR_QCOM_KRYO MIDR_CPU_MODEL(ARM_CPU_IMP_QCOM, QCOM_CPU_PART_KRYO) #define MIDR_NVIDIA_DENVER MIDR_CPU_MODEL(ARM_CPU_IMP_NVIDIA, NVIDIA_CPU_PART_DENVER) #define MIDR_NVIDIA_CARMEL MIDR_CPU_MODEL(ARM_CPU_IMP_NVIDIA, NVIDIA_CPU_PART_CARMEL) +#define MIDR_NVIDIA_OLYMPUS MIDR_CPU_MODEL(ARM_CPU_IMP_NVIDIA, NVIDIA_CPU_PART_OLYMPUS) #define MIDR_HISI_TSV110 MIDR_CPU_MODEL(ARM_CPU_IMP_HISI, HISI_CPU_PART_TSV110) #define MIDR_HISI_TSV200 MIDR_CPU_MODEL(ARM_CPU_IMP_HISI, HISI_CPU_PART_TSV200) #define MIDR_FT_1500A MIDR_CPU_MODEL(ARM_CPU_IMP_PHYTIUM, PHYTIUM_CPU_PART_1500A) #define MIDR_FT_2000AHK MIDR_CPU_MODEL(ARM_CPU_IMP_PHYTIUM, PHYTIUM_CPU_PART_2000AHK) #define MIDR_FT_2000PLUS MIDR_CPU_MODEL(ARM_CPU_IMP_PHYTIUM, PHYTIUM_CPU_PART_2000PLUS) diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c index 3b911e8964a7..9ba8cb0e1824 100644 --- a/arch/arm64/kernel/cpu_errata.c +++ b/arch/arm64/kernel/cpu_errata.c @@ -924,10 +924,17 @@ const struct arm64_cpu_capabilities arm64_errata[] = { .desc = "Qualcomm Technologies Falkor erratum 1009", .capability = ARM64_WORKAROUND_REPEAT_TLBI, ERRATA_MIDR_REV(MIDR_QCOM_FALKOR_V1, 0, 0), }, #endif +#ifdef CONFIG_NVIDIA_OLYMPUS_ERRATUM_TLBI + { + .desc = "NVIDIA Olympus erratum T410-OLY-1029", + .capability = ARM64_WORKAROUND_REPEAT_TLBI, + ERRATA_MIDR_ALL_VERSIONS(MIDR_NVIDIA_OLYMPUS), + }, +#endif #ifdef CONFIG_ARM64_ERRATUM_858921 { /* Cortex-A73 all versions */ .desc = "ARM erratum 858921", .capability = ARM64_WORKAROUND_858921, -- 2.34.1

2 1

[PATCH OLK-6.6 0/3] CVE-2026-53132
by Jinjiang Tu 15 Jul '26

15 Jul '26

Eric Dumazet (1): vsock/virtio: fix potential unbounded skb queue Stefano Garzarella (2): vsock/virtio: fix skb overhead accounting to preserve full buf_alloc vsock/virtio: reset connection on receiving queue overflow net/vmw_vsock/virtio_transport_common.c | 31 ++++++++++++++++++++----- 1 file changed, 25 insertions(+), 6 deletions(-) -- 2.43.0

2 4

[PATCH OLK-6.6] thunderbolt: Validate XDomain request packet size before type cast
by Ze Zuo 14 Jul '26

14 Jul '26

From: Michael Bommarito <michael.bommarito(a)gmail.com> stable inclusion from stable-v6.6.143 commit 0dd61ba03d05187726ecdf9c0e2175a81b9b24f6 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16034 CVE: CVE-2026-53147 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit a504b9f2797b739e0304d537e8aa4ce883ecce39 upstream. tb_xdp_handle_request() casts the received packet buffer to protocol-specific structs without verifying that the allocation is large enough for the target type. A peer can send a minimal XDomain packet that passes the generic header length check but is shorter than the struct accessed after the cast, causing out-of- bounds reads from the kmemdup allocation. Plumb the packet length through xdomain_request_work and validate it against the expected struct size before each cast. Fixes: 8e1de7042596 ("thunderbolt: Add support for XDomain lane bonding") Fixes: cdae7c07e3e3 ("thunderbolt: Add support for XDomain properties") Cc: stable(a)vger.kernel.org Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Signed-off-by: Mika Westerberg <mika.westerberg(a)linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- drivers/thunderbolt/xdomain.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/thunderbolt/xdomain.c b/drivers/thunderbolt/xdomain.c index 31fec78a197b..868ef56827af 100644 --- a/drivers/thunderbolt/xdomain.c +++ b/drivers/thunderbolt/xdomain.c @@ -55,6 +55,7 @@ static const char * const state_names[] = { struct xdomain_request_work { struct work_struct work; struct tb_xdp_header *pkg; + size_t pkg_len; struct tb *tb; }; @@ -731,6 +732,7 @@ static void tb_xdp_handle_request(struct work_struct *work) struct xdomain_request_work *xw = container_of(work, typeof(*xw), work); const struct tb_xdp_header *pkg = xw->pkg; const struct tb_xdomain_header *xhdr = &pkg->xd_hdr; + size_t pkg_len = xw->pkg_len; struct tb *tb = xw->tb; struct tb_ctl *ctl = tb->ctl; struct tb_xdomain *xd; @@ -762,7 +764,7 @@ static void tb_xdp_handle_request(struct work_struct *work) switch (pkg->type) { case PROPERTIES_REQUEST: tb_dbg(tb, "%llx: received XDomain properties request\n", route); - if (xd) { + if (xd && pkg_len >= sizeof(struct tb_xdp_properties)) { ret = tb_xdp_properties_response(tb, ctl, xd, sequence, (const struct tb_xdp_properties *)pkg); } @@ -816,7 +818,8 @@ static void tb_xdp_handle_request(struct work_struct *work) tb_dbg(tb, "%llx: received XDomain link state change request\n", route); - if (xd && xd->state == XDOMAIN_STATE_BONDING_UUID_HIGH) { + if (xd && xd->state == XDOMAIN_STATE_BONDING_UUID_HIGH && + pkg_len >= sizeof(struct tb_xdp_link_state_change)) { const struct tb_xdp_link_state_change *lsc = (const struct tb_xdp_link_state_change *)pkg; @@ -868,6 +871,7 @@ tb_xdp_schedule_request(struct tb *tb, const struct tb_xdp_header *hdr, kfree(xw); return false; } + xw->pkg_len = size; xw->tb = tb_domain_get(tb); schedule_work(&xw->work); -- 2.25.1

2 1

[PATCH OLK-6.6] sctp: fix uninit-value in __sctp_rcv_asconf_lookup()
by Ze Zuo 14 Jul '26

14 Jul '26

From: Michael Bommarito <michael.bommarito(a)gmail.com> stable inclusion from stable-v6.6.143 commit 8ce96f1182644079249a24ac7e2ffc32e0301a46 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15911 CVE: CVE-2026-53225 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f8373d7090b745728de66308deeecc67e8d319ce ] __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 ("net: sctp: fix KMSAN uninit-value in sctp_inq_pop"). Fixes: df2185771439 ("[SCTP]: Update association lookup to look at ASCONF chunks as well") Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Acked-by: Xin Long <lucien.xin(a)gmail.com> Link: https://patch.msgid.link/20260608122234.459098-1-michael.bommarito@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- net/sctp/input.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/net/sctp/input.c b/net/sctp/input.c index 032a10d82302..df5b2187b8fa 100644 --- a/net/sctp/input.c +++ b/net/sctp/input.c @@ -1204,6 +1204,14 @@ static struct sctp_association *__sctp_rcv_asconf_lookup( /* Skip over the ADDIP header and find the Address parameter */ param = (union sctp_addr_param *)(asconf + 1); + /* The whole address parameter must lie within the chunk before + * af->from_addr_param() reads the variable-length address; otherwise a + * truncated trailing ASCONF chunk lets it read uninitialized bytes past + * the parameter. + */ + if (sizeof(*asconf) + ntohs(param->p.length) > ntohs(ch->length)) + return NULL; + af = sctp_get_af_specific(param_type2af(param->p.type)); if (unlikely(!af)) return NULL; -- 2.25.1

2 1

[PATCH OLK-6.6] hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf
by Ze Zuo 14 Jul '26

14 Jul '26

From: Anton Leontev <leontyevantony(a)gmail.com> stable inclusion from stable-v6.6.143 commit 09b8a7aa5a341bb345dc492aac139525efa13515 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15885 CVE: CVE-2026-53199 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 004e9ecfe6c5384f9e0b2f6f6389d42ec22789af ] netvsc_copy_to_send_buf() copies page buffer entries into the VMBus send buffer using phys_to_virt() on the entry PFN. Entries for the RNDIS header and the skb linear data come from kmalloc'd memory and are always in the kernel direct map, but entries for skb fragments reference page cache or user pages, which on 32-bit x86 with CONFIG_HIGHMEM=y can live above the LOWMEM boundary. For such a page phys_to_virt() returns an address outside the direct map and the subsequent memcpy() faults on the transmit softirq path, which is fatal. Map the pages with kmap_local_page() instead, handling two properties of the page buffer entries: - pb[i].pfn is a Hyper-V PFN at HV_HYP_PAGE_SIZE (4K) granularity, not a native PFN. Reconstruct the physical address first and derive the native page from it, so the mapping stays correct where PAGE_SIZE > HV_HYP_PAGE_SIZE (e.g. arm64 with 64K pages). - Since commit 41a6328b2c55 ("hv_netvsc: Preserve contiguous PFN grouping in the page buffer array"), an entry describes a full physically contiguous fragment and pb[i].len can exceed PAGE_SIZE, while kmap_local_page() maps a single page. Copy page by page, splitting at native page boundaries. The copy path only handles packets smaller than the send section size (6144 bytes by default); larger packets take the cp_partial path where only the RNDIS header is copied. So entries here are bounded by the section size and a copy is split at most once on 4K-page systems. On !CONFIG_HIGHMEM configs kmap_local_page() folds to page_address() and no mapping work is added. Fixes: c25aaf814a63 ("hyperv: Enable sendbuf mechanism on the send path") Cc: stable(a)vger.kernel.org Signed-off-by: Anton Leontev <leontyevantony(a)gmail.com> Link: https://patch.msgid.link/20260604165938.32033-1-leontyevantony@gmail.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> [ adapted `phys_to_page(paddr)` to `pfn_to_page(PHYS_PFN(paddr))` ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- drivers/net/hyperv/netvsc.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c index 61584b40cb03..2f09b07d809e 100644 --- a/drivers/net/hyperv/netvsc.c +++ b/drivers/net/hyperv/netvsc.c @@ -12,6 +12,7 @@ #include <linux/sched.h> #include <linux/wait.h> #include <linux/mm.h> +#include <linux/highmem.h> #include <linux/delay.h> #include <linux/io.h> #include <linux/slab.h> @@ -957,12 +958,22 @@ static void netvsc_copy_to_send_buf(struct netvsc_device *net_device, } for (i = 0; i < page_count; i++) { - char *src = phys_to_virt(pb[i].pfn << HV_HYP_PAGE_SHIFT); - u32 offset = pb[i].offset; + phys_addr_t paddr = (pb[i].pfn << HV_HYP_PAGE_SHIFT) + + pb[i].offset; u32 len = pb[i].len; - memcpy(dest, (src + offset), len); - dest += len; + while (len) { + struct page *page = pfn_to_page(PHYS_PFN(paddr)); + u32 off = offset_in_page(paddr); + u32 chunk = min_t(u32, len, PAGE_SIZE - off); + char *src = kmap_local_page(page); + + memcpy(dest, src + off, chunk); + kunmap_local(src); + dest += chunk; + paddr += chunk; + len -= chunk; + } } if (padding) -- 2.25.1

2 1

[PATCH OLK-6.6] sctp: diag: reject stale associations in dump_one path
by Ze Zuo 14 Jul '26

14 Jul '26

From: Zhao Zhang <zzhan461(a)ucr.edu> stable inclusion from stable-v6.6.143 commit e97c2a535e23ed0fdd2660993fb3f10d9535c9bc category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15622 CVE: CVE-2026-52917 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 5eba3e48d78edd7551b992cb7ba687019b3a78da upstream. The SCTP exact sock_diag lookup can hold a transport reference, block on lock_sock(sk), and then resume after sctp_association_free() has marked the association dead and freed its bind address list. When that happens, inet_assoc_attr_size() and inet_diag_msg_sctpasoc_fill() can still dereference association state that is no longer valid for reporting. In particular, inet_diag_msg_sctpasoc_fill() may read an empty bind-address list as a real sctp_sockaddr_entry and trigger an out-of-bounds read from unrelated association memory. Reject the association after taking the socket lock if it has been reaped or detached from the endpoint, and report the lookup as stale. This keeps the exact dump-one path from formatting torn association state. Fixes: 8f840e47f190 ("sctp: add the sctp_diag.c file") Cc: stable(a)kernel.org Reported-by: Yuan Tan <yuantan098(a)gmail.com> Reported-by: Yifan Wu <yifanwucs(a)gmail.com> Reported-by: Juefei Pu <tomapufckgml(a)gmail.com> Reported-by: Zhengchuan Liang <zcliangcn(a)gmail.com> Reported-by: Xin Liu <bird(a)lzu.edu.cn> Signed-off-by: Zhao Zhang <zzhan461(a)ucr.edu> Signed-off-by: Ren Wei <n05ec(a)lzu.edu.cn> Acked-by: Xin Long <lucien.xin(a)gmail.com> Link: https://patch.msgid.link/fac6043fa20a2ff68e12958c431836f692c51268.178011382… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- net/sctp/diag.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/net/sctp/diag.c b/net/sctp/diag.c index 5a43f25478d0..ff4f8a679ffc 100644 --- a/net/sctp/diag.c +++ b/net/sctp/diag.c @@ -266,15 +266,15 @@ static int sctp_sock_dump_one(struct sctp_endpoint *ep, struct sctp_transport *t lock_sock(sk); - rep = nlmsg_new(inet_assoc_attr_size(sk, assoc), GFP_KERNEL); - if (!rep) { - release_sock(sk); - return -ENOMEM; + if (ep != assoc->ep || assoc->base.dead) { + err = -ESTALE; + goto out_unlock; } - if (ep != assoc->ep) { - err = -EAGAIN; - goto out; + rep = nlmsg_new(inet_assoc_attr_size(sk, assoc), GFP_KERNEL); + if (!rep) { + err = -ENOMEM; + goto out_unlock; } err = inet_sctp_diag_fill(sk, assoc, rep, req, sk_user_ns(NETLINK_CB(skb).sk), @@ -289,8 +289,9 @@ static int sctp_sock_dump_one(struct sctp_endpoint *ep, struct sctp_transport *t return nlmsg_unicast(sock_net(skb->sk)->diag_nlsk, rep, NETLINK_CB(skb).portid); out: - release_sock(sk); kfree_skb(rep); +out_unlock: + release_sock(sk); return err; } -- 2.25.1

2 1

[PATCH OLK-6.6 00/32] backport minios patches from linux mainline
by Qinxin Xia 14 Jul '26

14 Jul '26

From: Hongye Lin <linhongye(a)h-partners.com> backport minios patches from linux mainline Mark Rutland (8): arm64/fpsimd: Add fpsimd_save_and_flush_current_state() arm64/fpsimd: signal32: Always save+flush state early arm64/fpsimd: signal: Always save+flush state early arm64: ptrace: fix partial SETREGSET for NT_ARM_FPMR arm64/fpsimd: Reset FPMR upon exec() arm64/fpsimd: Don't corrupt FPMR when streaming mode changes arm64/fpsimd: Do not discard modified SVE state arm64/fpsimd: Avoid warning when sve_to_fpsimd() is unused Qinxin Xia (21): arm64/sysreg: Add definition for ID_AA64PFR2_EL1 arm64/sysreg: Add definition for ID_AA64ISAR3_EL1 arm64/sysreg: Add definition for ID_AA64FPFR0_EL1 arm64/sysreg: Add definition for FPMR arm64/sysreg: Add EnFPM field for SCTLR_EL1 and HCRX_EL2 arm64/sysreg: Add LUT field for ID_AA64ISAR2_EL1 arm64/cpufeature: Hook new identification registers up to cpufeature arm64/hwcap: Define hwcaps for 2023 DPISA features kselftest/arm64: Add basic FPMR test kselftest/arm64: Handle FPMR context in generic signal frame parser kselftest/arm64: Add 2023 DPISA hwcap test coverage arm64: Kconfig: Detect toolchain support for LSUI arm64: cpufeature: add FEAT_LSUI arm64/signal: Add FPMR signal handling arm64/ptrace: Expose FPMR via ptrace Add support "arm64.nocnp" for start option arm64/fpsimd: Support FEAT_FPMR arm64: syscall: switch to fpsimd_syscall_enter() arm64/fpsimd: Enable host kernel access to FPMR KVM: arm64: Properly save/restore HCRX_EL2 KVM: arm64: Kill HCRX_HOST_FLAGS Yifan Wu (3): arm64/hwcap: Add support for FEAT_CMPBR kselftest/arm64: Add FEAT_CMPBR to the hwcap selftest arm64/sysreg: Update ID_AA64ISAR2_EL1 for FEAT_CMPBR Documentation/arch/arm64/elf_hwcaps.rst | 30 +++++ arch/arm64/Kconfig | 5 + arch/arm64/include/asm/cpu.h | 3 + arch/arm64/include/asm/cpufeature.h | 6 + arch/arm64/include/asm/el2_setup.h | 2 +- arch/arm64/include/asm/fpsimd.h | 7 +- arch/arm64/include/asm/hwcap.h | 10 ++ arch/arm64/include/asm/kvm_arm.h | 1 - arch/arm64/include/asm/kvm_host.h | 1 + arch/arm64/include/asm/processor.h | 4 + arch/arm64/include/asm/signal_common.h | 20 ++- arch/arm64/include/uapi/asm/hwcap.h | 10 ++ arch/arm64/include/uapi/asm/sigcontext.h | 8 ++ arch/arm64/kernel/cpufeature.c | 70 +++++++++- arch/arm64/kernel/cpuinfo.c | 3 + arch/arm64/kernel/entry-common.c | 50 +++++-- arch/arm64/kernel/fpsimd.c | 74 +++++------ arch/arm64/kernel/hwcap_str.h | 10 ++ arch/arm64/kernel/idreg-override.c | 11 ++ arch/arm64/kernel/ptrace.c | 44 +++++++ arch/arm64/kernel/signal.c | 102 ++++++++------- arch/arm64/kernel/signal32.c | 11 +- arch/arm64/kvm/fpsimd.c | 1 + arch/arm64/kvm/hyp/include/hyp/switch.h | 12 +- arch/arm64/tools/cpucaps | 2 + arch/arm64/tools/sysreg | 122 +++++++++++++++++- include/uapi/linux/elf.h | 1 + tools/testing/selftests/arm64/abi/hwcap.c | 116 +++++++++++++++++ .../testing/selftests/arm64/signal/.gitignore | 1 + .../arm64/signal/testcases/fpmr_siginfo.c | 82 ++++++++++++ .../arm64/signal/testcases/testcases.c | 8 ++ .../arm64/signal/testcases/testcases.h | 1 + 32 files changed, 710 insertions(+), 118 deletions(-) create mode 100644 tools/testing/selftests/arm64/signal/testcases/fpmr_siginfo.c -- 2.33.0

2 33

[PATCH] ext4: validate readdir offset before accessing dirent
by Yao Kai 14 Jul '26

14 Jul '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9553 CVE: NA ------------------------ A corrupted directory can trigger the following KASAN report when ext4_readdir() resumes from an invalid position: BUG: KASAN: use-after-free in __ext4_check_dir_entry+0x5ef/0x820 Read of size 2 at addr ffff88810a646000 by task repro_linear/509 Call Trace: <TASK> dump_stack_lvl+0x53/0x70 print_report+0xd0/0x630 kasan_report+0xce/0x100 __ext4_check_dir_entry+0x5ef/0x820 ext4_readdir+0xcde/0x2b70 iterate_dir+0x1a1/0x520 __x64_sys_getdents64+0x12b/0x220 do_syscall_64+0xf9/0x540 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> KASAN reports use-after-free because the out-of-bounds access lands in an adjacent freed page. The directory buffer itself is still referenced. ext4_dir_llseek() invalidates the directory cookie so that ext4_readdir() rescans directory entries from the start of the block. The rescan checks only the lower bound of rec_len before advancing. A corrupted rec_len can therefore place the offset where the block has insufficient space for a complete directory entry. The rescan itself may dereference that truncated entry, or the main loop may pass it to __ext4_check_dir_entry(). The latter reads de->rec_len before validating the range. For example: block offset 0 4092 4096 |---- de1.rec_len = 4092 -----|----| de2.inode | de2.rec_len ^ OOB, reported as UAF de2 starts at offset 4092 in this 4 KiB block. Its four-byte inode fits in the block, but its rec_len starts at offset 4096 and crosses the boundary. The minimum safe length is inode-dependent. Encrypted and casefolded directory entries need eight additional hash bytes, while a valid metadata checksum tail is only 12 bytes. Cache the metadata checksum feature state and derive the minimum directory entry length from the on-disk format. Use it to bound both the rescan and the offset passed to the main loop. Report an offset in a truncated block tail and skip the remainder of the block, while continuing to accept an offset exactly at the block boundary. Reported-by: syzbot+5322c5c260eb44d209ed(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=5322c5c260eb44d209ed Fixes: ac27a0ec112a ("[PATCH] ext4: initial copy of files from ext3") Signed-off-by: Yao Kai <yaokai34(a)huawei.com> Reviewed-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> --- fs/ext4/dir.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/fs/ext4/dir.c b/fs/ext4/dir.c index 513360234b14..c2e0b7c9562e 100644 --- a/fs/ext4/dir.c +++ b/fs/ext4/dir.c @@ -219,7 +219,9 @@ static int ext4_readdir(struct file *file, struct dir_context *ctx) * dirent right now. Scan from the start of the block * to make sure. */ if (!inode_eq_iversion(inode, file->f_version)) { - for (i = 0; i < sb->s_blocksize && i < offset; ) { + for (i = 0; + i <= sb->s_blocksize - EXT4_DIR_REC_LEN(1) && + i < offset;) { de = (struct ext4_dir_entry_2 *) (bh->b_data + i); /* It's too expensive to do a full @@ -240,6 +242,16 @@ static int ext4_readdir(struct file *file, struct dir_context *ctx) file->f_version = inode_query_iversion(inode); } + if (unlikely(offset < sb->s_blocksize && + offset > sb->s_blocksize - EXT4_DIR_REC_LEN(1))) { + EXT4_ERROR_FILE(file, bh->b_blocknr, + "bad entry in directory: %s - offset=%u, size=%lu", + "directory entry too close to block end", + offset, sb->s_blocksize); + ctx->pos = round_up(ctx->pos, sb->s_blocksize); + goto next_block; + } + while (ctx->pos < inode->i_size && offset < sb->s_blocksize) { de = (struct ext4_dir_entry_2 *) (bh->b_data + offset); @@ -285,6 +297,7 @@ static int ext4_readdir(struct file *file, struct dir_context *ctx) ctx->pos += ext4_rec_len_from_disk(de->rec_len, sb->s_blocksize); } +next_block: if ((ctx->pos < inode->i_size) && !dir_relax_shared(inode)) goto done; brelse(bh); -- 2.34.1

1 0

[PATCH OLK-6.6 0/2] fix CVE-2026-53132
by Jinjiang Tu 14 Jul '26

14 Jul '26

Eric Dumazet (1): vsock/virtio: fix potential unbounded skb queue Stefano Garzarella (1): vsock/virtio: fix skb overhead accounting to preserve full buf_alloc net/vmw_vsock/virtio_transport_common.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) -- 2.43.0

2 3

[PATCH] ext4: validate readdir offset before accessing dirent
by Yao Kai 14 Jul '26

14 Jul '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9553 CVE: NA ------------------------ A corrupted directory can trigger the following KASAN report when ext4_readdir() resumes from an invalid position: BUG: KASAN: use-after-free in __ext4_check_dir_entry+0x5ef/0x820 Read of size 2 at addr ffff88810a646000 by task repro_linear/509 Call Trace: <TASK> dump_stack_lvl+0x53/0x70 print_report+0xd0/0x630 kasan_report+0xce/0x100 __ext4_check_dir_entry+0x5ef/0x820 ext4_readdir+0xcde/0x2b70 iterate_dir+0x1a1/0x520 __x64_sys_getdents64+0x12b/0x220 do_syscall_64+0xf9/0x540 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> KASAN reports use-after-free because the out-of-bounds access lands in an adjacent freed page. The directory buffer itself is still referenced. ext4_dir_llseek() invalidates the directory cookie so that ext4_readdir() rescans directory entries from the start of the block. The rescan checks only the lower bound of rec_len before advancing. A corrupted rec_len can therefore place the offset where the block has insufficient space for a complete directory entry. The rescan itself may dereference that truncated entry, or the main loop may pass it to __ext4_check_dir_entry(). The latter reads de->rec_len before validating the range. For example: block offset 0 4092 4096 |---- de1.rec_len = 4092 -----|----| de2.inode | de2.rec_len ^ OOB, reported as UAF de2 starts at offset 4092 in this 4 KiB block. Its four-byte inode fits in the block, but its rec_len starts at offset 4096 and crosses the boundary. The minimum safe length is inode-dependent. Encrypted and casefolded directory entries need eight additional hash bytes, while a valid metadata checksum tail is only 12 bytes. Cache the metadata checksum feature state and derive the minimum directory entry length from the on-disk format. Use it to bound both the rescan and the offset passed to the main loop. Report an offset in a truncated block tail and skip the remainder of the block, while continuing to accept an offset exactly at the block boundary. Reported-by: syzbot+5322c5c260eb44d209ed(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=5322c5c260eb44d209ed Fixes: ac27a0ec112a ("[PATCH] ext4: initial copy of files from ext3") Signed-off-by: Yao Kai <yaokai34(a)huawei.com> Reviewed-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> --- fs/ext4/dir.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/fs/ext4/dir.c b/fs/ext4/dir.c index 5def57966807..9c5ff45bfd6b 100644 --- a/fs/ext4/dir.c +++ b/fs/ext4/dir.c @@ -216,7 +216,9 @@ static int ext4_readdir(struct file *file, struct dir_context *ctx) * dirent right now. Scan from the start of the block * to make sure. */ if (!inode_eq_iversion(inode, file->f_version)) { - for (i = 0; i < sb->s_blocksize && i < offset; ) { + for (i = 0; + i <= sb->s_blocksize - EXT4_DIR_REC_LEN(1) && + i < offset;) { de = (struct ext4_dir_entry_2 *) (bh->b_data + i); /* It's too expensive to do a full @@ -237,6 +239,16 @@ static int ext4_readdir(struct file *file, struct dir_context *ctx) file->f_version = inode_query_iversion(inode); } + if (unlikely(offset < sb->s_blocksize && + offset > sb->s_blocksize - EXT4_DIR_REC_LEN(1))) { + EXT4_ERROR_FILE(file, bh->b_blocknr, + "bad entry in directory: %s - offset=%u, size=%lu", + "directory entry too close to block end", + offset, sb->s_blocksize); + ctx->pos = round_up(ctx->pos, sb->s_blocksize); + goto next_block; + } + while (ctx->pos < inode->i_size && offset < sb->s_blocksize) { de = (struct ext4_dir_entry_2 *) (bh->b_data + offset); @@ -282,6 +294,7 @@ static int ext4_readdir(struct file *file, struct dir_context *ctx) ctx->pos += ext4_rec_len_from_disk(de->rec_len, sb->s_blocksize); } +next_block: if ((ctx->pos < inode->i_size) && !dir_relax_shared(inode)) goto done; brelse(bh); -- 2.34.1

1 0

[PATCH OLK-6.6] zram: fix use-after-free in zram_bvec_write_partial()
by Jinjiang Tu 14 Jul '26

14 Jul '26

From: Cunlong Li <shenxiaogll(a)gmail.com> stable inclusion from stable-v6.6.143 commit 0c2821665ff71be3f4b07ecece384669f2877f6a category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15870 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 732fd9f0b9c1cdc6dfd77162ded60df005182cc0 upstream. zram_read_page() picks the sync or async backing device read path based on whether the parent bio is NULL. zram_bvec_write_partial() passes its parent bio down, so for ZRAM_WB slots the read is dispatched asynchronously and zram_read_page() returns 0 while the bio is still in flight. The caller then runs memcpy_from_bvec(), zram_write_page() and __free_page() on the buffer, leaving the async read to write into a freed page. zram_bvec_read_partial() was switched to NULL in commit 4e3c87b9421d ("zram: fix synchronous reads") for the same reason; the write_partial counterpart was missed. Link: https://lore.kernel.org/20260528-zram-v3-1-cab86eef8764@gmail.com Fixes: 8e654f8fbff5 ("zram: read page from backing device") Reviewed-by: Christoph Hellwig <hch(a)lst.de> Reviewed-by: Sergey Senozhatsky <senozhatsky(a)chromium.org> Signed-off-by: Cunlong Li <shenxiaogll(a)gmail.com> Cc: Jens Axboe <axboe(a)kernel.dk> Cc: Minchan Kim <minchan(a)kernel.org> Cc: Yisheng Xie <xieyisheng1(a)huawei.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- drivers/block/zram/zram_drv.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c index 8a0815b1e654..f048b5198df0 100644 --- a/drivers/block/zram/zram_drv.c +++ b/drivers/block/zram/zram_drv.c @@ -1554,7 +1554,7 @@ static int zram_bvec_write_partial(struct zram *zram, struct bio_vec *bvec, if (!page) return -ENOMEM; - ret = zram_read_page(zram, page, index, bio); + ret = zram_read_page(zram, page, index, NULL); if (!ret) { memcpy_from_bvec(page_address(page) + offset, bvec); ret = zram_write_page(zram, page, index); -- 2.43.0

2 1

[PATCH OLK-5.10 0/2] Fix livepatch activation failure
by Tengda Wu 14 Jul '26

14 Jul '26

During KO compilation, the absence of the elfutils-devel package in the build environment results in the KO missing the ORC section. Consequently, after the KO is loaded, any resident kernel threads spawned by it cannot reliably unwind the stack, causing livepatch activation to fail. This is resolved by backporting the mainline patch [1]. [1] https://lore.kernel.org/all/20210512065201.35268-1-masahiroy@kernel.org/ Masahiro Yamada (2): kbuild: hide tools/ build targets from external module builds kbuild: remove libelf checks from top Makefile Makefile | 104 +++++++++++++++-------------------------- scripts/Makefile.build | 2 - 2 files changed, 38 insertions(+), 68 deletions(-) -- 2.34.1

2 3

[OLK-5.10 0/2] Avoid unreliable stack during activating livepatch
by Tengda Wu 13 Jul '26

13 Jul '26

Avoid unreliable stack during activating livepatch. Masahiro Yamada (2): kbuild: hide tools/ build targets from external module builds kbuild: remove libelf checks from top Makefile Makefile | 104 +++++++++++++++-------------------------- scripts/Makefile.build | 2 - 2 files changed, 38 insertions(+), 68 deletions(-) -- 2.34.1

1 2

[PATCH OLK-6.6] perf/x86/amd/core: Avoid enabling BRS from the SVM reload path
by Luo Gengkun 13 Jul '26

13 Jul '26

From: Sandipan Das <sandipan.das(a)amd.com> mainline inclusion from mainline-v7.2-rc3 commit 07c60dda9c059c09f83d42a3ebda2e7cc1cf3bc2 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16080 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- Branch Sampling (BRS) and Last Branch Record (LBR) are mutually exclusive hardware features, and users of both are tracked via cpuc->lbr_users. When SVM is toggled on a CPU, the host perf events are reprogrammed to update the HostOnly filter bit (set when virtualization is enabled, cleared when it is disabled). On PerfMonV2-capable processors, this reprogramming is performed by calling amd_pmu_enable_all() to rewrite the event selectors. However, amd_pmu_enable_all() also calls amd_brs_enable_all(), which enables BRS whenever cpuc->lbr_users > 0. Having active LBR events satisfies this gating on processors that have LBR but not BRS. The kernel then tries to set the BRS enable bit in DebugExtnCfg (MSR 0xc000010f). Since that bit is deprecated on such hardware, the write results in a #GP: Call Trace: <IRQ> amd_pmu_enable_all+0x1d/0x90 amd_pmu_disable_virt+0x62/0xb0 kvm_arch_disable_virtualization_cpu+0xa/0x40 [kvm] hardware_disable_nolock+0x1a/0x30 [kvm] __flush_smp_call_function_queue+0x9b/0x410 __sysvec_call_function+0x18/0xc0 sysvec_call_function+0x69/0x90 </IRQ> <TASK> asm_sysvec_call_function+0x16/0x20 RIP: 0010:cpuidle_enter_state+0xc4/0x450 ? cpuidle_enter_state+0xb7/0x450 cpuidle_enter+0x29/0x40 cpuidle_idle_call+0xf5/0x160 do_idle+0x7b/0xe0 cpu_startup_entry+0x26/0x30 start_secondary+0x115/0x140 secondary_startup_64_no_verify+0x194/0x19b </TASK> Fix this by ensuring that BRS is not enabled from the event selector reprogramming path even when cpuc->lbr_users > 0. Fixes: bae19fdd7e9e ("perf/x86/amd/core: Fix reloading events for SVM") Signed-off-by: Sandipan Das <sandipan.das(a)amd.com> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Cc: Peter Zijlstra <peterz(a)infradead.org> Link: https://patch.msgid.link/702fa204d574b03d14e3664c7d4b201db048bbfd.178350652… Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- arch/x86/events/amd/core.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/arch/x86/events/amd/core.c b/arch/x86/events/amd/core.c index 5c93241b4262..5fbe0241a6eb 100644 --- a/arch/x86/events/amd/core.c +++ b/arch/x86/events/amd/core.c @@ -751,13 +751,11 @@ static void amd_pmu_enable_event(struct perf_event *event) x86_pmu_enable_event(event); } -static void amd_pmu_enable_all(int added) +static void __amd_pmu_enable_all(void) { struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events); int idx; - amd_brs_enable_all(); - for_each_set_bit(idx, x86_pmu.cntr_mask, X86_PMC_IDX_MAX) { /* only activate events which are marked as active */ if (!test_bit(idx, cpuc->active_mask)) @@ -772,6 +770,12 @@ static void amd_pmu_enable_all(int added) } } +static void amd_pmu_enable_all(int added) +{ + amd_brs_enable_all(); + __amd_pmu_enable_all(); +} + static void amd_pmu_v2_enable_event(struct perf_event *event) { struct hw_perf_event *hwc = &event->hw; @@ -1522,7 +1526,7 @@ static inline void amd_pmu_reload_virt(void) * set global enable bits once again */ amd_pmu_v2_disable_all(); - amd_pmu_enable_all(0); + __amd_pmu_enable_all(); amd_pmu_v2_enable_all(0); return; } -- 2.34.1

2 1

[PATCH OLK-6.6] perf/x86/amd/core: Avoid enabling BRS from the SVM reload path
by Luo Gengkun 13 Jul '26

13 Jul '26

From: Sandipan Das <sandipan.das(a)amd.com> mainline inclusion from mainline-v7.2-rc3 commit 07c60dda9c059c09f83d42a3ebda2e7cc1cf3bc2 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- Branch Sampling (BRS) and Last Branch Record (LBR) are mutually exclusive hardware features, and users of both are tracked via cpuc->lbr_users. When SVM is toggled on a CPU, the host perf events are reprogrammed to update the HostOnly filter bit (set when virtualization is enabled, cleared when it is disabled). On PerfMonV2-capable processors, this reprogramming is performed by calling amd_pmu_enable_all() to rewrite the event selectors. However, amd_pmu_enable_all() also calls amd_brs_enable_all(), which enables BRS whenever cpuc->lbr_users > 0. Having active LBR events satisfies this gating on processors that have LBR but not BRS. The kernel then tries to set the BRS enable bit in DebugExtnCfg (MSR 0xc000010f). Since that bit is deprecated on such hardware, the write results in a #GP: Call Trace: <IRQ> amd_pmu_enable_all+0x1d/0x90 amd_pmu_disable_virt+0x62/0xb0 kvm_arch_disable_virtualization_cpu+0xa/0x40 [kvm] hardware_disable_nolock+0x1a/0x30 [kvm] __flush_smp_call_function_queue+0x9b/0x410 __sysvec_call_function+0x18/0xc0 sysvec_call_function+0x69/0x90 </IRQ> <TASK> asm_sysvec_call_function+0x16/0x20 RIP: 0010:cpuidle_enter_state+0xc4/0x450 ? cpuidle_enter_state+0xb7/0x450 cpuidle_enter+0x29/0x40 cpuidle_idle_call+0xf5/0x160 do_idle+0x7b/0xe0 cpu_startup_entry+0x26/0x30 start_secondary+0x115/0x140 secondary_startup_64_no_verify+0x194/0x19b </TASK> Fix this by ensuring that BRS is not enabled from the event selector reprogramming path even when cpuc->lbr_users > 0. Fixes: bae19fdd7e9e ("perf/x86/amd/core: Fix reloading events for SVM") Signed-off-by: Sandipan Das <sandipan.das(a)amd.com> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Cc: Peter Zijlstra <peterz(a)infradead.org> Link: https://patch.msgid.link/702fa204d574b03d14e3664c7d4b201db048bbfd.178350652… Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- arch/x86/events/amd/core.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/arch/x86/events/amd/core.c b/arch/x86/events/amd/core.c index 5c93241b4262..5fbe0241a6eb 100644 --- a/arch/x86/events/amd/core.c +++ b/arch/x86/events/amd/core.c @@ -751,13 +751,11 @@ static void amd_pmu_enable_event(struct perf_event *event) x86_pmu_enable_event(event); } -static void amd_pmu_enable_all(int added) +static void __amd_pmu_enable_all(void) { struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events); int idx; - amd_brs_enable_all(); - for_each_set_bit(idx, x86_pmu.cntr_mask, X86_PMC_IDX_MAX) { /* only activate events which are marked as active */ if (!test_bit(idx, cpuc->active_mask)) @@ -772,6 +770,12 @@ static void amd_pmu_enable_all(int added) } } +static void amd_pmu_enable_all(int added) +{ + amd_brs_enable_all(); + __amd_pmu_enable_all(); +} + static void amd_pmu_v2_enable_event(struct perf_event *event) { struct hw_perf_event *hwc = &event->hw; @@ -1522,7 +1526,7 @@ static inline void amd_pmu_reload_virt(void) * set global enable bits once again */ amd_pmu_v2_disable_all(); - amd_pmu_enable_all(0); + __amd_pmu_enable_all(); amd_pmu_v2_enable_all(0); return; } -- 2.34.1

2 1

[PATCH OLK-5.10] bpf, arm64: Fix off-by-one in check_imm signed range check
by Pan Taixi 12 Jul '26

12 Jul '26

From: Daniel Borkmann <daniel(a)iogearbox.net> mainline inclusion from mainline-v7.1-rc1 commit 1dd8be4ec722ce54e4cace59f3a4ba658111b3ec category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15738 CVE: CVE-2026-53036 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- check_imm(bits, imm) is used in the arm64 BPF JIT to verify that a branch displacement (in arm64 instruction units) fits into the signed N-bit immediate field of a B, B.cond or CBZ/CBNZ encoding before it is handed to the encoder. The macro currently tests for (imm > 0 && imm >> bits) || (imm < 0 && ~imm >> bits) which admits values in [-2^N, 2^N) — effectively a signed (N+1)-bit range. A signed N-bit field only holds [-2^(N-1), 2^(N-1)), so the check admits one extra bit of range on each side. In particular, for check_imm19(), values in [2^18, 2^19) slip past the check but do not fit into the 19-bit signed imm19 field of B.cond. aarch64_insn_encode_immediate() then masks the raw value into the 19-bit field, setting bit 18 (the sign bit) and flipping a forward branch into a backward one. Same class of issue exists for check_imm26() and the B/BL encoding. Shift by (bits - 1) instead of bits so the actual signed N-bit range is enforced. Fixes: e54bcde3d69d ("arm64: eBPF JIT compiler") Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Reviewed-by: Puranjay Mohan <puranjay(a)kernel.org> Link: https://lore.kernel.org/r/20260415121403.639619-2-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Conflicts: arch/arm64/net/bpf_jit_comp.c [ctx conflicts] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com> --- arch/arm64/net/bpf_jit_comp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c index bb4c246aea96..2a6e0b80cae7 100644 --- a/arch/arm64/net/bpf_jit_comp.c +++ b/arch/arm64/net/bpf_jit_comp.c @@ -595,12 +595,12 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx, u8 dst_adj; int off_adj; int ret; #define check_imm(bits, imm) do { \ - if ((((imm) > 0) && ((imm) >> (bits))) || \ - (((imm) < 0) && (~(imm) >> (bits)))) { \ + if ((((imm) > 0) && ((imm) >> ((bits) - 1))) || \ + (((imm) < 0) && (~(imm) >> ((bits) - 1)))) { \ pr_info("[%2d] imm=%d(0x%x) out of range\n", \ i, imm, imm); \ return -EINVAL; \ } \ } while (0) -- 2.34.1

2 1

[PATCH OLK-5.10 00/14] CVE-2026-46054
by Cai Xinchen 10 Jul '26

10 Jul '26

ovl_open_realfile reletion code feature patch ("ovl: pass layer mnt to ovl_open_realfile: ovl_open_realfile reletion.") init_file code refactoring patch ("fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers") backing_file structure and backing_file_open function reletion features: patch ("fs: use backing_file container for internal files with "fake" f_path") patch ("fs: move cleanup from init_file() into its callers") bpf_fd_pass const warning fix patch ("lsm: constify the 'file' parameter in security_binder_transfer_file()") code refactoring: store real path instead of fake path in backing file f_path patch ("fs: get mnt_writers count for an open backing file's real path") patch ("fs: create helper file_user_path() for user displayed mapped file path") patch ("fs: store real path instead of fake path in backing file f_path") patch ("ovl: Fix nested backing file paths") patch ("perf/core: Fix MMAP event path names with backing files") backing_file const warning fix patch ("fs: constify file ptr in backing_file accessor helpers") SELinux overlay backing_file mmap/mprotect check prepare for lsm function: patch ("fs: prepare for adding LSM blob to backing_file") patch ("lsm: add backing_file LSM hooks") CVE-2026-46054 fix: Add SELinux lsm hooks for backing_file mmap/mprotect patch ("selinux: fix overlayfs mmap() and mprotect() access checks") Adrian Hunter (1): perf/core: Fix MMAP event path names with backing files Amir Goldstein (9): [Backport] ovl: pass layer mnt to ovl_open_realfile() fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers fs: use backing_file container for internal files with "fake" f_path fs: move cleanup from init_file() into its callers fs: get mnt_writers count for an open backing file's real path fs: create helper file_user_path() for user displayed mapped file path fs: store real path instead of fake path in backing file f_path fs: constify file ptr in backing_file accessor helpers fs: prepare for adding LSM blob to backing_file André Almeida (1): ovl: Fix nested backing file paths Khadija Kamran (1): lsm: constify the 'file' parameter in security_binder_transfer_file() Paul Moore (2): lsm: add backing_file LSM hooks selinux: fix overlayfs mmap() and mprotect() access checks arch/arc/kernel/troubleshoot.c | 6 +- fs/file_table.c | 139 ++++++++++++++--- fs/internal.h | 18 ++- fs/open.c | 76 ++++++--- fs/overlayfs/file.c | 34 ++-- fs/overlayfs/overlayfs.h | 1 + fs/overlayfs/super.c | 16 +- fs/overlayfs/util.c | 14 ++ fs/proc/base.c | 2 +- fs/proc/nommu.c | 2 +- fs/proc/task_mmu.c | 4 +- fs/proc/task_nommu.c | 2 +- include/linux/fs.h | 44 +++++- include/linux/lsm_audit.h | 2 +- include/linux/lsm_hook_defs.h | 7 +- include/linux/lsm_hooks.h | 1 + include/linux/security.h | 26 +++- kernel/events/core.c | 2 +- kernel/trace/trace_output.c | 2 +- security/security.c | 112 ++++++++++++- security/selinux/hooks.c | 250 ++++++++++++++++++++++-------- security/selinux/include/objsec.h | 11 ++ 22 files changed, 631 insertions(+), 140 deletions(-) -- 2.18.0.huawei.25

2 15

[PATCH OLK-6.6] mm/numa_remote: limit remote NUMA linear mapping to PMD granularity
by Jinjiang Tu 09 Jul '26

09 Jul '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9543 ---------------------------------------- When hot-adding 1G memory and then hot-removing a 128MB portion, the entire 1G PUD-level page table gets torn down because the linear mapping was created at PUD block granularity. This causes valid remaining memory to lose its mapping. Fix this by forcing PMD-level block mappings for remote NUMA nodes during arch_add_memory(), so that hot-remove only tears down PMD-sized segments rather than the full PUD range. Since hot-add/hot-remove granularity is larger than PMD size, there is no risk of incorrectly removing linear mappings belonging to adjacent memory regions. Fixes: 564bbaf3fbb5 ("mm/numa_remote: support to hotplug/hotremove remote memory") Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- arch/arm64/mm/mmu.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c index 6fd01159820b..2820748d7152 100644 --- a/arch/arm64/mm/mmu.c +++ b/arch/arm64/mm/mmu.c @@ -25,6 +25,7 @@ #include <linux/vmalloc.h> #include <linux/set_memory.h> #include <linux/kfence.h> +#include <linux/numa_remote.h> #include "internal.h" #include <asm/barrier.h> @@ -1408,7 +1409,7 @@ int arch_add_memory(int nid, u64 start, u64 size, if (can_set_direct_map() || is_virtcca_cvm_world()) flags |= NO_BLOCK_MAPPINGS | NO_CONT_MAPPINGS; - else if (should_pmd_linear_mapping()) + else if (should_pmd_linear_mapping() || numa_is_remote_node(nid)) flags |= NO_PUD_BLOCK_MAPPINGS | NO_CONT_MAPPINGS; __create_pgd_mapping(swapper_pg_dir, start, __phys_to_virt(start), -- 2.43.0

2 1

[PATCH OLK-6.6 0/4] Fix CVE-2026-46054
by Cai Xinchen 08 Jul '26

08 Jul '26

Backport the patch series "Fix incorrect overlayfs mmap() and mprotect() LSM access controls" [1] to OLK-6.6. The patch "fs: constify file ptr in backing_file accessor helpers" is backport to fix const warning. Amir Goldstein (2): fs: prepare for adding LSM blob to backing_file fs: constify file ptr in backing_file accessor helpers Paul Moore (2): lsm: add backing_file LSM hooks selinux: fix overlayfs mmap() and mprotect() access checks fs/backing-file.c | 15 +- fs/file_table.c | 54 ++++++- fs/fuse/passthrough.c | 2 +- fs/internal.h | 4 +- fs/overlayfs/file.c | 4 +- include/linux/backing-file.h | 2 +- include/linux/fs.h | 17 ++- include/linux/lsm_audit.h | 2 +- include/linux/lsm_hook_defs.h | 5 + include/linux/lsm_hooks.h | 1 + include/linux/security.h | 22 +++ security/security.c | 109 ++++++++++++++ security/selinux/hooks.c | 242 ++++++++++++++++++++++-------- security/selinux/include/objsec.h | 11 ++ 14 files changed, 408 insertions(+), 82 deletions(-) -- 2.18.0.huawei.25

2 5

openEuler Kernel SIG双周例会
by openEuler conference 08 Jul '26

08 Jul '26

您好！ Kernel 邀请您参加 2026-07-10 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议发起人： LiaoTao_Wave 会议内容： 1. 进展update 2. 议题征集中（新增议题请填报至会议纪要看板）会议链接：https://meeting.huaweicloud.com:36443/#/j/968477591 会议纪要&签到链接：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2026-07-10 14:00 The subject of the conference is openEuler Kernel SIG双周例会 The sponsor of the conference is LiaoTao_Wave Summary: 1. 进展update 2. 议题征集中（新增议题请填报至会议纪要看板） You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/968477591 Add topics at https://etherpad.openeuler.org/p/Kernel-meetings More information: https://www.openeuler.org/en/

1 0

[PATCH OLK-6.6 0/4] Fix CVE-2026-46054
by Cai Xinchen 08 Jul '26

08 Jul '26

Backport the patch series "Fix incorrect overlayfs mmap() and mprotect() LSM access controls" [1] to OLK-6.6. The patch "fs: constify file ptr in backing_file accessor helpers" is backport to fix const warning. Amir Goldstein (2): fs: prepare for adding LSM blob to backing_file fs: constify file ptr in backing_file accessor helpers Paul Moore (2): lsm: add backing_file LSM hooks selinux: fix overlayfs mmap() and mprotect() access checks fs/backing-file.c | 15 +- fs/file_table.c | 54 ++++++- fs/fuse/passthrough.c | 2 +- fs/internal.h | 4 +- fs/overlayfs/file.c | 4 +- include/linux/backing-file.h | 2 +- include/linux/fs.h | 17 ++- include/linux/lsm_audit.h | 2 +- include/linux/lsm_hook_defs.h | 5 + include/linux/lsm_hooks.h | 1 + include/linux/security.h | 22 +++ security/security.c | 109 ++++++++++++++ security/selinux/hooks.c | 242 ++++++++++++++++++++++-------- security/selinux/include/objsec.h | 11 ++ 14 files changed, 408 insertions(+), 82 deletions(-) -- 2.18.0.huawei.25

2 8

[PATCH OLK-6.6] drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval()
by Hongtao Zhang 08 Jul '26

08 Jul '26

From: Harry Wentland <harry.wentland(a)amd.com> mainline inclusion from mainline-v7.1-rc7 commit e8b4d37eba05141ee01794fc6b7f2da808cee83b category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16039 CVE: CVE-2026-53330 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [Why & How] The aux_rd_interval array in struct dc_lttpr_caps is declared with MAX_REPEATER_CNT - 1 (7) elements, indexed 0..6. However, the offset parameter passed to dp_get_eq_aux_rd_interval() can be as large as MAX_REPEATER_CNT (8) when a sink reports 8 LTTPR repeaters via DPCD. This leads to an out-of-bounds read of aux_rd_interval[7] when offset is 8. Fix this by growing aux_rd_interval to MAX_REPEATER_CNT elements to accommodate the full range of valid repeater counts defined by the DP spec. Assisted-by: GitHub Copilot:Claude claude-4-opus Signed-off-by: Harry Wentland <harry.wentland(a)amd.com> Signed-off-by: Ray Wu <ray.wu(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> (cherry picked from commit a55a458a8df37a65ffda5cf721d554a8f74f6b04) Cc: stable(a)vger.kernel.org Conflicts: drivers/gpu/drm/amd/display/dc/dc_dp_types.h [conflicts due to not mergered de84d580126eb ("drm/amd/display: Read LTTPR ALPM caps during link cap retrieval")] Signed-off-by: Zhang Hongtao <zhanghongtao35(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/dc_dp_types.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/dc/dc_dp_types.h b/drivers/gpu/drm/amd/display/dc/dc_dp_types.h index 83719f5bea495..f834c0fa3b17c 100644 --- a/drivers/gpu/drm/amd/display/dc/dc_dp_types.h +++ b/drivers/gpu/drm/amd/display/dc/dc_dp_types.h @@ -1156,7 +1156,7 @@ struct dc_lttpr_caps { uint8_t max_ext_timeout; union dp_main_link_channel_coding_lttpr_cap main_link_channel_coding; union dp_128b_132b_supported_lttpr_link_rates supported_128b_132b_rates; - uint8_t aux_rd_interval[MAX_REPEATER_CNT - 1]; + uint8_t aux_rd_interval[MAX_REPEATER_CNT]; }; struct dc_dongle_dfp_cap_ext { -- 2.43.0

2 1

[PATCH OLK-5.10] drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval()
by Hongtao Zhang 08 Jul '26

08 Jul '26

From: Harry Wentland <harry.wentland(a)amd.com> mainline inclusion from mainline-v7.1-rc7 commit e8b4d37eba05141ee01794fc6b7f2da808cee83b category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16039 CVE: CVE-2026-53330 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [Why & How] The aux_rd_interval array in struct dc_lttpr_caps is declared with MAX_REPEATER_CNT - 1 (7) elements, indexed 0..6. However, the offset parameter passed to dp_get_eq_aux_rd_interval() can be as large as MAX_REPEATER_CNT (8) when a sink reports 8 LTTPR repeaters via DPCD. This leads to an out-of-bounds read of aux_rd_interval[7] when offset is 8. Fix this by growing aux_rd_interval to MAX_REPEATER_CNT elements to accommodate the full range of valid repeater counts defined by the DP spec. Assisted-by: GitHub Copilot:Claude claude-4-opus Signed-off-by: Harry Wentland <harry.wentland(a)amd.com> Signed-off-by: Ray Wu <ray.wu(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> (cherry picked from commit a55a458a8df37a65ffda5cf721d554a8f74f6b04) Cc: stable(a)vger.kernel.org Conflicts: drivers/gpu/drm/amd/display/dc/dc_types.h drivers/gpu/drm/amd/display/dc/dc_dp_types.h [conflicts due to not mergered de84d580126eb ("drm/amd/display: Read LTTPR ALPM caps during link cap retrieval")] Signed-off-by: Zhang Hongtao <zhanghongtao35(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/dc_types.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/dc/dc_types.h b/drivers/gpu/drm/amd/display/dc/dc_types.h index c47a19719de2c..6c7530b1ca039 100644 --- a/drivers/gpu/drm/amd/display/dc/dc_types.h +++ b/drivers/gpu/drm/amd/display/dc/dc_types.h @@ -438,7 +438,7 @@ struct dc_lttpr_caps { uint8_t max_link_rate; uint8_t phy_repeater_cnt; uint8_t max_ext_timeout; - uint8_t aux_rd_interval[MAX_REPEATER_CNT - 1]; + uint8_t aux_rd_interval[MAX_REPEATER_CNT]; }; struct dc_dongle_caps { -- 2.43.0

2 1

[PATCH OLK-6.6] drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs
by Hongtao Zhang 08 Jul '26

08 Jul '26

From: Harry Wentland <harry.wentland(a)amd.com> stable inclusion from stable-v6.6.143 commit 7fc4fab4acc307ad2903312c195872b2953d32c3 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15829 CVE: CVE-2026-53135 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit adf67034b1f61f7119295208085bfd43f85f56af upstream. [Why & How] dp_sdp_message_debugfs_write() dereferences connector->base.state->crtc without checking for NULL. A connector can be connected but not bound to any CRTC (e.g. after hot-plug before the next atomic commit), causing a kernel crash when writing to the sdp_message debugfs node. The function also ignores the user-provided size argument and always passes 36 bytes to copy_from_user(), reading past the user buffer when size < 36. Fix both issues by: - Returning -ENODEV when connector->base.state or state->crtc is NULL - Clamping write_size to min(size, sizeof(data)) Fixes: c7ba3653e977 ("drm/amd/display: Generic SDP message access in amdgpu") Assisted-by: Copilot:claude-opus-4.6 Reviewed-by: Alex Hung <alex.hung(a)amd.com> Signed-off-by: Harry Wentland <harry.wentland(a)amd.com> Signed-off-by: Ray Wu <ray.wu(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> (cherry picked from commit 6ab4c36a522842ff70474a1c0af2e40e50fc8300) Cc: stable(a)vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Hongtao <zhanghongtao35(a)huawei.com> --- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c index c8609595f324b..4b8101bf62e9d 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c @@ -1230,8 +1230,13 @@ static ssize_t dp_sdp_message_debugfs_write(struct file *f, const char __user *b if (size == 0) return 0; + if (!connector->base.state || !connector->base.state->crtc) + return -ENODEV; + acrtc_state = to_dm_crtc_state(connector->base.state->crtc->state); + write_size = min_t(size_t, size, sizeof(data)); + r = copy_from_user(data, buf, write_size); write_size -= r; -- 2.43.0

2 1

[PATCH OLK-5.10] drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs
by Hongtao Zhang 08 Jul '26

08 Jul '26

From: Harry Wentland <harry.wentland(a)amd.com> stable inclusion from stable-v5.10.259 commit ee9cfcf77a8e8af637396dc00966df5f701e661c category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15829 CVE: CVE-2026-53135 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit adf67034b1f61f7119295208085bfd43f85f56af upstream. [Why & How] dp_sdp_message_debugfs_write() dereferences connector->base.state->crtc without checking for NULL. A connector can be connected but not bound to any CRTC (e.g. after hot-plug before the next atomic commit), causing a kernel crash when writing to the sdp_message debugfs node. The function also ignores the user-provided size argument and always passes 36 bytes to copy_from_user(), reading past the user buffer when size < 36. Fix both issues by: - Returning -ENODEV when connector->base.state or state->crtc is NULL - Clamping write_size to min(size, sizeof(data)) Fixes: c7ba3653e977 ("drm/amd/display: Generic SDP message access in amdgpu") Assisted-by: Copilot:claude-opus-4.6 Reviewed-by: Alex Hung <alex.hung(a)amd.com> Signed-off-by: Harry Wentland <harry.wentland(a)amd.com> Signed-off-by: Ray Wu <ray.wu(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> (cherry picked from commit 6ab4c36a522842ff70474a1c0af2e40e50fc8300) Cc: stable(a)vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Hongtao <zhanghongtao35(a)huawei.com> --- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c index f4a1ad8959b7d..8b27ccae62b34 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c @@ -895,8 +895,13 @@ static ssize_t dp_sdp_message_debugfs_write(struct file *f, const char __user *b if (size == 0) return 0; + if (!connector->base.state || !connector->base.state->crtc) + return -ENODEV; + acrtc_state = to_dm_crtc_state(connector->base.state->crtc->state); + write_size = min_t(size_t, size, sizeof(data)); + r = copy_from_user(data, buf, write_size); write_size -= r; -- 2.43.0

2 1

[PATCH OLK-6.6] KVM: x86: Fix shadow paging use-after-free due to unexpected role
by Zhang Kunbo 08 Jul '26

08 Jul '26

From: Paolo Bonzini <pbonzini(a)redhat.com> stable inclusion from stable-v6.6.144 commit 9291654d69e08542de37755cebe4d5b02c3170d1 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16072 CVE: CVE-2026-53359 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 81ccda30b4e83d8f5cc4fd50503c44e3a33abfeb upstream. Commit 0cb2af2ea66ad ("KVM: x86: Fix shadow paging use-after-free due to unexpected GFN") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free. Fixes: 2032a93d66fa ("KVM: MMU: Don't allocate gfns page for direct mmu pages") Reported-by: Hyunwoo Kim <imv4bel(a)gmail.com> Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- arch/x86/kvm/mmu/mmu.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c index beef195edfe0..99d5810c8210 100644 --- a/arch/x86/kvm/mmu/mmu.c +++ b/arch/x86/kvm/mmu/mmu.c @@ -2347,13 +2347,15 @@ static struct kvm_mmu_page *kvm_mmu_get_child_sp(struct kvm_vcpu *vcpu, u64 *sptep, gfn_t gfn, bool direct, unsigned int access) { - union kvm_mmu_page_role role; + union kvm_mmu_page_role role = kvm_mmu_child_role(sptep, direct, access); - if (is_shadow_present_pte(*sptep) && !is_large_pte(*sptep) && - spte_to_child_sp(*sptep) && spte_to_child_sp(*sptep)->gfn == gfn) + if (is_shadow_present_pte(*sptep) && + !is_large_pte(*sptep) && + spte_to_child_sp(*sptep) && + spte_to_child_sp(*sptep)->gfn == gfn && + spte_to_child_sp(*sptep)->role.word == role.word) return ERR_PTR(-EEXIST); - role = kvm_mmu_child_role(sptep, direct, access); return kvm_mmu_get_shadow_page(vcpu, gfn, role); } -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] *** CVE-2026-53359 ***
by Zhang Kunbo 08 Jul '26

08 Jul '26

*** BLURB HERE *** Paolo Bonzini (1): KVM: x86: Fix shadow paging use-after-free due to unexpected role Sean Christopherson (1): KVM: x86: Fix shadow paging use-after-free due to unexpected GFN arch/x86/kvm/mmu/mmu.c | 41 ++++++++++++++++++----------------------- 1 file changed, 18 insertions(+), 23 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 v2 0/2] CVE-2026-53090
by Pu Lehui 08 Jul '26

08 Jul '26

Daniel Borkmann (2): bpf: Fix ld_{abs,ind} failure path analysis in subprogs selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs kernel/bpf/verifier.c | 17 +++ .../selftests/bpf/progs/verifier_ld_ind.c | 142 ++++++++++++++++++ 2 files changed, 159 insertions(+) -- 2.34.1

2 3

[PATCH OLK-5.10 v2] bpf: Fix ld_{abs,ind} failure path analysis in subprogs
by Pu Lehui 08 Jul '26

08 Jul '26

From: Daniel Borkmann <daniel(a)iogearbox.net> mainline inclusion from mainline-v7.1-rc1 commit ee861486e377edc55361c08dcbceab3f6b6577bd category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15793 CVE: CVE-2026-53090 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Usage of ld_{abs,ind} instructions got extended into subprogs some time ago via commit 09b28d76eac4 ("bpf: Add abnormal return checks."). These are only allowed in subprograms when the latter are BTF annotated and have scalar return types. The code generator in bpf_gen_ld_abs() has an abnormal exit path (r0=0 + exit) from legacy cBPF times. While the enforcement is on scalar return types, the verifier must also simulate the path of abnormal exit if the packet data load via ld_{abs,ind} failed. This is currently not the case. Fix it by having the verifier simulate both success and failure paths, and extend it in similar ways as we do for tail calls. The success path (r0=unknown, continue to next insn) is pushed onto stack for later validation and the r0=0 and return to the caller is done on the fall-through side. Fixes: 09b28d76eac4 ("bpf: Add abnormal return checks.") Reported-by: STAR Labs SG <info(a)starlabs.sg> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Link: https://lore.kernel.org/r/20260408191242.526279-2-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Conflicts: kernel/bpf/verifier.c [The current version does not introduce consumers corresponding to the output of jump tables; therefore, the assignment of jump tables is not involved. And mark_reg_scratched is for logging, so no need to backport it.] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/verifier.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index edeff06b04d4..9183cb84307e 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -8769,6 +8769,22 @@ static int check_ld_abs(struct bpf_verifier_env *env, struct bpf_insn *insn) mark_reg_unknown(env, regs, BPF_REG_0); /* ld_abs load up to 32-bit skb data. */ regs[BPF_REG_0].subreg_def = env->insn_idx + 1; + /* + * See bpf_gen_ld_abs() which emits a hidden BPF_EXIT with r0=0 + * which must be explored by the verifier when in a subprog. + */ + if (env->cur_state->curframe) { + struct bpf_verifier_state *branch; + + branch = push_stack(env, env->insn_idx + 1, env->insn_idx, false); + if (!branch) + return -EFAULT; + mark_reg_known_zero(env, regs, BPF_REG_0); + err = prepare_func_exit(env, &env->insn_idx); + if (err) + return err; + env->insn_idx--; + } return 0; } -- 2.34.1

2 1

[PATCH OLK-6.6] l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()
by Gu Bowen 08 Jul '26

08 Jul '26

From: Lee Jones <lee(a)kernel.org> mainline inclusion from mainline-v7.1-rc7 commit a213a8950414c684999dcf03edeea6c46ede172e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15948 CVE: CVE-2026-53262 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- pppol2tp_ioctl() read sock->sk->sk_user_data directly without any locks or reference counting. If a controllable sleep was induced during copy_from_user() (e.g. via a userfaultfd page fault sleep), a concurrent socket close could trigger pppol2tp_session_close() asynchronously. This frees the l2tp_session structure via the l2tp_session_del_work workqueue. Upon resuming, the ioctl thread dereferences the stale session pointer, resulting in a Use-After-Free (UAF). Fix this by securely fetching the session reference using the RCU-safe, refcounted helper pppol2tp_sock_to_session(sk) on entry. This locks the session's refcount across the sleep. We structured the function to exit via standard err breaks, guaranteeing that l2tp_session_put() is cleanly called on all return paths to drop the reference. To preserve existing behavior we validate the session and its magic signature only for the specific L2TP commands that require it. This ensures that generic/unknown ioctls called on an unconnected socket still return -ENOIOCTLCMD and correctly fall back to generic handlers (e.g. in sock_do_ioctl()). Signed-off-by: Lee Jones <lee(a)kernel.org> Fixes: fd558d186df2 ("l2tp: Split pppol2tp patch into separate l2tp and ppp parts") Link: https://patch.msgid.link/20260527133630.2120612-1-lee@kernel.org Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/l2tp/l2tp_ppp.c [Function l2tp_session_put() conflicts due to mainline commit abe7a1a7d0b6 ("l2tp: improve tunnel/session refcount helpers") and commit c5cbaef992d64 ("l2tp: refactor ppp socket/session relationship") not merge.] Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- net/l2tp/l2tp_ppp.c | 82 +++++++++++++++++++++++++++------------------ 1 file changed, 50 insertions(+), 32 deletions(-) diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c index 7ee095e854ae..de10e7783334 100644 --- a/net/l2tp/l2tp_ppp.c +++ b/net/l2tp/l2tp_ppp.c @@ -1055,64 +1055,76 @@ static int pppol2tp_ioctl(struct socket *sock, unsigned int cmd, { struct pppol2tp_ioc_stats stats; struct l2tp_session *session; + int err = 0; + + session = pppol2tp_sock_to_session(sock->sk); + /* Validate session presence and magic integrity ONLY for commands + * that belong to L2TP and require a valid session. + */ switch (cmd) { case PPPIOCGMRU: case PPPIOCGFLAGS: - session = sock->sk->sk_user_data; + case PPPIOCSMRU: + case PPPIOCSFLAGS: + case PPPIOCGL2TPSTATS: if (!session) return -ENOTCONN; - if (WARN_ON(session->magic != L2TP_SESSION_MAGIC)) + if (session->magic != L2TP_SESSION_MAGIC) { + sock_put(sock->sk); return -EBADF; + } + break; + default: + break; + } + switch (cmd) { + case PPPIOCGMRU: + case PPPIOCGFLAGS: /* Not defined for tunnels */ - if (!session->session_id && !session->peer_session_id) - return -ENOSYS; + if (!session->session_id && !session->peer_session_id) { + err = -ENOSYS; + break; + } - if (put_user(0, (int __user *)arg)) - return -EFAULT; + if (put_user(0, (int __user *)arg)) { + err = -EFAULT; + break; + } break; case PPPIOCSMRU: case PPPIOCSFLAGS: - session = sock->sk->sk_user_data; - if (!session) - return -ENOTCONN; - - if (WARN_ON(session->magic != L2TP_SESSION_MAGIC)) - return -EBADF; - /* Not defined for tunnels */ - if (!session->session_id && !session->peer_session_id) - return -ENOSYS; + if (!session->session_id && !session->peer_session_id) { + err = -ENOSYS; + break; + } - if (!access_ok((int __user *)arg, sizeof(int))) - return -EFAULT; + if (!access_ok((int __user *)arg, sizeof(int))) { + err = -EFAULT; + break; + } break; case PPPIOCGL2TPSTATS: - session = sock->sk->sk_user_data; - if (!session) - return -ENOTCONN; - - if (WARN_ON(session->magic != L2TP_SESSION_MAGIC)) - return -EBADF; - /* Session 0 represents the parent tunnel */ if (!session->session_id && !session->peer_session_id) { u32 session_id; - int err; if (copy_from_user(&stats, (void __user *)arg, - sizeof(stats))) - return -EFAULT; + sizeof(stats))) { + err = -EFAULT; + break; + } session_id = stats.session_id; err = pppol2tp_tunnel_copy_stats(&stats, session->tunnel); if (err < 0) - return err; + break; stats.session_id = session_id; } else { @@ -1122,15 +1134,21 @@ static int pppol2tp_ioctl(struct socket *sock, unsigned int cmd, stats.tunnel_id = session->tunnel->tunnel_id; stats.using_ipsec = l2tp_tunnel_uses_xfrm(session->tunnel); - if (copy_to_user((void __user *)arg, &stats, sizeof(stats))) - return -EFAULT; + if (copy_to_user((void __user *)arg, &stats, sizeof(stats))) { + err = -EFAULT; + break; + } break; default: - return -ENOIOCTLCMD; + err = -ENOIOCTLCMD; + break; } - return 0; + if (session) + sock_put(sock->sk); + + return err; } /***************************************************************************** -- 2.43.0

2 1

[PATCH OLK-5.10 0/2] CVE-2026-52918
by Xia Fukun 07 Jul '26

07 Jul '26

CVE-2026-52918 Jiexun Wang (1): Bluetooth: serialize accept_q access Luiz Augusto von Dentz (1): Bluetooth: Init sk_peer_* on bt_sock_alloc include/net/bluetooth/bluetooth.h | 1 + net/bluetooth/af_bluetooth.c | 111 ++++++++++++++++++++++++------ net/bluetooth/hidp/sock.c | 10 +-- net/bluetooth/l2cap_sock.c | 19 ----- 4 files changed, 91 insertions(+), 50 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] arm64: stacktrace: Don't WARN when unwinding other tasks
by Tengda Wu 07 Jul '26

07 Jul '26

From: Mark Rutland <mark.rutland(a)arm.com> mainline inclusion from mainline-v6.13-rc3 commit 65ac33bed8b9255213b08ed153dbe9c0ca3535e6 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9572 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The arm64 stacktrace code has a few error conditions where a WARN_ON_ONCE() is triggered before the stacktrace is terminated and an error is returned to the caller. The conditions shouldn't be triggered when unwinding the current task, but it is possible to trigger these when unwinding another task which is not blocked, as the stack of that task is concurrently modified. Kent reports that these warnings can be triggered while running filesystem tests on bcachefs, which calls the stacktrace code directly. To produce a meaningful stacktrace of another task, the task in question should be blocked, but the stacktrace code is expected to be robust to cases where it is not blocked. Note that this is purely about not unuduly scaring the user and/or crashing the kernel; stacktraces in such cases are meaningless and may leak kernel secrets from the stack of the task being unwound. Ideally we'd pin the task in a blocked state during the unwind, as we do for /proc/${PID}/wchan since commit: 42a20f86dc19f928 ("sched: Add wrapper for get_wchan() to keep task blocked") ... but a bunch of places don't do that, notably /proc/${PID}/stack, where we don't pin the task in a blocked state, but do restrict the output to privileged users since commit: f8a00cef17206ecd ("proc: restrict kernel stack dumps to root") ... and so it's possible to trigger these warnings accidentally, e.g. by reading /proc/*/stack (as root): | for n in $(seq 1 10); do | while true; do cat /proc/*/stack > /dev/null 2>&1; done & | done | ------------[ cut here ]------------ | WARNING: CPU: 3 PID: 166 at arch/arm64/kernel/stacktrace.c:207 arch_stack_walk+0x1c8/0x370 | Modules linked in: | CPU: 3 UID: 0 PID: 166 Comm: cat Not tainted 6.13.0-rc2-00003-g3dafa7a7925d #2 | Hardware name: linux,dummy-virt (DT) | pstate: 81400005 (Nzcv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) | pc : arch_stack_walk+0x1c8/0x370 | lr : arch_stack_walk+0x1b0/0x370 | sp : ffff800080773890 | x29: ffff800080773930 x28: fff0000005c44500 x27: fff00000058fa038 | x26: 000000007ffff000 x25: 0000000000000000 x24: 0000000000000000 | x23: ffffa35a8d9600ec x22: 0000000000000000 x21: fff00000043a33c0 | x20: ffff800080773970 x19: ffffa35a8d960168 x18: 0000000000000000 | x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 | x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 | x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000 | x8 : ffff8000807738e0 x7 : ffff8000806e3800 x6 : ffff8000806e3818 | x5 : ffff800080773920 x4 : ffff8000806e4000 x3 : ffff8000807738e0 | x2 : 0000000000000018 x1 : ffff8000806e3800 x0 : 0000000000000000 | Call trace: | arch_stack_walk+0x1c8/0x370 (P) | stack_trace_save_tsk+0x8c/0x108 | proc_pid_stack+0xb0/0x134 | proc_single_show+0x60/0x120 | seq_read_iter+0x104/0x438 | seq_read+0xf8/0x140 | vfs_read+0xc4/0x31c | ksys_read+0x70/0x108 | __arm64_sys_read+0x1c/0x28 | invoke_syscall+0x48/0x104 | el0_svc_common.constprop.0+0x40/0xe0 | do_el0_svc+0x1c/0x28 | el0_svc+0x30/0xcc | el0t_64_sync_handler+0x10c/0x138 | el0t_64_sync+0x198/0x19c | ---[ end trace 0000000000000000 ]--- Fix this by only warning when unwinding the current task. When unwinding another task the error conditions will be handled by returning an error without producing a warning. The two warnings in kunwind_next_frame_record_meta() were added recently as part of commit: c2c6b27b5aa14fa2 ("arm64: stacktrace: unwind exception boundaries") The warning when recovering the fgraph return address has changed form many times, but was originally introduced back in commit: 9f416319f40cd857 ("arm64: fix unwind_frame() for filtered out fn for function graph tracing") Fixes: c2c6b27b5aa1 ("arm64: stacktrace: unwind exception boundaries") Fixes: 9f416319f40c ("arm64: fix unwind_frame() for filtered out fn for function graph tracing") Signed-off-by: Mark Rutland <mark.rutland(a)arm.com> Reported-by: Kent Overstreet <kent.overstreet(a)linux.dev> Cc: Kees Cook <keescook(a)chromium.org> Cc: Peter Zijlstra <peterz(a)infradead.org> Cc: Will Deacon <will(a)kernel.org> Link: https://lore.kernel.org/r/20241211140704.2498712-3-mark.rutland@arm.com Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com> Conflicts: arch/arm64/kernel/stacktrace.c [c2c6b27b5aa1 ("arm64: stacktrace: unwind exception boundaries") This commit introduces an unwind-boundary feature that is not required for this backport.] Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- arch/arm64/kernel/stacktrace.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/arch/arm64/kernel/stacktrace.c b/arch/arm64/kernel/stacktrace.c index 17f66a74c745..80cd45e4a922 100644 --- a/arch/arm64/kernel/stacktrace.c +++ b/arch/arm64/kernel/stacktrace.c @@ -81,8 +81,10 @@ unwind_recover_return_address(struct unwind_state *state) unsigned long orig_pc; orig_pc = ftrace_graph_ret_addr(state->task, NULL, state->pc, (void *)state->fp); - if (WARN_ON_ONCE(state->pc == orig_pc)) + if (state->pc == orig_pc) { + WARN_ON_ONCE(state->task == current); return -EINVAL; + } state->pc = orig_pc; } #endif /* CONFIG_FUNCTION_GRAPH_TRACER */ -- 2.34.1

2 1

[PATCH OLK-5.10] bpf: Fix ld_{abs,ind} failure path analysis in subprogs
by Pu Lehui 07 Jul '26

07 Jul '26

From: Daniel Borkmann <daniel(a)iogearbox.net> mainline inclusion from mainline-v7.1-rc1 commit ee861486e377edc55361c08dcbceab3f6b6577bd category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15793 CVE: CVE-2026-53090 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Usage of ld_{abs,ind} instructions got extended into subprogs some time ago via commit 09b28d76eac4 ("bpf: Add abnormal return checks."). These are only allowed in subprograms when the latter are BTF annotated and have scalar return types. The code generator in bpf_gen_ld_abs() has an abnormal exit path (r0=0 + exit) from legacy cBPF times. While the enforcement is on scalar return types, the verifier must also simulate the path of abnormal exit if the packet data load via ld_{abs,ind} failed. This is currently not the case. Fix it by having the verifier simulate both success and failure paths, and extend it in similar ways as we do for tail calls. The success path (r0=unknown, continue to next insn) is pushed onto stack for later validation and the r0=0 and return to the caller is done on the fall-through side. Fixes: 09b28d76eac4 ("bpf: Add abnormal return checks.") Reported-by: STAR Labs SG <info(a)starlabs.sg> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Link: https://lore.kernel.org/r/20260408191242.526279-2-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Conflicts: kernel/bpf/verifier.c [The current version does not introduce consumers corresponding to the output of jump tables; therefore, the assignment of jump tables is not involved. And mark_reg_scratched is for logging, so no need to backport it.] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/verifier.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index edeff06b04d4..ad90fe6224db 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -8769,6 +8769,22 @@ static int check_ld_abs(struct bpf_verifier_env *env, struct bpf_insn *insn) mark_reg_unknown(env, regs, BPF_REG_0); /* ld_abs load up to 32-bit skb data. */ regs[BPF_REG_0].subreg_def = env->insn_idx + 1; + /* + * See bpf_gen_ld_abs() which emits a hidden BPF_EXIT with r0=0 + * which must be explored by the verifier when in a subprog. + */ + if (env->cur_state->curframe) { + struct bpf_verifier_state *branch; + + branch = push_stack(env, env->insn_idx + 1, env->insn_idx, false); + if (IS_ERR(branch)) + return PTR_ERR(branch); + mark_reg_known_zero(env, regs, BPF_REG_0); + err = prepare_func_exit(env, &env->insn_idx); + if (err) + return err; + env->insn_idx--; + } return 0; } -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] CVE-2026-53090
by Pu Lehui 07 Jul '26

07 Jul '26

Daniel Borkmann (2): bpf: Fix ld_{abs,ind} failure path analysis in subprogs selftests/bpf: Add tests for ld_{abs,ind} failure path in subprogs kernel/bpf/verifier.c | 17 +++ .../selftests/bpf/progs/verifier_ld_ind.c | 142 ++++++++++++++++++ 2 files changed, 159 insertions(+) -- 2.34.1

2 3

[PATCH OLK-6.6] USB: serial: io_ti: fix heap overflow in get_manuf_info()
by Liu Mingrui 07 Jul '26

07 Jul '26

From: Adrian Korwel <adriank20047(a)gmail.com> stable inclusion from stable-v6.6.143 commit d92f17af7097d10bdeddf26f66f34b354104b277 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15882 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 183c1076eca43bbb3e7bdf597456f91d81c73e74 upstream. get_manuf_info() reads le16_to_cpu(rom_desc->Size) bytes from the device I2C EEPROM into a buffer allocated with kmalloc_obj(), which is sizeof(struct edge_ti_manuf_descriptor) = 10 bytes. The Size field comes from the device and is only validated (in check_i2c_image()) to make sure the descriptor fits within TI_MAX_I2C_SIZE (16384 bytes), not against the destination buffer size. A malicious USB device can therefore set Size to any value up to 16377, causing a heap overflow of up to 16367 bytes when plugged into a host running this driver. valid_csum() is called after read_rom() and also iterates buffer[0..Size-1], compounding the out-of-bounds access. Fix by rejecting descriptors with unexpected length before calling read_rom(). Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable(a)vger.kernel.org Signed-off-by: Adrian Korwel <adriank20047(a)gmail.com> [ johan: amend commit message; also check for short descriptors ] Signed-off-by: Johan Hovold <johan(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Hulk Robot <hulkci(a)huawei.com> Signed-off-by: Mingrui Liu <liumingrui(a)huawei.com> --- drivers/usb/serial/io_ti.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c index c41fbc321b35..45184faf02bc 100644 --- a/drivers/usb/serial/io_ti.c +++ b/drivers/usb/serial/io_ti.c @@ -773,6 +773,12 @@ static int get_manuf_info(struct edgeport_serial *serial, u8 *buffer) } /* Read the descriptor data */ + if (le16_to_cpu(rom_desc->Size) != sizeof(struct edge_ti_manuf_descriptor)) { + dev_err(dev, "unexpected Edge descriptor length: %u\n", + le16_to_cpu(rom_desc->Size)); + status = -EINVAL; + goto exit; + } status = read_rom(serial, start_address+sizeof(struct ti_i2c_desc), le16_to_cpu(rom_desc->Size), buffer); if (status) -- 2.34.1

2 1

[PATCH OLK-6.6] drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED
by Jiacheng Yu 07 Jul '26

07 Jul '26

From: Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> mainline inclusion from mainline-v7.1-rc4 commit 183182235f6d53bac62c6c39014738a54a68dfa6 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15974 CVE: CVE-2026-53285 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [Why] dcn32_validate_bandwidth() wraps dcn32_internal_validate_bw() with DC_FP_START()/DC_FP_END(). In x86 non-RT, DC_FP_START takes fpregs_lock(), which disables local softirqs. The DML1 path through dcn32_enable_phantom_plane() calls kvzalloc() to allocate ~335 KiB for dc_plane_state. This triggers the vmalloc path, which calls BUG_ON(in_interrupt()) because it's invoked within the FPU-enabled (softirq disabled) region, leading to a kernel crash. [How] Wrap the dc_state_create_phantom_plane() call with the DC_RUN_WITH_PREEMPTION_ENABLED() macro to allow preemption during this memory allocation. Fixes: 235c67634230 ("drm/amd/display: add DCN32/321 specific files for Display Core") Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/4470 Reviewed-by: Aurabindo Pillai <aurabindo.pillai(a)amd.com> Signed-off-by: Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> Signed-off-by: James Lin <pinglei.lin(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> (cherry picked from commit 885ccbef7b94a8b38f69c4211c679021aa27ad11) Cc: stable(a)vger.kernel.org Conflicts: drivers/gpu/drm/amd/display/amdgpu_dm/dc_fpu.h drivers/gpu/drm/amd/display/amdgpu_dm/dc_fpu.c drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c drivers/gpu/drm/amd/display/dc/resource/dcn32/dcn32_resource.c [3539437f354b drm/amd/display: Move FPU Guards From DML To DC - Part 1, not commited.] Signed-off-by: Jiacheng Yu <yujiacheng3(a)huawei.com> --- .../gpu/drm/amd/display/amdgpu_dm/dc_fpu.c | 19 +++++++++++++++++++ .../gpu/drm/amd/display/amdgpu_dm/dc_fpu.h | 15 +++++++++++++++ .../drm/amd/display/dc/dcn32/dcn32_resource.c | 9 ++++++++- 3 files changed, 42 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/dc_fpu.c b/drivers/gpu/drm/amd/display/amdgpu_dm/dc_fpu.c index 172aa10a8800..e4455be0c99a 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/dc_fpu.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/dc_fpu.c @@ -69,6 +69,25 @@ inline void dc_assert_fp_enabled(void) ASSERT(depth >= 1); } +/** + * dc_is_fp_enabled - Check if FPU protection is enabled + * + * This function tells if the code is already under FPU protection or not. A + * function that works as an API for a set of FPU operations can use this + * function for checking if the caller invoked it after DC_FP_START(). For + * example, take a look at dcn20_fpu.c file. + * + * Similar to dc_assert_fp_enabled, but does not assert, returns status instead. + */ +inline bool dc_is_fp_enabled(void) +{ + int depth; + + depth = this_cpu_read(fpu_recursion_depth); + + return (depth >= 1); +} + /** * dc_fpu_begin - Enables FPU protection * @function_name: A string containing the function name for debug purposes diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/dc_fpu.h b/drivers/gpu/drm/amd/display/amdgpu_dm/dc_fpu.h index b8275b397920..e968589d75ef 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/dc_fpu.h +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/dc_fpu.h @@ -28,7 +28,22 @@ #define __DC_FPU_H__ void dc_assert_fp_enabled(void); +bool dc_is_fp_enabled(void); void dc_fpu_begin(const char *function_name, const int line); void dc_fpu_end(const char *function_name, const int line); +#ifdef CONFIG_DRM_AMD_DC_FP +#define DC_RUN_WITH_PREEMPTION_ENABLED(code) \ + do { \ + bool dc_fp_enabled = dc_is_fp_enabled(); \ + if (dc_fp_enabled) \ + dc_fpu_end(__func__, __LINE__); \ + code; \ + if (dc_fp_enabled) \ + dc_fpu_begin(__func__, __LINE__); \ + } while (0) +#else +#define DC_RUN_WITH_PREEMPTION_ENABLED(code) code +#endif /* CONFIG_DRM_AMD_DC_FP */ + #endif /* __DC_FPU_H__ */ diff --git a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c index ab6b4f44f537..bdd1fc574d6a 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c +++ b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c @@ -89,6 +89,12 @@ #include "dcn20/dcn20_vmid.h" #include "dml/dcn32/dcn32_fpu.h" +#include "amdgpu_dm/dc_fpu.h" + +#if !defined(DC_RUN_WITH_PREEMPTION_ENABLED) +#define DC_RUN_WITH_PREEMPTION_ENABLED(code) code +#endif + #define DC_LOGGER_INIT(logger) enum dcn32_clk_src_array_id { @@ -1643,7 +1649,8 @@ static void dcn32_enable_phantom_plane(struct dc *dc, if (curr_pipe->top_pipe && curr_pipe->top_pipe->plane_state == curr_pipe->plane_state) phantom_plane = prev_phantom_plane; else - phantom_plane = dc_create_plane_state(dc); + DC_RUN_WITH_PREEMPTION_ENABLED(phantom_plane = + dc_create_plane_state(dc)); if (!phantom_plane) continue; -- 2.34.1

2 1

[PATCH OLK-6.6] drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths
by Jiacheng Yu 07 Jul '26

07 Jul '26

From: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> mainline inclusion from mainline-v7.1-rc1 commit 4ae3e16f4b3bf64140f773629b765d605ee079a9 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16001 CVE: CVE-2026-53313 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In dc_dmub_srv_log_diagnostic_data() and dc_dmub_srv_enable_dpia_trace(). Both functions check: if (!dc_dmub_srv || !dc_dmub_srv->dmub) and then call DC_LOG_ERROR() inside that block. DC_LOG_ERROR() uses dc_dmub_srv->ctx internally. So if dc_dmub_srv is NULL, the logging itself can dereference a NULL pointer and cause a crash. Fix this by splitting the checks. First check if dc_dmub_srv is NULL and return immediately. Then check dc_dmub_srv->dmub and log the error only when dc_dmub_srv is valid. Fixes the below: ../display/dc/dc_dmub_srv.c:962 dc_dmub_srv_log_diagnostic_data() error: we previously assumed 'dc_dmub_srv' could be null (see line 961) ../display/dc/dc_dmub_srv.c:1167 dc_dmub_srv_enable_dpia_trace() error: we previously assumed 'dc_dmub_srv' could be null (see line 1166) Fixes: 2631ac1ac328 ("drm/amd/display: add DMUB registers to crash dump diagnostic data.") Fixes: 71ba6b577a35 ("drm/amd/display: Add interface to enable DPIA trace") Cc: Roman Li <roman.li(a)amd.com> Cc: Alex Hung <alex.hung(a)amd.com> Cc: Tom Chung <chiahsuan.chung(a)amd.com> Cc: Dan Carpenter <dan.carpenter(a)linaro.org> Cc: Aurabindo Pillai <aurabindo.pillai(a)amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> Reviewed-by: Alex Hung <alex.hung(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Conflicts: drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c [context conflicts] Signed-off-by: Jiacheng Yu <yujiacheng3(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c b/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c index 8344957d7449..a579366e7698 100644 --- a/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c +++ b/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c @@ -796,7 +796,10 @@ void dc_dmub_srv_log_diagnostic_data(struct dc_dmub_srv *dc_dmub_srv) { struct dmub_diagnostic_data diag_data = {0}; - if (!dc_dmub_srv || !dc_dmub_srv->dmub) { + if (!dc_dmub_srv) + return; + + if (!dc_dmub_srv->dmub) { DC_LOG_ERROR("%s: invalid parameters.", __func__); return; } @@ -1037,7 +1040,10 @@ void dc_dmub_srv_enable_dpia_trace(const struct dc *dc) enum dmub_status status; static const uint32_t timeout_us = 30; - if (!dc_dmub_srv || !dc_dmub_srv->dmub) { + if (!dc_dmub_srv) + return; + + if (!dc_dmub_srv->dmub) { DC_LOG_ERROR("%s: invalid parameters.", __func__); return; } -- 2.34.1

2 1

[PATCH OLK-6.6] Bluetooth: serialize accept_q access
by Xia Fukun 07 Jul '26

07 Jul '26

From: Jiexun Wang <wangjiexun2025(a)gmail.com> stable inclusion from stable-v6.6.142 commit be43e6b4043113c3b3cf887c3c8350f67140274c category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15621 CVE: CVE-2026-52918 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e83f5e24da741fa9405aeeff00b08c5ee7c37b88 upstream. bt_sock_poll() walks the accept queue without synchronization, while child teardown can unlink the same socket and drop its last reference. The unsynchronized accept queue walk has existed since the initial Bluetooth import. Protect accept_q with a dedicated lock for queue updates and polling. Also rework bt_accept_dequeue() to take temporary child references under the queue lock before dropping it and locking the child socket. Fixes: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ("Linux-2.6.12-rc2") Cc: stable(a)vger.kernel.org Reported-by: Jann Horn <jannh(a)google.com> Reported-by: Yuan Tan <yuantan098(a)gmail.com> Reported-by: Yifan Wu <yifanwucs(a)gmail.com> Reported-by: Juefei Pu <tomapufckgml(a)gmail.com> Reported-by: Xin Liu <bird(a)lzu.edu.cn> Signed-off-by: Jiexun Wang <wangjiexun2025(a)gmail.com> Signed-off-by: Ren Wei <n05ec(a)lzu.edu.cn> Signed-off-by: Jiexun Wang <wangjiexun2025(a)gmail.com> Reviewed-by: Jann Horn <jannh(a)google.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- include/net/bluetooth/bluetooth.h | 1 + net/bluetooth/af_bluetooth.c | 87 +++++++++++++++++++++++-------- 2 files changed, 66 insertions(+), 22 deletions(-) diff --git a/include/net/bluetooth/bluetooth.h b/include/net/bluetooth/bluetooth.h index c25f9f4cac80..7673228cd697 100644 --- a/include/net/bluetooth/bluetooth.h +++ b/include/net/bluetooth/bluetooth.h @@ -380,6 +380,7 @@ void baswap(bdaddr_t *dst, const bdaddr_t *src); struct bt_sock { struct sock sk; struct list_head accept_q; + spinlock_t accept_q_lock; /* protects accept_q */ struct sock *parent; unsigned long flags; void (*skb_msg_name)(struct sk_buff *, void *, int *); diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c index 69047e533db1..53a4792ae75d 100644 --- a/net/bluetooth/af_bluetooth.c +++ b/net/bluetooth/af_bluetooth.c @@ -151,6 +151,7 @@ struct sock *bt_sock_alloc(struct net *net, struct socket *sock, sock_init_data(sock, sk); INIT_LIST_HEAD(&bt_sk(sk)->accept_q); + spin_lock_init(&bt_sk(sk)->accept_q_lock); sock_reset_flag(sk, SOCK_ZAPPED); @@ -211,6 +212,7 @@ void bt_accept_enqueue(struct sock *parent, struct sock *sk, bool bh) { const struct cred *old_cred; struct pid *old_pid; + struct bt_sock *par = bt_sk(parent); BT_DBG("parent %p, sk %p", parent, sk); @@ -221,9 +223,13 @@ void bt_accept_enqueue(struct sock *parent, struct sock *sk, bool bh) else lock_sock_nested(sk, SINGLE_DEPTH_NESTING); - list_add_tail(&bt_sk(sk)->accept_q, &bt_sk(parent)->accept_q); bt_sk(sk)->parent = parent; + spin_lock_bh(&par->accept_q_lock); + list_add_tail(&bt_sk(sk)->accept_q, &par->accept_q); + sk_acceptq_added(parent); + spin_unlock_bh(&par->accept_q_lock); + /* Copy credentials from parent since for incoming connections the * socket is allocated by the kernel. */ @@ -241,8 +247,6 @@ void bt_accept_enqueue(struct sock *parent, struct sock *sk, bool bh) bh_unlock_sock(sk); else release_sock(sk); - - sk_acceptq_added(parent); } EXPORT_SYMBOL(bt_accept_enqueue); @@ -251,45 +255,72 @@ EXPORT_SYMBOL(bt_accept_enqueue); */ void bt_accept_unlink(struct sock *sk) { + struct sock *parent = bt_sk(sk)->parent; + BT_DBG("sk %p state %d", sk, sk->sk_state); + spin_lock_bh(&bt_sk(parent)->accept_q_lock); list_del_init(&bt_sk(sk)->accept_q); - sk_acceptq_removed(bt_sk(sk)->parent); + sk_acceptq_removed(parent); + spin_unlock_bh(&bt_sk(parent)->accept_q_lock); bt_sk(sk)->parent = NULL; sock_put(sk); } EXPORT_SYMBOL(bt_accept_unlink); +static struct sock *bt_accept_get(struct sock *parent, struct sock *sk) +{ + struct bt_sock *bt = bt_sk(parent); + struct sock *next = NULL; + + /* accept_q is modified from child teardown paths too, so take a + * temporary reference before dropping the queue lock. + */ + spin_lock_bh(&bt->accept_q_lock); + + if (sk) { + if (bt_sk(sk)->parent != parent) + goto out; + + if (!list_is_last(&bt_sk(sk)->accept_q, &bt->accept_q)) { + next = &list_next_entry(bt_sk(sk), accept_q)->sk; + sock_hold(next); + } + } else if (!list_empty(&bt->accept_q)) { + next = &list_first_entry(&bt->accept_q, + struct bt_sock, accept_q)->sk; + sock_hold(next); + } + +out: + spin_unlock_bh(&bt->accept_q_lock); + return next; +} + struct sock *bt_accept_dequeue(struct sock *parent, struct socket *newsock) { - struct bt_sock *s, *n; - struct sock *sk; + struct sock *sk, *next; BT_DBG("parent %p", parent); restart: - list_for_each_entry_safe(s, n, &bt_sk(parent)->accept_q, accept_q) { - sk = (struct sock *)s; - + for (sk = bt_accept_get(parent, NULL); sk; sk = next) { /* Prevent early freeing of sk due to unlink and sock_kill */ - sock_hold(sk); lock_sock(sk); /* Check sk has not already been unlinked via * bt_accept_unlink() due to serialisation caused by sk locking */ - if (!bt_sk(sk)->parent) { + if (bt_sk(sk)->parent != parent) { BT_DBG("sk %p, already unlinked", sk); release_sock(sk); sock_put(sk); - /* Restart the loop as sk is no longer in the list - * and also avoid a potential infinite loop because - * list_for_each_entry_safe() is not thread safe. - */ goto restart; } + next = bt_accept_get(parent, sk); + /* sk is safely in the parent list so reduce reference count */ sock_put(sk); @@ -317,6 +348,8 @@ struct sock *bt_accept_dequeue(struct sock *parent, struct socket *newsock) sock_hold(sk); release_sock(sk); + if (next) + sock_put(next); return sk; } @@ -518,18 +551,28 @@ EXPORT_SYMBOL(bt_sock_stream_recvmsg); static inline __poll_t bt_accept_poll(struct sock *parent) { - struct bt_sock *s, *n; + struct bt_sock *bt = bt_sk(parent); + struct bt_sock *s; struct sock *sk; + __poll_t mask = 0; + + spin_lock_bh(&bt->accept_q_lock); + list_for_each_entry(s, &bt->accept_q, accept_q) { + int state; - list_for_each_entry_safe(s, n, &bt_sk(parent)->accept_q, accept_q) { sk = (struct sock *)s; - if (sk->sk_state == BT_CONNECTED || - (test_bit(BT_SK_DEFER_SETUP, &bt_sk(parent)->flags) && - sk->sk_state == BT_CONNECT2)) - return EPOLLIN | EPOLLRDNORM; + state = READ_ONCE(sk->sk_state); + + if (state == BT_CONNECTED || + (test_bit(BT_SK_DEFER_SETUP, &bt->flags) && + state == BT_CONNECT2)) { + mask = EPOLLIN | EPOLLRDNORM; + break; + } } + spin_unlock_bh(&bt->accept_q_lock); - return 0; + return mask; } __poll_t bt_sock_poll(struct file *file, struct socket *sock, -- 2.34.1

2 1

[PATCH OLK-6.6] l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()
by Gu Bowen 07 Jul '26

07 Jul '26

From: Lee Jones <lee(a)kernel.org> mainline inclusion from mainline-v7.1-rc7 commit a213a8950414c684999dcf03edeea6c46ede172e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15948 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- pppol2tp_ioctl() read sock->sk->sk_user_data directly without any locks or reference counting. If a controllable sleep was induced during copy_from_user() (e.g. via a userfaultfd page fault sleep), a concurrent socket close could trigger pppol2tp_session_close() asynchronously. This frees the l2tp_session structure via the l2tp_session_del_work workqueue. Upon resuming, the ioctl thread dereferences the stale session pointer, resulting in a Use-After-Free (UAF). Fix this by securely fetching the session reference using the RCU-safe, refcounted helper pppol2tp_sock_to_session(sk) on entry. This locks the session's refcount across the sleep. We structured the function to exit via standard err breaks, guaranteeing that l2tp_session_put() is cleanly called on all return paths to drop the reference. To preserve existing behavior we validate the session and its magic signature only for the specific L2TP commands that require it. This ensures that generic/unknown ioctls called on an unconnected socket still return -ENOIOCTLCMD and correctly fall back to generic handlers (e.g. in sock_do_ioctl()). Signed-off-by: Lee Jones <lee(a)kernel.org> Fixes: fd558d186df2 ("l2tp: Split pppol2tp patch into separate l2tp and ppp parts") Link: https://patch.msgid.link/20260527133630.2120612-1-lee@kernel.org Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/l2tp/l2tp_ppp.c [Function l2tp_session_put() conflicts due to mainline commit abe7a1a7d0b6 ("l2tp: improve tunnel/session refcount helpers") and commit c5cbaef992d64 ("l2tp: refactor ppp socket/session relationship") not merge.] Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- net/l2tp/l2tp_ppp.c | 82 +++++++++++++++++++++++++++------------------ 1 file changed, 50 insertions(+), 32 deletions(-) diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c index 7ee095e854ae..de10e7783334 100644 --- a/net/l2tp/l2tp_ppp.c +++ b/net/l2tp/l2tp_ppp.c @@ -1055,64 +1055,76 @@ static int pppol2tp_ioctl(struct socket *sock, unsigned int cmd, { struct pppol2tp_ioc_stats stats; struct l2tp_session *session; + int err = 0; + + session = pppol2tp_sock_to_session(sock->sk); + /* Validate session presence and magic integrity ONLY for commands + * that belong to L2TP and require a valid session. + */ switch (cmd) { case PPPIOCGMRU: case PPPIOCGFLAGS: - session = sock->sk->sk_user_data; + case PPPIOCSMRU: + case PPPIOCSFLAGS: + case PPPIOCGL2TPSTATS: if (!session) return -ENOTCONN; - if (WARN_ON(session->magic != L2TP_SESSION_MAGIC)) + if (session->magic != L2TP_SESSION_MAGIC) { + sock_put(sock->sk); return -EBADF; + } + break; + default: + break; + } + switch (cmd) { + case PPPIOCGMRU: + case PPPIOCGFLAGS: /* Not defined for tunnels */ - if (!session->session_id && !session->peer_session_id) - return -ENOSYS; + if (!session->session_id && !session->peer_session_id) { + err = -ENOSYS; + break; + } - if (put_user(0, (int __user *)arg)) - return -EFAULT; + if (put_user(0, (int __user *)arg)) { + err = -EFAULT; + break; + } break; case PPPIOCSMRU: case PPPIOCSFLAGS: - session = sock->sk->sk_user_data; - if (!session) - return -ENOTCONN; - - if (WARN_ON(session->magic != L2TP_SESSION_MAGIC)) - return -EBADF; - /* Not defined for tunnels */ - if (!session->session_id && !session->peer_session_id) - return -ENOSYS; + if (!session->session_id && !session->peer_session_id) { + err = -ENOSYS; + break; + } - if (!access_ok((int __user *)arg, sizeof(int))) - return -EFAULT; + if (!access_ok((int __user *)arg, sizeof(int))) { + err = -EFAULT; + break; + } break; case PPPIOCGL2TPSTATS: - session = sock->sk->sk_user_data; - if (!session) - return -ENOTCONN; - - if (WARN_ON(session->magic != L2TP_SESSION_MAGIC)) - return -EBADF; - /* Session 0 represents the parent tunnel */ if (!session->session_id && !session->peer_session_id) { u32 session_id; - int err; if (copy_from_user(&stats, (void __user *)arg, - sizeof(stats))) - return -EFAULT; + sizeof(stats))) { + err = -EFAULT; + break; + } session_id = stats.session_id; err = pppol2tp_tunnel_copy_stats(&stats, session->tunnel); if (err < 0) - return err; + break; stats.session_id = session_id; } else { @@ -1122,15 +1134,21 @@ static int pppol2tp_ioctl(struct socket *sock, unsigned int cmd, stats.tunnel_id = session->tunnel->tunnel_id; stats.using_ipsec = l2tp_tunnel_uses_xfrm(session->tunnel); - if (copy_to_user((void __user *)arg, &stats, sizeof(stats))) - return -EFAULT; + if (copy_to_user((void __user *)arg, &stats, sizeof(stats))) { + err = -EFAULT; + break; + } break; default: - return -ENOIOCTLCMD; + err = -ENOIOCTLCMD; + break; } - return 0; + if (session) + sock_put(sock->sk); + + return err; } /***************************************************************************** -- 2.43.0

2 1

[PATCH OLK-5.10] drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size
by Jiacheng Yu 07 Jul '26

07 Jul '26

From: Harry Wentland <harry.wentland(a)amd.com> mainline inclusion from mainline-v7.1-rc7 commit f0f3981c43b32cadfe373d636d9e9ca522bb3702 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15831 CVE: CVE-2026-53137 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [Why & How] During HDCP 2.x repeater authentication over HDMI, the driver reads the sink's RxStatus register and extracts a 10-bit message size field (max value 1023). This value is used as the read length for the ReceiverID list without being clamped to the size of the destination buffer rx_id_list[177]. A malicious HDMI repeater could advertise a message size larger than the buffer, causing an out-of-bounds write during the I2C read. Clamp the read length in mod_hdcp_read_rx_id_list() to the size of the rx_id_list buffer, matching the approach already used in the DP branch. Fixes: eff682f83c9c ("drm/amd/display: Add DDC handles for HDCP2.2") Assisted-by: Copilot:claude-opus-4.6 Reviewed-by: Alex Hung <alex.hung(a)amd.com> Signed-off-by: Harry Wentland <harry.wentland(a)amd.com> Signed-off-by: Ray Wu <ray.wu(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> (cherry picked from commit 229212219e4247d9486f8ba41ef087358490be09) Cc: stable(a)vger.kernel.org Signed-off-by: Jiacheng Yu <yujiacheng3(a)huawei.com> --- drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c b/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c index 1b2df97226a3..26956be604c3 100644 --- a/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c +++ b/drivers/gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c @@ -531,7 +531,8 @@ enum mod_hdcp_status mod_hdcp_read_rx_id_list(struct mod_hdcp *hdcp) } else { status = read(hdcp, MOD_HDCP_MESSAGE_ID_READ_REPEATER_AUTH_SEND_RECEIVERID_LIST, hdcp->auth.msg.hdcp2.rx_id_list, - hdcp->auth.msg.hdcp2.rx_id_list_size); + MIN(hdcp->auth.msg.hdcp2.rx_id_list_size, + sizeof(hdcp->auth.msg.hdcp2.rx_id_list))); } return status; } -- 2.34.1

2 1

[PATCH OLK-6.6] drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED
by Jiacheng Yu 07 Jul '26

07 Jul '26

From: Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> mainline inclusion from mainline-v7.1-rc4 commit 183182235f6d53bac62c6c39014738a54a68dfa6 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15974 CVE: CVE-2026-53285 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [Why] dcn32_validate_bandwidth() wraps dcn32_internal_validate_bw() with DC_FP_START()/DC_FP_END(). In x86 non-RT, DC_FP_START takes fpregs_lock(), which disables local softirqs. The DML1 path through dcn32_enable_phantom_plane() calls kvzalloc() to allocate ~335 KiB for dc_plane_state. This triggers the vmalloc path, which calls BUG_ON(in_interrupt()) because it's invoked within the FPU-enabled (softirq disabled) region, leading to a kernel crash. [How] Wrap the dc_state_create_phantom_plane() call with the DC_RUN_WITH_PREEMPTION_ENABLED() macro to allow preemption during this memory allocation. Fixes: 235c67634230 ("drm/amd/display: add DCN32/321 specific files for Display Core") Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/4470 Reviewed-by: Aurabindo Pillai <aurabindo.pillai(a)amd.com> Signed-off-by: Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> Signed-off-by: James Lin <pinglei.lin(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> (cherry picked from commit 885ccbef7b94a8b38f69c4211c679021aa27ad11) Cc: stable(a)vger.kernel.org Conflicts: drivers/gpu/drm/amd/display/amdgpu_dm/dc_fpu.c drivers/gpu/drm/amd/display/amdgpu_dm/dc_fpu.c drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c [3539437f354b drm/amd/display: Move FPU Guards From DML To DC - Part 1, not commited.] Signed-off-by: Jiacheng Yu <yujiacheng3(a)huawei.com> --- .../gpu/drm/amd/display/amdgpu_dm/dc_fpu.c | 19 +++++++++++++++++++ .../gpu/drm/amd/display/amdgpu_dm/dc_fpu.h | 15 +++++++++++++++ .../drm/amd/display/dc/dcn32/dcn32_resource.c | 9 ++++++++- 3 files changed, 42 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/dc_fpu.c b/drivers/gpu/drm/amd/display/amdgpu_dm/dc_fpu.c index 172aa10a8800..e4455be0c99a 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/dc_fpu.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/dc_fpu.c @@ -69,6 +69,25 @@ inline void dc_assert_fp_enabled(void) ASSERT(depth >= 1); } +/** + * dc_is_fp_enabled - Check if FPU protection is enabled + * + * This function tells if the code is already under FPU protection or not. A + * function that works as an API for a set of FPU operations can use this + * function for checking if the caller invoked it after DC_FP_START(). For + * example, take a look at dcn20_fpu.c file. + * + * Similar to dc_assert_fp_enabled, but does not assert, returns status instead. + */ +inline bool dc_is_fp_enabled(void) +{ + int depth; + + depth = this_cpu_read(fpu_recursion_depth); + + return (depth >= 1); +} + /** * dc_fpu_begin - Enables FPU protection * @function_name: A string containing the function name for debug purposes diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/dc_fpu.h b/drivers/gpu/drm/amd/display/amdgpu_dm/dc_fpu.h index b8275b397920..e968589d75ef 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/dc_fpu.h +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/dc_fpu.h @@ -28,7 +28,22 @@ #define __DC_FPU_H__ void dc_assert_fp_enabled(void); +bool dc_is_fp_enabled(void); void dc_fpu_begin(const char *function_name, const int line); void dc_fpu_end(const char *function_name, const int line); +#ifdef CONFIG_DRM_AMD_DC_FP +#define DC_RUN_WITH_PREEMPTION_ENABLED(code) \ + do { \ + bool dc_fp_enabled = dc_is_fp_enabled(); \ + if (dc_fp_enabled) \ + dc_fpu_end(__func__, __LINE__); \ + code; \ + if (dc_fp_enabled) \ + dc_fpu_begin(__func__, __LINE__); \ + } while (0) +#else +#define DC_RUN_WITH_PREEMPTION_ENABLED(code) code +#endif /* CONFIG_DRM_AMD_DC_FP */ + #endif /* __DC_FPU_H__ */ diff --git a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c index ab6b4f44f537..bdd1fc574d6a 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c +++ b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c @@ -89,6 +89,12 @@ #include "dcn20/dcn20_vmid.h" #include "dml/dcn32/dcn32_fpu.h" +#include "amdgpu_dm/dc_fpu.h" + +#if !defined(DC_RUN_WITH_PREEMPTION_ENABLED) +#define DC_RUN_WITH_PREEMPTION_ENABLED(code) code +#endif + #define DC_LOGGER_INIT(logger) enum dcn32_clk_src_array_id { @@ -1643,7 +1649,8 @@ static void dcn32_enable_phantom_plane(struct dc *dc, if (curr_pipe->top_pipe && curr_pipe->top_pipe->plane_state == curr_pipe->plane_state) phantom_plane = prev_phantom_plane; else - phantom_plane = dc_create_plane_state(dc); + DC_RUN_WITH_PREEMPTION_ENABLED(phantom_plane = + dc_create_plane_state(dc)); if (!phantom_plane) continue; -- 2.34.1

2 1

[PATCH OLK-6.6] drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED
by Jiacheng Yu 07 Jul '26

07 Jul '26

From: Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> mainline inclusion from mainline-v7.1-rc4 commit 183182235f6d53bac62c6c39014738a54a68dfa6 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15974 CVE: CVE-2026-53285 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [Why] dcn32_validate_bandwidth() wraps dcn32_internal_validate_bw() with DC_FP_START()/DC_FP_END(). In x86 non-RT, DC_FP_START takes fpregs_lock(), which disables local softirqs. The DML1 path through dcn32_enable_phantom_plane() calls kvzalloc() to allocate ~335 KiB for dc_plane_state. This triggers the vmalloc path, which calls BUG_ON(in_interrupt()) because it's invoked within the FPU-enabled (softirq disabled) region, leading to a kernel crash. [How] Wrap the dc_state_create_phantom_plane() call with the DC_RUN_WITH_PREEMPTION_ENABLED() macro to allow preemption during this memory allocation. Fixes: 235c67634230 ("drm/amd/display: add DCN32/321 specific files for Display Core") Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/4470 Reviewed-by: Aurabindo Pillai <aurabindo.pillai(a)amd.com> Signed-off-by: Mikhail Gavrilov <mikhail.v.gavrilov(a)gmail.com> Signed-off-by: James Lin <pinglei.lin(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> (cherry picked from commit 885ccbef7b94a8b38f69c4211c679021aa27ad11) Cc: stable(a)vger.kernel.org Conflicts: drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c [context conflicts.] Signed-off-by: Jiacheng Yu <yujiacheng3(a)huawei.com> --- .../gpu/drm/amd/display/dc/dcn32/dcn32_resource.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c index ab6b4f44f537..3d30608e98e7 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c +++ b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c @@ -89,6 +89,15 @@ #include "dcn20/dcn20_vmid.h" #include "dml/dcn32/dcn32_fpu.h" +#include "dc_state_priv.h" +#include "dc_fpu.h" + +#include "dml2_0/dml2_wrapper.h" + +#if !defined(DC_RUN_WITH_PREEMPTION_ENABLED) +#define DC_RUN_WITH_PREEMPTION_ENABLED(code) code +#endif + #define DC_LOGGER_INIT(logger) enum dcn32_clk_src_array_id { @@ -1643,7 +1652,8 @@ static void dcn32_enable_phantom_plane(struct dc *dc, if (curr_pipe->top_pipe && curr_pipe->top_pipe->plane_state == curr_pipe->plane_state) phantom_plane = prev_phantom_plane; else - phantom_plane = dc_create_plane_state(dc); + DC_RUN_WITH_PREEMPTION_ENABLED(phantom_plane = + dc_create_plane_state(dc)); if (!phantom_plane) continue; -- 2.34.1

2 1

[PATCH OLK-6.6 0/3] CVE-2026-53358
by Chen Jinghuang 07 Jul '26

07 Jul '26

*** BLURB HERE *** Marco Elver (1): Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref Siwei Zhang (2): Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn include/net/bluetooth/l2cap.h | 1 + net/bluetooth/l2cap_core.c | 36 +++++++++++++++++++++-------------- net/bluetooth/l2cap_sock.c | 16 +++++++++------- 3 files changed, 32 insertions(+), 21 deletions(-) -- 2.34.1

2 4

[PATCH OLK-6.6] l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl()
by Gu Bowen 07 Jul '26

07 Jul '26

From: Lee Jones <lee(a)kernel.org> mainline inclusion from mainline-v7.1-rc7 commit a213a8950414c684999dcf03edeea6c46ede172e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15948 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- pppol2tp_ioctl() read sock->sk->sk_user_data directly without any locks or reference counting. If a controllable sleep was induced during copy_from_user() (e.g. via a userfaultfd page fault sleep), a concurrent socket close could trigger pppol2tp_session_close() asynchronously. This frees the l2tp_session structure via the l2tp_session_del_work workqueue. Upon resuming, the ioctl thread dereferences the stale session pointer, resulting in a Use-After-Free (UAF). Fix this by securely fetching the session reference using the RCU-safe, refcounted helper pppol2tp_sock_to_session(sk) on entry. This locks the session's refcount across the sleep. We structured the function to exit via standard err breaks, guaranteeing that l2tp_session_put() is cleanly called on all return paths to drop the reference. To preserve existing behavior we validate the session and its magic signature only for the specific L2TP commands that require it. This ensures that generic/unknown ioctls called on an unconnected socket still return -ENOIOCTLCMD and correctly fall back to generic handlers (e.g. in sock_do_ioctl()). Signed-off-by: Lee Jones <lee(a)kernel.org> Fixes: fd558d186df2 ("l2tp: Split pppol2tp patch into separate l2tp and ppp parts") Link: https://patch.msgid.link/20260527133630.2120612-1-lee@kernel.org Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/l2tp/l2tp_ppp.c [Function l2tp_session_put() conflicts due to mainline commit abe7a1a7d0b6 ("l2tp: improve tunnel/session refcount helpers") not merge.] Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- net/l2tp/l2tp_ppp.c | 82 +++++++++++++++++++++++++++------------------ 1 file changed, 50 insertions(+), 32 deletions(-) diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c index 7ee095e854ae..1bdac5a6fd1e 100644 --- a/net/l2tp/l2tp_ppp.c +++ b/net/l2tp/l2tp_ppp.c @@ -1055,64 +1055,76 @@ static int pppol2tp_ioctl(struct socket *sock, unsigned int cmd, { struct pppol2tp_ioc_stats stats; struct l2tp_session *session; + int err = 0; + + session = pppol2tp_sock_to_session(sock->sk); + /* Validate session presence and magic integrity ONLY for commands + * that belong to L2TP and require a valid session. + */ switch (cmd) { case PPPIOCGMRU: case PPPIOCGFLAGS: - session = sock->sk->sk_user_data; + case PPPIOCSMRU: + case PPPIOCSFLAGS: + case PPPIOCGL2TPSTATS: if (!session) return -ENOTCONN; - if (WARN_ON(session->magic != L2TP_SESSION_MAGIC)) + if (session->magic != L2TP_SESSION_MAGIC) { + l2tp_session_dec_refcount(session); return -EBADF; + } + break; + default: + break; + } + switch (cmd) { + case PPPIOCGMRU: + case PPPIOCGFLAGS: /* Not defined for tunnels */ - if (!session->session_id && !session->peer_session_id) - return -ENOSYS; + if (!session->session_id && !session->peer_session_id) { + err = -ENOSYS; + break; + } - if (put_user(0, (int __user *)arg)) - return -EFAULT; + if (put_user(0, (int __user *)arg)) { + err = -EFAULT; + break; + } break; case PPPIOCSMRU: case PPPIOCSFLAGS: - session = sock->sk->sk_user_data; - if (!session) - return -ENOTCONN; - - if (WARN_ON(session->magic != L2TP_SESSION_MAGIC)) - return -EBADF; - /* Not defined for tunnels */ - if (!session->session_id && !session->peer_session_id) - return -ENOSYS; + if (!session->session_id && !session->peer_session_id) { + err = -ENOSYS; + break; + } - if (!access_ok((int __user *)arg, sizeof(int))) - return -EFAULT; + if (!access_ok((int __user *)arg, sizeof(int))) { + err = -EFAULT; + break; + } break; case PPPIOCGL2TPSTATS: - session = sock->sk->sk_user_data; - if (!session) - return -ENOTCONN; - - if (WARN_ON(session->magic != L2TP_SESSION_MAGIC)) - return -EBADF; - /* Session 0 represents the parent tunnel */ if (!session->session_id && !session->peer_session_id) { u32 session_id; - int err; if (copy_from_user(&stats, (void __user *)arg, - sizeof(stats))) - return -EFAULT; + sizeof(stats))) { + err = -EFAULT; + break; + } session_id = stats.session_id; err = pppol2tp_tunnel_copy_stats(&stats, session->tunnel); if (err < 0) - return err; + break; stats.session_id = session_id; } else { @@ -1122,15 +1134,21 @@ static int pppol2tp_ioctl(struct socket *sock, unsigned int cmd, stats.tunnel_id = session->tunnel->tunnel_id; stats.using_ipsec = l2tp_tunnel_uses_xfrm(session->tunnel); - if (copy_to_user((void __user *)arg, &stats, sizeof(stats))) - return -EFAULT; + if (copy_to_user((void __user *)arg, &stats, sizeof(stats))) { + err = -EFAULT; + break; + } break; default: - return -ENOIOCTLCMD; + err = -ENOIOCTLCMD; + break; } - return 0; + if (session) + l2tp_session_dec_refcount(session); + + return err; } /***************************************************************************** -- 2.43.0

2 1

[PATCH 0/3] *** CVE-2026-53358 ***
by Chen Jinghuang 07 Jul '26

07 Jul '26

*** BLURB HERE *** Marco Elver (1): Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref Siwei Zhang (2): Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn include/net/bluetooth/l2cap.h | 1 + net/bluetooth/l2cap_core.c | 36 +++++++++++++++++++++-------------- net/bluetooth/l2cap_sock.c | 16 +++++++++------- 3 files changed, 32 insertions(+), 21 deletions(-) -- 2.34.1

1 3

[PATCH openEuler-1.0-LTS] ext4: validate readdir offset before accessing dirent
by Yao Kai 06 Jul '26

06 Jul '26

Offering: HULK hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9553 ------------------------ A corrupted directory can trigger the following KASAN report when ext4_readdir() resumes from an invalid position: BUG: KASAN: use-after-free in __ext4_check_dir_entry+0x5ef/0x820 Read of size 2 at addr ffff88810a646000 by task repro_linear/509 Call Trace: <TASK> dump_stack_lvl+0x53/0x70 print_report+0xd0/0x630 kasan_report+0xce/0x100 __ext4_check_dir_entry+0x5ef/0x820 ext4_readdir+0xcde/0x2b70 iterate_dir+0x1a1/0x520 __x64_sys_getdents64+0x12b/0x220 do_syscall_64+0xf9/0x540 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> KASAN reports use-after-free because the out-of-bounds access lands in an adjacent freed page. The directory buffer itself is still referenced. ext4_dir_llseek() invalidates the directory cookie so that ext4_readdir() rescans directory entries from the start of the block. The rescan checks only the lower bound of rec_len before advancing. A corrupted rec_len can therefore place the offset where the block has insufficient space for a complete directory entry. The rescan itself may dereference that truncated entry, or the main loop may pass it to __ext4_check_dir_entry(). The latter reads de->rec_len before validating the range. For example: block offset 0 4092 4096 |---- de1.rec_len = 4092 -----|----| de2.inode | de2.rec_len ^ OOB, reported as UAF de2 starts at offset 4092 in this 4 KiB block. Its four-byte inode fits in the block, but its rec_len starts at offset 4096 and crosses the boundary. The minimum safe length is inode-dependent. Encrypted and casefolded directory entries need eight additional hash bytes, while a valid metadata checksum tail is only 12 bytes. Cache the metadata checksum feature state and derive the minimum directory entry length from the on-disk format. Use it to bound both the rescan and the offset passed to the main loop. Report an offset in a truncated block tail and skip the remainder of the block, while continuing to accept an offset exactly at the block boundary. Reported-by: syzbot+5322c5c260eb44d209ed(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=5322c5c260eb44d209ed Fixes: ac27a0ec112a ("[PATCH] ext4: initial copy of files from ext3") Signed-off-by: Yao Kai <yaokai34(a)huawei.com> Reviewed-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> --- fs/ext4/dir.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/fs/ext4/dir.c b/fs/ext4/dir.c index 5def57966807..9c5ff45bfd6b 100644 --- a/fs/ext4/dir.c +++ b/fs/ext4/dir.c @@ -216,7 +216,9 @@ static int ext4_readdir(struct file *file, struct dir_context *ctx) * dirent right now. Scan from the start of the block * to make sure. */ if (!inode_eq_iversion(inode, file->f_version)) { - for (i = 0; i < sb->s_blocksize && i < offset; ) { + for (i = 0; + i <= sb->s_blocksize - EXT4_DIR_REC_LEN(1) && + i < offset;) { de = (struct ext4_dir_entry_2 *) (bh->b_data + i); /* It's too expensive to do a full @@ -237,6 +239,16 @@ static int ext4_readdir(struct file *file, struct dir_context *ctx) file->f_version = inode_query_iversion(inode); } + if (unlikely(offset < sb->s_blocksize && + offset > sb->s_blocksize - EXT4_DIR_REC_LEN(1))) { + EXT4_ERROR_FILE(file, bh->b_blocknr, + "bad entry in directory: %s - offset=%u, size=%lu", + "directory entry too close to block end", + offset, sb->s_blocksize); + ctx->pos = round_up(ctx->pos, sb->s_blocksize); + goto next_block; + } + while (ctx->pos < inode->i_size && offset < sb->s_blocksize) { de = (struct ext4_dir_entry_2 *) (bh->b_data + offset); @@ -282,6 +294,7 @@ static int ext4_readdir(struct file *file, struct dir_context *ctx) ctx->pos += ext4_rec_len_from_disk(de->rec_len, sb->s_blocksize); } +next_block: if ((ctx->pos < inode->i_size) && !dir_relax_shared(inode)) goto done; brelse(bh); -- 2.34.1

2 1

[PATCH OLK-5.10] ext4: validate readdir offset before accessing dirent
by Yao Kai 06 Jul '26

06 Jul '26

Offering: HULK hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9553 ------------------------ A corrupted directory can trigger the following KASAN report when ext4_readdir() resumes from an invalid position: BUG: KASAN: use-after-free in __ext4_check_dir_entry+0x5ef/0x820 Read of size 2 at addr ffff88810a646000 by task repro_linear/509 Call Trace: <TASK> dump_stack_lvl+0x53/0x70 print_report+0xd0/0x630 kasan_report+0xce/0x100 __ext4_check_dir_entry+0x5ef/0x820 ext4_readdir+0xcde/0x2b70 iterate_dir+0x1a1/0x520 __x64_sys_getdents64+0x12b/0x220 do_syscall_64+0xf9/0x540 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> KASAN reports use-after-free because the out-of-bounds access lands in an adjacent freed page. The directory buffer itself is still referenced. ext4_dir_llseek() invalidates the directory cookie so that ext4_readdir() rescans directory entries from the start of the block. The rescan checks only the lower bound of rec_len before advancing. A corrupted rec_len can therefore place the offset where the block has insufficient space for a complete directory entry. The rescan itself may dereference that truncated entry, or the main loop may pass it to __ext4_check_dir_entry(). The latter reads de->rec_len before validating the range. For example: block offset 0 4092 4096 |---- de1.rec_len = 4092 -----|----| de2.inode | de2.rec_len ^ OOB, reported as UAF de2 starts at offset 4092 in this 4 KiB block. Its four-byte inode fits in the block, but its rec_len starts at offset 4096 and crosses the boundary. The minimum safe length is inode-dependent. Encrypted and casefolded directory entries need eight additional hash bytes, while a valid metadata checksum tail is only 12 bytes. Cache the metadata checksum feature state and derive the minimum directory entry length from the on-disk format. Use it to bound both the rescan and the offset passed to the main loop. Report an offset in a truncated block tail and skip the remainder of the block, while continuing to accept an offset exactly at the block boundary. Reported-by: syzbot+5322c5c260eb44d209ed(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=5322c5c260eb44d209ed Fixes: ac27a0ec112a ("[PATCH] ext4: initial copy of files from ext3") Signed-off-by: Yao Kai <yaokai34(a)huawei.com> Reviewed-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> --- fs/ext4/dir.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/fs/ext4/dir.c b/fs/ext4/dir.c index 513360234b14..c2e0b7c9562e 100644 --- a/fs/ext4/dir.c +++ b/fs/ext4/dir.c @@ -219,7 +219,9 @@ static int ext4_readdir(struct file *file, struct dir_context *ctx) * dirent right now. Scan from the start of the block * to make sure. */ if (!inode_eq_iversion(inode, file->f_version)) { - for (i = 0; i < sb->s_blocksize && i < offset; ) { + for (i = 0; + i <= sb->s_blocksize - EXT4_DIR_REC_LEN(1) && + i < offset;) { de = (struct ext4_dir_entry_2 *) (bh->b_data + i); /* It's too expensive to do a full @@ -240,6 +242,16 @@ static int ext4_readdir(struct file *file, struct dir_context *ctx) file->f_version = inode_query_iversion(inode); } + if (unlikely(offset < sb->s_blocksize && + offset > sb->s_blocksize - EXT4_DIR_REC_LEN(1))) { + EXT4_ERROR_FILE(file, bh->b_blocknr, + "bad entry in directory: %s - offset=%u, size=%lu", + "directory entry too close to block end", + offset, sb->s_blocksize); + ctx->pos = round_up(ctx->pos, sb->s_blocksize); + goto next_block; + } + while (ctx->pos < inode->i_size && offset < sb->s_blocksize) { de = (struct ext4_dir_entry_2 *) (bh->b_data + offset); @@ -285,6 +297,7 @@ static int ext4_readdir(struct file *file, struct dir_context *ctx) ctx->pos += ext4_rec_len_from_disk(de->rec_len, sb->s_blocksize); } +next_block: if ((ctx->pos < inode->i_size) && !dir_relax_shared(inode)) goto done; brelse(bh); -- 2.34.1

2 1

[PATCH OLK-6.6] ext4: validate readdir offset before accessing dirent
by Yao Kai 06 Jul '26

06 Jul '26

Offering: HULK hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9553 ------------------------ A corrupted directory can trigger the following KASAN report when ext4_readdir() resumes from an invalid position: BUG: KASAN: use-after-free in __ext4_check_dir_entry+0x5ef/0x820 Read of size 2 at addr ffff88810a646000 by task repro_linear/509 Call Trace: <TASK> dump_stack_lvl+0x53/0x70 print_report+0xd0/0x630 kasan_report+0xce/0x100 __ext4_check_dir_entry+0x5ef/0x820 ext4_readdir+0xcde/0x2b70 iterate_dir+0x1a1/0x520 __x64_sys_getdents64+0x12b/0x220 do_syscall_64+0xf9/0x540 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> KASAN reports use-after-free because the out-of-bounds access lands in an adjacent freed page. The directory buffer itself is still referenced. ext4_dir_llseek() invalidates the directory cookie so that ext4_readdir() rescans directory entries from the start of the block. The rescan checks only the lower bound of rec_len before advancing. A corrupted rec_len can therefore place the offset where the block has insufficient space for a complete directory entry. The rescan itself may dereference that truncated entry, or the main loop may pass it to __ext4_check_dir_entry(). The latter reads de->rec_len before validating the range. For example: block offset 0 4092 4096 |---- de1.rec_len = 4092 -----|----| de2.inode | de2.rec_len ^ OOB, reported as UAF de2 starts at offset 4092 in this 4 KiB block. Its four-byte inode fits in the block, but its rec_len starts at offset 4096 and crosses the boundary. The minimum safe length is inode-dependent. Encrypted and casefolded directory entries need eight additional hash bytes, while a valid metadata checksum tail is only 12 bytes. Cache the metadata checksum feature state and derive the minimum directory entry length from the on-disk format. Use it to bound both the rescan and the offset passed to the main loop. Report an offset in a truncated block tail and skip the remainder of the block, while continuing to accept an offset exactly at the block boundary. Reported-by: syzbot+5322c5c260eb44d209ed(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=5322c5c260eb44d209ed Fixes: ac27a0ec112a ("[PATCH] ext4: initial copy of files from ext3") Signed-off-by: Yao Kai <yaokai34(a)huawei.com> Reviewed-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> --- fs/ext4/dir.c | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) diff --git a/fs/ext4/dir.c b/fs/ext4/dir.c index 6682b8ab11f1..bc53ea82161d 100644 --- a/fs/ext4/dir.c +++ b/fs/ext4/dir.c @@ -136,6 +136,7 @@ static int ext4_readdir(struct file *file, struct dir_context *ctx) struct super_block *sb = inode->i_sb; struct buffer_head *bh = NULL; struct fscrypt_str fstr = FSTR_INIT(NULL, 0); + bool has_csum = ext4_has_metadata_csum(sb); err = fscrypt_prepare_readdir(inode); if (err) @@ -147,7 +148,7 @@ static int ext4_readdir(struct file *file, struct dir_context *ctx) return err; /* Can we just clear INDEX flag to ignore htree information? */ - if (!ext4_has_metadata_csum(sb)) { + if (!has_csum) { /* * We don't set the inode dirty flag since it's not * critical that it gets flushed back to the disk. @@ -233,7 +234,10 @@ static int ext4_readdir(struct file *file, struct dir_context *ctx) * dirent right now. Scan from the start of the block * to make sure. */ if (!inode_eq_iversion(inode, file->f_version)) { - for (i = 0; i < sb->s_blocksize && i < offset; ) { + for (i = 0; + i <= sb->s_blocksize - + ext4_dir_rec_len(1, has_csum ? NULL : inode) && + i < offset;) { de = (struct ext4_dir_entry_2 *) (bh->b_data + i); /* It's too expensive to do a full @@ -255,6 +259,17 @@ static int ext4_readdir(struct file *file, struct dir_context *ctx) file->f_version = inode_query_iversion(inode); } + if (unlikely(offset < sb->s_blocksize && + offset > sb->s_blocksize - + ext4_dir_rec_len(1, has_csum ? NULL : inode))) { + EXT4_ERROR_FILE(file, bh->b_blocknr, + "bad entry in directory: %s - offset=%u, size=%lu", + "directory entry too close to block end", + offset, sb->s_blocksize); + ctx->pos = round_up(ctx->pos, sb->s_blocksize); + goto next_block; + } + while (ctx->pos < inode->i_size && offset < sb->s_blocksize) { de = (struct ext4_dir_entry_2 *) (bh->b_data + offset); @@ -310,6 +325,7 @@ static int ext4_readdir(struct file *file, struct dir_context *ctx) ctx->pos += ext4_rec_len_from_disk(de->rec_len, sb->s_blocksize); } +next_block: if ((ctx->pos < inode->i_size) && !dir_relax_shared(inode)) goto done; brelse(bh); -- 2.34.1

2 1

[PATCH OLK-6.6] thunderbolt: Reject zero-length property entries in validator
by Wupeng Ma 06 Jul '26

06 Jul '26

From: Michael Bommarito <michael.bommarito(a)gmail.com> stable inclusion from stable-v6.6.143 commit 5f56bc6bddffe8710ba0ba8844023b5a44ca90e4 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16031 CVE: CVE-2026-53150 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit cff8eb65d1eafe7793e54b4d0cf6bf831644630b upstream. tb_property_entry_valid() accepts entries with length == 0 for DIRECTORY, DATA, and TEXT types. A zero-length TEXT entry passes validation but causes an underflow in the null-termination logic: property->value.text[property->length * 4 - 1] = '\0'; When property->length is 0 this writes to offset -1 relative to the allocation. Reject zero-length entries early in the validator since they have no valid representation in the XDomain property protocol. Fixes: cdae7c07e3e3 ("thunderbolt: Add support for XDomain properties") Cc: stable(a)vger.kernel.org Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Signed-off-by: Mika Westerberg <mika.westerberg(a)linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- drivers/thunderbolt/property.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/thunderbolt/property.c b/drivers/thunderbolt/property.c index dc555cda98e68..bf750bee23694 100644 --- a/drivers/thunderbolt/property.c +++ b/drivers/thunderbolt/property.c @@ -56,6 +56,8 @@ static bool tb_property_entry_valid(const struct tb_property_entry *entry, case TB_PROPERTY_TYPE_DIRECTORY: case TB_PROPERTY_TYPE_DATA: case TB_PROPERTY_TYPE_TEXT: + if (!entry->length) + return false; if (entry->length > block_len) return false; if (entry->value + entry->length > block_len) -- 2.43.0

2 1

[PATCH OLK-6.6] sctp: purge outqueue on stale COOKIE-ECHO handling
by Wupeng Ma 06 Jul '26

06 Jul '26

From: Xin Long <lucien.xin(a)gmail.com> stable inclusion from stable-v6.6.143 commit 2afc9e684dc7fecf73db1edc937ebbc47b4b68dc category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15640 CVE: CVE-2026-52924 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e374b22e9b07b72a25909621464ff74096151bfb ] sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths. Fixes: 5bbbbe32a431 ("sctp: introduce stream scheduler foundations") Reported-by: Yuan Tan <yuantan098(a)gmail.com> Reported-by: Yifan Wu <yifanwucs(a)gmail.com> Reported-by: Juefei Pu <tomapufckgml(a)gmail.com> Reported-by: Zhengchuan Liang <zcliangcn(a)gmail.com> Reported-by: Xin Liu <bird(a)lzu.edu.cn> Reported-by: Yuqi Xu <xuyq21(a)lenovo.com> Reported-by: Ren Wei <n05ec(a)lzu.edu.cn> Signed-off-by: Xin Long <lucien.xin(a)gmail.com> Link: https://patch.msgid.link/94318159b9052907a6cbb7256aee8b5f8dfbfccb.178051030… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- net/sctp/sm_statefuns.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c index 5e9449b0c7907..583d83dcb8426 100644 --- a/net/sctp/sm_statefuns.c +++ b/net/sctp/sm_statefuns.c @@ -2597,11 +2597,7 @@ static enum sctp_disposition sctp_sf_do_5_2_6_stale( */ sctp_add_cmd_sf(commands, SCTP_CMD_DEL_NON_PRIMARY, SCTP_NULL()); - /* If we've sent any data bundled with COOKIE-ECHO we will need to - * resend - */ - sctp_add_cmd_sf(commands, SCTP_CMD_T1_RETRAN, - SCTP_TRANSPORT(asoc->peer.primary_path)); + sctp_add_cmd_sf(commands, SCTP_CMD_PURGE_OUTQUEUE, SCTP_NULL()); /* Cast away the const modifier, as we want to just * rerun it through as a sideffect. -- 2.43.0

2 1

[PATCH OLK-6.6] [Backport] gtp: disable BH before calling udp_tunnel_xmit_skb()
by Wupeng Ma 06 Jul '26

06 Jul '26

From: David Carlier <devnexen(a)gmail.com> stable inclusion from stable-v6.12.88 commit 0e550caa4bf575a06417de1e2b03a25f2caf88b6 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15772 CVE: CVE-2026-53070 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5638504a2aa9e1b9d72af9060df1a160cce2d379 ] gtp_genl_send_echo_req() runs as a generic netlink doit handler in process context with BH not disabled. It calls udp_tunnel_xmit_skb(), which eventually invokes iptunnel_xmit() — that uses __this_cpu_inc/dec on softnet_data.xmit.recursion to track the tunnel xmit recursion level. Without local_bh_disable(), the task may migrate between dev_xmit_recursion_inc() and dev_xmit_recursion_dec(), breaking the per-CPU counter pairing. The result is stale or negative recursion levels that can later produce false-positive SKB_DROP_REASON_RECURSION_LIMIT drops on either CPU. The other udp_tunnel_xmit_skb() call sites in gtp.c are unaffected: the data path runs under ndo_start_xmit and the echo response handlers run from the UDP encap rx softirq, both with BH already disabled. Fix it by disabling BH around the udp_tunnel_xmit_skb() call, mirroring commit 2cd7e6971fc2 ("sctp: disable BH before calling udp_tunnel_xmit_skb()"). Fixes: 6f1a9140ecda ("net: add xmit recursion limit to tunnel xmit functions") Cc: stable(a)vger.kernel.org Signed-off-by: David Carlier <devnexen(a)gmail.com> Link: https://patch.msgid.link/20260417055408.4667-1-devnexen@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> [ Context ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wupeng Ma <mawupeng1(a)huawei.com> --- drivers/net/gtp.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c index 3684044547dc6..c6fe44be47d9f 100644 --- a/drivers/net/gtp.c +++ b/drivers/net/gtp.c @@ -1809,6 +1809,7 @@ static int gtp_genl_send_echo_req(struct sk_buff *skb, struct genl_info *info) return -ENODEV; } + local_bh_disable(); udp_tunnel_xmit_skb(rt, sk, skb_to_send, fl4.saddr, fl4.daddr, fl4.flowi4_tos, @@ -1818,6 +1819,7 @@ static int gtp_genl_send_echo_req(struct sk_buff *skb, struct genl_info *info) !net_eq(sock_net(sk), dev_net(gtp->dev)), false); + local_bh_enable(); return 0; } -- 2.43.0

2 1

[PATCH OLK-6.6] drm/amd/display: Avoid NULL dereference in dc_dmub_srv error paths
by Jiacheng Yu 06 Jul '26

06 Jul '26

From: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> mainline inclusion from mainline-v7.1-rc1 commit 4ae3e16f4b3bf64140f773629b765d605ee079a9 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16001 CVE: CVE-2026-53313 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In dc_dmub_srv_log_diagnostic_data() and dc_dmub_srv_enable_dpia_trace(). Both functions check: if (!dc_dmub_srv || !dc_dmub_srv->dmub) and then call DC_LOG_ERROR() inside that block. DC_LOG_ERROR() uses dc_dmub_srv->ctx internally. So if dc_dmub_srv is NULL, the logging itself can dereference a NULL pointer and cause a crash. Fix this by splitting the checks. First check if dc_dmub_srv is NULL and return immediately. Then check dc_dmub_srv->dmub and log the error only when dc_dmub_srv is valid. Fixes the below: ../display/dc/dc_dmub_srv.c:962 dc_dmub_srv_log_diagnostic_data() error: we previously assumed 'dc_dmub_srv' could be null (see line 961) ../display/dc/dc_dmub_srv.c:1167 dc_dmub_srv_enable_dpia_trace() error: we previously assumed 'dc_dmub_srv' could be null (see line 1166) Fixes: 2631ac1ac328 ("drm/amd/display: add DMUB registers to crash dump diagnostic data.") Fixes: 71ba6b577a35 ("drm/amd/display: Add interface to enable DPIA trace") Cc: Roman Li <roman.li(a)amd.com> Cc: Alex Hung <alex.hung(a)amd.com> Cc: Tom Chung <chiahsuan.chung(a)amd.com> Cc: Dan Carpenter <dan.carpenter(a)linaro.org> Cc: Aurabindo Pillai <aurabindo.pillai(a)amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> Reviewed-by: Alex Hung <alex.hung(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Jiacheng Yu <yujiacheng3(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c b/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c index 8344957d7449..a579366e7698 100644 --- a/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c +++ b/drivers/gpu/drm/amd/display/dc/dc_dmub_srv.c @@ -796,7 +796,10 @@ void dc_dmub_srv_log_diagnostic_data(struct dc_dmub_srv *dc_dmub_srv) { struct dmub_diagnostic_data diag_data = {0}; - if (!dc_dmub_srv || !dc_dmub_srv->dmub) { + if (!dc_dmub_srv) + return; + + if (!dc_dmub_srv->dmub) { DC_LOG_ERROR("%s: invalid parameters.", __func__); return; } @@ -1037,7 +1040,10 @@ void dc_dmub_srv_enable_dpia_trace(const struct dc *dc) enum dmub_status status; static const uint32_t timeout_us = 30; - if (!dc_dmub_srv || !dc_dmub_srv->dmub) { + if (!dc_dmub_srv) + return; + + if (!dc_dmub_srv->dmub) { DC_LOG_ERROR("%s: invalid parameters.", __func__); return; } -- 2.34.1

2 1

[PATCH OLK-6.6] locking/rtmutex: Skip remove_waiter() when waiter is not enqueued
by Jiacheng Yu 06 Jul '26

06 Jul '26

From: Davidlohr Bueso <dave(a)stgolabs.net> mainline inclusion from mainline-v7.1-rc7 commit 40a25d59e85b3c8709ac2424d44f65610467871e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15848 CVE: CVE-2026-53163 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzbot triggered the following splat in remove_waiter() via FUTEX_CMP_REQUEUE_PI: KASAN: null-ptr-deref in range [0x0000000000000a88-0x0000000000000a8f] class_raw_spinlock_constructor remove_waiter+0x159/0x1200 kernel/locking/rtmutex.c:1561 rt_mutex_start_proxy_lock+0x103/0x120 futex_requeue+0x10e4/0x20d0 __x64_sys_futex+0x34f/0x4d0 task_blocks_on_rt_mutex() does not arm the waiter upon deadlock detection, leaving waiter->task nil, where 3bfdc63936dd ("rtmutex: Use waiter::task instead of current in remove_waiter()") made this fatal. Furthermore, rt_mutex_start_proxy_lock() should not be calling into remove_waiter() upon a successfully grabbing the rtmutex. 1a1fb985f2e2 ("futex: Handle early deadlock return correctly"), moved the remove_waiter() out of __rt_mutex_start_proxy_lock() (where 'ret' was only ever 0 or < 0) into the wrapper. Tighten this check to account for try_to_take_rt_mutex(). Fixes: 3bfdc63936dd ("rtmutex: Use waiter::task instead of current in remove_waiter()") Reported-by: syzbot+78147abe6c524f183ee9(a)syzkaller.appspotmail.com Signed-off-by: Davidlohr Bueso <dave(a)stgolabs.net> Signed-off-by: Thomas Gleixner <tglx(a)kernel.org> Cc: stable(a)vger.kernel.org Closes: https://lore.kernel.org/all/69f114ac.050a0220.ac8b.0003.GAE@google.com/ Link: https://patch.msgid.link/20260507112913.1019537-1-dave@stgolabs.net Conflicts: kernel/locking/rtmutex_api.c [context conflicts.] Signed-off-by: Jiacheng Yu <yujiacheng3(a)huawei.com> --- kernel/locking/rtmutex.c | 3 +++ kernel/locking/rtmutex_api.c | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c index def1f8fbc85c..6df2f674712a 100644 --- a/kernel/locking/rtmutex.c +++ b/kernel/locking/rtmutex.c @@ -1524,6 +1524,9 @@ static void __sched remove_waiter(struct rt_mutex_base *lock, lockdep_assert_held(&lock->wait_lock); + if (!waiter_task) /* never enqueued */ + return; + scoped_guard(raw_spinlock, &waiter_task->pi_lock) { rt_mutex_dequeue(lock, waiter); waiter_task->pi_blocked_on = NULL; diff --git a/kernel/locking/rtmutex_api.c b/kernel/locking/rtmutex_api.c index d0433287effd..74b24ecdbeea 100644 --- a/kernel/locking/rtmutex_api.c +++ b/kernel/locking/rtmutex_api.c @@ -344,7 +344,7 @@ int __sched rt_mutex_start_proxy_lock(struct rt_mutex_base *lock, raw_spin_lock_irq(&lock->wait_lock); ret = __rt_mutex_start_proxy_lock(lock, waiter, task); - if (unlikely(ret)) + if (unlikely(ret < 0)) remove_waiter(lock, waiter); raw_spin_unlock_irq(&lock->wait_lock); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] locking/rtmutex: Skip remove_waiter() when waiter is not enqueued
by Jiacheng Yu 06 Jul '26

06 Jul '26

From: Davidlohr Bueso <dave(a)stgolabs.net> mainline inclusion from mainline-v7.1-rc7 commit 40a25d59e85b3c8709ac2424d44f65610467871e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15848 CVE: CVE-2026-53163 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzbot triggered the following splat in remove_waiter() via FUTEX_CMP_REQUEUE_PI: KASAN: null-ptr-deref in range [0x0000000000000a88-0x0000000000000a8f] class_raw_spinlock_constructor remove_waiter+0x159/0x1200 kernel/locking/rtmutex.c:1561 rt_mutex_start_proxy_lock+0x103/0x120 futex_requeue+0x10e4/0x20d0 __x64_sys_futex+0x34f/0x4d0 task_blocks_on_rt_mutex() does not arm the waiter upon deadlock detection, leaving waiter->task nil, where 3bfdc63936dd ("rtmutex: Use waiter::task instead of current in remove_waiter()") made this fatal. Furthermore, rt_mutex_start_proxy_lock() should not be calling into remove_waiter() upon a successfully grabbing the rtmutex. 1a1fb985f2e2 ("futex: Handle early deadlock return correctly"), moved the remove_waiter() out of __rt_mutex_start_proxy_lock() (where 'ret' was only ever 0 or < 0) into the wrapper. Tighten this check to account for try_to_take_rt_mutex(). Fixes: 3bfdc63936dd ("rtmutex: Use waiter::task instead of current in remove_waiter()") Reported-by: syzbot+78147abe6c524f183ee9(a)syzkaller.appspotmail.com Signed-off-by: Davidlohr Bueso <dave(a)stgolabs.net> Signed-off-by: Thomas Gleixner <tglx(a)kernel.org> Cc: stable(a)vger.kernel.org Closes: https://lore.kernel.org/all/69f114ac.050a0220.ac8b.0003.GAE@google.com/ Link: https://patch.msgid.link/20260507112913.1019537-1-dave@stgolabs.net Conflicts: kernel/locking/rtmutex.c kernel/locking/rtmutex_api.c [context conflicts.] Signed-off-by: Jiacheng Yu <yujiacheng3(a)huawei.com> --- kernel/locking/rtmutex.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c index 109a9e21b4e1..fb41115bfa99 100644 --- a/kernel/locking/rtmutex.c +++ b/kernel/locking/rtmutex.c @@ -1113,6 +1113,9 @@ static void remove_waiter(struct rt_mutex *lock, lockdep_assert_held(&lock->wait_lock); + if (!waiter_task) /* never enqueued */ + return; + raw_spin_lock(&waiter_task->pi_lock); rt_mutex_dequeue(lock, waiter); waiter_task->pi_blocked_on = NULL; @@ -1842,7 +1845,7 @@ int rt_mutex_start_proxy_lock(struct rt_mutex *lock, raw_spin_lock_irq(&lock->wait_lock); ret = __rt_mutex_start_proxy_lock(lock, waiter, task); - if (unlikely(ret)) + if (unlikely(ret < 0)) remove_waiter(lock, waiter); raw_spin_unlock_irq(&lock->wait_lock); -- 2.34.1

2 1

[PATCH OLK-6.6] drm/virtio: Fix driver removal with disabled KMS
by Fanhua Li 06 Jul '26

06 Jul '26

From: Dmitry Osipenko <dmitry.osipenko(a)collabora.com> stable inclusion from stable-v6.6.143 commit ed3e134700a2e07caa99b9bc0683ebbe0327c562 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16056 CVE: CVE-2026-53347 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f329e8325e054bd6d84d10904f8dd51137281b92 ] DRM atomic and modesetting aren't initialized if virtio-gpu driver built with disabled KMS, leading to access of uninitialized data on driver removal/unbinding and crashing kernel. Fix it by skipping shutting down atomic core with unavailable KMS. Fixes: 72122c69d717 ("drm/virtio: Add option to disable KMS support") Signed-off-by: Dmitry Osipenko <dmitry.osipenko(a)collabora.com> Tested-by: Ryosuke Yasuoka <ryasuoka(a)redhat.com> Reviewed-by: Ryosuke Yasuoka <ryasuoka(a)redhat.com> Link: https://patch.msgid.link/20260604122743.13383-1-dmitry.osipenko@collabora.c… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/gpu/drm/virtio/virtgpu_drv.c [Fanhua Li: context conflict] Signed-off-by: Fanhua Li <lifanhua5(a)huawei.com> --- drivers/gpu/drm/virtio/virtgpu_drv.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/virtio/virtgpu_drv.c b/drivers/gpu/drm/virtio/virtgpu_drv.c index c6a62ad6c1a92..c9054e51c859b 100644 --- a/drivers/gpu/drm/virtio/virtgpu_drv.c +++ b/drivers/gpu/drm/virtio/virtgpu_drv.c @@ -118,7 +118,10 @@ static void virtio_gpu_remove(struct virtio_device *vdev) struct drm_device *dev = vdev->priv; drm_dev_unplug(dev); - drm_atomic_helper_shutdown(dev); + + if (drm_core_check_feature(dev, DRIVER_ATOMIC)) + drm_atomic_helper_shutdown(dev); + virtio_gpu_deinit(dev); drm_dev_put(dev); } -- 2.43.0

2 1

[PATCH OLK-6.6] drm/virtio: Fix driver removal with disabled KMS
by Fanhua Li 06 Jul '26

06 Jul '26

From: Dmitry Osipenko <dmitry.osipenko(a)collabora.com> stable inclusion from stable-v6.6.143 commit ed3e134700a2e07caa99b9bc0683ebbe0327c562 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16056 CVE: CVE-2026-53347 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f329e8325e054bd6d84d10904f8dd51137281b92 ] DRM atomic and modesetting aren't initialized if virtio-gpu driver built with disabled KMS, leading to access of uninitialized data on driver removal/unbinding and crashing kernel. Fix it by skipping shutting down atomic core with unavailable KMS. Fixes: 72122c69d717 ("drm/virtio: Add option to disable KMS support") Signed-off-by: Dmitry Osipenko <dmitry.osipenko(a)collabora.com> Tested-by: Ryosuke Yasuoka <ryasuoka(a)redhat.com> Reviewed-by: Ryosuke Yasuoka <ryasuoka(a)redhat.com> Link: https://patch.msgid.link/20260604122743.13383-1-dmitry.osipenko@collabora.c… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Fanhua Li <lifanhua5(a)huawei.com> --- drivers/gpu/drm/virtio/virtgpu_drv.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/virtio/virtgpu_drv.c b/drivers/gpu/drm/virtio/virtgpu_drv.c index c6a62ad6c1a92..c9054e51c859b 100644 --- a/drivers/gpu/drm/virtio/virtgpu_drv.c +++ b/drivers/gpu/drm/virtio/virtgpu_drv.c @@ -118,7 +118,10 @@ static void virtio_gpu_remove(struct virtio_device *vdev) struct drm_device *dev = vdev->priv; drm_dev_unplug(dev); - drm_atomic_helper_shutdown(dev); + + if (drm_core_check_feature(dev, DRIVER_ATOMIC)) + drm_atomic_helper_shutdown(dev); + virtio_gpu_deinit(dev); drm_dev_put(dev); } -- 2.43.0

2 1

[PATCH OLK-5.10 v2] netfilter: nf_conntrack: destroy stale expectfn expectations
by superdcc97＠163.com 06 Jul '26

06 Jul '26

From: Weiming Shi <bestswngs(a)gmail.com> mainline inclusion from mainline-v7.2-rc1 commit c3009418f9fa1dcb3eb86f4d8c92583537b5faa3 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16058 CVE: CVE-2026-53349 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- NAT helpers such as nf_nat_h323 store a raw pointer to module text in exp->expectfn (e.g. ip_nat_q931_expect). nf_ct_helper_expectfn_unregister() only unlinks the callback descriptor and never walks the expectation table, so an expectation pending at module removal survives with a dangling exp->expectfn into freed module text. When the expected connection arrives, init_conntrack() invokes exp->expectfn(), now a stale pointer into the unloaded module. Reproduced on a KASAN build by loading the H.323 helpers, creating a Q.931 expectation, unloading nf_nat_h323, then connecting to the expected port: Oops: int3: 0000 [#1] SMP KASAN NOPTI RIP: 0010:0xffffffffa06102d1 init_conntrack.isra.0 (net/netfilter/nf_conntrack_core.c:1862) nf_conntrack_in (net/netfilter/nf_conntrack_core.c:2049) ipv4_conntrack_local (net/netfilter/nf_conntrack_proto.c:223) nf_hook_slow (net/netfilter/core.c:619) __ip_local_out (net/ipv4/ip_output.c:120) __tcp_transmit_skb (net/ipv4/tcp_output.c:1715) tcp_connect (net/ipv4/tcp_output.c:4374) tcp_v4_connect (net/ipv4/tcp_ipv4.c:345) __sys_connect (net/socket.c:2167) Modules linked in: nf_conntrack_h323 [last unloaded: nf_nat_h323] Reaching the dangling state requires CAP_SYS_MODULE in the initial user namespace to remove a NAT helper that still has live expectations, so this is a robustness fix; leaving an expectation pointing at freed text is wrong regardless. Add nf_ct_helper_expectfn_destroy(), which walks the expectation table and drops every expectation whose ->expectfn matches the descriptor being torn down. Call it from each NAT helper's exit path after the existing RCU grace period, so no expectation outlives the code it points at and no extra synchronize_rcu() is introduced. With the fix, the same reproducer runs to completion without the Oops. Fixes: f587de0e2feb ("[NETFILTER]: nf_conntrack/nf_nat: add H.323 helper port") Reported-by: Xiang Mei <xmei5(a)asu.edu> Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Weiming Shi <bestswngs(a)gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/ipv4/netfilter/nf_nat_h323.c net/netfilter/nf_nat_core.c [commit cbc1dd5b659f is not backport] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- include/net/netfilter/nf_conntrack_helper.h | 1 + net/ipv4/netfilter/nf_nat_h323.c | 2 ++ net/netfilter/nf_conntrack_helper.c | 19 +++++++++++++++++++ net/netfilter/nf_nat_core.c | 2 ++ net/netfilter/nf_nat_sip.c | 1 + 5 files changed, 25 insertions(+) diff --git a/include/net/netfilter/nf_conntrack_helper.h b/include/net/netfilter/nf_conntrack_helper.h index 37f0fbefb060..3932f09f8801 100644 --- a/include/net/netfilter/nf_conntrack_helper.h +++ b/include/net/netfilter/nf_conntrack_helper.h @@ -152,6 +152,7 @@ void nf_ct_helper_log(struct sk_buff *skb, const struct nf_conn *ct, void nf_ct_helper_expectfn_register(struct nf_ct_helper_expectfn *n); void nf_ct_helper_expectfn_unregister(struct nf_ct_helper_expectfn *n); +void nf_ct_helper_expectfn_destroy(const struct nf_ct_helper_expectfn *n); struct nf_ct_helper_expectfn * nf_ct_helper_expectfn_find_by_name(const char *name); struct nf_ct_helper_expectfn * diff --git a/net/ipv4/netfilter/nf_nat_h323.c b/net/ipv4/netfilter/nf_nat_h323.c index 3e2685c120c7..d028cbae11e8 100644 --- a/net/ipv4/netfilter/nf_nat_h323.c +++ b/net/ipv4/netfilter/nf_nat_h323.c @@ -621,6 +621,8 @@ static void __exit fini(void) nf_ct_helper_expectfn_unregister(&q931_nat); nf_ct_helper_expectfn_unregister(&callforwarding_nat); synchronize_rcu(); + nf_ct_helper_expectfn_destroy(&q931_nat); + nf_ct_helper_expectfn_destroy(&callforwarding_nat); } /****************************************************************************/ diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c index 862a782ec931..24a945cfb2e8 100644 --- a/net/netfilter/nf_conntrack_helper.c +++ b/net/netfilter/nf_conntrack_helper.c @@ -332,6 +332,25 @@ void nf_ct_helper_expectfn_unregister(struct nf_ct_helper_expectfn *n) } EXPORT_SYMBOL_GPL(nf_ct_helper_expectfn_unregister); +static bool expect_iter_expectfn(struct nf_conntrack_expect *exp, void *data) +{ + const struct nf_ct_helper_expectfn *n = data; + + /* Relies on registered expectfn descriptors having unique ->expectfn + * pointers, which holds for the in-tree NAT helpers. + */ + return exp->expectfn == n->expectfn; +} + +/* Destroy expectations still pointing at @n->expectfn; call after the + * caller's RCU grace period so none outlives the (often modular) callback. + */ +void nf_ct_helper_expectfn_destroy(const struct nf_ct_helper_expectfn *n) +{ + nf_ct_expect_iterate_destroy(expect_iter_expectfn, (void *)n); +} +EXPORT_SYMBOL_GPL(nf_ct_helper_expectfn_destroy); + /* Caller should hold the rcu lock */ struct nf_ct_helper_expectfn * nf_ct_helper_expectfn_find_by_name(const char *name) diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c index b7c3c902290f..ddc2b59ff43c 100644 --- a/net/netfilter/nf_nat_core.c +++ b/net/netfilter/nf_nat_core.c @@ -1179,6 +1179,7 @@ static int __init nf_nat_init(void) } nf_ct_helper_expectfn_register(&follow_master_nat); + nf_ct_helper_expectfn_destroy(&follow_master_nat); WARN_ON(nf_nat_hook != NULL); RCU_INIT_POINTER(nf_nat_hook, &nat_hook); @@ -1197,6 +1198,7 @@ static void __exit nf_nat_cleanup(void) RCU_INIT_POINTER(nf_nat_hook, NULL); synchronize_net(); + nf_ct_helper_expectfn_destroy(&follow_master_nat); kvfree(nf_nat_bysource); unregister_pernet_subsys(&nat_net_ops); } diff --git a/net/netfilter/nf_nat_sip.c b/net/netfilter/nf_nat_sip.c index 390ff2d3c6bc..80afbff649be 100644 --- a/net/netfilter/nf_nat_sip.c +++ b/net/netfilter/nf_nat_sip.c @@ -667,6 +667,7 @@ static void __exit nf_nat_sip_fini(void) RCU_INIT_POINTER(nf_nat_sip_hooks, NULL); nf_ct_helper_expectfn_unregister(&sip_nat); synchronize_rcu(); + nf_ct_helper_expectfn_destroy(&sip_nat); } static const struct nf_nat_sip_hooks sip_hooks = { -- 2.43.0

2 1

[PATCH OLK-5.10] vdpa: use generic driver_override infrastructure
by Lin Ruifeng 06 Jul '26

06 Jul '26

From: Danilo Krummrich <dakr(a)kernel.org> stable inclusion from stable-v6.18.33 commit 654ef9c33e138ede6734ac286282df9faf83cd11 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15815 CVE: CVE-2026-53118 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 85bb534ff12aab6916058897b39c748940a7a4c6 ] When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF. Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally. Note that calling match() from __driver_attach() without the device lock held is intentional. [1] Link: https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/ [1] Reported-by: Gui-Dong Han <hanguidong02(a)gmail.com> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220789 Fixes: 539fec78edb4 ("vdpa: add driver_override support") Acked-by: Eugenio Pérez <eperezma(a)redhat.com> Acked-by: Michael S. Tsirkin <mst(a)redhat.com> Link: https://patch.msgid.link/20260324005919.2408620-9-dakr@kernel.org Signed-off-by: Danilo Krummrich <dakr(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/vdpa/vdpa.c include/linux/vdpa.h [Context Conflicts] Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/vdpa/vdpa.c | 70 ++++---------------------------------------- include/linux/vdpa.h | 2 -- 2 files changed, 5 insertions(+), 67 deletions(-) diff --git a/drivers/vdpa/vdpa.c b/drivers/vdpa/vdpa.c index 5c9e37061fce..2c68dad26c56 100644 --- a/drivers/vdpa/vdpa.c +++ b/drivers/vdpa/vdpa.c @@ -64,79 +64,20 @@ static int vdpa_dev_remove(struct device *d) static int vdpa_dev_match(struct device *dev, struct device_driver *drv) { - struct vdpa_device *vdev = dev_to_vdpa(dev); + int ret; /* Check override first, and if set, only use the named driver */ - if (vdev->driver_override) - return strcmp(vdev->driver_override, drv->name) == 0; + ret = device_match_driver_override(dev, drv); + if (ret >= 0) + return ret; /* Currently devices must be supported by all vDPA bus drivers */ return 1; } -static ssize_t driver_override_store(struct device *dev, - struct device_attribute *attr, - const char *buf, size_t count) -{ - struct vdpa_device *vdev = dev_to_vdpa(dev); - const char *driver_override, *old; - char *cp; - - /* We need to keep extra room for a newline */ - if (count >= (PAGE_SIZE - 1)) - return -EINVAL; - - driver_override = kstrndup(buf, count, GFP_KERNEL); - if (!driver_override) - return -ENOMEM; - - cp = strchr(driver_override, '\n'); - if (cp) - *cp = '\0'; - - device_lock(dev); - old = vdev->driver_override; - if (strlen(driver_override)) { - vdev->driver_override = driver_override; - } else { - kfree(driver_override); - vdev->driver_override = NULL; - } - device_unlock(dev); - - kfree(old); - - return count; -} - -static ssize_t driver_override_show(struct device *dev, - struct device_attribute *attr, char *buf) -{ - struct vdpa_device *vdev = dev_to_vdpa(dev); - ssize_t len; - - device_lock(dev); - len = snprintf(buf, PAGE_SIZE, "%s\n", vdev->driver_override); - device_unlock(dev); - - return len; -} -static DEVICE_ATTR_RW(driver_override); - -static struct attribute *vdpa_dev_attrs[] = { - &dev_attr_driver_override.attr, - NULL, -}; - -static const struct attribute_group vdpa_dev_group = { - .attrs = vdpa_dev_attrs, -}; -__ATTRIBUTE_GROUPS(vdpa_dev); - - static struct bus_type vdpa_bus = { .name = "vdpa", - .dev_groups = vdpa_dev_groups, + .driver_override = true, .match = vdpa_dev_match, .probe = vdpa_dev_probe, .remove = vdpa_dev_remove, @@ -151,7 +92,6 @@ static void vdpa_release_dev(struct device *d) ops->free(vdev); ida_simple_remove(&vdpa_index_ida, vdev->index); - kfree(vdev->driver_override); kfree(vdev); } diff --git a/include/linux/vdpa.h b/include/linux/vdpa.h index ef53829c7a7a..825b88740eb1 100644 --- a/include/linux/vdpa.h +++ b/include/linux/vdpa.h @@ -64,7 +64,6 @@ struct vdpa_mgmt_dev; * struct vdpa_device - representation of a vDPA device * @dev: underlying device * @dma_dev: the actual device that is performing DMA - * @driver_override: driver name to force a match * @config: the configuration ops for this device. * @cf_lock: Protects get and set access to configuration layout. * @index: device index @@ -79,7 +78,6 @@ struct vdpa_mgmt_dev; struct vdpa_device { struct device dev; struct device *dma_dev; - const char *driver_override; const struct vdpa_config_ops *config; struct rw_semaphore cf_lock; /* Protects get/set config */ unsigned int index; -- 2.34.1

2 1

[PATCH OLK-5.10] netfilter: nf_conntrack: destroy stale expectfn expectations
by superdcc97＠163.com 06 Jul '26

06 Jul '26

From: Weiming Shi <bestswngs(a)gmail.com> mainline inclusion from mainline-v7.2-rc1 commit c3009418f9fa1dcb3eb86f4d8c92583537b5faa3 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16058 CVE: CVE-2026-53349 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- NAT helpers such as nf_nat_h323 store a raw pointer to module text in exp->expectfn (e.g. ip_nat_q931_expect). nf_ct_helper_expectfn_unregister() only unlinks the callback descriptor and never walks the expectation table, so an expectation pending at module removal survives with a dangling exp->expectfn into freed module text. When the expected connection arrives, init_conntrack() invokes exp->expectfn(), now a stale pointer into the unloaded module. Reproduced on a KASAN build by loading the H.323 helpers, creating a Q.931 expectation, unloading nf_nat_h323, then connecting to the expected port: Oops: int3: 0000 [#1] SMP KASAN NOPTI RIP: 0010:0xffffffffa06102d1 init_conntrack.isra.0 (net/netfilter/nf_conntrack_core.c:1862) nf_conntrack_in (net/netfilter/nf_conntrack_core.c:2049) ipv4_conntrack_local (net/netfilter/nf_conntrack_proto.c:223) nf_hook_slow (net/netfilter/core.c:619) __ip_local_out (net/ipv4/ip_output.c:120) __tcp_transmit_skb (net/ipv4/tcp_output.c:1715) tcp_connect (net/ipv4/tcp_output.c:4374) tcp_v4_connect (net/ipv4/tcp_ipv4.c:345) __sys_connect (net/socket.c:2167) Modules linked in: nf_conntrack_h323 [last unloaded: nf_nat_h323] Reaching the dangling state requires CAP_SYS_MODULE in the initial user namespace to remove a NAT helper that still has live expectations, so this is a robustness fix; leaving an expectation pointing at freed text is wrong regardless. Add nf_ct_helper_expectfn_destroy(), which walks the expectation table and drops every expectation whose ->expectfn matches the descriptor being torn down. Call it from each NAT helper's exit path after the existing RCU grace period, so no expectation outlives the code it points at and no extra synchronize_rcu() is introduced. With the fix, the same reproducer runs to completion without the Oops. Fixes: f587de0e2feb ("[NETFILTER]: nf_conntrack/nf_nat: add H.323 helper port") Reported-by: Xiang Mei <xmei5(a)asu.edu> Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Weiming Shi <bestswngs(a)gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/ipv4/netfilter/nf_nat_h323.c net/netfilter/nf_nat_core.c [context differs on OLK-5.10] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- include/net/netfilter/nf_conntrack_helper.h | 1 + net/ipv4/netfilter/nf_nat_h323.c | 2 ++ net/netfilter/nf_conntrack_helper.c | 19 +++++++++++++++++++ net/netfilter/nf_nat_core.c | 2 ++ net/netfilter/nf_nat_sip.c | 1 + 5 files changed, 25 insertions(+) diff --git a/include/net/netfilter/nf_conntrack_helper.h b/include/net/netfilter/nf_conntrack_helper.h index 37f0fbefb060..3932f09f8801 100644 --- a/include/net/netfilter/nf_conntrack_helper.h +++ b/include/net/netfilter/nf_conntrack_helper.h @@ -152,6 +152,7 @@ void nf_ct_helper_log(struct sk_buff *skb, const struct nf_conn *ct, void nf_ct_helper_expectfn_register(struct nf_ct_helper_expectfn *n); void nf_ct_helper_expectfn_unregister(struct nf_ct_helper_expectfn *n); +void nf_ct_helper_expectfn_destroy(const struct nf_ct_helper_expectfn *n); struct nf_ct_helper_expectfn * nf_ct_helper_expectfn_find_by_name(const char *name); struct nf_ct_helper_expectfn * diff --git a/net/ipv4/netfilter/nf_nat_h323.c b/net/ipv4/netfilter/nf_nat_h323.c index 3e2685c120c7..d028cbae11e8 100644 --- a/net/ipv4/netfilter/nf_nat_h323.c +++ b/net/ipv4/netfilter/nf_nat_h323.c @@ -621,6 +621,8 @@ static void __exit fini(void) nf_ct_helper_expectfn_unregister(&q931_nat); nf_ct_helper_expectfn_unregister(&callforwarding_nat); synchronize_rcu(); + nf_ct_helper_expectfn_destroy(&q931_nat); + nf_ct_helper_expectfn_destroy(&callforwarding_nat); } /****************************************************************************/ diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c index 862a782ec931..24a945cfb2e8 100644 --- a/net/netfilter/nf_conntrack_helper.c +++ b/net/netfilter/nf_conntrack_helper.c @@ -332,6 +332,25 @@ void nf_ct_helper_expectfn_unregister(struct nf_ct_helper_expectfn *n) } EXPORT_SYMBOL_GPL(nf_ct_helper_expectfn_unregister); +static bool expect_iter_expectfn(struct nf_conntrack_expect *exp, void *data) +{ + const struct nf_ct_helper_expectfn *n = data; + + /* Relies on registered expectfn descriptors having unique ->expectfn + * pointers, which holds for the in-tree NAT helpers. + */ + return exp->expectfn == n->expectfn; +} + +/* Destroy expectations still pointing at @n->expectfn; call after the + * caller's RCU grace period so none outlives the (often modular) callback. + */ +void nf_ct_helper_expectfn_destroy(const struct nf_ct_helper_expectfn *n) +{ + nf_ct_expect_iterate_destroy(expect_iter_expectfn, (void *)n); +} +EXPORT_SYMBOL_GPL(nf_ct_helper_expectfn_destroy); + /* Caller should hold the rcu lock */ struct nf_ct_helper_expectfn * nf_ct_helper_expectfn_find_by_name(const char *name) diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c index b7c3c902290f..62356dcd694b 100644 --- a/net/netfilter/nf_nat_core.c +++ b/net/netfilter/nf_nat_core.c @@ -1341,6 +1341,7 @@ static int __init nf_nat_init(void) RCU_INIT_POINTER(nf_nat_hook, NULL); nf_ct_helper_expectfn_unregister(&follow_master_nat); synchronize_net(); + nf_ct_helper_expectfn_destroy(&follow_master_nat); unregister_pernet_subsys(&nat_net_ops); kvfree(nf_nat_bysource); } @@ -1358,6 +1359,7 @@ static void __exit nf_nat_cleanup(void) RCU_INIT_POINTER(nf_nat_hook, NULL); synchronize_net(); + nf_ct_helper_expectfn_destroy(&follow_master_nat); kvfree(nf_nat_bysource); unregister_pernet_subsys(&nat_net_ops); } diff --git a/net/netfilter/nf_nat_sip.c b/net/netfilter/nf_nat_sip.c index 15d4267cf49f..71e75a751c09 100644 --- a/net/netfilter/nf_nat_sip.c +++ b/net/netfilter/nf_nat_sip.c @@ -666,6 +666,7 @@ static void __exit nf_nat_sip_fini(void) RCU_INIT_POINTER(nf_nat_sip_hooks, NULL); nf_ct_helper_expectfn_unregister(&sip_nat); synchronize_rcu(); + nf_ct_helper_expectfn_destroy(&sip_nat); } static const struct nf_nat_sip_hooks sip_hooks = { -- 2.43.0

2 1

[PATCH OLK-6.6] drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs
by Hongtao Zhang 06 Jul '26

06 Jul '26

From: Harry Wentland <harry.wentland(a)amd.com> stable inclusion from stable-v6.6.143 commit 7fc4fab4acc307ad2903312c195872b2953d32c3 category: bugfix bugzilla: 15829 CVE: CVE-2026-53135 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit adf67034b1f61f7119295208085bfd43f85f56af upstream. [Why & How] dp_sdp_message_debugfs_write() dereferences connector->base.state->crtc without checking for NULL. A connector can be connected but not bound to any CRTC (e.g. after hot-plug before the next atomic commit), causing a kernel crash when writing to the sdp_message debugfs node. The function also ignores the user-provided size argument and always passes 36 bytes to copy_from_user(), reading past the user buffer when size < 36. Fix both issues by: - Returning -ENODEV when connector->base.state or state->crtc is NULL - Clamping write_size to min(size, sizeof(data)) Fixes: c7ba3653e977 ("drm/amd/display: Generic SDP message access in amdgpu") Assisted-by: Copilot:claude-opus-4.6 Reviewed-by: Alex Hung <alex.hung(a)amd.com> Signed-off-by: Harry Wentland <harry.wentland(a)amd.com> Signed-off-by: Ray Wu <ray.wu(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> (cherry picked from commit 6ab4c36a522842ff70474a1c0af2e40e50fc8300) Cc: stable(a)vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Hongtao <zhanghongtao35(a)huawei.com> --- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c index c8609595f324b..4b8101bf62e9d 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c @@ -1230,8 +1230,13 @@ static ssize_t dp_sdp_message_debugfs_write(struct file *f, const char __user *b if (size == 0) return 0; + if (!connector->base.state || !connector->base.state->crtc) + return -ENODEV; + acrtc_state = to_dm_crtc_state(connector->base.state->crtc->state); + write_size = min_t(size_t, size, sizeof(data)); + r = copy_from_user(data, buf, write_size); write_size -= r; -- 2.43.0

2 1

[PATCH OLK-5.10] drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs
by Hongtao Zhang 06 Jul '26

06 Jul '26

From: Harry Wentland <harry.wentland(a)amd.com> stable inclusion from stable-v5.10.259 commit ee9cfcf77a8e8af637396dc00966df5f701e661c category: bugfix bugzilla: 15829 CVE: CVE-2026-53135 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit adf67034b1f61f7119295208085bfd43f85f56af upstream. [Why & How] dp_sdp_message_debugfs_write() dereferences connector->base.state->crtc without checking for NULL. A connector can be connected but not bound to any CRTC (e.g. after hot-plug before the next atomic commit), causing a kernel crash when writing to the sdp_message debugfs node. The function also ignores the user-provided size argument and always passes 36 bytes to copy_from_user(), reading past the user buffer when size < 36. Fix both issues by: - Returning -ENODEV when connector->base.state or state->crtc is NULL - Clamping write_size to min(size, sizeof(data)) Fixes: c7ba3653e977 ("drm/amd/display: Generic SDP message access in amdgpu") Assisted-by: Copilot:claude-opus-4.6 Reviewed-by: Alex Hung <alex.hung(a)amd.com> Signed-off-by: Harry Wentland <harry.wentland(a)amd.com> Signed-off-by: Ray Wu <ray.wu(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> (cherry picked from commit 6ab4c36a522842ff70474a1c0af2e40e50fc8300) Cc: stable(a)vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Hongtao <zhanghongtao35(a)huawei.com> --- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c index f4a1ad8959b7d..8b27ccae62b34 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c @@ -895,8 +895,13 @@ static ssize_t dp_sdp_message_debugfs_write(struct file *f, const char __user *b if (size == 0) return 0; + if (!connector->base.state || !connector->base.state->crtc) + return -ENODEV; + acrtc_state = to_dm_crtc_state(connector->base.state->crtc->state); + write_size = min_t(size_t, size, sizeof(data)); + r = copy_from_user(data, buf, write_size); write_size -= r; -- 2.43.0

2 1

[PATCH OLK-6.6] drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval()
by Hongtao Zhang 06 Jul '26

06 Jul '26

From: Harry Wentland <harry.wentland(a)amd.com> mainline inclusion from mainline-v7.1-rc7 commit e8b4d37eba05141ee01794fc6b7f2da808cee83b category: bugfix bugzilla: 16039 CVE: CVE-2026-53330 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [Why & How] The aux_rd_interval array in struct dc_lttpr_caps is declared with MAX_REPEATER_CNT - 1 (7) elements, indexed 0..6. However, the offset parameter passed to dp_get_eq_aux_rd_interval() can be as large as MAX_REPEATER_CNT (8) when a sink reports 8 LTTPR repeaters via DPCD. This leads to an out-of-bounds read of aux_rd_interval[7] when offset is 8. Fix this by growing aux_rd_interval to MAX_REPEATER_CNT elements to accommodate the full range of valid repeater counts defined by the DP spec. Assisted-by: GitHub Copilot:Claude claude-4-opus Signed-off-by: Harry Wentland <harry.wentland(a)amd.com> Signed-off-by: Ray Wu <ray.wu(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> (cherry picked from commit a55a458a8df37a65ffda5cf721d554a8f74f6b04) Cc: stable(a)vger.kernel.org Conflicts: drivers/gpu/drm/amd/display/dc/dc_dp_types.h [conflicts due to not mergered de84d580126eb ("drm/amd/display: Read LTTPR ALPM caps during link cap retrieval")] Signed-off-by: Zhang Hongtao <zhanghongtao35(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/dc_dp_types.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/dc/dc_dp_types.h b/drivers/gpu/drm/amd/display/dc/dc_dp_types.h index 83719f5bea495..f834c0fa3b17c 100644 --- a/drivers/gpu/drm/amd/display/dc/dc_dp_types.h +++ b/drivers/gpu/drm/amd/display/dc/dc_dp_types.h @@ -1156,7 +1156,7 @@ struct dc_lttpr_caps { uint8_t max_ext_timeout; union dp_main_link_channel_coding_lttpr_cap main_link_channel_coding; union dp_128b_132b_supported_lttpr_link_rates supported_128b_132b_rates; - uint8_t aux_rd_interval[MAX_REPEATER_CNT - 1]; + uint8_t aux_rd_interval[MAX_REPEATER_CNT]; }; struct dc_dongle_dfp_cap_ext { -- 2.43.0

2 1

[PATCH OLK-5.10] RDMA/srp: bound SRP_RSP sense copy by the received length
by Chen Jinghuang 06 Jul '26

06 Jul '26

From: Michael Bommarito <michael.bommarito(a)gmail.com> stable inclusion from stable-v5.10.259 commit 3889517c2ec7f364914aea8209abfff735f7ecde category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15871 CVE: CVE-2026-53186 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 13e91fd076306f5d0cdfa14f53d69e37274723c4 upstream. srp_process_rsp() copies sense data from rsp->data + resp_data_len, where resp_data_len is the full 32-bit value supplied by the SRP target and is never checked against the number of bytes actually received (wc->byte_len). The copy length is bounded to SCSI_SENSE_BUFFERSIZE, so at most 96 bytes are copied, but the source offset is not bounded. A malicious or compromised SRP target on the InfiniBand/RoCE fabric that the initiator has logged into can return an SRP_RSP with SRP_RSP_FLAG_SNSVALID set and a large resp_data_len. The receive buffer is allocated at the target-chosen max_ti_iu_len, so the source of the sense copy lands past the bytes actually received; with resp_data_len near 0xFFFFFFFF it is gigabytes past the buffer and the read faults. Copy the sense data only if it has not been truncated, that is, only if the response header, the response data, and the sense region fit within the bytes actually received; otherwise drop the sense and log. The in-tree iSER and NVMe-RDMA receive paths already bound their parse by wc->byte_len; this brings ib_srp into line with them. Fixes: aef9ec39c47f ("IB: Add SCSI RDMA Protocol (SRP) initiator") Link: https://patch.msgid.link/r/20260602220457.2542840-1-michael.bommarito@gmail… Cc: stable(a)vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Reviewed-by: Bart Van Assche <bvanassche(a)acm.org> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/infiniband/ulp/srp/ib_srp.c [Fix type-mismatch build error using min_t for explicit casting and kernel safety.] Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- drivers/infiniband/ulp/srp/ib_srp.c | 30 +++++++++++++++++++++++------ 1 file changed, 24 insertions(+), 6 deletions(-) diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c index 68df080263f2..2348555cb041 100644 --- a/drivers/infiniband/ulp/srp/ib_srp.c +++ b/drivers/infiniband/ulp/srp/ib_srp.c @@ -1929,7 +1929,8 @@ static int srp_post_recv(struct srp_rdma_ch *ch, struct srp_iu *iu) return ib_post_recv(ch->qp, &wr, NULL); } -static void srp_process_rsp(struct srp_rdma_ch *ch, struct srp_rsp *rsp) +static void srp_process_rsp(struct srp_rdma_ch *ch, struct srp_rsp *rsp, + u32 byte_len) { struct srp_target_port *target = ch->target; struct srp_request *req; @@ -1970,10 +1971,27 @@ static void srp_process_rsp(struct srp_rdma_ch *ch, struct srp_rsp *rsp) scmnd->result = rsp->status; if (rsp->flags & SRP_RSP_FLAG_SNSVALID) { - memcpy(scmnd->sense_buffer, rsp->data + - be32_to_cpu(rsp->resp_data_len), - min_t(int, be32_to_cpu(rsp->sense_data_len), - SCSI_SENSE_BUFFERSIZE)); + u32 resp_len = be32_to_cpu(rsp->resp_data_len); + u32 sense_len = be32_to_cpu(rsp->sense_data_len); + + /* + * The sense data starts resp_data_len bytes past the + * response data area; both lengths come from the + * target-controlled response. Copy the sense data + * only if it has not been truncated, that is, only if + * the full sense region fits within the bytes actually + * received. Otherwise the copy source would run past + * the receive buffer (sized to the target-chosen + * max_ti_iu_len), reading out of bounds. + */ + if (sizeof(*rsp) + (u64)resp_len + sense_len <= byte_len) + memcpy(scmnd->sense_buffer, + rsp->data + resp_len, + min_t(u32, sense_len, SCSI_SENSE_BUFFERSIZE)); + else + shost_printk(KERN_ERR, target->scsi_host, + "dropping truncated sense data (resp_data_len %u sense_data_len %u, %u bytes received)\n", + resp_len, sense_len, byte_len); } if (unlikely(rsp->flags & SRP_RSP_FLAG_DIUNDER)) @@ -2083,7 +2101,7 @@ static void srp_recv_done(struct ib_cq *cq, struct ib_wc *wc) switch (opcode) { case SRP_RSP: - srp_process_rsp(ch, iu->buf); + srp_process_rsp(ch, iu->buf, wc->byte_len); break; case SRP_CRED_REQ: -- 2.34.1

2 1

[PATCH OLK-5.10] vdpa: use generic driver_override infrastructure
by Lin Ruifeng 06 Jul '26

06 Jul '26

From: Danilo Krummrich <dakr(a)kernel.org> stable inclusion from stable-v6.18.33 commit 654ef9c33e138ede6734ac286282df9faf83cd11 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15815 CVE: CVE-2026-53118 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 85bb534ff12aab6916058897b39c748940a7a4c6 ] When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF. Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally. Note that calling match() from __driver_attach() without the device lock held is intentional. [1] Link: https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/ [1] Reported-by: Gui-Dong Han <hanguidong02(a)gmail.com> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220789 Fixes: 539fec78edb4 ("vdpa: add driver_override support") Acked-by: Eugenio Pérez <eperezma(a)redhat.com> Acked-by: Michael S. Tsirkin <mst(a)redhat.com> Link: https://patch.msgid.link/20260324005919.2408620-9-dakr@kernel.org Signed-off-by: Danilo Krummrich <dakr(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/vdpa/vdpa.c include/linux/vdpa.h [Context Conflicts] Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/vdpa/vdpa.c | 69 ++++---------------------------------------- include/linux/vdpa.h | 2 -- 2 files changed, 5 insertions(+), 66 deletions(-) diff --git a/drivers/vdpa/vdpa.c b/drivers/vdpa/vdpa.c index 5c9e37061fce..021daa026990 100644 --- a/drivers/vdpa/vdpa.c +++ b/drivers/vdpa/vdpa.c @@ -65,78 +65,20 @@ static int vdpa_dev_remove(struct device *d) static int vdpa_dev_match(struct device *dev, struct device_driver *drv) { struct vdpa_device *vdev = dev_to_vdpa(dev); + int ret; /* Check override first, and if set, only use the named driver */ - if (vdev->driver_override) - return strcmp(vdev->driver_override, drv->name) == 0; + ret = device_match_driver_override(dev, drv); + if (ret >= 0) + return ret; /* Currently devices must be supported by all vDPA bus drivers */ return 1; } -static ssize_t driver_override_store(struct device *dev, - struct device_attribute *attr, - const char *buf, size_t count) -{ - struct vdpa_device *vdev = dev_to_vdpa(dev); - const char *driver_override, *old; - char *cp; - - /* We need to keep extra room for a newline */ - if (count >= (PAGE_SIZE - 1)) - return -EINVAL; - - driver_override = kstrndup(buf, count, GFP_KERNEL); - if (!driver_override) - return -ENOMEM; - - cp = strchr(driver_override, '\n'); - if (cp) - *cp = '\0'; - - device_lock(dev); - old = vdev->driver_override; - if (strlen(driver_override)) { - vdev->driver_override = driver_override; - } else { - kfree(driver_override); - vdev->driver_override = NULL; - } - device_unlock(dev); - - kfree(old); - - return count; -} - -static ssize_t driver_override_show(struct device *dev, - struct device_attribute *attr, char *buf) -{ - struct vdpa_device *vdev = dev_to_vdpa(dev); - ssize_t len; - - device_lock(dev); - len = snprintf(buf, PAGE_SIZE, "%s\n", vdev->driver_override); - device_unlock(dev); - - return len; -} -static DEVICE_ATTR_RW(driver_override); - -static struct attribute *vdpa_dev_attrs[] = { - &dev_attr_driver_override.attr, - NULL, -}; - -static const struct attribute_group vdpa_dev_group = { - .attrs = vdpa_dev_attrs, -}; -__ATTRIBUTE_GROUPS(vdpa_dev); - - static struct bus_type vdpa_bus = { .name = "vdpa", - .dev_groups = vdpa_dev_groups, + .driver_override = true, .match = vdpa_dev_match, .probe = vdpa_dev_probe, .remove = vdpa_dev_remove, @@ -151,7 +93,6 @@ static void vdpa_release_dev(struct device *d) ops->free(vdev); ida_simple_remove(&vdpa_index_ida, vdev->index); - kfree(vdev->driver_override); kfree(vdev); } diff --git a/include/linux/vdpa.h b/include/linux/vdpa.h index ef53829c7a7a..825b88740eb1 100644 --- a/include/linux/vdpa.h +++ b/include/linux/vdpa.h @@ -64,7 +64,6 @@ struct vdpa_mgmt_dev; * struct vdpa_device - representation of a vDPA device * @dev: underlying device * @dma_dev: the actual device that is performing DMA - * @driver_override: driver name to force a match * @config: the configuration ops for this device. * @cf_lock: Protects get and set access to configuration layout. * @index: device index @@ -79,7 +78,6 @@ struct vdpa_mgmt_dev; struct vdpa_device { struct device dev; struct device *dma_dev; - const char *driver_override; const struct vdpa_config_ops *config; struct rw_semaphore cf_lock; /* Protects get/set config */ unsigned int index; -- 2.34.1

2 1

[PATCH OLK-6.6 0/3] CVE-2026-53084 and CVE-2026-53085
by Pu Lehui 05 Jul '26

05 Jul '26

Puranjay Mohan (3): bpf: fix mm lifecycle in open-coded task_vma iterator bpf: switch task_vma iterator from mmap_lock to per-VMA locks bpf: return VMA snapshot from task_vma iterator kernel/bpf/task_iter.c | 151 +++++++++++++++++++++++++++++++++++++---- 1 file changed, 136 insertions(+), 15 deletions(-) -- 2.34.1

2 4

[PATCH OLK-6.6 0/3] CVE-2026-53084
by Pu Lehui 05 Jul '26

05 Jul '26

Puranjay Mohan (3): bpf: fix mm lifecycle in open-coded task_vma iterator bpf: switch task_vma iterator from mmap_lock to per-VMA locks bpf: return VMA snapshot from task_vma iterator kernel/bpf/task_iter.c | 151 +++++++++++++++++++++++++++++++++++++---- 1 file changed, 136 insertions(+), 15 deletions(-) -- 2.34.1

2 4

[PATCH OLK-6.6 0/2] fix CVE-2026-53003
by Lu Jialin 04 Jul '26

04 Jul '26

Lu Jialin (1): fix kabi for ppp_defs.h Qingfang Deng (1): pppoe: drop PFC frames drivers/net/ppp/pppoe.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/2] fix CVE-2026-53003
by Lu Jialin 04 Jul '26

04 Jul '26

Lu Jialin (1): fix kabi for ppp_defs.h Qingfang Deng (1): pppoe: drop PFC frames drivers/net/ppp/pppoe.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH OLK-5.10] netfilter: nf_conntrack: destroy stale expectfn expectations
by superdcc97＠163.com 04 Jul '26

04 Jul '26

From: Weiming Shi <bestswngs(a)gmail.com> mainline inclusion from mainline-v7.2-rc1 commit c3009418f9fa1dcb3eb86f4d8c92583537b5faa3 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16058 CVE: CVE-2026-53349 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- NAT helpers such as nf_nat_h323 store a raw pointer to module text in exp->expectfn (e.g. ip_nat_q931_expect). nf_ct_helper_expectfn_unregister() only unlinks the callback descriptor and never walks the expectation table, so an expectation pending at module removal survives with a dangling exp->expectfn into freed module text. When the expected connection arrives, init_conntrack() invokes exp->expectfn(), now a stale pointer into the unloaded module. Reproduced on a KASAN build by loading the H.323 helpers, creating a Q.931 expectation, unloading nf_nat_h323, then connecting to the expected port: Oops: int3: 0000 [#1] SMP KASAN NOPTI RIP: 0010:0xffffffffa06102d1 init_conntrack.isra.0 (net/netfilter/nf_conntrack_core.c:1862) nf_conntrack_in (net/netfilter/nf_conntrack_core.c:2049) ipv4_conntrack_local (net/netfilter/nf_conntrack_proto.c:223) nf_hook_slow (net/netfilter/core.c:619) __ip_local_out (net/ipv4/ip_output.c:120) __tcp_transmit_skb (net/ipv4/tcp_output.c:1715) tcp_connect (net/ipv4/tcp_output.c:4374) tcp_v4_connect (net/ipv4/tcp_ipv4.c:345) __sys_connect (net/socket.c:2167) Modules linked in: nf_conntrack_h323 [last unloaded: nf_nat_h323] Reaching the dangling state requires CAP_SYS_MODULE in the initial user namespace to remove a NAT helper that still has live expectations, so this is a robustness fix; leaving an expectation pointing at freed text is wrong regardless. Add nf_ct_helper_expectfn_destroy(), which walks the expectation table and drops every expectation whose ->expectfn matches the descriptor being torn down. Call it from each NAT helper's exit path after the existing RCU grace period, so no expectation outlives the code it points at and no extra synchronize_rcu() is introduced. With the fix, the same reproducer runs to completion without the Oops. Fixes: f587de0e2feb ("[NETFILTER]: nf_conntrack/nf_nat: add H.323 helper port") Reported-by: Xiang Mei <xmei5(a)asu.edu> Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Weiming Shi <bestswngs(a)gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/ipv4/netfilter/nf_nat_h323.c net/netfilter/nf_nat_core.c [commit cbc1dd5b659f is not backport, which lead to conflicts. - net/netfilter/nf_nat_core.c init error path: register_nf_nat_bpf() does not exist on OLK-5.10, so the corresponding nf_ct_helper_expectfn_destroy() call in that dead path was omitted (this path does not exist on target branch).] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- include/net/netfilter/nf_conntrack_helper.h | 1 + net/ipv4/netfilter/nf_nat_h323.c | 2 ++ net/netfilter/nf_conntrack_helper.c | 19 +++++++++++++++++++ net/netfilter/nf_nat_core.c | 1 + net/netfilter/nf_nat_sip.c | 1 + 5 files changed, 24 insertions(+) diff --git a/include/net/netfilter/nf_conntrack_helper.h b/include/net/netfilter/nf_conntrack_helper.h index 37f0fbefb060..3932f09f8801 100644 --- a/include/net/netfilter/nf_conntrack_helper.h +++ b/include/net/netfilter/nf_conntrack_helper.h @@ -152,6 +152,7 @@ void nf_ct_helper_log(struct sk_buff *skb, const struct nf_conn *ct, void nf_ct_helper_expectfn_register(struct nf_ct_helper_expectfn *n); void nf_ct_helper_expectfn_unregister(struct nf_ct_helper_expectfn *n); +void nf_ct_helper_expectfn_destroy(const struct nf_ct_helper_expectfn *n); struct nf_ct_helper_expectfn * nf_ct_helper_expectfn_find_by_name(const char *name); struct nf_ct_helper_expectfn * diff --git a/net/ipv4/netfilter/nf_nat_h323.c b/net/ipv4/netfilter/nf_nat_h323.c index 3e2685c120c7..d028cbae11e8 100644 --- a/net/ipv4/netfilter/nf_nat_h323.c +++ b/net/ipv4/netfilter/nf_nat_h323.c @@ -621,6 +621,8 @@ static void __exit fini(void) nf_ct_helper_expectfn_unregister(&q931_nat); nf_ct_helper_expectfn_unregister(&callforwarding_nat); synchronize_rcu(); + nf_ct_helper_expectfn_destroy(&q931_nat); + nf_ct_helper_expectfn_destroy(&callforwarding_nat); } /****************************************************************************/ diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c index 862a782ec931..24a945cfb2e8 100644 --- a/net/netfilter/nf_conntrack_helper.c +++ b/net/netfilter/nf_conntrack_helper.c @@ -332,6 +332,25 @@ void nf_ct_helper_expectfn_unregister(struct nf_ct_helper_expectfn *n) } EXPORT_SYMBOL_GPL(nf_ct_helper_expectfn_unregister); +static bool expect_iter_expectfn(struct nf_conntrack_expect *exp, void *data) +{ + const struct nf_ct_helper_expectfn *n = data; + + /* Relies on registered expectfn descriptors having unique ->expectfn + * pointers, which holds for the in-tree NAT helpers. + */ + return exp->expectfn == n->expectfn; +} + +/* Destroy expectations still pointing at @n->expectfn; call after the + * caller's RCU grace period so none outlives the (often modular) callback. + */ +void nf_ct_helper_expectfn_destroy(const struct nf_ct_helper_expectfn *n) +{ + nf_ct_expect_iterate_destroy(expect_iter_expectfn, (void *)n); +} +EXPORT_SYMBOL_GPL(nf_ct_helper_expectfn_destroy); + /* Caller should hold the rcu lock */ struct nf_ct_helper_expectfn * nf_ct_helper_expectfn_find_by_name(const char *name) diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c index b7c3c902290f..62356dcd694b 100644 --- a/net/netfilter/nf_nat_core.c +++ b/net/netfilter/nf_nat_core.c @@ -1197,6 +1197,7 @@ static void __exit nf_nat_cleanup(void) RCU_INIT_POINTER(nf_nat_hook, NULL); synchronize_net(); + nf_ct_helper_expectfn_destroy(&follow_master_nat); kvfree(nf_nat_bysource); unregister_pernet_subsys(&nat_net_ops); } diff --git a/net/netfilter/nf_nat_sip.c b/net/netfilter/nf_nat_sip.c index 15d4267cf49f..71e75a751c09 100644 --- a/net/netfilter/nf_nat_sip.c +++ b/net/netfilter/nf_nat_sip.c @@ -666,6 +666,7 @@ static void __exit nf_nat_sip_fini(void) RCU_INIT_POINTER(nf_nat_sip_hooks, NULL); nf_ct_helper_expectfn_unregister(&sip_nat); synchronize_rcu(); + nf_ct_helper_expectfn_destroy(&sip_nat); } static const struct nf_nat_sip_hooks sip_hooks = { -- 2.43.0

2 1

[PATCH OLK-6.6] net/sched: act_api: use RCU with deferred freeing for action lifecycle
by superdcc97＠163.com 04 Jul '26

04 Jul '26

From: Jamal Hadi Salim <jhs(a)mojatatu.com> stable inclusion from stable-v6.6.143 commit 8b136f18ac4b2ace5aaad3305b3f8a5d8165a009 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15950 CVE: CVE-2026-53264 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5057e1aca011e51ef51498c940ef96f3d3e8a305 ] When NEWTFILTER and DELFILTER are run concurrently it is possible to create a race with an associated action. Let's illustrate with CPU0 running NEWTFILTER and CPU1 running DELFILTER: 0: mutex_lock() <-- holds the idr lock 0: rcu_read_lock() 0: p = idr_find(idr, index) <-- action p is valid (RCU protects IDR) 0: mutex_unlock() <-- releases the idr lock 1: refcount_dec_and_mutex_lock() <-- refcnt 1->0, mutex held 1: idr_remove(idr, index) <-- Action removed from IDR 1: mutex_unlock() <-- mutex released allowing us to delete the action 1: tcf_action_cleanup(p); kfree(p) <-- Kfrees p immediately, no deferral 0: refcount_inc_not_zero(&p->tcfa_refcnt) <-- ouch, UAF p points to freed memory This patch fixes the race condition between NEWTFILTER and DELFILTER by adding struct rcu_head to tc_action used in the deferral and introducing a call_rcu() in the delete path to defer the final kfree(). Note: this is a revert of commit d7fb60b9cafb ("net_sched: get rid of tcfa_rcu") but also modernization/simplification to directly use kfree_rcu(). Let's illustrate the new restored code path: 0: rcu_read_lock() 1: refcount_dec_and_mutex_lock() <-- refcnt 1->0, mutex held 1: idr_remove(idr, index) 1: mutex_unlock() 1: call_rcu(&p->tcfa_rcu, tcf_action_rcu_free) <-- defer kfree after grace period 0: p = idr_find(idr, index) 0: refcount_inc_not_zero(&p->tcfa_refcnt) <-- fails, refcnt already 0 1: rcu_read_unlock() <-- release so freeing can run after grace period After CPU1 calls idr_remove(), the object is no longer reachable through the IDR. CPU0's subsequent idr_find() will return NULL, and even if it still held a stale pointer, the immediate kfree() is now deferred until after the RCU grace period, so no UAF can occur. Fixes: d7fb60b9cafb ("net_sched: get rid of tcfa_rcu") Suggested-by: Jakub Kicinski <kuba(a)kernel.org> Reported-by: Kyle Zeng <kylebot(a)openai.com> Tested-by: Victor Nogueira <victor(a)mojatatu.com> Tested-by: syzbot(a)syzkaller.appspotmail.com Signed-off-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Tested-by: Kyle Zeng <kylebot(a)openai.com> Reviewed-by: Pedro Tammela <pctammela(a)mojatatu.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Victor Nogueira <victor(a)mojatatu.com> Link: https://patch.msgid.link/20260531160812.68020-1-jhs@mojatatu.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- include/net/act_api.h | 1 + net/sched/act_api.c | 7 +------ 2 files changed, 2 insertions(+), 6 deletions(-) diff --git a/include/net/act_api.h b/include/net/act_api.h index 8db6994c90ee..56f49351fd51 100644 --- a/include/net/act_api.h +++ b/include/net/act_api.h @@ -42,6 +42,7 @@ struct tc_action { struct tc_cookie __rcu *user_cookie; struct tcf_chain __rcu *goto_chain; u32 tcfa_flags; + struct rcu_head tcfa_rcu; u8 hw_stats; u8 used_hw_stats; bool used_hw_stats_valid; diff --git a/net/sched/act_api.c b/net/sched/act_api.c index e509ac28c492..bed04ae3003c 100644 --- a/net/sched/act_api.c +++ b/net/sched/act_api.c @@ -112,11 +112,6 @@ struct tcf_chain *tcf_action_set_ctrlact(struct tc_action *a, int action, } EXPORT_SYMBOL(tcf_action_set_ctrlact); -/* XXX: For standalone actions, we don't need a RCU grace period either, because - * actions are always connected to filters and filters are already destroyed in - * RCU callbacks, so after a RCU grace period actions are already disconnected - * from filters. Readers later can not find us. - */ static void free_tcf(struct tc_action *p) { struct tcf_chain *chain = rcu_dereference_protected(p->goto_chain, 1); @@ -129,7 +124,7 @@ static void free_tcf(struct tc_action *p) if (chain) tcf_chain_put_by_act(chain); - kfree(p); + kfree_rcu(p, tcfa_rcu); } static void offload_action_hw_count_set(struct tc_action *act, -- 2.43.0

2 1

[PATCH OLK-6.6] netfilter: revalidate bridge ports
by superdcc97＠163.com 04 Jul '26

04 Jul '26

From: Florian Westphal <fw(a)strlen.de> mainline inclusion from mainline-v7.2-rc1 commit ccb9fd4b87538ccf19ccff78ee26700526d94867 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15906 CVE: CVE-2026-53220 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ebt_redirect_tg() dereferences br_port_get_rcu() return without a NULL check, causing a kernel panic when the bridge port has been removed between the original hook invocation and an NFQUEUE reinject. A mere NULL check isn't sufficient, however. As sashiko review points out userspace can not only remove the port from the bridge, it could also place the device in a different virtual device, e.g. macvlan. If this happens, we must drop the packet, there is no way for us to reinject it into the bridge path. Switch to _upper API, we don't need the bridge port structure. Also, this fix keeps another bug intact: Both nfnetlink_log and nfnetlink_queue use CONFIG_BRIDGE_NETFILTER too aggressive, which prevents certain logging features when queueing in bridge family: NETFILTER_FAMILY_BRIDGE can be enabled while the old CONFIG_BRIDGE_NETFILTER cruft is off. Fixes tag is a common ancestor, this was always broken. Fixes: f350a0a87374 ("bridge: use rx_handler_data pointer to store net_bridge_port pointer") Reported-by: Ji'an Zhou <eilaimemedsnaimel(a)gmail.com> Assisted-by: Claude:claude-sonnet-4-6 Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/bridge/netfilter/ebt_dnat.c | 4 +- net/bridge/netfilter/ebt_redirect.c | 16 +++++--- net/netfilter/nfnetlink_log.c | 23 +++++++++-- net/netfilter/nfnetlink_queue.c | 60 +++++++++++++++++++++++++++-- 4 files changed, 89 insertions(+), 14 deletions(-) diff --git a/net/bridge/netfilter/ebt_dnat.c b/net/bridge/netfilter/ebt_dnat.c index 3fda71a8579d..73f185cccd63 100644 --- a/net/bridge/netfilter/ebt_dnat.c +++ b/net/bridge/netfilter/ebt_dnat.c @@ -39,7 +39,9 @@ ebt_dnat_tg(struct sk_buff *skb, const struct xt_action_param *par) dev = xt_in(par); break; case NF_BR_PRE_ROUTING: - dev = br_port_get_rcu(xt_in(par))->br->dev; + dev = netdev_master_upper_dev_get_rcu(xt_in(par)); + if (!dev) /* bridge port removed? */ + return EBT_DROP; break; default: dev = NULL; diff --git a/net/bridge/netfilter/ebt_redirect.c b/net/bridge/netfilter/ebt_redirect.c index 307790562b49..83486cd4d564 100644 --- a/net/bridge/netfilter/ebt_redirect.c +++ b/net/bridge/netfilter/ebt_redirect.c @@ -24,12 +24,18 @@ ebt_redirect_tg(struct sk_buff *skb, const struct xt_action_param *par) if (skb_ensure_writable(skb, 0)) return EBT_DROP; - if (xt_hooknum(par) != NF_BR_BROUTING) - /* rcu_read_lock()ed by nf_hook_thresh */ - ether_addr_copy(eth_hdr(skb)->h_dest, - br_port_get_rcu(xt_in(par))->br->dev->dev_addr); - else + if (xt_hooknum(par) != NF_BR_BROUTING) { + const struct net_device *dev; + + dev = netdev_master_upper_dev_get_rcu(xt_in(par)); + if (!dev) + return EBT_DROP; + + ether_addr_copy(eth_hdr(skb)->h_dest, dev->dev_addr); + } else { ether_addr_copy(eth_hdr(skb)->h_dest, xt_in(par)->dev_addr); + } + skb->pkt_type = PACKET_HOST; return info->target; } diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c index 3da32d2f68e0..cfd68bc005d2 100644 --- a/net/netfilter/nfnetlink_log.c +++ b/net/netfilter/nfnetlink_log.c @@ -450,6 +450,23 @@ static int nfulnl_put_bridge(struct nfulnl_instance *inst, const struct sk_buff return -1; } +#if IS_ENABLED(CONFIG_BRIDGE_NETFILTER) +static int nflog_put_master_ifindex(struct sk_buff *nlskb, int attr, + const struct net_device *dev) +{ + const struct net_device *upper; + + if (dev && !netif_is_bridge_port(dev)) + return 0; + + upper = netdev_master_upper_dev_get_rcu((struct net_device *)dev); + if (upper && nla_put_be32(nlskb, attr, htonl(upper->ifindex))) + return -EMSGSIZE; + + return 0; +} +#endif + /* This is an inline function, we don't really care about a long * list of arguments */ static inline int @@ -504,8 +521,7 @@ __build_packet_message(struct nfnl_log_net *log, /* rcu_read_lock()ed by nf_hook_thresh or * nf_log_packet. */ - nla_put_be32(inst->skb, NFULA_IFINDEX_INDEV, - htonl(br_port_get_rcu(indev)->br->dev->ifindex))) + nflog_put_master_ifindex(inst->skb, NFULA_IFINDEX_INDEV, indev)) goto nla_put_failure; } else { int physinif; @@ -541,8 +557,7 @@ __build_packet_message(struct nfnl_log_net *log, /* rcu_read_lock()ed by nf_hook_thresh or * nf_log_packet. */ - nla_put_be32(inst->skb, NFULA_IFINDEX_OUTDEV, - htonl(br_port_get_rcu(outdev)->br->dev->ifindex))) + nflog_put_master_ifindex(inst->skb, NFULA_IFINDEX_OUTDEV, outdev)) goto nla_put_failure; } else { struct net_device *physoutdev; diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c index 38ab16b71c21..574c62a451ce 100644 --- a/net/netfilter/nfnetlink_queue.c +++ b/net/netfilter/nfnetlink_queue.c @@ -255,11 +255,48 @@ static bool nf_ct_drop_unconfirmed(const struct nf_queue_entry *entry, bool *is_ return false; } +static bool nf_bridge_port_valid(const struct net_device *dev) +{ + if (!dev) + return true; + + return netif_is_bridge_port(dev); +} + +/* queued skbs leave rcu protection. We bump device refcount so that + * the device cannot go away. However, while packet was out the port + * could have been removed from the bridge. + * + * Ensure in+outdev are still part of a bridge at reinject time. + * + * The device rx_handler_data could even be pointing at data that is + * not a net_bridge_port structure. + */ +static bool nf_bridge_ports_valid(const struct nf_queue_entry *entry) +{ +#if IS_ENABLED(CONFIG_BRIDGE_NETFILTER) + if (!nf_bridge_port_valid(entry->physin) || + !nf_bridge_port_valid(entry->physout)) + return false; +#endif + if (entry->state.pf != PF_BRIDGE) + return true; + + if (!nf_bridge_port_valid(entry->state.in) || + !nf_bridge_port_valid(entry->state.out)) + return false; + + return true; +} + static void nfqnl_reinject(struct nf_queue_entry *entry, unsigned int verdict) { const struct nf_ct_hook *ct_hook; int err; + if (!nf_bridge_ports_valid(entry)) + verdict = NF_DROP; + if (verdict == NF_ACCEPT || verdict == NF_REPEAT || verdict == NF_STOP) { @@ -434,6 +471,23 @@ static int nfqnl_put_bridge(struct nf_queue_entry *entry, struct sk_buff *skb) return -1; } +#if IS_ENABLED(CONFIG_BRIDGE_NETFILTER) +static int nfqnl_put_master_ifindex(struct sk_buff *nlskb, int attr, + const struct net_device *dev) +{ + const struct net_device *upper; + + if (dev && !netif_is_bridge_port(dev)) + return 0; + + upper = netdev_master_upper_dev_get_rcu((struct net_device *)dev); + if (upper && nla_put_be32(nlskb, attr, htonl(upper->ifindex))) + return -EMSGSIZE; + + return 0; +} +#endif + static struct sk_buff * nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue, struct nf_queue_entry *entry, @@ -569,8 +623,7 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue, htonl(indev->ifindex)) || /* this is the bridge group "brX" */ /* rcu_read_lock()ed by __nf_queue */ - nla_put_be32(skb, NFQA_IFINDEX_INDEV, - htonl(br_port_get_rcu(indev)->br->dev->ifindex))) + nfqnl_put_master_ifindex(skb, NFQA_IFINDEX_INDEV, indev)) goto nla_put_failure; } else { int physinif; @@ -603,8 +656,7 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue, htonl(outdev->ifindex)) || /* this is the bridge group "brX" */ /* rcu_read_lock()ed by __nf_queue */ - nla_put_be32(skb, NFQA_IFINDEX_OUTDEV, - htonl(br_port_get_rcu(outdev)->br->dev->ifindex))) + nfqnl_put_master_ifindex(skb, NFQA_IFINDEX_OUTDEV, outdev)) goto nla_put_failure; } else { int physoutif; -- 2.43.0

2 1

[PATCH OLK-5.10] netfilter: revalidate bridge ports
by superdcc97＠163.com 04 Jul '26

04 Jul '26

From: Florian Westphal <fw(a)strlen.de> mainline inclusion from mainline-v7.2-rc1 commit ccb9fd4b87538ccf19ccff78ee26700526d94867 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15906 CVE: CVE-2026-53220 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ebt_redirect_tg() dereferences br_port_get_rcu() return without a NULL check, causing a kernel panic when the bridge port has been removed between the original hook invocation and an NFQUEUE reinject. A mere NULL check isn't sufficient, however. As sashiko review points out userspace can not only remove the port from the bridge, it could also place the device in a different virtual device, e.g. macvlan. If this happens, we must drop the packet, there is no way for us to reinject it into the bridge path. Switch to _upper API, we don't need the bridge port structure. Also, this fix keeps another bug intact: Both nfnetlink_log and nfnetlink_queue use CONFIG_BRIDGE_NETFILTER too aggressive, which prevents certain logging features when queueing in bridge family: NETFILTER_FAMILY_BRIDGE can be enabled while the old CONFIG_BRIDGE_NETFILTER cruft is off. Fixes tag is a common ancestor, this was always broken. Fixes: f350a0a87374 ("bridge: use rx_handler_data pointer to store net_bridge_port pointer") Reported-by: Ji'an Zhou <eilaimemedsnaimel(a)gmail.com> Assisted-by: Claude:claude-sonnet-4-6 Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/nfnetlink_queue.c [commit ccb9fd4b8753 ("netfilter: revalidate bridge ports") is not backport, which lead to conflicts] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/bridge/netfilter/ebt_dnat.c | 4 +- net/bridge/netfilter/ebt_redirect.c | 16 +++++--- net/netfilter/nfnetlink_log.c | 23 +++++++++-- net/netfilter/nfnetlink_queue.c | 64 +++++++++++++++++++++++++---- 4 files changed, 89 insertions(+), 18 deletions(-) diff --git a/net/bridge/netfilter/ebt_dnat.c b/net/bridge/netfilter/ebt_dnat.c index 3fda71a8579d..73f185cccd63 100644 --- a/net/bridge/netfilter/ebt_dnat.c +++ b/net/bridge/netfilter/ebt_dnat.c @@ -39,7 +39,9 @@ ebt_dnat_tg(struct sk_buff *skb, const struct xt_action_param *par) dev = xt_in(par); break; case NF_BR_PRE_ROUTING: - dev = br_port_get_rcu(xt_in(par))->br->dev; + dev = netdev_master_upper_dev_get_rcu(xt_in(par)); + if (!dev) /* bridge port removed? */ + return EBT_DROP; break; default: dev = NULL; diff --git a/net/bridge/netfilter/ebt_redirect.c b/net/bridge/netfilter/ebt_redirect.c index 307790562b49..83486cd4d564 100644 --- a/net/bridge/netfilter/ebt_redirect.c +++ b/net/bridge/netfilter/ebt_redirect.c @@ -24,12 +24,18 @@ ebt_redirect_tg(struct sk_buff *skb, const struct xt_action_param *par) if (skb_ensure_writable(skb, 0)) return EBT_DROP; - if (xt_hooknum(par) != NF_BR_BROUTING) - /* rcu_read_lock()ed by nf_hook_thresh */ - ether_addr_copy(eth_hdr(skb)->h_dest, - br_port_get_rcu(xt_in(par))->br->dev->dev_addr); - else + if (xt_hooknum(par) != NF_BR_BROUTING) { + const struct net_device *dev; + + dev = netdev_master_upper_dev_get_rcu(xt_in(par)); + if (!dev) + return EBT_DROP; + + ether_addr_copy(eth_hdr(skb)->h_dest, dev->dev_addr); + } else { ether_addr_copy(eth_hdr(skb)->h_dest, xt_in(par)->dev_addr); + } + skb->pkt_type = PACKET_HOST; return info->target; } diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c index ff01afe1bc60..e5daece618f2 100644 --- a/net/netfilter/nfnetlink_log.c +++ b/net/netfilter/nfnetlink_log.c @@ -435,6 +435,23 @@ static int nfulnl_put_bridge(struct nfulnl_instance *inst, const struct sk_buff return -1; } +#if IS_ENABLED(CONFIG_BRIDGE_NETFILTER) +static int nflog_put_master_ifindex(struct sk_buff *nlskb, int attr, + const struct net_device *dev) +{ + const struct net_device *upper; + + if (dev && !netif_is_bridge_port(dev)) + return 0; + + upper = netdev_master_upper_dev_get_rcu((struct net_device *)dev); + if (upper && nla_put_be32(nlskb, attr, htonl(upper->ifindex))) + return -EMSGSIZE; + + return 0; +} +#endif + /* This is an inline function, we don't really care about a long * list of arguments */ static inline int @@ -489,8 +506,7 @@ __build_packet_message(struct nfnl_log_net *log, /* rcu_read_lock()ed by nf_hook_thresh or * nf_log_packet. */ - nla_put_be32(inst->skb, NFULA_IFINDEX_INDEV, - htonl(br_port_get_rcu(indev)->br->dev->ifindex))) + nflog_put_master_ifindex(inst->skb, NFULA_IFINDEX_INDEV, indev)) goto nla_put_failure; } else { int physinif; @@ -526,8 +542,7 @@ __build_packet_message(struct nfnl_log_net *log, /* rcu_read_lock()ed by nf_hook_thresh or * nf_log_packet. */ - nla_put_be32(inst->skb, NFULA_IFINDEX_OUTDEV, - htonl(br_port_get_rcu(outdev)->br->dev->ifindex))) + nflog_put_master_ifindex(inst->skb, NFULA_IFINDEX_OUTDEV, outdev)) goto nla_put_failure; } else { struct net_device *physoutdev; diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c index dc6af1919dea..6a79287f33c3 100644 --- a/net/netfilter/nfnetlink_queue.c +++ b/net/netfilter/nfnetlink_queue.c @@ -225,11 +225,48 @@ find_dequeue_entry(struct nfqnl_instance *queue, unsigned int id) return entry; } +static bool nf_bridge_port_valid(const struct net_device *dev) +{ + if (!dev) + return true; + + return netif_is_bridge_port(dev); +} + +/* queued skbs leave rcu protection. We bump device refcount so that + * the device cannot go away. However, while packet was out the port + * could have been removed from the bridge. + * + * Ensure in+outdev are still part of a bridge at reinject time. + * + * The device rx_handler_data could even be pointing at data that is + * not a net_bridge_port structure. + */ +static bool nf_bridge_ports_valid(const struct nf_queue_entry *entry) +{ +#if IS_ENABLED(CONFIG_BRIDGE_NETFILTER) + if (!nf_bridge_port_valid(entry->physin) || + !nf_bridge_port_valid(entry->physout)) + return false; +#endif + if (entry->state.pf != PF_BRIDGE) + return true; + + if (!nf_bridge_port_valid(entry->state.in) || + !nf_bridge_port_valid(entry->state.out)) + return false; + + return true; +} + static void nfqnl_reinject(struct nf_queue_entry *entry, unsigned int verdict) { struct nf_ct_hook *ct_hook; int err; + if (!nf_bridge_ports_valid(entry)) + verdict = NF_DROP; + if (verdict == NF_ACCEPT || verdict == NF_REPEAT || verdict == NF_STOP) { @@ -373,6 +410,23 @@ static int nfqnl_put_bridge(struct nf_queue_entry *entry, struct sk_buff *skb) return -1; } +#if IS_ENABLED(CONFIG_BRIDGE_NETFILTER) +static int nfqnl_put_master_ifindex(struct sk_buff *nlskb, int attr, + const struct net_device *dev) +{ + const struct net_device *upper; + + if (dev && !netif_is_bridge_port(dev)) + return 0; + + upper = netdev_master_upper_dev_get_rcu((struct net_device *)dev); + if (upper && nla_put_be32(nlskb, attr, htonl(upper->ifindex))) + return -EMSGSIZE; + + return 0; +} +#endif + static struct sk_buff * nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue, struct nf_queue_entry *entry, @@ -498,10 +552,7 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue, * netfilter_bridge) */ if (nla_put_be32(skb, NFQA_IFINDEX_PHYSINDEV, htonl(indev->ifindex)) || - /* this is the bridge group "brX" */ - /* rcu_read_lock()ed by __nf_queue */ - nla_put_be32(skb, NFQA_IFINDEX_INDEV, - htonl(br_port_get_rcu(indev)->br->dev->ifindex))) + nfqnl_put_master_ifindex(skb, NFQA_IFINDEX_INDEV, indev)) goto nla_put_failure; } else { int physinif; @@ -532,10 +583,7 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue, * netfilter_bridge) */ if (nla_put_be32(skb, NFQA_IFINDEX_PHYSOUTDEV, htonl(outdev->ifindex)) || - /* this is the bridge group "brX" */ - /* rcu_read_lock()ed by __nf_queue */ - nla_put_be32(skb, NFQA_IFINDEX_OUTDEV, - htonl(br_port_get_rcu(outdev)->br->dev->ifindex))) + nfqnl_put_master_ifindex(skb, NFQA_IFINDEX_OUTDEV, outdev)) goto nla_put_failure; } else { int physoutif; -- 2.43.0

2 1

[PATCH OLK-5.10] net: pull headers in qdisc_pkt_len_segs_init()
by superdcc97＠163.com 04 Jul '26

04 Jul '26

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v7.1-rc1 commit 7fb4c19670110f052c04e1ec1d2b953b9f4f57e4 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15794 CVE: CVE-2026-53091 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Most ndo_start_xmit() methods expects headers of gso packets to be already in skb->head. net/core/tso.c users are particularly at risk, because tso_build_hdr() does a memcpy(hdr, skb->data, hdr_len); qdisc_pkt_len_segs_init() already does a dissection of gso packets. Use pskb_may_pull() instead of skb_header_pointer() to make sure drivers do not have to reimplement this. Some malicious packets could be fed, detect them so that we can drop them sooner with a new SKB_DROP_REASON_SKB_BAD_GSO drop_reason. Fixes: e876f208af18 ("net: Add a software TSO helper API") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Joe Damato <joe(a)dama.to> Link: https://patch.msgid.link/20260403221540.3297753-3-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: include/net/dropreason-core.h net/core/dev.c [commit c504e5c2f964 ("net: skb: introduce kfree_skb_reason()") introduced skb_drop_reason enum and kfree_skb_reason(); later commit ff8372a467fa ("net: skb: move enum skb_drop_reason to standalone header file") and 5b8285cca6fe ("net: move dropreason.h to dropreason-core.h") moved it to include/net/dropreason-core.h. These are not present in OLK-5.10, so the SKB_DROP_REASON_SKB_BAD_GSO drop reason is omitted and the malicious GSO packet is dropped using kfree_skb() and atomic_long_inc(&dev->tx_dropped) instead. commit 874c1928d372 ("net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init()") renamed qdisc_pkt_len_init() to qdisc_pkt_len_segs_init() and added pkt_segs initialization; this is not backported to OLK-5.10, so the fix is applied to the existing qdisc_pkt_len_init() function and the function returns -EINVAL on error. commit 625788b58445 ("net: add per-cpu storage and net->core_stats") introduced dev_core_stats_tx_dropped_inc(), which is not present in OLK-5.10; the existing atomic_long_inc(&dev->tx_dropped) is used instead.] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/core/dev.c | 39 +++++++++++++++++++++++++-------------- 1 file changed, 25 insertions(+), 14 deletions(-) diff --git a/net/core/dev.c b/net/core/dev.c index d6dc66b2960d..8d2a00851eb7 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -3748,7 +3748,7 @@ struct sk_buff *validate_xmit_skb_list(struct sk_buff *skb, struct net_device *d } EXPORT_SYMBOL_GPL(validate_xmit_skb_list); -static void qdisc_pkt_len_init(struct sk_buff *skb) +static int qdisc_pkt_len_init(struct sk_buff *skb) { const struct skb_shared_info *shinfo = skb_shinfo(skb); @@ -3758,7 +3758,7 @@ static void qdisc_pkt_len_init(struct sk_buff *skb) * we add to pkt_len the headers size of all segments */ if (shinfo->gso_size && skb_transport_header_was_set(skb)) { - unsigned int hdr_len; + unsigned int hdr_len, tlen; u16 gso_segs = shinfo->gso_segs; /* mac layer + network layer */ @@ -3767,30 +3767,36 @@ static void qdisc_pkt_len_init(struct sk_buff *skb) /* + transport layer */ if (likely(shinfo->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6))) { const struct tcphdr *th; - struct tcphdr _tcphdr; - th = skb_header_pointer(skb, skb_transport_offset(skb), - sizeof(_tcphdr), &_tcphdr); - if (likely(th)) - hdr_len += __tcp_hdrlen(th); - } else if (shinfo->gso_type & SKB_GSO_UDP_L4) { - struct udphdr _udphdr; + if (!pskb_may_pull(skb, hdr_len + sizeof(struct tcphdr))) + return -EINVAL; - if (skb_header_pointer(skb, skb_transport_offset(skb), - sizeof(_udphdr), &_udphdr)) - hdr_len += sizeof(struct udphdr); + th = (const struct tcphdr *)(skb->data + hdr_len); + tlen = __tcp_hdrlen(th); + if (tlen < sizeof(*th)) + return -EINVAL; + hdr_len += tlen; + if (!pskb_may_pull(skb, hdr_len)) + return -EINVAL; + } else if (shinfo->gso_type & SKB_GSO_UDP_L4) { + if (!pskb_may_pull(skb, hdr_len + sizeof(struct udphdr))) + return -EINVAL; + hdr_len += sizeof(struct udphdr); } + /* prior pskb_may_pull() might have changed skb->head. */ + shinfo = skb_shinfo(skb); if (unlikely(shinfo->gso_type & SKB_GSO_DODGY)) { int payload = skb->len - hdr_len; /* Malicious packet. */ if (payload <= 0) - return; + return -EINVAL; gso_segs = DIV_ROUND_UP(payload, shinfo->gso_size); } qdisc_skb_cb(skb)->pkt_len += (gso_segs - 1) * hdr_len; } + return 0; } static inline int __dev_xmit_skb(struct sk_buff *skb, struct Qdisc *q, @@ -4145,7 +4151,12 @@ static int __dev_queue_xmit(struct sk_buff *skb, struct net_device *sb_dev) skb_update_prio(skb); - qdisc_pkt_len_init(skb); + if (unlikely(qdisc_pkt_len_init(skb))) { + atomic_long_inc(&dev->tx_dropped); + kfree_skb(skb); + rc = -EINVAL; + goto out; + } #ifdef CONFIG_NET_CLS_ACT skb->tc_at_ingress = 0; # ifdef CONFIG_NET_EGRESS -- 2.43.0

2 1

[PATCH OLK-5.10 v2] netfilter: nf_tables: use list_del_rcu for netlink hooks
by superdcc97＠163.com 04 Jul '26

04 Jul '26

From: Florian Westphal <fw(a)strlen.de> mainline inclusion from mainline-v7.1-rc2 commit f3224ee463f8f6f6ced7dcdf6081add4f8128527 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15588 CVE: CVE-2026-46324 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- nft_netdev_unregister_hooks and __nft_unregister_flowtable_net_hooks need to use list_del_rcu(), this list can be walked by concurrent dumpers. Add a new helper and use it consistently. Fixes: f9a43007d3f7 ("netfilter: nf_tables: double hook unregistration in netns path") Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/nf_tables_api.c [1.The nf_tables_updchain() hook-list teardown path present in mainline (where hook.list lives on the stack and uses list_del() / nft_netdev_hook_free_rcu()) does not exist in OLK-5.10, so that hunk was skipped. 2. nf_tables_flowtable_destroy() in OLK-5.10 still performs flowtable->data.type->setup(..., FLOW_BLOCK_UNBIND) for each hook before removing it, a pattern that was refactored out upstream; the helper replacement from mainline therefore could not be used here. The existing list_del_rcu() call is retained, and the immediate kfree(hook) was changed to kfree_rcu(hook, rcu) to match the RCU-safe freeing used by the new helper. 3. Other hunks were applied manually by introducing the nft_netdev_hook_unlink_free_rcu() helper and using it consistently wherever OLK-5.10 already performed list_del_rcu()/kfree_rcu() on a netdev/flowtable hook, and by converting the two list_del() callers (nft_netdev_unregister_hooks and __nft_unregister_flowtable_net_hooks) to list_del_rcu() as required by the CVE fix. ] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/nf_tables_api.c | 38 ++++++++++++++++------------------- 1 file changed, 17 insertions(+), 21 deletions(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 2beef989cced..b97c4d0cf1d9 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -303,6 +303,12 @@ static int nft_netdev_register_hooks(struct net *net, return err; } +static void nft_netdev_hook_unlink_free_rcu(struct nft_hook *hook) +{ + list_del_rcu(&hook->list); + kfree_rcu(hook, rcu); +} + static void nft_netdev_unregister_hooks(struct net *net, struct list_head *hook_list, bool release_netdev) @@ -311,10 +317,8 @@ static void nft_netdev_unregister_hooks(struct net *net, list_for_each_entry_safe(hook, next, hook_list, list) { nf_unregister_net_hook(net, &hook->ops); - if (release_netdev) { - list_del(&hook->list); - kfree_rcu(hook, rcu); - } + if (release_netdev) + nft_netdev_hook_unlink_free_rcu(hook); } } @@ -1932,10 +1936,8 @@ void nf_tables_chain_destroy(struct nft_ctx *ctx) if (nft_base_chain_netdev(ctx->family, basechain->ops.hooknum)) { list_for_each_entry_safe(hook, next, - &basechain->hook_list, list) { - list_del_rcu(&hook->list); - kfree_rcu(hook, rcu); - } + &basechain->hook_list, list) + nft_netdev_hook_unlink_free_rcu(hook); } module_put(basechain->type->owner); if (rcu_access_pointer(basechain->stats)) { @@ -7004,10 +7006,8 @@ static void __nft_unregister_flowtable_net_hooks(struct net *net, list_for_each_entry_safe(hook, next, hook_list, list) { nf_unregister_net_hook(net, &hook->ops); - if (release_netdev) { - list_del(&hook->list); - kfree_rcu(hook, rcu); - } + if (release_netdev) + nft_netdev_hook_unlink_free_rcu(hook); } } @@ -7065,8 +7065,7 @@ static int nft_register_flowtable_net_hooks(struct net *net, break; nft_unregister_flowtable_hook(net, flowtable, hook); - list_del_rcu(&hook->list); - kfree_rcu(hook, rcu); + nft_netdev_hook_unlink_free_rcu(hook); } return err; @@ -7076,10 +7075,8 @@ static void nft_flowtable_hooks_destroy(struct list_head *hook_list) { struct nft_hook *hook, *next; - list_for_each_entry_safe(hook, next, hook_list, list) { - list_del_rcu(&hook->list); - kfree_rcu(hook, rcu); - } + list_for_each_entry_safe(hook, next, hook_list, list) + nft_netdev_hook_unlink_free_rcu(hook); } static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh, @@ -7147,8 +7144,7 @@ static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh, list_for_each_entry_safe(hook, next, &flowtable_hook.list, list) { if (unregister) nft_unregister_flowtable_hook(ctx->net, flowtable, hook); - list_del_rcu(&hook->list); - kfree_rcu(hook, rcu); + nft_netdev_hook_unlink_free_rcu(hook); } return err; @@ -7639,7 +7635,7 @@ static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable) flowtable->data.type->setup(&flowtable->data, hook->ops.dev, FLOW_BLOCK_UNBIND); list_del_rcu(&hook->list); - kfree(hook); + kfree_rcu(hook, rcu); } kfree(flowtable->name); module_put(flowtable->data.type->owner); -- 2.43.0

2 1

[PATCH OLK-6.6] af_unix: Drop all SCM attributes for SOCKMAP.
by superdcc97＠163.com 04 Jul '26

04 Jul '26

From: Kuniyuki Iwashima <kuniyu(a)google.com> mainline inclusion from mainline-v7.1-rc1 commit 965dc93481d1b80d341bdd16c27b16fe197175ee category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15707 CVE: CVE-2026-53005 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- SOCKMAP can hide inflight fd from AF_UNIX GC. When a socket in SOCKMAP receives skb with inflight fd, sk_psock_verdict_data_ready() looks up the mapped socket and enqueue skb to its psock->ingress_skb. Since neither the old nor the new GC can inspect the psock queue, the hidden skb leaks the inflight sockets. Note that this cannot be detected via kmemleak because inflight sockets are linked to a global list. In addition, SOCKMAP redirect breaks the Tarjan-based GC's assumption that unix_edge.successor is always alive, which is no longer true once skb is redirected, resulting in use-after-free below. [0] Moreover, SOCKMAP does not call scm_stat_del() properly, so unix_show_fdinfo() could report an incorrect fd count. sk_msg_recvmsg() does not support any SCM attributes in the first place. Let's drop all SCM attributes before passing skb to the SOCKMAP layer. [0]: BUG: KASAN: slab-use-after-free in unix_del_edges (net/unix/garbage.c:118 net/unix/garbage.c:181 net/unix/garbage.c:251) Read of size 8 at addr ffff888125362670 by task kworker/56:1/496 CPU: 56 UID: 0 PID: 496 Comm: kworker/56:1 Not tainted 7.0.0-rc7-00263-gb9d8b856689d #3 PREEMPT(lazy) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014 Workqueue: events sk_psock_backlog Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:122) print_report (mm/kasan/report.c:379) kasan_report (mm/kasan/report.c:597) unix_del_edges (net/unix/garbage.c:118 net/unix/garbage.c:181 net/unix/garbage.c:251) unix_destroy_fpl (net/unix/garbage.c:317) unix_destruct_scm (./include/net/scm.h:80 ./include/net/scm.h:86 net/unix/af_unix.c:1976) sk_psock_backlog (./include/linux/skbuff.h:?) process_scheduled_works (kernel/workqueue.c:?) worker_thread (kernel/workqueue.c:?) kthread (kernel/kthread.c:438) ret_from_fork (arch/x86/kernel/process.c:164) ret_from_fork_asm (arch/x86/entry/entry_64.S:258) </TASK> Allocated by task 955: kasan_save_track (mm/kasan/common.c:58 mm/kasan/common.c:78) __kasan_slab_alloc (mm/kasan/common.c:369) kmem_cache_alloc_noprof (mm/slub.c:4539) sk_prot_alloc (net/core/sock.c:2240) sk_alloc (net/core/sock.c:2301) unix_create1 (net/unix/af_unix.c:1099) unix_create (net/unix/af_unix.c:1169) __sock_create (net/socket.c:1606) __sys_socketpair (net/socket.c:1811) __x64_sys_socketpair (net/socket.c:1863 net/socket.c:1860 net/socket.c:1860) do_syscall_64 (arch/x86/entry/syscall_64.c:?) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) Freed by task 496: kasan_save_track (mm/kasan/common.c:58 mm/kasan/common.c:78) kasan_save_free_info (mm/kasan/generic.c:587) __kasan_slab_free (mm/kasan/common.c:287) kmem_cache_free (mm/slub.c:6165) __sk_destruct (net/core/sock.c:2282 net/core/sock.c:2384) sk_psock_destroy (./include/net/sock.h:?) process_scheduled_works (kernel/workqueue.c:?) worker_thread (kernel/workqueue.c:?) kthread (kernel/kthread.c:438) ret_from_fork (arch/x86/kernel/process.c:164) ret_from_fork_asm (arch/x86/entry/entry_64.S:258) Fixes: c63829182c37 ("af_unix: Implement ->psock_update_sk_prot()") Fixes: 77462de14a43 ("af_unix: Add read_sock for stream socket types") Reported-by: Xingyu Jin <xingyuj(a)google.com> Signed-off-by: Kuniyuki Iwashima <kuniyu(a)google.com> Link: https://patch.msgid.link/20260415184830.3988432-1-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/unix/af_unix.c [commit d0aac85449de ("af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb().") and commit 2b9996417e4e ("af_unix/scm: fix whitespace errors") are not backported, which lead to conflicts] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/unix/af_unix.c | 32 ++++++++++++++++++++++++-------- 1 file changed, 24 insertions(+), 8 deletions(-) diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c index d20b43a13ffc..da0e477b96a7 100644 --- a/net/unix/af_unix.c +++ b/net/unix/af_unix.c @@ -1854,16 +1854,18 @@ static void unix_peek_fds(struct scm_cookie *scm, struct sk_buff *skb) static void unix_destruct_scm(struct sk_buff *skb) { - struct scm_cookie scm; + struct scm_cookie scm = {}; - memset(&scm, 0, sizeof(scm)); - scm.pid = UNIXCB(skb).pid; + swap(scm.pid, UNIXCB(skb).pid); if (UNIXCB(skb).fp) unix_detach_fds(&scm, skb); - /* Alas, it calls VFS */ - /* So fscking what? fput() had been SMP-safe since the last Summer */ scm_destroy(&scm); +} + +static void unix_wfree(struct sk_buff *skb) +{ + unix_destruct_scm(skb); sock_wfree(skb); } @@ -1879,7 +1881,7 @@ static int unix_scm_to_skb(struct scm_cookie *scm, struct sk_buff *skb, bool sen if (scm->fp && send_fds) err = unix_attach_fds(scm, skb); - skb->destructor = unix_destruct_scm; + skb->destructor = unix_wfree; return err; } @@ -1940,6 +1942,13 @@ static void scm_stat_del(struct sock *sk, struct sk_buff *skb) } } +static void unix_orphan_scm(struct sock *sk, struct sk_buff *skb) +{ + scm_stat_del(sk, skb); + unix_destruct_scm(skb); + skb->destructor = sock_wfree; +} + /* * Send AF_UNIX data. */ @@ -2517,9 +2526,14 @@ static int unix_read_skb(struct sock *sk, skb_read_actor_t recv_actor) mutex_lock(&u->iolock); skb = skb_recv_datagram(sk, MSG_DONTWAIT, &err); - mutex_unlock(&u->iolock); - if (!skb) + if (!skb) { + mutex_unlock(&u->iolock); return err; + } + + unix_orphan_scm(sk, skb); + + mutex_unlock(&u->iolock); return recv_actor(sk, skb); } @@ -2708,6 +2722,8 @@ static int unix_stream_read_skb(struct sock *sk, skb_read_actor_t recv_actor) } #endif + unix_orphan_scm(sk, skb); + return recv_actor(sk, skb); } -- 2.43.0

2 1

[PATCH OLK-5.10] bonding: 3ad: implement proper RCU rules for port->aggregator
by superdcc97＠163.com 04 Jul '26

04 Jul '26

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v7.1-rc2 commit c4f050ce06c56cfb5993268af4a5cb66ed1cd04e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15677 CVE: CVE-2026-52975 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzbot found a data-race in bond_3ad_get_active_agg_info / bond_3ad_state_machine_handler [1] which hints at lack of proper RCU implementation. Add __rcu qualifier to port->aggregator, and add proper RCU API. [1] BUG: KCSAN: data-race in bond_3ad_get_active_agg_info / bond_3ad_state_machine_handler write to 0xffff88813cf5c4b0 of 8 bytes by task 36 on cpu 0: ad_port_selection_logic drivers/net/bonding/bond_3ad.c:1659 [inline] bond_3ad_state_machine_handler+0x9d5/0x2d60 drivers/net/bonding/bond_3ad.c:2569 process_one_work kernel/workqueue.c:3302 [inline] process_scheduled_works+0x4f0/0x9c0 kernel/workqueue.c:3385 worker_thread+0x58a/0x780 kernel/workqueue.c:3466 kthread+0x22a/0x280 kernel/kthread.c:436 ret_from_fork+0x146/0x330 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 read to 0xffff88813cf5c4b0 of 8 bytes by task 22063 on cpu 1: __bond_3ad_get_active_agg_info drivers/net/bonding/bond_3ad.c:2858 [inline] bond_3ad_get_active_agg_info+0x8c/0x230 drivers/net/bonding/bond_3ad.c:2881 bond_fill_info+0xe0f/0x10f0 drivers/net/bonding/bond_netlink.c:853 rtnl_link_info_fill net/core/rtnetlink.c:906 [inline] rtnl_link_fill+0x1d7/0x4e0 net/core/rtnetlink.c:927 rtnl_fill_ifinfo+0xf8e/0x1380 net/core/rtnetlink.c:2168 rtmsg_ifinfo_build_skb+0x11c/0x1b0 net/core/rtnetlink.c:4453 rtmsg_ifinfo_event net/core/rtnetlink.c:4486 [inline] rtmsg_ifinfo+0x6d/0x110 net/core/rtnetlink.c:4495 __dev_notify_flags+0x76/0x390 net/core/dev.c:9790 netif_change_flags+0xac/0xd0 net/core/dev.c:9823 do_setlink+0x905/0x2950 net/core/rtnetlink.c:3180 rtnl_group_changelink net/core/rtnetlink.c:3813 [inline] __rtnl_newlink net/core/rtnetlink.c:3981 [inline] rtnl_newlink+0xf55/0x1400 net/core/rtnetlink.c:4109 rtnetlink_rcv_msg+0x64b/0x720 net/core/rtnetlink.c:6995 netlink_rcv_skb+0x123/0x220 net/netlink/af_netlink.c:2550 rtnetlink_rcv+0x1c/0x30 net/core/rtnetlink.c:7022 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x5a8/0x680 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x5c8/0x6f0 net/netlink/af_netlink.c:1894 sock_sendmsg_nosec net/socket.c:787 [inline] __sock_sendmsg net/socket.c:802 [inline] ____sys_sendmsg+0x563/0x5b0 net/socket.c:2698 ___sys_sendmsg+0x195/0x1e0 net/socket.c:2752 __sys_sendmsg net/socket.c:2784 [inline] __do_sys_sendmsg net/socket.c:2789 [inline] __se_sys_sendmsg net/socket.c:2787 [inline] __x64_sys_sendmsg+0xd4/0x160 net/socket.c:2787 x64_sys_call+0x194c/0x3020 arch/x86/include/generated/asm/syscalls_64.h:47 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x12c/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f value changed: 0x0000000000000000 -> 0xffff88813cf5c400 Reported by Kernel Concurrency Sanitizer on: CPU: 1 UID: 0 PID: 22063 Comm: syz.0.31122 Tainted: G W syzkaller #0 PREEMPT(full) Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 Fixes: 47e91f56008b ("bonding: use RCU protection for 3ad xmit path") Reported-by: syzbot+9bb2ff2a4ab9e17307e1(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/69f0a82f.050a0220.3aadc4.0000.GAE@google.com/ Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Jay Vosburgh <jv(a)jvosburgh.net> Cc: Andrew Lunn <andrew+netdev(a)lunn.ch> Link: https://patch.msgid.link/20260428123207.3809211-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: drivers/net/bonding/bond_3ad.c drivers/net/bonding/bond_netlink.c drivers/net/bonding/bond_procfs.c drivers/net/bonding/bond_sysfs_slave.c [commit 240fd405528b and 4440873f3655 are not backport, which lead to conflicts] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/net/bonding/bond_3ad.c | 97 ++++++++++++++------------ drivers/net/bonding/bond_main.c | 8 ++- drivers/net/bonding/bond_netlink.c | 12 ++-- drivers/net/bonding/bond_procfs.c | 3 +- drivers/net/bonding/bond_sysfs_slave.c | 27 ++++--- include/net/bond_3ad.h | 2 +- 6 files changed, 83 insertions(+), 66 deletions(-) diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c index 7278f3d44a68..724c98247894 100644 --- a/drivers/net/bonding/bond_3ad.c +++ b/drivers/net/bonding/bond_3ad.c @@ -923,6 +923,7 @@ static int ad_marker_send(struct port *port, struct bond_marker *marker) */ static void ad_mux_machine(struct port *port, bool *update_slave_arr) { + struct aggregator *aggregator; mux_states_t last_state; /* keep current State Machine state to compare later if it was @@ -930,6 +931,7 @@ static void ad_mux_machine(struct port *port, bool *update_slave_arr) */ last_state = port->sm_mux_state; + aggregator = rcu_dereference(port->aggregator); if (port->sm_vars & AD_PORT_BEGIN) { port->sm_mux_state = AD_MUX_DETACHED; } else { @@ -949,7 +951,7 @@ static void ad_mux_machine(struct port *port, bool *update_slave_arr) * cycle to update ready variable, we check * READY_N and update READY here */ - __set_agg_ports_ready(port->aggregator, __agg_ports_are_ready(port->aggregator)); + __set_agg_ports_ready(aggregator, __agg_ports_are_ready(aggregator)); port->sm_mux_state = AD_MUX_DETACHED; break; } @@ -964,7 +966,7 @@ static void ad_mux_machine(struct port *port, bool *update_slave_arr) * update ready variable, we check READY_N and update * READY here */ - __set_agg_ports_ready(port->aggregator, __agg_ports_are_ready(port->aggregator)); + __set_agg_ports_ready(aggregator, __agg_ports_are_ready(aggregator)); /* if the wait_while_timer expired, and the port is * in READY state, move to ATTACHED state @@ -980,7 +982,7 @@ static void ad_mux_machine(struct port *port, bool *update_slave_arr) if ((port->sm_vars & AD_PORT_SELECTED) && (port->partner_oper.port_state & LACP_STATE_SYNCHRONIZATION) && !__check_agg_selection_timer(port)) { - if (port->aggregator->is_active) + if (aggregator->is_active) port->sm_mux_state = AD_MUX_COLLECTING_DISTRIBUTING; } else if (!(port->sm_vars & AD_PORT_SELECTED) || @@ -992,9 +994,9 @@ static void ad_mux_machine(struct port *port, bool *update_slave_arr) * cycle to update ready variable, we check * READY_N and update READY here */ - __set_agg_ports_ready(port->aggregator, __agg_ports_are_ready(port->aggregator)); + __set_agg_ports_ready(aggregator, __agg_ports_are_ready(aggregator)); port->sm_mux_state = AD_MUX_DETACHED; - } else if (port->aggregator->is_active) { + } else if (aggregator->is_active) { port->actor_oper_port_state |= LACP_STATE_SYNCHRONIZATION; } @@ -1010,8 +1012,8 @@ static void ad_mux_machine(struct port *port, bool *update_slave_arr) * sure that a collecting distributing * port in an active aggregator is enabled */ - if (port->aggregator && - port->aggregator->is_active && + if (aggregator && + aggregator->is_active && !__port_is_enabled(port)) { __enable_port(port); *update_slave_arr = true; @@ -1043,7 +1045,7 @@ static void ad_mux_machine(struct port *port, bool *update_slave_arr) port->sm_mux_timer_counter = __ad_timer_to_ticks(AD_WAIT_WHILE_TIMER, 0); break; case AD_MUX_ATTACHED: - if (port->aggregator->is_active) + if (aggregator->is_active) port->actor_oper_port_state |= LACP_STATE_SYNCHRONIZATION; else @@ -1397,9 +1399,9 @@ static void ad_port_selection_logic(struct port *port, bool *update_slave_arr) bond = __get_bond_by_port(port); /* if the port is connected to other aggregator, detach it */ - if (port->aggregator) { + temp_aggregator = rcu_dereference(port->aggregator); + if (temp_aggregator) { /* detach the port from its former aggregator */ - temp_aggregator = port->aggregator; for (curr_port = temp_aggregator->lag_ports; curr_port; last_port = curr_port, curr_port = curr_port->next_port_in_aggregator) { @@ -1422,7 +1424,7 @@ static void ad_port_selection_logic(struct port *port, bool *update_slave_arr) /* clear the port's relations to this * aggregator */ - port->aggregator = NULL; + RCU_INIT_POINTER(port->aggregator, NULL); port->next_port_in_aggregator = NULL; port->actor_port_aggregator_identifier = 0; @@ -1445,7 +1447,7 @@ static void ad_port_selection_logic(struct port *port, bool *update_slave_arr) port->slave->bond->dev->name, port->slave->dev->name, port->actor_port_number, - port->aggregator->aggregator_identifier); + temp_aggregator->aggregator_identifier); } } /* search on all aggregators for a suitable aggregator for this port */ @@ -1469,15 +1471,15 @@ static void ad_port_selection_logic(struct port *port, bool *update_slave_arr) ) ) { /* attach to the founded aggregator */ - port->aggregator = aggregator; + rcu_assign_pointer(port->aggregator, aggregator); port->actor_port_aggregator_identifier = - port->aggregator->aggregator_identifier; + aggregator->aggregator_identifier; port->next_port_in_aggregator = aggregator->lag_ports; - port->aggregator->num_of_ports++; + aggregator->num_of_ports++; aggregator->lag_ports = port; slave_dbg(bond->dev, slave->dev, "Port %d joined LAG %d (existing LAG)\n", port->actor_port_number, - port->aggregator->aggregator_identifier); + aggregator->aggregator_identifier); /* mark this port as selected */ port->sm_vars |= AD_PORT_SELECTED; @@ -1492,39 +1494,40 @@ static void ad_port_selection_logic(struct port *port, bool *update_slave_arr) if (!found) { if (free_aggregator) { /* assign port a new aggregator */ - port->aggregator = free_aggregator; port->actor_port_aggregator_identifier = - port->aggregator->aggregator_identifier; + free_aggregator->aggregator_identifier; /* update the new aggregator's parameters * if port was responsed from the end-user */ if (port->actor_oper_port_key & AD_DUPLEX_KEY_MASKS) /* if port is full duplex */ - port->aggregator->is_individual = false; + free_aggregator->is_individual = false; else - port->aggregator->is_individual = true; + free_aggregator->is_individual = true; - port->aggregator->actor_admin_aggregator_key = + free_aggregator->actor_admin_aggregator_key = port->actor_admin_port_key; - port->aggregator->actor_oper_aggregator_key = + free_aggregator->actor_oper_aggregator_key = port->actor_oper_port_key; - port->aggregator->partner_system = + free_aggregator->partner_system = port->partner_oper.system; - port->aggregator->partner_system_priority = + free_aggregator->partner_system_priority = port->partner_oper.system_priority; - port->aggregator->partner_oper_aggregator_key = port->partner_oper.key; - port->aggregator->receive_state = 1; - port->aggregator->transmit_state = 1; - port->aggregator->lag_ports = port; - port->aggregator->num_of_ports++; + free_aggregator->partner_oper_aggregator_key = port->partner_oper.key; + free_aggregator->receive_state = 1; + free_aggregator->transmit_state = 1; + free_aggregator->lag_ports = port; + free_aggregator->num_of_ports++; + + rcu_assign_pointer(port->aggregator, free_aggregator); /* mark this port as selected */ port->sm_vars |= AD_PORT_SELECTED; slave_dbg(bond->dev, port->slave->dev, "Port %d joined LAG %d (new LAG)\n", port->actor_port_number, - port->aggregator->aggregator_identifier); + free_aggregator->aggregator_identifier); } else { slave_err(bond->dev, port->slave->dev, "Port %d did not find a suitable aggregator\n", @@ -1536,13 +1539,12 @@ static void ad_port_selection_logic(struct port *port, bool *update_slave_arr) * in all aggregator's ports, else set ready=FALSE in all * aggregator's ports */ - __set_agg_ports_ready(port->aggregator, - __agg_ports_are_ready(port->aggregator)); + aggregator = rcu_dereference(port->aggregator); + __set_agg_ports_ready(aggregator, __agg_ports_are_ready(aggregator)); - aggregator = __get_first_agg(port); - ad_agg_selection_logic(aggregator, update_slave_arr); + ad_agg_selection_logic(__get_first_agg(port), update_slave_arr); - if (!port->aggregator->is_active) + if (!aggregator->is_active) port->actor_oper_port_state &= ~LACP_STATE_SYNCHRONIZATION; } @@ -1871,7 +1873,7 @@ static void ad_initialize_port(struct port *port, int lacp_fast) port->sm_mux_state = 0; port->sm_mux_timer_counter = 0; port->sm_tx_state = 0; - port->aggregator = NULL; + RCU_INIT_POINTER(port->aggregator, NULL); port->next_port_in_aggregator = NULL; port->transaction_id = 0; @@ -1896,11 +1898,13 @@ static void ad_initialize_port(struct port *port, int lacp_fast) static void ad_enable_collecting_distributing(struct port *port, bool *update_slave_arr) { - if (port->aggregator->is_active) { + struct aggregator *aggregator = rcu_dereference(port->aggregator); + + if (aggregator->is_active) { slave_dbg(port->slave->bond->dev, port->slave->dev, "Enabling port %d (LAG %d)\n", port->actor_port_number, - port->aggregator->aggregator_identifier); + aggregator->aggregator_identifier); __enable_port(port); /* Slave array needs update */ *update_slave_arr = true; @@ -1915,13 +1919,13 @@ static void ad_enable_collecting_distributing(struct port *port, static void ad_disable_collecting_distributing(struct port *port, bool *update_slave_arr) { - if (port->aggregator && - !MAC_ADDRESS_EQUAL(&(port->aggregator->partner_system), - &(null_mac_addr))) { + struct aggregator *aggregator = rcu_dereference(port->aggregator); + + if (aggregator && __agg_has_partner(aggregator)) { slave_dbg(port->slave->bond->dev, port->slave->dev, "Disabling port %d (LAG %d)\n", port->actor_port_number, - port->aggregator->aggregator_identifier); + aggregator->aggregator_identifier); __disable_port(port); /* Slave array needs an update */ *update_slave_arr = true; @@ -2164,7 +2168,7 @@ void bond_3ad_unbind_slave(struct slave *slave) */ for (temp_port = aggregator->lag_ports; temp_port; temp_port = temp_port->next_port_in_aggregator) { - temp_port->aggregator = new_aggregator; + rcu_assign_pointer(temp_port->aggregator, new_aggregator); temp_port->actor_port_aggregator_identifier = new_aggregator->aggregator_identifier; } @@ -2633,15 +2637,16 @@ int bond_3ad_set_carrier(struct bonding *bond) int __bond_3ad_get_active_agg_info(struct bonding *bond, struct ad_info *ad_info) { - struct aggregator *aggregator = NULL; + struct aggregator *aggregator = NULL, *tmp; struct list_head *iter; struct slave *slave; struct port *port; bond_for_each_slave_rcu(bond, slave, iter) { port = &(SLAVE_AD_INFO(slave)->port); - if (port->aggregator && port->aggregator->is_active) { - aggregator = port->aggregator; + tmp = rcu_dereference(port->aggregator); + if (tmp && tmp->is_active) { + aggregator = tmp; break; } } diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c index c6e625ef6d34..2ba313997dbb 100644 --- a/drivers/net/bonding/bond_main.c +++ b/drivers/net/bonding/bond_main.c @@ -1282,7 +1282,7 @@ static void bond_poll_controller(struct net_device *bond_dev) if (BOND_MODE(bond) == BOND_MODE_8023AD) { struct aggregator *agg = - SLAVE_AD_INFO(slave)->port.aggregator; + rcu_dereference(SLAVE_AD_INFO(slave)->port.aggregator); if (agg && agg->aggregator_identifier != ad_info.aggregator_id) @@ -4712,15 +4712,16 @@ int bond_update_slave_arr(struct bonding *bond, struct slave *skipslave) spin_unlock_bh(&bond->mode_lock); agg_id = ad_info.aggregator_id; } + rcu_read_lock(); bond_for_each_slave(bond, slave, iter) { if (skipslave == slave) continue; all_slaves->arr[all_slaves->count++] = slave; if (BOND_MODE(bond) == BOND_MODE_8023AD) { - struct aggregator *agg; + const struct aggregator *agg; - agg = SLAVE_AD_INFO(slave)->port.aggregator; + agg = rcu_dereference(SLAVE_AD_INFO(slave)->port.aggregator); if (!agg || agg->aggregator_identifier != agg_id) continue; } @@ -4732,6 +4733,7 @@ int bond_update_slave_arr(struct bonding *bond, struct slave *skipslave) usable_slaves->arr[usable_slaves->count++] = slave; } + rcu_read_unlock(); bond_set_slave_arr(bond, usable_slaves, all_slaves); return ret; diff --git a/drivers/net/bonding/bond_netlink.c b/drivers/net/bonding/bond_netlink.c index f0f9138e967f..a53fbf6035ed 100644 --- a/drivers/net/bonding/bond_netlink.c +++ b/drivers/net/bonding/bond_netlink.c @@ -57,24 +57,28 @@ static int bond_fill_slave_info(struct sk_buff *skb, const struct port *ad_port; ad_port = &SLAVE_AD_INFO(slave)->port; - agg = SLAVE_AD_INFO(slave)->port.aggregator; + rcu_read_lock(); + agg = rcu_dereference(SLAVE_AD_INFO(slave)->port.aggregator); if (agg) { if (nla_put_u16(skb, IFLA_BOND_SLAVE_AD_AGGREGATOR_ID, agg->aggregator_identifier)) - goto nla_put_failure; + goto nla_put_failure_rcu; if (nla_put_u8(skb, IFLA_BOND_SLAVE_AD_ACTOR_OPER_PORT_STATE, ad_port->actor_oper_port_state)) - goto nla_put_failure; + goto nla_put_failure_rcu; if (nla_put_u16(skb, IFLA_BOND_SLAVE_AD_PARTNER_OPER_PORT_STATE, ad_port->partner_oper.port_state)) - goto nla_put_failure; + goto nla_put_failure_rcu; } + rcu_read_unlock(); } return 0; +nla_put_failure_rcu: + rcu_read_unlock(); nla_put_failure: return -EMSGSIZE; } diff --git a/drivers/net/bonding/bond_procfs.c b/drivers/net/bonding/bond_procfs.c index fd5c9cbe45b1..0b22785bacbf 100644 --- a/drivers/net/bonding/bond_procfs.c +++ b/drivers/net/bonding/bond_procfs.c @@ -166,6 +166,7 @@ static void bond_info_show_master(struct seq_file *seq) } } +/* Note: runs under rcu_read_lock() */ static void bond_info_show_slave(struct seq_file *seq, const struct slave *slave) { @@ -192,7 +193,7 @@ static void bond_info_show_slave(struct seq_file *seq, if (BOND_MODE(bond) == BOND_MODE_8023AD) { const struct port *port = &SLAVE_AD_INFO(slave)->port; - const struct aggregator *agg = port->aggregator; + const struct aggregator *agg = rcu_dereference(port->aggregator); if (agg) { seq_printf(seq, "Aggregator ID: %d\n", diff --git a/drivers/net/bonding/bond_sysfs_slave.c b/drivers/net/bonding/bond_sysfs_slave.c index 6a6cdd0bb258..d11a7b3ca335 100644 --- a/drivers/net/bonding/bond_sysfs_slave.c +++ b/drivers/net/bonding/bond_sysfs_slave.c @@ -68,13 +68,18 @@ static ssize_t ad_aggregator_id_show(struct slave *slave, char *buf) const struct aggregator *agg; if (BOND_MODE(slave->bond) == BOND_MODE_8023AD) { - agg = SLAVE_AD_INFO(slave)->port.aggregator; - if (agg) - return sprintf(buf, "%d\n", - agg->aggregator_identifier); + rcu_read_lock(); + agg = rcu_dereference(SLAVE_AD_INFO(slave)->port.aggregator); + if (agg) { + ssize_t res = sysfs_emit(buf, "%d\n", + agg->aggregator_identifier); + rcu_read_unlock(); + return res; + } + rcu_read_unlock(); } - return sprintf(buf, "N/A\n"); + return sysfs_emit(buf, "N/A\n"); } static SLAVE_ATTR_RO(ad_aggregator_id); @@ -84,12 +89,12 @@ static ssize_t ad_actor_oper_port_state_show(struct slave *slave, char *buf) if (BOND_MODE(slave->bond) == BOND_MODE_8023AD) { ad_port = &SLAVE_AD_INFO(slave)->port; - if (ad_port->aggregator) - return sprintf(buf, "%u\n", + if (rcu_access_pointer(ad_port->aggregator)) + return sysfs_emit(buf, "%u\n", ad_port->actor_oper_port_state); } - return sprintf(buf, "N/A\n"); + return sysfs_emit(buf, "N/A\n"); } static SLAVE_ATTR_RO(ad_actor_oper_port_state); @@ -99,12 +104,12 @@ static ssize_t ad_partner_oper_port_state_show(struct slave *slave, char *buf) if (BOND_MODE(slave->bond) == BOND_MODE_8023AD) { ad_port = &SLAVE_AD_INFO(slave)->port; - if (ad_port->aggregator) - return sprintf(buf, "%u\n", + if (rcu_access_pointer(ad_port->aggregator)) + return sysfs_emit(buf, "%u\n", ad_port->partner_oper.port_state); } - return sprintf(buf, "N/A\n"); + return sysfs_emit(buf, "N/A\n"); } static SLAVE_ATTR_RO(ad_partner_oper_port_state); diff --git a/include/net/bond_3ad.h b/include/net/bond_3ad.h index 895eae18271f..f9b2855753c7 100644 --- a/include/net/bond_3ad.h +++ b/include/net/bond_3ad.h @@ -237,7 +237,7 @@ typedef struct port { churn_state_t sm_churn_actor_state; churn_state_t sm_churn_partner_state; struct slave *slave; /* pointer to the bond slave that this port belongs to */ - struct aggregator *aggregator; /* pointer to an aggregator that this port related to */ + struct aggregator __rcu *aggregator; /* pointer to an aggregator that this port related to */ struct port *next_port_in_aggregator; /* Next port on the linked list of the parent aggregator */ u32 transaction_id; /* continuous number for identification of Marker PDU's; */ struct lacpdu lacpdu; /* the lacpdu that will be sent for this port */ -- 2.43.0

2 1

[PATCH OLK-5.10] bpf: Free reuseport cBPF prog after RCU grace period.
by superdcc97＠163.com 04 Jul '26

04 Jul '26

From: Kuniyuki Iwashima <kuniyu(a)google.com> stable inclusion from stable-v5.10.259 commit 08264d5bba0bdd3a79bc2984fee09286aba0c4eb category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15607 CVE: CVE-2026-52910 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 18fc650ccd7fe3376eca89203668cfb8268f60df ] Eulgyu Kim reported the splat below with a repro. [0] The repro sets up a UDP reuseport group with a cBPF prog and replaces it with a new one while another thread is sending a UDP packet to the group. The reuseport prog is freed by sk_reuseport_prog_free(). bpf_prog_put() is called for "e"BPF prog to destruct through multiple stages while cBPF prog is freed immediately by bpf_release_orig_filter() and bpf_prog_free(). If a reuseport prog is detached from the setsockopt() path (reuseport_attach_prog() or reuseport_detach_prog()), sk_reuseport_prog_free() is called without waiting for RCU readers to complete, resulting in various bugs. Let's defer freeing the reuseport cBPF prog after one RCU grace period. Note "e"BPF prog is safe as is unless the fast path starts to touch fields destroyed in bpf_prog_put_deferred() and __bpf_prog_put_noref(). [0]: BUG: KASAN: vmalloc-out-of-bounds in reuseport_select_sock+0xedc/0x1220 net/core/sock_reuseport.c:596 Read of size 4 at addr ffffc9000051e004 by task slowme/10208 CPU: 6 UID: 1000 PID: 10208 Comm: slowme Not tainted 7.0.0-geb7ac95ff75e #32 PREEMPT(full) Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: <IRQ> dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xca/0x240 mm/kasan/report.c:482 kasan_report+0x118/0x150 mm/kasan/report.c:595 reuseport_select_sock+0xedc/0x1220 net/core/sock_reuseport.c:596 udp4_lib_lookup2+0x3bc/0x950 net/ipv4/udp.c:495 __udp4_lib_lookup+0x768/0xe20 net/ipv4/udp.c:723 __udp4_lib_lookup_skb+0x297/0x390 net/ipv4/udp.c:752 __udp4_lib_rcv+0x1312/0x2620 net/ipv4/udp.c:2752 ip_protocol_deliver_rcu+0x282/0x440 net/ipv4/ip_input.c:207 ip_local_deliver_finish+0x3bb/0x6f0 net/ipv4/ip_input.c:241 NF_HOOK+0x30c/0x3a0 include/linux/netfilter.h:318 NF_HOOK+0x30c/0x3a0 include/linux/netfilter.h:318 __netif_receive_skb_one_core net/core/dev.c:6181 [inline] __netif_receive_skb net/core/dev.c:6294 [inline] process_backlog+0xaa4/0x1960 net/core/dev.c:6645 __napi_poll+0xae/0x340 net/core/dev.c:7709 napi_poll net/core/dev.c:7772 [inline] net_rx_action+0x5d7/0xf50 net/core/dev.c:7929 handle_softirqs+0x22b/0x870 kernel/softirq.c:622 do_softirq+0x76/0xd0 kernel/softirq.c:523 </IRQ> <TASK> __local_bh_enable_ip+0xf8/0x130 kernel/softirq.c:450 local_bh_enable include/linux/bottom_half.h:33 [inline] rcu_read_unlock_bh include/linux/rcupdate.h:924 [inline] __dev_queue_xmit+0x1dd7/0x3710 net/core/dev.c:4890 neigh_output include/net/neighbour.h:556 [inline] ip_finish_output2+0xca9/0x1070 net/ipv4/ip_output.c:237 NF_HOOK_COND include/linux/netfilter.h:307 [inline] ip_output+0x29f/0x450 net/ipv4/ip_output.c:438 ip_send_skb+0x45/0xc0 net/ipv4/ip_output.c:1508 udp_send_skb+0xb04/0x1510 net/ipv4/udp.c:1195 udp_sendmsg+0x1a71/0x2350 net/ipv4/udp.c:1485 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg net/socket.c:742 [inline] __sys_sendto+0x554/0x680 net/socket.c:2206 __do_sys_sendto net/socket.c:2213 [inline] __se_sys_sendto net/socket.c:2209 [inline] __x64_sys_sendto+0xde/0x100 net/socket.c:2209 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x160/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x415a2d Code: b3 66 2e 0f 1f 84 00 00 00 00 00 66 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f6bc31e41e8 EFLAGS: 00000212 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007f6bc31e4cdc RCX: 0000000000415a2d RDX: 0000000000000001 RSI: 00007f6bc31e421f RDI: 0000000000000003 RBP: 00007f6bc31e4240 R08: 00007f6bc31e4220 R09: 0000000000000010 R10: 0000000000000000 R11: 0000000000000212 R12: 00007f6bc31e46c0 R13: ffffffffffffffb8 R14: 0000000000000000 R15: 00007ffc9b0d70b0 </TASK> Fixes: 538950a1b752 ("soreuseport: setsockopt SO_ATTACH_REUSEPORT_[CE]BPF") Reported-by: Eulgyu Kim <eulgyukim(a)snu.ac.kr> Reported-by: Taeyang Lee <0wn(a)theori.io> Signed-off-by: Kuniyuki Iwashima <kuniyu(a)google.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Acked-by: Daniel Borkmann <daniel(a)iogearbox.net> Link: https://lore.kernel.org/bpf/20260426012647.3233119-1-kuniyu@google.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/core/filter.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/net/core/filter.c b/net/core/filter.c index e28857036d90..4587692710fc 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -1629,15 +1629,24 @@ int sk_reuseport_attach_bpf(u32 ufd, struct sock *sk) return err; } +static void sk_reuseport_prog_free_rcu(struct rcu_head *rcu) +{ + struct bpf_prog_aux *aux = container_of(rcu, struct bpf_prog_aux, rcu); + struct bpf_prog *prog = aux->prog; + + bpf_release_orig_filter(prog); + bpf_prog_free(prog); +} + void sk_reuseport_prog_free(struct bpf_prog *prog) { if (!prog) return; - if (prog->type == BPF_PROG_TYPE_SK_REUSEPORT) - bpf_prog_put(prog); + if (bpf_prog_was_classic(prog)) + call_rcu(&prog->aux->rcu, sk_reuseport_prog_free_rcu); else - bpf_prog_destroy(prog); + bpf_prog_put(prog); } struct bpf_scratchpad { -- 2.43.0

2 1

[PATCH OLK-5.10] netfilter: nf_tables: use list_del_rcu for netlink hooks
by superdcc97＠163.com 04 Jul '26

04 Jul '26

From: Dong Chenchen <dongchenchen2(a)huawei.com> mainline inclusion from mainline-v7.1-rc2 commit f3224ee463f8f6f6ced7dcdf6081add4f8128527 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15588 CVE: CVE-2026-46324 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- nft_netdev_unregister_hooks and __nft_unregister_flowtable_net_hooks need to use list_del_rcu(), this list can be walked by concurrent dumpers. Add a new helper and use it consistently. Fixes: f9a43007d3f7 ("netfilter: nf_tables: double hook unregistration in netns path") Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/nf_tables_api.c [1.The nf_tables_updchain() hook-list teardown path present in mainline (where hook.list lives on the stack and uses list_del() / nft_netdev_hook_free_rcu()) does not exist in OLK-5.10, so that hunk was skipped. 2. nf_tables_flowtable_destroy() in OLK-5.10 still performs flowtable->data.type->setup(..., FLOW_BLOCK_UNBIND) for each hook before removing it, a pattern that was refactored out upstream; the helper replacement from mainline therefore could not be used here. The existing list_del_rcu() call is retained, and the immediate kfree(hook) was changed to kfree_rcu(hook, rcu) to match the RCU-safe freeing used by the new helper. 3. Other hunks were applied manually by introducing the nft_netdev_hook_unlink_free_rcu() helper and using it consistently wherever OLK-5.10 already performed list_del_rcu()/kfree_rcu() on a netdev/flowtable hook, and by converting the two list_del() callers (nft_netdev_unregister_hooks and __nft_unregister_flowtable_net_hooks) to list_del_rcu() as required by the CVE fix. ] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/nf_tables_api.c | 38 ++++++++++++++++------------------- 1 file changed, 17 insertions(+), 21 deletions(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 2beef989cced..b97c4d0cf1d9 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -303,6 +303,12 @@ static int nft_netdev_register_hooks(struct net *net, return err; } +static void nft_netdev_hook_unlink_free_rcu(struct nft_hook *hook) +{ + list_del_rcu(&hook->list); + kfree_rcu(hook, rcu); +} + static void nft_netdev_unregister_hooks(struct net *net, struct list_head *hook_list, bool release_netdev) @@ -311,10 +317,8 @@ static void nft_netdev_unregister_hooks(struct net *net, list_for_each_entry_safe(hook, next, hook_list, list) { nf_unregister_net_hook(net, &hook->ops); - if (release_netdev) { - list_del(&hook->list); - kfree_rcu(hook, rcu); - } + if (release_netdev) + nft_netdev_hook_unlink_free_rcu(hook); } } @@ -1932,10 +1936,8 @@ void nf_tables_chain_destroy(struct nft_ctx *ctx) if (nft_base_chain_netdev(ctx->family, basechain->ops.hooknum)) { list_for_each_entry_safe(hook, next, - &basechain->hook_list, list) { - list_del_rcu(&hook->list); - kfree_rcu(hook, rcu); - } + &basechain->hook_list, list) + nft_netdev_hook_unlink_free_rcu(hook); } module_put(basechain->type->owner); if (rcu_access_pointer(basechain->stats)) { @@ -7004,10 +7006,8 @@ static void __nft_unregister_flowtable_net_hooks(struct net *net, list_for_each_entry_safe(hook, next, hook_list, list) { nf_unregister_net_hook(net, &hook->ops); - if (release_netdev) { - list_del(&hook->list); - kfree_rcu(hook, rcu); - } + if (release_netdev) + nft_netdev_hook_unlink_free_rcu(hook); } } @@ -7065,8 +7065,7 @@ static int nft_register_flowtable_net_hooks(struct net *net, break; nft_unregister_flowtable_hook(net, flowtable, hook); - list_del_rcu(&hook->list); - kfree_rcu(hook, rcu); + nft_netdev_hook_unlink_free_rcu(hook); } return err; @@ -7076,10 +7075,8 @@ static void nft_flowtable_hooks_destroy(struct list_head *hook_list) { struct nft_hook *hook, *next; - list_for_each_entry_safe(hook, next, hook_list, list) { - list_del_rcu(&hook->list); - kfree_rcu(hook, rcu); - } + list_for_each_entry_safe(hook, next, hook_list, list) + nft_netdev_hook_unlink_free_rcu(hook); } static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh, @@ -7147,8 +7144,7 @@ static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh, list_for_each_entry_safe(hook, next, &flowtable_hook.list, list) { if (unregister) nft_unregister_flowtable_hook(ctx->net, flowtable, hook); - list_del_rcu(&hook->list); - kfree_rcu(hook, rcu); + nft_netdev_hook_unlink_free_rcu(hook); } return err; @@ -7639,7 +7635,7 @@ static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable) flowtable->data.type->setup(&flowtable->data, hook->ops.dev, FLOW_BLOCK_UNBIND); list_del_rcu(&hook->list); - kfree(hook); + kfree_rcu(hook, rcu); } kfree(flowtable->name); module_put(flowtable->data.type->owner); -- 2.43.0

2 1

[PATCH OLK-6.6] iommu/vt-d: Fix oops due to out of scope access
by Zhang Yuwei 03 Jul '26

03 Jul '26

From: Zhenzhong Duan <zhenzhong.duan(a)intel.com> mainline inclusion from mainline-v7.1-rc4 commit a6dea58d8625c06b9654c0555f101742481335c3 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15655 CVE: CVE-2026-52953 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Below oops triggers when kill QEMU process: Oops: general protection fault, probably for non-canonical address 0x7fffffff844eaaa7: 0000 [#1] SMP NOPTI Call Trace: <TASK> do_raw_spin_lock+0xaa/0xc0 _raw_spin_lock_irqsave+0x21/0x40 domain_remove_dev_pasid+0x52/0x160 intel_nested_set_dev_pasid+0x1b9/0x1e0 __iommu_set_group_pasid+0x56/0x120 pci_dev_reset_iommu_done+0xe3/0x180 pcie_flr+0x65/0x160 __pci_reset_function_locked+0x5b/0x120 vfio_pci_core_close_device+0x63/0xe0 [vfio_pci_core] vfio_df_close+0x4f/0xa0 vfio_df_unbind_iommufd+0x2d/0x60 vfio_device_fops_release+0x3e/0x40 __fput+0xe5/0x2c0 task_work_run+0x58/0xa0 do_exit+0x2c8/0x600 do_group_exit+0x2f/0xa0 get_signal+0x863/0x8c0 arch_do_signal_or_restart+0x24/0x100 exit_to_user_mode_loop+0x87/0x380 do_syscall_64+0x2ff/0x11e0 entry_SYSCALL_64_after_hwframe+0x76/0x7e The global static blocked domain is a dummy domain without corresponding dmar_domain structure, accessing beyond iommu_domain structure triggers oops easily. Fix it by return early in domain_remove_dev_pasid() like identity domain. Fixes: 7d0c9da6c150 ("iommu/vt-d: Add set_dev_pasid callback for dma domain") Cc: stable(a)vger.kernel.org Signed-off-by: Zhenzhong Duan <zhenzhong.duan(a)intel.com> Reviewed-by: Kevin Tian <kevin.tian(a)intel.com> Link: https://lore.kernel.org/r/20260421031347.1408890-1-zhenzhong.duan@intel.com Signed-off-by: Lu Baolu <baolu.lu(a)linux.intel.com> Signed-off-by: Joerg Roedel <joerg.roedel(a)amd.com> Conflicts: drivers/iommu/intel/iommu.c [commit d93cf86cc66a0 not merged] Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> --- drivers/iommu/intel/iommu.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c index 5f9a361ed6e9..f982327f3dfd 100644 --- a/drivers/iommu/intel/iommu.c +++ b/drivers/iommu/intel/iommu.c @@ -4657,6 +4657,10 @@ static void intel_iommu_remove_dev_pasid(struct device *dev, ioasid_t pasid, struct intel_iommu *iommu = info->iommu; unsigned long flags; + /* Identity domain and blocked domain have no meta data for pasid. */ + if (domain->type == IOMMU_DOMAIN_BLOCKED) + return; + /* * The SVA implementation needs to handle its own stuffs like the mm * notification. Before consolidating that code into iommu core, let -- 2.22.0

2 1

[PATCH] [Backport] iommu/vt-d: Fix oops due to out of scope access
by Zhang Yuwei 03 Jul '26

03 Jul '26

From: Zhenzhong Duan <zhenzhong.duan(a)intel.com> mainline inclusion from mainline-v7.1-rc4 commit a6dea58d8625c06b9654c0555f101742481335c3 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15655 CVE: CVE-2026-52953 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Below oops triggers when kill QEMU process: Oops: general protection fault, probably for non-canonical address 0x7fffffff844eaaa7: 0000 [#1] SMP NOPTI Call Trace: <TASK> do_raw_spin_lock+0xaa/0xc0 _raw_spin_lock_irqsave+0x21/0x40 domain_remove_dev_pasid+0x52/0x160 intel_nested_set_dev_pasid+0x1b9/0x1e0 __iommu_set_group_pasid+0x56/0x120 pci_dev_reset_iommu_done+0xe3/0x180 pcie_flr+0x65/0x160 __pci_reset_function_locked+0x5b/0x120 vfio_pci_core_close_device+0x63/0xe0 [vfio_pci_core] vfio_df_close+0x4f/0xa0 vfio_df_unbind_iommufd+0x2d/0x60 vfio_device_fops_release+0x3e/0x40 __fput+0xe5/0x2c0 task_work_run+0x58/0xa0 do_exit+0x2c8/0x600 do_group_exit+0x2f/0xa0 get_signal+0x863/0x8c0 arch_do_signal_or_restart+0x24/0x100 exit_to_user_mode_loop+0x87/0x380 do_syscall_64+0x2ff/0x11e0 entry_SYSCALL_64_after_hwframe+0x76/0x7e The global static blocked domain is a dummy domain without corresponding dmar_domain structure, accessing beyond iommu_domain structure triggers oops easily. Fix it by return early in domain_remove_dev_pasid() like identity domain. Fixes: 7d0c9da6c150 ("iommu/vt-d: Add set_dev_pasid callback for dma domain") Cc: stable(a)vger.kernel.org Signed-off-by: Zhenzhong Duan <zhenzhong.duan(a)intel.com> Reviewed-by: Kevin Tian <kevin.tian(a)intel.com> Link: https://lore.kernel.org/r/20260421031347.1408890-1-zhenzhong.duan@intel.com Signed-off-by: Lu Baolu <baolu.lu(a)linux.intel.com> Signed-off-by: Joerg Roedel <joerg.roedel(a)amd.com> Conflicts: drivers/iommu/intel/iommu.c [commit d93cf86cc66a0 not merged] Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> --- drivers/iommu/intel/iommu.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c index 4d6812426077..992849156503 100644 --- a/drivers/iommu/intel/iommu.c +++ b/drivers/iommu/intel/iommu.c @@ -4669,6 +4669,10 @@ static void intel_iommu_remove_dev_pasid(struct device *dev, ioasid_t pasid, struct intel_iommu *iommu = info->iommu; unsigned long flags; + /* Blocked domain have no meta data for pasid. */ + if (domain->type == IOMMU_DOMAIN_BLOCKED) + return; + /* * The SVA implementation needs to handle its own stuffs like the mm * notification. Before consolidating that code into iommu core, let -- 2.22.0

1 0

[PATCH] [Backport] iommu/vt-d: Fix oops due to out of scope access
by Zhang Yuwei 03 Jul '26

03 Jul '26

From: Zhenzhong Duan <zhenzhong.duan(a)intel.com> mainline inclusion from mainline-v7.1-rc4 commit a6dea58d8625c06b9654c0555f101742481335c3 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15655 CVE: CVE-2026-52953 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Below oops triggers when kill QEMU process: Oops: general protection fault, probably for non-canonical address 0x7fffffff844eaaa7: 0000 [#1] SMP NOPTI Call Trace: <TASK> do_raw_spin_lock+0xaa/0xc0 _raw_spin_lock_irqsave+0x21/0x40 domain_remove_dev_pasid+0x52/0x160 intel_nested_set_dev_pasid+0x1b9/0x1e0 __iommu_set_group_pasid+0x56/0x120 pci_dev_reset_iommu_done+0xe3/0x180 pcie_flr+0x65/0x160 __pci_reset_function_locked+0x5b/0x120 vfio_pci_core_close_device+0x63/0xe0 [vfio_pci_core] vfio_df_close+0x4f/0xa0 vfio_df_unbind_iommufd+0x2d/0x60 vfio_device_fops_release+0x3e/0x40 __fput+0xe5/0x2c0 task_work_run+0x58/0xa0 do_exit+0x2c8/0x600 do_group_exit+0x2f/0xa0 get_signal+0x863/0x8c0 arch_do_signal_or_restart+0x24/0x100 exit_to_user_mode_loop+0x87/0x380 do_syscall_64+0x2ff/0x11e0 entry_SYSCALL_64_after_hwframe+0x76/0x7e The global static blocked domain is a dummy domain without corresponding dmar_domain structure, accessing beyond iommu_domain structure triggers oops easily. Fix it by return early in domain_remove_dev_pasid() like identity domain. Fixes: 7d0c9da6c150 ("iommu/vt-d: Add set_dev_pasid callback for dma domain") Cc: stable(a)vger.kernel.org Signed-off-by: Zhenzhong Duan <zhenzhong.duan(a)intel.com> Reviewed-by: Kevin Tian <kevin.tian(a)intel.com> Link: https://lore.kernel.org/r/20260421031347.1408890-1-zhenzhong.duan@intel.com Signed-off-by: Lu Baolu <baolu.lu(a)linux.intel.com> Signed-off-by: Joerg Roedel <joerg.roedel(a)amd.com> Conflicts: drivers/iommu/intel/iommu.c [commit d93cf86cc66a0 not merged] Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> --- drivers/iommu/intel/iommu.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c index 4d6812426077..992849156503 100644 --- a/drivers/iommu/intel/iommu.c +++ b/drivers/iommu/intel/iommu.c @@ -4669,6 +4669,10 @@ static void intel_iommu_remove_dev_pasid(struct device *dev, ioasid_t pasid, struct intel_iommu *iommu = info->iommu; unsigned long flags; + /* Identity domain and blocked domain have no meta data for pasid. */ + if (domain->type == IOMMU_DOMAIN_BLOCKED) + return; + /* * The SVA implementation needs to handle its own stuffs like the mm * notification. Before consolidating that code into iommu core, let -- 2.22.0

1 0

[PATCH OLK-5.10] vdpa: use generic driver_override infrastructure
by Lin Ruifeng 03 Jul '26

03 Jul '26

From: Danilo Krummrich <dakr(a)kernel.org> stable inclusion from stable-v6.18.33 commit 654ef9c33e138ede6734ac286282df9faf83cd11 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15815 CVE: CVE-2026-53118 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 85bb534ff12aab6916058897b39c748940a7a4c6 ] When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF. Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally. Note that calling match() from __driver_attach() without the device lock held is intentional. [1] Link: https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/ [1] Reported-by: Gui-Dong Han <hanguidong02(a)gmail.com> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220789 Fixes: 539fec78edb4 ("vdpa: add driver_override support") Acked-by: Eugenio Pérez <eperezma(a)redhat.com> Acked-by: Michael S. Tsirkin <mst(a)redhat.com> Link: https://patch.msgid.link/20260324005919.2408620-9-dakr@kernel.org Signed-off-by: Danilo Krummrich <dakr(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/vdpa/vdpa.c include/linux/vdpa.h [Context Conflicts] Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/vdpa/vdpa.c | 48 +++++--------------------------------------- include/linux/vdpa.h | 4 ---- 2 files changed, 5 insertions(+), 47 deletions(-) diff --git a/drivers/vdpa/vdpa.c b/drivers/vdpa/vdpa.c index a7612e0783b3..28a2fb1d0fa4 100644 --- a/drivers/vdpa/vdpa.c +++ b/drivers/vdpa/vdpa.c @@ -67,57 +67,20 @@ static void vdpa_dev_remove(struct device *d) static int vdpa_dev_match(struct device *dev, struct device_driver *drv) { - struct vdpa_device *vdev = dev_to_vdpa(dev); + int ret; /* Check override first, and if set, only use the named driver */ - if (vdev->driver_override) - return strcmp(vdev->driver_override, drv->name) == 0; + ret = device_match_driver_override(dev, drv); + if (ret >= 0) + return ret; /* Currently devices must be supported by all vDPA bus drivers */ return 1; } -static ssize_t driver_override_store(struct device *dev, - struct device_attribute *attr, - const char *buf, size_t count) -{ - struct vdpa_device *vdev = dev_to_vdpa(dev); - int ret; - - ret = driver_set_override(dev, &vdev->driver_override, buf, count); - if (ret) - return ret; - - return count; -} - -static ssize_t driver_override_show(struct device *dev, - struct device_attribute *attr, char *buf) -{ - struct vdpa_device *vdev = dev_to_vdpa(dev); - ssize_t len; - - device_lock(dev); - len = snprintf(buf, PAGE_SIZE, "%s\n", vdev->driver_override); - device_unlock(dev); - - return len; -} -static DEVICE_ATTR_RW(driver_override); - -static struct attribute *vdpa_dev_attrs[] = { - &dev_attr_driver_override.attr, - NULL, -}; - -static const struct attribute_group vdpa_dev_group = { - .attrs = vdpa_dev_attrs, -}; -__ATTRIBUTE_GROUPS(vdpa_dev); - static struct bus_type vdpa_bus = { .name = "vdpa", - .dev_groups = vdpa_dev_groups, + .driver_override = true, .match = vdpa_dev_match, .probe = vdpa_dev_probe, .remove = vdpa_dev_remove, @@ -132,7 +95,6 @@ static void vdpa_release_dev(struct device *d) ops->free(vdev); ida_simple_remove(&vdpa_index_ida, vdev->index); - kfree(vdev->driver_override); kfree(vdev); } diff --git a/include/linux/vdpa.h b/include/linux/vdpa.h index 3120a1a600dd..f16a2647e1cc 100644 --- a/include/linux/vdpa.h +++ b/include/linux/vdpa.h @@ -70,9 +70,6 @@ struct vdpa_mgmt_dev; * struct vdpa_device - representation of a vDPA device * @dev: underlying device * @dma_dev: the actual device that is performing DMA - * @driver_override: driver name to force a match; do not set directly, - * because core frees it; use driver_set_override() to - * set or clear it. * @config: the configuration ops for this device. * @cf_lock: Protects get and set access to configuration layout. * @index: device index @@ -87,7 +84,6 @@ struct vdpa_mgmt_dev; struct vdpa_device { struct device dev; struct device *dma_dev; - const char *driver_override; const struct vdpa_config_ops *config; struct rw_semaphore cf_lock; /* Protects get/set config */ unsigned int index; -- 2.34.1

2 1

[PATCH OLK-5.10] ALSA: usb-audio: Bound MIDI endpoint descriptor scans
by Lin Ruifeng 03 Jul '26

03 Jul '26

From: Cássio Gabriel <cassiogabrielcontato(a)gmail.com> stable inclusion from stable-v5.10.258 commit e2f1260a056eb3215c13c48c5378f3e4112dc3af category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15665 CVE: CVE-2026-52963 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit d6854daa67be623860f4e1873fd3d3c275aba4ed upstream. snd_usbmidi_get_ms_info() validates the internal MIDIStreaming endpoint descriptor size before using baAssocJackID[], but the descriptor walker can still return a class-specific endpoint descriptor whose bLength exceeds the remaining bytes in the endpoint-extra scan. That leaves later flexible-array reads bounded by bLength, but not by the remaining bytes in the endpoint-extra scan. Stop walking when bLength is zero or extends past the remaining endpoint-extra scan. Fixes: 5c6cd7021a05 ("ALSA: usb-audio: Fix case when USB MIDI interface has more than one extra endpoint descriptor") Cc: stable(a)vger.kernel.org Signed-off-by: Cássio Gabriel <cassiogabrielcontato(a)gmail.com> Link: https://patch.msgid.link/20260507-usb-midi-endpoint-scan-bounds-v1-1-329d73… Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- sound/usb/midi.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/sound/usb/midi.c b/sound/usb/midi.c index b02e1a33304f..12c35cb0a707 100644 --- a/sound/usb/midi.c +++ b/sound/usb/midi.c @@ -1838,15 +1838,17 @@ static struct usb_ms_endpoint_descriptor *find_usb_ms_endpoint_descriptor( while (extralen > 3) { struct usb_ms_endpoint_descriptor *ms_ep = (struct usb_ms_endpoint_descriptor *)extra; + int length = ms_ep->bLength; - if (ms_ep->bLength > 3 && + if (!length || length > extralen) + break; + + if (length > 3 && ms_ep->bDescriptorType == USB_DT_CS_ENDPOINT && ms_ep->bDescriptorSubtype == UAC_MS_GENERAL) return ms_ep; - if (!extra[0]) - break; - extralen -= extra[0]; - extra += extra[0]; + extralen -= length; + extra += length; } return NULL; } -- 2.34.1

2 1

[PATCH OLK-6.6 v2] erofs: unify lcn as u64 for 32-bit platforms
by Yipeng Zou 03 Jul '26

03 Jul '26

From: Gao Xiang <hsiangkao(a)linux.alibaba.com> mainline inclusion from mainline-v7.1 commit 2d8c7edcb661812249469f4a5b62e9339118846f category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15717 CVE: CVE-2026-53015 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- As sashiko reported [1], `lcn` was typed as `unsigned long` (or `unsigned int` sometimes), which is only 32 bits wide on 32-bit platforms, which causes `(lcn << lclusterbits)` to be truncated at 4 GiB. In order to consolidate the logic, just use `u64` consistently around the codebase. [1] https://sashiko.dev/r/20260420034612.1899973-1-hsiangkao%40linux.alibaba.com Fixes: 152a333a5895 ("staging: erofs: add compacted compression indexes support") Signed-off-by: Gao Xiang <hsiangkao(a)linux.alibaba.com> [context conflicts] Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- fs/erofs/zmap.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/fs/erofs/zmap.c b/fs/erofs/zmap.c index 0603ccd00b3c..d6ada723ffae 100644 --- a/fs/erofs/zmap.c +++ b/fs/erofs/zmap.c @@ -12,7 +12,7 @@ struct z_erofs_maprecorder { struct erofs_map_blocks *map; void *kaddr; - unsigned long lcn; + u64 lcn; /* compression extent information gathered */ u8 type, headtype; u16 clusterofs; @@ -23,7 +23,7 @@ struct z_erofs_maprecorder { }; static int z_erofs_load_full_lcluster(struct z_erofs_maprecorder *m, - unsigned long lcn) + u64 lcn) { struct inode *const inode = m->inode; struct erofs_inode *const vi = EROFS_I(inode); @@ -219,7 +219,7 @@ static int unpack_compacted_index(struct z_erofs_maprecorder *m, } static int z_erofs_load_compact_lcluster(struct z_erofs_maprecorder *m, - unsigned long lcn, bool lookahead) + u64 lcn, bool lookahead) { struct inode *const inode = m->inode; struct erofs_inode *const vi = EROFS_I(inode); @@ -270,7 +270,7 @@ static int z_erofs_load_compact_lcluster(struct z_erofs_maprecorder *m, } static int z_erofs_load_lcluster_from_disk(struct z_erofs_maprecorder *m, - unsigned int lcn, bool lookahead) + u64 lcn, bool lookahead) { struct erofs_inode *vi = EROFS_I(m->inode); int err; @@ -301,7 +301,7 @@ static int z_erofs_extent_lookback(struct z_erofs_maprecorder *m, const unsigned int lclusterbits = vi->z_logical_clusterbits; while (m->lcn >= lookback_distance) { - unsigned long lcn = m->lcn - lookback_distance; + u64 lcn = m->lcn - lookback_distance; int err; err = z_erofs_load_lcluster_from_disk(m, lcn, false); @@ -321,14 +321,14 @@ static int z_erofs_extent_lookback(struct z_erofs_maprecorder *m, m->map->m_la = (lcn << lclusterbits) | m->clusterofs; return 0; default: - erofs_err(sb, "unknown type %u @ lcn %lu of nid %llu", + erofs_err(sb, "unknown type %u @ lcn %llu of nid %llu", m->type, lcn, vi->nid); DBG_BUGON(1); return -EOPNOTSUPP; } } err_bogus: - erofs_err(sb, "bogus lookback distance %u @ lcn %lu of nid %llu", + erofs_err(sb, "bogus lookback distance %u @ lcn %llu of nid %llu", lookback_distance, m->lcn, vi->nid); DBG_BUGON(1); return -EFSCORRUPTED; @@ -341,7 +341,7 @@ static int z_erofs_get_extent_compressedlen(struct z_erofs_maprecorder *m, struct erofs_inode *const vi = EROFS_I(m->inode); struct erofs_map_blocks *const map = m->map; const unsigned int lclusterbits = vi->z_logical_clusterbits; - unsigned long lcn; + u64 lcn; int err; DBG_BUGON(m->type != Z_EROFS_LCLUSTER_TYPE_PLAIN && @@ -393,7 +393,7 @@ static int z_erofs_get_extent_compressedlen(struct z_erofs_maprecorder *m, break; fallthrough; default: - erofs_err(sb, "cannot found CBLKCNT @ lcn %lu of nid %llu", lcn, + erofs_err(sb, "cannot found CBLKCNT @ lcn %llu of nid %llu", lcn, vi->nid); DBG_BUGON(1); return -EFSCORRUPTED; @@ -402,7 +402,7 @@ static int z_erofs_get_extent_compressedlen(struct z_erofs_maprecorder *m, map->m_plen = erofs_pos(sb, m->compressedblks); return 0; err_bonus_cblkcnt: - erofs_err(sb, "bogus CBLKCNT @ lcn %lu of nid %llu", lcn, vi->nid); + erofs_err(sb, "bogus CBLKCNT @ lcn %llu of nid %llu", lcn, vi->nid); DBG_BUGON(1); return -EFSCORRUPTED; } -- 2.34.1

2 1

[PATCH OLK-6.6] iommu/amd: Fix clone_alias() to use the original device's devid
by Zhang Yuwei 03 Jul '26

03 Jul '26

From: Vasant Hegde <vasant.hegde(a)amd.com> mainline inclusion from mainline-v7.1-rc1 commit faad224fe0f0857a04ff2eb3c90f0de57f47d0f3 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15755 CVE: CVE-2026-53053 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Currently clone_alias() assumes first argument (pdev) is always the original device pointer. This function is called by pci_for_each_dma_alias() which based on topology decides to send original or alias device details in first argument. This meant that the source devid used to look up and copy the DTE may be incorrect, leading to wrong or stale DTE entries being propagated to alias device. Fix this by passing the original pdev as the opaque data argument to both the direct clone_alias() call and pci_for_each_dma_alias(). Inside clone_alias(), retrieve the original device from data and compute devid from it. Fixes: 3332364e4ebc ("iommu/amd: Support multiple PCI DMA aliases in device table") Signed-off-by: Vasant Hegde <vasant.hegde(a)amd.com> Signed-off-by: Joerg Roedel <joerg.roedel(a)amd.com> Conflicts: drivers/iommu/amd/iommu.c [context conflict] Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> --- drivers/iommu/amd/iommu.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c index 72022dfb1c0d..d0ffc64204fc 100644 --- a/drivers/iommu/amd/iommu.c +++ b/drivers/iommu/amd/iommu.c @@ -353,11 +353,12 @@ struct iommu_dev_data *search_dev_data(struct amd_iommu *iommu, u16 devid) return NULL; } -static int clone_alias(struct pci_dev *pdev, u16 alias, void *data) +static int clone_alias(struct pci_dev *pdev_origin, u16 alias, void *data) { struct dev_table_entry new; struct amd_iommu *iommu; struct iommu_dev_data *dev_data, *alias_data; + struct pci_dev *pdev = data; u16 devid = pci_dev_id(pdev); int ret = 0; @@ -404,9 +405,9 @@ static void clone_aliases(struct amd_iommu *iommu, struct device *dev) * part of the PCI DMA aliases if it's bus differs * from the original device. */ - clone_alias(pdev, iommu->pci_seg->alias_table[pci_dev_id(pdev)], NULL); + clone_alias(pdev, iommu->pci_seg->alias_table[pci_dev_id(pdev)], pdev); - pci_for_each_dma_alias(pdev, clone_alias, NULL); + pci_for_each_dma_alias(pdev, clone_alias, pdev); } static void setup_aliases(struct amd_iommu *iommu, struct device *dev) -- 2.22.0

2 1

[PATCH OLK-6.6] erofs: unify lcn as u64 for 32-bit platforms
by Yipeng Zou 03 Jul '26

03 Jul '26

From: Gao Xiang <hsiangkao(a)linux.alibaba.com> mainline inclusion from mainline-v7.1 commit 2d8c7edcb661812249469f4a5b62e9339118846f category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15717 CVE: CVE-2026-53015 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- As sashiko reported [1], `lcn` was typed as `unsigned long` (or `unsigned int` sometimes), which is only 32 bits wide on 32-bit platforms, which causes `(lcn << lclusterbits)` to be truncated at 4 GiB. In order to consolidate the logic, just use `u64` consistently around the codebase. [1] https://sashiko.dev/r/20260420034612.1899973-1-hsiangkao%40linux.alibaba.com Fixes: 152a333a5895 ("staging: erofs: add compacted compression indexes support") Signed-off-by: Gao Xiang <hsiangkao(a)linux.alibaba.com> [context conflicts] Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- fs/erofs/zmap.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/fs/erofs/zmap.c b/fs/erofs/zmap.c index 0603ccd00b3c..d9a71cd131a3 100644 --- a/fs/erofs/zmap.c +++ b/fs/erofs/zmap.c @@ -12,7 +12,7 @@ struct z_erofs_maprecorder { struct erofs_map_blocks *map; void *kaddr; - unsigned long lcn; + u64 lcn; /* compression extent information gathered */ u8 type, headtype; u16 clusterofs; @@ -23,7 +23,7 @@ struct z_erofs_maprecorder { }; static int z_erofs_load_full_lcluster(struct z_erofs_maprecorder *m, - unsigned long lcn) + u64 lcn) { struct inode *const inode = m->inode; struct erofs_inode *const vi = EROFS_I(inode); @@ -219,7 +219,7 @@ static int unpack_compacted_index(struct z_erofs_maprecorder *m, } static int z_erofs_load_compact_lcluster(struct z_erofs_maprecorder *m, - unsigned long lcn, bool lookahead) + u64 lcn, bool lookahead) { struct inode *const inode = m->inode; struct erofs_inode *const vi = EROFS_I(inode); @@ -270,7 +270,7 @@ static int z_erofs_load_compact_lcluster(struct z_erofs_maprecorder *m, } static int z_erofs_load_lcluster_from_disk(struct z_erofs_maprecorder *m, - unsigned int lcn, bool lookahead) + u64 lcn, bool lookahead) { struct erofs_inode *vi = EROFS_I(m->inode); int err; @@ -301,7 +301,7 @@ static int z_erofs_extent_lookback(struct z_erofs_maprecorder *m, const unsigned int lclusterbits = vi->z_logical_clusterbits; while (m->lcn >= lookback_distance) { - unsigned long lcn = m->lcn - lookback_distance; + u64 lcn = m->lcn - lookback_distance; int err; err = z_erofs_load_lcluster_from_disk(m, lcn, false); @@ -321,14 +321,14 @@ static int z_erofs_extent_lookback(struct z_erofs_maprecorder *m, m->map->m_la = (lcn << lclusterbits) | m->clusterofs; return 0; default: - erofs_err(sb, "unknown type %u @ lcn %lu of nid %llu", + erofs_err(sb, "unknown type %u @ lcn %llu of nid %llu", m->type, lcn, vi->nid); DBG_BUGON(1); return -EOPNOTSUPP; } } err_bogus: - erofs_err(sb, "bogus lookback distance %u @ lcn %lu of nid %llu", + erofs_err(sb, "bogus lookback distance %u @ lcn %llu of nid %llu", lookback_distance, m->lcn, vi->nid); DBG_BUGON(1); return -EFSCORRUPTED; @@ -341,7 +341,7 @@ static int z_erofs_get_extent_compressedlen(struct z_erofs_maprecorder *m, struct erofs_inode *const vi = EROFS_I(m->inode); struct erofs_map_blocks *const map = m->map; const unsigned int lclusterbits = vi->z_logical_clusterbits; - unsigned long lcn; + u64 lcn; int err; DBG_BUGON(m->type != Z_EROFS_LCLUSTER_TYPE_PLAIN && @@ -393,7 +393,7 @@ static int z_erofs_get_extent_compressedlen(struct z_erofs_maprecorder *m, break; fallthrough; default: - erofs_err(sb, "cannot found CBLKCNT @ lcn %lu of nid %llu", lcn, + erofs_err(sb, "cannot found CBLKCNT @ lcn %llu of nid %llu", lcn, vi->nid); DBG_BUGON(1); return -EFSCORRUPTED; -- 2.34.1

2 1

[PATCH OLK-5.10] scsi: leapraid: update driver to v2.00.01.05
by haodongdong 02 Jul '26

02 Jul '26

LeapIO inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/9539 ------------------------------------------ leapraid driver changes from v2.00.01.02 to v2.00.01.05. This update includes: - recovery wait and hard reset flow stabilization - improved timeout diagnostics with per-command context logging - MSI-X/IRQ CPU affinity fixes - SAS topology and event bitmap alignment fixes - transport and task-management error-path cleanup - config-page stack usage reduction and adapter info cleanup - ioctl compatibility cleanup - resource cleanup and failure-path hardening Signed-off-by: haodongdong <doubled(a)leap-io.com> --- drivers/scsi/leapraid/leapraid.h | 21 -- drivers/scsi/leapraid/leapraid_app.c | 9 +- drivers/scsi/leapraid/leapraid_func.c | 344 +++++++++------------ drivers/scsi/leapraid/leapraid_func.h | 18 +- drivers/scsi/leapraid/leapraid_os.c | 61 ++-- drivers/scsi/leapraid/leapraid_transport.c | 24 +- 6 files changed, 191 insertions(+), 286 deletions(-) diff --git a/drivers/scsi/leapraid/leapraid.h b/drivers/scsi/leapraid/leapraid.h index 2a99417143ad..c9f403efb84f 100644 --- a/drivers/scsi/leapraid/leapraid.h +++ b/drivers/scsi/leapraid/leapraid.h @@ -27,8 +27,6 @@ /* Maximum number of retries waiting for doorbell to become operational. */ #define LEAPRAID_DB_WAIT_OP_SHORT 10 #define LEAPRAID_DB_WAIT_OP_LONG 200 -/* Sleep interval (in seconds) between doorbell polls. */ -#define LEAPRAID_DB_POLL_INTERVAL_S 1 /* Maximum number of retries waiting for host to end recovery. */ #define LEAPRAID_WAIT_SHOST_RECOVERY 400 @@ -180,7 +178,6 @@ #define LEAPRAID_CFG_PAGE_NUM_DEV0 0x0 /* SAS device page 0 flags. */ -#define LEAPRAID_SAS_DEV_P0_FLG_FP_CAP 0x2000 #define LEAPRAID_SAS_DEV_P0_FLG_SATA_SMART 0x0040 #define LEAPRAID_SAS_DEV_P0_FLG_ENC_LEVEL_VALID 0x0002 #define LEAPRAID_SAS_DEV_P0_FLG_DEV_PRESENT 0x0001 @@ -207,15 +204,9 @@ /* Physical disk page number. */ #define LEAPRAID_CFG_PAGE_NUM_PD0 0x0 -/* Adapter page number. */ -#define LEAPRAID_CFG_PAGE_NUM_ADAPTER1 0x1 - #define LEAPRAID_CFG_UNIT_SIZE 4 /* Raid volume type and state. */ -#define LEAPRAID_VOL_STATE_MISSING 0x00 -#define LEAPRAID_VOL_STATE_FAILED 0x01 -#define LEAPRAID_VOL_STATE_INITIALIZING 0x02 #define LEAPRAID_VOL_STATE_ONLINE 0x03 #define LEAPRAID_VOL_STATE_DEGRADED 0x04 #define LEAPRAID_VOL_STATE_OPTIMAL 0x05 @@ -231,10 +222,6 @@ #define LEAPRAID_RAIDCFG_P0_EFLG_HOT_SPARE_ELEMENT 0x0002 #define LEAPRAID_RAIDCFG_P0_EFLG_OCE_ELEMENT 0x0003 -/* Raid action. */ -#define LEAPRAID_RAID_ACT_SYSTEM_SHUTDOWN_INITIATED 0x20 -#define LEAPRAID_RAID_ACT_PHYSDISK_HIDDEN 0x24 - /* SAS negotiated link rates. */ #define LEAPRAID_SAS_NEG_LINK_RATE_MASK_PHYSICAL 0x0F #define LEAPRAID_SAS_NEG_LINK_RATE_UNKNOWN_LINK_RATE 0x00 @@ -290,8 +277,6 @@ #define LEAPRAID_TM_MSGFLAGS_LINK_RESET 0x00 #define LEAPRAID_TM_RSP_INVALID_FRAME 0x02 -#define LEAPRAID_TM_RSP_TM_SUCCEEDED 0x08 -#define LEAPRAID_TM_RSP_IO_QUEUED_ON_ADAPTER 0x80 /* SCSI enclosure processor request defines. */ #define LEAPRAID_SEP_REQ_ACT_WRITE_STATUS 0x00 @@ -301,8 +286,6 @@ /* The capabilities of the adapter. */ #define LEAPRAID_ADAPTER_FEATURES_CAP_ATOMIC_REQ 0x00080000 -#define LEAPRAID_ADAPTER_FEATURES_CAP_RDPQ_ARRAY_CAPABLE 0x00040000 -#define LEAPRAID_ADAPTER_FEATURES_CAP_EVENT_REPLAY 0x00002000 #define LEAPRAID_ADAPTER_FEATURES_CAP_INTEGRATED_RAID 0x00001000 /* Event code definitions for the firmware. */ @@ -338,10 +321,6 @@ #define LEAPRAID_EVT_SAS_TOPO_RC_TARG_ADDED 0x01 #define LEAPRAID_EVT_SAS_TOPO_RC_TARG_NOT_RESPONDING 0x02 -/* SAS discovery event defines. */ -#define LEAPRAID_EVT_SAS_DISC_RC_STARTED 0x01 -#define LEAPRAID_EVT_SAS_DISC_RC_COMPLETED 0x02 - /* Enclosure device status change event. */ #define LEAPRAID_EVT_SAS_ENCL_RC_ADDED 0x01 #define LEAPRAID_EVT_SAS_ENCL_RC_NOT_RESPONDING 0x02 diff --git a/drivers/scsi/leapraid/leapraid_app.c b/drivers/scsi/leapraid/leapraid_app.c index 25ec57c2ce4b..8ee57865adca 100644 --- a/drivers/scsi/leapraid/leapraid_app.c +++ b/drivers/scsi/leapraid/leapraid_app.c @@ -388,6 +388,7 @@ static int leapraid_ctl_do_command(struct leapraid_adapter *adapter, dev_err(&adapter->pdev->dev, "%s: ctl_cmd timeout, status=0x%x\n", __func__, adapter->driver_cmds.ctl_cmd.status); + leapraid_log_req_context(adapter, taskid, ctl_sp_mpi_req); } if ((leap_mpi_req->func == LEAPRAID_FUNC_SMP_PASSTHROUGH || @@ -590,7 +591,7 @@ static int leapraid_ctl_ioctl_main(struct file *file, unsigned int cmd, break; } - if (karg.hdr.adapter_id != ioctl_header.adapter_id) { + if (karg.hdr.adapter_id != ioctl_header.adapter_id) { rc = -EINVAL; break; } @@ -621,11 +622,6 @@ static int leapraid_ctl_ioctl_main(struct file *file, unsigned int cmd, return rc; } -static long bad_ioctl(struct file *file, unsigned int cmd, unsigned long arg) -{ - return -ENOTTY; -} - static long leapraid_ctl_ioctl(struct file *file, unsigned int cmd, unsigned long arg) { @@ -679,7 +675,6 @@ static const struct file_operations leapraid_ctl_fops = { .owner = THIS_MODULE, .unlocked_ioctl = leapraid_ctl_ioctl, .mmap = leapraid_fw_mmap, - .compat_ioctl = bad_ioctl, }; static struct miscdevice leapraid_ctl_dev = { diff --git a/drivers/scsi/leapraid/leapraid_func.c b/drivers/scsi/leapraid/leapraid_func.c index 01096664d122..aa97369a7aca 100644 --- a/drivers/scsi/leapraid/leapraid_func.c +++ b/drivers/scsi/leapraid/leapraid_func.c @@ -43,6 +43,17 @@ static bool leapraid_should_skip_poll_work(struct leapraid_adapter *adapter); static int leapraid_make_adapter_ready(struct leapraid_adapter *adapter, enum reset_type type); +static noinline bool leapraid_shost_in_recovery(struct Scsi_Host *shost) +{ + enum scsi_host_state state; + + state = READ_ONCE(shost->shost_state); + return state == SHOST_RECOVERY || + state == SHOST_CANCEL_RECOVERY || + state == SHOST_DEL_RECOVERY || + shost->tmf_in_progress; +} + static void leapraid_debug_log_info(struct leapraid_adapter *adapter) { struct leapraid_reg_base __iomem *iomem_base = adapter->iomem_base; @@ -77,6 +88,7 @@ static void leapraid_debug_log_info(struct leapraid_adapter *adapter) debug_log[i + 2], debug_log[i + 3]); } + static inline bool leapraid_is_end_dev(u32 dev_type) { return (dev_type & LEAPRAID_DEVTYP_END_DEV) && @@ -167,7 +179,6 @@ static void leapraid_overheat_suspend(struct leapraid_adapter *adapter) pdev = adapter->pdev; shost = pci_get_drvdata(pdev); - if (!shost) { dev_warn(&pdev->dev, "Overheat suspend failed, invalid host or adapter\n"); @@ -1933,7 +1944,7 @@ static const char *leapraid_tm_type_name(u8 task_type) } } -void leapraid_log_req_context(struct leapraid_adapter *adapter, +void leapraid_log_req_context(struct leapraid_adapter *adapter, u16 smid, const void *req_data) { const struct leapraid_req *req = req_data; @@ -1946,8 +1957,8 @@ void leapraid_log_req_context(struct leapraid_adapter *adapter, const struct leapraid_cfg_req *cfg_req = req_data; dev_err(&adapter->pdev->dev, - "cfg-req: func=0x%02x(%s) act=0x%02x(%s)\n", - req->func, leapraid_func_name(req->func), + "cfg-req: smid=%u func=0x%02x(%s) action=0x%02x(%s)\n", + smid, req->func, leapraid_func_name(req->func), cfg_req->action, leapraid_cfg_action_name(cfg_req->action)); dev_err(&adapter->pdev->dev, @@ -1969,12 +1980,12 @@ void leapraid_log_req_context(struct leapraid_adapter *adapter, const struct leapraid_scsi_tm_req *tm_req = req_data; dev_err(&adapter->pdev->dev, - "scsi_tm: func=0x%02x(%s) task=0x%02x(%s)\n", - req->func, leapraid_func_name(req->func), + "scsi_tm:: smid=%u func=0x%02x(%s) task=0x%02x(%s)\n", + smid, req->func, leapraid_func_name(req->func), tm_req->task_type, leapraid_tm_type_name(tm_req->task_type)); dev_err(&adapter->pdev->dev, - "scsi_tm: dev_hdl=0x%04x task_mid=%u\n", + "scsi_tm:: dev_hdl=0x%04x task_mid=%u\n", le16_to_cpu(tm_req->dev_hdl), le16_to_cpu(tm_req->task_mid)); break; @@ -1983,8 +1994,8 @@ void leapraid_log_req_context(struct leapraid_adapter *adapter, const struct leapraid_sep_req *sep_req = req_data; dev_err(&adapter->pdev->dev, - "sep: func=0x%02x(%s) act=0x%02x(%s)\n", - req->func, leapraid_func_name(req->func), + "sep: smid=%u func=0x%02x(%s) action=0x%02x(%s)\n", + smid, req->func, leapraid_func_name(req->func), sep_req->act, leapraid_sep_action_name(sep_req->act)); dev_err(&adapter->pdev->dev, @@ -1998,11 +2009,11 @@ void leapraid_log_req_context(struct leapraid_adapter *adapter, const struct leapraid_io_unit_ctrl_req *io_req = req_data; dev_err(&adapter->pdev->dev, - "timestamp sync: func=0x%02x(%s) op=0x%02x(%s)\n", - req->func, leapraid_func_name(req->func), + "ctl_cmd: smid=%u func=0x%02x(%s) action=0x%02x(%s)\n", + smid, req->func, leapraid_func_name(req->func), io_req->op, leapraid_sas_op_name(io_req->op)); dev_err(&adapter->pdev->dev, - "timestamp sync: dev_hdl=0x%04x param=0x%02x(%s)\n", + "ctl_cmd: dev_hdl=0x%04x param=0x%02x(%s)\n", le16_to_cpu(io_req->dev_hdl), io_req->adapter_para, leapraid_io_param_name(io_req->adapter_para)); @@ -2012,18 +2023,21 @@ void leapraid_log_req_context(struct leapraid_adapter *adapter, const struct leapraid_smp_passthrough_req *smp_req = req_data; dev_err(&adapter->pdev->dev, - "transport: func=0x%02x(%s) port=%u req_len=%u\n", - req->func, leapraid_func_name(req->func), + "smp_cmd: smid=%u func=0x%02x(%s) action=0x%02x\n", + smid, req->func, leapraid_func_name(req->func), + smp_req->passthrough_flg); + dev_err(&adapter->pdev->dev, + "smp_cmd: port=%u req_len=%u\n", smp_req->physical_port, le16_to_cpu(smp_req->req_data_len)); - dev_err(&adapter->pdev->dev, "transport: sas_addr=0x%016llx\n", + dev_err(&adapter->pdev->dev, "smp_cmd: sas_addr=0x%016llx\n", (unsigned long long)le64_to_cpu(smp_req->sas_address)); break; } default: dev_err(&adapter->pdev->dev, - "%s: func=0x%02x(%s)\n", - __func__, req->func, leapraid_func_name(req->func)); + "cmd: smid=%u func=0x%02x(%s)\n", + smid, req->func, leapraid_func_name(req->func)); break; } } @@ -2034,19 +2048,18 @@ static void leapraid_build_and_fire_cfg_req( struct leapraid_cfg_rep *leap_mpi_cfgp_rep) { struct leapraid_cfg_req *local_leap_cfg_req; + u16 smid; memset(leap_mpi_cfgp_rep, 0, sizeof(struct leapraid_cfg_rep)); memset(&adapter->driver_cmds.cfg_op_cmd.reply, 0, sizeof(struct leapraid_cfg_rep)); adapter->driver_cmds.cfg_op_cmd.status = LEAPRAID_CMD_PENDING; - local_leap_cfg_req = leapraid_get_task_desc( - adapter, - adapter->driver_cmds.cfg_op_cmd.inter_taskid); + smid = adapter->driver_cmds.cfg_op_cmd.inter_taskid; + local_leap_cfg_req = leapraid_get_task_desc(adapter, smid); memcpy(local_leap_cfg_req, leap_mpi_cfgp_req, sizeof(struct leapraid_cfg_req)); init_completion(&adapter->driver_cmds.cfg_op_cmd.done); - leapraid_fire_task(adapter, - adapter->driver_cmds.cfg_op_cmd.inter_taskid); + leapraid_fire_task(adapter, smid); wait_for_completion_timeout(&adapter->driver_cmds.cfg_op_cmd.done, LEAPRAID_CFG_OP_TIMEOUT * HZ); } @@ -2059,11 +2072,13 @@ static int leapraid_req_cfg_func(struct leapraid_adapter *adapter, { u32 adapter_status = UINT_MAX; bool issue_reset = false; + u16 smid; u8 retry_cnt; int rc; retry_cnt = 0; mutex_lock(&adapter->driver_cmds.cfg_op_cmd.mutex); + smid = adapter->driver_cmds.cfg_op_cmd.inter_taskid; retry: if (retry_cnt) { if (retry_cnt > LEAPRAID_CFG_REQ_RETRY_TIMES) { @@ -2100,14 +2115,16 @@ static int leapraid_req_cfg_func(struct leapraid_adapter *adapter, adapter->access_ctrl.shost_recovering ? "shost recovery" : "pcie recovery", adapter->driver_cmds.cfg_op_cmd.status); - leapraid_log_req_context(adapter, leap_mpi_cfgp_req); + leapraid_log_req_context(adapter, smid, + leap_mpi_cfgp_req); issue_reset = false; rc = -EFAULT; } else { dev_err(&adapter->pdev->dev, "cfg-req: timeout, status=0x%x, reset\n", adapter->driver_cmds.cfg_op_cmd.status); - leapraid_log_req_context(adapter, leap_mpi_cfgp_req); + leapraid_log_req_context(adapter, smid, + leap_mpi_cfgp_req); issue_reset = true; } @@ -2147,7 +2164,7 @@ static int leapraid_req_cfg_func(struct leapraid_adapter *adapter, mutex_unlock(&adapter->driver_cmds.cfg_op_cmd.mutex); if (issue_reset) { if (adapter->scan_dev_desc.first_scan_dev_fired) { - dev_info(&adapter->pdev->dev, + dev_warn(&adapter->pdev->dev, "%s:%d cfg-req: Failure, issuing reset\n", __func__, __LINE__); leapraid_hard_reset_handler(adapter, FULL_RESET); @@ -2418,14 +2435,12 @@ static int leapraid_cfg_find_vol_in_page( u16 phys_hdl; phys_hdl = le16_to_cpu(elem->phys_disk_dev_hdl); - if (phys_hdl == pd_hdl) { *vol_hdl = le16_to_cpu(elem->vol_dev_hdl); return 0; } break; } - case LEAPRAID_RAIDCFG_P0_EFLG_HOT_SPARE_ELEMENT: *vol_hdl = 0; return 0; @@ -2592,7 +2607,6 @@ static int leapraid_cfg_get_number_pds(struct leapraid_adapter *adapter, cfgp2.handle = hdl; rc = leapraid_op_config_page(adapter, &raidvol_p0, cfgp1, cfgp2, GET_RAID_VOLUME_PG0); - if (!rc) *num_pds = raidvol_p0.num_phys_disks; @@ -2812,13 +2826,12 @@ static void leapraid_timestamp_sync(struct leapraid_adapter *adapter) ktime_t current_time; bool issue_reset = false; u64 time_stamp; + u16 smid; mutex_lock(&adapter->driver_cmds.timestamp_sync_cmd.mutex); adapter->driver_cmds.timestamp_sync_cmd.status = LEAPRAID_CMD_PENDING; - io_unit_ctrl_req = - leapraid_get_task_desc( - adapter, - adapter->driver_cmds.timestamp_sync_cmd.inter_taskid); + smid = adapter->driver_cmds.timestamp_sync_cmd.inter_taskid; + io_unit_ctrl_req = leapraid_get_task_desc(adapter, smid); memset(io_unit_ctrl_req, 0, sizeof(struct leapraid_io_unit_ctrl_req)); io_unit_ctrl_req->func = LEAPRAID_FUNC_SAS_IO_UNIT_CTRL; io_unit_ctrl_req->op = LEAPRAID_SAS_OP_SET_PARAMETER; @@ -2832,9 +2845,7 @@ static void leapraid_timestamp_sync(struct leapraid_adapter *adapter) io_unit_ctrl_req->adapter_para_value2 = cpu_to_le32(time_stamp >> 32); init_completion(&adapter->driver_cmds.timestamp_sync_cmd.done); - leapraid_fire_task( - adapter, - adapter->driver_cmds.timestamp_sync_cmd.inter_taskid); + leapraid_fire_task(adapter, smid); leapraid_debug_log_info(adapter); wait_for_completion_timeout(&adapter->driver_cmds .timestamp_sync_cmd.done, @@ -2845,7 +2856,7 @@ static void leapraid_timestamp_sync(struct leapraid_adapter *adapter) "%s: timestamp sync timeout, status=0x%x\n", __func__, adapter->driver_cmds.timestamp_sync_cmd.status); - leapraid_log_req_context(adapter, io_unit_ctrl_req); + leapraid_log_req_context(adapter, smid, io_unit_ctrl_req); issue_reset = leapraid_check_reset( adapter->driver_cmds.timestamp_sync_cmd.status); @@ -2876,15 +2887,16 @@ static void leapraid_check_scheduled_fault_work(struct work_struct *work) adapter_state = leapraid_get_adapter_state(adapter); if (adapter_state != LEAPRAID_DB_OPERATIONAL) { - dev_info(&adapter->pdev->dev, "%s:%d: call hard_reset\n", - __func__, __LINE__); + dev_info(&adapter->pdev->dev, "%s:%d: call hard_reset 0x%x\n", + __func__, __LINE__, adapter_state); rc = leapraid_hard_reset_handler(adapter, FULL_RESET); - dev_warn(&adapter->pdev->dev, "%s: Hard reset %s\n", - __func__, rc == 0 ? "success" : "failed"); - adapter_state = leapraid_get_adapter_state(adapter); - if (rc && adapter_state != LEAPRAID_DB_OPERATIONAL) + if (rc && adapter_state != LEAPRAID_DB_OPERATIONAL) { + dev_err(&adapter->pdev->dev, + "%s: Hard reset failed, state=0x%x rc=%d\n", + __func__, adapter_state, rc); return; + } } if (++adapter->timestamp_sync_cnt >= @@ -3247,7 +3259,6 @@ void leapraid_smart_polling_stop(struct leapraid_adapter *adapter) wq = desc->smart_poll_wq; desc->smart_poll_wq = NULL; - if (wq) { if (!cancel_delayed_work_sync(&desc->smart_poll_work)) flush_workqueue(wq); @@ -3289,7 +3300,6 @@ static void leapraid_overheat_work(struct work_struct *work) adapter->scan_dev_desc.scan_start = 0; adapter->scan_dev_desc.wait_scan_dev_done = 0; adapter->scan_dev_desc.driver_loading = 0; - wake_up(&adapter->access_ctrl.recovery_waitq); wake_up(&adapter->access_ctrl.shost_recover_wq); wake_up(&adapter->scan_dev_desc.wait_driver_loading); @@ -3378,10 +3388,10 @@ static struct leapraid_fw_evt_work *leapraid_alloc_fw_evt_work(void) { struct leapraid_fw_evt_work *fw_evt = kzalloc(sizeof(*fw_evt), GFP_ATOMIC); - if (!fw_evt) - return NULL; - kref_init(&fw_evt->refcnt); + if (fw_evt) + kref_init(&fw_evt->refcnt); + return fw_evt; } @@ -3452,7 +3462,6 @@ void leapraid_clean_active_fw_evt(struct leapraid_adapter *adapter) return; adapter->fw_evt_s.fw_evt_cleanup = 1; - wake_up(&adapter->access_ctrl.recovery_waitq); if (adapter->access_ctrl.shost_recovering && adapter->fw_evt_s.cur_evt) adapter->fw_evt_s.cur_evt->ignore = 1; @@ -4367,7 +4376,7 @@ void leapraid_exp_rm(struct leapraid_adapter *adapter, u64 sas_addr, leapraid_exp_node_rm(adapter, topo_node_exp); } -static int leapraid_internal_sas_topo_chg_evt( +static void leapraid_internal_sas_topo_chg_evt( struct leapraid_adapter *adapter, struct leapraid_card_port *card_port, struct leapraid_topo_node *topo_node_exp, @@ -4384,11 +4393,11 @@ static int leapraid_internal_sas_topo_chg_evt( evt_data = fw_evt->evt_data; for (i = 0; i < evt_data->entry_num; i++) { if (fw_evt->ignore) - return 0; + return; if (adapter->access_ctrl.host_removing || adapter->access_ctrl.pcie_recovering) - return 0; + return; phy_number = evt_data->start_phy_num + i; if (phy_number >= max_phys) @@ -4426,12 +4435,10 @@ static int leapraid_internal_sas_topo_chg_evt( if (evt_data->exp_status == LEAPRAID_EVT_SAS_TOPO_ES_NOT_RESPONDING && topo_node_exp) leapraid_exp_rm(adapter, sas_addr, card_port); - - return 0; } -static int leapraid_sas_topo_chg_evt(struct leapraid_adapter *adapter, - struct leapraid_fw_evt_work *fw_evt) +static void leapraid_sas_topo_chg_evt(struct leapraid_adapter *adapter, + struct leapraid_fw_evt_work *fw_evt) { struct leapraid_topo_node *topo_node_exp; struct leapraid_card_port *card_port; @@ -4444,13 +4451,13 @@ static int leapraid_sas_topo_chg_evt(struct leapraid_adapter *adapter, if (adapter->access_ctrl.shost_recovering || adapter->access_ctrl.host_removing || adapter->access_ctrl.pcie_recovering) - return 0; + return; evt_data = fw_evt->evt_data; leapraid_sas_host_add(adapter, adapter->dev_topo.card.phys_num > 0); if (fw_evt->ignore) - return 0; + return; phdl = le16_to_cpu(evt_data->exp_dev_hdl); card_port = leapraid_get_port_by_id(adapter, @@ -4458,7 +4465,7 @@ static int leapraid_sas_topo_chg_evt(struct leapraid_adapter *adapter, false); if (evt_data->exp_status == LEAPRAID_EVT_SAS_TOPO_ES_ADDED && leapraid_exp_add(adapter, phdl) != 0) - return 0; + return; spin_lock_irqsave(&adapter->dev_topo.topo_node_lock, flags); topo_node_exp = leapraid_exp_find_by_hdl(adapter, phdl); @@ -4472,13 +4479,13 @@ static int leapraid_sas_topo_chg_evt(struct leapraid_adapter *adapter, } else { spin_unlock_irqrestore(&adapter->dev_topo.topo_node_lock, flags); - return 0; + return; } spin_unlock_irqrestore(&adapter->dev_topo.topo_node_lock, flags); - return leapraid_internal_sas_topo_chg_evt(adapter, card_port, - topo_node_exp, fw_evt, - sas_addr, max_phys); + leapraid_internal_sas_topo_chg_evt(adapter, card_port, + topo_node_exp, fw_evt, + sas_addr, max_phys); } static void leapraid_reprobe_lun(struct scsi_device *sdev, void *no_uld_attach) @@ -4588,7 +4595,6 @@ static void leapraid_sas_pd_hide( } spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); if (starget) { - dev_info(&adapter->pdev->dev, "hide sas_dev, hdl=0x%x\n", hdl); starget_for_each_device(starget, (void *)LEAPRAID_NO_ULD_ATTACH_FLAG, leapraid_reprobe_lun); @@ -4608,7 +4614,6 @@ static void leapraid_sas_pd_expose( u16 hdl; hdl = le16_to_cpu(evt_data->phys_disk_dev_hdl); - if (!hdl || hdl > adapter->adapter_attr.features.max_dev_handle) { dev_warn(&adapter->pdev->dev, "%s: Invalid device handle\n", __func__); @@ -4637,8 +4642,6 @@ static void leapraid_sas_pd_expose( spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); if (starget) { - dev_info(&adapter->pdev->dev, - "expose sas_dev, hdl=0x%x\n", hdl); starget_for_each_device(starget, LEAPRAID_ULD_ATTACH_FLAG, leapraid_reprobe_lun); @@ -4971,7 +4974,7 @@ static void leapraid_remove_unresp_sas_end_dev( leapraid_sdev_put(sas_dev); } - dev_info(&adapter->pdev->dev, + dev_warn(&adapter->pdev->dev, "Unresponsive SAS end devices removed\n"); } @@ -4996,7 +4999,7 @@ static void leapraid_remove_unresp_raid_volumes( leapraid_sas_volume_delete_by_ptr(adapter, raid_volume); } - dev_info(&adapter->pdev->dev, + dev_warn(&adapter->pdev->dev, "Unresponsive RAID volumes removed\n"); } @@ -5020,7 +5023,7 @@ static void leapraid_remove_unresp_sas_exp(struct leapraid_adapter *adapter) &head, list) leapraid_exp_node_rm(adapter, topo_node_exp); - dev_info(&adapter->pdev->dev, + dev_warn(&adapter->pdev->dev, "Unresponsive SAS expanders removed\n"); } @@ -5138,8 +5141,6 @@ static void leapraid_scan_exp_after_reset(struct leapraid_adapter *adapter) u16 hdl; u8 port_id; - dev_info(&adapter->pdev->dev, "Begin scanning expanders\n"); - cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (hdl = 0xFFFF, cfgp2.handle = hdl; !leapraid_op_config_page(adapter, &exp_p0, cfgp1, cfgp2, @@ -5170,8 +5171,6 @@ static void leapraid_scan_exp_after_reset(struct leapraid_adapter *adapter) exp_p0.sas_address)); } } - - dev_info(&adapter->pdev->dev, "Expanders scan complete\n"); } static void leapraid_scan_phy_disks_after_reset( @@ -5188,8 +5187,6 @@ static void leapraid_scan_phy_disks_after_reset( u16 hdl, parent_hdl; u64 sas_addr; - dev_info(&adapter->pdev->dev, "Begin scanning phys disk\n"); - cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (phys_disk_num = 0xFF, cfgp2.form_specific = phys_disk_num; !leapraid_op_config_page(adapter, &raidpd_p0, @@ -5238,8 +5235,6 @@ static void leapraid_scan_phy_disks_after_reset( } } } - - dev_info(&adapter->pdev->dev, "PHYs disk scan complete\n"); } static void leapraid_scan_vol_after_reset(struct leapraid_adapter *adapter) @@ -5264,7 +5259,6 @@ static void leapraid_scan_vol_after_reset(struct leapraid_adapter *adapter) return; } - dev_info(&adapter->pdev->dev, "Begin scanning volumes\n"); cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (hdl = 0xFFFF, cfgp2.handle = hdl; !leapraid_op_config_page(adapter, vol_p1, cfgp1, @@ -5301,8 +5295,6 @@ static void leapraid_scan_vol_after_reset(struct leapraid_adapter *adapter) kfree(vol_p0); kfree(vol_p1); - - dev_info(&adapter->pdev->dev, "Volumes scan complete\n"); } static void leapraid_scan_sas_dev_after_reset(struct leapraid_adapter *adapter) @@ -5315,9 +5307,6 @@ static void leapraid_scan_sas_dev_after_reset(struct leapraid_adapter *adapter) u64 sas_address; u8 port_id; - dev_info(&adapter->pdev->dev, - "Begin scanning SAS end devices\n"); - cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (hdl = 0xFFFF, cfgp2.handle = hdl; !leapraid_op_config_page(adapter, &sas_dev_p0, cfgp1, cfgp2, @@ -5367,14 +5356,10 @@ static void leapraid_scan_sas_dev_after_reset(struct leapraid_adapter *adapter) sas_dev_p0.sas_address)); } } - - dev_info(&adapter->pdev->dev, "SAS end devices scan complete\n"); } static void leapraid_scan_all_dev_after_reset(struct leapraid_adapter *adapter) { - dev_info(&adapter->pdev->dev, "Begin scanning devices\n"); - leapraid_sas_host_add(adapter, adapter->dev_topo.card.phys_num > 0); leapraid_scan_exp_after_reset(adapter); if (adapter->adapter_attr.raid_support) { @@ -5382,8 +5367,6 @@ static void leapraid_scan_all_dev_after_reset(struct leapraid_adapter *adapter) leapraid_scan_vol_after_reset(adapter); } leapraid_scan_sas_dev_after_reset(adapter); - - dev_info(&adapter->pdev->dev, "Devices scan complete\n"); } static void leapraid_hardreset_async_logic(struct leapraid_adapter *adapter) @@ -5411,6 +5394,7 @@ static int leapraid_send_enc_cmd(struct leapraid_adapter *adapter, void *req; bool reset_flg = false; int rc; + u16 smid; mutex_lock(&adapter->driver_cmds.enc_cmd.mutex); rc = leapraid_check_adapter_is_op(adapter, LEAPRAID_DB_WAIT_OP_SHORT, @@ -5419,21 +5403,19 @@ static int leapraid_send_enc_cmd(struct leapraid_adapter *adapter, goto unlock; adapter->driver_cmds.enc_cmd.status = LEAPRAID_CMD_PENDING; - req = leapraid_get_task_desc( - adapter, - adapter->driver_cmds.enc_cmd.inter_taskid); + smid = adapter->driver_cmds.enc_cmd.inter_taskid; + req = leapraid_get_task_desc(adapter, smid); memset(req, 0, LEAPRAID_REQUEST_SIZE); memcpy(req, sep_req, sizeof(struct leapraid_sep_req)); init_completion(&adapter->driver_cmds.enc_cmd.done); - leapraid_fire_task(adapter, - adapter->driver_cmds.enc_cmd.inter_taskid); + leapraid_fire_task(adapter, smid); wait_for_completion_timeout(&adapter->driver_cmds.enc_cmd.done, LEAPRAID_ENC_CMD_TIMEOUT * HZ); if (!(adapter->driver_cmds.enc_cmd.status & LEAPRAID_CMD_DONE)) { dev_err(&adapter->pdev->dev, "%s: SEP command timeout, status=0x%x\n", __func__, adapter->driver_cmds.enc_cmd.status); - leapraid_log_req_context(adapter, sep_req); + leapraid_log_req_context(adapter, smid, sep_req); reset_flg = leapraid_check_reset( adapter->driver_cmds.enc_cmd.status); @@ -5497,10 +5479,10 @@ static int leapraid_wait_adapter_recovery(struct leapraid_adapter *adapter) { unsigned long flags; - while (scsi_host_in_recovery(adapter->shost) || - adapter->access_ctrl.shost_recovering) { - if (adapter->access_ctrl.host_removing || - adapter->fw_evt_s.fw_evt_cleanup) { + while (leapraid_shost_in_recovery(adapter->shost) || + READ_ONCE(adapter->access_ctrl.shost_recovering)) { + if (READ_ONCE(adapter->access_ctrl.host_removing) || + READ_ONCE(adapter->fw_evt_s.fw_evt_cleanup)) { spin_lock_irqsave( &adapter->reset_desc.adapter_reset_lock, flags); @@ -5520,12 +5502,13 @@ static int leapraid_wait_adapter_recovery(struct leapraid_adapter *adapter) return -EFAULT; } - wait_event_timeout(adapter->access_ctrl.recovery_waitq, - !adapter->access_ctrl.shost_recovering || - adapter->access_ctrl.host_removing || - adapter->fw_evt_s.fw_evt_cleanup, - msecs_to_jiffies(1000)); + wait_event_timeout( + adapter->access_ctrl.recovery_waitq, + (!leapraid_shost_in_recovery(adapter->shost) && + !READ_ONCE(adapter->access_ctrl.shost_recovering)), + msecs_to_jiffies(1000)); } + return 0; } @@ -5610,7 +5593,6 @@ static void leapraid_sas_dev_stat_chg_evt( leapraid_get_port_by_id(adapter, event_data->physical_port, false)); - if (!sas_dev || !sas_dev->starget) goto out_unlock; @@ -5880,9 +5862,9 @@ static void leapraid_scan_dev_complete(struct leapraid_adapter *adapter) leapraid_fw_evt_put(fw_evt); } -static u8 leapraid_handle_scan_cb(struct leapraid_adapter *adapter, - struct leapraid_driver_cmd *cmd, - struct leapraid_rep *rep) +static void leapraid_handle_scan_cb(struct leapraid_adapter *adapter, + struct leapraid_driver_cmd *cmd, + struct leapraid_rep *rep) { u16 status; @@ -5890,21 +5872,18 @@ static u8 leapraid_handle_scan_cb(struct leapraid_adapter *adapter, status = le16_to_cpu(rep->adapter_status) & LEAPRAID_ADAPTER_STATUS_MASK; - if (status != LEAPRAID_ADAPTER_STATUS_SUCCESS) adapter->scan_dev_desc.scan_dev_failed = 1; if (!cmd->async_scan_dev) { complete(&cmd->done); - return 1; + return; } if (status == LEAPRAID_ADAPTER_STATUS_SUCCESS) leapraid_scan_dev_complete(adapter); else adapter->scan_dev_desc.scan_start_failed = status; - - return 1; } static void leapraid_handle_ctl_cb(struct leapraid_adapter *adapter, @@ -5918,7 +5897,6 @@ static void leapraid_handle_ctl_cb(struct leapraid_adapter *adapter, return; scsiio_reply = (struct leapraid_scsiio_rep *)rep; - if (!(scsiio_reply->scsi_state & LEAPRAID_SCSI_STATE_AUTOSENSE_VALID)) return; @@ -5961,10 +5939,11 @@ static bool leapraid_driver_cmds_done(struct leapraid_adapter *adapter, memcpy(&_sp_cmd->reply, leap_mpi_rep, reply_len); _sp_cmd->status |= LEAPRAID_CMD_REPLY_VALID; - if (_sp_cmd->cb_idx == LEAPRAID_SCAN_DEV_CB_IDX) - return leapraid_handle_scan_cb(adapter, - _sp_cmd, - leap_mpi_rep); + if (_sp_cmd->cb_idx == LEAPRAID_SCAN_DEV_CB_IDX) { + leapraid_handle_scan_cb(adapter, _sp_cmd, + leap_mpi_rep); + return true; + } if (_sp_cmd->cb_idx == LEAPRAID_CTL_CB_IDX) leapraid_handle_ctl_cb(adapter, leap_mpi_rep, taskid); @@ -6230,7 +6209,6 @@ static int leapraid_host_diag_reset(struct leapraid_adapter *adapter) { u32 host_diag; - dev_info(&adapter->pdev->dev, "Entering host diag reset!\n"); pci_cfg_access_lock(adapter->pdev); mutex_lock(&adapter->reset_desc.host_diag_mutex); @@ -6254,14 +6232,13 @@ static int leapraid_host_diag_reset(struct leapraid_adapter *adapter) goto out_failed; pci_cfg_access_unlock(adapter->pdev); - dev_info(&adapter->pdev->dev, "Host diag success!\n"); return 0; out_cleanup: mutex_unlock(&adapter->reset_desc.host_diag_mutex); out_failed: pci_cfg_access_unlock(adapter->pdev); - dev_info(&adapter->pdev->dev, "Host diag failed!\n"); + dev_err(&adapter->pdev->dev, "Host diag failed\n"); return -EFAULT; } @@ -6776,11 +6753,8 @@ static void leapraid_search_resp_sas_dev(struct leapraid_adapter *adapter) struct leapraid_sas_dev_p0 sas_dev_p0; u32 device_info; - dev_info(&adapter->pdev->dev, - "Begin searching for SAS end devices\n"); - if (list_empty(&adapter->dev_topo.sas_dev_list)) - goto exit_search; + return; cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (cfgp2.handle = 0xFFFF; @@ -6793,9 +6767,6 @@ static void leapraid_search_resp_sas_dev(struct leapraid_adapter *adapter) leapraid_mark_resp_sas_dev(adapter, &sas_dev_p0); } -exit_search: - dev_info(&adapter->pdev->dev, - "SAS end devices searching complete\n"); } static void leapraid_mark_resp_raid_volume(struct leapraid_adapter *adapter, @@ -6864,14 +6835,11 @@ static void leapraid_search_resp_raid_volume(struct leapraid_adapter *adapter) if (!adapter->adapter_attr.raid_support) return; - dev_info(&adapter->pdev->dev, - "Begin searching for RAID volumes\n"); - spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); is_empty = list_empty(&adapter->dev_topo.raid_volume_list); spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); if (is_empty) - goto exit_search; + return; cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (hdl = 0xFFFF, cfgp2.handle = hdl; @@ -6909,9 +6877,6 @@ static void leapraid_search_resp_raid_volume(struct leapraid_adapter *adapter) else set_bit(hdl, adapter->dev_topo.pd_hdls); } -exit_search: - dev_info(&adapter->pdev->dev, - "RAID volumes searching complete\n"); } static void leapraid_mark_resp_exp(struct leapraid_adapter *adapter, @@ -6972,10 +6937,8 @@ static void leapraid_search_resp_exp(struct leapraid_adapter *adapter) u16 hdl; u8 port; - dev_dbg(&adapter->pdev->dev, - "Begin searching for expanders\n"); if (list_empty(&adapter->dev_topo.exp_list)) - goto exit_search; + return; cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (hdl = 0xFFFF, cfgp2.handle = hdl; @@ -6993,9 +6956,6 @@ static void leapraid_search_resp_exp(struct leapraid_adapter *adapter) LEAPRAID_DISABLE_MP_PORT_ID); leapraid_mark_resp_exp(adapter, &exp_p0); } -exit_search: - dev_dbg(&adapter->pdev->dev, - "Expander searching complete\n"); } void leapraid_wait_cmds_done(struct leapraid_adapter *adapter) @@ -7084,7 +7044,6 @@ int leapraid_hard_reset_handler(struct leapraid_adapter *adapter, dev_err(&adapter->pdev->dev, "Previous device scan failed or driver loading\n"); adapter->access_ctrl.host_removing = 1; - wake_up(&adapter->access_ctrl.recovery_waitq); rc = -EFAULT; goto out_cleanup; } @@ -7105,8 +7064,8 @@ int leapraid_hard_reset_handler(struct leapraid_adapter *adapter, leapraid_hardreset_barrier(adapter); } out_cleanup: - dev_info(&adapter->pdev->dev, "Hard reset %s\n", - rc == 0 ? "SUCCESS" : "FAILED"); + if (rc) + dev_err(&adapter->pdev->dev, "Hard reset failed\n"); spin_lock_irqsave(&adapter->reset_desc.adapter_reset_lock, flags); adapter->reset_desc.adapter_reset_results = rc; @@ -7345,8 +7304,8 @@ static void leapraid_map_msix_to_cpu(struct leapraid_adapter *adapter) { struct leapraid_int_rq *int_rq; const cpumask_t *affinity_mask; + int cpu; u32 i; - u16 cpu; if (!adapter->adapter_attr.rq_cnt) return; @@ -7370,6 +7329,7 @@ static void leapraid_map_msix_to_cpu(struct leapraid_adapter *adapter) int_rq->rq.msix_idx; } } + return; out_apply_irq_affinity: leapraid_cpus_on_irq(adapter); } @@ -7432,7 +7392,6 @@ static int leapraid_setup_irqs(struct leapraid_adapter *adapter) adapter->notification_desc.iopoll_qdex, adapter->notification_desc.iopoll_qdex, PCI_IRQ_MSIX | PCI_IRQ_AFFINITY, NULL); - if (rc < 0) { dev_err(&adapter->pdev->dev, "%d MSI/MSIX vectors allocated failed!\n", @@ -7465,7 +7424,6 @@ static int leapraid_setup_irqs(struct leapraid_adapter *adapter) IRQF_SHARED, adapter->notification_desc.int_rqs[i].rq.name, &adapter->notification_desc.int_rqs[i].rq); - if (rc) { dev_err(&adapter->pdev->dev, "MSI/MSIx: request_irq %s failed!\n", @@ -7523,8 +7481,6 @@ static int leapraid_setup_legacy_int(struct leapraid_adapter *adapter) static int leapraid_set_legacy_int(struct leapraid_adapter *adapter) { - int rc; - adapter->notification_desc.msix_cpu_map_sz = num_online_cpus(); adapter->notification_desc.msix_cpu_map = kzalloc(adapter->notification_desc.msix_cpu_map_sz, @@ -7547,9 +7503,7 @@ static int leapraid_set_legacy_int(struct leapraid_adapter *adapter) if (!adapter->notification_desc.int_rqs) return -ENOMEM; - rc = leapraid_setup_legacy_int(adapter); - - return rc; + return leapraid_setup_legacy_int(adapter); } static int leapraid_set_msix(struct leapraid_adapter *adapter) @@ -7650,9 +7604,7 @@ static int leapraid_set_msix(struct leapraid_adapter *adapter) return 0; apply_legacy_int: - rc = leapraid_set_legacy_int(adapter); - - return rc; + return leapraid_set_legacy_int(adapter); } static int leapraid_set_msi(struct leapraid_adapter *adapter) @@ -7774,9 +7726,7 @@ static int leapraid_set_msi(struct leapraid_adapter *adapter) return 0; apply_legacy_int: - rc = leapraid_set_legacy_int(adapter); - - return rc; + return leapraid_set_legacy_int(adapter); } static int leapraid_set_notification(struct leapraid_adapter *adapter) @@ -7859,18 +7809,16 @@ static int leapraid_adapter_unit_reset(struct leapraid_adapter *adapter) { int rc = 0; - dev_info(&adapter->pdev->dev, "fire unit reset\n"); writel(LEAPRAID_FUNC_ADAPTER_UNIT_RESET << LEAPRAID_DB_FUNC_SHIFT, &adapter->iomem_base->db); if (leapraid_db_wait_ack_and_clear_int(adapter)) rc = -EFAULT; if (!leapraid_wait_adapter_ready(adapter)) { - dev_info(&adapter->pdev->dev, "unit reset: FAILED\n"); + dev_err(&adapter->pdev->dev, "unit reset failed\n"); return -EFAULT; } - dev_info(&adapter->pdev->dev, "unit reset: SUCCESS\n"); return rc; } @@ -7878,7 +7826,6 @@ static int leapraid_make_adapter_ready(struct leapraid_adapter *adapter, enum reset_type type) { u32 db; - int rc; int count; if (!leapraid_pci_active(adapter)) @@ -7917,8 +7864,7 @@ static int leapraid_make_adapter_ready(struct leapraid_adapter *adapter, return 0; full_reset: - rc = leapraid_host_diag_reset(adapter); - return rc; + return leapraid_host_diag_reset(adapter); } static void leapraid_fw_log_exit(struct leapraid_adapter *adapter) @@ -8095,15 +8041,13 @@ int leapraid_internal_init_cmd_priv(struct leapraid_adapter *adapter, return 0; } -int leapraid_internal_exit_cmd_priv(struct leapraid_adapter *adapter, - struct leapraid_io_req_tracker *io_tracker) +void leapraid_internal_exit_cmd_priv(struct leapraid_adapter *adapter, + struct leapraid_io_req_tracker *io_tracker) { if (io_tracker && io_tracker->chain) dma_pool_free(adapter->mem_desc.sg_chain_pool, io_tracker->chain, io_tracker->chain_dma); - - return 0; } static int leapraid_request_host_memory(struct leapraid_adapter *adapter) @@ -8394,9 +8338,10 @@ static int leapraid_alloc_dev_topo_bitmaps(struct leapraid_adapter *adapter) { u16 pd_hdls_sz; - pd_hdls_sz = adapter->adapter_attr.features.max_dev_handle / - LEAPRAID_BITS_PER_BYTE; - pd_hdls_sz++; + pd_hdls_sz = + BITS_TO_LONGS( + adapter->adapter_attr.features.max_dev_handle + 1) * + sizeof(unsigned long); adapter->dev_topo.pd_hdls_sz = pd_hdls_sz; adapter->dev_topo.pd_hdls = @@ -8636,48 +8581,52 @@ static int leapraid_cfg_pages(struct leapraid_adapter *adapter) { union cfg_param_1 cfgp1 = {0}; union cfg_param_2 cfgp2 = {0}; - struct leapraid_manufacturing_p0 manufacturing_page0; - struct leapraid_bios_page3 bios_page3; - struct leapraid_bios_page2 bios_page2; + union { + struct leapraid_manufacturing_p0 manufacturing_page0; + struct leapraid_bios_page3 bios_page3; + struct leapraid_bios_page2 bios_page2; + } cfg_page; int rc; - rc = leapraid_op_config_page(adapter, &bios_page3, cfgp1, + rc = leapraid_op_config_page(adapter, &cfg_page.bios_page3, cfgp1, cfgp2, GET_BIOS_PG3); if (rc) return rc; - rc = leapraid_op_config_page(adapter, &bios_page2, cfgp1, - cfgp2, GET_BIOS_PG2); - if (rc) - return rc; + adapter->adapter_attr.bios_version = + le32_to_cpu(cfg_page.bios_page3.bios_version); - rc = leapraid_op_config_page(adapter, &manufacturing_page0, cfgp1, - cfgp2, GET_MANUFACTURING_PG0); + rc = leapraid_op_config_page(adapter, &cfg_page.bios_page2, cfgp1, + cfgp2, GET_BIOS_PG2); if (rc) return rc; - adapter->adapter_attr.bios_version = - le32_to_cpu(bios_page3.bios_version); - snprintf(adapter->adapter_attr.board_name, - sizeof(adapter->adapter_attr.board_name), - "%.*s", - (int)sizeof(manufacturing_page0.board_name), - manufacturing_page0.board_name); adapter->boot_devs.requested_boot_dev.form = - bios_page2.requested_boot_dev_form; + cfg_page.bios_page2.requested_boot_dev_form; memcpy(adapter->boot_devs.requested_boot_dev.pg_dev, - &bios_page2.requested_boot_dev, + &cfg_page.bios_page2.requested_boot_dev, LEAPRAID_BOOT_DEV_SIZE); adapter->boot_devs.requested_alt_boot_dev.form = - bios_page2.requested_alt_boot_dev_form; + cfg_page.bios_page2.requested_alt_boot_dev_form; memcpy(adapter->boot_devs.requested_alt_boot_dev.pg_dev, - &bios_page2.requested_alt_boot_dev, + &cfg_page.bios_page2.requested_alt_boot_dev, LEAPRAID_BOOT_DEV_SIZE); adapter->boot_devs.current_boot_dev.form = - bios_page2.current_boot_dev_form; + cfg_page.bios_page2.current_boot_dev_form; memcpy(adapter->boot_devs.current_boot_dev.pg_dev, - &bios_page2.current_boot_dev, + &cfg_page.bios_page2.current_boot_dev, LEAPRAID_BOOT_DEV_SIZE); + + rc = leapraid_op_config_page(adapter, &cfg_page.manufacturing_page0, + cfgp1, cfgp2, GET_MANUFACTURING_PG0); + if (rc) + return rc; + + snprintf(adapter->adapter_attr.board_name, + sizeof(adapter->adapter_attr.board_name), + "%.*s", + (int)sizeof(cfg_page.manufacturing_page0.board_name), + cfg_page.manufacturing_page0.board_name); return rc; } @@ -8786,8 +8735,6 @@ int leapraid_scan_dev(struct leapraid_adapter *adapter, bool async_scan_dev) out_cleanup: adapter->driver_cmds.scan_dev_cmd.status = LEAPRAID_CMD_NOT_USED; - dev_info(&adapter->pdev->dev, - "Device scan %s\n", rc == 0 ? "SUCCESS" : "FAILED"); return rc; } @@ -8936,11 +8883,7 @@ static int leapraid_make_adapter_available(struct leapraid_adapter *adapter) return 0; } - rc = leapraid_scan_dev(adapter, false); - if (rc) - return rc; - - return rc; + return leapraid_scan_dev(adapter, false); } int leapraid_ctrl_init(struct leapraid_adapter *adapter) @@ -9006,7 +8949,6 @@ int leapraid_ctrl_init(struct leapraid_adapter *adapter) out_free: adapter->access_ctrl.host_removing = 1; - wake_up(&adapter->access_ctrl.recovery_waitq); leapraid_fw_log_exit(adapter); leapraid_free_internal_scsi_cmd(adapter); leapraid_disable_controller(adapter); diff --git a/drivers/scsi/leapraid/leapraid_func.h b/drivers/scsi/leapraid/leapraid_func.h index 359802578586..5b66a8922661 100644 --- a/drivers/scsi/leapraid/leapraid_func.h +++ b/drivers/scsi/leapraid/leapraid_func.h @@ -50,11 +50,11 @@ #define LEAPRAID_BOARD_NAME_LENGTH 17 #define LEAPRAID_AUTHOR "LeapIO Inc." #define LEAPRAID_DESCRIPTION "LeapRAID Driver" -#define LEAPRAID_DRIVER_VERSION "2.00.01.02" +#define LEAPRAID_DRIVER_VERSION "2.00.01.05" #define LEAPRAID_MAJOR_VERSION 2 #define LEAPRAID_MINOR_VERSION 00 #define LEAPRAID_BUILD_VERSION 01 -#define LEAPRAID_RELEASE_VERSION 02 +#define LEAPRAID_RELEASE_VERSION 05 #define LEAPRAID_MSG_VERSION 0x1021 #define LEAPRAID_HEADER_VERSION 0x0000 @@ -126,7 +126,6 @@ /* SMP (Serial Management Protocol). */ #define LEAPRAID_SMP_PT_FLAG_SGL_PTR 0x80 -#define LEAPRAID_SMP_FN_REPORT_PHY_ERR_LOG 0x91 #define LEAPRAID_SMP_FRAME_HEADER_SIZE 4 #define LEAPRAID_SCSI_HOST_SHIFT 16 #define LEAPRAID_SCSI_DRIVER_SHIFT 24 @@ -170,13 +169,9 @@ /* Basic constants and limits. */ #define LEAPRAID_BUSY_LIMIT 1 -#define LEAPRAID_INDEX_FIRST 0 -#define LEAPRAID_BITS_PER_BYTE 8 #define LEAPRAID_INVALID_HOST_DIAG_VAL 0xFFFFFFFF /* Retry/Sleep configuration. */ -#define LEAPRAID_WRITE_SEQUENCE_OFFSET 0x4 -#define LEAPRAID_WRSEQ_KEY_VALUE_MASK 0xF #define LEAPRAID_WRSEQ_FLUSH_KEY_VALUE 0x0 #define LEAPRAID_WRSEQ_1ST_KEY_VALUE 0xF #define LEAPRAID_WRSEQ_2ND_KEY_VALUE 0x4 @@ -186,7 +181,6 @@ #define LEAPRAID_WRSEQ_6TH_KEY_VALUE 0xD #define LEAPRAID_UNLOCK_RETRY_LIMIT 20 #define LEAPRAID_UNLOCK_SLEEP_MS 100 -#define LEAPRAID_MSLEEP_SHORT_MS 50 #define LEAPRAID_MSLEEP_NORMAL_MS 100 #define LEAPRAID_MSLEEP_EXTRA_LONG_MS 500 #define LEAPRAID_IO_POLL_DELAY_US 500 @@ -197,7 +191,6 @@ #define LEAPRAID_INVALID_DEV_HANDLE 0xFFFF /* Commands queue depth. */ -#define LEAPRAID_COALESCING_DEPTH_MAX 256 #define LEAPRAID_DEFAULT_CMD_QD_OFFSET 64 #define LEAPRAID_REPLY_QD_ALIGNMENT 16 /* Task ID offset. */ @@ -223,7 +216,6 @@ #define LEAPRAID_CTL_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT #define LEAPRAID_SCAN_DEV_CMD_TIMEOUT 300 #define LEAPRAID_TIMESTAMP_SYNC_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT -#define LEAPRAID_RAID_ACTION_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT #define LEAPRAID_ENC_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT #define LEAPRAID_IO_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT #define LEAPRAID_NOTIFY_EVENT_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT @@ -598,6 +590,7 @@ struct leapraid_fw_evt_work { * @leapraid_evt_masks: Array of event masks for filtering firmware events. */ struct leapraid_fw_evt_struct { + u32 leapraid_evt_masks[4]; char fw_evt_name[48]; struct workqueue_struct *fw_evt_thread; spinlock_t fw_evt_lock; /* protects firmware event */ @@ -605,7 +598,6 @@ struct leapraid_fw_evt_struct { struct leapraid_fw_evt_work *cur_evt; struct task_struct *cur_evt_task; u8 fw_evt_cleanup; - u32 leapraid_evt_masks[4]; }; /** @@ -1444,7 +1436,7 @@ int leapraid_get_volume_cap(struct leapraid_adapter *adapter, int leapraid_internal_init_cmd_priv( struct leapraid_adapter *adapter, struct leapraid_io_req_tracker *io_tracker); -int leapraid_internal_exit_cmd_priv( +void leapraid_internal_exit_cmd_priv( struct leapraid_adapter *adapter, struct leapraid_io_req_tracker *io_tracker); void leapraid_clean_active_fw_evt(struct leapraid_adapter *adapter); @@ -1515,7 +1507,7 @@ int leapraid_op_config_page(struct leapraid_adapter *adapter, void *cfgp, union cfg_param_1 cfgp1, union cfg_param_2 cfgp2, enum config_page_action cfg_op); -void leapraid_log_req_context(struct leapraid_adapter *adapter, +void leapraid_log_req_context(struct leapraid_adapter *adapter, u16 smid, const void *req_data); int leapraid_change_queue_depth(struct scsi_device *sdev, int qdepth); diff --git a/drivers/scsi/leapraid/leapraid_os.c b/drivers/scsi/leapraid/leapraid_os.c index 5a6cda0b5ea8..301ad59a48bf 100644 --- a/drivers/scsi/leapraid/leapraid_os.c +++ b/drivers/scsi/leapraid/leapraid_os.c @@ -157,9 +157,8 @@ static int leapraid_tm_post_processing(struct leapraid_adapter *adapter, leapraid_sync_irqs(adapter, true); leapraid_unmask_int(adapter); - rc = leapraid_tm_cmd_map_status(adapter, channel, id, lun, type, - taskid_task); - return rc; + return leapraid_tm_cmd_map_status(adapter, channel, id, lun, type, + taskid_task); } static void leapraid_build_tm_req(struct leapraid_scsi_tm_req *scsi_tm_req, @@ -185,6 +184,7 @@ int leapraid_issue_tm(struct leapraid_adapter *adapter, u16 hdl, uint channel, struct leapraid_scsiio_req *scsiio_req; struct leapraid_io_req_tracker *io_req_tracker = NULL; u16 msix_task; + u16 taskid; bool issue_reset = false; u32 db; int rc; @@ -239,16 +239,15 @@ int leapraid_issue_tm(struct leapraid_adapter *adapter, u16 hdl, uint channel, msix_task = io_req_tracker->msix_io; else msix_task = 0; - leapraid_fire_hpr_task(adapter, - adapter->driver_cmds.tm_cmd.hp_taskid, - msix_task); + taskid = adapter->driver_cmds.tm_cmd.hp_taskid; + leapraid_fire_hpr_task(adapter, taskid, msix_task); wait_for_completion_timeout(&adapter->driver_cmds.tm_cmd.done, LEAPRAID_TM_CMD_TIMEOUT * HZ); if (!(adapter->driver_cmds.tm_cmd.status & LEAPRAID_CMD_DONE)) { dev_err(&adapter->pdev->dev, "%s: TM cmd timeout, status=0x%x\n", __func__, adapter->driver_cmds.tm_cmd.status); - leapraid_log_req_context(adapter, scsi_tm_req); + leapraid_log_req_context(adapter, taskid, scsi_tm_req); issue_reset = leapraid_check_reset( adapter->driver_cmds.tm_cmd.status); @@ -647,7 +646,6 @@ static void leapraid_probe_sas(struct leapraid_adapter *adapter) sas_dev->hdl, sas_dev->parent_sas_addr, sas_dev->card_port); - if (!added) goto remove_dev; @@ -808,10 +806,7 @@ static inline bool leapraid_is_scmd_permitted(struct leapraid_adapter *adapter, return false; opcode = scmd->cmnd[0]; - if (opcode == SYNCHRONIZE_CACHE || opcode == START_STOP) - return true; - - return false; + return opcode == SYNCHRONIZE_CACHE || opcode == START_STOP; } return true; } @@ -1084,13 +1079,15 @@ static int leapraid_error_handler(struct scsi_cmnd *scmd, out_eh_done: if (type == LEAPRAID_TM_TASKTYPE_ABORT_TASK) { - dev_info(&adapter->pdev->dev, - "EH ABORT result: %s, scmd=0x%p\n", - rc == SUCCESS ? "success" : "failed", scmd); + if (rc) + dev_err(&adapter->pdev->dev, + "EH ABORT result: failed, scmd=0x%p\n", + scmd); } else { - dev_info(&adapter->pdev->dev, - "EH %s result: %s, scmd=0x%p\n", - str, rc == SUCCESS ? "success" : "failed", scmd); + if (rc) + dev_err(&adapter->pdev->dev, + "EH %s result: failed, scmd=0x%p\n", + str, scmd); if (sas_dev) leapraid_sdev_put(sas_dev); } @@ -1144,8 +1141,10 @@ static int leapraid_eh_host_reset_handler(struct scsi_cmnd *scmd) rc = SUCCESS; out_host_reset_done: - dev_info(&adapter->pdev->dev, "EH HOST RESET result: %s, scmd=0x%p\n", - rc == SUCCESS ? "success" : "failed", scmd); + if (rc) + dev_err(&adapter->pdev->dev, + "EH HOST RESET result: failed, scmd=0x%p\n", + scmd); return rc; } @@ -1210,7 +1209,7 @@ static int leapraid_slave_alloc(struct scsi_device *sdev) return 0; } -static int leapraid_slave_cfg_volume(struct scsi_device *sdev) +static bool leapraid_slave_cfg_volume(struct scsi_device *sdev) { struct Scsi_Host *shost = sdev->host; struct leapraid_adapter *adapter = shost_priv(shost); @@ -1259,10 +1258,10 @@ static int leapraid_slave_cfg_volume(struct scsi_device *sdev) return 0; } -static int leapraid_slave_configure_extra(struct scsi_device *sdev, - struct leapraid_sas_dev **psas_dev, - u16 vol_hdl, u64 volume_wwid, - bool *is_target_ssp, int *qd) +static bool leapraid_slave_configure_extra(struct scsi_device *sdev, + struct leapraid_sas_dev **psas_dev, + u16 vol_hdl, u64 volume_wwid, + bool *is_target_ssp, int *qd) { struct leapraid_sas_dev *sas_dev; struct leapraid_sdev_priv *sdev_priv; @@ -1569,11 +1568,9 @@ static bool leapraid_scan_check_status(struct leapraid_adapter *adapter, wake_up(&adapter->scan_dev_desc.wait_driver_loading); adapter->scan_dev_desc.wait_scan_dev_done = 0; adapter->access_ctrl.host_removing = 1; - wake_up(&adapter->access_ctrl.recovery_waitq); return true; } - dev_info(&adapter->pdev->dev, "Device scan: SUCCESS\n"); adapter->driver_cmds.scan_dev_cmd.status = LEAPRAID_CMD_NOT_USED; leapraid_scan_dev_done(adapter); return true; @@ -2116,7 +2113,6 @@ static void leapraid_remove(struct pci_dev *pdev) !atomic_read(&adapter->overheat_desc.thermal_alert)); adapter->access_ctrl.host_removing = 1; - wake_up(&adapter->access_ctrl.recovery_waitq); leapraid_wait_cmds_done(adapter); @@ -2157,7 +2153,6 @@ static void leapraid_shutdown(struct pci_dev *pdev) } adapter->access_ctrl.host_removing = 1; - wake_up(&adapter->access_ctrl.recovery_waitq); leapraid_wait_cmds_done(adapter); leapraid_clean_active_fw_evt(adapter); leapraid_overheat_cleanup(adapter); @@ -2244,7 +2239,6 @@ static pci_ers_result_t leapraid_pci_slot_reset(struct pci_dev *pdev) dev_err(&pdev->dev, "%s PCI error slot reset\n", adapter->adapter_attr.name); - adapter->access_ctrl.pcie_recovering = 0; adapter->pdev = pdev; pci_restore_state(pdev); if (leapraid_set_pcie_and_notification(adapter)) { @@ -2254,13 +2248,15 @@ static pci_ers_result_t leapraid_pci_slot_reset(struct pci_dev *pdev) return PCI_ERS_RESULT_DISCONNECT; } + adapter->access_ctrl.pcie_recovering = 0; dev_info(&pdev->dev, "%s: Hard reset triggered by PCI slot reset\n", adapter->adapter_attr.name); dev_info(&adapter->pdev->dev, "%s: %d: call hard_reset\n", __func__, __LINE__); rc = leapraid_hard_reset_handler(adapter, FULL_RESET); - dev_info(&pdev->dev, "%s hard reset: %s\n", - adapter->adapter_attr.name, rc == 0 ? "success" : "failed"); + if (rc) + dev_err(&pdev->dev, "%s hard reset: failed\n", + adapter->adapter_attr.name); return rc == 0 ? PCI_ERS_RESULT_RECOVERED : PCI_ERS_RESULT_DISCONNECT; @@ -2277,6 +2273,7 @@ static void leapraid_pci_resume(struct pci_dev *pdev) } dev_err(&pdev->dev, "PCI error resume!\n"); + pci_aer_clear_nonfatal_status(pdev); leapraid_check_scheduled_fault_start(adapter); leapraid_fw_log_start(adapter); diff --git a/drivers/scsi/leapraid/leapraid_transport.c b/drivers/scsi/leapraid/leapraid_transport.c index 738bc55df416..e175ca4c1264 100644 --- a/drivers/scsi/leapraid/leapraid_transport.c +++ b/drivers/scsi/leapraid/leapraid_transport.c @@ -298,6 +298,7 @@ static int leapraid_transport_exp_report_manu(struct leapraid_adapter *adapter, dma_addr_t c2h_dma_addr; bool issue_reset = false; void *data_out = NULL; + u16 inter_taskid; size_t c2h_size; size_t h2c_size; void *psge; @@ -338,10 +339,8 @@ static int leapraid_transport_exp_report_manu(struct leapraid_adapter *adapter, rep_manu_request->allocated_response_length = 0; rep_manu_request->request_length = 0; - smp_passthrough_req = - leapraid_get_task_desc( - adapter, - adapter->driver_cmds.transport_cmd.inter_taskid); + inter_taskid = adapter->driver_cmds.transport_cmd.inter_taskid; + smp_passthrough_req = leapraid_get_task_desc(adapter, inter_taskid); memset(smp_passthrough_req, 0, sizeof(struct leapraid_smp_passthrough_req)); smp_passthrough_req->func = LEAPRAID_FUNC_SMP_PASSTHROUGH; @@ -354,8 +353,7 @@ static int leapraid_transport_exp_report_manu(struct leapraid_adapter *adapter, c2h_dma_addr, c2h_size); init_completion(&adapter->driver_cmds.transport_cmd.done); - leapraid_fire_task(adapter, - adapter->driver_cmds.transport_cmd.inter_taskid); + leapraid_fire_task(adapter, inter_taskid); wait_for_completion_timeout(&adapter->driver_cmds.transport_cmd.done, LEAPRAID_TRANSPORT_CMD_TIMEOUT * HZ); if (!(adapter->driver_cmds.transport_cmd.status & LEAPRAID_CMD_DONE)) { @@ -363,7 +361,8 @@ static int leapraid_transport_exp_report_manu(struct leapraid_adapter *adapter, dev_err(&adapter->pdev->dev, "%s: SMP passthrough timeout, st=0x%x\n", __func__, adapter->driver_cmds.transport_cmd.status); - leapraid_log_req_context(adapter, smp_passthrough_req); + leapraid_log_req_context(adapter, inter_taskid, + smp_passthrough_req); if (!(adapter->driver_cmds.transport_cmd.status & LEAPRAID_CMD_RESET)) issue_reset = true; @@ -1249,20 +1248,21 @@ static void leapraid_build_smp_task(struct leapraid_adapter *adapter, static int leapraid_send_smp_req(struct leapraid_adapter *adapter) { const struct leapraid_smp_passthrough_req *smp_passthrough_req; + u16 inter_taskid; dev_dbg(&adapter->pdev->dev, "%s: Sending smp request\n", __func__); - smp_passthrough_req = leapraid_get_task_desc( - adapter, adapter->driver_cmds.transport_cmd.inter_taskid); + inter_taskid = adapter->driver_cmds.transport_cmd.inter_taskid; + smp_passthrough_req = leapraid_get_task_desc(adapter, inter_taskid); init_completion(&adapter->driver_cmds.transport_cmd.done); - leapraid_fire_task(adapter, - adapter->driver_cmds.transport_cmd.inter_taskid); + leapraid_fire_task(adapter, inter_taskid); wait_for_completion_timeout(&adapter->driver_cmds.transport_cmd.done, LEAPRAID_TRANSPORT_CMD_TIMEOUT * HZ); if (!(adapter->driver_cmds.transport_cmd.status & LEAPRAID_CMD_DONE)) { dev_err(&adapter->pdev->dev, "%s: timeout, st=0x%x\n", __func__, adapter->driver_cmds.transport_cmd.status); - leapraid_log_req_context(adapter, smp_passthrough_req); + leapraid_log_req_context(adapter, inter_taskid, + smp_passthrough_req); if (!(adapter->driver_cmds.transport_cmd.status & LEAPRAID_CMD_RESET)) { dev_dbg(&adapter->pdev->dev, -- 2.25.1

2 1

[PATCH OLK-6.6] scsi: leapraid: update driver to v2.00.01.05
by haodongdong 02 Jul '26

02 Jul '26

From: Hao Dongdong <doubled(a)leap-io-kernel.com> LeapIO inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/9538 ------------------------------------------ leapraid driver changes from v2.00.01.02 to v2.00.01.05. This update includes: - recovery wait and hard reset flow stabilization - improved timeout diagnostics with per-command context logging - MSI-X/IRQ CPU affinity fixes - SAS topology and event bitmap alignment fixes - transport and task-management error-path cleanup - config-page stack usage reduction and adapter info cleanup - ioctl compatibility cleanup - resource cleanup and failure-path hardening Signed-off-by: Hao Dongdong <doubled(a)leap-io-kernel.com> --- drivers/scsi/leapraid/leapraid.h | 21 -- drivers/scsi/leapraid/leapraid_app.c | 9 +- drivers/scsi/leapraid/leapraid_func.c | 344 +++++++++------------ drivers/scsi/leapraid/leapraid_func.h | 18 +- drivers/scsi/leapraid/leapraid_os.c | 61 ++-- drivers/scsi/leapraid/leapraid_transport.c | 24 +- 6 files changed, 191 insertions(+), 286 deletions(-) diff --git a/drivers/scsi/leapraid/leapraid.h b/drivers/scsi/leapraid/leapraid.h index 2a99417143ad..c9f403efb84f 100644 --- a/drivers/scsi/leapraid/leapraid.h +++ b/drivers/scsi/leapraid/leapraid.h @@ -27,8 +27,6 @@ /* Maximum number of retries waiting for doorbell to become operational. */ #define LEAPRAID_DB_WAIT_OP_SHORT 10 #define LEAPRAID_DB_WAIT_OP_LONG 200 -/* Sleep interval (in seconds) between doorbell polls. */ -#define LEAPRAID_DB_POLL_INTERVAL_S 1 /* Maximum number of retries waiting for host to end recovery. */ #define LEAPRAID_WAIT_SHOST_RECOVERY 400 @@ -180,7 +178,6 @@ #define LEAPRAID_CFG_PAGE_NUM_DEV0 0x0 /* SAS device page 0 flags. */ -#define LEAPRAID_SAS_DEV_P0_FLG_FP_CAP 0x2000 #define LEAPRAID_SAS_DEV_P0_FLG_SATA_SMART 0x0040 #define LEAPRAID_SAS_DEV_P0_FLG_ENC_LEVEL_VALID 0x0002 #define LEAPRAID_SAS_DEV_P0_FLG_DEV_PRESENT 0x0001 @@ -207,15 +204,9 @@ /* Physical disk page number. */ #define LEAPRAID_CFG_PAGE_NUM_PD0 0x0 -/* Adapter page number. */ -#define LEAPRAID_CFG_PAGE_NUM_ADAPTER1 0x1 - #define LEAPRAID_CFG_UNIT_SIZE 4 /* Raid volume type and state. */ -#define LEAPRAID_VOL_STATE_MISSING 0x00 -#define LEAPRAID_VOL_STATE_FAILED 0x01 -#define LEAPRAID_VOL_STATE_INITIALIZING 0x02 #define LEAPRAID_VOL_STATE_ONLINE 0x03 #define LEAPRAID_VOL_STATE_DEGRADED 0x04 #define LEAPRAID_VOL_STATE_OPTIMAL 0x05 @@ -231,10 +222,6 @@ #define LEAPRAID_RAIDCFG_P0_EFLG_HOT_SPARE_ELEMENT 0x0002 #define LEAPRAID_RAIDCFG_P0_EFLG_OCE_ELEMENT 0x0003 -/* Raid action. */ -#define LEAPRAID_RAID_ACT_SYSTEM_SHUTDOWN_INITIATED 0x20 -#define LEAPRAID_RAID_ACT_PHYSDISK_HIDDEN 0x24 - /* SAS negotiated link rates. */ #define LEAPRAID_SAS_NEG_LINK_RATE_MASK_PHYSICAL 0x0F #define LEAPRAID_SAS_NEG_LINK_RATE_UNKNOWN_LINK_RATE 0x00 @@ -290,8 +277,6 @@ #define LEAPRAID_TM_MSGFLAGS_LINK_RESET 0x00 #define LEAPRAID_TM_RSP_INVALID_FRAME 0x02 -#define LEAPRAID_TM_RSP_TM_SUCCEEDED 0x08 -#define LEAPRAID_TM_RSP_IO_QUEUED_ON_ADAPTER 0x80 /* SCSI enclosure processor request defines. */ #define LEAPRAID_SEP_REQ_ACT_WRITE_STATUS 0x00 @@ -301,8 +286,6 @@ /* The capabilities of the adapter. */ #define LEAPRAID_ADAPTER_FEATURES_CAP_ATOMIC_REQ 0x00080000 -#define LEAPRAID_ADAPTER_FEATURES_CAP_RDPQ_ARRAY_CAPABLE 0x00040000 -#define LEAPRAID_ADAPTER_FEATURES_CAP_EVENT_REPLAY 0x00002000 #define LEAPRAID_ADAPTER_FEATURES_CAP_INTEGRATED_RAID 0x00001000 /* Event code definitions for the firmware. */ @@ -338,10 +321,6 @@ #define LEAPRAID_EVT_SAS_TOPO_RC_TARG_ADDED 0x01 #define LEAPRAID_EVT_SAS_TOPO_RC_TARG_NOT_RESPONDING 0x02 -/* SAS discovery event defines. */ -#define LEAPRAID_EVT_SAS_DISC_RC_STARTED 0x01 -#define LEAPRAID_EVT_SAS_DISC_RC_COMPLETED 0x02 - /* Enclosure device status change event. */ #define LEAPRAID_EVT_SAS_ENCL_RC_ADDED 0x01 #define LEAPRAID_EVT_SAS_ENCL_RC_NOT_RESPONDING 0x02 diff --git a/drivers/scsi/leapraid/leapraid_app.c b/drivers/scsi/leapraid/leapraid_app.c index 25ec57c2ce4b..8ee57865adca 100644 --- a/drivers/scsi/leapraid/leapraid_app.c +++ b/drivers/scsi/leapraid/leapraid_app.c @@ -388,6 +388,7 @@ static int leapraid_ctl_do_command(struct leapraid_adapter *adapter, dev_err(&adapter->pdev->dev, "%s: ctl_cmd timeout, status=0x%x\n", __func__, adapter->driver_cmds.ctl_cmd.status); + leapraid_log_req_context(adapter, taskid, ctl_sp_mpi_req); } if ((leap_mpi_req->func == LEAPRAID_FUNC_SMP_PASSTHROUGH || @@ -590,7 +591,7 @@ static int leapraid_ctl_ioctl_main(struct file *file, unsigned int cmd, break; } - if (karg.hdr.adapter_id != ioctl_header.adapter_id) { + if (karg.hdr.adapter_id != ioctl_header.adapter_id) { rc = -EINVAL; break; } @@ -621,11 +622,6 @@ static int leapraid_ctl_ioctl_main(struct file *file, unsigned int cmd, return rc; } -static long bad_ioctl(struct file *file, unsigned int cmd, unsigned long arg) -{ - return -ENOTTY; -} - static long leapraid_ctl_ioctl(struct file *file, unsigned int cmd, unsigned long arg) { @@ -679,7 +675,6 @@ static const struct file_operations leapraid_ctl_fops = { .owner = THIS_MODULE, .unlocked_ioctl = leapraid_ctl_ioctl, .mmap = leapraid_fw_mmap, - .compat_ioctl = bad_ioctl, }; static struct miscdevice leapraid_ctl_dev = { diff --git a/drivers/scsi/leapraid/leapraid_func.c b/drivers/scsi/leapraid/leapraid_func.c index f2574feb2514..3701c9c8a4c7 100644 --- a/drivers/scsi/leapraid/leapraid_func.c +++ b/drivers/scsi/leapraid/leapraid_func.c @@ -47,6 +47,17 @@ static bool leapraid_should_skip_poll_work(struct leapraid_adapter *adapter); static int leapraid_make_adapter_ready(struct leapraid_adapter *adapter, enum reset_type type); +static noinline bool leapraid_shost_in_recovery(struct Scsi_Host *shost) +{ + enum scsi_host_state state; + + state = READ_ONCE(shost->shost_state); + return state == SHOST_RECOVERY || + state == SHOST_CANCEL_RECOVERY || + state == SHOST_DEL_RECOVERY || + shost->tmf_in_progress; +} + static void leapraid_debug_log_info(struct leapraid_adapter *adapter) { struct leapraid_reg_base __iomem *iomem_base = adapter->iomem_base; @@ -81,6 +92,7 @@ static void leapraid_debug_log_info(struct leapraid_adapter *adapter) debug_log[i + 2], debug_log[i + 3]); } + static inline bool leapraid_is_end_dev(u32 dev_type) { return (dev_type & LEAPRAID_DEVTYP_END_DEV) && @@ -171,7 +183,6 @@ static void leapraid_overheat_suspend(struct leapraid_adapter *adapter) pdev = adapter->pdev; shost = pci_get_drvdata(pdev); - if (!shost) { dev_warn(&pdev->dev, "Overheat suspend failed, invalid host or adapter\n"); @@ -1948,7 +1959,7 @@ static const char *leapraid_tm_type_name(u8 task_type) } } -void leapraid_log_req_context(struct leapraid_adapter *adapter, +void leapraid_log_req_context(struct leapraid_adapter *adapter, u16 smid, const void *req_data) { const struct leapraid_req *req = req_data; @@ -1961,8 +1972,8 @@ void leapraid_log_req_context(struct leapraid_adapter *adapter, const struct leapraid_cfg_req *cfg_req = req_data; dev_err(&adapter->pdev->dev, - "cfg-req: func=0x%02x(%s) act=0x%02x(%s)\n", - req->func, leapraid_func_name(req->func), + "cfg-req: smid=%u func=0x%02x(%s) action=0x%02x(%s)\n", + smid, req->func, leapraid_func_name(req->func), cfg_req->action, leapraid_cfg_action_name(cfg_req->action)); dev_err(&adapter->pdev->dev, @@ -1984,12 +1995,12 @@ void leapraid_log_req_context(struct leapraid_adapter *adapter, const struct leapraid_scsi_tm_req *tm_req = req_data; dev_err(&adapter->pdev->dev, - "scsi_tm: func=0x%02x(%s) task=0x%02x(%s)\n", - req->func, leapraid_func_name(req->func), + "scsi_tm:: smid=%u func=0x%02x(%s) task=0x%02x(%s)\n", + smid, req->func, leapraid_func_name(req->func), tm_req->task_type, leapraid_tm_type_name(tm_req->task_type)); dev_err(&adapter->pdev->dev, - "scsi_tm: dev_hdl=0x%04x task_mid=%u\n", + "scsi_tm:: dev_hdl=0x%04x task_mid=%u\n", le16_to_cpu(tm_req->dev_hdl), le16_to_cpu(tm_req->task_mid)); break; @@ -1998,8 +2009,8 @@ void leapraid_log_req_context(struct leapraid_adapter *adapter, const struct leapraid_sep_req *sep_req = req_data; dev_err(&adapter->pdev->dev, - "sep: func=0x%02x(%s) act=0x%02x(%s)\n", - req->func, leapraid_func_name(req->func), + "sep: smid=%u func=0x%02x(%s) action=0x%02x(%s)\n", + smid, req->func, leapraid_func_name(req->func), sep_req->act, leapraid_sep_action_name(sep_req->act)); dev_err(&adapter->pdev->dev, @@ -2013,11 +2024,11 @@ void leapraid_log_req_context(struct leapraid_adapter *adapter, const struct leapraid_io_unit_ctrl_req *io_req = req_data; dev_err(&adapter->pdev->dev, - "timestamp sync: func=0x%02x(%s) op=0x%02x(%s)\n", - req->func, leapraid_func_name(req->func), + "ctl_cmd: smid=%u func=0x%02x(%s) action=0x%02x(%s)\n", + smid, req->func, leapraid_func_name(req->func), io_req->op, leapraid_sas_op_name(io_req->op)); dev_err(&adapter->pdev->dev, - "timestamp sync: dev_hdl=0x%04x param=0x%02x(%s)\n", + "ctl_cmd: dev_hdl=0x%04x param=0x%02x(%s)\n", le16_to_cpu(io_req->dev_hdl), io_req->adapter_para, leapraid_io_param_name(io_req->adapter_para)); @@ -2027,18 +2038,21 @@ void leapraid_log_req_context(struct leapraid_adapter *adapter, const struct leapraid_smp_passthrough_req *smp_req = req_data; dev_err(&adapter->pdev->dev, - "transport: func=0x%02x(%s) port=%u req_len=%u\n", - req->func, leapraid_func_name(req->func), + "smp_cmd: smid=%u func=0x%02x(%s) action=0x%02x\n", + smid, req->func, leapraid_func_name(req->func), + smp_req->passthrough_flg); + dev_err(&adapter->pdev->dev, + "smp_cmd: port=%u req_len=%u\n", smp_req->physical_port, le16_to_cpu(smp_req->req_data_len)); - dev_err(&adapter->pdev->dev, "transport: sas_addr=0x%016llx\n", + dev_err(&adapter->pdev->dev, "smp_cmd: sas_addr=0x%016llx\n", (unsigned long long)le64_to_cpu(smp_req->sas_address)); break; } default: dev_err(&adapter->pdev->dev, - "%s: func=0x%02x(%s)\n", - __func__, req->func, leapraid_func_name(req->func)); + "cmd: smid=%u func=0x%02x(%s)\n", + smid, req->func, leapraid_func_name(req->func)); break; } } @@ -2049,19 +2063,18 @@ static void leapraid_build_and_fire_cfg_req( struct leapraid_cfg_rep *leap_mpi_cfgp_rep) { struct leapraid_cfg_req *local_leap_cfg_req; + u16 smid; memset(leap_mpi_cfgp_rep, 0, sizeof(struct leapraid_cfg_rep)); memset(&adapter->driver_cmds.cfg_op_cmd.reply, 0, sizeof(struct leapraid_cfg_rep)); adapter->driver_cmds.cfg_op_cmd.status = LEAPRAID_CMD_PENDING; - local_leap_cfg_req = leapraid_get_task_desc( - adapter, - adapter->driver_cmds.cfg_op_cmd.inter_taskid); + smid = adapter->driver_cmds.cfg_op_cmd.inter_taskid; + local_leap_cfg_req = leapraid_get_task_desc(adapter, smid); memcpy(local_leap_cfg_req, leap_mpi_cfgp_req, sizeof(struct leapraid_cfg_req)); init_completion(&adapter->driver_cmds.cfg_op_cmd.done); - leapraid_fire_task(adapter, - adapter->driver_cmds.cfg_op_cmd.inter_taskid); + leapraid_fire_task(adapter, smid); wait_for_completion_timeout(&adapter->driver_cmds.cfg_op_cmd.done, LEAPRAID_CFG_OP_TIMEOUT * HZ); } @@ -2074,11 +2087,13 @@ static int leapraid_req_cfg_func(struct leapraid_adapter *adapter, { u32 adapter_status = UINT_MAX; bool issue_reset = false; + u16 smid; u8 retry_cnt; int rc; retry_cnt = 0; mutex_lock(&adapter->driver_cmds.cfg_op_cmd.mutex); + smid = adapter->driver_cmds.cfg_op_cmd.inter_taskid; retry: if (retry_cnt) { if (retry_cnt > LEAPRAID_CFG_REQ_RETRY_TIMES) { @@ -2115,14 +2130,16 @@ static int leapraid_req_cfg_func(struct leapraid_adapter *adapter, adapter->access_ctrl.shost_recovering ? "shost recovery" : "pcie recovery", adapter->driver_cmds.cfg_op_cmd.status); - leapraid_log_req_context(adapter, leap_mpi_cfgp_req); + leapraid_log_req_context(adapter, smid, + leap_mpi_cfgp_req); issue_reset = false; rc = -EFAULT; } else { dev_err(&adapter->pdev->dev, "cfg-req: timeout, status=0x%x, reset\n", adapter->driver_cmds.cfg_op_cmd.status); - leapraid_log_req_context(adapter, leap_mpi_cfgp_req); + leapraid_log_req_context(adapter, smid, + leap_mpi_cfgp_req); issue_reset = true; } @@ -2162,7 +2179,7 @@ static int leapraid_req_cfg_func(struct leapraid_adapter *adapter, mutex_unlock(&adapter->driver_cmds.cfg_op_cmd.mutex); if (issue_reset) { if (adapter->scan_dev_desc.first_scan_dev_fired) { - dev_info(&adapter->pdev->dev, + dev_warn(&adapter->pdev->dev, "%s:%d cfg-req: Failure, issuing reset\n", __func__, __LINE__); leapraid_hard_reset_handler(adapter, FULL_RESET); @@ -2433,14 +2450,12 @@ static int leapraid_cfg_find_vol_in_page( u16 phys_hdl; phys_hdl = le16_to_cpu(elem->phys_disk_dev_hdl); - if (phys_hdl == pd_hdl) { *vol_hdl = le16_to_cpu(elem->vol_dev_hdl); return 0; } break; } - case LEAPRAID_RAIDCFG_P0_EFLG_HOT_SPARE_ELEMENT: *vol_hdl = 0; return 0; @@ -2607,7 +2622,6 @@ static int leapraid_cfg_get_number_pds(struct leapraid_adapter *adapter, cfgp2.handle = hdl; rc = leapraid_op_config_page(adapter, &raidvol_p0, cfgp1, cfgp2, GET_RAID_VOLUME_PG0); - if (!rc) *num_pds = raidvol_p0.num_phys_disks; @@ -2827,13 +2841,12 @@ static void leapraid_timestamp_sync(struct leapraid_adapter *adapter) ktime_t current_time; bool issue_reset = false; u64 time_stamp; + u16 smid; mutex_lock(&adapter->driver_cmds.timestamp_sync_cmd.mutex); adapter->driver_cmds.timestamp_sync_cmd.status = LEAPRAID_CMD_PENDING; - io_unit_ctrl_req = - leapraid_get_task_desc( - adapter, - adapter->driver_cmds.timestamp_sync_cmd.inter_taskid); + smid = adapter->driver_cmds.timestamp_sync_cmd.inter_taskid; + io_unit_ctrl_req = leapraid_get_task_desc(adapter, smid); memset(io_unit_ctrl_req, 0, sizeof(struct leapraid_io_unit_ctrl_req)); io_unit_ctrl_req->func = LEAPRAID_FUNC_SAS_IO_UNIT_CTRL; io_unit_ctrl_req->op = LEAPRAID_SAS_OP_SET_PARAMETER; @@ -2847,9 +2860,7 @@ static void leapraid_timestamp_sync(struct leapraid_adapter *adapter) io_unit_ctrl_req->adapter_para_value2 = cpu_to_le32(time_stamp >> 32); init_completion(&adapter->driver_cmds.timestamp_sync_cmd.done); - leapraid_fire_task( - adapter, - adapter->driver_cmds.timestamp_sync_cmd.inter_taskid); + leapraid_fire_task(adapter, smid); leapraid_debug_log_info(adapter); wait_for_completion_timeout(&adapter->driver_cmds .timestamp_sync_cmd.done, @@ -2860,7 +2871,7 @@ static void leapraid_timestamp_sync(struct leapraid_adapter *adapter) "%s: timestamp sync timeout, status=0x%x\n", __func__, adapter->driver_cmds.timestamp_sync_cmd.status); - leapraid_log_req_context(adapter, io_unit_ctrl_req); + leapraid_log_req_context(adapter, smid, io_unit_ctrl_req); issue_reset = leapraid_check_reset( adapter->driver_cmds.timestamp_sync_cmd.status); @@ -2891,15 +2902,16 @@ static void leapraid_check_scheduled_fault_work(struct work_struct *work) adapter_state = leapraid_get_adapter_state(adapter); if (adapter_state != LEAPRAID_DB_OPERATIONAL) { - dev_info(&adapter->pdev->dev, "%s:%d: call hard_reset\n", - __func__, __LINE__); + dev_info(&adapter->pdev->dev, "%s:%d: call hard_reset 0x%x\n", + __func__, __LINE__, adapter_state); rc = leapraid_hard_reset_handler(adapter, FULL_RESET); - dev_warn(&adapter->pdev->dev, "%s: Hard reset %s\n", - __func__, rc == 0 ? "success" : "failed"); - adapter_state = leapraid_get_adapter_state(adapter); - if (rc && adapter_state != LEAPRAID_DB_OPERATIONAL) + if (rc && adapter_state != LEAPRAID_DB_OPERATIONAL) { + dev_err(&adapter->pdev->dev, + "%s: Hard reset failed, state=0x%x rc=%d\n", + __func__, adapter_state, rc); return; + } } if (++adapter->timestamp_sync_cnt >= @@ -3262,7 +3274,6 @@ void leapraid_smart_polling_stop(struct leapraid_adapter *adapter) wq = desc->smart_poll_wq; desc->smart_poll_wq = NULL; - if (wq) { if (!cancel_delayed_work_sync(&desc->smart_poll_work)) flush_workqueue(wq); @@ -3304,7 +3315,6 @@ static void leapraid_overheat_work(struct work_struct *work) adapter->scan_dev_desc.scan_start = 0; adapter->scan_dev_desc.wait_scan_dev_done = 0; adapter->scan_dev_desc.driver_loading = 0; - wake_up(&adapter->access_ctrl.recovery_waitq); wake_up(&adapter->access_ctrl.shost_recover_wq); wake_up(&adapter->scan_dev_desc.wait_driver_loading); @@ -3393,10 +3403,10 @@ static struct leapraid_fw_evt_work *leapraid_alloc_fw_evt_work(void) { struct leapraid_fw_evt_work *fw_evt = kzalloc(sizeof(*fw_evt), GFP_ATOMIC); - if (!fw_evt) - return NULL; - kref_init(&fw_evt->refcnt); + if (fw_evt) + kref_init(&fw_evt->refcnt); + return fw_evt; } @@ -3467,7 +3477,6 @@ void leapraid_clean_active_fw_evt(struct leapraid_adapter *adapter) return; adapter->fw_evt_s.fw_evt_cleanup = 1; - wake_up(&adapter->access_ctrl.recovery_waitq); if (adapter->access_ctrl.shost_recovering && adapter->fw_evt_s.cur_evt) adapter->fw_evt_s.cur_evt->ignore = 1; @@ -4382,7 +4391,7 @@ void leapraid_exp_rm(struct leapraid_adapter *adapter, u64 sas_addr, leapraid_exp_node_rm(adapter, topo_node_exp); } -static int leapraid_internal_sas_topo_chg_evt( +static void leapraid_internal_sas_topo_chg_evt( struct leapraid_adapter *adapter, struct leapraid_card_port *card_port, struct leapraid_topo_node *topo_node_exp, @@ -4399,11 +4408,11 @@ static int leapraid_internal_sas_topo_chg_evt( evt_data = fw_evt->evt_data; for (i = 0; i < evt_data->entry_num; i++) { if (fw_evt->ignore) - return 0; + return; if (adapter->access_ctrl.host_removing || adapter->access_ctrl.pcie_recovering) - return 0; + return; phy_number = evt_data->start_phy_num + i; if (phy_number >= max_phys) @@ -4441,12 +4450,10 @@ static int leapraid_internal_sas_topo_chg_evt( if (evt_data->exp_status == LEAPRAID_EVT_SAS_TOPO_ES_NOT_RESPONDING && topo_node_exp) leapraid_exp_rm(adapter, sas_addr, card_port); - - return 0; } -static int leapraid_sas_topo_chg_evt(struct leapraid_adapter *adapter, - struct leapraid_fw_evt_work *fw_evt) +static void leapraid_sas_topo_chg_evt(struct leapraid_adapter *adapter, + struct leapraid_fw_evt_work *fw_evt) { struct leapraid_topo_node *topo_node_exp; struct leapraid_card_port *card_port; @@ -4459,13 +4466,13 @@ static int leapraid_sas_topo_chg_evt(struct leapraid_adapter *adapter, if (adapter->access_ctrl.shost_recovering || adapter->access_ctrl.host_removing || adapter->access_ctrl.pcie_recovering) - return 0; + return; evt_data = fw_evt->evt_data; leapraid_sas_host_add(adapter, adapter->dev_topo.card.phys_num > 0); if (fw_evt->ignore) - return 0; + return; phdl = le16_to_cpu(evt_data->exp_dev_hdl); card_port = leapraid_get_port_by_id(adapter, @@ -4473,7 +4480,7 @@ static int leapraid_sas_topo_chg_evt(struct leapraid_adapter *adapter, false); if (evt_data->exp_status == LEAPRAID_EVT_SAS_TOPO_ES_ADDED && leapraid_exp_add(adapter, phdl) != 0) - return 0; + return; spin_lock_irqsave(&adapter->dev_topo.topo_node_lock, flags); topo_node_exp = leapraid_exp_find_by_hdl(adapter, phdl); @@ -4487,13 +4494,13 @@ static int leapraid_sas_topo_chg_evt(struct leapraid_adapter *adapter, } else { spin_unlock_irqrestore(&adapter->dev_topo.topo_node_lock, flags); - return 0; + return; } spin_unlock_irqrestore(&adapter->dev_topo.topo_node_lock, flags); - return leapraid_internal_sas_topo_chg_evt(adapter, card_port, - topo_node_exp, fw_evt, - sas_addr, max_phys); + leapraid_internal_sas_topo_chg_evt(adapter, card_port, + topo_node_exp, fw_evt, + sas_addr, max_phys); } static void leapraid_reprobe_lun(struct scsi_device *sdev, void *no_uld_attach) @@ -4603,7 +4610,6 @@ static void leapraid_sas_pd_hide( } spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); if (starget) { - dev_info(&adapter->pdev->dev, "hide sas_dev, hdl=0x%x\n", hdl); starget_for_each_device(starget, (void *)LEAPRAID_NO_ULD_ATTACH_FLAG, leapraid_reprobe_lun); @@ -4623,7 +4629,6 @@ static void leapraid_sas_pd_expose( u16 hdl; hdl = le16_to_cpu(evt_data->phys_disk_dev_hdl); - if (!hdl || hdl > adapter->adapter_attr.features.max_dev_handle) { dev_warn(&adapter->pdev->dev, "%s: Invalid device handle\n", __func__); @@ -4652,8 +4657,6 @@ static void leapraid_sas_pd_expose( spin_unlock_irqrestore(&adapter->dev_topo.sas_dev_lock, flags); if (starget) { - dev_info(&adapter->pdev->dev, - "expose sas_dev, hdl=0x%x\n", hdl); starget_for_each_device(starget, LEAPRAID_ULD_ATTACH_FLAG, leapraid_reprobe_lun); @@ -4986,7 +4989,7 @@ static void leapraid_remove_unresp_sas_end_dev( leapraid_sdev_put(sas_dev); } - dev_info(&adapter->pdev->dev, + dev_warn(&adapter->pdev->dev, "Unresponsive SAS end devices removed\n"); } @@ -5011,7 +5014,7 @@ static void leapraid_remove_unresp_raid_volumes( leapraid_sas_volume_delete_by_ptr(adapter, raid_volume); } - dev_info(&adapter->pdev->dev, + dev_warn(&adapter->pdev->dev, "Unresponsive RAID volumes removed\n"); } @@ -5035,7 +5038,7 @@ static void leapraid_remove_unresp_sas_exp(struct leapraid_adapter *adapter) &head, list) leapraid_exp_node_rm(adapter, topo_node_exp); - dev_info(&adapter->pdev->dev, + dev_warn(&adapter->pdev->dev, "Unresponsive SAS expanders removed\n"); } @@ -5153,8 +5156,6 @@ static void leapraid_scan_exp_after_reset(struct leapraid_adapter *adapter) u16 hdl; u8 port_id; - dev_info(&adapter->pdev->dev, "Begin scanning expanders\n"); - cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (hdl = 0xFFFF, cfgp2.handle = hdl; !leapraid_op_config_page(adapter, &exp_p0, cfgp1, cfgp2, @@ -5185,8 +5186,6 @@ static void leapraid_scan_exp_after_reset(struct leapraid_adapter *adapter) exp_p0.sas_address)); } } - - dev_info(&adapter->pdev->dev, "Expanders scan complete\n"); } static void leapraid_scan_phy_disks_after_reset( @@ -5203,8 +5202,6 @@ static void leapraid_scan_phy_disks_after_reset( u16 hdl, parent_hdl; u64 sas_addr; - dev_info(&adapter->pdev->dev, "Begin scanning phys disk\n"); - cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (phys_disk_num = 0xFF, cfgp2.form_specific = phys_disk_num; !leapraid_op_config_page(adapter, &raidpd_p0, @@ -5253,8 +5250,6 @@ static void leapraid_scan_phy_disks_after_reset( } } } - - dev_info(&adapter->pdev->dev, "PHYs disk scan complete\n"); } static void leapraid_scan_vol_after_reset(struct leapraid_adapter *adapter) @@ -5279,7 +5274,6 @@ static void leapraid_scan_vol_after_reset(struct leapraid_adapter *adapter) return; } - dev_info(&adapter->pdev->dev, "Begin scanning volumes\n"); cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (hdl = 0xFFFF, cfgp2.handle = hdl; !leapraid_op_config_page(adapter, vol_p1, cfgp1, @@ -5316,8 +5310,6 @@ static void leapraid_scan_vol_after_reset(struct leapraid_adapter *adapter) kfree(vol_p0); kfree(vol_p1); - - dev_info(&adapter->pdev->dev, "Volumes scan complete\n"); } static void leapraid_scan_sas_dev_after_reset(struct leapraid_adapter *adapter) @@ -5330,9 +5322,6 @@ static void leapraid_scan_sas_dev_after_reset(struct leapraid_adapter *adapter) u64 sas_address; u8 port_id; - dev_info(&adapter->pdev->dev, - "Begin scanning SAS end devices\n"); - cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (hdl = 0xFFFF, cfgp2.handle = hdl; !leapraid_op_config_page(adapter, &sas_dev_p0, cfgp1, cfgp2, @@ -5382,14 +5371,10 @@ static void leapraid_scan_sas_dev_after_reset(struct leapraid_adapter *adapter) sas_dev_p0.sas_address)); } } - - dev_info(&adapter->pdev->dev, "SAS end devices scan complete\n"); } static void leapraid_scan_all_dev_after_reset(struct leapraid_adapter *adapter) { - dev_info(&adapter->pdev->dev, "Begin scanning devices\n"); - leapraid_sas_host_add(adapter, adapter->dev_topo.card.phys_num > 0); leapraid_scan_exp_after_reset(adapter); if (adapter->adapter_attr.raid_support) { @@ -5397,8 +5382,6 @@ static void leapraid_scan_all_dev_after_reset(struct leapraid_adapter *adapter) leapraid_scan_vol_after_reset(adapter); } leapraid_scan_sas_dev_after_reset(adapter); - - dev_info(&adapter->pdev->dev, "Devices scan complete\n"); } static void leapraid_hardreset_async_logic(struct leapraid_adapter *adapter) @@ -5426,6 +5409,7 @@ static int leapraid_send_enc_cmd(struct leapraid_adapter *adapter, void *req; bool reset_flg = false; int rc; + u16 smid; mutex_lock(&adapter->driver_cmds.enc_cmd.mutex); rc = leapraid_check_adapter_is_op(adapter, LEAPRAID_DB_WAIT_OP_SHORT, @@ -5434,21 +5418,19 @@ static int leapraid_send_enc_cmd(struct leapraid_adapter *adapter, goto unlock; adapter->driver_cmds.enc_cmd.status = LEAPRAID_CMD_PENDING; - req = leapraid_get_task_desc( - adapter, - adapter->driver_cmds.enc_cmd.inter_taskid); + smid = adapter->driver_cmds.enc_cmd.inter_taskid; + req = leapraid_get_task_desc(adapter, smid); memset(req, 0, LEAPRAID_REQUEST_SIZE); memcpy(req, sep_req, sizeof(struct leapraid_sep_req)); init_completion(&adapter->driver_cmds.enc_cmd.done); - leapraid_fire_task(adapter, - adapter->driver_cmds.enc_cmd.inter_taskid); + leapraid_fire_task(adapter, smid); wait_for_completion_timeout(&adapter->driver_cmds.enc_cmd.done, LEAPRAID_ENC_CMD_TIMEOUT * HZ); if (!(adapter->driver_cmds.enc_cmd.status & LEAPRAID_CMD_DONE)) { dev_err(&adapter->pdev->dev, "%s: SEP command timeout, status=0x%x\n", __func__, adapter->driver_cmds.enc_cmd.status); - leapraid_log_req_context(adapter, sep_req); + leapraid_log_req_context(adapter, smid, sep_req); reset_flg = leapraid_check_reset( adapter->driver_cmds.enc_cmd.status); @@ -5512,10 +5494,10 @@ static int leapraid_wait_adapter_recovery(struct leapraid_adapter *adapter) { unsigned long flags; - while (scsi_host_in_recovery(adapter->shost) || - adapter->access_ctrl.shost_recovering) { - if (adapter->access_ctrl.host_removing || - adapter->fw_evt_s.fw_evt_cleanup) { + while (leapraid_shost_in_recovery(adapter->shost) || + READ_ONCE(adapter->access_ctrl.shost_recovering)) { + if (READ_ONCE(adapter->access_ctrl.host_removing) || + READ_ONCE(adapter->fw_evt_s.fw_evt_cleanup)) { spin_lock_irqsave( &adapter->reset_desc.adapter_reset_lock, flags); @@ -5535,12 +5517,13 @@ static int leapraid_wait_adapter_recovery(struct leapraid_adapter *adapter) return -EFAULT; } - wait_event_timeout(adapter->access_ctrl.recovery_waitq, - !adapter->access_ctrl.shost_recovering || - adapter->access_ctrl.host_removing || - adapter->fw_evt_s.fw_evt_cleanup, - msecs_to_jiffies(1000)); + wait_event_timeout( + adapter->access_ctrl.recovery_waitq, + (!leapraid_shost_in_recovery(adapter->shost) && + !READ_ONCE(adapter->access_ctrl.shost_recovering)), + msecs_to_jiffies(1000)); } + return 0; } @@ -5625,7 +5608,6 @@ static void leapraid_sas_dev_stat_chg_evt( leapraid_get_port_by_id(adapter, event_data->physical_port, false)); - if (!sas_dev || !sas_dev->starget) goto out_unlock; @@ -5895,9 +5877,9 @@ static void leapraid_scan_dev_complete(struct leapraid_adapter *adapter) leapraid_fw_evt_put(fw_evt); } -static u8 leapraid_handle_scan_cb(struct leapraid_adapter *adapter, - struct leapraid_driver_cmd *cmd, - struct leapraid_rep *rep) +static void leapraid_handle_scan_cb(struct leapraid_adapter *adapter, + struct leapraid_driver_cmd *cmd, + struct leapraid_rep *rep) { u16 status; @@ -5905,21 +5887,18 @@ static u8 leapraid_handle_scan_cb(struct leapraid_adapter *adapter, status = le16_to_cpu(rep->adapter_status) & LEAPRAID_ADAPTER_STATUS_MASK; - if (status != LEAPRAID_ADAPTER_STATUS_SUCCESS) adapter->scan_dev_desc.scan_dev_failed = 1; if (!cmd->async_scan_dev) { complete(&cmd->done); - return 1; + return; } if (status == LEAPRAID_ADAPTER_STATUS_SUCCESS) leapraid_scan_dev_complete(adapter); else adapter->scan_dev_desc.scan_start_failed = status; - - return 1; } static void leapraid_handle_ctl_cb(struct leapraid_adapter *adapter, @@ -5933,7 +5912,6 @@ static void leapraid_handle_ctl_cb(struct leapraid_adapter *adapter, return; scsiio_reply = (struct leapraid_scsiio_rep *)rep; - if (!(scsiio_reply->scsi_state & LEAPRAID_SCSI_STATE_AUTOSENSE_VALID)) return; @@ -5976,10 +5954,11 @@ static bool leapraid_driver_cmds_done(struct leapraid_adapter *adapter, memcpy(&_sp_cmd->reply, leap_mpi_rep, reply_len); _sp_cmd->status |= LEAPRAID_CMD_REPLY_VALID; - if (_sp_cmd->cb_idx == LEAPRAID_SCAN_DEV_CB_IDX) - return leapraid_handle_scan_cb(adapter, - _sp_cmd, - leap_mpi_rep); + if (_sp_cmd->cb_idx == LEAPRAID_SCAN_DEV_CB_IDX) { + leapraid_handle_scan_cb(adapter, _sp_cmd, + leap_mpi_rep); + return true; + } if (_sp_cmd->cb_idx == LEAPRAID_CTL_CB_IDX) leapraid_handle_ctl_cb(adapter, leap_mpi_rep, taskid); @@ -6245,7 +6224,6 @@ static int leapraid_host_diag_reset(struct leapraid_adapter *adapter) { u32 host_diag; - dev_info(&adapter->pdev->dev, "Entering host diag reset!\n"); pci_cfg_access_lock(adapter->pdev); mutex_lock(&adapter->reset_desc.host_diag_mutex); @@ -6269,14 +6247,13 @@ static int leapraid_host_diag_reset(struct leapraid_adapter *adapter) goto out_failed; pci_cfg_access_unlock(adapter->pdev); - dev_info(&adapter->pdev->dev, "Host diag success!\n"); return 0; out_cleanup: mutex_unlock(&adapter->reset_desc.host_diag_mutex); out_failed: pci_cfg_access_unlock(adapter->pdev); - dev_info(&adapter->pdev->dev, "Host diag failed!\n"); + dev_err(&adapter->pdev->dev, "Host diag failed\n"); return -EFAULT; } @@ -6791,11 +6768,8 @@ static void leapraid_search_resp_sas_dev(struct leapraid_adapter *adapter) struct leapraid_sas_dev_p0 sas_dev_p0; u32 device_info; - dev_info(&adapter->pdev->dev, - "Begin searching for SAS end devices\n"); - if (list_empty(&adapter->dev_topo.sas_dev_list)) - goto exit_search; + return; cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (cfgp2.handle = 0xFFFF; @@ -6808,9 +6782,6 @@ static void leapraid_search_resp_sas_dev(struct leapraid_adapter *adapter) leapraid_mark_resp_sas_dev(adapter, &sas_dev_p0); } -exit_search: - dev_info(&adapter->pdev->dev, - "SAS end devices searching complete\n"); } static void leapraid_mark_resp_raid_volume(struct leapraid_adapter *adapter, @@ -6879,14 +6850,11 @@ static void leapraid_search_resp_raid_volume(struct leapraid_adapter *adapter) if (!adapter->adapter_attr.raid_support) return; - dev_info(&adapter->pdev->dev, - "Begin searching for RAID volumes\n"); - spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); is_empty = list_empty(&adapter->dev_topo.raid_volume_list); spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); if (is_empty) - goto exit_search; + return; cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (hdl = 0xFFFF, cfgp2.handle = hdl; @@ -6924,9 +6892,6 @@ static void leapraid_search_resp_raid_volume(struct leapraid_adapter *adapter) else set_bit(hdl, adapter->dev_topo.pd_hdls); } -exit_search: - dev_info(&adapter->pdev->dev, - "RAID volumes searching complete\n"); } static void leapraid_mark_resp_exp(struct leapraid_adapter *adapter, @@ -6987,10 +6952,8 @@ static void leapraid_search_resp_exp(struct leapraid_adapter *adapter) u16 hdl; u8 port; - dev_dbg(&adapter->pdev->dev, - "Begin searching for expanders\n"); if (list_empty(&adapter->dev_topo.exp_list)) - goto exit_search; + return; cfgp1.form = LEAPRAID_SAS_CFG_PGAD_GET_NEXT_LOOP; for (hdl = 0xFFFF, cfgp2.handle = hdl; @@ -7008,9 +6971,6 @@ static void leapraid_search_resp_exp(struct leapraid_adapter *adapter) LEAPRAID_DISABLE_MP_PORT_ID); leapraid_mark_resp_exp(adapter, &exp_p0); } -exit_search: - dev_dbg(&adapter->pdev->dev, - "Expander searching complete\n"); } void leapraid_wait_cmds_done(struct leapraid_adapter *adapter) @@ -7099,7 +7059,6 @@ int leapraid_hard_reset_handler(struct leapraid_adapter *adapter, dev_err(&adapter->pdev->dev, "Previous device scan failed or driver loading\n"); adapter->access_ctrl.host_removing = 1; - wake_up(&adapter->access_ctrl.recovery_waitq); rc = -EFAULT; goto out_cleanup; } @@ -7120,8 +7079,8 @@ int leapraid_hard_reset_handler(struct leapraid_adapter *adapter, leapraid_hardreset_barrier(adapter); } out_cleanup: - dev_info(&adapter->pdev->dev, "Hard reset %s\n", - rc == 0 ? "SUCCESS" : "FAILED"); + if (rc) + dev_err(&adapter->pdev->dev, "Hard reset failed\n"); spin_lock_irqsave(&adapter->reset_desc.adapter_reset_lock, flags); adapter->reset_desc.adapter_reset_results = rc; @@ -7358,8 +7317,8 @@ static void leapraid_map_msix_to_cpu(struct leapraid_adapter *adapter) { struct leapraid_int_rq *int_rq; const cpumask_t *affinity_mask; + int cpu; u32 i; - u16 cpu; if (!adapter->adapter_attr.rq_cnt) return; @@ -7383,6 +7342,7 @@ static void leapraid_map_msix_to_cpu(struct leapraid_adapter *adapter) int_rq->rq.msix_idx; } } + return; out_apply_irq_affinity: leapraid_cpus_on_irq(adapter); } @@ -7445,7 +7405,6 @@ static int leapraid_setup_irqs(struct leapraid_adapter *adapter) adapter->notification_desc.iopoll_qdex, adapter->notification_desc.iopoll_qdex, PCI_IRQ_MSIX | PCI_IRQ_AFFINITY, NULL); - if (rc < 0) { dev_err(&adapter->pdev->dev, "%d MSI/MSIX vectors allocated failed!\n", @@ -7478,7 +7437,6 @@ static int leapraid_setup_irqs(struct leapraid_adapter *adapter) IRQF_SHARED, adapter->notification_desc.int_rqs[i].rq.name, &adapter->notification_desc.int_rqs[i].rq); - if (rc) { dev_err(&adapter->pdev->dev, "MSI/MSIx: request_irq %s failed!\n", @@ -7536,8 +7494,6 @@ static int leapraid_setup_legacy_int(struct leapraid_adapter *adapter) static int leapraid_set_legacy_int(struct leapraid_adapter *adapter) { - int rc; - adapter->notification_desc.msix_cpu_map_sz = num_online_cpus(); adapter->notification_desc.msix_cpu_map = kzalloc(adapter->notification_desc.msix_cpu_map_sz, @@ -7560,9 +7516,7 @@ static int leapraid_set_legacy_int(struct leapraid_adapter *adapter) if (!adapter->notification_desc.int_rqs) return -ENOMEM; - rc = leapraid_setup_legacy_int(adapter); - - return rc; + return leapraid_setup_legacy_int(adapter); } static int leapraid_set_msix(struct leapraid_adapter *adapter) @@ -7670,9 +7624,7 @@ static int leapraid_set_msix(struct leapraid_adapter *adapter) return 0; apply_legacy_int: - rc = leapraid_set_legacy_int(adapter); - - return rc; + return leapraid_set_legacy_int(adapter); } static int leapraid_set_msi(struct leapraid_adapter *adapter) @@ -7801,9 +7753,7 @@ static int leapraid_set_msi(struct leapraid_adapter *adapter) return 0; apply_legacy_int: - rc = leapraid_set_legacy_int(adapter); - - return rc; + return leapraid_set_legacy_int(adapter); } static int leapraid_set_notification(struct leapraid_adapter *adapter) @@ -7886,18 +7836,16 @@ static int leapraid_adapter_unit_reset(struct leapraid_adapter *adapter) { int rc = 0; - dev_info(&adapter->pdev->dev, "fire unit reset\n"); writel(LEAPRAID_FUNC_ADAPTER_UNIT_RESET << LEAPRAID_DB_FUNC_SHIFT, &adapter->iomem_base->db); if (leapraid_db_wait_ack_and_clear_int(adapter)) rc = -EFAULT; if (!leapraid_wait_adapter_ready(adapter)) { - dev_info(&adapter->pdev->dev, "unit reset: FAILED\n"); + dev_err(&adapter->pdev->dev, "unit reset failed\n"); return -EFAULT; } - dev_info(&adapter->pdev->dev, "unit reset: SUCCESS\n"); return rc; } @@ -7905,7 +7853,6 @@ static int leapraid_make_adapter_ready(struct leapraid_adapter *adapter, enum reset_type type) { u32 db; - int rc; int count; if (!leapraid_pci_active(adapter)) @@ -7944,8 +7891,7 @@ static int leapraid_make_adapter_ready(struct leapraid_adapter *adapter, return 0; full_reset: - rc = leapraid_host_diag_reset(adapter); - return rc; + return leapraid_host_diag_reset(adapter); } static void leapraid_fw_log_exit(struct leapraid_adapter *adapter) @@ -8116,15 +8062,13 @@ int leapraid_internal_init_cmd_priv(struct leapraid_adapter *adapter, return 0; } -int leapraid_internal_exit_cmd_priv(struct leapraid_adapter *adapter, - struct leapraid_io_req_tracker *io_tracker) +void leapraid_internal_exit_cmd_priv(struct leapraid_adapter *adapter, + struct leapraid_io_req_tracker *io_tracker) { if (io_tracker && io_tracker->chain) dma_pool_free(adapter->mem_desc.sg_chain_pool, io_tracker->chain, io_tracker->chain_dma); - - return 0; } static int leapraid_request_host_memory(struct leapraid_adapter *adapter) @@ -8405,9 +8349,10 @@ static int leapraid_alloc_dev_topo_bitmaps(struct leapraid_adapter *adapter) { u16 pd_hdls_sz; - pd_hdls_sz = adapter->adapter_attr.features.max_dev_handle / - LEAPRAID_BITS_PER_BYTE; - pd_hdls_sz++; + pd_hdls_sz = + BITS_TO_LONGS( + adapter->adapter_attr.features.max_dev_handle + 1) * + sizeof(unsigned long); adapter->dev_topo.pd_hdls_sz = pd_hdls_sz; adapter->dev_topo.pd_hdls = @@ -8643,48 +8588,52 @@ static int leapraid_cfg_pages(struct leapraid_adapter *adapter) { union cfg_param_1 cfgp1 = {0}; union cfg_param_2 cfgp2 = {0}; - struct leapraid_manufacturing_p0 manufacturing_page0; - struct leapraid_bios_page3 bios_page3; - struct leapraid_bios_page2 bios_page2; + union { + struct leapraid_manufacturing_p0 manufacturing_page0; + struct leapraid_bios_page3 bios_page3; + struct leapraid_bios_page2 bios_page2; + } cfg_page; int rc; - rc = leapraid_op_config_page(adapter, &bios_page3, cfgp1, + rc = leapraid_op_config_page(adapter, &cfg_page.bios_page3, cfgp1, cfgp2, GET_BIOS_PG3); if (rc) return rc; - rc = leapraid_op_config_page(adapter, &bios_page2, cfgp1, - cfgp2, GET_BIOS_PG2); - if (rc) - return rc; + adapter->adapter_attr.bios_version = + le32_to_cpu(cfg_page.bios_page3.bios_version); - rc = leapraid_op_config_page(adapter, &manufacturing_page0, cfgp1, - cfgp2, GET_MANUFACTURING_PG0); + rc = leapraid_op_config_page(adapter, &cfg_page.bios_page2, cfgp1, + cfgp2, GET_BIOS_PG2); if (rc) return rc; - adapter->adapter_attr.bios_version = - le32_to_cpu(bios_page3.bios_version); - snprintf(adapter->adapter_attr.board_name, - sizeof(adapter->adapter_attr.board_name), - "%.*s", - (int)sizeof(manufacturing_page0.board_name), - manufacturing_page0.board_name); adapter->boot_devs.requested_boot_dev.form = - bios_page2.requested_boot_dev_form; + cfg_page.bios_page2.requested_boot_dev_form; memcpy(adapter->boot_devs.requested_boot_dev.pg_dev, - &bios_page2.requested_boot_dev, + &cfg_page.bios_page2.requested_boot_dev, LEAPRAID_BOOT_DEV_SIZE); adapter->boot_devs.requested_alt_boot_dev.form = - bios_page2.requested_alt_boot_dev_form; + cfg_page.bios_page2.requested_alt_boot_dev_form; memcpy(adapter->boot_devs.requested_alt_boot_dev.pg_dev, - &bios_page2.requested_alt_boot_dev, + &cfg_page.bios_page2.requested_alt_boot_dev, LEAPRAID_BOOT_DEV_SIZE); adapter->boot_devs.current_boot_dev.form = - bios_page2.current_boot_dev_form; + cfg_page.bios_page2.current_boot_dev_form; memcpy(adapter->boot_devs.current_boot_dev.pg_dev, - &bios_page2.current_boot_dev, + &cfg_page.bios_page2.current_boot_dev, LEAPRAID_BOOT_DEV_SIZE); + + rc = leapraid_op_config_page(adapter, &cfg_page.manufacturing_page0, + cfgp1, cfgp2, GET_MANUFACTURING_PG0); + if (rc) + return rc; + + snprintf(adapter->adapter_attr.board_name, + sizeof(adapter->adapter_attr.board_name), + "%.*s", + (int)sizeof(cfg_page.manufacturing_page0.board_name), + cfg_page.manufacturing_page0.board_name); return rc; } @@ -8793,8 +8742,6 @@ int leapraid_scan_dev(struct leapraid_adapter *adapter, bool async_scan_dev) out_cleanup: adapter->driver_cmds.scan_dev_cmd.status = LEAPRAID_CMD_NOT_USED; - dev_info(&adapter->pdev->dev, - "Device scan %s\n", rc == 0 ? "SUCCESS" : "FAILED"); return rc; } @@ -8936,11 +8883,7 @@ static int leapraid_make_adapter_available(struct leapraid_adapter *adapter) return 0; } - rc = leapraid_scan_dev(adapter, false); - if (rc) - return rc; - - return rc; + return leapraid_scan_dev(adapter, false); } int leapraid_ctrl_init(struct leapraid_adapter *adapter) @@ -9006,7 +8949,6 @@ int leapraid_ctrl_init(struct leapraid_adapter *adapter) out_free: adapter->access_ctrl.host_removing = 1; - wake_up(&adapter->access_ctrl.recovery_waitq); leapraid_fw_log_exit(adapter); leapraid_free_internal_scsi_cmd(adapter); leapraid_disable_controller(adapter); diff --git a/drivers/scsi/leapraid/leapraid_func.h b/drivers/scsi/leapraid/leapraid_func.h index df61bc2e994a..6cd550756501 100644 --- a/drivers/scsi/leapraid/leapraid_func.h +++ b/drivers/scsi/leapraid/leapraid_func.h @@ -51,11 +51,11 @@ #define LEAPRAID_BOARD_NAME_LENGTH 17 #define LEAPRAID_AUTHOR "LeapIO Inc." #define LEAPRAID_DESCRIPTION "LeapRAID Driver" -#define LEAPRAID_DRIVER_VERSION "2.00.01.02" +#define LEAPRAID_DRIVER_VERSION "2.00.01.05" #define LEAPRAID_MAJOR_VERSION 2 #define LEAPRAID_MINOR_VERSION 00 #define LEAPRAID_BUILD_VERSION 01 -#define LEAPRAID_RELEASE_VERSION 02 +#define LEAPRAID_RELEASE_VERSION 05 #define LEAPRAID_MSG_VERSION 0x1021 #define LEAPRAID_HEADER_VERSION 0x0000 @@ -127,7 +127,6 @@ /* SMP (Serial Management Protocol). */ #define LEAPRAID_SMP_PT_FLAG_SGL_PTR 0x80 -#define LEAPRAID_SMP_FN_REPORT_PHY_ERR_LOG 0x91 #define LEAPRAID_SMP_FRAME_HEADER_SIZE 4 #define LEAPRAID_SCSI_HOST_SHIFT 16 #define LEAPRAID_SCSI_DRIVER_SHIFT 24 @@ -171,13 +170,9 @@ /* Basic constants and limits. */ #define LEAPRAID_BUSY_LIMIT 1 -#define LEAPRAID_INDEX_FIRST 0 -#define LEAPRAID_BITS_PER_BYTE 8 #define LEAPRAID_INVALID_HOST_DIAG_VAL 0xFFFFFFFF /* Retry/Sleep configuration. */ -#define LEAPRAID_WRITE_SEQUENCE_OFFSET 0x4 -#define LEAPRAID_WRSEQ_KEY_VALUE_MASK 0xF #define LEAPRAID_WRSEQ_FLUSH_KEY_VALUE 0x0 #define LEAPRAID_WRSEQ_1ST_KEY_VALUE 0xF #define LEAPRAID_WRSEQ_2ND_KEY_VALUE 0x4 @@ -187,7 +182,6 @@ #define LEAPRAID_WRSEQ_6TH_KEY_VALUE 0xD #define LEAPRAID_UNLOCK_RETRY_LIMIT 20 #define LEAPRAID_UNLOCK_SLEEP_MS 100 -#define LEAPRAID_MSLEEP_SHORT_MS 50 #define LEAPRAID_MSLEEP_NORMAL_MS 100 #define LEAPRAID_MSLEEP_EXTRA_LONG_MS 500 #define LEAPRAID_IO_POLL_DELAY_US 500 @@ -198,7 +192,6 @@ #define LEAPRAID_INVALID_DEV_HANDLE 0xFFFF /* Commands queue depth. */ -#define LEAPRAID_COALESCING_DEPTH_MAX 256 #define LEAPRAID_DEFAULT_CMD_QD_OFFSET 64 #define LEAPRAID_REPLY_QD_ALIGNMENT 16 /* Task ID offset. */ @@ -224,7 +217,6 @@ #define LEAPRAID_CTL_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT #define LEAPRAID_SCAN_DEV_CMD_TIMEOUT 300 #define LEAPRAID_TIMESTAMP_SYNC_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT -#define LEAPRAID_RAID_ACTION_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT #define LEAPRAID_ENC_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT #define LEAPRAID_IO_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT #define LEAPRAID_NOTIFY_EVENT_CMD_TIMEOUT LEAPRAID_UNIFIED_TIMEOUT @@ -599,6 +591,7 @@ struct leapraid_fw_evt_work { * @leapraid_evt_masks: Array of event masks for filtering firmware events. */ struct leapraid_fw_evt_struct { + u32 leapraid_evt_masks[4]; char fw_evt_name[48]; struct workqueue_struct *fw_evt_thread; spinlock_t fw_evt_lock; /* protects firmware event */ @@ -606,7 +599,6 @@ struct leapraid_fw_evt_struct { struct leapraid_fw_evt_work *cur_evt; struct task_struct *cur_evt_task; u8 fw_evt_cleanup; - u32 leapraid_evt_masks[4]; }; /** @@ -1446,7 +1438,7 @@ int leapraid_get_volume_cap(struct leapraid_adapter *adapter, int leapraid_internal_init_cmd_priv( struct leapraid_adapter *adapter, struct leapraid_io_req_tracker *io_tracker); -int leapraid_internal_exit_cmd_priv( +void leapraid_internal_exit_cmd_priv( struct leapraid_adapter *adapter, struct leapraid_io_req_tracker *io_tracker); void leapraid_clean_active_fw_evt(struct leapraid_adapter *adapter); @@ -1517,7 +1509,7 @@ int leapraid_op_config_page(struct leapraid_adapter *adapter, void *cfgp, union cfg_param_1 cfgp1, union cfg_param_2 cfgp2, enum config_page_action cfg_op); -void leapraid_log_req_context(struct leapraid_adapter *adapter, +void leapraid_log_req_context(struct leapraid_adapter *adapter, u16 smid, const void *req_data); int leapraid_change_queue_depth(struct scsi_device *sdev, int qdepth); diff --git a/drivers/scsi/leapraid/leapraid_os.c b/drivers/scsi/leapraid/leapraid_os.c index c60c5d80c7b3..a69b8c6938a3 100644 --- a/drivers/scsi/leapraid/leapraid_os.c +++ b/drivers/scsi/leapraid/leapraid_os.c @@ -157,9 +157,8 @@ static int leapraid_tm_post_processing(struct leapraid_adapter *adapter, leapraid_sync_irqs(adapter, true); leapraid_unmask_int(adapter); - rc = leapraid_tm_cmd_map_status(adapter, channel, id, lun, type, - taskid_task); - return rc; + return leapraid_tm_cmd_map_status(adapter, channel, id, lun, type, + taskid_task); } static void leapraid_build_tm_req(struct leapraid_scsi_tm_req *scsi_tm_req, @@ -185,6 +184,7 @@ int leapraid_issue_tm(struct leapraid_adapter *adapter, u16 hdl, uint channel, struct leapraid_scsiio_req *scsiio_req; struct leapraid_io_req_tracker *io_req_tracker = NULL; u16 msix_task; + u16 taskid; bool issue_reset = false; u32 db; int rc; @@ -239,16 +239,15 @@ int leapraid_issue_tm(struct leapraid_adapter *adapter, u16 hdl, uint channel, msix_task = io_req_tracker->msix_io; else msix_task = 0; - leapraid_fire_hpr_task(adapter, - adapter->driver_cmds.tm_cmd.hp_taskid, - msix_task); + taskid = adapter->driver_cmds.tm_cmd.hp_taskid; + leapraid_fire_hpr_task(adapter, taskid, msix_task); wait_for_completion_timeout(&adapter->driver_cmds.tm_cmd.done, LEAPRAID_TM_CMD_TIMEOUT * HZ); if (!(adapter->driver_cmds.tm_cmd.status & LEAPRAID_CMD_DONE)) { dev_err(&adapter->pdev->dev, "%s: TM cmd timeout, status=0x%x\n", __func__, adapter->driver_cmds.tm_cmd.status); - leapraid_log_req_context(adapter, scsi_tm_req); + leapraid_log_req_context(adapter, taskid, scsi_tm_req); issue_reset = leapraid_check_reset( adapter->driver_cmds.tm_cmd.status); @@ -644,7 +643,6 @@ static void leapraid_probe_sas(struct leapraid_adapter *adapter) sas_dev->hdl, sas_dev->parent_sas_addr, sas_dev->card_port); - if (!added) goto remove_dev; @@ -805,10 +803,7 @@ static inline bool leapraid_is_scmd_permitted(struct leapraid_adapter *adapter, return false; opcode = scmd->cmnd[0]; - if (opcode == SYNCHRONIZE_CACHE || opcode == START_STOP) - return true; - - return false; + return opcode == SYNCHRONIZE_CACHE || opcode == START_STOP; } return true; } @@ -1101,13 +1096,15 @@ static int leapraid_error_handler(struct scsi_cmnd *scmd, out_eh_done: if (type == LEAPRAID_TM_TASKTYPE_ABORT_TASK) { - dev_info(&adapter->pdev->dev, - "EH ABORT result: %s, scmd=0x%p\n", - rc == SUCCESS ? "success" : "failed", scmd); + if (rc) + dev_err(&adapter->pdev->dev, + "EH ABORT result: failed, scmd=0x%p\n", + scmd); } else { - dev_info(&adapter->pdev->dev, - "EH %s result: %s, scmd=0x%p\n", - str, rc == SUCCESS ? "success" : "failed", scmd); + if (rc) + dev_err(&adapter->pdev->dev, + "EH %s result: failed, scmd=0x%p\n", + str, scmd); if (sas_dev) leapraid_sdev_put(sas_dev); } @@ -1161,8 +1158,10 @@ static int leapraid_eh_host_reset_handler(struct scsi_cmnd *scmd) rc = SUCCESS; out_host_reset_done: - dev_info(&adapter->pdev->dev, "EH HOST RESET result: %s, scmd=0x%p\n", - rc == SUCCESS ? "success" : "failed", scmd); + if (rc) + dev_err(&adapter->pdev->dev, + "EH HOST RESET result: failed, scmd=0x%p\n", + scmd); return rc; } @@ -1227,7 +1226,7 @@ static int leapraid_slave_alloc(struct scsi_device *sdev) return 0; } -static int leapraid_slave_cfg_volume(struct scsi_device *sdev) +static bool leapraid_slave_cfg_volume(struct scsi_device *sdev) { struct Scsi_Host *shost = sdev->host; struct leapraid_adapter *adapter = shost_priv(shost); @@ -1276,10 +1275,10 @@ static int leapraid_slave_cfg_volume(struct scsi_device *sdev) return 0; } -static int leapraid_slave_configure_extra(struct scsi_device *sdev, - struct leapraid_sas_dev **psas_dev, - u16 vol_hdl, u64 volume_wwid, - bool *is_target_ssp, int *qd) +static bool leapraid_slave_configure_extra(struct scsi_device *sdev, + struct leapraid_sas_dev **psas_dev, + u16 vol_hdl, u64 volume_wwid, + bool *is_target_ssp, int *qd) { struct leapraid_sas_dev *sas_dev; struct leapraid_sdev_priv *sdev_priv; @@ -1586,11 +1585,9 @@ static bool leapraid_scan_check_status(struct leapraid_adapter *adapter, wake_up(&adapter->scan_dev_desc.wait_driver_loading); adapter->scan_dev_desc.wait_scan_dev_done = 0; adapter->access_ctrl.host_removing = 1; - wake_up(&adapter->access_ctrl.recovery_waitq); return true; } - dev_info(&adapter->pdev->dev, "Device scan: SUCCESS\n"); adapter->driver_cmds.scan_dev_cmd.status = LEAPRAID_CMD_NOT_USED; leapraid_scan_dev_done(adapter); return true; @@ -2206,7 +2203,6 @@ static void leapraid_remove(struct pci_dev *pdev) !atomic_read(&adapter->overheat_desc.thermal_alert)); adapter->access_ctrl.host_removing = 1; - wake_up(&adapter->access_ctrl.recovery_waitq); leapraid_wait_cmds_done(adapter); @@ -2247,7 +2243,6 @@ static void leapraid_shutdown(struct pci_dev *pdev) } adapter->access_ctrl.host_removing = 1; - wake_up(&adapter->access_ctrl.recovery_waitq); leapraid_wait_cmds_done(adapter); leapraid_clean_active_fw_evt(adapter); leapraid_overheat_cleanup(adapter); @@ -2334,7 +2329,6 @@ static pci_ers_result_t leapraid_pci_slot_reset(struct pci_dev *pdev) dev_err(&pdev->dev, "%s PCI error slot reset\n", adapter->adapter_attr.name); - adapter->access_ctrl.pcie_recovering = 0; adapter->pdev = pdev; pci_restore_state(pdev); if (leapraid_set_pcie_and_notification(adapter)) { @@ -2344,13 +2338,15 @@ static pci_ers_result_t leapraid_pci_slot_reset(struct pci_dev *pdev) return PCI_ERS_RESULT_DISCONNECT; } + adapter->access_ctrl.pcie_recovering = 0; dev_info(&pdev->dev, "%s: Hard reset triggered by PCI slot reset\n", adapter->adapter_attr.name); dev_info(&adapter->pdev->dev, "%s: %d: call hard_reset\n", __func__, __LINE__); rc = leapraid_hard_reset_handler(adapter, FULL_RESET); - dev_info(&pdev->dev, "%s hard reset: %s\n", - adapter->adapter_attr.name, rc == 0 ? "success" : "failed"); + if (rc) + dev_err(&pdev->dev, "%s hard reset: failed\n", + adapter->adapter_attr.name); return rc == 0 ? PCI_ERS_RESULT_RECOVERED : PCI_ERS_RESULT_DISCONNECT; @@ -2367,6 +2363,7 @@ static void leapraid_pci_resume(struct pci_dev *pdev) } dev_err(&pdev->dev, "PCI error resume!\n"); + pci_aer_clear_nonfatal_status(pdev); leapraid_check_scheduled_fault_start(adapter); leapraid_fw_log_start(adapter); diff --git a/drivers/scsi/leapraid/leapraid_transport.c b/drivers/scsi/leapraid/leapraid_transport.c index 738bc55df416..e175ca4c1264 100644 --- a/drivers/scsi/leapraid/leapraid_transport.c +++ b/drivers/scsi/leapraid/leapraid_transport.c @@ -298,6 +298,7 @@ static int leapraid_transport_exp_report_manu(struct leapraid_adapter *adapter, dma_addr_t c2h_dma_addr; bool issue_reset = false; void *data_out = NULL; + u16 inter_taskid; size_t c2h_size; size_t h2c_size; void *psge; @@ -338,10 +339,8 @@ static int leapraid_transport_exp_report_manu(struct leapraid_adapter *adapter, rep_manu_request->allocated_response_length = 0; rep_manu_request->request_length = 0; - smp_passthrough_req = - leapraid_get_task_desc( - adapter, - adapter->driver_cmds.transport_cmd.inter_taskid); + inter_taskid = adapter->driver_cmds.transport_cmd.inter_taskid; + smp_passthrough_req = leapraid_get_task_desc(adapter, inter_taskid); memset(smp_passthrough_req, 0, sizeof(struct leapraid_smp_passthrough_req)); smp_passthrough_req->func = LEAPRAID_FUNC_SMP_PASSTHROUGH; @@ -354,8 +353,7 @@ static int leapraid_transport_exp_report_manu(struct leapraid_adapter *adapter, c2h_dma_addr, c2h_size); init_completion(&adapter->driver_cmds.transport_cmd.done); - leapraid_fire_task(adapter, - adapter->driver_cmds.transport_cmd.inter_taskid); + leapraid_fire_task(adapter, inter_taskid); wait_for_completion_timeout(&adapter->driver_cmds.transport_cmd.done, LEAPRAID_TRANSPORT_CMD_TIMEOUT * HZ); if (!(adapter->driver_cmds.transport_cmd.status & LEAPRAID_CMD_DONE)) { @@ -363,7 +361,8 @@ static int leapraid_transport_exp_report_manu(struct leapraid_adapter *adapter, dev_err(&adapter->pdev->dev, "%s: SMP passthrough timeout, st=0x%x\n", __func__, adapter->driver_cmds.transport_cmd.status); - leapraid_log_req_context(adapter, smp_passthrough_req); + leapraid_log_req_context(adapter, inter_taskid, + smp_passthrough_req); if (!(adapter->driver_cmds.transport_cmd.status & LEAPRAID_CMD_RESET)) issue_reset = true; @@ -1249,20 +1248,21 @@ static void leapraid_build_smp_task(struct leapraid_adapter *adapter, static int leapraid_send_smp_req(struct leapraid_adapter *adapter) { const struct leapraid_smp_passthrough_req *smp_passthrough_req; + u16 inter_taskid; dev_dbg(&adapter->pdev->dev, "%s: Sending smp request\n", __func__); - smp_passthrough_req = leapraid_get_task_desc( - adapter, adapter->driver_cmds.transport_cmd.inter_taskid); + inter_taskid = adapter->driver_cmds.transport_cmd.inter_taskid; + smp_passthrough_req = leapraid_get_task_desc(adapter, inter_taskid); init_completion(&adapter->driver_cmds.transport_cmd.done); - leapraid_fire_task(adapter, - adapter->driver_cmds.transport_cmd.inter_taskid); + leapraid_fire_task(adapter, inter_taskid); wait_for_completion_timeout(&adapter->driver_cmds.transport_cmd.done, LEAPRAID_TRANSPORT_CMD_TIMEOUT * HZ); if (!(adapter->driver_cmds.transport_cmd.status & LEAPRAID_CMD_DONE)) { dev_err(&adapter->pdev->dev, "%s: timeout, st=0x%x\n", __func__, adapter->driver_cmds.transport_cmd.status); - leapraid_log_req_context(adapter, smp_passthrough_req); + leapraid_log_req_context(adapter, inter_taskid, + smp_passthrough_req); if (!(adapter->driver_cmds.transport_cmd.status & LEAPRAID_CMD_RESET)) { dev_dbg(&adapter->pdev->dev, -- 2.25.1

2 1

[PATCH OLK-6.6] i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl
by Yin Tirui 02 Jul '26

02 Jul '26

From: Mingyu Wang <25181214217(a)stu.xidian.edu.cn> stable inclusion from stable-v6.6.143 commit aa6ef734016912653a909477fb30aeb66c98b3a2 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15650 CVE: CVE-2026-52948 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 617eb7c0961a8dfcfc811844a6396e406b2923ea upstream. While fuzzing with Syzkaller, a persistent `schedule_timeout: wrong timeout value` warning was observed, accompanied by SMBus controller state machine corruption. The I2C_TIMEOUT ioctl accepts a user-provided timeout in multiples of 10 ms. The user argument is checked against INT_MAX, but it is subsequently multiplied by 10 before being passed to msecs_to_jiffies(). A malicious user can pass a large value (e.g., 429496729) that passes the `arg > INT_MAX` check but overflows when multiplied by 10. This results in a truncated 32-bit unsigned value that bypasses the internal `(int)m < 0` check in `msecs_to_jiffies()`. The truncated value is then assigned to `client->adapter->timeout` (a signed 32-bit int), which is reinterpreted as a negative number. When passed to wait_for_completion_timeout(), this negative value undergoes sign extension to a 64-bit unsigned long, triggering the `schedule_timeout` warning and causing premature returns. This leaves the SMBus state machine in an unrecoverable state, constituting a local Denial of Service (DoS). Fix this by bounding the user argument to `INT_MAX / 10`. Signed-off-by: Mingyu Wang <25181214217(a)stu.xidian.edu.cn> [wsa: move the comment as well] Signed-off-by: Wolfram Sang <wsa+renesas(a)sang-engineering.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yin Tirui <yintirui(a)huawei.com> --- drivers/i2c/i2c-dev.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c index 7d337380a05d..2ee07fc675d6 100644 --- a/drivers/i2c/i2c-dev.c +++ b/drivers/i2c/i2c-dev.c @@ -476,12 +476,13 @@ static long i2cdev_ioctl(struct file *file, unsigned int cmd, unsigned long arg) client->adapter->retries = arg; break; case I2C_TIMEOUT: - if (arg > INT_MAX) + /* + * For historical reasons, user-space sets the timeout value in + * units of 10 ms. + */ + if (arg > INT_MAX / 10) return -EINVAL; - /* For historical reasons, user-space sets the timeout - * value in units of 10 ms. - */ client->adapter->timeout = msecs_to_jiffies(arg * 10); break; default: -- 2.43.0

2 1

[PATCH OLK-5.10] ALSA: usb-audio: Bound MIDI endpoint descriptor scans
by Lin Ruifeng 02 Jul '26

02 Jul '26

From: Cássio Gabriel <cassiogabrielcontato(a)gmail.com> stable inclusion from stable-v5.10.258 commit e2f1260a056eb3215c13c48c5378f3e4112dc3af category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15665 CVE: CVE-2026-52963 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit d6854daa67be623860f4e1873fd3d3c275aba4ed upstream. snd_usbmidi_get_ms_info() validates the internal MIDIStreaming endpoint descriptor size before using baAssocJackID[], but the descriptor walker can still return a class-specific endpoint descriptor whose bLength exceeds the remaining bytes in the endpoint-extra scan. That leaves later flexible-array reads bounded by bLength, but not by the remaining bytes in the endpoint-extra scan. Stop walking when bLength is zero or extends past the remaining endpoint-extra scan. Fixes: 5c6cd7021a05 ("ALSA: usb-audio: Fix case when USB MIDI interface has more than one extra endpoint descriptor") Cc: stable(a)vger.kernel.org Signed-off-by: Cássio Gabriel <cassiogabrielcontato(a)gmail.com> Link: https://patch.msgid.link/20260507-usb-midi-endpoint-scan-bounds-v1-1-329d73… Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- sound/usb/midi.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/sound/usb/midi.c b/sound/usb/midi.c index b02e1a33304f..12c35cb0a707 100644 --- a/sound/usb/midi.c +++ b/sound/usb/midi.c @@ -1838,15 +1838,17 @@ static struct usb_ms_endpoint_descriptor *find_usb_ms_endpoint_descriptor( while (extralen > 3) { struct usb_ms_endpoint_descriptor *ms_ep = (struct usb_ms_endpoint_descriptor *)extra; + int length = ms_ep->bLength; - if (ms_ep->bLength > 3 && + if (!length || length > extralen) + break; + + if (length > 3 && ms_ep->bDescriptorType == USB_DT_CS_ENDPOINT && ms_ep->bDescriptorSubtype == UAC_MS_GENERAL) return ms_ep; - if (!extra[0]) - break; - extralen -= extra[0]; - extra += extra[0]; + extralen -= length; + extra += length; } return NULL; } -- 2.34.1

2 1

[PATCH OLK-6.6] bus: fsl-mc: use generic driver_override infrastructure
by Lin Ruifeng 02 Jul '26

02 Jul '26

From: Danilo Krummrich <dakr(a)kernel.org> stable inclusion from stable-v6.12.91 commit 4911b836f35c034c36f102db4ecbe339b38e7d1d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15812 CVE: CVE-2026-53115 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 6c8dfb0362732bf1e4829867a2a5239fedc592d0 ] When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF. Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally. Note that calling match() from __driver_attach() without the device lock held is intentional. [1] Tested-by: Ioana Ciornei <ioana.ciornei(a)nxp.com> Acked-by: Ioana Ciornei <ioana.ciornei(a)nxp.com> Acked-by: Christophe Leroy (CS GROUP) <chleroy(a)kernel.org> Link: https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/ [1] Reported-by: Gui-Dong Han <hanguidong02(a)gmail.com> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220789 Fixes: 1f86a00c1159 ("bus/fsl-mc: add support for 'driver_override' in the mc-bus") Link: https://patch.msgid.link/20260324005919.2408620-3-dakr@kernel.org Signed-off-by: Danilo Krummrich <dakr(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/bus/fsl-mc/fsl-mc-bus.c [Context Conflicts] Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/bus/fsl-mc/fsl-mc-bus.c | 43 +++++-------------------------- drivers/vfio/fsl-mc/vfio_fsl_mc.c | 4 +-- include/linux/fsl/mc.h | 4 --- 3 files changed, 8 insertions(+), 43 deletions(-) diff --git a/drivers/bus/fsl-mc/fsl-mc-bus.c b/drivers/bus/fsl-mc/fsl-mc-bus.c index 0806c8215675..4e45d92060fe 100644 --- a/drivers/bus/fsl-mc/fsl-mc-bus.c +++ b/drivers/bus/fsl-mc/fsl-mc-bus.c @@ -86,12 +86,16 @@ static int fsl_mc_bus_match(struct device *dev, struct device_driver *drv) struct fsl_mc_device *mc_dev = to_fsl_mc_device(dev); struct fsl_mc_driver *mc_drv = to_fsl_mc_driver(drv); bool found = false; + int ret; /* When driver_override is set, only bind to the matching driver */ - if (mc_dev->driver_override) { - found = !strcmp(mc_dev->driver_override, mc_drv->driver.name); + ret = device_match_driver_override(dev, drv); + if (ret > 0) { + found = true; goto out; } + if (ret == 0) + goto out; if (!mc_drv->match_id_table) goto out; @@ -180,39 +184,8 @@ static ssize_t modalias_show(struct device *dev, struct device_attribute *attr, } static DEVICE_ATTR_RO(modalias); -static ssize_t driver_override_store(struct device *dev, - struct device_attribute *attr, - const char *buf, size_t count) -{ - struct fsl_mc_device *mc_dev = to_fsl_mc_device(dev); - int ret; - - if (WARN_ON(dev->bus != &fsl_mc_bus_type)) - return -EINVAL; - - ret = driver_set_override(dev, &mc_dev->driver_override, buf, count); - if (ret) - return ret; - - return count; -} - -static ssize_t driver_override_show(struct device *dev, - struct device_attribute *attr, char *buf) -{ - struct fsl_mc_device *mc_dev = to_fsl_mc_device(dev); - ssize_t len; - - device_lock(dev); - len = snprintf(buf, PAGE_SIZE, "%s\n", mc_dev->driver_override); - device_unlock(dev); - return len; -} -static DEVICE_ATTR_RW(driver_override); - static struct attribute *fsl_mc_dev_attrs[] = { &dev_attr_modalias.attr, - &dev_attr_driver_override.attr, NULL, }; @@ -315,6 +288,7 @@ ATTRIBUTE_GROUPS(fsl_mc_bus); struct bus_type fsl_mc_bus_type = { .name = "fsl-mc", + .driver_override = true, .match = fsl_mc_bus_match, .uevent = fsl_mc_bus_uevent, .dma_configure = fsl_mc_dma_configure, @@ -924,9 +898,6 @@ static struct notifier_block fsl_mc_nb; */ void fsl_mc_device_remove(struct fsl_mc_device *mc_dev) { - kfree(mc_dev->driver_override); - mc_dev->driver_override = NULL; - /* * The device-specific remove callback will get invoked by device_del() */ diff --git a/drivers/vfio/fsl-mc/vfio_fsl_mc.c b/drivers/vfio/fsl-mc/vfio_fsl_mc.c index f65d91c01f2e..03600872c480 100644 --- a/drivers/vfio/fsl-mc/vfio_fsl_mc.c +++ b/drivers/vfio/fsl-mc/vfio_fsl_mc.c @@ -430,9 +430,7 @@ static int vfio_fsl_mc_bus_notifier(struct notifier_block *nb, if (action == BUS_NOTIFY_ADD_DEVICE && vdev->mc_dev == mc_cont) { - mc_dev->driver_override = kasprintf(GFP_KERNEL, "%s", - vfio_fsl_mc_ops.name); - if (!mc_dev->driver_override) + if (device_set_driver_override(dev, vfio_fsl_mc_ops.name)) dev_warn(dev, "VFIO_FSL_MC: Setting driver override for device in dprc %s failed\n", dev_name(&mc_cont->dev)); else diff --git a/include/linux/fsl/mc.h b/include/linux/fsl/mc.h index a1b3de87a3d1..7a19f5a1cbcf 100644 --- a/include/linux/fsl/mc.h +++ b/include/linux/fsl/mc.h @@ -178,9 +178,6 @@ struct fsl_mc_obj_desc { * @regions: pointer to array of MMIO region entries * @irqs: pointer to array of pointers to interrupts allocated to this device * @resource: generic resource associated with this MC object device, if any. - * @driver_override: driver name to force a match; do not set directly, - * because core frees it; use driver_set_override() to - * set or clear it. * * Generic device object for MC object devices that are "attached" to a * MC bus. @@ -214,7 +211,6 @@ struct fsl_mc_device { struct fsl_mc_device_irq **irqs; struct fsl_mc_resource *resource; struct device_link *consumer_link; - const char *driver_override; }; #define to_fsl_mc_device(_dev) \ -- 2.34.1

2 1

[PATCH OLK-6.6] iommu/amd: Fix clone_alias() to use the original device's devid
by Zhang Yuwei 02 Jul '26

02 Jul '26

From: Vasant Hegde <vasant.hegde(a)amd.com> mainline inclusion from mainline-v7.1-rc1 commit faad224fe0f0857a04ff2eb3c90f0de57f47d0f3 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15755 CVE: CVE-2026-53053 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Currently clone_alias() assumes first argument (pdev) is always the original device pointer. This function is called by pci_for_each_dma_alias() which based on topology decides to send original or alias device details in first argument. This meant that the source devid used to look up and copy the DTE may be incorrect, leading to wrong or stale DTE entries being propagated to alias device. Fix this by passing the original pdev as the opaque data argument to both the direct clone_alias() call and pci_for_each_dma_alias(). Inside clone_alias(), retrieve the original device from data and compute devid from it. Fixes: 3332364e4ebc ("iommu/amd: Support multiple PCI DMA aliases in device table") Signed-off-by: Vasant Hegde <vasant.hegde(a)amd.com> Signed-off-by: Joerg Roedel <joerg.roedel(a)amd.com> Conflicts: drivers/iommu/amd/iommu.c [context conflict] Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> --- drivers/iommu/amd/iommu.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c index 72022dfb1c0d..d0ffc64204fc 100644 --- a/drivers/iommu/amd/iommu.c +++ b/drivers/iommu/amd/iommu.c @@ -353,11 +353,12 @@ struct iommu_dev_data *search_dev_data(struct amd_iommu *iommu, u16 devid) return NULL; } -static int clone_alias(struct pci_dev *pdev, u16 alias, void *data) +static int clone_alias(struct pci_dev *pdev_origin, u16 alias, void *data) { struct dev_table_entry new; struct amd_iommu *iommu; struct iommu_dev_data *dev_data, *alias_data; + struct pci_dev *pdev = data; u16 devid = pci_dev_id(pdev); int ret = 0; @@ -404,9 +405,9 @@ static void clone_aliases(struct amd_iommu *iommu, struct device *dev) * part of the PCI DMA aliases if it's bus differs * from the original device. */ - clone_alias(pdev, iommu->pci_seg->alias_table[pci_dev_id(pdev)], NULL); + clone_alias(pdev, iommu->pci_seg->alias_table[pci_dev_id(pdev)], pdev); - pci_for_each_dma_alias(pdev, clone_alias, NULL); + pci_for_each_dma_alias(pdev, clone_alias, pdev); } static void setup_aliases(struct amd_iommu *iommu, struct device *dev) -- 2.22.0

2 1

[PATCH OLK-6.6] ALSA: timer: Fix UAF at snd_timer_user_params()
by Zhang Yuwei 02 Jul '26

02 Jul '26

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v5.10.259 commit 92ad2d7f80cad43b046f093e808e11fe919d304a category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15878 CVE: CVE-2026-53192 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 053a401b592be424fea9d57c789f66cd5d8cec11 upstream. At releasing a timer object, e.g. when a userspace timer (CONFIG_SND_UTIMER) gets closed and snd_timer_free() is called, it tries to detach the timer instances and release the resources. However, it's still possible that other in-flight tasks are holding the timer instance where the to-be-deleted timer object is associated, and this may lead to racy accesses. Fortunately, most of ioctls dealing with the timer instance list already have the protection with register_mutex, and this also avoids such races. But, SNDRV_TIMER_IOCTL_PARAMS isn't protected, hence the concurrent ioctl may lead to use-after-free. This patch just adds the guard with register_mutex to protect snd_timer_user_params() for covering the code path as a quick workaround. It's no hot-path but rather a rarely issued ioctl, so the performance penalty doesn't matter. Reported-by: Kyle Zeng <kylebot(a)openai.com> Tested-by: Kyle Zeng <kylebot(a)openai.com> Cc: <stable(a)vger.kernel.org> Link: https://patch.msgid.link/20260606161145.1933447-2-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lin Yujun <linyujun809(a)h-partners.com> --- sound/core/timer.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sound/core/timer.c b/sound/core/timer.c index 230babace502..e7cf47104257 100644 --- a/sound/core/timer.c +++ b/sound/core/timer.c @@ -1850,6 +1850,7 @@ static int snd_timer_user_params(struct file *file, struct snd_timer *t; int err; + guard(mutex)(&register_mutex); tu = file->private_data; if (!tu->timeri) return -EBADFD; -- 2.22.0

2 1

[PATCH OLK-5.10] ALSA: timer: Fix UAF at snd_timer_user_params()
by Zhang Yuwei 02 Jul '26

02 Jul '26

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v5.10.259 commit 92ad2d7f80cad43b046f093e808e11fe919d304a category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15878 CVE: CVE-2026-53192 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 053a401b592be424fea9d57c789f66cd5d8cec11 upstream. At releasing a timer object, e.g. when a userspace timer (CONFIG_SND_UTIMER) gets closed and snd_timer_free() is called, it tries to detach the timer instances and release the resources. However, it's still possible that other in-flight tasks are holding the timer instance where the to-be-deleted timer object is associated, and this may lead to racy accesses. Fortunately, most of ioctls dealing with the timer instance list already have the protection with register_mutex, and this also avoids such races. But, SNDRV_TIMER_IOCTL_PARAMS isn't protected, hence the concurrent ioctl may lead to use-after-free. This patch just adds the guard with register_mutex to protect snd_timer_user_params() for covering the code path as a quick workaround. It's no hot-path but rather a rarely issued ioctl, so the performance penalty doesn't matter. Reported-by: Kyle Zeng <kylebot(a)openai.com> Tested-by: Kyle Zeng <kylebot(a)openai.com> Cc: <stable(a)vger.kernel.org> Link: https://patch.msgid.link/20260606161145.1933447-2-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lin Yujun <linyujun809(a)h-partners.com> --- sound/core/timer.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sound/core/timer.c b/sound/core/timer.c index 708c9a46eefe..7b91c11241f5 100644 --- a/sound/core/timer.c +++ b/sound/core/timer.c @@ -1842,6 +1842,7 @@ static int snd_timer_user_params(struct file *file, struct snd_timer *t; int err; + guard(mutex)(&register_mutex); tu = file->private_data; if (!tu->timeri) return -EBADFD; -- 2.22.0

2 1

[PATCH OLK-5.10] ALSA: timer: Fix UAF at snd_timer_user_params()
by Zhang Yuwei 02 Jul '26

02 Jul '26

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v5.10.259 commit 92ad2d7f80cad43b046f093e808e11fe919d304a category: bugfix bugzilla: NA CVE: CVE-2026-53192 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 053a401b592be424fea9d57c789f66cd5d8cec11 upstream. At releasing a timer object, e.g. when a userspace timer (CONFIG_SND_UTIMER) gets closed and snd_timer_free() is called, it tries to detach the timer instances and release the resources. However, it's still possible that other in-flight tasks are holding the timer instance where the to-be-deleted timer object is associated, and this may lead to racy accesses. Fortunately, most of ioctls dealing with the timer instance list already have the protection with register_mutex, and this also avoids such races. But, SNDRV_TIMER_IOCTL_PARAMS isn't protected, hence the concurrent ioctl may lead to use-after-free. This patch just adds the guard with register_mutex to protect snd_timer_user_params() for covering the code path as a quick workaround. It's no hot-path but rather a rarely issued ioctl, so the performance penalty doesn't matter. Reported-by: Kyle Zeng <kylebot(a)openai.com> Tested-by: Kyle Zeng <kylebot(a)openai.com> Cc: <stable(a)vger.kernel.org> Link: https://patch.msgid.link/20260606161145.1933447-2-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lin Yujun <linyujun809(a)h-partners.com> --- sound/core/timer.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sound/core/timer.c b/sound/core/timer.c index 708c9a46eefe..7b91c11241f5 100644 --- a/sound/core/timer.c +++ b/sound/core/timer.c @@ -1842,6 +1842,7 @@ static int snd_timer_user_params(struct file *file, struct snd_timer *t; int err; + guard(mutex)(&register_mutex); tu = file->private_data; if (!tu->timeri) return -EBADFD; -- 2.22.0

2 1

[PATCH OLK-5.10] ALSA: timer: Fix UAF at snd_timer_user_params()
by Zhang Yuwei 02 Jul '26

02 Jul '26

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v5.10.259 commit 92ad2d7f80cad43b046f093e808e11fe919d304a category: bugfix bugzilla: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 053a401b592be424fea9d57c789f66cd5d8cec11 upstream. At releasing a timer object, e.g. when a userspace timer (CONFIG_SND_UTIMER) gets closed and snd_timer_free() is called, it tries to detach the timer instances and release the resources. However, it's still possible that other in-flight tasks are holding the timer instance where the to-be-deleted timer object is associated, and this may lead to racy accesses. Fortunately, most of ioctls dealing with the timer instance list already have the protection with register_mutex, and this also avoids such races. But, SNDRV_TIMER_IOCTL_PARAMS isn't protected, hence the concurrent ioctl may lead to use-after-free. This patch just adds the guard with register_mutex to protect snd_timer_user_params() for covering the code path as a quick workaround. It's no hot-path but rather a rarely issued ioctl, so the performance penalty doesn't matter. Reported-by: Kyle Zeng <kylebot(a)openai.com> Tested-by: Kyle Zeng <kylebot(a)openai.com> Cc: <stable(a)vger.kernel.org> Link: https://patch.msgid.link/20260606161145.1933447-2-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lin Yujun <linyujun809(a)h-partners.com> --- sound/core/timer.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sound/core/timer.c b/sound/core/timer.c index 708c9a46eefe..7b91c11241f5 100644 --- a/sound/core/timer.c +++ b/sound/core/timer.c @@ -1842,6 +1842,7 @@ static int snd_timer_user_params(struct file *file, struct snd_timer *t; int err; + guard(mutex)(&register_mutex); tu = file->private_data; if (!tu->timeri) return -EBADFD; -- 2.22.0

2 1

[PATCH OLK-6.6] ALSA: timer: Fix UAF at snd_timer_user_params()
by Zhang Yuwei 02 Jul '26

02 Jul '26

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v5.10.259 commit 92ad2d7f80cad43b046f093e808e11fe919d304a category: bugfix bugzilla: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 053a401b592be424fea9d57c789f66cd5d8cec11 upstream. At releasing a timer object, e.g. when a userspace timer (CONFIG_SND_UTIMER) gets closed and snd_timer_free() is called, it tries to detach the timer instances and release the resources. However, it's still possible that other in-flight tasks are holding the timer instance where the to-be-deleted timer object is associated, and this may lead to racy accesses. Fortunately, most of ioctls dealing with the timer instance list already have the protection with register_mutex, and this also avoids such races. But, SNDRV_TIMER_IOCTL_PARAMS isn't protected, hence the concurrent ioctl may lead to use-after-free. This patch just adds the guard with register_mutex to protect snd_timer_user_params() for covering the code path as a quick workaround. It's no hot-path but rather a rarely issued ioctl, so the performance penalty doesn't matter. Reported-by: Kyle Zeng <kylebot(a)openai.com> Tested-by: Kyle Zeng <kylebot(a)openai.com> Cc: <stable(a)vger.kernel.org> Link: https://patch.msgid.link/20260606161145.1933447-2-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lin Yujun <linyujun809(a)h-partners.com> --- sound/core/timer.c | 1 + 1 file changed, 1 insertion(+) diff --git a/sound/core/timer.c b/sound/core/timer.c index 230babace502..e7cf47104257 100644 --- a/sound/core/timer.c +++ b/sound/core/timer.c @@ -1850,6 +1850,7 @@ static int snd_timer_user_params(struct file *file, struct snd_timer *t; int err; + guard(mutex)(&register_mutex); tu = file->private_data; if (!tu->timeri) return -EBADFD; -- 2.22.0

2 1

[PATCH OLK-6.6] cgroup/psi: Set of->priv to NULL upon file release
by Cai Xinchen 02 Jul '26

02 Jul '26

From: Chen Ridong <chenridong(a)huawei.com> mainline inclusion from mainline-v6.17-rc7 commit 94a4acfec14615e971eb2c9e1fa6c992c85ff6c6 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15693 CVE: CVE-2026-52991 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Setting of->priv to NULL when the file is released enables earlier bug detection. This allows potential bugs to manifest as NULL pointer dereferences rather than use-after-free errors[1], which are generally more difficult to diagnose. [1] https://lore.kernel.org/cgroups/38ef3ff9-b380-44f0-9315-8b3714b0948d@huawei… Signed-off-by: Chen Ridong <chenridong(a)huawei.com> Signed-off-by: Tejun Heo <tj(a)kernel.org> Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- kernel/cgroup/cgroup.c | 1 + 1 file changed, 1 insertion(+) diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c index 6949584610a5..7e08f494c61c 100644 --- a/kernel/cgroup/cgroup.c +++ b/kernel/cgroup/cgroup.c @@ -4215,6 +4215,7 @@ static void cgroup_file_release(struct kernfs_open_file *of) cft->release(of); put_cgroup_ns(ctx->ns); kfree(ctx); + of->priv = NULL; } static ssize_t cgroup_file_write(struct kernfs_open_file *of, char *buf, -- 2.18.0.huawei.25

2 1

[PATCH openEuler-1.0-LTS] RDMA/umem: Fix truncation for block sizes >= 4G
by Xia Fukun 01 Jul '26

01 Jul '26

From: Jason Gunthorpe <jgg(a)nvidia.com> mainline inclusion from mainline-v7.1 commit 15fe76e23615f502d051ef0768f86babaf08746c category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15827 CVE: CVE-2026-53133 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When the iommu is used the linearization of the mapping can give a single block that is very large split across multiple SG entries. When __rdma_block_iter_next() reassembles the split SG entries it is overflowing the 32 bit stack values and computed the wrong DMA addresses for blocks after the truncation. Use the right types to hold DMA addresses. Link: https://patch.msgid.link/r/1-v1-88303e9e509f+f7-ib_umem_types_jgg@nvidia.com Cc: stable(a)vger.kernel.org Fixes: a808273a495c ("RDMA/verbs: Add a DMA iterator to return aligned contiguous memory blocks") Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Conflicts: drivers/infiniband/core/iter.c drivers/infiniband/core/verbs.c [Newer versions moved this function to iter.c, this version adapts the changes in verbs.c.] Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- drivers/infiniband/core/verbs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c index 47a969a7f6f6..1b87b8d02cf9 100644 --- a/drivers/infiniband/core/verbs.c +++ b/drivers/infiniband/core/verbs.c @@ -2644,7 +2644,7 @@ EXPORT_SYMBOL(__rdma_block_iter_start); bool __rdma_block_iter_next(struct ib_block_iter *biter) { - unsigned int block_offset; + dma_addr_t block_offset; if (!biter->__sg_nents || !biter->__sg) return false; -- 2.34.1

2 1

[patch OLK-6.6] cgroup/psi: Set of->priv to NULL upon file release
by Cai Xinchen 01 Jul '26

01 Jul '26

From: Chen Ridong <chenridong(a)huawei.com> mainline inclusion from mainline-v6.17-rc7 commit 94a4acfec14615e971eb2c9e1fa6c992c85ff6c6 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15693 CVE: CVE-2026-52991 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Setting of->priv to NULL when the file is released enables earlier bug detection. This allows potential bugs to manifest as NULL pointer dereferences rather than use-after-free errors[1], which are generally more difficult to diagnose. [1] https://lore.kernel.org/cgroups/38ef3ff9-b380-44f0-9315-8b3714b0948d@huawei… Signed-off-by: Chen Ridong <chenridong(a)huawei.com> Signed-off-by: Tejun Heo <tj(a)kernel.org> Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- kernel/cgroup/cgroup.c | 1 + 1 file changed, 1 insertion(+) diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c index 6949584610a5..7e08f494c61c 100644 --- a/kernel/cgroup/cgroup.c +++ b/kernel/cgroup/cgroup.c @@ -4215,6 +4215,7 @@ static void cgroup_file_release(struct kernfs_open_file *of) cft->release(of); put_cgroup_ns(ctx->ns); kfree(ctx); + of->priv = NULL; } static ssize_t cgroup_file_write(struct kernfs_open_file *of, char *buf, -- 2.18.0.huawei.25

1 0

[PATCH openEuler-1.0-LTS] IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
by Xia Fukun 01 Jul '26

01 Jul '26

From: Michael Bommarito <michael.bommarito(a)gmail.com> mainline inclusion from mainline-v7.1 commit 29e7b925ae6df64894e82ab6419994dc25580a8a category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15861 CVE: CVE-2026-53176 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added. Fixes: b8d26b3be8b3 ("iser-target: Add iSCSI Extensions for RDMA (iSER) target driver") Link: https://patch.msgid.link/r/20260602194642.2273217-1-michael.bommarito@gmail… Cc: stable(a)vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Conflicts: drivers/infiniband/ulp/isert/ib_isert.c [Context differences, unrelated to the fix patch.] Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- drivers/infiniband/ulp/isert/ib_isert.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c index f39670c5c25c..97119e8e0751 100644 --- a/drivers/infiniband/ulp/isert/ib_isert.c +++ b/drivers/infiniband/ulp/isert/ib_isert.c @@ -1473,6 +1473,12 @@ isert_login_recv_done(struct ib_cq *cq, struct ib_wc *wc) ib_dma_sync_single_for_cpu(ib_dev, isert_conn->login_req_dma, ISER_RX_PAYLOAD_SIZE, DMA_FROM_DEVICE); + if (unlikely(wc->byte_len < ISER_HEADERS_LEN)) { + isert_dbg("login request length %u is too short\n", + wc->byte_len); + return; + } + isert_conn->login_req_len = wc->byte_len - ISER_HEADERS_LEN; if (isert_conn->conn) { -- 2.34.1

2 1

[PATCH OLK-6.6] ipc/shm: serialize orphan cleanup with shm_nattch updates
by Fanhua Li 01 Jul '26

01 Jul '26

From: Yilin Zhu <zylzyl2333(a)gmail.com> stable inclusion from stable-v5.10.259 commit b1e9aef48e4d8a0c1b54fb913077b0824ed7d650 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15634 CVE: CVE-2026-52930 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 2e5c6f4fd4001562781e99bbfc7f1f0127187542 upstream. shm_destroy_orphaned() walks the shm idr under shm_ids(ns).rwsem, but that does not serialize all fields tested by shm_may_destroy(). In particular, shm_nattch is updated while holding shm_perm.lock, and attach paths can do that without holding the rwsem. Do not decide that an orphaned segment is unused before taking the object lock. Move the shm_may_destroy() check under shm_perm.lock, matching the other destroy paths, and unlock the segment when it no longer qualifies for removal. Link: https://lore.kernel.org/9d97cc1031de2d0bace0edf3a668818aa2f4eca6.1777410234… Fixes: 4c677e2eefdb ("shm: optimize locking and ipc_namespace getting") Reported-by: Yuan Tan <yuantan098(a)gmail.com> Reported-by: Yifan Wu <yifanwucs(a)gmail.com> Reported-by: Juefei Pu <tomapufckgml(a)gmail.com> Reported-by: Xin Liu <bird(a)lzu.edu.cn> Signed-off-by: Yilin Zhu <zylzyl2333(a)gmail.com> Signed-off-by: Ren Wei <n05ec(a)lzu.edu.cn> Cc: Christian Brauner <brauner(a)kernel.org> Cc: Jeongjun Park <aha310510(a)gmail.com> Cc: Kees Cook <kees(a)kernel.org> Cc: Liam Howlett <liam(a)infradead.org> Cc: Lorenzo Stoakes <ljs(a)kernel.org> Cc: Serge Hallyn <sergeh(a)kernel.org> Cc: Vasiliy Kulikov <segoon(a)openwall.com> Cc: Davidlohr Bueso <dave(a)stgolabs.net> Cc: Oleg Nesterov <oleg(a)redhat.com> Cc: Serge Hallyn <serge(a)hallyn.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Fanhua Li <lifanhua5(a)huawei.com> --- ipc/shm.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/ipc/shm.c b/ipc/shm.c index bb017dd760f4d..25190965c9a50 100644 --- a/ipc/shm.c +++ b/ipc/shm.c @@ -415,15 +415,17 @@ static int shm_try_destroy_orphaned(int id, void *p, void *data) * We want to destroy segments without users and with already * exit'ed originating process. * - * As shp->* are changed under rwsem, it's safe to skip shp locking. + * shm_nattch can be changed under shm_perm.lock without holding the + * rwsem, so take the object lock before checking shm_may_destroy(). */ if (!list_empty(&shp->shm_clist)) return 0; - if (shm_may_destroy(shp)) { - shm_lock_by_ptr(shp); + shm_lock_by_ptr(shp); + if (shm_may_destroy(shp)) shm_destroy(ns, shp); - } + else + shm_unlock(shp); return 0; } -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] USB: serial: kl5kusb105: fix bulk-out buffer overflow
by Jinjie Ruan 01 Jul '26

01 Jul '26

From: HyeongJun An <sammiee5311(a)gmail.com> stable inclusion from stable-v6.6.143 commit a1288cd700f721c1a119c4f1e8efa234e59caada category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15880 CVE: CVE-2026-53194 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 96d47e40bf9db4a9efd5c8fb53287a508d165f14 upstream. klsi_105_prepare_write_buffer() is called by the generic write path with the bulk-out buffer and its size (bulk_out_size, 64 bytes). It stores a two-byte length header at the start of the buffer and copies the payload from the write fifo starting at buf + KLSI_HDR_LEN, but passes the full buffer size as the number of bytes to copy: count = kfifo_out_locked(&port->write_fifo, buf + KLSI_HDR_LEN, size, &port->lock); When the fifo holds at least size bytes, size bytes are copied starting two bytes into the size-byte buffer, writing KLSI_HDR_LEN bytes past its end. Copy at most size - KLSI_HDR_LEN bytes instead, leaving room for the header as safe_serial already does. Writing bulk_out_size or more bytes to the tty triggers a slab out-of-bounds write, observed with KASAN by emulating the device with dummy_hcd and raw-gadget: BUG: KASAN: slab-out-of-bounds in kfifo_copy_out+0x83/0xc0 Write of size 64 at addr ffff888112c62202 by task python3 kfifo_copy_out klsi_105_prepare_write_buffer [kl5kusb105] usb_serial_generic_write_start [usbserial] Allocated by task 139: usb_serial_probe [usbserial] The buggy address is located 2 bytes inside of allocated 64-byte region The out-of-bounds write no longer occurs with this change applied. Fixes: 60b3013cdaf3 ("USB: kl5usb105: reimplement using generic framework") Cc: stable(a)vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: HyeongJun An <sammiee5311(a)gmail.com> Signed-off-by: Johan Hovold <johan(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- drivers/usb/serial/kl5kusb105.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/usb/serial/kl5kusb105.c b/drivers/usb/serial/kl5kusb105.c index 5ee48b0650c4..472043568d6a 100644 --- a/drivers/usb/serial/kl5kusb105.c +++ b/drivers/usb/serial/kl5kusb105.c @@ -361,8 +361,8 @@ static int klsi_105_prepare_write_buffer(struct usb_serial_port *port, unsigned char *buf = dest; int count; - count = kfifo_out_locked(&port->write_fifo, buf + KLSI_HDR_LEN, size, - &port->lock); + count = kfifo_out_locked(&port->write_fifo, buf + KLSI_HDR_LEN, + size - KLSI_HDR_LEN, &port->lock); put_unaligned_le16(count, buf); return count + KLSI_HDR_LEN; -- 2.34.1

2 1

[PATCH OLK-6.6] ceph: fix BUG_ON in __ceph_build_xattrs_blob() due to stale blob size
by Pan Taixi 01 Jul '26

01 Jul '26

From: Viacheslav Dubeyko <Slava.Dubeyko(a)ibm.com> mainline inclusion from mainline-v7.1-rc4 commit 0c22d9511cbde746622f8e4c11aaa63fe76d45f9 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15663 CVE: CVE-2026-52961 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The generic/642 test-case can reproduce the kernel crash: [40243.605254] ------------[ cut here ]------------ [40243.605956] kernel BUG at fs/ceph/xattr.c:918! [40243.607142] Oops: invalid opcode: 0000 [#1] SMP PTI [40243.608067] CPU: 7 UID: 0 PID: 498762 Comm: kworker/7:1 Not tainted 7.0.0-rc7+ #3 PREEMPT(full) [40243.609700] Hardware name: QEMU Ubuntu 25.10 PC v2 (i440FX + PIIX, + 10.1 machine, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [40243.611820] Workqueue: ceph-msgr ceph_con_workfn [40243.612715] RIP: 0010:__ceph_build_xattrs_blob+0x1b8/0x1e0 [40243.613731] Code: 0f 84 82 fe ff ff e9 cf 8e 56 ff 48 8d 65 e8 31 c0 5b 41 5c 41 5d 5d 31 d2 31 c9 31 f6 31 ff 45 31 c0 45 31 c9 c3 cc cc cc cc <0f> 0b 4c 8b 62 08 41 8b 85 24 07 00 00 49 83 c4 04 41 89 44 24 fc [40243.616888] RSP: 0018:ffffcc80c4d4b688 EFLAGS: 00010287 [40243.617773] RAX: 0000000000010026 RBX: 0000000000000001 RCX: 0000000000000000 [40243.618928] RDX: ffff8a773798dee0 RSI: 0000000000000000 RDI: 0000000000000000 [40243.620158] RBP: ffffcc80c4d4b6a0 R08: 0000000000000000 R09: 0000000000000000 [40243.621573] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8a75f3b58000 [40243.622907] R13: ffff8a75f3b58000 R14: 0000000000000080 R15: 000000000000bffd [40243.624054] FS: 0000000000000000(0000) GS:ffff8a787d1b4000(0000) knlGS:0000000000000000 [40243.625331] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [40243.626269] CR2: 000072f390b623c0 CR3: 000000011c02a003 CR4: 0000000000372ef0 [40243.627408] Call Trace: [40243.627839] <TASK> [40243.628188] __prep_cap+0x3fd/0x4a0 [40243.628789] ? do_raw_spin_unlock+0x4e/0xe0 [40243.629474] ceph_check_caps+0x46a/0xc80 [40243.630094] ? __lock_acquire+0x4a2/0x2650 [40243.630773] ? find_held_lock+0x31/0x90 [40243.631347] ? handle_cap_grant+0x79f/0x1060 [40243.632068] ? lock_release+0xd9/0x300 [40243.632696] ? __mutex_unlock_slowpath+0x3e/0x340 [40243.633429] ? lock_release+0xd9/0x300 [40243.634052] handle_cap_grant+0xcf6/0x1060 [40243.634745] ceph_handle_caps+0x122b/0x2110 [40243.635415] mds_dispatch+0x5bd/0x2160 [40243.636034] ? ceph_con_process_message+0x65/0x190 [40243.636828] ? lock_release+0xd9/0x300 [40243.637431] ceph_con_process_message+0x7a/0x190 [40243.638184] ? kfree+0x311/0x4f0 [40243.638749] ? kfree+0x311/0x4f0 [40243.639268] process_message+0x16/0x1a0 [40243.639915] ? sg_free_table+0x39/0x90 [40243.640572] ceph_con_v2_try_read+0xf58/0x2120 [40243.641255] ? lock_acquire+0xc8/0x300 [40243.641863] ceph_con_workfn+0x151/0x820 [40243.642493] process_one_work+0x22f/0x630 [40243.643093] ? process_one_work+0x254/0x630 [40243.643770] worker_thread+0x1e2/0x400 [40243.644332] ? __pfx_worker_thread+0x10/0x10 [40243.645020] kthread+0x109/0x140 [40243.645560] ? __pfx_kthread+0x10/0x10 [40243.646125] ret_from_fork+0x3f8/0x480 [40243.646752] ? __pfx_kthread+0x10/0x10 [40243.647316] ? __pfx_kthread+0x10/0x10 [40243.647919] ret_from_fork_asm+0x1a/0x30 [40243.648556] </TASK> [40243.648902] Modules linked in: overlay hctr2 libpolyval chacha libchacha adiantum libnh libpoly1305 essiv intel_rapl_msr intel_rapl_common intel_uncore_frequency_common skx_edac_common nfit kvm_intel kvm irqbypass joydev ghash_clmulni_intel aesni_intel rapl input_leds mac_hid psmouse vga16fb serio_raw vgastate floppy i2c_piix4 pata_acpi bochs qemu_fw_cfg i2c_smbus sch_fq_codel rbd dm_crypt msr parport_pc ppdev lp parport efi_pstore [40243.654766] ---[ end trace 0000000000000000 ]--- Commit d93231a6bc8a ("ceph: prevent a client from exceeding the MDS maximum xattr size") moved the required_blob_size computation to before the __build_xattrs() call, introducing a race. __build_xattrs() releases and reacquires i_ceph_lock during execution. In that window, handle_cap_grant() may update i_xattrs.blob with a newer MDS-provided blob and bump i_xattrs.version. When __build_xattrs() detects that index_version < version, it destroys and rebuilds the entire xattr rb-tree from the new blob, potentially increasing count, names_size, and vals_size. The prealloc_blob size check that follows still uses the stale required_blob_size computed before the rebuild, so it passes even when prealloc_blob is too small for the now-larger tree. After __set_xattr() adds one more xattr on top, __ceph_build_xattrs_blob() is called from the cap flush path and hits: BUG_ON(need > ci->i_xattrs.prealloc_blob->alloc_len); Fix this by recomputing required_blob_size after __build_xattrs() returns, using the current tree state. Also re-validate against m_max_xattr_size to fall back to the sync path if the rebuilt tree now exceeds the MDS limit. Cc: stable(a)vger.kernel.org Fixes: d93231a6bc8a ("ceph: prevent a client from exceeding the MDS maximum xattr size") Signed-off-by: Viacheslav Dubeyko <Slava.Dubeyko(a)ibm.com> Reviewed-by: Alex Markuze <amarkuze(a)redhat.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Conflicts: fs/ceph/xattr.c [Use dout to print log instead of doutc due to unmerged commit 38d46409c463 ("ceph: print cluster fsid and client global_id in all debug logs")] Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com> --- fs/ceph/xattr.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/fs/ceph/xattr.c b/fs/ceph/xattr.c index 6fd6a652499e..3920aa4e40a8 100644 --- a/fs/ceph/xattr.c +++ b/fs/ceph/xattr.c @@ -1238,10 +1238,26 @@ int __ceph_setxattr(struct inode *inode, const char *name, dout("setxattr %p name '%s' issued %s\n", inode, name, ceph_cap_string(issued)); __build_xattrs(inode); + /* + * __build_xattrs() may have released and reacquired i_ceph_lock, + * during which handle_cap_grant() could have replaced i_xattrs.blob + * with a newer MDS-provided blob and bumped i_xattrs.version. If that + * caused __build_xattrs() to rebuild the rb-tree from the new blob, + * count/names_size/vals_size may now be larger than when + * required_blob_size was computed above. Recompute it here so the + * prealloc_blob size check below reflects the current tree state. + */ + required_blob_size = __get_required_blob_size(ci, name_len, val_len); + if (required_blob_size > mdsc->mdsmap->m_max_xattr_size) { + dout("%s sync (size too large): %d > %llu\n", __func__, + required_blob_size, mdsc->mdsmap->m_max_xattr_size); + goto do_sync; + } + if (!ci->i_xattrs.prealloc_blob || required_blob_size > ci->i_xattrs.prealloc_blob->alloc_len) { struct ceph_buffer *blob; spin_unlock(&ci->i_ceph_lock); -- 2.34.1

2 1

[PATCH OLK-5.10] USB: serial: kl5kusb105: fix bulk-out buffer overflow
by Jinjie Ruan 01 Jul '26

01 Jul '26

From: HyeongJun An <sammiee5311(a)gmail.com> stable inclusion from stable-v6.6.143 commit a1288cd700f721c1a119c4f1e8efa234e59caada category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15880 CVE: CVE-2026-53194 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 96d47e40bf9db4a9efd5c8fb53287a508d165f14 upstream. klsi_105_prepare_write_buffer() is called by the generic write path with the bulk-out buffer and its size (bulk_out_size, 64 bytes). It stores a two-byte length header at the start of the buffer and copies the payload from the write fifo starting at buf + KLSI_HDR_LEN, but passes the full buffer size as the number of bytes to copy: count = kfifo_out_locked(&port->write_fifo, buf + KLSI_HDR_LEN, size, &port->lock); When the fifo holds at least size bytes, size bytes are copied starting two bytes into the size-byte buffer, writing KLSI_HDR_LEN bytes past its end. Copy at most size - KLSI_HDR_LEN bytes instead, leaving room for the header as safe_serial already does. Writing bulk_out_size or more bytes to the tty triggers a slab out-of-bounds write, observed with KASAN by emulating the device with dummy_hcd and raw-gadget: BUG: KASAN: slab-out-of-bounds in kfifo_copy_out+0x83/0xc0 Write of size 64 at addr ffff888112c62202 by task python3 kfifo_copy_out klsi_105_prepare_write_buffer [kl5kusb105] usb_serial_generic_write_start [usbserial] Allocated by task 139: usb_serial_probe [usbserial] The buggy address is located 2 bytes inside of allocated 64-byte region The out-of-bounds write no longer occurs with this change applied. Fixes: 60b3013cdaf3 ("USB: kl5usb105: reimplement using generic framework") Cc: stable(a)vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: HyeongJun An <sammiee5311(a)gmail.com> Signed-off-by: Johan Hovold <johan(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- drivers/usb/serial/kl5kusb105.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/usb/serial/kl5kusb105.c b/drivers/usb/serial/kl5kusb105.c index 5f6b82ebccc5..1534ba2b88b4 100644 --- a/drivers/usb/serial/kl5kusb105.c +++ b/drivers/usb/serial/kl5kusb105.c @@ -359,8 +359,8 @@ static int klsi_105_prepare_write_buffer(struct usb_serial_port *port, unsigned char *buf = dest; int count; - count = kfifo_out_locked(&port->write_fifo, buf + KLSI_HDR_LEN, size, - &port->lock); + count = kfifo_out_locked(&port->write_fifo, buf + KLSI_HDR_LEN, + size - KLSI_HDR_LEN, &port->lock); put_unaligned_le16(count, buf); return count + KLSI_HDR_LEN; -- 2.34.1

2 1

[PATCH OLK-6.6] USB: serial: kl5kusb105: fix bulk-out buffer overflow
by Jinjie Ruan 01 Jul '26

01 Jul '26

From: HyeongJun An <sammiee5311(a)gmail.com> stable inclusion from stable-v6.6.143 commit a1288cd700f721c1a119c4f1e8efa234e59caada category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15880 CVE: CVE-2026-53194 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 96d47e40bf9db4a9efd5c8fb53287a508d165f14 upstream. klsi_105_prepare_write_buffer() is called by the generic write path with the bulk-out buffer and its size (bulk_out_size, 64 bytes). It stores a two-byte length header at the start of the buffer and copies the payload from the write fifo starting at buf + KLSI_HDR_LEN, but passes the full buffer size as the number of bytes to copy: count = kfifo_out_locked(&port->write_fifo, buf + KLSI_HDR_LEN, size, &port->lock); When the fifo holds at least size bytes, size bytes are copied starting two bytes into the size-byte buffer, writing KLSI_HDR_LEN bytes past its end. Copy at most size - KLSI_HDR_LEN bytes instead, leaving room for the header as safe_serial already does. Writing bulk_out_size or more bytes to the tty triggers a slab out-of-bounds write, observed with KASAN by emulating the device with dummy_hcd and raw-gadget: BUG: KASAN: slab-out-of-bounds in kfifo_copy_out+0x83/0xc0 Write of size 64 at addr ffff888112c62202 by task python3 kfifo_copy_out klsi_105_prepare_write_buffer [kl5kusb105] usb_serial_generic_write_start [usbserial] Allocated by task 139: usb_serial_probe [usbserial] The buggy address is located 2 bytes inside of allocated 64-byte region The out-of-bounds write no longer occurs with this change applied. Fixes: 60b3013cdaf3 ("USB: kl5usb105: reimplement using generic framework") Cc: stable(a)vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: HyeongJun An <sammiee5311(a)gmail.com> Signed-off-by: Johan Hovold <johan(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- drivers/usb/serial/kl5kusb105.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/usb/serial/kl5kusb105.c b/drivers/usb/serial/kl5kusb105.c index 394b3189e003..b86900fe4a1b 100644 --- a/drivers/usb/serial/kl5kusb105.c +++ b/drivers/usb/serial/kl5kusb105.c @@ -331,8 +331,8 @@ static int klsi_105_prepare_write_buffer(struct usb_serial_port *port, unsigned char *buf = dest; int count; - count = kfifo_out_locked(&port->write_fifo, buf + KLSI_HDR_LEN, size, - &port->lock); + count = kfifo_out_locked(&port->write_fifo, buf + KLSI_HDR_LEN, + size - KLSI_HDR_LEN, &port->lock); put_unaligned_le16(count, buf); return count + KLSI_HDR_LEN; -- 2.34.1

2 1

[PATCH OLK-6.6] ipc: limit next_id allocation to the valid ID range
by Fanhua Li 01 Jul '26

01 Jul '26

From: Linpu Yu <linpu5433(a)gmail.com> stable inclusion from stable-v6.6.143 commit 157ce2c6836ce0ff19108a819f38df061345425f category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15641 CVE: CVE-2026-52923 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit fa0b9b2b7ae3539908d69c2b9ac0d144d9bc5139 upstream. The checkpoint/restore sysctl path can request the next SysV IPC id through ids->next_id. ipc_idr_alloc() currently forwards that request to idr_alloc() with an open-ended upper bound. If the valid tail of the SysV IPC id space is full, the allocation can spill beyond ipc_mni. The returned SysV IPC id still uses the normal index encoding, so later lookup and removal can target the wrong slot. This leaves the real IDR entry behind and breaks the IDR state for the object. The bug is in ipc_idr_alloc() in the checkpoint/restore path. 1. ids->next_id is passed to: idr_alloc(&ids->ipcs_idr, new, ipcid_to_idx(next_id), 0, ...) 2. The zero upper bound makes the allocation effectively open-ended. Once the valid SysV IPC tail is occupied, idr_alloc() can spill past ipc_mni and allocate an entry beyond the valid IPC id range. 3. The new object id is still encoded with the narrower SysV IPC index width: new->id = (new->seq << ipcmni_seq_shift()) + idx 4. Later removal goes through ipc_rmid(), which uses: ipcid_to_idx(ipcp->id) That truncates the real IDR index. An object actually stored at a high index can then be removed as if it lived at a low in-range index. 5. For shared memory, shm_destroy() frees the current object anyway, but the real high IDR slot is left behind as a dangling pointer. 6. A subsequent walk of /proc/sysvipc/shm reaches the stale IDR entry and dereferences freed memory. Prevent this by bounding the requested allocation to ipc_mni so the checkpoint/restore path fails once the valid range is exhausted. Link: https://lore.kernel.org/cover.1778336914.git.linpu5433@gmail.com Link: https://lore.kernel.org/2eebe949bfa7d1f6e13b5be6a92c64c850ce9d45.1778336914… Fixes: 03f595668017 ("ipc: add sysctl to specify desired next object id") Signed-off-by: Linpu Yu <linpu5433(a)gmail.com> Signed-off-by: Ren Wei <n05ec(a)lzu.edu.cn> Reported-by: Yuan Tan <yuantan098(a)gmail.com> Reported-by: Yifan Wu <yifanwucs(a)gmail.com> Reported-by: Juefei Pu <tomapufckgml(a)gmail.com> Reported-by: Xin Liu <bird(a)lzu.edu.cn> Cc: Kees Cook <kees(a)kernel.org> Cc: Stanislav Kinsbursky <skinsbursky(a)parallels.com> Cc: Davidlohr Bueso <dave(a)stgolabs.net> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Fanhua Li <lifanhua5(a)huawei.com> --- ipc/util.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ipc/util.c b/ipc/util.c index 05cb9de667350..14dec7e9c887c 100644 --- a/ipc/util.c +++ b/ipc/util.c @@ -253,7 +253,7 @@ static inline int ipc_idr_alloc(struct ipc_ids *ids, struct kern_ipc_perm *new) } else { new->seq = ipcid_to_seqx(next_id); idx = idr_alloc(&ids->ipcs_idr, new, ipcid_to_idx(next_id), - 0, GFP_NOWAIT); + ipc_mni, GFP_NOWAIT); } if (idx >= 0) new->id = (new->seq << ipcmni_seq_shift()) + idx; -- 2.43.0

2 1

[PATCH] vdpa: use generic driver_override infrastructure
by Lin Ruifeng 01 Jul '26

01 Jul '26

From: Danilo Krummrich <dakr(a)kernel.org> stable inclusion from stable-v6.18.33 commit 654ef9c33e138ede6734ac286282df9faf83cd11 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15815 CVE: CVE-2026-53118 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 85bb534ff12aab6916058897b39c748940a7a4c6 ] When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF. Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally. Note that calling match() from __driver_attach() without the device lock held is intentional. [1] Link: https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/ [1] Reported-by: Gui-Dong Han <hanguidong02(a)gmail.com> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220789 Fixes: 539fec78edb4 ("vdpa: add driver_override support") Acked-by: Eugenio Pérez <eperezma(a)redhat.com> Acked-by: Michael S. Tsirkin <mst(a)redhat.com> Link: https://patch.msgid.link/20260324005919.2408620-9-dakr@kernel.org Signed-off-by: Danilo Krummrich <dakr(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/vdpa/vdpa.c include/linux/vdpa.h [Context Conflicts] Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/vdpa/vdpa.c | 48 +++++--------------------------------------- include/linux/vdpa.h | 4 ---- 2 files changed, 5 insertions(+), 47 deletions(-) diff --git a/drivers/vdpa/vdpa.c b/drivers/vdpa/vdpa.c index a7612e0783b3..28a2fb1d0fa4 100644 --- a/drivers/vdpa/vdpa.c +++ b/drivers/vdpa/vdpa.c @@ -67,57 +67,20 @@ static void vdpa_dev_remove(struct device *d) static int vdpa_dev_match(struct device *dev, struct device_driver *drv) { - struct vdpa_device *vdev = dev_to_vdpa(dev); + int ret; /* Check override first, and if set, only use the named driver */ - if (vdev->driver_override) - return strcmp(vdev->driver_override, drv->name) == 0; + ret = device_match_driver_override(dev, drv); + if (ret >= 0) + return ret; /* Currently devices must be supported by all vDPA bus drivers */ return 1; } -static ssize_t driver_override_store(struct device *dev, - struct device_attribute *attr, - const char *buf, size_t count) -{ - struct vdpa_device *vdev = dev_to_vdpa(dev); - int ret; - - ret = driver_set_override(dev, &vdev->driver_override, buf, count); - if (ret) - return ret; - - return count; -} - -static ssize_t driver_override_show(struct device *dev, - struct device_attribute *attr, char *buf) -{ - struct vdpa_device *vdev = dev_to_vdpa(dev); - ssize_t len; - - device_lock(dev); - len = snprintf(buf, PAGE_SIZE, "%s\n", vdev->driver_override); - device_unlock(dev); - - return len; -} -static DEVICE_ATTR_RW(driver_override); - -static struct attribute *vdpa_dev_attrs[] = { - &dev_attr_driver_override.attr, - NULL, -}; - -static const struct attribute_group vdpa_dev_group = { - .attrs = vdpa_dev_attrs, -}; -__ATTRIBUTE_GROUPS(vdpa_dev); - static struct bus_type vdpa_bus = { .name = "vdpa", - .dev_groups = vdpa_dev_groups, + .driver_override = true, .match = vdpa_dev_match, .probe = vdpa_dev_probe, .remove = vdpa_dev_remove, @@ -132,7 +95,6 @@ static void vdpa_release_dev(struct device *d) ops->free(vdev); ida_simple_remove(&vdpa_index_ida, vdev->index); - kfree(vdev->driver_override); kfree(vdev); } diff --git a/include/linux/vdpa.h b/include/linux/vdpa.h index 3120a1a600dd..f16a2647e1cc 100644 --- a/include/linux/vdpa.h +++ b/include/linux/vdpa.h @@ -70,9 +70,6 @@ struct vdpa_mgmt_dev; * struct vdpa_device - representation of a vDPA device * @dev: underlying device * @dma_dev: the actual device that is performing DMA - * @driver_override: driver name to force a match; do not set directly, - * because core frees it; use driver_set_override() to - * set or clear it. * @config: the configuration ops for this device. * @cf_lock: Protects get and set access to configuration layout. * @index: device index @@ -87,7 +84,6 @@ struct vdpa_mgmt_dev; struct vdpa_device { struct device dev; struct device *dma_dev; - const char *driver_override; const struct vdpa_config_ops *config; struct rw_semaphore cf_lock; /* Protects get/set config */ unsigned int index; -- 2.34.1

1 0

[PATCH OLK-5.10] ipc: limit next_id allocation to the valid ID range
by Fanhua Li 01 Jul '26

01 Jul '26

From: Linpu Yu <linpu5433(a)gmail.com> stable inclusion from stable-v5.10.259 commit 3bbe2bb9111ce6967a951bfac79af142d816fae5 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15641 CVE: CVE-2026-52923 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit fa0b9b2b7ae3539908d69c2b9ac0d144d9bc5139 upstream. The checkpoint/restore sysctl path can request the next SysV IPC id through ids->next_id. ipc_idr_alloc() currently forwards that request to idr_alloc() with an open-ended upper bound. If the valid tail of the SysV IPC id space is full, the allocation can spill beyond ipc_mni. The returned SysV IPC id still uses the normal index encoding, so later lookup and removal can target the wrong slot. This leaves the real IDR entry behind and breaks the IDR state for the object. The bug is in ipc_idr_alloc() in the checkpoint/restore path. 1. ids->next_id is passed to: idr_alloc(&ids->ipcs_idr, new, ipcid_to_idx(next_id), 0, ...) 2. The zero upper bound makes the allocation effectively open-ended. Once the valid SysV IPC tail is occupied, idr_alloc() can spill past ipc_mni and allocate an entry beyond the valid IPC id range. 3. The new object id is still encoded with the narrower SysV IPC index width: new->id = (new->seq << ipcmni_seq_shift()) + idx 4. Later removal goes through ipc_rmid(), which uses: ipcid_to_idx(ipcp->id) That truncates the real IDR index. An object actually stored at a high index can then be removed as if it lived at a low in-range index. 5. For shared memory, shm_destroy() frees the current object anyway, but the real high IDR slot is left behind as a dangling pointer. 6. A subsequent walk of /proc/sysvipc/shm reaches the stale IDR entry and dereferences freed memory. Prevent this by bounding the requested allocation to ipc_mni so the checkpoint/restore path fails once the valid range is exhausted. Link: https://lore.kernel.org/cover.1778336914.git.linpu5433@gmail.com Link: https://lore.kernel.org/2eebe949bfa7d1f6e13b5be6a92c64c850ce9d45.1778336914… Fixes: 03f595668017 ("ipc: add sysctl to specify desired next object id") Signed-off-by: Linpu Yu <linpu5433(a)gmail.com> Signed-off-by: Ren Wei <n05ec(a)lzu.edu.cn> Reported-by: Yuan Tan <yuantan098(a)gmail.com> Reported-by: Yifan Wu <yifanwucs(a)gmail.com> Reported-by: Juefei Pu <tomapufckgml(a)gmail.com> Reported-by: Xin Liu <bird(a)lzu.edu.cn> Cc: Kees Cook <kees(a)kernel.org> Cc: Stanislav Kinsbursky <skinsbursky(a)parallels.com> Cc: Davidlohr Bueso <dave(a)stgolabs.net> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Fanhua Li <lifanhua5(a)huawei.com> --- ipc/util.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ipc/util.c b/ipc/util.c index 7c3601dad9bd5..9fd65095e91b6 100644 --- a/ipc/util.c +++ b/ipc/util.c @@ -252,7 +252,7 @@ static inline int ipc_idr_alloc(struct ipc_ids *ids, struct kern_ipc_perm *new) } else { new->seq = ipcid_to_seqx(next_id); idx = idr_alloc(&ids->ipcs_idr, new, ipcid_to_idx(next_id), - 0, GFP_NOWAIT); + ipc_mni, GFP_NOWAIT); } if (idx >= 0) new->id = (new->seq << ipcmni_seq_shift()) + idx; -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] ipc: limit next_id allocation to the valid ID range
by Fanhua Li 01 Jul '26

01 Jul '26

From: Linpu Yu <linpu5433(a)gmail.com> stable inclusion from stable-v5.10.259 commit 3bbe2bb9111ce6967a951bfac79af142d816fae5 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15641 CVE: CVE-2026-52923 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit fa0b9b2b7ae3539908d69c2b9ac0d144d9bc5139 upstream. The checkpoint/restore sysctl path can request the next SysV IPC id through ids->next_id. ipc_idr_alloc() currently forwards that request to idr_alloc() with an open-ended upper bound. If the valid tail of the SysV IPC id space is full, the allocation can spill beyond ipc_mni. The returned SysV IPC id still uses the normal index encoding, so later lookup and removal can target the wrong slot. This leaves the real IDR entry behind and breaks the IDR state for the object. The bug is in ipc_idr_alloc() in the checkpoint/restore path. 1. ids->next_id is passed to: idr_alloc(&ids->ipcs_idr, new, ipcid_to_idx(next_id), 0, ...) 2. The zero upper bound makes the allocation effectively open-ended. Once the valid SysV IPC tail is occupied, idr_alloc() can spill past ipc_mni and allocate an entry beyond the valid IPC id range. 3. The new object id is still encoded with the narrower SysV IPC index width: new->id = (new->seq << ipcmni_seq_shift()) + idx 4. Later removal goes through ipc_rmid(), which uses: ipcid_to_idx(ipcp->id) That truncates the real IDR index. An object actually stored at a high index can then be removed as if it lived at a low in-range index. 5. For shared memory, shm_destroy() frees the current object anyway, but the real high IDR slot is left behind as a dangling pointer. 6. A subsequent walk of /proc/sysvipc/shm reaches the stale IDR entry and dereferences freed memory. Prevent this by bounding the requested allocation to ipc_mni so the checkpoint/restore path fails once the valid range is exhausted. Link: https://lore.kernel.org/cover.1778336914.git.linpu5433@gmail.com Link: https://lore.kernel.org/2eebe949bfa7d1f6e13b5be6a92c64c850ce9d45.1778336914… Fixes: 03f595668017 ("ipc: add sysctl to specify desired next object id") Signed-off-by: Linpu Yu <linpu5433(a)gmail.com> Signed-off-by: Ren Wei <n05ec(a)lzu.edu.cn> Reported-by: Yuan Tan <yuantan098(a)gmail.com> Reported-by: Yifan Wu <yifanwucs(a)gmail.com> Reported-by: Juefei Pu <tomapufckgml(a)gmail.com> Reported-by: Xin Liu <bird(a)lzu.edu.cn> Cc: Kees Cook <kees(a)kernel.org> Cc: Stanislav Kinsbursky <skinsbursky(a)parallels.com> Cc: Davidlohr Bueso <dave(a)stgolabs.net> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: ipc/util.c [Fanhua Li: context conflict] Signed-off-by: Fanhua Li <lifanhua5(a)huawei.com> --- ipc/util.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ipc/util.c b/ipc/util.c index 5e2674e3d56c7..bf483e9bff547 100644 --- a/ipc/util.c +++ b/ipc/util.c @@ -223,7 +223,7 @@ static inline int ipc_idr_alloc(struct ipc_ids *ids, struct kern_ipc_perm *new) } else { new->seq = ipcid_to_seqx(next_id); idx = idr_alloc(&ids->ipcs_idr, new, ipcid_to_idx(next_id), - 0, GFP_NOWAIT); + IPCMNI, GFP_NOWAIT); } if (idx >= 0) new->id = SEQ_MULTIPLIER * new->seq + idx; -- 2.43.0

2 1

[PATCH OLK-5.10] vdpa: use generic driver_override infrastructure
by Lin Ruifeng 01 Jul '26

01 Jul '26

From: Danilo Krummrich <dakr(a)kernel.org> stable inclusion from stable-v6.18.33 commit 654ef9c33e138ede6734ac286282df9faf83cd11 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15815 CVE: CVE-2026-53118 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 85bb534ff12aab6916058897b39c748940a7a4c6 ] When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF. Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally. Note that calling match() from __driver_attach() without the device lock held is intentional. [1] Link: https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/ [1] Reported-by: Gui-Dong Han <hanguidong02(a)gmail.com> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220789 Fixes: 539fec78edb4 ("vdpa: add driver_override support") Acked-by: Eugenio Pérez <eperezma(a)redhat.com> Acked-by: Michael S. Tsirkin <mst(a)redhat.com> Link: https://patch.msgid.link/20260324005919.2408620-9-dakr@kernel.org Signed-off-by: Danilo Krummrich <dakr(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/vdpa/vdpa.c include/linux/vdpa.h [Context Conflicts] Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/vdpa/vdpa.c | 48 +++++--------------------------------------- include/linux/vdpa.h | 4 ---- 2 files changed, 5 insertions(+), 47 deletions(-) diff --git a/drivers/vdpa/vdpa.c b/drivers/vdpa/vdpa.c index a7612e0783b3..28a2fb1d0fa4 100644 --- a/drivers/vdpa/vdpa.c +++ b/drivers/vdpa/vdpa.c @@ -67,57 +67,20 @@ static void vdpa_dev_remove(struct device *d) static int vdpa_dev_match(struct device *dev, struct device_driver *drv) { - struct vdpa_device *vdev = dev_to_vdpa(dev); + int ret; /* Check override first, and if set, only use the named driver */ - if (vdev->driver_override) - return strcmp(vdev->driver_override, drv->name) == 0; + ret = device_match_driver_override(dev, drv); + if (ret >= 0) + return ret; /* Currently devices must be supported by all vDPA bus drivers */ return 1; } -static ssize_t driver_override_store(struct device *dev, - struct device_attribute *attr, - const char *buf, size_t count) -{ - struct vdpa_device *vdev = dev_to_vdpa(dev); - int ret; - - ret = driver_set_override(dev, &vdev->driver_override, buf, count); - if (ret) - return ret; - - return count; -} - -static ssize_t driver_override_show(struct device *dev, - struct device_attribute *attr, char *buf) -{ - struct vdpa_device *vdev = dev_to_vdpa(dev); - ssize_t len; - - device_lock(dev); - len = snprintf(buf, PAGE_SIZE, "%s\n", vdev->driver_override); - device_unlock(dev); - - return len; -} -static DEVICE_ATTR_RW(driver_override); - -static struct attribute *vdpa_dev_attrs[] = { - &dev_attr_driver_override.attr, - NULL, -}; - -static const struct attribute_group vdpa_dev_group = { - .attrs = vdpa_dev_attrs, -}; -__ATTRIBUTE_GROUPS(vdpa_dev); - static struct bus_type vdpa_bus = { .name = "vdpa", - .dev_groups = vdpa_dev_groups, + .driver_override = true, .match = vdpa_dev_match, .probe = vdpa_dev_probe, .remove = vdpa_dev_remove, @@ -132,7 +95,6 @@ static void vdpa_release_dev(struct device *d) ops->free(vdev); ida_simple_remove(&vdpa_index_ida, vdev->index); - kfree(vdev->driver_override); kfree(vdev); } diff --git a/include/linux/vdpa.h b/include/linux/vdpa.h index 3120a1a600dd..f16a2647e1cc 100644 --- a/include/linux/vdpa.h +++ b/include/linux/vdpa.h @@ -70,9 +70,6 @@ struct vdpa_mgmt_dev; * struct vdpa_device - representation of a vDPA device * @dev: underlying device * @dma_dev: the actual device that is performing DMA - * @driver_override: driver name to force a match; do not set directly, - * because core frees it; use driver_set_override() to - * set or clear it. * @config: the configuration ops for this device. * @cf_lock: Protects get and set access to configuration layout. * @index: device index @@ -87,7 +84,6 @@ struct vdpa_mgmt_dev; struct vdpa_device { struct device dev; struct device *dma_dev; - const char *driver_override; const struct vdpa_config_ops *config; struct rw_semaphore cf_lock; /* Protects get/set config */ unsigned int index; -- 2.34.1

2 1

[PATCH OLK-6.6] vdpa: use generic driver_override infrastructure
by Lin Ruifeng 01 Jul '26

01 Jul '26

From: Danilo Krummrich <dakr(a)kernel.org> stable inclusion from stable-v6.18.33 commit 654ef9c33e138ede6734ac286282df9faf83cd11 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15815 CVE: CVE-2026-53118 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 85bb534ff12aab6916058897b39c748940a7a4c6 ] When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF. Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally. Note that calling match() from __driver_attach() without the device lock held is intentional. [1] Link: https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/ [1] Reported-by: Gui-Dong Han <hanguidong02(a)gmail.com> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220789 Fixes: 539fec78edb4 ("vdpa: add driver_override support") Acked-by: Eugenio Pérez <eperezma(a)redhat.com> Acked-by: Michael S. Tsirkin <mst(a)redhat.com> Link: https://patch.msgid.link/20260324005919.2408620-9-dakr@kernel.org Signed-off-by: Danilo Krummrich <dakr(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/vdpa/vdpa.c include/linux/vdpa.h [Context Conflicts] Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/vdpa/vdpa.c | 48 +++++--------------------------------------- include/linux/vdpa.h | 4 ---- 2 files changed, 5 insertions(+), 47 deletions(-) diff --git a/drivers/vdpa/vdpa.c b/drivers/vdpa/vdpa.c index a7612e0783b3..28a2fb1d0fa4 100644 --- a/drivers/vdpa/vdpa.c +++ b/drivers/vdpa/vdpa.c @@ -67,57 +67,20 @@ static void vdpa_dev_remove(struct device *d) static int vdpa_dev_match(struct device *dev, struct device_driver *drv) { - struct vdpa_device *vdev = dev_to_vdpa(dev); + int ret; /* Check override first, and if set, only use the named driver */ - if (vdev->driver_override) - return strcmp(vdev->driver_override, drv->name) == 0; + ret = device_match_driver_override(dev, drv); + if (ret >= 0) + return ret; /* Currently devices must be supported by all vDPA bus drivers */ return 1; } -static ssize_t driver_override_store(struct device *dev, - struct device_attribute *attr, - const char *buf, size_t count) -{ - struct vdpa_device *vdev = dev_to_vdpa(dev); - int ret; - - ret = driver_set_override(dev, &vdev->driver_override, buf, count); - if (ret) - return ret; - - return count; -} - -static ssize_t driver_override_show(struct device *dev, - struct device_attribute *attr, char *buf) -{ - struct vdpa_device *vdev = dev_to_vdpa(dev); - ssize_t len; - - device_lock(dev); - len = snprintf(buf, PAGE_SIZE, "%s\n", vdev->driver_override); - device_unlock(dev); - - return len; -} -static DEVICE_ATTR_RW(driver_override); - -static struct attribute *vdpa_dev_attrs[] = { - &dev_attr_driver_override.attr, - NULL, -}; - -static const struct attribute_group vdpa_dev_group = { - .attrs = vdpa_dev_attrs, -}; -__ATTRIBUTE_GROUPS(vdpa_dev); - static struct bus_type vdpa_bus = { .name = "vdpa", - .dev_groups = vdpa_dev_groups, + .driver_override = true, .match = vdpa_dev_match, .probe = vdpa_dev_probe, .remove = vdpa_dev_remove, @@ -132,7 +95,6 @@ static void vdpa_release_dev(struct device *d) ops->free(vdev); ida_simple_remove(&vdpa_index_ida, vdev->index); - kfree(vdev->driver_override); kfree(vdev); } diff --git a/include/linux/vdpa.h b/include/linux/vdpa.h index 3120a1a600dd..f16a2647e1cc 100644 --- a/include/linux/vdpa.h +++ b/include/linux/vdpa.h @@ -70,9 +70,6 @@ struct vdpa_mgmt_dev; * struct vdpa_device - representation of a vDPA device * @dev: underlying device * @dma_dev: the actual device that is performing DMA - * @driver_override: driver name to force a match; do not set directly, - * because core frees it; use driver_set_override() to - * set or clear it. * @config: the configuration ops for this device. * @cf_lock: Protects get and set access to configuration layout. * @index: device index @@ -87,7 +84,6 @@ struct vdpa_mgmt_dev; struct vdpa_device { struct device dev; struct device *dma_dev; - const char *driver_override; const struct vdpa_config_ops *config; struct rw_semaphore cf_lock; /* Protects get/set config */ unsigned int index; -- 2.34.1

2 1

[PATCH OLK-5.10] bus: fsl-mc: use generic driver_override infrastructure
by Lin Ruifeng 01 Jul '26

01 Jul '26

From: Danilo Krummrich <dakr(a)kernel.org> stable inclusion from stable-v6.12.91 commit 4911b836f35c034c36f102db4ecbe339b38e7d1d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15812 CVE: CVE-2026-53115 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 6c8dfb0362732bf1e4829867a2a5239fedc592d0 ] When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF. Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally. Note that calling match() from __driver_attach() without the device lock held is intentional. [1] Tested-by: Ioana Ciornei <ioana.ciornei(a)nxp.com> Acked-by: Ioana Ciornei <ioana.ciornei(a)nxp.com> Acked-by: Christophe Leroy (CS GROUP) <chleroy(a)kernel.org> Link: https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/ [1] Reported-by: Gui-Dong Han <hanguidong02(a)gmail.com> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220789 Fixes: 1f86a00c1159 ("bus/fsl-mc: add support for 'driver_override' in the mc-bus") Link: https://patch.msgid.link/20260324005919.2408620-3-dakr@kernel.org Signed-off-by: Danilo Krummrich <dakr(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/bus/fsl-mc/fsl-mc-bus.c include/linux/fsl/mc.h [Context Conflicts] Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/bus/fsl-mc/fsl-mc-bus.c | 62 ++++--------------------------- drivers/vfio/fsl-mc/vfio_fsl_mc.c | 4 +- include/linux/fsl/mc.h | 2 - 3 files changed, 8 insertions(+), 60 deletions(-) diff --git a/drivers/bus/fsl-mc/fsl-mc-bus.c b/drivers/bus/fsl-mc/fsl-mc-bus.c index 59389ad93595..12d32b86c4ab 100644 --- a/drivers/bus/fsl-mc/fsl-mc-bus.c +++ b/drivers/bus/fsl-mc/fsl-mc-bus.c @@ -80,12 +80,16 @@ static int fsl_mc_bus_match(struct device *dev, struct device_driver *drv) struct fsl_mc_device *mc_dev = to_fsl_mc_device(dev); struct fsl_mc_driver *mc_drv = to_fsl_mc_driver(drv); bool found = false; + int ret; /* When driver_override is set, only bind to the matching driver */ - if (mc_dev->driver_override) { - found = !strcmp(mc_dev->driver_override, mc_drv->driver.name); + ret = device_match_driver_override(dev, drv); + if (ret > 0) { + found = true; goto out; } + if (ret == 0) + goto out; if (!mc_drv->match_id_table) goto out; @@ -156,58 +160,8 @@ static ssize_t modalias_show(struct device *dev, struct device_attribute *attr, } static DEVICE_ATTR_RO(modalias); -static ssize_t driver_override_store(struct device *dev, - struct device_attribute *attr, - const char *buf, size_t count) -{ - struct fsl_mc_device *mc_dev = to_fsl_mc_device(dev); - char *driver_override, *old = mc_dev->driver_override; - char *cp; - - if (WARN_ON(dev->bus != &fsl_mc_bus_type)) - return -EINVAL; - - if (count >= (PAGE_SIZE - 1)) - return -EINVAL; - - driver_override = kstrndup(buf, count, GFP_KERNEL); - if (!driver_override) - return -ENOMEM; - - cp = strchr(driver_override, '\n'); - if (cp) - *cp = '\0'; - - device_lock(dev); - if (strlen(driver_override)) { - mc_dev->driver_override = driver_override; - } else { - kfree(driver_override); - mc_dev->driver_override = NULL; - } - device_unlock(dev); - - kfree(old); - - return count; -} - -static ssize_t driver_override_show(struct device *dev, - struct device_attribute *attr, char *buf) -{ - struct fsl_mc_device *mc_dev = to_fsl_mc_device(dev); - ssize_t len; - - device_lock(dev); - len = snprintf(buf, PAGE_SIZE, "%s\n", mc_dev->driver_override); - device_unlock(dev); - return len; -} -static DEVICE_ATTR_RW(driver_override); - static struct attribute *fsl_mc_dev_attrs[] = { &dev_attr_modalias.attr, - &dev_attr_driver_override.attr, NULL, }; @@ -215,6 +169,7 @@ ATTRIBUTE_GROUPS(fsl_mc_dev); struct bus_type fsl_mc_bus_type = { .name = "fsl-mc", + .driver_override = true, .match = fsl_mc_bus_match, .uevent = fsl_mc_bus_uevent, .dma_configure = fsl_mc_dma_configure, @@ -823,9 +778,6 @@ EXPORT_SYMBOL_GPL(fsl_mc_device_add); */ void fsl_mc_device_remove(struct fsl_mc_device *mc_dev) { - kfree(mc_dev->driver_override); - mc_dev->driver_override = NULL; - /* * The device-specific remove callback will get invoked by device_del() */ diff --git a/drivers/vfio/fsl-mc/vfio_fsl_mc.c b/drivers/vfio/fsl-mc/vfio_fsl_mc.c index 8722f5effacd..2187c3d99708 100644 --- a/drivers/vfio/fsl-mc/vfio_fsl_mc.c +++ b/drivers/vfio/fsl-mc/vfio_fsl_mc.c @@ -524,9 +524,7 @@ static int vfio_fsl_mc_bus_notifier(struct notifier_block *nb, if (action == BUS_NOTIFY_ADD_DEVICE && vdev->mc_dev == mc_cont) { - mc_dev->driver_override = kasprintf(GFP_KERNEL, "%s", - vfio_fsl_mc_ops.name); - if (!mc_dev->driver_override) + if (device_set_driver_override(dev, vfio_fsl_mc_ops.name)) dev_warn(dev, "VFIO_FSL_MC: Setting driver override for device in dprc %s failed\n", dev_name(&mc_cont->dev)); else diff --git a/include/linux/fsl/mc.h b/include/linux/fsl/mc.h index db244874e834..41f293aee4c2 100644 --- a/include/linux/fsl/mc.h +++ b/include/linux/fsl/mc.h @@ -169,7 +169,6 @@ struct fsl_mc_obj_desc { * @regions: pointer to array of MMIO region entries * @irqs: pointer to array of pointers to interrupts allocated to this device * @resource: generic resource associated with this MC object device, if any. - * @driver_override: driver name to force a match * * Generic device object for MC object devices that are "attached" to a * MC bus. @@ -203,7 +202,6 @@ struct fsl_mc_device { struct fsl_mc_device_irq **irqs; struct fsl_mc_resource *resource; struct device_link *consumer_link; - char *driver_override; }; #define to_fsl_mc_device(_dev) \ -- 2.34.1

2 1

[RFC] PR合入代码checkpatch问题，请帮忙看看如何解决？
by huangmin 30 Jun '26

30 Jun '26

我当前已提交PR，标题为“【OLK-6.6】drm: add display driver for NEW H3C SEMI EG210 chip” #24200 链接：https://atomgit.com/openeuler/kernel/pull/24200 ###问题描述：目前，正在进行CI checkpatch，但是我们即使修改了代码，ci还是报checkpatch FAILED。我检查它报的日志文件#10187中的代码和我分支库h3csemi/kernel：feat/display-driver上的代码不一致，我不太清楚为什么它不用更新后的代码来做checkpatch？请帮忙看看，谢谢！ ------------------------------------------------------------------------------------------------------------------------------------- 本邮件及其附件含有新华三半导体公司的保密信息，仅限于发送给上面地址中列出的个人或群组。禁止任何其他人以任何形式使用（包括但不限于全部或部分地泄露、复制、或散发）本邮件中的信息。如果您错收了本邮件，请您立即电话或邮件通知发件人并删除本邮件！ This e-mail and its attachments contain confidential information from New H3C SEMI, which is intended only for the person or entity whose address is listed above. Any use of the information contained herein in any way (including, but not limited to, total or partial disclosure, reproduction, or dissemination) by persons other than the intended recipient(s) is prohibited. If you receive this e-mail in error, please notify the sender by phone or email immediately and delete it!

1 0

[PATCH openEuler-1.0-LTS] ipc: limit next_id allocation to the valid ID range
by Fanhua Li 30 Jun '26

30 Jun '26

From: Linpu Yu <linpu5433(a)gmail.com> stable inclusion from stable-v5.10.259 commit 3bbe2bb9111ce6967a951bfac79af142d816fae5 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15641 CVE: CVE-2026-52923 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit fa0b9b2b7ae3539908d69c2b9ac0d144d9bc5139 upstream. The checkpoint/restore sysctl path can request the next SysV IPC id through ids->next_id. ipc_idr_alloc() currently forwards that request to idr_alloc() with an open-ended upper bound. If the valid tail of the SysV IPC id space is full, the allocation can spill beyond ipc_mni. The returned SysV IPC id still uses the normal index encoding, so later lookup and removal can target the wrong slot. This leaves the real IDR entry behind and breaks the IDR state for the object. The bug is in ipc_idr_alloc() in the checkpoint/restore path. 1. ids->next_id is passed to: idr_alloc(&ids->ipcs_idr, new, ipcid_to_idx(next_id), 0, ...) 2. The zero upper bound makes the allocation effectively open-ended. Once the valid SysV IPC tail is occupied, idr_alloc() can spill past ipc_mni and allocate an entry beyond the valid IPC id range. 3. The new object id is still encoded with the narrower SysV IPC index width: new->id = (new->seq << ipcmni_seq_shift()) + idx 4. Later removal goes through ipc_rmid(), which uses: ipcid_to_idx(ipcp->id) That truncates the real IDR index. An object actually stored at a high index can then be removed as if it lived at a low in-range index. 5. For shared memory, shm_destroy() frees the current object anyway, but the real high IDR slot is left behind as a dangling pointer. 6. A subsequent walk of /proc/sysvipc/shm reaches the stale IDR entry and dereferences freed memory. Prevent this by bounding the requested allocation to ipc_mni so the checkpoint/restore path fails once the valid range is exhausted. Link: https://lore.kernel.org/cover.1778336914.git.linpu5433@gmail.com Link: https://lore.kernel.org/2eebe949bfa7d1f6e13b5be6a92c64c850ce9d45.1778336914… Fixes: 03f595668017 ("ipc: add sysctl to specify desired next object id") Signed-off-by: Linpu Yu <linpu5433(a)gmail.com> Signed-off-by: Ren Wei <n05ec(a)lzu.edu.cn> Reported-by: Yuan Tan <yuantan098(a)gmail.com> Reported-by: Yifan Wu <yifanwucs(a)gmail.com> Reported-by: Juefei Pu <tomapufckgml(a)gmail.com> Reported-by: Xin Liu <bird(a)lzu.edu.cn> Cc: Kees Cook <kees(a)kernel.org> Cc: Stanislav Kinsbursky <skinsbursky(a)parallels.com> Cc: Davidlohr Bueso <dave(a)stgolabs.net> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: ipc/util.c [Fanhua Li: context conflict] Signed-off-by: Fanhua Li <lifanhua5(a)huawei.com> --- ipc/util.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ipc/util.c b/ipc/util.c index 5e2674e3d56c7..bf483e9bff547 100644 --- a/ipc/util.c +++ b/ipc/util.c @@ -223,7 +223,7 @@ static inline int ipc_idr_alloc(struct ipc_ids *ids, struct kern_ipc_perm *new) } else { new->seq = ipcid_to_seqx(next_id); idx = idr_alloc(&ids->ipcs_idr, new, ipcid_to_idx(next_id), - 0, GFP_NOWAIT); + IPCMNI, GFP_NOWAIT); } if (idx >= 0) new->id = SEQ_MULTIPLIER * new->seq + idx; -- 2.43.0

2 1

[PATCH OLK-6.6] Bluetooth: fix memory leak in error path of hci_alloc_dev()
by Chen Jinghuang 30 Jun '26

30 Jun '26

From: Bharath Reddy <kbreddy.rpbc(a)gmail.com> stable inclusion from stable-v6.6.143 commit 0622e527a31d4b44737fed5c1a2ac1fc2cfb5184 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15938 CVE: CVE-2026-53252 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm… -------------------------------- [ Upstream commit 37b3009bf5976e8ab77c8b9a9bc3bbd7ff49e37f ] Early failures in Bluetooth HCI UART configuration leak SRCU percpu memory. When device initialization fails before hci_register_dev() completes, the HCI_UNREGISTER flag is never set. As a result, when the device reference count reaches zero, bt_host_release() evaluates this flag as false and falls back to a direct kfree(hdev). Because hci_release_dev() is bypassed, the SRCU struct initialized early in hci_alloc_dev() is never cleaned up, resulting in a leak of percpu memory. Fix the leak by explicitly calling cleanup_srcu_struct() in the fallback (unregistered) branch of bt_host_release() before freeing the device. Reported-by: syzbot+535ecc844591e50588a5(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=535ecc844591e50588a5 Tested-by: syzbot+535ecc844591e50588a5(a)syzkaller.appspotmail.com Fixes: 1d6123102e9f ("Bluetooth: hci_core: Fix use-after-free in vhci_flush()") Signed-off-by: Bharath Reddy <kbreddy.rpbc(a)gmail.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- net/bluetooth/hci_sysfs.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c index 4b54dbbf0729..60350c6723cb 100644 --- a/net/bluetooth/hci_sysfs.c +++ b/net/bluetooth/hci_sysfs.c @@ -83,10 +83,12 @@ static void bt_host_release(struct device *dev) { struct hci_dev *hdev = to_hci_dev(dev); - if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) + if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) { hci_release_dev(hdev); - else + } else { + cleanup_srcu_struct(&hdev->srcu); kfree(hdev); + } module_put(THIS_MODULE); } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] kernel/fork: clear PF_BLOCK_TS in copy_process()
by Chen Jinghuang 30 Jun '26

30 Jun '26

From: Usama Arif <usama.arif(a)linux.dev> mainline inclusion from mainline-v7.2-rc1 commit fd38b75c4b43295b10d69772a46d1c74dbd6fc81 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9506 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- PF_BLOCK_TS is only set in blk_time_get_ns() when current->plug is non-NULL, and blk_finish_plug() clears it via __blk_flush_plug() before NULLing the plug pointer. copy_process() breaks the invariant by inheriting PF_BLOCK_TS from the parent while resetting the child's plug to NULL. Clear PF_BLOCK_TS alongside that assignment so callers can rely on "PF_BLOCK_TS set implies current->plug != NULL" and dereference current->plug unguarded. Fixes: 06b23f92af87 ("block: update cached timestamp post schedule/preemption") Cc: stable(a)vger.kernel.org Signed-off-by: Usama Arif <usama.arif(a)linux.dev> Link: https://patch.msgid.link/20260616141604.328820-2-usama.arif@linux.dev Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: kernel/fork.c [context conflict] Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- kernel/fork.c | 1 + 1 file changed, 1 insertion(+) diff --git a/kernel/fork.c b/kernel/fork.c index 02b676d10054..fce021bf136a 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -2051,6 +2051,7 @@ static __latent_entropy struct task_struct *copy_process( #ifdef CONFIG_BLOCK p->plug = NULL; + p->flags &= ~PF_BLOCK_TS; #endif futex_init_task(p); p->futex_exit_mutex = kmalloc(sizeof(struct mutex), GFP_KERNEL); -- 2.34.1

2 1

[PATCH OLK-6.6] kernel/fork: clear PF_BLOCK_TS in copy_process()
by Chen Jinghuang 30 Jun '26

30 Jun '26

From: Usama Arif <usama.arif(a)linux.dev> mainline inclusion from mainline-v7.2-rc1 commit fd38b75c4b43295b10d69772a46d1c74dbd6fc81 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9506 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- PF_BLOCK_TS is only set in blk_time_get_ns() when current->plug is non-NULL, and blk_finish_plug() clears it via __blk_flush_plug() before NULLing the plug pointer. copy_process() breaks the invariant by inheriting PF_BLOCK_TS from the parent while resetting the child's plug to NULL. Clear PF_BLOCK_TS alongside that assignment so callers can rely on "PF_BLOCK_TS set implies current->plug != NULL" and dereference current->plug unguarded. Fixes: 06b23f92af87 ("block: update cached timestamp post schedule/preemption") Cc: stable(a)vger.kernel.org Signed-off-by: Usama Arif <usama.arif(a)linux.dev> Link: https://patch.msgid.link/20260616141604.328820-2-usama.arif@linux.dev Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- kernel/fork.c | 1 + 1 file changed, 1 insertion(+) diff --git a/kernel/fork.c b/kernel/fork.c index 4b71b0e4078c..5b9140713827 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -2688,6 +2688,7 @@ __latent_entropy struct task_struct *copy_process( #ifdef CONFIG_BLOCK p->plug = NULL; + p->flags &= ~PF_BLOCK_TS; #endif futex_init_task(p); -- 2.34.1

2 1

[PATCH OLK-5.10] wifi: mac80211: check tdls flag in ieee80211_tdls_oper
by Yi Yang 30 Jun '26

30 Jun '26

From: Deepanshu Kartikey <kartikey406(a)gmail.com> stable inclusion from stable-v5.10.259 commit e602246235fc2ef06c39b2e9cf147d84d0896b73 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14584 CVE: CVE-2026-43052 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 7d73872d949c488a1d7c308031d6a9d89b5e0a8b upstream. When NL80211_TDLS_ENABLE_LINK is called, the code only checks if the station exists but not whether it is actually a TDLS station. This allows the operation to proceed for non-TDLS stations, causing unintended side effects like modifying channel context and HT protection before failing. Add a check for sta->sta.tdls early in the ENABLE_LINK case, before any side effects occur, to ensure the operation is only allowed for actual TDLS peers. Reported-by: syzbot+56b6a844a4ea74487b7b(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=56b6a844a4ea74487b7b Tested-by: syzbot+56b6a844a4ea74487b7b(a)syzkaller.appspotmail.com Suggested-by: Johannes Berg <johannes(a)sipsolutions.net> Signed-off-by: Deepanshu Kartikey <kartikey406(a)gmail.com> Link: https://patch.msgid.link/20260313092417.520807-1-kartikey406@gmail.com Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> [ Alexey: Adapted to the older sta_mtx locking and error-handling flow. ] Signed-off-by: Alexey Panov <apanov(a)astralinux.ru> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- net/mac80211/tdls.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/mac80211/tdls.c b/net/mac80211/tdls.c index e01e4daeb8cd..66e32f1d0a98 100644 --- a/net/mac80211/tdls.c +++ b/net/mac80211/tdls.c @@ -1380,7 +1380,7 @@ int ieee80211_tdls_oper(struct wiphy *wiphy, struct net_device *dev, mutex_lock(&local->sta_mtx); sta = sta_info_get(sdata, peer); - if (!sta) { + if (!sta || !sta->sta.tdls) { mutex_unlock(&local->sta_mtx); ret = -ENOLINK; break; -- 2.25.1

2 1

[PATCH OLK-5.10] gfs2: add some missing log locking
by Zhang Kunbo 29 Jun '26

29 Jun '26

From: Andreas Gruenbacher <agruenba(a)redhat.com> stable inclusion from stable-v5.15.209 commit 3b28eb75afe520972bacc833850c2b30aa0824cd category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15751 CVE: CVE-2026-53049 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fe2c8d051150b90b3ccb85f89e3b1d636cb88ec8 ] Function gfs2_logd() calls the log flushing functions gfs2_ail1_start(), gfs2_ail1_wait(), and gfs2_ail1_empty() without holding sdp->sd_log_flush_lock, but these functions require exclusion against concurrent transactions. To fix that, add a non-locking __gfs2_log_flush() function. Then, in gfs2_logd(), take sdp->sd_log_flush_lock before calling the above mentioned log flushing functions and __gfs2_log_flush(). Fixes: 5e4c7632aae1c ("gfs2: Issue revokes more intelligently") Signed-off-by: Andreas Gruenbacher <agruenba(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/gfs2/log.c [context conflicts] Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- fs/gfs2/log.c | 29 ++++++++++++++++++++--------- 1 file changed, 20 insertions(+), 9 deletions(-) diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c index 7473b894e3c6..2a5660f879a6 100644 --- a/fs/gfs2/log.c +++ b/fs/gfs2/log.c @@ -950,20 +950,19 @@ static void trans_drain(struct gfs2_trans *tr) } /** - * gfs2_log_flush - flush incore transaction(s) + * __gfs2_log_flush - flush incore transaction(s) * @sdp: the filesystem * @gl: The glock structure to flush. If NULL, flush the whole incore log * @flags: The log header flags: GFS2_LOG_HEAD_FLUSH_* and debug flags * */ -void gfs2_log_flush(struct gfs2_sbd *sdp, struct gfs2_glock *gl, u32 flags) +static void __gfs2_log_flush(struct gfs2_sbd *sdp, struct gfs2_glock *gl, + u32 flags) { struct gfs2_trans *tr = NULL; enum gfs2_freeze_state state = atomic_read(&sdp->sd_freeze_state); - down_write(&sdp->sd_log_flush_lock); - /* * Do this check while holding the log_flush_lock to prevent new * buffers from being added to the ail via gfs2_pin() @@ -1052,7 +1051,6 @@ void gfs2_log_flush(struct gfs2_sbd *sdp, struct gfs2_glock *gl, u32 flags) out_end: trace_gfs2_log_flush(sdp, 0, flags); out: - up_write(&sdp->sd_log_flush_lock); gfs2_trans_free(sdp, tr); if (gfs2_withdrawing(sdp)) gfs2_withdraw(sdp); @@ -1075,6 +1073,13 @@ void gfs2_log_flush(struct gfs2_sbd *sdp, struct gfs2_glock *gl, u32 flags) goto out_end; } +void gfs2_log_flush(struct gfs2_sbd *sdp, struct gfs2_glock *gl, u32 flags) +{ + down_write(&sdp->sd_log_flush_lock); + __gfs2_log_flush(sdp, gl, flags); + up_write(&sdp->sd_log_flush_lock); +} + /** * gfs2_merge_trans - Merge a new transaction into a cached transaction * @old: Original transaction to be expanded @@ -1233,19 +1238,25 @@ int gfs2_logd(void *data) did_flush = false; if (gfs2_jrnl_flush_reqd(sdp) || t == 0) { + down_write(&sdp->sd_log_flush_lock); gfs2_ail1_empty(sdp, 0); - gfs2_log_flush(sdp, NULL, GFS2_LOG_HEAD_FLUSH_NORMAL | - GFS2_LFC_LOGD_JFLUSH_REQD); + __gfs2_log_flush(sdp, NULL, + GFS2_LOG_HEAD_FLUSH_NORMAL | + GFS2_LFC_LOGD_JFLUSH_REQD); did_flush = true; + up_write(&sdp->sd_log_flush_lock); } if (gfs2_ail_flush_reqd(sdp)) { + down_write(&sdp->sd_log_flush_lock); gfs2_ail1_start(sdp); gfs2_ail1_wait(sdp); gfs2_ail1_empty(sdp, 0); - gfs2_log_flush(sdp, NULL, GFS2_LOG_HEAD_FLUSH_NORMAL | - GFS2_LFC_LOGD_AIL_FLUSH_REQD); + __gfs2_log_flush(sdp, NULL, + GFS2_LOG_HEAD_FLUSH_NORMAL | + GFS2_LFC_LOGD_AIL_FLUSH_REQD); did_flush = true; + up_write(&sdp->sd_log_flush_lock); } if (!gfs2_ail_flush_reqd(sdp) || did_flush) -- 2.34.1

2 1

[PATCH OLK-5.10] gfs2: add some missing log locking
by Zhang Kunbo 29 Jun '26

29 Jun '26

From: Andreas Gruenbacher <agruenba(a)redhat.com> stable inclusion from stable-v5.15.209 commit 3b28eb75afe520972bacc833850c2b30aa0824cd category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15751 CVE: CVE-2026-53049 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fe2c8d051150b90b3ccb85f89e3b1d636cb88ec8 ] Function gfs2_logd() calls the log flushing functions gfs2_ail1_start(), gfs2_ail1_wait(), and gfs2_ail1_empty() without holding sdp->sd_log_flush_lock, but these functions require exclusion against concurrent transactions. To fix that, add a non-locking __gfs2_log_flush() function. Then, in gfs2_logd(), take sdp->sd_log_flush_lock before calling the above mentioned log flushing functions and __gfs2_log_flush(). Fixes: 5e4c7632aae1c ("gfs2: Issue revokes more intelligently") Signed-off-by: Andreas Gruenbacher <agruenba(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/gfs2/log.c [context conflicts] Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- fs/gfs2/log.c | 28 ++++++++++++++++++++-------- 1 file changed, 20 insertions(+), 8 deletions(-) diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c index 7473b894e3c6..20f0e8fee25b 100644 --- a/fs/gfs2/log.c +++ b/fs/gfs2/log.c @@ -950,19 +950,19 @@ static void trans_drain(struct gfs2_trans *tr) } /** - * gfs2_log_flush - flush incore transaction(s) + * __gfs2_log_flush - flush incore transaction(s) * @sdp: the filesystem * @gl: The glock structure to flush. If NULL, flush the whole incore log * @flags: The log header flags: GFS2_LOG_HEAD_FLUSH_* and debug flags * */ -void gfs2_log_flush(struct gfs2_sbd *sdp, struct gfs2_glock *gl, u32 flags) +static void __gfs2_log_flush(struct gfs2_sbd *sdp, struct gfs2_glock *gl, + u32 flags) { struct gfs2_trans *tr = NULL; enum gfs2_freeze_state state = atomic_read(&sdp->sd_freeze_state); - down_write(&sdp->sd_log_flush_lock); /* * Do this check while holding the log_flush_lock to prevent new @@ -1052,7 +1052,6 @@ void gfs2_log_flush(struct gfs2_sbd *sdp, struct gfs2_glock *gl, u32 flags) out_end: trace_gfs2_log_flush(sdp, 0, flags); out: - up_write(&sdp->sd_log_flush_lock); gfs2_trans_free(sdp, tr); if (gfs2_withdrawing(sdp)) gfs2_withdraw(sdp); @@ -1075,6 +1074,13 @@ void gfs2_log_flush(struct gfs2_sbd *sdp, struct gfs2_glock *gl, u32 flags) goto out_end; } +void gfs2_log_flush(struct gfs2_sbd *sdp, struct gfs2_glock *gl, u32 flags) +{ + down_write(&sdp->sd_log_flush_lock); + __gfs2_log_flush(sdp, gl, flags); + up_write(&sdp->sd_log_flush_lock); +} + /** * gfs2_merge_trans - Merge a new transaction into a cached transaction * @old: Original transaction to be expanded @@ -1233,19 +1239,25 @@ int gfs2_logd(void *data) did_flush = false; if (gfs2_jrnl_flush_reqd(sdp) || t == 0) { + down_write(&sdp->sd_log_flush_lock); gfs2_ail1_empty(sdp, 0); - gfs2_log_flush(sdp, NULL, GFS2_LOG_HEAD_FLUSH_NORMAL | - GFS2_LFC_LOGD_JFLUSH_REQD); + __gfs2_log_flush(sdp, NULL, + GFS2_LOG_HEAD_FLUSH_NORMAL | + GFS2_LFC_LOGD_JFLUSH_REQD); did_flush = true; + up_write(&sdp->sd_log_flush_lock); } if (gfs2_ail_flush_reqd(sdp)) { + down_write(&sdp->sd_log_flush_lock); gfs2_ail1_start(sdp); gfs2_ail1_wait(sdp); gfs2_ail1_empty(sdp, 0); - gfs2_log_flush(sdp, NULL, GFS2_LOG_HEAD_FLUSH_NORMAL | - GFS2_LFC_LOGD_AIL_FLUSH_REQD); + __gfs2_log_flush(sdp, NULL, + GFS2_LOG_HEAD_FLUSH_NORMAL | + GFS2_LFC_LOGD_AIL_FLUSH_REQD); did_flush = true; + up_write(&sdp->sd_log_flush_lock); } if (!gfs2_ail_flush_reqd(sdp) || did_flush) -- 2.34.1

2 1

[PATCH OLK-5.10] wifi: mac80211: check tdls flag in ieee80211_tdls_oper
by Yi Yang 29 Jun '26

29 Jun '26

From: Deepanshu Kartikey <kartikey406(a)gmail.com> mainline inclusion from mainline-v7.0-rc5 commit 7d73872d949c488a1d7c308031d6a9d89b5e0a8b category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14584 CVE: CVE-2026-43052 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- commit 7d73872d949c488a1d7c308031d6a9d89b5e0a8b upstream. When NL80211_TDLS_ENABLE_LINK is called, the code only checks if the station exists but not whether it is actually a TDLS station. This allows the operation to proceed for non-TDLS stations, causing unintended side effects like modifying channel context and HT protection before failing. Add a check for sta->sta.tdls early in the ENABLE_LINK case, before any side effects occur, to ensure the operation is only allowed for actual TDLS peers. Reported-by: syzbot+56b6a844a4ea74487b7b(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=56b6a844a4ea74487b7b Tested-by: syzbot+56b6a844a4ea74487b7b(a)syzkaller.appspotmail.com Suggested-by: Johannes Berg <johannes(a)sipsolutions.net> Signed-off-by: Deepanshu Kartikey <kartikey406(a)gmail.com> Link: https://patch.msgid.link/20260313092417.520807-1-kartikey406@gmail.com Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> [ Alexey: Adapted to the older sta_mtx locking and error-handling flow. ] Signed-off-by: Alexey Panov <apanov(a)astralinux.ru> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- net/mac80211/tdls.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/mac80211/tdls.c b/net/mac80211/tdls.c index e01e4daeb8cd..66e32f1d0a98 100644 --- a/net/mac80211/tdls.c +++ b/net/mac80211/tdls.c @@ -1380,7 +1380,7 @@ int ieee80211_tdls_oper(struct wiphy *wiphy, struct net_device *dev, mutex_lock(&local->sta_mtx); sta = sta_info_get(sdata, peer); - if (!sta) { + if (!sta || !sta->sta.tdls) { mutex_unlock(&local->sta_mtx); ret = -ENOLINK; break; -- 2.25.1

2 1

[PATCH OLK-6.6] powerpc/hv-gpci: fix preempt count leak in sysfs show paths
by Luo Gengkun 29 Jun '26

29 Jun '26

From: Aboorva Devarajan <aboorvad(a)linux.ibm.com> mainline inclusion from mainline-v7.1-rc4 commit dbc30a57bd8e026995e9fa8e8c31cffd18542c01 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16017 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- Four sysfs show() callbacks in hv-gpci take get_cpu_var(hv_gpci_reqb) (which calls preempt_disable()) but only call the matching put_cpu_var() on the error path under the 'out:' label. Every successful read leaks one preempt_disable(): processor_bus_topology_show() processor_config_show() affinity_domain_via_virtual_processor_show() affinity_domain_via_domain_show() (affinity_domain_via_partition_show() was already correct.) On a CONFIG_PREEMPT=y kernel, repeated reads raise preempt_count and eventually return to userspace with preemption still disabled. The next user-mode page fault then hits faulthandler_disabled() == 1, gets forced to SIGSEGV, and the resulting coredump trips 'BUG: scheduling while atomic' in call_usermodehelper_exec -> wait_for_completion_state -> schedule: BUG: scheduling while atomic: <task>/<pid>/0x00000004 ... __schedule_bug+0x6c/0x90 __schedule+0x58c/0x13a0 schedule+0x48/0x1a0 schedule_timeout+0x104/0x170 wait_for_completion_state+0x16c/0x330 call_usermodehelper_exec+0x254/0x2d0 vfs_coredump+0x1050/0x2590 get_signal+0xb9c/0xc80 do_notify_resume+0xf8/0x470 Add an out_success label that calls put_cpu_var() before returning the byte count, mirroring affinity_domain_via_partition_show(). Fixes: 71f1c39647d8 ("powerpc/hv_gpci: Add sysfs file inside hv_gpci device to show processor bus topology information") Fixes: 1a160c2a13c6 ("powerpc/hv_gpci: Add sysfs file inside hv_gpci device to show processor config information") Fixes: 71a7ccb478fc ("powerpc/hv_gpci: Add sysfs file inside hv_gpci device to show affinity domain via virtual processor information") Fixes: a69a57cac1ec ("powerpc/hv_gpci: Add sysfs file inside hv_gpci device to show affinity domain via domain information") Signed-off-by: Aboorva Devarajan <aboorvad(a)linux.ibm.com> Reviewed-by: Ritesh Harjani (IBM) <ritesh.list(a)gmail.com> Signed-off-by: Madhavan Srinivasan <maddy(a)linux.ibm.com> Link: https://patch.msgid.link/20260508041256.3447113-1-aboorvad@linux.ibm.com Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- arch/powerpc/perf/hv-gpci.c | 24 ++++++++++++++++-------- 1 file changed, 16 insertions(+), 8 deletions(-) diff --git a/arch/powerpc/perf/hv-gpci.c b/arch/powerpc/perf/hv-gpci.c index 241551d1282f..0ec0bd311065 100644 --- a/arch/powerpc/perf/hv-gpci.c +++ b/arch/powerpc/perf/hv-gpci.c @@ -210,7 +210,7 @@ static ssize_t processor_bus_topology_show(struct device *dev, struct device_att 0, 0, buf, &n, arg); if (!ret) - return n; + goto out_success; if (ret != H_PARAMETER) goto out; @@ -244,12 +244,14 @@ static ssize_t processor_bus_topology_show(struct device *dev, struct device_att starting_index, 0, buf, &n, arg); if (!ret) - return n; + goto out_success; if (ret != H_PARAMETER) goto out; } +out_success: + put_cpu_var(hv_gpci_reqb); return n; out: @@ -278,7 +280,7 @@ static ssize_t processor_config_show(struct device *dev, struct device_attribute 0, 0, buf, &n, arg); if (!ret) - return n; + goto out_success; if (ret != H_PARAMETER) goto out; @@ -312,12 +314,14 @@ static ssize_t processor_config_show(struct device *dev, struct device_attribute starting_index, 0, buf, &n, arg); if (!ret) - return n; + goto out_success; if (ret != H_PARAMETER) goto out; } +out_success: + put_cpu_var(hv_gpci_reqb); return n; out: @@ -346,7 +350,7 @@ static ssize_t affinity_domain_via_virtual_processor_show(struct device *dev, 0, 0, buf, &n, arg); if (!ret) - return n; + goto out_success; if (ret != H_PARAMETER) goto out; @@ -382,12 +386,14 @@ static ssize_t affinity_domain_via_virtual_processor_show(struct device *dev, starting_index, secondary_index, buf, &n, arg); if (!ret) - return n; + goto out_success; if (ret != H_PARAMETER) goto out; } +out_success: + put_cpu_var(hv_gpci_reqb); return n; out: @@ -416,7 +422,7 @@ static ssize_t affinity_domain_via_domain_show(struct device *dev, struct device 0, 0, buf, &n, arg); if (!ret) - return n; + goto out_success; if (ret != H_PARAMETER) goto out; @@ -448,12 +454,14 @@ static ssize_t affinity_domain_via_domain_show(struct device *dev, struct device starting_index, 0, buf, &n, arg); if (!ret) - return n; + goto out_success; if (ret != H_PARAMETER) goto out; } +out_success: + put_cpu_var(hv_gpci_reqb); return n; out: -- 2.34.1

2 1

[PATCH OLK-6.6] signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()
by Chen Jinghuang 27 Jun '26

27 Jun '26

From: Aleksandr Nogikh <nogikh(a)google.com> stable inclusion from stable-v6.6.143 commit 2b32b2fb241435145ea199efac024540759d2495 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9495 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit… ------------------------------------------------- [ Upstream commit 90918794a4e2c3b440f8fcf3847765a8b1d81b25 ] When a multi-threaded process receives a stop signal (e.g., SIGSTOP), do_signal_stop() sets JOBCTL_STOP_PENDING and JOBCTL_STOP_CONSUME on all threads and sets signal->group_stop_count to the number of threads. If one of the threads concurrently calls execve(), de_thread() invokes zap_other_threads() to kill all other threads. zap_other_threads() aborts the pending group stop by resetting signal->group_stop_count to 0 and clears the JOBCTL_PENDING_MASK for all other threads. However, it fails to clear the job control flags for the calling thread. When execve() completes, the calling thread returns to user mode and checks for pending signals. Seeing the stale JOBCTL_STOP_PENDING flag, it calls do_signal_stop(), which invokes task_participate_group_stop(). Since JOBCTL_STOP_CONSUME is still set, it attempts to decrement the already-zero signal->group_stop_count, triggering a warning: sig->group_stop_count == 0 WARNING: CPU: 1 PID: 6475 at kernel/signal.c:373 task_participate_group_stop+0x215/0x2d0 Call Trace: <TASK> do_signal_stop+0x3be/0x5c0 kernel/signal.c:2619 get_signal+0xa8c/0x1330 kernel/signal.c:2884 arch_do_signal_or_restart+0xbc/0x840 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop+0x8c/0x4d0 kernel/entry/common.c:98 do_syscall_64+0x33e/0xf80 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> Fix this race condition by clearing the JOBCTL_PENDING_MASK for the calling thread in zap_other_threads(), ensuring it does not retain any stale job control state after the thread group is destroyed. This aligns with other functions that tear down a thread group and abort group stops, such as zap_process() and complete_signal(), which correctly clear these flags for all threads including the current one. Fixes: 39efa3ef3a37 ("signal: Use GROUP_STOP_PENDING to stop once for a single group stop") Assisted-by: Gemini:gemini-3.1-pro-preview Gemini:gemini-3-flash-preview syzbot Reported-by: syzbot+b109633ea805cac54a61(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b109633ea805cac54a61 Link: https://syzkaller.appspot.com/ai_job?id=d70208cc-862b-4fe3-bf02-3031e10cd0b3 Signed-off-by: Aleksandr Nogikh <nogikh(a)google.com> Link: https://patch.msgid.link/20260521142240.2973022-1-nogikh@google.com Signed-off-by: Christian Brauner (Amutable) <brauner(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- kernel/signal.c | 1 + 1 file changed, 1 insertion(+) diff --git a/kernel/signal.c b/kernel/signal.c index 50aa72d6ff4e..91019f737a94 100644 --- a/kernel/signal.c +++ b/kernel/signal.c @@ -1385,6 +1385,7 @@ int zap_other_threads(struct task_struct *p) int count = 0; p->signal->group_stop_count = 0; + task_clear_jobctl_pending(p, JOBCTL_PENDING_MASK); while_each_thread(p, t) { task_clear_jobctl_pending(t, JOBCTL_PENDING_MASK); -- 2.34.1

2 1

[PATCH OLK-5.10] signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads()
by Chen Jinghuang 27 Jun '26

27 Jun '26

From: Aleksandr Nogikh <nogikh(a)google.com> stable inclusion from stable-v5.10.259 commit 2b32b2fb241435145ea199efac024540759d2495 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9495 CVE: NA Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit… -------------------------------- [ Upstream commit 90918794a4e2c3b440f8fcf3847765a8b1d81b25 ] When a multi-threaded process receives a stop signal (e.g., SIGSTOP), do_signal_stop() sets JOBCTL_STOP_PENDING and JOBCTL_STOP_CONSUME on all threads and sets signal->group_stop_count to the number of threads. If one of the threads concurrently calls execve(), de_thread() invokes zap_other_threads() to kill all other threads. zap_other_threads() aborts the pending group stop by resetting signal->group_stop_count to 0 and clears the JOBCTL_PENDING_MASK for all other threads. However, it fails to clear the job control flags for the calling thread. When execve() completes, the calling thread returns to user mode and checks for pending signals. Seeing the stale JOBCTL_STOP_PENDING flag, it calls do_signal_stop(), which invokes task_participate_group_stop(). Since JOBCTL_STOP_CONSUME is still set, it attempts to decrement the already-zero signal->group_stop_count, triggering a warning: sig->group_stop_count == 0 WARNING: CPU: 1 PID: 6475 at kernel/signal.c:373 task_participate_group_stop+0x215/0x2d0 Call Trace: <TASK> do_signal_stop+0x3be/0x5c0 kernel/signal.c:2619 get_signal+0xa8c/0x1330 kernel/signal.c:2884 arch_do_signal_or_restart+0xbc/0x840 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop+0x8c/0x4d0 kernel/entry/common.c:98 do_syscall_64+0x33e/0xf80 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> Fix this race condition by clearing the JOBCTL_PENDING_MASK for the calling thread in zap_other_threads(), ensuring it does not retain any stale job control state after the thread group is destroyed. This aligns with other functions that tear down a thread group and abort group stops, such as zap_process() and complete_signal(), which correctly clear these flags for all threads including the current one. Fixes: 39efa3ef3a37 ("signal: Use GROUP_STOP_PENDING to stop once for a single group stop") Assisted-by: Gemini:gemini-3.1-pro-preview Gemini:gemini-3-flash-preview syzbot Reported-by: syzbot+b109633ea805cac54a61(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b109633ea805cac54a61 Link: https://syzkaller.appspot.com/ai_job?id=d70208cc-862b-4fe3-bf02-3031e10cd0b3 Signed-off-by: Aleksandr Nogikh <nogikh(a)google.com> Link: https://patch.msgid.link/20260521142240.2973022-1-nogikh@google.com Signed-off-by: Christian Brauner (Amutable) <brauner(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- kernel/signal.c | 1 + 1 file changed, 1 insertion(+) diff --git a/kernel/signal.c b/kernel/signal.c index eed7a3a38053..91d177e1023d 100644 --- a/kernel/signal.c +++ b/kernel/signal.c @@ -1358,6 +1358,7 @@ int zap_other_threads(struct task_struct *p) int count = 0; p->signal->group_stop_count = 0; + task_clear_jobctl_pending(p, JOBCTL_PENDING_MASK); while_each_thread(p, t) { task_clear_jobctl_pending(t, JOBCTL_PENDING_MASK); -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] mainline bpf for olk-6.6
by Pu Lehui 27 Jun '26

27 Jun '26

Yazhou Tang (2): bpf: Fix out-of-bounds read in bpf_patch_call_args() bpf: Fix s16 truncation for large bpf-to-bpf call offsets include/linux/bpf.h | 8 +++++++- include/linux/filter.h | 3 --- kernel/bpf/core.c | 27 +++++++++++++++++++-------- kernel/bpf/syscall.c | 26 ++++++++++++++++++++++++++ kernel/bpf/verifier.c | 13 +++++++++---- 5 files changed, 61 insertions(+), 16 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10 0/2] fix null pointer in bpf_get_local_storage
by Pu Lehui 27 Jun '26

27 Jun '26

Ilya Leoshkevich (1): bpf: Check for helper calls in check_subprogs() Leon Hwang (1): bpf, verifier: Correct tail_call_reachable for bpf prog kernel/bpf/verifier.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/4] Fix CVE-2026-52975: bonding 3ad RCU data-race
by superdcc97＠163.com 26 Jun '26

26 Jun '26

From: Dong Chenchen <dongchenchen2(a)huawei.com> This series fixes CVE-2026-52975, a data-race in bonding 3ad code (bond_3ad_get_active_agg_info / bond_3ad_state_machine_handler) reported by KCSAN. The fix adds __rcu qualifier to port->aggregator and proper RCU API usage. Patches 1-3 are Stable-dep-of prerequisites that add churn state netlink support, per-port LACP actor priority, and broadcast_neighbor option. Patch 4 is the main CVE fix implementing proper RCU rules for port->aggregator. Note: Patch 3 (broadcast_neighbor) has a Class B forced-minimal adaptation conflict - the target already has bond_up_slave array style in bond_xmit_broadcast, while the original patch expected bond_for_each_slave_rcu style. CVE core logic (all_slaves parameter, bond_should_broadcast_neighbor) was safely applied on target's existing control flow. Also, OLK-specific sysctl_bond_broadcast_arp_or_nd requires signature update at both bond_xmit_broadcast call sites. Dong Chenchen (3): bonding: print churn state via netlink bonding: add support for per-port LACP actor priority net: bonding: add broadcast_neighbor option for 802.3ad Eric Dumazet (1): bonding: 3ad: implement proper RCU rules for port->aggregator Documentation/networking/bonding.rst | 15 ++++ drivers/net/bonding/bond_3ad.c | 113 ++++++++++++++----------- drivers/net/bonding/bond_main.c | 73 +++++++++++++--- drivers/net/bonding/bond_netlink.c | 37 +++++++- drivers/net/bonding/bond_options.c | 78 +++++++++++++++++ drivers/net/bonding/bond_procfs.c | 3 +- drivers/net/bonding/bond_sysfs_slave.c | 17 ++-- include/net/bond_3ad.h | 3 +- include/net/bond_options.h | 2 + include/net/bonding.h | 3 + include/uapi/linux/if_link.h | 3 + 11 files changed, 276 insertions(+), 71 deletions(-) -- 2.43.0

2 5

[PATCH OLK-6.6] perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler
by Luo Gengkun 26 Jun '26

26 Jun '26

From: Ravi Bangoria <ravi.bangoria(a)amd.com> mainline inclusion from mainline-v7.1-rc1 commit b0a09142622a994c4f4088c3f61db5da87cfc711 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15810 CVE: CVE-2026-53114 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- Calling perf_allow_kernel() from the NMI context is unsafe and could be fatal. Capture the permission at event-initialization time by storing it in event->hw.flags, and have the NMI handler rely on that cached flag instead of making the call directly. Fixes: 50a53b60e141 ("perf/amd/ibs: Prevent leaking sensitive data to userspace") Reported-by: Sadasivan Shaiju <sadasivan.shaiju2(a)amd.com> Signed-off-by: Ravi Bangoria <ravi.bangoria(a)amd.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Acked-by: Namhyung Kim <namhyung(a)kernel.org> Link: https://patch.msgid.link/20260216042216.1440-5-ravi.bangoria@amd.com Conflicts: arch/x86/events/amd/ibs.c [Fix conflict because commit 9ec84f79c5a7 is not merged.] Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- arch/x86/events/amd/ibs.c | 5 ++++- arch/x86/events/perf_event_flags.h | 1 + 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/arch/x86/events/amd/ibs.c b/arch/x86/events/amd/ibs.c index c775047a1bda..74b0c608af5d 100644 --- a/arch/x86/events/amd/ibs.c +++ b/arch/x86/events/amd/ibs.c @@ -312,6 +312,9 @@ static int perf_ibs_init(struct perf_event *event) if (ret) return ret; + if (perf_allow_kernel(&event->attr)) + hwc->flags |= PERF_X86_EVENT_UNPRIVILEGED; + if (hwc->sample_period) { if (config & perf_ibs->cnt_mask) /* raw max_cnt may not be set */ @@ -1343,7 +1346,7 @@ static int perf_ibs_handle_irq(struct perf_ibs *perf_ibs, struct pt_regs *iregs) * unprivileged users. */ if ((event->attr.sample_type & PERF_SAMPLE_RAW) && - perf_allow_kernel(&event->attr)) { + (hwc->flags & PERF_X86_EVENT_UNPRIVILEGED)) { perf_ibs_phyaddr_clear(perf_ibs, &ibs_data); } diff --git a/arch/x86/events/perf_event_flags.h b/arch/x86/events/perf_event_flags.h index 70078334e4a3..47f84ee8f540 100644 --- a/arch/x86/events/perf_event_flags.h +++ b/arch/x86/events/perf_event_flags.h @@ -23,3 +23,4 @@ PERF_ARCH(PEBS_LAT_HYBRID, 0x0020000) /* ld and st lat for hybrid */ PERF_ARCH(NEEDS_BRANCH_STACK, 0x0040000) /* require branch stack setup */ PERF_ARCH(BRANCH_COUNTERS, 0x0080000) /* logs the counters in the extra space of each branch */ PERF_ARCH(ACR, 0x0100000) /* Auto counter reload */ +PERF_ARCH(UNPRIVILEGED, 0x0200000) /* Unprivileged event (wrt perf_allow_kernel()) */ -- 2.34.1

2 1

[PATCH OLK-6.6] fuse: limit FUSE_NOTIFY_RETRIEVE to uptodate folios
by Zizhi Wo 26 Jun '26

26 Jun '26

From: Jann Horn <jannh(a)google.com> stable inclusion from stable-v6.18.36 commit 56763afa013444a9d84ca1b74e4b7130942177ba category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15852 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit… -------------------------------- commit 4e3d1b2c48ca6c55f1e9ca7f8dccc76f120f276c upstream. FUSE_NOTIFY_RETRIEVE must be limited to uptodate folios; !uptodate folios can contain uninitialized data. Since FUSE_NOTIFY_RETRIEVE is intended to only return data that is already in the page cache and not wait for data from the FUSE daemon, treat !uptodate folios as if they weren't present. This only has security impact on systems that don't enable automatic zero-initialization of all page allocations via CONFIG_INIT_ON_ALLOC_DEFAULT_ON or init_on_alloc=1. Cc: stable(a)kernel.org Fixes: 2d45ba381a74 ("fuse: add retrieve request") Signed-off-by: Jann Horn <jannh(a)google.com> Link: https://patch.msgid.link/20260519-fuse-retrieve-uptodate-v1-1-a7a1912a37f9@… Acked-by: Miklos Szeredi <mszeredi(a)redhat.com> Signed-off-by: Christian Brauner (Amutable) <brauner(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/fuse/dev.c [page -> folio] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/fuse/dev.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c index 7718e2504797..35b18e4c1562 100644 --- a/fs/fuse/dev.c +++ b/fs/fuse/dev.c @@ -1802,10 +1802,14 @@ static int fuse_retrieve(struct fuse_mount *fm, struct inode *inode, unsigned int this_num; page = find_get_page(mapping, index); if (!page) break; + if (!PageUptodate(page)) { + put_page(page); + break; + } this_num = min_t(unsigned, num, PAGE_SIZE - offset); ap->pages[ap->num_pages] = page; ap->descs[ap->num_pages].offset = offset; ap->descs[ap->num_pages].length = this_num; -- 2.52.0

2 1

[PATCH OLK-5.10] smb: client: require a full NFS mode SID before reading mode bits
by Long Li 26 Jun '26

26 Jun '26

From: Michael Bommarito <michael.bommarito(a)gmail.com> mainline inclusion from mainline-v7.0 commit 2757ad3e4b6f9e0fed4c7739594e702abc5cab21 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14908 CVE: CVE-2026-43350 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- parse_dacl() treats an ACE SID matching sid_unix_NFS_mode as an NFS mode SID and reads sid.sub_auth[2] to recover the mode bits. That assumes the ACE carries three subauthorities, but compare_sids() only compares min(a, b) subauthorities. A malicious server can return an ACE with num_subauth = 2 and sub_auth[] = {88, 3}, which still matches sid_unix_NFS_mode and then drives the sub_auth[2] read four bytes past the end of the ACE. Require num_subauth >= 3 before treating the ACE as an NFS mode SID. This keeps the fix local to the special-SID mode path without changing compare_sids() semantics for the rest of cifsacl. Fixes: e2f8fbfb8d09 ("cifs: get mode bits from special sid on stat") Cc: stable(a)vger.kernel.org Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/cifs/cifsacl.c fs/smb/client/cifsacl.c [context conflicts] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/cifs/cifsacl.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/cifs/cifsacl.c b/fs/cifs/cifsacl.c index ef4784e72b1d..472a110158ec 100644 --- a/fs/cifs/cifsacl.c +++ b/fs/cifs/cifsacl.c @@ -757,6 +757,7 @@ static void parse_dacl(struct cifs_acl *pdacl, char *end_of_acl, dump_ace(ppace[i], end_of_acl); #endif if (mode_from_special_sid && + ppace[i]->sid.num_subauth >= 3 && (compare_sids(&(ppace[i]->sid), &sid_unix_NFS_mode) == 0)) { /* -- 2.52.0

2 1

[PATCH OLK-6.6] tracing: Do not call map->ops->elt_free() if elt_alloc() fails
by Tengda Wu 25 Jun '26

25 Jun '26

From: "Masami Hiramatsu (Google)" <mhiramat(a)kernel.org> stable inclusion from stable-v6.6.142 commit f383cff9fb382139980bac1bcd3f3f5d59f68435 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9478 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 8f0f5c4fb9df0e19a341e0c6ed8dc4fda9124f03 upstream. In paths where tracing_map_elt_alloc() failed to allocate objects, the map->ops->elt_alloc() call was never successful. In this case, map->ops->elt_free() should not be called. Link: https://sashiko.dev/#/patchset/20260520223101.34710-1-rosenp%40gmail.com Cc: stable(a)vger.kernel.org Cc: Tom Zanussi <tom.zanussi(a)linux.intel.com> Cc: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Cc: Rosen Penev <rosenp(a)gmail.com> Reported-by: Sashiko <sashiko-bot(a)kernel.org> Fixes: 2734b629525a ("tracing: Add per-element variable support to tracing_map") Link: https://patch.msgid.link/177933895460.108746.5396070821443932634.stgit@devn… Signed-off-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org> Signed-off-by: Steven Rostedt <rostedt(a)goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/trace/tracing_map.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/kernel/trace/tracing_map.c b/kernel/trace/tracing_map.c index 1921ade45be3..0e5b3ea49936 100644 --- a/kernel/trace/tracing_map.c +++ b/kernel/trace/tracing_map.c @@ -386,13 +386,11 @@ static void tracing_map_elt_init_fields(struct tracing_map_elt *elt) } } -static void tracing_map_elt_free(struct tracing_map_elt *elt) +static void __tracing_map_elt_free(struct tracing_map_elt *elt) { if (!elt) return; - if (elt->map->ops && elt->map->ops->elt_free) - elt->map->ops->elt_free(elt); kfree(elt->fields); kfree(elt->vars); kfree(elt->var_set); @@ -400,6 +398,17 @@ static void tracing_map_elt_free(struct tracing_map_elt *elt) kfree(elt); } +static void tracing_map_elt_free(struct tracing_map_elt *elt) +{ + if (!elt) + return; + + /* Only objects initialized with alloc_elt() should be passed to free_elt().*/ + if (elt->map->ops && elt->map->ops->elt_free) + elt->map->ops->elt_free(elt); + __tracing_map_elt_free(elt); +} + static struct tracing_map_elt *tracing_map_elt_alloc(struct tracing_map *map) { struct tracing_map_elt *elt; @@ -444,7 +453,7 @@ static struct tracing_map_elt *tracing_map_elt_alloc(struct tracing_map *map) } return elt; free: - tracing_map_elt_free(elt); + __tracing_map_elt_free(elt); return ERR_PTR(err); } -- 2.34.1

2 1

[PATCH OLK-5.10] bpf: Tighten cgroup storage cookie checks for prog arrays
by Pu Lehui 25 Jun '26

25 Jun '26

From: Daniel Borkmann <daniel(a)iogearbox.net> mainline inclusion from mainline-v7.2-rc1 commit 10627ddc0167aab5c1c390a10ef461e9937aba08 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9479 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The fix in commit abad3d0bad72 ("bpf: Fix oob access in cgroup local storage") is still incomplete. The prog-array compatibility check treats a program with no cgroup storage as compatible with any stored storage cookie. This allows a storage-less program to bridge a tail call chain between an entry program and a storage-using callee even though cgroup local storage at runtime still follows the caller's context, that is, A -> B(no storage) -> C(storage) path. Requiring exact cookie equality would break the legitimate case of a storage-less leaf program being tail called from a storage-using one. Instead, only accept a zero storage cookie if the program cannot perform tail calls itself. This keeps A -> B(no storage) working while rejecting the A -> B(no storage) -> C(storage) bridge. Fixes: abad3d0bad72 ("bpf: Fix oob access in cgroup local storage") Reported-by: Lin Ma <malin89(a)huawei.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Acked-by: Yonghong Song <yonghong.song(a)linux.dev> Link: https://lore.kernel.org/r/20260610105539.705887-1-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Conflicts: kernel/bpf/core.c [ctx conflicts] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c index c2f5ff16b742..ba56d4c55bc2 100644 --- a/kernel/bpf/core.c +++ b/kernel/bpf/core.c @@ -1814,7 +1814,7 @@ bool bpf_prog_map_compatible(struct bpf_map *map, cookie = aux->cgroup_storage[i] ? aux->cgroup_storage[i]->cookie : 0; ret = map->owner->storage_cookie[i] == cookie || - !cookie; + (!cookie && !aux->tail_call_reachable); } if (ret && map->owner->attach_func_proto != aux->attach_func_proto) { -- 2.34.1

2 1

[PATCH OLK-6.6] bpf: Tighten cgroup storage cookie checks for prog arrays
by Pu Lehui 25 Jun '26

25 Jun '26

From: Daniel Borkmann <daniel(a)iogearbox.net> mainline inclusion from mainline-v7.2-rc1 commit 10627ddc0167aab5c1c390a10ef461e9937aba08 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9479 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The fix in commit abad3d0bad72 ("bpf: Fix oob access in cgroup local storage") is still incomplete. The prog-array compatibility check treats a program with no cgroup storage as compatible with any stored storage cookie. This allows a storage-less program to bridge a tail call chain between an entry program and a storage-using callee even though cgroup local storage at runtime still follows the caller's context, that is, A -> B(no storage) -> C(storage) path. Requiring exact cookie equality would break the legitimate case of a storage-less leaf program being tail called from a storage-using one. Instead, only accept a zero storage cookie if the program cannot perform tail calls itself. This keeps A -> B(no storage) working while rejecting the A -> B(no storage) -> C(storage) bridge. Fixes: abad3d0bad72 ("bpf: Fix oob access in cgroup local storage") Reported-by: Lin Ma <malin89(a)huawei.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Acked-by: Yonghong Song <yonghong.song(a)linux.dev> Link: https://lore.kernel.org/r/20260610105539.705887-1-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c index ff20567bbb78..f1dfff8dab07 100644 --- a/kernel/bpf/core.c +++ b/kernel/bpf/core.c @@ -2368,7 +2368,7 @@ bool bpf_prog_map_compatible(struct bpf_map *map, cookie = aux->cgroup_storage[i] ? aux->cgroup_storage[i]->cookie : 0; ret = map->owner->storage_cookie[i] == cookie || - !cookie; + (!cookie && !aux->tail_call_reachable); } if (ret && map->owner->attach_func_proto != aux->attach_func_proto) { -- 2.34.1

2 1

[PATCH OLK-6.6] fsnotify: fix inode reference leak in fsnotify_recalc_mask()
by Zizhi Wo 25 Jun '26

25 Jun '26

From: Amir Goldstein <amir73il(a)gmail.com> stable inclusion from stable-v6.12.91 commit 8c8afa6444e6bdc145d2bf2f3aeeca6da3e36b42 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15692 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit… -------------------------------- [ Upstream commit 4aca914ac152f5d055ddcb36704d1e539ac08977 ] fsnotify_recalc_mask() fails to handle the return value of __fsnotify_recalc_mask(), which may return an inode pointer that needs to be released via fsnotify_drop_object() when the connector's HAS_IREF flag transitions from set to cleared. This manifests as a hung task with the following call trace: INFO: task umount:1234 blocked for more than 120 seconds. Call Trace: __schedule schedule fsnotify_sb_delete generic_shutdown_super kill_anon_super cleanup_mnt task_work_run do_exit do_group_exit The race window that triggers the iref leak: Thread A (adding mark) Thread B (removing mark) ────────────────────── ──────────────────────── fsnotify_add_mark_locked(): fsnotify_add_mark_list(): spin_lock(conn->lock) add mark_B(evictable) to list spin_unlock(conn->lock) return /* ---- gap: no lock held ---- */ fsnotify_detach_mark(mark_A): spin_lock(mark_A->lock) clear ATTACHED flag on mark_A spin_unlock(mark_A->lock) fsnotify_put_mark(mark_A) fsnotify_recalc_mask(): spin_lock(conn->lock) __fsnotify_recalc_mask(): /* mark_A skipped: ATTACHED cleared */ /* only mark_B(evictable) remains */ want_iref = false has_iref = true /* not yet cleared */ -> HAS_IREF transitions true -> false -> returns inode pointer spin_unlock(conn->lock) /* BUG: return value discarded! * iput() and fsnotify_put_sb_watched_objects() * are never called */ Fix this by deferring the transition true -> false of HAS_IREF flag from fsnotify_recalc_mask() (Thread A) to fsnotify_put_mark() (thread B). Fixes: c3638b5b1374 ("fsnotify: allow adding an inode mark without pinning inode") Signed-off-by: Xin Yin <yinxin.x(a)bytedance.com> Signed-off-by: Amir Goldstein <amir73il(a)gmail.com> Link: https://patch.msgid.link/CAOQ4uxiPsbHb0o5voUKyPFMvBsDkG914FYDcs4C5UpBMNm0Vc… Signed-off-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/notify/mark.c [Commit 35ceae44742e ("fsnotify: Avoid data race between fsnotify_recalc_mask() and fsnotify_object_watched()") has not mergfed, not affect to this patch.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/notify/mark.c | 39 ++++++++++++++++++++++++++++++++++++--- 1 file changed, 36 insertions(+), 3 deletions(-) diff --git a/fs/notify/mark.c b/fs/notify/mark.c index b419a5ccf192..951d7de29f82 100644 --- a/fs/notify/mark.c +++ b/fs/notify/mark.c @@ -151,11 +151,16 @@ static struct inode *fsnotify_update_iref(struct fsnotify_mark_connector *conn, } return inode; } -static void *__fsnotify_recalc_mask(struct fsnotify_mark_connector *conn) +/* + * Calculate mask of events for a list of marks. + * + * Return true if any of the attached marks want to hold an inode reference. + */ +static bool __fsnotify_recalc_mask(struct fsnotify_mark_connector *conn) { u32 new_mask = 0; bool want_iref = false; struct fsnotify_mark *mark; @@ -171,10 +176,38 @@ static void *__fsnotify_recalc_mask(struct fsnotify_mark_connector *conn) !(mark->flags & FSNOTIFY_MARK_FLAG_NO_IREF)) want_iref = true; } *fsnotify_conn_mask_p(conn) = new_mask; + return want_iref; +} + +/* + * Calculate mask of events for a list of marks after attach/modify mark + * and get an inode reference for the connector if needed. + * + * A concurrent add of evictable mark and detach of non-evictable mark can + * lead to __fsnotify_recalc_mask() returning false want_iref, but in this + * case we defer clearing iref to fsnotify_recalc_mask_clear_iref() called + * from fsnotify_put_mark(). + */ +static void fsnotify_recalc_mask_set_iref(struct fsnotify_mark_connector *conn) +{ + bool has_iref = conn->flags & FSNOTIFY_CONN_FLAG_HAS_IREF; + bool want_iref = __fsnotify_recalc_mask(conn) || has_iref; + + (void) fsnotify_update_iref(conn, want_iref); +} + +/* + * Calculate mask of events for a list of marks after detach mark + * and return the inode object if its reference is no longer needed. + */ +static void *fsnotify_recalc_mask_clear_iref(struct fsnotify_mark_connector *conn) +{ + bool want_iref = __fsnotify_recalc_mask(conn); + return fsnotify_update_iref(conn, want_iref); } static bool fsnotify_conn_watches_children( struct fsnotify_mark_connector *conn) @@ -207,11 +240,11 @@ void fsnotify_recalc_mask(struct fsnotify_mark_connector *conn) if (!conn) return; spin_lock(&conn->lock); update_children = !fsnotify_conn_watches_children(conn); - __fsnotify_recalc_mask(conn); + fsnotify_recalc_mask_set_iref(conn); update_children &= fsnotify_conn_watches_children(conn); spin_unlock(&conn->lock); /* * Set children's PARENT_WATCHED flags only if parent started watching. * When parent stops watching, we clear false positive PARENT_WATCHED @@ -340,11 +373,11 @@ void fsnotify_put_mark(struct fsnotify_mark *mark) hlist_del_init_rcu(&mark->obj_list); if (hlist_empty(&conn->list)) { objp = fsnotify_detach_connector_from_object(conn, &type); free_conn = true; } else { - objp = __fsnotify_recalc_mask(conn); + objp = fsnotify_recalc_mask_clear_iref(conn); type = conn->type; } WRITE_ONCE(mark->connector, NULL); spin_unlock(&conn->lock); -- 2.52.0

2 1

[PATCH OLK-6.6] net:yt6801: fix the panic of call fxgmac_shutdown after ndo_stop (fxgmac_close)
by Frank_Sae 25 Jun '26

25 Jun '26

driver inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9393 -------------------------------- If NetworkManager let nic down, it call ndo_stop (fxgmac_close). Then do "kexec -l /boot/vmlinuz-6.6.0-156.0.0.146.oe2403sp4.loongarch64 --initrd=/boot/initramfs-6.6.0-156.0.0.146.oe2403sp4.loongarch64.img kexec -e", it will call the fxgmac_disable_rx in fxgmac_shutdown, cause a panic: Unable to handle kernel paging request at virtual address 0000000000000398 Fixes: 6460d9d3c42d ("yt6801: Add Motorcomm yt6801 PCIe driver") Signed-off-by: Frank_Sae <Frank.Sae(a)motor-comm.com> --- drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c b/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c index 4f2f82293125..b0f56d9d4991 100644 --- a/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c +++ b/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c @@ -1429,6 +1429,10 @@ static int fxgmac_net_powerdown(struct fxgmac_pdata *priv) return 0; /* do nothing if already down */ __clear_bit(FXGMAC_POWER_STATE_UP, &priv->power_state); + + if (priv->dev_state == FXGMAC_DEV_CLOSE) + return 0; /* do nothing if already close */ + netif_tx_stop_all_queues(ndev); /* Shut off incoming Tx traffic */ /* Call carrier off first to avoid false dev_watchdog timeouts */ -- 2.30.2

2 1

[PATCH OLK-5.10 v2] xfs: remove xfs_attr_leaf_hasname
by Long Li 25 Jun '26

25 Jun '26

From: Christoph Hellwig <hch(a)lst.de> mainline inclusion from mainline-v6.19-rc6 commit 3a65ea768b8094e4699e72f9ab420eb9e0f3f568 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14700 CVE: CVE-2026-43153 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The calling convention of xfs_attr_leaf_hasname() is problematic, because it returns a NULL buffer when xfs_attr3_leaf_read fails, a valid buffer when xfs_attr3_leaf_lookup_int returns -ENOATTR or -EEXIST, and a non-NULL buffer pointer for an already released buffer when xfs_attr3_leaf_lookup_int fails with other error values. Fix this by simply open coding xfs_attr_leaf_hasname in the callers, so that the buffer release code is done by each caller of xfs_attr3_leaf_read. Cc: stable(a)vger.kernel.org # v5.19+ Fixes: 07120f1abdff ("xfs: Add xfs_has_attr and subroutines") Reported-by: Mark Tinguely <mark.tinguely(a)oracle.com> Signed-off-by: Christoph Hellwig <hch(a)lst.de> Reviewed-by: Darrick J. Wong <djwong(a)kernel.org> Signed-off-by: Carlos Maiolino <cem(a)kernel.org> Conflicts: fs/xfs/libxfs/xfs_attr.c [Context config] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/xfs/libxfs/xfs_attr.c | 81 ++++++++++++++-------------------------- 1 file changed, 29 insertions(+), 52 deletions(-) diff --git a/fs/xfs/libxfs/xfs_attr.c b/fs/xfs/libxfs/xfs_attr.c index 13213c8b1285..818b6bf127de 100644 --- a/fs/xfs/libxfs/xfs_attr.c +++ b/fs/xfs/libxfs/xfs_attr.c @@ -46,7 +46,6 @@ STATIC int xfs_attr_shortform_addname(xfs_da_args_t *args); STATIC int xfs_attr_leaf_get(xfs_da_args_t *args); STATIC int xfs_attr_leaf_addname(xfs_da_args_t *args); STATIC int xfs_attr_leaf_removename(xfs_da_args_t *args); -STATIC int xfs_attr_leaf_hasname(struct xfs_da_args *args, struct xfs_buf **bp); /* * Internal routines when attribute list is more than one block. @@ -349,11 +348,12 @@ xfs_attr_lookup( } if (xfs_bmap_one_block(dp, XFS_ATTR_FORK)) { - error = xfs_attr_leaf_hasname(args, &bp); - - if (bp) - xfs_trans_brelse(args->trans, bp); - + error = xfs_attr3_leaf_read(args->trans, args->dp, + 0, &bp); + if (error) + return error; + error = xfs_attr3_leaf_lookup_int(bp, args); + xfs_trans_brelse(args->trans, bp); return error; } @@ -624,9 +624,13 @@ xfs_attr_leaf_try_add( * Look up the given attribute in the leaf block. Figure out if * the given flags produce an error or call for an atomic rename. */ - retval = xfs_attr_leaf_hasname(args, &bp); - if (retval != -ENOATTR && retval != -EEXIST) + retval = xfs_attr3_leaf_read(args->trans, args->dp, 0, &bp); + if (retval) return retval; + + retval = xfs_attr3_leaf_lookup_int(bp, args); + if (retval != -ENOATTR && retval != -EEXIST) + goto out_brelse; if (retval == -ENOATTR && (args->attr_flags & XATTR_REPLACE)) goto out_brelse; if (retval == -EEXIST) { @@ -768,27 +772,6 @@ xfs_attr_leaf_addname( return error; } -/* - * Return EEXIST if attr is found, or ENOATTR if not - */ -STATIC int -xfs_attr_leaf_hasname( - struct xfs_da_args *args, - struct xfs_buf **bp) -{ - int error = 0; - - error = xfs_attr3_leaf_read(args->trans, args->dp, 0, bp); - if (error) - return error; - - error = xfs_attr3_leaf_lookup_int(*bp, args); - if (error != -ENOATTR && error != -EEXIST) - xfs_trans_brelse(args->trans, *bp); - - return error; -} - /* * Remove a name from the leaf attribute list structure * @@ -799,24 +782,21 @@ STATIC int xfs_attr_leaf_removename( struct xfs_da_args *args) { - struct xfs_inode *dp; - struct xfs_buf *bp; + struct xfs_inode *dp = args->dp; int error, forkoff; + struct xfs_buf *bp; trace_xfs_attr_leaf_removename(args); - /* - * Remove the attribute. - */ - dp = args->dp; - error = xfs_attr_leaf_hasname(args, &bp); - - if (error == -ENOATTR) { + error = xfs_attr3_leaf_read(args->trans, args->dp, 0, &bp); + if (error) + return error; + error = xfs_attr3_leaf_lookup_int(bp, args); + if (error != -EEXIST) { xfs_trans_brelse(args->trans, bp); return error; - } else if (error != -EEXIST) - return error; + } xfs_attr3_leaf_remove(bp, args); @@ -840,23 +820,20 @@ xfs_attr_leaf_removename( * Returns 0 on successful retrieval, otherwise an error. */ STATIC int -xfs_attr_leaf_get(xfs_da_args_t *args) +xfs_attr_leaf_get( + struct xfs_da_args *args) { - struct xfs_buf *bp; - int error; + struct xfs_buf *bp; + int error; trace_xfs_attr_leaf_get(args); - error = xfs_attr_leaf_hasname(args, &bp); - - if (error == -ENOATTR) { - xfs_trans_brelse(args->trans, bp); + error = xfs_attr3_leaf_read(args->trans, args->dp, 0, &bp); + if (error) return error; - } else if (error != -EEXIST) - return error; - - - error = xfs_attr3_leaf_getvalue(bp, args); + error = xfs_attr3_leaf_lookup_int(bp, args); + if (error == -EEXIST) + error = xfs_attr3_leaf_getvalue(bp, args); xfs_trans_brelse(args->trans, bp); return error; } -- 2.52.0

2 1

[PATCH openEuler-24.03-LTS-SP4] net:yt6801: fix the panic of call fxgmac_shutdown after ndo_stop (fxgmac_close)
by Frank_Sae 25 Jun '26

25 Jun '26

driver inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9393 -------------------------------- If NetworkManager let nic down, it call ndo_stop (fxgmac_close). Then do "kexec -l /boot/vmlinuz-6.6.0-156.0.0.146.oe2403sp4.loongarch64 --initrd=/boot/initramfs-6.6.0-156.0.0.146.oe2403sp4.loongarch64.img kexec -e", it will call the fxgmac_disable_rx in fxgmac_shutdown, cause a panic: Unable to handle kernel paging request at virtual address 0000000000000398 Fixes: 6460d9d3c42d ("yt6801: Add Motorcomm yt6801 PCIe driver") Signed-off-by: Frank_Sae <Frank.Sae(a)motor-comm.com> --- drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c b/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c index 4f2f82293125..b0f56d9d4991 100644 --- a/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c +++ b/drivers/net/ethernet/motorcomm/yt6801/yt6801_main.c @@ -1429,6 +1429,10 @@ static int fxgmac_net_powerdown(struct fxgmac_pdata *priv) return 0; /* do nothing if already down */ __clear_bit(FXGMAC_POWER_STATE_UP, &priv->power_state); + + if (priv->dev_state == FXGMAC_DEV_CLOSE) + return 0; /* do nothing if already close */ + netif_tx_stop_all_queues(ndev); /* Shut off incoming Tx traffic */ /* Call carrier off first to avoid false dev_watchdog timeouts */ -- 2.30.2

1 0

[PATCH OLK-6.6] mm/numa_remote: fix variable undeclared error when CONFIG_MEMORY_RELIABLE isn't enabled
by Jinjiang Tu 25 Jun '26

25 Jun '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9474 ---------------------------------------- when CONFIG_MEMORY_RELIABLE isn't enabled, linux/oom.h isn't included by numa_remote.c, leading to sysctl_oom_kill_cpuless_numa_allocating_task undeclared error. Fix it by including the header explicitly. Fixes: 479dbd03bbf0 ("mm/numa_remote: enable oom_kill_cpuless_numa_allocating_task when numa_remote is enabled") Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- drivers/base/numa_remote.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/base/numa_remote.c b/drivers/base/numa_remote.c index fed37dc20391..f924d7867394 100644 --- a/drivers/base/numa_remote.c +++ b/drivers/base/numa_remote.c @@ -11,6 +11,7 @@ #include <linux/page-isolation.h> #include <linux/memory.h> #include <linux/numa_remote.h> +#include <linux/oom.h> #include "../../mm/hugetlb_vmemmap.h" #include "../../mm/internal.h" -- 2.43.0

2 1

[PATCH OLK-5.10] xfs: remove xfs_attr_leaf_hasname
by Long Li 25 Jun '26

25 Jun '26

From: Christoph Hellwig <hch(a)lst.de> mainline inclusion from mainline-v6.19-rc6 commit 3a65ea768b8094e4699e72f9ab420eb9e0f3f568 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14700 CVE: CVE-2026-43153 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The calling convention of xfs_attr_leaf_hasname() is problematic, because it returns a NULL buffer when xfs_attr3_leaf_read fails, a valid buffer when xfs_attr3_leaf_lookup_int returns -ENOATTR or -EEXIST, and a non-NULL buffer pointer for an already released buffer when xfs_attr3_leaf_lookup_int fails with other error values. Fix this by simply open coding xfs_attr_leaf_hasname in the callers, so that the buffer release code is done by each caller of xfs_attr3_leaf_read. Cc: stable(a)vger.kernel.org # v5.19+ Fixes: 07120f1abdff ("xfs: Add xfs_has_attr and subroutines") Reported-by: Mark Tinguely <mark.tinguely(a)oracle.com> Signed-off-by: Christoph Hellwig <hch(a)lst.de> Reviewed-by: Darrick J. Wong <djwong(a)kernel.org> Signed-off-by: Carlos Maiolino <cem(a)kernel.org> Conflicts: fs/xfs/libxfs/xfs_attr.c [Context config] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/xfs/libxfs/xfs_attr.c | 83 +++++++++++++++------------------------- 1 file changed, 31 insertions(+), 52 deletions(-) diff --git a/fs/xfs/libxfs/xfs_attr.c b/fs/xfs/libxfs/xfs_attr.c index 13213c8b1285..9045084a4361 100644 --- a/fs/xfs/libxfs/xfs_attr.c +++ b/fs/xfs/libxfs/xfs_attr.c @@ -46,7 +46,6 @@ STATIC int xfs_attr_shortform_addname(xfs_da_args_t *args); STATIC int xfs_attr_leaf_get(xfs_da_args_t *args); STATIC int xfs_attr_leaf_addname(xfs_da_args_t *args); STATIC int xfs_attr_leaf_removename(xfs_da_args_t *args); -STATIC int xfs_attr_leaf_hasname(struct xfs_da_args *args, struct xfs_buf **bp); /* * Internal routines when attribute list is more than one block. @@ -349,11 +348,12 @@ xfs_attr_lookup( } if (xfs_bmap_one_block(dp, XFS_ATTR_FORK)) { - error = xfs_attr_leaf_hasname(args, &bp); - - if (bp) - xfs_trans_brelse(args->trans, bp); - + error = xfs_attr3_leaf_read(args->trans, args->dp, + 0, &bp); + if (error) + return error; + error = xfs_attr3_leaf_lookup_int(bp, args); + xfs_trans_brelse(args->trans, bp); return error; } @@ -624,9 +624,13 @@ xfs_attr_leaf_try_add( * Look up the given attribute in the leaf block. Figure out if * the given flags produce an error or call for an atomic rename. */ - retval = xfs_attr_leaf_hasname(args, &bp); - if (retval != -ENOATTR && retval != -EEXIST) + retval = xfs_attr3_leaf_read(args->trans, args->dp, 0, &bp); + if (retval) return retval; + + retval = xfs_attr3_leaf_lookup_int(bp, args); + if (retval != -ENOATTR && retval != -EEXIST) + goto out_brelse; if (retval == -ENOATTR && (args->attr_flags & XATTR_REPLACE)) goto out_brelse; if (retval == -EEXIST) { @@ -768,27 +772,6 @@ xfs_attr_leaf_addname( return error; } -/* - * Return EEXIST if attr is found, or ENOATTR if not - */ -STATIC int -xfs_attr_leaf_hasname( - struct xfs_da_args *args, - struct xfs_buf **bp) -{ - int error = 0; - - error = xfs_attr3_leaf_read(args->trans, args->dp, 0, bp); - if (error) - return error; - - error = xfs_attr3_leaf_lookup_int(*bp, args); - if (error != -ENOATTR && error != -EEXIST) - xfs_trans_brelse(args->trans, *bp); - - return error; -} - /* * Remove a name from the leaf attribute list structure * @@ -799,24 +782,23 @@ STATIC int xfs_attr_leaf_removename( struct xfs_da_args *args) { - struct xfs_inode *dp; - struct xfs_buf *bp; + struct xfs_inode *dp = args->dp; int error, forkoff; + struct xfs_buf *bp; trace_xfs_attr_leaf_removename(args); - /* - * Remove the attribute. - */ - dp = args->dp; - error = xfs_attr_leaf_hasname(args, &bp); - - if (error == -ENOATTR) { + error = xfs_attr3_leaf_read(args->trans, args->dp, 0, &bp); + if (error) + return error; + error = xfs_attr3_leaf_lookup_int(bp, args); + if (error != -EEXIST) { xfs_trans_brelse(args->trans, bp); + if (error == -ENOATTR) + return 0; return error; - } else if (error != -EEXIST) - return error; + } xfs_attr3_leaf_remove(bp, args); @@ -840,23 +822,20 @@ xfs_attr_leaf_removename( * Returns 0 on successful retrieval, otherwise an error. */ STATIC int -xfs_attr_leaf_get(xfs_da_args_t *args) +xfs_attr_leaf_get( + struct xfs_da_args *args) { - struct xfs_buf *bp; - int error; + struct xfs_buf *bp; + int error; trace_xfs_attr_leaf_get(args); - error = xfs_attr_leaf_hasname(args, &bp); - - if (error == -ENOATTR) { - xfs_trans_brelse(args->trans, bp); + error = xfs_attr3_leaf_read(args->trans, args->dp, 0, &bp); + if (error) return error; - } else if (error != -EEXIST) - return error; - - - error = xfs_attr3_leaf_getvalue(bp, args); + error = xfs_attr3_leaf_lookup_int(bp, args); + if (error == -EEXIST) + error = xfs_attr3_leaf_getvalue(bp, args); xfs_trans_brelse(args->trans, bp); return error; } -- 2.52.0

2 1

[PATCH OLK-5.10] xfs: fix undersized l_iclog_roundoff values
by Long Li 25 Jun '26

25 Jun '26

From: "Darrick J. Wong" <djwong(a)kernel.org> mainline inclusion from mainline-v7.0-rc1 commit 52a8a1ba883defbfe3200baa22cf4cd21985d51a category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14924 CVE: CVE-2026-43365 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If the superblock doesn't list a log stripe unit, we set the incore log roundoff value to 512. This leads to corrupt logs and unmountable filesystems in generic/617 on a disk with 4k physical sectors... XFS (sda1): Mounting V5 Filesystem ff3121ca-26e6-4b77-b742-aaff9a449e1c XFS (sda1): Torn write (CRC failure) detected at log block 0x318e. Truncating head block from 0x3197. XFS (sda1): failed to locate log tail XFS (sda1): log mount/recovery failed: error -74 XFS (sda1): log mount failed XFS (sda1): Mounting V5 Filesystem ff3121ca-26e6-4b77-b742-aaff9a449e1c XFS (sda1): Ending clean mount ...on the current xfsprogs for-next which has a broken mkfs. xfs_info shows this... meta-data=/dev/sda1 isize=512 agcount=4, agsize=644992 blks = sectsz=4096 attr=2, projid32bit=1 = crc=1 finobt=1, sparse=1, rmapbt=1 = reflink=1 bigtime=1 inobtcount=1 nrext64=1 = exchange=1 metadir=1 data = bsize=4096 blocks=2579968, imaxpct=25 = sunit=0 swidth=0 blks naming =version 2 bsize=4096 ascii-ci=0, ftype=1, parent=1 log =internal log bsize=4096 blocks=16384, version=2 = sectsz=4096 sunit=0 blks, lazy-count=1 realtime =none extsz=4096 blocks=0, rtextents=0 = rgcount=0 rgsize=268435456 extents = zoned=0 start=0 reserved=0 ...observe that the log section has sectsz=4096 sunit=0, which means that the roundoff factor is 512, not 4096 as you'd expect. We should fix mkfs not to generate broken filesystems, but anyone can fuzz the ondisk superblock so we should be more cautious. I think the inadequate logic predates commit a6a65fef5ef8d0, but that's clearly going to require a different backport. Cc: stable(a)vger.kernel.org # v5.14 Fixes: a6a65fef5ef8d0 ("xfs: log stripe roundoff is a property of the log") Signed-off-by: Darrick J. Wong <djwong(a)kernel.org> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Carlos Maiolino <cem(a)kernel.org> Conflicts: fs/xfs/xfs_log.c [context conflicts] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/xfs/xfs_log.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c index f8cf48d3aaf7..e25151ec9de2 100644 --- a/fs/xfs/xfs_log.c +++ b/fs/xfs/xfs_log.c @@ -1407,6 +1407,8 @@ xlog_alloc_log( if (xfs_has_logv2(mp) && mp->m_sb.sb_logsunit > 1) log->l_iclog_roundoff = mp->m_sb.sb_logsunit; + else if (mp->m_sb.sb_logsectsize > 0) + log->l_iclog_roundoff = mp->m_sb.sb_logsectsize; else log->l_iclog_roundoff = BBSIZE; -- 2.52.0

2 1

[PATCH OLK-5.10] fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath
by Long Li 25 Jun '26

25 Jun '26

From: Fredric Cover <FredTheDude(a)proton.me> mainline inclusion from mainline-v7.0-rc6 commit 78ec5bf2f589ec7fd8f169394bfeca541b077317 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14608 CVE: CVE-2026-43112 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When cifs_sanitize_prepath is called with an empty string or a string containing only delimiters (e.g., "/"), the current logic attempts to check *(cursor2 - 1) before cursor2 has advanced. This results in an out-of-bounds read. This patch adds an early exit check after stripping prepended delimiters. If no path content remains, the function returns NULL. The bug was identified via manual audit and verified using a standalone test case compiled with AddressSanitizer, which triggered a SEGV on affected inputs. Signed-off-by: Fredric Cover <FredTheDude(a)proton.me> Reviewed-by: Henrique Carvalho <[2]henrique.carvalho(a)suse.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/cifs/connect.c fs/smb/client/fs_context.c [fs/cifs move to fs/smb/client] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/cifs/connect.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c index a69f6f1f31bc..adfc235b7c06 100644 --- a/fs/cifs/connect.c +++ b/fs/cifs/connect.c @@ -1351,6 +1351,10 @@ static char *sanitize_path(char *path) while (IS_DELIM(*cursor1)) cursor1++; + /* exit in case of only delimiters */ + if (!*cursor1) + return NULL; + /* copy the first letter */ *cursor2 = *cursor1; -- 2.52.0

2 1

[PATCH OLK-5.10] vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write
by Yi Yang 25 Jun '26

25 Jun '26

mainline inclusion from mainline-v7.2-rc1 commit a287620312dc6dcb9a093417a0e589bf30fcf38a category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9459 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- A KASAN null-ptr-deref was observed in vcs_notifier(): BUG: KASAN: null-ptr-deref in vcs_notifier+0x98/0x130 Read of size 2 at addr qmp_cmd_name: qmp_capabilities, arguments: {} The issue is a race condition in vcs_write(). When the console_lock is temporarily dropped (to copy data from userspace), the vc_data pointer obtained from vcs_vc() may become stale. After re-acquiring the lock, vcs_vc() is called again to re-validate the pointer. If the vc has been deallocated in the meantime, vcs_vc() returns NULL, and the while loop breaks (with written > 0). However, after the loop, vcs_scr_updated(vc) is still called with the now-NULL vc pointer, leading to a null pointer dereference in the notifier chain (vcs_notifier dereferences param->vc). Fix this by adding a NULL check for vc before calling vcs_scr_updated(). Fixes: 8fb9ea65c9d1 ("vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF") Cc: stable(a)vger.kernel.org Signed-off-by: Yi Yang <yiyang13(a)huawei.com> Reviewed-by: Jiri Slaby <jirislaby(a)kernel.org> Link: https://patch.msgid.link/20260604060734.2914976-1-yiyang13@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/tty/vt/vc_screen.c [Context conflicts.] Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/tty/vt/vc_screen.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/tty/vt/vc_screen.c b/drivers/tty/vt/vc_screen.c index 01c96537fa36..27b44dc12385 100644 --- a/drivers/tty/vt/vc_screen.c +++ b/drivers/tty/vt/vc_screen.c @@ -699,7 +699,7 @@ vcs_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos) } *ppos += written; ret = written; - if (written) + if (written && vc) vcs_scr_updated(vc); unlock_out: -- 2.25.1

2 1

[PATCH OLK-6.6] vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write
by Yi Yang 25 Jun '26

25 Jun '26

mainline inclusion from mainline-v7.2-rc1 commit a287620312dc6dcb9a093417a0e589bf30fcf38a category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9459 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- A KASAN null-ptr-deref was observed in vcs_notifier(): BUG: KASAN: null-ptr-deref in vcs_notifier+0x98/0x130 Read of size 2 at addr qmp_cmd_name: qmp_capabilities, arguments: {} The issue is a race condition in vcs_write(). When the console_lock is temporarily dropped (to copy data from userspace), the vc_data pointer obtained from vcs_vc() may become stale. After re-acquiring the lock, vcs_vc() is called again to re-validate the pointer. If the vc has been deallocated in the meantime, vcs_vc() returns NULL, and the while loop breaks (with written > 0). However, after the loop, vcs_scr_updated(vc) is still called with the now-NULL vc pointer, leading to a null pointer dereference in the notifier chain (vcs_notifier dereferences param->vc). Fix this by adding a NULL check for vc before calling vcs_scr_updated(). Fixes: 8fb9ea65c9d1 ("vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF") Cc: stable(a)vger.kernel.org Signed-off-by: Yi Yang <yiyang13(a)huawei.com> Reviewed-by: Jiri Slaby <jirislaby(a)kernel.org> Link: https://patch.msgid.link/20260604060734.2914976-1-yiyang13@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/tty/vt/vc_screen.c [Context conflicts.] Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/tty/vt/vc_screen.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/tty/vt/vc_screen.c b/drivers/tty/vt/vc_screen.c index 829c4be66f3b..5c417b6426bb 100644 --- a/drivers/tty/vt/vc_screen.c +++ b/drivers/tty/vt/vc_screen.c @@ -699,7 +699,7 @@ vcs_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos) } *ppos += written; ret = written; - if (written) + if (written && vc) vcs_scr_updated(vc); unlock_out: -- 2.25.1

2 1

[PATCH OLK-6.6 00/15] Fix CVE-2026-45855
by Long Li 24 Jun '26

24 Jun '26

Fix CVE-2026-45855 Damien Le Moal (8): ata: libata: Introduce ata_port_eh_scheduled() ata: libata-scsi: avoid Non-NCQ command starvation ata: libata-eh: correctly handle deferred qc timeouts ata: libata-core: improve tag checks in ata_qc_issue() ata: libata-sata: simplify ata_sas_queuecmd() ata: libata-scsi: simplify ata_scsi_requeue_deferred_qc() ata: libata-scsi: rename and improve ata_qc_done() ata: libata-core: fix cancellation of a port deferred qc work Guenter Roeck (1): ata: libata-eh: Fix detection of deferred qc timeouts Igor Pylypiv (1): ata: libata-scsi: fix requeue of deferred ATA PASS-THROUGH commands Niklas Cassel (5): ata: libata: cancel pending work after clearing deferred_qc ata: libata-scsi: improve readability of ata_scsi_qc_issue() ata: libata-scsi: do not use the deferred QC feature for ATA_DEFER_PORT ata: libata-scsi: do not use the deferred QC feature on PMPs with CBS ata: libata-scsi: do not needlessly defer commands when using PMP with FBS drivers/ata/libata-core.c | 17 ++++- drivers/ata/libata-eh.c | 31 ++++++-- drivers/ata/libata-pmp.c | 18 ++++- drivers/ata/libata-sata.c | 14 ++-- drivers/ata/libata-scsi.c | 146 ++++++++++++++++++++++++++++++++------ drivers/ata/libata.h | 7 ++ drivers/ata/sata_sil24.c | 6 +- include/linux/libata.h | 4 ++ 8 files changed, 205 insertions(+), 38 deletions(-) -- 2.52.0

2 16

openEuler Kernel SIG双周例会
by openEuler conference 24 Jun '26

24 Jun '26

您好！ Kernel 邀请您参加 2026-06-26 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议发起人： LiaoTao_Wave 会议内容： 1. 进展update 2. 议题征集中（新增议题请填报至会议纪要看板）会议链接：https://meeting.huaweicloud.com:36443/#/j/964465751 会议纪要&签到链接：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2026-06-26 14:00 The subject of the conference is openEuler Kernel SIG双周例会 The sponsor of the conference is LiaoTao_Wave Summary: 1. 进展update 2. 议题征集中（新增议题请填报至会议纪要看板） You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/964465751 Add topics at https://etherpad.openeuler.org/p/Kernel-meetings More information: https://www.openeuler.org/en/

1 0

[PATCH OLK-6.6] Revert "block: remove the blk_flush_integrity call in blk_integrity_unregister"
by Zizhi Wo 24 Jun '26

24 Jun '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9468 CVE: NA -------------------------------- This reverts commit 6d7a428c50fb5eb9dc20a45bc26cf428763420c0. Our kernel has not merge e9f5f44ad372 ("block: remove the blk_integrity_profile structure"), So this patch will lead to null-ptr-deref error. Revert it. Fixes: 6d7a428c50fb ("block: remove the blk_flush_integrity call in blk_integrity_unregister") Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- block/blk-integrity.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/block/blk-integrity.c b/block/blk-integrity.c index 5276c556a9df..d4e9b4556d14 100644 --- a/block/blk-integrity.c +++ b/block/blk-integrity.c @@ -394,9 +394,11 @@ void blk_integrity_unregister(struct gendisk *disk) struct blk_integrity *bi = &disk->queue->integrity; if (!bi->profile) return; + /* ensure all bios are off the integrity workqueue */ + blk_flush_integrity(); blk_queue_flag_clear(QUEUE_FLAG_STABLE_WRITES, disk->queue); memset(bi, 0, sizeof(*bi)); } EXPORT_SYMBOL(blk_integrity_unregister); -- 2.52.0

2 1

[PATCH OLK-6.6 v2] netfilter: nf_tables: use list_del_rcu for netlink hooks
by superdcc97＠163.com 23 Jun '26

23 Jun '26

From: Florian Westphal <fw(a)strlen.de> mainline inclusion from mainline-v7.1-rc2 commit f3224ee463f8f6f6ced7dcdf6081add4f8128527 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15588 CVE: CVE-2026-46324 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- nft_netdev_unregister_hooks and __nft_unregister_flowtable_net_hooks need to use list_del_rcu(), this list can be walked by concurrent dumpers. Add a new helper and use it consistently. Fixes: f9a43007d3f7 ("netfilter: nf_tables: double hook unregistration in netns path") Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/nf_tables_api.c [commit 73319a8ee18b ("netfilter: nf_tables: Have a list of nf_hook_ops in nft_hook") introduced the ops_list structure and __nft_netdev_hook_free_rcu() helper which are not present in OLK-6.6. Adapted to use the single hook->ops and existing kfree_rcu()-based nft_netdev_hook_free_rcu() helper instead.] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/nf_tables_api.c | 44 ++++++++++++++--------------------- 1 file changed, 18 insertions(+), 26 deletions(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 919be34ac7a0..34b837976900 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -333,6 +333,12 @@ static void nft_netdev_hook_free_rcu(struct nft_hook *hook) kfree_rcu(hook, rcu); } +static void nft_netdev_hook_unlink_free_rcu(struct nft_hook *hook) +{ + list_del_rcu(&hook->list); + nft_netdev_hook_free_rcu(hook); +} + static void nft_netdev_unregister_hooks(struct net *net, struct list_head *hook_list, bool release_netdev) @@ -341,10 +347,8 @@ static void nft_netdev_unregister_hooks(struct net *net, list_for_each_entry_safe(hook, next, hook_list, list) { nf_unregister_net_hook(net, &hook->ops); - if (release_netdev) { - list_del(&hook->list); - nft_netdev_hook_free_rcu(hook); - } + if (release_netdev) + nft_netdev_hook_unlink_free_rcu(hook); } } @@ -2106,10 +2110,8 @@ void nf_tables_chain_destroy(struct nft_chain *chain) if (nft_base_chain_netdev(table->family, basechain->ops.hooknum)) { list_for_each_entry_safe(hook, next, - &basechain->hook_list, list) { - list_del_rcu(&hook->list); - nft_netdev_hook_free_rcu(hook); - } + &basechain->hook_list, list) + nft_netdev_hook_unlink_free_rcu(hook); } module_put(basechain->type->owner); if (rcu_access_pointer(basechain->stats)) { @@ -2784,6 +2786,7 @@ static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy, list_for_each_entry_safe(h, next, &hook.list, list) { if (unregister) nf_unregister_net_hook(ctx->net, &h->ops); + /* hook.list is on stack, no need for list_del_rcu() */ list_del(&h->list); nft_netdev_hook_free_rcu(h); } @@ -8495,10 +8498,8 @@ static void __nft_unregister_flowtable_net_hooks(struct net *net, nf_unregister_net_hook(net, &hook->ops); flowtable->data.type->setup(&flowtable->data, hook->ops.dev, FLOW_BLOCK_UNBIND); - if (release_netdev) { - list_del(&hook->list); - nft_netdev_hook_free_rcu(hook); - } + if (release_netdev) + nft_netdev_hook_unlink_free_rcu(hook); } } @@ -8557,8 +8558,7 @@ static int nft_register_flowtable_net_hooks(struct net *net, break; nft_unregister_flowtable_hook(net, flowtable, hook); - list_del_rcu(&hook->list); - nft_netdev_hook_free_rcu(hook); + nft_netdev_hook_unlink_free_rcu(hook); } return err; @@ -8568,10 +8568,8 @@ static void nft_hooks_destroy(struct list_head *hook_list) { struct nft_hook *hook, *next; - list_for_each_entry_safe(hook, next, hook_list, list) { - list_del_rcu(&hook->list); - nft_netdev_hook_free_rcu(hook); - } + list_for_each_entry_safe(hook, next, hook_list, list) + nft_netdev_hook_unlink_free_rcu(hook); } static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh, @@ -8655,8 +8653,7 @@ static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh, list_for_each_entry_safe(hook, next, &flowtable_hook.list, list) { if (unregister) nft_unregister_flowtable_hook(ctx->net, flowtable, hook); - list_del_rcu(&hook->list); - nft_netdev_hook_free_rcu(hook); + nft_netdev_hook_unlink_free_rcu(hook); } return err; @@ -9149,13 +9146,8 @@ static void nf_tables_flowtable_notify(struct nft_ctx *ctx, static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable) { - struct nft_hook *hook, *next; - flowtable->data.type->free(&flowtable->data); - list_for_each_entry_safe(hook, next, &flowtable->hook_list, list) { - list_del_rcu(&hook->list); - nft_netdev_hook_free_rcu(hook); - } + nft_hooks_destroy(&flowtable->hook_list); kfree(flowtable->name); module_put(flowtable->data.type->owner); kfree(flowtable); -- 2.43.0

2 1

[PATCH OLK-6.6 v2 00/25] Fix CVE-2026-45899
by Long Li 23 Jun '26

23 Jun '26

Fix CVE-2026-45899 Baokun Li (9): ext4: add new ext4_ext_path_brelse() helper ext4: get rid of ppath in get_ext_path() ext4: get rid of ppath in ext4_ext_insert_extent() ext4: get rid of ppath in ext4_split_extent_at() ext4: get rid of ppath in ext4_force_split_extent_at() ext4: get rid of ppath in ext4_split_extent() ext4: get rid of ppath in ext4_split_convert_extents() ext4: get rid of ppath in ext4_ext_convert_to_initialized() ext4: get rid of ppath in ext4_ext_handle_unwritten_extents() Dan Carpenter (1): ext4: fix error pointer dereference in ext4_mb_load_buddy_gfp() Jan Kara (1): ext4: always allocate blocks only from groups inode can use Long Li (2): Revert "ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O" Revert "ext4: fix e4b bitmap inconsistency reports" Matthew Wilcox (Oracle) (2): ext4: convert bd_bitmap_page to bd_bitmap_folio ext4: convert bd_buddy_page to bd_buddy_folio Theodore Ts'o (1): ext4: handle wraparound when searching for blocks for indirect mapped blocks Yang Erkun (3): ext4: correct the comments place for EXT4_EXT_MAY_ZEROOUT ext4: rename EXT4_GET_BLOCKS_PRE_IO ext4: cleanup for ext4_map_blocks Yongjian Sun (1): ext4: fix e4b bitmap inconsistency reports Zhang Yi (5): ext4: subdivide EXT4_EXT_DATA_VALID1 ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O ext4: drop extent cache after doing PARTIAL_VALID1 zeroout ext4: drop extent cache when splitting extent fails fs/ext4/ext4.h | 28 +- fs/ext4/extents.c | 575 ++++++++++++++++++++---------------- fs/ext4/fast_commit.c | 8 +- fs/ext4/inode.c | 18 +- fs/ext4/mballoc.c | 220 +++++++------- fs/ext4/mballoc.h | 4 +- fs/ext4/migrate.c | 5 +- fs/ext4/move_extent.c | 34 +-- include/trace/events/ext4.h | 2 +- 9 files changed, 489 insertions(+), 405 deletions(-) -- 2.52.0

2 26

[PATCH OLK-6.6 0/3] xfrm: Fix CVE-2026-31663
by superdcc97＠163.com 23 Jun '26

23 Jun '26

From: Dong Chenchen <dongchenchen2(a)huawei.com> Fix CVE-2026-31663 Dong Chenchen (1): xfrm: Fix dev use-after-free in xfrm async resumption Jianbo Liu (1): xfrm: hold device only for the asynchronous decryption Qi Tang (1): xfrm: hold dev ref until after transport_finish NF_HOOK net/ipv4/xfrm4_input.c | 3 ++- net/ipv6/xfrm6_input.c | 3 ++- net/xfrm/xfrm_input.c | 38 +++++++++++++++++++++++++------------- 3 files changed, 29 insertions(+), 15 deletions(-) -- 2.43.0

2 4

[PATCH OLK-6.6] nvmet-tcp: fix race between ICReq handling and queue teardown
by Long Li 23 Jun '26

23 Jun '26

From: Chaitanya Kulkarni <kch(a)nvidia.com> mainline inclusion from mainline-v7.0-rc3 commit 5293a8882c549fab4a878bc76b0b6c951f980a61 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15382 CVE: CVE-2026-46135 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- nvmet_tcp_handle_icreq() updates queue->state after sending an Initialization Connection Response (ICResp), but it does so without serializing against target-side queue teardown. If an NVMe/TCP host sends an Initialization Connection Request (ICReq) and immediately closes the connection, target-side teardown may start in softirq context before io_work drains the already buffered ICReq. In that case, nvmet_tcp_schedule_release_queue() sets queue->state to NVMET_TCP_Q_DISCONNECTING and drops the queue reference under state_lock. If io_work later processes that ICReq, nvmet_tcp_handle_icreq() can still overwrite the state back to NVMET_TCP_Q_LIVE. That defeats the DISCONNECTING-state guard in nvmet_tcp_schedule_release_queue() and allows a later socket state change to re-enter teardown and issue a second kref_put() on an already released queue. The ICResp send failure path has the same problem. If teardown has already moved the queue to DISCONNECTING, a send error can still overwrite the state with NVMET_TCP_Q_FAILED, again reopening the window for a second teardown path to drop the queue reference. Fix this by serializing both post-send state transitions with state_lock and bailing out if teardown has already started. Use -ESHUTDOWN as an internal sentinel for that bail-out path rather than propagating it as a transport error like -ECONNRESET. Keep nvmet_tcp_socket_error() setting rcv_state to NVMET_TCP_RECV_ERR before honoring that sentinel so receive-side parsing stays quiesced until the existing release path completes. Fixes: c46a6465bac2 ("nvmet-tcp: add NVMe over TCP target driver") Cc: stable(a)vger.kernel.org Reported-by: Shivam Kumar <skumar47(a)syr.edu> Tested-by: Shivam Kumar <kumar.shivam43666(a)gmail.com> Signed-off-by: Chaitanya Kulkarni <kch(a)nvidia.com> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Conflicts: drivers/nvme/target/tcp.c [not merge main commit 675b453e0241 ("nvmet-tcp: enable TLS handshake upcall")] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- drivers/nvme/target/tcp.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c index 5f85c4a812ab..6ec6912b2b47 100644 --- a/drivers/nvme/target/tcp.c +++ b/drivers/nvme/target/tcp.c @@ -389,6 +389,19 @@ static void nvmet_tcp_fatal_error(struct nvmet_tcp_queue *queue) static void nvmet_tcp_socket_error(struct nvmet_tcp_queue *queue, int status) { + /* + * Keep rcv_state at RECV_ERR even for the internal -ESHUTDOWN path. + * nvmet_tcp_handle_icreq() can return -ESHUTDOWN after the ICReq has + * already been consumed and queue teardown has started. + * + * If nvmet_tcp_data_ready() or nvmet_tcp_write_space() queues + * nvmet_tcp_io_work() again before nvmet_tcp_release_queue_work() + * cancels it, the queue must not keep that old receive state. + * Otherwise the next nvmet_tcp_io_work() run can reach + * nvmet_tcp_done_recv_pdu() and try to handle the same ICReq again. + * + * That is why queue->rcv_state needs to be updated before we return. + */ queue->rcv_state = NVMET_TCP_RECV_ERR; if (status == -EPIPE || status == -ECONNRESET) kernel_sock_shutdown(queue->sock, SHUT_RDWR); @@ -938,7 +951,14 @@ static int nvmet_tcp_handle_icreq(struct nvmet_tcp_queue *queue) if (ret < 0) return ret; /* queue removal will cleanup */ + spin_lock_bh(&queue->state_lock); + if (queue->state == NVMET_TCP_Q_DISCONNECTING) { + spin_unlock_bh(&queue->state_lock); + /* Tell nvmet_tcp_socket_error() teardown is in progress. */ + return -ESHUTDOWN; + } queue->state = NVMET_TCP_Q_LIVE; + spin_unlock_bh(&queue->state_lock); nvmet_prepare_receive_pdu(queue); return 0; } -- 2.52.0

2 1

[PATCH OLK-6.6 00/15] Backport venetcls for velinux
by Yue Haibing 23 Jun '26

23 Jun '26

Li Xiasong (7): net/venetcls: free sk entry hash on ntuple cleanup net/venetcls: fix RPS CPU index scaling bias net/venetcls: fix mode-0 init rollback for ntuple resources net/venetcls: validate module params and reject zero table sizes net/venetcls: move listen-time tuple resolution to worker context net/venetcls: fix async delete race with pending rule add net/venetcls: make rps policy module params read-only Yue Haibing (8): net/venetcls: introduce venetcls for network optimization net/venetcls: Fix possible hash collision issue net/venetcls: Make VENETCLS default as module net/venetcls: Add local flow NUMA-aware rps net/venetcls: Add rps policy switch for phy NIC net/venetcls: Fix flow table init for rps_policy net/venetcls: Limit rxqs against combined_channels net/venetcls: Make VENETCLS default as module MAINTAINERS | 5 + include/linux/netdevice.h | 3 + include/linux/skbuff.h | 3 + include/linux/venetcls.h | 130 ++++ include/net/sock.h | 3 + kernel/irq/irqdesc.c | 2 +- net/Kconfig | 1 + net/Makefile | 1 + net/core/dev.c | 37 + net/core/sock.c | 3 + net/ipv4/af_inet.c | 6 + net/ipv4/tcp.c | 12 + net/venetcls/Kconfig | 11 + net/venetcls/Makefile | 7 + net/venetcls/asmdefs.S | 61 ++ net/venetcls/memcpy-sve.S | 157 ++++ net/venetcls/venetcls.h | 199 ++++++ net/venetcls/venetcls_flow.c | 638 +++++++++++++++++ net/venetcls/venetcls_main.c | 1220 ++++++++++++++++++++++++++++++++ net/venetcls/venetcls_ntuple.c | 744 +++++++++++++++++++ 20 files changed, 3242 insertions(+), 1 deletion(-) create mode 100644 include/linux/venetcls.h create mode 100644 net/venetcls/Kconfig create mode 100644 net/venetcls/Makefile create mode 100644 net/venetcls/asmdefs.S create mode 100644 net/venetcls/memcpy-sve.S create mode 100644 net/venetcls/venetcls.h create mode 100644 net/venetcls/venetcls_flow.c create mode 100644 net/venetcls/venetcls_main.c create mode 100644 net/venetcls/venetcls_ntuple.c -- 2.34.1

2 16

[PATCH OLK-6.6 00/25] Fix CVE-2026-45899
by Long Li 23 Jun '26

23 Jun '26

Fix CVE-2026-45899. Baokun Li (9): ext4: add new ext4_ext_path_brelse() helper ext4: get rid of ppath in get_ext_path() ext4: get rid of ppath in ext4_ext_insert_extent() ext4: get rid of ppath in ext4_split_extent_at() ext4: get rid of ppath in ext4_force_split_extent_at() ext4: get rid of ppath in ext4_split_extent() ext4: get rid of ppath in ext4_split_convert_extents() ext4: get rid of ppath in ext4_ext_convert_to_initialized() ext4: get rid of ppath in ext4_ext_handle_unwritten_extents() Dan Carpenter (1): ext4: fix error pointer dereference in ext4_mb_load_buddy_gfp() Jan Kara (1): ext4: always allocate blocks only from groups inode can use Long Li (2): Revert "ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O" Revert "ext4: fix e4b bitmap inconsistency reports" Matthew Wilcox (Oracle) (2): ext4: convert bd_bitmap_page to bd_bitmap_folio ext4: convert bd_buddy_page to bd_buddy_folio Theodore Ts'o (1): ext4: handle wraparound when searching for blocks for indirect mapped blocks Yang Erkun (3): ext4: correct the comments place for EXT4_EXT_MAY_ZEROOUT ext4: rename EXT4_GET_BLOCKS_PRE_IO ext4: cleanup for ext4_map_blocks Yongjian Sun (1): ext4: fix e4b bitmap inconsistency reports Zhang Yi (5): ext4: subdivide EXT4_EXT_DATA_VALID1 ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O ext4: drop extent cache after doing PARTIAL_VALID1 zeroout ext4: drop extent cache when splitting extent fails fs/ext4/ext4.h | 28 +- fs/ext4/extents.c | 575 ++++++++++++++++++++---------------- fs/ext4/fast_commit.c | 8 +- fs/ext4/inode.c | 18 +- fs/ext4/mballoc.c | 220 +++++++------- fs/ext4/mballoc.h | 4 +- fs/ext4/migrate.c | 5 +- fs/ext4/move_extent.c | 34 +-- include/trace/events/ext4.h | 2 +- 9 files changed, 489 insertions(+), 405 deletions(-) -- 2.52.0

1 39

[PATCH OLK-6.6 0/5] net: netfilter: Fix CVE-2026-43025
by superdcc97＠163.com 23 Jun '26

23 Jun '26

From: Dong Chenchen <dongchenchen2(a)huawei.com> Fix CVE-2026-43025 Pablo Neira Ayuso (3): netfilter: nf_conntrack_expect: store netns and zone in expectation netfilter: ctnetlink: ignore explicit helper on new expectations netfilter: nf_conntrack_expect: restore helper propagation via expectation Pratham Gupta (1): netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump Dong Chenchen (1): net: Fix kabi breakage of struct nf_conntrack_expect include/net/netfilter/nf_conntrack_expect.h | 21 ++++++- net/netfilter/nf_conntrack_broadcast.c | 7 ++- net/netfilter/nf_conntrack_core.c | 7 ++- net/netfilter/nf_conntrack_expect.c | 10 +++- net/netfilter/nf_conntrack_h323_main.c | 12 ++-- net/netfilter/nf_conntrack_helper.c | 5 ++ net/netfilter/nf_conntrack_netlink.c | 63 ++++++++------------- net/netfilter/nf_conntrack_sip.c | 2 +- 8 files changed, 73 insertions(+), 54 deletions(-) -- 2.43.0

2 6

[PATCH OLK-5.10 0/3] CVE-2026-45892
by Long Li 23 Jun '26

23 Jun '26

Fix CVE-2026-45892 Zhang Yi (3): ext4: subdivide EXT4_EXT_DATA_VALID1 ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 ext4: drop extent cache after doing PARTIAL_VALID1 zeroout fs/ext4/extents.c | 37 +++++++++++++++++++++++++++++++------ 1 file changed, 31 insertions(+), 6 deletions(-) -- 2.52.0

2 4

[PATCH OLK-5.10 0/2] Fix CVE-2026-45899
by Long Li 23 Jun '26

23 Jun '26

Fix CVE-2026-45899. Zhang Yi (1): ext4: drop extent cache when splitting extent fails zhanchengbin (1): ext4: fix inode tree inconsistency caused by ENOMEM fs/ext4/extents.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) -- 2.52.0

2 3

[PATCH OLK-6.6 00/14] Fix CVE-2026-45899
by Long Li 23 Jun '26

23 Jun '26

Fix CVE-2026-45899 Baokun Li (7): ext4: get rid of ppath in ext4_ext_insert_extent() ext4: get rid of ppath in ext4_split_extent_at() ext4: get rid of ppath in ext4_split_extent() ext4: get rid of ppath in ext4_split_convert_extents() ext4: get rid of ppath in ext4_convert_unwritten_extents_endio() ext4: get rid of ppath in ext4_ext_convert_to_initialized() ext4: get rid of ppath in ext4_ext_handle_unwritten_extents() Long Li (1): Revert "ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O" Yang Erkun (1): ext4: correct the comments place for EXT4_EXT_MAY_ZEROOUT Zhang Yi (5): ext4: subdivide EXT4_EXT_DATA_VALID1 ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O ext4: drop extent cache after doing PARTIAL_VALID1 zeroout ext4: drop extent cache when splitting extent fails fs/ext4/ext4.h | 7 +- fs/ext4/extents.c | 474 +++++++++++++++++++++++------------------- fs/ext4/fast_commit.c | 8 +- fs/ext4/migrate.c | 5 +- 4 files changed, 271 insertions(+), 223 deletions(-) -- 2.52.0

2 15

[PATCH OLK-6.6 v3 0/4] net: Fix CVE-2026-43025
by superdcc97＠163.com 23 Jun '26

23 Jun '26

From: Dong Chenchen <dongchenchen2(a)huawei.com> Fix CVE-2026-43025 Pablo Neira Ayuso (3): netfilter: nf_conntrack_expect: store netns and zone in expectation netfilter: ctnetlink: ignore explicit helper on new expectations netfilter: nf_conntrack_expect: restore helper propagation via expectation Dong Chenchen (1): net: Fix kabi breakage of struct nf_conntrack_expect include/net/netfilter/nf_conntrack_expect.h | 21 ++++++- net/netfilter/nf_conntrack_broadcast.c | 7 ++- net/netfilter/nf_conntrack_core.c | 7 ++- net/netfilter/nf_conntrack_expect.c | 10 +++- net/netfilter/nf_conntrack_h323_main.c | 12 ++-- net/netfilter/nf_conntrack_helper.c | 5 ++ net/netfilter/nf_conntrack_netlink.c | 61 ++++++++------------- net/netfilter/nf_conntrack_sip.c | 2 +- 8 files changed, 72 insertions(+), 53 deletions(-) -- 2.43.0

2 5

[PATCH OLK-6.6 0/3] Fix CVE-2026-45892
by Long Li 23 Jun '26

23 Jun '26

Fix CVE-2026-45892 Zhang Yi (3): ext4: subdivide EXT4_EXT_DATA_VALID1 ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 ext4: drop extent cache after doing PARTIAL_VALID1 zeroout fs/ext4/extents.c | 37 +++++++++++++++++++++++++++++++------ 1 file changed, 31 insertions(+), 6 deletions(-) -- 2.52.0

2 4

[PATCH OLK-6.6 v2 0/4] net: Fix CVE-2026-43025
by superdcc97＠163.com 23 Jun '26

23 Jun '26

From: Dong Chenchen <dongchenchen2(a)huawei.com> Fix CVE-2026-43025 Pablo Neira Ayuso (3): netfilter: nf_conntrack_expect: store netns and zone in expectation netfilter: ctnetlink: ignore explicit helper on new expectations netfilter: nf_conntrack_expect: restore helper propagation via expectation Dong Chenchen (1): net: Fix kabi breakage of struct nf_conntrack_expect include/net/netfilter/nf_conntrack_expect.h | 21 ++++++- net/netfilter/nf_conntrack_broadcast.c | 7 ++- net/netfilter/nf_conntrack_core.c | 7 ++- net/netfilter/nf_conntrack_expect.c | 10 +++- net/netfilter/nf_conntrack_h323_main.c | 12 ++-- net/netfilter/nf_conntrack_helper.c | 5 ++ net/netfilter/nf_conntrack_netlink.c | 61 ++++++++------------- net/netfilter/nf_conntrack_sip.c | 2 +- 8 files changed, 72 insertions(+), 53 deletions(-) -- 2.43.0

2 5

[PATCH OLK-6.6 0/4] net: Fix CVE-2026-43025
by superdcc97＠163.com 22 Jun '26

22 Jun '26

From: Sashiko Review <sashiko(a)example.com> Fix CVE-2026-43025 Pablo Neira Ayuso (3): netfilter: nf_conntrack_expect: store netns and zone in expectation netfilter: ctnetlink: ignore explicit helper on new expectations netfilter: nf_conntrack_expect: restore helper propagation via expectation Dong Chenchen (1): net: Fix kabi breakage of struct nf_conntrack_expect include/net/netfilter/nf_conntrack_expect.h | 21 ++++++- net/netfilter/nf_conntrack_broadcast.c | 7 ++- net/netfilter/nf_conntrack_core.c | 7 ++- net/netfilter/nf_conntrack_expect.c | 10 +++- net/netfilter/nf_conntrack_h323_main.c | 12 ++-- net/netfilter/nf_conntrack_helper.c | 5 ++ net/netfilter/nf_conntrack_netlink.c | 61 ++++++++------------- net/netfilter/nf_conntrack_sip.c | 2 +- 8 files changed, 72 insertions(+), 53 deletions(-) -- 2.43.0

2 5

[PATCH OLK-6.6 0/2] net: Fix CVE-2026-45859
by superdcc97＠163.com 22 Jun '26

22 Jun '26

From: Dong Chenchen <dongchenchen2(a)huawei.com> Fix CVE-2026-45859 Florian Westphal (1): netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation Dong Chenchen (1): net: Fix kabi breakage of struct nf_queue_entry include/net/netfilter/nf_queue.h | 1 + net/netfilter/nfnetlink_queue.c | 122 +++++++++++++++++++------------ 2 files changed, 75 insertions(+), 48 deletions(-) -- 2.43.0

2 3

[PATCH OLK-6.6] perf: arm_pmuv3: Use BR_RETIRED for HW branch event if enabled
by Yushan Wang 22 Jun '26

22 Jun '26

From: Ilkka Koskinen <ilkka(a)os.amperecomputing.com> mainline inclusion from mainline-v6.12-rc1 commit 5967a19f1c2ffb530f5d4589ddc4b4afbb6c7bd4 category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/9455 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ----------------------------------------------- The PMU driver attempts to use PC_WRITE_RETIRED for the HW branch event, if enabled. However, PC_WRITE_RETIRED counts only taken branches, whereas BR_RETIRED counts also non-taken ones. Furthermore, perf uses HW branch event to calculate branch misses ratio, implying BR_RETIRED is the correct event to count. We keep PC_WRITE_RETIRED still as an option in case BR_RETIRED isn't implemented. Signed-off-by: Ilkka Koskinen <ilkka(a)os.amperecomputing.com> Signed-off-by: Yushan Wang <wangyushan12(a)huawei.com> Signed-off-by: Ying Jiang <jiangying44(a)h-partners.com> --- drivers/perf/arm_pmuv3.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/perf/arm_pmuv3.c b/drivers/perf/arm_pmuv3.c index 5d750678a70e..d112d904c8c9 100644 --- a/drivers/perf/arm_pmuv3.c +++ b/drivers/perf/arm_pmuv3.c @@ -1419,14 +1419,14 @@ static int __armv8_pmuv3_map_event_id(struct arm_pmu *armpmu, if (event->attr.type == PERF_TYPE_HARDWARE && event->attr.config == PERF_COUNT_HW_BRANCH_INSTRUCTIONS) { - if (test_bit(ARMV8_PMUV3_PERFCTR_PC_WRITE_RETIRED, - armpmu->pmceid_bitmap)) - return ARMV8_PMUV3_PERFCTR_PC_WRITE_RETIRED; - if (test_bit(ARMV8_PMUV3_PERFCTR_BR_RETIRED, armpmu->pmceid_bitmap)) return ARMV8_PMUV3_PERFCTR_BR_RETIRED; + if (test_bit(ARMV8_PMUV3_PERFCTR_PC_WRITE_RETIRED, + armpmu->pmceid_bitmap)) + return ARMV8_PMUV3_PERFCTR_PC_WRITE_RETIRED; + return HW_OP_UNSUPPORTED; } -- 2.43.0

2 1

[PATCH OLK-6.6] netfilter: nf_tables: use list_del_rcu for netlink hooks
by superdcc97＠163.com 22 Jun '26

22 Jun '26

From: Florian Westphal <fw(a)strlen.de> mainline inclusion from mainline-v7.1-rc2 commit f3224ee463f8f6f6ced7dcdf6081add4f8128527 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15588 CVE: CVE-2026-46324 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- nft_netdev_unregister_hooks and __nft_unregister_flowtable_net_hooks need to use list_del_rcu(), this list can be walked by concurrent dumpers. Add a new helper and use it consistently. Fixes: f9a43007d3f7 ("netfilter: nf_tables: double hook unregistration in netns path") Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/nf_tables_api.c [commit 73319a8ee18b ("netfilter: nf_tables: Have a list of nf_hook_ops in nft_hook") introduced the ops_list structure and __nft_netdev_hook_free_rcu() helper which are not present in OLK-6.6. Adapted to use the single hook->ops and existing kfree_rcu()-based nft_netdev_hook_free_rcu() helper instead.] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/nf_tables_api.c | 38 +++++++++++++++-------------------- 1 file changed, 16 insertions(+), 22 deletions(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 919be34ac7a0..8602dc3dfe08 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -333,6 +333,12 @@ static void nft_netdev_hook_free_rcu(struct nft_hook *hook) kfree_rcu(hook, rcu); } +static void nft_netdev_hook_unlink_free_rcu(struct nft_hook *hook) +{ + list_del_rcu(&hook->list); + nft_netdev_hook_free_rcu(hook); +} + static void nft_netdev_unregister_hooks(struct net *net, struct list_head *hook_list, bool release_netdev) @@ -341,10 +347,8 @@ static void nft_netdev_unregister_hooks(struct net *net, list_for_each_entry_safe(hook, next, hook_list, list) { nf_unregister_net_hook(net, &hook->ops); - if (release_netdev) { - list_del(&hook->list); - nft_netdev_hook_free_rcu(hook); - } + if (release_netdev) + nft_netdev_hook_unlink_free_rcu(hook); } } @@ -2106,10 +2110,8 @@ void nf_tables_chain_destroy(struct nft_chain *chain) if (nft_base_chain_netdev(table->family, basechain->ops.hooknum)) { list_for_each_entry_safe(hook, next, - &basechain->hook_list, list) { - list_del_rcu(&hook->list); - nft_netdev_hook_free_rcu(hook); - } + &basechain->hook_list, list) + nft_netdev_hook_unlink_free_rcu(hook); } module_put(basechain->type->owner); if (rcu_access_pointer(basechain->stats)) { @@ -2784,6 +2786,7 @@ static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy, list_for_each_entry_safe(h, next, &hook.list, list) { if (unregister) nf_unregister_net_hook(ctx->net, &h->ops); + /* hook.list is on stack, no need for list_del_rcu() */ list_del(&h->list); nft_netdev_hook_free_rcu(h); } @@ -8495,10 +8498,8 @@ static void __nft_unregister_flowtable_net_hooks(struct net *net, nf_unregister_net_hook(net, &hook->ops); flowtable->data.type->setup(&flowtable->data, hook->ops.dev, FLOW_BLOCK_UNBIND); - if (release_netdev) { - list_del(&hook->list); - nft_netdev_hook_free_rcu(hook); - } + if (release_netdev) + nft_netdev_hook_unlink_free_rcu(hook); } } @@ -8557,8 +8558,7 @@ static int nft_register_flowtable_net_hooks(struct net *net, break; nft_unregister_flowtable_hook(net, flowtable, hook); - list_del_rcu(&hook->list); - nft_netdev_hook_free_rcu(hook); + nft_netdev_hook_unlink_free_rcu(hook); } return err; @@ -8655,8 +8655,7 @@ static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh, list_for_each_entry_safe(hook, next, &flowtable_hook.list, list) { if (unregister) nft_unregister_flowtable_hook(ctx->net, flowtable, hook); - list_del_rcu(&hook->list); - nft_netdev_hook_free_rcu(hook); + nft_netdev_hook_unlink_free_rcu(hook); } return err; @@ -9149,13 +9148,8 @@ static void nf_tables_flowtable_notify(struct nft_ctx *ctx, static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable) { - struct nft_hook *hook, *next; - flowtable->data.type->free(&flowtable->data); - list_for_each_entry_safe(hook, next, &flowtable->hook_list, list) { - list_del_rcu(&hook->list); - nft_netdev_hook_free_rcu(hook); - } + nft_hooks_destroy(&flowtable->hook_list); kfree(flowtable->name); module_put(flowtable->data.type->owner); kfree(flowtable); -- 2.43.0

2 1

[PATCH OLK-5.10] ext4: don't cache extent during splitting extent
by Long Li 18 Jun '26

18 Jun '26

From: Zhang Yi <yi.zhang(a)huawei.com> stable inclusion from stable-v5.10.251 commit 8302b5b4aacdbb378f7b1216bb2ee782b5142415 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15152 CVE: CVE-2026-45912 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 8b4b19a2f96348d70bfa306ef7d4a13b0bcbea79 upstream. Caching extents during the splitting process is risky, as it may result in stale extents remaining in the status tree. Moreover, in most cases, the corresponding extent block entries are likely already cached before the split happens, making caching here not particularly useful. Assume we have an unwritten extent, and then DIO writes the first half. [UUUUUUUUUUUUUUUU] on-disk extent U: unwritten extent [UUUUUUUUUUUUUUUU] extent status tree |<- ->| ----> dio write this range First, when ext4_split_extent_at() splits this extent, it truncates the existing extent and then inserts a new one. During this process, this extent status entry may be shrunk, and calls to ext4_find_extent() and ext4_cache_extents() may occur, which could potentially insert the truncated range as a hole into the extent status tree. After the split is completed, this hole is not replaced with the correct status. [UUUUUUU|UUUUUUUU] on-disk extent U: unwritten extent [UUUUUUU|HHHHHHHH] extent status tree H: hole Then, the outer calling functions will not correct this remaining hole extent either. Finally, if we perform a delayed buffer write on this latter part, it will re-insert the delayed extent and cause an error in space accounting. In adition, if the unwritten extent cache is not shrunk during the splitting, ext4_cache_extents() also conflicts with existing extents when caching extents. In the future, we will add checks when caching extents, which will trigger a warning. Therefore, Do not cache extents that are being split. Signed-off-by: Zhang Yi <yi.zhang(a)huawei.com> Reviewed-by: Ojaswin Mujoo <ojaswin(a)linux.ibm.com> Reviewed-by: Baokun Li <libaokun1(a)huawei.com> Cc: stable(a)kernel.org Message-ID: <20251129103247.686136-6-yi.zhang(a)huaweicloud.com> Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/ext4/extents.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c index 89a43a8fa808..ac260a66b4d9 100644 --- a/fs/ext4/extents.c +++ b/fs/ext4/extents.c @@ -3214,6 +3214,9 @@ static int ext4_split_extent_at(handle_t *handle, BUG_ON((split_flag & (EXT4_EXT_DATA_VALID1 | EXT4_EXT_DATA_VALID2)) == (EXT4_EXT_DATA_VALID1 | EXT4_EXT_DATA_VALID2)); + /* Do not cache extents that are in the process of being modified. */ + flags |= EXT4_EX_NOCACHE; + ext_debug(inode, "logical block %llu\n", (unsigned long long)split); ext4_ext_show_leaf(inode, path); @@ -3389,6 +3392,9 @@ static int ext4_split_extent(handle_t *handle, ee_len = ext4_ext_get_actual_len(ex); unwritten = ext4_ext_is_unwritten(ex); + /* Do not cache extents that are in the process of being modified. */ + flags |= EXT4_EX_NOCACHE; + if (map->m_lblk + map->m_len < ee_block + ee_len) { split_flag1 = split_flag & EXT4_EXT_MAY_ZEROOUT; flags1 = flags | EXT4_GET_BLOCKS_PRE_IO; -- 2.52.0

2 1

[PATCH OLK-6.6] xfs: remove xfs_attr_leaf_hasname
by Long Li 18 Jun '26

18 Jun '26

From: Christoph Hellwig <hch(a)lst.de> mainline inclusion from mainline-v6.19-rc6 commit 3a65ea768b8094e4699e72f9ab420eb9e0f3f568 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14700 CVE: CVE-2026-43153 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- mainline inclusion from mainline-v6.17-rc7 commit 3a65ea768b8094e4699e72f9ab420eb9e0f3f568 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14700 CVE: CVE-2026-43153 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The calling convention of xfs_attr_leaf_hasname() is problematic, because it returns a NULL buffer when xfs_attr3_leaf_read fails, a valid buffer when xfs_attr3_leaf_lookup_int returns -ENOATTR or -EEXIST, and a non-NULL buffer pointer for an already released buffer when xfs_attr3_leaf_lookup_int fails with other error values. Fix this by simply open coding xfs_attr_leaf_hasname in the callers, so that the buffer release code is done by each caller of xfs_attr3_leaf_read. Cc: stable(a)vger.kernel.org # v5.19+ Fixes: 07120f1abdff ("xfs: Add xfs_has_attr and subroutines") Reported-by: Mark Tinguely <mark.tinguely(a)oracle.com> Signed-off-by: Christoph Hellwig <hch(a)lst.de> Reviewed-by: Darrick J. Wong <djwong(a)kernel.org> Signed-off-by: Carlos Maiolino <cem(a)kernel.org> Conflicts: fs/xfs/libxfs/xfs_attr.c [Context conflicts] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/xfs/libxfs/xfs_attr.c | 75 +++++++++++++--------------------------- 1 file changed, 24 insertions(+), 51 deletions(-) diff --git a/fs/xfs/libxfs/xfs_attr.c b/fs/xfs/libxfs/xfs_attr.c index 33edf047e0ad..1a2e69d89113 100644 --- a/fs/xfs/libxfs/xfs_attr.c +++ b/fs/xfs/libxfs/xfs_attr.c @@ -49,7 +49,6 @@ STATIC int xfs_attr_shortform_addname(xfs_da_args_t *args); */ STATIC int xfs_attr_leaf_get(xfs_da_args_t *args); STATIC int xfs_attr_leaf_removename(xfs_da_args_t *args); -STATIC int xfs_attr_leaf_hasname(struct xfs_da_args *args, struct xfs_buf **bp); STATIC int xfs_attr_leaf_try_add(struct xfs_da_args *args); /* @@ -866,11 +865,12 @@ xfs_attr_lookup( return xfs_attr_sf_findname(args, NULL, NULL); if (xfs_attr_is_leaf(dp)) { - error = xfs_attr_leaf_hasname(args, &bp); - - if (bp) - xfs_trans_brelse(args->trans, bp); - + error = xfs_attr3_leaf_read(args->trans, args->dp, + 0, &bp); + if (error) + return error; + error = xfs_attr3_leaf_lookup_int(bp, args); + xfs_trans_brelse(args->trans, bp); return error; } @@ -1246,27 +1246,6 @@ xfs_attr_leaf_try_add( return error; } -/* - * Return EEXIST if attr is found, or ENOATTR if not - */ -STATIC int -xfs_attr_leaf_hasname( - struct xfs_da_args *args, - struct xfs_buf **bp) -{ - int error = 0; - - error = xfs_attr3_leaf_read(args->trans, args->dp, 0, bp); - if (error) - return error; - - error = xfs_attr3_leaf_lookup_int(*bp, args); - if (error != -ENOATTR && error != -EEXIST) - xfs_trans_brelse(args->trans, *bp); - - return error; -} - /* * Remove a name from the leaf attribute list structure * @@ -1277,25 +1256,22 @@ STATIC int xfs_attr_leaf_removename( struct xfs_da_args *args) { - struct xfs_inode *dp; - struct xfs_buf *bp; + struct xfs_inode *dp = args->dp; int error, forkoff; + struct xfs_buf *bp; trace_xfs_attr_leaf_removename(args); - /* - * Remove the attribute. - */ - dp = args->dp; - - error = xfs_attr_leaf_hasname(args, &bp); - if (error == -ENOATTR) { + error = xfs_attr3_leaf_read(args->trans, args->dp, 0, &bp); + if (error) + return error; + error = xfs_attr3_leaf_lookup_int(bp, args); + if (error != -EEXIST) { xfs_trans_brelse(args->trans, bp); - if (args->op_flags & XFS_DA_OP_RECOVERY) + if (error == -ENOATTR && (args->op_flags & XFS_DA_OP_RECOVERY)) return 0; return error; - } else if (error != -EEXIST) - return error; + } xfs_attr3_leaf_remove(bp, args); @@ -1319,23 +1295,20 @@ xfs_attr_leaf_removename( * Returns 0 on successful retrieval, otherwise an error. */ STATIC int -xfs_attr_leaf_get(xfs_da_args_t *args) +xfs_attr_leaf_get( + struct xfs_da_args *args) { - struct xfs_buf *bp; - int error; + struct xfs_buf *bp; + int error; trace_xfs_attr_leaf_get(args); - error = xfs_attr_leaf_hasname(args, &bp); - - if (error == -ENOATTR) { - xfs_trans_brelse(args->trans, bp); + error = xfs_attr3_leaf_read(args->trans, args->dp, 0, &bp); + if (error) return error; - } else if (error != -EEXIST) - return error; - - - error = xfs_attr3_leaf_getvalue(bp, args); + error = xfs_attr3_leaf_lookup_int(bp, args); + if (error == -EEXIST) + error = xfs_attr3_leaf_getvalue(bp, args); xfs_trans_brelse(args->trans, bp); return error; } -- 2.52.0

2 1

[PATCH OLK-5.10] hfs: validate record offset in hfsplus_bmap_alloc
by Jinjiang Tu 18 Jun '26

18 Jun '26

From: Yang Chenzhi <yang.chenzhi(a)vivo.com> stable inclusion from stable-v5.10.246 commit 40dfe7a4215a1f20842561ffaf5a6f83a987e75b category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/11616 CVE: CVE-2025-40349 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 738d5a51864ed8d7a68600b8c0c63fe6fe5c4f20 ] hfsplus_bmap_alloc can trigger a crash if a record offset or length is larger than node_size [ 15.264282] BUG: KASAN: slab-out-of-bounds in hfsplus_bmap_alloc+0x887/0x8b0 [ 15.265192] Read of size 8 at addr ffff8881085ca188 by task test/183 [ 15.265949] [ 15.266163] CPU: 0 UID: 0 PID: 183 Comm: test Not tainted 6.17.0-rc2-gc17b750b3ad9 #14 PREEMPT(voluntary) [ 15.266165] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 15.266167] Call Trace: [ 15.266168] <TASK> [ 15.266169] dump_stack_lvl+0x53/0x70 [ 15.266173] print_report+0xd0/0x660 [ 15.266181] kasan_report+0xce/0x100 [ 15.266185] hfsplus_bmap_alloc+0x887/0x8b0 [ 15.266208] hfs_btree_inc_height.isra.0+0xd5/0x7c0 [ 15.266217] hfsplus_brec_insert+0x870/0xb00 [ 15.266222] __hfsplus_ext_write_extent+0x428/0x570 [ 15.266225] __hfsplus_ext_cache_extent+0x5e/0x910 [ 15.266227] hfsplus_ext_read_extent+0x1b2/0x200 [ 15.266233] hfsplus_file_extend+0x5a7/0x1000 [ 15.266237] hfsplus_get_block+0x12b/0x8c0 [ 15.266238] __block_write_begin_int+0x36b/0x12c0 [ 15.266251] block_write_begin+0x77/0x110 [ 15.266252] cont_write_begin+0x428/0x720 [ 15.266259] hfsplus_write_begin+0x51/0x100 [ 15.266262] cont_write_begin+0x272/0x720 [ 15.266270] hfsplus_write_begin+0x51/0x100 [ 15.266274] generic_perform_write+0x321/0x750 [ 15.266285] generic_file_write_iter+0xc3/0x310 [ 15.266289] __kernel_write_iter+0x2fd/0x800 [ 15.266296] dump_user_range+0x2ea/0x910 [ 15.266301] elf_core_dump+0x2a94/0x2ed0 [ 15.266320] vfs_coredump+0x1d85/0x45e0 [ 15.266349] get_signal+0x12e3/0x1990 [ 15.266357] arch_do_signal_or_restart+0x89/0x580 [ 15.266362] irqentry_exit_to_user_mode+0xab/0x110 [ 15.266364] asm_exc_page_fault+0x26/0x30 [ 15.266366] RIP: 0033:0x41bd35 [ 15.266367] Code: bc d1 f3 0f 7f 27 f3 0f 7f 6f 10 f3 0f 7f 77 20 f3 0f 7f 7f 30 49 83 c0 0f 49 29 d0 48 8d 7c 17 31 e9 9f 0b 00 00 66 0f ef c0 <f3> 0f 6f 0e f3 0f 6f 56 10 66 0f 74 c1 66 0f d7 d0 49 83 f8f [ 15.266369] RSP: 002b:00007ffc9e62d078 EFLAGS: 00010283 [ 15.266371] RAX: 00007ffc9e62d100 RBX: 0000000000000000 RCX: 0000000000000000 [ 15.266372] RDX: 00000000000000e0 RSI: 0000000000000000 RDI: 00007ffc9e62d100 [ 15.266373] RBP: 0000400000000040 R08: 00000000000000e0 R09: 0000000000000000 [ 15.266374] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 15.266375] R13: 0000000000000000 R14: 0000000000000000 R15: 0000400000000000 [ 15.266376] </TASK> When calling hfsplus_bmap_alloc to allocate a free node, this function first retrieves the bitmap from header node and map node using node->page together with the offset and length from hfs_brec_lenoff ``` len = hfs_brec_lenoff(node, 2, &off16); off = off16; off += node->page_offset; pagep = node->page + (off >> PAGE_SHIFT); data = kmap_local_page(*pagep); ``` However, if the retrieved offset or length is invalid(i.e. exceeds node_size), the code may end up accessing pages outside the allocated range for this node. This patch adds proper validation of both offset and length before use, preventing out-of-bounds page access. Move is_bnode_offset_valid and check_and_correct_requested_length to hfsplus_fs.h, as they may be required by other functions. Reported-by: syzbot+356aed408415a56543cd(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/67bcb4a6.050a0220.bbfd1.008f.GAE@google.com/ Signed-off-by: Yang Chenzhi <yang.chenzhi(a)vivo.com> Reviewed-by: Viacheslav Dubeyko <slava(a)dubeyko.com> Signed-off-by: Viacheslav Dubeyko <slava(a)dubeyko.com> Link: https://lore.kernel.org/r/20250818141734.8559-2-yang.chenzhi@vivo.com Signed-off-by: Viacheslav Dubeyko <slava(a)dubeyko.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: fs/hfsplus/hfsplus_fs.h [Context conflicts.] Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- fs/hfsplus/bnode.c | 41 ---------------------------------------- fs/hfsplus/btree.c | 6 ++++++ fs/hfsplus/hfsplus_fs.h | 42 +++++++++++++++++++++++++++++++++++++++++ 3 files changed, 48 insertions(+), 41 deletions(-) diff --git a/fs/hfsplus/bnode.c b/fs/hfsplus/bnode.c index c9c38fddf505..e566cea23827 100644 --- a/fs/hfsplus/bnode.c +++ b/fs/hfsplus/bnode.c @@ -18,47 +18,6 @@ #include "hfsplus_fs.h" #include "hfsplus_raw.h" -static inline -bool is_bnode_offset_valid(struct hfs_bnode *node, int off) -{ - bool is_valid = off < node->tree->node_size; - - if (!is_valid) { - pr_err("requested invalid offset: " - "NODE: id %u, type %#x, height %u, " - "node_size %u, offset %d\n", - node->this, node->type, node->height, - node->tree->node_size, off); - } - - return is_valid; -} - -static inline -int check_and_correct_requested_length(struct hfs_bnode *node, int off, int len) -{ - unsigned int node_size; - - if (!is_bnode_offset_valid(node, off)) - return 0; - - node_size = node->tree->node_size; - - if ((off + len) > node_size) { - int new_len = (int)node_size - off; - - pr_err("requested length has been corrected: " - "NODE: id %u, type %#x, height %u, " - "node_size %u, offset %d, " - "requested_len %d, corrected_len %d\n", - node->this, node->type, node->height, - node->tree->node_size, off, len, new_len); - - return new_len; - } - - return len; -} /* Copy a specified range of bytes from the raw data of a node */ void hfs_bnode_read(struct hfs_bnode *node, void *buf, int off, int len) diff --git a/fs/hfsplus/btree.c b/fs/hfsplus/btree.c index 66774f4cb4fd..2211907537fe 100644 --- a/fs/hfsplus/btree.c +++ b/fs/hfsplus/btree.c @@ -392,6 +392,12 @@ struct hfs_bnode *hfs_bmap_alloc(struct hfs_btree *tree) len = hfs_brec_lenoff(node, 2, &off16); off = off16; + if (!is_bnode_offset_valid(node, off)) { + hfs_bnode_put(node); + return ERR_PTR(-EIO); + } + len = check_and_correct_requested_length(node, off, len); + off += node->page_offset; pagep = node->page + (off >> PAGE_SHIFT); data = kmap(*pagep); diff --git a/fs/hfsplus/hfsplus_fs.h b/fs/hfsplus/hfsplus_fs.h index daf5a828eaaf..ff43287ba29a 100644 --- a/fs/hfsplus/hfsplus_fs.h +++ b/fs/hfsplus/hfsplus_fs.h @@ -562,6 +562,48 @@ static inline __be32 __hfsp_ut2mt(time64_t ut) return cpu_to_be32(lower_32_bits(ut) + HFSPLUS_UTC_OFFSET); } +static inline +bool is_bnode_offset_valid(struct hfs_bnode *node, int off) +{ + bool is_valid = off < node->tree->node_size; + + if (!is_valid) { + pr_err("requested invalid offset: " + "NODE: id %u, type %#x, height %u, " + "node_size %u, offset %d\n", + node->this, node->type, node->height, + node->tree->node_size, off); + } + + return is_valid; +} + +static inline +int check_and_correct_requested_length(struct hfs_bnode *node, int off, int len) +{ + unsigned int node_size; + + if (!is_bnode_offset_valid(node, off)) + return 0; + + node_size = node->tree->node_size; + + if ((off + len) > node_size) { + int new_len = (int)node_size - off; + + pr_err("requested length has been corrected: " + "NODE: id %u, type %#x, height %u, " + "node_size %u, offset %d, " + "requested_len %d, corrected_len %d\n", + node->this, node->type, node->height, + node->tree->node_size, off, len, new_len); + + return new_len; + } + + return len; +} + /* compatibility */ #define hfsp_mt2ut(t) (struct timespec64){ .tv_sec = __hfsp_mt2ut(t) } #define hfsp_ut2mt(t) __hfsp_ut2mt((t).tv_sec) -- 2.43.0

2 1

[PATCH OLK-5.10] libceph: make decode_pool() more resilient against corrupted osdmaps
by Jinjiang Tu 18 Jun '26

18 Jun '26

From: Ilya Dryomov <idryomov(a)gmail.com> stable inclusion from stable-v5.10.248 commit d061be4c8040ffb1110d537654a038b8b6ad39d2 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13431 CVE: CVE-2025-71116 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 8c738512714e8c0aa18f8a10c072d5b01c83db39 upstream. If the osdmap is (maliciously) corrupted such that the encoded length of ceph_pg_pool envelope is less than what is expected for a particular encoding version, out-of-bounds reads may ensue because the only bounds check that is there is based on that length value. This patch adds explicit bounds checks for each field that is decoded or skipped. Cc: stable(a)vger.kernel.org Reported-by: ziming zhang <ezrakiez(a)gmail.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Reviewed-by: Xiubo Li <xiubli(a)redhat.com> Tested-by: ziming zhang <ezrakiez(a)gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lin Yujun <linyujun809(a)h-partners.com> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- net/ceph/osdmap.c | 116 +++++++++++++++++++++------------------------- 1 file changed, 52 insertions(+), 64 deletions(-) diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c index fe6de7d72752..fe796775e3e9 100644 --- a/net/ceph/osdmap.c +++ b/net/ceph/osdmap.c @@ -790,51 +790,49 @@ static int decode_pool(void **p, void *end, struct ceph_pg_pool_info *pi) ceph_decode_need(p, end, len, bad); pool_end = *p + len; + ceph_decode_need(p, end, 4 + 4 + 4, bad); pi->type = ceph_decode_8(p); pi->size = ceph_decode_8(p); pi->crush_ruleset = ceph_decode_8(p); pi->object_hash = ceph_decode_8(p); - pi->pg_num = ceph_decode_32(p); pi->pgp_num = ceph_decode_32(p); - *p += 4 + 4; /* skip lpg* */ - *p += 4; /* skip last_change */ - *p += 8 + 4; /* skip snap_seq, snap_epoch */ + /* lpg*, last_change, snap_seq, snap_epoch */ + ceph_decode_skip_n(p, end, 8 + 4 + 8 + 4, bad); /* skip snaps */ - num = ceph_decode_32(p); + ceph_decode_32_safe(p, end, num, bad); while (num--) { - *p += 8; /* snapid key */ - *p += 1 + 1; /* versions */ - len = ceph_decode_32(p); - *p += len; + /* snapid key, pool snap (with versions) */ + ceph_decode_skip_n(p, end, 8 + 2, bad); + ceph_decode_skip_string(p, end, bad); } - /* skip removed_snaps */ - num = ceph_decode_32(p); - *p += num * (8 + 8); + /* removed_snaps */ + ceph_decode_skip_map(p, end, 64, 64, bad); + ceph_decode_need(p, end, 8 + 8 + 4, bad); *p += 8; /* skip auid */ pi->flags = ceph_decode_64(p); *p += 4; /* skip crash_replay_interval */ if (ev >= 7) - pi->min_size = ceph_decode_8(p); + ceph_decode_8_safe(p, end, pi->min_size, bad); else pi->min_size = pi->size - pi->size / 2; if (ev >= 8) - *p += 8 + 8; /* skip quota_max_* */ + /* quota_max_* */ + ceph_decode_skip_n(p, end, 8 + 8, bad); if (ev >= 9) { - /* skip tiers */ - num = ceph_decode_32(p); - *p += num * 8; + /* tiers */ + ceph_decode_skip_set(p, end, 64, bad); + ceph_decode_need(p, end, 8 + 1 + 8 + 8, bad); *p += 8; /* skip tier_of */ *p += 1; /* skip cache_mode */ - pi->read_tier = ceph_decode_64(p); pi->write_tier = ceph_decode_64(p); } else { @@ -842,86 +840,76 @@ static int decode_pool(void **p, void *end, struct ceph_pg_pool_info *pi) pi->write_tier = -1; } - if (ev >= 10) { - /* skip properties */ - num = ceph_decode_32(p); - while (num--) { - len = ceph_decode_32(p); - *p += len; /* key */ - len = ceph_decode_32(p); - *p += len; /* val */ - } - } + if (ev >= 10) + /* properties */ + ceph_decode_skip_map(p, end, string, string, bad); if (ev >= 11) { - /* skip hit_set_params */ - *p += 1 + 1; /* versions */ - len = ceph_decode_32(p); - *p += len; + /* hit_set_params (with versions) */ + ceph_decode_skip_n(p, end, 2, bad); + ceph_decode_skip_string(p, end, bad); - *p += 4; /* skip hit_set_period */ - *p += 4; /* skip hit_set_count */ + /* hit_set_period, hit_set_count */ + ceph_decode_skip_n(p, end, 4 + 4, bad); } if (ev >= 12) - *p += 4; /* skip stripe_width */ + /* stripe_width */ + ceph_decode_skip_32(p, end, bad); - if (ev >= 13) { - *p += 8; /* skip target_max_bytes */ - *p += 8; /* skip target_max_objects */ - *p += 4; /* skip cache_target_dirty_ratio_micro */ - *p += 4; /* skip cache_target_full_ratio_micro */ - *p += 4; /* skip cache_min_flush_age */ - *p += 4; /* skip cache_min_evict_age */ - } + if (ev >= 13) + /* target_max_*, cache_target_*, cache_min_* */ + ceph_decode_skip_n(p, end, 16 + 8 + 8, bad); - if (ev >= 14) { - /* skip erasure_code_profile */ - len = ceph_decode_32(p); - *p += len; - } + if (ev >= 14) + /* erasure_code_profile */ + ceph_decode_skip_string(p, end, bad); /* * last_force_op_resend_preluminous, will be overridden if the * map was encoded with RESEND_ON_SPLIT */ if (ev >= 15) - pi->last_force_request_resend = ceph_decode_32(p); + ceph_decode_32_safe(p, end, pi->last_force_request_resend, bad); else pi->last_force_request_resend = 0; if (ev >= 16) - *p += 4; /* skip min_read_recency_for_promote */ + /* min_read_recency_for_promote */ + ceph_decode_skip_32(p, end, bad); if (ev >= 17) - *p += 8; /* skip expected_num_objects */ + /* expected_num_objects */ + ceph_decode_skip_64(p, end, bad); if (ev >= 19) - *p += 4; /* skip cache_target_dirty_high_ratio_micro */ + /* cache_target_dirty_high_ratio_micro */ + ceph_decode_skip_32(p, end, bad); if (ev >= 20) - *p += 4; /* skip min_write_recency_for_promote */ + /* min_write_recency_for_promote */ + ceph_decode_skip_32(p, end, bad); if (ev >= 21) - *p += 1; /* skip use_gmt_hitset */ + /* use_gmt_hitset */ + ceph_decode_skip_8(p, end, bad); if (ev >= 22) - *p += 1; /* skip fast_read */ + /* fast_read */ + ceph_decode_skip_8(p, end, bad); - if (ev >= 23) { - *p += 4; /* skip hit_set_grade_decay_rate */ - *p += 4; /* skip hit_set_search_last_n */ - } + if (ev >= 23) + /* hit_set_grade_decay_rate, hit_set_search_last_n */ + ceph_decode_skip_n(p, end, 4 + 4, bad); if (ev >= 24) { - /* skip opts */ - *p += 1 + 1; /* versions */ - len = ceph_decode_32(p); - *p += len; + /* opts (with versions) */ + ceph_decode_skip_n(p, end, 2, bad); + ceph_decode_skip_string(p, end, bad); } if (ev >= 25) - pi->last_force_request_resend = ceph_decode_32(p); + ceph_decode_32_safe(p, end, pi->last_force_request_resend, bad); /* ignore the rest */ -- 2.43.0

2 1

[PATCH OLK-5.10] xfs: fix freemap adjustments when adding xattrs to leaf blocks
by Long Li 18 Jun '26

18 Jun '26

From: "Darrick J. Wong" <djwong(a)kernel.org> stable inclusion from stable-v5.10.251 commit d08976725355b9d54d8332fce223fa281cc304a5 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14828 CVE: CVE-2026-43158 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 3eefc0c2b78444b64feeb3783c017d6adc3cd3ce ] xfs/592 and xfs/794 both trip this assertion in the leaf block freemap adjustment code after ~20 minutes of running on my test VMs: ASSERT(ichdr->firstused >= ichdr->count * sizeof(xfs_attr_leaf_entry_t) + xfs_attr3_leaf_hdr_size(leaf)); Upon enabling quite a lot more debugging code, I narrowed this down to fsstress trying to set a local extended attribute with namelen=3 and valuelen=71. This results in an entry size of 80 bytes. At the start of xfs_attr3_leaf_add_work, the freemap looks like this: i 0 base 448 size 0 rhs 448 count 46 i 1 base 388 size 132 rhs 448 count 46 i 2 base 2120 size 4 rhs 448 count 46 firstused = 520 where "rhs" is the first byte past the end of the leaf entry array. This is inconsistent -- the entries array ends at byte 448, but freemap[1] says there's free space starting at byte 388! By the end of the function, the freemap is in worse shape: i 0 base 456 size 0 rhs 456 count 47 i 1 base 388 size 52 rhs 456 count 47 i 2 base 2120 size 4 rhs 456 count 47 firstused = 440 Important note: 388 is not aligned with the entries array element size of 8 bytes. Based on the incorrect freemap, the name area starts at byte 440, which is below the end of the entries array! That's why the assertion triggers and the filesystem shuts down. How did we end up here? First, recall from the previous patch that the freemap array in an xattr leaf block is not intended to be a comprehensive map of all free space in the leaf block. In other words, it's perfectly legal to have a leaf block with: * 376 bytes in use by the entries array * freemap[0] has [base = 376, size = 8] * freemap[1] has [base = 388, size = 1500] * the space between 376 and 388 is free, but the freemap stopped tracking that some time ago If we add one xattr, the entries array grows to 384 bytes, and freemap[0] becomes [base = 384, size = 0]. So far, so good. But if we add a second xattr, the entries array grows to 392 bytes, and freemap[0] gets pushed up to [base = 392, size = 0]. This is bad, because freemap[1] hasn't been updated, and now the entries array and the free space claim the same space. The fix here is to adjust all freemap entries so that none of them collide with the entries array. Note that this fix relies on commit 2a2b5932db6758 ("xfs: fix attr leaf header freemap.size underflow") and the previous patch that resets zero length freemap entries to have base = 0. Cc: <stable(a)vger.kernel.org> # v2.6.12 Fixes: 1da177e4c3f415 ("Linux-2.6.12-rc2") Signed-off-by: "Darrick J. Wong" <djwong(a)kernel.org> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Yujun <linyujun809(a)h-partners.com> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/xfs/libxfs/xfs_attr_leaf.c | 36 +++++++++++++++++++++++++++-------- 1 file changed, 28 insertions(+), 8 deletions(-) diff --git a/fs/xfs/libxfs/xfs_attr_leaf.c b/fs/xfs/libxfs/xfs_attr_leaf.c index 3954bf017c8d..3da4643b26cb 100644 --- a/fs/xfs/libxfs/xfs_attr_leaf.c +++ b/fs/xfs/libxfs/xfs_attr_leaf.c @@ -1472,6 +1472,7 @@ xfs_attr3_leaf_add_work( struct xfs_attr_leaf_name_local *name_loc; struct xfs_attr_leaf_name_remote *name_rmt; struct xfs_mount *mp; + int old_end, new_end; int tmp; int i; @@ -1563,17 +1564,36 @@ xfs_attr3_leaf_add_work( if (be16_to_cpu(entry->nameidx) < ichdr->firstused) ichdr->firstused = be16_to_cpu(entry->nameidx); - ASSERT(ichdr->firstused >= ichdr->count * sizeof(xfs_attr_leaf_entry_t) - + xfs_attr3_leaf_hdr_size(leaf)); - tmp = (ichdr->count - 1) * sizeof(xfs_attr_leaf_entry_t) - + xfs_attr3_leaf_hdr_size(leaf); + new_end = ichdr->count * sizeof(struct xfs_attr_leaf_entry) + + xfs_attr3_leaf_hdr_size(leaf); + old_end = new_end - sizeof(struct xfs_attr_leaf_entry); + + ASSERT(ichdr->firstused >= new_end); for (i = 0; i < XFS_ATTR_LEAF_MAPSIZE; i++) { - if (ichdr->freemap[i].base == tmp) { - ichdr->freemap[i].base += sizeof(xfs_attr_leaf_entry_t); + int diff = 0; + + if (ichdr->freemap[i].base == old_end) { + /* + * This freemap entry starts at the old end of the + * leaf entry array, so we need to adjust its base + * upward to accomodate the larger array. + */ + diff = sizeof(struct xfs_attr_leaf_entry); + } else if (ichdr->freemap[i].size > 0 && + ichdr->freemap[i].base < new_end) { + /* + * This freemap entry starts in the space claimed by + * the new leaf entry. Adjust its base upward to + * reflect that. + */ + diff = new_end - ichdr->freemap[i].base; + } + + if (diff) { + ichdr->freemap[i].base += diff; ichdr->freemap[i].size -= - min_t(uint16_t, ichdr->freemap[i].size, - sizeof(xfs_attr_leaf_entry_t)); + min_t(uint16_t, ichdr->freemap[i].size, diff); } /* -- 2.52.0

2 1

[PATCH OLK-6.6] nvmet-tcp: fix race between ICReq handling and queue teardown
by Long Li 18 Jun '26

18 Jun '26

From: Chaitanya Kulkarni <kch(a)nvidia.com> mainline inclusion from mainline-v7.0-rc3 commit 5293a8882c549fab4a878bc76b0b6c951f980a61 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15382 CVE: CVE-2026-46135 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- nvmet_tcp_handle_icreq() updates queue->state after sending an Initialization Connection Response (ICResp), but it does so without serializing against target-side queue teardown. If an NVMe/TCP host sends an Initialization Connection Request (ICReq) and immediately closes the connection, target-side teardown may start in softirq context before io_work drains the already buffered ICReq. In that case, nvmet_tcp_schedule_release_queue() sets queue->state to NVMET_TCP_Q_DISCONNECTING and drops the queue reference under state_lock. If io_work later processes that ICReq, nvmet_tcp_handle_icreq() can still overwrite the state back to NVMET_TCP_Q_LIVE. That defeats the DISCONNECTING-state guard in nvmet_tcp_schedule_release_queue() and allows a later socket state change to re-enter teardown and issue a second kref_put() on an already released queue. The ICResp send failure path has the same problem. If teardown has already moved the queue to DISCONNECTING, a send error can still overwrite the state with NVMET_TCP_Q_FAILED, again reopening the window for a second teardown path to drop the queue reference. Fix this by serializing both post-send state transitions with state_lock and bailing out if teardown has already started. Use -ESHUTDOWN as an internal sentinel for that bail-out path rather than propagating it as a transport error like -ECONNRESET. Keep nvmet_tcp_socket_error() setting rcv_state to NVMET_TCP_RECV_ERR before honoring that sentinel so receive-side parsing stays quiesced until the existing release path completes. Fixes: c46a6465bac2 ("nvmet-tcp: add NVMe over TCP target driver") Cc: stable(a)vger.kernel.org Reported-by: Shivam Kumar <skumar47(a)syr.edu> Tested-by: Shivam Kumar <kumar.shivam43666(a)gmail.com> Signed-off-by: Chaitanya Kulkarni <kch(a)nvidia.com> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Conflicts: drivers/nvme/target/tcp.c [not merge main commit 675b453e0241 ("nvmet-tcp: enable TLS handshake upcall")] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- drivers/nvme/target/tcp.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c index 5f85c4a812ab..6ec6912b2b47 100644 --- a/drivers/nvme/target/tcp.c +++ b/drivers/nvme/target/tcp.c @@ -389,6 +389,19 @@ static void nvmet_tcp_fatal_error(struct nvmet_tcp_queue *queue) static void nvmet_tcp_socket_error(struct nvmet_tcp_queue *queue, int status) { + /* + * Keep rcv_state at RECV_ERR even for the internal -ESHUTDOWN path. + * nvmet_tcp_handle_icreq() can return -ESHUTDOWN after the ICReq has + * already been consumed and queue teardown has started. + * + * If nvmet_tcp_data_ready() or nvmet_tcp_write_space() queues + * nvmet_tcp_io_work() again before nvmet_tcp_release_queue_work() + * cancels it, the queue must not keep that old receive state. + * Otherwise the next nvmet_tcp_io_work() run can reach + * nvmet_tcp_done_recv_pdu() and try to handle the same ICReq again. + * + * That is why queue->rcv_state needs to be updated before we return. + */ queue->rcv_state = NVMET_TCP_RECV_ERR; if (status == -EPIPE || status == -ECONNRESET) kernel_sock_shutdown(queue->sock, SHUT_RDWR); @@ -938,7 +951,14 @@ static int nvmet_tcp_handle_icreq(struct nvmet_tcp_queue *queue) if (ret < 0) return ret; /* queue removal will cleanup */ + spin_lock_bh(&queue->state_lock); + if (queue->state == NVMET_TCP_Q_DISCONNECTING) { + spin_unlock_bh(&queue->state_lock); + /* Tell nvmet_tcp_socket_error() teardown is in progress. */ + return -ESHUTDOWN; + } queue->state = NVMET_TCP_Q_LIVE; + spin_unlock_bh(&queue->state_lock); nvmet_prepare_receive_pdu(queue); return 0; } -- 2.52.0

2 1

[PATCH OLK-5.10] nvmet-tcp: fix race between ICReq handling and queue teardown
by Long Li 18 Jun '26

18 Jun '26

From: Chaitanya Kulkarni <kch(a)nvidia.com> mainline inclusion from mainline-v7.0-rc3 commit 5293a8882c549fab4a878bc76b0b6c951f980a61 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15382 CVE: CVE-2026-46135 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- nvmet_tcp_handle_icreq() updates queue->state after sending an Initialization Connection Response (ICResp), but it does so without serializing against target-side queue teardown. If an NVMe/TCP host sends an Initialization Connection Request (ICReq) and immediately closes the connection, target-side teardown may start in softirq context before io_work drains the already buffered ICReq. In that case, nvmet_tcp_schedule_release_queue() sets queue->state to NVMET_TCP_Q_DISCONNECTING and drops the queue reference under state_lock. If io_work later processes that ICReq, nvmet_tcp_handle_icreq() can still overwrite the state back to NVMET_TCP_Q_LIVE. That defeats the DISCONNECTING-state guard in nvmet_tcp_schedule_release_queue() and allows a later socket state change to re-enter teardown and issue a second kref_put() on an already released queue. The ICResp send failure path has the same problem. If teardown has already moved the queue to DISCONNECTING, a send error can still overwrite the state with NVMET_TCP_Q_FAILED, again reopening the window for a second teardown path to drop the queue reference. Fix this by serializing both post-send state transitions with state_lock and bailing out if teardown has already started. Use -ESHUTDOWN as an internal sentinel for that bail-out path rather than propagating it as a transport error like -ECONNRESET. Keep nvmet_tcp_socket_error() setting rcv_state to NVMET_TCP_RECV_ERR before honoring that sentinel so receive-side parsing stays quiesced until the existing release path completes. Fixes: c46a6465bac2 ("nvmet-tcp: add NVMe over TCP target driver") Cc: stable(a)vger.kernel.org Reported-by: Shivam Kumar <skumar47(a)syr.edu> Tested-by: Shivam Kumar <kumar.shivam43666(a)gmail.com> Signed-off-by: Chaitanya Kulkarni <kch(a)nvidia.com> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Conflicts: drivers/nvme/target/tcp.c [not merge main commit 675b453e0241 ("nvmet-tcp: enable TLS handshake upcall")] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- drivers/nvme/target/tcp.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c index 6b506783ea4f..1f048ad19f6a 100644 --- a/drivers/nvme/target/tcp.c +++ b/drivers/nvme/target/tcp.c @@ -354,6 +354,19 @@ static void nvmet_tcp_fatal_error(struct nvmet_tcp_queue *queue) static void nvmet_tcp_socket_error(struct nvmet_tcp_queue *queue, int status) { + /* + * Keep rcv_state at RECV_ERR even for the internal -ESHUTDOWN path. + * nvmet_tcp_handle_icreq() can return -ESHUTDOWN after the ICReq has + * already been consumed and queue teardown has started. + * + * If nvmet_tcp_data_ready() or nvmet_tcp_write_space() queues + * nvmet_tcp_io_work() again before nvmet_tcp_release_queue_work() + * cancels it, the queue must not keep that old receive state. + * Otherwise the next nvmet_tcp_io_work() run can reach + * nvmet_tcp_done_recv_pdu() and try to handle the same ICReq again. + * + * That is why queue->rcv_state needs to be updated before we return. + */ queue->rcv_state = NVMET_TCP_RECV_ERR; if (status == -EPIPE || status == -ECONNRESET) kernel_sock_shutdown(queue->sock, SHUT_RDWR); @@ -890,7 +903,14 @@ static int nvmet_tcp_handle_icreq(struct nvmet_tcp_queue *queue) if (ret < 0) return ret; /* queue removal will cleanup */ + spin_lock_bh(&queue->state_lock); + if (queue->state == NVMET_TCP_Q_DISCONNECTING) { + spin_unlock_bh(&queue->state_lock); + /* Tell nvmet_tcp_socket_error() teardown is in progress. */ + return -ESHUTDOWN; + } queue->state = NVMET_TCP_Q_LIVE; + spin_unlock_bh(&queue->state_lock); nvmet_prepare_receive_pdu(queue); return 0; } -- 2.52.0

2 1

[PATCH OLK-6.6 0/3] Fix CVE-2026-31453
by Long Li 18 Jun '26

18 Jun '26

Fix CVE-2026-31453 Long Li (1): Revert "xfs: fix a UAF when inode item push" Yuto Ohnuki (2): xfs: save ailp before dropping the AIL lock in push callbacks xfs: avoid dereferencing log items after push callbacks fs/xfs/xfs_dquot_item.c | 9 +++++++-- fs/xfs/xfs_inode_item.c | 17 ++++++++--------- fs/xfs/xfs_trace.h | 36 ++++++++++++++++++++++++++++++++---- fs/xfs/xfs_trans_ail.c | 26 +++++++++++++++++++------- 4 files changed, 66 insertions(+), 22 deletions(-) -- 2.52.0

2 4

[PATCH OLK-5.10] xfs: stop reclaim before pushing AIL during unmount
by Long Li 17 Jun '26

17 Jun '26

From: Yuto Ohnuki <ytohnuki(a)amazon.com> stable inclusion from stable-v5.10.252 commit e6cc490048f78b009259a5f032acead9f789c34c category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14197 CVE: CVE-2026-31455 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 4f24a767e3d64a5f58c595b5c29b6063a201f1e3 ] The unmount sequence in xfs_unmount_flush_inodes() pushed the AIL while background reclaim and inodegc are still running. This is broken independently of any use-after-free issues - background reclaim and inodegc should not be running while the AIL is being pushed during unmount, as inodegc can dirty and insert inodes into the AIL during the flush, and background reclaim can race to abort and free dirty inodes. Reorder xfs_unmount_flush_inodes() to stop inodegc and cancel background reclaim before pushing the AIL. Stop inodegc before cancelling m_reclaim_work because the inodegc worker can re-queue m_reclaim_work via xfs_inodegc_set_reclaimable. Reported-by: syzbot+652af2b3c5569c4ab63c(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=652af2b3c5569c4ab63c Fixes: 90c60e164012 ("xfs: xfs_iflush() is no longer necessary") Cc: stable(a)vger.kernel.org # v5.9 Signed-off-by: Yuto Ohnuki <ytohnuki(a)amazon.com> Reviewed-by: Darrick J. Wong <djwong(a)kernel.org> Signed-off-by: Carlos Maiolino <cem(a)kernel.org> [ dropped xfs_inodegc_stop() call ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/xfs/xfs_mount.c [Context conflicts] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/xfs/xfs_mount.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/fs/xfs/xfs_mount.c b/fs/xfs/xfs_mount.c index 4983fe7eadf0..cb99ac78d904 100644 --- a/fs/xfs/xfs_mount.c +++ b/fs/xfs/xfs_mount.c @@ -687,8 +687,9 @@ xfs_ifree_unmount( * have been retrying in the background. This will prevent never-ending * retries in AIL pushing from hanging the unmount. * - * Finally, we can push the AIL to clean all the remaining dirty objects, then - * reclaim the remaining inodes that are still in memory at this point in time. + * Stop inodegc and background reclaim before pushing the AIL so that they + * are not running while the AIL is being flushed. Then push the AIL to + * clean all the remaining dirty objects and reclaim the remaining inodes. */ static void xfs_unmount_flush_inodes( @@ -700,9 +701,9 @@ xfs_unmount_flush_inodes( set_bit(XFS_OPSTATE_UNMOUNTING, &mp->m_opstate); - xfs_ail_push_all_sync(mp->m_ail); xfs_inodegc_stop(mp); cancel_delayed_work_sync(&mp->m_reclaim_work); + xfs_ail_push_all_sync(mp->m_ail); xfs_reclaim_inodes(mp); xfs_health_unmount(mp); } -- 2.52.0

2 1

[PATCH OLK-5.10 0/3] Fix CVE-2026-31453
by Long Li 17 Jun '26

17 Jun '26

Fix CVE-2026-31453. Long Li (1): Revert "xfs: fix a UAF when inode item push" Yuto Ohnuki (2): xfs: avoid dereferencing log items after push callbacks xfs: save ailp before dropping the AIL lock in push callbacks fs/xfs/xfs_dquot_item.c | 9 ++++-- fs/xfs/xfs_inode_item.c | 17 ++++++----- fs/xfs/xfs_trace.c | 1 + fs/xfs/xfs_trace.h | 63 ++++++++++++++++++++--------------------- fs/xfs/xfs_trans_ail.c | 26 ++++++++++++----- 5 files changed, 66 insertions(+), 50 deletions(-) -- 2.52.0

2 4

[PATCH OLK-5.10] xfs: delete attr leaf freemap entries when empty
by Long Li 17 Jun '26

17 Jun '26

From: "Darrick J. Wong" <djwong(a)kernel.org> stable inclusion from stable-v5.10.251 commit f3c0d1fc1eadbb4adbee5ab7757d41d35f48325b category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14733 CVE: CVE-2026-43187 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 6f13c1d2a6271c2e73226864a0e83de2770b6f34 ] Back in commit 2a2b5932db6758 ("xfs: fix attr leaf header freemap.size underflow"), Brian Foster observed that it's possible for a small freemap at the end of the end of the xattr entries array to experience a size underflow when subtracting the space consumed by an expansion of the entries array. There are only three freemap entries, which means that it is not a complete index of all free space in the leaf block. This code can leave behind a zero-length freemap entry with a nonzero base. Subsequent setxattr operations can increase the base up to the point that it overlaps with another freemap entry. This isn't in and of itself a problem because the code in _leaf_add that finds free space ignores any freemap entry with zero size. However, there's another bug in the freemap update code in _leaf_add, which is that it fails to update a freemap entry that begins midway through the xattr entry that was just appended to the array. That can result in the freemap containing two entries with the same base but different sizes (0 for the "pushed-up" entry, nonzero for the entry that's actually tracking free space). A subsequent _leaf_add can then allocate xattr namevalue entries on top of the entries array, leading to data loss. But fixing that is for later. For now, eliminate the possibility of confusion by zeroing out the base of any freemap entry that has zero size. Because the freemap is not intended to be a complete index of free space, a subsequent failure to find any free space for a new xattr will trigger block compaction, which regenerates the freemap. It looks like this bug has been in the codebase for quite a long time. Cc: <stable(a)vger.kernel.org> # v2.6.12 Fixes: 1da177e4c3f415 ("Linux-2.6.12-rc2") Signed-off-by: "Darrick J. Wong" <djwong(a)kernel.org> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/xfs/libxfs/xfs_attr_leaf.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/fs/xfs/libxfs/xfs_attr_leaf.c b/fs/xfs/libxfs/xfs_attr_leaf.c index e953bc44d4d0..3954bf017c8d 100644 --- a/fs/xfs/libxfs/xfs_attr_leaf.c +++ b/fs/xfs/libxfs/xfs_attr_leaf.c @@ -1575,6 +1575,19 @@ xfs_attr3_leaf_add_work( min_t(uint16_t, ichdr->freemap[i].size, sizeof(xfs_attr_leaf_entry_t)); } + + /* + * Don't leave zero-length freemaps with nonzero base lying + * around, because we don't want the code in _remove that + * matches on base address to get confused and create + * overlapping freemaps. If we end up with no freemap entries + * then the next _add will compact the leaf block and + * regenerate the freemaps. + */ + if (ichdr->freemap[i].size == 0 && ichdr->freemap[i].base > 0) { + ichdr->freemap[i].base = 0; + ichdr->holes = 1; + } } ichdr->usedbytes += xfs_attr_leaf_entsize(leaf, args->index); return 0; -- 2.52.0

2 1

[PATCH OLK-5.10] fuse: reject oversized dirents in page cache
by Long Li 17 Jun '26

17 Jun '26

From: Samuel Page <sam(a)bynar.io> mainline inclusion from mainline-v7.0 commit 51a8de6c50bf947c8f534cd73da4c8f0a13e7bed category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14444 CVE: CVE-2026-31694 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- fuse_add_dirent_to_cache() computes a serialized dirent size from the server-controlled namelen field and copies the dirent into a single page-cache page. The existing logic only checks whether the dirent fits in the remaining space of the current page and advances to a fresh page if not. It never checks whether the dirent itself exceeds PAGE_SIZE. As a result, a malicious FUSE server can return a dirent with namelen=4095, producing a serialized record size of 4120 bytes. On 4 KiB page systems this causes memcpy() to overflow the cache page by 24 bytes into the following kernel page. Reject dirents that cannot fit in a single page before copying them into the readdir cache. Fixes: 69e34551152a ("fuse: allow caching readdir") Cc: stable(a)vger.kernel.org # v6.16+ Assisted-by: Bynario AI Signed-off-by: Samuel Page <sam(a)bynar.io> Reported-by: Qi Tang <tpluszz77(a)gmail.com> Reported-by: Zijun Hu <nightu(a)northwestern.edu> Signed-off-by: Miklos Szeredi <mszeredi(a)redhat.com> Link: https://patch.msgid.link/20260420090139.662772-1-mszeredi@redhat.com Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/fuse/readdir.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/fuse/readdir.c b/fs/fuse/readdir.c index f18632027d8b..00b2fc180bc7 100644 --- a/fs/fuse/readdir.c +++ b/fs/fuse/readdir.c @@ -41,6 +41,10 @@ static void fuse_add_dirent_to_cache(struct file *file, unsigned int offset; void *addr; + /* Dirent doesn't fit in readdir cache page? Skip caching. */ + if (reclen > PAGE_SIZE) + return; + spin_lock(&fi->rdc.lock); /* * Is cache already completed? Or this entry does not go at the end of -- 2.52.0

2 1

[PATCH OLK-5.10] ntfs: ->d_compare() must not block
by Yifan Qiao 17 Jun '26

17 Jun '26

From: Al Viro <viro(a)zeniv.linux.org.uk> mainline inclusion from mainline-v7.0-rc1 commit ca2a04e84af79596e5cd9cfe697d5122ec39c8ce category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14789 CVE: CVE-2026-43245 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ... so don't use __getname() there. Switch it (and ntfs_d_hash(), while we are at it) to kmalloc(PATH_MAX, GFP_NOWAIT). Yes, ntfs_d_hash() almost certainly can do with smaller allocations, but let ntfs folks deal with that - keep the allocation size as-is for now. Stop abusing names_cachep in ntfs, period - various uses of that thing in there have nothing to do with pathnames; just use k[mz]alloc() and be done with that. For now let's keep sizes as-in, but AFAICS none of the users actually want PATH_MAX. Signed-off-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/ntfs3/dir.c | 5 ++--- fs/ntfs3/inode.c | 12 ++++++------ fs/ntfs3/namei.c | 9 ++++----- fs/ntfs3/xattr.c | 4 ++-- 4 files changed, 14 insertions(+), 16 deletions(-) diff --git a/fs/ntfs3/dir.c b/fs/ntfs3/dir.c index fb438d604040..27713367aa64 100644 --- a/fs/ntfs3/dir.c +++ b/fs/ntfs3/dir.c @@ -390,8 +390,7 @@ static int ntfs_readdir(struct file *file, struct dir_context *ctx) if (!dir_emit_dots(file, ctx)) return 0; - /* Allocate PATH_MAX bytes. */ - name = __getname(); + name = kmalloc(PATH_MAX, GFP_KERNEL); if (!name) return -ENOMEM; @@ -470,7 +469,7 @@ static int ntfs_readdir(struct file *file, struct dir_context *ctx) out: - __putname(name); + kfree(name); put_indx_node(node); if (err == -ENOENT) { diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c index b1849c4c48e1..c582eb08d5f8 100644 --- a/fs/ntfs3/inode.c +++ b/fs/ntfs3/inode.c @@ -1280,7 +1280,7 @@ struct inode *ntfs_create_inode(struct user_namespace *mnt_userns, fa |= FILE_ATTRIBUTE_READONLY; /* Allocate PATH_MAX bytes. */ - new_de = __getname(); + new_de = kzalloc(PATH_MAX, GFP_KERNEL); if (!new_de) { err = -ENOMEM; goto out1; @@ -1653,7 +1653,7 @@ struct inode *ntfs_create_inode(struct user_namespace *mnt_userns, ntfs_mark_rec_free(sbi, ino); out2: - __putname(new_de); + kfree(new_de); kfree(rp); out1: @@ -1676,7 +1676,7 @@ int ntfs_link_inode(struct inode *inode, struct dentry *dentry) struct ATTR_FILE_NAME *de_name; /* Allocate PATH_MAX bytes. */ - de = __getname(); + de = kzalloc(PATH_MAX, GFP_KERNEL); if (!de) return -ENOMEM; @@ -1699,7 +1699,7 @@ int ntfs_link_inode(struct inode *inode, struct dentry *dentry) err = ni_add_name(ntfs_i(d_inode(dentry->d_parent)), ni, de); out: - __putname(de); + kfree(de); return err; } @@ -1723,7 +1723,7 @@ int ntfs_unlink_inode(struct inode *dir, const struct dentry *dentry) return -EINVAL; /* Allocate PATH_MAX bytes. */ - de = __getname(); + de = kzalloc(PATH_MAX, GFP_KERNEL); if (!de) return -ENOMEM; @@ -1761,7 +1761,7 @@ int ntfs_unlink_inode(struct inode *dir, const struct dentry *dentry) out: ni_unlock(ni); - __putname(de); + kfree(de); return err; } diff --git a/fs/ntfs3/namei.c b/fs/ntfs3/namei.c index 18330d982b07..49f5246abfdd 100644 --- a/fs/ntfs3/namei.c +++ b/fs/ntfs3/namei.c @@ -66,7 +66,7 @@ static struct dentry *ntfs_lookup(struct inode *dir, struct dentry *dentry, u32 flags) { struct ntfs_inode *ni = ntfs_i(dir); - struct cpu_str *uni = __getname(); + struct cpu_str *uni = kmalloc(PATH_MAX, GFP_KERNEL); struct inode *inode; int err; @@ -83,7 +83,7 @@ static struct dentry *ntfs_lookup(struct inode *dir, struct dentry *dentry, inode = dir_search_u(dir, uni, NULL); ni_unlock(ni); } - __putname(uni); + kfree(uni); } return d_splice_alias(inode, dentry); @@ -280,8 +280,7 @@ static int ntfs_rename(struct inode *dir, return err; } - /* Allocate PATH_MAX bytes. */ - de = __getname(); + de = kmalloc(PATH_MAX, GFP_KERNEL); if (!de) return -ENOMEM; @@ -325,7 +324,7 @@ static int ntfs_rename(struct inode *dir, ni_unlock(ni); ni_unlock(dir_ni); out: - __putname(de); + kfree(de); return err; } diff --git a/fs/ntfs3/xattr.c b/fs/ntfs3/xattr.c index 24d739000c80..ddec586d4de6 100644 --- a/fs/ntfs3/xattr.c +++ b/fs/ntfs3/xattr.c @@ -533,7 +533,7 @@ static struct posix_acl *ntfs_get_acl_ex(struct user_namespace *mnt_userns, void *buf; /* Allocate PATH_MAX bytes. */ - buf = __getname(); + buf = kmalloc(PATH_MAX, GFP_KERNEL); if (!buf) return ERR_PTR(-ENOMEM); @@ -566,7 +566,7 @@ static struct posix_acl *ntfs_get_acl_ex(struct user_namespace *mnt_userns, if (!IS_ERR(acl)) set_cached_acl(inode, type, acl); - __putname(buf); + kfree(buf); return acl; } -- 2.52.0

2 1

社区update版本合入截止时间和构建时间调整公示
by Xushanshan(Sassa,openEuler) 16 Jun '26

16 Jun '26

Add kernel sig 发件人: Xushanshan(Sassa,openEuler) <xushanshan3(a)huawei.com> 发送时间: 2026年6月16日 23:17 收件人: release(a)openeuler.org 抄送: tc(a)openeuler.org; qa(a)openeuler.org; dev(a)openeuler.org; cicd(a)openeuler.org; kernel(a)openeuler.org 主题: [Dev] 社区update版本合入截止时间和构建时间调整公示 Hi ALL：经RM sig评审，update 版本的构建时间调整为周一合入，周三发布；整体触发背景和结论如下，如有相关的意见，可在06/22前反馈。一：变更背景：社区构建资源紧张，内核&用户态等PR集中提交的情况下，资源冲突，PR高峰期合入要等待2-3小时，构建出包10+小时。从工程能力和版本发布周期等维度讨论了部分优化措施，过程中识别到主干Next分支和update版本发布时间存在重叠（周三12点截止PR合入，周五出版本），资源抢占较多，影响两个版本，因此申请错开两个版本。其他优化措施见四；二：决策结论：社区update版本的PR截止合入时间，调整为周一16点，版本发布时间调整为周三晚；update变更开始执行时间：0622 三：修改后的合入时间建议：版本类型版本 PR截止合入时间版本发布时间内核用户态源码仓制品仓源码仓制品仓开发分支（保持不变） Next主干开发分支(当前24.03 LTS SP4) 周三16：00 周三18：00 / 周三18：00 周五晚维护版本 24.03 LTS SP3 update 周一16:00 周一18：00 / 周一18:00 周三晚 24.03 LTS SP1 update 22.03 LTS SP4 update 20.03 LTS SP4 四：其他工程能力优化措施和进展：问题改进措施进展内核源码编译门禁执行时间长 1、新增蓝区arm物理机集群，对接oe社区Jenkins 2、该集群用于内核源码编译，并根据负载情况进行扩缩容 done 检查类门禁（trigger门禁）排队时间长 1、增加trigger机器资源(done) 2、能自动停止同一个pr中已经失效的但还在排队或者执行中的任务目标730 多个版本集中在同一时间构建，导致EulerMaker负载大，调度慢 1、update版本和SP版本严格管控合入时间，按天错开构建时间(done) 2、EulerMaker进行重构，从架构层面解决调度问题目标930 构建流程存在断连，每个步骤都通过定时触发，而不是前后依赖触发，导致端到端构建总时间过长（20点开始包构建，凌晨6点左右出包，端到端需要10小时） 1、通过Jenkins流水线能力连编排EulerMaker everyting工程构建，ISO镜像构建，EulerMaker epol工程构建，docker镜像和虚拟机镜像构建，openQA测试等全流程，端到端时间缩短到4-6小时 done

1 0