- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] vmxnet3: unregister xdp rxq info in the reset path
by Dong Chenchen 25 Aug '25

25 Aug '25

From: Sankararaman Jayaraman <sankararaman.jayaraman(a)broadcom.com> mainline inclusion from mainline-v6.15-rc1 commit 0dd765fae295832934bf28e45dd5a355e0891ed4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QS7 CVE: CVE-2025-22106 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- vmxnet3 does not unregister xdp rxq info in the vmxnet3_reset_work() code path as vmxnet3_rq_destroy() is not invoked in this code path. So, we get below message with a backtrace. Missing unregister, handled but fix driver WARNING: CPU:48 PID: 500 at net/core/xdp.c:182 __xdp_rxq_info_reg+0x93/0xf0 This patch fixes the problem by moving the unregister code of XDP from vmxnet3_rq_destroy() to vmxnet3_rq_cleanup(). Fixes: 54f00cce1178 ("vmxnet3: Add XDP support.") Signed-off-by: Sankararaman Jayaraman <sankararaman.jayaraman(a)broadcom.com> Signed-off-by: Ronak Doshi <ronak.doshi(a)broadcom.com> Link: https://patch.msgid.link/20250320045522.57892-1-sankararaman.jayaraman@broa… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/net/vmxnet3/vmxnet3_drv.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c index beebe09eb88f..02da23fc695c 100644 --- a/drivers/net/vmxnet3/vmxnet3_drv.c +++ b/drivers/net/vmxnet3/vmxnet3_drv.c @@ -1955,6 +1955,11 @@ vmxnet3_rq_cleanup(struct vmxnet3_rx_queue *rq, rq->comp_ring.gen = VMXNET3_INIT_GEN; rq->comp_ring.next2proc = 0; + + if (xdp_rxq_info_is_reg(&rq->xdp_rxq)) + xdp_rxq_info_unreg(&rq->xdp_rxq); + page_pool_destroy(rq->page_pool); + rq->page_pool = NULL; } @@ -1995,11 +2000,6 @@ static void vmxnet3_rq_destroy(struct vmxnet3_rx_queue *rq, } } - if (xdp_rxq_info_is_reg(&rq->xdp_rxq)) - xdp_rxq_info_unreg(&rq->xdp_rxq); - page_pool_destroy(rq->page_pool); - rq->page_pool = NULL; - if (rq->data_ring.base) { dma_free_coherent(&adapter->pdev->dev, rq->rx_ring[0].size * rq->data_ring.desc_size, -- 2.25.1

2 1

[PATCH OLK-6.6 0/3] Updates of HiSilicon Uncore L3C PMU
by Yushan Wang 25 Aug '25

25 Aug '25

Updates of HiSilicon Uncore L3C PMU --- Support new version of L3C PMU, which supports extended events space which can be controlled in up to 2 extra address spaces with separate overflow interrupts. The layout of the control/event registers are kept the same. The extended events with original ones together cover the monitoring job of all transactions on L3C. That's said, the driver supports finer granual statistics of L3 cache with separated and dedicated PMUs, and a new operand `ext` to give a hint of to which part should perf counting command be delivered. The extended events is specified with `ext=[1|2]` option for the driver to distinguish: perf stat -e hisi_sccl0_l3c0_0/event=<event_id>,ext=<ext>/ Currently only event option using config bit [7, 0]. There's still plenty unused space. Make ext using config [16, 17] and reserve bit [15, 8] for event option for future extension. With the capability of extra counters, number of counters for HiSilicon uncore PMU could reach up to 24, the usedmap is extended accordingly. The hw_perf_event::event_base is initialized to the base MMIO address of the event and will be used for later control, overflow handling and counts readout. We still make use of the Uncore PMU framework for handling the events and interrupt migration on CPU hotplug. The framework's cpuhp callback will handle the event migration and interrupt migration of orginial event, if PMU supports extended events then the interrupt of extended events is migrated to the same CPU choosed by the framework. A new HID of HISI0215 is used for this version of L3C PMU. Some necessary refactor is included, allowing the framework to cope with the new version of driver. Yicong Yang (1): drivers/perf: hisi: Add support for L3C PMU v3 Yushan Wang (2): Documentation: hisi-pmu: Fix of minor format error Documentation: hisi-pmu: Add introduction to HiSilicon Documentation/admin-guide/perf/hisi-pmu.rst | 44 ++- drivers/perf/hisilicon/hisi_uncore_l3c_pmu.c | 342 ++++++++++--------- drivers/perf/hisilicon/hisi_uncore_pmu.h | 2 +- 3 files changed, 214 insertions(+), 174 deletions(-) -- 2.33.0

2 4

[PATCH OLK-6.6] Bluetooth: Fix error code in chan_alloc_skb_cb()
by Dong Chenchen 25 Aug '25

25 Aug '25

From: Dan Carpenter <dan.carpenter(a)linaro.org> stable inclusion from stable-v6.6.85 commit ecd06ad0823a90b4420c377ef8917e44e23ee841 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBYOFU CVE: CVE-2025-22007 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 72d061ee630d0dbb45c2920d8d19b3861c413e54 ] The chan_alloc_skb_cb() function is supposed to return error pointers on error. Returning NULL will lead to a NULL dereference. Fixes: 6b8d4a6a0314 ("Bluetooth: 6LoWPAN: Use connected oriented channel instead of fixed one") Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/bluetooth/6lowpan.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c index 3bcc15c9415f..13b752c169be 100644 --- a/net/bluetooth/6lowpan.c +++ b/net/bluetooth/6lowpan.c @@ -825,11 +825,16 @@ static struct sk_buff *chan_alloc_skb_cb(struct l2cap_chan *chan, unsigned long hdr_len, unsigned long len, int nb) { + struct sk_buff *skb; + /* Note that we must allocate using GFP_ATOMIC here as * this function is called originally from netdev hard xmit * function in atomic context. */ - return bt_skb_alloc(hdr_len + len, GFP_ATOMIC); + skb = bt_skb_alloc(hdr_len + len, GFP_ATOMIC); + if (!skb) + return ERR_PTR(-ENOMEM); + return skb; } static void chan_suspend_cb(struct l2cap_chan *chan) -- 2.25.1

2 1

[PATCH OLK-6.6 0/2] tcp: Fix CVE-2025-21864
by Dong Chenchen 25 Aug '25

25 Aug '25

Fix CVE-2025-21864 Dong Chenchen (1): net: use __GENKSYMS__ to revert the kabi change Sabrina Dubroca (1): tcp: drop secpath at the same time as we currently drop dst include/net/tcp.h | 16 ++++++++++++++++ net/ipv4/tcp_fastopen.c | 4 ++-- net/ipv4/tcp_input.c | 8 ++++---- net/ipv4/tcp_ipv4.c | 2 +- 4 files changed, 23 insertions(+), 7 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10 0/3] netfilter: fix CVE-2022-49622
by Dong Chenchen 25 Aug '25

25 Aug '25

fix CVE-2022-49622. Florian Westphal (3): netfilter: nf_tables: avoid skb access on nf_stolen netfilter: nf_tables: fix crash when nf_trace is enabled selftests: netfilter: add test case for nf trace infrastructure include/net/netfilter/nf_tables.h | 16 ++-- net/netfilter/nf_tables_core.c | 29 +++++-- net/netfilter/nf_tables_trace.c | 44 +++++----- .../selftests/netfilter/nft_trans_stress.sh | 81 +++++++++++++++++-- 4 files changed, 133 insertions(+), 37 deletions(-) -- 2.25.1

2 4

[PATCH OLK-6.6] ipmi:msghandler: Fix potential memory corruption in ipmi_create_user()
by Zhao Yipeng 25 Aug '25

25 Aug '25

From: Dan Carpenter <dan.carpenter(a)linaro.org> stable inclusion from stable-v6.6.99 commit e2d5c005dfc96fe857676d1d8ac46b29275cb89b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICOXOK CVE: CVE-2025-38456 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit fa332f5dc6fc662ad7d3200048772c96b861cf6b upstream. The "intf" list iterator is an invalid pointer if the correct "intf->intf_num" is not found. Calling atomic_dec(&intf->nr_users) on and invalid pointer will lead to memory corruption. We don't really need to call atomic_dec() if we haven't called atomic_add_return() so update the if (intf->in_shutdown) path as well. Fixes: 8e76741c3d8b ("ipmi: Add a limit on the number of users that may use IPMI") Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Message-ID: <aBjMZ8RYrOt6NOgi(a)stanley.mountain> Signed-off-by: Corey Minyard <corey(a)minyard.net> [ - Dropped change to the `if (intf->in_shutdown)` block since that logic doesn't exist yet. - Modified out_unlock to release the srcu lock instead of the mutex since we don't have the mutex here yet. ] Signed-off-by: Brendan Jackman <jackmanb(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhao Yipeng <zhaoyipeng5(a)huawei.com> --- drivers/char/ipmi/ipmi_msghandler.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c index 127ca3239009..fde76a6e6264 100644 --- a/drivers/char/ipmi/ipmi_msghandler.c +++ b/drivers/char/ipmi/ipmi_msghandler.c @@ -1247,7 +1247,7 @@ int ipmi_create_user(unsigned int if_num, } /* Not found, return an error */ rv = -EINVAL; - goto out_kfree; + goto out_unlock; found: if (atomic_add_return(1, &intf->nr_users) > max_users) { @@ -1289,6 +1289,7 @@ int ipmi_create_user(unsigned int if_num, out_kfree: atomic_dec(&intf->nr_users); +out_unlock: srcu_read_unlock(&ipmi_interfaces_srcu, index); vfree(new_user); return rv; -- 2.34.1

2 1

[PATCH OLK-5.10] net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()
by Dong Chenchen 25 Aug '25

25 Aug '25

From: Ignat Korchagin <ignat(a)cloudflare.com> stable inclusion from stable-v5.10.231 commit 14959fd7538b3be6d7617d9e60e404d6a8d4fd1f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAN6 CVE: CVE-2024-56602 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b4fcd63f6ef79c73cafae8cf4a114def5fc3d80d ] sock_init_data() attaches the allocated sk object to the provided sock object. If ieee802154_create() fails later, the allocated sk object is freed, but the dangling pointer remains in the provided sock object, which may allow use-after-free. Clear the sk pointer in the sock object on error. Signed-off-by: Ignat Korchagin <ignat(a)cloudflare.com> Reviewed-by: Miquel Raynal <miquel.raynal(a)bootlin.com> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20241014153808.51894-6-ignat@cloudflare.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ieee802154/socket.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/net/ieee802154/socket.c b/net/ieee802154/socket.c index d4c275e56d82..c8b9efc92b45 100644 --- a/net/ieee802154/socket.c +++ b/net/ieee802154/socket.c @@ -1047,19 +1047,21 @@ static int ieee802154_create(struct net *net, struct socket *sock, if (sk->sk_prot->hash) { rc = sk->sk_prot->hash(sk); - if (rc) { - sk_common_release(sk); - goto out; - } + if (rc) + goto out_sk_release; } if (sk->sk_prot->init) { rc = sk->sk_prot->init(sk); if (rc) - sk_common_release(sk); + goto out_sk_release; } out: return rc; +out_sk_release: + sk_common_release(sk); + sock->sk = NULL; + goto out; } static const struct net_proto_family ieee802154_family_ops = { -- 2.25.1

2 1

[PATCH OLK-6.6 0/2] gtp: Fix CVE-2025-21678
by Dong Chenchen 25 Aug '25

25 Aug '25

Fix CVE-2025-21678 Kuniyuki Iwashima (2): gtp: Destroy device along with udp socket's netns dismantle. gtp: Suppress list corruption splat in gtp_net_exit_batch_rtnl(). drivers/net/gtp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS] HID: core: do not bypass hid_hw_raw_request
by Zhao Yipeng 25 Aug '25

25 Aug '25

From: Benjamin Tissoires <bentiss(a)kernel.org> mainline inclusion from mainline-v6.16-rc7 commit c2ca42f190b6714d6c481dfd3d9b62ea091c946b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICPD1S CVE: CVE-2025-38494 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- hid_hw_raw_request() is actually useful to ensure the provided buffer and length are valid. Directly calling in the low level transport driver function bypassed those checks and allowed invalid paramto be used. Reported-by: Alan Stern <stern(a)rowland.harvard.edu> Closes: https://lore.kernel.org/linux-input/c75433e0-9b47-4072-bbe8-b1d14ea97b13@ro… Cc: stable(a)vger.kernel.org Link: https://patch.msgid.link/20250710-report-size-null-v2-3-ccf922b7c4e5@kernel… Signed-off-by: Benjamin Tissoires <bentiss(a)kernel.org> Conflicts: drivers/hid/hid-core.c [The conflicts are contextual conflicts caused by the absence of the commit: 0d0777ccaa2d ("HID: core: ensure __hid_request reserves the report ID as the first byte").] Signed-off-by: Zhao Yipeng <zhaoyipeng5(a)huawei.com> --- drivers/hid/hid-core.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c index 7dd30deceda4..c0446ee3d4a0 100644 --- a/drivers/hid/hid-core.c +++ b/drivers/hid/hid-core.c @@ -1536,8 +1536,7 @@ void __hid_request(struct hid_device *hid, struct hid_report *report, if (reqtype == HID_REQ_SET_REPORT) hid_output_report(report, buf); - ret = hid->ll_driver->raw_request(hid, report->id, buf, len, - report->type, reqtype); + ret = hid_hw_raw_request(hid, report->id, buf, len, report->type, reqtype); if (ret < 0) { dbg_hid("unable to complete request: %d\n", ret); goto out; -- 2.34.1

2 1

[PATCH OLK-6.6 v2 0/5] Fix for bpf samples and selftests
by Pu Lehui 25 Aug '25

25 Aug '25

Pu Lehui (4): Revert "selftests/bpf: fix perf_event link info name_len assertion" Revert "selftests/bpf: Add cookies check for perf_event fill_link_info test" Revert "selftests/bpf: Use bpf_link__destroy in fill_link_info tests" samples/bpf: Move bpf_rvi_* progs to bpf_rvi directory Tyrone Wu (1): selftests/bpf: fix perf_event link info name_len assertion samples/bpf/Makefile | 4 -- .../{ => bpf_rvi}/bpf_rvi_cpu_online.bpf.c | 0 .../{ => bpf_rvi}/bpf_rvi_cpuinfo_arm64.bpf.c | 0 .../{ => bpf_rvi}/bpf_rvi_cpuinfo_x86.bpf.c | 0 .../bpf/{ => bpf_rvi}/bpf_rvi_diskstats.bpf.c | 0 .../bpf/{ => bpf_rvi}/bpf_rvi_loadavg.bpf.c | 0 .../bpf/{ => bpf_rvi}/bpf_rvi_meminfo.bpf.c | 0 .../{ => bpf_rvi}/bpf_rvi_partitions.bpf.c | 0 samples/bpf/{ => bpf_rvi}/bpf_rvi_stat.bpf.c | 0 samples/bpf/{ => bpf_rvi}/bpf_rvi_swaps.bpf.c | 0 .../bpf/{ => bpf_rvi}/bpf_rvi_uptime.bpf.c | 0 .../selftests/bpf/prog_tests/fill_link_info.c | 62 +++++++------------ 12 files changed, 22 insertions(+), 44 deletions(-) rename samples/bpf/{ => bpf_rvi}/bpf_rvi_cpu_online.bpf.c (100%) rename samples/bpf/{ => bpf_rvi}/bpf_rvi_cpuinfo_arm64.bpf.c (100%) rename samples/bpf/{ => bpf_rvi}/bpf_rvi_cpuinfo_x86.bpf.c (100%) rename samples/bpf/{ => bpf_rvi}/bpf_rvi_diskstats.bpf.c (100%) rename samples/bpf/{ => bpf_rvi}/bpf_rvi_loadavg.bpf.c (100%) rename samples/bpf/{ => bpf_rvi}/bpf_rvi_meminfo.bpf.c (100%) rename samples/bpf/{ => bpf_rvi}/bpf_rvi_partitions.bpf.c (100%) rename samples/bpf/{ => bpf_rvi}/bpf_rvi_stat.bpf.c (100%) rename samples/bpf/{ => bpf_rvi}/bpf_rvi_swaps.bpf.c (100%) rename samples/bpf/{ => bpf_rvi}/bpf_rvi_uptime.bpf.c (100%) -- 2.34.1

2 6