- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] iommu/amd: Wait for completion instead of returning early in iommu_completion_wait()
by Zhang Yuwei 28 Aug '26

28 Aug '26

From: Guanghui Feng <guanghuifeng(a)linux.alibaba.com> stable inclusion from stable-v6.6.148 commit ab7faf5a172ebfdc423ebb3eea4d472740de82f9 category: bugfix bugzilla: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1e75a8255f11c81fb07e81e5029cfd75804350a0 ] need_sync is a per-IOMMU flag shared by all domains and devices behind that IOMMU. It is set whenever a command is queued with sync == true and cleared when a completion-wait (CWAIT) command is queued. However, a cleared need_sync only means that a covering CWAIT has been queued, not that all previously queued commands have actually completed in hardware. iommu_completion_wait() read need_sync locklessly and returned early when it was false. This breaks the "block until all previously queued commands have completed" contract in a multi-CPU scenario: CPU2: queue inv-B => need_sync = true CPU1: queue CWAIT(N); need_sync = false; then wait_on_sem(N) CPU2: read need_sync == false => return 0 (no wait!) CPU2 returns without waiting for any sequence number even though its inv-B may not have completed yet (CWAIT(N), queued after inv-B, has not been signaled). CPU2 then proceeds to, for example, free page-table pages while the IOMMU can still walk stale translations, opening a use-after-free window. This is a logical race in the meaning of the flag, not a memory-visibility issue, so barriers alone do not help. Fix it without losing the optimization of avoiding redundant CWAIT commands: take iommu->lock before testing need_sync, and when it is false do not return early but wait for the last allocated sequence number (cmd_sem_val). Since need_sync == false implies no sync command was queued after the last CWAIT, that CWAIT is FIFO-ordered after every not-yet-completed command, so waiting for its sequence number guarantees all prior commands (possibly queued by another CPU) have completed. The common path with pending work is unchanged and no extra hardware command is issued. Signed-off-by: Guanghui Feng <guanghuifeng(a)linux.alibaba.com> Fixes: 815b33fdc279 ("x86/amd-iommu: Cleanup completion-wait handling") Reviewed-by: Vasant Hegde <vasant.hegde(a)amd.com> Signed-off-by: Will Deacon <will(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Hulk Robot <hulkrobot(a)huawei.com> Conflicts: drivers/iommu/amd/iommu.c [context conflict] Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> --- drivers/iommu/amd/iommu.c | 22 ++++++++++++++++------ 1 file changed, 16 insertions(+), 6 deletions(-) diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c index ba17dd2b8e6f..4a8dc1326006 100644 --- a/drivers/iommu/amd/iommu.c +++ b/drivers/iommu/amd/iommu.c @@ -1140,11 +1140,23 @@ static int iommu_completion_wait(struct amd_iommu *iommu) int ret; u64 data; - if (!iommu->need_sync) - return 0; - raw_spin_lock_irqsave(&iommu->lock, flags); + if (!iommu->need_sync) { + /* + * No command has been queued since the last completion-wait. + * A concurrent CPU may have already queued that CWAIT and + * cleared need_sync; need_sync == false only means a covering + * CWAIT is queued, not that all prior commands have completed. + * Wait for the last allocated sequence number so that any + * command queued before this call (possibly on another CPU) + * is guaranteed to have completed before returning. + */ + data = iommu->cmd_sem_val; + raw_spin_unlock_irqrestore(&iommu->lock, flags); + return wait_on_sem(iommu, data); + } + data = ++iommu->cmd_sem_val; build_completion_wait(&cmd, iommu, data); @@ -1154,9 +1166,7 @@ static int iommu_completion_wait(struct amd_iommu *iommu) if (ret) return ret; - ret = wait_on_sem(iommu, data); - - return ret; + return wait_on_sem(iommu, data); } static int iommu_flush_dte(struct amd_iommu *iommu, u16 devid) -- 2.22.0

2 1

[PATCH OLK-5.10] watchdog: pretimeout: Fix UAF in watchdog_unregister_governor()
by Lin Ruifeng 28 Aug '26

28 Aug '26

From: Tzung-Bi Shih <tzungbi(a)kernel.org> stable inclusion from stable-v6.6.148 commit 2e47b91b9b4020fcc01def14d6b6556d66074cf4 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17075 CVE: CVE-2026-68357 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 7362ba0f9c96ac3ad6a2ca3995bd9fc9a28a8661 ] When a watchdog governor is unregistered, it updates existing watchdog devices that were using this governor by falling back to `default_gov`. If the governor being unregistered is currently set as `default_gov`, the `default_gov` is never cleared. This leads to 2 use-after-free issues: 1. New watchdog devices registered after this point will inherit the dangling `default_gov`. 2. Existing watchdog devices using the unregistered governor will have their `wdd->gov` reassigned to the dangling `default_gov`. Fix the UAF by clearing `default_gov` if it matches the governor being unregistered. Fixes: da0d12ff2b82 ("watchdog: pretimeout: add panic pretimeout governor") Signed-off-by: Tzung-Bi Shih <tzungbi(a)kernel.org> Link: https://lore.kernel.org/r/20260707101803.3598173-1-tzungbi@kernel.org Signed-off-by: Guenter Roeck <linux(a)roeck-us.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/watchdog/watchdog_pretimeout.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/watchdog/watchdog_pretimeout.c b/drivers/watchdog/watchdog_pretimeout.c index 01ca84be240f..fe4c8ace9a42 100644 --- a/drivers/watchdog/watchdog_pretimeout.c +++ b/drivers/watchdog/watchdog_pretimeout.c @@ -164,6 +164,8 @@ void watchdog_unregister_governor(struct watchdog_governor *gov) } spin_lock_irq(&pretimeout_lock); + if (default_gov == gov) + default_gov = NULL; list_for_each_entry(p, &pretimeout_list, entry) if (p->wdd->gov == gov) p->wdd->gov = default_gov; -- 2.34.1

2 1

[PATCH OLK-6.6] RDMA/nldev: Fix locking when accessing mr->pd
by Chen Jinghuang 27 Aug '26

27 Aug '26

From: Jason Gunthorpe <jgg(a)nvidia.com> mainline inclusion from mainline-v7.2-rc1 commit 50d5c02ab8e62325548bd3a6e6b758a9dcd6e7c3 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17658 CVE: CVE-2026-74334 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Sashiko points out that, due to rereg_mr, the PD is actually variable and all the touches in nldev are racy. Use mr->device instead of mr->pd->device. Getting the PD restrack ID is more tricky. To avoid disturbing all the happy paths, add an rdma_restrack_sync() operation which is sort of like flush_workqueue() or synchronize_irq(): after it returns, all the old nldev touches to the mr are gone and everything sees the new PD. This makes it safe to reach into the PD pointer. Fixes: da5c85078215 ("RDMA/nldev: add driver-specific resource tracking") Link: https://patch.msgid.link/r/4-v1-29ebd2c229b5+fd5-ib_mr_pd_jgg@nvidia.com Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Conflicts: drivers/infiniband/core/restrack.c drivers/infiniband/core/uverbs_cmd.c include/rdma/ib_verbs.h [In restrack.c, rdma_restrack_count() in target tree lacks show_details parameter and RESTRACK_DD mark logic; only added xa_is_zero() check required by rdma_restrack_sync(). Removed RESTRACK_DD xa_get_mark() check in rdma_restrack_sync() as target tree does not have driver-specific resource tracking (RESTRACK_DD mark). In uverbs_cmd.c, kept downstream #include "uverbs_profile.h" alongside new #include "restrack.h".] Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- drivers/infiniband/core/nldev.c | 15 ++++---- drivers/infiniband/core/restrack.c | 52 +++++++++++++++++++++++++++- drivers/infiniband/core/restrack.h | 1 + drivers/infiniband/core/uverbs_cmd.c | 10 ++++-- include/rdma/ib_verbs.h | 5 +++ 5 files changed, 74 insertions(+), 9 deletions(-) diff --git a/drivers/infiniband/core/nldev.c b/drivers/infiniband/core/nldev.c index 9d6627bde61a..6c4008a1e18f 100644 --- a/drivers/infiniband/core/nldev.c +++ b/drivers/infiniband/core/nldev.c @@ -644,7 +644,7 @@ static int fill_res_mr_entry(struct sk_buff *msg, bool has_cap_net_admin, struct rdma_restrack_entry *res, uint32_t port) { struct ib_mr *mr = container_of(res, struct ib_mr, res); - struct ib_device *dev = mr->pd->device; + struct ib_device *dev = mr->device; if (has_cap_net_admin) { if (nla_put_u32(msg, RDMA_NLDEV_ATTR_RES_RKEY, mr->rkey)) @@ -660,9 +660,12 @@ static int fill_res_mr_entry(struct sk_buff *msg, bool has_cap_net_admin, if (nla_put_u32(msg, RDMA_NLDEV_ATTR_RES_MRN, res->id)) return -EMSGSIZE; - if (!rdma_is_kernel_res(res) && - nla_put_u32(msg, RDMA_NLDEV_ATTR_RES_PDN, mr->pd->res.id)) - return -EMSGSIZE; + if (!rdma_is_kernel_res(res)) { + struct ib_pd *pd = READ_ONCE(mr->pd); + + if (nla_put_u32(msg, RDMA_NLDEV_ATTR_RES_PDN, pd->res.id)) + return -EMSGSIZE; + } if (fill_res_name_pid(msg, res)) return -EMSGSIZE; @@ -676,7 +679,7 @@ static int fill_res_mr_raw_entry(struct sk_buff *msg, bool has_cap_net_admin, struct rdma_restrack_entry *res, uint32_t port) { struct ib_mr *mr = container_of(res, struct ib_mr, res); - struct ib_device *dev = mr->pd->device; + struct ib_device *dev = mr->device; if (!dev->ops.fill_res_mr_entry_raw) return -EINVAL; @@ -966,7 +969,7 @@ static int fill_stat_mr_entry(struct sk_buff *msg, bool has_cap_net_admin, struct rdma_restrack_entry *res, uint32_t port) { struct ib_mr *mr = container_of(res, struct ib_mr, res); - struct ib_device *dev = mr->pd->device; + struct ib_device *dev = mr->device; if (nla_put_u32(msg, RDMA_NLDEV_ATTR_RES_MRN, res->id)) goto err; diff --git a/drivers/infiniband/core/restrack.c b/drivers/infiniband/core/restrack.c index 438ed3588175..19a813e75486 100644 --- a/drivers/infiniband/core/restrack.c +++ b/drivers/infiniband/core/restrack.c @@ -68,8 +68,11 @@ int rdma_restrack_count(struct ib_device *dev, enum rdma_restrack_type type) u32 cnt = 0; xa_lock(&rt->xa); - xas_for_each(&xas, e, U32_MAX) + xas_for_each(&xas, e, U32_MAX) { + if (xa_is_zero(e)) + continue; cnt++; + } xa_unlock(&rt->xa); return cnt; } @@ -266,6 +269,53 @@ int rdma_restrack_put(struct rdma_restrack_entry *res) } EXPORT_SYMBOL(rdma_restrack_put); +/** + * rdma_restrack_sync() - Fence concurrent netlink dumps on an entry + * @res: resource entry + * + * After this returns any concurrent netlink dump threads will see the current + * value of the object. This is useful if the object has to be changed and there + * is not locking to protect the nl side. Eg for mr->pd. This effectively + * destroys the object from a kref/xarray perspective and then immediately + * restores it. The kref is acting like a lock to barrier concurrent nl threads. + * Callers must ensure rdma_restrack_del() is not concurrently called. + */ +void rdma_restrack_sync(struct rdma_restrack_entry *res) +{ + struct rdma_restrack_entry *old; + struct rdma_restrack_root *rt; + struct task_struct *task; + struct ib_device *dev; + + if (!res->valid || res->no_track) + return; + + dev = res_to_dev(res); + if (WARN_ON(!dev)) + return; + + rt = &dev->res[res->type]; + if (WARN_ON(xa_get_mark(&rt->xa, res->id, RESTRACK_DD))) + return; + + old = xa_cmpxchg(&rt->xa, res->id, res, XA_ZERO_ENTRY, GFP_KERNEL); + if (WARN_ON(old != res)) + return; + + task = res->task; + if (task) + get_task_struct(task); + rdma_restrack_put(res); + wait_for_completion(&res->comp); + reinit_completion(&res->comp); + if (task) + res->task = task; + kref_init(&res->kref); + + xa_cmpxchg(&rt->xa, res->id, XA_ZERO_ENTRY, res, GFP_KERNEL); +} +EXPORT_SYMBOL(rdma_restrack_sync); + /** * rdma_restrack_del() - delete object from the reource tracking database * @res: resource entry diff --git a/drivers/infiniband/core/restrack.h b/drivers/infiniband/core/restrack.h index 6a04fc41f738..75b8d1005a98 100644 --- a/drivers/infiniband/core/restrack.h +++ b/drivers/infiniband/core/restrack.h @@ -27,6 +27,7 @@ int rdma_restrack_init(struct ib_device *dev); void rdma_restrack_clean(struct ib_device *dev); void rdma_restrack_add(struct rdma_restrack_entry *res); void rdma_restrack_del(struct rdma_restrack_entry *res); +void rdma_restrack_sync(struct rdma_restrack_entry *res); void rdma_restrack_new(struct rdma_restrack_entry *res, enum rdma_restrack_type type); void rdma_restrack_set_name(struct rdma_restrack_entry *res, diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c index 2e4265ba35b7..f442cca3c05c 100644 --- a/drivers/infiniband/core/uverbs_cmd.c +++ b/drivers/infiniband/core/uverbs_cmd.c @@ -46,6 +46,7 @@ #include "uverbs.h" #include "core_priv.h" +#include "restrack.h" /* * Copy a response to userspace. If the provided 'resp' is larger than the @@ -813,6 +814,10 @@ static int ib_uverbs_rereg_mr(struct uverbs_attr_bundle *attrs) ret = PTR_ERR(new_pd); goto put_uobjs; } + if (new_pd == orig_pd) { + uobj_put_obj_read(new_pd); + cmd.flags &= ~IB_MR_REREG_PD; + } } else { new_pd = mr->pd; } @@ -858,9 +863,10 @@ static int ib_uverbs_rereg_mr(struct uverbs_attr_bundle *attrs) mr = new_mr; } else { if (cmd.flags & IB_MR_REREG_PD) { - atomic_dec(&orig_pd->usecnt); - mr->pd = new_pd; atomic_inc(&new_pd->usecnt); + WRITE_ONCE(mr->pd, new_pd); + rdma_restrack_sync(&mr->res); + atomic_dec(&orig_pd->usecnt); } if (cmd.flags & IB_MR_REREG_TRANS) { mr->iova = cmd.hca_va; diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h index 3eea95e51928..05b101693cd5 100644 --- a/include/rdma/ib_verbs.h +++ b/include/rdma/ib_verbs.h @@ -1833,6 +1833,11 @@ struct ib_dm { struct ib_mr { struct ib_device *device; + /* + * Due to IB_MR_REREG_PD pd is not a fixed pointer and can change. For a + * user MR, this value should only be read from a system call that holds + * the uobject lock, or the driver should disable in-place REREG_PD. + */ struct ib_pd *pd; u32 lkey; u32 rkey; -- 2.34.1

2 1

[PTACH openEuler-1.0-LTS] RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one
by Chen Jinghuang 27 Aug '26

27 Aug '26

From: Leon Romanovsky <leonro(a)nvidia.com> mainline inclusion from mainline-v7.2-rc1 commit 449ae7927152e46acbe5f19f97eafdae6d3a96b1 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18162 CVE: CVE-2026-74296 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Free the UAR index returned by the hardware. Fixes: 4ed131d0bb15 ("IB/mlx5: Expose dynamic mmap allocation") Link: https://patch.msgid.link/r/20260611-fix-uar-release-v1-1-f5464d845dbf@nvidi… Signed-off-by: Leon Romanovsky <leonro(a)nvidia.com> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Conflicts: drivers/infiniband/hw/mlx5/main.c [ Context conflict ] Signed-off-by: Chen jinghuang <chenjinghuang2(a)huawei.com> --- drivers/infiniband/hw/mlx5/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c index 4f340d6db582..051de9f3ed82 100644 --- a/drivers/infiniband/hw/mlx5/main.c +++ b/drivers/infiniband/hw/mlx5/main.c @@ -2148,7 +2148,7 @@ static int uar_mmap(struct mlx5_ib_dev *dev, enum mlx5_ib_mmap_cmd cmd, if (!dyn_uar) return err; - mlx5_cmd_free_uar(dev->mdev, idx); + mlx5_cmd_free_uar(dev->mdev, uar_index); free_bfreg: mlx5_ib_free_bfreg(dev, bfregi, bfreg_dyn_idx); -- 2.34.1

1 0

[PATCH OLK-6.6] ceph: avoid fs reclaim while using current->journal_info
by Pu Lehui 27 Aug '26

27 Aug '26

From: Max Kellermann <max.kellermann(a)ionos.com> stable inclusion from stable-v6.6.153 commit c8a21660c3b90864c391164eea5622e7b5b2897c category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18341 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5b602344a49e039e792ce5a8923bcc61412ee134 ] handle_reply() stores a `ceph_mds_request` pointer in `current->journal_info` while filling the inode and dentry cache from an MDS reply. An allocation in this section can enter direct reclaim and prune dentries from another filesystem. If this dirties an ext4 inode, ext4 starts a JBD2 transaction. JBD2 interprets the Ceph request in `current->journal_info` as a journal handle and dereferences the request's `r_tid` as `h_transaction`, causing a kernel crash, e.g.: Unable to handle kernel paging request at virtual address 00000000077b4818 [...] Internal error: Oops: 0000000096000004 [#1] SMP Modules linked in: CPU: 6 UID: 0 PID: 2699135 Comm: kworker/6:3 Tainted: G W 6.18.38-i3 #1113 NONE [...] Workqueue: ceph-msgr ceph_con_workfn pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : jbd2__journal_start+0x2c/0x208 lr : __ext4_journal_start_sb+0x100/0x178 [...] Call trace: jbd2__journal_start+0x2c/0x208 (P) __ext4_journal_start_sb+0x100/0x178 ext4_dirty_inode+0x3c/0x90 __mark_inode_dirty+0x58/0x400 iput.part.0+0x2b0/0x370 iput+0x18/0x30 dentry_unlink_inode+0xc0/0x158 __dentry_kill+0x80/0x250 shrink_dentry_list+0x90/0x130 prune_dcache_sb+0x60/0x98 super_cache_scan+0xe8/0x190 do_shrink_slab+0x174/0x388 shrink_slab+0xd8/0x4c0 shrink_node+0x31c/0x908 do_try_to_free_pages+0xd0/0x508 try_to_free_pages+0x11c/0x238 __alloc_frozen_pages_noprof+0x4d0/0xdd0 __folio_alloc_noprof+0x18/0x70 __filemap_get_folio+0x248/0x440 ceph_readdir_prepopulate+0x570/0x9e8 mds_dispatch+0x1424/0x1ba0 ceph_con_process_message+0x74/0xa0 ceph_con_v1_try_read+0x3a0/0x1510 ceph_con_workfn+0x260/0x460 Enter a scoped NOFS allocation context and leave it after clearing `journal_info`. This prevents filesystem reclaim from recursing into another filesystem while the field contains Ceph-private data. Cc: stable(a)vger.kernel.org Fixes: 315f24088048 ("ceph: fix security xattr deadlock") Signed-off-by: Max Kellermann <max.kellermann(a)ionos.com> Reviewed-by: Viacheslav Dubeyko <slava(a)dubeyko.com> Reviewed-by: Xiubo Li <xiubo.li(a)clyso.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- fs/ceph/mds_client.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c index 47ddad3606da..00b9f9f3f4d7 100644 --- a/fs/ceph/mds_client.c +++ b/fs/ceph/mds_client.c @@ -6,6 +6,7 @@ #include <linux/slab.h> #include <linux/gfp.h> #include <linux/sched.h> +#include <linux/sched/mm.h> #include <linux/debugfs.h> #include <linux/seq_file.h> #include <linux/ratelimit.h> @@ -3676,6 +3677,7 @@ static void handle_reply(struct ceph_mds_session *session, struct ceph_msg *msg) struct ceph_mds_reply_head *head = msg->front.iov_base; struct ceph_mds_reply_info_parsed *rinfo; /* parsed reply info */ struct ceph_snap_realm *realm; + unsigned int nofs_flags; u64 tid; int err, result; int mds = session->s_mds; @@ -3817,6 +3819,14 @@ static void handle_reply(struct ceph_mds_session *session, struct ceph_msg *msg) /* insert trace into our cache */ mutex_lock(&req->r_fill_mutex); + + /* disable fs reclaim while we are using current->journal_info + * for our own purposes, or else shrinkers of other + * filesystems might dereference this pointer as a different + * type + */ + nofs_flags = memalloc_nofs_save(); + current->journal_info = req; err = ceph_fill_trace(mdsc->fsc->sb, req); if (err == 0) { @@ -3825,6 +3835,7 @@ static void handle_reply(struct ceph_mds_session *session, struct ceph_msg *msg) err = ceph_readdir_prepopulate(req, req->r_session); } current->journal_info = NULL; + memalloc_nofs_restore(nofs_flags); mutex_unlock(&req->r_fill_mutex); up_read(&mdsc->snap_rwsem); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] bpf: Preserve pointer state for commuted arithmetic
by Pu Lehui 27 Aug '26

27 Aug '26

From: Yiyang Chen <chenyy23(a)mails.tsinghua.edu.cn> mainline inclusion from mainline-v7.2-rc7 commit a4c6f804b44c5c790269b25e0e61cf4e9f117c86 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17686 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When scalar += pointer is handled in adjust_ptr_min_max_vals(), the destination register inherits the pointer state from the source pointer. Copying only selected fields is fragile because pointer provenance is tracked by several bpf_reg_state fields. Use the caller's temporary offset register to preserve the scalar operand while replacing the destination with the full pointer state. This preserves the frame number for PTR_TO_STACK registers and keeps parent identity fields consistent. Fixes: f4d7e40a5b71 ("bpf: introduce function calls (verification)") Signed-off-by: Yiyang Chen <chenyy23(a)mails.tsinghua.edu.cn> Tested-by: Daniel Wade <danjwade95(a)gmail.com> Acked-by: Shung-Hsi Yu <shung-hsi.yu(a)suse.com> Link: https://patch.msgid.link/20260729-c3-035-public-bpf-v4-v4-2-8ee297e2346b@ma… Signed-off-by: Eduard Zingerman <eddyz87(a)gmail.com> Conflicts: kernel/bpf/verifier.c [ctx conflicts] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/verifier.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index e00cb52fb480..71cc52cfaf31 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -3124,11 +3124,12 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env, return -EACCES; } - /* In case of 'scalar += pointer', dst_reg inherits pointer type and id. - * The id may be overwritten later if we create a new variable offset. + /* For 'scalar += pointer', dst_reg inherits the complete pointer + * register state. Individual fields may be adjusted later by pointer + * arithmetic. Callers guarantee that below does not overwrite off_reg. */ - dst_reg->type = ptr_reg->type; - dst_reg->id = ptr_reg->id; + if (dst_reg != ptr_reg) + *dst_reg = *ptr_reg; if (!check_reg_sane_offset(env, off_reg, ptr_reg->type) || !check_reg_sane_offset(env, ptr_reg, ptr_reg->type)) @@ -3193,7 +3194,7 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env, } break; case BPF_SUB: - if (dst_reg == off_reg) { + if (dst_reg != ptr_reg) { /* scalar -= pointer. Creates an unknown scalar */ verbose(env, "R%d tried to subtract pointer from scalar\n", dst); @@ -3598,8 +3599,8 @@ static int adjust_reg_min_max_vals(struct bpf_verifier_env *env, * This is legal, but we have to reverse our * src/dest handling in computing the range */ - return adjust_ptr_min_max_vals(env, insn, - src_reg, dst_reg); + off_reg = *dst_reg; + return adjust_ptr_min_max_vals(env, insn, src_reg, &off_reg); } } else if (ptr_reg) { /* pointer += scalar */ -- 2.34.1

2 1

[PATCH OLK-6.6] bpf: Preserve pointer state for commuted arithmetic
by Pu Lehui 27 Aug '26

27 Aug '26

From: Yiyang Chen <chenyy23(a)mails.tsinghua.edu.cn> stable inclusion from stable-v6.6.152 commit 86b203aadc2930e0a4f9c6277b5b80ff3664c472 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18233 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a4c6f804b44c5c790269b25e0e61cf4e9f117c86 ] When scalar += pointer is handled in adjust_ptr_min_max_vals(), the destination register inherits the pointer state from the source pointer. Copying only selected fields is fragile because pointer provenance is tracked by several bpf_reg_state fields. Use the caller's temporary offset register to preserve the scalar operand while replacing the destination with the full pointer state. This preserves the frame number for PTR_TO_STACK registers and keeps parent identity fields consistent. Fixes: f4d7e40a5b71 ("bpf: introduce function calls (verification)") Signed-off-by: Yiyang Chen <chenyy23(a)mails.tsinghua.edu.cn> Tested-by: Daniel Wade <danjwade95(a)gmail.com> Acked-by: Shung-Hsi Yu <shung-hsi.yu(a)suse.com> Link: https://patch.msgid.link/20260729-c3-035-public-bpf-v4-v4-2-8ee297e2346b@ma… Signed-off-by: Eduard Zingerman <eddyz87(a)gmail.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/verifier.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 3de3edcb0344..ee8c00981cea 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -12905,11 +12905,12 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env, break; } - /* In case of 'scalar += pointer', dst_reg inherits pointer type and id. - * The id may be overwritten later if we create a new variable offset. + /* For 'scalar += pointer', dst_reg inherits the complete pointer + * register state. Individual fields may be adjusted later by pointer + * arithmetic. Callers guarantee that below does not overwrite off_reg. */ - dst_reg->type = ptr_reg->type; - dst_reg->id = ptr_reg->id; + if (dst_reg != ptr_reg) + *dst_reg = *ptr_reg; if (!check_reg_sane_offset(env, off_reg, ptr_reg->type) || !check_reg_sane_offset(env, ptr_reg, ptr_reg->type)) @@ -12989,7 +12990,7 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env, } break; case BPF_SUB: - if (dst_reg == off_reg) { + if (dst_reg != ptr_reg) { /* scalar -= pointer. Creates an unknown scalar */ verbose(env, "R%d tried to subtract pointer from scalar\n", dst); @@ -13863,8 +13864,8 @@ static int adjust_reg_min_max_vals(struct bpf_verifier_env *env, err = mark_chain_precision(env, insn->dst_reg); if (err) return err; - return adjust_ptr_min_max_vals(env, insn, - src_reg, dst_reg); + off_reg = *dst_reg; + return adjust_ptr_min_max_vals(env, insn, src_reg, &off_reg); } } else if (ptr_reg) { /* pointer += scalar */ -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] crypto: authencesn - fix spawn leak in digestsize check error path
by Gaosheng Cui 27 Aug '26

27 Aug '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9817 CVE: CVE-2026-46033 -------------------------------- The commit 51c8d538230b ("crypto: authencesn - reject short ahash digests during instance creation") added a digestsize check in crypto_authenc_esn_create() but used "goto err_free_inst" as the error path, skipping "err_drop_auth". On 4.19/4.18 the error labels are structured as a progressive cleanup chain (err_drop_enc -> err_drop_auth -> err_free_inst), where each label only cleans up one resource and falls through to the next. Skipping err_drop_auth means crypto_drop_ahash() is not called, so the ahash spawn remains linked on the underlying algorithm's cra_users list after kfree(inst) frees the memory containing it. This creates a dangling list node that triggers a use-after-free when cra_users is later traversed (e.g. algorithm unregistration via CRYPTO_MSG_DELALG or rmmod). On 5.10+ the err_free_inst label calls crypto_authenc_esn_free() which performs full cleanup (drop_skcipher + drop_ahash + kfree), so the original goto is safe there. The backport did not account for the different label structure on 4.19/4.18. Fix this by changing the goto target from err_free_inst to err_drop_auth, which properly removes the ahash spawn via crypto_drop_ahash() before falling through to kfree(inst). Fixes: 51c8d538230b ("crypto: authencesn - reject short ahash digests during instance creation") Signed-off-by: Gaosheng Cui <cuigaosheng1(a)huawei.com> --- crypto/authencesn.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crypto/authencesn.c b/crypto/authencesn.c index 318fc75d326b..cbff96942824 100644 --- a/crypto/authencesn.c +++ b/crypto/authencesn.c @@ -429,7 +429,7 @@ static int crypto_authenc_esn_create(struct crypto_template *tmpl, crypto_set_skcipher_spawn(&ctx->enc, aead_crypto_instance(inst)); if (auth->digestsize > 0 && auth->digestsize < 4) { err = -EINVAL; - goto err_free_inst; + goto err_drop_auth; } err = crypto_grab_skcipher(&ctx->enc, enc_name, 0, -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] crypto: authencesn - fix spawn leak in digestsize check error path
by Gaosheng Cui 27 Aug '26

27 Aug '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9817 CVE: CVE-2026-46033 -------------------------------- The commit 51c8d538230b ("crypto: authencesn - reject short ahash digests during instance creation") added a digestsize check in crypto_authenc_esn_create() but used "goto err_free_inst" as the error path, skipping "err_drop_auth". On 4.19/4.18 the error labels are structured as a progressive cleanup chain (err_drop_enc -> err_drop_auth -> err_free_inst), where each label only cleans up one resource and falls through to the next. Skipping err_drop_auth means crypto_drop_ahash() is not called, so the ahash spawn remains linked on the underlying algorithm's cra_users list after kfree(inst) frees the memory containing it. This creates a dangling list node that triggers a use-after-free when cra_users is later traversed (e.g. algorithm unregistration via CRYPTO_MSG_DELALG or rmmod). On 5.10+ the err_free_inst label calls crypto_authenc_esn_free() which performs full cleanup (drop_skcipher + drop_ahash + kfree), so the original goto is safe there. The backport did not account for the different label structure on 4.19/4.18. Fix this by changing the goto target from err_free_inst to err_drop_auth, which properly removes the ahash spawn via crypto_drop_ahash() before falling through to kfree(inst). Fixes: 567af76238c38 ("crypto: authencesn - reject short ahash digests during instance creation") Signed-off-by: Gaosheng Cui <cuigaosheng1(a)huawei.com> --- crypto/authencesn.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crypto/authencesn.c b/crypto/authencesn.c index 318fc75d326b2..cbff969428243 100644 --- a/crypto/authencesn.c +++ b/crypto/authencesn.c @@ -429,7 +429,7 @@ static int crypto_authenc_esn_create(struct crypto_template *tmpl, crypto_set_skcipher_spawn(&ctx->enc, aead_crypto_instance(inst)); if (auth->digestsize > 0 && auth->digestsize < 4) { err = -EINVAL; - goto err_free_inst; + goto err_drop_auth; } err = crypto_grab_skcipher(&ctx->enc, enc_name, 0, -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS,v2] crypto: authencesn - fix spawn leak in digestsize check error path
by Gaosheng Cui 27 Aug '26

27 Aug '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9817 CVE: CVE-2026-46033 -------------------------------- The commit 51c8d538230b ("crypto: authencesn - reject short ahash digests during instance creation") added a digestsize check in crypto_authenc_esn_create() but used "goto err_free_inst" as the error path, skipping "err_drop_auth". On 4.19/4.18 the error labels are structured as a progressive cleanup chain (err_drop_enc -> err_drop_auth -> err_free_inst), where each label only cleans up one resource and falls through to the next. Skipping err_drop_auth means crypto_drop_ahash() is not called, so the ahash spawn remains linked on the underlying algorithm's cra_users list after kfree(inst) frees the memory containing it. This creates a dangling list node that triggers a use-after-free when cra_users is later traversed (e.g. algorithm unregistration via CRYPTO_MSG_DELALG or rmmod). On 5.10+ the err_free_inst label calls crypto_authenc_esn_free() which performs full cleanup (drop_skcipher + drop_ahash + kfree), so the original goto is safe there. The backport did not account for the different label structure on 4.19/4.18. Fix this by changing the goto target from err_free_inst to err_drop_auth, which properly removes the ahash spawn via crypto_drop_ahash() before falling through to kfree(inst). Fixes: 51c8d538230b ("crypto: authencesn - reject short ahash digests during instance creation") Signed-off-by: Gaosheng Cui <cuigaosheng1(a)huawei.com> --- v2: Fix Signed-off-by: Cui Gaosheng -> Gaosheng Cui crypto/authencesn.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crypto/authencesn.c b/crypto/authencesn.c index 318fc75d326b..cbff96942824 100644 --- a/crypto/authencesn.c +++ b/crypto/authencesn.c @@ -429,7 +429,7 @@ static int crypto_authenc_esn_create(struct crypto_template *tmpl, crypto_set_skcipher_spawn(&ctx->enc, aead_crypto_instance(inst)); if (auth->digestsize > 0 && auth->digestsize < 4) { err = -EINVAL; - goto err_free_inst; + goto err_drop_auth; } err = crypto_grab_skcipher(&ctx->enc, enc_name, 0, -- 2.43.0

1 0