- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 0/7] net: sch: Fix CVE-2025-37798
by Dong Chenchen 14 Aug '25

14 Aug '25

Fix CVE-2025-37798 Cong Wang (5): sch_ets: make est_qlen_notify() idempotent sch_qfq: make qfq_qlen_notify() idempotent sch_hfsc: make hfsc_qlen_notify() idempotent sch_drr: make drr_qlen_notify() idempotent codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() WANG Cong (2): sch_htb: make htb_qlen_notify() idempotent sch_htb: make htb_deactivate() idempotent net/sched/sch_codel.c | 5 +---- net/sched/sch_drr.c | 7 ++++--- net/sched/sch_ets.c | 8 ++++---- net/sched/sch_fq_codel.c | 6 ++---- net/sched/sch_hfsc.c | 8 ++++++-- net/sched/sch_htb.c | 13 ++++++------- net/sched/sch_qfq.c | 7 +++++-- 7 files changed, 28 insertions(+), 26 deletions(-) -- 2.25.1

2 8

[PATCH OLK-6.6 0/3] net_sched: Fix CVE-2025-37890
by Dong Chenchen 14 Aug '25

14 Aug '25

Fix CVE-2025-37890 Cong Wang (1): sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() Pedro Tammela (1): net_sched: hfsc: Address reentrant enqueue adding class to eltree twice Victor Nogueira (1): net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc net/sched/sch_hfsc.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) -- 2.25.1

2 4

[PATCH OLK-5.10 0/3] net_sched: Fix CVE-2025-37890
by Dong Chenchen 14 Aug '25

14 Aug '25

Fix CVE-2025-37890 Cong Wang (1): sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() Pedro Tammela (1): net_sched: hfsc: Address reentrant enqueue adding class to eltree twice Victor Nogueira (1): net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc net/sched/sch_hfsc.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) -- 2.25.1

2 4

[PATCH OLK-5.10] wifi: at76c50x: fix use after free access in at76_disconnect
by Dong Chenchen 14 Aug '25

14 Aug '25

From: Abdun Nihaal <abdun.nihaal(a)gmail.com> stable inclusion from stable-v5.10.237 commit 6e4ab3e574c2a335b40fa1f70d1c54fcb58ab33f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC5BMW CVE: CVE-2025-37796 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 27c7e63b3cb1a20bb78ed4a36c561ea4579fd7da ] The memory pointed to by priv is freed at the end of at76_delete_device function (using ieee80211_free_hw). But the code then accesses the udev field of the freed object to put the USB device. This may also lead to a memory leak of the usb device. Fix this by using udev from interface. Fixes: 29e20aa6c6af ("at76c50x-usb: fix use after free on failure path in at76_probe()") Signed-off-by: Abdun Nihaal <abdun.nihaal(a)gmail.com> Link: https://patch.msgid.link/20250330103110.44080-1-abdun.nihaal@gmail.com Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/net/wireless/atmel/at76c50x-usb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/atmel/at76c50x-usb.c b/drivers/net/wireless/atmel/at76c50x-usb.c index 404257800033..706de33d0ed4 100644 --- a/drivers/net/wireless/atmel/at76c50x-usb.c +++ b/drivers/net/wireless/atmel/at76c50x-usb.c @@ -2553,7 +2553,7 @@ static void at76_disconnect(struct usb_interface *interface) wiphy_info(priv->hw->wiphy, "disconnecting\n"); at76_delete_device(priv); - usb_put_dev(priv->udev); + usb_put_dev(interface_to_usbdev(interface)); dev_info(&interface->dev, "disconnected\n"); } -- 2.25.1

2 1

[PATCH OLK-6.6] wifi: at76c50x: fix use after free access in at76_disconnect
by Dong Chenchen 14 Aug '25

14 Aug '25

From: Abdun Nihaal <abdun.nihaal(a)gmail.com> stable inclusion from stable-v6.6.88 commit 7ca513631fa6ad3011b8b9197cdde0f351103704 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC5BMW CVE: CVE-2025-37796 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 27c7e63b3cb1a20bb78ed4a36c561ea4579fd7da ] The memory pointed to by priv is freed at the end of at76_delete_device function (using ieee80211_free_hw). But the code then accesses the udev field of the freed object to put the USB device. This may also lead to a memory leak of the usb device. Fix this by using udev from interface. Fixes: 29e20aa6c6af ("at76c50x-usb: fix use after free on failure path in at76_probe()") Signed-off-by: Abdun Nihaal <abdun.nihaal(a)gmail.com> Link: https://patch.msgid.link/20250330103110.44080-1-abdun.nihaal@gmail.com Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/net/wireless/atmel/at76c50x-usb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/atmel/at76c50x-usb.c b/drivers/net/wireless/atmel/at76c50x-usb.c index 447b51cff8f9..c1a92c7f0f8e 100644 --- a/drivers/net/wireless/atmel/at76c50x-usb.c +++ b/drivers/net/wireless/atmel/at76c50x-usb.c @@ -2554,7 +2554,7 @@ static void at76_disconnect(struct usb_interface *interface) wiphy_info(priv->hw->wiphy, "disconnecting\n"); at76_delete_device(priv); - usb_put_dev(priv->udev); + usb_put_dev(interface_to_usbdev(interface)); dev_info(&interface->dev, "disconnected\n"); } -- 2.25.1

2 1

[PATCH v8 0/8] arm64: entry: Convert to generic irq entry
by Jinjie Ruan 14 Aug '25

14 Aug '25

Currently, x86, Riscv, Loongarch use the generic entry which makes maintainers' work easier and codes more elegant. So also convert arm64 to use the generic entry infrastructure from kernel/entry/* by switching it to generic IRQ entry first, which will make PREEMPT_DYNAMIC and PREEMPT_LAZY use the generic entry common code and remove a lot of duplicate code. Since commit a70e9f647f50 ("entry: Split generic entry into generic exception and syscall entry") split the generic entry into generic irq entry and generic syscall entry, it is time to convert arm64 to use the generic irq entry. And ARM64 will be completely converted to generic entry in the upcoming patch series. The main convert steps are as follows: - Split generic entry into generic irq entry and generic syscall to make the single patch more concentrated in switching to one thing. - Make arm64 easier to use irqentry_enter/exit(). - Make arm64 closer to the PREEMPT_DYNAMIC code of generic entry. - Switch to generic irq entry. This patch set is rebased on 6.17-rc1. It was tested ok with following test cases on QEMU virt platform: - Perf tests. - Different `dynamic preempt` mode switch. - Pseudo NMI tests. - Stress-ng CPU stress test. - MTE test case in Documentation/arch/arm64/memory-tagging-extension.rst and all test cases in tools/testing/selftests/arm64/mte/*. The test QEMU configuration is as follows: qemu-system-aarch64 \ -M virt,gic-version=3,virtualization=on,mte=on \ -cpu max,pauth-impdef=on \ -kernel Image \ -smp 8,sockets=1,cores=4,threads=2 \ -m 512m \ -nographic \ -no-reboot \ -device virtio-rng-pci \ -append "root=/dev/vda rw console=ttyAMA0 kgdboc=ttyAMA0,115200 \ earlycon preempt=voluntary irqchip.gicv3_pseudo_nmi=1" \ -drive if=none,file=images/rootfs.ext4,format=raw,id=hd0 \ -device virtio-blk-device,drive=hd0 \ Changes in v8: - Update the comment. - Fix a typo, inerrupts_enabled(regs) -> interrupts_enabled(regs). - Consistently defined 'state' on a separate line, before the main block. - Split the "arch_irqentry_exit_need_resched()" patch. - Fix CONFIG_PREEMPTION not set build issue. - Remove do_signal() declaration in exception.h as there remains no users of `do_signal(). - Add asm/cpufeature.h header for entry-common.h - Add Reviewed-by, Acked-by and Tested-by. - Update the commit message. - Link to v7: https://lore.kernel.org/all/20250729015456.3411143-1-ruanjinjie@huawei.com/ Changes in v7: - Rebased on v6.16-rc7 and remove the merged first patch. - Update the commit message. - Link to v6: https://lore.kernel.org/all/20250213130007.1418890-1-ruanjinjie@huawei.com/ Changes in v6: - Rebased on 6.14 rc2 next. - Put the syscall bits aside and split it out. - Have the split patch before the arm64 changes. - Merge some tightly coupled patches. - Adjust the order of some patches to make them more reasonable. - Define regs_irqs_disabled() by inline function. - Define interrupts_enabled() in terms of regs_irqs_disabled(). - Delete the fast_interrupts_enabled() macro. - irqentry_state_t -> arm64_irqentry_state_t. - Remove arch_exit_to_user_mode_prepare() and pull local_daif_mask() later in the arm64 exit sequence - Update the commit message. - Link to v5: https://lkml.org/lkml/2024/12/6/609 Changes in v5: - Not change arm32 and keep inerrupts_enabled() macro for gicv3 driver. - Move irqentry_state definition into arch/arm64/kernel/entry-common.c. - Avoid removing the __enter_from_*() and __exit_to_*() wrappers. - Update "irqentry_state_t ret/irq_state" to "state" to keep it consistently. - Use generic irq entry header for PREEMPT_DYNAMIC after split the generic entry. - Also refactor the ARM64 syscall code. - Introduce arch_ptrace_report_syscall_entry/exit(), instead of arch_pre/post_report_syscall_entry/exit() to simplify code. - Make the syscall patches clear separation. - Update the commit message. Changes in v4: - Rework/cleanup split into a few patches as Mark suggested. - Replace interrupts_enabled() macro with regs_irqs_disabled(), instead of left it here. - Remove rcu and lockdep state in pt_regs by using temporary irqentry_state_t as Mark suggested. - Remove some unnecessary intermediate functions to make it clear. - Rework preempt irq and PREEMPT_DYNAMIC code to make the switch more clear. - arch_prepare_*_entry/exit() -> arch_pre_*_entry/exit(). - Expand the arch functions comment. - Make arch functions closer to its caller. - Declare saved_reg in for block. - Remove arch_exit_to_kernel_mode_prepare(), arch_enter_from_kernel_mode(). - Adjust "Add few arch functions to use generic entry" patch to be the penultimate. - Update the commit message. - Add suggested-by. Changes in v3: - Test the MTE test cases. - Handle forget_syscall() in arch_post_report_syscall_entry() - Make the arch funcs not use __weak as Thomas suggested, so move the arch funcs to entry-common.h, and make arch_forget_syscall() folded in arch_post_report_syscall_entry() as suggested. - Move report_single_step() to thread_info.h for arm64 - Change __always_inline() to inline, add inline for the other arch funcs. - Remove unused signal.h for entry-common.h. - Add Suggested-by. - Update the commit message. Changes in v2: - Add tested-by. - Fix a bug that not call arch_post_report_syscall_entry() in syscall_trace_enter() if ptrace_report_syscall_entry() return not zero. - Refactor report_syscall(). - Add comment for arch_prepare_report_syscall_exit(). - Adjust entry-common.h header file inclusion to alphabetical order. - Update the commit message. Jinjie Ruan (8): arm64: ptrace: Replace interrupts_enabled() with regs_irqs_disabled() arm64: entry: Refactor the entry and exit for exceptions from EL1 arm64: entry: Rework arm64_preempt_schedule_irq() arm64: entry: Use preempt_count() and need_resched() helper entry: Add arch_irqentry_exit_need_resched() for arm64 arm64: entry: Refactor preempt_schedule_irq() check code arm64: entry: Move arm64_preempt_schedule_irq() into __exit_to_kernel_mode() arm64: entry: Switch to generic IRQ entry arch/arm64/Kconfig | 1 + arch/arm64/include/asm/daifflags.h | 2 +- arch/arm64/include/asm/entry-common.h | 57 ++++ arch/arm64/include/asm/exception.h | 1 - arch/arm64/include/asm/preempt.h | 2 - arch/arm64/include/asm/ptrace.h | 13 +- arch/arm64/include/asm/xen/events.h | 2 +- arch/arm64/kernel/acpi.c | 2 +- arch/arm64/kernel/debug-monitors.c | 2 +- arch/arm64/kernel/entry-common.c | 423 +++++++++----------------- arch/arm64/kernel/sdei.c | 2 +- arch/arm64/kernel/signal.c | 3 +- kernel/entry/common.c | 16 +- 13 files changed, 230 insertions(+), 296 deletions(-) create mode 100644 arch/arm64/include/asm/entry-common.h -- 2.34.1

1 8

[PATCH OLK-6.6 0/2] net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime
by Dong Chenchen 14 Aug '25

14 Aug '25

Fix VLAN 0 refcount imbalance of toggling filtering during Dong Chenchen (2): net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime net: vlan: Fix kabi breakage of struct vlan_info net/8021q/vlan.c | 42 +++++++++++++++++++++++++++++++++--------- net/8021q/vlan.h | 1 + 2 files changed, 34 insertions(+), 9 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10 0/2] net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime
by Dong Chenchen 14 Aug '25

14 Aug '25

fix VLAN 0 refcount imbalance of toggling filtering during runtime Dong Chenchen (2): net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime net: vlan: Fix kabi breakage of struct vlan_info net/8021q/vlan.c | 42 +++++++++++++++++++++++++++++++++--------- net/8021q/vlan.h | 1 + 2 files changed, 34 insertions(+), 9 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS v2 0/2] net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime
by Dong Chenchen 14 Aug '25

14 Aug '25

Fix VLAN 0 refcount imbalance of toggling filtering during runtime. Dong Chenchen (2): net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime net: vlan: Fix kabi breakage of struct vlan_info net/8021q/vlan.c | 42 +++++++++++++++++++++++++++++++++--------- net/8021q/vlan.h | 3 +++ 2 files changed, 36 insertions(+), 9 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS 0/2] net/sched: sch_qfq: Fix CVE-2025-38477
by Dong Chenchen 14 Aug '25

14 Aug '25

Fix CVE-2025-38477 Xiang Mei (2): net/sched: sch_qfq: Fix race condition on qfq_aggregate net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class net/sched/sch_qfq.c | 33 ++++++++++++++++++++++----------- 1 file changed, 22 insertions(+), 11 deletions(-) -- 2.25.1

2 4