- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] netfilter: ctnetlink: ensure safe access to master conntrack
by superdcc97＠163.com 27 May '26

27 May '26

From: Pablo Neira Ayuso <pablo(a)netfilter.org> mainline inclusion from mainline-v7.0-rc6 commit bffcaad9afdfe45d7fc777397d3b83c1e3ebffe5 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14619 CVE: CVE-2026-43116 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Holding reference on the expectation is not sufficient, the master conntrack object can just go away, making exp->master invalid. To access exp->master safely: - Grab the nf_conntrack_expect_lock, this gets serialized with clean_from_lists() which also holds this lock when the master conntrack goes away. - Hold reference on master conntrack via nf_conntrack_find_get(). Not so easy since the master tuple to look up for the master conntrack is not available in the existing problematic paths. This patch goes for extending the nf_conntrack_expect_lock section to address this issue for simplicity, in the cases that are described below this is just slightly extending the lock section. The add expectation command already holds a reference to the master conntrack from ctnetlink_create_expect(). However, the delete expectation command needs to grab the spinlock before looking up for the expectation. Expand the existing spinlock section to address this to cover the expectation lookup. Note that, the nf_ct_expect_iterate_net() calls already grabs the spinlock while iterating over the expectation table, which is correct. The get expectation command needs to grab the spinlock to ensure master conntrack does not go away. This also expands the existing spinlock section to cover the expectation lookup too. I needed to move the netlink skb allocation out of the spinlock to keep it GFP_KERNEL. For the expectation events, the IPEXP_DESTROY event is already delivered under the spinlock, just move the delivery of IPEXP_NEW under the spinlock too because the master conntrack event cache is reached through exp->master. While at it, add lockdep notations to help identify what codepaths need to grab the spinlock. Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/nf_conntrack_expect.c net/netfilter/nf_conntrack_netlink.c [commit bffcaad9afdfe is not backport, which lead to conflicts due to timer_delete() vs del_timer() API differences and lock placement changes in ctnetlink_del_expect()] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- include/net/netfilter/nf_conntrack_core.h | 5 ++++ net/netfilter/nf_conntrack_ecache.c | 2 ++ net/netfilter/nf_conntrack_expect.c | 10 +++++++- net/netfilter/nf_conntrack_netlink.c | 28 +++++++++++++++-------- 4 files changed, 35 insertions(+), 10 deletions(-) diff --git a/include/net/netfilter/nf_conntrack_core.h b/include/net/netfilter/nf_conntrack_core.h index 3384859a8921..8883575adcc1 100644 --- a/include/net/netfilter/nf_conntrack_core.h +++ b/include/net/netfilter/nf_conntrack_core.h @@ -83,6 +83,11 @@ void nf_conntrack_lock(spinlock_t *lock); extern spinlock_t nf_conntrack_expect_lock; +static inline void lockdep_nfct_expect_lock_held(void) +{ + lockdep_assert_held(&nf_conntrack_expect_lock); +} + /* ctnetlink code shared by both ctnetlink and nf_conntrack_bpf */ static inline void __nf_ct_set_timeout(struct nf_conn *ct, u64 timeout) diff --git a/net/netfilter/nf_conntrack_ecache.c b/net/netfilter/nf_conntrack_ecache.c index 69948e1d6974..6526bdcca580 100644 --- a/net/netfilter/nf_conntrack_ecache.c +++ b/net/netfilter/nf_conntrack_ecache.c @@ -237,6 +237,8 @@ void nf_ct_expect_event_report(enum ip_conntrack_expect_events event, struct nf_ct_event_notifier *notify; struct nf_conntrack_ecache *e; + lockdep_nfct_expect_lock_held(); + rcu_read_lock(); notify = rcu_dereference(net->ct.nf_conntrack_event_cb); if (!notify) diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c index e0eb844c2cdc..c47f7eacf78a 100644 --- a/net/netfilter/nf_conntrack_expect.c +++ b/net/netfilter/nf_conntrack_expect.c @@ -51,6 +51,7 @@ void nf_ct_unlink_expect_report(struct nf_conntrack_expect *exp, struct net *net = nf_ct_exp_net(exp); struct nf_conntrack_net *cnet; + lockdep_nfct_expect_lock_held(); WARN_ON(!master_help); WARN_ON(timer_pending(&exp->timeout)); @@ -118,6 +119,8 @@ nf_ct_exp_equal(const struct nf_conntrack_tuple *tuple, bool nf_ct_remove_expect(struct nf_conntrack_expect *exp) { + lockdep_nfct_expect_lock_held(); + if (del_timer(&exp->timeout)) { nf_ct_unlink_expect(exp); nf_ct_expect_put(exp); @@ -177,6 +180,8 @@ nf_ct_find_expectation(struct net *net, struct nf_conntrack_expect *i, *exp = NULL; unsigned int h; + lockdep_nfct_expect_lock_held(); + if (!cnet->expect_count) return NULL; @@ -454,6 +459,8 @@ static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect, unsigned int h; int ret = 0; + lockdep_nfct_expect_lock_held(); + if (!master_help) { ret = -ESHUTDOWN; goto out; @@ -510,8 +517,9 @@ int nf_ct_expect_related_report(struct nf_conntrack_expect *expect, nf_ct_expect_insert(expect); - spin_unlock_bh(&nf_conntrack_expect_lock); nf_ct_expect_event_report(IPEXP_NEW, expect, portid, report); + spin_unlock_bh(&nf_conntrack_expect_lock); + return 0; out: spin_unlock_bh(&nf_conntrack_expect_lock); diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c index 4522e9110352..67a0762915e3 100644 --- a/net/netfilter/nf_conntrack_netlink.c +++ b/net/netfilter/nf_conntrack_netlink.c @@ -3337,31 +3337,37 @@ static int ctnetlink_get_expect(struct sk_buff *skb, if (err < 0) return err; + skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); + if (!skb2) + return -ENOMEM; + + spin_lock_bh(&nf_conntrack_expect_lock); exp = nf_ct_expect_find_get(info->net, &zone, &tuple); - if (!exp) + if (!exp) { + spin_unlock_bh(&nf_conntrack_expect_lock); + kfree_skb(skb2); return -ENOENT; + } if (cda[CTA_EXPECT_ID]) { __be32 id = nla_get_be32(cda[CTA_EXPECT_ID]); if (id != nf_expect_get_id(exp)) { nf_ct_expect_put(exp); + spin_unlock_bh(&nf_conntrack_expect_lock); + kfree_skb(skb2); return -ENOENT; } } - skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); - if (!skb2) { - nf_ct_expect_put(exp); - return -ENOMEM; - } - rcu_read_lock(); err = ctnetlink_exp_fill_info(skb2, NETLINK_CB(skb).portid, info->nlh->nlmsg_seq, IPCTNL_MSG_EXP_NEW, exp); rcu_read_unlock(); nf_ct_expect_put(exp); + spin_unlock_bh(&nf_conntrack_expect_lock); + if (err <= 0) { kfree_skb(skb2); return -ENOMEM; @@ -3408,22 +3414,26 @@ static int ctnetlink_del_expect(struct sk_buff *skb, if (err < 0) return err; + spin_lock_bh(&nf_conntrack_expect_lock); + /* bump usage count to 2 */ exp = nf_ct_expect_find_get(info->net, &zone, &tuple); - if (!exp) + if (!exp) { + spin_unlock_bh(&nf_conntrack_expect_lock); return -ENOENT; + } if (cda[CTA_EXPECT_ID]) { __be32 id = nla_get_be32(cda[CTA_EXPECT_ID]); if (id != nf_expect_get_id(exp)) { nf_ct_expect_put(exp); + spin_unlock_bh(&nf_conntrack_expect_lock); return -ENOENT; } } /* after list removal, usage count == 1 */ - spin_lock_bh(&nf_conntrack_expect_lock); if (del_timer(&exp->timeout)) { nf_ct_unlink_expect_report(exp, NETLINK_CB(skb).portid, nlmsg_report(info->nlh)); -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS 0/2] CVE-2026-43328
by Xinyu Zheng 27 May '26

27 May '26

Guangshuo Li (1): cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path Liao Chang (1): cpufreq: governor: Free dbs_data directly when gov->init() fails drivers/cpufreq/cpufreq_governor.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS 0/2] CVE-2026-43328
by Xinyu Zheng 27 May '26

27 May '26

Guangshuo Li (1): cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path Liao Chang (1): cpufreq: governor: Free dbs_data directly when gov->init() fails drivers/cpufreq/cpufreq_governor.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10] cgroup/cpuset.c: Comment out early when prefer_cpus cpumask equals
by Chen Jinghuang 27 May '26

27 May '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8397 CVE: NA ---------------------------------------- The current logic skips updating task's prefer_cpus in a cgroup when the cgroup's prefer_cpus is unchanged. However, task's prefer_cpus may mismatch the cgroup config in some cases, causing inconsistent CPU affinity. Comment out the early return logic to ensure task's prefer_cpus are always updated on cgroup.prefer_cpus writes, aligning task and cgroup settings. Fixes: 243865da2684 ("cpuset: Introduce new interface for scheduler dynamic affin ity") Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- kernel/cgroup/cpuset.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c index 1f6ed08af9f5..60c5ee2bc463 100644 --- a/kernel/cgroup/cpuset.c +++ b/kernel/cgroup/cpuset.c @@ -748,10 +748,6 @@ static int update_prefer_cpumask(struct cpuset *cs, struct cpuset *trialcs, return retval; } - /* Nothing to do if the cpus didn't change */ - if (cpumask_equal(cs->prefer_cpus, trialcs->prefer_cpus)) - return 0; - if (!cpumask_subset(trialcs->prefer_cpus, cs->cpus_allowed)) return -EINVAL; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] usb: ulpi: fix double free in ulpi_register_interface() error path
by Liu Mingrui 27 May '26

27 May '26

From: Guangshuo Li <lgs201920130244(a)gmail.com> stable inclusion from stable-v5.10.253 commit 2f70ba9dae13a190673cc3f9b4aad52179738f60 category: bugfix bugzilla: 189268 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 01af542392b5d41fd659d487015a71f627accce3 upstream. When device_register() fails, ulpi_register() calls put_device() on ulpi->dev. The device release callback ulpi_dev_release() drops the OF node reference and frees ulpi, but the current error path in ulpi_register_interface() then calls kfree(ulpi) again, causing a double free. Let put_device() handle the cleanup through ulpi_dev_release() and avoid freeing ulpi again in ulpi_register_interface(). Fixes: 289fcff4bcdb1 ("usb: add bus type for USB ULPI") Cc: stable <stable(a)kernel.org> Signed-off-by: Guangshuo Li <lgs201920130244(a)gmail.com> Reviewed-by: Heikki Krogerus <heikki.krogerus(a)linux.intel.com> Link: https://patch.msgid.link/20260401025142.1398996-1-lgs201920130244@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lin Yujun <linyujun809(a)h-partners.com> Signed-off-by: Mingrui Liu <liumingrui(a)huawei.com> --- drivers/usb/common/ulpi.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/usb/common/ulpi.c b/drivers/usb/common/ulpi.c index 9a2ab6751a23..2a68bd9fe451 100644 --- a/drivers/usb/common/ulpi.c +++ b/drivers/usb/common/ulpi.c @@ -279,10 +279,9 @@ struct ulpi *ulpi_register_interface(struct device *dev, ulpi->ops = ops; ret = ulpi_register(dev, ulpi); - if (ret) { - kfree(ulpi); + if (ret) return ERR_PTR(ret); - } + return ulpi; } -- 2.34.1

2 2

[PATCH OLK-5.10] cgroup/cpuset.c: Comment out early when prefer_cpus cpumask equals
by Chen Jinghuang 27 May '26

27 May '26

Offering: HULK hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8397 ---------------------------------------- The current logic skips updating task's prefer_cpus in a cgroup when the cgroup's prefer_cpus is unchanged. However, task's prefer_cpus may mismatch the cgroup config in some cases, causing inconsistent CPU affinity. Comment out the early return logic to ensure task's prefer_cpus are always updated on cgroup.prefer_cpus writes, aligning task and cgroup settings. Fixes: 243865da2684 ("cpuset: Introduce new interface for scheduler dynamic affin ity") Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- kernel/cgroup/cpuset.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c index 1f6ed08af9f5..60c5ee2bc463 100644 --- a/kernel/cgroup/cpuset.c +++ b/kernel/cgroup/cpuset.c @@ -748,10 +748,6 @@ static int update_prefer_cpumask(struct cpuset *cs, struct cpuset *trialcs, return retval; } - /* Nothing to do if the cpus didn't change */ - if (cpumask_equal(cs->prefer_cpus, trialcs->prefer_cpus)) - return 0; - if (!cpumask_subset(trialcs->prefer_cpus, cs->cpus_allowed)) return -EINVAL; -- 2.34.1

2 1

[PATCH OLK-6.6] drm: Account property blob allocations to memcg
by Hongtao Zhang 27 May '26

27 May '26

From: Xiao Kan <814091656(a)qq.com> stable inclusion from stable-v6.6.128 commit bbfaa5761f589a81031b493cb01275a990d6fb25 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14844 CVE: CVE-2026-43287 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 26b4309a3ab82a0697751cde52eb336c29c19035 ] DRM_IOCTL_MODE_CREATEPROPBLOB allows userspace to allocate arbitrary-sized property blobs backed by kernel memory. Currently, the blob data allocation is not accounted to the allocating process's memory cgroup, allowing unprivileged users to trigger unbounded kernel memory consumption and potentially cause system-wide OOM. Mark the property blob data allocation with GFP_KERNEL_ACCOUNT so that the memory is properly charged to the caller's memcg. This ensures existing cgroup memory limits apply and prevents uncontrolled kernel memory growth without introducing additional policy or per-file limits. Signed-off-by: Xiao Kan <814091656(a)qq.com> Signed-off-by: Xiao Kan <xiao.kan(a)samsung.com> Link: https://patch.msgid.link/tencent_D12AA2DEDE6F359E1AF59405242FB7A5FD05@qq.com Signed-off-by: Maxime Ripard <mripard(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Hongtao <zhanghongtao35(a)huawei.com> --- drivers/gpu/drm/drm_property.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/drm_property.c b/drivers/gpu/drm/drm_property.c index 4d1d04736222e..1c8508aa77e2e 100644 --- a/drivers/gpu/drm/drm_property.c +++ b/drivers/gpu/drm/drm_property.c @@ -561,7 +561,7 @@ drm_property_create_blob(struct drm_device *dev, size_t length, if (!length || length > INT_MAX - sizeof(struct drm_property_blob)) return ERR_PTR(-EINVAL); - blob = kvzalloc(sizeof(struct drm_property_blob)+length, GFP_KERNEL); + blob = kvzalloc(sizeof(struct drm_property_blob) + length, GFP_KERNEL_ACCOUNT); if (!blob) return ERR_PTR(-ENOMEM); -- 2.43.0

2 1

[PATCH OLK-5.10] drm: Account property blob allocations to memcg
by Hongtao Zhang 27 May '26

27 May '26

From: Xiao Kan <814091656(a)qq.com> stable inclusion from stable-v5.10.252 commit b6117210ed349356f8e6027ff020b4d620bca42b category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14844 CVE: CVE-2026-43287 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 26b4309a3ab82a0697751cde52eb336c29c19035 ] DRM_IOCTL_MODE_CREATEPROPBLOB allows userspace to allocate arbitrary-sized property blobs backed by kernel memory. Currently, the blob data allocation is not accounted to the allocating process's memory cgroup, allowing unprivileged users to trigger unbounded kernel memory consumption and potentially cause system-wide OOM. Mark the property blob data allocation with GFP_KERNEL_ACCOUNT so that the memory is properly charged to the caller's memcg. This ensures existing cgroup memory limits apply and prevents uncontrolled kernel memory growth without introducing additional policy or per-file limits. Signed-off-by: Xiao Kan <814091656(a)qq.com> Signed-off-by: Xiao Kan <xiao.kan(a)samsung.com> Link: https://patch.msgid.link/tencent_D12AA2DEDE6F359E1AF59405242FB7A5FD05@qq.com Signed-off-by: Maxime Ripard <mripard(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Hongtao <zhanghongtao35(a)huawei.com> --- drivers/gpu/drm/drm_property.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/drm_property.c b/drivers/gpu/drm/drm_property.c index dc867439f359f..02268f7d62e7a 100644 --- a/drivers/gpu/drm/drm_property.c +++ b/drivers/gpu/drm/drm_property.c @@ -564,7 +564,7 @@ drm_property_create_blob(struct drm_device *dev, size_t length, if (!length || length > INT_MAX - sizeof(struct drm_property_blob)) return ERR_PTR(-EINVAL); - blob = kvzalloc(sizeof(struct drm_property_blob)+length, GFP_KERNEL); + blob = kvzalloc(sizeof(struct drm_property_blob) + length, GFP_KERNEL_ACCOUNT); if (!blob) return ERR_PTR(-ENOMEM); -- 2.43.0

2 1

[PATCH OLK-6.6 0/3] netfilter: Fix CVE-2026-43025 - slab-out-of-bounds in nf_ct_expect_related_report
by superdcc97＠163.com 26 May '26

26 May '26

From: Sashiko Review <sashiko(a)example.com> This patch series fixes CVE-2026-43025 in the OLK-6.6 branch. The vulnerability allows reading kernel memory bytes off the expectation boundary when validating CTA_EXPECT_CLASS via a different helper than the existing master conntrack helper. * Patch 1: Store netns and zone in expectation (Stable-dep-of prerequisite) * Patch 2: Ignore explicit helper on new expectations (main CVE fix) * Patch 3: Restore helper propagation via expectation (newbugfix) Pablo Neira Ayuso (3): netfilter: nf_conntrack_expect: store netns and zone in expectation netfilter: ctnetlink: ignore explicit helper on new expectations netfilter: nf_conntrack_expect: restore helper propagation via expectation include/net/netfilter/nf_conntrack_expect.h | 23 +++++++- net/netfilter/nf_conntrack_broadcast.c | 7 ++- net/netfilter/nf_conntrack_core.c | 7 ++- net/netfilter/nf_conntrack_expect.c | 10 +++- net/netfilter/nf_conntrack_h323_main.c | 12 ++-- net/netfilter/nf_conntrack_helper.c | 5 ++ net/netfilter/nf_conntrack_netlink.c | 61 ++++++++------------- net/netfilter/nf_conntrack_sip.c | 2 +- 8 files changed, 74 insertions(+), 53 deletions(-) -- 2.43.0

2 4

[PATCH OLK-6.6 0/3] Fix hist_field_name issue
by Tengda Wu 26 May '26

26 May '26

This series is going to backport three patch from upstream to fix hist field name issue. David Carlier (1): tracing: Avoid NULL return from hist_field_name() on truncation Pengpeng Hou (1): tracing: Rebuild full_name on each hist_field_name() call Tom Zanussi (1): tracing: Fix fully-qualified variable reference printing in histograms kernel/trace/trace_events_hist.c | 25 +++++++++++++++---------- 1 file changed, 15 insertions(+), 10 deletions(-) -- 2.34.1

2 4