- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] RDMA/nldev: Fix locking when accessing mr->pd
by Chen Jinghuang 27 Aug '26

27 Aug '26

From: Jason Gunthorpe <jgg(a)nvidia.com> mainline inclusion from mainline-v7.2-rc1 commit 50d5c02ab8e62325548bd3a6e6b758a9dcd6e7c3 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17658 CVE: CVE-2026-74334 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Sashiko points out that, due to rereg_mr, the PD is actually variable and all the touches in nldev are racy. Use mr->device instead of mr->pd->device. Getting the PD restrack ID is more tricky. To avoid disturbing all the happy paths, add an rdma_restrack_sync() operation which is sort of like flush_workqueue() or synchronize_irq(): after it returns, all the old nldev touches to the mr are gone and everything sees the new PD. This makes it safe to reach into the PD pointer. Fixes: da5c85078215 ("RDMA/nldev: add driver-specific resource tracking") Link: https://patch.msgid.link/r/4-v1-29ebd2c229b5+fd5-ib_mr_pd_jgg@nvidia.com Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Conflicts: drivers/infiniband/core/restrack.c drivers/infiniband/core/uverbs_cmd.c include/rdma/ib_verbs.h [In restrack.c, rdma_restrack_count() in target tree lacks show_details parameter and RESTRACK_DD mark logic; only added xa_is_zero() check required by rdma_restrack_sync(). Removed RESTRACK_DD xa_get_mark() check in rdma_restrack_sync() as target tree does not have driver-specific resource tracking (RESTRACK_DD mark). In uverbs_cmd.c, kept downstream #include "uverbs_profile.h" alongside new #include "restrack.h".] Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- drivers/infiniband/core/nldev.c | 15 ++++---- drivers/infiniband/core/restrack.c | 52 +++++++++++++++++++++++++++- drivers/infiniband/core/restrack.h | 1 + drivers/infiniband/core/uverbs_cmd.c | 10 ++++-- include/rdma/ib_verbs.h | 5 +++ 5 files changed, 74 insertions(+), 9 deletions(-) diff --git a/drivers/infiniband/core/nldev.c b/drivers/infiniband/core/nldev.c index 9d6627bde61a..6c4008a1e18f 100644 --- a/drivers/infiniband/core/nldev.c +++ b/drivers/infiniband/core/nldev.c @@ -644,7 +644,7 @@ static int fill_res_mr_entry(struct sk_buff *msg, bool has_cap_net_admin, struct rdma_restrack_entry *res, uint32_t port) { struct ib_mr *mr = container_of(res, struct ib_mr, res); - struct ib_device *dev = mr->pd->device; + struct ib_device *dev = mr->device; if (has_cap_net_admin) { if (nla_put_u32(msg, RDMA_NLDEV_ATTR_RES_RKEY, mr->rkey)) @@ -660,9 +660,12 @@ static int fill_res_mr_entry(struct sk_buff *msg, bool has_cap_net_admin, if (nla_put_u32(msg, RDMA_NLDEV_ATTR_RES_MRN, res->id)) return -EMSGSIZE; - if (!rdma_is_kernel_res(res) && - nla_put_u32(msg, RDMA_NLDEV_ATTR_RES_PDN, mr->pd->res.id)) - return -EMSGSIZE; + if (!rdma_is_kernel_res(res)) { + struct ib_pd *pd = READ_ONCE(mr->pd); + + if (nla_put_u32(msg, RDMA_NLDEV_ATTR_RES_PDN, pd->res.id)) + return -EMSGSIZE; + } if (fill_res_name_pid(msg, res)) return -EMSGSIZE; @@ -676,7 +679,7 @@ static int fill_res_mr_raw_entry(struct sk_buff *msg, bool has_cap_net_admin, struct rdma_restrack_entry *res, uint32_t port) { struct ib_mr *mr = container_of(res, struct ib_mr, res); - struct ib_device *dev = mr->pd->device; + struct ib_device *dev = mr->device; if (!dev->ops.fill_res_mr_entry_raw) return -EINVAL; @@ -966,7 +969,7 @@ static int fill_stat_mr_entry(struct sk_buff *msg, bool has_cap_net_admin, struct rdma_restrack_entry *res, uint32_t port) { struct ib_mr *mr = container_of(res, struct ib_mr, res); - struct ib_device *dev = mr->pd->device; + struct ib_device *dev = mr->device; if (nla_put_u32(msg, RDMA_NLDEV_ATTR_RES_MRN, res->id)) goto err; diff --git a/drivers/infiniband/core/restrack.c b/drivers/infiniband/core/restrack.c index 438ed3588175..19a813e75486 100644 --- a/drivers/infiniband/core/restrack.c +++ b/drivers/infiniband/core/restrack.c @@ -68,8 +68,11 @@ int rdma_restrack_count(struct ib_device *dev, enum rdma_restrack_type type) u32 cnt = 0; xa_lock(&rt->xa); - xas_for_each(&xas, e, U32_MAX) + xas_for_each(&xas, e, U32_MAX) { + if (xa_is_zero(e)) + continue; cnt++; + } xa_unlock(&rt->xa); return cnt; } @@ -266,6 +269,53 @@ int rdma_restrack_put(struct rdma_restrack_entry *res) } EXPORT_SYMBOL(rdma_restrack_put); +/** + * rdma_restrack_sync() - Fence concurrent netlink dumps on an entry + * @res: resource entry + * + * After this returns any concurrent netlink dump threads will see the current + * value of the object. This is useful if the object has to be changed and there + * is not locking to protect the nl side. Eg for mr->pd. This effectively + * destroys the object from a kref/xarray perspective and then immediately + * restores it. The kref is acting like a lock to barrier concurrent nl threads. + * Callers must ensure rdma_restrack_del() is not concurrently called. + */ +void rdma_restrack_sync(struct rdma_restrack_entry *res) +{ + struct rdma_restrack_entry *old; + struct rdma_restrack_root *rt; + struct task_struct *task; + struct ib_device *dev; + + if (!res->valid || res->no_track) + return; + + dev = res_to_dev(res); + if (WARN_ON(!dev)) + return; + + rt = &dev->res[res->type]; + if (WARN_ON(xa_get_mark(&rt->xa, res->id, RESTRACK_DD))) + return; + + old = xa_cmpxchg(&rt->xa, res->id, res, XA_ZERO_ENTRY, GFP_KERNEL); + if (WARN_ON(old != res)) + return; + + task = res->task; + if (task) + get_task_struct(task); + rdma_restrack_put(res); + wait_for_completion(&res->comp); + reinit_completion(&res->comp); + if (task) + res->task = task; + kref_init(&res->kref); + + xa_cmpxchg(&rt->xa, res->id, XA_ZERO_ENTRY, res, GFP_KERNEL); +} +EXPORT_SYMBOL(rdma_restrack_sync); + /** * rdma_restrack_del() - delete object from the reource tracking database * @res: resource entry diff --git a/drivers/infiniband/core/restrack.h b/drivers/infiniband/core/restrack.h index 6a04fc41f738..75b8d1005a98 100644 --- a/drivers/infiniband/core/restrack.h +++ b/drivers/infiniband/core/restrack.h @@ -27,6 +27,7 @@ int rdma_restrack_init(struct ib_device *dev); void rdma_restrack_clean(struct ib_device *dev); void rdma_restrack_add(struct rdma_restrack_entry *res); void rdma_restrack_del(struct rdma_restrack_entry *res); +void rdma_restrack_sync(struct rdma_restrack_entry *res); void rdma_restrack_new(struct rdma_restrack_entry *res, enum rdma_restrack_type type); void rdma_restrack_set_name(struct rdma_restrack_entry *res, diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c index 2e4265ba35b7..f442cca3c05c 100644 --- a/drivers/infiniband/core/uverbs_cmd.c +++ b/drivers/infiniband/core/uverbs_cmd.c @@ -46,6 +46,7 @@ #include "uverbs.h" #include "core_priv.h" +#include "restrack.h" /* * Copy a response to userspace. If the provided 'resp' is larger than the @@ -813,6 +814,10 @@ static int ib_uverbs_rereg_mr(struct uverbs_attr_bundle *attrs) ret = PTR_ERR(new_pd); goto put_uobjs; } + if (new_pd == orig_pd) { + uobj_put_obj_read(new_pd); + cmd.flags &= ~IB_MR_REREG_PD; + } } else { new_pd = mr->pd; } @@ -858,9 +863,10 @@ static int ib_uverbs_rereg_mr(struct uverbs_attr_bundle *attrs) mr = new_mr; } else { if (cmd.flags & IB_MR_REREG_PD) { - atomic_dec(&orig_pd->usecnt); - mr->pd = new_pd; atomic_inc(&new_pd->usecnt); + WRITE_ONCE(mr->pd, new_pd); + rdma_restrack_sync(&mr->res); + atomic_dec(&orig_pd->usecnt); } if (cmd.flags & IB_MR_REREG_TRANS) { mr->iova = cmd.hca_va; diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h index 3eea95e51928..05b101693cd5 100644 --- a/include/rdma/ib_verbs.h +++ b/include/rdma/ib_verbs.h @@ -1833,6 +1833,11 @@ struct ib_dm { struct ib_mr { struct ib_device *device; + /* + * Due to IB_MR_REREG_PD pd is not a fixed pointer and can change. For a + * user MR, this value should only be read from a system call that holds + * the uobject lock, or the driver should disable in-place REREG_PD. + */ struct ib_pd *pd; u32 lkey; u32 rkey; -- 2.34.1

2 1

[PTACH openEuler-1.0-LTS] RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one
by Chen Jinghuang 27 Aug '26

27 Aug '26

From: Leon Romanovsky <leonro(a)nvidia.com> mainline inclusion from mainline-v7.2-rc1 commit 449ae7927152e46acbe5f19f97eafdae6d3a96b1 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18162 CVE: CVE-2026-74296 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Free the UAR index returned by the hardware. Fixes: 4ed131d0bb15 ("IB/mlx5: Expose dynamic mmap allocation") Link: https://patch.msgid.link/r/20260611-fix-uar-release-v1-1-f5464d845dbf@nvidi… Signed-off-by: Leon Romanovsky <leonro(a)nvidia.com> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Conflicts: drivers/infiniband/hw/mlx5/main.c [ Context conflict ] Signed-off-by: Chen jinghuang <chenjinghuang2(a)huawei.com> --- drivers/infiniband/hw/mlx5/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c index 4f340d6db582..051de9f3ed82 100644 --- a/drivers/infiniband/hw/mlx5/main.c +++ b/drivers/infiniband/hw/mlx5/main.c @@ -2148,7 +2148,7 @@ static int uar_mmap(struct mlx5_ib_dev *dev, enum mlx5_ib_mmap_cmd cmd, if (!dyn_uar) return err; - mlx5_cmd_free_uar(dev->mdev, idx); + mlx5_cmd_free_uar(dev->mdev, uar_index); free_bfreg: mlx5_ib_free_bfreg(dev, bfregi, bfreg_dyn_idx); -- 2.34.1

1 0

[PATCH OLK-6.6] ceph: avoid fs reclaim while using current->journal_info
by Pu Lehui 27 Aug '26

27 Aug '26

From: Max Kellermann <max.kellermann(a)ionos.com> stable inclusion from stable-v6.6.153 commit c8a21660c3b90864c391164eea5622e7b5b2897c category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18341 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5b602344a49e039e792ce5a8923bcc61412ee134 ] handle_reply() stores a `ceph_mds_request` pointer in `current->journal_info` while filling the inode and dentry cache from an MDS reply. An allocation in this section can enter direct reclaim and prune dentries from another filesystem. If this dirties an ext4 inode, ext4 starts a JBD2 transaction. JBD2 interprets the Ceph request in `current->journal_info` as a journal handle and dereferences the request's `r_tid` as `h_transaction`, causing a kernel crash, e.g.: Unable to handle kernel paging request at virtual address 00000000077b4818 [...] Internal error: Oops: 0000000096000004 [#1] SMP Modules linked in: CPU: 6 UID: 0 PID: 2699135 Comm: kworker/6:3 Tainted: G W 6.18.38-i3 #1113 NONE [...] Workqueue: ceph-msgr ceph_con_workfn pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : jbd2__journal_start+0x2c/0x208 lr : __ext4_journal_start_sb+0x100/0x178 [...] Call trace: jbd2__journal_start+0x2c/0x208 (P) __ext4_journal_start_sb+0x100/0x178 ext4_dirty_inode+0x3c/0x90 __mark_inode_dirty+0x58/0x400 iput.part.0+0x2b0/0x370 iput+0x18/0x30 dentry_unlink_inode+0xc0/0x158 __dentry_kill+0x80/0x250 shrink_dentry_list+0x90/0x130 prune_dcache_sb+0x60/0x98 super_cache_scan+0xe8/0x190 do_shrink_slab+0x174/0x388 shrink_slab+0xd8/0x4c0 shrink_node+0x31c/0x908 do_try_to_free_pages+0xd0/0x508 try_to_free_pages+0x11c/0x238 __alloc_frozen_pages_noprof+0x4d0/0xdd0 __folio_alloc_noprof+0x18/0x70 __filemap_get_folio+0x248/0x440 ceph_readdir_prepopulate+0x570/0x9e8 mds_dispatch+0x1424/0x1ba0 ceph_con_process_message+0x74/0xa0 ceph_con_v1_try_read+0x3a0/0x1510 ceph_con_workfn+0x260/0x460 Enter a scoped NOFS allocation context and leave it after clearing `journal_info`. This prevents filesystem reclaim from recursing into another filesystem while the field contains Ceph-private data. Cc: stable(a)vger.kernel.org Fixes: 315f24088048 ("ceph: fix security xattr deadlock") Signed-off-by: Max Kellermann <max.kellermann(a)ionos.com> Reviewed-by: Viacheslav Dubeyko <slava(a)dubeyko.com> Reviewed-by: Xiubo Li <xiubo.li(a)clyso.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- fs/ceph/mds_client.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c index 47ddad3606da..00b9f9f3f4d7 100644 --- a/fs/ceph/mds_client.c +++ b/fs/ceph/mds_client.c @@ -6,6 +6,7 @@ #include <linux/slab.h> #include <linux/gfp.h> #include <linux/sched.h> +#include <linux/sched/mm.h> #include <linux/debugfs.h> #include <linux/seq_file.h> #include <linux/ratelimit.h> @@ -3676,6 +3677,7 @@ static void handle_reply(struct ceph_mds_session *session, struct ceph_msg *msg) struct ceph_mds_reply_head *head = msg->front.iov_base; struct ceph_mds_reply_info_parsed *rinfo; /* parsed reply info */ struct ceph_snap_realm *realm; + unsigned int nofs_flags; u64 tid; int err, result; int mds = session->s_mds; @@ -3817,6 +3819,14 @@ static void handle_reply(struct ceph_mds_session *session, struct ceph_msg *msg) /* insert trace into our cache */ mutex_lock(&req->r_fill_mutex); + + /* disable fs reclaim while we are using current->journal_info + * for our own purposes, or else shrinkers of other + * filesystems might dereference this pointer as a different + * type + */ + nofs_flags = memalloc_nofs_save(); + current->journal_info = req; err = ceph_fill_trace(mdsc->fsc->sb, req); if (err == 0) { @@ -3825,6 +3835,7 @@ static void handle_reply(struct ceph_mds_session *session, struct ceph_msg *msg) err = ceph_readdir_prepopulate(req, req->r_session); } current->journal_info = NULL; + memalloc_nofs_restore(nofs_flags); mutex_unlock(&req->r_fill_mutex); up_read(&mdsc->snap_rwsem); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] bpf: Preserve pointer state for commuted arithmetic
by Pu Lehui 27 Aug '26

27 Aug '26

From: Yiyang Chen <chenyy23(a)mails.tsinghua.edu.cn> mainline inclusion from mainline-v7.2-rc7 commit a4c6f804b44c5c790269b25e0e61cf4e9f117c86 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17686 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When scalar += pointer is handled in adjust_ptr_min_max_vals(), the destination register inherits the pointer state from the source pointer. Copying only selected fields is fragile because pointer provenance is tracked by several bpf_reg_state fields. Use the caller's temporary offset register to preserve the scalar operand while replacing the destination with the full pointer state. This preserves the frame number for PTR_TO_STACK registers and keeps parent identity fields consistent. Fixes: f4d7e40a5b71 ("bpf: introduce function calls (verification)") Signed-off-by: Yiyang Chen <chenyy23(a)mails.tsinghua.edu.cn> Tested-by: Daniel Wade <danjwade95(a)gmail.com> Acked-by: Shung-Hsi Yu <shung-hsi.yu(a)suse.com> Link: https://patch.msgid.link/20260729-c3-035-public-bpf-v4-v4-2-8ee297e2346b@ma… Signed-off-by: Eduard Zingerman <eddyz87(a)gmail.com> Conflicts: kernel/bpf/verifier.c [ctx conflicts] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/verifier.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index e00cb52fb480..71cc52cfaf31 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -3124,11 +3124,12 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env, return -EACCES; } - /* In case of 'scalar += pointer', dst_reg inherits pointer type and id. - * The id may be overwritten later if we create a new variable offset. + /* For 'scalar += pointer', dst_reg inherits the complete pointer + * register state. Individual fields may be adjusted later by pointer + * arithmetic. Callers guarantee that below does not overwrite off_reg. */ - dst_reg->type = ptr_reg->type; - dst_reg->id = ptr_reg->id; + if (dst_reg != ptr_reg) + *dst_reg = *ptr_reg; if (!check_reg_sane_offset(env, off_reg, ptr_reg->type) || !check_reg_sane_offset(env, ptr_reg, ptr_reg->type)) @@ -3193,7 +3194,7 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env, } break; case BPF_SUB: - if (dst_reg == off_reg) { + if (dst_reg != ptr_reg) { /* scalar -= pointer. Creates an unknown scalar */ verbose(env, "R%d tried to subtract pointer from scalar\n", dst); @@ -3598,8 +3599,8 @@ static int adjust_reg_min_max_vals(struct bpf_verifier_env *env, * This is legal, but we have to reverse our * src/dest handling in computing the range */ - return adjust_ptr_min_max_vals(env, insn, - src_reg, dst_reg); + off_reg = *dst_reg; + return adjust_ptr_min_max_vals(env, insn, src_reg, &off_reg); } } else if (ptr_reg) { /* pointer += scalar */ -- 2.34.1

2 1

[PATCH OLK-6.6] bpf: Preserve pointer state for commuted arithmetic
by Pu Lehui 27 Aug '26

27 Aug '26

From: Yiyang Chen <chenyy23(a)mails.tsinghua.edu.cn> stable inclusion from stable-v6.6.152 commit 86b203aadc2930e0a4f9c6277b5b80ff3664c472 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18233 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a4c6f804b44c5c790269b25e0e61cf4e9f117c86 ] When scalar += pointer is handled in adjust_ptr_min_max_vals(), the destination register inherits the pointer state from the source pointer. Copying only selected fields is fragile because pointer provenance is tracked by several bpf_reg_state fields. Use the caller's temporary offset register to preserve the scalar operand while replacing the destination with the full pointer state. This preserves the frame number for PTR_TO_STACK registers and keeps parent identity fields consistent. Fixes: f4d7e40a5b71 ("bpf: introduce function calls (verification)") Signed-off-by: Yiyang Chen <chenyy23(a)mails.tsinghua.edu.cn> Tested-by: Daniel Wade <danjwade95(a)gmail.com> Acked-by: Shung-Hsi Yu <shung-hsi.yu(a)suse.com> Link: https://patch.msgid.link/20260729-c3-035-public-bpf-v4-v4-2-8ee297e2346b@ma… Signed-off-by: Eduard Zingerman <eddyz87(a)gmail.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/verifier.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 3de3edcb0344..ee8c00981cea 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -12905,11 +12905,12 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env, break; } - /* In case of 'scalar += pointer', dst_reg inherits pointer type and id. - * The id may be overwritten later if we create a new variable offset. + /* For 'scalar += pointer', dst_reg inherits the complete pointer + * register state. Individual fields may be adjusted later by pointer + * arithmetic. Callers guarantee that below does not overwrite off_reg. */ - dst_reg->type = ptr_reg->type; - dst_reg->id = ptr_reg->id; + if (dst_reg != ptr_reg) + *dst_reg = *ptr_reg; if (!check_reg_sane_offset(env, off_reg, ptr_reg->type) || !check_reg_sane_offset(env, ptr_reg, ptr_reg->type)) @@ -12989,7 +12990,7 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env, } break; case BPF_SUB: - if (dst_reg == off_reg) { + if (dst_reg != ptr_reg) { /* scalar -= pointer. Creates an unknown scalar */ verbose(env, "R%d tried to subtract pointer from scalar\n", dst); @@ -13863,8 +13864,8 @@ static int adjust_reg_min_max_vals(struct bpf_verifier_env *env, err = mark_chain_precision(env, insn->dst_reg); if (err) return err; - return adjust_ptr_min_max_vals(env, insn, - src_reg, dst_reg); + off_reg = *dst_reg; + return adjust_ptr_min_max_vals(env, insn, src_reg, &off_reg); } } else if (ptr_reg) { /* pointer += scalar */ -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] crypto: authencesn - fix spawn leak in digestsize check error path
by Gaosheng Cui 27 Aug '26

27 Aug '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9817 CVE: CVE-2026-46033 -------------------------------- The commit 51c8d538230b ("crypto: authencesn - reject short ahash digests during instance creation") added a digestsize check in crypto_authenc_esn_create() but used "goto err_free_inst" as the error path, skipping "err_drop_auth". On 4.19/4.18 the error labels are structured as a progressive cleanup chain (err_drop_enc -> err_drop_auth -> err_free_inst), where each label only cleans up one resource and falls through to the next. Skipping err_drop_auth means crypto_drop_ahash() is not called, so the ahash spawn remains linked on the underlying algorithm's cra_users list after kfree(inst) frees the memory containing it. This creates a dangling list node that triggers a use-after-free when cra_users is later traversed (e.g. algorithm unregistration via CRYPTO_MSG_DELALG or rmmod). On 5.10+ the err_free_inst label calls crypto_authenc_esn_free() which performs full cleanup (drop_skcipher + drop_ahash + kfree), so the original goto is safe there. The backport did not account for the different label structure on 4.19/4.18. Fix this by changing the goto target from err_free_inst to err_drop_auth, which properly removes the ahash spawn via crypto_drop_ahash() before falling through to kfree(inst). Fixes: 51c8d538230b ("crypto: authencesn - reject short ahash digests during instance creation") Signed-off-by: Gaosheng Cui <cuigaosheng1(a)huawei.com> --- crypto/authencesn.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crypto/authencesn.c b/crypto/authencesn.c index 318fc75d326b..cbff96942824 100644 --- a/crypto/authencesn.c +++ b/crypto/authencesn.c @@ -429,7 +429,7 @@ static int crypto_authenc_esn_create(struct crypto_template *tmpl, crypto_set_skcipher_spawn(&ctx->enc, aead_crypto_instance(inst)); if (auth->digestsize > 0 && auth->digestsize < 4) { err = -EINVAL; - goto err_free_inst; + goto err_drop_auth; } err = crypto_grab_skcipher(&ctx->enc, enc_name, 0, -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] crypto: authencesn - fix spawn leak in digestsize check error path
by Gaosheng Cui 27 Aug '26

27 Aug '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9817 CVE: CVE-2026-46033 -------------------------------- The commit 51c8d538230b ("crypto: authencesn - reject short ahash digests during instance creation") added a digestsize check in crypto_authenc_esn_create() but used "goto err_free_inst" as the error path, skipping "err_drop_auth". On 4.19/4.18 the error labels are structured as a progressive cleanup chain (err_drop_enc -> err_drop_auth -> err_free_inst), where each label only cleans up one resource and falls through to the next. Skipping err_drop_auth means crypto_drop_ahash() is not called, so the ahash spawn remains linked on the underlying algorithm's cra_users list after kfree(inst) frees the memory containing it. This creates a dangling list node that triggers a use-after-free when cra_users is later traversed (e.g. algorithm unregistration via CRYPTO_MSG_DELALG or rmmod). On 5.10+ the err_free_inst label calls crypto_authenc_esn_free() which performs full cleanup (drop_skcipher + drop_ahash + kfree), so the original goto is safe there. The backport did not account for the different label structure on 4.19/4.18. Fix this by changing the goto target from err_free_inst to err_drop_auth, which properly removes the ahash spawn via crypto_drop_ahash() before falling through to kfree(inst). Fixes: 567af76238c38 ("crypto: authencesn - reject short ahash digests during instance creation") Signed-off-by: Gaosheng Cui <cuigaosheng1(a)huawei.com> --- crypto/authencesn.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crypto/authencesn.c b/crypto/authencesn.c index 318fc75d326b2..cbff969428243 100644 --- a/crypto/authencesn.c +++ b/crypto/authencesn.c @@ -429,7 +429,7 @@ static int crypto_authenc_esn_create(struct crypto_template *tmpl, crypto_set_skcipher_spawn(&ctx->enc, aead_crypto_instance(inst)); if (auth->digestsize > 0 && auth->digestsize < 4) { err = -EINVAL; - goto err_free_inst; + goto err_drop_auth; } err = crypto_grab_skcipher(&ctx->enc, enc_name, 0, -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS,v2] crypto: authencesn - fix spawn leak in digestsize check error path
by Gaosheng Cui 27 Aug '26

27 Aug '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9817 CVE: CVE-2026-46033 -------------------------------- The commit 51c8d538230b ("crypto: authencesn - reject short ahash digests during instance creation") added a digestsize check in crypto_authenc_esn_create() but used "goto err_free_inst" as the error path, skipping "err_drop_auth". On 4.19/4.18 the error labels are structured as a progressive cleanup chain (err_drop_enc -> err_drop_auth -> err_free_inst), where each label only cleans up one resource and falls through to the next. Skipping err_drop_auth means crypto_drop_ahash() is not called, so the ahash spawn remains linked on the underlying algorithm's cra_users list after kfree(inst) frees the memory containing it. This creates a dangling list node that triggers a use-after-free when cra_users is later traversed (e.g. algorithm unregistration via CRYPTO_MSG_DELALG or rmmod). On 5.10+ the err_free_inst label calls crypto_authenc_esn_free() which performs full cleanup (drop_skcipher + drop_ahash + kfree), so the original goto is safe there. The backport did not account for the different label structure on 4.19/4.18. Fix this by changing the goto target from err_free_inst to err_drop_auth, which properly removes the ahash spawn via crypto_drop_ahash() before falling through to kfree(inst). Fixes: 51c8d538230b ("crypto: authencesn - reject short ahash digests during instance creation") Signed-off-by: Gaosheng Cui <cuigaosheng1(a)huawei.com> --- v2: Fix Signed-off-by: Cui Gaosheng -> Gaosheng Cui crypto/authencesn.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crypto/authencesn.c b/crypto/authencesn.c index 318fc75d326b..cbff96942824 100644 --- a/crypto/authencesn.c +++ b/crypto/authencesn.c @@ -429,7 +429,7 @@ static int crypto_authenc_esn_create(struct crypto_template *tmpl, crypto_set_skcipher_spawn(&ctx->enc, aead_crypto_instance(inst)); if (auth->digestsize > 0 && auth->digestsize < 4) { err = -EINVAL; - goto err_free_inst; + goto err_drop_auth; } err = crypto_grab_skcipher(&ctx->enc, enc_name, 0, -- 2.43.0

1 0

[PATCH openEuler-1.0-LTS] crypto: authencesn - fix spawn leak in digestsize check error path
by Gaosheng Cui 26 Aug '26

26 Aug '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9817 CVE: CVE-2026-46033 -------------------------------- The commit 51c8d538230b ("crypto: authencesn - reject short ahash digests during instance creation") added a digestsize check in crypto_authenc_esn_create() but used "goto err_free_inst" as the error path, skipping "err_drop_auth". On 4.19/4.18 the error labels are structured as a progressive cleanup chain (err_drop_enc -> err_drop_auth -> err_free_inst), where each label only cleans up one resource and falls through to the next. Skipping err_drop_auth means crypto_drop_ahash() is not called, so the ahash spawn remains linked on the underlying algorithm's cra_users list after kfree(inst) frees the memory containing it. This creates a dangling list node that triggers a use-after-free when cra_users is later traversed (e.g. algorithm unregistration via CRYPTO_MSG_DELALG or rmmod). On 5.10+ the err_free_inst label calls crypto_authenc_esn_free() which performs full cleanup (drop_skcipher + drop_ahash + kfree), so the original goto is safe there. The backport did not account for the different label structure on 4.19/4.18. Fix this by changing the goto target from err_free_inst to err_drop_auth, which properly removes the ahash spawn via crypto_drop_ahash() before falling through to kfree(inst). Fixes: 51c8d538230b ("crypto: authencesn - reject short ahash digests during instance creation") Signed-off-by: Cui GaoSheng <cuigaosheng1(a)huawei.com> --- crypto/authencesn.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crypto/authencesn.c b/crypto/authencesn.c index 318fc75d326b..cbff96942824 100644 --- a/crypto/authencesn.c +++ b/crypto/authencesn.c @@ -429,7 +429,7 @@ static int crypto_authenc_esn_create(struct crypto_template *tmpl, crypto_set_skcipher_spawn(&ctx->enc, aead_crypto_instance(inst)); if (auth->digestsize > 0 && auth->digestsize < 4) { err = -EINVAL; - goto err_free_inst; + goto err_drop_auth; } err = crypto_grab_skcipher(&ctx->enc, enc_name, 0, -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] netfilter: require Ethernet MAC header before using eth_hdr()
by superdcc97＠163.com 26 Aug '26

26 Aug '26

From: Zhengchuan Liang <zcliangcn(a)gmail.com> mainline inclusion from mainline-v7.1-rc1 commit 62443dc21114c0bbc476fa62973db89743f2f137 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15825 CVE: CVE-2026-53131 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`. Suggested-by: Florian Westphal <fw(a)strlen.de> Tested-by: Ren Wei <enjou1224z(a)gmail.com> Signed-off-by: Zhengchuan Liang <zcliangcn(a)gmail.com> Signed-off-by: Ren Wei <n05ec(a)lzu.edu.cn> Signed-off-by: Florian Westphal <fw(a)strlen.de> Conflicts: net/netfilter/nf_log_syslog.c net/ipv4/netfilter/nf_log_arp.c net/ipv4/netfilter/nf_log_ipv4.c net/ipv6/netfilter/ip6t_eui64.c net/ipv6/netfilter/nf_log_ipv6.c [commit fdce0b3590f7, f11d61e7957d are not backport, which lead to conflicts] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ipv4/netfilter/nf_log_arp.c | 5 ++++- net/ipv4/netfilter/nf_log_ipv4.c | 3 +++ net/ipv6/netfilter/ip6t_eui64.c | 8 +++++--- net/ipv6/netfilter/nf_log_ipv6.c | 3 +++ net/netfilter/ipset/ip_set_bitmap_ipmac.c | 5 +++-- net/netfilter/ipset/ip_set_hash_ipmac.c | 9 +++++---- net/netfilter/ipset/ip_set_hash_mac.c | 5 +++-- net/netfilter/xt_mac.c | 4 +--- 8 files changed, 27 insertions(+), 15 deletions(-) diff --git a/net/ipv4/netfilter/nf_log_arp.c b/net/ipv4/netfilter/nf_log_arp.c index 19fff2c589fa..fb10209c9a45 100644 --- a/net/ipv4/netfilter/nf_log_arp.c +++ b/net/ipv4/netfilter/nf_log_arp.c @@ -63,7 +63,10 @@ static void dump_arp_packet(struct nf_log_buf *m, else logflags = NF_LOG_DEFAULT_MASK; - if (logflags & NF_LOG_MACDECODE) { + if ((logflags & NF_LOG_MACDECODE) && + skb->dev && skb->dev->type == ARPHRD_ETHER && + skb_mac_header_was_set(skb) && + skb_mac_header_len(skb) >= ETH_HLEN) { nf_log_buf_add(m, "MACSRC=%pM MACDST=%pM ", eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest); nf_log_dump_vlan(m, skb); diff --git a/net/ipv4/netfilter/nf_log_ipv4.c b/net/ipv4/netfilter/nf_log_ipv4.c index faa1ca357d0c..7cc8e5d7528c 100644 --- a/net/ipv4/netfilter/nf_log_ipv4.c +++ b/net/ipv4/netfilter/nf_log_ipv4.c @@ -287,6 +287,9 @@ static void dump_ipv4_mac_header(struct nf_log_buf *m, switch (dev->type) { case ARPHRD_ETHER: + if (!skb_mac_header_was_set(skb) || skb_mac_header_len(skb) < ETH_HLEN) + return; + nf_log_buf_add(m, "MACSRC=%pM MACDST=%pM ", eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest); nf_log_dump_vlan(m, skb); diff --git a/net/ipv6/netfilter/ip6t_eui64.c b/net/ipv6/netfilter/ip6t_eui64.c index aab0706908c5..96273dcdc54c 100644 --- a/net/ipv6/netfilter/ip6t_eui64.c +++ b/net/ipv6/netfilter/ip6t_eui64.c @@ -10,6 +10,7 @@ #include <linux/module.h> #include <linux/skbuff.h> #include <linux/ipv6.h> +#include <linux/if_arp.h> #include <linux/if_ether.h> #include <linux/netfilter/x_tables.h> @@ -24,9 +25,10 @@ eui64_mt6(const struct sk_buff *skb, struct xt_action_param *par) { unsigned char eui64[8]; - if (!(skb_mac_header(skb) >= skb->head && - skb_mac_header(skb) + ETH_HLEN <= skb->data) && - par->fragoff != 0) { + if (!skb->dev || skb->dev->type != ARPHRD_ETHER) + return false; + + if (!skb_mac_header_was_set(skb) || skb_mac_header_len(skb) < ETH_HLEN) { par->hotdrop = true; return false; } diff --git a/net/ipv6/netfilter/nf_log_ipv6.c b/net/ipv6/netfilter/nf_log_ipv6.c index 4edf73b5c8e5..7bd36cb23fa1 100644 --- a/net/ipv6/netfilter/nf_log_ipv6.c +++ b/net/ipv6/netfilter/nf_log_ipv6.c @@ -300,6 +300,9 @@ static void dump_ipv6_mac_header(struct nf_log_buf *m, switch (dev->type) { case ARPHRD_ETHER: + if (!skb_mac_header_was_set(skb) || skb_mac_header_len(skb) < ETH_HLEN) + return; + nf_log_buf_add(m, "MACSRC=%pM MACDST=%pM ", eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest); nf_log_dump_vlan(m, skb); diff --git a/net/netfilter/ipset/ip_set_bitmap_ipmac.c b/net/netfilter/ipset/ip_set_bitmap_ipmac.c index 9669cace4522..153f8dec9ca5 100644 --- a/net/netfilter/ipset/ip_set_bitmap_ipmac.c +++ b/net/netfilter/ipset/ip_set_bitmap_ipmac.c @@ -15,6 +15,7 @@ #include <linux/etherdevice.h> #include <linux/skbuff.h> #include <linux/errno.h> +#include <linux/if_arp.h> #include <linux/if_ether.h> #include <linux/netlink.h> #include <linux/jiffies.h> @@ -224,8 +225,8 @@ bitmap_ipmac_kadt(struct ip_set *set, const struct sk_buff *skb, return -IPSET_ERR_BITMAP_RANGE; /* Backward compatibility: we don't check the second flag */ - if (skb_mac_header(skb) < skb->head || - (skb_mac_header(skb) + ETH_HLEN) > skb->data) + if (!skb->dev || skb->dev->type != ARPHRD_ETHER || + !skb_mac_header_was_set(skb) || skb_mac_header_len(skb) < ETH_HLEN) return -EINVAL; e.id = ip_to_id(map, ip); diff --git a/net/netfilter/ipset/ip_set_hash_ipmac.c b/net/netfilter/ipset/ip_set_hash_ipmac.c index f2c2f72e2fff..b7b98b129315 100644 --- a/net/netfilter/ipset/ip_set_hash_ipmac.c +++ b/net/netfilter/ipset/ip_set_hash_ipmac.c @@ -14,6 +14,7 @@ #include <linux/skbuff.h> #include <linux/errno.h> #include <linux/random.h> +#include <linux/if_arp.h> #include <linux/if_ether.h> #include <net/ip.h> #include <net/ipv6.h> @@ -92,8 +93,8 @@ hash_ipmac4_kadt(struct ip_set *set, const struct sk_buff *skb, struct hash_ipmac4_elem e = { .ip = 0, { .foo[0] = 0, .foo[1] = 0 } }; struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set); - if (skb_mac_header(skb) < skb->head || - (skb_mac_header(skb) + ETH_HLEN) > skb->data) + if (!skb->dev || skb->dev->type != ARPHRD_ETHER || + !skb_mac_header_was_set(skb) || skb_mac_header_len(skb) < ETH_HLEN) return -EINVAL; if (opt->flags & IPSET_DIM_TWO_SRC) @@ -208,8 +209,8 @@ hash_ipmac6_kadt(struct ip_set *set, const struct sk_buff *skb, }; struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set); - if (skb_mac_header(skb) < skb->head || - (skb_mac_header(skb) + ETH_HLEN) > skb->data) + if (!skb->dev || skb->dev->type != ARPHRD_ETHER || + !skb_mac_header_was_set(skb) || skb_mac_header_len(skb) < ETH_HLEN) return -EINVAL; if (opt->flags & IPSET_DIM_TWO_SRC) diff --git a/net/netfilter/ipset/ip_set_hash_mac.c b/net/netfilter/ipset/ip_set_hash_mac.c index 4fe5f243d0a3..ccb925f82fa7 100644 --- a/net/netfilter/ipset/ip_set_hash_mac.c +++ b/net/netfilter/ipset/ip_set_hash_mac.c @@ -12,6 +12,7 @@ #include <linux/etherdevice.h> #include <linux/skbuff.h> #include <linux/errno.h> +#include <linux/if_arp.h> #include <linux/if_ether.h> #include <net/netlink.h> @@ -81,8 +82,8 @@ hash_mac4_kadt(struct ip_set *set, const struct sk_buff *skb, struct hash_mac4_elem e = { { .foo[0] = 0, .foo[1] = 0 } }; struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set); - if (skb_mac_header(skb) < skb->head || - (skb_mac_header(skb) + ETH_HLEN) > skb->data) + if (!skb->dev || skb->dev->type != ARPHRD_ETHER || + !skb_mac_header_was_set(skb) || skb_mac_header_len(skb) < ETH_HLEN) return -EINVAL; if (opt->flags & IPSET_DIM_ONE_SRC) diff --git a/net/netfilter/xt_mac.c b/net/netfilter/xt_mac.c index d5b4fd4f91ed..df42d0233d73 100644 --- a/net/netfilter/xt_mac.c +++ b/net/netfilter/xt_mac.c @@ -32,9 +32,7 @@ static bool mac_mt(const struct sk_buff *skb, struct xt_action_param *par) if (skb->dev == NULL || skb->dev->type != ARPHRD_ETHER) return false; - if (skb_mac_header(skb) < skb->head) - return false; - if (skb_mac_header(skb) + ETH_HLEN > skb->data) + if (!skb_mac_header_was_set(skb) || skb_mac_header_len(skb) < ETH_HLEN) return false; ret = ether_addr_equal(eth_hdr(skb)->h_source, info->srcaddr); ret ^= info->invert; -- 2.43.0

2 1