- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS 0/2] smb: client: reject userspace cifs.spnego descriptions
by Zizhi Wo 29 May '26

29 May '26

From: Asim Viladi Oglu Manizada <manizada(a)pm.me> mainline inclusion from mainline-v7.1-rc5 commit 3da1fdf4efbc490041eb4f836bf596201203f8f2 category: bugfix bugzilla: NA CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- cifs.spnego key descriptions contain authority-bearing fields such as pid, uid, creduid, and upcall_target that cifs.upcall treats as kernel-originating inputs. However, userspace can also create keys of this type through request_key(2) or add_key(2), allowing those fields to be supplied without CIFS origin. Only accept cifs.spnego descriptions while CIFS is using its private spnego_cred to request the key. Fixes: f1d662a7d5e5 ("[CIFS] Add upcall files for cifs to use spnego/kerberos") Assisted-by: avom-custom-harness:gpt-5.5-qwen3.6-mod-mix Reviewed-by: David Howells <dhowells(a)redhat.com> Signed-off-by: Asim Viladi Oglu Manizada <manizada(a)pm.me> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/cifs/cifs_spnego.c fs/smb/client/cifs_spnego.c [File locations are inconsistent, not affect this patch.] Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/cifs/cifs_spnego.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/fs/cifs/cifs_spnego.c b/fs/cifs/cifs_spnego.c index 7f01c6e60791..288d3ccfa231 100644 --- a/fs/cifs/cifs_spnego.c +++ b/fs/cifs/cifs_spnego.c @@ -18,10 +18,11 @@ * along with this library; if not, write to the Free Software * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ #include <linux/list.h> +#include <linux/cred.h> #include <linux/slab.h> #include <linux/string.h> #include <keys/user-type.h> #include <linux/key-type.h> #include <linux/keyctl.h> @@ -56,16 +57,31 @@ static void cifs_spnego_key_destroy(struct key *key) { kfree(key->payload.data[0]); } +static int +cifs_spnego_key_vet_description(const char *description) +{ + /* + * cifs.spnego descriptions are authority-bearing inputs to cifs.upcall. + * They are only valid when produced by CIFS while using the private + * spnego_cred installed below. Do not let userspace create this type + * of key through request_key(2)/add_key(2), since the helper treats + * pid/uid/creduid/upcall_target as kernel-originating fields. + */ + if (current_cred() != spnego_cred) + return -EPERM; + return 0; +} /* * keytype for CIFS spnego keys */ struct key_type cifs_spnego_key_type = { .name = "cifs.spnego", + .vet_description = cifs_spnego_key_vet_description, .instantiate = cifs_spnego_key_instantiate, .destroy = cifs_spnego_key_destroy, .describe = user_describe, }; -- 2.52.0

1 0

[PATCH OLK-5.10] cgroup/cpuset.c: Comment out early when prefer_cpus cpumask equals
by Chen Jinghuang 29 May '26

29 May '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8397 CVE: NA ---------------------------------------- The current logic skips updating task's prefer_cpus in a cgroup when the cgroup's prefer_cpus is unchanged. However, task's prefer_cpus may mismatch the cgroup config in some cases, causing inconsistent CPU affinity. Comment out the early return logic to ensure task's prefer_cpus are always updated on cgroup.prefer_cpus writes, aligning task and cgroup settings. Fixes: 243865da2684 ("cpuset: Introduce new interface for scheduler dynamic affinity") Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- kernel/cgroup/cpuset.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c index 1f6ed08af9f5..60c5ee2bc463 100644 --- a/kernel/cgroup/cpuset.c +++ b/kernel/cgroup/cpuset.c @@ -748,10 +748,6 @@ static int update_prefer_cpumask(struct cpuset *cs, struct cpuset *trialcs, return retval; } - /* Nothing to do if the cpus didn't change */ - if (cpumask_equal(cs->prefer_cpus, trialcs->prefer_cpus)) - return 0; - if (!cpumask_subset(trialcs->prefer_cpus, cs->cpus_allowed)) return -EINVAL; -- 2.34.1

2 2

[PATCH OLK-6.6 0/6] mainline for bpf
by Pu Lehui 29 May '26

29 May '26

Alexei Starovoitov (1): bpf: Fix variable length stack write over spilled pointers Amery Hung (5): bpf: Select bpf_local_storage_map_bucket based on bpf_local_storage bpf: Convert bpf_selem_unlink_map to failable bpf: Convert bpf_selem_link_map to failable bpf: Convert bpf_selem_unlink to failable bpf: Do not allow deleting local storage in NMI include/linux/bpf_local_storage.h | 7 +- kernel/bpf/bpf_cgrp_storage.c | 3 +- kernel/bpf/bpf_inode_storage.c | 4 +- kernel/bpf/bpf_local_storage.c | 149 +++++++++++++++++------------- kernel/bpf/bpf_task_storage.c | 4 +- kernel/bpf/verifier.c | 28 ++++-- net/core/bpf_sk_storage.c | 13 ++- 7 files changed, 122 insertions(+), 86 deletions(-) -- 2.34.1

2 7

[PATCH OLK-6.6 V4 0/2] Support open_tree OPEN_TREE_NAMESPACE
by Zizhi Wo 28 May '26

28 May '26

Changes since V3: Delete overmount logic to fix KABI broken. Changes since V2: Add KABI_EXTEND to fix KABI broken. Changes since V1: The position of unlock_mount_hash() has been adjusted to align with the mainline. Christian Brauner (2): mount: add OPEN_TREE_NAMESPACE mount: hold namespace_sem across copy in create_new_namespace() fs/internal.h | 2 + fs/namespace.c | 174 ++++++++++++++++++++++++++++++++++--- fs/nsfs.c | 32 +++++++ include/uapi/linux/mount.h | 3 +- 4 files changed, 198 insertions(+), 13 deletions(-) -- 2.52.0

2 3

[PATCH OLK-6.6 V4 0/2] Support open_tree OPEN_TREE_NAMESPACE
by Zizhi Wo 28 May '26

28 May '26

Changes since V3: Delete overmount logic to fix KABI broken. Changes since V2: Add KABI_EXTEND to fix KABI broken. Changes since V1: The position of unlock_mount_hash() has been adjusted to align with the mainline. Christian Brauner (2): mount: add OPEN_TREE_NAMESPACE mount: hold namespace_sem across copy in create_new_namespace() fs/internal.h | 2 + fs/namespace.c | 174 ++++++++++++++++++++++++++++++++++--- fs/nsfs.c | 32 +++++++ include/uapi/linux/mount.h | 3 +- 4 files changed, 198 insertions(+), 13 deletions(-) -- 2.52.0

2 3

[PATCH OLK-6.6 0/1] Fix CVE-2026-45861
by Hongbo Li 28 May '26

28 May '26

Fix CVE-2026-45861. Andreas Gruenbacher (1): gfs2: Fix slab-use-after-free in qd_put fs/gfs2/quota.c | 1 + 1 file changed, 1 insertion(+) -- 2.34.1

2 2

[PATCH OLK-6.6 0/1] Fix CVE-2026-45861
by Hongbo Li 28 May '26

28 May '26

Fix CVE-2026-45861. Andreas Gruenbacher (1): gfs2: Fix slab-use-after-free in qd_put fs/gfs2/quota.c | 1 + 1 file changed, 1 insertion(+) -- 2.34.1

2 2

[PATCH OLK-6.6] tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG
by Zhang Qilong 28 May '26

28 May '26

From: Oleh Konko <security(a)1seal.org> stable inclusion from stable-v6.6.134 commit 3bcf7aca63f0bcd679ae28e9b99823c608e59ce3 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14404 CVE: CVE-2026-31662 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 48a5fe38772b6f039522469ee6131a67838221a8 upstream. The GRP_ACK_MSG handler in tipc_group_proto_rcv() currently decrements bc_ackers on every inbound group ACK, even when the same member has already acknowledged the current broadcast round. Because bc_ackers is a u16, a duplicate ACK received after the last legitimate ACK wraps the counter to 65535. Once wrapped, tipc_group_bc_cong() keeps reporting congestion and later group broadcasts on the affected socket stay blocked until the group is recreated. Fix this by ignoring duplicate or stale ACKs before touching bc_acked or bc_ackers. This makes repeated GRP_ACK_MSG handling idempotent and prevents the underflow path. Fixes: 2f487712b893 ("tipc: guarantee that group broadcast doesn't bypass group unicast") Cc: stable(a)vger.kernel.org Signed-off-by: Oleh Konko <security(a)1seal.org> Reviewed-by: Tung Nguyen <tung.quang.nguyen(a)est.tech> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://patch.msgid.link/41a4833f368641218e444fdcff822039.security@1seal.org Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- net/tipc/group.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/net/tipc/group.c b/net/tipc/group.c index 3e137d8c9d2f..215f2a7d8458 100644 --- a/net/tipc/group.c +++ b/net/tipc/group.c @@ -744,10 +744,11 @@ void tipc_group_proto_rcv(struct tipc_group *grp, bool *usr_wakeup, { u32 node = msg_orignode(hdr); u32 port = msg_origport(hdr); struct tipc_member *m, *pm; u16 remitted, in_flight; + u16 acked; if (!grp) return; if (grp->scope == TIPC_NODE_SCOPE && node != tipc_own_addr(grp->net)) @@ -796,11 +797,14 @@ void tipc_group_proto_rcv(struct tipc_group *grp, bool *usr_wakeup, tipc_group_open(m, usr_wakeup); return; case GRP_ACK_MSG: if (!m) return; - m->bc_acked = msg_grp_bc_acked(hdr); + acked = msg_grp_bc_acked(hdr); + if (less_eq(acked, m->bc_acked)) + return; + m->bc_acked = acked; if (--grp->bc_ackers) return; list_del_init(&m->small_win); *m->group->open = true; *usr_wakeup = true; -- 2.43.0

2 1

[PATCH OLK-5.10] tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG
by Zhang Qilong 28 May '26

28 May '26

From: Oleh Konko <security(a)1seal.org> stable inclusion from stable-v5.10.253 commit a7db57ccca21f5801609065473c89a38229ecb92 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14404 CVE: CVE-2026-31662 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 48a5fe38772b6f039522469ee6131a67838221a8 upstream. The GRP_ACK_MSG handler in tipc_group_proto_rcv() currently decrements bc_ackers on every inbound group ACK, even when the same member has already acknowledged the current broadcast round. Because bc_ackers is a u16, a duplicate ACK received after the last legitimate ACK wraps the counter to 65535. Once wrapped, tipc_group_bc_cong() keeps reporting congestion and later group broadcasts on the affected socket stay blocked until the group is recreated. Fix this by ignoring duplicate or stale ACKs before touching bc_acked or bc_ackers. This makes repeated GRP_ACK_MSG handling idempotent and prevents the underflow path. Fixes: 2f487712b893 ("tipc: guarantee that group broadcast doesn't bypass group unicast") Cc: stable(a)vger.kernel.org Signed-off-by: Oleh Konko <security(a)1seal.org> Reviewed-by: Tung Nguyen <tung.quang.nguyen(a)est.tech> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://patch.msgid.link/41a4833f368641218e444fdcff822039.security@1seal.org Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com> --- net/tipc/group.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/net/tipc/group.c b/net/tipc/group.c index b1fcd2ad5ecf..cae497418dc9 100644 --- a/net/tipc/group.c +++ b/net/tipc/group.c @@ -743,10 +743,11 @@ void tipc_group_proto_rcv(struct tipc_group *grp, bool *usr_wakeup, { u32 node = msg_orignode(hdr); u32 port = msg_origport(hdr); struct tipc_member *m, *pm; u16 remitted, in_flight; + u16 acked; if (!grp) return; if (grp->scope == TIPC_NODE_SCOPE && node != tipc_own_addr(grp->net)) @@ -795,11 +796,14 @@ void tipc_group_proto_rcv(struct tipc_group *grp, bool *usr_wakeup, tipc_group_open(m, usr_wakeup); return; case GRP_ACK_MSG: if (!m) return; - m->bc_acked = msg_grp_bc_acked(hdr); + acked = msg_grp_bc_acked(hdr); + if (less_eq(acked, m->bc_acked)) + return; + m->bc_acked = acked; if (--grp->bc_ackers) return; list_del_init(&m->small_win); *m->group->open = true; *usr_wakeup = true; -- 2.43.0

2 1

[PATCH OLK-6.6] s390/cio: Fix device lifecycle handling in css_alloc_subchannel()
by Zhang Yuwei 28 May '26

28 May '26

From: Salah Triki <salah.triki(a)gmail.com> stable inclusion from stable-v6.6.128 commit abb6e07f46a740cda4f07d1b561ae4eaa7a1df42 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15232 CVE: CVE-2026-45981 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f65c75b0b9b5a390bc3beadcde0a6fbc3ad118f7 ] `css_alloc_subchannel()` calls `device_initialize()` before setting up the DMA masks. If `dma_set_coherent_mask()` or `dma_set_mask()` fails, the error path frees the subchannel structure directly, bypassing the device model reference counting. Once `device_initialize()` has been called, the embedded struct device must be released via `put_device()`, allowing the release callback to free the container structure. Fix the error path by dropping the initial device reference with `put_device()` instead of calling `kfree()` directly. This ensures correct device lifetime handling and avoids potential use-after-free or double-free issues. Fixes: e5dcf0025d7af ("s390/css: move subchannel lock allocation") Signed-off-by: Salah Triki <salah.triki(a)gmail.com> Reviewed-by: Vineeth Vijayan <vneethv(a)linux.ibm.com> Signed-off-by: Heiko Carstens <hca(a)linux.ibm.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yuan can <yuancan(a)huawei.com> --- drivers/s390/cio/css.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c index 3ff46fc694f8..e50592c3d30c 100644 --- a/drivers/s390/cio/css.c +++ b/drivers/s390/cio/css.c @@ -247,7 +247,7 @@ struct subchannel *css_alloc_subchannel(struct subchannel_id schid, err_lock: kfree(sch->lock); err: - kfree(sch); + put_device(&sch->dev); return ERR_PTR(ret); } -- 2.22.0

2 1