- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] nfsd: provide locking for v4_end_grace
by Li Lingfeng 10 Apr '26

10 Apr '26

From: NeilBrown <neil(a)brown.name> stable inclusion from stable-v5.10.248 commit ca97360860eb02e3ae4ba42c19b439a0fcecbf06 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13489 CVE: CVE-2026-22980 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2857bd59feb63fcf40fe4baf55401baea6b4feb4 ] Writing to v4_end_grace can race with server shutdown and result in memory being accessed after it was freed - reclaim_str_hashtbl in particularly. We cannot hold nfsd_mutex across the nfsd4_end_grace() call as that is held while client_tracking_op->init() is called and that can wait for an upcall to nfsdcltrack which can write to v4_end_grace, resulting in a deadlock. nfsd4_end_grace() is also called by the landromat work queue and this doesn't require locking as server shutdown will stop the work and wait for it before freeing anything that nfsd4_end_grace() might access. However, we must be sure that writing to v4_end_grace doesn't restart the work item after shutdown has already waited for it. For this we add a new flag protected with nn->client_lock. It is set only while it is safe to make client tracking calls, and v4_end_grace only schedules work while the flag is set with the spinlock held. So this patch adds a nfsd_net field "client_tracking_active" which is set as described. Another field "grace_end_forced", is set when v4_end_grace is written. After this is set, and providing client_tracking_active is set, the laundromat is scheduled. This "grace_end_forced" field bypasses other checks for whether the grace period has finished. This resolves a race which can result in use-after-free. Reported-by: Li Lingfeng <lilingfeng3(a)huawei.com> Closes: https://lore.kernel.org/linux-nfs/20250623030015.2353515-1-neil@brown.name/… Fixes: 7f5ef2e900d9 ("nfsd: add a v4_end_grace file to /proc/fs/nfsd") Cc: stable(a)vger.kernel.org Signed-off-by: NeilBrown <neil(a)brown.name> Tested-by: Li Lingfeng <lilingfeng3(a)huawei.com> Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> [ Adjust context ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/nfsd/nfs4state.c [Commit 5aa2c4a1fe28 ("NFSD: Add a nfsd4_file_hash_remove() helper") add declaration of nfsd4_file_hash_remove(); commit ea92c0768f98 ("nfsd: simplify nfsd_renew") change the return value; commit 438ef64bbfe4 ("NFSD: register/unregister of nfsd-client shrinker at nfsd startup/shutdown time") add unregister_shrinker() in nfs4_state_shutdown_net(); commit 67ef9e5fd737 ("NFSD: add courteous server support for thread with only delegation") move the position of declaration of laundry_wq.] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfsd/netns.h | 2 ++ fs/nfsd/nfs4state.c | 44 +++++++++++++++++++++++++++++++++++++++++--- fs/nfsd/nfsctl.c | 3 +-- fs/nfsd/state.h | 2 +- 4 files changed, 45 insertions(+), 6 deletions(-) diff --git a/fs/nfsd/netns.h b/fs/nfsd/netns.h index 8500acac09e0..ca5c386aafce 100644 --- a/fs/nfsd/netns.h +++ b/fs/nfsd/netns.h @@ -40,6 +40,8 @@ struct nfsd_net { struct lock_manager nfsd4_manager; bool grace_ended; + bool grace_end_forced; + bool client_tracking_active; time64_t boot_time; struct dentry *nfsd_client_dir; diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c index 302bbad5cdc6..ee28d5456dde 100644 --- a/fs/nfsd/nfs4state.c +++ b/fs/nfsd/nfs4state.c @@ -80,7 +80,7 @@ static u64 current_sessionid = 1; /* forward declarations */ static bool check_for_locks(struct nfs4_file *fp, struct nfs4_lockowner *lowner); static void nfs4_free_ol_stateid(struct nfs4_stid *stid); -void nfsd4_end_grace(struct nfsd_net *nn); +static void nfsd4_end_grace(struct nfsd_net *nn); static void _free_cpntf_state_locked(struct nfsd_net *nn, struct nfs4_cpntf_state *cps); /* Locking: */ @@ -5346,7 +5346,7 @@ nfsd4_renew(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, return status; } -void +static void nfsd4_end_grace(struct nfsd_net *nn) { /* do nothing if grace period already ended */ @@ -5379,6 +5379,34 @@ nfsd4_end_grace(struct nfsd_net *nn) */ } +static struct workqueue_struct *laundry_wq; +/** + * nfsd4_force_end_grace - forcibly end the NFSv4 grace period + * @nn: network namespace for the server instance to be updated + * + * Forces bypass of normal grace period completion, then schedules + * the laundromat to end the grace period immediately. Does not wait + * for the grace period to fully terminate before returning. + * + * Return values: + * %true: Grace termination schedule + * %false: No action was taken + */ +bool nfsd4_force_end_grace(struct nfsd_net *nn) +{ + if (!nn->client_tracking_ops) + return false; + spin_lock(&nn->client_lock); + if (nn->grace_ended || !nn->client_tracking_active) { + spin_unlock(&nn->client_lock); + return false; + } + WRITE_ONCE(nn->grace_end_forced, true); + mod_delayed_work(laundry_wq, &nn->laundromat_work, 0); + spin_unlock(&nn->client_lock); + return true; +} + /* * If we've waited a lease period but there are still clients trying to * reclaim, wait a little longer to give them a chance to finish. @@ -5388,6 +5416,8 @@ static bool clients_still_reclaiming(struct nfsd_net *nn) time64_t double_grace_period_end = nn->boot_time + 2 * nn->nfsd4_lease; + if (READ_ONCE(nn->grace_end_forced)) + return false; if (nn->track_reclaim_completes && atomic_read(&nn->nr_reclaim_complete) == nn->reclaim_str_hashtbl_size) @@ -5530,7 +5560,6 @@ nfs4_laundromat(struct nfsd_net *nn) return new_timeo; } -static struct workqueue_struct *laundry_wq; static void laundromat_main(struct work_struct *); static void @@ -7343,6 +7372,8 @@ static int nfs4_state_create_net(struct net *net) nn->unconf_name_tree = RB_ROOT; nn->boot_time = ktime_get_real_seconds(); nn->grace_ended = false; + nn->grace_end_forced = false; + nn->client_tracking_active = false; nn->nfsd4_manager.block_opens = true; INIT_LIST_HEAD(&nn->nfsd4_manager.list); INIT_LIST_HEAD(&nn->client_lru); @@ -7409,6 +7440,10 @@ nfs4_state_start_net(struct net *net) return ret; locks_start_grace(net, &nn->nfsd4_manager); nfsd4_client_tracking_init(net); + /* safe for laundromat to run now */ + spin_lock(&nn->client_lock); + nn->client_tracking_active = true; + spin_unlock(&nn->client_lock); if (nn->track_reclaim_completes && nn->reclaim_str_hashtbl_size == 0) goto skip_grace; printk(KERN_INFO "NFSD: starting %lld-second grace period (net %x)\n", @@ -7458,6 +7493,9 @@ nfs4_state_shutdown_net(struct net *net) struct nfsd_net *nn = net_generic(net, nfsd_net_id); cancel_delayed_work_sync(&nn->laundromat_work); + spin_lock(&nn->client_lock); + nn->client_tracking_active = false; + spin_unlock(&nn->client_lock); locks_end_grace(&nn->nfsd4_manager); INIT_LIST_HEAD(&reaplist); diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c index 040340080b3d..e84c8cf8e2c0 100644 --- a/fs/nfsd/nfsctl.c +++ b/fs/nfsd/nfsctl.c @@ -1133,9 +1133,8 @@ static ssize_t write_v4_end_grace(struct file *file, char *buf, size_t size) case 'Y': case 'y': case '1': - if (!nn->nfsd_serv) + if (!nfsd4_force_end_grace(nn)) return -EBUSY; - nfsd4_end_grace(nn); break; default: return -EINVAL; diff --git a/fs/nfsd/state.h b/fs/nfsd/state.h index 9eae11a9d21c..0e4f98b41364 100644 --- a/fs/nfsd/state.h +++ b/fs/nfsd/state.h @@ -683,7 +683,7 @@ static inline void get_nfs4_file(struct nfs4_file *fi) struct nfsd_file *find_any_file(struct nfs4_file *f); /* grace period management */ -void nfsd4_end_grace(struct nfsd_net *nn); +bool nfsd4_force_end_grace(struct nfsd_net *nn); /* nfs4recover operations */ extern int nfsd4_client_tracking_init(struct net *net); -- 2.52.0

1 0

[PATCH OLK-6.6 00/22] arm64/sysreg: Add definition for FPMR
by Qinxin Xia 10 Apr '26

10 Apr '26

From: Hongye Lin <linhongye(a)h-partners.com> mainline inclusion from mainline-v6.8-rc1 commit e3a649ecf8b9253cb1d05ceb085544472b06446f category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/8904 CVE: NA Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/comm… ---------------------------------------------------------------------- DDI0601 2023-09 defines a new sysrem register FPMR (Floating Point Mode Register) which configures the new FP8 features. Add a definition of this register. Qinxin Xia (18): arm64/sysreg: Add definition for ID_AA64PFR2_EL1 arm64/sysreg: Add definition for ID_AA64ISAR3_EL1 arm64/sysreg: Add definition for ID_AA64FPFR0_EL1 arm64/sysreg: Add definition for FPMR arm64/sysreg: Add EnFPM field for SCTLR_EL1 and HCRX_EL2 arm64/sysreg: Add LUT field for ID_AA64ISAR2_EL1 arm64/cpufeature: Hook new identification registers up to cpufeature arm64/fpsimd: Support FEAT_FPMR arm64/hwcap: Define hwcaps for 2023 DPISA features kselftest/arm64: Add basic FPMR test kselftest/arm64: Handle FPMR context in generic signal frame parser kselftest/arm64: Add 2023 DPISA hwcap test coverage arm64: Kconfig: Detect toolchain support for LSUI arm64: cpufeature: add FEAT_LSUI arm64/signal: Add FPMR signal handling arm64/ptrace: Expose FPMR via ptrace Fix kabi for thread struct with FPMR Add support "arm64.nocnp" for start option Yifan Wu (4): arm64/hwcap: Add support for FEAT_CMPBR kselftest/arm64: Add FEAT_CMPBR to the hwcap selftest arm64/sysreg: Update ID_AA64ISAR2_EL1 for FEAT_CMPBR selftest/arm64: Fix sve2p1_sigill() to hwcap test Documentation/arch/arm64/elf_hwcaps.rst | 30 +++++ arch/arm64/Kconfig | 5 + arch/arm64/include/asm/cpu.h | 3 + arch/arm64/include/asm/cpufeature.h | 6 + arch/arm64/include/asm/fpsimd.h | 2 + arch/arm64/include/asm/hwcap.h | 10 ++ arch/arm64/include/asm/processor.h | 5 + arch/arm64/include/asm/signal_common.h | 16 +++ arch/arm64/include/uapi/asm/hwcap.h | 10 ++ arch/arm64/include/uapi/asm/sigcontext.h | 8 ++ arch/arm64/kernel/cpufeature.c | 70 +++++++++- arch/arm64/kernel/cpuinfo.c | 3 + arch/arm64/kernel/fpsimd.c | 13 ++ arch/arm64/kernel/hwcap_str.h | 10 ++ arch/arm64/kernel/idreg-override.c | 11 ++ arch/arm64/kernel/ptrace.c | 42 ++++++ arch/arm64/kernel/signal.c | 46 +++++++ arch/arm64/tools/cpucaps | 2 + arch/arm64/tools/sysreg | 122 +++++++++++++++++- include/uapi/linux/elf.h | 1 + tools/testing/selftests/arm64/abi/hwcap.c | 120 ++++++++++++++++- .../testing/selftests/arm64/signal/.gitignore | 1 + .../arm64/signal/testcases/fpmr_siginfo.c | 82 ++++++++++++ .../arm64/signal/testcases/testcases.c | 8 ++ .../arm64/signal/testcases/testcases.h | 1 + 25 files changed, 621 insertions(+), 6 deletions(-) create mode 100644 tools/testing/selftests/arm64/signal/testcases/fpmr_siginfo.c -- 2.33.0

2 23

[PATCH OLK-6.6 00/23] OLK-6.6 mainline or LTS patches sync
by Zicheng Qu 10 Apr '26

10 Apr '26

Chen Yu (1): sched/eevdf: Fix wakeup-preempt by checking cfs_rq->nr_running Ingo Molnar (2): sched/fair: Rename cfs_rq::avg_load to cfs_rq::sum_weight sched/fair: Rename cfs_rq::avg_vruntime to ::sum_w_vruntime, and helper functions Peter Zijlstra (10): sched/fair: Fix zero_vruntime tracking sched/fair: Fix EEVDF entity placement bug causing scheduling lag sched/fair: Adhere to place_entity() constraints sched: Unify runtime accounting across classes sched: Remove vruntime from trace_sched_stat_runtime() sched: Unify more update_curr*() sched/eevdf: Allow shorter slices to wakeup-preempt sched/fair: Only set slice protection at pick time sched/fair: Fix zero_vruntime tracking fix sched/debug: Fix avg_vruntime() usage Vincent Guittot (2): sched/fair: Use protect_slice() instead of direct comparison sched/fair: Fix NO_RUN_TO_PARITY case Wang Tao (1): sched/eevdf: Update se->vprot in reweight_entity() Zhang Qiao (1): sched: Fix struct sched_entity kabi broken Zicheng Qu (5): sched: Re-evaluate scheduling when migrating queued tasks out of throttled cgroups sched: Fix kabi breakage of struct cfs_rq for sum_weight sched: Fix kabi breakage of struct cfs_rq for sum_w_vruntime sched/eevdf: Disable shorter slices to wakeup-preempt sched/fair: Fix vruntime drift by preventing double lag scaling during reweight zihan zhou (1): sched: Cancel the slice protection of the idle entity include/linux/sched.h | 15 +- include/trace/events/sched.h | 15 +- kernel/sched/core.c | 4 +- kernel/sched/deadline.c | 15 +- kernel/sched/debug.c | 4 +- kernel/sched/fair.c | 477 +++++++++++++++++++---------------- kernel/sched/features.h | 5 + kernel/sched/rt.c | 15 +- kernel/sched/sched.h | 18 +- kernel/sched/stop_task.c | 13 +- 10 files changed, 304 insertions(+), 277 deletions(-) -- 2.34.1

2 24

[PATCH OLK-6.6 0/6] arm64: tlbflush: Optimize flush_tlb_mm() by using TLBID
by Zeng Heng 10 Apr '26

10 Apr '26

Jinjiang Tu (3): arm64: mm: hardcode domain info and add get_domain_cpumask() arm64: mm: Track CPUs that a task has run on for TLBID optimization arm64: tlbflush: Optimize flush_tlb_mm() by using TLBID Marc Zyngier (2): arm64: cpufeature: Add ID_AA64MMFR4_EL1 handling arm64: sysreg: Add layout for ID_AA64MMFR4_EL1 Zeng Heng (1): arm64: cpufeature: Add TLBID (Domain-based TLB Invalidation) detection arch/arm64/Kconfig | 12 ++ arch/arm64/include/asm/cpu.h | 1 + arch/arm64/include/asm/cpufeature.h | 6 + arch/arm64/include/asm/mmu_context.h | 3 + arch/arm64/include/asm/tlbflush.h | 74 ++++++++- arch/arm64/kernel/cpufeature.c | 17 ++ arch/arm64/kernel/cpuinfo.c | 1 + arch/arm64/mm/context.c | 224 ++++++++++++++++++++++++++- arch/arm64/tools/cpucaps | 1 + arch/arm64/tools/sysreg | 41 +++++ 10 files changed, 375 insertions(+), 5 deletions(-) -- 2.25.1

3 8

[PATCH OLK-6.6 00/14] Introduce dmem cgroup
by Liu Kai 09 Apr '26

09 Apr '26

Introduce dmem cgroup Chen Ridong (3): cgroup/dmem: fix NULL pointer dereference when setting max cgroup/dmem: avoid rcu warning when unregister region cgroup/dmem: avoid pool UAF Friedrich Vock (1): cgroup/dmem: Don't open-code css_for_each_descendant_pre Geert Uytterhoeven (1): cgroup/rdma: Drop bogus PAGE_COUNTER select Jiapeng Chong (1): kernel/cgroup: Remove the unused variable climit Liu Kai (2): cgroup/dmem: reuse SUBSYS for dmem and devices to preserve KABI dmem: enable CONFIG_CGROUP_DMEM in arm64/x86 defconfig Maarten Lankhorst (2): mm/page_counter: move calculating protection values to page_counter kernel/cgroup: Add "dmem" memory accounting cgroup Maxime Ripard (3): cgroup/dmem: Select PAGE_COUNTER cgroup/dmem: Fix parameters documentation doc/cgroup: Fix title underline length Roman Gushchin (1): mm: page_counters: put page_counter_calculate_protection() under CONFIG_MEMCG Documentation/admin-guide/cgroup-v2.rst | 58 +- Documentation/core-api/cgroup.rst | 9 + Documentation/core-api/index.rst | 1 + Documentation/gpu/drm-compute.rst | 54 ++ arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + include/linux/cgroup_dmem.h | 71 ++ include/linux/cgroup_subsys.h | 4 +- include/linux/device_cgroup.h | 20 + include/linux/page_counter.h | 10 + init/Kconfig | 10 + kernel/cgroup/Makefile | 1 + kernel/cgroup/dmem.c | 1025 +++++++++++++++++++++++ mm/memcontrol.c | 154 +--- mm/page_counter.c | 175 ++++ security/device_cgroup.c | 63 +- 16 files changed, 1492 insertions(+), 165 deletions(-) create mode 100644 Documentation/core-api/cgroup.rst create mode 100644 Documentation/gpu/drm-compute.rst create mode 100644 include/linux/cgroup_dmem.h create mode 100644 kernel/cgroup/dmem.c -- 2.34.1

2 15

[PATCH OLK-6.6] serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN
by Gu Bowen 09 Apr '26

09 Apr '26

From: Jiayuan Chen <jiayuan.chen(a)shopee.com> mainline inclusion from mainline-v7.0-rc5 commit 455ce986fa356ff43a43c0d363ba95fa152f21d5 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14111 CVE: CVE-2026-23472 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- uart_write_room() and uart_write() behave inconsistently when xmit_buf is NULL (which happens for PORT_UNKNOWN ports that were never properly initialized): - uart_write_room() returns kfifo_avail() which can be > 0 - uart_write() checks xmit_buf and returns 0 if NULL This inconsistency causes an infinite loop in drivers that rely on tty_write_room() to determine if they can write: while (tty_write_room(tty) > 0) { written = tty->ops->write(...); // written is always 0, loop never exits } For example, caif_serial's handle_tx() enters an infinite loop when used with PORT_UNKNOWN serial ports, causing system hangs. Fix by making uart_write_room() also check xmit_buf and return 0 if it's NULL, consistent with uart_write(). Reproducer: https://gist.github.com/mrpre/d9a694cc0e19828ee3bc3b37983fde13 Signed-off-by: Jiayuan Chen <jiayuan.chen(a)shopee.com> Cc: stable <stable(a)kernel.org> Link: https://patch.msgid.link/20260204074327.226165-1-jiayuan.chen@linux.dev Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/tty/serial/serial_core.c [Context conflicts.] Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- drivers/tty/serial/serial_core.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c index 7ce9c87750da..bc3241d47665 100644 --- a/drivers/tty/serial/serial_core.c +++ b/drivers/tty/serial/serial_core.c @@ -643,7 +643,10 @@ static unsigned int uart_write_room(struct tty_struct *tty) unsigned int ret; port = uart_port_lock(state, flags); - ret = uart_circ_chars_free(&state->xmit); + if (!state->xmit.buf) + ret = 0; + else + ret = uart_circ_chars_free(&state->xmit); uart_port_unlock(port, flags); return ret; } -- 2.43.0

2 1

[PATCH OLK-6.6 00/13] Introduce dmem cgroup
by Liu Kai 09 Apr '26

09 Apr '26

Introduce dmem cgroup Chen Ridong (3): cgroup/dmem: fix NULL pointer dereference when setting max cgroup/dmem: avoid rcu warning when unregister region cgroup/dmem: avoid pool UAF Friedrich Vock (1): cgroup/dmem: Don't open-code css_for_each_descendant_pre Geert Uytterhoeven (1): cgroup/rdma: Drop bogus PAGE_COUNTER select Jiapeng Chong (1): kernel/cgroup: Remove the unused variable climit Liu Kai (1): cgroup/dmem: reuse SUBSYS for dmem and devices to preserve KABI Maarten Lankhorst (2): mm/page_counter: move calculating protection values to page_counter kernel/cgroup: Add "dmem" memory accounting cgroup Maxime Ripard (3): cgroup/dmem: Select PAGE_COUNTER cgroup/dmem: Fix parameters documentation doc/cgroup: Fix title underline length Roman Gushchin (1): mm: page_counters: put page_counter_calculate_protection() under CONFIG_MEMCG Documentation/admin-guide/cgroup-v2.rst | 58 +- Documentation/core-api/cgroup.rst | 9 + Documentation/core-api/index.rst | 1 + Documentation/gpu/drm-compute.rst | 54 ++ include/linux/cgroup_dmem.h | 71 ++ include/linux/cgroup_subsys.h | 4 +- include/linux/device_cgroup.h | 20 + include/linux/page_counter.h | 10 + init/Kconfig | 10 + kernel/cgroup/Makefile | 1 + kernel/cgroup/dmem.c | 1025 +++++++++++++++++++++++ mm/memcontrol.c | 154 +--- mm/page_counter.c | 175 ++++ security/device_cgroup.c | 63 +- 14 files changed, 1490 insertions(+), 165 deletions(-) create mode 100644 Documentation/core-api/cgroup.rst create mode 100644 Documentation/gpu/drm-compute.rst create mode 100644 include/linux/cgroup_dmem.h create mode 100644 kernel/cgroup/dmem.c -- 2.34.1

2 14

[PATCH OLK-6.6] spi: fix statistics allocation
by Lin Ruifeng 09 Apr '26

09 Apr '26

From: Johan Hovold <johan(a)kernel.org> stable inclusion from stable-v6.6.130 commit f13100b1f5f111989f0750540a795fdef47492af category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14114 CVE: CVE-2026-23475 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit dee0774bbb2abb172e9069ce5ffef579b12b3ae9 upstream. The controller per-cpu statistics is not allocated until after the controller has been registered with driver core, which leaves a window where accessing the sysfs attributes can trigger a NULL-pointer dereference. Fix this by moving the statistics allocation to controller allocation while tying its lifetime to that of the controller (rather than using implicit devres). Fixes: 6598b91b5ac3 ("spi: spi.c: Convert statistics to per-cpu u64_stats_t") Cc: stable(a)vger.kernel.org # 6.0 Cc: David Jander <david(a)protonic.nl> Signed-off-by: Johan Hovold <johan(a)kernel.org> Link: https://patch.msgid.link/20260312151817.32100-3-johan@kernel.org Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/spi/spi.c | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c index 66f694457a8b..2ca4ea45e3b2 100644 --- a/drivers/spi/spi.c +++ b/drivers/spi/spi.c @@ -2773,6 +2773,8 @@ static void spi_controller_release(struct device *dev) struct spi_controller *ctlr; ctlr = container_of(dev, struct spi_controller, dev); + + free_percpu(ctlr->pcpu_statistics); kfree(ctlr); } @@ -2924,6 +2926,12 @@ struct spi_controller *__spi_alloc_controller(struct device *dev, if (!ctlr) return NULL; + ctlr->pcpu_statistics = spi_alloc_pcpu_stats(NULL); + if (!ctlr->pcpu_statistics) { + kfree(ctlr); + return NULL; + } + device_initialize(&ctlr->dev); INIT_LIST_HEAD(&ctlr->queue); spin_lock_init(&ctlr->queue_lock); @@ -3212,13 +3220,6 @@ int spi_register_controller(struct spi_controller *ctlr) if (status) goto del_ctrl; } - /* Add statistics */ - ctlr->pcpu_statistics = spi_alloc_pcpu_stats(dev); - if (!ctlr->pcpu_statistics) { - dev_err(dev, "Error allocating per-cpu statistics\n"); - status = -ENOMEM; - goto destroy_queue; - } mutex_lock(&board_lock); list_add_tail(&ctlr->list, &spi_controller_list); @@ -3231,8 +3232,6 @@ int spi_register_controller(struct spi_controller *ctlr) acpi_register_spi_devices(ctlr); return status; -destroy_queue: - spi_destroy_queue(ctlr); del_ctrl: device_del(&ctlr->dev); free_bus_id: -- 2.43.0

2 1

[PATCH OLK-6.6] netfilter: nf_tables: Fix null ptr dereference of nft_setelem_remove
by Dong Chenchen 09 Apr '26

09 Apr '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14141 CVE: CVE-2026-23272 -------------------------------- The initialization process of elem is missing in nft_add_set_elem(), which lead to null-ptr-deref of nft_setelem_remove as below. Unable to handle kernel NULL pointer dereference at virtual address 0000000000000014 Call trace: nft_setelem_remove+0x28/0xe0 [nf_tables] __nf_tables_abort+0x5f8/0xbe8 [nf_tables] nf_tables_abort+0x64/0x1c8 [nf_tables] nfnetlink_rcv_batch+0x2d8/0x850 [nfnetlink] nfnetlink_rcv+0x168/0x1a8 [nfnetlink] netlink_unicast_kernel+0x7c/0x160 netlink_unicast+0x1ac/0x250 netlink_sendmsg+0x21c/0x458 __sock_sendmsg+0x4c/0xa8 ____sys_sendmsg+0x280/0x300 ___sys_sendmsg+0x8c/0xf8 __sys_sendmsg+0x74/0xe0 __arm64_sys_sendmsg+0x2c/0x40 invoke_syscall+0x50/0x128 el0_svc_common.constprop.0+0xc8/0xf0 do_el0_svc+0x48/0x78 el0_slow_syscall+0x44/0x1b8 el0t_64_sync_handler+0x100/0x130 el0t_64_sync+0x188/0x190 Initialize elem to fix it. Fixes: e7a6bffde0fe ("netfilter: nf_tables: unconditionally bump set->nelems before insertion") Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/nf_tables_api.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index d8057efc777d..ef4f6f8c7a3f 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -7144,6 +7144,7 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, goto err_element_clash; } + nft_trans_elem(trans) = elem; nft_trans_commit_list_add_tail(ctx->net, trans); return set_full ? -ENFILE : 0; -- 2.25.1

2 1

[PATCH OLK-6.6] wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure
by Yi Yang 09 Apr '26

09 Apr '26

From: Felix Fietkau <nbd(a)nbd.name> mainline inclusion from mainline-v7.0-rc5 commit d5ad6ab61cbd89afdb60881f6274f74328af3ee9 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14084 CVE: CVE-2026-23444 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ieee80211_tx_prepare_skb() has three error paths, but only two of them free the skb. The first error path (ieee80211_tx_prepare() returning TX_DROP) does not free it, while invoke_tx_handlers() failure and the fragmentation check both do. Add kfree_skb() to the first error path so all three are consistent, and remove the now-redundant frees in callers (ath9k, mt76, mac80211_hwsim) to avoid double-free. Document the skb ownership guarantee in the function's kdoc. Signed-off-by: Felix Fietkau <nbd(a)nbd.name> Link: https://patch.msgid.link/20260314065455.2462900-1-nbd@nbd.name Fixes: 06be6b149f7e ("mac80211: add ieee80211_tx_prepare_skb() helper function") Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Conflicts: drivers/net/wireless/mediatek/mt76/scan.c [Commit 31083e38548f ("ifi: mt76: add code for emulating hardware scanning") was not merged. No problematic function is introduced.] include/net/mac80211.h [Commit 0e9824e0d59b2 ("wifi: mac80211: Add missing return value documentation") was not merged. Context conflicts.] Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/net/wireless/ath/ath9k/channel.c | 6 ++---- drivers/net/wireless/virtual/mac80211_hwsim.c | 1 - include/net/mac80211.h | 4 ++++ net/mac80211/tx.c | 4 +++- 4 files changed, 9 insertions(+), 6 deletions(-) diff --git a/drivers/net/wireless/ath/ath9k/channel.c b/drivers/net/wireless/ath/ath9k/channel.c index 571062f2e82a..ba8ec5112afe 100644 --- a/drivers/net/wireless/ath/ath9k/channel.c +++ b/drivers/net/wireless/ath/ath9k/channel.c @@ -1011,7 +1011,7 @@ static void ath_scan_send_probe(struct ath_softc *sc, skb_set_queue_mapping(skb, IEEE80211_AC_VO); if (!ieee80211_tx_prepare_skb(sc->hw, vif, skb, band, NULL)) - goto error; + return; txctl.txq = sc->tx.txq_map[IEEE80211_AC_VO]; if (ath_tx_start(sc->hw, skb, &txctl)) @@ -1124,10 +1124,8 @@ ath_chanctx_send_vif_ps_frame(struct ath_softc *sc, struct ath_vif *avp, skb->priority = 7; skb_set_queue_mapping(skb, IEEE80211_AC_VO); - if (!ieee80211_tx_prepare_skb(sc->hw, vif, skb, band, &sta)) { - dev_kfree_skb_any(skb); + if (!ieee80211_tx_prepare_skb(sc->hw, vif, skb, band, &sta)) return false; - } break; default: return false; diff --git a/drivers/net/wireless/virtual/mac80211_hwsim.c b/drivers/net/wireless/virtual/mac80211_hwsim.c index 1214e7dcc812..bf12ff0ab06a 100644 --- a/drivers/net/wireless/virtual/mac80211_hwsim.c +++ b/drivers/net/wireless/virtual/mac80211_hwsim.c @@ -2892,7 +2892,6 @@ static void hw_scan_work(struct work_struct *work) hwsim->tmp_chan->band, NULL)) { rcu_read_unlock(); - kfree_skb(probe); continue; } diff --git a/include/net/mac80211.h b/include/net/mac80211.h index adaa1b2323d2..85d785060e76 100644 --- a/include/net/mac80211.h +++ b/include/net/mac80211.h @@ -7032,6 +7032,10 @@ void ieee80211_report_wowlan_wakeup(struct ieee80211_vif *vif, * @band: the band to transmit on * @sta: optional pointer to get the station to send the frame to * + * Return: %true if the skb was prepared, %false otherwise. + * On failure, the skb is freed by this function; callers must not + * free it again. + * * Note: must be called under RCU lock */ bool ieee80211_tx_prepare_skb(struct ieee80211_hw *hw, diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c index 7eddcb6f9645..2a708132320c 100644 --- a/net/mac80211/tx.c +++ b/net/mac80211/tx.c @@ -1911,8 +1911,10 @@ bool ieee80211_tx_prepare_skb(struct ieee80211_hw *hw, struct ieee80211_tx_data tx; struct sk_buff *skb2; - if (ieee80211_tx_prepare(sdata, &tx, NULL, skb) == TX_DROP) + if (ieee80211_tx_prepare(sdata, &tx, NULL, skb) == TX_DROP) { + kfree_skb(skb); return false; + } info->band = band; info->control.vif = vif; -- 2.25.1

2 1