- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] xfs: remove xfs_attr_leaf_hasname
by Long Li 25 Jun '26

25 Jun '26

From: Christoph Hellwig <hch(a)lst.de> mainline inclusion from mainline-v6.19-rc6 commit 3a65ea768b8094e4699e72f9ab420eb9e0f3f568 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14700 CVE: CVE-2026-43153 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The calling convention of xfs_attr_leaf_hasname() is problematic, because it returns a NULL buffer when xfs_attr3_leaf_read fails, a valid buffer when xfs_attr3_leaf_lookup_int returns -ENOATTR or -EEXIST, and a non-NULL buffer pointer for an already released buffer when xfs_attr3_leaf_lookup_int fails with other error values. Fix this by simply open coding xfs_attr_leaf_hasname in the callers, so that the buffer release code is done by each caller of xfs_attr3_leaf_read. Cc: stable(a)vger.kernel.org # v5.19+ Fixes: 07120f1abdff ("xfs: Add xfs_has_attr and subroutines") Reported-by: Mark Tinguely <mark.tinguely(a)oracle.com> Signed-off-by: Christoph Hellwig <hch(a)lst.de> Reviewed-by: Darrick J. Wong <djwong(a)kernel.org> Signed-off-by: Carlos Maiolino <cem(a)kernel.org> Conflicts: fs/xfs/libxfs/xfs_attr.c [Context config] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/xfs/libxfs/xfs_attr.c | 83 +++++++++++++++------------------------- 1 file changed, 31 insertions(+), 52 deletions(-) diff --git a/fs/xfs/libxfs/xfs_attr.c b/fs/xfs/libxfs/xfs_attr.c index 13213c8b1285..9045084a4361 100644 --- a/fs/xfs/libxfs/xfs_attr.c +++ b/fs/xfs/libxfs/xfs_attr.c @@ -46,7 +46,6 @@ STATIC int xfs_attr_shortform_addname(xfs_da_args_t *args); STATIC int xfs_attr_leaf_get(xfs_da_args_t *args); STATIC int xfs_attr_leaf_addname(xfs_da_args_t *args); STATIC int xfs_attr_leaf_removename(xfs_da_args_t *args); -STATIC int xfs_attr_leaf_hasname(struct xfs_da_args *args, struct xfs_buf **bp); /* * Internal routines when attribute list is more than one block. @@ -349,11 +348,12 @@ xfs_attr_lookup( } if (xfs_bmap_one_block(dp, XFS_ATTR_FORK)) { - error = xfs_attr_leaf_hasname(args, &bp); - - if (bp) - xfs_trans_brelse(args->trans, bp); - + error = xfs_attr3_leaf_read(args->trans, args->dp, + 0, &bp); + if (error) + return error; + error = xfs_attr3_leaf_lookup_int(bp, args); + xfs_trans_brelse(args->trans, bp); return error; } @@ -624,9 +624,13 @@ xfs_attr_leaf_try_add( * Look up the given attribute in the leaf block. Figure out if * the given flags produce an error or call for an atomic rename. */ - retval = xfs_attr_leaf_hasname(args, &bp); - if (retval != -ENOATTR && retval != -EEXIST) + retval = xfs_attr3_leaf_read(args->trans, args->dp, 0, &bp); + if (retval) return retval; + + retval = xfs_attr3_leaf_lookup_int(bp, args); + if (retval != -ENOATTR && retval != -EEXIST) + goto out_brelse; if (retval == -ENOATTR && (args->attr_flags & XATTR_REPLACE)) goto out_brelse; if (retval == -EEXIST) { @@ -768,27 +772,6 @@ xfs_attr_leaf_addname( return error; } -/* - * Return EEXIST if attr is found, or ENOATTR if not - */ -STATIC int -xfs_attr_leaf_hasname( - struct xfs_da_args *args, - struct xfs_buf **bp) -{ - int error = 0; - - error = xfs_attr3_leaf_read(args->trans, args->dp, 0, bp); - if (error) - return error; - - error = xfs_attr3_leaf_lookup_int(*bp, args); - if (error != -ENOATTR && error != -EEXIST) - xfs_trans_brelse(args->trans, *bp); - - return error; -} - /* * Remove a name from the leaf attribute list structure * @@ -799,24 +782,23 @@ STATIC int xfs_attr_leaf_removename( struct xfs_da_args *args) { - struct xfs_inode *dp; - struct xfs_buf *bp; + struct xfs_inode *dp = args->dp; int error, forkoff; + struct xfs_buf *bp; trace_xfs_attr_leaf_removename(args); - /* - * Remove the attribute. - */ - dp = args->dp; - error = xfs_attr_leaf_hasname(args, &bp); - - if (error == -ENOATTR) { + error = xfs_attr3_leaf_read(args->trans, args->dp, 0, &bp); + if (error) + return error; + error = xfs_attr3_leaf_lookup_int(bp, args); + if (error != -EEXIST) { xfs_trans_brelse(args->trans, bp); + if (error == -ENOATTR) + return 0; return error; - } else if (error != -EEXIST) - return error; + } xfs_attr3_leaf_remove(bp, args); @@ -840,23 +822,20 @@ xfs_attr_leaf_removename( * Returns 0 on successful retrieval, otherwise an error. */ STATIC int -xfs_attr_leaf_get(xfs_da_args_t *args) +xfs_attr_leaf_get( + struct xfs_da_args *args) { - struct xfs_buf *bp; - int error; + struct xfs_buf *bp; + int error; trace_xfs_attr_leaf_get(args); - error = xfs_attr_leaf_hasname(args, &bp); - - if (error == -ENOATTR) { - xfs_trans_brelse(args->trans, bp); + error = xfs_attr3_leaf_read(args->trans, args->dp, 0, &bp); + if (error) return error; - } else if (error != -EEXIST) - return error; - - - error = xfs_attr3_leaf_getvalue(bp, args); + error = xfs_attr3_leaf_lookup_int(bp, args); + if (error == -EEXIST) + error = xfs_attr3_leaf_getvalue(bp, args); xfs_trans_brelse(args->trans, bp); return error; } -- 2.52.0

2 1

[PATCH OLK-5.10] xfs: fix undersized l_iclog_roundoff values
by Long Li 25 Jun '26

25 Jun '26

From: "Darrick J. Wong" <djwong(a)kernel.org> mainline inclusion from mainline-v7.0-rc1 commit 52a8a1ba883defbfe3200baa22cf4cd21985d51a category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14924 CVE: CVE-2026-43365 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If the superblock doesn't list a log stripe unit, we set the incore log roundoff value to 512. This leads to corrupt logs and unmountable filesystems in generic/617 on a disk with 4k physical sectors... XFS (sda1): Mounting V5 Filesystem ff3121ca-26e6-4b77-b742-aaff9a449e1c XFS (sda1): Torn write (CRC failure) detected at log block 0x318e. Truncating head block from 0x3197. XFS (sda1): failed to locate log tail XFS (sda1): log mount/recovery failed: error -74 XFS (sda1): log mount failed XFS (sda1): Mounting V5 Filesystem ff3121ca-26e6-4b77-b742-aaff9a449e1c XFS (sda1): Ending clean mount ...on the current xfsprogs for-next which has a broken mkfs. xfs_info shows this... meta-data=/dev/sda1 isize=512 agcount=4, agsize=644992 blks = sectsz=4096 attr=2, projid32bit=1 = crc=1 finobt=1, sparse=1, rmapbt=1 = reflink=1 bigtime=1 inobtcount=1 nrext64=1 = exchange=1 metadir=1 data = bsize=4096 blocks=2579968, imaxpct=25 = sunit=0 swidth=0 blks naming =version 2 bsize=4096 ascii-ci=0, ftype=1, parent=1 log =internal log bsize=4096 blocks=16384, version=2 = sectsz=4096 sunit=0 blks, lazy-count=1 realtime =none extsz=4096 blocks=0, rtextents=0 = rgcount=0 rgsize=268435456 extents = zoned=0 start=0 reserved=0 ...observe that the log section has sectsz=4096 sunit=0, which means that the roundoff factor is 512, not 4096 as you'd expect. We should fix mkfs not to generate broken filesystems, but anyone can fuzz the ondisk superblock so we should be more cautious. I think the inadequate logic predates commit a6a65fef5ef8d0, but that's clearly going to require a different backport. Cc: stable(a)vger.kernel.org # v5.14 Fixes: a6a65fef5ef8d0 ("xfs: log stripe roundoff is a property of the log") Signed-off-by: Darrick J. Wong <djwong(a)kernel.org> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Carlos Maiolino <cem(a)kernel.org> Conflicts: fs/xfs/xfs_log.c [context conflicts] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/xfs/xfs_log.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c index f8cf48d3aaf7..e25151ec9de2 100644 --- a/fs/xfs/xfs_log.c +++ b/fs/xfs/xfs_log.c @@ -1407,6 +1407,8 @@ xlog_alloc_log( if (xfs_has_logv2(mp) && mp->m_sb.sb_logsunit > 1) log->l_iclog_roundoff = mp->m_sb.sb_logsunit; + else if (mp->m_sb.sb_logsectsize > 0) + log->l_iclog_roundoff = mp->m_sb.sb_logsectsize; else log->l_iclog_roundoff = BBSIZE; -- 2.52.0

2 1

[PATCH OLK-5.10] fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath
by Long Li 25 Jun '26

25 Jun '26

From: Fredric Cover <FredTheDude(a)proton.me> mainline inclusion from mainline-v7.0-rc6 commit 78ec5bf2f589ec7fd8f169394bfeca541b077317 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14608 CVE: CVE-2026-43112 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When cifs_sanitize_prepath is called with an empty string or a string containing only delimiters (e.g., "/"), the current logic attempts to check *(cursor2 - 1) before cursor2 has advanced. This results in an out-of-bounds read. This patch adds an early exit check after stripping prepended delimiters. If no path content remains, the function returns NULL. The bug was identified via manual audit and verified using a standalone test case compiled with AddressSanitizer, which triggered a SEGV on affected inputs. Signed-off-by: Fredric Cover <FredTheDude(a)proton.me> Reviewed-by: Henrique Carvalho <[2]henrique.carvalho(a)suse.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/cifs/connect.c fs/smb/client/fs_context.c [fs/cifs move to fs/smb/client] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/cifs/connect.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c index a69f6f1f31bc..adfc235b7c06 100644 --- a/fs/cifs/connect.c +++ b/fs/cifs/connect.c @@ -1351,6 +1351,10 @@ static char *sanitize_path(char *path) while (IS_DELIM(*cursor1)) cursor1++; + /* exit in case of only delimiters */ + if (!*cursor1) + return NULL; + /* copy the first letter */ *cursor2 = *cursor1; -- 2.52.0

2 1

[PATCH OLK-5.10] vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write
by Yi Yang 25 Jun '26

25 Jun '26

mainline inclusion from mainline-v7.2-rc1 commit a287620312dc6dcb9a093417a0e589bf30fcf38a category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9459 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- A KASAN null-ptr-deref was observed in vcs_notifier(): BUG: KASAN: null-ptr-deref in vcs_notifier+0x98/0x130 Read of size 2 at addr qmp_cmd_name: qmp_capabilities, arguments: {} The issue is a race condition in vcs_write(). When the console_lock is temporarily dropped (to copy data from userspace), the vc_data pointer obtained from vcs_vc() may become stale. After re-acquiring the lock, vcs_vc() is called again to re-validate the pointer. If the vc has been deallocated in the meantime, vcs_vc() returns NULL, and the while loop breaks (with written > 0). However, after the loop, vcs_scr_updated(vc) is still called with the now-NULL vc pointer, leading to a null pointer dereference in the notifier chain (vcs_notifier dereferences param->vc). Fix this by adding a NULL check for vc before calling vcs_scr_updated(). Fixes: 8fb9ea65c9d1 ("vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF") Cc: stable(a)vger.kernel.org Signed-off-by: Yi Yang <yiyang13(a)huawei.com> Reviewed-by: Jiri Slaby <jirislaby(a)kernel.org> Link: https://patch.msgid.link/20260604060734.2914976-1-yiyang13@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/tty/vt/vc_screen.c [Context conflicts.] Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/tty/vt/vc_screen.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/tty/vt/vc_screen.c b/drivers/tty/vt/vc_screen.c index 01c96537fa36..27b44dc12385 100644 --- a/drivers/tty/vt/vc_screen.c +++ b/drivers/tty/vt/vc_screen.c @@ -699,7 +699,7 @@ vcs_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos) } *ppos += written; ret = written; - if (written) + if (written && vc) vcs_scr_updated(vc); unlock_out: -- 2.25.1

2 1

[PATCH OLK-6.6] vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write
by Yi Yang 25 Jun '26

25 Jun '26

mainline inclusion from mainline-v7.2-rc1 commit a287620312dc6dcb9a093417a0e589bf30fcf38a category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9459 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- A KASAN null-ptr-deref was observed in vcs_notifier(): BUG: KASAN: null-ptr-deref in vcs_notifier+0x98/0x130 Read of size 2 at addr qmp_cmd_name: qmp_capabilities, arguments: {} The issue is a race condition in vcs_write(). When the console_lock is temporarily dropped (to copy data from userspace), the vc_data pointer obtained from vcs_vc() may become stale. After re-acquiring the lock, vcs_vc() is called again to re-validate the pointer. If the vc has been deallocated in the meantime, vcs_vc() returns NULL, and the while loop breaks (with written > 0). However, after the loop, vcs_scr_updated(vc) is still called with the now-NULL vc pointer, leading to a null pointer dereference in the notifier chain (vcs_notifier dereferences param->vc). Fix this by adding a NULL check for vc before calling vcs_scr_updated(). Fixes: 8fb9ea65c9d1 ("vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF") Cc: stable(a)vger.kernel.org Signed-off-by: Yi Yang <yiyang13(a)huawei.com> Reviewed-by: Jiri Slaby <jirislaby(a)kernel.org> Link: https://patch.msgid.link/20260604060734.2914976-1-yiyang13@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/tty/vt/vc_screen.c [Context conflicts.] Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/tty/vt/vc_screen.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/tty/vt/vc_screen.c b/drivers/tty/vt/vc_screen.c index 829c4be66f3b..5c417b6426bb 100644 --- a/drivers/tty/vt/vc_screen.c +++ b/drivers/tty/vt/vc_screen.c @@ -699,7 +699,7 @@ vcs_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos) } *ppos += written; ret = written; - if (written) + if (written && vc) vcs_scr_updated(vc); unlock_out: -- 2.25.1

2 1

[PATCH OLK-6.6 00/15] Fix CVE-2026-45855
by Long Li 24 Jun '26

24 Jun '26

Fix CVE-2026-45855 Damien Le Moal (8): ata: libata: Introduce ata_port_eh_scheduled() ata: libata-scsi: avoid Non-NCQ command starvation ata: libata-eh: correctly handle deferred qc timeouts ata: libata-core: improve tag checks in ata_qc_issue() ata: libata-sata: simplify ata_sas_queuecmd() ata: libata-scsi: simplify ata_scsi_requeue_deferred_qc() ata: libata-scsi: rename and improve ata_qc_done() ata: libata-core: fix cancellation of a port deferred qc work Guenter Roeck (1): ata: libata-eh: Fix detection of deferred qc timeouts Igor Pylypiv (1): ata: libata-scsi: fix requeue of deferred ATA PASS-THROUGH commands Niklas Cassel (5): ata: libata: cancel pending work after clearing deferred_qc ata: libata-scsi: improve readability of ata_scsi_qc_issue() ata: libata-scsi: do not use the deferred QC feature for ATA_DEFER_PORT ata: libata-scsi: do not use the deferred QC feature on PMPs with CBS ata: libata-scsi: do not needlessly defer commands when using PMP with FBS drivers/ata/libata-core.c | 17 ++++- drivers/ata/libata-eh.c | 31 ++++++-- drivers/ata/libata-pmp.c | 18 ++++- drivers/ata/libata-sata.c | 14 ++-- drivers/ata/libata-scsi.c | 146 ++++++++++++++++++++++++++++++++------ drivers/ata/libata.h | 7 ++ drivers/ata/sata_sil24.c | 6 +- include/linux/libata.h | 4 ++ 8 files changed, 205 insertions(+), 38 deletions(-) -- 2.52.0

2 16

openEuler Kernel SIG双周例会
by openEuler conference 24 Jun '26

24 Jun '26

您好！ Kernel 邀请您参加 2026-06-26 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议发起人： LiaoTao_Wave 会议内容： 1. 进展update 2. 议题征集中（新增议题请填报至会议纪要看板）会议链接：https://meeting.huaweicloud.com:36443/#/j/964465751 会议纪要&签到链接：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2026-06-26 14:00 The subject of the conference is openEuler Kernel SIG双周例会 The sponsor of the conference is LiaoTao_Wave Summary: 1. 进展update 2. 议题征集中（新增议题请填报至会议纪要看板） You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/964465751 Add topics at https://etherpad.openeuler.org/p/Kernel-meetings More information: https://www.openeuler.org/en/

1 0

[PATCH OLK-6.6] Revert "block: remove the blk_flush_integrity call in blk_integrity_unregister"
by Zizhi Wo 24 Jun '26

24 Jun '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9468 CVE: NA -------------------------------- This reverts commit 6d7a428c50fb5eb9dc20a45bc26cf428763420c0. Our kernel has not merge e9f5f44ad372 ("block: remove the blk_integrity_profile structure"), So this patch will lead to null-ptr-deref error. Revert it. Fixes: 6d7a428c50fb ("block: remove the blk_flush_integrity call in blk_integrity_unregister") Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- block/blk-integrity.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/block/blk-integrity.c b/block/blk-integrity.c index 5276c556a9df..d4e9b4556d14 100644 --- a/block/blk-integrity.c +++ b/block/blk-integrity.c @@ -394,9 +394,11 @@ void blk_integrity_unregister(struct gendisk *disk) struct blk_integrity *bi = &disk->queue->integrity; if (!bi->profile) return; + /* ensure all bios are off the integrity workqueue */ + blk_flush_integrity(); blk_queue_flag_clear(QUEUE_FLAG_STABLE_WRITES, disk->queue); memset(bi, 0, sizeof(*bi)); } EXPORT_SYMBOL(blk_integrity_unregister); -- 2.52.0

2 1

[PATCH OLK-6.6 v2] netfilter: nf_tables: use list_del_rcu for netlink hooks
by superdcc97＠163.com 23 Jun '26

23 Jun '26

From: Florian Westphal <fw(a)strlen.de> mainline inclusion from mainline-v7.1-rc2 commit f3224ee463f8f6f6ced7dcdf6081add4f8128527 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15588 CVE: CVE-2026-46324 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- nft_netdev_unregister_hooks and __nft_unregister_flowtable_net_hooks need to use list_del_rcu(), this list can be walked by concurrent dumpers. Add a new helper and use it consistently. Fixes: f9a43007d3f7 ("netfilter: nf_tables: double hook unregistration in netns path") Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/nf_tables_api.c [commit 73319a8ee18b ("netfilter: nf_tables: Have a list of nf_hook_ops in nft_hook") introduced the ops_list structure and __nft_netdev_hook_free_rcu() helper which are not present in OLK-6.6. Adapted to use the single hook->ops and existing kfree_rcu()-based nft_netdev_hook_free_rcu() helper instead.] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/nf_tables_api.c | 44 ++++++++++++++--------------------- 1 file changed, 18 insertions(+), 26 deletions(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 919be34ac7a0..34b837976900 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -333,6 +333,12 @@ static void nft_netdev_hook_free_rcu(struct nft_hook *hook) kfree_rcu(hook, rcu); } +static void nft_netdev_hook_unlink_free_rcu(struct nft_hook *hook) +{ + list_del_rcu(&hook->list); + nft_netdev_hook_free_rcu(hook); +} + static void nft_netdev_unregister_hooks(struct net *net, struct list_head *hook_list, bool release_netdev) @@ -341,10 +347,8 @@ static void nft_netdev_unregister_hooks(struct net *net, list_for_each_entry_safe(hook, next, hook_list, list) { nf_unregister_net_hook(net, &hook->ops); - if (release_netdev) { - list_del(&hook->list); - nft_netdev_hook_free_rcu(hook); - } + if (release_netdev) + nft_netdev_hook_unlink_free_rcu(hook); } } @@ -2106,10 +2110,8 @@ void nf_tables_chain_destroy(struct nft_chain *chain) if (nft_base_chain_netdev(table->family, basechain->ops.hooknum)) { list_for_each_entry_safe(hook, next, - &basechain->hook_list, list) { - list_del_rcu(&hook->list); - nft_netdev_hook_free_rcu(hook); - } + &basechain->hook_list, list) + nft_netdev_hook_unlink_free_rcu(hook); } module_put(basechain->type->owner); if (rcu_access_pointer(basechain->stats)) { @@ -2784,6 +2786,7 @@ static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy, list_for_each_entry_safe(h, next, &hook.list, list) { if (unregister) nf_unregister_net_hook(ctx->net, &h->ops); + /* hook.list is on stack, no need for list_del_rcu() */ list_del(&h->list); nft_netdev_hook_free_rcu(h); } @@ -8495,10 +8498,8 @@ static void __nft_unregister_flowtable_net_hooks(struct net *net, nf_unregister_net_hook(net, &hook->ops); flowtable->data.type->setup(&flowtable->data, hook->ops.dev, FLOW_BLOCK_UNBIND); - if (release_netdev) { - list_del(&hook->list); - nft_netdev_hook_free_rcu(hook); - } + if (release_netdev) + nft_netdev_hook_unlink_free_rcu(hook); } } @@ -8557,8 +8558,7 @@ static int nft_register_flowtable_net_hooks(struct net *net, break; nft_unregister_flowtable_hook(net, flowtable, hook); - list_del_rcu(&hook->list); - nft_netdev_hook_free_rcu(hook); + nft_netdev_hook_unlink_free_rcu(hook); } return err; @@ -8568,10 +8568,8 @@ static void nft_hooks_destroy(struct list_head *hook_list) { struct nft_hook *hook, *next; - list_for_each_entry_safe(hook, next, hook_list, list) { - list_del_rcu(&hook->list); - nft_netdev_hook_free_rcu(hook); - } + list_for_each_entry_safe(hook, next, hook_list, list) + nft_netdev_hook_unlink_free_rcu(hook); } static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh, @@ -8655,8 +8653,7 @@ static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh, list_for_each_entry_safe(hook, next, &flowtable_hook.list, list) { if (unregister) nft_unregister_flowtable_hook(ctx->net, flowtable, hook); - list_del_rcu(&hook->list); - nft_netdev_hook_free_rcu(hook); + nft_netdev_hook_unlink_free_rcu(hook); } return err; @@ -9149,13 +9146,8 @@ static void nf_tables_flowtable_notify(struct nft_ctx *ctx, static void nf_tables_flowtable_destroy(struct nft_flowtable *flowtable) { - struct nft_hook *hook, *next; - flowtable->data.type->free(&flowtable->data); - list_for_each_entry_safe(hook, next, &flowtable->hook_list, list) { - list_del_rcu(&hook->list); - nft_netdev_hook_free_rcu(hook); - } + nft_hooks_destroy(&flowtable->hook_list); kfree(flowtable->name); module_put(flowtable->data.type->owner); kfree(flowtable); -- 2.43.0

2 1

[PATCH OLK-6.6 v2 00/25] Fix CVE-2026-45899
by Long Li 23 Jun '26

23 Jun '26

Fix CVE-2026-45899 Baokun Li (9): ext4: add new ext4_ext_path_brelse() helper ext4: get rid of ppath in get_ext_path() ext4: get rid of ppath in ext4_ext_insert_extent() ext4: get rid of ppath in ext4_split_extent_at() ext4: get rid of ppath in ext4_force_split_extent_at() ext4: get rid of ppath in ext4_split_extent() ext4: get rid of ppath in ext4_split_convert_extents() ext4: get rid of ppath in ext4_ext_convert_to_initialized() ext4: get rid of ppath in ext4_ext_handle_unwritten_extents() Dan Carpenter (1): ext4: fix error pointer dereference in ext4_mb_load_buddy_gfp() Jan Kara (1): ext4: always allocate blocks only from groups inode can use Long Li (2): Revert "ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O" Revert "ext4: fix e4b bitmap inconsistency reports" Matthew Wilcox (Oracle) (2): ext4: convert bd_bitmap_page to bd_bitmap_folio ext4: convert bd_buddy_page to bd_buddy_folio Theodore Ts'o (1): ext4: handle wraparound when searching for blocks for indirect mapped blocks Yang Erkun (3): ext4: correct the comments place for EXT4_EXT_MAY_ZEROOUT ext4: rename EXT4_GET_BLOCKS_PRE_IO ext4: cleanup for ext4_map_blocks Yongjian Sun (1): ext4: fix e4b bitmap inconsistency reports Zhang Yi (5): ext4: subdivide EXT4_EXT_DATA_VALID1 ext4: don't zero the entire extent if EXT4_EXT_DATA_PARTIAL_VALID1 ext4: don't set EXT4_GET_BLOCKS_CONVERT when splitting before submitting I/O ext4: drop extent cache after doing PARTIAL_VALID1 zeroout ext4: drop extent cache when splitting extent fails fs/ext4/ext4.h | 28 +- fs/ext4/extents.c | 575 ++++++++++++++++++++---------------- fs/ext4/fast_commit.c | 8 +- fs/ext4/inode.c | 18 +- fs/ext4/mballoc.c | 220 +++++++------- fs/ext4/mballoc.h | 4 +- fs/ext4/migrate.c | 5 +- fs/ext4/move_extent.c | 34 +-- include/trace/events/ext4.h | 2 +- 9 files changed, 489 insertions(+), 405 deletions(-) -- 2.52.0

2 26