- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters
by Xia Fukun 13 Oct '26

13 Oct '26

From: TanZheng <tanzheng(a)kylinos.cn> mainline inclusion from mainline-v7.3-rc1 commit b38f98e176050850f41bb6415f3a71400056623e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19940 CVE: CVE-2026-100075 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When srpt_alloc_rw_ctxs() fails partway through a multi-buffer indirect descriptor, the unwind path destroys RDMA contexts but leaves stale n_rw_ctx and n_rdma values (and a dangling rw_ctxs pointer). Later sq_wr_avail accounting in srpt_queue_response() or srpt_write_pending() can then subtract the wrong number of send queue credits. Reset the counters and clear rw_ctxs after freeing the heap allocation before returning an error. Fixes: b99f8e4d7bcd ("IB/srpt: convert to the generic RDMA READ/WRITE API") Signed-off-by: TanZheng <tanzheng(a)kylinos.cn> Link: https://patch.msgid.link/20260715101550.45345-1-kensanya@163.com Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- drivers/infiniband/ulp/srpt/ib_srpt.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c index 4948d5b446b6..e72e112ebf2e 100644 --- a/drivers/infiniband/ulp/srpt/ib_srpt.c +++ b/drivers/infiniband/ulp/srpt/ib_srpt.c @@ -891,6 +891,7 @@ static int srpt_alloc_rw_ctxs(struct srpt_send_ioctx *ioctx, struct srpt_rdma_ch *ch = ioctx->ch; struct scatterlist *prev = NULL; unsigned prev_nents; + u8 n_rdma, n_rw_ctx; int ret, i; if (nbufs == 1) { @@ -902,6 +903,9 @@ static int srpt_alloc_rw_ctxs(struct srpt_send_ioctx *ioctx, return -ENOMEM; } + n_rw_ctx = ioctx->n_rw_ctx; + n_rdma = ioctx->n_rdma; + for (i = ioctx->n_rw_ctx; i < nbufs; i++, db++) { struct srpt_rw_ctx *ctx = &ioctx->rw_ctxs[i]; u64 remote_addr = be64_to_cpu(db->va); @@ -948,6 +952,9 @@ static int srpt_alloc_rw_ctxs(struct srpt_send_ioctx *ioctx, } if (ioctx->rw_ctxs != &ioctx->s_rw_ctx) kfree(ioctx->rw_ctxs); + ioctx->rw_ctxs = NULL; + ioctx->n_rw_ctx = n_rw_ctx; + ioctx->n_rdma = n_rdma; return ret; } -- 2.34.1

2 1

[PATCH OLK-6.6] mm/huge_memory: fix unconditional pgtable deposit for special huge PMD in copy_huge_pmd()
by Jinjiang Tu 13 Oct '26

13 Oct '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/10116 -------------------------------- In copy_huge_pmd(), the special huge PMD path unconditionally allocates a pgtable and deposits it to the destination PMD. However, the corresponding withdraw in zap_huge_pmd() is guarded by arch_needs_pgtable_deposit(), which returns false on x86 and powerpc64 radix. This asymmetry causes a 4KB pgtable page and an mm->nr_ptes counter increment to leak on every fork+zap cycle of a special huge PMD on those architectures. Guard the deposit in copy_huge_pmd() with the same arch_needs_pgtable_deposit(dst_vma) check, matching what vmf_insert_pfn_pmd() already does at insertion time and what zap_huge_pmd() does at teardown. Fixes: 923e224a1246 ("mm: introduce remap_pfn_range_try_pmd() for PMD-level hugepage mapping") Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- mm/huge_memory.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/mm/huge_memory.c b/mm/huge_memory.c index 805a903d8423..d423824dc67a 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -1834,9 +1834,11 @@ int copy_huge_pmd(struct mm_struct *dst_mm, struct mm_struct *src_mm, pmd = pmdp_get_lockless(src_pmd); if (unlikely(pmd_present(pmd) && pmd_special(pmd))) { - pgtable = pte_alloc_one(dst_mm); - if (unlikely(!pgtable)) - goto out; + if (arch_needs_pgtable_deposit(dst_vma)) { + pgtable = pte_alloc_one(dst_mm); + if (unlikely(!pgtable)) + goto out; + } dst_ptl = pmd_lock(dst_mm, dst_pmd); src_ptl = pmd_lockptr(src_mm, src_pmd); spin_lock_nested(src_ptl, SINGLE_DEPTH_NESTING); @@ -1854,8 +1856,10 @@ int copy_huge_pmd(struct mm_struct *dst_mm, struct mm_struct *src_mm, /* dax won't reach here, it will be intercepted at vma_needs_copy() */ VM_WARN_ON_ONCE(vma_is_dax(src_vma)); - mm_inc_nr_ptes(dst_mm); - pgtable_trans_huge_deposit(dst_mm, dst_pmd, pgtable); + if (pgtable) { + mm_inc_nr_ptes(dst_mm); + pgtable_trans_huge_deposit(dst_mm, dst_pmd, pgtable); + } goto set_pmd; } -- 2.43.0

2 1

[PATCH OLK-6.6 1/1] KVM: arm64: Fix kernel panic due to uninitialized fpmr pointer
by Qinxin Xia 13 Oct '26

13 Oct '26

driver inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8904 ---------------------------------------------------------------------- When the hardware implements FEAT_FPMR but CONFIG_ENABLE_KVM_FPMR is not set in the kernel config, starting a VM crashes the host with the following panic: | Unable to handle kernel paging request at virtual address d6d0b7173a7d8b80 | Mem abort info: | ESR = 0x0000000096000044 | EC = 0x25: DABT (current EL), IL = 32 bits | FSC = 0x04: level 0 translation fault | CM = 0, WnR = 1, TnD = 0, TagAccess = 0 | [d6d0b7173a7d8b80] address between user and kernel address ranges | pc : fpsimd_save+0xd0/0x160 | lr : fpsimd_save+0x38/0x160 | Call trace: | fpsimd_save+0xd0/0x160 | fpsimd_save_and_flush_cpu_state+0x34/0xa8 | kvm_arch_vcpu_put_fp+0xf0/0x250 | kvm_arch_vcpu_put+0x44/0xf0 | vcpu_put+0x20/0x50 | kvm_arch_vcpu_ioctl_run+0x70/0x630 | Kernel panic - not syncing: Oops: Fatal exception The root cause is an asymmetric gating of the FPMR context switch introduced when backporting upstream FPMR support: - The consumer side (fpsimd_save()) saves FPMR whenever the hardware capability is detected at runtime: if (system_supports_fpmr()) *(last->fpmr) = read_sysreg_s(SYS_FPMR); - The producer side (kvm_arch_vcpu_ctxsync_fp()) only assigns fp_state.fpmr under #ifdef CONFIG_ENABLE_KVM_FPMR, while the struct cpu_fp_state stack variable is left uninitialized. With the config disabled, fpsimd_bind_state_to_cpu() binds stack garbage into the per-CPU fpsimd_last_state.fpmr, and the first guest exit writes FPMR to this garbage pointer, causing the above level 0 translation fault. Fixes: 17d5edd67293d ("KVM: arm64: Add save/restore support for FPMR") Signed-off-by: Qinxin Xia <xiaqinxin(a)huawei.com> Signed-off-by: Hongye Lin <linhongye(a)h-partners.com> --- arch/arm64/kernel/fpsimd.c | 2 +- arch/arm64/kvm/fpsimd.c | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/arch/arm64/kernel/fpsimd.c b/arch/arm64/kernel/fpsimd.c index a81103cdcbdb..49b5f70f41a5 100644 --- a/arch/arm64/kernel/fpsimd.c +++ b/arch/arm64/kernel/fpsimd.c @@ -478,7 +478,7 @@ static void fpsimd_save(void) if (test_thread_flag(TIF_FOREIGN_FPSTATE)) return; - if (system_supports_fpmr()) + if (system_supports_fpmr() && last->fpmr) *(last->fpmr) = read_sysreg_s(SYS_FPMR); /* diff --git a/arch/arm64/kvm/fpsimd.c b/arch/arm64/kvm/fpsimd.c index 90fb893e47ba..0100acc69964 100644 --- a/arch/arm64/kvm/fpsimd.c +++ b/arch/arm64/kvm/fpsimd.c @@ -122,7 +122,7 @@ void kvm_arch_vcpu_ctxflush_fp(struct kvm_vcpu *vcpu) */ void kvm_arch_vcpu_ctxsync_fp(struct kvm_vcpu *vcpu) { - struct cpu_fp_state fp_state; + struct cpu_fp_state fp_state = { }; WARN_ON_ONCE(!irqs_disabled()); @@ -139,6 +139,8 @@ void kvm_arch_vcpu_ctxsync_fp(struct kvm_vcpu *vcpu) fp_state.svcr = &vcpu->arch.svcr; #ifdef CONFIG_ENABLE_KVM_FPMR fp_state.fpmr = &__vcpu_sys_reg(vcpu, FPMR); +#else + fp_state.fpmr = NULL; #endif fp_state.fp_type = &vcpu->arch.fp_type; -- 2.33.0

2 1

[PATCH openEuler-1.0-LTS v3] netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types
by superdcc97＠163.com 12 Oct '26

12 Oct '26

From: Jozsef Kadlecsik <kadlec(a)netfilter.org> mainline inclusion from mainline-v7.2-rc1 commit e4b4984e28c16406ecb318444dea4a8bf47def3e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17399 CVE: CVE-2026-72436 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Sashiko pointed out that there are a few lockless RCU readers using test_bit() which is a relaxed atomic operation and provides no memory barrier guarantees. Use test_bit_acquire() instead where the operation may run parallel with add/del/gc, i.e. is not one from the next cases - protected by region lock - in a set destroy phase - in a new/temporary set creation phase Fixes: 18f84d41d34f ("netfilter: ipset: Introduce RCU locking in hash:* types") Signed-off-by: Jozsef Kadlecsik <kadlec(a)netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/ipset/ip_set_hash_gen.h [context differences from mainline: f66ee0410b1c: resize still holds set->lock; mtype_ext_size() is absent. 7f7445840b77: bucket position accesses are not annotated. 8238b4579866: test_bit_acquire() is absent; use its generic acquire-load and bit-mask semantics at the lockless readers. Add comment for memory barrier to fix checkpatch warning] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/ipset/ip_set_hash_gen.h | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h index 154b40f2f2a8..305e900b5882 100644 --- a/net/netfilter/ipset/ip_set_hash_gen.h +++ b/net/netfilter/ipset/ip_set_hash_gen.h @@ -588,7 +588,9 @@ mtype_resize(struct ip_set *set, bool retried) if (!n) continue; for (j = 0; j < n->pos; j++) { - if (!test_bit(j, n->used)) + /* Pairs with mtype_add()'s smp_mb__before_atomic(). */ + if (!(smp_load_acquire(&n->used[BIT_WORD(j)]) & + BIT_MASK(j))) continue; data = ahash_data(n, j, dsize); #ifdef IP_SET_HASH_WITH_NETS @@ -947,7 +949,9 @@ mtype_test_cidrs(struct ip_set *set, struct mtype_elem *d, if (!n) continue; for (i = 0; i < n->pos; i++) { - if (!test_bit(i, n->used)) + /* Pairs with mtype_add()'s smp_mb__before_atomic(). */ + if (!(smp_load_acquire(&n->used[BIT_WORD(i)]) & + BIT_MASK(i))) continue; data = ahash_data(n, i, set->dsize); if (!mtype_data_equal(data, d, &multi)) @@ -1002,7 +1006,9 @@ mtype_test(struct ip_set *set, void *value, const struct ip_set_ext *ext, goto out; } for (i = 0; i < n->pos; i++) { - if (!test_bit(i, n->used)) + /* Pairs with mtype_add()'s smp_mb__before_atomic(). */ + if (!(smp_load_acquire(&n->used[BIT_WORD(i)]) & + BIT_MASK(i))) continue; data = ahash_data(n, i, set->dsize); if (!mtype_data_equal(data, d, &multi)) @@ -1128,7 +1134,9 @@ mtype_list(const struct ip_set *set, if (!n) continue; for (i = 0; i < n->pos; i++) { - if (!test_bit(i, n->used)) + /* Pairs with mtype_add()'s smp_mb__before_atomic(). */ + if (!(smp_load_acquire(&n->used[BIT_WORD(i)]) & + BIT_MASK(i))) continue; e = ahash_data(n, i, set->dsize); if (SET_WITH_TIMEOUT(set) && -- 2.43.0

2 1

[PATCH OLK-6.6] bpf: reject BPF_PSEUDO_FUNC reference to the main program
by Pu Lehui 12 Oct '26

12 Oct '26

From: Eduard Zingerman <eddyz87(a)gmail.com> stable inclusion from stable-v6.6.158 commit 8cb75f7ada25b1cf25f2f74dec3ba649b9064a09 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19759 CVE: CVE-2026-98075 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 374b2c5561db80fcdd7cdce44af37a49416f61c7 ] fixups.c:jit_subprogs() rewrites BPF_PSEUDO_FUNC loads to contain real function addresses. This function is invoked from bpf_jit_subprogs() only when env->subprog_cnt > 1. Meaning that for any program like below: int main(void *ctx) { void *ptr = main; ... bpf_timer_set_callback(..., ptr); ... } The 'ptr' won't be ever converted to contain an address. In combination with e.g. bpf_timer_set_callback() this would lead to a function call at a bogus address. Instead of complicating the implementation, just assume that no useful program needs main to be a sync or async callback and reject BPF_PSEUDO_FUNC loads for the main subprogram. Fixes: 69c087ba6225 ("bpf: Add bpf_for_each_map_elem() helper") Reported-by: Nicholas Carlini <npc(a)anthropic.com> Suggested-by: Nicholas Carlini <npc(a)anthropic.com> Signed-off-by: Eduard Zingerman <eddyz87(a)gmail.com> Link: https://lore.kernel.org/r/20260902233658.1186477-1-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/verifier.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index c9921971950d..b796d985e420 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -15286,6 +15286,15 @@ static int check_ld_imm(struct bpf_verifier_env *env, struct bpf_insn *insn) verbose(env, "callback function not static\n"); return -EINVAL; } + /* + * When env->subprog_cnt == 1 this instruction won't be rewritten + * to hold a real function address. Assume that no usable program + * combines e.g. main and timer callback and just reject here. + */ + if (subprogno == 0) { + verbose(env, "callback function cannot be the main program\n"); + return -EINVAL; + } dst_reg->type = PTR_TO_FUNC; dst_reg->subprogno = subprogno; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS v2] netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types
by superdcc97＠163.com 12 Oct '26

12 Oct '26

From: Jozsef Kadlecsik <kadlec(a)netfilter.org> mainline inclusion from mainline-v7.2-rc1 commit e4b4984e28c16406ecb318444dea4a8bf47def3e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17399 CVE: CVE-2026-72436 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Sashiko pointed out that there are a few lockless RCU readers using test_bit() which is a relaxed atomic operation and provides no memory barrier guarantees. Use test_bit_acquire() instead where the operation may run parallel with add/del/gc, i.e. is not one from the next cases - protected by region lock - in a set destroy phase - in a new/temporary set creation phase Fixes: 18f84d41d34f ("netfilter: ipset: Introduce RCU locking in hash:* types") Signed-off-by: Jozsef Kadlecsik <kadlec(a)netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/ipset/ip_set_hash_gen.h [context differences from mainline: f66ee0410b1c: resize still holds set->lock; mtype_ext_size() is absent. 7f7445840b77: bucket position accesses are not annotated. 8238b4579866: test_bit_acquire() is absent; use its generic acquire-load and bit-mask semantics at the three lockless readers. Add comment for memory barrier to fix checkpatch warning] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/ipset/ip_set_hash_gen.h | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h index 154b40f2f2a8..10c6af0f4984 100644 --- a/net/netfilter/ipset/ip_set_hash_gen.h +++ b/net/netfilter/ipset/ip_set_hash_gen.h @@ -588,7 +588,9 @@ mtype_resize(struct ip_set *set, bool retried) if (!n) continue; for (j = 0; j < n->pos; j++) { - if (!test_bit(j, n->used)) + /* Pairs with mtype_add()'s smp_mb__before_atomic(). */ + if (!(smp_load_acquire(&n->used[BIT_WORD(i)]) & + BIT_MASK(i))) continue; data = ahash_data(n, j, dsize); #ifdef IP_SET_HASH_WITH_NETS @@ -947,7 +949,9 @@ mtype_test_cidrs(struct ip_set *set, struct mtype_elem *d, if (!n) continue; for (i = 0; i < n->pos; i++) { - if (!test_bit(i, n->used)) + /* Pairs with mtype_add()'s smp_mb__before_atomic(). */ + if (!(smp_load_acquire(&n->used[BIT_WORD(i)]) & + BIT_MASK(i))) continue; data = ahash_data(n, i, set->dsize); if (!mtype_data_equal(data, d, &multi)) @@ -1002,7 +1006,9 @@ mtype_test(struct ip_set *set, void *value, const struct ip_set_ext *ext, goto out; } for (i = 0; i < n->pos; i++) { - if (!test_bit(i, n->used)) + /* Pairs with mtype_add()'s smp_mb__before_atomic(). */ + if (!(smp_load_acquire(&n->used[BIT_WORD(i)]) & + BIT_MASK(i))) continue; data = ahash_data(n, i, set->dsize); if (!mtype_data_equal(data, d, &multi)) @@ -1128,7 +1134,9 @@ mtype_list(const struct ip_set *set, if (!n) continue; for (i = 0; i < n->pos; i++) { - if (!test_bit(i, n->used)) + /* Pairs with mtype_add()'s smp_mb__before_atomic(). */ + if (!(smp_load_acquire(&n->used[BIT_WORD(i)]) & + BIT_MASK(i))) continue; e = ahash_data(n, i, set->dsize); if (SET_WITH_TIMEOUT(set) && -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS] netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types
by superdcc97＠163.com 12 Oct '26

12 Oct '26

From: Jozsef Kadlecsik <kadlec(a)netfilter.org> mainline inclusion from mainline-v7.2-rc1 commit e4b4984e28c16406ecb318444dea4a8bf47def3e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17399 CVE: CVE-2026-72436 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Sashiko pointed out that there are a few lockless RCU readers using test_bit() which is a relaxed atomic operation and provides no memory barrier guarantees. Use test_bit_acquire() instead where the operation may run parallel with add/del/gc, i.e. is not one from the next cases - protected by region lock - in a set destroy phase - in a new/temporary set creation phase Fixes: 18f84d41d34f ("netfilter: ipset: Introduce RCU locking in hash:* types") Signed-off-by: Jozsef Kadlecsik <kadlec(a)netfilter.org> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/ipset/ip_set_hash_gen.h [context differences from mainline: f66ee0410b1c: resize still holds set->lock; mtype_ext_size() is absent. 7f7445840b77: bucket position accesses are not annotated. 8238b4579866: test_bit_acquire() is absent; use its generic acquire-load and bit-mask semantics at the three lockless readers.] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/ipset/ip_set_hash_gen.h | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h index 154b40f2f2a8..1cb7e5c1fc61 100644 --- a/net/netfilter/ipset/ip_set_hash_gen.h +++ b/net/netfilter/ipset/ip_set_hash_gen.h @@ -947,7 +947,9 @@ mtype_test_cidrs(struct ip_set *set, struct mtype_elem *d, if (!n) continue; for (i = 0; i < n->pos; i++) { - if (!test_bit(i, n->used)) + /* Pairs with mtype_add()'s smp_mb__before_atomic(). */ + if (!(smp_load_acquire(&n->used[BIT_WORD(i)]) & + BIT_MASK(i))) continue; data = ahash_data(n, i, set->dsize); if (!mtype_data_equal(data, d, &multi)) @@ -1002,7 +1004,9 @@ mtype_test(struct ip_set *set, void *value, const struct ip_set_ext *ext, goto out; } for (i = 0; i < n->pos; i++) { - if (!test_bit(i, n->used)) + /* Pairs with mtype_add()'s smp_mb__before_atomic(). */ + if (!(smp_load_acquire(&n->used[BIT_WORD(i)]) & + BIT_MASK(i))) continue; data = ahash_data(n, i, set->dsize); if (!mtype_data_equal(data, d, &multi)) @@ -1128,7 +1132,9 @@ mtype_list(const struct ip_set *set, if (!n) continue; for (i = 0; i < n->pos; i++) { - if (!test_bit(i, n->used)) + /* Pairs with mtype_add()'s smp_mb__before_atomic(). */ + if (!(smp_load_acquire(&n->used[BIT_WORD(i)]) & + BIT_MASK(i))) continue; e = ahash_data(n, i, set->dsize); if (SET_WITH_TIMEOUT(set) && -- 2.43.0

2 1

[PATCH OLK-5.10 0/2] Fix KASAN: slab-use-after-free Read in r1buf_pool_alloc
by Zhou Minqiang 12 Oct '26

12 Oct '26

Fix KASAN: slab-use-after-free Read in r1buf_pool_alloc Zhou Minqiang (2): md/raid1: change r1conf->r1bio_pool to a pointer type md/raid1: remove struct pool_info and related code drivers/md/raid1.c | 84 +++++++++++++++++----------------------------- drivers/md/raid1.h | 22 +----------- 2 files changed, 31 insertions(+), 75 deletions(-) -- 2.52.0

2 4

[PATCH OLK-6.6] procfs: move dropping pde and pid from ->evict_inode() to ->free_inode()
by Zhou Minqiang 12 Oct '26

12 Oct '26

mainline inclusion from mainline-v6.8-rc6 commit 47458802f6606f652cd0f6dc38cd52ce60ec0145 category: bugfix bugzilla: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- that keeps both around until struct inode is freed, making access to them safe from rcu-pathwalk Acked-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Zhou Minqiang <zhouminqiang2(a)huawei.com> --- fs/proc/base.c | 2 -- fs/proc/inode.c | 19 ++++++++----------- 2 files changed, 8 insertions(+), 13 deletions(-) diff --git a/fs/proc/base.c b/fs/proc/base.c index 7ee2285910bb..f34e357e9f97 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -1932,8 +1932,6 @@ void proc_pid_evict_inode(struct proc_inode *ei) hlist_del_init_rcu(&ei->sibling_inodes); spin_unlock(&pid->lock); } - - put_pid(pid); } struct inode *proc_pid_make_inode(struct super_block *sb, diff --git a/fs/proc/inode.c b/fs/proc/inode.c index 92772702d369..85a09918507e 100644 --- a/fs/proc/inode.c +++ b/fs/proc/inode.c @@ -30,7 +30,6 @@ static void proc_evict_inode(struct inode *inode) { - struct proc_dir_entry *de; struct ctl_table_header *head; struct proc_inode *ei = PROC_I(inode); @@ -38,17 +37,8 @@ static void proc_evict_inode(struct inode *inode) clear_inode(inode); /* Stop tracking associated processes */ - if (ei->pid) { + if (ei->pid) proc_pid_evict_inode(ei); - ei->pid = NULL; - } - - /* Let go of any associated proc directory entry */ - de = ei->pde; - if (de) { - pde_put(de); - ei->pde = NULL; - } head = ei->sysctl; if (head) { @@ -80,6 +70,13 @@ static struct inode *proc_alloc_inode(struct super_block *sb) static void proc_free_inode(struct inode *inode) { + struct proc_inode *ei = PROC_I(inode); + + if (ei->pid) + put_pid(ei->pid); + /* Let go of any associated proc directory entry */ + if (ei->pde) + pde_put(ei->pde); kmem_cache_free(proc_inode_cachep, PROC_I(inode)); } -- 2.52.0

2 1

[PATCH OLK-6.6 0/2] Fix KASAN: slab-use-after-free Read in r1buf_pool_alloc
by Zhou Minqiang 12 Oct '26

12 Oct '26

Fix KASAN: slab-use-after-free Read in r1buf_pool_alloc Zhou Minqiang (2): md/raid1: change r1conf->r1bio_pool to a pointer type md/raid1: remove struct pool_info and related code drivers/md/raid1.c | 86 +++++++++++++++++----------------------------- drivers/md/raid1.h | 22 +----------- 2 files changed, 32 insertions(+), 76 deletions(-) -- 2.52.0

2 3