- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10 0/5] CVE-2026-53120
by Ziming Du 07 Aug '26

07 Aug '26

patches for CVE-2026-53120 Danilo Krummrich (1): PCI: use generic driver_override infrastructure Samiullah Khawaja (1): PCI: Initialize temporary device in new_id_store() Zhenzhong Duan (2): PCI: Move pci_match_device() ahead of new_id_store() PCI: Avoid duplicate IDs in driver dynamic IDs list Ziming Du (1): [Huawei] PCI: fix kabi breakage due to driver_override removal drivers/pci/pci-driver.c | 161 +++++++++++++++-------------- drivers/pci/pci-sysfs.c | 48 --------- drivers/pci/probe.c | 1 - drivers/vfio/pci/vfio_pci.c | 4 +- drivers/xen/xen-pciback/pci_stub.c | 6 +- include/linux/pci.h | 2 +- 6 files changed, 93 insertions(+), 129 deletions(-) -- 2.43.0

1 5

[PATCH openEuler-1.0-LTS] smb/client: fix chown/chgrp with SMB3 POSIX Extensions
by Zhou Minqiang 07 Aug '26

07 Aug '26

mainline inclusion from mainline-v7.2-rc1 commit 760ef2c579c2609cf17fb1cd5392f64d42d43d33 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16820 CVE: CVE-2026-64388 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Ownership (chown) and group (chgrp) modifications were being ignored when mounting with SMB3 POSIX Extensions unless CIFS_MOUNT_CIFS_ACL or CIFS_MOUNT_MODE_FROM_SID were also explicitly set. Fix this by checking for posix_extensions in cifs_setattr_nounix() when updating UID and GID, ensuring that id_mode_to_cifs_acl() is called to map and set the ownership/group information on the server. Cc: stable(a)vger.kernel.org Signed-off-by: Ralph Boehme <slow(a)samba.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/cifs/inode.c fs/smb/client/inode.c [cxt conflicts] Signed-off-by: Zhou Minqiang <zhouminqiang2(a)huawei.com> --- fs/cifs/inode.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c index d30eb4350656..e5d0066f6125 100644 --- a/fs/cifs/inode.c +++ b/fs/cifs/inode.c @@ -2447,7 +2447,8 @@ cifs_setattr_nounix(struct dentry *direntry, struct iattr *attrs) gid = attrs->ia_gid; #ifdef CONFIG_CIFS_ACL - if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_CIFS_ACL) { + if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_CIFS_ACL) || + cifs_sb_master_tcon(cifs_sb)->posix_extensions) { if (uid_valid(uid) || gid_valid(gid)) { rc = id_mode_to_cifs_acl(inode, full_path, NO_CHANGE_64, uid, gid); -- 2.52.0

1 0

[PATCH OLK-6.6 0/3] CVE-2026-53120
by Ziming Du 07 Aug '26

07 Aug '26

CVE-2026-53120 Danilo Krummrich (1): PCI: use generic driver_override infrastructure Samiullah Khawaja (1): PCI: Initialize temporary device in new_id_store() Ziming Du (1): PCI: fix kabi breakage due to driver_override removal drivers/pci/pci-driver.c | 20 +++++++++++++++----- drivers/pci/pci-sysfs.c | 28 ---------------------------- drivers/pci/probe.c | 1 - drivers/vfio/pci/vfio_pci_core.c | 4 ++-- drivers/xen/xen-pciback/pci_stub.c | 6 ++++-- include/linux/pci.h | 7 +------ 6 files changed, 22 insertions(+), 44 deletions(-) -- 2.43.0

2 4

[PATCH OLK-6.6 0/4] CVE-2026-64405 fixes
by Tang Hui 06 Aug '26

06 Aug '26

CVE-2026-64405 fixes. Luiz Augusto von Dentz (2): [Backport] Bluetooth: hci_core: Remove check of BDADDR_ANY in hci_conn_hash_lookup_big_state [Backport] Bluetooth: hci_sync: Fix attempting to send HCI_Disconnect to BIS handle Pauli Virtanen (1): [Backport] Bluetooth: separate CIS_LINK and BIS_LINK link types Siwei Zhang (1): [Backport] Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn() include/net/bluetooth/hci.h | 3 +- include/net/bluetooth/hci_core.h | 38 ++++---- net/bluetooth/hci_conn.c | 56 +++++------- net/bluetooth/hci_core.c | 21 +++-- net/bluetooth/hci_event.c | 25 +++--- net/bluetooth/hci_sync.c | 149 ++++++++++++++++++++++++++----- net/bluetooth/iso.c | 4 +- net/bluetooth/mgmt.c | 3 +- 8 files changed, 206 insertions(+), 93 deletions(-) -- 2.34.1

1 4

[PATCH OLK-5.10] KVM: SEV: Ignore Port I/O requests of length '0'
by Zhang Kunbo 06 Aug '26

06 Aug '26

From: Sean Christopherson <seanjc(a)google.com> stable inclusion from stable-v6.12.95 commit 3b6035bc6bff20e89752ce4358bc4c9a9d5883f2 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16267 CVE: CVE-2026-63940 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 3988bd2723de407ae90fa7a6f6029b4e60238c58 upstream. Explicitly ignore Port I/O requests of length '0' (or count '0'), so that setting up the software scratch area (and other code) doesn't have to worry about underflowing the length, and to allow for WARNing on trying to configure the scratch area with len==0. Fixes: 291bd20d5d88 ("KVM: SVM: Add initial support for a VMGEXIT VMEXIT") Cc: stable(a)vger.kernel.org Reviewed-by: Tom Lendacky <thomas.lendacky(a)amd.com> Signed-off-by: Sean Christopherson <seanjc(a)google.com> Message-ID: <20260501202250.2115252-5-seanjc(a)google.com> Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com> Signed-off-by: Jack Wang <jinpu.wang(a)ionos.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- arch/x86/kvm/svm/sev.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c index c711a6369c13..79ebbe8cf0b4 100644 --- a/arch/x86/kvm/svm/sev.c +++ b/arch/x86/kvm/svm/sev.c @@ -2791,6 +2791,11 @@ int sev_handle_vmgexit(struct vcpu_svm *svm) "vmgexit: unsupported event - exit_info_1=%#llx, exit_info_2=%#llx\n", control->exit_info_1, control->exit_info_2); break; + case SVM_EXIT_IOIO: + if (!((control->exit_info_1 & SVM_IOIO_SIZE_MASK) >> SVM_IOIO_SIZE_SHIFT)) + return 1; + + fallthrough; default: ret = svm_invoke_exit_handler(svm, exit_code); } @@ -2810,6 +2815,9 @@ int sev_es_string_io(struct vcpu_svm *svm, int size, unsigned int port, int in) if (unlikely(check_mul_overflow(count, size, &bytes))) return -EINVAL; + if (!bytes) + return 1; + if (!setup_vmgexit_scratch(svm, in, bytes)) return -EINVAL; -- 2.34.1

2 1

[PATCH OLK-6.6] x86/bugs: Enable IBPB flush on BPF JIT allocation
by Zhang Kunbo 06 Aug '26

06 Aug '26

From: Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> stable inclusion from stable-v6.6.145 commit cb27f3bf915cc0f20fc0c48da9059304e39ebd35 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16808 CVE: CVE-2026-64507 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit a3af84b0fa00ead01fcd0e28b5d773ff25990a0d upstream. Enable hardening against JIT spraying when Spectre-v2 mitigations are in use. Specifically, issue an IBPB flush on BPF JIT memory reuse. Skip enabling the IBPB flush if the BPF dispatcher is already using a retpoline sequence. This hardening applies only when BPF-JIT is in use. Guard the enabling under CONFIG_BPF_JIT so that bugs.c still builds with CONFIG_BPF_JIT=n. [ pawan: Use entry_ibpb() instead of write_ibpb(). JIT hardening enable moved to spectre_v2_select_mitigation() because there is no spectre_v2_apply_mitigation()] Signed-off-by: Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> Acked-by: Daniel Borkmann <daniel(a)iogearbox.net> Acked-by: Dave Hansen <dave.hansen(a)linux.intel.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: arch/x86/include/asm/nospec-branch.h [context conflicts] Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- arch/x86/include/asm/nospec-branch.h | 4 +++ arch/x86/kernel/cpu/bugs.c | 50 +++++++++++++++++++++++++--- 2 files changed, 49 insertions(+), 5 deletions(-) diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h index 58dda23aee1b..d4eae71b2ab7 100644 --- a/arch/x86/include/asm/nospec-branch.h +++ b/arch/x86/include/asm/nospec-branch.h @@ -408,6 +408,10 @@ extern void srso_alias_untrain_ret(void); extern void entry_untrain_ret(void); extern void write_ibpb(void); +#ifdef CONFIG_BPF_JIT +extern void bpf_arch_ibpb(void); +#endif + #ifdef CONFIG_X86_64 extern void clear_bhb_loop(void); #endif diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c index 212408f6de11..e53ea50132e7 100644 --- a/arch/x86/kernel/cpu/bugs.c +++ b/arch/x86/kernel/cpu/bugs.c @@ -16,6 +16,7 @@ #include <linux/sched/smt.h> #include <linux/pgtable.h> #include <linux/bpf.h> +#include <linux/filter.h> #include <asm/spec-ctrl.h> #include <asm/cmdline.h> @@ -1312,8 +1313,21 @@ static inline const char *spectre_v2_module_string(void) { return spectre_v2_bad_module ? " - vulnerable module loaded" : ""; } + +/* + * The "retpoline sequence" is the "call;mov;ret" sequence that + * replaces normal indirect branch instructions. Differentiate + * *the* retpoline sequence from the LFENCE-prefixed indirect + * branches that simply use the retpoline infrastructure. + */ +static inline bool retpoline_seq_enabled(void) +{ + return boot_cpu_has(X86_FEATURE_RETPOLINE) && !boot_cpu_has(X86_FEATURE_RETPOLINE_LFENCE); +} + #else static inline const char *spectre_v2_module_string(void) { return ""; } +static inline bool retpoline_seq_enabled(void) { return false; } #endif #define SPECTRE_V2_LFENCE_MSG "WARNING: LFENCE mitigation is not recommended for this CPU, data leaks possible!\n" @@ -1787,8 +1801,7 @@ static void __init bhi_select_mitigation(void) return; /* Retpoline mitigates against BHI unless the CPU has RRSBA behavior */ - if (boot_cpu_has(X86_FEATURE_RETPOLINE) && - !boot_cpu_has(X86_FEATURE_RETPOLINE_LFENCE)) { + if (retpoline_seq_enabled()) { spec_ctrl_disable_kernel_rrsba(); if (rrsba_disabled) return; @@ -1810,6 +1823,27 @@ static void __init bhi_select_mitigation(void) pr_info("Spectre BHI mitigation: SW BHB clearing on syscall\n"); } +#ifdef CONFIG_BPF_JIT +static void __bpf_arch_ibpb(void *unused) +{ + entry_ibpb(); +} + +void bpf_arch_ibpb(void) +{ + on_each_cpu(__bpf_arch_ibpb, NULL, 1); +} + +static bool __init cpu_wants_ibpb_bpf(void) +{ + /* A genuine retpoline already neutralizes ring0 indirect predictions */ + if (retpoline_seq_enabled()) + return false; + + return boot_cpu_has(X86_FEATURE_IBPB); +} +#endif + static void __init spectre_v2_select_mitigation(void) { enum spectre_v2_mitigation_cmd cmd = spectre_v2_parse_cmdline(); @@ -1955,6 +1989,14 @@ static void __init spectre_v2_select_mitigation(void) pr_info("Enabling Restricted Speculation for firmware calls\n"); } +#ifdef CONFIG_BPF_JIT + if (cpu_wants_ibpb_bpf()) { + static_call_update(bpf_arch_pred_flush, bpf_arch_ibpb); + static_branch_enable(&bpf_pred_flush_enabled); + pr_info("Enabling IBPB for BPF\n"); + } +#endif + /* Set up IBPB and STIBP depending on the general spectre V2 command */ spectre_v2_cmd = cmd; } @@ -3113,9 +3155,7 @@ static const char *spectre_bhi_state(void) return "; BHI: BHI_DIS_S"; else if (boot_cpu_has(X86_FEATURE_CLEAR_BHB_LOOP)) return "; BHI: SW loop, KVM: SW loop"; - else if (boot_cpu_has(X86_FEATURE_RETPOLINE) && - !boot_cpu_has(X86_FEATURE_RETPOLINE_LFENCE) && - rrsba_disabled) + else if (retpoline_seq_enabled() && rrsba_disabled) return "; BHI: Retpoline"; else if (boot_cpu_has(X86_FEATURE_CLEAR_BHB_LOOP_ON_VMEXIT)) return "; BHI: Vulnerable, KVM: SW loop"; -- 2.34.1

2 1

[PATCH OLK-6.6 0/3] CVE-2026-53120
by Ziming Du 06 Aug '26

06 Aug '26

CVE-2026-53120 Danilo Krummrich (1): PCI: use generic driver_override infrastructure Samiullah Khawaja (1): PCI: Initialize temporary device in new_id_store() Ziming Du (1): PCI: fix kabi breakage due to driver_override removal drivers/pci/pci-driver.c | 20 +++++++++++++++----- drivers/pci/pci-sysfs.c | 28 ---------------------------- drivers/pci/probe.c | 1 - drivers/vfio/pci/vfio_pci_core.c | 4 ++-- drivers/xen/xen-pciback/pci_stub.c | 6 ++++-- include/linux/pci.h | 7 +------ 6 files changed, 22 insertions(+), 44 deletions(-) -- 2.43.0

2 4

[PATCH OLK-5.10] PCI: Fix pci_slot_trylock() error handling
by Ziming Du 06 Aug '26

06 Aug '26

From: Jinhui Guo <guojinhui.liam(a)bytedance.com> stable inclusion from stable-v5.10.252 commit ebb27b7399ab8b9eb1f792b329aa5f6250c590d4 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14757 CVE: CVE-2026-43211 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9368d1ee62829b08aa31836b3ca003803caf0b72 ] Commit a4e772898f8b ("PCI: Add missing bridge lock to pci_bus_lock()") delegates the bridge device's pci_dev_trylock() to pci_bus_trylock() in pci_slot_trylock(), but it forgets to remove the corresponding pci_dev_unlock() when pci_bus_trylock() fails. Before a4e772898f8b, the code did: if (!pci_dev_trylock(dev)) /* <- lock bridge device */ goto unlock; if (dev->subordinate) { if (!pci_bus_trylock(dev->subordinate)) { pci_dev_unlock(dev); /* <- unlock bridge device */ goto unlock; } } After a4e772898f8b the bridge-device lock is no longer taken, but the pci_dev_unlock(dev) on the failure path was left in place, leading to the bug. This yields one of two errors: 1. A warning that the lock is being unlocked when no one holds it. 2. An incorrect unlock of a lock that belongs to another thread. Fix it by removing the now-redundant pci_dev_unlock(dev) on the failure path. [Same patch later posted by Keith at https://patch.msgid.link/20260116184150.3013258-1-kbusch@meta.com] Fixes: a4e772898f8b ("PCI: Add missing bridge lock to pci_bus_lock()") Signed-off-by: Jinhui Guo <guojinhui.liam(a)bytedance.com> Signed-off-by: Bjorn Helgaas <bhelgaas(a)google.com> Reviewed-by: Dan Williams <dan.j.williams(a)intel.com> Cc: stable(a)vger.kernel.org Link: https://patch.msgid.link/20251212145528.2555-1-guojinhui.liam@bytedance.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ziming Du <duziming2(a)huawei.com> --- drivers/pci/pci.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c index 450228913544c..109b245210222 100644 --- a/drivers/pci/pci.c +++ b/drivers/pci/pci.c @@ -5391,10 +5391,8 @@ static int pci_slot_trylock(struct pci_slot *slot) if (!dev->slot || dev->slot != slot) continue; if (dev->subordinate) { - if (!pci_bus_trylock(dev->subordinate)) { - pci_dev_unlock(dev); + if (!pci_bus_trylock(dev->subordinate)) goto unlock; - } } else if (!pci_dev_trylock(dev)) goto unlock; } -- 2.43.0

2 1

[PATCH OLK-5.10 0/5] CVE-2026-53120
by Ziming Du 06 Aug '26

06 Aug '26

patches for CVE-2026-53120 Danilo Krummrich (1): PCI: use generic driver_override infrastructure Samiullah Khawaja (1): PCI: Initialize temporary device in new_id_store() Zhenzhong Duan (2): PCI: Move pci_match_device() ahead of new_id_store() PCI: Avoid duplicate IDs in driver dynamic IDs list Ziming Du (1): [Huawei] PCI: fix kabi breakage due to driver_override removal drivers/pci/pci-driver.c | 161 +++++++++++++++-------------- drivers/pci/pci-sysfs.c | 48 --------- drivers/pci/probe.c | 1 - drivers/vfio/pci/vfio_pci.c | 4 +- drivers/xen/xen-pciback/pci_stub.c | 6 +- include/linux/pci.h | 2 +- 6 files changed, 93 insertions(+), 129 deletions(-) -- 2.43.0

2 6

[PATCH OLK-6.6 0/4] CVE-2026-64405 fixes
by Hui Tang 06 Aug '26

06 Aug '26

CVE-2026-64405 fixes Luiz Augusto von Dentz (2): [Backport] Bluetooth: hci_core: Remove check of BDADDR_ANY in hci_conn_hash_lookup_big_state [Backport] Bluetooth: hci_sync: Fix attempting to send HCI_Disconnect to BIS handle Pauli Virtanen (1): [Backport] Bluetooth: separate CIS_LINK and BIS_LINK link types Siwei Zhang (1): [Backport] Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn() include/net/bluetooth/hci.h | 3 +- include/net/bluetooth/hci_core.h | 38 ++++---- net/bluetooth/hci_conn.c | 56 +++++------- net/bluetooth/hci_core.c | 21 +++-- net/bluetooth/hci_event.c | 25 +++--- net/bluetooth/hci_sync.c | 149 ++++++++++++++++++++++++++----- net/bluetooth/iso.c | 4 +- net/bluetooth/mgmt.c | 3 +- 8 files changed, 206 insertions(+), 93 deletions(-) -- 2.34.1

1 4