- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] ipv6: reject malicious packets in ipv6_gso_segment()
by Wang Liang 10 Dec '25

10 Dec '25

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v6.6.102 commit ef05007b403dcc21e701cb1f30d4572ac0a9da20 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICU6G7 CVE: CVE-2025-38572 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d45cf1e7d7180256e17c9ce88e32e8061a7887fe ] syzbot was able to craft a packet with very long IPv6 extension headers leading to an overflow of skb->transport_header. This 16bit field has a limited range. Add skb_reset_transport_header_careful() helper and use it from ipv6_gso_segment() WARNING: CPU: 0 PID: 5871 at ./include/linux/skbuff.h:3032 skb_reset_transport_header include/linux/skbuff.h:3032 [inline] WARNING: CPU: 0 PID: 5871 at ./include/linux/skbuff.h:3032 ipv6_gso_segment+0x15e2/0x21e0 net/ipv6/ip6_offload.c:151 Modules linked in: CPU: 0 UID: 0 PID: 5871 Comm: syz-executor211 Not tainted 6.16.0-rc6-syzkaller-g7abc678e3084 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:skb_reset_transport_header include/linux/skbuff.h:3032 [inline] RIP: 0010:ipv6_gso_segment+0x15e2/0x21e0 net/ipv6/ip6_offload.c:151 Call Trace: <TASK> skb_mac_gso_segment+0x31c/0x640 net/core/gso.c:53 nsh_gso_segment+0x54a/0xe10 net/nsh/nsh.c:110 skb_mac_gso_segment+0x31c/0x640 net/core/gso.c:53 __skb_gso_segment+0x342/0x510 net/core/gso.c:124 skb_gso_segment include/net/gso.h:83 [inline] validate_xmit_skb+0x857/0x11b0 net/core/dev.c:3950 validate_xmit_skb_list+0x84/0x120 net/core/dev.c:4000 sch_direct_xmit+0xd3/0x4b0 net/sched/sch_generic.c:329 __dev_xmit_skb net/core/dev.c:4102 [inline] __dev_queue_xmit+0x17b6/0x3a70 net/core/dev.c:4679 Fixes: d1da932ed4ec ("ipv6: Separate ipv6 offload support") Reported-by: syzbot+af43e647fd835acc02df(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/688a1a05.050a0220.5d226.0008.GAE@google.com/… Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Dawid Osuchowski <dawid.osuchowski(a)linux.intel.com> Reviewed-by: Willem de Bruijn <willemb(a)google.com> Link: https://patch.msgid.link/20250730131738.3385939-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- include/linux/skbuff.h | 23 +++++++++++++++++++++++ net/ipv6/ip6_offload.c | 4 +++- 2 files changed, 26 insertions(+), 1 deletion(-) diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h index 1597a5f9b5b8..68a236566458 100644 --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h @@ -2891,6 +2891,29 @@ static inline void skb_reset_transport_header(struct sk_buff *skb) skb->transport_header = skb->data - skb->head; } +/** + * skb_reset_transport_header_careful - conditionally reset transport header + * @skb: buffer to alter + * + * Hardened version of skb_reset_transport_header(). + * + * Returns: true if the operation was a success. + */ +static inline bool __must_check +skb_reset_transport_header_careful(struct sk_buff *skb) +{ + long offset = skb->data - skb->head; + + if (unlikely(offset != (typeof(skb->transport_header))offset)) + return false; + + if (unlikely(offset == (typeof(skb->transport_header))~0U)) + return false; + + skb->transport_header = offset; + return true; +} + static inline void skb_set_transport_header(struct sk_buff *skb, const int offset) { diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c index 7f014a8969fb..84b17eeaa57c 100644 --- a/net/ipv6/ip6_offload.c +++ b/net/ipv6/ip6_offload.c @@ -150,7 +150,9 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb, ops = rcu_dereference(inet6_offloads[proto]); if (likely(ops && ops->callbacks.gso_segment)) { - skb_reset_transport_header(skb); + if (!skb_reset_transport_header_careful(skb)) + goto out; + segs = ops->callbacks.gso_segment(skb, features); if (!segs) skb->network_header = skb_mac_header(skb) + nhoff - skb->head; -- 2.34.1

1 0

[PATCH OLK-6.6] vsock: Do not allow binding to VMADDR_PORT_ANY
by Wang Liang 10 Dec '25

10 Dec '25

From: Budimir Markovic <markovicbudimir(a)gmail.com> stable inclusion from stable-v6.6.102 commit 44bd006d5c93f6a8f28b106cbae2428c5d0275b7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICUC4U CVE: CVE-2025-38618 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit aba0c94f61ec05315fa7815d21aefa4c87f6a9f4 upstream. It is possible for a vsock to autobind to VMADDR_PORT_ANY. This can cause a use-after-free when a connection is made to the bound socket. The socket returned by accept() also has port VMADDR_PORT_ANY but is not on the list of unbound sockets. Binding it will result in an extra refcount decrement similar to the one fixed in fcdd2242c023 (vsock: Keep the binding until socket destruction). Modify the check in __vsock_bind_connectible() to also prevent binding to VMADDR_PORT_ANY. Fixes: d021c344051a ("VSOCK: Introduce VM Sockets") Reported-by: Budimir Markovic <markovicbudimir(a)gmail.com> Signed-off-by: Budimir Markovic <markovicbudimir(a)gmail.com> Reviewed-by: Stefano Garzarella <sgarzare(a)redhat.com> Link: https://patch.msgid.link/20250807041811.678-1-markovicbudimir@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/vmw_vsock/af_vsock.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c index f8f1a49689da..cdcffa01c230 100644 --- a/net/vmw_vsock/af_vsock.c +++ b/net/vmw_vsock/af_vsock.c @@ -654,7 +654,8 @@ static int __vsock_bind_connectible(struct vsock_sock *vsk, unsigned int i; for (i = 0; i < MAX_PORT_RETRIES; i++) { - if (port <= LAST_RESERVED_PORT) + if (port == VMADDR_PORT_ANY || + port <= LAST_RESERVED_PORT) port = LAST_RESERVED_PORT + 1; new_addr.svm_port = port++; -- 2.34.1

2 1

[PATCH OLK-6.6] netfilter: ctnetlink: fix refcount leak on table dump
by Wang Liang 10 Dec '25

10 Dec '25

From: Florian Westphal <fw(a)strlen.de> stable inclusion from stable-v6.6.103 commit 30cf811058552b8cd0e98dff677ef3f89d6d34ce category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICWGI3 CVE: CVE-2025-38721 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit de788b2e6227462b6dcd0e07474e72c089008f74 ] There is a reference count leak in ctnetlink_dump_table(): if (res < 0) { nf_conntrack_get(&ct->ct_general); // HERE cb->args[1] = (unsigned long)ct; ... While its very unlikely, its possible that ct == last. If this happens, then the refcount of ct was already incremented. This 2nd increment is never undone. This prevents the conntrack object from being released, which in turn keeps prevents cnet->count from dropping back to 0. This will then block the netns dismantle (or conntrack rmmod) as nf_conntrack_cleanup_net_list() will wait forever. This can be reproduced by running conntrack_resize.sh selftest in a loop. It takes ~20 minutes for me on a preemptible kernel on average before I see a runaway kworker spinning in nf_conntrack_cleanup_net_list. One fix would to change this to: if (res < 0) { if (ct != last) nf_conntrack_get(&ct->ct_general); But this reference counting isn't needed in the first place. We can just store a cookie value instead. A followup patch will do the same for ctnetlink_exp_dump_table, it looks to me as if this has the same problem and like ctnetlink_dump_table, we only need a 'skip hint', not the actual object so we can apply the same cookie strategy there as well. Fixes: d205dc40798d ("[NETFILTER]: ctnetlink: fix deadlock in table dumping") Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/netfilter/nf_conntrack_netlink.c | 24 +++++++++++++----------- 1 file changed, 13 insertions(+), 11 deletions(-) diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c index 282e9644f6fd..928bd2013289 100644 --- a/net/netfilter/nf_conntrack_netlink.c +++ b/net/netfilter/nf_conntrack_netlink.c @@ -859,8 +859,6 @@ ctnetlink_conntrack_event(unsigned int events, const struct nf_ct_event *item) static int ctnetlink_done(struct netlink_callback *cb) { - if (cb->args[1]) - nf_ct_put((struct nf_conn *)cb->args[1]); kfree(cb->data); return 0; } @@ -1175,19 +1173,26 @@ static int ctnetlink_filter_match(struct nf_conn *ct, void *data) return 0; } +static unsigned long ctnetlink_get_id(const struct nf_conn *ct) +{ + unsigned long id = nf_ct_get_id(ct); + + return id ? id : 1; +} + static int ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb) { unsigned int flags = cb->data ? NLM_F_DUMP_FILTERED : 0; struct net *net = sock_net(skb->sk); - struct nf_conn *ct, *last; + unsigned long last_id = cb->args[1]; struct nf_conntrack_tuple_hash *h; struct hlist_nulls_node *n; struct nf_conn *nf_ct_evict[8]; + struct nf_conn *ct; int res, i; spinlock_t *lockp; - last = (struct nf_conn *)cb->args[1]; i = 0; local_bh_disable(); @@ -1224,7 +1229,7 @@ ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb) continue; if (cb->args[1]) { - if (ct != last) + if (ctnetlink_get_id(ct) != last_id) continue; cb->args[1] = 0; } @@ -1237,8 +1242,7 @@ ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb) NFNL_MSG_TYPE(cb->nlh->nlmsg_type), ct, true, flags); if (res < 0) { - nf_conntrack_get(&ct->ct_general); - cb->args[1] = (unsigned long)ct; + cb->args[1] = ctnetlink_get_id(ct); spin_unlock(lockp); goto out; } @@ -1251,12 +1255,10 @@ ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb) } out: local_bh_enable(); - if (last) { + if (last_id) { /* nf ct hash resize happened, now clear the leftover. */ - if ((struct nf_conn *)cb->args[1] == last) + if (cb->args[1] == last_id) cb->args[1] = 0; - - nf_ct_put(last); } while (i) { -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] CVE-2025-38571
by Wang Liang 10 Dec '25

10 Dec '25

Justin Worrell (1): SUNRPC: call xs_sock_process_cmsg for all cmsg Olga Kornievskaia (1): sunrpc: fix client side handling of tls alerts net/sunrpc/xprtsock.c | 40 ++++++++++++++++++++++++++++++---------- 1 file changed, 30 insertions(+), 10 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] ipv6: fix possible infinite loop in fib6_info_uses_dev()
by Wang Liang 10 Dec '25

10 Dec '25

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v6.6.102 commit 9cb6de8ee144a94ae7a40bdb32560329ab7276f0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICU76Y CVE: CVE-2025-38587 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f8d8ce1b515a0a6af72b30502670a406cfb75073 ] fib6_info_uses_dev() seems to rely on RCU without an explicit protection. Like the prior fix in rt6_nlmsg_size(), we need to make sure fib6_del_route() or fib6_add_rt2node() have not removed the anchor from the list, or we risk an infinite loop. Fixes: d9ccb18f83ea ("ipv6: Fix soft lockups in fib6_select_path under high next hop churn") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20250725140725.3626540-4-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/ipv6/route.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/net/ipv6/route.c b/net/ipv6/route.c index 53197087353a..6f64fd9fe763 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -5863,16 +5863,21 @@ static bool fib6_info_uses_dev(const struct fib6_info *f6i, if (f6i->fib6_nh->fib_nh_dev == dev) return true; - if (f6i->fib6_nsiblings) { - struct fib6_info *sibling, *next_sibling; + if (READ_ONCE(f6i->fib6_nsiblings)) { + const struct fib6_info *sibling; - list_for_each_entry_safe(sibling, next_sibling, - &f6i->fib6_siblings, fib6_siblings) { - if (sibling->fib6_nh->fib_nh_dev == dev) + rcu_read_lock(); + list_for_each_entry_rcu(sibling, &f6i->fib6_siblings, + fib6_siblings) { + if (sibling->fib6_nh->fib_nh_dev == dev) { + rcu_read_unlock(); return true; + } + if (!READ_ONCE(f6i->fib6_nsiblings)) + break; } + rcu_read_unlock(); } - return false; } -- 2.34.1

2 1

[PATCH OLK-6.6 0/9] xsched: XCU Partition
by Zicheng Qu 10 Dec '25

10 Dec '25

Zicheng Qu (9): xsched: refactor CFS per-XCU rq init/deinit paths xsched: fix NULL pointer risk on attach entry allocation xsched: fix concurrent modification NULL pointer dereference in xcu.sched_class xsched: fix hung_task caused by cgroup_file_show and xcg_mutex deadlock xsched: prevent NULL deref by refcounting css and tracking offline state xsched: fix divide-by-zero caused by u64 overflow in CFS shares weight calculation xsched: DEBUG log cleanup xsched: prevent race between enqueue_ctx and xsched_task_free xsched: fix infinite loop caused by invalid CFS group vruntime update include/linux/xsched.h | 40 ++++++- kernel/xsched/cfs.c | 47 +++++--- kernel/xsched/cfs_quota.c | 9 ++ kernel/xsched/cgroup.c | 224 +++++++++++++++++++++----------------- kernel/xsched/core.c | 9 +- kernel/xsched/rt.c | 19 +--- kernel/xsched/vstream.c | 3 + 7 files changed, 210 insertions(+), 141 deletions(-) -- 2.34.1

2 10

[PATCH OLK-6.6 0/9] xsched: XCU Partition
by Zicheng Qu 10 Dec '25

10 Dec '25

Zicheng Qu (9): xsched: refactor CFS per-XCU rq init/deinit paths xsched: fix NULL pointer risk on attach entry allocation xsched: fix concurrent modification NULL pointer dereference in xcu.sched_class xsched: fix hung_task caused by cgroup_file_show and xcg_mutex deadlock xsched: prevent NULL deref by refcounting css and tracking offline state xsched: fix divide-by-zero caused by u64 overflow in CFS shares weight calculation xsched: DEBUG log cleanup xsched: prevent race between enqueue_ctx and xsched_task_free xsched: fix infinite loop caused by invalid CFS group vruntime update include/linux/xsched.h | 40 ++++++- kernel/xsched/cfs.c | 47 +++++--- kernel/xsched/cfs_quota.c | 9 ++ kernel/xsched/cgroup.c | 224 +++++++++++++++++++++----------------- kernel/xsched/core.c | 9 +- kernel/xsched/rt.c | 19 +--- kernel/xsched/vstream.c | 3 + 7 files changed, 210 insertions(+), 141 deletions(-) -- 2.34.1

2 10

[openeuler:OLK-5.10 3399/3399] drivers/net/ethernet/linkdata/sxe/base/log/sxe_log.c:24: warning: Function parameter or member 'buff' not described in 'time_for_file_name'
by kernel test robot 10 Dec '25

10 Dec '25

Hi liujie_answer, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 7579fd89cb4a201d22bd5b78f48df5ce339c0b2d commit: 8cee206b5558245197158bd20895f95cc28d8468 [3399/3399] Ethernet: Linkdata: Supports Linkdata ethernet Controllers config: x86_64-allnoconfig-bpf (https://download.01.org/0day-ci/archive/20251210/202512100859.mEVPzizr-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251210/202512100859.mEVPzizr-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202512100859.mEVPzizr-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/net/ethernet/linkdata/sxe/base/log/sxe_log.c:24: warning: Function parameter or member 'buff' not described in 'time_for_file_name' >> drivers/net/ethernet/linkdata/sxe/base/log/sxe_log.c:24: warning: Function parameter or member 'buf_len' not described in 'time_for_file_name' >> drivers/net/ethernet/linkdata/sxe/base/log/sxe_log.c:24: warning: Excess function parameter 'file' description in 'time_for_file_name' >> drivers/net/ethernet/linkdata/sxe/base/log/sxe_log.c:24: warning: Excess function parameter 'author' description in 'time_for_file_name' >> drivers/net/ethernet/linkdata/sxe/base/log/sxe_log.c:24: warning: Excess function parameter 'date' description in 'time_for_file_name' -- >> drivers/net/ethernet/linkdata/sxe/base/trace/sxe_trace.c:21: warning: Excess function parameter 'file' description in 'SXE_FILE_NAME_LEN' >> drivers/net/ethernet/linkdata/sxe/base/trace/sxe_trace.c:21: warning: Excess function parameter 'author' description in 'SXE_FILE_NAME_LEN' >> drivers/net/ethernet/linkdata/sxe/base/trace/sxe_trace.c:21: warning: Excess function parameter 'date' description in 'SXE_FILE_NAME_LEN' -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_csum.c:23: warning: Function parameter or member 'protocol' not described in 'sxe_is_sctp_ipv4' >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_csum.c:23: warning: Function parameter or member 'skb' not described in 'sxe_is_sctp_ipv4' >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_csum.c:23: warning: Excess function parameter 'file' description in 'sxe_is_sctp_ipv4' >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_csum.c:23: warning: Excess function parameter 'author' description in 'sxe_is_sctp_ipv4' >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_csum.c:23: warning: Excess function parameter 'date' description in 'sxe_is_sctp_ipv4' -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_dcb.c:16: warning: Excess function parameter 'file' description in 'SXE_TC_BWG_PERCENT_PER_CHAN' >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_dcb.c:16: warning: Excess function parameter 'author' description in 'SXE_TC_BWG_PERCENT_PER_CHAN' >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_dcb.c:16: warning: Excess function parameter 'date' description in 'SXE_TC_BWG_PERCENT_PER_CHAN' -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_dcb_nl.c:20: warning: Excess function parameter 'file' description in 'BIT_PFC' >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_dcb_nl.c:20: warning: Excess function parameter 'author' description in 'BIT_PFC' >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_dcb_nl.c:20: warning: Excess function parameter 'date' description in 'BIT_PFC' -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_debug.c:18: warning: Excess function parameter 'file' description in 'SKB_DESCRIPTION_LEN' >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_debug.c:18: warning: Excess function parameter 'author' description in 'SKB_DESCRIPTION_LEN' >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_debug.c:18: warning: Excess function parameter 'date' description in 'SKB_DESCRIPTION_LEN' -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_ipsec.c:23: warning: cannot understand function prototype: 'const char ipsec_aes_name[] = "rfc4106(gcm(aes))"; ' -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_host_cli.c:18: warning: cannot understand function prototype: 'dev_t sxe_cdev_major; ' -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_host_hdc.c:27: warning: cannot understand function prototype: 'atomic_t hdc_available = ATOMIC_INIT(1); ' -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_filter.c:24: warning: cannot understand function prototype: 'struct workqueue_struct *sxe_fnav_workqueue; ' -- >> drivers/net/ethernet/linkdata/sxe/sxepf/sxe_monitor.c:24: warning: cannot understand function prototype: 'struct workqueue_struct *sxe_fnav_workqueue; ' .. Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PTP_1588_CLOCK Depends on [n]: NET [=y] && POSIX_TIMERS [=n] Selected by [m]: - SXE [=m] && NETDEVICES [=y] && ETHERNET [=y] && NET_VENDOR_LINKDATA [=y] && (X86 [=y] || ARM64) && PCI [=y] - SXE_VF [=m] && NETDEVICES [=y] && ETHERNET [=y] && NET_VENDOR_LINKDATA [=y] && (X86 [=y] || ARM64) && PCI [=y] vim +24 drivers/net/ethernet/linkdata/sxe/base/log/sxe_log.c 19 20 #if (defined SXE_DRIVER_DEBUG && defined __KERNEL__) || \ 21 (defined SXE_DRIVER_TRACE) 22 23 int time_for_file_name(char *buff, int buf_len) > 24 { 25 #ifdef SXE_LOG_TIME_TO_TM 26 struct timeval tv; 27 struct tm td; 28 29 do_gettimeofday(&tv); 30 time_to_tm(tv.tv_sec, -sys_tz.tz_minuteswest * 60, &td); 31 #else 32 struct timespec64 tv; 33 struct tm td; 34 35 ktime_get_real_ts64(&tv); 36 time64_to_tm(tv.tv_sec, -sys_tz.tz_minuteswest * 60, &td); 37 #endif 38 return snprintf(buff, buf_len, "%04ld-%02d-%02d_%02d:%02d:%02d", 39 td.tm_year + 1900, td.tm_mon + 1, td.tm_mday, 40 td.tm_hour, td.tm_min, td.tm_sec); 41 } 42 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process()
by Li Lingfeng 10 Dec '25

10 Dec '25

From: Tomas Henzl <thenzl(a)redhat.com> stable inclusion from stable-v4.19.276 commit 9e5c7d52085b8c84bc82a261580f0eb170039325 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IDBMX7 CVE: CVE-2023-53803 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 9b4f5028e493cb353a5c8f5c45073eeea0303abd upstream. A fix for: BUG: KASAN: slab-out-of-bounds in ses_enclosure_data_process+0x949/0xe30 [ses] Read of size 1 at addr ffff88a1b043a451 by task systemd-udevd/3271 Checking after (and before in next loop) addl_desc_ptr[1] is sufficient, we expect the size to be sanitized before first access to addl_desc_ptr[1]. Make sure we don't walk beyond end of page. Link: https://lore.kernel.org/r/20230202162451.15346-2-thenzl@redhat.com Cc: stable(a)vger.kernel.org Signed-off-by: Tomas Henzl <thenzl(a)redhat.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/scsi/ses.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c index b42c0bb8caa9..3a0cb1fa6767 100644 --- a/drivers/scsi/ses.c +++ b/drivers/scsi/ses.c @@ -625,9 +625,11 @@ static void ses_enclosure_data_process(struct enclosure_device *edev, /* these elements are optional */ type_ptr[0] == ENCLOSURE_COMPONENT_SCSI_TARGET_PORT || type_ptr[0] == ENCLOSURE_COMPONENT_SCSI_INITIATOR_PORT || - type_ptr[0] == ENCLOSURE_COMPONENT_CONTROLLER_ELECTRONICS)) + type_ptr[0] == ENCLOSURE_COMPONENT_CONTROLLER_ELECTRONICS)) { addl_desc_ptr += addl_desc_ptr[1] + 2; - + if (addl_desc_ptr + 1 >= ses_dev->page10 + ses_dev->page10_len) + addl_desc_ptr = NULL; + } } } kfree(buf); -- 2.31.1

2 1

[PATCH OLK-6.6 0/2] Handling Kunpeng Chip ARM Spectre-BHB (CVE-2022-23960) Issue
by Jinqian Yang 10 Dec '25

10 Dec '25

Previously, the mitigation for HIP09 had been incorporated into 6.6. Now, the mitigation for TSV100 is being incorporated into 6.6. And non-privileged eBPF is disabled by default. In addition, the GRUB in the distribution needs to include 'nospectre-bhb'. Jinqian Yang (2): arm64: Add support for TSV110 Spectre-BHB mitigation config: Disable unprivileged BPF syscall by default arch/arm64/configs/openeuler_defconfig | 2 +- arch/arm64/kernel/proton-pack.c | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) -- 2.33.0

2 3