- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10 0/2] spi: Adapt downstream drivers to generic driver_override infrastructure
by Zhang Yuwei 13 May '26

13 May '26

The SPI subsystem fixed a Use-After-Free vulnerability by switching to the generic bus-level driver_override infrastructure and removing the driver_override field from struct spi_device. As a result, downstream drivers can no longer access this field directly. Danilo Krummrich (1): spi: use generic driver_override infrastructure Krzysztof Kozlowski (1): spi: Use helper for safer setting of driver_override drivers/spi/spi.c | 43 ++++++++++------------------------------- include/linux/spi/spi.h | 4 +--- 2 files changed, 11 insertions(+), 36 deletions(-) -- 2.22.0

2 3

[PATCH OLK-6.6] spi: use generic driver_override infrastructure
by Zhang Yuwei 13 May '26

13 May '26

From: Danilo Krummrich <dakr(a)kernel.org> mainline inclusion from mainline-v7.0-rc6 commit cc34d77dd48708d810c12bfd6f5bf03304f6c824 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14224 CVE: CVE-2026-31487 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF. Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally. Note that calling match() from __driver_attach() without the device lock held is intentional. [1] Also note that we do not enable the driver_override feature of struct bus_type, as SPI - in contrast to most other buses - passes "" to sysfs_emit() when the driver_override pointer is NULL. Thus, printing "\n" instead of "(null)\n". Link: https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/ [1] Reported-by: Gui-Dong Han <hanguidong02(a)gmail.com> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220789 Fixes: 5039563e7c25 ("spi: Add driver_override SPI device attribute") Signed-off-by: Danilo Krummrich <dakr(a)kernel.org> Link: https://patch.msgid.link/20260324005919.2408620-12-dakr@kernel.org Signed-off-by: Mark Brown <broonie(a)kernel.org> Conflicts: include/linux/spi/spi.h drivers/spi/spi.c [commit 702ca0269ed56 merged] Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> --- drivers/spi/spi.c | 19 +++++++------------ include/linux/spi/spi.h | 5 ----- 2 files changed, 7 insertions(+), 17 deletions(-) diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c index 2ca4ea45e3b2..b9774bcaa678 100644 --- a/drivers/spi/spi.c +++ b/drivers/spi/spi.c @@ -49,7 +49,6 @@ static void spidev_release(struct device *dev) struct spi_device *spi = to_spi_device(dev); spi_controller_put(spi->controller); - kfree(spi->driver_override); free_percpu(spi->pcpu_statistics); kfree(spi); } @@ -72,10 +71,9 @@ static ssize_t driver_override_store(struct device *dev, struct device_attribute *a, const char *buf, size_t count) { - struct spi_device *spi = to_spi_device(dev); int ret; - ret = driver_set_override(dev, &spi->driver_override, buf, count); + ret = __device_set_driver_override(dev, buf, count); if (ret) return ret; @@ -85,13 +83,8 @@ static ssize_t driver_override_store(struct device *dev, static ssize_t driver_override_show(struct device *dev, struct device_attribute *a, char *buf) { - const struct spi_device *spi = to_spi_device(dev); - ssize_t len; - - device_lock(dev); - len = sysfs_emit(buf, "%s\n", spi->driver_override ? : ""); - device_unlock(dev); - return len; + guard(spinlock)(&dev->driver_override.lock); + return sysfs_emit(buf, "%s\n", dev->driver_override.name ?: ""); } static DEVICE_ATTR_RW(driver_override); @@ -377,10 +370,12 @@ static int spi_match_device(struct device *dev, struct device_driver *drv) { const struct spi_device *spi = to_spi_device(dev); const struct spi_driver *sdrv = to_spi_driver(drv); + int ret; /* Check override first, and if set, only use the named driver */ - if (spi->driver_override) - return strcmp(spi->driver_override, drv->name) == 0; + ret = device_match_driver_override(dev, drv); + if (ret >= 0) + return ret; /* Attempt an OF style match */ if (of_driver_match_device(dev, drv)) diff --git a/include/linux/spi/spi.h b/include/linux/spi/spi.h index e5baf43bcfbb..3f6ca8052f63 100644 --- a/include/linux/spi/spi.h +++ b/include/linux/spi/spi.h @@ -153,10 +153,6 @@ extern void spi_transfer_cs_change_delay_exec(struct spi_message *msg, * @modalias: Name of the driver to use with this device, or an alias * for that name. This appears in the sysfs "modalias" attribute * for driver coldplugging, and in uevents used for hotplugging - * @driver_override: If the name of a driver is written to this attribute, then - * the device will bind to the named driver and only the named driver. - * Do not set directly, because core frees it; use driver_set_override() to - * set or clear it. * @cs_gpiod: GPIO descriptor of the chipselect line (optional, NULL when * not using a GPIO line) * @word_delay: delay to be inserted between consecutive @@ -212,7 +208,6 @@ struct spi_device { void *controller_state; void *controller_data; char modalias[SPI_NAME_SIZE]; - const char *driver_override; struct gpio_desc *cs_gpiod; /* Chip select GPIO descriptor */ struct spi_delay word_delay; /* Inter-word delay */ /* CS delays */ -- 2.22.0

2 1

[PATCH openEuler-1.0-LTS 0/3] bugfix set of CVEs
by Liu Kai 13 May '26

13 May '26

bugfix set of CVEs Lee Jones (2): HID: core: Mitigate potential OOB by removing bogus memset() HID: multitouch: Check to ensure report responses match the request Vicki Pfau (1): HID: core: Add printk_ratelimited variants to hid_warn() etc drivers/hid/hid-core.c | 7 ++++--- drivers/hid/hid-multitouch.c | 7 +++++++ include/linux/hid.h | 11 +++++++++++ 3 files changed, 22 insertions(+), 3 deletions(-) -- 2.34.1

2 4

[PATCH OLK-5.10] Bluetooth: hci_event: move wake reason storage into validated event handlers
by Chen Jinghuang 13 May '26

13 May '26

From: Oleh Konko <security(a)1seal.org> mainline inclusion from mainline-v7.0-rc7 commit 2b2bf47cd75518c36fa2d41380e4a40641cc89cd category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14521 CVE: CVE-2026-31771 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------------------------------------- hci_store_wake_reason() is called from hci_event_packet() immediately after stripping the HCI event header but before hci_event_func() enforces the per-event minimum payload length from hci_ev_table. This means a short HCI event frame can reach bacpy() before any bounds check runs. Rather than duplicating skb parsing and per-event length checks inside hci_store_wake_reason(), move wake-address storage into the individual event handlers after their existing event-length validation has succeeded. Convert hci_store_wake_reason() into a small helper that only stores an already-validated bdaddr while the caller holds hci_dev_lock(). Use the same helper after hci_event_func() with a NULL address to preserve the existing unexpected-wake fallback semantics when no validated event handler records a wake address. Annotate the helper with __must_hold(&hdev->lock) and add lockdep_assert_held(&hdev->lock) so future call paths keep the lock contract explicit. Call the helper from hci_conn_request_evt(), hci_conn_complete_evt(), hci_sync_conn_complete_evt(), le_conn_complete_evt(), hci_le_adv_report_evt(), hci_le_ext_adv_report_evt(), hci_le_direct_adv_report_evt(), hci_le_pa_sync_established_evt(), and hci_le_past_received_evt(). Fixes: 2f20216c1d6f ("Bluetooth: Emit controller suspend and resume events") Cc: stable(a)vger.kernel.org Signed-off-by: Oleh Konko <security(a)1seal.org> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- net/bluetooth/hci_event.c | 100 +++++++++++++++----------------------- 1 file changed, 38 insertions(+), 62 deletions(-) diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c index 509ec9fd4865..8fe811cc6e17 100644 --- a/net/bluetooth/hci_event.c +++ b/net/bluetooth/hci_event.c @@ -42,6 +42,10 @@ #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \ "\x00\x00\x00\x00\x00\x00\x00\x00" +static void hci_store_wake_reason(struct hci_dev *hdev, + const bdaddr_t *bdaddr, u8 addr_type) + __must_hold(&hdev->lock); + /* Handle HCI Event packets */ static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb, @@ -2588,6 +2592,7 @@ static void hci_conn_complete_evt(struct hci_dev *hdev, struct sk_buff *skb) BT_DBG("%s", hdev->name); hci_dev_lock(hdev); + hci_store_wake_reason(hdev, &ev->bdaddr, BDADDR_BREDR); conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr); if (!conn) { @@ -2740,6 +2745,10 @@ static void hci_conn_request_evt(struct hci_dev *hdev, struct sk_buff *skb) BT_DBG("%s bdaddr %pMR type 0x%x", hdev->name, &ev->bdaddr, ev->link_type); + hci_dev_lock(hdev); + hci_store_wake_reason(hdev, &ev->bdaddr, BDADDR_BREDR); + hci_dev_unlock(hdev); + /* Reject incoming connection from device with same BD ADDR against * CVE-2020-26555 */ @@ -4374,6 +4383,7 @@ static void hci_sync_conn_complete_evt(struct hci_dev *hdev, BT_DBG("%s status 0x%2.2x", hdev->name, ev->status); hci_dev_lock(hdev); + hci_store_wake_reason(hdev, &ev->bdaddr, BDADDR_BREDR); conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr); if (!conn) { @@ -5206,6 +5216,7 @@ static void le_conn_complete_evt(struct hci_dev *hdev, u8 status, u8 addr_type; hci_dev_lock(hdev); + hci_store_wake_reason(hdev, bdaddr, bdaddr_type); /* All controllers implicitly stop advertising in the event of a * connection, so ensure that the state bit is cleared. @@ -5737,6 +5748,8 @@ static void hci_le_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb) break; } + hci_store_wake_reason(hdev, &ev->bdaddr, ev->bdaddr_type); + if (ev->length <= HCI_MAX_AD_LENGTH && ev->data + ev->length <= skb_tail_pointer(skb)) { rssi = ev->data[ev->length]; @@ -5809,6 +5822,8 @@ static void hci_le_ext_adv_report_evt(struct hci_dev *hdev, struct sk_buff *skb) u8 legacy_evt_type; u16 evt_type; + hci_store_wake_reason(hdev, &ev->bdaddr, ev->bdaddr_type); + evt_type = __le16_to_cpu(ev->evt_type); legacy_evt_type = ext_evt_type_to_legacy(hdev, evt_type); if (legacy_evt_type != LE_ADV_INVALID) { @@ -6015,11 +6030,14 @@ static void hci_le_direct_adv_report_evt(struct hci_dev *hdev, hci_dev_lock(hdev); - for (; num_reports; num_reports--, ev++) + for (; num_reports; num_reports--, ev++) { + hci_store_wake_reason(hdev, &ev->bdaddr, ev->bdaddr_type); + process_adv_report(hdev, ev->evt_type, &ev->bdaddr, - ev->bdaddr_type, &ev->direct_addr, - ev->direct_addr_type, ev->rssi, NULL, 0, - false); + ev->bdaddr_type, &ev->direct_addr, + ev->direct_addr_type, ev->rssi, NULL, 0, + false); + } hci_dev_unlock(hdev); } @@ -6155,73 +6173,30 @@ static bool hci_get_cmd_complete(struct hci_dev *hdev, u16 opcode, return true; } -static void hci_store_wake_reason(struct hci_dev *hdev, u8 event, - struct sk_buff *skb) +static void hci_store_wake_reason(struct hci_dev *hdev, + const bdaddr_t *bdaddr, u8 addr_type) + __must_hold(&hdev->lock) { - struct hci_ev_le_advertising_info *adv; - struct hci_ev_le_direct_adv_info *direct_adv; - struct hci_ev_le_ext_adv_report *ext_adv; - const struct hci_ev_conn_complete *conn_complete = (void *)skb->data; - const struct hci_ev_conn_request *conn_request = (void *)skb->data; - - hci_dev_lock(hdev); + lockdep_assert_held(&hdev->lock); /* If we are currently suspended and this is the first BT event seen, * save the wake reason associated with the event. */ if (!hdev->suspended || hdev->wake_reason) - goto unlock; + return; + + if (!bdaddr) { + hdev->wake_reason = MGMT_WAKE_REASON_UNEXPECTED; + return; + } /* Default to remote wake. Values for wake_reason are documented in the * Bluez mgmt api docs. */ hdev->wake_reason = MGMT_WAKE_REASON_REMOTE_WAKE; - /* Once configured for remote wakeup, we should only wake up for - * reconnections. It's useful to see which device is waking us up so - * keep track of the bdaddr of the connection event that woke us up. - */ - if (event == HCI_EV_CONN_REQUEST) { - bacpy(&hdev->wake_addr, &conn_request->bdaddr); - hdev->wake_addr_type = BDADDR_BREDR; - } else if (event == HCI_EV_CONN_COMPLETE) { - bacpy(&hdev->wake_addr, &conn_complete->bdaddr); - hdev->wake_addr_type = BDADDR_BREDR; - } else if (event == HCI_EV_LE_META) { - struct hci_ev_le_meta *le_ev = (void *)skb->data; - u8 subevent = le_ev->subevent; - u8 *ptr = &skb->data[sizeof(*le_ev)]; - u8 num_reports = *ptr; - - if ((subevent == HCI_EV_LE_ADVERTISING_REPORT || - subevent == HCI_EV_LE_DIRECT_ADV_REPORT || - subevent == HCI_EV_LE_EXT_ADV_REPORT) && - num_reports) { - adv = (void *)(ptr + 1); - direct_adv = (void *)(ptr + 1); - ext_adv = (void *)(ptr + 1); - - switch (subevent) { - case HCI_EV_LE_ADVERTISING_REPORT: - bacpy(&hdev->wake_addr, &adv->bdaddr); - hdev->wake_addr_type = adv->bdaddr_type; - break; - case HCI_EV_LE_DIRECT_ADV_REPORT: - bacpy(&hdev->wake_addr, &direct_adv->bdaddr); - hdev->wake_addr_type = direct_adv->bdaddr_type; - break; - case HCI_EV_LE_EXT_ADV_REPORT: - bacpy(&hdev->wake_addr, &ext_adv->bdaddr); - hdev->wake_addr_type = ext_adv->bdaddr_type; - break; - } - } - } else { - hdev->wake_reason = MGMT_WAKE_REASON_UNEXPECTED; - } - -unlock: - hci_dev_unlock(hdev); + bacpy(&hdev->wake_addr, bdaddr); + hdev->wake_addr_type = addr_type; } void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb) @@ -6257,9 +6232,6 @@ void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb) skb_pull(skb, HCI_EVENT_HDR_SIZE); - /* Store wake reason if we're suspended */ - hci_store_wake_reason(hdev, event, skb); - switch (event) { case HCI_EV_INQUIRY_COMPLETE: hci_inquiry_complete_evt(hdev, skb); @@ -6446,6 +6418,10 @@ void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb) break; } + hci_dev_lock(hdev); + hci_store_wake_reason(hdev, NULL, 0); + hci_dev_unlock(hdev); + if (req_complete) { req_complete(hdev, status, opcode); } else if (req_complete_skb) { -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] ALSA: ctxfi: fix SPDIF1 mismatched
by Zhang Yuwei 13 May '26

13 May '26

The previous fix addressed the crash symptom by adding a fallback index mapping for SPDIFI1 on hw20k2 devices. However, SPDIFI1 is a special DAIO type intended only for the hw20k1 CTSB073X model and should never be enumerated on hw20k2 in the first place. The real regression was introduced by the sparse DAIO mapping refactoring, which changed the DAIO initialization loop to iterate over all DAIOTYP entries, including SPDIFI1. As hw20k2 lacks a valid SPDIFI1 definition, this eventually led to invalid index handling and out-of-bounds access. Instead of adding special-case index handling for an invalid DAIO type, fix the root cause by skipping SPDIFI1 during generic DAIO enumeration and only mapping SPDIFIO to SPDIFI1 for the CTSB073X model as originally intended. With this change applied, the earlier workaround patch is no longer needed. Takashi Iwai (2): ALSA: ctxfi: Fix missing SPDIFI1 index handling ALSA: ctxfi: Don't enumerate SPDIF1 at DAIO initialization sound/pci/ctxfi/ctatc.c | 8 ++++++-- sound/pci/ctxfi/ctdaio.c | 1 + 2 files changed, 7 insertions(+), 2 deletions(-) -- 2.22.0

2 3

[PATCH openEuler-1.0-LTS 0/2] CVE-2026-43048
by Liu Kai 13 May '26

13 May '26

CVE-2026-43048 Lee Jones (1): HID: core: Mitigate potential OOB by removing bogus memset() Vicki Pfau (1): HID: core: Add printk_ratelimited variants to hid_warn() etc drivers/hid/hid-core.c | 7 ++++--- include/linux/hid.h | 11 +++++++++++ 2 files changed, 15 insertions(+), 3 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] perf/x86/intel/uncore: Fix die ID init and look up bugs
by Luo Gengkun 13 May '26

13 May '26

From: Zide Chen <zide.chen(a)intel.com> mainline inclusion from mainline-v7.0 commit a16d1ec4dd0cdcf689f324adde6067083bce9099 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14902 CVE: CVE-2026-43344 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- In snbep_pci2phy_map_init(), in the nr_node_ids > 8 path, uncore_device_to_die() may return -1 when all CPUs associated with the UBOX device are offline. Remove the WARN_ON_ONCE(die_id == -1) check for two reasons: - The current code breaks out of the loop. This is incorrect because pci_get_device() does not guarantee iteration in domain or bus order, so additional UBOX devices may be skipped during the scan. - Returning -EINVAL is incorrect, since marking offline buses with die_id == -1 is expected and should not be treated as an error. Separately, when NUMA is disabled on a NUMA-capable platform, pcibus_to_node() returns NUMA_NO_NODE, causing uncore_device_to_die() to return -1 for all PCI devices. As a result, spr_update_device_location(), used on Intel SPR and EMR, ignores the corresponding PMON units and does not add them to the RB tree. Fix this by using uncore_pcibus_to_dieid(), which retrieves topology from the UBOX GIDNIDMAP register and works regardless of whether NUMA is enabled in Linux. This requires snbep_pci2phy_map_init() to be added in spr_uncore_pci_init(). Keep uncore_device_to_die() only for the nr_node_ids > 8 case, where NUMA is expected to be enabled. Fixes: 9a7832ce3d92 ("perf/x86/intel/uncore: With > 8 nodes, get pci bus die id from NUMA info") Fixes: 65248a9a9ee1 ("perf/x86/uncore: Add a quirk for UPI on SPR") Signed-off-by: Zide Chen <zide.chen(a)intel.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Reviewed-by: Dapeng Mi <dapeng1.mi(a)linux.intel.com> Tested-by: Steve Wahl <steve.wahl(a)hpe.com> Link: https://patch.msgid.link/20260313174050.171704-4-zide.chen@intel.com Conflicts: arch/x86/events/intel/uncore_snbep.c [Fix context diff.] Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- arch/x86/events/intel/uncore.c | 1 + arch/x86/events/intel/uncore_snbep.c | 13 ++++++------- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/arch/x86/events/intel/uncore.c b/arch/x86/events/intel/uncore.c index 56ad62097c80..377adddcca5f 100644 --- a/arch/x86/events/intel/uncore.c +++ b/arch/x86/events/intel/uncore.c @@ -66,6 +66,7 @@ int uncore_die_to_segment(int die) return bus ? pci_domain_nr(bus) : -EINVAL; } +/* Note: This API can only be used when NUMA information is available. */ int uncore_device_to_die(struct pci_dev *dev) { int node = pcibus_to_node(dev->bus); diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c index 08faac369397..f66ffc3b66ea 100644 --- a/arch/x86/events/intel/uncore_snbep.c +++ b/arch/x86/events/intel/uncore_snbep.c @@ -1465,13 +1465,7 @@ static int snbep_pci2phy_map_init(int devid, int nodeid_loc, int idmap_loc, bool } map->pbus_to_dieid[bus] = die_id = uncore_device_to_die(ubox_dev); - raw_spin_unlock(&pci2phy_map_lock); - - if (WARN_ON_ONCE(die_id == -1)) { - err = -EINVAL; - break; - } } } @@ -6528,7 +6522,7 @@ static void spr_update_device_location(int type_id) while ((dev = pci_get_device(PCI_VENDOR_ID_INTEL, device, dev)) != NULL) { - die = uncore_device_to_die(dev); + die = uncore_pcibus_to_dieid(dev->bus); if (die < 0) continue; @@ -6552,6 +6546,11 @@ static void spr_update_device_location(int type_id) int spr_uncore_pci_init(void) { + int ret = snbep_pci2phy_map_init(0x3250, SKX_CPUNODEID, SKX_GIDNIDMAP, true); + + if (ret) + return ret; + /* * The discovery table of UPI on some SPR variant is broken, * which impacts the detection of both UPI and M3UPI uncore PMON. -- 2.34.1

2 1

[PATCH OLK-6.6] smb: client: prevent races in ->query_interfaces()
by Li Lingfeng 13 May '26

13 May '26

From: Henrique Carvalho <henrique.carvalho(a)suse.com> stable inclusion from stable-v6.6.128 commit 93e8e3ee165ae4609a1222b516b573837103d2c3 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14783 CVE: CVE-2026-43239 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit c3c06e42e1527716c54f3ad2ced6a034b5f3a489 ] It was possible for two query interface works to be concurrently trying to update the interfaces. Prevent this by checking and updating iface_last_update under iface_lock. Signed-off-by: Henrique Carvalho <henrique.carvalho(a)suse.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/smb/client/smb2ops.c | 19 ++++++++----------- 1 file changed, 8 insertions(+), 11 deletions(-) diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c index b6528b81cd78..68378a27a489 100644 --- a/fs/smb/client/smb2ops.c +++ b/fs/smb/client/smb2ops.c @@ -595,13 +595,6 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf, p = buf; spin_lock(&ses->iface_lock); - /* do not query too frequently, this time with lock held */ - if (ses->iface_last_update && - time_before(jiffies, ses->iface_last_update + - (SMB_INTERFACE_POLL_INTERVAL * HZ))) { - spin_unlock(&ses->iface_lock); - return 0; - } /* * Go through iface_list and mark them as inactive @@ -624,7 +617,6 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf, "Empty network interface list returned by server %s\n", ses->server->hostname); rc = -EOPNOTSUPP; - ses->iface_last_update = jiffies; goto out; } @@ -753,8 +745,6 @@ parse_server_interfaces(struct network_interface_info_ioctl_rsp *buf, + sizeof(p->Next) && p->Next)) cifs_dbg(VFS, "%s: incomplete interface info\n", __func__); - ses->iface_last_update = jiffies; - out: /* * Go through the list again and put the inactive entries @@ -783,10 +773,17 @@ SMB3_request_interfaces(const unsigned int xid, struct cifs_tcon *tcon, bool in_ struct TCP_Server_Info *pserver; /* do not query too frequently */ + spin_lock(&ses->iface_lock); if (ses->iface_last_update && time_before(jiffies, ses->iface_last_update + - (SMB_INTERFACE_POLL_INTERVAL * HZ))) + (SMB_INTERFACE_POLL_INTERVAL * HZ))) { + spin_unlock(&ses->iface_lock); return 0; + } + + ses->iface_last_update = jiffies; + + spin_unlock(&ses->iface_lock); rc = SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID, FSCTL_QUERY_NETWORK_INTERFACE_INFO, -- 2.52.0

2 1

[PATCH] Bluetooth: hci_event: move wake reason storage into validated event handlers
by Chen Jinghuang 13 May '26

13 May '26

From: Oleh Konko <security(a)1seal.org> hci_store_wake_reason() is called from hci_event_packet() immediately after stripping the HCI event header but before hci_event_func() enforces the per-event minimum payload length from hci_ev_table. This means a short HCI event frame can reach bacpy() before any bounds check runs. Rather than duplicating skb parsing and per-event length checks inside hci_store_wake_reason(), move wake-address storage into the individual event handlers after their existing event-length validation has succeeded. Convert hci_store_wake_reason() into a small helper that only stores an already-validated bdaddr while the caller holds hci_dev_lock(). Use the same helper after hci_event_func() with a NULL address to preserve the existing unexpected-wake fallback semantics when no validated event handler records a wake address. Annotate the helper with __must_hold(&hdev->lock) and add lockdep_assert_held(&hdev->lock) so future call paths keep the lock contract explicit. Call the helper from hci_conn_request_evt(), hci_conn_complete_evt(), hci_sync_conn_complete_evt(), le_conn_complete_evt(), hci_le_adv_report_evt(), hci_le_ext_adv_report_evt(), hci_le_direct_adv_report_evt(), hci_le_pa_sync_established_evt(), and hci_le_past_received_evt(). Fixes: 2f20216c1d6f ("Bluetooth: Emit controller suspend and resume events") Cc: stable(a)vger.kernel.org Signed-off-by: Oleh Konko <security(a)1seal.org> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> --- net/bluetooth/hci_event.c.rej | 195 ++++++++++++++++++++++++++++++++++ 1 file changed, 195 insertions(+) create mode 100644 net/bluetooth/hci_event.c.rej diff --git a/net/bluetooth/hci_event.c.rej b/net/bluetooth/hci_event.c.rej new file mode 100644 index 000000000000..99f9b2368f7d --- /dev/null +++ b/net/bluetooth/hci_event.c.rej @@ -0,0 +1,195 @@ +diff a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c (rejected hunks) +@@ -80,6 +80,10 @@ static void *hci_le_ev_skb_pull(struct hci_dev *hdev, struct sk_buff *skb, + return data; + } + ++static void hci_store_wake_reason(struct hci_dev *hdev, ++ const bdaddr_t *bdaddr, u8 addr_type) ++ __must_hold(&hdev->lock); ++ + static u8 hci_cc_inquiry_cancel(struct hci_dev *hdev, void *data, + struct sk_buff *skb) + { +@@ -3111,6 +3115,7 @@ static void hci_conn_complete_evt(struct hci_dev *hdev, void *data, + bt_dev_dbg(hdev, "status 0x%2.2x", status); + + hci_dev_lock(hdev); ++ hci_store_wake_reason(hdev, &ev->bdaddr, BDADDR_BREDR); + + /* Check for existing connection: + * +@@ -3274,6 +3279,10 @@ static void hci_conn_request_evt(struct hci_dev *hdev, void *data, + + bt_dev_dbg(hdev, "bdaddr %pMR type 0x%x", &ev->bdaddr, ev->link_type); + ++ hci_dev_lock(hdev); ++ hci_store_wake_reason(hdev, &ev->bdaddr, BDADDR_BREDR); ++ hci_dev_unlock(hdev); ++ + /* Reject incoming connection from device with same BD ADDR against + * CVE-2020-26555 + */ +@@ -5021,6 +5030,7 @@ static void hci_sync_conn_complete_evt(struct hci_dev *hdev, void *data, + bt_dev_dbg(hdev, "status 0x%2.2x", status); + + hci_dev_lock(hdev); ++ hci_store_wake_reason(hdev, &ev->bdaddr, BDADDR_BREDR); + + conn = hci_conn_hash_lookup_ba(hdev, ev->link_type, &ev->bdaddr); + if (!conn) { +@@ -5713,6 +5723,7 @@ static void le_conn_complete_evt(struct hci_dev *hdev, u8 status, + int err; + + hci_dev_lock(hdev); ++ hci_store_wake_reason(hdev, bdaddr, bdaddr_type); + + /* All controllers implicitly stop advertising in the event of a + * connection, so ensure that the state bit is cleared. +@@ -6005,6 +6016,7 @@ static void hci_le_past_received_evt(struct hci_dev *hdev, void *data, + bt_dev_dbg(hdev, "status 0x%2.2x", ev->status); + + hci_dev_lock(hdev); ++ hci_store_wake_reason(hdev, &ev->bdaddr, ev->bdaddr_type); + + hci_dev_clear_flag(hdev, HCI_PA_SYNC); + +@@ -6403,6 +6415,8 @@ static void hci_le_adv_report_evt(struct hci_dev *hdev, void *data, + info->length + 1)) + break; + ++ hci_store_wake_reason(hdev, &info->bdaddr, info->bdaddr_type); ++ + if (info->length <= max_adv_len(hdev)) { + rssi = info->data[info->length]; + process_adv_report(hdev, info->type, &info->bdaddr, +@@ -6491,6 +6505,8 @@ static void hci_le_ext_adv_report_evt(struct hci_dev *hdev, void *data, + info->length)) + break; + ++ hci_store_wake_reason(hdev, &info->bdaddr, info->bdaddr_type); ++ + evt_type = __le16_to_cpu(info->type) & LE_EXT_ADV_EVT_TYPE_MASK; + legacy_evt_type = ext_evt_type_to_legacy(hdev, evt_type); + +@@ -6536,6 +6552,7 @@ static void hci_le_pa_sync_established_evt(struct hci_dev *hdev, void *data, + bt_dev_dbg(hdev, "status 0x%2.2x", ev->status); + + hci_dev_lock(hdev); ++ hci_store_wake_reason(hdev, &ev->bdaddr, ev->bdaddr_type); + + hci_dev_clear_flag(hdev, HCI_PA_SYNC); + +@@ -6834,6 +6851,8 @@ static void hci_le_direct_adv_report_evt(struct hci_dev *hdev, void *data, + for (i = 0; i < ev->num; i++) { + struct hci_ev_le_direct_adv_info *info = &ev->info[i]; + ++ hci_store_wake_reason(hdev, &info->bdaddr, info->bdaddr_type); ++ + process_adv_report(hdev, info->type, &info->bdaddr, + info->bdaddr_type, &info->direct_addr, + info->direct_addr_type, HCI_ADV_PHY_1M, 0, +@@ -7517,73 +7536,29 @@ static bool hci_get_cmd_complete(struct hci_dev *hdev, u16 opcode, + return true; + } + +-static void hci_store_wake_reason(struct hci_dev *hdev, u8 event, +- struct sk_buff *skb) ++static void hci_store_wake_reason(struct hci_dev *hdev, ++ const bdaddr_t *bdaddr, u8 addr_type) ++ __must_hold(&hdev->lock) + { +- struct hci_ev_le_advertising_info *adv; +- struct hci_ev_le_direct_adv_info *direct_adv; +- struct hci_ev_le_ext_adv_info *ext_adv; +- const struct hci_ev_conn_complete *conn_complete = (void *)skb->data; +- const struct hci_ev_conn_request *conn_request = (void *)skb->data; +- +- hci_dev_lock(hdev); ++ lockdep_assert_held(&hdev->lock); + + /* If we are currently suspended and this is the first BT event seen, + * save the wake reason associated with the event. + */ + if (!hdev->suspended || hdev->wake_reason) +- goto unlock; ++ return; ++ ++ if (!bdaddr) { ++ hdev->wake_reason = MGMT_WAKE_REASON_UNEXPECTED; ++ return; ++ } + + /* Default to remote wake. Values for wake_reason are documented in the + * Bluez mgmt api docs. + */ + hdev->wake_reason = MGMT_WAKE_REASON_REMOTE_WAKE; +- +- /* Once configured for remote wakeup, we should only wake up for +- * reconnections. It's useful to see which device is waking us up so +- * keep track of the bdaddr of the connection event that woke us up. +- */ +- if (event == HCI_EV_CONN_REQUEST) { +- bacpy(&hdev->wake_addr, &conn_request->bdaddr); +- hdev->wake_addr_type = BDADDR_BREDR; +- } else if (event == HCI_EV_CONN_COMPLETE) { +- bacpy(&hdev->wake_addr, &conn_complete->bdaddr); +- hdev->wake_addr_type = BDADDR_BREDR; +- } else if (event == HCI_EV_LE_META) { +- struct hci_ev_le_meta *le_ev = (void *)skb->data; +- u8 subevent = le_ev->subevent; +- u8 *ptr = &skb->data[sizeof(*le_ev)]; +- u8 num_reports = *ptr; +- +- if ((subevent == HCI_EV_LE_ADVERTISING_REPORT || +- subevent == HCI_EV_LE_DIRECT_ADV_REPORT || +- subevent == HCI_EV_LE_EXT_ADV_REPORT) && +- num_reports) { +- adv = (void *)(ptr + 1); +- direct_adv = (void *)(ptr + 1); +- ext_adv = (void *)(ptr + 1); +- +- switch (subevent) { +- case HCI_EV_LE_ADVERTISING_REPORT: +- bacpy(&hdev->wake_addr, &adv->bdaddr); +- hdev->wake_addr_type = adv->bdaddr_type; +- break; +- case HCI_EV_LE_DIRECT_ADV_REPORT: +- bacpy(&hdev->wake_addr, &direct_adv->bdaddr); +- hdev->wake_addr_type = direct_adv->bdaddr_type; +- break; +- case HCI_EV_LE_EXT_ADV_REPORT: +- bacpy(&hdev->wake_addr, &ext_adv->bdaddr); +- hdev->wake_addr_type = ext_adv->bdaddr_type; +- break; +- } +- } +- } else { +- hdev->wake_reason = MGMT_WAKE_REASON_UNEXPECTED; +- } +- +-unlock: +- hci_dev_unlock(hdev); ++ bacpy(&hdev->wake_addr, bdaddr); ++ hdev->wake_addr_type = addr_type; + } + + #define HCI_EV_VL(_op, _func, _min_len, _max_len) \ +@@ -7830,14 +7805,15 @@ void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb) + + skb_pull(skb, HCI_EVENT_HDR_SIZE); + +- /* Store wake reason if we're suspended */ +- hci_store_wake_reason(hdev, event, skb); +- + bt_dev_dbg(hdev, "event 0x%2.2x", event); + + hci_event_func(hdev, event, skb, &opcode, &status, &req_complete, + &req_complete_skb); + ++ hci_dev_lock(hdev); ++ hci_store_wake_reason(hdev, NULL, 0); ++ hci_dev_unlock(hdev); ++ + if (req_complete) { + req_complete(hdev, status, opcode); + } else if (req_complete_skb) { -- 2.34.1

1 0

[PATCH OLK-6.6] ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop()
by Zhang Changzhong 13 May '26

13 May '26

From: Fernando Fernandez Mancera <fmancera(a)suse.de> mainline inclusion from mainline-v7.0 commit 14cf0cd35361f4e94824bf8a42f72713d7702a73 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14275 CVE: CVE-2026-31531 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When querying a nexthop object via RTM_GETNEXTHOP, the kernel currently allocates a fixed-size skb using NLMSG_GOODSIZE. While sufficient for single nexthops and small Equal-Cost Multi-Path groups, this fixed allocation fails for large nexthop groups like 512 nexthops. This results in the following warning splat: WARNING: net/ipv4/nexthop.c:3395 at rtm_get_nexthop+0x176/0x1c0, CPU#20: rep/4608 [...] RIP: 0010:rtm_get_nexthop (net/ipv4/nexthop.c:3395) [...] Call Trace: <TASK> rtnetlink_rcv_msg (net/core/rtnetlink.c:6989) netlink_rcv_skb (net/netlink/af_netlink.c:2550) netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344) netlink_sendmsg (net/netlink/af_netlink.c:1894) ____sys_sendmsg (net/socket.c:721 net/socket.c:736 net/socket.c:2585) ___sys_sendmsg (net/socket.c:2641) __sys_sendmsg (net/socket.c:2671) do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) </TASK> Fix this by allocating the size dynamically using nh_nlmsg_size() and using nlmsg_new(), this is consistent with nexthop_notify() behavior. In addition, adjust nh_nlmsg_size_grp() so it calculates the size needed based on flags passed. While at it, also add the size of NHA_FDB for nexthop group size calculation as it was missing too. This cannot be reproduced via iproute2 as the group size is currently limited and the command fails as follows: addattr_l ERROR: message exceeded bound of 1048 Fixes: 430a049190de ("nexthop: Add support for nexthop groups") Reported-by: Yiming Qian <yimingqian591(a)gmail.com> Closes: https://lore.kernel.org/netdev/CAL_bE8Li2h4KO+AQFXW4S6Yb_u5X4oSKnkywW+LPFju… Signed-off-by: Fernando Fernandez Mancera <fmancera(a)suse.de> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Ido Schimmel <idosch(a)nvidia.com> Link: https://patch.msgid.link/20260402072613.25262-2-fmancera@suse.de Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv4/nexthop.c [commit 75bab45e6b2d ("net: nexthop: Add flag to assert that NHGRP reserved fields are zero") and 95fedd768591 ("net: nexthop: Expose nexthop group stats to user space") not merged] Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- net/ipv4/nexthop.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/net/ipv4/nexthop.c b/net/ipv4/nexthop.c index 99385fe..b7b86e1 100644 --- a/net/ipv4/nexthop.c +++ b/net/ipv4/nexthop.c @@ -786,7 +786,8 @@ static size_t nh_nlmsg_size_grp(struct nexthop *nh) struct nh_group *nhg = rtnl_dereference(nh->nh_grp); size_t sz = sizeof(struct nexthop_grp) * nhg->num_nh; size_t tot = nla_total_size(sz) + - nla_total_size(2); /* NHA_GROUP_TYPE */ + nla_total_size(2) + /* NHA_GROUP_TYPE */ + nla_total_size(0); /* NHA_FDB */ if (nhg->resilient) tot += nh_nlmsg_size_grp_res(nhg); @@ -3061,15 +3062,15 @@ static int rtm_get_nexthop(struct sk_buff *in_skb, struct nlmsghdr *nlh, if (err) return err; - err = -ENOBUFS; - skb = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL); - if (!skb) - goto out; - err = -ENOENT; nh = nexthop_find_by_id(net, id); if (!nh) - goto errout_free; + goto out; + + err = -ENOBUFS; + skb = nlmsg_new(nh_nlmsg_size(nh), GFP_KERNEL); + if (!skb) + goto out; err = nh_fill_node(skb, nh, RTM_NEWNEXTHOP, NETLINK_CB(in_skb).portid, nlh->nlmsg_seq, 0); -- 2.9.5

2 1