- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] btrfs: tracepoints: get correct superblock from dentry in event btrfs_sync_file()
by Pan Taixi 18 May '26

18 May '26

From: Goldwyn Rodrigues <rgoldwyn(a)suse.de> stable inclusion from stable-v6.6.136 commit c09a7446aab5773f38d6abb25fce99b8e1dfbc97 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14618 CVE: CVE-2026-43117 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a85b46db143fda5869e7d8df8f258ccef5fa1719 ] If overlay is used on top of btrfs, dentry->d_sb translates to overlay's super block and fsid assignment will lead to a crash. Use file_inode(file)->i_sb to always get btrfs_sb. Reviewed-by: Boris Burkov <boris(a)bur.io> Signed-off-by: Goldwyn Rodrigues <rgoldwyn(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com> --- include/trace/events/btrfs.h | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/include/trace/events/btrfs.h b/include/trace/events/btrfs.h index f759109caeea..4fef4f8c3138 100644 --- a/include/trace/events/btrfs.h +++ b/include/trace/events/btrfs.h @@ -789,12 +789,15 @@ TRACE_EVENT(btrfs_sync_file, ), TP_fast_assign( - const struct dentry *dentry = file->f_path.dentry; - const struct inode *inode = d_inode(dentry); + struct dentry *dentry = file_dentry(file); + struct inode *inode = file_inode(file); + struct dentry *parent = dget_parent(dentry); + struct inode *parent_inode = d_inode(parent); - TP_fast_assign_fsid(btrfs_sb(file->f_path.dentry->d_sb)); + dput(parent); + TP_fast_assign_fsid(btrfs_sb(inode->i_sb)); __entry->ino = btrfs_ino(BTRFS_I(inode)); - __entry->parent = btrfs_ino(BTRFS_I(d_inode(dentry->d_parent))); + __entry->parent = btrfs_ino(BTRFS_I(parent_inode)); __entry->datasync = datasync; __entry->root_objectid = BTRFS_I(inode)->root->root_key.objectid; -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] Fix CVE-2026-31477
by Li Lingfeng 18 May '26

18 May '26

Jeff Layton (1): ksmbd: use F_SETLK when unlocking a file Werner Kasselman (1): ksmbd: fix memory leaks and NULL deref in smb2_lock() fs/ksmbd/smb2pdu.c | 29 +++++++++++++++++++---------- 1 file changed, 19 insertions(+), 10 deletions(-) -- 2.52.0

2 3

[PATCH OLK-6.6] blk-cgroup: skip dying blkg in blkcg_activate_policy()
by Zizhi Wo 16 May '26

16 May '26

From: Zheng Qixing <zhengqixing(a)huawei.com> maillist inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8427 Reference: https://lore.kernel.org/all/20260304073809.3438679-5-yukuai@fnnas.com/ -------------------------------- When switching IO schedulers on a block device, blkcg_activate_policy() can race with concurrent blkcg deletion, leading to a use-after-free in rcu_accelerate_cbs. T1: T2: blkg_destroy kill(&blkg->refcnt) // blkg->refcnt=1->0 blkg_release // call_rcu(__blkg_release) ... blkg_free_workfn ->pd_free_fn(pd) elv_iosched_store elevator_switch ... iterate blkg list blkg_get(blkg) // blkg->refcnt=0->1 list_del_init(&blkg->q_node) blkg_put(pinned_blkg) // blkg->refcnt=1->0 blkg_release // call_rcu again rcu_accelerate_cbs // uaf Fix this by checking hlist_unhashed(&blkg->blkcg_node) before getting a reference to the blkg. This is the same check used in blkg_destroy() to detect if a blkg has already been destroyed. If the blkg is already unhashed, skip processing it since it's being destroyed. Link: https://lore.kernel.org/all/20260108014416.3656493-4-zhengqixing@huaweiclou… Fixes: f1c006f1c685 ("blk-cgroup: synchronize pd_free_fn() from blkg_free_workfn() and blkcg_deactivate_policy()") Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> Signed-off-by: Yu Kuai <yukuai(a)fnnas.com> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- block/blk-cgroup.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c index ed387265f996..ca5485f04dab 100644 --- a/block/blk-cgroup.c +++ b/block/blk-cgroup.c @@ -1580,10 +1580,12 @@ int blkcg_activate_policy(struct gendisk *disk, const struct blkcg_policy *pol) list_for_each_entry_reverse(blkg, &q->blkg_list, q_node) { struct blkg_policy_data *pd; if (blkg->pd[pol->plid]) continue; + if (hlist_unhashed(&blkg->blkcg_node)) + continue; /* If prealloc matches, use it; otherwise try GFP_NOWAIT */ if (blkg == pinned_blkg) { pd = pd_prealloc; pd_prealloc = NULL; -- 2.52.0

2 1

[PATCH openEuler-1.0-LTS 0/2] CVE-2026-46333
by Pu Lehui 16 May '26

16 May '26

Linus Torvalds (1): ptrace: slightly saner 'get_dumpable()' logic Pu Lehui (1): ptrace: Fix kabi breakage in struct task_struct include/linux/sched.h | 5 +++++ kernel/exit.c | 1 + kernel/ptrace.c | 22 ++++++++++++++++------ 3 files changed, 22 insertions(+), 6 deletions(-) -- 2.34.1

2 4

[PATCH OLK-6.6 0/2] CVE-2026-46333
by Pu Lehui 16 May '26

16 May '26

Linus Torvalds (1): ptrace: slightly saner 'get_dumpable()' logic Pu Lehui (1): ptrace: Fix kabi breakage in struct task_struct include/linux/sched.h | 2 ++ kernel/exit.c | 1 + kernel/ptrace.c | 22 ++++++++++++++++------ 3 files changed, 19 insertions(+), 6 deletions(-) -- 2.34.1

2 4

[PATCH OLK-5.10 0/2] CVE-2026-46333
by Pu Lehui 16 May '26

16 May '26

Linus Torvalds (1): ptrace: slightly saner 'get_dumpable()' logic Pu Lehui (1): ptrace: Fix kabi breakage in struct task_struct include/linux/sched.h | 2 ++ kernel/exit.c | 1 + kernel/ptrace.c | 22 ++++++++++++++++------ 3 files changed, 19 insertions(+), 6 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] usb: xhci: Prevent interrupt storm on host controller error (HCE)
by Jinjie Ruan 15 May '26

15 May '26

From: Dayu Jiang <jiangdayu(a)xiaomi.com> stable inclusion from stable-v6.6.130 commit b2dd9abf8c06cfcbcf242321fd54ae51a4807705 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15046 CVE: CVE-2026-43488 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit d6d5febd12452b7fd951fdd15c3ec262f01901a4 upstream. The xHCI controller reports a Host Controller Error (HCE) in UAS Storage Device plug/unplug scenarios on Android devices. HCE is checked in xhci_irq() function and causes an interrupt storm (since the interrupt isn’t cleared), leading to severe system-level faults. When the xHC controller reports HCE in the interrupt handler, the driver only logs a warning and assumes xHC activity will stop as stated in xHCI specification. An interrupt storm does however continue on some hosts even after HCE, and only ceases after manually disabling xHC interrupt and stopping the controller by calling xhci_halt(). Add xhci_halt() to xhci_irq() function where STS_HCE status is checked, mirroring the existing error handling pattern used for STS_FATAL errors. This only fixes the interrupt storm. Proper HCE recovery requires resetting and re-initializing the xHC. CC: stable(a)vger.kernel.org Signed-off-by: Dayu Jiang <jiangdayu(a)xiaomi.com> Signed-off-by: Mathias Nyman <mathias.nyman(a)linux.intel.com> Link: https://patch.msgid.link/20260304223639.3882398-3-mathias.nyman@linux.intel… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- drivers/usb/host/xhci-ring.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c index 24d045889c6e..e804aea23063 100644 --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -3221,6 +3221,7 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd) if (status & STS_HCE) { xhci_warn(xhci, "WARNING: Host Controller Error\n"); + xhci_halt(xhci); goto out; } -- 2.34.1

2 1

[PATCH OLK-5.10] usb: xhci: Prevent interrupt storm on host controller error (HCE)
by Jinjie Ruan 15 May '26

15 May '26

From: Dayu Jiang <jiangdayu(a)xiaomi.com> stable inclusion from stable-v6.6.130 commit b2dd9abf8c06cfcbcf242321fd54ae51a4807705 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15046 CVE: CVE-2026-43488 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit d6d5febd12452b7fd951fdd15c3ec262f01901a4 upstream. The xHCI controller reports a Host Controller Error (HCE) in UAS Storage Device plug/unplug scenarios on Android devices. HCE is checked in xhci_irq() function and causes an interrupt storm (since the interrupt isn’t cleared), leading to severe system-level faults. When the xHC controller reports HCE in the interrupt handler, the driver only logs a warning and assumes xHC activity will stop as stated in xHCI specification. An interrupt storm does however continue on some hosts even after HCE, and only ceases after manually disabling xHC interrupt and stopping the controller by calling xhci_halt(). Add xhci_halt() to xhci_irq() function where STS_HCE status is checked, mirroring the existing error handling pattern used for STS_FATAL errors. This only fixes the interrupt storm. Proper HCE recovery requires resetting and re-initializing the xHC. CC: stable(a)vger.kernel.org Signed-off-by: Dayu Jiang <jiangdayu(a)xiaomi.com> Signed-off-by: Mathias Nyman <mathias.nyman(a)linux.intel.com> Link: https://patch.msgid.link/20260304223639.3882398-3-mathias.nyman@linux.intel… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- drivers/usb/host/xhci-ring.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c index 747403de8cb2..4aca4b517005 100644 --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -3163,6 +3163,7 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd) if (status & STS_HCE) { xhci_warn(xhci, "WARNING: Host Controller Error\n"); + xhci_halt(xhci); goto out; } -- 2.34.1

2 1

[PATCH OLK-6.6] KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated
by Jinjie Ruan 15 May '26

15 May '26

From: Sean Christopherson <seanjc(a)google.com> stable inclusion from stable-v6.6.130 commit 816fa1dfae4532e851b1fe6b2434c753ecbd86c7 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15045 CVE: CVE-2026-43483 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 87d0f901a9bd8ae6be57249c737f20ac0cace93d ] Explicitly set/clear CR8 write interception when AVIC is (de)activated to fix a bug where KVM leaves the interception enabled after AVIC is activated. E.g. if KVM emulates INIT=>WFS while AVIC is deactivated, CR8 will remain intercepted in perpetuity. On its own, the dangling CR8 intercept is "just" a performance issue, but combined with the TPR sync bug fixed by commit d02e48830e3f ("KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active"), the danging intercept is fatal to Windows guests as the TPR seen by hardware gets wildly out of sync with reality. Note, VMX isn't affected by the bug as TPR_THRESHOLD is explicitly ignored when Virtual Interrupt Delivery is enabled, i.e. when APICv is active in KVM's world. I.e. there's no need to trigger update_cr8_intercept(), this is firmly an SVM implementation flaw/detail. WARN if KVM gets a CR8 write #VMEXIT while AVIC is active, as KVM should never enter the guest with AVIC enabled and CR8 writes intercepted. Fixes: 3bbf3565f48c ("svm: Do not intercept CR8 when enable AVIC") Cc: stable(a)vger.kernel.org Cc: Jim Mattson <jmattson(a)google.com> Cc: Naveen N Rao (AMD) <naveen(a)kernel.org> Cc: Maciej S. Szmigiero <maciej.szmigiero(a)oracle.com> Reviewed-by: Naveen N Rao (AMD) <naveen(a)kernel.org> Reviewed-by: Jim Mattson <jmattson(a)google.com> Link: https://patch.msgid.link/20260203190711.458413-3-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc(a)google.com> [Squash fix to avic_deactivate_vmcb. - Paolo] Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> conflict: arch/x86/kvm/svm/avic.c [Conflict conflicts.] Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- arch/x86/kvm/svm/avic.c | 6 +++++- arch/x86/kvm/svm/svm.c | 7 ++++--- 2 files changed, 9 insertions(+), 4 deletions(-) diff --git a/arch/x86/kvm/svm/avic.c b/arch/x86/kvm/svm/avic.c index 6970b11a6b4c..5d4d1d2ebba9 100644 --- a/arch/x86/kvm/svm/avic.c +++ b/arch/x86/kvm/svm/avic.c @@ -88,9 +88,10 @@ static void avic_activate_vmcb(struct vcpu_svm *svm) vmcb->control.int_ctl &= ~(AVIC_ENABLE_MASK | X2APIC_MODE_MASK); vmcb->control.avic_physical_id &= ~AVIC_PHYSICAL_MAX_INDEX_MASK; - vmcb->control.int_ctl |= AVIC_ENABLE_MASK; + svm_clr_intercept(svm, INTERCEPT_CR8_WRITE); + /* * Note: KVM supports hybrid-AVIC mode, where KVM emulates x2APIC MSR * accesses, while interrupt injection to a running vCPU can be @@ -124,6 +125,9 @@ static void avic_deactivate_vmcb(struct vcpu_svm *svm) vmcb->control.int_ctl &= ~(AVIC_ENABLE_MASK | X2APIC_MODE_MASK); vmcb->control.avic_physical_id &= ~AVIC_PHYSICAL_MAX_INDEX_MASK; + if (!sev_es_guest(svm->vcpu.kvm)) + svm_set_intercept(svm, INTERCEPT_CR8_WRITE); + /* * If running nested and the guest uses its own MSR bitmap, there * is no need to update L0's msr bitmap diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index e365c50b6d92..ad25a6995ee6 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -1279,8 +1279,7 @@ static void init_vmcb(struct kvm_vcpu *vcpu) svm_set_intercept(svm, INTERCEPT_CR0_WRITE); svm_set_intercept(svm, INTERCEPT_CR3_WRITE); svm_set_intercept(svm, INTERCEPT_CR4_WRITE); - if (!kvm_vcpu_apicv_active(vcpu)) - svm_set_intercept(svm, INTERCEPT_CR8_WRITE); + svm_set_intercept(svm, INTERCEPT_CR8_WRITE); set_dr_intercepts(svm); @@ -2836,9 +2835,11 @@ static int dr_interception(struct kvm_vcpu *vcpu) static int cr8_write_interception(struct kvm_vcpu *vcpu) { + u8 cr8_prev = kvm_get_cr8(vcpu); int r; - u8 cr8_prev = kvm_get_cr8(vcpu); + WARN_ON_ONCE(kvm_vcpu_apicv_active(vcpu)); + /* instruction emulation calls kvm_set_cr8() */ r = cr_interception(vcpu); if (lapic_in_kernel(vcpu)) -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] Fix CVE-2026-31709
by Li Lingfeng 15 May '26

15 May '26

Michael Bommarito (2): smb: client: validate the whole DACL before rewriting it in cifsacl smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl fs/smb/client/cifsacl.c | 115 +++++++++++++++++++++++++++++----------- 1 file changed, 85 insertions(+), 30 deletions(-) -- 2.52.0

2 3