- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10 0/2] CVE-2026-23209
by Li Xiasong 05 Mar '26

05 Mar '26

Eric Dumazet (2): macvlan: fix error recovery in macvlan_common_newlink() macvlan: observe an RCU grace period in macvlan_common_newlink() error path drivers/net/macvlan.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) -- 2.34.1

1 2

[PATCH openEuler-1.0-LTS 0/2] CVE-2026-23209
by Li Xiasong 05 Mar '26

05 Mar '26

Eric Dumazet (2): macvlan: fix error recovery in macvlan_common_newlink() macvlan: observe an RCU grace period in macvlan_common_newlink() error path drivers/net/macvlan.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) -- 2.34.1

1 2

[PATCH OLK-6.6] ipv6: annotate data-race in ndisc_router_discovery()
by Li Xiasong 05 Mar '26

05 Mar '26

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v6.6.122 commit fad8f4ff7928f4d52a062ffdcffa484989c79c47 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13674 CVE: CVE-2026-23124 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9a063f96d87efc3a6cc667f8de096a3d38d74bb5 ] syzbot found that ndisc_router_discovery() could read and write in6_dev->ra_mtu without holding a lock [1] This looks fine, IFLA_INET6_RA_MTU is best effort. Add READ_ONCE()/WRITE_ONCE() to document the race. Note that we might also reject illegal MTU values (mtu < IPV6_MIN_MTU || mtu > skb->dev->mtu) in a future patch. [1] BUG: KCSAN: data-race in ndisc_router_discovery / ndisc_router_discovery read to 0xffff888119809c20 of 4 bytes by task 25817 on cpu 1: ndisc_router_discovery+0x151d/0x1c90 net/ipv6/ndisc.c:1558 ndisc_rcv+0x2ad/0x3d0 net/ipv6/ndisc.c:1841 icmpv6_rcv+0xe5a/0x12f0 net/ipv6/icmp.c:989 ip6_protocol_deliver_rcu+0xb2a/0x10d0 net/ipv6/ip6_input.c:438 ip6_input_finish+0xf0/0x1d0 net/ipv6/ip6_input.c:489 NF_HOOK include/linux/netfilter.h:318 [inline] ip6_input+0x5e/0x140 net/ipv6/ip6_input.c:500 ip6_mc_input+0x27c/0x470 net/ipv6/ip6_input.c:590 dst_input include/net/dst.h:474 [inline] ip6_rcv_finish+0x336/0x340 net/ipv6/ip6_input.c:79 ... write to 0xffff888119809c20 of 4 bytes by task 25816 on cpu 0: ndisc_router_discovery+0x155a/0x1c90 net/ipv6/ndisc.c:1559 ndisc_rcv+0x2ad/0x3d0 net/ipv6/ndisc.c:1841 icmpv6_rcv+0xe5a/0x12f0 net/ipv6/icmp.c:989 ip6_protocol_deliver_rcu+0xb2a/0x10d0 net/ipv6/ip6_input.c:438 ip6_input_finish+0xf0/0x1d0 net/ipv6/ip6_input.c:489 NF_HOOK include/linux/netfilter.h:318 [inline] ip6_input+0x5e/0x140 net/ipv6/ip6_input.c:500 ip6_mc_input+0x27c/0x470 net/ipv6/ip6_input.c:590 dst_input include/net/dst.h:474 [inline] ip6_rcv_finish+0x336/0x340 net/ipv6/ip6_input.c:79 ... value changed: 0x00000000 -> 0xe5400659 Fixes: 49b99da2c9ce ("ipv6: add IFLA_INET6_RA_MTU to expose mtu value") Reported-by: syzbot <syzkaller(a)googlegroups.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Rocco Yue <rocco.yue(a)mediatek.com> Link: https://patch.msgid.link/20260118152941.2563857-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Li Xiasong <lixiasong1(a)huawei.com> --- net/ipv6/ndisc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c index 8d853971f2f6..29d7eb6ac2f8 100644 --- a/net/ipv6/ndisc.c +++ b/net/ipv6/ndisc.c @@ -1566,8 +1566,8 @@ static enum skb_drop_reason ndisc_router_discovery(struct sk_buff *skb) memcpy(&n, ((u8 *)(ndopts.nd_opts_mtu+1))+2, sizeof(mtu)); mtu = ntohl(n); - if (in6_dev->ra_mtu != mtu) { - in6_dev->ra_mtu = mtu; + if (READ_ONCE(in6_dev->ra_mtu) != mtu) { + WRITE_ONCE(in6_dev->ra_mtu, mtu); send_ifinfo_notify = true; } -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] CVE-2026-23209
by Li Xiasong 05 Mar '26

05 Mar '26

Eric Dumazet (2): macvlan: fix error recovery in macvlan_common_newlink() macvlan: observe an RCU grace period in macvlan_common_newlink() error path drivers/net/macvlan.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] mptcp: fix race in mptcp_pm_nl_flush_addrs_doit()
by Li Xiasong 05 Mar '26

05 Mar '26

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v6.18.9 commit 1f1b9523527df02685dde603f20ff6e603d8e4a1 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13719 CVE: CVE-2026-23169 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e2a9eeb69f7d4ca4cf4c70463af77664fdb6ab1d ] syzbot and Eulgyu Kim reported crashes in mptcp_pm_nl_get_local_id() and/or mptcp_pm_nl_is_backup() Root cause is list_splice_init() in mptcp_pm_nl_flush_addrs_doit() which is not RCU ready. list_splice_init_rcu() can not be called here while holding pernet->lock spinlock. Many thanks to Eulgyu Kim for providing a repro and testing our patches. Fixes: 141694df6573 ("mptcp: remove address when netlink flushes addrs") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reported-by: syzbot+5498a510ff9de39d37da(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/6970a46d.a00a0220.3ad28e.5cf0.GAE@google.com/T/ Reported-by: Eulgyu Kim <eulgyukim(a)snu.ac.kr> Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/611 Reviewed-by: Mat Martineau <martineau(a)kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe(a)kernel.org> Link: https://patch.msgid.link/20260124-net-mptcp-race_nl_flush_addrs-v3-1-b2dc1b… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: net/mptcp/pm_kernel.c net/mptcp/pm_netlink.c [conflicts due to not merge 35e71e43a56d ("mptcp: pm: in-kernel: rename 'local_addr_list' to 'endp_list'") and 8617e85e04bd ("mptcp: pm: split in-kernel PM specific code").] Signed-off-by: Li Xiasong <lixiasong1(a)huawei.com> --- net/mptcp/pm_netlink.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c index c41dc7fa983f..2b537828a20f 100644 --- a/net/mptcp/pm_netlink.c +++ b/net/mptcp/pm_netlink.c @@ -1750,16 +1750,26 @@ static void __reset_counters(struct pm_nl_pernet *pernet) int mptcp_pm_nl_flush_addrs_doit(struct sk_buff *skb, struct genl_info *info) { struct pm_nl_pernet *pernet = genl_info_pm_nl(info); - LIST_HEAD(free_list); + struct list_head free_list; spin_lock_bh(&pernet->lock); - list_splice_init(&pernet->local_addr_list, &free_list); + free_list = pernet->local_addr_list; + INIT_LIST_HEAD_RCU(&pernet->local_addr_list); __reset_counters(pernet); pernet->next_id = 1; bitmap_zero(pernet->id_bitmap, MPTCP_PM_MAX_ADDR_ID + 1); spin_unlock_bh(&pernet->lock); - mptcp_nl_flush_addrs_list(sock_net(skb->sk), &free_list); + + if (free_list.next == &pernet->local_addr_list) + return 0; + synchronize_rcu(); + + /* Adjust the pointers to free_list instead of pernet->local_addr_list */ + free_list.prev->next = &free_list; + free_list.next->prev = &free_list; + + mptcp_nl_flush_addrs_list(sock_net(skb->sk), &free_list); __flush_addrs(&free_list); return 0; } -- 2.34.1

2 1

[PATCH OLK-6.6] net: fix segmentation of forwarding fraglist GRO
by Li Xiasong 05 Mar '26

05 Mar '26

From: Jibin Zhang <jibin.zhang(a)mediatek.com> stable inclusion from stable-v6.12.69 commit 3e62db1e3140449608975e29e0979cc5f3b1cc07 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13704 CVE: CVE-2026-23154 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 426ca15c7f6cb6562a081341ca88893a50c59fa2 upstream. This patch enhances GSO segment handling by properly checking the SKB_GSO_DODGY flag for frag_list GSO packets, addressing low throughput issues observed when a station accesses IPv4 servers via hotspots with an IPv6-only upstream interface. Specifically, it fixes a bug in GSO segmentation when forwarding GRO packets containing a frag_list. The function skb_segment_list cannot correctly process GRO skbs that have been converted by XLAT, since XLAT only translates the header of the head skb. Consequently, skbs in the frag_list may remain untranslated, resulting in protocol inconsistencies and reduced throughput. To address this, the patch explicitly sets the SKB_GSO_DODGY flag for GSO packets in XLAT's IPv4/IPv6 protocol translation helpers (bpf_skb_proto_4_to_6 and bpf_skb_proto_6_to_4). This marks GSO packets as potentially modified after protocol translation. As a result, GSO segmentation will avoid using skb_segment_list and instead falls back to skb_segment for packets with the SKB_GSO_DODGY flag. This ensures that only safe and fully translated frag_list packets are processed by skb_segment_list, resolving protocol inconsistencies and improving throughput when forwarding GRO packets converted by XLAT. Signed-off-by: Jibin Zhang <jibin.zhang(a)mediatek.com> Fixes: 9fd1ff5d2ac7 ("udp: Support UDP fraglist GRO/GSO.") Cc: stable(a)vger.kernel.org Link: https://patch.msgid.link/20260126152114.1211-1-jibin.zhang@mediatek.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: net/ipv4/tcp_offload.c net/ipv6/tcpv6_offload.c [conflicts due to not merge bee88cd5bd83 ("net: add support for segmenting TCP fraglist GSO packets") and 17bd3bd82f9f ("net: gso: fix tcp fraglist segmentation after pull from frag_list").] Signed-off-by: Li Xiasong <lixiasong1(a)huawei.com> --- net/core/filter.c | 2 ++ net/ipv4/udp_offload.c | 3 ++- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/net/core/filter.c b/net/core/filter.c index 00037445a6c6..a7af6be43624 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -3340,6 +3340,7 @@ static int bpf_skb_proto_4_to_6(struct sk_buff *skb) shinfo->gso_type &= ~SKB_GSO_TCPV4; shinfo->gso_type |= SKB_GSO_TCPV6; } + shinfo->gso_type |= SKB_GSO_DODGY; } bpf_skb_change_protocol(skb, ETH_P_IPV6); @@ -3370,6 +3371,7 @@ static int bpf_skb_proto_6_to_4(struct sk_buff *skb) shinfo->gso_type &= ~SKB_GSO_TCPV6; shinfo->gso_type |= SKB_GSO_TCPV4; } + shinfo->gso_type |= SKB_GSO_DODGY; } bpf_skb_change_protocol(skb, ETH_P_IP); diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c index 9be9df2caf65..cd860d8d497b 100644 --- a/net/ipv4/udp_offload.c +++ b/net/ipv4/udp_offload.c @@ -352,7 +352,8 @@ struct sk_buff *__udp_gso_segment(struct sk_buff *gso_skb, if (skb_shinfo(gso_skb)->gso_type & SKB_GSO_FRAGLIST) { /* Detect modified geometry and pass those to skb_segment. */ - if (skb_pagelen(gso_skb) - sizeof(*uh) == skb_shinfo(gso_skb)->gso_size) + if ((skb_pagelen(gso_skb) - sizeof(*uh) == skb_shinfo(gso_skb)->gso_size) && + !(skb_shinfo(gso_skb)->gso_type & SKB_GSO_DODGY)) return __udp_gso_segment_list(gso_skb, features, is_ipv6); ret = __skb_linearize(gso_skb); -- 2.34.1

2 1

[PATCH OLK-6.6] libceph: reset sparse-read state in osd_fault()
by Jinjiang Tu 05 Mar '26

05 Mar '26

From: Sam Edwards <cfsworks(a)gmail.com> stable inclusion from stable-v6.6.121 commit 90a60fe61908afa0eaf7f8fcf1421b9b50e5f7ff category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13688 CVE: CVE-2026-23136 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 11194b416ef95012c2cfe5f546d71af07b639e93 upstream. When a fault occurs, the connection is abandoned, reestablished, and any pending operations are retried. The OSD client tracks the progress of a sparse-read reply using a separate state machine, largely independent of the messenger's state. If a connection is lost mid-payload or the sparse-read state machine returns an error, the sparse-read state is not reset. The OSD client will then interpret the beginning of a new reply as the continuation of the old one. If this makes the sparse-read machinery enter a failure state, it may never recover, producing loops like: libceph: [0] got 0 extents libceph: data len 142248331 != extent len 0 libceph: osd0 (1)...:6801 socket error on read libceph: data len 142248331 != extent len 0 libceph: osd0 (1)...:6801 socket error on read Therefore, reset the sparse-read state in osd_fault(), ensuring retries start from a clean state. Cc: stable(a)vger.kernel.org Fixes: f628d7999727 ("libceph: add sparse read support to OSD client") Signed-off-by: Sam Edwards <CFSworks(a)gmail.com> Reviewed-by: Ilya Dryomov <idryomov(a)gmail.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuan can <yuancan(a)huawei.com> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- net/ceph/osd_client.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c index 866cef26ce2a..a86ba8b78575 100644 --- a/net/ceph/osd_client.c +++ b/net/ceph/osd_client.c @@ -4313,6 +4313,9 @@ static void osd_fault(struct ceph_connection *con) goto out_unlock; } + osd->o_sparse_op_idx = -1; + ceph_init_sparse_read(&osd->o_sparse_read); + if (!reopen_osd(osd)) kick_osd_requests(osd); maybe_request_map(osdc); -- 2.43.0

2 1

[PATCH OLK-5.10 0/2] bpf selftest cross compile fixes
by Pu Lehui 05 Mar '26

05 Mar '26

Björn Töpel (1): selftests/bpf: Pass target triple to get_sys_includes macro Jean-Philippe Brucker (1): selftests/bpf: Enable cross-building tools/testing/selftests/bpf/Makefile | 58 +++++++++++++++++++++------- 1 file changed, 43 insertions(+), 15 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/2] CVE-2026-23177
by Fanhua Li 05 Mar '26

05 Mar '26

*** BLURB HERE *** Kairui Song (2): mm/shmem, swap: fix race of truncate and swap entry split mm, shmem: prevent infinite loop on truncate race mm/shmem.c | 54 +++++++++++++++++++++++++++++++++++++++++------------- 1 file changed, 41 insertions(+), 13 deletions(-) -- 2.43.0

2 3

[PATCH OLK-5.10 0/2] bpf selftest cross compile fixes
by Pu Lehui 05 Mar '26

05 Mar '26

Björn Töpel (1): selftests/bpf: Pass target triple to get_sys_includes macro Jean-Philippe Brucker (1): selftests/bpf: Enable cross-building tools/testing/selftests/bpf/Makefile | 58 +++++++++++++++++++++------- 1 file changed, 43 insertions(+), 15 deletions(-) -- 2.34.1

2 3