- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] nfsd: split nfsd4_copy into transient and durable async copy objects
by Lu Jialin 02 Nov '26

02 Nov '26

From: Jeff Layton <jlayton(a)kernel.org> mainline inclusion from mainline-v7.3-rc1 commit f307b4f7ed174a3252d2f292904fd276c78c77de category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18939 CVE: CVE-2026-89676 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- struct nfsd4_copy served two roles: as &u->copy it is a transient per-COMPOUND argument in the request buffer; as the heap async_copy it is a durable object (worker kthread, reaper linkage, CB_OFFLOAD callback, IDR stateid) that outlives the COMPOUND, with dup_copy_fields() shuttling state between them. That dual identity was the root of the recent lifetime bugs. Introduce struct nfsd4_async_copy for the durable object. It embeds a struct nfsd4_copy (cp_copy) for the operation parameters/result and adds the durable-only fields: async_copies linkage, task_struct, refcount, reaper TTL, copy stateid, and CB_OFFLOAD callback. The durable object therefore never points into the request buffer. cp_clp stays in nfsd4_copy -- it is a request property read by the sync-copy tracepoints on the transient object. Mechanical split, no intended behavioral change; a step toward folding the copy stateids into the common nfs4_stid infrastructure. Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Jeff Layton <jlayton(a)kernel.org> Link: https://patch.msgid.link/20260710-nfsd-testing-v3-8-a0ff7db6aa3e@kernel.org Signed-off-by: Chuck Lever <cel(a)kernel.org> Conflicts: fs/nfsd/nfs4proc.c [OLK-6.6 lacks the async-copy reaper, DESTROY_CLIENTID gating and admin-revoke cancel work, and still allocates a separate CB_OFFLOAD object; the split was adapted to that older model, so the hunks for nfsd4_async_copy_reaper(), nfsd4_has_active_async_copies() and nfsd4_cancel_copy_by_sb() were dropped] fs/nfsd/nfs4state.c [nfs4_free_copy_state() now reaches cp_clp through cp_copy.cp_clp after the split] fs/nfsd/state.h [Prototypes for nfs4_init_copy_state()/nfs4_free_copy_state() changed to struct nfsd4_async_copy] fs/nfsd/xdr4.h [Only copies/copy_task/refcount/cp_stateid moved to the new struct; cp_nn and ss_nsui stay in nfsd4_copy because OLK-6.6 has no cp_ttl/cp_cb_offload/attr_update fields] Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- fs/nfsd/nfs4proc.c | 86 +++++++++++++++++++++++---------------------- fs/nfsd/nfs4state.c | 6 ++-- fs/nfsd/state.h | 5 +-- fs/nfsd/xdr4.h | 24 +++++++++---- 4 files changed, 68 insertions(+), 53 deletions(-) diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c index c94d15fa4330..c26be4ba2996 100644 --- a/fs/nfsd/nfs4proc.c +++ b/fs/nfsd/nfs4proc.c @@ -1274,35 +1274,35 @@ nfsd4_clone(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, return status; } -static void nfs4_put_copy(struct nfsd4_copy *copy) +static void nfs4_put_copy(struct nfsd4_async_copy *copy) { if (!refcount_dec_and_test(&copy->refcount)) return; - atomic_dec(&copy->cp_nn->pending_async_copies); + atomic_dec(&copy->cp_copy.cp_nn->pending_async_copies); /* Drop the task_struct pinned in nfsd4_copy(); NULL on error paths. */ if (copy->copy_task) put_task_struct(copy->copy_task); - kfree(copy->cp_src); + kfree(copy->cp_copy.cp_src); kfree(copy); } -static void nfsd4_stop_copy(struct nfsd4_copy *copy) +static void nfsd4_stop_copy(struct nfsd4_async_copy *copy) { - if (!test_and_set_bit(NFSD4_COPY_F_STOPPED, &copy->cp_flags)) + if (!test_and_set_bit(NFSD4_COPY_F_STOPPED, &copy->cp_copy.cp_flags)) kthread_stop(copy->copy_task); nfs4_put_copy(copy); } -static struct nfsd4_copy *nfsd4_unhash_copy(struct nfs4_client *clp) +static struct nfsd4_async_copy *nfsd4_unhash_copy(struct nfs4_client *clp) { - struct nfsd4_copy *copy = NULL; + struct nfsd4_async_copy *copy = NULL; spin_lock(&clp->async_lock); if (!list_empty(&clp->async_copies)) { - copy = list_first_entry(&clp->async_copies, struct nfsd4_copy, - copies); + copy = list_first_entry(&clp->async_copies, + struct nfsd4_async_copy, copies); refcount_inc(&copy->refcount); - copy->cp_clp = NULL; + copy->cp_copy.cp_clp = NULL; if (!list_empty(&copy->copies)) list_del_init(&copy->copies); } @@ -1312,7 +1312,7 @@ static struct nfsd4_copy *nfsd4_unhash_copy(struct nfs4_client *clp) void nfsd4_shutdown_copy(struct nfs4_client *clp) { - struct nfsd4_copy *copy; + struct nfsd4_async_copy *copy; while ((copy = nfsd4_unhash_copy(clp)) != NULL) nfsd4_stop_copy(copy); @@ -1705,7 +1705,6 @@ static void dup_copy_fields(struct nfsd4_copy *src, struct nfsd4_copy *dst) if (!nfsd4_ssc_is_inter(src)) dst->nf_src = nfsd_file_get(src->nf_src); - memcpy(&dst->cp_stateid, &src->cp_stateid, sizeof(src->cp_stateid)); memcpy(dst->cp_src, src->cp_src, sizeof(struct nl4_server)); memcpy(&dst->stateid, &src->stateid, sizeof(src->stateid)); memcpy(&dst->c_fh, &src->c_fh, sizeof(src->c_fh)); @@ -1720,20 +1719,20 @@ static void release_copy_files(struct nfsd4_copy *copy) nfsd_file_put(copy->nf_dst); } -static void cleanup_async_copy(struct nfsd4_copy *copy) +static void cleanup_async_copy(struct nfsd4_async_copy *copy) { nfs4_free_copy_state(copy); - release_copy_files(copy); - if (copy->cp_clp) { - spin_lock(&copy->cp_clp->async_lock); + release_copy_files(&copy->cp_copy); + if (copy->cp_copy.cp_clp) { + spin_lock(&copy->cp_copy.cp_clp->async_lock); if (!list_empty(&copy->copies)) list_del_init(&copy->copies); - spin_unlock(&copy->cp_clp->async_lock); + spin_unlock(&copy->cp_copy.cp_clp->async_lock); } nfs4_put_copy(copy); } -static void nfsd4_send_cb_offload(struct nfsd4_copy *copy, __be32 nfserr) +static void nfsd4_send_cb_offload(struct nfsd4_async_copy *copy, __be32 nfserr) { struct nfsd4_cb_offload *cbo; @@ -1741,14 +1740,15 @@ static void nfsd4_send_cb_offload(struct nfsd4_copy *copy, __be32 nfserr) if (!cbo) return; - memcpy(&cbo->co_res, &copy->cp_res, sizeof(copy->cp_res)); - memcpy(&cbo->co_fh, &copy->fh, sizeof(copy->fh)); + memcpy(&cbo->co_res, &copy->cp_copy.cp_res, + sizeof(copy->cp_copy.cp_res)); + memcpy(&cbo->co_fh, &copy->cp_copy.fh, sizeof(copy->cp_copy.fh)); cbo->co_nfserr = nfserr; - nfsd4_init_cb(&cbo->co_cb, copy->cp_clp, &nfsd4_cb_offload_ops, + nfsd4_init_cb(&cbo->co_cb, copy->cp_copy.cp_clp, &nfsd4_cb_offload_ops, NFSPROC4_CLNT_CB_OFFLOAD); - trace_nfsd_cb_offload(copy->cp_clp, &cbo->co_res.cb_stateid, - &cbo->co_fh, copy->cp_count, nfserr); + trace_nfsd_cb_offload(copy->cp_copy.cp_clp, &cbo->co_res.cb_stateid, + &cbo->co_fh, copy->cp_copy.cp_count, nfserr); nfsd4_run_cb(&cbo->co_cb); } @@ -1761,7 +1761,8 @@ static void nfsd4_send_cb_offload(struct nfsd4_copy *copy, __be32 nfserr) */ static int nfsd4_do_async_copy(void *data) { - struct nfsd4_copy *copy = (struct nfsd4_copy *)data; + struct nfsd4_async_copy *async = data; + struct nfsd4_copy *copy = &async->cp_copy; __be32 nfserr; if (nfsd4_ssc_is_inter(copy)) { @@ -1789,8 +1790,8 @@ static int nfsd4_do_async_copy(void *data) } do_callback: - nfsd4_send_cb_offload(copy, nfserr); - cleanup_async_copy(copy); + nfsd4_send_cb_offload(async, nfserr); + cleanup_async_copy(async); return 0; } @@ -1799,7 +1800,7 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, union nfsd4_op_u *u) { struct nfsd_net *nn = net_generic(SVC_NET(rqstp), nfsd_net_id); - struct nfsd4_copy *async_copy = NULL; + struct nfsd4_async_copy *async_copy = NULL; struct nfsd4_copy *copy = &u->copy; struct nfsd42_write_res *result; __be32 status; @@ -1829,20 +1830,21 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, if (nfsd4_copy_is_async(copy)) { struct task_struct *task; - async_copy = kzalloc(sizeof(struct nfsd4_copy), GFP_KERNEL); + async_copy = kzalloc(sizeof(struct nfsd4_async_copy), GFP_KERNEL); if (!async_copy) goto out_err; - async_copy->cp_nn = nn; + async_copy->cp_copy.cp_nn = nn; INIT_LIST_HEAD(&async_copy->copies); refcount_set(&async_copy->refcount, 1); /* Arbitrary cap on number of pending async copy operations */ if (atomic_inc_return(&nn->pending_async_copies) > (int)rqstp->rq_pool->sp_nrthreads) goto out_err; - async_copy->cp_src = kmalloc(sizeof(*async_copy->cp_src), GFP_KERNEL); - if (!async_copy->cp_src) + async_copy->cp_copy.cp_src = + kmalloc(sizeof(*async_copy->cp_copy.cp_src), GFP_KERNEL); + if (!async_copy->cp_copy.cp_src) goto out_err; - dup_copy_fields(copy, async_copy); + dup_copy_fields(copy, &async_copy->cp_copy); if (!nfs4_init_copy_state(nn, async_copy)) goto out_err; @@ -1858,10 +1860,10 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, */ get_task_struct(task); async_copy->copy_task = task; - spin_lock(&async_copy->cp_clp->async_lock); + spin_lock(&async_copy->cp_copy.cp_clp->async_lock); list_add(&async_copy->copies, - &async_copy->cp_clp->async_copies); - spin_unlock(&async_copy->cp_clp->async_lock); + &async_copy->cp_copy.cp_clp->async_copies); + spin_unlock(&async_copy->cp_copy.cp_clp->async_lock); wake_up_process(async_copy->copy_task); status = nfs_ok; } else { @@ -1886,10 +1888,10 @@ nfsd4_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, goto out; } -static struct nfsd4_copy * +static struct nfsd4_async_copy * find_async_copy_locked(struct nfs4_client *clp, stateid_t *stateid) { - struct nfsd4_copy *copy; + struct nfsd4_async_copy *copy; lockdep_assert_held(&clp->async_lock); @@ -1901,10 +1903,10 @@ find_async_copy_locked(struct nfs4_client *clp, stateid_t *stateid) return NULL; } -static struct nfsd4_copy * +static struct nfsd4_async_copy * find_async_copy(struct nfs4_client *clp, stateid_t *stateid) { - struct nfsd4_copy *copy; + struct nfsd4_async_copy *copy; spin_lock(&clp->async_lock); copy = find_async_copy_locked(clp, stateid); @@ -1920,7 +1922,7 @@ nfsd4_offload_cancel(struct svc_rqst *rqstp, union nfsd4_op_u *u) { struct nfsd4_offload_status *os = &u->offload_status; - struct nfsd4_copy *copy; + struct nfsd4_async_copy *copy; struct nfs4_client *clp = cstate->clp; copy = find_async_copy(clp, &os->stateid); @@ -2008,13 +2010,13 @@ nfsd4_offload_status(struct svc_rqst *rqstp, { struct nfsd4_offload_status *os = &u->offload_status; __be32 status = nfs_ok; - struct nfsd4_copy *copy; + struct nfsd4_async_copy *copy; struct nfs4_client *clp = cstate->clp; spin_lock(&clp->async_lock); copy = find_async_copy_locked(clp, &os->stateid); if (copy) - os->count = copy->cp_res.wr_bytes_written; + os->count = copy->cp_copy.cp_res.wr_bytes_written; else status = nfserr_bad_stateid; spin_unlock(&clp->async_lock); diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c index 4e5af5a79ed5..054a24e0e84a 100644 --- a/fs/nfsd/nfs4state.c +++ b/fs/nfsd/nfs4state.c @@ -1034,7 +1034,7 @@ static int nfs4_init_cp_state(struct nfsd_net *nn, copy_stateid_t *stid, return 1; } -int nfs4_init_copy_state(struct nfsd_net *nn, struct nfsd4_copy *copy) +int nfs4_init_copy_state(struct nfsd_net *nn, struct nfsd4_async_copy *copy) { return nfs4_init_cp_state(nn, &copy->cp_stateid, NFS4_COPY_STID); } @@ -1068,13 +1068,13 @@ struct nfs4_cpntf_state *nfs4_alloc_init_cpntf_state(struct nfsd_net *nn, return NULL; } -void nfs4_free_copy_state(struct nfsd4_copy *copy) +void nfs4_free_copy_state(struct nfsd4_async_copy *copy) { struct nfsd_net *nn; if (copy->cp_stateid.cs_type != NFS4_COPY_STID) return; - nn = net_generic(copy->cp_clp->net, nfsd_net_id); + nn = net_generic(copy->cp_copy.cp_clp->net, nfsd_net_id); spin_lock(&nn->s2s_cp_lock); idr_remove(&nn->s2s_cp_stateids, copy->cp_stateid.cs_stid.si_opaque.so_id); diff --git a/fs/nfsd/state.h b/fs/nfsd/state.h index 4dd8ade17446..d62faf4f183a 100644 --- a/fs/nfsd/state.h +++ b/fs/nfsd/state.h @@ -676,6 +676,7 @@ struct nfsd4_blocked_lock { struct nfsd4_compound_state; struct nfsd_net; struct nfsd4_copy; +struct nfsd4_async_copy; extern __be32 nfs4_preprocess_stateid_op(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, struct svc_fh *fhp, @@ -686,8 +687,8 @@ __be32 nfsd4_lookup_stateid(struct nfsd4_compound_state *cstate, struct nfs4_stid **s, struct nfsd_net *nn); struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl, struct kmem_cache *slab, void (*sc_free)(struct nfs4_stid *)); -int nfs4_init_copy_state(struct nfsd_net *nn, struct nfsd4_copy *copy); -void nfs4_free_copy_state(struct nfsd4_copy *copy); +int nfs4_init_copy_state(struct nfsd_net *nn, struct nfsd4_async_copy *copy); +void nfs4_free_copy_state(struct nfsd4_async_copy *copy); struct nfs4_cpntf_state *nfs4_alloc_init_cpntf_state(struct nfsd_net *nn, struct nfs4_stid *p_stid); void nfs4_unhash_stid(struct nfs4_stid *s); diff --git a/fs/nfsd/xdr4.h b/fs/nfsd/xdr4.h index a83a52b0f518..37597f8dec46 100644 --- a/fs/nfsd/xdr4.h +++ b/fs/nfsd/xdr4.h @@ -599,18 +599,30 @@ struct nfsd4_copy { struct nfsd_file *nf_src; struct nfsd_file *nf_dst; - copy_stateid_t cp_stateid; - - struct list_head copies; - struct task_struct *copy_task; - refcount_t refcount; - struct nfsd4_ssc_umount_item *ss_nsui; struct nfs_fh c_fh; nfs4_stateid stateid; struct nfsd_net *cp_nn; }; +/* + * Durable state for an async (background) server-side COPY. + * + * struct nfsd4_copy is transient: it lives in the COMPOUND argument buffer + * and is reused once the op returns. An async COPY outlives the COMPOUND + * (worker kthread, async_copies linkage), so its params and result are + * snapshotted into the embedded cp_copy and it never points into the request + * buffer. + */ +struct nfsd4_async_copy { + struct nfsd4_copy cp_copy; /* operation params + result */ + + struct list_head copies; /* nfs4_client.async_copies */ + struct task_struct *copy_task; + refcount_t refcount; + copy_stateid_t cp_stateid; /* s2s_cp_stateids IDR entry */ +}; + static inline void nfsd4_copy_set_sync(struct nfsd4_copy *copy, bool sync) { if (sync) -- 2.34.1

2 1

[PATCH OLK-6.6 0/9] arm64/mpam: Fix Narrow-PARTID and monitor handling
by Jinjie Ruan 02 Nov '26

02 Nov '26

Fix several bugs in arm_mpam driver and the resctrl filesystem it shares with x86. Two of them leave MPAM monitoring completely unusable; the rest fix Narrow-PARTID label loss, an overwritten intPARTID limit, a use-after-free, a leftover debugfs subtree, a counter unit mismatch, a lost MSC write error and a missing debugfs_file_put(). Jinjie Ruan (9): arm64/mpam: Keep the monitor tag of tasks in root monitor groups arm64/mpam: Take the minimum intPARTID limit across RIS arm64/mpam: Remove class and component debugfs before freeing them arm64/mpam: Protect the reqPARTID map with RCU arm64/mpam: Store MBWU state saved across reset in counter units arm64/mpam: Propagate MSC write failures from mpam_apply_config() debugfs: Fix missing debugfs_file_put() on cpumask read failure fs/resctrl: Expand the width of domid by replacing mon_data_bits fs/resctrl: Set up the monitor state of a mon_capable MBA domain arch/arm64/include/asm/mpam.h | 34 ++++++-- drivers/platform/mpam/mpam_devices.c | 76 ++++++++++++++-- drivers/platform/mpam/mpam_resctrl.c | 125 ++++++++++++++++++++++----- fs/debugfs/file.c | 3 +- fs/resctrl/ctrlmondata.c | 10 +-- fs/resctrl/internal.h | 23 ++--- fs/resctrl/rdtgroup.c | 72 +++++++++++++-- 7 files changed, 287 insertions(+), 56 deletions(-) -- 2.34.1

2 11

[PATCH OLK-5.10] mmc: core: Cancel SDIO IRQ work before freeing host
by Lu Jialin 02 Nov '26

02 Nov '26

From: Fan Wu <fanwu01(a)zju.edu.cn> stable inclusion from stable-v6.6.158 commit 0bf3d168a2cc20b120d6b50f0a8ac5b40ff4d589 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19959 CVE: CVE-2026-98213 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 6feadbecdae60a6324c967f3b1493741083793a3 upstream. A host controller that uses sdio_signal_irq() schedules host->sdio_irq_work from its interrupt handler. That work is only cancelled on the suspend path (mmc_sdio_suspend()), not on the remove/free path, so a worker armed just before the controller freed its IRQ can run after mmc_host_classdev_release() has freed the host and dereference it through container_of(). Cancel host->sdio_irq_work in mmc_free_host(), like the existing host->detect drain added by commit 1036f69e2513 ("mmc: core: Cancel delayed work before releasing host"). This issue was found by an in-house static analysis tool. Fixes: 682696605c70 ("mmc: sdio: Add API to manage SDIO IRQs from a workqueue") Cc: stable(a)vger.kernel.org Assisted-by: Codex:gpt-5.6 Signed-off-by: Fan Wu <fanwu01(a)zju.edu.cn> Signed-off-by: Ulf Hansson <ulfh(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/mmc/core/host.c [In OLK-5.10 host->sdio_irq_work is still a struct delayed_work as in linux-5.10.y, while the 6.6.y patch targets struct work_struct; adapted cancel_work_sync() to cancel_delayed_work_sync(), matching the type and the existing suspend-path call in sdio.c] Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- drivers/mmc/core/host.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c index b949a4468bf5..040e9c417a5e 100644 --- a/drivers/mmc/core/host.c +++ b/drivers/mmc/core/host.c @@ -613,6 +613,7 @@ EXPORT_SYMBOL(mmc_remove_host); void mmc_free_host(struct mmc_host *host) { cancel_delayed_work_sync(&host->detect); + cancel_delayed_work_sync(&host->sdio_irq_work); mmc_pwrseq_free(host); put_device(&host->class_dev); } -- 2.34.1

2 1

[PATCH OLK-6.6] mtd: core: avoid double-free of OTP NVMEM device
by Lu Jialin 02 Nov '26

02 Nov '26

From: Karl Mehltretter <kmehltretter(a)gmail.com> mainline inclusion from mainline-v7.3-rc6 commit 26300879cd8e4612dce66bb8f6ff7cd35fcf3e59 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20479 CVE: CVE-2026-98834 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If factory OTP setup fails after the user OTP NVMEM device has been registered, mtd_otp_nvmem_add() unregisters the user device but leaves mtd->otp_user_nvmem set. On an error, the caller unregisters it again. For -EOPNOTSUPP, registration continues and normal teardown unregisters it again. Clear mtd->otp_user_nvmem after unregistering it. Fixes: e0489f6e221f ("mtd: core: fix error path for nvmem provider") Fixes: fe0b8213c012 ("mtd: core: Don't fail mtd_otp_nvmem_add() if OTP is unsupported") Assisted-by: Codex:gpt-5.6-sol Signed-off-by: Karl Mehltretter <kmehltretter(a)gmail.com> Signed-off-by: Miquel Raynal <miquel.raynal(a)bootlin.com> Conflicts: drivers/mtd/mtdcore.c [Context lines differ due to code layout differences between OLK-6.6 and mainline; commit fe0b8213c012 ("mtd: core: Don't fail mtd_otp_nvmem_add() if OTP is unsupported") is not backported, so the err label has no EOPNOTSUPP handling; the assignment was inserted right after nvmem_unregister() in the existing err path] Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- drivers/mtd/mtdcore.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/mtd/mtdcore.c b/drivers/mtd/mtdcore.c index 28aa823e90ab..7f180d934aa8 100644 --- a/drivers/mtd/mtdcore.c +++ b/drivers/mtd/mtdcore.c @@ -1014,6 +1014,7 @@ static int mtd_otp_nvmem_add(struct mtd_info *mtd) err: nvmem_unregister(mtd->otp_user_nvmem); + mtd->otp_user_nvmem = NULL; return dev_err_probe(dev, err, "Failed to register OTP NVMEM device\n"); } -- 2.34.1

2 1

[PATCH OLK-6.6] wifi: mac80211: validate TX status rate metadata
by Lu Jialin 02 Nov '26

02 Nov '26

From: Yuqi Xu <xuyuqiabc(a)gmail.com> mainline inclusion from mainline-v7.3-rc6 commit 6bdcdb31318c10e6369cff8e5b32c37397e98091 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20489 CVE: CVE-2026-98824 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- minstrel_ht_tx_status() converts the HT/VHT rate reported in a TX status into a group and rate index and uses those to index the minstrel_ht rate tables. The existing validation only checked that an entry was present and had tries recorded; it did not check that the reported MCS, spatial stream count and bandwidth are representable by the tables, so malformed metadata passed to minstrel_ht_get_stats() or minstrel_ht_ri_get_stats() could be used as an out-of-bounds index. Validate the rate metadata in the common TX status path instead of only in minstrel_ht, since the values are used by more than rate control. The legacy ieee80211_tx_rate array and the rate_info based entries are sanitized in ieee80211_tx_status_ext() and ieee80211_tx_rate_update() before any consumer runs: an entry that does not describe a valid rate for its encoding is dropped. minstrel_ht keeps the checks that depend on its own tables, i.e. the supported number of spatial streams, the MCS group size and the supported bandwidths. This does not take away the driver's responsibility to report sane values, it only prevents a single bad report from corrupting mac80211 state. No WARN_ON() is added: with panic_on_warn a driver bug would otherwise turn into a denial of service. Fixes: a5f69d94d8e2 ("mac80211: Get rid of search loop for rate group index") Fixes: 9208247d74bc ("mac80211: minstrel_ht: add basic support for VHT rates <= 3SS@80MHz") Reported-by: Vega <vega(a)nebusec.ai> Assisted-by: LLM Signed-off-by: Yuqi Xu <xuyuqiabc(a)gmail.com> Reviewed-by: Ren Wei <weir(a)nebusec.ai> Link: https://patch.msgid.link/607e985d71fbbe63ebfc182a37f882f04f980f7f.178995887… Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Conflicts: net/mac80211/status.c [Context lines differ due to code layout differences between OLK-6.6 and mainline; the function preceding ieee80211_tx_status_ext() is ieee80211_tx_status() rather than ieee80211_tx_status_skb(), so the new helper functions were inserted before ieee80211_tx_status_ext()] Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- net/mac80211/rc80211_minstrel_ht.c | 59 ++++++++++++++++++++++--- net/mac80211/status.c | 70 ++++++++++++++++++++++++++++++ 2 files changed, 123 insertions(+), 6 deletions(-) diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c index b34c80522047..34eee00dac4f 100644 --- a/net/mac80211/rc80211_minstrel_ht.c +++ b/net/mac80211/rc80211_minstrel_ht.c @@ -1193,6 +1193,54 @@ minstrel_ht_update_stats(struct minstrel_priv *mp, struct minstrel_ht_sta *mi) mi->sample_time = jiffies; } +/* + * Check whether an HT/VHT rate from a TX status entry maps to an entry + * in the minstrel_ht rate tables. Values that cannot be represented + * there must not be used for indexing mi->groups[] and the MCS groups. + */ +static bool +minstrel_ht_txstat_rate_valid(struct ieee80211_tx_rate *rate) +{ + unsigned int bw; + + if (!(rate->flags & (IEEE80211_TX_RC_MCS | IEEE80211_TX_RC_VHT_MCS))) + return true; + + if (rate->flags & IEEE80211_TX_RC_MCS) { + /* minstrel_ht supports up to MINSTREL_MAX_STREAMS streams */ + return rate->idx < MINSTREL_MAX_STREAMS * 8; + } + + /* minstrel_ht has no VHT groups for 160 MHz and wider */ + bw = !!(rate->flags & IEEE80211_TX_RC_40_MHZ_WIDTH) + + 2 * !!(rate->flags & IEEE80211_TX_RC_80_MHZ_WIDTH); + if ((rate->flags & IEEE80211_TX_RC_160_MHZ_WIDTH) || bw > BW_80) + return false; + + return ieee80211_rate_get_vht_nss(rate) <= MINSTREL_MAX_STREAMS && + ieee80211_rate_get_vht_mcs(rate) < MCS_GROUP_RATES; +} + +static bool +minstrel_ht_ri_txstat_rate_valid(struct rate_info *rate) +{ + if (!(rate->flags & (RATE_INFO_FLAGS_MCS | RATE_INFO_FLAGS_VHT_MCS))) + return true; + + if (rate->flags & RATE_INFO_FLAGS_MCS) { + /* minstrel_ht supports up to MINSTREL_MAX_STREAMS streams */ + return rate->mcs < MINSTREL_MAX_STREAMS * 8; + } + + /* minstrel_ht has VHT groups only for 20/40/80 MHz */ + if (rate->bw != RATE_INFO_BW_20 && rate->bw != RATE_INFO_BW_40 && + rate->bw != RATE_INFO_BW_80) + return false; + + return rate->nss <= MINSTREL_MAX_STREAMS && + rate->mcs < MCS_GROUP_RATES; +} + static bool minstrel_ht_txstat_valid(struct minstrel_priv *mp, struct minstrel_ht_sta *mi, struct ieee80211_tx_rate *rate) @@ -1205,9 +1253,8 @@ minstrel_ht_txstat_valid(struct minstrel_priv *mp, struct minstrel_ht_sta *mi, if (!rate->count) return false; - if (rate->flags & IEEE80211_TX_RC_MCS || - rate->flags & IEEE80211_TX_RC_VHT_MCS) - return true; + if (rate->flags & (IEEE80211_TX_RC_MCS | IEEE80211_TX_RC_VHT_MCS)) + return minstrel_ht_txstat_rate_valid(rate); for (i = 0; i < ARRAY_SIZE(mp->cck_rates); i++) if (rate->idx == mp->cck_rates[i]) @@ -1235,9 +1282,9 @@ minstrel_ht_ri_txstat_valid(struct minstrel_priv *mp, if (!rate_status->try_count) return false; - if (rate_status->rate_idx.flags & RATE_INFO_FLAGS_MCS || - rate_status->rate_idx.flags & RATE_INFO_FLAGS_VHT_MCS) - return true; + if (rate_status->rate_idx.flags & + (RATE_INFO_FLAGS_MCS | RATE_INFO_FLAGS_VHT_MCS)) + return minstrel_ht_ri_txstat_rate_valid(&rate_status->rate_idx); for (i = 0; i < ARRAY_SIZE(mp->cck_rates); i++) { if (rate_status->rate_idx.legacy == diff --git a/net/mac80211/status.c b/net/mac80211/status.c index 9676ed15efec..cc8ebc10854c 100644 --- a/net/mac80211/status.c +++ b/net/mac80211/status.c @@ -1102,6 +1102,73 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb) } EXPORT_SYMBOL(ieee80211_tx_status); +/* + * Check whether the HT/VHT rate information in a TX status entry is + * valid for its encoding. This is not specific to any rate control + * algorithm; all status consumers rely on the values being sane. + */ +static bool ieee80211_tx_status_rate_info_valid(const struct rate_info *rate) +{ + if (rate->flags & RATE_INFO_FLAGS_MCS) + return rate->mcs < 32; + + if (rate->flags & RATE_INFO_FLAGS_VHT_MCS) + return rate->nss >= 1 && rate->nss <= 8 && rate->mcs <= 11; + + return true; +} + +static bool +ieee80211_tx_status_tx_rate_valid(const struct ieee80211_tx_rate *rate) +{ + if (rate->flags & IEEE80211_TX_RC_MCS) + return rate->idx < 32; + + if (rate->flags & IEEE80211_TX_RC_VHT_MCS) + return ieee80211_rate_get_vht_mcs(rate) <= 11; + + return true; +} + +/* + * Drop TX status rate entries that don't describe a valid rate. The + * status information is used by rate control and by other mac80211 + * code, and a malformed entry must not be able to corrupt state beyond + * the driver that reported it. + */ +static void +ieee80211_tx_status_drop_invalid_rates(struct ieee80211_tx_status *status) +{ + int i; + + for (i = 0; i < status->n_rates; i++) { + struct ieee80211_rate_status *rs = &status->rates[i]; + + if (ieee80211_tx_status_rate_info_valid(&rs->rate_idx)) + continue; + + rs->try_count = 0; + memset(&rs->rate_idx, 0, sizeof(rs->rate_idx)); + } + + if (!status->info) + return; + + for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) { + struct ieee80211_tx_rate *rate; + + rate = &status->info->status.rates[i]; + if (rate->idx < 0) + break; + + if (ieee80211_tx_status_tx_rate_valid(rate)) + continue; + + rate->idx = -1; + rate->count = 0; + } +} + void ieee80211_tx_status_ext(struct ieee80211_hw *hw, struct ieee80211_tx_status *status) { @@ -1114,6 +1181,8 @@ void ieee80211_tx_status_ext(struct ieee80211_hw *hw, bool acked, noack_success, ack_signal_valid; u16 tx_time_est; + ieee80211_tx_status_drop_invalid_rates(status); + if (pubsta) { sta = container_of(pubsta, struct sta_info, sta); @@ -1237,6 +1306,7 @@ void ieee80211_tx_rate_update(struct ieee80211_hw *hw, .sta = pubsta, }; + ieee80211_tx_status_drop_invalid_rates(&status); rate_control_tx_status(local, &status); if (ieee80211_hw_check(&local->hw, HAS_RATE_CONTROL)) -- 2.34.1

2 1

[PATCH OLK-6.6] bpf: Fix out-of-bounds btf->types write for split BTF
by Pu Lehui 02 Nov '26

02 Nov '26

From: Feng Yang <yangfeng(a)kylinos.cn> mainline inclusion from mainline-v7.4-rc1 commit 6c476d2b73056ed151c3f8b884c627c75999ed7c category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/10194 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- btf_add_type() stores the types of a BTF in btf->types[], which can hold at most BTF_MAX_TYPE entries. The types of a split BTF get IDs start_id .. start_id + nr_types - 1, so only BTF_MAX_TYPE - start_id of them fit, but neither the limit check nor the size used to grow the array accounts for start_id: the check is an equality test against BTF_MAX_TYPE ('start_id + btf->types_size == BTF_MAX_TYPE') and the new size is clamped to BTF_MAX_TYPE. The check therefore only fires if the array happens to grow to exactly BTF_MAX_TYPE - start_id entries. Otherwise, if the module has more than BTF_MAX_TYPE types, the array is filled up to BTF_MAX_TYPE entries. The next type that needs to be added reallocates the array to the same size, after which btf->types_size no longer equals btf->nr_types and the growth path is not taken anymore, so every following type is written past the end of the array: BUG: unable to handle page fault for address: ffffc90006200000 RIP: 0010:btf_add_type+0x74/0x270 Call Trace: btf_check_all_metas btf_parse_module Bound both the array size and the limit check by BTF_MAX_TYPE - start_id. Base BTF (start_id == 0) is unaffected. Fixes: 951bb64621b8 ("bpf: Add in-kernel split BTF support") Signed-off-by: Feng Yang <yangfeng(a)kylinos.cn> Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Reviewed-by: Mahe Tardy <mahe.tardy(a)gmail.com> Acked-by: Ihor Solodrai <ihor.solodrai(a)linux.dev> Link: https://patch.msgid.link/20261028031933.277550-1-yangfeng59949@163.com Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/btf.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c index 1c5ed5d4b591..876f48012b1c 100644 --- a/kernel/bpf/btf.c +++ b/kernel/bpf/btf.c @@ -1580,15 +1580,16 @@ static int btf_add_type(struct btf_verifier_env *env, struct btf_type *t) /* Expand 'types' array */ struct btf_type **new_types; - u32 expand_by, new_size; + u32 expand_by, new_size, max_size; - if (btf->start_id + btf->types_size == BTF_MAX_TYPE) { + if (btf->start_id + btf->types_size >= BTF_MAX_TYPE) { btf_verifier_log(env, "Exceeded max num of types"); return -E2BIG; } + max_size = BTF_MAX_TYPE - btf->start_id; expand_by = max_t(u32, btf->types_size >> 2, 16); - new_size = min_t(u32, BTF_MAX_TYPE, + new_size = min_t(u32, max_size, btf->types_size + expand_by); new_types = kvcalloc(new_size, sizeof(*new_types), -- 2.34.1

2 1

[PATCH OLK-6.6] bpf: Fix out-of-bounds btf->types write for split BTF
by Pu Lehui 02 Nov '26

02 Nov '26

mainline inclusion from mainline-v7.4-rc1 commit 6c476d2b73056ed151c3f8b884c627c75999ed7c category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/10194 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- btf_add_type() stores the types of a BTF in btf->types[], which can hold at most BTF_MAX_TYPE entries. The types of a split BTF get IDs start_id .. start_id + nr_types - 1, so only BTF_MAX_TYPE - start_id of them fit, but neither the limit check nor the size used to grow the array accounts for start_id: the check is an equality test against BTF_MAX_TYPE ('start_id + btf->types_size == BTF_MAX_TYPE') and the new size is clamped to BTF_MAX_TYPE. The check therefore only fires if the array happens to grow to exactly BTF_MAX_TYPE - start_id entries. Otherwise, if the module has more than BTF_MAX_TYPE types, the array is filled up to BTF_MAX_TYPE entries. The next type that needs to be added reallocates the array to the same size, after which btf->types_size no longer equals btf->nr_types and the growth path is not taken anymore, so every following type is written past the end of the array: BUG: unable to handle page fault for address: ffffc90006200000 RIP: 0010:btf_add_type+0x74/0x270 Call Trace: btf_check_all_metas btf_parse_module Bound both the array size and the limit check by BTF_MAX_TYPE - start_id. Base BTF (start_id == 0) is unaffected. Fixes: 951bb64621b8 ("bpf: Add in-kernel split BTF support") Signed-off-by: Feng Yang <yangfeng(a)kylinos.cn> Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Reviewed-by: Mahe Tardy <mahe.tardy(a)gmail.com> Acked-by: Ihor Solodrai <ihor.solodrai(a)linux.dev> Link: https://patch.msgid.link/20261028031933.277550-1-yangfeng59949@163.com Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/btf.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c index 1c5ed5d4b591..876f48012b1c 100644 --- a/kernel/bpf/btf.c +++ b/kernel/bpf/btf.c @@ -1580,15 +1580,16 @@ static int btf_add_type(struct btf_verifier_env *env, struct btf_type *t) /* Expand 'types' array */ struct btf_type **new_types; - u32 expand_by, new_size; + u32 expand_by, new_size, max_size; - if (btf->start_id + btf->types_size == BTF_MAX_TYPE) { + if (btf->start_id + btf->types_size >= BTF_MAX_TYPE) { btf_verifier_log(env, "Exceeded max num of types"); return -E2BIG; } + max_size = BTF_MAX_TYPE - btf->start_id; expand_by = max_t(u32, btf->types_size >> 2, 16); - new_size = min_t(u32, BTF_MAX_TYPE, + new_size = min_t(u32, max_size, btf->types_size + expand_by); new_types = kvcalloc(new_size, sizeof(*new_types), -- 2.34.1

2 1

[PATCH bpf-next] bpf: Fix out-of-bounds btf->types write for split BTF
by Pu Lehui 02 Nov '26

02 Nov '26

mainline inclusion from mainline-v7.4-rc1 commit 6c476d2b73056ed151c3f8b884c627c75999ed7c category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/10194 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- btf_add_type() stores the types of a BTF in btf->types[], which can hold at most BTF_MAX_TYPE entries. The types of a split BTF get IDs start_id .. start_id + nr_types - 1, so only BTF_MAX_TYPE - start_id of them fit, but neither the limit check nor the size used to grow the array accounts for start_id: the check is an equality test against BTF_MAX_TYPE ('start_id + btf->types_size == BTF_MAX_TYPE') and the new size is clamped to BTF_MAX_TYPE. The check therefore only fires if the array happens to grow to exactly BTF_MAX_TYPE - start_id entries. Otherwise, if the module has more than BTF_MAX_TYPE types, the array is filled up to BTF_MAX_TYPE entries. The next type that needs to be added reallocates the array to the same size, after which btf->types_size no longer equals btf->nr_types and the growth path is not taken anymore, so every following type is written past the end of the array: BUG: unable to handle page fault for address: ffffc90006200000 RIP: 0010:btf_add_type+0x74/0x270 Call Trace: btf_check_all_metas btf_parse_module Bound both the array size and the limit check by BTF_MAX_TYPE - start_id. Base BTF (start_id == 0) is unaffected. Fixes: 951bb64621b8 ("bpf: Add in-kernel split BTF support") Signed-off-by: Feng Yang <yangfeng(a)kylinos.cn> Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Reviewed-by: Mahe Tardy <mahe.tardy(a)gmail.com> Acked-by: Ihor Solodrai <ihor.solodrai(a)linux.dev> Link: https://patch.msgid.link/20261028031933.277550-1-yangfeng59949@163.com Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/btf.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c index 1c5ed5d4b591..876f48012b1c 100644 --- a/kernel/bpf/btf.c +++ b/kernel/bpf/btf.c @@ -1580,15 +1580,16 @@ static int btf_add_type(struct btf_verifier_env *env, struct btf_type *t) /* Expand 'types' array */ struct btf_type **new_types; - u32 expand_by, new_size; + u32 expand_by, new_size, max_size; - if (btf->start_id + btf->types_size == BTF_MAX_TYPE) { + if (btf->start_id + btf->types_size >= BTF_MAX_TYPE) { btf_verifier_log(env, "Exceeded max num of types"); return -E2BIG; } + max_size = BTF_MAX_TYPE - btf->start_id; expand_by = max_t(u32, btf->types_size >> 2, 16); - new_size = min_t(u32, BTF_MAX_TYPE, + new_size = min_t(u32, max_size, btf->types_size + expand_by); new_types = kvcalloc(new_size, sizeof(*new_types), -- 2.34.1

1 0

[PATCH OLK-6.6 0/2] Fix CVE-2026-98799
by Chen Yuxi 31 Oct '26

31 Oct '26

Fix CVE-2026-98799 and the kabi breakage. Chen Yuxi (1): bpf: Fix kabi breakage in struct bpf_tramp_image and bpf_trampoline Florent Revest (Anthropic) (1): bpf: Skip detached progs in trampoline images that are still in use arch/arm64/net/bpf_jit_comp.c | 37 ++++++++------ arch/riscv/net/bpf_jit_comp64.c | 45 ++++++++++++----- arch/s390/net/bpf_jit_comp.c | 43 ++++++++++------ arch/sw_64/net/bpf_jit_comp.c | 7 --- arch/x86/net/bpf_jit_comp.c | 27 ++++++---- include/linux/bpf.h | 52 +++++++++++++++++-- kernel/bpf/trampoline.c | 89 ++++++++++++++++++++++++++------- 7 files changed, 216 insertions(+), 84 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] bpf: Mark syscall helpers as sleepable
by Pu Lehui 31 Oct '26

31 Oct '26

From: Kumar Kartikeya Dwivedi <memxor(a)gmail.com> stable inclusion from stable-v6.6.160 commit 9496d857205e60241034b798d7745ff8830ba599 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/10219 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d05524794240b52fdc3b6c1220dd05505715824d ] bpf_sys_bpf() executes the bpf(2) syscall body, which can take mutexes, allocate with GFP_KERNEL, and wait for an RCU grace period. bpf_sys_close() reaches close_fd() and filp_close(), which can sleep as well. Both helpers are limited to BPF_PROG_TYPE_SYSCALL, whose main program is sleepable. That does not make every callback sleepable: a syscall program can register a bpf_timer callback, and the verifier checks that callback in a non-sleepable context while retaining the syscall helper set. Without .might_sleep on the prototypes, such a callback can invoke bpf_sys_bpf() from hrtimer softirq context and trigger a scheduling-while-atomic failure. bpf_sys_close() is exposed through the same missing context check. Set .might_sleep on both prototypes so the existing helper-context check rejects them from timer callbacks and other atomic regions. Calls from the sleepable main body remain valid. Fixes: 79a7f8bdb159 ("bpf: Introduce bpf_sys_bpf() helper and program type.") Fixes: 3abea089246f ("bpf: Add bpf_sys_close() helper.") Reported-by: Nicholas Carlini <npc(a)anthropic.com> Suggested-by: Nicholas Carlini <npc(a)anthropic.com> Signed-off-by: Kumar Kartikeya Dwivedi <memxor(a)gmail.com> Link: https://lore.kernel.org/r/20260903144433.1716731-10-memxor@gmail.com Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/syscall.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c index ff1c8dc903cb..b18ac538fd87 100644 --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -5814,6 +5814,7 @@ EXPORT_SYMBOL(kern_sys_bpf); static const struct bpf_func_proto bpf_sys_bpf_proto = { .func = bpf_sys_bpf, .gpl_only = false, + .might_sleep = true, .ret_type = RET_INTEGER, .arg1_type = ARG_ANYTHING, .arg2_type = ARG_PTR_TO_MEM | MEM_RDONLY, @@ -5839,6 +5840,7 @@ BPF_CALL_1(bpf_sys_close, u32, fd) static const struct bpf_func_proto bpf_sys_close_proto = { .func = bpf_sys_close, .gpl_only = false, + .might_sleep = true, .ret_type = RET_INTEGER, .arg1_type = ARG_ANYTHING, }; -- 2.34.1

2 1