- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 0/2] Backport CVE-2026-64361 fixes from 6.6 LTS
by Pan Taixi 07 Aug '26

07 Aug '26

Bacport "hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length" and its antecedent patch "hfs/hfsplus: prevent getting negative values of offset/length" Tristan Madani (1): hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length Viacheslav Dubeyko (1): hfs/hfsplus: prevent getting negative values of offset/length fs/hfs/bfind.c | 2 +- fs/hfs/bnode.c | 54 ++++++++++++------------- fs/hfs/brec.c | 2 +- fs/hfs/btree.c | 2 +- fs/hfs/btree.h | 71 +++++++++++++++++---------------- fs/hfs/hfs_fs.h | 88 ++++++++++++++++++++++++----------------- fs/hfs/inode.c | 3 +- fs/hfsplus/bfind.c | 2 +- fs/hfsplus/bnode.c | 60 ++++++++++++++-------------- fs/hfsplus/brec.c | 2 +- fs/hfsplus/btree.c | 2 +- fs/hfsplus/hfsplus_fs.h | 40 +++++++++---------- 12 files changed, 173 insertions(+), 155 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] sched: Add the qos schduler's cgroup v2 interface
by Chen Jinghuang 07 Aug '26

07 Aug '26

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8MF4R -------------------------------- Add the qos schduler's cgroup v2 interface. Cgroup v2 use the qos scheduler, as follows: offline group: echo -1 > /sys/fs/cgroup/xxxx/offline/cpu.qos_level online group: /sys/fs/cgroup/xxxx/online/cpu.qos_level Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- kernel/sched/core.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/kernel/sched/core.c b/kernel/sched/core.c index cdc931c14930..fd8fdaaf7cbb 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -10660,6 +10660,14 @@ static struct cftype cpu_files[] = { .write = cpu_uclamp_max_write, }, #endif +#endif +#ifdef CONFIG_QOS_SCHED + { + .name = "qos_level", + .flags = CFTYPE_NOT_ON_ROOT, + .read_s64 = cpu_qos_read, + .write_s64 = cpu_qos_write, + }, #ifdef CONFIG_SCHED_SOFT_DOMAIN { .name = "soft_domain", -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] Backport CVE-2026-64361 fixes from 6.6 LTS
by Pan Taixi 07 Aug '26

07 Aug '26

Bacport "hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length" and its antecedent patch "hfs/hfsplus: prevent getting negative values of offset/length" Tristan Madani (1): hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length Viacheslav Dubeyko (1): hfs/hfsplus: prevent getting negative values of offset/length fs/hfs/bfind.c | 2 +- fs/hfs/bnode.c | 54 ++++++++++++------------- fs/hfs/brec.c | 2 +- fs/hfs/btree.c | 2 +- fs/hfs/btree.h | 71 +++++++++++++++++---------------- fs/hfs/hfs_fs.h | 88 ++++++++++++++++++++++++----------------- fs/hfs/inode.c | 3 +- fs/hfsplus/bfind.c | 2 +- fs/hfsplus/bnode.c | 60 ++++++++++++++-------------- fs/hfsplus/brec.c | 2 +- fs/hfsplus/btree.c | 2 +- fs/hfsplus/hfsplus_fs.h | 40 +++++++++---------- 12 files changed, 173 insertions(+), 155 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] NFSv4/flexfiles: reject zero filehandle version count
by Zhou Minqiang 07 Aug '26

07 Aug '26

mainline inclusion from mainline-v7.2-rc1 commit 2c6bb3c40bc24f6aa8dfbe6fe98c3ad6389203f2 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16112 CVE: CVE-2026-53392 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ff_layout_alloc_lseg() decodes the filehandle-version array count from the flexfiles layout body. The value is used as the count for kzalloc_objs(), and the current code only rejects NULL. A zero count yields ZERO_SIZE_PTR, which can be stored in dss_info->fh_versions even though later flexfiles paths assume that at least one filehandle version exists. Reject fh_count == 0 before the allocation, matching the existing zero version_count validation in the flexfiles GETDEVICEINFO parser. A QEMU/KASAN run with a malformed flexfiles layout hit: KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] RIP: 0010:ff_layout_encode_ff_layoutupdate.isra.0+0x15f/0x750 ff_layout_encode_layoutreturn+0x683/0x970 nfs4_xdr_enc_layoutreturn+0x278/0x3a0 Kernel panic - not syncing: Fatal exception The patched kernel rejects the malformed layout without KASAN/oops/panic, and a valid fh_count=1 regression still opens, reads, and unmounts cleanly. Cc: stable(a)vger.kernel.org Fixes: d67ae825a59d ("pnfs/flexfiles: Add the FlexFile Layout Driver") Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Signed-off-by: Anna Schumaker <anna.schumaker(a)hammerspace.com> Signed-off-by: Zhou Minqiang <zhouminqiang2(a)huawei.com> --- fs/nfs/flexfilelayout/flexfilelayout.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c index 81843dd8b0ee..73ef9a88208f 100644 --- a/fs/nfs/flexfilelayout/flexfilelayout.c +++ b/fs/nfs/flexfilelayout/flexfilelayout.c @@ -459,6 +459,10 @@ ff_layout_alloc_lseg(struct pnfs_layout_hdr *lh, if (!p) goto out_err_free; fh_count = be32_to_cpup(p); + if (fh_count == 0) { + rc = -EINVAL; + goto out_err_free; + } fls->mirror_array[i]->fh_versions = kcalloc(fh_count, sizeof(struct nfs_fh), -- 2.52.0

2 1

[PATCH openEuler-1.0-LTS] smb/client: fix chown/chgrp with SMB3 POSIX Extensions
by Zhou Minqiang 07 Aug '26

07 Aug '26

mainline inclusion from mainline-v7.2-rc1 commit 760ef2c579c2609cf17fb1cd5392f64d42d43d33 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16820 CVE: CVE-2026-64388 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Ownership (chown) and group (chgrp) modifications were being ignored when mounting with SMB3 POSIX Extensions unless CIFS_MOUNT_CIFS_ACL or CIFS_MOUNT_MODE_FROM_SID were also explicitly set. Fix this by checking for posix_extensions in cifs_setattr_nounix() when updating UID and GID, ensuring that id_mode_to_cifs_acl() is called to map and set the ownership/group information on the server. Cc: stable(a)vger.kernel.org Signed-off-by: Ralph Boehme <slow(a)samba.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/cifs/inode.c fs/smb/client/inode.c [cxt conflicts] Signed-off-by: Zhou Minqiang <zhouminqiang2(a)huawei.com> --- fs/cifs/inode.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c index d30eb4350656..e5d0066f6125 100644 --- a/fs/cifs/inode.c +++ b/fs/cifs/inode.c @@ -2447,7 +2447,8 @@ cifs_setattr_nounix(struct dentry *direntry, struct iattr *attrs) gid = attrs->ia_gid; #ifdef CONFIG_CIFS_ACL - if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_CIFS_ACL) { + if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_CIFS_ACL) || + cifs_sb_master_tcon(cifs_sb)->posix_extensions) { if (uid_valid(uid) || gid_valid(gid)) { rc = id_mode_to_cifs_acl(inode, full_path, NO_CHANGE_64, uid, gid); -- 2.52.0

2 1

[PATCH OLK-5.10 0/5] CVE-2026-53120
by Ziming Du 07 Aug '26

07 Aug '26

patches for CVE-2026-53120 Danilo Krummrich (1): PCI: use generic driver_override infrastructure Samiullah Khawaja (1): PCI: Initialize temporary device in new_id_store() Zhenzhong Duan (2): PCI: Move pci_match_device() ahead of new_id_store() PCI: Avoid duplicate IDs in driver dynamic IDs list Ziming Du (1): [Huawei] PCI: fix kabi breakage due to driver_override removal drivers/pci/pci-driver.c | 161 +++++++++++++++-------------- drivers/pci/pci-sysfs.c | 48 --------- drivers/pci/probe.c | 1 - drivers/vfio/pci/vfio_pci.c | 4 +- drivers/xen/xen-pciback/pci_stub.c | 6 +- include/linux/pci.h | 2 +- 6 files changed, 93 insertions(+), 129 deletions(-) -- 2.43.0

2 6

[PATCH OLK-6.6 0/3] CVE-2026-53120
by Ziming Du 07 Aug '26

07 Aug '26

CVE-2026-53120 Danilo Krummrich (1): PCI: use generic driver_override infrastructure Samiullah Khawaja (1): PCI: Initialize temporary device in new_id_store() Ziming Du (1): PCI: fix kabi breakage due to driver_override removal drivers/pci/pci-driver.c | 20 +++++++++++++++----- drivers/pci/pci-sysfs.c | 28 ---------------------------- drivers/pci/probe.c | 1 - drivers/vfio/pci/vfio_pci_core.c | 4 ++-- drivers/xen/xen-pciback/pci_stub.c | 6 ++++-- include/linux/pci.h | 7 +------ 6 files changed, 22 insertions(+), 44 deletions(-) -- 2.43.0

2 4

[PATCH OLK-6.6 0/4] CVE-2026-64405 fixes
by Tang Hui 06 Aug '26

06 Aug '26

CVE-2026-64405 fixes. Luiz Augusto von Dentz (2): [Backport] Bluetooth: hci_core: Remove check of BDADDR_ANY in hci_conn_hash_lookup_big_state [Backport] Bluetooth: hci_sync: Fix attempting to send HCI_Disconnect to BIS handle Pauli Virtanen (1): [Backport] Bluetooth: separate CIS_LINK and BIS_LINK link types Siwei Zhang (1): [Backport] Bluetooth: hci_conn: Fix null ptr deref in hci_abort_conn() include/net/bluetooth/hci.h | 3 +- include/net/bluetooth/hci_core.h | 38 ++++---- net/bluetooth/hci_conn.c | 56 +++++------- net/bluetooth/hci_core.c | 21 +++-- net/bluetooth/hci_event.c | 25 +++--- net/bluetooth/hci_sync.c | 149 ++++++++++++++++++++++++++----- net/bluetooth/iso.c | 4 +- net/bluetooth/mgmt.c | 3 +- 8 files changed, 206 insertions(+), 93 deletions(-) -- 2.34.1

1 4

[PATCH OLK-5.10] KVM: SEV: Ignore Port I/O requests of length '0'
by Zhang Kunbo 06 Aug '26

06 Aug '26

From: Sean Christopherson <seanjc(a)google.com> stable inclusion from stable-v6.12.95 commit 3b6035bc6bff20e89752ce4358bc4c9a9d5883f2 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16267 CVE: CVE-2026-63940 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 3988bd2723de407ae90fa7a6f6029b4e60238c58 upstream. Explicitly ignore Port I/O requests of length '0' (or count '0'), so that setting up the software scratch area (and other code) doesn't have to worry about underflowing the length, and to allow for WARNing on trying to configure the scratch area with len==0. Fixes: 291bd20d5d88 ("KVM: SVM: Add initial support for a VMGEXIT VMEXIT") Cc: stable(a)vger.kernel.org Reviewed-by: Tom Lendacky <thomas.lendacky(a)amd.com> Signed-off-by: Sean Christopherson <seanjc(a)google.com> Message-ID: <20260501202250.2115252-5-seanjc(a)google.com> Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com> Signed-off-by: Jack Wang <jinpu.wang(a)ionos.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- arch/x86/kvm/svm/sev.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c index c711a6369c13..79ebbe8cf0b4 100644 --- a/arch/x86/kvm/svm/sev.c +++ b/arch/x86/kvm/svm/sev.c @@ -2791,6 +2791,11 @@ int sev_handle_vmgexit(struct vcpu_svm *svm) "vmgexit: unsupported event - exit_info_1=%#llx, exit_info_2=%#llx\n", control->exit_info_1, control->exit_info_2); break; + case SVM_EXIT_IOIO: + if (!((control->exit_info_1 & SVM_IOIO_SIZE_MASK) >> SVM_IOIO_SIZE_SHIFT)) + return 1; + + fallthrough; default: ret = svm_invoke_exit_handler(svm, exit_code); } @@ -2810,6 +2815,9 @@ int sev_es_string_io(struct vcpu_svm *svm, int size, unsigned int port, int in) if (unlikely(check_mul_overflow(count, size, &bytes))) return -EINVAL; + if (!bytes) + return 1; + if (!setup_vmgexit_scratch(svm, in, bytes)) return -EINVAL; -- 2.34.1

2 1

[PATCH OLK-6.6] x86/bugs: Enable IBPB flush on BPF JIT allocation
by Zhang Kunbo 06 Aug '26

06 Aug '26

From: Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> stable inclusion from stable-v6.6.145 commit cb27f3bf915cc0f20fc0c48da9059304e39ebd35 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16808 CVE: CVE-2026-64507 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit a3af84b0fa00ead01fcd0e28b5d773ff25990a0d upstream. Enable hardening against JIT spraying when Spectre-v2 mitigations are in use. Specifically, issue an IBPB flush on BPF JIT memory reuse. Skip enabling the IBPB flush if the BPF dispatcher is already using a retpoline sequence. This hardening applies only when BPF-JIT is in use. Guard the enabling under CONFIG_BPF_JIT so that bugs.c still builds with CONFIG_BPF_JIT=n. [ pawan: Use entry_ibpb() instead of write_ibpb(). JIT hardening enable moved to spectre_v2_select_mitigation() because there is no spectre_v2_apply_mitigation()] Signed-off-by: Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> Acked-by: Daniel Borkmann <daniel(a)iogearbox.net> Acked-by: Dave Hansen <dave.hansen(a)linux.intel.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: arch/x86/include/asm/nospec-branch.h [context conflicts] Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- arch/x86/include/asm/nospec-branch.h | 4 +++ arch/x86/kernel/cpu/bugs.c | 50 +++++++++++++++++++++++++--- 2 files changed, 49 insertions(+), 5 deletions(-) diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h index 58dda23aee1b..d4eae71b2ab7 100644 --- a/arch/x86/include/asm/nospec-branch.h +++ b/arch/x86/include/asm/nospec-branch.h @@ -408,6 +408,10 @@ extern void srso_alias_untrain_ret(void); extern void entry_untrain_ret(void); extern void write_ibpb(void); +#ifdef CONFIG_BPF_JIT +extern void bpf_arch_ibpb(void); +#endif + #ifdef CONFIG_X86_64 extern void clear_bhb_loop(void); #endif diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c index 212408f6de11..e53ea50132e7 100644 --- a/arch/x86/kernel/cpu/bugs.c +++ b/arch/x86/kernel/cpu/bugs.c @@ -16,6 +16,7 @@ #include <linux/sched/smt.h> #include <linux/pgtable.h> #include <linux/bpf.h> +#include <linux/filter.h> #include <asm/spec-ctrl.h> #include <asm/cmdline.h> @@ -1312,8 +1313,21 @@ static inline const char *spectre_v2_module_string(void) { return spectre_v2_bad_module ? " - vulnerable module loaded" : ""; } + +/* + * The "retpoline sequence" is the "call;mov;ret" sequence that + * replaces normal indirect branch instructions. Differentiate + * *the* retpoline sequence from the LFENCE-prefixed indirect + * branches that simply use the retpoline infrastructure. + */ +static inline bool retpoline_seq_enabled(void) +{ + return boot_cpu_has(X86_FEATURE_RETPOLINE) && !boot_cpu_has(X86_FEATURE_RETPOLINE_LFENCE); +} + #else static inline const char *spectre_v2_module_string(void) { return ""; } +static inline bool retpoline_seq_enabled(void) { return false; } #endif #define SPECTRE_V2_LFENCE_MSG "WARNING: LFENCE mitigation is not recommended for this CPU, data leaks possible!\n" @@ -1787,8 +1801,7 @@ static void __init bhi_select_mitigation(void) return; /* Retpoline mitigates against BHI unless the CPU has RRSBA behavior */ - if (boot_cpu_has(X86_FEATURE_RETPOLINE) && - !boot_cpu_has(X86_FEATURE_RETPOLINE_LFENCE)) { + if (retpoline_seq_enabled()) { spec_ctrl_disable_kernel_rrsba(); if (rrsba_disabled) return; @@ -1810,6 +1823,27 @@ static void __init bhi_select_mitigation(void) pr_info("Spectre BHI mitigation: SW BHB clearing on syscall\n"); } +#ifdef CONFIG_BPF_JIT +static void __bpf_arch_ibpb(void *unused) +{ + entry_ibpb(); +} + +void bpf_arch_ibpb(void) +{ + on_each_cpu(__bpf_arch_ibpb, NULL, 1); +} + +static bool __init cpu_wants_ibpb_bpf(void) +{ + /* A genuine retpoline already neutralizes ring0 indirect predictions */ + if (retpoline_seq_enabled()) + return false; + + return boot_cpu_has(X86_FEATURE_IBPB); +} +#endif + static void __init spectre_v2_select_mitigation(void) { enum spectre_v2_mitigation_cmd cmd = spectre_v2_parse_cmdline(); @@ -1955,6 +1989,14 @@ static void __init spectre_v2_select_mitigation(void) pr_info("Enabling Restricted Speculation for firmware calls\n"); } +#ifdef CONFIG_BPF_JIT + if (cpu_wants_ibpb_bpf()) { + static_call_update(bpf_arch_pred_flush, bpf_arch_ibpb); + static_branch_enable(&bpf_pred_flush_enabled); + pr_info("Enabling IBPB for BPF\n"); + } +#endif + /* Set up IBPB and STIBP depending on the general spectre V2 command */ spectre_v2_cmd = cmd; } @@ -3113,9 +3155,7 @@ static const char *spectre_bhi_state(void) return "; BHI: BHI_DIS_S"; else if (boot_cpu_has(X86_FEATURE_CLEAR_BHB_LOOP)) return "; BHI: SW loop, KVM: SW loop"; - else if (boot_cpu_has(X86_FEATURE_RETPOLINE) && - !boot_cpu_has(X86_FEATURE_RETPOLINE_LFENCE) && - rrsba_disabled) + else if (retpoline_seq_enabled() && rrsba_disabled) return "; BHI: Retpoline"; else if (boot_cpu_has(X86_FEATURE_CLEAR_BHB_LOOP_ON_VMEXIT)) return "; BHI: Vulnerable, KVM: SW loop"; -- 2.34.1

2 1