- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] perf/x86/intel/uncore: Fix PCI device refcount leak in UPI discovery
by Luo Gengkun 20 Jul '26

20 Jul '26

From: Zide Chen <zide.chen(a)intel.com> mainline inclusion from mainline-v7.2-rc1 commit 81ec618f59415bdcf3e8989e2691c1f240be27fb category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16325 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- pci_get_domain_bus_and_slot() increments the reference count of the returned PCI device and therefore requires a matching pci_dev_put(). In skx_upi_topology_cb() and discover_upi_topology(), the lookup is performed inside a loop, but pci_dev_put() is only called once after the loop. As a result, references from all previous iterations are leaked. Move pci_dev_put(dev) into the if (dev) block immediately after upi_fill_topology() returns. Opportunistically, fix uninitialized variable in skx_upi_topology_cb(). Fixes: 4cfce57fa42d ("perf/x86/intel/uncore: Enable UPI topology discovery for Skylake Server") Fixes: f680b6e6062e ("perf/x86/intel/uncore: Enable UPI topology discovery for Icelake Server") Signed-off-by: Zide Chen <zide.chen(a)intel.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Reviewed-by: Dapeng Mi <dapeng1.mi(a)linux.intel.com> Link: https://patch.msgid.link/20260602144908.263680-4-zide.chen@intel.com Conflicts: arch/x86/events/intel/uncore_snbep.c [Fix ctx diff.] Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- arch/x86/events/intel/uncore_snbep.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c index 65d30e7501e3..e696d13a578c 100644 --- a/arch/x86/events/intel/uncore_snbep.c +++ b/arch/x86/events/intel/uncore_snbep.c @@ -4326,7 +4326,7 @@ static int upi_fill_topology(struct pci_dev *dev, struct intel_uncore_topology * static int skx_upi_topology_cb(struct intel_uncore_type *type, int segment, int die, u64 cpu_bus_msr) { - int idx, ret; + int idx, ret = 0; struct intel_uncore_topology *upi; unsigned int devfn; struct pci_dev *dev = NULL; @@ -4339,12 +4339,12 @@ static int skx_upi_topology_cb(struct intel_uncore_type *type, int segment, dev = pci_get_domain_bus_and_slot(segment, bus, devfn); if (dev) { ret = upi_fill_topology(dev, upi, idx); + pci_dev_put(dev); if (ret) break; } } - pci_dev_put(dev); return ret; } @@ -5592,6 +5592,7 @@ static int discover_upi_topology(struct intel_uncore_type *type, int ubox_did, i devfn); if (dev) { ret = upi_fill_topology(dev, upi, idx); + pci_dev_put(dev); if (ret) goto err; } @@ -5601,7 +5602,6 @@ static int discover_upi_topology(struct intel_uncore_type *type, int ubox_did, i } err: pci_dev_put(ubox); - pci_dev_put(dev); return ret; } -- 2.34.1

2 1

[PATCH OLK-6.6 0/7] CVE-2026-45905: xfrm icmp_route_lookup reverse path race fix for OLK-6.6
by superdcc97＠163.com 20 Jul '26

20 Jul '26

From: Dong Chenchen <dongchenchen2(a)huawei.com> This series backports the CVE-2026-45905 fix and its required LTS-6.6 prerequisites to OLK-6.6. It converts ip_route_input() and icmp_route_lookup() to dscp_t, adds the skb_dstref_steal/restore helpers, and finally fixes the ip_rt_bug race in the XFRM ICMP reverse path. Because OLK-6.6 already contains an earlier partial backport of cve-001 ("ipvlan: ensure network headers are in skb linear part") and cve-010 ("net: Add skb_dstref_steal and skb_dstref_restore"), those two patches are omitted as redundant. The remaining ipvlan-specific prerequisites (cve-002 and cve-005) cannot be cleanly applied against the OLK-6.6 version of ipvlan_core.c without conflicting with the existing partial backport, so they are also skipped. The functional CVE-2026-45905 fix is fully applied. Guillaume Nault (2): ipv4: Convert icmp_route_lookup() to dscp_t. ipv4: Convert ip_route_input() to dscp_t. Ido Schimmel (2): ipv4: icmp: Pass full DS field to ip_route_input() ipv4: icmp: Unmask upper DSCP bits in icmp_route_lookup() Jiayuan Chen (1): xfrm: fix ip_rt_bug race in icmp_route_lookup reverse path Peilin He (1): net/ipv4: add tracepoint for icmp_send Stanislav Fomichev (1): net: Switch to skb_dstref_steal/skb_dstref_restore for ip_route_input callers include/net/ip.h | 5 +++ include/net/route.h | 5 ++- include/trace/events/icmp.h | 67 +++++++++++++++++++++++++++++++++ net/bridge/br_netfilter_hooks.c | 8 ++-- net/ipv4/icmp.c | 46 +++++++++++++++------- net/ipv4/ip_options.c | 8 ++-- net/ipv6/ip6_tunnel.c | 4 +- 7 files changed, 119 insertions(+), 24 deletions(-) create mode 100644 include/trace/events/icmp.h -- 2.43.0

2 8

[PATCH OLK-6.6] ixgbevf: fix use-after-free in VEPA multicast source pruning
by Luo Gengkun 20 Jul '26

20 Jul '26

From: Michael Bommarito <michael.bommarito(a)gmail.com> stable inclusion from stable-v6.6.142 commit add70e2682c0ad3be2a5810bcf1bc13963ba4df9 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16356 CVE: CVE-2026-64113 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- commit 5d49b568c188dc77199d8d2b959c91da8cc27cf1 upstream. ixgbevf_clean_rx_irq() prunes frames whose source MAC matches the VF's own address (VEPA multicast workaround) by freeing the skb and continuing to the next descriptor: dev_kfree_skb_irq(skb); continue; The skb pointer is declared outside the while loop and persists across iterations. Because the continue skips the "skb = NULL" reset at the bottom of the loop, the next iteration enters the "else if (skb)" path and calls ixgbevf_add_rx_frag() on the freed skb, dereferencing skb_shinfo(skb)->nr_frags - a use-after-free in NAPI softirq context. The sibling driver iavf already handles this correctly by nulling the pointer before continuing. Apply the same pattern here. I do not have ixgbevf hardware; the bug was found by static analysis (scan_drop_continue_loops.py + semgrep drop_continue_in_loop, multi-tool corroboration with the highest score in the scan). The UAF was confirmed under KASAN by loading a test module that reproduces the exact code pattern (alloc skb, kfree_skb, then read skb_shinfo(skb)->nr_frags): BUG: KASAN: slab-use-after-free in ixgbevf_uaf_test_init+0x100/0x1000 Read of size 8 at addr 000000006163ae78 by task insmod/30 freed 208-byte region [000000006163adc0, 000000006163ae90) QEMU emulates igb (82576) but not ixgbe (82599), and the igbvf VF driver does not include the VEPA source pruning path, so a full end-to-end reproduction with emulated hardware was not possible. Fixes: bad17234ba70 ("ixgbevf: Change receive model to use double buffered page based receives") Cc: stable(a)vger.kernel.org Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Tested-by: Rafal Romanowski <rafal.romanowski(a)intel.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com> Link: https://patch.msgid.link/20260515182419.1597859-8-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c index 72b17a0f052c..99d6aa03d4b6 100644 --- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c +++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c @@ -1225,6 +1225,7 @@ static int ixgbevf_clean_rx_irq(struct ixgbevf_q_vector *q_vector, ether_addr_equal(rx_ring->netdev->dev_addr, eth_hdr(skb)->h_source)) { dev_kfree_skb_irq(skb); + skb = NULL; continue; } -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] net: Fix CVE-2026-53264
by Dong Chenchen 20 Jul '26

20 Jul '26

net: Fix CVE-2026-53264 Dong Chenchen (1): net: Fix kabi breakage of struct tc_action Jamal Hadi Salim (1): net/sched: act_api: use RCU with deferred freeing for action lifecycle include/net/act_api.h | 7 +++++++ net/sched/act_api.c | 26 ++++++++++++++++++++------ 2 files changed, 27 insertions(+), 6 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6 0/3] bonding: Fix CVE-2026-43456
by Dong Chenchen 20 Jul '26

20 Jul '26

Fix CVE-2026-43456 Dong Chenchen (1): net: Fix kabi breakage of struct header_ops Eric Dumazet (1): bonding: prevent potential infinite loop in bond_header_parse() Jiayuan Chen (1): bonding: fix type confusion in bond_setup_by_slave() drivers/net/bonding/bond_main.c | 53 ++++++++++++++++++++++++++++++++- include/linux/netdevice.h | 15 +++++++--- 2 files changed, 63 insertions(+), 5 deletions(-) -- 2.25.1

2 4

[PATCH OLK-6.6 0/4] net: Fix CVE-2026-53091
by Dong Chenchen 20 Jul '26

20 Jul '26

Fix CVE-2026-53091 Cosmin Ratiu (1): xfrm: Don't clobber inner headers when already set Eric Dumazet (2): net: qdisc_pkt_len_segs_init() cleanup net: pull headers in qdisc_pkt_len_segs_init() Fengyuan Gong (1): net: account for encap headers in qdisc pkt len net/core/dev.c | 79 ++++++++++++++++++++++++++---------------- net/sched/sch_cake.c | 5 ++- net/xfrm/xfrm_output.c | 20 +++++++---- 3 files changed, 67 insertions(+), 37 deletions(-) -- 2.25.1

2 5

[PATCH OLK-6.6 0/2] net: Fix CVE-2026-53264
by Dong Chenchen 20 Jul '26

20 Jul '26

net: Fix CVE-2026-53264 Dong Chenchen (1): net: Fix kabi breakage of struct tc_action Jamal Hadi Salim (1): net/sched: act_api: use RCU with deferred freeing for action lifecycle include/net/act_api.h | 7 +++++++ net/sched/act_api.c | 26 ++++++++++++++++++++------ 2 files changed, 27 insertions(+), 6 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6 0/3] bonding: Fix CVE-2026-43456
by Dong Chenchen 20 Jul '26

20 Jul '26

Fix CVE-2026-43456 Dong Chenchen (1): net: Fix kabi breakage of struct header_ops Eric Dumazet (1): bonding: prevent potential infinite loop in bond_header_parse() Jiayuan Chen (1): bonding: fix type confusion in bond_setup_by_slave() drivers/net/bonding/bond_main.c | 53 ++++++++++++++++++++++++++++++++- include/linux/netdevice.h | 15 +++++++--- 2 files changed, 63 insertions(+), 5 deletions(-) -- 2.25.1

2 4

[PATCH OLK-5.10] Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()
by Chen Jinghuang 20 Jul '26

20 Jul '26

From: Siwei Zhang <oss(a)fourdim.xyz> stable inclusion from stable-v5.10.259 commit 3634cbdc2eb414b69ffa752ddbe5e0458518e321 category: bugfix bugzilla: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 8c8e620467a7b51562dbcefbd1f09f288d7d710d ] l2cap_chan_close() removes the channel from conn->chan_l, which must be done under conn->lock. cleanup_listen() runs under the parent sk_lock, so acquiring conn->lock would invert the established conn->lock -> chan->lock -> sk_lock order. Instead of calling l2cap_chan_close() directly, schedule l2cap_chan_timeout with delay 0 to close the channel asynchronously. The timeout handler already acquires conn->lock and chan->lock in the correct order. The timer is only armed when chan->conn is still set: if it is already NULL, l2cap_conn_del() has already processed this channel (l2cap_chan_del + l2cap_sock_teardown_cb + l2cap_sock_close_cb), so there is nothing left to do. If l2cap_conn_del() races in after the timer is armed, __clear_chan_timer() inside l2cap_chan_del() cancels it; if the timer has already fired, the handler returns harmlessly because chan->conn was cleared. Fixes: 3df91ea20e74 ("Bluetooth: Revert to mutexes from RCU list") Cc: <stable(a)vger.kernel.org> # 0b58004: Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() Signed-off-by: Siwei Zhang <oss(a)fourdim.xyz> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- net/bluetooth/l2cap_sock.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c index 644ec4bf06f0..4b4a9268f007 100644 --- a/net/bluetooth/l2cap_sock.c +++ b/net/bluetooth/l2cap_sock.c @@ -1441,6 +1441,10 @@ static void l2cap_sock_cleanup_listen(struct sock *parent) * pin it (hold_unless_zero() additionally skips a chan already past * its last reference). We then drop the sk lock before taking * chan->lock, so sk and chan locks are never held together. + * + * Since we cannot call l2cap_chan_close() without conn->lock, + * schedule l2cap_chan_timeout to close the channel; it already + * acquires conn->lock -> chan->lock in the correct order. */ while ((sk = bt_accept_dequeue(parent, NULL))) { struct l2cap_chan *chan; @@ -1458,14 +1462,12 @@ static void l2cap_sock_cleanup_listen(struct sock *parent) state_to_string(chan->state)); l2cap_chan_lock(chan); - __clear_chan_timer(chan); - l2cap_chan_close(chan, ECONNRESET); - /* l2cap_conn_del() may already have killed this socket - * (it sets SOCK_DEAD); skip the duplicate to avoid a - * double sock_put()/l2cap_chan_put(). + /* Since we cannot call l2cap_chan_close() without + * conn->lock, schedule its timer to trigger the close + * and cleanup of this channel. */ - if (!sock_flag(sk, SOCK_DEAD)) - l2cap_sock_kill(sk); + if (chan->conn) + __set_chan_timer(chan, 0); l2cap_chan_unlock(chan); l2cap_chan_put(chan); -- 2.34.1

2 1

[PATCH OLK-5.10] ceph: fix a buffer leak in __ceph_setxattr()
by Pan Taixi 20 Jul '26

20 Jul '26

From: Viacheslav Dubeyko <Slava.Dubeyko(a)ibm.com> stable inclusion from stable-v5.10.258 commit 521e5aba857fd267624892c8dd6295f22ce0267e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15664 CVE: CVE-2026-52962 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 5d3cc36b4e77a27ce7b686b7c59c7072bcb3fa8e upstream. The old_blob in __ceph_setxattr() can store ci->i_xattrs.prealloc_blob value during the retry. However, it is never called the ceph_buffer_put() for the old_blob object. This patch fixes the issue of the buffer leak. Cc: stable(a)vger.kernel.org Signed-off-by: Viacheslav Dubeyko <Slava.Dubeyko(a)ibm.com> Reviewed-by: Alex Markuze <amarkuze(a)redhat.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lin Yujun <linyujun809(a)h-partners.com> Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com> --- fs/ceph/xattr.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/ceph/xattr.c b/fs/ceph/xattr.c index 76322c0f6e5f..d1fd81b1b541 100644 --- a/fs/ceph/xattr.c +++ b/fs/ceph/xattr.c @@ -1130,10 +1130,11 @@ int __ceph_setxattr(struct inode *inode, const char *name, ceph_free_cap_flush(prealloc_cf); return err; do_sync: spin_unlock(&ci->i_ceph_lock); + ceph_buffer_put(old_blob); do_sync_unlocked: if (lock_snap_rwsem) up_read(&mdsc->snap_rwsem); /* security module set xattr while filling trace */ -- 2.34.1

2 1