- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] udf: Fix uninitialized array access for some pathnames
by Chen Jinghuang 25 Sep '25

25 Sep '25

From: Jan Kara <jack(a)suse.cz> stable inclusion from stable-v4.19.293 commit b37f998d357102e8eb0f8eeb33f03fff22e49cbf category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICY48N CVE: CVE-2023-53165 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit 028f6055c912588e6f72722d89c30b401bbcf013 ] For filenames that begin with . and are between 2 and 5 characters long, UDF charset conversion code would read uninitialized memory in the output buffer. The only practical impact is that the name may be prepended a "unification hash" when it is not actually needed but still it is good to fix this. Reported-by: syzbot+cd311b1e43cc25f90d18(a)syzkaller.appspotmail.com Link: https://lore.kernel.org/all/000000000000e2638a05fe9dc8f9@google.com Signed-off-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- fs/udf/unicode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/udf/unicode.c b/fs/udf/unicode.c index 5fcfa96463eb..85521d6b0237 100644 --- a/fs/udf/unicode.c +++ b/fs/udf/unicode.c @@ -247,7 +247,7 @@ static int udf_name_from_CS0(struct super_block *sb, } if (translate) { - if (str_o_len <= 2 && str_o[0] == '.' && + if (str_o_len > 0 && str_o_len <= 2 && str_o[0] == '.' && (str_o_len == 1 || str_o[1] == '.')) needsCRC = 1; if (needsCRC) { -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] perf: arm_pmuv3: Factor out PMCCNTR_EL0 use conditions and Don't use PMCCNTR_EL0 on SMT cores
by Yushan Wang 25 Sep '25

25 Sep '25

From: Qizhi Zhang <zhangqizhi3(a)h-partners.com> perf: arm_pmuv3: Factor out PMCCNTR_EL0 use conditions and Don't use PMCCNTR_EL0 on SMT cores Yicong Yang (2): perf: arm_pmuv3: Factor out PMCCNTR_EL0 use conditions perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores drivers/perf/arm_pmu.c | 3 +++ drivers/perf/arm_pmuv3.c | 34 ++++++++++++++++++++++++++++++---- include/linux/arch_topology.h | 11 +++++++++++ include/linux/perf/arm_pmu.h | 1 + 4 files changed, 45 insertions(+), 4 deletions(-) -- 2.33.0

2 3

[PATCH OLK-6.6 0/9] Implement disable/enable for (delayed) work
by Qi Xi 25 Sep '25

25 Sep '25

*** BLURB HERE *** Tejun Heo (8): [Backport] workqueue: Rename __cancel_work_timer() to __cancel_timer_sync() [Backport] workqueue: Introduce work_cancel_flags [Backport] workqueue: Clean up enum work_bits and related constants [Backport] workqueue: Factor out work_grab_pending() from __cancel_work_sync() [Backport] workqueue: Remove clear_work_data() [Backport] workqueue: Make @flags handling consistent across set_work_data() and friends [Backport] workqueue: Preserve OFFQ bits in cancel[_sync] paths [Backport] workqueue: Implement disable/enable for (delayed) work items Will Deacon (1): [Backport] workqueue: Fix UBSAN 'subtraction overflow' error in shift_and_mask() include/linux/workqueue.h | 68 +++--- kernel/workqueue.c | 426 +++++++++++++++++++++++++++----------- 2 files changed, 353 insertions(+), 141 deletions(-) -- 2.33.0

2 10

[PATCH OLK-6.6 1/9] [Backport] workqueue: Rename __cancel_work_timer() to __cancel_timer_sync()
by Qi Xi 25 Sep '25

25 Sep '25

From: Tejun Heo <tj(a)kernel.org> mainline inclusion from mainline-v6.9-rc1 commit c5140688d19a4579f7b01e6ca4b6e5f5d23d3d4d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEANP CVE: CVE-2024-56591 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- __cancel_work_timer() is used to implement cancel_work_sync() and cancel_delayed_work_sync(), similarly to how __cancel_work() is used to implement cancel_work() and cancel_delayed_work(). ie. The _timer part of the name is a complete misnomer. The difference from __cancel_work() is the fact that it syncs against work item execution not whether it handles timers or not. Let's rename it to less confusing __cancel_work_sync(). No functional change. Signed-off-by: Tejun Heo <tj(a)kernel.org> Reviewed-by: Lai Jiangshan <jiangshanlai(a)gmail.com> Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- kernel/workqueue.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/kernel/workqueue.c b/kernel/workqueue.c index bc5e508bbe9b..e1d14bf8c54b 100644 --- a/kernel/workqueue.c +++ b/kernel/workqueue.c @@ -3466,7 +3466,7 @@ static int cwt_wakefn(wait_queue_entry_t *wait, unsigned mode, int sync, void *k return autoremove_wake_function(wait, mode, sync, key); } -static bool __cancel_work_timer(struct work_struct *work, bool is_dwork) +static bool __cancel_work_sync(struct work_struct *work, bool is_dwork) { static DECLARE_WAIT_QUEUE_HEAD(cancel_waitq); unsigned long flags; @@ -3550,7 +3550,7 @@ static bool __cancel_work_timer(struct work_struct *work, bool is_dwork) */ bool cancel_work_sync(struct work_struct *work) { - return __cancel_work_timer(work, false); + return __cancel_work_sync(work, false); } EXPORT_SYMBOL_GPL(cancel_work_sync); @@ -3655,7 +3655,7 @@ EXPORT_SYMBOL(cancel_delayed_work); */ bool cancel_delayed_work_sync(struct delayed_work *dwork) { - return __cancel_work_timer(&dwork->work, true); + return __cancel_work_sync(&dwork->work, true); } EXPORT_SYMBOL(cancel_delayed_work_sync); -- 2.33.0

2 10

[PATCH openEuler-1.0-LTS] scsi: qla2xxx: Init 'nvme_ls_waitq' in qla_nvme_ls_req()
by Qi Xi 25 Sep '25

25 Sep '25

From: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICYAB4 CVE: CVE-2023-53280 -------------------------------- If we enter a error branch in qla_nvme_ls_req(), we will wakeup 'sp->nvme_ls_waitq', but it is not initilized. It will cause system crash. Fix it by initilizing 'nvme_ls_waitq' in qla_nvme_ls_req(). This commit is based on the mainline commit 20fce500b232b970e40312a9c97e7f3b6d7a709c 'scsi: qla2xxx: Remove unused nvme_ls_waitq wait queue'. But we are still use nvme_ls_waitq wait queue because commit 219d27d7147e ("scsi: qla2xxx: Fix race conditions in the code for aborting SCSI commands") is not merged. Fixes: 5621b0dd7453 ("scsi: qla2xxx: Simpify unregistration of FC-NVMe local/remote ports") Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/scsi/qla2xxx/qla_nvme.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c index daa412667d6e..120bc13d8dcd 100644 --- a/drivers/scsi/qla2xxx/qla_nvme.c +++ b/drivers/scsi/qla2xxx/qla_nvme.c @@ -237,6 +237,7 @@ static int qla_nvme_ls_req(struct nvme_fc_local_port *lport, sp->name = "nvme_ls"; sp->done = qla_nvme_sp_ls_done; atomic_set(&sp->ref_count, 1); + init_waitqueue_head(&sp->nvme_ls_waitq); nvme = &sp->u.iocb_cmd; priv->sp = sp; priv->fd = fd; -- 2.20.1

2 1

[PATCH openEuler-1.0-LTS 0/2] fix race between memory offline and UCE handling
by Jinjiang Tu 25 Sep '25

25 Sep '25

Jinjiang Tu (1): mm/memory_hotplug: fix hwpoisoned large folio handling in do_migrate_range() Ma Wupeng (1): hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio mm/memory_hotplug.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) -- 2.43.0

2 3

[PATCH openEuler-1.0-LTS] watchdog: Fix kmemleak in watchdog_cdev_register
by Jinjiang Tu 25 Sep '25

25 Sep '25

From: Chen Jun <chenjun102(a)huawei.com> stable inclusion from stable-v4.19.276 commit 8c1655600f4f2839fb844fe8c70b2b65fadc7a56 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICY4HK CVE: CVE-2023-53234 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 13721a2ac66b246f5802ba1b75ad8637e53eeecc ] kmemleak reports memory leaks in watchdog_dev_register, as follows: unreferenced object 0xffff888116233000 (size 2048): comm ""modprobe"", pid 28147, jiffies 4353426116 (age 61.741s) hex dump (first 32 bytes): 80 fa b9 05 81 88 ff ff 08 30 23 16 81 88 ff ff .........0#..... 08 30 23 16 81 88 ff ff 00 00 00 00 00 00 00 00 .0#............. backtrace: [<000000007f001ffd>] __kmem_cache_alloc_node+0x157/0x220 [<000000006a389304>] kmalloc_trace+0x21/0x110 [<000000008d640eea>] watchdog_dev_register+0x4e/0x780 [watchdog] [<0000000053c9f248>] __watchdog_register_device+0x4f0/0x680 [watchdog] [<00000000b2979824>] watchdog_register_device+0xd2/0x110 [watchdog] [<000000001f730178>] 0xffffffffc10880ae [<000000007a1a8bcc>] do_one_initcall+0xcb/0x4d0 [<00000000b98be325>] do_init_module+0x1ca/0x5f0 [<0000000046d08e7c>] load_module+0x6133/0x70f0 ... unreferenced object 0xffff888105b9fa80 (size 16): comm ""modprobe"", pid 28147, jiffies 4353426116 (age 61.741s) hex dump (first 16 bytes): 77 61 74 63 68 64 6f 67 31 00 b9 05 81 88 ff ff watchdog1....... backtrace: [<000000007f001ffd>] __kmem_cache_alloc_node+0x157/0x220 [<00000000486ab89b>] __kmalloc_node_track_caller+0x44/0x1b0 [<000000005a39aab0>] kvasprintf+0xb5/0x140 [<0000000024806f85>] kvasprintf_const+0x55/0x180 [<000000009276cb7f>] kobject_set_name_vargs+0x56/0x150 [<00000000a92e820b>] dev_set_name+0xab/0xe0 [<00000000cec812c6>] watchdog_dev_register+0x285/0x780 [watchdog] [<0000000053c9f248>] __watchdog_register_device+0x4f0/0x680 [watchdog] [<00000000b2979824>] watchdog_register_device+0xd2/0x110 [watchdog] [<000000001f730178>] 0xffffffffc10880ae [<000000007a1a8bcc>] do_one_initcall+0xcb/0x4d0 [<00000000b98be325>] do_init_module+0x1ca/0x5f0 [<0000000046d08e7c>] load_module+0x6133/0x70f0 ... The reason is that put_device is not be called if cdev_device_add fails and wdd->id != 0. watchdog_cdev_register wd_data = kzalloc [1] err = dev_set_name [2] .. err = cdev_device_add if (err) { if (wdd->id == 0) { // wdd->id != 0 .. } return err; // [1],[2] would be leaked To fix it, call put_device in all wdd->id cases. Fixes: 72139dfa2464 ("watchdog: Fix the race between the release of watchdog_core_data and cdev") Signed-off-by: Chen Jun <chenjun102(a)huawei.com> Reviewed-by: Guenter Roeck <linux(a)roeck-us.net> Link: https://lore.kernel.org/r/20221116012714.102066-1-chenjun102@huawei.com Signed-off-by: Guenter Roeck <linux(a)roeck-us.net> Signed-off-by: Wim Van Sebroeck <wim(a)linux-watchdog.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- drivers/watchdog/watchdog_dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/watchdog/watchdog_dev.c b/drivers/watchdog/watchdog_dev.c index 2b652df44593..e6d0247d349d 100644 --- a/drivers/watchdog/watchdog_dev.c +++ b/drivers/watchdog/watchdog_dev.c @@ -1052,8 +1052,8 @@ static int watchdog_cdev_register(struct watchdog_device *wdd) if (wdd->id == 0) { misc_deregister(&watchdog_miscdev); old_wd_data = NULL; - put_device(&wd_data->dev); } + put_device(&wd_data->dev); return err; } -- 2.43.0

2 1

[PATCH OLK-6.6 1/9] [Backport] workqueue: Rename __cancel_work_timer() to __cancel_timer_sync()
by Qi Xi 25 Sep '25

25 Sep '25

From: Tejun Heo <tj(a)kernel.org> mainline inclusion from mainline-v6.9-rc1 commit c5140688d19a4579f7b01e6ca4b6e5f5d23d3d4d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEANP CVE: CVE-2024-56591 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- __cancel_work_timer() is used to implement cancel_work_sync() and cancel_delayed_work_sync(), similarly to how __cancel_work() is used to implement cancel_work() and cancel_delayed_work(). ie. The _timer part of the name is a complete misnomer. The difference from __cancel_work() is the fact that it syncs against work item execution not whether it handles timers or not. Let's rename it to less confusing __cancel_work_sync(). No functional change. Signed-off-by: Tejun Heo <tj(a)kernel.org> Reviewed-by: Lai Jiangshan <jiangshanlai(a)gmail.com> Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- kernel/workqueue.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/kernel/workqueue.c b/kernel/workqueue.c index bc5e508bbe9b..e1d14bf8c54b 100644 --- a/kernel/workqueue.c +++ b/kernel/workqueue.c @@ -3466,7 +3466,7 @@ static int cwt_wakefn(wait_queue_entry_t *wait, unsigned mode, int sync, void *k return autoremove_wake_function(wait, mode, sync, key); } -static bool __cancel_work_timer(struct work_struct *work, bool is_dwork) +static bool __cancel_work_sync(struct work_struct *work, bool is_dwork) { static DECLARE_WAIT_QUEUE_HEAD(cancel_waitq); unsigned long flags; @@ -3550,7 +3550,7 @@ static bool __cancel_work_timer(struct work_struct *work, bool is_dwork) */ bool cancel_work_sync(struct work_struct *work) { - return __cancel_work_timer(work, false); + return __cancel_work_sync(work, false); } EXPORT_SYMBOL_GPL(cancel_work_sync); @@ -3655,7 +3655,7 @@ EXPORT_SYMBOL(cancel_delayed_work); */ bool cancel_delayed_work_sync(struct delayed_work *dwork) { - return __cancel_work_timer(&dwork->work, true); + return __cancel_work_sync(&dwork->work, true); } EXPORT_SYMBOL(cancel_delayed_work_sync); -- 2.33.0

2 9

[PATCH openEuler-1.0-LTS 0/2] fix CVE-2022-50384 and CVE-2022-50249
by Tong Tiangen 25 Sep '25

25 Sep '25

Gaosheng Cui (1): staging: vme_user: Fix possible UAF in tsi148_dma_list_add Liang He (1): memory: of: Fix refcount leak bug in of_get_ddr_timings() drivers/memory/of_memory.c | 1 + drivers/vme/bridges/vme_tsi148.c | 1 + 2 files changed, 2 insertions(+) -- 2.25.1

2 3

[PATCH OLK-6.6] usb: core: config: Prevent OOB read in SS endpoint companion parsing
by Huang Xiaojia 25 Sep '25

25 Sep '25

From: Xinyu Liu <katieeliu(a)tencent.com> stable inclusion from stable-v6.6.103 commit 5badd56c711e2c8371d1670f9bd486697575423c category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICXO12 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit cf16f408364efd8a68f39011a3b073c83a03612d upstream. usb_parse_ss_endpoint_companion() checks descriptor type before length, enabling a potentially odd read outside of the buffer size. Fix this up by checking the size first before looking at any of the fields in the descriptor. Signed-off-by: Xinyu Liu <katieeliu(a)tencent.com> Cc: stable <stable(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Huang Xiaojia <huangxiaojia2(a)huawei.com> --- drivers/usb/core/config.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c index 847dd32c0f5e..3180419424c0 100644 --- a/drivers/usb/core/config.c +++ b/drivers/usb/core/config.c @@ -81,8 +81,14 @@ static void usb_parse_ss_endpoint_companion(struct device *ddev, int cfgno, */ desc = (struct usb_ss_ep_comp_descriptor *) buffer; - if (desc->bDescriptorType != USB_DT_SS_ENDPOINT_COMP || - size < USB_DT_SS_EP_COMP_SIZE) { + if (size < USB_DT_SS_EP_COMP_SIZE) { + dev_notice(ddev, + "invalid SuperSpeed endpoint companion descriptor " + "of length %d, skipping\n", size); + return; + } + + if (desc->bDescriptorType != USB_DT_SS_ENDPOINT_COMP) { dev_notice(ddev, "No SuperSpeed endpoint companion for config %d " " interface %d altsetting %d ep %d: " "using minimum values\n", -- 2.34.1

2 1