- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] tty: vt: Fix vc_origin buffer copy overflow in fbcon_prepare_logo()
by Chen Jun 03 Nov '25

03 Nov '25

From: Wang ShaoBo <bobo.shaobowang(a)huawei.com> Offering: HULK hulk inclusion category: bugfix bugzilla: NA CVE: NA ---------------------------------------------------------------------- I got some KASAN report as below: BUG: KASAN: slab-use-after-free in fbcon_prepare_logo+0x61e/0xc90 Read of size 14 at addr ffff88812c9a4c38 by task syz.0.3549/19016 CPU: 0 PID: 19016 Comm: syz.0.3549 Not tainted 6.6.0+ #80 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x72/0xa0 print_address_description.constprop.0+0x6b/0x3d0 ? fbcon_prepare_logo+0x61e/0xc90 print_report+0xba/0x280 ? fbcon_prepare_logo+0x61e/0xc90 ? kasan_addr_to_slab+0xd/0xa0 ? fbcon_prepare_logo+0x61e/0xc90 kasan_report+0xaf/0xe0 ? fbcon_prepare_logo+0x61e/0xc90 kasan_check_range+0x100/0x1c0 __asan_memcpy+0x23/0x60 fbcon_prepare_logo+0x61e/0xc90 fbcon_init+0xeb9/0x1db0 ? __pfx_drm_fb_helper_set_par+0x10/0x10 visual_init+0x310/0x5c0 do_bind_con_driver.isra.0+0x627/0xbd0 store_bind+0x60b/0x710 ? __pfx_store_bind+0x10/0x10 dev_attr_store+0x5a/0x90 ? __pfx_dev_attr_store+0x10/0x10 sysfs_kf_write+0x145/0x1b0 kernfs_fop_write_iter+0x367/0x580 ? __pfx_sysfs_kf_write+0x10/0x10 new_sync_write+0x1b1/0x2d0 ? __pfx_new_sync_write+0x10/0x10 ? rb_commit+0x121/0x910 ? avc_policy_seqno+0xe/0x20 ? selinux_file_permission+0x129/0x5d0 ? security_file_permission+0xa8/0x700 vfs_write+0x71a/0x960 ksys_write+0x12e/0x260 fbcon_init() -> vc_resize() //success resize vc_origin buffer size=224=7(cols)*2*16(rows) -> bcon_prepare_logo(vc, info, old_cols, old_rows, new_cols, new_rows) //old_cols=256，old_rows=4，new_cols=7，new_rows=16 There happened to be a vc_origin buffer copy overflow error in fbcon_prepare_logo(), scrolling screen down when using old cols after vc resize would trigger out of lower bound of vc_origin buffer. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Wang ShaoBo <bobo.shaobowang(a)huawei.com> Acked-by: Thomas Zimmermann <tzimmermann(a)suse.de> --- drivers/video/fbdev/core/fbcon.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c index f5178eefec64..83a4949e2497 100644 --- a/drivers/video/fbdev/core/fbcon.c +++ b/drivers/video/fbdev/core/fbcon.c @@ -592,6 +592,8 @@ static void fbcon_prepare_logo(struct vc_data *vc, struct fb_info *info, /* We can scroll screen down */ r = q - step - cols; for (cnt = rows - logo_lines; cnt > 0; cnt--) { + if (r < (unsigned short *) vc->vc_origin) + break; scr_memcpyw(r + step, r, vc->vc_size_row); r -= cols; } -- 2.22.0

2 1

[PATCH OLK-6.6 0/5] blk-ioinf: introduce inflight-based IO QoS controller
by Baokun Li 03 Nov '25

03 Nov '25

Baokun Li (5): blk-ioinf: introduce inflight-based IO QoS controller blk-ioinf: add rqos/inflight/stat debufs interface blk-ioinf: dynamically adjust inflight limit to balance workloads blk-ioinf: support percentile latency QoS for oneline workloads openeuler_defconfig: Enable CONFIG_BLK_CGROUP_IOINFLIGHT arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + block/Kconfig | 10 + block/Makefile | 1 + block/blk-ioinf.c | 1315 ++++++++++++++++++++++++ block/blk-mq-debugfs.c | 2 + block/blk-rq-qos.h | 1 + include/linux/blk-mq.h | 3 + 8 files changed, 1334 insertions(+) create mode 100644 block/blk-ioinf.c -- 2.46.1

2 6

[PATCH openEuler-1.0-LTS] mainline patch backport
by Xinyu Zheng 03 Nov '25

03 Nov '25

Huisong Li (1): ACPI: processor: idle: Fix memory leak when register cpuidle device failed Rafael J. Wysocki (1): PM: sleep: core: Clear power.must_resume in noirq suspend error path Sean Christopherson (2): x86/umip: Check that the instruction opcode is at least two bytes x86/umip: Fix decoding of register forms of 0F 01 (SGDT and SIDT aliases) arch/x86/kernel/umip.c | 15 +++++++++++++-- drivers/acpi/processor_idle.c | 3 +++ drivers/base/power/main.c | 14 +++++++++++++- 3 files changed, 29 insertions(+), 3 deletions(-) -- 2.34.1

2 8

[PATCH OLK-6.6 0/3] CVE-2025-38501
by Yongjian Sun 03 Nov '25

03 Nov '25

Namjae Jeon (3): ksmbd: limit repeated connections from clients with the same IP ksmbd: extend the connection limiting mechanism to support IPv6 ksmbd: add max ip connections parameter fs/smb/server/connection.h | 6 +++++ fs/smb/server/ksmbd_netlink.h | 5 ++-- fs/smb/server/server.h | 1 + fs/smb/server/transport_ipc.c | 3 +++ fs/smb/server/transport_tcp.c | 43 +++++++++++++++++++++++++++++++++++ 5 files changed, 56 insertions(+), 2 deletions(-) -- 2.39.2

2 4

[PATCH openEuler-1.0-LTS] wifi: ath9k: hif_usb: fix memory leak of remain_skbs
by Ziming Du 03 Nov '25

03 Nov '25

From: Fedor Pchelkin <pchelkin(a)ispras.ru> stable inclusion from stable-v4.19.283 commit 6719e3797ec52cd144c8a5ba8aaab36674800585 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID0VHF CVE: CVE-2023-53641 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 7654cc03eb699297130b693ec34e25f77b17c947 ] hif_dev->remain_skb is allocated and used exclusively in ath9k_hif_usb_rx_stream(). It is implied that an allocated remain_skb is processed and subsequently freed (in error paths) only during the next call of ath9k_hif_usb_rx_stream(). So, if the urbs are deallocated between those two calls due to the device deinitialization or suspend, it is possible that ath9k_hif_usb_rx_stream() is not called next time and the allocated remain_skb is leaked. Our local Syzkaller instance was able to trigger that. remain_skb makes sense when receiving two consecutive urbs which are logically linked together, i.e. a specific data field from the first skb indicates a cached skb to be allocated, memcpy'd with some data and subsequently processed in the next call to ath9k_hif_usb_rx_stream(). Urbs deallocation supposedly makes that link irrelevant so we need to free the cached skb in those cases. Fix the leak by introducing a function to explicitly free remain_skb (if it is not NULL) when the rx urbs have been deallocated. remain_skb is NULL when it has not been allocated at all (hif_dev struct is kzalloced) or when it has been processed in next call to ath9k_hif_usb_rx_stream(). Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.") Signed-off-by: Fedor Pchelkin <pchelkin(a)ispras.ru> Signed-off-by: Alexey Khoroshilov <khoroshilov(a)ispras.ru> Acked-by: Toke Høiland-Jørgensen <toke(a)toke.dk> Signed-off-by: Kalle Valo <quic_kvalo(a)quicinc.com> Link: https://lore.kernel.org/r/20230216192301.171225-1-pchelkin@ispras.ru Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ziming Du <duziming2(a)huawei.com> --- drivers/net/wireless/ath/ath9k/hif_usb.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c index 32672964e87e8..1688042f62362 100644 --- a/drivers/net/wireless/ath/ath9k/hif_usb.c +++ b/drivers/net/wireless/ath/ath9k/hif_usb.c @@ -525,6 +525,24 @@ static struct ath9k_htc_hif hif_usb = { .send = hif_usb_send, }; +/* Need to free remain_skb allocated in ath9k_hif_usb_rx_stream + * in case ath9k_hif_usb_rx_stream wasn't called next time to + * process the buffer and subsequently free it. + */ +static void ath9k_hif_usb_free_rx_remain_skb(struct hif_device_usb *hif_dev) +{ + unsigned long flags; + + spin_lock_irqsave(&hif_dev->rx_lock, flags); + if (hif_dev->remain_skb) { + dev_kfree_skb_any(hif_dev->remain_skb); + hif_dev->remain_skb = NULL; + hif_dev->rx_remain_len = 0; + RX_STAT_INC(hif_dev, skb_dropped); + } + spin_unlock_irqrestore(&hif_dev->rx_lock, flags); +} + static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev, struct sk_buff *skb) { @@ -842,6 +860,7 @@ static int ath9k_hif_usb_alloc_tx_urbs(struct hif_device_usb *hif_dev) static void ath9k_hif_usb_dealloc_rx_urbs(struct hif_device_usb *hif_dev) { usb_kill_anchored_urbs(&hif_dev->rx_submitted); + ath9k_hif_usb_free_rx_remain_skb(hif_dev); } static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev) -- 2.43.0

2 1

[PATCH OLK-6.6] nbd: restrict sockets to TCP and UDP
by Zheng Qixing 03 Nov '25

03 Nov '25

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v6.6.112 commit 4f9e6ff6319dbcebea64b50af0304cf0ad7e97e7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID3WIC CVE: CVE-2025-40080 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------ [ Upstream commit 9f7c02e031570e8291a63162c6c046dc15ff85b0 ] Recently, syzbot started to abuse NBD with all kinds of sockets. Commit cf1b2326b734 ("nbd: verify socket is supported during setup") made sure the socket supported a shutdown() method. Explicitely accept TCP and UNIX stream sockets. Fixes: cf1b2326b734 ("nbd: verify socket is supported during setup") Reported-by: syzbot+e1cd6bd8493060bd701d(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/CANn89iJ+76eE3A_8S_zTpSyW5hvPRn6V57458hCZGY5… Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Mike Christie <mchristi(a)redhat.com> Cc: Richard W.M. Jones <rjones(a)redhat.com> Cc: Jens Axboe <axboe(a)kernel.dk> Cc: Yu Kuai <yukuai1(a)huaweicloud.com> Cc: linux-block(a)vger.kernel.org Cc: nbd(a)other.debian.org Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/block/nbd.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index 7eeb4b6de6de..26e1cf7f666c 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -1128,6 +1128,14 @@ static struct socket *nbd_get_socket(struct nbd_device *nbd, unsigned long fd, if (!sock) return NULL; + if (!sk_is_tcp(sock->sk) && + !sk_is_stream_unix(sock->sk)) { + dev_err(disk_to_dev(nbd->disk), "Unsupported socket: should be TCP or UNIX.\n"); + *err = -EINVAL; + sockfd_put(sock); + return NULL; + } + if (sock->ops->shutdown == sock_no_shutdown) { dev_err(disk_to_dev(nbd->disk), "Unsupported socket: shutdown callout must be supported.\n"); *err = -EINVAL; -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS 0/2] fix CVE-2023-53675
by Zheng Qixing 03 Nov '25

03 Nov '25

fix CVE-2023-53675 Tomas Henzl (1): scsi: ses: Fix possible desc_ptr out-of-bounds accesses Zheng Qixing (1): Revert "scsi: ses: fix slab-out-of-bounds in ses_enclosure_data_process" drivers/scsi/ses.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) -- 2.39.2

2 3

[PATCH openEuler-1.0-LTS 0/2] *** CVE-2023-53454 ***
by Lin Ruifeng 03 Nov '25

03 Nov '25

*** CVE-2023-53454 *** Charles Han (1): HID: multitouch: Add NULL check in mt_input_configured Rahul Rameshbabu (1): HID: multitouch: Correct devm device reference for hidinput input_dev name drivers/hid/hid-multitouch.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) -- 2.22.0

2 3

[PATCH openEuler-1.0-LTS 0/2] fix CVE-2023-53675
by Zheng Qixing 03 Nov '25

03 Nov '25

fix CVE-2023-53675 Tomas Henzl (1): scsi: ses: Fix possible desc_ptr out-of-bounds accesses Zheng Qixing (1): Revert "scsi: ses: fix slab-out-of-bounds in ses_enclosure_data_process" drivers/scsi/ses.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) -- 2.39.2

2 3

[PATCH openEuler-1.0-LTS] scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show()
by Zheng Qixing 03 Nov '25

03 Nov '25

From: Konstantin Shelekhin <k.shelekhin(a)yadro.com> stable inclusion from stable-v4.19.295 commit 114b44dddea1f8f99576de3c0e6e9059012002fc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID0VIW CVE: CVE-2023-53676 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------ [ Upstream commit 801f287c93ff95582b0a2d2163f12870a2f076d4 ] The function lio_target_nacl_info_show() uses sprintf() in a loop to print details for every iSCSI connection in a session without checking for the buffer length. With enough iSCSI connections it's possible to overflow the buffer provided by configfs and corrupt the memory. This patch replaces sprintf() with sysfs_emit_at() that checks for buffer boundries. Signed-off-by: Konstantin Shelekhin <k.shelekhin(a)yadro.com> Link: https://lore.kernel.org/r/20230722152657.168859-2-k.shelekhin@yadro.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zheng Qixing <zhengqixing(a)huawei.com> --- drivers/target/iscsi/iscsi_target_configfs.c | 54 ++++++++++---------- 1 file changed, 27 insertions(+), 27 deletions(-) diff --git a/drivers/target/iscsi/iscsi_target_configfs.c b/drivers/target/iscsi/iscsi_target_configfs.c index d25cadc4f4f1..ac071abae7e9 100644 --- a/drivers/target/iscsi/iscsi_target_configfs.c +++ b/drivers/target/iscsi/iscsi_target_configfs.c @@ -516,102 +516,102 @@ static ssize_t lio_target_nacl_info_show(struct config_item *item, char *page) spin_lock_bh(&se_nacl->nacl_sess_lock); se_sess = se_nacl->nacl_sess; if (!se_sess) { - rb += sprintf(page+rb, "No active iSCSI Session for Initiator" + rb += sysfs_emit_at(page, rb, "No active iSCSI Session for Initiator" " Endpoint: %s\n", se_nacl->initiatorname); } else { sess = se_sess->fabric_sess_ptr; - rb += sprintf(page+rb, "InitiatorName: %s\n", + rb += sysfs_emit_at(page, rb, "InitiatorName: %s\n", sess->sess_ops->InitiatorName); - rb += sprintf(page+rb, "InitiatorAlias: %s\n", + rb += sysfs_emit_at(page, rb, "InitiatorAlias: %s\n", sess->sess_ops->InitiatorAlias); - rb += sprintf(page+rb, + rb += sysfs_emit_at(page, rb, "LIO Session ID: %u ISID: 0x%6ph TSIH: %hu ", sess->sid, sess->isid, sess->tsih); - rb += sprintf(page+rb, "SessionType: %s\n", + rb += sysfs_emit_at(page, rb, "SessionType: %s\n", (sess->sess_ops->SessionType) ? "Discovery" : "Normal"); - rb += sprintf(page+rb, "Session State: "); + rb += sysfs_emit_at(page, rb, "Session State: "); switch (sess->session_state) { case TARG_SESS_STATE_FREE: - rb += sprintf(page+rb, "TARG_SESS_FREE\n"); + rb += sysfs_emit_at(page, rb, "TARG_SESS_FREE\n"); break; case TARG_SESS_STATE_ACTIVE: - rb += sprintf(page+rb, "TARG_SESS_STATE_ACTIVE\n"); + rb += sysfs_emit_at(page, rb, "TARG_SESS_STATE_ACTIVE\n"); break; case TARG_SESS_STATE_LOGGED_IN: - rb += sprintf(page+rb, "TARG_SESS_STATE_LOGGED_IN\n"); + rb += sysfs_emit_at(page, rb, "TARG_SESS_STATE_LOGGED_IN\n"); break; case TARG_SESS_STATE_FAILED: - rb += sprintf(page+rb, "TARG_SESS_STATE_FAILED\n"); + rb += sysfs_emit_at(page, rb, "TARG_SESS_STATE_FAILED\n"); break; case TARG_SESS_STATE_IN_CONTINUE: - rb += sprintf(page+rb, "TARG_SESS_STATE_IN_CONTINUE\n"); + rb += sysfs_emit_at(page, rb, "TARG_SESS_STATE_IN_CONTINUE\n"); break; default: - rb += sprintf(page+rb, "ERROR: Unknown Session" + rb += sysfs_emit_at(page, rb, "ERROR: Unknown Session" " State!\n"); break; } - rb += sprintf(page+rb, "---------------------[iSCSI Session" + rb += sysfs_emit_at(page, rb, "---------------------[iSCSI Session" " Values]-----------------------\n"); - rb += sprintf(page+rb, " CmdSN/WR : CmdSN/WC : ExpCmdSN" + rb += sysfs_emit_at(page, rb, " CmdSN/WR : CmdSN/WC : ExpCmdSN" " : MaxCmdSN : ITT : TTT\n"); max_cmd_sn = (u32) atomic_read(&sess->max_cmd_sn); - rb += sprintf(page+rb, " 0x%08x 0x%08x 0x%08x 0x%08x" + rb += sysfs_emit_at(page, rb, " 0x%08x 0x%08x 0x%08x 0x%08x" " 0x%08x 0x%08x\n", sess->cmdsn_window, (max_cmd_sn - sess->exp_cmd_sn) + 1, sess->exp_cmd_sn, max_cmd_sn, sess->init_task_tag, sess->targ_xfer_tag); - rb += sprintf(page+rb, "----------------------[iSCSI" + rb += sysfs_emit_at(page, rb, "----------------------[iSCSI" " Connections]-------------------------\n"); spin_lock(&sess->conn_lock); list_for_each_entry(conn, &sess->sess_conn_list, conn_list) { - rb += sprintf(page+rb, "CID: %hu Connection" + rb += sysfs_emit_at(page, rb, "CID: %hu Connection" " State: ", conn->cid); switch (conn->conn_state) { case TARG_CONN_STATE_FREE: - rb += sprintf(page+rb, + rb += sysfs_emit_at(page, rb, "TARG_CONN_STATE_FREE\n"); break; case TARG_CONN_STATE_XPT_UP: - rb += sprintf(page+rb, + rb += sysfs_emit_at(page, rb, "TARG_CONN_STATE_XPT_UP\n"); break; case TARG_CONN_STATE_IN_LOGIN: - rb += sprintf(page+rb, + rb += sysfs_emit_at(page, rb, "TARG_CONN_STATE_IN_LOGIN\n"); break; case TARG_CONN_STATE_LOGGED_IN: - rb += sprintf(page+rb, + rb += sysfs_emit_at(page, rb, "TARG_CONN_STATE_LOGGED_IN\n"); break; case TARG_CONN_STATE_IN_LOGOUT: - rb += sprintf(page+rb, + rb += sysfs_emit_at(page, rb, "TARG_CONN_STATE_IN_LOGOUT\n"); break; case TARG_CONN_STATE_LOGOUT_REQUESTED: - rb += sprintf(page+rb, + rb += sysfs_emit_at(page, rb, "TARG_CONN_STATE_LOGOUT_REQUESTED\n"); break; case TARG_CONN_STATE_CLEANUP_WAIT: - rb += sprintf(page+rb, + rb += sysfs_emit_at(page, rb, "TARG_CONN_STATE_CLEANUP_WAIT\n"); break; default: - rb += sprintf(page+rb, + rb += sysfs_emit_at(page, rb, "ERROR: Unknown Connection State!\n"); break; } - rb += sprintf(page+rb, " Address %pISc %s", &conn->login_sockaddr, + rb += sysfs_emit_at(page, rb, " Address %pISc %s", &conn->login_sockaddr, (conn->network_transport == ISCSI_TCP) ? "TCP" : "SCTP"); - rb += sprintf(page+rb, " StatSN: 0x%08x\n", + rb += sysfs_emit_at(page, rb, " StatSN: 0x%08x\n", conn->stat_sn); } spin_unlock(&sess->conn_lock); -- 2.39.2

2 1