- Kernel - mailweb.openeuler.org

[PATCH] erofs: fix stack-out-of-bounds in erofs_put_metabuf
by Liu Mingrui 08 Aug '26

08 Aug '26

From: Mingrui Liu <liumingrui(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16872 -------------------------------- Commit 1d4b040dd8ee moved erofs_put_metabuf() to out_unlock, but some error paths jump there before buf is initialized, unlike mainline where buf is always set. This triggers : BUG: KASAN: stack-out-of-bounds in erofs_put_metabuf+0x54/0x158 [erofs] Call Trace: dump_backtrace+0xa0/0x128 show_stack+0x20/0x38 dump_stack_lvl+0x78/0xc8 print_address_description.constprop.0+0x84/0x3c8 print_report+0xb0/0x280 kasan_report+0x84/0xd0 __asan_load8+0x9c/0xc0 erofs_put_metabuf+0x54/0x158 [erofs] erofs_init_inode_xattrs+0x194/0x560 [erofs] erofs_getxattr+0xc8/0x238 [erofs] erofs_get_acl+0x6c/0x150 [erofs] __get_acl.part.0+0x218/0x390 vfs_get_acl+0xd0/0x150 do_get_acl+0x38/0x2a0 do_getxattr+0x9c/0x250 getxattr+0xe0/0x148 path_getxattr+0xdc/0x150 __arm64_sys_getxattr+0x60/0x80 invoke_syscall+0x64/0x178 el0_svc_common.constprop.0+0x11c/0x150 do_el0_svc+0x38/0x50 el0_svc+0x44/0x228 el0t_64_sync_handler+0x100/0x130 el0t_64_sync+0x3c8/0x3d0 Fix by zero-initializing buf at declaration so erofs_put_metabuf() can safely handle it. Fixes: 6a89c63750cb ("erofs: fix metabuf leak in inode xattr initialization") Signed-off-by: Mingrui Liu <liumingrui(a)huawei.com> --- fs/erofs/xattr.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/erofs/xattr.c b/fs/erofs/xattr.c index b270226be379..abd23e990a3a 100644 --- a/fs/erofs/xattr.c +++ b/fs/erofs/xattr.c @@ -34,6 +34,8 @@ static int erofs_init_inode_xattrs(struct inode *inode) struct super_block *sb = inode->i_sb; int ret = 0; + it.buf = __EROFS_BUF_INITIALIZER; + /* the most case is that xattrs of this inode are initialized. */ if (test_bit(EROFS_I_EA_INITED_BIT, &vi->flags)) { /* @@ -76,7 +78,6 @@ static int erofs_init_inode_xattrs(struct inode *inode) goto out_unlock; } - it.buf = __EROFS_BUF_INITIALIZER; erofs_init_metabuf(&it.buf, sb); it.pos = erofs_iloc(inode) + vi->inode_isize; -- 2.34.1

1 0

[PATCH OLK-6.6] erofs: fix stack-out-of-bounds in erofs_put_metabuf
by Liu Mingrui 08 Aug '26

08 Aug '26

From: Mingrui Liu <liumingrui(a)huawei.com> Offering: HULK hulk inclusion category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16872 -------------------------------- Commit 1d4b040dd8ee moved erofs_put_metabuf() to out_unlock, but some error paths jump there before buf is initialized, unlike mainline where buf is always set. This triggers : BUG: KASAN: stack-out-of-bounds in erofs_put_metabuf+0x54/0x158 [erofs] Call Trace: dump_backtrace+0xa0/0x128 show_stack+0x20/0x38 dump_stack_lvl+0x78/0xc8 print_address_description.constprop.0+0x84/0x3c8 print_report+0xb0/0x280 kasan_report+0x84/0xd0 __asan_load8+0x9c/0xc0 erofs_put_metabuf+0x54/0x158 [erofs] erofs_init_inode_xattrs+0x194/0x560 [erofs] erofs_getxattr+0xc8/0x238 [erofs] erofs_get_acl+0x6c/0x150 [erofs] __get_acl.part.0+0x218/0x390 vfs_get_acl+0xd0/0x150 do_get_acl+0x38/0x2a0 do_getxattr+0x9c/0x250 getxattr+0xe0/0x148 path_getxattr+0xdc/0x150 __arm64_sys_getxattr+0x60/0x80 invoke_syscall+0x64/0x178 el0_svc_common.constprop.0+0x11c/0x150 do_el0_svc+0x38/0x50 el0_svc+0x44/0x228 el0t_64_sync_handler+0x100/0x130 el0t_64_sync+0x3c8/0x3d0 Fix by zero-initializing buf at declaration so erofs_put_metabuf() can safely handle it. Fixes: 6a89c63750cb ("erofs: fix metabuf leak in inode xattr initialization") Signed-off-by: Mingrui Liu <liumingrui(a)huawei.com> --- fs/erofs/xattr.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/erofs/xattr.c b/fs/erofs/xattr.c index b270226be379..abd23e990a3a 100644 --- a/fs/erofs/xattr.c +++ b/fs/erofs/xattr.c @@ -34,6 +34,8 @@ static int erofs_init_inode_xattrs(struct inode *inode) struct super_block *sb = inode->i_sb; int ret = 0; + it.buf = __EROFS_BUF_INITIALIZER; + /* the most case is that xattrs of this inode are initialized. */ if (test_bit(EROFS_I_EA_INITED_BIT, &vi->flags)) { /* @@ -76,7 +78,6 @@ static int erofs_init_inode_xattrs(struct inode *inode) goto out_unlock; } - it.buf = __EROFS_BUF_INITIALIZER; erofs_init_metabuf(&it.buf, sb); it.pos = erofs_iloc(inode) + vi->inode_isize; -- 2.34.1

2 1

[PATCH OLK-6.6] x86/bugs: Enable IBPB flush on BPF JIT allocation
by Zhang Kunbo 08 Aug '26

08 Aug '26

From: Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> stable inclusion from stable-v6.6.145 commit cb27f3bf915cc0f20fc0c48da9059304e39ebd35 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16808 CVE: CVE-2026-64507 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit a3af84b0fa00ead01fcd0e28b5d773ff25990a0d upstream. Enable hardening against JIT spraying when Spectre-v2 mitigations are in use. Specifically, issue an IBPB flush on BPF JIT memory reuse. Skip enabling the IBPB flush if the BPF dispatcher is already using a retpoline sequence. This hardening applies only when BPF-JIT is in use. Guard the enabling under CONFIG_BPF_JIT so that bugs.c still builds with CONFIG_BPF_JIT=n. [ pawan: Use entry_ibpb() instead of write_ibpb(). JIT hardening enable moved to spectre_v2_select_mitigation() because there is no spectre_v2_apply_mitigation()] Signed-off-by: Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> Acked-by: Daniel Borkmann <daniel(a)iogearbox.net> Acked-by: Dave Hansen <dave.hansen(a)linux.intel.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: arch/x86/kernel/cpu/bugs.c arch/x86/include/asm/nospec-branch.h [context conflicts and use `write_ibpb` instead of `entry_ibpb` due to 13235d6d50bb ("x86/bugs: Rename entry_ibpb() to write_ibpb()") ] Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- arch/x86/include/asm/nospec-branch.h | 4 +++ arch/x86/kernel/cpu/bugs.c | 50 +++++++++++++++++++++++++--- 2 files changed, 49 insertions(+), 5 deletions(-) diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h index 58dda23aee1b..d4eae71b2ab7 100644 --- a/arch/x86/include/asm/nospec-branch.h +++ b/arch/x86/include/asm/nospec-branch.h @@ -408,6 +408,10 @@ extern void srso_alias_untrain_ret(void); extern void entry_untrain_ret(void); extern void write_ibpb(void); +#ifdef CONFIG_BPF_JIT +extern void bpf_arch_ibpb(void); +#endif + #ifdef CONFIG_X86_64 extern void clear_bhb_loop(void); #endif diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c index 212408f6de11..d5dd360ee330 100644 --- a/arch/x86/kernel/cpu/bugs.c +++ b/arch/x86/kernel/cpu/bugs.c @@ -16,6 +16,7 @@ #include <linux/sched/smt.h> #include <linux/pgtable.h> #include <linux/bpf.h> +#include <linux/filter.h> #include <asm/spec-ctrl.h> #include <asm/cmdline.h> @@ -1312,8 +1313,21 @@ static inline const char *spectre_v2_module_string(void) { return spectre_v2_bad_module ? " - vulnerable module loaded" : ""; } + +/* + * The "retpoline sequence" is the "call;mov;ret" sequence that + * replaces normal indirect branch instructions. Differentiate + * *the* retpoline sequence from the LFENCE-prefixed indirect + * branches that simply use the retpoline infrastructure. + */ +static inline bool retpoline_seq_enabled(void) +{ + return boot_cpu_has(X86_FEATURE_RETPOLINE) && !boot_cpu_has(X86_FEATURE_RETPOLINE_LFENCE); +} + #else static inline const char *spectre_v2_module_string(void) { return ""; } +static inline bool retpoline_seq_enabled(void) { return false; } #endif #define SPECTRE_V2_LFENCE_MSG "WARNING: LFENCE mitigation is not recommended for this CPU, data leaks possible!\n" @@ -1787,8 +1801,7 @@ static void __init bhi_select_mitigation(void) return; /* Retpoline mitigates against BHI unless the CPU has RRSBA behavior */ - if (boot_cpu_has(X86_FEATURE_RETPOLINE) && - !boot_cpu_has(X86_FEATURE_RETPOLINE_LFENCE)) { + if (retpoline_seq_enabled()) { spec_ctrl_disable_kernel_rrsba(); if (rrsba_disabled) return; @@ -1810,6 +1823,27 @@ static void __init bhi_select_mitigation(void) pr_info("Spectre BHI mitigation: SW BHB clearing on syscall\n"); } +#ifdef CONFIG_BPF_JIT +static void __bpf_arch_ibpb(void *unused) +{ + write_ibpb(); +} + +void bpf_arch_ibpb(void) +{ + on_each_cpu(__bpf_arch_ibpb, NULL, 1); +} + +static bool __init cpu_wants_ibpb_bpf(void) +{ + /* A genuine retpoline already neutralizes ring0 indirect predictions */ + if (retpoline_seq_enabled()) + return false; + + return boot_cpu_has(X86_FEATURE_IBPB); +} +#endif + static void __init spectre_v2_select_mitigation(void) { enum spectre_v2_mitigation_cmd cmd = spectre_v2_parse_cmdline(); @@ -1955,6 +1989,14 @@ static void __init spectre_v2_select_mitigation(void) pr_info("Enabling Restricted Speculation for firmware calls\n"); } +#ifdef CONFIG_BPF_JIT + if (cpu_wants_ibpb_bpf()) { + static_call_update(bpf_arch_pred_flush, bpf_arch_ibpb); + static_branch_enable(&bpf_pred_flush_enabled); + pr_info("Enabling IBPB for BPF\n"); + } +#endif + /* Set up IBPB and STIBP depending on the general spectre V2 command */ spectre_v2_cmd = cmd; } @@ -3113,9 +3155,7 @@ static const char *spectre_bhi_state(void) return "; BHI: BHI_DIS_S"; else if (boot_cpu_has(X86_FEATURE_CLEAR_BHB_LOOP)) return "; BHI: SW loop, KVM: SW loop"; - else if (boot_cpu_has(X86_FEATURE_RETPOLINE) && - !boot_cpu_has(X86_FEATURE_RETPOLINE_LFENCE) && - rrsba_disabled) + else if (retpoline_seq_enabled() && rrsba_disabled) return "; BHI: Retpoline"; else if (boot_cpu_has(X86_FEATURE_CLEAR_BHB_LOOP_ON_VMEXIT)) return "; BHI: Vulnerable, KVM: SW loop"; -- 2.34.1

2 1

[PATCH OLK-5.10] USB: serial: mct_u232: fix memory corruption with small endpoint
by Zhang Kunbo 08 Aug '26

08 Aug '26

From: Johan Hovold <johan(a)kernel.org> stable inclusion from stable-v5.10.259 commit 94edbbc5fe00d03cfe1d4e690d7d2cd36317a935 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16226 CVE: CVE-2026-63898 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 915b36d701950503c4ea0f6e314b10868e59fce3 upstream. The driver overrides the maximum transfer size for a specific device which only accepts 16 byte packets for its 32 byte bulk-out endpoint. Make sure to never increase the maximum transfer size to prevent slab corruption should a malicious device report a smaller endpoint max packet size than expected. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable(a)vger.kernel.org Reviewed-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Johan Hovold <johan(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- drivers/usb/serial/mct_u232.c | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-) diff --git a/drivers/usb/serial/mct_u232.c b/drivers/usb/serial/mct_u232.c index 04f16d4a0a68..8842a1db72b3 100644 --- a/drivers/usb/serial/mct_u232.c +++ b/drivers/usb/serial/mct_u232.c @@ -378,6 +378,7 @@ static int mct_u232_port_probe(struct usb_serial_port *port) { struct usb_serial *serial = port->serial; struct mct_u232_private *priv; + u16 pid; /* check first to simplify error handling */ if (!serial->port[1] || !serial->port[1]->interrupt_in_urb) { @@ -385,6 +386,16 @@ static int mct_u232_port_probe(struct usb_serial_port *port) return -ENODEV; } + /* + * Compensate for a hardware bug: although the Sitecom U232-P25 + * device reports a maximum output packet size of 32 bytes, + * it seems to be able to accept only 16 bytes (and that's what + * SniffUSB says too...) + */ + pid = le16_to_cpu(serial->dev->descriptor.idProduct); + if (pid == MCT_U232_SITECOM_PID) + port->bulk_out_size = min(16, port->bulk_out_size); + priv = kzalloc(sizeof(*priv), GFP_KERNEL); if (!priv) return -ENOMEM; @@ -412,7 +423,6 @@ static int mct_u232_port_remove(struct usb_serial_port *port) static int mct_u232_open(struct tty_struct *tty, struct usb_serial_port *port) { - struct usb_serial *serial = port->serial; struct mct_u232_private *priv = usb_get_serial_port_data(port); int retval = 0; unsigned int control_state; @@ -420,15 +430,6 @@ static int mct_u232_open(struct tty_struct *tty, struct usb_serial_port *port) unsigned char last_lcr; unsigned char last_msr; - /* Compensate for a hardware bug: although the Sitecom U232-P25 - * device reports a maximum output packet size of 32 bytes, - * it seems to be able to accept only 16 bytes (and that's what - * SniffUSB says too...) - */ - if (le16_to_cpu(serial->dev->descriptor.idProduct) - == MCT_U232_SITECOM_PID) - port->bulk_out_size = 16; - /* Do a defined restart: the normal serial device seems to * always turn on DTR and RTS here, so do the same. I'm not * sure if this is really necessary. But it should not harm -- 2.34.1

2 1

[PATCH OLK-5.10] USB: serial: mct_u232: fix memory corruption with small endpoint
by Zhang Kunbo 08 Aug '26

08 Aug '26

From: Johan Hovold <johan(a)kernel.org> commit 915b36d701950503c4ea0f6e314b10868e59fce3 upstream. The driver overrides the maximum transfer size for a specific device which only accepts 16 byte packets for its 32 byte bulk-out endpoint. Make sure to never increase the maximum transfer size to prevent slab corruption should a malicious device report a smaller endpoint max packet size than expected. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable(a)vger.kernel.org Reviewed-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Johan Hovold <johan(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/usb/serial/mct_u232.c | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-) diff --git a/drivers/usb/serial/mct_u232.c b/drivers/usb/serial/mct_u232.c index 04f16d4a0a68..8842a1db72b3 100644 --- a/drivers/usb/serial/mct_u232.c +++ b/drivers/usb/serial/mct_u232.c @@ -378,6 +378,7 @@ static int mct_u232_port_probe(struct usb_serial_port *port) { struct usb_serial *serial = port->serial; struct mct_u232_private *priv; + u16 pid; /* check first to simplify error handling */ if (!serial->port[1] || !serial->port[1]->interrupt_in_urb) { @@ -385,6 +386,16 @@ static int mct_u232_port_probe(struct usb_serial_port *port) return -ENODEV; } + /* + * Compensate for a hardware bug: although the Sitecom U232-P25 + * device reports a maximum output packet size of 32 bytes, + * it seems to be able to accept only 16 bytes (and that's what + * SniffUSB says too...) + */ + pid = le16_to_cpu(serial->dev->descriptor.idProduct); + if (pid == MCT_U232_SITECOM_PID) + port->bulk_out_size = min(16, port->bulk_out_size); + priv = kzalloc(sizeof(*priv), GFP_KERNEL); if (!priv) return -ENOMEM; @@ -412,7 +423,6 @@ static int mct_u232_port_remove(struct usb_serial_port *port) static int mct_u232_open(struct tty_struct *tty, struct usb_serial_port *port) { - struct usb_serial *serial = port->serial; struct mct_u232_private *priv = usb_get_serial_port_data(port); int retval = 0; unsigned int control_state; @@ -420,15 +430,6 @@ static int mct_u232_open(struct tty_struct *tty, struct usb_serial_port *port) unsigned char last_lcr; unsigned char last_msr; - /* Compensate for a hardware bug: although the Sitecom U232-P25 - * device reports a maximum output packet size of 32 bytes, - * it seems to be able to accept only 16 bytes (and that's what - * SniffUSB says too...) - */ - if (le16_to_cpu(serial->dev->descriptor.idProduct) - == MCT_U232_SITECOM_PID) - port->bulk_out_size = 16; - /* Do a defined restart: the normal serial device seems to * always turn on DTR and RTS here, so do the same. I'm not * sure if this is really necessary. But it should not harm -- 2.34.1

2 1

[PATCH OLK-5.10] KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path
by Zhang Kunbo 08 Aug '26

08 Aug '26

From: Ashutosh Desai <ashutoshdesai993(a)gmail.com> stable inclusion from stable-v5.10.260 commit f701ae476cb92a3a3d8844bb39bb63b4512684c8 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16125 CVE: CVE-2026-63794 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 78ee2d50185a037b3d2452a97f3dad69c3f7f389 upstream. In sev_dbg_crypt(), the per-iteration transfer length is bounded by the source page offset (PAGE_SIZE - s_off) but not by the destination page offset (PAGE_SIZE - d_off). When d_off > s_off, the encrypt path (__sev_dbg_encrypt_user) performs a read-modify-write using a single-page intermediate buffer (dst_tpage): 1. __sev_dbg_decrypt() expands the size to round_up(len + (d_off & 15), 16) before issuing the PSP command. If len + (d_off & 15) > PAGE_SIZE, the PSP writes beyond the end of the 4096-byte dst_tpage allocation. 2. The subsequent memcpy()/copy_from_user() into page_address(dst_tpage) + (d_off & 15) of 'len' bytes overflows by up to 15 bytes under the same condition. Trigger example: s_off = 0, d_off = 1, debug.len = PAGE_SIZE - the PSP is instructed to write round_up(4097, 16) = 4112 bytes to a 4096-byte buffer. Fix by also bounding len by (PAGE_SIZE - d_off), the same check that sev_send_update_data() already performs for its single-page guest region. ================================================================== BUG: KASAN: slab-use-after-free in sev_dbg_crypt+0x993/0xd10 [kvm_amd] Write of size 4095 at addr ff110062293bb009 by task sev_dbg_test/228214 CPU: 96 UID: 0 PID: 228214 Comm: sev_dbg_test Tainted: G U W 7.0.0-smp--5ce9b0c48211-dbg #156 PREEMPTLAZY Tainted: [U]=USER, [W]=WARN Hardware name: Google Astoria/astoria, BIOS 0.20250817.1-0 08/25/2025 Call Trace: <TASK> dump_stack_lvl+0x54/0x70 print_report+0xbc/0x260 kasan_report+0xa2/0xd0 kasan_check_range+0x25f/0x2c0 __asan_memcpy+0x40/0x70 sev_dbg_crypt+0x993/0xd10 [kvm_amd] sev_mem_enc_ioctl+0x33c/0x450 [kvm_amd] kvm_vm_ioctl+0x65d/0x6d0 [kvm] __se_sys_ioctl+0xb2/0x100 do_syscall_64+0xe8/0x870 entry_SYSCALL_64_after_hwframe+0x4b/0x53 </TASK> The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x7fe72b6a0 pfn:0x62293bb memcg:ff11000112827d82 flags: 0x1400000000000000(node=1|zone=1) raw: 1400000000000000 0000000000000000 dead000000000122 0000000000000000 raw: 00000007fe72b6a0 0000000000000000 00000001ffffffff ff11000112827d82 page dumped because: kasan: bad access detected Memory state around the buggy address: ff110062293bbf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff110062293bbf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ff110062293bc000: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ^ ff110062293bc080: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ff110062293bc100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ================================================================== Disabling lock debugging due to kernel taint Fixes: 24f41fb23a39 ("KVM: SVM: Add support for SEV DEBUG_DECRYPT command") Fixes: 7d1594f5d94b ("KVM: SVM: Add support for SEV DEBUG_ENCRYPT command") Cc: stable(a)vger.kernel.org Signed-off-by: Ashutosh Desai <ashutoshdesai993(a)gmail.com> [sean: add sample KASAN splat, Fixes, and stable@] Link: https://patch.msgid.link/20260501203537.2120074-2-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- arch/x86/kvm/svm/sev.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c index 79ebbe8cf0b4..a3a68ec8ab63 100644 --- a/arch/x86/kvm/svm/sev.c +++ b/arch/x86/kvm/svm/sev.c @@ -975,6 +975,7 @@ static int sev_dbg_crypt(struct kvm *kvm, struct kvm_sev_cmd *argp, bool dec) s_off = vaddr & ~PAGE_MASK; d_off = dst_vaddr & ~PAGE_MASK; len = min_t(size_t, (PAGE_SIZE - s_off), size); + len = min_t(size_t, len, PAGE_SIZE - d_off); if (dec) ret = __sev_dbg_decrypt_user(kvm, -- 2.34.1

2 1

[PATCH OLK-5.10] arm64: Add runtime PAN control for user copy optimization
by Qi Xi 07 Aug '26

07 Aug '26

Signed-off-by: Qi Xi <xiqi2(a)huawei.com> arm64: Optimize copy_from/to_user with batched LDP/STP Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- arch/arm64/include/asm/asm-uaccess.h | 16 +++ arch/arm64/include/asm/uaccess.h | 25 +++- arch/arm64/kernel/Makefile | 2 +- arch/arm64/kernel/copy_opt.c | 100 ++++++++++++++ arch/arm64/lib/Makefile | 1 + arch/arm64/lib/copy_from_user_opt.S | 75 ++++++++++ arch/arm64/lib/copy_to_user_opt.S | 75 ++++++++++ arch/arm64/lib/copy_user_template.S | 196 +++++++++++++++++++++++++++ 8 files changed, 485 insertions(+), 5 deletions(-) create mode 100644 arch/arm64/kernel/copy_opt.c create mode 100644 arch/arm64/lib/copy_from_user_opt.S create mode 100644 arch/arm64/lib/copy_to_user_opt.S create mode 100644 arch/arm64/lib/copy_user_template.S diff --git a/arch/arm64/include/asm/asm-uaccess.h b/arch/arm64/include/asm/asm-uaccess.h index 46b8d2585980..f51f0d0aadc4 100644 --- a/arch/arm64/include/asm/asm-uaccess.h +++ b/arch/arm64/include/asm/asm-uaccess.h @@ -92,4 +92,20 @@ alternative_else_nop_endif _asm_mc_extable 8888b,\l; .endm + + .macro user_ldst_index l, inst, reg, addr, val +8888: \inst \reg, [\addr, \val]; + + _asm_extable 8888b,\l; + + _asm_mc_extable 8888b,\l; + .endm + + .macro user_ldst_pair_index l, inst, reg1, reg2, addr, val +8888: \inst \reg1, \reg2, [\addr, \val]; + + _asm_extable 8888b,\l; + + _asm_mc_extable 8888b,\l; + .endm #endif diff --git a/arch/arm64/include/asm/uaccess.h b/arch/arm64/include/asm/uaccess.h index 03c2db710f92..d6d21d6bc6d6 100644 --- a/arch/arm64/include/asm/uaccess.h +++ b/arch/arm64/include/asm/uaccess.h @@ -386,24 +386,41 @@ do { \ goto err_label; \ } while(0) +#define COPY_OPT_THRESHOLD 4096 +extern bool kernel_copy_opt_enabled(void); extern unsigned long __must_check __arch_copy_from_user(void *to, const void __user *from, unsigned long n); +extern unsigned long __must_check __arch_copy_from_user_opt(void *to, const void __user *from, unsigned long n); #define raw_copy_from_user(to, from, n) \ ({ \ unsigned long __acfu_ret; \ - uaccess_ttbr0_enable(); \ - __acfu_ret = __arch_copy_from_user((to), \ - __uaccess_mask_ptr(from), (n)); \ + if ((n) >= COPY_OPT_THRESHOLD && kernel_copy_opt_enabled()) { \ + uaccess_enable_privileged(); \ + __acfu_ret = __arch_copy_from_user_opt((to), \ + __uaccess_mask_ptr(from), (n)); \ + uaccess_disable_privileged(); \ + } else { \ + __acfu_ret = __arch_copy_from_user((to), \ + __uaccess_mask_ptr(from), n); \ + } \ uaccess_ttbr0_disable(); \ __acfu_ret; \ }) extern unsigned long __must_check __arch_copy_to_user(void __user *to, const void *from, unsigned long n); +extern unsigned long __must_check __arch_copy_to_user_opt(void __user *to, const void *from, unsigned long n); #define raw_copy_to_user(to, from, n) \ ({ \ unsigned long __actu_ret; \ uaccess_ttbr0_enable(); \ - __actu_ret = __arch_copy_to_user(__uaccess_mask_ptr(to), \ + if ((n) >= COPY_OPT_THRESHOLD && kernel_copy_opt_enabled()) { \ + uaccess_enable_privileged(); \ + __actu_ret = __arch_copy_to_user_opt(__uaccess_mask_ptr(to),\ + (from), (n)); \ + uaccess_disable_privileged(); \ + } else { \ + __actu_ret = __arch_copy_to_user(__uaccess_mask_ptr(to),\ (from), (n)); \ + } \ uaccess_ttbr0_disable(); \ __actu_ret; \ }) diff --git a/arch/arm64/kernel/Makefile b/arch/arm64/kernel/Makefile index a5fb42a6c8d7..04e84437d3e5 100644 --- a/arch/arm64/kernel/Makefile +++ b/arch/arm64/kernel/Makefile @@ -22,7 +22,7 @@ obj-y := debug-monitors.o entry.o irq.o fpsimd.o \ return_address.o cpuinfo.o cpu_errata.o \ cpufeature.o alternative.o cacheinfo.o \ smp.o smp_spin_table.o topology.o smccc-call.o \ - syscall.o proton-pack.o ipi_nmi.o + syscall.o proton-pack.o ipi_nmi.o copy_opt.o targets += efi-entry.o diff --git a/arch/arm64/kernel/copy_opt.c b/arch/arm64/kernel/copy_opt.c new file mode 100644 index 000000000000..3eeae607956d --- /dev/null +++ b/arch/arm64/kernel/copy_opt.c @@ -0,0 +1,100 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * Copy to/from user optimization. + * + * Copyright (C) 2026 Huawei Ltd. + */ + +#include <linux/bitmap.h> +#include <linux/bitops.h> +#include <linux/bottom_half.h> +#include <linux/bug.h> +#include <linux/cache.h> +#include <linux/compat.h> +#include <linux/compiler.h> +#include <linux/cpu.h> +#include <linux/cpu_pm.h> +#include <linux/ctype.h> +#include <linux/kernel.h> +#include <linux/linkage.h> +#include <linux/irqflags.h> +#include <linux/init.h> +#include <linux/percpu.h> +#include <linux/prctl.h> +#include <linux/preempt.h> +#include <linux/ptrace.h> +#include <linux/sched/signal.h> +#include <linux/sched/task_stack.h> +#include <linux/signal.h> +#include <linux/slab.h> +#include <linux/stddef.h> +#include <linux/sysctl.h> +#include <linux/swab.h> + +#include <asm/esr.h> +#include <asm/exception.h> +#include <asm/fpsimd.h> +#include <asm/cpufeature.h> +#include <asm/cputype.h> +#include <asm/neon.h> +#include <asm/processor.h> +#include <asm/simd.h> +#include <asm/sigcontext.h> +#include <asm/sysreg.h> +#include <asm/traps.h> +#include <asm/virt.h> + +DEFINE_STATIC_KEY_FALSE(use_copy_opt); +bool kernel_copy_opt_enabled(void) +{ + return static_key_enabled(&use_copy_opt); +} +EXPORT_SYMBOL_GPL(kernel_copy_opt_enabled); + +static int copy_opt_sysctl_handler(struct ctl_table *table, int write, + void *buffer, size_t *lenp, loff_t *ppos) +{ + int ret, val; + struct ctl_table tmp = { + .data = &val, + .maxlen = sizeof(val), + .mode = table->mode, + .extra1 = SYSCTL_ZERO, + .extra2 = SYSCTL_ONE, + }; + + if (write && !capable(CAP_SYS_ADMIN)) + return -EPERM; + + if (!write) { + if (static_key_enabled(&use_copy_opt)) + val = 1; + else + val = 0; + } + ret = proc_dointvec_minmax(&tmp, write, buffer, lenp, ppos); + if (write && !ret) { + if (val) + static_branch_enable(&use_copy_opt); + else + static_branch_disable(&use_copy_opt); + } + return 0; +} + +static struct ctl_table copy_opt_sysctl_table[] = { + { + .procname = "copy_opt_user", + .mode = 0644, + .proc_handler = copy_opt_sysctl_handler, + }, + { } +}; + +static int __init copy_opt_sysctl_init(void) +{ + if (!register_sysctl("kernel", copy_opt_sysctl_table)) + return -EINVAL; + return 0; +} +core_initcall(copy_opt_sysctl_init); diff --git a/arch/arm64/lib/Makefile b/arch/arm64/lib/Makefile index e2dbef587c9b..c69993a77e78 100644 --- a/arch/arm64/lib/Makefile +++ b/arch/arm64/lib/Makefile @@ -1,6 +1,7 @@ # SPDX-License-Identifier: GPL-2.0 lib-y := clear_user.o delay.o copy_from_user.o \ copy_to_user.o copy_in_user.o copy_page.o \ + copy_to_user_opt.o copy_from_user_opt.o \ clear_page.o csum.o memchr.o memcpy.o memcpy_mc.o memmove.o \ memset.o memcmp.o strcmp.o strncmp.o strlen.o \ strnlen.o strchr.o strrchr.o tishift.o diff --git a/arch/arm64/lib/copy_from_user_opt.S b/arch/arm64/lib/copy_from_user_opt.S new file mode 100644 index 000000000000..94cfc09b89d7 --- /dev/null +++ b/arch/arm64/lib/copy_from_user_opt.S @@ -0,0 +1,75 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ +/* + * Copyright (C) 2012 ARM Ltd. + */ + +#include <linux/linkage.h> + +#include <asm/asm-uaccess.h> +#include <asm/assembler.h> +#include <asm/cache.h> + +/* + * Copy from user space to a kernel buffer (alignment handled by the hardware) + * + * Parameters: + * x0 - to + * x1 - from + * x2 - n + * Returns: + * x0 - bytes not copied + */ + + .macro ldrb1 reg, ptr, val + user_ldst 9998f, ldtrb, \reg, \ptr, \val + .endm + + .macro strb1 reg, ptr, val + USER_MC(9998f, strb \reg, [\ptr], \val) + .endm + + .macro ldrh1 reg, ptr, val + user_ldst 9997f, ldtrh, \reg, \ptr, \val + .endm + + .macro strh1 reg, ptr, val + USER_MC(9998f, strh \reg, [\ptr], \val) + .endm + + .macro ldr1 reg, ptr, val + user_ldst 9997f, ldtr, \reg, \ptr, \val + .endm + + .macro str1 reg, ptr, val + USER_MC(9998f, str \reg, [\ptr], \val) + .endm + + .macro ldp2 reg1, reg2, ptr, val + user_ldst_pair_index 9997f, ldp, \reg1, \reg2, \ptr, \val + .endm + + .macro stp2 reg1, reg2, ptr, val + USER_MC(9998f, stp \reg1, \reg2, [\ptr, \val]) + .endm + +end .req x5 +srcin .req x15 +SYM_FUNC_START(__arch_copy_from_user_opt) + add end, x0, x2 + mov srcin, x1 +#include "copy_user_template.S" + mov x0, #0 // Nothing to copy + ret +SYM_FUNC_END(__arch_copy_from_user_opt) +EXPORT_SYMBOL(__arch_copy_from_user_opt) + + .section .fixup,"ax" + .align 2 +9997: cmp dst, dstin + b.ne 9998f + // Before being absolutely sure we couldn't copy anything, try harder +USER(9998f, ldtrb tmp1w, [srcin]) + strb tmp1w, [dst], #1 +9998: sub x0, end, dst // bytes not copied + ret + .previous diff --git a/arch/arm64/lib/copy_to_user_opt.S b/arch/arm64/lib/copy_to_user_opt.S new file mode 100644 index 000000000000..57a47383df20 --- /dev/null +++ b/arch/arm64/lib/copy_to_user_opt.S @@ -0,0 +1,75 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ +/* + * Copyright (C) 2012 ARM Ltd. + */ + +#include <linux/linkage.h> + +#include <asm/asm-uaccess.h> +#include <asm/assembler.h> +#include <asm/cache.h> + +/* + * Copy to user space from a kernel buffer (alignment handled by the hardware) + * + * Parameters: + * x0 - to + * x1 - from + * x2 - n + * Returns: + * x0 - bytes not copied + */ + .macro ldrb1 reg, ptr, val + USER_MC(9998f, ldrb \reg, [\ptr], \val) + .endm + + .macro strb1 reg, ptr, val + user_ldst 9998f, sttrb, \reg, \ptr, \val + .endm + + .macro ldrh1 reg, ptr, val + USER_MC(9998f, ldrh \reg, [\ptr], \val) + .endm + + .macro strh1 reg, ptr, val + user_ldst 9997f, sttrh, \reg, \ptr, \val + .endm + + .macro ldr1 reg, ptr, val + USER_MC(9998f, ldr \reg, [\ptr], \val) + .endm + + .macro str1 reg, ptr, val + user_ldst 9997f, sttr, \reg, \ptr, \val + .endm + + .macro ldp2 reg1, reg2, ptr, val + USER_MC(9998f, ldp \reg1, \reg2, [\ptr, \val]) + .endm + + .macro stp2 reg1, reg2, ptr, val + user_ldst_pair_index 9997f, stp, \reg1, \reg2, \ptr, \val + .endm + +end .req x5 +srcin .req x15 +SYM_FUNC_START(__arch_copy_to_user_opt) + add end, x0, x2 + mov srcin, x1 +#include "copy_user_template.S" + mov x0, #0 + ret +SYM_FUNC_END(__arch_copy_to_user_opt) +EXPORT_SYMBOL(__arch_copy_to_user_opt) + + .section .fixup,"ax" + .align 2 +9997: cmp dst, dstin + b.ne 9998f + // Before being absolutely sure we couldn't copy anything, try harder +USER_MC(9998f, ldrb tmp1w, [srcin]) +USER(9998f, sttrb tmp1w, [dst]) + add dst, dst, #1 +9998: sub x0, end, dst // bytes not copied + ret + .previous diff --git a/arch/arm64/lib/copy_user_template.S b/arch/arm64/lib/copy_user_template.S new file mode 100644 index 000000000000..72983eb658b3 --- /dev/null +++ b/arch/arm64/lib/copy_user_template.S @@ -0,0 +1,196 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ +/* + * Copyright (C) 2013 ARM Ltd. + * Copyright (C) 2013 Linaro. + * + * This code is based on glibc cortex strings work originally authored by Linaro + * be found @ + * + * http://bazaar.launchpad.net/~linaro-toolchain-dev/cortex-strings/trunk/ + * files/head:/src/aarch64/ + */ + +/* + * Copy a buffer from src to dest (alignment handled by the hardware) + * + * Parameters: + * x0 - dest + * x1 - src + * x2 - n + * Returns: + * x0 - dest + */ +dstin .req x0 +src .req x1 +count .req x2 +tmp1 .req x3 +tmp1w .req w3 +tmp2 .req x4 +tmp2w .req w4 +dst .req x6 + +A_l .req x7 +A_h .req x8 +B_l .req x9 +B_h .req x10 +C_l .req x11 +C_h .req x12 +D_l .req x13 +D_h .req x14 + + mov dst, dstin + cmp count, #16 + /*When memory length is less than 16, the accessed are not aligned.*/ + b.lo .Ltiny15 + + neg tmp2, src + ands tmp2, tmp2, #15/* Bytes to reach alignment. */ + b.eq .LSrcAligned + sub count, count, tmp2 + /* + * Copy the leading memory data from src to dst in an increasing + * address order.By this way,the risk of overwriting the source + * memory data is eliminated when the distance between src and + * dst is less than 16. The memory accesses here are alignment. + */ + tbz tmp2, #0, 1f + ldrb1 tmp1w, src, #1 + strb1 tmp1w, dst, #1 +1: + tbz tmp2, #1, 2f + ldrh1 tmp1w, src, #2 + strh1 tmp1w, dst, #2 +2: + tbz tmp2, #2, 3f + ldr1 tmp1w, src, #4 + str1 tmp1w, dst, #4 +3: + tbz tmp2, #3, .LSrcAligned + ldr1 tmp1, src, #8 + str1 tmp1, dst, #8 + +.LSrcAligned: + cmp count, #64 + b.ge .Lcpy_over64 + /* + * Deal with small copies quickly by dropping straight into the + * exit block. + */ +.Ltail63: + /* + * Copy up to 48 bytes of data. At this point we only need the + * bottom 6 bits of count to be accurate. + */ + ands tmp1, count, #0x30 + b.eq .Ltiny15 + cmp tmp1w, #0x20 + b.eq 1f + b.lt 2f + ldp2 A_l, A_h, src, #0 + stp2 A_l, A_h, dst, #0 + add src, src, #16 + add dst, dst, #16 +1: + ldp2 A_l, A_h, src, #0 + stp2 A_l, A_h, dst, #0 + add src, src, #16 + add dst, dst, #16 +2: + ldp2 A_l, A_h, src, #0 + stp2 A_l, A_h, dst, #0 + add src, src, #16 + add dst, dst, #16 +.Ltiny15: + /* + * Prefer to break one ldp/stp into several load/store to access + * memory in an increasing address order,rather than to load/store 16 + * bytes from (src-16) to (dst-16) and to backward the src to aligned + * address,which way is used in original cortex memcpy. If keeping + * the original memcpy process here, memmove need to satisfy the + * precondition that src address is at least 16 bytes bigger than dst + * address,otherwise some source data will be overwritten when memove + * call memcpy directly. To make memmove simpler and decouple the + * memcpy's dependency on memmove, withdrew the original process. + */ + tbz count, #3, 1f + ldr1 tmp1, src, #8 + str1 tmp1, dst, #8 +1: + tbz count, #2, 2f + ldr1 tmp1w, src, #4 + str1 tmp1w, dst, #4 +2: + tbz count, #1, 3f + ldrh1 tmp1w, src, #2 + strh1 tmp1w, dst, #2 +3: + tbz count, #0, .Lexitfunc + ldrb1 tmp1w, src, #1 + strb1 tmp1w, dst, #1 + + b .Lexitfunc + +.Lcpy_over64: + subs count, count, #128 + b.ge .Lcpy_body_large + /* + * Less than 128 bytes to copy, so handle 64 here and then jump + * to the tail. + */ + ldp2 A_l, A_h, src, #0 + stp2 A_l, A_h, dst, #0 + ldp2 B_l, B_h, src, #16 + ldp2 C_l, C_h, src, #32 + stp2 B_l, B_h, dst, #16 + stp2 C_l, C_h, dst, #32 + ldp2 D_l, D_h, src, #48 + stp2 D_l, D_h, dst, #48 + add src, src, #64 + add dst, dst, #64 + + tst count, #0x3f + b.ne .Ltail63 + b .Lexitfunc + + /* + * Critical loop. Start at a new cache line boundary. Assuming + * 64 bytes per line this ensures the entire loop is in one line. + */ + .p2align L1_CACHE_SHIFT +.Lcpy_body_large: + + /* pre-get 64 bytes data. */ + ldp2 A_l, A_h, src, #0 + ldp2 B_l, B_h, src, #16 + ldp2 C_l, C_h, src, #32 + ldp2 D_l, D_h, src, #48 + add src, src, #64 +1: + /* + * interlace the load of next 64 bytes data block with store of the last + * loaded 64 bytes data. + */ + stp2 A_l, A_h, dst, #0 + ldp2 A_l, A_h, src, #0 + stp2 B_l, B_h, dst, #16 + ldp2 B_l, B_h, src, #16 + stp2 C_l, C_h, dst, #32 + ldp2 C_l, C_h, src, #32 + stp2 D_l, D_h, dst, #48 + ldp2 D_l, D_h, src, #48 + add dst, dst, #64 + add src, src, #64 + subs count, count, #64 + b.ge 1b + + /* Post-loop: store the last block of data using stp2 */ + /* (without post-increment) */ + stp2 A_l, A_h, dst, #0 + stp2 B_l, B_h, dst, #16 + stp2 C_l, C_h, dst, #32 + stp2 D_l, D_h, dst, #48 + add dst, dst, #64 + + tst count, #0x3f + b.ne .Ltail63 +.Lexitfunc: -- 2.43.0

2 1

[PATCH OLK-6.6] [Backport] mm: refactor mm_access() to not return NULL
by Tang Hui 07 Aug '26

07 Aug '26

From: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> stable inclusion from stable-v6.6.146 commit d8a1f7420d2d58fcbde479bd72d0900fb512cb2d category: bugfix bugzilla: NA CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit cd3f8467afd470ccab0de2fbc7c76664af4a0bac ] mm_access() can return NULL if the mm is not found, but this is handled the same as an error in all callers, with some translating this into an -ESRCH error. Only proc_mem_open() returns NULL if no mm is found, however in this case it is clearer and makes more sense to explicitly handle the error. Additionally we take the opportunity to refactor the function to eliminate unnecessary nesting. d8a1f7420d2d58fcbde479bd72d0900fb512cb2d Simplify things by simply returning -ESRCH if no mm is found - this both eliminates confusing use of the IS_ERR_OR_NULL() macro, and simplifies callers which would return -ESRCH by returning this error directly. [lorenzo.stoakes(a)oracle.com: prefer neater pointer error comparison] Link: https://lkml.kernel.org/r/2fae1834-749a-45e1-8594-5e5979cf7103@lucifer.local Link: https://lkml.kernel.org/r/20240924201023.193135-1-lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Suggested-by: Arnd Bergmann <arnd(a)arndb.de> Cc: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Tang Hui <tanghui20(a)huawei.com> --- fs/proc/base.c | 26 ++++++++++++++------------ kernel/fork.c | 5 +++-- mm/madvise.c | 4 ++-- mm/process_vm_access.c | 4 ++-- 4 files changed, 21 insertions(+), 18 deletions(-) diff --git a/fs/proc/base.c b/fs/proc/base.c index cac883cf29fa..7ee2285910bb 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -815,19 +815,21 @@ static const struct file_operations proc_single_file_operations = { struct mm_struct *proc_mem_open(struct inode *inode, unsigned int mode) { struct task_struct *task = get_proc_task(inode); - struct mm_struct *mm = ERR_PTR(-ESRCH); + struct mm_struct *mm; - if (task) { - mm = mm_access(task, mode | PTRACE_MODE_FSCREDS); - put_task_struct(task); + if (!task) + return ERR_PTR(-ESRCH); - if (!IS_ERR_OR_NULL(mm)) { - /* ensure this mm_struct can't be freed */ - mmgrab(mm); - /* but do not pin its memory */ - mmput(mm); - } - } + mm = mm_access(task, mode | PTRACE_MODE_FSCREDS); + put_task_struct(task); + + if (IS_ERR(mm)) + return mm == ERR_PTR(-ESRCH) ? NULL : mm; + + /* ensure this mm_struct can't be freed */ + mmgrab(mm); + /* but do not pin its memory */ + mmput(mm); return mm; } @@ -2205,7 +2207,7 @@ static int map_files_d_revalidate(struct dentry *dentry, unsigned int flags) goto out_notask; mm = mm_access(task, PTRACE_MODE_READ_FSCREDS); - if (IS_ERR_OR_NULL(mm)) + if (IS_ERR(mm)) goto out; if (!dname_to_vma_addr(dentry, &vm_start, &vm_end)) { diff --git a/kernel/fork.c b/kernel/fork.c index e92ddc0a0c66..7f188d166f35 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -1676,8 +1676,9 @@ struct mm_struct *mm_access(struct task_struct *task, unsigned int mode) return ERR_PTR(err); mm = get_task_mm(task); - if (mm && mm != current->mm && - !ptrace_may_access(task, mode)) { + if (!mm) { + mm = ERR_PTR(-ESRCH); + } else if (mm != current->mm && !ptrace_may_access(task, mode)) { mmput(mm); mm = ERR_PTR(-EACCES); } diff --git a/mm/madvise.c b/mm/madvise.c index 4b7956dd6357..7fb856fc7eec 100644 --- a/mm/madvise.c +++ b/mm/madvise.c @@ -1846,8 +1846,8 @@ SYSCALL_DEFINE5(process_madvise, int, pidfd, const struct iovec __user *, vec, /* Require PTRACE_MODE_READ to avoid leaking ASLR metadata. */ mm = mm_access(task, PTRACE_MODE_READ_FSCREDS); - if (IS_ERR_OR_NULL(mm)) { - ret = IS_ERR(mm) ? PTR_ERR(mm) : -ESRCH; + if (IS_ERR(mm)) { + ret = PTR_ERR(mm); goto release_task; } diff --git a/mm/process_vm_access.c b/mm/process_vm_access.c index 0523edab03a6..5be8e91aa872 100644 --- a/mm/process_vm_access.c +++ b/mm/process_vm_access.c @@ -200,8 +200,8 @@ static ssize_t process_vm_rw_core(pid_t pid, struct iov_iter *iter, } mm = mm_access(task, PTRACE_MODE_ATTACH_REALCREDS); - if (!mm || IS_ERR(mm)) { - rc = IS_ERR(mm) ? PTR_ERR(mm) : -ESRCH; + if (IS_ERR(mm)) { + rc = PTR_ERR(mm); /* * Explicitly map EACCES to EPERM as EPERM is a more * appropriate error code for process_vw_readv/writev -- 2.34.1

1 0

[PATCH OLK-6.6] erofs: fix stack-out-of-bounds in erofs_put_metabuf
by Liu Mingrui 07 Aug '26

07 Aug '26

From: Mingrui Liu <liumingrui(a)huawei.com> Offering: HULK hulk inclusion category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16872 -------------------------------- Commit 1d4b040dd8ee moved erofs_put_metabuf() to out_unlock, but some error paths jump there before buf is initialized, unlike mainline where buf is always set. This triggers : BUG: KASAN: stack-out-of-bounds in erofs_put_metabuf+0x54/0x158 [erofs] Call Trace: dump_backtrace+0xa0/0x128 show_stack+0x20/0x38 dump_stack_lvl+0x78/0xc8 print_address_description.constprop.0+0x84/0x3c8 print_report+0xb0/0x280 kasan_report+0x84/0xd0 __asan_load8+0x9c/0xc0 erofs_put_metabuf+0x54/0x158 [erofs] erofs_init_inode_xattrs+0x194/0x560 [erofs] erofs_getxattr+0xc8/0x238 [erofs] erofs_get_acl+0x6c/0x150 [erofs] __get_acl.part.0+0x218/0x390 vfs_get_acl+0xd0/0x150 do_get_acl+0x38/0x2a0 do_getxattr+0x9c/0x250 getxattr+0xe0/0x148 path_getxattr+0xdc/0x150 __arm64_sys_getxattr+0x60/0x80 invoke_syscall+0x64/0x178 el0_svc_common.constprop.0+0x11c/0x150 do_el0_svc+0x38/0x50 el0_svc+0x44/0x228 el0t_64_sync_handler+0x100/0x130 el0t_64_sync+0x3c8/0x3d0 Fix by zero-initializing buf at declaration so erofs_put_metabuf() can safely handle it. Fixes: 1d4b040dd8ee ("[Backport] erofs: fix metabuf leak in inode xattr initialization") Signed-off-by: Mingrui Liu <liumingrui(a)huawei.com> --- fs/erofs/xattr.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/erofs/xattr.c b/fs/erofs/xattr.c index b270226be379..abd23e990a3a 100644 --- a/fs/erofs/xattr.c +++ b/fs/erofs/xattr.c @@ -34,6 +34,8 @@ static int erofs_init_inode_xattrs(struct inode *inode) struct super_block *sb = inode->i_sb; int ret = 0; + it.buf = __EROFS_BUF_INITIALIZER; + /* the most case is that xattrs of this inode are initialized. */ if (test_bit(EROFS_I_EA_INITED_BIT, &vi->flags)) { /* @@ -76,7 +78,6 @@ static int erofs_init_inode_xattrs(struct inode *inode) goto out_unlock; } - it.buf = __EROFS_BUF_INITIALIZER; erofs_init_metabuf(&it.buf, sb); it.pos = erofs_iloc(inode) + vi->inode_isize; -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] Backport CVE-2026-64361 fixes from 6.6 LTS
by Pan Taixi 07 Aug '26

07 Aug '26

Bacport "hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length" and its antecedent patch "hfs/hfsplus: prevent getting negative values of offset/length" Tristan Madani (1): hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length Viacheslav Dubeyko (1): hfs/hfsplus: prevent getting negative values of offset/length fs/hfs/bfind.c | 2 +- fs/hfs/bnode.c | 54 ++++++++++++------------- fs/hfs/brec.c | 2 +- fs/hfs/btree.c | 2 +- fs/hfs/btree.h | 71 +++++++++++++++++---------------- fs/hfs/hfs_fs.h | 88 ++++++++++++++++++++++++----------------- fs/hfs/inode.c | 3 +- fs/hfsplus/bfind.c | 2 +- fs/hfsplus/bnode.c | 60 ++++++++++++++-------------- fs/hfsplus/brec.c | 2 +- fs/hfsplus/btree.c | 2 +- fs/hfsplus/hfsplus_fs.h | 40 +++++++++---------- 12 files changed, 173 insertions(+), 155 deletions(-) -- 2.34.1

2 3