- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10 0/2] Fix CVE-2025-40016
by Long Li 13 Jan '26

13 Jan '26

Fix CVE-2025-40016 Ricardo Ribalda (1): media: uvcvideo: Allow extra entities Thadeu Lima de Souza Cascardo (1): media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID drivers/media/usb/uvc/uvc_driver.c | 66 +++++++++++++++++++----------- drivers/media/usb/uvc/uvcvideo.h | 9 +++- 2 files changed, 49 insertions(+), 26 deletions(-) -- 2.39.2

2 3

[PATCH OLK-5.10] smb: client: fix race with concurrent opens in rename(2)
by Long Li 13 Jan '26

13 Jan '26

From: Paulo Alcantara <pc(a)manguebit.org> mainline inclusion from mainline-v6.17-rc1 commit d84291fc7453df7881a970716f8256273aca5747 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/8680 CVE: CVE-2025-39825 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Besides sending the rename request to the server, the rename process also involves closing any deferred close, waiting for outstanding I/O to complete as well as marking all existing open handles as deleted to prevent them from deferring closes, which increases the race window for potential concurrent opens on the target file. Fix this by unhashing the dentry in advance to prevent any concurrent opens on the target. Signed-off-by: Paulo Alcantara (Red Hat) <pc(a)manguebit.org> Reviewed-by: David Howells <dhowells(a)redhat.com> Cc: Al Viro <viro(a)zeniv.linux.org.uk> Cc: linux-cifs(a)vger.kernel.org Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/cifs/inode.c fs/smb/client/inode.c [Code mvoe to fs/smb/client] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/cifs/inode.c | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c index b11a919b9cab..3f33cdd14b1a 100644 --- a/fs/cifs/inode.c +++ b/fs/cifs/inode.c @@ -2069,6 +2069,7 @@ cifs_rename2(struct inode *source_dir, struct dentry *source_dentry, struct cifs_sb_info *cifs_sb; struct tcon_link *tlink; struct cifs_tcon *tcon; + bool rehash = false; FILE_UNIX_BASIC_INFO *info_buf_source = NULL; FILE_UNIX_BASIC_INFO *info_buf_target; unsigned int xid; @@ -2078,6 +2079,18 @@ cifs_rename2(struct inode *source_dir, struct dentry *source_dentry, return -EINVAL; cifs_sb = CIFS_SB(source_dir->i_sb); + + /* + * Prevent any concurrent opens on the target by unhashing the dentry. + * VFS already unhashes the target when renaming directories. + */ + if (d_is_positive(target_dentry) && !d_is_dir(target_dentry)) { + if (!d_unhashed(target_dentry)) { + d_drop(target_dentry); + rehash = true; + } + } + tlink = cifs_sb_tlink(cifs_sb); if (IS_ERR(tlink)) return PTR_ERR(tlink); @@ -2103,6 +2116,8 @@ cifs_rename2(struct inode *source_dir, struct dentry *source_dentry, rc = cifs_do_rename(xid, source_dentry, from_name, target_dentry, to_name); + if (!rc) + rehash = false; /* * No-replace is the natural behavior for CIFS, so skip unlink hacks. @@ -2159,6 +2174,8 @@ cifs_rename2(struct inode *source_dir, struct dentry *source_dentry, goto cifs_rename_exit; rc = cifs_do_rename(xid, source_dentry, from_name, target_dentry, to_name); + if (!rc) + rehash = false; } /* force revalidate to go get info when needed */ @@ -2168,6 +2185,8 @@ cifs_rename2(struct inode *source_dir, struct dentry *source_dentry, target_dir->i_mtime = current_time(source_dir); cifs_rename_exit: + if (rehash) + d_rehash(target_dentry); kfree(info_buf_source); kfree(from_name); kfree(to_name); -- 2.39.2

2 1

[PATCH OLK-5.10 0/3] Fix CVE-2022-50737
by Long Li 13 Jan '26

13 Jan '26

Fix CVE-2022-50737 Edward Lo (2): fs/ntfs3: Validate index root when initialize NTFS security fs/ntfs3: Validate buffer length while parsing index Konstantin Komarov (1): fs/ntfs3: Add null pointer checks fs/ntfs3/fsntfs.c | 18 ++++++++++++------ fs/ntfs3/index.c | 7 +++++++ 2 files changed, 19 insertions(+), 6 deletions(-) -- 2.39.2

2 4

[PATCH OLK-5.10 v2 0/2] Fix CVE-2024-53179
by Long Li 13 Jan '26

13 Jan '26

Fix CVE-2024-53179 Paulo Alcantara (1): smb: client: fix use-after-free of signing key Shyam Prasad N (1): cifs: missed ref-counting smb session in find fs/cifs/smb2proto.h | 2 -- fs/cifs/smb2transport.c | 58 ++++++++++++++++++++++++++++++----------- 2 files changed, 43 insertions(+), 17 deletions(-) -- 2.39.2

2 3

[PATCH OLK-5.10] xfs: Add xfs_dir3_leaf_header_check() in leaf/leafn read
by Zizhi Wo 13 Jan '26

13 Jan '26

Offering: HULK hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8353 -------------------------------- [BUG] A KASAN out-of-bounds issue was discovered during syzkaller testing: BUG: unable to handle page fault for address: ffffed101c3f4de7 ... ...... Call Trace: xfs_dir2_leaf_addname+0xc70/0x1060 xfs_dir_createname+0x3a6/0x4a0 xfs_create+0x6ff/0x8b0 ...... [CAUSE] The root cause is mounting a corrupted XFS image where the physical block of a data block overlaps with the physical block of a leaf block. The process is as follows: 1) User called getdents. Then xfs_readdir() is called to pre-read the xfs_buf corresponding to the data block. 2) Then, when creating a file in the corresponding directory, the leaf reuses the previous xfs_buf because of the same value of startblock and blockcnt in record. 3) In xfs_dir2_leaf_addname(), "bestsp" is calculated by subtracting the ltp->bestcount size from an address. At this point, bestcount is actually xfs_dir2_data_unused->tag from the data block, which represents the offset of the current unused space, making it easy to trigger an out-of-bounds access on bestsp. Subsequent accesses to bestsp lead to this issue. [FIX] The xfs_dir3_leaf_read() function does not perform further validation on the acquired xfs_buf. Following the logic in xfs_dir3_data_read() and linux-mainline, apply the validation to leaf/leafn read to detect errors early and prevent subsequent KASAN issues. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/xfs/libxfs/xfs_dir2_leaf.c | 51 +++++++++++++++++++++++++++++++++-- 1 file changed, 49 insertions(+), 2 deletions(-) diff --git a/fs/xfs/libxfs/xfs_dir2_leaf.c b/fs/xfs/libxfs/xfs_dir2_leaf.c index bb18323fd1ed..553ca8526c89 100644 --- a/fs/xfs/libxfs/xfs_dir2_leaf.c +++ b/fs/xfs/libxfs/xfs_dir2_leaf.c @@ -203,6 +203,29 @@ xfs_dir3_leaf_verify( return xfs_dir3_leaf_check_int(mp, &leafhdr, bp->b_addr); } +xfs_failaddr_t +xfs_dir3_leaf_header_check( + struct xfs_buf *bp, + xfs_ino_t owner) +{ + struct xfs_mount *mp = bp->b_mount; + + if (xfs_has_crc(mp)) { + struct xfs_dir3_leaf *hdr3 = bp->b_addr; + + if (hdr3->hdr.info.hdr.magic != + cpu_to_be16(XFS_DIR3_LEAF1_MAGIC) && + hdr3->hdr.info.hdr.magic != + cpu_to_be16(XFS_DIR3_LEAFN_MAGIC)) + return __this_address; + + if (be64_to_cpu(hdr3->hdr.info.owner) != owner) + return __this_address; + } + + return NULL; +} + static void xfs_dir3_leaf_read_verify( struct xfs_buf *bp) @@ -269,11 +292,23 @@ xfs_dir3_leaf_read( xfs_dablk_t fbno, struct xfs_buf **bpp) { + xfs_failaddr_t fa; int err; err = xfs_da_read_buf(tp, dp, fbno, 0, bpp, XFS_DATA_FORK, &xfs_dir3_leaf1_buf_ops); - if (!err && tp && *bpp) + if (err || !(*bpp)) + return err; + + fa = xfs_dir3_leaf_header_check(*bpp, dp->i_ino); + if (fa) { + __xfs_buf_mark_corrupt(*bpp, fa); + xfs_trans_brelse(tp, *bpp); + *bpp = NULL; + return -EFSCORRUPTED; + } + + if (tp) xfs_trans_buf_set_type(tp, *bpp, XFS_BLFT_DIR_LEAF1_BUF); return err; } @@ -285,11 +320,23 @@ xfs_dir3_leafn_read( xfs_dablk_t fbno, struct xfs_buf **bpp) { + xfs_failaddr_t fa; int err; err = xfs_da_read_buf(tp, dp, fbno, 0, bpp, XFS_DATA_FORK, &xfs_dir3_leafn_buf_ops); - if (!err && tp && *bpp) + if (err || !(*bpp)) + return err; + + fa = xfs_dir3_leaf_header_check(*bpp, dp->i_ino); + if (fa) { + __xfs_buf_mark_corrupt(*bpp, fa); + xfs_trans_brelse(tp, *bpp); + *bpp = NULL; + return -EFSCORRUPTED; + } + + if (tp) xfs_trans_buf_set_type(tp, *bpp, XFS_BLFT_DIR_LEAFN_BUF); return err; } -- 2.39.2

2 1

[PATCH OLK-6.6] xfs: Add xfs_dir3_leaf_header_check() in leaf/leafn read
by Zizhi Wo 13 Jan '26

13 Jan '26

Offering: HULK hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8353 -------------------------------- [BUG] A KASAN out-of-bounds issue was discovered during syzkaller testing: BUG: unable to handle page fault for address: ffffed101c3f4de7 ... ...... Call Trace: xfs_dir2_leaf_addname+0xc70/0x1060 xfs_dir_createname+0x3a6/0x4a0 xfs_create+0x6ff/0x8b0 ...... [CAUSE] The root cause is mounting a corrupted XFS image where the physical block of a data block overlaps with the physical block of a leaf block. The process is as follows: 1) User called getdents. Then xfs_readdir() is called to pre-read the xfs_buf corresponding to the data block. 2) Then, when creating a file in the corresponding directory, the leaf reuses the previous xfs_buf because of the same value of startblock and blockcnt in record. 3) In xfs_dir2_leaf_addname(), "bestsp" is calculated by subtracting the ltp->bestcount size from an address. At this point, bestcount is actually xfs_dir2_data_unused->tag from the data block, which represents the offset of the current unused space, making it easy to trigger an out-of-bounds access on bestsp. Subsequent accesses to bestsp lead to this issue. [FIX] The xfs_dir3_leaf_read() function does not perform further validation on the acquired xfs_buf. Following the logic in xfs_dir3_data_read() and linux-mainline, apply the validation to leaf/leafn read to detect errors early and prevent subsequent KASAN issues. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/xfs/libxfs/xfs_dir2_leaf.c | 51 +++++++++++++++++++++++++++++++++-- 1 file changed, 49 insertions(+), 2 deletions(-) diff --git a/fs/xfs/libxfs/xfs_dir2_leaf.c b/fs/xfs/libxfs/xfs_dir2_leaf.c index cb9e950a911d..57720c2274b6 100644 --- a/fs/xfs/libxfs/xfs_dir2_leaf.c +++ b/fs/xfs/libxfs/xfs_dir2_leaf.c @@ -207,6 +207,29 @@ xfs_dir3_leaf_verify( return xfs_dir3_leaf_check_int(mp, &leafhdr, bp->b_addr, true); } +xfs_failaddr_t +xfs_dir3_leaf_header_check( + struct xfs_buf *bp, + xfs_ino_t owner) +{ + struct xfs_mount *mp = bp->b_mount; + + if (xfs_has_crc(mp)) { + struct xfs_dir3_leaf *hdr3 = bp->b_addr; + + if (hdr3->hdr.info.hdr.magic != + cpu_to_be16(XFS_DIR3_LEAF1_MAGIC) && + hdr3->hdr.info.hdr.magic != + cpu_to_be16(XFS_DIR3_LEAFN_MAGIC)) + return __this_address; + + if (be64_to_cpu(hdr3->hdr.info.owner) != owner) + return __this_address; + } + + return NULL; +} + static void xfs_dir3_leaf_read_verify( struct xfs_buf *bp) @@ -273,11 +296,23 @@ xfs_dir3_leaf_read( xfs_dablk_t fbno, struct xfs_buf **bpp) { + xfs_failaddr_t fa; int err; err = xfs_da_read_buf(tp, dp, fbno, 0, bpp, XFS_DATA_FORK, &xfs_dir3_leaf1_buf_ops); - if (!err && tp && *bpp) + if (err || !(*bpp)) + return err; + + fa = xfs_dir3_leaf_header_check(*bpp, dp->i_ino); + if (fa) { + __xfs_buf_mark_corrupt(*bpp, fa); + xfs_trans_brelse(tp, *bpp); + *bpp = NULL; + return -EFSCORRUPTED; + } + + if (tp) xfs_trans_buf_set_type(tp, *bpp, XFS_BLFT_DIR_LEAF1_BUF); return err; } @@ -289,11 +324,23 @@ xfs_dir3_leafn_read( xfs_dablk_t fbno, struct xfs_buf **bpp) { + xfs_failaddr_t fa; int err; err = xfs_da_read_buf(tp, dp, fbno, 0, bpp, XFS_DATA_FORK, &xfs_dir3_leafn_buf_ops); - if (!err && tp && *bpp) + if (err || !(*bpp)) + return err; + + fa = xfs_dir3_leaf_header_check(*bpp, dp->i_ino); + if (fa) { + __xfs_buf_mark_corrupt(*bpp, fa); + xfs_trans_brelse(tp, *bpp); + *bpp = NULL; + return -EFSCORRUPTED; + } + + if (tp) xfs_trans_buf_set_type(tp, *bpp, XFS_BLFT_DIR_LEAFN_BUF); return err; } -- 2.39.2

2 1

[PATCH OLK-6.6] net/mdiobus: Fix potential out-of-bounds read/write access
by Zhang Changzhong 12 Jan '26

12 Jan '26

From: Jakub Raczynski <j.raczynski(a)samsung.com> stable inclusion from stable-v6.6.94 commit bab6bca0834cbb5be2a7cfe59ec6ad016ec72608 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/9645 CVE: CVE-2025-38111 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 0e629694126ca388916f059453a1c36adde219c4 ] When using publicly available tools like 'mdio-tools' to read/write data from/to network interface and its PHY via mdiobus, there is no verification of parameters passed to the ioctl and it accepts any mdio address. Currently there is support for 32 addresses in kernel via PHY_MAX_ADDR define, but it is possible to pass higher value than that via ioctl. While read/write operation should generally fail in this case, mdiobus provides stats array, where wrong address may allow out-of-bounds read/write. Fix that by adding address verification before read/write operation. While this excludes this access from any statistics, it improves security of read/write operation. Fixes: 080bb352fad00 ("net: phy: Maintain MDIO device and bus statistics") Signed-off-by: Jakub Raczynski <j.raczynski(a)samsung.com> Reported-by: Wenjing Shan <wenjing.shan(a)samsung.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/net/phy/mdio_bus.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c index 6f8177a..e02706b 100644 --- a/drivers/net/phy/mdio_bus.c +++ b/drivers/net/phy/mdio_bus.c @@ -850,6 +850,9 @@ int __mdiobus_read(struct mii_bus *bus, int addr, u32 regnum) lockdep_assert_held_once(&bus->mdio_lock); + if (addr >= PHY_MAX_ADDR) + return -ENXIO; + if (bus->read) retval = bus->read(bus, addr, regnum); else @@ -879,6 +882,9 @@ int __mdiobus_write(struct mii_bus *bus, int addr, u32 regnum, u16 val) lockdep_assert_held_once(&bus->mdio_lock); + if (addr >= PHY_MAX_ADDR) + return -ENXIO; + if (bus->write) err = bus->write(bus, addr, regnum, val); else -- 2.9.5

2 1

[PATCH OLK-5.10 0/2] CVE-2025-38111
by Zhang Changzhong 12 Jan '26

12 Jan '26

Andrew Lunn (1): net: mdio: C22 is now optional, EOPNOTSUPP if not provided Jakub Raczynski (1): net/mdiobus: Fix potential out-of-bounds read/write access drivers/net/phy/mdio_bus.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) -- 2.9.5

2 3

[PATCH OLK-6.6] net/mdiobus: Fix potential out-of-bounds clause 45 read/write access
by Zhang Changzhong 12 Jan '26

12 Jan '26

From: Jakub Raczynski <j.raczynski(a)samsung.com> stable inclusion from stable-v6.6.94 commit abb0605ca00979a49572a6516f6db22c3dc57223 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/9663 CVE: CVE-2025-38110 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 260388f79e94fb3026c419a208ece8358bb7b555 ] When using publicly available tools like 'mdio-tools' to read/write data from/to network interface and its PHY via C45 (clause 45) mdiobus, there is no verification of parameters passed to the ioctl and it accepts any mdio address. Currently there is support for 32 addresses in kernel via PHY_MAX_ADDR define, but it is possible to pass higher value than that via ioctl. While read/write operation should generally fail in this case, mdiobus provides stats array, where wrong address may allow out-of-bounds read/write. Fix that by adding address verification before C45 read/write operation. While this excludes this access from any statistics, it improves security of read/write operation. Fixes: 4e4aafcddbbf ("net: mdio: Add dedicated C45 API to MDIO bus drivers") Signed-off-by: Jakub Raczynski <j.raczynski(a)samsung.com> Reported-by: Wenjing Shan <wenjing.shan(a)samsung.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/net/phy/mdio_bus.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c index 25dcaa4..6f8177a 100644 --- a/drivers/net/phy/mdio_bus.c +++ b/drivers/net/phy/mdio_bus.c @@ -940,6 +940,9 @@ int __mdiobus_c45_read(struct mii_bus *bus, int addr, int devad, u32 regnum) lockdep_assert_held_once(&bus->mdio_lock); + if (addr >= PHY_MAX_ADDR) + return -ENXIO; + if (bus->read_c45) retval = bus->read_c45(bus, addr, devad, regnum); else @@ -971,6 +974,9 @@ int __mdiobus_c45_write(struct mii_bus *bus, int addr, int devad, u32 regnum, lockdep_assert_held_once(&bus->mdio_lock); + if (addr >= PHY_MAX_ADDR) + return -ENXIO; + if (bus->write_c45) err = bus->write_c45(bus, addr, devad, regnum, val); else -- 2.9.5

2 1

[PATCH OLK-6.6] net: phy: clear phydev->devlink when the link is deleted
by Zhang Changzhong 12 Jan '26

12 Jan '26

From: Wei Fang <wei.fang(a)nxp.com> stable inclusion from stable-v6.6.94 commit 363fdf2777423ad346d781f09548cca14877f729 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/9635 CVE: CVE-2025-38149 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 0795b05a59b1371b18ffbf09d385296b12e9f5d5 ] There is a potential crash issue when disabling and re-enabling the network port. When disabling the network port, phy_detach() calls device_link_del() to remove the device link, but it does not clear phydev->devlink, so phydev->devlink is not a NULL pointer. Then the network port is re-enabled, but if phy_attach_direct() fails before calling device_link_add(), the code jumps to the "error" label and calls phy_detach(). Since phydev->devlink retains the old value from the previous attach/detach cycle, device_link_del() uses the old value, which accesses a NULL pointer and causes a crash. The simplified crash log is as follows. [ 24.702421] Call trace: [ 24.704856] device_link_put_kref+0x20/0x120 [ 24.709124] device_link_del+0x30/0x48 [ 24.712864] phy_detach+0x24/0x168 [ 24.716261] phy_attach_direct+0x168/0x3a4 [ 24.720352] phylink_fwnode_phy_connect+0xc8/0x14c [ 24.725140] phylink_of_phy_connect+0x1c/0x34 Therefore, phydev->devlink needs to be cleared when the device link is deleted. Fixes: bc66fa87d4fd ("net: phy: Add link between phy dev and mac dev") Signed-off-by: Wei Fang <wei.fang(a)nxp.com> Reviewed-by: Andrew Lunn <andrew(a)lunn.ch> Reviewed-by: Florian Fainelli <florian.fainelli(a)broadcom.com> Link: https://patch.msgid.link/20250523083759.3741168-1-wei.fang@nxp.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/net/phy/phy_device.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c index ee43f4d..14da8fdb 100644 --- a/drivers/net/phy/phy_device.c +++ b/drivers/net/phy/phy_device.c @@ -1833,8 +1833,10 @@ void phy_detach(struct phy_device *phydev) struct module *ndev_owner = NULL; struct mii_bus *bus; - if (phydev->devlink) + if (phydev->devlink) { device_link_del(phydev->devlink); + phydev->devlink = NULL; + } if (phydev->sysfs_links) { if (dev) -- 2.9.5

2 1