- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] Bluetooth: Fix error code in chan_alloc_skb_cb()
by Dong Chenchen 25 Aug '25

25 Aug '25

From: Dan Carpenter <dan.carpenter(a)linaro.org> stable inclusion from stable-v6.6.85 commit ecd06ad0823a90b4420c377ef8917e44e23ee841 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBYOFU CVE: CVE-2025-22007 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 72d061ee630d0dbb45c2920d8d19b3861c413e54 ] The chan_alloc_skb_cb() function is supposed to return error pointers on error. Returning NULL will lead to a NULL dereference. Fixes: 6b8d4a6a0314 ("Bluetooth: 6LoWPAN: Use connected oriented channel instead of fixed one") Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/bluetooth/6lowpan.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c index 3bcc15c9415f..13b752c169be 100644 --- a/net/bluetooth/6lowpan.c +++ b/net/bluetooth/6lowpan.c @@ -825,11 +825,16 @@ static struct sk_buff *chan_alloc_skb_cb(struct l2cap_chan *chan, unsigned long hdr_len, unsigned long len, int nb) { + struct sk_buff *skb; + /* Note that we must allocate using GFP_ATOMIC here as * this function is called originally from netdev hard xmit * function in atomic context. */ - return bt_skb_alloc(hdr_len + len, GFP_ATOMIC); + skb = bt_skb_alloc(hdr_len + len, GFP_ATOMIC); + if (!skb) + return ERR_PTR(-ENOMEM); + return skb; } static void chan_suspend_cb(struct l2cap_chan *chan) -- 2.25.1

2 1

[PATCH OLK-6.6 0/2] tcp: Fix CVE-2025-21864
by Dong Chenchen 25 Aug '25

25 Aug '25

Fix CVE-2025-21864 Dong Chenchen (1): net: use __GENKSYMS__ to revert the kabi change Sabrina Dubroca (1): tcp: drop secpath at the same time as we currently drop dst include/net/tcp.h | 16 ++++++++++++++++ net/ipv4/tcp_fastopen.c | 4 ++-- net/ipv4/tcp_input.c | 8 ++++---- net/ipv4/tcp_ipv4.c | 2 +- 4 files changed, 23 insertions(+), 7 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10 0/3] netfilter: fix CVE-2022-49622
by Dong Chenchen 25 Aug '25

25 Aug '25

fix CVE-2022-49622. Florian Westphal (3): netfilter: nf_tables: avoid skb access on nf_stolen netfilter: nf_tables: fix crash when nf_trace is enabled selftests: netfilter: add test case for nf trace infrastructure include/net/netfilter/nf_tables.h | 16 ++-- net/netfilter/nf_tables_core.c | 29 +++++-- net/netfilter/nf_tables_trace.c | 44 +++++----- .../selftests/netfilter/nft_trans_stress.sh | 81 +++++++++++++++++-- 4 files changed, 133 insertions(+), 37 deletions(-) -- 2.25.1

2 4

[PATCH OLK-6.6] ipmi:msghandler: Fix potential memory corruption in ipmi_create_user()
by Zhao Yipeng 25 Aug '25

25 Aug '25

From: Dan Carpenter <dan.carpenter(a)linaro.org> stable inclusion from stable-v6.6.99 commit e2d5c005dfc96fe857676d1d8ac46b29275cb89b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICOXOK CVE: CVE-2025-38456 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit fa332f5dc6fc662ad7d3200048772c96b861cf6b upstream. The "intf" list iterator is an invalid pointer if the correct "intf->intf_num" is not found. Calling atomic_dec(&intf->nr_users) on and invalid pointer will lead to memory corruption. We don't really need to call atomic_dec() if we haven't called atomic_add_return() so update the if (intf->in_shutdown) path as well. Fixes: 8e76741c3d8b ("ipmi: Add a limit on the number of users that may use IPMI") Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Message-ID: <aBjMZ8RYrOt6NOgi(a)stanley.mountain> Signed-off-by: Corey Minyard <corey(a)minyard.net> [ - Dropped change to the `if (intf->in_shutdown)` block since that logic doesn't exist yet. - Modified out_unlock to release the srcu lock instead of the mutex since we don't have the mutex here yet. ] Signed-off-by: Brendan Jackman <jackmanb(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhao Yipeng <zhaoyipeng5(a)huawei.com> --- drivers/char/ipmi/ipmi_msghandler.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c index 127ca3239009..fde76a6e6264 100644 --- a/drivers/char/ipmi/ipmi_msghandler.c +++ b/drivers/char/ipmi/ipmi_msghandler.c @@ -1247,7 +1247,7 @@ int ipmi_create_user(unsigned int if_num, } /* Not found, return an error */ rv = -EINVAL; - goto out_kfree; + goto out_unlock; found: if (atomic_add_return(1, &intf->nr_users) > max_users) { @@ -1289,6 +1289,7 @@ int ipmi_create_user(unsigned int if_num, out_kfree: atomic_dec(&intf->nr_users); +out_unlock: srcu_read_unlock(&ipmi_interfaces_srcu, index); vfree(new_user); return rv; -- 2.34.1

2 1

[PATCH OLK-5.10] net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()
by Dong Chenchen 25 Aug '25

25 Aug '25

From: Ignat Korchagin <ignat(a)cloudflare.com> stable inclusion from stable-v5.10.231 commit 14959fd7538b3be6d7617d9e60e404d6a8d4fd1f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAN6 CVE: CVE-2024-56602 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b4fcd63f6ef79c73cafae8cf4a114def5fc3d80d ] sock_init_data() attaches the allocated sk object to the provided sock object. If ieee802154_create() fails later, the allocated sk object is freed, but the dangling pointer remains in the provided sock object, which may allow use-after-free. Clear the sk pointer in the sock object on error. Signed-off-by: Ignat Korchagin <ignat(a)cloudflare.com> Reviewed-by: Miquel Raynal <miquel.raynal(a)bootlin.com> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20241014153808.51894-6-ignat@cloudflare.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/ieee802154/socket.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/net/ieee802154/socket.c b/net/ieee802154/socket.c index d4c275e56d82..c8b9efc92b45 100644 --- a/net/ieee802154/socket.c +++ b/net/ieee802154/socket.c @@ -1047,19 +1047,21 @@ static int ieee802154_create(struct net *net, struct socket *sock, if (sk->sk_prot->hash) { rc = sk->sk_prot->hash(sk); - if (rc) { - sk_common_release(sk); - goto out; - } + if (rc) + goto out_sk_release; } if (sk->sk_prot->init) { rc = sk->sk_prot->init(sk); if (rc) - sk_common_release(sk); + goto out_sk_release; } out: return rc; +out_sk_release: + sk_common_release(sk); + sock->sk = NULL; + goto out; } static const struct net_proto_family ieee802154_family_ops = { -- 2.25.1

2 1

[PATCH OLK-6.6 0/2] gtp: Fix CVE-2025-21678
by Dong Chenchen 25 Aug '25

25 Aug '25

Fix CVE-2025-21678 Kuniyuki Iwashima (2): gtp: Destroy device along with udp socket's netns dismantle. gtp: Suppress list corruption splat in gtp_net_exit_batch_rtnl(). drivers/net/gtp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS] HID: core: do not bypass hid_hw_raw_request
by Zhao Yipeng 25 Aug '25

25 Aug '25

From: Benjamin Tissoires <bentiss(a)kernel.org> mainline inclusion from mainline-v6.16-rc7 commit c2ca42f190b6714d6c481dfd3d9b62ea091c946b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICPD1S CVE: CVE-2025-38494 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- hid_hw_raw_request() is actually useful to ensure the provided buffer and length are valid. Directly calling in the low level transport driver function bypassed those checks and allowed invalid paramto be used. Reported-by: Alan Stern <stern(a)rowland.harvard.edu> Closes: https://lore.kernel.org/linux-input/c75433e0-9b47-4072-bbe8-b1d14ea97b13@ro… Cc: stable(a)vger.kernel.org Link: https://patch.msgid.link/20250710-report-size-null-v2-3-ccf922b7c4e5@kernel… Signed-off-by: Benjamin Tissoires <bentiss(a)kernel.org> Conflicts: drivers/hid/hid-core.c [The conflicts are contextual conflicts caused by the absence of the commit: 0d0777ccaa2d ("HID: core: ensure __hid_request reserves the report ID as the first byte").] Signed-off-by: Zhao Yipeng <zhaoyipeng5(a)huawei.com> --- drivers/hid/hid-core.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c index 7dd30deceda4..c0446ee3d4a0 100644 --- a/drivers/hid/hid-core.c +++ b/drivers/hid/hid-core.c @@ -1536,8 +1536,7 @@ void __hid_request(struct hid_device *hid, struct hid_report *report, if (reqtype == HID_REQ_SET_REPORT) hid_output_report(report, buf); - ret = hid->ll_driver->raw_request(hid, report->id, buf, len, - report->type, reqtype); + ret = hid_hw_raw_request(hid, report->id, buf, len, report->type, reqtype); if (ret < 0) { dbg_hid("unable to complete request: %d\n", ret); goto out; -- 2.34.1

2 1

[PATCH OLK-6.6 v2 0/5] Fix for bpf samples and selftests
by Pu Lehui 25 Aug '25

25 Aug '25

Pu Lehui (4): Revert "selftests/bpf: fix perf_event link info name_len assertion" Revert "selftests/bpf: Add cookies check for perf_event fill_link_info test" Revert "selftests/bpf: Use bpf_link__destroy in fill_link_info tests" samples/bpf: Move bpf_rvi_* progs to bpf_rvi directory Tyrone Wu (1): selftests/bpf: fix perf_event link info name_len assertion samples/bpf/Makefile | 4 -- .../{ => bpf_rvi}/bpf_rvi_cpu_online.bpf.c | 0 .../{ => bpf_rvi}/bpf_rvi_cpuinfo_arm64.bpf.c | 0 .../{ => bpf_rvi}/bpf_rvi_cpuinfo_x86.bpf.c | 0 .../bpf/{ => bpf_rvi}/bpf_rvi_diskstats.bpf.c | 0 .../bpf/{ => bpf_rvi}/bpf_rvi_loadavg.bpf.c | 0 .../bpf/{ => bpf_rvi}/bpf_rvi_meminfo.bpf.c | 0 .../{ => bpf_rvi}/bpf_rvi_partitions.bpf.c | 0 samples/bpf/{ => bpf_rvi}/bpf_rvi_stat.bpf.c | 0 samples/bpf/{ => bpf_rvi}/bpf_rvi_swaps.bpf.c | 0 .../bpf/{ => bpf_rvi}/bpf_rvi_uptime.bpf.c | 0 .../selftests/bpf/prog_tests/fill_link_info.c | 62 +++++++------------ 12 files changed, 22 insertions(+), 44 deletions(-) rename samples/bpf/{ => bpf_rvi}/bpf_rvi_cpu_online.bpf.c (100%) rename samples/bpf/{ => bpf_rvi}/bpf_rvi_cpuinfo_arm64.bpf.c (100%) rename samples/bpf/{ => bpf_rvi}/bpf_rvi_cpuinfo_x86.bpf.c (100%) rename samples/bpf/{ => bpf_rvi}/bpf_rvi_diskstats.bpf.c (100%) rename samples/bpf/{ => bpf_rvi}/bpf_rvi_loadavg.bpf.c (100%) rename samples/bpf/{ => bpf_rvi}/bpf_rvi_meminfo.bpf.c (100%) rename samples/bpf/{ => bpf_rvi}/bpf_rvi_partitions.bpf.c (100%) rename samples/bpf/{ => bpf_rvi}/bpf_rvi_stat.bpf.c (100%) rename samples/bpf/{ => bpf_rvi}/bpf_rvi_swaps.bpf.c (100%) rename samples/bpf/{ => bpf_rvi}/bpf_rvi_uptime.bpf.c (100%) -- 2.34.1

2 6

[PATCH OLK-6.6] media: cx231xx: set device_caps for 417
by Yi Yang 25 Aug '25

25 Aug '25

From: Hans Verkuil <hverkuil(a)xs4all.nl> stable inclusion from stable-v6.6.93 commit 5c9eca180a4235abd56cc7f7308ca72128d93dce category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICGAIX CVE: CVE-2025-38044 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a79efc44b51432490538a55b9753a721f7d3ea42 ] The video_device for the MPEG encoder did not set device_caps. Add this, otherwise the video device can't be registered (you get a WARN_ON instead). Not seen before since currently 417 support is disabled, but I found this while experimenting with it. Signed-off-by: Hans Verkuil <hverkuil(a)xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/media/usb/cx231xx/cx231xx-417.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/media/usb/cx231xx/cx231xx-417.c b/drivers/media/usb/cx231xx/cx231xx-417.c index c5e21785fafe..02343e88cc61 100644 --- a/drivers/media/usb/cx231xx/cx231xx-417.c +++ b/drivers/media/usb/cx231xx/cx231xx-417.c @@ -1722,6 +1722,8 @@ static void cx231xx_video_dev_init( vfd->lock = &dev->lock; vfd->release = video_device_release_empty; vfd->ctrl_handler = &dev->mpeg_ctrl_handler.hdl; + vfd->device_caps = V4L2_CAP_READWRITE | V4L2_CAP_STREAMING | + V4L2_CAP_VIDEO_CAPTURE; video_set_drvdata(vfd, dev); if (dev->tuner_type == TUNER_ABSENT) { v4l2_disable_ioctl(vfd, VIDIOC_G_FREQUENCY); -- 2.25.1

2 1

[PATCH OLK-6.6] dm cache: prevent BUG_ON by blocking retries on failed device resumes
by Yi Yang 25 Aug '25

25 Aug '25

From: Ming-Hung Tsai <mtsai(a)redhat.com> stable inclusion from stable-v6.6.93 commit 3986ef4a9b6a0d9c28bc325d8713beba5e67586f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICG5R7 CVE: CVE-2025-38066 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5da692e2262b8f81993baa9592f57d12c2703dea ] A cache device failing to resume due to mapping errors should not be retried, as the failure leaves a partially initialized policy object. Repeating the resume operation risks triggering BUG_ON when reloading cache mappings into the incomplete policy object. Reproduce steps: 1. create a cache metadata consisting of 512 or more cache blocks, with some mappings stored in the first array block of the mapping array. Here we use cache_restore v1.0 to build the metadata. cat <<EOF >> cmeta.xml <superblock uuid="" block_size="128" nr_cache_blocks="512" \ policy="smq" hint_width="4"> <mappings> <mapping cache_block="0" origin_block="0" dirty="false"/> </mappings> </superblock> EOF dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" cache_restore -i cmeta.xml -o /dev/mapper/cmeta --metadata-version=2 dmsetup remove cmeta 2. wipe the second array block of the mapping array to simulate data degradations. mapping_root=$(dd if=/dev/sdc bs=1c count=8 skip=192 \ 2>/dev/null | hexdump -e '1/8 "%u\n"') ablock=$(dd if=/dev/sdc bs=1c count=8 skip=$((4096*mapping_root+2056)) \ 2>/dev/null | hexdump -e '1/8 "%u\n"') dd if=/dev/zero of=/dev/sdc bs=4k count=1 seek=$ablock 3. try bringing up the cache device. The resume is expected to fail due to the broken array block. dmsetup create cmeta --table "0 8192 linear /dev/sdc 0" dmsetup create cdata --table "0 65536 linear /dev/sdc 8192" dmsetup create corig --table "0 524288 linear /dev/sdc 262144" dmsetup create cache --notable dmsetup load cache --table "0 524288 cache /dev/mapper/cmeta \ /dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0" dmsetup resume cache 4. try resuming the cache again. An unexpected BUG_ON is triggered while loading cache mappings. dmsetup resume cache Kernel logs: (snip) ------------[ cut here ]------------ kernel BUG at drivers/md/dm-cache-policy-smq.c:752! Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI CPU: 0 UID: 0 PID: 332 Comm: dmsetup Not tainted 6.13.4 #3 RIP: 0010:smq_load_mapping+0x3e5/0x570 Fix by disallowing resume operations for devices that failed the initial attempt. Signed-off-by: Ming-Hung Tsai <mtsai(a)redhat.com> Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/md/dm-cache-target.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c index c5851c9f7ec0..0d002d50329d 100644 --- a/drivers/md/dm-cache-target.c +++ b/drivers/md/dm-cache-target.c @@ -2903,6 +2903,27 @@ static dm_cblock_t get_cache_dev_size(struct cache *cache) return to_cblock(size); } +static bool can_resume(struct cache *cache) +{ + /* + * Disallow retrying the resume operation for devices that failed the + * first resume attempt, as the failure leaves the policy object partially + * initialized. Retrying could trigger BUG_ON when loading cache mappings + * into the incomplete policy object. + */ + if (cache->sized && !cache->loaded_mappings) { + if (get_cache_mode(cache) != CM_WRITE) + DMERR("%s: unable to resume a failed-loaded cache, please check metadata.", + cache_device_name(cache)); + else + DMERR("%s: unable to resume cache due to missing proper cache table reload", + cache_device_name(cache)); + return false; + } + + return true; +} + static bool can_resize(struct cache *cache, dm_cblock_t new_size) { if (from_cblock(new_size) > from_cblock(cache->cache_size)) { @@ -2951,6 +2972,9 @@ static int cache_preresume(struct dm_target *ti) struct cache *cache = ti->private; dm_cblock_t csize = get_cache_dev_size(cache); + if (!can_resume(cache)) + return -EINVAL; + /* * Check to see if the cache has resized. */ -- 2.25.1

2 1