- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] dmaengine: idxd: Fix not releasing workqueue on .release()
by Yin Tirui 12 May '26

12 May '26

From: Vinicius Costa Gomes <vinicius.gomes(a)intel.com> mainline inclusion from mainline-v7.0-rc6 commit 3d33de353b1ff9023d5ec73b9becf80ea87af695 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14596 CVE: CVE-2026-43064 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- The workqueue associated with an DSA/IAA device is not released when the object is freed. Fixes: 47c16ac27d4c ("dmaengine: idxd: fix idxd conf_dev 'struct device' lifetime") Reviewed-by: Dave Jiang <dave.jiang(a)intel.com> Signed-off-by: Vinicius Costa Gomes <vinicius.gomes(a)intel.com> Link: https://patch.msgid.link/20260121-idxd-fix-flr-on-kernel-queues-v3-v3-7-7ed… Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Yin Tirui <yintirui(a)huawei.com> --- drivers/dma/idxd/sysfs.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/dma/idxd/sysfs.c b/drivers/dma/idxd/sysfs.c index f900976acf7e..c9e4d37a189f 100644 --- a/drivers/dma/idxd/sysfs.c +++ b/drivers/dma/idxd/sysfs.c @@ -1663,6 +1663,7 @@ static void idxd_conf_device_release(struct device *dev) { struct idxd_device *idxd = confdev_to_idxd(dev); + destroy_workqueue(idxd->wq); kfree(idxd->groups); bitmap_free(idxd->wq_enable_map); kfree(idxd->wqs); -- 2.43.0

2 1

[PATCH OLK-6.6] dmaengine: idxd: Fix not releasing workqueue on .release()
by Yin Tirui 12 May '26

12 May '26

From: Vinicius Costa Gomes <vinicius.gomes(a)intel.com> stable inclusion from stable-v6.6.131 commit 2bb9e9e93adff9cc8a138ae9a3a8d59b3452272e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14596 CVE: CVE-2026-43064 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3d33de353b1ff9023d5ec73b9becf80ea87af695 ] The workqueue associated with an DSA/IAA device is not released when the object is freed. Fixes: 47c16ac27d4c ("dmaengine: idxd: fix idxd conf_dev 'struct device' lifetime") Reviewed-by: Dave Jiang <dave.jiang(a)intel.com> Signed-off-by: Vinicius Costa Gomes <vinicius.gomes(a)intel.com> Link: https://patch.msgid.link/20260121-idxd-fix-flr-on-kernel-queues-v3-v3-7-7ed… Signed-off-by: Vinod Koul <vkoul(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yin Tirui <yintirui(a)huawei.com> --- drivers/dma/idxd/sysfs.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/dma/idxd/sysfs.c b/drivers/dma/idxd/sysfs.c index f706eae0e76b..154d754db339 100644 --- a/drivers/dma/idxd/sysfs.c +++ b/drivers/dma/idxd/sysfs.c @@ -1810,6 +1810,7 @@ static void idxd_conf_device_release(struct device *dev) { struct idxd_device *idxd = confdev_to_idxd(dev); + destroy_workqueue(idxd->wq); kfree(idxd->groups); bitmap_free(idxd->wq_enable_map); kfree(idxd->wqs); -- 2.43.0

2 1

[PATCH OLK-6.6 0/4] *** fix CVE-2026-31527 ***
by Lin Ruifeng 12 May '26

12 May '26

*** fix CVE-2026-31527 *** Danilo Krummrich (3): driver core: generalize driver_override in struct device hwmon: axi-fan: don't use driver_override as IRQ name driver core: platform: use generic driver_override infrastructure Lin Ruifeng (1): driver/core: Fix kabi broken of platform_device/bus_type/device drivers/base/bus.c | 43 ++++++++++++++++++++++- drivers/base/core.c | 2 ++ drivers/base/dd.c | 60 +++++++++++++++++++++++++++++++++ drivers/base/platform.c | 37 +++----------------- drivers/bus/simple-pm-bus.c | 4 +-- drivers/clk/imx/clk-scu.c | 3 +- drivers/hwmon/axi-fan-control.c | 2 +- drivers/slimbus/qcom-ngd-ctrl.c | 6 ++-- include/linux/device.h | 57 +++++++++++++++++++++++++++++++ include/linux/device/bus.h | 5 ++- include/linux/platform_device.h | 7 ++-- sound/soc/samsung/i2s.c | 6 ++-- 12 files changed, 181 insertions(+), 51 deletions(-) -- 2.43.0

2 5

[PATCH OLK-5.10 0/4] *** fix CVE-2026-31527 ***
by Lin Ruifeng 12 May '26

12 May '26

*** fix CVE-2026-31527 *** Danilo Krummrich (3): driver core: generalize driver_override in struct device hwmon: axi-fan: don't use driver_override as IRQ name driver core: platform: use generic driver_override infrastructure Lin Ruifeng (1): driver/core: Fix kabi broken of platform_device/device/bus_type drivers/base/bus.c | 49 +++++++++++++++++++++++- drivers/base/core.c | 2 + drivers/base/dd.c | 60 ++++++++++++++++++++++++++++++ drivers/base/platform.c | 57 +++------------------------- drivers/hwmon/axi-fan-control.c | 2 +- drivers/slimbus/qcom-ngd-ctrl.c | 12 +++++- include/linux/device.h | 66 +++++++++++++++++++++++++++++++++ include/linux/device/bus.h | 4 ++ include/linux/platform_device.h | 3 +- sound/soc/samsung/i2s.c | 6 ++- 10 files changed, 204 insertions(+), 57 deletions(-) -- 2.43.0

2 5

[PATCH openEuler-1.0-LTS 0/3] *** fix CVE-2026-31527 ***
by Lin Ruifeng 12 May '26

12 May '26

*** fix CVE-2026-31527 *** Danilo Krummrich (2): driver core: generalize driver_override in struct device driver core: platform: use generic driver_override infrastructure Lin Ruifeng (1): driver/core: Fix kabi broken of platform_device/device/bus_type drivers/base/bus.c | 49 +++++++++++++++++++++- drivers/base/core.c | 3 ++ drivers/base/dd.c | 61 ++++++++++++++++++++++++++++ drivers/base/platform.c | 57 +++----------------------- drivers/slimbus/qcom-ngd-ctrl.c | 12 +++++- include/linux/device.h | 72 +++++++++++++++++++++++++++++++++ include/linux/platform_device.h | 7 +++- 7 files changed, 206 insertions(+), 55 deletions(-) -- 2.43.0

2 4

[PATCH OLK-6.6 0/2] Fix CVE-2026-31486
by Yin Tirui 12 May '26

12 May '26

Fix CVE-2026-31486 Guenter Roeck (1): hwmon: (pmbus/core) Declare regulator notification function as void Yin Tirui (1): hwmon: (pmbus/core) Protect regulator operations with mutex drivers/hwmon/pmbus/pmbus_core.c | 121 +++++++++++++++++++++++-------- 1 file changed, 92 insertions(+), 29 deletions(-) -- 2.43.0

2 3

[PATCH OLK-6.6 0/4] *** fix CVE-2026-31527 ***
by Lin Ruifeng 12 May '26

12 May '26

*** fix CVE-2026-31527 *** Danilo Krummrich (3): driver core: generalize driver_override in struct device hwmon: axi-fan: don't use driver_override as IRQ name driver core: platform: use generic driver_override infrastructure Lin Ruifeng (1): driver/core: Fix kabi broken of platform_device/bus_type/device drivers/base/bus.c | 43 ++++++++++++++++++++++- drivers/base/core.c | 2 ++ drivers/base/dd.c | 60 +++++++++++++++++++++++++++++++++ drivers/base/platform.c | 37 +++----------------- drivers/bus/simple-pm-bus.c | 4 +-- drivers/clk/imx/clk-scu.c | 3 +- drivers/hwmon/axi-fan-control.c | 2 +- drivers/slimbus/qcom-ngd-ctrl.c | 6 ++-- include/linux/device.h | 57 +++++++++++++++++++++++++++++++ include/linux/device/bus.h | 5 ++- include/linux/platform_device.h | 7 ++-- sound/soc/samsung/i2s.c | 6 ++-- 12 files changed, 181 insertions(+), 51 deletions(-) -- 2.43.0

2 5

[PATCH OLK-5.10] fbdev: Fix vmalloc out-of-bounds write in fast_imageblit
by Jiacheng Yu 12 May '26

12 May '26

From: Sravan Kumar Gundu <sravankumarlpu(a)gmail.com> mainline inclusion from mainline-v6.17-rc1 commit af0db3c1f898144846d4c172531a199bb3ca375d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/9085 CVE: CVE-2025-38685 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- This issue triggers when a userspace program does an ioctl FBIOPUT_CON2FBMAP by passing console number and frame buffer number. Ideally this maps console to frame buffer and updates the screen if console is visible. As part of mapping it has to do resize of console according to frame buffer info. if this resize fails and returns from vc_do_resize() and continues further. At this point console and new frame buffer are mapped and sets display vars. Despite failure still it continue to proceed updating the screen at later stages where vc_data is related to previous frame buffer and frame buffer info and display vars are mapped to new frame buffer and eventully leading to out-of-bounds write in fast_imageblit(). This bheviour is excepted only when fg_console is equal to requested console which is a visible console and updates screen with invalid struct references in fbcon_putcs(). Reported-and-tested-by: syzbot+c4b7aa0513823e2ea880(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=c4b7aa0513823e2ea880 Signed-off-by: Sravan Kumar Gundu <sravankumarlpu(a)gmail.com> Cc: stable(a)vger.kernel.org Signed-off-by: Helge Deller <deller(a)gmx.de> Conflicts: drivers/video/fbdev/core/fbcon.c [Context conflicts.] Signed-off-by: Jiacheng Yu <yujiacheng3(a)huawei.com> --- drivers/video/fbdev/core/fbcon.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c index 3aaf0053c9fc9..d0a11b7543b64 100644 --- a/drivers/video/fbdev/core/fbcon.c +++ b/drivers/video/fbdev/core/fbcon.c @@ -827,7 +827,8 @@ static void con2fb_init_display(struct vc_data *vc, struct fb_info *info, fg_vc->vc_rows); } - update_screen(vc_cons[fg_console].d); + if (fg_console != unit) + update_screen(vc_cons[fg_console].d); } /** @@ -1366,6 +1367,7 @@ static void fbcon_set_disp(struct fb_info *info, struct fb_var_screeninfo *var, struct vc_data *svc; struct fbcon_ops *ops = info->fbcon_par; int rows, cols, charcnt = 256; + int ret = 0; p = &fb_display[unit]; @@ -1417,11 +1419,10 @@ static void fbcon_set_disp(struct fb_info *info, struct fb_var_screeninfo *var, rows = FBCON_SWAP(ops->rotate, info->var.yres, info->var.xres); cols /= vc->vc_font.width; rows /= vc->vc_font.height; - vc_resize(vc, cols, rows); + ret = vc_resize(vc, cols, rows); - if (con_is_visible(vc)) { + if (con_is_visible(vc) && !ret) update_screen(vc); - } } static __inline__ void ywrap_up(struct vc_data *vc, int count) -- 2.43.0

2 1

[PATCH OLK-5.10 0/4] *** fix CVE-2026-31527 ***
by Lin Ruifeng 12 May '26

12 May '26

*** fix CVE-2026-31527 *** Danilo Krummrich (3): driver core: generalize driver_override in struct device hwmon: axi-fan: don't use driver_override as IRQ name driver core: platform: use generic driver_override infrastructure Lin Ruifeng (1): driver/core: Fix kabi broken of platform_device/device/bus_type drivers/base/bus.c | 49 +++++++++++++++++++++++- drivers/base/core.c | 2 + drivers/base/dd.c | 60 ++++++++++++++++++++++++++++++ drivers/base/platform.c | 57 +++------------------------- drivers/hwmon/axi-fan-control.c | 2 +- drivers/slimbus/qcom-ngd-ctrl.c | 12 +++++- include/linux/device.h | 66 +++++++++++++++++++++++++++++++++ include/linux/device/bus.h | 4 ++ include/linux/platform_device.h | 3 +- sound/soc/samsung/i2s.c | 6 ++- 10 files changed, 204 insertions(+), 57 deletions(-) -- 2.43.0

2 5

[PATCH OLK-5.10 0/2] Fix CVE-2026-43409
by Tengda Wu 12 May '26

12 May '26

Fix CVE-2026-43409. Masami Hiramatsu (Google) (1): kprobes: avoid crash when rmmod/insmod after ftrace killed Stephen Brennan (1): kprobe/ftrace: bail out if ftrace was killed arch/csky/kernel/probes/ftrace.c | 3 +++ arch/parisc/kernel/ftrace.c | 3 +++ arch/powerpc/kernel/kprobes-ftrace.c | 3 +++ arch/s390/kernel/ftrace.c | 3 +++ arch/sw_64/kernel/kprobes/kprobes-ftrace.c | 3 +++ arch/x86/kernel/kprobes/ftrace.c | 3 +++ include/linux/kprobes.h | 8 ++++++++ kernel/kprobes.c | 11 +++++++++++ kernel/trace/ftrace.c | 1 + 9 files changed, 38 insertions(+) -- 2.34.1

2 3