- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10 v2 00/13] HiSock Redirect Framework
by Pu Lehui 01 Jul '25

01 Jul '25

HiSock Redirect Framework, which bypasses net filter rules for specific connections selected by bpf prog on both TX and RX directions. Julien Thierry (1): arm64: insn: Add some opcodes to instruction decoder Pu Lehui (11): bpf: Add CONFIG_HISOCK bpf: Add XDP_HISOCK_REDIRECT action bpf: Add BPF_PROG_TYPE_HISOCK prog type bpf: Add HISOCK_EGRESS hook on network egress path bpf: Add bpf_get_ingress_dst helper bpf: Add hisock_xdp_buff wrapper for xdp_buff bpf: Add bpf_set_ingress_dst helper bpf: Add bpf_change_skb_dev helper bpf: Add bpf_ext_memcpy helper openeuler_defconfig: Enable CONFIG_HISOCK samples/bpf: Add HiSock Redirect Framework sample Xu Kuohai (1): bpf, arm64: Fixup bpf_ext_memcpy extension helper arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/insn.h | 13 + arch/arm64/kernel/insn.c | 8 + arch/arm64/net/bpf_jit.h | 15 + arch/arm64/net/bpf_jit_comp.c | 266 ++++++++++++++++ arch/x86/configs/openeuler_defconfig | 1 + include/linux/bpf-cgroup.h | 35 +++ include/linux/bpf_types.h | 4 + include/linux/filter.h | 3 + include/net/xdp.h | 5 + include/uapi/linux/bpf.h | 45 +++ kernel/bpf/cgroup.c | 43 +++ kernel/bpf/core.c | 7 + kernel/bpf/helpers.c | 27 ++ kernel/bpf/syscall.c | 19 ++ kernel/bpf/verifier.c | 28 ++ net/Kconfig | 10 + net/core/dev.c | 74 ++++- net/core/filter.c | 184 +++++++++++ net/ipv4/ip_output.c | 66 ++++ samples/bpf/.gitignore | 1 + samples/bpf/Makefile | 3 + samples/bpf/hisock/bpf.c | 241 +++++++++++++++ samples/bpf/hisock/hisock_cmd.c | 405 +++++++++++++++++++++++++ tools/include/uapi/linux/bpf.h | 45 +++ tools/lib/bpf/libbpf.c | 2 + 26 files changed, 1548 insertions(+), 3 deletions(-) create mode 100644 samples/bpf/hisock/bpf.c create mode 100644 samples/bpf/hisock/hisock_cmd.c -- 2.34.1

2 14

[openeuler:openEuler-1.0-LTS 1605/1605] arch/x86/mm/pageattr.c:1787:5: warning: no previous prototype for function 'set_memory_global'
by kernel test robot 01 Jul '25

01 Jul '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 890108d01fde2c3b6dde4d169b695ce64362f135 commit: eac7073aa69aa1cac819aa712146284f53f642b1 [1605/1605] x86/mm/pti: Clear Global bit more aggressively config: x86_64-buildonly-randconfig-2001-20250501 (https://download.01.org/0day-ci/archive/20250701/202507011110.QFxtjmpf-lkp@…) compiler: clang version 20.1.2 (https://github.com/llvm/llvm-project 58df0ef89dd64126512e4ee27b4ac3fd8ddf6247) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250701/202507011110.QFxtjmpf-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202507011110.QFxtjmpf-lkp@intel.com/ All warnings (new ones prefixed by >>): arch/x86/mm/pageattr.c:170:6: warning: no previous prototype for function 'arch_invalidate_pmem' [-Wmissing-prototypes] 170 | void arch_invalidate_pmem(void *addr, size_t size) | ^ arch/x86/mm/pageattr.c:170:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 170 | void arch_invalidate_pmem(void *addr, size_t size) | ^ | static arch/x86/mm/pageattr.c:556:17: warning: variable 'old_pte' set but not used [-Wunused-but-set-variable] 556 | pte_t new_pte, old_pte, *tmp; | ^ arch/x86/mm/pageattr.c:1781:5: warning: no previous prototype for function 'set_memory_nonglobal' [-Wmissing-prototypes] 1781 | int set_memory_nonglobal(unsigned long addr, int numpages) | ^ arch/x86/mm/pageattr.c:1781:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1781 | int set_memory_nonglobal(unsigned long addr, int numpages) | ^ | static >> arch/x86/mm/pageattr.c:1787:5: warning: no previous prototype for function 'set_memory_global' [-Wmissing-prototypes] 1787 | int set_memory_global(unsigned long addr, int numpages) | ^ arch/x86/mm/pageattr.c:1787:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1787 | int set_memory_global(unsigned long addr, int numpages) | ^ | static 4 warnings generated. vim +/set_memory_global +1787 arch/x86/mm/pageattr.c 1786 > 1787 int set_memory_global(unsigned long addr, int numpages) 1788 { 1789 return change_page_attr_set(&addr, numpages, 1790 __pgprot(_PAGE_GLOBAL), 0); 1791 } 1792 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] wifi: mac80211: Don't finalize CSA in IBSS mode if state is disconnected
by Wang Liang 01 Jul '25

01 Jul '25

From: Siddh Raman Pant <code(a)siddh.me> stable inclusion from stable-v4.19.258 commit d9eb37db6a28b59a95a3461450ee209654c5f95b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICG9HM CVE: CVE-2022-49942 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 15bc8966b6d3a5b9bfe4c9facfa02f2b69b1e5f0 upstream. When we are not connected to a channel, sending channel "switch" announcement doesn't make any sense. The BSS list is empty in that case. This causes the for loop in cfg80211_get_bss() to be bypassed, so the function returns NULL (check line 1424 of net/wireless/scan.c), causing the WARN_ON() in ieee80211_ibss_csa_beacon() to get triggered (check line 500 of net/mac80211/ibss.c), which was consequently reported on the syzkaller dashboard. Thus, check if we have an existing connection before generating the CSA beacon in ieee80211_ibss_finish_csa(). Cc: stable(a)vger.kernel.org Fixes: cd7760e62c2a ("mac80211: add support for CSA in IBSS mode") Link: https://syzkaller.appspot.com/bug?id=05603ef4ae8926761b678d2939a3b2ad28ab9c… Reported-by: syzbot+b6c9fe29aefe68e4ad34(a)syzkaller.appspotmail.com Signed-off-by: Siddh Raman Pant <code(a)siddh.me> Tested-by: syzbot+b6c9fe29aefe68e4ad34(a)syzkaller.appspotmail.com Link: https://lore.kernel.org/r/20220814151512.9985-1-code@siddh.me Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/mac80211/ibss.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c index f0f5fedb8caa..480902335b44 100644 --- a/net/mac80211/ibss.c +++ b/net/mac80211/ibss.c @@ -544,6 +544,10 @@ int ieee80211_ibss_finish_csa(struct ieee80211_sub_if_data *sdata) sdata_assert_lock(sdata); + /* When not connected/joined, sending CSA doesn't make sense. */ + if (ifibss->state != IEEE80211_IBSS_MLME_JOINED) + return -ENOLINK; + /* update cfg80211 bss information with the new channel */ if (!is_zero_ether_addr(ifibss->bssid)) { cbss = cfg80211_get_bss(sdata->local->hw.wiphy, -- 2.34.1

2 1

[PATCH OLK-5.10 00/13] HiSock Redirect Framework
by Pu Lehui 01 Jul '25

01 Jul '25

Julien Thierry (1): arm64: insn: Add some opcodes to instruction decoder Pu Lehui (11): bpf: Add CONFIG_HISOCK bpf: Add XDP_HISOCK_REDIRECT action bpf: Add BPF_PROG_TYPE_HISOCK prog type bpf: Add HISOCK_EGRESS hook on network egress path bpf: Add bpf_get_ingress_dst helper bpf: Add hisock_xdp_buff wrapper for xdp_buff bpf: Add bpf_set_ingress_dst helper bpf: Add bpf_change_skb_dev helper bpf: Add bpf_ext_memcpy helper openeuler_defconfig: Enable CONFIG_HISOCK samples/bpf: Add HiSock Redirect Framework sample Xu Kuohai (1): bpf, arm64: Fixup bpf_ext_memcpy extension helper arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/insn.h | 13 + arch/arm64/kernel/insn.c | 8 + arch/arm64/net/bpf_jit.h | 15 + arch/arm64/net/bpf_jit_comp.c | 266 ++++++++++++++++ arch/x86/configs/openeuler_defconfig | 1 + include/linux/bpf-cgroup.h | 35 +++ include/linux/bpf_types.h | 4 + include/linux/filter.h | 3 + include/net/xdp.h | 5 + include/uapi/linux/bpf.h | 45 +++ kernel/bpf/cgroup.c | 43 +++ kernel/bpf/core.c | 7 + kernel/bpf/helpers.c | 27 ++ kernel/bpf/syscall.c | 19 ++ kernel/bpf/verifier.c | 28 ++ net/Kconfig | 10 + net/core/dev.c | 74 ++++- net/core/filter.c | 184 +++++++++++ net/ipv4/ip_output.c | 66 ++++ samples/bpf/.gitignore | 1 + samples/bpf/Makefile | 5 +- samples/bpf/hisock/bpf.c | 241 +++++++++++++++ samples/bpf/hisock/hisock_cmd.c | 405 +++++++++++++++++++++++++ tools/include/uapi/linux/bpf.h | 45 +++ tools/lib/bpf/libbpf.c | 2 + 26 files changed, 1549 insertions(+), 4 deletions(-) create mode 100644 samples/bpf/hisock/bpf.c create mode 100644 samples/bpf/hisock/hisock_cmd.c -- 2.34.1

2 14

[PATCH openEuler-1.0-LTS V1 0/2] hulk-4.19-fix-CVE-2022-49989
by Cheng Yu 01 Jul '25

01 Jul '25

hulk-4.19-fix-CVE-2022-49989 Juergen Gross (1): xen/privcmd: fix error exit of privcmd_ioctl_dm_op() Souptick Joarder (1): xen/privcmd: Corrected error handling path drivers/xen/privcmd.c | 42 +++++++++++++++++++++--------------------- 1 file changed, 21 insertions(+), 21 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10 v3 0/7] backport udp-4tuple-hash
by Liu Jian 01 Jul '25

01 Jul '25

backport udp-4tuple-hash Paolo Abeni (1): udp: fix l4 hash after reconnect Philo Lu (5): net/udp: Add a new struct for hash2 slot net/udp: Add 4-tuple hash list basis ipv4/udp: Add 4-tuple hash for connected socket ipv6/udp: Add 4-tuple hash for connected socket udp: Make rehash4 independent in udp_lib_rehash() Yue Haibing (1): inet6: Remove unused function declaration udpv6_connect() include/linux/udp.h | 12 ++ include/net/transp_v6.h | 2 - include/net/udp.h | 139 ++++++++++++++++++++++- net/ipv4/datagram.c | 8 +- net/ipv4/udp.c | 240 ++++++++++++++++++++++++++++++++++++---- net/ipv6/udp.c | 115 +++++++++++++++++-- 6 files changed, 475 insertions(+), 41 deletions(-) -- 2.34.1

2 8

[PATCH openEuler-1.0-LTS v3 0/7] backport udp-4tuple-hash
by Liu Jian 01 Jul '25

01 Jul '25

backport udp-4tuple-hash Paolo Abeni (1): udp: fix l4 hash after reconnect Philo Lu (5): net/udp: Add a new struct for hash2 slot net/udp: Add 4-tuple hash list basis ipv4/udp: Add 4-tuple hash for connected socket ipv6/udp: Add 4-tuple hash for connected socket udp: Make rehash4 independent in udp_lib_rehash() Yue Haibing (1): inet6: Remove unused function declaration udpv6_connect() include/linux/udp.h | 12 ++ include/net/transp_v6.h | 2 - include/net/udp.h | 139 +++++++++++++++++++++- net/ipv4/datagram.c | 8 +- net/ipv4/udp.c | 251 ++++++++++++++++++++++++++++++++++++---- net/ipv6/udp.c | 121 ++++++++++++++++--- 6 files changed, 484 insertions(+), 49 deletions(-) -- 2.34.1

2 8

[PATCH openEuler-1.0-LTS] mtd: maps: Fix refcount leak in ap_flash_init
by Yi Yang 01 Jul '25

01 Jul '25

From: Miaoqian Lin <linmq006(a)gmail.com> stable inclusion from stable-v4.19.256 commit d10855876a6f47add6ff621cef25cc0171dac162 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICGA0V CVE: CVE-2022-50160 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 77087a04c8fd554134bddcb8a9ff87b21f357926 ] of_find_matching_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak. Fixes: b0afd44bc192 ("mtd: physmap_of: add a hook for Versatile write protection") Signed-off-by: Miaoqian Lin <linmq006(a)gmail.com> Reviewed-by: Linus Walleij <linus.walleij(a)linaro.org> Signed-off-by: Miquel Raynal <miquel.raynal(a)bootlin.com> Link: https://lore.kernel.org/linux-mtd/20220523143255.4376-1-linmq006@gmail.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/mtd/maps/physmap_of_versatile.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/mtd/maps/physmap_of_versatile.c b/drivers/mtd/maps/physmap_of_versatile.c index 03f2b6e7bc7e..93cfe4071ea4 100644 --- a/drivers/mtd/maps/physmap_of_versatile.c +++ b/drivers/mtd/maps/physmap_of_versatile.c @@ -107,6 +107,7 @@ static int ap_flash_init(struct platform_device *pdev) return -ENODEV; } ebi_base = of_iomap(ebi, 0); + of_node_put(ebi); if (!ebi_base) return -ENODEV; -- 2.25.1

2 1

[PATCH OLK-5.10] nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu()
by Yi Yang 01 Jul '25

01 Jul '25

From: Maurizio Lombardi <mlombard(a)redhat.com> mainline inclusion from mainline-v6.14 commit ad95bab0cd28ed77c2c0d0b6e76e03e031391064 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBY43W CVE: CVE-2025-21927 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- nvme_tcp_recv_pdu() doesn't check the validity of the header length. When header digests are enabled, a target might send a packet with an invalid header length (e.g. 255), causing nvme_tcp_verify_hdgst() to access memory outside the allocated area and cause memory corruptions by overwriting it with the calculated digest. Fix this by rejecting packets with an unexpected header length. Fixes: 3f2304f8c6d6 ("nvme-tcp: add NVMe over TCP host driver") Signed-off-by: Maurizio Lombardi <mlombard(a)redhat.com> Reviewed-by: Sagi Grimberg <sagi(a)grimberg.me> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Conflicts: drivers/nvme/host/tcp.c [Confilcts dues to no backport of 363895767fbf("nvme-tcp: sanitize TLS key handling") and 84e009042d0f("nvme-tcp: add basic support for the C2HTermReq PDU")] Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/nvme/host/tcp.c | 32 +++++++++++++++++++++++++++++--- 1 file changed, 29 insertions(+), 3 deletions(-) diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c index 7be1da41081d..2ffb4df56d11 100644 --- a/drivers/nvme/host/tcp.c +++ b/drivers/nvme/host/tcp.c @@ -185,6 +185,19 @@ static inline int nvme_tcp_queue_id(struct nvme_tcp_queue *queue) return queue - queue->ctrl->queues; } +static inline bool nvme_tcp_recv_pdu_supported(enum nvme_tcp_pdu_type type) +{ + switch (type) { + case nvme_tcp_c2h_term: + case nvme_tcp_c2h_data: + case nvme_tcp_r2t: + case nvme_tcp_rsp: + return true; + default: + return false; + } +} + static inline struct blk_mq_tags *nvme_tcp_tagset(struct nvme_tcp_queue *queue) { u32 queue_idx = nvme_tcp_queue_id(queue); @@ -700,6 +713,16 @@ static int nvme_tcp_recv_pdu(struct nvme_tcp_queue *queue, struct sk_buff *skb, return 0; hdr = queue->pdu; + if (unlikely(hdr->hlen != sizeof(struct nvme_tcp_rsp_pdu))) { + if (!nvme_tcp_recv_pdu_supported(hdr->type)) + goto unsupported_pdu; + + dev_err(queue->ctrl->ctrl.device, + "pdu type %d has unexpected header length (%d)\n", + hdr->type, hdr->hlen); + return -EPROTO; + } + if (queue->hdr_digest) { ret = nvme_tcp_verify_hdgst(queue, queue->pdu, hdr->hlen); if (unlikely(ret)) @@ -723,10 +746,13 @@ static int nvme_tcp_recv_pdu(struct nvme_tcp_queue *queue, struct sk_buff *skb, nvme_tcp_init_recv_ctx(queue); return nvme_tcp_handle_r2t(queue, (void *)queue->pdu); default: - dev_err(queue->ctrl->ctrl.device, - "unsupported pdu type (%d)\n", hdr->type); - return -EINVAL; + goto unsupported_pdu; } + +unsupported_pdu: + dev_err(queue->ctrl->ctrl.device, + "unsupported pdu type (%d)\n", hdr->type); + return -EINVAL; } static inline void nvme_tcp_end_request(struct request *rq, u16 status) -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS V1] ALSA: bcd2000: Fix a UAF bug on the error path of probing
by Wang Tao 01 Jul '25

01 Jul '25

From: Zheyu Ma <zheyuma97(a)gmail.com> stable inclusion from stable-v4.19.256 commit 5e7338f4dd92b2f8915a82abfa1dd3ad3464bea0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICG792 CVE: CVE-2022-50229 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit ffb2759df7efbc00187bfd9d1072434a13a54139 upstream. When the driver fails in snd_card_register() at probe time, it will free the 'bcd2k->midi_out_urb' before killing it, which may cause a UAF bug. The following log can reveal it: [ 50.727020] BUG: KASAN: use-after-free in bcd2000_input_complete+0x1f1/0x2e0 [snd_bcd2000] [ 50.727623] Read of size 8 at addr ffff88810fab0e88 by task swapper/4/0 [ 50.729530] Call Trace: [ 50.732899] bcd2000_input_complete+0x1f1/0x2e0 [snd_bcd2000] Fix this by adding usb_kill_urb() before usb_free_urb(). Fixes: b47a22290d58 ("ALSA: MIDI driver for Behringer BCD2000 USB device") Signed-off-by: Zheyu Ma <zheyuma97(a)gmail.com> Cc: <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/20220715010515.2087925-1-zheyuma97@gmail.com Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Tao <wangtao554(a)huawei.com> --- sound/usb/bcd2000/bcd2000.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/sound/usb/bcd2000/bcd2000.c b/sound/usb/bcd2000/bcd2000.c index d6c8b29fe430..bdab5426aa17 100644 --- a/sound/usb/bcd2000/bcd2000.c +++ b/sound/usb/bcd2000/bcd2000.c @@ -357,7 +357,8 @@ static int bcd2000_init_midi(struct bcd2000 *bcd2k) static void bcd2000_free_usb_related_resources(struct bcd2000 *bcd2k, struct usb_interface *interface) { - /* usb_kill_urb not necessary, urb is aborted automatically */ + usb_kill_urb(bcd2k->midi_out_urb); + usb_kill_urb(bcd2k->midi_in_urb); usb_free_urb(bcd2k->midi_out_urb); usb_free_urb(bcd2k->midi_in_urb); -- 2.34.1

2 1