- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 0/1] CVE-2026-72397
by Yongqiang Liu 07 Sep '26

07 Sep '26

Abdurrahman Hussain (1): hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid() drivers/hwmon/pmbus/pmbus_core.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) -- 2.43.0

2 2

[PATCH OLK-6.6 0/1] CVE-2026-72397
by Yongqiang Liu 07 Sep '26

07 Sep '26

Abdurrahman Hussain (1): hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid() drivers/hwmon/pmbus/pmbus_core.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) -- 2.43.0

2 2

[PATCH OLK-5.10 0/1] CVE-2026-72397
by Yongqiang Liu 07 Sep '26

07 Sep '26

Abdurrahman Hussain (1): hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid() drivers/hwmon/pmbus/pmbus_core.c | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) -- 2.43.0

2 2

[PATCH OLK-6.6 0/9] nbd: boost nbd setup
by Yang Erkun 07 Sep '26

07 Sep '26

Drop local patchset, using mainline pathset to do the same thing. Yang Erkun (9): Revert "nbd: remove queue freeze in nbd_add_socket" Revert "nbd: remove redundant num_connections boundary checks" Revert "nbd: replace socks pointer array with xarray" Revert "nbd: simplify find_fallback() by removing redundant logic" nbd: disallow NBD_SET_SOCK on an active device nbd: remove queue freeze in nbd_add_socket nbd: factor out a nbd_genl_foreach_sock nbd: remove queue freeze for newly created nbd from netlink path nbd: add pre_defined_connections module parameter for pre-created devices drivers/block/nbd.c | 350 ++++++++++++++++++++++---------------------- 1 file changed, 176 insertions(+), 174 deletions(-) -- 2.52.0

2 10

[PATCH OLK-6.6 00/16] backport minios part4 patches from linux mainline
by Qinxin Xia 07 Sep '26

07 Sep '26

From: Hongye Lin <linhongye(a)h-partners.com> mainline inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/8904 ---------------------------------------------------------------------- backport minios part4 patches from linux mainline Mark Brown (6): arm64/sysreg: Update HCRX_EL2 definition for DDI0601 2023-09 arm64/fpsimd: Enable host kernel access to FPMR arm64/fpsimd: Support FEAT_FPMR arm64/signal: Add FPMR signal handling arm64/ptrace: Expose FPMR via ptrace arm64/fpsimd: Don't corrupt FPMR when streaming mode changes Mark Rutland (7): arm64: ptrace: fix partial SETREGSET for NT_ARM_FPMR arm64/fpsimd: Add fpsimd_save_and_flush_current_state() arm64/fpsimd: Reset FPMR upon exec() arm64/fpsimd: signal32: Always save+flush state early arm64/fpsimd: signal: Always save+flush state early arm64/fpsimd: Avoid warning when sve_to_fpsimd() is unused arm64/fpsimd: Do not discard modified SVE state Qinxin Xia (1): Add support "arm64.nocnp" for start option arch/arm64/include/asm/cpufeature.h | 6 ++ arch/arm64/include/asm/el2_setup.h | 2 +- arch/arm64/include/asm/fpsimd.h | 7 +- arch/arm64/include/asm/kvm_arm.h | 1 - arch/arm64/include/asm/kvm_host.h | 1 + arch/arm64/include/asm/processor.h | 4 + arch/arm64/include/asm/signal_common.h | 20 ++++- arch/arm64/include/uapi/asm/sigcontext.h | 8 ++ arch/arm64/kernel/cpufeature.c | 13 ++- arch/arm64/kernel/entry-common.c | 50 ++++++++--- arch/arm64/kernel/fpsimd.c | 74 ++++++++-------- arch/arm64/kernel/idreg-override.c | 11 +++ arch/arm64/kernel/ptrace.c | 44 ++++++++++ arch/arm64/kernel/signal.c | 103 ++++++++++++----------- arch/arm64/kernel/signal32.c | 11 ++- arch/arm64/kvm/fpsimd.c | 1 + arch/arm64/kvm/hyp/include/hyp/switch.h | 13 ++- arch/arm64/tools/cpucaps | 2 +- arch/arm64/tools/sysreg | 4 +- include/uapi/linux/elf.h | 1 + 20 files changed, 259 insertions(+), 117 deletions(-) -- 2.33.0

2 17

[PATCH OLK-6.6] net/mlx5: LAG, Fix off-by-one in single-FDB error rollback
by Yi Yang 07 Sep '26

07 Sep '26

From: Shay Drory <shayd(a)nvidia.com> mainline inclusion from mainline-v7.2-rc3 commit 0f0e4ae6975c773f7854fc48932a267f6c79088f category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17727 CVE: CVE-2026-72345 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- On failure at index i, the reverse cleanup loop in mlx5_lag_create_single_fdb() starts from i, so the failed index itself is rolled back. That can operate on uninitialized state or double-tear-down a rule the add_one path already self-rolled-back. Start the rollback from i - 1 so only successfully-installed entries are undone. Fixes: ddbb5ddc43ad ("net/mlx5: LAG, Refactor lag logic") Signed-off-by: Shay Drory <shayd(a)nvidia.com> Reviewed-by: Mark Bloch <mbloch(a)nvidia.com> Signed-off-by: Tariq Toukan <tariqt(a)nvidia.com> Link: https://patch.msgid.link/20260630112917.698313-2-tariqt@nvidia.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Conflicts: drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c [Commit 3b8b364f97f40 which factored shared FDB code into shared_fdb.c is not present in this tree; mlx5_lag_create_single_fdb() still lives in lag.c. Apply the same off-by-one rollback fix there by starting the reverse cleanup at i-1 instead of i.] Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c b/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c index f6b1ac80c0af..96b1eb0ec72d 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c @@ -570,7 +570,7 @@ static int mlx5_lag_create_single_fdb(struct mlx5_lag *ldev) } return 0; err: - for (; i > MLX5_LAG_P1; i--) + for (i--; i > MLX5_LAG_P1; i--) mlx5_eswitch_offloads_single_fdb_del_one(master_esw, ldev->pf[i].dev->priv.eswitch); return err; -- 2.25.1

2 1

[PATCH OLK-6.6] ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD
by Lu Chentao 07 Sep '26

07 Sep '26

mainline inclusion from mainline-v7.2-rc2 commit 462775c620197adaabc983ce847e5b9878ff4cb0 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17314 CVE: CVE-2026-72031 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The PNY CS900 1TB SSD (Phison PS3111-S11, DRAM-less) drops off the bus after entering Device-Initiated Slumber during idle. With the default med_power_with_dipm policy the link goes down (SStatus 1 SControl 300) and does not recover, forcing the filesystem read-only. Forcing max_performance keeps the link stable across prolonged idle. Add a NOLPM quirk so link power management is disabled for this drive specifically, leaving it intact for other devices on the host. Cc: stable(a)vger.kernel.org Signed-off-by: Bryam Vargas <hexlabsecurity(a)proton.me> Reviewed-by: Niklas Cassel <cassel(a)kernel.org> Signed-off-by: Damien Le Moal <dlemoal(a)kernel.org> Conflicts: drivers/ata/libata-core.c [5.10 didn't introduce __ata_dev_quirks and ATA_QUIRK_NOLPM, adapted with ATA_HORKAGE_NOLPM] Signed-off-by: Lu Chentao <luchentao1(a)huawei.com> --- drivers/ata/libata-core.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c index 0aac030532c3..9110e9b50b80 100644 --- a/drivers/ata/libata-core.c +++ b/drivers/ata/libata-core.c @@ -4232,10 +4232,13 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { ATA_HORKAGE_NOLPM }, { "Crucial_CT960M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | ATA_HORKAGE_ZERO_AFTER_TRIM | ATA_HORKAGE_NOLPM }, + /* PNY CS900 (Phison PS3111-S11, DRAM-less) drops the link on DIPM */ + { "PNY CS900 1TB SSD", NULL, ATA_HORKAGE_NOLPM }, + /* These specific Samsung models/firmware-revs do not handle LPM well */ { "SAMSUNG MZMPC128HBFU-000MV", "CXM14M1Q", ATA_HORKAGE_NOLPM }, { "SAMSUNG SSD PM830 mSATA *", "CXM13D1Q", ATA_HORKAGE_NOLPM }, { "SAMSUNG MZ7TD256HAFV-000L9", NULL, ATA_HORKAGE_NOLPM }, { "SAMSUNG MZ7TE512HMHP-000L1", "EXT06L0Q", ATA_HORKAGE_NOLPM }, -- 2.52.0

2 1

[PATCH OLK-6.6] ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD
by Lu Chentao 07 Sep '26

07 Sep '26

mainline inclusion from mainline-v7.2-rc2 commit 462775c620197adaabc983ce847e5b9878ff4cb0 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17314 CVE: CVE-2026-72031 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The PNY CS900 1TB SSD (Phison PS3111-S11, DRAM-less) drops off the bus after entering Device-Initiated Slumber during idle. With the default med_power_with_dipm policy the link goes down (SStatus 1 SControl 300) and does not recover, forcing the filesystem read-only. Forcing max_performance keeps the link stable across prolonged idle. Add a NOLPM quirk so link power management is disabled for this drive specifically, leaving it intact for other devices on the host. Cc: stable(a)vger.kernel.org Signed-off-by: Bryam Vargas <hexlabsecurity(a)proton.me> Reviewed-by: Niklas Cassel <cassel(a)kernel.org> Signed-off-by: Damien Le Moal <dlemoal(a)kernel.org> Conflicts: drivers/ata/libata-core.c [5.10 didn't introduce __ata_dev_quirks and ATA_QUIRK_NOLPM, adapted with ATA_HORKAGE_NOLPM] Signed-off-by: Lu Chentao <luchentao1(a)huawei.com> --- drivers/ata/libata-core.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c index 0aac030532c3..9110e9b50b80 100644 --- a/drivers/ata/libata-core.c +++ b/drivers/ata/libata-core.c @@ -4232,10 +4232,13 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { ATA_HORKAGE_NOLPM }, { "Crucial_CT960M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | ATA_HORKAGE_ZERO_AFTER_TRIM | ATA_HORKAGE_NOLPM }, + /* PNY CS900 (Phison PS3111-S11, DRAM-less) drops the link on DIPM */ + { "PNY CS900 1TB SSD", NULL, ATA_HORKAGE_NOLPM }, + /* These specific Samsung models/firmware-revs do not handle LPM well */ { "SAMSUNG MZMPC128HBFU-000MV", "CXM14M1Q", ATA_HORKAGE_NOLPM }, { "SAMSUNG SSD PM830 mSATA *", "CXM13D1Q", ATA_HORKAGE_NOLPM }, { "SAMSUNG MZ7TD256HAFV-000L9", NULL, ATA_HORKAGE_NOLPM }, { "SAMSUNG MZ7TE512HMHP-000L1", "EXT06L0Q", ATA_HORKAGE_NOLPM }, -- 2.52.0

2 1

[PATCH OLK-5.10] ocfs2: validate fast symlink target during inode read
by Lai Zewei 07 Sep '26

07 Sep '26

mainline inclusion from mainline-v7.2-rc1 commit e234973f286ed2e8961a24561ec91594ec3e3ff8 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18148 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ocfs2_validate_inode_block() already rejects several inconsistent self-contained dinodes before they are exposed to the rest of the filesystem. Fast symlinks need the same treatment. A zero-cluster symlink is treated as a fast symlink and later read through page_get_link() and ocfs2_fast_symlink_read_folio(). That path uses strnlen() on the inline payload and then copies len + 1 bytes into the folio. If a corrupt dinode stores an i_size that does not fit the inline area or omits the terminating NUL at i_size, that copy reads past the end of the inode block buffer. Reject zero-cluster symlink dinodes whose i_size exceeds the inline fast-symlink capacity or whose inline payload is not NUL-terminated exactly at i_size when the inode block is validated. This keeps malformed fast symlinks from reaching the read path. Validation reproduced this kernel report: KASAN use-after-free in ocfs2_fast_symlink_read_folio+0x12c/0x1f0 RIP: 0033:0x7f5c6d859aa7 Read of size 3905 Call trace: dump_stack_lvl+0x66/0xa0 (?:?) print_report+0xce/0x630 (?:?) ocfs2_fast_symlink_read_folio+0x12c/0x1f0 (fs/ocfs2/inode.c:?) srso_alias_return_thunk+0x5/0xfbef5 (?:?) __virt_addr_valid+0x19f/0x330 (?:?) kasan_report+0xe0/0x110 (?:?) kasan_check_range+0x105/0x1b0 (?:?) __asan_memcpy+0x23/0x60 (?:?) filemap_read_folio+0x27/0xe0 (?:?) filemap_read_folio+0x35/0xe0 (?:?) do_read_cache_folio+0x138/0x230 (?:?) __page_get_link+0x26/0x110 (?:?) page_get_link+0x2e/0x70 (?:?) vfs_readlink+0x15e/0x250 (?:?) touch_atime+0x4d/0x370 (?:?) do_readlinkat+0x186/0x200 (?:?) do_user_addr_fault+0x65a/0x890 (?:?) __x64_sys_readlink+0x46/0x60 (?:?) do_syscall_64+0x115/0x6a0 (arch/x86/entry/syscall_64.c:87) entry_SYSCALL_64_after_hwframe+0x77/0x7f (?:?) Link: https://lore.kernel.org/20260528151230.361127-1-rollkingzzc@gmail.com Fixes: ea022dfb3c2a ("ocfs: simplify symlink handling") Signed-off-by: Zhang Cen <rollkingzzc(a)gmail.com> Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Cc: Gui-Dong Han <2045gemini(a)gmail.com> Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Jun Piao <piaojun(a)huawei.com> Cc: Heming Zhao <heming.zhao(a)suse.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: fs/ocfs2/inode.c [ctx conflicts] Signed-off-by: Lai Zewei <laizewei3(a)huawei.com> --- fs/ocfs2/inode.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/fs/ocfs2/inode.c b/fs/ocfs2/inode.c index 7c9dfd50c1c1..e5fa0070016f 100644 --- a/fs/ocfs2/inode.c +++ b/fs/ocfs2/inode.c @@ -1418,6 +1418,29 @@ int ocfs2_validate_inode_block(struct super_block *sb, goto bail; } + if (S_ISLNK(le16_to_cpu(di->i_mode)) && + !le32_to_cpu(di->i_clusters)) { + int max_inline = ocfs2_fast_symlink_chars(sb); + u64 i_size = le64_to_cpu(di->i_size); + + if (i_size >= max_inline) { + rc = ocfs2_error(sb, + "Invalid dinode #%llu: fast symlink i_size %llu exceeds max %d\n", + (unsigned long long)bh->b_blocknr, + (unsigned long long)i_size, + max_inline - 1); + goto bail; + } + + if (strnlen((char *)di->id2.i_symlink, i_size + 1) != i_size) { + rc = ocfs2_error(sb, + "Invalid dinode #%llu: fast symlink is not NUL-terminated at i_size %llu\n", + (unsigned long long)bh->b_blocknr, + (unsigned long long)i_size); + goto bail; + } + } + rc = 0; bail: -- 2.52.0

2 1

[PATCH OLK-5.10] wifi: mac80211: validate extension-frame layout before RX
by Gaosheng Cui 07 Sep '26

07 Sep '26

From: Zhao Li <enderaoelyther(a)gmail.com> mainline inclusion from mainline-v7.2-rc4 commit 57d503ce32eccfa7650065ca4c560f7e29a2e676 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17512 CVE: CVE-2026-68470 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Extension frames only have the extension header at the regular 802.11 header offset. The generic RX path can still reach helpers and interface dispatch code that read regular header address fields before unsupported extension subtypes are dropped. mac80211 currently only handles S1G beacon extension frames. Drop other extension subtypes before they can reach regular-header RX processing. For S1G beacons, linearize the SKB with the management-frame path and require the fixed S1G beacon header, including optional fixed fields indicated by frame control, before generic RX dispatch. Route S1G beacons through the station/default-link RX path without regular-header station lookup. Avoid regular-header address reads in the mac80211 RX paths that process S1G extension beacons, including accept-frame, duplicate-detection, address-copy, and MLO address-translation paths. Also make ieee80211_get_bssid() length-safe before returning the S1G source-address pointer. Fixes: 09a740ce352e ("mac80211: receive and process S1G beacons") Cc: stable(a)vger.kernel.org Signed-off-by: Zhao Li <enderaoelyther(a)gmail.com> Link: https://patch.msgid.link/20260611161943.91069-5-enderaoelyther@gmail.com Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Conflicts: net/mac80211/rx.c [Commit 57d503ce32ec built the S1G-beacon handling on top of ieee80211_rx_for_interface() and ieee80211_s1g_optional_len(), which do not exist in this tree (no include/linux/ieee80211-s1g.h). The equivalent logic is inlined into __ieee80211_rx_handle_packet(): S1G beacons are dispatched with a NULL sta (skipping the regular-header addr2 station lookup), and the optional-header length check is expressed with the existing ieee80211_next_tbtt_present(). ieee80211_prepare_and_rx_handle() needs no S1G shortcut because this tree does not have the SW-crypto/MLO address-copy paths.] Co-authored-by: BackportAgent@deepseek-v4-flash Signed-off-by: Hulk Robot <hulkrobot(a)huawei.com> Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- net/mac80211/rx.c | 30 ++++++++++++++++++++++++++---- net/mac80211/util.c | 3 +++ 2 files changed, 29 insertions(+), 4 deletions(-) diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c index 65fea564c9c0..ba25540c4013 100644 --- a/net/mac80211/rx.c +++ b/net/mac80211/rx.c @@ -1429,6 +1429,9 @@ ieee80211_rx_h_check_dup(struct ieee80211_rx_data *rx) if (status->flag & RX_FLAG_DUP_VALIDATED) return RX_CONTINUE; + if (ieee80211_is_ext(hdr->frame_control)) + return RX_CONTINUE; + /* * Drop duplicate 802.11 retransmissions * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery") @@ -4051,8 +4054,12 @@ static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx) struct ieee80211_hdr *hdr = (void *)skb->data; struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); u8 *bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type); - bool multicast = is_multicast_ether_addr(hdr->addr1) || - ieee80211_is_s1g_beacon(hdr->frame_control); + bool multicast; + + if (ieee80211_is_s1g_beacon(hdr->frame_control)) + return sdata->vif.type == NL80211_IFTYPE_STATION && bssid; + + multicast = is_multicast_ether_addr(hdr->addr1); switch (sdata->vif.type) { case NL80211_IFTYPE_STATION: @@ -4639,6 +4646,19 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw, err = -ENOBUFS; else err = skb_linearize(skb); + } else if (ieee80211_is_s1g_beacon(fc)) { + size_t s1g_hdr_len = offsetof(struct ieee80211_ext, + u.s1g_beacon.variable); + + if (ieee80211_next_tbtt_present(fc)) + s1g_hdr_len += 3; + + if (skb->len < s1g_hdr_len) + err = -ENOBUFS; + else + err = skb_linearize(skb); + } else if (ieee80211_is_ext(fc)) { + err = -EINVAL; } else { err = !pskb_may_pull(skb, ieee80211_hdrlen(fc)); } @@ -4714,7 +4734,8 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw, continue; } - rx.sta = sta_info_get_bss(prev, hdr->addr2); + rx.sta = ieee80211_is_s1g_beacon(hdr->frame_control) ? + NULL : sta_info_get_bss(prev, hdr->addr2); rx.sdata = prev; ieee80211_prepare_and_rx_handle(&rx, skb, false); @@ -4722,7 +4743,8 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw, } if (prev) { - rx.sta = sta_info_get_bss(prev, hdr->addr2); + rx.sta = ieee80211_is_s1g_beacon(hdr->frame_control) ? + NULL : sta_info_get_bss(prev, hdr->addr2); rx.sdata = prev; if (ieee80211_prepare_and_rx_handle(&rx, skb, true)) diff --git a/net/mac80211/util.c b/net/mac80211/util.c index e49355cbb1ce..8e27e191945d 100644 --- a/net/mac80211/util.c +++ b/net/mac80211/util.c @@ -67,6 +67,9 @@ u8 *ieee80211_get_bssid(struct ieee80211_hdr *hdr, size_t len, if (ieee80211_is_s1g_beacon(fc)) { struct ieee80211_ext *ext = (void *) hdr; + if (len < offsetofend(struct ieee80211_ext, u.s1g_beacon.sa)) + return NULL; + return ext->u.s1g_beacon.sa; } -- 2.43.0

2 1

[PATCH OLK-6.6 00/24] arm64: support BBML2 noabort feature
by Jinjiang Tu 07 Sep '26

07 Sep '26

Anshuman Khandual (1): arm64/mm: Rename pte_mkpresent() as pte_mkvalid() Ard Biesheuvel (1): arm64: Avoid enabling KPTI unnecessarily Catalin Marinas (1): arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type Dev Jain (2): arm64: Enable permission change on arm64 kernel block mappings arm64/pageattr: Propagate return value from __change_memory_common Jeremy Linton (1): arm64: cpufeature: Display the set of cores with a feature Jinjiang Tu (1): arm64: cpufeature: add HISI_HIP13 to BBML2 allow list Kevin Brodsky (1): arm64: mm: Simplify check in arch_kfence_init_pool() Linu Cherian (3): arm64: sysreg: Add BBM_3 arm64: cpufeature: Rename BBML2_NOABORT as BBML3 arm64: cpufeature: Detect BBML3 based on ID_AA64MMFR2_EL1.BBM Lorenzo Stoakes (1): mm/pagewalk: split walk_page_range_novma() into kernel/user parts Mark Rutland (1): arm64: Split kpti_install_ng_mappings() Mikołaj Lenczewski (2): arm64: Add BBM Level 2 cpu feature arm64/mm: Elide tlbi in contpte_convert() under BBML2 Muchun Song (1): mm: pagewalk: assert write mmap lock only for walking the user page tables Ryan Roberts (7): arm64: mm: split linear mapping if BBML2 unsupported on secondary CPUs arm64: mm: Don't sleep in split_kernel_leaf_mapping() when in atomic context arm64: mm: Optimize range_split_to_ptes() arm64: mm: Tidy up force_pte_mapping() arm64: mm: Fix rodata=full block mapping support for realm guests arm64/mm: generalize PMD_PRESENT_INVALID for all levels arm64: mm: Handle invalid large leaf mappings correctly Yang Shi (1): arm64: mm: support large block mapping when rodata=full arch/arm64/include/asm/cpufeature.h | 32 ++ arch/arm64/include/asm/kfence.h | 3 +- arch/arm64/include/asm/mmu.h | 5 + arch/arm64/include/asm/pgtable-prot.h | 10 +- arch/arm64/include/asm/pgtable.h | 35 +- arch/arm64/kernel/cpufeature.c | 161 +++++++-- arch/arm64/mm/contpte.c | 134 +++++++- arch/arm64/mm/init.c | 6 +- arch/arm64/mm/mmu.c | 474 +++++++++++++++++++++++++- arch/arm64/mm/pageattr.c | 166 ++++++--- arch/arm64/mm/pfn_range_alloc.c | 6 +- arch/arm64/mm/proc.S | 27 +- arch/arm64/mm/trans_pgd.c | 40 +-- arch/arm64/tools/cpucaps | 2 +- arch/arm64/tools/sysreg | 1 + arch/openrisc/kernel/dma.c | 4 +- arch/riscv/mm/pageattr.c | 8 +- arch/sw_64/mm/pageattr.c | 2 +- include/linux/pagewalk.h | 10 +- mm/internal.h | 5 + mm/pagewalk.c | 82 ++++- mm/ptdump.c | 3 +- 22 files changed, 1047 insertions(+), 169 deletions(-) -- 2.43.0

2 25

[PATCH OLK-5.10] wifi: mac80211: validate extension-frame layout before RX
by Gaosheng Cui 07 Sep '26

07 Sep '26

From: Zhao Li <enderaoelyther(a)gmail.com> mainline inclusion from mainline-v7.2-rc4 commit 57d503ce32eccfa7650065ca4c560f7e29a2e676 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17512 CVE: CVE-2026-68470 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Extension frames only have the extension header at the regular 802.11 header offset. The generic RX path can still reach helpers and interface dispatch code that read regular header address fields before unsupported extension subtypes are dropped. mac80211 currently only handles S1G beacon extension frames. Drop other extension subtypes before they can reach regular-header RX processing. For S1G beacons, linearize the SKB with the management-frame path and require the fixed S1G beacon header, including optional fixed fields indicated by frame control, before generic RX dispatch. Route S1G beacons through the station/default-link RX path without regular-header station lookup. Avoid regular-header address reads in the mac80211 RX paths that process S1G extension beacons, including accept-frame, duplicate-detection, address-copy, and MLO address-translation paths. Also make ieee80211_get_bssid() length-safe before returning the S1G source-address pointer. Fixes: 09a740ce352e ("mac80211: receive and process S1G beacons") Cc: stable(a)vger.kernel.org Signed-off-by: Zhao Li <enderaoelyther(a)gmail.com> Link: https://patch.msgid.link/20260611161943.91069-5-enderaoelyther@gmail.com Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Conflicts: net/mac80211/rx.c [Commit 57d503ce32ec built the S1G-beacon handling on top of ieee80211_rx_for_interface() and ieee80211_s1g_optional_len(), which do not exist in this tree (no include/linux/ieee80211-s1g.h). The equivalent logic is inlined into __ieee80211_rx_handle_packet(): S1G beacons are dispatched with a NULL sta (skipping the regular-header addr2 station lookup), and the optional-header length check is expressed with the existing ieee80211_next_tbtt_present(). ieee80211_prepare_and_rx_handle() needs no S1G shortcut because this tree does not have the SW-crypto/MLO address-copy paths.] Co-authored-by: BackportAgent@deepseek-v4-flash Signed-off-by: Hulk Robot <hulkrobot(a)huawei.com> Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- net/mac80211/rx.c | 30 ++++++++++++++++++++++++++---- net/mac80211/util.c | 3 +++ 2 files changed, 29 insertions(+), 4 deletions(-) diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c index 65fea564c9c0..ba25540c4013 100644 --- a/net/mac80211/rx.c +++ b/net/mac80211/rx.c @@ -1429,6 +1429,9 @@ ieee80211_rx_h_check_dup(struct ieee80211_rx_data *rx) if (status->flag & RX_FLAG_DUP_VALIDATED) return RX_CONTINUE; + if (ieee80211_is_ext(hdr->frame_control)) + return RX_CONTINUE; + /* * Drop duplicate 802.11 retransmissions * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery") @@ -4051,8 +4054,12 @@ static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx) struct ieee80211_hdr *hdr = (void *)skb->data; struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); u8 *bssid = ieee80211_get_bssid(hdr, skb->len, sdata->vif.type); - bool multicast = is_multicast_ether_addr(hdr->addr1) || - ieee80211_is_s1g_beacon(hdr->frame_control); + bool multicast; + + if (ieee80211_is_s1g_beacon(hdr->frame_control)) + return sdata->vif.type == NL80211_IFTYPE_STATION && bssid; + + multicast = is_multicast_ether_addr(hdr->addr1); switch (sdata->vif.type) { case NL80211_IFTYPE_STATION: @@ -4639,6 +4646,19 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw, err = -ENOBUFS; else err = skb_linearize(skb); + } else if (ieee80211_is_s1g_beacon(fc)) { + size_t s1g_hdr_len = offsetof(struct ieee80211_ext, + u.s1g_beacon.variable); + + if (ieee80211_next_tbtt_present(fc)) + s1g_hdr_len += 3; + + if (skb->len < s1g_hdr_len) + err = -ENOBUFS; + else + err = skb_linearize(skb); + } else if (ieee80211_is_ext(fc)) { + err = -EINVAL; } else { err = !pskb_may_pull(skb, ieee80211_hdrlen(fc)); } @@ -4714,7 +4734,8 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw, continue; } - rx.sta = sta_info_get_bss(prev, hdr->addr2); + rx.sta = ieee80211_is_s1g_beacon(hdr->frame_control) ? + NULL : sta_info_get_bss(prev, hdr->addr2); rx.sdata = prev; ieee80211_prepare_and_rx_handle(&rx, skb, false); @@ -4722,7 +4743,8 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw, } if (prev) { - rx.sta = sta_info_get_bss(prev, hdr->addr2); + rx.sta = ieee80211_is_s1g_beacon(hdr->frame_control) ? + NULL : sta_info_get_bss(prev, hdr->addr2); rx.sdata = prev; if (ieee80211_prepare_and_rx_handle(&rx, skb, true)) diff --git a/net/mac80211/util.c b/net/mac80211/util.c index e49355cbb1ce..8e27e191945d 100644 --- a/net/mac80211/util.c +++ b/net/mac80211/util.c @@ -67,6 +67,9 @@ u8 *ieee80211_get_bssid(struct ieee80211_hdr *hdr, size_t len, if (ieee80211_is_s1g_beacon(fc)) { struct ieee80211_ext *ext = (void *) hdr; + if (len < offsetofend(struct ieee80211_ext, u.s1g_beacon.sa)) + return NULL; + return ext->u.s1g_beacon.sa; } -- 2.43.0

2 1

[PATCH OLK-5.10] drm/vmwgfx: validate DRAW_PRIMITIVES header size before division
by Hongtao Zhang 07 Sep '26

07 Sep '26

From: Zack Rusin <zack.rusin(a)broadcom.com> stable inclusion from stable-v6.6.151 commit 2666cddf0dd218aa9bd1f99db688d1b532eac21a category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17884 CVE: CVE-2026-74444 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 85891d174707d8bddcec7a888fb4e1d17def34f3 upstream. vmw_cmd_draw() computes maxnum = (header->size - sizeof(cmd->body)) / sizeof(*decl); where header->size is u32 and is taken straight from the user-supplied command stream. When header->size is less than sizeof(cmd->body) the unsigned subtraction wraps to nearly 4 GiB, producing a huge maxnum. Any user-controlled cmd->body.numVertexDecls then passes the bound and the loop dereferences decl[i] far past the end of the kernel command bounce buffer, producing an out-of-bounds read of kernel memory. Reject undersized headers up front. Fixes: 7a73ba7469cb ("drm/vmwgfx: Use TTM handles instead of SIDs as user-space surface handles.") Cc: stable(a)vger.kernel.org Assisted-by: Claude:claude-opus-4.7 Signed-off-by: Zack Rusin <zack.rusin(a)broadcom.com> Reviewed-by: Ian Forbes <ian.forbes(a)broadcom.com> Link: https://patch.msgid.link/20260505222728.519626-7-zack.rusin@broadcom.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Hongtao <zhanghongtao35(a)huawei.com> --- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c index 6e75adaae0bcd..e690751698307 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c @@ -1563,11 +1563,17 @@ static int vmw_cmd_draw(struct vmw_private *dev_priv, uint32_t maxnum; int ret; + cmd = container_of(header, typeof(*cmd), header); + + if (unlikely(header->size < sizeof(cmd->body))) { + VMW_DEBUG_USER("Illegal DRAW_PRIMITIVES header size.\n"); + return -EINVAL; + } + ret = vmw_cmd_cid_check(dev_priv, sw_context, header); if (unlikely(ret != 0)) return ret; - cmd = container_of(header, typeof(*cmd), header); maxnum = (header->size - sizeof(cmd->body)) / sizeof(*decl); if (unlikely(cmd->body.numVertexDecls > maxnum)) { -- 2.43.0

2 1

[PATCH OLK-6.6] serial: amba-pl011: synchronize DMA teardown
by Cai Xinchen 07 Sep '26

07 Sep '26

From: Fan Wu <fanwu01(a)zju.edu.cn> stable inclusion from stable-6.6.154 commit c8c8e895f65fbf71ea6224e27cf8dab91b776e0d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18582 CVE: CVE-2026-80737 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------ [ Upstream commit 440915499231e9db1c361aa45bb702e8fd3b4a32 ] dmaengine_terminate_all() does not wait for a running callback, so the TX callback can still touch the TX buffer after it is freed. The RX poll timer reads the RX buffers without the port lock. Switch to dmaengine_terminate_sync() and delete the RX timer before freeing the buffers. Fixes: ead76f329f77 ("ARM: 6763/1: pl011: add optional RX DMA to PL011 v2") Cc: stable <stable(a)kernel.org> Assisted-by: Codex:gpt-5.6 Signed-off-by: Fan Wu <fanwu01(a)zju.edu.cn> Link: https://patch.msgid.link/20260731085915.326775-4-fanwu01@zju.edu.cn Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> [ changed upstream's `timer_delete_sync()` deletion to match this tree's `del_timer_sync()` spelling at the old call site ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- drivers/tty/serial/amba-pl011.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c index 8aa71a51cdab..4c107556ae31 100644 --- a/drivers/tty/serial/amba-pl011.c +++ b/drivers/tty/serial/amba-pl011.c @@ -1193,7 +1193,7 @@ static void pl011_dma_shutdown(struct uart_amba_port *uap) if (uap->using_tx_dma) { /* In theory, this should already be done by pl011_dma_flush_buffer */ - dmaengine_terminate_all(uap->dmatx.chan); + dmaengine_terminate_sync(uap->dmatx.chan); if (uap->dmatx.queued) { dma_unmap_single(uap->dmatx.chan->device->dev, uap->dmatx.dma, uap->dmatx.len, @@ -1206,12 +1206,12 @@ static void pl011_dma_shutdown(struct uart_amba_port *uap) } if (uap->using_rx_dma) { - dmaengine_terminate_all(uap->dmarx.chan); + if (uap->dmarx.poll_rate) + timer_delete_sync(&uap->dmarx.timer); + dmaengine_terminate_sync(uap->dmarx.chan); /* Clean up the RX DMA */ pl011_dmabuf_free(uap->dmarx.chan, &uap->dmarx.dbuf_a, DMA_FROM_DEVICE); pl011_dmabuf_free(uap->dmarx.chan, &uap->dmarx.dbuf_b, DMA_FROM_DEVICE); - if (uap->dmarx.poll_rate) - del_timer_sync(&uap->dmarx.timer); uap->using_rx_dma = false; } } -- 2.18.0.huawei.25

2 1

[PATCH OLK-6.6] selinux: reject a permission value exceeding the class permission count
by Cai Xinchen 07 Sep '26

07 Sep '26

From: Bryam Vargas <hexlabsecurity(a)proton.me> mainline inclusion from mainline-v7.2-rc7 commit d14b5d0e97fccd27974fedc03b903408872907fd category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18602 CVE: CVE-2026-80755 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- perm_read() bounds a permission value by SEL_VEC_MAX but never by the nprim of the owning class or common, which is taken verbatim from the policy image. security_get_permissions() then writes perms[value - 1] into an nprim-sized kcalloc() array, so a class declaring fewer permissions than its largest permission value drives an out-of-bounds heap write. The top-level symbol tables are validated this way; the nested per-class permission table is not. Reject a permission whose value exceeds nprim, which is already set when perm_read() runs. Well-formed policies are unaffected. Cc: stable(a)vger.kernel.org Fixes: 55fcf09b3fe4 ("selinux: add support for querying object classes and permissions from the running policy") Signed-off-by: Bryam Vargas <hexlabsecurity(a)proton.me> Acked-by: Stephen Smalley <stephen.smalley.work(a)gmail.com> [PM: tweak comment for line length] Signed-off-by: Paul Moore <paul(a)paul-moore.com> Conflicts: security/selinux/ss/policydb.c [Add rc = -ENVAL to init rc before goto bad;] Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- security/selinux/ss/policydb.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c index f70399373588..d58c9b77505a 100644 --- a/security/selinux/ss/policydb.c +++ b/security/selinux/ss/policydb.c @@ -1109,6 +1109,11 @@ static int perm_read(struct policydb *p, struct symtab *s, void *fp) len = le32_to_cpu(buf[0]); perdatum->value = le32_to_cpu(buf[1]); + rc = -EINVAL; + /* indexes an nprim-sized array in security_get_permissions() */ + if (perdatum->value > s->nprim) + goto bad; + rc = str_read(&key, GFP_KERNEL, fp, len); if (rc) goto bad; -- 2.18.0.huawei.25

2 1

[PATCH] serial: amba-pl011: synchronize DMA teardown
by Cai Xinchen 07 Sep '26

07 Sep '26

From: Fan Wu <fanwu01(a)zju.edu.cn> stable inclusion from stable-6.6.154 commit c8c8e895f65fbf71ea6224e27cf8dab91b776e0d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18582 CVE: CVE-2026-80737 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------ [ Upstream commit 440915499231e9db1c361aa45bb702e8fd3b4a32 ] dmaengine_terminate_all() does not wait for a running callback, so the TX callback can still touch the TX buffer after it is freed. The RX poll timer reads the RX buffers without the port lock. Switch to dmaengine_terminate_sync() and delete the RX timer before freeing the buffers. Fixes: ead76f329f77 ("ARM: 6763/1: pl011: add optional RX DMA to PL011 v2") Cc: stable <stable(a)kernel.org> Assisted-by: Codex:gpt-5.6 Signed-off-by: Fan Wu <fanwu01(a)zju.edu.cn> Link: https://patch.msgid.link/20260731085915.326775-4-fanwu01@zju.edu.cn Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> [ changed upstream's `timer_delete_sync()` deletion to match this tree's `del_timer_sync()` spelling at the old call site ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- drivers/tty/serial/amba-pl011.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c index 8aa71a51cdab..4c107556ae31 100644 --- a/drivers/tty/serial/amba-pl011.c +++ b/drivers/tty/serial/amba-pl011.c @@ -1193,7 +1193,7 @@ static void pl011_dma_shutdown(struct uart_amba_port *uap) if (uap->using_tx_dma) { /* In theory, this should already be done by pl011_dma_flush_buffer */ - dmaengine_terminate_all(uap->dmatx.chan); + dmaengine_terminate_sync(uap->dmatx.chan); if (uap->dmatx.queued) { dma_unmap_single(uap->dmatx.chan->device->dev, uap->dmatx.dma, uap->dmatx.len, @@ -1206,12 +1206,12 @@ static void pl011_dma_shutdown(struct uart_amba_port *uap) } if (uap->using_rx_dma) { - dmaengine_terminate_all(uap->dmarx.chan); + if (uap->dmarx.poll_rate) + timer_delete_sync(&uap->dmarx.timer); + dmaengine_terminate_sync(uap->dmarx.chan); /* Clean up the RX DMA */ pl011_dmabuf_free(uap->dmarx.chan, &uap->dmarx.dbuf_a, DMA_FROM_DEVICE); pl011_dmabuf_free(uap->dmarx.chan, &uap->dmarx.dbuf_b, DMA_FROM_DEVICE); - if (uap->dmarx.poll_rate) - del_timer_sync(&uap->dmarx.timer); uap->using_rx_dma = false; } } -- 2.18.0.huawei.25

1 0

[PATCH OLK-5.10] drm/vmwgfx: Validate vmw_surface_metadata::array_size
by Hongtao Zhang 07 Sep '26

07 Sep '26

From: Ian Forbes <ian.forbes(a)broadcom.com> stable inclusion from stable-v5.10.265 commit e949adf2d42678fb391a41db277e2fcb12090566 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17161 CVE: CVE-2026-68446 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit a4f55260f7f7d4dc4d0ee55063dfb0c457b77991 upstream. This field comes from userspace and should be validated against specific limits depending on which Shader Model (SM) is available. Fixes: 504901dbb0b5 ("drm/vmwgfx: Refactor surface_define to use vmw_surface_metadata") Reported-by: Zero Day Initiative <zdi-disclosures(a)trendmicro.com> Cc: stable(a)vger.kernel.org Signed-off-by: Ian Forbes <ian.forbes(a)broadcom.com> Reviewed-by: Maaz Mombasawala <maaz.mombasawala(a)broadcom.com> Signed-off-by: Zack Rusin <zack.rusin(a)broadcom.com> Link: https://patch.msgid.link/20260623193314.506257-1-ian.forbes@broadcom.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Hongtao <zhanghongtao35(a)huawei.com> --- drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-) diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c index f1a51371de5b1..0005016a9be75 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c @@ -101,7 +101,7 @@ static int vmw_gb_surface_unbind(struct vmw_resource *res, static int vmw_gb_surface_destroy(struct vmw_resource *res); static int vmw_gb_surface_define_internal(struct drm_device *dev, - struct drm_vmw_gb_surface_create_ext_req *req, + const struct drm_vmw_gb_surface_create_ext_req *req, struct drm_vmw_gb_surface_create_rep *rep, struct drm_file *file_priv); static int @@ -1450,7 +1450,7 @@ int vmw_gb_surface_reference_ext_ioctl(struct drm_device *dev, void *data, */ static int vmw_gb_surface_define_internal(struct drm_device *dev, - struct drm_vmw_gb_surface_create_ext_req *req, + const struct drm_vmw_gb_surface_create_ext_req *req, struct drm_vmw_gb_surface_create_rep *rep, struct drm_file *file_priv) { @@ -1469,9 +1469,21 @@ vmw_gb_surface_define_internal(struct drm_device *dev, req->base.svga3d_flags); /* array_size must be null for non-GL3 host. */ - if (req->base.array_size > 0 && !has_sm4_context(dev_priv)) { - VMW_DEBUG_USER("SM4 surface not supported.\n"); - return -EINVAL; + if (req->base.array_size > 0) { + if (has_sm5_context(dev_priv)) { + if (req->base.array_size > SVGA3D_SM5_MAX_SURFACE_ARRAYSIZE) { + VMW_DEBUG_USER("Invalid Surface Array Size.\n"); + return -EINVAL; + } + } else if (has_sm4_context(dev_priv)) { + if (req->base.array_size > SVGA3D_SM4_MAX_SURFACE_ARRAYSIZE) { + VMW_DEBUG_USER("Invalid Surface Array Size.\n"); + return -EINVAL; + } + } else { + VMW_DEBUG_USER("SM4+ surface not supported.\n"); + return -EINVAL; + } } if (!has_sm4_1_context(dev_priv)) { -- 2.43.0

2 1

[PATCH OLK-6.6 0/2] PCI: Check ROM header and data structure addr before accessing
by Hongtao Zhang 07 Sep '26

07 Sep '26

*** BLURB HERE *** Guixin Liu (2): PCI: Introduce named defines for PCI ROM PCI: Check ROM header and data structure addr before accessing drivers/pci/rom.c | 149 +++++++++++++++++++++++++++++++++++++++------- 1 file changed, 126 insertions(+), 23 deletions(-) -- 2.43.0

2 3

[PATCH OLK-5.10 0/2] PCI: Check ROM header and data structure addr before accessing
by Hongtao Zhang 07 Sep '26

07 Sep '26

*** BLURB HERE *** Guixin Liu (2): PCI: Introduce named defines for PCI ROM PCI: Check ROM header and data structure addr before accessing drivers/pci/rom.c | 148 +++++++++++++++++++++++++++++++++++++++------- 1 file changed, 125 insertions(+), 23 deletions(-) -- 2.43.0

2 3

[PATCH OLK-5.10] ocfs2: validate fast symlink target during inode read
by Lai Zewei 07 Sep '26

07 Sep '26

mainline inclusion from mainline-v7.2-rc1 commit e234973f286ed2e8961a24561ec91594ec3e3ff8 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18148 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ocfs2_validate_inode_block() already rejects several inconsistent self-contained dinodes before they are exposed to the rest of the filesystem. Fast symlinks need the same treatment. A zero-cluster symlink is treated as a fast symlink and later read through page_get_link() and ocfs2_fast_symlink_read_folio(). That path uses strnlen() on the inline payload and then copies len + 1 bytes into the folio. If a corrupt dinode stores an i_size that does not fit the inline area or omits the terminating NUL at i_size, that copy reads past the end of the inode block buffer. Reject zero-cluster symlink dinodes whose i_size exceeds the inline fast-symlink capacity or whose inline payload is not NUL-terminated exactly at i_size when the inode block is validated. This keeps malformed fast symlinks from reaching the read path. Validation reproduced this kernel report: KASAN use-after-free in ocfs2_fast_symlink_read_folio+0x12c/0x1f0 RIP: 0033:0x7f5c6d859aa7 Read of size 3905 Call trace: dump_stack_lvl+0x66/0xa0 (?:?) print_report+0xce/0x630 (?:?) ocfs2_fast_symlink_read_folio+0x12c/0x1f0 (fs/ocfs2/inode.c:?) srso_alias_return_thunk+0x5/0xfbef5 (?:?) __virt_addr_valid+0x19f/0x330 (?:?) kasan_report+0xe0/0x110 (?:?) kasan_check_range+0x105/0x1b0 (?:?) __asan_memcpy+0x23/0x60 (?:?) filemap_read_folio+0x27/0xe0 (?:?) filemap_read_folio+0x35/0xe0 (?:?) do_read_cache_folio+0x138/0x230 (?:?) __page_get_link+0x26/0x110 (?:?) page_get_link+0x2e/0x70 (?:?) vfs_readlink+0x15e/0x250 (?:?) touch_atime+0x4d/0x370 (?:?) do_readlinkat+0x186/0x200 (?:?) do_user_addr_fault+0x65a/0x890 (?:?) __x64_sys_readlink+0x46/0x60 (?:?) do_syscall_64+0x115/0x6a0 (arch/x86/entry/syscall_64.c:87) entry_SYSCALL_64_after_hwframe+0x77/0x7f (?:?) Link: https://lore.kernel.org/20260528151230.361127-1-rollkingzzc@gmail.com Fixes: ea022dfb3c2a ("ocfs: simplify symlink handling") Assisted-by: Codex:gpt-5.5 Signed-off-by: Zhang Cen <rollkingzzc(a)gmail.com> Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Cc: Gui-Dong Han <2045gemini(a)gmail.com> Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Jun Piao <piaojun(a)huawei.com> Cc: Heming Zhao <heming.zhao(a)suse.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: fs/ocfs2/inode.c [ctx conflicts] Signed-off-by: Lai Zewei <laizewei3(a)huawei.com> --- fs/ocfs2/inode.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/fs/ocfs2/inode.c b/fs/ocfs2/inode.c index 7c9dfd50c1c1..e5fa0070016f 100644 --- a/fs/ocfs2/inode.c +++ b/fs/ocfs2/inode.c @@ -1418,6 +1418,29 @@ int ocfs2_validate_inode_block(struct super_block *sb, goto bail; } + if (S_ISLNK(le16_to_cpu(di->i_mode)) && + !le32_to_cpu(di->i_clusters)) { + int max_inline = ocfs2_fast_symlink_chars(sb); + u64 i_size = le64_to_cpu(di->i_size); + + if (i_size >= max_inline) { + rc = ocfs2_error(sb, + "Invalid dinode #%llu: fast symlink i_size %llu exceeds max %d\n", + (unsigned long long)bh->b_blocknr, + (unsigned long long)i_size, + max_inline - 1); + goto bail; + } + + if (strnlen((char *)di->id2.i_symlink, i_size + 1) != i_size) { + rc = ocfs2_error(sb, + "Invalid dinode #%llu: fast symlink is not NUL-terminated at i_size %llu\n", + (unsigned long long)bh->b_blocknr, + (unsigned long long)i_size); + goto bail; + } + } + rc = 0; bail: -- 2.52.0

2 1

[PATCH openEuler-1.0-LTS] perf: Fix refcount race between perf_event_open() and perf_mmap_close()
by Luo Gengkun 07 Sep '26

07 Sep '26

Offering: HULK hulk inclusion category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18563 -------------------------------- perf_event_set_output() can succeed and add the event to a ring buffer's event_list, making it visible to concurrent perf_mmap_close(). The latter raises the event refcount via atomic_long_inc_not_zero() during its RCU-protected iteration of rb->event_list. If a subsequent check in sys_perf_event_open() fails, the error path calls free_event() which expects refcount==1. When perf_mmap_close() has already incremented it to 2, free_event() triggers a WARN. Fixes: 9bb5d40cd93c ("perf: Fix mmap() accounting hole") Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- kernel/events/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/events/core.c b/kernel/events/core.c index ff875ddf4aeb..292419dc2ec5 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -11149,7 +11149,7 @@ SYSCALL_DEFINE5(perf_event_open, * and that will take care of freeing the event. */ if (!event_file) - free_event(event); + put_event(event); err_cred: if (task) mutex_unlock(&task->signal->cred_guard_mutex); -- 2.34.1

2 1

[PATCH OLK-6.6] bpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk
by Pu Lehui 07 Sep '26

07 Sep '26

maillist inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9873 Reference: https://lore.kernel.org/bpf/20260901150307.3474349-1-pulehui@huaweicloud.com -------------------------------- Syzkaller repeatedly triggered UAF splats related to nodes in waiting_for_gp_ttrace within the bpf memalloc: BUG: KASAN: slab-use-after-free in llist_del_first+0x85/0x110 lib/llist.c:61 Read of size 8 at addr ffff8881572cd080 by task syz.4.470/5112 ... llist_del_first+0x85/0x110 lib/llist.c:61 alloc_bulk+0x193/0x460 kernel/bpf/memalloc.c:229 bpf_mem_refill+0x386/0x560 kernel/bpf/memalloc.c:436 Freed by task 14: ... __free_rcu kernel/bpf/memalloc.c:281 [inline] __free_rcu_tasks_trace+0x48/0xd0 kernel/bpf/memalloc.c:291 rcu_tasks_invoke_cbs+0x1ec/0x3e0 kernel/rcu/tasks.h:571 rcu_tasks_one_gp+0x13d/0x220 kernel/rcu/tasks.h:621 rcu_tasks_kthread+0xf3/0x120 kernel/rcu/tasks.h:651 Initially, we suspected that alloc_bulk() lacked RCU Tasks Trace protection when accessing waiting_for_gp_ttrace. However, explicitly adding rcu_read_lock_trace() did not help. This is expected because, as noted in commit 57b23c0f612d ("bpf: Retire rcu_trace_implies_rcu_gp()"), an RCU Tasks Trace GP currently implies (and will continue to imply in the future) a normal RCU GP. Since alloc_bulk() runs in an RCU read-side CS (!PREEMPT_RT runs in IRQ context, PREEMPT_RT runs with guard(rcu)), an RCU Tasks Trace GP cannot complete while alloc_bulk() is accessing the list. Instead, the UAF occurs after the GP expires: when the __free_rcu() callback runs, there is no synchronization protecting llist_del_all() against concurrent alloc_bulk() operates on waiting_for_gp_ttrace, leading to the race condition below: CPU0 CPU1 __free_rcu (RCU Tasks Trace callback) alloc_bulk llist_del_first(&c->waiting_for_gp_ttrace) entry = smp_load_acquire(&head->first); do { if (entry == NULL) return NULL; free_all(llist_del_all(&c->waiting_for_gp_ttrace)) llist_for_each_safe(pos, t, llnode) free_one(pos); next = READ_ONCE(entry->next); <-- trigger UAF } while (!try_cmpxchg(&head->first, &entry, next)); In addition, there is also a theoretical race condition on the free_by_rcu_ttrace list. This race requires two preconditions: an in-flight Tasks Trace GP keeping c->call_rcu_ttrace_in_progress == 1, and concurrent cross-CPU frees repopulating c->free_by_rcu_ttrace with new nodes. Under these conditions, the following scenario triggers UAF: // CPU0 // irq work is still busy (on PREEMPT_RT) alloc_bulk() llist_del_first(&c->free_by_rcu_ttrace) entry = smp_load_acquire(&head->first); do { if (entry == NULL) return NULL; // CPU1 bpf_mem_alloc_destroy() WRITE_ONCE(c->draining, true) // wait for CPU0 irq_work_sync() // CPU2 do_call_rcu_ttrace(tgt(CPU0)) if (c->draining) { llist_del_all(&c->free_by_rcu_ttrace) free_all() } // CPU0 continue next = READ_ONCE(entry->next); <-- trigger UAF while (!try_cmpxchg(&head->first, &entry, next)); Fix this by introducing a raw spinlock to synchronize the concurrent consumption on waiting_for_gp_ttrace and free_by_rcu_ttrace. Fixes: 04fabf00b4d3 ("bpf: Allow reuse from waiting_for_gp_ttrace list.") Suggested-by: Alexei Starovoitov <ast(a)kernel.org> Suggested-by: Hou Tao <houtao1(a)huawei.com> Conflicts: kernel/bpf/memalloc.c [not merged bpf_mem_alloc_percpu_unit_init] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/memalloc.c | 49 ++++++++++++++++++++++++------------------- 1 file changed, 28 insertions(+), 21 deletions(-) diff --git a/kernel/bpf/memalloc.c b/kernel/bpf/memalloc.c index b4f27c34dd94..afdc0fab5ccd 100644 --- a/kernel/bpf/memalloc.c +++ b/kernel/bpf/memalloc.c @@ -120,6 +120,7 @@ struct bpf_mem_cache { struct llist_head waiting_for_gp_ttrace; struct rcu_head rcu_ttrace; atomic_t call_rcu_ttrace_in_progress; + raw_spinlock_t lock; }; struct bpf_mem_caches { @@ -216,25 +217,25 @@ static void alloc_bulk(struct bpf_mem_cache *c, int cnt, int node, bool atomic) gfp = __GFP_NOWARN | __GFP_ACCOUNT; gfp |= atomic ? GFP_NOWAIT : GFP_KERNEL; - for (i = 0; i < cnt; i++) { - /* - * For every 'c' llist_del_first(&c->free_by_rcu_ttrace); is - * done only by one CPU == current CPU. Other CPUs might - * llist_add() and llist_del_all() in parallel. - */ - obj = llist_del_first(&c->free_by_rcu_ttrace); - if (!obj) - break; - add_obj_to_free_list(c, obj); - } - if (i >= cnt) - return; + scoped_guard(raw_spinlock_irqsave, &c->lock) { + for (i = 0; i < cnt; i++) { + /* + * For every 'c' llist_del_first(&c->free_by_rcu_ttrace); is + * done only by one CPU == current CPU. Other CPUs might + * llist_add() and llist_del_all() in parallel. + */ + obj = llist_del_first(&c->free_by_rcu_ttrace); + if (!obj) + break; + add_obj_to_free_list(c, obj); + } - for (; i < cnt; i++) { - obj = llist_del_first(&c->waiting_for_gp_ttrace); - if (!obj) - break; - add_obj_to_free_list(c, obj); + for (; i < cnt; i++) { + obj = llist_del_first(&c->waiting_for_gp_ttrace); + if (!obj) + break; + add_obj_to_free_list(c, obj); + } } if (i >= cnt) return; @@ -284,8 +285,12 @@ static int free_all(struct bpf_mem_cache *c, struct llist_node *llnode, bool per static void __free_rcu(struct rcu_head *head) { struct bpf_mem_cache *c = container_of(head, struct bpf_mem_cache, rcu_ttrace); + struct llist_node *llnode; - free_all(c, llist_del_all(&c->waiting_for_gp_ttrace), !!c->percpu_size); + scoped_guard(raw_spinlock_irqsave, &c->lock) + llnode = llist_del_all(&c->waiting_for_gp_ttrace); + + free_all(c, llnode, !!c->percpu_size); atomic_set(&c->call_rcu_ttrace_in_progress, 0); } @@ -316,7 +321,8 @@ static void do_call_rcu_ttrace(struct bpf_mem_cache *c) if (atomic_xchg(&c->call_rcu_ttrace_in_progress, 1)) { if (unlikely(READ_ONCE(c->draining))) { - llnode = llist_del_all(&c->free_by_rcu_ttrace); + scoped_guard(raw_spinlock_irqsave, &c->lock) + llnode = llist_del_all(&c->free_by_rcu_ttrace); free_all(c, llnode, !!c->percpu_size); } return; @@ -532,6 +538,7 @@ int bpf_mem_alloc_init(struct bpf_mem_alloc *ma, int size, bool percpu) c->objcg = objcg; c->percpu_size = percpu_size; c->tgt = c; + raw_spin_lock_init(&c->lock); init_refill_work(c); prefill_mem_cache(c, cpu); } @@ -556,7 +563,7 @@ int bpf_mem_alloc_init(struct bpf_mem_alloc *ma, int size, bool percpu) c->unit_size = sizes[i]; c->objcg = objcg; c->tgt = c; - + raw_spin_lock_init(&c->lock); init_refill_work(c); prefill_mem_cache(c, cpu); } -- 2.34.1

2 1

[PATCH OLK-6.6] bpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk
by Pu Lehui 07 Sep '26

07 Sep '26

maillist inclusion category: bugfix bugzilla: NA Reference: https://lore.kernel.org/bpf/20260901150307.3474349-1-pulehui@huaweicloud.com -------------------------------- Syzkaller repeatedly triggered UAF splats related to nodes in waiting_for_gp_ttrace within the bpf memalloc: BUG: KASAN: slab-use-after-free in llist_del_first+0x85/0x110 lib/llist.c:61 Read of size 8 at addr ffff8881572cd080 by task syz.4.470/5112 ... llist_del_first+0x85/0x110 lib/llist.c:61 alloc_bulk+0x193/0x460 kernel/bpf/memalloc.c:229 bpf_mem_refill+0x386/0x560 kernel/bpf/memalloc.c:436 Freed by task 14: ... __free_rcu kernel/bpf/memalloc.c:281 [inline] __free_rcu_tasks_trace+0x48/0xd0 kernel/bpf/memalloc.c:291 rcu_tasks_invoke_cbs+0x1ec/0x3e0 kernel/rcu/tasks.h:571 rcu_tasks_one_gp+0x13d/0x220 kernel/rcu/tasks.h:621 rcu_tasks_kthread+0xf3/0x120 kernel/rcu/tasks.h:651 Initially, we suspected that alloc_bulk() lacked RCU Tasks Trace protection when accessing waiting_for_gp_ttrace. However, explicitly adding rcu_read_lock_trace() did not help. This is expected because, as noted in commit 57b23c0f612d ("bpf: Retire rcu_trace_implies_rcu_gp()"), an RCU Tasks Trace GP currently implies (and will continue to imply in the future) a normal RCU GP. Since alloc_bulk() runs in an RCU read-side CS (!PREEMPT_RT runs in IRQ context, PREEMPT_RT runs with guard(rcu)), an RCU Tasks Trace GP cannot complete while alloc_bulk() is accessing the list. Instead, the UAF occurs after the GP expires: when the __free_rcu() callback runs, there is no synchronization protecting llist_del_all() against concurrent alloc_bulk() operates on waiting_for_gp_ttrace, leading to the race condition below: CPU0 CPU1 __free_rcu (RCU Tasks Trace callback) alloc_bulk llist_del_first(&c->waiting_for_gp_ttrace) entry = smp_load_acquire(&head->first); do { if (entry == NULL) return NULL; free_all(llist_del_all(&c->waiting_for_gp_ttrace)) llist_for_each_safe(pos, t, llnode) free_one(pos); next = READ_ONCE(entry->next); <-- trigger UAF } while (!try_cmpxchg(&head->first, &entry, next)); In addition, there is also a theoretical race condition on the free_by_rcu_ttrace list. This race requires two preconditions: an in-flight Tasks Trace GP keeping c->call_rcu_ttrace_in_progress == 1, and concurrent cross-CPU frees repopulating c->free_by_rcu_ttrace with new nodes. Under these conditions, the following scenario triggers UAF: // CPU0 // irq work is still busy (on PREEMPT_RT) alloc_bulk() llist_del_first(&c->free_by_rcu_ttrace) entry = smp_load_acquire(&head->first); do { if (entry == NULL) return NULL; // CPU1 bpf_mem_alloc_destroy() WRITE_ONCE(c->draining, true) // wait for CPU0 irq_work_sync() // CPU2 do_call_rcu_ttrace(tgt(CPU0)) if (c->draining) { llist_del_all(&c->free_by_rcu_ttrace) free_all() } // CPU0 continue next = READ_ONCE(entry->next); <-- trigger UAF while (!try_cmpxchg(&head->first, &entry, next)); Fix this by introducing a raw spinlock to synchronize the concurrent consumption on waiting_for_gp_ttrace and free_by_rcu_ttrace. Fixes: 04fabf00b4d3 ("bpf: Allow reuse from waiting_for_gp_ttrace list.") Suggested-by: Alexei Starovoitov <ast(a)kernel.org> Suggested-by: Hou Tao <houtao1(a)huawei.com> Conflicts: kernel/bpf/memalloc.c [not merged bpf_mem_alloc_percpu_unit_init] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/memalloc.c | 49 ++++++++++++++++++++++++------------------- 1 file changed, 28 insertions(+), 21 deletions(-) diff --git a/kernel/bpf/memalloc.c b/kernel/bpf/memalloc.c index b4f27c34dd94..afdc0fab5ccd 100644 --- a/kernel/bpf/memalloc.c +++ b/kernel/bpf/memalloc.c @@ -120,6 +120,7 @@ struct bpf_mem_cache { struct llist_head waiting_for_gp_ttrace; struct rcu_head rcu_ttrace; atomic_t call_rcu_ttrace_in_progress; + raw_spinlock_t lock; }; struct bpf_mem_caches { @@ -216,25 +217,25 @@ static void alloc_bulk(struct bpf_mem_cache *c, int cnt, int node, bool atomic) gfp = __GFP_NOWARN | __GFP_ACCOUNT; gfp |= atomic ? GFP_NOWAIT : GFP_KERNEL; - for (i = 0; i < cnt; i++) { - /* - * For every 'c' llist_del_first(&c->free_by_rcu_ttrace); is - * done only by one CPU == current CPU. Other CPUs might - * llist_add() and llist_del_all() in parallel. - */ - obj = llist_del_first(&c->free_by_rcu_ttrace); - if (!obj) - break; - add_obj_to_free_list(c, obj); - } - if (i >= cnt) - return; + scoped_guard(raw_spinlock_irqsave, &c->lock) { + for (i = 0; i < cnt; i++) { + /* + * For every 'c' llist_del_first(&c->free_by_rcu_ttrace); is + * done only by one CPU == current CPU. Other CPUs might + * llist_add() and llist_del_all() in parallel. + */ + obj = llist_del_first(&c->free_by_rcu_ttrace); + if (!obj) + break; + add_obj_to_free_list(c, obj); + } - for (; i < cnt; i++) { - obj = llist_del_first(&c->waiting_for_gp_ttrace); - if (!obj) - break; - add_obj_to_free_list(c, obj); + for (; i < cnt; i++) { + obj = llist_del_first(&c->waiting_for_gp_ttrace); + if (!obj) + break; + add_obj_to_free_list(c, obj); + } } if (i >= cnt) return; @@ -284,8 +285,12 @@ static int free_all(struct bpf_mem_cache *c, struct llist_node *llnode, bool per static void __free_rcu(struct rcu_head *head) { struct bpf_mem_cache *c = container_of(head, struct bpf_mem_cache, rcu_ttrace); + struct llist_node *llnode; - free_all(c, llist_del_all(&c->waiting_for_gp_ttrace), !!c->percpu_size); + scoped_guard(raw_spinlock_irqsave, &c->lock) + llnode = llist_del_all(&c->waiting_for_gp_ttrace); + + free_all(c, llnode, !!c->percpu_size); atomic_set(&c->call_rcu_ttrace_in_progress, 0); } @@ -316,7 +321,8 @@ static void do_call_rcu_ttrace(struct bpf_mem_cache *c) if (atomic_xchg(&c->call_rcu_ttrace_in_progress, 1)) { if (unlikely(READ_ONCE(c->draining))) { - llnode = llist_del_all(&c->free_by_rcu_ttrace); + scoped_guard(raw_spinlock_irqsave, &c->lock) + llnode = llist_del_all(&c->free_by_rcu_ttrace); free_all(c, llnode, !!c->percpu_size); } return; @@ -532,6 +538,7 @@ int bpf_mem_alloc_init(struct bpf_mem_alloc *ma, int size, bool percpu) c->objcg = objcg; c->percpu_size = percpu_size; c->tgt = c; + raw_spin_lock_init(&c->lock); init_refill_work(c); prefill_mem_cache(c, cpu); } @@ -556,7 +563,7 @@ int bpf_mem_alloc_init(struct bpf_mem_alloc *ma, int size, bool percpu) c->unit_size = sizes[i]; c->objcg = objcg; c->tgt = c; - + raw_spin_lock_init(&c->lock); init_refill_work(c); prefill_mem_cache(c, cpu); } -- 2.34.1

2 1

[PATCH OLK-6.6] netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag
by superdcc97＠163.com 05 Sep '26

05 Sep '26

From: David Carlier <devnexen(a)gmail.com> mainline inclusion from mainline-v7.2-rc1 commit e052f920773b73be49eb4d8702a9f85de7464363 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18534 CVE: CVE-2026-80634 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The DEV_PATH_BR_VLAN_UNTAG case post-decrements info->num_encaps inside WARN_ON_ONCE(). num_encaps is u8, so if it's already 0 the decrement still happens and wraps it to 255. The break only leaves the inner switch -- a later path entry can set info->indev back to a real device, and we end up returning with num_encaps == 255. nft_dev_forward_path() then walks info.encap[] (size 2) up to num_encaps, which means an OOB stack read and a bogus count copied into the route descriptor. Should only happen on a malformed bridge path stack, hence the WARN, but worth handling sanely. Move the decrement out of the WARN. [ While at this, remove the WARN_ON_ONCE since this can only happen with a buggy bridge path stack --pablo ]. Fixes: e990cef6516d ("netfilter: flowtable: add bridge vlan filtering support") Signed-off-by: David Carlier <devnexen(a)gmail.com> Reviewed-by: Fernando Fernandez Mancera <fmancera(a)suse.de> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: net/netfilter/nft_flow_offload.c net/netfilter/nf_flow_table_path.c [commit 93d7a7ed0734 is not backport] Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/nft_flow_offload.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c index 2df9178d423a..b0472efd59b4 100644 --- a/net/netfilter/nft_flow_offload.c +++ b/net/netfilter/nft_flow_offload.c @@ -143,22 +143,23 @@ static void nft_dev_path_info(const struct net_device_path_stack *stack, if (info->num_encaps >= NF_FLOW_TABLE_ENCAP_MAX) { info->indev = NULL; break; } info->encap[info->num_encaps].id = path->bridge.vlan_id; info->encap[info->num_encaps].proto = path->bridge.vlan_proto; info->num_encaps++; break; case DEV_PATH_BR_VLAN_UNTAG: - if (WARN_ON_ONCE(info->num_encaps-- == 0)) { + if (info->num_encaps == 0) { info->indev = NULL; break; } + info->num_encaps--; break; case DEV_PATH_BR_VLAN_KEEP: break; } info->xmit_type = FLOW_OFFLOAD_XMIT_DIRECT; break; default: info->indev = NULL; break; -- 2.43.0

2 1

[PATCH OLK-6.6 0/4] Fix CVE-2026-74264
by JiangJieHua 04 Sep '26

04 Sep '26

Eric Dumazet (3): net: watchdog: rename __dev_watchdog_up() and dev_watchdog_down() net: watchdog: fix refcount tracking races net: do not acquire dev->tx_global_lock in netdev_watchdog_up() JiangJieHua (1): net: watchdog: fix kabi breakage of struct net_device drivers/net/ethernet/freescale/ucc_geth.c | 2 +- include/linux/netdevice.h | 9 ++-- net/core/dev.c | 5 +- net/sched/sch_generic.c | 60 ++++++++++++++--------- 4 files changed, 46 insertions(+), 30 deletions(-) -- 2.33.8

2 5

[PATCH openEuler-1.0-LTS] configfs_lookup(): don't leave ->s_dentry dangling on failure
by Ran Hongyun 04 Sep '26

04 Sep '26

mainline inclusion from mainline-v7.2-rc1 commit 10da12d352b7b2bb330a8609fdda9a58bf0e9856 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18161 CVE: CVE-2026-74359 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Normally ->s_dentry is cleared when dentry it's pointing to becomes negative (on eviction, realistically). However, that only happens if dentry gets to be positive in the first place; in case of inode allocation failure dentry never becomes positive, so ->d_iput() is not called at all. We do part of what normally would've been done by configfs_d_iput() (dropping the reference to configfs_dirent) manually, but we do not clear ->s_dentry there. Sloppy as it is, it does not matter in case of configfs_create_{dir,link}() - there configfs_dirent does not survive dropping the sole reference to it. However, for configfs_lookup() it *does* survive, with a dangling pointer to soon to be freed dentry sitting it its ->s_dentry. Subsequent getdents(2) in that directory will end up dereferencing that pointer in order to pick the inode number. Use after free... This is the minimal fix; the right approach is to set the linkage between dentry and configfs_dirent only after we know that we have an inode, but that takes more surgery and the bug had been there since 2006, so... Fixes: 3d0f89bb1694 ("configfs: Add permission and ownership to configfs objects") # 2.6.16-rc3 Reviewed-by: Jan Kara <jack(a)suse.cz> Reviewed-by: Breno Leitao <leitao(a)debian.org> Signed-off-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Ran Hongyun <ranhongyun1(a)huawei.com> --- fs/configfs/dir.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c index 687735be3cd4..150441b0f5c5 100644 --- a/fs/configfs/dir.c +++ b/fs/configfs/dir.c @@ -476,6 +476,9 @@ static struct dentry * configfs_lookup(struct inode *dir, inode = configfs_create(dentry, mode); if (IS_ERR(inode)) { + spin_lock(&configfs_dirent_lock); + sd->s_dentry = NULL; + spin_unlock(&configfs_dirent_lock); configfs_put(sd); return ERR_CAST(inode); } -- 2.52.0

2 1

[PATCH openEuler-1.0-LTS] configfs: fix lockless traversals of ->s_children
by Ran Hongyun 04 Sep '26

04 Sep '26

mainline inclusion from mainline-v7.2-rc1 commit 9b9e8bb81c41fd27e7b57a1c936fde140548535f category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18047 CVE: CVE-2026-74330 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Having the parent directory locked protects entries from removal by another thread, but it does *not* protect cursors from being moved around by lseek() - or freed, for that matter. Fixes: 6f6107640625 ("configfs: Introduce configfs_dirent_lock") Reviewed-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Al Viro <viro(a)zeniv.linux.org.uk> Conflicts: fs/configfs/dir.c [Context conflicts.] Signed-off-by: Ran Hongyun <ranhongyun1(a)huawei.com> --- fs/configfs/dir.c | 54 +++++++++++++++++++++++++++++++++++------------ 1 file changed, 41 insertions(+), 13 deletions(-) diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c index 687735be3cd4..776ca9d80b48 100644 --- a/fs/configfs/dir.c +++ b/fs/configfs/dir.c @@ -242,15 +242,16 @@ static int configfs_dirent_exists(struct configfs_dirent *parent_sd, { struct configfs_dirent * sd; + spin_lock(&configfs_dirent_lock); list_for_each_entry(sd, &parent_sd->s_children, s_sibling) { if (sd->s_element) { - const unsigned char *existing = configfs_get_name(sd); - if (strcmp(existing, new)) - continue; - else + if (strcmp(configfs_get_name(sd), new) == 0) { + spin_unlock(&configfs_dirent_lock); return -EEXIST; + } } } + spin_unlock(&configfs_dirent_lock); return 0; } @@ -562,11 +563,28 @@ static void configfs_detach_rollback(struct dentry *dentry) configfs_detach_rollback(sd->s_dentry); } +/* + * Find the next non-cursor. configfs_dirent_lock held by caller. + */ +static struct configfs_dirent *next_dirent(struct configfs_dirent *parent, + struct configfs_dirent *last) +{ + struct configfs_dirent *s; + + s = list_prepare_entry(last, &parent->s_children, s_sibling); + + list_for_each_entry_continue(s, &parent->s_children, s_sibling) { + if (s->s_element) + return s; + } + return NULL; +} + static void detach_attrs(struct config_item * item) { struct dentry * dentry = dget(item->ci_dentry); - struct configfs_dirent * parent_sd; - struct configfs_dirent * sd, * tmp; + struct configfs_dirent *parent_sd; + struct configfs_dirent *sd, *next; if (!dentry) return; @@ -575,15 +593,19 @@ static void detach_attrs(struct config_item * item) dentry->d_name.name); parent_sd = dentry->d_fsdata; - list_for_each_entry_safe(sd, tmp, &parent_sd->s_children, s_sibling) { - if (!sd->s_element || !(sd->s_type & CONFIGFS_NOT_PINNED)) + + spin_lock(&configfs_dirent_lock); + for (sd = next_dirent(parent_sd, NULL); sd; sd = next) { + next = next_dirent(parent_sd, sd); + if (!(sd->s_type & CONFIGFS_NOT_PINNED)) continue; - spin_lock(&configfs_dirent_lock); list_del_init(&sd->s_sibling); spin_unlock(&configfs_dirent_lock); configfs_drop_dentry(sd, dentry); configfs_put(sd); + spin_lock(&configfs_dirent_lock); } + spin_unlock(&configfs_dirent_lock); /** * Drop reference from dget() on entrance. @@ -632,18 +654,20 @@ static void detach_groups(struct config_group *group) struct dentry * dentry = dget(group->cg_item.ci_dentry); struct dentry *child; struct configfs_dirent *parent_sd; - struct configfs_dirent *sd, *tmp; + struct configfs_dirent *sd, *next; if (!dentry) return; parent_sd = dentry->d_fsdata; - list_for_each_entry_safe(sd, tmp, &parent_sd->s_children, s_sibling) { - if (!sd->s_element || - !(sd->s_type & CONFIGFS_USET_DEFAULT)) + spin_lock(&configfs_dirent_lock); + for (sd = next_dirent(parent_sd, NULL); sd; sd = next) { + next = next_dirent(parent_sd, sd); + if (!(sd->s_type & CONFIGFS_USET_DEFAULT)) continue; child = sd->s_dentry; + spin_unlock(&configfs_dirent_lock); inode_lock(d_inode(child)); @@ -655,7 +679,9 @@ static void detach_groups(struct config_group *group) d_delete(child); dput(child); + spin_lock(&configfs_dirent_lock); } + spin_unlock(&configfs_dirent_lock); /** * Drop reference from dget() on entrance. @@ -1107,6 +1133,7 @@ configfs_find_subsys_dentry(struct configfs_dirent *root_sd, struct configfs_dirent *p; struct configfs_dirent *ret = NULL; + spin_lock(&configfs_dirent_lock); list_for_each_entry(p, &root_sd->s_children, s_sibling) { if (p->s_type & CONFIGFS_DIR && p->s_element == subsys_item) { @@ -1114,6 +1141,7 @@ configfs_find_subsys_dentry(struct configfs_dirent *root_sd, break; } } + spin_unlock(&configfs_dirent_lock); return ret; } -- 2.52.0

2 1

[PATCH openEuler-1.0-LTS 0/2] ovl: check access to copy_file_range source with src mounter creds
by Ran Hongyun 04 Sep '26

04 Sep '26

Export rw_verify_area and check access to copy_file_range source with src mounter creds. Patch 1 export rw_verify_area for verification. Patch 2 check access to copy_file_range source with src mounter creds Ran Hongyun (2): fs: export rw_verify_area() ovl: check access to copy_file_range source with src mounter creds fs/internal.h | 4 ---- fs/overlayfs/file.c | 17 +++++++++++++++++ fs/read_write.c | 1 + include/linux/fs.h | 1 + 4 files changed, 19 insertions(+), 4 deletions(-) -- 2.52.0

2 1

[PATCH OLK-5.10] configfs_lookup(): don't leave ->s_dentry dangling on failure
by Ran Hongyun 04 Sep '26

04 Sep '26

mainline inclusion from mainline-v7.2-rc1 commit 10da12d352b7b2bb330a8609fdda9a58bf0e9856 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18161 CVE: CVE-2026-74359 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Normally ->s_dentry is cleared when dentry it's pointing to becomes negative (on eviction, realistically). However, that only happens if dentry gets to be positive in the first place; in case of inode allocation failure dentry never becomes positive, so ->d_iput() is not called at all. We do part of what normally would've been done by configfs_d_iput() (dropping the reference to configfs_dirent) manually, but we do not clear ->s_dentry there. Sloppy as it is, it does not matter in case of configfs_create_{dir,link}() - there configfs_dirent does not survive dropping the sole reference to it. However, for configfs_lookup() it *does* survive, with a dangling pointer to soon to be freed dentry sitting it its ->s_dentry. Subsequent getdents(2) in that directory will end up dereferencing that pointer in order to pick the inode number. Use after free... This is the minimal fix; the right approach is to set the linkage between dentry and configfs_dirent only after we know that we have an inode, but that takes more surgery and the bug had been there since 2006, so... Fixes: 3d0f89bb1694 ("configfs: Add permission and ownership to configfs objects") # 2.6.16-rc3 Reviewed-by: Jan Kara <jack(a)suse.cz> Reviewed-by: Breno Leitao <leitao(a)debian.org> Signed-off-by: Al Viro <viro(a)zeniv.linux.org.uk> Signed-off-by: Ran Hongyun <ranhongyun1(a)huawei.com> --- fs/configfs/dir.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c index 8c1a8d6a1861..c142e012573a 100644 --- a/fs/configfs/dir.c +++ b/fs/configfs/dir.c @@ -463,6 +463,9 @@ static struct dentry * configfs_lookup(struct inode *dir, inode = configfs_create(dentry, mode); if (IS_ERR(inode)) { + spin_lock(&configfs_dirent_lock); + sd->s_dentry = NULL; + spin_unlock(&configfs_dirent_lock); configfs_put(sd); return ERR_CAST(inode); } -- 2.52.0

2 1

[PATCH OLK-5.10] configfs: fix lockless traversals of ->s_children
by Ran Hongyun 04 Sep '26

04 Sep '26

mainline inclusion from mainline-v7.2-rc1 commit 9b9e8bb81c41fd27e7b57a1c936fde140548535f category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18047 CVE: CVE-2026-74330 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Having the parent directory locked protects entries from removal by another thread, but it does *not* protect cursors from being moved around by lseek() - or freed, for that matter. Fixes: 6f6107640625 ("configfs: Introduce configfs_dirent_lock") Reviewed-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Al Viro <viro(a)zeniv.linux.org.uk> Conflicts: fs/configfs/dir.c [Context conflicts.] Signed-off-by: Ran Hongyun <ranhongyun1(a)huawei.com> --- fs/configfs/dir.c | 54 +++++++++++++++++++++++++++++++++++------------ 1 file changed, 41 insertions(+), 13 deletions(-) diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c index 8c1a8d6a1861..4913c1cecfb5 100644 --- a/fs/configfs/dir.c +++ b/fs/configfs/dir.c @@ -227,15 +227,16 @@ static int configfs_dirent_exists(struct configfs_dirent *parent_sd, { struct configfs_dirent * sd; + spin_lock(&configfs_dirent_lock); list_for_each_entry(sd, &parent_sd->s_children, s_sibling) { if (sd->s_element) { - const unsigned char *existing = configfs_get_name(sd); - if (strcmp(existing, new)) - continue; - else + if (strcmp(configfs_get_name(sd), new) == 0) { + spin_unlock(&configfs_dirent_lock); return -EEXIST; + } } } + spin_unlock(&configfs_dirent_lock); return 0; } @@ -549,11 +550,28 @@ static void configfs_detach_rollback(struct dentry *dentry) configfs_detach_rollback(sd->s_dentry); } +/* + * Find the next non-cursor. configfs_dirent_lock held by caller. + */ +static struct configfs_dirent *next_dirent(struct configfs_dirent *parent, + struct configfs_dirent *last) +{ + struct configfs_dirent *s; + + s = list_prepare_entry(last, &parent->s_children, s_sibling); + + list_for_each_entry_continue(s, &parent->s_children, s_sibling) { + if (s->s_element) + return s; + } + return NULL; +} + static void detach_attrs(struct config_item * item) { struct dentry * dentry = dget(item->ci_dentry); - struct configfs_dirent * parent_sd; - struct configfs_dirent * sd, * tmp; + struct configfs_dirent *parent_sd; + struct configfs_dirent *sd, *next; if (!dentry) return; @@ -562,15 +580,19 @@ static void detach_attrs(struct config_item * item) dentry->d_name.name); parent_sd = dentry->d_fsdata; - list_for_each_entry_safe(sd, tmp, &parent_sd->s_children, s_sibling) { - if (!sd->s_element || !(sd->s_type & CONFIGFS_NOT_PINNED)) + + spin_lock(&configfs_dirent_lock); + for (sd = next_dirent(parent_sd, NULL); sd; sd = next) { + next = next_dirent(parent_sd, sd); + if (!(sd->s_type & CONFIGFS_NOT_PINNED)) continue; - spin_lock(&configfs_dirent_lock); list_del_init(&sd->s_sibling); spin_unlock(&configfs_dirent_lock); configfs_drop_dentry(sd, dentry); configfs_put(sd); + spin_lock(&configfs_dirent_lock); } + spin_unlock(&configfs_dirent_lock); /** * Drop reference from dget() on entrance. @@ -619,18 +641,20 @@ static void detach_groups(struct config_group *group) struct dentry * dentry = dget(group->cg_item.ci_dentry); struct dentry *child; struct configfs_dirent *parent_sd; - struct configfs_dirent *sd, *tmp; + struct configfs_dirent *sd, *next; if (!dentry) return; parent_sd = dentry->d_fsdata; - list_for_each_entry_safe(sd, tmp, &parent_sd->s_children, s_sibling) { - if (!sd->s_element || - !(sd->s_type & CONFIGFS_USET_DEFAULT)) + spin_lock(&configfs_dirent_lock); + for (sd = next_dirent(parent_sd, NULL); sd; sd = next) { + next = next_dirent(parent_sd, sd); + if (!(sd->s_type & CONFIGFS_USET_DEFAULT)) continue; child = sd->s_dentry; + spin_unlock(&configfs_dirent_lock); inode_lock(d_inode(child)); @@ -642,7 +666,9 @@ static void detach_groups(struct config_group *group) d_delete(child); dput(child); + spin_lock(&configfs_dirent_lock); } + spin_unlock(&configfs_dirent_lock); /** * Drop reference from dget() on entrance. @@ -1094,6 +1120,7 @@ configfs_find_subsys_dentry(struct configfs_dirent *root_sd, struct configfs_dirent *p; struct configfs_dirent *ret = NULL; + spin_lock(&configfs_dirent_lock); list_for_each_entry(p, &root_sd->s_children, s_sibling) { if (p->s_type & CONFIGFS_DIR && p->s_element == subsys_item) { @@ -1101,6 +1128,7 @@ configfs_find_subsys_dentry(struct configfs_dirent *root_sd, break; } } + spin_unlock(&configfs_dirent_lock); return ret; } -- 2.52.0

2 1

[PATCH OLK-5.10 0/2] ovl: check access to copy_file_range source with src mounter creds
by Ran Hongyun 04 Sep '26

04 Sep '26

Export rw_verify_area and check access to copy_file_range source with src mounter creds. Patch 1 export rw_verify_area for verification. Patch 2 check access to copy_file_range source with src mounter creds Ran Hongyun (2): fs: export rw_verify_area() ovl: check access to copy_file_range source with src mounter creds fs/internal.h | 5 ----- fs/overlayfs/file.c | 17 +++++++++++++++++ fs/read_write.c | 1 + include/linux/fs.h | 1 + 4 files changed, 19 insertions(+), 5 deletions(-) -- 2.52.0

2 1

[PATCH OLK-6.6] ovl: check access to copy_file_range source with src mounter creds
by Ran Hongyun 04 Sep '26

04 Sep '26

mainline inclusion from mainline-v7.2-rc5 commit a1e0eb8f55cfe09bb31a202a388babc411292656 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17160 CVE: CVE-2026-68448 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Commit 5dae222a5ff0c ("vfs: allow copy_file_range to copy across devices") allowed filesystems that implement the copy_file_range() f_op to decide if they want to access cross-sb copy from/to the same fs type. The same commit added checks to verify same sb copy for filesystems that implement ->copy_file_range() and do not support cross-sb copy at the time, namely, to ceph, fuse and nfs. The two remaining fs which implement ->copy_file_range(), cifs and overlayfs started to support cross-sb copy from this time. While overlayfs does support cross-sb copy when the two underlying files are on the same base fs, the copy operation on the two real files from two different overalyfs filesystems is performed with the mounter creds of the destination overlayfs and the read permission access hook for the source file was called with the wrong creds. This could cause either deny of access to copy which would otherwise be allowed (e.g. with splice) or allow read access to file which would otherwise be denied. Fix the latter case by explicitly verifying read access to source file with the source overlayfs mounter creds. The former case remains a quirk of cross-sb overlayfs copy, but userspace could fall back to regular copy so no harm done. Fixes: 5dae222a5ff0c ("vfs: allow copy_file_range to copy across devices") Signed-off-by: Amir Goldstein <amir73il(a)gmail.com> Link: https://patch.msgid.link/20260712122421.203113-1-amir73il@gmail.com Signed-off-by: Christian Brauner (Amutable) <brauner(a)kernel.org> Conflicts: fs/overlayfs/file.c [6f5c84162a30 ("ovl: add override_creds cleanup guard extension for overlayfs") not merged.] Signed-off-by: Ran Hongyun <ranhongyun1(a)huawei.com> --- fs/overlayfs/file.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/fs/overlayfs/file.c b/fs/overlayfs/file.c index d11c104e6ef2..171979f7872b 100644 --- a/fs/overlayfs/file.c +++ b/fs/overlayfs/file.c @@ -487,6 +487,7 @@ static loff_t ovl_copyfile(struct file *file_in, loff_t pos_in, struct file *file_out, loff_t pos_out, loff_t len, unsigned int flags, enum ovl_copyop op) { + struct inode *inode_in = file_inode(file_in); struct inode *inode_out = file_inode(file_out); struct fd real_in, real_out; const struct cred *old_cred; @@ -511,6 +512,22 @@ static loff_t ovl_copyfile(struct file *file_in, loff_t pos_in, goto out_unlock; } + /* + * For cross-sb copy, vfs_copy_file_range() will verify read access with + * the mounter creds of the dest fs mounter, so we need to explicitly + * verify read access with the source mounter creds. + */ + if (unlikely(inode_in->i_sb != inode_out->i_sb)) { + old_cred = ovl_override_creds(inode_in->i_sb); + ret = rw_verify_area(READ, real_in.file, &pos_in, len); + revert_creds(old_cred); + if (unlikely(ret)) { + fdput(real_in); + fdput(real_out); + goto out_unlock; + } + } + old_cred = ovl_override_creds(file_inode(file_out)->i_sb); switch (op) { case OVL_COPY: -- 2.52.0

2 1

[PATCH OLK-6.6] iomap: guard io_size EOF trim against concurrent truncate underflow
by Ran Hongyun 04 Sep '26

04 Sep '26

mainline inclusion from mainline-v7.2-rc2 commit 55ec50d046c03b3724741957f7b007856e36dbe7 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17916 CVE: CVE-2026-72367 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- iomap: fix zero padding data issue in concurrent append writes changed ioend accounting so that io_size tracks only valid data within EOF. This trims io_size when a writeback range extends past end_pos: ioend->io_size += map_len; if (ioend->io_offset + ioend->io_size > end_pos) ioend->io_size = end_pos - ioend->io_offset; However, if end_pos ends up below ioend->io_offset, the subtraction becomes negative and is stored in size_t io_size, causing an unsigned wrap to a huge value. This can happen when writeback continues past byte-level EOF up to a block-aligned range, or when a concurrent truncate shrinks the file after end_pos was sampled in iomap_writeback_handle_eof(). A wrapped io_size can mislead append detection and corrupt completion-time size handling, since filesystem end_io paths consume io_size for decisions such as on-disk EOF updates and unwritten/COW completion ranges. Fix this by clamping io_size to zero when EOF has moved to or before the ioend start offset. This preserves the original intent of trimming io_size to valid in-EOF data while avoiding the underflow. Fixes: 51d20d1dacbe ("iomap: fix zero padding data issue in concurrent append writes") Suggested-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Morduan Zang <zhangdandan(a)uniontech.com> Link: https://patch.msgid.link/9E38E2659B47DC2A+20260624062622.337469-1-zhangdand… Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Christian Brauner (Amutable) <brauner(a)kernel.org> Conflicts: fs/iomap/buffered-io.c [5fcbd555d483 ("iomap: split bios to zone append limits in the submission handlers") not merged.] Signed-off-by: Ran Hongyun <ranhongyun1(a)huawei.com> --- fs/iomap/buffered-io.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/fs/iomap/buffered-io.c b/fs/iomap/buffered-io.c index 1b9177ad7cdd..baa7bbe02fad 100644 --- a/fs/iomap/buffered-io.c +++ b/fs/iomap/buffered-io.c @@ -2002,8 +2002,12 @@ static int iomap_add_to_ioend(struct iomap_writepage_ctx *wpc, * should not be trimmed in such cases. */ wpc->ioend->io_size += len; - if (pos < isize && pos + len > isize) - wpc->ioend->io_size = isize - wpc->ioend->io_offset; + if (wpc->ioend->io_offset + wpc->ioend->io_size > isize) { + if (wpc->ioend->io_offset >= isize) + wpc->ioend->io_size = 0; + else + wpc->ioend->io_size = isize - wpc->ioend->io_offset; + } wbc_account_cgroup_owner(wbc, &folio->page, len); return 0; -- 2.52.0

2 1

[PATCH openEuler-1.0-LTS 2/2] ovl: check access to copy_file_range source with src mounter creds
by Ran Hongyun 04 Sep '26

04 Sep '26

mainline inclusion from mainline-v7.2-rc5 commit a1e0eb8f55cfe09bb31a202a388babc411292656 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17160 CVE: CVE-2026-68448 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Commit 5dae222a5ff0c ("vfs: allow copy_file_range to copy across devices") allowed filesystems that implement the copy_file_range() f_op to decide if they want to access cross-sb copy from/to the same fs type. The same commit added checks to verify same sb copy for filesystems that implement ->copy_file_range() and do not support cross-sb copy at the time, namely, to ceph, fuse and nfs. The two remaining fs which implement ->copy_file_range(), cifs and overlayfs started to support cross-sb copy from this time. While overlayfs does support cross-sb copy when the two underlying files are on the same base fs, the copy operation on the two real files from two different overalyfs filesystems is performed with the mounter creds of the destination overlayfs and the read permission access hook for the source file was called with the wrong creds. This could cause either deny of access to copy which would otherwise be allowed (e.g. with splice) or allow read access to file which would otherwise be denied. Fix the latter case by explicitly verifying read access to source file with the source overlayfs mounter creds. The former case remains a quirk of cross-sb overlayfs copy, but userspace could fall back to regular copy so no harm done. Fixes: 5dae222a5ff0c ("vfs: allow copy_file_range to copy across devices") Signed-off-by: Amir Goldstein <amir73il(a)gmail.com> Link: https://patch.msgid.link/20260712122421.203113-1-amir73il@gmail.com Signed-off-by: Christian Brauner (Amutable) <brauner(a)kernel.org> Conflicts: fs/overlayfs/file.c [6f5c84162a30 ("ovl: add override_creds cleanup guard extension for overlayfs") not merged.] Signed-off-by: Ran Hongyun <ranhongyun1(a)huawei.com> --- fs/overlayfs/file.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/fs/overlayfs/file.c b/fs/overlayfs/file.c index 63b7b2600d81..4d9b73cc31ad 100644 --- a/fs/overlayfs/file.c +++ b/fs/overlayfs/file.c @@ -583,6 +583,7 @@ static ssize_t ovl_copyfile(struct file *file_in, loff_t pos_in, struct file *file_out, loff_t pos_out, u64 len, unsigned int flags, enum ovl_copyop op) { + struct inode *inode_in = file_inode(file_in); struct inode *inode_out = file_inode(file_out); struct fd real_in, real_out; const struct cred *old_cred; @@ -598,6 +599,22 @@ static ssize_t ovl_copyfile(struct file *file_in, loff_t pos_in, return ret; } + /* + * For cross-sb copy, vfs_copy_file_range() will verify read access with + * the mounter creds of the dest fs mounter, so we need to explicitly + * verify read access with the source mounter creds. + */ + if (unlikely(inode_in->i_sb != inode_out->i_sb)) { + old_cred = ovl_override_creds(inode_in->i_sb); + ret = rw_verify_area(READ, real_in.file, &pos_in, len); + revert_creds(old_cred); + if (unlikely(ret)) { + fdput(real_in); + fdput(real_out); + goto out_unlock; + } + } + old_cred = ovl_override_creds(file_inode(file_out)->i_sb); switch (op) { case OVL_COPY: -- 2.52.0

1 0

[PATCH openEuler-1.0-LTS 1/2] fs: export rw_verify_area()
by Ran Hongyun 04 Sep '26

04 Sep '26

mainline inclusion from mainline-v5.18-rc1 commit 871129332d74c9e94bd110932ac4445833995639 category: cleanup bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17160 CVE: CVE-2026-68448 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- I'm adding btrfs ioctls to read and write compressed data, and rather than duplicating the checks in rw_verify_area(), let's just export it. Reviewed-by: Josef Bacik <josef(a)toxicpanda.com> Signed-off-by: Omar Sandoval <osandov(a)fb.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Ran Hongyun <ranhongyun1(a)huawei.com> --- fs/internal.h | 5 ---- fs/read_write.c | 1 + include/linux/fs.h | 1 + 3 files changed, 2 insertions(+), 5 deletions(-) diff --git a/fs/internal.h b/fs/internal.h index a17f76e7651e..71db6ce61a77 100644 --- a/fs/internal.h +++ b/fs/internal.h @@ -151,11 +151,6 @@ extern int d_set_mounted(struct dentry *dentry); extern long prune_dcache_sb(struct super_block *sb, struct shrink_control *sc); extern struct dentry *d_alloc_cursor(struct dentry *); -/* - * read_write.c - */ -extern int rw_verify_area(int, struct file *, const loff_t *, size_t); - /* * pipe.c */ diff --git a/fs/read_write.c b/fs/read_write.c index c90152064615..f026231f9e0b 100644 --- a/fs/read_write.c +++ b/fs/read_write.c @@ -393,6 +393,7 @@ int rw_verify_area(int read_write, struct file *file, const loff_t *ppos, size_t return security_file_permission(file, read_write == READ ? MAY_READ : MAY_WRITE); } +EXPORT_SYMBOL(rw_verify_area); static ssize_t new_sync_read(struct file *filp, char __user *buf, size_t len, loff_t *ppos) { diff --git a/include/linux/fs.h b/include/linux/fs.h index 584957a75822..5714bea3bc3c 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -3135,6 +3135,7 @@ extern loff_t fixed_size_llseek(struct file *file, loff_t offset, int whence, loff_t size); extern loff_t no_seek_end_llseek_size(struct file *, loff_t, int, loff_t); extern loff_t no_seek_end_llseek(struct file *, loff_t, int); +int rw_verify_area(int, struct file *, const loff_t *, size_t); extern int generic_file_open(struct inode * inode, struct file * filp); extern int nonseekable_open(struct inode * inode, struct file * filp); extern int stream_open(struct inode * inode, struct file * filp); -- 2.52.0

1 0

[PATCH OLK-5.10 2/2] ovl: check access to copy_file_range source with src mounter creds
by Ran Hongyun 04 Sep '26

04 Sep '26

mainline inclusion from mainline-v7.2-rc5 commit a1e0eb8f55cfe09bb31a202a388babc411292656 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17160 CVE: CVE-2026-68448 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Commit 5dae222a5ff0c ("vfs: allow copy_file_range to copy across devices") allowed filesystems that implement the copy_file_range() f_op to decide if they want to access cross-sb copy from/to the same fs type. The same commit added checks to verify same sb copy for filesystems that implement ->copy_file_range() and do not support cross-sb copy at the time, namely, to ceph, fuse and nfs. The two remaining fs which implement ->copy_file_range(), cifs and overlayfs started to support cross-sb copy from this time. While overlayfs does support cross-sb copy when the two underlying files are on the same base fs, the copy operation on the two real files from two different overalyfs filesystems is performed with the mounter creds of the destination overlayfs and the read permission access hook for the source file was called with the wrong creds. This could cause either deny of access to copy which would otherwise be allowed (e.g. with splice) or allow read access to file which would otherwise be denied. Fix the latter case by explicitly verifying read access to source file with the source overlayfs mounter creds. The former case remains a quirk of cross-sb overlayfs copy, but userspace could fall back to regular copy so no harm done. Fixes: 5dae222a5ff0c ("vfs: allow copy_file_range to copy across devices") Signed-off-by: Amir Goldstein <amir73il(a)gmail.com> Link: https://patch.msgid.link/20260712122421.203113-1-amir73il@gmail.com Signed-off-by: Christian Brauner (Amutable) <brauner(a)kernel.org> Conflicts: fs/overlayfs/file.c [6f5c84162a30 ("ovl: add override_creds cleanup guard extension for overlayfs") not merged.] Signed-off-by: Ran Hongyun <ranhongyun1(a)huawei.com> --- fs/overlayfs/file.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/fs/overlayfs/file.c b/fs/overlayfs/file.c index 02427e6fdfb0..09651572e633 100644 --- a/fs/overlayfs/file.c +++ b/fs/overlayfs/file.c @@ -696,6 +696,7 @@ static loff_t ovl_copyfile(struct file *file_in, loff_t pos_in, struct file *file_out, loff_t pos_out, loff_t len, unsigned int flags, enum ovl_copyop op) { + struct inode *inode_in = file_inode(file_in); struct inode *inode_out = file_inode(file_out); struct fd real_in, real_out; const struct cred *old_cred; @@ -720,6 +721,22 @@ static loff_t ovl_copyfile(struct file *file_in, loff_t pos_in, goto out_unlock; } + /* + * For cross-sb copy, vfs_copy_file_range() will verify read access with + * the mounter creds of the dest fs mounter, so we need to explicitly + * verify read access with the source mounter creds. + */ + if (unlikely(inode_in->i_sb != inode_out->i_sb)) { + old_cred = ovl_override_creds(inode_in->i_sb); + ret = rw_verify_area(READ, real_in.file, &pos_in, len); + revert_creds(old_cred); + if (unlikely(ret)) { + fdput(real_in); + fdput(real_out); + goto out_unlock; + } + } + old_cred = ovl_override_creds(file_inode(file_out)->i_sb); switch (op) { case OVL_COPY: -- 2.52.0

1 0

[PATCH OLK-5.10 1/2] fs: export rw_verify_area()
by Ran Hongyun 04 Sep '26

04 Sep '26

mainline inclusion from mainline-v5.18-rc1 commit 871129332d74c9e94bd110932ac4445833995639 category: cleanup bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17160 CVE: CVE-2026-68448 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- I'm adding btrfs ioctls to read and write compressed data, and rather than duplicating the checks in rw_verify_area(), let's just export it. Reviewed-by: Josef Bacik <josef(a)toxicpanda.com> Signed-off-by: Omar Sandoval <osandov(a)fb.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Ran Hongyun <ranhongyun1(a)huawei.com> --- fs/internal.h | 5 ----- fs/read_write.c | 1 + include/linux/fs.h | 1 + 3 files changed, 2 insertions(+), 5 deletions(-) diff --git a/fs/internal.h b/fs/internal.h index 20974758595b..9da6a6d90a93 100644 --- a/fs/internal.h +++ b/fs/internal.h @@ -190,11 +190,6 @@ extern char *simple_dname(struct dentry *, char *, int); extern void dput_to_list(struct dentry *, struct list_head *); extern void shrink_dentry_list(struct list_head *); -/* - * read_write.c - */ -extern int rw_verify_area(int, struct file *, const loff_t *, size_t); - /* * pipe.c */ diff --git a/fs/read_write.c b/fs/read_write.c index a850bb1b0a77..679e408e94b7 100644 --- a/fs/read_write.c +++ b/fs/read_write.c @@ -397,6 +397,7 @@ int rw_verify_area(int read_write, struct file *file, const loff_t *ppos, size_t return security_file_permission(file, read_write == READ ? MAY_READ : MAY_WRITE); } +EXPORT_SYMBOL(rw_verify_area); static ssize_t new_sync_read(struct file *filp, char __user *buf, size_t len, loff_t *ppos) { diff --git a/include/linux/fs.h b/include/linux/fs.h index 8ca24d2f79f9..057000368f6e 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -3246,6 +3246,7 @@ extern loff_t fixed_size_llseek(struct file *file, loff_t offset, int whence, loff_t size); extern loff_t no_seek_end_llseek_size(struct file *, loff_t, int, loff_t); extern loff_t no_seek_end_llseek(struct file *, loff_t, int); +int rw_verify_area(int, struct file *, const loff_t *, size_t); extern int generic_file_open(struct inode * inode, struct file * filp); extern int nonseekable_open(struct inode * inode, struct file * filp); extern int stream_open(struct inode * inode, struct file * filp); -- 2.52.0

1 0

[PATCH OLK-5.10] drm/vmwgfx: Validate vmw_surface_metadata::array_size
by Hongtao Zhang 04 Sep '26

04 Sep '26

From: Ian Forbes <ian.forbes(a)broadcom.com> stable inclusion from stable-v5.10.265 commit e949adf2d42678fb391a41db277e2fcb12090566 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17161 CVE: CVE-2026-68446 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit a4f55260f7f7d4dc4d0ee55063dfb0c457b77991 upstream. This field comes from userspace and should be validated against specific limits depending on which Shader Model (SM) is available. Fixes: 504901dbb0b5 ("drm/vmwgfx: Refactor surface_define to use vmw_surface_metadata") Reported-by: Zero Day Initiative <zdi-disclosures(a)trendmicro.com> Cc: stable(a)vger.kernel.org Signed-off-by: Ian Forbes <ian.forbes(a)broadcom.com> Reviewed-by: Maaz Mombasawala <maaz.mombasawala(a)broadcom.com> Signed-off-by: Zack Rusin <zack.rusin(a)broadcom.com> Link: https://patch.msgid.link/20260623193314.506257-1-ian.forbes@broadcom.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Hongtao <zhanghongtao35(a)huawei.com> --- drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-) diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c index f1a51371de5b1..0005016a9be75 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c @@ -101,7 +101,7 @@ static int vmw_gb_surface_unbind(struct vmw_resource *res, static int vmw_gb_surface_destroy(struct vmw_resource *res); static int vmw_gb_surface_define_internal(struct drm_device *dev, - struct drm_vmw_gb_surface_create_ext_req *req, + const struct drm_vmw_gb_surface_create_ext_req *req, struct drm_vmw_gb_surface_create_rep *rep, struct drm_file *file_priv); static int @@ -1450,7 +1450,7 @@ int vmw_gb_surface_reference_ext_ioctl(struct drm_device *dev, void *data, */ static int vmw_gb_surface_define_internal(struct drm_device *dev, - struct drm_vmw_gb_surface_create_ext_req *req, + const struct drm_vmw_gb_surface_create_ext_req *req, struct drm_vmw_gb_surface_create_rep *rep, struct drm_file *file_priv) { @@ -1469,9 +1469,21 @@ vmw_gb_surface_define_internal(struct drm_device *dev, req->base.svga3d_flags); /* array_size must be null for non-GL3 host. */ - if (req->base.array_size > 0 && !has_sm4_context(dev_priv)) { - VMW_DEBUG_USER("SM4 surface not supported.\n"); - return -EINVAL; + if (req->base.array_size > 0) { + if (has_sm5_context(dev_priv)) { + if (req->base.array_size > SVGA3D_SM5_MAX_SURFACE_ARRAYSIZE) { + VMW_DEBUG_USER("Invalid Surface Array Size.\n"); + return -EINVAL; + } + } else if (has_sm4_context(dev_priv)) { + if (req->base.array_size > SVGA3D_SM4_MAX_SURFACE_ARRAYSIZE) { + VMW_DEBUG_USER("Invalid Surface Array Size.\n"); + return -EINVAL; + } + } else { + VMW_DEBUG_USER("SM4+ surface not supported.\n"); + return -EINVAL; + } } if (!has_sm4_1_context(dev_priv)) { -- 2.43.0

2 1

[PATCH OLK-5.10] drm/vmwgfx: bound DMA command body size against suffix pointer
by Ziming Du 04 Sep '26

04 Sep '26

From: Zack Rusin <zack.rusin(a)broadcom.com> stable inclusion from stable-v5.10.265 commit eb20f418933bea53375843b27b4022c1810be63b category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17885 CVE: CVE-2026-74443 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f4f1db96bfd68b81053693ba53405b6f510ac16c upstream. vmw_cmd_dma() locates the DMA suffix at (unsigned long) &cmd->body + header->size - sizeof(*suffix) without checking that header->size is large enough to contain both cmd->body and the suffix. An undersized header makes the suffix pointer underflow back into the previous command in the bounce buffer. The verifier later writes suffix->maximumOffset, clobbering verified fields of an already-relocated earlier command -- a TOCTOU on the device-visible command stream that lets one command rewrite another's GMR id, surface id, or other authenticated fields. Reject the command if the body is too small for the suffix to fit. Fixes: 4e4ddd477743 ("drm/vmwgfx: Fix queries if no dma buffer thrashing is occuring.") Cc: stable(a)vger.kernel.org Assisted-by: Claude:claude-opus-4.7 Signed-off-by: Zack Rusin <zack.rusin(a)broadcom.com> Reviewed-by: Ian Forbes <ian.forbes(a)broadcom.com> Link: https://patch.msgid.link/20260505222728.519626-8-zack.rusin@broadcom.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ziming Du <duziming2(a)huawei.com> --- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c index 6e75adaae0bcd..2084b029920c3 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c @@ -1508,6 +1508,12 @@ static int vmw_cmd_dma(struct vmw_private *dev_priv, bool dirty; cmd = container_of(header, typeof(*cmd), header); + + if (unlikely(header->size < sizeof(cmd->body) + sizeof(*suffix))) { + VMW_DEBUG_USER("Illegal SVGA_3D_CMD_SURFACE_DMA size.\n"); + return -EINVAL; + } + suffix = (SVGA3dCmdSurfaceDMASuffix *)((unsigned long) &cmd->body + header->size - sizeof(*suffix)); -- 2.43.0

2 1

[PATCH OLK-6.6] iommu/io-pgtable-arm: Add support for contiguous hint
by Zhang Yuwei 04 Sep '26

04 Sep '26

mail inclusion category: feature bugzilla: NA ------------------------------------------------------------- Add support for the contiguous hint (CONT) bit in ARM LPAE page tables. When a set of consecutive PTEs map a naturally-aligned contiguous block of memory, the CONT bit can be set on all entries in the group to allow the hardware to combine them into a single TLB entry, improving TLB utilization. The contiguous hint sizes per granule are: Page Size | CONT PTE | Block | CONT Block | L1 Block | CONT L1 ----------+----------+---------+------------+----------+--------- 4K | 64K | 2M | 32M | 1G | 16G 16K | 2M | 32M | 1G | | 64K | 2M | 512M | 16G | | Contiguous hint sizes are advertised in pgsize_bitmap so that IOMMU API users can align allocations to these sizes and benefit from the TLB optimization automatically. Partial unmaps of a contiguous group are rejected, ensuring the full group is always invalidated as a unit. The IO_PGTABLE_QUIRK_ARM_NO_CONT_HINT quirk allows SMMU drivers to disable contiguous hint support at runtime for hardware with implementation-specific errata. Suggested-by: Robin Murphy <robin.murphy(a)arm.com> Co-developed-by: Vijayanand Jitta <vijayanand.jitta(a)oss.qualcomm.com> Signed-off-by: Vijayanand Jitta <vijayanand.jitta(a)oss.qualcomm.com> Signed-off-by: Prakash Gupta <prakash.gupta(a)oss.qualcomm.com> Signed-off-by: Zhang Yuwei <zhangyuwei20(a)huawei.com> --- drivers/iommu/io-pgtable-arm.c | 242 +++++++++++++++++++++++++++++++-- include/linux/io-pgtable.h | 3 + 2 files changed, 235 insertions(+), 10 deletions(-) diff --git a/drivers/iommu/io-pgtable-arm.c b/drivers/iommu/io-pgtable-arm.c index aecd5939e7b2..5c2e09cd8ec5 100644 --- a/drivers/iommu/io-pgtable-arm.c +++ b/drivers/iommu/io-pgtable-arm.c @@ -93,6 +93,21 @@ /* Software bit for solving coherency races */ #define ARM_LPAE_PTE_SW_SYNC (((arm_lpae_iopte)1) << 55) +/* PTE Contiguous Bit */ +#define ARM_LPAE_PTE_CONT (((arm_lpae_iopte)1) << 52) + +/* + * Contiguous hint group sizes per granule: + * + *------------------------------------------------------------------ + *| Page Size | CONT PTE | Block | CONT Block | L1 Block | CONT L1 | + *------------------------------------------------------------------ + *| 4K | 64K | 2M | 32M | 1G | 16G | + *| 16K | 2M | 32M | 1G | | | + *| 64K | 2M | 512M | 16G | | | + *------------------------------------------------------------------ +*/ + /* Stage-1 PTE */ #define ARM_LPAE_PTE_AP_UNPRIV (((arm_lpae_iopte)1) << 6) #define ARM_LPAE_PTE_AP_RDONLY_BIT 7 @@ -408,6 +423,137 @@ static arm_lpae_iopte arm_lpae_install_table(arm_lpae_iopte *table, return old; } +static int arm_lpae_num_cont(size_t size) +{ + switch (size) { + case SZ_4K: + case SZ_2M: + case SZ_1G: + return 16; + case SZ_64K: + case SZ_32M: + case SZ_512M: + return 32; + case SZ_16K: + return 128; + default: + return 1; + } +} + +/* + * A group is only usable if its span fits within both the configured + * ias and oas. Otherwise no aligned iova/paddr pair for a full group + * can exist, and advertising the size would let callers pick a + * mapping that unconditionally fails. + */ +static bool arm_lpae_cont_size_fits(struct io_pgtable_cfg *cfg, unsigned long size) +{ + int size_bits = ilog2(size); + + return size_bits <= cfg->ias && size_bits <= cfg->oas; +} + +static unsigned long arm_lpae_get_cont_sizes(struct io_pgtable_cfg *cfg) +{ + unsigned long pg_size, blk_size, l1_blk_size, cont_sizes = 0; + unsigned long cont_leaf_size, cont_blk_size, cont_l1_blk_size; + int pg_shift, bits_per_level; + + if (!cfg->pgsize_bitmap || (cfg->quirks & IO_PGTABLE_QUIRK_ARM_NO_CONT_HINT)) + return 0; + + pg_shift = __ffs(cfg->pgsize_bitmap); + bits_per_level = pg_shift - ilog2(sizeof(arm_lpae_iopte)); + pg_size = 1UL << pg_shift; + blk_size = pg_size << bits_per_level; + l1_blk_size = blk_size << bits_per_level; + + cont_leaf_size = arm_lpae_num_cont(pg_size) * pg_size; + if ((cfg->pgsize_bitmap & pg_size) && + arm_lpae_cont_size_fits(cfg, cont_leaf_size)) + cont_sizes |= cont_leaf_size; + + if (cfg->pgsize_bitmap & blk_size) { + cont_blk_size = arm_lpae_num_cont(blk_size) * blk_size; + if (arm_lpae_cont_size_fits(cfg, cont_blk_size)) + cont_sizes |= cont_blk_size; + } + + /* + * l1_blk_size is only set in pgsize_bitmap if level-1 blocks are + * supported for this granule (not 16K/64K, per + * arm_lpae_restrict_pgsizes()), so no extra gating is needed here. + */ + if (cfg->pgsize_bitmap & l1_blk_size) { + cont_l1_blk_size = arm_lpae_num_cont(l1_blk_size) * l1_blk_size; + if (arm_lpae_cont_size_fits(cfg, cont_l1_blk_size)) + cont_sizes |= cont_l1_blk_size; + } + + return cont_sizes; +} + +/* + * Install num_entries leaf entries starting at ptep (index map_idx_start + * within the current table), tagging arm_lpae_num_cont()-sized groups with + * the contiguous hint where both idx and paddr are aligned to the group + * size. Entries in a misaligned group are installed without the hint. + * + * idx and paddr both advance by block_size per entry, so their alignment + * relative to the group size is invariant across a run of entries within + * this call: once a group qualifies (or fails to), every later whole group + * does too, up to num_entries. This merges each such run into a single + * arm_lpae_init_pte() call instead of one call per group. + */ +static int arm_lpae_install_leaf(struct arm_lpae_io_pgtable *data, + unsigned long iova, phys_addr_t paddr, + arm_lpae_iopte prot, int lvl, + int map_idx_start, int num_entries, int num_cont, + arm_lpae_iopte *ptep, size_t *mapped) +{ + size_t block_size = ARM_LPAE_BLOCK_SIZE(lvl, data); + size_t cont_size = num_cont * block_size; + int done = 0; + + while (done < num_entries) { + int idx = map_idx_start + done; + int remaining = num_entries - done; + int off = idx % num_cont; + arm_lpae_iopte pte = prot; + int chunk, ret; + + if (off) { + /* Misaligned prefix: advance to the next boundary */ + chunk = min_t(int, num_cont - off, remaining); + } else if (remaining >= num_cont && IS_ALIGNED(paddr, cont_size)) { + /* Aligned: merge every full group in this run */ + chunk = remaining - remaining % num_cont; + pte |= ARM_LPAE_PTE_CONT; + } else { + /* + * Aligned idx but paddr doesn't line up with cont_size, + * or too short for a full group. That holds for the + * rest of this call too, so install the remainder + * plain in one go. + */ + chunk = remaining; + } + + ret = arm_lpae_init_pte(data, iova, paddr, pte, lvl, chunk, ptep); + if (ret) + return ret; + + *mapped += chunk * block_size; + ptep += chunk; + iova += chunk * block_size; + paddr += chunk * block_size; + done += chunk; + } + + return 0; +} + static int __arm_lpae_map(struct arm_lpae_io_pgtable *data, unsigned long iova, phys_addr_t paddr, size_t size, size_t pgcount, arm_lpae_iopte prot, int lvl, arm_lpae_iopte *ptep, @@ -417,21 +563,44 @@ static int __arm_lpae_map(struct arm_lpae_io_pgtable *data, unsigned long iova, size_t block_size = ARM_LPAE_BLOCK_SIZE(lvl, data); size_t tblsz = ARM_LPAE_GRANULE(data); struct io_pgtable_cfg *cfg = &data->iop.cfg; - int ret = 0, num_entries, max_entries, map_idx_start; + bool cont_hint_enabled = !(cfg->quirks & IO_PGTABLE_QUIRK_ARM_NO_CONT_HINT); + int num_entries, max_entries, map_idx_start; + int num_cont = cont_hint_enabled ? arm_lpae_num_cont(block_size) : 1; + bool use_cont = cont_hint_enabled && num_cont > 1; /* Find our entry at the current level */ map_idx_start = ARM_LPAE_LVL_IDX(iova, lvl, data); ptep += map_idx_start; + /* + * Normalize an exact whole-CONT-group request down to the + * equivalent block_size/pgcount so it funnels through the same + * leaf path below. arm_lpae_install_leaf() independently decides, + * per sub-chunk, whether the CONT hint actually applies. + */ + if (use_cont && size == block_size * num_cont) { + pgcount *= num_cont; + size = block_size; + } + /* If we can install a leaf entry at this level, then do so */ if (size == block_size) { + int ret; + max_entries = arm_lpae_max_entries(map_idx_start, data); - num_entries = min_t(int, pgcount, max_entries); - ret = arm_lpae_init_pte(data, iova, paddr, prot, lvl, num_entries, ptep); - if (!ret) - *mapped += num_entries * size; + num_entries = min_t(size_t, pgcount, max_entries); - return ret; + if (!use_cont) { + ret = arm_lpae_init_pte(data, iova, paddr, prot, lvl, + num_entries, ptep); + if (!ret) + *mapped += num_entries * size; + return ret; + } + + return arm_lpae_install_leaf(data, iova, paddr, prot, lvl, + map_idx_start, num_entries, + num_cont, ptep, mapped); } /* We can't allocate tables at the final level */ @@ -683,6 +852,8 @@ static size_t __arm_lpae_unmap(struct arm_lpae_io_pgtable *data, { arm_lpae_iopte pte; struct io_pgtable *iop = &data->iop; + size_t block_size = ARM_LPAE_BLOCK_SIZE(lvl, data); + int num_cont = arm_lpae_num_cont(block_size); int i = 0, num_entries, max_entries, unmap_idx_start; /* Something went horribly wrong and we ran out of page table */ @@ -695,16 +866,62 @@ static size_t __arm_lpae_unmap(struct arm_lpae_io_pgtable *data, if (WARN_ON(!pte)) return 0; + /* + * Normalize an exact whole-CONT-group request down to the + * equivalent block_size/pgcount, mirroring __arm_lpae_map(). + */ + if (!(data->iop.cfg.quirks & IO_PGTABLE_QUIRK_ARM_NO_CONT_HINT) && + num_cont > 1 && size == block_size * num_cont) { + pgcount *= num_cont; + size = block_size; + } + /* If the size matches this level, we're in the right place */ - if (size == ARM_LPAE_BLOCK_SIZE(lvl, data)) { + if (size == block_size) { + size_t cont_size = num_cont * block_size; + max_entries = arm_lpae_max_entries(unmap_idx_start, data); - num_entries = min_t(int, pgcount, max_entries); + num_entries = min_t(size_t, pgcount, max_entries); while (i < num_entries) { pte = READ_ONCE(*ptep); if (WARN_ON(!pte)) break; + /* + * A real CONT group must always be invalidated as a + * unit, so reject an unmap that splits one. Check the + * PTE's own CONT bit rather than the caller's size, + * since a legitimate unmap can span multiple prior + * iommu_map() calls and its size alone doesn't say how + * the underlying PTEs were grouped. Only the first and + * last entries can straddle a group boundary; an + * interior CONT-tagged entry's group is necessarily + * fully covered by this unmap, since groups can't + * overlap without also covering everything between + * them. + */ + if (pte & ARM_LPAE_PTE_CONT) { + bool ok = true; + + if (i == 0) + ok = ok && IS_ALIGNED(iova, cont_size); + if (i == num_entries - 1) + ok = ok && IS_ALIGNED(iova + (i + 1) * block_size, + cont_size); + + /* + * Stop short of this entry instead of returning + * 0: entries before i may already have had + * non-leaf sub-tables torn down above, so the + * caller needs the real unmapped count, and the + * loop exit below still clears/gathers entries + * [0, i) correctly. + */ + if (WARN_ON_ONCE(!ok)) + break; + } + __arm_lpae_clear_pte(ptep, &iop->cfg); if (!iopte_leaf(pte, lvl, iop->fmt)) { @@ -1295,6 +1512,7 @@ static void arm_lpae_restrict_pgsizes(struct io_pgtable_cfg *cfg) } cfg->pgsize_bitmap &= page_sizes; + cfg->pgsize_bitmap |= arm_lpae_get_cont_sizes(cfg); cfg->ias = min(cfg->ias, max_addr_bits); cfg->oas = min(cfg->oas, max_addr_bits); } @@ -1358,7 +1576,8 @@ arm_64_lpae_alloc_pgtable_s1(struct io_pgtable_cfg *cfg, void *cookie) IO_PGTABLE_QUIRK_ARM_HD | IO_PGTABLE_QUIRK_ARM_BBML1 | IO_PGTABLE_QUIRK_ARM_BBML2 | - IO_PGTABLE_QUIRK_HISI_ERRATA)) + IO_PGTABLE_QUIRK_HISI_ERRATA | + IO_PGTABLE_QUIRK_ARM_NO_CONT_HINT)) return NULL; data = arm_lpae_alloc_pgtable(cfg); @@ -1464,7 +1683,8 @@ arm_64_lpae_alloc_pgtable_s2(struct io_pgtable_cfg *cfg, void *cookie) IO_PGTABLE_QUIRK_ARM_BBML1 | IO_PGTABLE_QUIRK_ARM_BBML2 | IO_PGTABLE_QUIRK_ARM_S2FWB | - IO_PGTABLE_QUIRK_HISI_ERRATA)) + IO_PGTABLE_QUIRK_HISI_ERRATA | + IO_PGTABLE_QUIRK_ARM_NO_CONT_HINT)) return NULL; data = arm_lpae_alloc_pgtable(cfg); @@ -1591,6 +1811,8 @@ arm_mali_lpae_alloc_pgtable(struct io_pgtable_cfg *cfg, void *cookie) return NULL; cfg->pgsize_bitmap &= (SZ_4K | SZ_2M | SZ_1G); + /* Mali LPAE has no CONT bit - never advertise CONT page sizes */ + cfg->quirks |= IO_PGTABLE_QUIRK_ARM_NO_CONT_HINT; data = arm_lpae_alloc_pgtable(cfg); if (!data) diff --git a/include/linux/io-pgtable.h b/include/linux/io-pgtable.h index 62a0c5b0f55f..16dd83f38744 100644 --- a/include/linux/io-pgtable.h +++ b/include/linux/io-pgtable.h @@ -98,6 +98,8 @@ struct io_pgtable_cfg { * IO_PGTABLE_QUIRK_ARM_BBML2: ARM SMMU supports BBM Level 2 behavior * when changing block size. * IO_PGTABLE_QUIRK_ARM_S2FWB: Use the FWB format for the MemAttrs bits + * IO_PGTABLE_QUIRK_ARM_NO_CONT_HINT: Disable use of the contiguous + * hint for hardware affected by implementation-specific errata. */ #define IO_PGTABLE_QUIRK_ARM_NS BIT(0) #define IO_PGTABLE_QUIRK_NO_PERMS BIT(1) @@ -110,6 +112,7 @@ struct io_pgtable_cfg { #define IO_PGTABLE_QUIRK_ARM_BBML2 BIT(9) #define IO_PGTABLE_QUIRK_ARM_S2FWB BIT(10) #define IO_PGTABLE_QUIRK_HISI_ERRATA BIT(11) + #define IO_PGTABLE_QUIRK_ARM_NO_CONT_HINT BIT(12) unsigned long quirks; unsigned long pgsize_bitmap; unsigned int ias; -- 2.22.0

2 1

[PATCH OLK-5.10] drm/vmwgfx: bound DMA command body size against suffix pointer
by Ziming Du 04 Sep '26

04 Sep '26

From: Zack Rusin <zack.rusin(a)broadcom.com> stable inclusion from stable-v5.10.265 commit eb20f418933bea53375843b27b4022c1810be63b category: bugfix bugzilla: NA CVE: CVE-2026-74443 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f4f1db96bfd68b81053693ba53405b6f510ac16c upstream. vmw_cmd_dma() locates the DMA suffix at (unsigned long) &cmd->body + header->size - sizeof(*suffix) without checking that header->size is large enough to contain both cmd->body and the suffix. An undersized header makes the suffix pointer underflow back into the previous command in the bounce buffer. The verifier later writes suffix->maximumOffset, clobbering verified fields of an already-relocated earlier command -- a TOCTOU on the device-visible command stream that lets one command rewrite another's GMR id, surface id, or other authenticated fields. Reject the command if the body is too small for the suffix to fit. Fixes: 4e4ddd477743 ("drm/vmwgfx: Fix queries if no dma buffer thrashing is occuring.") Cc: stable(a)vger.kernel.org Assisted-by: Claude:claude-opus-4.7 Signed-off-by: Zack Rusin <zack.rusin(a)broadcom.com> Reviewed-by: Ian Forbes <ian.forbes(a)broadcom.com> Link: https://patch.msgid.link/20260505222728.519626-8-zack.rusin@broadcom.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ziming Du <duziming2(a)huawei.com> --- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c index 6e75adaae0bcd..2084b029920c3 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c @@ -1508,6 +1508,12 @@ static int vmw_cmd_dma(struct vmw_private *dev_priv, bool dirty; cmd = container_of(header, typeof(*cmd), header); + + if (unlikely(header->size < sizeof(cmd->body) + sizeof(*suffix))) { + VMW_DEBUG_USER("Illegal SVGA_3D_CMD_SURFACE_DMA size.\n"); + return -EINVAL; + } + suffix = (SVGA3dCmdSurfaceDMASuffix *)((unsigned long) &cmd->body + header->size - sizeof(*suffix)); -- 2.43.0

2 1

[PATCH OLK-5.10] drm/virtio: bound EDID block reads to the response buffer
by Ziming Du 04 Sep '26

04 Sep '26

From: Bryam Vargas <hexlabsecurity(a)proton.me> mainline inclusion from mainline-v7.2-rc2 commit 4e1a53892ba7f8a3e1da6bfc53c83ae7c812dccd category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/17136 CVE: CVE-2026-68255 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- virtio_get_edid_block() validates the read offset only against the device-supplied resp->size field, never against the fixed-size resp->edid array. The EDID block index is driven by the device-supplied extension count, so a malicious virtio-gpu backend can advertise a large size together with a high block count and read far past the array into adjacent kernel memory, which is then surfaced in the parsed EDID (an out-of-bounds read / info leak). Also reject any read whose end exceeds the size of the edid array. Conforming EDID responses stay within the array and are unaffected. Fixes: b4b01b4995fb ("drm/virtio: add edid support") Cc: stable(a)vger.kernel.org Signed-off-by: Bryam Vargas <hexlabsecurity(a)proton.me> Signed-off-by: Dmitry Osipenko <dmitry.osipenko(a)collabora.com> Link: https://patch.msgid.link/20260620-b4-disp-22bba7bf-v1-1-b95924cee742@proton… Conflicts: drivers/gpu/drm/virtio/virtgpu_vq.c [Ziming Du: context conflict due to 4c703f5d6f776eaa6a98611c9b5dfe800fbeb0c8] Signed-off-by: Ziming Du <duziming2(a)huawei.com> --- drivers/gpu/drm/virtio/virtgpu_vq.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c index e98a29d243c08..3f75510bf2407 100644 --- a/drivers/gpu/drm/virtio/virtgpu_vq.c +++ b/drivers/gpu/drm/virtio/virtgpu_vq.c @@ -724,7 +724,8 @@ static int virtio_get_edid_block(void *data, u8 *buf, struct virtio_gpu_resp_edid *resp = data; size_t start = block * EDID_LENGTH; - if (start + len > le32_to_cpu(resp->size)) + if (start + len > le32_to_cpu(resp->size) || + start + len > sizeof(resp->edid)) return -1; memcpy(buf, resp->edid + start, len); return 0; -- 2.43.0

2 1

[PATCH OLK-6.6] cputype: add cputype for HIP13
by Jiacheng Yu 04 Sep '26

04 Sep '26

From: Yushan Wang <wangyushan12(a)huawei.com> driver inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/9850 ---------------------------------------------------------------------- Add new HiSilicon CPU type HIP13. Signed-off-by: Yushan Wang <wangyushan12(a)huawei.com> Signed-off-by: Jiacheng Yu <yujiacheng3(a)huawei.com> --- arch/arm64/include/asm/cputype.h | 2 ++ tools/arch/arm64/include/asm/cputype.h | 2 ++ 2 files changed, 4 insertions(+) diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h index 9cd4532daff3..32e610cb281a 100644 --- a/arch/arm64/include/asm/cputype.h +++ b/arch/arm64/include/asm/cputype.h @@ -147,6 +147,7 @@ #define HISI_CPU_PART_LINXICORE9100 0xD02 #define HISI_CPU_PART_HIP11 0xD22 #define HISI_CPU_PART_HIP12 0xD06 +#define HISI_CPU_PART_HIP13 0xD08 #define APPLE_CPU_PART_M1_ICESTORM 0x022 #define APPLE_CPU_PART_M1_FIRESTORM 0x023 @@ -239,6 +240,7 @@ #define MIDR_HISI_LINXICORE9100 MIDR_CPU_MODEL(ARM_CPU_IMP_HISI, HISI_CPU_PART_LINXICORE9100) #define MIDR_HISI_HIP11 MIDR_CPU_MODEL(ARM_CPU_IMP_HISI, HISI_CPU_PART_HIP11) #define MIDR_HISI_HIP12 MIDR_CPU_MODEL(ARM_CPU_IMP_HISI, HISI_CPU_PART_HIP12) +#define MIDR_HISI_HIP13 MIDR_CPU_MODEL(ARM_CPU_IMP_HISI, HISI_CPU_PART_HIP13) #define MIDR_APPLE_M1_ICESTORM MIDR_CPU_MODEL(ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_ICESTORM) #define MIDR_APPLE_M1_FIRESTORM MIDR_CPU_MODEL(ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_FIRESTORM) #define MIDR_APPLE_M1_ICESTORM_PRO MIDR_CPU_MODEL(ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_ICESTORM_PRO) diff --git a/tools/arch/arm64/include/asm/cputype.h b/tools/arch/arm64/include/asm/cputype.h index c269f3bc87b3..bacb39bd65a9 100644 --- a/tools/arch/arm64/include/asm/cputype.h +++ b/tools/arch/arm64/include/asm/cputype.h @@ -129,6 +129,7 @@ #define HISI_CPU_PART_TSV110 0xD01 #define HISI_CPU_PART_HIP11 0xD22 #define HISI_CPU_PART_HIP12 0xD06 +#define HISI_CPU_PART_HIP13 0xD08 #define APPLE_CPU_PART_M1_ICESTORM 0x022 #define APPLE_CPU_PART_M1_FIRESTORM 0x023 @@ -203,6 +204,7 @@ #define MIDR_HISI_TSV110 MIDR_CPU_MODEL(ARM_CPU_IMP_HISI, HISI_CPU_PART_TSV110) #define MIDR_HISI_HIP11 MIDR_CPU_MODEL(ARM_CPU_IMP_HISI, HISI_CPU_PART_HIP11) #define MIDR_HISI_HIP12 MIDR_CPU_MODEL(ARM_CPU_IMP_HISI, HISI_CPU_PART_HIP12) +#define MIDR_HISI_HIP13 MIDR_CPU_MODEL(ARM_CPU_IMP_HISI, HISI_CPU_PART_HIP13) #define MIDR_APPLE_M1_ICESTORM MIDR_CPU_MODEL(ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_ICESTORM) #define MIDR_APPLE_M1_FIRESTORM MIDR_CPU_MODEL(ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_FIRESTORM) #define MIDR_APPLE_M1_ICESTORM_PRO MIDR_CPU_MODEL(ARM_CPU_IMP_APPLE, APPLE_CPU_PART_M1_ICESTORM_PRO) -- 2.34.1

2 1

[PATCH OLK-6.6 0/4] Fix CVE-2026-74264
by JiangJieHua 04 Sep '26

04 Sep '26

Eric Dumazet (3): net: watchdog: rename __dev_watchdog_up() and dev_watchdog_down() net: watchdog: fix refcount tracking races net: do not acquire dev->tx_global_lock in netdev_watchdog_up() JiangJieHua (1): net: watchdog: fix kabi breakage of struct net_device drivers/net/ethernet/freescale/ucc_geth.c | 2 +- include/linux/netdevice.h | 9 ++-- net/core/dev.c | 5 +- net/sched/sch_generic.c | 60 ++++++++++++++--------- 4 files changed, 46 insertions(+), 30 deletions(-) -- 2.33.8

2 5

[PATCH OLK-6.6 0/4] Fix CVE-2026-74264
by JiangJieHua 04 Sep '26

04 Sep '26

Eric Dumazet (3): net: watchdog: rename __dev_watchdog_up() and dev_watchdog_down() net: watchdog: fix refcount tracking races net: do not acquire dev->tx_global_lock in netdev_watchdog_up() JiangJieHua (1): net: watchdog: fix kabi breakage of struct net_device drivers/net/ethernet/freescale/ucc_geth.c | 2 +- include/linux/netdevice.h | 9 ++-- net/core/dev.c | 5 +- net/sched/sch_generic.c | 60 ++++++++++++++--------- 4 files changed, 46 insertions(+), 30 deletions(-) -- 2.33.8

2 5

[PATCH OLK-6.6 0/4] Fix CVE-2026-74264
by JiangJieHua 04 Sep '26

04 Sep '26

Eric Dumazet (3): net: watchdog: rename __dev_watchdog_up() and dev_watchdog_down() net: watchdog: fix refcount tracking races net: do not acquire dev->tx_global_lock in netdev_watchdog_up() JiangJieHua (1): net: watchdog: fix kabi breakage of struct net_device drivers/net/ethernet/freescale/ucc_geth.c | 2 +- include/linux/netdevice.h | 9 ++-- net/core/dev.c | 5 +- net/sched/sch_generic.c | 60 ++++++++++++++--------- 4 files changed, 46 insertions(+), 30 deletions(-) -- 2.33.8

2 5

[PATCH OLK-5.10 0/2] Fix CVE-2026-80619
by Yi Yang 04 Sep '26

04 Sep '26

The following patches are used to fix the CVE-2026-80619 vulnerability: John Johansen (1): apparmor: fix label can not be immediately before a declaration Maxime Bélair (1): apparmor: fix potential UAF in aa_replace_profiles security/apparmor/policy.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS] ipv4: validate IPV4_DEVCONF attributes properly
by JiangJieHua 04 Sep '26

04 Sep '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9803 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzbot reported a UBSAN undefined behavior issue in vif_delete(): UBSAN: Undefined behaviour in net/ipv4/ipmr.c:720:43 signed integer overflow: -2147483648 - 1 cannot be represented in type 'int' When vif_delete() is called with vifi = -2147483648 (INT_MIN), the operation "vifi - 1" causes a signed integer overflow, which is undefined behavior in C. This occurs because the function does not validate the vifi range before using it as an array index. Fix by adding a check in inet_validate_link_af() to reject IPV4_DEVCONF_MC_FORWARDING attribute, returning -EINVAL when userspace attempts to modify it through netlink. This prevents the overflow and eliminates the UBSAN warning. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: JiangJieHua <jiangjiehua1(a)huawei.com> --- net/ipv4/devinet.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c index 64f0fa0be370e..acf60f0a01a4a 100644 --- a/net/ipv4/devinet.c +++ b/net/ipv4/devinet.c @@ -1796,6 +1796,9 @@ static int inet_validate_link_af(const struct net_device *dev, if (cfgid <= 0 || cfgid > IPV4_DEVCONF_MAX) return -EINVAL; + + if (cfgid == IPV4_DEVCONF_MC_FORWARDING) + return -EINVAL; } } -- 2.33.8

2 1

[PATCH OLK-5.10 0/2] mainline patch submission for OLK-5.10
by Chen Yuxi 03 Sep '26

03 Sep '26

Zide Chen (2): perf/x86/intel/uncore: Keep PCI PMUs working when MMIO/MSR setup fails perf/x86/intel/uncore: Fix uncore_box ref/unref ordering arch/x86/events/intel/uncore.c | 48 ++++++++++++++-------------------- 1 file changed, 20 insertions(+), 28 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/2] mainline patch submission for OLK-6.6
by Chen Yuxi 03 Sep '26

03 Sep '26

Zide Chen (2): perf/x86/intel/uncore: Keep PCI PMUs working when MMIO/MSR setup fails perf/x86/intel/uncore: Fix uncore_box ref/unref ordering arch/x86/events/intel/uncore.c | 48 ++++++++++++++-------------------- 1 file changed, 20 insertions(+), 28 deletions(-) -- 2.34.1

2 3