- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 0/2] *** fix CVE-2025-38062 ***
by Lin Ruifeng 03 Feb '26

03 Feb '26

*** fix CVE-2025-38062 *** Jason Gunthorpe (1): genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie Lin Ruifeng (1): genirq/msi:: Fix kabi break of struct msi_desc drivers/iommu/dma-iommu.c | 28 +++++++++++++--------------- include/linux/msi.h | 35 +++++++++++++++-------------------- 2 files changed, 28 insertions(+), 35 deletions(-) -- 2.43.0

2 3

[PATCH openEuler-1.0-LTS] dm flakey: don't corrupt the zero page
by Yuan can 03 Feb '26

03 Feb '26

From: Mikulas Patocka <mpatocka(a)redhat.com> stable inclusion from stable-v4.19.276 commit 98e311be44dbe31ad9c42aa067b2359bac451fda category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13114 CVE: CVE-2023-54317 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f50714b57aecb6b3dc81d578e295f86d9c73f078 upstream. When we need to zero some range on a block device, the function __blkdev_issue_zero_pages submits a write bio with the bio vector pointing to the zero page. If we use dm-flakey with corrupt bio writes option, it will corrupt the content of the zero page which results in crashes of various userspace programs. Glibc assumes that memory returned by mmap is zeroed and it uses it for calloc implementation; if the newly mapped memory is not zeroed, calloc will return non-zeroed memory. Fix this bug by testing if the page is equal to ZERO_PAGE(0) and avoiding the corruption in this case. Cc: stable(a)vger.kernel.org Fixes: a00f5276e266 ("dm flakey: Properly corrupt multi-page bios.") Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Reviewed-by: Sweet Tea Dorminy <sweettea-kernel(a)dorminy.me> Signed-off-by: Mike Snitzer <snitzer(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuan can <yuancan(a)huawei.com> --- drivers/md/dm-flakey.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/md/dm-flakey.c b/drivers/md/dm-flakey.c index 9a955b8cf378..6a8c7ec21219 100644 --- a/drivers/md/dm-flakey.c +++ b/drivers/md/dm-flakey.c @@ -299,12 +299,15 @@ static void corrupt_bio_data(struct bio *bio, struct flakey_c *fc) * Overwrite the Nth byte of the bio's data, on whichever page * it falls. */ bio_for_each_segment(bvec, bio, iter) { if (bio_iter_len(bio, iter) > corrupt_bio_byte) { - char *segment = (page_address(bio_iter_page(bio, iter)) - + bio_iter_offset(bio, iter)); + char *segment; + struct page *page = bio_iter_page(bio, iter); + if (unlikely(page == ZERO_PAGE(0))) + break; + segment = (page_address(page) + bio_iter_offset(bio, iter)); segment[corrupt_bio_byte] = fc->corrupt_bio_value; DMDEBUG("Corrupting data bio=%p by writing %u to byte %u " "(rw=%c bi_opf=%u bi_sector=%llu size=%u)\n", bio, fc->corrupt_bio_value, fc->corrupt_bio_byte, (bio_data_dir(bio) == WRITE) ? 'w' : 'r', bio->bi_opf, -- 2.34.1

2 1

[PATCH OLK-5.10] atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control().
by Lin Ruifeng 03 Feb '26

03 Feb '26

From: Kuniyuki Iwashima <kuniyu(a)google.com> stable inclusion from stable-v5.10.242 commit 0a6a6d4fb333f7afe22e59ffed18511a7a98efc8 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/12387 CVE: CVE-2025-39828 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ec79003c5f9d2c7f9576fc69b8dbda80305cbe3a ] syzbot reported the splat below. [0] When atmtcp_v_open() or atmtcp_v_close() is called via connect() or close(), atmtcp_send_control() is called to send an in-kernel special message. The message has ATMTCP_HDR_MAGIC in atmtcp_control.hdr.length. Also, a pointer of struct atm_vcc is set to atmtcp_control.vcc. The notable thing is struct atmtcp_control is uAPI but has a space for an in-kernel pointer. struct atmtcp_control { struct atmtcp_hdr hdr; /* must be first */ ... atm_kptr_t vcc; /* both directions */ ... } __ATM_API_ALIGN; typedef struct { unsigned char _[8]; } __ATM_API_ALIGN atm_kptr_t; The special message is processed in atmtcp_recv_control() called from atmtcp_c_send(). atmtcp_c_send() is vcc->dev->ops->send() and called from 2 paths: 1. .ndo_start_xmit() (vcc->send() == atm_send_aal0()) 2. vcc_sendmsg() The problem is sendmsg() does not validate the message length and userspace can abuse atmtcp_recv_control() to overwrite any kptr by atmtcp_control. Let's add a new ->pre_send() hook to validate messages from sendmsg(). [0]: Oops: general protection fault, probably for non-canonical address 0xdffffc00200000ab: 0000 [#1] SMP KASAN PTI KASAN: probably user-memory-access in range [0x0000000100000558-0x000000010000055f] CPU: 0 UID: 0 PID: 5865 Comm: syz-executor331 Not tainted 6.17.0-rc1-syzkaller-00215-gbab3ce404553 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:atmtcp_recv_control drivers/atm/atmtcp.c:93 [inline] RIP: 0010:atmtcp_c_send+0x1da/0x950 drivers/atm/atmtcp.c:297 Code: 4d 8d 75 1a 4c 89 f0 48 c1 e8 03 42 0f b6 04 20 84 c0 0f 85 15 06 00 00 41 0f b7 1e 4d 8d b7 60 05 00 00 4c 89 f0 48 c1 e8 03 <42> 0f b6 04 20 84 c0 0f 85 13 06 00 00 66 41 89 1e 4d 8d 75 1c 4c RSP: 0018:ffffc90003f5f810 EFLAGS: 00010203 RAX: 00000000200000ab RBX: 0000000000000000 RCX: 0000000000000000 RDX: ffff88802a510000 RSI: 00000000ffffffff RDI: ffff888030a6068c RBP: ffff88802699fb40 R08: ffff888030a606eb R09: 1ffff1100614c0dd R10: dffffc0000000000 R11: ffffffff8718fc40 R12: dffffc0000000000 R13: ffff888030a60680 R14: 000000010000055f R15: 00000000ffffffff FS: 00007f8d7e9236c0(0000) GS:ffff888125c1c000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000045ad50 CR3: 0000000075bde000 CR4: 00000000003526f0 Call Trace: <TASK> vcc_sendmsg+0xa10/0xc60 net/atm/common.c:645 sock_sendmsg_nosec net/socket.c:714 [inline] __sock_sendmsg+0x219/0x270 net/socket.c:729 ____sys_sendmsg+0x505/0x830 net/socket.c:2614 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668 __sys_sendmsg net/socket.c:2700 [inline] __do_sys_sendmsg net/socket.c:2705 [inline] __se_sys_sendmsg net/socket.c:2703 [inline] __x64_sys_sendmsg+0x19b/0x260 net/socket.c:2703 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f8d7e96a4a9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f8d7e923198 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f8d7e9f4308 RCX: 00007f8d7e96a4a9 RDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000000005 RBP: 00007f8d7e9f4300 R08: 65732f636f72702f R09: 65732f636f72702f R10: 65732f636f72702f R11: 0000000000000246 R12: 00007f8d7e9c10ac R13: 00007f8d7e9231a0 R14: 0000200000000200 R15: 0000200000000250 </TASK> Modules linked in: Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+1741b56d54536f4ec349(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/68a6767c.050a0220.3d78fd.0011.GAE@google.com/ Tested-by: syzbot+1741b56d54536f4ec349(a)syzkaller.appspotmail.com Signed-off-by: Kuniyuki Iwashima <kuniyu(a)google.com> Link: https://patch.msgid.link/20250821021901.2814721-1-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/atm/atmtcp.c net/atm/common.c [Context Conflicts] Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- drivers/atm/atmtcp.c | 14 ++++++++++++++ include/linux/atmdev.h | 1 + net/atm/common.c | 13 +++++++++++-- 3 files changed, 26 insertions(+), 2 deletions(-) diff --git a/drivers/atm/atmtcp.c b/drivers/atm/atmtcp.c index 96bea1ab1ecc..df2b47472de4 100644 --- a/drivers/atm/atmtcp.c +++ b/drivers/atm/atmtcp.c @@ -279,6 +279,19 @@ static struct atm_vcc *find_vcc(struct atm_dev *dev, short vpi, int vci) return NULL; } +static int atmtcp_c_pre_send(struct atm_vcc *vcc, struct sk_buff *skb) +{ + struct atmtcp_hdr *hdr; + + if (skb->len < sizeof(struct atmtcp_hdr)) + return -EINVAL; + + hdr = (struct atmtcp_hdr *)skb->data; + if (hdr->length == ATMTCP_HDR_MAGIC) + return -EINVAL; + + return 0; +} static int atmtcp_c_send(struct atm_vcc *vcc,struct sk_buff *skb) { @@ -345,6 +358,7 @@ static const struct atmdev_ops atmtcp_v_dev_ops = { static const struct atmdev_ops atmtcp_c_dev_ops = { .close = atmtcp_c_close, + .pre_send = atmtcp_c_pre_send, .send = atmtcp_c_send }; diff --git a/include/linux/atmdev.h b/include/linux/atmdev.h index 5d5ff2203fa2..cedf880259d3 100644 --- a/include/linux/atmdev.h +++ b/include/linux/atmdev.h @@ -185,6 +185,7 @@ struct atmdev_ops { /* only send is required */ int (*compat_ioctl)(struct atm_dev *dev,unsigned int cmd, void __user *arg); #endif + int (*pre_send)(struct atm_vcc *vcc, struct sk_buff *skb); int (*send)(struct atm_vcc *vcc,struct sk_buff *skb); int (*send_oam)(struct atm_vcc *vcc,void *cell,int flags); void (*phy_put)(struct atm_dev *dev,unsigned char value, diff --git a/net/atm/common.c b/net/atm/common.c index 1cfa9bf1d187..cb153d6e6745 100644 --- a/net/atm/common.c +++ b/net/atm/common.c @@ -635,17 +635,26 @@ int vcc_sendmsg(struct socket *sock, struct msghdr *m, size_t size) skb->dev = NULL; /* for paths shared with net_device interfaces */ if (!copy_from_iter_full(skb_put(skb, size), size, &m->msg_iter)) { - kfree_skb(skb); error = -EFAULT; - goto out; + goto free_skb; } if (eff != size) memset(skb->data + size, 0, eff-size); + + if (vcc->dev->ops->pre_send) { + error = vcc->dev->ops->pre_send(vcc, skb); + if (error) + goto free_skb; + } + error = vcc->dev->ops->send(vcc, skb); error = error ? error : size; out: release_sock(sk); return error; +free_skb: + kfree_skb(skb); + goto out; } __poll_t vcc_poll(struct file *file, struct socket *sock, poll_table *wait) -- 2.43.0

2 1

[PATCH OLK-6.6 0/2] *** fix CVE-2025-38062 ***
by Lin Ruifeng 03 Feb '26

03 Feb '26

*** fix CVE-2025-38062 *** Jason Gunthorpe (1): genirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie Lin Ruifeng (1): genirq/msi:: Fix kabi break of struct msi_desc drivers/iommu/dma-iommu.c | 28 +++++++++++++--------------- include/linux/msi.h | 35 +++++++++++++++-------------------- 2 files changed, 28 insertions(+), 35 deletions(-) -- 2.43.0

2 3

[PATCH OLK-6.6] iommu/s390: Implement blocking domain
by Lin Ruifeng 03 Feb '26

03 Feb '26

From: Matthew Rosato <mjrosato(a)linux.ibm.com> mainline inclusion from mainline-v6.13-rc1 commit ecda483339a5151e3ca30d6b82691ef6f1d17912 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/1633 CVE: CVE-2024-53232 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------------------------------------------- This fixes a crash when surprise hot-unplugging a PCI device. This crash happens because during hot-unplug __iommu_group_set_domain_nofail() attaching the default domain fails when the platform no longer recognizes the device as it has already been removed and we end up with a NULL domain pointer and UAF. This is exactly the case referred to in the second comment in __iommu_device_set_domain() and just as stated there if we can instead attach the blocking domain the UAF is prevented as this can handle the already removed device. Implement the blocking domain to use this handling. With this change, the crash is fixed but we still hit a warning attempting to change DMA ownership on a blocked device. Fixes: c76c067e488c ("s390/pci: Use dma-iommu layer") Co-developed-by: Niklas Schnelle <schnelle(a)linux.ibm.com> Signed-off-by: Niklas Schnelle <schnelle(a)linux.ibm.com> Signed-off-by: Matthew Rosato <mjrosato(a)linux.ibm.com> Reviewed-by: Niklas Schnelle <schnelle(a)linux.ibm.com> Reviewed-by: Jason Gunthorpe <jgg(a)nvidia.com> Link: https://lore.kernel.org/r/20240910211516.137933-1-mjrosato@linux.ibm.com Signed-off-by: Joerg Roedel <jroedel(a)suse.de> Conflicts: drivers/iommu/s390-iommu.c arch/s390/pci/pci.c [Some context differences] Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> Signed-off-by: Lin Ruifeng <linruifeng4(a)huawei.com> --- arch/s390/include/asm/pci.h | 4 +- arch/s390/pci/pci_debug.c | 10 ++++- drivers/iommu/s390-iommu.c | 73 +++++++++++++++++++++++-------------- 3 files changed, 56 insertions(+), 31 deletions(-) diff --git a/arch/s390/include/asm/pci.h b/arch/s390/include/asm/pci.h index 3f74f1cf37df..e0fae2739994 100644 --- a/arch/s390/include/asm/pci.h +++ b/arch/s390/include/asm/pci.h @@ -96,7 +96,6 @@ struct zpci_bar_struct { u8 size; /* order 2 exponent */ }; -struct s390_domain; struct kvm_zdev; #define ZPCI_FUNCTIONS_PER_BUS 256 @@ -184,9 +183,10 @@ struct zpci_dev { struct dentry *debugfs_dev; /* IOMMU and passthrough */ - struct s390_domain *s390_domain; /* s390 IOMMU domain data */ + struct iommu_domain *s390_domain; /* attached IOMMU domain */ struct kvm_zdev *kzdev; struct mutex kzdev_lock; + spinlock_t dom_lock; /* protect s390_domain change */ }; static inline bool zdev_enabled(struct zpci_dev *zdev) diff --git a/arch/s390/pci/pci_debug.c b/arch/s390/pci/pci_debug.c index 6dde2263c79d..ac4d172f2740 100644 --- a/arch/s390/pci/pci_debug.c +++ b/arch/s390/pci/pci_debug.c @@ -71,17 +71,23 @@ static void pci_fmb_show(struct seq_file *m, char *name[], int length, static void pci_sw_counter_show(struct seq_file *m) { - struct zpci_iommu_ctrs *ctrs = zpci_get_iommu_ctrs(m->private); + struct zpci_dev *zdev = m->private; + struct zpci_iommu_ctrs *ctrs; atomic64_t *counter; + unsigned long flags; int i; + spin_lock_irqsave(&zdev->dom_lock, flags); + ctrs = zpci_get_iommu_ctrs(m->private); if (!ctrs) - return; + goto unlock; counter = &ctrs->mapped_pages; for (i = 0; i < ARRAY_SIZE(pci_sw_names); i++, counter++) seq_printf(m, "%26s:\t%llu\n", pci_sw_names[i], atomic64_read(counter)); +unlock: + spin_unlock_irqrestore(&zdev->dom_lock, flags); } static int pci_perf_show(struct seq_file *m, void *v) diff --git a/drivers/iommu/s390-iommu.c b/drivers/iommu/s390-iommu.c index 9a5196f523de..db9fc74f9027 100644 --- a/drivers/iommu/s390-iommu.c +++ b/drivers/iommu/s390-iommu.c @@ -33,6 +33,8 @@ struct s390_domain { struct rcu_head rcu; }; +static struct iommu_domain blocking_domain; + static inline unsigned int calc_rtx(dma_addr_t ptr) { return ((unsigned long)ptr >> ZPCI_RT_SHIFT) & ZPCI_INDEX_MASK; @@ -369,20 +371,36 @@ static void s390_domain_free(struct iommu_domain *domain) call_rcu(&s390_domain->rcu, s390_iommu_rcu_free_domain); } -static void s390_iommu_detach_device(struct iommu_domain *domain, - struct device *dev) +static void zdev_s390_domain_update(struct zpci_dev *zdev, + struct iommu_domain *domain) +{ + unsigned long flags; + + spin_lock_irqsave(&zdev->dom_lock, flags); + zdev->s390_domain = domain; + spin_unlock_irqrestore(&zdev->dom_lock, flags); +} + +static int blocking_domain_attach_device(struct iommu_domain *domain, + struct device *dev) { - struct s390_domain *s390_domain = to_s390_domain(domain); struct zpci_dev *zdev = to_zpci_dev(dev); + struct s390_domain *s390_domain; unsigned long flags; + if (zdev->s390_domain->type == IOMMU_DOMAIN_BLOCKED) + return 0; + + s390_domain = to_s390_domain(zdev->s390_domain); spin_lock_irqsave(&s390_domain->list_lock, flags); list_del_rcu(&zdev->iommu_list); spin_unlock_irqrestore(&s390_domain->list_lock, flags); zpci_unregister_ioat(zdev, 0); - zdev->s390_domain = NULL; zdev->dma_table = NULL; + zdev_s390_domain_update(zdev, domain); + + return 0; } static int s390_iommu_attach_device(struct iommu_domain *domain, @@ -401,20 +419,15 @@ static int s390_iommu_attach_device(struct iommu_domain *domain, domain->geometry.aperture_end < zdev->start_dma)) return -EINVAL; - if (zdev->s390_domain) - s390_iommu_detach_device(&zdev->s390_domain->domain, dev); + blocking_domain_attach_device(&blocking_domain, dev); + /* If we fail now DMA remains blocked via blocking domain */ cc = zpci_register_ioat(zdev, 0, zdev->start_dma, zdev->end_dma, virt_to_phys(s390_domain->dma_table), &status); - /* - * If the device is undergoing error recovery the reset code - * will re-establish the new domain. - */ if (cc && status != ZPCI_PCI_ST_FUNC_NOT_AVAIL) return -EIO; - zdev->dma_table = s390_domain->dma_table; - zdev->s390_domain = s390_domain; + zdev_s390_domain_update(zdev, domain); spin_lock_irqsave(&s390_domain->list_lock, flags); list_add_rcu(&zdev->iommu_list, &s390_domain->devices); @@ -466,19 +479,11 @@ static struct iommu_device *s390_iommu_probe_device(struct device *dev) if (zdev->tlb_refresh) dev->iommu->shadow_on_flush = 1; - return &zdev->iommu_dev; -} + /* Start with DMA blocked */ + spin_lock_init(&zdev->dom_lock); + zdev_s390_domain_update(zdev, &blocking_domain); -static void s390_iommu_release_device(struct device *dev) -{ - struct zpci_dev *zdev = to_zpci_dev(dev); - - /* - * release_device is expected to detach any domain currently attached - * to the device, but keep it attached to other devices in the group. - */ - if (zdev) - s390_iommu_detach_device(&zdev->s390_domain->domain, dev); + return &zdev->iommu_dev; } static int zpci_refresh_all(struct zpci_dev *zdev) @@ -702,9 +707,15 @@ static void s390_iommu_probe_finalize(struct device *dev) struct zpci_iommu_ctrs *zpci_get_iommu_ctrs(struct zpci_dev *zdev) { - if (!zdev || !zdev->s390_domain) + struct s390_domain *s390_domain; + + lockdep_assert_held(&zdev->dom_lock); + + if (zdev->s390_domain->type == IOMMU_DOMAIN_BLOCKED) return NULL; - return &zdev->s390_domain->ctrs; + + s390_domain = to_s390_domain(zdev->s390_domain); + return &s390_domain->ctrs; } int zpci_init_iommu(struct zpci_dev *zdev) @@ -781,12 +792,20 @@ static int __init s390_iommu_init(void) } subsys_initcall(s390_iommu_init); +static struct iommu_domain blocking_domain = { + .type = IOMMU_DOMAIN_BLOCKED, + .ops = &(const struct iommu_domain_ops) { + .attach_dev = blocking_domain_attach_device, + } +}; + static const struct iommu_ops s390_iommu_ops = { + .blocked_domain = &blocking_domain, + .release_domain = &blocking_domain, .capable = s390_iommu_capable, .domain_alloc_paging = s390_domain_alloc_paging, .probe_device = s390_iommu_probe_device, .probe_finalize = s390_iommu_probe_finalize, - .release_device = s390_iommu_release_device, .device_group = generic_device_group, .pgsize_bitmap = SZ_4K, .get_resv_regions = s390_iommu_get_resv_regions, -- 2.43.0

2 1

[PATCH OLK-6.6 0/2] Fix CVE-2025-68785
by Zhao Yipeng 03 Feb '26

03 Feb '26

Patch #1 is the prerequisite patch, and Patch #2 fixes CVE-2025-68785. Ilya Maximets (2): net: openvswitch: remove never-working support for setting nsh fields net: openvswitch: fix middle attribute validation in push_nsh() action net/openvswitch/actions.c | 68 +------------------------------- net/openvswitch/flow_netlink.c | 71 +++++++--------------------------- net/openvswitch/flow_netlink.h | 2 - 3 files changed, 16 insertions(+), 125 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 v4 00/13] net: LTS-6.6 backport
by Dong Chenchen 03 Feb '26

03 Feb '26

net LTS-6.6 patches backport Aakash Kumar S (1): xfrm: Duplicate SPI Handling Bui Quang Minh (1): virtio-net: fix received length check in big packets Florian Westphal (1): netfilter: nf_reject: don't leak dst refcount for loopback packets Jakub Kicinski (3): tls: handle data disappearing from under the TLS ULP tls: make sure to abort the stream if headers are bogus page_pool: always add GFP_NOWARN for ATOMIC allocations Jiayuan Chen (1): bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls Kuniyuki Iwashima (1): Bluetooth: hci_core: Fix use-after-free in vhci_flush() Maher Azzouzi (1): net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing Michal Luczaj (1): vsock: Ignore signal/timeout on connect() if already established Nikolay Aleksandrov (1): net: bridge: fix use-after-free due to MST port state bypass Nishanth Menon (1): net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error Sabrina Dubroca (1): xfrm: xfrm_alloc_spi shouldn't use 0 as SPI drivers/net/ethernet/ti/netcp_core.c | 10 ++-- drivers/net/virtio_net.c | 25 +++++----- drivers/soc/ti/knav_dma.c | 14 +++--- include/net/bluetooth/hci_core.h | 1 + net/bluetooth/hci_core.c | 34 +++++++++++-- net/bridge/br_forward.c | 2 +- net/bridge/br_input.c | 4 +- net/bridge/br_private.h | 8 +-- net/core/page_pool.c | 6 +++ net/ipv4/netfilter/nf_reject_ipv4.c | 6 +-- net/ipv6/netfilter/nf_reject_ipv6.c | 5 +- net/sched/sch_mqprio.c | 2 +- net/tls/tls.h | 3 +- net/tls/tls_strp.c | 25 +++++++--- net/tls/tls_sw.c | 19 +++++-- net/vmw_vsock/af_vsock.c | 40 +++++++++++---- net/xfrm/xfrm_state.c | 75 +++++++++++++++++----------- 17 files changed, 186 insertions(+), 93 deletions(-) -- 2.25.1

2 14

[PATCH OLK-6.6 0/2] Fix NFS deadlock
by Li Lingfeng 03 Feb '26

03 Feb '26

Revert the patch from hulk and apply the one from mainline. Trond Myklebust (1): NFS: Fix a deadlock involving nfs_release_folio() Wang Zhaolong (1): Revert "[Huawei] Revert "NFS: fix up nfs_release_folio() to try to release the page"" fs/nfs/file.c | 11 +++++++++-- fs/nfs/nfstrace.h | 3 +++ fs/nfs/write.c | 33 +++++++++++++++++++++++++++++++++ include/linux/nfs_fs.h | 1 + 4 files changed, 46 insertions(+), 2 deletions(-) -- 2.52.0

2 3

[PATCH OLK-6.6] net: usb: rtl8150: fix memory leak on usb_submit_urb() failure
by Jinjiang Tu 03 Feb '26

03 Feb '26

From: Deepakkumar Karn <dkarn(a)redhat.com> stable inclusion from stable-v6.6.120 commit 4bd4ea3eb326608ffc296db12c105f92dc2f2190 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13480 CVE: CVE-2025-71154 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 12cab1191d9890097171156d06bfa8d31f1e39c8 ] In async_set_registers(), when usb_submit_urb() fails, the allocated async_req structure and URB are not freed, causing a memory leak. The completion callback async_set_reg_cb() is responsible for freeing these allocations, but it is only called after the URB is successfully submitted and completes (successfully or with error). If submission fails, the callback never runs and the memory is leaked. Fix this by freeing both the URB and the request structure in the error path when usb_submit_urb() fails. Reported-by: syzbot+8dd915c7cb0490fc8c52(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=8dd915c7cb0490fc8c52 Fixes: 4d12997a9bb3 ("drivers: net: usb: rtl8150: concurrent URB bugfix") Signed-off-by: Deepakkumar Karn <dkarn(a)redhat.com> Link: https://patch.msgid.link/20251216151304.59865-2-dkarn@redhat.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yuan can <yuancan(a)huawei.com> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- drivers/net/usb/rtl8150.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c index 92add3daadbb..f840fc374a29 100644 --- a/drivers/net/usb/rtl8150.c +++ b/drivers/net/usb/rtl8150.c @@ -211,6 +211,8 @@ static int async_set_registers(rtl8150_t *dev, u16 indx, u16 size, u16 reg) if (res == -ENODEV) netif_device_detach(dev->netdev); dev_err(&dev->udev->dev, "%s failed with %d\n", __func__, res); + kfree(req); + usb_free_urb(async_urb); } return res; } -- 2.43.0

2 1

[PATCH OLK-6.6] wifi: avoid kernel-infoleak from struct iw_point
by Jinjiang Tu 03 Feb '26

03 Feb '26

From: Eric Dumazet <edumazet(a)google.com> stable inclusion from stable-v6.6.121 commit d21ec867d84c9f3a9845d7d8c90c9ce35dbe48f8 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13487 CVE: CVE-2026-22978 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 21cbf883d073abbfe09e3924466aa5e0449e7261 upstream. struct iw_point has a 32bit hole on 64bit arches. struct iw_point { void __user *pointer; /* Pointer to the data (in user space) */ __u16 length; /* number of fields or size in bytes */ __u16 flags; /* Optional params */ }; Make sure to zero the structure to avoid disclosing 32bits of kernel data to user space. Fixes: 87de87d5e47f ("wext: Dispatch and handle compat ioctls entirely in net/wireless/wext.c") Reported-by: syzbot+bfc7323743ca6dbcc3d3(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/695f83f3.050a0220.1c677c.0392.GAE@google.com… Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: stable(a)vger.kernel.org Link: https://patch.msgid.link/20260108101927.857582-1-edumazet@google.com Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- net/wireless/wext-core.c | 4 ++++ net/wireless/wext-priv.c | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c index 838ad6541a17..73a29ee3eff2 100644 --- a/net/wireless/wext-core.c +++ b/net/wireless/wext-core.c @@ -1103,6 +1103,10 @@ static int compat_standard_call(struct net_device *dev, return ioctl_standard_call(dev, iwr, cmd, info, handler); iwp_compat = (struct compat_iw_point *) &iwr->u.data; + + /* struct iw_point has a 32bit hole on 64bit arches. */ + memset(&iwp, 0, sizeof(iwp)); + iwp.pointer = compat_ptr(iwp_compat->pointer); iwp.length = iwp_compat->length; iwp.flags = iwp_compat->flags; diff --git a/net/wireless/wext-priv.c b/net/wireless/wext-priv.c index 674d426a9d24..37d1147019c2 100644 --- a/net/wireless/wext-priv.c +++ b/net/wireless/wext-priv.c @@ -228,6 +228,10 @@ int compat_private_call(struct net_device *dev, struct iwreq *iwr, struct iw_point iwp; iwp_compat = (struct compat_iw_point *) &iwr->u.data; + + /* struct iw_point has a 32bit hole on 64bit arches. */ + memset(&iwp, 0, sizeof(iwp)); + iwp.pointer = compat_ptr(iwp_compat->pointer); iwp.length = iwp_compat->length; iwp.flags = iwp_compat->flags; -- 2.43.0

2 1

[PATCH OLK-6.6] mm/secretmem: fix use-after-free race in fault handler
by Jinjiang Tu 03 Feb '26

03 Feb '26

From: Lance Yang <lance.yang(a)linux.dev> stable inclusion from stable-v6.6.117 commit 42d486d35a4143cc37fc72ee66edc99d942dd367 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/11252 CVE: CVE-2025-40272 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 6f86d0534fddfbd08687fa0f01479d4226bc3c3d upstream. When a page fault occurs in a secret memory file created with `memfd_secret(2)`, the kernel will allocate a new folio for it, mark the underlying page as not-present in the direct map, and add it to the file mapping. If two tasks cause a fault in the same page concurrently, both could end up allocating a folio and removing the page from the direct map, but only one would succeed in adding the folio to the file mapping. The task that failed undoes the effects of its attempt by (a) freeing the folio again and (b) putting the page back into the direct map. However, by doing these two operations in this order, the page becomes available to the allocator again before it is placed back in the direct mapping. If another task attempts to allocate the page between (a) and (b), and the kernel tries to access it via the direct map, it would result in a supervisor not-present page fault. Fix the ordering to restore the direct map before the folio is freed. Link: https://lkml.kernel.org/r/20251031120955.92116-1-lance.yang@linux.dev Fixes: 1507f51255c9 ("mm: introduce memfd_secret system call to create "secret" memory areas") Signed-off-by: Lance Yang <lance.yang(a)linux.dev> Reported-by: Google Big Sleep <big-sleep-vuln-reports(a)google.com> Closes: https://lore.kernel.org/linux-mm/CAEXGt5QeDpiHTu3K9tvjUTPqo+d-=wuCNYPa+6sWK… Acked-by: David Hildenbrand <david(a)redhat.com> Reviewed-by: Mike Rapoport (Microsoft) <rppt(a)kernel.org> Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes(a)oracle.com> Cc: Matthew Wilcox (Oracle) <willy(a)infradead.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Mike Rapoport (Microsoft) <rppt(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- mm/secretmem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/secretmem.c b/mm/secretmem.c index 88fbd3598207..987def80d810 100644 --- a/mm/secretmem.c +++ b/mm/secretmem.c @@ -84,13 +84,13 @@ static vm_fault_t secretmem_fault(struct vm_fault *vmf) __folio_mark_uptodate(folio); err = filemap_add_folio(mapping, folio, offset, gfp); if (unlikely(err)) { - folio_put(folio); /* * If a split of large page was required, it * already happened when we marked the page invalid * which guarantees that this call won't fail */ set_direct_map_default_noflush(page); + folio_put(folio); if (err == -EEXIST) goto retry; -- 2.43.0

2 1

[PATCH OLK-6.6] mm/page_alloc: change all pageblocks migrate type on coalescing
by Jinjiang Tu 03 Feb '26

03 Feb '26

From: Alexander Gordeev <agordeev(a)linux.ibm.com> mainline inclusion from mainline-v6.19-rc4 commit 7838a4eb8a1d23160bd3f588ea7f2b8f7c00c55b category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13448 CVE: CVE-2025-71134 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When a page is freed it coalesces with a buddy into a higher order page while possible. When the buddy page migrate type differs, it is expected to be updated to match the one of the page being freed. However, only the first pageblock of the buddy page is updated, while the rest of the pageblocks are left unchanged. That causes warnings in later expand() and other code paths (like below), since an inconsistency between migration type of the list containing the page and the page-owned pageblocks migration types is introduced. [ 308.986589] ------------[ cut here ]------------ [ 308.987227] page type is 0, passed migratetype is 1 (nr=256) [ 308.987275] WARNING: CPU: 1 PID: 5224 at mm/page_alloc.c:812 expand+0x23c/0x270 [ 308.987293] Modules linked in: algif_hash(E) af_alg(E) nft_fib_inet(E) nft_fib_ipv4(E) nft_fib_ipv6(E) nft_fib(E) nft_reject_inet(E) nf_reject_ipv4(E) nf_reject_ipv6(E) nft_reject(E) nft_ct(E) nft_chain_nat(E) nf_nat(E) nf_conntrack(E) nf_defrag_ipv6(E) nf_defrag_ipv4(E) nf_tables(E) s390_trng(E) vfio_ccw(E) mdev(E) vfio_iommu_type1(E) vfio(E) sch_fq_codel(E) drm(E) i2c_core(E) drm_panel_orientation_quirks(E) loop(E) nfnetlink(E) vsock_loopback(E) vmw_vsock_virtio_transport_common(E) vsock(E) ctcm(E) fsm(E) diag288_wdt(E) watchdog(E) zfcp(E) scsi_transport_fc(E) ghash_s390(E) prng(E) aes_s390(E) des_generic(E) des_s390(E) libdes(E) sha3_512_s390(E) sha3_256_s390(E) sha_common(E) paes_s390(E) crypto_engine(E) pkey_cca(E) pkey_ep11(E) zcrypt(E) rng_core(E) pkey_pckmo(E) pkey(E) autofs4(E) [ 308.987439] Unloaded tainted modules: hmac_s390(E):2 [ 308.987650] CPU: 1 UID: 0 PID: 5224 Comm: mempig_verify Kdump: loaded Tainted: G E 6.18.0-gcc-bpf-debug #431 PREEMPT [ 308.987657] Tainted: [E]=UNSIGNED_MODULE [ 308.987661] Hardware name: IBM 3906 M04 704 (z/VM 7.3.0) [ 308.987666] Krnl PSW : 0404f00180000000 00000349976fa600 (expand+0x240/0x270) [ 308.987676] R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:3 CC:3 PM:0 RI:0 EA:3 [ 308.987682] Krnl GPRS: 0000034980000004 0000000000000005 0000000000000030 000003499a0e6d88 [ 308.987688] 0000000000000005 0000034980000005 000002be803ac000 0000023efe6c8300 [ 308.987692] 0000000000000008 0000034998d57290 000002be00000100 0000023e00000008 [ 308.987696] 0000000000000000 0000000000000000 00000349976fa5fc 000002c99b1eb6f0 [ 308.987708] Krnl Code: 00000349976fa5f0: c020008a02f2 larl %r2,000003499883abd4 00000349976fa5f6: c0e5ffe3f4b5 brasl %r14,0000034997378f60 #00000349976fa5fc: af000000 mc 0,0 >00000349976fa600: a7f4ff4c brc 15,00000349976fa498 00000349976fa604: b9040026 lgr %r2,%r6 00000349976fa608: c0300088317f larl %r3,0000034998800906 00000349976fa60e: c0e5fffdb6e1 brasl %r14,00000349976b13d0 00000349976fa614: af000000 mc 0,0 [ 308.987734] Call Trace: [ 308.987738] [<00000349976fa600>] expand+0x240/0x270 [ 308.987744] ([<00000349976fa5fc>] expand+0x23c/0x270) [ 308.987749] [<00000349976ff95e>] rmqueue_bulk+0x71e/0x940 [ 308.987754] [<00000349976ffd7e>] __rmqueue_pcplist+0x1fe/0x2a0 [ 308.987759] [<0000034997700966>] rmqueue.isra.0+0xb46/0xf40 [ 308.987763] [<0000034997703ec8>] get_page_from_freelist+0x198/0x8d0 [ 308.987768] [<0000034997706fa8>] __alloc_frozen_pages_noprof+0x198/0x400 [ 308.987774] [<00000349977536f8>] alloc_pages_mpol+0xb8/0x220 [ 308.987781] [<0000034997753bf6>] folio_alloc_mpol_noprof+0x26/0xc0 [ 308.987786] [<0000034997753e4c>] vma_alloc_folio_noprof+0x6c/0xa0 [ 308.987791] [<0000034997775b22>] vma_alloc_anon_folio_pmd+0x42/0x240 [ 308.987799] [<000003499777bfea>] __do_huge_pmd_anonymous_page+0x3a/0x210 [ 308.987804] [<00000349976cb08e>] __handle_mm_fault+0x4de/0x500 [ 308.987809] [<00000349976cb14c>] handle_mm_fault+0x9c/0x3a0 [ 308.987813] [<000003499734d70e>] do_exception+0x1de/0x540 [ 308.987822] [<0000034998387390>] __do_pgm_check+0x130/0x220 [ 308.987830] [<000003499839a934>] pgm_check_handler+0x114/0x160 [ 308.987838] 3 locks held by mempig_verify/5224: [ 308.987842] #0: 0000023ea44c1e08 (vm_lock){++++}-{0:0}, at: lock_vma_under_rcu+0xb2/0x2a0 [ 308.987859] #1: 0000023ee4d41b18 (&pcp->lock){+.+.}-{2:2}, at: rmqueue.isra.0+0xad6/0xf40 [ 308.987871] #2: 0000023efe6c8998 (&zone->lock){..-.}-{2:2}, at: rmqueue_bulk+0x5a/0x940 [ 308.987886] Last Breaking-Event-Address: [ 308.987890] [<0000034997379096>] __warn_printk+0x136/0x140 [ 308.987897] irq event stamp: 52330356 [ 308.987901] hardirqs last enabled at (52330355): [<000003499838742e>] __do_pgm_check+0x1ce/0x220 [ 308.987907] hardirqs last disabled at (52330356): [<000003499839932e>] _raw_spin_lock_irqsave+0x9e/0xe0 [ 308.987913] softirqs last enabled at (52329882): [<0000034997383786>] handle_softirqs+0x2c6/0x530 [ 308.987922] softirqs last disabled at (52329859): [<0000034997382f86>] __irq_exit_rcu+0x126/0x140 [ 308.987929] ---[ end trace 0000000000000000 ]--- [ 308.987936] ------------[ cut here ]------------ [ 308.987940] page type is 0, passed migratetype is 1 (nr=256) [ 308.987951] WARNING: CPU: 1 PID: 5224 at mm/page_alloc.c:860 __del_page_from_free_list+0x1be/0x1e0 [ 308.987960] Modules linked in: algif_hash(E) af_alg(E) nft_fib_inet(E) nft_fib_ipv4(E) nft_fib_ipv6(E) nft_fib(E) nft_reject_inet(E) nf_reject_ipv4(E) nf_reject_ipv6(E) nft_reject(E) nft_ct(E) nft_chain_nat(E) nf_nat(E) nf_conntrack(E) nf_defrag_ipv6(E) nf_defrag_ipv4(E) nf_tables(E) s390_trng(E) vfio_ccw(E) mdev(E) vfio_iommu_type1(E) vfio(E) sch_fq_codel(E) drm(E) i2c_core(E) drm_panel_orientation_quirks(E) loop(E) nfnetlink(E) vsock_loopback(E) vmw_vsock_virtio_transport_common(E) vsock(E) ctcm(E) fsm(E) diag288_wdt(E) watchdog(E) zfcp(E) scsi_transport_fc(E) ghash_s390(E) prng(E) aes_s390(E) des_generic(E) des_s390(E) libdes(E) sha3_512_s390(E) sha3_256_s390(E) sha_common(E) paes_s390(E) crypto_engine(E) pkey_cca(E) pkey_ep11(E) zcrypt(E) rng_core(E) pkey_pckmo(E) pkey(E) autofs4(E) [ 308.988070] Unloaded tainted modules: hmac_s390(E):2 [ 308.988087] CPU: 1 UID: 0 PID: 5224 Comm: mempig_verify Kdump: loaded Tainted: G W E 6.18.0-gcc-bpf-debug #431 PREEMPT [ 308.988095] Tainted: [W]=WARN, [E]=UNSIGNED_MODULE [ 308.988100] Hardware name: IBM 3906 M04 704 (z/VM 7.3.0) [ 308.988105] Krnl PSW : 0404f00180000000 00000349976f9e32 (__del_page_from_free_list+0x1c2/0x1e0) [ 308.988118] R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:3 CC:3 PM:0 RI:0 EA:3 [ 308.988127] Krnl GPRS: 0000034980000004 0000000000000005 0000000000000030 000003499a0e6d88 [ 308.988133] 0000000000000005 0000034980000005 0000034998d57290 0000023efe6c8300 [ 308.988139] 0000000000000001 0000000000000008 000002be00000100 000002be803ac000 [ 308.988144] 0000000000000000 0000000000000001 00000349976f9e2e 000002c99b1eb728 [ 308.988153] Krnl Code: 00000349976f9e22: c020008a06d9 larl %r2,000003499883abd4 00000349976f9e28: c0e5ffe3f89c brasl %r14,0000034997378f60 #00000349976f9e2e: af000000 mc 0,0 >00000349976f9e32: a7f4ff4e brc 15,00000349976f9cce 00000349976f9e36: b904002b lgr %r2,%r11 00000349976f9e3a: c030008a06e7 larl %r3,000003499883ac08 00000349976f9e40: c0e5fffdbac8 brasl %r14,00000349976b13d0 00000349976f9e46: af000000 mc 0,0 [ 308.988184] Call Trace: [ 308.988188] [<00000349976f9e32>] __del_page_from_free_list+0x1c2/0x1e0 [ 308.988195] ([<00000349976f9e2e>] __del_page_from_free_list+0x1be/0x1e0) [ 308.988202] [<00000349976ff946>] rmqueue_bulk+0x706/0x940 [ 308.988208] [<00000349976ffd7e>] __rmqueue_pcplist+0x1fe/0x2a0 [ 308.988214] [<0000034997700966>] rmqueue.isra.0+0xb46/0xf40 [ 308.988221] [<0000034997703ec8>] get_page_from_freelist+0x198/0x8d0 [ 308.988227] [<0000034997706fa8>] __alloc_frozen_pages_noprof+0x198/0x400 [ 308.988233] [<00000349977536f8>] alloc_pages_mpol+0xb8/0x220 [ 308.988240] [<0000034997753bf6>] folio_alloc_mpol_noprof+0x26/0xc0 [ 308.988247] [<0000034997753e4c>] vma_alloc_folio_noprof+0x6c/0xa0 [ 308.988253] [<0000034997775b22>] vma_alloc_anon_folio_pmd+0x42/0x240 [ 308.988260] [<000003499777bfea>] __do_huge_pmd_anonymous_page+0x3a/0x210 [ 308.988267] [<00000349976cb08e>] __handle_mm_fault+0x4de/0x500 [ 308.988273] [<00000349976cb14c>] handle_mm_fault+0x9c/0x3a0 [ 308.988279] [<000003499734d70e>] do_exception+0x1de/0x540 [ 308.988286] [<0000034998387390>] __do_pgm_check+0x130/0x220 [ 308.988293] [<000003499839a934>] pgm_check_handler+0x114/0x160 [ 308.988300] 3 locks held by mempig_verify/5224: [ 308.988305] #0: 0000023ea44c1e08 (vm_lock){++++}-{0:0}, at: lock_vma_under_rcu+0xb2/0x2a0 [ 308.988322] #1: 0000023ee4d41b18 (&pcp->lock){+.+.}-{2:2}, at: rmqueue.isra.0+0xad6/0xf40 [ 308.988334] #2: 0000023efe6c8998 (&zone->lock){..-.}-{2:2}, at: rmqueue_bulk+0x5a/0x940 [ 308.988346] Last Breaking-Event-Address: [ 308.988350] [<0000034997379096>] __warn_printk+0x136/0x140 [ 308.988356] irq event stamp: 52330356 [ 308.988360] hardirqs last enabled at (52330355): [<000003499838742e>] __do_pgm_check+0x1ce/0x220 [ 308.988366] hardirqs last disabled at (52330356): [<000003499839932e>] _raw_spin_lock_irqsave+0x9e/0xe0 [ 308.988373] softirqs last enabled at (52329882): [<0000034997383786>] handle_softirqs+0x2c6/0x530 [ 308.988380] softirqs last disabled at (52329859): [<0000034997382f86>] __irq_exit_rcu+0x126/0x140 [ 308.988388] ---[ end trace 0000000000000000 ]--- Link: https://lkml.kernel.org/r/20251215081002.3353900A9c-agordeev@linux.ibm.com Link: https://lkml.kernel.org/r/20251212151457.3898073Add-agordeev@linux.ibm.com Fixes: e6cf9e1c4cde ("mm: page_alloc: fix up block types when merging compatible blocks") Signed-off-by: Alexander Gordeev <agordeev(a)linux.ibm.com> Reported-by: Marc Hartmayer <mhartmay(a)linux.ibm.com> Closes: https://lore.kernel.org/linux-mm/87wmalyktd.fsf@linux.ibm.com/ Acked-by: Vlastimil Babka <vbabka(a)suse.cz> Acked-by: Johannes Weiner <hannes(a)cmpxchg.org> Reviewed-by: Wei Yang <richard.weiyang(a)gmail.com> Cc: Marc Hartmayer <mhartmay(a)linux.ibm.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflicts: mm/page_allo.c [Context conflicts.] Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- mm/page_alloc.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/mm/page_alloc.c b/mm/page_alloc.c index b70a7f657853..2bc511aa784c 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -748,6 +748,17 @@ buddy_merge_likely(unsigned long pfn, unsigned long buddy_pfn, NULL) != NULL; } +static void change_pageblock_range(struct page *pageblock_page, + int start_order, int migratetype) +{ + int nr_pageblocks = 1 << (start_order - pageblock_order); + + while (nr_pageblocks--) { + set_pageblock_migratetype(pageblock_page, migratetype); + pageblock_page += pageblock_nr_pages; + } +} + /* * Freeing function for a buddy system allocator. * @@ -835,7 +846,7 @@ static inline void __free_one_page(struct page *page, * expand() down the line puts the sub-blocks * on the right freelists. */ - set_pageblock_migratetype(buddy, migratetype); + change_pageblock_range(buddy, order, migratetype); } combined_pfn = buddy_pfn & pfn; @@ -1813,17 +1824,6 @@ bool move_freepages_block_isolate(struct zone *zone, struct page *page, } #endif /* CONFIG_MEMORY_ISOLATION */ -static void change_pageblock_range(struct page *pageblock_page, - int start_order, int migratetype) -{ - int nr_pageblocks = 1 << (start_order - pageblock_order); - - while (nr_pageblocks--) { - set_pageblock_migratetype(pageblock_page, migratetype); - pageblock_page += pageblock_nr_pages; - } -} - /* * When we are falling back to another migratetype during allocation, should we * try to claim an entire block to satisfy further allocations, instead of -- 2.43.0

2 1

[PATCH OLK-6.6] libceph: make decode_pool() more resilient against corrupted osdmaps
by Jinjiang Tu 03 Feb '26

03 Feb '26

From: Ilya Dryomov <idryomov(a)gmail.com> stable inclusion from stable-v6.6.120 commit e927ab132b87ba3f076705fc2684d94b24201ed1 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13431 CVE: CVE-2025-71116 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 8c738512714e8c0aa18f8a10c072d5b01c83db39 upstream. If the osdmap is (maliciously) corrupted such that the encoded length of ceph_pg_pool envelope is less than what is expected for a particular encoding version, out-of-bounds reads may ensue because the only bounds check that is there is based on that length value. This patch adds explicit bounds checks for each field that is decoded or skipped. Cc: stable(a)vger.kernel.org Reported-by: ziming zhang <ezrakiez(a)gmail.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Reviewed-by: Xiubo Li <xiubli(a)redhat.com> Tested-by: ziming zhang <ezrakiez(a)gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuan can <yuancan(a)huawei.com> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- net/ceph/osdmap.c | 116 +++++++++++++++++++++------------------------- 1 file changed, 52 insertions(+), 64 deletions(-) diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c index 295098873861..b0a08a537012 100644 --- a/net/ceph/osdmap.c +++ b/net/ceph/osdmap.c @@ -806,51 +806,49 @@ static int decode_pool(void **p, void *end, struct ceph_pg_pool_info *pi) ceph_decode_need(p, end, len, bad); pool_end = *p + len; + ceph_decode_need(p, end, 4 + 4 + 4, bad); pi->type = ceph_decode_8(p); pi->size = ceph_decode_8(p); pi->crush_ruleset = ceph_decode_8(p); pi->object_hash = ceph_decode_8(p); - pi->pg_num = ceph_decode_32(p); pi->pgp_num = ceph_decode_32(p); - *p += 4 + 4; /* skip lpg* */ - *p += 4; /* skip last_change */ - *p += 8 + 4; /* skip snap_seq, snap_epoch */ + /* lpg*, last_change, snap_seq, snap_epoch */ + ceph_decode_skip_n(p, end, 8 + 4 + 8 + 4, bad); /* skip snaps */ - num = ceph_decode_32(p); + ceph_decode_32_safe(p, end, num, bad); while (num--) { - *p += 8; /* snapid key */ - *p += 1 + 1; /* versions */ - len = ceph_decode_32(p); - *p += len; + /* snapid key, pool snap (with versions) */ + ceph_decode_skip_n(p, end, 8 + 2, bad); + ceph_decode_skip_string(p, end, bad); } - /* skip removed_snaps */ - num = ceph_decode_32(p); - *p += num * (8 + 8); + /* removed_snaps */ + ceph_decode_skip_map(p, end, 64, 64, bad); + ceph_decode_need(p, end, 8 + 8 + 4, bad); *p += 8; /* skip auid */ pi->flags = ceph_decode_64(p); *p += 4; /* skip crash_replay_interval */ if (ev >= 7) - pi->min_size = ceph_decode_8(p); + ceph_decode_8_safe(p, end, pi->min_size, bad); else pi->min_size = pi->size - pi->size / 2; if (ev >= 8) - *p += 8 + 8; /* skip quota_max_* */ + /* quota_max_* */ + ceph_decode_skip_n(p, end, 8 + 8, bad); if (ev >= 9) { - /* skip tiers */ - num = ceph_decode_32(p); - *p += num * 8; + /* tiers */ + ceph_decode_skip_set(p, end, 64, bad); + ceph_decode_need(p, end, 8 + 1 + 8 + 8, bad); *p += 8; /* skip tier_of */ *p += 1; /* skip cache_mode */ - pi->read_tier = ceph_decode_64(p); pi->write_tier = ceph_decode_64(p); } else { @@ -858,86 +856,76 @@ static int decode_pool(void **p, void *end, struct ceph_pg_pool_info *pi) pi->write_tier = -1; } - if (ev >= 10) { - /* skip properties */ - num = ceph_decode_32(p); - while (num--) { - len = ceph_decode_32(p); - *p += len; /* key */ - len = ceph_decode_32(p); - *p += len; /* val */ - } - } + if (ev >= 10) + /* properties */ + ceph_decode_skip_map(p, end, string, string, bad); if (ev >= 11) { - /* skip hit_set_params */ - *p += 1 + 1; /* versions */ - len = ceph_decode_32(p); - *p += len; + /* hit_set_params (with versions) */ + ceph_decode_skip_n(p, end, 2, bad); + ceph_decode_skip_string(p, end, bad); - *p += 4; /* skip hit_set_period */ - *p += 4; /* skip hit_set_count */ + /* hit_set_period, hit_set_count */ + ceph_decode_skip_n(p, end, 4 + 4, bad); } if (ev >= 12) - *p += 4; /* skip stripe_width */ + /* stripe_width */ + ceph_decode_skip_32(p, end, bad); - if (ev >= 13) { - *p += 8; /* skip target_max_bytes */ - *p += 8; /* skip target_max_objects */ - *p += 4; /* skip cache_target_dirty_ratio_micro */ - *p += 4; /* skip cache_target_full_ratio_micro */ - *p += 4; /* skip cache_min_flush_age */ - *p += 4; /* skip cache_min_evict_age */ - } + if (ev >= 13) + /* target_max_*, cache_target_*, cache_min_* */ + ceph_decode_skip_n(p, end, 16 + 8 + 8, bad); - if (ev >= 14) { - /* skip erasure_code_profile */ - len = ceph_decode_32(p); - *p += len; - } + if (ev >= 14) + /* erasure_code_profile */ + ceph_decode_skip_string(p, end, bad); /* * last_force_op_resend_preluminous, will be overridden if the * map was encoded with RESEND_ON_SPLIT */ if (ev >= 15) - pi->last_force_request_resend = ceph_decode_32(p); + ceph_decode_32_safe(p, end, pi->last_force_request_resend, bad); else pi->last_force_request_resend = 0; if (ev >= 16) - *p += 4; /* skip min_read_recency_for_promote */ + /* min_read_recency_for_promote */ + ceph_decode_skip_32(p, end, bad); if (ev >= 17) - *p += 8; /* skip expected_num_objects */ + /* expected_num_objects */ + ceph_decode_skip_64(p, end, bad); if (ev >= 19) - *p += 4; /* skip cache_target_dirty_high_ratio_micro */ + /* cache_target_dirty_high_ratio_micro */ + ceph_decode_skip_32(p, end, bad); if (ev >= 20) - *p += 4; /* skip min_write_recency_for_promote */ + /* min_write_recency_for_promote */ + ceph_decode_skip_32(p, end, bad); if (ev >= 21) - *p += 1; /* skip use_gmt_hitset */ + /* use_gmt_hitset */ + ceph_decode_skip_8(p, end, bad); if (ev >= 22) - *p += 1; /* skip fast_read */ + /* fast_read */ + ceph_decode_skip_8(p, end, bad); - if (ev >= 23) { - *p += 4; /* skip hit_set_grade_decay_rate */ - *p += 4; /* skip hit_set_search_last_n */ - } + if (ev >= 23) + /* hit_set_grade_decay_rate, hit_set_search_last_n */ + ceph_decode_skip_n(p, end, 4 + 4, bad); if (ev >= 24) { - /* skip opts */ - *p += 1 + 1; /* versions */ - len = ceph_decode_32(p); - *p += len; + /* opts (with versions) */ + ceph_decode_skip_n(p, end, 2, bad); + ceph_decode_skip_string(p, end, bad); } if (ev >= 25) - pi->last_force_request_resend = ceph_decode_32(p); + ceph_decode_32_safe(p, end, pi->last_force_request_resend, bad); /* ignore the rest */ -- 2.43.0

2 1

[PATCH OLK-6.6 0/2] Fix NFS deadlock
by Li Lingfeng 03 Feb '26

03 Feb '26

Revert the patch from hulk and apply the one from mainline. Trond Myklebust (1): NFS: Fix a deadlock involving nfs_release_folio() Wang Zhaolong (1): Revert "[Huawei] Revert "NFS: fix up nfs_release_folio() to try to release the page"" fs/nfs/file.c | 11 +++++++++-- fs/nfs/nfstrace.h | 3 +++ fs/nfs/write.c | 33 +++++++++++++++++++++++++++++++++ include/linux/nfs_fs.h | 1 + 4 files changed, 46 insertions(+), 2 deletions(-) -- 2.52.0

2 3

[PATCH OLK-6.6 0/1] CVE-2025-68172
by Liu Mingrui 03 Feb '26

03 Feb '26

From: Mingrui Liu <liumingrui(a)huawei.com> CVE-2025-68172 Haotian Zhang (1): crypto: aspeed - fix double free caused by devm drivers/crypto/aspeed/aspeed-acry.c | 2 -- 1 file changed, 2 deletions(-) -- 2.34.1

2 2

[PATCH OLK-6.6 0/3] CVE-2025-39981 fixup
by Jiacheng Yu 03 Feb '26

03 Feb '26

*** BLURB HERE *** Luiz Augusto von Dentz (1): Bluetooth: MGMT: Fix possible UAFs Pavel Shpakovskiy (1): Bluetooth: hci_sync: fix set_local_name race condition Roman Smirnov (1): Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() include/net/bluetooth/hci_sync.h | 2 +- net/bluetooth/hci_sync.c | 6 +- net/bluetooth/mgmt.c | 261 ++++++++++++++++++++++--------- net/bluetooth/mgmt_util.c | 46 ++++++ net/bluetooth/mgmt_util.h | 3 + 5 files changed, 237 insertions(+), 81 deletions(-) -- 2.43.0

2 4

[PATCH OLK-6.6] net/mlx5: fw_tracer, Validate format string parameters
by Chen Ridong 02 Feb '26

02 Feb '26

From: Shay Drory <shayd(a)nvidia.com> stable inclusion from stable-v6.6.120 commit 8ac688c0e430dab19f6a9b70df94b1f635612c1a category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13368 CVE: CVE-2025-68816 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b35966042d20b14e2d83330049f77deec5229749 ] Add validation for format string parameters in the firmware tracer to prevent potential security vulnerabilities and crashes from malformed format strings received from firmware. The firmware tracer receives format strings from the device firmware and uses them to format trace messages. Without proper validation, bad firmware could provide format strings with invalid format specifiers (e.g., %s, %p, %n) that could lead to crashes, or other undefined behavior. Add mlx5_tracer_validate_params() to validate that all format specifiers in trace strings are limited to safe integer/hex formats (%x, %d, %i, %u, %llx, %lx, etc.). Reject strings containing other format types that could be used to access arbitrary memory or cause crashes. Invalid format strings are added to the trace output for visibility with "BAD_FORMAT: " prefix. Fixes: 70dd6fdb8987 ("net/mlx5: FW tracer, parse traces and kernel tracing support") Signed-off-by: Shay Drory <shayd(a)nvidia.com> Reviewed-by: Moshe Shemesh <moshe(a)nvidia.com> Reported-by: Breno Leitao <leitao(a)debian.org> Closes: https://lore.kernel.org/netdev/hanz6rzrb2bqbplryjrakvkbmv4y5jlmtthnvi3thg5s… Signed-off-by: Tariq Toukan <tariqt(a)nvidia.com> Link: https://patch.msgid.link/1765284977-1363052-4-git-send-email-tariqt@nvidia.… Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Chen Ridong <chenridong(a)huawei.com> --- .../mellanox/mlx5/core/diag/fw_tracer.c | 83 ++++++++++++++++--- .../mellanox/mlx5/core/diag/fw_tracer.h | 1 + 2 files changed, 74 insertions(+), 10 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c index 85d3bfa0780c6..197c306d350bf 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c @@ -33,6 +33,7 @@ #include "lib/eq.h" #include "fw_tracer.h" #include "fw_tracer_tracepoint.h" +#include <linux/ctype.h> static int mlx5_query_mtrc_caps(struct mlx5_fw_tracer *tracer) { @@ -358,6 +359,43 @@ static const char *VAL_PARM = "%llx"; static const char *REPLACE_64_VAL_PARM = "%x%x"; static const char *PARAM_CHAR = "%"; +static bool mlx5_is_valid_spec(const char *str) +{ + /* Parse format specifiers to find the actual type. + * Structure: %[flags][width][.precision][length]type + * Skip flags, width, precision & length. + */ + while (isdigit(*str) || *str == '#' || *str == '.' || *str == 'l') + str++; + + /* Check if it's a valid integer/hex specifier: + * Valid formats: %x, %d, %i, %u, etc. + */ + if (*str != 'x' && *str != 'X' && *str != 'd' && *str != 'i' && + *str != 'u' && *str != 'c') + return false; + + return true; +} + +static bool mlx5_tracer_validate_params(const char *str) +{ + const char *substr = str; + + if (!str) + return false; + + substr = strstr(substr, PARAM_CHAR); + while (substr) { + if (!mlx5_is_valid_spec(substr + 1)) + return false; + + substr = strstr(substr + 1, PARAM_CHAR); + } + + return true; +} + static int mlx5_tracer_message_hash(u32 message_id) { return jhash_1word(message_id, 0) & (MESSAGE_HASH_SIZE - 1); @@ -419,6 +457,10 @@ static int mlx5_tracer_get_num_of_params(char *str) char *substr, *pstr = str; int num_of_params = 0; + /* Validate that all parameters are valid before processing */ + if (!mlx5_tracer_validate_params(str)) + return -EINVAL; + /* replace %llx with %x%x */ substr = strstr(pstr, VAL_PARM); while (substr) { @@ -570,14 +612,17 @@ void mlx5_tracer_print_trace(struct tracer_string_format *str_frmt, { char tmp[512]; - snprintf(tmp, sizeof(tmp), str_frmt->string, - str_frmt->params[0], - str_frmt->params[1], - str_frmt->params[2], - str_frmt->params[3], - str_frmt->params[4], - str_frmt->params[5], - str_frmt->params[6]); + if (str_frmt->invalid_string) + snprintf(tmp, sizeof(tmp), "BAD_FORMAT: %s", str_frmt->string); + else + snprintf(tmp, sizeof(tmp), str_frmt->string, + str_frmt->params[0], + str_frmt->params[1], + str_frmt->params[2], + str_frmt->params[3], + str_frmt->params[4], + str_frmt->params[5], + str_frmt->params[6]); trace_mlx5_fw(dev->tracer, trace_timestamp, str_frmt->lost, str_frmt->event_id, tmp); @@ -609,6 +654,13 @@ static int mlx5_tracer_handle_raw_string(struct mlx5_fw_tracer *tracer, return 0; } +static void mlx5_tracer_handle_bad_format_string(struct mlx5_fw_tracer *tracer, + struct tracer_string_format *cur_string) +{ + cur_string->invalid_string = true; + list_add_tail(&cur_string->list, &tracer->ready_strings_list); +} + static int mlx5_tracer_handle_string_trace(struct mlx5_fw_tracer *tracer, struct tracer_event *tracer_event) { @@ -619,12 +671,18 @@ static int mlx5_tracer_handle_string_trace(struct mlx5_fw_tracer *tracer, if (!cur_string) return mlx5_tracer_handle_raw_string(tracer, tracer_event); - cur_string->num_of_params = mlx5_tracer_get_num_of_params(cur_string->string); - cur_string->last_param_num = 0; cur_string->event_id = tracer_event->event_id; cur_string->tmsn = tracer_event->string_event.tmsn; cur_string->timestamp = tracer_event->string_event.timestamp; cur_string->lost = tracer_event->lost_event; + cur_string->last_param_num = 0; + cur_string->num_of_params = mlx5_tracer_get_num_of_params(cur_string->string); + if (cur_string->num_of_params < 0) { + pr_debug("%s Invalid format string parameters\n", + __func__); + mlx5_tracer_handle_bad_format_string(tracer, cur_string); + return 0; + } if (cur_string->num_of_params == 0) /* trace with no params */ list_add_tail(&cur_string->list, &tracer->ready_strings_list); } else { @@ -634,6 +692,11 @@ static int mlx5_tracer_handle_string_trace(struct mlx5_fw_tracer *tracer, __func__, tracer_event->string_event.tmsn); return mlx5_tracer_handle_raw_string(tracer, tracer_event); } + if (cur_string->num_of_params < 0) { + pr_debug("%s string parameter of invalid string, dumping\n", + __func__); + return 0; + } cur_string->last_param_num += 1; if (cur_string->last_param_num > TRACER_MAX_PARAMS) { pr_debug("%s Number of params exceeds the max (%d)\n", diff --git a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.h b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.h index 5c548bb74f07b..30d0bcba88479 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.h +++ b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.h @@ -125,6 +125,7 @@ struct tracer_string_format { struct list_head list; u32 timestamp; bool lost; + bool invalid_string; }; enum mlx5_fw_tracer_ownership_state { -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] CVE-2022-50616
by Liu Mingrui 02 Feb '26

02 Feb '26

From: Mingrui Liu <liumingrui(a)huawei.com> CVE-2022-50616 ChiYuan Huang (2): regulator: core: Use different devices for resource allocation and DT lookup regulator: core: Fix resolve supply lookup issue drivers/regulator/core.c | 10 +++++----- drivers/regulator/devres.c | 2 +- drivers/regulator/dummy.c | 2 +- drivers/regulator/of_regulator.c | 2 +- drivers/regulator/stm32-vrefbuf.c | 2 +- drivers/staging/hikey9xx/hi6421v600-regulator.c | 2 +- include/linux/regulator/driver.h | 3 ++- 7 files changed, 12 insertions(+), 11 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 1/1] crypto: aspeed - fix double free caused by devm
by Liu Mingrui 02 Feb '26

02 Feb '26

From: Haotian Zhang <vulab(a)iscas.ac.cn> stable inclusion from stable-v6.6.117 commit 0dd6474ced33489076e6c0f3fe5077bf12e85b28 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/8287 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3c9bf72cc1ced1297b235f9422d62b613a3fdae9 ] The clock obtained via devm_clk_get_enabled() is automatically managed by devres and will be disabled and freed on driver detach. Manually calling clk_disable_unprepare() in error path and remove function causes double free. Remove the manual clock cleanup in both aspeed_acry_probe()'s error path and aspeed_acry_remove(). Fixes: 2f1cf4e50c95 ("crypto: aspeed - Add ACRY RSA driver") Signed-off-by: Haotian Zhang <vulab(a)iscas.ac.cn> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Mingrui Liu <liumingrui(a)huawei.com> --- drivers/crypto/aspeed/aspeed-acry.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/crypto/aspeed/aspeed-acry.c b/drivers/crypto/aspeed/aspeed-acry.c index 247c568aa8df..64facdfaff2a 100644 --- a/drivers/crypto/aspeed/aspeed-acry.c +++ b/drivers/crypto/aspeed/aspeed-acry.c @@ -789,7 +789,6 @@ static int aspeed_acry_probe(struct platform_device *pdev) err_engine_rsa_start: crypto_engine_exit(acry_dev->crypt_engine_rsa); clk_exit: - clk_disable_unprepare(acry_dev->clk); return rc; } @@ -801,7 +800,6 @@ static int aspeed_acry_remove(struct platform_device *pdev) aspeed_acry_unregister(acry_dev); crypto_engine_exit(acry_dev->crypt_engine_rsa); tasklet_kill(&acry_dev->done_task); - clk_disable_unprepare(acry_dev->clk); return 0; } -- 2.34.1

2 1

[PATCH OLK-5.10 0/4] CVE-2025-39744 fixup
by Jiacheng Yu 02 Feb '26

02 Feb '26

*** BLURB HERE *** Frederic Weisbecker (1): rcu: Fix racy re-initialization of irq_work causing hangs Joel Fernandes (1): rcu: Fix rcu_read_unlock() deadloop due to IRQ work Paul E. McKenney (1): rcu: Protect ->defer_qs_iw_pending from data race Zqiang (1): rcu: Use IRQ_WORK_INIT_HARD() to avoid rcu_read_unlock() hangs kernel/rcu/tree.c | 1 + kernel/rcu/tree.h | 14 +++++++++++++- kernel/rcu/tree_plugin.h | 39 +++++++++++++++++++++++++++++++++------ 3 files changed, 47 insertions(+), 7 deletions(-) -- 2.43.0

2 5

[PATCH OLK-6.6 0/3] CVE-2025-39744 fixup
by Jiacheng Yu 02 Feb '26

02 Feb '26

*** BLURB HERE *** Frederic Weisbecker (1): rcu: Fix racy re-initialization of irq_work causing hangs Joel Fernandes (1): rcu: Fix rcu_read_unlock() deadloop due to IRQ work Paul E. McKenney (1): rcu: Protect ->defer_qs_iw_pending from data race kernel/rcu/tree.c | 2 ++ kernel/rcu/tree.h | 14 ++++++++++++- kernel/rcu/tree_plugin.h | 44 ++++++++++++++++++++++++++++++---------- 3 files changed, 48 insertions(+), 12 deletions(-) -- 2.43.0

2 4

[PATCH OLK-5.10 0/2] CVE-2022-50616
by Liu Mingrui 02 Feb '26

02 Feb '26

From: Mingrui Liu <liumingrui(a)huawei.com> CVE-2022-50616 ChiYuan Huang (2): regulator: core: Use different devices for resource allocation and DT lookup regulator: core: Fix resolve supply lookup issue drivers/regulator/core.c | 10 +++++----- drivers/regulator/devres.c | 2 +- drivers/regulator/dummy.c | 2 +- drivers/regulator/of_regulator.c | 2 +- drivers/regulator/stm32-vrefbuf.c | 2 +- drivers/staging/hikey9xx/hi6421v600-regulator.c | 2 +- include/linux/regulator/driver.h | 3 ++- 7 files changed, 12 insertions(+), 11 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] Bluetooth: bcsp: receive data only if registered
by Yin Tirui 02 Feb '26

02 Feb '26

From: Ivan Pravdin <ipravdin.official(a)gmail.com> stable inclusion from stable-v6.6.117 commit 799cd62cbcc3f12ee04b33ef390ff7d41c37d671 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/11320 CVE: CVE-2025-40308 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ca94b2b036c22556c3a66f1b80f490882deef7a6 ] Currently, bcsp_recv() can be called even when the BCSP protocol has not been registered. This leads to a NULL pointer dereference, as shown in the following stack trace: KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f] RIP: 0010:bcsp_recv+0x13d/0x1740 drivers/bluetooth/hci_bcsp.c:590 Call Trace: <TASK> hci_uart_tty_receive+0x194/0x220 drivers/bluetooth/hci_ldisc.c:627 tiocsti+0x23c/0x2c0 drivers/tty/tty_io.c:2290 tty_ioctl+0x626/0xde0 drivers/tty/tty_io.c:2706 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f To prevent this, ensure that the HCI_UART_REGISTERED flag is set before processing received data. If the protocol is not registered, return -EUNATCH. Reported-by: syzbot+4ed6852d4da4606c93da(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=4ed6852d4da4606c93da Tested-by: syzbot+4ed6852d4da4606c93da(a)syzkaller.appspotmail.com Signed-off-by: Ivan Pravdin <ipravdin.official(a)gmail.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yin Tirui <yintirui(a)huawei.com> --- drivers/bluetooth/hci_bcsp.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/bluetooth/hci_bcsp.c b/drivers/bluetooth/hci_bcsp.c index 2a5a27d713f8..e991d9e62486 100644 --- a/drivers/bluetooth/hci_bcsp.c +++ b/drivers/bluetooth/hci_bcsp.c @@ -582,6 +582,9 @@ static int bcsp_recv(struct hci_uart *hu, const void *data, int count) struct bcsp_struct *bcsp = hu->priv; const unsigned char *ptr; + if (!test_bit(HCI_UART_REGISTERED, &hu->flags)) + return -EUNATCH; + BT_DBG("hu %p count %d rx_state %d rx_count %ld", hu, count, bcsp->rx_state, bcsp->rx_count); -- 2.43.0

2 1

[PATCH OLK-6.6] Bluetooth: bcsp: receive data only if registered
by Yin Tirui 02 Feb '26

02 Feb '26

From: Ivan Pravdin <ipravdin.official(a)gmail.com> stable inclusion from stable-v6.6.117 commit 799cd62cbcc3f12ee04b33ef390ff7d41c37d671 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IDBAE0 CVE: CVE-2025-40308 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ca94b2b036c22556c3a66f1b80f490882deef7a6 ] Currently, bcsp_recv() can be called even when the BCSP protocol has not been registered. This leads to a NULL pointer dereference, as shown in the following stack trace: KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f] RIP: 0010:bcsp_recv+0x13d/0x1740 drivers/bluetooth/hci_bcsp.c:590 Call Trace: <TASK> hci_uart_tty_receive+0x194/0x220 drivers/bluetooth/hci_ldisc.c:627 tiocsti+0x23c/0x2c0 drivers/tty/tty_io.c:2290 tty_ioctl+0x626/0xde0 drivers/tty/tty_io.c:2706 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f To prevent this, ensure that the HCI_UART_REGISTERED flag is set before processing received data. If the protocol is not registered, return -EUNATCH. Reported-by: syzbot+4ed6852d4da4606c93da(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=4ed6852d4da4606c93da Tested-by: syzbot+4ed6852d4da4606c93da(a)syzkaller.appspotmail.com Signed-off-by: Ivan Pravdin <ipravdin.official(a)gmail.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yin Tirui <yintirui(a)huawei.com> --- drivers/bluetooth/hci_bcsp.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/bluetooth/hci_bcsp.c b/drivers/bluetooth/hci_bcsp.c index 2a5a27d713f8..e991d9e62486 100644 --- a/drivers/bluetooth/hci_bcsp.c +++ b/drivers/bluetooth/hci_bcsp.c @@ -582,6 +582,9 @@ static int bcsp_recv(struct hci_uart *hu, const void *data, int count) struct bcsp_struct *bcsp = hu->priv; const unsigned char *ptr; + if (!test_bit(HCI_UART_REGISTERED, &hu->flags)) + return -EUNATCH; + BT_DBG("hu %p count %d rx_state %d rx_count %ld", hu, count, bcsp->rx_state, bcsp->rx_count); -- 2.43.0

2 1

[PATCH OLK-6.6] XSched: Update XSched manual
by Liu Kai 02 Feb '26

02 Feb '26

hulk inclusion category: doc bugzilla: https://atomgit.com/openeuler/kernel/issues/8423 -------------------------------- Update the patch link Signed-off-by: Liu Kai <liukai284(a)huawei.com> --- Documentation/scheduler/xsched.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/Documentation/scheduler/xsched.md b/Documentation/scheduler/xsched.md index 89ef01d42fc0..11dc0c964e0a 100644 --- a/Documentation/scheduler/xsched.md +++ b/Documentation/scheduler/xsched.md @@ -84,7 +84,7 @@ mkdir <new_driver_dir> ./Ascend-hdk-910b-npu-driver_xx.x.x_linux-aarch64.run --tar -xvf -C <new_driver_dir> ``` -下载驱动补丁 [XSched driver patch](https://gitee.com/openeuler/kernel/commit/8d50448f11b697a177b63d3ccb… 适配 NPU 驱动 +下载驱动补丁 [XSched driver patch](https://gitcode.com/openeuler/kernel/commit/58e645cf8fd8d96573b70153… 适配 NPU 驱动 ```shell cp 0001-Adapt-910b-npu-driver-for-xsched.patch <new_driver_dir>/driver/kernel/ @@ -94,8 +94,10 @@ cd <new_driver_dir>/driver/kernel/ git init git add . git commit -m "npu init" +# 使用下载的 patch 文件 +git am 58e645cf8fd8d96573b7015385bf52522ebfee67.patch --reject # 如果有冲突则根据 .rej 文件适配冲突代码 -git am 0001-Adapt-910b-npu-driver-for-xsched.patch --reject +git am drivers/xcu/0001-Adapt-910_93-npu-driver-for-xsched.txt --reject ``` #### 1.3.2 替换驱动 -- 2.34.1

2 1

[PATCH OLK-6.6 0/3] adapt LTS patch 5ba723cc37230e616fe47ec19d441ba3168b4c4c
by Quanmin Yan 02 Feb '26

02 Feb '26

The original LTS patch is incompatible with the atomic mode of the mm counter. Therefore, the patch needs to be reverted and adapted again. Baolin Wang (1): mm: fix the inaccurate memory statistics issue for users Quanmin Yan (2): Revert "mm: fix the inaccurate memory statistics issue for users" mm: add config option for atomic mode in mm counter arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + include/linux/mm.h | 53 ++++++++++++++++++++------ include/trace/events/kmem.h | 2 +- kernel/fork.c | 26 ++++++++++--- mm/Kconfig | 12 ++++++ 6 files changed, 78 insertions(+), 17 deletions(-) -- 2.43.0

2 4

[PATCH OLK-6.6] arch_topology: Fix incorrect error check in topology_parse_cpu_capacity()
by Wang Wensheng 02 Feb '26

02 Feb '26

From: Kaushlendra Kumar <kaushlendra.kumar(a)intel.com> stable inclusion from stable-v6.6.115 commit 3373f263bb647fcc3b5237cfaef757633b9ee25e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/11599 CVE: CVE-2025-40346 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 2eead19334516c8e9927c11b448fbe512b1f18a1 upstream. Fix incorrect use of PTR_ERR_OR_ZERO() in topology_parse_cpu_capacity() which causes the code to proceed with NULL clock pointers. The current logic uses !PTR_ERR_OR_ZERO(cpu_clk) which evaluates to true for both valid pointers and NULL, leading to potential NULL pointer dereference in clk_get_rate(). Per include/linux/err.h documentation, PTR_ERR_OR_ZERO(ptr) returns: "The error code within @ptr if it is an error pointer; 0 otherwise." This means PTR_ERR_OR_ZERO() returns 0 for both valid pointers AND NULL pointers. Therefore !PTR_ERR_OR_ZERO(cpu_clk) evaluates to true (proceed) when cpu_clk is either valid or NULL, causing clk_get_rate(NULL) to be called when of_clk_get() returns NULL. Replace with !IS_ERR_OR_NULL(cpu_clk) which only proceeds for valid pointers, preventing potential NULL pointer dereference in clk_get_rate(). Cc: stable <stable(a)kernel.org> Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar(a)intel.com> Reviewed-by: Sudeep Holla <sudeep.holla(a)arm.com> Fixes: b8fe128dad8f ("arch_topology: Adjust initial CPU capacities with current freq") Link: https://patch.msgid.link/20250923174308.1771906-1-kaushlendra.kumar@intel.c… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/base/arch_topology.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/base/arch_topology.c b/drivers/base/arch_topology.c index 998aefb44315..14aade8b591d 100644 --- a/drivers/base/arch_topology.c +++ b/drivers/base/arch_topology.c @@ -347,7 +347,7 @@ bool __init topology_parse_cpu_capacity(struct device_node *cpu_node, int cpu) * frequency (by keeping the initial capacity_freq_ref value). */ cpu_clk = of_clk_get(cpu_node, 0); - if (!PTR_ERR_OR_ZERO(cpu_clk)) { + if (!IS_ERR_OR_NULL(cpu_clk)) { per_cpu(capacity_freq_ref, cpu) = clk_get_rate(cpu_clk) / HZ_PER_KHZ; clk_put(cpu_clk); -- 2.22.0

2 1

[PATCH OLK-6.6] drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies
by Wang Wensheng 02 Feb '26

02 Feb '26

From: Tvrtko Ursulin <tvrtko.ursulin(a)igalia.com> stable inclusion from stable-v6.6.114 commit 57239762aa90ad768dac055021f27705dae73344 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/12320 CVE: CVE-2025-40096 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 5801e65206b065b0b2af032f7f1eef222aa2fd83 upstream. When adding dependencies with drm_sched_job_add_dependency(), that function consumes the fence reference both on success and failure, so in the latter case the dma_fence_put() on the error path (xarray failed to expand) is a double free. Interestingly this bug appears to have been present ever since commit ebd5f74255b9 ("drm/sched: Add dependency tracking"), since the code back then looked like this: drm_sched_job_add_implicit_dependencies(): ... for (i = 0; i < fence_count; i++) { ret = drm_sched_job_add_dependency(job, fences[i]); if (ret) break; } for (; i < fence_count; i++) dma_fence_put(fences[i]); Which means for the failing 'i' the dma_fence_put was already a double free. Possibly there were no users at that time, or the test cases were insufficient to hit it. The bug was then only noticed and fixed after commit 9c2ba265352a ("drm/scheduler: use new iterator in drm_sched_job_add_implicit_dependencies v2") landed, with its fixup of commit 4eaf02d6076c ("drm/scheduler: fix drm_sched_job_add_implicit_dependencies"). At that point it was a slightly different flavour of a double free, which commit 963d0b356935 ("drm/scheduler: fix drm_sched_job_add_implicit_dependencies harder") noticed and attempted to fix. But it only moved the double free from happening inside the drm_sched_job_add_dependency(), when releasing the reference not yet obtained, to the caller, when releasing the reference already released by the former in the failure case. As such it is not easy to identify the right target for the fixes tag so lets keep it simple and just continue the chain. While fixing we also improve the comment and explain the reason for taking the reference and not dropping it. Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin(a)igalia.com> Fixes: 963d0b356935 ("drm/scheduler: fix drm_sched_job_add_implicit_dependencies harder") Reported-by: Dan Carpenter <dan.carpenter(a)linaro.org> Closes: https://lore.kernel.org/dri-devel/aNFbXq8OeYl3QSdm@stanley.mountain/ Cc: Christian König <christian.koenig(a)amd.com> Cc: Rob Clark <robdclark(a)chromium.org> Cc: Daniel Vetter <daniel.vetter(a)ffwll.ch> Cc: Matthew Brost <matthew.brost(a)intel.com> Cc: Danilo Krummrich <dakr(a)kernel.org> Cc: Philipp Stanner <phasta(a)kernel.org> Cc: Christian König <ckoenig.leichtzumerken(a)gmail.com> Cc: dri-devel(a)lists.freedesktop.org Cc: stable(a)vger.kernel.org # v5.16+ Signed-off-by: Philipp Stanner <phasta(a)kernel.org> Link: https://lore.kernel.org/r/20251015084015.6273-1-tvrtko.ursulin@igalia.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Signed-off-by: Wang Wensheng <wangwensheng4(a)huawei.com> --- drivers/gpu/drm/scheduler/sched_main.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/drivers/gpu/drm/scheduler/sched_main.c b/drivers/gpu/drm/scheduler/sched_main.c index fa4652f23471..4faa2108c0a7 100644 --- a/drivers/gpu/drm/scheduler/sched_main.c +++ b/drivers/gpu/drm/scheduler/sched_main.c @@ -783,13 +783,14 @@ int drm_sched_job_add_resv_dependencies(struct drm_sched_job *job, dma_resv_assert_held(resv); dma_resv_for_each_fence(&cursor, resv, usage, fence) { - /* Make sure to grab an additional ref on the added fence */ - dma_fence_get(fence); - ret = drm_sched_job_add_dependency(job, fence); - if (ret) { - dma_fence_put(fence); + /* + * As drm_sched_job_add_dependency always consumes the fence + * reference (even when it fails), and dma_resv_for_each_fence + * is not obtaining one, we need to grab one before calling. + */ + ret = drm_sched_job_add_dependency(job, dma_fence_get(fence)); + if (ret) return ret; - } } return 0; } -- 2.22.0

2 1

[PATCH OLK-6.6] iommu/amd: Avoid stack buffer overflow from kernel cmdline
by Wang Wensheng 02 Feb '26

02 Feb '26

From: Kees Cook <kees(a)kernel.org> stable inclusion from stable-v6.6.103 commit 8f80c633cba144f721d38d9380f23d23ab7db10e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/9098 CVE: CVE-2025-38676 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 8503d0fcb1086a7cfe26df67ca4bd9bd9e99bdec ] While the kernel command line is considered trusted in most environments, avoid writing 1 byte past the end of "acpiid" if the "str" argument is maximum length. Reported-by: Simcha Kosman <simcha.kosman(a)cyberark.com> Closes: https://lore.kernel.org/all/AS8P193MB2271C4B24BCEDA31830F37AE84A52@AS8P193M… Fixes: b6b26d86c61c ("iommu/amd: Add a length limitation for the ivrs_acpihid command-line parameter") Signed-off-by: Kees Cook <kees(a)kernel.org> Reviewed-by: Ankit Soni <Ankit.Soni(a)amd.com> Link: https://lore.kernel.org/r/20250804154023.work.970-kees@kernel.org Signed-off-by: Joerg Roedel <joerg.roedel(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Wensheng <wangwensheng4(a)huawei.com> --- drivers/iommu/amd/init.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c index e3d4a23b66fd..090b88a4b1e3 100644 --- a/drivers/iommu/amd/init.c +++ b/drivers/iommu/amd/init.c @@ -3633,7 +3633,7 @@ static int __init parse_ivrs_acpihid(char *str) { u32 seg = 0, bus, dev, fn; char *hid, *uid, *p, *addr; - char acpiid[ACPIID_LEN] = {0}; + char acpiid[ACPIID_LEN + 1] = { }; /* size with NULL terminator */ int i; addr = strchr(str, '@'); @@ -3659,7 +3659,7 @@ static int __init parse_ivrs_acpihid(char *str) /* We have the '@', make it the terminator to get just the acpiid */ *addr++ = 0; - if (strlen(str) > ACPIID_LEN + 1) + if (strlen(str) > ACPIID_LEN) goto not_found; if (sscanf(str, "=%s", acpiid) != 1) -- 2.22.0

2 1

[PATCH OLK-6.6] HID: core: Harden s32ton() against conversion to 0 bits
by Wang Wensheng 02 Feb '26

02 Feb '26

From: Alan Stern <stern(a)rowland.harvard.edu> mainline inclusion from mainline-v6.17-rc1 commit a6b87bfc2ab5bccb7ad953693c85d9062aef3fdd category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/9186 CVE: CVE-2025-38556 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Testing by the syzbot fuzzer showed that the HID core gets a shift-out-of-bounds exception when it tries to convert a 32-bit quantity to a 0-bit quantity. Ideally this should never occur, but there are buggy devices and some might have a report field with size set to zero; we shouldn't reject the report or the device just because of that. Instead, harden the s32ton() routine so that it returns a reasonable result instead of crashing when it is called with the number of bits set to 0 -- the same as what snto32() does. Signed-off-by: Alan Stern <stern(a)rowland.harvard.edu> Reported-by: syzbot+b63d677d63bcac06cf90(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-usb/68753a08.050a0220.33d347.0008.GAE@google.… Tested-by: syzbot+b63d677d63bcac06cf90(a)syzkaller.appspotmail.com Fixes: dde5845a529f ("[PATCH] Generic HID layer - code split") Cc: stable(a)vger.kernel.org Link: https://patch.msgid.link/613a66cd-4309-4bce-a4f7-2905f9bce0c9@rowland.harva… Signed-off-by: Benjamin Tissoires <bentiss(a)kernel.org> Conflicts: drivers/hid/hid-core.c [Only context conflict because of commit c653ffc283404 is not applied] Signed-off-by: Wang Wensheng <wangwensheng4(a)huawei.com> --- drivers/hid/hid-core.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c index 266cd56dec50..d8fda282d049 100644 --- a/drivers/hid/hid-core.c +++ b/drivers/hid/hid-core.c @@ -1351,7 +1351,12 @@ EXPORT_SYMBOL_GPL(hid_snto32); static u32 s32ton(__s32 value, unsigned n) { - s32 a = value >> (n - 1); + s32 a; + + if (!value || !n) + return 0; + + a = value >> (n - 1); if (a && a != -1) return value < 0 ? 1 << (n - 1) : (1 << (n - 1)) - 1; return value & ((1 << n) - 1); -- 2.22.0

2 1

[PATCH OLK-6.6] iommu: Fix two issues in iommu_copy_struct_from_user()
by Wang Wensheng 02 Feb '26

02 Feb '26

From: Nicolin Chen <nicolinc(a)nvidia.com> mainline inclusion from mainline-v6.15-rc5 commit 30a3f2f3e4bd6335b727c83c08a982d969752bc1 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/10084 CVE: CVE-2025-37900 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In the review for iommu_copy_struct_to_user() helper, Matt pointed out that a NULL pointer should be rejected prior to dereferencing it: https://lore.kernel.org/all/86881827-8E2D-461C-BDA3-FA8FD14C343C@nvidia.com And Alok pointed out a typo at the same time: https://lore.kernel.org/all/480536af-6830-43ce-a327-adbd13dc3f1d@oracle.com Since both issues were copied from iommu_copy_struct_from_user(), fix them first in the current header. Fixes: e9d36c07bb78 ("iommu: Add iommu_copy_struct_from_user helper") Cc: stable(a)vger.kernel.org Signed-off-by: Nicolin Chen <nicolinc(a)nvidia.com> Reviewed-by: Kevin Tian <kevin.tian(a)intel.com> Acked-by: Alok Tiwari <alok.a.tiwari(a)oracle.com> Reviewed-by: Matthew R. Ochs <mochs(a)nvidia.com> Link: https://lore.kernel.org/r/20250414191635.450472-1-nicolinc@nvidia.com Signed-off-by: Joerg Roedel <jroedel(a)suse.de> Signed-off-by: Wang Wensheng <wangwensheng4(a)huawei.com> --- include/linux/iommu.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/include/linux/iommu.h b/include/linux/iommu.h index ceecbc5ba759..974c3b94365f 100644 --- a/include/linux/iommu.h +++ b/include/linux/iommu.h @@ -517,10 +517,10 @@ static inline int __iommu_copy_struct_from_user( void *dst_data, const struct iommu_user_data *src_data, unsigned int data_type, size_t data_len, size_t min_len) { - if (src_data->type != data_type) - return -EINVAL; if (WARN_ON(!dst_data || !src_data)) return -EINVAL; + if (src_data->type != data_type) + return -EINVAL; if (src_data->len < min_len || data_len < src_data->len) return -EINVAL; return copy_struct_from_user(dst_data, data_len, src_data->uptr, @@ -533,8 +533,8 @@ static inline int __iommu_copy_struct_from_user( * include/uapi/linux/iommufd.h * @user_data: Pointer to a struct iommu_user_data for user space data info * @data_type: The data type of the @kdst. Must match with @user_data->type - * @min_last: The last memember of the data structure @kdst points in the - * initial version. + * @min_last: The last member of the data structure @kdst points in the initial + * version. * Return 0 for success, otherwise -error. */ #define iommu_copy_struct_from_user(kdst, user_data, data_type, min_last) \ -- 2.22.0

2 1

[PATCH OLK-6.6] scsi: leapraid: add RAID disk hide/show events and fix misc issues
by haodongdong 02 Feb '26

02 Feb '26

LeapIO inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/8462 ------------------------------------------ This change introduces RAID disk hide/show events to allow dynamic visibility control of RAID devices. It also updates the MSI-X vector count retrieval logic and unifies driver naming from LeapRaid to LeapRAID for consistency. In addition, fix an issue where the fw_log workqueue was not properly released during system shutdown, which could lead to resource leaks. Signed-off-by: haodongdong <doubled(a)leap-io.com> --- drivers/scsi/leapraid/leapraid.h | 2 + drivers/scsi/leapraid/leapraid_func.c | 104 ++++++++++++++++++++++---- drivers/scsi/leapraid/leapraid_func.h | 47 ++++++------ drivers/scsi/leapraid/leapraid_os.c | 2 +- 4 files changed, 116 insertions(+), 39 deletions(-) diff --git a/drivers/scsi/leapraid/leapraid.h b/drivers/scsi/leapraid/leapraid.h index 842810d41542..77bb93b79254 100644 --- a/drivers/scsi/leapraid/leapraid.h +++ b/drivers/scsi/leapraid/leapraid.h @@ -310,6 +310,8 @@ #define LEAPRAID_EVT_IR_RC_PD_UNHIDDEN_TO_DELETE 0x04 #define LEAPRAID_EVT_IR_RC_PD_CREATED_TO_HIDE 0x05 #define LEAPRAID_EVT_IR_RC_PD_DELETED_TO_EXPOSE 0x06 +#define LEAPRAID_EVT_IR_RC_VOLUME_HIDE 0x0A +#define LEAPRAID_EVT_IR_RC_VOLUME_UNHIDE 0x0B /* sas topology change event */ #define LEAPRAID_EVT_SAS_TOPO_ES_NO_EXPANDER 0x00 diff --git a/drivers/scsi/leapraid/leapraid_func.c b/drivers/scsi/leapraid/leapraid_func.c index 2fc142fff982..ad8aee40e2c1 100644 --- a/drivers/scsi/leapraid/leapraid_func.c +++ b/drivers/scsi/leapraid/leapraid_func.c @@ -4132,6 +4132,66 @@ static void leapraid_sas_pd_expose( } } +static void leapraid_sas_vol_visibility(struct leapraid_adapter *adapter, + struct leapraid_evt_data_ir_change *evt_data) +{ + struct leapraid_raid_volume *raid_volume = NULL; + struct scsi_device *sdev = NULL; + u16 hdl = 0; + unsigned long flags; + u8 rc = 0; + u8 reprobe_flg = 0; + + hdl = le16_to_cpu(evt_data->vol_dev_hdl); + rc = evt_data->reason_code; + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); + raid_volume = leapraid_raid_volume_find_by_hdl(adapter, hdl); + if (!raid_volume) { + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, + flags); + dev_warn(&adapter->pdev->dev, + "%s:%d: volume handle 0x%x not found\n", + __func__, __LINE__, hdl); + return; + } + + reprobe_flg = 0; + sdev = raid_volume->sdev; + if (sdev) { + if (sdev->no_uld_attach) { + if (rc == LEAPRAID_EVT_IR_RC_VOLUME_UNHIDE) { + sdev->no_uld_attach = 0; + reprobe_flg = 1; + } + } else { + if (rc == LEAPRAID_EVT_IR_RC_VOLUME_HIDE) { + sdev->no_uld_attach = 1; + reprobe_flg = 1; + } + } + + if (reprobe_flg) { + if (sdev->no_uld_attach) + sdev_printk(KERN_INFO, sdev, "hide vol\n"); + else + sdev_printk(KERN_INFO, sdev, "unhide vol\n"); + + WARN_ON(scsi_device_reprobe(sdev)); + } else { + dev_warn(&adapter->pdev->dev, + "%s:rc(0x%x):request matches, skipping.\n", + __func__, rc); + } + + } else { + dev_warn(&adapter->pdev->dev, + "%s:%d: volume handle 0x%x has no sdev\n", + __func__, __LINE__, hdl); + } + + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); +} + static void leapraid_sas_volume_add(struct leapraid_adapter *adapter, struct leapraid_evt_data_ir_change *evt_data) { @@ -4250,6 +4310,10 @@ static void leapraid_sas_ir_chg_evt(struct leapraid_adapter *adapter, case LEAPRAID_EVT_IR_RC_PD_DELETED_TO_EXPOSE: leapraid_sas_pd_expose(adapter, evt_data); break; + case LEAPRAID_EVT_IR_RC_VOLUME_HIDE: + case LEAPRAID_EVT_IR_RC_VOLUME_UNHIDE: + leapraid_sas_vol_visibility(adapter, evt_data); + break; default: break; } @@ -6397,6 +6461,8 @@ static int leapraid_get_adapter_features(struct leapraid_adapter *adapter) le16_to_cpu(leap_mpi_rep.hp_slot); adapter->adapter_attr.features.adapter_caps = le32_to_cpu(leap_mpi_rep.adapter_caps); + adapter->adapter_attr.features.max_msix_vectors = + leap_mpi_rep.max_msix_vectors; adapter->adapter_attr.features.max_volumes = leap_mpi_rep.max_volumes; if (!adapter->adapter_attr.features.max_volumes) @@ -6754,11 +6820,15 @@ static int leapraid_set_msix(struct leapraid_adapter *adapter) goto legacy_int; msix_cnt = leapraid_msix_cnt(adapter->pdev); - if (msix_cnt <= 0) { + if (msix_cnt <= 0 || + adapter->adapter_attr.features.max_msix_vectors == 0) { dev_info(&adapter->pdev->dev, "msix unsupported!\n"); goto legacy_int; } + msix_cnt = min_t(int, msix_cnt, + adapter->adapter_attr.features.max_msix_vectors); + if (reset_devices) adapter->adapter_attr.rq_cnt = 1; else @@ -6859,11 +6929,15 @@ static int leapraid_set_msi(struct leapraid_adapter *adapter) goto legacy_int1; msi_cnt = leapraid_msi_cnt(adapter->pdev); - if (msi_cnt <= 0) { - dev_info(&adapter->pdev->dev, "msix unsupported!\n"); + if (msi_cnt <= 0 || + adapter->adapter_attr.features.max_msix_vectors == 0) { + dev_info(&adapter->pdev->dev, "msi unsupported!\n"); goto legacy_int1; } + msi_cnt = min_t(int, msi_cnt, + adapter->adapter_attr.features.max_msix_vectors); + if (reset_devices) adapter->adapter_attr.rq_cnt = 1; else @@ -7015,6 +7089,18 @@ int leapraid_set_pcie_and_notification(struct leapraid_adapter *adapter) leapraid_mask_int(adapter); + rc = leapraid_make_adapter_ready(adapter, PART_RESET); + if (rc) { + dev_err(&adapter->pdev->dev, "make adapter ready failure\n"); + goto out_fail; + } + + rc = leapraid_get_adapter_features(adapter); + if (rc) { + dev_err(&adapter->pdev->dev, "get adapter feature failure\n"); + goto out_fail; + } + rc = leapraid_set_notification(adapter); if (rc) goto out_fail; @@ -8185,18 +8271,6 @@ int leapraid_ctrl_init(struct leapraid_adapter *adapter) PCI_EXP_DEVCTL_EXT_TAG); } - rc = leapraid_make_adapter_ready(adapter, PART_RESET); - if (rc) { - dev_err(&adapter->pdev->dev, "make adapter ready failure\n"); - goto out_free_resources; - } - - rc = leapraid_get_adapter_features(adapter); - if (rc) { - dev_err(&adapter->pdev->dev, "get adapter feature failure\n"); - goto out_free_resources; - } - rc = leapraid_fw_log_init(adapter); if (rc) { dev_err(&adapter->pdev->dev, "fw log init failure\n"); diff --git a/drivers/scsi/leapraid/leapraid_func.h b/drivers/scsi/leapraid/leapraid_func.h index 2c51ef359b7e..f7072d078315 100644 --- a/drivers/scsi/leapraid/leapraid_func.h +++ b/drivers/scsi/leapraid/leapraid_func.h @@ -46,15 +46,15 @@ #define LEAPRAID_SYS_LOG_BUF_RESERVE 0x1000 /* Driver version and name */ -#define LEAPRAID_DRIVER_NAME "LeapRaid" +#define LEAPRAID_DRIVER_NAME "LeapRAID" #define LEAPRAID_NAME_LENGTH 48 #define LEAPRAID_AUTHOR "LeapIO Inc." -#define LEAPRAID_DESCRIPTION "LeapRaid Driver" -#define LEAPRAID_DRIVER_VERSION "2.00.00.05" +#define LEAPRAID_DESCRIPTION "LeapRAID Driver" +#define LEAPRAID_DRIVER_VERSION "2.00.00.06" #define LEAPRAID_MAJOR_VERSION 2 #define LEAPRAID_MINOR_VERSION 00 #define LEAPRAID_BUILD_VERSION 00 -#define LEAPRAID_RELEASE_VERSION 05 +#define LEAPRAID_RELEASE_VERSION 06 /* Device ID */ #define LEAPRAID_VENDOR_ID 0xD405 @@ -243,6 +243,7 @@ struct leapraid_adapter_features { u16 hp_slot; u32 adapter_caps; u32 fw_version; + u8 max_msix_vectors; u8 max_volumes; u16 max_dev_handle; u16 min_dev_handle; @@ -349,7 +350,7 @@ struct leapraid_rep_desc_seg_maint { }; /** - * struct leapraid_mem_desc - Memory descriptor for LeapRaid adapter + * struct leapraid_mem_desc - Memory descriptor for LeapRAID adapter * * @task_desc: Pointer to task descriptor * @task_desc_dma: DMA address of task descriptor @@ -395,7 +396,7 @@ struct leapraid_mem_desc { #define LEAPRAID_CMD_RESET 0x0008 /** - * enum LEAPRAID_CB_INDEX - Callback index for LeapRaid driver + * enum LEAPRAID_CB_INDEX - Callback index for LeapRAID driver * * @LEAPRAID_SCAN_DEV_CB_IDX: Scan device callback index * @LEAPRAID_CONFIG_CB_IDX: Configuration callback index @@ -513,7 +514,7 @@ struct leapraid_dynamic_task_desc { * struct leapraid_fw_evt_work - Firmware event work structure * * @list: Linked list node for queuing the work - * @adapter: Pointer to the associated LeapRaid adapter + * @adapter: Pointer to the associated LeapRAID adapter * @work: Work structure used by the kernel workqueue * @refcnt: Reference counter for managing the lifetime of this work * @evt_data: Pointer to firmware event data @@ -554,9 +555,9 @@ struct leapraid_fw_evt_struct { }; /** - * struct leapraid_rq - Represents a LeapRaid request queue + * struct leapraid_rq - Represents a LeapRAID request queue * - * @adapter: Pointer to the associated LeapRaid adapter + * @adapter: Pointer to the associated LeapRAID adapter * @msix_idx: MSI-X vector index used by this queue * @rep_post_host_idx: Index of the last processed reply descriptor * @rep_desc: Pointer to the reply descriptor associated with this queue @@ -576,7 +577,7 @@ struct leapraid_rq { * struct leapraid_int_rq - Internal request queue for a CPU * * @affinity_hint: CPU affinity mask for the queue - * @rq: Underlying LeapRaid request queue structure + * @rq: Underlying LeapRAID request queue structure */ struct leapraid_int_rq { cpumask_var_t affinity_hint; @@ -584,11 +585,11 @@ struct leapraid_int_rq { }; /** - * struct leapraid_blk_mq_poll_rq - Polling request for LeapRaid blk-mq + * struct leapraid_blk_mq_poll_rq - Polling request for LeapRAID blk-mq * * @busy: Atomic flag indicating request is being processed * @pause: Atomic flag to temporarily suspend polling - * @rq: The underlying LeapRaid request structure + * @rq: The underlying LeapRAID request structure */ struct leapraid_blk_mq_poll_rq { atomic_t busy; @@ -598,7 +599,7 @@ struct leapraid_blk_mq_poll_rq { /** * struct leapraid_notification_desc - Notification - * descriptor for LeapRaid + * descriptor for LeapRAID * * @iopoll_qdex: Index of the I/O polling queue * @iopoll_qcnt: Count of I/O polling queues @@ -621,7 +622,7 @@ struct leapraid_notification_desc { }; /** - * struct leapraid_reset_desc - Reset descriptor for LeapRaid + * struct leapraid_reset_desc - Reset descriptor for LeapRAID * * @fault_reset_wq: Workqueue for fault reset operations * @fault_reset_work: Delayed work structure for fault reset @@ -651,7 +652,7 @@ struct leapraid_reset_desc { /** * struct leapraid_scan_dev_desc - Scan device descriptor - * for LeapRaid + * for LeapRAID * * @wait_scan_dev_done: Flag indicating if scan device operation is done * @driver_loading: Flag indicating if driver is loading @@ -670,7 +671,7 @@ struct leapraid_scan_dev_desc { }; /** - * struct leapraid_access_ctrl - Access control structure for LeapRaid + * struct leapraid_access_ctrl - Access control structure for LeapRAID * * @pci_access_lock: Mutex for PCI access control * @adapter_thermal_alert: Flag indicating if adapter thermal alert is active @@ -687,7 +688,7 @@ struct leapraid_access_ctrl { }; /** - * struct leapraid_fw_log_desc - Firmware log descriptor for LeapRaid + * struct leapraid_fw_log_desc - Firmware log descriptor for LeapRAID * * @fw_log_buffer: Buffer for firmware log data * @fw_log_buffer_dma: DMA address of the firmware log buffer @@ -711,7 +712,7 @@ struct leapraid_fw_log_desc { #define LEAPRAID_CARD_PORT_FLG_NEW 0x02 #define LEAPRAID_DISABLE_MP_PORT_ID 0xFF /** - * struct leapraid_card_port - Card port structure for LeapRaid + * struct leapraid_card_port - Card port structure for LeapRAID * * @list: List head for card port * @vphys_list: List head for virtual phy list @@ -732,7 +733,7 @@ struct leapraid_card_port { }; /** - * struct leapraid_card_phy - Card phy structure for LeapRaid + * struct leapraid_card_phy - Card phy structure for LeapRAID * * @port_siblings: List head for port siblings * @card_port: Pointer to the card port @@ -759,7 +760,7 @@ struct leapraid_card_phy { }; /** - * struct leapraid_topo_node - SAS topology node for LeapRaid + * struct leapraid_topo_node - SAS topology node for LeapRAID * * @list: List head for linking nodes * @sas_port_list: List of SAS ports @@ -792,7 +793,7 @@ struct leapraid_topo_node { }; /** - * struct leapraid_dev_topo - LeapRaid device topology management structure + * struct leapraid_dev_topo - LeapRAID device topology management structure * * @topo_node_lock: Spinlock for protecting topology node operations * @sas_dev_lock: Spinlock for SAS device list access @@ -832,7 +833,7 @@ struct leapraid_dev_topo { }; /** - * struct leapraid_boot_dev - Boot device structure for LeapRaid + * struct leapraid_boot_dev - Boot device structure for LeapRAID * * @dev: Device pointer * @chnl: Channel number @@ -871,7 +872,7 @@ struct leapraid_smart_poll_desc { }; /** - * struct leapraid_adapter - Main LeapRaid adapter structure + * struct leapraid_adapter - Main LeapRAID adapter structure * @list: List head for adapter management * @shost: SCSI host structure * @pdev: PCI device structure diff --git a/drivers/scsi/leapraid/leapraid_os.c b/drivers/scsi/leapraid/leapraid_os.c index be0f7cbb6684..f8354c68ab71 100644 --- a/drivers/scsi/leapraid/leapraid_os.c +++ b/drivers/scsi/leapraid/leapraid_os.c @@ -2124,7 +2124,7 @@ static void leapraid_shutdown(struct pci_dev *pdev) adapter->access_ctrl.host_removing = true; leapraid_wait_cmds_done(adapter); leapraid_clean_active_fw_evt(adapter); - + leapraid_fw_log_stop(adapter); spin_lock_irqsave(&adapter->fw_evt_s.fw_evt_lock, flags); wq = adapter->fw_evt_s.fw_evt_thread; adapter->fw_evt_s.fw_evt_thread = NULL; -- 2.25.1

2 2

[PATCH OLK-5.10] scsi: leapraid: add RAID disk hide/show events and fix misc issues
by haodongdong 02 Feb '26

02 Feb '26

LeapIO inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/8463 ------------------------------------------ This change introduces RAID disk hide/show events to allow dynamic visibility control of RAID devices. It also updates the MSI-X vector count retrieval logic and unifies driver naming from LeapRaid to LeapRAID for consistency. In addition, fix an issue where the fw_log workqueue was not properly released during system shutdown, which could lead to resource leaks. Signed-off-by: haodongdong <doubled(a)leap-io.com> --- drivers/scsi/leapraid/leapraid.h | 2 + drivers/scsi/leapraid/leapraid_func.c | 104 ++++++++++++++++++++++---- drivers/scsi/leapraid/leapraid_func.h | 47 ++++++------ drivers/scsi/leapraid/leapraid_os.c | 2 +- 4 files changed, 116 insertions(+), 39 deletions(-) diff --git a/drivers/scsi/leapraid/leapraid.h b/drivers/scsi/leapraid/leapraid.h index 842810d41542..77bb93b79254 100644 --- a/drivers/scsi/leapraid/leapraid.h +++ b/drivers/scsi/leapraid/leapraid.h @@ -310,6 +310,8 @@ #define LEAPRAID_EVT_IR_RC_PD_UNHIDDEN_TO_DELETE 0x04 #define LEAPRAID_EVT_IR_RC_PD_CREATED_TO_HIDE 0x05 #define LEAPRAID_EVT_IR_RC_PD_DELETED_TO_EXPOSE 0x06 +#define LEAPRAID_EVT_IR_RC_VOLUME_HIDE 0x0A +#define LEAPRAID_EVT_IR_RC_VOLUME_UNHIDE 0x0B /* sas topology change event */ #define LEAPRAID_EVT_SAS_TOPO_ES_NO_EXPANDER 0x00 diff --git a/drivers/scsi/leapraid/leapraid_func.c b/drivers/scsi/leapraid/leapraid_func.c index c83c30f56805..5dfe95a8dd84 100644 --- a/drivers/scsi/leapraid/leapraid_func.c +++ b/drivers/scsi/leapraid/leapraid_func.c @@ -4117,6 +4117,66 @@ static void leapraid_sas_pd_expose( } } +static void leapraid_sas_vol_visibility(struct leapraid_adapter *adapter, + struct leapraid_evt_data_ir_change *evt_data) +{ + struct leapraid_raid_volume *raid_volume = NULL; + struct scsi_device *sdev = NULL; + u16 hdl = 0; + unsigned long flags; + u8 rc = 0; + u8 reprobe_flg = 0; + + hdl = le16_to_cpu(evt_data->vol_dev_hdl); + rc = evt_data->reason_code; + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); + raid_volume = leapraid_raid_volume_find_by_hdl(adapter, hdl); + if (!raid_volume) { + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, + flags); + dev_warn(&adapter->pdev->dev, + "%s:%d: volume handle 0x%x not found\n", + __func__, __LINE__, hdl); + return; + } + + reprobe_flg = 0; + sdev = raid_volume->sdev; + if (sdev) { + if (sdev->no_uld_attach) { + if (rc == LEAPRAID_EVT_IR_RC_VOLUME_UNHIDE) { + sdev->no_uld_attach = 0; + reprobe_flg = 1; + } + } else { + if (rc == LEAPRAID_EVT_IR_RC_VOLUME_HIDE) { + sdev->no_uld_attach = 1; + reprobe_flg = 1; + } + } + + if (reprobe_flg) { + if (sdev->no_uld_attach) + sdev_printk(KERN_INFO, sdev, "hide vol\n"); + else + sdev_printk(KERN_INFO, sdev, "unhide vol\n"); + + WARN_ON(scsi_device_reprobe(sdev)); + } else { + dev_warn(&adapter->pdev->dev, + "%s:rc(0x%x):request matches, skipping.\n", + __func__, rc); + } + + } else { + dev_warn(&adapter->pdev->dev, + "%s:%d: volume handle 0x%x has no sdev\n", + __func__, __LINE__, hdl); + } + + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); +} + static void leapraid_sas_volume_add(struct leapraid_adapter *adapter, struct leapraid_evt_data_ir_change *evt_data) { @@ -4235,6 +4295,10 @@ static void leapraid_sas_ir_chg_evt(struct leapraid_adapter *adapter, case LEAPRAID_EVT_IR_RC_PD_DELETED_TO_EXPOSE: leapraid_sas_pd_expose(adapter, evt_data); break; + case LEAPRAID_EVT_IR_RC_VOLUME_HIDE: + case LEAPRAID_EVT_IR_RC_VOLUME_UNHIDE: + leapraid_sas_vol_visibility(adapter, evt_data); + break; default: break; } @@ -6382,6 +6446,8 @@ static int leapraid_get_adapter_features(struct leapraid_adapter *adapter) le16_to_cpu(leap_mpi_rep.hp_slot); adapter->adapter_attr.features.adapter_caps = le32_to_cpu(leap_mpi_rep.adapter_caps); + adapter->adapter_attr.features.max_msix_vectors = + leap_mpi_rep.max_msix_vectors; adapter->adapter_attr.features.max_volumes = leap_mpi_rep.max_volumes; if (!adapter->adapter_attr.features.max_volumes) @@ -6741,11 +6807,15 @@ static int leapraid_set_msix(struct leapraid_adapter *adapter) goto legacy_int; msix_cnt = leapraid_msix_cnt(adapter->pdev); - if (msix_cnt <= 0) { + if (msix_cnt <= 0 || + adapter->adapter_attr.features.max_msix_vectors == 0) { dev_info(&adapter->pdev->dev, "msix unsupported!\n"); goto legacy_int; } + msix_cnt = min_t(int, msix_cnt, + adapter->adapter_attr.features.max_msix_vectors); + if (reset_devices) adapter->adapter_attr.rq_cnt = 1; else @@ -6839,11 +6909,15 @@ static int leapraid_set_msi(struct leapraid_adapter *adapter) goto legacy_int1; msi_cnt = leapraid_msi_cnt(adapter->pdev); - if (msi_cnt <= 0) { - dev_info(&adapter->pdev->dev, "msix unsupported!\n"); + if (msi_cnt <= 0 || + adapter->adapter_attr.features.max_msix_vectors == 0) { + dev_info(&adapter->pdev->dev, "msi unsupported!\n"); goto legacy_int1; } + msi_cnt = min_t(int, msi_cnt, + adapter->adapter_attr.features.max_msix_vectors); + if (reset_devices) adapter->adapter_attr.rq_cnt = 1; else @@ -6988,6 +7062,18 @@ int leapraid_set_pcie_and_notification(struct leapraid_adapter *adapter) leapraid_mask_int(adapter); + rc = leapraid_make_adapter_ready(adapter, PART_RESET); + if (rc) { + dev_err(&adapter->pdev->dev, "make adapter ready failure\n"); + goto out_fail; + } + + rc = leapraid_get_adapter_features(adapter); + if (rc) { + dev_err(&adapter->pdev->dev, "get adapter feature failure\n"); + goto out_fail; + } + rc = leapraid_set_notification(adapter); if (rc) goto out_fail; @@ -8185,18 +8271,6 @@ int leapraid_ctrl_init(struct leapraid_adapter *adapter) PCI_EXP_DEVCTL_EXT_TAG); } - rc = leapraid_make_adapter_ready(adapter, PART_RESET); - if (rc) { - dev_err(&adapter->pdev->dev, "make adapter ready failure\n"); - goto out_free_resources; - } - - rc = leapraid_get_adapter_features(adapter); - if (rc) { - dev_err(&adapter->pdev->dev, "get adapter feature failure\n"); - goto out_free_resources; - } - rc = leapraid_fw_log_init(adapter); if (rc) { dev_err(&adapter->pdev->dev, "fw log init failure\n"); diff --git a/drivers/scsi/leapraid/leapraid_func.h b/drivers/scsi/leapraid/leapraid_func.h index 9f42763bda72..15293922aefa 100644 --- a/drivers/scsi/leapraid/leapraid_func.h +++ b/drivers/scsi/leapraid/leapraid_func.h @@ -45,15 +45,15 @@ #define LEAPRAID_SYS_LOG_BUF_RESERVE 0x1000 /* Driver version and name */ -#define LEAPRAID_DRIVER_NAME "LeapRaid" +#define LEAPRAID_DRIVER_NAME "LeapRAID" #define LEAPRAID_NAME_LENGTH 48 #define LEAPRAID_AUTHOR "LeapIO Inc." -#define LEAPRAID_DESCRIPTION "LeapRaid Driver" -#define LEAPRAID_DRIVER_VERSION "2.00.00.05" +#define LEAPRAID_DESCRIPTION "LeapRAID Driver" +#define LEAPRAID_DRIVER_VERSION "2.00.00.06" #define LEAPRAID_MAJOR_VERSION 2 #define LEAPRAID_MINOR_VERSION 00 #define LEAPRAID_BUILD_VERSION 00 -#define LEAPRAID_RELEASE_VERSION 05 +#define LEAPRAID_RELEASE_VERSION 06 /* Device ID */ #define LEAPRAID_VENDOR_ID 0xD405 @@ -242,6 +242,7 @@ struct leapraid_adapter_features { u16 hp_slot; u32 adapter_caps; u32 fw_version; + u8 max_msix_vectors; u8 max_volumes; u16 max_dev_handle; u16 min_dev_handle; @@ -348,7 +349,7 @@ struct leapraid_rep_desc_seg_maint { }; /** - * struct leapraid_mem_desc - Memory descriptor for LeapRaid adapter + * struct leapraid_mem_desc - Memory descriptor for LeapRAID adapter * * @task_desc: Pointer to task descriptor * @task_desc_dma: DMA address of task descriptor @@ -394,7 +395,7 @@ struct leapraid_mem_desc { #define LEAPRAID_CMD_RESET 0x0008 /** - * enum LEAPRAID_CB_INDEX - Callback index for LeapRaid driver + * enum LEAPRAID_CB_INDEX - Callback index for LeapRAID driver * * @LEAPRAID_SCAN_DEV_CB_IDX: Scan device callback index * @LEAPRAID_CONFIG_CB_IDX: Configuration callback index @@ -512,7 +513,7 @@ struct leapraid_dynamic_task_desc { * struct leapraid_fw_evt_work - Firmware event work structure * * @list: Linked list node for queuing the work - * @adapter: Pointer to the associated LeapRaid adapter + * @adapter: Pointer to the associated LeapRAID adapter * @work: Work structure used by the kernel workqueue * @refcnt: Reference counter for managing the lifetime of this work * @evt_data: Pointer to firmware event data @@ -553,9 +554,9 @@ struct leapraid_fw_evt_struct { }; /** - * struct leapraid_rq - Represents a LeapRaid request queue + * struct leapraid_rq - Represents a LeapRAID request queue * - * @adapter: Pointer to the associated LeapRaid adapter + * @adapter: Pointer to the associated LeapRAID adapter * @msix_idx: MSI-X vector index used by this queue * @rep_post_host_idx: Index of the last processed reply descriptor * @rep_desc: Pointer to the reply descriptor associated with this queue @@ -575,7 +576,7 @@ struct leapraid_rq { * struct leapraid_int_rq - Internal request queue for a CPU * * @affinity_hint: CPU affinity mask for the queue - * @rq: Underlying LeapRaid request queue structure + * @rq: Underlying LeapRAID request queue structure */ struct leapraid_int_rq { cpumask_var_t affinity_hint; @@ -583,11 +584,11 @@ struct leapraid_int_rq { }; /** - * struct leapraid_blk_mq_poll_rq - Polling request for LeapRaid blk-mq + * struct leapraid_blk_mq_poll_rq - Polling request for LeapRAID blk-mq * * @busy: Atomic flag indicating request is being processed * @pause: Atomic flag to temporarily suspend polling - * @rq: The underlying LeapRaid request structure + * @rq: The underlying LeapRAID request structure */ struct leapraid_blk_mq_poll_rq { atomic_t busy; @@ -597,7 +598,7 @@ struct leapraid_blk_mq_poll_rq { /** * struct leapraid_notification_desc - Notification - * descriptor for LeapRaid + * descriptor for LeapRAID * * @iopoll_qdex: Index of the I/O polling queue * @iopoll_qcnt: Count of I/O polling queues @@ -620,7 +621,7 @@ struct leapraid_notification_desc { }; /** - * struct leapraid_reset_desc - Reset descriptor for LeapRaid + * struct leapraid_reset_desc - Reset descriptor for LeapRAID * * @fault_reset_wq: Workqueue for fault reset operations * @fault_reset_work: Delayed work structure for fault reset @@ -650,7 +651,7 @@ struct leapraid_reset_desc { /** * struct leapraid_scan_dev_desc - Scan device descriptor - * for LeapRaid + * for LeapRAID * * @wait_scan_dev_done: Flag indicating if scan device operation is done * @driver_loading: Flag indicating if driver is loading @@ -669,7 +670,7 @@ struct leapraid_scan_dev_desc { }; /** - * struct leapraid_access_ctrl - Access control structure for LeapRaid + * struct leapraid_access_ctrl - Access control structure for LeapRAID * * @pci_access_lock: Mutex for PCI access control * @adapter_thermal_alert: Flag indicating if adapter thermal alert is active @@ -686,7 +687,7 @@ struct leapraid_access_ctrl { }; /** - * struct leapraid_fw_log_desc - Firmware log descriptor for LeapRaid + * struct leapraid_fw_log_desc - Firmware log descriptor for LeapRAID * * @fw_log_buffer: Buffer for firmware log data * @fw_log_buffer_dma: DMA address of the firmware log buffer @@ -710,7 +711,7 @@ struct leapraid_fw_log_desc { #define LEAPRAID_CARD_PORT_FLG_NEW 0x02 #define LEAPRAID_DISABLE_MP_PORT_ID 0xFF /** - * struct leapraid_card_port - Card port structure for LeapRaid + * struct leapraid_card_port - Card port structure for LeapRAID * * @list: List head for card port * @vphys_list: List head for virtual phy list @@ -731,7 +732,7 @@ struct leapraid_card_port { }; /** - * struct leapraid_card_phy - Card phy structure for LeapRaid + * struct leapraid_card_phy - Card phy structure for LeapRAID * * @port_siblings: List head for port siblings * @card_port: Pointer to the card port @@ -758,7 +759,7 @@ struct leapraid_card_phy { }; /** - * struct leapraid_topo_node - SAS topology node for LeapRaid + * struct leapraid_topo_node - SAS topology node for LeapRAID * * @list: List head for linking nodes * @sas_port_list: List of SAS ports @@ -791,7 +792,7 @@ struct leapraid_topo_node { }; /** - * struct leapraid_dev_topo - LeapRaid device topology management structure + * struct leapraid_dev_topo - LeapRAID device topology management structure * * @topo_node_lock: Spinlock for protecting topology node operations * @sas_dev_lock: Spinlock for SAS device list access @@ -831,7 +832,7 @@ struct leapraid_dev_topo { }; /** - * struct leapraid_boot_dev - Boot device structure for LeapRaid + * struct leapraid_boot_dev - Boot device structure for LeapRAID * * @dev: Device pointer * @chnl: Channel number @@ -870,7 +871,7 @@ struct leapraid_smart_poll_desc { }; /** - * struct leapraid_adapter - Main LeapRaid adapter structure + * struct leapraid_adapter - Main LeapRAID adapter structure * @list: List head for adapter management * @shost: SCSI host structure * @pdev: PCI device structure diff --git a/drivers/scsi/leapraid/leapraid_os.c b/drivers/scsi/leapraid/leapraid_os.c index 44ec2615648f..6635e74fd8ff 100644 --- a/drivers/scsi/leapraid/leapraid_os.c +++ b/drivers/scsi/leapraid/leapraid_os.c @@ -2029,7 +2029,7 @@ static void leapraid_shutdown(struct pci_dev *pdev) adapter->access_ctrl.host_removing = true; leapraid_wait_cmds_done(adapter); leapraid_clean_active_fw_evt(adapter); - + leapraid_fw_log_stop(adapter); spin_lock_irqsave(&adapter->fw_evt_s.fw_evt_lock, flags); wq = adapter->fw_evt_s.fw_evt_thread; adapter->fw_evt_s.fw_evt_thread = NULL; -- 2.25.1

2 2

[PATCH OLK-6.6] scsi: leapraid: add RAID disk hide/show events and fix misc issues
by haodongdong 02 Feb '26

02 Feb '26

LeapIO inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/8462 This change introduces RAID disk hide/show events to allow dynamic visibility control of RAID devices. It also updates the MSI-X vector count retrieval logic and unifies driver naming from LeapRaid to LeapRAID for consistency. In addition, fix an issue where the fw_log workqueue was not properly released during system shutdown, which could lead to resource leaks. Signed-off-by: haodongdong <doubled(a)leap-io.com> --- drivers/scsi/leapraid/leapraid.h | 2 + drivers/scsi/leapraid/leapraid_func.c | 104 ++++++++++++++++++++++---- drivers/scsi/leapraid/leapraid_func.h | 47 ++++++------ drivers/scsi/leapraid/leapraid_os.c | 2 +- 4 files changed, 116 insertions(+), 39 deletions(-) diff --git a/drivers/scsi/leapraid/leapraid.h b/drivers/scsi/leapraid/leapraid.h index 842810d41542..77bb93b79254 100644 --- a/drivers/scsi/leapraid/leapraid.h +++ b/drivers/scsi/leapraid/leapraid.h @@ -310,6 +310,8 @@ #define LEAPRAID_EVT_IR_RC_PD_UNHIDDEN_TO_DELETE 0x04 #define LEAPRAID_EVT_IR_RC_PD_CREATED_TO_HIDE 0x05 #define LEAPRAID_EVT_IR_RC_PD_DELETED_TO_EXPOSE 0x06 +#define LEAPRAID_EVT_IR_RC_VOLUME_HIDE 0x0A +#define LEAPRAID_EVT_IR_RC_VOLUME_UNHIDE 0x0B /* sas topology change event */ #define LEAPRAID_EVT_SAS_TOPO_ES_NO_EXPANDER 0x00 diff --git a/drivers/scsi/leapraid/leapraid_func.c b/drivers/scsi/leapraid/leapraid_func.c index 2fc142fff982..ad8aee40e2c1 100644 --- a/drivers/scsi/leapraid/leapraid_func.c +++ b/drivers/scsi/leapraid/leapraid_func.c @@ -4132,6 +4132,66 @@ static void leapraid_sas_pd_expose( } } +static void leapraid_sas_vol_visibility(struct leapraid_adapter *adapter, + struct leapraid_evt_data_ir_change *evt_data) +{ + struct leapraid_raid_volume *raid_volume = NULL; + struct scsi_device *sdev = NULL; + u16 hdl = 0; + unsigned long flags; + u8 rc = 0; + u8 reprobe_flg = 0; + + hdl = le16_to_cpu(evt_data->vol_dev_hdl); + rc = evt_data->reason_code; + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); + raid_volume = leapraid_raid_volume_find_by_hdl(adapter, hdl); + if (!raid_volume) { + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, + flags); + dev_warn(&adapter->pdev->dev, + "%s:%d: volume handle 0x%x not found\n", + __func__, __LINE__, hdl); + return; + } + + reprobe_flg = 0; + sdev = raid_volume->sdev; + if (sdev) { + if (sdev->no_uld_attach) { + if (rc == LEAPRAID_EVT_IR_RC_VOLUME_UNHIDE) { + sdev->no_uld_attach = 0; + reprobe_flg = 1; + } + } else { + if (rc == LEAPRAID_EVT_IR_RC_VOLUME_HIDE) { + sdev->no_uld_attach = 1; + reprobe_flg = 1; + } + } + + if (reprobe_flg) { + if (sdev->no_uld_attach) + sdev_printk(KERN_INFO, sdev, "hide vol\n"); + else + sdev_printk(KERN_INFO, sdev, "unhide vol\n"); + + WARN_ON(scsi_device_reprobe(sdev)); + } else { + dev_warn(&adapter->pdev->dev, + "%s:rc(0x%x):request matches, skipping.\n", + __func__, rc); + } + + } else { + dev_warn(&adapter->pdev->dev, + "%s:%d: volume handle 0x%x has no sdev\n", + __func__, __LINE__, hdl); + } + + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); +} + static void leapraid_sas_volume_add(struct leapraid_adapter *adapter, struct leapraid_evt_data_ir_change *evt_data) { @@ -4250,6 +4310,10 @@ static void leapraid_sas_ir_chg_evt(struct leapraid_adapter *adapter, case LEAPRAID_EVT_IR_RC_PD_DELETED_TO_EXPOSE: leapraid_sas_pd_expose(adapter, evt_data); break; + case LEAPRAID_EVT_IR_RC_VOLUME_HIDE: + case LEAPRAID_EVT_IR_RC_VOLUME_UNHIDE: + leapraid_sas_vol_visibility(adapter, evt_data); + break; default: break; } @@ -6397,6 +6461,8 @@ static int leapraid_get_adapter_features(struct leapraid_adapter *adapter) le16_to_cpu(leap_mpi_rep.hp_slot); adapter->adapter_attr.features.adapter_caps = le32_to_cpu(leap_mpi_rep.adapter_caps); + adapter->adapter_attr.features.max_msix_vectors = + leap_mpi_rep.max_msix_vectors; adapter->adapter_attr.features.max_volumes = leap_mpi_rep.max_volumes; if (!adapter->adapter_attr.features.max_volumes) @@ -6754,11 +6820,15 @@ static int leapraid_set_msix(struct leapraid_adapter *adapter) goto legacy_int; msix_cnt = leapraid_msix_cnt(adapter->pdev); - if (msix_cnt <= 0) { + if (msix_cnt <= 0 || + adapter->adapter_attr.features.max_msix_vectors == 0) { dev_info(&adapter->pdev->dev, "msix unsupported!\n"); goto legacy_int; } + msix_cnt = min_t(int, msix_cnt, + adapter->adapter_attr.features.max_msix_vectors); + if (reset_devices) adapter->adapter_attr.rq_cnt = 1; else @@ -6859,11 +6929,15 @@ static int leapraid_set_msi(struct leapraid_adapter *adapter) goto legacy_int1; msi_cnt = leapraid_msi_cnt(adapter->pdev); - if (msi_cnt <= 0) { - dev_info(&adapter->pdev->dev, "msix unsupported!\n"); + if (msi_cnt <= 0 || + adapter->adapter_attr.features.max_msix_vectors == 0) { + dev_info(&adapter->pdev->dev, "msi unsupported!\n"); goto legacy_int1; } + msi_cnt = min_t(int, msi_cnt, + adapter->adapter_attr.features.max_msix_vectors); + if (reset_devices) adapter->adapter_attr.rq_cnt = 1; else @@ -7015,6 +7089,18 @@ int leapraid_set_pcie_and_notification(struct leapraid_adapter *adapter) leapraid_mask_int(adapter); + rc = leapraid_make_adapter_ready(adapter, PART_RESET); + if (rc) { + dev_err(&adapter->pdev->dev, "make adapter ready failure\n"); + goto out_fail; + } + + rc = leapraid_get_adapter_features(adapter); + if (rc) { + dev_err(&adapter->pdev->dev, "get adapter feature failure\n"); + goto out_fail; + } + rc = leapraid_set_notification(adapter); if (rc) goto out_fail; @@ -8185,18 +8271,6 @@ int leapraid_ctrl_init(struct leapraid_adapter *adapter) PCI_EXP_DEVCTL_EXT_TAG); } - rc = leapraid_make_adapter_ready(adapter, PART_RESET); - if (rc) { - dev_err(&adapter->pdev->dev, "make adapter ready failure\n"); - goto out_free_resources; - } - - rc = leapraid_get_adapter_features(adapter); - if (rc) { - dev_err(&adapter->pdev->dev, "get adapter feature failure\n"); - goto out_free_resources; - } - rc = leapraid_fw_log_init(adapter); if (rc) { dev_err(&adapter->pdev->dev, "fw log init failure\n"); diff --git a/drivers/scsi/leapraid/leapraid_func.h b/drivers/scsi/leapraid/leapraid_func.h index 2c51ef359b7e..f7072d078315 100644 --- a/drivers/scsi/leapraid/leapraid_func.h +++ b/drivers/scsi/leapraid/leapraid_func.h @@ -46,15 +46,15 @@ #define LEAPRAID_SYS_LOG_BUF_RESERVE 0x1000 /* Driver version and name */ -#define LEAPRAID_DRIVER_NAME "LeapRaid" +#define LEAPRAID_DRIVER_NAME "LeapRAID" #define LEAPRAID_NAME_LENGTH 48 #define LEAPRAID_AUTHOR "LeapIO Inc." -#define LEAPRAID_DESCRIPTION "LeapRaid Driver" -#define LEAPRAID_DRIVER_VERSION "2.00.00.05" +#define LEAPRAID_DESCRIPTION "LeapRAID Driver" +#define LEAPRAID_DRIVER_VERSION "2.00.00.06" #define LEAPRAID_MAJOR_VERSION 2 #define LEAPRAID_MINOR_VERSION 00 #define LEAPRAID_BUILD_VERSION 00 -#define LEAPRAID_RELEASE_VERSION 05 +#define LEAPRAID_RELEASE_VERSION 06 /* Device ID */ #define LEAPRAID_VENDOR_ID 0xD405 @@ -243,6 +243,7 @@ struct leapraid_adapter_features { u16 hp_slot; u32 adapter_caps; u32 fw_version; + u8 max_msix_vectors; u8 max_volumes; u16 max_dev_handle; u16 min_dev_handle; @@ -349,7 +350,7 @@ struct leapraid_rep_desc_seg_maint { }; /** - * struct leapraid_mem_desc - Memory descriptor for LeapRaid adapter + * struct leapraid_mem_desc - Memory descriptor for LeapRAID adapter * * @task_desc: Pointer to task descriptor * @task_desc_dma: DMA address of task descriptor @@ -395,7 +396,7 @@ struct leapraid_mem_desc { #define LEAPRAID_CMD_RESET 0x0008 /** - * enum LEAPRAID_CB_INDEX - Callback index for LeapRaid driver + * enum LEAPRAID_CB_INDEX - Callback index for LeapRAID driver * * @LEAPRAID_SCAN_DEV_CB_IDX: Scan device callback index * @LEAPRAID_CONFIG_CB_IDX: Configuration callback index @@ -513,7 +514,7 @@ struct leapraid_dynamic_task_desc { * struct leapraid_fw_evt_work - Firmware event work structure * * @list: Linked list node for queuing the work - * @adapter: Pointer to the associated LeapRaid adapter + * @adapter: Pointer to the associated LeapRAID adapter * @work: Work structure used by the kernel workqueue * @refcnt: Reference counter for managing the lifetime of this work * @evt_data: Pointer to firmware event data @@ -554,9 +555,9 @@ struct leapraid_fw_evt_struct { }; /** - * struct leapraid_rq - Represents a LeapRaid request queue + * struct leapraid_rq - Represents a LeapRAID request queue * - * @adapter: Pointer to the associated LeapRaid adapter + * @adapter: Pointer to the associated LeapRAID adapter * @msix_idx: MSI-X vector index used by this queue * @rep_post_host_idx: Index of the last processed reply descriptor * @rep_desc: Pointer to the reply descriptor associated with this queue @@ -576,7 +577,7 @@ struct leapraid_rq { * struct leapraid_int_rq - Internal request queue for a CPU * * @affinity_hint: CPU affinity mask for the queue - * @rq: Underlying LeapRaid request queue structure + * @rq: Underlying LeapRAID request queue structure */ struct leapraid_int_rq { cpumask_var_t affinity_hint; @@ -584,11 +585,11 @@ struct leapraid_int_rq { }; /** - * struct leapraid_blk_mq_poll_rq - Polling request for LeapRaid blk-mq + * struct leapraid_blk_mq_poll_rq - Polling request for LeapRAID blk-mq * * @busy: Atomic flag indicating request is being processed * @pause: Atomic flag to temporarily suspend polling - * @rq: The underlying LeapRaid request structure + * @rq: The underlying LeapRAID request structure */ struct leapraid_blk_mq_poll_rq { atomic_t busy; @@ -598,7 +599,7 @@ struct leapraid_blk_mq_poll_rq { /** * struct leapraid_notification_desc - Notification - * descriptor for LeapRaid + * descriptor for LeapRAID * * @iopoll_qdex: Index of the I/O polling queue * @iopoll_qcnt: Count of I/O polling queues @@ -621,7 +622,7 @@ struct leapraid_notification_desc { }; /** - * struct leapraid_reset_desc - Reset descriptor for LeapRaid + * struct leapraid_reset_desc - Reset descriptor for LeapRAID * * @fault_reset_wq: Workqueue for fault reset operations * @fault_reset_work: Delayed work structure for fault reset @@ -651,7 +652,7 @@ struct leapraid_reset_desc { /** * struct leapraid_scan_dev_desc - Scan device descriptor - * for LeapRaid + * for LeapRAID * * @wait_scan_dev_done: Flag indicating if scan device operation is done * @driver_loading: Flag indicating if driver is loading @@ -670,7 +671,7 @@ struct leapraid_scan_dev_desc { }; /** - * struct leapraid_access_ctrl - Access control structure for LeapRaid + * struct leapraid_access_ctrl - Access control structure for LeapRAID * * @pci_access_lock: Mutex for PCI access control * @adapter_thermal_alert: Flag indicating if adapter thermal alert is active @@ -687,7 +688,7 @@ struct leapraid_access_ctrl { }; /** - * struct leapraid_fw_log_desc - Firmware log descriptor for LeapRaid + * struct leapraid_fw_log_desc - Firmware log descriptor for LeapRAID * * @fw_log_buffer: Buffer for firmware log data * @fw_log_buffer_dma: DMA address of the firmware log buffer @@ -711,7 +712,7 @@ struct leapraid_fw_log_desc { #define LEAPRAID_CARD_PORT_FLG_NEW 0x02 #define LEAPRAID_DISABLE_MP_PORT_ID 0xFF /** - * struct leapraid_card_port - Card port structure for LeapRaid + * struct leapraid_card_port - Card port structure for LeapRAID * * @list: List head for card port * @vphys_list: List head for virtual phy list @@ -732,7 +733,7 @@ struct leapraid_card_port { }; /** - * struct leapraid_card_phy - Card phy structure for LeapRaid + * struct leapraid_card_phy - Card phy structure for LeapRAID * * @port_siblings: List head for port siblings * @card_port: Pointer to the card port @@ -759,7 +760,7 @@ struct leapraid_card_phy { }; /** - * struct leapraid_topo_node - SAS topology node for LeapRaid + * struct leapraid_topo_node - SAS topology node for LeapRAID * * @list: List head for linking nodes * @sas_port_list: List of SAS ports @@ -792,7 +793,7 @@ struct leapraid_topo_node { }; /** - * struct leapraid_dev_topo - LeapRaid device topology management structure + * struct leapraid_dev_topo - LeapRAID device topology management structure * * @topo_node_lock: Spinlock for protecting topology node operations * @sas_dev_lock: Spinlock for SAS device list access @@ -832,7 +833,7 @@ struct leapraid_dev_topo { }; /** - * struct leapraid_boot_dev - Boot device structure for LeapRaid + * struct leapraid_boot_dev - Boot device structure for LeapRAID * * @dev: Device pointer * @chnl: Channel number @@ -871,7 +872,7 @@ struct leapraid_smart_poll_desc { }; /** - * struct leapraid_adapter - Main LeapRaid adapter structure + * struct leapraid_adapter - Main LeapRAID adapter structure * @list: List head for adapter management * @shost: SCSI host structure * @pdev: PCI device structure diff --git a/drivers/scsi/leapraid/leapraid_os.c b/drivers/scsi/leapraid/leapraid_os.c index be0f7cbb6684..f8354c68ab71 100644 --- a/drivers/scsi/leapraid/leapraid_os.c +++ b/drivers/scsi/leapraid/leapraid_os.c @@ -2124,7 +2124,7 @@ static void leapraid_shutdown(struct pci_dev *pdev) adapter->access_ctrl.host_removing = true; leapraid_wait_cmds_done(adapter); leapraid_clean_active_fw_evt(adapter); - + leapraid_fw_log_stop(adapter); spin_lock_irqsave(&adapter->fw_evt_s.fw_evt_lock, flags); wq = adapter->fw_evt_s.fw_evt_thread; adapter->fw_evt_s.fw_evt_thread = NULL; -- 2.25.1

2 1

[PATCH OLK-6.6] interference: Fix uninitialized ifs_clock compiling issue
by Pu Lehui 02 Feb '26

02 Feb '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/7429 -------------------------------- When compiling with clang, it will occur the warning: 623 | if (__mutex_trylock(lock)) { | ^~~~~~~~~~~~~~~~~~~~~ kernel/locking/mutex.c:725:24: note: uninitialized use occurs here 725 | cgroup_ifs_leave_lock(ifs_clock, IFS_MUTEX); | ^~~~~~~~~ kernel/locking/mutex.c:623:2: note: remove the 'if' if its condition is always false 623 | if (__mutex_trylock(lock)) { | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ 624 | if (ww_ctx) | ~~~~~~~~~~~ 625 | __ww_mutex_check_waiters(lock, ww_ctx); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 626 | 627 | goto skip_wait; | ~~~~~~~~~~~~~~~ 628 | } | ~ kernel/locking/mutex.c:576:15: note: initialize the variable 'ifs_clock' to silence this warning 576 | u64 ifs_clock; | ^ | = 0 2 warnings generated. Let's fix it by zero initialize ifs_clock. Fixes: a1ad9b2ed459 ("interference: Add mutex interference track support") Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- include/linux/cgroup.h | 3 +++ kernel/locking/mutex.c | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h index 05a9cef2edac..d4f69e89b3fb 100644 --- a/include/linux/cgroup.h +++ b/include/linux/cgroup.h @@ -1000,6 +1000,9 @@ static inline void cgroup_ifs_leave_lock(u64 clock, enum ifs_types t) if (!cgroup_ifs_enabled()) return; + if (unlikely(!clock)) + return; + ifs = current_ifs(); if (ifs) { ifsc = this_cpu_ptr(ifs->pcpu); diff --git a/kernel/locking/mutex.c b/kernel/locking/mutex.c index 1003afe8dd74..038c6fb9d71d 100644 --- a/kernel/locking/mutex.c +++ b/kernel/locking/mutex.c @@ -573,7 +573,7 @@ __mutex_lock_common(struct mutex *lock, unsigned int state, unsigned int subclas { struct mutex_waiter waiter; struct ww_mutex *ww; - u64 ifs_clock; + u64 ifs_clock = 0; int ret; if (!use_ww_ctx) -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] usb: typec: altmodes/displayport: fix pin_assignment_show
by Yin Tirui 02 Feb '26

02 Feb '26

From: Badhri Jagan Sridharan <badhri(a)google.com> stable inclusion from stable-v4.19.284 commit 0e61a7432fcd4bca06f05b7f1c7d7cb461880fe2 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13216 CVE: CVE-2023-54186 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit d8f28269dd4bf9b55c3fb376ae31512730a96fce upstream. This patch fixes negative indexing of buf array in pin_assignment_show when get_current_pin_assignments returns 0 i.e. no compatible pin assignments are found. BUG: KASAN: use-after-free in pin_assignment_show+0x26c/0x33c ... Call trace: dump_backtrace+0x110/0x204 dump_stack_lvl+0x84/0xbc print_report+0x358/0x974 kasan_report+0x9c/0xfc __do_kernel_fault+0xd4/0x2d4 do_bad_area+0x48/0x168 do_tag_check_fault+0x24/0x38 do_mem_abort+0x6c/0x14c el1_abort+0x44/0x68 el1h_64_sync_handler+0x64/0xa4 el1h_64_sync+0x78/0x7c pin_assignment_show+0x26c/0x33c dev_attr_show+0x50/0xc0 Fixes: 0e3bb7d6894d ("usb: typec: Add driver for DisplayPort alternate mode") Cc: stable(a)vger.kernel.org Signed-off-by: Badhri Jagan Sridharan <badhri(a)google.com> Reviewed-by: Heikki Krogerus <heikki.krogerus(a)linux.intel.com> Link: https://lore.kernel.org/r/20230508214443.893436-1-badhri@google.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yin Tirui <yintirui(a)huawei.com> --- drivers/usb/typec/altmodes/displayport.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/usb/typec/altmodes/displayport.c b/drivers/usb/typec/altmodes/displayport.c index 90bb0baed624..3be3a1942b5f 100644 --- a/drivers/usb/typec/altmodes/displayport.c +++ b/drivers/usb/typec/altmodes/displayport.c @@ -495,6 +495,10 @@ static ssize_t pin_assignment_show(struct device *dev, mutex_unlock(&dp->lock); + /* get_current_pin_assignments can return 0 when no matching pin assignments are found */ + if (len == 0) + len++; + buf[len - 1] = '\n'; return len; } -- 2.43.0

2 1

[PATCH OLK-6.6] rcu: Protect ->defer_qs_iw_pending from data race
by Jiacheng Yu 02 Feb '26

02 Feb '26

From: "Paul E. McKenney" <paulmck(a)kernel.org> stable inclusion from stable-v6.6.103 commit b55947b725f190396f475d5d0c59aa855a4d8895 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/8987 CVE: CVE-2025-39749 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 90c09d57caeca94e6f3f87c49e96a91edd40cbfd ] On kernels built with CONFIG_IRQ_WORK=y, when rcu_read_unlock() is invoked within an interrupts-disabled region of code [1], it will invoke rcu_read_unlock_special(), which uses an irq-work handler to force the system to notice when the RCU read-side critical section actually ends. That end won't happen until interrupts are enabled at the soonest. In some kernels, such as those booted with rcutree.use_softirq=y, the irq-work handler is used unconditionally. The per-CPU rcu_data structure's ->defer_qs_iw_pending field is updated by the irq-work handler and is both read and updated by rcu_read_unlock_special(). This resulted in the following KCSAN splat: ------------------------------------------------------------------------ BUG: KCSAN: data-race in rcu_preempt_deferred_qs_handler / rcu_read_unlock_special read to 0xffff96b95f42d8d8 of 1 bytes by task 90 on cpu 8: rcu_read_unlock_special+0x175/0x260 __rcu_read_unlock+0x92/0xa0 rt_spin_unlock+0x9b/0xc0 __local_bh_enable+0x10d/0x170 __local_bh_enable_ip+0xfb/0x150 rcu_do_batch+0x595/0xc40 rcu_cpu_kthread+0x4e9/0x830 smpboot_thread_fn+0x24d/0x3b0 kthread+0x3bd/0x410 ret_from_fork+0x35/0x40 ret_from_fork_asm+0x1a/0x30 write to 0xffff96b95f42d8d8 of 1 bytes by task 88 on cpu 8: rcu_preempt_deferred_qs_handler+0x1e/0x30 irq_work_single+0xaf/0x160 run_irq_workd+0x91/0xc0 smpboot_thread_fn+0x24d/0x3b0 kthread+0x3bd/0x410 ret_from_fork+0x35/0x40 ret_from_fork_asm+0x1a/0x30 no locks held by irq_work/8/88. irq event stamp: 200272 hardirqs last enabled at (200272): [<ffffffffb0f56121>] finish_task_switch+0x131/0x320 hardirqs last disabled at (200271): [<ffffffffb25c7859>] __schedule+0x129/0xd70 softirqs last enabled at (0): [<ffffffffb0ee093f>] copy_process+0x4df/0x1cc0 softirqs last disabled at (0): [<0000000000000000>] 0x0 ------------------------------------------------------------------------ The problem is that irq-work handlers run with interrupts enabled, which means that rcu_preempt_deferred_qs_handler() could be interrupted, and that interrupt handler might contain an RCU read-side critical section, which might invoke rcu_read_unlock_special(). In the strict KCSAN mode of operation used by RCU, this constitutes a data race on the ->defer_qs_iw_pending field. This commit therefore disables interrupts across the portion of the rcu_preempt_deferred_qs_handler() that updates the ->defer_qs_iw_pending field. This suffices because this handler is not a fast path. Signed-off-by: Paul E. McKenney <paulmck(a)kernel.org> Reviewed-by: Frederic Weisbecker <frederic(a)kernel.org> Signed-off-by: Neeraj Upadhyay (AMD) <neeraj.upadhyay(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jiacheng Yu <yujiacheng3(a)huawei.com> --- kernel/rcu/tree_plugin.h | 3 +++ 1 file changed, 3 insertions(+) diff --git a/kernel/rcu/tree_plugin.h b/kernel/rcu/tree_plugin.h index 94b715139f52..de727f2568bf 100644 --- a/kernel/rcu/tree_plugin.h +++ b/kernel/rcu/tree_plugin.h @@ -612,10 +612,13 @@ notrace void rcu_preempt_deferred_qs(struct task_struct *t) */ static void rcu_preempt_deferred_qs_handler(struct irq_work *iwp) { + unsigned long flags; struct rcu_data *rdp; rdp = container_of(iwp, struct rcu_data, defer_qs_iw); + local_irq_save(flags); rdp->defer_qs_iw_pending = false; + local_irq_restore(flags); } /* -- 2.43.0

2 1

[PATCH OLK-6.6] f2fs: fix to avoid potential deadlock
by Pan Taixi 31 Jan '26

31 Jan '26

From: Chao Yu <chao(a)kernel.org> stable inclusion from stable-v6.6.120 commit 8bd6dff8b801abaa362272894bda795bf0cf1307 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13377/ CVE: CVE-2025-71065 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ca8b201f28547e28343a6f00a6e91fa8c09572fe ] As Jiaming Zhang and syzbot reported, there is potential deadlock in f2fs as below: Chain exists of: &sbi->cp_rwsem --> fs_reclaim --> sb_internal#2 Possible unsafe locking scenario: CPU0 CPU1 ---- ---- rlock(sb_internal#2); lock(fs_reclaim); lock(sb_internal#2); rlock(&sbi->cp_rwsem); *** DEADLOCK *** 3 locks held by kswapd0/73: #0: ffffffff8e247a40 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat mm/vmscan.c:7015 [inline] #0: ffffffff8e247a40 (fs_reclaim){+.+.}-{0:0}, at: kswapd+0x951/0x2800 mm/vmscan.c:7389 #1: ffff8880118400e0 (&type->s_umount_key#50){.+.+}-{4:4}, at: super_trylock_shared fs/super.c:562 [inline] #1: ffff8880118400e0 (&type->s_umount_key#50){.+.+}-{4:4}, at: super_cache_scan+0x91/0x4b0 fs/super.c:197 #2: ffff888011840610 (sb_internal#2){.+.+}-{0:0}, at: f2fs_evict_inode+0x8d9/0x1b60 fs/f2fs/inode.c:890 stack backtrace: CPU: 0 UID: 0 PID: 73 Comm: kswapd0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 print_circular_bug+0x2ee/0x310 kernel/locking/lockdep.c:2043 check_noncircular+0x134/0x160 kernel/locking/lockdep.c:2175 check_prev_add kernel/locking/lockdep.c:3165 [inline] check_prevs_add kernel/locking/lockdep.c:3284 [inline] validate_chain+0xb9b/0x2140 kernel/locking/lockdep.c:3908 __lock_acquire+0xab9/0xd20 kernel/locking/lockdep.c:5237 lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5868 down_read+0x46/0x2e0 kernel/locking/rwsem.c:1537 f2fs_down_read fs/f2fs/f2fs.h:2278 [inline] f2fs_lock_op fs/f2fs/f2fs.h:2357 [inline] f2fs_do_truncate_blocks+0x21c/0x10c0 fs/f2fs/file.c:791 f2fs_truncate_blocks+0x10a/0x300 fs/f2fs/file.c:867 f2fs_truncate+0x489/0x7c0 fs/f2fs/file.c:925 f2fs_evict_inode+0x9f2/0x1b60 fs/f2fs/inode.c:897 evict+0x504/0x9c0 fs/inode.c:810 f2fs_evict_inode+0x1dc/0x1b60 fs/f2fs/inode.c:853 evict+0x504/0x9c0 fs/inode.c:810 dispose_list fs/inode.c:852 [inline] prune_icache_sb+0x21b/0x2c0 fs/inode.c:1000 super_cache_scan+0x39b/0x4b0 fs/super.c:224 do_shrink_slab+0x6ef/0x1110 mm/shrinker.c:437 shrink_slab_memcg mm/shrinker.c:550 [inline] shrink_slab+0x7ef/0x10d0 mm/shrinker.c:628 shrink_one+0x28a/0x7c0 mm/vmscan.c:4955 shrink_many mm/vmscan.c:5016 [inline] lru_gen_shrink_node mm/vmscan.c:5094 [inline] shrink_node+0x315d/0x3780 mm/vmscan.c:6081 kswapd_shrink_node mm/vmscan.c:6941 [inline] balance_pgdat mm/vmscan.c:7124 [inline] kswapd+0x147c/0x2800 mm/vmscan.c:7389 kthread+0x70e/0x8a0 kernel/kthread.c:463 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> The root cause is deadlock among four locks as below: kswapd - fs_reclaim --- Lock A - shrink_one - evict - f2fs_evict_inode - sb_start_intwrite --- Lock B - iput - evict - f2fs_evict_inode - sb_start_intwrite --- Lock B - f2fs_truncate - f2fs_truncate_blocks - f2fs_do_truncate_blocks - f2fs_lock_op --- Lock C ioctl - f2fs_ioc_commit_atomic_write - f2fs_lock_op --- Lock C - __f2fs_commit_atomic_write - __replace_atomic_write_block - f2fs_get_dnode_of_data - __get_node_folio - f2fs_check_nid_range - f2fs_handle_error - f2fs_record_errors - f2fs_down_write --- Lock D open - do_open - do_truncate - security_inode_need_killpriv - f2fs_getxattr - lookup_all_xattrs - f2fs_handle_error - f2fs_record_errors - f2fs_down_write --- Lock D - f2fs_commit_super - read_mapping_folio - filemap_alloc_folio_noprof - prepare_alloc_pages - fs_reclaim_acquire --- Lock A In order to avoid such deadlock, we need to avoid grabbing sb_lock in f2fs_handle_error(), so, let's use asynchronous method instead: - remove f2fs_handle_error() implementation - rename f2fs_handle_error_async() to f2fs_handle_error() - spread f2fs_handle_error() Fixes: 95fa90c9e5a7 ("f2fs: support recording errors into superblock") Cc: stable(a)kernel.org Reported-by: syzbot+14b90e1156b9f6fc1266(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-f2fs-devel/68eae49b.050a0220.ac43.0001.GAE@go… Reported-by: Jiaming Zhang <r772577952(a)gmail.com> Closes: https://lore.kernel.org/lkml/CANypQFa-Gy9sD-N35o3PC+FystOWkNuN8pv6S75HLT0ga… Signed-off-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/f2fs/super.c [Context conflicts due to ummerged commit: 0b8eb814e058 ("f2fs: use f2fs_err_ratelimited() to avoid redundant logs")] Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com> --- fs/f2fs/compress.c | 5 +---- fs/f2fs/f2fs.h | 1 - fs/f2fs/super.c | 40 ---------------------------------------- 3 files changed, 1 insertion(+), 45 deletions(-) diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c index 1dd043330b00..89890f54e781 100644 --- a/fs/f2fs/compress.c +++ b/fs/f2fs/compress.c @@ -755,10 +755,7 @@ void f2fs_decompress_cluster(struct decompress_io_ctx *dic, bool in_task) ret = -EFSCORRUPTED; /* Avoid f2fs_commit_super in irq context */ - if (!in_task) - f2fs_handle_error_async(sbi, ERROR_FAIL_DECOMPRESSION); - else - f2fs_handle_error(sbi, ERROR_FAIL_DECOMPRESSION); + f2fs_handle_error(sbi, ERROR_FAIL_DECOMPRESSION); goto out_release; } diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h index fa9d1b3efcce..df30000e7f18 100644 --- a/fs/f2fs/f2fs.h +++ b/fs/f2fs/f2fs.h @@ -3633,7 +3633,6 @@ void f2fs_quota_off_umount(struct super_block *sb); void f2fs_save_errors(struct f2fs_sb_info *sbi, unsigned char flag); void f2fs_handle_critical_error(struct f2fs_sb_info *sbi, unsigned char reason); void f2fs_handle_error(struct f2fs_sb_info *sbi, unsigned char error); -void f2fs_handle_error_async(struct f2fs_sb_info *sbi, unsigned char error); int f2fs_commit_super(struct f2fs_sb_info *sbi, bool recover); int f2fs_sync_fs(struct super_block *sb, int sync); int f2fs_sanity_check_ckpt(struct f2fs_sb_info *sbi); diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c index 92a3b592e936..2981d11ed2e8 100644 --- a/fs/f2fs/super.c +++ b/fs/f2fs/super.c @@ -4083,47 +4083,7 @@ void f2fs_save_errors(struct f2fs_sb_info *sbi, unsigned char flag) spin_unlock_irqrestore(&sbi->error_lock, flags); } -static bool f2fs_update_errors(struct f2fs_sb_info *sbi) -{ - unsigned long flags; - bool need_update = false; - - spin_lock_irqsave(&sbi->error_lock, flags); - if (sbi->error_dirty) { - memcpy(F2FS_RAW_SUPER(sbi)->s_errors, sbi->errors, - MAX_F2FS_ERRORS); - sbi->error_dirty = false; - need_update = true; - } - spin_unlock_irqrestore(&sbi->error_lock, flags); - - return need_update; -} - -static void f2fs_record_errors(struct f2fs_sb_info *sbi, unsigned char error) -{ - int err; - - f2fs_down_write(&sbi->sb_lock); - - if (!f2fs_update_errors(sbi)) - goto out_unlock; - - err = f2fs_commit_super(sbi, false); - if (err) - f2fs_err(sbi, "f2fs_commit_super fails to record errors:%u, err:%d", - error, err); -out_unlock: - f2fs_up_write(&sbi->sb_lock); -} - void f2fs_handle_error(struct f2fs_sb_info *sbi, unsigned char error) -{ - f2fs_save_errors(sbi, error); - f2fs_record_errors(sbi, error); -} - -void f2fs_handle_error_async(struct f2fs_sb_info *sbi, unsigned char error) { f2fs_save_errors(sbi, error); -- 2.34.1

2 1

[PATCH OLK-6.6] svcrdma: bound check rq_pages index in inline path
by Li Xiasong 31 Jan '26

31 Jan '26

From: Joshua Rogers <linux(a)joshua.hu> stable inclusion from stable-v6.6.120 commit 7ba826aae1d43212f3baa53a2175ad949e21926e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13379 CVE: CVE-2025-71068 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d1bea0ce35b6095544ee82bb54156fc62c067e58 ] svc_rdma_copy_inline_range indexed rqstp->rq_pages[rc_curpage] without verifying rc_curpage stays within the allocated page array. Add guards before the first use and after advancing to a new page. Fixes: d7cc73972661 ("svcrdma: support multiple Read chunks per RPC") Cc: stable(a)vger.kernel.org Signed-off-by: Joshua Rogers <linux(a)joshua.hu> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> [ adapted rc_curpage and rq_maxpages fields to ri_pageno and RPCSVC_MAXPAGES constant ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Xiasong <lixiasong1(a)huawei.com> --- net/sunrpc/xprtrdma/svc_rdma_rw.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/sunrpc/xprtrdma/svc_rdma_rw.c b/net/sunrpc/xprtrdma/svc_rdma_rw.c index e460e25a1d6d..249a17c7e82b 100644 --- a/net/sunrpc/xprtrdma/svc_rdma_rw.c +++ b/net/sunrpc/xprtrdma/svc_rdma_rw.c @@ -815,6 +815,9 @@ static int svc_rdma_copy_inline_range(struct svc_rdma_read_info *info, for (page_no = 0; page_no < numpages; page_no++) { unsigned int page_len; + if (info->ri_pageno >= RPCSVC_MAXPAGES) + return -EINVAL; + page_len = min_t(unsigned int, remaining, PAGE_SIZE - info->ri_pageoff); -- 2.34.1

2 1

[PATCH OLK-6.6] ipv6: Fix use-after-free in inet6_addr_del().
by Li Xiasong 31 Jan '26

31 Jan '26

From: Kuniyuki Iwashima <kuniyu(a)google.com> mainline inclusion from mainline-v6.19-rc6 commit ddf96c393a33aef4887e2e406c76c2f8cda1419c category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13520 CVE: CVE-2026-23010 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzbot reported use-after-free of inet6_ifaddr in inet6_addr_del(). [0] The cited commit accidentally moved ipv6_del_addr() for mngtmpaddr before reading its ifp->flags for temporary addresses in inet6_addr_del(). Let's move ipv6_del_addr() down to fix the UAF. [0]: BUG: KASAN: slab-use-after-free in inet6_addr_del.constprop.0+0x67a/0x6b0 net/ipv6/addrconf.c:3117 Read of size 4 at addr ffff88807b89c86c by task syz.3.1618/9593 CPU: 0 UID: 0 PID: 9593 Comm: syz.3.1618 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xcd/0x630 mm/kasan/report.c:482 kasan_report+0xe0/0x110 mm/kasan/report.c:595 inet6_addr_del.constprop.0+0x67a/0x6b0 net/ipv6/addrconf.c:3117 addrconf_del_ifaddr+0x11e/0x190 net/ipv6/addrconf.c:3181 inet6_ioctl+0x1e5/0x2b0 net/ipv6/af_inet6.c:582 sock_do_ioctl+0x118/0x280 net/socket.c:1254 sock_ioctl+0x227/0x6b0 net/socket.c:1375 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f164cf8f749 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f164de64038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f164d1e5fa0 RCX: 00007f164cf8f749 RDX: 0000200000000000 RSI: 0000000000008936 RDI: 0000000000000003 RBP: 00007f164d013f91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f164d1e6038 R14: 00007f164d1e5fa0 R15: 00007ffde15c8288 </TASK> Allocated by task 9593: kasan_save_stack+0x33/0x60 mm/kasan/common.c:56 kasan_save_track+0x14/0x30 mm/kasan/common.c:77 poison_kmalloc_redzone mm/kasan/common.c:397 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:414 kmalloc_noprof include/linux/slab.h:957 [inline] kzalloc_noprof include/linux/slab.h:1094 [inline] ipv6_add_addr+0x4e3/0x2010 net/ipv6/addrconf.c:1120 inet6_addr_add+0x256/0x9b0 net/ipv6/addrconf.c:3050 addrconf_add_ifaddr+0x1fc/0x450 net/ipv6/addrconf.c:3160 inet6_ioctl+0x103/0x2b0 net/ipv6/af_inet6.c:580 sock_do_ioctl+0x118/0x280 net/socket.c:1254 sock_ioctl+0x227/0x6b0 net/socket.c:1375 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 6099: kasan_save_stack+0x33/0x60 mm/kasan/common.c:56 kasan_save_track+0x14/0x30 mm/kasan/common.c:77 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:252 [inline] __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:284 kasan_slab_free include/linux/kasan.h:234 [inline] slab_free_hook mm/slub.c:2540 [inline] slab_free_freelist_hook mm/slub.c:2569 [inline] slab_free_bulk mm/slub.c:6696 [inline] kmem_cache_free_bulk mm/slub.c:7383 [inline] kmem_cache_free_bulk+0x2bf/0x680 mm/slub.c:7362 kfree_bulk include/linux/slab.h:830 [inline] kvfree_rcu_bulk+0x1b7/0x1e0 mm/slab_common.c:1523 kvfree_rcu_drain_ready mm/slab_common.c:1728 [inline] kfree_rcu_monitor+0x1d0/0x2f0 mm/slab_common.c:1801 process_one_work+0x9ba/0x1b20 kernel/workqueue.c:3257 process_scheduled_works kernel/workqueue.c:3340 [inline] worker_thread+0x6c8/0xf10 kernel/workqueue.c:3421 kthread+0x3c5/0x780 kernel/kthread.c:463 ret_from_fork+0x983/0xb10 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 Fixes: 00b5b7aab9e42 ("net/ipv6: delete temporary address if mngtmpaddr is removed or unmanaged") Reported-by: syzbot+72e610f4f1a930ca9d8a(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/696598e9.050a0220.3be5c5.0009.GAE@google.com/ Signed-off-by: Kuniyuki Iwashima <kuniyu(a)google.com> Reviewed-by: Hangbin Liu <liuhangbin(a)gmail.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20260113010538.2019411-1-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Li Xiasong <lixiasong1(a)huawei.com> --- net/ipv6/addrconf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c index f6188bd9f55b..1bf67ea03cf3 100644 --- a/net/ipv6/addrconf.c +++ b/net/ipv6/addrconf.c @@ -3094,12 +3094,12 @@ static int inet6_addr_del(struct net *net, int ifindex, u32 ifa_flags, in6_ifa_hold(ifp); read_unlock_bh(&idev->lock); - ipv6_del_addr(ifp); - if (!(ifp->flags & IFA_F_TEMPORARY) && (ifp->flags & IFA_F_MANAGETEMPADDR)) delete_tempaddrs(idev, ifp); + ipv6_del_addr(ifp); + addrconf_verify_rtnl(net); if (ipv6_addr_is_multicast(pfx)) { ipv6_mc_config(net->ipv6.mc_autojoin_sk, -- 2.34.1

2 1

[PATCH OLK-6.6] ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()
by Li Xiasong 31 Jan '26

31 Jan '26

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.19-rc6 commit 81c734dae203757fb3c9eee6f9896386940776bd category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13513 CVE: CVE-2026-23003 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Blamed commit did not take care of VLAN encapsulations as spotted by syzbot [1]. Use skb_vlan_inet_prepare() instead of pskb_inet_may_pull(). [1] BUG: KMSAN: uninit-value in __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline] BUG: KMSAN: uninit-value in INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline] BUG: KMSAN: uninit-value in IP6_ECN_decapsulate+0x7a8/0x1fa0 include/net/inet_ecn.h:321 __INET_ECN_decapsulate include/net/inet_ecn.h:253 [inline] INET_ECN_decapsulate include/net/inet_ecn.h:275 [inline] IP6_ECN_decapsulate+0x7a8/0x1fa0 include/net/inet_ecn.h:321 ip6ip6_dscp_ecn_decapsulate+0x16f/0x1b0 net/ipv6/ip6_tunnel.c:729 __ip6_tnl_rcv+0xed9/0x1b50 net/ipv6/ip6_tunnel.c:860 ip6_tnl_rcv+0xc3/0x100 net/ipv6/ip6_tunnel.c:903 gre_rcv+0x1529/0x1b90 net/ipv6/ip6_gre.c:-1 ip6_protocol_deliver_rcu+0x1c89/0x2c60 net/ipv6/ip6_input.c:438 ip6_input_finish+0x1f4/0x4a0 net/ipv6/ip6_input.c:489 NF_HOOK include/linux/netfilter.h:318 [inline] ip6_input+0x9c/0x330 net/ipv6/ip6_input.c:500 ip6_mc_input+0x7ca/0xc10 net/ipv6/ip6_input.c:590 dst_input include/net/dst.h:474 [inline] ip6_rcv_finish+0x958/0x990 net/ipv6/ip6_input.c:79 NF_HOOK include/linux/netfilter.h:318 [inline] ipv6_rcv+0xf1/0x3c0 net/ipv6/ip6_input.c:311 __netif_receive_skb_one_core net/core/dev.c:6139 [inline] __netif_receive_skb+0x1df/0xac0 net/core/dev.c:6252 netif_receive_skb_internal net/core/dev.c:6338 [inline] netif_receive_skb+0x57/0x630 net/core/dev.c:6397 tun_rx_batched+0x1df/0x980 drivers/net/tun.c:1485 tun_get_user+0x5c0e/0x6c60 drivers/net/tun.c:1953 tun_chr_write_iter+0x3e9/0x5c0 drivers/net/tun.c:1999 new_sync_write fs/read_write.c:593 [inline] vfs_write+0xbe2/0x15d0 fs/read_write.c:686 ksys_write fs/read_write.c:738 [inline] __do_sys_write fs/read_write.c:749 [inline] __se_sys_write fs/read_write.c:746 [inline] __x64_sys_write+0x1fb/0x4d0 fs/read_write.c:746 x64_sys_call+0x30ab/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:2 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd3/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Uninit was created at: slab_post_alloc_hook mm/slub.c:4960 [inline] slab_alloc_node mm/slub.c:5263 [inline] kmem_cache_alloc_node_noprof+0x9e7/0x17a0 mm/slub.c:5315 kmalloc_reserve+0x13c/0x4b0 net/core/skbuff.c:586 __alloc_skb+0x805/0x1040 net/core/skbuff.c:690 alloc_skb include/linux/skbuff.h:1383 [inline] alloc_skb_with_frags+0xc5/0xa60 net/core/skbuff.c:6712 sock_alloc_send_pskb+0xacc/0xc60 net/core/sock.c:2995 tun_alloc_skb drivers/net/tun.c:1461 [inline] tun_get_user+0x1142/0x6c60 drivers/net/tun.c:1794 tun_chr_write_iter+0x3e9/0x5c0 drivers/net/tun.c:1999 new_sync_write fs/read_write.c:593 [inline] vfs_write+0xbe2/0x15d0 fs/read_write.c:686 ksys_write fs/read_write.c:738 [inline] __do_sys_write fs/read_write.c:749 [inline] __se_sys_write fs/read_write.c:746 [inline] __x64_sys_write+0x1fb/0x4d0 fs/read_write.c:746 x64_sys_call+0x30ab/0x3e70 arch/x86/include/generated/asm/syscalls_64.h:2 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd3/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f CPU: 0 UID: 0 PID: 6465 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(none) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Fixes: 8d975c15c0cd ("ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()") Reported-by: syzbot+d4dda070f833dc5dc89a(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/695e88b2.050a0220.1c677c.036d.GAE@google.com… Signed-off-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20260107163109.4188620-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Li Xiasong <lixiasong1(a)huawei.com> --- net/ipv6/ip6_tunnel.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c index c70ff45649ad..2d9a7fa13c5f 100644 --- a/net/ipv6/ip6_tunnel.c +++ b/net/ipv6/ip6_tunnel.c @@ -844,7 +844,7 @@ static int __ip6_tnl_rcv(struct ip6_tnl *tunnel, struct sk_buff *skb, skb_reset_network_header(skb); - if (!pskb_inet_may_pull(skb)) { + if (skb_vlan_inet_prepare(skb, true)) { DEV_STATS_INC(tunnel->dev, rx_length_errors); DEV_STATS_INC(tunnel->dev, rx_errors); goto drop; -- 2.34.1

2 1

[PATCH OLK-6.6] dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list()
by Li Xiasong 31 Jan '26

31 Jan '26

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.19-rc6 commit 9a6f0c4d5796ab89b5a28a890ce542344d58bd69 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13515 CVE: CVE-2026-23004 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- syzbot was able to crash the kernel in rt6_uncached_list_flush_dev() in an interesting way [1] Crash happens in list_del_init()/INIT_LIST_HEAD() while writing list->prev, while the prior write on list->next went well. static inline void INIT_LIST_HEAD(struct list_head *list) { WRITE_ONCE(list->next, list); // This went well WRITE_ONCE(list->prev, list); // Crash, @list has been freed. } Issue here is that rt6_uncached_list_del() did not attempt to lock ul->lock, as list_empty(&rt->dst.rt_uncached) returned true because the WRITE_ONCE(list->next, list) happened on the other CPU. We might use list_del_init_careful() and list_empty_careful(), or make sure rt6_uncached_list_del() always grabs the spinlock whenever rt->dst.rt_uncached_list has been set. A similar fix is neeed for IPv4. [1] BUG: KASAN: slab-use-after-free in INIT_LIST_HEAD include/linux/list.h:46 [inline] BUG: KASAN: slab-use-after-free in list_del_init include/linux/list.h:296 [inline] BUG: KASAN: slab-use-after-free in rt6_uncached_list_flush_dev net/ipv6/route.c:191 [inline] BUG: KASAN: slab-use-after-free in rt6_disable_ip+0x633/0x730 net/ipv6/route.c:5020 Write of size 8 at addr ffff8880294cfa78 by task kworker/u8:14/3450 CPU: 0 UID: 0 PID: 3450 Comm: kworker/u8:14 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Workqueue: netns cleanup_net Call Trace: <TASK> dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xca/0x240 mm/kasan/report.c:482 kasan_report+0x118/0x150 mm/kasan/report.c:595 INIT_LIST_HEAD include/linux/list.h:46 [inline] list_del_init include/linux/list.h:296 [inline] rt6_uncached_list_flush_dev net/ipv6/route.c:191 [inline] rt6_disable_ip+0x633/0x730 net/ipv6/route.c:5020 addrconf_ifdown+0x143/0x18a0 net/ipv6/addrconf.c:3853 addrconf_notify+0x1bc/0x1050 net/ipv6/addrconf.c:-1 notifier_call_chain+0x19d/0x3a0 kernel/notifier.c:85 call_netdevice_notifiers_extack net/core/dev.c:2268 [inline] call_netdevice_notifiers net/core/dev.c:2282 [inline] netif_close_many+0x29c/0x410 net/core/dev.c:1785 unregister_netdevice_many_notify+0xb50/0x2330 net/core/dev.c:12353 ops_exit_rtnl_list net/core/net_namespace.c:187 [inline] ops_undo_list+0x3dc/0x990 net/core/net_namespace.c:248 cleanup_net+0x4de/0x7b0 net/core/net_namespace.c:696 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0xad1/0x1770 kernel/workqueue.c:3340 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3421 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 </TASK> Allocated by task 803: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 unpoison_slab_object mm/kasan/common.c:340 [inline] __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:366 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4953 [inline] slab_alloc_node mm/slub.c:5263 [inline] kmem_cache_alloc_noprof+0x18d/0x6c0 mm/slub.c:5270 dst_alloc+0x105/0x170 net/core/dst.c:89 ip6_dst_alloc net/ipv6/route.c:342 [inline] icmp6_dst_alloc+0x75/0x460 net/ipv6/route.c:3333 mld_sendpack+0x683/0xe60 net/ipv6/mcast.c:1844 mld_send_cr net/ipv6/mcast.c:2154 [inline] mld_ifc_work+0x83e/0xd60 net/ipv6/mcast.c:2693 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0xad1/0x1770 kernel/workqueue.c:3340 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3421 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 Freed by task 20: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2540 [inline] slab_free mm/slub.c:6670 [inline] kmem_cache_free+0x18f/0x8d0 mm/slub.c:6781 dst_destroy+0x235/0x350 net/core/dst.c:121 rcu_do_batch kernel/rcu/tree.c:2605 [inline] rcu_core kernel/rcu/tree.c:2857 [inline] rcu_cpu_kthread+0xba5/0x1af0 kernel/rcu/tree.c:2945 smpboot_thread_fn+0x542/0xa60 kernel/smpboot.c:160 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 Last potentially related work creation: kasan_save_stack+0x3e/0x60 mm/kasan/common.c:57 kasan_record_aux_stack+0xbd/0xd0 mm/kasan/generic.c:556 __call_rcu_common kernel/rcu/tree.c:3119 [inline] call_rcu+0xee/0x890 kernel/rcu/tree.c:3239 refdst_drop include/net/dst.h:266 [inline] skb_dst_drop include/net/dst.h:278 [inline] skb_release_head_state+0x71/0x360 net/core/skbuff.c:1156 skb_release_all net/core/skbuff.c:1180 [inline] __kfree_skb net/core/skbuff.c:1196 [inline] sk_skb_reason_drop+0xe9/0x170 net/core/skbuff.c:1234 kfree_skb_reason include/linux/skbuff.h:1322 [inline] tcf_kfree_skb_list include/net/sch_generic.h:1127 [inline] __dev_xmit_skb net/core/dev.c:4260 [inline] __dev_queue_xmit+0x26aa/0x3210 net/core/dev.c:4785 NF_HOOK_COND include/linux/netfilter.h:307 [inline] ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247 NF_HOOK+0x9e/0x380 include/linux/netfilter.h:318 mld_sendpack+0x8d4/0xe60 net/ipv6/mcast.c:1855 mld_send_cr net/ipv6/mcast.c:2154 [inline] mld_ifc_work+0x83e/0xd60 net/ipv6/mcast.c:2693 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0xad1/0x1770 kernel/workqueue.c:3340 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3421 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 The buggy address belongs to the object at ffff8880294cfa00 which belongs to the cache ip6_dst_cache of size 232 The buggy address is located 120 bytes inside of freed 232-byte region [ffff8880294cfa00, ffff8880294cfae8) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x294cf memcg:ffff88803536b781 flags: 0x80000000000000(node=0|zone=1) page_type: f5(slab) raw: 0080000000000000 ffff88802ff1c8c0 ffffea0000bf2bc0 dead000000000006 raw: 0000000000000000 00000000800c000c 00000000f5000000 ffff88803536b781 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 9, tgid 9 (kworker/0:0), ts 91119585830, free_ts 91088628818 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x234/0x290 mm/page_alloc.c:1857 prep_new_page mm/page_alloc.c:1865 [inline] get_page_from_freelist+0x28c0/0x2960 mm/page_alloc.c:3915 __alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5210 alloc_pages_mpol+0xd1/0x380 mm/mempolicy.c:2486 alloc_slab_page mm/slub.c:3075 [inline] allocate_slab+0x86/0x3b0 mm/slub.c:3248 new_slab mm/slub.c:3302 [inline] ___slab_alloc+0xb10/0x13e0 mm/slub.c:4656 __slab_alloc+0xc6/0x1f0 mm/slub.c:4779 __slab_alloc_node mm/slub.c:4855 [inline] slab_alloc_node mm/slub.c:5251 [inline] kmem_cache_alloc_noprof+0x101/0x6c0 mm/slub.c:5270 dst_alloc+0x105/0x170 net/core/dst.c:89 ip6_dst_alloc net/ipv6/route.c:342 [inline] icmp6_dst_alloc+0x75/0x460 net/ipv6/route.c:3333 mld_sendpack+0x683/0xe60 net/ipv6/mcast.c:1844 mld_send_cr net/ipv6/mcast.c:2154 [inline] mld_ifc_work+0x83e/0xd60 net/ipv6/mcast.c:2693 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0xad1/0x1770 kernel/workqueue.c:3340 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3421 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158 page last free pid 5859 tgid 5859 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1406 [inline] __free_frozen_pages+0xfe1/0x1170 mm/page_alloc.c:2943 discard_slab mm/slub.c:3346 [inline] __put_partials+0x149/0x170 mm/slub.c:3886 __slab_free+0x2af/0x330 mm/slub.c:5952 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x97/0x100 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4953 [inline] slab_alloc_node mm/slub.c:5263 [inline] kmem_cache_alloc_noprof+0x18d/0x6c0 mm/slub.c:5270 getname_flags+0xb8/0x540 fs/namei.c:146 getname include/linux/fs.h:2498 [inline] do_sys_openat2+0xbc/0x200 fs/open.c:1426 do_sys_open fs/open.c:1436 [inline] __do_sys_openat fs/open.c:1452 [inline] __se_sys_openat fs/open.c:1447 [inline] __x64_sys_openat+0x138/0x170 fs/open.c:1447 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xec/0xf80 arch/x86/entry/syscall_64.c:94 Fixes: 8d0b94afdca8 ("ipv6: Keep track of DST_NOCACHE routes in case of iface down/unregister") Fixes: 78df76a065ae ("ipv4: take rt_uncached_lock only if needed") Reported-by: syzbot+179fc225724092b8b2b2(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/6964cdf2.050a0220.eaf7.009d.GAE@google.com/T… Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Martin KaFai Lau <martin.lau(a)kernel.org> Reviewed-by: David Ahern <dsahern(a)kernel.org> Link: https://patch.msgid.link/20260112103825.3810713-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Li Xiasong <lixiasong1(a)huawei.com> --- net/core/dst.c | 1 + net/ipv4/route.c | 4 ++-- net/ipv6/route.c | 4 ++-- 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/net/core/dst.c b/net/core/dst.c index 6f7a2a4d3ad2..f34bd06b75cd 100644 --- a/net/core/dst.c +++ b/net/core/dst.c @@ -68,6 +68,7 @@ void dst_init(struct dst_entry *dst, struct dst_ops *ops, dst->lwtstate = NULL; rcuref_init(&dst->__rcuref, initial_ref); INIT_LIST_HEAD(&dst->rt_uncached); + dst->rt_uncached_list = NULL; dst->__use = 0; dst->lastuse = jiffies; dst->flags = flags; diff --git a/net/ipv4/route.c b/net/ipv4/route.c index 24f09972c9c5..e3482568997b 100644 --- a/net/ipv4/route.c +++ b/net/ipv4/route.c @@ -1546,9 +1546,9 @@ void rt_add_uncached_list(struct rtable *rt) void rt_del_uncached_list(struct rtable *rt) { - if (!list_empty(&rt->dst.rt_uncached)) { - struct uncached_list *ul = rt->dst.rt_uncached_list; + struct uncached_list *ul = rt->dst.rt_uncached_list; + if (ul) { spin_lock_bh(&ul->lock); list_del_init(&rt->dst.rt_uncached); spin_unlock_bh(&ul->lock); diff --git a/net/ipv6/route.c b/net/ipv6/route.c index 41d358dd58c0..40bf2df40c19 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -149,9 +149,9 @@ void rt6_uncached_list_add(struct rt6_info *rt) void rt6_uncached_list_del(struct rt6_info *rt) { - if (!list_empty(&rt->dst.rt_uncached)) { - struct uncached_list *ul = rt->dst.rt_uncached_list; + struct uncached_list *ul = rt->dst.rt_uncached_list; + if (ul) { spin_lock_bh(&ul->lock); list_del_init(&rt->dst.rt_uncached); spin_unlock_bh(&ul->lock); -- 2.34.1

2 1

[PATCH OLK-6.6] ipv4: ip_gre: make ipgre_header() robust
by Li Xiasong 31 Jan '26

31 Jan '26

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.19-rc6 commit e67c577d89894811ce4dcd1a9ed29d8b63476667 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13522 CVE: CVE-2026-23011 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Analog to commit db5b4e39c4e6 ("ip6_gre: make ip6gre_header() robust") Over the years, syzbot found many ways to crash the kernel in ipgre_header() [1]. This involves team or bonding drivers ability to dynamically change their dev->needed_headroom and/or dev->hard_header_len In this particular crash mld_newpack() allocated an skb with a too small reserve/headroom, and by the time mld_sendpack() was called, syzbot managed to attach an ipgre device. [1] skbuff: skb_under_panic: text:ffffffff89ea3cb7 len:2030915468 put:2030915372 head:ffff888058b43000 data:ffff887fdfa6e194 tail:0x120 end:0x6c0 dev:team0 kernel BUG at net/core/skbuff.c:213 ! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 1 UID: 0 PID: 1322 Comm: kworker/1:9 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Workqueue: mld mld_ifc_work RIP: 0010:skb_panic+0x157/0x160 net/core/skbuff.c:213 Call Trace: <TASK> skb_under_panic net/core/skbuff.c:223 [inline] skb_push+0xc3/0xe0 net/core/skbuff.c:2641 ipgre_header+0x67/0x290 net/ipv4/ip_gre.c:897 dev_hard_header include/linux/netdevice.h:3436 [inline] neigh_connected_output+0x286/0x460 net/core/neighbour.c:1618 NF_HOOK_COND include/linux/netfilter.h:307 [inline] ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247 NF_HOOK+0x9e/0x380 include/linux/netfilter.h:318 mld_sendpack+0x8d4/0xe60 net/ipv6/mcast.c:1855 mld_send_cr net/ipv6/mcast.c:2154 [inline] mld_ifc_work+0x83e/0xd60 net/ipv6/mcast.c:2693 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0xad1/0x1770 kernel/workqueue.c:3340 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3421 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 Fixes: c54419321455 ("GRE: Refactor GRE tunneling code.") Reported-by: syzbot+7c134e1c3aa3283790b9(a)syzkaller.appspotmail.com Closes: https://www.spinics.net/lists/netdev/msg1147302.html Signed-off-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20260108190214.1667040-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Li Xiasong <lixiasong1(a)huawei.com> --- net/ipv4/ip_gre.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c index f261e29adc7c..75d388dd5ac6 100644 --- a/net/ipv4/ip_gre.c +++ b/net/ipv4/ip_gre.c @@ -860,10 +860,17 @@ static int ipgre_header(struct sk_buff *skb, struct net_device *dev, const void *daddr, const void *saddr, unsigned int len) { struct ip_tunnel *t = netdev_priv(dev); - struct iphdr *iph; struct gre_base_hdr *greh; + struct iphdr *iph; + int needed; + + needed = t->hlen + sizeof(*iph); + if (skb_headroom(skb) < needed && + pskb_expand_head(skb, HH_DATA_ALIGN(needed - skb_headroom(skb)), + 0, GFP_ATOMIC)) + return -needed; - iph = skb_push(skb, t->hlen + sizeof(*iph)); + iph = skb_push(skb, needed); greh = (struct gre_base_hdr *)(iph+1); greh->flags = gre_tnl_flags_to_gre_flags(t->parms.o_flags); greh->protocol = htons(type); -- 2.34.1

2 1

[PATCH OLK-6.6] net: fix memory leak in skb_segment_list for GRO packets
by Li Xiasong 31 Jan '26

31 Jan '26

From: Mohammad Heib <mheib(a)redhat.com> stable inclusion from stable-v6.6.121 commit 88bea149db2057112af3aaf63534b24fab5858ab category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13488 CVE: CVE-2026-22979 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 238e03d0466239410b72294b79494e43d4fabe77 ] When skb_segment_list() is called during packet forwarding, it handles packets that were aggregated by the GRO engine. Historically, the segmentation logic in skb_segment_list assumes that individual segments are split from a parent SKB and may need to carry their own socket memory accounting. Accordingly, the code transfers truesize from the parent to the newly created segments. Prior to commit ed4cccef64c1 ("gro: fix ownership transfer"), this truesize subtraction in skb_segment_list() was valid because fragments still carry a reference to the original socket. However, commit ed4cccef64c1 ("gro: fix ownership transfer") changed this behavior by ensuring that fraglist entries are explicitly orphaned (skb->sk = NULL) to prevent illegal orphaning later in the stack. This change meant that the entire socket memory charge remained with the head SKB, but the corresponding accounting logic in skb_segment_list() was never updated. As a result, the current code unconditionally adds each fragment's truesize to delta_truesize and subtracts it from the parent SKB. Since the fragments are no longer charged to the socket, this subtraction results in an effective under-count of memory when the head is freed. This causes sk_wmem_alloc to remain non-zero, preventing socket destruction and leading to a persistent memory leak. The leak can be observed via KMEMLEAK when tearing down the networking environment: unreferenced object 0xffff8881e6eb9100 (size 2048): comm "ping", pid 6720, jiffies 4295492526 backtrace: kmem_cache_alloc_noprof+0x5c6/0x800 sk_prot_alloc+0x5b/0x220 sk_alloc+0x35/0xa00 inet6_create.part.0+0x303/0x10d0 __sock_create+0x248/0x640 __sys_socket+0x11b/0x1d0 Since skb_segment_list() is exclusively used for SKB_GSO_FRAGLIST packets constructed by GRO, the truesize adjustment is removed. The call to skb_release_head_state() must be preserved. As documented in commit cf673ed0e057 ("net: fix fraglist segmentation reference count leak"), it is still required to correctly drop references to SKB extensions that may be overwritten during __copy_skb_header(). Fixes: ed4cccef64c1 ("gro: fix ownership transfer") Signed-off-by: Mohammad Heib <mheib(a)redhat.com> Reviewed-by: Willem de Bruijn <willemb(a)google.com> Link: https://patch.msgid.link/20260104213101.352887-1-mheib@redhat.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Li Xiasong <lixiasong1(a)huawei.com> --- net/core/skbuff.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/net/core/skbuff.c b/net/core/skbuff.c index ea5e9d46d4c4..b115544fde66 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -4348,12 +4348,14 @@ struct sk_buff *skb_segment_list(struct sk_buff *skb, { struct sk_buff *list_skb = skb_shinfo(skb)->frag_list; unsigned int tnl_hlen = skb_tnl_header_len(skb); - unsigned int delta_truesize = 0; unsigned int delta_len = 0; struct sk_buff *tail = NULL; struct sk_buff *nskb, *tmp; int len_diff, err; + /* Only skb_gro_receive_list generated skbs arrive here */ + DEBUG_NET_WARN_ON_ONCE(!(skb_shinfo(skb)->gso_type & SKB_GSO_FRAGLIST)); + skb_push(skb, -skb_network_offset(skb) + offset); /* Ensure the head is writeable before touching the shared info */ @@ -4367,8 +4369,9 @@ struct sk_buff *skb_segment_list(struct sk_buff *skb, nskb = list_skb; list_skb = list_skb->next; + DEBUG_NET_WARN_ON_ONCE(nskb->sk); + err = 0; - delta_truesize += nskb->truesize; if (skb_shared(nskb)) { tmp = skb_clone(nskb, GFP_ATOMIC); if (tmp) { @@ -4411,7 +4414,6 @@ struct sk_buff *skb_segment_list(struct sk_buff *skb, goto err_linearize; } - skb->truesize = skb->truesize - delta_truesize; skb->data_len = skb->data_len - delta_len; skb->len = skb->len - delta_len; -- 2.34.1

2 1

[PATCH OLK-6.6] net: sock: fix hardened usercopy panic in sock_recv_errqueue
by Li Xiasong 31 Jan '26

31 Jan '26

From: Weiming Shi <bestswngs(a)gmail.com> stable inclusion from stable-v6.6.121 commit 582a5e922a9652fcbb7d0165c95d5b20aa37575d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13464 CVE: CVE-2026-22977 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2a71a1a8d0ed718b1c7a9ac61f07e5755c47ae20 ] skbuff_fclone_cache was created without defining a usercopy region, [1] unlike skbuff_head_cache which properly whitelists the cb[] field. [2] This causes a usercopy BUG() when CONFIG_HARDENED_USERCOPY is enabled and the kernel attempts to copy sk_buff.cb data to userspace via sock_recv_errqueue() -> put_cmsg(). The crash occurs when: 1. TCP allocates an skb using alloc_skb_fclone() (from skbuff_fclone_cache) [1] 2. The skb is cloned via skb_clone() using the pre-allocated fclone [3] 3. The cloned skb is queued to sk_error_queue for timestamp reporting 4. Userspace reads the error queue via recvmsg(MSG_ERRQUEUE) 5. sock_recv_errqueue() calls put_cmsg() to copy serr->ee from skb->cb [4] 6. __check_heap_object() fails because skbuff_fclone_cache has no usercopy whitelist [5] When cloned skbs allocated from skbuff_fclone_cache are used in the socket error queue, accessing the sock_exterr_skb structure in skb->cb via put_cmsg() triggers a usercopy hardening violation: [ 5.379589] usercopy: Kernel memory exposure attempt detected from SLUB object 'skbuff_fclone_cache' (offset 296, size 16)! [ 5.382796] kernel BUG at mm/usercopy.c:102! [ 5.383923] Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI [ 5.384903] CPU: 1 UID: 0 PID: 138 Comm: poc_put_cmsg Not tainted 6.12.57 #7 [ 5.384903] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 5.384903] RIP: 0010:usercopy_abort+0x6c/0x80 [ 5.384903] Code: 1a 86 51 48 c7 c2 40 15 1a 86 41 52 48 c7 c7 c0 15 1a 86 48 0f 45 d6 48 c7 c6 80 15 1a 86 48 89 c1 49 0f 45 f3 e8 84 27 88 ff <0f> 0b 490 [ 5.384903] RSP: 0018:ffffc900006f77a8 EFLAGS: 00010246 [ 5.384903] RAX: 000000000000006f RBX: ffff88800f0ad2a8 RCX: 1ffffffff0f72e74 [ 5.384903] RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffff87b973a0 [ 5.384903] RBP: 0000000000000010 R08: 0000000000000000 R09: fffffbfff0f72e74 [ 5.384903] R10: 0000000000000003 R11: 79706f6372657375 R12: 0000000000000001 [ 5.384903] R13: ffff88800f0ad2b8 R14: ffffea00003c2b40 R15: ffffea00003c2b00 [ 5.384903] FS: 0000000011bc4380(0000) GS:ffff8880bf100000(0000) knlGS:0000000000000000 [ 5.384903] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 5.384903] CR2: 000056aa3b8e5fe4 CR3: 000000000ea26004 CR4: 0000000000770ef0 [ 5.384903] PKRU: 55555554 [ 5.384903] Call Trace: [ 5.384903] <TASK> [ 5.384903] __check_heap_object+0x9a/0xd0 [ 5.384903] __check_object_size+0x46c/0x690 [ 5.384903] put_cmsg+0x129/0x5e0 [ 5.384903] sock_recv_errqueue+0x22f/0x380 [ 5.384903] tls_sw_recvmsg+0x7ed/0x1960 [ 5.384903] ? srso_alias_return_thunk+0x5/0xfbef5 [ 5.384903] ? schedule+0x6d/0x270 [ 5.384903] ? srso_alias_return_thunk+0x5/0xfbef5 [ 5.384903] ? mutex_unlock+0x81/0xd0 [ 5.384903] ? __pfx_mutex_unlock+0x10/0x10 [ 5.384903] ? __pfx_tls_sw_recvmsg+0x10/0x10 [ 5.384903] ? _raw_spin_lock_irqsave+0x8f/0xf0 [ 5.384903] ? _raw_read_unlock_irqrestore+0x20/0x40 [ 5.384903] ? srso_alias_return_thunk+0x5/0xfbef5 The crash offset 296 corresponds to skb2->cb within skbuff_fclones: - sizeof(struct sk_buff) = 232 - offsetof(struct sk_buff, cb) = 40 - offset of skb2.cb in fclones = 232 + 40 = 272 - crash offset 296 = 272 + 24 (inside sock_exterr_skb.ee) This patch uses a local stack variable as a bounce buffer to avoid the hardened usercopy check failure. [1] https://elixir.bootlin.com/linux/v6.12.62/source/net/ipv4/tcp.c#L885 [2] https://elixir.bootlin.com/linux/v6.12.62/source/net/core/skbuff.c#L5104 [3] https://elixir.bootlin.com/linux/v6.12.62/source/net/core/skbuff.c#L5566 [4] https://elixir.bootlin.com/linux/v6.12.62/source/net/core/skbuff.c#L5491 [5] https://elixir.bootlin.com/linux/v6.12.62/source/mm/slub.c#L5719 Fixes: 6d07d1cd300f ("usercopy: Restrict non-usercopy caches to size 0") Reported-by: Xiang Mei <xmei5(a)asu.edu> Signed-off-by: Weiming Shi <bestswngs(a)gmail.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20251223203534.1392218-2-bestswngs@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Li Xiasong <lixiasong1(a)huawei.com> --- net/core/sock.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/net/core/sock.c b/net/core/sock.c index b5a2fea5237e..d5175f9e515b 100644 --- a/net/core/sock.c +++ b/net/core/sock.c @@ -3655,7 +3655,7 @@ void sock_enable_timestamp(struct sock *sk, enum sock_flags flag) int sock_recv_errqueue(struct sock *sk, struct msghdr *msg, int len, int level, int type) { - struct sock_exterr_skb *serr; + struct sock_extended_err ee; struct sk_buff *skb; int copied, err; @@ -3675,8 +3675,9 @@ int sock_recv_errqueue(struct sock *sk, struct msghdr *msg, int len, sock_recv_timestamp(msg, sk, skb); - serr = SKB_EXT_ERR(skb); - put_cmsg(msg, level, type, sizeof(serr->ee), &serr->ee); + /* We must use a bounce buffer for CONFIG_HARDENED_USERCOPY=y */ + ee = SKB_EXT_ERR(skb)->ee; + put_cmsg(msg, level, type, sizeof(ee), &ee); msg->msg_flags |= MSG_ERRQUEUE; err = copied; -- 2.34.1

2 1

[PATCH OLK-6.6] ipv4: Fix reference count leak when using error routes with nexthop objects
by Li Xiasong 31 Jan '26

31 Jan '26

From: Ido Schimmel <idosch(a)nvidia.com> stable inclusion from stable-v6.6.120 commit 5979338c83012110ccd45cae6517591770bfe536 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13408 CVE: CVE-2025-71097 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ac782f4e3bfcde145b8a7f8af31d9422d94d172a ] When a nexthop object is deleted, it is marked as dead and then fib_table_flush() is called to flush all the routes that are using the dead nexthop. The current logic in fib_table_flush() is to only flush error routes (e.g., blackhole) when it is called as part of network namespace dismantle (i.e., with flush_all=true). Therefore, error routes are not flushed when their nexthop object is deleted: # ip link add name dummy1 up type dummy # ip nexthop add id 1 dev dummy1 # ip route add 198.51.100.1/32 nhid 1 # ip route add blackhole 198.51.100.2/32 nhid 1 # ip nexthop del id 1 # ip route show blackhole 198.51.100.2 nhid 1 dev dummy1 As such, they keep holding a reference on the nexthop object which in turn holds a reference on the nexthop device, resulting in a reference count leak: # ip link del dev dummy1 [ 70.516258] unregister_netdevice: waiting for dummy1 to become free. Usage count = 2 Fix by flushing error routes when their nexthop is marked as dead. IPv6 does not suffer from this problem. Fixes: 493ced1ac47c ("ipv4: Allow routes to use nexthop objects") Reported-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Closes: https://lore.kernel.org/netdev/d943f806-4da6-4970-ac28-b9373b0e63ac@I-love.… Reported-by: syzbot+881d65229ca4f9ae8c84(a)syzkaller.appspotmail.com Signed-off-by: Ido Schimmel <idosch(a)nvidia.com> Reviewed-by: David Ahern <dsahern(a)kernel.org> Link: https://patch.msgid.link/20251221144829.197694-1-idosch@nvidia.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Li Xiasong <lixiasong1(a)huawei.com> --- net/ipv4/fib_trie.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c index fa54b36b241a..4d148d089232 100644 --- a/net/ipv4/fib_trie.c +++ b/net/ipv4/fib_trie.c @@ -2059,10 +2059,11 @@ int fib_table_flush(struct net *net, struct fib_table *tb, bool flush_all) continue; } - /* Do not flush error routes if network namespace is - * not being dismantled + /* When not flushing the entire table, skip error + * routes that are not marked for deletion. */ - if (!flush_all && fib_props[fa->fa_type].error) { + if (!flush_all && fib_props[fa->fa_type].error && + !(fi->fib_flags & RTNH_F_DEAD)) { slen = fa->fa_slen; continue; } -- 2.34.1

2 1

[PATCH OLK-6.6] SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf
by Li Xiasong 31 Jan '26

31 Jan '26

From: Joshua Rogers <linux(a)joshua.hu> mainline inclusion from mainline-v6.19-rc3 commit d4b69a6186b215d2dc1ebcab965ed88e8d41768d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13435 CVE: CVE-2025-71120 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- A zero length gss_token results in pages == 0 and in_token->pages[0] is NULL. The code unconditionally evaluates page_address(in_token->pages[0]) for the initial memcpy, which can dereference NULL even when the copy length is 0. Guard the first memcpy so it only runs when length > 0. Fixes: 5866efa8cbfb ("SUNRPC: Fix svcauth_gss_proxy_init()") Cc: stable(a)vger.kernel.org Signed-off-by: Joshua Rogers <linux(a)joshua.hu> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Signed-off-by: Li Xiasong <lixiasong1(a)huawei.com> --- net/sunrpc/auth_gss/svcauth_gss.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c index d063b63516f8..49a8623cc1d5 100644 --- a/net/sunrpc/auth_gss/svcauth_gss.c +++ b/net/sunrpc/auth_gss/svcauth_gss.c @@ -1093,7 +1093,8 @@ static int gss_read_proxy_verf(struct svc_rqst *rqstp, } length = min_t(unsigned int, inlen, (char *)xdr->end - (char *)xdr->p); - memcpy(page_address(in_token->pages[0]), xdr->p, length); + if (length) + memcpy(page_address(in_token->pages[0]), xdr->p, length); inlen -= length; to_offs = length; -- 2.34.1

2 1

[PATCH OLK-6.6] drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer
by Jiacheng Yu 31 Jan '26

31 Jan '26

From: Krzysztof Niemiec <krzysztof.niemiec(a)intel.com> stable inclusion from stable-v6.6.120 commit 0336188cc85d0eab8463bd1bbd4ded4e9602de8b category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13444 CVE: CVE-2025-71130 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 4fe2bd195435e71c117983d87f278112c5ab364c upstream. Initialize the eb.vma array with values of 0 when the eb structure is first set up. In particular, this sets the eb->vma[i].vma pointers to NULL, simplifying cleanup and getting rid of the bug described below. During the execution of eb_lookup_vmas(), the eb->vma array is successively filled up with struct eb_vma objects. This process includes calling eb_add_vma(), which might fail; however, even in the event of failure, eb->vma[i].vma is set for the currently processed buffer. If eb_add_vma() fails, eb_lookup_vmas() returns with an error, which prompts a call to eb_release_vmas() to clean up the mess. Since eb_lookup_vmas() might fail during processing any (possibly not first) buffer, eb_release_vmas() checks whether a buffer's vma is NULL to know at what point did the lookup function fail. In eb_lookup_vmas(), eb->vma[i].vma is set to NULL if either the helper function eb_lookup_vma() or eb_validate_vma() fails. eb->vma[i+1].vma is set to NULL in case i915_gem_object_userptr_submit_init() fails; the current one needs to be cleaned up by eb_release_vmas() at this point, so the next one is set. If eb_add_vma() fails, neither the current nor the next vma is set to NULL, which is a source of a NULL deref bug described in the issue linked in the Closes tag. When entering eb_lookup_vmas(), the vma pointers are set to the slab poison value, instead of NULL. This doesn't matter for the actual lookup, since it gets overwritten anyway, however the eb_release_vmas() function only recognizes NULL as the stopping value, hence the pointers are being set to NULL as they go in case of intermediate failure. This patch changes the approach to filling them all with NULL at the start instead, rather than handling that manually during failure. Reported-by: Gangmin Kim <km.kim1503(a)gmail.com> Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/15062 Fixes: 544460c33821 ("drm/i915: Multi-BB execbuf") Cc: stable(a)vger.kernel.org # 5.16.x Signed-off-by: Krzysztof Niemiec <krzysztof.niemiec(a)intel.com> Reviewed-by: Janusz Krzysztofik <janusz.krzysztofik(a)linux.intel.com> Reviewed-by: Krzysztof Karas <krzysztof.karas(a)intel.com> Reviewed-by: Andi Shyti <andi.shyti(a)linux.intel.com> Signed-off-by: Andi Shyti <andi.shyti(a)kernel.org> Link: https://lore.kernel.org/r/20251216180900.54294-2-krzysztof.niemiec@intel.com (cherry picked from commit 08889b706d4f0b8d2352b7ca29c2d8df4d0787cd) Signed-off-by: Jani Nikula <jani.nikula(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jiacheng Yu <yujiacheng3(a)huawei.com> --- .../gpu/drm/i915/gem/i915_gem_execbuffer.c | 37 +++++++++---------- 1 file changed, 17 insertions(+), 20 deletions(-) diff --git a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c index 5a687a3686bd..e208cc8c2ac1 100644 --- a/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c +++ b/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.c @@ -950,13 +950,13 @@ static int eb_lookup_vmas(struct i915_execbuffer *eb) vma = eb_lookup_vma(eb, eb->exec[i].handle); if (IS_ERR(vma)) { err = PTR_ERR(vma); - goto err; + return err; } err = eb_validate_vma(eb, &eb->exec[i], vma); if (unlikely(err)) { i915_vma_put(vma); - goto err; + return err; } err = eb_add_vma(eb, &current_batch, i, vma); @@ -965,19 +965,8 @@ static int eb_lookup_vmas(struct i915_execbuffer *eb) if (i915_gem_object_is_userptr(vma->obj)) { err = i915_gem_object_userptr_submit_init(vma->obj); - if (err) { - if (i + 1 < eb->buffer_count) { - /* - * Execbuffer code expects last vma entry to be NULL, - * since we already initialized this entry, - * set the next value to NULL or we mess up - * cleanup handling. - */ - eb->vma[i + 1].vma = NULL; - } - + if (err) return err; - } eb->vma[i].flags |= __EXEC_OBJECT_USERPTR_INIT; eb->args->flags |= __EXEC_USERPTR_USED; @@ -985,10 +974,6 @@ static int eb_lookup_vmas(struct i915_execbuffer *eb) } return 0; - -err: - eb->vma[i].vma = NULL; - return err; } static int eb_lock_vmas(struct i915_execbuffer *eb) @@ -3381,7 +3366,8 @@ i915_gem_do_execbuffer(struct drm_device *dev, eb.exec = exec; eb.vma = (struct eb_vma *)(exec + args->buffer_count + 1); - eb.vma[0].vma = NULL; + memset(eb.vma, 0, (args->buffer_count + 1) * sizeof(struct eb_vma)); + eb.batch_pool = NULL; eb.invalid_flags = __EXEC_OBJECT_UNKNOWN_FLAGS; @@ -3590,7 +3576,18 @@ i915_gem_execbuffer2_ioctl(struct drm_device *dev, void *data, if (err) return err; - /* Allocate extra slots for use by the command parser */ + /* + * Allocate extra slots for use by the command parser. + * + * Note that this allocation handles two different arrays (the + * exec2_list array, and the eventual eb.vma array introduced in + * i915_gem_do_execbuffer()), that reside in virtually contiguous + * memory. Also note that the allocation intentionally doesn't fill the + * area with zeros, because the exec2_list part doesn't need to be, as + * it's immediately overwritten by user data a few lines below. + * However, the eb.vma part is explicitly zeroed later in + * i915_gem_do_execbuffer(). + */ exec2_list = kvmalloc_array(count + 2, eb_element_size(), __GFP_NOWARN | GFP_KERNEL); if (exec2_list == NULL) { -- 2.43.0

2 1

[PATCH OLK-6.6 0/3] CVE-2025-39981 fixup
by Jiacheng Yu 31 Jan '26

31 Jan '26

*** BLURB HERE *** Luiz Augusto von Dentz (1): Bluetooth: MGMT: Fix possible UAFs Pavel Shpakovskiy (1): Bluetooth: hci_sync: fix set_local_name race condition Roman Smirnov (1): Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() include/net/bluetooth/hci_sync.h | 2 +- net/bluetooth/hci_sync.c | 6 +- net/bluetooth/mgmt.c | 261 ++++++++++++++++++++++--------- net/bluetooth/mgmt_util.c | 46 ++++++ net/bluetooth/mgmt_util.h | 3 + 5 files changed, 237 insertions(+), 81 deletions(-) -- 2.43.0

2 4

[PATCH OLK-5.10] pptp: ensure minimal skb length in pptp_xmit()
by Jiacheng Yu 31 Jan '26

31 Jan '26

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.17-rc1 commit de9c4861fb42f0cd72da844c3c34f692d5895b7b category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/9204 CVE: CVE-2025-38574 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Commit aabc6596ffb3 ("net: ppp: Add bound checking for skb data on ppp_sync_txmung") fixed ppp_sync_txmunge() We need a similar fix in pptp_xmit(), otherwise we might read uninit data as reported by syzbot. BUG: KMSAN: uninit-value in pptp_xmit+0xc34/0x2720 drivers/net/ppp/pptp.c:193 pptp_xmit+0xc34/0x2720 drivers/net/ppp/pptp.c:193 ppp_channel_bridge_input drivers/net/ppp/ppp_generic.c:2290 [inline] ppp_input+0x1d6/0xe60 drivers/net/ppp/ppp_generic.c:2314 pppoe_rcv_core+0x1e8/0x760 drivers/net/ppp/pppoe.c:379 sk_backlog_rcv+0x142/0x420 include/net/sock.h:1148 __release_sock+0x1d3/0x330 net/core/sock.c:3213 release_sock+0x6b/0x270 net/core/sock.c:3767 pppoe_sendmsg+0x15d/0xcb0 drivers/net/ppp/pppoe.c:904 sock_sendmsg_nosec net/socket.c:712 [inline] __sock_sendmsg+0x330/0x3d0 net/socket.c:727 ____sys_sendmsg+0x893/0xd80 net/socket.c:2566 ___sys_sendmsg+0x271/0x3b0 net/socket.c:2620 __sys_sendmmsg+0x2d9/0x7c0 net/socket.c:2709 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+afad90ffc8645324afe5(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/68887d86.a00a0220.b12ec.00cd.GAE@google.com/… Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Dawid Osuchowski <dawid.osuchowski(a)linux.intel.com> Link: https://patch.msgid.link/20250729080207.1863408-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Jiacheng Yu <yujiacheng3(a)huawei.com> --- drivers/net/ppp/pptp.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c index 05a75b5a8b68..1b306562f916 100644 --- a/drivers/net/ppp/pptp.c +++ b/drivers/net/ppp/pptp.c @@ -159,9 +159,7 @@ static int pptp_xmit(struct ppp_channel *chan, struct sk_buff *skb) int len; unsigned char *data; __u32 seq_recv; - - - struct rtable *rt; + struct rtable *rt = NULL; struct net_device *tdev; struct iphdr *iph; int max_headroom; @@ -179,16 +177,20 @@ static int pptp_xmit(struct ppp_channel *chan, struct sk_buff *skb) if (skb_headroom(skb) < max_headroom || skb_cloned(skb) || skb_shared(skb)) { struct sk_buff *new_skb = skb_realloc_headroom(skb, max_headroom); - if (!new_skb) { - ip_rt_put(rt); + + if (!new_skb) goto tx_error; - } + if (skb->sk) skb_set_owner_w(new_skb, skb->sk); consume_skb(skb); skb = new_skb; } + /* Ensure we can safely access protocol field and LCP code */ + if (!pskb_may_pull(skb, 3)) + goto tx_error; + data = skb->data; islcp = ((data[0] << 8) + data[1]) == PPP_LCP && 1 <= data[2] && data[2] <= 7; @@ -262,6 +264,7 @@ static int pptp_xmit(struct ppp_channel *chan, struct sk_buff *skb) return 1; tx_error: + ip_rt_put(rt); kfree_skb(skb); return 1; } -- 2.43.0

2 1