- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 0/2] Backport tracing mainline patches
by Tengda Wu 23 Sep '26

23 Sep '26

Backport tracing mainline patches. Steven Rostedt (1): tracing: Take trace_array reference when opening a tracer options file Tengda Wu (1): tracing: tracing: Fix KABI breakage from trace_options nr_topts field kernel/trace/trace.c | 46 +++++++++++++++++++++++++++++++++++++++++++- kernel/trace/trace.h | 1 + 2 files changed, 46 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH OLK-6.6] tracing: Fix memory corruption from a "STACKTRACE" histogram key
by Tengda Wu 23 Sep '26

23 Sep '26

From: Donggeun Yoo <donggeunyoo.kernel(a)gmail.com> mainline inclusion from mainline-v7.3-rc3 commit 7f711e62355bb3123a2ca2f97a2facbfebc678c6 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9956 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- "cpu", "CPU", "stacktrace" and "STACKTRACE" are generic fields, defined with an offset and a size of zero so that the filter code can match them by name. parse_field() maps them onto their common_* equivalents for backward compatibility, but unlike the common_* names it hands the placeholder back to the caller instead of NULL. create_hist_field() takes a non-NULL field as a promise that the record carries a stacktrace and picks HIST_FIELD_FN_STACK, so the __data_loc word is read from offset 0, that is from common_type, and its low 16 bits are followed as an offset into the record. What is found there becomes the length of an unbounded memcpy. Pick an event whose id is small enough that the offset stays inside its own record and the length is a kernel text address: # cd /sys/kernel/tracing # echo 'hist:keys=STACKTRACE' > events/ftrace/print/trigger # echo hello > trace_marker Oops: general protection fault, probably for non-canonical address RIP: 0010:rb_next+0x23/0x60 </IRQ> RIP: 0010:memcpy+0xc/0x30 event_hist_trigger+0x2e7/0x12c0 Kernel panic - not syncing: Fatal exception in interrupt Leave the field NULL, which is what the comment above the branch says the code does and what common_stacktrace already does. FILTER_CPU and FILTER_COMM are left alone, their create_hist_field() branches never look at the field. Cc: stable(a)vger.kernel.org Fixes: 4b512860bdbd ("tracing: Rename stacktrace field to common_stacktrace") Link: https://patch.msgid.link/20260907155045.692664-3-donggeunyoo.kernel@gmail.c… Signed-off-by: Donggeun Yoo <donggeunyoo.kernel(a)gmail.com> Signed-off-by: Steven Rostedt <rostedt(a)goodmis.org> Conflicts: kernel/trace/trace_events_hist.c [Context conflict] Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/trace/trace_events_hist.c | 1 + 1 file changed, 1 insertion(+) diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c index 40e81642c75d..d5602a4c6eb5 100644 --- a/kernel/trace/trace_events_hist.c +++ b/kernel/trace/trace_events_hist.c @@ -2401,6 +2401,7 @@ parse_field(struct hist_trigger_data *hist_data, struct trace_event_file *file, *flags |= HIST_FIELD_FL_CPU; } else if (field && field->filter_type == FILTER_STACKTRACE) { *flags |= HIST_FIELD_FL_STACKTRACE; + field = NULL; } else { hist_err(tr, HIST_ERR_FIELD_NOT_FOUND, errpos(field_name)); -- 2.34.1

2 1

[PATCH OLK-5.10] lockd: pin next file across nlm_inspect_file lock-drop
by Pu Lehui 23 Sep '26

23 Sep '26

From: Michael Bommarito <michael.bommarito(a)gmail.com> mainline inclusion from mainline-v7.3-rc1 commit 526c49cff3f72c3ec74752016380c7567040581b category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18850 CVE: CVE-2026-89485 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- nlm_traverse_files() pins the current file with f_count++ across a mutex_unlock for nlm_inspect_file(), but nothing pins the saved next pointer. A concurrent nlm_release_file() can kfree the next file during the unlock window, and the iterator dereferences freed memory on the next loop step. Pin both current and next before the lock-drop. Advance by swapping the pinned cursors at the end of each iteration so next is always held alive across the unlock. Always call nlm_file_release() after dropping the iteration pin, regardless of whether the file matched the predicate. Use nlm_file_inuse(), which does a live walk of the inode lock list, rather than the cached f_locks field, so skipped files that never ran nlm_inspect_file() are evaluated correctly. Because every file in a hash bucket is now pinned and released, files skipped by the is_failover_file predicate that have no locks, blocks, shares, or external references are deleted during traversal. The old code never evaluated skipped files for cleanup. The new behavior is intentional: such files are stale and should not persist in the table. Fixes: 01df9c5e918a ("LOCKD: Fix a deadlock in nlm_traverse_files()") Cc: stable(a)vger.kernel.org Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Link: https://patch.msgid.link/20260524115527.1734251-1-michael.bommarito@gmail.c… Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Conflicts: fs/lockd/svcsubs.c [Downstream tree has no standalone nlm_close_files() helper; the teardown was inlined inside nlm_traverse_files(). Add nlm_file_release() (as upstream does) and rewrite the traversal loop to the new pinned-cursor form.] Co-authored-by: BackportAgent@deepseek-v4-flash Signed-off-by: Hulk Robot <hulkrobot(a)huawei.com> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- fs/lockd/svcsubs.c | 52 +++++++++++++++++++++++++++++----------------- 1 file changed, 33 insertions(+), 19 deletions(-) diff --git a/fs/lockd/svcsubs.c b/fs/lockd/svcsubs.c index 028fc152da22..23fd515b2185 100644 --- a/fs/lockd/svcsubs.c +++ b/fs/lockd/svcsubs.c @@ -246,6 +246,11 @@ nlm_file_inuse(struct nlm_file *file) return 0; } +static void nlm_file_release(struct nlm_file *file) +{ + if (!nlm_file_inuse(file)) + nlm_delete_file(file); +} /* * Loop over all files in the file table. */ @@ -253,32 +258,41 @@ static int nlm_traverse_files(void *data, nlm_host_match_fn_t match, int (*is_failover_file)(void *data, struct nlm_file *file)) { - struct hlist_node *next; - struct nlm_file *file; + struct nlm_file *file, *next; int i, ret = 0; mutex_lock(&nlm_file_mutex); for (i = 0; i < FILE_NRHASH; i++) { - hlist_for_each_entry_safe(file, next, &nlm_files[i], f_list) { - if (is_failover_file && !is_failover_file(data, file)) - continue; + file = hlist_entry_safe(nlm_files[i].first, + struct nlm_file, f_list); + if (file) file->f_count++; - mutex_unlock(&nlm_file_mutex); - - /* Traverse locks, blocks and shares of this file - * and update file->f_locks count */ - if (nlm_inspect_file(data, file, match)) - ret = 1; + while (file) { + /* + * Pin the next neighbour before we drop the mutex + * for nlm_inspect_file(); a concurrent + * nlm_release_file() under the same mutex would + * otherwise be free to unlink and kfree it during + * the unlock window, leaving us to dereference a + * freed slab when we walked to next afterwards. + */ + next = hlist_entry_safe(file->f_list.next, + struct nlm_file, f_list); + if (next) + next->f_count++; + + if (!is_failover_file || is_failover_file(data, file)) { + mutex_unlock(&nlm_file_mutex); + + if (nlm_inspect_file(data, file, match)) + ret = 1; + + mutex_lock(&nlm_file_mutex); + } - mutex_lock(&nlm_file_mutex); file->f_count--; - /* No more references to this file. Let go of it. */ - if (list_empty(&file->f_blocks) && !file->f_locks - && !file->f_shares && !file->f_count) { - hlist_del(&file->f_list); - nlmsvc_ops->fclose(file->f_file); - kfree(file); - } + nlm_file_release(file); + file = next; } } mutex_unlock(&nlm_file_mutex); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] lockd: pin next file across nlm_inspect_file lock-drop
by Pu Lehui 23 Sep '26

23 Sep '26

From: Michael Bommarito <michael.bommarito(a)gmail.com> mainline inclusion from mainline-v7.3-rc1 commit 526c49cff3f72c3ec74752016380c7567040581b category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18850 CVE: CVE-2026-89485 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- nlm_traverse_files() pins the current file with f_count++ across a mutex_unlock for nlm_inspect_file(), but nothing pins the saved next pointer. A concurrent nlm_release_file() can kfree the next file during the unlock window, and the iterator dereferences freed memory on the next loop step. Pin both current and next before the lock-drop. Advance by swapping the pinned cursors at the end of each iteration so next is always held alive across the unlock. Always call nlm_file_release() after dropping the iteration pin, regardless of whether the file matched the predicate. Use nlm_file_inuse(), which does a live walk of the inode lock list, rather than the cached f_locks field, so skipped files that never ran nlm_inspect_file() are evaluated correctly. Because every file in a hash bucket is now pinned and released, files skipped by the is_failover_file predicate that have no locks, blocks, shares, or external references are deleted during traversal. The old code never evaluated skipped files for cleanup. The new behavior is intentional: such files are stale and should not persist in the table. Fixes: 01df9c5e918a ("LOCKD: Fix a deadlock in nlm_traverse_files()") Cc: stable(a)vger.kernel.org Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Link: https://patch.msgid.link/20260524115527.1734251-1-michael.bommarito@gmail.c… Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Conflicts: fs/lockd/svcsubs.c [Downstream tree has no standalone nlm_close_files() helper; the teardown was inlined inside nlm_traverse_files(). Add nlm_file_release() (as upstream does) and rewrite the traversal loop to the new pinned-cursor form.] Co-authored-by: BackportAgent@deepseek-v4-flash Signed-off-by: Hulk Robot <hulkrobot(a)huawei.com> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- fs/lockd/svcsubs.c | 52 +++++++++++++++++++++++++++++----------------- 1 file changed, 33 insertions(+), 19 deletions(-) diff --git a/fs/lockd/svcsubs.c b/fs/lockd/svcsubs.c index 899360ba3b84..4c2f70a3fc86 100644 --- a/fs/lockd/svcsubs.c +++ b/fs/lockd/svcsubs.c @@ -245,6 +245,11 @@ nlm_file_inuse(struct nlm_file *file) return 0; } +static void nlm_file_release(struct nlm_file *file) +{ + if (!nlm_file_inuse(file)) + nlm_delete_file(file); +} /* * Loop over all files in the file table. */ @@ -252,32 +257,41 @@ static int nlm_traverse_files(void *data, nlm_host_match_fn_t match, int (*is_failover_file)(void *data, struct nlm_file *file)) { - struct hlist_node *next; - struct nlm_file *file; + struct nlm_file *file, *next; int i, ret = 0; mutex_lock(&nlm_file_mutex); for (i = 0; i < FILE_NRHASH; i++) { - hlist_for_each_entry_safe(file, next, &nlm_files[i], f_list) { - if (is_failover_file && !is_failover_file(data, file)) - continue; + file = hlist_entry_safe(nlm_files[i].first, + struct nlm_file, f_list); + if (file) file->f_count++; - mutex_unlock(&nlm_file_mutex); - - /* Traverse locks, blocks and shares of this file - * and update file->f_locks count */ - if (nlm_inspect_file(data, file, match)) - ret = 1; + while (file) { + /* + * Pin the next neighbour before we drop the mutex + * for nlm_inspect_file(); a concurrent + * nlm_release_file() under the same mutex would + * otherwise be free to unlink and kfree it during + * the unlock window, leaving us to dereference a + * freed slab when we walked to next afterwards. + */ + next = hlist_entry_safe(file->f_list.next, + struct nlm_file, f_list); + if (next) + next->f_count++; + + if (!is_failover_file || is_failover_file(data, file)) { + mutex_unlock(&nlm_file_mutex); + + if (nlm_inspect_file(data, file, match)) + ret = 1; + + mutex_lock(&nlm_file_mutex); + } - mutex_lock(&nlm_file_mutex); file->f_count--; - /* No more references to this file. Let go of it. */ - if (list_empty(&file->f_blocks) && !file->f_locks - && !file->f_shares && !file->f_count) { - hlist_del(&file->f_list); - nlmsvc_ops->fclose(file->f_file); - kfree(file); - } + nlm_file_release(file); + file = next; } } mutex_unlock(&nlm_file_mutex); -- 2.34.1

2 1

[PATCH OLK-6.6] scsi: qla2xxx: Zero SFP DMA buffer in FRU/I2C bsg handlers
by Pan Taixi 23 Sep '26

23 Sep '26

From: Nilesh Javali <njavali(a)marvell.com> stable inclusion from stable-v6.6.157 commit 84bde5ce4038d9ad811e5c994305bbfcbd7a9f79 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19080 CVE: CVE-2026-89865 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit b47d4a1547d9ef21b2e9d1a739fe2204d4be05dc upstream. The FRU and I2C bsg handlers stage their transfer in a DMA_POOL_SIZE (256-byte) bounce buffer obtained from dma_pool_alloc(), which does not zero the allocation. They initialize only a few leading bytes before handing the buffer to qla2x00_write_sfp(). qla2x00_write_sfp() can override the transfer length with a user-supplied value: if (len == 1) opt |= BIT_0; if (opt & BIT_0) len = *sfp; *sfp is the first byte of the (user-controlled) payload, so len can grow up to 255. The device then DMA-reads len bytes from the 256-byte pool buffer. Since only a small prefix was written (e.g. MAX_FRU_SIZE == 36 bytes for a FRU version, one byte for a FRU status register), the hardware reads past the initialized region and writes up to ~219 bytes of stale DMA-pool heap memory to the device flash. Allocate the buffer with dma_pool_zalloc() in all five FRU/I2C handlers so any bytes beyond the initialized data are zero rather than stale heap contents. Fixes: 697a4bc69159 ("[SCSI] qla2xxx: Provide method for updating I2C attached VPD.") Fixes: 9ebb5d9c69f1 ("[SCSI] qla2xxx: Add I2C BSG interface.") Cc: stable(a)vger.kernel.org Reported-by: Sashiko <sashiko-dev(a)google.com> Signed-off-by: Nilesh Javali <njavali(a)marvell.com> Link: https://patch.msgid.link/20260730155838.2119230-32-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) <mkp(a)kernel.org> Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com> --- drivers/scsi/qla2xxx/qla_bsg.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/scsi/qla2xxx/qla_bsg.c b/drivers/scsi/qla2xxx/qla_bsg.c index 9319b81ea0b8..a55af07b3e83 100644 --- a/drivers/scsi/qla2xxx/qla_bsg.c +++ b/drivers/scsi/qla2xxx/qla_bsg.c @@ -1563,11 +1563,11 @@ qla2x00_update_fru_versions(struct bsg_job *bsg_job) uint8_t bsg[DMA_POOL_SIZE]; struct qla_image_version_list *list = (void *)bsg; struct qla_image_version *image; uint32_t count; dma_addr_t sfp_dma; - void *sfp = dma_pool_alloc(ha->s_dma_pool, GFP_KERNEL, &sfp_dma); + void *sfp = dma_pool_zalloc(ha->s_dma_pool, GFP_KERNEL, &sfp_dma); if (!sfp) { bsg_reply->reply_data.vendor_reply.vendor_rsp[0] = EXT_STATUS_NO_MEMORY; goto done; @@ -1614,11 +1614,11 @@ qla2x00_read_fru_status(struct bsg_job *bsg_job) struct qla_hw_data *ha = vha->hw; int rval = 0; uint8_t bsg[DMA_POOL_SIZE]; struct qla_status_reg *sr = (void *)bsg; dma_addr_t sfp_dma; - uint8_t *sfp = dma_pool_alloc(ha->s_dma_pool, GFP_KERNEL, &sfp_dma); + uint8_t *sfp = dma_pool_zalloc(ha->s_dma_pool, GFP_KERNEL, &sfp_dma); if (!sfp) { bsg_reply->reply_data.vendor_reply.vendor_rsp[0] = EXT_STATUS_NO_MEMORY; goto done; @@ -1665,11 +1665,11 @@ qla2x00_write_fru_status(struct bsg_job *bsg_job) struct qla_hw_data *ha = vha->hw; int rval = 0; uint8_t bsg[DMA_POOL_SIZE]; struct qla_status_reg *sr = (void *)bsg; dma_addr_t sfp_dma; - uint8_t *sfp = dma_pool_alloc(ha->s_dma_pool, GFP_KERNEL, &sfp_dma); + uint8_t *sfp = dma_pool_zalloc(ha->s_dma_pool, GFP_KERNEL, &sfp_dma); if (!sfp) { bsg_reply->reply_data.vendor_reply.vendor_rsp[0] = EXT_STATUS_NO_MEMORY; goto done; @@ -1712,11 +1712,11 @@ qla2x00_write_i2c(struct bsg_job *bsg_job) struct qla_hw_data *ha = vha->hw; int rval = 0; uint8_t bsg[DMA_POOL_SIZE]; struct qla_i2c_access *i2c = (void *)bsg; dma_addr_t sfp_dma; - uint8_t *sfp = dma_pool_alloc(ha->s_dma_pool, GFP_KERNEL, &sfp_dma); + uint8_t *sfp = dma_pool_zalloc(ha->s_dma_pool, GFP_KERNEL, &sfp_dma); if (!sfp) { bsg_reply->reply_data.vendor_reply.vendor_rsp[0] = EXT_STATUS_NO_MEMORY; goto done; @@ -1758,11 +1758,11 @@ qla2x00_read_i2c(struct bsg_job *bsg_job) struct qla_hw_data *ha = vha->hw; int rval = 0; uint8_t bsg[DMA_POOL_SIZE]; struct qla_i2c_access *i2c = (void *)bsg; dma_addr_t sfp_dma; - uint8_t *sfp = dma_pool_alloc(ha->s_dma_pool, GFP_KERNEL, &sfp_dma); + uint8_t *sfp = dma_pool_zalloc(ha->s_dma_pool, GFP_KERNEL, &sfp_dma); if (!sfp) { bsg_reply->reply_data.vendor_reply.vendor_rsp[0] = EXT_STATUS_NO_MEMORY; goto done; -- 2.34.1

2 1

[PATCH OLK-6.6] scsi: qla2xxx: Bound i2c->length in I2C bsg handlers
by Pan Taixi 23 Sep '26

23 Sep '26

From: Nilesh Javali <njavali(a)marvell.com> stable inclusion from stable-v6.6.157 commit 9a756f277eb89f769dbf380f38245c270d31fdb5 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19079 CVE: CVE-2026-89864 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 0918ee2c0eeb4d7f45b82b3dc11e65c2d9b7ad59 upstream. struct qla_i2c_access carries a 16-bit length field alongside a fixed 64-byte buffer: struct qla_i2c_access { uint16_t device, offset, option, length; uint8_t buffer[0x40]; } __packed; qla2x00_write_i2c() and qla2x00_read_i2c() use the user-supplied i2c->length without any bounds check. i2c is overlaid on a 256-byte on-stack buffer and sfp is a 256-byte DMA-pool buffer, so a length up to 65535 overruns both: - write: memcpy(sfp, i2c->buffer, i2c->length) over-reads the stack and over-writes the sfp heap buffer, and qla2x00_write_sfp() then DMAs i2c->length bytes out of the 256-byte buffer. - read: qla2x00_read_sfp() DMAs i2c->length bytes into the 256-byte sfp, then memcpy(i2c->buffer, sfp, i2c->length) overflows the 64-byte buffer inside the on-stack array. A caller holding CAP_SYS_RAWIO can use this to corrupt the heap and the kernel stack. Reject requests whose length exceeds the buffer before any copy or DMA transfer in both handlers. Fixes: 9ebb5d9c69f1 ("[SCSI] qla2xxx: Add I2C BSG interface.") Cc: stable(a)vger.kernel.org Reported-by: Sashiko <sashiko-dev(a)google.com> Signed-off-by: Nilesh Javali <njavali(a)marvell.com> Link: https://patch.msgid.link/20260730155838.2119230-33-njavali@marvell.com Signed-off-by: Martin K. Petersen (Oracle) <mkp(a)kernel.org> Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com> --- drivers/scsi/qla2xxx/qla_bsg.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/drivers/scsi/qla2xxx/qla_bsg.c b/drivers/scsi/qla2xxx/qla_bsg.c index 9319b81ea0b8..bf83382dd637 100644 --- a/drivers/scsi/qla2xxx/qla_bsg.c +++ b/drivers/scsi/qla2xxx/qla_bsg.c @@ -1723,10 +1723,16 @@ qla2x00_write_i2c(struct bsg_job *bsg_job) } sg_copy_to_buffer(bsg_job->request_payload.sg_list, bsg_job->request_payload.sg_cnt, i2c, sizeof(*i2c)); + if (i2c->length > sizeof(i2c->buffer)) { + bsg_reply->reply_data.vendor_reply.vendor_rsp[0] = + EXT_STATUS_INVALID_PARAM; + goto dealloc; + } + memcpy(sfp, i2c->buffer, i2c->length); rval = qla2x00_write_sfp(vha, sfp_dma, sfp, i2c->device, i2c->offset, i2c->length, i2c->option); if (rval) { @@ -1769,10 +1775,16 @@ qla2x00_read_i2c(struct bsg_job *bsg_job) } sg_copy_to_buffer(bsg_job->request_payload.sg_list, bsg_job->request_payload.sg_cnt, i2c, sizeof(*i2c)); + if (i2c->length > sizeof(i2c->buffer)) { + bsg_reply->reply_data.vendor_reply.vendor_rsp[0] = + EXT_STATUS_INVALID_PARAM; + goto dealloc; + } + rval = qla2x00_read_sfp(vha, sfp_dma, sfp, i2c->device, i2c->offset, i2c->length, i2c->option); if (rval) { bsg_reply->reply_data.vendor_reply.vendor_rsp[0] = -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] Fix CVE-2026-89861
by Pan Taixi 23 Sep '26

23 Sep '26

Backport stable patches ("scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition()") and follow up fix ("scsi: qla2xxx: Drop vport reference under lock in report ID acquisition") to fix CVE-2026-89861 Nilesh Javali (2): scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() scsi: qla2xxx: Drop vport reference under lock in report ID acquisition drivers/scsi/qla2xxx/qla_mbx.c | 5 +++++ 1 file changed, 5 insertions(+) -- 2.34.1

2 3

[PATCH OLK-5.10 0/2] Fix CVE-2026-89861
by Pan Taixi 23 Sep '26

23 Sep '26

Backport stable patches ("scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition()") and follow up fix ("scsi: qla2xxx: Drop vport reference under lock in report ID acquisition") to fix CVE-2026-89861 Nilesh Javali (2): scsi: qla2xxx: Hold vport reference in qla24xx_report_id_acquisition() scsi: qla2xxx: Drop vport reference under lock in report ID acquisition drivers/scsi/qla2xxx/qla_mbx.c | 5 +++++ 1 file changed, 5 insertions(+) -- 2.34.1

2 3

[PATCH OLK-5.10 0/2] CVE-2026-89492
by Pu Lehui 23 Sep '26

23 Sep '26

Doruk Tan Ozturk (1): ocfs2: validate directory-index entry counts when reading metadata Joseph Qi (1): ocfs2: validate dx_root extent list fields during block read fs/ocfs2/dir.c | 71 ++++++++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 66 insertions(+), 5 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/2] Fix CVE-2026-90042 OLK-6.6
by Pan Taixi 23 Sep '26

23 Sep '26

Backport "ceph: properly decrypt filenames in vmalloc() buffers" to fix CVE-2026-90042. This patch depends on "ceph: pass fscrypt tname buffers directly". Pan Taixi (2): ceph: pass fscrypt tname buffers directly ceph: properly decrypt filenames in vmalloc() buffers fs/ceph/crypto.c | 49 +++++++++++++++++++++++++++++++++----------- fs/ceph/crypto.h | 4 ++-- fs/ceph/mds_client.c | 12 +++++++---- 3 files changed, 47 insertions(+), 18 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/2] CVE-2026-89492
by Pu Lehui 23 Sep '26

23 Sep '26

Doruk Tan Ozturk (1): ocfs2: validate directory-index entry counts when reading metadata Joseph Qi (1): ocfs2: validate dx_root extent list fields during block read fs/ocfs2/dir.c | 71 ++++++++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 66 insertions(+), 5 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] nvme-fabrics: fix DHCHAP secret leak on parse failure
by Chen Yuxi 23 Sep '26

23 Sep '26

From: Xu Rao <raoxu(a)uniontech.com> mainline inclusion from mainline-v7.3-rc2 commit afdee49a1b88ed9bb44e2b30e855297c169bcc53 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19103 CVE: CVE-2026-89975 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- nvmf_parse_options() duplicates dhchap_secret and dhchap_ctrl_secret with match_strdup() before validating the DHHC-1: representation. If validation fails, the parser returns -EINVAL before the temporary string in p is assigned to opts->dhchap_secret or opts->dhchap_ctrl_secret. nvmf_create_ctrl() subsequently frees opts, but nvmf_free_options() cannot release the unassigned temporary string. Each rejected option therefore leaks one allocation. This is easy to miss because valid secrets transfer ownership to opts and are freed normally, while the malformed-secret path still returns the expected -EINVAL to userspace. With CONFIG_NVME_HOST_AUTH enabled, the leak is reachable before the required-option checks and transport lookup. No NVMe-oF target or working transport connection is required; for example, repeatedly writing dhchap_secret=BAD or dhchap_ctrl_secret=BAD to /dev/nvme-fabrics deterministically takes the leaking parse path. Free the temporary string before leaving both validation error paths. Use kfree_sensitive() because the copied option may contain secret material even when its representation is rejected, matching the sensitive cleanup used for stored DHCHAP secrets. Fixes: f50fff73d620 ("nvme: implement In-Band authentication") Cc: stable(a)vger.kernel.org Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Xu Rao <raoxu(a)uniontech.com> Signed-off-by: Chen Yuxi <chenyuxi19(a)huawei.com> --- drivers/nvme/host/fabrics.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c index 5119421afd95..6f5a4670c5d8 100644 --- a/drivers/nvme/host/fabrics.c +++ b/drivers/nvme/host/fabrics.c @@ -952,6 +952,7 @@ static int nvmf_parse_options(struct nvmf_ctrl_options *opts, } if (strlen(p) < 11 || strncmp(p, "DHHC-1:", 7)) { pr_err("Invalid DH-CHAP secret %s\n", p); + kfree_sensitive(p); ret = -EINVAL; goto out; } @@ -966,6 +967,7 @@ static int nvmf_parse_options(struct nvmf_ctrl_options *opts, } if (strlen(p) < 11 || strncmp(p, "DHHC-1:", 7)) { pr_err("Invalid DH-CHAP secret %s\n", p); + kfree_sensitive(p); ret = -EINVAL; goto out; } -- 2.34.1

2 1

[PATCH OLK-5.10] nvme-tcp: reject a read that transferred too few bytes
by Chen Yuxi 23 Sep '26

23 Sep '26

From: Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> mainline inclusion from mainline-v7.3-rc1 commit 7fa3f73f6c8ddc5f0425b50fb2a626a782ef7d12 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18845 CVE: CVE-2026-89480 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- nvme_tcp_recv_data() completes a request once the current C2HData PDU has been consumed. Nothing compares the total bytes received against the length the command asked for: struct nvme_tcp_request has no receive-side counter, queue->data_remaining is per queue, and blk_mq_end_request() completes for blk_rq_bytes(rq) unconditionally with no residual concept anywhere above. A controller can therefore answer a 4096-byte read with 512 bytes and have it reported as a complete read; user space then gets 4096 bytes of which 3584 are whatever was already in the page. I reproduced that with a test target. Count the bytes received and refuse to complete a successful read whose count does not match, at the two NVME_TCP_F_DATA_SUCCESS paths and in nvme_tcp_process_nvme_cqe(). The success test shifts req->status right by one, because the driver keeps the wire value there and shifts it on completion, so the check must see what the completion path will see. Only REQ_OP_READ is checked, because there the length comes from the sectors the request covers; a passthrough command is built by its submitter, which picks both command and buffer, so the kernel has nothing to compare against. Fixes: 3f2304f8c6d6 ("nvme-tcp: add NVMe over TCP host driver") Cc: stable(a)vger.kernel.org Signed-off-by: Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Conflicts: drivers/nvme/host/tcp.c [Upstream commit 1ba2e507f55c ("nvme-tcp: Do not reset transport on data digest errors") is not backported, so this tree completes DATA_SUCCESS requests with the hard-coded NVME_SC_SUCCESS and passes cqe->status directly to nvme_try_complete_req(); give nvme_tcp_data_in_short() an explicit status argument and pass le16_to_cpu(cqe->status) or NVME_SC_SUCCESS at the call sites.] Signed-off-by: Chen Yuxi <chenyuxi19(a)huawei.com> --- drivers/nvme/host/tcp.c | 37 +++++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c index 89cef71def14..0779596f629b 100644 --- a/drivers/nvme/host/tcp.c +++ b/drivers/nvme/host/tcp.c @@ -89,6 +89,7 @@ struct nvme_tcp_request { struct bio *curr_bio; struct iov_iter iter; + u32 data_recvd; /* send state */ size_t offset; @@ -534,6 +535,29 @@ static void nvme_tcp_error_recovery(struct nvme_ctrl *ctrl) queue_work(nvme_reset_wq, &to_tcp_ctrl(ctrl)->err_work); } +/* + * NVMe has no short read: a read that completes successfully must + * have transferred everything it asked for. + */ +static bool nvme_tcp_data_in_short(struct nvme_tcp_queue *queue, + struct request *rq, u16 status) +{ + struct nvme_tcp_request *req = blk_mq_rq_to_pdu(rq); + + if (status >> 1) + return false; + if (req_op(rq) != REQ_OP_READ || !req->data_len) + return false; + if (likely(req->data_recvd == req->data_len)) + return false; + + dev_err(queue->ctrl->ctrl.device, + "queue %d tag %#x short data-in: got %u of %u\n", + nvme_tcp_queue_id(queue), rq->tag, + req->data_recvd, req->data_len); + return true; +} + static int nvme_tcp_process_nvme_cqe(struct nvme_tcp_queue *queue, struct nvme_completion *cqe) { @@ -548,6 +572,10 @@ static int nvme_tcp_process_nvme_cqe(struct nvme_tcp_queue *queue, return -EINVAL; } + if (unlikely(nvme_tcp_data_in_short(queue, rq, + le16_to_cpu(cqe->status)))) + return -EPROTO; + if (!nvme_try_complete_req(rq, cqe->status, cqe->result)) nvme_complete_rq(rq); queue->nr_cqe++; @@ -815,6 +843,7 @@ static int nvme_tcp_recv_data(struct nvme_tcp_queue *queue, struct sk_buff *skb, *len -= recv_len; *offset += recv_len; queue->data_remaining -= recv_len; + req->data_recvd += recv_len; } if (!queue->data_remaining) { @@ -823,6 +852,9 @@ static int nvme_tcp_recv_data(struct nvme_tcp_queue *queue, struct sk_buff *skb, queue->ddgst_remaining = NVME_TCP_DIGEST_LENGTH; } else { if (pdu->hdr.flags & NVME_TCP_F_DATA_SUCCESS) { + if (unlikely(nvme_tcp_data_in_short(queue, rq, + NVME_SC_SUCCESS))) + return -EPROTO; nvme_tcp_end_request(rq, NVME_SC_SUCCESS); queue->nr_cqe++; } @@ -864,6 +896,10 @@ static int nvme_tcp_recv_ddgst(struct nvme_tcp_queue *queue, struct request *rq = nvme_cid_to_rq(nvme_tcp_tagset(queue), pdu->command_id); + if (unlikely(nvme_tcp_data_in_short(queue, rq, + NVME_SC_SUCCESS))) + return -EPROTO; + nvme_tcp_end_request(rq, NVME_SC_SUCCESS); queue->nr_cqe++; } @@ -2394,6 +2430,7 @@ static blk_status_t nvme_tcp_setup_cmd_pdu(struct nvme_ns *ns, req->state = NVME_TCP_SEND_CMD_PDU; req->offset = 0; req->data_sent = 0; + req->data_recvd = 0; req->pdu_len = 0; req->pdu_sent = 0; req->data_len = blk_rq_nr_phys_segments(rq) ? -- 2.34.1

2 1

[PATCH OLK-5.10 v5] bpf: Disable preemption in __bpf_get_stack
by Pu Lehui 23 Sep '26

23 Sep '26

From: Daniel Borkmann <borkmann(a)iogearbox.net> mainline inclusion from mainline-v7.3-rc1 commit b1a47b2708d4e95dbd23aee2ec83752190897b3f category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18901 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- get_perf_callchain() returns a per-CPU perf_callchain_entry buffer and releases its recursion slot via put_callchain_entry() before returning, so nothing keeps the entry reserved while __bpf_get_stack() consumes it below. A preemptible BPF program (e.g. a non-sleepable raw tracepoint program on a PREEMPT kernel, which runs under migrate_disable() but not preempt_disable()) can be scheduled out between obtaining the entry and the copy. Another task scheduled on the same CPU then reuses the same per-CPU buffer and overwrites trace->nr with a larger value. copy_len is then computed from the inflated trace->nr and can exceed the caller's buffer, causing an out-of-bounds write in the memcpy() and in the build_id path. The rcu_read_lock() taken here alone does not prevent this. It is only taken on the may_fault path, and under CONFIG_PREEMPT_RCU it does not disable preemption; it merely keeps perf's callchain buffer array alive (freed via call_rcu()) and does nothing to stop another task from reusing the entry. Disable preemption around obtaining the callchain entry and copying it into the caller's buffer, so the entry cannot be reused underneath us and trace->nr stays bounded by max_depth. Build ID resolution may fault and is therefore deferred until after preemption is re-enabled; by then the instruction pointers have already been copied into buf, so it operates only on that private copy. Note, preempt_disable() also subsumes the buffer-lifetime guarantee the rcu_read_lock() provided, since a preempt-disabled section is an RCU read-side critical section for the callchain buffers' call_rcu() reclaim. Fixes: c195651e565a ("bpf: add bpf_get_stack helper") Reported-by: Tao Chen <chen.dylane(a)linux.dev> Reported-by: STAR Labs SG <info(a)starlabs.sg> Signed-off-by: Daniel Borkmann <borkmann(a)iogearbox.net> Signed-off-by: Jiri Olsa <jolsa(a)kernel.org> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/bpf/20260803210149.296496-11-jolsa@kernel.org Closes: https://lore.kernel.org/bpf/20260206090653.1336687-1-chen.dylane@linux.dev/ [ changed Fixes: commit ] Conflicts: kernel/bpf/stackmap.c [not refactor to callchain_store and callchain_finalize] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/stackmap.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c index 623d50bda9c1..86ab80a2fb23 100644 --- a/kernel/bpf/stackmap.c +++ b/kernel/bpf/stackmap.c @@ -716,6 +716,7 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task, max_depth = stack_map_calculate_max_depth(size, elem_size, flags); + preempt_disable(); if (trace_in) { trace = trace_in; trace->nr = min_t(u32, trace->nr, max_depth); @@ -725,11 +726,15 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task, trace = get_perf_callchain(regs, 0, kernel, user, max_depth, crosstask, false); } - if (unlikely(!trace)) + if (unlikely(!trace)) { + preempt_enable(); goto err_fault; + } - if (trace->nr < skip) + if (trace->nr < skip) { + preempt_enable(); goto err_fault; + } trace_nr = trace->nr - skip; copy_len = trace_nr * elem_size; @@ -741,11 +746,15 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task, for (i = 0; i < trace_nr; i++) id_offs[i].ip = ips[i]; - stack_map_get_build_id_offset(buf, trace_nr, user); } else { memcpy(buf, ips, copy_len); } + preempt_enable(); + + if (user && user_build_id) + stack_map_get_build_id_offset(buf, trace_nr, user); + if (size > copy_len) memset(buf + copy_len, 0, size - copy_len); return copy_len; -- 2.34.1

2 1

[PATCH OLK-6.6 v5] bpf: Disable preemption in __bpf_get_stack
by Pu Lehui 23 Sep '26

23 Sep '26

From: Daniel Borkmann <borkmann(a)iogearbox.net> mainline inclusion from mainline-v7.3-rc1 commit b1a47b2708d4e95dbd23aee2ec83752190897b3f category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18901 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- get_perf_callchain() returns a per-CPU perf_callchain_entry buffer and releases its recursion slot via put_callchain_entry() before returning, so nothing keeps the entry reserved while __bpf_get_stack() consumes it below. A preemptible BPF program (e.g. a non-sleepable raw tracepoint program on a PREEMPT kernel, which runs under migrate_disable() but not preempt_disable()) can be scheduled out between obtaining the entry and the copy. Another task scheduled on the same CPU then reuses the same per-CPU buffer and overwrites trace->nr with a larger value. copy_len is then computed from the inflated trace->nr and can exceed the caller's buffer, causing an out-of-bounds write in the memcpy() and in the build_id path. The rcu_read_lock() taken here alone does not prevent this. It is only taken on the may_fault path, and under CONFIG_PREEMPT_RCU it does not disable preemption; it merely keeps perf's callchain buffer array alive (freed via call_rcu()) and does nothing to stop another task from reusing the entry. Disable preemption around obtaining the callchain entry and copying it into the caller's buffer, so the entry cannot be reused underneath us and trace->nr stays bounded by max_depth. Build ID resolution may fault and is therefore deferred until after preemption is re-enabled; by then the instruction pointers have already been copied into buf, so it operates only on that private copy. Note, preempt_disable() also subsumes the buffer-lifetime guarantee the rcu_read_lock() provided, since a preempt-disabled section is an RCU read-side critical section for the callchain buffers' call_rcu() reclaim. Fixes: c195651e565a ("bpf: add bpf_get_stack helper") Reported-by: Tao Chen <chen.dylane(a)linux.dev> Reported-by: STAR Labs SG <info(a)starlabs.sg> Signed-off-by: Daniel Borkmann <borkmann(a)iogearbox.net> Signed-off-by: Jiri Olsa <jolsa(a)kernel.org> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/bpf/20260803210149.296496-11-jolsa@kernel.org Closes: https://lore.kernel.org/bpf/20260206090653.1336687-1-chen.dylane@linux.dev/ [ changed Fixes: commit ] Conflicts: kernel/bpf/stackmap.c [not refactor to callchain_store and callchain_finalize] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- kernel/bpf/stackmap.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c index 12bb2f66f03a..d2ec9758b4d5 100644 --- a/kernel/bpf/stackmap.c +++ b/kernel/bpf/stackmap.c @@ -516,6 +516,7 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task, max_depth = stack_map_calculate_max_depth(size, elem_size, flags); + preempt_disable(); if (trace_in) { trace = trace_in; trace->nr = min_t(u32, trace->nr, max_depth); @@ -525,11 +526,15 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task, trace = get_perf_callchain(regs, 0, kernel, user, max_depth, crosstask, false); } - if (unlikely(!trace)) + if (unlikely(!trace)) { + preempt_enable(); goto err_fault; + } - if (trace->nr < skip) + if (trace->nr < skip) { + preempt_enable(); goto err_fault; + } trace_nr = trace->nr - skip; copy_len = trace_nr * elem_size; @@ -541,11 +546,15 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task, for (i = 0; i < trace_nr; i++) id_offs[i].ip = ips[i]; - stack_map_get_build_id_offset(buf, trace_nr, user); } else { memcpy(buf, ips, copy_len); } + preempt_enable(); + + if (user && user_build_id) + stack_map_get_build_id_offset(buf, trace_nr, user); + if (size > copy_len) memset(buf + copy_len, 0, size - copy_len); return copy_len; -- 2.34.1

2 1

[PATCH OLK-5.10] ring-buffer: Acquire the lock with irqsave in rb_wake_up_waiters()
by Tengda Wu 23 Sep '26

23 Sep '26

From: Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> mainline inclusion from mainline-v7.3-rc3 commit 815e07c8fe885a87751c2496a30ae0dcd4118210 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9956 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- rb_wake_up_waiters() is a irq_work callback which is initialized with init_irq_work(). As such it will be invoked in thread context on PREEMPT_RT. Invoking the callback in IRQ context on PREEMPT_RT is not an option due its usage of wake_up_all(). Since this callback may run in thread context, it needs to acquire ring_buffer_per_cpu::reader_lock with disabling interrupts and may not assume that they are disabled. Use raw_spinlock_irqsave() to acquire ring_buffer_per_cpu::reader_lock. Cc: stable(a)vger.kernel.org Link: https://patch.msgid.link/20260911102152.YEtwkBj9@linutronix.de Fixes: 68282dd930ea3 ("ring-buffer: Fix resetting of shortest_full") Reviewed-by: Vincent Donnefort <vdonnefort(a)google.com> Signed-off-by: Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> Signed-off-by: Steven Rostedt <rostedt(a)goodmis.org> Conflicts: kernel/trace/ring_buffer.c [scope_guard is not widely used in this version, so use original raw_spin_lock_irqsave/irqrestore instead.] Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/trace/ring_buffer.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c index 9a2c8727b033..91346d3a0f96 100644 --- a/kernel/trace/ring_buffer.c +++ b/kernel/trace/ring_buffer.c @@ -828,6 +828,7 @@ static __always_inline bool full_hit(struct trace_buffer *buffer, int cpu, int f static void rb_wake_up_waiters(struct irq_work *work) { struct rb_irq_work *rbwork = container_of(work, struct rb_irq_work, work); + unsigned long flags; wake_up_all(&rbwork->waiters); if (rbwork->full_waiters_pending || rbwork->wakeup_full) { @@ -835,14 +836,13 @@ static void rb_wake_up_waiters(struct irq_work *work) struct ring_buffer_per_cpu *cpu_buffer = container_of(rbwork, struct ring_buffer_per_cpu, irq_work); - /* Called from interrupt context */ - raw_spin_lock(&cpu_buffer->reader_lock); + raw_spin_lock_irqsave(&cpu_buffer->reader_lock, flags); rbwork->wakeup_full = false; rbwork->full_waiters_pending = false; /* Waking up all waiters, they will reset the shortest full */ cpu_buffer->shortest_full = 0; - raw_spin_unlock(&cpu_buffer->reader_lock); + raw_spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags); wake_up_all(&rbwork->full_waiters); } -- 2.34.1

2 1

[PATCH OLK-6.6] lockd: fix NULL dereference on lockowner allocation failure
by Pu Lehui 23 Sep '26

23 Sep '26

From: Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> mainline inclusion from mainline-v7.3-rc1 commit 4c7fc129db061c7daab841c4f3c342d894832362 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18849 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- nlmclnt_locks_init_private() installs NLM file lock operations even when nlmclnt_find_lockowner() fails to allocate a lockowner. nlmclnt_proc() then returns -ENOMEM, but the VFS still tears down the partially initialized file_lock and calls locks_release_private(). That invokes nlmclnt_locks_release_private(), which dereferences fl->fl_u.nfs_fl.owner and crashes because the owner was never installed. Clear fl_ops before attempting to initialize the NLM private state, and install the NLM lock operations only after a lockowner has been allocated successfully. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable(a)vger.kernel.org Signed-off-by: Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Conflicts: fs/lockd/clntproc.c [ctx conflicts] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- fs/lockd/clntproc.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/lockd/clntproc.c b/fs/lockd/clntproc.c index fba6c7fa7474..bbaa8c2d8877 100644 --- a/fs/lockd/clntproc.c +++ b/fs/lockd/clntproc.c @@ -485,8 +485,11 @@ static const struct file_lock_operations nlmclnt_lock_ops = { static void nlmclnt_locks_init_private(struct file_lock *fl, struct nlm_host *host) { fl->fl_u.nfs_fl.state = 0; + fl->fl_ops = NULL; fl->fl_u.nfs_fl.owner = nlmclnt_find_lockowner(host, fl->fl_owner); INIT_LIST_HEAD(&fl->fl_u.nfs_fl.list); + if (!fl->fl_u.nfs_fl.owner) + return; fl->fl_ops = &nlmclnt_lock_ops; } -- 2.34.1

2 1

[PATCH OLK-6.6] ring-buffer: Acquire the lock with irqsave in rb_wake_up_waiters()
by Tengda Wu 23 Sep '26

23 Sep '26

From: Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> mainline inclusion from mainline-v7.3-rc3 commit 815e07c8fe885a87751c2496a30ae0dcd4118210 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/9956 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- rb_wake_up_waiters() is a irq_work callback which is initialized with init_irq_work(). As such it will be invoked in thread context on PREEMPT_RT. Invoking the callback in IRQ context on PREEMPT_RT is not an option due its usage of wake_up_all(). Since this callback may run in thread context, it needs to acquire ring_buffer_per_cpu::reader_lock with disabling interrupts and may not assume that they are disabled. Use raw_spinlock_irqsave() to acquire ring_buffer_per_cpu::reader_lock. Cc: stable(a)vger.kernel.org Link: https://patch.msgid.link/20260911102152.YEtwkBj9@linutronix.de Fixes: 68282dd930ea3 ("ring-buffer: Fix resetting of shortest_full") Reviewed-by: Vincent Donnefort <vdonnefort(a)google.com> Signed-off-by: Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> Signed-off-by: Steven Rostedt <rostedt(a)goodmis.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/trace/ring_buffer.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c index 47908a826373..c1800fb607ae 100644 --- a/kernel/trace/ring_buffer.c +++ b/kernel/trace/ring_buffer.c @@ -918,14 +918,13 @@ static void rb_wake_up_waiters(struct irq_work *work) struct ring_buffer_per_cpu *cpu_buffer = container_of(rbwork, struct ring_buffer_per_cpu, irq_work); - /* Called from interrupt context */ - raw_spin_lock(&cpu_buffer->reader_lock); - rbwork->wakeup_full = false; - rbwork->full_waiters_pending = false; + scoped_guard(raw_spinlock_irqsave, &cpu_buffer->reader_lock) { + rbwork->wakeup_full = false; + rbwork->full_waiters_pending = false; - /* Waking up all waiters, they will reset the shortest full */ - cpu_buffer->shortest_full = 0; - raw_spin_unlock(&cpu_buffer->reader_lock); + /* Waking up all waiters, they will reset the shortest full */ + cpu_buffer->shortest_full = 0; + } wake_up_all(&rbwork->full_waiters); } -- 2.34.1

2 1

[PATCH OLK-6.6] lockd: fix NULL dereference on lockowner allocation failure
by Pu Lehui 23 Sep '26

23 Sep '26

From: Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> mainline inclusion from mainline-v7.3-rc1 commit 4c7fc129db061c7daab841c4f3c342d894832362 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18849 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- nlmclnt_locks_init_private() installs NLM file lock operations even when nlmclnt_find_lockowner() fails to allocate a lockowner. nlmclnt_proc() then returns -ENOMEM, but the VFS still tears down the partially initialized file_lock and calls locks_release_private(). That invokes nlmclnt_locks_release_private(), which dereferences fl->fl_u.nfs_fl.owner and crashes because the owner was never installed. Clear fl_ops before attempting to initialize the NLM private state, and install the NLM lock operations only after a lockowner has been allocated successfully. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable(a)vger.kernel.org Signed-off-by: Shuangpeng Bai <shuangpeng.kernel(a)gmail.com> Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Conflicts: fs/lockd/clntproc.c [ctx conflicts] Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- fs/lockd/clntproc.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/lockd/clntproc.c b/fs/lockd/clntproc.c index fba6c7fa7474..bbaa8c2d8877 100644 --- a/fs/lockd/clntproc.c +++ b/fs/lockd/clntproc.c @@ -485,8 +485,11 @@ static const struct file_lock_operations nlmclnt_lock_ops = { static void nlmclnt_locks_init_private(struct file_lock *fl, struct nlm_host *host) { fl->fl_u.nfs_fl.state = 0; + fl->fl_ops = NULL; fl->fl_u.nfs_fl.owner = nlmclnt_find_lockowner(host, fl->fl_owner); INIT_LIST_HEAD(&fl->fl_u.nfs_fl.list); + if (!fl->fl_u.nfs_fl.owner) + return; fl->fl_ops = &nlmclnt_lock_ops; } -- 2.34.1

2 1

[PATCH OLK-5.10] ceph: cap delegated inode count in ceph_parse_deleg_inos()
by Pan Taixi 23 Sep '26

23 Sep '26

From: Michael Bommarito <michael.bommarito(a)gmail.com> mainline inclusion from mainline-v7.3-rc1 commit 4bd3158bd62466d57ed72a3f7bc5f205fedd6919 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18927 CVE: CVE-2026-89648 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- ceph_parse_deleg_inos() decodes interval sets of delegated inode numbers from an MDS create-with-delegation reply. For each set it reads a 64-bit start and a 64-bit len with ceph_decode_64_safe(), which only validates that the eight bytes are present in the message, not the value, and then loops over len while inserting entries into s_delegated_inos. len is fully attacker controlled. A malicious or compromised MDS can send one huge interval, many intervals in one reply, duplicate intervals, or repeated replies that accumulate delegated inodes on the same session. The original code bounded none of these and could spin the insert loop or grow the xarray without limit. Bound both dimensions with a single enforcement point. Track the number of delegated inodes held by each MDS session in an atomic counter and grow it only in ceph_insert_deleg_ino(), which uses atomic_add_unless() to refuse to push the count past CEPH_MAX_DELEG_INOS. Because that helper is the only place the counter grows, the per-session population can never exceed the cap, so no separate per-session pre-check is needed. The counter is decremented when async create consumes a delegated inode or when an insert fails, incremented when a delegated inode is restored, initialized with the session xarray, and reset when reconnect destroys the xarray. A per-session cap alone still lets one reply spin the insert loop on duplicate ranges without growing the counter, so also cap the aggregate interval length accepted from a single reply. Together these bound both the loop trip count per reply and the xarray population across replies. The cap is a fixed, client-chosen constant rather than a value derived from the MDS. mds_client_prealloc_inos is a userspace MDS configuration option; it is never sent to the kernel client on the wire, and a server-supplied bound could not be trusted for a defensive limit in any case. The constant is set well above that option's documented default of 1000 (a generous multiple), so legitimate refill behavior is unaffected while the CPU and xarray memory a malformed delegation stream can consume stays bounded. Impact: a malicious or compromised Ceph MDS can no longer make a client spin through an unbounded delegated-inode interval or grow one session's delegated-inode xarray without limit. Cc: stable(a)vger.kernel.org Fixes: d48464878708 ("ceph: decode interval_sets for delegated inos") Suggested-by: Viacheslav Dubeyko <Slava.Dubeyko(a)ibm.com> Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko(a)ibm.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Conflicts: fs/ceph/mds_client.c [backport to OLK-5.10: context adjusted for this tree: pr_warn_ratelimited_client()/doutc() from 38d46409c4639 are not used here, so the new warnings use plain pr_warn_ratelimited() and the struct ceph_client *cl local is not added. The redundant 'ino' local (2ecd0edd13a8b not applied here) is dropped together with its only user, the open-coded xa_insert() in ceph_parse_deleg_inos(). CEPH_MAX_DELEG_INOS is inserted right after CEPH_INO_SYSTEM_BASE. s_num_deleg_inos is reset next to the existing xa_destroy() in send_mds_reconnect(), which still runs before mutex_lock(&session->s_mutex) in this tree (39fe30315893 not applied); this matches the linux-6.18.y stable backport c040e139f1a62.] Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com> --- fs/ceph/mds_client.c | 58 ++++++++++++++++++++++++++++++++++++++------ fs/ceph/mds_client.h | 1 + fs/ceph/super.h | 9 +++++++ 3 files changed, 61 insertions(+), 7 deletions(-) diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c index aea1b42b9b18..ef39852280c8 100644 --- a/fs/ceph/mds_client.c +++ b/fs/ceph/mds_client.c @@ -419,39 +419,80 @@ static int parse_reply_info_filelock(void **p, void *end, #if BITS_PER_LONG == 64 #define DELEGATED_INO_AVAILABLE xa_mk_value(1) +static int ceph_insert_deleg_ino(struct ceph_mds_session *s, u64 ino) +{ + int err; + + /* + * Cap how many delegated inodes a single session may hold. This is + * the only place that grows the count, so atomic_add_unless() bounds + * it at exactly CEPH_MAX_DELEG_INOS; s_num_deleg_inos can never exceed + * that. + */ + if (!atomic_add_unless(&s->s_num_deleg_inos, 1, CEPH_MAX_DELEG_INOS)) { + pr_warn_ratelimited("MDS session already holds %d delegated inodes\n", + CEPH_MAX_DELEG_INOS); + return -EOVERFLOW; + } + + err = xa_insert(&s->s_delegated_inos, ino, DELEGATED_INO_AVAILABLE, + GFP_KERNEL); + if (err) + atomic_dec(&s->s_num_deleg_inos); + return err; +} + static int ceph_parse_deleg_inos(void **p, void *end, struct ceph_mds_session *s) { + u64 msg_deleg_inos = 0; u32 sets; ceph_decode_32_safe(p, end, sets, bad); dout("got %u sets of delegated inodes\n", sets); while (sets--) { - u64 start, len, ino; + u64 start, len; ceph_decode_64_safe(p, end, start, bad); ceph_decode_64_safe(p, end, len, bad); /* Don't accept a delegation of system inodes */ if (start < CEPH_INO_SYSTEM_BASE) { pr_warn_ratelimited("ceph: ignoring reserved inode range delegation (start=0x%llx len=0x%llx)\n", start, len); continue; } + + /* + * Bound the number of inodes one reply may delegate. + * ceph_insert_deleg_ino() separately caps the per-session + * population, so this only has to stop one reply from spinning + * the insert loop under an attacker-controlled len. + */ + if (len > (u64)CEPH_MAX_DELEG_INOS || + msg_deleg_inos > (u64)CEPH_MAX_DELEG_INOS - len) { + pr_warn_ratelimited("MDS reply delegates too many inodes (have %llu, +%llu, max %d)\n", + msg_deleg_inos, len, CEPH_MAX_DELEG_INOS); + return -EIO; + } + msg_deleg_inos += len; + while (len--) { - int err = xa_insert(&s->s_delegated_inos, ino = start++, - DELEGATED_INO_AVAILABLE, - GFP_KERNEL); + int err = ceph_insert_deleg_ino(s, start++); + if (!err) { dout("added delegated inode 0x%llx\n", start - 1); } else if (err == -EBUSY) { pr_warn("ceph: MDS delegated inode 0x%llx more than once.\n", start - 1); + } else if (err == -EOVERFLOW) { + /* ceph_insert_deleg_ino() already warned. */ + return -EIO; } else { return err; } } } @@ -465,20 +506,21 @@ u64 ceph_get_deleg_ino(struct ceph_mds_session *s) unsigned long ino; void *val; xa_for_each(&s->s_delegated_inos, ino, val) { val = xa_erase(&s->s_delegated_inos, ino); - if (val == DELEGATED_INO_AVAILABLE) + if (val == DELEGATED_INO_AVAILABLE) { + atomic_dec(&s->s_num_deleg_inos); return ino; + } } return 0; } int ceph_restore_deleg_ino(struct ceph_mds_session *s, u64 ino) { - return xa_insert(&s->s_delegated_inos, ino, DELEGATED_INO_AVAILABLE, - GFP_KERNEL); + return ceph_insert_deleg_ino(s, ino); } #else /* BITS_PER_LONG == 64 */ /* * FIXME: xarrays can't handle 64-bit indexes on a 32-bit arch. For now, just * ignore delegated_inos on 32 bit arch. Maybe eventually add xarrays for top @@ -760,10 +802,11 @@ static struct ceph_mds_session *register_session(struct ceph_mds_client *mdsc, s->s_nr_caps = 0; refcount_set(&s->s_ref, 1); INIT_LIST_HEAD(&s->s_waiting); INIT_LIST_HEAD(&s->s_unsafe); xa_init(&s->s_delegated_inos); + atomic_set(&s->s_num_deleg_inos, 0); s->s_num_cap_releases = 0; s->s_cap_reconnect = 0; s->s_cap_iterator = NULL; INIT_LIST_HEAD(&s->s_cap_releases); INIT_WORK(&s->s_cap_release_work, ceph_cap_release_work); @@ -3908,10 +3951,11 @@ static void send_mds_reconnect(struct ceph_mds_client *mdsc, reply = ceph_msg_new2(CEPH_MSG_CLIENT_RECONNECT, 0, 1, GFP_NOFS, false); if (!reply) goto fail_nomsg; xa_destroy(&session->s_delegated_inos); + atomic_set(&session->s_num_deleg_inos, 0); mutex_lock(&session->s_mutex); session->s_state = CEPH_MDS_SESSION_RECONNECTING; session->s_seq = 0; diff --git a/fs/ceph/mds_client.h b/fs/ceph/mds_client.h index b1939f916228..847f04424be3 100644 --- a/fs/ceph/mds_client.h +++ b/fs/ceph/mds_client.h @@ -208,10 +208,11 @@ struct ceph_mds_session { u64 s_renew_seq; struct list_head s_waiting; /* waiting requests */ struct list_head s_unsafe; /* unsafe requests */ struct xarray s_delegated_inos; + atomic_t s_num_deleg_inos; }; /* * modes of choosing which MDS to send a request to */ diff --git a/fs/ceph/super.h b/fs/ceph/super.h index c0c5ed3e2718..6b2e0cfb9ae3 100644 --- a/fs/ceph/super.h +++ b/fs/ceph/super.h @@ -538,10 +538,19 @@ static inline int ceph_ino_compare(struct inode *inode, void *data) #define CEPH_MAX_MDS 0x100 #define CEPH_NUM_STRAY 10 #define CEPH_MDS_INO_MDSDIR_OFFSET (1 * CEPH_MAX_MDS) #define CEPH_INO_SYSTEM_BASE ((6*CEPH_MAX_MDS) + (CEPH_MAX_MDS * CEPH_NUM_STRAY)) +/* + * Upper bound on the number of delegated inodes a single MDS session may + * hold. The MDS normally hands out a small preallocation window (the + * userspace mds_client_prealloc_inos option defaults to 1000) and refills + * it as the client consumes entries. This leaves generous headroom while + * bounding the CPU and memory a malformed delegation interval can consume. + */ +#define CEPH_MAX_DELEG_INOS 8192 + static inline bool ceph_vino_is_reserved(const struct ceph_vino vino) { if (vino.ino < CEPH_INO_SYSTEM_BASE && vino.ino >= CEPH_MDS_INO_MDSDIR_OFFSET) { WARN_RATELIMIT(1, "Attempt to access reserved inode number 0x%llx", vino.ino); -- 2.34.1

2 1

[PATCH OLK-5.10] nvme-tcp: fix host memory disclosure on R2T for a read command
by Chen Yuxi 23 Sep '26

23 Sep '26

From: Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> mainline inclusion from mainline-v7.3-rc1 commit 6efbc52237facda35d2d874fe1765bb4839275d8 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18846 CVE: CVE-2026-89481 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- nvme_tcp_handle_r2t() does not check the direction of the request the R2T refers to. A malicious controller can send an R2T for a READ and the host will answer it: nvme_tcp_setup_h2c_data_pdu() builds the H2CData header and nvme_tcp_try_send_data() sends the request's data buffer. That buffer is the READ destination, so its contents go to the controller. The command then completes normally and nothing is logged. Against a test controller that answers every READ with an R2T, a 4096 byte buffered read returned all 4096 bytes, split over two R2Ts. The pages contained stale kernel data, including an array of struct page pointers. Reject an R2T for a request that is not a write. Fixes: 3f2304f8c6d6 ("nvme-tcp: add NVMe over TCP host driver") Cc: stable(a)vger.kernel.org Signed-off-by: Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Conflicts: drivers/nvme/host/tcp.c [Upstream commit 1d3ef9c3a39e ("nvme-tcp: validate R2T PDU in nvme_tcp_handle_r2t()") is not backported, so there is no standalone r2t_length check after req = blk_mq_rq_to_pdu(rq); insert the rq_data_dir() check right after it, before nvme_tcp_setup_h2c_data_pdu().] Signed-off-by: Chen Yuxi <chenyuxi19(a)huawei.com> --- drivers/nvme/host/tcp.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c index 89cef71def14..586f47e47b11 100644 --- a/drivers/nvme/host/tcp.c +++ b/drivers/nvme/host/tcp.c @@ -680,6 +680,13 @@ static int nvme_tcp_handle_r2t(struct nvme_tcp_queue *queue, } req = blk_mq_rq_to_pdu(rq); + if (unlikely(rq_data_dir(rq) != WRITE)) { + dev_err(queue->ctrl->ctrl.device, + "req %d unexpected r2t for a non-write command\n", + rq->tag); + return -EPROTO; + } + ret = nvme_tcp_setup_h2c_data_pdu(req, pdu); if (unlikely(ret)) return ret; -- 2.34.1

2 1

[PATCH OLK-5.10] lockd: pin next file across nlm_inspect_file lock-drop
by Pu Lehui 23 Sep '26

23 Sep '26

From: Michael Bommarito <michael.bommarito(a)gmail.com> stable inclusion from stable-v5.10.270 commit e3c413f789eaf0170275c7eba523ead73d963f30 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18850 CVE: CVE-2026-89485 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 526c49cff3f72c3ec74752016380c7567040581b upstream. nlm_traverse_files() pins the current file with f_count++ across a mutex_unlock for nlm_inspect_file(), but nothing pins the saved next pointer. A concurrent nlm_release_file() can kfree the next file during the unlock window, and the iterator dereferences freed memory on the next loop step. Pin both current and next before the lock-drop. Advance by swapping the pinned cursors at the end of each iteration so next is always held alive across the unlock. Always call nlm_file_release() after dropping the iteration pin, regardless of whether the file matched the predicate. Use nlm_file_inuse(), which does a live walk of the inode lock list, rather than the cached f_locks field, so skipped files that never ran nlm_inspect_file() are evaluated correctly. Because every file in a hash bucket is now pinned and released, files skipped by the is_failover_file predicate that have no locks, blocks, shares, or external references are deleted during traversal. The old code never evaluated skipped files for cleanup. The new behavior is intentional: such files are stale and should not persist in the table. Fixes: 01df9c5e918a ("LOCKD: Fix a deadlock in nlm_traverse_files()") Cc: stable(a)vger.kernel.org Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Link: https://patch.msgid.link/20260524115527.1734251-1-michael.bommarito@gmail.c… Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- fs/lockd/svcsubs.c | 55 ++++++++++++++++++++++++++-------------------- 1 file changed, 31 insertions(+), 24 deletions(-) diff --git a/fs/lockd/svcsubs.c b/fs/lockd/svcsubs.c index e64e0110f66b..9e2a67bfd070 100644 --- a/fs/lockd/svcsubs.c +++ b/fs/lockd/svcsubs.c @@ -286,12 +286,10 @@ nlm_file_inuse(struct nlm_file *file) return 0; } -static void nlm_close_files(struct nlm_file *file) +static void nlm_file_release(struct nlm_file *file) { - if (file->f_file[O_RDONLY]) - nlmsvc_ops->fclose(file->f_file[O_RDONLY]); - if (file->f_file[O_WRONLY]) - nlmsvc_ops->fclose(file->f_file[O_WRONLY]); + if (!nlm_file_inuse(file)) + nlm_delete_file(file); } /* @@ -301,32 +299,41 @@ static int nlm_traverse_files(void *data, nlm_host_match_fn_t match, int (*is_failover_file)(void *data, struct nlm_file *file)) { - struct hlist_node *next; - struct nlm_file *file; + struct nlm_file *file, *next; int i, ret = 0; mutex_lock(&nlm_file_mutex); for (i = 0; i < FILE_NRHASH; i++) { - hlist_for_each_entry_safe(file, next, &nlm_files[i], f_list) { - if (is_failover_file && !is_failover_file(data, file)) - continue; + file = hlist_entry_safe(nlm_files[i].first, + struct nlm_file, f_list); + if (file) file->f_count++; - mutex_unlock(&nlm_file_mutex); - - /* Traverse locks, blocks and shares of this file - * and update file->f_locks count */ - if (nlm_inspect_file(data, file, match)) - ret = 1; + while (file) { + /* + * Pin the next neighbour before we drop the mutex + * for nlm_inspect_file(); a concurrent + * nlm_release_file() under the same mutex would + * otherwise be free to unlink and kfree it during + * the unlock window, leaving us to dereference a + * freed slab when we walked to next afterwards. + */ + next = hlist_entry_safe(file->f_list.next, + struct nlm_file, f_list); + if (next) + next->f_count++; + + if (!is_failover_file || is_failover_file(data, file)) { + mutex_unlock(&nlm_file_mutex); + + if (nlm_inspect_file(data, file, match)) + ret = 1; + + mutex_lock(&nlm_file_mutex); + } - mutex_lock(&nlm_file_mutex); file->f_count--; - /* No more references to this file. Let go of it. */ - if (list_empty(&file->f_blocks) && !file->f_locks - && !file->f_shares && !file->f_count) { - hlist_del(&file->f_list); - nlm_close_files(file); - kfree(file); - } + nlm_file_release(file); + file = next; } } mutex_unlock(&nlm_file_mutex); -- 2.34.1

2 1

[PATCH OLK-5.10] [Backport] media: cec: disable delayed work before freeing an interrupted transmit
by Chen Jinghuang 23 Sep '26

23 Sep '26

From: Biren Pandya <birenpandya(a)gmail.com> mainline inclusion from mainline-v7.2-rc1 commit 0fbd5c2327020858c45b2d1c65775d64cdeca523 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19090 CVE: CVE-2026-89899 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- cec_transmit_msg_fh() drops adap->lock to wait for a blocking transmit in wait_for_completion_killable(). If that wait is interrupted by a signal, cancel_delayed_work_sync() can run before the CEC kthread arms the reply timeout via schedule_delayed_work(&data->work) in cec_transmit_done_ts(). The work is then armed after the cancel, and the data is freed with its delayed_work still pending: ODEBUG: free active (active state 0) object: ... hint: cec_wait_timeout Use disable_delayed_work_sync(): it cancels the work and disables it, so the later schedule_delayed_work() becomes a no-op and the work cannot be re-armed. The data is freed right after, so it need not be re-enabled. Fixes: 490d84f6d73c ("media: cec: forgot to cancel delayed work") Reported-by: syzbot+051024d603432b4ab395(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=051024d603432b4ab395 Suggested-by: Hillf Danton <hdanton(a)sina.com> Cc: stable(a)vger.kernel.org Signed-off-by: Biren Pandya <birenpandya(a)gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco(a)kernel.org> Conflicts: drivers/media/cec/core/cec-adap.c [The 5.10 tree lacks the disable_delayed_work_sync() API (added in v6.9) and uses the older wait/!data->completed structure; keep the original cancel_delayed_work_sync() and, under adap->lock, cancel the reply-timeout work again before freeing, waiting for a running work without the lock (cec_wait_timeout() takes adap->lock) and re-cancelling after re-locking.] Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- drivers/media/cec/core/cec-adap.c | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) diff --git a/drivers/media/cec/core/cec-adap.c b/drivers/media/cec/core/cec-adap.c index eed962a9ff01..05329c40a58e 100644 --- a/drivers/media/cec/core/cec-adap.c +++ b/drivers/media/cec/core/cec-adap.c @@ -918,8 +918,24 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg, mutex_lock(&adap->lock); /* Cancel the transmit if it was interrupted */ - if (!data->completed) - cec_data_cancel(data, CEC_TX_STATUS_ABORTED); + if (!data->completed) { + /* + * The reply-timeout delayed work may have been armed by the + * CEC kthread after the cancel above. Cancel it under the lock; + * if it is already running it is blocked on adap->lock (as + * cec_wait_timeout() takes the lock itself), so wait for it + * without the lock like cec_receive_notify() does, then cancel + * again in case the kthread armed it in the meantime. + */ + if (!cancel_delayed_work(&data->work)) { + mutex_unlock(&adap->lock); + cancel_delayed_work_sync(&data->work); + mutex_lock(&adap->lock); + cancel_delayed_work(&data->work); + } + if (!data->completed) + cec_data_cancel(data, CEC_TX_STATUS_ABORTED); + } /* The transmit completed (possibly with an error) */ *msg = data->msg; -- 2.34.1

2 1

[PATCH OLK-6.6 0/6] CVE-2026-89799
by Pu Lehui 23 Sep '26

23 Sep '26

Andrii Nakryiko (1): bpf: decouple stack_map_get_build_id_offset() from perf_callchain_entry Jiri Olsa (5): bpf: Factor stackid_init function from __bpf_get_stackid bpf: Factor stackid_fastpath function from __bpf_get_stackid bpf: Factor stackid_new_bucket from __bpf_get_stackid bpf: Use stack id functions instead of __bpf_get_stackid bpf: Disable preemption in bpf_get_stackid kernel/bpf/stackmap.c | 214 ++++++++++++++++++++++++++++-------------- 1 file changed, 146 insertions(+), 68 deletions(-) -- 2.34.1

2 7

[PATCH OLK-5.10 0/8] CVE-2026-89799
by Pu Lehui 23 Sep '26

23 Sep '26

Andrii Nakryiko (1): bpf: decouple stack_map_get_build_id_offset() from perf_callchain_entry Arnaud Lecomte (2): bpf: Refactor stack map trace depth calculation into helper function bpf: Fix stackmap overflow check in __bpf_get_stackid() Jiri Olsa (5): bpf: Factor stackid_init function from __bpf_get_stackid bpf: Factor stackid_fastpath function from __bpf_get_stackid bpf: Factor stackid_new_bucket from __bpf_get_stackid bpf: Use stack id functions instead of __bpf_get_stackid bpf: Disable preemption in bpf_get_stackid kernel/bpf/stackmap.c | 265 +++++++++++++++++++++++++++++------------- 1 file changed, 184 insertions(+), 81 deletions(-) -- 2.34.1

2 9

[PATCH openEuler-1.0-LTS 0/2] CVE-2026-89847
by Yifan Qiao 23 Sep '26

23 Sep '26

Nilesh Javali (1): scsi: qla2xxx: Avoid double completion in async IOCB timeout Quinn Tran (1): scsi: qla2xxx: Fix fabric scan hang drivers/scsi/qla2xxx/qla_init.c | 55 +++++++++++++++++++++++++-------- drivers/scsi/qla2xxx/qla_iocb.c | 47 +++++++++++++++++++++++----- 2 files changed, 81 insertions(+), 21 deletions(-) -- 2.52.0

2 3

[PATCH OLK-6.6] nvme-tcp: check the data direction of a C2HData PDU
by Chen Yuxi 23 Sep '26

23 Sep '26

From: Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> stable inclusion from stable-v6.6.157 commit 0673a2affe45ca76b60de31a83c67b1e60f81bde category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19102 CVE: CVE-2026-89973 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------ commit f83af377c148f6ad94b41c0e8313f12adf45e1c1 upstream. nvme_tcp_handle_c2h_data() finds the request by command id and checks that it has a payload, but it does not check that the command asked for data to be read. A controller that answers a write command with C2HData therefore reaches nvme_tcp_recv_data(), where _copy_to_iter() hits WARN_ON_ONCE(i->data_source) and returns 0. The receive path turns that into -EFAULT and resets the controller. No data is copied, so this is not memory corruption. What a controller gets is a kernel warning it can raise at will, which is fatal on a host booted with panic_on_warn. The send path already knows the direction - it consults rq_data_dir() when it builds a command - and nvme_tcp_handle_r2t() checks the length and the offset of the request it names. The C2HData path does not check the direction at all. Reject a C2HData PDU whose command is not a read. Rejecting it fails the command and resets the controller, as the neighbouring check in this function does; what goes away is the warning. [ 6.885580] ------------[ cut here ]------------ [ 6.886457] WARNING: lib/iov_iter.c:193 at _copy_to_iter+0x289/0x1330, CPU#0: kworker/0:1H/71 [ 6.888137] CPU: 0 UID: 0 PID: 71 Comm: kworker/0:1H Not tainted 7.2.0-rc5-NVMETCP-gf5098b6bae76 #1 PREEMPT(lazy) [ 6.891165] Workqueue: nvme_tcp_wq nvme_tcp_io_work [ 6.891875] RIP: 0010:_copy_to_iter+0x289/0x1330 [ 6.903739] Call Trace: [ 6.904085] <TASK> [ 6.909254] __skb_datagram_iter+0x433/0x820 [ 6.911026] skb_copy_datagram_iter+0x37/0x120 [ 6.911622] nvme_tcp_recv_skb+0xa07/0x4320 [ 6.913378] __tcp_read_sock+0x1ab/0x810 [ 6.915788] nvme_tcp_try_recv+0x152/0x1e0 [ 6.918222] nvme_tcp_io_work+0x1e4/0x6c0 [ 6.926906] </TASK> [ 6.927226] ---[ end trace 0000000000000000 ]--- [ 6.927878] nvme nvme0: queue 1 failed to copy request 0x71 data [ 6.928709] nvme nvme0: receive failed: -14 Fixes: 3f2304f8c6d6 ("nvme-tcp: add NVMe over TCP host driver") Cc: stable(a)vger.kernel.org Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/nvme/host/tcp.c [Upstream commit 3a4aa9e6ad3e ("nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone") is not backported, so the payload check in nvme_tcp_handle_c2h_data() is still the plain blk_rq_payload_bytes() form; insert the rq_data_dir() check after the request lookup, before it.] Signed-off-by: Chen Yuxi <chenyuxi19(a)huawei.com> --- drivers/nvme/host/tcp.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c index 691338bf63ab..cd89be821763 100644 --- a/drivers/nvme/host/tcp.c +++ b/drivers/nvme/host/tcp.c @@ -597,6 +597,13 @@ static int nvme_tcp_handle_c2h_data(struct nvme_tcp_queue *queue, return -ENOENT; } + if (rq_data_dir(rq) != READ) { + dev_err(queue->ctrl->ctrl.device, + "queue %d tag %#x unexpected data for a write\n", + nvme_tcp_queue_id(queue), rq->tag); + return -EIO; + } + if (!blk_rq_payload_bytes(rq)) { dev_err(queue->ctrl->ctrl.device, "queue %d tag %#x unexpected data\n", -- 2.34.1

2 1

[PATCH OLK-5.10] nvme-tcp: check the data direction of a C2HData PDU
by Chen Yuxi 23 Sep '26

23 Sep '26

From: Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> stable inclusion from stable-v5.10.270 commit df74950ba6008655d4a977d17df7faf4b6e52b74 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19102 CVE: CVE-2026-89973 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f83af377c148f6ad94b41c0e8313f12adf45e1c1 upstream. nvme_tcp_handle_c2h_data() finds the request by command id and checks that it has a payload, but it does not check that the command asked for data to be read. A controller that answers a write command with C2HData therefore reaches nvme_tcp_recv_data(), where _copy_to_iter() hits WARN_ON_ONCE(i->data_source) and returns 0. The receive path turns that into -EFAULT and resets the controller. No data is copied, so this is not memory corruption. What a controller gets is a kernel warning it can raise at will, which is fatal on a host booted with panic_on_warn. The send path already knows the direction - it consults rq_data_dir() when it builds a command - and nvme_tcp_handle_r2t() checks the length and the offset of the request it names. The C2HData path does not check the direction at all. Reject a C2HData PDU whose command is not a read. Rejecting it fails the command and resets the controller, as the neighbouring check in this function does; what goes away is the warning. [ 6.885580] ------------[ cut here ]------------ [ 6.886457] WARNING: lib/iov_iter.c:193 at _copy_to_iter+0x289/0x1330, CPU#0: kworker/0:1H/71 [ 6.888137] CPU: 0 UID: 0 PID: 71 Comm: kworker/0:1H Not tainted 7.2.0-rc5-NVMETCP-gf5098b6bae76 #1 PREEMPT(lazy) [ 6.891165] Workqueue: nvme_tcp_wq nvme_tcp_io_work [ 6.891875] RIP: 0010:_copy_to_iter+0x289/0x1330 [ 6.903739] Call Trace: [ 6.904085] <TASK> [ 6.909254] __skb_datagram_iter+0x433/0x820 [ 6.911026] skb_copy_datagram_iter+0x37/0x120 [ 6.911622] nvme_tcp_recv_skb+0xa07/0x4320 [ 6.913378] __tcp_read_sock+0x1ab/0x810 [ 6.915788] nvme_tcp_try_recv+0x152/0x1e0 [ 6.918222] nvme_tcp_io_work+0x1e4/0x6c0 [ 6.926906] </TASK> [ 6.927226] ---[ end trace 0000000000000000 ]--- [ 6.927878] nvme nvme0: queue 1 failed to copy request 0x71 data [ 6.928709] nvme nvme0: receive failed: -14 Fixes: 3f2304f8c6d6 ("nvme-tcp: add NVMe over TCP host driver") Cc: stable(a)vger.kernel.org Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/nvme/host/tcp.c [Upstream commit 3a4aa9e6ad3e ("nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone") is not backported, so the payload check in nvme_tcp_handle_c2h_data() is still the plain blk_rq_payload_bytes() form; insert the rq_data_dir() check after the request lookup, before it.] Signed-off-by: Chen Yuxi <chenyuxi19(a)huawei.com> --- drivers/nvme/host/tcp.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c index 89cef71def14..c9625e12c217 100644 --- a/drivers/nvme/host/tcp.c +++ b/drivers/nvme/host/tcp.c @@ -568,6 +568,13 @@ static int nvme_tcp_handle_c2h_data(struct nvme_tcp_queue *queue, return -ENOENT; } + if (rq_data_dir(rq) != READ) { + dev_err(queue->ctrl->ctrl.device, + "queue %d tag %#x unexpected data for a write\n", + nvme_tcp_queue_id(queue), rq->tag); + return -EIO; + } + if (!blk_rq_payload_bytes(rq)) { dev_err(queue->ctrl->ctrl.device, "queue %d tag %#x unexpected data\n", -- 2.34.1

2 1

[PATCH openEuler-26.09] bpf: Fix missing BTF_KFUNCS_START/END conversion for arch kfuncs
by Tengda Wu 23 Sep '26

23 Sep '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18731 ---------------------------------------- After 1cd6437b7dde ("bpf: treewide: Annotate BPF kfuncs in BTF"), all kfuncs should be wrapped by BTF_KFUNCS_START. However, some parts of the current kernel have not been replaced, resulting in the following warning being printed during boot: [ 12.642917] WARNING: CPU: 0 PID: 1 at kernel/bpf/btf.c:8264 register_btf_kfunc_id_set+0x48/0x50 [ 12.643646] Modules linked in: [ 12.644274] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.6.0+ #3 [ 12.644668] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 4 [ 12.645182] RIP: 0010:register_btf_kfunc_id_set+0x48/0x50 [ 12.645462] Code: 44 89 c7 e9 ca fb ff ff 89 ff 44 0f be 87 80 56 22 82 44 89 c7 e9 b8 fb ff ff 48 83 3e 00 74 0a b8 0 [ 12.645959] RSP: 0018:ffffc90000013e98 EFLAGS: 00000246 [ 12.646275] RAX: ffffffff8365bc00 RBX: 0000000000000000 RCX: 0000000000000000 [ 12.646576] RDX: 0000000000000000 RSI: ffffffff8220dc60 RDI: 000000000000001a [ 12.646755] RBP: ffffffff8332d190 R08: 0000000000000009 R09: 00000000248a5858 [ 12.646940] R10: 0000000014af4066 R11: 00000000abf468e2 R12: ffff888100a16900 [ 12.647390] R13: 0000000000000216 R14: 0000000000000000 R15: 0000000000000000 [ 12.647663] FS: 0000000000000000(0000) GS:ffff888237c00000(0000) knlGS:0000000000000000 [ 12.647925] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 12.648406] CR2: ffff88823ffff000 CR3: 0000000002a30000 CR4: 00000000000006f0 [ 12.648793] Call Trace: [ 12.649150] <TASK> [ 12.649411] do_one_initcall+0x48/0x220 [ 12.650216] kernel_init_freeable+0x1a9/0x2e0 [ 12.650435] ? __pfx_kernel_init+0x10/0x10 [ 12.650660] ? __pfx_kernel_init+0x10/0x10 [ 12.650880] kernel_init+0x1a/0x1c0 [ 12.651274] ret_from_fork+0xa4/0x100 [ 12.651524] ret_from_fork_asm+0x1b/0x30 [ 12.651901] </TASK> Get rid of it by searching for and replacing all BTF_SET8_START/END with BTF_KFUNCS_START/END. Note: except for the kfuncs in net/mptcp/bpf.c and drivers/hid/bpf/hid_bpf_dispatch.c (kept consistent with the mainline). Fixes: 1cd6437b7dde ("bpf: treewide: Annotate BPF kfuncs in BTF") Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- arch/arm64/kernel/bpf-rvi.c | 4 ++-- arch/x86/kernel/cpu/bpf-rvi.c | 4 ++-- block/blk-cgroup.c | 4 ++-- fs/proc/stat.c | 4 ++-- kernel/bpf-rvi/common_kfuncs.c | 4 ++-- kernel/cgroup/cpuset.c | 4 ++-- kernel/sched/bpf_sched.c | 8 ++++---- kernel/sched/cpuacct.c | 4 ++-- net/core/filter.c | 8 ++++---- 9 files changed, 22 insertions(+), 22 deletions(-) diff --git a/arch/arm64/kernel/bpf-rvi.c b/arch/arm64/kernel/bpf-rvi.c index 1ff460b46c85..026822aab85e 100644 --- a/arch/arm64/kernel/bpf-rvi.c +++ b/arch/arm64/kernel/bpf-rvi.c @@ -45,10 +45,10 @@ __bpf_kfunc const char *bpf_arch_flags(enum arch_flags_type t, int i) } } -BTF_SET8_START(bpf_arm64_kfunc_ids) +BTF_KFUNCS_START(bpf_arm64_kfunc_ids) BTF_ID_FLAGS(func, bpf_arm64_cpu_have_feature, KF_RCU) BTF_ID_FLAGS(func, bpf_arch_flags) -BTF_SET8_END(bpf_arm64_kfunc_ids) +BTF_KFUNCS_END(bpf_arm64_kfunc_ids) static const struct btf_kfunc_id_set bpf_arm64_kfunc_set = { .owner = THIS_MODULE, diff --git a/arch/x86/kernel/cpu/bpf-rvi.c b/arch/x86/kernel/cpu/bpf-rvi.c index dc71657623ed..a5de8f4d0c86 100644 --- a/arch/x86/kernel/cpu/bpf-rvi.c +++ b/arch/x86/kernel/cpu/bpf-rvi.c @@ -142,9 +142,9 @@ __bpf_kfunc const char *bpf_arch_flags(enum arch_flags_type t, int i) } } -BTF_SET8_START(bpf_arch_flags_kfunc_ids) +BTF_KFUNCS_START(bpf_arch_flags_kfunc_ids) BTF_ID_FLAGS(func, bpf_arch_flags) -BTF_SET8_END(bpf_arch_flags_kfunc_ids) +BTF_KFUNCS_END(bpf_arch_flags_kfunc_ids) static const struct btf_kfunc_id_set bpf_arch_flags_kfunc_set = { .owner = THIS_MODULE, diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c index 0a56cfac5a5d..80630a2e6e2c 100644 --- a/block/blk-cgroup.c +++ b/block/blk-cgroup.c @@ -2349,9 +2349,9 @@ __bpf_kfunc void bpf_blkcg_get_dev_iostat(struct blkcg *blkcg, int major, int mi rcu_read_unlock(); } -BTF_SET8_START(bpf_blkcg_kfunc_ids) +BTF_KFUNCS_START(bpf_blkcg_kfunc_ids) BTF_ID_FLAGS(func, bpf_blkcg_get_dev_iostat) -BTF_SET8_END(bpf_blkcg_kfunc_ids) +BTF_KFUNCS_END(bpf_blkcg_kfunc_ids) static const struct btf_kfunc_id_set bpf_blkcg_kfunc_set = { .owner = THIS_MODULE, diff --git a/fs/proc/stat.c b/fs/proc/stat.c index 4757e5b1be38..dc21a2c9a25d 100644 --- a/fs/proc/stat.c +++ b/fs/proc/stat.c @@ -239,11 +239,11 @@ __bpf_kfunc void bpf_show_all_irqs(struct seq_file *p) show_all_irqs(p); } -BTF_SET8_START(bpf_proc_stat_kfunc_ids) +BTF_KFUNCS_START(bpf_proc_stat_kfunc_ids) BTF_ID_FLAGS(func, bpf_get_idle_time) BTF_ID_FLAGS(func, bpf_get_iowait_time) BTF_ID_FLAGS(func, bpf_show_all_irqs) -BTF_SET8_END(bpf_proc_stat_kfunc_ids) +BTF_KFUNCS_END(bpf_proc_stat_kfunc_ids) static const struct btf_kfunc_id_set bpf_proc_stat_kfunc_set = { .owner = THIS_MODULE, diff --git a/kernel/bpf-rvi/common_kfuncs.c b/kernel/bpf-rvi/common_kfuncs.c index b0f33fd0201d..d790a7b65da6 100644 --- a/kernel/bpf-rvi/common_kfuncs.c +++ b/kernel/bpf-rvi/common_kfuncs.c @@ -280,7 +280,7 @@ __bpf_kfunc void bpf_x86_direct_pages(unsigned long *p) } #endif -BTF_SET8_START(bpf_common_kfuncs_ids) +BTF_KFUNCS_START(bpf_common_kfuncs_ids) BTF_ID_FLAGS(func, bpf_mem_cgroup_from_task, KF_RET_NULL | KF_RCU) BTF_ID_FLAGS(func, bpf_task_active_pid_ns, KF_TRUSTED_ARGS) BTF_ID_FLAGS(func, bpf_pidns_nr_tasks) @@ -309,7 +309,7 @@ BTF_ID_FLAGS(func, bpf_mem_committed) BTF_ID_FLAGS(func, bpf_mem_vmalloc_used) BTF_ID_FLAGS(func, bpf_mem_vmalloc_total) BTF_ID_FLAGS(func, bpf_x86_direct_pages, KF_TRUSTED_ARGS) -BTF_SET8_END(bpf_common_kfuncs_ids) +BTF_KFUNCS_END(bpf_common_kfuncs_ids) static const struct btf_kfunc_id_set bpf_common_kfuncs_set = { .owner = THIS_MODULE, diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c index 9e1a4680860e..1dc413ac01cf 100644 --- a/kernel/cgroup/cpuset.c +++ b/kernel/cgroup/cpuset.c @@ -5248,10 +5248,10 @@ __bpf_kfunc unsigned int bpf_cpumask_weight(struct cpumask *pmask) return cpumask_weight(pmask); } -BTF_SET8_START(bpf_cpuset_kfunc_ids) +BTF_KFUNCS_START(bpf_cpuset_kfunc_ids) BTF_ID_FLAGS(func, bpf_cpuset_from_task, KF_RET_NULL | KF_RCU) BTF_ID_FLAGS(func, bpf_cpumask_weight) -BTF_SET8_END(bpf_cpuset_kfunc_ids) +BTF_KFUNCS_END(bpf_cpuset_kfunc_ids) static const struct btf_kfunc_id_set bpf_cpuset_kfunc_set = { .owner = THIS_MODULE, diff --git a/kernel/sched/bpf_sched.c b/kernel/sched/bpf_sched.c index 6849a58439b2..1039f20198aa 100644 --- a/kernel/sched/bpf_sched.c +++ b/kernel/sched/bpf_sched.c @@ -167,12 +167,12 @@ __bpf_kfunc s32 bpf_sched_cpu_stats_of(int cpuid, __diag_pop(); -BTF_SET8_START(sched_cpustats_kfunc_btf_ids) +BTF_KFUNCS_START(sched_cpustats_kfunc_btf_ids) BTF_ID_FLAGS(func, bpf_sched_cpustats_create, KF_ACQUIRE | KF_RET_NULL) BTF_ID_FLAGS(func, bpf_sched_cpustats_release, KF_RELEASE) BTF_ID_FLAGS(func, bpf_sched_cpustats_acquire, KF_ACQUIRE | KF_TRUSTED_ARGS) BTF_ID_FLAGS(func, bpf_sched_cpu_stats_of, KF_RCU) -BTF_SET8_END(sched_cpustats_kfunc_btf_ids) +BTF_KFUNCS_END(sched_cpustats_kfunc_btf_ids) static const struct btf_kfunc_id_set cpustats_kfunc_set = { .owner = THIS_MODULE, @@ -221,12 +221,12 @@ __bpf_kfunc int bpf_sched_set_task_prefer_nid(struct task_struct *task, int nid) return set_prefer_cpus_ptr(task, cpumask_of_node(nid)); } -BTF_SET8_START(sched_task_kfunc_btf_ids) +BTF_KFUNCS_START(sched_task_kfunc_btf_ids) BTF_ID_FLAGS(func, bpf_sched_entity_is_task) BTF_ID_FLAGS(func, bpf_sched_entity_to_task) BTF_ID_FLAGS(func, bpf_sched_tag_of_entity) BTF_ID_FLAGS(func, bpf_sched_set_task_prefer_nid) -BTF_SET8_END(sched_task_kfunc_btf_ids) +BTF_KFUNCS_END(sched_task_kfunc_btf_ids) static const struct btf_kfunc_id_set sched_task_kfunc_set = { .owner = THIS_MODULE, diff --git a/kernel/sched/cpuacct.c b/kernel/sched/cpuacct.c index 801f3df9734c..c479a4b9ce77 100644 --- a/kernel/sched/cpuacct.c +++ b/kernel/sched/cpuacct.c @@ -427,10 +427,10 @@ __bpf_kfunc void bpf_cpuacct_kcpustat_cpu_fetch(struct kernel_cpustat *dst, memcpy(dst, per_cpu_ptr(ca->cpustat, cpu), sizeof(struct kernel_cpustat)); } -BTF_SET8_START(bpf_cpuacct_kfunc_ids) +BTF_KFUNCS_START(bpf_cpuacct_kfunc_ids) BTF_ID_FLAGS(func, bpf_task_ca_cpuusage) BTF_ID_FLAGS(func, bpf_cpuacct_kcpustat_cpu_fetch) -BTF_SET8_END(bpf_cpuacct_kfunc_ids) +BTF_KFUNCS_END(bpf_cpuacct_kfunc_ids) static const struct btf_kfunc_id_set bpf_cpuacct_kfunc_set = { .owner = THIS_MODULE, diff --git a/net/core/filter.c b/net/core/filter.c index d32c0000d345..80ca2b2d1f0b 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -12174,13 +12174,13 @@ BTF_ID_FLAGS(func, bpf_sock_addr_set_sun_path) BTF_KFUNCS_END(bpf_kfunc_check_set_sock_addr) #ifdef CONFIG_HISOCK -BTF_SET8_START(bpf_kfunc_check_set_sock_ops) +BTF_KFUNCS_START(bpf_kfunc_check_set_sock_ops) BTF_ID_FLAGS(func, bpf_skops_get_ingress_dst, KF_RET_NULL) -BTF_SET8_END(bpf_kfunc_check_set_sock_ops) +BTF_KFUNCS_END(bpf_kfunc_check_set_sock_ops) -BTF_SET8_START(bpf_kfunc_check_set_hisock) +BTF_KFUNCS_START(bpf_kfunc_check_set_hisock) BTF_ID_FLAGS(func, bpf_skb_change_dev) -BTF_SET8_END(bpf_kfunc_check_set_hisock) +BTF_KFUNCS_END(bpf_kfunc_check_set_hisock) #endif static const struct btf_kfunc_id_set bpf_kfunc_set_skb = { -- 2.34.1

2 1

[PATCH OLK-6.6 00/10] cache: Support cache maintenance for HiSilicon SoC Hydra Home Agent
by Yushan Wang 23 Sep '26

23 Sep '26

From: Hongye Lin <linhongye(a)h-partners.com> driver inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/10043 ---------------------------------------------------------------------- Jonathan Cameron (4): memregion: Drop unused IORES_DESC_* parameter from cpu_cache_invalidate_memregion() arm64: Select GENERIC_CPU_CACHE_MAINTENANCE MAINTAINERS: Add Jonathan Cameron to drivers/cache and add lib/cache_maint.c + header cache: Make top level Kconfig menu a boolean dependent on RISCV Yicong Yang (2): memregion: Support fine grained invalidate by cpu_cache_invalidate_memregion() lib: Support ARCH_HAS_CPU_CACHE_INVALIDATE_MEMREGION Yushan Wang (4): mm: reclaim_notify: move struct reclaim_notify_data out of CONFIG_RECLAIM_NOTIFY soc cache: remove old cache maintain cache: Support cache maintenance for HiSilicon SoC Hydra Home Agent defconfig: Add cache maintain related config MAINTAINERS | 4 +- arch/arm64/Kconfig | 2 + arch/arm64/configs/openeuler_defconfig | 9 +- arch/x86/mm/pat/set_memory.c | 2 +- drivers/cache/Kconfig | 28 +++- drivers/cache/Makefile | 2 + .../{soc/hisilicon => cache}/hisi_soc_hha.c | 152 +++++++++--------- drivers/cxl/core/region.c | 5 +- drivers/nvdimm/region.c | 2 +- drivers/nvdimm/region_devs.c | 2 +- drivers/soc/hisilicon/Kconfig | 12 -- drivers/soc/hisilicon/Makefile | 1 - .../soc/hisilicon/hisi_soc_cache_framework.c | 112 ------------- .../soc/hisilicon/hisi_soc_cache_framework.h | 10 -- include/linux/cache_coherency.h | 61 +++++++ include/linux/memregion.h | 16 +- include/linux/mm.h | 3 +- .../uapi/misc/hisi_soc_cache/hisi_soc_cache.h | 37 ----- lib/Kconfig | 3 + lib/Makefile | 2 + lib/cache_maint.c | 138 ++++++++++++++++ 21 files changed, 339 insertions(+), 264 deletions(-) rename drivers/{soc/hisilicon => cache}/hisi_soc_hha.c (50%) create mode 100644 include/linux/cache_coherency.h delete mode 100644 include/uapi/misc/hisi_soc_cache/hisi_soc_cache.h create mode 100644 lib/cache_maint.c -- 2.33.0

2 11

[PATCH OLK-6.6] ceph: do not repeat ceph_trim_dentries() if no progress possible
by Pan Taixi 23 Sep '26

23 Sep '26

From: Max Kellermann <max.kellermann(a)ionos.com> mainline inclusion from mainline-v7.3-rc1 commit e7d7aa7b730178278109c41fa1b17b06873065d5 category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/19026 CVE: CVE-2026-89647 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- ceph_cap_reclaim_work() re-queues itself for as long as ceph_trim_dentries() returns -EAGAIN, which happens whenever a lease walk exhausts its `nr_to_scan` budget. This creates a busy loop that consumes CPU without making any progress when there is nothing to reclaim: with no cap pressure (`count==0`) and every scanned lease still valid, each pass runs the full scan budget down to zero and returns `-EAGAIN`, only to be queued again immediately. The dir-lease walk made this worse. When `expire_dir_lease` is `false` (i.e. we have no intention of reclaiming dir leases), __dir_lease_check() returned `TOUCH` for every valid lease. `TOUCH` moves the dentry to the tail of the list and resets `di->time` via __dentry_dir_lease_touch(), so a walk over N valid leases pointlessly rewrote the list, refreshed the timestamps (preventing them from ever aging out) and always drained `nr_to_scan`, guaranteeing the `-EAGAIN` requeue. Fix this in three steps: - Return `KEEP` instead of `TOUCH` when `expire_dir_lease` is `false`. If we are not going to reclaim the lease, leave it in place instead of churning the list and resetting its timestamp; the walk then terminates naturally (or via `STOP` at the first fresh lease). - Only return `-EAGAIN` from the first (dentry-lease) walk when something was actually freed. A full batch that frees nothing means retrying the same list immediately is futile; fall through to the dir-lease walk instead. - After both walks, bail out with success (0) when nothing was freed and there is no cap pressure (`count==0`). There is no reason to keep retrying when we are not over the cap limit and made no progress. Under real cap pressure (`count>0`) the reclaim path is unchanged and still retries via `-EAGAIN`. Without this patch, I saw 500 ceph_trim_dentries() calls per second on our web servers. This is very visible in `/proc/lock_stat` (5 minute capture): class name con-bounces contentions waittime-min waittime-max waittime-total waittime-avg acq-bounces acquisitions holdtime-min holdtime-max holdtime-total holdtime-avg &mdsc->dentry_list_lock: 126180 128218 0.04 8063.44 15986965.20 124.69 1573354 5296812 0.04 8291.28 74164526.48 14.00 ----------------------- &mdsc->dentry_list_lock 111736 [<000000007b11e319>] __ceph_dentry_dir_lease_touch+0x7c/0xa8 &mdsc->dentry_list_lock 2631 [<0000000050597999>] __dentry_leases_walk+0x64/0x2c8 &mdsc->dentry_list_lock 3878 [<00000000c0022f62>] __ceph_dentry_lease_touch+0x5c/0xa8 &mdsc->dentry_list_lock 9973 [<000000002f27cb6f>] __dentry_lease_unlist+0x50/0xa0 ----------------------- &mdsc->dentry_list_lock 123621 [<0000000050597999>] __dentry_leases_walk+0x64/0x2c8 &mdsc->dentry_list_lock 1822 [<000000007b11e319>] __ceph_dentry_dir_lease_touch+0x7c/0xa8 &mdsc->dentry_list_lock 2720 [<000000002f27cb6f>] __dentry_lease_unlist+0x50/0xa0 &mdsc->dentry_list_lock 55 [<00000000c0022f62>] __ceph_dentry_lease_touch+0x5c/0xa8 With this patch: class name con-bounces contentions waittime-min waittime-max waittime-total waittime-avg acq-bounces acquisitions holdtime-min holdtime-max holdtime-total holdtime-avg &mdsc->dentry_list_lock: 1203 1215 0.16 408.88 33082.88 27.23 4320501 7357389 0.04 500.64 1961578.00 0.27 ----------------------- &mdsc->dentry_list_lock 1029 [<000000003c9aea8a>] __ceph_dentry_dir_lease_touch+0x7c/0xa8 &mdsc->dentry_list_lock 169 [<000000002038c577>] __dentry_lease_unlist+0x50/0xa0 &mdsc->dentry_list_lock 16 [<00000000c991106d>] __ceph_dentry_lease_touch+0x5c/0xa8 &mdsc->dentry_list_lock 1 [<00000000612fe15f>] __dentry_leases_walk+0x64/0x2c8 ----------------------- &mdsc->dentry_list_lock 158 [<000000002038c577>] __dentry_lease_unlist+0x50/0xa0 &mdsc->dentry_list_lock 858 [<000000003c9aea8a>] __ceph_dentry_dir_lease_touch+0x7c/0xa8 &mdsc->dentry_list_lock 182 [<00000000612fe15f>] __dentry_leases_walk+0x64/0x2c8 &mdsc->dentry_list_lock 17 [<00000000c991106d>] __ceph_dentry_lease_touch+0x5c/0xa8 __dentry_leases_walk() is almost gone. The total wait time is reduced by a factor of 483. That will give some latency gains to ceph_readdir(). Cc: stable(a)vger.kernel.org Fixes: 37c4efc1ddf9 ("ceph: periodically trim stale dentries") Signed-off-by: Max Kellermann <max.kellermann(a)ionos.com> Reviewed-by: Alex Markuze <amarkuze(a)redhat.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Conflicts: fs/ceph/dir.c [backport to OLK-6.6: the three upstream semantic changes are taken verbatim - __dir_lease_check() now returns KEEP instead of TOUCH when expire_dir_lease is false (moved above the round-robin comment), the first -EAGAIN is gated on freed > 0, and ceph_trim_dentries() bails out with 0 when freed == 0 && count == 0. Only the two __dentry_leases_walk() call sites had to be adapted: like linux-5.10.y, this tree still passes the check callback as a third argument, because 2a965d1b15d28 ("ceph: get rid of passing callbacks in __dentry_leases_walk()", v6.8-rc1, which is what the linux-6.12.y stable backport is based on) is a pure cleanup that is neither present in OLK-6.6 nor part of this fix's dependency chain. linux-6.6.y LTS has not taken this fix, so mainline e7d7aa7b73017 is used as the baseline.] Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com> --- fs/ceph/dir.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c index 949c2a450cfb..5f82537ba37c 100644 --- a/fs/ceph/dir.c +++ b/fs/ceph/dir.c @@ -1674,15 +1674,15 @@ static int __dir_lease_check(struct dentry *dentry, void *arg) if (ret == -EBUSY) return KEEP; if (ret > 0) { if (time_before(jiffies, di->time + lwc->dir_lease_ttl)) return STOP; + if (!lwc->expire_dir_lease) + return KEEP; /* Move dentry to tail of dir lease list if we don't want * to delete it. So dentries in the list are checked in a * round robin manner */ - if (!lwc->expire_dir_lease) - return TOUCH; if (dentry->d_lockref.count > 0 || (di->flags & CEPH_DENTRY_REFERENCED)) return TOUCH; /* invalidate dir lease */ di->lease_shared_gen = 0; @@ -1705,20 +1705,24 @@ int ceph_trim_dentries(struct ceph_mds_client *mdsc) spin_unlock(&mdsc->caps_list_lock); lwc.dir_lease = false; lwc.nr_to_scan = CEPH_CAPS_PER_RELEASE * 2; freed = __dentry_leases_walk(mdsc, &lwc, __dentry_lease_check); - if (!lwc.nr_to_scan) /* more invalid leases */ + if (freed > 0 && !lwc.nr_to_scan) /* more invalid leases */ return -EAGAIN; if (lwc.nr_to_scan < CEPH_CAPS_PER_RELEASE) lwc.nr_to_scan = CEPH_CAPS_PER_RELEASE; lwc.dir_lease = true; lwc.expire_dir_lease = freed < count; lwc.dir_lease_ttl = mdsc->fsc->mount_options->caps_wanted_delay_max * HZ; freed +=__dentry_leases_walk(mdsc, &lwc, __dir_lease_check); + if (freed == 0 && count == 0) + /* no progress possible currently, retry futile */ + return 0; + if (!lwc.nr_to_scan) /* more to check */ return -EAGAIN; return freed > 0 ? 1 : 0; } -- 2.34.1

2 1

[PATCH OLK-5.10] ceph: do not repeat ceph_trim_dentries() if no progress possible
by Pan Taixi 23 Sep '26

23 Sep '26

From: Max Kellermann <max.kellermann(a)ionos.com> mainline inclusion from mainline-v7.3-rc1 commit e7d7aa7b730178278109c41fa1b17b06873065d5 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19026 CVE: CVE-2026-89647 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- ceph_cap_reclaim_work() re-queues itself for as long as ceph_trim_dentries() returns -EAGAIN, which happens whenever a lease walk exhausts its `nr_to_scan` budget. This creates a busy loop that consumes CPU without making any progress when there is nothing to reclaim: with no cap pressure (`count==0`) and every scanned lease still valid, each pass runs the full scan budget down to zero and returns `-EAGAIN`, only to be queued again immediately. The dir-lease walk made this worse. When `expire_dir_lease` is `false` (i.e. we have no intention of reclaiming dir leases), __dir_lease_check() returned `TOUCH` for every valid lease. `TOUCH` moves the dentry to the tail of the list and resets `di->time` via __dentry_dir_lease_touch(), so a walk over N valid leases pointlessly rewrote the list, refreshed the timestamps (preventing them from ever aging out) and always drained `nr_to_scan`, guaranteeing the `-EAGAIN` requeue. Fix this in three steps: - Return `KEEP` instead of `TOUCH` when `expire_dir_lease` is `false`. If we are not going to reclaim the lease, leave it in place instead of churning the list and resetting its timestamp; the walk then terminates naturally (or via `STOP` at the first fresh lease). - Only return `-EAGAIN` from the first (dentry-lease) walk when something was actually freed. A full batch that frees nothing means retrying the same list immediately is futile; fall through to the dir-lease walk instead. - After both walks, bail out with success (0) when nothing was freed and there is no cap pressure (`count==0`). There is no reason to keep retrying when we are not over the cap limit and made no progress. Under real cap pressure (`count>0`) the reclaim path is unchanged and still retries via `-EAGAIN`. Without this patch, I saw 500 ceph_trim_dentries() calls per second on our web servers. This is very visible in `/proc/lock_stat` (5 minute capture): class name con-bounces contentions waittime-min waittime-max waittime-total waittime-avg acq-bounces acquisitions holdtime-min holdtime-max holdtime-total holdtime-avg &mdsc->dentry_list_lock: 126180 128218 0.04 8063.44 15986965.20 124.69 1573354 5296812 0.04 8291.28 74164526.48 14.00 ----------------------- &mdsc->dentry_list_lock 111736 [<000000007b11e319>] __ceph_dentry_dir_lease_touch+0x7c/0xa8 &mdsc->dentry_list_lock 2631 [<0000000050597999>] __dentry_leases_walk+0x64/0x2c8 &mdsc->dentry_list_lock 3878 [<00000000c0022f62>] __ceph_dentry_lease_touch+0x5c/0xa8 &mdsc->dentry_list_lock 9973 [<000000002f27cb6f>] __dentry_lease_unlist+0x50/0xa0 ----------------------- &mdsc->dentry_list_lock 123621 [<0000000050597999>] __dentry_leases_walk+0x64/0x2c8 &mdsc->dentry_list_lock 1822 [<000000007b11e319>] __ceph_dentry_dir_lease_touch+0x7c/0xa8 &mdsc->dentry_list_lock 2720 [<000000002f27cb6f>] __dentry_lease_unlist+0x50/0xa0 &mdsc->dentry_list_lock 55 [<00000000c0022f62>] __ceph_dentry_lease_touch+0x5c/0xa8 With this patch: class name con-bounces contentions waittime-min waittime-max waittime-total waittime-avg acq-bounces acquisitions holdtime-min holdtime-max holdtime-total holdtime-avg &mdsc->dentry_list_lock: 1203 1215 0.16 408.88 33082.88 27.23 4320501 7357389 0.04 500.64 1961578.00 0.27 ----------------------- &mdsc->dentry_list_lock 1029 [<000000003c9aea8a>] __ceph_dentry_dir_lease_touch+0x7c/0xa8 &mdsc->dentry_list_lock 169 [<000000002038c577>] __dentry_lease_unlist+0x50/0xa0 &mdsc->dentry_list_lock 16 [<00000000c991106d>] __ceph_dentry_lease_touch+0x5c/0xa8 &mdsc->dentry_list_lock 1 [<00000000612fe15f>] __dentry_leases_walk+0x64/0x2c8 ----------------------- &mdsc->dentry_list_lock 158 [<000000002038c577>] __dentry_lease_unlist+0x50/0xa0 &mdsc->dentry_list_lock 858 [<000000003c9aea8a>] __ceph_dentry_dir_lease_touch+0x7c/0xa8 &mdsc->dentry_list_lock 182 [<00000000612fe15f>] __dentry_leases_walk+0x64/0x2c8 &mdsc->dentry_list_lock 17 [<00000000c991106d>] __ceph_dentry_lease_touch+0x5c/0xa8 __dentry_leases_walk() is almost gone. The total wait time is reduced by a factor of 483. That will give some latency gains to ceph_readdir(). Cc: stable(a)vger.kernel.org Fixes: 37c4efc1ddf9 ("ceph: periodically trim stale dentries") Signed-off-by: Max Kellermann <max.kellermann(a)ionos.com> Reviewed-by: Alex Markuze <amarkuze(a)redhat.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Conflicts: fs/ceph/dir.c [backport to OLK-5.10: the three upstream semantic changes are taken verbatim - __dir_lease_check() now returns KEEP instead of TOUCH when expire_dir_lease is false (moved above the round-robin comment), the first -EAGAIN is gated on freed > 0, and ceph_trim_dentries() bails out with 0 when freed == 0 && count == 0. Only the two __dentry_leases_walk() call sites had to be adapted: this tree still passes the check callback as a third argument, because 2a965d1b15d28 ("ceph: get rid of passing callbacks in __dentry_leases_walk()", v6.8-rc1) is a pure cleanup that is neither present in OLK-5.10 nor part of this fix's dependency chain. linux-5.10.y LTS has not taken this fix, so mainline e7d7aa7b73017 is used as the baseline.] Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com> --- fs/ceph/dir.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c index 504693f6b72d..fafff54e30d5 100644 --- a/fs/ceph/dir.c +++ b/fs/ceph/dir.c @@ -1468,15 +1468,15 @@ static int __dir_lease_check(struct dentry *dentry, void *arg) if (ret == -EBUSY) return KEEP; if (ret > 0) { if (time_before(jiffies, di->time + lwc->dir_lease_ttl)) return STOP; + if (!lwc->expire_dir_lease) + return KEEP; /* Move dentry to tail of dir lease list if we don't want * to delete it. So dentries in the list are checked in a * round robin manner */ - if (!lwc->expire_dir_lease) - return TOUCH; if (dentry->d_lockref.count > 0 || (di->flags & CEPH_DENTRY_REFERENCED)) return TOUCH; /* invalidate dir lease */ di->lease_shared_gen = 0; @@ -1499,20 +1499,24 @@ int ceph_trim_dentries(struct ceph_mds_client *mdsc) spin_unlock(&mdsc->caps_list_lock); lwc.dir_lease = false; lwc.nr_to_scan = CEPH_CAPS_PER_RELEASE * 2; freed = __dentry_leases_walk(mdsc, &lwc, __dentry_lease_check); - if (!lwc.nr_to_scan) /* more invalid leases */ + if (freed > 0 && !lwc.nr_to_scan) /* more invalid leases */ return -EAGAIN; if (lwc.nr_to_scan < CEPH_CAPS_PER_RELEASE) lwc.nr_to_scan = CEPH_CAPS_PER_RELEASE; lwc.dir_lease = true; lwc.expire_dir_lease = freed < count; lwc.dir_lease_ttl = mdsc->fsc->mount_options->caps_wanted_delay_max * HZ; freed +=__dentry_leases_walk(mdsc, &lwc, __dir_lease_check); + if (freed == 0 && count == 0) + /* no progress possible currently, retry futile */ + return 0; + if (!lwc.nr_to_scan) /* more to check */ return -EAGAIN; return freed > 0 ? 1 : 0; } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] inetpeer: randomize RB-tree node comparison using SipHash
by JiangJieHua 23 Sep '26

23 Sep '26

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v7.3-rc1 commit 2ee66e9487172fcd189bc52a767c30dad7141c09 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19402 CVE: CVE-2026-90110 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The inetpeer rate limiting system stores peer entries in a Red-Black tree keyed deterministically on the remote IP address. Because tree lookups walk the RB-tree using standard lexicographical comparisons (inetpeer_addr_cmp), an off-path adversary can predict the exact topology of the tree and the sequence of nodes traversed during lookups (the gc_stack candidate list). By combining deterministic tree traversal with aggressive garbage collection (triggered when tree size exceeds inet_peer_threshold), an attacker can selectively force the eviction of targeted inet_peer nodes. When an evicted node is subsequently re-created upon receiving a new packet, its rate-limiting token bucket (rate_tokens, rate_last) is reset to full capacity. This creates a side-channel primitive allowing off-path attackers to bypass IP-keyed ICMP rate limits and infer open UDP ports (similar to SAD DNS style attacks). Mitigate this by randomizing the RB-tree node comparison logic using SipHash with a secret key (inetpeer_hash_key) initialized via net_get_random_once(). Nodes are ordered in the tree by SipHash(addr, key) rather than raw IP addresses. Because the secret key is unknown to external entities, the tree layout and lookup traversal paths are unpredictable to off-path adversaries, breaking the deterministic eviction gadget. Cache the computed 64-bit SipHash (hash) in struct inet_peer and compute the target hash (dhash) once at the beginning of inet_getpeer() to avoid recomputing SipHash at every step of the RB-tree walk. Fixes: b145425f269a ("inetpeer: remove AVL implementation in favor of RB tree") Reported-by: Michael Blunt <michaelbblunt(a)gmail.com> Suggested-by: Michael Blunt <michaelbblunt(a)gmail.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20260818151213.3953963-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv4/inetpeer.c [Conflicts are caused by the following patches not being merged: inet_getpeer() still keeps the create argument and the invalidated/read_seqretry/rcu_read_lock layout: 7a596a50c4a4 ("inetpeer: remove create argument of inet_getpeer()") a853c609504e ("inetpeer: do not get a refcount in inet_getpeer()") Also,Commit 2ee66e948717 adapted to this tree:siphash_aligned_key_t does not exist here, use siphash_key_t(same { u64 key[2] } layout);] Signed-off-by: JiangJieHua <jiangjiehua1(a)huawei.com> --- include/net/inetpeer.h | 4 ++++ net/ipv4/inetpeer.c | 38 +++++++++++++++++++++++++++++++++++--- 2 files changed, 39 insertions(+), 3 deletions(-) diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h index 74ff688568a0c..66b48d4266fbb 100644 --- a/include/net/inetpeer.h +++ b/include/net/inetpeer.h @@ -35,6 +35,7 @@ struct inetpeer_addr { struct inet_peer { struct rb_node rb_node; + u64 hash; struct inetpeer_addr daddr; u32 metrics[RTAX_MAX]; @@ -127,6 +128,9 @@ static inline int inetpeer_addr_cmp(const struct inetpeer_addr *a, { int i, n; + if (a->family != b->family) + return a->family < b->family ? -1 : 1; + if (a->family == AF_INET) n = sizeof(a->a4) / sizeof(u32); else diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c index a18668552d33d..50e818a82825b 100644 --- a/net/ipv4/inetpeer.c +++ b/net/ipv4/inetpeer.c @@ -22,6 +22,7 @@ #include <net/ip.h> #include <net/inetpeer.h> #include <net/secure_seq.h> +#include <linux/siphash.h> /* * Theory of operations. @@ -53,6 +54,34 @@ */ static struct kmem_cache *peer_cachep __ro_after_init; +static siphash_key_t inetpeer_hash_key __read_mostly; + +static u64 inetpeer_addr_hash(const struct inetpeer_addr *a) +{ + net_get_random_once(&inetpeer_hash_key, sizeof(inetpeer_hash_key)); + + if (a->family == AF_INET) + return siphash_2u32((__force u32)a->a4.addr, a->a4.vif, + &inetpeer_hash_key); + + return siphash_4u32((__force u32)a->a6.s6_addr32[0], + (__force u32)a->a6.s6_addr32[1], + (__force u32)a->a6.s6_addr32[2], + (__force u32)a->a6.s6_addr32[3], + &inetpeer_hash_key); +} + +static int inetpeer_entry_cmp(u64 dhash, + const struct inetpeer_addr *daddr, + const struct inet_peer *p) +{ + if (dhash < p->hash) + return -1; + if (dhash > p->hash) + return 1; + + return inetpeer_addr_cmp(daddr, &p->daddr); +} void inet_peer_base_init(struct inet_peer_base *bp) { @@ -96,6 +125,7 @@ void __init inet_initpeers(void) /* Called with rcu_read_lock() or base->lock held */ static struct inet_peer *lookup(const struct inetpeer_addr *daddr, + u64 dhash, struct inet_peer_base *base, unsigned int seq, struct inet_peer *gc_stack[], @@ -116,7 +146,7 @@ static struct inet_peer *lookup(const struct inetpeer_addr *daddr, break; parent = next; p = rb_entry(parent, struct inet_peer, rb_node); - cmp = inetpeer_addr_cmp(daddr, &p->daddr); + cmp = inetpeer_entry_cmp(dhash, daddr, p); if (cmp == 0) { if (!refcount_inc_not_zero(&p->refcnt)) break; @@ -188,6 +218,7 @@ struct inet_peer *inet_getpeer(struct inet_peer_base *base, int create) { struct inet_peer *p, *gc_stack[PEER_MAX_GC]; + u64 dhash = inetpeer_addr_hash(daddr); struct rb_node **pp, *parent; unsigned int gc_cnt, seq; int invalidated; @@ -197,7 +228,7 @@ struct inet_peer *inet_getpeer(struct inet_peer_base *base, */ rcu_read_lock(); seq = read_seqbegin(&base->lock); - p = lookup(daddr, base, seq, NULL, &gc_cnt, &parent, &pp); + p = lookup(daddr, dhash, base, seq, NULL, &gc_cnt, &parent, &pp); invalidated = read_seqretry(&base->lock, seq); rcu_read_unlock(); @@ -215,11 +246,12 @@ struct inet_peer *inet_getpeer(struct inet_peer_base *base, write_seqlock_bh(&base->lock); gc_cnt = 0; - p = lookup(daddr, base, seq, gc_stack, &gc_cnt, &parent, &pp); + p = lookup(daddr, dhash, base, seq, gc_stack, &gc_cnt, &parent, &pp); if (!p && create) { p = kmem_cache_alloc(peer_cachep, GFP_ATOMIC); if (p) { p->daddr = *daddr; + p->hash = dhash; p->dtime = (__u32)jiffies; refcount_set(&p->refcnt, 2); atomic_set(&p->rid, 0); -- 2.33.8

2 1

[PATCH OLK-5.10 V1 0/5] Fix CVE-2026-90329
by Yao Yiqi 23 Sep '26

23 Sep '26

2 dependencies brings back 2 more fixes for them, so we have 5 patches in total. Daniel Borkmann (1): bpf: Fix vmlinux BTF prep race in bpf_get_btf_vmlinux Vitaly Kuznetsov (1): HID: hyperv: streamline driver probe to avoid devres issues Xingrui Li (1): HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature Yehyeong Lee (2): IB/isert: reject PDUs declaring more data than was received IB/isert: reject login PDUs declaring more data than was received -- 2.34.1

2 6

[PATCH OLK-6.6] seg6: reset IP6CB after IPv6 decapsulation
by JiangJieHua 23 Sep '26

23 Sep '26

From: Zhiling Zou <zhilinz(a)nebusec.ai> stable inclusion from stable-v6.6.157 commit 96c74420ac92930a7e0f21770818544eee4a93d7 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18815 CVE: CVE-2026-80976 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f967455fb2a5a2079b9eb5823e9ccf359174bf9f upstream. decap_and_validate() pulls the outer SRv6 headers and makes the inner packet the skb network header. The IPv6 control block still contains values collected while parsing the outer packet, including nhoff and extension-header flags. End.DX6 and End.DT6 route the inner IPv6 packet directly to the IPv6 input path. An unprivileged user can reach End.DT6 from a user and net namespace by installing a local SID and injecting an outer packet with Hop-by-Hop and Destination Options headers followed by an SRH and a minimal inner IPv6 packet. The outer extension headers leave a large nhoff in IP6CB. After decapsulation, ip6_protocol_deliver_rcu() uses that stale offset on the inner packet and reads beyond the skb head. KASAN reports: BUG: KASAN: slab-out-of-bounds in ip6_protocol_deliver_rcu ip6_protocol_deliver_rcu+0x1118/0x1450 ip6_input_finish+0x11b/0x240 seg6_local_input_core+0xed/0x2e0 lwtunnel_input+0x1e9/0x4e0 ipv6_rthdr_rcv+0x525f/0x6c50 ip6_protocol_deliver_rcu+0xcb7/0x1450 Before clearing IP6CB for an inner IPv6 packet, save its incoming interface index and L3 slave state. Restore both after the clear and set nhoff to the inner IPv6 base-header nexthdr field. Use IP6CB(skb)->iif rather than skb->skb_iif because VRF processing can replace skb_iif with the L3 master while IP6CB keeps the receiving interface. Preserve IP6SKB_L3SLAVE for the same reason. Fixes: d7a669dd2f8b ("ipv6: sr: add helper functions for seg6local") Cc: stable(a)vger.kernel.org Reported-by: Vega <vega(a)nebusec.ai> Signed-off-by: Zhiling Zou <zhilinz(a)nebusec.ai> Reviewed-by: Andrea Mayer <andrea.mayer(a)uniroma2.it> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: JiangJieHua <jiangjiehua1(a)huawei.com> --- net/ipv6/seg6_local.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/net/ipv6/seg6_local.c b/net/ipv6/seg6_local.c index 2aba3d7e9cecd..129cb659bab2c 100644 --- a/net/ipv6/seg6_local.c +++ b/net/ipv6/seg6_local.c @@ -261,6 +261,15 @@ static bool decap_and_validate(struct sk_buff *skb, int proto) memset(IPCB(skb), 0, sizeof(*IPCB(skb))); IPCB(skb)->iif = iif; + } else if (proto == IPPROTO_IPV6) { + bool l3slave = ipv6_l3mdev_skb(IP6CB(skb)->flags); + int iif = IP6CB(skb)->iif; + + memset(IP6CB(skb), 0, sizeof(*IP6CB(skb))); + IP6CB(skb)->iif = iif; + IP6CB(skb)->nhoff = offsetof(struct ipv6hdr, nexthdr); + if (l3slave) + IP6CB(skb)->flags |= IP6SKB_L3SLAVE; } return true; -- 2.33.8

2 1

[PATCH openEuler-26.09] bpf: Fix missing BTF_KFUNCS_START/END conversion for arch kfuncs
by Tengda Wu 23 Sep '26

23 Sep '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18731 ---------------------------------------- After 1cd6437b7dde ("bpf: treewide: Annotate BPF kfuncs in BTF"), all kfuncs should be wrapped by BTF_KFUNCS_START. However, some parts of the current kernel have not been replaced, resulting in the following warning being printed during boot: [ 12.642917] WARNING: CPU: 0 PID: 1 at kernel/bpf/btf.c:8264 register_btf_kfunc_id_set+0x48/0x50 [ 12.643646] Modules linked in: [ 12.644274] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.6.0+ #3 [ 12.644668] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 4 [ 12.645182] RIP: 0010:register_btf_kfunc_id_set+0x48/0x50 [ 12.645462] Code: 44 89 c7 e9 ca fb ff ff 89 ff 44 0f be 87 80 56 22 82 44 89 c7 e9 b8 fb ff ff 48 83 3e 00 74 0a b8 0 [ 12.645959] RSP: 0018:ffffc90000013e98 EFLAGS: 00000246 [ 12.646275] RAX: ffffffff8365bc00 RBX: 0000000000000000 RCX: 0000000000000000 [ 12.646576] RDX: 0000000000000000 RSI: ffffffff8220dc60 RDI: 000000000000001a [ 12.646755] RBP: ffffffff8332d190 R08: 0000000000000009 R09: 00000000248a5858 [ 12.646940] R10: 0000000014af4066 R11: 00000000abf468e2 R12: ffff888100a16900 [ 12.647390] R13: 0000000000000216 R14: 0000000000000000 R15: 0000000000000000 [ 12.647663] FS: 0000000000000000(0000) GS:ffff888237c00000(0000) knlGS:0000000000000000 [ 12.647925] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 12.648406] CR2: ffff88823ffff000 CR3: 0000000002a30000 CR4: 00000000000006f0 [ 12.648793] Call Trace: [ 12.649150] <TASK> [ 12.649411] do_one_initcall+0x48/0x220 [ 12.650216] kernel_init_freeable+0x1a9/0x2e0 [ 12.650435] ? __pfx_kernel_init+0x10/0x10 [ 12.650660] ? __pfx_kernel_init+0x10/0x10 [ 12.650880] kernel_init+0x1a/0x1c0 [ 12.651274] ret_from_fork+0xa4/0x100 [ 12.651524] ret_from_fork_asm+0x1b/0x30 [ 12.651901] </TASK> Get rid of it by searching for and replacing all BTF_SET8_START/END with BTF_KFUNCS_START/END. Fixes: 1cd6437b7dde ("bpf: treewide: Annotate BPF kfuncs in BTF") Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- arch/arm64/kernel/bpf-rvi.c | 4 ++-- arch/x86/kernel/cpu/bpf-rvi.c | 4 ++-- block/blk-cgroup.c | 4 ++-- drivers/hid/bpf/hid_bpf_dispatch.c | 4 ++-- fs/proc/stat.c | 4 ++-- kernel/bpf-rvi/common_kfuncs.c | 4 ++-- kernel/cgroup/cpuset.c | 4 ++-- kernel/sched/bpf_sched.c | 8 ++++---- kernel/sched/cpuacct.c | 4 ++-- net/core/filter.c | 8 ++++---- net/mptcp/bpf.c | 4 ++-- 11 files changed, 26 insertions(+), 26 deletions(-) diff --git a/arch/arm64/kernel/bpf-rvi.c b/arch/arm64/kernel/bpf-rvi.c index 1ff460b46c85..026822aab85e 100644 --- a/arch/arm64/kernel/bpf-rvi.c +++ b/arch/arm64/kernel/bpf-rvi.c @@ -45,10 +45,10 @@ __bpf_kfunc const char *bpf_arch_flags(enum arch_flags_type t, int i) } } -BTF_SET8_START(bpf_arm64_kfunc_ids) +BTF_KFUNCS_START(bpf_arm64_kfunc_ids) BTF_ID_FLAGS(func, bpf_arm64_cpu_have_feature, KF_RCU) BTF_ID_FLAGS(func, bpf_arch_flags) -BTF_SET8_END(bpf_arm64_kfunc_ids) +BTF_KFUNCS_END(bpf_arm64_kfunc_ids) static const struct btf_kfunc_id_set bpf_arm64_kfunc_set = { .owner = THIS_MODULE, diff --git a/arch/x86/kernel/cpu/bpf-rvi.c b/arch/x86/kernel/cpu/bpf-rvi.c index dc71657623ed..a5de8f4d0c86 100644 --- a/arch/x86/kernel/cpu/bpf-rvi.c +++ b/arch/x86/kernel/cpu/bpf-rvi.c @@ -142,9 +142,9 @@ __bpf_kfunc const char *bpf_arch_flags(enum arch_flags_type t, int i) } } -BTF_SET8_START(bpf_arch_flags_kfunc_ids) +BTF_KFUNCS_START(bpf_arch_flags_kfunc_ids) BTF_ID_FLAGS(func, bpf_arch_flags) -BTF_SET8_END(bpf_arch_flags_kfunc_ids) +BTF_KFUNCS_END(bpf_arch_flags_kfunc_ids) static const struct btf_kfunc_id_set bpf_arch_flags_kfunc_set = { .owner = THIS_MODULE, diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c index 0a56cfac5a5d..80630a2e6e2c 100644 --- a/block/blk-cgroup.c +++ b/block/blk-cgroup.c @@ -2349,9 +2349,9 @@ __bpf_kfunc void bpf_blkcg_get_dev_iostat(struct blkcg *blkcg, int major, int mi rcu_read_unlock(); } -BTF_SET8_START(bpf_blkcg_kfunc_ids) +BTF_KFUNCS_START(bpf_blkcg_kfunc_ids) BTF_ID_FLAGS(func, bpf_blkcg_get_dev_iostat) -BTF_SET8_END(bpf_blkcg_kfunc_ids) +BTF_KFUNCS_END(bpf_blkcg_kfunc_ids) static const struct btf_kfunc_id_set bpf_blkcg_kfunc_set = { .owner = THIS_MODULE, diff --git a/drivers/hid/bpf/hid_bpf_dispatch.c b/drivers/hid/bpf/hid_bpf_dispatch.c index c2ffa01585ed..5fa53d0bea58 100644 --- a/drivers/hid/bpf/hid_bpf_dispatch.c +++ b/drivers/hid/bpf/hid_bpf_dispatch.c @@ -467,11 +467,11 @@ hid_bpf_hw_request(struct hid_bpf_ctx *ctx, __u8 *buf, size_t buf__sz, } /* our HID-BPF entrypoints */ -BTF_SET8_START(hid_bpf_fmodret_ids) +BTF_KFUNCS_START(hid_bpf_fmodret_ids) BTF_ID_FLAGS(func, hid_bpf_device_event) BTF_ID_FLAGS(func, hid_bpf_rdesc_fixup) BTF_ID_FLAGS(func, __hid_bpf_tail_call) -BTF_SET8_END(hid_bpf_fmodret_ids) +BTF_KFUNCS_END(hid_bpf_fmodret_ids) static const struct btf_kfunc_id_set hid_bpf_fmodret_set = { .owner = THIS_MODULE, diff --git a/fs/proc/stat.c b/fs/proc/stat.c index 4757e5b1be38..dc21a2c9a25d 100644 --- a/fs/proc/stat.c +++ b/fs/proc/stat.c @@ -239,11 +239,11 @@ __bpf_kfunc void bpf_show_all_irqs(struct seq_file *p) show_all_irqs(p); } -BTF_SET8_START(bpf_proc_stat_kfunc_ids) +BTF_KFUNCS_START(bpf_proc_stat_kfunc_ids) BTF_ID_FLAGS(func, bpf_get_idle_time) BTF_ID_FLAGS(func, bpf_get_iowait_time) BTF_ID_FLAGS(func, bpf_show_all_irqs) -BTF_SET8_END(bpf_proc_stat_kfunc_ids) +BTF_KFUNCS_END(bpf_proc_stat_kfunc_ids) static const struct btf_kfunc_id_set bpf_proc_stat_kfunc_set = { .owner = THIS_MODULE, diff --git a/kernel/bpf-rvi/common_kfuncs.c b/kernel/bpf-rvi/common_kfuncs.c index b0f33fd0201d..d790a7b65da6 100644 --- a/kernel/bpf-rvi/common_kfuncs.c +++ b/kernel/bpf-rvi/common_kfuncs.c @@ -280,7 +280,7 @@ __bpf_kfunc void bpf_x86_direct_pages(unsigned long *p) } #endif -BTF_SET8_START(bpf_common_kfuncs_ids) +BTF_KFUNCS_START(bpf_common_kfuncs_ids) BTF_ID_FLAGS(func, bpf_mem_cgroup_from_task, KF_RET_NULL | KF_RCU) BTF_ID_FLAGS(func, bpf_task_active_pid_ns, KF_TRUSTED_ARGS) BTF_ID_FLAGS(func, bpf_pidns_nr_tasks) @@ -309,7 +309,7 @@ BTF_ID_FLAGS(func, bpf_mem_committed) BTF_ID_FLAGS(func, bpf_mem_vmalloc_used) BTF_ID_FLAGS(func, bpf_mem_vmalloc_total) BTF_ID_FLAGS(func, bpf_x86_direct_pages, KF_TRUSTED_ARGS) -BTF_SET8_END(bpf_common_kfuncs_ids) +BTF_KFUNCS_END(bpf_common_kfuncs_ids) static const struct btf_kfunc_id_set bpf_common_kfuncs_set = { .owner = THIS_MODULE, diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c index 9e1a4680860e..1dc413ac01cf 100644 --- a/kernel/cgroup/cpuset.c +++ b/kernel/cgroup/cpuset.c @@ -5248,10 +5248,10 @@ __bpf_kfunc unsigned int bpf_cpumask_weight(struct cpumask *pmask) return cpumask_weight(pmask); } -BTF_SET8_START(bpf_cpuset_kfunc_ids) +BTF_KFUNCS_START(bpf_cpuset_kfunc_ids) BTF_ID_FLAGS(func, bpf_cpuset_from_task, KF_RET_NULL | KF_RCU) BTF_ID_FLAGS(func, bpf_cpumask_weight) -BTF_SET8_END(bpf_cpuset_kfunc_ids) +BTF_KFUNCS_END(bpf_cpuset_kfunc_ids) static const struct btf_kfunc_id_set bpf_cpuset_kfunc_set = { .owner = THIS_MODULE, diff --git a/kernel/sched/bpf_sched.c b/kernel/sched/bpf_sched.c index 6849a58439b2..1039f20198aa 100644 --- a/kernel/sched/bpf_sched.c +++ b/kernel/sched/bpf_sched.c @@ -167,12 +167,12 @@ __bpf_kfunc s32 bpf_sched_cpu_stats_of(int cpuid, __diag_pop(); -BTF_SET8_START(sched_cpustats_kfunc_btf_ids) +BTF_KFUNCS_START(sched_cpustats_kfunc_btf_ids) BTF_ID_FLAGS(func, bpf_sched_cpustats_create, KF_ACQUIRE | KF_RET_NULL) BTF_ID_FLAGS(func, bpf_sched_cpustats_release, KF_RELEASE) BTF_ID_FLAGS(func, bpf_sched_cpustats_acquire, KF_ACQUIRE | KF_TRUSTED_ARGS) BTF_ID_FLAGS(func, bpf_sched_cpu_stats_of, KF_RCU) -BTF_SET8_END(sched_cpustats_kfunc_btf_ids) +BTF_KFUNCS_END(sched_cpustats_kfunc_btf_ids) static const struct btf_kfunc_id_set cpustats_kfunc_set = { .owner = THIS_MODULE, @@ -221,12 +221,12 @@ __bpf_kfunc int bpf_sched_set_task_prefer_nid(struct task_struct *task, int nid) return set_prefer_cpus_ptr(task, cpumask_of_node(nid)); } -BTF_SET8_START(sched_task_kfunc_btf_ids) +BTF_KFUNCS_START(sched_task_kfunc_btf_ids) BTF_ID_FLAGS(func, bpf_sched_entity_is_task) BTF_ID_FLAGS(func, bpf_sched_entity_to_task) BTF_ID_FLAGS(func, bpf_sched_tag_of_entity) BTF_ID_FLAGS(func, bpf_sched_set_task_prefer_nid) -BTF_SET8_END(sched_task_kfunc_btf_ids) +BTF_KFUNCS_END(sched_task_kfunc_btf_ids) static const struct btf_kfunc_id_set sched_task_kfunc_set = { .owner = THIS_MODULE, diff --git a/kernel/sched/cpuacct.c b/kernel/sched/cpuacct.c index 801f3df9734c..c479a4b9ce77 100644 --- a/kernel/sched/cpuacct.c +++ b/kernel/sched/cpuacct.c @@ -427,10 +427,10 @@ __bpf_kfunc void bpf_cpuacct_kcpustat_cpu_fetch(struct kernel_cpustat *dst, memcpy(dst, per_cpu_ptr(ca->cpustat, cpu), sizeof(struct kernel_cpustat)); } -BTF_SET8_START(bpf_cpuacct_kfunc_ids) +BTF_KFUNCS_START(bpf_cpuacct_kfunc_ids) BTF_ID_FLAGS(func, bpf_task_ca_cpuusage) BTF_ID_FLAGS(func, bpf_cpuacct_kcpustat_cpu_fetch) -BTF_SET8_END(bpf_cpuacct_kfunc_ids) +BTF_KFUNCS_END(bpf_cpuacct_kfunc_ids) static const struct btf_kfunc_id_set bpf_cpuacct_kfunc_set = { .owner = THIS_MODULE, diff --git a/net/core/filter.c b/net/core/filter.c index d32c0000d345..80ca2b2d1f0b 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -12174,13 +12174,13 @@ BTF_ID_FLAGS(func, bpf_sock_addr_set_sun_path) BTF_KFUNCS_END(bpf_kfunc_check_set_sock_addr) #ifdef CONFIG_HISOCK -BTF_SET8_START(bpf_kfunc_check_set_sock_ops) +BTF_KFUNCS_START(bpf_kfunc_check_set_sock_ops) BTF_ID_FLAGS(func, bpf_skops_get_ingress_dst, KF_RET_NULL) -BTF_SET8_END(bpf_kfunc_check_set_sock_ops) +BTF_KFUNCS_END(bpf_kfunc_check_set_sock_ops) -BTF_SET8_START(bpf_kfunc_check_set_hisock) +BTF_KFUNCS_START(bpf_kfunc_check_set_hisock) BTF_ID_FLAGS(func, bpf_skb_change_dev) -BTF_SET8_END(bpf_kfunc_check_set_hisock) +BTF_KFUNCS_END(bpf_kfunc_check_set_hisock) #endif static const struct btf_kfunc_id_set bpf_kfunc_set_skb = { diff --git a/net/mptcp/bpf.c b/net/mptcp/bpf.c index 8a16672b94e2..9a52a76bd368 100644 --- a/net/mptcp/bpf.c +++ b/net/mptcp/bpf.c @@ -20,9 +20,9 @@ struct mptcp_sock *bpf_mptcp_sock_from_subflow(struct sock *sk) return NULL; } -BTF_SET8_START(bpf_mptcp_fmodret_ids) +BTF_KFUNCS_START(bpf_mptcp_fmodret_ids) BTF_ID_FLAGS(func, update_socket_protocol) -BTF_SET8_END(bpf_mptcp_fmodret_ids) +BTF_KFUNCS_END(bpf_mptcp_fmodret_ids) static const struct btf_kfunc_id_set bpf_mptcp_fmodret_set = { .owner = THIS_MODULE, -- 2.34.1

2 1

[PATCH OLK-5.10] xfs: validate attr entry pointer before field access
by Yang Erkun 22 Sep '26

22 Sep '26

From: Hongling Zeng <zenghongling(a)kylinos.cn> stable inclusion from stable-v5.10.267 commit 0f82586741e39926542f621bafa424e237a04fa4 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18651 CVE: CVE-2026-80805 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit b7eea80be25f3334f131d52982b3131aba77b97d upstream. xfs_attr3_leaf_verify_entry() accesses lentry/rentry fields (namelen, valuelen) before checking if the entry pointer itself is within bounds. If nameidx is crafted to point near the end of the buffer, these field accesses can read out-of-bounds before the bounds check at name_end > buf_end is performed. Add explicit bounds checks for entry pointers before accessing their fields. Use offsetof() to check that the start of the flexible array member (nameval/name) is within bounds, which ensures all preceding fields are safe to access. Fixes: c84760659dcf2 ("xfs: check attribute leaf block structure") Cc: <stable(a)vger.kernel.org> # v5.5 Signed-off-by: Hongling Zeng <zenghongling(a)kylinos.cn> Reviewed-by: Darrick J. Wong <djwong(a)kernel.org> Signed-off-by: Carlos Maiolino <cem(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Erkun <yangerkun(a)huawei.com> --- fs/xfs/libxfs/xfs_attr_leaf.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/fs/xfs/libxfs/xfs_attr_leaf.c b/fs/xfs/libxfs/xfs_attr_leaf.c index 3da4643b26cb..3f1bd0e38c9d 100644 --- a/fs/xfs/libxfs/xfs_attr_leaf.c +++ b/fs/xfs/libxfs/xfs_attr_leaf.c @@ -265,6 +265,13 @@ xfs_attr3_leaf_verify_entry( */ if (ent->flags & XFS_ATTR_LOCAL) { lentry = xfs_attr3_leaf_name_local(leaf, idx); + + /* Validate lentry pointer is within bounds before field access */ + if ((char *)lentry >= buf_end) + return __this_address; + if ((char *)lentry + offsetof(struct xfs_attr_leaf_name_local, nameval) > buf_end) + return __this_address; + namesize = xfs_attr_leaf_entsize_local(lentry->namelen, be16_to_cpu(lentry->valuelen)); name_end = (char *)lentry + namesize; @@ -272,6 +279,13 @@ xfs_attr3_leaf_verify_entry( return __this_address; } else { rentry = xfs_attr3_leaf_name_remote(leaf, idx); + + /* Validate rentry pointer is within bounds before field access */ + if ((char *)rentry >= buf_end) + return __this_address; + if ((char *)rentry + offsetof(struct xfs_attr_leaf_name_remote, name) > buf_end) + return __this_address; + namesize = xfs_attr_leaf_entsize_remote(rentry->namelen); name_end = (char *)rentry + namesize; if (rentry->namelen == 0) -- 2.52.0

2 1

[PATCH openEuler-1.0-LTS] inetpeer: randomize RB-tree node comparison using SipHash
by JiangJieHua 22 Sep '26

22 Sep '26

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v7.3-rc1 commit 2ee66e9487172fcd189bc52a767c30dad7141c09 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19402 CVE: CVE-2026-90110 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The inetpeer rate limiting system stores peer entries in a Red-Black tree keyed deterministically on the remote IP address. Because tree lookups walk the RB-tree using standard lexicographical comparisons (inetpeer_addr_cmp), an off-path adversary can predict the exact topology of the tree and the sequence of nodes traversed during lookups (the gc_stack candidate list). By combining deterministic tree traversal with aggressive garbage collection (triggered when tree size exceeds inet_peer_threshold), an attacker can selectively force the eviction of targeted inet_peer nodes. When an evicted node is subsequently re-created upon receiving a new packet, its rate-limiting token bucket (rate_tokens, rate_last) is reset to full capacity. This creates a side-channel primitive allowing off-path attackers to bypass IP-keyed ICMP rate limits and infer open UDP ports (similar to SAD DNS style attacks). Mitigate this by randomizing the RB-tree node comparison logic using SipHash with a secret key (inetpeer_hash_key) initialized via net_get_random_once(). Nodes are ordered in the tree by SipHash(addr, key) rather than raw IP addresses. Because the secret key is unknown to external entities, the tree layout and lookup traversal paths are unpredictable to off-path adversaries, breaking the deterministic eviction gadget. Cache the computed 64-bit SipHash (hash) in struct inet_peer and compute the target hash (dhash) once at the beginning of inet_getpeer() to avoid recomputing SipHash at every step of the RB-tree walk. Fixes: b145425f269a ("inetpeer: remove AVL implementation in favor of RB tree") Reported-by: Michael Blunt <michaelbblunt(a)gmail.com> Suggested-by: Michael Blunt <michaelbblunt(a)gmail.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/20260818151213.3953963-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv4/inetpeer.c [Conflicts are caused by the following patches not being merged: inet_getpeer() still keeps the create argument and the invalidated/read_seqretry/rcu_read_lock layout: 7a596a50c4a4 ("inetpeer: remove create argument of inet_getpeer()") a853c609504e ("inetpeer: do not get a refcount in inet_getpeer()")] Signed-off-by: JiangJieHua <jiangjiehua1(a)huawei.com> --- include/net/inetpeer.h | 4 ++++ net/ipv4/inetpeer.c | 38 +++++++++++++++++++++++++++++++++++--- 2 files changed, 39 insertions(+), 3 deletions(-) diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h index 74ff688568a0c..66b48d4266fbb 100644 --- a/include/net/inetpeer.h +++ b/include/net/inetpeer.h @@ -35,6 +35,7 @@ struct inetpeer_addr { struct inet_peer { struct rb_node rb_node; + u64 hash; struct inetpeer_addr daddr; u32 metrics[RTAX_MAX]; @@ -127,6 +128,9 @@ static inline int inetpeer_addr_cmp(const struct inetpeer_addr *a, { int i, n; + if (a->family != b->family) + return a->family < b->family ? -1 : 1; + if (a->family == AF_INET) n = sizeof(a->a4) / sizeof(u32); else diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c index a18668552d33d..2b50a64e39a71 100644 --- a/net/ipv4/inetpeer.c +++ b/net/ipv4/inetpeer.c @@ -22,6 +22,7 @@ #include <net/ip.h> #include <net/inetpeer.h> #include <net/secure_seq.h> +#include <linux/siphash.h> /* * Theory of operations. @@ -53,6 +54,34 @@ */ static struct kmem_cache *peer_cachep __ro_after_init; +static siphash_aligned_key_t inetpeer_hash_key __read_mostly; + +static u64 inetpeer_addr_hash(const struct inetpeer_addr *a) +{ + net_get_random_once(&inetpeer_hash_key, sizeof(inetpeer_hash_key)); + + if (a->family == AF_INET) + return siphash_2u32((__force u32)a->a4.addr, a->a4.vif, + &inetpeer_hash_key); + + return siphash_4u32((__force u32)a->a6.s6_addr32[0], + (__force u32)a->a6.s6_addr32[1], + (__force u32)a->a6.s6_addr32[2], + (__force u32)a->a6.s6_addr32[3], + &inetpeer_hash_key); +} + +static int inetpeer_entry_cmp(u64 dhash, + const struct inetpeer_addr *daddr, + const struct inet_peer *p) +{ + if (dhash < p->hash) + return -1; + if (dhash > p->hash) + return 1; + + return inetpeer_addr_cmp(daddr, &p->daddr); +} void inet_peer_base_init(struct inet_peer_base *bp) { @@ -96,6 +125,7 @@ void __init inet_initpeers(void) /* Called with rcu_read_lock() or base->lock held */ static struct inet_peer *lookup(const struct inetpeer_addr *daddr, + u64 dhash, struct inet_peer_base *base, unsigned int seq, struct inet_peer *gc_stack[], @@ -116,7 +146,7 @@ static struct inet_peer *lookup(const struct inetpeer_addr *daddr, break; parent = next; p = rb_entry(parent, struct inet_peer, rb_node); - cmp = inetpeer_addr_cmp(daddr, &p->daddr); + cmp = inetpeer_entry_cmp(dhash, daddr, p); if (cmp == 0) { if (!refcount_inc_not_zero(&p->refcnt)) break; @@ -188,6 +218,7 @@ struct inet_peer *inet_getpeer(struct inet_peer_base *base, int create) { struct inet_peer *p, *gc_stack[PEER_MAX_GC]; + u64 dhash = inetpeer_addr_hash(daddr); struct rb_node **pp, *parent; unsigned int gc_cnt, seq; int invalidated; @@ -197,7 +228,7 @@ struct inet_peer *inet_getpeer(struct inet_peer_base *base, */ rcu_read_lock(); seq = read_seqbegin(&base->lock); - p = lookup(daddr, base, seq, NULL, &gc_cnt, &parent, &pp); + p = lookup(daddr, dhash, base, seq, NULL, &gc_cnt, &parent, &pp); invalidated = read_seqretry(&base->lock, seq); rcu_read_unlock(); @@ -215,11 +246,12 @@ struct inet_peer *inet_getpeer(struct inet_peer_base *base, write_seqlock_bh(&base->lock); gc_cnt = 0; - p = lookup(daddr, base, seq, gc_stack, &gc_cnt, &parent, &pp); + p = lookup(daddr, dhash, base, seq, gc_stack, &gc_cnt, &parent, &pp); if (!p && create) { p = kmem_cache_alloc(peer_cachep, GFP_ATOMIC); if (p) { p->daddr = *daddr; + p->hash = dhash; p->dtime = (__u32)jiffies; refcount_set(&p->refcnt, 2); atomic_set(&p->rid, 0); -- 2.33.8

2 1

[PATCH OLK-5.10] ext4: don't enable DAX on new encrypted files
by Yang Erkun 22 Sep '26

22 Sep '26

From: Eric Biggers <ebiggers(a)kernel.org> stable inclusion from stable-v5.10.269 commit add98959b220935b243170214c787bc03044a44d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18652 CVE: CVE-2026-80806 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit da32af420d6d466e247c43ac0b829edeac7ae0ad upstream. Currently, when a new encrypted regular file is created, the call to ext4_set_inode_flags(inode, init=true) in __ext4_new_inode() is made before EXT4_INODE_ENCRYPT is set. As a result, it can set S_DAX if the filesystem is mounted with "-o dax=always". EXT4_INODE_ENCRYPT then actually gets set a bit later in __ext4_new_inode(), when it calls fscrypt_set_context() which calls ext4_set_context(). ext4_set_context() sets EXT4_INODE_ENCRYPT and calls ext4_set_inode_flags(inode, init=false) to set S_ENCRYPTED too. This was intended to clear S_DAX as well. However, this was broken by commit 043546e46dc7 ("fs/ext4: Only change S_DAX on inode load"). This causes data written to the file to bypass encryption, also causing xfstests failures such as generic/548 (when "-o dax=always" is used). Fix this by simplifying the flow by making __ext4_new_inode() set EXT4_INODE_ENCRYPT earlier. This makes it take effect in ext4_set_inode_flags(inode, init=true), making S_DAX never be set. Similarly, make EXT4_STATE_MAY_INLINE_DATA never be set in the first place on new encrypted inodes. Then it doesn't need to be cleared. As a result of these simplifications, ext4_set_context() no longer needs to change inode flags or state when 'handle != NULL'. Remove that too. Reported-by: Disha Goel <disgoel(a)linux.ibm.com> Reported-by: Ojaswin Mujoo <ojaswin(a)linux.ibm.com> Closes: https://lore.kernel.org/r/20260723085648.1500357-1-ojaswin@linux.ibm.com Fixes: 043546e46dc7 ("fs/ext4: Only change S_DAX on inode load") Cc: stable(a)vger.kernel.org Signed-off-by: Eric Biggers <ebiggers(a)kernel.org> Tested-by: Disha Goel <disgoel(a)linux.ibm.com> Reviewed-by: Ojaswin Mujoo <ojaswin(a)linux.ibm.com> Reviewed-by: Jan Kara <jack(a)suse.cz> Link: https://patch.msgid.link/20260730175212.36923-1-ebiggers@kernel.org Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yang Erkun <yangerkun(a)huawei.com> --- fs/ext4/ialloc.c | 4 ++++ fs/ext4/super.c | 40 ++++++++++++++++++++-------------------- 2 files changed, 24 insertions(+), 20 deletions(-) diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c index b0d0ca8f4389..97077402253f 100644 --- a/fs/ext4/ialloc.c +++ b/fs/ext4/ialloc.c @@ -986,6 +986,8 @@ struct inode *__ext4_new_inode(handle_t *handle, struct inode *dir, err = fscrypt_prepare_new_inode(dir, inode, &encrypt); if (err) goto out; + if (encrypt) + i_flags |= EXT4_ENCRYPT_FL; } err = dquot_initialize(inode); @@ -1298,6 +1300,8 @@ struct inode *__ext4_new_inode(handle_t *handle, struct inode *dir, ei->i_extra_isize = sbi->s_want_extra_isize; ei->i_inline_off = 0; if (ext4_has_feature_inline_data(sb) && + /* Encrypted inodes cannot have inline data */ + !(ei->i_flags & EXT4_ENCRYPT_FL) && (!(ei->i_flags & EXT4_DAX_FL) || S_ISDIR(mode))) ext4_set_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA); ret = inode; diff --git a/fs/ext4/super.c b/fs/ext4/super.c index 35df5a3f84e3..c4bf643a0fd0 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -1565,7 +1565,13 @@ static int ext4_set_context(struct inode *inode, const void *ctx, size_t len, if (inode->i_ino == EXT4_ROOT_INO) return -EPERM; - if (WARN_ON_ONCE(IS_DAX(inode) && i_size_read(inode))) + /* + * For new encrypted inodes, S_DAX is never set in the first place. + * + * For existing inodes, this is called only on empty directories. ext4 + * never sets S_DAX on directories. + */ + if (WARN_ON_ONCE(IS_DAX(inode))) return -EINVAL; if (ext4_test_inode_flag(inode, EXT4_INODE_DAX)) @@ -1584,21 +1590,18 @@ static int ext4_set_context(struct inode *inode, const void *ctx, size_t len, */ if (handle) { - res = ext4_xattr_set_handle(handle, inode, - EXT4_XATTR_INDEX_ENCRYPTION, - EXT4_XATTR_NAME_ENCRYPTION_CONTEXT, - ctx, len, 0); - if (!res) { - ext4_set_inode_flag(inode, EXT4_INODE_ENCRYPT); - ext4_clear_inode_state(inode, - EXT4_STATE_MAY_INLINE_DATA); - /* - * Update inode->i_flags - S_ENCRYPTED will be enabled, - * S_DAX may be disabled - */ - ext4_set_inode_flags(inode, false); - } - return res; + /* + * __ext4_new_inode() should have already set the encrypt flag + * on the inode and avoided enabling inline data. + */ + if (WARN_ON_ONCE(!IS_ENCRYPTED(inode))) + return -EINVAL; + if (WARN_ON_ONCE(ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA))) + return -EINVAL; + return ext4_xattr_set_handle(handle, inode, + EXT4_XATTR_INDEX_ENCRYPTION, + EXT4_XATTR_NAME_ENCRYPTION_CONTEXT, + ctx, len, 0); } res = dquot_initialize(inode); @@ -1619,10 +1622,7 @@ static int ext4_set_context(struct inode *inode, const void *ctx, size_t len, ctx, len, 0); if (!res) { ext4_set_inode_flag(inode, EXT4_INODE_ENCRYPT); - /* - * Update inode->i_flags - S_ENCRYPTED will be enabled, - * S_DAX may be disabled - */ + /* Update inode->i_flags to set S_ENCRYPTED. */ ext4_set_inode_flags(inode, false); res = ext4_mark_inode_dirty(handle, inode); if (res) -- 2.52.0

2 1

[PATCH OLK-5.10] fuse: fix invalidate lock leak on open O_TRUNC DAX failure
by Yang Erkun 22 Sep '26

22 Sep '26

From: Baokun Li <libaokun(a)linux.alibaba.com> mainline inclusion from mainline-v7.3-rc1 commit a927f1867e61b78f39f9da0bbba3c98c2ca151fe category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18697 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- fuse_open() takes filemap_invalidate_lock() for a DAX truncate (dax_truncate = true) and releases it before the out_inode_unlock label. But when fuse_dax_break_layouts() fails, the goto out_inode_unlock skips the unlock and leaks the rwsem, so any later fault or truncate on the file stalls on the stale lock. fuse_dax_break_layouts() can fail with -ERESTARTSYS when a signal interrupts the wait for busy DAX pages to drain: open("file", O_RDWR | O_TRUNC) └─ fuse_open() ├─ filemap_invalidate_lock() # dax_truncate └─ fuse_dax_break_layouts() └─ dax_break_layout() └─ wait_page_idle() # TASK_INTERRUPTIBLE └─ fuse_wait_dax_page() # unlock, schedule, re-lock └─ signal → -ERESTARTSYS goto out_inode_unlock # <- lock leaked Fix this by moving filemap_invalidate_unlock() below the label so that all error paths release the lock, and rename the label to out_unlock as it now covers more than just the inode lock. Fixes: 2fdbb8dd0155 ("fuse: fix deadlock between atomic O_TRUNC and page invalidation") Cc: stable(a)vger.kernel.org # v6.0+ Signed-off-by: Baokun Li <libaokun(a)linux.alibaba.com> Signed-off-by: Miklos Szeredi <mszeredi(a)redhat.com> Conflicts: fs/fuse/file.c [The target tree still uses i_mmap_sem instead of filemap_invalidate_lock(), so relocate up_write(&i_mmap_sem) below the renamed out_unlock label.] Signed-off-by: Yang Erkun <yangerkun(a)huawei.com> --- fs/fuse/file.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/fuse/file.c b/fs/fuse/file.c index 87c8272d0e17..91fb1f67d6af 100644 --- a/fs/fuse/file.c +++ b/fs/fuse/file.c @@ -245,7 +245,7 @@ int fuse_open_common(struct inode *inode, struct file *file, bool isdir) down_write(&get_fuse_inode(inode)->i_mmap_sem); err = fuse_dax_break_layouts(inode, 0, 0); if (err) - goto out_inode_unlock; + goto out_unlock; } if (is_wb_truncate || dax_truncate) @@ -265,10 +265,10 @@ int fuse_open_common(struct inode *inode, struct file *file, bool isdir) else if (!(ff->open_flags & FOPEN_KEEP_CACHE)) invalidate_inode_pages2(inode->i_mapping); } +out_unlock: if (dax_truncate) up_write(&get_fuse_inode(inode)->i_mmap_sem); -out_inode_unlock: if (is_wb_truncate || dax_truncate) inode_unlock(inode); -- 2.52.0

2 1

[PATCH OLK-6.6] net: add missing ref_tracker_dir_exit() to alloc_netdev_mqs()
by JiangJieHua 22 Sep '26

22 Sep '26

From: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> mainline inclusion from mainline-v7.3-rc1 commit 0b1c2af8a22c35cb099c735c2f63ea3ba757557d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19412 CVE: CVE-2026-90135 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- sashiko is reporting that trying to read /sys/kernel/debug/ref_tracker/* causes use-afer-free crash when either alloc_percpu() or dev_addr_init() in alloc_netdev_mqs() failed, for commit 4d92b95ff2f9 ("net: add net device refcount tracker infrastructure") added ref_tracker_dir_exit() to only free_netdev() path. Closes: https://sashiko.dev/#/patchset/56c707e7-1fb0-43ec-b8fb-cf6f451e513e%40I-lov… Fixes: 4d92b95ff2f9 ("net: add net device refcount tracker infrastructure") Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://patch.msgid.link/b06ce35d-e7bc-47a5-8e0a-e82be7e4dd08@I-love.SAKURA… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/core/dev.c [Conflicts are caused by the following patches not being merged: 13cabc47f8ae ("netdevice: define and allocate &net_device _properly_")] Signed-off-by: JiangJieHua <jiangjiehua1(a)huawei.com> --- net/core/dev.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/core/dev.c b/net/core/dev.c index 662c22e15fc2d..42b30aaa61c10 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -11131,6 +11131,7 @@ struct net_device *alloc_netdev_mqs(int sizeof_priv, const char *name, free_percpu(dev->pcpu_refcnt); free_dev: #endif + ref_tracker_dir_exit(&dev->refcnt_tracker); netdev_freemem(dev); return NULL; } -- 2.33.8

2 1

[PATCH OLK-6.6] net: bridge: arp/nd proxy: fix reading neigh ha
by JiangJieHua 22 Sep '26

22 Sep '26

From: Nikolay Aleksandrov <razor(a)blackwall.org> mainline inclusion from mainline-v7.3-rc1 commit 57549ab9079122991dfa0f8248ca00e101e8e69b category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19399 CVE: CVE-2026-90106 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Currently neigh ha address is read directly, but that can result in torn/partial reads if the neigh is being updated. Use neigh_ha_snapshot to take a stable snapshot of the address. Fixes: 057658cb33fb ("bridge: suppress arp pkts on BR_NEIGH_SUPPRESS ports") Fixes: ed842faeb2bd ("bridge: suppress nd pkts on BR_NEIGH_SUPPRESS ports") Signed-off-by: Nikolay Aleksandrov <razor(a)blackwall.org> Reviewed-by: Petr Machata <petrm(a)nvidia.com> Reviewed-by: Ido Schimmel <idosch(a)nvidia.com> Link: https://patch.msgid.link/20260818150756.890025-2-razor@blackwall.org Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/bridge/br_arp_nd_proxy.c [Context differences are due to the following patches not being merged: fee1fc1d5a54 ("bridge: Do not suppress ARP probes and DAD NS unconditionally")] Signed-off-by: JiangJieHua <jiangjiehua1(a)huawei.com> --- net/bridge/br_arp_nd_proxy.c | 24 ++++++++++++++---------- 1 file changed, 14 insertions(+), 10 deletions(-) diff --git a/net/bridge/br_arp_nd_proxy.c b/net/bridge/br_arp_nd_proxy.c index 985aaf7ff1564..5aac37ed4f608 100644 --- a/net/bridge/br_arp_nd_proxy.c +++ b/net/bridge/br_arp_nd_proxy.c @@ -191,13 +191,15 @@ void br_do_proxy_suppress_arp(struct sk_buff *skb, struct net_bridge *br, n = neigh_lookup(&arp_tbl, &tip, vlandev); if (n) { struct net_bridge_fdb_entry *f; + u8 ha[ETH_ALEN] __aligned(2); if (!(READ_ONCE(n->nud_state) & NUD_VALID)) { neigh_release(n); return; } - f = br_fdb_find_rcu(br, n->ha, vid); + neigh_ha_snapshot(ha, n, n->dev); + f = br_fdb_find_rcu(br, ha, vid); if (f) { const struct net_bridge_port *dst = READ_ONCE(f->dst); bool replied = false; @@ -207,10 +209,10 @@ void br_do_proxy_suppress_arp(struct sk_buff *skb, struct net_bridge *br, br_is_neigh_suppress_enabled(dst, vid)) { if (!vid) br_arp_send(br, p, skb->dev, sip, tip, - sha, n->ha, sha, 0, 0); + sha, ha, sha, 0, 0); else br_arp_send(br, p, skb->dev, sip, tip, - sha, n->ha, sha, + sha, ha, sha, skb->vlan_proto, skb_vlan_tag_get(skb)); replied = true; @@ -248,7 +250,7 @@ struct nd_msg *br_is_nd_neigh_msg(struct sk_buff *skb, struct nd_msg *msg) } static void br_nd_send(struct net_bridge *br, struct net_bridge_port *p, - struct sk_buff *request, struct neighbour *n, + struct sk_buff *request, struct neighbour *n, u8 *ha, __be16 vlan_proto, u16 vlan_tci) { struct net_device *dev = request->dev; @@ -300,7 +302,7 @@ static void br_nd_send(struct net_bridge *br, struct net_bridge_port *p, /* Ethernet header */ ether_addr_copy(eth_hdr(reply)->h_dest, daddr); - ether_addr_copy(eth_hdr(reply)->h_source, n->ha); + ether_addr_copy(eth_hdr(reply)->h_source, ha); eth_hdr(reply)->h_proto = htons(ETH_P_IPV6); reply->protocol = htons(ETH_P_IPV6); @@ -330,7 +332,7 @@ static void br_nd_send(struct net_bridge *br, struct net_bridge_port *p, na->icmph.icmp6_override = 1; na->icmph.icmp6_solicited = 1; na->target = ns->target; - ether_addr_copy(&na->opt[2], n->ha); + ether_addr_copy(&na->opt[2], ha); na->opt[0] = ND_OPT_TARGET_LL_ADDR; na->opt[1] = na_olen >> 3; @@ -359,7 +361,7 @@ static void br_nd_send(struct net_bridge *br, struct net_bridge_port *p, __vlan_hwaccel_put_tag(reply, vlan_proto, vlan_tci); netdev_dbg(dev, "nd send dev %s dst %pI6 dst_hw %pM src %pI6 src_hw %pM\n", - dev->name, &pip6->daddr, daddr, &pip6->saddr, n->ha); + dev->name, &pip6->daddr, daddr, &pip6->saddr, ha); if (p) { dev_queue_xmit(reply); @@ -456,24 +458,26 @@ void br_do_suppress_nd(struct sk_buff *skb, struct net_bridge *br, n = neigh_lookup(ipv6_stub->nd_tbl, &msg->target, vlandev); if (n) { struct net_bridge_fdb_entry *f; + u8 ha[ETH_ALEN] __aligned(2); if (!(READ_ONCE(n->nud_state) & NUD_VALID)) { neigh_release(n); return; } - f = br_fdb_find_rcu(br, n->ha, vid); + neigh_ha_snapshot(ha, n, n->dev); + f = br_fdb_find_rcu(br, ha, vid); if (f) { const struct net_bridge_port *dst = READ_ONCE(f->dst); bool replied = false; if (br_is_neigh_suppress_enabled(dst, vid)) { if (vid != 0) - br_nd_send(br, p, skb, n, + br_nd_send(br, p, skb, n, ha, skb->vlan_proto, skb_vlan_tag_get(skb)); else - br_nd_send(br, p, skb, n, 0, 0); + br_nd_send(br, p, skb, n, ha, 0, 0); replied = true; } -- 2.33.8

2 1

[PATCH openEuler-1.0-LTS 0/5] CVE-2026-90049
by JiangJieHua 22 Sep '26

22 Sep '26

Mike Pattrick (2): openvswitch: Fix double reporting of drops in dropwatch openvswitch: Fix overreporting of drops in dropwatch Norbert Szetei (3): openvswitch: only skb_tx_error() a packet we are about to drop net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy() net: skbuff: don't touch shared zerocopy state in skb_tx_error() net/core/skbuff.c | 7 +++++-- net/openvswitch/datapath.c | 21 ++++++++++++++------- 2 files changed, 19 insertions(+), 9 deletions(-) -- 2.33.8

2 6

[PATCH OLK-6.6 0/2] Fix CVE-2026-90049
by JiangJieHua 22 Sep '26

22 Sep '26

Norbert Szetei (2): openvswitch: only skb_tx_error() a packet we are about to drop net: skbuff: don't skb_tx_error() the source skb in skb_zerocopy() net/core/skbuff.c | 5 ++--- net/openvswitch/datapath.c | 3 +-- 2 files changed, 3 insertions(+), 5 deletions(-) -- 2.33.8

2 3

[PATCH OLK-6.6 0/2] 89563
by JiangJieHua 22 Sep '26

22 Sep '26

Eric Dumazet (1): ip6_gre: check tunnel info before xmit in ip6gre_tunnel_xmit Zhiling Zou (1): ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit() net/ipv6/ip6_gre.c | 6 +++++- net/ipv6/ip6_tunnel.c | 15 ++------------- 2 files changed, 7 insertions(+), 14 deletions(-) -- 2.33.8

2 3

[PATCH OLK-6.6 0/2] Fix CVE-2026-89561
by JiangJieHua 22 Sep '26

22 Sep '26

Andrea Mayer (1): ipv6: rpl: fix NULL dereference of idev in ipv6_rpl_srh_rcv() Yue Haibing (1): ipv6: annotate data-races around devconf->rpl_seg_enabled net/ipv6/exthdrs.c | 32 ++++++++++++++------------------ 1 file changed, 14 insertions(+), 18 deletions(-) -- 2.33.8

2 3

[PATCH OLK-5.10 V1] HID: sensor-hub: Fix out-of-bounds write in sensor_hub_get_feature
by Yao Yiqi 22 Sep '26

22 Sep '26

From: Xingrui Li <baka9(a)bakabaka9.tech> stable inclusion from stable-v5.10.270 commit 1c0463f0f028801a933f090cd2695f132635b374 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18767 CVE: CVE-2026-89765 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c92693f3ed099401d0383ef35ca1fe1e6ba033de upstream. sensor_hub_get_feature() clamps its return value to the caller's buffer size, but the copy loop still copies field->report_size / 8 bytes for each report value. A malicious HID descriptor can advertise a large feature field size while an IIO caller supplies a small stack buffer, such as a single s32, causing an out-of-bounds write. HID core stores parsed report values in __s32 slots and clamps extracted values to 32 bits. Reject feature fields that require more than one slot per value, guard the total byte count calculation, and clamp each per-value copy to the remaining caller buffer. Fixes: 5459ada2b3cd69 ("HID: sensor-hub: Fix packing of result buffer for feature report") Cc: stable(a)kernel.org Assisted-by: OpenAI:GPT-5.5-Cyber Signed-off-by: Xingrui Li <baka9(a)bakabaka9.tech> Acked-by: Srinivas Pandruvada <srinivas.pandruvada(a)linux.intel.com> Signed-off-by: Jiri Kosina <jkosina(a)suse.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yao Yiqi <yaoyiqi3(a)huawei.com> --- drivers/hid/hid-sensor-hub.c | 42 +++++++++++++++++++++--------------- 1 file changed, 25 insertions(+), 17 deletions(-) diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c index f9983145d4e7..5b72b453191c 100644 --- a/drivers/hid/hid-sensor-hub.c +++ b/drivers/hid/hid-sensor-hub.c @@ -240,12 +240,17 @@ int sensor_hub_get_feature(struct hid_sensor_hub_device *hsdev, u32 report_id, u32 field_index, int buffer_size, void *buffer) { struct hid_report *report; + struct hid_field *field; struct sensor_hub_data *data = hid_get_drvdata(hsdev->hdev); - int report_size; + size_t field_size; + size_t report_size; + size_t copied = 0; + size_t to_copy; int ret = 0; - u8 *val_ptr; - int buffer_index = 0; - int i; + unsigned int i; + + if (!buffer || buffer_size <= 0) + return -EINVAL; memset(buffer, 0, buffer_size); @@ -259,26 +264,29 @@ int sensor_hub_get_feature(struct hid_sensor_hub_device *hsdev, u32 report_id, hid_hw_request(hsdev->hdev, report, HID_REQ_GET_REPORT); hid_hw_wait(hsdev->hdev); + field = report->field[field_index]; + /* calculate number of bytes required to read this field */ - report_size = DIV_ROUND_UP(report->field[field_index]->report_size, - 8) * - report->field[field_index]->report_count; - if (!report_size) { + field_size = DIV_ROUND_UP(field->report_size, 8); + /* HID core stores each parsed report value in a __s32 slot. */ + if (!field_size || field_size > sizeof(field->value[0])) { + ret = -EINVAL; + goto done_proc; + } + if (field->report_count > SIZE_MAX / field_size) { ret = -EINVAL; goto done_proc; } - ret = min(report_size, buffer_size); - val_ptr = (u8 *)report->field[field_index]->value; - for (i = 0; i < report->field[field_index]->report_count; ++i) { - if (buffer_index >= ret) - break; + report_size = field_size * field->report_count; + report_size = min_t(size_t, report_size, buffer_size); - memcpy(&((u8 *)buffer)[buffer_index], val_ptr, - report->field[field_index]->report_size / 8); - val_ptr += sizeof(__s32); - buffer_index += (report->field[field_index]->report_size / 8); + for (i = 0; i < field->report_count && copied < report_size; ++i) { + to_copy = min(field_size, report_size - copied); + memcpy(&((u8 *)buffer)[copied], &field->value[i], to_copy); + copied += to_copy; } + ret = copied; done_proc: mutex_unlock(&data->mutex); -- 2.34.1

2 1

[PATCH OLK-6.6 V1] timers/itimer: Zero-init old itimerval before copy to userspace
by Yao Yiqi 22 Sep '26

22 Sep '26

From: Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> stable inclusion from stable-v6.6.157 commit bdfda99c5763822a9a888e8af0ad7d9312ffcfe2 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18783 CVE: CVE-2026-89765 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 18c7d85864e554adc8fad1e8d2e9d2cb6c3911c8 upstream. On native sparc64, struct __kernel_old_timeval contains a four-byte hole after tv_usec because tv_sec is 64-bit while __kernel_suseconds_t is 32-bit. put_itimerval() fills only the named fields in a stack-allocated __kernel_old_itimerval and copies the entire object to userspace, so getitimer() can expose the two padding holes. Zero-initialize the aggregate before assigning the fields so implicit padding is deterministic before it crosses the user/kernel boundary. Signed-off-by: Jérémy Jean <Jeremy.Jean(a)oss.cyber.gouv.fr> Signed-off-by: Thomas Gleixner <tglx(a)kernel.org> Assisted-by: Codex:gpt-5 Cc: stable(a)vger.kernel.org Link: https://patch.msgid.link/20260809190428.1523014-1-Jeremy.Jean@oss.cyber.gou… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yao Yiqi <yaoyiqi3(a)huawei.com> --- kernel/time/itimer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/time/itimer.c b/kernel/time/itimer.c index 00629e658ca1..dc5b1d92e246 100644 --- a/kernel/time/itimer.c +++ b/kernel/time/itimer.c @@ -100,7 +100,7 @@ static int do_getitimer(int which, struct itimerspec64 *value) static int put_itimerval(struct __kernel_old_itimerval __user *o, const struct itimerspec64 *i) { - struct __kernel_old_itimerval v; + struct __kernel_old_itimerval v = {}; v.it_interval.tv_sec = i->it_interval.tv_sec; v.it_interval.tv_usec = i->it_interval.tv_nsec / NSEC_PER_USEC; -- 2.34.1

2 1

[PATCH OLK-5.10 V1 0/4] Fix CVE-2026-90329
by Yao Yiqi 22 Sep '26

22 Sep '26

CVE-2026-90329 patch has 2 dependencies and 1 fix. Dan Carpenter (1): HID: fix an error code in hid_check_device_match() Dmitry Torokhov (2): HID: split apart hid_device_probe to make logic more apparent HID: ensure timely release of driver-allocated resources Yousef Alhouseen (1): HID: synchronize input before cleaning up a failed probe drivers/hid/hid-core.c | 120 +++++++++++++++++++++++++---------------- include/linux/hid.h | 1 + 2 files changed, 74 insertions(+), 47 deletions(-) -- 2.34.1

2 5

[PATCH OLK-5.10 V1] Bluetooth: SCO: hold sk properly in sco_conn_ready
by Yao Yiqi 22 Sep '26

22 Sep '26

From: Pauli Virtanen <pav(a)iki.fi> stable inclusion from stable-v6.6.145 commit d141d9b769bcd1b747898528c5023270cda040f2 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19595 CVE: CVE-2026-89774 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 4e37f6452d586b95c346a9abdd2fb80b67794f39 upstream. sk deref in sco_conn_ready must be done either under conn->lock, or holding a refcount, to avoid concurrent close. conn->sk and parent sk is currently accessed without either, and without checking parent->sk_state: [Task 1] [Task 2] sco_sock_release sco_conn_ready sk = conn->sk lock_sock(sk) conn->sk = NULL lock_sock(sk) release_sock(sk) sco_sock_kill(sk) UAF on sk deref and similarly for access to sco_get_sock_listen() return value. Fix possible UAF by holding sk refcount in sco_conn_ready() and making sco_get_sock_listen() increase refcount. Also recheck after lock_sock that the socket is still valid. Adjust conn->sk locking so it's protected also by lock_sock() of the associated socket if any. Fixes: 27c24fda62b60 ("Bluetooth: switch to lock_sock in SCO") Signed-off-by: Pauli Virtanen <pav(a)iki.fi> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: net/bluetooth/sco.c [ Context conflicts ] Signed-off-by: Yao Yiqi <yaoyiqi3(a)huawei.com> --- net/bluetooth/sco.c | 42 ++++++++++++++++++++++++++++++------------ 1 file changed, 30 insertions(+), 12 deletions(-) diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c index 5dbd7e6e1481..33480cc5e853 100644 --- a/net/bluetooth/sco.c +++ b/net/bluetooth/sco.c @@ -372,9 +372,13 @@ static struct sock *sco_get_sock_listen(bdaddr_t *src) sk1 = sk; } + sk = sk ? sk : sk1; + if (sk) + sock_hold(sk); + read_unlock(&sco_sk_list.lock); - return sk ? sk : sk1; + return sk; } static void sco_sock_destruct(struct sock *sk) @@ -1108,17 +1112,28 @@ static int sco_sock_release(struct socket *sock) static void sco_conn_ready(struct sco_conn *conn) { - struct sock *parent; - struct sock *sk = conn->sk; + struct sock *parent, *sk; + + sco_conn_lock(conn); + sk = sco_sock_hold(conn); + sco_conn_unlock(conn); BT_DBG("conn %p", conn); if (sk) { - sco_sock_clear_timer(sk); lock_sock(sk); - sk->sk_state = BT_CONNECTED; - sk->sk_state_change(sk); + + /* conn->sk may have become NULL if racing with sk close, but + * due to held hdev->lock, it can't become different sk. + */ + if (conn->sk) { + sco_sock_clear_timer(sk); + sk->sk_state = BT_CONNECTED; + sk->sk_state_change(sk); + } + release_sock(sk); + sock_put(sk); } else { sco_conn_lock(conn); @@ -1135,13 +1150,15 @@ static void sco_conn_ready(struct sco_conn *conn) lock_sock(parent); + /* hdev->lock guarantees conn->sk == NULL still here */ + + if (parent->sk_state != BT_LISTEN) + goto release; + sk = sco_sock_alloc(sock_net(parent), NULL, BTPROTO_SCO, GFP_ATOMIC, 0); - if (!sk) { - release_sock(parent); - sco_conn_unlock(conn); - return; - } + if (!sk) + goto release; sco_sock_init(sk, parent); @@ -1159,9 +1176,10 @@ static void sco_conn_ready(struct sco_conn *conn) /* Wake up parent */ parent->sk_data_ready(parent); +release: release_sock(parent); - sco_conn_unlock(conn); + sock_put(parent); } } -- 2.34.1

2 1