- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] wifi: mac80211: Don't finalize CSA in IBSS mode if state is disconnected
by Wang Liang 01 Jul '25

01 Jul '25

From: Siddh Raman Pant <code(a)siddh.me> stable inclusion from stable-v4.19.258 commit d9eb37db6a28b59a95a3461450ee209654c5f95b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICG9HM CVE: CVE-2022-49942 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 15bc8966b6d3a5b9bfe4c9facfa02f2b69b1e5f0 upstream. When we are not connected to a channel, sending channel "switch" announcement doesn't make any sense. The BSS list is empty in that case. This causes the for loop in cfg80211_get_bss() to be bypassed, so the function returns NULL (check line 1424 of net/wireless/scan.c), causing the WARN_ON() in ieee80211_ibss_csa_beacon() to get triggered (check line 500 of net/mac80211/ibss.c), which was consequently reported on the syzkaller dashboard. Thus, check if we have an existing connection before generating the CSA beacon in ieee80211_ibss_finish_csa(). Cc: stable(a)vger.kernel.org Fixes: cd7760e62c2a ("mac80211: add support for CSA in IBSS mode") Link: https://syzkaller.appspot.com/bug?id=05603ef4ae8926761b678d2939a3b2ad28ab9c… Reported-by: syzbot+b6c9fe29aefe68e4ad34(a)syzkaller.appspotmail.com Signed-off-by: Siddh Raman Pant <code(a)siddh.me> Tested-by: syzbot+b6c9fe29aefe68e4ad34(a)syzkaller.appspotmail.com Link: https://lore.kernel.org/r/20220814151512.9985-1-code@siddh.me Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/mac80211/ibss.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c index f0f5fedb8caa..480902335b44 100644 --- a/net/mac80211/ibss.c +++ b/net/mac80211/ibss.c @@ -544,6 +544,10 @@ int ieee80211_ibss_finish_csa(struct ieee80211_sub_if_data *sdata) sdata_assert_lock(sdata); + /* When not connected/joined, sending CSA doesn't make sense. */ + if (ifibss->state != IEEE80211_IBSS_MLME_JOINED) + return -ENOLINK; + /* update cfg80211 bss information with the new channel */ if (!is_zero_ether_addr(ifibss->bssid)) { cbss = cfg80211_get_bss(sdata->local->hw.wiphy, -- 2.34.1

2 1

[PATCH OLK-5.10 00/13] HiSock Redirect Framework
by Pu Lehui 01 Jul '25

01 Jul '25

Julien Thierry (1): arm64: insn: Add some opcodes to instruction decoder Pu Lehui (11): bpf: Add CONFIG_HISOCK bpf: Add XDP_HISOCK_REDIRECT action bpf: Add BPF_PROG_TYPE_HISOCK prog type bpf: Add HISOCK_EGRESS hook on network egress path bpf: Add bpf_get_ingress_dst helper bpf: Add hisock_xdp_buff wrapper for xdp_buff bpf: Add bpf_set_ingress_dst helper bpf: Add bpf_change_skb_dev helper bpf: Add bpf_ext_memcpy helper openeuler_defconfig: Enable CONFIG_HISOCK samples/bpf: Add HiSock Redirect Framework sample Xu Kuohai (1): bpf, arm64: Fixup bpf_ext_memcpy extension helper arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/insn.h | 13 + arch/arm64/kernel/insn.c | 8 + arch/arm64/net/bpf_jit.h | 15 + arch/arm64/net/bpf_jit_comp.c | 266 ++++++++++++++++ arch/x86/configs/openeuler_defconfig | 1 + include/linux/bpf-cgroup.h | 35 +++ include/linux/bpf_types.h | 4 + include/linux/filter.h | 3 + include/net/xdp.h | 5 + include/uapi/linux/bpf.h | 45 +++ kernel/bpf/cgroup.c | 43 +++ kernel/bpf/core.c | 7 + kernel/bpf/helpers.c | 27 ++ kernel/bpf/syscall.c | 19 ++ kernel/bpf/verifier.c | 28 ++ net/Kconfig | 10 + net/core/dev.c | 74 ++++- net/core/filter.c | 184 +++++++++++ net/ipv4/ip_output.c | 66 ++++ samples/bpf/.gitignore | 1 + samples/bpf/Makefile | 5 +- samples/bpf/hisock/bpf.c | 241 +++++++++++++++ samples/bpf/hisock/hisock_cmd.c | 405 +++++++++++++++++++++++++ tools/include/uapi/linux/bpf.h | 45 +++ tools/lib/bpf/libbpf.c | 2 + 26 files changed, 1549 insertions(+), 4 deletions(-) create mode 100644 samples/bpf/hisock/bpf.c create mode 100644 samples/bpf/hisock/hisock_cmd.c -- 2.34.1

2 14

[PATCH openEuler-1.0-LTS V1 0/2] hulk-4.19-fix-CVE-2022-49989
by Cheng Yu 01 Jul '25

01 Jul '25

hulk-4.19-fix-CVE-2022-49989 Juergen Gross (1): xen/privcmd: fix error exit of privcmd_ioctl_dm_op() Souptick Joarder (1): xen/privcmd: Corrected error handling path drivers/xen/privcmd.c | 42 +++++++++++++++++++++--------------------- 1 file changed, 21 insertions(+), 21 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10 v3 0/7] backport udp-4tuple-hash
by Liu Jian 01 Jul '25

01 Jul '25

backport udp-4tuple-hash Paolo Abeni (1): udp: fix l4 hash after reconnect Philo Lu (5): net/udp: Add a new struct for hash2 slot net/udp: Add 4-tuple hash list basis ipv4/udp: Add 4-tuple hash for connected socket ipv6/udp: Add 4-tuple hash for connected socket udp: Make rehash4 independent in udp_lib_rehash() Yue Haibing (1): inet6: Remove unused function declaration udpv6_connect() include/linux/udp.h | 12 ++ include/net/transp_v6.h | 2 - include/net/udp.h | 139 ++++++++++++++++++++++- net/ipv4/datagram.c | 8 +- net/ipv4/udp.c | 240 ++++++++++++++++++++++++++++++++++++---- net/ipv6/udp.c | 115 +++++++++++++++++-- 6 files changed, 475 insertions(+), 41 deletions(-) -- 2.34.1

2 8

[PATCH openEuler-1.0-LTS v3 0/7] backport udp-4tuple-hash
by Liu Jian 01 Jul '25

01 Jul '25

backport udp-4tuple-hash Paolo Abeni (1): udp: fix l4 hash after reconnect Philo Lu (5): net/udp: Add a new struct for hash2 slot net/udp: Add 4-tuple hash list basis ipv4/udp: Add 4-tuple hash for connected socket ipv6/udp: Add 4-tuple hash for connected socket udp: Make rehash4 independent in udp_lib_rehash() Yue Haibing (1): inet6: Remove unused function declaration udpv6_connect() include/linux/udp.h | 12 ++ include/net/transp_v6.h | 2 - include/net/udp.h | 139 +++++++++++++++++++++- net/ipv4/datagram.c | 8 +- net/ipv4/udp.c | 251 ++++++++++++++++++++++++++++++++++++---- net/ipv6/udp.c | 121 ++++++++++++++++--- 6 files changed, 484 insertions(+), 49 deletions(-) -- 2.34.1

2 8

[PATCH openEuler-1.0-LTS] mtd: maps: Fix refcount leak in ap_flash_init
by Yi Yang 01 Jul '25

01 Jul '25

From: Miaoqian Lin <linmq006(a)gmail.com> stable inclusion from stable-v4.19.256 commit d10855876a6f47add6ff621cef25cc0171dac162 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICGA0V CVE: CVE-2022-50160 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 77087a04c8fd554134bddcb8a9ff87b21f357926 ] of_find_matching_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak. Fixes: b0afd44bc192 ("mtd: physmap_of: add a hook for Versatile write protection") Signed-off-by: Miaoqian Lin <linmq006(a)gmail.com> Reviewed-by: Linus Walleij <linus.walleij(a)linaro.org> Signed-off-by: Miquel Raynal <miquel.raynal(a)bootlin.com> Link: https://lore.kernel.org/linux-mtd/20220523143255.4376-1-linmq006@gmail.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/mtd/maps/physmap_of_versatile.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/mtd/maps/physmap_of_versatile.c b/drivers/mtd/maps/physmap_of_versatile.c index 03f2b6e7bc7e..93cfe4071ea4 100644 --- a/drivers/mtd/maps/physmap_of_versatile.c +++ b/drivers/mtd/maps/physmap_of_versatile.c @@ -107,6 +107,7 @@ static int ap_flash_init(struct platform_device *pdev) return -ENODEV; } ebi_base = of_iomap(ebi, 0); + of_node_put(ebi); if (!ebi_base) return -ENODEV; -- 2.25.1

2 1

[PATCH OLK-5.10] nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu()
by Yi Yang 01 Jul '25

01 Jul '25

From: Maurizio Lombardi <mlombard(a)redhat.com> mainline inclusion from mainline-v6.14 commit ad95bab0cd28ed77c2c0d0b6e76e03e031391064 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBY43W CVE: CVE-2025-21927 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- nvme_tcp_recv_pdu() doesn't check the validity of the header length. When header digests are enabled, a target might send a packet with an invalid header length (e.g. 255), causing nvme_tcp_verify_hdgst() to access memory outside the allocated area and cause memory corruptions by overwriting it with the calculated digest. Fix this by rejecting packets with an unexpected header length. Fixes: 3f2304f8c6d6 ("nvme-tcp: add NVMe over TCP host driver") Signed-off-by: Maurizio Lombardi <mlombard(a)redhat.com> Reviewed-by: Sagi Grimberg <sagi(a)grimberg.me> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Conflicts: drivers/nvme/host/tcp.c [Confilcts dues to no backport of 363895767fbf("nvme-tcp: sanitize TLS key handling") and 84e009042d0f("nvme-tcp: add basic support for the C2HTermReq PDU")] Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/nvme/host/tcp.c | 32 +++++++++++++++++++++++++++++--- 1 file changed, 29 insertions(+), 3 deletions(-) diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c index 7be1da41081d..2ffb4df56d11 100644 --- a/drivers/nvme/host/tcp.c +++ b/drivers/nvme/host/tcp.c @@ -185,6 +185,19 @@ static inline int nvme_tcp_queue_id(struct nvme_tcp_queue *queue) return queue - queue->ctrl->queues; } +static inline bool nvme_tcp_recv_pdu_supported(enum nvme_tcp_pdu_type type) +{ + switch (type) { + case nvme_tcp_c2h_term: + case nvme_tcp_c2h_data: + case nvme_tcp_r2t: + case nvme_tcp_rsp: + return true; + default: + return false; + } +} + static inline struct blk_mq_tags *nvme_tcp_tagset(struct nvme_tcp_queue *queue) { u32 queue_idx = nvme_tcp_queue_id(queue); @@ -700,6 +713,16 @@ static int nvme_tcp_recv_pdu(struct nvme_tcp_queue *queue, struct sk_buff *skb, return 0; hdr = queue->pdu; + if (unlikely(hdr->hlen != sizeof(struct nvme_tcp_rsp_pdu))) { + if (!nvme_tcp_recv_pdu_supported(hdr->type)) + goto unsupported_pdu; + + dev_err(queue->ctrl->ctrl.device, + "pdu type %d has unexpected header length (%d)\n", + hdr->type, hdr->hlen); + return -EPROTO; + } + if (queue->hdr_digest) { ret = nvme_tcp_verify_hdgst(queue, queue->pdu, hdr->hlen); if (unlikely(ret)) @@ -723,10 +746,13 @@ static int nvme_tcp_recv_pdu(struct nvme_tcp_queue *queue, struct sk_buff *skb, nvme_tcp_init_recv_ctx(queue); return nvme_tcp_handle_r2t(queue, (void *)queue->pdu); default: - dev_err(queue->ctrl->ctrl.device, - "unsupported pdu type (%d)\n", hdr->type); - return -EINVAL; + goto unsupported_pdu; } + +unsupported_pdu: + dev_err(queue->ctrl->ctrl.device, + "unsupported pdu type (%d)\n", hdr->type); + return -EINVAL; } static inline void nvme_tcp_end_request(struct request *rq, u16 status) -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS V1] ALSA: bcd2000: Fix a UAF bug on the error path of probing
by Wang Tao 01 Jul '25

01 Jul '25

From: Zheyu Ma <zheyuma97(a)gmail.com> stable inclusion from stable-v4.19.256 commit 5e7338f4dd92b2f8915a82abfa1dd3ad3464bea0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICG792 CVE: CVE-2022-50229 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit ffb2759df7efbc00187bfd9d1072434a13a54139 upstream. When the driver fails in snd_card_register() at probe time, it will free the 'bcd2k->midi_out_urb' before killing it, which may cause a UAF bug. The following log can reveal it: [ 50.727020] BUG: KASAN: use-after-free in bcd2000_input_complete+0x1f1/0x2e0 [snd_bcd2000] [ 50.727623] Read of size 8 at addr ffff88810fab0e88 by task swapper/4/0 [ 50.729530] Call Trace: [ 50.732899] bcd2000_input_complete+0x1f1/0x2e0 [snd_bcd2000] Fix this by adding usb_kill_urb() before usb_free_urb(). Fixes: b47a22290d58 ("ALSA: MIDI driver for Behringer BCD2000 USB device") Signed-off-by: Zheyu Ma <zheyuma97(a)gmail.com> Cc: <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/20220715010515.2087925-1-zheyuma97@gmail.com Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Tao <wangtao554(a)huawei.com> --- sound/usb/bcd2000/bcd2000.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/sound/usb/bcd2000/bcd2000.c b/sound/usb/bcd2000/bcd2000.c index d6c8b29fe430..bdab5426aa17 100644 --- a/sound/usb/bcd2000/bcd2000.c +++ b/sound/usb/bcd2000/bcd2000.c @@ -357,7 +357,8 @@ static int bcd2000_init_midi(struct bcd2000 *bcd2k) static void bcd2000_free_usb_related_resources(struct bcd2000 *bcd2k, struct usb_interface *interface) { - /* usb_kill_urb not necessary, urb is aborted automatically */ + usb_kill_urb(bcd2k->midi_out_urb); + usb_kill_urb(bcd2k->midi_in_urb); usb_free_urb(bcd2k->midi_out_urb); usb_free_urb(bcd2k->midi_in_urb); -- 2.34.1

2 1

[PATCH OLK-6.6] config: Enable CONFIG_VIRT_DRIVERS
by Cai Xinchen 01 Jul '25

01 Jul '25

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8JVN0 -------------------------------- To use tsm report for arm cca guest, enable CONFIG_VIRT_DRIVERS in openeuler_defconfig by default. ARM_CCA_GUEST and TSM_REPORTS will open as module by default. CONFIG_VMGENID will enable by default. It is Compared with linux mainline that only two feature patches not backport: the commit e07606713a908 ("virt: vmgenid: change implementation to use a platform driver") and the commit 7b1bcd6b50a6 ("virt: vmgenid: add support for devicetree bindings"). Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index f048a1b098d1..40d22677320c 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -6491,7 +6491,7 @@ CONFIG_VFIO_PLATFORM=m # end of VFIO platform reset drivers # end of VFIO support for platform devices -# CONFIG_VIRT_DRIVERS is not set +CONFIG_VIRT_DRIVERS=y CONFIG_VIRTIO_ANCHOR=y CONFIG_VIRTIO=m CONFIG_VIRTIO_PCI_LIB=m -- 2.18.0.huawei.25

2 1

[PATCH openEuler-1.0-LTS] vt: Clear selection before changing the font
by Yi Yang 01 Jul '25

01 Jul '25

From: Helge Deller <deller(a)gmx.de> stable inclusion from stable-v4.19.258 commit f74b4a41c5d7c9522469917e3072e55d435efd9e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICG8T5 CVE: CVE-2022-49948 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 566f9c9f89337792070b5a6062dff448b3e7977f upstream. When changing the console font with ioctl(KDFONTOP) the new font size can be bigger than the previous font. A previous selection may thus now be outside of the new screen size and thus trigger out-of-bounds accesses to graphics memory if the selection is removed in vc_do_resize(). Prevent such out-of-memory accesses by dropping the selection before the various con_font_set() console handlers are called. Reported-by: syzbot+14b0e8f3fd1612e35350(a)syzkaller.appspotmail.com Cc: stable <stable(a)kernel.org> Tested-by: Khalid Masum <khalid.masum.92(a)gmail.com> Signed-off-by: Helge Deller <deller(a)gmx.de> Link: https://lore.kernel.org/r/YuV9apZGNmGfjcor@p100 Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/tty/vt/vt.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c index e547669c1471..abcacd377e09 100644 --- a/drivers/tty/vt/vt.c +++ b/drivers/tty/vt/vt.c @@ -4518,9 +4518,11 @@ static int con_font_set(struct vc_data *vc, struct console_font_op *op) console_lock(); if (vc->vc_mode != KD_TEXT) rc = -EINVAL; - else if (vc->vc_sw->con_font_set) + else if (vc->vc_sw->con_font_set) { + if (vc_is_sel(vc)) + clear_selection(); rc = vc->vc_sw->con_font_set(vc, &font, op->flags); - else + } else rc = -ENOSYS; console_unlock(); kfree(font.data); @@ -4547,9 +4549,11 @@ static int con_font_default(struct vc_data *vc, struct console_font_op *op) console_unlock(); return -EINVAL; } - if (vc->vc_sw->con_font_default) + if (vc->vc_sw->con_font_default) { + if (vc_is_sel(vc)) + clear_selection(); rc = vc->vc_sw->con_font_default(vc, &font, s); - else + } else rc = -ENOSYS; console_unlock(); if (!rc) { -- 2.25.1

2 1