- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] ceph: cap delegated inode count in ceph_parse_deleg_inos()
by Pan Taixi 23 Sep '26

23 Sep '26

From: Michael Bommarito <michael.bommarito(a)gmail.com> mainline inclusion from mainline-v7.3-rc1 commit 4bd3158bd62466d57ed72a3f7bc5f205fedd6919 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18927 CVE: CVE-2026-89648 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- ceph_parse_deleg_inos() decodes interval sets of delegated inode numbers from an MDS create-with-delegation reply. For each set it reads a 64-bit start and a 64-bit len with ceph_decode_64_safe(), which only validates that the eight bytes are present in the message, not the value, and then loops over len while inserting entries into s_delegated_inos. len is fully attacker controlled. A malicious or compromised MDS can send one huge interval, many intervals in one reply, duplicate intervals, or repeated replies that accumulate delegated inodes on the same session. The original code bounded none of these and could spin the insert loop or grow the xarray without limit. Bound both dimensions with a single enforcement point. Track the number of delegated inodes held by each MDS session in an atomic counter and grow it only in ceph_insert_deleg_ino(), which uses atomic_add_unless() to refuse to push the count past CEPH_MAX_DELEG_INOS. Because that helper is the only place the counter grows, the per-session population can never exceed the cap, so no separate per-session pre-check is needed. The counter is decremented when async create consumes a delegated inode or when an insert fails, incremented when a delegated inode is restored, initialized with the session xarray, and reset when reconnect destroys the xarray. A per-session cap alone still lets one reply spin the insert loop on duplicate ranges without growing the counter, so also cap the aggregate interval length accepted from a single reply. Together these bound both the loop trip count per reply and the xarray population across replies. The cap is a fixed, client-chosen constant rather than a value derived from the MDS. mds_client_prealloc_inos is a userspace MDS configuration option; it is never sent to the kernel client on the wire, and a server-supplied bound could not be trusted for a defensive limit in any case. The constant is set well above that option's documented default of 1000 (a generous multiple), so legitimate refill behavior is unaffected while the CPU and xarray memory a malformed delegation stream can consume stays bounded. Impact: a malicious or compromised Ceph MDS can no longer make a client spin through an unbounded delegated-inode interval or grow one session's delegated-inode xarray without limit. Cc: stable(a)vger.kernel.org Fixes: d48464878708 ("ceph: decode interval_sets for delegated inos") Suggested-by: Viacheslav Dubeyko <Slava.Dubeyko(a)ibm.com> Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko(a)ibm.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Conflicts: fs/ceph/mds_client.c [backport to OLK-5.10: context adjusted for this tree: pr_warn_ratelimited_client()/doutc() from 38d46409c4639 are not used here, so the new warnings use plain pr_warn_ratelimited() and the struct ceph_client *cl local is not added. The redundant 'ino' local (2ecd0edd13a8b not applied here) is dropped together with its only user, the open-coded xa_insert() in ceph_parse_deleg_inos(). CEPH_MAX_DELEG_INOS is inserted right after CEPH_INO_SYSTEM_BASE. s_num_deleg_inos is reset next to the existing xa_destroy() in send_mds_reconnect(), which still runs before mutex_lock(&session->s_mutex) in this tree (39fe30315893 not applied); this matches the linux-6.18.y stable backport c040e139f1a62.] Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com> --- fs/ceph/mds_client.c | 58 ++++++++++++++++++++++++++++++++++++++------ fs/ceph/mds_client.h | 1 + fs/ceph/super.h | 9 +++++++ 3 files changed, 61 insertions(+), 7 deletions(-) diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c index aea1b42b9b18..ef39852280c8 100644 --- a/fs/ceph/mds_client.c +++ b/fs/ceph/mds_client.c @@ -419,39 +419,80 @@ static int parse_reply_info_filelock(void **p, void *end, #if BITS_PER_LONG == 64 #define DELEGATED_INO_AVAILABLE xa_mk_value(1) +static int ceph_insert_deleg_ino(struct ceph_mds_session *s, u64 ino) +{ + int err; + + /* + * Cap how many delegated inodes a single session may hold. This is + * the only place that grows the count, so atomic_add_unless() bounds + * it at exactly CEPH_MAX_DELEG_INOS; s_num_deleg_inos can never exceed + * that. + */ + if (!atomic_add_unless(&s->s_num_deleg_inos, 1, CEPH_MAX_DELEG_INOS)) { + pr_warn_ratelimited("MDS session already holds %d delegated inodes\n", + CEPH_MAX_DELEG_INOS); + return -EOVERFLOW; + } + + err = xa_insert(&s->s_delegated_inos, ino, DELEGATED_INO_AVAILABLE, + GFP_KERNEL); + if (err) + atomic_dec(&s->s_num_deleg_inos); + return err; +} + static int ceph_parse_deleg_inos(void **p, void *end, struct ceph_mds_session *s) { + u64 msg_deleg_inos = 0; u32 sets; ceph_decode_32_safe(p, end, sets, bad); dout("got %u sets of delegated inodes\n", sets); while (sets--) { - u64 start, len, ino; + u64 start, len; ceph_decode_64_safe(p, end, start, bad); ceph_decode_64_safe(p, end, len, bad); /* Don't accept a delegation of system inodes */ if (start < CEPH_INO_SYSTEM_BASE) { pr_warn_ratelimited("ceph: ignoring reserved inode range delegation (start=0x%llx len=0x%llx)\n", start, len); continue; } + + /* + * Bound the number of inodes one reply may delegate. + * ceph_insert_deleg_ino() separately caps the per-session + * population, so this only has to stop one reply from spinning + * the insert loop under an attacker-controlled len. + */ + if (len > (u64)CEPH_MAX_DELEG_INOS || + msg_deleg_inos > (u64)CEPH_MAX_DELEG_INOS - len) { + pr_warn_ratelimited("MDS reply delegates too many inodes (have %llu, +%llu, max %d)\n", + msg_deleg_inos, len, CEPH_MAX_DELEG_INOS); + return -EIO; + } + msg_deleg_inos += len; + while (len--) { - int err = xa_insert(&s->s_delegated_inos, ino = start++, - DELEGATED_INO_AVAILABLE, - GFP_KERNEL); + int err = ceph_insert_deleg_ino(s, start++); + if (!err) { dout("added delegated inode 0x%llx\n", start - 1); } else if (err == -EBUSY) { pr_warn("ceph: MDS delegated inode 0x%llx more than once.\n", start - 1); + } else if (err == -EOVERFLOW) { + /* ceph_insert_deleg_ino() already warned. */ + return -EIO; } else { return err; } } } @@ -465,20 +506,21 @@ u64 ceph_get_deleg_ino(struct ceph_mds_session *s) unsigned long ino; void *val; xa_for_each(&s->s_delegated_inos, ino, val) { val = xa_erase(&s->s_delegated_inos, ino); - if (val == DELEGATED_INO_AVAILABLE) + if (val == DELEGATED_INO_AVAILABLE) { + atomic_dec(&s->s_num_deleg_inos); return ino; + } } return 0; } int ceph_restore_deleg_ino(struct ceph_mds_session *s, u64 ino) { - return xa_insert(&s->s_delegated_inos, ino, DELEGATED_INO_AVAILABLE, - GFP_KERNEL); + return ceph_insert_deleg_ino(s, ino); } #else /* BITS_PER_LONG == 64 */ /* * FIXME: xarrays can't handle 64-bit indexes on a 32-bit arch. For now, just * ignore delegated_inos on 32 bit arch. Maybe eventually add xarrays for top @@ -760,10 +802,11 @@ static struct ceph_mds_session *register_session(struct ceph_mds_client *mdsc, s->s_nr_caps = 0; refcount_set(&s->s_ref, 1); INIT_LIST_HEAD(&s->s_waiting); INIT_LIST_HEAD(&s->s_unsafe); xa_init(&s->s_delegated_inos); + atomic_set(&s->s_num_deleg_inos, 0); s->s_num_cap_releases = 0; s->s_cap_reconnect = 0; s->s_cap_iterator = NULL; INIT_LIST_HEAD(&s->s_cap_releases); INIT_WORK(&s->s_cap_release_work, ceph_cap_release_work); @@ -3908,10 +3951,11 @@ static void send_mds_reconnect(struct ceph_mds_client *mdsc, reply = ceph_msg_new2(CEPH_MSG_CLIENT_RECONNECT, 0, 1, GFP_NOFS, false); if (!reply) goto fail_nomsg; xa_destroy(&session->s_delegated_inos); + atomic_set(&session->s_num_deleg_inos, 0); mutex_lock(&session->s_mutex); session->s_state = CEPH_MDS_SESSION_RECONNECTING; session->s_seq = 0; diff --git a/fs/ceph/mds_client.h b/fs/ceph/mds_client.h index b1939f916228..847f04424be3 100644 --- a/fs/ceph/mds_client.h +++ b/fs/ceph/mds_client.h @@ -208,10 +208,11 @@ struct ceph_mds_session { u64 s_renew_seq; struct list_head s_waiting; /* waiting requests */ struct list_head s_unsafe; /* unsafe requests */ struct xarray s_delegated_inos; + atomic_t s_num_deleg_inos; }; /* * modes of choosing which MDS to send a request to */ diff --git a/fs/ceph/super.h b/fs/ceph/super.h index c0c5ed3e2718..6b2e0cfb9ae3 100644 --- a/fs/ceph/super.h +++ b/fs/ceph/super.h @@ -538,10 +538,19 @@ static inline int ceph_ino_compare(struct inode *inode, void *data) #define CEPH_MAX_MDS 0x100 #define CEPH_NUM_STRAY 10 #define CEPH_MDS_INO_MDSDIR_OFFSET (1 * CEPH_MAX_MDS) #define CEPH_INO_SYSTEM_BASE ((6*CEPH_MAX_MDS) + (CEPH_MAX_MDS * CEPH_NUM_STRAY)) +/* + * Upper bound on the number of delegated inodes a single MDS session may + * hold. The MDS normally hands out a small preallocation window (the + * userspace mds_client_prealloc_inos option defaults to 1000) and refills + * it as the client consumes entries. This leaves generous headroom while + * bounding the CPU and memory a malformed delegation interval can consume. + */ +#define CEPH_MAX_DELEG_INOS 8192 + static inline bool ceph_vino_is_reserved(const struct ceph_vino vino) { if (vino.ino < CEPH_INO_SYSTEM_BASE && vino.ino >= CEPH_MDS_INO_MDSDIR_OFFSET) { WARN_RATELIMIT(1, "Attempt to access reserved inode number 0x%llx", vino.ino); -- 2.34.1

2 1

[PATCH OLK-5.10] nvme-tcp: fix host memory disclosure on R2T for a read command
by Chen Yuxi 23 Sep '26

23 Sep '26

From: Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> mainline inclusion from mainline-v7.3-rc1 commit 6efbc52237facda35d2d874fe1765bb4839275d8 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18846 CVE: CVE-2026-89481 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- nvme_tcp_handle_r2t() does not check the direction of the request the R2T refers to. A malicious controller can send an R2T for a READ and the host will answer it: nvme_tcp_setup_h2c_data_pdu() builds the H2CData header and nvme_tcp_try_send_data() sends the request's data buffer. That buffer is the READ destination, so its contents go to the controller. The command then completes normally and nothing is logged. Against a test controller that answers every READ with an R2T, a 4096 byte buffered read returned all 4096 bytes, split over two R2Ts. The pages contained stale kernel data, including an array of struct page pointers. Reject an R2T for a request that is not a write. Fixes: 3f2304f8c6d6 ("nvme-tcp: add NVMe over TCP host driver") Cc: stable(a)vger.kernel.org Signed-off-by: Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Conflicts: drivers/nvme/host/tcp.c [Upstream commit 1d3ef9c3a39e ("nvme-tcp: validate R2T PDU in nvme_tcp_handle_r2t()") is not backported, so there is no standalone r2t_length check after req = blk_mq_rq_to_pdu(rq); insert the rq_data_dir() check right after it, before nvme_tcp_setup_h2c_data_pdu().] Signed-off-by: Chen Yuxi <chenyuxi19(a)huawei.com> --- drivers/nvme/host/tcp.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c index 89cef71def14..586f47e47b11 100644 --- a/drivers/nvme/host/tcp.c +++ b/drivers/nvme/host/tcp.c @@ -680,6 +680,13 @@ static int nvme_tcp_handle_r2t(struct nvme_tcp_queue *queue, } req = blk_mq_rq_to_pdu(rq); + if (unlikely(rq_data_dir(rq) != WRITE)) { + dev_err(queue->ctrl->ctrl.device, + "req %d unexpected r2t for a non-write command\n", + rq->tag); + return -EPROTO; + } + ret = nvme_tcp_setup_h2c_data_pdu(req, pdu); if (unlikely(ret)) return ret; -- 2.34.1

2 1

[PATCH OLK-5.10] lockd: pin next file across nlm_inspect_file lock-drop
by Pu Lehui 23 Sep '26

23 Sep '26

From: Michael Bommarito <michael.bommarito(a)gmail.com> stable inclusion from stable-v5.10.270 commit e3c413f789eaf0170275c7eba523ead73d963f30 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18850 CVE: CVE-2026-89485 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 526c49cff3f72c3ec74752016380c7567040581b upstream. nlm_traverse_files() pins the current file with f_count++ across a mutex_unlock for nlm_inspect_file(), but nothing pins the saved next pointer. A concurrent nlm_release_file() can kfree the next file during the unlock window, and the iterator dereferences freed memory on the next loop step. Pin both current and next before the lock-drop. Advance by swapping the pinned cursors at the end of each iteration so next is always held alive across the unlock. Always call nlm_file_release() after dropping the iteration pin, regardless of whether the file matched the predicate. Use nlm_file_inuse(), which does a live walk of the inode lock list, rather than the cached f_locks field, so skipped files that never ran nlm_inspect_file() are evaluated correctly. Because every file in a hash bucket is now pinned and released, files skipped by the is_failover_file predicate that have no locks, blocks, shares, or external references are deleted during traversal. The old code never evaluated skipped files for cleanup. The new behavior is intentional: such files are stale and should not persist in the table. Fixes: 01df9c5e918a ("LOCKD: Fix a deadlock in nlm_traverse_files()") Cc: stable(a)vger.kernel.org Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Link: https://patch.msgid.link/20260524115527.1734251-1-michael.bommarito@gmail.c… Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- fs/lockd/svcsubs.c | 55 ++++++++++++++++++++++++++-------------------- 1 file changed, 31 insertions(+), 24 deletions(-) diff --git a/fs/lockd/svcsubs.c b/fs/lockd/svcsubs.c index e64e0110f66b..9e2a67bfd070 100644 --- a/fs/lockd/svcsubs.c +++ b/fs/lockd/svcsubs.c @@ -286,12 +286,10 @@ nlm_file_inuse(struct nlm_file *file) return 0; } -static void nlm_close_files(struct nlm_file *file) +static void nlm_file_release(struct nlm_file *file) { - if (file->f_file[O_RDONLY]) - nlmsvc_ops->fclose(file->f_file[O_RDONLY]); - if (file->f_file[O_WRONLY]) - nlmsvc_ops->fclose(file->f_file[O_WRONLY]); + if (!nlm_file_inuse(file)) + nlm_delete_file(file); } /* @@ -301,32 +299,41 @@ static int nlm_traverse_files(void *data, nlm_host_match_fn_t match, int (*is_failover_file)(void *data, struct nlm_file *file)) { - struct hlist_node *next; - struct nlm_file *file; + struct nlm_file *file, *next; int i, ret = 0; mutex_lock(&nlm_file_mutex); for (i = 0; i < FILE_NRHASH; i++) { - hlist_for_each_entry_safe(file, next, &nlm_files[i], f_list) { - if (is_failover_file && !is_failover_file(data, file)) - continue; + file = hlist_entry_safe(nlm_files[i].first, + struct nlm_file, f_list); + if (file) file->f_count++; - mutex_unlock(&nlm_file_mutex); - - /* Traverse locks, blocks and shares of this file - * and update file->f_locks count */ - if (nlm_inspect_file(data, file, match)) - ret = 1; + while (file) { + /* + * Pin the next neighbour before we drop the mutex + * for nlm_inspect_file(); a concurrent + * nlm_release_file() under the same mutex would + * otherwise be free to unlink and kfree it during + * the unlock window, leaving us to dereference a + * freed slab when we walked to next afterwards. + */ + next = hlist_entry_safe(file->f_list.next, + struct nlm_file, f_list); + if (next) + next->f_count++; + + if (!is_failover_file || is_failover_file(data, file)) { + mutex_unlock(&nlm_file_mutex); + + if (nlm_inspect_file(data, file, match)) + ret = 1; + + mutex_lock(&nlm_file_mutex); + } - mutex_lock(&nlm_file_mutex); file->f_count--; - /* No more references to this file. Let go of it. */ - if (list_empty(&file->f_blocks) && !file->f_locks - && !file->f_shares && !file->f_count) { - hlist_del(&file->f_list); - nlm_close_files(file); - kfree(file); - } + nlm_file_release(file); + file = next; } } mutex_unlock(&nlm_file_mutex); -- 2.34.1

2 1

[PATCH OLK-5.10] [Backport] media: cec: disable delayed work before freeing an interrupted transmit
by Chen Jinghuang 23 Sep '26

23 Sep '26

From: Biren Pandya <birenpandya(a)gmail.com> mainline inclusion from mainline-v7.2-rc1 commit 0fbd5c2327020858c45b2d1c65775d64cdeca523 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19090 CVE: CVE-2026-89899 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- cec_transmit_msg_fh() drops adap->lock to wait for a blocking transmit in wait_for_completion_killable(). If that wait is interrupted by a signal, cancel_delayed_work_sync() can run before the CEC kthread arms the reply timeout via schedule_delayed_work(&data->work) in cec_transmit_done_ts(). The work is then armed after the cancel, and the data is freed with its delayed_work still pending: ODEBUG: free active (active state 0) object: ... hint: cec_wait_timeout Use disable_delayed_work_sync(): it cancels the work and disables it, so the later schedule_delayed_work() becomes a no-op and the work cannot be re-armed. The data is freed right after, so it need not be re-enabled. Fixes: 490d84f6d73c ("media: cec: forgot to cancel delayed work") Reported-by: syzbot+051024d603432b4ab395(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=051024d603432b4ab395 Suggested-by: Hillf Danton <hdanton(a)sina.com> Cc: stable(a)vger.kernel.org Signed-off-by: Biren Pandya <birenpandya(a)gmail.com> Signed-off-by: Hans Verkuil <hverkuil+cisco(a)kernel.org> Conflicts: drivers/media/cec/core/cec-adap.c [The 5.10 tree lacks the disable_delayed_work_sync() API (added in v6.9) and uses the older wait/!data->completed structure; keep the original cancel_delayed_work_sync() and, under adap->lock, cancel the reply-timeout work again before freeing, waiting for a running work without the lock (cec_wait_timeout() takes adap->lock) and re-cancelling after re-locking.] Signed-off-by: Chen Jinghuang <chenjinghuang2(a)huawei.com> --- drivers/media/cec/core/cec-adap.c | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) diff --git a/drivers/media/cec/core/cec-adap.c b/drivers/media/cec/core/cec-adap.c index eed962a9ff01..05329c40a58e 100644 --- a/drivers/media/cec/core/cec-adap.c +++ b/drivers/media/cec/core/cec-adap.c @@ -918,8 +918,24 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg, mutex_lock(&adap->lock); /* Cancel the transmit if it was interrupted */ - if (!data->completed) - cec_data_cancel(data, CEC_TX_STATUS_ABORTED); + if (!data->completed) { + /* + * The reply-timeout delayed work may have been armed by the + * CEC kthread after the cancel above. Cancel it under the lock; + * if it is already running it is blocked on adap->lock (as + * cec_wait_timeout() takes the lock itself), so wait for it + * without the lock like cec_receive_notify() does, then cancel + * again in case the kthread armed it in the meantime. + */ + if (!cancel_delayed_work(&data->work)) { + mutex_unlock(&adap->lock); + cancel_delayed_work_sync(&data->work); + mutex_lock(&adap->lock); + cancel_delayed_work(&data->work); + } + if (!data->completed) + cec_data_cancel(data, CEC_TX_STATUS_ABORTED); + } /* The transmit completed (possibly with an error) */ *msg = data->msg; -- 2.34.1

2 1

[PATCH OLK-6.6 0/6] CVE-2026-89799
by Pu Lehui 23 Sep '26

23 Sep '26

Andrii Nakryiko (1): bpf: decouple stack_map_get_build_id_offset() from perf_callchain_entry Jiri Olsa (5): bpf: Factor stackid_init function from __bpf_get_stackid bpf: Factor stackid_fastpath function from __bpf_get_stackid bpf: Factor stackid_new_bucket from __bpf_get_stackid bpf: Use stack id functions instead of __bpf_get_stackid bpf: Disable preemption in bpf_get_stackid kernel/bpf/stackmap.c | 214 ++++++++++++++++++++++++++++-------------- 1 file changed, 146 insertions(+), 68 deletions(-) -- 2.34.1

2 7

[PATCH OLK-5.10 0/8] CVE-2026-89799
by Pu Lehui 23 Sep '26

23 Sep '26

Andrii Nakryiko (1): bpf: decouple stack_map_get_build_id_offset() from perf_callchain_entry Arnaud Lecomte (2): bpf: Refactor stack map trace depth calculation into helper function bpf: Fix stackmap overflow check in __bpf_get_stackid() Jiri Olsa (5): bpf: Factor stackid_init function from __bpf_get_stackid bpf: Factor stackid_fastpath function from __bpf_get_stackid bpf: Factor stackid_new_bucket from __bpf_get_stackid bpf: Use stack id functions instead of __bpf_get_stackid bpf: Disable preemption in bpf_get_stackid kernel/bpf/stackmap.c | 265 +++++++++++++++++++++++++++++------------- 1 file changed, 184 insertions(+), 81 deletions(-) -- 2.34.1

2 9

[PATCH openEuler-1.0-LTS 0/2] CVE-2026-89847
by Yifan Qiao 23 Sep '26

23 Sep '26

Nilesh Javali (1): scsi: qla2xxx: Avoid double completion in async IOCB timeout Quinn Tran (1): scsi: qla2xxx: Fix fabric scan hang drivers/scsi/qla2xxx/qla_init.c | 55 +++++++++++++++++++++++++-------- drivers/scsi/qla2xxx/qla_iocb.c | 47 +++++++++++++++++++++++----- 2 files changed, 81 insertions(+), 21 deletions(-) -- 2.52.0

2 3

[PATCH OLK-6.6] nvme-tcp: check the data direction of a C2HData PDU
by Chen Yuxi 23 Sep '26

23 Sep '26

From: Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> stable inclusion from stable-v6.6.157 commit 0673a2affe45ca76b60de31a83c67b1e60f81bde category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19102 CVE: CVE-2026-89973 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------ commit f83af377c148f6ad94b41c0e8313f12adf45e1c1 upstream. nvme_tcp_handle_c2h_data() finds the request by command id and checks that it has a payload, but it does not check that the command asked for data to be read. A controller that answers a write command with C2HData therefore reaches nvme_tcp_recv_data(), where _copy_to_iter() hits WARN_ON_ONCE(i->data_source) and returns 0. The receive path turns that into -EFAULT and resets the controller. No data is copied, so this is not memory corruption. What a controller gets is a kernel warning it can raise at will, which is fatal on a host booted with panic_on_warn. The send path already knows the direction - it consults rq_data_dir() when it builds a command - and nvme_tcp_handle_r2t() checks the length and the offset of the request it names. The C2HData path does not check the direction at all. Reject a C2HData PDU whose command is not a read. Rejecting it fails the command and resets the controller, as the neighbouring check in this function does; what goes away is the warning. [ 6.885580] ------------[ cut here ]------------ [ 6.886457] WARNING: lib/iov_iter.c:193 at _copy_to_iter+0x289/0x1330, CPU#0: kworker/0:1H/71 [ 6.888137] CPU: 0 UID: 0 PID: 71 Comm: kworker/0:1H Not tainted 7.2.0-rc5-NVMETCP-gf5098b6bae76 #1 PREEMPT(lazy) [ 6.891165] Workqueue: nvme_tcp_wq nvme_tcp_io_work [ 6.891875] RIP: 0010:_copy_to_iter+0x289/0x1330 [ 6.903739] Call Trace: [ 6.904085] <TASK> [ 6.909254] __skb_datagram_iter+0x433/0x820 [ 6.911026] skb_copy_datagram_iter+0x37/0x120 [ 6.911622] nvme_tcp_recv_skb+0xa07/0x4320 [ 6.913378] __tcp_read_sock+0x1ab/0x810 [ 6.915788] nvme_tcp_try_recv+0x152/0x1e0 [ 6.918222] nvme_tcp_io_work+0x1e4/0x6c0 [ 6.926906] </TASK> [ 6.927226] ---[ end trace 0000000000000000 ]--- [ 6.927878] nvme nvme0: queue 1 failed to copy request 0x71 data [ 6.928709] nvme nvme0: receive failed: -14 Fixes: 3f2304f8c6d6 ("nvme-tcp: add NVMe over TCP host driver") Cc: stable(a)vger.kernel.org Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/nvme/host/tcp.c [Upstream commit 3a4aa9e6ad3e ("nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone") is not backported, so the payload check in nvme_tcp_handle_c2h_data() is still the plain blk_rq_payload_bytes() form; insert the rq_data_dir() check after the request lookup, before it.] Signed-off-by: Chen Yuxi <chenyuxi19(a)huawei.com> --- drivers/nvme/host/tcp.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c index 691338bf63ab..cd89be821763 100644 --- a/drivers/nvme/host/tcp.c +++ b/drivers/nvme/host/tcp.c @@ -597,6 +597,13 @@ static int nvme_tcp_handle_c2h_data(struct nvme_tcp_queue *queue, return -ENOENT; } + if (rq_data_dir(rq) != READ) { + dev_err(queue->ctrl->ctrl.device, + "queue %d tag %#x unexpected data for a write\n", + nvme_tcp_queue_id(queue), rq->tag); + return -EIO; + } + if (!blk_rq_payload_bytes(rq)) { dev_err(queue->ctrl->ctrl.device, "queue %d tag %#x unexpected data\n", -- 2.34.1

2 1

[PATCH OLK-5.10] nvme-tcp: check the data direction of a C2HData PDU
by Chen Yuxi 23 Sep '26

23 Sep '26

From: Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> stable inclusion from stable-v5.10.270 commit df74950ba6008655d4a977d17df7faf4b6e52b74 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19102 CVE: CVE-2026-89973 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f83af377c148f6ad94b41c0e8313f12adf45e1c1 upstream. nvme_tcp_handle_c2h_data() finds the request by command id and checks that it has a payload, but it does not check that the command asked for data to be read. A controller that answers a write command with C2HData therefore reaches nvme_tcp_recv_data(), where _copy_to_iter() hits WARN_ON_ONCE(i->data_source) and returns 0. The receive path turns that into -EFAULT and resets the controller. No data is copied, so this is not memory corruption. What a controller gets is a kernel warning it can raise at will, which is fatal on a host booted with panic_on_warn. The send path already knows the direction - it consults rq_data_dir() when it builds a command - and nvme_tcp_handle_r2t() checks the length and the offset of the request it names. The C2HData path does not check the direction at all. Reject a C2HData PDU whose command is not a read. Rejecting it fails the command and resets the controller, as the neighbouring check in this function does; what goes away is the warning. [ 6.885580] ------------[ cut here ]------------ [ 6.886457] WARNING: lib/iov_iter.c:193 at _copy_to_iter+0x289/0x1330, CPU#0: kworker/0:1H/71 [ 6.888137] CPU: 0 UID: 0 PID: 71 Comm: kworker/0:1H Not tainted 7.2.0-rc5-NVMETCP-gf5098b6bae76 #1 PREEMPT(lazy) [ 6.891165] Workqueue: nvme_tcp_wq nvme_tcp_io_work [ 6.891875] RIP: 0010:_copy_to_iter+0x289/0x1330 [ 6.903739] Call Trace: [ 6.904085] <TASK> [ 6.909254] __skb_datagram_iter+0x433/0x820 [ 6.911026] skb_copy_datagram_iter+0x37/0x120 [ 6.911622] nvme_tcp_recv_skb+0xa07/0x4320 [ 6.913378] __tcp_read_sock+0x1ab/0x810 [ 6.915788] nvme_tcp_try_recv+0x152/0x1e0 [ 6.918222] nvme_tcp_io_work+0x1e4/0x6c0 [ 6.926906] </TASK> [ 6.927226] ---[ end trace 0000000000000000 ]--- [ 6.927878] nvme nvme0: queue 1 failed to copy request 0x71 data [ 6.928709] nvme nvme0: receive failed: -14 Fixes: 3f2304f8c6d6 ("nvme-tcp: add NVMe over TCP host driver") Cc: stable(a)vger.kernel.org Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Yehyeong Lee <yhlee(a)isslab.korea.ac.kr> Signed-off-by: Keith Busch <kbusch(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/nvme/host/tcp.c [Upstream commit 3a4aa9e6ad3e ("nvme-tcp: do not accept C2HData based on blk_rq_payload_bytes() alone") is not backported, so the payload check in nvme_tcp_handle_c2h_data() is still the plain blk_rq_payload_bytes() form; insert the rq_data_dir() check after the request lookup, before it.] Signed-off-by: Chen Yuxi <chenyuxi19(a)huawei.com> --- drivers/nvme/host/tcp.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c index 89cef71def14..c9625e12c217 100644 --- a/drivers/nvme/host/tcp.c +++ b/drivers/nvme/host/tcp.c @@ -568,6 +568,13 @@ static int nvme_tcp_handle_c2h_data(struct nvme_tcp_queue *queue, return -ENOENT; } + if (rq_data_dir(rq) != READ) { + dev_err(queue->ctrl->ctrl.device, + "queue %d tag %#x unexpected data for a write\n", + nvme_tcp_queue_id(queue), rq->tag); + return -EIO; + } + if (!blk_rq_payload_bytes(rq)) { dev_err(queue->ctrl->ctrl.device, "queue %d tag %#x unexpected data\n", -- 2.34.1

2 1

[PATCH openEuler-26.09] bpf: Fix missing BTF_KFUNCS_START/END conversion for arch kfuncs
by Tengda Wu 23 Sep '26

23 Sep '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18731 ---------------------------------------- After 1cd6437b7dde ("bpf: treewide: Annotate BPF kfuncs in BTF"), all kfuncs should be wrapped by BTF_KFUNCS_START. However, some parts of the current kernel have not been replaced, resulting in the following warning being printed during boot: [ 12.642917] WARNING: CPU: 0 PID: 1 at kernel/bpf/btf.c:8264 register_btf_kfunc_id_set+0x48/0x50 [ 12.643646] Modules linked in: [ 12.644274] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.6.0+ #3 [ 12.644668] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 4 [ 12.645182] RIP: 0010:register_btf_kfunc_id_set+0x48/0x50 [ 12.645462] Code: 44 89 c7 e9 ca fb ff ff 89 ff 44 0f be 87 80 56 22 82 44 89 c7 e9 b8 fb ff ff 48 83 3e 00 74 0a b8 0 [ 12.645959] RSP: 0018:ffffc90000013e98 EFLAGS: 00000246 [ 12.646275] RAX: ffffffff8365bc00 RBX: 0000000000000000 RCX: 0000000000000000 [ 12.646576] RDX: 0000000000000000 RSI: ffffffff8220dc60 RDI: 000000000000001a [ 12.646755] RBP: ffffffff8332d190 R08: 0000000000000009 R09: 00000000248a5858 [ 12.646940] R10: 0000000014af4066 R11: 00000000abf468e2 R12: ffff888100a16900 [ 12.647390] R13: 0000000000000216 R14: 0000000000000000 R15: 0000000000000000 [ 12.647663] FS: 0000000000000000(0000) GS:ffff888237c00000(0000) knlGS:0000000000000000 [ 12.647925] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 12.648406] CR2: ffff88823ffff000 CR3: 0000000002a30000 CR4: 00000000000006f0 [ 12.648793] Call Trace: [ 12.649150] <TASK> [ 12.649411] do_one_initcall+0x48/0x220 [ 12.650216] kernel_init_freeable+0x1a9/0x2e0 [ 12.650435] ? __pfx_kernel_init+0x10/0x10 [ 12.650660] ? __pfx_kernel_init+0x10/0x10 [ 12.650880] kernel_init+0x1a/0x1c0 [ 12.651274] ret_from_fork+0xa4/0x100 [ 12.651524] ret_from_fork_asm+0x1b/0x30 [ 12.651901] </TASK> Get rid of it by searching for and replacing all BTF_SET8_START/END with BTF_KFUNCS_START/END. Note: except for the kfuncs in net/mptcp/bpf.c and drivers/hid/bpf/hid_bpf_dispatch.c (kept consistent with the mainline). Fixes: 1cd6437b7dde ("bpf: treewide: Annotate BPF kfuncs in BTF") Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- arch/arm64/kernel/bpf-rvi.c | 4 ++-- arch/x86/kernel/cpu/bpf-rvi.c | 4 ++-- block/blk-cgroup.c | 4 ++-- fs/proc/stat.c | 4 ++-- kernel/bpf-rvi/common_kfuncs.c | 4 ++-- kernel/cgroup/cpuset.c | 4 ++-- kernel/sched/bpf_sched.c | 8 ++++---- kernel/sched/cpuacct.c | 4 ++-- net/core/filter.c | 8 ++++---- 9 files changed, 22 insertions(+), 22 deletions(-) diff --git a/arch/arm64/kernel/bpf-rvi.c b/arch/arm64/kernel/bpf-rvi.c index 1ff460b46c85..026822aab85e 100644 --- a/arch/arm64/kernel/bpf-rvi.c +++ b/arch/arm64/kernel/bpf-rvi.c @@ -45,10 +45,10 @@ __bpf_kfunc const char *bpf_arch_flags(enum arch_flags_type t, int i) } } -BTF_SET8_START(bpf_arm64_kfunc_ids) +BTF_KFUNCS_START(bpf_arm64_kfunc_ids) BTF_ID_FLAGS(func, bpf_arm64_cpu_have_feature, KF_RCU) BTF_ID_FLAGS(func, bpf_arch_flags) -BTF_SET8_END(bpf_arm64_kfunc_ids) +BTF_KFUNCS_END(bpf_arm64_kfunc_ids) static const struct btf_kfunc_id_set bpf_arm64_kfunc_set = { .owner = THIS_MODULE, diff --git a/arch/x86/kernel/cpu/bpf-rvi.c b/arch/x86/kernel/cpu/bpf-rvi.c index dc71657623ed..a5de8f4d0c86 100644 --- a/arch/x86/kernel/cpu/bpf-rvi.c +++ b/arch/x86/kernel/cpu/bpf-rvi.c @@ -142,9 +142,9 @@ __bpf_kfunc const char *bpf_arch_flags(enum arch_flags_type t, int i) } } -BTF_SET8_START(bpf_arch_flags_kfunc_ids) +BTF_KFUNCS_START(bpf_arch_flags_kfunc_ids) BTF_ID_FLAGS(func, bpf_arch_flags) -BTF_SET8_END(bpf_arch_flags_kfunc_ids) +BTF_KFUNCS_END(bpf_arch_flags_kfunc_ids) static const struct btf_kfunc_id_set bpf_arch_flags_kfunc_set = { .owner = THIS_MODULE, diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c index 0a56cfac5a5d..80630a2e6e2c 100644 --- a/block/blk-cgroup.c +++ b/block/blk-cgroup.c @@ -2349,9 +2349,9 @@ __bpf_kfunc void bpf_blkcg_get_dev_iostat(struct blkcg *blkcg, int major, int mi rcu_read_unlock(); } -BTF_SET8_START(bpf_blkcg_kfunc_ids) +BTF_KFUNCS_START(bpf_blkcg_kfunc_ids) BTF_ID_FLAGS(func, bpf_blkcg_get_dev_iostat) -BTF_SET8_END(bpf_blkcg_kfunc_ids) +BTF_KFUNCS_END(bpf_blkcg_kfunc_ids) static const struct btf_kfunc_id_set bpf_blkcg_kfunc_set = { .owner = THIS_MODULE, diff --git a/fs/proc/stat.c b/fs/proc/stat.c index 4757e5b1be38..dc21a2c9a25d 100644 --- a/fs/proc/stat.c +++ b/fs/proc/stat.c @@ -239,11 +239,11 @@ __bpf_kfunc void bpf_show_all_irqs(struct seq_file *p) show_all_irqs(p); } -BTF_SET8_START(bpf_proc_stat_kfunc_ids) +BTF_KFUNCS_START(bpf_proc_stat_kfunc_ids) BTF_ID_FLAGS(func, bpf_get_idle_time) BTF_ID_FLAGS(func, bpf_get_iowait_time) BTF_ID_FLAGS(func, bpf_show_all_irqs) -BTF_SET8_END(bpf_proc_stat_kfunc_ids) +BTF_KFUNCS_END(bpf_proc_stat_kfunc_ids) static const struct btf_kfunc_id_set bpf_proc_stat_kfunc_set = { .owner = THIS_MODULE, diff --git a/kernel/bpf-rvi/common_kfuncs.c b/kernel/bpf-rvi/common_kfuncs.c index b0f33fd0201d..d790a7b65da6 100644 --- a/kernel/bpf-rvi/common_kfuncs.c +++ b/kernel/bpf-rvi/common_kfuncs.c @@ -280,7 +280,7 @@ __bpf_kfunc void bpf_x86_direct_pages(unsigned long *p) } #endif -BTF_SET8_START(bpf_common_kfuncs_ids) +BTF_KFUNCS_START(bpf_common_kfuncs_ids) BTF_ID_FLAGS(func, bpf_mem_cgroup_from_task, KF_RET_NULL | KF_RCU) BTF_ID_FLAGS(func, bpf_task_active_pid_ns, KF_TRUSTED_ARGS) BTF_ID_FLAGS(func, bpf_pidns_nr_tasks) @@ -309,7 +309,7 @@ BTF_ID_FLAGS(func, bpf_mem_committed) BTF_ID_FLAGS(func, bpf_mem_vmalloc_used) BTF_ID_FLAGS(func, bpf_mem_vmalloc_total) BTF_ID_FLAGS(func, bpf_x86_direct_pages, KF_TRUSTED_ARGS) -BTF_SET8_END(bpf_common_kfuncs_ids) +BTF_KFUNCS_END(bpf_common_kfuncs_ids) static const struct btf_kfunc_id_set bpf_common_kfuncs_set = { .owner = THIS_MODULE, diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c index 9e1a4680860e..1dc413ac01cf 100644 --- a/kernel/cgroup/cpuset.c +++ b/kernel/cgroup/cpuset.c @@ -5248,10 +5248,10 @@ __bpf_kfunc unsigned int bpf_cpumask_weight(struct cpumask *pmask) return cpumask_weight(pmask); } -BTF_SET8_START(bpf_cpuset_kfunc_ids) +BTF_KFUNCS_START(bpf_cpuset_kfunc_ids) BTF_ID_FLAGS(func, bpf_cpuset_from_task, KF_RET_NULL | KF_RCU) BTF_ID_FLAGS(func, bpf_cpumask_weight) -BTF_SET8_END(bpf_cpuset_kfunc_ids) +BTF_KFUNCS_END(bpf_cpuset_kfunc_ids) static const struct btf_kfunc_id_set bpf_cpuset_kfunc_set = { .owner = THIS_MODULE, diff --git a/kernel/sched/bpf_sched.c b/kernel/sched/bpf_sched.c index 6849a58439b2..1039f20198aa 100644 --- a/kernel/sched/bpf_sched.c +++ b/kernel/sched/bpf_sched.c @@ -167,12 +167,12 @@ __bpf_kfunc s32 bpf_sched_cpu_stats_of(int cpuid, __diag_pop(); -BTF_SET8_START(sched_cpustats_kfunc_btf_ids) +BTF_KFUNCS_START(sched_cpustats_kfunc_btf_ids) BTF_ID_FLAGS(func, bpf_sched_cpustats_create, KF_ACQUIRE | KF_RET_NULL) BTF_ID_FLAGS(func, bpf_sched_cpustats_release, KF_RELEASE) BTF_ID_FLAGS(func, bpf_sched_cpustats_acquire, KF_ACQUIRE | KF_TRUSTED_ARGS) BTF_ID_FLAGS(func, bpf_sched_cpu_stats_of, KF_RCU) -BTF_SET8_END(sched_cpustats_kfunc_btf_ids) +BTF_KFUNCS_END(sched_cpustats_kfunc_btf_ids) static const struct btf_kfunc_id_set cpustats_kfunc_set = { .owner = THIS_MODULE, @@ -221,12 +221,12 @@ __bpf_kfunc int bpf_sched_set_task_prefer_nid(struct task_struct *task, int nid) return set_prefer_cpus_ptr(task, cpumask_of_node(nid)); } -BTF_SET8_START(sched_task_kfunc_btf_ids) +BTF_KFUNCS_START(sched_task_kfunc_btf_ids) BTF_ID_FLAGS(func, bpf_sched_entity_is_task) BTF_ID_FLAGS(func, bpf_sched_entity_to_task) BTF_ID_FLAGS(func, bpf_sched_tag_of_entity) BTF_ID_FLAGS(func, bpf_sched_set_task_prefer_nid) -BTF_SET8_END(sched_task_kfunc_btf_ids) +BTF_KFUNCS_END(sched_task_kfunc_btf_ids) static const struct btf_kfunc_id_set sched_task_kfunc_set = { .owner = THIS_MODULE, diff --git a/kernel/sched/cpuacct.c b/kernel/sched/cpuacct.c index 801f3df9734c..c479a4b9ce77 100644 --- a/kernel/sched/cpuacct.c +++ b/kernel/sched/cpuacct.c @@ -427,10 +427,10 @@ __bpf_kfunc void bpf_cpuacct_kcpustat_cpu_fetch(struct kernel_cpustat *dst, memcpy(dst, per_cpu_ptr(ca->cpustat, cpu), sizeof(struct kernel_cpustat)); } -BTF_SET8_START(bpf_cpuacct_kfunc_ids) +BTF_KFUNCS_START(bpf_cpuacct_kfunc_ids) BTF_ID_FLAGS(func, bpf_task_ca_cpuusage) BTF_ID_FLAGS(func, bpf_cpuacct_kcpustat_cpu_fetch) -BTF_SET8_END(bpf_cpuacct_kfunc_ids) +BTF_KFUNCS_END(bpf_cpuacct_kfunc_ids) static const struct btf_kfunc_id_set bpf_cpuacct_kfunc_set = { .owner = THIS_MODULE, diff --git a/net/core/filter.c b/net/core/filter.c index d32c0000d345..80ca2b2d1f0b 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -12174,13 +12174,13 @@ BTF_ID_FLAGS(func, bpf_sock_addr_set_sun_path) BTF_KFUNCS_END(bpf_kfunc_check_set_sock_addr) #ifdef CONFIG_HISOCK -BTF_SET8_START(bpf_kfunc_check_set_sock_ops) +BTF_KFUNCS_START(bpf_kfunc_check_set_sock_ops) BTF_ID_FLAGS(func, bpf_skops_get_ingress_dst, KF_RET_NULL) -BTF_SET8_END(bpf_kfunc_check_set_sock_ops) +BTF_KFUNCS_END(bpf_kfunc_check_set_sock_ops) -BTF_SET8_START(bpf_kfunc_check_set_hisock) +BTF_KFUNCS_START(bpf_kfunc_check_set_hisock) BTF_ID_FLAGS(func, bpf_skb_change_dev) -BTF_SET8_END(bpf_kfunc_check_set_hisock) +BTF_KFUNCS_END(bpf_kfunc_check_set_hisock) #endif static const struct btf_kfunc_id_set bpf_kfunc_set_skb = { -- 2.34.1

2 1