- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks
by Jinjiang Tu 16 Jul '26

16 Jul '26

From: Michael Bommarito <michael.bommarito(a)gmail.com> stable inclusion from stable-v5.10.258 commit a132e199de69e2a45628aa8534df1bf5d44e1b6e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15706 CVE: CVE-2026-53004 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 0cf004ffb61cd32d140531c3a84afe975f9fc7ea ] sctp_getsockopt_peer_auth_chunks() checks that the caller's optval buffer is large enough for the peer AUTH chunk list with if (len < num_chunks) return -EINVAL; but then writes num_chunks bytes to p->gauth_chunks, which lives at offset offsetof(struct sctp_authchunks, gauth_chunks) == 8 inside optval. The check is missing the sizeof(struct sctp_authchunks) = 8-byte header. When the caller supplies len == num_chunks (for any num_chunks > 0) the test passes but copy_to_user() writes sizeof(struct sctp_authchunks) = 8 bytes past the declared buffer. The sibling function sctp_getsockopt_local_auth_chunks() at the next line already has the correct check: if (len < sizeof(struct sctp_authchunks) + num_chunks) return -EINVAL; Align the peer variant with its sibling. Reproducer confirms on v7.0-13-generic: an unprivileged userspace caller that opens a loopback SCTP association with AUTH enabled, queries num_chunks with a short optval, then issues the real getsockopt with len == num_chunks and sentinel bytes painted past the buffer observes those sentinel bytes overwritten with the peer's AUTH chunk type. The bytes written are under the peer's control but land in the caller's own userspace; this is not a kernel memory corruption, but it is a kernel-side contract violation that can silently corrupt adjacent userspace data. Fixes: 65b07e5d0d09 ("[SCTP]: API updates to suport SCTP-AUTH extensions.") Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Acked-by: Xin Long <lucien.xin(a)gmail.com> Link: https://patch.msgid.link/20260416031903.1447072-1-michael.bommarito@gmail.c… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- net/sctp/socket.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/sctp/socket.c b/net/sctp/socket.c index 279d5e9421d3..e20aa4dbf740 100644 --- a/net/sctp/socket.c +++ b/net/sctp/socket.c @@ -6863,7 +6863,7 @@ static int sctp_getsockopt_peer_auth_chunks(struct sock *sk, int len, /* See if the user provided enough room for all the data */ num_chunks = ntohs(ch->param_hdr.length) - sizeof(struct sctp_paramhdr); - if (len < num_chunks) + if (len < sizeof(struct sctp_authchunks) + num_chunks) return -EINVAL; if (copy_to_user(to, ch->chunks, num_chunks)) -- 2.43.0

2 1

[PATCH openEuler-1.0-LTS 0/2] CVE-2025-10263
by Lin Yujun 16 Jul '26

16 Jul '26

*** BLURB HERE *** Lin Yujun (2): arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU arm64/openeuler_defconfig: add CONFIG_NVIDIA_OLYMPUS_ERRATUM_TLBI to openeuler_defconfig Documentation/arm64/silicon-errata.txt | 2 ++ arch/arm64/Kconfig | 15 +++++++++++++++ arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/cputype.h | 2 ++ arch/arm64/kernel/cpu_errata.c | 7 +++++++ 5 files changed, 27 insertions(+) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU
by Lin Yujun 16 Jul '26

16 Jul '26

mainline inclusion from mainline-v7.1 commit ec7216f92e4ebd485b1c6dc6aa3f6064b71a5768 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15600 CVE: CVE-2025-10263 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- NVIDIA Olympus cores are affected by the TLBI completion issue tracked as CVE-2025-10263. The existing ARM64_ERRATUM_4118414 handling already uses ARM64_WORKAROUND_REPEAT_TLBI to issue an additional broadcast TLBI;DSB sequence and ensure affected memory write effects are globally observed. Add MIDR_NVIDIA_OLYMPUS to the repeat-TLBI match list so the same mitigation is enabled on affected Olympus systems. Also document the NVIDIA Olympus erratum in the arm64 silicon errata table and list it in the Kconfig help text. [linyujun: 4.19 does not have ARM64_ERRATUM_4118414 or the arm64_repeat_tlbi_list[] array. Adapt using the existing per-vendor config pattern (same as QCOM_FALKOR_ERRATUM_1009) with ERRATA_MIDR_ALL_VERSIONS.] Signed-off-by: Shanker Donthineni <sdonthineni(a)nvidia.com> Acked-by: Mark Rutland <mark.rutland(a)arm.com> Signed-off-by: Will Deacon <will(a)kernel.org> Conflicts: Documentation/arm64/silicon-errata.txt arch/arm64/Kconfig arch/arm64/include/asm/cputype.h arch/arm64/kernel/cpu_errata.c [主线高版本有 ARM64_ERRATUM_4118414 通用配置和 arm64_repeat_tlbi_list[] 数组， 4.19上是每个厂商各自一个独立 Kconfig 选项（QCOM_FALKOR_ERRATUM_1009 模式）。所以这个补丁需要手动适配，按这个模式新增了NVIDIA_OLYMPUS_ERRATUM_TLBI, 并且新增对应的CPU ID 定义。] Signed-off-by: Lin Yujun <linyujun809(a)h-partners.com> --- Documentation/arm64/silicon-errata.txt | 2 ++ arch/arm64/Kconfig | 15 +++++++++++++++ arch/arm64/include/asm/cputype.h | 2 ++ arch/arm64/kernel/cpu_errata.c | 7 +++++++ 4 files changed, 26 insertions(+) diff --git a/Documentation/arm64/silicon-errata.txt b/Documentation/arm64/silicon-errata.txt index 5016158f5e67..430c0dfbeca1 100644 --- a/Documentation/arm64/silicon-errata.txt +++ b/Documentation/arm64/silicon-errata.txt @@ -82,5 +82,7 @@ stable kernels. | | | | | | Qualcomm Tech. | Kryo/Falkor v1 | E1003 | QCOM_FALKOR_ERRATUM_1003 | | Qualcomm Tech. | Falkor v1 | E1009 | QCOM_FALKOR_ERRATUM_1009 | | Qualcomm Tech. | QDF2400 ITS | E0065 | QCOM_QDF2400_ERRATUM_0065 | | Qualcomm Tech. | Falkor v{1,2} | E1041 | QCOM_FALKOR_ERRATUM_1041 | +| | | | | +| NVIDIA | Olympus Core | T410-OLY-1029 | NVIDIA_OLYMPUS_ERRATUM_TLBI | diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index 6498279140fc..3951b0cc8134 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -615,10 +615,25 @@ config QCOM_FALKOR_ERRATUM_1009 TLBI xxIS invalidate maintenance operation. Repeat the TLBI operation one more time to fix the issue. If unsure, say Y. +config NVIDIA_OLYMPUS_ERRATUM_TLBI + bool "NVIDIA Olympus: Completion of affected memory accesses might not be guaranteed by completion of a TLBI" + default y + select ARM64_WORKAROUND_REPEAT_TLBI + help + On NVIDIA Olympus CPU, the completion of a broadcast TLB + invalidation might not guarantee that the memory accesses + expected to be affected by it have completed. Work around + this by issuing an additional broadcast TLBI followed by DSB. + + This is erratum T410-OLY-1029 on the NVIDIA Olympus CPU, + also known as CVE-2025-10263. + + If unsure, say Y. + config QCOM_QDF2400_ERRATUM_0065 bool "QDF2400 E0065: Incorrect GITS_TYPER.ITT_Entry_size" default y help On Qualcomm Datacenter Technologies QDF2400 SoC, ITS hardware reports diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h index bdec50291017..c18e48628509 100644 --- a/arch/arm64/include/asm/cputype.h +++ b/arch/arm64/include/asm/cputype.h @@ -100,10 +100,11 @@ #define QCOM_CPU_PART_FALKOR 0xC00 #define QCOM_CPU_PART_KRYO 0x200 #define NVIDIA_CPU_PART_DENVER 0x003 #define NVIDIA_CPU_PART_CARMEL 0x004 +#define NVIDIA_CPU_PART_OLYMPUS 0x010 #define HISI_CPU_PART_TSV110 0xD01 #define HISI_CPU_PART_TSV200 0xD02 #define PHYTIUM_CPU_PART_1500A 0X660 @@ -135,10 +136,11 @@ #define MIDR_QCOM_FALKOR_V1 MIDR_CPU_MODEL(ARM_CPU_IMP_QCOM, QCOM_CPU_PART_FALKOR_V1) #define MIDR_QCOM_FALKOR MIDR_CPU_MODEL(ARM_CPU_IMP_QCOM, QCOM_CPU_PART_FALKOR) #define MIDR_QCOM_KRYO MIDR_CPU_MODEL(ARM_CPU_IMP_QCOM, QCOM_CPU_PART_KRYO) #define MIDR_NVIDIA_DENVER MIDR_CPU_MODEL(ARM_CPU_IMP_NVIDIA, NVIDIA_CPU_PART_DENVER) #define MIDR_NVIDIA_CARMEL MIDR_CPU_MODEL(ARM_CPU_IMP_NVIDIA, NVIDIA_CPU_PART_CARMEL) +#define MIDR_NVIDIA_OLYMPUS MIDR_CPU_MODEL(ARM_CPU_IMP_NVIDIA, NVIDIA_CPU_PART_OLYMPUS) #define MIDR_HISI_TSV110 MIDR_CPU_MODEL(ARM_CPU_IMP_HISI, HISI_CPU_PART_TSV110) #define MIDR_HISI_TSV200 MIDR_CPU_MODEL(ARM_CPU_IMP_HISI, HISI_CPU_PART_TSV200) #define MIDR_FT_1500A MIDR_CPU_MODEL(ARM_CPU_IMP_PHYTIUM, PHYTIUM_CPU_PART_1500A) #define MIDR_FT_2000AHK MIDR_CPU_MODEL(ARM_CPU_IMP_PHYTIUM, PHYTIUM_CPU_PART_2000AHK) #define MIDR_FT_2000PLUS MIDR_CPU_MODEL(ARM_CPU_IMP_PHYTIUM, PHYTIUM_CPU_PART_2000PLUS) diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c index 3b911e8964a7..9ba8cb0e1824 100644 --- a/arch/arm64/kernel/cpu_errata.c +++ b/arch/arm64/kernel/cpu_errata.c @@ -924,10 +924,17 @@ const struct arm64_cpu_capabilities arm64_errata[] = { .desc = "Qualcomm Technologies Falkor erratum 1009", .capability = ARM64_WORKAROUND_REPEAT_TLBI, ERRATA_MIDR_REV(MIDR_QCOM_FALKOR_V1, 0, 0), }, #endif +#ifdef CONFIG_NVIDIA_OLYMPUS_ERRATUM_TLBI + { + .desc = "NVIDIA Olympus erratum T410-OLY-1029", + .capability = ARM64_WORKAROUND_REPEAT_TLBI, + ERRATA_MIDR_ALL_VERSIONS(MIDR_NVIDIA_OLYMPUS), + }, +#endif #ifdef CONFIG_ARM64_ERRATUM_858921 { /* Cortex-A73 all versions */ .desc = "ARM erratum 858921", .capability = ARM64_WORKAROUND_858921, -- 2.34.1

2 1

[PATCH OLK-5.10] ice: fix double-free of tx_buf skb
by Tengda Wu 16 Jul '26

16 Jul '26

From: Michal Schmidt <mschmidt(a)redhat.com> mainline inclusion from mainline-v7.1-rc1 commit 1a303baa715e6b78d6a406aaf335f87ff35acfcd category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15711 CVE: CVE-2026-53009 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If ice_tso() or ice_tx_csum() fail, the error path in ice_xmit_frame_ring() frees the skb, but the 'first' tx_buf still points to it and is marked as valid (ICE_TX_BUF_SKB). 'next_to_use' remains unchanged, so the potential problem will likely fix itself when the next packet is transmitted and the tx_buf gets overwritten. But if there is no next packet and the interface is brought down instead, ice_clean_tx_ring() -> ice_unmap_and_free_tx_buf() will find the tx_buf and free the skb for the second time. The fix is to reset the tx_buf type to ICE_TX_BUF_EMPTY in the error path, so that ice_unmap_and_free_tx_buf(). Move the initialization of 'first' up, to ensure it's already valid in case we hit the linearization error path. The bug was spotted by AI while I had it looking for something else. It also proposed an initial version of the patch. I reproduced the bug and tested the fix by adding code to inject failures, on a build with KASAN. I looked for similar bugs in related Intel drivers and did not find any. Fixes: d76a60ba7afb ("ice: Add support for VLANs and offloads") Assisted-by: Claude:claude-4.6-opus-high Cursor Signed-off-by: Michal Schmidt <mschmidt(a)redhat.com> Signed-off-by: Jacob Keller <jacob.e.keller(a)intel.com> Link: https://patch.msgid.link/20260416-iwl-net-submission-2026-04-14-v2-4-686c33… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: drivers/net/ethernet/intel/ice/ice_txrx.c [commit aa1d3faf71a6 ("ice: Robustify cleaning/completing XDP Tx buffers") is not merged yet, so the `type` field doesn't exist in struct ice_tx_buf. Instead of introducing the `type` field via commit aa1d3faf71a6, just set skb to NULL to prevent double-free.] Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- drivers/net/ethernet/intel/ice/ice_txrx.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/intel/ice/ice_txrx.c b/drivers/net/ethernet/intel/ice/ice_txrx.c index 0fc891861a10..779881dfcce9 100644 --- a/drivers/net/ethernet/intel/ice/ice_txrx.c +++ b/drivers/net/ethernet/intel/ice/ice_txrx.c @@ -2369,6 +2369,9 @@ ice_xmit_frame_ring(struct sk_buff *skb, struct ice_ring *tx_ring) unsigned int count; int tso, csum; + /* record the location of the first descriptor for this packet */ + first = &tx_ring->tx_buf[tx_ring->next_to_use]; + count = ice_xmit_desc_count(skb); if (ice_chk_linearize(skb, count)) { if (__skb_linearize(skb)) @@ -2391,8 +2394,6 @@ ice_xmit_frame_ring(struct sk_buff *skb, struct ice_ring *tx_ring) offload.tx_ring = tx_ring; - /* record the location of the first descriptor for this packet */ - first = &tx_ring->tx_buf[tx_ring->next_to_use]; first->skb = skb; first->bytecount = max_t(unsigned int, skb->len, ETH_ZLEN); first->gso_segs = 1; @@ -2442,6 +2443,7 @@ ice_xmit_frame_ring(struct sk_buff *skb, struct ice_ring *tx_ring) out_drop: dev_kfree_skb_any(skb); + first->skb = NULL; return NETDEV_TX_OK; } -- 2.34.1

2 1

[PATCH OLK-5.10] IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
by Xia Fukun 15 Jul '26

15 Jul '26

From: Michael Bommarito <michael.bommarito(a)gmail.com> stable inclusion from stable-v5.10.259 commit 75ee6e4aa096aa9e7b2dd5c8ff98356e30aceefb category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15861 CVE: CVE-2026-53176 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 29e7b925ae6df64894e82ab6419994dc25580a8a upstream. In drivers/infiniband/ulp/isert/ib_isert.c, isert_login_recv_done() computes the login request payload length as wc->byte_len minus ISER_HEADERS_LEN with no lower bound, and login_req_len is a signed int. A remote iSER initiator can post a login Send work request carrying fewer than ISER_HEADERS_LEN (76) bytes, so the subtraction underflows and login_req_len becomes negative. isert_rx_login_req() then reads that negative length back into a signed int, takes size = min(rx_buflen, MAX_KEY_VALUE_PAIRS), and because the min() is signed it keeps the negative value; the value is then passed as the memcpy() length and sign-extended to a multi-gigabyte size_t. The copy into the 8192-byte login->req_buf runs far out of bounds and faults, crashing the target node. The login phase precedes iSCSI authentication, so no credentials are required to reach this path. Reject any login PDU shorter than ISER_HEADERS_LEN before the subtraction, mirroring the existing early return on a failed work completion, so login_req_len can never go negative. The upper bound was already safe: a posted login buffer cannot deliver more than ISER_RX_PAYLOAD_SIZE, so the difference stays at or below MAX_KEY_VALUE_PAIRS and the existing min() clamps it; only the missing lower bound needs to be added. Fixes: b8d26b3be8b3 ("iser-target: Add iSCSI Extensions for RDMA (iSER) target driver") Link: https://patch.msgid.link/r/20260602194642.2273217-1-michael.bommarito@gmail… Cc: stable(a)vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lin Yujun <linyujun809(a)h-partners.com> Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- drivers/infiniband/ulp/isert/ib_isert.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c index ed375f517e8a..9f8d6113efb4 100644 --- a/drivers/infiniband/ulp/isert/ib_isert.c +++ b/drivers/infiniband/ulp/isert/ib_isert.c @@ -1388,6 +1388,12 @@ isert_login_recv_done(struct ib_cq *cq, struct ib_wc *wc) ib_dma_sync_single_for_cpu(ib_dev, isert_conn->login_desc->dma_addr, ISER_RX_SIZE, DMA_FROM_DEVICE); + if (unlikely(wc->byte_len < ISER_HEADERS_LEN)) { + isert_dbg("login request length %u is too short\n", + wc->byte_len); + return; + } + isert_conn->login_req_len = wc->byte_len - ISER_HEADERS_LEN; if (isert_conn->conn) { -- 2.34.1

2 1

[PATCH OLK-6.6 0/3] fix CVE-2026-53132
by Jinjiang Tu 15 Jul '26

15 Jul '26

Eric Dumazet (1): vsock/virtio: fix potential unbounded skb queue Stefano Garzarella (2): vsock/virtio: fix skb overhead accounting to preserve full buf_alloc vsock/virtio: reset connection on receiving queue overflow net/vmw_vsock/virtio_transport_common.c | 31 ++++++++++++++++++++----- 1 file changed, 25 insertions(+), 6 deletions(-) -- 2.43.0

2 4

[PATCH openEuler-1.0-LTS] arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU
by Lin Yujun 15 Jul '26

15 Jul '26

mainline inclusion from mainline-v7.1 commit ec7216f92e4ebd485b1c6dc6aa3f6064b71a5768 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15600 CVE: CVE-2025-10263 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- NVIDIA Olympus cores are affected by the TLBI completion issue tracked as CVE-2025-10263. The existing ARM64_ERRATUM_4118414 handling already uses ARM64_WORKAROUND_REPEAT_TLBI to issue an additional broadcast TLBI;DSB sequence and ensure affected memory write effects are globally observed. Add MIDR_NVIDIA_OLYMPUS to the repeat-TLBI match list so the same mitigation is enabled on affected Olympus systems. Also document the NVIDIA Olympus erratum in the arm64 silicon errata table and list it in the Kconfig help text. [linyujun: 4.19 does not have ARM64_ERRATUM_4118414 or the arm64_repeat_tlbi_list[] array. Adapt using the existing per-vendor config pattern (same as QCOM_FALKOR_ERRATUM_1009) with ERRATA_MIDR_ALL_VERSIONS.] Signed-off-by: Shanker Donthineni <sdonthineni(a)nvidia.com> Acked-by: Mark Rutland <mark.rutland(a)arm.com> Signed-off-by: Will Deacon <will(a)kernel.org> Conflicts: Documentation/arm64/silicon-errata.txt arch/arm64/Kconfig arch/arm64/include/asm/cputype.h arch/arm64/kernel/cpu_errata.c [主线高版本有 ARM64_ERRATUM_4118414 通用配置和 arm64_repeat_tlbi_list[] 数组， 4.19上是每个厂商各自一个独立 Kconfig 选项（QCOM_FALKOR_ERRATUM_1009 模式）。所以这个补丁需要手动适配，按这个模式新增了NVIDIA_OLYMPUS_ERRATUM_TLBI, 并且新增对应的CPU ID 定义。] Signed-off-by: Lin Yujun <linyujun809(a)h-partners.com> --- Documentation/arm64/silicon-errata.txt | 2 ++ arch/arm64/Kconfig | 15 +++++++++++++++ arch/arm64/include/asm/cputype.h | 2 ++ arch/arm64/kernel/cpu_errata.c | 7 +++++++ 4 files changed, 26 insertions(+) diff --git a/Documentation/arm64/silicon-errata.txt b/Documentation/arm64/silicon-errata.txt index 5016158f5e67..430c0dfbeca1 100644 --- a/Documentation/arm64/silicon-errata.txt +++ b/Documentation/arm64/silicon-errata.txt @@ -82,5 +82,7 @@ stable kernels. | | | | | | Qualcomm Tech. | Kryo/Falkor v1 | E1003 | QCOM_FALKOR_ERRATUM_1003 | | Qualcomm Tech. | Falkor v1 | E1009 | QCOM_FALKOR_ERRATUM_1009 | | Qualcomm Tech. | QDF2400 ITS | E0065 | QCOM_QDF2400_ERRATUM_0065 | | Qualcomm Tech. | Falkor v{1,2} | E1041 | QCOM_FALKOR_ERRATUM_1041 | +| | | | | +| NVIDIA | Olympus Core | T410-OLY-1029 | NVIDIA_OLYMPUS_ERRATUM_TLBI | diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index 6498279140fc..3951b0cc8134 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -615,10 +615,25 @@ config QCOM_FALKOR_ERRATUM_1009 TLBI xxIS invalidate maintenance operation. Repeat the TLBI operation one more time to fix the issue. If unsure, say Y. +config NVIDIA_OLYMPUS_ERRATUM_TLBI + bool "NVIDIA Olympus: Completion of affected memory accesses might not be guaranteed by completion of a TLBI" + default y + select ARM64_WORKAROUND_REPEAT_TLBI + help + On NVIDIA Olympus CPU, the completion of a broadcast TLB + invalidation might not guarantee that the memory accesses + expected to be affected by it have completed. Work around + this by issuing an additional broadcast TLBI followed by DSB. + + This is erratum T410-OLY-1029 on the NVIDIA Olympus CPU, + also known as CVE-2025-10263. + + If unsure, say Y. + config QCOM_QDF2400_ERRATUM_0065 bool "QDF2400 E0065: Incorrect GITS_TYPER.ITT_Entry_size" default y help On Qualcomm Datacenter Technologies QDF2400 SoC, ITS hardware reports diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h index bdec50291017..c18e48628509 100644 --- a/arch/arm64/include/asm/cputype.h +++ b/arch/arm64/include/asm/cputype.h @@ -100,10 +100,11 @@ #define QCOM_CPU_PART_FALKOR 0xC00 #define QCOM_CPU_PART_KRYO 0x200 #define NVIDIA_CPU_PART_DENVER 0x003 #define NVIDIA_CPU_PART_CARMEL 0x004 +#define NVIDIA_CPU_PART_OLYMPUS 0x010 #define HISI_CPU_PART_TSV110 0xD01 #define HISI_CPU_PART_TSV200 0xD02 #define PHYTIUM_CPU_PART_1500A 0X660 @@ -135,10 +136,11 @@ #define MIDR_QCOM_FALKOR_V1 MIDR_CPU_MODEL(ARM_CPU_IMP_QCOM, QCOM_CPU_PART_FALKOR_V1) #define MIDR_QCOM_FALKOR MIDR_CPU_MODEL(ARM_CPU_IMP_QCOM, QCOM_CPU_PART_FALKOR) #define MIDR_QCOM_KRYO MIDR_CPU_MODEL(ARM_CPU_IMP_QCOM, QCOM_CPU_PART_KRYO) #define MIDR_NVIDIA_DENVER MIDR_CPU_MODEL(ARM_CPU_IMP_NVIDIA, NVIDIA_CPU_PART_DENVER) #define MIDR_NVIDIA_CARMEL MIDR_CPU_MODEL(ARM_CPU_IMP_NVIDIA, NVIDIA_CPU_PART_CARMEL) +#define MIDR_NVIDIA_OLYMPUS MIDR_CPU_MODEL(ARM_CPU_IMP_NVIDIA, NVIDIA_CPU_PART_OLYMPUS) #define MIDR_HISI_TSV110 MIDR_CPU_MODEL(ARM_CPU_IMP_HISI, HISI_CPU_PART_TSV110) #define MIDR_HISI_TSV200 MIDR_CPU_MODEL(ARM_CPU_IMP_HISI, HISI_CPU_PART_TSV200) #define MIDR_FT_1500A MIDR_CPU_MODEL(ARM_CPU_IMP_PHYTIUM, PHYTIUM_CPU_PART_1500A) #define MIDR_FT_2000AHK MIDR_CPU_MODEL(ARM_CPU_IMP_PHYTIUM, PHYTIUM_CPU_PART_2000AHK) #define MIDR_FT_2000PLUS MIDR_CPU_MODEL(ARM_CPU_IMP_PHYTIUM, PHYTIUM_CPU_PART_2000PLUS) diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c index 3b911e8964a7..9ba8cb0e1824 100644 --- a/arch/arm64/kernel/cpu_errata.c +++ b/arch/arm64/kernel/cpu_errata.c @@ -924,10 +924,17 @@ const struct arm64_cpu_capabilities arm64_errata[] = { .desc = "Qualcomm Technologies Falkor erratum 1009", .capability = ARM64_WORKAROUND_REPEAT_TLBI, ERRATA_MIDR_REV(MIDR_QCOM_FALKOR_V1, 0, 0), }, #endif +#ifdef CONFIG_NVIDIA_OLYMPUS_ERRATUM_TLBI + { + .desc = "NVIDIA Olympus erratum T410-OLY-1029", + .capability = ARM64_WORKAROUND_REPEAT_TLBI, + ERRATA_MIDR_ALL_VERSIONS(MIDR_NVIDIA_OLYMPUS), + }, +#endif #ifdef CONFIG_ARM64_ERRATUM_858921 { /* Cortex-A73 all versions */ .desc = "ARM erratum 858921", .capability = ARM64_WORKAROUND_858921, -- 2.34.1

2 1

[PATCH OLK-6.6 0/3] CVE-2026-53132
by Jinjiang Tu 15 Jul '26

15 Jul '26

Eric Dumazet (1): vsock/virtio: fix potential unbounded skb queue Stefano Garzarella (2): vsock/virtio: fix skb overhead accounting to preserve full buf_alloc vsock/virtio: reset connection on receiving queue overflow net/vmw_vsock/virtio_transport_common.c | 31 ++++++++++++++++++++----- 1 file changed, 25 insertions(+), 6 deletions(-) -- 2.43.0

2 4

[PATCH OLK-6.6] thunderbolt: Validate XDomain request packet size before type cast
by Ze Zuo 14 Jul '26

14 Jul '26

From: Michael Bommarito <michael.bommarito(a)gmail.com> stable inclusion from stable-v6.6.143 commit 0dd61ba03d05187726ecdf9c0e2175a81b9b24f6 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/16034 CVE: CVE-2026-53147 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit a504b9f2797b739e0304d537e8aa4ce883ecce39 upstream. tb_xdp_handle_request() casts the received packet buffer to protocol-specific structs without verifying that the allocation is large enough for the target type. A peer can send a minimal XDomain packet that passes the generic header length check but is shorter than the struct accessed after the cast, causing out-of- bounds reads from the kmemdup allocation. Plumb the packet length through xdomain_request_work and validate it against the expected struct size before each cast. Fixes: 8e1de7042596 ("thunderbolt: Add support for XDomain lane bonding") Fixes: cdae7c07e3e3 ("thunderbolt: Add support for XDomain properties") Cc: stable(a)vger.kernel.org Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Signed-off-by: Mika Westerberg <mika.westerberg(a)linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- drivers/thunderbolt/xdomain.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/thunderbolt/xdomain.c b/drivers/thunderbolt/xdomain.c index 31fec78a197b..868ef56827af 100644 --- a/drivers/thunderbolt/xdomain.c +++ b/drivers/thunderbolt/xdomain.c @@ -55,6 +55,7 @@ static const char * const state_names[] = { struct xdomain_request_work { struct work_struct work; struct tb_xdp_header *pkg; + size_t pkg_len; struct tb *tb; }; @@ -731,6 +732,7 @@ static void tb_xdp_handle_request(struct work_struct *work) struct xdomain_request_work *xw = container_of(work, typeof(*xw), work); const struct tb_xdp_header *pkg = xw->pkg; const struct tb_xdomain_header *xhdr = &pkg->xd_hdr; + size_t pkg_len = xw->pkg_len; struct tb *tb = xw->tb; struct tb_ctl *ctl = tb->ctl; struct tb_xdomain *xd; @@ -762,7 +764,7 @@ static void tb_xdp_handle_request(struct work_struct *work) switch (pkg->type) { case PROPERTIES_REQUEST: tb_dbg(tb, "%llx: received XDomain properties request\n", route); - if (xd) { + if (xd && pkg_len >= sizeof(struct tb_xdp_properties)) { ret = tb_xdp_properties_response(tb, ctl, xd, sequence, (const struct tb_xdp_properties *)pkg); } @@ -816,7 +818,8 @@ static void tb_xdp_handle_request(struct work_struct *work) tb_dbg(tb, "%llx: received XDomain link state change request\n", route); - if (xd && xd->state == XDOMAIN_STATE_BONDING_UUID_HIGH) { + if (xd && xd->state == XDOMAIN_STATE_BONDING_UUID_HIGH && + pkg_len >= sizeof(struct tb_xdp_link_state_change)) { const struct tb_xdp_link_state_change *lsc = (const struct tb_xdp_link_state_change *)pkg; @@ -868,6 +871,7 @@ tb_xdp_schedule_request(struct tb *tb, const struct tb_xdp_header *hdr, kfree(xw); return false; } + xw->pkg_len = size; xw->tb = tb_domain_get(tb); schedule_work(&xw->work); -- 2.25.1

2 1

[PATCH OLK-6.6] sctp: fix uninit-value in __sctp_rcv_asconf_lookup()
by Ze Zuo 14 Jul '26

14 Jul '26

From: Michael Bommarito <michael.bommarito(a)gmail.com> stable inclusion from stable-v6.6.143 commit 8ce96f1182644079249a24ac7e2ffc32e0301a46 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15911 CVE: CVE-2026-53225 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f8373d7090b745728de66308deeecc67e8d319ce ] __sctp_rcv_asconf_lookup() in net/sctp/input.c only checks that the ASCONF chunk can hold the ADDIP header and a parameter header, then calls af->from_addr_param(), which reads the full address (16 bytes for IPv6) trusting the parameter's declared length. An unauthenticated peer can send a truncated trailing ASCONF chunk that declares an IPv6 address parameter but stops after the 4-byte parameter header; reached from the no-association lookup path, from_addr_param() then reads uninitialized bytes past the parameter. Impact: an unauthenticated SCTP peer makes the receive path read up to 16 bytes of uninitialized memory past a truncated ASCONF address parameter. The sibling __sctp_rcv_init_lookup() bounds parameters with sctp_walk_params(); this path open-codes the fetch and omits the bound. Verify the whole address parameter lies within the chunk before from_addr_param() reads it, the same class of fix as commit 51e5ad549c43 ("net: sctp: fix KMSAN uninit-value in sctp_inq_pop"). Fixes: df2185771439 ("[SCTP]: Update association lookup to look at ASCONF chunks as well") Signed-off-by: Michael Bommarito <michael.bommarito(a)gmail.com> Acked-by: Xin Long <lucien.xin(a)gmail.com> Link: https://patch.msgid.link/20260608122234.459098-1-michael.bommarito@gmail.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Ze Zuo <zuoze1(a)huawei.com> --- net/sctp/input.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/net/sctp/input.c b/net/sctp/input.c index 032a10d82302..df5b2187b8fa 100644 --- a/net/sctp/input.c +++ b/net/sctp/input.c @@ -1204,6 +1204,14 @@ static struct sctp_association *__sctp_rcv_asconf_lookup( /* Skip over the ADDIP header and find the Address parameter */ param = (union sctp_addr_param *)(asconf + 1); + /* The whole address parameter must lie within the chunk before + * af->from_addr_param() reads the variable-length address; otherwise a + * truncated trailing ASCONF chunk lets it read uninitialized bytes past + * the parameter. + */ + if (sizeof(*asconf) + ntohs(param->p.length) > ntohs(ch->length)) + return NULL; + af = sctp_get_af_specific(param_type2af(param->p.type)); if (unlikely(!af)) return NULL; -- 2.25.1

2 1