- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 0/5]fix some CVE
by Tong Tiangen 26 Aug '25

26 Aug '25

Ma Wupeng (1): mm: memory-failure: update ttu flag inside unmap_poisoned_folio Michał Pecio (1): usb: xhci: Fix invalid pointer dereference in Etron workaround Neeraj Sanjay Kale (1): Bluetooth: btnxpuart: Fix kernel panic during FW release Ritesh Harjani (1): powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap Sergey Senozhatsky (1): thunderbolt: Do not double dequeue a configuration request arch/powerpc/platforms/powernv/memtrace.c | 8 ++++++-- drivers/bluetooth/btnxpuart.c | 6 ++++-- drivers/thunderbolt/ctl.c | 5 +++++ drivers/usb/host/xhci-ring.c | 2 +- mm/memory_hotplug.c | 2 +- 5 files changed, 17 insertions(+), 6 deletions(-) -- 2.25.1

2 6

[PATCH OLK-6.6] iBMA: Fix veth soft lockup by adding DMA-pre-readl sync
by linan666＠huaweicloud.com 26 Aug '25

26 Aug '25

From: Huangjunhua <huangjunhua14(a)huawei.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICUK85 CVE: NA ----------------------------------------- Fix soft lockup during large file transfers over veth interfaces in Taishan 500(Model 2280) environments by adding a readl operation prior to DMA initiation. This guarantees proper synchronization of Send Queue buffer descriptors, preventing descriptor corruption that caused system hangs. Signed-off-by: Huangjunhua <huangjunhua14(a)huawei.com> --- drivers/net/ethernet/huawei/bma/edma_drv/edma_queue.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/net/ethernet/huawei/bma/edma_drv/edma_queue.c b/drivers/net/ethernet/huawei/bma/edma_drv/edma_queue.c index 678262f7412c..94e63d3ee9dd 100644 --- a/drivers/net/ethernet/huawei/bma/edma_drv/edma_queue.c +++ b/drivers/net/ethernet/huawei/bma/edma_drv/edma_queue.c @@ -406,6 +406,12 @@ static s32 submit_dma_queue_sq(u32 dir, struct bspveth_dmal pdmalbase_v, u32 pf) BMA_LOG(DLOG_DEBUG, "submit dma queue sq, sq_tail change %d,\n", sq_tail); wmb(); /* memory barriers. */ + /* readl last u32 of sq buffer descriptor to confirm the sq buffer descriptor + * write to local sq + */ + (void)readl((void __iomem *)(p_dma_sq + sq_tail + sizeof(struct dma_ch_sq_s) + - sizeof(u32))); + (void)set_dma_queue_sq_tail(sq_tail); return 0; -- 2.33.0

2 1

[PATCH OLK-5.10] trace/fgraph: Fix the warning caused by missing unregister notifier
by Ye Weihua 26 Aug '25

26 Aug '25

mainline inclusion from mainline-v6.17-rc3 commit edede7a6dcd7435395cf757d053974aaab6ab1c2 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICUMJS Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------- This warning was triggered during testing on v6.16: notifier callback ftrace_suspend_notifier_call already registered WARNING: CPU: 2 PID: 86 at kernel/notifier.c:23 notifier_chain_register+0x44/0xb0 ... Call Trace: <TASK> blocking_notifier_chain_register+0x34/0x60 register_ftrace_graph+0x330/0x410 ftrace_profile_write+0x1e9/0x340 vfs_write+0xf8/0x420 ? filp_flush+0x8a/0xa0 ? filp_close+0x1f/0x30 ? do_dup2+0xaf/0x160 ksys_write+0x65/0xe0 do_syscall_64+0xa4/0x260 entry_SYSCALL_64_after_hwframe+0x77/0x7f When writing to the function_profile_enabled interface, the notifier was not unregistered after start_graph_tracing failed, causing a warning the next time function_profile_enabled was written. Fixed by adding unregister_pm_notifier in the exception path. Link: https://lore.kernel.org/20250818073332.3890629-1-yeweihua4@huawei.com Fixes: 4a2b8dda3f87 ("tracing/function-graph-tracer: fix a regression while suspend to disk") Acked-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org> Signed-off-by: Ye Weihua <yeweihua4(a)huawei.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Conflicts: kernel/trace/fgraph.c [just contex conflicts] Signed-off-by: Ye Weihua <yeweihua4(a)huawei.com> --- kernel/trace/fgraph.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/kernel/trace/fgraph.c b/kernel/trace/fgraph.c index a58da91eadb5..fd8f06c5dcc3 100644 --- a/kernel/trace/fgraph.c +++ b/kernel/trace/fgraph.c @@ -609,10 +609,11 @@ int register_ftrace_graph(struct fgraph_ops *gops) ftrace_graph_active++; ret = start_graph_tracing(); if (ret) { ftrace_graph_active--; + unregister_pm_notifier(&ftrace_suspend_notifier); goto out; } ftrace_graph_return = gops->retfunc; @@ -625,10 +626,12 @@ int register_ftrace_graph(struct fgraph_ops *gops) __ftrace_graph_entry = gops->entryfunc; ftrace_graph_entry = ftrace_graph_entry_test; update_function_graph_func(); ret = ftrace_startup(&graph_ops, FTRACE_START_FUNC_RET); + if (ret) + unregister_pm_notifier(&ftrace_suspend_notifier); out: mutex_unlock(&ftrace_lock); return ret; } -- 2.34.1

2 1

[PATCH OLK-6.6] trace/fgraph: Fix the warning caused by missing unregister notifier
by Ye Weihua 26 Aug '25

26 Aug '25

mainline inclusion from mainline-v6.17-rc3 commit edede7a6dcd7435395cf757d053974aaab6ab1c2 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICUMJS Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------- This warning was triggered during testing on v6.16: notifier callback ftrace_suspend_notifier_call already registered WARNING: CPU: 2 PID: 86 at kernel/notifier.c:23 notifier_chain_register+0x44/0xb0 ... Call Trace: <TASK> blocking_notifier_chain_register+0x34/0x60 register_ftrace_graph+0x330/0x410 ftrace_profile_write+0x1e9/0x340 vfs_write+0xf8/0x420 ? filp_flush+0x8a/0xa0 ? filp_close+0x1f/0x30 ? do_dup2+0xaf/0x160 ksys_write+0x65/0xe0 do_syscall_64+0xa4/0x260 entry_SYSCALL_64_after_hwframe+0x77/0x7f When writing to the function_profile_enabled interface, the notifier was not unregistered after start_graph_tracing failed, causing a warning the next time function_profile_enabled was written. Fixed by adding unregister_pm_notifier in the exception path. Link: https://lore.kernel.org/20250818073332.3890629-1-yeweihua4@huawei.com Fixes: 4a2b8dda3f87 ("tracing/function-graph-tracer: fix a regression while suspend to disk") Acked-by: Masami Hiramatsu (Google) <mhiramat(a)kernel.org> Signed-off-by: Ye Weihua <yeweihua4(a)huawei.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Conflicts: kernel/trace/fgraph.c [just contex conflicts] Signed-off-by: Ye Weihua <yeweihua4(a)huawei.com> --- kernel/trace/fgraph.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/kernel/trace/fgraph.c b/kernel/trace/fgraph.c index c83c005e654e..7956a799b5e8 100644 --- a/kernel/trace/fgraph.c +++ b/kernel/trace/fgraph.c @@ -646,10 +646,11 @@ int register_ftrace_graph(struct fgraph_ops *gops) ftrace_graph_active++; ret = start_graph_tracing(); if (ret) { ftrace_graph_active--; + unregister_pm_notifier(&ftrace_suspend_notifier); goto out; } ftrace_graph_return = gops->retfunc; @@ -662,10 +663,12 @@ int register_ftrace_graph(struct fgraph_ops *gops) __ftrace_graph_entry = gops->entryfunc; ftrace_graph_entry = ftrace_graph_entry_test; update_function_graph_func(); ret = ftrace_startup(&graph_ops, FTRACE_START_FUNC_RET); + if (ret) + unregister_pm_notifier(&ftrace_suspend_notifier); out: mutex_unlock(&ftrace_lock); return ret; } -- 2.34.1

2 1

[PATCH OLK-5.10] i2c: qup: jump out of the loop in case of timeout
by Pu Lehui 26 Aug '25

26 Aug '25

From: Yang Xiwen <forbidden405(a)outlook.com> mainline inclusion from mainline-v6.16 commit a7982a14b3012527a9583d12525cd0dc9f8d8934 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICUCAE CVE: CVE-2025-38671 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Original logic only sets the return value but doesn't jump out of the loop if the bus is kept active by a client. This is not expected. A malicious or buggy i2c client can hang the kernel in this case and should be avoided. This is observed during a long time test with a PCA953x GPIO extender. Fix it by changing the logic to not only sets the return value, but also jumps out of the loop and return to the caller with -ETIMEDOUT. Fixes: fbfab1ab0658 ("i2c: qup: reorganization of driver code to remove polling for qup v1") Signed-off-by: Yang Xiwen <forbidden405(a)outlook.com> Cc: <stable(a)vger.kernel.org> # v4.17+ Signed-off-by: Andi Shyti <andi.shyti(a)kernel.org> Link: https://lore.kernel.org/r/20250616-qca-i2c-v1-1-2a8d37ee0a30@outlook.com Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- drivers/i2c/busses/i2c-qup.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/i2c/busses/i2c-qup.c b/drivers/i2c/busses/i2c-qup.c index 576c12670bd8..a94f2ccf27ac 100644 --- a/drivers/i2c/busses/i2c-qup.c +++ b/drivers/i2c/busses/i2c-qup.c @@ -444,8 +444,10 @@ static int qup_i2c_bus_active(struct qup_i2c_dev *qup, int len) if (!(status & I2C_STATUS_BUS_ACTIVE)) break; - if (time_after(jiffies, timeout)) + if (time_after(jiffies, timeout)) { ret = -ETIMEDOUT; + break; + } usleep_range(len, len * 2); } -- 2.34.1

2 1

[PATCH OLK-6.6] i2c: qup: jump out of the loop in case of timeout
by Pu Lehui 26 Aug '25

26 Aug '25

From: Yang Xiwen <forbidden405(a)outlook.com> stable inclusion from stable-v6.6.101 commit 0d33913fce67a93c1eb83396c3c9d6b411dcab33 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICUCAE CVE: CVE-2025-38671 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit a7982a14b3012527a9583d12525cd0dc9f8d8934 upstream. Original logic only sets the return value but doesn't jump out of the loop if the bus is kept active by a client. This is not expected. A malicious or buggy i2c client can hang the kernel in this case and should be avoided. This is observed during a long time test with a PCA953x GPIO extender. Fix it by changing the logic to not only sets the return value, but also jumps out of the loop and return to the caller with -ETIMEDOUT. Fixes: fbfab1ab0658 ("i2c: qup: reorganization of driver code to remove polling for qup v1") Signed-off-by: Yang Xiwen <forbidden405(a)outlook.com> Cc: <stable(a)vger.kernel.org> # v4.17+ Signed-off-by: Andi Shyti <andi.shyti(a)kernel.org> Link: https://lore.kernel.org/r/20250616-qca-i2c-v1-1-2a8d37ee0a30@outlook.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- drivers/i2c/busses/i2c-qup.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/i2c/busses/i2c-qup.c b/drivers/i2c/busses/i2c-qup.c index 598102d16677..298aa0ce9eb2 100644 --- a/drivers/i2c/busses/i2c-qup.c +++ b/drivers/i2c/busses/i2c-qup.c @@ -444,8 +444,10 @@ static int qup_i2c_bus_active(struct qup_i2c_dev *qup, int len) if (!(status & I2C_STATUS_BUS_ACTIVE)) break; - if (time_after(jiffies, timeout)) + if (time_after(jiffies, timeout)) { ret = -ETIMEDOUT; + break; + } usleep_range(len, len * 2); } -- 2.34.1

2 1

[PATCH OLK-6.6 0/2] Fix trace may OOB when trace_get_user failed
by Pu Lehui 26 Aug '25

26 Aug '25

Pu Lehui (1): tracing: Limit access to parser->buffer when trace_get_user failed Steven Rostedt (1): tracing: Remove unneeded goto out logic kernel/trace/trace.c | 33 +++++++++++++++------------------ kernel/trace/trace.h | 8 +++++++- 2 files changed, 22 insertions(+), 19 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10 0/2] Fix trace may OOB when trace_get_user failed
by Pu Lehui 26 Aug '25

26 Aug '25

Pu Lehui (1): tracing: Limit access to parser->buffer when trace_get_user failed Steven Rostedt (1): tracing: Remove unneeded goto out logic kernel/trace/trace.c | 33 +++++++++++++++------------------ kernel/trace/trace.h | 8 +++++++- 2 files changed, 22 insertions(+), 19 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] iBMA: Fix veth soft lockup by adding DMA-pre-readl sync
by linan666＠huaweicloud.com 26 Aug '25

26 Aug '25

From: Huangjunhua <huangjunhua14(a)huawei.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICUK85 CVE: NA Fix soft lockup during large file transfers over veth interfaces in Taishan 500(Model 2280) environments by adding a readl operation prior to DMA initiation. This guarantees proper synchronization of Send Queue buffer descriptors, preventing descriptor corruption that caused system hangs. Signed-off-by: Huangjunhua <huangjunhua14(a)huawei.com> --- drivers/net/ethernet/huawei/bma/edma_drv/edma_queue.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/net/ethernet/huawei/bma/edma_drv/edma_queue.c b/drivers/net/ethernet/huawei/bma/edma_drv/edma_queue.c index 678262f7412c..94e63d3ee9dd 100644 --- a/drivers/net/ethernet/huawei/bma/edma_drv/edma_queue.c +++ b/drivers/net/ethernet/huawei/bma/edma_drv/edma_queue.c @@ -406,6 +406,12 @@ static s32 submit_dma_queue_sq(u32 dir, struct bspveth_dmal pdmalbase_v, u32 pf) BMA_LOG(DLOG_DEBUG, "submit dma queue sq, sq_tail change %d,\n", sq_tail); wmb(); /* memory barriers. */ + /* readl last u32 of sq buffer descriptor to confirm the sq buffer descriptor + * write to local sq + */ + (void)readl((void __iomem *)(p_dma_sq + sq_tail + sizeof(struct dma_ch_sq_s) + - sizeof(u32))); + (void)set_dma_queue_sq_tail(sq_tail); return 0; -- 2.33.0

2 1

[PATCH OLK-5.10 0/8] CVE-2024-53216 && CVE-2024-56558
by Li Lingfeng 26 Aug '25

26 Aug '25

Yang Erkun (8): nfsd: make sure exp active before svc_export_show SUNRPC: make sure cache entry active before cache_show nfsd: release svc_expkey/svc_export with rcu_work nfsd: Revert "nfsd: release svc_expkey/svc_export with rcu_work" SUNRPC: introduce cache_check_rcu to help check in rcu context nfsd: no need get cache ref when protected by rcu SUNRPC: no need get cache ref when protected by rcu nfsd: fix UAF when access ex_uuid or ex_stats fs/nfsd/export.c | 20 ++++++++++---- include/linux/sunrpc/cache.h | 2 ++ net/sunrpc/cache.c | 53 ++++++++++++++++++++---------------- 3 files changed, 46 insertions(+), 29 deletions(-) -- 2.39.2

2 9