- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM
by Hongtao Zhang 29 Oct '26

29 Oct '26

From: Peiyang He <peiyang_he(a)smail.nju.edu.cn> mainline inclusion from mainline-v7.3-rc5 commit 3359a372efb6d585c97019ee1b7f1874442bcebe category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20586 CVE: CVE-2026-98517 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- nouveau_uvmm_sm() calls op_map(), which passes bo->resource through nouveau_mem() to nouveau_uvma_map(). nouveau_uvmm_vmm_map() then reads mem->mem.type. But this is only valid when bo->resource is backed by struct nouveau_mem, as is the case for VRAM and TT resources. If the BO is left in TTM_PL_SYSTEM, bo->resource is only a struct ttm_resource. Treating it as struct nouveau_mem makes the mem->mem.type read past the end of the resource, causing a KASAN: slab-use-after-free Read in nouveau_uvmm_sm report: BUG: KASAN: slab-use-after-free in nouveau_uvmm_vmm_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:152 [inline] BUG: KASAN: slab-use-after-free in nouveau_uvma_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:199 [inline] BUG: KASAN: slab-use-after-free in op_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:849 [inline] BUG: KASAN: slab-use-after-free in nouveau_uvmm_sm.constprop.0+0x6ab/0x900 drivers/gpu/drm/nouveau/nouveau_uvmm.c:903 Read of size 1 at addr ffff888127d3e3a0 by task kworker/0:1/11 CPU: 0 UID: 0 PID: 11 Comm: kworker/0:1 Not tainted 7.2.0 #5 PREEMPT(lazy) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Workqueue: nouveau_sched_wq_2224 drm_sched_run_job_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x95/0xe0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xcb/0x5a0 mm/kasan/report.c:482 kasan_report+0xca/0x100 mm/kasan/report.c:595 nouveau_uvmm_vmm_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:152 [inline] nouveau_uvma_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:199 [inline] op_map drivers/gpu/drm/nouveau/nouveau_uvmm.c:849 [inline] nouveau_uvmm_sm.constprop.0+0x6ab/0x900 drivers/gpu/drm/nouveau/nouveau_uvmm.c:903 nouveau_uvmm_sm_unmap drivers/gpu/drm/nouveau/nouveau_uvmm.c:932 [inline] nouveau_uvmm_bind_job_run+0xd6/0x250 drivers/gpu/drm/nouveau/nouveau_uvmm.c:1532 nouveau_job_run drivers/gpu/drm/nouveau/nouveau_sched.c:350 [inline] nouveau_sched_run_job+0x62/0xd0 drivers/gpu/drm/nouveau/nouveau_sched.c:364 drm_sched_run_job_work+0x356/0xa10 drivers/gpu/drm/scheduler/sched_main.c:1061 process_one_work+0x8a5/0x1900 kernel/workqueue.c:3322 process_scheduled_works kernel/workqueue.c:3405 [inline] worker_thread+0x5dd/0xd80 kernel/workqueue.c:3486 kthread+0x31d/0x420 kernel/kthread.c:436 ret_from_fork+0x662/0x940 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> Allocated by task 2224 on cpu 0 at 66.550027s: kasan_save_stack+0x24/0x50 mm/kasan/common.c:57 kasan_save_track+0x17/0x60 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __do_kmalloc_node mm/slub.c:5334 [inline] __kmalloc_noprof+0x304/0x7c0 mm/slub.c:5359 _kmalloc_noprof include/linux/slab.h:992 [inline] dma_resv_list_alloc+0x27/0x90 drivers/dma-buf/dma-resv.c:106 dma_resv_reserve_fences+0x60e/0xa30 drivers/dma-buf/dma-resv.c:205 ttm_bo_alloc_resource+0x12c/0xbd0 drivers/gpu/drm/ttm/ttm_bo.c:721 ttm_bo_validate+0x1bc/0x4a0 drivers/gpu/drm/ttm/ttm_bo.c:856 ttm_bo_init_reserved+0x2c3/0x570 drivers/gpu/drm/ttm/ttm_bo.c:970 nouveau_bo_init+0x159/0x2c0 drivers/gpu/drm/nouveau/nouveau_bo.c:359 nouveau_gem_new+0x234/0x5f0 drivers/gpu/drm/nouveau/nouveau_gem.c:272 nouveau_gem_ioctl_new+0x1eb/0x420 drivers/gpu/drm/nouveau/nouveau_gem.c:352 drm_ioctl_kernel+0x192/0x350 drivers/gpu/drm/drm_ioctl.c:817 drm_ioctl+0x4f8/0xb40 drivers/gpu/drm/drm_ioctl.c:914 nouveau_drm_ioctl+0xea/0x2c0 drivers/gpu/drm/nouveau/nouveau_drm.c:1338 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x180/0x1d0 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x690 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 2223 on cpu 0 at 66.554063s: kasan_save_stack+0x24/0x50 mm/kasan/common.c:57 kasan_save_track+0x17/0x60 mm/kasan/common.c:78 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x61/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2677 [inline] __rcu_free_sheaf_prepare+0xb6/0x2e0 mm/slub.c:2928 rcu_free_sheaf+0x1b/0x120 mm/slub.c:5978 rcu_do_batch kernel/rcu/tree.c:2645 [inline] rcu_core+0x521/0x1490 kernel/rcu/tree.c:2897 handle_softirqs+0x1b1/0x8a0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0x137/0x1c0 kernel/softirq.c:735 irq_exit_rcu+0x9/0x20 kernel/softirq.c:752 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0x70/0x80 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 The buggy address belongs to the object at ffff888127d3e380 which belongs to the cache kmalloc-96 of size 96 The buggy address is located 32 bytes inside of freed 96-byte region [ffff888127d3e380, ffff888127d3e3e0) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x127d3e flags: 0x200000000000000(node=0|zone=2) page_type: f5(slab) raw: 0200000000000000 ffff888100041280 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000200020 00000000f5000000 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888127d3e280: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc ffff888127d3e300: 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc >ffff888127d3e380: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ^ ffff888127d3e400: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ffff888127d3e480: 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc Fix by resetting the placement to the BO's valid domains before calling nouveau_bo_validate(), matching the handling in nouveau_uvmm_bo_validate(), so map jobs do not run for SYSTEM resources; Reject BO that cannot reside in VRAM or GART; Also skip op_map() when the GPUVA has been invalidated, matching the handling in the unmap and remap paths. Found when fuzzing the nouveau driver with a modified Syzkaller. Fixes: b88baab82871 ("drm/nouveau: implement new VM_BIND uAPI") Cc: stable(a)vger.kernel.org Signed-off-by: Peiyang He <peiyang_he(a)smail.nju.edu.cn> Assisted-by: Codex:gpt-5.5 Reviewed-by: Lyude Paul <lyude(a)redhat.com> Signed-off-by: Lyude Paul <lyude(a)redhat.com> Link: https://patch.msgid.link/0D77BEC410CE0129+20260907052204.1431488-1-peiyang_… Conflicts: drivers/gpu/drm/nouveau/nouveau_uvmm.c [bind_lock_validate() doesn't exist in this tree, since the conversion to the drm_gpuvm exec helpers is not backported. The lock/validate loop is still open-coded in nouveau_uvmm_bind_job_submit(), which already resets the placement before validation, so only add the valid_domains check there. The op_map() hunk applies cleanly.] Signed-off-by: Zhang Hongtao <zhanghongtao35(a)huawei.com> --- drivers/gpu/drm/nouveau/nouveau_uvmm.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/gpu/drm/nouveau/nouveau_uvmm.c b/drivers/gpu/drm/nouveau/nouveau_uvmm.c index 1310ee5f4973..a56d6adf4295 100644 --- a/drivers/gpu/drm/nouveau/nouveau_uvmm.c +++ b/drivers/gpu/drm/nouveau/nouveau_uvmm.c @@ -772,6 +772,9 @@ op_map(struct nouveau_uvma *uvma) { struct nouveau_bo *nvbo = nouveau_gem_object(uvma->va.gem.obj); + if (drm_gpuva_invalidated(&uvma->va)) + return; + nouveau_uvma_map(uvma, nouveau_mem(nvbo->bo.resource)); } @@ -1334,6 +1337,13 @@ nouveau_uvmm_bind_job_submit(struct nouveau_job *job) continue; nvbo = nouveau_gem_object(obj); + if (!(nvbo->valid_domains & + (NOUVEAU_GEM_DOMAIN_VRAM | NOUVEAU_GEM_DOMAIN_GART))) { + ret = -EINVAL; + op = list_last_op(&bind_job->ops); + goto unwind; + } + nouveau_bo_placement_set(nvbo, nvbo->valid_domains, 0); ret = nouveau_bo_validate(nvbo, true, false); if (ret) { -- 2.43.0

2 1

[PATCH OLK-6.6 V1 0/2] RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz()
by Yao Yiqi 29 Oct '26

29 Oct '26

There are kABI changes on this patch, so we add another patch to fix that. This is the patchset for all those patches. Jason Gunthorpe (1): RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() Yao Yiqi (1): RDMA/umem: fix ib_umem_find_best_pgsz kABI drivers/infiniband/core/umem.c | 18 ++++++++++++------ include/rdma/ib_umem.h | 4 ++-- 2 files changed, 14 insertions(+), 8 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 v9 00/14] net: dynthread: dynamic threaded NAPI
by Cai Xinchen 28 Oct '26

28 Oct '26

This series makes the NAPI/queue/IRQ relationship visible to the network stack, backports the drivers and locking fixes it needs, and then builds net/dynthread on top of it: a loadable module that adapts the NAPI processing and the RX queue IRQ placement of a set of net devices to the scheduling behaviour of a target application at runtime. Motivation ---------- Interrupt and softirq processing of network RX competes with latency sensitive applications (e.g. mysqld) for CPU time. When such an application runs for a long time on a CPU without blocking, the softirq work of the NIC completion queues can preempt it on the same CPU and inflate its tail latency. The usual remedies are to steer the RX queue IRQs to other CPUs and/or to move NAPI processing into kernel threads bound to spare CPUs, but a static configuration cannot follow the application: once the target goes idle, is scheduled in short bursts, or is displaced, the reserved CPUs are simply wasted. To do this from a module, the queue a NAPI instance serves, the NAPI instance of a queue and the interrupt vector of that NAPI must be discoverable. Mainline added that association in v6.8/v6.9 (queue/NAPI pointer, netif_napi_set_irq(), mlx5e conversion) together with the RTNL fixes it requires. Patches 1-8 of this series backport that infrastructure, adapt it to the OLK KABI layout and fix the mlx5e lock ordering; patches 9-14 add the scheduler. Approach -------- The module periodically samples the scheduling statistics of all threads matching the appname module parameter and classifies them into one of five statuses (DATA_LOSS, NO_TASK, NOT_RUNNING, FRAGMENTATION, LONG_RUNNING_WITH_INTERRUPTS). Acting on that status it: - restores the RX queue IRQs to their original affinity when the target is gone or barely running; - spreads the IRQs over the NUMA node of their queues when processing in softirq context is acceptable again; - switches the NAPI processing of the configured net devices to kernel threads and binds the NAPI threads (and, optionally, the queue IRQs) to the CPUs of their NUMA node that the target tasks are not allowed to use; - scales the number of CPUs used by those threads with their measured load while the target stays in the long-running status. An unusable sample (counters moved backwards: DATA_LOSS) keeps the previous status, so a single bad sample cannot toggle the mode. Everything is controlled through module parameters, and the original IRQ affinity and NAPI mode are restored when the target disappears, the scheduler is disabled or the module is unloaded. The module is buildable only as a loadable module; the Kconfig entry currently allows ARM64 and it is enabled in the arm64 openeuler defconfig. Patch breakdown --------------- 1/14 net: Add queue and napi association Backport the queue <-> NAPI mapping: add enum netdev_queue_type, a napi pointer to struct netdev_queue and struct netdev_rx_queue, and netif_queue_set_napi() to set or clear it for RX and TX queues. The new netdev_queue field is put into reserve space so the layout of the structure is preserved. 2/14 net: fix KABI breakage for queue napi association Keep the struct layout stable across the backport: use the reserved domain segment of KABI 1 for netdev_queue and KABI 2 for netdev_rx_queue. 3/14 net: Add NAPI IRQ support Add napi->irq and netif_napi_set_irq(), so a driver can publish the interrupt vector that serves a NAPI instance. It is initialized to -1 by netif_napi_add_weight() and stays unknown for drivers that do not call the setter. The ice and netdev-genl/netlink parts of the upstream patch are not needed here and are dropped. 4/14 net: Fix napi irq KABI breakage Store napi->irq in the reserved domain segment of KABI 1 so that the napi_struct layout does not change. 5/14 net/mlx5e: link NAPI instances to queues and IRQs Make mlx5e call netif_napi_set_irq() when a channel is opened and register/clear the queue/NAPI association for its RX and TX queues (including the PTP queues) when they are activated/deactivated. This is also what users of the queue GET netlink API expect. 6/14 net/mlx5e: Acquire RTNL lock before RQs/SQs activation/deactivation netif_queue_set_napi() asserts RTNL for a registered netdev, so take the lock in the mlx5e TX reporter recovery paths that activate or deactivate queues without it. 7/14 net/mlx5e: Fix lock order in mlx5e_tx_reporter_ptpsq_unhealthy_recover The RTNL has to be acquired before priv->state_lock in the PTP SQ recovery. Move the lock acquisition up so the order matches the probe and channel switch paths. 8/14 net/mlx5e: Do not block on RTNL while recovering an SQ The recovery callbacks run synchronously from devlink_health_report() under the devlink lock, from SQ work items, while channel teardown holds the RTNL and waits for those work items with cancel_work_sync(). Replace the blocking rtnl_lock() with rtnl_trylock() and abandon the recovery when the SQ has been disabled by the teardown, following the existing mlx5e_tx_timeout_work() pattern. This avoids a deadlock that also stalled all devlink operations on the device. 9/14 net: dynthread: Add dynamic threaded NAPI scheduler framework Wire the new directory into net/Kconfig and net/Makefile, add the NET_DYNTHREAD Kconfig entry (ARM64, module only) and the module skeleton. On load the module takes a reference on each device given with the '#' separated ifname parameter, walks the IRQ descriptor table through the exported irq_get_irq_data(), snapshots desc->action and the effective affinity under desc->lock, and records the IRQ number and the original affinity CPU of every RX queue. IRQs are matched against the device name, its parent device name and the irqname pattern. Also count the NUMA nodes the recorded queues span, drop the device references on unload, and unwind a partially failed init. 10/14 net: dynthread: Monitor the load of the target tasks Add the sampling loop and the status judgement. Every dyn_threaded_interval ms, every monitored thread whose name matches appname contributes its runtime, voluntary/involuntary context switches and its allowed CPU mask; the masks are unioned to know where the target may run. The sample is compared with the previous one to derive the average runtime per switch, the nvcsw percentage and the CPU load, and to classify it as DATA_LOSS, NO_TASK, NOT_RUNNING, FRAGMENTATION or LONG_RUNNING_WITH_INTERRUPTS. Add the periodic hrtimer/work worker, the dynthreaded enable/disable parameter, a mutex serializing the worker control, a zeroed baseline on every enable, and the last_status tracking used to carry the transition sample. 11/14 net: dynthread: Steer the RX queue IRQs away from the target tasks Manage the affinity of the recorded RX queue IRQs. When the target tasks sit in a single NUMA node and enough CPUs of that node are free, move all queue IRQs there round-robin; when the target is gone or barely running, restore the affinity recorded at load time; when the target is fragmented, spread the IRQs over a subset of their own NUMA node sized from dyn_threaded_irq_cpucore_per. Track the "bound to one node" state so spreading is suppressed while it is active, and clear it on every recovery. All of this is skipped when dyn_threaded_bindirq is off, and the IRQ affinity is restored when the worker is stopped. 12/14 net: dynthread: Switch NAPI to threads on spare CPUs Enable threaded NAPI (dev_set_threaded) on the monitored devices in LONG_RUNNING_WITH_INTERRUPTS and bind each NAPI thread from the NUMA node of its queue IRQ: use the whole node if the target is not there, the target-free CPUs of the node if any, otherwise the first dyn_threaded_corenum CPUs of the node. Use napi->irq when the driver published it and fall back to the RX queue IRQ recorded by the module (e.g. hns3) otherwise. The NAPI list is built by head insertion, so it is walked in reverse to visit the NAPIs in registration (vector) order, matching the ascending order in which the RX queue IRQs are recorded. Optionally bind the queue IRQ to the same mask. Record the CPUs used by the NAPI threads in napi_cpumask for the load evaluation of the next patch. Switch the devices back to softirq mode in NO_TASK, NOT_RUNNING and FRAGMENTATION, when the scheduler is disabled and on module unload; the NAPI and IRQ operations run under the rtnetlink lock. 13/14 net: dynthread: Scale the number of NAPI thread CPUs Sample the kernel_cpustat of the CPUs used by the NAPI threads and compare consecutive periods. Grow dyn_threaded_corenum when the irq/softirq share or the total load of those CPUs is too high, and shrink it when the user share is high or the total load is low, within the lower/upper limit parameters. Damping and anti-fight rules avoid oscillating right after a change or undoing a change made for the opposite reason; the two total-load driven directions check each other, and the cpustat baseline is taken over the mask that was actually just bound. The default core count is computed at init from the busiest device's RX queue count divided by the online NUMA nodes. The lower/upper limit parameters reject zero and an inverted range, refuse a change that would move the computed default out of range, and clamp the current core count into the new range. Reset the damping state and the baseline when leaving the long-running status or when the scheduler is stopped, and serialize the core-count updates with the module parameter setter. 14/14 net: dynthread: Add debug switch and instrumentation Add the dyn_threaded_debug module parameter and instrument the periodic sampling, the status transitions, the IRQ affinity decisions, the NAPI thread masks and the CPU-count resizes. The messages are recorded with trace_printk() so they can be read from tracefs without flooding the console; without tracing support they fall back to dynamic debug. The switch is off by default. Amritha Nambiar (2): net: Add queue and napi association net: Add NAPI IRQ support Cai Xinchen (7): net/mlx5e: Do not block on RTNL while recovering an SQ net: dynthread: Add dynamic threaded NAPI scheduler framework net: dynthread: Monitor the load of the target tasks net: dynthread: Steer the RX queue IRQs away from the target tasks net: dynthread: Switch NAPI to threads on spare CPUs net: dynthread: Scale the number of NAPI thread CPUs net: dynthread: Add debug switch and instrumentation Carolina Jubran (1): net/mlx5e: Acquire RTNL lock before RQs/SQs activation/deactivation Cosmin Ratiu (1): net/mlx5e: Fix lock order in mlx5e_tx_reporter_ptpsq_unhealthy_recover JiangJieHua (2): net: Fix KABI breakage for queue napi association net: Fix napi irq KABI breakage Joe Damato (1): net/mlx5e: link NAPI instances to queues and IRQs arch/arm64/configs/openeuler_defconfig | 1 + .../net/ethernet/mellanox/mlx5/core/en/ptp.c | 5 +- .../mellanox/mlx5/core/en/reporter_tx.c | 23 + .../net/ethernet/mellanox/mlx5/core/en_main.c | 7 + include/linux/netdevice.h | 21 +- include/net/netdev_rx_queue.h | 5 +- net/Kconfig | 1 + net/Makefile | 1 + net/core/dev.c | 38 + net/dynthread/Kconfig | 13 + net/dynthread/Makefile | 2 + net/dynthread/net_dynthread.c | 1539 +++++++++++++++++ net/dynthread/net_dynthread.h | 92 + 13 files changed, 1744 insertions(+), 4 deletions(-) create mode 100644 net/dynthread/Kconfig create mode 100644 net/dynthread/Makefile create mode 100644 net/dynthread/net_dynthread.c create mode 100644 net/dynthread/net_dynthread.h -- 2.18.0.huawei.25

2 15

[PATCH OLK-5.10 V1 0/2] RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz()
by Yao Yiqi 28 Oct '26

28 Oct '26

There are kABI changes on this patch, so we add another patch to fix that. This is the patchset for all those patches. Jason Gunthorpe (1): RDMA/umem: Be careful about boundary conditions in ib_umem_find_best_pgsz() Yao Yiqi (1): RDMA/umem: fix ib_umem_find_best_pgsz kABI drivers/infiniband/core/umem.c | 18 ++++++++++++------ include/rdma/ib_umem.h | 4 ++-- 2 files changed, 14 insertions(+), 8 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds
by Jiacheng Yu 28 Oct '26

28 Oct '26

From: Baineng Shou <shoubaineng(a)gmail.com> mainline inclusion from mainline-v7.3-rc2 commit 30d0aff2c65a277135cfd8ea28fa1ee75e0ea4e0 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19111 CVE: CVE-2026-89996 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- DMA_HEAP_IOCTL_ALLOC allocates a dma-buf and installs an fd into the caller's fd table via dma_buf_fd() -> fd_install() before dma_heap_ioctl() copies the result back to userspace. If the trailing copy_to_user() fails, userspace never learns the fd number, but the fd (and the underlying dma-buf reference) are already visible to other threads in the same process and are leaked for the lifetime of the process. The obvious "close it on the failure path" fix is unsafe: once fd_install() has run, another thread can already dup() the fd, send it via SCM_RIGHTS, or close() it and let its number be reused, so a subsequent close_fd() from the ioctl path can operate on an unrelated file. This was pointed out by Christian König on v1 [1]. Restructure the allocation path so that fd_install() is the last, unfailable step of a successful ioctl: 1. heap->ops->allocate() creates the dma_buf. 2. get_unused_fd_flags() reserves an fd number in the caller's fd table without publishing it, so no other thread can observe it. 3. copy_to_user() delivers the fd number to userspace; on failure the fd is returned with put_unused_fd() and the dma_buf reference is dropped with dma_buf_put(), leaving no user- visible state behind. 4. dma_buf_fd_install() publishes the fd and emits the trace_dma_buf_fd tracepoint -- from here on the ioctl cannot fail. A new dma_buf_fd_install() helper is introduced in dma-buf.c to wrap fd_install() together with the DMA_BUF_TRACE() call, preserving the export tracing that dma_buf_fd() provides. dma_heap_ioctl_allocate() is refactored to return the struct dma_buf * directly (returning ERR_PTR on failure) so the caller holds the dmabuf reference across steps 3 and 4. The failure at step 3 is easily reachable from userspace: pass a struct dma_heap_allocation_data that lives in a page whose protection is flipped to PROT_READ between copy_from_user() and copy_to_user() (e.g. via mprotect()). Before this change each such ioctl leaks one dmabuf fd; after it, the fd table is unchanged on failure and only /dev/dma_heap/<name> remains open. No UAPI or heap-driver interface change. [1] https://lore.kernel.org/dri-devel/175e98de-f414-47d7-81c1-c0fe0a8f7f62@amd.… Fixes: c02a81fba74f ("dma-buf: Add dma-buf heaps framework") Cc: stable(a)vger.kernel.org Reviewed-by: T.J. Mercier <tjmercier(a)google.com> Acked-by: Christian König <christian.koenig(a)amd.com> Acked-by: Sumit Semwal <sumit.semwal(a)linaro.org> Signed-off-by: Baineng Shou <shoubaineng(a)gmail.com> Link: https://lore.kernel.org/r/20260817050457.1005285-2-shoubaineng@gmail.com Signed-off-by: Christian König <christian.koenig(a)amd.com> Conflicts: drivers/dma-buf/dma-buf.c drivers/dma-buf/dma-heap.c [1. Context conflicts. 2. This tree predates the trace_dma_buf_fd tracepoint, so the new helper drops the DMA_BUF_TRACE() call and only wraps fd_install().] Signed-off-by: Jiacheng Yu <yujiacheng3(a)huawei.com> --- drivers/dma-buf/dma-buf.c | 15 ++++++++ drivers/dma-buf/dma-heap.c | 78 +++++++++++++++++++------------------- include/linux/dma-buf.h | 1 + 3 files changed, 54 insertions(+), 40 deletions(-) diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c index 21916bba77d5..47783225ed02 100644 --- a/drivers/dma-buf/dma-buf.c +++ b/drivers/dma-buf/dma-buf.c @@ -714,6 +714,21 @@ int dma_buf_fd(struct dma_buf *dmabuf, int flags) } EXPORT_SYMBOL_NS_GPL(dma_buf_fd, DMA_BUF); +/** + * dma_buf_fd_install - install a reserved fd for a dma-buf + * @dmabuf: [in] pointer to dma_buf + * @fd: [in] fd reserved with get_unused_fd_flags() + * + * Publishes a previously reserved fd into the caller's fd table. + * Must only be called after all fallible work (e.g. copy_to_user) + * has succeeded, as it cannot be undone safely once called. + */ +void dma_buf_fd_install(struct dma_buf *dmabuf, int fd) +{ + fd_install(fd, dmabuf->file); +} +EXPORT_SYMBOL_NS_GPL(dma_buf_fd_install, DMA_BUF); + /** * dma_buf_get - returns the struct dma_buf related to an fd * @fd: [in] fd associated with the struct dma_buf to be returned diff --git a/drivers/dma-buf/dma-heap.c b/drivers/dma-buf/dma-heap.c index 84ae708fafe7..6acf8aa5c2e8 100644 --- a/drivers/dma-buf/dma-heap.c +++ b/drivers/dma-buf/dma-heap.c @@ -49,33 +49,6 @@ static dev_t dma_heap_devt; static struct class *dma_heap_class; static DEFINE_XARRAY_ALLOC(dma_heap_minors); -static int dma_heap_buffer_alloc(struct dma_heap *heap, size_t len, - unsigned int fd_flags, - unsigned int heap_flags) -{ - struct dma_buf *dmabuf; - int fd; - - /* - * Allocations from all heaps have to begin - * and end on page boundaries. - */ - len = PAGE_ALIGN(len); - if (!len) - return -EINVAL; - - dmabuf = heap->ops->allocate(heap, len, fd_flags, heap_flags); - if (IS_ERR(dmabuf)) - return PTR_ERR(dmabuf); - - fd = dma_buf_fd(dmabuf, fd_flags); - if (fd < 0) { - dma_buf_put(dmabuf); - /* just return, as put will call release and that will free */ - } - return fd; -} - static int dma_heap_open(struct inode *inode, struct file *file) { struct dma_heap *heap; @@ -93,30 +66,41 @@ static int dma_heap_open(struct inode *inode, struct file *file) return 0; } -static long dma_heap_ioctl_allocate(struct file *file, void *data) +static struct dma_buf *dma_heap_ioctl_allocate(struct file *file, void *data) { struct dma_heap_allocation_data *heap_allocation = data; struct dma_heap *heap = file->private_data; + struct dma_buf *dmabuf; int fd; + size_t len; if (heap_allocation->fd) - return -EINVAL; + return ERR_PTR(-EINVAL); if (heap_allocation->fd_flags & ~DMA_HEAP_VALID_FD_FLAGS) - return -EINVAL; + return ERR_PTR(-EINVAL); if (heap_allocation->heap_flags & ~DMA_HEAP_VALID_HEAP_FLAGS) - return -EINVAL; + return ERR_PTR(-EINVAL); + + len = PAGE_ALIGN(heap_allocation->len); + if (!len) + return ERR_PTR(-EINVAL); - fd = dma_heap_buffer_alloc(heap, heap_allocation->len, - heap_allocation->fd_flags, - heap_allocation->heap_flags); - if (fd < 0) - return fd; + dmabuf = heap->ops->allocate(heap, len, heap_allocation->fd_flags, + heap_allocation->heap_flags); + if (IS_ERR(dmabuf)) + return dmabuf; + + fd = get_unused_fd_flags(heap_allocation->fd_flags); + if (fd < 0) { + dma_buf_put(dmabuf); + return ERR_PTR(fd); + } heap_allocation->fd = fd; - return 0; + return dmabuf; } static unsigned int dma_heap_ioctl_cmds[] = { @@ -132,6 +116,8 @@ static long dma_heap_ioctl(struct file *file, unsigned int ucmd, unsigned int in_size, out_size, drv_size, ksize; int nr = _IOC_NR(ucmd); int ret = 0; + int fd; + struct dma_buf *dmabuf; if (nr >= ARRAY_SIZE(dma_heap_ioctl_cmds)) return -EINVAL; @@ -168,15 +154,27 @@ static long dma_heap_ioctl(struct file *file, unsigned int ucmd, switch (kcmd) { case DMA_HEAP_IOCTL_ALLOC: - ret = dma_heap_ioctl_allocate(file, kdata); + dmabuf = dma_heap_ioctl_allocate(file, kdata); + if (IS_ERR(dmabuf)) { + ret = PTR_ERR(dmabuf); + break; + } + + fd = ((struct dma_heap_allocation_data *)kdata)->fd; + if (copy_to_user((void __user *)arg, kdata, out_size) != 0) { + put_unused_fd(fd); + dma_buf_put(dmabuf); + ret = -EFAULT; + } else { + dma_buf_fd_install(dmabuf, fd); + } + break; default: ret = -ENOTTY; goto err; } - if (copy_to_user((void __user *)arg, kdata, out_size) != 0) - ret = -EFAULT; err: if (kdata != stack_kdata) kfree(kdata); diff --git a/include/linux/dma-buf.h b/include/linux/dma-buf.h index 3f31baa3293f..e29dcab1d2d1 100644 --- a/include/linux/dma-buf.h +++ b/include/linux/dma-buf.h @@ -606,6 +606,7 @@ void dma_buf_unpin(struct dma_buf_attachment *attach); struct dma_buf *dma_buf_export(const struct dma_buf_export_info *exp_info); int dma_buf_fd(struct dma_buf *dmabuf, int flags); +void dma_buf_fd_install(struct dma_buf *dmabuf, int fd); struct dma_buf *dma_buf_get(int fd); void dma_buf_put(struct dma_buf *dmabuf); -- 2.34.1

2 1

[PATCH OLK-5.10] nouveau/gem: reserve the bo in the info ioctl around the vma lookup
by Jiacheng Yu 28 Oct '26

28 Oct '26

From: Dave Airlie <airlied(a)redhat.com> mainline inclusion from mainline-v7.3-rc1 commit 5e17160d41d92823f3379c1982e1369680c5ce4d category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/18887 CVE: CVE-2026-89553 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In the non-uvmm path, there could be a race between the info lookup finding the vma, and the gem close path closing the vma leading to a use-after-free. Spotted with the help of Opus 4.6. Signed-off-by: Dave Airlie <airlied(a)redhat.com> Fixes: e758a3111914 ("drm/nouveau: fixup gem_info ioctl to return client-specific bo virtual") Cc: stable(a)vger.kernel.org Link: https://patch.msgid.link/20260612020658.3176270-1-airlied@gmail.com Signed-off-by: Danilo Krummrich <dakr(a)kernel.org> Conflicts: drivers/gpu/drm/nouveau/nouveau_gem.c [This tree predates the uvmm rework: there is no nouveau_cli_uvmm() helper and nouveau_gem_object_close() unconditionally releases the vma under the reservation lock. Drop the "!nouveau_cli_uvmm(cli)" condition and the "else rep->offset = 0;" arm, keeping only the ttm_bo_reserve()/unreserve() around nouveau_vma_find() and the vma->addr read.] Signed-off-by: Jiacheng Yu <yujiacheng3(a)huawei.com> --- drivers/gpu/drm/nouveau/nouveau_gem.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c index 6504ebec11901..ec585da438726 100644 --- a/drivers/gpu/drm/nouveau/nouveau_gem.c +++ b/drivers/gpu/drm/nouveau/nouveau_gem.c @@ -230,11 +230,20 @@ nouveau_gem_info(struct drm_file *file_priv, struct drm_gem_object *gem, rep->domain = NOUVEAU_GEM_DOMAIN_VRAM; rep->offset = nvbo->offset; if (vmm->vmm.object.oclass >= NVIF_CLASS_VMM_NV50) { + int ret; + + ret = ttm_bo_reserve(&nvbo->bo, false, false, NULL); + if (ret) + return ret; + vma = nouveau_vma_find(nvbo, vmm); - if (!vma) + if (!vma) { + ttm_bo_unreserve(&nvbo->bo); return -EINVAL; + } rep->offset = vma->addr; + ttm_bo_unreserve(&nvbo->bo); } rep->size = nvbo->bo.mem.num_pages << PAGE_SHIFT; -- 2.34.1

2 1

[PATCH OLK-6.6] smb: client: use i_size_read instead of old i_size
by Yifan Qiao 28 Oct '26

28 Oct '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20573 -------------------------------- Fix the conflicts of commits 7e86ecfec95f8aa11e736a8560868fea652f661a and fe13fc4d19b587e24082c8c1a6457521090075e1. Use i_size_read instead of using old i_size. i_size was deleted by the first commit. Fixes: fe13fc4d19b5 ("smb: client: discard post-EOF pagecache when extending a file via zero range") Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/smb/client/smb2ops.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c index 7013b6c3abe4..924250cd8476 100644 --- a/fs/smb/client/smb2ops.c +++ b/fs/smb/client/smb2ops.c @@ -3291,7 +3291,8 @@ static long smb3_zero_range(struct file *file, struct cifs_tcon *tcon, * Start at the old EOF when extending so the folio straddling it, which * may hold data written past EOF through an mmap, is dropped too. */ - truncate_pagecache_range(inode, min(offset, i_size), offset + len - 1); + truncate_pagecache_range(inode, min_t(unsigned long long, offset, + i_size_read(inode)), offset + len - 1); /* if file not oplocked can't be sure whether asking to extend size */ rc = -EOPNOTSUPP; -- 2.52.0

2 1

[PATCH OLK-6.6] smb: client: use i_size_read instead of old i_size
by Yifan Qiao 28 Oct '26

28 Oct '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20573 -------------------------------- Fix the conflicts of commits bebef902d8e77fadccdbfa89634ab09c93c226a6 and 8e3ef1f6422041ba66580a6fc48b0719e00860fd. Use i_size_read instead of using old i_size. i_size was deleted by the later commit. Fixes: fe13fc4d19b5 ("smb: client: discard post-EOF pagecache when extending a file via zero range") Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/smb/client/smb2ops.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c index 7013b6c3abe4..924250cd8476 100644 --- a/fs/smb/client/smb2ops.c +++ b/fs/smb/client/smb2ops.c @@ -3291,7 +3291,8 @@ static long smb3_zero_range(struct file *file, struct cifs_tcon *tcon, * Start at the old EOF when extending so the folio straddling it, which * may hold data written past EOF through an mmap, is dropped too. */ - truncate_pagecache_range(inode, min(offset, i_size), offset + len - 1); + truncate_pagecache_range(inode, min_t(unsigned long long, offset, + i_size_read(inode)), offset + len - 1); /* if file not oplocked can't be sure whether asking to extend size */ rc = -EOPNOTSUPP; -- 2.52.0

2 1

[PATCH OLK-6.6] smb: client: use i_size_read instead of old i_size
by Yifan Qiao 28 Oct '26

28 Oct '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20573 -------------------------------- Fix the conflicts of commits bebef902d8e77fadccdbfa89634ab09c93c226a6 and 8e3ef1f6422041ba66580a6fc48b0719e00860fd. Use i_size_read instead of using old i_size. Fixes: fe13fc4d19b5 ("smb: client: discard post-EOF pagecache when extending a file via zero range") Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/smb/client/smb2ops.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/smb/client/smb2ops.c b/fs/smb/client/smb2ops.c index 7013b6c3abe4..924250cd8476 100644 --- a/fs/smb/client/smb2ops.c +++ b/fs/smb/client/smb2ops.c @@ -3291,7 +3291,8 @@ static long smb3_zero_range(struct file *file, struct cifs_tcon *tcon, * Start at the old EOF when extending so the folio straddling it, which * may hold data written past EOF through an mmap, is dropped too. */ - truncate_pagecache_range(inode, min(offset, i_size), offset + len - 1); + truncate_pagecache_range(inode, min_t(unsigned long long, offset, + i_size_read(inode)), offset + len - 1); /* if file not oplocked can't be sure whether asking to extend size */ rc = -EOPNOTSUPP; -- 2.52.0

2 1

[PATCH OLK-6.6 0/2] Fix CVE-2026-98044
by Chen Yuxi 28 Oct '26

28 Oct '26

Fix CVE-2026-98044 and the kabi breakage. Chen Yuxi (1): bpf: Fix kabi breakage in struct bpf_subprog_info Kumar Kartikeya Dwivedi (1): bpf: Reject legacy packet loads from callbacks include/linux/bpf_verifier.h | 1 + kernel/bpf/verifier.c | 22 ++++++++++++++++++++++ 2 files changed, 23 insertions(+) -- 2.34.1

2 3