本仓库基于 Rockchip 主线分支 `develop-6.6`，合并了 OpenHarmony `kernel/linux/linux-6.6` 的代码。
| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
回退 'Pull Request !193 : lts升级 6.6.101->6.6.102' | 1 年前 | |
LICENSES: Add the copyleft-next-0.3.1 license Add the full text of the copyleft-next-0.3.1 license to the kernel tree as well as the required tags for reference and tooling. The license text was copied directly from the copyleft-next project's git tree [0]. Discussion of using copyleft-next-0.3.1 on Linux started since June, 2016 [1]. In the end Linus' preference was to have drivers use MODULE_LICENSE("GPL") to make it clear that the GPL applies when it comes to Linux [2]. Additionally, even though copyleft-next-0.3.1 has been found to be to be GPLv2 compatible by three attorneys at SUSE and Redhat [3], to err on the side of caution we simply recommend to always use the "OR" language for this license [4]. Even though it has been a goal of the project to be GPL-v2 compatible to be certain in 2016 I asked for a clarification about what makes copyleft-next GPLv2 compatible and also asked for a summary of benefits. This prompted some small minor changes to make compatibility even further clear and as of copyleft 0.3.1 compatibility should be crystal clear [5]. The summary of why copyleft-next 0.3.1 is compatible with GPLv2 is explained as follows: Like GPLv2, copyleft-next requires distribution of derivative works ("Derived Works" in copyleft-next 0.3.x) to be under the same license. Ordinarily this would make the two licenses incompatible. However, copyleft-next 0.3.1 says: "If the Derived Work includes material licensed under the GPL, You may instead license the Derived Work under the GPL." "GPL" is defined to include GPLv2. In practice this means copyleft-next code in Linux may be licensed under the GPL2, however there are additional obvious gains for bringing contributions from Linux outbound where copyleft-next is preferred. A summary of benefits why projects outside of Linux might prefer to use copyleft-next >= 0.3.1 over GPLv2: o It is much shorter and simpler o It has an explicit patent license grant, unlike GPLv2 o Its notice preservation conditions are clearer o More free software/open source licenses are compatible with it (via section 4) o The source code requirement triggered by binary distribution is much simpler in a procedural sense o Recipients potentially have a contract claim against distributors who are noncompliant with the source code requirement o There is a built-in inbound=outbound policy for upstream contributions (cf. Apache License 2.0 section 5) o There are disincentives to engage in the controversial practice of copyleft/ proprietary dual-licensing o In 15 years copyleft expires, which can be advantageous for legacy code o There are explicit disincentives to bringing patent infringement claims accusing the licensed work of infringement (see 10b) o There is a cure period for licensees who are not compliant with the license (there is no cure opportunity in GPLv2) o copyleft-next has a 'built-in or-later' provision The first driver submission to Linux under this dual strategy was lib/test_sysctl.c through commit 9308f2f9e7f05 ("test_sysctl: add dedicated proc sysctl test driver") merged in July 2017. Shortly after that I also added test_kmod through commit d9c6a72d6fa29 ("kmod: add test driver to stress test the module loader") in the same month. These two drivers went in just a few months before the SPDX license practice kicked in. In 2018 Kuno Woudt went through the process to get SPDX identifiers for copyleft-next [6] [7]. Although there are SPDX tags for copyleft-next-0.3.0, we only document use in Linux starting from copyleft-next-0.3.1 which makes GPLv2 compatibility crystal clear. This patch will let us update the two Linux selftest drivers in subsequent patches with their respective SPDX license identifiers and let us remove repetitive license boiler plate. [0] https://github.com/copyleft-next/copyleft-next/blob/master/Releases/copyleft-next-0.3.1 [1] https://lore.kernel.org/lkml/1465929311-13509-1-git-send-email-mcgrof@kernel.org/ [2] https://lore.kernel.org/lkml/CA+55aFyhxcvD+q7tp+-yrSFDKfR0mOHgyEAe=f_94aKLsOu0Og@mail.gmail.com/ [3] https://lore.kernel.org/lkml/20170516232702.GL17314@wotan.suse.de/ [4] https://lkml.kernel.org/r/1495234558.7848.122.camel@linux.intel.com [5] https://lists.fedorahosted.org/archives/list/copyleft-next@lists.fedorahosted.org/thread/JTGV56DDADWGKU7ZKTZA4DLXTGTLNJ57/#SQMDIKBRAVDOCT4UVNOOCRGBN2UJIKHZ [6] https://spdx.org/licenses/copyleft-next-0.3.0.html [7] https://spdx.org/licenses/copyleft-next-0.3.1.html Cc: Goldwyn Rodrigues <rgoldwyn@suse.com> Cc: Kuno Woudt <kuno@frob.nl> Cc: Richard Fontana <fontana@sharpeleven.org> Cc: copyleft-next@lists.fedorahosted.org Cc: Ciaran Farrell <Ciaran.Farrell@suse.com> Cc: Christopher De Nicolo <Christopher.DeNicolo@suse.com> Cc: Christoph Hellwig <hch@lst.de> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Jonathan Corbet <corbet@lwn.net> Cc: Thorsten Leemhuis <linux@leemhuis.info> Cc: Andrew Morton <akpm@linux-foundation.org> Reviewed-by: Kees Cook <keescook@chromium.org> Signed-off-by: Luis Chamberlain <mcgrof@kernel.org> Reviewed-by: Tim Bird <tim.bird@sony.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 3 年前 | |
f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() mainline inclusion from mainline-6.6.140 commit 1171f329cf1c175321251ac40fd126150d7ad1e8 category: bugfix issue: #758 CVE: CVE-2026-31715 Signed-off-by: 姜小林 <jiangxiaolin11@huawei.com> Co-Authored-By: Agent ------------------------------- f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() The xfstests case "generic/107" and syzbot have both reported a NULL pointer dereference. The concurrent scenario that triggers the panic is as follows: F2FS_WB_CP_DATA write callback umount - f2fs_write_checkpoint - f2fs_wait_on_all_pages(sbi, F2FS_WB_CP_DATA) - blk_mq_end_request - bio_endio - f2fs_write_end_io : dec_page_count(sbi, F2FS_WB_CP_DATA) : wake_up(&sbi->cp_wait) - kill_f2fs_super - kill_block_super - f2fs_put_super : iput(sbi->node_inode) : sbi->node_inode = NULL : f2fs_in_warm_node_list - is_node_folio // sbi->node_inode is NULL and panic The root cause is that f2fs_put_super() calls iput(sbi->node_inode) and sets sbi->node_inode to NULL after sbi->nr_pages[F2FS_WB_CP_DATA] is decremented to zero. As a result, f2fs_in_warm_node_list() may dereference a NULL node_inode when checking whether a folio belongs to the node inode, leading to a panic. This patch fixes the issue by calling f2fs_in_warm_node_list() before decrementing sbi->nr_pages[F2FS_WB_CP_DATA], thus preventing the use-after-free condition. Cc: stable@kernel.org Fixes: 50fa53eccf9f ("f2fs: fix to avoid broken of dnode block list") Reported-by: syzbot+6e4cb1cac5efc96ea0ca@syzkaller.appspotmail.com Signed-off-by: Yongpeng Yang <yangyongpeng@xiaomi.com> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org> Change-Id: I2e8b1f4a7c3d5e9f0a6b2c8d4e1f7a3b5d9c2e6f8 | 3 个月前 | |
block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock stable inclusion from stable-6.6.105 commit 59e25ef2b413c category: bugfix issue: #206 CVE: CVE-2025-68756 Signed-off-by: w00955705 <wangchenyang65@huawei.com> --------------------------------------- blk_mq_{add,del}_queue_tag_set() functions add and remove queues from tagset, the functions make sure that tagset and queues are marked as shared when two or more queues are attached to the same tagset. Initially a tagset starts as unshared and when the number of added queues reaches two, blk_mq_add_queue_tag_set() marks it as shared along with all the queues attached to it. When the number of attached queues drops to 1 blk_mq_del_queue_tag_set() need to mark both the tagset and the remaining queues as unshared. Both functions need to freeze current queues in tagset before setting on unsetting BLK_MQ_F_TAG_QUEUE_SHARED flag. While doing so, both functions hold set->tag_list_lock mutex, which makes sense as we do not want queues to be added or deleted in the process. This used to work fine until commit 98d81f0df70c ("nvme: use blk_mq_[un]quiesce_tagset") made the nvme driver quiesce tagset instead of quiscing individual queues. blk_mq_quiesce_tagset() does the job and quiesce the queues in set->tag_list while holding set->tag_list_lock also. This results in deadlock between two threads with these stacktraces: __schedule+0x47c/0xbb0 ? timerqueue_add+0x66/0xb0 schedule+0x1c/0xa0 schedule_preempt_disabled+0xa/0x10 __mutex_lock.constprop.0+0x271/0x600 blk_mq_quiesce_tagset+0x25/0xc0 nvme_dev_disable+0x9c/0x250 nvme_timeout+0x1fc/0x520 blk_mq_handle_expired+0x5c/0x90 bt_iter+0x7e/0x90 blk_mq_queue_tag_busy_iter+0x27e/0x550 ? __blk_mq_complete_request_remote+0x10/0x10 ? __blk_mq_complete_request_remote+0x10/0x10 ? __call_rcu_common.constprop.0+0x1c0/0x210 blk_mq_timeout_work+0x12d/0x170 process_one_work+0x12e/0x2d0 worker_thread+0x288/0x3a0 ? rescuer_thread+0x480/0x480 kthread+0xb8/0xe0 ? kthread_park+0x80/0x80 ret_from_fork+0x2d/0x50 ? kthread_park+0x80/0x80 ret_from_fork_asm+0x11/0x20 __schedule+0x47c/0xbb0 ? xas_find+0x161/0x1a0 schedule+0x1c/0xa0 blk_mq_freeze_queue_wait+0x3d/0x70 ? destroy_sched_domains_rcu+0x30/0x30 blk_mq_update_tag_set_shared+0x44/0x80 blk_mq_exit_queue+0x141/0x150 del_gendisk+0x25a/0x2d0 nvme_ns_remove+0xc9/0x170 nvme_remove_namespaces+0xc7/0x100 nvme_remove+0x62/0x150 pci_device_remove+0x23/0x60 device_release_driver_internal+0x159/0x200 unbind_store+0x99/0xa0 kernfs_fop_write_iter+0x112/0x1e0 vfs_write+0x2b1/0x3d0 ksys_write+0x4e/0xb0 do_syscall_64+0x5b/0x160 entry_SYSCALL_64_after_hwframe+0x4b/0x53 The top stacktrace is showing nvme_timeout() called to handle nvme command timeout. timeout handler is trying to disable the controller and as a first step, it needs to blk_mq_quiesce_tagset() to tell blk-mq not to call queue callback handlers. The thread is stuck waiting for set->tag_list_lock as it tries to walk the queues in set->tag_list. The lock is held by the second thread in the bottom stack which is waiting for one of queues to be frozen. The queue usage counter will drop to zero after nvme_timeout() finishes, and this will not happen because the thread will wait for this mutex forever. Given that [un]quiescing queue is an operation that does not need to sleep, update blk_mq_[un]quiesce_tagset() to use RCU instead of taking set->tag_list_lock, update blk_mq_{add,del}_queue_tag_set() to use RCU safe list operations. Also, delete INIT_LIST_HEAD(&q->tag_set_list) in blk_mq_del_queue_tag_set() because we can not re-initialize it while the list is being traversed under RCU. The deleted queue will not be added/deleted to/from a tagset and it will be freed in blk_free_queue() after the end of RCU grace period. Signed-off-by: Mohamed Khalfella <mkhalfella@purestorage.com> Fixes: 98d81f0df70c ("nvme: use blk_mq_[un]quiesce_tagset") Reviewed-by: Ming Lei <ming.lei@redhat.com> Reviewed-by: Bart Van Assche <bvanassche@acm.org> Signed-off-by: Jens Axboe <axboe@kernel.dk> Co-Authored-By: Agent Signed-off-by: w00955705 wangchenyang65@huawei.com | 6 个月前 | |
sign-file,extract-cert: use pkcs11 provider for OPENSSL MAJOR >= 3 stable inclusion from stable-6.6.88 commit 2eb70f54ad8634b63402bd9bcea8e4ee5af85add category: bugfix issue: #IC6IH3 CVE: NA Signed-off-by: zyf1116 <zhouyongfei3@huawei.com> --------------------------------------- commit 558bdc45dfb2669e1741384a0c80be9c82fa052c upstream. ENGINE API has been deprecated since OpenSSL version 3.0 [1]. Distros have started dropping support from headers and in future it will likely disappear also from library. It has been superseded by the PROVIDER API, so use it instead for OPENSSL MAJOR >= 3. [1] https://github.com/openssl/openssl/blob/master/README-ENGINES.md [jarkko: fixed up alignment issues reported by checkpatch.pl --strict] Signed-off-by: Jan Stancek <jstancek@redhat.com> Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org> Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com> Reviewed-by: Neal Gompa <neal@gompa.dev> Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: zyf1116 <zhouyongfei3@huawei.com> | 1 年前 | |
!384 merge cve-fix-20260522-kernel_linux_6.6-master into master CVE修复: kernel_linux_6.6 master (55 个安全补丁) - 2026-05-22 Created-by: Hun_Dun Commit-by: Hun_Dun Merged-by: openharmony_ci Description: ## CVE 修复列表 | CVE ID | 标题 | Commit | |--------|------|--------| | CVE-2026-31726 | usb: gadget: uvc: fix NULL pointer dereference dur... | c78e463ee134 | | CVE-2026-31759 | usb: ulpi: fix double free in ulpi_register_interf... | aaeae6533d77 | | CVE-2026-43024 | netfilter: nf_tables: reject immediate NF_QUEUE ve... | 4b12a3cc3f07 | | CVE-2026-43026 | netfilter: ctnetlink: zero expect NAT fields when ... | 2898080c054e | | CVE-2026-43027 | netfilter: nf_conntrack_helper: pass helper to exp... | 2cf2737c85a2 | | CVE-2026-43028 | netfilter: x_tables: ensure names are nul-terminat... | c2d4a3abb15c | | CVE-2026-43035 | net: sched: cls_api: fix tc_chain_fill_node to ini... | e35f5195cd44 | | CVE-2026-43060 | netfilter: nft_ct: drop pending enqueued packets o... | e68a8db3a054 | | CVE-2026-43073 | x86-64: rename misleadingly named '__copy_user_noc... | d187a86de793 | | CVE-2026-43077 | crypto: algif_aead - Fix minimum RX size check for... | 3d14bd48e3a7 | | CVE-2026-43080 | l2tp: Drop large packets with UDP encap | ebe560ea5f54 | | CVE-2026-43082 | net: txgbe: leave space for null terminators on pr... | 5a37d228799b | | CVE-2026-43085 | netfilter: nfnetlink_log: initialize nfgenmsg in N... | 1f3083aec883 | | CVE-2026-43086 | ipvs: fix NULL deref in ip_vs_add_service error pa... | 9a91797e61d2 | | CVE-2026-43088 | net: af_key: zero aligned sockaddr tail in PF_KEY ... | 426c355742f0 | | CVE-2026-43089 | xfrm_user: fix info leak in build_mapping() | 1beb76b2053b | | CVE-2026-43091 | xfrm: Wait for RCU readers during policy netns exi... | 069daad4f2ae | | CVE-2026-43107 | xfrm: account XFRMA_IF_ID in aevent size calculati... | 7081d46d3231 | | CVE-2026-43114 | netfilter: nft_set_pipapo_avx2: don't return non-m... | d3c0037ffe12 | | CVE-2026-43116 | netfilter: ctnetlink: ensure safe access to master... | bffcaad9afdf | | CVE-2026-43128 | RDMA/umem: Fix double dma_buf_unpin in failure pat... | b324327ff6f4 | | CVE-2026-43129 | ima: verify the previous kernel's IMA buffer lies ... | 10d1c75ed438 | | CVE-2026-43130 | iommu/vt-d: Flush dev-IOTLB only when PCIe device ... | 01aed2f1d7cb | | CVE-2026-43136 | HID: logitech-hidpp: Check maxfield in hidpp_get_r... | b74bf7d0d01f | | CVE-2026-43139 | xfrm6: fix uninitialized saddr in xfrm6_get_saddr(... | 719918fc88df | | CVE-2026-43161 | iommu/vt-d: Skip dev-iotlb flush for inaccessible ... | 42662d19839f | | CVE-2026-43167 | xfrm: always flush state and policy upon NETDEV_UN... | 166801e49a5b | | CVE-2026-43180 | net: usb: kaweth: remove TX queue manipulation in ... | ef9b10a02050 | | CVE-2026-43190 | netfilter: xt_tcpmss: check remaining length befor... | 07a9b32eaae7 | | CVE-2026-43199 | net/mlx5e: Fix "scheduling while atomic" in IPsec ... | 859380694f43 | | CVE-2026-43238 | net/sched: act_skbedit: fix divide-by-zero in tcf_... | 9c735a7d98c9 | | CVE-2026-43248 | vhost: move vdpa group bound check to vhost_vdpa | cd025c1e876b | | CVE-2026-43281 | mailbox: Prevent out-of-bounds access in fw_mbox_i... | 31c4c67dec33 | | CVE-2026-43292 | mm/vmalloc: prevent RCU stalls in kasan_release_vm... | 5747435e0fd4 | | CVE-2026-43304 | libceph: define and enforce CEPH_MAX_KEY_LEN | e1dc45d97975 | | CVE-2026-43309 | md raid: fix hang when stopping arrays with metada... | cefcb9297fbd | | CVE-2026-43310 | media: verisilicon: Avoid G2 bus error while decod... | e0203ddf9af7 | | CVE-2026-43319 | spi: spidev: fix lock inversion between spi_lock a... | 40534d19ed2a | | CVE-2026-43324 | USB: dummy-hcd: Fix interrupt synchronization erro... | 5aa776c8615b | | CVE-2026-43330 | crypto: caam - fix overflow on long hmac keys | 31022cfde523 | | CVE-2026-43332 | thermal: core: Fix thermal zone device registratio... | 9e796001af97 | | CVE-2026-43339 | ipv6: prevent possible UaF in addrconf_permanent_a... | 7d9f2f4aabd1 | | CVE-2026-43353 | i3c: mipi-i3c-hci: Fix race in DMA ring dequeue | 1dca8aee80ee | | CVE-2026-43406 | libceph: prevent potential out-of-bounds reads in ... | 50156622eb08 | | CVE-2026-43413 | scsi: hisi_sas: Fix NULL pointer exception during ... | 70c78429ef38 | | CVE-2026-43439 | cgroup: fix race between task migration and iterat... | 3dfd1328c052 | | CVE-2026-43441 | net: bonding: Fix nd_tbl NULL dereference when IPv... | cf6099ef493b | | CVE-2026-43450 | netfilter: nfnetlink_cthelper: fix OOB read in nfn... | 4a1f6ee69267 | | CVE-2026-43451 | netfilter: nfnetlink_queue: fix entry leak in brid... | 47b1c5d1b094 | | CVE-2026-43452 | netfilter: x_tables: guard option walkers against ... | 9b94f0e42ed2 | | CVE-2026-43453 | netfilter: nft_set_pipapo: fix stack out-of-bounds... | 0a55d62cdb62 | | CVE-2026-43456 | bonding: fix type confusion in bond_setup_by_slave... | 950803f72547 | | CVE-2026-43466 | net/mlx5e: Fix DMA FIFO desync on error CQE SQ rec... | 383b37c04a48 | | CVE-2026-43468 | net/mlx5: Fix deadlock between devlink lock and es... | 957d2a58f7f8 | | CVE-2026-43475 | scsi: storvsc: Fix scheduling while atomic on PREE... | e7919a293f9b | **来源**: Cherry-pick from stable-tags/v6.6.134~18 ## 统计 - **总数**: 60 - **成功**: 55 - **空提交（已存在）**: 3 - **跳过**: 2 ## 修复详情 ### CVE-2026-31726 - **Commit**: c78e463ee134b4669579d453c81ae00795e4c19a - **Stable**: tags/v6.6.134~18 - **标题**: usb: gadget: uvc: fix NULL pointer dereference during unbind race ### CVE-2026-31759 - **Commit**: aaeae6533d77e6ed4def85baec01e2815ebbef61 - **Stable**: tags/v6.6.134~56 - **标题**: usb: ulpi: fix double free in ulpi_register_interface() error path ### CVE-2026-43024 - **Commit**: 4b12a3cc3f075e750cc3c5e693fd25fb400af4a2 - **Stable**: tags/v6.6.134~116 - **标题**: netfilter: nf_tables: reject immediate NF_QUEUE verdict ### CVE-2026-43026 - **Commit**: 2898080c054ea4d6ddfaaf21bbedbc229a9a8376 - **Stable**: tags/v6.6.134~122 - **标题**: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent ### CVE-2026-43027 - **Commit**: 2cf2737c85a2ba2b52024dafe68ffad2676f97be - **Stable**: tags/v6.6.134~123 - **标题**: netfilter: nf_conntrack_helper: pass helper to expect cleanup ### CVE-2026-43028 - **Commit**: c2d4a3abb15ca14716c6d8b9ffcbcd7c63626af4 - **Stable**: tags/v6.6.134~125 - **标题**: netfilter: x_tables: ensure names are nul-terminated ### CVE-2026-43035 - **Commit**: e35f5195cd44ff4053fbc5d71ea97681728a0099 - **Stable**: tags/v6.6.134~132 - **标题**: net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak ### CVE-2026-43060 - **Commit**: e68a8db3a0546482b34e9ca5ca886bcf73eb37bb - **Stable**: tags/v6.6.130~52 - **标题**: netfilter: nft_ct: drop pending enqueued packets on removal ### CVE-2026-43073 - **Commit**: d187a86de793f84766ea40b9ade7ac60aabbb4fe - **Stable**: tags/v7.1-rc1~251^2~2 - **标题**: x86-64: rename misleadingly named '__copy_user_nocache()' function ### CVE-2026-43077 - **Commit**: 3d14bd48e3a77091cbce637a12c2ae31b4a1687c - **Stable**: tags/v7.0~7^2 - **标题**: crypto: algif_aead - Fix minimum RX size check for decryption ### CVE-2026-43080 - **Commit**: ebe560ea5f54134279356703e73b7f867c89db13 - **Stable**: tags/v7.0~27^2~2 - **标题**: l2tp: Drop large packets with UDP encap ### CVE-2026-43082 - **Commit**: 5a37d228799b0ec2c277459c83c814a59d310bc3 - **Stable**: tags/v7.0~27^2~11 - **标题**: net: txgbe: leave space for null terminators on property_entry ### CVE-2026-43085 - **Commit**: 1f3083aec8836213da441270cdb1ab612dd82cf4 - **Stable**: tags/v7.0~27^2~16^2~5 - **标题**: netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator ### CVE-2026-43086 - **Commit**: 9a91797e61d286805ae10a92cc48959c30800556 - **Stable**: tags/v7.0~27^2~16^2~6 - **标题**: ipvs: fix NULL deref in ip_vs_add_service error path ### CVE-2026-43088 - **Commit**: 426c355742f02cf743b347d9d7dbdc1bfbfa31ef - **Stable**: tags/v7.0~27^2~14^2 - **标题**: net: af_key: zero aligned sockaddr tail in PF_KEY exports ### CVE-2026-43089 - **Commit**: 1beb76b2053b68c491b78370794b8ff63c8f8c02 - **Stable**: tags/v7.0~27^2~14^2~2 - **标题**: xfrm_user: fix info leak in build_mapping() ### CVE-2026-43091 - **Commit**: 069daad4f2ae9c5c108131995529d5f02392c446 - **Stable**: tags/v7.0~27^2~14^2~5 - **标题**: xfrm: Wait for RCU readers during policy netns exit ### CVE-2026-43107 - **Commit**: 7081d46d32312f1a31f0e0e99c6835a394037599 - **Stable**: tags/v7.0~27^2~14^2~6 - **标题**: xfrm: account XFRMA_IF_ID in aevent size calculation ### CVE-2026-43114 - **Commit**: d3c0037ffe1273fa1961e779ff6906234d6cf53c - **Stable**: tags/v7.0-rc6~40^2^2~11 - **标题**: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry ### CVE-2026-43116 - **Commit**: bffcaad9afdfe45d7fc777397d3b83c1e3ebffe5 - **Stable**: tags/v7.0-rc6~40^2^2~4 - **标题**: netfilter: ctnetlink: ensure safe access to master conntrack ### CVE-2026-43128 - **Commit**: b324327ff6f48d8065dca67eb3b91357e72726bd - **Stable**: tags/v6.6.128~137 - **标题**: RDMA/umem: Fix double dma_buf_unpin in failure path ### CVE-2026-43129 - **Commit**: 10d1c75ed4382a8e79874379caa2ead8952734f9 - **Stable**: tags/v7.0-rc1~46^2~76 - **标题**: ima: verify the previous kernel's IMA buffer lies in addressable RAM ### CVE-2026-43130 - **Commit**: 01aed2f1d7cb8fdf4c60c5bb4727608cb82b401d - **Stable**: tags/v6.6.128~70 - **标题**: iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode ### CVE-2026-43136 - **Commit**: b74bf7d0d01fa9b53653f58c29aa00772121f6e9 - **Stable**: tags/v6.6.128~111 - **标题**: HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() ### CVE-2026-43139 - **Commit**: 719918fc88df6da023dfff370cd965151a5afd7f - **Stable**: tags/v6.6.128~157 - **标题**: xfrm6: fix uninitialized saddr in xfrm6_get_saddr() ### CVE-2026-43161 - **Commit**: 42662d19839f34735b718129ea200e3734b07e50 - **Stable**: tags/v7.0-rc1~137^2^3~6 - **标题**: iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode ### CVE-2 See merge request: openharmony/kernel_linux_6.6!384 | 3 个月前 | |
fix: correct CVE-2026-23472 backporting error in uart_write_room() The upstream patch for CVE-2026-23472 was written for a kernel that already migrated UART xmit from circ_buf to kfifo. In kernel 6.6, struct uart_state still uses circ_buf (state->xmit), not kfifo (state->port.xmit_fifo). The incorrect backport caused uart_write_room() to always return 0 because state->port.xmit_buf (tty_port field) is never initialized for UART ports, while the actual buffer is state->xmit.buf (circ_buf). This broke all serial console output on ARM64 boards, causing init process failure where rcS produces no log output. Fix by using the correct 6.6 circ_buf API: - state->port.xmit_buf -> state->xmit.buf - kfifo_avail(&state->port.xmit_fifo) -> uart_circ_chars_free(&state->xmit) Fixes: c9231ee88555 ("serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN") Change-Id: Ib67d15c1bfb4709888703f70 Signed-off-by: 姜小林 <jiangxiaolin11@huawei.com> | 3 个月前 | |
!390 merge wcyfix into master esp: fix skb leak with espintcp and async crypto Created-by: chenyang_w Commit-by: llj123 Merged-by: openharmony_ci Description: ## CVE 修复列表 本次 PR 包含 **23** 个 CVE 安全补丁。 ### CVE 详情 - **CVE-2026-23340**: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - Commit: dbd58b0730aa - **CVE-2026-23367**: wifi: radiotap: reject radiotap with unknown bits - Commit: 129c8bb320a7 - **CVE-2026-23442**: ipv6: add NULL checks for idev in SRv6 paths - Commit: 50352fc10392 - **CVE-2026-31412**: usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks() - Commit: ce0caaed5940 - **CVE-2026-31424**: netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP - Commit: f00ac65c90ea - **CVE-2026-31447**: ext4: reject mount if bigalloc with s_first_data_block != 0 - Commit: b77de3fceafb - **CVE-2026-31450**: ext4: publish jinode after initialization - Commit: a070d5a872ff - **CVE-2026-31454**: xfs: save ailp before dropping the AIL lock in push callbacks - Commit: 75669e987137 - **CVE-2026-31495**: netfilter: ctnetlink: use netlink policy range checks - Commit: fcec5ce2d73a - **CVE-2026-31496**: netfilter: nf_conntrack_expect: skip expectations in other netns via proc - Commit: 168145c87444 - **CVE-2026-31497**: Bluetooth: btusb: clamp SCO altsetting table indices - Commit: 6fba3c3d48c9 - **CVE-2026-31498**: Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop - Commit: 52667c859fe3 - **CVE-2026-31510**: Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb - Commit: a04a760c06bb - **CVE-2026-31512**: Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() - Commit: 477ad4976072 - **CVE-2026-31515**: af_key: validate families in pfkey_send_migrate() - Commit: d3225e6b9bd5 - **CVE-2026-31521**: module: Fix kernel panic when a symbol st_shndx is out of bounds - Commit: 082f15d28873 - **CVE-2026-31602**: ALSA: ctxfi: Limit PTP to a single page - Commit: 452894005b4a - **CVE-2026-31664**: xfrm: clear trailing padding in build_polexpire() - Commit: c221ed63a276 - **CVE-2026-31667**: Input: uinput - fix circular locking dependency with ff-core - Commit: 546c18a14924 - **CVE-2026-31668**: seg6: separate dst_cache for input and output paths in seg6 lwtunnel - Commit: 84d458018b14 - **CVE-2026-31671**: xfrm_user: fix info leak in build_report() - Commit: e0c8542c3d09 - **CVE-2026-31680**: net: ipv6: flowlabel: defer exclusive option free until RCU teardown - Commit: 6c7fbdb8ffde - **CVE-2026-31705**: ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment - Commit: ffbce350c6fd ### 关联 Issue Closes #862 See merge request: openharmony/kernel_linux_6.6!390 | 3 个月前 | |
net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs [ Upstream commit 7f083faf59d14c04e01ec05a7507f036c965acf8 ] When shrinking the number of real tx queues, netif_set_real_num_tx_queues() calls qdisc_reset_all_tx_gt() to flush qdiscs for queues which will no longer be used. qdisc_reset_all_tx_gt() currently serializes qdisc_reset() with qdisc_lock(). However, for lockless qdiscs, the dequeue path is serialized by qdisc_run_begin/end() using qdisc->seqlock instead, so qdisc_reset() can run concurrently with __qdisc_run() and free skbs while they are still being dequeued, leading to UAF. This can easily be reproduced on e.g. virtio-net by imposing heavy traffic while frequently changing the number of queue pairs: iperf3 -ub0 -c $peer -t 0 & while :; do ethtool -L eth0 combined 1 ethtool -L eth0 combined 2 done With KASAN enabled, this leads to reports like: BUG: KASAN: slab-use-after-free in __qdisc_run+0x133f/0x1760 ... Call Trace: <TASK> ... __qdisc_run+0x133f/0x1760 __dev_queue_xmit+0x248f/0x3550 ip_finish_output2+0xa42/0x2110 ip_output+0x1a7/0x410 ip_send_skb+0x2e6/0x480 udp_send_skb+0xb0a/0x1590 udp_sendmsg+0x13c9/0x1fc0 ... </TASK> Allocated by task 1270 on cpu 5 at 44.558414s: ... alloc_skb_with_frags+0x84/0x7c0 sock_alloc_send_pskb+0x69a/0x830 __ip_append_data+0x1b86/0x48c0 ip_make_skb+0x1e8/0x2b0 udp_sendmsg+0x13a6/0x1fc0 ... Freed by task 1306 on cpu 3 at 44.558445s: ... kmem_cache_free+0x117/0x5e0 pfifo_fast_reset+0x14d/0x580 qdisc_reset+0x9e/0x5f0 netif_set_real_num_tx_queues+0x303/0x840 virtnet_set_channels+0x1bf/0x260 [virtio_net] ethnl_set_channels+0x684/0xae0 ethnl_default_set_doit+0x31a/0x890 ... Serialize qdisc_reset_all_tx_gt() against the lockless dequeue path by taking qdisc->seqlock for TCQ_F_NOLOCK qdiscs, matching the serialization model already used by dev_reset_queue(). Additionally clear QDISC_STATE_NON_EMPTY after reset so the qdisc state reflects an empty queue, avoiding needless re-scheduling. Fixes: 6b3ba9146fe6 ("net: sched: allow qdiscs to handle locking") Signed-off-by: llj123 <luojie119@h-partners.com> Link: https://patch.msgid.link/20260228145307.3955532-1-den@valinux.co.jp | 3 个月前 | |
sched/isolation: Make CONFIG_CPU_ISOLATION depend on CONFIG_SMP stable inclusion from stable-6.6.89 commit b205d02726b32c2f491a1a267557da5344432428 category: bugfix issue: #IC6IH3 CVE: NA Signed-off-by: zyf1116 <zhouyongfei3@huawei.com> --------------------------------------- [ Upstream commit 975776841e689dd8ba36df9fa72ac3eca3c2957a ] kernel/sched/isolation.c obviously makes no sense without CONFIG_SMP, but the Kconfig entry we have right now: config CPU_ISOLATION bool "CPU isolation" depends on SMP || COMPILE_TEST allows the creation of pointless .config's which cause build failures. Reported-by: kernel test robot <lkp@intel.com> Signed-off-by: Oleg Nesterov <oleg@redhat.com> Signed-off-by: Ingo Molnar <mingo@kernel.org> Link: https://lore.kernel.org/r/20250330134955.GA7910@redhat.com Closes: https://lore.kernel.org/oe-kbuild-all/202503260646.lrUqD3j5-lkp@intel.com/ Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: zyf1116 <zhouyongfei3@huawei.com> | 1 年前 | |
io_uring: fix filename leak in __io_openat_prep() stable inclusion from stable-6.6.105 commit b14fad555302 category: bugfix issue: #223 CVE: CVE-2025-68814 Signed-off-by: zxl <1554188414@qq.com> ------------------------------- io_uring: fix filename leak in __io_openat_prep() __io_openat_prep() allocates a struct filename using getname(). However, for the condition of the file being installed in the fixed file table as well as having O_CLOEXEC flag set, the function returns early. At that point, the request doesn't have REQ_F_NEED_CLEANUP flag set. Due to this, the memory for the newly allocated struct filename is not cleaned up, causing a memory leak. Fix this by setting the REQ_F_NEED_CLEANUP for the request just after the successful getname() call, so that when the request is torn down, the filename will be cleaned up, along with other resources needing cleanup. Reported-by: syzbot+00e61c43eb5e4740438f@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=00e61c43eb5e4740438f Tested-by: syzbot+00e61c43eb5e4740438f@syzkaller.appspotmail.com Cc: stable@vger.kernel.org Signed-off-by: Prithvi Tambewagh <activprithvi@gmail.com> Fixes: b9445598d8c6 ("io_uring: openat directly into fixed fd table") Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: zxl <1554188414@qq.com> | 6 个月前 | |
ipc: fix to protect IPCS lookups using RCU stable inclusion from stable-6.6.95 commit 5180561afff8e0f029073c8c8117c95c6512d1f9 category: bugfix issue: #ICCW0G CVE: NA Signed-off-by: Li Nan <linan122@huawei.com> --------------------------------------- commit d66adabe91803ef34a8b90613c81267b5ded1472 upstream. syzbot reported that it discovered a use-after-free vulnerability, [0] [0]: https://lore.kernel.org/all/67af13f8.050a0220.21dd3.0038.GAE@google.com/ idr_for_each() is protected by rwsem, but this is not enough. If it is not protected by RCU read-critical region, when idr_for_each() calls radix_tree_node_free() through call_rcu() to free the radix_tree_node structure, the node will be freed immediately, and when reading the next node in radix_tree_for_each_slot(), the already freed memory may be read. Therefore, we need to add code to make sure that idr_for_each() is protected within the RCU read-critical region when we call it in shm_destroy_orphaned(). Link: https://lkml.kernel.org/r/20250424143322.18830-1-aha310510@gmail.com Fixes: b34a6b1da371 ("ipc: introduce shm_rmid_forced sysctl") Signed-off-by: Jeongjun Park <aha310510@gmail.com> Reported-by: syzbot+a2b84e569d06ca3a949c@syzkaller.appspotmail.com Cc: Jeongjun Park <aha310510@gmail.com> Cc: Liam Howlett <liam.howlett@oracle.com> Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com> Cc: Matthew Wilcox (Oracle) <willy@infradead.org> Cc: Vasiliy Kulikov <segoon@openwall.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Li Nan <linan122@huawei.com> | 1 年前 | |
!390 merge wcyfix into master esp: fix skb leak with espintcp and async crypto Created-by: chenyang_w Commit-by: llj123 Merged-by: openharmony_ci Description: ## CVE 修复列表 本次 PR 包含 **23** 个 CVE 安全补丁。 ### CVE 详情 - **CVE-2026-23340**: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - Commit: dbd58b0730aa - **CVE-2026-23367**: wifi: radiotap: reject radiotap with unknown bits - Commit: 129c8bb320a7 - **CVE-2026-23442**: ipv6: add NULL checks for idev in SRv6 paths - Commit: 50352fc10392 - **CVE-2026-31412**: usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks() - Commit: ce0caaed5940 - **CVE-2026-31424**: netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP - Commit: f00ac65c90ea - **CVE-2026-31447**: ext4: reject mount if bigalloc with s_first_data_block != 0 - Commit: b77de3fceafb - **CVE-2026-31450**: ext4: publish jinode after initialization - Commit: a070d5a872ff - **CVE-2026-31454**: xfs: save ailp before dropping the AIL lock in push callbacks - Commit: 75669e987137 - **CVE-2026-31495**: netfilter: ctnetlink: use netlink policy range checks - Commit: fcec5ce2d73a - **CVE-2026-31496**: netfilter: nf_conntrack_expect: skip expectations in other netns via proc - Commit: 168145c87444 - **CVE-2026-31497**: Bluetooth: btusb: clamp SCO altsetting table indices - Commit: 6fba3c3d48c9 - **CVE-2026-31498**: Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop - Commit: 52667c859fe3 - **CVE-2026-31510**: Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb - Commit: a04a760c06bb - **CVE-2026-31512**: Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() - Commit: 477ad4976072 - **CVE-2026-31515**: af_key: validate families in pfkey_send_migrate() - Commit: d3225e6b9bd5 - **CVE-2026-31521**: module: Fix kernel panic when a symbol st_shndx is out of bounds - Commit: 082f15d28873 - **CVE-2026-31602**: ALSA: ctxfi: Limit PTP to a single page - Commit: 452894005b4a - **CVE-2026-31664**: xfrm: clear trailing padding in build_polexpire() - Commit: c221ed63a276 - **CVE-2026-31667**: Input: uinput - fix circular locking dependency with ff-core - Commit: 546c18a14924 - **CVE-2026-31668**: seg6: separate dst_cache for input and output paths in seg6 lwtunnel - Commit: 84d458018b14 - **CVE-2026-31671**: xfrm_user: fix info leak in build_report() - Commit: e0c8542c3d09 - **CVE-2026-31680**: net: ipv6: flowlabel: defer exclusive option free until RCU teardown - Commit: 6c7fbdb8ffde - **CVE-2026-31705**: ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment - Commit: ffbce350c6fd ### 关联 Issue Closes #862 See merge request: openharmony/kernel_linux_6.6!390 | 3 个月前 | |
flex_proportions: make fprop_new_period() hardirq safe stable inclusion from stable-6.6.119 commit dd9e2f5b38f1fdd49b1ab6d3a85f81c14369eacc category: bugfix issue: CVE: CVE-2026-23168 Signed-off-by: Hun_Dun <18967138853@163.com> Co-Authored-By: Agent ------------------------------- flex_proportions: make fprop_new_period() hardirq safe Bernd has reported a lockdep splat from flexible proportions code that is essentially complaining about the following race: <timer fires> run_timer_softirq - we are in softirq context call_timer_fn writeout_period fprop_new_period write_seqcount_begin(&p->sequence); <hardirq is raised> ... blk_mq_end_request() blk_update_request() ext4_end_bio() folio_end_writeback() __wb_writeout_add() __fprop_add_percpu_max() if (unlikely(max_frac < FPROP_FRAC_BASE)) { fprop_fraction_percpu() seq = read_seqcount_begin(&p->sequence); - sees odd sequence so loops indefinitely Note that a deadlock like this is only possible if the bdi has configured maximum fraction of writeout throughput which is very rare in general but frequent for example for FUSE bdis. To fix this problem we have to make sure write section of the sequence counter is irqsafe. Link: https://lkml.kernel.org/r/20260121112729.24463-2-jack@suse.cz Fixes: a91befde3503 ("lib/flex_proportions.c: remove local_irq_ops in fprop_new_period()") Signed-off-by: Jan Kara <jack@suse.cz> Reported-by: Bernd Schubert <bernd@bsbernd.com> Link: https://lore.kernel.org/all/9b845a47-9aee-43dd-99bc-1a82bea00442@bsbernd.com/ Reviewed-by: Matthew Wilcox (Oracle) <willy@infradead.org> Cc: Joanne Koong <joannelkoong@gmail.com> Cc: Miklos Szeredi <miklos@szeredi.hu> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Hun_Dun <18967138853@163.com> | 4 个月前 | |
!381 merge cve-fix-20260519-kernel_linux_6.6-master into master CVE修复: kernel_linux_6.6 master (3 个安全补丁) - 2026-05-19 Created-by: wanghao794 Commit-by: Mikhail Gavrilov;Filipe Manana;Goldwyn Rodrigues;Andrey Vatoropin Merged-by: openharmony_ci Description: ## CVE 修复列表 | CVE ID | 标题 | Commit | |--------|------|--------| | CVE-2024-46750 | PCI: Add missing bridge lock to pci_bus_lock() | a19b61fdb958 | | CVE-2025-71295 | fs/buffer: add alert in try_to_free_buffers() for ... | c1b6227555c5 | | CVE-2026-43287 | drm: Account property blob allocations to memcg | bbfaa5761f58 | **来源**: Cherry-pick from stable-remotes/stable/linux-6.6.y~1656 ## 统计 - **总数**: 23 - **成功**: 3 - **冲突**: 1 - **跳过**: 19 ## 修复详情 ### CVE-2024-46750 - **Commit**: a19b61fdb958ffadbba85b43c991eb9fc70c1c1c - **Stable**: remotes/stable/linux-6.6.y~1656 - **标题**: PCI: Add missing bridge lock to pci_bus_lock() ### CVE-2025-71295 - **Commit**: c1b6227555c52781178132b7a06466711855795c - **Stable**: remotes/stable/linux-6.6.y~1960 - **标题**: fs/buffer: add alert in try_to_free_buffers() for folios without buffers ### CVE-2026-43287 - **Commit**: bbfaa5761f589a81031b493cb01275a990d6fb25 - **Stable**: remotes/stable/linux-6.6.y~1899 - **标题**: drm: Account property blob allocations to memcg ## 测试状态 - 编译：待触发 CI - 测试：待执行 ## 关联 Issue 已关联 Issue: #719 --- *生成时间: 2026-05-19 17:20:37* See merge request: openharmony/kernel_linux_6.6!381 | 3 个月前 | |
!390 merge wcyfix into master esp: fix skb leak with espintcp and async crypto Created-by: chenyang_w Commit-by: llj123 Merged-by: openharmony_ci Description: ## CVE 修复列表 本次 PR 包含 **23** 个 CVE 安全补丁。 ### CVE 详情 - **CVE-2026-23340**: net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs - Commit: dbd58b0730aa - **CVE-2026-23367**: wifi: radiotap: reject radiotap with unknown bits - Commit: 129c8bb320a7 - **CVE-2026-23442**: ipv6: add NULL checks for idev in SRv6 paths - Commit: 50352fc10392 - **CVE-2026-31412**: usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks() - Commit: ce0caaed5940 - **CVE-2026-31424**: netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP - Commit: f00ac65c90ea - **CVE-2026-31447**: ext4: reject mount if bigalloc with s_first_data_block != 0 - Commit: b77de3fceafb - **CVE-2026-31450**: ext4: publish jinode after initialization - Commit: a070d5a872ff - **CVE-2026-31454**: xfs: save ailp before dropping the AIL lock in push callbacks - Commit: 75669e987137 - **CVE-2026-31495**: netfilter: ctnetlink: use netlink policy range checks - Commit: fcec5ce2d73a - **CVE-2026-31496**: netfilter: nf_conntrack_expect: skip expectations in other netns via proc - Commit: 168145c87444 - **CVE-2026-31497**: Bluetooth: btusb: clamp SCO altsetting table indices - Commit: 6fba3c3d48c9 - **CVE-2026-31498**: Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop - Commit: 52667c859fe3 - **CVE-2026-31510**: Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb - Commit: a04a760c06bb - **CVE-2026-31512**: Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() - Commit: 477ad4976072 - **CVE-2026-31515**: af_key: validate families in pfkey_send_migrate() - Commit: d3225e6b9bd5 - **CVE-2026-31521**: module: Fix kernel panic when a symbol st_shndx is out of bounds - Commit: 082f15d28873 - **CVE-2026-31602**: ALSA: ctxfi: Limit PTP to a single page - Commit: 452894005b4a - **CVE-2026-31664**: xfrm: clear trailing padding in build_polexpire() - Commit: c221ed63a276 - **CVE-2026-31667**: Input: uinput - fix circular locking dependency with ff-core - Commit: 546c18a14924 - **CVE-2026-31668**: seg6: separate dst_cache for input and output paths in seg6 lwtunnel - Commit: 84d458018b14 - **CVE-2026-31671**: xfrm_user: fix info leak in build_report() - Commit: e0c8542c3d09 - **CVE-2026-31680**: net: ipv6: flowlabel: defer exclusive option free until RCU teardown - Commit: 6c7fbdb8ffde - **CVE-2026-31705**: ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment - Commit: ffbce350c6fd ### 关联 Issue Closes #862 See merge request: openharmony/kernel_linux_6.6!390 | 3 个月前 | |
rust: module: place cleanup_module() in .exit.text section stable inclusion from stable-6.6.96 commit c765f592adc719cd2b925b0f30d65207a7e8f8f5 category: bugfix issue: #ICCW0G CVE: NA Signed-off-by: Li Nan <linan122@huawei.com> --------------------------------------- [ Upstream commit 249c3a0e53acefc2b06d3b3e1fc28fb2081f878d ] Place cleanup_module() in .exit.text section. Currently, cleanup_module() is likely placed in the .text section. It's inconsistent with the layout of C modules, where cleanup_module() is placed in .exit.text. [ Boqun asked for an example of how the section changed to be put in the log. Tomonori provided the following examples: C module: $ objdump -t ~/build/x86/drivers/block/loop.o|grep clean 0000000000000000 l O .exit.data 0000000000000008 __UNIQUE_ID___addressable_cleanup_module412 0000000000000000 g F .exit.text 000000000000009c cleanup_module Rust module without this patch: $ objdump -t ~/build/x86/samples/rust/rust_minimal.o|grep clean 00000000000002b0 g F .text 00000000000000c6 cleanup_module 0000000000000000 g O .exit.data 0000000000000008 _R...___UNIQUE_ID___addressable_cleanup_module Rust module with this patch: $ objdump -t ~/build/x86/samples/rust/rust_minimal.o|grep clean 0000000000000000 g F .exit.text 00000000000000c6 cleanup_module 0000000000000000 g O .exit.data 0000000000000008 _R...___UNIQUE_ID___addressable_cleanup_module - Miguel ] Signed-off-by: FUJITA Tomonori <fujita.tomonori@gmail.com> Acked-by: Jarkko Sakkinen <jarkko@kernel.org> Link: https://lore.kernel.org/r/20250308044506.14458-1-fujita.tomonori@gmail.com Signed-off-by: Miguel Ojeda <ojeda@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Li Nan <linan122@huawei.com> | 1 年前 | |
回退 'Pull Request !193 : lts升级 6.6.101->6.6.102' | 1 年前 | |
sharefs 调测 Signed-off-by: chen_jie <chenjie439@h-partners.com> | 7 个月前 | |
apparmor: fix race between freeing data and fs accessing it Signed-off-by: llj123 <luojie119@h-partners.com> commit 8e135b8aee5a06c52a4347a5a6d51223c6f36ba3 upstream. AppArmor was putting the reference to i_private data on its end after removing the original entry from the file system. However the inode can and does live beyond that point and it is possible that some of the fs call back functions will be invoked after the reference has been put, which results in a race between freeing the data and accessing it through the fs. While the rawdata/loaddata is the most likely candidate to fail the race, as it has the fewest references. If properly crafted it might be possible to trigger a race for the other types stored in i_private. Fix this by moving the put of i_private referenced data to the correct place which is during inode eviction. Fixes: c961ee5f21b20 ("apparmor: convert from securityfs to apparmorfs for policy ns files") Reported-by: Qualys Security Advisory <qsa@qualys.com> Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com> Reviewed-by: Maxime Bélair <maxime.belair@canonical.com> Reviewed-by: Cengiz Can <cengiz.can@canonical.com> Signed-off-by: John Johansen <john.johansen@canonical.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit fd5a51cf1aed35058239fbc0888e320a613cbde5) | 3 个月前 | |
ALSA: ctxfi: Limit PTP to a single page commit e9418da50d9e5c496c22fe392e4ad74c038a94eb upstream. Commit 391e69143d0a increased CT_PTP_NUM from 1 to 4 to support 256 playback streams, but the additional pages are not used by the card correctly. The CT20K2 hardware already has multiple VMEM_PTPAL registers, but using them separately would require refactoring the entire virtual memory allocation logic. ct_vm_map() always uses PTEs in vm->ptp[0].area regardless of CT_PTP_NUM. On AMD64 systems, a single PTP covers 512 PTEs (2M). When aggregate memory allocations exceed this limit, ct_vm_map() tries to access beyond the allocated space and causes a page fault: BUG: unable to handle page fault for address: ffffd4ae8a10a000 Oops: Oops: 0002 [#1] SMP PTI RIP: 0010:ct_vm_map+0x17c/0x280 [snd_ctxfi] Call Trace: atc_pcm_playback_prepare+0x225/0x3b0 ct_pcm_playback_prepare+0x38/0x60 snd_pcm_do_prepare+0x2f/0x50 snd_pcm_action_single+0x36/0x90 snd_pcm_action_nonatomic+0xbf/0xd0 snd_pcm_ioctl+0x28/0x40 __x64_sys_ioctl+0x97/0xe0 do_syscall_64+0x81/0x610 entry_SYSCALL_64_after_hwframe+0x76/0x7e Revert CT_PTP_NUM to 1. The 256 SRC_RESOURCE_NUM and playback_count remain unchanged. Fixes: 391e69143d0a ("ALSA: ctxfi: Bump playback substreams to 256") Cc: stable@vger.kernel.org Signed-off-by: llj123 <luojie119@h-partners.com> Link: https://patch.msgid.link/20260406074857.216034-1-me@harin.net | 3 个月前 | |
x86-64: rename misleadingly named '__copy_user_nocache()' function mainline inclusion from mainline-6.6.101 commit d187a86de793f84766ea40b9ade7ac60aabbb4fe category: bugfix issue: #722 CVE: CVE-2026-43073 ------------------------------- x86-64: rename misleadingly named '__copy_user_nocache()' function This function was a masterclass in bad naming, for various historical reasons. It claimed to be a non-cached user copy. It is literally _neither_ of those things. It's a specialty memory copy routine that uses non-temporal stores for the destination (but not the source), and that does exception handling for both source and destination accesses. Also note that while it works for unaligned targets, any unaligned parts (whether at beginning or end) will not use non-temporal stores, since only words and quadwords can be non-temporal on x86. The exception handling means that it _can_ be used for user space accesses, but not on its own - it needs all the normal "start user space access" logic around it. But typically the user space access would be the source, not the non-temporal destination. That was the original intention of this, where the destination was some fragile persistent memory target that needed non-temporal stores in order to catch machine check exceptions synchronously and deal with them gracefully. Thus that non-descriptive name: one use case was to copy from user space into a non-cached kernel buffer. However, the existing users are a mix of that intended use-case, and a couple of random drivers that just did this as a performance tweak. Some of those random drivers then actively misused the user copying version (with STAC/CLAC and all) to do kernel copies without ever even caring about the exception handling, _just_ for the non-temporal destination. Rename it as a first small step to actually make it halfway sane, and change the prototype to be more normal: it doesn't take a user pointer unless the caller has done the proper conversion, and the argument size is the full size_t (it still won't actually copy more than 4GB in one go, but there's also no reason to silently truncate the size argument in the caller). Finally, use this now sanely named function in the NTB code, which mis-used a user copy version (with STAC/CLAC and all) of this interface despite it not actually being a user copy at all. Signed-off-by: Hun_Dun <18967138853@163.com> | 3 个月前 | |
kbuild: hdrcheck: fix cross build with clang stable inclusion from stable-6.6.83 commit 128962f5ab565a8c3251c7a86a31e072ed288f18 category: bugfix issue: #IC1IVT CVE: NA Signed-off-by: zyf1116 <zhouyongfei3@huawei.com> --------------------------------------- [ Upstream commit 02e9a22ceef0227175e391902d8760425fa072c6 ] The headercheck tries to call clang with a mix of compiler arguments that don't include the target architecture. When building e.g. x86 headers on arm64, this produces a warning like clang: warning: unknown platform, assuming -mfloat-abi=soft Add in the KBUILD_CPPFLAGS, which contain the target, in order to make it build properly. See also 1b71c2fb04e7 ("kbuild: userprogs: fix bitsize and target detection on clang"). Reviewed-by: Nathan Chancellor <nathan@kernel.org> Fixes: feb843a469fb ("kbuild: add $(CLANG_FLAGS) to KBUILD_CPPFLAGS") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: zyf1116 <zhouyongfei3@huawei.com> | 1 年前 | |
KVM: Destroy target device if coalesced MMIO unregistration fails stable inclusion from stable-6.6.105 commit b1cb1fac22abf category: bugfix issue: #207 CVE: CVE-2023-54024 Signed-off-by: 何京晶 <18967138853@163.com> Co-Authored-By: Agent ------------------------------- KVM: Destroy target device if coalesced MMIO unregistration fails Destroy and free the target coalesced MMIO device if unregistering said device fails. As clearly noted in the code, kvm_io_bus_unregister_dev() does not destroy the target device. BUG: memory leak unreferenced object 0xffff888112a54880 (size 64): comm "syz-executor.2", pid 5258, jiffies 4297861402 (age 14.129s) hex dump (first 32 bytes): 38 c7 67 15 00 c9 ff ff 38 c7 67 15 00 c9 ff ff 8.g.....8.g..... e0 c7 e1 83 ff ff ff ff 00 30 67 15 00 c9 ff ff .........0g..... backtrace: [<0000000006995a8a>] kmalloc include/linux/slab.h:556 [inline] [<0000000006995a8a>] kzalloc include/linux/slab.h:690 [inline] [<0000000006995a8a>] kvm_vm_ioctl_register_coalesced_mmio+0x8e/0x3d0 arch/x86/kvm/../../../virt/kvm/coalesced_mmio.c:150 [<00000000022550c2>] kvm_vm_ioctl+0x47d/0x1600 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3323 [<000000008a75102f>] vfs_ioctl fs/ioctl.c:46 [inline] [<000000008a75102f>] file_ioctl fs/ioctl.c:509 [inline] [<000000008a75102f>] do_vfs_ioctl+0xbab/0x1160 fs/ioctl.c:696 [<0000000080e3f669>] ksys_ioctl+0x76/0xa0 fs/ioctl.c:713 [<0000000059ef4888>] __do_sys_ioctl fs/ioctl.c:720 [inline] [<0000000059ef4888>] __se_sys_ioctl fs/ioctl.c:718 [inline] [<0000000059ef4888>] __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:718 [<000000006444fa05>] do_syscall_64+0x9f/0x4e0 arch/x86/entry/common.c:290 [<000000009a4ed50b>] entry_SYSCALL_64_after_hwframe+0x49/0xbe BUG: leak checking failed Fixes: 5d3c4c79384a ("KVM: Stop looking for coalesced MMIO zones if the bus is destroyed") Cc: stable@vger.kernel.org Reported-by: 柳菁峰 <liujingfeng@qianxin.com> Reported-by: Michal Luczaj <mhal@rbox.co> Link: https://lore.kernel.org/r/20221219171924.67989-1-seanjc@google.com Link: https://lore.kernel.org/all/20230118220003.1239032-1-mhal@rbox.co Signed-off-by: Sean Christopherson <seanjc@google.com> Signed-off-by: 何京晶 <18967138853@163.com> | 6 个月前 | |
iommu: Add for_each_group_device() Convenience macro to iterate over every struct group_device in the group. Replace all open coded list_for_each_entry's with this macro. Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com> Reviewed-by: Kevin Tian <kevin.tian@intel.com> Tested-by: Heiko Stuebner <heiko@sntech.de> Tested-by: Niklas Schnelle <schnelle@linux.ibm.com> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> Link: https://lore.kernel.org/r/2-v5-1b99ae392328+44574-iommu_err_unwind_jgg@nvidia.com Signed-off-by: Joerg Roedel <jroedel@suse.de> | 3 年前 | |
scripts: add Linux .cocciconfig for coccinelle Coccinelle supports reading .cocciconfig, the order of precedence for variables for .cocciconfig is as follows: o Your current user's home directory is processed first o Your directory from which spatch is called is processed next o The directory provided with the --dir option is processed last, if used Since coccicheck runs through make, it naturally runs from the kernel proper dir, as such the second rule above would be implied for picking up a .cocciconfig when using 'make coccicheck'. 'make coccicheck' also supports using M= targets.If you do not supply any M= target, it is assumed you want to target the entire kernel. The kernel coccicheck script has: if [ "$KBUILD_EXTMOD" = "" ] ; then OPTIONS="--dir $srctree $COCCIINCLUDE" else OPTIONS="--dir $KBUILD_EXTMOD $COCCIINCLUDE" fi KBUILD_EXTMOD is set when an explicit target with M= is used. For both cases the spatch --dir argument is used, as such third rule applies when whether M= is used or not, and when M= is used the target directory can have its own .cocciconfig file. When M= is not passed as an argument to coccicheck the target directory is the same as the directory from where spatch was called. If not using the kernel's coccicheck target, keep the above precedence order logic of .cocciconfig reading. If using the kernel's coccicheck target, override any of the kernel's .coccicheck's settings using SPFLAGS. We help Coccinelle when used against Linux with a set of sensible defaults options for Linux with our own Linux .cocciconfig. This hints to coccinelle git can be used for 'git grep' queries over coccigrep. A timeout of 200 seconds should suffice for now. The options picked up by coccinelle when reading a .cocciconfig do not appear as arguments to spatch processes running on your system, to confirm what options will be used by Coccinelle run: spatch --print-options-only You can override with your own preferred index option by using SPFLAGS. Coccinelle supports both glimpse and idutils. Glimpse had historically provided the best performance, however recent benchmarks reveal idutils is performing just as well. Due to some recent fixes however you however will need at least coccinelle >= 1.0.6 if using idutils. Coccinelle carries a script scripts/idutils_index.sh which creates the idutils database with as follows: mkid -i C --output .id-utils.index If using just "--use-idutils" coccinelle expects your idutils database to be on the top level of the kernel as a file named ".id-utils.index". If you do not use this you can symlink your database file to it, or you can specify the database file following the "--use-idutils" argument. Examples: make SPFLAGS=--use-idutils coccicheck This assumes you have $srctree/.id-utils.index, where $srctree is the top level of the kernel. make SPFLAGS="--use-idutils /full-path/to/ID" coccicheck Here you specify the full path of the idutils ID database. Using .cocciconfig is possible, however given the order of precedence followed by Coccinelle, and since the kernel now carries its own .cocciconfig, you will need to use SPFLAGS to use idutils if desired. v4: o Recommend upgrade for using idutils with coccinelle due to some recent fixes. o Refer to using --print-options-only for testing what options are picked up by .cocciconfig reading. o Expand commit log considerably explaining *why* .cocconfig from two precedence rules are used when using coccicheck, and how to properly override these if needed. o Expand Documentation/coccinelle.txt v3: Expand commit log a bit more Signed-off-by: Luis R. Rodriguez <mcgrof@kernel.org> Acked-by: Julia Lawall <julia.lawall@lip6.fr> Signed-off-by: Michal Marek <mmarek@suse.com> | 9 年前 | |
get_maintainer: add Alan to .get_maintainer.ignore Alan asked to be added to the .get_maintainer.ignore list. Link: https://lkml.kernel.org/r/YvN30KhO9aD5Sza9@kili Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Cc: Alan Cox <alan@lxorguk.ukuu.org.uk> Cc: Arnd Bergmann <arnd@arndb.de> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> | 4 年前 | |
.gitattributes: set diff driver for Rust source code files Git supports a builtin Rust diff driver [1] since v2.23.0 (2019). It improves the choice of hunk headers in some cases, such as diffs within methods, since those are indented in Rust within an impl block, and therefore the default diff driver would pick the outer impl block instead (rather than the method where the changed code is). For instance, with the default diff driver: @@ -455,6 +455,8 @@ impl fmt::Write for RawFormatter { // Amount that we can copy. saturating_sub ensures we get 0 if pos goes past end. let len_to_copy = core::cmp::min(pos_new, self.end).saturating_sub(self.pos); + test_diff_driver(); + if len_to_copy > 0 { // SAFETY: If len_to_copy is non-zero, then we know pos has not gone past end // yet, so it is valid for write per the type invariants. With the Rust diff driver: @@ -455,6 +455,8 @@ fn write_str(&mut self, s: &str) -> fmt::Result { // Amount that we can copy. saturating_sub ensures we get 0 if pos goes past end. let len_to_copy = core::cmp::min(pos_new, self.end).saturating_sub(self.pos); + test_diff_driver(); + if len_to_copy > 0 { // SAFETY: If len_to_copy is non-zero, then we know pos has not gone past end // yet, so it is valid for write per the type invariants. Thus set the rust diff driver for *.rs source files. The Rust repository also does so since 2020 [2]. Link: https://git-scm.com/docs/gitattributes#_defining_a_custom_hunk_header [1] Link: https://github.com/rust-lang/rust/pull/78882 [2] Reviewed-by: Gary Guo <gary@garyguo.net> Reviewed-by: Martin Rodriguez Reboredo <yakoyoku@gmail.com> Reviewed-by: Benno Lossin <benno.lossin@proton.me> Link: https://lore.kernel.org/r/20230418233048.335281-1-ojeda@kernel.org [ Added link to Rust repository ] Signed-off-by: Miguel Ojeda <ojeda@kernel.org> | 3 年前 | |
Remove *.orig pattern from .gitignore stable inclusion from stable-6.6.54 commit 38dee6edb700d381d5ade626c67a7d63aca97a5e category: bugfix issue: #IB7W7N CVE: NA Signed-off-by: zhangshuqi <zhangshuqi3@huawei.com> --------------------------------------- commit 76be4f5a784533c71afbbb1b8f2963ef9e2ee258 upstream. Commit 3f1b0e1f2875 (".gitignore update") added *.orig and *.rej patterns to .gitignore in v2.6.23. The commit message didn't give a rationale. Later on, commit 1f5d3a6b6532 ("Remove *.rej pattern from .gitignore") removed the *.rej pattern in v2.6.26, on the rationale that *.rej files indicated something went really wrong and should not be ignored. The *.rej files are now shown by git status, which helps located conflicts when applying patches and lowers the probability that they will go unnoticed. It is however still easy to overlook the *.orig files which slowly polute the source tree. That's not as big of a deal as not noticing a conflict, but it's still not nice. Drop the *.orig pattern from .gitignore to avoid this and help keep the source tree clean. Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> [masahiroy@kernel.org: I do not have a strong opinion about this. Perhaps some people may have a different opinion. If you are someone who wants to ignore *.orig, it is likely you would want to do so across all projects. Then, $XDG_CONFIG_HOME/git/ignore would be more suitable for your needs. gitignore(5) suggests, "Patterns which a user wants Git to ignore in all situations generally go into a file specified by core.excludesFile in the user's ~/.gitconfig". Please note that you cannot do the opposite; if *.orig is ignored by the project's .gitignore, you cannot override the decision because $XDG_CONFIG_HOME/git/ignore has a lower priority. If *.orig is sitting on the fence, I'd leave it to the users. ] Signed-off-by: Masahiro Yamada <masahiroy@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: zhangshuqi <zhangshuqi3@huawei.com> | 1 年前 | |
Merge tag 'mm-hotfixes-stable-2023-10-24-09-40' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "20 hotfixes. 12 are cc:stable and the remainder address post-6.5 issues or aren't considered necessary for earlier kernel versions" * tag 'mm-hotfixes-stable-2023-10-24-09-40' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: maple_tree: add GFP_KERNEL to allocations in mas_expected_entries() selftests/mm: include mman header to access MREMAP_DONTUNMAP identifier mailmap: correct email aliasing for Oleksij Rempel mailmap: map Bartosz's old address to the current one mm/damon/sysfs: check DAMOS regions update progress from before_terminate() MAINTAINERS: Ondrej has moved kasan: disable kasan_non_canonical_hook() for HW tags kasan: print the original fault addr when access invalid shadow hugetlbfs: close race between MADV_DONTNEED and page fault hugetlbfs: extend hugetlb_vma_lock to private VMAs hugetlbfs: clear resv_map pointer if mmap fails mm: zswap: fix pool refcount bug around shrink_worker() mm/migrate: fix do_pages_move for compat pointers riscv: fix set_huge_pte_at() for NAPOT mappings when a swap entry is set riscv: handle VM_FAULT_[HWPOISON|HWPOISON_LARGE] faults instead of panicking mmap: fix error paths with dup_anon_vma() mmap: fix vma_iterator in error path of vma_merge() mm: fix vm_brk_flags() to not bail out while holding lock mm/mempolicy: fix set_mempolicy_home_node() previous VMA pointer mm/page_alloc: correct start page when guard page debug is enabled | 2 年前 | |
rust: add .rustfmt.toml This is the configuration file for the rustfmt tool. rustfmt is a tool for formatting Rust code according to style guidelines. It is very commonly used across Rust projects. The default configuration options are used. Reviewed-by: Kees Cook <keescook@chromium.org> Co-developed-by: Alex Gaynor <alex.gaynor@gmail.com> Signed-off-by: Alex Gaynor <alex.gaynor@gmail.com> Co-developed-by: Wedson Almeida Filho <wedsonaf@google.com> Signed-off-by: Wedson Almeida Filho <wedsonaf@google.com> Signed-off-by: Miguel Ojeda <ojeda@kernel.org> | 3 年前 | |
COPYING: state that all contributions really are covered by this file Explicitly state that all contributions to the kernel source tree really are covered under this COPYING file in case someone thought otherwise. Lawyers love to be pedantic, even more so than software engineers at times, and this sentence makes them sleep easier. Reviewed-by: Thomas Gleixner <tglx@linutronix.de> Acked-by: Gustavo A. R. Silva <gustavo@embeddedor.com> Link: https://lore.kernel.org/r/20200206154800.GA3754085@kroah.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 6 年前 | |
USB: Remove Wireless USB and UWB documentation Support for Wireless USB and Ultra WideBand was removed in 2020 by commit caa6772db4c1 ("Staging: remove wusbcore and UWB from the kernel tree."). But the documentation files were left behind. Let's get rid of that out-of-date documentation. Signed-off-by: Alan Stern <stern@rowland.harvard.edu> Link: https://lore.kernel.org/r/015d4310-bcd3-4ba4-9a0e-3664f281a9be@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 3 年前 | |
Merge tag 'kbuild-v6.1' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild updates from Masahiro Yamada: - Remove potentially incomplete targets when Kbuid is interrupted by SIGINT etc in case GNU Make may miss to do that when stderr is piped to another program. - Rewrite the single target build so it works more correctly. - Fix rpm-pkg builds with V=1. - List top-level subdirectories in ./Kbuild. - Ignore auto-generated __kstrtab_* and __kstrtabns_* symbols in kallsyms. - Avoid two different modules in lib/zstd/ having shared code, which potentially causes building the common code as build-in and modular back-and-forth. - Unify two modpost invocations to optimize the build process. - Remove head-y syntax in favor of linker scripts for placing particular sections in the head of vmlinux. - Bump the minimal GNU Make version to 3.82. - Clean up misc Makefiles and scripts. * tag 'kbuild-v6.1' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: (41 commits) docs: bump minimal GNU Make version to 3.82 ia64: simplify esi object addition in Makefile Revert "kbuild: Check if linker supports the -X option" kbuild: rebuild .vmlinux.export.o when its prerequisite is updated kbuild: move modules.builtin(.modinfo) rules to Makefile.vmlinux_o zstd: Fixing mixed module-builtin objects kallsyms: ignore __kstrtab_* and __kstrtabns_* symbols kallsyms: take the input file instead of reading stdin kallsyms: drop duplicated ignore patterns from kallsyms.c kbuild: reuse mksysmap output for kallsyms mksysmap: update comment about __crc_* kbuild: remove head-y syntax kbuild: use obj-y instead extra-y for objects placed at the head kbuild: hide error checker logs for V=1 builds kbuild: re-run modpost when it is updated kbuild: unify two modpost invocations kbuild: move vmlinux.o rule to the top Makefile kbuild: move .vmlinux.objs rule to Makefile.modpost kbuild: list sub-directories in ./Kbuild Makefile.compiler: replace cc-ifversion with compiler-specific macros ... | 3 年前 | |
kbuild: ensure full rebuild when the compiler is updated Commit 21c54b774744 ("kconfig: show compiler version text in the top comment") added the environment variable, CC_VERSION_TEXT in the comment of the top Kconfig file. It can detect the compiler update, and invoke the syncconfig because all environment variables referenced in Kconfig files are recorded in include/config/auto.conf.cmd This commit makes it a CONFIG option in order to ensure the full rebuild when the compiler is updated. This works like follows: include/config/kconfig.h contains "CONFIG_CC_VERSION_TEXT" in the comment block. The top Makefile specifies "-include $(srctree)/include/linux/kconfig.h" to guarantee it is included from all kernel source files. fixdep parses every source file and all headers included from it, searching for words prefixed with "CONFIG_". Then, fixdep finds CONFIG_CC_VERSION_TEXT in include/config/kconfig.h and adds include/config/cc/version/text.h into every .*.cmd file. When the compiler is updated, syncconfig is invoked because init/Kconfig contains the reference to the environment variable CC_VERTION_TEXT. CONFIG_CC_VERSION_TEXT is updated to the new version string, and include/config/cc/version/text.h is touched. In the next rebuild, Make will rebuild every files since the timestamp of include/config/cc/version/text.h is newer than that of target. Signed-off-by: Masahiro Yamada <masahiroy@kernel.org> | 6 年前 | |
sign-file,extract-cert: move common SSL helper functions to a header stable inclusion from stable-6.6.88 commit 1e2d849efc3225398cfb18fb5d9232fa6ab4851c category: bugfix issue: #IC6IH3 CVE: NA Signed-off-by: zyf1116 <zhouyongfei3@huawei.com> --------------------------------------- commit 300e6d4116f956b035281ec94297dc4dc8d4e1d3 upstream. Couple error handling helpers are repeated in both tools, so move them to a common header. Signed-off-by: Jan Stancek <jstancek@redhat.com> Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org> Tested-by: R Nageswara Sastry <rnsastry@linux.ibm.com> Reviewed-by: Neal Gompa <neal@gompa.dev> Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: zyf1116 <zhouyongfei3@huawei.com> create mode 100644 scripts/ssl-common.h Signed-off-by: zyf1116 <zhouyongfei3@huawei.com> | 1 年前 | |
回退 'Pull Request !193 : lts升级 6.6.101->6.6.102' | 1 年前 | |
NexusLand: a new high performance IPC machanism Signed-off-by: Bryan_Wu <wyp1536481268@foxmail.com> | 5 个月前 | |
Drop all 00-INDEX files from Documentation/ This is a respin with a wider audience (all that get_maintainer returned) and I know this spams a *lot* of people. Not sure what would be the correct way, so my apologies for ruining your inbox. The 00-INDEX files are supposed to give a summary of all files present in a directory, but these files are horribly out of date and their usefulness is brought into question. Often a simple "ls" would reveal the same information as the filenames are generally quite descriptive as a short introduction to what the file covers (it should not surprise anyone what Documentation/sched/sched-design-CFS.txt covers) A few years back it was mentioned that these files were no longer really needed, and they have since then grown further out of date, so perhaps it is time to just throw them out. A short status yields the following _outdated_ 00-INDEX files, first counter is files listed in 00-INDEX but missing in the directory, last is files present but not listed in 00-INDEX. List of outdated 00-INDEX: Documentation: (4/10) Documentation/sysctl: (0/1) Documentation/timers: (1/0) Documentation/blockdev: (3/1) Documentation/w1/slaves: (0/1) Documentation/locking: (0/1) Documentation/devicetree: (0/5) Documentation/power: (1/1) Documentation/powerpc: (0/5) Documentation/arm: (1/0) Documentation/x86: (0/9) Documentation/x86/x86_64: (1/1) Documentation/scsi: (4/4) Documentation/filesystems: (2/9) Documentation/filesystems/nfs: (0/2) Documentation/cgroup-v1: (0/2) Documentation/kbuild: (0/4) Documentation/spi: (1/0) Documentation/virtual/kvm: (1/0) Documentation/scheduler: (0/2) Documentation/fb: (0/1) Documentation/block: (0/1) Documentation/networking: (6/37) Documentation/vm: (1/3) Then there are 364 subdirectories in Documentation/ with several files that are missing 00-INDEX alltogether (and another 120 with a single file and no 00-INDEX). I don't really have an opinion to whether or not we /should/ have 00-INDEX, but the above 00-INDEX should either be removed or be kept up to date. If we should keep the files, I can try to keep them updated, but I rather not if we just want to delete them anyway. As a starting point, remove all index-files and references to 00-INDEX and see where the discussion is going. Signed-off-by: Henrik Austad <henrik@austad.us> Acked-by: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com> Just-do-it-by: Steven Rostedt <rostedt@goodmis.org> Reviewed-by: Jens Axboe <axboe@kernel.dk> Acked-by: Paul Moore <paul@paul-moore.com> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Acked-by: Mark Brown <broonie@kernel.org> Acked-by: Mike Rapoport <rppt@linux.vnet.ibm.com> Cc: [Almost everybody else] Signed-off-by: Jonathan Corbet <corbet@lwn.net> | 7 年前 | |
kernel 6.6.89 Signed-off-by: zyf1116 <zhouyongfei3@huawei.com> | 1 年前 | |
add reamde file Signed-off-by: 朱佳鑫 <zhujiaxin@huawei.com> | 2 年前 |
Linux kernel
There are several guides for kernel developers and users. These guides can be rendered in a number of formats, like HTML and PDF. Please read Documentation/admin-guide/README.rst first.
In order to build the documentation, use make htmldocs or
make pdfdocs. The formatted documentation can also be read online at:
https://www.kernel.org/doc/html/latest/
There are various text files in the Documentation/ subdirectory, several of them using the Restructured Text markup notation.
Please read the Documentation/process/changes.rst file, as it contains the requirements for building and running the kernel, and information about the problems which may result by upgrading your kernel.