可用于OpenHarmony系统内核的开发与贡献,支持补丁提交、编译测试及代码风格检查,遵循统一补丁格式和DCO签名规范,助力内核功能优化与版本升级。【此简介由AI生成】
| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
arm64: errata: Mitigate TLBI errata on various Arm CPUs stable inclusion from stable-v5.10.101 commit 925058203229 category: bugfix issue: 8663 CVE: CVE-2026-53354 Signed-off-by: wanghao794 <wanghao865@huawei.com> Co-Authored-By: Agent ------------------------------- | 13 天前 | |
LICENSES/deprecated: add Zlib license text The new files contributed to zlib have Zlib SPDX license identifier. Since there was no Zlib license text in LICENSES, scripts/spdxcheck.py reported the following errors: lib/zlib_dfltcc/dfltcc.c: 1:28 Invalid License ID: Zlib lib/zlib_dfltcc/dfltcc.h: 1:28 Invalid License ID: Zlib lib/zlib_dfltcc/dfltcc_deflate.c: 1:28 Invalid License ID: Zlib lib/zlib_dfltcc/dfltcc_inflate.c: 1:28 Invalid License ID: Zlib lib/zlib_dfltcc/dfltcc_util.h: 1:28 Invalid License ID: Zlib The patch adds Zlib SPDX license to LICENSES/deprecated, thus resolving the issues reported by spdxcheck. Suggested-by: Lukas Bulwahn <lukas.bulwahn@gmail.com> Reviewed-by: Lukas Bulwahn <lukas.bulwahn@gmail.com> Signed-off-by: Mikhail Zaslonko <zaslonko@linux.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 5 年前 | |
!1982 merge cve-fix-20260727-master into master CVE修复: kernel_linux_5.10 OpenHarmony-7.0-Release (84 个安全补丁) - 2026-07-27 Created-by: provii Commit-by: 姜小林;Xiang Mei;Votokina Victoria;Chengchang Tang;Dmitry Baryshkov;Jason Gunthorpe;Jiexun Wang;Haoze Xie;Ziyi Guo;Minh Nguyen;Ulf Hansson;Wyatt Feng;Yilin Zhu;Mingyu Wang;Weiming Shi;Xin Long;Kuniyuki Iwashima;Linpu Yu;Sven Eckelmann;Florian Westphal;Ruijie Li;Luxiao Xu;Ruide Cao;Zhengchuan Liang;Asim Viladi Oglu Manizada;Cássio Gabriel;Herbert Xu;Li Xiasong;Ido Schimmel;Bart Van Assche;HyungJung Joo;Chaitanya Kulkarni;Michael Bommarito;Johan Hovold;Mingming Cao;Jiri Slaby (SUSE);James Kim;John Johansen;Waqar Hameed;Jinliang Zheng;Anshumali Gaur;Zhiyu Zhang;Sai Ritvik Tanksalkar;Raphael Zimmer;Nan Li;Stephen Smalley;Zhang Yi;Viacheslav Dubeyko;Arjan van de Ven;Mikulas Patocka;Yao Zi Merged-by: openharmony_ci Description: ## OpenHarmony kernel_linux_5.10 安全补丁集合 本 PR 包含 **84 个安全修复补丁**(83 个 CVE + 1 个 OH 内部漏洞),涵盖内核多个子系统的安全漏洞修复。 ### 修复统计 - **总漏洞数**: 90 - **已修复**: 84 (83 CVE + 1 OH 内部漏洞) - **不受影响**: 7 - **修复方式**: - Stable backport: ~63 条 - Mainline backport: ~14 条 - 手动 backport: 6 条 - 冲突解决: 1 条 ### 不受影响的漏洞 (7 条) 以下漏洞在 OH fork 5.10 中不受影响: | CVE ID | 原因 | |--------|------| | CVE-2026-46014 | KVM SVM 是 x86_64 代码,OH fork 目标架构为 ARM64,不会编译 | | CVE-2026-46059 | KVM nSVM 是 x86_64 代码,OH fork 目标架构为 ARM64,不会编译 | | CVE-2026-45894 | iommu/vt-d 是 x86_64 代码,OH fork 目标架构为 ARM64,不会编译 | | CVE-2026-45944 | iommu/vt-d 是 x86_64 代码,OH fork 目标架构为 ARM64,不会编译 | | CVE-2026-46054 | 依赖 security_mmap_backing_file() LSM hook,5.10 内核不存在此基础设施 | | CVE-2026-46311 | OH fork 不含 mes_userqueue.c 文件,AMD GPU 用户队列功能不存在 | | CVE-2026-53091 | OH fork 不含 net/core/gro.h,qdisc_pkt_len_segs_init() 函数不存在 | ### 修复列表 (84 条) | CVE ID | 标题 | Commit | |--------|------|--------| | CVE-2026-46250 | MIPS: Work around LLVM bug when gp is used as global re | a1f4ad886903 | | CVE-2026-46294 | dm: fix a buffer overflow in ioctl processing | 25e6acec358b | | CVE-2026-46276 | drm/amdgpu: fix zero-size GDS range init on RDNA4 | aea02a7e7282 | | CVE-2026-52955 | libceph: Fix potential out-of-bounds access in crush_de | 58f94ca19edc | | CVE-2026-52957 | libceph: Fix potential null-ptr-deref in decode_choose_ | 0c76e6b0c706 | | CVE-2026-52962 | ceph: fix a buffer leak in __ceph_setxattr() | 6c8c98effca9 | | CVE-2026-52946 | fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signa | eb1e0e790827 | | CVE-2026-52948 | i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl | 4e8c98cfcd51 | | CVE-2026-45892 | ext4: drop extent cache when splitting extent fails | 30e71ab92a54 | | CVE-2026-46302 | selinux: allow multiple opens of /sys/fs/selinux/policy | caf9dcaeb5ad | | CVE-2026-52921 | netfilter: ipset: stop hash:* range iteration at end | 0f968e86acd5 | | CVE-2026-52956 | libceph: Fix potential out-of-bounds access in __ceph_x | 710f30aec350 | | CVE-2026-46253 | pstore/ram: fix buffer overflow in persistent_ram_save_ | 19765e41c165 | | CVE-2026-45915 | fat: avoid parent link count underflow in rmdir | a355a522251f | | CVE-2026-46249 | octeontx2-af: Fix PF driver crash with kexec kernel boo | 42ba863ea278 | | CVE-2026-46259 | procfs: fix missing RCU protection when reading real_pa | cb15a689c39b | | CVE-2026-45936 | power: supply: goldfish: Fix use-after-free in power_su | 63bb9ebcbfd5 | | CVE-2026-46270 | power: supply: rt9455: Fix use-after-free in power_supp | 3d22510f2b5f | | CVE-2026-46328 | apparmor: fix rlimit for posix cpu timers | f9a24675e8bb | | CVE-2026-46285 | mtd: docg3: fix use-after-free in docg3_release() | fc2b228e97c3 | | CVE-2026-46307 | wifi: ath5k: do not access array OOB | 787978ed6afa | | CVE-2026-46273 | ibmveth: Disable GSO for packets with small MSS | f46034cf622d | | CVE-2026-46301 | spi: topcliff-pch: fix use-after-free on unbind | e1e63fe6fbb7 | | CVE-2026-46303 | isofs: validate Rock Ridge CE continuation extent again | ed272e9faee0 | | CVE-2026-46304 | nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_fre | 1b9cc047d638 | | CVE-2026-53130 | fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_S | 62e724b4cb1a | | CVE-2026-53128 | drbd: Balance RCU calls in drbd_adm_dump_devices() | 4d6a20f471dc | | CVE-2026-52920 | netfilter: xt_policy: fix strict mode inbound policy ma | 949c206fc387 | | CVE-2026-52925 | vrf: Fix a potential NPD when removing a port from a VR | e0daf72a5dbc | | CVE-2026-52970 | netfilter: nft_ct: fix missing expect put in obj eval | 98ff5892821f | | CVE-2026-52972 | crypto: af_alg - Cap AEAD AD length to 0x80000000 | 3b1670ee65ff | | CVE-2026-52963 | ALSA: usb-audio: Bound MIDI endpoint descriptor scans | 012f7bf5580e | | CVE-2026-46243 | smb: client: reject userspace cifs.spnego descriptions | 7089ba638183 | | CVE-2026-52915 | netfilter: ip6t_hbh: reject oversized option lists | a4c886953981 | | CVE-2026-52914 | batman-adv: fix fragment reassembly length accounting | 84d3aac0df71 | | CVE-2026-52916 | batman-adv: frag: disallow unicast fragment in fragment | 5fb3480f0ee3 | | CVE-2026-52919 | batman-adv: fix tp_meter counter underflow during shutd | 0fb254f48e32 | | CVE-2026-52922 | batman-adv: dat: handle forward allocation error | 6b01de54dedb | | CVE-2026-52926 | batman-adv: clear current gateway during teardown | 9f4ce357a585 | | CVE-2026-52931 | batman-adv: tp_meter: avoid use of uninit sender vars | f503c0a09b33 | | CVE-2026-52927 | netfilter: ebtables: fix OOB read in compat_mtw_from_us | 51ca971056a3 | | CVE-2026-52913 | batman-adv: v: stop OGMv2 on disabled interface | 76a5db529481 | | CVE-2026-52934 | batman-adv: tvlv: reject oversized TVLV packets | bc2424da3859 | | CVE-2026-52923 | ipc: limit next_id allocation to the valid ID range | f529f87d7775 | | CVE-2026-52910 | bpf: Free reuseport cBPF prog after RCU grace period. | bcb8fcfd98be | | CVE-2026-52924 | sctp: purge outqueue on stale COOKIE-ECHO handling | 5d325b2db045 | | CVE-2026-52939 | net/rds: fix NULL deref in rds_ib_send_cqe_handler() on | 3e5aed92d165 | | CVE-2026-52947 | net: qrtr: fix refcount saturation and potential UAF in | 78ad15a32375 | | CVE-2026-52935 | xfrm: espintcp: do not reuse an in-progress partial sen | 387e194263ca | | CVE-2026-52930 | ipc/shm: serialize orphan cleanup with shm_nattch updat | 7aa9cb9d604c | | CVE-2026-52929 | sctp: stream: fully roll back denied add-stream state | 2bf87ac4e2de | | CVE-2026-46292 | pmdomain: core: Fix detach procedure for virtual device | 2ef746fb3c2d | | CVE-2026-52943 | net: skbuff: fix missing zerocopy reference in pskb_car | 8c86f2f17ae7 | | CVE-2026-52909 | ip6_vti: set netns_immutable on the fallback device. | 873ac1b1d077 | | CVE-2026-45923 | net: usb: catc: enable basic endpoint checking | ca0a849ab20d | | CVE-2026-52912 | netfilter: nf_queue: hold bridge skb->dev while queued | 15b6a57b7c78 | | CVE-2026-52918 | Bluetooth: serialize accept_q access | f1baec78b243 | | CVE-2026-46112 | RDMA/hns: Fix unlocked call to hns_roce_qp_remove() | acee5a3275b5 | | CVE-2026-46247 | clk: qcom: gfx3d: add parent to parent request map | ca122689a112 | | CVE-2026-46265 | RDMA/hns: Fix WQ_MEM_RECLAIM warning | 6061b1b261d7 | | CVE-2026-46267 | nfc: hci: shdlc: Stop timers and work before freeing co | b121f7430b62 | | CVE-2026-52942 | netfilter: nf_log: validate MAC header was set before d | 9df75cf1753b | | CVE-2026-45905 | xfrm: fix ip_rt_bug race in icmp_route_lookup reverse p | b8d4c24b996e | | CVE-2026-45940 | net: stmmac: fix oops when split header is enabled | 8e20de0ea434 | | CVE-2026-46299 | hfsplus: fix held lock freed on hfsplus_fill_super() | 2e6b230bdff6 | | CVE-2026-46245 | drm/amd/display: Fix dc_link NULL handling in HPD init | 91ab519b842c | | CVE-2026-52917 | sctp: diag: reject stale associations in dump_one path | f19ddb0620a6 | | CVE-2026-52936 | crypto: jitterentropy - replace long-held spinlock with | 62339b910c40 | | CVE-2026-53129 | fs/mbcache: cancel shrink work before destroying the ca | 07677ffecdb3 | | CVE-2026-46082 | KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 | af5f3bbe2666 | | CVE-2026-46312 | media: videobuf2: Set vma_flags in vb2_dma_sg_mmap | 1174dc5e621e | | CVE-2026-46254 | AppArmor: Allow apparmor to handle unaligned dfa tables | b04e4ca39bcd | | CVE-2026-46266 | inet: RAW sockets using IPPROTO_RAW MUST drop incoming | 2451fbdd15b6 | | CVE-2026-46032 | KVM: nSVM: Triple fault if restore host CR3 fails on ne | 2b4f0b95108c | | CVE-2026-45850 | ipvs: skip ipv6 extension headers for csum checks | 9b51cd577414 | | CVE-2026-45934 | btrfs: fix EEXIST abort due to non-consecutive gaps in | 6f36bbd3e296 | | CVE-2026-45942 | ext4: fix e4b bitmap inconsistency reports | ccfd53f1172b | | CVE-2026-45949 | hwrng: core - use RCU and work_struct to fix race condi | 9a83f3ecf44e | | CVE-2026-45961 | gfs2: fix memory leaks in gfs2_fill_super error path | 400ea67e0ab2 | | CVE-2026-46083 | spi: fix resource leaks on device setup failure | ae5dc9d7472d | | CVE-2026-46252 | regulator: core: fix locking in regulator_resolve_suppl | 79edde319158 | | CVE-2026-46275 | Bluetooth: hci_uart: fix UAFs and race conditions in cl | 54e34bd15d4e | | CVE-2026-52937 | tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR | dda5887b360e | | vul-1082119022692012032 | hmdfs: fix heap OOB read/write in getxattr/listxattr re | 40e552c6f270 | ### 手动 backport 说明 (6 条) 以下漏洞因 OH fork 5.10 与上游代码差异较大,进行了手动 backport: 1. **CVE-2026-45934** (btrfs): mainline +183 -60 行重构 chunk 分配逻辑,适配 5.10 API 2. **CVE-2026-45942** (ext4): mainline folio API 适配为 OH fork page API,添加 PageLocked 检查 3. **CVE-2026-45949** (hwrng): mainline RCU + work_struct 完整重构,适配 5.10 代码结构 4. **CVE-2026-45961** (gfs2): mainline 补丁适配,修复 fill_super 错误路径泄漏 5. **CVE-2026-46083** (spi): mainline 大规模重构改为最小化修复(+1 行 spi_cleanup) 6. **CVE-2026-52937** (tap): mainline 手动 backport(1 行初始化) ### 冲突解决说明 (1 条) - **CVE-2026-46275** (bluetooth): stable cherry-pick 冲突,解决后修复 HCI_UART_PROTO_INIT → HCI_UART_PROTO_SET 适配 ### 编译验证 所有 84 个修复均已通过内核编译验证: - defconfig activate 执行 2 轮(第 2 轮无新增配置) - 内核编译通过(~457 秒) - 所有修改的 .o 文件均已生成 ### 相关 Issue - Issue: #8664 ## 影响模块与手动测试建议 ### 改动模块 | 模块 | 可能影响的手机功能 | 关键路径 | | --- | --- | --- | | Security/Crypto | 安全存储、TLS、签名校验 | crypto/af_alg.c、crypto/jitterentropy-kcapi.c、security/apparmor/match.c、等 5 个文件 | | Power | 充电、电量显示、挂起/恢复 | drivers/base/power/domain.c、drivers/power/supply/goldfish_battery.c、drivers/power/supply/rt9455_charger.c | | Bluetooth | 蓝牙配对、蓝牙音频、文件传输、BLE 外设连接 | drivers/bluetooth/hci_ldisc.c、include/net/bluetooth/bluetooth.h、net/bluetooth/af_bluetooth.c | | Display | 屏幕渲染、亮度、旋转、息屏/亮屏显示 | drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c、drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c | | Camera/Media | 相机预览、录像、编解码播放 | `drivers/media/common/videobuf2/ See merge request: openharmony/kernel_linux_5.10!1982 | 7 天前 | |
kernel: repair linux-5.10 CVE backport build Signed-off-by: Hun_Dun <18967138853@163.com> | 2 个月前 | |
certs: Add support for using elliptic curve keys for signing modules mainline inclusion from mainline-5.15-rc1 commit a4aed36ed5924a05ecfadc470584188bfba2b928 category: feature issue: #I6S6P0 CVE: NA Signed-off-by: lihehe <lihehao@huawei.com> --------------------------------------- certs: Add support for using elliptic curve keys for signing modules Add support for using elliptic curve keys for signing modules. It uses a NIST P384 (secp384r1) key if the user chooses an elliptic curve key and will have ECDSA support built into the kernel. Note: A developer choosing an ECDSA key for signing modules should still delete the signing key (rm certs/signing_key.*) when building an older version of a kernel that only supports RSA keys. Unless kbuild automati- cally detects and generates a new kernel module key, ECDSA-signed kernel modules will fail signature verification. Cc: David Howells <dhowells@redhat.com> Cc: David Woodhouse <dwmw2@infradead.org> Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org> Tested-by: Jarkko Sakkinen <jarkko@kernel.org> Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org> Signed-off-by: lihehe <lihehao@huawei.com> Change-Id: I991f2b62a051c959bd0a663fdb50a2e17efbc491 | 3 年前 | |
crypto: jitterentropy - replace long-held spinlock with mutex stable inclusion from stable-5.10.252 commit 01d798e9feb3 category: bugfix issue: #8664 CVE: CVE-2026-52936 Signed-off-by: 姜小林 <jiangxiaolin11@huawei.com> Co-Authored-By: Agent ------------------------------- Signed-off-by: 姜小林 <jiangxiaolin11@huawei.com> Change-Id: Ie2a758b1d49a14fbe1f8e8ae84c3d5bd99425f6c | 9 天前 | |
!1984 merge add_cmd_check into master drivers: accesstokenid validate ioctl command against whitelist Created-by: xia-bubai Commit-by: xia-bubai Merged-by: openharmony_ci Description: ### 一、内容说明(相关的Issue) https://gitcode.com/openharmony/kernel_linux_5.10/issues/9013 ### 二、建议测试周期和提测地址 建议测试完成时间:xxxx.xx.xx 投产上线时间:xxxx.xx.xx 提测地址:CI环境/压测环境 测试账号: ### 三、变更内容 * 3.1 关联PR列表 * 3.2 数据库和部署说明 **不涉及** 1. 常规更新 2. 重启unicorn 3. 重启sidekiq 4. 迁移任务:是否有迁移任务,没有写 "无" 5. rake脚本: bundle exec xxx RAILS_ENV = production;没有写 "无" * 3.4 其他技术优化内容(做了什么,变更了什么) 将ioctl的cmd检查流程进行优化,比原来检查,相当于新增了数据类型size的检查 * 3.5 废弃通知(什么字段、方法弃用?) * 3.6 后向不兼容变更(是否有无法向后兼容的变更?) ### 四、研发自测点(自测哪些?冒烟用例全部自测?) 自测测试结论: 非法ileage cmd返回失败  ### 五、测试关注点(需要提醒QA重点关注的、可能会忽略的地方) 检查点: | 需求名称 | 是否影响xx公共模块 | 是否需要xx功能 | 需求升级是否依赖其他子产品 | |------|------------|----------|---------------| | xxx | 否 | 需要 | 不需要 | | | | | | 接口测试: 性能测试: 并发测试: 其他: See merge request: openharmony/kernel_linux_5.10!1984 | 4 天前 | |
!1983 merge cve-fix-20260729-master into master CVE修复: kernel_linux_5.10 master (修复6个cherry-pick问题) - 2026-07-29 Created-by: provii Commit-by: 姜小林 Merged-by: openharmony_ci Description: ## 重新修复的漏洞列表 本 PR 修复 PR #1982 中发现的 6 个 cherry-pick 问题,采用 revert + 重新正确修复的方式。 ### 1. CVE-2026-52942 — netfilter: nf_log: validate MAC header was set before dumping it - **问题**: 错误新增 nf_log_syslog.c (1099行),5.10 中该文件不存在 - **修复**: revert 删除该文件 + 正确修复 nf_log_ipv4.c 和 nf_log_ipv6.c (各 2 行) ### 2. CVE-2026-46243 — RDMA/hns: Fix WQ_MEM_RECLAIM warning - **问题**: hns_roce_hw_v2.c 被整体替换为 mainline 版本 (7413行变更),引用 3 个不存在的头文件 - **修复**: revert 恢复 5.10 版本 + 正确添加 WQ_MEM_RECLAIM 标志 (2 行) ### 3. CVE-2026-46245 — RDMA/hns: Fix unlocked call to hns_roce_qp_remove() - **问题**: hns_roce_qp.c 被整体替换为 mainline 版本 (1057行变更) - **修复**: revert 恢复 5.10 版本 + 正确添加 spinlock 保护 (7 行) ### 4. CVE-2026-46247 — clk: qcom: gfx3d: add parent to parent request map - **问题**: clk-rcg2.c 被整体替换为 mainline 版本 (766行变更),引入未定义的 freq_multi_tbl - **修复**: revert 恢复 5.10 版本 + 正确添加 parent_req.best_parent_hw (1 行) ### 5. CVE-2026-46249 — Bluetooth: serialize accept_q access - **问题**: af_bluetooth.c 被整体替换为 stable-5.10.259 版本 (151行变更) - **修复**: revert 恢复 5.10 版本 + 正确 backport accept_q 序列化 (5 文件, 68 行) ### 6. 检视修复不完整 - **问题**: 原检视修复缺少 hmdfs 下溢检查 + hw_random cancel_work_sync - **修复**: revert 原检视修复 + 重新提交完整修复 (catc + hmdfs含下溢检查 + ebtables + crush + hw_random) ### 编译验证 - workspace: master, kernel: linux-5.10 - 编译通过, 耗时 1764.1 秒 See merge request: openharmony/kernel_linux_5.10!1983 | 4 天前 | |
!1982 merge cve-fix-20260727-master into master CVE修复: kernel_linux_5.10 OpenHarmony-7.0-Release (84 个安全补丁) - 2026-07-27 Created-by: provii Commit-by: 姜小林;Xiang Mei;Votokina Victoria;Chengchang Tang;Dmitry Baryshkov;Jason Gunthorpe;Jiexun Wang;Haoze Xie;Ziyi Guo;Minh Nguyen;Ulf Hansson;Wyatt Feng;Yilin Zhu;Mingyu Wang;Weiming Shi;Xin Long;Kuniyuki Iwashima;Linpu Yu;Sven Eckelmann;Florian Westphal;Ruijie Li;Luxiao Xu;Ruide Cao;Zhengchuan Liang;Asim Viladi Oglu Manizada;Cássio Gabriel;Herbert Xu;Li Xiasong;Ido Schimmel;Bart Van Assche;HyungJung Joo;Chaitanya Kulkarni;Michael Bommarito;Johan Hovold;Mingming Cao;Jiri Slaby (SUSE);James Kim;John Johansen;Waqar Hameed;Jinliang Zheng;Anshumali Gaur;Zhiyu Zhang;Sai Ritvik Tanksalkar;Raphael Zimmer;Nan Li;Stephen Smalley;Zhang Yi;Viacheslav Dubeyko;Arjan van de Ven;Mikulas Patocka;Yao Zi Merged-by: openharmony_ci Description: ## OpenHarmony kernel_linux_5.10 安全补丁集合 本 PR 包含 **84 个安全修复补丁**(83 个 CVE + 1 个 OH 内部漏洞),涵盖内核多个子系统的安全漏洞修复。 ### 修复统计 - **总漏洞数**: 90 - **已修复**: 84 (83 CVE + 1 OH 内部漏洞) - **不受影响**: 7 - **修复方式**: - Stable backport: ~63 条 - Mainline backport: ~14 条 - 手动 backport: 6 条 - 冲突解决: 1 条 ### 不受影响的漏洞 (7 条) 以下漏洞在 OH fork 5.10 中不受影响: | CVE ID | 原因 | |--------|------| | CVE-2026-46014 | KVM SVM 是 x86_64 代码,OH fork 目标架构为 ARM64,不会编译 | | CVE-2026-46059 | KVM nSVM 是 x86_64 代码,OH fork 目标架构为 ARM64,不会编译 | | CVE-2026-45894 | iommu/vt-d 是 x86_64 代码,OH fork 目标架构为 ARM64,不会编译 | | CVE-2026-45944 | iommu/vt-d 是 x86_64 代码,OH fork 目标架构为 ARM64,不会编译 | | CVE-2026-46054 | 依赖 security_mmap_backing_file() LSM hook,5.10 内核不存在此基础设施 | | CVE-2026-46311 | OH fork 不含 mes_userqueue.c 文件,AMD GPU 用户队列功能不存在 | | CVE-2026-53091 | OH fork 不含 net/core/gro.h,qdisc_pkt_len_segs_init() 函数不存在 | ### 修复列表 (84 条) | CVE ID | 标题 | Commit | |--------|------|--------| | CVE-2026-46250 | MIPS: Work around LLVM bug when gp is used as global re | a1f4ad886903 | | CVE-2026-46294 | dm: fix a buffer overflow in ioctl processing | 25e6acec358b | | CVE-2026-46276 | drm/amdgpu: fix zero-size GDS range init on RDNA4 | aea02a7e7282 | | CVE-2026-52955 | libceph: Fix potential out-of-bounds access in crush_de | 58f94ca19edc | | CVE-2026-52957 | libceph: Fix potential null-ptr-deref in decode_choose_ | 0c76e6b0c706 | | CVE-2026-52962 | ceph: fix a buffer leak in __ceph_setxattr() | 6c8c98effca9 | | CVE-2026-52946 | fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signa | eb1e0e790827 | | CVE-2026-52948 | i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl | 4e8c98cfcd51 | | CVE-2026-45892 | ext4: drop extent cache when splitting extent fails | 30e71ab92a54 | | CVE-2026-46302 | selinux: allow multiple opens of /sys/fs/selinux/policy | caf9dcaeb5ad | | CVE-2026-52921 | netfilter: ipset: stop hash:* range iteration at end | 0f968e86acd5 | | CVE-2026-52956 | libceph: Fix potential out-of-bounds access in __ceph_x | 710f30aec350 | | CVE-2026-46253 | pstore/ram: fix buffer overflow in persistent_ram_save_ | 19765e41c165 | | CVE-2026-45915 | fat: avoid parent link count underflow in rmdir | a355a522251f | | CVE-2026-46249 | octeontx2-af: Fix PF driver crash with kexec kernel boo | 42ba863ea278 | | CVE-2026-46259 | procfs: fix missing RCU protection when reading real_pa | cb15a689c39b | | CVE-2026-45936 | power: supply: goldfish: Fix use-after-free in power_su | 63bb9ebcbfd5 | | CVE-2026-46270 | power: supply: rt9455: Fix use-after-free in power_supp | 3d22510f2b5f | | CVE-2026-46328 | apparmor: fix rlimit for posix cpu timers | f9a24675e8bb | | CVE-2026-46285 | mtd: docg3: fix use-after-free in docg3_release() | fc2b228e97c3 | | CVE-2026-46307 | wifi: ath5k: do not access array OOB | 787978ed6afa | | CVE-2026-46273 | ibmveth: Disable GSO for packets with small MSS | f46034cf622d | | CVE-2026-46301 | spi: topcliff-pch: fix use-after-free on unbind | e1e63fe6fbb7 | | CVE-2026-46303 | isofs: validate Rock Ridge CE continuation extent again | ed272e9faee0 | | CVE-2026-46304 | nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_fre | 1b9cc047d638 | | CVE-2026-53130 | fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_S | 62e724b4cb1a | | CVE-2026-53128 | drbd: Balance RCU calls in drbd_adm_dump_devices() | 4d6a20f471dc | | CVE-2026-52920 | netfilter: xt_policy: fix strict mode inbound policy ma | 949c206fc387 | | CVE-2026-52925 | vrf: Fix a potential NPD when removing a port from a VR | e0daf72a5dbc | | CVE-2026-52970 | netfilter: nft_ct: fix missing expect put in obj eval | 98ff5892821f | | CVE-2026-52972 | crypto: af_alg - Cap AEAD AD length to 0x80000000 | 3b1670ee65ff | | CVE-2026-52963 | ALSA: usb-audio: Bound MIDI endpoint descriptor scans | 012f7bf5580e | | CVE-2026-46243 | smb: client: reject userspace cifs.spnego descriptions | 7089ba638183 | | CVE-2026-52915 | netfilter: ip6t_hbh: reject oversized option lists | a4c886953981 | | CVE-2026-52914 | batman-adv: fix fragment reassembly length accounting | 84d3aac0df71 | | CVE-2026-52916 | batman-adv: frag: disallow unicast fragment in fragment | 5fb3480f0ee3 | | CVE-2026-52919 | batman-adv: fix tp_meter counter underflow during shutd | 0fb254f48e32 | | CVE-2026-52922 | batman-adv: dat: handle forward allocation error | 6b01de54dedb | | CVE-2026-52926 | batman-adv: clear current gateway during teardown | 9f4ce357a585 | | CVE-2026-52931 | batman-adv: tp_meter: avoid use of uninit sender vars | f503c0a09b33 | | CVE-2026-52927 | netfilter: ebtables: fix OOB read in compat_mtw_from_us | 51ca971056a3 | | CVE-2026-52913 | batman-adv: v: stop OGMv2 on disabled interface | 76a5db529481 | | CVE-2026-52934 | batman-adv: tvlv: reject oversized TVLV packets | bc2424da3859 | | CVE-2026-52923 | ipc: limit next_id allocation to the valid ID range | f529f87d7775 | | CVE-2026-52910 | bpf: Free reuseport cBPF prog after RCU grace period. | bcb8fcfd98be | | CVE-2026-52924 | sctp: purge outqueue on stale COOKIE-ECHO handling | 5d325b2db045 | | CVE-2026-52939 | net/rds: fix NULL deref in rds_ib_send_cqe_handler() on | 3e5aed92d165 | | CVE-2026-52947 | net: qrtr: fix refcount saturation and potential UAF in | 78ad15a32375 | | CVE-2026-52935 | xfrm: espintcp: do not reuse an in-progress partial sen | 387e194263ca | | CVE-2026-52930 | ipc/shm: serialize orphan cleanup with shm_nattch updat | 7aa9cb9d604c | | CVE-2026-52929 | sctp: stream: fully roll back denied add-stream state | 2bf87ac4e2de | | CVE-2026-46292 | pmdomain: core: Fix detach procedure for virtual device | 2ef746fb3c2d | | CVE-2026-52943 | net: skbuff: fix missing zerocopy reference in pskb_car | 8c86f2f17ae7 | | CVE-2026-52909 | ip6_vti: set netns_immutable on the fallback device. | 873ac1b1d077 | | CVE-2026-45923 | net: usb: catc: enable basic endpoint checking | ca0a849ab20d | | CVE-2026-52912 | netfilter: nf_queue: hold bridge skb->dev while queued | 15b6a57b7c78 | | CVE-2026-52918 | Bluetooth: serialize accept_q access | f1baec78b243 | | CVE-2026-46112 | RDMA/hns: Fix unlocked call to hns_roce_qp_remove() | acee5a3275b5 | | CVE-2026-46247 | clk: qcom: gfx3d: add parent to parent request map | ca122689a112 | | CVE-2026-46265 | RDMA/hns: Fix WQ_MEM_RECLAIM warning | 6061b1b261d7 | | CVE-2026-46267 | nfc: hci: shdlc: Stop timers and work before freeing co | b121f7430b62 | | CVE-2026-52942 | netfilter: nf_log: validate MAC header was set before d | 9df75cf1753b | | CVE-2026-45905 | xfrm: fix ip_rt_bug race in icmp_route_lookup reverse p | b8d4c24b996e | | CVE-2026-45940 | net: stmmac: fix oops when split header is enabled | 8e20de0ea434 | | CVE-2026-46299 | hfsplus: fix held lock freed on hfsplus_fill_super() | 2e6b230bdff6 | | CVE-2026-46245 | drm/amd/display: Fix dc_link NULL handling in HPD init | 91ab519b842c | | CVE-2026-52917 | sctp: diag: reject stale associations in dump_one path | f19ddb0620a6 | | CVE-2026-52936 | crypto: jitterentropy - replace long-held spinlock with | 62339b910c40 | | CVE-2026-53129 | fs/mbcache: cancel shrink work before destroying the ca | 07677ffecdb3 | | CVE-2026-46082 | KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 | af5f3bbe2666 | | CVE-2026-46312 | media: videobuf2: Set vma_flags in vb2_dma_sg_mmap | 1174dc5e621e | | CVE-2026-46254 | AppArmor: Allow apparmor to handle unaligned dfa tables | b04e4ca39bcd | | CVE-2026-46266 | inet: RAW sockets using IPPROTO_RAW MUST drop incoming | 2451fbdd15b6 | | CVE-2026-46032 | KVM: nSVM: Triple fault if restore host CR3 fails on ne | 2b4f0b95108c | | CVE-2026-45850 | ipvs: skip ipv6 extension headers for csum checks | 9b51cd577414 | | CVE-2026-45934 | btrfs: fix EEXIST abort due to non-consecutive gaps in | 6f36bbd3e296 | | CVE-2026-45942 | ext4: fix e4b bitmap inconsistency reports | ccfd53f1172b | | CVE-2026-45949 | hwrng: core - use RCU and work_struct to fix race condi | 9a83f3ecf44e | | CVE-2026-45961 | gfs2: fix memory leaks in gfs2_fill_super error path | 400ea67e0ab2 | | CVE-2026-46083 | spi: fix resource leaks on device setup failure | ae5dc9d7472d | | CVE-2026-46252 | regulator: core: fix locking in regulator_resolve_suppl | 79edde319158 | | CVE-2026-46275 | Bluetooth: hci_uart: fix UAFs and race conditions in cl | 54e34bd15d4e | | CVE-2026-52937 | tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR | dda5887b360e | | vul-1082119022692012032 | hmdfs: fix heap OOB read/write in getxattr/listxattr re | 40e552c6f270 | ### 手动 backport 说明 (6 条) 以下漏洞因 OH fork 5.10 与上游代码差异较大,进行了手动 backport: 1. **CVE-2026-45934** (btrfs): mainline +183 -60 行重构 chunk 分配逻辑,适配 5.10 API 2. **CVE-2026-45942** (ext4): mainline folio API 适配为 OH fork page API,添加 PageLocked 检查 3. **CVE-2026-45949** (hwrng): mainline RCU + work_struct 完整重构,适配 5.10 代码结构 4. **CVE-2026-45961** (gfs2): mainline 补丁适配,修复 fill_super 错误路径泄漏 5. **CVE-2026-46083** (spi): mainline 大规模重构改为最小化修复(+1 行 spi_cleanup) 6. **CVE-2026-52937** (tap): mainline 手动 backport(1 行初始化) ### 冲突解决说明 (1 条) - **CVE-2026-46275** (bluetooth): stable cherry-pick 冲突,解决后修复 HCI_UART_PROTO_INIT → HCI_UART_PROTO_SET 适配 ### 编译验证 所有 84 个修复均已通过内核编译验证: - defconfig activate 执行 2 轮(第 2 轮无新增配置) - 内核编译通过(~457 秒) - 所有修改的 .o 文件均已生成 ### 相关 Issue - Issue: #8664 ## 影响模块与手动测试建议 ### 改动模块 | 模块 | 可能影响的手机功能 | 关键路径 | | --- | --- | --- | | Security/Crypto | 安全存储、TLS、签名校验 | crypto/af_alg.c、crypto/jitterentropy-kcapi.c、security/apparmor/match.c、等 5 个文件 | | Power | 充电、电量显示、挂起/恢复 | drivers/base/power/domain.c、drivers/power/supply/goldfish_battery.c、drivers/power/supply/rt9455_charger.c | | Bluetooth | 蓝牙配对、蓝牙音频、文件传输、BLE 外设连接 | drivers/bluetooth/hci_ldisc.c、include/net/bluetooth/bluetooth.h、net/bluetooth/af_bluetooth.c | | Display | 屏幕渲染、亮度、旋转、息屏/亮屏显示 | drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c、drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c | | Camera/Media | 相机预览、录像、编解码播放 | `drivers/media/common/videobuf2/ See merge request: openharmony/kernel_linux_5.10!1982 | 7 天前 | |
start_kernel: Add __no_stack_protector function attribute mainline inclusion from mainline-v6.5-rc1 commit 514ca14ed5444b911de59ed3381dfd195d99fe4b category: bugfix issue: #8060 CVE: CVE-2023-53491 Signed-off-by: Tengda Wu <wutengda2@huawei.com> --------------------------------------- Back during the discussion of commit a9a3ed1eff36 ("x86: Fix early boot crash on gcc-10, third try") we discussed the need for a function attribute to control the omission of stack protectors on a per-function basis; at the time Clang had support for no_stack_protector but GCC did not. This was fixed in gcc-11. Now that the function attribute is available, let's start using it. Callers of boot_init_stack_canary need to use this function attribute unless they're compiled with -fno-stack-protector, otherwise the canary stored in the stack slot of the caller will differ upon the call to boot_init_stack_canary. This will lead to a call to __stack_chk_fail() then panic. Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94722 Link: https://lore.kernel.org/all/20200316130414.GC12561@hirez.programming.kicks-ass.net/ Tested-by: Nathan Chancellor <nathan@kernel.org> Acked-by: Michael Ellerman <mpe@ellerman.id.au> (powerpc) Acked-by: Miguel Ojeda <ojeda@kernel.org> Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org> Signed-off-by: Nick Desaulniers <ndesaulniers@google.com> Link: https://lore.kernel.org/r/20230412-no_stackp-v2-1-116f9fe4bbe7@google.com Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org> Signed-off-by: ndesaulniers@google.com <ndesaulniers@google.com> | 8 个月前 | |
io-wq: check that the predecessor is hashed in io_wq_remove_pending() mainline inclusion from mainline-5.10.101 commit d6a2d7b04b5a093021a7a0e2e69e9d5237dfa8cc category: bugfix issue: 8663 CVE: CVE-2026-46274 Signed-off-by: wanghao794 <wanghao865@huawei.com> Co-Authored-By: Agent ------------------------------- io-wq: check that the predecessor is hashed in io_wq_remove_pending() io_wq_remove_pending() needs to fix up wq->hash_tail[] if the cancelled work was the tail of its hash bucket. When doing this, it checks whether the preceding entry in acct->work_list has the same hash value, but never checks that the predecessor is hashed at all. io_get_work_hash() is simply atomic_read(&work->flags) >> IO_WQ_HASH_SHIFT, and the hash bits are never set for non-hashed work, so it returns 0. Thus, when a hashed bucket-0 work is cancelled while a non-hashed work is its list predecessor, the check spuriously passes and a pointer to the non-hashed io_kiocb is stored in wq->hash_tail[0]. Because non-hashed work is dequeued via the fast path in io_get_next_work(), which never touches hash_tail[], the stale pointer is never cleared. Therefore, after the non-hashed io_kiocb completes and is freed back to req_cachep, wq->hash_tail[0] is a dangling pointer. The io_wq is per-task (tctx->io_wq) and survives ring open/close, so the dangling pointer persists for the lifetime of the task; the next hashed bucket-0 enqueue dereferences it in io_wq_insert_work() and wq_list_add_after() writes through freed memory. Add the missing io_wq_is_hashed() check so a non-hashed predecessor never inherits a hash_tail[] slot. Cc: stable@vger.kernel.org Fixes: 204361a77f40 ("io-wq: fix hang after cancelling pending hashed work") Original-signoff: Nicholas Carlini <nicholas@carlini.com> Original-signoff: Jens Axboe <axboe@kernel.dk> Signed-off-by: wanghao794 <wanghao865@huawei.com> | 13 天前 | |
ipc/shm: serialize orphan cleanup with shm_nattch updates stable inclusion from stable-5.10.258 commit b1e9aef48e4d8a0c1b54fb913077b0824ed7d650 category: bugfix issue: #8664 CVE: CVE-2026-52930 Signed-off-by: 姜小林 <jiangxiaolin11@huawei.com> Co-Authored-By: Agent ------------------------------- commit 2e5c6f4fd4001562781e99bbfc7f1f0127187542 upstream. shm_destroy_orphaned() walks the shm idr under shm_ids(ns).rwsem, but that does not serialize all fields tested by shm_may_destroy(). In particular, shm_nattch is updated while holding shm_perm.lock, and attach paths can do that without holding the rwsem. Do not decide that an orphaned segment is unused before taking the object lock. Move the shm_may_destroy() check under shm_perm.lock, matching the other destroy paths, and unlock the segment when it no longer qualifies for removal. Link: https://lore.kernel.org/9d97cc1031de2d0bace0edf3a668818aa2f4eca6.1777410234.git.zylzyl2333@gmail.com Fixes: 4c677e2eefdb ("shm: optimize locking and ipc_namespace getting") Reported-by: Yuan Tan <yuantan098@gmail.com> Reported-by: Yifan Wu <yifanwucs@gmail.com> Reported-by: Juefei Pu <tomapufckgml@gmail.com> Reported-by: Xin Liu <bird@lzu.edu.cn> Signed-off-by: Yilin Zhu <zylzyl2333@gmail.com> Signed-off-by: Ren Wei <n05ec@lzu.edu.cn> Cc: Christian Brauner <brauner@kernel.org> Cc: Jeongjun Park <aha310510@gmail.com> Cc: Kees Cook <kees@kernel.org> Cc: Liam Howlett <liam@infradead.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Serge Hallyn <sergeh@kernel.org> Cc: Vasiliy Kulikov <segoon@openwall.com> Cc: Davidlohr Bueso <dave@stgolabs.net> Cc: Oleg Nesterov <oleg@redhat.com> Cc: Serge Hallyn <serge@hallyn.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: 姜小林 <jiangxiaolin11@huawei.com> Change-Id: I6770b8efbb8325969989f1079304c45ec7f2e515 | 11 天前 | |
audit: fix incorrect inheritable capability in CAPSET records mainline inclusion from mainline-v5.10.101 commit e4a640475e43 category: bugfix issue: 8663 CVE: CVE-2026-53287 Signed-off-by: wanghao794 <wanghao865@huawei.com> Co-Authored-By: Agent ------------------------------- | 13 天前 | |
lib: test_hmm: evict device pages on file close to avoid use-after-free mainline inclusion from mainline-5.10.101 commit 744dd97752ef1076a8d8672bb0d8aa2c7abc1144 category: bugfix issue: 8663 CVE: CVE-2026-46280 Signed-off-by: wanghao794 <wanghao865@huawei.com> Co-Authored-By: Agent ------------------------------- lib: test_hmm: evict device pages on file close to avoid use-after-free Patch series "Minor hmm_test fixes and cleanups". Two bugfixes a cleanup for the HMM kernel selftests. These were mostly reported by Zenghui Yu with special thanks to Lorenzo for analysing and pointing out the problems. This patch (of 3): When dmirror_fops_release() is called it frees the dmirror struct but doesn't migrate device private pages back to system memory first. This leaves those pages with a dangling zone_device_data pointer to the freed dmirror. If a subsequent fault occurs on those pages (eg. during coredump) the dmirror_devmem_fault() callback dereferences the stale pointer causing a kernel panic. This was reported [1] when running mm/ksft_hmm.sh on arm64, where a test failure triggered SIGABRT and the resulting coredump walked the VMAs faulting in the stale device private pages. Fix this by calling dmirror_device_evict_chunk() for each devmem chunk in dmirror_fops_release() to migrate all device private pages back to system memory before freeing the dmirror struct. The function is moved earlier in the file to avoid a forward declaration. Link: https://lore.kernel.org/20260331063445.3551404-1-apopple@nvidia.com Link: https://lore.kernel.org/20260331063445.3551404-2-apopple@nvidia.com Fixes: b2ef9f5a5cb3 ("mm/hmm/test: add selftest driver for HMM") Original-signoff: Alistair Popple <apopple@nvidia.com> Reported-by: Zenghui Yu <zenghui.yu@linux.dev> Closes: https://lore.kernel.org/linux-mm/8bd0396a-8997-4d2e-a13f-5aac033083d7@linux.dev/ Reviewed-by: Balbir Singh <balbirs@nvidia.com> Tested-by: Zenghui Yu <zenghui.yu@linux.dev> Cc: David Hildenbrand <david@kernel.org> Cc: Jason Gunthorpe <jgg@ziepe.ca> Cc: Leon Romanovsky <leon@kernel.org> Cc: Liam Howlett <liam.howlett@oracle.com> Cc: Lorenzo Stoakes (Oracle) <ljs@kernel.org> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Zenghui Yu <zenghui.yu@linux.dev> Cc: Matthew Brost <matthew.brost@intel.com> Cc: <stable@vger.kernel.org> Original-signoff: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: wanghao794 <wanghao865@huawei.com> | 13 天前 | |
kernel: repair linux-5.10 CVE backport build Signed-off-by: Hun_Dun <18967138853@163.com> | 2 个月前 | |
!1983 merge cve-fix-20260729-master into master CVE修复: kernel_linux_5.10 master (修复6个cherry-pick问题) - 2026-07-29 Created-by: provii Commit-by: 姜小林 Merged-by: openharmony_ci Description: ## 重新修复的漏洞列表 本 PR 修复 PR #1982 中发现的 6 个 cherry-pick 问题,采用 revert + 重新正确修复的方式。 ### 1. CVE-2026-52942 — netfilter: nf_log: validate MAC header was set before dumping it - **问题**: 错误新增 nf_log_syslog.c (1099行),5.10 中该文件不存在 - **修复**: revert 删除该文件 + 正确修复 nf_log_ipv4.c 和 nf_log_ipv6.c (各 2 行) ### 2. CVE-2026-46243 — RDMA/hns: Fix WQ_MEM_RECLAIM warning - **问题**: hns_roce_hw_v2.c 被整体替换为 mainline 版本 (7413行变更),引用 3 个不存在的头文件 - **修复**: revert 恢复 5.10 版本 + 正确添加 WQ_MEM_RECLAIM 标志 (2 行) ### 3. CVE-2026-46245 — RDMA/hns: Fix unlocked call to hns_roce_qp_remove() - **问题**: hns_roce_qp.c 被整体替换为 mainline 版本 (1057行变更) - **修复**: revert 恢复 5.10 版本 + 正确添加 spinlock 保护 (7 行) ### 4. CVE-2026-46247 — clk: qcom: gfx3d: add parent to parent request map - **问题**: clk-rcg2.c 被整体替换为 mainline 版本 (766行变更),引入未定义的 freq_multi_tbl - **修复**: revert 恢复 5.10 版本 + 正确添加 parent_req.best_parent_hw (1 行) ### 5. CVE-2026-46249 — Bluetooth: serialize accept_q access - **问题**: af_bluetooth.c 被整体替换为 stable-5.10.259 版本 (151行变更) - **修复**: revert 恢复 5.10 版本 + 正确 backport accept_q 序列化 (5 文件, 68 行) ### 6. 检视修复不完整 - **问题**: 原检视修复缺少 hmdfs 下溢检查 + hw_random cancel_work_sync - **修复**: revert 原检视修复 + 重新提交完整修复 (catc + hmdfs含下溢检查 + ebtables + crush + hw_random) ### 编译验证 - workspace: master, kernel: linux-5.10 - 编译通过, 耗时 1764.1 秒 See merge request: openharmony/kernel_linux_5.10!1983 | 4 天前 | |
samples/hw_breakpoint: fix building without module unloading stable inclusion from stable-5.10.197 commit 7be3a38f0e379ed3a68b293b3518e8ba5f700b32 category: bugfix issue: #I9SP3X CVE: NA Signed-off-by: wanxiaoqing <wanxiaoqing@huawei.com> --------------------------------------- [ Upstream commit b9080468caeddc58a91edd1c3a7d212ea82b0d1d ] __symbol_put() is really meant as an internal helper and is not available when module unloading is disabled, unlike the previously used symbol_put(): samples/hw_breakpoint/data_breakpoint.c: In function 'hw_break_module_exit': samples/hw_breakpoint/data_breakpoint.c:73:9: error: implicit declaration of function '__symbol_put'; did you mean '__symbol_get'? [-Werror=implicit-function-declaration] The hw_break_module_exit() function is not actually used when module unloading is disabled, but it still causes the build failure for an undefined identifier. Enclose this one call in an appropriate #ifdef to clarify what the requirement is. Leaving out the entire exit function would also work but feels less clar in this case. Fixes: 910e230d5f1bb ("samples/hw_breakpoint: Fix kernel BUG 'invalid opcode: 0000'") Fixes: d8a84d33a4954 ("samples/hw_breakpoint: drop use of kallsyms_lookup_name()") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Reviewed-by: Petr Mladek <pmladek@suse.com> Signed-off-by: Luis Chamberlain <mcgrof@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: wanxiaoqing <wanxiaoqing@huawei.com> | 2 年前 | |
scripts/decode_stacktrace.sh: optionally use LLVM utilities stable inclusion from stable-5.10.210 commit 583a6c76b9498ea08948aeb9558a492b470dfa0f category: bugfix issue: #IAOD4C CVE: NA Signed-off-by: yaowenrui <yaowenrui2@huawei.com> --------------------------------------- [ Upstream commit efbd6398353315b7018e6943e41fee9ec35e875f ] GNU's addr2line can have problems parsing a vmlinux built with LLVM, particularly when LTO was used. In order to decode the traces correctly this patch adds the ability to switch to LLVM's utilities readelf and addr2line. The same approach is followed by Will in [1]. Before: $ scripts/decode_stacktrace.sh vmlinux < kernel.log [17716.240635] Call trace: [17716.240646] skb_cow_data (??:?) [17716.240654] esp6_input (ld-temp.o:?) [17716.240666] xfrm_input (ld-temp.o:?) [17716.240674] xfrm6_rcv (??:?) [...] After: $ LLVM=1 scripts/decode_stacktrace.sh vmlinux < kernel.log [17716.240635] Call trace: [17716.240646] skb_cow_data (include/linux/skbuff.h:2172 net/core/skbuff.c:4503) [17716.240654] esp6_input (net/ipv6/esp6.c:977) [17716.240666] xfrm_input (net/xfrm/xfrm_input.c:659) [17716.240674] xfrm6_rcv (net/ipv6/xfrm6_input.c:172) [...] Note that one could set CROSS_COMPILE=llvm- instead to hack around this issue. However, doing so can break the decodecode routine as it will force the selection of other LLVM utilities down the line e.g. llvm-as. [1] https://lore.kernel.org/all/20230914131225.13415-3-will@kernel.org/ Link: https://lkml.kernel.org/r/20230929034836.403735-1-cmllamas@google.com Signed-off-by: Carlos Llamas <cmllamas@google.com> Reviewed-by: Nick Desaulniers <ndesaulniers@google.com> Reviewed-by: Elliot Berman <quic_eberman@quicinc.com> Tested-by: Justin Stitt <justinstitt@google.com> Cc: Will Deacon <will@kernel.org> Cc: John Stultz <jstultz@google.com> Cc: Masahiro Yamada <masahiroy@kernel.org> Cc: Nathan Chancellor <nathan@kernel.org> Cc: Tom Rix <trix@redhat.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: yaowenrui <yaowenrui2@huawei.com> | 1 年前 | |
!1982 merge cve-fix-20260727-master into master CVE修复: kernel_linux_5.10 OpenHarmony-7.0-Release (84 个安全补丁) - 2026-07-27 Created-by: provii Commit-by: 姜小林;Xiang Mei;Votokina Victoria;Chengchang Tang;Dmitry Baryshkov;Jason Gunthorpe;Jiexun Wang;Haoze Xie;Ziyi Guo;Minh Nguyen;Ulf Hansson;Wyatt Feng;Yilin Zhu;Mingyu Wang;Weiming Shi;Xin Long;Kuniyuki Iwashima;Linpu Yu;Sven Eckelmann;Florian Westphal;Ruijie Li;Luxiao Xu;Ruide Cao;Zhengchuan Liang;Asim Viladi Oglu Manizada;Cássio Gabriel;Herbert Xu;Li Xiasong;Ido Schimmel;Bart Van Assche;HyungJung Joo;Chaitanya Kulkarni;Michael Bommarito;Johan Hovold;Mingming Cao;Jiri Slaby (SUSE);James Kim;John Johansen;Waqar Hameed;Jinliang Zheng;Anshumali Gaur;Zhiyu Zhang;Sai Ritvik Tanksalkar;Raphael Zimmer;Nan Li;Stephen Smalley;Zhang Yi;Viacheslav Dubeyko;Arjan van de Ven;Mikulas Patocka;Yao Zi Merged-by: openharmony_ci Description: ## OpenHarmony kernel_linux_5.10 安全补丁集合 本 PR 包含 **84 个安全修复补丁**(83 个 CVE + 1 个 OH 内部漏洞),涵盖内核多个子系统的安全漏洞修复。 ### 修复统计 - **总漏洞数**: 90 - **已修复**: 84 (83 CVE + 1 OH 内部漏洞) - **不受影响**: 7 - **修复方式**: - Stable backport: ~63 条 - Mainline backport: ~14 条 - 手动 backport: 6 条 - 冲突解决: 1 条 ### 不受影响的漏洞 (7 条) 以下漏洞在 OH fork 5.10 中不受影响: | CVE ID | 原因 | |--------|------| | CVE-2026-46014 | KVM SVM 是 x86_64 代码,OH fork 目标架构为 ARM64,不会编译 | | CVE-2026-46059 | KVM nSVM 是 x86_64 代码,OH fork 目标架构为 ARM64,不会编译 | | CVE-2026-45894 | iommu/vt-d 是 x86_64 代码,OH fork 目标架构为 ARM64,不会编译 | | CVE-2026-45944 | iommu/vt-d 是 x86_64 代码,OH fork 目标架构为 ARM64,不会编译 | | CVE-2026-46054 | 依赖 security_mmap_backing_file() LSM hook,5.10 内核不存在此基础设施 | | CVE-2026-46311 | OH fork 不含 mes_userqueue.c 文件,AMD GPU 用户队列功能不存在 | | CVE-2026-53091 | OH fork 不含 net/core/gro.h,qdisc_pkt_len_segs_init() 函数不存在 | ### 修复列表 (84 条) | CVE ID | 标题 | Commit | |--------|------|--------| | CVE-2026-46250 | MIPS: Work around LLVM bug when gp is used as global re | a1f4ad886903 | | CVE-2026-46294 | dm: fix a buffer overflow in ioctl processing | 25e6acec358b | | CVE-2026-46276 | drm/amdgpu: fix zero-size GDS range init on RDNA4 | aea02a7e7282 | | CVE-2026-52955 | libceph: Fix potential out-of-bounds access in crush_de | 58f94ca19edc | | CVE-2026-52957 | libceph: Fix potential null-ptr-deref in decode_choose_ | 0c76e6b0c706 | | CVE-2026-52962 | ceph: fix a buffer leak in __ceph_setxattr() | 6c8c98effca9 | | CVE-2026-52946 | fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signa | eb1e0e790827 | | CVE-2026-52948 | i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl | 4e8c98cfcd51 | | CVE-2026-45892 | ext4: drop extent cache when splitting extent fails | 30e71ab92a54 | | CVE-2026-46302 | selinux: allow multiple opens of /sys/fs/selinux/policy | caf9dcaeb5ad | | CVE-2026-52921 | netfilter: ipset: stop hash:* range iteration at end | 0f968e86acd5 | | CVE-2026-52956 | libceph: Fix potential out-of-bounds access in __ceph_x | 710f30aec350 | | CVE-2026-46253 | pstore/ram: fix buffer overflow in persistent_ram_save_ | 19765e41c165 | | CVE-2026-45915 | fat: avoid parent link count underflow in rmdir | a355a522251f | | CVE-2026-46249 | octeontx2-af: Fix PF driver crash with kexec kernel boo | 42ba863ea278 | | CVE-2026-46259 | procfs: fix missing RCU protection when reading real_pa | cb15a689c39b | | CVE-2026-45936 | power: supply: goldfish: Fix use-after-free in power_su | 63bb9ebcbfd5 | | CVE-2026-46270 | power: supply: rt9455: Fix use-after-free in power_supp | 3d22510f2b5f | | CVE-2026-46328 | apparmor: fix rlimit for posix cpu timers | f9a24675e8bb | | CVE-2026-46285 | mtd: docg3: fix use-after-free in docg3_release() | fc2b228e97c3 | | CVE-2026-46307 | wifi: ath5k: do not access array OOB | 787978ed6afa | | CVE-2026-46273 | ibmveth: Disable GSO for packets with small MSS | f46034cf622d | | CVE-2026-46301 | spi: topcliff-pch: fix use-after-free on unbind | e1e63fe6fbb7 | | CVE-2026-46303 | isofs: validate Rock Ridge CE continuation extent again | ed272e9faee0 | | CVE-2026-46304 | nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_fre | 1b9cc047d638 | | CVE-2026-53130 | fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_S | 62e724b4cb1a | | CVE-2026-53128 | drbd: Balance RCU calls in drbd_adm_dump_devices() | 4d6a20f471dc | | CVE-2026-52920 | netfilter: xt_policy: fix strict mode inbound policy ma | 949c206fc387 | | CVE-2026-52925 | vrf: Fix a potential NPD when removing a port from a VR | e0daf72a5dbc | | CVE-2026-52970 | netfilter: nft_ct: fix missing expect put in obj eval | 98ff5892821f | | CVE-2026-52972 | crypto: af_alg - Cap AEAD AD length to 0x80000000 | 3b1670ee65ff | | CVE-2026-52963 | ALSA: usb-audio: Bound MIDI endpoint descriptor scans | 012f7bf5580e | | CVE-2026-46243 | smb: client: reject userspace cifs.spnego descriptions | 7089ba638183 | | CVE-2026-52915 | netfilter: ip6t_hbh: reject oversized option lists | a4c886953981 | | CVE-2026-52914 | batman-adv: fix fragment reassembly length accounting | 84d3aac0df71 | | CVE-2026-52916 | batman-adv: frag: disallow unicast fragment in fragment | 5fb3480f0ee3 | | CVE-2026-52919 | batman-adv: fix tp_meter counter underflow during shutd | 0fb254f48e32 | | CVE-2026-52922 | batman-adv: dat: handle forward allocation error | 6b01de54dedb | | CVE-2026-52926 | batman-adv: clear current gateway during teardown | 9f4ce357a585 | | CVE-2026-52931 | batman-adv: tp_meter: avoid use of uninit sender vars | f503c0a09b33 | | CVE-2026-52927 | netfilter: ebtables: fix OOB read in compat_mtw_from_us | 51ca971056a3 | | CVE-2026-52913 | batman-adv: v: stop OGMv2 on disabled interface | 76a5db529481 | | CVE-2026-52934 | batman-adv: tvlv: reject oversized TVLV packets | bc2424da3859 | | CVE-2026-52923 | ipc: limit next_id allocation to the valid ID range | f529f87d7775 | | CVE-2026-52910 | bpf: Free reuseport cBPF prog after RCU grace period. | bcb8fcfd98be | | CVE-2026-52924 | sctp: purge outqueue on stale COOKIE-ECHO handling | 5d325b2db045 | | CVE-2026-52939 | net/rds: fix NULL deref in rds_ib_send_cqe_handler() on | 3e5aed92d165 | | CVE-2026-52947 | net: qrtr: fix refcount saturation and potential UAF in | 78ad15a32375 | | CVE-2026-52935 | xfrm: espintcp: do not reuse an in-progress partial sen | 387e194263ca | | CVE-2026-52930 | ipc/shm: serialize orphan cleanup with shm_nattch updat | 7aa9cb9d604c | | CVE-2026-52929 | sctp: stream: fully roll back denied add-stream state | 2bf87ac4e2de | | CVE-2026-46292 | pmdomain: core: Fix detach procedure for virtual device | 2ef746fb3c2d | | CVE-2026-52943 | net: skbuff: fix missing zerocopy reference in pskb_car | 8c86f2f17ae7 | | CVE-2026-52909 | ip6_vti: set netns_immutable on the fallback device. | 873ac1b1d077 | | CVE-2026-45923 | net: usb: catc: enable basic endpoint checking | ca0a849ab20d | | CVE-2026-52912 | netfilter: nf_queue: hold bridge skb->dev while queued | 15b6a57b7c78 | | CVE-2026-52918 | Bluetooth: serialize accept_q access | f1baec78b243 | | CVE-2026-46112 | RDMA/hns: Fix unlocked call to hns_roce_qp_remove() | acee5a3275b5 | | CVE-2026-46247 | clk: qcom: gfx3d: add parent to parent request map | ca122689a112 | | CVE-2026-46265 | RDMA/hns: Fix WQ_MEM_RECLAIM warning | 6061b1b261d7 | | CVE-2026-46267 | nfc: hci: shdlc: Stop timers and work before freeing co | b121f7430b62 | | CVE-2026-52942 | netfilter: nf_log: validate MAC header was set before d | 9df75cf1753b | | CVE-2026-45905 | xfrm: fix ip_rt_bug race in icmp_route_lookup reverse p | b8d4c24b996e | | CVE-2026-45940 | net: stmmac: fix oops when split header is enabled | 8e20de0ea434 | | CVE-2026-46299 | hfsplus: fix held lock freed on hfsplus_fill_super() | 2e6b230bdff6 | | CVE-2026-46245 | drm/amd/display: Fix dc_link NULL handling in HPD init | 91ab519b842c | | CVE-2026-52917 | sctp: diag: reject stale associations in dump_one path | f19ddb0620a6 | | CVE-2026-52936 | crypto: jitterentropy - replace long-held spinlock with | 62339b910c40 | | CVE-2026-53129 | fs/mbcache: cancel shrink work before destroying the ca | 07677ffecdb3 | | CVE-2026-46082 | KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 | af5f3bbe2666 | | CVE-2026-46312 | media: videobuf2: Set vma_flags in vb2_dma_sg_mmap | 1174dc5e621e | | CVE-2026-46254 | AppArmor: Allow apparmor to handle unaligned dfa tables | b04e4ca39bcd | | CVE-2026-46266 | inet: RAW sockets using IPPROTO_RAW MUST drop incoming | 2451fbdd15b6 | | CVE-2026-46032 | KVM: nSVM: Triple fault if restore host CR3 fails on ne | 2b4f0b95108c | | CVE-2026-45850 | ipvs: skip ipv6 extension headers for csum checks | 9b51cd577414 | | CVE-2026-45934 | btrfs: fix EEXIST abort due to non-consecutive gaps in | 6f36bbd3e296 | | CVE-2026-45942 | ext4: fix e4b bitmap inconsistency reports | ccfd53f1172b | | CVE-2026-45949 | hwrng: core - use RCU and work_struct to fix race condi | 9a83f3ecf44e | | CVE-2026-45961 | gfs2: fix memory leaks in gfs2_fill_super error path | 400ea67e0ab2 | | CVE-2026-46083 | spi: fix resource leaks on device setup failure | ae5dc9d7472d | | CVE-2026-46252 | regulator: core: fix locking in regulator_resolve_suppl | 79edde319158 | | CVE-2026-46275 | Bluetooth: hci_uart: fix UAFs and race conditions in cl | 54e34bd15d4e | | CVE-2026-52937 | tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR | dda5887b360e | | vul-1082119022692012032 | hmdfs: fix heap OOB read/write in getxattr/listxattr re | 40e552c6f270 | ### 手动 backport 说明 (6 条) 以下漏洞因 OH fork 5.10 与上游代码差异较大,进行了手动 backport: 1. **CVE-2026-45934** (btrfs): mainline +183 -60 行重构 chunk 分配逻辑,适配 5.10 API 2. **CVE-2026-45942** (ext4): mainline folio API 适配为 OH fork page API,添加 PageLocked 检查 3. **CVE-2026-45949** (hwrng): mainline RCU + work_struct 完整重构,适配 5.10 代码结构 4. **CVE-2026-45961** (gfs2): mainline 补丁适配,修复 fill_super 错误路径泄漏 5. **CVE-2026-46083** (spi): mainline 大规模重构改为最小化修复(+1 行 spi_cleanup) 6. **CVE-2026-52937** (tap): mainline 手动 backport(1 行初始化) ### 冲突解决说明 (1 条) - **CVE-2026-46275** (bluetooth): stable cherry-pick 冲突,解决后修复 HCI_UART_PROTO_INIT → HCI_UART_PROTO_SET 适配 ### 编译验证 所有 84 个修复均已通过内核编译验证: - defconfig activate 执行 2 轮(第 2 轮无新增配置) - 内核编译通过(~457 秒) - 所有修改的 .o 文件均已生成 ### 相关 Issue - Issue: #8664 ## 影响模块与手动测试建议 ### 改动模块 | 模块 | 可能影响的手机功能 | 关键路径 | | --- | --- | --- | | Security/Crypto | 安全存储、TLS、签名校验 | crypto/af_alg.c、crypto/jitterentropy-kcapi.c、security/apparmor/match.c、等 5 个文件 | | Power | 充电、电量显示、挂起/恢复 | drivers/base/power/domain.c、drivers/power/supply/goldfish_battery.c、drivers/power/supply/rt9455_charger.c | | Bluetooth | 蓝牙配对、蓝牙音频、文件传输、BLE 外设连接 | drivers/bluetooth/hci_ldisc.c、include/net/bluetooth/bluetooth.h、net/bluetooth/af_bluetooth.c | | Display | 屏幕渲染、亮度、旋转、息屏/亮屏显示 | drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c、drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c | | Camera/Media | 相机预览、录像、编解码播放 | `drivers/media/common/videobuf2/ See merge request: openharmony/kernel_linux_5.10!1982 | 7 天前 | |
!1982 merge cve-fix-20260727-master into master CVE修复: kernel_linux_5.10 OpenHarmony-7.0-Release (84 个安全补丁) - 2026-07-27 Created-by: provii Commit-by: 姜小林;Xiang Mei;Votokina Victoria;Chengchang Tang;Dmitry Baryshkov;Jason Gunthorpe;Jiexun Wang;Haoze Xie;Ziyi Guo;Minh Nguyen;Ulf Hansson;Wyatt Feng;Yilin Zhu;Mingyu Wang;Weiming Shi;Xin Long;Kuniyuki Iwashima;Linpu Yu;Sven Eckelmann;Florian Westphal;Ruijie Li;Luxiao Xu;Ruide Cao;Zhengchuan Liang;Asim Viladi Oglu Manizada;Cássio Gabriel;Herbert Xu;Li Xiasong;Ido Schimmel;Bart Van Assche;HyungJung Joo;Chaitanya Kulkarni;Michael Bommarito;Johan Hovold;Mingming Cao;Jiri Slaby (SUSE);James Kim;John Johansen;Waqar Hameed;Jinliang Zheng;Anshumali Gaur;Zhiyu Zhang;Sai Ritvik Tanksalkar;Raphael Zimmer;Nan Li;Stephen Smalley;Zhang Yi;Viacheslav Dubeyko;Arjan van de Ven;Mikulas Patocka;Yao Zi Merged-by: openharmony_ci Description: ## OpenHarmony kernel_linux_5.10 安全补丁集合 本 PR 包含 **84 个安全修复补丁**(83 个 CVE + 1 个 OH 内部漏洞),涵盖内核多个子系统的安全漏洞修复。 ### 修复统计 - **总漏洞数**: 90 - **已修复**: 84 (83 CVE + 1 OH 内部漏洞) - **不受影响**: 7 - **修复方式**: - Stable backport: ~63 条 - Mainline backport: ~14 条 - 手动 backport: 6 条 - 冲突解决: 1 条 ### 不受影响的漏洞 (7 条) 以下漏洞在 OH fork 5.10 中不受影响: | CVE ID | 原因 | |--------|------| | CVE-2026-46014 | KVM SVM 是 x86_64 代码,OH fork 目标架构为 ARM64,不会编译 | | CVE-2026-46059 | KVM nSVM 是 x86_64 代码,OH fork 目标架构为 ARM64,不会编译 | | CVE-2026-45894 | iommu/vt-d 是 x86_64 代码,OH fork 目标架构为 ARM64,不会编译 | | CVE-2026-45944 | iommu/vt-d 是 x86_64 代码,OH fork 目标架构为 ARM64,不会编译 | | CVE-2026-46054 | 依赖 security_mmap_backing_file() LSM hook,5.10 内核不存在此基础设施 | | CVE-2026-46311 | OH fork 不含 mes_userqueue.c 文件,AMD GPU 用户队列功能不存在 | | CVE-2026-53091 | OH fork 不含 net/core/gro.h,qdisc_pkt_len_segs_init() 函数不存在 | ### 修复列表 (84 条) | CVE ID | 标题 | Commit | |--------|------|--------| | CVE-2026-46250 | MIPS: Work around LLVM bug when gp is used as global re | a1f4ad886903 | | CVE-2026-46294 | dm: fix a buffer overflow in ioctl processing | 25e6acec358b | | CVE-2026-46276 | drm/amdgpu: fix zero-size GDS range init on RDNA4 | aea02a7e7282 | | CVE-2026-52955 | libceph: Fix potential out-of-bounds access in crush_de | 58f94ca19edc | | CVE-2026-52957 | libceph: Fix potential null-ptr-deref in decode_choose_ | 0c76e6b0c706 | | CVE-2026-52962 | ceph: fix a buffer leak in __ceph_setxattr() | 6c8c98effca9 | | CVE-2026-52946 | fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signa | eb1e0e790827 | | CVE-2026-52948 | i2c: dev: prevent integer overflow in I2C_TIMEOUT ioctl | 4e8c98cfcd51 | | CVE-2026-45892 | ext4: drop extent cache when splitting extent fails | 30e71ab92a54 | | CVE-2026-46302 | selinux: allow multiple opens of /sys/fs/selinux/policy | caf9dcaeb5ad | | CVE-2026-52921 | netfilter: ipset: stop hash:* range iteration at end | 0f968e86acd5 | | CVE-2026-52956 | libceph: Fix potential out-of-bounds access in __ceph_x | 710f30aec350 | | CVE-2026-46253 | pstore/ram: fix buffer overflow in persistent_ram_save_ | 19765e41c165 | | CVE-2026-45915 | fat: avoid parent link count underflow in rmdir | a355a522251f | | CVE-2026-46249 | octeontx2-af: Fix PF driver crash with kexec kernel boo | 42ba863ea278 | | CVE-2026-46259 | procfs: fix missing RCU protection when reading real_pa | cb15a689c39b | | CVE-2026-45936 | power: supply: goldfish: Fix use-after-free in power_su | 63bb9ebcbfd5 | | CVE-2026-46270 | power: supply: rt9455: Fix use-after-free in power_supp | 3d22510f2b5f | | CVE-2026-46328 | apparmor: fix rlimit for posix cpu timers | f9a24675e8bb | | CVE-2026-46285 | mtd: docg3: fix use-after-free in docg3_release() | fc2b228e97c3 | | CVE-2026-46307 | wifi: ath5k: do not access array OOB | 787978ed6afa | | CVE-2026-46273 | ibmveth: Disable GSO for packets with small MSS | f46034cf622d | | CVE-2026-46301 | spi: topcliff-pch: fix use-after-free on unbind | e1e63fe6fbb7 | | CVE-2026-46303 | isofs: validate Rock Ridge CE continuation extent again | ed272e9faee0 | | CVE-2026-46304 | nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_fre | 1b9cc047d638 | | CVE-2026-53130 | fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_S | 62e724b4cb1a | | CVE-2026-53128 | drbd: Balance RCU calls in drbd_adm_dump_devices() | 4d6a20f471dc | | CVE-2026-52920 | netfilter: xt_policy: fix strict mode inbound policy ma | 949c206fc387 | | CVE-2026-52925 | vrf: Fix a potential NPD when removing a port from a VR | e0daf72a5dbc | | CVE-2026-52970 | netfilter: nft_ct: fix missing expect put in obj eval | 98ff5892821f | | CVE-2026-52972 | crypto: af_alg - Cap AEAD AD length to 0x80000000 | 3b1670ee65ff | | CVE-2026-52963 | ALSA: usb-audio: Bound MIDI endpoint descriptor scans | 012f7bf5580e | | CVE-2026-46243 | smb: client: reject userspace cifs.spnego descriptions | 7089ba638183 | | CVE-2026-52915 | netfilter: ip6t_hbh: reject oversized option lists | a4c886953981 | | CVE-2026-52914 | batman-adv: fix fragment reassembly length accounting | 84d3aac0df71 | | CVE-2026-52916 | batman-adv: frag: disallow unicast fragment in fragment | 5fb3480f0ee3 | | CVE-2026-52919 | batman-adv: fix tp_meter counter underflow during shutd | 0fb254f48e32 | | CVE-2026-52922 | batman-adv: dat: handle forward allocation error | 6b01de54dedb | | CVE-2026-52926 | batman-adv: clear current gateway during teardown | 9f4ce357a585 | | CVE-2026-52931 | batman-adv: tp_meter: avoid use of uninit sender vars | f503c0a09b33 | | CVE-2026-52927 | netfilter: ebtables: fix OOB read in compat_mtw_from_us | 51ca971056a3 | | CVE-2026-52913 | batman-adv: v: stop OGMv2 on disabled interface | 76a5db529481 | | CVE-2026-52934 | batman-adv: tvlv: reject oversized TVLV packets | bc2424da3859 | | CVE-2026-52923 | ipc: limit next_id allocation to the valid ID range | f529f87d7775 | | CVE-2026-52910 | bpf: Free reuseport cBPF prog after RCU grace period. | bcb8fcfd98be | | CVE-2026-52924 | sctp: purge outqueue on stale COOKIE-ECHO handling | 5d325b2db045 | | CVE-2026-52939 | net/rds: fix NULL deref in rds_ib_send_cqe_handler() on | 3e5aed92d165 | | CVE-2026-52947 | net: qrtr: fix refcount saturation and potential UAF in | 78ad15a32375 | | CVE-2026-52935 | xfrm: espintcp: do not reuse an in-progress partial sen | 387e194263ca | | CVE-2026-52930 | ipc/shm: serialize orphan cleanup with shm_nattch updat | 7aa9cb9d604c | | CVE-2026-52929 | sctp: stream: fully roll back denied add-stream state | 2bf87ac4e2de | | CVE-2026-46292 | pmdomain: core: Fix detach procedure for virtual device | 2ef746fb3c2d | | CVE-2026-52943 | net: skbuff: fix missing zerocopy reference in pskb_car | 8c86f2f17ae7 | | CVE-2026-52909 | ip6_vti: set netns_immutable on the fallback device. | 873ac1b1d077 | | CVE-2026-45923 | net: usb: catc: enable basic endpoint checking | ca0a849ab20d | | CVE-2026-52912 | netfilter: nf_queue: hold bridge skb->dev while queued | 15b6a57b7c78 | | CVE-2026-52918 | Bluetooth: serialize accept_q access | f1baec78b243 | | CVE-2026-46112 | RDMA/hns: Fix unlocked call to hns_roce_qp_remove() | acee5a3275b5 | | CVE-2026-46247 | clk: qcom: gfx3d: add parent to parent request map | ca122689a112 | | CVE-2026-46265 | RDMA/hns: Fix WQ_MEM_RECLAIM warning | 6061b1b261d7 | | CVE-2026-46267 | nfc: hci: shdlc: Stop timers and work before freeing co | b121f7430b62 | | CVE-2026-52942 | netfilter: nf_log: validate MAC header was set before d | 9df75cf1753b | | CVE-2026-45905 | xfrm: fix ip_rt_bug race in icmp_route_lookup reverse p | b8d4c24b996e | | CVE-2026-45940 | net: stmmac: fix oops when split header is enabled | 8e20de0ea434 | | CVE-2026-46299 | hfsplus: fix held lock freed on hfsplus_fill_super() | 2e6b230bdff6 | | CVE-2026-46245 | drm/amd/display: Fix dc_link NULL handling in HPD init | 91ab519b842c | | CVE-2026-52917 | sctp: diag: reject stale associations in dump_one path | f19ddb0620a6 | | CVE-2026-52936 | crypto: jitterentropy - replace long-held spinlock with | 62339b910c40 | | CVE-2026-53129 | fs/mbcache: cancel shrink work before destroying the ca | 07677ffecdb3 | | CVE-2026-46082 | KVM: SVM: Inject #UD for INVLPGA if EFER.SVME=0 | af5f3bbe2666 | | CVE-2026-46312 | media: videobuf2: Set vma_flags in vb2_dma_sg_mmap | 1174dc5e621e | | CVE-2026-46254 | AppArmor: Allow apparmor to handle unaligned dfa tables | b04e4ca39bcd | | CVE-2026-46266 | inet: RAW sockets using IPPROTO_RAW MUST drop incoming | 2451fbdd15b6 | | CVE-2026-46032 | KVM: nSVM: Triple fault if restore host CR3 fails on ne | 2b4f0b95108c | | CVE-2026-45850 | ipvs: skip ipv6 extension headers for csum checks | 9b51cd577414 | | CVE-2026-45934 | btrfs: fix EEXIST abort due to non-consecutive gaps in | 6f36bbd3e296 | | CVE-2026-45942 | ext4: fix e4b bitmap inconsistency reports | ccfd53f1172b | | CVE-2026-45949 | hwrng: core - use RCU and work_struct to fix race condi | 9a83f3ecf44e | | CVE-2026-45961 | gfs2: fix memory leaks in gfs2_fill_super error path | 400ea67e0ab2 | | CVE-2026-46083 | spi: fix resource leaks on device setup failure | ae5dc9d7472d | | CVE-2026-46252 | regulator: core: fix locking in regulator_resolve_suppl | 79edde319158 | | CVE-2026-46275 | Bluetooth: hci_uart: fix UAFs and race conditions in cl | 54e34bd15d4e | | CVE-2026-52937 | tap: fix stack info leak in tap_ioctl() SIOCGIFHWADDR | dda5887b360e | | vul-1082119022692012032 | hmdfs: fix heap OOB read/write in getxattr/listxattr re | 40e552c6f270 | ### 手动 backport 说明 (6 条) 以下漏洞因 OH fork 5.10 与上游代码差异较大,进行了手动 backport: 1. **CVE-2026-45934** (btrfs): mainline +183 -60 行重构 chunk 分配逻辑,适配 5.10 API 2. **CVE-2026-45942** (ext4): mainline folio API 适配为 OH fork page API,添加 PageLocked 检查 3. **CVE-2026-45949** (hwrng): mainline RCU + work_struct 完整重构,适配 5.10 代码结构 4. **CVE-2026-45961** (gfs2): mainline 补丁适配,修复 fill_super 错误路径泄漏 5. **CVE-2026-46083** (spi): mainline 大规模重构改为最小化修复(+1 行 spi_cleanup) 6. **CVE-2026-52937** (tap): mainline 手动 backport(1 行初始化) ### 冲突解决说明 (1 条) - **CVE-2026-46275** (bluetooth): stable cherry-pick 冲突,解决后修复 HCI_UART_PROTO_INIT → HCI_UART_PROTO_SET 适配 ### 编译验证 所有 84 个修复均已通过内核编译验证: - defconfig activate 执行 2 轮(第 2 轮无新增配置) - 内核编译通过(~457 秒) - 所有修改的 .o 文件均已生成 ### 相关 Issue - Issue: #8664 ## 影响模块与手动测试建议 ### 改动模块 | 模块 | 可能影响的手机功能 | 关键路径 | | --- | --- | --- | | Security/Crypto | 安全存储、TLS、签名校验 | crypto/af_alg.c、crypto/jitterentropy-kcapi.c、security/apparmor/match.c、等 5 个文件 | | Power | 充电、电量显示、挂起/恢复 | drivers/base/power/domain.c、drivers/power/supply/goldfish_battery.c、drivers/power/supply/rt9455_charger.c | | Bluetooth | 蓝牙配对、蓝牙音频、文件传输、BLE 外设连接 | drivers/bluetooth/hci_ldisc.c、include/net/bluetooth/bluetooth.h、net/bluetooth/af_bluetooth.c | | Display | 屏幕渲染、亮度、旋转、息屏/亮屏显示 | drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c、drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c | | Camera/Media | 相机预览、录像、编解码播放 | `drivers/media/common/videobuf2/ See merge request: openharmony/kernel_linux_5.10!1982 | 7 天前 | |
pm: cpupower: bench: Prevent NULL dereference on malloc failure stable inclusion from stable-v5.10.237 commit 79bded9d70142d2a11d931fc029afece471641db category: bugfix issue: #ICF8GA CVE: CVE-2025-37841 Signed-off-by: Tengda Wu <wutengda2@huawei.com> --------------------------------------- [ Upstream commit 208baa3ec9043a664d9acfb8174b332e6b17fb69 ] If malloc returns NULL due to low memory, 'config' pointer can be NULL. Add a check to prevent NULL dereference. Link: https://lore.kernel.org/r/20250219122715.3892223-1-quic_zhonhan@quicinc.com Signed-off-by: Zhongqiu Han <quic_zhonhan@quicinc.com> Signed-off-by: Shuah Khan <skhan@linuxfoundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org> | 1 年前 | |
usr/include/Makefile: add linux/nfc.h to the compile-test coverage stable inclusion from stable-5.10.96 commit 8bae6db29c7f2d0452bf721d6c6b8cf28b6eee35 category: bugfix issue: #I4UU4A CVE: NA Signed-off-by: Wenfei <wenfei9@huawei.com> --------------------------------------- commit 10756dc5b02bff370ddd351d7744bc99ada659c2 upstream. As linux/nfc.h userspace compilation was finally fixed by commits 79b69a83705e ("nfc: uapi: use kernel size_t to fix user-space builds") and 7175f02c4e5f ("uapi: fix linux/nfc.h userspace compilation errors"), there is no need to keep the compile-test exception for it in usr/include/Makefile. Signed-off-by: Dmitry V. Levin <ldv@altlinux.org> Signed-off-by: Masahiro Yamada <masahiroy@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: wenfei <wenfei9@huawei.com> | 3 年前 | |
KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying mainline inclusion from mainline-6.6.134 commit 8618004d3e897c0f1b71d9a9ab860461289bb89a category: bugfix issue: 8663 CVE: CVE-2026-53345 Signed-off-by: wanghao794 <wanghao865@huawei.com> Co-Authored-By: Agent ------------------------------- KVM: Don't WARN if memory is dirtied without a vCPU when the VM is dying When marking a page dirty, complain about not having a running/loaded vCPU if and only if the VM is still alive, i.e. its refcount is non-zero. This will allow fixing a memory leak for x86 SEV-ES guests without hitting what is effectively a false positive on the WARN. For some SEV-ES VM-Exits, KVM keeps a writable mapping of a guest page across an exit to userspace, and typically unmaps the page on the next KVM_RUN. But if userspace never calls KVM_RUN after such an exit, then KVM needs to unmap the page when the vCPU is destroyed, which in turn triggers the WARN about not having a running vCPU. Alternatively, SEV-ES could temporarily load the vCPU to suppress the WARN, as is done in nested_vmx_free_vcpu() (but for completely unrelated reasons; suppressing WARN from nested_put_vmcs12_pages() is pure happenstance). But loading a vCPU during destruction is gross (ideally nVMX code would be cleaned up), risks complicating the SEV-ES code (KVM would need to ensure the temporarily load()+put() only runs when the vCPU isn't already loaded), and is ultimately pointless. The motivation for the WARN is to guard against KVM dirtying guest memory without pushing the corresponding GFN to the active vCPU's dirty ring, e.g. to ensure userspace doesn't miss a dirty page. But for the VM's refcount to reach zero, there can't be _any_ userspace mappings to the dirty ring, as mapping the dirty ring requires doing mmap() on the vCPU FD. I.e. if userspace had a valid mapping for the dirty ring, then the vCPU file and thus the owning VM would still be alive. And so since userspace can't possibly reach the dirty ring, whether or not KVM technically "misses" a push to the dirty ring is irrelevant. Reported-by: Michael Roth <michael.roth@amd.com> Cc: stable@vger.kernel.org Reviewed-by: Michael Roth <michael.roth@amd.com> Original-signoff: Sean Christopherson <seanjc@google.com> Message-ID: <20260501202250.2115252-15-seanjc@google.com> Original-signoff: Paolo Bonzini <pbonzini@redhat.com> Message-ID: <20260529183549.1104619-15-pbonzini@redhat.com> Original-signoff: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: wanghao794 <wanghao865@huawei.com> | 13 天前 | |
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma updates from Jason Gunthorpe: "A usual cycle for RDMA with a typical mix of driver and core subsystem updates: - Driver minor changes and bug fixes for mlx5, efa, rxe, vmw_pvrdma, hns, usnic, qib, qedr, cxgb4, hns, bnxt_re - Various rtrs fixes and updates - Bug fix for mlx4 CM emulation for virtualization scenarios where MRA wasn't working right - Use tracepoints instead of pr_debug in the CM code - Scrub the locking in ucma and cma to close more syzkaller bugs - Use tasklet_setup in the subsystem - Revert the idea that 'destroy' operations are not allowed to fail at the driver level. This proved unworkable from a HW perspective. - Revise how the umem API works so drivers make fewer mistakes using it - XRC support for qedr - Convert uverbs objects RWQ and MW to new the allocation scheme - Large queue entry sizes for hns - Use hmm_range_fault() for mlx5 On Demand Paging - uverbs APIs to inspect the GID table instead of sysfs - Move some of the RDMA code for building large page SGLs into lib/scatterlist" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (191 commits) RDMA/ucma: Fix use after free in destroy id flow RDMA/rxe: Handle skb_clone() failure in rxe_recv.c RDMA/rxe: Move the definitions for rxe_av.network_type to uAPI RDMA: Explicitly pass in the dma_device to ib_register_device lib/scatterlist: Do not limit max_segment to PAGE_ALIGNED values IB/mlx4: Convert rej_tmout radix-tree to XArray RDMA/rxe: Fix bug rejecting all multicast packets RDMA/rxe: Fix skb lifetime in rxe_rcv_mcast_pkt() RDMA/rxe: Remove duplicate entries in struct rxe_mr IB/hfi,rdmavt,qib,opa_vnic: Update MAINTAINERS IB/rdmavt: Fix sizeof mismatch MAINTAINERS: CISCO VIC LOW LATENCY NIC DRIVER RDMA/bnxt_re: Fix sizeof mismatch for allocation of pbl_tbl. RDMA/bnxt_re: Use rdma_umem_for_each_dma_block() RDMA/umem: Move to allocate SG table from pages lib/scatterlist: Add support in dynamic allocation of SG table from pages tools/testing/scatterlist: Show errors in human readable form tools/testing/scatterlist: Rejuvenate bit-rotten test RDMA/ipoib: Set rtnl_link_ops for ipoib interfaces RDMA/uverbs: Expose the new GID query API to user space ... | 5 年前 | |
scripts: add Linux .cocciconfig for coccinelle Coccinelle supports reading .cocciconfig, the order of precedence for variables for .cocciconfig is as follows: o Your current user's home directory is processed first o Your directory from which spatch is called is processed next o The directory provided with the --dir option is processed last, if used Since coccicheck runs through make, it naturally runs from the kernel proper dir, as such the second rule above would be implied for picking up a .cocciconfig when using 'make coccicheck'. 'make coccicheck' also supports using M= targets.If you do not supply any M= target, it is assumed you want to target the entire kernel. The kernel coccicheck script has: if [ "$KBUILD_EXTMOD" = "" ] ; then OPTIONS="--dir $srctree $COCCIINCLUDE" else OPTIONS="--dir $KBUILD_EXTMOD $COCCIINCLUDE" fi KBUILD_EXTMOD is set when an explicit target with M= is used. For both cases the spatch --dir argument is used, as such third rule applies when whether M= is used or not, and when M= is used the target directory can have its own .cocciconfig file. When M= is not passed as an argument to coccicheck the target directory is the same as the directory from where spatch was called. If not using the kernel's coccicheck target, keep the above precedence order logic of .cocciconfig reading. If using the kernel's coccicheck target, override any of the kernel's .coccicheck's settings using SPFLAGS. We help Coccinelle when used against Linux with a set of sensible defaults options for Linux with our own Linux .cocciconfig. This hints to coccinelle git can be used for 'git grep' queries over coccigrep. A timeout of 200 seconds should suffice for now. The options picked up by coccinelle when reading a .cocciconfig do not appear as arguments to spatch processes running on your system, to confirm what options will be used by Coccinelle run: spatch --print-options-only You can override with your own preferred index option by using SPFLAGS. Coccinelle supports both glimpse and idutils. Glimpse had historically provided the best performance, however recent benchmarks reveal idutils is performing just as well. Due to some recent fixes however you however will need at least coccinelle >= 1.0.6 if using idutils. Coccinelle carries a script scripts/idutils_index.sh which creates the idutils database with as follows: mkid -i C --output .id-utils.index If using just "--use-idutils" coccinelle expects your idutils database to be on the top level of the kernel as a file named ".id-utils.index". If you do not use this you can symlink your database file to it, or you can specify the database file following the "--use-idutils" argument. Examples: make SPFLAGS=--use-idutils coccicheck This assumes you have $srctree/.id-utils.index, where $srctree is the top level of the kernel. make SPFLAGS="--use-idutils /full-path/to/ID" coccicheck Here you specify the full path of the idutils ID database. Using .cocciconfig is possible, however given the order of precedence followed by Coccinelle, and since the kernel now carries its own .cocciconfig, you will need to use SPFLAGS to use idutils if desired. v4: o Recommend upgrade for using idutils with coccinelle due to some recent fixes. o Refer to using --print-options-only for testing what options are picked up by .cocciconfig reading. o Expand commit log considerably explaining *why* .cocconfig from two precedence rules are used when using coccicheck, and how to properly override these if needed. o Expand Documentation/coccinelle.txt v3: Expand commit log a bit more Signed-off-by: Luis R. Rodriguez <mcgrof@kernel.org> Acked-by: Julia Lawall <julia.lawall@lip6.fr> Signed-off-by: Michal Marek <mmarek@suse.com> | 9 年前 | |
Opt out of scripts/get_maintainer.pl A few months ago, I submitted a trivial arm64 defconfig update. get_maintainer.pl now outputs my address for every defconfig tweak. Add me to .get_maintainer.ignore to opt out of these notifications. Signed-off-by: Marc Gonzalez <marc.w.gonzalez@free.fr> Signed-off-by: Olof Johansson <olof@lixom.net> | 7 年前 | |
.gitattributes: use 'dts' diff driver for dts files Git is gaining support to display the closest node to the diff in the hunk header via the 'dts' diff driver. Use that driver for all dts and dtsi files so we can gain some more context on where the diff is. Taking a recent commit in the kernel dts files you can see the difference. With this patch and an updated git : diff --git a/arch/arm64/boot/dts/nvidia/tegra194-p2888.dtsi b/arch/arm64/boot/dts/nvidia/tegra194-p2888.dtsi : index 62e07e1197cc..4c38426a6969 100644 : --- a/arch/arm64/boot/dts/nvidia/tegra194-p2888.dtsi : +++ b/arch/arm64/boot/dts/nvidia/tegra194-p2888.dtsi : @@ -289,5 +289,29 @@ vdd_hdmi: regulator@1 { : gpio = <&gpio TEGRA194_MAIN_GPIO(A, 3) GPIO_ACTIVE_HIGH>; : enable-active-high; : }; : + : + vdd_3v3_pcie: regulator@2 { : + compatible = "regulator-fixed"; vs. without this patch : diff --git a/arch/arm64/boot/dts/nvidia/tegra194-p2888.dtsi b/arch/arm64/boot/dts/nvidia/tegra194-p2888.dtsi : index 62e07e1197cc..4c38426a6969 100644 : --- a/arch/arm64/boot/dts/nvidia/tegra194-p2888.dtsi : +++ b/arch/arm64/boot/dts/nvidia/tegra194-p2888.dtsi : @@ -289,5 +289,29 @@ : gpio = <&gpio TEGRA194_MAIN_GPIO(A, 3) GPIO_ACTIVE_HIGH>; : enable-active-high; : }; : + : + vdd_3v3_pcie: regulator@2 { : + compatible = "regulator-fixed"; You can see that we don't know what the context node is because it isn't shown after the '@@'. dts is not released yet but it is staged to be in the next release[1]. One can probably build git from source and try it out. [1] https://git.kernel.org/pub/scm/git/git.git/commit/?id=d49c2c3466d2c8cb0b3d0a43e6b406b07078fdb1 Link: http://lkml.kernel.org/r/20191004212311.141538-1-swboyd@chromium.org Signed-off-by: Stephen Boyd <swboyd@chromium.org> Cc: Rob Herring <robh+dt@kernel.org> Cc: Randy Dunlap <rdunlap@infradead.org> Acked-by: Frank Rowand <frowand.list@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | 6 年前 | |
Revert "回退 'Pull Request !1416 : 支持 LoongArch 架构'" This reverts commit 9c568aeb94e2a381b3883dc8d1e865c461229ad8. Signed-off-by: Xiaotian Wu <wuxiaotian@loongson.cn> | 1 年前 | |
mailmap: add two more addresses of Uwe Kleine-König This fixes attribution for the commits (among others) - d4097456cd1d ("video/framebuffer: move the probe func into .devinit.text in Blackfin LCD driver") - 0312e024d6cd ("mfd: mc13xxx: Add support for mc34708") Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Link: https://lkml.kernel.org/r/20201127213358.3440830-1-u.kleine-koenig@pengutronix.de Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | 5 年前 | |
COPYING: state that all contributions really are covered by this file Explicitly state that all contributions to the kernel source tree really are covered under this COPYING file in case someone thought otherwise. Lawyers love to be pedantic, even more so than software engineers at times, and this sentence makes them sleep easier. Reviewed-by: Thomas Gleixner <tglx@linutronix.de> Acked-by: Gustavo A. R. Silva <gustavo@embeddedor.com> Link: https://lore.kernel.org/r/20200206154800.GA3754085@kroah.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 6 年前 | |
MAINTAINERS: Move Jason Cooper to CREDITS Jason's email address has now been bouncing for weeks, and no reply was received when trying to reach out on other addresses. We really hope he is OK. But until we hear of his whereabouts, let's move him to the CREDITS file so that people stop Cc-ing him. Signed-off-by: Marc Zyngier <maz@kernel.org> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Acked-by: Gregory CLEMENT <gregory.clement@bootlin.com> Acked-by: Andrew Lunn <andrew@lunn.ch> Link: https://lore.kernel.org/r/20201128103707.332874-1-maz@kernel.org | 5 年前 | |
kbuild: rename hostprogs-y/always to hostprogs/always-y In old days, the "host-progs" syntax was used for specifying host programs. It was renamed to the current "hostprogs-y" in 2004. It is typically useful in scripts/Makefile because it allows Kbuild to selectively compile host programs based on the kernel configuration. This commit renames like follows: always -> always-y hostprogs-y -> hostprogs So, scripts/Makefile will look like this: always-$(CONFIG_BUILD_BIN2C) += ... always-$(CONFIG_KALLSYMS) += ... ... hostprogs := $(always-y) $(always-m) I think this makes more sense because a host program is always a host program, irrespective of the kernel configuration. We want to specify which ones to compile by CONFIG options, so always-y will be handier. The "always", "hostprogs-y", "hostprogs-m" will be kept for backward compatibility for a while. Signed-off-by: Masahiro Yamada <masahiroy@kernel.org> | 6 年前 | |
kbuild: compile vendor in kernel ohos inclusion category: feature issue:I60AG7 CVE: NO Signed-off-by: gaochao <gaochao49@huawei.com> --------------------------------------- Kconfig and Makefile : add vendor directory in kernel scripts : solve build error when vendor is not exist | 3 年前 | |
Revert "回退 'Pull Request !1416 : 支持 LoongArch 架构'" This reverts commit 9c568aeb94e2a381b3883dc8d1e865c461229ad8. Signed-off-by: Xiaotian Wu <wuxiaotian@loongson.cn> | 1 年前 | |
Linux 5.10.210 stable inclusion from stable-5.10.210^0 commit aa6ca808a46767ba80d92d79d5cfd308f4d71b73 category: bugfix issue: #IAOD4C CVE: NA Signed-off-by: yaowenrui <yaowenrui2@huawei.com> --------------------------------------- Link: https://lore.kernel.org/r/20240221125954.917878865@linuxfoundation.org Tested-by: Jon Hunter <jonathanh@nvidia.com> Tested-by: Florian Fainelli <florian.fainelli@broadcom.com> Tested-by: kernelci.org bot <bot@kernelci.org> Tested-by: Salvatore Bonaccorso <carnil@debian.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: yaowenrui <yaowenrui2@huawei.com> | 1 年前 | |
Fix: binary file copyright alarm Signed-off-by: wanxiaoqing <wanxiaoqing@huawei.com> | 2 年前 | |
Document: add guideline to submitting patches to OpenHarmony kernel ohos inclusion category: doc issue: #I3ZXZF CVE: NA We need to document our rules of submitting patches to OpenHarmony, it contains the basic step of submitting patches, and unified patch format. This guideline is important for OpenHarmony daily works, so I prefer to place it into kernel root directory, it would be easy to access and reference it. Signed-off-by: Xie XiuQi <xiexiuqi@huawei.com> Signed-off-by: Hanjun Guo <guohanjun@huawei.com> [add ohos patch template and tips for developers] Signed-off-by: Yu Changchun <yuchangchun1@huawei.com> | 4 年前 | |
Kernel Version UPdate: v5.10.209=>v5.10.210 Signed-off-by: yaowenrui <yaowenrui2@huawei.com> | 1 年前 |
向 OpenHarmony Linux 内核项目贡献代码
签署 DCO
在向 OpenHarmony 内核提交任何贡献之前,您必须签署 DCO。
请参阅: https://dco.openharmony.io/sign-dco
提交补丁的步骤
1. 成功编译并测试您的补丁
您应在 OpenHarmony 支持的开发板(如 hi3516dv300 等)上测试您的补丁。
2. 生成补丁
您的补丁应以 OpenHarmony 最新分支为基础,并使用 git-format-patch 生成。如果是补丁集,建议使用 --cover-letter 选项来描述补丁集的作用。
使用 scripts/checkpatch.pl 确保不存在代码风格问题。
并确保您的补丁遵循以下统一的 OpenHarmony 补丁格式。
提示:了解更多关于 Linux 内核编码风格 英文: https://gitee.com/openharmony/kernel_linux/blob/master/Documentation/process/coding-style.rst 中文: https://gitee.com/openharmony/kernel_linux/blob/master/Documentation/translations/zh_CN/coding-style.rst
3. 将补丁发送至 OpenHarmony 邮件列表
使用以下命令将补丁发送至 OpenHarmony 内核邮件列表:
git send-email *.patch -to="kernel@openharmony.io" --suppress-cc=all
注意:如果您使用 git send-email,必须添加 --suppress-cc=all 选项,否则邮件将抄送上游社区和邮件列表中的人员。
提示:订阅邮件列表 https://lists.openatom.io/postorius/lists/kernel.openharmony.io/
请参阅:如何使用 git-send-email 发送补丁 https://git-scm.com/docs/git-send-email
4. 如果您要发送多个版本的补丁,请在补丁主题中标记“v1, v2, v3 ...”
使用 --subject-prefix="PATCH v2" 选项为补丁集添加 v2 标签: git format-patch --subject-prefix="PATCH v2" -1
主题示例: Subject: [PATCH v2 01/27] fork: fix some -Wmissing-prototypes warnings Subject: [PATCH v3] ext2: improve scalability of bitmap searching
5. 强烈建议将您的内核补丁提交至内核社区上游
OpenHarmony 将及时与内核主线代码同步。
6. 签署您的工作——开发者原创声明(Developer's Certificate of Origin)
与上游内核社区相同,您也需要签署您的补丁。
请参阅: https://www.kernel.org/doc/html/latest/process/submitting-patches.html
签署行是补丁说明末尾的一行简单文字,用以证明您是该补丁的作者,或者有权将其作为开源补丁提交。规则非常简单:如果您能证明以下内容:
开发者原创声明 1.1
通过对本项目做出贡献,本人证明:
(a) 此贡献全部或部分由本人创作,并且本人有权根据文件中指明的开源许可进行提交;或者
(b) 此贡献基于本人所知的先前工作,该工作受适当的开源许可保护,并且本人有权根据该许可(除非允许在不同许可下提交)将全部或部分由本人修改的该工作,按照文件中指明的相同开源许可进行提交;或者
(c) 此贡献由其他个人直接提供给本人,该个人已证明其符合 (a)、(b) 或 (c),且本人未对其进行修改。
(d) 本人理解并同意本项目及本贡献均为公开内容,且本贡献的记录(包括本人提交的所有个人信息,包括本人的签署)将被永久保存,并可根据本项目或所涉及的开源许可进行再分发。
那么您只需添加如下一行:
Signed-off-by: Random J Developer <random@developer.example.org>
请使用您的真实姓名(抱歉,不接受笔名或匿名贡献)。
使用统一补丁格式
原因:
-
长期可维护性 OpenHarmony 将合并大量补丁。如果所有补丁都以随意的变更日志格式合并,没有统一的格式,git 日志将会变得混乱,进而难以找到原始补丁。
-
内核升级 未来我们肯定会升级 OpenHarmony 内核,采用严格的补丁管理将减轻重大升级过程中迁移补丁的难度。
-
便于脚本解析 关键字高亮对于脚本解析是必要的。
补丁格式定义
[M] 代表“必填” [O] 代表“可选” $category 可以是:bug preparation、bugfix、perf、feature、doc、other...
如果类别是 feature,则还需要添加特性名称,如下所示: category: feature feature: YYY (特性名称)
如果补丁与 CVE 或 issue/bugzilla 相关,则需要添加相应的标签,如下所示(通常,至少应包含以下之一): CVE: $cve-id 或 NA issue: $issue-id 或 NA bugzilla: $bug-id 或 NA
issue: https://gitee.com/openharmony/kernel_linux/issues
附加变更日志应至少包含以下之一: 1) 为什么我们应该应用此补丁 2) 此补丁解决了产品中的什么实际问题 3) 如何复现此 bug 或如何测试 4) 其他有助于理解此补丁或问题的有用信息
详细信息对于将补丁移植到另一个内核分支非常有用。
-
稳定版补丁 stable inclusion [M] from $stable-version [M] commit $id [M] bugzilla: $bug-id [O] issue: $issue-id [O] CVE: $cve-id [O]
additional changelog [O]
original changelog
Signed-off-by: yourname<your_name <yourname<your_mail> [M]
($stable-version 可以是 stable-4.19.156、stable-4.19.157 等…… $id 是稳定版提交 ID)
-
主线补丁:
mainline inclusion [M] from $mainline-version [M] commit $id [M] category: $category [M] bugzilla: $bug-id [O] issue: $issue-id [O] CVE: $cve-id [O]
additional changelog [O]
original changelog
Signed-off-by: yourname<your_name <yourname<your_mail> [M]
($mainline-version 可以是 mainline-5.6、mainline-5.10 等…… $id 是主线提交 ID)
-
ohos 补丁 ohos inclusion [M] category: $category [M] bugzilla: $bug-id or NA [O] issue: $issue-id or NA [O] CVE: $cve-id or NA [O]
changelog
Signed-off-by: yourname<your_name <yourname<your_mail> [M]
示例
主线合入 源自主线-4.10 提交 0becc0ae5b42828785b589f686725ff5bc3b9b25 类别:错误修复 问题编号:1000 CVE:不适用
此补丁修复了产品中的一个 BUG_ON 问题:在系统启动前使用硬件注入工具向内存注入单比特 ECC 错误,这会导致系统启动期间出现大量 CMCI。
[ 1.146580] mce: [硬件错误]:已记录机器检查事件 [ 1.152908] ------------[ 在此处剪切 ]------------ [ 1.157751] kernel BUG at kernel/timer.c:951! [ 1.162321] invalid opcode: 0000 [#1] SMP ...
原始变更日志
Signed-off-by: Zhang San Tested-by: Li Si电子邮件客户端 - Thunderbird 设置
如果您是内核社区的新开发人员,强烈建议使用 Thunderbird 邮件客户端。
-
Thunderbird 安装 从 http://www.mozilla.org/ 获取英文版 Thunderbird 并在您的系统上安装。
-
设置 2.1 使用纯文本格式而非 HTML 格式 选项 -> 账户设置 -> 撰写与地址,不要 勾选“以 HTML 格式撰写消息”。
2.2 编辑器设置 工具 -> 选项 -> 高级 -> 配置编辑器。
- 调出 Thunderbird 的注册表编辑器,并设置: “mailnews.send_plaintext_flowed” 为 “false”。 - 禁用 HTML 格式:将 “mail.identity.id1.compose_html” 设置为 “false”。 - 启用 UTF8:将 “prefs.converted-to-utf8” 设置为 “true”。 - 以 UTF-8 查看消息:将 “mailnews.view_default_charset” 设置为 “UTF-8”。 - 将 mailnews.wraplength 设置为 9999 以避免自动换行
Linux 内核
有多个面向内核开发人员和用户的指南。这些指南可以以多种格式呈现,如 HTML 和 PDF。请首先阅读 Documentation/admin-guide/README.rst。
要构建文档,请使用 make htmldocs 或 make pdfdocs。格式化的文档也可以在线阅读:
https://www.kernel.org/doc/html/latest/
Documentation/ 子目录中有各种文本文件,其中有几个使用了 reStructured Text 标记符号。
请阅读 Documentation/process/changes.rst 文件,其中包含构建和运行内核的要求,以及升级内核可能导致的问题的相关信息。