| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
accel/qaic: Mask out SR-IOV PCI resources stable inclusion from stable-6.6.93 commit a21971b4be60f72cda93952fdaee6f84cdb48dc0 category: bugfix issue: #ICCW0G CVE: NA Signed-off-by: Li Nan <linan122@huawei.com> --------------------------------------- [ Upstream commit 8685520474bfc0fe4be83c3cbfe3fb3e1ca1514a ] During the initialization of the qaic device, pci_select_bars() is used to fetch a bitmask of the BARs exposed by the device. On devices that have Virtual Functions capabilities, the bitmask includes SR-IOV BARs. Use a mask to filter out SR-IOV BARs if they exist. Signed-off-by: Youssef Samir <quic_yabdulra@quicinc.com> Reviewed-by: Jeffrey Hugo <quic_jhugo@quicinc.com> Signed-off-by: Jeffrey Hugo <quic_jhugo@quicinc.com> Reviewed-by: Lizhi Hou <lizhi.hou@amd.com> Link: https://patchwork.freedesktop.org/patch/msgid/20250117170943.2643280-6-quic_jhugo@quicinc.com Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Li Nan <linan122@huawei.com> | 1 年前 | |
speakup: Avoid crash on very long word stable inclusion from stable-6.6.105 commit c8d2f34ea96ea category: bugfix issue: #207 CVE: CVE-2024-26994 Signed-off-by: 何京晶 <18967138853@163.com> Co-Authored-By: Agent ------------------------------- speakup: Avoid crash on very long word In case a console is set up really large and contains a really long word (> 256 characters), we have to stop before the length of the word buffer. Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Fixes: c6e3fd22cd538 ("Staging: add speakup to the staging directory") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20240323164843.1426997-1-samuel.thibault@ens-lyon.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: 何京晶 <18967138853@163.com> | 5 个月前 | |
drivers: accesstokenid validate ioctl command In access_tokenid_ioctl(), dispatch is now gated by the ioctl command table before calling the handler. Signed-off-by: xia-bubai <xiacong5@huawei.com> AI[0%] Human Fixed[0%] Human[100%] AI Adopted[0%] Change-Id: Id0ce668c40c167ba93955cc5e0e2a6c8d995e6df | 27 天前 | |
ACPICA: Avoid walking the Namespace if start_node is NULL stable inclusion from stable-6.6.105 commit 9d6c58dae8f6 category: bugfix issue: #223 CVE: CVE-2025-71118 Signed-off-by: zxl <1554188414@qq.com> ------------------------------- ACPICA: Avoid walking the Namespace if start_node is NULL Although commit 0c9992315e73 ("ACPICA: Avoid walking the ACPI Namespace if it is not there") fixed the situation when both start_node and acpi_gbl_root_node are NULL, the Linux kernel mainline now still crashed on Honor Magicbook 14 Pro [1]. That happens due to the access to the member of parent_node in acpi_ns_get_next_node(). The NULL pointer dereference will always happen, no matter whether or not the start_node is equal to ACPI_ROOT_OBJECT, so move the check of start_node being NULL out of the if block. Unfortunately, all the attempts to contact Honor have failed, they refused to provide any technical support for Linux. The bad DSDT table's dump could be found on GitHub [2]. DMI: HONOR FMB-P/FMB-P-PCB, BIOS 1.13 05/08/2025 Link: https://github.com/acpica/acpica/commit/1c1b57b9eba4554cb132ee658dd942c0210ed20d Link: https://gist.github.com/Cryolitia/a860ffc97437dcd2cd988371d5b73ed7 [1] Link: https://github.com/denis-bb/honor-fmb-p-dsdt [2] Signed-off-by: Cryolitia PukNgae <cryolitia.pukngae@linux.dev> Reviewed-by: WangYuli <wangyl5933@chinaunicom.cn> [ rjw: Subject adjustment, changelog edits ] Link: https://patch.msgid.link/20251125-acpica-v1-1-99e63b1b25f8@linux.dev Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Signed-off-by: zxl <1554188414@qq.com> | 5 个月前 | |
amba: bus: fix refcount leak commit 5de1540b7bc4 ("drivers/amba: create devices from device tree") increases the refcount of of_node, but not releases it in amba_device_release, so there is refcount leak. By using of_node_put to avoid refcount leak. Fixes: 5de1540b7bc4 ("drivers/amba: create devices from device tree") Signed-off-by: Peng Fan <peng.fan@nxp.com> Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://lore.kernel.org/r/20230821023928.3324283-1-peng.fan@oss.nxp.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2 年前 | |
binder: fix UAF caused by offsets overwrite stable inclusion from stable-6.6.51 commit 1f33d9f1d9ac3f0129f8508925000900c2fe5bb0 category: bugfix issue: #IB7W7N CVE: NA Signed-off-by: zhangshuqi <zhangshuqi3@huawei.com> --------------------------------------- commit 4df153652cc46545722879415937582028c18af5 upstream. Binder objects are processed and copied individually into the target buffer during transactions. Any raw data in-between these objects is copied as well. However, this raw data copy lacks an out-of-bounds check. If the raw data exceeds the data section size then the copy overwrites the offsets section. This eventually triggers an error that attempts to unwind the processed objects. However, at this point the offsets used to index these objects are now corrupted. Unwinding with corrupted offsets can result in decrements of arbitrary nodes and lead to their premature release. Other users of such nodes are left with a dangling pointer triggering a use-after-free. This issue is made evident by the following KASAN report (trimmed): ================================================================== BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x19c Write of size 4 at addr ffff47fc91598f04 by task binder-util/743 CPU: 9 UID: 0 PID: 743 Comm: binder-util Not tainted 6.11.0-rc4 #1 Hardware name: linux,dummy-virt (DT) Call trace: _raw_spin_lock+0xe4/0x19c binder_free_buf+0x128/0x434 binder_thread_write+0x8a4/0x3260 binder_ioctl+0x18f0/0x258c [...] Allocated by task 743: __kmalloc_cache_noprof+0x110/0x270 binder_new_node+0x50/0x700 binder_transaction+0x413c/0x6da8 binder_thread_write+0x978/0x3260 binder_ioctl+0x18f0/0x258c [...] Freed by task 745: kfree+0xbc/0x208 binder_thread_read+0x1c5c/0x37d4 binder_ioctl+0x16d8/0x258c [...] ================================================================== To avoid this issue, let's check that the raw data copy is within the boundaries of the data section. Fixes: 6d98eb95b450 ("binder: avoid potential data leakage when copying txn") Cc: Todd Kjos <tkjos@google.com> Cc: stable@vger.kernel.org Signed-off-by: Carlos Llamas <cmllamas@google.com> Link: https://lore.kernel.org/r/20240822182353.2129600-1-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: zhangshuqi <zhangshuqi3@huawei.com> | 1 年前 | |
ata: pata_cs5536: fix build on 32-bit UML stable inclusion from stable-6.6.97 commit 69283b3fd463edb3001c32242a2dde3b00dd8756 category: bugfix issue: #ICCW0G CVE: NA Signed-off-by: Li Nan <linan122@huawei.com> --------------------------------------- [ Upstream commit fe5b391fc56f77cf3c22a9dd4f0ce20db0e3533f ] On 32-bit ARCH=um, CONFIG_X86_32 is still defined, so it doesn't indicate building on real X86 machines. There's no MSR on UML though, so add a check for CONFIG_X86. Reported-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Johannes Berg <johannes.berg@intel.com> Link: https://lore.kernel.org/r/20250606090110.15784-2-johannes@sipsolutions.net Signed-off-by: Niklas Cassel <cassel@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Li Nan <linan122@huawei.com> | 1 年前 | |
atm/fore200e: Fix possible data race in fore200e_open() stable inclusion from stable-6.6.105 commit 82fca3d8a4a34 category: bugfix issue: #207 CVE: CVE-2025-68339 Signed-off-by: 何京晶 <18967138853@163.com> Co-Authored-By: Agent ------------------------------- atm/fore200e: Fix possible data race in fore200e_open() Protect access to fore200e->available_cell_rate with rate_mtx lock in the error handling path of fore200e_open() to prevent a data race. The field fore200e->available_cell_rate is a shared resource used to track available bandwidth. It is concurrently accessed by fore200e_open(), fore200e_close(), and fore200e_change_qos(). In fore200e_open(), the lock rate_mtx is correctly held when subtracting vcc->qos.txtp.max_pcr from available_cell_rate to reserve bandwidth. However, if the subsequent call to fore200e_activate_vcin() fails, the function restores the reserved bandwidth by adding back to available_cell_rate without holding the lock. This introduces a race condition because available_cell_rate is a global device resource shared across all VCCs. If the error path in fore200e_open() executes concurrently with operations like fore200e_close() or fore200e_change_qos() on other VCCs, a read-modify-write race occurs. Specifically, the error path reads the rate without the lock. If another CPU acquires the lock and modifies the rate (e.g., releasing bandwidth in fore200e_close()) between this read and the subsequent write, the error path will overwrite the concurrent update with a stale value. This results in incorrect bandwidth accounting. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Gui-Dong Han <hanguidong02@gmail.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20251120120657.2462194-1-hanguidong02@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: 何京晶 <18967138853@163.com> | 5 个月前 | |
auxdisplay: charlcd: Partially revert "Move hwidth and bwidth to struct hd44780_common" stable inclusion from stable-6.6.93 commit 5b518c452ff58016be7bd12776548d7d8a8ae1ae category: bugfix issue: #ICCW0G CVE: NA Signed-off-by: Li Nan <linan122@huawei.com> --------------------------------------- [ Upstream commit 09965a142078080fe7807bab0f6f1890cb5987a4 ] Commit 2545c1c948a6 ("auxdisplay: Move hwidth and bwidth to struct hd44780_common") makes charlcd_alloc() argument-less effectively dropping the single allocation for the struct charlcd_priv object along with the driver specific one. Restore that behaviour here. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Li Nan <linan122@huawei.com> | 1 年前 | |
!375 merge cve-fix-20260519 into master net: fix memory leak in skb_segment_list for GRO packets Created-by: llj123 Commit-by: Mohammad Heib;Thadeu Lima de Souza Cascardo;Paolo Abeni;Tetsuo Handa;Taeyang Lee;Peter Zijlstra;Eric Dumazet;John Johansen;Kaushlendra Kumar;Jens Axboe;Bert Karwatzki;Yongpeng Yang;Cheng-Yu Lee;Ariel Silver;Pablo Neira Ayuso;Ye Bin;Xu Yang;Zqiang;Theodore Ts'o;Alex Guo;Shaurya Rane;Yuan Tan;Jeffrey Bencteux;Xiang Mei;Weiming Shi;Luiz Augusto von Dentz;Daniil Dulov;Kohei Enju;Martin Ottens;Yuezhang Mo Merged-by: openharmony_ci Description: ## CVE 修复提交 本次提交包含 30 个 CVE 修复： - **CVE-2024-27065**: netfilter: nf_tables: do not compare internal table flags on updates - **CVE-2025-22111**: net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. - **CVE-2025-38693**: media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_t - **CVE-2025-38701**: ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr - **CVE-2025-38704**: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access - **CVE-2025-38725**: net: usb: asix_devices: add phy_mask for ax88772 mdio bus - **CVE-2025-39691**: fs/buffer: fix use-after-free when call bh_read() helper - **CVE-2025-71239**: audit: add fchmodat2() to change attributes class - **CVE-2026-22979**: net: fix memory leak in skb_segment_list for GRO packets - **CVE-2026-22994**: bpf: Fix reference count leak in bpf_prog_test_run_xdp() - **CVE-2026-23060**: crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - **CVE-2026-23071**: regmap: Fix race condition in hwspinlock irqsave routine - **CVE-2026-23120**: l2tp: avoid one data-race in l2tp_tunnel_del_work() - **CVE-2026-23246**: wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration - **CVE-2026-23253**: media: dvb-core: fix wrong reinitialization of ringbuffer on reopen - **CVE-2026-23254**: net: gro: fix outer network offset - **CVE-2026-23255**: net: add proper RCU protection to /proc/net/ptype - **CVE-2026-23260**: regmap: maple: free entry on mas_store_gfp() failure - **CVE-2026-23264**: Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" - **CVE-2026-23267**: f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes - **CVE-2026-23268**: apparmor: fix unprivileged local user can do privileged policy management - **CVE-2026-23271**: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race - **CVE-2026-23274**: netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer later - **CVE-2026-23336**: wifi: cfg80211: cancel rfkill_block work in wiphy_unregister - **CVE-2026-23359**: bpf: Fix stack-out-of-bounds write in devmap - **CVE-2026-23395**: Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - **CVE-2026-23396**: wifi: mac80211: fix NULL deref in mesh_matches_local() - **CVE-2026-23398**: icmp: fix NULL pointer dereference in icmp_tag_validation() - **CVE-2026-23409**: apparmor: fix differential encoding verification - **CVE-2026-23461**: Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user --- 提交由 cve-skill 自动处理生成。 See merge request: openharmony/kernel_linux_6.6!375 | 3 个月前 | |
bcma: Add explicit of_device.h include bcma/main.c uses of_dma_configure() which is declared in of_device.h. of_device.h gets implicitly included by of_platform.h, but that is going to be removed soon. Signed-off-by: Rob Herring <robh@kernel.org> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230410232701.1561613-1-robh@kernel.org | 3 年前 | |
loop: Avoid updating block size under exclusive owner stable inclusion from stable-6.6.117 commit 7e49538288e523427beedd26993d446afef1a6fb category: bugfix issue: CVE: CVE-2025-38709 Signed-off-by: llj123 <luojie119@h-partners.com> Co-Authored-By: Agent ------------------------------- loop: Avoid updating block size under exclusive owner Syzbot came up with a reproducer where a loop device block size is changed underneath a mounted filesystem. This causes a mismatch between the block device block size and the block size stored in the superblock causing confusion in various places such as fs/buffer.c. The particular issue triggered by syzbot was a warning in __getblk_slow() due to requested buffer size not matching block device block size. Fix the problem by getting exclusive hold of the loop device to change its block size. This fails if somebody (such as filesystem) has already an exclusive ownership of the block device and thus prevents modifying the loop device under some exclusive owner which doesn't expect it. Reported-by: syzbot+01ef7a8da81a975e1ccd@syzkaller.appspotmail.com Signed-off-by: Jan Kara <jack@suse.cz> Tested-by: syzbot+01ef7a8da81a975e1ccd@syzkaller.appspotmail.com Link: https://lore.kernel.org/r/20250711163202.19623-2-jack@suse.cz Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: llj123 <luojie119@h-partners.com> Change-Id: I62c8e381abd0e9409a1c86e3395a51570217c107 | 3 个月前 | |
esp: fix skb leak with espintcp and async crypto commit 0c0eef8ccd2413b0a10eb6bbd3442333b1e64dd2 upstream. When the TX queue for espintcp is full, esp_output_tail_tcp will return an error and not free the skb, because with synchronous crypto, the common xfrm output code will drop the packet for us. With async crypto (esp_output_done), we need to drop the skb when esp_output_tail_tcp returns an error. CVE: CVE-2026-31518 Signed-off-by: llj123 <luojie119@h-partners.com> Change-Id: I2393172623675275b74112f6183764474e67a155 | 2 个月前 | |
driver core: platform: use generic driver_override infrastructure mainline inclusion from mainline-6.6.100 commit 2b38efc05bf7a8568ec74bfffea0f5cfa62bc01d category: bugfix issue: #617 CVE: CVE-2026-31527 Signed-off-by: 姜小林 <jiangxiaolin11@huawei.com> Co-Authored-By: Agent ------------------------------- driver core: platform: use generic driver_override infrastructure When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF. Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally. Note that calling match() from __driver_attach() without the device lock held is intentional. [1] Link: https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/ [1] Reported-by: Gui-Dong Han <hanguidong02@gmail.com> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220789 Fixes: 3d713e0e382e ("driver core: platform: add device binding path 'driver_override'") Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Link: https://patch.msgid.link/20260303115720.48783-5-dakr@kernel.org Signed-off-by: Danilo Krummrich <dakr@kernel.org> Change-Id: I117b6089c6768e06e0496df571f64ff397d01f74 Signed-off-by: 姜小林 <jiangxiaolin11@huawei.com> | 3 个月前 | |
cache: ax45mp_cache: Align end size to cache boundary in ax45mp_dma_cache_wback() [ Upstream commit 9bd405c48b0ac4de087c0c4440fd79597201b8a7 ] Align the end size to cache boundary size in ax45mp_dma_cache_wback() callback likewise done in ax45mp_dma_cache_inv() callback. Additionally return early in case of start == end. Fixes: d34599bcd2e4 ("cache: Add L2 cache management for Andes AX45MP RISC-V core") Reported-by: Pavel Machek <pavel@denx.de> Link: https://lore.kernel.org/cip-dev/ZYsdKDiw7G+kxQ3m@duo.ucw.cz/ Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Signed-off-by: Conor Dooley <conor.dooley@microchip.com> Signed-off-by: Sasha Levin <sashal@kernel.org> | 2 年前 | |
cdrom: Avoid barrier_nospec() in cdrom_ioctl_media_changed() stable inclusion from stable-6.6.59 commit cf2bb1bf03068504f5c216194df57c23ed0bed5a category: bugfix issue: #IB7W7N CVE: NA Signed-off-by: zhangshuqi <zhangshuqi3@huawei.com> --------------------------------------- [ Upstream commit b0bf1afde7c34698cf61422fa8ee60e690dc25c3 ] The barrier_nospec() after the array bounds check is overkill and painfully slow for arches which implement it. Furthermore, most arches don't implement it, so they remain exposed to Spectre v1 (which can affect pretty much any CPU with branch prediction). Instead, clamp the user pointer to a valid range so it's guaranteed to be a valid array index even when the bounds check mispredicts. Fixes: 8270cb10c068 ("cdrom: Fix spectre-v1 gadget") Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org> Link: https://lore.kernel.org/r/1d86f4d9d8fba68e5ca64cdeac2451b95a8bf872.1729202937.git.jpoimboe@kernel.org Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: zhangshuqi <zhangshuqi3@huawei.com> | 1 年前 | |
cdx: Fix possible UAF error in driver_override_show() stable inclusion from stable-6.6.83 commit d7b339bbc887bcfc1a5b620bfc70c6fbb8f733bf category: bugfix issue: #IC1IVT CVE: NA Signed-off-by: zyf1116 <zhouyongfei3@huawei.com> --------------------------------------- commit 91d44c1afc61a2fec37a9c7a3485368309391e0b upstream. Fixed a possible UAF problem in driver_override_show() in drivers/cdx/cdx.c This function driver_override_show() is part of DEVICE_ATTR_RW, which includes both driver_override_show() and driver_override_store(). These functions can be executed concurrently in sysfs. The driver_override_store() function uses driver_set_override() to update the driver_override value, and driver_set_override() internally locks the device (device_lock(dev)). If driver_override_show() reads cdx_dev->driver_override without locking, it could potentially access a freed pointer if driver_override_store() frees the string concurrently. This could lead to printing a kernel address, which is a security risk since DEVICE_ATTR can be read by all users. Additionally, a similar pattern is used in drivers/amba/bus.c, as well as many other bus drivers, where device_lock() is taken in the show function, and it has been working without issues. This potential bug was detected by our experimental static analysis tool, which analyzes locking APIs and paired functions to identify data races and atomicity violations. Fixes: 1f86a00c1159 ("bus/fsl-mc: add support for 'driver_override' in the mc-bus") Cc: stable <stable@kernel.org> Signed-off-by: Qiu-ji Chen <chenqiuji666@gmail.com> Link: https://lore.kernel.org/r/20250118070833.27201-1-chenqiuji666@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: zyf1116 <zhouyongfei3@huawei.com> | 1 年前 | |
tpm: Cap the number of PCR banks stable inclusion from stable-6.6.105 commit faf07e611dfa464b201223a7253e9dc5ee0f3c9e category: bugfix issue: #207 CVE: CVE-2025-71077 Signed-off-by: zxl <1554188414@qq.com> Co-Authored-By: Agent ------------------------------- tpm: Cap the number of PCR banks tpm2_get_pcr_allocation() does not cap any upper limit for the number of banks. Cap the limit to eight banks so that out of bounds values coming from external I/O cause on only limited harm. Cc: stable@vger.kernel.org # v5.10+ Fixes: bcfff8384f6c ("tpm: dynamically allocate the allocated_banks array") Tested-by: Lai Yi <yi1.lai@linux.intel.com> Reviewed-by: Jonathan McDowell <noodles@meta.com> Reviewed-by: Roberto Sassu <roberto.sassu@huawei.com> Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@opinsys.com> Signed-off-by: zxl <1554188414@qq.com> | 5 个月前 | |
driver core: platform: use generic driver_override infrastructure mainline inclusion from mainline-6.6.100 commit 2b38efc05bf7a8568ec74bfffea0f5cfa62bc01d category: bugfix issue: #617 CVE: CVE-2026-31527 Signed-off-by: 姜小林 <jiangxiaolin11@huawei.com> Co-Authored-By: Agent ------------------------------- driver core: platform: use generic driver_override infrastructure When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF. Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally. Note that calling match() from __driver_attach() without the device lock held is intentional. [1] Link: https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/ [1] Reported-by: Gui-Dong Han <hanguidong02@gmail.com> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220789 Fixes: 3d713e0e382e ("driver core: platform: add device binding path 'driver_override'") Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Link: https://patch.msgid.link/20260303115720.48783-5-dakr@kernel.org Signed-off-by: Danilo Krummrich <dakr@kernel.org> Change-Id: I117b6089c6768e06e0496df571f64ff397d01f74 Signed-off-by: 姜小林 <jiangxiaolin11@huawei.com> | 3 个月前 | |
clocksource: mips-gic-timer: Enable counter when CPUs start stable inclusion from stable-6.6.93 commit 06abee685cc97580573fe59ef73263ae0ab469df category: bugfix issue: #ICCW0G CVE: NA Signed-off-by: Li Nan <linan122@huawei.com> --------------------------------------- [ Upstream commit 3128b0a2e0cf6e07aa78e5f8cf7dd9cd59dc8174 ] In multi-cluster MIPS I6500 systems there is a GIC in each cluster, each with its own counter. When a cluster powers up the counter will be stopped, with the COUNTSTOP bit set in the GIC_CONFIG register. In single cluster systems, it has been fine to clear COUNTSTOP once in gic_clocksource_of_init() to start the counter. In multi-cluster systems, this will only have started the counter in the boot cluster, and any CPUs in other clusters will find their counter stopped which will break the GIC clock_event_device. Resolve this by having CPUs clear the COUNTSTOP bit when they come online, using the existing gic_starting_cpu() CPU hotplug callback. This will allow CPUs in secondary clusters to ensure that the cluster's GIC counter is running as expected. Signed-off-by: Paul Burton <paulburton@kernel.org> Signed-off-by: Chao-ying Fu <cfu@wavecomp.com> Signed-off-by: Dragan Mladjenovic <dragan.mladjenovic@syrmia.com> Signed-off-by: Aleksandar Rikalo <arikalo@gmail.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org> Tested-by: Serge Semin <fancer.lancer@gmail.com> Tested-by: Gregory CLEMENT <gregory.clement@bootlin.com> Acked-by: Daniel Lezcano <daniel.lezcano@linaro.org> Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Li Nan <linan122@huawei.com> | 1 年前 | |
comedi: c6xdigio: Fix invalid PNP driver unregistration stable inclusion from stable-6.6.105 commit 72262330f7b3a category: bugfix issue: #207 CVE: CVE-2025-68332 Signed-off-by: 何京晶 <18967138853@163.com> Co-Authored-By: Agent ------------------------------- comedi: c6xdigio: Fix invalid PNP driver unregistration The Comedi low-level driver "c6xdigio" seems to be for a parallel port connected device. When the Comedi core calls the driver's Comedi "attach" handler c6xdigio_attach() to configure a Comedi to use this driver, it tries to enable the parallel port PNP resources by registering a PNP driver with pnp_register_driver(), but ignores the return value. (The struct pnp_driver it uses has only the name and id_table members filled in.) The driver's Comedi "detach" handler c6xdigio_detach() unconditionally unregisters the PNP driver with pnp_unregister_driver(). It is possible for c6xdigio_attach() to return an error before it calls pnp_register_driver() and it is possible for the call to pnp_register_driver() to return an error (that is ignored). In both cases, the driver should not be calling pnp_unregister_driver() as it does in c6xdigio_detach(). (Note that c6xdigio_detach() will be called by the Comedi core if c6xdigio_attach() returns an error, or if the Comedi core decides to detach the Comedi device from the driver for some other reason.) The unconditional call to pnp_unregister_driver() without a previous successful call to pnp_register_driver() will cause driver_unregister() to issue a warning "Unexpected driver unregister!". This was detected by Syzbot [1]. Also, the PNP driver registration and unregistration should be done at module init and exit time, respectively, not when attaching or detaching Comedi devices to the driver. (There might be more than one Comedi device being attached to the driver, although that is unlikely.) Change the driver to do the PNP driver registration at module init time, and the unregistration at module exit time. Since c6xdigio_detach() now only calls comedi_legacy_detach(), remove the function and change the Comedi driver "detach" handler to comedi_legacy_detach. ------------------------------------------- [1] Syzbot sample crash report: Unexpected driver unregister! WARNING: CPU: 0 PID: 5970 at drivers/base/driver.c:273 driver_unregister drivers/base/driver.c:273 [inline] WARNING: CPU: 0 PID: 5970 at drivers/base/driver.c:273 driver_unregister+0x90/0xb0 drivers/base/driver.c:270 Modules linked in: CPU: 0 UID: 0 PID: 5970 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 RIP: 0010:driver_unregister drivers/base/driver.c:273 [inline] RIP: 0010:driver_unregister+0x90/0xb0 drivers/base/driver.c:270 Code: 48 89 ef e8 c2 e6 82 fc 48 89 df e8 3a 93 ff ff 5b 5d e9 c3 6d d9 fb e8 be 6d d9 fb 90 48 c7 c7 e0 f8 1f 8c e8 51 a2 97 fb 90 <0f> 0b 90 90 5b 5d e9 a5 6d d9 fb e8 e0 f4 41 fc eb 94 e8 d9 f4 41 RSP: 0018:ffffc9000373f9a0 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffffffff8ff24720 RCX: ffffffff817b6ee8 RDX: ffff88807c932480 RSI: ffffffff817b6ef5 RDI: 0000000000000001 RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000001 R12: ffffffff8ff24660 R13: dffffc0000000000 R14: 0000000000000000 R15: ffff88814cca0000 FS: 000055556dab1500(0000) GS:ffff8881249d9000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055f77f285cd0 CR3: 000000007d871000 CR4: 00000000003526f0 Call Trace: <TASK> comedi_device_detach_locked+0x12f/0xa50 drivers/comedi/drivers.c:207 comedi_device_detach+0x67/0xb0 drivers/comedi/drivers.c:215 comedi_device_attach+0x43d/0x900 drivers/comedi/drivers.c:1011 do_devconfig_ioctl+0x1b1/0x710 drivers/comedi/comedi_fops.c:872 comedi_unlocked_ioctl+0x165d/0x2f00 drivers/comedi/comedi_fops.c:2178 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fc05798eec9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffcf8184238 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007fc057be5fa0 RCX: 00007fc05798eec9 RDX: 0000200000000080 RSI: 0000000040946400 RDI: 0000000000000003 RBP: 00007fc057a11f91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fc057be5fa0 R14: 00007fc057be5fa0 R15: 0000000000000003 </TASK> ------------------------------------------- Reported-by: syzbot+6616bba359cec7a1def1@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=6616bba359cec7a1def1 Fixes: 2c89e159cd2f ("Staging: comedi: add c6xdigio driver") Cc: stable <stable@kernel.org> Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Link: https://patch.msgid.link/20251023123141.6537-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: 何京晶 <18967138853@163.com> | 5 个月前 | |
connector/cn_proc: revert "connector: Fix proc_event_num_listeners count not cleared" commit 8929f95b2b587791a7dcd04cc91520194a76d3a6 upstream. This reverts commit c46bfba1337d ("connector: Fix proc_event_num_listeners count not cleared"). It is not accurate to reset proc_event_num_listeners according to cn_netlink_send_mult() return value -ESRCH. In the case of stress-ng netlink-proc, -ESRCH will always be returned, because netlink_broadcast_filtered will return -ESRCH, which may cause stress-ng netlink-proc performance degradation. Reported-by: kernel test robot <oliver.sang@intel.com> Closes: https://lore.kernel.org/oe-lkp/202401112259.b23a1567-oliver.sang@intel.com Fixes: c46bfba1337d ("connector: Fix proc_event_num_listeners count not cleared") Signed-off-by: Keqi Wang <wangkeqi_chris@163.com> Link: https://lore.kernel.org/r/20240209091659.68723-1-wangkeqi_chris@163.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2 年前 | |
counter: interrupt-cnt: Protect enable/disable OPs with mutex stable inclusion from stable-6.6.94 commit 32b3f3382d6c2276a4135b1dc7388ffdd350eaf8 category: bugfix issue: #ICCW0G CVE: NA Signed-off-by: Li Nan <linan122@huawei.com> --------------------------------------- [ Upstream commit 7351312632e831e51383f48957d47712fae791ef ] Enable/disable seems to be racy on SMP, consider the following scenario: CPU0 CPU1 interrupt_cnt_enable_write(true) { if (priv->enabled == enable) return 0; if (enable) { priv->enabled = true; interrupt_cnt_enable_write(false) { if (priv->enabled == enable) return 0; if (enable) { priv->enabled = true; enable_irq(priv->irq); } else { disable_irq(priv->irq) priv->enabled = false; } enable_irq(priv->irq); } else { disable_irq(priv->irq); priv->enabled = false; } The above would result in priv->enabled == false, but IRQ left enabled. Protect both write (above race) and read (to propagate the value on SMP) callbacks with a mutex. Signed-off-by: Alexander Sverdlin <alexander.sverdlin@siemens.com> Fixes: a55ebd47f21f ("counter: add IRQ or GPIO based counter") Acked-by: Oleksij Rempel <o.rempel@pengutronix.de> Link: https://lore.kernel.org/r/20250331163642.2382651-1-alexander.sverdlin@siemens.com Signed-off-by: William Breathitt Gray <wbg@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Li Nan <linan122@huawei.com> | 1 年前 | |
回退 'Pull Request !193 : lts升级 6.6.101->6.6.102' | 11 个月前 | |
cpuidle: menu: Avoid discarding useful information stable inclusion from stable-6.6.93 commit 3cd2aa93674ee9e6cb711d81c0486ade690f98fc category: bugfix issue: #ICCW0G CVE: NA Signed-off-by: Li Nan <linan122@huawei.com> --------------------------------------- [ Upstream commit 85975daeaa4d6ec560bfcd354fc9c08ad7f38888 ] When giving up on making a high-confidence prediction, get_typical_interval() always returns UINT_MAX which means that the next idle interval prediction will be based entirely on the time till the next timer. However, the information represented by the most recent intervals may not be completely useless in those cases. Namely, the largest recent idle interval is an upper bound on the recently observed idle duration, so it is reasonable to assume that the next idle duration is unlikely to exceed it. Moreover, this is still true after eliminating the suspected outliers if the sample set still under consideration is at least as large as 50% of the maximum sample set size. Accordingly, make get_typical_interval() return the current maximum recent interval value in that case instead of UINT_MAX. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Reported-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com> Tested-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com> Reviewed-by: Christian Loehle <christian.loehle@arm.com> Tested-by: Christian Loehle <christian.loehle@arm.com> Tested-by: Aboorva Devarajan <aboorvad@linux.ibm.com> Link: https://patch.msgid.link/7770672.EvYhyI6sBW@rjwysocki.net Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Li Nan <linan122@huawei.com> | 1 年前 | |
!384 merge cve-fix-20260522-kernel_linux_6.6-master into master CVE修复: kernel_linux_6.6 master (55 个安全补丁) - 2026-05-22 Created-by: Hun_Dun Commit-by: Hun_Dun Merged-by: openharmony_ci Description: ## CVE 修复列表 | CVE ID | 标题 | Commit | |--------|------|--------| | CVE-2026-31726 | usb: gadget: uvc: fix NULL pointer dereference dur... | c78e463ee134 | | CVE-2026-31759 | usb: ulpi: fix double free in ulpi_register_interf... | aaeae6533d77 | | CVE-2026-43024 | netfilter: nf_tables: reject immediate NF_QUEUE ve... | 4b12a3cc3f07 | | CVE-2026-43026 | netfilter: ctnetlink: zero expect NAT fields when ... | 2898080c054e | | CVE-2026-43027 | netfilter: nf_conntrack_helper: pass helper to exp... | 2cf2737c85a2 | | CVE-2026-43028 | netfilter: x_tables: ensure names are nul-terminat... | c2d4a3abb15c | | CVE-2026-43035 | net: sched: cls_api: fix tc_chain_fill_node to ini... | e35f5195cd44 | | CVE-2026-43060 | netfilter: nft_ct: drop pending enqueued packets o... | e68a8db3a054 | | CVE-2026-43073 | x86-64: rename misleadingly named '__copy_user_noc... | d187a86de793 | | CVE-2026-43077 | crypto: algif_aead - Fix minimum RX size check for... | 3d14bd48e3a7 | | CVE-2026-43080 | l2tp: Drop large packets with UDP encap | ebe560ea5f54 | | CVE-2026-43082 | net: txgbe: leave space for null terminators on pr... | 5a37d228799b | | CVE-2026-43085 | netfilter: nfnetlink_log: initialize nfgenmsg in N... | 1f3083aec883 | | CVE-2026-43086 | ipvs: fix NULL deref in ip_vs_add_service error pa... | 9a91797e61d2 | | CVE-2026-43088 | net: af_key: zero aligned sockaddr tail in PF_KEY ... | 426c355742f0 | | CVE-2026-43089 | xfrm_user: fix info leak in build_mapping() | 1beb76b2053b | | CVE-2026-43091 | xfrm: Wait for RCU readers during policy netns exi... | 069daad4f2ae | | CVE-2026-43107 | xfrm: account XFRMA_IF_ID in aevent size calculati... | 7081d46d3231 | | CVE-2026-43114 | netfilter: nft_set_pipapo_avx2: don't return non-m... | d3c0037ffe12 | | CVE-2026-43116 | netfilter: ctnetlink: ensure safe access to master... | bffcaad9afdf | | CVE-2026-43128 | RDMA/umem: Fix double dma_buf_unpin in failure pat... | b324327ff6f4 | | CVE-2026-43129 | ima: verify the previous kernel's IMA buffer lies ... | 10d1c75ed438 | | CVE-2026-43130 | iommu/vt-d: Flush dev-IOTLB only when PCIe device ... | 01aed2f1d7cb | | CVE-2026-43136 | HID: logitech-hidpp: Check maxfield in hidpp_get_r... | b74bf7d0d01f | | CVE-2026-43139 | xfrm6: fix uninitialized saddr in xfrm6_get_saddr(... | 719918fc88df | | CVE-2026-43161 | iommu/vt-d: Skip dev-iotlb flush for inaccessible ... | 42662d19839f | | CVE-2026-43167 | xfrm: always flush state and policy upon NETDEV_UN... | 166801e49a5b | | CVE-2026-43180 | net: usb: kaweth: remove TX queue manipulation in ... | ef9b10a02050 | | CVE-2026-43190 | netfilter: xt_tcpmss: check remaining length befor... | 07a9b32eaae7 | | CVE-2026-43199 | net/mlx5e: Fix "scheduling while atomic" in IPsec ... | 859380694f43 | | CVE-2026-43238 | net/sched: act_skbedit: fix divide-by-zero in tcf_... | 9c735a7d98c9 | | CVE-2026-43248 | vhost: move vdpa group bound check to vhost_vdpa | cd025c1e876b | | CVE-2026-43281 | mailbox: Prevent out-of-bounds access in fw_mbox_i... | 31c4c67dec33 | | CVE-2026-43292 | mm/vmalloc: prevent RCU stalls in kasan_release_vm... | 5747435e0fd4 | | CVE-2026-43304 | libceph: define and enforce CEPH_MAX_KEY_LEN | e1dc45d97975 | | CVE-2026-43309 | md raid: fix hang when stopping arrays with metada... | cefcb9297fbd | | CVE-2026-43310 | media: verisilicon: Avoid G2 bus error while decod... | e0203ddf9af7 | | CVE-2026-43319 | spi: spidev: fix lock inversion between spi_lock a... | 40534d19ed2a | | CVE-2026-43324 | USB: dummy-hcd: Fix interrupt synchronization erro... | 5aa776c8615b | | CVE-2026-43330 | crypto: caam - fix overflow on long hmac keys | 31022cfde523 | | CVE-2026-43332 | thermal: core: Fix thermal zone device registratio... | 9e796001af97 | | CVE-2026-43339 | ipv6: prevent possible UaF in addrconf_permanent_a... | 7d9f2f4aabd1 | | CVE-2026-43353 | i3c: mipi-i3c-hci: Fix race in DMA ring dequeue | 1dca8aee80ee | | CVE-2026-43406 | libceph: prevent potential out-of-bounds reads in ... | 50156622eb08 | | CVE-2026-43413 | scsi: hisi_sas: Fix NULL pointer exception during ... | 70c78429ef38 | | CVE-2026-43439 | cgroup: fix race between task migration and iterat... | 3dfd1328c052 | | CVE-2026-43441 | net: bonding: Fix nd_tbl NULL dereference when IPv... | cf6099ef493b | | CVE-2026-43450 | netfilter: nfnetlink_cthelper: fix OOB read in nfn... | 4a1f6ee69267 | | CVE-2026-43451 | netfilter: nfnetlink_queue: fix entry leak in brid... | 47b1c5d1b094 | | CVE-2026-43452 | netfilter: x_tables: guard option walkers against ... | 9b94f0e42ed2 | | CVE-2026-43453 | netfilter: nft_set_pipapo: fix stack out-of-bounds... | 0a55d62cdb62 | | CVE-2026-43456 | bonding: fix type confusion in bond_setup_by_slave... | 950803f72547 | | CVE-2026-43466 | net/mlx5e: Fix DMA FIFO desync on error CQE SQ rec... | 383b37c04a48 | | CVE-2026-43468 | net/mlx5: Fix deadlock between devlink lock and es... | 957d2a58f7f8 | | CVE-2026-43475 | scsi: storvsc: Fix scheduling while atomic on PREE... | e7919a293f9b | **来源**: Cherry-pick from stable-tags/v6.6.134~18 ## 统计 - **总数**: 60 - **成功**: 55 - **空提交（已存在）**: 3 - **跳过**: 2 ## 修复详情 ### CVE-2026-31726 - **Commit**: c78e463ee134b4669579d453c81ae00795e4c19a - **Stable**: tags/v6.6.134~18 - **标题**: usb: gadget: uvc: fix NULL pointer dereference during unbind race ### CVE-2026-31759 - **Commit**: aaeae6533d77e6ed4def85baec01e2815ebbef61 - **Stable**: tags/v6.6.134~56 - **标题**: usb: ulpi: fix double free in ulpi_register_interface() error path ### CVE-2026-43024 - **Commit**: 4b12a3cc3f075e750cc3c5e693fd25fb400af4a2 - **Stable**: tags/v6.6.134~116 - **标题**: netfilter: nf_tables: reject immediate NF_QUEUE verdict ### CVE-2026-43026 - **Commit**: 2898080c054ea4d6ddfaaf21bbedbc229a9a8376 - **Stable**: tags/v6.6.134~122 - **标题**: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent ### CVE-2026-43027 - **Commit**: 2cf2737c85a2ba2b52024dafe68ffad2676f97be - **Stable**: tags/v6.6.134~123 - **标题**: netfilter: nf_conntrack_helper: pass helper to expect cleanup ### CVE-2026-43028 - **Commit**: c2d4a3abb15ca14716c6d8b9ffcbcd7c63626af4 - **Stable**: tags/v6.6.134~125 - **标题**: netfilter: x_tables: ensure names are nul-terminated ### CVE-2026-43035 - **Commit**: e35f5195cd44ff4053fbc5d71ea97681728a0099 - **Stable**: tags/v6.6.134~132 - **标题**: net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak ### CVE-2026-43060 - **Commit**: e68a8db3a0546482b34e9ca5ca886bcf73eb37bb - **Stable**: tags/v6.6.130~52 - **标题**: netfilter: nft_ct: drop pending enqueued packets on removal ### CVE-2026-43073 - **Commit**: d187a86de793f84766ea40b9ade7ac60aabbb4fe - **Stable**: tags/v7.1-rc1~251^2~2 - **标题**: x86-64: rename misleadingly named '__copy_user_nocache()' function ### CVE-2026-43077 - **Commit**: 3d14bd48e3a77091cbce637a12c2ae31b4a1687c - **Stable**: tags/v7.0~7^2 - **标题**: crypto: algif_aead - Fix minimum RX size check for decryption ### CVE-2026-43080 - **Commit**: ebe560ea5f54134279356703e73b7f867c89db13 - **Stable**: tags/v7.0~27^2~2 - **标题**: l2tp: Drop large packets with UDP encap ### CVE-2026-43082 - **Commit**: 5a37d228799b0ec2c277459c83c814a59d310bc3 - **Stable**: tags/v7.0~27^2~11 - **标题**: net: txgbe: leave space for null terminators on property_entry ### CVE-2026-43085 - **Commit**: 1f3083aec8836213da441270cdb1ab612dd82cf4 - **Stable**: tags/v7.0~27^2~16^2~5 - **标题**: netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator ### CVE-2026-43086 - **Commit**: 9a91797e61d286805ae10a92cc48959c30800556 - **Stable**: tags/v7.0~27^2~16^2~6 - **标题**: ipvs: fix NULL deref in ip_vs_add_service error path ### CVE-2026-43088 - **Commit**: 426c355742f02cf743b347d9d7dbdc1bfbfa31ef - **Stable**: tags/v7.0~27^2~14^2 - **标题**: net: af_key: zero aligned sockaddr tail in PF_KEY exports ### CVE-2026-43089 - **Commit**: 1beb76b2053b68c491b78370794b8ff63c8f8c02 - **Stable**: tags/v7.0~27^2~14^2~2 - **标题**: xfrm_user: fix info leak in build_mapping() ### CVE-2026-43091 - **Commit**: 069daad4f2ae9c5c108131995529d5f02392c446 - **Stable**: tags/v7.0~27^2~14^2~5 - **标题**: xfrm: Wait for RCU readers during policy netns exit ### CVE-2026-43107 - **Commit**: 7081d46d32312f1a31f0e0e99c6835a394037599 - **Stable**: tags/v7.0~27^2~14^2~6 - **标题**: xfrm: account XFRMA_IF_ID in aevent size calculation ### CVE-2026-43114 - **Commit**: d3c0037ffe1273fa1961e779ff6906234d6cf53c - **Stable**: tags/v7.0-rc6~40^2^2~11 - **标题**: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry ### CVE-2026-43116 - **Commit**: bffcaad9afdfe45d7fc777397d3b83c1e3ebffe5 - **Stable**: tags/v7.0-rc6~40^2^2~4 - **标题**: netfilter: ctnetlink: ensure safe access to master conntrack ### CVE-2026-43128 - **Commit**: b324327ff6f48d8065dca67eb3b91357e72726bd - **Stable**: tags/v6.6.128~137 - **标题**: RDMA/umem: Fix double dma_buf_unpin in failure path ### CVE-2026-43129 - **Commit**: 10d1c75ed4382a8e79874379caa2ead8952734f9 - **Stable**: tags/v7.0-rc1~46^2~76 - **标题**: ima: verify the previous kernel's IMA buffer lies in addressable RAM ### CVE-2026-43130 - **Commit**: 01aed2f1d7cb8fdf4c60c5bb4727608cb82b401d - **Stable**: tags/v6.6.128~70 - **标题**: iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode ### CVE-2026-43136 - **Commit**: b74bf7d0d01fa9b53653f58c29aa00772121f6e9 - **Stable**: tags/v6.6.128~111 - **标题**: HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() ### CVE-2026-43139 - **Commit**: 719918fc88df6da023dfff370cd965151a5afd7f - **Stable**: tags/v6.6.128~157 - **标题**: xfrm6: fix uninitialized saddr in xfrm6_get_saddr() ### CVE-2026-43161 - **Commit**: 42662d19839f34735b718129ea200e3734b07e50 - **Stable**: tags/v7.0-rc1~137^2^3~6 - **标题**: iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode ### CVE-2 See merge request: openharmony/kernel_linux_6.6!384 | 3 个月前 | |
cxl/region: Add a dev_err() on missing target list entries stable inclusion from stable-6.6.96 commit 9d90ab45d3d393532b7fa62d6a6b7ebbde9cf5fc category: bugfix issue: #ICCW0G CVE: NA Signed-off-by: Li Nan <linan122@huawei.com> --------------------------------------- [ Upstream commit d90acdf49e18029cfe4194475c45ef143657737a ] Broken target lists are hard to discover as the driver fails at a later initialization stage. Add an error message for this. Example log messages: cxl_mem mem1: failed to find endpoint6:0000:e0:01.3 in target list of decoder1.1 cxl_port endpoint6: failed to register decoder6.0: -6 cxl_port endpoint6: probe: 0 Signed-off-by: Robert Richter <rrichter@amd.com> Reviewed-by: Gregory Price <gourry@gourry.net> Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Reviewed-by: Dave Jiang <dave.jiang@intel.com> Reviewed-by: Dan Williams <dan.j.williams@intel.com> Reviewed-by: Alison Schofield <alison.schofield@intel.com> Reviewed-by: "Fabio M. De Francesco" <fabio.m.de.francesco@linux.intel.com> Tested-by: Gregory Price <gourry@gourry.net> Acked-by: Dan Williams <dan.j.williams@intel.com> Link: https://patch.msgid.link/20250509150700.2817697-14-rrichter@amd.com Signed-off-by: Dave Jiang <dave.jiang@intel.com> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Li Nan <linan122@huawei.com> | 1 年前 | |
dax: delete a stale directory pmem stable inclusion from stable-6.6.64 commit a6faea503ba4345c267b4a414827881cfa8c461e category: bugfix issue: #IBE7K0 CVE: NA Signed-off-by: zyf1116 <zhouyongfei3@huawei.com> --------------------------------------- [ Upstream commit b8e6d7ce50673c39514921ac61f7af00bbb58b87 ] After commit: 83762cb5c7c4 ("dax: Kill DEV_DAX_PMEM_COMPAT") the pmem/ directory is not needed anymore and Makefile changes were made accordingly in this commit, but there is a Makefile and pmem.c in pmem/ which are now stale and pmem.c is empty, remove them. Fixes: 83762cb5c7c4 ("dax: Kill DEV_DAX_PMEM_COMPAT") Suggested-by: Vegard Nossum <vegard.nossum@oracle.com> Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com> Reviewed-by: Dan Williams <dan.j.williams@intel.com> Reviewed-by: Ira Weiny <ira.weiny@intel.com> Link: https://patch.msgid.link/20241017101144.1654085-1-harshit.m.mogalapalli@oracle.com Signed-off-by: Ira Weiny <ira.weiny@intel.com> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: zyf1116 <zhouyongfei3@huawei.com> delete mode 100644 drivers/dax/pmem/Makefile delete mode 100644 drivers/dax/pmem/pmem.c Signed-off-by: zyf1116 <zhouyongfei3@huawei.com> | 1 年前 | |
Merge tag 'mm-nonmm-stable-2023-04-27-16-01' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull non-MM updates from Andrew Morton: "Mainly singleton patches all over the place. Series of note are: - updates to scripts/gdb from Glenn Washburn - kexec cleanups from Bjorn Helgaas" * tag 'mm-nonmm-stable-2023-04-27-16-01' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (50 commits) mailmap: add entries for Paul Mackerras libgcc: add forward declarations for generic library routines mailmap: add entry for Oleksandr ocfs2: reduce ioctl stack usage fs/proc: add Kthread flag to /proc/$pid/status ia64: fix an addr to taddr in huge_pte_offset() checkpatch: introduce proper bindings license check epoll: rename global epmutex scripts/gdb: add GDB convenience functions $lx_dentry_name() and $lx_i_dentry() scripts/gdb: create linux/vfs.py for VFS related GDB helpers uapi/linux/const.h: prefer ISO-friendly __typeof__ delayacct: track delays from IRQ/SOFTIRQ scripts/gdb: timerlist: convert int chunks to str scripts/gdb: print interrupts scripts/gdb: raise error with reduced debugging information scripts/gdb: add a Radix Tree Parser lib/rbtree: use '+' instead of '|' for setting color. proc/stat: remove arch_idle_time() checkpatch: check for misuse of the link tags checkpatch: allow Closes tags with links ... | 3 年前 | |
回退 'Pull Request !193 : lts升级 6.6.101->6.6.102' | 11 个月前 | |
drivers: dio: fix possible memory leak in dio_init() If device_register() returns error, the 'dev' and name needs be freed. Add a release function, and then call put_device() in the error path, so the name is freed in kobject_cleanup() and to the 'dev' is freed in release function. Fixes: 2e4c77bea3d8 ("m68k: dio - Kill warn_unused_result warnings") Fixes: 1fa5ae857bb1 ("driver core: get rid of struct device's bus_id string array") Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> Link: https://lore.kernel.org/r/20221109064036.1835346-1-yangyingliang@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 3 年前 | |
dma-buf: fix timeout handling in dma_resv_wait_timeout v2 stable inclusion from stable-6.6.97 commit d8eab407c08d40908345174f27c306483c894c7b category: bugfix issue: #ICCW0G CVE: NA Signed-off-by: Li Nan <linan122@huawei.com> --------------------------------------- commit 2b95a7db6e0f75587bffddbb490399cbb87e4985 upstream. Even the kerneldoc says that with a zero timeout the function should not wait for anything, but still return 1 to indicate that the fences are signaled now. Unfortunately that isn't what was implemented, instead of only returning 1 we also waited for at least one jiffies. Fix that by adjusting the handling to what the function is actually documented to do. v2: improve code readability Reported-by: Marek Olšák <marek.olsak@amd.com> Reported-by: Lucas Stach <l.stach@pengutronix.de> Signed-off-by: Christian König <christian.koenig@amd.com> Reviewed-by: Lucas Stach <l.stach@pengutronix.de> Cc: <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20250129105841.1806-1-christian.koenig@amd.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Li Nan <linan122@huawei.com> | 1 年前 | |
dmaengine: tegra-adma: Fix use-after-free stable inclusion from stable-6.6.105 commit 2efd07a7c369 category: bugfix issue: #223 CVE: CVE-2025-71162 Signed-off-by: zxl <1554188414@qq.com> ------------------------------- dmaengine: tegra-adma: Fix use-after-free A use-after-free bug exists in the Tegra ADMA driver when audio streams are terminated, particularly during XRUN conditions. The issue occurs when the DMA buffer is freed by tegra_adma_terminate_all() before the vchan completion tasklet finishes accessing it. The race condition follows this sequence: 1. DMA transfer completes, triggering an interrupt that schedules the completion tasklet (tasklet has not executed yet) 2. Audio playback stops, calling tegra_adma_terminate_all() which frees the DMA buffer memory via kfree() 3. The scheduled tasklet finally executes, calling vchan_complete() which attempts to access the already-freed memory Since tasklets can execute at any time after being scheduled, there is no guarantee that the buffer will remain valid when vchan_complete() runs. Fix this by properly synchronizing the virtual channel completion: - Calling vchan_terminate_vdesc() in tegra_adma_stop() to mark the descriptors as terminated instead of freeing the descriptor. - Add the callback tegra_adma_synchronize() that calls vchan_synchronize() which kills any pending tasklets and frees any terminated descriptors. Crash logs: [ 337.427523] BUG: KASAN: use-after-free in vchan_complete+0x124/0x3b0 [ 337.427544] Read of size 8 at addr ffff000132055428 by task swapper/0/0 [ 337.427562] Call trace: [ 337.427564] dump_backtrace+0x0/0x320 [ 337.427571] show_stack+0x20/0x30 [ 337.427575] dump_stack_lvl+0x68/0x84 [ 337.427584] print_address_description.constprop.0+0x74/0x2b8 [ 337.427590] kasan_report+0x1f4/0x210 [ 337.427598] __asan_load8+0xa0/0xd0 [ 337.427603] vchan_complete+0x124/0x3b0 [ 337.427609] tasklet_action_common.constprop.0+0x190/0x1d0 [ 337.427617] tasklet_action+0x30/0x40 [ 337.427623] __do_softirq+0x1a0/0x5c4 [ 337.427628] irq_exit+0x110/0x140 [ 337.427633] handle_domain_irq+0xa4/0xe0 [ 337.427640] gic_handle_irq+0x64/0x160 [ 337.427644] call_on_irq_stack+0x20/0x4c [ 337.427649] do_interrupt_handler+0x7c/0x90 [ 337.427654] el1_interrupt+0x30/0x80 [ 337.427659] el1h_64_irq_handler+0x18/0x30 [ 337.427663] el1h_64_irq+0x7c/0x80 [ 337.427667] cpuidle_enter_state+0xe4/0x540 [ 337.427674] cpuidle_enter+0x54/0x80 [ 337.427679] do_idle+0x2e0/0x380 [ 337.427685] cpu_startup_entry+0x2c/0x70 [ 337.427690] rest_init+0x114/0x130 [ 337.427695] arch_call_rest_init+0x18/0x24 [ 337.427702] start_kernel+0x380/0x3b4 [ 337.427706] __primary_switched+0xc0/0xc8 Fixes: f46b195799b5 ("dmaengine: tegra-adma: Add support for Tegra210 ADMA") Signed-off-by: Sheetal <sheetal@nvidia.com> Acked-by: Thierry Reding <treding@nvidia.com> Link: https://patch.msgid.link/20251110142445.3842036-1-sheetal@nvidia.com Signed-off-by: Vinod Koul <vkoul@kernel.org> Signed-off-by: zxl <1554188414@qq.com> | 5 个月前 | |
EDAC/amd64: Fix size calculation for Non-Power-of-Two DIMMs stable inclusion from stable-6.6.96 commit e5e6a5aa3915507f1a5a67fea1a24bb61e63704d category: bugfix issue: #ICCW0G CVE: NA Signed-off-by: Li Nan <linan122@huawei.com> --------------------------------------- commit a3f3040657417aeadb9622c629d4a0c2693a0f93 upstream. Each Chip-Select (CS) of a Unified Memory Controller (UMC) on AMD Zen-based SOCs has an Address Mask and a Secondary Address Mask register associated with it. The amd64_edac module logs DIMM sizes on a per-UMC per-CS granularity during init using these two registers. Currently, the module primarily considers only the Address Mask register for computing DIMM sizes. The Secondary Address Mask register is only considered for odd CS. Additionally, if it has been considered, the Address Mask register is ignored altogether for that CS. For power-of-two DIMMs i.e. DIMMs whose total capacity is a power of two (32GB, 64GB, etc), this is not an issue since only the Address Mask register is used. For non-power-of-two DIMMs i.e., DIMMs whose total capacity is not a power of two (48GB, 96GB, etc), however, the Secondary Address Mask register is used in conjunction with the Address Mask register. However, since the module only considers either of the two registers for a CS, the size computed by the module is incorrect. The Secondary Address Mask register is not considered for even CS, and the Address Mask register is not considered for odd CS. Introduce a new helper function so that both Address Mask and Secondary Address Mask registers are considered, when valid, for computing DIMM sizes. Furthermore, also rename some variables for greater clarity. Fixes: 81f5090db843 ("EDAC/amd64: Support asymmetric dual-rank DIMMs") Closes: https://lore.kernel.org/dbec22b6-00f2-498b-b70d-ab6f8a5ec87e@natrix.lt Reported-by: Žilvinas Žaltiena <zilvinas@natrix.lt> Signed-off-by: Avadhut Naik <avadhut.naik@amd.com> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> Reviewed-by: Yazen Ghannam <yazen.ghannam@amd.com> Tested-by: Žilvinas Žaltiena <zilvinas@natrix.lt> Cc: stable@vger.kernel.org Link: https://lore.kernel.org/20250529205013.403450-1-avadhut.naik@amd.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Li Nan <linan122@huawei.com> | 1 年前 | |
EISA: Replace all non-returning strlcpy with strscpy strlcpy() reads the entire source buffer first. This read may exceed the destination size limit. This is both inefficient and can lead to linear read overflows if a source string is not NUL-terminated [1]. In an effort to remove strlcpy() completely [2], replace strlcpy() here with strscpy(). No return values were used, so direct replacement is safe. [1] https://www.kernel.org/doc/html/latest/process/deprecated.html#strlcpy [2] https://github.com/KSPP/linux/issues/89 Signed-off-by: Azeem Shaikh <azeemshaikh38@gmail.com> Reviewed-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/20230706175804.2249018-1-azeemshaikh38@gmail.com Signed-off-by: Kees Cook <keescook@chromium.org> # diff --git a/drivers/eisa/eisa-bus.c b/drivers/eisa/eisa-bus.c # index 713582cc27d1..33f0ba11c6ad 100644 # --- a/drivers/eisa/eisa-bus.c # +++ b/drivers/eisa/eisa-bus.c # @@ -60,7 +60,7 @@ static void __init eisa_name_device(struct eisa_device *edev) # int i; # for (i = 0; i < EISA_INFOS; i++) { # if (!strcmp(edev->id.sig, eisa_table[i].id.sig)) { # - strlcpy(edev->pretty_name, # + strscpy(edev->pretty_name, # eisa_table[i].name, # sizeof(edev->pretty_name)); # return; | 3 年前 | |
extcon: max8997: select IRQ_DOMAIN instead of depending on it stable inclusion from stable-6.6.33 commit 913a00ec6b0939db5f2ba8356b912f783b6d8345 category: bugfix issue: #IB7W7N CVE: NA Signed-off-by: zhangshuqi <zhangshuqi3@huawei.com> --------------------------------------- [ Upstream commit b1781d0a1458070d40134e4f3412ec9d70099bec ] IRQ_DOMAIN is a hidden (not user visible) symbol. Users cannot set it directly thru "make *config", so drivers should select it instead of depending on it if they need it. Relying on it being set for a dependency is risky. Consistently using "select" or "depends on" can also help reduce Kconfig circular dependency issues. Therefore, change EXTCON_MAX8997's use of "depends on" for IRQ_DOMAIN to "select". Link: https://lore.kernel.org/lkml/20240213060028.9744-1-rdunlap@infradead.org/ Fixes: dca1a71e4108 ("extcon: Add support irq domain for MAX8997 muic") Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Acked-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: zhangshuqi <zhangshuqi3@huawei.com> | 1 年前 | |
firewire: core: correct range of block for case of switch statement stable inclusion from stable-6.6.54 commit 8e152448d0a099b71d64d3e52fcfc8175fbd123b category: bugfix issue: #IB7W7N CVE: NA Signed-off-by: zhangshuqi <zhangshuqi3@huawei.com> --------------------------------------- [ Upstream commit ebb9d3ca8f7efc1b6a2f1750d1058eda444883d0 ] A commit d8527cab6c31 ("firewire: cdev: implement new event to notify response subaction with time stamp") adds an additional case, FW_CDEV_EVENT_RESPONSE2, into switch statement in complete_transaction(). However, the range of block is beyond to the case label and reaches neibour default label. This commit corrects the range of block. Fortunately, it has few impacts in practice since the local variable in the scope under the label is not used in codes under default label. Fixes: d8527cab6c31 ("firewire: cdev: implement new event to notify response subaction with time stamp") Link: https://lore.kernel.org/r/20240810070403.36801-1-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: zhangshuqi <zhangshuqi3@huawei.com> | 1 年前 | |
firmware: arm_scmi: Ensure that the message-id supports fastchannel stable inclusion from stable-6.6.96 commit f9917821c527d7d1321b41aa4b4e3acdd8651946 category: bugfix issue: #ICCW0G CVE: NA Signed-off-by: Li Nan <linan122@huawei.com> --------------------------------------- commit 94a263f981a3fa3d93f65c31e0fed0756736be43 upstream. Currently the perf and powercap protocol relies on the protocol domain attributes, which just ensures that one fastchannel per domain, before instantiating fastchannels for all possible message-ids. Fix this by ensuring that each message-id supports fastchannel before initialization. Logs: | scmi: Failed to get FC for protocol 13 [MSG_ID:6 / RES_ID:0] - ret:-95. Using regular messaging | scmi: Failed to get FC for protocol 13 [MSG_ID:6 / RES_ID:1] - ret:-95. Using regular messaging | scmi: Failed to get FC for protocol 13 [MSG_ID:6 / RES_ID:2] - ret:-95. Using regular messaging CC: stable@vger.kernel.org Reported-by: Johan Hovold <johan+linaro@kernel.org> Closes: https://lore.kernel.org/lkml/ZoQjAWse2YxwyRJv@hovoldconsulting.com/ Fixes: 6f9ea4dabd2d ("firmware: arm_scmi: Generalize the fast channel support") Reviewed-by: Johan Hovold <johan+linaro@kernel.org> Tested-by: Johan Hovold <johan+linaro@kernel.org> Signed-off-by: Sibi Sankar <quic_sibis@quicinc.com> [Cristian: Modified the condition checked to establish support or not] Signed-off-by: Cristian Marussi <cristian.marussi@arm.com> Message-Id: <20250429141108.406045-2-cristian.marussi@arm.com> Signed-off-by: Sudeep Holla <sudeep.holla@arm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Li Nan <linan122@huawei.com> | 1 年前 | |
fpga: fix potential null pointer deref in fpga_mgr_test_img_load_sgt() stable inclusion from stable-6.6.94 commit e69e2cfd8b38d9463a250e153ef4963a604d61e9 category: bugfix issue: #ICCW0G CVE: NA Signed-off-by: Li Nan <linan122@huawei.com> --------------------------------------- [ Upstream commit 6ebf1982038af12f3588417e4fd0417d2551da28 ] fpga_mgr_test_img_load_sgt() allocates memory for sgt using kunit_kzalloc() however it does not check if the allocation failed. It then passes sgt to sg_alloc_table(), which passes it to __sg_alloc_table(). This function calls memset() on sgt in an attempt to zero it out. If the allocation fails then sgt will be NULL and the memset will trigger a NULL pointer dereference. Fix this by checking the allocation with KUNIT_ASSERT_NOT_ERR_OR_NULL(). Reviewed-by: Marco Pagani <marco.pagani@linux.dev> Fixes: ccbc1c302115 ("fpga: add an initial KUnit suite for the FPGA Manager") Signed-off-by: Qasim Ijaz <qasdev00@gmail.com> Acked-by: Xu Yilun <yilun.xu@intel.com> Link: https://lore.kernel.org/r/20250422153737.5264-1-qasdev00@gmail.com Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Li Nan <linan122@huawei.com> | 1 年前 | |
fsi: i2cr: Switch to use struct i2c_driver's .probe() struct i2c_driver::probe_new is about to go away. Switch the driver to use the probe callback with the same prototype. Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Reviewed-by: Eddie James <eajames@linux.ibm.com> Reviewed-by: Joel Stanley <joel@jms.id.au> Link: https://lore.kernel.org/r/20230816171944.123705-1-u.kleine-koenig@pengutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2 年前 | |
driver core: class: remove module * from class_create() The module pointer in class_create() never actually did anything, and it shouldn't have been requred to be set as a parameter even if it did something. So just remove it and fix up all callers of the function in the kernel tree at the same time. Cc: "Rafael J. Wysocki" <rafael@kernel.org> Acked-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> Link: https://lore.kernel.org/r/20230313181843.1207845-4-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 3 年前 | |
gpio: mlxbf3: only get IRQ for device instance 0 stable inclusion from stable-6.6.95 commit 6b4311f78a133fc3d6a4bedba0881ea399447d3a category: bugfix issue: #ICCW0G CVE: NA Signed-off-by: Li Nan <linan122@huawei.com> --------------------------------------- [ Upstream commit 10af0273a35ab4513ca1546644b8c853044da134 ] The gpio-mlxbf3 driver interfaces with two GPIO controllers, device instance 0 and 1. There is a single IRQ resource shared between the two controllers, and it is found in the ACPI table for device instance 0. The driver should not attempt to get an IRQ resource when probing device instance 1, otherwise the following error is logged: mlxbf3_gpio MLNXBF33:01: error -ENXIO: IRQ index 0 not found Signed-off-by: David Thompson <davthompson@nvidia.com> Reviewed-by: Shravan Kumar Ramani <shravankr@nvidia.com> Fixes: cd33f216d241 ("gpio: mlxbf3: Add gpio driver support") Link: https://lore.kernel.org/r/20250613163443.1065217-1-davthompson@nvidia.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Li Nan <linan122@huawei.com> | 1 年前 | |
!375 merge cve-fix-20260519 into master net: fix memory leak in skb_segment_list for GRO packets Created-by: llj123 Commit-by: Mohammad Heib;Thadeu Lima de Souza Cascardo;Paolo Abeni;Tetsuo Handa;Taeyang Lee;Peter Zijlstra;Eric Dumazet;John Johansen;Kaushlendra Kumar;Jens Axboe;Bert Karwatzki;Yongpeng Yang;Cheng-Yu Lee;Ariel Silver;Pablo Neira Ayuso;Ye Bin;Xu Yang;Zqiang;Theodore Ts'o;Alex Guo;Shaurya Rane;Yuan Tan;Jeffrey Bencteux;Xiang Mei;Weiming Shi;Luiz Augusto von Dentz;Daniil Dulov;Kohei Enju;Martin Ottens;Yuezhang Mo Merged-by: openharmony_ci Description: ## CVE 修复提交 本次提交包含 30 个 CVE 修复： - **CVE-2024-27065**: netfilter: nf_tables: do not compare internal table flags on updates - **CVE-2025-22111**: net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. - **CVE-2025-38693**: media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_t - **CVE-2025-38701**: ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr - **CVE-2025-38704**: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access - **CVE-2025-38725**: net: usb: asix_devices: add phy_mask for ax88772 mdio bus - **CVE-2025-39691**: fs/buffer: fix use-after-free when call bh_read() helper - **CVE-2025-71239**: audit: add fchmodat2() to change attributes class - **CVE-2026-22979**: net: fix memory leak in skb_segment_list for GRO packets - **CVE-2026-22994**: bpf: Fix reference count leak in bpf_prog_test_run_xdp() - **CVE-2026-23060**: crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - **CVE-2026-23071**: regmap: Fix race condition in hwspinlock irqsave routine - **CVE-2026-23120**: l2tp: avoid one data-race in l2tp_tunnel_del_work() - **CVE-2026-23246**: wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration - **CVE-2026-23253**: media: dvb-core: fix wrong reinitialization of ringbuffer on reopen - **CVE-2026-23254**: net: gro: fix outer network offset - **CVE-2026-23255**: net: add proper RCU protection to /proc/net/ptype - **CVE-2026-23260**: regmap: maple: free entry on mas_store_gfp() failure - **CVE-2026-23264**: Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" - **CVE-2026-23267**: f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes - **CVE-2026-23268**: apparmor: fix unprivileged local user can do privileged policy management - **CVE-2026-23271**: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race - **CVE-2026-23274**: netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer later - **CVE-2026-23336**: wifi: cfg80211: cancel rfkill_block work in wiphy_unregister - **CVE-2026-23359**: bpf: Fix stack-out-of-bounds write in devmap - **CVE-2026-23395**: Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - **CVE-2026-23396**: wifi: mac80211: fix NULL deref in mesh_matches_local() - **CVE-2026-23398**: icmp: fix NULL pointer dereference in icmp_tag_validation() - **CVE-2026-23409**: apparmor: fix differential encoding verification - **CVE-2026-23461**: Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user --- 提交由 cve-skill 自动处理生成。 See merge request: openharmony/kernel_linux_6.6!375 | 3 个月前 | |
greybus: Fix use-after-free bug in gb_interface_release due to race condition. stable inclusion from stable-6.6.35 commit 0b8fba38bdfb848fac52e71270b2aa3538c996ea category: bugfix issue: #IB7W7N CVE: NA Signed-off-by: zhangshuqi <zhangshuqi3@huawei.com> --------------------------------------- commit 5c9c5d7f26acc2c669c1dcf57d1bb43ee99220ce upstream. In gb_interface_create, &intf->mode_switch_completion is bound with gb_interface_mode_switch_work. Then it will be started by gb_interface_request_mode_switch. Here is the relevant code. if (!queue_work(system_long_wq, &intf->mode_switch_work)) { ... } If we call gb_interface_release to make cleanup, there may be an unfinished work. This function will call kfree to free the object "intf". However, if gb_interface_mode_switch_work is scheduled to run after kfree, it may cause use-after-free error as gb_interface_mode_switch_work will use the object "intf". The possible execution flow that may lead to the issue is as follows: CPU0 CPU1 | gb_interface_create | gb_interface_request_mode_switch gb_interface_release | kfree(intf) (free) | | gb_interface_mode_switch_work | mutex_lock(&intf->mutex) (use) Fix it by canceling the work before kfree. Signed-off-by: Sicong Huang <congei42@163.com> Link: https://lore.kernel.org/r/20240416080313.92306-1-congei42@163.com Cc: Ronnie Sahlberg <rsahlberg@ciq.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: zhangshuqi <zhangshuqi3@huawei.com> | 1 年前 | |
hck for linux-6.6 Signed-off-by: 朱佳鑫 <zhujiaxin@huawei.com> | 2 年前 | |
HID: core: clamp report_size in s32ton() to avoid undefined shift commit 69c02ffde6ed4d535fa4e693a9e572729cad3d0d upstream. s32ton() shifts by n-1 where n is the field's report_size, a value that comes directly from a HID device. The HID parser bounds report_size only to <= 256, so a broken HID device can supply a report descriptor with a wide field that triggers shift exponents up to 256 on a 32-bit type when an output report is built via hid_output_field() or hid_set_field(). Fix this up by just clamping the max value of n, just like snto32() does. CVE: CVE-2026-31624 Signed-off-by: llj123 <luojie119@h-partners.com> | 2 个月前 | |
HSI: ssi_protocol: Fix use after free vulnerability in ssi_protocol Driver Due to Race Condition stable inclusion from stable-6.6.88 commit 58eb29dba712ab0f13af59ca2fe545f5ce360e78 category: bugfix issue: #IC6IH3 CVE: NA Signed-off-by: zyf1116 <zhouyongfei3@huawei.com> --------------------------------------- commit e3f88665a78045fe35c7669d2926b8d97b892c11 upstream. In the ssi_protocol_probe() function, &ssi->work is bound with ssip_xmit_work(), In ssip_pn_setup(), the ssip_pn_xmit() function within the ssip_pn_ops structure is capable of starting the work. If we remove the module which will call ssi_protocol_remove() to make a cleanup, it will free ssi through kfree(ssi), while the work mentioned above will be used. The sequence of operations that may lead to a UAF bug is as follows: CPU0 CPU1 | ssip_xmit_work ssi_protocol_remove | kfree(ssi); | | struct hsi_client *cl = ssi->cl; | // use ssi Fix it by ensuring that the work is canceled before proceeding with the cleanup in ssi_protocol_remove(). Signed-off-by: Kaixin Wang <kxwang23@m.fudan.edu.cn> Acked-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://lore.kernel.org/r/20240918120749.1730-1-kxwang23@m.fudan.edu.cn Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: zyf1116 <zhouyongfei3@huawei.com> | 1 年前 | |
hte: tegra: Fix missing error code in tegra_hte_test_probe() [ Upstream commit b7c3ca3553d1de5e86c85636828e186d30cd0628 ] The value of 'ret' is zero when of_hte_req_count() fails to get number of entitties to timestamp. And returning success(zero) on this failure path is incorrect. Fixes: 9a75a7cd03c9 ("hte: Add Tegra HTE test driver") Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com> Reviewed-by: Dipen Patel <dipenp@nvidia.com> Signed-off-by: Dipen Patel <dipenp@nvidia.com> Signed-off-by: Sasha Levin <sashal@kernel.org> | 2 年前 | |
Drivers: hv: vmbus: Add utility function for querying ring size stable inclusion from stable-6.6.96 commit ebba6cc0781c00566ab7a11d9307cd093a787881 category: bugfix issue: #ICCW0G CVE: NA Signed-off-by: Li Nan <linan122@huawei.com> --------------------------------------- [ Upstream commit e8c4bd6c6e6b7e7b416c42806981c2a81370001e ] Add a function to query for the preferred ring buffer size of VMBus device. This will allow the drivers (eg. UIO) to allocate the most optimized ring buffer size for devices. Signed-off-by: Saurabh Sengar <ssengar@linux.microsoft.com> Reviewed-by: Long Li <longli@microsoft.com> Link: https://lore.kernel.org/r/1711788723-8593-2-git-send-email-ssengar@linux.microsoft.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Stable-dep-of: 0315fef2aff9 ("uio_hv_generic: Align ring size to system page") Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Li Nan <linan122@huawei.com> | 1 年前 | |
af_unix: Set gc_in_progress to true in unix_gc(). Change-Id: I2050ef3e823079b8006412207d03d6c34a84454e Signed-off-by: wanghao794 <wanghao865@huawei.com> | 1 个月前 | |
hwspinlock: Introduce hwspin_lock_bust() stable inclusion from stable-6.6.50 commit a6978d1b7bb8f3a25305e8ff7d367f7289614c5d category: bugfix issue: #IB7W7N CVE: NA Signed-off-by: zhangshuqi <zhangshuqi3@huawei.com> --------------------------------------- [ Upstream commit 7c327d56597d8de1680cf24e956b704270d3d84a ] When a remoteproc crashes or goes down unexpectedly this can result in a state where locks held by the remoteproc will remain locked possibly resulting in deadlock. This new API hwspin_lock_bust() allows hwspinlock implementers to define a bust operation for freeing previously acquired hwspinlocks after verifying ownership of the acquired lock. Signed-off-by: Richard Maina <quic_rmaina@quicinc.com> Reviewed-by: Bjorn Andersson <andersson@kernel.org> Signed-off-by: Chris Lew <quic_clew@quicinc.com> Link: https://lore.kernel.org/r/20240529-hwspinlock-bust-v3-1-c8b924ffa5a2@quicinc.com Signed-off-by: Bjorn Andersson <andersson@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: zhangshuqi <zhangshuqi3@huawei.com> | 1 年前 | |
coresight: ETR: Fix ETR buffer use-after-free issue stable inclusion from stable-6.6.105 commit 35501ac3c7d40 category: bugfix issue: #207 CVE: CVE-2025-68376 Signed-off-by: 何京晶 <18967138853@163.com> Co-Authored-By: Agent ------------------------------- coresight: ETR: Fix ETR buffer use-after-free issue When ETR is enabled as CS_MODE_SYSFS, if the buffer size is changed and enabled again, currently sysfs_buf will point to the newly allocated memory(buf_new) and free the old memory(buf_old). But the etr_buf that is being used by the ETR remains pointed to buf_old, not updated to buf_new. In this case, it will result in a memory use-after-free issue. Fix this by checking ETR's mode before updating and releasing buf_old, if the mode is CS_MODE_SYSFS, then skip updating and releasing it. Fixes: bd2767ec3df2 ("coresight: Fix run time warnings while reusing ETR buffer") Signed-off-by: Xiaoqi Zhuang <xiaoqi.zhuang@oss.qualcomm.com> Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com> Tested-by: Leo Yan <leo.yan@arm.com> Link: https://lore.kernel.org/r/20251021-fix_etr_issue-v3-1-99a2d066fee2@oss.qualcomm.com Signed-off-by: 何京晶 <18967138853@163.com> | 5 个月前 | |
feat: support hyperhold Signed-off-by: minjie.yu <minjie.yu@unionman.com.cn> | 2 年前 | |
回退 'Pull Request !193 : lts升级 6.6.101->6.6.102' | 11 个月前 | |
i3c: mipi-i3c-hci: Fix race in DMA ring dequeue mainline inclusion from mainline-6.6.100 commit 1dca8aee80eea76d2aae21265de5dd64f6ba0f09 category: bugfix issue: #722 CVE: CVE-2026-43353 ------------------------------- i3c: mipi-i3c-hci: Fix race in DMA ring dequeue The HCI DMA dequeue path (hci_dma_dequeue_xfer()) may be invoked for multiple transfers that timeout around the same time. However, the function is not serialized and can race with itself. When a timeout occurs, hci_dma_dequeue_xfer() stops the ring, processes incomplete transfers, and then restarts the ring. If another timeout triggers a parallel call into the same function, the two instances may interfere with each other - stopping or restarting the ring at unexpected times. Add a mutex so that hci_dma_dequeue_xfer() is serialized with respect to itself. Fixes: 9ad9a52cce282 ("i3c/master: introduce the mipi-i3c-hci driver") Cc: stable@vger.kernel.org Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20260306072451.11131-7-adrian.hunter@intel.com Signed-off-by: Hun_Dun <18967138853@163.com> | 3 个月前 | |
intel_idle: Handle older CPUs, which stop the TSC in deeper C states, correctly stable inclusion from stable-6.6.81 commit 3b7d2d1b42d2b7ea4700173c0d785743c1f84dd4 category: bugfix issue: #IC1IVT CVE: NA Signed-off-by: zyf1116 <zhouyongfei3@huawei.com> --------------------------------------- commit c157d351460bcf202970e97e611cb6b54a3dd4a4 upstream. The Intel idle driver is preferred over the ACPI processor idle driver, but fails to implement the work around for Core2 generation CPUs, where the TSC stops in C2 and deeper C-states. This causes stalls and boot delays, when the clocksource watchdog does not catch the unstable TSC before the CPU goes deep idle for the first time. The ACPI driver marks the TSC unstable when it detects that the CPU supports C2 or deeper and the CPU does not have a non-stop TSC. Add the equivivalent work around to the Intel idle driver to cure that. Fixes: 18734958e9bf ("intel_idle: Use ACPI _CST for processor models without C-state tables") Reported-by: Fab Stz <fabstz-it@yahoo.fr> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Tested-by: Fab Stz <fabstz-it@yahoo.fr> Cc: All applicable <stable@vger.kernel.org> Closes: https://lore.kernel.org/all/10cf96aa-1276-4bd4-8966-c890377030c3@yahoo.fr Link: https://patch.msgid.link/87bjupfy7f.ffs@tglx Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: zyf1116 <zhouyongfei3@huawei.com> | 1 年前 | |
iio: accel: bmc150: Fix irq assumption regression stable inclusion from stable-6.6.105 commit 3aa385a9c75c0 category: bugfix issue: #206 CVE: CVE-2025-68330 Signed-off-by: w00955705 <wangchenyang65@huawei.com> --------------------------------------- The code in bmc150-accel-core.c unconditionally calls bmc150_accel_set_interrupt() in the iio_buffer_setup_ops, such as on the runtime PM resume path giving a kernel splat like this if the device has no interrupts: Unable to handle kernel NULL pointer dereference at virtual address 00000001 when read PC is at bmc150_accel_set_interrupt+0x98/0x194 LR is at __pm_runtime_resume+0x5c/0x64 (...) Call trace: bmc150_accel_set_interrupt from bmc150_accel_buffer_postenable+0x40/0x108 bmc150_accel_buffer_postenable from __iio_update_buffers+0xbe0/0xcbc __iio_update_buffers from enable_store+0x84/0xc8 enable_store from kernfs_fop_write_iter+0x154/0x1b4 This bug seems to have been in the driver since the beginning, but it only manifests recently, I do not know why. Store the IRQ number in the state struct, as this is a common pattern in other drivers, then use this to determine if we have IRQ support or not. Cc: stable@vger.kernel.org Signed-off-by: Linus Walleij <linus.walleij@linaro.org> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com> Reviewed-by: Nuno Sá <nuno.sa@analog.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Co-Authored-By: Agent Signed-off-by: w00955705 wangchenyang65@huawei.com | 5 个月前 | |
x86-64: rename misleadingly named '__copy_user_nocache()' function mainline inclusion from mainline-6.6.101 commit d187a86de793f84766ea40b9ade7ac60aabbb4fe category: bugfix issue: #722 CVE: CVE-2026-43073 ------------------------------- x86-64: rename misleadingly named '__copy_user_nocache()' function This function was a masterclass in bad naming, for various historical reasons. It claimed to be a non-cached user copy. It is literally _neither_ of those things. It's a specialty memory copy routine that uses non-temporal stores for the destination (but not the source), and that does exception handling for both source and destination accesses. Also note that while it works for unaligned targets, any unaligned parts (whether at beginning or end) will not use non-temporal stores, since only words and quadwords can be non-temporal on x86. The exception handling means that it _can_ be used for user space accesses, but not on its own - it needs all the normal "start user space access" logic around it. But typically the user space access would be the source, not the non-temporal destination. That was the original intention of this, where the destination was some fragile persistent memory target that needed non-temporal stores in order to catch machine check exceptions synchronously and deal with them gracefully. Thus that non-descriptive name: one use case was to copy from user space into a non-cached kernel buffer. However, the existing users are a mix of that intended use-case, and a couple of random drivers that just did this as a performance tweak. Some of those random drivers then actively misused the user copying version (with STAC/CLAC and all) to do kernel copies without ever even caring about the exception handling, _just_ for the non-temporal destination. Rename it as a first small step to actually make it halfway sane, and change the prototype to be more normal: it doesn't take a user pointer unless the caller has done the proper conversion, and the argument size is the full size_t (it still won't actually copy more than 4GB in one go, but there's also no reason to silently truncate the size argument in the caller). Finally, use this now sanely named function in the NTB code, which mis-used a user copy version (with STAC/CLAC and all) of this interface despite it not actually being a user copy at all. Signed-off-by: Hun_Dun <18967138853@163.com> | 3 个月前 | |
Input: uinput - fix circular locking dependency with ff-core commit 4cda78d6f8bf2b700529f2fbccb994c3e826d7c2 upstream. A lockdep circular locking dependency warning can be triggered reproducibly when using a force-feedback gamepad with uinput (for example, playing ELDEN RING under Wine with a Flydigi Vader 5 controller): ff->mutex -> udev->mutex -> input_mutex -> dev->mutex -> ff->mutex The cycle is caused by four lock acquisition paths: 1. ff upload: input_ff_upload() holds ff->mutex and calls uinput_dev_upload_effect() -> uinput_request_submit() -> uinput_request_send(), which acquires udev->mutex. 2. device create: uinput_ioctl_handler() holds udev->mutex and calls uinput_create_device() -> input_register_device(), which acquires input_mutex. 3. device register: input_register_device() holds input_mutex and calls kbd_connect() -> input_register_handle(), which acquires dev->mutex. 4. evdev release: evdev_release() calls input_flush_device() under dev->mutex, which calls input_ff_flush() acquiring ff->mutex. Fix this by introducing a new state_lock spinlock to protect udev->state and udev->dev access in uinput_request_send() instead of acquiring udev->mutex. The function only needs to atomically check device state and queue an input event into the ring buffer via uinput_dev_event() -- both operations are safe under a spinlock (ktime_get_ts64() and wake_up_interruptible() do not sleep). This breaks the ff->mutex -> udev->mutex link since a spinlock is a leaf in the lock ordering and cannot form cycles with mutexes. To keep state transitions visible to uinput_request_send(), protect writes to udev->state in uinput_create_device() and uinput_destroy_device() with the same state_lock spinlock. Additionally, move init_completion(&request->done) from uinput_request_send() to uinput_request_submit() before uinput_request_reserve_slot(). Once the slot is allocated, uinput_flush_requests() may call complete() on it at any time from the destroy path, so the completion must be initialised before the request becomes visible. Lock ordering after the fix: ff->mutex -> state_lock (spinlock, leaf) udev->mutex -> state_lock (spinlock, leaf) udev->mutex -> input_mutex -> dev->mutex -> ff->mutex (no back-edge) Fixes: ff462551235d ("Input: uinput - switch to the new FF interface") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/all/CABXGCsMoxag+kEwHhb7KqhuyxfmGGd0P=tHZyb1uKE0pLr8Hkg@mail.gmail.com/ Signed-off-by: llj123 <luojie119@h-partners.com> Link: https://patch.msgid.link/20260407075031.38351-1-mikhail.v.gavrilov@gmail.com | 2 个月前 | |
回退 'Pull Request !193 : lts升级 6.6.101->6.6.102' | 11 个月前 | |
iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode mainline inclusion from mainline-6.6.100 commit 42662d19839f34735b718129ea200e3734b07e50 category: bugfix issue: #722 CVE: CVE-2026-43161 ------------------------------- iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode PCIe endpoints with ATS enabled and passed through to userspace (e.g., QEMU, DPDK) can hard-lock the host when their link drops, either by surprise removal or by a link fault. Commit 4fc82cd907ac ("iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected") adds pci_dev_is_disconnected() to devtlb_invalidation_with_pasid() so ATS invalidation is skipped only when the device is being safely removed, but it applies only when Intel IOMMU scalable mode is enabled. With scalable mode disabled or unsupported, a system hard-lock occurs when a PCIe endpoint's link drops because the Intel IOMMU waits indefinitely for an ATS invalidation that cannot complete. Call Trace: qi_submit_sync qi_flush_dev_iotlb __context_flush_dev_iotlb.part.0 domain_context_clear_one_cb pci_for_each_dma_alias device_block_translation blocking_domain_attach_dev iommu_deinit_device __iommu_group_remove_device iommu_release_device iommu_bus_notifier blocking_notifier_call_chain bus_notify device_del pci_remove_bus_device pci_stop_and_remove_bus_device pciehp_unconfigure_device pciehp_disable_slot pciehp_handle_presence_or_link_change pciehp_ist Commit 81e921fd3216 ("iommu/vt-d: Fix NULL domain on device release") adds intel_pasid_teardown_sm_context() to intel_iommu_release_device(), which calls qi_flush_dev_iotlb() and can also hard-lock the system when a PCIe endpoint's link drops. Call Trace: qi_submit_sync qi_flush_dev_iotlb __context_flush_dev_iotlb.part.0 intel_context_flush_no_pasid device_pasid_table_teardown pci_pasid_table_teardown pci_for_each_dma_alias intel_pasid_teardown_sm_context intel_iommu_release_device iommu_deinit_device __iommu_group_remove_device iommu_release_device iommu_bus_notifier blocking_notifier_call_chain bus_notify device_del pci_remove_bus_device pci_stop_and_remove_bus_device pciehp_unconfigure_device pciehp_disable_slot pciehp_handle_presence_or_link_change pciehp_ist Sometimes the endpoint loses connection without a link-down event (e.g., due to a link fault); killing the process (virsh destroy) then hard-locks the host. Call Trace: qi_submit_sync qi_flush_dev_iotlb __context_flush_dev_iotlb.part.0 domain_context_clear_one_cb pci_for_each_dma_alias device_block_translation blocking_domain_attach_dev __iommu_attach_device __iommu_device_set_domain __iommu_group_set_domain_internal iommu_detach_group vfio_iommu_type1_detach_group vfio_group_detach_container vfio_group_fops_release __fput pci_dev_is_disconnected() only covers safe-removal paths; pci_device_is_present() tests accessibility by reading vendor/device IDs and internally calls pci_dev_is_disconnected(). On a ConnectX-5 (8 GT/s, x2) this costs ~70 µs. Since __context_flush_dev_iotlb() is only called on {attach,release}_dev paths (not hot), add pci_device_is_present() there to skip inaccessible devices and avoid the hard-lock. Fixes: 37764b952e1b ("iommu/vt-d: Global devTLB flush when present context entry changed") Fixes: 81e921fd3216 ("iommu/vt-d: Fix NULL domain on device release") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20251211035946.2071-2-guojinhui.liam@bytedance.com Signed-off-by: Hun_Dun <18967138853@163.com> | 3 个月前 | |
tty: make tty_operations::write()'s count size_t Unify with the rest of the code. Use size_t for counts and ssize_t for retval. Signed-off-by: "Jiri Slaby (SUSE)" <jirislaby@kernel.org> Link: https://lore.kernel.org/r/20230810091510.13006-30-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2 年前 | |
irqchip/gic-v3-its: Avoid truncating memory addresses stable inclusion from stable-6.6.119 commit 8d76a7d89c12d08382b66e2f21f20d0627d14859 category: bugfix issue: CVE: CVE-2026-23085 Signed-off-by: Hun_Dun <18967138853@163.com> Co-Authored-By: Agent ------------------------------- irqchip/gic-v3-its: Avoid truncating memory addresses On 32-bit machines with CONFIG_ARM_LPAE, it is possible for lowmem allocations to be backed by addresses physical memory above the 32-bit address limit, as found while experimenting with larger VMSPLIT configurations. This caused the qemu virt model to crash in the GICv3 driver, which allocates the 'itt' object using GFP_KERNEL. Since all memory below the 4GB physical address limit is in ZONE_DMA in this configuration, kmalloc() defaults to higher addresses for ZONE_NORMAL, and the ITS driver stores the physical address in a 32-bit 'unsigned long' variable. Change the itt_addr variable to the correct phys_addr_t type instead, along with all other variables in this driver that hold a physical address. The gicv5 driver correctly uses u64 variables, while all other irqchip drivers don't call virt_to_phys or similar interfaces. It's expected that other device drivers have similar issues, but fixing this one is sufficient for booting a virtio based guest. Fixes: cc2d3216f53c ("irqchip: GICv3: ITS command queue") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Reviewed-by: Marc Zyngier <maz@kernel.org> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260119201603.2713066-1-arnd@kernel.org Signed-off-by: Hun_Dun <18967138853@163.com> | 3 个月前 | |
isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() stable inclusion from stable-6.6.105 commit 3f978e3f15701 category: bugfix issue: #207 CVE: CVE-2025-68734 Signed-off-by: 何京晶 <18967138853@163.com> Co-Authored-By: Agent ------------------------------- isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() In hfcsusb_probe(), the memory allocated for ctrl_urb gets leaked when setup_instance() fails with an error code. Fix that by freeing the urb before freeing the hw structure. Also change the error paths to use the goto ladder style. Compile tested only. Issue found using a prototype static analysis tool. Fixes: 69f52adb2d53 ("mISDN: Add HFC USB driver") Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in> Link: https://patch.msgid.link/20251030042524.194812-1-nihaal@cse.iitm.ac.in Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: 何京晶 <18967138853@163.com> | 5 个月前 | |
leds: led-class: Only Add LED to leds_list when it is fully ready stable inclusion from stable-6.6.119 commit d1883cefd31752f0504b94c3bcfa1f6d511d6e87 category: bugfix issue: CVE: CVE-2026-23101 Signed-off-by: Hun_Dun <18967138853@163.com> Co-Authored-By: Agent ------------------------------- leds: led-class: Only Add LED to leds_list when it is fully ready Before this change the LED was added to leds_list before led_init_core() gets called adding it the list before led_classdev.set_brightness_work gets initialized. This leaves a window where led_trigger_register() of a LED's default trigger will call led_trigger_set() which calls led_set_brightness() which in turn will end up queueing the *uninitialized* led_classdev.set_brightness_work. This race gets hit by the lenovo-thinkpad-t14s EC driver which registers 2 LEDs with a default trigger provided by snd_ctl_led.ko in quick succession. The first led_classdev_register() causes an async modprobe of snd_ctl_led to run and that async modprobe manages to exactly hit the window where the second LED is on the leds_list without led_init_core() being called for it, resulting in: ------------[ cut here ]------------ WARNING: CPU: 11 PID: 5608 at kernel/workqueue.c:4234 __flush_work+0x344/0x390 Hardware name: LENOVO 21N2S01F0B/21N2S01F0B, BIOS N42ET93W (2.23 ) 09/01/2025 ... Call trace: __flush_work+0x344/0x390 (P) flush_work+0x2c/0x50 led_trigger_set+0x1c8/0x340 led_trigger_register+0x17c/0x1c0 led_trigger_register_simple+0x84/0xe8 snd_ctl_led_init+0x40/0xf88 [snd_ctl_led] do_one_initcall+0x5c/0x318 do_init_module+0x9c/0x2b8 load_module+0x7e0/0x998 Close the race window by moving the adding of the LED to leds_list to after the led_init_core() call. Cc: stable@vger.kernel.org Fixes: d23a22a74fde ("leds: delay led_set_brightness if stopping soft-blink") Signed-off-by: Hans de Goede <johannes.goede@oss.qualcomm.com> Reviewed-by: Sebastian Reichel <sre@kernel.org> Link: https://patch.msgid.link/20251211163727.366441-1-johannes.goede@oss.qualcomm.com Signed-off-by: Lee Jones <lee@kernel.org> Signed-off-by: Hun_Dun <18967138853@163.com> | 3 个月前 | |
macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse stable inclusion from stable-6.6.105 commit 1e4b207ffe54c category: bugfix issue: #207 CVE: CVE-2025-68367 Signed-off-by: 何京晶 <18967138853@163.com> Co-Authored-By: Agent ------------------------------- macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse The following warning appears when running syzkaller, and this issue also exists in the mainline code. ------------[ cut here ]------------ list_add double add: new=ffffffffa57eee28, prev=ffffffffa57eee28, next=ffffffffa5e63100. WARNING: CPU: 0 PID: 1491 at lib/list_debug.c:35 __list_add_valid_or_report+0xf7/0x130 Modules linked in: CPU: 0 PID: 1491 Comm: syz.1.28 Not tainted 6.6.0+ #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:__list_add_valid_or_report+0xf7/0x130 RSP: 0018:ff1100010dfb7b78 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffffffffa57eee18 RCX: ffffffff97fc9817 RDX: 0000000000040000 RSI: ffa0000002383000 RDI: 0000000000000001 RBP: ffffffffa57eee28 R08: 0000000000000001 R09: ffe21c0021bf6f2c R10: 0000000000000001 R11: 6464615f7473696c R12: ffffffffa5e63100 R13: ffffffffa57eee28 R14: ffffffffa57eee28 R15: ff1100010dfb7d48 FS: 00007fb14398b640(0000) GS:ff11000119600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000010d096005 CR4: 0000000000773ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 80000000 Call Trace: <TASK> input_register_handler+0xb3/0x210 mac_hid_start_emulation+0x1c5/0x290 mac_hid_toggle_emumouse+0x20a/0x240 proc_sys_call_handler+0x4c2/0x6e0 new_sync_write+0x1b1/0x2d0 vfs_write+0x709/0x950 ksys_write+0x12a/0x250 do_syscall_64+0x5a/0x110 entry_SYSCALL_64_after_hwframe+0x78/0xe2 The WARNING occurs when two processes concurrently write to the mac-hid emulation sysctl, causing a race condition in mac_hid_toggle_emumouse(). Both processes read old_val=0, then both try to register the input handler, leading to a double list_add of the same handler. CPU0 CPU1 ------------------------- ------------------------- vfs_write() //write 1 vfs_write() //write 1 proc_sys_write() proc_sys_write() mac_hid_toggle_emumouse() mac_hid_toggle_emumouse() old_val = *valp // old_val=0 old_val = *valp // old_val=0 mutex_lock_killable() proc_dointvec() // *valp=1 mac_hid_start_emulation() input_register_handler() mutex_unlock() mutex_lock_killable() proc_dointvec() mac_hid_start_emulation() input_register_handler() //Trigger Warning mutex_unlock() Fix this by moving the old_val read inside the mutex lock region. Fixes: 99b089c3c38a ("Input: Mac button emulation - implement as an input filter") Signed-off-by: Long Li <leo.lilong@huawei.com> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20250819091035.2263329-1-leo.lilong@huaweicloud.com Signed-off-by: 何京晶 <18967138853@163.com> | 5 个月前 | |
backport: fix linux-6.6 CVE build fallout Adapt recent CVE backports to the OpenHarmony 6.6 tree and rk3568 build. Fix vmalloc KASAN release batching scope, xfrm aevent size accounting, and mailbox phandle argument validation for the local 6.6 APIs. Signed-off-by: Hun_Dun <18967138853@163.com> | 3 个月前 | |
mcb: fix a double free bug in chameleon_parse_gdd() stable inclusion from stable-6.6.89 commit 96838eb1836fd372e42be5db84f0b333b65146a6 category: bugfix issue: #IC6IH3 CVE: NA Signed-off-by: zyf1116 <zhouyongfei3@huawei.com> --------------------------------------- commit 7c7f1bfdb2249f854a736d9b79778c7e5a29a150 upstream. In chameleon_parse_gdd(), if mcb_device_register() fails, 'mdev' would be released in mcb_device_register() via put_device(). Thus, goto 'err' label and free 'mdev' again causes a double free. Just return if mcb_device_register() fails. Fixes: 3764e82e5150 ("drivers: Introduce MEN Chameleon Bus") Cc: stable <stable@kernel.org> Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com> Signed-off-by: Johannes Thumshirn <jth@kernel.org> Link: https://lore.kernel.org/r/6201d09e2975ae5789879f79a6de4c38de9edd4a.1741596225.git.jth@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: zyf1116 <zhouyongfei3@huawei.com> | 1 年前 | |
md raid: fix hang when stopping arrays with metadata through dm-raid mainline inclusion from mainline-6.6.100 commit cefcb9297fbdb6d94b61787b4f8d84f55b741470 category: bugfix issue: #722 CVE: CVE-2026-43309 ------------------------------- md raid: fix hang when stopping arrays with metadata through dm-raid When using device-mapper's dm-raid target, stopping a RAID array can cause the system to hang under specific conditions. This occurs when: - A dm-raid managed device tree is suspended from top to bottom (the top-level RAID device is suspended first, followed by its underlying metadata and data devices) - The top-level RAID device is then removed Removing the top-level device triggers a hang in the following sequence: the dm-raid destructor calls md_stop(), which tries to flush the write-intent bitmap by writing to the metadata sub-devices. However, these devices are already suspended, making them unable to complete the write-intent operations and causing an indefinite block. Fix: - Prevent bitmap flushing when md_stop() is called from dm-raid destructor context and avoid a quiescing/unquescing cycle which could also cause I/O - Still allow write-intent bitmap flushing when called from dm-raid suspend context This ensures that RAID array teardown can complete successfully even when the underlying devices are in a suspended state. This second patch uses md_is_rdwr() to distinguish between suspend and destructor paths as elaborated on above. Link: https://lore.kernel.org/linux-raid/CAM23VxqYrwkhKEBeQrZeZwQudbiNey2_8B_SEOLqug=pXxaFrA@mail.gmail.com Signed-off-by: Hun_Dun <18967138853@163.com> | 3 个月前 | |
media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() Signed-off-by: llj123 <luojie119@h-partners.com> commit 782b6a718651eda3478b1824b37a8b3185d2740c upstream. The buffer length check before calling uvc_parse_format() only ensured that the buffer has at least 3 bytes (buflen > 2), buf the function accesses buffer[3], requiring at least 4 bytes. This can lead to an out-of-bounds read if the buffer has exactly 3 bytes. Fix it by checking that the buffer has at least 4 bytes in uvc_parse_format(). Signed-off-by: Youngjun Lee <yjjuny.lee@samsung.com> Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Fixes: c0efd232929c ("V4L/DVB (8145a): USB Video Class driver") Cc: stable@vger.kernel.org Reviewed-by: Ricardo Ribalda <ribalda@chromium.org> Link: https://lore.kernel.org/r/20250610124107.37360-1-yjjuny.lee@samsung.com Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com> Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 29af99191f322f8aeb79ac79130b6303875dd842) | 2 个月前 | |
memory: omap-gpmc: drop no compatible check stable inclusion from stable-6.6.87 commit aaf534ad0720d2d8c989162c3086de393266375d category: bugfix issue: #IC6IH3 CVE: NA Signed-off-by: zyf1116 <zhouyongfei3@huawei.com> --------------------------------------- [ Upstream commit edcccc6892f65eff5fd3027a13976131dc7fd733 ] We are no longer depending on legacy device trees so drop the no compatible check for NAND and OneNAND nodes. Suggested-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Roger Quadros <rogerq@kernel.org> Reviewed-by: Rob Herring (Arm) <robh@kernel.org> Link: https://lore.kernel.org/r/20250114-omap-gpmc-drop-no-compatible-check-v1-1-262c8d549732@kernel.org Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: zyf1116 <zhouyongfei3@huawei.com> | 1 年前 | |
memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() stable inclusion from stable-6.6.100 commit 4206824af6dd983d4347570e5a9e0f59ac80fb5a category: bugfix issue: #ICCW0G CVE: NA Signed-off-by: Li Nan <linan122@huawei.com> --------------------------------------- commit 21b34a3a204ed616373a12ec17dc127ebe51eab3 upstream. A new warning in clang [1] points out that id_reg is uninitialized then passed to memstick_init_req() as a const pointer: drivers/memstick/core/memstick.c:330:59: error: variable 'id_reg' is uninitialized when passed as a const pointer argument here [-Werror,-Wuninitialized-const-pointer] 330 | memstick_init_req(&card->current_mrq, MS_TPC_READ_REG, &id_reg, | ^~~~~~ Commit de182cc8e882 ("drivers/memstick/core/memstick.c: avoid -Wnonnull warning") intentionally passed this variable uninitialized to avoid an -Wnonnull warning from a NULL value that was previously there because id_reg is never read from the call to memstick_init_req() in h_memstick_read_dev_id(). Just zero initialize id_reg to avoid the warning, which is likely happening in the majority of builds using modern compilers that support '-ftrivial-auto-var-init=zero'. Cc: stable@vger.kernel.org Fixes: de182cc8e882 ("drivers/memstick/core/memstick.c: avoid -Wnonnull warning") Link: https://github.com/llvm/llvm-project/commit/00dacf8c22f065cb52efb14cd091d441f19b319e [1] Closes: https://github.com/ClangBuiltLinux/linux/issues/2105 Signed-off-by: Nathan Chancellor <nathan@kernel.org> Link: https://lore.kernel.org/r/20250715-memstick-fix-uninit-const-pointer-v1-1-f6753829c27a@kernel.org Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Li Nan <linan122@huawei.com> | 1 年前 | |
scsi: fusion: Remove unused variable 'rc' stable inclusion from stable-6.6.64 commit ac3c9fb621de1db40addedd3ae67add10a315134 category: bugfix issue: #IBE7K0 CVE: NA Signed-off-by: zyf1116 <zhouyongfei3@huawei.com> --------------------------------------- [ Upstream commit bd65694223f7ad11c790ab63ad1af87a771192ee ] The return value of scsi_device_reprobe() is currently ignored in _scsih_reprobe_lun(). Fixing the calling code to deal with the potential error is non-trivial, so for now just WARN_ON(). The handling of scsi_device_reprobe()'s return value refers to _scsih_reprobe_lun() and the following link: https://lore.kernel.org/all/094fdbf57487af4f395238c0525b2a560c8f68f0.1469766027.git.calvinowens@fb.com/ Fixes: f99be43b3024 ("[SCSI] fusion: power pc and miscellaneous bug fixs") Signed-off-by: Zeng Heng <zengheng4@huawei.com> Link: https://lore.kernel.org/r/20241024084417.154655-1-zengheng4@huawei.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: zyf1116 <zhouyongfei3@huawei.com> | 1 年前 | |
mfd: max14577: Fix wakeup source leaks on device unbind stable inclusion from stable-6.6.96 commit f0ba7e6d06f24b5586781324f1efee550df4f8f9 category: bugfix issue: #ICCW0G CVE: NA Signed-off-by: Li Nan <linan122@huawei.com> --------------------------------------- [ Upstream commit d905d06e64b0eb3da43af6186c132f5282197998 ] Device can be unbound, so driver must also release memory for the wakeup source. Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Link: https://lore.kernel.org/r/20250406-mfd-device-wakekup-leak-v1-3-318e14bdba0a@linaro.org Signed-off-by: Lee Jones <lee@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Li Nan <linan122@huawei.com> | 1 年前 | |
NexusLand: a new high performance IPC machanism Signed-off-by: Bryan_Wu <wyp1536481268@foxmail.com> | 4 个月前 | |
mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode stable inclusion from stable-6.6.119 commit 3009738a855cf938bbfc9078bec725031ae623a4 category: bugfix issue: CVE: CVE-2025-71200 Signed-off-by: Hun_Dun <18967138853@163.com> Co-Authored-By: Agent ------------------------------- mmc: sdhci-of-dwcmshc: Prevent illegal clock reduction in HS200/HS400 mode When operating in HS200 or HS400 timing modes, reducing the clock frequency below 52MHz will lead to link broken as the Rockchip DWC MSHC controller requires maintaining a minimum clock of 52MHz in these modes. Add a check to prevent illegal clock reduction through debugfs: root@debian:/# echo 50000000 > /sys/kernel/debug/mmc0/clock root@debian:/# [ 30.090146] mmc0: running CQE recovery mmc0: cqhci: Failed to halt mmc0: cqhci: spurious TCN for tag 0 WARNING: drivers/mmc/host/cqhci-core.c:797 at cqhci_irq+0x254/0x818, CPU#1: kworker/1:0H/24 Modules linked in: CPU: 1 UID: 0 PID: 24 Comm: kworker/1:0H Not tainted 6.19.0-rc1-00001-g09db0998649d-dirty #204 PREEMPT Hardware name: Rockchip RK3588 EVB1 V10 Board (DT) Workqueue: kblockd blk_mq_run_work_fn pstate: 604000c9 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : cqhci_irq+0x254/0x818 lr : cqhci_irq+0x254/0x818 ... Fixes: c6f361cba51c ("mmc: sdhci-of-dwcmshc: add support for rk3588") Cc: Sebastian Reichel <sebastian.reichel@collabora.com> Cc: Yifeng Zhao <yifeng.zhao@rock-chips.com> Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com> Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org> Signed-off-by: Hun_Dun <18967138853@163.com> | 3 个月前 | |
staging: most: Replace all non-returning strlcpy with strscpy strlcpy() reads the entire source buffer first. This read may exceed the destination size limit. This is both inefficient and can lead to linear read overflows if a source string is not NUL-terminated [1]. In an effort to remove strlcpy() completely [2], replace strlcpy() here with strscpy(). No return values were used, so direct replacement is safe. [1] https://www.kernel.org/doc/html/latest/process/deprecated.html#strlcpy [2] https://github.com/KSPP/linux/issues/89 Signed-off-by: Azeem Shaikh <azeemshaikh38@gmail.com> Reviewed-by: Kees Cook <keescook@chromium.org> Signed-off-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/20230523021640.2406585-1-azeemshaikh38@gmail.com | 3 年前 | |
mtd: rawnand: cadence: fix DMA device NULL pointer dereference stable inclusion from stable-6.6.105 commit 5c56bf214af85 category: bugfix issue: #207 CVE: CVE-2025-68238 Signed-off-by: 何京晶 <18967138853@163.com> Co-Authored-By: Agent ------------------------------- mtd: rawnand: cadence: fix DMA device NULL pointer dereference The DMA device pointer dma_dev was being dereferenced before ensuring that cdns_ctrl->dmac is properly initialized. Move the assignment of dma_dev after successfully acquiring the DMA channel to ensure the pointer is valid before use. Fixes: d76d22b5096c ("mtd: rawnand: cadence: use dma_map_resource for sdma address") Cc: stable@vger.kernel.org Signed-off-by: Niravkumar L Rabara <niravkumarlaxmidas.rabara@altera.com> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com> Signed-off-by: 何京晶 <18967138853@163.com> | 5 个月前 | |
mux: Explicitly include correct DT includes The DT of_device.h and of_platform.h date back to the separate of_platform_bus_type before it was merged into the regular platform bus. As part of that merge prepping Arm DT support 13 years ago, they "temporarily" include each other. They also include platform_device.h and of.h. As a result, there's a pretty much random mix of those include files used throughout the tree. In order to detangle these headers and replace the implicit includes with struct declarations, users need to explicitly include the correct includes. Link: https://lore.kernel.org/r/20230714174754.4060608-1-robh@kernel.org Signed-off-by: Rob Herring <robh@kernel.org> | 2 年前 | |
!384 merge cve-fix-20260522-kernel_linux_6.6-master into master CVE修复: kernel_linux_6.6 master (55 个安全补丁) - 2026-05-22 Created-by: Hun_Dun Commit-by: Hun_Dun Merged-by: openharmony_ci Description: ## CVE 修复列表 | CVE ID | 标题 | Commit | |--------|------|--------| | CVE-2026-31726 | usb: gadget: uvc: fix NULL pointer dereference dur... | c78e463ee134 | | CVE-2026-31759 | usb: ulpi: fix double free in ulpi_register_interf... | aaeae6533d77 | | CVE-2026-43024 | netfilter: nf_tables: reject immediate NF_QUEUE ve... | 4b12a3cc3f07 | | CVE-2026-43026 | netfilter: ctnetlink: zero expect NAT fields when ... | 2898080c054e | | CVE-2026-43027 | netfilter: nf_conntrack_helper: pass helper to exp... | 2cf2737c85a2 | | CVE-2026-43028 | netfilter: x_tables: ensure names are nul-terminat... | c2d4a3abb15c | | CVE-2026-43035 | net: sched: cls_api: fix tc_chain_fill_node to ini... | e35f5195cd44 | | CVE-2026-43060 | netfilter: nft_ct: drop pending enqueued packets o... | e68a8db3a054 | | CVE-2026-43073 | x86-64: rename misleadingly named '__copy_user_noc... | d187a86de793 | | CVE-2026-43077 | crypto: algif_aead - Fix minimum RX size check for... | 3d14bd48e3a7 | | CVE-2026-43080 | l2tp: Drop large packets with UDP encap | ebe560ea5f54 | | CVE-2026-43082 | net: txgbe: leave space for null terminators on pr... | 5a37d228799b | | CVE-2026-43085 | netfilter: nfnetlink_log: initialize nfgenmsg in N... | 1f3083aec883 | | CVE-2026-43086 | ipvs: fix NULL deref in ip_vs_add_service error pa... | 9a91797e61d2 | | CVE-2026-43088 | net: af_key: zero aligned sockaddr tail in PF_KEY ... | 426c355742f0 | | CVE-2026-43089 | xfrm_user: fix info leak in build_mapping() | 1beb76b2053b | | CVE-2026-43091 | xfrm: Wait for RCU readers during policy netns exi... | 069daad4f2ae | | CVE-2026-43107 | xfrm: account XFRMA_IF_ID in aevent size calculati... | 7081d46d3231 | | CVE-2026-43114 | netfilter: nft_set_pipapo_avx2: don't return non-m... | d3c0037ffe12 | | CVE-2026-43116 | netfilter: ctnetlink: ensure safe access to master... | bffcaad9afdf | | CVE-2026-43128 | RDMA/umem: Fix double dma_buf_unpin in failure pat... | b324327ff6f4 | | CVE-2026-43129 | ima: verify the previous kernel's IMA buffer lies ... | 10d1c75ed438 | | CVE-2026-43130 | iommu/vt-d: Flush dev-IOTLB only when PCIe device ... | 01aed2f1d7cb | | CVE-2026-43136 | HID: logitech-hidpp: Check maxfield in hidpp_get_r... | b74bf7d0d01f | | CVE-2026-43139 | xfrm6: fix uninitialized saddr in xfrm6_get_saddr(... | 719918fc88df | | CVE-2026-43161 | iommu/vt-d: Skip dev-iotlb flush for inaccessible ... | 42662d19839f | | CVE-2026-43167 | xfrm: always flush state and policy upon NETDEV_UN... | 166801e49a5b | | CVE-2026-43180 | net: usb: kaweth: remove TX queue manipulation in ... | ef9b10a02050 | | CVE-2026-43190 | netfilter: xt_tcpmss: check remaining length befor... | 07a9b32eaae7 | | CVE-2026-43199 | net/mlx5e: Fix "scheduling while atomic" in IPsec ... | 859380694f43 | | CVE-2026-43238 | net/sched: act_skbedit: fix divide-by-zero in tcf_... | 9c735a7d98c9 | | CVE-2026-43248 | vhost: move vdpa group bound check to vhost_vdpa | cd025c1e876b | | CVE-2026-43281 | mailbox: Prevent out-of-bounds access in fw_mbox_i... | 31c4c67dec33 | | CVE-2026-43292 | mm/vmalloc: prevent RCU stalls in kasan_release_vm... | 5747435e0fd4 | | CVE-2026-43304 | libceph: define and enforce CEPH_MAX_KEY_LEN | e1dc45d97975 | | CVE-2026-43309 | md raid: fix hang when stopping arrays with metada... | cefcb9297fbd | | CVE-2026-43310 | media: verisilicon: Avoid G2 bus error while decod... | e0203ddf9af7 | | CVE-2026-43319 | spi: spidev: fix lock inversion between spi_lock a... | 40534d19ed2a | | CVE-2026-43324 | USB: dummy-hcd: Fix interrupt synchronization erro... | 5aa776c8615b | | CVE-2026-43330 | crypto: caam - fix overflow on long hmac keys | 31022cfde523 | | CVE-2026-43332 | thermal: core: Fix thermal zone device registratio... | 9e796001af97 | | CVE-2026-43339 | ipv6: prevent possible UaF in addrconf_permanent_a... | 7d9f2f4aabd1 | | CVE-2026-43353 | i3c: mipi-i3c-hci: Fix race in DMA ring dequeue | 1dca8aee80ee | | CVE-2026-43406 | libceph: prevent potential out-of-bounds reads in ... | 50156622eb08 | | CVE-2026-43413 | scsi: hisi_sas: Fix NULL pointer exception during ... | 70c78429ef38 | | CVE-2026-43439 | cgroup: fix race between task migration and iterat... | 3dfd1328c052 | | CVE-2026-43441 | net: bonding: Fix nd_tbl NULL dereference when IPv... | cf6099ef493b | | CVE-2026-43450 | netfilter: nfnetlink_cthelper: fix OOB read in nfn... | 4a1f6ee69267 | | CVE-2026-43451 | netfilter: nfnetlink_queue: fix entry leak in brid... | 47b1c5d1b094 | | CVE-2026-43452 | netfilter: x_tables: guard option walkers against ... | 9b94f0e42ed2 | | CVE-2026-43453 | netfilter: nft_set_pipapo: fix stack out-of-bounds... | 0a55d62cdb62 | | CVE-2026-43456 | bonding: fix type confusion in bond_setup_by_slave... | 950803f72547 | | CVE-2026-43466 | net/mlx5e: Fix DMA FIFO desync on error CQE SQ rec... | 383b37c04a48 | | CVE-2026-43468 | net/mlx5: Fix deadlock between devlink lock and es... | 957d2a58f7f8 | | CVE-2026-43475 | scsi: storvsc: Fix scheduling while atomic on PREE... | e7919a293f9b | **来源**: Cherry-pick from stable-tags/v6.6.134~18 ## 统计 - **总数**: 60 - **成功**: 55 - **空提交（已存在）**: 3 - **跳过**: 2 ## 修复详情 ### CVE-2026-31726 - **Commit**: c78e463ee134b4669579d453c81ae00795e4c19a - **Stable**: tags/v6.6.134~18 - **标题**: usb: gadget: uvc: fix NULL pointer dereference during unbind race ### CVE-2026-31759 - **Commit**: aaeae6533d77e6ed4def85baec01e2815ebbef61 - **Stable**: tags/v6.6.134~56 - **标题**: usb: ulpi: fix double free in ulpi_register_interface() error path ### CVE-2026-43024 - **Commit**: 4b12a3cc3f075e750cc3c5e693fd25fb400af4a2 - **Stable**: tags/v6.6.134~116 - **标题**: netfilter: nf_tables: reject immediate NF_QUEUE verdict ### CVE-2026-43026 - **Commit**: 2898080c054ea4d6ddfaaf21bbedbc229a9a8376 - **Stable**: tags/v6.6.134~122 - **标题**: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent ### CVE-2026-43027 - **Commit**: 2cf2737c85a2ba2b52024dafe68ffad2676f97be - **Stable**: tags/v6.6.134~123 - **标题**: netfilter: nf_conntrack_helper: pass helper to expect cleanup ### CVE-2026-43028 - **Commit**: c2d4a3abb15ca14716c6d8b9ffcbcd7c63626af4 - **Stable**: tags/v6.6.134~125 - **标题**: netfilter: x_tables: ensure names are nul-terminated ### CVE-2026-43035 - **Commit**: e35f5195cd44ff4053fbc5d71ea97681728a0099 - **Stable**: tags/v6.6.134~132 - **标题**: net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak ### CVE-2026-43060 - **Commit**: e68a8db3a0546482b34e9ca5ca886bcf73eb37bb - **Stable**: tags/v6.6.130~52 - **标题**: netfilter: nft_ct: drop pending enqueued packets on removal ### CVE-2026-43073 - **Commit**: d187a86de793f84766ea40b9ade7ac60aabbb4fe - **Stable**: tags/v7.1-rc1~251^2~2 - **标题**: x86-64: rename misleadingly named '__copy_user_nocache()' function ### CVE-2026-43077 - **Commit**: 3d14bd48e3a77091cbce637a12c2ae31b4a1687c - **Stable**: tags/v7.0~7^2 - **标题**: crypto: algif_aead - Fix minimum RX size check for decryption ### CVE-2026-43080 - **Commit**: ebe560ea5f54134279356703e73b7f867c89db13 - **Stable**: tags/v7.0~27^2~2 - **标题**: l2tp: Drop large packets with UDP encap ### CVE-2026-43082 - **Commit**: 5a37d228799b0ec2c277459c83c814a59d310bc3 - **Stable**: tags/v7.0~27^2~11 - **标题**: net: txgbe: leave space for null terminators on property_entry ### CVE-2026-43085 - **Commit**: 1f3083aec8836213da441270cdb1ab612dd82cf4 - **Stable**: tags/v7.0~27^2~16^2~5 - **标题**: netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator ### CVE-2026-43086 - **Commit**: 9a91797e61d286805ae10a92cc48959c30800556 - **Stable**: tags/v7.0~27^2~16^2~6 - **标题**: ipvs: fix NULL deref in ip_vs_add_service error path ### CVE-2026-43088 - **Commit**: 426c355742f02cf743b347d9d7dbdc1bfbfa31ef - **Stable**: tags/v7.0~27^2~14^2 - **标题**: net: af_key: zero aligned sockaddr tail in PF_KEY exports ### CVE-2026-43089 - **Commit**: 1beb76b2053b68c491b78370794b8ff63c8f8c02 - **Stable**: tags/v7.0~27^2~14^2~2 - **标题**: xfrm_user: fix info leak in build_mapping() ### CVE-2026-43091 - **Commit**: 069daad4f2ae9c5c108131995529d5f02392c446 - **Stable**: tags/v7.0~27^2~14^2~5 - **标题**: xfrm: Wait for RCU readers during policy netns exit ### CVE-2026-43107 - **Commit**: 7081d46d32312f1a31f0e0e99c6835a394037599 - **Stable**: tags/v7.0~27^2~14^2~6 - **标题**: xfrm: account XFRMA_IF_ID in aevent size calculation ### CVE-2026-43114 - **Commit**: d3c0037ffe1273fa1961e779ff6906234d6cf53c - **Stable**: tags/v7.0-rc6~40^2^2~11 - **标题**: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry ### CVE-2026-43116 - **Commit**: bffcaad9afdfe45d7fc777397d3b83c1e3ebffe5 - **Stable**: tags/v7.0-rc6~40^2^2~4 - **标题**: netfilter: ctnetlink: ensure safe access to master conntrack ### CVE-2026-43128 - **Commit**: b324327ff6f48d8065dca67eb3b91357e72726bd - **Stable**: tags/v6.6.128~137 - **标题**: RDMA/umem: Fix double dma_buf_unpin in failure path ### CVE-2026-43129 - **Commit**: 10d1c75ed4382a8e79874379caa2ead8952734f9 - **Stable**: tags/v7.0-rc1~46^2~76 - **标题**: ima: verify the previous kernel's IMA buffer lies in addressable RAM ### CVE-2026-43130 - **Commit**: 01aed2f1d7cb8fdf4c60c5bb4727608cb82b401d - **Stable**: tags/v6.6.128~70 - **标题**: iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode ### CVE-2026-43136 - **Commit**: b74bf7d0d01fa9b53653f58c29aa00772121f6e9 - **Stable**: tags/v6.6.128~111 - **标题**: HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() ### CVE-2026-43139 - **Commit**: 719918fc88df6da023dfff370cd965151a5afd7f - **Stable**: tags/v6.6.128~157 - **标题**: xfrm6: fix uninitialized saddr in xfrm6_get_saddr() ### CVE-2026-43161 - **Commit**: 42662d19839f34735b718129ea200e3734b07e50 - **Stable**: tags/v7.0-rc1~137^2^3~6 - **标题**: iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode ### CVE-2 See merge request: openharmony/kernel_linux_6.6!384 | 3 个月前 | |
nfc: pn533: Add poll mod list filling check stable inclusion from stable-6.6.49 commit 56ad559cf6d87f250a8d203b555dfc3716afa946 category: bugfix issue: #IB7W7N CVE: NA Signed-off-by: zhangshuqi <zhangshuqi3@huawei.com> --------------------------------------- [ Upstream commit febccb39255f9df35527b88c953b2e0deae50e53 ] In case of im_protocols value is 1 and tm_protocols value is 0 this combination successfully passes the check 'if (!im_protocols && !tm_protocols)' in the nfc_start_poll(). But then after pn533_poll_create_mod_list() call in pn533_start_poll() poll mod list will remain empty and dev->poll_mod_count will remain 0 which lead to division by zero. Normally no im protocol has value 1 in the mask, so this combination is not expected by driver. But these protocol values actually come from userspace via Netlink interface (NFC_CMD_START_POLL operation). So a broken or malicious program may pass a message containing a "bad" combination of protocol parameter values so that dev->poll_mod_count is not incremented inside pn533_poll_create_mod_list(), thus leading to division by zero. Call trace looks like: nfc_genl_start_poll() nfc_start_poll() ->start_poll() pn533_start_poll() Add poll mod list filling check. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: dfccd0f58044 ("NFC: pn533: Add some polling entropy") Signed-off-by: Aleksandr Mishin <amishin@t-argos.ru> Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Link: https://patch.msgid.link/20240827084822.18785-1-amishin@t-argos.ru Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: zhangshuqi <zhangshuqi3@huawei.com> | 1 年前 | |
x86-64: rename misleadingly named '__copy_user_nocache()' function mainline inclusion from mainline-6.6.101 commit d187a86de793f84766ea40b9ade7ac60aabbb4fe category: bugfix issue: #722 CVE: CVE-2026-43073 ------------------------------- x86-64: rename misleadingly named '__copy_user_nocache()' function This function was a masterclass in bad naming, for various historical reasons. It claimed to be a non-cached user copy. It is literally _neither_ of those things. It's a specialty memory copy routine that uses non-temporal stores for the destination (but not the source), and that does exception handling for both source and destination accesses. Also note that while it works for unaligned targets, any unaligned parts (whether at beginning or end) will not use non-temporal stores, since only words and quadwords can be non-temporal on x86. The exception handling means that it _can_ be used for user space accesses, but not on its own - it needs all the normal "start user space access" logic around it. But typically the user space access would be the source, not the non-temporal destination. That was the original intention of this, where the destination was some fragile persistent memory target that needed non-temporal stores in order to catch machine check exceptions synchronously and deal with them gracefully. Thus that non-descriptive name: one use case was to copy from user space into a non-cached kernel buffer. However, the existing users are a mix of that intended use-case, and a couple of random drivers that just did this as a performance tweak. Some of those random drivers then actively misused the user copying version (with STAC/CLAC and all) to do kernel copies without ever even caring about the exception handling, _just_ for the non-temporal destination. Rename it as a first small step to actually make it halfway sane, and change the prototype to be more normal: it doesn't take a user pointer unless the caller has done the proper conversion, and the argument size is the full size_t (it still won't actually copy more than 4GB in one go, but there's also no reason to silently truncate the size argument in the caller). Finally, use this now sanely named function in the NTB code, which mis-used a user copy version (with STAC/CLAC and all) of this interface despite it not actually being a user copy at all. Signed-off-by: Hun_Dun <18967138853@163.com> | 3 个月前 | |
nubus: Don't list slot resources by default Some Nubus card ROMs contain many slot resources. A single Radius video card produced well over a thousand entries under /proc/bus/nubus/. Populating /proc/bus/nubus/ on a slow machine with several such cards installed takes long enough that the user may think that the system is wedged. All those procfs entries also consume significant RAM though they are not normally needed (except by developers). Omit these resources from /proc/bus/nubus/ by default and add a kernel parameter to enable them when needed. On the test machine, this saved 300 kB and 10 seconds. Cc: Brad Boyer <flar@allandria.com> Reviewed-by: Brad Boyer <flar@allandria.com> Tested-by: Stan Johnson <userm57@yahoo.com> Signed-off-by: Finn Thain <fthain@linux-m68k.org> Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org> Link: https://lore.kernel.org/r/71ed7fb234a5f7381a50253b0d841a656d53e64c.1684200125.git.fthain@linux-m68k.org Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org> | 3 年前 | |
nvdimm/bus: Fix potential use after free in asynchronous initialization mainline inclusion from mainline-6.6 commit e48bf8f1d2b12c1c5ba1f609edbd4cde5dadc20e category: bugfix CVE: CVE-2026-31399 Signed-off-by: 姜小林 <jiangxiaolin11@huawei.com> Co-Authored-By: Agent ------------------------------- commit a8aec14230322ed8f1e8042b6d656c1631d41163 upstream. Dingisoul with KASAN reports a use after free if device_add() fails in nd_async_device_register(). Commit b6eae0f61db2 ("libnvdimm: Hold reference on parent while scheduling async init") correctly added a reference on the parent device to be held until asynchronous initialization was complete. However, if device_add() results in an allocation failure the ref count of the device drops to 0 prior to the parent pointer being accessed. Thus resulting in use after free. The bug bot AI correctly identified the fix. Save a reference to the parent pointer to be used to drop the parent reference regardless of the outcome of device_add(). Reported-by: Dingisoul <dingiso.kernel@gmail.com> Closes: http://lore.kernel.org/8855544b-be9e-4153-aa55-0bc328b13733@gmail.com Fixes: b6eae0f61db2 ("libnvdimm: Hold reference on parent while scheduling async init") Cc: stable@vger.kernel.org Reviewed-by: Dave Jiang <dave.jiang@intel.com> Link: https://patch.msgid.link/20260306-fix-uaf-async-init-v1-1-a28fd7526723@intel.com Signed-off-by: Ira Weiny <ira.weiny@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 3 个月前 | |
nvme-pci: ensure we're polling a polled queue mainline inclusion from mainline-6.6.131 commit 166e31d7dbf6aa44829b98aa446bda5c9580f12a category: bugfix issue: #723 CVE: CVE-2026-31523 Signed-off-by: 姜小林 <jiangxiaolin11@huawei.com> ------------------------------- A user can change the polled queue count at run time. There's a brief window during a reset where a hipri task may try to poll that queue before the block layer has updated the queue maps, which would race with the now interrupt driven queue and may cause double completions. Reviewed-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Kanchan Joshi <joshi.k@samsung.com> Signed-off-by: Keith Busch <kbusch@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> | 3 个月前 | |
nvmem: layouts: u-boot-env: remove crc32 endianness conversion stable inclusion from stable-6.6.100 commit 48e8791843206baf76827df1b6ee3cb88a2a17d8 category: bugfix issue: #ICCW0G CVE: NA Signed-off-by: Li Nan <linan122@huawei.com> --------------------------------------- commit 2d7521aa26ec2dc8b877bb2d1f2611a2df49a3cf upstream. On 11 Oct 2022, it was reported that the crc32 verification of the u-boot environment failed only on big-endian systems for the u-boot-env nvmem layout driver with the following error. Invalid calculated CRC32: 0x88cd6f09 (expected: 0x096fcd88) This problem has been present since the driver was introduced, and before it was made into a layout driver. The suggested fix at the time was to use further endianness conversion macros in order to have both the stored and calculated crc32 values to compare always represented in the system's endianness. This was not accepted due to sparse warnings and some disagreement on how to handle the situation. Later on in a newer revision of the patch, it was proposed to use cpu_to_le32() for both values to compare instead of le32_to_cpu() and store the values as __le32 type to remove compilation errors. The necessity of this is based on the assumption that the use of crc32() requires endianness conversion because the algorithm uses little-endian, however, this does not prove to be the case and the issue is unrelated. Upon inspecting the current kernel code, there already is an existing use of le32_to_cpu() in this driver, which suggests there already is special handling for big-endian systems, however, it is big-endian systems that have the problem. This, being the only functional difference between architectures in the driver combined with the fact that the suggested fix was to use the exact same endianness conversion for the values brings up the possibility that it was not necessary to begin with, as the same endianness conversion for two values expected to be the same is expected to be equivalent to no conversion at all. After inspecting the u-boot environment of devices of both endianness and trying to remove the existing endianness conversion, the problem is resolved in an equivalent way as the other suggested fixes. Ultimately, it seems that u-boot is agnostic to endianness at least for the purpose of environment variables. In other words, u-boot reads and writes the stored crc32 value with the same endianness that the crc32 value is calculated with in whichever endianness a certain architecture runs on. Therefore, the u-boot-env driver does not need to convert endianness. Remove the usage of endianness macros in the u-boot-env driver, and change the type of local variables to maintain the same return type. If there is a special situation in the case of endianness, it would be a corner case and should be handled by a unique "compatible". Even though it is not necessary to use endianness conversion macros here, it may be useful to use them in the future for consistent error printing. Fixes: d5542923f200 ("nvmem: add driver handling U-Boot environment variables") Reported-by: INAGAKI Hiroshi <musashino.open@gmail.com> Link: https://lore.kernel.org/all/20221011024928.1807-1-musashino.open@gmail.com Cc: stable@vger.kernel.org Signed-off-by: "Michael C. Pratt" <mcpratt@pm.me> Signed-off-by: Srinivas Kandagatla <srini@kernel.org> Link: https://lore.kernel.org/r/20250716144210.4804-1-srini@kernel.org [ applied changes to drivers/nvmem/u-boot-env.c before code was moved to drivers/nvmem/layouts/u-boot-env.c ] Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Li Nan <linan122@huawei.com> | 1 年前 | |
dfx for memory Signed-off-by: Marine Tears <1191161286@qq.com> | 11 个月前 | |
OPP: OF: Fix an OF node leak in _opp_add_static_v2() stable inclusion from stable-6.6.76 commit 7ec98ebb38dc612f4692d1041db072f72da30832 category: bugfix issue: #IBLFX7 CVE: NA Signed-off-by: zyf1116 <zhouyongfei3@huawei.com> --------------------------------------- [ Upstream commit 1d38eb7f7b26261a0b642f6e0923269c7c000a97 ] _opp_add_static_v2() leaks the obtained OF node reference when _of_opp_alloc_required_opps() fails. Add an of_node_put() call in the error path. Fixes: 3466ea2cd6b6 ("OPP: Don't drop opp->np reference while it is still in use") Signed-off-by: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp> Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: zyf1116 <zhouyongfei3@huawei.com> | 1 年前 | |
parisc: Do not reprogram affinitiy on ASP chip stable inclusion from stable-6.6.105 commit dca7da244349 category: bugfix issue: #223 CVE: CVE-2025-71121 Signed-off-by: zxl <1554188414@qq.com> ------------------------------- parisc: Do not reprogram affinitiy on ASP chip The ASP chip is a very old variant of the GSP chip and is used e.g. in HP 730 workstations. When trying to reprogram the affinity it will crash with a HPMC as the relevant registers don't seem to be at the usual location. Let's avoid the crash by checking the sversion. Also note, that reprogramming isn't necessary either, as the HP730 is a just a single-CPU machine. Signed-off-by: Helge Deller <deller@gmx.de> Cc: stable@vger.kernel.org Signed-off-by: zxl <1554188414@qq.com> | 5 个月前 | |
parport: Proper fix for array out-of-bounds access stable inclusion from stable-6.6.58 commit 66029078fee00646e2e9dbb8f41ff7819f8e7569 category: bugfix issue: #IB7W7N CVE: NA Signed-off-by: zhangshuqi <zhangshuqi3@huawei.com> --------------------------------------- commit 02ac3a9ef3a18b58d8f3ea2b6e46de657bf6c4f9 upstream. The recent fix for array out-of-bounds accesses replaced sprintf() calls blindly with snprintf(). However, since snprintf() returns the would-be-printed size, not the actually output size, the length calculation can still go over the given limit. Use scnprintf() instead of snprintf(), which returns the actually output letters, for addressing the potential out-of-bounds access properly. Fixes: ab11dac93d2d ("dev/parport: fix the array out-of-bounds risk") Cc: stable@vger.kernel.org Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://lore.kernel.org/r/20240920103318.19271-1-tiwai@suse.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: zhangshuqi <zhangshuqi3@huawei.com> | 1 年前 | |
PCI: Fix pci_slot_trylock() error handling mainline inclusion from mainline-6.6 commit 9368d1ee62829b08aa31836b3ca003803caf0b72 category: bugfix CVE: CVE-2026-43211 Signed-off-by: 姜小林 <jiangxiaolin11@huawei.com> Co-Authored-By: Agent ------------------------------- Commit a4e772898f8b ("PCI: Add missing bridge lock to pci_bus_lock()") delegates the bridge device's pci_dev_trylock() to pci_bus_trylock() in pci_slot_trylock(), but it forgets to remove the corresponding pci_dev_unlock() when pci_bus_trylock() fails. Before a4e772898f8b, the code did: if (!pci_dev_trylock(dev)) /* <- lock bridge device */ goto unlock; if (dev->subordinate) { if (!pci_bus_trylock(dev->subordinate)) { pci_dev_unlock(dev); /* <- unlock bridge device */ goto unlock; } } After a4e772898f8b the bridge-device lock is no longer taken, but the pci_dev_unlock(dev) on the failure path was left in place, leading to the bug. This yields one of two errors: 1. A warning that the lock is being unlocked when no one holds it. 2. An incorrect unlock of a lock that belongs to another thread. Fix it by removing the now-redundant pci_dev_unlock(dev) on the failure path. [Same patch later posted by Keith at https://patch.msgid.link/20260116184150.3013258-1-kbusch@meta.com] Fixes: a4e772898f8b ("PCI: Add missing bridge lock to pci_bus_lock()") Signed-off-by: Jinhui Guo <guojinhui.liam@bytedance.com> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Reviewed-by: Dan Williams <dan.j.williams@intel.com> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20251212145528.2555-1-guojinhui.liam@bytedance.com Signed-off-by: Sasha Levin <sashal@kernel.org> | 3 个月前 | |
pcmcia: Use resource_size function on resource object stable inclusion from stable-6.6.51 commit dd48992a8a90e787df1cf76b2518e8212c94e0d0 category: bugfix issue: #IB7W7N CVE: NA Signed-off-by: zhangshuqi <zhangshuqi3@huawei.com> --------------------------------------- [ Upstream commit 24a025497e7e883bd2adef5d0ece1e9b9268009f ] Cocinnele reports a warning WARNING: Suspicious code. resource_size is maybe missing with root The root cause is the function resource_size is not used when needed Use resource_size() on variable "root" of type resource Signed-off-by: Jules Irenge <jbi.octave@gmail.com> Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: zhangshuqi <zhangshuqi3@huawei.com> | 1 年前 | |
Merge tag 'peci-next-6.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/iwi/linux into char-misc-next Iwona writes: Update peci-next for v6.6-rc1 * Add Intel Sapphire Rapids support. * Add Nuvoton controller driver. * tag 'peci-next-6.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/iwi/linux: arm64: dts: nuvoton: Add PECI controller node ARM: dts: nuvoton: Add PECI controller node peci: Add peci-npcm controller driver dt-bindings: Add bindings for peci-npcm hwmon: (peci/dimmtemp) Add Sapphire Rapids support hwmon: (peci/cputemp) Add Intel Sapphire Rapids support peci: cpu: Add Intel Sapphire Rapids support | 2 年前 | |
perf/amlogic: Replace smp_processor_id() with raw_smp_processor_id() in meson_ddr_pmu_create() stable inclusion from stable-6.6.94 commit 77511c2d2d1cbce8d9b4f50849843dd469d14173 category: bugfix issue: #ICCW0G CVE: NA Signed-off-by: Li Nan <linan122@huawei.com> --------------------------------------- [ Upstream commit 097469a2b0f12b91b4f27b9e9e4f2c46484cde30 ] The Amlogic DDR PMU driver meson_ddr_pmu_create() function incorrectly uses smp_processor_id(), which assumes disabled preemption. This leads to kernel warnings during module loading because meson_ddr_pmu_create() can be called in a preemptible context. Following kernel warning and stack trace: [ 31.745138] [ T2289] BUG: using smp_processor_id() in preemptible [00000000] code: (udev-worker)/2289 [ 31.745154] [ T2289] caller is debug_smp_processor_id+0x28/0x38 [ 31.745172] [ T2289] CPU: 4 UID: 0 PID: 2289 Comm: (udev-worker) Tainted: GW 6.14.0-0-MANJARO-ARM #1 59519addcbca6ba8de735e151fd7b9e97aac7ff0 [ 31.745181] [ T2289] Tainted: [W]=WARN [ 31.745183] [ T2289] Hardware name: Hardkernel ODROID-N2Plus (DT) [ 31.745188] [ T2289] Call trace: [ 31.745191] [ T2289] show_stack+0x28/0x40 (C) [ 31.745199] [ T2289] dump_stack_lvl+0x4c/0x198 [ 31.745205] [ T2289] dump_stack+0x20/0x50 [ 31.745209] [ T2289] check_preemption_disabled+0xec/0xf0 [ 31.745213] [ T2289] debug_smp_processor_id+0x28/0x38 [ 31.745216] [ T2289] meson_ddr_pmu_create+0x200/0x560 [meson_ddr_pmu_g12 8095101c49676ad138d9961e3eddaee10acca7bd] [ 31.745237] [ T2289] g12_ddr_pmu_probe+0x20/0x38 [meson_ddr_pmu_g12 8095101c49676ad138d9961e3eddaee10acca7bd] [ 31.745246] [ T2289] platform_probe+0x98/0xe0 [ 31.745254] [ T2289] really_probe+0x144/0x3f8 [ 31.745258] [ T2289] __driver_probe_device+0xb8/0x180 [ 31.745261] [ T2289] driver_probe_device+0x54/0x268 [ 31.745264] [ T2289] __driver_attach+0x11c/0x288 [ 31.745267] [ T2289] bus_for_each_dev+0xfc/0x160 [ 31.745274] [ T2289] driver_attach+0x34/0x50 [ 31.745277] [ T2289] bus_add_driver+0x160/0x2b0 [ 31.745281] [ T2289] driver_register+0x78/0x120 [ 31.745285] [ T2289] __platform_driver_register+0x30/0x48 [ 31.745288] [ T2289] init_module+0x30/0xfe0 [meson_ddr_pmu_g12 8095101c49676ad138d9961e3eddaee10acca7bd] [ 31.745298] [ T2289] do_one_initcall+0x11c/0x438 [ 31.745303] [ T2289] do_init_module+0x68/0x228 [ 31.745311] [ T2289] load_module+0x118c/0x13a8 [ 31.745315] [ T2289] __arm64_sys_finit_module+0x274/0x390 [ 31.745320] [ T2289] invoke_syscall+0x74/0x108 [ 31.745326] [ T2289] el0_svc_common+0x90/0xf8 [ 31.745330] [ T2289] do_el0_svc+0x2c/0x48 [ 31.745333] [ T2289] el0_svc+0x60/0x150 [ 31.745337] [ T2289] el0t_64_sync_handler+0x80/0x118 [ 31.745341] [ T2289] el0t_64_sync+0x1b8/0x1c0 Changes replaces smp_processor_id() with raw_smp_processor_id() to ensure safe CPU ID retrieval in preemptible contexts. Cc: Jiucheng Xu <jiucheng.xu@amlogic.com> Fixes: 2016e2113d35 ("perf/amlogic: Add support for Amlogic meson G12 SoC DDR PMU driver") Signed-off-by: Anand Moon <linux.amoon@gmail.com> Link: https://lore.kernel.org/r/20250407063206.5211-1-linux.amoon@gmail.com Signed-off-by: Will Deacon <will@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Li Nan <linan122@huawei.com> | 1 年前 | |
phy: tegra: xusb: Disable periodic tracking on Tegra234 stable inclusion from stable-6.6.100 commit ad2437f4abcae4410771bb6625981365e001a871 category: bugfix issue: #ICCW0G CVE: NA Signed-off-by: Li Nan <linan122@huawei.com> --------------------------------------- commit 7be54870e9bf5ed0b4fe2a23b41a630527882de5 upstream. Periodic calibration updates (~10µs) may overlap with transfers when PCIe NVMe SSD, LPDDR, and USB2 devices operate simultaneously, causing crosstalk on Tegra234 devices. Hence disable periodic calibration updates and make this a one-time calibration. Fixes: d8163a32ca95 ("phy: tegra: xusb: Add Tegra234 support") Cc: stable@vger.kernel.org Signed-off-by: Haotien Hsu <haotienh@nvidia.com> Signed-off-by: Wayne Chang <waynec@nvidia.com> Reviewed-by: Jon Hunter <jonathanh@nvidia.com> Tested-by: Jon Hunter <jonathanh@nvidia.com> Link: https://lore.kernel.org/r/20250519090929.3132456-3-waynec@nvidia.com Signed-off-by: Vinod Koul <vkoul@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Li Nan <linan122@huawei.com> | 1 年前 | |
回退 'Pull Request !193 : lts升级 6.6.101->6.6.102' | 11 个月前 | |
!289 merge cve_remain-fixmsg-72 into master cve漏洞修复 Created-by: chenyang_w Commit-by: w00955705;Qu Wenruo Merged-by: openharmony_ci Description: ### 一、内容说明（相关的Issue） ### 二、建议测试周期和提测地址 建议测试完成时间：xxxx.xx.xx 投产上线时间：xxxx.xx.xx 提测地址：CI环境/压测环境 测试账号： ### 三、变更内容 * 3.1 关联PR列表 * 3.2 数据库和部署说明 1. 常规更新 2. 重启unicorn 3. 重启sidekiq 4. 迁移任务：是否有迁移任务，没有写 "无" 5. rake脚本： bundle exec xxx RAILS_ENV = production；没有写 "无" * 3.4 其他技术优化内容（做了什么，变更了什么） - 重构了 xxxx 代码 - xxxx 算法优化 * 3.5 废弃通知（什么字段、方法弃用？） * 3.6 后向不兼容变更（是否有无法向后兼容的变更？） ### 四、研发自测点（自测哪些？冒烟用例全部自测？） 自测测试结论： ### 五、测试关注点（需要提醒QA重点关注的、可能会忽略的地方） 检查点： | 需求名称 | 是否影响xx公共模块 | 是否需要xx功能 | 需求升级是否依赖其他子产品 | |------|------------|----------|---------------| | xxx | 否 | 需要 | 不需要 | | | | | | 接口测试： 性能测试： 并发测试： 其他： See merge request: openharmony/kernel_linux_6.6!289 | 5 个月前 | |
pmdomain: imx: gpcv2: use proper helper for property detection stable inclusion from stable-6.6.93 commit ef7ee9b815345436a9e639f928d02b4fe99c0fb9 category: bugfix issue: #ICCW0G CVE: NA Signed-off-by: Li Nan <linan122@huawei.com> --------------------------------------- [ Upstream commit 6568cb40e73163fa25e2779f7234b169b2e1a32e ] Starting with commit c141ecc3cecd7 ("of: Warn when of_property_read_bool() is used on non-boolean properties"), probing the gpcv2 device on i.MX8M SoCs leads to warnings when LOCKDEP is enabled. Fix this by checking property presence with of_property_present as intended. Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de> Link: https://lore.kernel.org/r/20250218-gpcv2-of-property-present-v1-1-3bb1a9789654@pengutronix.de Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Li Nan <linan122@huawei.com> | 1 年前 | |
PNP: ACPI: fix fortify warning [ Upstream commit ba3f5058db437d919f8468db50483dd9028ff688 ] When compiling with gcc version 14.0.0 20231126 (experimental) and CONFIG_FORTIFY_SOURCE=y, I've noticed the following: In file included from ./include/linux/string.h:295, from ./include/linux/bitmap.h:12, from ./include/linux/cpumask.h:12, from ./arch/x86/include/asm/paravirt.h:17, from ./arch/x86/include/asm/cpuid.h:62, from ./arch/x86/include/asm/processor.h:19, from ./arch/x86/include/asm/cpufeature.h:5, from ./arch/x86/include/asm/thread_info.h:53, from ./include/linux/thread_info.h:60, from ./arch/x86/include/asm/preempt.h:9, from ./include/linux/preempt.h:79, from ./include/linux/spinlock.h:56, from ./include/linux/mmzone.h:8, from ./include/linux/gfp.h:7, from ./include/linux/slab.h:16, from ./include/linux/resource_ext.h:11, from ./include/linux/acpi.h:13, from drivers/pnp/pnpacpi/rsparser.c:11: In function 'fortify_memcpy_chk', inlined from 'pnpacpi_parse_allocated_vendor' at drivers/pnp/pnpacpi/rsparser.c:158:3, inlined from 'pnpacpi_allocated_resource' at drivers/pnp/pnpacpi/rsparser.c:249:3: ./include/linux/fortify-string.h:588:25: warning: call to '__read_overflow2_field' declared with attribute warning: detected read beyond size of field (2nd parameter); maybe use struct_group()? [-Wattribute-warning] 588 | __read_overflow2_field(q_size_field, size); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ According to the comments in include/linux/fortify-string.h, 'memcpy()', 'memmove()' and 'memset()' must not be used beyond individual struct members to ensure that the compiler can enforce protection against buffer overflows, and, IIUC, this also applies to partial copies from the particular member ('vendor->byte_data' in this case). So it should be better (and safer) to do both copies at once (and 'byte_data' of 'struct acpi_resource_vendor_typed' seems to be a good candidate for '__counted_by(byte_length)' as well). Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Reviewed-by: Kees Cook <keescook@chromium.org> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Signed-off-by: Sasha Levin <sashal@kernel.org> | 2 年前 | |
回退 'Pull Request !193 : lts升级 6.6.101->6.6.102' | 11 个月前 | |
回退 'Pull Request !193 : lts升级 6.6.101->6.6.102' | 11 个月前 | |
回退 'Pull Request !193 : lts升级 6.6.101->6.6.102' | 11 个月前 | |
driver/ps3: Include <video/cmdline.h> for mode parsing Include <video/cmdline.h> in ps3av.c to get video_get_options() and avoid the dependency on <linux/fb.h>. The replaced function fb_get_options() is just a tiny wrapper around video_get_opions(). No functional changes. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> Link: https://patchwork.freedesktop.org/patch/msgid/20230209135509.7786-10-tzimmermann@suse.de | 3 年前 | |
ptp: allow reading of currently dialed frequency to succeed on free-running clocks stable inclusion from stable-6.6.95 commit 43e3433a48c303b9dac1e72cd7eebce0be1e2cb3 category: bugfix issue: #ICCW0G CVE: NA Signed-off-by: Li Nan <linan122@huawei.com> --------------------------------------- [ Upstream commit aa112cbc5f0ac6f3b44d829005bf34005d9fe9bb ] There is a bug in ptp_clock_adjtime() which makes it refuse the operation even if we just want to read the current clock dialed frequency, not modify anything (tx->modes == 0). That should be possible even if the clock is free-running. For context, the kernel UAPI is the same for getting and setting the frequency of a POSIX clock. For example, ptp4l errors out at clock_create() -> clockadj_get_freq() -> clock_adjtime() time, when it should logically only have failed on actual adjustments to the clock, aka if the clock was configured as slave. But in master mode it should work. This was discovered when examining the issue described in the previous commit, where ptp_clock_freerun() returned true despite n_vclocks being zero. Fixes: 73f37068d540 ("ptp: support ptp physical/virtual clocks conversion") Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com> Link: https://patch.msgid.link/20250613174749.406826-3-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Li Nan <linan122@huawei.com> | 1 年前 | |
pwm: mediatek: Ensure to disable clocks in error path stable inclusion from stable-6.6.99 commit ad9d4db5a8acb9e5ab28b08f41408df5a5c2c389 category: bugfix issue: #ICCW0G CVE: NA Signed-off-by: Li Nan <linan122@huawei.com> --------------------------------------- commit 505b730ede7f5c4083ff212aa955155b5b92e574 upstream. After enabling the clocks each error path must disable the clocks again. One of them failed to do so. Unify the error paths to use goto to make it harder for future changes to add a similar bug. Fixes: 7ca59947b5fc ("pwm: mediatek: Prevent divide-by-zero in pwm_mediatek_config()") Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com> Link: https://lore.kernel.org/r/20250704172728.626815-2-u.kleine-koenig@baylibre.com Cc: stable@vger.kernel.org [ukleinek: backported to 6.6.y] Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Li Nan <linan122@huawei.com> | 1 年前 | |
drivers/rapidio/rio_cm.c: prevent possible heap overwrite stable inclusion from stable-6.6.95 commit 1921781ec4a8824bd0c520bf9363e28a880d14ec category: bugfix issue: #ICCW0G CVE: NA Signed-off-by: Li Nan <linan122@huawei.com> --------------------------------------- commit 50695153d7ddde3b1696dbf0085be0033bf3ddb3 upstream. In riocm_cdev_ioctl(RIO_CM_CHAN_SEND) -> cm_chan_msg_send() -> riocm_ch_send() cm_chan_msg_send() checks that userspace didn't send too much data but riocm_ch_send() failed to check that userspace sent sufficient data. The result is that riocm_ch_send() can write to fields in the rio_ch_chan_hdr which were outside the bounds of the space which cm_chan_msg_send() allocated. Address this by teaching riocm_ch_send() to check that the entire rio_ch_chan_hdr was copied in from userspace. Reported-by: maher azz <maherazz04@gmail.com> Cc: Matt Porter <mporter@kernel.crashing.org> Cc: Alexandre Bounine <alex.bou9@gmail.com> Cc: Linus Torvalds <torvalds@linuxfoundation.org> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Li Nan <linan122@huawei.com> | 1 年前 | |
ras/debugfs: Fix error checking for debugfs_create_dir() Check the return value of debugfs_create_dir() properly. [ bp: Rewrite commit message. ] Signed-off-by: Osama Muhammad <osmtendev@gmail.com> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> Link: https://lore.kernel.org/r/20230516182927.9171-1-osmtendev@gmail.com | 3 年前 | |
regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex stable inclusion from stable-6.6.105 commit 0cc15a10c3b4a category: bugfix issue: #207 CVE: CVE-2025-68354 Signed-off-by: 何京晶 <18967138853@163.com> Co-Authored-By: Agent ------------------------------- regulator: core: Protect regulator_supply_alias_list with regulator_list_mutex regulator_supply_alias_list was accessed without any locking in regulator_supply_alias(), regulator_register_supply_alias(), and regulator_unregister_supply_alias(). Concurrent registration, unregistration and lookups can race, leading to: 1 use-after-free if an alias entry is removed while being read, 2 duplicate entries when two threads register the same alias, 3 inconsistent alias mappings observed by consumers. Protect all traversals, insertions and deletions on regulator_supply_alias_list with the existing regulator_list_mutex. Fixes: a06ccd9c3785f ("regulator: core: Add ability to create a lookup alias for supply") Signed-off-by: sparkhuang <huangshaobo3@xiaomi.com> Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com> Link: https://patch.msgid.link/20251127025716.5440-1-huangshaobo3@xiaomi.com Signed-off-by: Mark Brown <broonie@kernel.org> Signed-off-by: 何京晶 <18967138853@163.com> | 5 个月前 | |
remoteproc: core: Release rproc->clean_table after rproc_attach() fails stable inclusion from stable-6.6.95 commit 3ee979709e16a83b257bc9a544a7ff71fd445ea9 category: bugfix issue: #ICCW0G CVE: NA Signed-off-by: Li Nan <linan122@huawei.com> --------------------------------------- commit bcd241230fdbc6005230f80a4f8646ff5a84f15b upstream. When rproc->state = RPROC_DETACHED is attached to remote processor through rproc_attach(), if rproc_handle_resources() returns failure, then the clean table should be released, otherwise the following memory leak will occur. unreferenced object 0xffff000086a99800 (size 1024): comm "kworker/u12:3", pid 59, jiffies 4294893670 (age 121.140s) hex dump (first 32 bytes): 00 00 00 00 00 80 00 00 00 00 00 00 00 00 10 00 ............ 00 00 00 00 00 00 08 00 00 00 00 00 00 00 00 00 ............ backtrace: [<000000008bbe4ca8>] slab_post_alloc_hook+0x98/0x3fc [<000000003b8a272b>] __kmem_cache_alloc_node+0x13c/0x230 [<000000007a507c51>] __kmalloc_node_track_caller+0x5c/0x260 [<0000000037818dae>] kmemdup+0x34/0x60 [<00000000610f7f57>] rproc_boot+0x35c/0x56c [<0000000065f8871a>] rproc_add+0x124/0x17c [<00000000497416ee>] imx_rproc_probe+0x4ec/0x5d4 [<000000003bcaa37d>] platform_probe+0x68/0xd8 [<00000000771577f9>] really_probe+0x110/0x27c [<00000000531fea59>] __driver_probe_device+0x78/0x12c [<0000000080036a04>] driver_probe_device+0x3c/0x118 [<000000007e0bddcb>] __device_attach_driver+0xb8/0xf8 [<000000000cf1fa33>] bus_for_each_drv+0x84/0xe4 [<000000001a53b53e>] __device_attach+0xfc/0x18c [<00000000d1a2a32c>] device_initial_probe+0x14/0x20 [<00000000d8f8b7ae>] bus_probe_device+0xb0/0xb4 unreferenced object 0xffff0000864c9690 (size 16): Fixes: 9dc9507f1880 ("remoteproc: Properly deal with the resource table when detaching") Signed-off-by: Xiaolei Wang <xiaolei.wang@windriver.com> Reviewed-by: Peng Fan <peng.fan@nxp.com> Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20250430092043.1819308-3-xiaolei.wang@windriver.com Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Li Nan <linan122@huawei.com> | 1 年前 | |
reset: starfive: jh71x0: Fix accessing the empty member on JH7110 SoC stable inclusion from stable-6.6.86 commit 3918b2016d28c9b2bddd5ab194ab366a4e2310f5 category: bugfix issue: #IC1IVT CVE: NA Signed-off-by: zyf1116 <zhouyongfei3@huawei.com> --------------------------------------- commit 2cf59663660799ce16f4dfbed97cdceac7a7fa11 upstream. data->asserted will be NULL on JH7110 SoC since commit 82327b127d41 ("reset: starfive: Add StarFive JH7110 reset driver") was added. Add the judgment condition to avoid errors when calling reset_control_status on JH7110 SoC. Fixes: 82327b127d41 ("reset: starfive: Add StarFive JH7110 reset driver") Signed-off-by: Changhuang Liang <changhuang.liang@starfivetech.com> Acked-by: Hal Feng <hal.feng@starfivetech.com> Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de> Link: https://lore.kernel.org/r/20240925112442.1732416-1-changhuang.liang@starfivetech.com Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de> Signed-off-by: Jianqi Ren <jianqi.ren.cn@windriver.com> Signed-off-by: He Zhe <zhe.he@windriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: zyf1116 <zhouyongfei3@huawei.com> | 1 年前 | |
rpmsg: qcom_smd: Fix uninitialized return variable in __qcom_smd_send() stable inclusion from stable-6.6.94 commit 85322ddd449a8d2bd02dd3dc388932a62fd75b35 category: bugfix issue: #ICCW0G CVE: NA Signed-off-by: Li Nan <linan122@huawei.com> --------------------------------------- [ Upstream commit 5de775df3362090a6e90046d1f2d83fe62489aa0 ] The "ret" variable isn't initialized if we don't enter the loop. For example, if "channel->state" is not SMD_CHANNEL_OPENED. Fixes: 33e3820dda88 ("rpmsg: smd: Use spinlock in tx path") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Link: https://lore.kernel.org/r/aAkhvV0nSbrsef1P@stanley.mountain Signed-off-by: Bjorn Andersson <andersson@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Li Nan <linan122@huawei.com> | 1 年前 | |
回退 'Pull Request !193 : lts升级 6.6.101->6.6.102' | 11 个月前 | |
s390/ctcm: Fix double-kfree stable inclusion from stable-6.6.105 commit da02a1824884d category: bugfix issue: #207 CVE: CVE-2025-40253 Signed-off-by: 何京晶 <18967138853@163.com> ------------------------------- s390/ctcm: Fix double-kfree The function 'mpc_rcvd_sweep_req(mpcginfo)' is called conditionally from function 'ctcmpc_unpack_skb'. It frees passed mpcginfo. After that a call to function 'kfree' in function 'ctcmpc_unpack_skb' frees it again. Remove 'kfree' call in function 'mpc_rcvd_sweep_req(mpcginfo)'. Bug detected by the clang static analyzer. Fixes: 0c0b20587b9f25a2 ("s390/ctcm: fix potential memory leak") Reviewed-by: Aswin Karuvally <aswin@linux.ibm.com> Signed-off-by: Aleksei Nikiforov <aleksei.nikiforov@linux.ibm.com> Signed-off-by: Aswin Karuvally <aswin@linux.ibm.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20251112182724.1109474-1-aswin@linux.ibm.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: 何京晶 <18967138853@163.com> | 5 个月前 | |
sbus: Explicitly include correct DT includes The DT of_device.h and of_platform.h date back to the separate of_platform_bus_type before it was merged into the regular platform bus. As part of that merge prepping Arm DT support 13 years ago, they "temporarily" include each other. They also include platform_device.h and of.h. As a result, there's a pretty much random mix of those include files used throughout the tree. In order to detangle these headers and replace the implicit includes with struct declarations, users need to explicitly include the correct includes. Acked-by: Sam Ravnborg <sam@ravnborg.org> Link: https://lore.kernel.org/r/20230714175048.4066006-1-robh@kernel.org Signed-off-by: Rob Herring <robh@kernel.org> | 2 年前 | |
!384 merge cve-fix-20260522-kernel_linux_6.6-master into master CVE修复: kernel_linux_6.6 master (55 个安全补丁) - 2026-05-22 Created-by: Hun_Dun Commit-by: Hun_Dun Merged-by: openharmony_ci Description: ## CVE 修复列表 | CVE ID | 标题 | Commit | |--------|------|--------| | CVE-2026-31726 | usb: gadget: uvc: fix NULL pointer dereference dur... | c78e463ee134 | | CVE-2026-31759 | usb: ulpi: fix double free in ulpi_register_interf... | aaeae6533d77 | | CVE-2026-43024 | netfilter: nf_tables: reject immediate NF_QUEUE ve... | 4b12a3cc3f07 | | CVE-2026-43026 | netfilter: ctnetlink: zero expect NAT fields when ... | 2898080c054e | | CVE-2026-43027 | netfilter: nf_conntrack_helper: pass helper to exp... | 2cf2737c85a2 | | CVE-2026-43028 | netfilter: x_tables: ensure names are nul-terminat... | c2d4a3abb15c | | CVE-2026-43035 | net: sched: cls_api: fix tc_chain_fill_node to ini... | e35f5195cd44 | | CVE-2026-43060 | netfilter: nft_ct: drop pending enqueued packets o... | e68a8db3a054 | | CVE-2026-43073 | x86-64: rename misleadingly named '__copy_user_noc... | d187a86de793 | | CVE-2026-43077 | crypto: algif_aead - Fix minimum RX size check for... | 3d14bd48e3a7 | | CVE-2026-43080 | l2tp: Drop large packets with UDP encap | ebe560ea5f54 | | CVE-2026-43082 | net: txgbe: leave space for null terminators on pr... | 5a37d228799b | | CVE-2026-43085 | netfilter: nfnetlink_log: initialize nfgenmsg in N... | 1f3083aec883 | | CVE-2026-43086 | ipvs: fix NULL deref in ip_vs_add_service error pa... | 9a91797e61d2 | | CVE-2026-43088 | net: af_key: zero aligned sockaddr tail in PF_KEY ... | 426c355742f0 | | CVE-2026-43089 | xfrm_user: fix info leak in build_mapping() | 1beb76b2053b | | CVE-2026-43091 | xfrm: Wait for RCU readers during policy netns exi... | 069daad4f2ae | | CVE-2026-43107 | xfrm: account XFRMA_IF_ID in aevent size calculati... | 7081d46d3231 | | CVE-2026-43114 | netfilter: nft_set_pipapo_avx2: don't return non-m... | d3c0037ffe12 | | CVE-2026-43116 | netfilter: ctnetlink: ensure safe access to master... | bffcaad9afdf | | CVE-2026-43128 | RDMA/umem: Fix double dma_buf_unpin in failure pat... | b324327ff6f4 | | CVE-2026-43129 | ima: verify the previous kernel's IMA buffer lies ... | 10d1c75ed438 | | CVE-2026-43130 | iommu/vt-d: Flush dev-IOTLB only when PCIe device ... | 01aed2f1d7cb | | CVE-2026-43136 | HID: logitech-hidpp: Check maxfield in hidpp_get_r... | b74bf7d0d01f | | CVE-2026-43139 | xfrm6: fix uninitialized saddr in xfrm6_get_saddr(... | 719918fc88df | | CVE-2026-43161 | iommu/vt-d: Skip dev-iotlb flush for inaccessible ... | 42662d19839f | | CVE-2026-43167 | xfrm: always flush state and policy upon NETDEV_UN... | 166801e49a5b | | CVE-2026-43180 | net: usb: kaweth: remove TX queue manipulation in ... | ef9b10a02050 | | CVE-2026-43190 | netfilter: xt_tcpmss: check remaining length befor... | 07a9b32eaae7 | | CVE-2026-43199 | net/mlx5e: Fix "scheduling while atomic" in IPsec ... | 859380694f43 | | CVE-2026-43238 | net/sched: act_skbedit: fix divide-by-zero in tcf_... | 9c735a7d98c9 | | CVE-2026-43248 | vhost: move vdpa group bound check to vhost_vdpa | cd025c1e876b | | CVE-2026-43281 | mailbox: Prevent out-of-bounds access in fw_mbox_i... | 31c4c67dec33 | | CVE-2026-43292 | mm/vmalloc: prevent RCU stalls in kasan_release_vm... | 5747435e0fd4 | | CVE-2026-43304 | libceph: define and enforce CEPH_MAX_KEY_LEN | e1dc45d97975 | | CVE-2026-43309 | md raid: fix hang when stopping arrays with metada... | cefcb9297fbd | | CVE-2026-43310 | media: verisilicon: Avoid G2 bus error while decod... | e0203ddf9af7 | | CVE-2026-43319 | spi: spidev: fix lock inversion between spi_lock a... | 40534d19ed2a | | CVE-2026-43324 | USB: dummy-hcd: Fix interrupt synchronization erro... | 5aa776c8615b | | CVE-2026-43330 | crypto: caam - fix overflow on long hmac keys | 31022cfde523 | | CVE-2026-43332 | thermal: core: Fix thermal zone device registratio... | 9e796001af97 | | CVE-2026-43339 | ipv6: prevent possible UaF in addrconf_permanent_a... | 7d9f2f4aabd1 | | CVE-2026-43353 | i3c: mipi-i3c-hci: Fix race in DMA ring dequeue | 1dca8aee80ee | | CVE-2026-43406 | libceph: prevent potential out-of-bounds reads in ... | 50156622eb08 | | CVE-2026-43413 | scsi: hisi_sas: Fix NULL pointer exception during ... | 70c78429ef38 | | CVE-2026-43439 | cgroup: fix race between task migration and iterat... | 3dfd1328c052 | | CVE-2026-43441 | net: bonding: Fix nd_tbl NULL dereference when IPv... | cf6099ef493b | | CVE-2026-43450 | netfilter: nfnetlink_cthelper: fix OOB read in nfn... | 4a1f6ee69267 | | CVE-2026-43451 | netfilter: nfnetlink_queue: fix entry leak in brid... | 47b1c5d1b094 | | CVE-2026-43452 | netfilter: x_tables: guard option walkers against ... | 9b94f0e42ed2 | | CVE-2026-43453 | netfilter: nft_set_pipapo: fix stack out-of-bounds... | 0a55d62cdb62 | | CVE-2026-43456 | bonding: fix type confusion in bond_setup_by_slave... | 950803f72547 | | CVE-2026-43466 | net/mlx5e: Fix DMA FIFO desync on error CQE SQ rec... | 383b37c04a48 | | CVE-2026-43468 | net/mlx5: Fix deadlock between devlink lock and es... | 957d2a58f7f8 | | CVE-2026-43475 | scsi: storvsc: Fix scheduling while atomic on PREE... | e7919a293f9b | **来源**: Cherry-pick from stable-tags/v6.6.134~18 ## 统计 - **总数**: 60 - **成功**: 55 - **空提交（已存在）**: 3 - **跳过**: 2 ## 修复详情 ### CVE-2026-31726 - **Commit**: c78e463ee134b4669579d453c81ae00795e4c19a - **Stable**: tags/v6.6.134~18 - **标题**: usb: gadget: uvc: fix NULL pointer dereference during unbind race ### CVE-2026-31759 - **Commit**: aaeae6533d77e6ed4def85baec01e2815ebbef61 - **Stable**: tags/v6.6.134~56 - **标题**: usb: ulpi: fix double free in ulpi_register_interface() error path ### CVE-2026-43024 - **Commit**: 4b12a3cc3f075e750cc3c5e693fd25fb400af4a2 - **Stable**: tags/v6.6.134~116 - **标题**: netfilter: nf_tables: reject immediate NF_QUEUE verdict ### CVE-2026-43026 - **Commit**: 2898080c054ea4d6ddfaaf21bbedbc229a9a8376 - **Stable**: tags/v6.6.134~122 - **标题**: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent ### CVE-2026-43027 - **Commit**: 2cf2737c85a2ba2b52024dafe68ffad2676f97be - **Stable**: tags/v6.6.134~123 - **标题**: netfilter: nf_conntrack_helper: pass helper to expect cleanup ### CVE-2026-43028 - **Commit**: c2d4a3abb15ca14716c6d8b9ffcbcd7c63626af4 - **Stable**: tags/v6.6.134~125 - **标题**: netfilter: x_tables: ensure names are nul-terminated ### CVE-2026-43035 - **Commit**: e35f5195cd44ff4053fbc5d71ea97681728a0099 - **Stable**: tags/v6.6.134~132 - **标题**: net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak ### CVE-2026-43060 - **Commit**: e68a8db3a0546482b34e9ca5ca886bcf73eb37bb - **Stable**: tags/v6.6.130~52 - **标题**: netfilter: nft_ct: drop pending enqueued packets on removal ### CVE-2026-43073 - **Commit**: d187a86de793f84766ea40b9ade7ac60aabbb4fe - **Stable**: tags/v7.1-rc1~251^2~2 - **标题**: x86-64: rename misleadingly named '__copy_user_nocache()' function ### CVE-2026-43077 - **Commit**: 3d14bd48e3a77091cbce637a12c2ae31b4a1687c - **Stable**: tags/v7.0~7^2 - **标题**: crypto: algif_aead - Fix minimum RX size check for decryption ### CVE-2026-43080 - **Commit**: ebe560ea5f54134279356703e73b7f867c89db13 - **Stable**: tags/v7.0~27^2~2 - **标题**: l2tp: Drop large packets with UDP encap ### CVE-2026-43082 - **Commit**: 5a37d228799b0ec2c277459c83c814a59d310bc3 - **Stable**: tags/v7.0~27^2~11 - **标题**: net: txgbe: leave space for null terminators on property_entry ### CVE-2026-43085 - **Commit**: 1f3083aec8836213da441270cdb1ab612dd82cf4 - **Stable**: tags/v7.0~27^2~16^2~5 - **标题**: netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator ### CVE-2026-43086 - **Commit**: 9a91797e61d286805ae10a92cc48959c30800556 - **Stable**: tags/v7.0~27^2~16^2~6 - **标题**: ipvs: fix NULL deref in ip_vs_add_service error path ### CVE-2026-43088 - **Commit**: 426c355742f02cf743b347d9d7dbdc1bfbfa31ef - **Stable**: tags/v7.0~27^2~14^2 - **标题**: net: af_key: zero aligned sockaddr tail in PF_KEY exports ### CVE-2026-43089 - **Commit**: 1beb76b2053b68c491b78370794b8ff63c8f8c02 - **Stable**: tags/v7.0~27^2~14^2~2 - **标题**: xfrm_user: fix info leak in build_mapping() ### CVE-2026-43091 - **Commit**: 069daad4f2ae9c5c108131995529d5f02392c446 - **Stable**: tags/v7.0~27^2~14^2~5 - **标题**: xfrm: Wait for RCU readers during policy netns exit ### CVE-2026-43107 - **Commit**: 7081d46d32312f1a31f0e0e99c6835a394037599 - **Stable**: tags/v7.0~27^2~14^2~6 - **标题**: xfrm: account XFRMA_IF_ID in aevent size calculation ### CVE-2026-43114 - **Commit**: d3c0037ffe1273fa1961e779ff6906234d6cf53c - **Stable**: tags/v7.0-rc6~40^2^2~11 - **标题**: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry ### CVE-2026-43116 - **Commit**: bffcaad9afdfe45d7fc777397d3b83c1e3ebffe5 - **Stable**: tags/v7.0-rc6~40^2^2~4 - **标题**: netfilter: ctnetlink: ensure safe access to master conntrack ### CVE-2026-43128 - **Commit**: b324327ff6f48d8065dca67eb3b91357e72726bd - **Stable**: tags/v6.6.128~137 - **标题**: RDMA/umem: Fix double dma_buf_unpin in failure path ### CVE-2026-43129 - **Commit**: 10d1c75ed4382a8e79874379caa2ead8952734f9 - **Stable**: tags/v7.0-rc1~46^2~76 - **标题**: ima: verify the previous kernel's IMA buffer lies in addressable RAM ### CVE-2026-43130 - **Commit**: 01aed2f1d7cb8fdf4c60c5bb4727608cb82b401d - **Stable**: tags/v6.6.128~70 - **标题**: iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode ### CVE-2026-43136 - **Commit**: b74bf7d0d01fa9b53653f58c29aa00772121f6e9 - **Stable**: tags/v6.6.128~111 - **标题**: HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() ### CVE-2026-43139 - **Commit**: 719918fc88df6da023dfff370cd965151a5afd7f - **Stable**: tags/v6.6.128~157 - **标题**: xfrm6: fix uninitialized saddr in xfrm6_get_saddr() ### CVE-2026-43161 - **Commit**: 42662d19839f34735b718129ea200e3734b07e50 - **Stable**: tags/v7.0-rc1~137^2^3~6 - **标题**: iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode ### CVE-2 See merge request: openharmony/kernel_linux_6.6!384 | 3 个月前 | |
sh: intc: Fix use-after-free bug in register_intc_controller() stable inclusion from stable-6.6.64 commit b8b84dcdf3ab1d414304819f824b10efba64132c category: bugfix issue: #IBE7K0 CVE: NA Signed-off-by: zyf1116 <zhouyongfei3@huawei.com> --------------------------------------- [ Upstream commit 63e72e551942642c48456a4134975136cdcb9b3c ] In the error handling for this function, d is freed without ever removing it from intc_list which would lead to a use after free. To fix this, let's only add it to the list after everything has succeeded. Fixes: 2dcec7a988a1 ("sh: intc: set_irq_wake() support") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Reviewed-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> Signed-off-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: zyf1116 <zhouyongfei3@huawei.com> | 1 年前 | |
siox: fix possible memory leak in siox_device_add() If device_register() returns error in siox_device_add(), the name allocated by dev_set_name() need be freed. As comment of device_register() says, it should use put_device() to give up the reference in the error path. So fix this by calling put_device(), then the name can be freed in kobject_cleanup(), and sdevice is freed in siox_device_release(), set it to null in error path. Fixes: bbecb07fa0af ("siox: new driver framework for eckelmann SIOX") Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> Reviewed-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Link: https://lore.kernel.org/r/20221104021334.618189-1-yangyingliang@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 3 年前 | |
driver core: platform: use generic driver_override infrastructure mainline inclusion from mainline-6.6.100 commit 2b38efc05bf7a8568ec74bfffea0f5cfa62bc01d category: bugfix issue: #617 CVE: CVE-2026-31527 Signed-off-by: 姜小林 <jiangxiaolin11@huawei.com> Co-Authored-By: Agent ------------------------------- driver core: platform: use generic driver_override infrastructure When a driver is probed through __driver_attach(), the bus' match() callback is called without the device lock held, thus accessing the driver_override field without a lock, which can cause a UAF. Fix this by using the driver-core driver_override infrastructure taking care of proper locking internally. Note that calling match() from __driver_attach() without the device lock held is intentional. [1] Link: https://lore.kernel.org/driver-core/DGRGTIRHA62X.3RY09D9SOK77P@kernel.org/ [1] Reported-by: Gui-Dong Han <hanguidong02@gmail.com> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220789 Fixes: 3d713e0e382e ("driver core: platform: add device binding path 'driver_override'") Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Link: https://patch.msgid.link/20260303115720.48783-5-dakr@kernel.org Signed-off-by: Danilo Krummrich <dakr@kernel.org> Change-Id: I117b6089c6768e06e0496df571f64ff397d01f74 Signed-off-by: 姜小林 <jiangxiaolin11@huawei.com> | 3 个月前 | |
net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error stable inclusion from stable-6.6.105 commit 90a88306eb874 category: bugfix issue: #206 CVE: CVE-2025-68220 Signed-off-by: w00955705 <wangchenyang65@huawei.com> --------------------------------------- Make knav_dma_open_channel consistently return NULL on error instead of ERR_PTR. Currently the header include/linux/soc/ti/knav_dma.h returns NULL when the driver is disabled, but the driver implementation does not even return NULL or ERR_PTR on failure, causing inconsistency in the users. This results in a crash in netcp_free_navigator_resources as followed (trimmed): Unhandled fault: alignment exception (0x221) at 0xfffffff2 [fffffff2] *pgd=80000800207003, *pmd=82ffda003, *pte=00000000 Internal error: : 221 [#1] SMP ARM Modules linked in: CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.17.0-rc7 #1 NONE Hardware name: Keystone PC is at knav_dma_close_channel+0x30/0x19c LR is at netcp_free_navigator_resources+0x2c/0x28c [... TRIM...] Call trace: knav_dma_close_channel from netcp_free_navigator_resources+0x2c/0x28c netcp_free_navigator_resources from netcp_ndo_open+0x430/0x46c netcp_ndo_open from __dev_open+0x114/0x29c __dev_open from __dev_change_flags+0x190/0x208 __dev_change_flags from netif_change_flags+0x1c/0x58 netif_change_flags from dev_change_flags+0x38/0xa0 dev_change_flags from ip_auto_config+0x2c4/0x11f0 ip_auto_config from do_one_initcall+0x58/0x200 do_one_initcall from kernel_init_freeable+0x1cc/0x238 kernel_init_freeable from kernel_init+0x1c/0x12c kernel_init from ret_from_fork+0x14/0x38 [... TRIM...] Standardize the error handling by making the function return NULL on all error conditions. The API is used in just the netcp_core.c so the impact is limited. Note, this change, in effect reverts commit 5b6cb43b4d62 ("net: ethernet: ti: netcp_core: return error while dma channel open issue"), but provides a less error prone implementation. Suggested-by: Simon Horman <horms@kernel.org> Suggested-by: Jacob Keller <jacob.e.keller@intel.com> Signed-off-by: Nishanth Menon <nm@ti.com> Reviewed-by: Jacob Keller <jacob.e.keller@intel.com> Link: https://patch.msgid.link/20251103162811.3730055-1-nm@ti.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Co-Authored-By: Agent Signed-off-by: w00955705 wangchenyang65@huawei.com | 5 个月前 | |
回退 'Pull Request !193 : lts升级 6.6.101->6.6.102' | 11 个月前 | |
!384 merge cve-fix-20260522-kernel_linux_6.6-master into master CVE修复: kernel_linux_6.6 master (55 个安全补丁) - 2026-05-22 Created-by: Hun_Dun Commit-by: Hun_Dun Merged-by: openharmony_ci Description: ## CVE 修复列表 | CVE ID | 标题 | Commit | |--------|------|--------| | CVE-2026-31726 | usb: gadget: uvc: fix NULL pointer dereference dur... | c78e463ee134 | | CVE-2026-31759 | usb: ulpi: fix double free in ulpi_register_interf... | aaeae6533d77 | | CVE-2026-43024 | netfilter: nf_tables: reject immediate NF_QUEUE ve... | 4b12a3cc3f07 | | CVE-2026-43026 | netfilter: ctnetlink: zero expect NAT fields when ... | 2898080c054e | | CVE-2026-43027 | netfilter: nf_conntrack_helper: pass helper to exp... | 2cf2737c85a2 | | CVE-2026-43028 | netfilter: x_tables: ensure names are nul-terminat... | c2d4a3abb15c | | CVE-2026-43035 | net: sched: cls_api: fix tc_chain_fill_node to ini... | e35f5195cd44 | | CVE-2026-43060 | netfilter: nft_ct: drop pending enqueued packets o... | e68a8db3a054 | | CVE-2026-43073 | x86-64: rename misleadingly named '__copy_user_noc... | d187a86de793 | | CVE-2026-43077 | crypto: algif_aead - Fix minimum RX size check for... | 3d14bd48e3a7 | | CVE-2026-43080 | l2tp: Drop large packets with UDP encap | ebe560ea5f54 | | CVE-2026-43082 | net: txgbe: leave space for null terminators on pr... | 5a37d228799b | | CVE-2026-43085 | netfilter: nfnetlink_log: initialize nfgenmsg in N... | 1f3083aec883 | | CVE-2026-43086 | ipvs: fix NULL deref in ip_vs_add_service error pa... | 9a91797e61d2 | | CVE-2026-43088 | net: af_key: zero aligned sockaddr tail in PF_KEY ... | 426c355742f0 | | CVE-2026-43089 | xfrm_user: fix info leak in build_mapping() | 1beb76b2053b | | CVE-2026-43091 | xfrm: Wait for RCU readers during policy netns exi... | 069daad4f2ae | | CVE-2026-43107 | xfrm: account XFRMA_IF_ID in aevent size calculati... | 7081d46d3231 | | CVE-2026-43114 | netfilter: nft_set_pipapo_avx2: don't return non-m... | d3c0037ffe12 | | CVE-2026-43116 | netfilter: ctnetlink: ensure safe access to master... | bffcaad9afdf | | CVE-2026-43128 | RDMA/umem: Fix double dma_buf_unpin in failure pat... | b324327ff6f4 | | CVE-2026-43129 | ima: verify the previous kernel's IMA buffer lies ... | 10d1c75ed438 | | CVE-2026-43130 | iommu/vt-d: Flush dev-IOTLB only when PCIe device ... | 01aed2f1d7cb | | CVE-2026-43136 | HID: logitech-hidpp: Check maxfield in hidpp_get_r... | b74bf7d0d01f | | CVE-2026-43139 | xfrm6: fix uninitialized saddr in xfrm6_get_saddr(... | 719918fc88df | | CVE-2026-43161 | iommu/vt-d: Skip dev-iotlb flush for inaccessible ... | 42662d19839f | | CVE-2026-43167 | xfrm: always flush state and policy upon NETDEV_UN... | 166801e49a5b | | CVE-2026-43180 | net: usb: kaweth: remove TX queue manipulation in ... | ef9b10a02050 | | CVE-2026-43190 | netfilter: xt_tcpmss: check remaining length befor... | 07a9b32eaae7 | | CVE-2026-43199 | net/mlx5e: Fix "scheduling while atomic" in IPsec ... | 859380694f43 | | CVE-2026-43238 | net/sched: act_skbedit: fix divide-by-zero in tcf_... | 9c735a7d98c9 | | CVE-2026-43248 | vhost: move vdpa group bound check to vhost_vdpa | cd025c1e876b | | CVE-2026-43281 | mailbox: Prevent out-of-bounds access in fw_mbox_i... | 31c4c67dec33 | | CVE-2026-43292 | mm/vmalloc: prevent RCU stalls in kasan_release_vm... | 5747435e0fd4 | | CVE-2026-43304 | libceph: define and enforce CEPH_MAX_KEY_LEN | e1dc45d97975 | | CVE-2026-43309 | md raid: fix hang when stopping arrays with metada... | cefcb9297fbd | | CVE-2026-43310 | media: verisilicon: Avoid G2 bus error while decod... | e0203ddf9af7 | | CVE-2026-43319 | spi: spidev: fix lock inversion between spi_lock a... | 40534d19ed2a | | CVE-2026-43324 | USB: dummy-hcd: Fix interrupt synchronization erro... | 5aa776c8615b | | CVE-2026-43330 | crypto: caam - fix overflow on long hmac keys | 31022cfde523 | | CVE-2026-43332 | thermal: core: Fix thermal zone device registratio... | 9e796001af97 | | CVE-2026-43339 | ipv6: prevent possible UaF in addrconf_permanent_a... | 7d9f2f4aabd1 | | CVE-2026-43353 | i3c: mipi-i3c-hci: Fix race in DMA ring dequeue | 1dca8aee80ee | | CVE-2026-43406 | libceph: prevent potential out-of-bounds reads in ... | 50156622eb08 | | CVE-2026-43413 | scsi: hisi_sas: Fix NULL pointer exception during ... | 70c78429ef38 | | CVE-2026-43439 | cgroup: fix race between task migration and iterat... | 3dfd1328c052 | | CVE-2026-43441 | net: bonding: Fix nd_tbl NULL dereference when IPv... | cf6099ef493b | | CVE-2026-43450 | netfilter: nfnetlink_cthelper: fix OOB read in nfn... | 4a1f6ee69267 | | CVE-2026-43451 | netfilter: nfnetlink_queue: fix entry leak in brid... | 47b1c5d1b094 | | CVE-2026-43452 | netfilter: x_tables: guard option walkers against ... | 9b94f0e42ed2 | | CVE-2026-43453 | netfilter: nft_set_pipapo: fix stack out-of-bounds... | 0a55d62cdb62 | | CVE-2026-43456 | bonding: fix type confusion in bond_setup_by_slave... | 950803f72547 | | CVE-2026-43466 | net/mlx5e: Fix DMA FIFO desync on error CQE SQ rec... | 383b37c04a48 | | CVE-2026-43468 | net/mlx5: Fix deadlock between devlink lock and es... | 957d2a58f7f8 | | CVE-2026-43475 | scsi: storvsc: Fix scheduling while atomic on PREE... | e7919a293f9b | **来源**: Cherry-pick from stable-tags/v6.6.134~18 ## 统计 - **总数**: 60 - **成功**: 55 - **空提交（已存在）**: 3 - **跳过**: 2 ## 修复详情 ### CVE-2026-31726 - **Commit**: c78e463ee134b4669579d453c81ae00795e4c19a - **Stable**: tags/v6.6.134~18 - **标题**: usb: gadget: uvc: fix NULL pointer dereference during unbind race ### CVE-2026-31759 - **Commit**: aaeae6533d77e6ed4def85baec01e2815ebbef61 - **Stable**: tags/v6.6.134~56 - **标题**: usb: ulpi: fix double free in ulpi_register_interface() error path ### CVE-2026-43024 - **Commit**: 4b12a3cc3f075e750cc3c5e693fd25fb400af4a2 - **Stable**: tags/v6.6.134~116 - **标题**: netfilter: nf_tables: reject immediate NF_QUEUE verdict ### CVE-2026-43026 - **Commit**: 2898080c054ea4d6ddfaaf21bbedbc229a9a8376 - **Stable**: tags/v6.6.134~122 - **标题**: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent ### CVE-2026-43027 - **Commit**: 2cf2737c85a2ba2b52024dafe68ffad2676f97be - **Stable**: tags/v6.6.134~123 - **标题**: netfilter: nf_conntrack_helper: pass helper to expect cleanup ### CVE-2026-43028 - **Commit**: c2d4a3abb15ca14716c6d8b9ffcbcd7c63626af4 - **Stable**: tags/v6.6.134~125 - **标题**: netfilter: x_tables: ensure names are nul-terminated ### CVE-2026-43035 - **Commit**: e35f5195cd44ff4053fbc5d71ea97681728a0099 - **Stable**: tags/v6.6.134~132 - **标题**: net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak ### CVE-2026-43060 - **Commit**: e68a8db3a0546482b34e9ca5ca886bcf73eb37bb - **Stable**: tags/v6.6.130~52 - **标题**: netfilter: nft_ct: drop pending enqueued packets on removal ### CVE-2026-43073 - **Commit**: d187a86de793f84766ea40b9ade7ac60aabbb4fe - **Stable**: tags/v7.1-rc1~251^2~2 - **标题**: x86-64: rename misleadingly named '__copy_user_nocache()' function ### CVE-2026-43077 - **Commit**: 3d14bd48e3a77091cbce637a12c2ae31b4a1687c - **Stable**: tags/v7.0~7^2 - **标题**: crypto: algif_aead - Fix minimum RX size check for decryption ### CVE-2026-43080 - **Commit**: ebe560ea5f54134279356703e73b7f867c89db13 - **Stable**: tags/v7.0~27^2~2 - **标题**: l2tp: Drop large packets with UDP encap ### CVE-2026-43082 - **Commit**: 5a37d228799b0ec2c277459c83c814a59d310bc3 - **Stable**: tags/v7.0~27^2~11 - **标题**: net: txgbe: leave space for null terminators on property_entry ### CVE-2026-43085 - **Commit**: 1f3083aec8836213da441270cdb1ab612dd82cf4 - **Stable**: tags/v7.0~27^2~16^2~5 - **标题**: netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator ### CVE-2026-43086 - **Commit**: 9a91797e61d286805ae10a92cc48959c30800556 - **Stable**: tags/v7.0~27^2~16^2~6 - **标题**: ipvs: fix NULL deref in ip_vs_add_service error path ### CVE-2026-43088 - **Commit**: 426c355742f02cf743b347d9d7dbdc1bfbfa31ef - **Stable**: tags/v7.0~27^2~14^2 - **标题**: net: af_key: zero aligned sockaddr tail in PF_KEY exports ### CVE-2026-43089 - **Commit**: 1beb76b2053b68c491b78370794b8ff63c8f8c02 - **Stable**: tags/v7.0~27^2~14^2~2 - **标题**: xfrm_user: fix info leak in build_mapping() ### CVE-2026-43091 - **Commit**: 069daad4f2ae9c5c108131995529d5f02392c446 - **Stable**: tags/v7.0~27^2~14^2~5 - **标题**: xfrm: Wait for RCU readers during policy netns exit ### CVE-2026-43107 - **Commit**: 7081d46d32312f1a31f0e0e99c6835a394037599 - **Stable**: tags/v7.0~27^2~14^2~6 - **标题**: xfrm: account XFRMA_IF_ID in aevent size calculation ### CVE-2026-43114 - **Commit**: d3c0037ffe1273fa1961e779ff6906234d6cf53c - **Stable**: tags/v7.0-rc6~40^2^2~11 - **标题**: netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry ### CVE-2026-43116 - **Commit**: bffcaad9afdfe45d7fc777397d3b83c1e3ebffe5 - **Stable**: tags/v7.0-rc6~40^2^2~4 - **标题**: netfilter: ctnetlink: ensure safe access to master conntrack ### CVE-2026-43128 - **Commit**: b324327ff6f48d8065dca67eb3b91357e72726bd - **Stable**: tags/v6.6.128~137 - **标题**: RDMA/umem: Fix double dma_buf_unpin in failure path ### CVE-2026-43129 - **Commit**: 10d1c75ed4382a8e79874379caa2ead8952734f9 - **Stable**: tags/v7.0-rc1~46^2~76 - **标题**: ima: verify the previous kernel's IMA buffer lies in addressable RAM ### CVE-2026-43130 - **Commit**: 01aed2f1d7cb8fdf4c60c5bb4727608cb82b401d - **Stable**: tags/v6.6.128~70 - **标题**: iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode ### CVE-2026-43136 - **Commit**: b74bf7d0d01fa9b53653f58c29aa00772121f6e9 - **Stable**: tags/v6.6.128~111 - **标题**: HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() ### CVE-2026-43139 - **Commit**: 719918fc88df6da023dfff370cd965151a5afd7f - **Stable**: tags/v6.6.128~157 - **标题**: xfrm6: fix uninitialized saddr in xfrm6_get_saddr() ### CVE-2026-43161 - **Commit**: 42662d19839f34735b718129ea200e3734b07e50 - **Stable**: tags/v7.0-rc1~137^2^3~6 - **标题**: iommu/vt-d: Skip dev-iotlb flush for inaccessible PCIe device without scalable mode ### CVE-2 See merge request: openharmony/kernel_linux_6.6!384 | 3 个月前 | |
spmi: hisi-spmi-controller: Do not override device identifier stable inclusion from stable-6.6.35 commit 591d5b12f8147cc88cc9c2b21740c6166d36c817 category: bugfix issue: #IB7W7N CVE: NA Signed-off-by: zhangshuqi <zhangshuqi3@huawei.com> --------------------------------------- commit eda4923d78d634482227c0b189d9b7ca18824146 upstream. 'nr' member of struct spmi_controller, which serves as an identifier for the controller/bus. This value is a dynamic ID assigned in spmi_controller_alloc, and overriding it from the driver results in an ida_free error "ida_free called for id=xx which is not allocated". Signed-off-by: Vamshi Gajjela <vamshigajjela@google.com> Fixes: 70f59c90c819 ("staging: spmi: add Hikey 970 SPMI controller driver") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20240228185116.1269-1-vamshigajjela@google.com Signed-off-by: Stephen Boyd <sboyd@kernel.org> Link: https://lore.kernel.org/r/20240507210809.3479953-5-sboyd@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: zhangshuqi <zhangshuqi3@huawei.com> | 1 年前 | |
ssb: Fix division by zero issue in ssb_calc_clock_rate stable inclusion from stable-6.6.48 commit 8574cdabb526ac3972316c5c95028c0dacb161c5 category: bugfix issue: #IB7W7N CVE: NA Signed-off-by: zhangshuqi <zhangshuqi3@huawei.com> --------------------------------------- [ Upstream commit e0b5127fa134fe0284d58877b6b3133939c8b3ce ] In ssb_calc_clock_rate(), there is a potential issue where the value of m1 could be zero due to initialization using clkfactor_f6_resolv(). This situation raised concerns about the possibility of a division by zero error. We fixed it by following the suggestions provided by Larry Finger <Larry.Finger@lwfinger.net> and Michael Büsch <m@bues.ch>. The fix involves returning a value of 1 instead of 0 in clkfactor_f6_resolv(). This modification ensures the proper functioning of the code and eliminates the risk of division by zero errors. Signed-off-by: Rand Deeb <rand.sec96@gmail.com> Acked-by: Larry Finger <Larry.Finger@lwfinger.net> Acked-by: Michael Büsch <m@bues.ch> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230904232346.34991-1-rand.sec96@gmail.com Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: zhangshuqi <zhangshuqi3@huawei.com> | 1 年前 | |
staging: most: remove broken i2c driver stable inclusion from stable-6.6.105 commit 495df2da69444 category: bugfix issue: #206 CVE: CVE-2025-68755 Signed-off-by: w00955705 <wangchenyang65@huawei.com> --------------------------------------- The MOST I2C driver has been completely broken for five years without anyone noticing so remove the driver from staging. Specifically, commit 723de0f9171e ("staging: most: remove device from interface structure") started requiring drivers to set the interface device pointer before registration, but the I2C driver was never updated which results in a NULL pointer dereference if anyone ever tries to probe it. Fixes: 723de0f9171e ("staging: most: remove device from interface structure") Cc: Christian Gromm <christian.gromm@microchip.com> Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20251029093442.29256-1-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Co-Authored-By: Agent Signed-off-by: w00955705 wangchenyang65@huawei.com | 5 个月前 | |
scsi: target: Reset t_task_cdb pointer in error case stable inclusion from stable-6.6.105 commit 5053eab38a4c4543522d0c320c639c56a8b59908 category: bugfix issue: #200 CVE: CVE-2025-68782 Signed-off-by: zhangxiaoliang <1554188414@qq.com> --------------------------------------- If allocation of cmd->t_task_cdb fails, it remains NULL but is later dereferenced in the 'err' path. In case of error, reset NULL t_task_cdb value to point at the default fixed-size buffer. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 9e95fb805dc0 ("scsi: target: Fix NULL pointer dereference") Cc: stable@vger.kernel.org Signed-off-by: Andrey Vatoropin <a.vatoropin@crpt.ru> Reviewed-by: Mike Christie <michael.christie@oracle.com> Link: https://patch.msgid.link/20251118084014.324940-1-a.vatoropin@crpt.ru Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: zhangxiaoliang <1554188414@qq.com> Change-Id: I2a762322103a136ae3d5c470cae738f6442c4c2a | 6 个月前 | |
Merge tag 'mips_5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull MIPS changes from Paul Burton: "Nothing too big or scary in here: - Support mremap() for the VDSO, primarily to allow CRIU to restore the VDSO to its checkpointed location. - Restore the MIPS32 cBPF JIT, after having reverted the enablement of the eBPF JIT for MIPS32 systems in the 5.5 cycle. - Improve cop0 counter synchronization behaviour whilst onlining CPUs by running with interrupts disabled. - Better match FPU behaviour when emulating multiply-accumulate instructions on pre-r6 systems that implement IEEE754-2008 style MACs. - Loongson64 kernels now build using the MIPS64r2 ISA, allowing them to take advantage of instructions introduced by r2. - Support for the Ingenic X1000 SoC & the really nice little CU Neo development board that's using it. - Support for WMAC on GARDENA Smart Gateway devices. - Lots of cleanup & refactoring of SGI IP27 (Origin 2*) support in preparation for introducing IP35 (Origin 3*) support. - Various Kconfig & Makefile cleanups" * tag 'mips_5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: (60 commits) MIPS: PCI: Add detection of IOC3 on IO7, IO8, IO9 and Fuel MIPS: Loongson64: Disable exec hazard MIPS: Loongson64: Bump ISA level to MIPSR2 MIPS: Make DIEI support as a config option MIPS: OCTEON: octeon-irq: fix spelling mistake "to" -> "too" MIPS: asm: local: add barriers for Loongson MIPS: Loongson64: Select mac2008 only feature MIPS: Add MAC2008 Support Revert "MIPS: Add custom serial.h with BASE_BAUD override for generic kernel" MIPS: sort MIPS and MIPS_GENERIC Kconfig selects alphabetically (again) MIPS: make CPU_HAS_LOAD_STORE_LR opt-out MIPS: generic: don't unconditionally select PINCTRL MIPS: don't explicitly select LIBFDT in Kconfig MIPS: sync-r4k: do slave counter synchronization with disabled HW interrupts MIPS: SGI-IP30: Check for valid pointer before using it MIPS: syscalls: fix indentation of the 'SYSNR' message MIPS: boot: fix typo in 'vmlinux.lzma.its' target MIPS: fix indentation of the 'RELOCS' message dt-bindings: Document loongson vendor-prefix MIPS: CU1000-Neo: Refresh defconfig to support HWMON and WiFi. ... | 6 年前 | |
tee: Prevent size calculation wraparound on 32-bit kernels stable inclusion from stable-6.6.95 commit cdc1b9b47bc574bbb6e2e2bc25843249b76d46d9 category: bugfix issue: #ICCW0G CVE: NA Signed-off-by: Li Nan <linan122@huawei.com> --------------------------------------- [ Upstream commit 39bb67edcc582b3b386a9ec983da67fa8a10ec03 ] The current code around TEE_IOCTL_PARAM_SIZE() is a bit wrong on 32-bit kernels: Multiplying a user-provided 32-bit value with the size of a structure can wrap around on such platforms. Fix it by using saturating arithmetic for the size calculation. This has no security consequences because, in all users of TEE_IOCTL_PARAM_SIZE(), the subsequent kcalloc() implicitly checks for wrapping. Signed-off-by: Jann Horn <jannh@google.com> Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org> Tested-by: Rouven Czerwinski <rouven.czerwinski@linaro.org> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Li Nan <linan122@huawei.com> | 1 年前 | |
thermal: core: Fix thermal zone device registration error path commit 9e07e3b81807edd356e1f794cffa00a428eff443 upstream. If thermal_zone_device_register_with_trips() fails after registering a thermal zone device, it needs to wait for the tz->removal completion like thermal_zone_device_unregister(), in case user space has managed to take a reference to the thermal zone device's kobject, in which case thermal_release() may not be called by the error path itself and tz may be freed prematurely. Add the missing wait_for_completion() call to the thermal zone device registration error path. Fixes: 04e6ccfc93c5 ("thermal: core: Fix NULL pointer dereference in zone registration error path") Cc: All applicable <stable@vger.kernel.org> Reviewed-by: Lukasz Luba <lukasz.luba@arm.com> Tested-by: Lukasz Luba <lukasz.luba@arm.com> Link: https://patch.msgid.link/2849815.mvXUDI8C0e@rafael.j.wysocki Signed-off-by: Hun_Dun <18967138853@163.com> | 3 个月前 | |
thunderbolt: Fix bit masking in tb_dp_port_set_hops() stable inclusion from stable-6.6.100 commit 0cd051cb5852c340755db676dc25cb8e9b7e2e41 category: bugfix issue: #ICCW0G CVE: NA Signed-off-by: Li Nan <linan122@huawei.com> --------------------------------------- commit 2cdde91c14ec358087f43287513946d493aef940 upstream. The tb_dp_port_set_hops() function was incorrectly clearing ADP_DP_CS_1_AUX_RX_HOPID_MASK twice. According to the function's purpose, it should clear both TX and RX AUX HopID fields. Replace the first instance with ADP_DP_CS_1_AUX_TX_HOPID_MASK to ensure proper configuration of both AUX directions. Fixes: 98176380cbe5 ("thunderbolt: Convert DP adapter register names to follow the USB4 spec") Cc: stable@vger.kernel.org Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com> Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Li Nan <linan122@huawei.com> | 1 年前 | |
fix: correct CVE-2026-23472 backporting error in uart_write_room() The upstream patch for CVE-2026-23472 was written for a kernel that already migrated UART xmit from circ_buf to kfifo. In kernel 6.6, struct uart_state still uses circ_buf (state->xmit), not kfifo (state->port.xmit_fifo). The incorrect backport caused uart_write_room() to always return 0 because state->port.xmit_buf (tty_port field) is never initialized for UART ports, while the actual buffer is state->xmit.buf (circ_buf). This broke all serial console output on ARM64 boards, causing init process failure where rcS produces no log output. Fix by using the correct 6.6 circ_buf API: - state->port.xmit_buf -> state->xmit.buf - kfifo_avail(&state->port.xmit_fifo) -> uart_circ_chars_free(&state->xmit) Fixes: c9231ee88555 ("serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN") Change-Id: Ib67d15c1bfb4709888703f70 Signed-off-by: 姜小林 <jiangxiaolin11@huawei.com> | 2 个月前 | |
scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE stable inclusion from stable-6.6.105 commit 01aad16c2257 category: bugfix issue: #223 CVE: CVE-2025-39788 Signed-off-by: zxl <1554188414@qq.com> ------------------------------- scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE On Google gs101, the number of UTP transfer request slots (nutrs) is 32, and in this case the driver ends up programming the UTRL_NEXUS_TYPE incorrectly as 0. This is because the left hand side of the shift is 1, which is of type int, i.e. 31 bits wide. Shifting by more than that width results in undefined behaviour. Fix this by switching to the BIT() macro, which applies correct type casting as required. This ensures the correct value is written to UTRL_NEXUS_TYPE (0xffffffff on gs101), and it also fixes a UBSAN shift warning: UBSAN: shift-out-of-bounds in drivers/ufs/host/ufs-exynos.c:1113:21 shift exponent 32 is too large for 32-bit type 'int' For consistency, apply the same change to the nutmrs / UTMRL_NEXUS_TYPE write. Fixes: 55f4b1f73631 ("scsi: ufs: ufs-exynos: Add UFS host support for Exynos SoCs") Cc: stable@vger.kernel.org Signed-off-by: André Draszik <andre.draszik@linaro.org> Link: https://lore.kernel.org/r/20250707-ufs-exynos-shift-v1-1-1418e161ae40@linaro.org Reviewed-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Peter Griffin <peter.griffin@linaro.org> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: zxl <1554188414@qq.com> | 5 个月前 | |
uio_hv_generic: Align ring size to system page stable inclusion from stable-6.6.96 commit df1d7e879eddc0e346727a47b649c5cab1820757 category: bugfix issue: #ICCW0G CVE: NA Signed-off-by: Li Nan <linan122@huawei.com> --------------------------------------- [ Upstream commit 0315fef2aff9f251ddef8a4b53db9187429c3553 ] Following the ring header, the ring data should align to system page boundary. Adjust the size if necessary. Cc: stable@vger.kernel.org Fixes: 95096f2fbd10 ("uio-hv-generic: new userspace i/o driver for VMBus") Signed-off-by: Long Li <longli@microsoft.com> Reviewed-by: Michael Kelley <mhklinux@outlook.com> Link: https://lore.kernel.org/r/1746492997-4599-4-git-send-email-longli@linuxonhyperv.com Signed-off-by: Wei Liu <wei.liu@kernel.org> Message-ID: <1746492997-4599-4-git-send-email-longli@linuxonhyperv.com> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Li Nan <linan122@huawei.com> | 1 年前 | |
usb: gadget: f_mass_storage: Fix potential integer overflow in check_command_size_in_blocks() [ Upstream commit 8479891d1f04a8ce55366fe4ca361ccdb96f02e1 ] The check_command_size_in_blocks() function calculates the data size in bytes by left shifting common->data_size_from_cmnd by the block size (common->curlun->blkbits). However, it does not validate whether this shift operation will cause an integer overflow. Initially, the block size is set up in fsg_lun_open() , and the common->data_size_from_cmnd is set up in do_scsi_command(). During initialization, there is no integer overflow check for the interaction between two variables. So if a malicious USB host sends a SCSI READ or WRITE command requesting a large amount of data (common->data_size_from_cmnd), the left shift operation can wrap around. This results in a truncated data size, which can bypass boundary checks and potentially lead to memory corruption or out-of-bounds accesses. Fix this by using the check_shl_overflow() macro to safely perform the shift and catch any overflows. Fixes: 144974e7f9e3 ("usb: gadget: mass_storage: support multi-luns with different logic block size") Signed-off-by: llj123 <luojie119@h-partners.com> Reviewed-by: Alan Stern <stern@rowland.harvard.edu> Link: https://patch.msgid.link/20260228104324.1696455-2-eeodqql09@gmail.com | 2 个月前 | |
vhost: move vdpa group bound check to vhost_vdpa mainline inclusion from mainline-6.6.100 commit cd025c1e876b4e262e71398236a1550486a73ede category: bugfix issue: #722 CVE: CVE-2026-43248 ------------------------------- vhost: move vdpa group bound check to vhost_vdpa Remove duplication by consolidating these here. This reduces the posibility of a parent driver missing them. While we're at it, fix a bug in vdpa_sim where a valid ASID can be assigned to a group equal to ngroups, causing an out of bound write. Cc: stable@vger.kernel.org Fixes: bda324fd037a ("vdpasim: control virtqueue support") Acked-by: Jason Wang <jasowang@redhat.com> Message-Id: <20260119143306.1818855-2-eperezma@redhat.com> Signed-off-by: Hun_Dun <18967138853@163.com> | 3 个月前 | |
iommufd: Don't overflow during division for dirty tracking stable inclusion from stable-6.6.105 commit cb30dfa75d55e category: bugfix issue: #207 CVE: CVE-2025-40293 Signed-off-by: 何京晶 <18967138853@163.com> ------------------------------- iommufd: Don't overflow during division for dirty tracking If pgshift is 63 then BITS_PER_TYPE(*bitmap->bitmap) * pgsize will overflow to 0 and this triggers divide by 0. In this case the index should just be 0, so reorganize things to divide by shift and avoid hitting any overflows. Link: https://patch.msgid.link/r/0-v1-663679b57226+172-iommufd_dirty_div0_jgg@nvidia.com Cc: stable@vger.kernel.org Fixes: 58ccf0190d19 ("vfio: Add an IOVA bitmap support") Reviewed-by: Joao Martins <joao.m.martins@oracle.com> Reviewed-by: Nicolin Chen <nicolinc@nvidia.com> Reviewed-by: Kevin Tian <kevin.tian@intel.com> Reported-by: syzbot+093a8a8b859472e6c257@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=093a8a8b859472e6c257 Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> Signed-off-by: 何京晶 <18967138853@163.com> | 5 个月前 | |
vhost: move vdpa group bound check to vhost_vdpa mainline inclusion from mainline-6.6.100 commit cd025c1e876b4e262e71398236a1550486a73ede category: bugfix issue: #722 CVE: CVE-2026-43248 ------------------------------- vhost: move vdpa group bound check to vhost_vdpa Remove duplication by consolidating these here. This reduces the posibility of a parent driver missing them. While we're at it, fix a bug in vdpa_sim where a valid ASID can be assigned to a group equal to ngroups, causing an out of bound write. Cc: stable@vger.kernel.org Fixes: bda324fd037a ("vdpasim: control virtqueue support") Acked-by: Jason Wang <jasowang@redhat.com> Message-Id: <20260119143306.1818855-2-eperezma@redhat.com> Signed-off-by: Hun_Dun <18967138853@163.com> | 3 个月前 | |
fbcon: check return value of con2fb_acquire_newinfo() [ Upstream commit 011a0502801c8536f64141a2b61362c14f456544 ] If fbcon_open() fails when called from con2fb_acquire_newinfo() then info->fbcon_par pointer remains NULL which is later dereferenced. Add check for return value of the function con2fb_acquire_newinfo() to avoid it. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: d1baa4ffa677 ("fbcon: set_con2fb_map fixes") Cc: stable@vger.kernel.org Original-signoff: Andrey Vatoropin <a.vatoropin@crpt.ru> Original-signoff: Helge Deller <deller@gmx.de> Original-signoff: Sasha Levin <sashal@kernel.org> mainline inclusion from mainline-6.6.134 commit a785c4e2a999c2d51dfcf40d317cfb30cc735d2c category: bugfix issue: #8190 CVE: CVE-2026-43123 Signed-off-by: wanghao794 <wanghao865@huawei.com> ------------------------------- | 3 个月前 | |
drivers: virt: acrn: hsm: Use kzalloc to avoid info leak in pmcmd_ioctl stable inclusion from stable-6.6.83 commit d7e5031fe3f161c8eb5e84db1540bc4373ed861b category: bugfix issue: #IC1IVT CVE: NA Signed-off-by: zyf1116 <zhouyongfei3@huawei.com> --------------------------------------- commit 819cec1dc47cdeac8f5dd6ba81c1dbee2a68c3bb upstream. In the "pmcmd_ioctl" function, three memory objects allocated by kmalloc are initialized by "hcall_get_cpu_state", which are then copied to user space. The initializer is indeed implemented in "acrn_hypercall2" (arch/x86/include/asm/acrn.h). There is a risk of information leakage due to uninitialized bytes. Fixes: 3d679d5aec64 ("virt: acrn: Introduce interfaces to query C-states and P-states allowed by hypervisor") Signed-off-by: Haoyu Li <lihaoyu499@gmail.com> Cc: stable <stable@kernel.org> Acked-by: Fei Li <fei1.li@intel.com> Link: https://lore.kernel.org/r/20250130115811.92424-1-lihaoyu499@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: zyf1116 <zhouyongfei3@huawei.com> | 1 年前 | |
virtio_ring: Fix error reporting in virtqueue_resize stable inclusion from stable-6.6.101 commit 0e8c65939ba2aab32b3ea7c2e9037ec3327241b3 category: bugfix issue: #ICCW0G CVE: NA Signed-off-by: Li Nan <linan122@huawei.com> --------------------------------------- [ Upstream commit 45ebc7e6c125ce93d2ddf82cd5bea20121bb0258 ] The virtqueue_resize() function was not correctly propagating error codes from its internal resize helper functions, specifically virtqueue_resize_packet() and virtqueue_resize_split(). If these helpers returned an error, but the subsequent call to virtqueue_enable_after_reset() succeeded, the original error from the resize operation would be masked. Consequently, virtqueue_resize() could incorrectly report success to its caller despite an underlying resize failure. This change restores the original code behavior: if (vdev->config->enable_vq_after_reset(_vq)) return -EBUSY; return err; Fix: commit ad48d53b5b3f ("virtio_ring: separate the logic of reset/enable from virtqueue_resize") Cc: xuanzhuo@linux.alibaba.com Signed-off-by: Laurent Vivier <lvivier@redhat.com> Acked-by: Jason Wang <jasowang@redhat.com> Link: https://patch.msgid.link/20250521092236.661410-2-lvivier@redhat.com Tested-by: Lei Yang <leiyang@redhat.com> Acked-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Li Nan <linan122@huawei.com> | 1 年前 | |
bus: Make remove callback return void The driver core ignores the return value of this callback because there is only little it can do when a device disappears. This is the final bit of a long lasting cleanup quest where several buses were converted to also return void from their remove callback. Additionally some resource leaks were fixed that were caused by drivers returning an error code in the expectation that the driver won't go away. With struct bus_type::remove returning void it's prevented that newly implemented buses return an ignored error code and so don't anticipate wrong expectations for driver authors. Reviewed-by: Tom Rix <trix@redhat.com> (For fpga) Reviewed-by: Mathieu Poirier <mathieu.poirier@linaro.org> Reviewed-by: Cornelia Huck <cohuck@redhat.com> (For drivers/s390 and drivers/vfio) Acked-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk> (For ARM, Amba and related parts) Acked-by: Mark Brown <broonie@kernel.org> Acked-by: Chen-Yu Tsai <wens@csie.org> (for sunxi-rsb) Acked-by: Pali Rohár <pali@kernel.org> Acked-by: Mauro Carvalho Chehab <mchehab@kernel.org> (for media) Acked-by: Hans de Goede <hdegoede@redhat.com> (For drivers/platform) Acked-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Acked-By: Vinod Koul <vkoul@kernel.org> Acked-by: Juergen Gross <jgross@suse.com> (For xen) Acked-by: Lee Jones <lee.jones@linaro.org> (For mfd) Acked-by: Johannes Thumshirn <jth@kernel.org> (For mcb) Acked-by: Johan Hovold <johan@kernel.org> Acked-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org> (For slimbus) Acked-by: Kirti Wankhede <kwankhede@nvidia.com> (For vfio) Acked-by: Maximilian Luz <luzmaximilian@gmail.com> Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> (For ulpi and typec) Acked-by: Samuel Iglesias Gonsálvez <siglesias@igalia.com> (For ipack) Acked-by: Geoff Levand <geoff@infradead.org> (For ps3) Acked-by: Yehezkel Bernat <YehezkelShB@gmail.com> (For thunderbolt) Acked-by: Alexander Shishkin <alexander.shishkin@linux.intel.com> (For intel_th) Acked-by: Dominik Brodowski <linux@dominikbrodowski.net> (For pcmcia) Acked-by: Rafael J. Wysocki <rafael@kernel.org> (For ACPI) Acked-by: Bjorn Andersson <bjorn.andersson@linaro.org> (rpmsg and apr) Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> (For intel-ish-hid) Acked-by: Dan Williams <dan.j.williams@intel.com> (For CXL, DAX, and NVDIMM) Acked-by: William Breathitt Gray <vilhelm.gray@gmail.com> (For isa) Acked-by: Stefan Richter <stefanr@s5r6.in-berlin.de> (For firewire) Acked-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> (For hid) Acked-by: Thorsten Scherer <t.scherer@eckelmann.de> (For siox) Acked-by: Sven Van Asbroeck <TheSven73@gmail.com> (For anybuss) Acked-by: Ulf Hansson <ulf.hansson@linaro.org> (For MMC) Acked-by: Wolfram Sang <wsa@kernel.org> # for I2C Acked-by: Sudeep Holla <sudeep.holla@arm.com> Acked-by: Geert Uytterhoeven <geert@linux-m68k.org> Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Acked-by: Finn Thain <fthain@linux-m68k.org> Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Link: https://lore.kernel.org/r/20210713193522.1770306-6-u.kleine-koenig@pengutronix.de Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 5 年前 | |
nvmem: add explicit config option to read old syntax fixed OF cells stable inclusion from stable-6.6.31 commit 26e2fe4cab10e67f116f4a2eecc393824bb294b8 category: bugfix issue: #IB7W7N CVE: NA Signed-off-by: zhangshuqi <zhangshuqi3@huawei.com> --------------------------------------- [ Upstream commit 2cc3b37f5b6df8189d55d0e812d9658ce256dfec ] Binding for fixed NVMEM cells defined directly as NVMEM device subnodes has been deprecated. It has been replaced by the "fixed-layout" NVMEM layout binding. New syntax is meant to be clearer and should help avoiding imprecise bindings. NVMEM subsystem already supports the new binding. It should be a good idea to limit support for old syntax to existing drivers that actually support & use it (we can't break backward compatibility!). That way we additionally encourage new bindings & drivers to ignore deprecated binding. It wasn't clear (to me) if rtc and w1 code actually uses old syntax fixed cells. I enabled them to don't risk any breakage. Signed-off-by: Rafał Miłecki <rafal@milecki.pl> [for meson-{efuse,mx-efuse}.c] Acked-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com> [for mtk-efuse.c, nvmem/core.c, nvmem-provider.h] Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> [MT8192, MT8195 Chromebooks] Tested-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> [for microchip-otpc.c] Reviewed-by: Claudiu Beznea <claudiu.beznea@microchip.com> [SAMA7G5-EK] Tested-by: Claudiu Beznea <claudiu.beznea@microchip.com> Acked-by: Jernej Skrabec <jernej.skrabec@gmail.com> Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org> Link: https://lore.kernel.org/r/20231020105545.216052-3-srinivas.kandagatla@linaro.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Stable-dep-of: d2d73a6dd173 ("mtd: limit OTP NVMEM cell parse to non-NAND devices") Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: zhangshuqi <zhangshuqi3@huawei.com> | 1 年前 | |
via_wdt: fix critical boot hang due to unnamed resource allocation stable inclusion from stable-6.6.105 commit 7aa31ee9ec92 category: bugfix issue: #223 CVE: CVE-2025-71114 Signed-off-by: zxl <1554188414@qq.com> ------------------------------- via_wdt: fix critical boot hang due to unnamed resource allocation The VIA watchdog driver uses allocate_resource() to reserve a MMIO region for the watchdog control register. However, the allocated resource was not given a name, which causes the kernel resource tree to contain an entry marked as "<BAD>" under /proc/iomem on x86 platforms. During boot, this unnamed resource can lead to a critical hang because subsequent resource lookups and conflict checks fail to handle the invalid entry properly. Signed-off-by: Li Qiang <liqiang01@kylinos.cn> Reviewed-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org> Signed-off-by: zxl <1554188414@qq.com> | 5 个月前 | |
回退 'Pull Request !193 : lts升级 6.6.101->6.6.102' | 11 个月前 | |
zorro: Include zorro.h in names.c The zorro_name_device() function is defined in drivers/zorro/names.c, but the declaration is not visible there: drivers/zorro/names.c:58:13: error: no previous prototype for 'zorro_name_device' [-Werror=missing-prototypes] 58 | void __init zorro_name_device(struct zorro_dev *dev) Include the header to avoid the warning. Signed-off-by: Arnd Bergmann <arnd@arndb.de> Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org> Link: https://lore.kernel.org/r/20230810141947.1236730-11-arnd@kernel.org Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org> | 2 年前 | |
modify mk file Signed-off-by: 朱佳鑫 <zhujiaxin@huawei.com> | 2 年前 | |
modify mk file Signed-off-by: 朱佳鑫 <zhujiaxin@huawei.com> | 2 年前 |
| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
| 1 年前 | ||
| 5 个月前 | ||
| 27 天前 | ||
| 5 个月前 | ||
| 2 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 5 个月前 | ||
| 1 年前 | ||
| 3 个月前 | ||
| 3 年前 | ||
| 3 个月前 | ||
| 2 个月前 | ||
| 3 个月前 | ||
| 2 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 5 个月前 | ||
| 3 个月前 | ||
| 1 年前 | ||
| 5 个月前 | ||
| 2 年前 | ||
| 1 年前 | ||
| 11 个月前 | ||
| 1 年前 | ||
| 3 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 3 年前 | ||
| 11 个月前 | ||
| 3 年前 | ||
| 1 年前 | ||
| 5 个月前 | ||
| 1 年前 | ||
| 3 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 2 年前 | ||
| 3 年前 | ||
| 1 年前 | ||
| 3 个月前 | ||
| 1 年前 | ||
| 2 年前 | ||
| 2 个月前 | ||
| 1 年前 | ||
| 2 年前 | ||
| 1 年前 | ||
| 1 个月前 | ||
| 1 年前 | ||
| 5 个月前 | ||
| 2 年前 | ||
| 11 个月前 | ||
| 3 个月前 | ||
| 1 年前 | ||
| 5 个月前 | ||
| 3 个月前 | ||
| 2 个月前 | ||
| 11 个月前 | ||
| 3 个月前 | ||
| 2 年前 | ||
| 3 个月前 | ||
| 5 个月前 | ||
| 3 个月前 | ||
| 5 个月前 | ||
| 3 个月前 | ||
| 1 年前 | ||
| 3 个月前 | ||
| 2 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 4 个月前 | ||
| 3 个月前 | ||
| 3 年前 | ||
| 5 个月前 | ||
| 2 年前 | ||
| 3 个月前 | ||
| 1 年前 | ||
| 3 个月前 | ||
| 3 年前 | ||
| 3 个月前 | ||
| 3 个月前 | ||
| 1 年前 | ||
| 11 个月前 | ||
| 1 年前 | ||
| 5 个月前 | ||
| 1 年前 | ||
| 3 个月前 | ||
| 1 年前 | ||
| 2 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 11 个月前 | ||
| 5 个月前 | ||
| 1 年前 | ||
| 2 年前 | ||
| 11 个月前 | ||
| 11 个月前 | ||
| 11 个月前 | ||
| 3 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 3 年前 | ||
| 5 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 11 个月前 | ||
| 5 个月前 | ||
| 2 年前 | ||
| 3 个月前 | ||
| 1 年前 | ||
| 3 年前 | ||
| 3 个月前 | ||
| 5 个月前 | ||
| 11 个月前 | ||
| 3 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 5 个月前 | ||
| 6 个月前 | ||
| 6 年前 | ||
| 1 年前 | ||
| 3 个月前 | ||
| 1 年前 | ||
| 2 个月前 | ||
| 5 个月前 | ||
| 1 年前 | ||
| 2 个月前 | ||
| 3 个月前 | ||
| 5 个月前 | ||
| 3 个月前 | ||
| 3 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 5 年前 | ||
| 1 年前 | ||
| 5 个月前 | ||
| 11 个月前 | ||
| 2 年前 | ||
| 2 年前 | ||
| 2 年前 |