| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
!375 merge cve-fix-20260519 into master net: fix memory leak in skb_segment_list for GRO packets Created-by: llj123 Commit-by: Mohammad Heib;Thadeu Lima de Souza Cascardo;Paolo Abeni;Tetsuo Handa;Taeyang Lee;Peter Zijlstra;Eric Dumazet;John Johansen;Kaushlendra Kumar;Jens Axboe;Bert Karwatzki;Yongpeng Yang;Cheng-Yu Lee;Ariel Silver;Pablo Neira Ayuso;Ye Bin;Xu Yang;Zqiang;Theodore Ts'o;Alex Guo;Shaurya Rane;Yuan Tan;Jeffrey Bencteux;Xiang Mei;Weiming Shi;Luiz Augusto von Dentz;Daniil Dulov;Kohei Enju;Martin Ottens;Yuezhang Mo Merged-by: openharmony_ci Description: ## CVE 修复提交 本次提交包含 30 个 CVE 修复： - **CVE-2024-27065**: netfilter: nf_tables: do not compare internal table flags on updates - **CVE-2025-22111**: net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. - **CVE-2025-38693**: media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_t - **CVE-2025-38701**: ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr - **CVE-2025-38704**: rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access - **CVE-2025-38725**: net: usb: asix_devices: add phy_mask for ax88772 mdio bus - **CVE-2025-39691**: fs/buffer: fix use-after-free when call bh_read() helper - **CVE-2025-71239**: audit: add fchmodat2() to change attributes class - **CVE-2026-22979**: net: fix memory leak in skb_segment_list for GRO packets - **CVE-2026-22994**: bpf: Fix reference count leak in bpf_prog_test_run_xdp() - **CVE-2026-23060**: crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - **CVE-2026-23071**: regmap: Fix race condition in hwspinlock irqsave routine - **CVE-2026-23120**: l2tp: avoid one data-race in l2tp_tunnel_del_work() - **CVE-2026-23246**: wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration - **CVE-2026-23253**: media: dvb-core: fix wrong reinitialization of ringbuffer on reopen - **CVE-2026-23254**: net: gro: fix outer network offset - **CVE-2026-23255**: net: add proper RCU protection to /proc/net/ptype - **CVE-2026-23260**: regmap: maple: free entry on mas_store_gfp() failure - **CVE-2026-23264**: Revert "drm/amd: Check if ASPM is enabled from PCIe subsystem" - **CVE-2026-23267**: f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes - **CVE-2026-23268**: apparmor: fix unprivileged local user can do privileged policy management - **CVE-2026-23271**: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race - **CVE-2026-23274**: netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer later - **CVE-2026-23336**: wifi: cfg80211: cancel rfkill_block work in wiphy_unregister - **CVE-2026-23359**: bpf: Fix stack-out-of-bounds write in devmap - **CVE-2026-23395**: Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ - **CVE-2026-23396**: wifi: mac80211: fix NULL deref in mesh_matches_local() - **CVE-2026-23398**: icmp: fix NULL pointer dereference in icmp_tag_validation() - **CVE-2026-23409**: apparmor: fix differential encoding verification - **CVE-2026-23461**: Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user --- 提交由 cve-skill 自动处理生成。 See merge request: openharmony/kernel_linux_6.6!375 | 3 个月前 | |
gpu: host1x: Fix race in syncpt alloc/free stable inclusion from stable-6.6.105 commit c7d393267c497 category: bugfix issue: #207 CVE: CVE-2025-68732 Signed-off-by: 何京晶 <18967138853@163.com> Co-Authored-By: Agent ------------------------------- gpu: host1x: Fix race in syncpt alloc/free Fix race condition between host1x_syncpt_alloc() and host1x_syncpt_put() by using kref_put_mutex() instead of kref_put() + manual mutex locking. This ensures no thread can acquire the syncpt_mutex after the refcount drops to zero but before syncpt_release acquires it. This prevents races where syncpoints could be allocated while still being cleaned up from a previous release. Remove explicit mutex locking in syncpt_release as kref_put_mutex() handles this atomically. Signed-off-by: Mainak Sen <msen@nvidia.com> Fixes: f5ba33fb9690 ("gpu: host1x: Reserve VBLANK syncpoints at initialization") Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com> Signed-off-by: Thierry Reding <treding@nvidia.com> Link: https://lore.kernel.org/r/20250707-host1x-syncpt-race-fix-v1-1-28b0776e70bc@nvidia.com Signed-off-by: 何京晶 <18967138853@163.com> | 5 个月前 | |
Merge tag 'drm-next-2023-08-30' of git://anongit.freedesktop.org/drm/drm Pull drm updates from Dave Airlie: "The drm core grew a new generic gpu virtual address manager, and new execution locking helpers. These are used by nouveau now to provide uAPI support for the userspace Vulkan driver. AMD had a bunch of new IP core support, loads of refactoring around fbdev, but mostly just the usual amount of stuff across the board. core: - fix gfp flags in drmm_kmalloc gpuva: - add new generic GPU VA manager (for nouveau initially) syncobj: - add new DRM_IOCTL_SYNCOBJ_EVENTFD ioctl dma-buf: - acquire resv lock for mmap() in exporters - support dma-buf self import automatically - docs fixes backlight: - fix fbdev interactions atomic: - improve logging prime: - remove struct gem_prim_mmap plus driver updates gem: - drm_exec: add locking over multiple GEM objects - fix lockdep checking fbdev: - make fbdev userspace interfaces optional - use linux device instead of fbdev device - use deferred i/o helper macros in various drivers - Make FB core selectable without drivers - Remove obsolete flags FBINFO_DEFAULT and FBINFO_FLAG_DEFAULT - Add helper macros and Kconfig tokens for DMA-allocated framebuffer ttm: - support init_on_free - swapout fixes panel: - panel-edp: Support AUO B116XAB01.4 - Support Visionox R66451 plus DT bindings - ld9040: - Backlight support - magic improved - Kconfig fix - Convert to of_device_get_match_data() - Fix Kconfig dependencies - simple: - Set bpc value to fix warning - Set connector type for AUO T215HVN01 - Support Innolux G156HCE-L01 plus DT bindings - ili9881: Support TDO TL050HDV35 LCD panel plus DT bindings - startek: Support KD070FHFID015 MIPI-DSI panel plus DT bindings - sitronix-st7789v: - Support Inanbo T28CP45TN89 plus DT bindings - Support EDT ET028013DMA plus DT bindings - Various cleanups - edp: Add timings for N140HCA-EAC - Allow panels and touchscreens to power sequence together - Fix Innolux G156HCE-L01 LVDS clock bridge: - debugfs for chains support - dw-hdmi: - Improve support for YUV420 bus format - CEC suspend/resume - update EDID on HDMI detect - dw-mipi-dsi: Fix enable/disable of DSI controller - lt9611uxc: Use MODULE_FIRMWARE() - ps8640: Remove broken EDID code - samsung-dsim: Fix command transfer - tc358764: - Handle HS/VS polarity - Use BIT() macro - Various cleanups - adv7511: Fix low refresh rate - anx7625: - Switch to macros instead of hardcoded values - locking fixes - tc358767: fix hardware delays - sitronix-st7789v: - Support panel orientation - Support rotation property - Add support for Jasonic JT240MHQS-HWT-EK-E3 plus DT bindings amdgpu: - SDMA 6.1.0 support - HDP 6.1 support - SMUIO 14.0 support - PSP 14.0 support - IH 6.1 support - Lots of checkpatch cleanups - GFX 9.4.3 updates - Add USB PD and IFWI flashing documentation - GPUVM updates - RAS fixes - DRR fixes - FAMS fixes - Virtual display fixes - Soft IH fixes - SMU13 fixes - Rework PSP firmware loading for other IPs - Kernel doc fixes - DCN 3.0.1 fixes - LTTPR fixes - DP MST fixes - DCN 3.1.6 fixes - SMU 13.x fixes - PSP 13.x fixes - SubVP fixes - GC 9.4.3 fixes - Display bandwidth calculation fixes - VCN4 secure submission fixes - Allow building DC on RISC-V - Add visible FB info to bo_print_info - HBR3 fixes - GFX9 MCBP fix - GMC10 vmhub index fix - GMC11 vmhub index fix - Create a new doorbell manager - SR-IOV fixes - initial freesync panel replay support - revert zpos properly until igt regression is fixeed - use TTM to manage doorbell BAR - Expose both current and average power via hwmon if supported amdkfd: - Cleanup CRIU dma-buf handling - Use KIQ to unmap HIQ - GFX 9.4.3 debugger updates - GFX 9.4.2 debugger fixes - Enable cooperative groups fof gfx11 - SVM fixes - Convert older APUs to use dGPU path like newer APUs - Drop IOMMUv2 path as it is no longer used - TBA fix for aldebaran i915: - ICL+ DSI modeset sequence - HDCP improvements - MTL display fixes and cleanups - HSW/BDW PSR1 restored - Init DDI ports in VBT order - General display refactors - Start using plane scale factor for relative data rate - Use shmem for dpt objects - Expose RPS thresholds in sysfs - Apply GuC SLPC min frequency softlimit correctly - Extend Wa_14015795083 to TGL, RKL, DG1 and ADL - Fix a VMA UAF for multi-gt platform - Do not use stolen on MTL due to HW bug - Check HuC and GuC version compatibility on MTL - avoid infinite GPU waits due to premature release of request memory - Fixes and updates for GSC memory allocation - Display SDVO fixes - Take stolen handling out of FBC code - Make i915_coherent_map_type GT-centric - Simplify shmem_create_from_object map_type msm: - SM6125 MDSS support - DPU: SM6125 DPU support - DSI: runtime PM support, burst mode support - DSI PHY: SM6125 support in 14nm DSI PHY driver - GPU: prepare for a7xx - fix a690 firmware - disable relocs on a6xx and newer radeon: - Lots of checkpatch cleanups ast: - improve device-model detection - Represent BMV as virtual connector - Report DP connection status nouveau: - add new exec/bind interface to support Vulkan - document some getparam ioctls - improve VRAM detection - various fixes/cleanups - workraound DPCD issues ivpu: - MMU updates - debugfs support - Support vpu4 virtio: - add sync object support atmel-hlcdc: - Support inverted pixclock polarity etnaviv: - runtime PM cleanups - hang handling fixes exynos: - use fbdev DMA helpers - fix possible NULL ptr dereference komeda: - always attach encoder omapdrm: - use fbdev DMA helpers ingenic: - kconfig regmap fixes loongson: - support display controller mediatek: - Small mtk-dpi cleanups - DisplayPort: support eDP and aux-bus - Fix coverity issues - Fix potential memory leak if vmap() fail mgag200: - minor fixes mxsfb: - support disabling overlay planes panfrost: - fix sync in IRQ handling ssd130x: - Support per-controller default resolution plus DT bindings - Reduce memory-allocation overhead - Improve intermediate buffer size computation - Fix allocation of temporary buffers - Fix pitch computation - Fix shadow plane allocation tegra: - use fbdev DMA helpers - Convert to devm_platform_ioremap_resource() - support bridge/connector - enable PM tidss: - Support TI AM625 plus DT bindings - Implement new connector model plus driver updates vkms: - improve write back support - docs fixes - support gamma LUT zynqmp-dpsub: - misc fixes" * tag 'drm-next-2023-08-30' of git://anongit.freedesktop.org/drm/drm: (1327 commits) drm/gpuva_mgr: remove unused prev pointer in __drm_gpuva_sm_map() drm/tests/drm_kunit_helpers: Place correct function name in the comment header drm/nouveau: uapi: don't pass NO_PREFETCH flag implicitly drm/nouveau: uvmm: fix unset region pointer on remap drm/nouveau: sched: avoid job races between entities drm/i915: Fix HPD polling, reenabling the output poll work as needed drm: Add an HPD poll helper to reschedule the poll work drm/i915: Fix TLB-Invalidation seqno store drm/ttm/tests: Fix type conversion in ttm_pool_test drm/msm/a6xx: Bail out early if setting GPU OOB fails drm/msm/a6xx: Move LLC accessors to the common header drm/msm/a6xx: Introduce a6xx_llc_read drm/ttm/tests: Require MMU when testing drm/panel: simple: Fix Innolux G156HCE-L01 LVDS clock Revert "Revert "drm/amdgpu/display: change pipe policy for DCN 2.0"" drm/amdgpu: Add memory vendor information drm/amd: flush any delayed gfxoff on suspend entry drm/amdgpu: skip fence GFX interrupts disable/enable for S0ix drm/amdgpu: Remove gfxoff check in GFX v9.4.3 drm/amd/pm: Update pci link speed for smu v13.0.6 ... | 2 年前 | |
gpu/trace: add a gpu total memory usage tracepoint This change adds the below gpu memory tracepoint: gpu_mem/gpu_mem_total: track global or proc gpu memory total usages Per process tracking of total gpu memory usage in the gem layer is not appropriate and hard to implement with trivial overhead. So for the gfx device driver layer to track total gpu memory usage both globally and per process in an easy and uniform way is to integrate the tracepoint in this patch to the underlying varied implementations of gpu memory tracking system from vendors. Putting this tracepoint in the common trace events can not only help wean the gfx drivers off of debugfs but also greatly help the downstream Android gpu vendors because debugfs is to be deprecated in the upcoming Android release. Then the gpu memory tracking of both Android kernel and the upstream linux kernel can stay closely, which can benefit the whole kernel eco-system in the long term. Link: http://lkml.kernel.org/r/20200302235044.59163-1-zzyiwei@google.com Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Yiwei Zhang <zzyiwei@google.com> Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org> | 6 年前 | |
PCI/VGA: Move vgaarb to drivers/pci The VGA arbiter is really PCI-specific and doesn't depend on any GPU things. Move it to the PCI subsystem. Note that misc_init() must be called before vga_arb_device_init(). These are both subsys_initcalls, so this ordering depends on the link order, which is determined by drivers/Makefile: obj-y += pci/ obj-y += char/ <-- misc_init() obj-y += gpu/ <-- vga_arb_device_init() (before this commit) The drivers/pci/ subsys_initcalls are called *before* misc_init(), so convert vga_arb_device_init() to subsys_initcall_sync(), which is called after *all* subsys_initcalls. Link: https://lore.kernel.org/r/20220224224753.297579-2-helgaas@kernel.org Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> | 4 年前 | |
gpu: host1x: Add context bus The context bus is a "dummy" bus that contains struct devices that correspond to IOMMU contexts assigned through Host1x to processes. Even when host1x itself is built as a module, the bus is registered in built-in code so that the built-in ARM SMMU driver is able to reference it. Signed-off-by: Mikko Perttunen <mperttunen@nvidia.com> Signed-off-by: Thierry Reding <treding@nvidia.com> | 4 年前 |