From: Greg Kroah-Hartman Date: Wed, 5 Aug 2026 09:40:21 +0000 (+0200) Subject: 5.10-stable patches X-Git-Url: http://git.ipfire.org/index.cgi?a=commitdiff_plain;h=ace401d480a461bd5df3a150e036fd304766cff9;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: audit-fix-potential-integer-overflow-in-audit_log_n_string.patch audit-fix-potential-use-after-free-in-audit_del_rule.patch bluetooth-hidp-validate-numbered-report-payloads.patch mm-hugetlb-fix-list-corruption-in-allocate_file_region_entries.patch mm-percpu-km-fix-bitmap-overflow-and-accounting-in-pcpu_create_chunk.patch sctp-validate-adaptation-indication-parameter-length.patch --- diff --git a/queue-5.10/audit-fix-potential-integer-overflow-in-audit_log_n_string.patch b/queue-5.10/audit-fix-potential-integer-overflow-in-audit_log_n_string.patch new file mode 100644 index 0000000000..d82afc6329 --- /dev/null +++ b/queue-5.10/audit-fix-potential-integer-overflow-in-audit_log_n_string.patch @@ -0,0 +1,61 @@ +From f865c143629d4094866a811dba5f329250bad486 Mon Sep 17 00:00:00 2001 +From: Zhan Xusheng +Date: Sat, 18 Jul 2026 13:09:22 +0800 +Subject: audit: fix potential integer overflow in audit_log_n_string() + +From: Zhan Xusheng + +commit f865c143629d4094866a811dba5f329250bad486 upstream. + +audit_log_n_string() computes new_len as "slen + 3" (enclosing quotes +plus the NUL terminator) and stores it into an int, while slen is a +size_t. For a sufficiently large slen the addition can overflow and/or +the result be truncated when assigned to the int new_len, so the +"new_len > avail" check can be bypassed and the subsequent +memcpy(ptr, string, slen) can write past the skb tail. + +This is the same class of bug that was fixed for the hex sibling in +commit 65dfde57d1e2 ("audit: fix potential integer overflow in +audit_log_n_hex()"); both helpers are reached through +audit_log_n_untrustedstring() with the same length source. + +Make new_len a size_t and use check_add_overflow() to catch the +overflow, mirroring the audit_log_n_hex() fix. No functional change for +the in-tree callers, which all pass bounded lengths. + +Cc: stable@vger.kernel.org +Fixes: 168b7173959f ("AUDIT: Clean up logging of untrusted strings") +Signed-off-by: Zhan Xusheng +Signed-off-by: Paul Moore +Signed-off-by: Greg Kroah-Hartman +--- + kernel/audit.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +--- a/kernel/audit.c ++++ b/kernel/audit.c +@@ -2074,7 +2074,8 @@ void audit_log_n_hex(struct audit_buffer + void audit_log_n_string(struct audit_buffer *ab, const char *string, + size_t slen) + { +- int avail, new_len; ++ int avail; ++ size_t new_len; + unsigned char *ptr; + struct sk_buff *skb; + +@@ -2084,7 +2085,13 @@ void audit_log_n_string(struct audit_buf + BUG_ON(!ab->skb); + skb = ab->skb; + avail = skb_tailroom(skb); +- new_len = slen + 3; /* enclosing quotes + null terminator */ ++ ++ /* enclosing quotes + null terminator */ ++ if (check_add_overflow(slen, 3, &new_len)) { ++ audit_log_format(ab, "?"); ++ return; ++ } ++ + if (new_len > avail) { + avail = audit_expand(ab, new_len); + if (!avail) diff --git a/queue-5.10/audit-fix-potential-use-after-free-in-audit_del_rule.patch b/queue-5.10/audit-fix-potential-use-after-free-in-audit_del_rule.patch new file mode 100644 index 0000000000..c039e37ce4 --- /dev/null +++ b/queue-5.10/audit-fix-potential-use-after-free-in-audit_del_rule.patch @@ -0,0 +1,55 @@ +From 246df90b5f1a8a6e6abbd2f058b029558720adec Mon Sep 17 00:00:00 2001 +From: Luxiao Xu +Date: Tue, 21 Jul 2026 23:37:41 +0800 +Subject: audit: fix potential use-after-free in audit_del_rule() + +From: Luxiao Xu + +commit 246df90b5f1a8a6e6abbd2f058b029558720adec upstream. + +`audit_del_rule()` destroys `e->rule.exe` via `audit_remove_mark_rule()` +before unlinking the rule from RCU-visible filter lists and waiting for a +grace period. Concurrent readers in `audit_filter()` and +`audit_filter_rules()` still dereference `e->rule.exe`, while the fsnotify +mark can be freed on an independent lifetime path. This creates a +use-after-free window during rule deletion. + +Fix this by unlinking the rule from the RCU-visible lists and invoking +`synchronize_rcu()` before calling `audit_remove_mark_rule()` (and other +rule removal helpers). This ensures that all existing RCU readers have +exited the critical section before any underlying resources are destroyed. + +Cc: stable@vger.kernel.org +Fixes: 34d99af52ad4 ("audit: implement audit by executable") +Reported-by: Vega +Assisted-by: Codex:gpt-5.4 +Signed-off-by: Luxiao Xu +Signed-off-by: Ren Wei +Signed-off-by: Paul Moore +Signed-off-by: Greg Kroah-Hartman +--- + kernel/auditfilter.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/kernel/auditfilter.c ++++ b/kernel/auditfilter.c +@@ -1036,6 +1036,10 @@ int audit_del_rule(struct audit_entry *e + goto out; + } + ++ list_del_rcu(&e->list); ++ list_del(&e->rule.list); ++ synchronize_rcu(); ++ + if (e->rule.watch) + audit_remove_watch_rule(&e->rule); + +@@ -1053,8 +1057,6 @@ int audit_del_rule(struct audit_entry *e + audit_signals--; + #endif + +- list_del_rcu(&e->list); +- list_del(&e->rule.list); + call_rcu(&e->rcu, audit_free_rule_rcu); + + out: diff --git a/queue-5.10/bluetooth-hidp-validate-numbered-report-payloads.patch b/queue-5.10/bluetooth-hidp-validate-numbered-report-payloads.patch new file mode 100644 index 0000000000..f06bab23bb --- /dev/null +++ b/queue-5.10/bluetooth-hidp-validate-numbered-report-payloads.patch @@ -0,0 +1,53 @@ +From 34f53d27b81a16a02828c8fdfa4e02badc326f17 Mon Sep 17 00:00:00 2001 +From: Sangho Lee +Date: Thu, 23 Jul 2026 12:28:07 +0900 +Subject: Bluetooth: HIDP: validate numbered report payloads + +From: Sangho Lee + +commit 34f53d27b81a16a02828c8fdfa4e02badc326f17 upstream. + +When hidp_get_raw_report() waits for a numbered report, +hidp_process_data() compares the expected report number with skb->data[0]. +A connected HIDP peer can reply with only a DATA transaction header, +leaving the skb empty after the header is removed. + +KMSAN reports an uninitialized-value use in hidp_session_run(), with the +value originating in __alloc_skb() through vhci_write(). The transaction +header checks remove the empty-frame reports, but this report remains until +the payload check is added. + +The comparison can also consume a peer-controlled byte beyond the declared +L2CAP PDU. A DATA | FEATURE response followed by an extra 0x01 byte made +the current code accept that byte as report ID 1 and complete +HIDIOCGFEATURE with a zero-byte result. With this change the malformed +response is rejected with -EIO, while a subsequent valid response still +succeeds. + +Require a payload byte before comparing a numbered report ID. Unnumbered +reports continue to accept an empty payload. + +Fixes: 0ff1731a1ae5 ("HID: bt: Add support for hidraw HIDIOCGFEATURE and HIDIOCSFEATURE") +Cc: stable@vger.kernel.org +Signed-off-by: Sangho Lee +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Greg Kroah-Hartman +--- + net/bluetooth/hidp/core.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/net/bluetooth/hidp/core.c ++++ b/net/bluetooth/hidp/core.c +@@ -533,9 +533,10 @@ static int hidp_process_data(struct hidp + } + + if (test_bit(HIDP_WAITING_FOR_RETURN, &session->flags) && +- param == session->waiting_report_type) { ++ param == session->waiting_report_type) { + if (session->waiting_report_number < 0 || +- session->waiting_report_number == skb->data[0]) { ++ (skb->len && ++ session->waiting_report_number == skb->data[0])) { + /* hidp_get_raw_report() is waiting on this report. */ + session->report_return = skb; + done_with_skb = 0; diff --git a/queue-5.10/mm-hugetlb-fix-list-corruption-in-allocate_file_region_entries.patch b/queue-5.10/mm-hugetlb-fix-list-corruption-in-allocate_file_region_entries.patch new file mode 100644 index 0000000000..2bedf7ea3a --- /dev/null +++ b/queue-5.10/mm-hugetlb-fix-list-corruption-in-allocate_file_region_entries.patch @@ -0,0 +1,77 @@ +From dd9623f58ec702a07b2d67179d6fcea79c52231a Mon Sep 17 00:00:00 2001 +From: Xiangfeng Cai +Date: Tue, 14 Jul 2026 01:14:55 +0800 +Subject: mm/hugetlb: fix list corruption in allocate_file_region_entries() + +From: Xiangfeng Cai + +commit dd9623f58ec702a07b2d67179d6fcea79c52231a upstream. + +allocate_file_region_entries() tops up resv->region_cache with freshly +allocated file_region descriptors. The allocation uses GFP_KERNEL, so +resv->lock is dropped around it: the new entries are gathered on a +stack-local list head, allocated_regions, and spliced into +resv->region_cache once the lock is re-acquired. + +The splice used list_splice(), which moves the entries but does not +re-initialize the source head, so allocated_regions is left pointing at an +entry that now lives on resv->region_cache. The top-up runs in a while +loop that re-checks the cache deficit after re-acquiring the lock. For a +shared mapping the resv_map is shared by every mapper of the hugetlbfs +inode, so a concurrent region_chg()/region_add()/region_del() on the same +resv_map can consume cache entries during the unlocked window and force a +second iteration. That iteration calls list_add() on the stale head and +corrupts the list; with CONFIG_DEBUG_LIST the __list_add_valid() check +trips: + + list_add corruption. next->prev should be prev (ffffc900011ff7f8), + but was ffff88814c281460. (next=ffff88814c545640). + kernel BUG at lib/list_debug.c:31! + allocate_file_region_entries+0x191/0x420 + region_chg+0x267/0x300 + hugetlb_reserve_pages+0x387/0xc80 + hugetlbfs_file_mmap+0x2ce/0x3f0 + mmap_region+0x1348/0x1a80 + do_mmap+0x85e/0xb90 + vm_mmap_pgoff+0x18c/0x330 + ksys_mmap_pgoff+0x2a1/0x3e0 + do_syscall_64+0xd7/0x420 + +Without CONFIG_DEBUG_LIST the bad list_add() silently links a kernel-stack +address into resv->region_cache, leading to later use-after-free. + +This was observed as a real host panic on a dense KVM host where a QEMU +guest-RAM hugetlbfs file was mapped MAP_SHARED by both QEMU and a separate +SPDK/DPDK vhost-user target, generating concurrent region_* traffic on one +shared resv_map. + +Use list_splice_init() so the source head is re-initialized empty after +each splice, making the retry loop safe. + +Link: https://lore.kernel.org/20260713171456.300518-2-caixiangfeng@bytedance.com +Fixes: d3ec7b6e09e5 ("mm/hugetlb: use list_splice to merge two list at once") +Signed-off-by: Xiangfeng Cai +Reviewed-by: Muchun Song +Cc: Baoquan He +Cc: David Hildenbrand +Cc: Oscar Salvador +Cc: Shuah Khan +Cc: Wei Yang +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + mm/hugetlb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -482,7 +482,7 @@ static int allocate_file_region_entries( + + spin_lock(&resv->lock); + +- list_splice(&allocated_regions, &resv->region_cache); ++ list_splice_init(&allocated_regions, &resv->region_cache); + resv->region_cache_count += to_allocate; + } + diff --git a/queue-5.10/mm-percpu-km-fix-bitmap-overflow-and-accounting-in-pcpu_create_chunk.patch b/queue-5.10/mm-percpu-km-fix-bitmap-overflow-and-accounting-in-pcpu_create_chunk.patch new file mode 100644 index 0000000000..7a49264a4a --- /dev/null +++ b/queue-5.10/mm-percpu-km-fix-bitmap-overflow-and-accounting-in-pcpu_create_chunk.patch @@ -0,0 +1,53 @@ +From 89b1b79c308818a715e75f28744b70d8940a07c9 Mon Sep 17 00:00:00 2001 +From: Zi Yan +Date: Thu, 9 Jul 2026 15:12:01 -0400 +Subject: mm/percpu-km: fix bitmap overflow and accounting in pcpu_create_chunk() + +From: Zi Yan + +commit 89b1b79c308818a715e75f28744b70d8940a07c9 upstream. + +In pcpu_create_chunk(), nr_pages is the total contiguous backing +allocation, i.e., nr_units * pcpu_unit_pages, but pcpu_chunk_populated() +uses it to set chunk->populated, whose size is pcpu_unit_pages, bitmap. +Since bit N in chunk->populated means page offset N inside every unit is +backed. When nr_units > 1, the function writes beyond chunk->populated. +Fix it by using chunk->nr_pages. + +It also fixes the global pcpu_nr_empty_pop_pages accounting, since +pcpu_balance_free() only iterates up to chunk->nr_pages. + +Commit a63d4ac4ab609 ("percpu: make percpu-km set chunk->populated bitmap +properly") introduced the bitmap overflow issue. Later, commit +b539b87fed37f ("percpu: implmeent pcpu_nr_empty_pop_pages and +chunk->nr_populated") added pcpu_nr_empty_pop_pages and caused the +accounting issue. + +Link: https://lore.kernel.org/20260709-fix-pcpu_create_chunk-in-percpu-km-v1-1-1f64745a84cc@nvidia.com +Fixes: a63d4ac4ab609 ("percpu: make percpu-km set chunk->populated bitmap properly") +Reported-by: Sashiko +Closes: https://sashiko.dev/#/patchset/20260703-keep-subpage-private-zero-at-free-v2-0-2970fe777dd6%40nvidia.com?part=1 +Assisted-by: Codex:GPT-5 +Signed-off-by: Zi Yan +Acked-by: Dennis Zhou +Cc: Christoph Lameter +Cc: Tejun Heo +Cc: Zi Yan +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + mm/percpu-km.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/mm/percpu-km.c ++++ b/mm/percpu-km.c +@@ -70,7 +70,7 @@ static struct pcpu_chunk *pcpu_create_ch + chunk->base_addr = page_address(pages); + + spin_lock_irqsave(&pcpu_lock, flags); +- pcpu_chunk_populated(chunk, 0, nr_pages); ++ pcpu_chunk_populated(chunk, 0, chunk->nr_pages); + spin_unlock_irqrestore(&pcpu_lock, flags); + + pcpu_stats_chunk_alloc(); diff --git a/queue-5.10/sctp-validate-adaptation-indication-parameter-length.patch b/queue-5.10/sctp-validate-adaptation-indication-parameter-length.patch new file mode 100644 index 0000000000..3129c63a6e --- /dev/null +++ b/queue-5.10/sctp-validate-adaptation-indication-parameter-length.patch @@ -0,0 +1,51 @@ +From 74b21f52c5c5a71a05c0ff70e513f4f04ff28b17 Mon Sep 17 00:00:00 2001 +From: Charles Vosburgh +Date: Mon, 27 Jul 2026 19:17:30 -0400 +Subject: sctp: validate Adaptation Indication parameter length + +From: Charles Vosburgh + +commit 74b21f52c5c5a71a05c0ff70e513f4f04ff28b17 upstream. + +The Adaptation Layer Indication parameter contains a fixed 32-bit +Adaptation Code Point after its parameter header. However, +sctp_verify_param() accepts a header-only parameter because the generic +parameter walker only requires the header to be present. + +sctp_process_param() then reads adaptation_ind beyond the declared +parameter. When the malformed parameter is last in an INIT, the read +starts at the receive skb tail, and the value is copied into the state +cookie returned in the INIT ACK. This may disclose four receive-buffer +tail bytes. + +Require the declared parameter length to match the fixed structure size +and abort the association through the existing invalid parameter length +path otherwise. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Cc: stable@vger.kernel.org +Signed-off-by: Charles Vosburgh +Acked-by: Xin Long +Link: https://patch.msgid.link/20260727-sctp-adaptation-length-v1-1-0ab58b2810a5@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/sctp/sm_make_chunk.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/net/sctp/sm_make_chunk.c ++++ b/net/sctp/sm_make_chunk.c +@@ -2142,7 +2142,13 @@ static enum sctp_ierror sctp_verify_para + case SCTP_PARAM_HEARTBEAT_INFO: + case SCTP_PARAM_UNRECOGNIZED_PARAMETERS: + case SCTP_PARAM_ECN_CAPABLE: ++ break; + case SCTP_PARAM_ADAPTATION_LAYER_IND: ++ if (ntohs(param.p->length) != sizeof(*param.aind)) { ++ sctp_process_inv_paramlength(asoc, param.p, ++ chunk, err_chunk); ++ retval = SCTP_IERROR_ABORT; ++ } + break; + + case SCTP_PARAM_SUPPORTED_EXT: diff --git a/queue-5.10/series b/queue-5.10/series index 828bde5d6e..a77b6d0d9b 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -239,3 +239,9 @@ ipv6-fib6-fix-null-deref-in-fib6_walk_continue-on-mu.patch rhashtable-clear-stale-iter-p-on-table-restart.patch pinctrl-devicetree-don-t-free-uninitialized-dev_name-on-error-path.patch pinctrl-bm1880-add-missing-select-generic_pinconf.patch +mm-percpu-km-fix-bitmap-overflow-and-accounting-in-pcpu_create_chunk.patch +mm-hugetlb-fix-list-corruption-in-allocate_file_region_entries.patch +sctp-validate-adaptation-indication-parameter-length.patch +audit-fix-potential-integer-overflow-in-audit_log_n_string.patch +audit-fix-potential-use-after-free-in-audit_del_rule.patch +bluetooth-hidp-validate-numbered-report-payloads.patch