January 2023 - Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] USB: Fix kABI for usb_device->reset_in_progress
by Yongqiang Liu 18 Jan '23

18 Jan '23

From: Yuyao Lin <linyuyao1(a)huawei.com> hulk inclusion category: bugfix bugzilla:https://gitee.com/src-openeuler/kernel/issues/I675RE CVE: CVE-2022-4662 -------------------------------- Fix kABI by using __GENKSYMS__ for usb_device->reset_in_progress. Signed-off-by: Yuyao Lin <linyuyao1(a)huawei.com> Reviewed-by: zhangjialin <zhangjialin11(a)huawei.com> Reviewed-by: Wei Li <liwei391(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- include/linux/usb.h | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/include/linux/usb.h b/include/linux/usb.h index 317eedae1c10..9c10a16c3abe 100644 --- a/include/linux/usb.h +++ b/include/linux/usb.h @@ -665,7 +665,6 @@ struct usb_device { unsigned can_submit:1; unsigned persist_enabled:1; - unsigned reset_in_progress:1; unsigned have_langid:1; unsigned authorized:1; unsigned authenticated:1; @@ -677,6 +676,11 @@ struct usb_device { unsigned usb2_hw_lpm_allowed:1; unsigned usb3_lpm_u1_enabled:1; unsigned usb3_lpm_u2_enabled:1; + +#ifndef __GENKSYMS__ + unsigned reset_in_progress:1; +#endif + int string_langid; /* static strings from the device */ -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] USB: Fix kABI for usb_device->reset_in_progress
by Yongqiang Liu 18 Jan '23

18 Jan '23

From: Yuyao Lin <linyuyao1(a)huawei.com> hulk inclusion category: bugfix bugzilla:https://gitee.com/src-openeuler/kernel/issues/I675RE CVE: CVE-2022-4662 -------------------------------- Fix kABI by using __GENKSYMS__ for usb_device->reset_in_progress. Signed-off-by: Yuyao Lin <linyuyao1(a)huawei.com> Reviewed-by: zhangjialin 00591957 <zhangjialin11(a)huawei.com> Reviewed-by: Wei Li <liwei391(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- include/linux/usb.h | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/include/linux/usb.h b/include/linux/usb.h index 317eedae1c10..9c10a16c3abe 100644 --- a/include/linux/usb.h +++ b/include/linux/usb.h @@ -665,7 +665,6 @@ struct usb_device { unsigned can_submit:1; unsigned persist_enabled:1; - unsigned reset_in_progress:1; unsigned have_langid:1; unsigned authorized:1; unsigned authenticated:1; @@ -677,6 +676,11 @@ struct usb_device { unsigned usb2_hw_lpm_allowed:1; unsigned usb3_lpm_u1_enabled:1; unsigned usb3_lpm_u2_enabled:1; + +#ifndef __GENKSYMS__ + unsigned reset_in_progress:1; +#endif + int string_langid; /* static strings from the device */ -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] rndis_wlan: Prevent buffer overflow in rndis_query_oid
by Yongqiang Liu 18 Jan '23

18 Jan '23

From: Szymon Heidrich <szymon.heidrich(a)gmail.com> maillist inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6AQJP CVE: CVE-2023-23559 Reference: https://patchwork.kernel.org/project/linux-wireless/patch/20230111175031.70… ------------------------------- Since resplen and respoffs are signed integers sufficiently large values of unsigned int len and offset members of RNDIS response will result in negative values of prior variables. This may be utilized to bypass implemented security checks to either extract memory contents by manipulating offset or overflow the data buffer via memcpy by manipulating both offset and len. Additionally assure that sum of resplen and respoffs does not overflow so buffer boundaries are kept. Fixes: 80f8c5b434f9 ("rndis_wlan: copy only useful data from rndis_command respond") Signed-off-by: Szymon Heidrich <szymon.heidrich(a)gmail.com> Signed-off-by: Wang Yufen <wangyufen(a)huawei.com> Reviewed-by: Liu Jian <liujian56(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/net/wireless/rndis_wlan.c | 19 ++++++------------- 1 file changed, 6 insertions(+), 13 deletions(-) diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c index 51e4e92d95a0..0bbeb61ec3a3 100644 --- a/drivers/net/wireless/rndis_wlan.c +++ b/drivers/net/wireless/rndis_wlan.c @@ -712,8 +712,8 @@ static int rndis_query_oid(struct usbnet *dev, u32 oid, void *data, int *len) struct rndis_query *get; struct rndis_query_c *get_c; } u; - int ret, buflen; - int resplen, respoffs, copylen; + int ret; + size_t buflen, resplen, respoffs, copylen; buflen = *len + sizeof(*u.get); if (buflen < CONTROL_BUFFER_SIZE) @@ -748,22 +748,15 @@ static int rndis_query_oid(struct usbnet *dev, u32 oid, void *data, int *len) if (respoffs > buflen) { /* Device returned data offset outside buffer, error. */ - netdev_dbg(dev->net, "%s(%s): received invalid " - "data offset: %d > %d\n", __func__, - oid_to_string(oid), respoffs, buflen); + netdev_dbg(dev->net, + "%s(%s): received invalid data offset: %zu > %zu\n", + __func__, oid_to_string(oid), respoffs, buflen); ret = -EINVAL; goto exit_unlock; } - if ((resplen + respoffs) > buflen) { - /* Device would have returned more data if buffer would - * have been big enough. Copy just the bits that we got. - */ - copylen = buflen - respoffs; - } else { - copylen = resplen; - } + copylen = min(resplen, buflen - respoffs); if (copylen > *len) copylen = *len; -- 2.25.1

1 0

[openEuler-22.03-LTS] rndis_wlan: Prevent buffer overflow in rndis_query_oid
by Wang Yufen 17 Jan '23

17 Jan '23

From: Szymon Heidrich <szymon.heidrich(a)gmail.com> maillist inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6AQJP CVE: CVE-2023-23559 Reference: https://patchwork.kernel.org/project/linux-wireless/patch/20230111175031.70… ------------------------------- Since resplen and respoffs are signed integers sufficiently large values of unsigned int len and offset members of RNDIS response will result in negative values of prior variables. This may be utilized to bypass implemented security checks to either extract memory contents by manipulating offset or overflow the data buffer via memcpy by manipulating both offset and len. Additionally assure that sum of resplen and respoffs does not overflow so buffer boundaries are kept. Fixes: 80f8c5b434f9 ("rndis_wlan: copy only useful data from rndis_command respond") Signed-off-by: Szymon Heidrich <szymon.heidrich(a)gmail.com> Signed-off-by: Wang Yufen <wangyufen(a)huawei.com> --- drivers/net/wireless/rndis_wlan.c | 19 ++++++------------- 1 file changed, 6 insertions(+), 13 deletions(-) diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c index 75b5d54..dc076d8 100644 --- a/drivers/net/wireless/rndis_wlan.c +++ b/drivers/net/wireless/rndis_wlan.c @@ -694,8 +694,8 @@ static int rndis_query_oid(struct usbnet *dev, u32 oid, void *data, int *len) struct rndis_query *get; struct rndis_query_c *get_c; } u; - int ret, buflen; - int resplen, respoffs, copylen; + int ret; + size_t buflen, resplen, respoffs, copylen; buflen = *len + sizeof(*u.get); if (buflen < CONTROL_BUFFER_SIZE) @@ -730,22 +730,15 @@ static int rndis_query_oid(struct usbnet *dev, u32 oid, void *data, int *len) if (respoffs > buflen) { /* Device returned data offset outside buffer, error. */ - netdev_dbg(dev->net, "%s(%s): received invalid " - "data offset: %d > %d\n", __func__, - oid_to_string(oid), respoffs, buflen); + netdev_dbg(dev->net, + "%s(%s): received invalid data offset: %zu > %zu\n", + __func__, oid_to_string(oid), respoffs, buflen); ret = -EINVAL; goto exit_unlock; } - if ((resplen + respoffs) > buflen) { - /* Device would have returned more data if buffer would - * have been big enough. Copy just the bits that we got. - */ - copylen = buflen - respoffs; - } else { - copylen = resplen; - } + copylen = min(resplen, buflen - respoffs); if (copylen > *len) copylen = *len; -- 1.8.3.1

1 0

[OLK-5.10] rndis_wlan: Prevent buffer overflow in rndis_query_oid
by Wang Yufen 17 Jan '23

17 Jan '23

From: Szymon Heidrich <szymon.heidrich(a)gmail.com> maillist inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6AQJP CVE: CVE-2023-23559 Reference: https://patchwork.kernel.org/project/linux-wireless/patch/20230111175031.70… ------------------------------- Since resplen and respoffs are signed integers sufficiently large values of unsigned int len and offset members of RNDIS response will result in negative values of prior variables. This may be utilized to bypass implemented security checks to either extract memory contents by manipulating offset or overflow the data buffer via memcpy by manipulating both offset and len. Additionally assure that sum of resplen and respoffs does not overflow so buffer boundaries are kept. Fixes: 80f8c5b434f9 ("rndis_wlan: copy only useful data from rndis_command respond") Signed-off-by: Szymon Heidrich <szymon.heidrich(a)gmail.com> Signed-off-by: Wang Yufen <wangyufen(a)huawei.com> --- drivers/net/wireless/rndis_wlan.c | 19 ++++++------------- 1 file changed, 6 insertions(+), 13 deletions(-) diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c index 75b5d54..dc076d8 100644 --- a/drivers/net/wireless/rndis_wlan.c +++ b/drivers/net/wireless/rndis_wlan.c @@ -694,8 +694,8 @@ static int rndis_query_oid(struct usbnet *dev, u32 oid, void *data, int *len) struct rndis_query *get; struct rndis_query_c *get_c; } u; - int ret, buflen; - int resplen, respoffs, copylen; + int ret; + size_t buflen, resplen, respoffs, copylen; buflen = *len + sizeof(*u.get); if (buflen < CONTROL_BUFFER_SIZE) @@ -730,22 +730,15 @@ static int rndis_query_oid(struct usbnet *dev, u32 oid, void *data, int *len) if (respoffs > buflen) { /* Device returned data offset outside buffer, error. */ - netdev_dbg(dev->net, "%s(%s): received invalid " - "data offset: %d > %d\n", __func__, - oid_to_string(oid), respoffs, buflen); + netdev_dbg(dev->net, + "%s(%s): received invalid data offset: %zu > %zu\n", + __func__, oid_to_string(oid), respoffs, buflen); ret = -EINVAL; goto exit_unlock; } - if ((resplen + respoffs) > buflen) { - /* Device would have returned more data if buffer would - * have been big enough. Copy just the bits that we got. - */ - copylen = buflen - respoffs; - } else { - copylen = resplen; - } + copylen = min(resplen, buflen - respoffs); if (copylen > *len) copylen = *len; -- 1.8.3.1

1 0

[openEuler-1.0-LTS] rndis_wlan: Prevent buffer overflow in rndis_query_oid
by Wang Yufen 17 Jan '23

17 Jan '23

From: Szymon Heidrich <szymon.heidrich(a)gmail.com> maillist inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6AQJP CVE: CVE-2023-23559 Reference: https://patchwork.kernel.org/project/linux-wireless/patch/20230111175031.70… ------------------------------- Since resplen and respoffs are signed integers sufficiently large values of unsigned int len and offset members of RNDIS response will result in negative values of prior variables. This may be utilized to bypass implemented security checks to either extract memory contents by manipulating offset or overflow the data buffer via memcpy by manipulating both offset and len. Additionally assure that sum of resplen and respoffs does not overflow so buffer boundaries are kept. Fixes: 80f8c5b434f9 ("rndis_wlan: copy only useful data from rndis_command respond") Signed-off-by: Szymon Heidrich <szymon.heidrich(a)gmail.com> Signed-off-by: Wang Yufen <wangyufen(a)huawei.com> --- drivers/net/wireless/rndis_wlan.c | 19 ++++++------------- 1 file changed, 6 insertions(+), 13 deletions(-) diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c index 51e4e92..0bbeb61 100644 --- a/drivers/net/wireless/rndis_wlan.c +++ b/drivers/net/wireless/rndis_wlan.c @@ -712,8 +712,8 @@ static int rndis_query_oid(struct usbnet *dev, u32 oid, void *data, int *len) struct rndis_query *get; struct rndis_query_c *get_c; } u; - int ret, buflen; - int resplen, respoffs, copylen; + int ret; + size_t buflen, resplen, respoffs, copylen; buflen = *len + sizeof(*u.get); if (buflen < CONTROL_BUFFER_SIZE) @@ -748,22 +748,15 @@ static int rndis_query_oid(struct usbnet *dev, u32 oid, void *data, int *len) if (respoffs > buflen) { /* Device returned data offset outside buffer, error. */ - netdev_dbg(dev->net, "%s(%s): received invalid " - "data offset: %d > %d\n", __func__, - oid_to_string(oid), respoffs, buflen); + netdev_dbg(dev->net, + "%s(%s): received invalid data offset: %zu > %zu\n", + __func__, oid_to_string(oid), respoffs, buflen); ret = -EINVAL; goto exit_unlock; } - if ((resplen + respoffs) > buflen) { - /* Device would have returned more data if buffer would - * have been big enough. Copy just the bits that we got. - */ - copylen = buflen - respoffs; - } else { - copylen = resplen; - } + copylen = min(resplen, buflen - respoffs); if (copylen > *len) copylen = *len; -- 1.8.3.1

1 0

[PATCH] rndis_wlan: Prevent buffer overflow in rndis_query_oid
by Wang Yufen 17 Jan '23

17 Jan '23

From: Szymon Heidrich <szymon.heidrich(a)gmail.com> maillist inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6AQJP CVE: CVE-2023-23559 Reference: https://patchwork.kernel.org/project/linux-wireless/patch/20230111175031.70… ------------------------------- Since resplen and respoffs are signed integers sufficiently large values of unsigned int len and offset members of RNDIS response will result in negative values of prior variables. This may be utilized to bypass implemented security checks to either extract memory contents by manipulating offset or overflow the data buffer via memcpy by manipulating both offset and len. Additionally assure that sum of resplen and respoffs does not overflow so buffer boundaries are kept. Fixes: 80f8c5b434f9 ("rndis_wlan: copy only useful data from rndis_command respond") Signed-off-by: Szymon Heidrich <szymon.heidrich(a)gmail.com> Signed-off-by: Wang Yufen <wangyufen(a)huawei.com> --- drivers/net/wireless/rndis_wlan.c | 19 ++++++------------- 1 file changed, 6 insertions(+), 13 deletions(-) diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c index 51e4e92..0bbeb61 100644 --- a/drivers/net/wireless/rndis_wlan.c +++ b/drivers/net/wireless/rndis_wlan.c @@ -712,8 +712,8 @@ static int rndis_query_oid(struct usbnet *dev, u32 oid, void *data, int *len) struct rndis_query *get; struct rndis_query_c *get_c; } u; - int ret, buflen; - int resplen, respoffs, copylen; + int ret; + size_t buflen, resplen, respoffs, copylen; buflen = *len + sizeof(*u.get); if (buflen < CONTROL_BUFFER_SIZE) @@ -748,22 +748,15 @@ static int rndis_query_oid(struct usbnet *dev, u32 oid, void *data, int *len) if (respoffs > buflen) { /* Device returned data offset outside buffer, error. */ - netdev_dbg(dev->net, "%s(%s): received invalid " - "data offset: %d > %d\n", __func__, - oid_to_string(oid), respoffs, buflen); + netdev_dbg(dev->net, + "%s(%s): received invalid data offset: %zu > %zu\n", + __func__, oid_to_string(oid), respoffs, buflen); ret = -EINVAL; goto exit_unlock; } - if ((resplen + respoffs) > buflen) { - /* Device would have returned more data if buffer would - * have been big enough. Copy just the bits that we got. - */ - copylen = buflen - respoffs; - } else { - copylen = resplen; - } + copylen = min(resplen, buflen - respoffs); if (copylen > *len) copylen = *len; -- 1.8.3.1

1 0

[PATCH openEuler-22.09 0/2]fix two review issue for memcpy_mcs()
by Tong Tiangen 16 Jan '23

16 Jan '23

Tong Tiangen (2): arm64: fix return value type of memcpy_mcs() kasan: add kasan support for memcpy_mcs() arch/arm64/include/asm/string.h | 4 ++-- mm/kasan/common.c | 12 ++++++++++++ 2 files changed, 14 insertions(+), 2 deletions(-) -- 2.25.1

1 2

[PATCH OLK-5.10 0/2]fix two review issue for memcpy_mcs()
by Tong Tiangen 16 Jan '23

16 Jan '23

Tong Tiangen (2): arm64: fix return value type of memcpy_mcs() kasan: add kasan support for memcpy_mcs() arch/arm64/include/asm/string.h | 4 ++-- mm/kasan/common.c | 12 ++++++++++++ 2 files changed, 14 insertions(+), 2 deletions(-) -- 2.25.1

1 2

[PATCH openEuler-22.03-LTS] selftests/rseq: check if libc rseq support is registered
by MinMin Ren 12 Jan '23

12 Jan '23

From: Michael Jeanson <mjeanson(a)efficios.com> mainline inclusion from mainline-v6.0-rc1 commit d1a997ba4c1bf65497d956aea90de42a6398f73a category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I69PT8 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit d1a997ba4c1bf65497d956aea90de42a6398f73a upstream. When checking for libc rseq support in the library constructor, don't only depend on the symbols presence, check that the registration was completed. This targets a scenario where the libc has rseq support but it is not wired for the current architecture in 'bits/rseq.h', we want to fallback to our internal registration mechanism. Signed-off-by: Michael Jeanson <mjeanson(a)efficios.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Reviewed-by: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com> Link: https://lore.kernel.org/r/20220614154830.1367382-4-mjeanson@efficios.com Signed-off-by: rminmin <rmm0811(a)gmail.com> --- tools/testing/selftests/rseq/rseq.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tools/testing/selftests/rseq/rseq.c b/tools/testing/selftests/rseq/rseq.c index 986b9458efb2..4177f9507bbe 100644 --- a/tools/testing/selftests/rseq/rseq.c +++ b/tools/testing/selftests/rseq/rseq.c @@ -111,7 +111,8 @@ void rseq_init(void) libc_rseq_offset_p = dlsym(RTLD_NEXT, "__rseq_offset"); libc_rseq_size_p = dlsym(RTLD_NEXT, "__rseq_size"); libc_rseq_flags_p = dlsym(RTLD_NEXT, "__rseq_flags"); - if (libc_rseq_size_p && libc_rseq_offset_p && libc_rseq_flags_p) { + if (libc_rseq_size_p && libc_rseq_offset_p && libc_rseq_flags_p && + *libc_rseq_size_p != 0) { /* rseq registration owned by glibc */ rseq_offset = *libc_rseq_offset_p; rseq_size = *libc_rseq_size_p; -- 2.33.0

1 0