October 2024 - Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] kabi: use CONFIG_KABI_RESERVE to control reservation in ucount_type and user_table
by GONG Ruiqi 26 Oct '24

26 Oct '24

From: "GONG, Ruiqi" <gongruiqi1(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4MYYH CVE: NA ---------------------------------------- Commit 328e64817efe ("kabi: reserve space for cred and user_namespace"), besides reserving space for struct cred and struct user_namespace, adds new members to enum ucount_type and struct ctl_table user_table[] as well. Use CONFIG_KABI_RESERVE to control them. Signed-off-by: GONG, Ruiqi <gongruiqi1(a)huawei.com> --- include/linux/user_namespace.h | 2 ++ kernel/ucount.c | 2 ++ 2 files changed, 4 insertions(+) diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h index f79abb16a874..6bdd18062ee0 100644 --- a/include/linux/user_namespace.h +++ b/include/linux/user_namespace.h @@ -51,6 +51,7 @@ enum ucount_type { UCOUNT_INOTIFY_INSTANCES, UCOUNT_INOTIFY_WATCHES, #endif +#ifdef CONFIG_KABI_RESERVE /* These 15 members are reserved (with extra margin) for the future * enlargement of enum ucount_type, as how RH8.1 did it. This number * should be enough, as 6 of them are very likely to be used in the near @@ -71,6 +72,7 @@ enum ucount_type { UCOUNT_KABI_RESERVE13, UCOUNT_KABI_RESERVE14, UCOUNT_KABI_RESERVE15, +#endif UCOUNT_COUNTS, }; diff --git a/kernel/ucount.c b/kernel/ucount.c index 1f5825b674d8..093b2fa76385 100644 --- a/kernel/ucount.c +++ b/kernel/ucount.c @@ -77,6 +77,7 @@ static struct ctl_table user_table[] = { UCOUNT_ENTRY("max_inotify_instances"), UCOUNT_ENTRY("max_inotify_watches"), #endif +#ifdef CONFIG_KABI_RESERVE /* These corresponds to the reservation in enum ucount_type */ { }, // UCOUNT_KABI_RESERVE1 { }, // UCOUNT_KABI_RESERVE2 @@ -93,6 +94,7 @@ static struct ctl_table user_table[] = { { }, // UCOUNT_KABI_RESERVE13 { }, // UCOUNT_KABI_RESERVE14 { }, // UCOUNT_KABI_RESERVE15 +#endif { } }; #endif /* CONFIG_SYSCTL */ -- 2.25.1

2 1

[PATCH OLK-5.10 0/1] fix CVE-2024-49924
by Lin Yujun 26 Oct '24

26 Oct '24

Kaixin Wang (1): fbdev: pxafb: Fix possible use after free in pxafb_task() drivers/video/fbdev/pxafb.c | 1 + 1 file changed, 1 insertion(+) -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS-SP1 0/1] fix CVE-2024-49924
by Lin Yujun 26 Oct '24

26 Oct '24

Kaixin Wang (1): fbdev: pxafb: Fix possible use after free in pxafb_task() drivers/video/fbdev/pxafb.c | 1 + 1 file changed, 1 insertion(+) -- 2.34.1

2 2

[PATCH OLK-6.6] drm/amd/display: Add null check for head_pipe in dcn32_acquire_idle_pipe_for_head_pipe_in_layer
by Li Huafei 26 Oct '24

26 Oct '24

From: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> mainline inclusion from mainline-v6.12-rc1 commit ac2140449184a26eac99585b7f69814bd3ba8f2d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRAX CVE: CVE-2024-49918 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- This commit addresses a potential null pointer dereference issue in the `dcn32_acquire_idle_pipe_for_head_pipe_in_layer` function. The issue could occur when `head_pipe` is null. The fix adds a check to ensure `head_pipe` is not null before asserting it. If `head_pipe` is null, the function returns NULL to prevent a potential null pointer dereference. Reported by smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/resource/dcn32/dcn32_resource.c:2690 dcn32_acquire_idle_pipe_for_head_pipe_in_layer() error: we previously assumed 'head_pipe' could be null (see line 2681) Cc: Tom Chung <chiahsuan.chung(a)amd.com> Cc: Rodrigo Siqueira <Rodrigo.Siqueira(a)amd.com> Cc: Roman Li <roman.li(a)amd.com> Cc: Alex Hung <alex.hung(a)amd.com> Cc: Aurabindo Pillai <aurabindo.pillai(a)amd.com> Cc: Harry Wentland <harry.wentland(a)amd.com> Cc: Hamza Mahfooz <hamza.mahfooz(a)amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> Reviewed-by: Tom Chung <chiahsuan.chung(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Conflicts: drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c drivers/gpu/drm/amd/display/dc/resource/dcn32/dcn32_resource.c [ Resolve the conflict caused by renaming files in the commit 8b8eed05a1c6 ('drm/amd/display: Refactor resource into component directory'). ] Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c index 4d4ff13a2af8..d96c1d953593 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c +++ b/drivers/gpu/drm/amd/display/dc/dcn32/dcn32_resource.c @@ -2642,8 +2642,10 @@ static struct pipe_ctx *dcn32_acquire_idle_pipe_for_head_pipe_in_layer( struct resource_context *old_ctx = &stream->ctx->dc->current_state->res_ctx; int head_index; - if (!head_pipe) + if (!head_pipe) { ASSERT(0); + return NULL; + } /* * Modified from dcn20_acquire_idle_pipe_for_layer -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/1] fix CVE-2024-49924
by Lin Yujun 26 Oct '24

26 Oct '24

Kaixin Wang (1): fbdev: pxafb: Fix possible use after free in pxafb_task() drivers/video/fbdev/pxafb.c | 1 + 1 file changed, 1 insertion(+) -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS-SP1 0/1] fix CVE-2024-49924
by Lin Yujun 26 Oct '24

26 Oct '24

Kaixin Wang (1): fbdev: pxafb: Fix possible use after free in pxafb_task() drivers/video/fbdev/pxafb.c | 1 + 1 file changed, 1 insertion(+) -- 2.34.1

2 2

[PATCH OLK-5.10 0/1] fix CVE-2024-49924
by Lin Yujun 26 Oct '24

26 Oct '24

Kaixin Wang (1): fbdev: pxafb: Fix possible use after free in pxafb_task() drivers/video/fbdev/pxafb.c | 1 + 1 file changed, 1 insertion(+) -- 2.34.1

2 4

[PATCH OLK-6.6 0/1] fix CVE-2024-49924
by Lin Yujun 26 Oct '24

26 Oct '24

Kaixin Wang (1): fbdev: pxafb: Fix possible use after free in pxafb_task() drivers/video/fbdev/pxafb.c | 1 + 1 file changed, 1 insertion(+) -- 2.34.1

2 2

[PATCH OLK-6.6 0/1] fix CVE-2024-49924
by Lin Yujun 26 Oct '24

26 Oct '24

Kaixin Wang (1): fbdev: pxafb: Fix possible use after free in pxafb_task() drivers/video/fbdev/pxafb.c | 1 + 1 file changed, 1 insertion(+) -- 2.34.1

2 4

[PATCH OLK-5.10 0/2] Randomized Kmalloc 5.10 Backport
by GONG Ruiqi 26 Oct '24

26 Oct '24

GONG Ruiqi (1): Randomized slab caches for kmalloc() Jesper Dangaard Brouer (1): mm/slab: introduce kmem_cache flag SLAB_NO_MERGE include/linux/percpu.h | 12 ++++++-- include/linux/slab.h | 49 +++++++++++++++++++++++++++++--- init/Kconfig | 19 ++++++++++++- mm/kfence/kfence_test.c | 14 +++++---- mm/slab.c | 8 +++--- mm/slab.h | 7 +++-- mm/slab_common.c | 63 +++++++++++++++++++++++++++++++++-------- mm/slub.c | 8 +++--- 8 files changed, 143 insertions(+), 37 deletions(-) -- 2.25.1

2 3