May 2024 - Kernel - mailweb.openeuler.org

[openeuler:openEuler-1.0-LTS 21365/22424] drivers/media/platform/phytium-jpeg/phytium_jpeg_core.c:1301:5-11: inconsistent IS_ERR and PTR_ERR on line 1303.
by kernel test robot 14 May '24

14 May '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 819e21d7b3e4610b4f9d6531b4fcd61ad2e9770a commit: a773f33429ed6187436dd27117f3cc74a65a5344 [21365/22424] jpeg: Add a Phytium JPEG Engine driver config: arm64-randconfig-r051-20240514 (https://download.01.org/0day-ci/archive/20240514/202405140308.WGE9RFya-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405140308.WGE9RFya-lkp@intel.com/ cocci warnings: (new ones prefixed by >>) >> drivers/media/platform/phytium-jpeg/phytium_jpeg_core.c:1301:5-11: inconsistent IS_ERR and PTR_ERR on line 1303. drivers/media/platform/phytium-jpeg/phytium_jpeg_core.c:1308:5-11: inconsistent IS_ERR and PTR_ERR on line 1310. vim +1301 drivers/media/platform/phytium-jpeg/phytium_jpeg_core.c 1279 1280 static int phytium_jpeg_probe(struct platform_device *pdev) 1281 { 1282 struct phytium_jpeg_dev *jpeg_dev; 1283 const struct of_device_id *match; 1284 const struct phytium_jpeg_config *config; 1285 struct resource *res; 1286 int ret; 1287 1288 jpeg_dev = devm_kzalloc(&pdev->dev, sizeof(*jpeg_dev), GFP_KERNEL); 1289 if (jpeg_dev == NULL) 1290 return -ENOMEM; 1291 1292 res = platform_get_resource(pdev, IORESOURCE_MEM, 0); 1293 jpeg_dev->base_addr = devm_ioremap_resource(&pdev->dev, res); 1294 if (IS_ERR(jpeg_dev->base_addr)) { 1295 dev_err(jpeg_dev->dev, "Failed to ioremap.\n"); 1296 return PTR_ERR(jpeg_dev->base_addr); 1297 } 1298 1299 res = platform_get_resource(pdev, IORESOURCE_MEM, 1); 1300 jpeg_dev->timer30_addr = devm_ioremap_resource(&pdev->dev, res); > 1301 if (IS_ERR(jpeg_dev->base_addr)) { 1302 dev_err(jpeg_dev->dev, "Failed to parse timer30.\n"); > 1303 return PTR_ERR(jpeg_dev->timer30_addr); 1304 } 1305 1306 res = platform_get_resource(pdev, IORESOURCE_MEM, 2); 1307 jpeg_dev->timer31_addr = devm_ioremap_resource(&pdev->dev, res); 1308 if (IS_ERR(jpeg_dev->base_addr)) { 1309 dev_err(jpeg_dev->dev, "Failed to parse timer30.\n"); 1310 return PTR_ERR(jpeg_dev->timer31_addr); 1311 } 1312 match = of_match_node(phytium_jpeg_match, pdev->dev.of_node); 1313 if (match == NULL) { 1314 dev_err(jpeg_dev->dev, "Failed to match.\n"); 1315 return -EINVAL; 1316 } 1317 1318 config = match->data; 1319 jpeg_dev->comp_size_read = config->comp_size_read; 1320 1321 jpeg_dev->frame_rate = 30; 1322 jpeg_dev->dev = &pdev->dev; 1323 spin_lock_init(&jpeg_dev->hw_lock); 1324 mutex_init(&jpeg_dev->video_lock); 1325 init_waitqueue_head(&jpeg_dev->wait); 1326 INIT_DELAYED_WORK(&jpeg_dev->res_work, phytium_jpeg_resolution_work); 1327 INIT_LIST_HEAD(&jpeg_dev->buffers); 1328 1329 ret = phytium_jpeg_init(jpeg_dev); 1330 if (ret != 0) { 1331 dev_err(jpeg_dev->dev, "Failed to initialize the JPEG engine.\n"); 1332 return ret; 1333 } 1334 1335 ret = phytium_jpeg_setup_video(jpeg_dev); 1336 1337 return ret; 1338 } 1339 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 0/3] major bugfix before 2023
by Liao Chen 13 May '24

13 May '24

major bugfix before 2023 Li Huafei (1): [Backport] powerpc/kprobes: Fix null pointer reference in arch_prepare_kprobe() Mark Rutland (1): [Backport] irqchip/gic-v3: Ensure pseudo-NMIs have an ISB between ack and handling Sergey Shtylyov (1): [Backport] genirq/ipi: Fix NULL pointer deref in irq_data_get_affinity_mask() arch/powerpc/kernel/kprobes.c | 7 ++++++- drivers/irqchip/irq-gic-v3.c | 3 +++ kernel/irq/ipi.c | 8 ++++++-- 3 files changed, 15 insertions(+), 3 deletions(-) -- 2.34.1

2 4

[PATCH OLK-5.10 0/3] CVE-2024-26807
by Guo Mengqi 13 May '24

13 May '24

CVE-2024-26807 Théo Lebrun (1): spi: cadence-qspi: fix pointer reference in runtime PM hooks Vaishnav Achath (2): spi: cadence-quadspi: Handle spi_unregister_master() in remove() spi: cadence-quadspi: Remove spi_master_put() in probe failure path drivers/spi/spi-cadence-quadspi.c | 35 +++++++++++++------------------ 1 file changed, 14 insertions(+), 21 deletions(-) -- 2.17.1

2 4

[PATCH openEuler-22.03-LTS-SP2 0/3] CVE-2024-26807
by Guo Mengqi 13 May '24

13 May '24

CVE-2024-26807 Théo Lebrun (1): spi: cadence-qspi: fix pointer reference in runtime PM hooks Vaishnav Achath (2): spi: cadence-quadspi: Handle spi_unregister_master() in remove() spi: cadence-quadspi: Remove spi_master_put() in probe failure path drivers/spi/spi-cadence-quadspi.c | 35 +++++++++++++------------------ 1 file changed, 14 insertions(+), 21 deletions(-) -- 2.17.1

2 4

[PATCH openEuler-1.0-LTS 0/2] major bugfix before 2023
by Liao Chen 13 May '24

13 May '24

irqchip/gic-v3: Ensure pseudo-NMIs have an ISB between ack and handling genirq/ipi: Fix NULL pointer deref in irq_data_get_affinity_mask() Mark Rutland (1): irqchip/gic-v3: Ensure pseudo-NMIs have an ISB between ack and handling Sergey Shtylyov (1): genirq/ipi: Fix NULL pointer deref in irq_data_get_affinity_mask() drivers/irqchip/irq-gic-v3.c | 3 +++ kernel/irq/ipi.c | 8 ++++++-- 2 files changed, 9 insertions(+), 2 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10 0/2] CVE-2024-27017
by Wang Hai 13 May '24

13 May '24

CVE-2024-27017 Pablo Neira Ayuso (2): netfilter: nft_set_pipapo: walk over current view on netlink dump netfilter: nf_tables: missing iterator type in lookup walk include/net/netfilter/nf_tables.h | 13 +++++++++++++ net/netfilter/nf_tables_api.c | 6 ++++++ net/netfilter/nft_lookup.c | 1 + net/netfilter/nft_set_pipapo.c | 6 ++++-- 4 files changed, 24 insertions(+), 2 deletions(-) -- 2.17.1

2 3

[PATCH OLK-5.10 0/3] CVE-2024-26807
by g30012805 13 May '24

13 May '24

CVE-2024-26807 Théo Lebrun (1): spi: cadence-qspi: fix pointer reference in runtime PM hooks Vaishnav Achath (2): spi: cadence-quadspi: Handle spi_unregister_master() in remove() spi: cadence-quadspi: Remove spi_master_put() in probe failure path drivers/spi/spi-cadence-quadspi.c | 35 +++++++++++++------------------ 1 file changed, 14 insertions(+), 21 deletions(-) -- 2.17.1

2 4

[PATCH openEuler-22.03-LTS-SP2 0/3] CVE-2024-26807
by Guo Mengqi 13 May '24

13 May '24

CVE-2024-26807 Théo Lebrun (1): spi: cadence-qspi: fix pointer reference in runtime PM hooks Vaishnav Achath (2): spi: cadence-quadspi: Handle spi_unregister_master() in remove() spi: cadence-quadspi: Remove spi_master_put() in probe failure path drivers/spi/spi-cadence-quadspi.c | 35 +++++++++++++------------------ 1 file changed, 14 insertions(+), 21 deletions(-) -- 2.17.1

2 4

[PATCH openEuler-22.03-LTS-SP2] net: ip_tunnel: prevent perpetual headroom growth
by Guo Mengqi 13 May '24

13 May '24

From: Florian Westphal <fw(a)strlen.de> stable inclusion from stable-v5.10.212 commit 2e95350fe9db9d53c701075060ac8ac883b68aee category: bugfix bugzilla: 189268 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5ae1e9922bbdbaeb9cfbe91085ab75927488ac0f ] syzkaller triggered following kasan splat: BUG: KASAN: use-after-free in __skb_flow_dissect+0x19d1/0x7a50 net/core/flow_dissector.c:1170 Read of size 1 at addr ffff88812fb4000e by task syz-executor183/5191 [..] kasan_report+0xda/0x110 mm/kasan/report.c:588 __skb_flow_dissect+0x19d1/0x7a50 net/core/flow_dissector.c:1170 skb_flow_dissect_flow_keys include/linux/skbuff.h:1514 [inline] ___skb_get_hash net/core/flow_dissector.c:1791 [inline] __skb_get_hash+0xc7/0x540 net/core/flow_dissector.c:1856 skb_get_hash include/linux/skbuff.h:1556 [inline] ip_tunnel_xmit+0x1855/0x33c0 net/ipv4/ip_tunnel.c:748 ipip_tunnel_xmit+0x3cc/0x4e0 net/ipv4/ipip.c:308 __netdev_start_xmit include/linux/netdevice.h:4940 [inline] netdev_start_xmit include/linux/netdevice.h:4954 [inline] xmit_one net/core/dev.c:3548 [inline] dev_hard_start_xmit+0x13d/0x6d0 net/core/dev.c:3564 __dev_queue_xmit+0x7c1/0x3d60 net/core/dev.c:4349 dev_queue_xmit include/linux/netdevice.h:3134 [inline] neigh_connected_output+0x42c/0x5d0 net/core/neighbour.c:1592 ... ip_finish_output2+0x833/0x2550 net/ipv4/ip_output.c:235 ip_finish_output+0x31/0x310 net/ipv4/ip_output.c:323 .. iptunnel_xmit+0x5b4/0x9b0 net/ipv4/ip_tunnel_core.c:82 ip_tunnel_xmit+0x1dbc/0x33c0 net/ipv4/ip_tunnel.c:831 ipgre_xmit+0x4a1/0x980 net/ipv4/ip_gre.c:665 __netdev_start_xmit include/linux/netdevice.h:4940 [inline] netdev_start_xmit include/linux/netdevice.h:4954 [inline] xmit_one net/core/dev.c:3548 [inline] dev_hard_start_xmit+0x13d/0x6d0 net/core/dev.c:3564 ... The splat occurs because skb->data points past skb->head allocated area. This is because neigh layer does: __skb_pull(skb, skb_network_offset(skb)); ... but skb_network_offset() returns a negative offset and __skb_pull() arg is unsigned. IOW, we skb->data gets "adjusted" by a huge value. The negative value is returned because skb->head and skb->data distance is more than 64k and skb->network_header (u16) has wrapped around. The bug is in the ip_tunnel infrastructure, which can cause dev->needed_headroom to increment ad infinitum. The syzkaller reproducer consists of packets getting routed via a gre tunnel, and route of gre encapsulated packets pointing at another (ipip) tunnel. The ipip encapsulation finds gre0 as next output device. This results in the following pattern: 1). First packet is to be sent out via gre0. Route lookup found an output device, ipip0. 2). ip_tunnel_xmit for gre0 bumps gre0->needed_headroom based on the future output device, rt.dev->needed_headroom (ipip0). 3). ip output / start_xmit moves skb on to ipip0. which runs the same code path again (xmit recursion). 4). Routing step for the post-gre0-encap packet finds gre0 as output device to use for ipip0 encapsulated packet. tunl0->needed_headroom is then incremented based on the (already bumped) gre0 device headroom. This repeats for every future packet: gre0->needed_headroom gets inflated because previous packets' ipip0 step incremented rt->dev (gre0) headroom, and ipip0 incremented because gre0 needed_headroom was increased. For each subsequent packet, gre/ipip0->needed_headroom grows until post-expand-head reallocations result in a skb->head/data distance of more than 64k. Once that happens, skb->network_header (u16) wraps around when pskb_expand_head tries to make sure that skb_network_offset() is unchanged after the headroom expansion/reallocation. After this skb_network_offset(skb) returns a different (and negative) result post headroom expansion. The next trip to neigh layer (or anything else that would __skb_pull the network header) makes skb->data point to a memory location outside skb->head area. v2: Cap the needed_headroom update to an arbitarily chosen upperlimit to prevent perpetual increase instead of dropping the headroom increment completely. Reported-and-tested-by: syzbot+bfde3bef047a81b8fde6(a)syzkaller.appspotmail.com Closes: https://groups.google.com/g/syzkaller-bugs/c/fL9G6GtWskY/m/VKk_PR5FBAAJ Fixes: 243aad830e8a ("ip_gre: include route header_len in max_headroom calculation") Signed-off-by: Florian Westphal <fw(a)strlen.de> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://lore.kernel.org/r/20240220135606.4939-1-fw@strlen.de Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- net/ipv4/ip_tunnel.c | 28 +++++++++++++++++++++------- 1 file changed, 21 insertions(+), 7 deletions(-) diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c index 99f70b990eb1..50f8231e9dae 100644 --- a/net/ipv4/ip_tunnel.c +++ b/net/ipv4/ip_tunnel.c @@ -540,6 +540,20 @@ static int tnl_update_pmtu(struct net_device *dev, struct sk_buff *skb, return 0; } +static void ip_tunnel_adj_headroom(struct net_device *dev, unsigned int headroom) +{ + /* we must cap headroom to some upperlimit, else pskb_expand_head + * will overflow header offsets in skb_headers_offset_update(). + */ + static const unsigned int max_allowed = 512; + + if (headroom > max_allowed) + headroom = max_allowed; + + if (headroom > READ_ONCE(dev->needed_headroom)) + WRITE_ONCE(dev->needed_headroom, headroom); +} + void ip_md_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, u8 proto, int tunnel_hlen) { @@ -613,13 +627,13 @@ void ip_md_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, } headroom += LL_RESERVED_SPACE(rt->dst.dev) + rt->dst.header_len; - if (headroom > READ_ONCE(dev->needed_headroom)) - WRITE_ONCE(dev->needed_headroom, headroom); - - if (skb_cow_head(skb, READ_ONCE(dev->needed_headroom))) { + if (skb_cow_head(skb, headroom)) { ip_rt_put(rt); goto tx_dropped; } + + ip_tunnel_adj_headroom(dev, headroom); + iptunnel_xmit(NULL, rt, skb, fl4.saddr, fl4.daddr, proto, tos, ttl, df, !net_eq(tunnel->net, dev_net(dev))); return; @@ -797,16 +811,16 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev, max_headroom = LL_RESERVED_SPACE(rt->dst.dev) + sizeof(struct iphdr) + rt->dst.header_len + ip_encap_hlen(&tunnel->encap); - if (max_headroom > READ_ONCE(dev->needed_headroom)) - WRITE_ONCE(dev->needed_headroom, max_headroom); - if (skb_cow_head(skb, READ_ONCE(dev->needed_headroom))) { + if (skb_cow_head(skb, max_headroom)) { ip_rt_put(rt); dev->stats.tx_dropped++; kfree_skb(skb); return; } + ip_tunnel_adj_headroom(dev, max_headroom); + iptunnel_xmit(NULL, rt, skb, fl4.saddr, fl4.daddr, protocol, tos, ttl, df, !net_eq(tunnel->net, dev_net(dev))); return; -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP2 0/3] CVE-2024-26807
by Guo Mengqi 13 May '24

13 May '24

CVE-2024-26807 Cristian Marussi (1): firmware: arm_scmi: Harden accesses to the reset domains Florian Westphal (1): net: ip_tunnel: prevent perpetual headroom growth Théo Lebrun (1): spi: cadence-qspi: fix pointer reference in runtime PM hooks drivers/firmware/arm_scmi/reset.c | 6 +++++- drivers/spi/spi-cadence-quadspi.c | 6 ++---- net/ipv4/ip_tunnel.c | 28 +++++++++++++++++++++------- 3 files changed, 28 insertions(+), 12 deletions(-) -- 2.17.1

2 4