May 2024 - Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 v4 0/2] block: dicard bugfix
by Li Nan 09 May '24

09 May '24

Improve patch 2. Li Nan (2): block: fix overflow in blk_ioctl_discard() block: check io size before submit discard block/blk-lib.c | 13 ++++++++++++- block/ioctl.c | 5 +++-- 2 files changed, 15 insertions(+), 3 deletions(-) -- 2.39.2

2 4

[PATCH OLK-5.10] drm: nv04: Fix out of bounds access
by Zhang Changzhong 09 May '24

09 May '24

From: Mikhail Kobuk <m.kobuk(a)ispras.ru> stable inclusion from stable-v5.10.216 commit 097c7918fcfa1dee233acfd1f3029f00c3bc8062 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5JU CVE: CVE-2024-27008 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit cf92bb778eda7830e79452c6917efa8474a30c1e ] When Output Resource (dcb->or) value is assigned in fabricate_dcb_output(), there may be out of bounds access to dac_users array in case dcb->or is zero because ffs(dcb->or) is used as index there. The 'or' argument of fabricate_dcb_output() must be interpreted as a number of bit to set, not value. Utilize macros from 'enum nouveau_or' in calls instead of hardcoding. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 2e5702aff395 ("drm/nouveau: fabricate DCB encoder table for iMac G4") Fixes: 670820c0e6a9 ("drm/nouveau: Workaround incorrect DCB entry on a GeForce3 Ti 200.") Signed-off-by: Mikhail Kobuk <m.kobuk(a)ispras.ru> Signed-off-by: Danilo Krummrich <dakr(a)redhat.com> Link: https://patchwork.freedesktop.org/patch/msgid/20240411110854.16701-1-m.kobu… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/gpu/drm/nouveau/nouveau_bios.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/drivers/gpu/drm/nouveau/nouveau_bios.c b/drivers/gpu/drm/nouveau/nouveau_bios.c index d204ea8..5cdf0d8 100644 --- a/drivers/gpu/drm/nouveau/nouveau_bios.c +++ b/drivers/gpu/drm/nouveau/nouveau_bios.c @@ -23,6 +23,7 @@ */ #include "nouveau_drv.h" +#include "nouveau_bios.h" #include "nouveau_reg.h" #include "dispnv04/hw.h" #include "nouveau_encoder.h" @@ -1672,7 +1673,7 @@ apply_dcb_encoder_quirks(struct drm_device *dev, int idx, u32 *conn, u32 *conf) */ if (nv_match_device(dev, 0x0201, 0x1462, 0x8851)) { if (*conn == 0xf2005014 && *conf == 0xffffffff) { - fabricate_dcb_output(dcb, DCB_OUTPUT_TMDS, 1, 1, 1); + fabricate_dcb_output(dcb, DCB_OUTPUT_TMDS, 1, 1, DCB_OUTPUT_B); return false; } } @@ -1758,26 +1759,26 @@ fabricate_dcb_encoder_table(struct drm_device *dev, struct nvbios *bios) #ifdef __powerpc__ /* Apple iMac G4 NV17 */ if (of_machine_is_compatible("PowerMac4,5")) { - fabricate_dcb_output(dcb, DCB_OUTPUT_TMDS, 0, all_heads, 1); - fabricate_dcb_output(dcb, DCB_OUTPUT_ANALOG, 1, all_heads, 2); + fabricate_dcb_output(dcb, DCB_OUTPUT_TMDS, 0, all_heads, DCB_OUTPUT_B); + fabricate_dcb_output(dcb, DCB_OUTPUT_ANALOG, 1, all_heads, DCB_OUTPUT_C); return; } #endif /* Make up some sane defaults */ fabricate_dcb_output(dcb, DCB_OUTPUT_ANALOG, - bios->legacy.i2c_indices.crt, 1, 1); + bios->legacy.i2c_indices.crt, 1, DCB_OUTPUT_B); if (nv04_tv_identify(dev, bios->legacy.i2c_indices.tv) >= 0) fabricate_dcb_output(dcb, DCB_OUTPUT_TV, bios->legacy.i2c_indices.tv, - all_heads, 0); + all_heads, DCB_OUTPUT_A); else if (bios->tmds.output0_script_ptr || bios->tmds.output1_script_ptr) fabricate_dcb_output(dcb, DCB_OUTPUT_TMDS, bios->legacy.i2c_indices.panel, - all_heads, 1); + all_heads, DCB_OUTPUT_B); } static int -- 2.9.5

2 1

[PATCH openEuler-1.0-LTS] nvmet: fix a use-after-free
by Xiang Yang 09 May '24

09 May '24

From: Bart Van Assche <bvanassche(a)acm.org> stable inclusion from stable-v4.19.260 commit 17f121ca3ec6be0fb32d77c7f65362934a38cc8e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9LKE0 CVE: CVE-2022-48697 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 6a02a61e81c231cc5c680c5dbf8665275147ac52 ] Fix the following use-after-free complaint triggered by blktests nvme/004: BUG: KASAN: user-memory-access in blk_mq_complete_request_remote+0xac/0x350 Read of size 4 at addr 0000607bd1835943 by task kworker/13:1/460 Workqueue: nvmet-wq nvme_loop_execute_work [nvme_loop] Call Trace: show_stack+0x52/0x58 dump_stack_lvl+0x49/0x5e print_report.cold+0x36/0x1e2 kasan_report+0xb9/0xf0 __asan_load4+0x6b/0x80 blk_mq_complete_request_remote+0xac/0x350 nvme_loop_queue_response+0x1df/0x275 [nvme_loop] __nvmet_req_complete+0x132/0x4f0 [nvmet] nvmet_req_complete+0x15/0x40 [nvmet] nvmet_execute_io_connect+0x18a/0x1f0 [nvmet] nvme_loop_execute_work+0x20/0x30 [nvme_loop] process_one_work+0x56e/0xa70 worker_thread+0x2d1/0x640 kthread+0x183/0x1c0 ret_from_fork+0x1f/0x30 Cc: stable(a)vger.kernel.org Fixes: a07b4970f464 ("nvmet: add a generic NVMe target") Signed-off-by: Bart Van Assche <bvanassche(a)acm.org> Signed-off-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Xiang Yang <xiangyang3(a)huawei.com> --- drivers/nvme/target/core.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c index 776b7e9e23b9..4a2ab093811e 100644 --- a/drivers/nvme/target/core.c +++ b/drivers/nvme/target/core.c @@ -498,6 +498,7 @@ static void __nvmet_req_complete(struct nvmet_req *req, u16 status) { u32 old_sqhd, new_sqhd; u16 sqhd; + struct nvmet_ns *ns = req->ns; if (status) nvmet_set_status(req, status); @@ -514,9 +515,9 @@ static void __nvmet_req_complete(struct nvmet_req *req, u16 status) req->rsp->sq_id = cpu_to_le16(req->sq->qid); req->rsp->command_id = req->cmd->common.command_id; - if (req->ns) - nvmet_put_namespace(req->ns); req->ops->queue_response(req); + if (ns) + nvmet_put_namespace(ns); } void nvmet_req_complete(struct nvmet_req *req, u16 status) -- 2.34.1

2 1

[PATCH OLK-6.6 v2 0/4] Backport four conflict stable patch
by Liu Shixin 09 May '24

09 May '24

Backport four stable patch which have conflicts need to fix. Kirill A. Shutemov (1): mm, treewide: introduce NR_PAGE_ORDERS Matthew Wilcox (Oracle) (1): mm: turn folio_test_hugetlb into a PageType Miaohe Lin (1): fork: defer linking file vma until vma is fully initialized Peter Xu (1): mm/hugetlb: fix missing hugetlb_lock for resv uncharge .../admin-guide/kdump/vmcoreinfo.rst | 6 +- arch/arm64/kvm/hyp/include/nvhe/gfp.h | 2 +- arch/sparc/kernel/traps_64.c | 2 +- drivers/gpu/drm/ttm/tests/ttm_device_test.c | 2 +- drivers/gpu/drm/ttm/ttm_pool.c | 20 +++--- include/drm/ttm/ttm_pool.h | 2 +- include/linux/mmzone.h | 6 +- include/linux/page-flags.h | 72 +++++++++---------- include/trace/events/mmflags.h | 1 + kernel/crash_core.c | 7 +- kernel/fork.c | 33 ++++----- lib/test_meminit.c | 2 +- mm/hugetlb.c | 27 ++----- mm/internal.h | 1 - mm/kmsan/init.c | 2 +- mm/page_alloc.c | 13 ++-- mm/page_reporting.c | 2 +- mm/show_mem.c | 8 +-- mm/vmstat.c | 12 ++-- 19 files changed, 102 insertions(+), 118 deletions(-) -- 2.25.1

2 5

[PATCH OLK-6.6 v4 0/2] block: dicard bugfix
by Li Nan 09 May '24

09 May '24

Improve patch 2. Li Nan (2): block: fix overflow in blk_ioctl_discard() block: check io size before submit discard block/blk-lib.c | 13 ++++++++++++- block/ioctl.c | 5 +++-- 2 files changed, 15 insertions(+), 3 deletions(-) -- 2.39.2

2 3

[PATCH openEuler-1.0-LTS 0/3] i40e: fix CVE-2024-26830
by Dong Chenchen 09 May '24

09 May '24

fix CVE-2024-26830. Aleksandr Loktionov (1): i40e: Refactoring VF MAC filters counting to make more reliable Ivan Vecera (1): i40e: Do not allow untrusted VF to remove administratively set MAC Slawomir Laba (1): i40e: Fix MAC address setting for a VF via Host/VM drivers/net/ethernet/intel/i40e/i40e.h | 1 + drivers/net/ethernet/intel/i40e/i40e_main.c | 19 ++++ .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 105 ++++++++++++------ .../ethernet/intel/i40e/i40e_virtchnl_pf.h | 1 - 4 files changed, 94 insertions(+), 32 deletions(-) -- 2.25.1

2 4

[PATCH openEuler-1.0-LTS 0/2] fix CVE-2024-26865
by Zhengchao Shao 09 May '24

09 May '24

Fix CVE-2024-26865. Eric Dumazet (1): tcp: Fix NEW_SYN_RECV handling in inet_twsk_purge() Kuniyuki Iwashima (1): tcp: Clean up kernel listener's reqsk in inet_twsk_purge() net/ipv4/inet_timewait_sock.c | 32 +++++++++++++++++++++----------- 1 file changed, 21 insertions(+), 11 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/4] Backport four conflict stable patch
by Liu Shixin 09 May '24

09 May '24

Backport four stable patch which have conflicts need to fix. Kirill A. Shutemov (1): mm, treewide: introduce NR_PAGE_ORDERS Matthew Wilcox (Oracle) (1): mm: turn folio_test_hugetlb into a PageType Miaohe Lin (1): fork: defer linking file vma until vma is fully initialized Peter Xu (1): mm/hugetlb: fix missing hugetlb_lock for resv uncharge .../admin-guide/kdump/vmcoreinfo.rst | 6 +- arch/arm64/kvm/hyp/include/nvhe/gfp.h | 2 +- arch/sparc/kernel/traps_64.c | 2 +- drivers/gpu/drm/ttm/tests/ttm_device_test.c | 2 +- drivers/gpu/drm/ttm/ttm_pool.c | 20 +++--- include/drm/ttm/ttm_pool.h | 2 +- include/linux/mmzone.h | 6 +- include/linux/page-flags.h | 72 +++++++++---------- include/trace/events/mmflags.h | 1 + kernel/crash_core.c | 7 +- kernel/fork.c | 33 ++++----- lib/test_meminit.c | 2 +- mm/hugetlb.c | 27 ++----- mm/kmsan/init.c | 2 +- mm/page_alloc.c | 13 ++-- mm/page_reporting.c | 2 +- mm/show_mem.c | 8 +-- mm/vmstat.c | 12 ++-- 18 files changed, 102 insertions(+), 117 deletions(-) -- 2.25.1

3 6

[PATCH OLK-5.10 v2 0/2] block: dicard bugfix
by Li Nan 09 May '24

09 May '24

Improve patch 2. Li Nan (2): block: fix overflow in blk_ioctl_discard() block: check io size before submit discard block/blk-lib.c | 13 ++++++++++++- block/ioctl.c | 5 +++-- 2 files changed, 15 insertions(+), 3 deletions(-) -- 2.39.2

2 3

[PATCH OLK-6.6 v2 0/2] block: dicard bugfix
by Li Nan 09 May '24

09 May '24

Improve patch 2. Li Nan (2): block: fix overflow in blk_ioctl_discard() block: check io size before submit discard block/blk-lib.c | 13 ++++++++++++- block/ioctl.c | 5 +++-- 2 files changed, 15 insertions(+), 3 deletions(-) -- 2.39.2

1 0