June 2024 - Kernel - mailweb.openeuler.org

[PATCH OLK-5.10 0/2] CVE-2024-37356
by Liu Jian 28 Jun '24

28 Jun '24

CVE-2024-37356 Kuniyuki Iwashima (1): tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). Sagi Grimberg (1): params: lift param_set_uint_minmax to common code include/linux/moduleparam.h | 2 ++ kernel/params.c | 18 ++++++++++++++++++ net/ipv4/tcp_dctcp.c | 13 ++++++++++++- net/sunrpc/xprtsock.c | 18 ------------------ 4 files changed, 32 insertions(+), 19 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-22.03-LTS-SP1 0/2] CVE-2024-37356
by Liu Jian 28 Jun '24

28 Jun '24

CVE-2024-37356 Kuniyuki Iwashima (1): tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). Sagi Grimberg (1): params: lift param_set_uint_minmax to common code include/linux/moduleparam.h | 2 ++ kernel/params.c | 18 ++++++++++++++++++ net/ipv4/tcp_dctcp.c | 13 ++++++++++++- net/sunrpc/xprtsock.c | 18 ------------------ 4 files changed, 32 insertions(+), 19 deletions(-) -- 2.34.1

2 3

[PATCH V2 openEuler-1.0-LTS 0/2] Backport LTS patches
by Zhang Zekun 28 Jun '24

28 Jun '24

Backport LTS patches for openEuler-1.0-LTS. v2: - fix error in commit message. Zeng Heng (2): pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map() drivers/pinctrl/devicetree.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) -- 2.17.1

2 3

[PATCH openEuler-22.03-LTS-SP1] media: lgdt3306a: Add a check against null-pointer-def
by Tengda Wu 28 Jun '24

28 Jun '24

From: Zheyu Ma <zheyuma97(a)gmail.com> mainline inclusion from mainline-v6.10-rc1 commit c1115ddbda9c930fba0fdd062e7a8873ebaf898d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA8AEA CVE: CVE-2022-48772 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The driver should check whether the client provides the platform_data. The following log reveals it: [ 29.610324] BUG: KASAN: null-ptr-deref in kmemdup+0x30/0x40 [ 29.610730] Read of size 40 at addr 0000000000000000 by task bash/414 [ 29.612820] Call Trace: [ 29.613030] <TASK> [ 29.613201] dump_stack_lvl+0x56/0x6f [ 29.613496] ? kmemdup+0x30/0x40 [ 29.613754] print_report.cold+0x494/0x6b7 [ 29.614082] ? kmemdup+0x30/0x40 [ 29.614340] kasan_report+0x8a/0x190 [ 29.614628] ? kmemdup+0x30/0x40 [ 29.614888] kasan_check_range+0x14d/0x1d0 [ 29.615213] memcpy+0x20/0x60 [ 29.615454] kmemdup+0x30/0x40 [ 29.615700] lgdt3306a_probe+0x52/0x310 [ 29.616339] i2c_device_probe+0x951/0xa90 Link: https://lore.kernel.org/linux-media/20220405095018.3993578-1-zheyuma97@gmai… Signed-off-by: Zheyu Ma <zheyuma97(a)gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab(a)kernel.org> Fixes: 4f75189024f4 ("[media] lgdt3306a: support i2c mux for use by em28xx") Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- drivers/media/dvb-frontends/lgdt3306a.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/media/dvb-frontends/lgdt3306a.c b/drivers/media/dvb-frontends/lgdt3306a.c index 722576f1732a..9b3f74f3f7b2 100644 --- a/drivers/media/dvb-frontends/lgdt3306a.c +++ b/drivers/media/dvb-frontends/lgdt3306a.c @@ -2213,6 +2213,11 @@ static int lgdt3306a_probe(struct i2c_client *client, struct dvb_frontend *fe; int ret; + if (!client->dev.platform_data) { + dev_err(&client->dev, "platform data is mandatory\n"); + return -EINVAL; + } + config = kmemdup(client->dev.platform_data, sizeof(struct lgdt3306a_config), GFP_KERNEL); if (config == NULL) { -- 2.34.1

2 1

[PATCH OLK-6.6] media: lgdt3306a: Add a check against null-pointer-def
by Tengda Wu 28 Jun '24

28 Jun '24

From: Zheyu Ma <zheyuma97(a)gmail.com> mainline inclusion from mainline-v6.10-rc1 commit c1115ddbda9c930fba0fdd062e7a8873ebaf898d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA8AEA CVE: CVE-2022-48772 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The driver should check whether the client provides the platform_data. The following log reveals it: [ 29.610324] BUG: KASAN: null-ptr-deref in kmemdup+0x30/0x40 [ 29.610730] Read of size 40 at addr 0000000000000000 by task bash/414 [ 29.612820] Call Trace: [ 29.613030] <TASK> [ 29.613201] dump_stack_lvl+0x56/0x6f [ 29.613496] ? kmemdup+0x30/0x40 [ 29.613754] print_report.cold+0x494/0x6b7 [ 29.614082] ? kmemdup+0x30/0x40 [ 29.614340] kasan_report+0x8a/0x190 [ 29.614628] ? kmemdup+0x30/0x40 [ 29.614888] kasan_check_range+0x14d/0x1d0 [ 29.615213] memcpy+0x20/0x60 [ 29.615454] kmemdup+0x30/0x40 [ 29.615700] lgdt3306a_probe+0x52/0x310 [ 29.616339] i2c_device_probe+0x951/0xa90 Link: https://lore.kernel.org/linux-media/20220405095018.3993578-1-zheyuma97@gmai… Signed-off-by: Zheyu Ma <zheyuma97(a)gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab(a)kernel.org> Fixes: 4f75189024f4 ("[media] lgdt3306a: support i2c mux for use by em28xx") Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- drivers/media/dvb-frontends/lgdt3306a.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/media/dvb-frontends/lgdt3306a.c b/drivers/media/dvb-frontends/lgdt3306a.c index 263887592415..231b45632ad5 100644 --- a/drivers/media/dvb-frontends/lgdt3306a.c +++ b/drivers/media/dvb-frontends/lgdt3306a.c @@ -2176,6 +2176,11 @@ static int lgdt3306a_probe(struct i2c_client *client) struct dvb_frontend *fe; int ret; + if (!client->dev.platform_data) { + dev_err(&client->dev, "platform data is mandatory\n"); + return -EINVAL; + } + config = kmemdup(client->dev.platform_data, sizeof(struct lgdt3306a_config), GFP_KERNEL); if (config == NULL) { -- 2.34.1

2 1

[PATCH OLK-5.10] media: lgdt3306a: Add a check against null-pointer-def
by Tengda Wu 28 Jun '24

28 Jun '24

From: Zheyu Ma <zheyuma97(a)gmail.com> mainline inclusion from mainline-v6.10-rc1 commit c1115ddbda9c930fba0fdd062e7a8873ebaf898d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA8AEA CVE: CVE-2022-48772 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The driver should check whether the client provides the platform_data. The following log reveals it: [ 29.610324] BUG: KASAN: null-ptr-deref in kmemdup+0x30/0x40 [ 29.610730] Read of size 40 at addr 0000000000000000 by task bash/414 [ 29.612820] Call Trace: [ 29.613030] <TASK> [ 29.613201] dump_stack_lvl+0x56/0x6f [ 29.613496] ? kmemdup+0x30/0x40 [ 29.613754] print_report.cold+0x494/0x6b7 [ 29.614082] ? kmemdup+0x30/0x40 [ 29.614340] kasan_report+0x8a/0x190 [ 29.614628] ? kmemdup+0x30/0x40 [ 29.614888] kasan_check_range+0x14d/0x1d0 [ 29.615213] memcpy+0x20/0x60 [ 29.615454] kmemdup+0x30/0x40 [ 29.615700] lgdt3306a_probe+0x52/0x310 [ 29.616339] i2c_device_probe+0x951/0xa90 Link: https://lore.kernel.org/linux-media/20220405095018.3993578-1-zheyuma97@gmai… Signed-off-by: Zheyu Ma <zheyuma97(a)gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab(a)kernel.org> Fixes: 4f75189024f4 ("[media] lgdt3306a: support i2c mux for use by em28xx") Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- drivers/media/dvb-frontends/lgdt3306a.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/media/dvb-frontends/lgdt3306a.c b/drivers/media/dvb-frontends/lgdt3306a.c index 722576f1732a..9b3f74f3f7b2 100644 --- a/drivers/media/dvb-frontends/lgdt3306a.c +++ b/drivers/media/dvb-frontends/lgdt3306a.c @@ -2213,6 +2213,11 @@ static int lgdt3306a_probe(struct i2c_client *client, struct dvb_frontend *fe; int ret; + if (!client->dev.platform_data) { + dev_err(&client->dev, "platform data is mandatory\n"); + return -EINVAL; + } + config = kmemdup(client->dev.platform_data, sizeof(struct lgdt3306a_config), GFP_KERNEL); if (config == NULL) { -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] media: lgdt3306a: Add a check against null-pointer-def
by Tengda Wu 28 Jun '24

28 Jun '24

From: Zheyu Ma <zheyuma97(a)gmail.com> mainline inclusion from mainline-v6.10-rc1 commit c1115ddbda9c930fba0fdd062e7a8873ebaf898d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA8AEA CVE: CVE-2022-48772 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The driver should check whether the client provides the platform_data. The following log reveals it: [ 29.610324] BUG: KASAN: null-ptr-deref in kmemdup+0x30/0x40 [ 29.610730] Read of size 40 at addr 0000000000000000 by task bash/414 [ 29.612820] Call Trace: [ 29.613030] <TASK> [ 29.613201] dump_stack_lvl+0x56/0x6f [ 29.613496] ? kmemdup+0x30/0x40 [ 29.613754] print_report.cold+0x494/0x6b7 [ 29.614082] ? kmemdup+0x30/0x40 [ 29.614340] kasan_report+0x8a/0x190 [ 29.614628] ? kmemdup+0x30/0x40 [ 29.614888] kasan_check_range+0x14d/0x1d0 [ 29.615213] memcpy+0x20/0x60 [ 29.615454] kmemdup+0x30/0x40 [ 29.615700] lgdt3306a_probe+0x52/0x310 [ 29.616339] i2c_device_probe+0x951/0xa90 Link: https://lore.kernel.org/linux-media/20220405095018.3993578-1-zheyuma97@gmai… Signed-off-by: Zheyu Ma <zheyuma97(a)gmail.com> Signed-off-by: Mauro Carvalho Chehab <mchehab(a)kernel.org> Fixes: 4f75189024f4 ("[media] lgdt3306a: support i2c mux for use by em28xx") Conflicts: drivers/media/dvb-frontends/lgdt3306a.c [This is because we did not backport commit 2c4746cf45b9 ("media: dvb-frontends: Use kmemdup instead of duplicating its function")] Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- drivers/media/dvb-frontends/lgdt3306a.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/media/dvb-frontends/lgdt3306a.c b/drivers/media/dvb-frontends/lgdt3306a.c index 0e1f5daaf20c..4607e255e9f8 100644 --- a/drivers/media/dvb-frontends/lgdt3306a.c +++ b/drivers/media/dvb-frontends/lgdt3306a.c @@ -2205,6 +2205,11 @@ static int lgdt3306a_probe(struct i2c_client *client, struct dvb_frontend *fe; int ret; + if (!client->dev.platform_data) { + dev_err(&client->dev, "platform data is mandatory\n"); + return -EINVAL; + } + config = kzalloc(sizeof(struct lgdt3306a_config), GFP_KERNEL); if (config == NULL) { ret = -ENOMEM; -- 2.34.1

2 1

[PATCH OLK-6.6] eth: sungem: remove .ndo_poll_controller to avoid deadlocks
by Liu Chuang 27 Jun '24

27 Jun '24

From: Jakub Kicinski <kuba(a)kernel.org> stable inclusion from stable-v6.6.33 commit 5de5aeb98f9a000adb0db184e32765e4815d860b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA6S6S CVE: CVE-2024-38597 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- [ Upstream commit ac0a230f719b02432d8c7eba7615ebd691da86f4 ] Erhard reports netpoll warnings from sungem: netpoll_send_skb_on_dev(): eth0 enabled interrupts in poll (gem_start_xmit+0x0/0x398) WARNING: CPU: 1 PID: 1 at net/core/netpoll.c:370 netpoll_send_skb+0x1fc/0x20c gem_poll_controller() disables interrupts, which may sleep. We can't sleep in netpoll, it has interrupts disabled completely. Strangely, gem_poll_controller() doesn't even poll the completions, and instead acts as if an interrupt has fired so it just schedules NAPI and exits. None of this has been necessary for years, since netpoll invokes NAPI directly. Fixes: fe09bb619096 ("sungem: Spring cleaning and GRO support") Reported-and-tested-by: Erhard Furtner <erhard_f(a)mailbox.org> Link: https://lore.kernel.org/all/20240428125306.2c3080ef@legion Reviewed-by: Eric Dumazet <edumazet(a)google.com> Link: https://lore.kernel.org/r/20240508134504.3560956-1-kuba@kernel.org Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- drivers/net/ethernet/sun/sungem.c | 14 -------------- 1 file changed, 14 deletions(-) diff --git a/drivers/net/ethernet/sun/sungem.c b/drivers/net/ethernet/sun/sungem.c index 9bd1df8308d2..d3a2fbb14140 100644 --- a/drivers/net/ethernet/sun/sungem.c +++ b/drivers/net/ethernet/sun/sungem.c @@ -949,17 +949,6 @@ static irqreturn_t gem_interrupt(int irq, void *dev_id) return IRQ_HANDLED; } -#ifdef CONFIG_NET_POLL_CONTROLLER -static void gem_poll_controller(struct net_device *dev) -{ - struct gem *gp = netdev_priv(dev); - - disable_irq(gp->pdev->irq); - gem_interrupt(gp->pdev->irq, dev); - enable_irq(gp->pdev->irq); -} -#endif - static void gem_tx_timeout(struct net_device *dev, unsigned int txqueue) { struct gem *gp = netdev_priv(dev); @@ -2839,9 +2828,6 @@ static const struct net_device_ops gem_netdev_ops = { .ndo_change_mtu = gem_change_mtu, .ndo_validate_addr = eth_validate_addr, .ndo_set_mac_address = gem_set_mac_address, -#ifdef CONFIG_NET_POLL_CONTROLLER - .ndo_poll_controller = gem_poll_controller, -#endif }; static int gem_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/2] Backport LTS patches
by Zhang Zekun 27 Jun '24

27 Jun '24

Backport LTS patches for openEuler-1.0-LTS. Zeng Heng (2): pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map() drivers/pinctrl/devicetree.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) -- 2.17.1

2 3

[PATCH OLK-6.6] bonding: fix oops during rmmod
by Zhengchao Shao 27 Jun '24

27 Jun '24

From: Tony Battersby <tonyb(a)cybernetics.com> stable inclusion from stable-v6.6.34 commit f07224c16678a8af54ddc059b3d2d51885d7f35e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA8ADY CVE: CVE-2024-39296 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- commit a45835a0bb6ef7d5ddbc0714dd760de979cb6ece upstream. "rmmod bonding" causes an oops ever since commit cc317ea3d927 ("bonding: remove redundant NULL check in debugfs function"). Here are the relevant functions being called: bonding_exit() bond_destroy_debugfs() debugfs_remove_recursive(bonding_debug_root); bonding_debug_root = NULL; <--------- SET TO NULL HERE bond_netlink_fini() rtnl_link_unregister() __rtnl_link_unregister() unregister_netdevice_many_notify() bond_uninit() bond_debug_unregister() (commit removed check for bonding_debug_root == NULL) debugfs_remove() simple_recursive_removal() down_write() -> OOPS However, reverting the bad commit does not solve the problem completely because the original code contains a race that could cause the same oops, although it was much less likely to be triggered unintentionally: CPU1 rmmod bonding bonding_exit() bond_destroy_debugfs() debugfs_remove_recursive(bonding_debug_root); CPU2 echo -bond0 > /sys/class/net/bonding_masters bond_uninit() bond_debug_unregister() if (!bonding_debug_root) CPU1 bonding_debug_root = NULL; So do NOT revert the bad commit (since the removed checks were racy anyway), and instead change the order of actions taken during module removal. The same oops can also happen if there is an error during module init, so apply the same fix there. Fixes: cc317ea3d927 ("bonding: remove redundant NULL check in debugfs function") Cc: stable(a)vger.kernel.org Signed-off-by: Tony Battersby <tonyb(a)cybernetics.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Acked-by: Jay Vosburgh <jay.vosburgh(a)canonical.com> Link: https://lore.kernel.org/r/641f914f-3216-4eeb-87dd-91b78aa97773@cybernetics.… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/net/bonding/bond_main.c [The conflict occurs because the commit 6263012c995d("anolis: bond: broadcast ARP or ND messages to all slaves") is not merged into mainline] Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- drivers/net/bonding/bond_main.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c index df1bc2fa6979..7da60b741c3e 100644 --- a/drivers/net/bonding/bond_main.c +++ b/drivers/net/bonding/bond_main.c @@ -6526,15 +6526,16 @@ static int __init bonding_init(void) if (res) goto out; + bond_create_debugfs(); + res = register_pernet_subsys(&bond_net_ops); if (res) - goto out; + goto err_net_ops; res = bond_netlink_init(); if (res) goto err_link; - bond_create_debugfs(); bond_create_sysctl(); for (i = 0; i < max_bonds; i++) { @@ -6551,11 +6552,12 @@ static int __init bonding_init(void) out: return res; err: - bond_destroy_debugfs(); bond_destroy_sysctl(); bond_netlink_fini(); err_link: unregister_pernet_subsys(&bond_net_ops); +err_net_ops: + bond_destroy_debugfs(); goto out; } @@ -6564,12 +6566,13 @@ static void __exit bonding_exit(void) { unregister_netdevice_notifier(&bond_netdev_notifier); - bond_destroy_debugfs(); bond_destroy_sysctl(); bond_netlink_fini(); unregister_pernet_subsys(&bond_net_ops); + bond_destroy_debugfs(); + #ifdef CONFIG_NET_POLL_CONTROLLER /* Make sure we don't have an imbalance on our netpoll blocking */ WARN_ON(atomic_read(&netpoll_block_tx)); -- 2.34.1

2 1