August 2024 - Kernel - mailweb.openeuler.org

[PATCH OLK-5.10 0/2] Fix CVE-2024-36880
by Yi Yang 16 Aug '24

16 Aug '24

Fix CVE-2024-36880 for OLK-5.10 Johan Hovold (2): Bluetooth: qca: add missing firmware sanity checks Bluetooth: qca: fix firmware check error path drivers/bluetooth/btqca.c | 36 ++++++++++++++++++++++++++++++------ 1 file changed, 30 insertions(+), 6 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-22.03-LTS-SP1 0/1] CVE-2023-52868
by Chen Ridong 16 Aug '24

16 Aug '24

*** BLURB HERE *** Dan Carpenter (1): thermal: core: prevent potential string overflow drivers/thermal/thermal_core.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) -- 2.34.1

2 2

[openeuler:openEuler-1.0-LTS 9263/23498] drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dml1_display_rq_dlg_calc.o: warning: objtool: dml1_rq_dlg_get_dlg_params()+0x2f1c: unreachable instruction
by kernel test robot 16 Aug '24

16 Aug '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: c75f813072b1d42cc638d175e1a8e84835f383ee commit: f25433cb156a967d9b426ebaadf197c2369398e7 [9263/23498] drm/amd/display: readd -msse2 to prevent Clang from emitting libcalls to undefined SW FP routines config: x86_64-randconfig-104-20240816 (https://download.01.org/0day-ci/archive/20240816/202408161225.VySIKip3-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240816/202408161225.VySIKip3-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408161225.VySIKip3-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dml1_display_rq_dlg_calc.c:26: In file included from drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dml1_display_rq_dlg_calc.h:29: In file included from drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dml_common_defs.h:29: In file included from drivers/gpu/drm/amd/amdgpu/../display/dc/dm_services.h:35: In file included from drivers/gpu/drm/amd/amdgpu/../display/dc/dm_services_types.h:29: In file included from drivers/gpu/drm/amd/amdgpu/../display/dc/os_types.h:31: In file included from include/drm/drmP.h:62: In file included from arch/x86/include/asm/pgalloc.h:7: include/linux/pagemap.h:401:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 401 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1 warning generated. >> drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dml1_display_rq_dlg_calc.o: warning: objtool: dml1_rq_dlg_get_dlg_params()+0x2f1c: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1 0/4] Fix CVE-2024-36031
by Yi Yang 16 Aug '24

16 Aug '24

Fix CVE-2024-36031 for openEuler-22.03-LTS-SP1 David Howells (2): keys, dns: Allow key types (eg. DNS) to be reclaimed immediately on expiry keys, dns: Fix size check of V1 server-list header Edward Adam Davis (1): keys, dns: Fix missing size check of V1 server-list header Silvio Gissi (1): keys: Fix overwrite of key expiration on instantiation include/linux/key-type.h | 1 + net/dns_resolver/dns_key.c | 25 ++++++++++++++++--------- security/keys/gc.c | 31 +++++++++++++++++++++---------- security/keys/internal.h | 11 ++++++++++- security/keys/key.c | 16 ++++++---------- security/keys/proc.c | 2 +- 6 files changed, 55 insertions(+), 31 deletions(-) -- 2.25.1

2 5

[PATCH openEuler-22.03-LTS-SP1] usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()
by Zeng Heng 16 Aug '24

16 Aug '24

From: Lee Jones <lee(a)kernel.org> mainline inclusion from mainline-v6.10 commit 6d3c721e686ea6c59e18289b400cc95c76e927e0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAILHF CVE: CVE-2024-42236 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Userspace provided string 's' could trivially have the length zero. Left unchecked this will firstly result in an OOB read in the form `if (str[0 - 1] == '\n') followed closely by an OOB write in the form `str[0 - 1] = '\0'`. There is already a validating check to catch strings that are too long. Let's supply an additional check for invalid strings that are too short. Signed-off-by: Lee Jones <lee(a)kernel.org> Cc: stable <stable(a)kernel.org> Link: https://lore.kernel.org/r/20240705074339.633717-1-lee@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: dengquan <dengquan9(a)huawei.com> --- drivers/usb/gadget/configfs.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c index d51ea1c052f2..6bb69a4e6470 100644 --- a/drivers/usb/gadget/configfs.c +++ b/drivers/usb/gadget/configfs.c @@ -104,9 +104,12 @@ static int usb_string_copy(const char *s, char **s_copy) int ret; char *str; char *copy = *s_copy; + ret = strlen(s); if (ret > USB_MAX_STRING_LEN) return -EOVERFLOW; + if (ret < 1) + return -EINVAL; if (copy) { str = copy; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()
by Zeng Heng 16 Aug '24

16 Aug '24

From: Lee Jones <lee(a)kernel.org> mainline inclusion from mainline-v6.10 commit 6d3c721e686ea6c59e18289b400cc95c76e927e0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAILHF CVE: CVE-2024-42236 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Userspace provided string 's' could trivially have the length zero. Left unchecked this will firstly result in an OOB read in the form `if (str[0 - 1] == '\n') followed closely by an OOB write in the form `str[0 - 1] = '\0'`. There is already a validating check to catch strings that are too long. Let's supply an additional check for invalid strings that are too short. Signed-off-by: Lee Jones <lee(a)kernel.org> Cc: stable <stable(a)kernel.org> Link: https://lore.kernel.org/r/20240705074339.633717-1-lee@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: dengquan <dengquan9(a)huawei.com> --- drivers/usb/gadget/configfs.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c index c85e64c0c39e..39a483b66484 100644 --- a/drivers/usb/gadget/configfs.c +++ b/drivers/usb/gadget/configfs.c @@ -114,9 +114,12 @@ static int usb_string_copy(const char *s, char **s_copy) int ret; char *str; char *copy = *s_copy; + ret = strlen(s); if (ret > 126) return -EOVERFLOW; + if (ret < 1) + return -EINVAL; str = kstrdup(s, GFP_KERNEL); if (!str) -- 2.25.1

2 1

[PATCH OLK-5.10] usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()
by Zeng Heng 16 Aug '24

16 Aug '24

From: Lee Jones <lee(a)kernel.org> mainline inclusion from mainline-v6.10 commit 6d3c721e686ea6c59e18289b400cc95c76e927e0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAILHF CVE: CVE-2024-42236 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Userspace provided string 's' could trivially have the length zero. Left unchecked this will firstly result in an OOB read in the form `if (str[0 - 1] == '\n') followed closely by an OOB write in the form `str[0 - 1] = '\0'`. There is already a validating check to catch strings that are too long. Let's supply an additional check for invalid strings that are too short. Signed-off-by: Lee Jones <lee(a)kernel.org> Cc: stable <stable(a)kernel.org> Link: https://lore.kernel.org/r/20240705074339.633717-1-lee@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: dengquan <dengquan9(a)huawei.com> --- drivers/usb/gadget/configfs.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c index d51ea1c052f2..6bb69a4e6470 100644 --- a/drivers/usb/gadget/configfs.c +++ b/drivers/usb/gadget/configfs.c @@ -104,9 +104,12 @@ static int usb_string_copy(const char *s, char **s_copy) int ret; char *str; char *copy = *s_copy; + ret = strlen(s); if (ret > USB_MAX_STRING_LEN) return -EOVERFLOW; + if (ret < 1) + return -EINVAL; if (copy) { str = copy; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] sched/cputime: Fix mul_u64_u64_div_u64() precision for cputime
by Zheng Zucheng 16 Aug '24

16 Aug '24

mainline inclusion from mainline-v6.11-rc2 commit 77baa5bafcbe1b2a15ef9c37232c21279c95481c category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAIN7D Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In extreme test scenarios: the 14th field utime in /proc/xx/stat is greater than sum_exec_runtime, utime = 18446744073709518790 ns, rtime = 135989749728000 ns In cputime_adjust() process, stime is greater than rtime due to mul_u64_u64_div_u64() precision problem. before call mul_u64_u64_div_u64(), stime = 175136586720000, rtime = 135989749728000, utime = 1416780000. after call mul_u64_u64_div_u64(), stime = 135989949653530 unsigned reversion occurs because rtime is less than stime. utime = rtime - stime = 135989749728000 - 135989949653530 = -199925530 = (u64)18446744073709518790 Trigger condition: 1). User task run in kernel mode most of time 2). ARM64 architecture 3). TICK_CPU_ACCOUNTING=y CONFIG_VIRT_CPU_ACCOUNTING_NATIVE is not set Fix mul_u64_u64_div_u64() conversion precision by reset stime to rtime Fixes: 3dc167ba5729 ("sched/cputime: Improve cputime_adjust()") Signed-off-by: Zheng Zucheng <zhengzucheng(a)huawei.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Cc: <stable(a)vger.kernel.org> Link: https://lkml.kernel.org/r/20240726023235.217771-1-zhengzucheng@huawei.com Signed-off-by: Zheng Zucheng <zhengzucheng(a)huawei.com> Conflicts: kernel/sched/cputime.c [mul_u64_u64_div_u64 is replaced by scale_stime, No functional impact.] Signed-off-by: Zheng Zucheng <zhengzucheng(a)huawei.com> --- kernel/sched/cputime.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/kernel/sched/cputime.c b/kernel/sched/cputime.c index 0df2448eb5d1..4055f2008cc6 100644 --- a/kernel/sched/cputime.c +++ b/kernel/sched/cputime.c @@ -728,6 +728,12 @@ void cputime_adjust(struct task_cputime *curr, struct prev_cputime *prev, } stime = scale_stime(stime, rtime, stime + utime); + /* + * Because mul_u64_u64_div_u64() can approximate on some + * achitectures; enforce the constraint that: a*b/(b+c) <= a. + */ + if (unlikely(stime > rtime)) + stime = rtime; update: /* -- 2.34.1

2 1

[openeuler:OLK-6.6] BUILD REGRESSION 130fc493d13fa24dba99b7116f0f995fe2d1465b
by kernel test robot 16 Aug '24

16 Aug '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: 130fc493d13fa24dba99b7116f0f995fe2d1465b !10907 v2 perf/x86: Fix smp_processor_id()-in-preemptible warnings Error/Warning reports: https://lore.kernel.org/oe-kbuild-all/202408160647.XUdenjS0-lkp@intel.com Error/Warning: (recently discovered and may have been fixed) drivers/crypto/ccp/hygon/tdm-dev.c:340:40: error: incomplete definition of type 'struct module' Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- arch-arm64-kvm-arm.c:warning:variable-r-is-used-uninitialized-whenever-if-condition-is-false | |-- arch-arm64-kvm-tmi.c:warning:no-previous-prototype-for-function-tmi_tmm_inf_test | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_create_ttt_levels | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_get_num_brps | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_get_num_wrps | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_ipa_limit | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_populate_par_region | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_supports_pmu | `-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_supports_sve |-- x86_64-buildonly-randconfig-001-20240816 | `-- drivers-crypto-ccp-hygon-tdm-dev.c:error:incomplete-definition-of-type-struct-module |-- x86_64-buildonly-randconfig-002-20240816 | `-- kernel-sched-isolation.c:error:setup_max_cpus-undeclared-(first-use-in-this-function) |-- x86_64-buildonly-randconfig-003-20240816 | `-- kernel-sched-isolation.c:error:setup_max_cpus-undeclared-(first-use-in-this-function) |-- x86_64-buildonly-randconfig-006-20240816 | `-- kernel-sched-isolation.c:error:setup_max_cpus-undeclared-(first-use-in-this-function) `-- x86_64-randconfig-014-20240816 |-- include-linux-psp-hygon.h:warning:no-previous-prototype-for-function-psp_register_cmd_notifier `-- include-linux-psp-hygon.h:warning:no-previous-prototype-for-function-psp_unregister_cmd_notifier elapsed time: 728m configs tested: 33 configs skipped: 133 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240816 clang-20 arm64 randconfig-002-20240816 clang-20 arm64 randconfig-003-20240816 clang-20 arm64 randconfig-004-20240816 clang-20 loongarch allmodconfig gcc-14.1.0 loongarch allnoconfig gcc-14.1.0 loongarch randconfig-001-20240816 gcc-14.1.0 loongarch randconfig-002-20240816 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240816 clang-18 x86_64 buildonly-randconfig-002-20240816 gcc-12 x86_64 buildonly-randconfig-003-20240816 gcc-12 x86_64 buildonly-randconfig-004-20240816 clang-18 x86_64 buildonly-randconfig-005-20240816 clang-18 x86_64 buildonly-randconfig-006-20240816 gcc-12 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240816 gcc-12 x86_64 randconfig-002-20240816 clang-18 x86_64 randconfig-003-20240816 clang-18 x86_64 randconfig-004-20240816 clang-18 x86_64 randconfig-005-20240816 clang-18 x86_64 randconfig-006-20240816 gcc-12 x86_64 randconfig-011-20240816 clang-18 x86_64 randconfig-012-20240816 gcc-12 x86_64 randconfig-013-20240816 gcc-12 x86_64 randconfig-014-20240816 clang-18 x86_64 randconfig-015-20240816 clang-18 x86_64 randconfig-016-20240816 clang-18 x86_64 randconfig-072-20240816 gcc-11 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 13292/13430] drivers/crypto/ccp/hygon/tdm-dev.c:340:40: error: incomplete definition of type 'struct module'
by kernel test robot 16 Aug '24

16 Aug '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 130fc493d13fa24dba99b7116f0f995fe2d1465b commit: a1dd4972da4e66d9a9d1a89b3dfd8f742c20193b [13292/13430] crypto: tdm: Add Hygon TDM driver config: x86_64-buildonly-randconfig-001-20240816 (https://download.01.org/0day-ci/archive/20240816/202408160647.XUdenjS0-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240816/202408160647.XUdenjS0-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408160647.XUdenjS0-lkp@intel.com/ All errors (new ones prefixed by >>): drivers/crypto/ccp/hygon/tdm-dev.c:94:6: warning: variable 'ret' set but not used [-Wunused-but-set-variable] 94 | int ret = 0; | ^ >> drivers/crypto/ccp/hygon/tdm-dev.c:340:40: error: incomplete definition of type 'struct module' 340 | memcpy(ctx_msg.module_name, p_module->name, sizeof(p_module->name)); | ~~~~~~~~^ arch/x86/include/asm/alternative.h:103:8: note: forward declaration of 'struct module' 103 | struct module; | ^ drivers/crypto/ccp/hygon/tdm-dev.c:340:63: error: incomplete definition of type 'struct module' 340 | memcpy(ctx_msg.module_name, p_module->name, sizeof(p_module->name)); | ~~~~~~~~^ arch/x86/include/asm/alternative.h:103:8: note: forward declaration of 'struct module' 103 | struct module; | ^ drivers/crypto/ccp/hygon/tdm-dev.c:606:20: warning: variable 'head' set but not used [-Wunused-but-set-variable] 606 | struct list_head *head = NULL; | ^ 2 warnings and 2 errors generated. vim +340 drivers/crypto/ccp/hygon/tdm-dev.c 323 324 if (!hash) { 325 ret = -DYN_NULL_POINTER; 326 pr_err("Null pointer\n"); 327 goto end; 328 } 329 330 ctx_msg.flag = flag; 331 ctx_msg.pid = current->pid; 332 memcpy(ctx_msg.comm, current->comm, sizeof(current->comm)); 333 334 return_address = CALLER_ADDR1; 335 if (return_address) { 336 #if IS_BUILTIN(CONFIG_CRYPTO_DEV_CCP_DD) 337 p_module = __module_address(return_address); 338 // caller is module 339 if (p_module) > 340 memcpy(ctx_msg.module_name, p_module->name, sizeof(p_module->name)); 341 // caller is build-in 342 else 343 memset(ctx_msg.module_name, 0, sizeof(ctx_msg.module_name)); 344 #elif IS_ENABLED(CONFIG_KALLSYMS) 345 symbol_len = sprint_symbol((char *)symbol_buf, return_address); 346 if (!symbol_len) { 347 ret = -DYN_ERR_API; 348 pr_err("sprint_symbol failed\n"); 349 goto end; 350 } 351 symbol_begin = strchr((char *)symbol_buf, '['); 352 if (!symbol_begin) { 353 ret = -DYN_NULL_POINTER; 354 pr_err("module name is not exist\n"); 355 goto end; 356 } 357 symbol_end = strchr((char *)symbol_buf, ']'); 358 if (!symbol_end) { 359 ret = -DYN_NULL_POINTER; 360 pr_err("module name is not exist\n"); 361 goto end; 362 } 363 symbol_begin++; 364 if (symbol_end - symbol_begin) 365 memcpy(ctx_msg.module_name, symbol_begin, symbol_end - symbol_begin); 366 else 367 memset(ctx_msg.module_name, 0, sizeof(ctx_msg.module_name)); 368 #else 369 memset(ctx_msg.module_name, 0, sizeof(ctx_msg.module_name)); 370 #endif 371 } else 372 memset(ctx_msg.module_name, 0, sizeof(ctx_msg.module_name)); 373 374 ret = calc_task_context_hash(ctx_msg, hash); 375 if (ret) { 376 pr_err("calc_task_context_hash failed\n"); 377 goto end; 378 } 379 380 end: 381 return ret; 382 } 383 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0