- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] drm: nv04: Fix out of bounds access
by Zhang Changzhong 09 May '24

09 May '24

From: Mikhail Kobuk <m.kobuk(a)ispras.ru> stable inclusion from stable-v5.10.216 commit 097c7918fcfa1dee233acfd1f3029f00c3bc8062 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5JU CVE: CVE-2024-27008 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit cf92bb778eda7830e79452c6917efa8474a30c1e ] When Output Resource (dcb->or) value is assigned in fabricate_dcb_output(), there may be out of bounds access to dac_users array in case dcb->or is zero because ffs(dcb->or) is used as index there. The 'or' argument of fabricate_dcb_output() must be interpreted as a number of bit to set, not value. Utilize macros from 'enum nouveau_or' in calls instead of hardcoding. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 2e5702aff395 ("drm/nouveau: fabricate DCB encoder table for iMac G4") Fixes: 670820c0e6a9 ("drm/nouveau: Workaround incorrect DCB entry on a GeForce3 Ti 200.") Signed-off-by: Mikhail Kobuk <m.kobuk(a)ispras.ru> Signed-off-by: Danilo Krummrich <dakr(a)redhat.com> Link: https://patchwork.freedesktop.org/patch/msgid/20240411110854.16701-1-m.kobu… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/gpu/drm/nouveau/nouveau_bios.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/drivers/gpu/drm/nouveau/nouveau_bios.c b/drivers/gpu/drm/nouveau/nouveau_bios.c index d204ea8..5cdf0d8 100644 --- a/drivers/gpu/drm/nouveau/nouveau_bios.c +++ b/drivers/gpu/drm/nouveau/nouveau_bios.c @@ -23,6 +23,7 @@ */ #include "nouveau_drv.h" +#include "nouveau_bios.h" #include "nouveau_reg.h" #include "dispnv04/hw.h" #include "nouveau_encoder.h" @@ -1672,7 +1673,7 @@ apply_dcb_encoder_quirks(struct drm_device *dev, int idx, u32 *conn, u32 *conf) */ if (nv_match_device(dev, 0x0201, 0x1462, 0x8851)) { if (*conn == 0xf2005014 && *conf == 0xffffffff) { - fabricate_dcb_output(dcb, DCB_OUTPUT_TMDS, 1, 1, 1); + fabricate_dcb_output(dcb, DCB_OUTPUT_TMDS, 1, 1, DCB_OUTPUT_B); return false; } } @@ -1758,26 +1759,26 @@ fabricate_dcb_encoder_table(struct drm_device *dev, struct nvbios *bios) #ifdef __powerpc__ /* Apple iMac G4 NV17 */ if (of_machine_is_compatible("PowerMac4,5")) { - fabricate_dcb_output(dcb, DCB_OUTPUT_TMDS, 0, all_heads, 1); - fabricate_dcb_output(dcb, DCB_OUTPUT_ANALOG, 1, all_heads, 2); + fabricate_dcb_output(dcb, DCB_OUTPUT_TMDS, 0, all_heads, DCB_OUTPUT_B); + fabricate_dcb_output(dcb, DCB_OUTPUT_ANALOG, 1, all_heads, DCB_OUTPUT_C); return; } #endif /* Make up some sane defaults */ fabricate_dcb_output(dcb, DCB_OUTPUT_ANALOG, - bios->legacy.i2c_indices.crt, 1, 1); + bios->legacy.i2c_indices.crt, 1, DCB_OUTPUT_B); if (nv04_tv_identify(dev, bios->legacy.i2c_indices.tv) >= 0) fabricate_dcb_output(dcb, DCB_OUTPUT_TV, bios->legacy.i2c_indices.tv, - all_heads, 0); + all_heads, DCB_OUTPUT_A); else if (bios->tmds.output0_script_ptr || bios->tmds.output1_script_ptr) fabricate_dcb_output(dcb, DCB_OUTPUT_TMDS, bios->legacy.i2c_indices.panel, - all_heads, 1); + all_heads, DCB_OUTPUT_B); } static int -- 2.9.5

2 1

[PATCH openEuler-1.0-LTS] nvmet: fix a use-after-free
by Xiang Yang 09 May '24

09 May '24

From: Bart Van Assche <bvanassche(a)acm.org> stable inclusion from stable-v4.19.260 commit 17f121ca3ec6be0fb32d77c7f65362934a38cc8e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9LKE0 CVE: CVE-2022-48697 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 6a02a61e81c231cc5c680c5dbf8665275147ac52 ] Fix the following use-after-free complaint triggered by blktests nvme/004: BUG: KASAN: user-memory-access in blk_mq_complete_request_remote+0xac/0x350 Read of size 4 at addr 0000607bd1835943 by task kworker/13:1/460 Workqueue: nvmet-wq nvme_loop_execute_work [nvme_loop] Call Trace: show_stack+0x52/0x58 dump_stack_lvl+0x49/0x5e print_report.cold+0x36/0x1e2 kasan_report+0xb9/0xf0 __asan_load4+0x6b/0x80 blk_mq_complete_request_remote+0xac/0x350 nvme_loop_queue_response+0x1df/0x275 [nvme_loop] __nvmet_req_complete+0x132/0x4f0 [nvmet] nvmet_req_complete+0x15/0x40 [nvmet] nvmet_execute_io_connect+0x18a/0x1f0 [nvmet] nvme_loop_execute_work+0x20/0x30 [nvme_loop] process_one_work+0x56e/0xa70 worker_thread+0x2d1/0x640 kthread+0x183/0x1c0 ret_from_fork+0x1f/0x30 Cc: stable(a)vger.kernel.org Fixes: a07b4970f464 ("nvmet: add a generic NVMe target") Signed-off-by: Bart Van Assche <bvanassche(a)acm.org> Signed-off-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Xiang Yang <xiangyang3(a)huawei.com> --- drivers/nvme/target/core.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c index 776b7e9e23b9..4a2ab093811e 100644 --- a/drivers/nvme/target/core.c +++ b/drivers/nvme/target/core.c @@ -498,6 +498,7 @@ static void __nvmet_req_complete(struct nvmet_req *req, u16 status) { u32 old_sqhd, new_sqhd; u16 sqhd; + struct nvmet_ns *ns = req->ns; if (status) nvmet_set_status(req, status); @@ -514,9 +515,9 @@ static void __nvmet_req_complete(struct nvmet_req *req, u16 status) req->rsp->sq_id = cpu_to_le16(req->sq->qid); req->rsp->command_id = req->cmd->common.command_id; - if (req->ns) - nvmet_put_namespace(req->ns); req->ops->queue_response(req); + if (ns) + nvmet_put_namespace(ns); } void nvmet_req_complete(struct nvmet_req *req, u16 status) -- 2.34.1

2 1

[PATCH OLK-6.6 v2 0/4] Backport four conflict stable patch
by Liu Shixin 09 May '24

09 May '24

Backport four stable patch which have conflicts need to fix. Kirill A. Shutemov (1): mm, treewide: introduce NR_PAGE_ORDERS Matthew Wilcox (Oracle) (1): mm: turn folio_test_hugetlb into a PageType Miaohe Lin (1): fork: defer linking file vma until vma is fully initialized Peter Xu (1): mm/hugetlb: fix missing hugetlb_lock for resv uncharge .../admin-guide/kdump/vmcoreinfo.rst | 6 +- arch/arm64/kvm/hyp/include/nvhe/gfp.h | 2 +- arch/sparc/kernel/traps_64.c | 2 +- drivers/gpu/drm/ttm/tests/ttm_device_test.c | 2 +- drivers/gpu/drm/ttm/ttm_pool.c | 20 +++--- include/drm/ttm/ttm_pool.h | 2 +- include/linux/mmzone.h | 6 +- include/linux/page-flags.h | 72 +++++++++---------- include/trace/events/mmflags.h | 1 + kernel/crash_core.c | 7 +- kernel/fork.c | 33 ++++----- lib/test_meminit.c | 2 +- mm/hugetlb.c | 27 ++----- mm/internal.h | 1 - mm/kmsan/init.c | 2 +- mm/page_alloc.c | 13 ++-- mm/page_reporting.c | 2 +- mm/show_mem.c | 8 +-- mm/vmstat.c | 12 ++-- 19 files changed, 102 insertions(+), 118 deletions(-) -- 2.25.1

2 5

[PATCH OLK-6.6 v4 0/2] block: dicard bugfix
by Li Nan 09 May '24

09 May '24

Improve patch 2. Li Nan (2): block: fix overflow in blk_ioctl_discard() block: check io size before submit discard block/blk-lib.c | 13 ++++++++++++- block/ioctl.c | 5 +++-- 2 files changed, 15 insertions(+), 3 deletions(-) -- 2.39.2

2 3

[PATCH openEuler-1.0-LTS 0/3] i40e: fix CVE-2024-26830
by Dong Chenchen 09 May '24

09 May '24

fix CVE-2024-26830. Aleksandr Loktionov (1): i40e: Refactoring VF MAC filters counting to make more reliable Ivan Vecera (1): i40e: Do not allow untrusted VF to remove administratively set MAC Slawomir Laba (1): i40e: Fix MAC address setting for a VF via Host/VM drivers/net/ethernet/intel/i40e/i40e.h | 1 + drivers/net/ethernet/intel/i40e/i40e_main.c | 19 ++++ .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 105 ++++++++++++------ .../ethernet/intel/i40e/i40e_virtchnl_pf.h | 1 - 4 files changed, 94 insertions(+), 32 deletions(-) -- 2.25.1

2 4

[PATCH openEuler-1.0-LTS 0/2] fix CVE-2024-26865
by Zhengchao Shao 09 May '24

09 May '24

Fix CVE-2024-26865. Eric Dumazet (1): tcp: Fix NEW_SYN_RECV handling in inet_twsk_purge() Kuniyuki Iwashima (1): tcp: Clean up kernel listener's reqsk in inet_twsk_purge() net/ipv4/inet_timewait_sock.c | 32 +++++++++++++++++++++----------- 1 file changed, 21 insertions(+), 11 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/4] Backport four conflict stable patch
by Liu Shixin 09 May '24

09 May '24

Backport four stable patch which have conflicts need to fix. Kirill A. Shutemov (1): mm, treewide: introduce NR_PAGE_ORDERS Matthew Wilcox (Oracle) (1): mm: turn folio_test_hugetlb into a PageType Miaohe Lin (1): fork: defer linking file vma until vma is fully initialized Peter Xu (1): mm/hugetlb: fix missing hugetlb_lock for resv uncharge .../admin-guide/kdump/vmcoreinfo.rst | 6 +- arch/arm64/kvm/hyp/include/nvhe/gfp.h | 2 +- arch/sparc/kernel/traps_64.c | 2 +- drivers/gpu/drm/ttm/tests/ttm_device_test.c | 2 +- drivers/gpu/drm/ttm/ttm_pool.c | 20 +++--- include/drm/ttm/ttm_pool.h | 2 +- include/linux/mmzone.h | 6 +- include/linux/page-flags.h | 72 +++++++++---------- include/trace/events/mmflags.h | 1 + kernel/crash_core.c | 7 +- kernel/fork.c | 33 ++++----- lib/test_meminit.c | 2 +- mm/hugetlb.c | 27 ++----- mm/kmsan/init.c | 2 +- mm/page_alloc.c | 13 ++-- mm/page_reporting.c | 2 +- mm/show_mem.c | 8 +-- mm/vmstat.c | 12 ++-- 18 files changed, 102 insertions(+), 117 deletions(-) -- 2.25.1

3 6

[PATCH OLK-5.10 v2 0/2] block: dicard bugfix
by Li Nan 09 May '24

09 May '24

Improve patch 2. Li Nan (2): block: fix overflow in blk_ioctl_discard() block: check io size before submit discard block/blk-lib.c | 13 ++++++++++++- block/ioctl.c | 5 +++-- 2 files changed, 15 insertions(+), 3 deletions(-) -- 2.39.2

2 3

[PATCH OLK-6.6 v2 0/2] block: dicard bugfix
by Li Nan 09 May '24

09 May '24

Improve patch 2. Li Nan (2): block: fix overflow in blk_ioctl_discard() block: check io size before submit discard block/blk-lib.c | 13 ++++++++++++- block/ioctl.c | 5 +++-- 2 files changed, 15 insertions(+), 3 deletions(-) -- 2.39.2

1 0

[PATCH OLK-6.6] ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super()
by Baokun Li 09 May '24

09 May '24

maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8TM21 CVE: NA Reference: https://www.spinics.net/lists/kernel/msg5053632.html ---------------------------------------- In the following concurrency we will access the uninitialized rs->lock: ext4_fill_super ext4_register_sysfs // sysfs registered msg_ratelimit_interval_ms // Other processes modify rs->interval to // non-zero via msg_ratelimit_interval_ms ext4_orphan_cleanup ext4_msg(sb, KERN_INFO, "Errors on filesystem, " __ext4_msg ___ratelimit(&(EXT4_SB(sb)->s_msg_ratelimit_state) if (!rs->interval) // do nothing if interval is 0 return 1; raw_spin_trylock_irqsave(&rs->lock, flags) raw_spin_trylock(lock) _raw_spin_trylock __raw_spin_trylock spin_acquire(&lock->dep_map, 0, 1, _RET_IP_) lock_acquire __lock_acquire register_lock_class assign_lock_key dump_stack(); ratelimit_state_init(&sbi->s_msg_ratelimit_state, 5 * HZ, 10); raw_spin_lock_init(&rs->lock); // init rs->lock here and get the following dump_stack: ========================================================= INFO: trying to register non-static key. The code is fine but needs lockdep annotation, or maybe you didn't initialize this object before use? turning off the locking correctness validator. CPU: 12 PID: 753 Comm: mount Tainted: G E 6.7.0-rc6-next-20231222 #504 [...] Call Trace: dump_stack_lvl+0xc5/0x170 dump_stack+0x18/0x30 register_lock_class+0x740/0x7c0 __lock_acquire+0x69/0x13a0 lock_acquire+0x120/0x450 _raw_spin_trylock+0x98/0xd0 ___ratelimit+0xf6/0x220 __ext4_msg+0x7f/0x160 [ext4] ext4_orphan_cleanup+0x665/0x740 [ext4] __ext4_fill_super+0x21ea/0x2b10 [ext4] ext4_fill_super+0x14d/0x360 [ext4] [...] ========================================================= Normally interval is 0 until s_msg_ratelimit_state is initialized, so ___ratelimit() does nothing. But registering sysfs precedes initializing rs->lock, so it is possible to change rs->interval to a non-zero value via the msg_ratelimit_interval_ms interface of sysfs while rs->lock is uninitialized, and then a call to ext4_msg triggers the problem by accessing an uninitialized rs->lock. Therefore register sysfs after all initializations are complete to avoid such problems. Reviewed-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/ext4/super.c | 22 ++++++++++------------ 1 file changed, 10 insertions(+), 12 deletions(-) diff --git a/fs/ext4/super.c b/fs/ext4/super.c index 9ef4017751bd..292143ce354c 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -5633,19 +5633,15 @@ static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb) if (err) goto failed_mount6; - err = ext4_register_sysfs(sb); - if (err) - goto failed_mount7; - err = ext4_init_orphan_info(sb); if (err) - goto failed_mount8; + goto failed_mount7; #ifdef CONFIG_QUOTA /* Enable quota usage during mount. */ if (ext4_has_feature_quota(sb) && !sb_rdonly(sb)) { err = ext4_enable_quotas(sb); if (err) - goto failed_mount9; + goto failed_mount8; } #endif /* CONFIG_QUOTA */ @@ -5671,7 +5667,7 @@ static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb) ext4_msg(sb, KERN_INFO, "recovery complete"); err = ext4_mark_recovery_complete(sb, es); if (err) - goto failed_mount10; + goto failed_mount9; } if (test_opt(sb, DISCARD) && !bdev_max_discard_sectors(sb->s_bdev)) @@ -5688,15 +5684,17 @@ static int __ext4_fill_super(struct fs_context *fc, struct super_block *sb) atomic_set(&sbi->s_warning_count, 0); atomic_set(&sbi->s_msg_count, 0); + /* Register sysfs after all initializations are complete. */ + err = ext4_register_sysfs(sb); + if (err) + goto failed_mount9; + return 0; -failed_mount10: +failed_mount9: ext4_quotas_off(sb, EXT4_MAXQUOTAS); -failed_mount9: __maybe_unused +failed_mount8: __maybe_unused ext4_release_orphan_info(sb); -failed_mount8: - ext4_unregister_sysfs(sb); - kobject_put(&sbi->s_kobj); failed_mount7: ext4_unregister_li_request(sb); failed_mount6: -- 2.31.1

2 1