- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] ARM: hisi: Add missing of_node_put after of_find_compatible_node
by Huang Xiaojia 07 Mar '25

07 Mar '25

From: Peng Wu <wupeng58(a)huawei.com> stable inclusion from stable-v4.19.247 commit dd4be8ecfb41a29e7c4e551b4e866157ce4a3429 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6KO CVE: CVE-2022-49447 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9bc72e47d4630d58a840a66a869c56b29554cfe4 ] of_find_compatible_node will increment the refcount of the returned device_node. Calling of_node_put() to avoid the refcount leak Signed-off-by: Peng Wu <wupeng58(a)huawei.com> Signed-off-by: Wei Xu <xuwei5(a)hisilicon.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Huang Xiaojia <huangxiaojia2(a)huawei.com> --- arch/arm/mach-hisi/platsmp.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/arch/arm/mach-hisi/platsmp.c b/arch/arm/mach-hisi/platsmp.c index da5689ababf7..d7fbfb6d293d 100644 --- a/arch/arm/mach-hisi/platsmp.c +++ b/arch/arm/mach-hisi/platsmp.c @@ -70,14 +70,17 @@ static void __init hi3xxx_smp_prepare_cpus(unsigned int max_cpus) } ctrl_base = of_iomap(np, 0); if (!ctrl_base) { + of_node_put(np); pr_err("failed to map address\n"); return; } if (of_property_read_u32(np, "smp-offset", &offset) < 0) { + of_node_put(np); pr_err("failed to find smp-offset property\n"); return; } ctrl_base += offset; + of_node_put(np); } } @@ -163,6 +166,7 @@ static int hip01_boot_secondary(unsigned int cpu, struct task_struct *idle) if (WARN_ON(!node)) return -1; ctrl_base = of_iomap(node, 0); + of_node_put(node); /* set the secondary core boot from DDR */ remap_reg_value = readl_relaxed(ctrl_base + REG_SC_CTRL); -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] backport mainline bugfix patch
by Lin Yujun 07 Mar '25

07 Mar '25

Thomas Gleixner (1): genirq: Make handle_enforce_irqctx() unconditionally available Yogesh Lal (1): irqchip/gic-v3: Handle CPU_PM_ENTER_FAILED correctly drivers/irqchip/irq-gic-v3.c | 2 +- kernel/irq/internals.h | 9 +++------ 2 files changed, 4 insertions(+), 7 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6 0/2] backport mainline bugfix patch
by Lin Yujun 07 Mar '25

07 Mar '25

Thomas Gleixner (1): genirq: Make handle_enforce_irqctx() unconditionally available Yogesh Lal (1): irqchip/gic-v3: Handle CPU_PM_ENTER_FAILED correctly drivers/irqchip/irq-gic-v3.c | 2 +- kernel/irq/internals.h | 9 +++------ 2 files changed, 4 insertions(+), 7 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10] orangefs: fix a oob in orangefs_debug_write
by Yifan Qiao 07 Mar '25

07 Mar '25

From: Mike Marshall <hubcap(a)omnibond.com> mainline inclusion from mainline-v6.14-rc1 commit f7c848431632598ff9bce57a659db6af60d75b39 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC4Q Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- I got a syzbot report: slab-out-of-bounds Read in orangefs_debug_write... several people suggested fixes, I tested Al Viro's suggestion and made this patch. Signed-off-by: Mike Marshall <hubcap(a)omnibond.com> Reported-by: syzbot+fc519d7875f2d9186c1f(a)syzkaller.appspotmail.com Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/orangefs/orangefs-debugfs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/orangefs/orangefs-debugfs.c b/fs/orangefs/orangefs-debugfs.c index 1b508f543384..fa41db088488 100644 --- a/fs/orangefs/orangefs-debugfs.c +++ b/fs/orangefs/orangefs-debugfs.c @@ -393,9 +393,9 @@ static ssize_t orangefs_debug_write(struct file *file, * Thwart users who try to jamb a ridiculous number * of bytes into the debug file... */ - if (count > ORANGEFS_MAX_DEBUG_STRING_LEN + 1) { + if (count > ORANGEFS_MAX_DEBUG_STRING_LEN) { silly = count; - count = ORANGEFS_MAX_DEBUG_STRING_LEN + 1; + count = ORANGEFS_MAX_DEBUG_STRING_LEN; } buf = kzalloc(ORANGEFS_MAX_DEBUG_STRING_LEN, GFP_KERNEL); -- 2.39.2

2 1

[PATCH OLK-5.10] orangefs: fix a oob in orangefs_debug_write
by Yifan Qiao 07 Mar '25

07 Mar '25

From: Mike Marshall <hubcap(a)omnibond.com> mainline inclusion from mainline-v6.14-rc1 commit f7c848431632598ff9bce57a659db6af60d75b39 category: feature bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC4Q Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- I got a syzbot report: slab-out-of-bounds Read in orangefs_debug_write... several people suggested fixes, I tested Al Viro's suggestion and made this patch. Signed-off-by: Mike Marshall <hubcap(a)omnibond.com> Reported-by: syzbot+fc519d7875f2d9186c1f(a)syzkaller.appspotmail.com Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/orangefs/orangefs-debugfs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/orangefs/orangefs-debugfs.c b/fs/orangefs/orangefs-debugfs.c index 1b508f543384..fa41db088488 100644 --- a/fs/orangefs/orangefs-debugfs.c +++ b/fs/orangefs/orangefs-debugfs.c @@ -393,9 +393,9 @@ static ssize_t orangefs_debug_write(struct file *file, * Thwart users who try to jamb a ridiculous number * of bytes into the debug file... */ - if (count > ORANGEFS_MAX_DEBUG_STRING_LEN + 1) { + if (count > ORANGEFS_MAX_DEBUG_STRING_LEN) { silly = count; - count = ORANGEFS_MAX_DEBUG_STRING_LEN + 1; + count = ORANGEFS_MAX_DEBUG_STRING_LEN; } buf = kzalloc(ORANGEFS_MAX_DEBUG_STRING_LEN, GFP_KERNEL); -- 2.39.2

2 1

[PATCH OLK-5.10] crypto: qat - add param check for DH
by Yifan Qiao 07 Mar '25

07 Mar '25

From: Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> mainline inclusion from mainline-v5.19-rc1 commit 2acbb8771f6ac82422886e63832ee7a0f4b1635b category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBP212 CVE: CVE-2022-49564 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Reject requests with a source buffer that is bigger than the size of the key. This is to prevent a possible integer underflow that might happen when copying the source scatterlist into a linear buffer. Cc: stable(a)vger.kernel.org Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> Reviewed-by: Adam Guerin <adam.guerin(a)intel.com> Reviewed-by: Wojciech Ziemba <wojciech.ziemba(a)intel.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- drivers/crypto/qat/qat_common/qat_asym_algs.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/crypto/qat/qat_common/qat_asym_algs.c b/drivers/crypto/qat/qat_common/qat_asym_algs.c index 846569ec9066..50c81a2a560e 100644 --- a/drivers/crypto/qat/qat_common/qat_asym_algs.c +++ b/drivers/crypto/qat/qat_common/qat_asym_algs.c @@ -228,6 +228,10 @@ static int qat_dh_compute_value(struct kpp_request *req) req->dst_len = ctx->p_size; return -EOVERFLOW; } + + if (req->src_len > ctx->p_size) + return -EINVAL; + memset(msg, '\0', sizeof(*msg)); ICP_QAT_FW_PKE_HDR_VALID_FLAG_SET(msg->pke_hdr, ICP_QAT_FW_COMN_REQ_FLAG_SET); -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS] crypto: qat - add param check for DH
by Yifan Qiao 07 Mar '25

07 Mar '25

From: Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> mainline inclusion from mainline-v5.19-rc1 commit 2acbb8771f6ac82422886e63832ee7a0f4b1635b category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBP212 CVE: CVE-2022-49564 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Reject requests with a source buffer that is bigger than the size of the key. This is to prevent a possible integer underflow that might happen when copying the source scatterlist into a linear buffer. Cc: stable(a)vger.kernel.org Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu(a)intel.com> Reviewed-by: Adam Guerin <adam.guerin(a)intel.com> Reviewed-by: Wojciech Ziemba <wojciech.ziemba(a)intel.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- drivers/crypto/qat/qat_common/qat_asym_algs.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/crypto/qat/qat_common/qat_asym_algs.c b/drivers/crypto/qat/qat_common/qat_asym_algs.c index 320e7854b4ee..7eab5078fecd 100644 --- a/drivers/crypto/qat/qat_common/qat_asym_algs.c +++ b/drivers/crypto/qat/qat_common/qat_asym_algs.c @@ -273,6 +273,10 @@ static int qat_dh_compute_value(struct kpp_request *req) req->dst_len = ctx->p_size; return -EOVERFLOW; } + + if (req->src_len > ctx->p_size) + return -EINVAL; + memset(msg, '\0', sizeof(*msg)); ICP_QAT_FW_PKE_HDR_VALID_FLAG_SET(msg->pke_hdr, ICP_QAT_FW_COMN_REQ_FLAG_SET); -- 2.39.2

2 1

[PATCH OLK-6.6] orangefs: fix a oob in orangefs_debug_write
by Yifan Qiao 07 Mar '25

07 Mar '25

From: Mike Marshall <hubcap(a)omnibond.com> mainline inclusion from mainline-v6.14-rc1 commit f7c848431632598ff9bce57a659db6af60d75b39 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC4Q Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- I got a syzbot report: slab-out-of-bounds Read in orangefs_debug_write... several people suggested fixes, I tested Al Viro's suggestion and made this patch. Signed-off-by: Mike Marshall <hubcap(a)omnibond.com> Reported-by: syzbot+fc519d7875f2d9186c1f(a)syzkaller.appspotmail.com Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/orangefs/orangefs-debugfs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/orangefs/orangefs-debugfs.c b/fs/orangefs/orangefs-debugfs.c index 1b508f543384..fa41db088488 100644 --- a/fs/orangefs/orangefs-debugfs.c +++ b/fs/orangefs/orangefs-debugfs.c @@ -393,9 +393,9 @@ static ssize_t orangefs_debug_write(struct file *file, * Thwart users who try to jamb a ridiculous number * of bytes into the debug file... */ - if (count > ORANGEFS_MAX_DEBUG_STRING_LEN + 1) { + if (count > ORANGEFS_MAX_DEBUG_STRING_LEN) { silly = count; - count = ORANGEFS_MAX_DEBUG_STRING_LEN + 1; + count = ORANGEFS_MAX_DEBUG_STRING_LEN; } buf = kzalloc(ORANGEFS_MAX_DEBUG_STRING_LEN, GFP_KERNEL); -- 2.39.2

2 1

[openeuler:openEuler-1.0-LTS 1447/1447] kernel/futex.o: warning: objtool: get_futex_key()+0xf8b: unreachable instruction
by kernel test robot 07 Mar '25

07 Mar '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: fa7c6902e19233b35b7caf7c8d591f1c48aa2be1 commit: b404141975c53fb7b92d74e28466b98b81db4b2e [1447/1447] futex: Provide and use pi_state_update_owner() config: x86_64-buildonly-randconfig-002-20250306 (https://download.01.org/0day-ci/archive/20250307/202503070152.Lezu4e8K-lkp@…) compiler: clang version 19.1.7 (https://github.com/llvm/llvm-project cd708029e0b2869e80abe31ddb175f7c35361f90) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250307/202503070152.Lezu4e8K-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503070152.Lezu4e8K-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from kernel/futex.c:56: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1 warning generated. >> kernel/futex.o: warning: objtool: get_futex_key()+0xf8b: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH] Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc
by Yang Yingliang 06 Mar '25

06 Mar '25

From: Fedor Pchelkin <pchelkin(a)ispras.ru> maillist inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEANO CVE: CVE-2024-56605 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.gi… ---------------------------------------- A NULL sock pointer is passed into l2cap_sock_alloc() when it is called from l2cap_sock_new_connection_cb() and the error handling paths should also be aware of it. Seemingly a more elegant solution would be to swap bt_sock_alloc() and l2cap_chan_create() calls since they are not interdependent to that moment but then l2cap_chan_create() adds the soon to be deallocated and still dummy-initialized channel to the global list accessible by many L2CAP paths. The channel would be removed from the list in short period of time but be a bit more straight-forward here and just check for NULL instead of changing the order of function calls. Found by Linux Verification Center (linuxtesting.org) with SVACE static analysis tool. Fixes: 7c4f78cdb8e7 ("Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create()") Cc: stable(a)vger.kernel.org Signed-off-by: Fedor Pchelkin <pchelkin(a)ispras.ru> Reviewed-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/bluetooth/l2cap_sock.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c index c736aba98161..6537d0867fb3 100644 --- a/net/bluetooth/l2cap_sock.c +++ b/net/bluetooth/l2cap_sock.c @@ -1864,7 +1864,8 @@ static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, chan = l2cap_chan_create(); if (!chan) { sk_free(sk); - sock->sk = NULL; + if (sock) + sock->sk = NULL; return NULL; } -- 2.25.1

1 0