- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS 0/1] 4.19: fix CVE-2024-35978
by Wupeng Ma 31 May '24

31 May '24

From: Ma Wupeng <mawupeng1(a)huawei.com> fix CVE-2024-35978. Dmitry Antipov (1): Bluetooth: Fix memory leak in hci_req_sync_complete() net/bluetooth/hci_request.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) -- 2.25.1

2 2

[openeuler:openEuler-1.0-LTS 1606/22616] drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:43:28: sparse: sparse: symbol 'hns3_pci_tbl' was not declared. Should it be static?
by kernel test robot 31 May '24

31 May '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: e8bccb051f559b78517ce23633a3d983f48abb0b commit: 09262653590358d6bd64c121600490fcfa3312b3 [1606/22616] driver: hns3: update hns3 driver from drivers config: arm64-randconfig-r122-20240531 (https://download.01.org/0day-ci/archive/20240531/202405311309.sjTeOAO2-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240531/202405311309.sjTeOAO2-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405311309.sjTeOAO2-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:43:28: sparse: sparse: symbol 'hns3_pci_tbl' was not declared. Should it be static? >> drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:1949:27: sparse: sparse: symbol 'hns3_err_handler' was not declared. Should it be static? In file included from include/linux/sctp.h:57, from drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:14: include/uapi/linux/sctp.h:390:1: warning: alignment 4 of 'struct sctp_paddr_change' is less than 8 [-Wpacked-not-aligned] 390 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:719:1: warning: alignment 4 of 'struct sctp_setpeerprim' is less than 8 [-Wpacked-not-aligned] 719 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:718:33: warning: 'sspp_addr' offset 4 in 'struct sctp_setpeerprim' isn't aligned to 8 [-Wpacked-not-aligned] 718 | struct sockaddr_storage sspp_addr; | ^~~~~~~~~ include/uapi/linux/sctp.h:732:1: warning: alignment 4 of 'struct sctp_prim' is less than 8 [-Wpacked-not-aligned] 732 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:731:33: warning: 'ssp_addr' offset 4 in 'struct sctp_prim' isn't aligned to 8 [-Wpacked-not-aligned] 731 | struct sockaddr_storage ssp_addr; | ^~~~~~~~ include/uapi/linux/sctp.h:783:1: warning: alignment 4 of 'struct sctp_paddrparams' is less than 8 [-Wpacked-not-aligned] 783 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:775:33: warning: 'spp_address' offset 4 in 'struct sctp_paddrparams' isn't aligned to 8 [-Wpacked-not-aligned] 775 | struct sockaddr_storage spp_address; | ^~~~~~~~~~~ include/uapi/linux/sctp.h:896:1: warning: alignment 4 of 'struct sctp_paddrinfo' is less than 8 [-Wpacked-not-aligned] 896 | } __attribute__((packed, aligned(4))); | ^ include/uapi/linux/sctp.h:890:33: warning: 'spinfo_address' offset 4 in 'struct sctp_paddrinfo' isn't aligned to 8 [-Wpacked-not-aligned] 890 | struct sockaddr_storage spinfo_address; | ^~~~~~~~~~~~~~ drivers/net/ethernet/hisilicon/hns3/hns3_enet.c: In function 'hns3_rx_checksum': drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:2414:33: warning: this statement may fall through [-Wimplicit-fallthrough=] 2414 | skb->csum_level = 1; | ~~~~~~~~~~~~~~~~^~~ drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:2415:9: note: here 2415 | case HNS3_OL4_TYPE_NO_TUN: | ^~~~ vim +/hns3_pci_tbl +43 drivers/net/ethernet/hisilicon/hns3/hns3_enet.c 35 36 /* hns3_pci_tbl - PCI Device ID Table 37 * 38 * Last entry must be all 0s 39 * 40 * { Vendor ID, Device ID, SubVendor ID, SubDevice ID, 41 * Class, Class Mask, private data (not used) } 42 */ > 43 const struct pci_device_id hns3_pci_tbl[] = { 44 {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_GE), 0}, 45 {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_25GE), 0}, 46 {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_25GE_RDMA), 47 HNAE3_DEV_SUPPORT_ROCE_DCB_BITS}, 48 {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_25GE_RDMA_MACSEC), 49 HNAE3_DEV_SUPPORT_ROCE_DCB_BITS}, 50 {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_50GE_RDMA), 51 HNAE3_DEV_SUPPORT_ROCE_DCB_BITS}, 52 {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_50GE_RDMA_MACSEC), 53 HNAE3_DEV_SUPPORT_ROCE_DCB_BITS}, 54 {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_100G_RDMA_MACSEC), 55 HNAE3_DEV_SUPPORT_ROCE_DCB_BITS}, 56 {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_100G_VF), 0}, 57 {PCI_VDEVICE(HUAWEI, HNAE3_DEV_ID_100G_RDMA_DCB_PFC_VF), 58 HNAE3_DEV_SUPPORT_ROCE_DCB_BITS}, 59 /* required last entry */ 60 {0, } 61 }; 62 MODULE_DEVICE_TABLE(pci, hns3_pci_tbl); 63 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 9622/9794] arch/x86/kernel/zhaoxin_kh40000.c:35:15: sparse: sparse: symbol 'zhaoxin_patch_code' was not declared. Should it be static?
by kernel test robot 31 May '24

31 May '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: a4c1bb6d259c5f07d1cf526fcb8c10d67c43a825 commit: 4332dbb07181359cccca3ba757ef54e434fb1296 [9622/9794] Add kh40000_direct_dma_ops for KH-40000 platform config: x86_64-randconfig-123-20240531 (https://download.01.org/0day-ci/archive/20240531/202405311319.BzJDMWBG-lkp@…) compiler: gcc-12 (Ubuntu 12.3.0-9ubuntu2) 12.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240531/202405311319.BzJDMWBG-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405311319.BzJDMWBG-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> arch/x86/kernel/zhaoxin_kh40000.c:35:15: sparse: sparse: symbol 'zhaoxin_patch_code' was not declared. Should it be static? vim +/zhaoxin_patch_code +35 arch/x86/kernel/zhaoxin_kh40000.c 34 > 35 unsigned long zhaoxin_patch_code = ZHAOXIN_PATCH_CODE_DEFAULT; 36 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS 0/2] Fix CVE-2021-47438
by Zheng Zucheng 31 May '24

31 May '24

Fix CVE-2021-47438 Valentine Fatiev (2): net/mlx5e: Fix memory leak in mlx5_core_destroy_cq() error path net/mlx5e: nullify cq->dbg pointer in mlx5_debug_cq_remove() drivers/net/ethernet/mellanox/mlx5/core/cq.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/debugfs.c | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] drm/nouveau/debugfs: fix file release memory leak
by Zheng Zucheng 31 May '24

31 May '24

From: Yang Yingliang <yangyingliang(a)huawei.com> stable inclusion from stable-v4.19.211 commit 1508b09945bde393326a9dab73b1fc35f672d771 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9R4NL CVE: CVE-2021-47423 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f5a8703a9c418c6fc54eb772712dfe7641e3991c ] When using single_open() for opening, single_release() should be called, otherwise the 'op' allocated in single_open() will be leaked. Fixes: 6e9fc177399f ("drm/nouveau/debugfs: add copy of sysfs pstate interface ported to debugfs") Reported-by: Hulk Robot <hulkci(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Karol Herbst <kherbst(a)redhat.com> Signed-off-by: Karol Herbst <kherbst(a)redhat.com> Link: https://patchwork.freedesktop.org/patch/msgid/20210911075023.3969054-2-yang… Signed-off-by: Maarten Lankhorst <maarten.lankhorst(a)linux.intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zheng Zucheng <zhengzucheng(a)huawei.com> --- drivers/gpu/drm/nouveau/nouveau_debugfs.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/nouveau/nouveau_debugfs.c b/drivers/gpu/drm/nouveau/nouveau_debugfs.c index 9635704a1d86..41f9c53302ab 100644 --- a/drivers/gpu/drm/nouveau/nouveau_debugfs.c +++ b/drivers/gpu/drm/nouveau/nouveau_debugfs.c @@ -182,6 +182,7 @@ static const struct file_operations nouveau_pstate_fops = { .open = nouveau_debugfs_pstate_open, .read = seq_read, .write = nouveau_debugfs_pstate_set, + .release = single_release, }; static struct drm_info_list nouveau_debugfs_list[] = { -- 2.34.1

2 1

[PATCH OLK-5.10 0/5] Fix CVE-2023-52732
by Zizhi Wo 31 May '24

31 May '24

V3: Fix wrong adaptation in remove_session_caps_cb(). V2: Modify conflicting files in the commit message. V1: Fix main error. Jeff Layton (4): ceph: drop private list from remove_session_caps_cb ceph: fix auth cap handling logic in remove_session_caps_cb ceph: refactor remove_session_caps_cb ceph: shut down access to inode when async create fails Xiubo Li (1): ceph: blocklist the kclient when receiving corrupted snap trace fs/ceph/addr.c | 24 ++++-- fs/ceph/caps.c | 138 ++++++++++++++++++++++++++++++++-- fs/ceph/export.c | 12 ++- fs/ceph/file.c | 13 +++- fs/ceph/inode.c | 33 +++++++- fs/ceph/locks.c | 7 ++ fs/ceph/mds_client.c | 142 ++++++++--------------------------- fs/ceph/snap.c | 36 ++++++++- fs/ceph/super.h | 12 +++ include/linux/ceph/libceph.h | 1 + 10 files changed, 289 insertions(+), 129 deletions(-) -- 2.39.2

2 6

[PATCH openEuler-1.0-LTS 0/2] Fix CVE-2021-47438
by Zheng Zucheng 31 May '24

31 May '24

Fix CVE-2021-47438 Valentine Fatiev (2): net/mlx5e: Fix memory leak in mlx5_core_destroy_cq() error path net/mlx5e: nullify cq->dbg pointer in mlx5_debug_cq_remove() drivers/net/ethernet/mellanox/mlx5/core/cq.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/debugfs.c | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10 v2 0/7] net: Backport hulk patches
by Dong Chenchen 31 May '24

31 May '24

Backport hulk patches Dong Chenchen (1): net: xfrm: skip policies marked as dead while reinserting policies Lu Wei (4): netfilter: make return-type and function-name in the same line bpf: fix magic numbers in bpf_get_sockops_uid_gid() bpf: socketmap: add Kconfig for customized socketmap tcp_comp: modify default value of TCP_COMP to n Ziyang Xuan (2): bpf: fix format type mismatch warning bpf: fix type incompatible warning arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + include/net/netfilter/nf_conntrack.h | 2 ++ include/net/sock.h | 6 +++++- net/Kconfig | 10 ++++++++++ net/core/filter.c | 11 ++++++++++- net/core/sock.c | 4 ++++ net/ipv4/Kconfig | 1 + net/netfilter/nf_conntrack_proto.c | 16 +++++++++++----- net/socket.c | 2 ++ net/xfrm/xfrm_policy.c | 13 +++++++++---- 11 files changed, 56 insertions(+), 11 deletions(-) -- 2.25.1

2 8

[PATCH OLK-5.10] dma-direct: Leak pages on dma_set_decrypted() failure
by Jinjiang Tu 31 May '24

31 May '24

From: Rick Edgecombe <rick.p.edgecombe(a)intel.com> mainline inclusion from mainline-v6.9-rc1 commit b9fa16949d18e06bdf728a560f5c8af56d2bdcaf category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9QGIS CVE: CVE-2024-35939 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- On TDX it is possible for the untrusted host to cause set_memory_encrypted() or set_memory_decrypted() to fail such that an error is returned and the resulting memory is shared. Callers need to take care to handle these errors to avoid returning decrypted (shared) memory to the page allocator, which could lead to functional or security issues. DMA could free decrypted/shared pages if dma_set_decrypted() fails. This should be a rare case. Just leak the pages in this case instead of freeing them. Signed-off-by: Rick Edgecombe <rick.p.edgecombe(a)intel.com> Signed-off-by: Christoph Hellwig <hch(a)lst.de> Conflicts: kernel/dma/direct.c [Context conflicts.] Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- kernel/dma/direct.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/kernel/dma/direct.c b/kernel/dma/direct.c index f13493c54629..9f08d81ce1f8 100644 --- a/kernel/dma/direct.c +++ b/kernel/dma/direct.c @@ -243,7 +243,7 @@ void *dma_direct_alloc(struct device *dev, size_t size, err = set_memory_decrypted((unsigned long)ret, PFN_UP(size)); if (err) - goto out_free_pages; + goto out_leak_pages; } memset(ret, 0, size); @@ -270,6 +270,8 @@ void *dma_direct_alloc(struct device *dev, size_t size, out_free_pages: __dma_direct_free_pages(dev, page, size); return NULL; +out_leak_pages: + return NULL; } void dma_direct_free(struct device *dev, size_t size, @@ -333,7 +335,7 @@ struct page *dma_direct_alloc_pages(struct device *dev, size_t size, ret = page_address(page); if (force_dma_unencrypted(dev)) { if (set_memory_decrypted((unsigned long)ret, PFN_UP(size))) - goto out_free_pages; + goto out_leak_pages; } memset(ret, 0, size); *dma_handle = phys_to_dma_direct(dev, page_to_phys(page)); @@ -341,6 +343,8 @@ struct page *dma_direct_alloc_pages(struct device *dev, size_t size, out_free_pages: __dma_direct_free_pages(dev, page, size); return NULL; +out_leak_pages: + return NULL; } void dma_direct_free_pages(struct device *dev, size_t size, -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/2] CVE-2024-35808
by Li Nan 31 May '24

31 May '24

Li Nan (2): md/dm-raid: don't call md_reap_sync_thread() directly md/dm-raid: don't clear MD_RECOVERY_FROZEN after setting frozen drivers/md/md.h | 2 ++ drivers/md/dm-raid.c | 16 ++++++++-------- drivers/md/md.c | 6 ++++-- 3 files changed, 14 insertions(+), 10 deletions(-) -- 2.39.2

2 3