- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] ima: fix a compilation error with ima_bprm_creds_for_exec()
by Gu Bowen 18 Nov '24

18 Nov '24

The new feature script execution check has added a new security function ima_bprm_creds_for_exe, which causes a compilation error when ima is not enabled, we fix it. Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- include/linux/ima.h | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/include/linux/ima.h b/include/linux/ima.h index 76d0f71d7955..eb119cd62f02 100644 --- a/include/linux/ima.h +++ b/include/linux/ima.h @@ -63,6 +63,11 @@ static inline int ima_bprm_check(struct linux_binprm *bprm) return 0; } +static inline int ima_bprm_creds_for_exec(struct linux_binprm *bprm) +{ + return 0; +} + static inline int ima_file_check(struct file *file, int mask) { return 0; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower
by Liu Jian 18 Nov '24

18 Nov '24

From: Felix Fietkau <nbd(a)nbd.name> stable inclusion from stable-v4.19.323 commit b0b862aa3dbcd16b3c4715259a825f48ca540088 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB37A8 CVE: CVE-2024-50237 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- commit 393b6bc174b0dd21bb2a36c13b36e62fc3474a23 upstream. Avoid potentially crashing in the driver because of uninitialized private data Fixes: 5b3dc42b1b0d ("mac80211: add support for driver tx power reporting") Cc: stable(a)vger.kernel.org Signed-off-by: Felix Fietkau <nbd(a)nbd.name> Link: https://patch.msgid.link/20241002095630.22431-1-nbd@nbd.name Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/mac80211/cfg.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c index d384fb85b8df..1f7ae4cbbdee 100644 --- a/net/mac80211/cfg.c +++ b/net/mac80211/cfg.c @@ -2451,7 +2451,8 @@ static int ieee80211_get_tx_power(struct wiphy *wiphy, struct ieee80211_local *local = wiphy_priv(wiphy); struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev); - if (local->ops->get_txpower) + if (local->ops->get_txpower && + (sdata->flags & IEEE80211_SDATA_IN_DRIVER)) return drv_get_txpower(local, sdata, dbm); if (!local->use_chanctx) -- 2.34.1

2 1

[PATCH OLK-5.10] wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower
by Liu Jian 18 Nov '24

18 Nov '24

From: Felix Fietkau <nbd(a)nbd.name> stable inclusion from stable-v5.10.229 commit c21efba8b5a86537ccdf43f77536bad02f82776c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB37A8 CVE: CVE-2024-50237 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- commit 393b6bc174b0dd21bb2a36c13b36e62fc3474a23 upstream. Avoid potentially crashing in the driver because of uninitialized private data Fixes: 5b3dc42b1b0d ("mac80211: add support for driver tx power reporting") Cc: stable(a)vger.kernel.org Signed-off-by: Felix Fietkau <nbd(a)nbd.name> Link: https://patch.msgid.link/20241002095630.22431-1-nbd@nbd.name Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/mac80211/cfg.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c index c8d2fe8fbc0a..f2629e56d1a5 100644 --- a/net/mac80211/cfg.c +++ b/net/mac80211/cfg.c @@ -2720,7 +2720,8 @@ static int ieee80211_get_tx_power(struct wiphy *wiphy, struct ieee80211_local *local = wiphy_priv(wiphy); struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev); - if (local->ops->get_txpower) + if (local->ops->get_txpower && + (sdata->flags & IEEE80211_SDATA_IN_DRIVER)) return drv_get_txpower(local, sdata, dbm); if (!local->use_chanctx) -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower
by Liu Jian 18 Nov '24

18 Nov '24

From: Felix Fietkau <nbd(a)nbd.name> stable inclusion from stable-v5.10.229 commit c21efba8b5a86537ccdf43f77536bad02f82776c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB37A8 CVE: CVE-2024-50237 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- commit 393b6bc174b0dd21bb2a36c13b36e62fc3474a23 upstream. Avoid potentially crashing in the driver because of uninitialized private data Fixes: 5b3dc42b1b0d ("mac80211: add support for driver tx power reporting") Cc: stable(a)vger.kernel.org Signed-off-by: Felix Fietkau <nbd(a)nbd.name> Link: https://patch.msgid.link/20241002095630.22431-1-nbd@nbd.name Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/mac80211/cfg.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c index c8d2fe8fbc0a..f2629e56d1a5 100644 --- a/net/mac80211/cfg.c +++ b/net/mac80211/cfg.c @@ -2720,7 +2720,8 @@ static int ieee80211_get_tx_power(struct wiphy *wiphy, struct ieee80211_local *local = wiphy_priv(wiphy); struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev); - if (local->ops->get_txpower) + if (local->ops->get_txpower && + (sdata->flags & IEEE80211_SDATA_IN_DRIVER)) return drv_get_txpower(local, sdata, dbm); if (!local->use_chanctx) -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] mailbox: bcm2835: Fix timeout during suspend mode
by dinglongwei 18 Nov '24

18 Nov '24

From: Stefan Wahren <wahrenst(a)gmx.net> stable inclusion from stable-v5.10.227 commit 32ee78823dea2d54adaf6e05f86622eba359e091 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRCG CVE: CVE-2024-49963 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit dc09f007caed3b2f6a3b6bd7e13777557ae22bfd ] During noirq suspend phase the Raspberry Pi power driver suffer of firmware property timeouts. The reason is that the IRQ of the underlying BCM2835 mailbox is disabled and rpi_firmware_property_list() will always run into a timeout [1]. Since the VideoCore side isn't consider as a wakeup source, set the IRQF_NO_SUSPEND flag for the mailbox IRQ in order to keep it enabled during suspend-resume cycle. [1] PM: late suspend of devices complete after 1.754 msecs WARNING: CPU: 0 PID: 438 at drivers/firmware/raspberrypi.c:128 rpi_firmware_property_list+0x204/0x22c Firmware transaction 0x00028001 timeout Modules linked in: CPU: 0 PID: 438 Comm: bash Tainted: G C 6.9.3-dirty #17 Hardware name: BCM2835 Call trace: unwind_backtrace from show_stack+0x18/0x1c show_stack from dump_stack_lvl+0x34/0x44 dump_stack_lvl from __warn+0x88/0xec __warn from warn_slowpath_fmt+0x7c/0xb0 warn_slowpath_fmt from rpi_firmware_property_list+0x204/0x22c rpi_firmware_property_list from rpi_firmware_property+0x68/0x8c rpi_firmware_property from rpi_firmware_set_power+0x54/0xc0 rpi_firmware_set_power from _genpd_power_off+0xe4/0x148 _genpd_power_off from genpd_sync_power_off+0x7c/0x11c genpd_sync_power_off from genpd_finish_suspend+0xcc/0xe0 genpd_finish_suspend from dpm_run_callback+0x78/0xd0 dpm_run_callback from device_suspend_noirq+0xc0/0x238 device_suspend_noirq from dpm_suspend_noirq+0xb0/0x168 dpm_suspend_noirq from suspend_devices_and_enter+0x1b8/0x5ac suspend_devices_and_enter from pm_suspend+0x254/0x2e4 pm_suspend from state_store+0xa8/0xd4 state_store from kernfs_fop_write_iter+0x154/0x1a0 kernfs_fop_write_iter from vfs_write+0x12c/0x184 vfs_write from ksys_write+0x78/0xc0 ksys_write from ret_fast_syscall+0x0/0x54 Exception stack(0xcc93dfa8 to 0xcc93dff0) [...] PM: noirq suspend of devices complete after 3095.584 msecs Link: https://github.com/raspberrypi/firmware/issues/1894 Fixes: 0bae6af6d704 ("mailbox: Enable BCM2835 mailbox support") Signed-off-by: Stefan Wahren <wahrenst(a)gmx.net> Reviewed-by: Florian Fainelli <florian.fainelli(a)broadcom.com> Signed-off-by: Jassi Brar <jassisinghbrar(a)gmail.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: dinglongwei <dinglongwei1(a)huawei.com> --- drivers/mailbox/bcm2835-mailbox.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/mailbox/bcm2835-mailbox.c b/drivers/mailbox/bcm2835-mailbox.c index 39761d190545..5c33c01a9d26 100644 --- a/drivers/mailbox/bcm2835-mailbox.c +++ b/drivers/mailbox/bcm2835-mailbox.c @@ -146,7 +146,8 @@ static int bcm2835_mbox_probe(struct platform_device *pdev) spin_lock_init(&mbox->lock); ret = devm_request_irq(dev, irq_of_parse_and_map(dev->of_node, 0), - bcm2835_mbox_irq, 0, dev_name(dev), mbox); + bcm2835_mbox_irq, IRQF_NO_SUSPEND, dev_name(dev), + mbox); if (ret) { dev_err(dev, "Failed to register a mailbox IRQ handler: %d\n", ret); -- 2.17.1

2 1

[PATCH OLK-6.6 0/4] CVE-2023-52920
by Pu Lehui 18 Nov '24

18 Nov '24

Andrii Nakryiko (3): bpf: support non-r10 register spill/fill to/from stack in precision tracking selftests/bpf: add stack access precision test bpf: handle fake register spill to stack with BPF_ST_MEM instruction Pu Lehui (1): bpf: Fix kabi breakage in struct bpf_verifier_state and bpf_verifier_env include/linux/bpf_verifier.h | 35 +++- kernel/bpf/verifier.c | 174 ++++++++++-------- .../bpf/progs/verifier_subprog_precision.c | 87 ++++++++- .../testing/selftests/bpf/verifier/precise.c | 38 ++-- 4 files changed, 232 insertions(+), 102 deletions(-) -- 2.34.1

2 5

[PATCH OLK-5.10 0/5] CVE-2023-52920
by Pu Lehui 18 Nov '24

18 Nov '24

Andrii Nakryiko (5): bpf: decouple prune and jump points bpf: encapsulate precision backtracking bookkeeping bpf: mostly decouple jump history management from is_state_visited() bpf: support non-r10 register spill/fill to/from stack in precision tracking bpf: handle fake register spill to stack with BPF_ST_MEM instruction include/linux/bpf_verifier.h | 46 +- kernel/bpf/verifier.c | 480 ++++++++++++------ .../testing/selftests/bpf/verifier/precise.c | 29 +- 3 files changed, 385 insertions(+), 170 deletions(-) -- 2.34.1

2 6

[PATCH OLK-5.10] mailbox: bcm2835: Fix timeout during suspend mode
by dinglongwei 18 Nov '24

18 Nov '24

From: Stefan Wahren <wahrenst(a)gmx.net> stable inclusion from stable-v5.10.227 commit 32ee78823dea2d54adaf6e05f86622eba359e091 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRCG CVE: CVE-2024-49963 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit dc09f007caed3b2f6a3b6bd7e13777557ae22bfd ] During noirq suspend phase the Raspberry Pi power driver suffer of firmware property timeouts. The reason is that the IRQ of the underlying BCM2835 mailbox is disabled and rpi_firmware_property_list() will always run into a timeout [1]. Since the VideoCore side isn't consider as a wakeup source, set the IRQF_NO_SUSPEND flag for the mailbox IRQ in order to keep it enabled during suspend-resume cycle. [1] PM: late suspend of devices complete after 1.754 msecs WARNING: CPU: 0 PID: 438 at drivers/firmware/raspberrypi.c:128 rpi_firmware_property_list+0x204/0x22c Firmware transaction 0x00028001 timeout Modules linked in: CPU: 0 PID: 438 Comm: bash Tainted: G C 6.9.3-dirty #17 Hardware name: BCM2835 Call trace: unwind_backtrace from show_stack+0x18/0x1c show_stack from dump_stack_lvl+0x34/0x44 dump_stack_lvl from __warn+0x88/0xec __warn from warn_slowpath_fmt+0x7c/0xb0 warn_slowpath_fmt from rpi_firmware_property_list+0x204/0x22c rpi_firmware_property_list from rpi_firmware_property+0x68/0x8c rpi_firmware_property from rpi_firmware_set_power+0x54/0xc0 rpi_firmware_set_power from _genpd_power_off+0xe4/0x148 _genpd_power_off from genpd_sync_power_off+0x7c/0x11c genpd_sync_power_off from genpd_finish_suspend+0xcc/0xe0 genpd_finish_suspend from dpm_run_callback+0x78/0xd0 dpm_run_callback from device_suspend_noirq+0xc0/0x238 device_suspend_noirq from dpm_suspend_noirq+0xb0/0x168 dpm_suspend_noirq from suspend_devices_and_enter+0x1b8/0x5ac suspend_devices_and_enter from pm_suspend+0x254/0x2e4 pm_suspend from state_store+0xa8/0xd4 state_store from kernfs_fop_write_iter+0x154/0x1a0 kernfs_fop_write_iter from vfs_write+0x12c/0x184 vfs_write from ksys_write+0x78/0xc0 ksys_write from ret_fast_syscall+0x0/0x54 Exception stack(0xcc93dfa8 to 0xcc93dff0) [...] PM: noirq suspend of devices complete after 3095.584 msecs Link: https://github.com/raspberrypi/firmware/issues/1894 Fixes: 0bae6af6d704 ("mailbox: Enable BCM2835 mailbox support") Signed-off-by: Stefan Wahren <wahrenst(a)gmx.net> Reviewed-by: Florian Fainelli <florian.fainelli(a)broadcom.com> Signed-off-by: Jassi Brar <jassisinghbrar(a)gmail.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: dinglongwei <dinglongwei1(a)huawei.com> --- drivers/mailbox/bcm2835-mailbox.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/mailbox/bcm2835-mailbox.c b/drivers/mailbox/bcm2835-mailbox.c index 39761d190545..5c33c01a9d26 100644 --- a/drivers/mailbox/bcm2835-mailbox.c +++ b/drivers/mailbox/bcm2835-mailbox.c @@ -146,7 +146,8 @@ static int bcm2835_mbox_probe(struct platform_device *pdev) spin_lock_init(&mbox->lock); ret = devm_request_irq(dev, irq_of_parse_and_map(dev->of_node, 0), - bcm2835_mbox_irq, 0, dev_name(dev), mbox); + bcm2835_mbox_irq, IRQF_NO_SUSPEND, dev_name(dev), + mbox); if (ret) { dev_err(dev, "Failed to register a mailbox IRQ handler: %d\n", ret); -- 2.17.1

2 1

[PATCH OLK-6.6 0/6] CVE-2024-46698
by dinglongwei 18 Nov '24

18 Nov '24

CVE-2024-46698 Alex Deucher (1): video/aperture: optionally match the device in sysfb_disable() Dan Carpenter (1): firmware/sysfb: fix an error code in sysfb_init() Javier Martinez Canillas (1): of/platform: Disable sysfb if a simple-framebuffer node is found Thomas Zimmermann (3): firmware/sysfb: Set firmware-framebuffer parent device firmware/sysfb: Create firmware device only for enabled PCI devices firmware: sysfb: Fix reference count of sysfb parent device drivers/firmware/sysfb.c | 74 ++++++++++++++++++++++++++++--- drivers/firmware/sysfb_simplefb.c | 5 ++- drivers/of/platform.c | 18 +++++++- drivers/video/aperture.c | 11 ++--- include/linux/sysfb.h | 10 +++-- 5 files changed, 96 insertions(+), 22 deletions(-) -- 2.17.1

2 7

[openeuler:OLK-6.6 1474/1474] arch/x86/kernel/zhaoxin_kh40000.c:155:26: sparse: sparse: symbol 'kh40000_dma_direct_ops' was not declared. Should it be static?
by kernel test robot 18 Nov '24

18 Nov '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 7c547c6bbe6b6a9cedf63d7cdadb2529404df633 commit: 11557c1ae4529f133483879b7ee00b7d8c653be7 [1474/1474] x86/cpu/zhaoxin: Encapsulate access to kh40000_dma_direct_ops within function config: x86_64-randconfig-123-20241118 (https://download.01.org/0day-ci/archive/20241118/202411180946.SYMUTUAQ-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241118/202411180946.SYMUTUAQ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411180946.SYMUTUAQ-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) arch/x86/kernel/zhaoxin_kh40000.c:33:15: sparse: sparse: symbol 'zhaoxin_patch_code' was not declared. Should it be static? >> arch/x86/kernel/zhaoxin_kh40000.c:155:26: sparse: sparse: symbol 'kh40000_dma_direct_ops' was not declared. Should it be static? arch/x86/kernel/zhaoxin_kh40000.c:325:26: sparse: sparse: symbol 'kh40000_dma_iommu_ops' was not declared. Should it be static? vim +/kh40000_dma_direct_ops +155 arch/x86/kernel/zhaoxin_kh40000.c 4332dbb0718135 leoliu-oc 2024-05-13 154 4332dbb0718135 leoliu-oc 2024-05-13 @155 const struct dma_map_ops kh40000_dma_direct_ops = { 4332dbb0718135 leoliu-oc 2024-05-13 156 .flags = DMA_F_PCI_P2PDMA_SUPPORTED, 4332dbb0718135 leoliu-oc 2024-05-13 157 .alloc = kh40000_dma_direct_alloc, 4332dbb0718135 leoliu-oc 2024-05-13 158 .sync_sg_for_cpu = kh40000_dma_direct_sync_sg_for_cpu, 4332dbb0718135 leoliu-oc 2024-05-13 159 .unmap_page = kh40000_dma_direct_unmap_page, 4332dbb0718135 leoliu-oc 2024-05-13 160 .sync_single_for_cpu = kh40000_dma_direct_sync_single_for_cpu, 4332dbb0718135 leoliu-oc 2024-05-13 161 .unmap_sg = kh40000_dma_direct_unmap_sg, 4332dbb0718135 leoliu-oc 2024-05-13 162 .unmap_resource = kh40000_dma_direct_unmap_resource, 4332dbb0718135 leoliu-oc 2024-05-13 163 .dma_supported = dma_direct_supported, 4332dbb0718135 leoliu-oc 2024-05-13 164 .free = dma_direct_free, 4332dbb0718135 leoliu-oc 2024-05-13 165 .alloc_pages = dma_direct_alloc_pages, 4332dbb0718135 leoliu-oc 2024-05-13 166 .free_pages = dma_direct_free_pages, 4332dbb0718135 leoliu-oc 2024-05-13 167 .sync_single_for_device = dma_direct_sync_single_for_device, 4332dbb0718135 leoliu-oc 2024-05-13 168 .sync_sg_for_device = dma_direct_sync_sg_for_device, 4332dbb0718135 leoliu-oc 2024-05-13 169 .get_required_mask = dma_direct_get_required_mask, 4332dbb0718135 leoliu-oc 2024-05-13 170 .max_mapping_size = dma_direct_max_mapping_size, 4332dbb0718135 leoliu-oc 2024-05-13 171 .mmap = dma_direct_mmap, 4332dbb0718135 leoliu-oc 2024-05-13 172 .get_sgtable = dma_direct_get_sgtable, 4332dbb0718135 leoliu-oc 2024-05-13 173 .map_page = dma_direct_map_page, 4332dbb0718135 leoliu-oc 2024-05-13 174 .map_sg = dma_direct_map_sg, 4332dbb0718135 leoliu-oc 2024-05-13 175 .map_resource = dma_direct_map_resource, 4332dbb0718135 leoliu-oc 2024-05-13 176 }; ef20808db09987 leoliu-oc 2024-03-22 177 :::::: The code at line 155 was first introduced by commit :::::: 4332dbb07181359cccca3ba757ef54e434fb1296 Add kh40000_direct_dma_ops for KH-40000 platform :::::: TO: leoliu-oc <leoliu-oc(a)zhaoxin.com> :::::: CC: leoliu-oc <leoliu-oc(a)zhaoxin.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0