- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv
by Xiangwei Li 22 Jan '25

22 Jan '25

From: Dennis Lam <dennis.lamerice(a)gmail.com> mainline inclusion from mainline-v6.13-rc6 commit 5f3fd772d152229d94602bca243fbb658068a597 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBID30 CVE: CVE-2024-57892 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------- When mounting ocfs2 and then remounting it as read-only, a slab-use-after-free occurs after the user uses a syscall to quota_getnextquota. Specifically, sb_dqinfo(sb, type)->dqi_priv is the dangling pointer. During the remounting process, the pointer dqi_priv is freed but is never set as null leaving it to be accessed. Additionally, the read-only option for remounting sets the DQUOT_SUSPENDED flag instead of setting the DQUOT_USAGE_ENABLED flags. Moreover, later in the process of getting the next quota, the function ocfs2_get_next_id is called and only checks the quota usage flags and not the quota suspended flags. To fix this, I set dqi_priv to null when it is freed after remounting with read-only and put a check for DQUOT_SUSPENDED in ocfs2_get_next_id. [akpm(a)linux-foundation.org: coding-style cleanups] Link: https://lkml.kernel.org/r/20241218023924.22821-2-dennis.lamerice@gmail.com Fixes: 8f9e8f5fcc05 ("ocfs2: Fix Q_GETNEXTQUOTA for filesystem without quotas") Signed-off-by: Dennis Lam <dennis.lamerice(a)gmail.com> Reported-by: syzbot+d173bf8a5a7faeede34c(a)syzkaller.appspotmail.com Tested-by: syzbot+d173bf8a5a7faeede34c(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/6731d26f.050a0220.1fb99c.014b.GAE@google.com/T/ Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Jun Piao <piaojun(a)huawei.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Xiangwei Li <liwei728(a)huawei.com> --- fs/ocfs2/quota_global.c | 2 +- fs/ocfs2/quota_local.c | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/ocfs2/quota_global.c b/fs/ocfs2/quota_global.c index dc9f76ab7e13..0dffd6a44d39 100644 --- a/fs/ocfs2/quota_global.c +++ b/fs/ocfs2/quota_global.c @@ -881,7 +881,7 @@ static int ocfs2_get_next_id(struct super_block *sb, struct kqid *qid) int status = 0; trace_ocfs2_get_next_id(from_kqid(&init_user_ns, *qid), type); - if (!sb_has_quota_loaded(sb, type)) { + if (!sb_has_quota_active(sb, type)) { status = -ESRCH; goto out; } diff --git a/fs/ocfs2/quota_local.c b/fs/ocfs2/quota_local.c index 257f13cdd14c..4b4fa58cd32f 100644 --- a/fs/ocfs2/quota_local.c +++ b/fs/ocfs2/quota_local.c @@ -864,6 +864,7 @@ static int ocfs2_local_free_info(struct super_block *sb, int type) brelse(oinfo->dqi_libh); brelse(oinfo->dqi_lqi_bh); kfree(oinfo); + info->dqi_priv = NULL; return status; } -- 2.25.1

2 1

[PATCH OLK-5.10 0/2] fix CVE-2024-57892
by Xiangwei Li 22 Jan '25

22 Jan '25

Dennis Lam (1): ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv Joseph Qi (1): ocfs2: correct return value of ocfs2_local_free_info() fs/ocfs2/quota_global.c | 2 +- fs/ocfs2/quota_local.c | 10 ++++------ 2 files changed, 5 insertions(+), 7 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS 0/2] fix CVE-2024-57892
by Xiangwei Li 22 Jan '25

22 Jan '25

Dennis Lam (1): ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv Joseph Qi (1): ocfs2: correct return value of ocfs2_local_free_info() fs/ocfs2/quota_global.c | 2 +- fs/ocfs2/quota_local.c | 10 ++++------ 2 files changed, 5 insertions(+), 7 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6 0/1] CVE-2024-57906
by Liao Chen 22 Jan '25

22 Jan '25

fix CVE-2024-57906 Javier Carrasco (1): iio: adc: ti-ads8688: fix information leak in triggered buffer drivers/iio/adc/ti-ads8688.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.34.1

2 2

[openeuler:OLK-6.6 1834/1834] drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:1741:9: sparse: sparse: Using plain integer as NULL pointer
by kernel test robot 22 Jan '25

22 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 75c81bcddd82381fbd4cef477a5b56eb2fe56697 commit: 4b4aa2fdd905bb63f965668452f1d1986555e1a3 [1834/1834] Huawei BMA: Adding Huawei BMA driver: cdev_veth_drv config: x86_64-randconfig-121-20250122 (https://download.01.org/0day-ci/archive/20250122/202501221622.ZyAVvHaC-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250122/202501221622.ZyAVvHaC-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501221622.ZyAVvHaC-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:1741:9: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:1750:9: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:1764:9: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:1812:9: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:1816:9: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:1832:25: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:1838:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:1842:9: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:1849:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:56:17: sparse: sparse: incorrect type in initializer (different base types) @@ expected restricted __poll_t ( *poll )( ... ) @@ got unsigned int ( * )( ... ) @@ drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:56:17: sparse: expected restricted __poll_t ( *poll )( ... ) drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:56:17: sparse: got unsigned int ( * )( ... ) >> drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:52:30: sparse: sparse: symbol 'g_eth_edma_cdev_fops' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:68:9: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:71:9: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:75:9: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:61:6: sparse: sparse: symbol 'dump_global_info' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:112:9: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:99:6: sparse: sparse: symbol 'edma_veth_free_tx_resources' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:115:6: sparse: sparse: symbol 'edma_veth_free_all_tx_resources' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:133:17: sparse: sparse: Using plain integer as NULL pointer >> drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:124:5: sparse: sparse: symbol 'edma_veth_setup_tx_resources' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:158:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:148:5: sparse: sparse: symbol 'edma_veth_setup_all_tx_resources' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:201:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:192:5: sparse: sparse: symbol 'edma_veth_setup_rx_resources' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:226:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:216:5: sparse: sparse: symbol 'edma_veth_setup_all_rx_resources' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:273:9: sparse: sparse: Using plain integer as NULL pointer >> drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:259:6: sparse: sparse: symbol 'edma_veth_free_rx_resources' was not declared. Should it be static? >> drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:276:6: sparse: sparse: symbol 'edma_veth_free_all_rx_resources' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:316:25: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:322:25: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:334:9: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:346:25: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:352:25: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:364:9: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:285:5: sparse: sparse: symbol 'edma_veth_setup_all_rxtx_queue' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:381:9: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:385:9: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:390:9: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:394:9: sparse: sparse: Using plain integer as NULL pointer >> drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:369:6: sparse: sparse: symbol 'edma_veth_dump' was not declared. Should it be static? >> drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:398:5: sparse: sparse: symbol 'edma_veth_setup_resource' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:424:5: sparse: sparse: symbol 'edma_veth_free_rxtx_queue' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:466:9: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:469:9: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:472:9: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:463:6: sparse: sparse: symbol 'edma_veth_free_resource' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:484:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:492:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:500:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:506:25: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:525:9: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:475:5: sparse: sparse: symbol 'edma_veth_send_one_pkt' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:577:9: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:608:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:615:33: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:631:33: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:647:25: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:652:25: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:661:9: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:673:9: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:684:25: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:716:9: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:722:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:740:33: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:745:25: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:746:25: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:754:25: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:764:25: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:772:25: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:787:9: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:833:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:840:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:843:25: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:858:25: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:875:25: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:801:5: sparse: sparse: symbol 'edma_veth_recv_pkt' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:883:6: sparse: sparse: symbol 'edma_task_do_packet_recv' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:916:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:923:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:908:5: sparse: sparse: symbol '__dmacmp_err_deal_2' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:941:5: sparse: sparse: symbol 'edma_veth_check_dma_status' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:1005:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:1008:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:1023:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:1026:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:962:5: sparse: sparse: symbol '__check_dmacmp_H_2' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:1059:9: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:1078:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:1096:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:1042:5: sparse: sparse: symbol '__checkspace_H_2' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:1147:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:1167:17: sparse: sparse: Using plain integer as NULL pointer >> drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:1116:5: sparse: sparse: symbol '__make_dmalistbd_h2b_H_2' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:1227:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:1249:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:1198:5: sparse: sparse: symbol '__make_dmalistbd_b2h_H_2' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:1289:9: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:1309:9: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:1278:5: sparse: sparse: symbol '__start_dmalist_H_2' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:1322:5: sparse: sparse: symbol 'check_dma_queue_fault_2' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:1361:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:1367:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:1376:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:1383:25: sparse: sparse: Using plain integer as NULL pointer >> drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:1352:5: sparse: sparse: symbol '__dma_rxtx_H_2' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:1424:9: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:1425:9: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:1439:9: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:1440:9: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:1419:6: sparse: sparse: symbol 'edma_task_do_data_transmit' was not declared. Should it be static? >> drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:1456:5: sparse: sparse: symbol 'edma_tasklet_setup' was not declared. Should it be static? >> drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:1504:6: sparse: sparse: symbol 'edma_tasklet_free' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:1554:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:1577:9: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:1588:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:1598:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:1612:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:1619:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:1645:9: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:1680:9: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:1693:9: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:1720:17: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:1725:9: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:1405:25: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:1405:25: sparse: sparse: Using plain integer as NULL pointer drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c:94:26: sparse: sparse: cast removes address space '__iomem' of expression vim +1741 drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c 1736 1737 int cdev_open(struct inode *inode_ptr, struct file *filp) 1738 { 1739 struct cdev_dev_s *dev = &g_eth_edmaprivate.cdev; 1740 > 1741 LOG(DLOG_DEBUG, "Open device."); 1742 1743 if (!inode_ptr || !filp) 1744 return -EFAULT; 1745 1746 /* only one instance is allowed. */ 1747 if (IS_CDEV_IN_OPEN_STATE()) 1748 return -EBUSY; 1749 1750 LOG(DLOG_DEBUG, "Init flag, rx: %d, tx:%d", 1751 g_eth_edmaprivate.prx_queue->pshmqhd_v->init, 1752 g_eth_edmaprivate.ptx_queue->pshmqhd_v->init); 1753 1754 /* save to private data. */ 1755 filp->private_data = dev; 1756 SET_CDEV_OPEN_STATE(CDEV_OPENED); 1757 g_read_pos = 0; 1758 1759 return 0; 1760 } 1761 1762 int cdev_release(struct inode *inode_ptr, struct file *filp) 1763 { 1764 LOG(DLOG_DEBUG, "Close device."); 1765 1766 if (!filp) 1767 return 0; 1768 1769 filp->private_data = NULL; 1770 1771 SET_CDEV_OPEN_STATE(CDEV_CLOSED); 1772 1773 return 0; 1774 } 1775 1776 unsigned int cdev_poll(struct file *filp, poll_table *wait) 1777 { 1778 unsigned int mask = 0; 1779 wait_queue_head_t *queue_head = NULL; 1780 1781 if (!filp) 1782 return 0; 1783 1784 edma_veth_dump(); 1785 1786 queue_head = (wait_queue_head_t *) 1787 bma_cdev_get_wait_queue(GET_PRIVATE_DATA(filp)); 1788 if (!queue_head) 1789 return 0; 1790 1791 /* check or add to wait queue. */ 1792 poll_wait(filp, queue_head, wait); 1793 1794 if (!edma_is_queue_ready(g_eth_edmaprivate.prx_queue)) 1795 return 0; 1796 1797 if (cdev_check_ring_recv() > 0) 1798 mask = (POLLIN | POLLRDNORM); 1799 1800 return mask; 1801 } 1802 1803 ssize_t cdev_read(struct file *filp, char __user *data, 1804 size_t count, loff_t *ppos) 1805 { 1806 struct edma_eth_dev_s *dev = &g_eth_edmaprivate; 1807 ssize_t length = 0; 1808 1809 if (!data || count >= MAX_PACKET_LEN) 1810 return -EFAULT; 1811 1812 LOG(DLOG_DEBUG, "read begin, count: %zu, pos: %u.", count, g_read_pos); 1813 1814 length = cdev_copy_packet_to_user(dev, data, count); 1815 > 1816 LOG(DLOG_DEBUG, "read done, length: %zd, pos: %u.", length, g_read_pos); 1817 1818 return length; 1819 } 1820 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] arm64: ptrace: fix partial SETREGSET for NT_ARM_TAGGED_ADDR_CTRL
by Yuntao Liu 22 Jan '25

22 Jan '25

From: Mark Rutland <mark.rutland(a)arm.com> stable inclusion from stable-v6.6.66 commit 96035c0093db258975b8887676afe59a64c34a72 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBJC6J CVE: CVE-2024-57874 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Currently tagged_addr_ctrl_set() doesn't initialize the temporary 'ctrl' variable, and a SETREGSET call with a length of zero will leave this uninitialized. Consequently tagged_addr_ctrl_set() will consume an arbitrary value, potentially leaking up to 64 bits of memory from the kernel stack. The read is limited to a specific slot on the stack, and the issue does not provide a write mechanism. As set_tagged_addr_ctrl() only accepts values where bits [63:4] zero and rejects other values, a partial SETREGSET attempt will randomly succeed or fail depending on the value of the uninitialized value, and the exposure is significantly limited. Fix this by initializing the temporary value before copying the regset from userspace, as for other regsets (e.g. NT_PRSTATUS, NT_PRFPREG, NT_ARM_SYSTEM_CALL). In the case of a zero-length write, the existing value of the tagged address ctrl will be retained. The NT_ARM_TAGGED_ADDR_CTRL regset is only visible in the user_aarch64_view used by a native AArch64 task to manipulate another native AArch64 task. As get_tagged_addr_ctrl() only returns an error value when called for a compat task, tagged_addr_ctrl_get() and tagged_addr_ctrl_set() should never observe an error value from get_tagged_addr_ctrl(). Add a WARN_ON_ONCE() to both to indicate that such an error would be unexpected, and error handlnig is not missing in either case. Fixes: 2200aa7154cb ("arm64: mte: ptrace: Add NT_ARM_TAGGED_ADDR_CTRL regset") Cc: <stable(a)vger.kernel.org> # 5.10.x Signed-off-by: Mark Rutland <mark.rutland(a)arm.com> Cc: Will Deacon <will(a)kernel.org> Reviewed-by: Mark Brown <broonie(a)kernel.org> Link: https://lore.kernel.org/r/20241205121655.1824269-2-mark.rutland@arm.com Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com> Signed-off-by: Yuntao Liu <liuyuntao12(a)huawei.com> --- arch/arm64/kernel/ptrace.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c index 28a5ddcf0a1e..d34b57caad49 100644 --- a/arch/arm64/kernel/ptrace.c +++ b/arch/arm64/kernel/ptrace.c @@ -1384,7 +1384,7 @@ static int tagged_addr_ctrl_get(struct task_struct *target, { long ctrl = get_tagged_addr_ctrl(target); - if (IS_ERR_VALUE(ctrl)) + if (WARN_ON_ONCE(IS_ERR_VALUE(ctrl))) return ctrl; return membuf_write(&to, &ctrl, sizeof(ctrl)); @@ -1398,6 +1398,10 @@ static int tagged_addr_ctrl_set(struct task_struct *target, const struct int ret; long ctrl; + ctrl = get_tagged_addr_ctrl(target); + if (WARN_ON_ONCE(IS_ERR_VALUE(ctrl))) + return ctrl; + ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &ctrl, 0, -1); if (ret) return ret; -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 1410/1410] arch/x86/entry/entry_64.o: warning: objtool: If this is a retpoline, please patch it in with alternatives and annotate it with ANNOTATE_NOSPEC_ALTERNATIVE.
by kernel test robot 22 Jan '25

22 Jan '25

Hi Peter, First bad commit (maybe != root cause): tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 4d48400e0254b5310842eb2ad33c6ccba43b0f1d commit: 3acbac72baea337e0ac79801a8ba4b81e3b67014 [1410/1410] x86/speculation: Change FILL_RETURN_BUFFER to work with objtool config: x86_64-randconfig-102-20250121 (https://download.01.org/0day-ci/archive/20250122/202501221629.J60ha3Fd-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250122/202501221629.J60ha3Fd-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501221629.J60ha3Fd-lkp@intel.com/ All warnings (new ones prefixed by >>): >> arch/x86/entry/entry_64.o: warning: objtool: .entry.text+0x1e2: unsupported intra-function call >> arch/x86/entry/entry_64.o: warning: objtool: If this is a retpoline, please patch it in with alternatives and annotate it with ANNOTATE_NOSPEC_ALTERNATIVE. -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1 0/2] Two CVE fixes for ksmbd
by Wang Zhaolong 22 Jan '25

22 Jan '25

Namjae Jeon (2): ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16() ksmbd: fix potencial out-of-bounds when buffer offset is invalid fs/ksmbd/smb2misc.c | 26 +++++++++++++++++------- fs/ksmbd/smb2pdu.c | 48 ++++++++++++++++++++++++--------------------- 2 files changed, 45 insertions(+), 29 deletions(-) -- 2.34.3

2 3

[PATCH V2 OLK-5.10 0/2] Two CVE fixes for ksmbd
by Wang Zhaolong 22 Jan '25

22 Jan '25

V1 -> V2: Adjusted code indentation. Namjae Jeon (2): ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16() ksmbd: fix potencial out-of-bounds when buffer offset is invalid fs/ksmbd/smb2misc.c | 26 +++++++++++++++++------- fs/ksmbd/smb2pdu.c | 48 ++++++++++++++++++++++++--------------------- 2 files changed, 45 insertions(+), 29 deletions(-) -- 2.34.3

2 3

[openeuler:OLK-6.6 1834/1834] drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_drive.c:41:30: sparse: sparse: symbol 'kbox_fops' was not declared. Should it be static?
by kernel test robot 22 Jan '25

22 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 75c81bcddd82381fbd4cef477a5b56eb2fe56697 commit: cd2978286f40089fcd83f74ffdff733bfbe1e52a [1834/1834] Huawei BMA: Adding Huawei BMA driver: host_kbox_drv config: x86_64-randconfig-121-20250122 (https://download.01.org/0day-ci/archive/20250122/202501221527.POAEXa7r-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250122/202501221527.POAEXa7r-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501221527.POAEXa7r-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_drive.c:41:30: sparse: sparse: symbol 'kbox_fops' was not declared. Should it be static? -- drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:51:28: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:42:6: sparse: sparse: symbol 'kbox_write_to_pci' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:120:27: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:111:6: sparse: sparse: symbol 'kbox_read_from_pci' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:179:28: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:172:6: sparse: sparse: symbol 'kbox_memset_pci' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:360:26: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected char *user_buf @@ got char [noderef] __user *data @@ drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:360:26: sparse: expected char *user_buf drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:360:26: sparse: got char [noderef] __user *data drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:395:34: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] __user *to @@ got char *user_buf @@ drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:395:34: sparse: expected void [noderef] __user *to drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:395:34: sparse: got char *user_buf >> drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:422:32: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected char const *user_buf @@ got char const [noderef] __user *data @@ drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:422:32: sparse: expected char const *user_buf drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:422:32: sparse: got char const [noderef] __user *data drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:453:51: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const [noderef] __user *from @@ got char const *user_buf @@ drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:453:51: sparse: expected void const [noderef] __user *from drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:453:51: sparse: got char const *user_buf vim +/kbox_fops +41 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_drive.c 40 > 41 const struct file_operations kbox_fops = { 42 .owner = THIS_MODULE, 43 .read = kbox_read, 44 .write = kbox_write, 45 .unlocked_ioctl = kbox_ioctl, 46 .mmap = kbox_mmap, 47 .open = kbox_open, 48 .release = kbox_release, 49 }; 50 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0