- Kernel - mailweb.openeuler.org

[PATCH v7 OLK-5.10 0/3] arm64: support page mapping percpu first chunk allocator
by Kaixiong Yu 13 Nov '24

13 Nov '24

Percpu embedded first chunk allocator is the firstly option, but it could fails on ARM64 when turning on numa with CONFIG_KASAN=y. Let's implement page mapping percpu first chunk allocator as a fallback to the embedding allocator to increase the robustness of the system. Also fix a crash when both NEED_PER_CPU_PAGE_FIRST_CHUNK and KASAN_VMALLOC enabled. After merging this patch set, the ARM64 machine can start and work normally. Kefeng Wang (3): vmalloc: choose a better start address in vm_area_register_early() arm64: support page mapping percpu first chunk allocator kasan: arm64: fix pcpu_page_first_chunk crash with KASAN_VMALLOC arch/arm64/Kconfig | 4 ++ arch/arm64/mm/kasan_init.c | 16 ++++++++ arch/arm64/mm/numa.c | 84 +++++++++++++++++++++++++++++++++----- include/linux/kasan.h | 10 ++++- mm/kasan/common.c | 5 +++ mm/vmalloc.c | 19 ++++++--- 6 files changed, 120 insertions(+), 18 deletions(-) -- 2.34.1

2 4

[PATCH OLK-6.6 0/6] Script execution control
by Gu Bowen 13 Nov '24

13 Nov '24

Ensure that direct file execution (e.g. ./script.sh) and indirect file execution (e.g. sh script.sh) lead to the same result to support script protection. Gu Bowen (2): IMA support script execution check fix kabi breakage due to exec is_check Kees Cook (1): exec: Check __FMODE_EXEC instead of in_execve for LSMs Linus Torvalds (2): execve: open the executable file before doing anything else uselib: remove use of __FMODE_EXEC Mickaël Salaün (1): exec: Add a new AT_CHECK flag to execveat(2) V2: Add a new patch to fix kabi breakage. Align with the original variables to prevent others from inserting new variables before is_check in the future. V3: Add a mainline patch to fix commit 4759ff71f23e(exec: __FMODE_EXEC instead of in_execve for LSMs). V4: Since openEuler has a more standardised way of using KABI_FILL_HOLE to fix kabi breakage, replace it. fs/exec.c | 89 ++++++++++++++++++------------- include/linux/binfmts.h | 5 ++ include/linux/ima.h | 1 + include/uapi/linux/fcntl.h | 31 +++++++++++ kernel/audit.h | 1 + kernel/auditsc.c | 1 + security/apparmor/lsm.c | 4 +- security/integrity/ima/ima_main.c | 11 ++++ security/security.c | 17 +++++- security/tomoyo/tomoyo.c | 3 +- 10 files changed, 123 insertions(+), 40 deletions(-) -- 2.25.1

2 7

[PATCH openEuler-1.0-LTS 0/1] fix CVE-2024-50115
by Liao Chen 13 Nov '24

13 Nov '24

fix CVE-2024-50115 Sean Christopherson (1): KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory arch/x86/kvm/svm.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH OLK-6.6 0/2] CVE-2024-5012{4,5}
by GONG Ruiqi 13 Nov '24

13 Nov '24

Luiz Augusto von Dentz (2): Bluetooth: SCO: Fix UAF on sco_sock_timeout Bluetooth: ISO: Fix UAF on iso_sock_timeout include/net/bluetooth/bluetooth.h | 1 + net/bluetooth/af_bluetooth.c | 22 ++++++++++++++++++++++ net/bluetooth/iso.c | 18 ++++++++++++------ net/bluetooth/sco.c | 18 ++++++++++++------ 4 files changed, 47 insertions(+), 12 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS] irqchip/i8259: Fix shutdown order by moving syscore_ops registration
by Zhang Kunbo 13 Nov '24

13 Nov '24

From: Aaro Koskinen <aaro.koskinen(a)iki.fi> mainline inclusion from mainline-v5.1-rc1 commit 518bfe84ec417318b2470652cdb27978ddfeaa59 category: bugfix bugzilla: 190379 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When using cpufreq on Loongson 2F MIPS platform, "poweroff" command gets frequently stuck in syscore_shutdown(). The reason is that i8259A_shutdown() gets called before cpufreq_suspend(), and if we have pending work then irq_work_sync() in cpufreq_dbs_governor_stop() gets stuck forever as we have all interrupts masked already. irq-i8259 is registering syscore_ops using device_initcall(), while cpufreq uses core_initcall(). Fix the shutdown order simply by registering the irq syscore_ops during the early IRQ init instead of using a separate initcall at later stage. Signed-off-by: Aaro Koskinen <aaro.koskinen(a)iki.fi> Signed-off-by: Marc Zyngier <marc.zyngier(a)arm.com> Signed-off-by: Zhang Kunbo <zhangkunbo(a)huawei.com> --- drivers/irqchip/irq-i8259.c | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) diff --git a/drivers/irqchip/irq-i8259.c b/drivers/irqchip/irq-i8259.c index b0d4aab1a58c..d000870d9b6b 100644 --- a/drivers/irqchip/irq-i8259.c +++ b/drivers/irqchip/irq-i8259.c @@ -225,14 +225,6 @@ static struct syscore_ops i8259_syscore_ops = { .shutdown = i8259A_shutdown, }; -static int __init i8259A_init_sysfs(void) -{ - register_syscore_ops(&i8259_syscore_ops); - return 0; -} - -device_initcall(i8259A_init_sysfs); - static void init_8259A(int auto_eoi) { unsigned long flags; @@ -332,6 +324,7 @@ struct irq_domain * __init __init_i8259_irqs(struct device_node *node) panic("Failed to add i8259 IRQ domain"); setup_irq(I8259A_IRQ_BASE + PIC_CASCADE_IR, &irq2); + register_syscore_ops(&i8259_syscore_ops); return domain; } -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 1291/1291] kernel/sched/core.c:5976:2: error: implicit declaration of function 'init_auto_affinity'
by kernel test robot 13 Nov '24

13 Nov '24

Hi Hui, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 58ec866c31299a4b0d63a01cb026877c5f85e4d9 commit: 713cfd2684fa5ea08b144d92b9858b932c0f1705 [1291/1291] sched: Introduce smart grid scheduling strategy for cfs config: x86_64-buildonly-randconfig-002-20241113 (https://download.01.org/0day-ci/archive/20241113/202411131145.yjptmRWX-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241113/202411131145.yjptmRWX-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411131145.yjptmRWX-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from kernel/sched/core.c:8: In file included from kernel/sched/sched.h:52: In file included from include/linux/migrate.h:6: In file included from include/linux/mempolicy.h:16: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from kernel/sched/core.c:8: kernel/sched/sched.h:1249:15: warning: cast from 'void (*)(struct rq *)' to 'void (*)(struct callback_head *)' converts to incompatible function type [-Wcast-function-type-strict] 1249 | head->func = (void (*)(struct callback_head *))func; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/core.c:1587:6: warning: no previous prototype for function 'sched_set_stop_task' [-Wmissing-prototypes] 1587 | void sched_set_stop_task(int cpu, struct task_struct *stop) | ^ kernel/sched/core.c:1587:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 1587 | void sched_set_stop_task(int cpu, struct task_struct *stop) | ^ | static kernel/sched/core.c:2741:10: warning: cast from 'void (*)(struct callback_head *)' to 'void (*)(struct rq *)' converts to incompatible function type [-Wcast-function-type-strict] 2741 | func = (void (*)(struct rq *))head->func; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ kernel/sched/core.c:3632:35: warning: no previous prototype for function 'schedule_user' [-Wmissing-prototypes] 3632 | asmlinkage __visible void __sched schedule_user(void) | ^ kernel/sched/core.c:3632:22: note: declare 'static' if the function is not intended to be used outside of this translation unit 3632 | asmlinkage __visible void __sched schedule_user(void) | ^ | static kernel/sched/core.c:3771:35: warning: no previous prototype for function 'preempt_schedule_irq' [-Wmissing-prototypes] 3771 | asmlinkage __visible void __sched preempt_schedule_irq(void) | ^ kernel/sched/core.c:3771:22: note: declare 'static' if the function is not intended to be used outside of this translation unit 3771 | asmlinkage __visible void __sched preempt_schedule_irq(void) | ^ | static kernel/sched/core.c:5845:2: error: implicit declaration of function 'tg_update_affinity_domains' [-Werror,-Wimplicit-function-declaration] 5845 | tg_update_affinity_domains(cpu, 1); | ^ kernel/sched/core.c:5904:2: error: implicit declaration of function 'tg_update_affinity_domains' [-Werror,-Wimplicit-function-declaration] 5904 | tg_update_affinity_domains(cpu, 0); | ^ >> kernel/sched/core.c:5976:2: error: implicit declaration of function 'init_auto_affinity' [-Werror,-Wimplicit-function-declaration] 5976 | init_auto_affinity(&root_task_group); | ^ kernel/sched/core.c:5976:2: note: did you mean 'irq_set_affinity'? include/linux/interrupt.h:292:1: note: 'irq_set_affinity' declared here 292 | irq_set_affinity(unsigned int irq, const struct cpumask *cpumask) | ^ kernel/sched/core.c:5976:22: error: use of undeclared identifier 'root_task_group'; did you mean 'task_group'? 5976 | init_auto_affinity(&root_task_group); | ^~~~~~~~~~~~~~~ | task_group kernel/sched/sched.h:1444:34: note: 'task_group' declared here 1444 | static inline struct task_group *task_group(struct task_struct *p) | ^ kernel/sched/core.c:6029:32: warning: variable 'ptr' set but not used [-Wunused-but-set-variable] 6029 | unsigned long alloc_size = 0, ptr; | ^ 7 warnings and 4 errors generated. vim +/init_auto_affinity +5976 kernel/sched/core.c 5949 5950 void __init sched_init_smp(void) 5951 { 5952 sched_init_numa(); 5953 5954 /* 5955 * There's no userspace yet to cause hotplug operations; hence all the 5956 * CPU masks are stable and all blatant races in the below code cannot 5957 * happen. The hotplug lock is nevertheless taken to satisfy lockdep, 5958 * but there won't be any contention on it. 5959 */ 5960 cpus_read_lock(); 5961 mutex_lock(&sched_domains_mutex); 5962 sched_init_domains(cpu_active_mask); 5963 mutex_unlock(&sched_domains_mutex); 5964 cpus_read_unlock(); 5965 5966 /* Move init over to a non-isolated CPU */ 5967 if (set_cpus_allowed_ptr(current, housekeeping_cpumask(HK_FLAG_DOMAIN)) < 0) 5968 BUG(); 5969 sched_init_granularity(); 5970 5971 init_sched_rt_class(); 5972 init_sched_dl_class(); 5973 5974 sched_smp_initialized = true; 5975 > 5976 init_auto_affinity(&root_task_group); 5977 } 5978 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/6] Script execution control
by Gu Bowen 13 Nov '24

13 Nov '24

Ensure that direct file execution (e.g. ./script.sh) and indirect file execution (e.g. sh script.sh) lead to the same result to support script protection. Gu Bowen (2): IMA support script execution check fix kabi breakage due to exec is_check Kees Cook (1): exec: Check __FMODE_EXEC instead of in_execve for LSMs Linus Torvalds (2): execve: open the executable file before doing anything else uselib: remove use of __FMODE_EXEC Mickaël Salaün (1): exec: Add a new AT_CHECK flag to execveat(2) V2: Add a new patch to fix kabi breakage. Align with the original variables to prevent others from inserting new variables before is_check in the future. V3: Add a mainline patch to fix commit 4759ff71f23e(exec: __FMODE_EXEC instead of in_execve for LSMs). V4: Since openEuler has a more standardised way of using KABI_FILL_HOLE to fix kabi breakage, replace it. fs/exec.c | 89 ++++++++++++++++++------------- include/linux/binfmts.h | 5 ++ include/linux/ima.h | 1 + include/uapi/linux/fcntl.h | 31 +++++++++++ kernel/audit.h | 1 + kernel/auditsc.c | 1 + security/apparmor/lsm.c | 4 +- security/integrity/ima/ima_main.c | 11 ++++ security/security.c | 17 +++++- security/tomoyo/tomoyo.c | 3 +- 10 files changed, 123 insertions(+), 40 deletions(-) -- 2.25.1

2 7

[openeuler:openEuler-1.0-LTS] BUILD REGRESSION 58ec866c31299a4b0d63a01cb026877c5f85e4d9
by kernel test robot 13 Nov '24

13 Nov '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 58ec866c31299a4b0d63a01cb026877c5f85e4d9 !13165 security/keys: fix slab-out-of-bounds in key_task_permission Error/Warning (recently discovered and may have been fixed): https://lore.kernel.org/oe-kbuild-all/202411130037.24hgbc37-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202411130527.FCTcx7wa-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202411130708.2IT5fUX3-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202411130719.5GGQe3oi-lkp@intel.com arch/arm64/mm/init.c:784:17: error: 'mem_sleep_current' undeclared (first use in this function) arch/arm64/mm/init.c:790:17: error: 'pmu_nmi_enable' undeclared (first use in this function); did you mean 'perf_pmu_enable'? drivers/iommu/arm-smmu-v3.c:2896:41: error: 'pci_bus_type' undeclared (first use in this function); did you mean 'pci_pcie_type'? include/linux/uaccess.h:112:17: warning: 'gup' may be used uninitialized [-Wmaybe-uninitialized] mm/mem_reliable.c:41:22: warning: 'zero' defined but not used [-Wunused-variable] Unverified Error/Warning (likely false positive, kindly check if interested): drivers/tty/tty_buffer.c:170:9: error: implicit declaration of function 'printk_safe_enter'; did you mean 'printk_nmi_enter'? [-Werror=implicit-function-declaration] Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- arm64-allnoconfig | `-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains |-- arm64-randconfig-001-20241112 | `-- drivers-iommu-arm-smmu-v3.c:error:pci_bus_type-undeclared-(first-use-in-this-function) |-- arm64-randconfig-001-20241113 | |-- fs-ext4-inode.c:warning:unused-variable-sbi | `-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains |-- arm64-randconfig-002-20241113 | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | |-- fs-ext4-inode.c:warning:unused-variable-sbi | `-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains |-- arm64-randconfig-003-20241112 | |-- arch-arm64-mm-init.c:error:mem_sleep_current-undeclared-(first-use-in-this-function) | `-- arch-arm64-mm-init.c:error:pmu_nmi_enable-undeclared-(first-use-in-this-function) |-- arm64-randconfig-003-20241113 | |-- arch-arm64-mm-init.c:error:pmu_nmi_enable-undeclared-(first-use-in-this-function) | |-- drivers-tty-tty_buffer.c:error:implicit-declaration-of-function-printk_safe_enter | |-- drivers-tty-tty_buffer.c:error:implicit-declaration-of-function-printk_safe_exit | |-- fs-ext4-inode.c:warning:unused-variable-sbi | `-- mm-mem_reliable.c:warning:zero-defined-but-not-used |-- arm64-randconfig-004-20241113 | |-- arch-arm64-include-asm-irqflags.h:warning:flags-may-be-used-uninitialized | |-- drivers-mailbox-phytium_mailbox.c:warning:phytium_mbox_acpi_match-defined-but-not-used | |-- drivers-mfd-cros_ec_dev.c:warning:cros_ec_id-defined-but-not-used | |-- include-linux-uaccess.h:warning:aen-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:args32-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:ciov-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:ctl-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:data32-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:dd-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:f-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:gup-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:ioctl_header-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:karg-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:karg32-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:ol_create-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:ol_viewport_set-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:packet_size_peek-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:qd-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:rdwr_arg-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:rq-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:u_cmd-may-be-used-uninitialized | |-- include-linux-uaccess.h:warning:user_desc-may-be-used-uninitialized | `-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains |-- arm64-randconfig-r063-20241113 | |-- arch-arm64-kernel-acpi.c:warning:no-previous-prototype-for-acpi_map_cpu | |-- arch-arm64-kernel-acpi.c:warning:no-previous-prototype-for-acpi_unmap_cpu | |-- drivers-iommu-arm-smmu-v3.c:error:CONFIG_CMA_ALIGNMENT-undeclared-(first-use-in-this-function) | |-- drivers-misc-uacce-uacce.c:error:implicit-declaration-of-function-module_refcount | |-- fs-ext4-inode.c:warning:unused-variable-sbi | `-- include-linux-kernel.h:error:first-argument-to-__builtin_choose_expr-not-a-constant |-- x86_64-allyesconfig | |-- drivers-net-ethernet-stmicro-stmmac-dwmac-phytium.c:error:incompatible-pointer-to-integer-conversion-returning-void-from-a-function-with-result-type-int | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-buildonly-randconfig-001-20241113 | |-- crypto-.tmp_sm4_generic.o:warning:objtool:missing-symbol-for-section-.text | |-- drivers-char-ipmi-.tmp_ipmi_poweroff.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- drivers-gpu-drm-vkms-.tmp_vkms_drv.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-iio-chemical-.tmp_bme680_i2c.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-iio-dac-.tmp_ad5696-i2c.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-iio-light-.tmp_si1133.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-iio-light-.tmp_tsl2772.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-iio-proximity-.tmp_isl29501.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-pinctrl-cirrus-.tmp_pinctrl-madera-core.o:warning:objtool:missing-symbol-for-section-.init.text | |-- drivers-regulator-.tmp_sy8106a-regulator.o:warning:objtool:missing-symbol-for-section-.init.text | |-- fs-ext4-inode.c:warning:unused-variable-sbi | |-- fs-fscache-.tmp_stats.o:warning:objtool:missing-symbol-for-section-.text | |-- fs-jfs-.tmp_super.o:warning:objtool:missing-symbol-for-section-.exit.text | |-- kernel-dma-.tmp_contiguous.o:warning:objtool:missing-symbol-for-section-.text | |-- lib-zstd-.tmp_decompress.o:warning:objtool:missing-symbol-for-section-.text | |-- lib-zstd-.tmp_fse_compress.o:warning:objtool:missing-symbol-for-section-.text | |-- lib-zstd-.tmp_huf_compress.o:warning:objtool:missing-symbol-for-section-.text | |-- lib-zstd-.tmp_huf_decompress.o:warning:objtool:missing-symbol-for-section-.text | `-- net-can-j1939-.tmp_main.o:warning:objtool:missing-symbol-for-section-.init.text |-- x86_64-buildonly-randconfig-003-20241113 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-defconfig | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-kexec | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-randconfig-003-20241113 | |-- fs-ext4-inode.c:warning:unused-variable-sbi | `-- kernel-uid16.o:warning:objtool:__x64_sys_getuid16cold():unreachable-instruction |-- x86_64-randconfig-101-20241113 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-rhel-8.3 | `-- fs-ext4-inode.c:warning:unused-variable-sbi |-- x86_64-rhel-8.3-func | `-- fs-ext4-inode.c:warning:unused-variable-sbi `-- x86_64-rhel-8.3-kselftests `-- fs-ext4-inode.c:warning:unused-variable-sbi elapsed time: 729m configs tested: 19 configs skipped: 139 tested configs: arm64 allmodconfig gcc-14.2.0 arm64 allnoconfig gcc-14.2.0 arm64 randconfig-001-20241113 gcc-14.2.0 arm64 randconfig-002-20241113 gcc-14.2.0 arm64 randconfig-003-20241113 gcc-14.2.0 arm64 randconfig-004-20241113 gcc-14.2.0 x86_64 allnoconfig clang-19 x86_64 allyesconfig clang-19 x86_64 buildonly-randconfig-001-20241113 clang-19 x86_64 buildonly-randconfig-002-20241113 clang-19 x86_64 buildonly-randconfig-003-20241113 clang-19 x86_64 buildonly-randconfig-004-20241113 clang-19 x86_64 buildonly-randconfig-005-20241113 clang-19 x86_64 buildonly-randconfig-006-20241113 clang-19 x86_64 defconfig gcc-11 x86_64 kexec clang-19 x86_64 randconfig-001-20241113 gcc-12 x86_64 randconfig-003-20241113 gcc-12 x86_64 rhel-8.3 gcc-12 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] iio: light: veml6030: fix IIO device retrieval from embedded device
by Luo Gengkun 13 Nov '24

13 Nov '24

From: Javier Carrasco <javier.carrasco.cruz(a)gmail.com> stable inclusion from stable-v5.10.228 commit bf3ab8e1c28f10df0823d4ff312f83c952b06a15 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2YWA CVE: CVE-2024-50198 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c7c44e57750c31de43906d97813273fdffcf7d02 upstream. The dev pointer that is received as an argument in the in_illuminance_period_available_show function references the device embedded in the IIO device, not in the i2c client. dev_to_iio_dev() must be used to accessthe right data. The current implementation leads to a segmentation fault on every attempt to read the attribute because indio_dev gets a NULL assignment. This bug has been present since the first appearance of the driver, apparently since the last version (V6) before getting applied. A constant attribute was used until then, and the last modifications might have not been tested again. Cc: stable(a)vger.kernel.org Fixes: 7b779f573c48 ("iio: light: add driver for veml6030 ambient light sensor") Signed-off-by: Javier Carrasco <javier.carrasco.cruz(a)gmail.com> Link: https://patch.msgid.link/20240913-veml6035-v1-3-0b09c0c90418@gmail.com Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- drivers/iio/light/veml6030.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/iio/light/veml6030.c b/drivers/iio/light/veml6030.c index de85c9b30be1..c13626548003 100644 --- a/drivers/iio/light/veml6030.c +++ b/drivers/iio/light/veml6030.c @@ -99,9 +99,8 @@ static const char * const period_values[] = { static ssize_t in_illuminance_period_available_show(struct device *dev, struct device_attribute *attr, char *buf) { + struct veml6030_data *data = iio_priv(dev_to_iio_dev(dev)); int ret, reg, x; - struct iio_dev *indio_dev = i2c_get_clientdata(to_i2c_client(dev)); - struct veml6030_data *data = iio_priv(indio_dev); ret = regmap_read(data->regmap, VEML6030_REG_ALS_CONF, &reg); if (ret) { -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] iio: light: veml6030: fix IIO device retrieval from embedded device
by Luo Gengkun 13 Nov '24

13 Nov '24

From: Javier Carrasco <javier.carrasco.cruz(a)gmail.com> stable inclusion from stable-v5.10.228 commit bf3ab8e1c28f10df0823d4ff312f83c952b06a15 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2YWA CVE: CVE-2024-50198 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit c7c44e57750c31de43906d97813273fdffcf7d02 upstream. The dev pointer that is received as an argument in the in_illuminance_period_available_show function references the device embedded in the IIO device, not in the i2c client. dev_to_iio_dev() must be used to accessthe right data. The current implementation leads to a segmentation fault on every attempt to read the attribute because indio_dev gets a NULL assignment. This bug has been present since the first appearance of the driver, apparently since the last version (V6) before getting applied. A constant attribute was used until then, and the last modifications might have not been tested again. Cc: stable(a)vger.kernel.org Fixes: 7b779f573c48 ("iio: light: add driver for veml6030 ambient light sensor") Signed-off-by: Javier Carrasco <javier.carrasco.cruz(a)gmail.com> Link: https://patch.msgid.link/20240913-veml6035-v1-3-0b09c0c90418@gmail.com Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- drivers/iio/light/veml6030.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/iio/light/veml6030.c b/drivers/iio/light/veml6030.c index de85c9b30be1..c13626548003 100644 --- a/drivers/iio/light/veml6030.c +++ b/drivers/iio/light/veml6030.c @@ -99,9 +99,8 @@ static const char * const period_values[] = { static ssize_t in_illuminance_period_available_show(struct device *dev, struct device_attribute *attr, char *buf) { + struct veml6030_data *data = iio_priv(dev_to_iio_dev(dev)); int ret, reg, x; - struct iio_dev *indio_dev = i2c_get_clientdata(to_i2c_client(dev)); - struct veml6030_data *data = iio_priv(indio_dev); ret = regmap_read(data->regmap, VEML6030_REG_ALS_CONF, &reg); if (ret) { -- 2.34.1

2 1