- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS v2] HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup
by Yipeng Zou 23 Sep '24

23 Sep '24

From: Camila Alvarez <cam.alvarez.i(a)gmail.com> stable inclusion from stable-v6.11-rc5 commit a6e9c391d45b5865b61e569146304cff72821a5d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWXF CVE: CVE-2024-46747 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- report_fixup for the Cougar 500k Gaming Keyboard was not verifying that the report descriptor size was correct before accessing it Reported-by: syzbot+24c0361074799d02c452(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=24c0361074799d02c452 Signed-off-by: Camila Alvarez <cam.alvarez.i(a)gmail.com> Reviewed-by: Silvan Jegen <s.jegen(a)gmail.com> Signed-off-by: Jiri Kosina <jkosina(a)suse.com> Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- drivers/hid/hid-cougar.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/hid/hid-cougar.c b/drivers/hid/hid-cougar.c index ad2e87de7dc5..d58a108a96c0 100644 --- a/drivers/hid/hid-cougar.c +++ b/drivers/hid/hid-cougar.c @@ -104,7 +104,7 @@ static void cougar_fix_g6_mapping(struct hid_device *hdev) static __u8 *cougar_report_fixup(struct hid_device *hdev, __u8 *rdesc, unsigned int *rsize) { - if (rdesc[2] == 0x09 && rdesc[3] == 0x02 && + if (*rsize >= 117 && rdesc[2] == 0x09 && rdesc[3] == 0x02 && (rdesc[115] | rdesc[116] << 8) >= HID_MAX_USAGES) { hid_info(hdev, "usage count exceeds max: fixing up report descriptor\n"); -- 2.34.1

2 1

[PATCH] drm/amd/pm: fix the Out-of-bounds read warning
by Huang Xiaojia 23 Sep '24

23 Sep '24

From: Jesse Zhang <jesse.zhang(a)amd.com> stable inclusion from stable-v6.6.50 commit f1e261ced9bcad772a45a2fcdf413c3490e87299 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARV5V CVE: CVE-2024-46731 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 12c6967428a099bbba9dfd247bb4322a984fcc0b ] using index i - 1U may beyond element index for mc_data[] when i = 0. Signed-off-by: Jesse Zhang <Jesse.Zhang(a)amd.com> Reviewed-by: Tim Huang <Tim.Huang(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c index f503e61faa60..cc3b62f73394 100644 --- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c +++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c @@ -73,8 +73,9 @@ static int atomctrl_retrieve_ac_timing( j++; } else if ((table->mc_reg_address[i].uc_pre_reg_data & LOW_NIBBLE_MASK) == DATA_EQU_PREV) { - table->mc_reg_table_entry[num_ranges].mc_data[i] = - table->mc_reg_table_entry[num_ranges].mc_data[i-1]; + if (i) + table->mc_reg_table_entry[num_ranges].mc_data[i] = + table->mc_reg_table_entry[num_ranges].mc_data[i-1]; } } num_ranges++; -- 2.34.1

1 0

[PATCH OLK-6.6] drm/amd/pm: fix the Out-of-bounds read warning
by Huang Xiaojia 23 Sep '24

23 Sep '24

From: Jesse Zhang <jesse.zhang(a)amd.com> stable inclusion from stable-v6.6.50 commit f1e261ced9bcad772a45a2fcdf413c3490e87299 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARV5V CVE: CVE-2024-46731 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 12c6967428a099bbba9dfd247bb4322a984fcc0b ] using index i - 1U may beyond element index for mc_data[] when i = 0. Signed-off-by: Jesse Zhang <Jesse.Zhang(a)amd.com> Reviewed-by: Tim Huang <Tim.Huang(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c index f503e61faa60..cc3b62f73394 100644 --- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c +++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c @@ -73,8 +73,9 @@ static int atomctrl_retrieve_ac_timing( j++; } else if ((table->mc_reg_address[i].uc_pre_reg_data & LOW_NIBBLE_MASK) == DATA_EQU_PREV) { - table->mc_reg_table_entry[num_ranges].mc_data[i] = - table->mc_reg_table_entry[num_ranges].mc_data[i-1]; + if (i) + table->mc_reg_table_entry[num_ranges].mc_data[i] = + table->mc_reg_table_entry[num_ranges].mc_data[i-1]; } } num_ranges++; -- 2.34.1

2 1

[PATCH OLK-5.10] drm/amd/pm: fix the Out-of-bounds read warning
by Huang Xiaojia 23 Sep '24

23 Sep '24

From: Jesse Zhang <jesse.zhang(a)amd.com> stable inclusion from stable-v5.10.226 commit 38e32a0d837443c91c4b615a067b976cfb925376 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARV5V CVE: CVE-2024-46731 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 12c6967428a099bbba9dfd247bb4322a984fcc0b ] using index i - 1U may beyond element index for mc_data[] when i = 0. Signed-off-by: Jesse Zhang <Jesse.Zhang(a)amd.com> Reviewed-by: Tim Huang <Tim.Huang(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Huang Xiaojia <huangxiaojia2(a)huawei.com> --- drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c index 01dc46dc9c8a..165af862d054 100644 --- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c +++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c @@ -73,8 +73,9 @@ static int atomctrl_retrieve_ac_timing( j++; } else if ((table->mc_reg_address[i].uc_pre_reg_data & LOW_NIBBLE_MASK) == DATA_EQU_PREV) { - table->mc_reg_table_entry[num_ranges].mc_data[i] = - table->mc_reg_table_entry[num_ranges].mc_data[i-1]; + if (i) + table->mc_reg_table_entry[num_ranges].mc_data[i] = + table->mc_reg_table_entry[num_ranges].mc_data[i-1]; } } num_ranges++; -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] drm/amd/pm: fix the Out-of-bounds read warning
by Huang Xiaojia 23 Sep '24

23 Sep '24

From: Jesse Zhang <jesse.zhang(a)amd.com> stable inclusion from stable-v5.10.226 commit 38e32a0d837443c91c4b615a067b976cfb925376 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARV5V CVE: CVE-2024-46731 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 12c6967428a099bbba9dfd247bb4322a984fcc0b ] using index i - 1U may beyond element index for mc_data[] when i = 0. Signed-off-by: Jesse Zhang <Jesse.Zhang(a)amd.com> Reviewed-by: Tim Huang <Tim.Huang(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Huang Xiaojia <huangxiaojia2(a)huawei.com> --- drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c index 01dc46dc9c8a..165af862d054 100644 --- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c +++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c @@ -73,8 +73,9 @@ static int atomctrl_retrieve_ac_timing( j++; } else if ((table->mc_reg_address[i].uc_pre_reg_data & LOW_NIBBLE_MASK) == DATA_EQU_PREV) { - table->mc_reg_table_entry[num_ranges].mc_data[i] = - table->mc_reg_table_entry[num_ranges].mc_data[i-1]; + if (i) + table->mc_reg_table_entry[num_ranges].mc_data[i] = + table->mc_reg_table_entry[num_ranges].mc_data[i-1]; } } num_ranges++; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] drm/amd/pm: fix the Out-of-bounds read warning
by Huang Xiaojia 23 Sep '24

23 Sep '24

From: Jesse Zhang <jesse.zhang(a)amd.com> stable inclusion from stable-v5.10.226 commit 38e32a0d837443c91c4b615a067b976cfb925376 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARV5V CVE: CVE-2024-46731 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 12c6967428a099bbba9dfd247bb4322a984fcc0b ] using index i - 1U may beyond element index for mc_data[] when i = 0. Signed-off-by: Jesse Zhang <Jesse.Zhang(a)amd.com> Reviewed-by: Tim Huang <Tim.Huang(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/gpu/drm/amd/pm/powerplay/hwmgr/ppatomctrl.c [Adapt conflicts due to directory change] Signed-off-by: Huang Xiaojia <huangxiaojia2(a)huawei.com> --- drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.c b/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.c index 01dc46dc9c8a..165af862d054 100644 --- a/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.c +++ b/drivers/gpu/drm/amd/powerplay/hwmgr/ppatomctrl.c @@ -73,8 +73,9 @@ static int atomctrl_retrieve_ac_timing( j++; } else if ((table->mc_reg_address[i].uc_pre_reg_data & LOW_NIBBLE_MASK) == DATA_EQU_PREV) { - table->mc_reg_table_entry[num_ranges].mc_data[i] = - table->mc_reg_table_entry[num_ranges].mc_data[i-1]; + if (i) + table->mc_reg_table_entry[num_ranges].mc_data[i] = + table->mc_reg_table_entry[num_ranges].mc_data[i-1]; } } num_ranges++; -- 2.34.1

2 1

[PATCH OLK-5.10 0/9] xfs: some fix for forcealign
by Long Li 23 Sep '24

23 Sep '24

This patch set fix some bug for forcealign: patch 1 ~ 4 : fix tail alignment issue while approach to no space. patch 5 : fix file offset not align due to revert allocated offset while bmap alloc. patch 6 ~ 8 : fix expose stale data issue while truance down file. patch 9 : fix forcealign not compatible with reflink and realtime. Dave Chinner (3): xfs: only allow minlen allocations when near ENOSPC xfs: always tail align maxlen allocations xfs: align args->minlen for forced allocation alignment John Garry (2): xfs: Don't revert allocated offset for forcealign Long Li (3): xfs: set minlen to align for forcealign xfs: correct the truncate blocksize of forcealign xfs: forcealign not compatible with reflink and realtime device Zhang Yi (2): math64: add rem_u64() to just return the remainder iomap: pass blocksize to iomap_truncate_page() fs/iomap/buffered-io.c | 8 ++++---- fs/xfs/libxfs/xfs_alloc.c | 31 ++++++++++++++++++----------- fs/xfs/libxfs/xfs_bmap.c | 42 +++++++++++++++++++++++++++++---------- fs/xfs/xfs_iops.c | 10 ++++++++-- fs/xfs/xfs_super.c | 19 +++++++++++++++++- include/linux/iomap.h | 4 ++-- include/linux/math64.h | 24 ++++++++++++++++++++++ 7 files changed, 106 insertions(+), 32 deletions(-) -- 2.39.2

4 15

[PATCH OLK-6.6 0/1] cgroup-psi-add-PSI_STATE_LAST-for-kabi-reserve
by Chen Ridong 23 Sep '24

23 Sep '24

*** BLURB HERE *** Chen Ridong (1): cgroup/psi: add PSI_STATE_LAST for kabi reserve include/linux/psi_types.h | 5 ++++- kernel/sched/psi.c | 14 +++++++------- 2 files changed, 11 insertions(+), 8 deletions(-) -- 2.34.1

2 2

[PATCH OLK-6.6 1/1] cgroup/psi: add PSI_STATE_LAST for kabi reserve
by Chen Ridong 23 Sep '24

23 Sep '24

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IARWZ2 -------------------------------- Adding KABI_RESERVE for psi_stat_states results in redundant information being shown when running cat pressure.stat. Therefore, add PSI_STATE_LAST to maintain an unchanged KABI and eliminate the invalid information displayed in pressure.stat. Fixes: cbd277b915b9 ("cgroup/psi: reserve kabi for future psi development") Signed-off-by: Chen Ridong <chenridong(a)huawei.com> --- include/linux/psi_types.h | 5 ++++- kernel/sched/psi.c | 14 +++++++------- 2 files changed, 11 insertions(+), 8 deletions(-) diff --git a/include/linux/psi_types.h b/include/linux/psi_types.h index 1c5bca4e48ed..b224a89c293e 100644 --- a/include/linux/psi_types.h +++ b/include/linux/psi_types.h @@ -100,12 +100,15 @@ enum psi_stat_states { #ifdef CONFIG_QOS_SCHED PSI_CPU_QOS_FULL, #endif + /* reserve for KABI start */ + PSI_STATE_LAST, PSI_STATE_RESERVE1, PSI_STATE_RESERVE2, PSI_STATE_RESERVE3, PSI_STATE_RESERVE4, PSI_STATE_RESERVE5, - PSI_STATE_RESERVE6, + /* reserve for KABI end */ + NR_PSI_STAT_STATES, }; diff --git a/kernel/sched/psi.c b/kernel/sched/psi.c index c66f64ab9f4e..9f68756a3baf 100644 --- a/kernel/sched/psi.c +++ b/kernel/sched/psi.c @@ -470,12 +470,12 @@ static void get_recent_stat_times(struct psi_group *group, int cpu, enum psi_aggregators aggregator, u64 *stat_delta, u64 nonidle) { struct psi_group_cpu *groupc = per_cpu_ptr(group->pcpu, cpu); - u32 times[NR_PSI_STAT_STATES] = {0}; + u32 times[PSI_STATE_LAST] = {0}; enum psi_stat_states s; u32 delta; - memcpy(times, groupc->fine_grained_times, sizeof(groupc->fine_grained_times)); - for (s = 0; s < NR_PSI_STAT_STATES; s++) { + for (s = 0; s < PSI_STATE_LAST; s++) { + times[s] = groupc->fine_grained_times[s]; if (groupc->fine_grained_state_mask & (1 << s)) times[s] += groupc->fine_grained_times_delta; delta = times[s] - groupc->fine_grained_times_prev[aggregator][s]; @@ -522,7 +522,7 @@ static void collect_percpu_times(struct psi_group *group, u32 *pchanged_states) { #ifdef CONFIG_PSI_FINE_GRAINED - u64 stat_delta[NR_PSI_STAT_STATES] = { 0 }; + u64 stat_delta[PSI_STATE_LAST] = { 0 }; #endif u64 deltas[NR_PSI_STATES - 1] = { 0, }; unsigned long nonidle_total = 0; @@ -575,7 +575,7 @@ static void collect_percpu_times(struct psi_group *group, div_u64(deltas[s], max(nonidle_total, 1UL)); #ifdef CONFIG_PSI_FINE_GRAINED - for (s = 0; s < NR_PSI_STAT_STATES; s++) + for (s = 0; s < PSI_STATE_LAST; s++) group->fine_grained_total[aggregator][s] += div_u64(stat_delta[s], max(nonidle_total, 1UL)); #endif @@ -753,7 +753,7 @@ static u64 update_averages(struct psi_group *group, u64 now) calc_avgs(group->avg[s], missed_periods, sample, period); } #ifdef CONFIG_PSI_FINE_GRAINED - for (s = 0; s < NR_PSI_STAT_STATES; s++) { + for (s = 0; s < PSI_STATE_LAST; s++) { u32 stat_sample; stat_sample = group->fine_grained_total[PSI_AVGS][s] - @@ -1935,7 +1935,7 @@ int psi_stat_show(struct seq_file *m, struct psi_group *group) group->avg_next_update = update_averages(group, now); mutex_unlock(&group->avgs_lock); - for (i = 0; i < NR_PSI_STAT_STATES; i++) { + for (i = 0; i < PSI_STATE_LAST; i++) { unsigned long avg[3] = {0, }; int w; u64 total; -- 2.34.1

2 2

[openeuler:OLK-5.10 19319/30000] drivers/ub/urma/uburma/uburma_cmd.c:180:6: warning: no previous prototype for 'uburma_jetty_event_cb'
by kernel test robot 22 Sep '24

22 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 108b9a92793f61e1abf94d341c676515421e57a2 commit: c3af5be3e72710b357d9f23a5bdcafe8f96d6dfd [19319/30000] ub: uburma add cmd create jetty implementation. config: arm64-randconfig-004-20240912 (https://download.01.org/0day-ci/archive/20240922/202409222352.T2dIjY0d-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240922/202409222352.T2dIjY0d-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409222352.T2dIjY0d-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/ub/urma/uburma/uburma_cmd.c:144:6: warning: no previous prototype for 'uburma_jfc_event_cb' [-Wmissing-prototypes] 144 | void uburma_jfc_event_cb(struct ubcore_event *event, struct ubcore_ucontext *ctx) | ^~~~~~~~~~~~~~~~~~~ drivers/ub/urma/uburma/uburma_cmd.c:156:6: warning: no previous prototype for 'uburma_jfs_event_cb' [-Wmissing-prototypes] 156 | void uburma_jfs_event_cb(struct ubcore_event *event, struct ubcore_ucontext *ctx) | ^~~~~~~~~~~~~~~~~~~ drivers/ub/urma/uburma/uburma_cmd.c:168:6: warning: no previous prototype for 'uburma_jfr_event_cb' [-Wmissing-prototypes] 168 | void uburma_jfr_event_cb(struct ubcore_event *event, struct ubcore_ucontext *ctx) | ^~~~~~~~~~~~~~~~~~~ >> drivers/ub/urma/uburma/uburma_cmd.c:180:6: warning: no previous prototype for 'uburma_jetty_event_cb' [-Wmissing-prototypes] 180 | void uburma_jetty_event_cb(struct ubcore_event *event, struct ubcore_ucontext *ctx) | ^~~~~~~~~~~~~~~~~~~~~ Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PGP_KEY_PARSER Depends on [n]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] && ASYMMETRIC_PUBLIC_KEY_SUBTYPE [=n] Selected by [y]: - PGP_PRELOAD [=y] && CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] vim +/uburma_jetty_event_cb +180 drivers/ub/urma/uburma/uburma_cmd.c 179 > 180 void uburma_jetty_event_cb(struct ubcore_event *event, struct ubcore_ucontext *ctx) 181 { 182 struct uburma_jetty_uobj *jetty_uobj; 183 184 if (event->element.jetty == NULL) 185 return; 186 187 jetty_uobj = (struct uburma_jetty_uobj *)event->element.jetty->jetty_cfg.jetty_context; 188 uburma_write_async_event(ctx, event->element.jetty->urma_jetty, event->event_type, 189 &jetty_uobj->async_event_list, &jetty_uobj->async_events_reported); 190 } 191 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0