- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] ALSA: usb-audio: fix null pointer dereference on pointer cs_desc
by Liu Shixin 16 Apr '24

16 Apr '24

From: Chengfeng Ye <cyeaa(a)connect.ust.hk> mainline inclusion from mainline-v5.16-rc1 commit b97053df0f04747c3c1e021ecbe99db675342954 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9FNFQ CVE: CVE-2021-47211 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The pointer cs_desc return from snd_usb_find_clock_source could be null, so there is a potential null pointer dereference issue. Fix this by adding a null check before dereference. Signed-off-by: Chengfeng Ye <cyeaa(a)connect.ust.hk> Link: https://lore.kernel.org/r/20211024111736.11342-1-cyeaa@connect.ust.hk Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Conflicts: sound/usb/clock.c Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- sound/usb/clock.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/sound/usb/clock.c b/sound/usb/clock.c index 514d18a3e07a..95b019f15224 100644 --- a/sound/usb/clock.c +++ b/sound/usb/clock.c @@ -618,11 +618,17 @@ static int set_sample_rate_v2v3(struct snd_usb_audio *chip, int iface, struct uac3_clock_source_descriptor *cs_desc; cs_desc = snd_usb_find_clock_source_v3(chip->ctrl_intf, clock); + if (!cs_desc) + return 0; + bmControls = le32_to_cpu(cs_desc->bmControls); } else { struct uac_clock_source_descriptor *cs_desc; cs_desc = snd_usb_find_clock_source(chip->ctrl_intf, clock); + if (!cs_desc) + return 0; + bmControls = cs_desc->bmControls; } -- 2.25.1

2 1

[PATCH OLK-6.6 v2 00/14] mm: some optimization about hugetlb and thp
by Kefeng Wang 16 Apr '24

16 Apr '24

1. hugetlb: remove hugetlb special casing in filemap.c 2. thp: 1) align larger anonymous mappings on THP 2) batch tlb flush when splitting 3) try madvise huge for file exec Baolin Wang (1): mm: huge_memory: batch tlb flush when splitting a pte-mapped THP Fangrui Song (1): mm: remove VM_EXEC requirement for THP eligibility Kefeng Wang (1): mm: filemap: try to enable THP for exec mapping Lance Yang (2): mm/khugepaged: bypassing unnecessary scans with MMF_DISABLE_THP check mm/khugepaged: keep mm in mm_slot without MMF_DISABLE_THP check Lorenzo Stoakes (1): mm/filemap: clarify filemap_fault() comments for not uptodate case Rik van Riel (1): mm: align larger anonymous mappings on THP boundaries Ryan Roberts (1): mm: thp_get_unmapped_area must honour topdown preference Sidhartha Kumar (3): mm/filemap: remove hugetlb special casing in filemap.c mm/hugetlb: have CONFIG_HUGETLB_PAGE select CONFIG_XARRAY_MULTI fs/hugetlbfs/inode.c: mm/memory-failure.c: fix hugetlbfs hwpoison handling Yang Shi (3): mm: mmap: map MAP_STACK to VM_NOHUGEPAGE mm: huge_memory: don't force huge page alignment on 32 bit mm: mmap: no need to call khugepaged_enter_vma() for stack Documentation/admin-guide/mm/transhuge.rst | 7 ++ fs/Kconfig | 1 + fs/hugetlbfs/inode.c | 37 +++++----- include/linux/huge_mm.h | 2 +- include/linux/hugetlb.h | 12 ++++ include/linux/mman.h | 1 + include/linux/pagemap.h | 32 +-------- mm/filemap.c | 80 ++++++++++++++-------- mm/huge_memory.c | 47 ++++++++++++- mm/hugetlb.c | 32 ++------- mm/khugepaged.c | 16 +++-- mm/memory-failure.c | 2 +- mm/migrate.c | 6 +- mm/mmap.c | 11 +-- 14 files changed, 165 insertions(+), 121 deletions(-) -- 2.27.0

2 15

[PATCH openEuler-1.0-LTS] ALSA: usb-audio: fix null pointer dereference on pointer cs_desc
by Liu Shixin 16 Apr '24

16 Apr '24

From: Chengfeng Ye <cyeaa(a)connect.ust.hk> mainline inclusion from mainline-v5.16-rc1 commit b97053df0f04747c3c1e021ecbe99db675342954 category: bugfix bugzilla: 189792 CVE: CVE-2021-47211 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The pointer cs_desc return from snd_usb_find_clock_source could be null, so there is a potential null pointer dereference issue. Fix this by adding a null check before dereference. Signed-off-by: Chengfeng Ye <cyeaa(a)connect.ust.hk> Link: https://lore.kernel.org/r/20211024111736.11342-1-cyeaa@connect.ust.hk Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Conflicts: sound/usb/clock.c Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- sound/usb/clock.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/sound/usb/clock.c b/sound/usb/clock.c index e31349865f20..01b414448312 100644 --- a/sound/usb/clock.c +++ b/sound/usb/clock.c @@ -538,11 +538,17 @@ static int set_sample_rate_v2v3(struct snd_usb_audio *chip, int iface, struct uac3_clock_source_descriptor *cs_desc; cs_desc = snd_usb_find_clock_source_v3(chip->ctrl_intf, clock); + if (!cs_desc) + return 0; + bmControls = le32_to_cpu(cs_desc->bmControls); } else { struct uac_clock_source_descriptor *cs_desc; cs_desc = snd_usb_find_clock_source(chip->ctrl_intf, clock); + if (!cs_desc) + return 0; + bmControls = cs_desc->bmControls; } -- 2.25.1

2 1

[PATCH OLK-5.10 0/1] writeback fix softlockup
by Chen Ridong 16 Apr '24

16 Apr '24

*** BLURB HERE *** Chen Ridong (1): cgroup_writeback: fix softlockup for blkcg->memcg_list mm/backing-dev.c | 15 ++++++++++----- mm/memcontrol.c | 5 ++--- 2 files changed, 12 insertions(+), 8 deletions(-) -- 2.34.1

2 2

[openeuler:OLK-6.6 7345/7439] arch/arm64/kernel/cpufeature.c:2209:57: error: 'enable_pseudo_nmi' undeclared; did you mean 'enable_percpu_nmi'?
by kernel test robot 16 Apr '24

16 Apr '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: ba2303cacfdaf39c19a78290c541499b23712f54 commit: b8c8255e1d74937638bca666264404952c60395a [7345/7439] arm64: Decouple KVM from CONFIG_ARM64_NMI config: arm64-allnoconfig (https://download.01.org/0day-ci/archive/20240416/202404162024.n82VbpYr-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240416/202404162024.n82VbpYr-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202404162024.n82VbpYr-lkp@intel.com/ All errors (new ones prefixed by >>): arch/arm64/kernel/cpufeature.c: In function 'use_nmi': >> arch/arm64/kernel/cpufeature.c:2209:57: error: 'enable_pseudo_nmi' undeclared (first use in this function); did you mean 'enable_percpu_nmi'? 2209 | else if (IS_ENABLED(CONFIG_ARM64_PSEUDO_NMI) && enable_pseudo_nmi) { | ^~~~~~~~~~~~~~~~~ | enable_percpu_nmi arch/arm64/kernel/cpufeature.c:2209:57: note: each undeclared identifier is reported only once for each function it appears in vim +2209 arch/arm64/kernel/cpufeature.c 2191 2192 static bool use_nmi(const struct arm64_cpu_capabilities *entry, int scope) 2193 { 2194 if (!has_cpuid_feature(entry, scope)) 2195 return false; 2196 2197 /* 2198 * NMI support was not enabled in the kernel, but can still be 2199 * used by guests. Let the world know. 2200 * 2201 * Having both real and pseudo NMIs enabled simultaneously is 2202 * likely to cause confusion. Since pseudo NMIs must be 2203 * enabled with an explicit command line option, if the user 2204 * has set that option on a system with real NMIs for some 2205 * reason assume they know what they're doing. 2206 */ 2207 if (!IS_ENABLED(CONFIG_ARM64_NMI)) 2208 pr_info("CONFIG_ARM64_NMI disabled, using NMIs for guests only\n"); > 2209 else if (IS_ENABLED(CONFIG_ARM64_PSEUDO_NMI) && enable_pseudo_nmi) { 2210 pr_info("Pseudo NMI enabled, not using architected NMI\n"); 2211 return false; 2212 } 2213 2214 return true; 2215 } 2216 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/2] fix deadlock in cgroup1_writeback
by Chen Ridong 16 Apr '24

16 Apr '24

*** BLURB HERE *** Chen Ridong (2): Revert "cgroup_writeback: fix deadlock in cgroup1_writeback" cgroup_writeback: fix deadlock in cgroup1_writeback mm/backing-dev.c | 2 ++ mm/memcontrol.c | 24 +++++++++--------------- 2 files changed, 11 insertions(+), 15 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-22.03-LTS-SP1] tee: amdtee: fix use-after-free vulnerability in amdtee_close_session
by Guo Mengqi 16 Apr '24

16 Apr '24

From: Rijo Thomas <Rijo-john.Thomas(a)amd.com> stable inclusion from stable-v5.10.199 commit da7ce52a2f6c468946195b116615297d3d113a27 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9AWJ5 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f4384b3e54ea813868bb81a861bf5b2406e15d8f upstream. There is a potential race condition in amdtee_close_session that may cause use-after-free in amdtee_open_session. For instance, if a session has refcount == 1, and one thread tries to free this session via: kref_put(&sess->refcount, destroy_session); the reference count will get decremented, and the next step would be to call destroy_session(). However, if in another thread, amdtee_open_session() is called before destroy_session() has completed execution, alloc_session() may return 'sess' that will be freed up later in destroy_session() leading to use-after-free in amdtee_open_session. To fix this issue, treat decrement of sess->refcount and removal of 'sess' from session list in destroy_session() as a critical section, so that it is executed atomically. Fixes: 757cc3e9ff1d ("tee: add AMD-TEE driver") Cc: stable(a)vger.kernel.org Signed-off-by: Rijo Thomas <Rijo-john.Thomas(a)amd.com> Reviewed-by: Sumit Garg <sumit.garg(a)linaro.org> Signed-off-by: Jens Wiklander <jens.wiklander(a)linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: sanglipeng <sanglipeng1(a)jd.com> --- drivers/tee/amdtee/core.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/drivers/tee/amdtee/core.c b/drivers/tee/amdtee/core.c index 297dc62bca29..a890eeabe065 100644 --- a/drivers/tee/amdtee/core.c +++ b/drivers/tee/amdtee/core.c @@ -217,12 +217,12 @@ static int copy_ta_binary(struct tee_context *ctx, void *ptr, void **ta, return rc; } +/* mutex must be held by caller */ static void destroy_session(struct kref *ref) { struct amdtee_session *sess = container_of(ref, struct amdtee_session, refcount); - mutex_lock(&session_list_mutex); list_del(&sess->list_node); mutex_unlock(&session_list_mutex); kfree(sess); @@ -277,7 +277,8 @@ int amdtee_open_session(struct tee_context *ctx, if (i >= TEE_NUM_SESSIONS) { pr_err("reached maximum session count %d\n", TEE_NUM_SESSIONS); handle_unload_ta(ta_handle); - kref_put(&sess->refcount, destroy_session); + kref_put_mutex(&sess->refcount, destroy_session, + &session_list_mutex); rc = -ENOMEM; goto out; } @@ -290,7 +291,8 @@ int amdtee_open_session(struct tee_context *ctx, clear_bit(i, sess->sess_mask); spin_unlock(&sess->lock); handle_unload_ta(ta_handle); - kref_put(&sess->refcount, destroy_session); + kref_put_mutex(&sess->refcount, destroy_session, + &session_list_mutex); goto out; } @@ -332,7 +334,7 @@ int amdtee_close_session(struct tee_context *ctx, u32 session) handle_close_session(ta_handle, session_info); handle_unload_ta(ta_handle); - kref_put(&sess->refcount, destroy_session); + kref_put_mutex(&sess->refcount, destroy_session, &session_list_mutex); return 0; } -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS] tee: amdtee: fix use-after-free vulnerability in amdtee_close_session
by Guo Mengqi 16 Apr '24

16 Apr '24

From: Rijo Thomas <Rijo-john.Thomas(a)amd.com> stable inclusion from stable-v5.10.199 commit da7ce52a2f6c468946195b116615297d3d113a27 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9AWJ5 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f4384b3e54ea813868bb81a861bf5b2406e15d8f upstream. There is a potential race condition in amdtee_close_session that may cause use-after-free in amdtee_open_session. For instance, if a session has refcount == 1, and one thread tries to free this session via: kref_put(&sess->refcount, destroy_session); the reference count will get decremented, and the next step would be to call destroy_session(). However, if in another thread, amdtee_open_session() is called before destroy_session() has completed execution, alloc_session() may return 'sess' that will be freed up later in destroy_session() leading to use-after-free in amdtee_open_session. To fix this issue, treat decrement of sess->refcount and removal of 'sess' from session list in destroy_session() as a critical section, so that it is executed atomically. Fixes: 757cc3e9ff1d ("tee: add AMD-TEE driver") Cc: stable(a)vger.kernel.org Signed-off-by: Rijo Thomas <Rijo-john.Thomas(a)amd.com> Reviewed-by: Sumit Garg <sumit.garg(a)linaro.org> Signed-off-by: Jens Wiklander <jens.wiklander(a)linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: sanglipeng <sanglipeng1(a)jd.com> --- drivers/tee/amdtee/core.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/drivers/tee/amdtee/core.c b/drivers/tee/amdtee/core.c index 297dc62bca29..a890eeabe065 100644 --- a/drivers/tee/amdtee/core.c +++ b/drivers/tee/amdtee/core.c @@ -217,12 +217,12 @@ static int copy_ta_binary(struct tee_context *ctx, void *ptr, void **ta, return rc; } +/* mutex must be held by caller */ static void destroy_session(struct kref *ref) { struct amdtee_session *sess = container_of(ref, struct amdtee_session, refcount); - mutex_lock(&session_list_mutex); list_del(&sess->list_node); mutex_unlock(&session_list_mutex); kfree(sess); @@ -277,7 +277,8 @@ int amdtee_open_session(struct tee_context *ctx, if (i >= TEE_NUM_SESSIONS) { pr_err("reached maximum session count %d\n", TEE_NUM_SESSIONS); handle_unload_ta(ta_handle); - kref_put(&sess->refcount, destroy_session); + kref_put_mutex(&sess->refcount, destroy_session, + &session_list_mutex); rc = -ENOMEM; goto out; } @@ -290,7 +291,8 @@ int amdtee_open_session(struct tee_context *ctx, clear_bit(i, sess->sess_mask); spin_unlock(&sess->lock); handle_unload_ta(ta_handle); - kref_put(&sess->refcount, destroy_session); + kref_put_mutex(&sess->refcount, destroy_session, + &session_list_mutex); goto out; } @@ -332,7 +334,7 @@ int amdtee_close_session(struct tee_context *ctx, u32 session) handle_close_session(ta_handle, session_info); handle_unload_ta(ta_handle); - kref_put(&sess->refcount, destroy_session); + kref_put_mutex(&sess->refcount, destroy_session, &session_list_mutex); return 0; } -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP2] tee: amdtee: fix use-after-free vulnerability in amdtee_close_session
by Guo Mengqi 16 Apr '24

16 Apr '24

From: Rijo Thomas <Rijo-john.Thomas(a)amd.com> stable inclusion from stable-v5.10.199 commit da7ce52a2f6c468946195b116615297d3d113a27 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9AWJ5 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f4384b3e54ea813868bb81a861bf5b2406e15d8f upstream. There is a potential race condition in amdtee_close_session that may cause use-after-free in amdtee_open_session. For instance, if a session has refcount == 1, and one thread tries to free this session via: kref_put(&sess->refcount, destroy_session); the reference count will get decremented, and the next step would be to call destroy_session(). However, if in another thread, amdtee_open_session() is called before destroy_session() has completed execution, alloc_session() may return 'sess' that will be freed up later in destroy_session() leading to use-after-free in amdtee_open_session. To fix this issue, treat decrement of sess->refcount and removal of 'sess' from session list in destroy_session() as a critical section, so that it is executed atomically. Fixes: 757cc3e9ff1d ("tee: add AMD-TEE driver") Cc: stable(a)vger.kernel.org Signed-off-by: Rijo Thomas <Rijo-john.Thomas(a)amd.com> Reviewed-by: Sumit Garg <sumit.garg(a)linaro.org> Signed-off-by: Jens Wiklander <jens.wiklander(a)linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: sanglipeng <sanglipeng1(a)jd.com> --- drivers/tee/amdtee/core.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/drivers/tee/amdtee/core.c b/drivers/tee/amdtee/core.c index 372d64756ed6..3c15f6a9e91c 100644 --- a/drivers/tee/amdtee/core.c +++ b/drivers/tee/amdtee/core.c @@ -217,12 +217,12 @@ static int copy_ta_binary(struct tee_context *ctx, void *ptr, void **ta, return rc; } +/* mutex must be held by caller */ static void destroy_session(struct kref *ref) { struct amdtee_session *sess = container_of(ref, struct amdtee_session, refcount); - mutex_lock(&session_list_mutex); list_del(&sess->list_node); mutex_unlock(&session_list_mutex); kfree(sess); @@ -272,7 +272,8 @@ int amdtee_open_session(struct tee_context *ctx, if (arg->ret != TEEC_SUCCESS) { pr_err("open_session failed %d\n", arg->ret); handle_unload_ta(ta_handle); - kref_put(&sess->refcount, destroy_session); + kref_put_mutex(&sess->refcount, destroy_session, + &session_list_mutex); goto out; } @@ -290,7 +291,8 @@ int amdtee_open_session(struct tee_context *ctx, pr_err("reached maximum session count %d\n", TEE_NUM_SESSIONS); handle_close_session(ta_handle, session_info); handle_unload_ta(ta_handle); - kref_put(&sess->refcount, destroy_session); + kref_put_mutex(&sess->refcount, destroy_session, + &session_list_mutex); rc = -ENOMEM; goto out; } @@ -331,7 +333,7 @@ int amdtee_close_session(struct tee_context *ctx, u32 session) handle_close_session(ta_handle, session_info); handle_unload_ta(ta_handle); - kref_put(&sess->refcount, destroy_session); + kref_put_mutex(&sess->refcount, destroy_session, &session_list_mutex); return 0; } -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1] tee: amdtee: fix use-after-free vulnerability in amdtee_close_session
by Guo Mengqi 16 Apr '24

16 Apr '24

From: Rijo Thomas <Rijo-john.Thomas(a)amd.com> stable inclusion from stable-v5.10.199 commit da7ce52a2f6c468946195b116615297d3d113a27 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9AWJ5 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f4384b3e54ea813868bb81a861bf5b2406e15d8f upstream. There is a potential race condition in amdtee_close_session that may cause use-after-free in amdtee_open_session. For instance, if a session has refcount == 1, and one thread tries to free this session via: kref_put(&sess->refcount, destroy_session); the reference count will get decremented, and the next step would be to call destroy_session(). However, if in another thread, amdtee_open_session() is called before destroy_session() has completed execution, alloc_session() may return 'sess' that will be freed up later in destroy_session() leading to use-after-free in amdtee_open_session. To fix this issue, treat decrement of sess->refcount and removal of 'sess' from session list in destroy_session() as a critical section, so that it is executed atomically. Fixes: 757cc3e9ff1d ("tee: add AMD-TEE driver") Cc: stable(a)vger.kernel.org Signed-off-by: Rijo Thomas <Rijo-john.Thomas(a)amd.com> Reviewed-by: Sumit Garg <sumit.garg(a)linaro.org> Signed-off-by: Jens Wiklander <jens.wiklander(a)linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: sanglipeng <sanglipeng1(a)jd.com> --- drivers/tee/amdtee/core.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/drivers/tee/amdtee/core.c b/drivers/tee/amdtee/core.c index 372d64756ed6..3c15f6a9e91c 100644 --- a/drivers/tee/amdtee/core.c +++ b/drivers/tee/amdtee/core.c @@ -217,12 +217,12 @@ static int copy_ta_binary(struct tee_context *ctx, void *ptr, void **ta, return rc; } +/* mutex must be held by caller */ static void destroy_session(struct kref *ref) { struct amdtee_session *sess = container_of(ref, struct amdtee_session, refcount); - mutex_lock(&session_list_mutex); list_del(&sess->list_node); mutex_unlock(&session_list_mutex); kfree(sess); @@ -272,7 +272,8 @@ int amdtee_open_session(struct tee_context *ctx, if (arg->ret != TEEC_SUCCESS) { pr_err("open_session failed %d\n", arg->ret); handle_unload_ta(ta_handle); - kref_put(&sess->refcount, destroy_session); + kref_put_mutex(&sess->refcount, destroy_session, + &session_list_mutex); goto out; } @@ -290,7 +291,8 @@ int amdtee_open_session(struct tee_context *ctx, pr_err("reached maximum session count %d\n", TEE_NUM_SESSIONS); handle_close_session(ta_handle, session_info); handle_unload_ta(ta_handle); - kref_put(&sess->refcount, destroy_session); + kref_put_mutex(&sess->refcount, destroy_session, + &session_list_mutex); rc = -ENOMEM; goto out; } @@ -331,7 +333,7 @@ int amdtee_close_session(struct tee_context *ctx, u32 session) handle_close_session(ta_handle, session_info); handle_unload_ta(ta_handle); - kref_put(&sess->refcount, destroy_session); + kref_put_mutex(&sess->refcount, destroy_session, &session_list_mutex); return 0; } -- 2.17.1

2 1