- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT
by Dong Chenchen 12 Dec '24

12 Dec '24

From: Pedro Tammela <pctammela(a)mojatatu.com> stable inclusion from stable-v4.19.323 commit e7f9a6f97eb067599a74f3bcb6761976b0ed303e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5KR7 CVE: CVE-2024-53057 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2e95c4384438adeaa772caa560244b1a2efef816 ] In qdisc_tree_reduce_backlog, Qdiscs with major handle ffff: are assumed to be either root or ingress. This assumption is bogus since it's valid to create egress qdiscs with major handle ffff: Budimir Markovic found that for qdiscs like DRR that maintain an active class list, it will cause a UAF with a dangling class pointer. In 066a3b5b2346, the concern was to avoid iterating over the ingress qdisc since its parent is itself. The proper fix is to stop when parent TC_H_ROOT is reached because the only way to retrieve ingress is when a hierarchy which does not contain a ffff: major handle call into qdisc_lookup with TC_H_MAJ(TC_H_ROOT). In the scenario where major ffff: is an egress qdisc in any of the tree levels, the updates will also propagate to TC_H_ROOT, which then the iteration must stop. Fixes: 066a3b5b2346 ("[NET_SCHED] sch_api: fix qdisc_tree_decrease_qlen() loop") Reported-by: Budimir Markovic <markovicbudimir(a)gmail.com> Suggested-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Tested-by: Victor Nogueira <victor(a)mojatatu.com> Signed-off-by: Pedro Tammela <pctammela(a)mojatatu.com> Signed-off-by: Jamal Hadi Salim <jhs(a)mojatatu.com> net/sched/sch_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://patch.msgid.link/20241024165547.418570-1-jhs@mojatatu.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> Reviewed-by: Zhang Changzhong <zhangchangzhong(a)huaiwei.com> --- net/sched/sch_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c index 458f9e733cf0..36a5d3ceead2 100644 --- a/net/sched/sch_api.c +++ b/net/sched/sch_api.c @@ -783,7 +783,7 @@ void qdisc_tree_reduce_backlog(struct Qdisc *sch, unsigned int n, drops = max_t(int, n, 0); rcu_read_lock(); while ((parentid = sch->parent)) { - if (TC_H_MAJ(parentid) == TC_H_MAJ(TC_H_INGRESS)) + if (parentid == TC_H_ROOT) break; if (sch->flags & TCQ_F_NOPARENT) -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] netfilter: nft_payload: sanitize offset and length before calling skb_checksum()
by Dong Chenchen 12 Dec '24

12 Dec '24

From: Pablo Neira Ayuso <pablo(a)netfilter.org> stable inclusion from stable-v4.19.323 commit a661ed364ae6ae88c2fafa9ddc27df1af2a73701 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB37AM CVE: CVE-2024-50251 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d5953d680f7e96208c29ce4139a0e38de87a57fe ] If access to offset + length is larger than the skbuff length, then skb_checksum() triggers BUG_ON(). skb_checksum() internally subtracts the length parameter while iterating over skbuff, BUG_ON(len) at the end of it checks that the expected length to be included in the checksum calculation is fully consumed. Fixes: 7ec3f7b47b8d ("netfilter: nft_payload: add packet mangling support") Reported-by: Slavin Liu <slavin-ayu(a)qq.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/netfilter/nft_payload.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c index fd87216bc0a9..904652b226a7 100644 --- a/net/netfilter/nft_payload.c +++ b/net/netfilter/nft_payload.c @@ -306,6 +306,9 @@ static void nft_payload_set_eval(const struct nft_expr *expr, if ((priv->csum_type == NFT_PAYLOAD_CSUM_INET || priv->csum_flags) && (priv->base != NFT_PAYLOAD_TRANSPORT_HEADER || skb->ip_summed != CHECKSUM_PARTIAL)) { + if (offset + priv->len > skb->len) + goto err; + fsum = skb_checksum(skb, offset, priv->len, 0); tsum = csum_partial(src, priv->len, 0); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] be2net: fix potential memory leak in be_xmit()
by Dong Chenchen 12 Dec '24

12 Dec '24

From: Wang Hai <wanghai38(a)huawei.com> stable inclusion from stable-v4.19.323 commit 941026023c256939943a47d1c66671526befbb26 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2STK CVE: CVE-2024-50167 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e4dd8bfe0f6a23acd305f9b892c00899089bd621 ] The be_xmit() returns NETDEV_TX_OK without freeing skb in case of be_xmit_enqueue() fails, add dev_kfree_skb_any() to fix it. Fixes: 760c295e0e8d ("be2net: Support for OS2BMC.") Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Reviewed-by: Kalesh AP <kalesh-anakkur.purayil(a)broadcom.com> Message-ID: <20241015144802.12150-1-wanghai38(a)huawei.com> Signed-off-by: Andrew Lunn <andrew(a)lunn.ch> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/net/ethernet/emulex/benet/be_main.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c index 3fe6a28027fe..63a0156922b4 100644 --- a/drivers/net/ethernet/emulex/benet/be_main.c +++ b/drivers/net/ethernet/emulex/benet/be_main.c @@ -1385,10 +1385,8 @@ static netdev_tx_t be_xmit(struct sk_buff *skb, struct net_device *netdev) be_get_wrb_params_from_skb(adapter, skb, &wrb_params); wrb_cnt = be_xmit_enqueue(adapter, txo, skb, &wrb_params); - if (unlikely(!wrb_cnt)) { - dev_kfree_skb_any(skb); - goto drop; - } + if (unlikely(!wrb_cnt)) + goto drop_skb; /* if os2bmc is enabled and if the pkt is destined to bmc, * enqueue the pkt a 2nd time with mgmt bit set. @@ -1397,7 +1395,7 @@ static netdev_tx_t be_xmit(struct sk_buff *skb, struct net_device *netdev) BE_WRB_F_SET(wrb_params.features, OS2BMC, 1); wrb_cnt = be_xmit_enqueue(adapter, txo, skb, &wrb_params); if (unlikely(!wrb_cnt)) - goto drop; + goto drop_skb; else skb_get(skb); } @@ -1411,6 +1409,8 @@ static netdev_tx_t be_xmit(struct sk_buff *skb, struct net_device *netdev) be_xmit_flush(adapter, txo); return NETDEV_TX_OK; +drop_skb: + dev_kfree_skb_any(skb); drop: tx_stats(txo)->tx_drv_drops++; /* Flush the already enqueued tx requests */ -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] net/sun3_82586: fix potential memory leak in sun3_82586_send_packet()
by Dong Chenchen 12 Dec '24

12 Dec '24

From: Wang Hai <wanghai38(a)huawei.com> stable inclusion from stable-v4.19.323 commit 137010d26dc5cd47cd62fef77cbe952d31951b7a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2SUF CVE: CVE-2024-50168 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2cb3f56e827abb22c4168ad0c1bbbf401bb2f3b8 ] The sun3_82586_send_packet() returns NETDEV_TX_OK without freeing skb in case of skb->len being too long, add dev_kfree_skb() to fix it. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Message-ID: <20241015144148.7918-1-wanghai38(a)huawei.com> Signed-off-by: Andrew Lunn <andrew(a)lunn.ch> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- drivers/net/ethernet/i825xx/sun3_82586.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/ethernet/i825xx/sun3_82586.c b/drivers/net/ethernet/i825xx/sun3_82586.c index 1a86184d44c0..0f0304043070 100644 --- a/drivers/net/ethernet/i825xx/sun3_82586.c +++ b/drivers/net/ethernet/i825xx/sun3_82586.c @@ -1015,6 +1015,7 @@ sun3_82586_send_packet(struct sk_buff *skb, struct net_device *dev) if(skb->len > XMIT_BUFF_SIZE) { printk("%s: Sorry, max. framelength is %d bytes. The length of your frame is %d bytes.\n",dev->name,XMIT_BUFF_SIZE,skb->len); + dev_kfree_skb(skb); return NETDEV_TX_OK; } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/2] Bluetooth: Fix CVE-2024-50125
by Dong Chenchen 12 Dec '24

12 Dec '24

Fix CVE-2024-50125 Desmond Cheong Zhi Xi (1): Bluetooth: call sock_hold earlier in sco_conn_del Luiz Augusto von Dentz (1): Bluetooth: SCO: Fix UAF on sco_sock_timeout include/net/bluetooth/bluetooth.h | 1 + net/bluetooth/af_bluetooth.c | 22 ++++++++++++++++++++++ net/bluetooth/sco.c | 17 ++++++++++++----- 3 files changed, 35 insertions(+), 5 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6] drm/amd/display: Adjust VSDB parser for replay feature
by Yuan Can 12 Dec '24

12 Dec '24

From: Rodrigo Siqueira <Rodrigo.Siqueira(a)amd.com> mainline inclusion from mainline-v6.12 commit 16dd2825c23530f2259fc671960a3a65d2af69bd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB8IUF CVE: CVE-2024-53108 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- At some point, the IEEE ID identification for the replay check in the AMD EDID was added. However, this check causes the following out-of-bounds issues when using KASAN: [ 27.804016] BUG: KASAN: slab-out-of-bounds in amdgpu_dm_update_freesync_caps+0xefa/0x17a0 [amdgpu] [ 27.804788] Read of size 1 at addr ffff8881647fdb00 by task systemd-udevd/383 ... [ 27.821207] Memory state around the buggy address: [ 27.821215] ffff8881647fda00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 27.821224] ffff8881647fda80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 27.821234] >ffff8881647fdb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.821243] ^ [ 27.821250] ffff8881647fdb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 27.821259] ffff8881647fdc00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 27.821268] ================================================================== This is caused because the ID extraction happens outside of the range of the edid lenght. This commit addresses this issue by considering the amd_vsdb_block size. Cc: ChiaHsuan Chung <chiahsuan.chung(a)amd.com> Reviewed-by: Leo Li <sunpeng.li(a)amd.com> Signed-off-by: Rodrigo Siqueira <Rodrigo.Siqueira(a)amd.com> Signed-off-by: Hamza Mahfooz <hamza.mahfooz(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> (cherry picked from commit b7e381b1ccd5e778e3d9c44c669ad38439a861d8) Cc: stable(a)vger.kernel.org Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c index 1b7b92000e6e..f729acc5ea35 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c @@ -10729,7 +10729,7 @@ static int parse_amd_vsdb(struct amdgpu_dm_connector *aconnector, break; } - while (j < EDID_LENGTH) { + while (j < EDID_LENGTH - sizeof(struct amd_vsdb_block)) { struct amd_vsdb_block *amd_vsdb = (struct amd_vsdb_block *)&edid_ext[j]; unsigned int ieeeId = (amd_vsdb->ieee_id[2] << 16) | (amd_vsdb->ieee_id[1] << 8) | (amd_vsdb->ieee_id[0]); -- 2.22.0

2 1

[PATCH OLK-6.6 0/4] crypto: hisilicon/sec2 - the aead algorithm of sec2 is fixed.
by Weili Qian 12 Dec '24

12 Dec '24

From: JiangShui Yang <yangjiangshui(a)h-partners.com> Weili Qian (2): crypto: hisilicon/qm - disable error report before flr crypto: hisilicon/trng - support to obtain random numbers from soft algorithm Wenkai Lin (2): crypto: hisilicon/sec2 - fix for aead icv error crypto: hisilicon/sec2 - fix for aead invalid authsize drivers/crypto/hisilicon/Kconfig | 1 + drivers/crypto/hisilicon/qm.c | 49 ++++--- drivers/crypto/hisilicon/sec2/sec.h | 3 +- drivers/crypto/hisilicon/sec2/sec_crypto.c | 161 ++++++++++----------- drivers/crypto/hisilicon/sec2/sec_crypto.h | 11 -- drivers/crypto/hisilicon/trng/trng.c | 52 ++++++- 6 files changed, 156 insertions(+), 121 deletions(-) -- 2.43.0

2 5

[openeuler:OLK-6.6 1613/1613] kernel/sched/fair.c:175:5: sparse: sparse: symbol 'sysctl_sched_util_low_pct' was not declared. Should it be static?
by kernel test robot 12 Dec '24

12 Dec '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: ea308216b3205d652bf8108517516848b0b64435 commit: 2e1dfc02d115143587ccfee1815ad295763050f2 [1613/1613] sched: Adjust wakeup cpu range according CPU util dynamicly config: loongarch-randconfig-r111-20241210 (https://download.01.org/0day-ci/archive/20241212/202412121240.WE2mP4ai-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20241212/202412121240.WE2mP4ai-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412121240.WE2mP4ai-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> kernel/sched/fair.c:175:5: sparse: sparse: symbol 'sysctl_sched_util_low_pct' was not declared. Should it be static? kernel/sched/fair.c:1256:34: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected struct sched_entity const *se @@ got struct sched_entity [noderef] __rcu * @@ kernel/sched/fair.c:1256:34: sparse: expected struct sched_entity const *se kernel/sched/fair.c:1256:34: sparse: got struct sched_entity [noderef] __rcu * kernel/sched/fair.c:12740:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:12740:9: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:12740:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:6633:38: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct task_struct *curr @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/fair.c:6633:38: sparse: expected struct task_struct *curr kernel/sched/fair.c:6633:38: sparse: got struct task_struct [noderef] __rcu *curr kernel/sched/fair.c:7964:20: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:7964:20: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:7964:20: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:8258:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] tmp @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:8258:9: sparse: expected struct sched_domain *[assigned] tmp kernel/sched/fair.c:8258:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:8367:38: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct task_struct *curr @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/fair.c:8367:38: sparse: expected struct task_struct *curr kernel/sched/fair.c:8367:38: sparse: got struct task_struct [noderef] __rcu *curr kernel/sched/fair.c:8941:38: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct task_struct *curr @@ got struct task_struct [noderef] __rcu *curr @@ kernel/sched/fair.c:8941:38: sparse: expected struct task_struct *curr kernel/sched/fair.c:8941:38: sparse: got struct task_struct [noderef] __rcu *curr kernel/sched/fair.c:9934:40: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct sched_domain *child @@ got struct sched_domain [noderef] __rcu *child @@ kernel/sched/fair.c:9934:40: sparse: expected struct sched_domain *child kernel/sched/fair.c:9934:40: sparse: got struct sched_domain [noderef] __rcu *child kernel/sched/fair.c:10571:22: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/fair.c:10571:22: sparse: struct task_struct [noderef] __rcu * kernel/sched/fair.c:10571:22: sparse: struct task_struct * kernel/sched/fair.c:12012:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:12012:9: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:12012:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:11669:44: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected struct sched_domain *sd_parent @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:11669:44: sparse: expected struct sched_domain *sd_parent kernel/sched/fair.c:11669:44: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c:12108:9: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected struct sched_domain *[assigned] sd @@ got struct sched_domain [noderef] __rcu *parent @@ kernel/sched/fair.c:12108:9: sparse: expected struct sched_domain *[assigned] sd kernel/sched/fair.c:12108:9: sparse: got struct sched_domain [noderef] __rcu *parent kernel/sched/fair.c: note: in included file (through include/linux/mmzone.h, include/linux/gfp.h, include/linux/xarray.h, ...): include/linux/page-flags.h:242:46: sparse: sparse: self-comparison always evaluates to false kernel/sched/fair.c:6555:35: sparse: sparse: marked inline, but without a definition kernel/sched/fair.c: note: in included file: kernel/sched/sched.h:2145:25: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2145:25: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2145:25: sparse: struct task_struct * kernel/sched/sched.h:2309:9: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2309:9: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2309:9: sparse: struct task_struct * kernel/sched/sched.h:2145:25: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2145:25: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2145:25: sparse: struct task_struct * kernel/sched/sched.h:2145:25: sparse: sparse: incompatible types in comparison expression (different address spaces): kernel/sched/sched.h:2145:25: sparse: struct task_struct [noderef] __rcu * kernel/sched/sched.h:2145:25: sparse: struct task_struct * vim +/sysctl_sched_util_low_pct +175 kernel/sched/fair.c 168 169 #ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY 170 /* 171 * Low utilization threshold for CPU 172 * 173 * (default: 85%), units: percentage of CPU utilization) 174 */ > 175 int sysctl_sched_util_low_pct = 85; 176 #endif 177 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/1] CVE-2024-53142
by Liao Chen 12 Dec '24

12 Dec '24

CVE-2024-53142 David Disseldorp (1): initramfs: avoid filename buffer overrun init/initramfs.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS-SP1 0/1] CVE-2024-53142
by Liao Chen 12 Dec '24

12 Dec '24

CVE-2024-53142 David Disseldorp (1): initramfs: avoid filename buffer overrun init/initramfs.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) -- 2.34.1

2 2