- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start
by Wang Liang 29 Nov '24

29 Nov '24

From: Xin Long <lucien.xin(a)gmail.com> stable inclusion from stable-v5.10.227 commit dd70c8a89ef99c3d53127fe19e51ef47c3f860fa category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRCU CVE: CVE-2024-49944 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 8beee4d8dee76b67c75dc91fd8185d91e845c160 ] In sctp_listen_start() invoked by sctp_inet_listen(), it should set the sk_state back to CLOSED if sctp_autobind() fails due to whatever reason. Otherwise, next time when calling sctp_inet_listen(), if sctp_sk(sk)->reuse is already set via setsockopt(SCTP_REUSE_PORT), sctp_sk(sk)->bind_hash will be dereferenced as sk_state is LISTENING, which causes a crash as bind_hash is NULL. KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:sctp_inet_listen+0x7f0/0xa20 net/sctp/socket.c:8617 Call Trace: <TASK> __sys_listen_socket net/socket.c:1883 [inline] __sys_listen+0x1b7/0x230 net/socket.c:1894 __do_sys_listen net/socket.c:1902 [inline] Fixes: 5e8f3f703ae4 ("sctp: simplify sctp listening code") Reported-by: syzbot+f4e0f821e3a3b7cee51d(a)syzkaller.appspotmail.com Signed-off-by: Xin Long <lucien.xin(a)gmail.com> Acked-by: Marcelo Ricardo Leitner <marcelo.leitner(a)gmail.com> Link: https://patch.msgid.link/a93e655b3c153dc8945d7a812e6d8ab0d52b7aa0.172772939… Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/sctp/socket.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/sctp/socket.c b/net/sctp/socket.c index 46fb5840ce82..5ffa7515903b 100644 --- a/net/sctp/socket.c +++ b/net/sctp/socket.c @@ -8282,8 +8282,10 @@ static int sctp_listen_start(struct sock *sk, int backlog) */ inet_sk_set_state(sk, SCTP_SS_LISTENING); if (!ep->base.bind_addr.port) { - if (sctp_autobind(sk)) + if (sctp_autobind(sk)) { + inet_sk_set_state(sk, SCTP_SS_CLOSED); return -EAGAIN; + } } else { if (sctp_get_port(sk, inet_sk(sk)->inet_num)) { inet_sk_set_state(sk, SCTP_SS_CLOSED); -- 2.34.1

2 1

[PATCH OLK-5.10] wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit
by Wang Liang 29 Nov '24

29 Nov '24

From: Toke Høiland-Jørgensen <toke(a)redhat.com> stable inclusion from stable-v5.10.227 commit b02eb7c86ff2ef1411c3095ec8a52b13f68db04f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRA2 CVE: CVE-2024-49938 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 94745807f3ebd379f23865e6dab196f220664179 ] Syzbot points out that skb_trim() has a sanity check on the existing length of the skb, which can be uninitialised in some error paths. The intent here is clearly just to reset the length to zero before resubmitting, so switch to calling __skb_set_length(skb, 0) directly. In addition, __skb_set_length() already contains a call to skb_reset_tail_pointer(), so remove the redundant call. The syzbot report came from ath9k_hif_usb_reg_in_cb(), but there's a similar usage of skb_trim() in ath9k_hif_usb_rx_cb(), change both while we're at it. Reported-by: syzbot+98afa303be379af6cdb2(a)syzkaller.appspotmail.com Signed-off-by: Toke Høiland-Jørgensen <toke(a)redhat.com> Signed-off-by: Kalle Valo <quic_kvalo(a)quicinc.com> Link: https://patch.msgid.link/20240812142447.12328-1-toke@toke.dk Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- drivers/net/wireless/ath/ath9k/hif_usb.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c index e0130beb304d..6c73c0c0b82a 100644 --- a/drivers/net/wireless/ath/ath9k/hif_usb.c +++ b/drivers/net/wireless/ath/ath9k/hif_usb.c @@ -718,8 +718,7 @@ static void ath9k_hif_usb_rx_cb(struct urb *urb) } resubmit: - skb_reset_tail_pointer(skb); - skb_trim(skb, 0); + __skb_set_length(skb, 0); usb_anchor_urb(urb, &hif_dev->rx_submitted); ret = usb_submit_urb(urb, GFP_ATOMIC); @@ -756,8 +755,7 @@ static void ath9k_hif_usb_reg_in_cb(struct urb *urb) case -ESHUTDOWN: goto free_skb; default: - skb_reset_tail_pointer(skb); - skb_trim(skb, 0); + __skb_set_length(skb, 0); goto resubmit; } -- 2.34.1

2 1

[PATCH OLK-5.10] wifi: ath11k: fix array out-of-bound access in SoC stats
by Wang Liang 29 Nov '24

29 Nov '24

From: Karthikeyan Periyasamy <quic_periyasa(a)quicinc.com> stable inclusion from stable-v5.10.227 commit 0f26f26944035ec67546a944f182cbad6577a9c0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYR8M CVE: CVE-2024-49930 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 69f253e46af98af17e3efa3e5dfa72fcb7d1983d ] Currently, the ath11k_soc_dp_stats::hal_reo_error array is defined with a maximum size of DP_REO_DST_RING_MAX. However, the ath11k_dp_process_rx() function access ath11k_soc_dp_stats::hal_reo_error using the REO destination SRNG ring ID, which is incorrect. SRNG ring ID differ from normal ring ID, and this usage leads to out-of-bounds array access. To fix this issue, modify ath11k_dp_process_rx() to use the normal ring ID directly instead of the SRNG ring ID to avoid out-of-bounds array access. Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 Signed-off-by: Karthikeyan Periyasamy <quic_periyasa(a)quicinc.com> Signed-off-by: Kalle Valo <quic_kvalo(a)quicinc.com> Link: https://patch.msgid.link/20240704070811.4186543-3-quic_periyasa@quicinc.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- drivers/net/wireless/ath/ath11k/dp_rx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/ath/ath11k/dp_rx.c b/drivers/net/wireless/ath/ath11k/dp_rx.c index a50325f4634b..89d90be0ba9c 100644 --- a/drivers/net/wireless/ath/ath11k/dp_rx.c +++ b/drivers/net/wireless/ath/ath11k/dp_rx.c @@ -2600,7 +2600,7 @@ int ath11k_dp_process_rx(struct ath11k_base *ab, int ring_id, if (push_reason != HAL_REO_DEST_RING_PUSH_REASON_ROUTING_INSTRUCTION) { dev_kfree_skb_any(msdu); - ab->soc_stats.hal_reo_error[dp->reo_dst_ring[ring_id].ring_id]++; + ab->soc_stats.hal_reo_error[ring_id]++; continue; } -- 2.34.1

2 1

[openeuler:OLK-6.6 1484/1484] drivers/md/dm-cache-metadata.c:1729:9: warning: 'strncpy' specified bound 16 equals destination size
by kernel test robot 29 Nov '24

29 Nov '24

Hi Feiyang, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 95bc69473a373c2e578d4fc39734e5811a03ead3 commit: 2363088eba2ecccfb643725e4864af73c4226a04 [1484/1484] LoongArch: Allow building with kcov coverage config: loongarch-randconfig-001-20241119 (https://download.01.org/0day-ci/archive/20241129/202411291031.9VhI0eVO-lkp@…) compiler: loongarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241129/202411291031.9VhI0eVO-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411291031.9VhI0eVO-lkp@intel.com/ All warnings (new ones prefixed by >>): In function 'write_hints', inlined from 'dm_cache_write_hints' at drivers/md/dm-cache-metadata.c:1753:6: >> drivers/md/dm-cache-metadata.c:1729:9: warning: 'strncpy' specified bound 16 equals destination size [-Wstringop-truncation] 1729 | strncpy(cmd->policy_name, policy_name, sizeof(cmd->policy_name)); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +/strncpy +1729 drivers/md/dm-cache-metadata.c 4e781b498ee500 Joe Thornber 2016-09-15 1713 4e781b498ee500 Joe Thornber 2016-09-15 1714 /* 4e781b498ee500 Joe Thornber 2016-09-15 1715 * It's quicker to always delete the hint array, and recreate with 4e781b498ee500 Joe Thornber 2016-09-15 1716 * dm_array_new(). 4e781b498ee500 Joe Thornber 2016-09-15 1717 */ 4e781b498ee500 Joe Thornber 2016-09-15 1718 static int write_hints(struct dm_cache_metadata *cmd, struct dm_cache_policy *policy) c6b4fcbad044e6 Joe Thornber 2013-03-01 1719 { c6b4fcbad044e6 Joe Thornber 2013-03-01 1720 int r; c6b4fcbad044e6 Joe Thornber 2013-03-01 1721 size_t hint_size; c6b4fcbad044e6 Joe Thornber 2013-03-01 1722 const char *policy_name = dm_cache_policy_get_name(policy); 86a3238c7b9b75 Heinz Mauelshagen 2023-01-25 1723 const unsigned int *policy_version = dm_cache_policy_get_version(policy); c6b4fcbad044e6 Joe Thornber 2013-03-01 1724 c6b4fcbad044e6 Joe Thornber 2013-03-01 1725 if (!policy_name[0] || c6b4fcbad044e6 Joe Thornber 2013-03-01 1726 (strlen(policy_name) > sizeof(cmd->policy_name) - 1)) c6b4fcbad044e6 Joe Thornber 2013-03-01 1727 return -EINVAL; c6b4fcbad044e6 Joe Thornber 2013-03-01 1728 c6b4fcbad044e6 Joe Thornber 2013-03-01 @1729 strncpy(cmd->policy_name, policy_name, sizeof(cmd->policy_name)); 4e7f506f642963 Mike Snitzer 2013-03-20 1730 memcpy(cmd->policy_version, policy_version, sizeof(cmd->policy_version)); c6b4fcbad044e6 Joe Thornber 2013-03-01 1731 c6b4fcbad044e6 Joe Thornber 2013-03-01 1732 hint_size = dm_cache_policy_get_hint_size(policy); c6b4fcbad044e6 Joe Thornber 2013-03-01 1733 if (!hint_size) c6b4fcbad044e6 Joe Thornber 2013-03-01 1734 return 0; /* short-circuit hints initialization */ c6b4fcbad044e6 Joe Thornber 2013-03-01 1735 cmd->policy_hint_size = hint_size; c6b4fcbad044e6 Joe Thornber 2013-03-01 1736 c6b4fcbad044e6 Joe Thornber 2013-03-01 1737 if (cmd->hint_root) { c6b4fcbad044e6 Joe Thornber 2013-03-01 1738 r = dm_array_del(&cmd->hint_info, cmd->hint_root); c6b4fcbad044e6 Joe Thornber 2013-03-01 1739 if (r) c6b4fcbad044e6 Joe Thornber 2013-03-01 1740 return r; c6b4fcbad044e6 Joe Thornber 2013-03-01 1741 } c6b4fcbad044e6 Joe Thornber 2013-03-01 1742 4e781b498ee500 Joe Thornber 2016-09-15 1743 return dm_array_new(&cmd->hint_info, &cmd->hint_root, c6b4fcbad044e6 Joe Thornber 2013-03-01 1744 from_cblock(cmd->cache_blocks), 4e781b498ee500 Joe Thornber 2016-09-15 1745 get_hint, policy); 0596661f0a16d9 Joe Thornber 2014-04-03 1746 } 0596661f0a16d9 Joe Thornber 2014-04-03 1747 :::::: The code at line 1729 was first introduced by commit :::::: c6b4fcbad044e6fffcc75bba160e720eb8d67d17 dm: add cache target :::::: TO: Joe Thornber <ejt(a)redhat.com> :::::: CC: Alasdair G Kergon <agk(a)redhat.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] genirq/proc: Fix warning of no previous prototype for register_irqchip_proc()
by Jinjie Ruan 29 Nov '24

29 Nov '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/release-management/issues/IB6JLE -------------------------------- Fix the following warnings by add the proper header. kernel/irq/proc.c:334:13: warning: no previous prototype for function 'register_irqchip_proc' [-Wmissing-prototypes] 334 | void __weak register_irqchip_proc(struct irq_desc *desc, void *irqp) { } | ^ kernel/irq/proc.c:334:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 334 | void __weak register_irqchip_proc(struct irq_desc *desc, void *irqp) { } | ^ | static kernel/irq/proc.c:335:13: warning: no previous prototype for function 'unregister_irqchip_proc' [-Wmissing-prototypes] 335 | void __weak unregister_irqchip_proc(struct irq_desc *desc) { } | ^ kernel/irq/proc.c:335:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 335 | void __weak unregister_irqchip_proc(struct irq_desc *desc) { } | ^ | static 2 warnings generated. Fixes: 3053668e6b21 ("arm64: Introduce Xint software solution") Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- kernel/irq/proc.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/kernel/irq/proc.c b/kernel/irq/proc.c index 0fdfde11ab81..2bb1769cf432 100644 --- a/kernel/irq/proc.c +++ b/kernel/irq/proc.c @@ -13,6 +13,10 @@ #include <linux/kernel_stat.h> #include <linux/mutex.h> +#ifdef CONFIG_FAST_IRQ +#include <linux/irqchip/arm-gic-v3.h> +#endif + #include "internals.h" /* -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/2] CVE-2024-50236
by Wang Liang 29 Nov '24

29 Nov '24

Manikanta Pubbisetty (1): wifi: ath10k: Fix memory leak in management tx Rakesh Pillai (1): ath10k: Remove msdu from idr when management pkt send fails drivers/net/wireless/ath/ath10k/mac.c | 3 +++ drivers/net/wireless/ath/ath10k/wmi-ops.h | 10 ++++++++++ drivers/net/wireless/ath/ath10k/wmi-tlv.c | 20 ++++++++++++++++++++ drivers/net/wireless/ath/ath10k/wmi.c | 2 ++ 4 files changed, 35 insertions(+) -- 2.34.1

2 3

[PATCH openEuler-22.03-LTS-SP1] wifi: ath10k: Fix memory leak in management tx
by Wang Liang 29 Nov '24

29 Nov '24

From: Manikanta Pubbisetty <quic_mpubbise(a)quicinc.com> stable inclusion from stable-v5.10.229 commit 4112450da7d67b59ccedc2208bae622db17dbcb8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB37AQ CVE: CVE-2024-50236 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e15d84b3bba187aa372dff7c58ce1fd5cb48a076 upstream. In the current logic, memory is allocated for storing the MSDU context during management packet TX but this memory is not being freed during management TX completion. Similar leaks are seen in the management TX cleanup logic. Kmemleak reports this problem as below, unreferenced object 0xffffff80b64ed250 (size 16): comm "kworker/u16:7", pid 148, jiffies 4294687130 (age 714.199s) hex dump (first 16 bytes): 00 2b d8 d8 80 ff ff ff c4 74 e9 fd 07 00 00 00 .+.......t...... backtrace: [<ffffffe6e7b245dc>] __kmem_cache_alloc_node+0x1e4/0x2d8 [<ffffffe6e7adde88>] kmalloc_trace+0x48/0x110 [<ffffffe6bbd765fc>] ath10k_wmi_tlv_op_gen_mgmt_tx_send+0xd4/0x1d8 [ath10k_core] [<ffffffe6bbd3eed4>] ath10k_mgmt_over_wmi_tx_work+0x134/0x298 [ath10k_core] [<ffffffe6e78d5974>] process_scheduled_works+0x1ac/0x400 [<ffffffe6e78d60b8>] worker_thread+0x208/0x328 [<ffffffe6e78dc890>] kthread+0x100/0x1c0 [<ffffffe6e78166c0>] ret_from_fork+0x10/0x20 Free the memory during completion and cleanup to fix the leak. Protect the mgmt_pending_tx idr_remove() operation in ath10k_wmi_tlv_op_cleanup_mgmt_tx_send() using ar->data_lock similar to other instances. Tested-on: WCN3990 hw1.0 SNOC WLAN.HL.2.0-01387-QCAHLSWMTPLZ-1 Fixes: dc405152bb64 ("ath10k: handle mgmt tx completion event") Fixes: c730c477176a ("ath10k: Remove msdu from idr when management pkt send fails") Cc: stable(a)vger.kernel.org Signed-off-by: Manikanta Pubbisetty <quic_mpubbise(a)quicinc.com> Link: https://patch.msgid.link/20241015064103.6060-1-quic_mpubbise@quicinc.com Signed-off-by: Jeff Johnson <quic_jjohnson(a)quicinc.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- drivers/net/wireless/ath/ath10k/wmi-tlv.c | 7 ++++++- drivers/net/wireless/ath/ath10k/wmi.c | 2 ++ 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c index 0eeb74245372..7e65788238bb 100644 --- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c +++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c @@ -3035,9 +3035,14 @@ ath10k_wmi_tlv_op_cleanup_mgmt_tx_send(struct ath10k *ar, struct sk_buff *msdu) { struct ath10k_skb_cb *cb = ATH10K_SKB_CB(msdu); + struct ath10k_mgmt_tx_pkt_addr *pkt_addr; struct ath10k_wmi *wmi = &ar->wmi; - idr_remove(&wmi->mgmt_pending_tx, cb->msdu_id); + spin_lock_bh(&ar->data_lock); + pkt_addr = idr_remove(&wmi->mgmt_pending_tx, cb->msdu_id); + spin_unlock_bh(&ar->data_lock); + + kfree(pkt_addr); return 0; } diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c index 85fe855ece09..77bd00d933c0 100644 --- a/drivers/net/wireless/ath/ath10k/wmi.c +++ b/drivers/net/wireless/ath/ath10k/wmi.c @@ -2420,6 +2420,7 @@ wmi_process_mgmt_tx_comp(struct ath10k *ar, struct mgmt_tx_compl_params *param) dma_unmap_single(ar->dev, pkt_addr->paddr, msdu->len, DMA_TO_DEVICE); info = IEEE80211_SKB_CB(msdu); + kfree(pkt_addr); if (param->status) { info->flags &= ~IEEE80211_TX_STAT_ACK; @@ -9561,6 +9562,7 @@ static int ath10k_wmi_mgmt_tx_clean_up_pending(int msdu_id, void *ptr, dma_unmap_single(ar->dev, pkt_addr->paddr, msdu->len, DMA_TO_DEVICE); ieee80211_free_txskb(ar->hw, msdu); + kfree(pkt_addr); return 0; } -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages
by Wang Liang 29 Nov '24

29 Nov '24

From: Bhargava Chenna Marreddy <bhargava.marreddy(a)broadcom.com> stable inclusion from stable-v5.10.229 commit df6fed0a2a1a5e57f033bca40dc316b18e0d0ce6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2YUP CVE: CVE-2024-50208 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 7988bdbbb85ac85a847baf09879edcd0f70521dc ] Avoid memory corruption while setting up Level-2 PBL pages for the non MR resources when num_pages > 256K. There will be a single PDE page address (contiguous pages in the case of > PAGE_SIZE), but, current logic assumes multiple pages, leading to invalid memory access after 256K PBL entries in the PDE. Fixes: 0c4dcd602817 ("RDMA/bnxt_re: Refactor hardware queue memory allocation") Link: https://patch.msgid.link/r/1728373302-19530-10-git-send-email-selvin.xavier… Signed-off-by: Bhargava Chenna Marreddy <bhargava.marreddy(a)broadcom.com> Signed-off-by: Selvin Xavier <selvin.xavier(a)broadcom.com> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- drivers/infiniband/hw/bnxt_re/qplib_res.c | 19 +++---------------- 1 file changed, 3 insertions(+), 16 deletions(-) diff --git a/drivers/infiniband/hw/bnxt_re/qplib_res.c b/drivers/infiniband/hw/bnxt_re/qplib_res.c index a9c2359b0d07..1e965b2edd82 100644 --- a/drivers/infiniband/hw/bnxt_re/qplib_res.c +++ b/drivers/infiniband/hw/bnxt_re/qplib_res.c @@ -262,22 +262,9 @@ int bnxt_qplib_alloc_init_hwq(struct bnxt_qplib_hwq *hwq, dst_virt_ptr = (dma_addr_t **)hwq->pbl[PBL_LVL_0].pg_arr; src_phys_ptr = hwq->pbl[PBL_LVL_1].pg_map_arr; - if (hwq_attr->type == HWQ_TYPE_MR) { - /* For MR it is expected that we supply only 1 contigous - * page i.e only 1 entry in the PDL that will contain - * all the PBLs for the user supplied memory region - */ - for (i = 0; i < hwq->pbl[PBL_LVL_1].pg_count; - i++) - dst_virt_ptr[0][i] = src_phys_ptr[i] | - flag; - } else { - for (i = 0; i < hwq->pbl[PBL_LVL_1].pg_count; - i++) - dst_virt_ptr[PTR_PG(i)][PTR_IDX(i)] = - src_phys_ptr[i] | - PTU_PDE_VALID; - } + for (i = 0; i < hwq->pbl[PBL_LVL_1].pg_count; i++) + dst_virt_ptr[0][i] = src_phys_ptr[i] | flag; + /* Alloc or init PTEs */ rc = __alloc_pbl(res, &hwq->pbl[PBL_LVL_2], hwq_attr->sginfo); -- 2.34.1

2 1

[PATCH OLK-5.10] wifi: ath10k: Fix memory leak in management tx
by Wang Liang 29 Nov '24

29 Nov '24

From: Manikanta Pubbisetty <quic_mpubbise(a)quicinc.com> stable inclusion from stable-v5.10.229 commit 4112450da7d67b59ccedc2208bae622db17dbcb8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB37AQ CVE: CVE-2024-50236 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e15d84b3bba187aa372dff7c58ce1fd5cb48a076 upstream. In the current logic, memory is allocated for storing the MSDU context during management packet TX but this memory is not being freed during management TX completion. Similar leaks are seen in the management TX cleanup logic. Kmemleak reports this problem as below, unreferenced object 0xffffff80b64ed250 (size 16): comm "kworker/u16:7", pid 148, jiffies 4294687130 (age 714.199s) hex dump (first 16 bytes): 00 2b d8 d8 80 ff ff ff c4 74 e9 fd 07 00 00 00 .+.......t...... backtrace: [<ffffffe6e7b245dc>] __kmem_cache_alloc_node+0x1e4/0x2d8 [<ffffffe6e7adde88>] kmalloc_trace+0x48/0x110 [<ffffffe6bbd765fc>] ath10k_wmi_tlv_op_gen_mgmt_tx_send+0xd4/0x1d8 [ath10k_core] [<ffffffe6bbd3eed4>] ath10k_mgmt_over_wmi_tx_work+0x134/0x298 [ath10k_core] [<ffffffe6e78d5974>] process_scheduled_works+0x1ac/0x400 [<ffffffe6e78d60b8>] worker_thread+0x208/0x328 [<ffffffe6e78dc890>] kthread+0x100/0x1c0 [<ffffffe6e78166c0>] ret_from_fork+0x10/0x20 Free the memory during completion and cleanup to fix the leak. Protect the mgmt_pending_tx idr_remove() operation in ath10k_wmi_tlv_op_cleanup_mgmt_tx_send() using ar->data_lock similar to other instances. Tested-on: WCN3990 hw1.0 SNOC WLAN.HL.2.0-01387-QCAHLSWMTPLZ-1 Fixes: dc405152bb64 ("ath10k: handle mgmt tx completion event") Fixes: c730c477176a ("ath10k: Remove msdu from idr when management pkt send fails") Cc: stable(a)vger.kernel.org Signed-off-by: Manikanta Pubbisetty <quic_mpubbise(a)quicinc.com> Link: https://patch.msgid.link/20241015064103.6060-1-quic_mpubbise@quicinc.com Signed-off-by: Jeff Johnson <quic_jjohnson(a)quicinc.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- drivers/net/wireless/ath/ath10k/wmi-tlv.c | 7 ++++++- drivers/net/wireless/ath/ath10k/wmi.c | 2 ++ 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c index 0eeb74245372..7e65788238bb 100644 --- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c +++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c @@ -3035,9 +3035,14 @@ ath10k_wmi_tlv_op_cleanup_mgmt_tx_send(struct ath10k *ar, struct sk_buff *msdu) { struct ath10k_skb_cb *cb = ATH10K_SKB_CB(msdu); + struct ath10k_mgmt_tx_pkt_addr *pkt_addr; struct ath10k_wmi *wmi = &ar->wmi; - idr_remove(&wmi->mgmt_pending_tx, cb->msdu_id); + spin_lock_bh(&ar->data_lock); + pkt_addr = idr_remove(&wmi->mgmt_pending_tx, cb->msdu_id); + spin_unlock_bh(&ar->data_lock); + + kfree(pkt_addr); return 0; } diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c index 85fe855ece09..77bd00d933c0 100644 --- a/drivers/net/wireless/ath/ath10k/wmi.c +++ b/drivers/net/wireless/ath/ath10k/wmi.c @@ -2420,6 +2420,7 @@ wmi_process_mgmt_tx_comp(struct ath10k *ar, struct mgmt_tx_compl_params *param) dma_unmap_single(ar->dev, pkt_addr->paddr, msdu->len, DMA_TO_DEVICE); info = IEEE80211_SKB_CB(msdu); + kfree(pkt_addr); if (param->status) { info->flags &= ~IEEE80211_TX_STAT_ACK; @@ -9561,6 +9562,7 @@ static int ath10k_wmi_mgmt_tx_clean_up_pending(int msdu_id, void *ptr, dma_unmap_single(ar->dev, pkt_addr->paddr, msdu->len, DMA_TO_DEVICE); ieee80211_free_txskb(ar->hw, msdu); + kfree(pkt_addr); return 0; } -- 2.34.1

2 1

[PATCH OLK-5.10] RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages
by Wang Liang 29 Nov '24

29 Nov '24

From: Bhargava Chenna Marreddy <bhargava.marreddy(a)broadcom.com> stable inclusion from stable-v5.10.229 commit df6fed0a2a1a5e57f033bca40dc316b18e0d0ce6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2YUP CVE: CVE-2024-50208 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 7988bdbbb85ac85a847baf09879edcd0f70521dc ] Avoid memory corruption while setting up Level-2 PBL pages for the non MR resources when num_pages > 256K. There will be a single PDE page address (contiguous pages in the case of > PAGE_SIZE), but, current logic assumes multiple pages, leading to invalid memory access after 256K PBL entries in the PDE. Fixes: 0c4dcd602817 ("RDMA/bnxt_re: Refactor hardware queue memory allocation") Link: https://patch.msgid.link/r/1728373302-19530-10-git-send-email-selvin.xavier… Signed-off-by: Bhargava Chenna Marreddy <bhargava.marreddy(a)broadcom.com> Signed-off-by: Selvin Xavier <selvin.xavier(a)broadcom.com> Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- drivers/infiniband/hw/bnxt_re/qplib_res.c | 19 +++---------------- 1 file changed, 3 insertions(+), 16 deletions(-) diff --git a/drivers/infiniband/hw/bnxt_re/qplib_res.c b/drivers/infiniband/hw/bnxt_re/qplib_res.c index e36a5c71a85b..53ddd4b37851 100644 --- a/drivers/infiniband/hw/bnxt_re/qplib_res.c +++ b/drivers/infiniband/hw/bnxt_re/qplib_res.c @@ -254,22 +254,9 @@ int bnxt_qplib_alloc_init_hwq(struct bnxt_qplib_hwq *hwq, dst_virt_ptr = (dma_addr_t **)hwq->pbl[PBL_LVL_0].pg_arr; src_phys_ptr = hwq->pbl[PBL_LVL_1].pg_map_arr; - if (hwq_attr->type == HWQ_TYPE_MR) { - /* For MR it is expected that we supply only 1 contigous - * page i.e only 1 entry in the PDL that will contain - * all the PBLs for the user supplied memory region - */ - for (i = 0; i < hwq->pbl[PBL_LVL_1].pg_count; - i++) - dst_virt_ptr[0][i] = src_phys_ptr[i] | - flag; - } else { - for (i = 0; i < hwq->pbl[PBL_LVL_1].pg_count; - i++) - dst_virt_ptr[PTR_PG(i)][PTR_IDX(i)] = - src_phys_ptr[i] | - PTU_PDE_VALID; - } + for (i = 0; i < hwq->pbl[PBL_LVL_1].pg_count; i++) + dst_virt_ptr[0][i] = src_phys_ptr[i] | flag; + /* Alloc or init PTEs */ rc = __alloc_pbl(res, &hwq->pbl[PBL_LVL_2], hwq_attr->sginfo); -- 2.34.1

2 1