- Kernel - mailweb.openeuler.org

[openeuler:openEuler-1.0-LTS 1343/1343] drivers/iommu/iommu.c:979:31: sparse: sparse: dubious: !x | !y
by kernel test robot 24 Dec '24

24 Dec '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 5a23f5b9f615aef1973a9e3894d42c2ddd7364b3 commit: ac084b72b429b1bc0378add3abecfe107a732b7a [1343/1343] iommu: introduce device fault report API config: arm64-randconfig-r113-20241223 (https://download.01.org/0day-ci/archive/20241224/202412242131.GLZuoZe5-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20241224/202412242131.GLZuoZe5-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412242131.GLZuoZe5-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/iommu/iommu.c:979:31: sparse: sparse: dubious: !x | !y drivers/iommu/iommu.c: In function 'iommu_unregister_device_fault_handler': drivers/iommu/iommu.c:937:13: warning: variable 'ret' set but not used [-Wunused-but-set-variable] 937 | int ret = 0; | ^~~ In file included from arch/arm64/include/asm/atomic.h:34, from include/linux/atomic.h:7, from include/asm-generic/bitops/atomic.h:5, from arch/arm64/include/asm/bitops.h:37, from include/linux/bitops.h:19, from include/linux/kernel.h:11, from include/linux/list.h:9, from include/linux/kobject.h:20, from include/linux/device.h:17, from drivers/iommu/iommu.c:21: In function '__cmpxchg_case_acq_4', inlined from '__cmpxchg_acq' at arch/arm64/include/asm/cmpxchg.h:141:1, inlined from 'queued_spin_lock' at include/asm-generic/qspinlock.h:85:8, inlined from 'do_raw_spin_lock' at include/linux/spinlock.h:180:2, inlined from '__raw_spin_lock' at include/linux/spinlock_api_smp.h:143:2, inlined from 'spin_lock' at include/linux/spinlock.h:329:2, inlined from 'iommu_device_register' at drivers/iommu/iommu.c:101:2: arch/arm64/include/asm/atomic_lse.h:458:9: warning: array subscript 'long unsigned int[0]' is partly outside array bounds of 'spinlock_t[1]' {aka 'struct spinlock[1]'} [-Warray-bounds=] 458 | asm volatile(ARM64_LSE_ATOMIC_INSN( 25- | ^~~ arch/arm64/include/asm/atomic_lse.h:479:1: note: in expansion of macro '__CMPXCHG_CASE' 479 | __CMPXCHG_CASE(w, , acq_4, a, "memory") | ^~~~~~~~~~~~~~ In file included from include/linux/mutex.h:16, from include/linux/kernfs.h:14, from include/linux/sysfs.h:16, from include/linux/kobject.h:21: drivers/iommu/iommu.c: In function 'iommu_device_register': drivers/iommu/iommu.c:97:24: note: object 'iommu_device_lock' of size 4 97 | static DEFINE_SPINLOCK(iommu_device_lock); | ^~~~~~~~~~~~~~~~~ include/linux/spinlock_types.h:81:44: note: in definition of macro 'DEFINE_SPINLOCK' 81 | #define DEFINE_SPINLOCK(x) spinlock_t x = __SPIN_LOCK_UNLOCKED(x) | ^ In function '__cmpxchg_case_acq_4', inlined from '__cmpxchg_acq' at arch/arm64/include/asm/cmpxchg.h:141:1, inlined from 'queued_spin_lock' at include/asm-generic/qspinlock.h:85:8, inlined from 'do_raw_spin_lock' at include/linux/spinlock.h:180:2, inlined from '__raw_spin_lock' at include/linux/spinlock_api_smp.h:143:2, inlined from 'spin_lock' at include/linux/spinlock.h:329:2, inlined from 'iommu_device_register' at drivers/iommu/iommu.c:101:2: arch/arm64/include/asm/atomic_lse.h:458:9: warning: array subscript 'long unsigned int[0]' is partly outside array bounds of 'spinlock_t[1]' {aka 'struct spinlock[1]'} [-Warray-bounds=] 458 | asm volatile(ARM64_LSE_ATOMIC_INSN( 49- | ^~~ arch/arm64/include/asm/atomic_lse.h:479:1: note: in expansion of macro '__CMPXCHG_CASE' 479 | __CMPXCHG_CASE(w, , acq_4, a, "memory") | ^~~~~~~~~~~~~~ drivers/iommu/iommu.c: In function 'iommu_device_register': drivers/iommu/iommu.c:97:24: note: object 'iommu_device_lock' of size 4 97 | static DEFINE_SPINLOCK(iommu_device_lock); | ^~~~~~~~~~~~~~~~~ include/linux/spinlock_types.h:81:44: note: in definition of macro 'DEFINE_SPINLOCK' 81 | #define DEFINE_SPINLOCK(x) spinlock_t x = __SPIN_LOCK_UNLOCKED(x) | ^ In function '__cmpxchg_case_acq_4', inlined from '__cmpxchg_acq' at arch/arm64/include/asm/cmpxchg.h:141:1, inlined from 'queued_spin_lock' at include/asm-generic/qspinlock.h:85:8, inlined from 'do_raw_spin_lock' at include/linux/spinlock.h:180:2, inlined from '__raw_spin_lock' at include/linux/spinlock_api_smp.h:143:2, inlined from 'spin_lock' at include/linux/spinlock.h:329:2, inlined from 'iommu_device_unregister' at drivers/iommu/iommu.c:110:2: arch/arm64/include/asm/atomic_lse.h:458:9: warning: array subscript 'long unsigned int[0]' is partly outside array bounds of 'spinlock_t[1]' {aka 'struct spinlock[1]'} [-Warray-bounds=] 458 | asm volatile(ARM64_LSE_ATOMIC_INSN( 69- | ^~~ arch/arm64/include/asm/atomic_lse.h:479:1: note: in expansion of macro '__CMPXCHG_CASE' 479 | __CMPXCHG_CASE(w, , acq_4, a, "memory") | ^~~~~~~~~~~~~~ drivers/iommu/iommu.c: In function 'iommu_device_unregister': drivers/iommu/iommu.c:97:24: note: object 'iommu_device_lock' of size 4 97 | static DEFINE_SPINLOCK(iommu_device_lock); | ^~~~~~~~~~~~~~~~~ include/linux/spinlock_types.h:81:44: note: in definition of macro 'DEFINE_SPINLOCK' 81 | #define DEFINE_SPINLOCK(x) spinlock_t x = __SPIN_LOCK_UNLOCKED(x) | ^ In function '__cmpxchg_case_acq_4', inlined from '__cmpxchg_acq' at arch/arm64/include/asm/cmpxchg.h:141:1, inlined from 'queued_spin_lock' at include/asm-generic/qspinlock.h:85:8, inlined from 'do_raw_spin_lock' at include/linux/spinlock.h:180:2, inlined from '__raw_spin_lock' at include/linux/spinlock_api_smp.h:143:2, inlined from 'spin_lock' at include/linux/spinlock.h:329:2, inlined from 'iommu_device_unregister' at drivers/iommu/iommu.c:110:2: arch/arm64/include/asm/atomic_lse.h:458:9: warning: array subscript 'long unsigned int[0]' is partly outside array bounds of 'spinlock_t[1]' {aka 'struct spinlock[1]'} [-Warray-bounds=] 458 | asm volatile(ARM64_LSE_ATOMIC_INSN( 89- | ^~~ arch/arm64/include/asm/atomic_lse.h:479:1: note: in expansion of macro '__CMPXCHG_CASE' 479 | __CMPXCHG_CASE(w, , acq_4, a, "memory") | ^~~~~~~~~~~~~~ drivers/iommu/iommu.c: In function 'iommu_device_unregister': drivers/iommu/iommu.c:97:24: note: object 'iommu_device_lock' of size 4 97 | static DEFINE_SPINLOCK(iommu_device_lock); | ^~~~~~~~~~~~~~~~~ include/linux/spinlock_types.h:81:44: note: in definition of macro 'DEFINE_SPINLOCK' 81 | #define DEFINE_SPINLOCK(x) spinlock_t x = __SPIN_LOCK_UNLOCKED(x) | ^ In function '__cmpxchg_case_acq_4', inlined from '__cmpxchg_acq' at arch/arm64/include/asm/cmpxchg.h:141:1, vim +979 drivers/iommu/iommu.c 960 961 962 /** 963 * iommu_report_device_fault() - Report fault event to device 964 * @dev: the device 965 * @evt: fault event data 966 * 967 * Called by IOMMU model specific drivers when fault is detected, typically 968 * in a threaded IRQ handler. 969 * 970 * Return 0 on success, or an error. 971 */ 972 int iommu_report_device_fault(struct device *dev, struct iommu_fault_event *evt) 973 { 974 int ret = 0; 975 struct iommu_fault_event *evt_pending; 976 struct iommu_fault_param *fparam; 977 978 /* iommu_param is allocated when device is added to group */ > 979 if (!dev->iommu_param | !evt) 980 return -EINVAL; 981 /* we only report device fault if there is a handler registered */ 982 mutex_lock(&dev->iommu_param->lock); 983 if (!dev->iommu_param->fault_param || 984 !dev->iommu_param->fault_param->handler) { 985 ret = -EINVAL; 986 goto done_unlock; 987 } 988 fparam = dev->iommu_param->fault_param; 989 if (evt->type == IOMMU_FAULT_PAGE_REQ && evt->last_req) { 990 evt_pending = kzalloc(sizeof(*evt_pending), GFP_ATOMIC); 991 if (!evt_pending) { 992 ret = -ENOMEM; 993 goto done_unlock; 994 } 995 memcpy(evt_pending, evt, sizeof(struct iommu_fault_event)); 996 mutex_lock(&fparam->lock); 997 list_add_tail(&evt_pending->list, &fparam->faults); 998 mutex_unlock(&fparam->lock); 999 } 1000 ret = fparam->handler(evt, fparam->data); 1001 done_unlock: 1002 mutex_unlock(&dev->iommu_param->lock); 1003 return ret; 1004 } 1005 EXPORT_SYMBOL_GPL(iommu_report_device_fault); 1006 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] dhugetlb: keep refcount to 0 while page is actually free in pool
by Liu Shixin 24 Dec '24

24 Dec '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBDF90 -------------------------------- While we split/merge page in dynamic pool, the refcount of page may be increased to 1 due to prep_new_page(), and we then set the refcount to 0. That means there's a time window that the refcount of the free page is not 0. split_huge_pages_set() will scan all pages and try to get the refcount If try to get refcount in the above time window and put_page() after the refcount is set to 0, the refcount will be decreased to -1. It's dangerous if the refcount for page is not 0 when split/merge, so try not to get refcount there. Fixes: 0bc0d0d57eda ("dhugetlb: backport dynamic hugetlb feature") Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- mm/hugetlb.c | 4 ++-- mm/internal.h | 4 ++++ mm/page_alloc.c | 26 ++++++++++++++++++++++++++ 3 files changed, 32 insertions(+), 2 deletions(-) diff --git a/mm/hugetlb.c b/mm/hugetlb.c index 82a758bb8ac9..191ed8a6b0d0 100644 --- a/mm/hugetlb.c +++ b/mm/hugetlb.c @@ -3575,8 +3575,8 @@ static void add_new_huge_page_to_pool(struct dhugetlb_pool *hpool, list_add_tail(&page->lru, &hpool->dhugetlb_1G_freelists); hpool->free_unreserved_1G++; } else { - prep_new_page(page, PMD_SHIFT - PAGE_SHIFT, __GFP_COMP, 0); - set_page_count(page, 0); + prep_new_frozen_free_page(page, PMD_SHIFT - PAGE_SHIFT, + __GFP_COMP); list_add_tail(&page->lru, &hpool->dhugetlb_2M_freelists); hpool->free_unreserved_2M++; } diff --git a/mm/internal.h b/mm/internal.h index 72f77379b58f..e50363ddb416 100644 --- a/mm/internal.h +++ b/mm/internal.h @@ -185,6 +185,10 @@ extern void prep_compound_page(struct page *page, unsigned int order); extern int check_new_page(struct page *page); extern void post_alloc_hook(struct page *page, unsigned int order, gfp_t gfp_flags); +#ifdef CONFIG_DYNAMIC_HUGETLB +extern void prep_new_frozen_free_page(struct page *page, unsigned int order, + gfp_t gfp_flags); +#endif extern int user_min_free_kbytes; #if defined CONFIG_COMPACTION || defined CONFIG_CMA diff --git a/mm/page_alloc.c b/mm/page_alloc.c index e2360fe3616d..787bbabc29d0 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -2100,6 +2100,32 @@ void prep_new_page(struct page *page, unsigned int order, gfp_t gfp_flags, clear_page_pfmemalloc(page); } +#ifdef CONFIG_DYNAMIC_HUGETLB +/* Similar with prep_new_page without set refcount to 1 */ +void prep_new_frozen_free_page(struct page *page, unsigned int order, + gfp_t gfp_flags) +{ + int i; + + set_page_private(page, 0); + + arch_alloc_page(page, order); + kernel_map_pages(page, 1 << order, 1); + kasan_alloc_pages(page, order); + kernel_poison_pages(page, 1 << order, 1); + set_page_owner(page, order, gfp_flags); + + if (!free_pages_prezeroed() && (gfp_flags & __GFP_ZERO)) + for (i = 0; i < (1 << order); i++) + clear_highpage(page + i); + + if (order && (gfp_flags & __GFP_COMP)) + prep_compound_page(page, order); + + clear_page_pfmemalloc(page); +} +#endif + /* * Go through the free lists for the given migratetype and remove * the smallest available page from the freelists -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] ACPI: battery: Fix possible crash when unregistering a battery hook
by Heyuan Wang 24 Dec '24

24 Dec '24

From: Armin Wolf <W_Armin(a)gmx.de> stable inclusion from stable-v4.19.323 commit 76fb2cbf01571926da8ecf6876cc8cb07d3f5183 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBBN6V Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------------------- [ Upstream commit 76959aff14a0012ad6b984ec7686d163deccdc16 ] When a battery hook returns an error when adding a new battery, then the battery hook is automatically unregistered. However the battery hook provider cannot know that, so it will later call battery_hook_unregister() on the already unregistered battery hook, resulting in a crash. Fix this by using the list head to mark already unregistered battery hooks as already being unregistered so that they can be ignored by battery_hook_unregister(). Fixes: fa93854f7a7e ("battery: Add the battery hooking API") Signed-off-by: Armin Wolf <W_Armin(a)gmx.de> Link: https://patch.msgid.link/20241001212835.341788-3-W_Armin@gmx.de Cc: All applicable <stable(a)vger.kernel.org> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Heyuan Wang <wangheyuan2(a)h-partners.com> --- drivers/acpi/battery.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c index b741ed87ab3d..46aa0e5e6f8b 100644 --- a/drivers/acpi/battery.c +++ b/drivers/acpi/battery.c @@ -724,7 +724,7 @@ static void battery_hook_unregister_unlocked(struct acpi_battery_hook *hook) list_for_each_entry(battery, &acpi_battery_list, list) { hook->remove_battery(battery->bat); } - list_del(&hook->list); + list_del_init(&hook->list); pr_info("extension unregistered: %s\n", hook->name); } @@ -732,7 +732,14 @@ static void battery_hook_unregister_unlocked(struct acpi_battery_hook *hook) void battery_hook_unregister(struct acpi_battery_hook *hook) { mutex_lock(&hook_mutex); - battery_hook_unregister_unlocked(hook); + /* + * Ignore already unregistered battery hooks. This might happen + * if a battery hook was previously unloaded due to an error when + * adding a new battery. + */ + if (!list_empty(&hook->list)) + battery_hook_unregister_unlocked(hook); + mutex_unlock(&hook_mutex); } EXPORT_SYMBOL_GPL(battery_hook_unregister); @@ -742,7 +749,6 @@ void battery_hook_register(struct acpi_battery_hook *hook) struct acpi_battery *battery; mutex_lock(&hook_mutex); - INIT_LIST_HEAD(&hook->list); list_add(&hook->list, &battery_hook_list); /* * Now that the driver is registered, we need -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/2] CVE-2024-45009
by Wang Liang 24 Dec '24

24 Dec '24

Matthieu Baerts (NGI0) (2): mptcp: pm: only decrement add_addr_accepted for MPJ req mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow net/mptcp/pm_netlink.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) -- 2.34.1

2 3

[PATCH openEuler-22.03-LTS-SP1 0/5] CVE-2024-46765
by Wang Liang 24 Dec '24

24 Dec '24

Anirudh Venkataramanan (1): ice: Consolidate VSI state and flags Jesse Brandeburg (1): ice: fix writeback enable logic Larysa Zaremba (1): ice: protect XDP configuration with a mutex Maciej Fijalkowski (1): ice: allow hot-swapping XDP programs Nick Nunley (1): ice: Remove vlan_ena from vsi structure drivers/net/ethernet/intel/ice/ice.h | 24 ++--- drivers/net/ethernet/intel/ice/ice_ethtool.c | 2 +- drivers/net/ethernet/intel/ice/ice_lib.c | 38 +++++--- drivers/net/ethernet/intel/ice/ice_main.c | 97 ++++++++++---------- drivers/net/ethernet/intel/ice/ice_txrx.c | 63 ++++++------- drivers/net/ethernet/intel/ice/ice_txrx.h | 1 - drivers/net/ethernet/intel/ice/ice_xsk.c | 3 +- 7 files changed, 120 insertions(+), 108 deletions(-) -- 2.34.1

2 6

[PATCH openEuler-22.03-LTS-SP1] igb: Initialize mailbox message for VF reset
by Wang Liang 24 Dec '24

24 Dec '24

From: Tony Nguyen <anthony.l.nguyen(a)intel.com> stable inclusion from stable-v5.10.161 commit f2479c3daaabccbac6c343a737615d0c595c6dc4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRIW CVE: CVE-2022-48949 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit de5dc44370fbd6b46bd7f1a1e00369be54a041c8 upstream. When a MAC address is not assigned to the VF, that portion of the message sent to the VF is not set. The memory, however, is allocated from the stack meaning that information may be leaked to the VM. Initialize the message buffer to 0 so that no information is passed to the VM in this case. Fixes: 6ddbc4cf1f4d ("igb: Indicate failure on vf reset for empty mac address") Reported-by: Akihiko Odaki <akihiko.odaki(a)daynix.com> Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com> Reviewed-by: Akihiko Odaki <akihiko.odaki(a)daynix.com> Reviewed-by: Leon Romanovsky <leonro(a)nvidia.com> Link: https://lore.kernel.org/r/20221212190031.3983342-1-anthony.l.nguyen@intel.c… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- drivers/net/ethernet/intel/igb/igb_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c index 7edbad2558e0..f5521d5304c0 100644 --- a/drivers/net/ethernet/intel/igb/igb_main.c +++ b/drivers/net/ethernet/intel/igb/igb_main.c @@ -7407,7 +7407,7 @@ static void igb_vf_reset_msg(struct igb_adapter *adapter, u32 vf) { struct e1000_hw *hw = &adapter->hw; unsigned char *vf_mac = adapter->vf_data[vf].vf_mac_addresses; - u32 reg, msgbuf[3]; + u32 reg, msgbuf[3] = {}; u8 *addr = (u8 *)(&msgbuf[1]); /* process all the same items cleared in a function level reset */ -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] Bluetooth: Fix not cleanup led when bt_init fails
by Wang Liang 24 Dec '24

24 Dec '24

From: Chen Zhongjin <chenzhongjin(a)huawei.com> stable inclusion from stable-v5.10.159 commit e7b950458156d410509a08c41930b75e72985938 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRIP CVE: CVE-2022-48971 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 2f3957c7eb4e07df944169a3e50a4d6790e1c744 ] bt_init() calls bt_leds_init() to register led, but if it fails later, bt_leds_cleanup() is not called to unregister it. This can cause panic if the argument "bluetooth-power" in text is freed and then another led_trigger_register() tries to access it: BUG: unable to handle page fault for address: ffffffffc06d3bc0 RIP: 0010:strcmp+0xc/0x30 Call Trace: <TASK> led_trigger_register+0x10d/0x4f0 led_trigger_register_simple+0x7d/0x100 bt_init+0x39/0xf7 [bluetooth] do_one_initcall+0xd0/0x4e0 Fixes: e64c97b53bc6 ("Bluetooth: Add combined LED trigger for controller power") Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/bluetooth/af_bluetooth.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c index b577e65a0c3e..14a917e70f3e 100644 --- a/net/bluetooth/af_bluetooth.c +++ b/net/bluetooth/af_bluetooth.c @@ -741,7 +741,7 @@ static int __init bt_init(void) err = bt_sysfs_init(); if (err < 0) - return err; + goto cleanup_led; err = sock_register(&bt_sock_family_ops); if (err) @@ -777,6 +777,8 @@ static int __init bt_init(void) sock_unregister(PF_BLUETOOTH); cleanup_sysfs: bt_sysfs_cleanup(); +cleanup_led: + bt_leds_cleanup(); return err; } -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] net: tun: Fix use-after-free in tun_detach()
by Wang Liang 24 Dec '24

24 Dec '24

From: Shigeru Yoshida <syoshida(a)redhat.com> stable inclusion from stable-v5.10.158 commit 5f442e1d403e0496bacb74a58e2be7f500695e6f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRER CVE: CVE-2022-49014 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 5daadc86f27ea4d691e2131c04310d0418c6cd12 ] syzbot reported use-after-free in tun_detach() [1]. This causes call trace like below: ================================================================== BUG: KASAN: use-after-free in notifier_call_chain+0x1ee/0x200 kernel/notifier.c:75 Read of size 8 at addr ffff88807324e2a8 by task syz-executor.0/3673 CPU: 0 PID: 3673 Comm: syz-executor.0 Not tainted 6.1.0-rc5-syzkaller-00044-gcc675d22e422 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:284 [inline] print_report+0x15e/0x461 mm/kasan/report.c:395 kasan_report+0xbf/0x1f0 mm/kasan/report.c:495 notifier_call_chain+0x1ee/0x200 kernel/notifier.c:75 call_netdevice_notifiers_info+0x86/0x130 net/core/dev.c:1942 call_netdevice_notifiers_extack net/core/dev.c:1983 [inline] call_netdevice_notifiers net/core/dev.c:1997 [inline] netdev_wait_allrefs_any net/core/dev.c:10237 [inline] netdev_run_todo+0xbc6/0x1100 net/core/dev.c:10351 tun_detach drivers/net/tun.c:704 [inline] tun_chr_close+0xe4/0x190 drivers/net/tun.c:3467 __fput+0x27c/0xa90 fs/file_table.c:320 task_work_run+0x16f/0x270 kernel/task_work.c:179 exit_task_work include/linux/task_work.h:38 [inline] do_exit+0xb3d/0x2a30 kernel/exit.c:820 do_group_exit+0xd4/0x2a0 kernel/exit.c:950 get_signal+0x21b1/0x2440 kernel/signal.c:2858 arch_do_signal_or_restart+0x86/0x2300 arch/x86/kernel/signal.c:869 exit_to_user_mode_loop kernel/entry/common.c:168 [inline] exit_to_user_mode_prepare+0x15f/0x250 kernel/entry/common.c:203 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:296 do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd The cause of the issue is that sock_put() from __tun_detach() drops last reference count for struct net, and then notifier_call_chain() from netdev_state_change() accesses that struct net. This patch fixes the issue by calling sock_put() from tun_detach() after all necessary accesses for the struct net has done. Fixes: 83c1f36f9880 ("tun: send netlink notification when the device is modified") Reported-by: syzbot+106f9b687cd64ee70cd1(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?id=96eb7f1ce75ef933697f24eeab928c4a716ede… [1] Signed-off-by: Shigeru Yoshida <syoshida(a)redhat.com> Link: https://lore.kernel.org/r/20221124175134.1589053-1-syoshida@redhat.com Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- drivers/net/tun.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/tun.c b/drivers/net/tun.c index 98df0b4a3542..d8bb9f1fd916 100644 --- a/drivers/net/tun.c +++ b/drivers/net/tun.c @@ -698,7 +698,6 @@ static void __tun_detach(struct tun_file *tfile, bool clean) if (tun) xdp_rxq_info_unreg(&tfile->xdp_rxq); ptr_ring_cleanup(&tfile->tx_ring, tun_ptr_free); - sock_put(&tfile->sk); } } @@ -714,6 +713,9 @@ static void tun_detach(struct tun_file *tfile, bool clean) if (dev) netdev_state_change(dev); rtnl_unlock(); + + if (clean) + sock_put(&tfile->sk); } static void tun_detach_all(struct net_device *dev) -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] net: hsr: Fix potential use-after-free
by Wang Liang 24 Dec '24

24 Dec '24

From: YueHaibing <yuehaibing(a)huawei.com> stable inclusion from stable-v5.10.158 commit 7ca81a161e406834a1fdc405fc83a572bd14b8d9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRJ1 CVE: CVE-2022-49015 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 7e177d32442b7ed08a9fa61b61724abc548cb248 ] The skb is delivered to netif_rx() which may free it, after calling this, dereferencing skb may trigger use-after-free. Fixes: f421436a591d ("net/hsr: Add support for the High-availability Seamless Redundancy protocol (HSRv0)") Signed-off-by: YueHaibing <yuehaibing(a)huawei.com> Link: https://lore.kernel.org/r/20221125075724.27912-1-yuehaibing@huawei.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/hsr/hsr_forward.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/net/hsr/hsr_forward.c b/net/hsr/hsr_forward.c index 4d1a2a48cf3f..860364e5df41 100644 --- a/net/hsr/hsr_forward.c +++ b/net/hsr/hsr_forward.c @@ -301,17 +301,18 @@ static void hsr_deliver_master(struct sk_buff *skb, struct net_device *dev, struct hsr_node *node_src) { bool was_multicast_frame; - int res; + int res, recv_len; was_multicast_frame = (skb->pkt_type == PACKET_MULTICAST); hsr_addr_subst_source(node_src, skb); skb_pull(skb, ETH_HLEN); + recv_len = skb->len; res = netif_rx(skb); if (res == NET_RX_DROP) { dev->stats.rx_dropped++; } else { dev->stats.rx_packets++; - dev->stats.rx_bytes += skb->len; + dev->stats.rx_bytes += recv_len; if (was_multicast_frame) dev->stats.multicast++; } -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration
by Wang Liang 24 Dec '24

24 Dec '24

From: Lorenzo Bianconi <lorenzo(a)kernel.org> stable inclusion from stable-v5.10.158 commit 0184ede0ec61b9cd075babfaa45081b1bf322234 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRDN CVE: CVE-2022-49022 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 3e8f7abcc3473bc9603323803aeaed4ffcc3a2ab ] Fix possible out-of-bound access in ieee80211_get_rate_duration routine as reported by the following UBSAN report: UBSAN: array-index-out-of-bounds in net/mac80211/airtime.c:455:47 index 15 is out of range for type 'u16 [12]' CPU: 2 PID: 217 Comm: kworker/u32:10 Not tainted 6.1.0-060100rc3-generic Hardware name: Acer Aspire TC-281/Aspire TC-281, BIOS R01-A2 07/18/2017 Workqueue: mt76 mt76u_tx_status_data [mt76_usb] Call Trace: <TASK> show_stack+0x4e/0x61 dump_stack_lvl+0x4a/0x6f dump_stack+0x10/0x18 ubsan_epilogue+0x9/0x43 __ubsan_handle_out_of_bounds.cold+0x42/0x47 ieee80211_get_rate_duration.constprop.0+0x22f/0x2a0 [mac80211] ? ieee80211_tx_status_ext+0x32e/0x640 [mac80211] ieee80211_calc_rx_airtime+0xda/0x120 [mac80211] ieee80211_calc_tx_airtime+0xb4/0x100 [mac80211] mt76x02_send_tx_status+0x266/0x480 [mt76x02_lib] mt76x02_tx_status_data+0x52/0x80 [mt76x02_lib] mt76u_tx_status_data+0x67/0xd0 [mt76_usb] process_one_work+0x225/0x400 worker_thread+0x50/0x3e0 ? process_one_work+0x400/0x400 kthread+0xe9/0x110 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x22/0x30 Fixes: db3e1c40cf2f ("mac80211: Import airtime calculation code from mt76") Signed-off-by: Lorenzo Bianconi <lorenzo(a)kernel.org> Acked-by: Toke Høiland-Jørgensen <toke(a)toke.dk> Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Liang <wangliang74(a)huawei.com> --- net/mac80211/airtime.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/mac80211/airtime.c b/net/mac80211/airtime.c index 26d2f8ba7029..758ef63669e7 100644 --- a/net/mac80211/airtime.c +++ b/net/mac80211/airtime.c @@ -457,6 +457,9 @@ static u32 ieee80211_get_rate_duration(struct ieee80211_hw *hw, (status->encoding == RX_ENC_HE && streams > 8))) return 0; + if (idx >= MCS_GROUP_RATES) + return 0; + duration = airtime_mcs_groups[group].duration[idx]; duration <<= airtime_mcs_groups[group].shift; *overhead = 36 + (streams << 2); -- 2.34.1

2 1