- Kernel - mailweb.openeuler.org

[openeuler:OLK-6.6 1484/1484] drivers/crypto/montage/tsse/tsse_dev.h:84:13: warning: variable 'cpu' set but not used
by kernel test robot 19 Nov '24

19 Nov '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 8a039651010897592567f5751c4e706ab794e9c0 commit: 811debd4ea52033d7393d4a7de2be11f71c70348 [1484/1484] add support for Mont-TSSE Driver config: x86_64-randconfig-074-20241119 (https://download.01.org/0day-ci/archive/20241119/202411191002.S36p5N3T-lkp@…) compiler: gcc-11 (Debian 11.3.0-12) 11.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241119/202411191002.S36p5N3T-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411191002.S36p5N3T-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/crypto/montage/tsse/tsse_irq.c:10: drivers/crypto/montage/tsse/tsse_dev.h: In function 'tsse_get_cur_node': >> drivers/crypto/montage/tsse/tsse_dev.h:84:13: warning: variable 'cpu' set but not used [-Wunused-but-set-variable] 84 | int cpu, node; | ^~~ -- In file included from drivers/crypto/montage/tsse/tsse_ipc.c:14: drivers/crypto/montage/tsse/tsse_dev.h: In function 'tsse_get_cur_node': >> drivers/crypto/montage/tsse/tsse_dev.h:84:13: warning: variable 'cpu' set but not used [-Wunused-but-set-variable] 84 | int cpu, node; | ^~~ drivers/crypto/montage/tsse/tsse_ipc.c: At top level: drivers/crypto/montage/tsse/tsse_ipc.c:17:18: warning: no previous prototype for 'get_msginf' [-Wmissing-prototypes] 17 | struct tsse_msg *get_msginf(void __iomem *d2h) | ^~~~~~~~~~ drivers/crypto/montage/tsse/tsse_ipc.c:41:6: warning: no previous prototype for 'ipc_recieve_msg' [-Wmissing-prototypes] 41 | void ipc_recieve_msg(struct tsse_ipc *tsseipc, struct ipc_msg *msg) | ^~~~~~~~~~~~~~~ drivers/crypto/montage/tsse/tsse_ipc.c:53:5: warning: no previous prototype for 'msg_rout' [-Wmissing-prototypes] 53 | int msg_rout(struct tsse_ipc *tsseipc, struct tsse_msg *tssemsg) | ^~~~~~~~ drivers/crypto/montage/tsse/tsse_ipc.c:103:6: warning: no previous prototype for 'ipc_send_msg' [-Wmissing-prototypes] 103 | void ipc_send_msg(struct tsse_ipc *tsseipc, struct ipc_data *msg) | ^~~~~~~~~~~~ drivers/crypto/montage/tsse/tsse_ipc.c:115:6: warning: no previous prototype for 'ipc_hw_init' [-Wmissing-prototypes] 115 | void ipc_hw_init(struct tsse_ipc *hw_ipc) | ^~~~~~~~~~~ drivers/crypto/montage/tsse/tsse_ipc.c:122:5: warning: no previous prototype for 'ipc_init_msg' [-Wmissing-prototypes] 122 | int ipc_init_msg(struct tsse_ipc *tsseipc) | ^~~~~~~~~~~~ -- In file included from drivers/crypto/montage/tsse/tsse_dev_mgr.c:15: drivers/crypto/montage/tsse/tsse_dev.h: In function 'tsse_get_cur_node': >> drivers/crypto/montage/tsse/tsse_dev.h:84:13: warning: variable 'cpu' set but not used [-Wunused-but-set-variable] 84 | int cpu, node; | ^~~ drivers/crypto/montage/tsse/tsse_dev_mgr.c: At top level: drivers/crypto/montage/tsse/tsse_dev_mgr.c:107:5: warning: no previous prototype for 'tsse_stop_dev' [-Wmissing-prototypes] 107 | int tsse_stop_dev(struct tsse_dev *tdev, bool busy_exit) | ^~~~~~~~~~~~~ -- In file included from drivers/crypto/montage/tsse/tsse_vuart.c:25: drivers/crypto/montage/tsse/tsse_dev.h: In function 'tsse_get_cur_node': >> drivers/crypto/montage/tsse/tsse_dev.h:84:13: warning: variable 'cpu' set but not used [-Wunused-but-set-variable] 84 | int cpu, node; | ^~~ At top level: drivers/crypto/montage/tsse/tsse_vuart.c:77:13: warning: 'vuart_wait_for_xmitr' defined but not used [-Wunused-function] 77 | static void vuart_wait_for_xmitr(struct uart_port *port) | ^~~~~~~~~~~~~~~~~~~~ -- In file included from drivers/crypto/montage/tsse/tsse_fw_service.c:20: drivers/crypto/montage/tsse/tsse_dev.h: In function 'tsse_get_cur_node': >> drivers/crypto/montage/tsse/tsse_dev.h:84:13: warning: variable 'cpu' set but not used [-Wunused-but-set-variable] 84 | int cpu, node; | ^~~ drivers/crypto/montage/tsse/tsse_fw_service.c: At top level: drivers/crypto/montage/tsse/tsse_fw_service.c:26:5: warning: no previous prototype for 'fw_send_msg' [-Wmissing-prototypes] 26 | int fw_send_msg(struct tsse_ipc *tsseipc, struct ipc_msg *msg) | ^~~~~~~~~~~ drivers/crypto/montage/tsse/tsse_fw_service.c:51:6: warning: no previous prototype for 'fw_free' [-Wmissing-prototypes] 51 | void fw_free(void *msg_t) | ^~~~~~~ vim +/cpu +84 drivers/crypto/montage/tsse/tsse_dev.h 81 82 static inline int tsse_get_cur_node(void) 83 { > 84 int cpu, node; 85 86 cpu = get_cpu(); 87 node = topology_physical_package_id(cpu); 88 put_cpu(); 89 90 return node; 91 } 92 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1] [Backport] ext4: don't set SB_RDONLY after filesystem errors
by Yongjian Sun 19 Nov '24

19 Nov '24

From: Jan Kara <jack(a)suse.cz> mainline inclusion from mainline-v6.12-rc1 commit d3476f3dad4ad68ae5f6b008ea6591d1520da5d8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2YWS CVE: CVE-2024-50191 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When the filesystem is mounted with errors=remount-ro, we were setting SB_RDONLY flag to stop all filesystem modifications. We knew this misses proper locking (sb->s_umount) and does not go through proper filesystem remount procedure but it has been the way this worked since early ext2 days and it was good enough for catastrophic situation damage mitigation. Recently, syzbot has found a way (see link) to trigger warnings in filesystem freezing because the code got confused by SB_RDONLY changing under its hands. Since these days we set EXT4_FLAGS_SHUTDOWN on the superblock which is enough to stop all filesystem modifications, modifying SB_RDONLY shouldn't be needed. So stop doing that. Link: https://lore.kernel.org/all/000000000000b90a8e061e21d12f@google.com Reported-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Jan Kara <jack(a)suse.cz> Reviewed-by: Christian Brauner <brauner(a)kernel.org> Link: https://patch.msgid.link/20240805201241.27286-1-jack@suse.cz Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Conflicts: fs/ext4/super.c [Context differences.] Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/ext4/super.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/fs/ext4/super.c b/fs/ext4/super.c index e1f99fa9a6d0..d721c0e9d382 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -742,11 +742,12 @@ static void ext4_handle_error(struct super_block *sb, bool force_ro, int error, ext4_msg(sb, KERN_CRIT, "Remounting filesystem read-only"); /* - * Make sure updated value of ->s_mount_flags will be visible before - * ->s_flags update + * EXT4_FLAGS_SHUTDOWN was set which stops all filesystem + * modifications. We don't set SB_RDONLY because that requires + * sb->s_umount semaphore and setting it without proper remount + * procedure is confusing code such as freeze_super() leading to + * deadlocks and other problems. */ - smp_wmb(); - sb->s_flags |= SB_RDONLY; out: ext4_netlink_send_info(sb, force_ro ? 2 : 1); } -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] [Backport] ext4: don't set SB_RDONLY after filesystem errors
by Yongjian Sun 19 Nov '24

19 Nov '24

From: Jan Kara <jack(a)suse.cz> mainline inclusion from mainline-v6.12-rc1 commit d3476f3dad4ad68ae5f6b008ea6591d1520da5d8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2YWS CVE: CVE-2024-50191 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When the filesystem is mounted with errors=remount-ro, we were setting SB_RDONLY flag to stop all filesystem modifications. We knew this misses proper locking (sb->s_umount) and does not go through proper filesystem remount procedure but it has been the way this worked since early ext2 days and it was good enough for catastrophic situation damage mitigation. Recently, syzbot has found a way (see link) to trigger warnings in filesystem freezing because the code got confused by SB_RDONLY changing under its hands. Since these days we set EXT4_FLAGS_SHUTDOWN on the superblock which is enough to stop all filesystem modifications, modifying SB_RDONLY shouldn't be needed. So stop doing that. Link: https://lore.kernel.org/all/000000000000b90a8e061e21d12f@google.com Reported-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Jan Kara <jack(a)suse.cz> Reviewed-by: Christian Brauner <brauner(a)kernel.org> Link: https://patch.msgid.link/20240805201241.27286-1-jack@suse.cz Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Conflicts: fs/ext4/super.c [Context differences.] Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/ext4/super.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/fs/ext4/super.c b/fs/ext4/super.c index e1f99fa9a6d0..d721c0e9d382 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -742,11 +742,12 @@ static void ext4_handle_error(struct super_block *sb, bool force_ro, int error, ext4_msg(sb, KERN_CRIT, "Remounting filesystem read-only"); /* - * Make sure updated value of ->s_mount_flags will be visible before - * ->s_flags update + * EXT4_FLAGS_SHUTDOWN was set which stops all filesystem + * modifications. We don't set SB_RDONLY because that requires + * sb->s_umount semaphore and setting it without proper remount + * procedure is confusing code such as freeze_super() leading to + * deadlocks and other problems. */ - smp_wmb(); - sb->s_flags |= SB_RDONLY; out: ext4_netlink_send_info(sb, force_ro ? 2 : 1); } -- 2.39.2

2 3

[PATCH OLK-5.10] [Backport] ext4: don't set SB_RDONLY after filesystem errors
by Yongjian Sun 19 Nov '24

19 Nov '24

From: Jan Kara <jack(a)suse.cz> mainline inclusion from mainline-v6.12-rc1 commit d3476f3dad4ad68ae5f6b008ea6591d1520da5d8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2YWS CVE: CVE-2024-50191 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When the filesystem is mounted with errors=remount-ro, we were setting SB_RDONLY flag to stop all filesystem modifications. We knew this misses proper locking (sb->s_umount) and does not go through proper filesystem remount procedure but it has been the way this worked since early ext2 days and it was good enough for catastrophic situation damage mitigation. Recently, syzbot has found a way (see link) to trigger warnings in filesystem freezing because the code got confused by SB_RDONLY changing under its hands. Since these days we set EXT4_FLAGS_SHUTDOWN on the superblock which is enough to stop all filesystem modifications, modifying SB_RDONLY shouldn't be needed. So stop doing that. Link: https://lore.kernel.org/all/000000000000b90a8e061e21d12f@google.com Reported-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Jan Kara <jack(a)suse.cz> Reviewed-by: Christian Brauner <brauner(a)kernel.org> Link: https://patch.msgid.link/20240805201241.27286-1-jack@suse.cz Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Conflicts: fs/ext4/super.c [Context differences.] Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/ext4/super.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/fs/ext4/super.c b/fs/ext4/super.c index 2adee3847415..22d8025668db 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -753,11 +753,12 @@ static void ext4_handle_error(struct super_block *sb, bool force_ro, int error, ext4_msg(sb, KERN_CRIT, "Remounting filesystem read-only"); /* - * Make sure updated value of ->s_mount_flags will be visible before - * ->s_flags update + * EXT4_FLAGS_SHUTDOWN was set which stops all filesystem + * modifications. We don't set SB_RDONLY because that requires + * sb->s_umount semaphore and setting it without proper remount + * procedure is confusing code such as freeze_super() leading to + * deadlocks and other problems. */ - smp_wmb(); - sb->s_flags |= SB_RDONLY; #ifdef CONFIG_EXT4_ERROR_REPORT out: ext4_netlink_send_info(sb, force_ro ? 2 : 1); -- 2.39.2

2 3

[PATCH OLK-6.6] [Backport] ext4: don't set SB_RDONLY after filesystem errors
by Yongjian Sun 19 Nov '24

19 Nov '24

From: Jan Kara <jack(a)suse.cz> mainline inclusion from mainline-v6.12-rc1 commit d3476f3dad4ad68ae5f6b008ea6591d1520da5d8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2YWS CVE: CVE-2024-50191 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When the filesystem is mounted with errors=remount-ro, we were setting SB_RDONLY flag to stop all filesystem modifications. We knew this misses proper locking (sb->s_umount) and does not go through proper filesystem remount procedure but it has been the way this worked since early ext2 days and it was good enough for catastrophic situation damage mitigation. Recently, syzbot has found a way (see link) to trigger warnings in filesystem freezing because the code got confused by SB_RDONLY changing under its hands. Since these days we set EXT4_FLAGS_SHUTDOWN on the superblock which is enough to stop all filesystem modifications, modifying SB_RDONLY shouldn't be needed. So stop doing that. Link: https://lore.kernel.org/all/000000000000b90a8e061e21d12f@google.com Reported-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Jan Kara <jack(a)suse.cz> Reviewed-by: Christian Brauner <brauner(a)kernel.org> Link: https://patch.msgid.link/20240805201241.27286-1-jack@suse.cz Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Conflicts: fs/ext4/super.c [Context differences.] Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/ext4/super.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/fs/ext4/super.c b/fs/ext4/super.c index 4b81f9ae3454..367fa50be4d6 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -821,11 +821,12 @@ static void ext4_handle_error(struct super_block *sb, bool force_ro, int error, ext4_msg(sb, KERN_CRIT, "Remounting filesystem read-only"); /* - * Make sure updated value of ->s_mount_flags will be visible before - * ->s_flags update + * EXT4_FLAGS_SHUTDOWN was set which stops all filesystem + * modifications. We don't set SB_RDONLY because that requires + * sb->s_umount semaphore and setting it without proper remount + * procedure is confusing code such as freeze_super() leading to + * deadlocks and other problems. */ - smp_wmb(); - sb->s_flags |= SB_RDONLY; #ifdef CONFIG_EXT4_ERROR_REPORT out: ext4_netlink_send_info(sb, force_ro ? 2 : 1); -- 2.39.2

2 1

[PATCH OLK-6.6 0/2] Fix CVE-2024-50225
by Long Li 19 Nov '24

19 Nov '24

This patch set fix CVE-2024-50225. Naohiro Aota (1): btrfs: fix error propagation of split bios Qu Wenruo (1): btrfs: merge btrfs_orig_bbio_end_io() into btrfs_bio_end_io() fs/btrfs/bio.c | 62 ++++++++++++++++++-------------------------------- fs/btrfs/bio.h | 3 +++ 2 files changed, 25 insertions(+), 40 deletions(-) -- 2.39.2

2 3

[PATCH OLK-6.6] xfs: fix finding a last resort AG in xfs_filestream_pick_ag
by Long Li 19 Nov '24

19 Nov '24

From: Christoph Hellwig <hch(a)lst.de> mainline inclusion from mainline-v6.10-rc2 commit dc60992ce76fbc2f71c2674f435ff6bde2108028 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB37AZ CVE: CVE-2024-50216 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When the main loop in xfs_filestream_pick_ag fails to find a suitable AG it tries to just pick the online AG. But the loop for that uses args->pag as loop iterator while the later code expects pag to be set. Fix this by reusing the max_pag case for this last resort, and also add a check for impossible case of no AG just to make sure that the uninitialized pag doesn't even escape in theory. Reported-by: syzbot+4125a3c514e3436a02e6(a)syzkaller.appspotmail.com Signed-off-by: Christoph Hellwig <hch(a)lst.de> Tested-by: syzbot+4125a3c514e3436a02e6(a)syzkaller.appspotmail.com Fixes: f8f1ed1ab3baba ("xfs: return a referenced perag from filestreams allocator") Cc: <stable(a)vger.kernel.org> # v6.3 Reviewed-by: Darrick J. Wong <djwong(a)kernel.org> Signed-off-by: Carlos Maiolino <cem(a)kernel.org> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/xfs/xfs_filestream.c | 23 ++++++++++++----------- fs/xfs/xfs_trace.h | 15 +++++---------- 2 files changed, 17 insertions(+), 21 deletions(-) diff --git a/fs/xfs/xfs_filestream.c b/fs/xfs/xfs_filestream.c index 2fc98d313708..f62b023f274e 100644 --- a/fs/xfs/xfs_filestream.c +++ b/fs/xfs/xfs_filestream.c @@ -64,7 +64,7 @@ xfs_filestream_pick_ag( struct xfs_perag *pag; struct xfs_perag *max_pag = NULL; xfs_extlen_t minlen = *longest; - xfs_extlen_t free = 0, minfree, maxfree = 0; + xfs_extlen_t minfree, maxfree = 0; xfs_agnumber_t agno; bool first_pass = true; int err; @@ -107,7 +107,6 @@ xfs_filestream_pick_ag( !(flags & XFS_PICK_USERDATA) || (flags & XFS_PICK_LOWSPACE))) { /* Break out, retaining the reference on the AG. */ - free = pag->pagf_freeblks; break; } } @@ -150,23 +149,25 @@ xfs_filestream_pick_ag( * grab. */ if (!max_pag) { - for_each_perag_wrap(args->mp, 0, start_agno, args->pag) + for_each_perag_wrap(args->mp, 0, start_agno, pag) { + max_pag = pag; break; - atomic_inc(&args->pag->pagf_fstrms); - *longest = 0; - } else { - pag = max_pag; - free = maxfree; - atomic_inc(&pag->pagf_fstrms); + } + + /* Bail if there are no AGs at all to select from. */ + if (!max_pag) + return -ENOSPC; } + + pag = max_pag; + atomic_inc(&pag->pagf_fstrms); } else if (max_pag) { xfs_perag_rele(max_pag); } - trace_xfs_filestream_pick(pag, pino, free); + trace_xfs_filestream_pick(pag, pino); args->pag = pag; return 0; - } static struct xfs_inode * diff --git a/fs/xfs/xfs_trace.h b/fs/xfs/xfs_trace.h index 3926cf7f2a6e..d562028281f5 100644 --- a/fs/xfs/xfs_trace.h +++ b/fs/xfs/xfs_trace.h @@ -672,8 +672,8 @@ DEFINE_FILESTREAM_EVENT(xfs_filestream_lookup); DEFINE_FILESTREAM_EVENT(xfs_filestream_scan); TRACE_EVENT(xfs_filestream_pick, - TP_PROTO(struct xfs_perag *pag, xfs_ino_t ino, xfs_extlen_t free), - TP_ARGS(pag, ino, free), + TP_PROTO(struct xfs_perag *pag, xfs_ino_t ino), + TP_ARGS(pag, ino), TP_STRUCT__entry( __field(dev_t, dev) __field(xfs_ino_t, ino) @@ -684,14 +684,9 @@ TRACE_EVENT(xfs_filestream_pick, TP_fast_assign( __entry->dev = pag->pag_mount->m_super->s_dev; __entry->ino = ino; - if (pag) { - __entry->agno = pag->pag_agno; - __entry->streams = atomic_read(&pag->pagf_fstrms); - } else { - __entry->agno = NULLAGNUMBER; - __entry->streams = 0; - } - __entry->free = free; + __entry->agno = pag->pag_agno; + __entry->streams = atomic_read(&pag->pagf_fstrms); + __entry->free = pag->pagf_freeblks; ), TP_printk("dev %d:%d ino 0x%llx agno 0x%x streams %d free %d", MAJOR(__entry->dev), MINOR(__entry->dev), -- 2.39.2

2 1

[PATCH OLK-6.6] btrfs: fix use-after-free of block device file in __btrfs_free_extra_devids()
by Long Li 19 Nov '24

19 Nov '24

From: Zhihao Cheng <chengzhihao1(a)huawei.com> mainline inclusion from mainline-v6.10-rc2 commit aec8e6bf839101784f3ef037dcdb9432c3f32343 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB37A4 CVE: CVE-2024-50217 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Mounting btrfs from two images (which have the same one fsid and two different dev_uuids) in certain executing order may trigger an UAF for variable 'device->bdev_file' in __btrfs_free_extra_devids(). And following are the details: 1. Attach image_1 to loop0, attach image_2 to loop1, and scan btrfs devices by ioctl(BTRFS_IOC_SCAN_DEV): / btrfs_device_1 → loop0 fs_device \ btrfs_device_2 → loop1 2. mount /dev/loop0 /mnt btrfs_open_devices btrfs_device_1->bdev_file = btrfs_get_bdev_and_sb(loop0) btrfs_device_2->bdev_file = btrfs_get_bdev_and_sb(loop1) btrfs_fill_super open_ctree fail: btrfs_close_devices // -ENOMEM btrfs_close_bdev(btrfs_device_1) fput(btrfs_device_1->bdev_file) // btrfs_device_1->bdev_file is freed btrfs_close_bdev(btrfs_device_2) fput(btrfs_device_2->bdev_file) 3. mount /dev/loop1 /mnt btrfs_open_devices btrfs_get_bdev_and_sb(&bdev_file) // EIO, btrfs_device_1->bdev_file is not assigned, // which points to a freed memory area btrfs_device_2->bdev_file = btrfs_get_bdev_and_sb(loop1) btrfs_fill_super open_ctree btrfs_free_extra_devids if (btrfs_device_1->bdev_file) fput(btrfs_device_1->bdev_file) // UAF ! Fix it by setting 'device->bdev_file' as 'NULL' after closing the btrfs_device in btrfs_close_one_device(). Fixes: 142388194191 ("btrfs: do not background blkdev_put()") CC: stable(a)vger.kernel.org # 4.19+ Link: https://bugzilla.kernel.org/show_bug.cgi?id=219408 Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Conflicts: fs/btrfs/volumes.c [Not merge mainline commit 9ae061cf2a46 ("btrfs: port device access to file")] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/btrfs/volumes.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c index c6810b74f9b1..093c5a3ef079 100644 --- a/fs/btrfs/volumes.c +++ b/fs/btrfs/volumes.c @@ -1143,6 +1143,7 @@ static void btrfs_close_one_device(struct btrfs_device *device) if (device->bdev) { fs_devices->open_devices--; device->bdev = NULL; + device->bdev_handle = NULL; } clear_bit(BTRFS_DEV_STATE_WRITEABLE, &device->dev_state); btrfs_destroy_dev_zone_info(device); -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS 0/2] CVE-2024-50195
by Gu Bowen 19 Nov '24

19 Nov '24

Jinjie Ruan (2): posix-clock: Fix missing timespec64 check in pc_clock_settime() posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime() kernel/time/posix-clock.c | 3 +++ 1 file changed, 3 insertions(+) -- 2.25.1

2 3

[PATCH openEuler-22.03-LTS-SP1] ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size()
by Gu Bowen 19 Nov '24

19 Nov '24

From: Andrey Shumilin <shum.sdl(a)nppct.ru> stable inclusion from stable-v5.10.229 commit 5e431f85c87bbffd93a9830d5a576586f9855291 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2YWV CVE: CVE-2024-50205 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 72cafe63b35d06b5cfbaf807e90ae657907858da ] The step variable is initialized to zero. It is changed in the loop, but if it's not changed it will remain zero. Add a variable check before the division. The observed behavior was introduced by commit 826b5de90c0b ("ALSA: firewire-lib: fix insufficient PCM rule for period/buffer size"), and it is difficult to show that any of the interval parameters will satisfy the snd_interval_test() condition with data from the amdtp_rate_table[] table. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 826b5de90c0b ("ALSA: firewire-lib: fix insufficient PCM rule for period/buffer size") Signed-off-by: Andrey Shumilin <shum.sdl(a)nppct.ru> Reviewed-by: Takashi Sakamoto <o-takashi(a)sakamocchi.jp> Link: https://patch.msgid.link/20241018060018.1189537-1-shum.sdl@nppct.ru Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Gu Bowen <gubowen5(a)huawei.com> --- sound/firewire/amdtp-stream.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/sound/firewire/amdtp-stream.c b/sound/firewire/amdtp-stream.c index 7a282d8e7148..bd272ab2048e 100644 --- a/sound/firewire/amdtp-stream.c +++ b/sound/firewire/amdtp-stream.c @@ -163,6 +163,9 @@ static int apply_constraint_to_size(struct snd_pcm_hw_params *params, step = max(step, amdtp_syt_intervals[i]); } + if (step == 0) + return -EINVAL; + t.min = roundup(s->min, step); t.max = rounddown(s->max, step); t.integer = 1; -- 2.25.1

2 1