- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 0/2] arm64: cpufeature: Both the major and the minor version numbers need to be checked
by Zeng Heng 31 May '24

31 May '24

Zeng Heng (2): arm64: cpufeature: Both the major and the minor version numbers need to be checked arm64/mpam: skip mpam initialize under kdump kernel arch/arm64/include/asm/cpufeature.h | 7 +++++++ arch/arm64/kernel/cpufeature.c | 13 +++++++++---- arch/arm64/kernel/cpuinfo.c | 3 ++- arch/arm64/kernel/mpam.c | 4 ++++ 4 files changed, 22 insertions(+), 5 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6] arm64/mpam: skip mpam initialize under kdump kernel
by Zeng Heng 31 May '24

31 May '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I92AK4 ----------------------------- Skip MPAM initialize when running under kdump kernel. Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/arm64/kernel/mpam.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/arch/arm64/kernel/mpam.c b/arch/arm64/kernel/mpam.c index 02f43334f078..8fd9dbdc2b01 100644 --- a/arch/arm64/kernel/mpam.c +++ b/arch/arm64/kernel/mpam.c @@ -6,6 +6,7 @@ #include <linux/arm_mpam.h> #include <linux/jump_label.h> #include <linux/percpu.h> +#include <linux/crash_dump.h> DEFINE_STATIC_KEY_FALSE(arm64_mpam_has_hcr); DEFINE_STATIC_KEY_FALSE(mpam_enabled); @@ -14,6 +15,9 @@ DEFINE_PER_CPU(u64, arm64_mpam_current); static int __init arm64_mpam_register_cpus(void) { + if (is_kdump_kernel()) + return 0; + u64 mpamidr = read_sanitised_ftr_reg(SYS_MPAMIDR_EL1); u16 partid_max = FIELD_GET(MPAMIDR_PARTID_MAX, mpamidr); u8 pmg_max = FIELD_GET(MPAMIDR_PMG_MAX, mpamidr); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] NFC: digital: fix possible memory leak in digital_in_send_sdd_req()
by Ziyang Xuan 31 May '24

31 May '24

stable inclusion from stable-v4.19.213 commit 071bdef36391958c89af5fa2172f691b31baa212 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RBH0 CVE: CVE-2021-47442 -------------------------------- commit 291c932fc3692e4d211a445ba8aa35663831bac7 upstream. 'skb' is allocated in digital_in_send_sdd_req(), but not free when digital_in_send_cmd() failed, which will cause memory leak. Fix it by freeing 'skb' if digital_in_send_cmd() return failed. Fixes: 2c66daecc409 ("NFC Digital: Add NFC-A technology support") Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)canonical.com> Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> --- net/nfc/digital_technology.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/net/nfc/digital_technology.c b/net/nfc/digital_technology.c index 2021d1d58a75..c092b02fde8a 100644 --- a/net/nfc/digital_technology.c +++ b/net/nfc/digital_technology.c @@ -474,8 +474,12 @@ static int digital_in_send_sdd_req(struct nfc_digital_dev *ddev, skb_put_u8(skb, sel_cmd); skb_put_u8(skb, DIGITAL_SDD_REQ_SEL_PAR); - return digital_in_send_cmd(ddev, skb, 30, digital_in_recv_sdd_res, - target); + rc = digital_in_send_cmd(ddev, skb, 30, digital_in_recv_sdd_res, + target); + if (rc) + kfree_skb(skb); + + return rc; } static void digital_in_recv_sens_res(struct nfc_digital_dev *ddev, void *arg, -- 2.25.1

2 1

[PATCH OLK-5.10] iio: adc: stm32-adc: harden against NULL pointer deref in stm32_adc_probe()
by Cai Xinchen 31 May '24

31 May '24

From: Zhang Shurong <zhang_shurong(a)foxmail.com> mainline inclusion from mainline-v6.7-rc1 commit 3a23b384e7e3d64d5587ad10729a34d4f761517e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9REBR CVE: CVE-2023-52802 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- of_match_device() may fail and returns a NULL pointer. In practice there is no known reasonable way to trigger this, but in case one is added in future, harden the code by adding the check Signed-off-by: Zhang Shurong <zhang_shurong(a)foxmail.com> Link: https://lore.kernel.org/r/tencent_994DA85912C937E3B5405BA960B31ED90A08@qq.c… Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Conflicts: drivers/iio/adc/stm32-adc-core.c [Only context conflicts] Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- drivers/iio/adc/stm32-adc-core.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/drivers/iio/adc/stm32-adc-core.c b/drivers/iio/adc/stm32-adc-core.c index 20fc867e3998..81724e0dec67 100644 --- a/drivers/iio/adc/stm32-adc-core.c +++ b/drivers/iio/adc/stm32-adc-core.c @@ -635,6 +635,8 @@ static int stm32_adc_probe(struct platform_device *pdev) struct stm32_adc_priv *priv; struct device *dev = &pdev->dev; struct device_node *np = pdev->dev.of_node; + const struct of_device_id *of_id; + struct resource *res; u32 max_rate; int ret; @@ -647,8 +649,11 @@ static int stm32_adc_probe(struct platform_device *pdev) return -ENOMEM; platform_set_drvdata(pdev, &priv->common); - priv->cfg = (const struct stm32_adc_priv_cfg *) - of_match_device(dev->driver->of_match_table, dev)->data; + of_id = of_match_device(dev->driver->of_match_table, dev); + if (!of_id) + return -ENODEV; + + priv->cfg = (const struct stm32_adc_priv_cfg *)of_id->data; res = platform_get_resource(pdev, IORESOURCE_MEM, 0); priv->common.base = devm_ioremap_resource(&pdev->dev, res); -- 2.34.1

2 1

[PATCH OLK-5.10] md: fix bi_status reporting in md_end_clone_io
by Li Nan 31 May '24

31 May '24

From: Song Liu <song(a)kernel.org> mainline inclusion from mainline-v6.7-rc3 commit 45b478951b2ba5aea70b2850c49c1aa83aedd0d2 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9U1GO Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- md_end_clone_io() may overwrite error status in orig_bio->bi_status with BLK_STS_OK. This could happen when orig_bio has BIO_CHAIN (split by md_submit_bio => bio_split_to_limits, for example). As a result, upper layer may miss error reported from md (or the device) and consider the failed IO was successful. Fix this by only update orig_bio->bi_status when current bio reports error and orig_bio is BLK_STS_OK. This is the same behavior as __bio_chain_endio(). Fixes: 10764815ff47 ("md: add io accounting for raid0 and raid5") Cc: stable(a)vger.kernel.org # v5.14+ Reported-by: Bhanu Victor DiCara <00bvd0+linux(a)gmail.com> Closes: https://lore.kernel.org/regressions/5727380.DvuYhMxLoT@bvd0/ Signed-off-by: Song Liu <song(a)kernel.org> Tested-by: Xiao Ni <xni(a)redhat.com> Reviewed-by: Yu Kuai <yukuai3(a)huawei.com> Acked-by: Guoqing Jiang <guoqing.jiang(a)linux.dev> Conflicts: drivers/md/md.c [ Context conflict ] Signed-off-by: Li Nan <linan122(a)huawei.com> --- drivers/md/md.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/md/md.c b/drivers/md/md.c index 6df154ab9802..b6aeb0958ae2 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -8723,7 +8723,8 @@ static void md_end_io_acct(struct bio *bio) struct md_io_acct *md_io_acct = bio->bi_private; struct bio *orig_bio = md_io_acct->orig_bio; - orig_bio->bi_status = bio->bi_status; + if (bio->bi_status && !orig_bio->bi_status) + orig_bio->bi_status = bio->bi_status; bio_end_io_acct(orig_bio, md_io_acct->start_time); bio_put(bio); -- 2.39.2

2 1

[PATCH openEuler-1.0-LTS 0/2] backport for CVE-2023-52750
by Hongbo Li 31 May '24

31 May '24

Backport for CVE-2023-52750 Nathan Chancellor (2): arm64: Make CPU_BIG_ENDIAN depend on ld.bfd or ld.lld 13.0.0+ arm64: Restrict CPU_BIG_ENDIAN to GNU as or LLVM IAS 15.x or newer arch/arm64/Kconfig | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] NFC: digital: fix possible memory leak in digital_tg_listen_mdaa()
by Ziyang Xuan 31 May '24

31 May '24

stable inclusion from stable-v4.19.213 commit 9881b0c860649f27ef2565deef011e516390f416 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RBHJ CVE: CVE-2021-47443 -------------------------------- commit 58e7dcc9ca29c14e44267a4d0ea61e3229124907 upstream. 'params' is allocated in digital_tg_listen_mdaa(), but not free when digital_send_cmd() failed, which will cause memory leak. Fix it by freeing 'params' if digital_send_cmd() return failed. Fixes: 1c7a4c24fbfd ("NFC Digital: Add target NFC-DEP support") Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)canonical.com> Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> --- net/nfc/digital_core.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/net/nfc/digital_core.c b/net/nfc/digital_core.c index ec0a8998e52d..d6258638a07a 100644 --- a/net/nfc/digital_core.c +++ b/net/nfc/digital_core.c @@ -286,6 +286,7 @@ int digital_tg_configure_hw(struct nfc_digital_dev *ddev, int type, int param) static int digital_tg_listen_mdaa(struct nfc_digital_dev *ddev, u8 rf_tech) { struct digital_tg_mdaa_params *params; + int rc; params = kzalloc(sizeof(*params), GFP_KERNEL); if (!params) @@ -300,8 +301,12 @@ static int digital_tg_listen_mdaa(struct nfc_digital_dev *ddev, u8 rf_tech) get_random_bytes(params->nfcid2 + 2, NFC_NFCID2_MAXSIZE - 2); params->sc = DIGITAL_SENSF_FELICA_SC; - return digital_send_cmd(ddev, DIGITAL_CMD_TG_LISTEN_MDAA, NULL, params, - 500, digital_tg_recv_atr_req, NULL); + rc = digital_send_cmd(ddev, DIGITAL_CMD_TG_LISTEN_MDAA, NULL, params, + 500, digital_tg_recv_atr_req, NULL); + if (rc) + kfree(params); + + return rc; } static int digital_tg_listen_md(struct nfc_digital_dev *ddev, u8 rf_tech) -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/2] Fix CVE-2021-47438
by Zheng Zucheng 31 May '24

31 May '24

Fix CVE-2021-47438 Valentine Fatiev (2): net/mlx5e: Fix memory leak in mlx5_core_destroy_cq() error path net/mlx5e: nullify cq->dbg pointer in mlx5_debug_cq_remove() drivers/net/ethernet/mellanox/mlx5/core/cq.c | 2 +- drivers/net/ethernet/mellanox/mlx5/core/debugfs.c | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] platform/x86: wmi: Fix opening of char device
by Jinjiang Tu 31 May '24

31 May '24

From: Armin Wolf <W_Armin(a)gmx.de> stable inclusion from stable-v4.19.299 commit cf098e937dd125c0317a0d6f261ac2a950a233d6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RFHT CVE: CVE-2023-52864 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit eba9ac7abab91c8f6d351460239108bef5e7a0b6 ] Since commit fa1f68db6ca7 ("drivers: misc: pass miscdevice pointer via file private data"), the miscdevice stores a pointer to itself inside filp->private_data, which means that private_data will not be NULL when wmi_char_open() is called. This might cause memory corruption should wmi_char_open() be unable to find its driver, something which can happen when the associated WMI device is deleted in wmi_free_devices(). Fix the problem by using the miscdevice pointer to retrieve the WMI device data associated with a char device using container_of(). This also avoids wmi_char_open() picking a wrong WMI device bound to a driver with the same name as the original driver. Fixes: 44b6b7661132 ("platform/x86: wmi: create userspace interface for drivers") Signed-off-by: Armin Wolf <W_Armin(a)gmx.de> Link: https://lore.kernel.org/r/20231020211005.38216-5-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/platform/x86/wmi.c [Conflicts due to prior cleanup commit 43aacf838ef7 is not merged.] Signed-off-by: Jinjiang Tu <tujinjiang(a)huawei.com> --- drivers/platform/x86/wmi.c | 20 ++++++-------------- 1 file changed, 6 insertions(+), 14 deletions(-) diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c index 04791ea5d97b..eba605b967cb 100644 --- a/drivers/platform/x86/wmi.c +++ b/drivers/platform/x86/wmi.c @@ -783,21 +783,13 @@ static int wmi_dev_match(struct device *dev, struct device_driver *driver) } static int wmi_char_open(struct inode *inode, struct file *filp) { - const char *driver_name = filp->f_path.dentry->d_iname; - struct wmi_block *wblock = NULL; - struct wmi_block *next = NULL; - - list_for_each_entry_safe(wblock, next, &wmi_block_list, list) { - if (!wblock->dev.dev.driver) - continue; - if (strcmp(driver_name, wblock->dev.dev.driver->name) == 0) { - filp->private_data = wblock; - break; - } - } + /* + * The miscdevice already stores a pointer to itself + * inside filp->private_data + */ + struct wmi_block *wblock = container_of(filp->private_data, struct wmi_block, char_dev); - if (!filp->private_data) - return -ENODEV; + filp->private_data = wblock; return nonseekable_open(inode, filp); } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] iio: adc: stm32-adc: harden against NULL pointer deref in stm32_adc_probe()
by Cai Xinchen 31 May '24

31 May '24

From: Zhang Shurong <zhang_shurong(a)foxmail.com> mainline inclusion from mainline-v6.7-rc1 commit 3a23b384e7e3d64d5587ad10729a34d4f761517e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9REBR CVE: CVE-2023-52802 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- of_match_device() may fail and returns a NULL pointer. In practice there is no known reasonable way to trigger this, but in case one is added in future, harden the code by adding the check Signed-off-by: Zhang Shurong <zhang_shurong(a)foxmail.com> Link: https://lore.kernel.org/r/tencent_994DA85912C937E3B5405BA960B31ED90A08@qq.c… Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Conflicts: drivers/iio/adc/stm32-adc-core.c [Only context conflicts] Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- drivers/iio/adc/stm32-adc-core.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/drivers/iio/adc/stm32-adc-core.c b/drivers/iio/adc/stm32-adc-core.c index 38eb96693079..dc44d4de82cb 100644 --- a/drivers/iio/adc/stm32-adc-core.c +++ b/drivers/iio/adc/stm32-adc-core.c @@ -394,6 +394,8 @@ static int stm32_adc_probe(struct platform_device *pdev) struct stm32_adc_priv *priv; struct device *dev = &pdev->dev; struct device_node *np = pdev->dev.of_node; + const struct of_device_id *of_id; + struct resource *res; int ret; @@ -404,8 +406,11 @@ static int stm32_adc_probe(struct platform_device *pdev) if (!priv) return -ENOMEM; - priv->cfg = (const struct stm32_adc_priv_cfg *) - of_match_device(dev->driver->of_match_table, dev)->data; + of_id = of_match_device(dev->driver->of_match_table, dev); + if (!of_id) + return -ENODEV; + + priv->cfg = (const struct stm32_adc_priv_cfg *)of_id->data; res = platform_get_resource(pdev, IORESOURCE_MEM, 0); priv->common.base = devm_ioremap_resource(&pdev->dev, res); -- 2.34.1

2 1