- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] [Backport] fs: Fix uninitialized value issue in from_kuid and from_kgid
by Yongjian Sun 29 Nov '24

29 Nov '24

From: Alessandro Zanni <alessandro.zanni87(a)gmail.com> mainline inclusion from mainline-v6.12-rc3 commit 15f34347481648a567db67fb473c23befb796af5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB705C CVE: CVE-2024-53101 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ocfs2_setattr() uses attr->ia_mode, attr->ia_uid and attr->ia_gid in a trace point even though ATTR_MODE, ATTR_UID and ATTR_GID aren't set. Initialize all fields of newattrs to avoid uninitialized variables, by checking if ATTR_MODE, ATTR_UID, ATTR_GID are initialized, otherwise 0. Reported-by: syzbot+6c55f725d1bdc8c52058(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=6c55f725d1bdc8c52058 Signed-off-by: Alessandro Zanni <alessandro.zanni87(a)gmail.com> Link: https://lore.kernel.org/r/20241017120553.55331-1-alessandro.zanni87@gmail.c… Reviewed-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/ocfs2/file.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c index 8c0e300f0463..da209f81c9ee 100644 --- a/fs/ocfs2/file.c +++ b/fs/ocfs2/file.c @@ -1139,9 +1139,12 @@ int ocfs2_setattr(struct dentry *dentry, struct iattr *attr) trace_ocfs2_setattr(inode, dentry, (unsigned long long)OCFS2_I(inode)->ip_blkno, dentry->d_name.len, dentry->d_name.name, - attr->ia_valid, attr->ia_mode, - from_kuid(&init_user_ns, attr->ia_uid), - from_kgid(&init_user_ns, attr->ia_gid)); + attr->ia_valid, + attr->ia_valid & ATTR_MODE ? attr->ia_mode : 0, + attr->ia_valid & ATTR_UID ? + from_kuid(&init_user_ns, attr->ia_uid) : 0, + attr->ia_valid & ATTR_GID ? + from_kgid(&init_user_ns, attr->ia_gid) : 0); /* ensuring we don't even attempt to truncate a symlink */ if (S_ISLNK(inode->i_mode)) -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] [Backport] fs: Fix uninitialized value issue in from_kuid and from_kgid
by Yongjian Sun 29 Nov '24

29 Nov '24

From: Alessandro Zanni <alessandro.zanni87(a)gmail.com> mainline inclusion from mainline-v6.12-rc3 commit 15f34347481648a567db67fb473c23befb796af5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB705C CVE: CVE-2024-53101 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ocfs2_setattr() uses attr->ia_mode, attr->ia_uid and attr->ia_gid in a trace point even though ATTR_MODE, ATTR_UID and ATTR_GID aren't set. Initialize all fields of newattrs to avoid uninitialized variables, by checking if ATTR_MODE, ATTR_UID, ATTR_GID are initialized, otherwise 0. Reported-by: syzbot+6c55f725d1bdc8c52058(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=6c55f725d1bdc8c52058 Signed-off-by: Alessandro Zanni <alessandro.zanni87(a)gmail.com> Link: https://lore.kernel.org/r/20241017120553.55331-1-alessandro.zanni87@gmail.c… Reviewed-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/ocfs2/file.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c index ffa258da6bac..a12f35d15032 100644 --- a/fs/ocfs2/file.c +++ b/fs/ocfs2/file.c @@ -1133,9 +1133,12 @@ int ocfs2_setattr(struct dentry *dentry, struct iattr *attr) trace_ocfs2_setattr(inode, dentry, (unsigned long long)OCFS2_I(inode)->ip_blkno, dentry->d_name.len, dentry->d_name.name, - attr->ia_valid, attr->ia_mode, - from_kuid(&init_user_ns, attr->ia_uid), - from_kgid(&init_user_ns, attr->ia_gid)); + attr->ia_valid, + attr->ia_valid & ATTR_MODE ? attr->ia_mode : 0, + attr->ia_valid & ATTR_UID ? + from_kuid(&init_user_ns, attr->ia_uid) : 0, + attr->ia_valid & ATTR_GID ? + from_kgid(&init_user_ns, attr->ia_gid) : 0); /* ensuring we don't even attempt to truncate a symlink */ if (S_ISLNK(inode->i_mode)) -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1] [Backport] fs: Fix uninitialized value issue in from_kuid and from_kgid
by Yongjian Sun 29 Nov '24

29 Nov '24

From: Alessandro Zanni <alessandro.zanni87(a)gmail.com> mainline inclusion from mainline-v6.12-rc3 commit 15f34347481648a567db67fb473c23befb796af5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB705C CVE: CVE-2024-53101 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ocfs2_setattr() uses attr->ia_mode, attr->ia_uid and attr->ia_gid in a trace point even though ATTR_MODE, ATTR_UID and ATTR_GID aren't set. Initialize all fields of newattrs to avoid uninitialized variables, by checking if ATTR_MODE, ATTR_UID, ATTR_GID are initialized, otherwise 0. Reported-by: syzbot+6c55f725d1bdc8c52058(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=6c55f725d1bdc8c52058 Signed-off-by: Alessandro Zanni <alessandro.zanni87(a)gmail.com> Link: https://lore.kernel.org/r/20241017120553.55331-1-alessandro.zanni87@gmail.c… Reviewed-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/ocfs2/file.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c index ffa258da6bac..a12f35d15032 100644 --- a/fs/ocfs2/file.c +++ b/fs/ocfs2/file.c @@ -1133,9 +1133,12 @@ int ocfs2_setattr(struct dentry *dentry, struct iattr *attr) trace_ocfs2_setattr(inode, dentry, (unsigned long long)OCFS2_I(inode)->ip_blkno, dentry->d_name.len, dentry->d_name.name, - attr->ia_valid, attr->ia_mode, - from_kuid(&init_user_ns, attr->ia_uid), - from_kgid(&init_user_ns, attr->ia_gid)); + attr->ia_valid, + attr->ia_valid & ATTR_MODE ? attr->ia_mode : 0, + attr->ia_valid & ATTR_UID ? + from_kuid(&init_user_ns, attr->ia_uid) : 0, + attr->ia_valid & ATTR_GID ? + from_kgid(&init_user_ns, attr->ia_gid) : 0); /* ensuring we don't even attempt to truncate a symlink */ if (S_ISLNK(inode->i_mode)) -- 2.39.2

2 1

[PATCH OLK-5.10] [Backport] fs: Fix uninitialized value issue in from_kuid and from_kgid
by Yongjian Sun 29 Nov '24

29 Nov '24

From: Alessandro Zanni <alessandro.zanni87(a)gmail.com> mainline inclusion from mainline-v6.12-rc3 commit 15f34347481648a567db67fb473c23befb796af5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB705C CVE: CVE-2024-53101 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- ocfs2_setattr() uses attr->ia_mode, attr->ia_uid and attr->ia_gid in a trace point even though ATTR_MODE, ATTR_UID and ATTR_GID aren't set. Initialize all fields of newattrs to avoid uninitialized variables, by checking if ATTR_MODE, ATTR_UID, ATTR_GID are initialized, otherwise 0. Reported-by: syzbot+6c55f725d1bdc8c52058(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=6c55f725d1bdc8c52058 Signed-off-by: Alessandro Zanni <alessandro.zanni87(a)gmail.com> Link: https://lore.kernel.org/r/20241017120553.55331-1-alessandro.zanni87@gmail.c… Reviewed-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/ocfs2/file.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c index ec0e67e9a3ec..43ce41404e72 100644 --- a/fs/ocfs2/file.c +++ b/fs/ocfs2/file.c @@ -1133,9 +1133,12 @@ int ocfs2_setattr(struct dentry *dentry, struct iattr *attr) trace_ocfs2_setattr(inode, dentry, (unsigned long long)OCFS2_I(inode)->ip_blkno, dentry->d_name.len, dentry->d_name.name, - attr->ia_valid, attr->ia_mode, - from_kuid(&init_user_ns, attr->ia_uid), - from_kgid(&init_user_ns, attr->ia_gid)); + attr->ia_valid, + attr->ia_valid & ATTR_MODE ? attr->ia_mode : 0, + attr->ia_valid & ATTR_UID ? + from_kuid(&init_user_ns, attr->ia_uid) : 0, + attr->ia_valid & ATTR_GID ? + from_kgid(&init_user_ns, attr->ia_gid) : 0); /* ensuring we don't even attempt to truncate a symlink */ if (S_ISLNK(inode->i_mode)) -- 2.39.2

2 1

[PATCH OLK-6.6] drm/amd/display: Add missing NULL pointer check within dpcd_extend_address_range
by Zhang Zekun 29 Nov '24

29 Nov '24

From: Hersen Wu <hersenxs.wu(a)amd.com> mainline inclusion from mainline-v6.11-rc1 commit 5524fa301ba649f8cf00848f91468e0ba7e4f24c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9OL CVE: CVE-2024-46808 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------------------------------------- [Why & How] ASSERT if return NULL from kcalloc. Reviewed-by: Alex Hung <alex.hung(a)amd.com> Reviewed-by: Rodrigo Siqueira <rodrigo.siqueira(a)amd.com> Acked-by: Tom Chung <chiahsuan.chung(a)amd.com> Signed-off-by: Hersen Wu <hersenxs.wu(a)amd.com> Tested-by: Daniel Wheeler <daniel.wheeler(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/link/protocols/link_dpcd.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dpcd.c b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dpcd.c index fc50931c2aec..9d67b9a9c2d9 100644 --- a/drivers/gpu/drm/amd/display/dc/link/protocols/link_dpcd.c +++ b/drivers/gpu/drm/amd/display/dc/link/protocols/link_dpcd.c @@ -165,6 +165,7 @@ static void dpcd_extend_address_range( *out_address = new_addr_range.start; *out_size = ADDRESS_RANGE_SIZE(new_addr_range.start, new_addr_range.end); *out_data = kzalloc(*out_size * sizeof(**out_data), GFP_KERNEL); + ASSERT(*out_data); } } -- 2.17.1

2 1

[PATCH OLK-6.6 0/2] ext4: fix potential memory exposure issues during truncate in iomap
by Yongjian Sun 29 Nov '24

29 Nov '24

*** BLURB HERE *** Yongjian Sun (2): ext4: do not always order data when partial zeroing out a block ext4: fix potential memory exposure issues during truncate in iomap mode. fs/ext4/inode.c | 75 ++++++++++++++++++++++++++++++++++++++----------- 1 file changed, 59 insertions(+), 16 deletions(-) -- 2.39.2

2 3

[openeuler:openEuler-1.0-LTS 1297/1297] drivers/pci/controller/hisi-pcie-customer/.tmp_hisi_pcie_cae.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 29 Nov '24

29 Nov '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: b5504db0db8375a77340b5bb54c17cfb75d3c754 commit: 2208b0283616863f166ef470fb9286223ba8f9ba [1297/1297] pcie: hisi pcie dfx driver config: x86_64-buildonly-randconfig-002-20241117 (https://download.01.org/0day-ci/archive/20241129/202411291412.QcA88pv3-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241129/202411291412.QcA88pv3-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411291412.QcA88pv3-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/pci/controller/hisi-pcie-customer/.tmp_hisi_pcie_cae.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1484/1484] arch/x86/kvm/svm/sev.c:2200:18: error: no member named 'false' in 'struct hygon_kvm_hooks_table'
by kernel test robot 29 Nov '24

29 Nov '24

Hi fangbaoshun, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 95bc69473a373c2e578d4fc39734e5811a03ead3 commit: 1c3b1095a26ed8bc1aa7ac3d4e8dd3e65964a74b [1484/1484] KVM: SVM: Add KVM_CSV_COMMAND_BATCH command for applying CSV RING_BUFFER mode config: x86_64-randconfig-073-20241119 (https://download.01.org/0day-ci/archive/20241129/202411291233.9CXb1cKX-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241129/202411291233.9CXb1cKX-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411291233.9CXb1cKX-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from arch/x86/kvm/svm/sev.c:12: In file included from include/linux/kvm_host.h:16: In file included from include/linux/mm.h:2235: include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ >> arch/x86/kvm/svm/sev.c:2200:18: error: no member named 'false' in 'struct hygon_kvm_hooks_table' 2200 | hygon_kvm_hooks.sev_enabled = &sev_enabled; | ~~~~~~~~~~~~~~~ ^ arch/x86/kvm/svm/sev.c:66:21: note: expanded from macro 'sev_enabled' 66 | #define sev_enabled false | ^ >> arch/x86/kvm/svm/sev.c:2200:32: error: cannot take the address of an rvalue of type 'int' 2200 | hygon_kvm_hooks.sev_enabled = &sev_enabled; | ^~~~~~~~~~~~ arch/x86/kvm/svm/sev.c:2198:6: warning: no previous prototype for function 'sev_install_hooks' [-Wmissing-prototypes] 2198 | void sev_install_hooks(void) | ^ arch/x86/kvm/svm/sev.c:2198:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 2198 | void sev_install_hooks(void) | ^ | static 2 warnings and 2 errors generated. vim +2200 arch/x86/kvm/svm/sev.c 2195 2196 #ifdef CONFIG_HYGON_CSV 2197 /* Code to set all of the function and vaiable pointers */ 2198 void sev_install_hooks(void) 2199 { > 2200 hygon_kvm_hooks.sev_enabled = &sev_enabled; 2201 hygon_kvm_hooks.sev_issue_cmd = sev_issue_cmd; 2202 hygon_kvm_hooks.get_num_contig_pages = get_num_contig_pages; 2203 hygon_kvm_hooks.sev_pin_memory = sev_pin_memory; 2204 hygon_kvm_hooks.sev_unpin_memory = sev_unpin_memory; 2205 2206 hygon_kvm_hooks.sev_hooks_installed = true; 2207 } 2208 #endif 2209 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1484/1484] include/linux/pgplib.h:36:30: error: field 'version' has incomplete type
by kernel test robot 29 Nov '24

29 Nov '24

Hi David, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 95bc69473a373c2e578d4fc39734e5811a03ead3 commit: 43d4042e06d2bf96adf67d25e8d91653507a4cf9 [1484/1484] KEYS: Provide a function to load keys from a PGP keyring blob config: x86_64-randconfig-074-20241119 (https://download.01.org/0day-ci/archive/20241129/202411291248.k6zanntO-lkp@…) compiler: gcc-11 (Debian 11.3.0-12) 11.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241129/202411291248.k6zanntO-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411291248.k6zanntO-lkp@intel.com/ All error/warnings (new ones prefixed by >>): In file included from crypto/asymmetric_keys/pgp_public_key.c:20: >> include/linux/pgplib.h:26:36: warning: 'enum pgp_packet_tag' declared inside parameter list will not be visible outside of this definition or declaration 26 | enum pgp_packet_tag type, | ^~~~~~~~~~~~~~ >> include/linux/pgplib.h:36:30: warning: 'version' is narrower than values of its type 36 | enum pgp_key_version version : 8; | ^~~~~~~ >> include/linux/pgplib.h:36:30: error: field 'version' has incomplete type >> include/linux/pgplib.h:37:30: warning: 'pubkey_algo' is narrower than values of its type 37 | enum pgp_pubkey_algo pubkey_algo : 8; | ^~~~~~~~~~~ >> include/linux/pgplib.h:37:30: error: field 'pubkey_algo' has incomplete type crypto/asymmetric_keys/pgp_public_key.c: In function 'pgp_calc_pkey_keyid': >> crypto/asymmetric_keys/pgp_public_key.c:63:9: error: implicit declaration of function 'kenter' [-Werror=implicit-function-declaration] 63 | kenter(""); | ^~~~~~ >> crypto/asymmetric_keys/pgp_public_key.c:65:29: error: 'PGP_KEY_VERSION_4' undeclared (first use in this function) 65 | n = (pgp->version < PGP_KEY_VERSION_4) ? 8 : 6; | ^~~~~~~~~~~~~~~~~ crypto/asymmetric_keys/pgp_public_key.c:65:29: note: each undeclared identifier is reported only once for each function it appears in >> crypto/asymmetric_keys/pgp_public_key.c:67:23: error: implicit declaration of function 'mpi_key_length' [-Werror=implicit-function-declaration] 67 | ret = mpi_key_length(key_ptr, keylen, nb + i, nn + i); | ^~~~~~~~~~~~~~ >> crypto/asymmetric_keys/pgp_public_key.c:115:9: error: implicit declaration of function 'kleave' [-Werror=implicit-function-declaration] 115 | kleave(" = %d", ret); | ^~~~~~ crypto/asymmetric_keys/pgp_public_key.c: In function 'pgp_generate_fingerprint': crypto/asymmetric_keys/pgp_public_key.c:134:49: error: 'PGP_KEY_VERSION_4' undeclared (first use in this function) 134 | tfm = crypto_alloc_shash(pgp->version < PGP_KEY_VERSION_4 ? | ^~~~~~~~~~~~~~~~~ crypto/asymmetric_keys/pgp_public_key.c: At top level: >> crypto/asymmetric_keys/pgp_public_key.c:199:40: warning: 'enum pgp_packet_tag' declared inside parameter list will not be visible outside of this definition or declaration 199 | enum pgp_packet_tag type, | ^~~~~~~~~~~~~~ >> crypto/asymmetric_keys/pgp_public_key.c:199:55: error: parameter 2 ('type') has incomplete type 199 | enum pgp_packet_tag type, | ~~~~~~~~~~~~~~~~~~~~^~~~ >> crypto/asymmetric_keys/pgp_public_key.c:198:12: error: function declaration isn't a prototype [-Werror=strict-prototypes] 198 | static int pgp_process_public_key(struct pgp_parse_context *context, | ^~~~~~~~~~~~~~~~~~~~~~ crypto/asymmetric_keys/pgp_public_key.c: In function 'pgp_process_public_key': >> crypto/asymmetric_keys/pgp_public_key.c:213:21: error: 'PGP_PKT_USER_ID' undeclared (first use in this function) 213 | if (type == PGP_PKT_USER_ID) { | ^~~~~~~~~~~~~~~ >> crypto/asymmetric_keys/pgp_public_key.c:234:32: error: 'PGP_PUBKEY__LAST' undeclared (first use in this function) 234 | if (pgp.pubkey_algo >= PGP_PUBKEY__LAST) | ^~~~~~~~~~~~~~~~ >> crypto/asymmetric_keys/pgp_public_key.c:236:16: error: 'pgp_to_public_key_algo' undeclared (first use in this function); did you mean 'pgp_pubkey_algo'? 236 | algo = pgp_to_public_key_algo[pgp.pubkey_algo]; | ^~~~~~~~~~~~~~~~~~~~~~ | pgp_pubkey_algo crypto/asymmetric_keys/pgp_public_key.c: In function 'pgp_key_parse': >> crypto/asymmetric_keys/pgp_public_key.c:313:43: error: 'PGP_PKT_PUBLIC_KEY' undeclared (first use in this function) 313 | ctx.pgp.types_of_interest = (1 << PGP_PKT_PUBLIC_KEY) | | ^~~~~~~~~~~~~~~~~~ crypto/asymmetric_keys/pgp_public_key.c:314:43: error: 'PGP_PKT_USER_ID' undeclared (first use in this function) 314 | (1 << PGP_PKT_USER_ID); | ^~~~~~~~~~~~~~~ >> crypto/asymmetric_keys/pgp_public_key.c:315:32: error: assignment to 'int (*)(struct pgp_parse_context *, enum pgp_packet_tag, u8, const u8 *, size_t)' {aka 'int (*)(struct pgp_parse_context *, enum pgp_packet_tag, unsigned char, const unsigned char *, long unsigned int)'} from incompatible pointer type 'int (*)()' [-Werror=incompatible-pointer-types] 315 | ctx.pgp.process_packet = pgp_process_public_key; | ^ cc1: some warnings being treated as errors -- In file included from crypto/asymmetric_keys/pgp_preload.c:19: >> include/linux/pgplib.h:26:36: warning: 'enum pgp_packet_tag' declared inside parameter list will not be visible outside of this definition or declaration 26 | enum pgp_packet_tag type, | ^~~~~~~~~~~~~~ >> include/linux/pgplib.h:36:30: warning: 'version' is narrower than values of its type 36 | enum pgp_key_version version : 8; | ^~~~~~~ >> include/linux/pgplib.h:36:30: error: field 'version' has incomplete type >> include/linux/pgplib.h:37:30: warning: 'pubkey_algo' is narrower than values of its type 37 | enum pgp_pubkey_algo pubkey_algo : 8; | ^~~~~~~~~~~ >> include/linux/pgplib.h:37:30: error: field 'pubkey_algo' has incomplete type >> crypto/asymmetric_keys/pgp_preload.c:63:38: warning: 'enum pgp_packet_tag' declared inside parameter list will not be visible outside of this definition or declaration 63 | enum pgp_packet_tag type, u8 headerlen, | ^~~~~~~~~~~~~~ >> crypto/asymmetric_keys/pgp_preload.c:63:53: error: parameter 2 ('type') has incomplete type 63 | enum pgp_packet_tag type, u8 headerlen, | ~~~~~~~~~~~~~~~~~~~~^~~~ >> crypto/asymmetric_keys/pgp_preload.c:62:19: error: function declaration isn't a prototype [-Werror=strict-prototypes] 62 | static int __init found_pgp_key(struct pgp_parse_context *context, | ^~~~~~~~~~~~~ >> crypto/asymmetric_keys/pgp_preload.c:101:12: warning: no previous prototype for 'preload_pgp_keys' [-Wmissing-prototypes] 101 | int __init preload_pgp_keys(const u8 *pgpdata, size_t pgpdatalen, | ^~~~~~~~~~~~~~~~ crypto/asymmetric_keys/pgp_preload.c: In function 'preload_pgp_keys': >> crypto/asymmetric_keys/pgp_preload.c:107:43: error: 'PGP_PKT_PUBLIC_KEY' undeclared (first use in this function) 107 | ctx.pgp.types_of_interest = (1 << PGP_PKT_PUBLIC_KEY); | ^~~~~~~~~~~~~~~~~~ crypto/asymmetric_keys/pgp_preload.c:107:43: note: each undeclared identifier is reported only once for each function it appears in >> crypto/asymmetric_keys/pgp_preload.c:108:32: error: assignment to 'int (*)(struct pgp_parse_context *, enum pgp_packet_tag, u8, const u8 *, size_t)' {aka 'int (*)(struct pgp_parse_context *, enum pgp_packet_tag, unsigned char, const unsigned char *, long unsigned int)'} from incompatible pointer type 'int (*)()' [-Werror=incompatible-pointer-types] 108 | ctx.pgp.process_packet = found_pgp_key; | ^ cc1: some warnings being treated as errors Kconfig warnings: (for reference only) WARNING: unmet direct dependencies detected for PGP_KEY_PARSER Depends on [m]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] && ASYMMETRIC_PUBLIC_KEY_SUBTYPE [=m] Selected by [y]: - PGP_PRELOAD [=y] && CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=y] vim +/version +36 include/linux/pgplib.h b78af6579e15dc David Howells 2023-09-12 19 b78af6579e15dc David Howells 2023-09-12 20 /* b78af6579e15dc David Howells 2023-09-12 21 * PGP library packet parser b78af6579e15dc David Howells 2023-09-12 22 */ b78af6579e15dc David Howells 2023-09-12 23 struct pgp_parse_context { b78af6579e15dc David Howells 2023-09-12 24 u64 types_of_interest; b78af6579e15dc David Howells 2023-09-12 25 int (*process_packet)(struct pgp_parse_context *context, b78af6579e15dc David Howells 2023-09-12 @26 enum pgp_packet_tag type, b78af6579e15dc David Howells 2023-09-12 27 u8 headerlen, b78af6579e15dc David Howells 2023-09-12 28 const u8 *data, b78af6579e15dc David Howells 2023-09-12 29 size_t datalen); b78af6579e15dc David Howells 2023-09-12 30 }; b78af6579e15dc David Howells 2023-09-12 31 b78af6579e15dc David Howells 2023-09-12 32 extern int pgp_parse_packets(const u8 *data, size_t datalen, b78af6579e15dc David Howells 2023-09-12 33 struct pgp_parse_context *ctx); b78af6579e15dc David Howells 2023-09-12 34 b78af6579e15dc David Howells 2023-09-12 35 struct pgp_parse_pubkey { b78af6579e15dc David Howells 2023-09-12 @36 enum pgp_key_version version : 8; b78af6579e15dc David Howells 2023-09-12 @37 enum pgp_pubkey_algo pubkey_algo : 8; b78af6579e15dc David Howells 2023-09-12 38 __kernel_old_time_t creation_time; b78af6579e15dc David Howells 2023-09-12 39 __kernel_old_time_t expires_at; b78af6579e15dc David Howells 2023-09-12 40 }; b78af6579e15dc David Howells 2023-09-12 41 :::::: The code at line 36 was first introduced by commit :::::: b78af6579e15dcdff86504da90af77f3e890270e PGPLIB: Basic packet parser :::::: TO: David Howells <dhowells(a)redhat.com> :::::: CC: zgzxx <zhangguangzhi3(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] Fix UAF in __update_blocked_fair
by liukai 29 Nov '24

29 Nov '24

From: Wenyu Huang <huangwenyu5(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB7B5F -------------------------------- After running the long-term stability test for a period of time, the UAF problem is triggered: [ 9533.667062] dump_stack_lvl+0x47/0x80 [ 9533.667158] print_address_description.constprop.0+0x66/0x300 [ 9533.667346] print_report+0x3e/0x70 [ 9533.667436] kasan_report+0xb4/0xf0 [ 9533.667619] __update_blocked_fair+0x421/0x15c0 [ 9533.667804] update_blocked_averages+0x14d/0x360 [ 9533.668176] run_rebalance_domains+0x66/0xa0 [ 9533.668271] handle_softirqs+0x10e/0x4c0 [ 9533.668370] irq_exit_rcu+0xea/0x120 [ 9533.668458] sysvec_apic_timer_interrupt+0x72/0x90 The unthrottle_qos_sched_group adds the leaf_cfs_rq back to the leaf_cfs_rq and sets on_list to 1. When unthrottle_qos_sched_group is executed in free_fair_sched_group, the node is inserted into the linked list again and then freed. So it causes UAF. Fixes: 926b9b0cd97e ("sched: Throttle qos cfs_rq when current cpu is running online task") Signed-off-by: Wenyu Huang <huangwenyu5(a)huawei.com> Signed-off-by: Liu Kai <liukai284(a)huawei.com> --- kernel/sched/fair.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index f1cd57e70f1f..13be1bd6cc53 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -14704,10 +14704,6 @@ void free_fair_sched_group(struct task_group *tg) int i; for_each_possible_cpu(i) { -#ifdef CONFIG_QOS_SCHED - if (tg->cfs_rq && tg->cfs_rq[i]) - unthrottle_qos_sched_group(tg->cfs_rq[i]); -#endif if (tg->cfs_rq) kfree(tg->cfs_rq[i]); if (tg->se) @@ -14794,6 +14790,11 @@ void unregister_fair_sched_group(struct task_group *tg) if (tg->se[cpu]) remove_entity_load_avg(tg->se[cpu]); + #ifdef CONFIG_QOS_SCHED + if (tg->cfs_rq && tg->cfs_rq[cpu]) + unthrottle_qos_sched_group(tg->cfs_rq[cpu]); + #endif + /* * Only empty task groups can be destroyed; so we can speculatively * check on_list without danger of it being re-added. -- 2.34.1

2 1