- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] pci:vga fix race condition in vga_arb_write
by Yuntao Liu 05 Jun '25

05 Jun '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICCYVI CVE: NA -------------------------------- Fixes: deb2d2ecd43d ("PCI/GPU: implement VGA arbitration on Linux") The following code has a race condition under concurrency. if (io_state & VGA_RSRC_LEGACY_IO) uc->io_cnt--; in race condition: pre: uc->io_cnt = 1 post: uc->io_cnt = 4294967295 move vga_put code below changing uc->io_cnt code. Signed-off-by: Yuntao Liu <liuyuntao12(a)huawei.com> --- drivers/gpu/vga/vgaarb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/vga/vgaarb.c b/drivers/gpu/vga/vgaarb.c index c61b04555779..41f56e10c1d6 100644 --- a/drivers/gpu/vga/vgaarb.c +++ b/drivers/gpu/vga/vgaarb.c @@ -1123,13 +1123,13 @@ static ssize_t vga_arb_write(struct file *file, const char __user *buf, goto done; } - vga_put(pdev, io_state); - if (io_state & VGA_RSRC_LEGACY_IO) uc->io_cnt--; if (io_state & VGA_RSRC_LEGACY_MEM) uc->mem_cnt--; + vga_put(pdev, io_state); + ret_val = count; goto done; } else if (strncmp(curr_pos, "trylock ", 8) == 0) { -- 2.34.1

2 1

[PATCH OLK-5.10] pci:vga fix race condition in vga_arb_write
by Yuntao Liu 05 Jun '25

05 Jun '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICCYVI CVE: NA -------------------------------- Fixes: deb2d2ecd43d ("PCI/GPU: implement VGA arbitration on Linux") The following code has a race condition under concurrency. if (io_state & VGA_RSRC_LEGACY_IO) uc->io_cnt--; in race condition: pre: uc->io_cnt = 1 post: uc->io_cnt = 4294967295 move vga_put code below changing uc->io_cnt code. Signed-off-by: Yuntao Liu <liuyuntao12(a)huawei.com> --- drivers/gpu/vga/vgaarb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/vga/vgaarb.c b/drivers/gpu/vga/vgaarb.c index 5180c5687ee5..9e0d3c454c7d 100644 --- a/drivers/gpu/vga/vgaarb.c +++ b/drivers/gpu/vga/vgaarb.c @@ -1171,13 +1171,13 @@ static ssize_t vga_arb_write(struct file *file, const char __user *buf, goto done; } - vga_put(pdev, io_state); - if (io_state & VGA_RSRC_LEGACY_IO) uc->io_cnt--; if (io_state & VGA_RSRC_LEGACY_MEM) uc->mem_cnt--; + vga_put(pdev, io_state); + ret_val = count; goto done; } else if (strncmp(curr_pos, "trylock ", 8) == 0) { -- 2.34.1

2 1

[PATCH OLK-6.6] pci:vga fix race condition in vga_arb_write
by Yuntao Liu 05 Jun '25

05 Jun '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICCYVI CVE: NA -------------------------------- Fixes: deb2d2ecd43d ("PCI/GPU: implement VGA arbitration on Linux") The following code has a race condition under concurrency. if (io_state & VGA_RSRC_LEGACY_IO) uc->io_cnt--; in race condition: pre: uc->io_cnt = 1 post: uc->io_cnt = 4294967295 move vga_put code below changing uc->io_cnt code. Signed-off-by: Yuntao Liu <liuyuntao12(a)huawei.com> --- drivers/pci/vgaarb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/pci/vgaarb.c b/drivers/pci/vgaarb.c index 5e6b1eb54c64..ed37fd3dcdef 100644 --- a/drivers/pci/vgaarb.c +++ b/drivers/pci/vgaarb.c @@ -1261,13 +1261,13 @@ static ssize_t vga_arb_write(struct file *file, const char __user *buf, goto done; } - vga_put(pdev, io_state); - if (io_state & VGA_RSRC_LEGACY_IO) uc->io_cnt--; if (io_state & VGA_RSRC_LEGACY_MEM) uc->mem_cnt--; + vga_put(pdev, io_state); + ret_val = count; goto done; } else if (strncmp(curr_pos, "trylock ", 8) == 0) { -- 2.34.1

2 1

[PATCH OLK-6.6] pci:vga fix race condition in vga_arb_write
by Yuntao Liu 05 Jun '25

05 Jun '25

Offering: HULK hulk inclusion category: bugfix bugzilla: 190653 -------------------------------- Fixes: deb2d2ecd43d ("PCI/GPU: implement VGA arbitration on Linux") The following code has a race condition under concurrency. if (io_state & VGA_RSRC_LEGACY_IO) uc->io_cnt--; in race condition: pre: uc->io_cnt = 1 post: uc->io_cnt = 4294967295 move vga_put code below changing uc->io_cnt code. Signed-off-by: Yuntao Liu <liuyuntao12(a)huawei.com> --- drivers/pci/vgaarb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/pci/vgaarb.c b/drivers/pci/vgaarb.c index 5e6b1eb54c64..ed37fd3dcdef 100644 --- a/drivers/pci/vgaarb.c +++ b/drivers/pci/vgaarb.c @@ -1261,13 +1261,13 @@ static ssize_t vga_arb_write(struct file *file, const char __user *buf, goto done; } - vga_put(pdev, io_state); - if (io_state & VGA_RSRC_LEGACY_IO) uc->io_cnt--; if (io_state & VGA_RSRC_LEGACY_MEM) uc->mem_cnt--; + vga_put(pdev, io_state); + ret_val = count; goto done; } else if (strncmp(curr_pos, "trylock ", 8) == 0) { -- 2.34.1

2 1

[PATCH OLK-5.10] pci:vga fix race condition in vga_arb_write
by Yuntao Liu 05 Jun '25

05 Jun '25

Offering: HULK hulk inclusion category: bugfix bugzilla: 190653 CVE: NA -------------------------------- Fixes: deb2d2ecd43d ("PCI/GPU: implement VGA arbitration on Linux") The following code has a race condition under concurrency. if (io_state & VGA_RSRC_LEGACY_IO) uc->io_cnt--; in race condition: pre: uc->io_cnt = 1 post: uc->io_cnt = 4294967295 move vga_put code below changing uc->io_cnt code. Signed-off-by: Yuntao Liu <liuyuntao12(a)huawei.com> --- drivers/gpu/vga/vgaarb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/vga/vgaarb.c b/drivers/gpu/vga/vgaarb.c index 5180c5687ee5..9e0d3c454c7d 100644 --- a/drivers/gpu/vga/vgaarb.c +++ b/drivers/gpu/vga/vgaarb.c @@ -1171,13 +1171,13 @@ static ssize_t vga_arb_write(struct file *file, const char __user *buf, goto done; } - vga_put(pdev, io_state); - if (io_state & VGA_RSRC_LEGACY_IO) uc->io_cnt--; if (io_state & VGA_RSRC_LEGACY_MEM) uc->mem_cnt--; + vga_put(pdev, io_state); + ret_val = count; goto done; } else if (strncmp(curr_pos, "trylock ", 8) == 0) { -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] pci:vga fix race condition in vga_arb_write
by Yuntao Liu 05 Jun '25

05 Jun '25

Offering: HULK hulk inclusion category: bugfix bugzilla: 190653 CVE: NA -------------------------------- Fixes: deb2d2ecd43d ("PCI/GPU: implement VGA arbitration on Linux") The following code has a race condition under concurrency. if (io_state & VGA_RSRC_LEGACY_IO) uc->io_cnt--; in race condition: pre: uc->io_cnt = 1 post: uc->io_cnt = 4294967295 move vga_put code below changing uc->io_cnt code. Signed-off-by: Yuntao Liu <liuyuntao12(a)huawei.com> --- drivers/gpu/vga/vgaarb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/vga/vgaarb.c b/drivers/gpu/vga/vgaarb.c index c61b04555779..41f56e10c1d6 100644 --- a/drivers/gpu/vga/vgaarb.c +++ b/drivers/gpu/vga/vgaarb.c @@ -1123,13 +1123,13 @@ static ssize_t vga_arb_write(struct file *file, const char __user *buf, goto done; } - vga_put(pdev, io_state); - if (io_state & VGA_RSRC_LEGACY_IO) uc->io_cnt--; if (io_state & VGA_RSRC_LEGACY_MEM) uc->mem_cnt--; + vga_put(pdev, io_state); + ret_val = count; goto done; } else if (strncmp(curr_pos, "trylock ", 8) == 0) { -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
by Yuntao Liu 05 Jun '25

05 Jun '25

From: Artemii Karasev <karasev(a)ispras.ru> stable inclusion from stable-v4.19.273 commit 6e1f586ddec48d71016b81acf68ba9f49ca54db8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVYV CVE: CVE-2023-52988 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b9cee506da2b7920b5ea02ccd8e78a907d0ee7aa ] snd_hda_get_connections() can return a negative error code. It may lead to accessing 'conn' array at a negative index. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Artemii Karasev <karasev(a)ispras.ru> Fixes: 30b4503378c9 ("ALSA: hda - Expose secret DAC-AA connection of some VIA codecs") Link: https://lore.kernel.org/r/20230119082259.3634-1-karasev@ispras.ru Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yuntao Liu <liuyuntao12(a)huawei.com> --- sound/pci/hda/patch_via.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/sound/pci/hda/patch_via.c b/sound/pci/hda/patch_via.c index 6b9617aee0e6..a6253e4f44bd 100644 --- a/sound/pci/hda/patch_via.c +++ b/sound/pci/hda/patch_via.c @@ -833,6 +833,9 @@ static int add_secret_dac_path(struct hda_codec *codec) return 0; nums = snd_hda_get_connections(codec, spec->gen.mixer_nid, conn, ARRAY_SIZE(conn) - 1); + if (nums < 0) + return nums; + for (i = 0; i < nums; i++) { if (get_wcaps_type(get_wcaps(codec, conn[i])) == AC_WID_AUD_OUT) return 0; -- 2.34.1

2 1

[PATCH OLK-6.6] SELinux: Add check for the user data passed to kcalloc in hashtab_init
by Cai Xinchen 05 Jun '25

05 Jun '25

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICC1TY -------------------------------- When the user writes some data to the file /sys/fs/selinux/load, there is no check for the user buf passed to kcalloc. Syzkaller shows this warning: WARNING: CPU: 1 PID: 6642 at mm/page_alloc.c __alloc_pages_noprof ___kmalloc_large_node __kmalloc_large_node_noprof __kmalloc_noprof hashtab_init common_read policydb_read security_load_policy sel_write_load vfs_write ksys_write do_syscall_64 This warning can be reproduced by writing this content to /sys/fs/selinux/load 8cff7cf9 08000000 5345204c 696e7578 15000000 e0ff962a 08000000 07000000 4cf523cd 7eec2688 6d70a6b7 c78b496f 1a0a192c ea34ff41 70581a74 3ff0cfb9 7ea0f0d1 70d1fe14 41c2f7c8 ea1c78dd 17a19249 35210081 a83c30ec 4171450b fc1de12c fe1ff342 a887 Add check to prevent the size passed to kcalloc larger than MAX_ORDER after get_order. Fixes: 24def7bb92c1 ("selinux: prepare for inlining of hashtab functions") Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- security/selinux/ss/hashtab.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/security/selinux/ss/hashtab.c b/security/selinux/ss/hashtab.c index ac5cdddfbf78..86ccb8715bd9 100644 --- a/security/selinux/ss/hashtab.c +++ b/security/selinux/ss/hashtab.c @@ -29,6 +29,18 @@ static u32 hashtab_compute_size(u32 nel) return nel == 0 ? 0 : roundup_pow_of_two(nel); } +static bool is_order_out_of_range(u32 size, struct hashtab *h) +{ + size_t bytes; + u32 order; + + if (unlikely(check_mul_overflow(size, sizeof(*h->htable), &bytes))) + return true; + + order = get_order(bytes); + return order > MAX_ORDER; +} + int hashtab_init(struct hashtab *h, u32 nel_hint) { u32 size = hashtab_compute_size(nel_hint); @@ -39,6 +51,9 @@ int hashtab_init(struct hashtab *h, u32 nel_hint) h->htable = NULL; if (size) { + if (is_order_out_of_range(size, h)) + return -ENOMEM; + h->htable = kcalloc(size, sizeof(*h->htable), GFP_KERNEL); if (!h->htable) return -ENOMEM; -- 2.34.1

2 1

[PATCH OLK-5.10] SELinux: Add check for the user data passed to kcalloc in hashtab_init
by Cai Xinchen 05 Jun '25

05 Jun '25

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICC1TY -------------------------------- When the user writes some data to the file /sys/fs/selinux/load, there is no check for the user buf passed to kcalloc. Syzkaller shows this warning: WARNING: CPU: 1 PID: 6642 at mm/page_alloc.c __alloc_pages_noprof ___kmalloc_large_node __kmalloc_large_node_noprof __kmalloc_noprof hashtab_init common_read policydb_read security_load_policy sel_write_load vfs_write ksys_write do_syscall_64 This warning can be reproduced by writing this content to /sys/fs/selinux/load 8cff7cf9 08000000 5345204c 696e7578 15000000 e0ff962a 08000000 07000000 4cf523cd 7eec2688 6d70a6b7 c78b496f 1a0a192c ea34ff41 70581a74 3ff0cfb9 7ea0f0d1 70d1fe14 41c2f7c8 ea1c78dd 17a19249 35210081 a83c30ec 4171450b fc1de12c fe1ff342 a887 Add check to prevent the size passed to kcalloc larger than or equal MAX_ORDER after get_order. Fixes: 24def7bb92c1 ("selinux: prepare for inlining of hashtab functions") Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- security/selinux/ss/hashtab.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/security/selinux/ss/hashtab.c b/security/selinux/ss/hashtab.c index e8960a59586c..91cfb07a3e51 100644 --- a/security/selinux/ss/hashtab.c +++ b/security/selinux/ss/hashtab.c @@ -28,6 +28,18 @@ static u32 hashtab_compute_size(u32 nel) return nel == 0 ? 0 : roundup_pow_of_two(nel); } +static bool is_order_out_of_range(u32 size, struct hashtab *h) +{ + size_t bytes = 0; + u32 order; + + if (unlikely(check_mul_overflow((size_t)size, sizeof(*h->htable), &bytes))) + return true; + + order = (u32)get_order(bytes); + return order >= MAX_ORDER; +} + int hashtab_init(struct hashtab *h, u32 nel_hint) { u32 size = hashtab_compute_size(nel_hint); @@ -38,6 +50,9 @@ int hashtab_init(struct hashtab *h, u32 nel_hint) h->htable = NULL; if (size) { + if (is_order_out_of_range(size, h)) + return -ENOMEM; + h->htable = kcalloc(size, sizeof(*h->htable), GFP_KERNEL); if (!h->htable) return -ENOMEM; -- 2.34.1

2 1

[PATCH OLK-5.10 0/3] CVE-2024-58100
by Chen Zhongjin 05 Jun '25

05 Jun '25

Chen Zhongjin (1): bpf: Fix kabi breakage for changes_pkt_data in struct bpf_prog_aux Eduard Zingerman (2): bpf: check changes_pkt_data property for extension programs bpf: fix null dereference when computing changes_pkt_data of prog w/o subprogs include/linux/bpf.h | 1 + kernel/bpf/verifier.c | 19 +++++++++++++++---- 2 files changed, 16 insertions(+), 4 deletions(-) -- 2.25.1

2 4