- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] usb: cdc-acm: Check control transfer buffer size before access
by Yuntao Liu 24 Feb '25

24 Feb '25

From: Jann Horn <jannh(a)google.com> stable inclusion from stable-v6.6.79 commit 6abb510251e75f875797d8983a830e6731fa281c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBO4LT CVE: CVE-2025-21704 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e563b01208f4d1f609bcab13333b6c0e24ce6a01 upstream. If the first fragment is shorter than struct usb_cdc_notification, we can't calculate an expected_size. Log an error and discard the notification instead of reading lengths from memory outside the received data, which can lead to memory corruption when the expected_size decreases between fragments, causing `expected_size - acm->nb_index` to wrap. This issue has been present since the beginning of git history; however, it only leads to memory corruption since commit ea2583529cd1 ("cdc-acm: reassemble fragmented notifications"). A mitigating factor is that acm_ctrl_irq() can only execute after userspace has opened /dev/ttyACM*; but if ModemManager is running, ModemManager will do that automatically depending on the USB device's vendor/product IDs and its other interfaces. Cc: stable <stable(a)kernel.org> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Jann Horn <jannh(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yuntao Liu <liuyuntao12(a)huawei.com> --- drivers/usb/class/cdc-acm.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c index 605fea461102..fcba1320be5b 100644 --- a/drivers/usb/class/cdc-acm.c +++ b/drivers/usb/class/cdc-acm.c @@ -371,7 +371,7 @@ static void acm_process_notification(struct acm *acm, unsigned char *buf) static void acm_ctrl_irq(struct urb *urb) { struct acm *acm = urb->context; - struct usb_cdc_notification *dr = urb->transfer_buffer; + struct usb_cdc_notification *dr; unsigned int current_size = urb->actual_length; unsigned int expected_size, copy_size, alloc_size; int retval; @@ -398,9 +398,20 @@ static void acm_ctrl_irq(struct urb *urb) usb_mark_last_busy(acm->dev); - if (acm->nb_index) + if (acm->nb_index == 0) { + /* + * The first chunk of a message must contain at least the + * notification header with the length field, otherwise we + * can't get an expected_size. + */ + if (current_size < sizeof(struct usb_cdc_notification)) { + dev_dbg(&acm->control->dev, "urb too short\n"); + goto exit; + } + dr = urb->transfer_buffer; + } else { dr = (struct usb_cdc_notification *)acm->notification_buffer; - + } /* size = notification-header + (optional) data */ expected_size = sizeof(struct usb_cdc_notification) + le16_to_cpu(dr->wLength); -- 2.34.1

2 1

[PATCH OLK-5.10] Fix kfree mismatch reported by cocci
by Wang Zhaolong 24 Feb '25

24 Feb '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBNI18 CVE: NA -------------------------------- fs/cifs/cifssmb.c: warning: kfree_mismatch.cocci ./fs/cifs/cifssmb.c:2129:15-16: WARNING kmalloc is used to allocate this memory at line 2125 kcalloc() ends up using kmalloc() to allocate memory, so use kfree() instead of kvfree() to free memory. Fixes: 36baf49790be ("[Huawei] cifs: Fix pages leak when cifs_writedata allocate fails in cifs_writedata_direct_alloc()") Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- fs/cifs/cifssmb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c index 1a6c9ac25615..643729b498a0 100644 --- a/fs/cifs/cifssmb.c +++ b/fs/cifs/cifssmb.c @@ -2126,7 +2126,7 @@ cifs_writedata_alloc(unsigned int nr_pages, work_func_t complete) if (pages) { wdata = cifs_writedata_direct_alloc(pages, complete); if (!wdata) - kvfree(pages); + kfree(pages); } return wdata; -- 2.34.3

2 1

[PATCH openEuler-25.03 00/20] mm: arm64: Add kernel replication feature
by darvish.denis＠huawei.com 24 Feb '25

24 Feb '25

From: Denis Darvish <darvish.denis(a)huawei.com> This patchset implements initial support of kernel text and rodata replication for AArch64. openEuler 25.03 is used as a baseline. Current implementation supports next functionality: 1. Replicated kernel text and rodata per-NUMA node 2. Vmalloc is able to work with replicated areas, so kernel modules text and rodata also replicated during modules loading stage. 3. BPF handlers are not replicated by default, but this can be easily done by using existent APIs. 4. KPROBES, KGDB and all functionality that depends on kernel text patching work without any limitation. 5. KPTI, KASLR, and KASAN fully supported. 6. Replicates parts of translation table related to replicated text and rodata. 7. 4K and 64K pages are supported. Translation tables synchronization is necessary only in several special cases: 1. Kernel boot 2. Modules deployment 3. Any allocation in user space that require new PUD/P4D In current design mutable kernel data modifications don't require synchronization between translation tables due to on 64-bit platforms all physical memory already mapped in kernel space and this mapping is persistent. In user space the translation tables synchronizations are quite rare due to the only case is new PUD/P4D allocation. At the current stage only the PGD layer is replicated for the user space. Please refer to the next pics. TT overview: NODE 0 NODE 1 USER KERNEL USER KERNEL --------------------- --------------------- PGD | | | | | | | | |*| | | | | | | | | |*| --------------------- --------------------- | | ------------------- ------------------- | | --------------------- --------------------- PUD | | | | | | | |*|*| | | | | | | | |*|*| --------------------- --------------------- | | ------------------- ------------------- | | --------------------- --------------------- PMD |READ-ONLY|MUTABLE | |READ-ONLY|MUTABLE | --------------------- --------------------- | | | | | -------------------------- | | | -------- ------- -------- PHYS | | | | | | MEM -------- ------- -------- <------> <------> NODE 0 Shared NODE 1 between nodes * - entries unique in each table TT synchronization: NODE 0 NODE 1 USER KERNEL USER KERNEL --------------------- --------------------- PGD | | |0| | | | | | | | | |0| | | | | | | --------------------- --------------------- | | | | | PUD_ALLOC / P4D_ALLOC | | IN USERSPACE | \/ --------------------- --------------------- PGD | | |p| | | | | | | | | |p| | | | | | | --------------------- --------------------- | | | | --------------------------- | --------------------- PUD/P4D | | | | | | | | | | --------------------- Known problems: 1. Not all paging modes are supported, for example, the 16K 4-level table is not supported right now. 2. Replication support in vmalloc, possibly, can be optimized in future. 3. Module APIs currently have lack of memory policies support. This part will be fixed in future. Nikita Panov (20): mm: arm64 add Kconfig option for kernel replication arm64: align kernel text and rodata mm: allow per-NUMA node local P4D/PUD/PMD/PTE allocation arm64: add arch callbacks for kernel replication mm: per-NUMA node replication core infrastructure mm: add apply_to_page_range() for replicated memory mm: add support of memory protection for NUMA replicas arm64: add support of memory protection for NUMA replicas mm: set memory permissions for BPF handlers replicas arm64: bpf arch text poke support mm: add replicas allocation support for vmalloc arm64: enable per-NUMA node kernel text and rodata replication mm: enable per-NUMA node kernel text and rodata replication arm64: make power management aware about kernel replication arm64: make KASAN aware about kernel replication arm64: make kernel text patching aware about replicas arm64: add support of NUMA replication for efi page tables arm64: add support of NUMA replication for ptdump arm64: add kernel modules text and rodata replication support mm: init kernel modules with replication support arch/arm64/include/asm/efi.h | 18 +- arch/arm64/include/asm/mmu_context.h | 4 + arch/arm64/include/asm/numa_replication.h | 54 ++ arch/arm64/include/asm/pgtable.h | 13 + arch/arm64/kernel/alternative.c | 27 +- arch/arm64/kernel/cpufeature.c | 5 + arch/arm64/kernel/hibernate.c | 5 + arch/arm64/kernel/module.c | 36 +- arch/arm64/kernel/patching.c | 59 ++ arch/arm64/kernel/sleep.S | 8 + arch/arm64/kernel/smp.c | 8 + arch/arm64/kernel/suspend.c | 6 + arch/arm64/kernel/vmlinux.lds.S | 22 + arch/arm64/mm/context.c | 3 +- arch/arm64/mm/init.c | 49 ++ arch/arm64/mm/kasan_init.c | 68 +- arch/arm64/mm/mmu.c | 41 +- arch/arm64/mm/pageattr.c | 62 ++ arch/arm64/mm/pgd.c | 77 +++ arch/arm64/mm/ptdump.c | 17 +- arch/arm64/net/bpf_jit_comp.c | 4 +- drivers/firmware/efi/arm-runtime.c | 17 +- include/asm-generic/pgalloc.h | 78 +++ include/asm-generic/pgtable-nop4d.h | 5 + include/asm-generic/pgtable-nopmd.h | 5 + include/asm-generic/pgtable-nopud.h | 5 + include/asm-generic/set_memory.h | 12 + include/linux/gfp.h | 5 + include/linux/mm.h | 93 ++- include/linux/mm_types.h | 4 + include/linux/moduleloader.h | 6 + include/linux/numa_kernel_replication.h | 184 ++++++ include/linux/set_memory.h | 10 + include/linux/vmalloc.h | 19 + init/main.c | 17 + kernel/bpf/bpf_struct_ops.c | 8 +- kernel/bpf/core.c | 4 +- kernel/bpf/trampoline.c | 6 +- kernel/module/main.c | 32 + kernel/module/strict_rwx.c | 14 +- mm/Kconfig | 10 + mm/Makefile | 1 + mm/memory.c | 295 ++++++++- mm/mm_init.c | 1 + mm/numa_kernel_replication.c | 759 ++++++++++++++++++++++ mm/page_alloc.c | 20 + mm/vmalloc.c | 469 ++++++++++--- net/bpf/bpf_dummy_struct_ops.c | 2 +- 48 files changed, 2520 insertions(+), 147 deletions(-) create mode 100644 arch/arm64/include/asm/numa_replication.h create mode 100644 include/linux/numa_kernel_replication.h create mode 100644 mm/numa_kernel_replication.c -- 2.34.1

1 20

[PATCH OLK-6.6] arm64/mpam: Try reading again if monitor instance returns not ready
by Zeng Heng 24 Feb '25

24 Feb '25

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAG93D -------------------------------- If the MSC monitor instance is the first time to configure, this single monitor need to wait 'not ready' time before getting the valid value. Components made up of multiple MSC may need values from each MSC, so when getting the whole component monitor values, need to wait every single monitor instance 'not ready' time instead of once per component. Fixes: bb66b4d115e5 ("arm_mpam: Add mpam_msmon_read() to read monitor value") Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/platform/mpam/mpam_devices.c | 37 +++++++++++++--------------- 1 file changed, 17 insertions(+), 20 deletions(-) diff --git a/drivers/platform/mpam/mpam_devices.c b/drivers/platform/mpam/mpam_devices.c index 6031551ed827..4aebefd58ac1 100644 --- a/drivers/platform/mpam/mpam_devices.c +++ b/drivers/platform/mpam/mpam_devices.c @@ -1038,11 +1038,14 @@ static void __ris_msmon_read(void *arg) } *(m->val) += now; + m->err = 0; } static int _msmon_read(struct mpam_component *comp, struct mon_read *arg) { int err, idx; + bool read_again; + u64 wait_jiffies; struct mpam_msc *msc; struct mpam_msc_ris *ris; @@ -1051,10 +1054,23 @@ static int _msmon_read(struct mpam_component *comp, struct mon_read *arg) arg->ris = ris; msc = ris->msc; + read_again = false; +again: mutex_lock(&msc->lock); err = smp_call_function_any(&msc->accessibility, __ris_msmon_read, arg, true); mutex_unlock(&msc->lock); + + if (arg->err == -EBUSY && !read_again) { + read_again = true; + + wait_jiffies = usecs_to_jiffies(comp->class->nrdy_usec); + while (wait_jiffies) + wait_jiffies = schedule_timeout_uninterruptible(wait_jiffies); + + goto again; + } + if (!err && arg->err) err = arg->err; if (err) @@ -1068,9 +1084,7 @@ static int _msmon_read(struct mpam_component *comp, struct mon_read *arg) int mpam_msmon_read(struct mpam_component *comp, struct mon_cfg *ctx, enum mpam_device_features type, u64 *val) { - int err; struct mon_read arg; - u64 wait_jiffies = 0; struct mpam_props *cprops = &comp->class->props; might_sleep(); @@ -1087,24 +1101,7 @@ int mpam_msmon_read(struct mpam_component *comp, struct mon_cfg *ctx, arg.val = val; *val = 0; - err = _msmon_read(comp, &arg); - if (err == -EBUSY) - wait_jiffies = usecs_to_jiffies(comp->class->nrdy_usec); - - while (wait_jiffies) - wait_jiffies = schedule_timeout_uninterruptible(wait_jiffies); - - if (err == -EBUSY) { - memset(&arg, 0, sizeof(arg)); - arg.ctx = ctx; - arg.type = type; - arg.val = val; - *val = 0; - - err = _msmon_read(comp, &arg); - } - - return err; + return _msmon_read(comp, &arg); } void mpam_msmon_reset_all_mbwu(struct mpam_component *comp) -- 2.25.1

2 1

[PATCH OLK-5.10] power: supply: gpio-charger: Fix set charge current limits
by Wenyu Huang 24 Feb '25

24 Feb '25

From: Dimitri Fedrau <dimitri.fedrau(a)liebherr.com> stable inclusion from stable-v5.10.233 commit b29c7783ac1fe36d639c089cf471ac7a46df05f0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBI63F CVE: CVE-2024-57792 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit afc6e39e824ad0e44b2af50a97885caec8d213d1 upstream. Fix set charge current limits for devices which allow to set the lowest charge current limit to be greater zero. If requested charge current limit is below lowest limit, the index equals current_limit_map_size which leads to accessing memory beyond allocated memory. Fixes: be2919d8355e ("power: supply: gpio-charger: add charge-current-limit feature") Cc: stable(a)vger.kernel.org Signed-off-by: Dimitri Fedrau <dimitri.fedrau(a)liebherr.com> Link: https://lore.kernel.org/r/20241209-fix-charge-current-limit-v1-1-760d9b8f2a… Signed-off-by: Sebastian Reichel <sebastian.reichel(a)collabora.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wenyu Huang <huangwenyu5(a)huawei.com> --- drivers/power/supply/gpio-charger.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/power/supply/gpio-charger.c b/drivers/power/supply/gpio-charger.c index 68212b39785b..6139f736ecbe 100644 --- a/drivers/power/supply/gpio-charger.c +++ b/drivers/power/supply/gpio-charger.c @@ -67,6 +67,14 @@ static int set_charge_current_limit(struct gpio_charger *gpio_charger, int val) if (gpio_charger->current_limit_map[i].limit_ua <= val) break; } + + /* + * If a valid charge current limit isn't found, default to smallest + * current limitation for safety reasons. + */ + if (i >= gpio_charger->current_limit_map_size) + i = gpio_charger->current_limit_map_size - 1; + mapping = gpio_charger->current_limit_map[i]; for (i = 0; i < ndescs; i++) { -- 2.34.1

2 1

[PATCH OLK-5.10 0/4] CVE-2024-57857
by Liu Jian 24 Feb '25

24 Feb '25

CVE-2024-57857 Bernard Metzler (2): RDMA/siw: Enable siw on tunnel devices RDMA/siw: Remove direct link to net_device Chuck Lever (1): RDMA/siw: Fabricate a GID on tun and loopback devices Kamal Heib (1): RDMA/siw: Use helper function to set sys_image_guid drivers/infiniband/sw/siw/siw.h | 8 +++--- drivers/infiniband/sw/siw/siw_cm.c | 27 ++++++++++++++---- drivers/infiniband/sw/siw/siw_main.c | 38 +++++++------------------ drivers/infiniband/sw/siw/siw_verbs.c | 41 ++++++++++++++++++--------- 4 files changed, 64 insertions(+), 50 deletions(-) -- 2.34.1

2 5

[openeuler:OLK-6.6 1966/1966] include/linux/fortify-string.h:57:33: warning: '__builtin_memcpy' reading between 65 and 536870912 bytes from a region of size 64
by kernel test robot 24 Feb '25

24 Feb '25

Hi Guo, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 88b69da4524a4c574fa7642d89cb392506b4595e commit: f04c0f3eb9b49427c273cd3e4d5a2ff895855b4b [1966/1966] make OPTIMIZE_INLINING config editable config: arm64-randconfig-001-20250224 (https://download.01.org/0day-ci/archive/20250224/202502241304.ilCBBhWc-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250224/202502241304.ilCBBhWc-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202502241304.ilCBBhWc-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from include/linux/string.h:294, from include/linux/bitmap.h:11, from include/linux/cpumask.h:12, from include/linux/smp.h:13, from include/linux/lockdep.h:14, from include/linux/spinlock.h:63, from include/linux/swait.h:7, from include/linux/completion.h:12, from kernel/padata.c:14: In function 'bitmap_copy', inlined from 'cpumask_copy' at include/linux/cpumask.h:740:2, inlined from '__padata_set_cpumasks' at kernel/padata.c:709:2: >> include/linux/fortify-string.h:57:33: warning: '__builtin_memcpy' reading between 65 and 536870912 bytes from a region of size 64 [-Wstringop-overread] 57 | #define __underlying_memcpy __builtin_memcpy | ^ include/linux/fortify-string.h:648:9: note: in expansion of macro '__underlying_memcpy' 648 | __underlying_##op(p, q, __fortify_size); \ | ^~~~~~~~~~~~~ include/linux/fortify-string.h:693:26: note: in expansion of macro '__fortify_memcpy_chk' 693 | #define memcpy(p, q, s) __fortify_memcpy_chk(p, q, s, \ | ^~~~~~~~~~~~~~~~~~~~ include/linux/bitmap.h:268:17: note: in expansion of macro 'memcpy' 268 | memcpy(dst, src, len); | ^~~~~~ kernel/padata.c: In function '__padata_set_cpumasks': kernel/padata.c:692:48: note: source object 'pcpumask' of size [0, 64] 692 | cpumask_var_t pcpumask, | ~~~~~~~~~~~~~~^~~~~~~~ In function 'bitmap_copy', inlined from 'cpumask_copy' at include/linux/cpumask.h:740:2, inlined from '__padata_set_cpumasks' at kernel/padata.c:709:2: >> include/linux/fortify-string.h:57:33: warning: '__builtin_memcpy' reading between 65 and 536870912 bytes from a region of size 64 [-Wstringop-overread] 57 | #define __underlying_memcpy __builtin_memcpy | ^ include/linux/fortify-string.h:648:9: note: in expansion of macro '__underlying_memcpy' 648 | __underlying_##op(p, q, __fortify_size); \ | ^~~~~~~~~~~~~ include/linux/fortify-string.h:693:26: note: in expansion of macro '__fortify_memcpy_chk' 693 | #define memcpy(p, q, s) __fortify_memcpy_chk(p, q, s, \ | ^~~~~~~~~~~~~~~~~~~~ include/linux/bitmap.h:268:17: note: in expansion of macro 'memcpy' 268 | memcpy(dst, src, len); | ^~~~~~ kernel/padata.c: In function '__padata_set_cpumasks': kernel/padata.c:692:48: note: source object 'pcpumask' of size [0, 64] 692 | cpumask_var_t pcpumask, | ~~~~~~~~~~~~~~^~~~~~~~ vim +/__builtin_memcpy +57 include/linux/fortify-string.h 78a498c3a227f2 Alexander Potapenko 2022-10-24 46 78a498c3a227f2 Alexander Potapenko 2022-10-24 47 #if defined(__SANITIZE_MEMORY__) 78a498c3a227f2 Alexander Potapenko 2022-10-24 48 /* 78a498c3a227f2 Alexander Potapenko 2022-10-24 49 * For KMSAN builds all memcpy/memset/memmove calls should be replaced by the 78a498c3a227f2 Alexander Potapenko 2022-10-24 50 * corresponding __msan_XXX functions. 78a498c3a227f2 Alexander Potapenko 2022-10-24 51 */ 78a498c3a227f2 Alexander Potapenko 2022-10-24 52 #include <linux/kmsan_string.h> 78a498c3a227f2 Alexander Potapenko 2022-10-24 53 #define __underlying_memcpy __msan_memcpy 78a498c3a227f2 Alexander Potapenko 2022-10-24 54 #define __underlying_memmove __msan_memmove 78a498c3a227f2 Alexander Potapenko 2022-10-24 55 #define __underlying_memset __msan_memset 78a498c3a227f2 Alexander Potapenko 2022-10-24 56 #else a28a6e860c6cf2 Francis Laniel 2021-02-25 @57 #define __underlying_memcpy __builtin_memcpy a28a6e860c6cf2 Francis Laniel 2021-02-25 58 #define __underlying_memmove __builtin_memmove a28a6e860c6cf2 Francis Laniel 2021-02-25 59 #define __underlying_memset __builtin_memset 78a498c3a227f2 Alexander Potapenko 2022-10-24 60 #endif 78a498c3a227f2 Alexander Potapenko 2022-10-24 61 :::::: The code at line 57 was first introduced by commit :::::: a28a6e860c6cf231cf3c5171c75c342adcd00406 string.h: move fortified functions definitions in a dedicated header. :::::: TO: Francis Laniel <laniel_francis(a)privacyrequired.com> :::::: CC: Linus Torvalds <torvalds(a)linux-foundation.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] iio: pressure: zpa2326: fix information leak in triggered buffer
by Wenyu Huang 24 Feb '25

24 Feb '25

From: Javier Carrasco <javier.carrasco.cruz(a)gmail.com> stable inclusion from stable-v6.6.72 commit fefb88a4da961a0b9c2473cbdcfce1a942fcfa9a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBIQW6 CVE: CVE-2024-57912 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 6007d10c5262f6f71479627c1216899ea7f09073 upstream. The 'sample' local struct is used to push data to user space from a triggered buffer, but it has a hole between the temperature and the timestamp (u32 pressure, u16 temperature, GAP, u64 timestamp). This hole is never initialized. Initialize the struct to zero before using it to avoid pushing uninitialized information to userspace. Cc: stable(a)vger.kernel.org Fixes: 03b262f2bbf4 ("iio:pressure: initial zpa2326 barometer support") Signed-off-by: Javier Carrasco <javier.carrasco.cruz(a)gmail.com> Link: https://patch.msgid.link/20241125-iio_memset_scan_holes-v1-3-0cb6e98d895c@g… Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wenyu Huang <huangwenyu5(a)huawei.com> --- drivers/iio/pressure/zpa2326.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/iio/pressure/zpa2326.c b/drivers/iio/pressure/zpa2326.c index 2cecbe0adb3f..b8bc2c67462d 100644 --- a/drivers/iio/pressure/zpa2326.c +++ b/drivers/iio/pressure/zpa2326.c @@ -586,6 +586,8 @@ static int zpa2326_fill_sample_buffer(struct iio_dev *indio_dev, } sample; int err; + memset(&sample, 0, sizeof(sample)); + if (test_bit(0, indio_dev->active_scan_mask)) { /* Get current pressure from hardware FIFO. */ err = zpa2326_dequeue_pressure(indio_dev, &sample.pressure); -- 2.34.1

2 1

[PATCH OLK-6.6 0/7] CVE-2024-57952
by Yongjian Sun 24 Feb '25

24 Feb '25

*** BLURB HERE *** Al Viro (1): [Backport] dentry: switch the lists of children to hlist Chuck Lever (5): [Backport] libfs: Return ENOSPC when the directory offset range is exhausted [Backport] Revert "libfs: Add simple_offset_empty()" [Backport] Revert "libfs: fix infinite directory reads for offset dir" [Backport] libfs: Replace simple_offset end-of-directory detection [Backport] libfs: Use d_children list to iterate simple_offset directories Yongjian Sun (1): [Huawei] fs: fix dentry kabi broken Documentation/filesystems/porting.rst | 9 + arch/powerpc/platforms/cell/spufs/inode.c | 5 +- fs/afs/dynroot.c | 5 +- fs/autofs/expire.c | 7 +- fs/ceph/dir.c | 2 +- fs/ceph/mds_client.c | 2 +- fs/coda/cache.c | 2 +- fs/dcache.c | 76 ++++---- fs/libfs.c | 207 ++++++++++------------ fs/nfsd/nfsctl.c | 5 +- fs/notify/fsnotify.c | 2 +- include/linux/dcache.h | 14 +- include/linux/fs.h | 1 - mm/shmem.c | 4 +- 14 files changed, 173 insertions(+), 168 deletions(-) -- 2.39.2

2 8

[PATCH openEuler-1.0-LTS] nfsd: make sure exp active before svc_export_show
by Li Lingfeng 24 Feb '25

24 Feb '25

From: Yang Erkun <yangerkun(a)huawei.com> mainline inclusion from mainline-v6.13-rc1 commit be8f982c369c965faffa198b46060f8853e0f1f0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAMQ CVE: CVE-2024-56558 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The function `e_show` was called with protection from RCU. This only ensures that `exp` will not be freed. Therefore, the reference count for `exp` can drop to zero, which will trigger a refcount use-after-free warning when `exp_get` is called. To resolve this issue, use `cache_get_rcu` to ensure that `exp` remains active. ------------[ cut here ]------------ refcount_t: addition on 0; use-after-free. WARNING: CPU: 3 PID: 819 at lib/refcount.c:25 refcount_warn_saturate+0xb1/0x120 CPU: 3 UID: 0 PID: 819 Comm: cat Not tainted 6.12.0-rc3+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 RIP: 0010:refcount_warn_saturate+0xb1/0x120 ... Call Trace: <TASK> e_show+0x20b/0x230 [nfsd] seq_read_iter+0x589/0x770 seq_read+0x1e5/0x270 vfs_read+0x125/0x530 ksys_read+0xc1/0x160 do_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e Fixes: bf18f163e89c ("NFSD: Using exp_get for export getting") Cc: stable(a)vger.kernel.org # 4.20+ Signed-off-by: Yang Erkun <yangerkun(a)huawei.com> Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Conflicts: fs/nfsd/export.c [Commit ae74136b4bb6 ("SUNRPC: Allow cache lookups to use RCU protection rather than the r/w spinlock") add the definition of cache_get_rcu.] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfsd/export.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/fs/nfsd/export.c b/fs/nfsd/export.c index 170456ba2e0b..20e36bb38554 100644 --- a/fs/nfsd/export.c +++ b/fs/nfsd/export.c @@ -1220,9 +1220,12 @@ static int e_show(struct seq_file *m, void *p) return 0; } - exp_get(exp); + if (!(kref_get_unless_zero(&(&exp->h)->ref))) + return 0; + if (cache_check(cd, &exp->h, NULL)) return 0; + exp_put(exp); return svc_export_show(m, cd, cp); } -- 2.31.1

2 1