- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] arm64: ptrace: fix partial SETREGSET for NT_ARM_TAGGED_ADDR_CTRL
by Yuntao Liu 22 Jan '25

22 Jan '25

From: Mark Rutland <mark.rutland(a)arm.com> stable inclusion from stable-v6.6.66 commit 96035c0093db258975b8887676afe59a64c34a72 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBJC6J CVE: CVE-2024-57874 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Currently tagged_addr_ctrl_set() doesn't initialize the temporary 'ctrl' variable, and a SETREGSET call with a length of zero will leave this uninitialized. Consequently tagged_addr_ctrl_set() will consume an arbitrary value, potentially leaking up to 64 bits of memory from the kernel stack. The read is limited to a specific slot on the stack, and the issue does not provide a write mechanism. As set_tagged_addr_ctrl() only accepts values where bits [63:4] zero and rejects other values, a partial SETREGSET attempt will randomly succeed or fail depending on the value of the uninitialized value, and the exposure is significantly limited. Fix this by initializing the temporary value before copying the regset from userspace, as for other regsets (e.g. NT_PRSTATUS, NT_PRFPREG, NT_ARM_SYSTEM_CALL). In the case of a zero-length write, the existing value of the tagged address ctrl will be retained. The NT_ARM_TAGGED_ADDR_CTRL regset is only visible in the user_aarch64_view used by a native AArch64 task to manipulate another native AArch64 task. As get_tagged_addr_ctrl() only returns an error value when called for a compat task, tagged_addr_ctrl_get() and tagged_addr_ctrl_set() should never observe an error value from get_tagged_addr_ctrl(). Add a WARN_ON_ONCE() to both to indicate that such an error would be unexpected, and error handlnig is not missing in either case. Fixes: 2200aa7154cb ("arm64: mte: ptrace: Add NT_ARM_TAGGED_ADDR_CTRL regset") Cc: <stable(a)vger.kernel.org> # 5.10.x Signed-off-by: Mark Rutland <mark.rutland(a)arm.com> Cc: Will Deacon <will(a)kernel.org> Reviewed-by: Mark Brown <broonie(a)kernel.org> Link: https://lore.kernel.org/r/20241205121655.1824269-2-mark.rutland@arm.com Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com> Signed-off-by: Yuntao Liu <liuyuntao12(a)huawei.com> --- arch/arm64/kernel/ptrace.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c index 28a5ddcf0a1e..d34b57caad49 100644 --- a/arch/arm64/kernel/ptrace.c +++ b/arch/arm64/kernel/ptrace.c @@ -1384,7 +1384,7 @@ static int tagged_addr_ctrl_get(struct task_struct *target, { long ctrl = get_tagged_addr_ctrl(target); - if (IS_ERR_VALUE(ctrl)) + if (WARN_ON_ONCE(IS_ERR_VALUE(ctrl))) return ctrl; return membuf_write(&to, &ctrl, sizeof(ctrl)); @@ -1398,6 +1398,10 @@ static int tagged_addr_ctrl_set(struct task_struct *target, const struct int ret; long ctrl; + ctrl = get_tagged_addr_ctrl(target); + if (WARN_ON_ONCE(IS_ERR_VALUE(ctrl))) + return ctrl; + ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &ctrl, 0, -1); if (ret) return ret; -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 1410/1410] arch/x86/entry/entry_64.o: warning: objtool: If this is a retpoline, please patch it in with alternatives and annotate it with ANNOTATE_NOSPEC_ALTERNATIVE.
by kernel test robot 22 Jan '25

22 Jan '25

Hi Peter, First bad commit (maybe != root cause): tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 4d48400e0254b5310842eb2ad33c6ccba43b0f1d commit: 3acbac72baea337e0ac79801a8ba4b81e3b67014 [1410/1410] x86/speculation: Change FILL_RETURN_BUFFER to work with objtool config: x86_64-randconfig-102-20250121 (https://download.01.org/0day-ci/archive/20250122/202501221629.J60ha3Fd-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250122/202501221629.J60ha3Fd-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501221629.J60ha3Fd-lkp@intel.com/ All warnings (new ones prefixed by >>): >> arch/x86/entry/entry_64.o: warning: objtool: .entry.text+0x1e2: unsupported intra-function call >> arch/x86/entry/entry_64.o: warning: objtool: If this is a retpoline, please patch it in with alternatives and annotate it with ANNOTATE_NOSPEC_ALTERNATIVE. -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1 0/2] Two CVE fixes for ksmbd
by Wang Zhaolong 22 Jan '25

22 Jan '25

Namjae Jeon (2): ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16() ksmbd: fix potencial out-of-bounds when buffer offset is invalid fs/ksmbd/smb2misc.c | 26 +++++++++++++++++------- fs/ksmbd/smb2pdu.c | 48 ++++++++++++++++++++++++--------------------- 2 files changed, 45 insertions(+), 29 deletions(-) -- 2.34.3

2 3

[PATCH V2 OLK-5.10 0/2] Two CVE fixes for ksmbd
by Wang Zhaolong 22 Jan '25

22 Jan '25

V1 -> V2: Adjusted code indentation. Namjae Jeon (2): ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16() ksmbd: fix potencial out-of-bounds when buffer offset is invalid fs/ksmbd/smb2misc.c | 26 +++++++++++++++++------- fs/ksmbd/smb2pdu.c | 48 ++++++++++++++++++++++++--------------------- 2 files changed, 45 insertions(+), 29 deletions(-) -- 2.34.3

2 3

[openeuler:OLK-6.6 1834/1834] drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_drive.c:41:30: sparse: sparse: symbol 'kbox_fops' was not declared. Should it be static?
by kernel test robot 22 Jan '25

22 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 75c81bcddd82381fbd4cef477a5b56eb2fe56697 commit: cd2978286f40089fcd83f74ffdff733bfbe1e52a [1834/1834] Huawei BMA: Adding Huawei BMA driver: host_kbox_drv config: x86_64-randconfig-121-20250122 (https://download.01.org/0day-ci/archive/20250122/202501221527.POAEXa7r-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250122/202501221527.POAEXa7r-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501221527.POAEXa7r-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_drive.c:41:30: sparse: sparse: symbol 'kbox_fops' was not declared. Should it be static? -- drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:51:28: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:42:6: sparse: sparse: symbol 'kbox_write_to_pci' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:120:27: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:111:6: sparse: sparse: symbol 'kbox_read_from_pci' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:179:28: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:172:6: sparse: sparse: symbol 'kbox_memset_pci' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:360:26: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected char *user_buf @@ got char [noderef] __user *data @@ drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:360:26: sparse: expected char *user_buf drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:360:26: sparse: got char [noderef] __user *data drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:395:34: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void [noderef] __user *to @@ got char *user_buf @@ drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:395:34: sparse: expected void [noderef] __user *to drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:395:34: sparse: got char *user_buf >> drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:422:32: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected char const *user_buf @@ got char const [noderef] __user *data @@ drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:422:32: sparse: expected char const *user_buf drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:422:32: sparse: got char const [noderef] __user *data drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:453:51: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const [noderef] __user *from @@ got char const *user_buf @@ drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:453:51: sparse: expected void const [noderef] __user *from drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c:453:51: sparse: got char const *user_buf vim +/kbox_fops +41 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_drive.c 40 > 41 const struct file_operations kbox_fops = { 42 .owner = THIS_MODULE, 43 .read = kbox_read, 44 .write = kbox_write, 45 .unlocked_ioctl = kbox_ioctl, 46 .mmap = kbox_mmap, 47 .open = kbox_open, 48 .release = kbox_release, 49 }; 50 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10 0/2] Two CVE fixes for ksmbd
by Wang Zhaolong 22 Jan '25

22 Jan '25

Namjae Jeon (2): ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16() ksmbd: fix potencial out-of-bounds when buffer offset is invalid fs/ksmbd/smb2misc.c | 27 ++++++++++++++++++------- fs/ksmbd/smb2pdu.c | 48 ++++++++++++++++++++++++--------------------- 2 files changed, 46 insertions(+), 29 deletions(-) -- 2.34.3

2 3

[PATCH OLK-6.6 0/2] Two CVE fixes for ksmbd
by Wang Zhaolong 22 Jan '25

22 Jan '25

Namjae Jeon (2): ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16() ksmbd: fix potencial out-of-bounds when buffer offset is invalid fs/smb/server/smb2misc.c | 26 ++++++++++++++++------ fs/smb/server/smb2pdu.c | 48 ++++++++++++++++++++++------------------ 2 files changed, 45 insertions(+), 29 deletions(-) -- 2.34.3

2 3

[PATCH OLK-6.6 0/7] Support MATA monitor feature for MPAM
by Zeng Heng 22 Jan '25

22 Jan '25

Zeng Heng (7): arm64/mpam: Support MATA monitor feature for MPAM arm64/mpam: Add judgment to distinguish MSMON_MBWU_CAPTURE definition arm64/mpam: fix MBA granularity conversion formula arm64/mpam: fix bug in percent_to_mbw_max() arm64/mpam: Fix out-of-bound access of mbwu_state array arm64/mpam: Fix out-of-bound access of cfg array arm64/mpam: Improve conversion accuracy between percent and fixed-point fraction drivers/platform/mpam/mpam_devices.c | 31 ++++++++++--- drivers/platform/mpam/mpam_resctrl.c | 68 ++++++++++++++++++---------- fs/resctrl/monitor.c | 42 ++++++++++++----- 3 files changed, 98 insertions(+), 43 deletions(-) -- 2.25.1

2 8

[openeuler:OLK-6.6 1834/1834] drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:88:23: sparse: sparse: symbol 'g_bspveth_dev' was not declared. Should it be static?
by kernel test robot 22 Jan '25

22 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 75c81bcddd82381fbd4cef477a5b56eb2fe56697 commit: 0cafdd73feea92b9a246d4fab07872eb6bec9f2b [1834/1834] Huawei BMA: Adding Huawei BMA driver: host_veth_drv config: x86_64-randconfig-121-20250122 (https://download.01.org/0day-ci/archive/20250122/202501221218.JgRI8RlC-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250122/202501221218.JgRI8RlC-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501221218.JgRI8RlC-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:88:23: sparse: sparse: symbol 'g_bspveth_dev' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:400:5: sparse: sparse: symbol 'bspveth_setup_tx_resources' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:449:6: sparse: sparse: symbol 'bspveth_free_tx_resources' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:491:5: sparse: sparse: symbol 'bspveth_setup_all_tx_resources' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:560:6: sparse: sparse: symbol 'bspveth_free_all_tx_resources' was not declared. Should it be static? >> drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:577:5: sparse: sparse: symbol 'veth_alloc_one_rx_skb' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:622:5: sparse: sparse: symbol 'veth_refill_rxskb' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:661:5: sparse: sparse: symbol 'bspveth_setup_rx_skb' was not declared. Should it be static? >> drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:693:6: sparse: sparse: symbol 'bspveth_free_rx_skb' was not declared. Should it be static? >> drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:726:5: sparse: sparse: symbol 'bspveth_setup_all_rx_skb' was not declared. Should it be static? >> drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:754:6: sparse: sparse: symbol 'bspveth_free_all_rx_skb' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:766:5: sparse: sparse: symbol 'bspveth_setup_rx_resources' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:817:6: sparse: sparse: symbol 'bspveth_free_rx_resources' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:849:5: sparse: sparse: symbol 'bspveth_setup_all_rx_resources' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:914:6: sparse: sparse: symbol 'bspveth_free_all_rx_resources' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:932:5: sparse: sparse: symbol 'bspveth_dev_install' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:967:5: sparse: sparse: symbol 'bspveth_dev_uninstall' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:1052:5: sparse: sparse: symbol 'veth_config' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:1069:6: sparse: sparse: symbol 'bspveth_initstatis' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:1094:5: sparse: sparse: symbol 'veth_ioctl' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:1099:25: sparse: sparse: symbol 'veth_stats' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:1104:5: sparse: sparse: symbol 'veth_mac_set' was not declared. Should it be static? >> drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:1235:6: sparse: sparse: symbol 'veth_netdev_func_init' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:1265:5: sparse: sparse: symbol 'veth_send_one_pkt' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:1544:6: sparse: sparse: symbol 'veth_skbtrtimer_do' was not declared. Should it be static? >> drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:1591:6: sparse: sparse: symbol 'veth_netdev_exit' was not declared. Should it be static? >> drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:1630:5: sparse: sparse: symbol 'veth_netdev_init' was not declared. Should it be static? >> drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:1721:6: sparse: sparse: symbol 'veth_dma_tx_timer_do_H' was not declared. Should it be static? >> drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:1771:5: sparse: sparse: symbol 'dmacmp_err_deal' was not declared. Should it be static? >> drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:1808:5: sparse: sparse: symbol 'veth_check_dma_status' was not declared. Should it be static? >> drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:1836:5: sparse: sparse: symbol '__check_dmacmp_H' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:1908:5: sparse: sparse: symbol '__checkspace_H' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:1989:5: sparse: sparse: symbol '__make_dmalistbd_h2b_H' was not declared. Should it be static? >> drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:2093:5: sparse: sparse: symbol '__make_dmalistbd_b2h_H' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:2196:5: sparse: sparse: symbol '__start_dmalist_H' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:2242:5: sparse: sparse: symbol 'check_dma_queue_fault' was not declared. Should it be static? drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:2390:6: sparse: sparse: symbol 'bspveth_host_exit_H' was not declared. Should it be static? >> drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:2439:26: sparse: sparse: cast removes address space '__iomem' of expression drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c:2404:5: sparse: sparse: symbol 'bspveth_host_init_H' was not declared. Should it be static? vim +/g_bspveth_dev +88 drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c 87 > 88 struct bspveth_device g_bspveth_dev = {}; 89 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1411/1411] drivers/cpuidle/.tmp_cpuidle-haltpoll.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 22 Jan '25

22 Jan '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: fdf62dff2537450d438667d817333e17ec71148a commit: 8104395ba98a81c8cb1ddd245482baca0d57d163 [1411/1411] add cpuidle-haltpoll driver config: x86_64-buildonly-randconfig-005-20250121 (https://download.01.org/0day-ci/archive/20250122/202501221206.KfU0Mays-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250122/202501221206.KfU0Mays-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501221206.KfU0Mays-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/cpuidle/.tmp_cpuidle-haltpoll.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0