- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10 0/2] CVE-2024-42304
by Yifan Qiao 20 Aug '24

20 Aug '24

Baokun Li (2): ext4: check dot and dotdot of dx_root before making dir indexed ext4: make sure the first directory block is not a hole fs/ext4/namei.c | 73 ++++++++++++++++++++++++++++++++++++++----------- 1 file changed, 57 insertions(+), 16 deletions(-) -- 2.39.2

2 3

[PATCH openEuler-1.0-LTS 0/2] CVE-2024-42304
by Yifan Qiao 20 Aug '24

20 Aug '24

Baokun Li (2): ext4: check dot and dotdot of dx_root before making dir indexed ext4: make sure the first directory block is not a hole fs/ext4/namei.c | 73 ++++++++++++++++++++++++++++++++++++++----------- 1 file changed, 57 insertions(+), 16 deletions(-) -- 2.39.2

2 3

[PATCH openEuler-22.03-LTS-SP1 0/1] CVE-2024-42290
by Yuntao Liu 20 Aug '24

20 Aug '24

CVE-2024-42290 Shenwei Wang (1): irqchip/imx-irqsteer: Handle runtime power management correctly drivers/irqchip/irq-imx-irqsteer.c | 24 +++++++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-) -- 2.34.1

2 2

[PATCH OLK-5.10 0/2] CVE-2024-42126
by Jinjie Ruan 20 Aug '24

20 Aug '24

CVE-2024-42126 Jinjie Ruan (1): Revert "powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt." Mahesh Salgaonkar (1): powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt. arch/powerpc/kernel/mce.c | 2 +- arch/powerpc/kernel/traps.c | 8 +++++++- 2 files changed, 8 insertions(+), 2 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10 0/1] CVE-2024-42290
by Yuntao Liu 20 Aug '24

20 Aug '24

CVE-2024-42290 Shenwei Wang (1): irqchip/imx-irqsteer: Handle runtime power management correctly drivers/irqchip/irq-imx-irqsteer.c | 24 +++++++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-) -- 2.34.1

2 2

[PATCH OLK-5.10 0/1] CVE-2024-42290
by Yuntao Liu 20 Aug '24

20 Aug '24

CVE-2024-42290 Shenwei Wang (1): irqchip/imx-irqsteer: Handle runtime power management correctly drivers/irqchip/irq-imx-irqsteer.c | 24 +++++++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS-SP1 0/1] CVE-2024-42290
by Yuntao Liu 20 Aug '24

20 Aug '24

CVE-2024-42290 Shenwei Wang (1): irqchip/imx-irqsteer: Handle runtime power management correctly drivers/irqchip/irq-imx-irqsteer.c | 24 +++++++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS-SP1] ext4: fix infinite loop when replaying fast_commit
by Zhihao Cheng 20 Aug '24

20 Aug '24

From: "Luis Henriques (SUSE)" <luis.henriques(a)linux.dev> mainline inclusion from mainline-v6.11-rc1 commit 907c3fe532253a6ef4eb9c4d67efb71fab58c706 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ7X CVE: CVE-2024-43828 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When doing fast_commit replay an infinite loop may occur due to an uninitialized extent_status struct. ext4_ext_determine_insert_hole() does not detect the replay and calls ext4_es_find_extent_range(), which will return immediately without initializing the 'es' variable. Because 'es' contains garbage, an integer overflow may happen causing an infinite loop in this function, easily reproducible using fstest generic/039. This commit fixes this issue by unconditionally initializing the structure in function ext4_es_find_extent_range(). Thanks to Zhang Yi, for figuring out the real problem! Fixes: 8016e29f4362 ("ext4: fast commit recovery path") Signed-off-by: Luis Henriques (SUSE) <luis.henriques(a)linux.dev> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Link: https://patch.msgid.link/20240515082857.32730-1-luis.henriques@linux.dev Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Zhihao Cheng <chengzhihao(a)huaweicloud.com> --- fs/ext4/extents_status.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/ext4/extents_status.c b/fs/ext4/extents_status.c index dd679014db98..1b4f07949136 100644 --- a/fs/ext4/extents_status.c +++ b/fs/ext4/extents_status.c @@ -311,6 +311,8 @@ void ext4_es_find_extent_range(struct inode *inode, ext4_lblk_t lblk, ext4_lblk_t end, struct extent_status *es) { + es->es_lblk = es->es_len = es->es_pblk = 0; + if (EXT4_SB(inode->i_sb)->s_mount_state & EXT4_FC_REPLAY) return; -- 2.31.1

2 1

[PATCH OLK-5.10] ext4: fix infinite loop when replaying fast_commit
by Zhihao Cheng 20 Aug '24

20 Aug '24

From: "Luis Henriques (SUSE)" <luis.henriques(a)linux.dev> mainline inclusion from mainline-v6.11-rc1 commit 907c3fe532253a6ef4eb9c4d67efb71fab58c706 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ7X CVE: CVE-2024-43828 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When doing fast_commit replay an infinite loop may occur due to an uninitialized extent_status struct. ext4_ext_determine_insert_hole() does not detect the replay and calls ext4_es_find_extent_range(), which will return immediately without initializing the 'es' variable. Because 'es' contains garbage, an integer overflow may happen causing an infinite loop in this function, easily reproducible using fstest generic/039. This commit fixes this issue by unconditionally initializing the structure in function ext4_es_find_extent_range(). Thanks to Zhang Yi, for figuring out the real problem! Fixes: 8016e29f4362 ("ext4: fast commit recovery path") Signed-off-by: Luis Henriques (SUSE) <luis.henriques(a)linux.dev> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Link: https://patch.msgid.link/20240515082857.32730-1-luis.henriques@linux.dev Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Zhihao Cheng <chengzhihao(a)huaweicloud.com> --- fs/ext4/extents_status.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/ext4/extents_status.c b/fs/ext4/extents_status.c index 783f6205cc9f..cf6e1e001ac7 100644 --- a/fs/ext4/extents_status.c +++ b/fs/ext4/extents_status.c @@ -311,6 +311,8 @@ void ext4_es_find_extent_range(struct inode *inode, ext4_lblk_t lblk, ext4_lblk_t end, struct extent_status *es) { + es->es_lblk = es->es_len = es->es_pblk = 0; + if (EXT4_SB(inode->i_sb)->s_mount_state & EXT4_FC_REPLAY) return; -- 2.31.1

2 1

[PATCH OLK-5.10] PCI: endpoint: pci-epf-test: Make use of cached 'epc_features' in pci_epf_test_core_init()
by liwei 20 Aug '24

20 Aug '24

From: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> mainline inclusion from mainline-v6.11-rc1 commit 5a5095a8bd1bd349cce1c879e5e44407a34dda8a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKQ5P CVE: CVE-2024-43824 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Instead of getting the epc_features from pci_epc_get_features() API, use the cached pci_epf_test::epc_features value to avoid the NULL check. Since the NULL check is already performed in pci_epf_test_bind(), having one more check in pci_epf_test_core_init() is redundant and it is not possible to hit the NULL pointer dereference. Also with commit a01e7214bef9 ("PCI: endpoint: Remove "core_init_notifier" flag"), 'epc_features' got dereferenced without the NULL check, leading to the following false positive Smatch warning: drivers/pci/endpoint/functions/pci-epf-test.c:784 pci_epf_test_core_init() error: we previously assumed 'epc_features' could be null (see line 747) Thus, remove the redundant NULL check and also use the epc_features:: {msix_capable/msi_capable} flags directly to avoid local variables. [kwilczynski: commit log] Fixes: 5e50ee27d4a5 ("PCI: pci-epf-test: Add support to defer core initialization") Closes: https://lore.kernel.org/linux-pci/024b5826-7180-4076-ae08-57d2584cca3f@moro… Link: https://lore.kernel.org/linux-pci/20240418-pci-epf-test-fix-v2-1-eacd548314… Reported-by: Dan Carpenter <dan.carpenter(a)linaro.org> Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> Signed-off-by: Krzysztof Wilczyński <kwilczynski(a)kernel.org> Signed-off-by: Bjorn Helgaas <bhelgaas(a)google.com> Reviewed-by: Frank Li <Frank.Li(a)nxp.com> Reviewed-by: Niklas Cassel <cassel(a)kernel.org> Conflicts: drivers/pci/endpoint/functions/pci-epf-test.c [context conflicts] Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/pci/endpoint/functions/pci-epf-test.c | 14 +++----------- 1 file changed, 3 insertions(+), 11 deletions(-) diff --git a/drivers/pci/endpoint/functions/pci-epf-test.c b/drivers/pci/endpoint/functions/pci-epf-test.c index ef52f5097eb3..219ac744275d 100644 --- a/drivers/pci/endpoint/functions/pci-epf-test.c +++ b/drivers/pci/endpoint/functions/pci-epf-test.c @@ -674,19 +674,11 @@ static int pci_epf_test_core_init(struct pci_epf *epf) { struct pci_epf_test *epf_test = epf_get_drvdata(epf); struct pci_epf_header *header = epf->header; - const struct pci_epc_features *epc_features; + const struct pci_epc_features *epc_features = epf_test->epc_features; struct pci_epc *epc = epf->epc; struct device *dev = &epf->dev; - bool msix_capable = false; - bool msi_capable = true; int ret; - epc_features = pci_epc_get_features(epc, epf->func_no); - if (epc_features) { - msix_capable = epc_features->msix_capable; - msi_capable = epc_features->msi_capable; - } - ret = pci_epc_write_header(epc, epf->func_no, header); if (ret) { dev_err(dev, "Configuration header write failed\n"); @@ -697,7 +689,7 @@ static int pci_epf_test_core_init(struct pci_epf *epf) if (ret) return ret; - if (msi_capable) { + if (epc_features->msi_capable) { ret = pci_epc_set_msi(epc, epf->func_no, epf->msi_interrupts); if (ret) { dev_err(dev, "MSI configuration failed\n"); @@ -705,7 +697,7 @@ static int pci_epf_test_core_init(struct pci_epf *epf) } } - if (msix_capable) { + if (epc_features->msix_capable) { ret = pci_epc_set_msix(epc, epf->func_no, epf->msix_interrupts, epf_test->test_reg_bar, epf_test->msix_table_offset); -- 2.25.1

2 1