From: Andrey Shumilin <shum.sdl(a)nppct.ru>
stable inclusion
from stable-v5.10.227
commit 252f147b1826cbb30ae0304cf86b66d3bb12b743
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2YVH
CVE: CVE-2024-50180
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
[ Upstream commit 9cf14f5a2746c19455ce9cb44341b5527b5e19c3 ]
The values of the variables xres and yres are placed in strbuf.
These variables are obtained from strbuf1.
The strbuf1 array contains digit characters
and a space if the array contains non-digit characters.
Then, when executing sprintf(strbuf, "%ux%ux8", xres, yres);
more than 16 bytes will be written to strbuf.
It is suggested to increase the size of the strbuf array to 24.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Signed-off-by: Andrey Shumilin <shum.sdl(a)nppct.ru>
Signed-off-by: Helge Deller <deller(a)gmx.de>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
Signed-off-by: Yi Yang <yiyang13(a)huawei.com>
---
drivers/video/fbdev/sis/sis_main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/video/fbdev/sis/sis_main.c b/drivers/video/fbdev/sis/sis_main.c
index e540cb0c5172..7787fd21932c 100644
--- a/drivers/video/fbdev/sis/sis_main.c
+++ b/drivers/video/fbdev/sis/sis_main.c
@@ -183,7 +183,7 @@ static void sisfb_search_mode(char *name, bool quiet)
{
unsigned int j = 0, xres = 0, yres = 0, depth = 0, rate = 0;
int i = 0;
- char strbuf[16], strbuf1[20];
+ char strbuf[24], strbuf1[20];
char *nameptr = name;
/* We don't know the hardware specs yet and there is no ivideo */
--
2.25.1
From: Andrey Shumilin <shum.sdl(a)nppct.ru>
stable inclusion
from stable-v5.10.227
commit 252f147b1826cbb30ae0304cf86b66d3bb12b743
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2YVH
CVE: CVE-2024-50180
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
[ Upstream commit 9cf14f5a2746c19455ce9cb44341b5527b5e19c3 ]
The values of the variables xres and yres are placed in strbuf.
These variables are obtained from strbuf1.
The strbuf1 array contains digit characters
and a space if the array contains non-digit characters.
Then, when executing sprintf(strbuf, "%ux%ux8", xres, yres);
more than 16 bytes will be written to strbuf.
It is suggested to increase the size of the strbuf array to 24.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Signed-off-by: Andrey Shumilin <shum.sdl(a)nppct.ru>
Signed-off-by: Helge Deller <deller(a)gmx.de>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
Signed-off-by: Yi Yang <yiyang13(a)huawei.com>
---
drivers/video/fbdev/sis/sis_main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/video/fbdev/sis/sis_main.c b/drivers/video/fbdev/sis/sis_main.c
index e540cb0c5172..7787fd21932c 100644
--- a/drivers/video/fbdev/sis/sis_main.c
+++ b/drivers/video/fbdev/sis/sis_main.c
@@ -183,7 +183,7 @@ static void sisfb_search_mode(char *name, bool quiet)
{
unsigned int j = 0, xres = 0, yres = 0, depth = 0, rate = 0;
int i = 0;
- char strbuf[16], strbuf1[20];
+ char strbuf[24], strbuf1[20];
char *nameptr = name;
/* We don't know the hardware specs yet and there is no ivideo */
--
2.25.1
Hi Zhao,
FYI, the error/warning still remains.
tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS
head: f49b713adeb7d09d40da433b7700b1666a7d6e32
commit: 6636f4434a9c5c9c645694db206188ee5a6626dd [1297/1297] ext4: report error to userspace by netlink
config: x86_64-buildonly-randconfig-005-20241117 (https://download.01.org/0day-ci/archive/20241121/202411210950.bzCekRiW-lkp@…)
compiler: gcc-12 (Debian 12.2.0-14) 12.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241121/202411210950.bzCekRiW-lkp@…)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp(a)intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202411210950.bzCekRiW-lkp@intel.com/
All errors (new ones prefixed by >>):
ld: warning: arch/x86/lib/csum-copy_64.o: missing .note.GNU-stack section implies executable stack
ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker
ld: warning: arch/x86/lib/csum-copy_64.o: missing .note.GNU-stack section implies executable stack
ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker
ld: warning: .tmp_vmlinux1 has a LOAD segment with RWX permissions
ld: fs/ext4/super.o: in function `ext4_netlink_send_info.part.0':
>> super.c:(.text+0x1c3cd): undefined reference to `__alloc_skb'
>> ld: super.c:(.text+0x1c456): undefined reference to `__nlmsg_put'
>> ld: super.c:(.text+0x1c422): undefined reference to `kfree_skb'
>> ld: super.c:(.text+0x1c50f): undefined reference to `netlink_broadcast'
ld: fs/ext4/super.o: in function `ext4_init_fs':
>> super.c:(.init.text+0x46ef): undefined reference to `init_net'
>> ld: super.c:(.init.text+0x46f9): undefined reference to `__netlink_kernel_create'
ld: fs/ext4/super.o: in function `ext4_exit_fs':
>> super.c:(.exit.text+0x65): undefined reference to `netlink_kernel_release'
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
Hi Nick,
FYI, the error/warning still remains.
tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS
head: f49b713adeb7d09d40da433b7700b1666a7d6e32
commit: b8ba22a604e4d0a3ad8e23af22f432e12b6f1a65 [1302/1302] nvme: fix compat address handling in several ioctls
config: arm64-randconfig-003-20241121 (https://download.01.org/0day-ci/archive/20241121/202411210730.g3bmaj7Y-lkp@…)
compiler: aarch64-linux-gcc (GCC) 14.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241121/202411210730.g3bmaj7Y-lkp@…)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp(a)intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202411210730.g3bmaj7Y-lkp@intel.com/
All errors (new ones prefixed by >>):
drivers/nvme/host/core.c: In function 'nvme_to_user_ptr':
>> drivers/nvme/host/core.c:1163:27: error: 'compat_uptr_t' undeclared (first use in this function); did you mean 'compat_time_t'?
1163 | ptrval = (compat_uptr_t)ptrval;
| ^~~~~~~~~~~~~
| compat_time_t
drivers/nvme/host/core.c:1163:27: note: each undeclared identifier is reported only once for each function it appears in
drivers/nvme/host/core.c:1163:41: error: expected ';' before 'ptrval'
1163 | ptrval = (compat_uptr_t)ptrval;
| ^~~~~~
| ;
vim +1163 drivers/nvme/host/core.c
1154
1155 /*
1156 * Convert integer values from ioctl structures to user pointers, silently
1157 * ignoring the upper bits in the compat case to match behaviour of 32-bit
1158 * kernels.
1159 */
1160 static void __user *nvme_to_user_ptr(uintptr_t ptrval)
1161 {
1162 if (in_compat_syscall())
> 1163 ptrval = (compat_uptr_t)ptrval;
1164 return (void __user *)ptrval;
1165 }
1166
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki