From: Wang Hai <wanghai38(a)huawei.com>
stable inclusion
from stable-v5.10.158
commit b775f37d943966f6f77dca402f5a9dedce502c25
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYREC
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
[ Upstream commit 45605c75c52c7ae7bfe902214343aabcfe5ba0ff ]
In e100_xmit_prepare(), if we can't map the skb, then return -ENOMEM, so
e100_xmit_frame() will return NETDEV_TX_BUSY and the upper layer will
resend the skb. But the skb is already freed, which will cause UAF bug
when the upper layer resends the skb.
Remove the harmful free.
Fixes: 5e5d49422dfb ("e100: Release skb when DMA mapping is failed in e100_xmit_prepare")
Signed-off-by: Wang Hai <wanghai38(a)huawei.com>
Reviewed-by: Alexander Duyck <alexanderduyck(a)fb.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
Conflicts:
drivers/net/ethernet/intel/e100.c
[The purpose of the if condition is the same in both cases. In openeuler,
it is `if (pci_dma_mapping_error(nic->pdev, dma_addr))`, and in version
5.10, it is `if (dma_mapping_error(&nic->pdev->dev, dma_addr))`. Both
are intended to "map the skb, allowing the upper layer to try later."
Therefore, retain the original `if` condition from openeuler, and
remove the code that frees the skb, aligning with the patch's purpose.]
Signed-off-by: Zicheng Qu <quzicheng(a)huawei.com>
---
drivers/net/ethernet/intel/e100.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/drivers/net/ethernet/intel/e100.c b/drivers/net/ethernet/intel/e100.c
index 8f7d2a335654..511f23f2a931 100644
--- a/drivers/net/ethernet/intel/e100.c
+++ b/drivers/net/ethernet/intel/e100.c
@@ -1742,11 +1742,8 @@ static int e100_xmit_prepare(struct nic *nic, struct cb *cb,
dma_addr = pci_map_single(nic->pdev,
skb->data, skb->len, PCI_DMA_TODEVICE);
/* If we can't map the skb, have the upper layer try later */
- if (pci_dma_mapping_error(nic->pdev, dma_addr)) {
- dev_kfree_skb_any(skb);
- skb = NULL;
+ if (pci_dma_mapping_error(nic->pdev, dma_addr))
return -ENOMEM;
- }
/*
* Use the last 4 bytes of the SKB payload packet as the CRC, used for
--
2.34.1
From: Aleksandr Mishin <amishin(a)t-argos.ru>
stable inclusion
from stable-v5.10.226
commit 41cc91e3138fe52f8da92a81bebcd0e6cf488c53
category: bugfix
bugzilla: IAVU8A
CVE: CVE-2024-47663
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
commit b48aa991758999d4e8f9296c5bbe388f293ef465 upstream.
In ad9834_write_frequency() clk_get_rate() can return 0. In such case
ad9834_calc_freqreg() call will lead to division by zero. Checking
'if (fout > (clk_freq / 2))' doesn't protect in case of 'fout' is 0.
ad9834_write_frequency() is called from ad9834_write(), where fout is
taken from text buffer, which can contain any value.
Modify parameters checking.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 12b9d5bf76bf ("Staging: IIO: DDS: AD9833 / AD9834 driver")
Suggested-by: Dan Carpenter <dan.carpenter(a)linaro.org>
Signed-off-by: Aleksandr Mishin <amishin(a)t-argos.ru>
Reviewed-by: Dan Carpenter <dan.carpenter(a)linaro.org>
Link: https://patch.msgid.link/20240703154506.25584-1-amishin@t-argos.ru
Cc: <Stable(a)vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Signed-off-by: Zicheng Qu <quzicheng(a)huawei.com>
---
drivers/staging/iio/frequency/ad9834.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/iio/frequency/ad9834.c b/drivers/staging/iio/frequency/ad9834.c
index 262c3590e64e..fa0a7056dea4 100644
--- a/drivers/staging/iio/frequency/ad9834.c
+++ b/drivers/staging/iio/frequency/ad9834.c
@@ -115,7 +115,7 @@ static int ad9834_write_frequency(struct ad9834_state *st,
clk_freq = clk_get_rate(st->mclk);
- if (fout > (clk_freq / 2))
+ if (!clk_freq || fout > (clk_freq / 2))
return -EINVAL;
regval = ad9834_calc_freqreg(clk_freq, fout);
--
2.34.1
From: Aleksandr Mishin <amishin(a)t-argos.ru>
stable inclusion
from stable-v5.10.226
commit 41cc91e3138fe52f8da92a81bebcd0e6cf488c53
category: bugfix
bugzilla: IAVU8A
CVE: CVE-2024-47663
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
commit b48aa991758999d4e8f9296c5bbe388f293ef465 upstream.
In ad9834_write_frequency() clk_get_rate() can return 0. In such case
ad9834_calc_freqreg() call will lead to division by zero. Checking
'if (fout > (clk_freq / 2))' doesn't protect in case of 'fout' is 0.
ad9834_write_frequency() is called from ad9834_write(), where fout is
taken from text buffer, which can contain any value.
Modify parameters checking.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 12b9d5bf76bf ("Staging: IIO: DDS: AD9833 / AD9834 driver")
Suggested-by: Dan Carpenter <dan.carpenter(a)linaro.org>
Signed-off-by: Aleksandr Mishin <amishin(a)t-argos.ru>
Reviewed-by: Dan Carpenter <dan.carpenter(a)linaro.org>
Link: https://patch.msgid.link/20240703154506.25584-1-amishin@t-argos.ru
Cc: <Stable(a)vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Signed-off-by: Zicheng Qu <quzicheng(a)huawei.com>
---
drivers/staging/iio/frequency/ad9834.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/iio/frequency/ad9834.c b/drivers/staging/iio/frequency/ad9834.c
index 262c3590e64e..fa0a7056dea4 100644
--- a/drivers/staging/iio/frequency/ad9834.c
+++ b/drivers/staging/iio/frequency/ad9834.c
@@ -115,7 +115,7 @@ static int ad9834_write_frequency(struct ad9834_state *st,
clk_freq = clk_get_rate(st->mclk);
- if (fout > (clk_freq / 2))
+ if (!clk_freq || fout > (clk_freq / 2))
return -EINVAL;
regval = ad9834_calc_freqreg(clk_freq, fout);
--
2.34.1
Hi Lu,
First bad commit (maybe != root cause):
tree: https://gitee.com/openeuler/kernel.git OLK-6.6
head: 19640fb08a2ccfb131121859517dfdbc6a04ccb6
commit: 654944510822988390470cbc5b6f914c19dd9b88 [1466/1466] sched/psi: add cpu fine grained stall tracking in pressure.stat
config: loongarch-randconfig-r051-20241114 (https://download.01.org/0day-ci/archive/20241114/202411140810.T0u4OHVo-lkp@…)
compiler: loongarch64-linux-gcc (GCC) 14.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241114/202411140810.T0u4OHVo-lkp@…)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp(a)intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202411140810.T0u4OHVo-lkp@intel.com/
All warnings (new ones prefixed by >>):
241 | __setup("isolcpus=", housekeeping_isolcpus_setup);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~
include/linux/init.h:343:46: note: in definition of macro '__setup_param'
343 | = { __setup_str_##unique_id, fn, early }
| ^~
kernel/sched/isolation.c:241:1: note: in expansion of macro '__setup'
241 | __setup("isolcpus=", housekeeping_isolcpus_setup);
| ^~~~~~~
kernel/sched/isolation.c:241:22: note: (near initialization for '__setup_housekeeping_isolcpus_setup.setup_func')
241 | __setup("isolcpus=", housekeeping_isolcpus_setup);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~
include/linux/init.h:343:46: note: in definition of macro '__setup_param'
343 | = { __setup_str_##unique_id, fn, early }
| ^~
kernel/sched/isolation.c:241:1: note: in expansion of macro '__setup'
241 | __setup("isolcpus=", housekeeping_isolcpus_setup);
| ^~~~~~~
In file included from kernel/sched/build_utility.c:109:
kernel/sched/autogroup.c:7:28: error: section attribute cannot be specified for local variables
7 | unsigned int __read_mostly sysctl_sched_autogroup_enabled = 1;
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
kernel/sched/autogroup.c:15:35: error: initializer element is not constant
15 | .data = &sysctl_sched_autogroup_enabled,
| ^
kernel/sched/autogroup.c:15:35: note: (near initialization for 'sched_autogroup_sysctls[0].data')
kernel/sched/autogroup.c:25:20: error: invalid storage class for function 'sched_autogroup_sysctl_init'
25 | static void __init sched_autogroup_sysctl_init(void)
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~
kernel/sched/autogroup.c:47:20: error: invalid storage class for function 'autogroup_destroy'
47 | static inline void autogroup_destroy(struct kref *kref)
| ^~~~~~~~~~~~~~~~~
kernel/sched/autogroup.c:60:20: error: invalid storage class for function 'autogroup_kref_put'
60 | static inline void autogroup_kref_put(struct autogroup *ag)
| ^~~~~~~~~~~~~~~~~~
kernel/sched/autogroup.c:65:33: error: invalid storage class for function 'autogroup_kref_get'
65 | static inline struct autogroup *autogroup_kref_get(struct autogroup *ag)
| ^~~~~~~~~~~~~~~~~~
kernel/sched/autogroup.c:71:33: error: invalid storage class for function 'autogroup_task_get'
71 | static inline struct autogroup *autogroup_task_get(struct task_struct *p)
| ^~~~~~~~~~~~~~~~~~
kernel/sched/autogroup.c:85:33: error: invalid storage class for function 'autogroup_create'
85 | static inline struct autogroup *autogroup_create(void)
| ^~~~~~~~~~~~~~~~
kernel/sched/autogroup.c:158:1: error: invalid storage class for function 'autogroup_move_group'
158 | autogroup_move_group(struct task_struct *p, struct autogroup *ag)
| ^~~~~~~~~~~~~~~~~~~~
kernel/sched/autogroup.c:202:15: error: non-static declaration of 'sched_autogroup_create_attach' follows static declaration
202 | EXPORT_SYMBOL(sched_autogroup_create_attach);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
include/linux/export.h:74:28: note: in definition of macro '__EXPORT_SYMBOL'
74 | extern typeof(sym) sym; \
| ^~~
include/linux/export.h:86:41: note: in expansion of macro '_EXPORT_SYMBOL'
86 | #define EXPORT_SYMBOL(sym) _EXPORT_SYMBOL(sym, "")
| ^~~~~~~~~~~~~~
kernel/sched/autogroup.c:202:1: note: in expansion of macro 'EXPORT_SYMBOL'
202 | EXPORT_SYMBOL(sched_autogroup_create_attach);
| ^~~~~~~~~~~~~
kernel/sched/autogroup.c:193:6: note: previous definition of 'sched_autogroup_create_attach' with type 'void(struct task_struct *)'
193 | void sched_autogroup_create_attach(struct task_struct *p)
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
kernel/sched/autogroup.c:209:15: error: non-static declaration of 'sched_autogroup_detach' follows static declaration
209 | EXPORT_SYMBOL(sched_autogroup_detach);
| ^~~~~~~~~~~~~~~~~~~~~~
include/linux/export.h:74:28: note: in definition of macro '__EXPORT_SYMBOL'
74 | extern typeof(sym) sym; \
| ^~~
include/linux/export.h:86:41: note: in expansion of macro '_EXPORT_SYMBOL'
86 | #define EXPORT_SYMBOL(sym) _EXPORT_SYMBOL(sym, "")
| ^~~~~~~~~~~~~~
kernel/sched/autogroup.c:209:1: note: in expansion of macro 'EXPORT_SYMBOL'
209 | EXPORT_SYMBOL(sched_autogroup_detach);
| ^~~~~~~~~~~~~
kernel/sched/autogroup.c:205:6: note: previous definition of 'sched_autogroup_detach' with type 'void(struct task_struct *)'
205 | void sched_autogroup_detach(struct task_struct *p)
| ^~~~~~~~~~~~~~~~~~~~~~
kernel/sched/autogroup.c:221:19: error: invalid storage class for function 'setup_autogroup'
221 | static int __init setup_autogroup(char *str)
| ^~~~~~~~~~~~~~~
kernel/sched/autogroup.c:227:24: error: initializer element is not constant
227 | __setup("noautogroup", setup_autogroup);
| ^~~~~~~~~~~~~~~
include/linux/init.h:343:46: note: in definition of macro '__setup_param'
343 | = { __setup_str_##unique_id, fn, early }
| ^~
kernel/sched/autogroup.c:227:1: note: in expansion of macro '__setup'
227 | __setup("noautogroup", setup_autogroup);
| ^~~~~~~
kernel/sched/autogroup.c:227:24: note: (near initialization for '__setup_setup_autogroup.setup_func')
227 | __setup("noautogroup", setup_autogroup);
| ^~~~~~~~~~~~~~~
include/linux/init.h:343:46: note: in definition of macro '__setup_param'
343 | = { __setup_str_##unique_id, fn, early }
| ^~
kernel/sched/autogroup.c:227:1: note: in expansion of macro '__setup'
227 | __setup("noautogroup", setup_autogroup);
| ^~~~~~~
kernel/sched/build_utility.c:110: error: expected declaration or statement at end of input
110 | #endif
kernel/sched/psi.c: At top level:
>> kernel/sched/psi.c:178:13: warning: 'psi_avgs_work' used but never defined
178 | static void psi_avgs_work(struct work_struct *work);
| ^~~~~~~~~~~~~
>> kernel/sched/psi.c:180:13: warning: 'poll_timer_fn' used but never defined
180 | static void poll_timer_fn(struct timer_list *t);
| ^~~~~~~~~~~~~
>> kernel/sched/autogroup.c:285:5: warning: 'autogroup_path' defined but not used [-Wunused-function]
285 | int autogroup_path(struct task_group *tg, char *buf, int buflen)
| ^~~~~~~~~~~~~~
>> kernel/sched/autogroup.c:269:6: warning: 'proc_sched_autogroup_show_task' defined but not used [-Wunused-function]
269 | void proc_sched_autogroup_show_task(struct task_struct *p, struct seq_file *m)
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>> kernel/sched/autogroup.c:231:5: warning: 'proc_sched_autogroup_set_nice' defined but not used [-Wunused-function]
231 | int proc_sched_autogroup_set_nice(struct task_struct *p, int nice)
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>> kernel/sched/autogroup.c:216:6: warning: 'sched_autogroup_exit' defined but not used [-Wunused-function]
216 | void sched_autogroup_exit(struct signal_struct *sig)
| ^~~~~~~~~~~~~~~~~~~~
>> kernel/sched/autogroup.c:211:6: warning: 'sched_autogroup_fork' defined but not used [-Wunused-function]
211 | void sched_autogroup_fork(struct signal_struct *sig)
| ^~~~~~~~~~~~~~~~~~~~
>> kernel/sched/autogroup.c:147:6: warning: 'sched_autogroup_exit_task' defined but not used [-Wunused-function]
147 | void sched_autogroup_exit_task(struct task_struct *p)
| ^~~~~~~~~~~~~~~~~~~~~~~~~
>> kernel/sched/autogroup.c:129:6: warning: 'task_wants_autogroup' defined but not used [-Wunused-function]
129 | bool task_wants_autogroup(struct task_struct *p, struct task_group *tg)
| ^~~~~~~~~~~~~~~~~~~~
>> kernel/sched/autogroup.c:42:6: warning: 'autogroup_free' defined but not used [-Wunused-function]
42 | void autogroup_free(struct task_group *tg)
| ^~~~~~~~~~~~~~
>> kernel/sched/autogroup.c:33:13: warning: 'autogroup_init' defined but not used [-Wunused-function]
33 | void __init autogroup_init(struct task_struct *init_task)
| ^~~~~~~~~~~~~~
>> kernel/sched/isolation.c:82:13: warning: 'housekeeping_init' defined but not used [-Wunused-function]
82 | void __init housekeeping_init(void)
| ^~~~~~~~~~~~~~~~~
>> include/linux/syscalls.h:249:25: warning: '__se_sys_membarrier' defined but not used [-Wunused-function]
249 | asmlinkage long __se_sys##name(__MAP(x,__SC_LONG,__VA_ARGS__)) \
| ^~~~~~~~
include/linux/syscalls.h:230:9: note: in expansion of macro '__SYSCALL_DEFINEx'
230 | __SYSCALL_DEFINEx(x, sname, __VA_ARGS__)
| ^~~~~~~~~~~~~~~~~
include/linux/syscalls.h:221:36: note: in expansion of macro 'SYSCALL_DEFINEx'
221 | #define SYSCALL_DEFINE3(name, ...) SYSCALL_DEFINEx(3, _##name, __VA_ARGS__)
| ^~~~~~~~~~~~~~~
kernel/sched/membarrier.c:614:1: note: in expansion of macro 'SYSCALL_DEFINE3'
614 | SYSCALL_DEFINE3(membarrier, int, cmd, unsigned int, flags, int, cpu_id)
| ^~~~~~~~~~~~~~~
>> kernel/sched/membarrier.c:233:6: warning: 'membarrier_update_current_mm' defined but not used [-Wunused-function]
233 | void membarrier_update_current_mm(struct mm_struct *next_mm)
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
>> kernel/sched/membarrier.c:217:6: warning: 'membarrier_exec_mmap' defined but not used [-Wunused-function]
217 | void membarrier_exec_mmap(struct mm_struct *mm)
| ^~~~~~~~~~~~~~~~~~~~
>> kernel/sched/psi.c:1471:6: warning: 'psi_cgroup_restart' defined but not used [-Wunused-function]
1471 | void psi_cgroup_restart(struct psi_group *group)
| ^~~~~~~~~~~~~~~~~~
>> kernel/sched/psi.c:1416:6: warning: 'cgroup_move_task' defined but not used [-Wunused-function]
1416 | void cgroup_move_task(struct task_struct *task, struct css_set *to)
| ^~~~~~~~~~~~~~~~
>> kernel/sched/psi.c:1392:6: warning: 'psi_cgroup_free' defined but not used [-Wunused-function]
1392 | void psi_cgroup_free(struct cgroup *cgroup)
| ^~~~~~~~~~~~~~~
>> kernel/sched/psi.c:1373:5: warning: 'psi_cgroup_alloc' defined but not used [-Wunused-function]
1373 | int psi_cgroup_alloc(struct cgroup *cgroup)
| ^~~~~~~~~~~~~~~~
>> kernel/sched/psi.c:1168:6: warning: 'psi_task_switch' defined but not used [-Wunused-function]
1168 | void psi_task_switch(struct task_struct *prev, struct task_struct *next,
| ^~~~~~~~~~~~~~~
kernel/sched/psi.c:949:13: warning: 'poll_timer_fn' defined but not used [-Wunused-function]
949 | static void poll_timer_fn(struct timer_list *t)
| ^~~~~~~~~~~~~
vim +/psi_avgs_work +178 kernel/sched/psi.c
eb414681d5a07d Johannes Weiner 2018-10-26 177
bcc78db64168eb Suren Baghdasaryan 2019-05-14 @178 static void psi_avgs_work(struct work_struct *work);
eb414681d5a07d Johannes Weiner 2018-10-26 179
8f91efd870ea5d Zhaoyang Huang 2021-06-11 @180 static void poll_timer_fn(struct timer_list *t);
8f91efd870ea5d Zhaoyang Huang 2021-06-11 181
:::::: The code at line 178 was first introduced by commit
:::::: bcc78db64168eb6dede056fed2999f75f7ace309 psi: rename psi fields in preparation for psi trigger addition
:::::: TO: Suren Baghdasaryan <surenb(a)google.com>
:::::: CC: Linus Torvalds <torvalds(a)linux-foundation.org>
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki