From: Aleksandr Mishin <amishin(a)t-argos.ru>
stable inclusion
from stable-v5.10.226
commit 41cc91e3138fe52f8da92a81bebcd0e6cf488c53
category: bugfix
bugzilla: IAVU8A
CVE: CVE-2024-47663
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
commit b48aa991758999d4e8f9296c5bbe388f293ef465 upstream.
In ad9834_write_frequency() clk_get_rate() can return 0. In such case
ad9834_calc_freqreg() call will lead to division by zero. Checking
'if (fout > (clk_freq / 2))' doesn't protect in case of 'fout' is 0.
ad9834_write_frequency() is called from ad9834_write(), where fout is
taken from text buffer, which can contain any value.
Modify parameters checking.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 12b9d5bf76bf ("Staging: IIO: DDS: AD9833 / AD9834 driver")
Suggested-by: Dan Carpenter <dan.carpenter(a)linaro.org>
Signed-off-by: Aleksandr Mishin <amishin(a)t-argos.ru>
Reviewed-by: Dan Carpenter <dan.carpenter(a)linaro.org>
Link: https://patch.msgid.link/20240703154506.25584-1-amishin@t-argos.ru
Cc: <Stable(a)vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Signed-off-by: Zicheng Qu <quzicheng(a)huawei.com>
---
drivers/staging/iio/frequency/ad9834.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/iio/frequency/ad9834.c b/drivers/staging/iio/frequency/ad9834.c
index 262c3590e64e..fa0a7056dea4 100644
--- a/drivers/staging/iio/frequency/ad9834.c
+++ b/drivers/staging/iio/frequency/ad9834.c
@@ -115,7 +115,7 @@ static int ad9834_write_frequency(struct ad9834_state *st,
clk_freq = clk_get_rate(st->mclk);
- if (fout > (clk_freq / 2))
+ if (!clk_freq || fout > (clk_freq / 2))
return -EINVAL;
regval = ad9834_calc_freqreg(clk_freq, fout);
--
2.34.1
From: Aleksandr Mishin <amishin(a)t-argos.ru>
stable inclusion
from stable-v5.10.226
commit 41cc91e3138fe52f8da92a81bebcd0e6cf488c53
category: bugfix
bugzilla: IAVU8A
CVE: CVE-2024-47663
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id…
--------------------------------
commit b48aa991758999d4e8f9296c5bbe388f293ef465 upstream.
In ad9834_write_frequency() clk_get_rate() can return 0. In such case
ad9834_calc_freqreg() call will lead to division by zero. Checking
'if (fout > (clk_freq / 2))' doesn't protect in case of 'fout' is 0.
ad9834_write_frequency() is called from ad9834_write(), where fout is
taken from text buffer, which can contain any value.
Modify parameters checking.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 12b9d5bf76bf ("Staging: IIO: DDS: AD9833 / AD9834 driver")
Suggested-by: Dan Carpenter <dan.carpenter(a)linaro.org>
Signed-off-by: Aleksandr Mishin <amishin(a)t-argos.ru>
Reviewed-by: Dan Carpenter <dan.carpenter(a)linaro.org>
Link: https://patch.msgid.link/20240703154506.25584-1-amishin@t-argos.ru
Cc: <Stable(a)vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Signed-off-by: Zicheng Qu <quzicheng(a)huawei.com>
---
drivers/staging/iio/frequency/ad9834.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/iio/frequency/ad9834.c b/drivers/staging/iio/frequency/ad9834.c
index 262c3590e64e..fa0a7056dea4 100644
--- a/drivers/staging/iio/frequency/ad9834.c
+++ b/drivers/staging/iio/frequency/ad9834.c
@@ -115,7 +115,7 @@ static int ad9834_write_frequency(struct ad9834_state *st,
clk_freq = clk_get_rate(st->mclk);
- if (fout > (clk_freq / 2))
+ if (!clk_freq || fout > (clk_freq / 2))
return -EINVAL;
regval = ad9834_calc_freqreg(clk_freq, fout);
--
2.34.1
Hi Lu,
First bad commit (maybe != root cause):
tree: https://gitee.com/openeuler/kernel.git OLK-6.6
head: 19640fb08a2ccfb131121859517dfdbc6a04ccb6
commit: 654944510822988390470cbc5b6f914c19dd9b88 [1466/1466] sched/psi: add cpu fine grained stall tracking in pressure.stat
config: loongarch-randconfig-r051-20241114 (https://download.01.org/0day-ci/archive/20241114/202411140810.T0u4OHVo-lkp@…)
compiler: loongarch64-linux-gcc (GCC) 14.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241114/202411140810.T0u4OHVo-lkp@…)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp(a)intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202411140810.T0u4OHVo-lkp@intel.com/
All warnings (new ones prefixed by >>):
241 | __setup("isolcpus=", housekeeping_isolcpus_setup);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~
include/linux/init.h:343:46: note: in definition of macro '__setup_param'
343 | = { __setup_str_##unique_id, fn, early }
| ^~
kernel/sched/isolation.c:241:1: note: in expansion of macro '__setup'
241 | __setup("isolcpus=", housekeeping_isolcpus_setup);
| ^~~~~~~
kernel/sched/isolation.c:241:22: note: (near initialization for '__setup_housekeeping_isolcpus_setup.setup_func')
241 | __setup("isolcpus=", housekeeping_isolcpus_setup);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~
include/linux/init.h:343:46: note: in definition of macro '__setup_param'
343 | = { __setup_str_##unique_id, fn, early }
| ^~
kernel/sched/isolation.c:241:1: note: in expansion of macro '__setup'
241 | __setup("isolcpus=", housekeeping_isolcpus_setup);
| ^~~~~~~
In file included from kernel/sched/build_utility.c:109:
kernel/sched/autogroup.c:7:28: error: section attribute cannot be specified for local variables
7 | unsigned int __read_mostly sysctl_sched_autogroup_enabled = 1;
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
kernel/sched/autogroup.c:15:35: error: initializer element is not constant
15 | .data = &sysctl_sched_autogroup_enabled,
| ^
kernel/sched/autogroup.c:15:35: note: (near initialization for 'sched_autogroup_sysctls[0].data')
kernel/sched/autogroup.c:25:20: error: invalid storage class for function 'sched_autogroup_sysctl_init'
25 | static void __init sched_autogroup_sysctl_init(void)
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~
kernel/sched/autogroup.c:47:20: error: invalid storage class for function 'autogroup_destroy'
47 | static inline void autogroup_destroy(struct kref *kref)
| ^~~~~~~~~~~~~~~~~
kernel/sched/autogroup.c:60:20: error: invalid storage class for function 'autogroup_kref_put'
60 | static inline void autogroup_kref_put(struct autogroup *ag)
| ^~~~~~~~~~~~~~~~~~
kernel/sched/autogroup.c:65:33: error: invalid storage class for function 'autogroup_kref_get'
65 | static inline struct autogroup *autogroup_kref_get(struct autogroup *ag)
| ^~~~~~~~~~~~~~~~~~
kernel/sched/autogroup.c:71:33: error: invalid storage class for function 'autogroup_task_get'
71 | static inline struct autogroup *autogroup_task_get(struct task_struct *p)
| ^~~~~~~~~~~~~~~~~~
kernel/sched/autogroup.c:85:33: error: invalid storage class for function 'autogroup_create'
85 | static inline struct autogroup *autogroup_create(void)
| ^~~~~~~~~~~~~~~~
kernel/sched/autogroup.c:158:1: error: invalid storage class for function 'autogroup_move_group'
158 | autogroup_move_group(struct task_struct *p, struct autogroup *ag)
| ^~~~~~~~~~~~~~~~~~~~
kernel/sched/autogroup.c:202:15: error: non-static declaration of 'sched_autogroup_create_attach' follows static declaration
202 | EXPORT_SYMBOL(sched_autogroup_create_attach);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
include/linux/export.h:74:28: note: in definition of macro '__EXPORT_SYMBOL'
74 | extern typeof(sym) sym; \
| ^~~
include/linux/export.h:86:41: note: in expansion of macro '_EXPORT_SYMBOL'
86 | #define EXPORT_SYMBOL(sym) _EXPORT_SYMBOL(sym, "")
| ^~~~~~~~~~~~~~
kernel/sched/autogroup.c:202:1: note: in expansion of macro 'EXPORT_SYMBOL'
202 | EXPORT_SYMBOL(sched_autogroup_create_attach);
| ^~~~~~~~~~~~~
kernel/sched/autogroup.c:193:6: note: previous definition of 'sched_autogroup_create_attach' with type 'void(struct task_struct *)'
193 | void sched_autogroup_create_attach(struct task_struct *p)
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
kernel/sched/autogroup.c:209:15: error: non-static declaration of 'sched_autogroup_detach' follows static declaration
209 | EXPORT_SYMBOL(sched_autogroup_detach);
| ^~~~~~~~~~~~~~~~~~~~~~
include/linux/export.h:74:28: note: in definition of macro '__EXPORT_SYMBOL'
74 | extern typeof(sym) sym; \
| ^~~
include/linux/export.h:86:41: note: in expansion of macro '_EXPORT_SYMBOL'
86 | #define EXPORT_SYMBOL(sym) _EXPORT_SYMBOL(sym, "")
| ^~~~~~~~~~~~~~
kernel/sched/autogroup.c:209:1: note: in expansion of macro 'EXPORT_SYMBOL'
209 | EXPORT_SYMBOL(sched_autogroup_detach);
| ^~~~~~~~~~~~~
kernel/sched/autogroup.c:205:6: note: previous definition of 'sched_autogroup_detach' with type 'void(struct task_struct *)'
205 | void sched_autogroup_detach(struct task_struct *p)
| ^~~~~~~~~~~~~~~~~~~~~~
kernel/sched/autogroup.c:221:19: error: invalid storage class for function 'setup_autogroup'
221 | static int __init setup_autogroup(char *str)
| ^~~~~~~~~~~~~~~
kernel/sched/autogroup.c:227:24: error: initializer element is not constant
227 | __setup("noautogroup", setup_autogroup);
| ^~~~~~~~~~~~~~~
include/linux/init.h:343:46: note: in definition of macro '__setup_param'
343 | = { __setup_str_##unique_id, fn, early }
| ^~
kernel/sched/autogroup.c:227:1: note: in expansion of macro '__setup'
227 | __setup("noautogroup", setup_autogroup);
| ^~~~~~~
kernel/sched/autogroup.c:227:24: note: (near initialization for '__setup_setup_autogroup.setup_func')
227 | __setup("noautogroup", setup_autogroup);
| ^~~~~~~~~~~~~~~
include/linux/init.h:343:46: note: in definition of macro '__setup_param'
343 | = { __setup_str_##unique_id, fn, early }
| ^~
kernel/sched/autogroup.c:227:1: note: in expansion of macro '__setup'
227 | __setup("noautogroup", setup_autogroup);
| ^~~~~~~
kernel/sched/build_utility.c:110: error: expected declaration or statement at end of input
110 | #endif
kernel/sched/psi.c: At top level:
>> kernel/sched/psi.c:178:13: warning: 'psi_avgs_work' used but never defined
178 | static void psi_avgs_work(struct work_struct *work);
| ^~~~~~~~~~~~~
>> kernel/sched/psi.c:180:13: warning: 'poll_timer_fn' used but never defined
180 | static void poll_timer_fn(struct timer_list *t);
| ^~~~~~~~~~~~~
>> kernel/sched/autogroup.c:285:5: warning: 'autogroup_path' defined but not used [-Wunused-function]
285 | int autogroup_path(struct task_group *tg, char *buf, int buflen)
| ^~~~~~~~~~~~~~
>> kernel/sched/autogroup.c:269:6: warning: 'proc_sched_autogroup_show_task' defined but not used [-Wunused-function]
269 | void proc_sched_autogroup_show_task(struct task_struct *p, struct seq_file *m)
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>> kernel/sched/autogroup.c:231:5: warning: 'proc_sched_autogroup_set_nice' defined but not used [-Wunused-function]
231 | int proc_sched_autogroup_set_nice(struct task_struct *p, int nice)
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>> kernel/sched/autogroup.c:216:6: warning: 'sched_autogroup_exit' defined but not used [-Wunused-function]
216 | void sched_autogroup_exit(struct signal_struct *sig)
| ^~~~~~~~~~~~~~~~~~~~
>> kernel/sched/autogroup.c:211:6: warning: 'sched_autogroup_fork' defined but not used [-Wunused-function]
211 | void sched_autogroup_fork(struct signal_struct *sig)
| ^~~~~~~~~~~~~~~~~~~~
>> kernel/sched/autogroup.c:147:6: warning: 'sched_autogroup_exit_task' defined but not used [-Wunused-function]
147 | void sched_autogroup_exit_task(struct task_struct *p)
| ^~~~~~~~~~~~~~~~~~~~~~~~~
>> kernel/sched/autogroup.c:129:6: warning: 'task_wants_autogroup' defined but not used [-Wunused-function]
129 | bool task_wants_autogroup(struct task_struct *p, struct task_group *tg)
| ^~~~~~~~~~~~~~~~~~~~
>> kernel/sched/autogroup.c:42:6: warning: 'autogroup_free' defined but not used [-Wunused-function]
42 | void autogroup_free(struct task_group *tg)
| ^~~~~~~~~~~~~~
>> kernel/sched/autogroup.c:33:13: warning: 'autogroup_init' defined but not used [-Wunused-function]
33 | void __init autogroup_init(struct task_struct *init_task)
| ^~~~~~~~~~~~~~
>> kernel/sched/isolation.c:82:13: warning: 'housekeeping_init' defined but not used [-Wunused-function]
82 | void __init housekeeping_init(void)
| ^~~~~~~~~~~~~~~~~
>> include/linux/syscalls.h:249:25: warning: '__se_sys_membarrier' defined but not used [-Wunused-function]
249 | asmlinkage long __se_sys##name(__MAP(x,__SC_LONG,__VA_ARGS__)) \
| ^~~~~~~~
include/linux/syscalls.h:230:9: note: in expansion of macro '__SYSCALL_DEFINEx'
230 | __SYSCALL_DEFINEx(x, sname, __VA_ARGS__)
| ^~~~~~~~~~~~~~~~~
include/linux/syscalls.h:221:36: note: in expansion of macro 'SYSCALL_DEFINEx'
221 | #define SYSCALL_DEFINE3(name, ...) SYSCALL_DEFINEx(3, _##name, __VA_ARGS__)
| ^~~~~~~~~~~~~~~
kernel/sched/membarrier.c:614:1: note: in expansion of macro 'SYSCALL_DEFINE3'
614 | SYSCALL_DEFINE3(membarrier, int, cmd, unsigned int, flags, int, cpu_id)
| ^~~~~~~~~~~~~~~
>> kernel/sched/membarrier.c:233:6: warning: 'membarrier_update_current_mm' defined but not used [-Wunused-function]
233 | void membarrier_update_current_mm(struct mm_struct *next_mm)
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
>> kernel/sched/membarrier.c:217:6: warning: 'membarrier_exec_mmap' defined but not used [-Wunused-function]
217 | void membarrier_exec_mmap(struct mm_struct *mm)
| ^~~~~~~~~~~~~~~~~~~~
>> kernel/sched/psi.c:1471:6: warning: 'psi_cgroup_restart' defined but not used [-Wunused-function]
1471 | void psi_cgroup_restart(struct psi_group *group)
| ^~~~~~~~~~~~~~~~~~
>> kernel/sched/psi.c:1416:6: warning: 'cgroup_move_task' defined but not used [-Wunused-function]
1416 | void cgroup_move_task(struct task_struct *task, struct css_set *to)
| ^~~~~~~~~~~~~~~~
>> kernel/sched/psi.c:1392:6: warning: 'psi_cgroup_free' defined but not used [-Wunused-function]
1392 | void psi_cgroup_free(struct cgroup *cgroup)
| ^~~~~~~~~~~~~~~
>> kernel/sched/psi.c:1373:5: warning: 'psi_cgroup_alloc' defined but not used [-Wunused-function]
1373 | int psi_cgroup_alloc(struct cgroup *cgroup)
| ^~~~~~~~~~~~~~~~
>> kernel/sched/psi.c:1168:6: warning: 'psi_task_switch' defined but not used [-Wunused-function]
1168 | void psi_task_switch(struct task_struct *prev, struct task_struct *next,
| ^~~~~~~~~~~~~~~
kernel/sched/psi.c:949:13: warning: 'poll_timer_fn' defined but not used [-Wunused-function]
949 | static void poll_timer_fn(struct timer_list *t)
| ^~~~~~~~~~~~~
vim +/psi_avgs_work +178 kernel/sched/psi.c
eb414681d5a07d Johannes Weiner 2018-10-26 177
bcc78db64168eb Suren Baghdasaryan 2019-05-14 @178 static void psi_avgs_work(struct work_struct *work);
eb414681d5a07d Johannes Weiner 2018-10-26 179
8f91efd870ea5d Zhaoyang Huang 2021-06-11 @180 static void poll_timer_fn(struct timer_list *t);
8f91efd870ea5d Zhaoyang Huang 2021-06-11 181
:::::: The code at line 178 was first introduced by commit
:::::: bcc78db64168eb6dede056fed2999f75f7ace309 psi: rename psi fields in preparation for psi trigger addition
:::::: TO: Suren Baghdasaryan <surenb(a)google.com>
:::::: CC: Linus Torvalds <torvalds(a)linux-foundation.org>
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
Hi Yury,
FYI, the error/warning still remains.
tree: https://gitee.com/openeuler/kernel.git OLK-6.6
head: 19640fb08a2ccfb131121859517dfdbc6a04ccb6
commit: 7de3ab4c3dd938fae3626a6344830b018eb7ba4f [1466/1466] arm64: introduce binfmt_elf32.c
config: arm64-randconfig-004-20241114 (https://download.01.org/0day-ci/archive/20241114/202411140707.rcVJtgbT-lkp@…)
compiler: aarch64-linux-gcc (GCC) 14.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241114/202411140707.rcVJtgbT-lkp@…)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp(a)intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202411140707.rcVJtgbT-lkp@intel.com/
All errors (new ones prefixed by >>):
aarch64-linux-ld: Unexpected GOT/PLT entries detected!
aarch64-linux-ld: Unexpected run-time procedure linkages detected!
aarch64-linux-ld: arch/arm64/kernel/binfmt_elf32.o: in function `load_elf_interp':
>> binfmt_elf32.c:(.text+0xb58): undefined reference to `arch_elf_adjust_prot'
aarch64-linux-ld: arch/arm64/kernel/binfmt_elf32.o: in function `load_elf_binary':
binfmt_elf32.c:(.text+0x2044): undefined reference to `arch_elf_adjust_prot'
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki