August 2024 - Kernel - mailweb.openeuler.org

[openeuler:openEuler-1.0-LTS] BUILD SUCCESS 90f4d81f4d19ad3d6d23b8775f4aa07771a1dac5
by kernel test robot 23 Aug '24

23 Aug '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: 90f4d81f4d19ad3d6d23b8775f4aa07771a1dac5 !11068 Fix CVE-2024-39501 elapsed time: 735m configs tested: 21 configs skipped: 139 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig gcc-14.1.0 arm64 allnoconfig gcc-14.1.0 arm64 defconfig gcc-14.1.0 arm64 randconfig-001-20240823 gcc-14.1.0 arm64 randconfig-002-20240823 gcc-14.1.0 arm64 randconfig-003-20240823 gcc-14.1.0 arm64 randconfig-004-20240823 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240823 gcc-12 x86_64 buildonly-randconfig-002-20240823 gcc-12 x86_64 buildonly-randconfig-003-20240823 gcc-12 x86_64 buildonly-randconfig-004-20240823 clang-18 x86_64 buildonly-randconfig-005-20240823 gcc-12 x86_64 buildonly-randconfig-006-20240823 gcc-12 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240823 clang-18 x86_64 randconfig-002-20240823 clang-18 x86_64 randconfig-003-20240823 clang-18 x86_64 randconfig-004-20240823 clang-18 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 13455/13476] arch/arm64/kernel/virtcca_cvm_tsi.c:57:30: warning: variable 'ver' is uninitialized when used here
by kernel test robot 23 Aug '24

23 Aug '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: eccf28eefc9db7799534bd84bb958f3ecf978e2d commit: 721f4ea899ff2ab4e3283767cf125dc5952c1d15 [13455/13476] cvm_tsi: add support virtcca attestation config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20240823/202408230839.S2haccDx-lkp@…) compiler: clang version 20.0.0git (https://github.com/llvm/llvm-project 26670e7fa4f032a019d23d56c6a02926e854e8af) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240823/202408230839.S2haccDx-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408230839.S2haccDx-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from arch/arm64/kernel/virtcca_cvm_tsi.c:3: In file included from include/linux/memblock.h:12: In file included from include/linux/mm.h:2242: include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ >> arch/arm64/kernel/virtcca_cvm_tsi.c:57:30: warning: variable 'ver' is uninitialized when used here [-Wuninitialized] 57 | TSI_ABI_VERSION_GET_MAJOR(ver), | ^~~ include/linux/printk.h:508:37: note: expanded from macro 'pr_warn' 508 | printk(KERN_WARNING pr_fmt(fmt), ##__VA_ARGS__) | ^~~~~~~~~~~ include/linux/printk.h:455:60: note: expanded from macro 'printk' 455 | #define printk(fmt, ...) printk_index_wrap(_printk, fmt, ##__VA_ARGS__) | ^~~~~~~~~~~ include/linux/printk.h:427:19: note: expanded from macro 'printk_index_wrap' 427 | _p_func(_fmt, ##__VA_ARGS__); \ | ^~~~~~~~~~~ arch/arm64/include/asm/virtcca_cvm_smc.h:16:47: note: expanded from macro 'TSI_ABI_VERSION_GET_MAJOR' 16 | #define TSI_ABI_VERSION_GET_MAJOR(_version) ((_version) >> 16) | ^~~~~~~~ arch/arm64/kernel/virtcca_cvm_tsi.c:39:19: note: initialize the variable 'ver' to silence this warning 39 | unsigned long ver; | ^ | = 0 6 warnings generated. vim +/ver +57 arch/arm64/kernel/virtcca_cvm_tsi.c 36 37 static int __init tmm_tsi_init(void) 38 { 39 unsigned long ver; 40 int ret; 41 42 if (!is_virtcca_cvm_world()) 43 return -EIO; 44 45 ret = misc_register(&ioctl_dev); 46 if (ret) { 47 pr_err("tmm_tsi: misc device register failed (%d)!\n", ret); 48 return ret; 49 } 50 51 /* Allocate a large memory */ 52 token.buf = kzalloc(GRANULE_SIZE * MAX_TOKEN_GRANULE_COUNT, GFP_KERNEL); 53 if (!token.buf) 54 return -ENOMEM; 55 56 pr_warn("tmm_tsi: module loaded (version %lu.%lu).\n", > 57 TSI_ABI_VERSION_GET_MAJOR(ver), 58 TSI_ABI_VERSION_GET_MINOR(ver)); 59 60 return 0; 61 } 62 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION eccf28eefc9db7799534bd84bb958f3ecf978e2d
by kernel test robot 23 Aug '24

23 Aug '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: eccf28eefc9db7799534bd84bb958f3ecf978e2d !10942 add support for arm virtcca attestation Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- arch-arm64-kvm-arm.c:warning:variable-r-is-used-uninitialized-whenever-if-condition-is-false | |-- arch-arm64-kvm-tmi.c:warning:no-previous-prototype-for-function-tmi_tmm_inf_test | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_create_ttt_levels | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_get_num_brps | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_get_num_wrps | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_ipa_limit | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_populate_par_region | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_supports_pmu | `-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_supports_sve |-- x86_64-buildonly-randconfig-005-20240823 | `-- kernel-sched-isolation.c:error:setup_max_cpus-undeclared-(first-use-in-this-function) `-- x86_64-buildonly-randconfig-006-20240823 `-- kernel-sched-isolation.c:error:setup_max_cpus-undeclared-(first-use-in-this-function) elapsed time: 732m configs tested: 36 configs skipped: 124 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240823 clang-20 arm64 randconfig-002-20240823 gcc-14.1.0 arm64 randconfig-003-20240823 gcc-14.1.0 arm64 randconfig-004-20240823 clang-20 loongarch allmodconfig gcc-14.1.0 loongarch allnoconfig gcc-14.1.0 loongarch randconfig-001-20240823 gcc-14.1.0 loongarch randconfig-002-20240823 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240823 gcc-12 x86_64 buildonly-randconfig-002-20240823 gcc-12 x86_64 buildonly-randconfig-003-20240823 gcc-12 x86_64 buildonly-randconfig-004-20240823 clang-18 x86_64 buildonly-randconfig-005-20240823 gcc-12 x86_64 buildonly-randconfig-006-20240823 gcc-12 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240823 clang-18 x86_64 randconfig-002-20240823 clang-18 x86_64 randconfig-003-20240823 clang-18 x86_64 randconfig-004-20240823 clang-18 x86_64 randconfig-005-20240823 clang-18 x86_64 randconfig-006-20240823 clang-18 x86_64 randconfig-011-20240823 gcc-12 x86_64 randconfig-012-20240823 clang-18 x86_64 randconfig-013-20240823 clang-18 x86_64 randconfig-014-20240823 gcc-11 x86_64 randconfig-015-20240823 clang-18 x86_64 randconfig-016-20240823 gcc-12 x86_64 randconfig-071-20240823 gcc-12 x86_64 randconfig-072-20240823 gcc-12 x86_64 randconfig-073-20240823 gcc-12 x86_64 randconfig-074-20240823 clang-18 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10] BUILD SUCCESS e9437292d288968fc2cb9f58fa81e21ab9471f7f
by kernel test robot 23 Aug '24

23 Aug '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: e9437292d288968fc2cb9f58fa81e21ab9471f7f !11045 bpf: Fix a segment issue when downgrading gso_size elapsed time: 746m configs tested: 34 configs skipped: 128 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240823 clang-20 arm64 randconfig-002-20240823 gcc-14.1.0 arm64 randconfig-003-20240823 gcc-14.1.0 arm64 randconfig-004-20240823 clang-20 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240823 gcc-12 x86_64 buildonly-randconfig-002-20240823 gcc-12 x86_64 buildonly-randconfig-003-20240823 gcc-12 x86_64 buildonly-randconfig-004-20240823 clang-18 x86_64 buildonly-randconfig-005-20240823 gcc-12 x86_64 buildonly-randconfig-006-20240823 gcc-12 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240823 clang-18 x86_64 randconfig-002-20240823 clang-18 x86_64 randconfig-003-20240823 clang-18 x86_64 randconfig-004-20240823 clang-18 x86_64 randconfig-005-20240823 clang-18 x86_64 randconfig-006-20240823 clang-18 x86_64 randconfig-011-20240823 gcc-12 x86_64 randconfig-012-20240823 clang-18 x86_64 randconfig-013-20240823 clang-18 x86_64 randconfig-014-20240823 gcc-11 x86_64 randconfig-015-20240823 clang-18 x86_64 randconfig-016-20240823 gcc-12 x86_64 randconfig-071-20240823 gcc-12 x86_64 randconfig-072-20240823 gcc-12 x86_64 randconfig-073-20240823 gcc-12 x86_64 randconfig-074-20240823 clang-18 x86_64 randconfig-075-20240823 gcc-12 x86_64 randconfig-076-20240823 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] nilfs2: fix general protection fault in nilfs_btree_insert()
by Yang Yingliang 22 Aug '24

22 Aug '24

From: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> stable inclusion from stable-v4.19.271 commit d9fde9eab1766170ff2ade67d09178d2cfd78749 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IALLDY CVE: CVE-2023-52900 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- commit 7633355e5c7f29c049a9048e461427d1d8ed3051 upstream. If nilfs2 reads a corrupted disk image and tries to reads a b-tree node block by calling __nilfs_btree_get_block() against an invalid virtual block address, it returns -ENOENT because conversion of the virtual block address to a disk block address fails. However, this return value is the same as the internal code that b-tree lookup routines return to indicate that the block being searched does not exist, so functions that operate on that b-tree may misbehave. When nilfs_btree_insert() receives this spurious 'not found' code from nilfs_btree_do_lookup(), it misunderstands that the 'not found' check was successful and continues the insert operation using incomplete lookup path data, causing the following crash: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] ... RIP: 0010:nilfs_btree_get_nonroot_node fs/nilfs2/btree.c:418 [inline] RIP: 0010:nilfs_btree_prepare_insert fs/nilfs2/btree.c:1077 [inline] RIP: 0010:nilfs_btree_insert+0x6d3/0x1c10 fs/nilfs2/btree.c:1238 Code: bc 24 80 00 00 00 4c 89 f8 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 ff e8 4b 02 92 fe 4d 8b 3f 49 83 c7 28 4c 89 f8 48 c1 e8 03 <42> 80 3c 28 00 74 08 4c 89 ff e8 2e 02 92 fe 4d 8b 3f 49 83 c7 02 ... Call Trace: <TASK> nilfs_bmap_do_insert fs/nilfs2/bmap.c:121 [inline] nilfs_bmap_insert+0x20d/0x360 fs/nilfs2/bmap.c:147 nilfs_get_block+0x414/0x8d0 fs/nilfs2/inode.c:101 __block_write_begin_int+0x54c/0x1a80 fs/buffer.c:1991 __block_write_begin fs/buffer.c:2041 [inline] block_write_begin+0x93/0x1e0 fs/buffer.c:2102 nilfs_write_begin+0x9c/0x110 fs/nilfs2/inode.c:261 generic_perform_write+0x2e4/0x5e0 mm/filemap.c:3772 __generic_file_write_iter+0x176/0x400 mm/filemap.c:3900 generic_file_write_iter+0xab/0x310 mm/filemap.c:3932 call_write_iter include/linux/fs.h:2186 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x7dc/0xc50 fs/read_write.c:584 ksys_write+0x177/0x2a0 fs/read_write.c:637 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd ... </TASK> This patch fixes the root cause of this problem by replacing the error code that __nilfs_btree_get_block() returns on block address conversion failure from -ENOENT to another internal code -EINVAL which means that the b-tree metadata is corrupted. By returning -EINVAL, it propagates without glitches, and for all relevant b-tree operations, functions in the upper bmap layer output an error message indicating corrupted b-tree metadata via nilfs_bmap_convert_error(), and code -EIO will be eventually returned as it should be. Link: https://lkml.kernel.org/r/000000000000bd89e205f0e38355@google.com Link: https://lkml.kernel.org/r/20230105055356.8811-1-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Reported-by: syzbot+ede796cecd5296353515(a)syzkaller.appspotmail.com Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/nilfs2/btree.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/fs/nilfs2/btree.c b/fs/nilfs2/btree.c index e94b18eb5385..7959d3c34d20 100644 --- a/fs/nilfs2/btree.c +++ b/fs/nilfs2/btree.c @@ -478,9 +478,18 @@ static int __nilfs_btree_get_block(const struct nilfs_bmap *btree, __u64 ptr, ret = nilfs_btnode_submit_block(btnc, ptr, 0, REQ_OP_READ, 0, &bh, &submit_ptr); if (ret) { - if (ret != -EEXIST) - return ret; - goto out_check; + if (likely(ret == -EEXIST)) + goto out_check; + if (ret == -ENOENT) { + /* + * Block address translation failed due to invalid + * value of 'ptr'. In this case, return internal code + * -EINVAL (broken bmap) to notify bmap layer of fatal + * metadata corruption. + */ + ret = -EINVAL; + } + return ret; } if (ra) { -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he()
by Liu Jian 22 Aug '24

22 Aug '24

From: Baochen Qiang <quic_bqiang(a)quicinc.com> stable inclusion from stable-v5.10.224 commit 2e201b3d162c6c49417c438ffb30b58c9f85769f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IALEA1 CVE: CVE-2024-43879 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit bcbd771cd5d68c0c52567556097d75f9fc4e7cd6 ] Currently NL80211_RATE_INFO_HE_RU_ALLOC_2x996 is not handled in cfg80211_calculate_bitrate_he(), leading to below warning: kernel: invalid HE MCS: bw:6, ru:6 kernel: WARNING: CPU: 0 PID: 2312 at net/wireless/util.c:1501 cfg80211_calculate_bitrate_he+0x22b/0x270 [cfg80211] Fix it by handling 2x996 RU allocation in the same way as 160 MHz bandwidth. Fixes: c4cbaf7973a7 ("cfg80211: Add support for HE") Signed-off-by: Baochen Qiang <quic_bqiang(a)quicinc.com> Link: https://msgid.link/20240606020653.33205-3-quic_bqiang@quicinc.com Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/wireless/util.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/wireless/util.c b/net/wireless/util.c index 5177fd63b1b8..15773db362a1 100644 --- a/net/wireless/util.c +++ b/net/wireless/util.c @@ -1357,7 +1357,9 @@ static u32 cfg80211_calculate_bitrate_he(struct rate_info *rate) if (WARN_ON_ONCE(rate->nss < 1 || rate->nss > 8)) return 0; - if (rate->bw == RATE_INFO_BW_160) + if (rate->bw == RATE_INFO_BW_160 || + (rate->bw == RATE_INFO_BW_HE_RU && + rate->he_ru_alloc == NL80211_RATE_INFO_HE_RU_ALLOC_2x996)) result = rates_160M[rate->he_gi]; else if (rate->bw == RATE_INFO_BW_80 || (rate->bw == RATE_INFO_BW_HE_RU && -- 2.34.1

2 1

[PATCH OLK-5.10] wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he()
by Liu Jian 22 Aug '24

22 Aug '24

From: Baochen Qiang <quic_bqiang(a)quicinc.com> stable inclusion from stable-v5.10.224 commit 2e201b3d162c6c49417c438ffb30b58c9f85769f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IALEA1 CVE: CVE-2024-43879 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit bcbd771cd5d68c0c52567556097d75f9fc4e7cd6 ] Currently NL80211_RATE_INFO_HE_RU_ALLOC_2x996 is not handled in cfg80211_calculate_bitrate_he(), leading to below warning: kernel: invalid HE MCS: bw:6, ru:6 kernel: WARNING: CPU: 0 PID: 2312 at net/wireless/util.c:1501 cfg80211_calculate_bitrate_he+0x22b/0x270 [cfg80211] Fix it by handling 2x996 RU allocation in the same way as 160 MHz bandwidth. Fixes: c4cbaf7973a7 ("cfg80211: Add support for HE") Signed-off-by: Baochen Qiang <quic_bqiang(a)quicinc.com> Link: https://msgid.link/20240606020653.33205-3-quic_bqiang@quicinc.com Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/wireless/util.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/wireless/util.c b/net/wireless/util.c index 5177fd63b1b8..15773db362a1 100644 --- a/net/wireless/util.c +++ b/net/wireless/util.c @@ -1357,7 +1357,9 @@ static u32 cfg80211_calculate_bitrate_he(struct rate_info *rate) if (WARN_ON_ONCE(rate->nss < 1 || rate->nss > 8)) return 0; - if (rate->bw == RATE_INFO_BW_160) + if (rate->bw == RATE_INFO_BW_160 || + (rate->bw == RATE_INFO_BW_HE_RU && + rate->he_ru_alloc == NL80211_RATE_INFO_HE_RU_ALLOC_2x996)) result = rates_160M[rate->he_gi]; else if (rate->bw == RATE_INFO_BW_80 || (rate->bw == RATE_INFO_BW_HE_RU && -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he()
by Liu Jian 22 Aug '24

22 Aug '24

From: Baochen Qiang <quic_bqiang(a)quicinc.com> stable inclusion from stable-v4.19.320 commit 45d20a1c54be4f3173862c7b950d4468447814c9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IALEA1 CVE: CVE-2024-43879 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit bcbd771cd5d68c0c52567556097d75f9fc4e7cd6 ] Currently NL80211_RATE_INFO_HE_RU_ALLOC_2x996 is not handled in cfg80211_calculate_bitrate_he(), leading to below warning: kernel: invalid HE MCS: bw:6, ru:6 kernel: WARNING: CPU: 0 PID: 2312 at net/wireless/util.c:1501 cfg80211_calculate_bitrate_he+0x22b/0x270 [cfg80211] Fix it by handling 2x996 RU allocation in the same way as 160 MHz bandwidth. Fixes: c4cbaf7973a7 ("cfg80211: Add support for HE") Signed-off-by: Baochen Qiang <quic_bqiang(a)quicinc.com> Link: https://msgid.link/20240606020653.33205-3-quic_bqiang@quicinc.com Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/wireless/util.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/wireless/util.c b/net/wireless/util.c index b39ee17dbead..4e81210e5b24 100644 --- a/net/wireless/util.c +++ b/net/wireless/util.c @@ -1189,7 +1189,9 @@ static u32 cfg80211_calculate_bitrate_he(struct rate_info *rate) if (WARN_ON_ONCE(rate->nss < 1 || rate->nss > 8)) return 0; - if (rate->bw == RATE_INFO_BW_160) + if (rate->bw == RATE_INFO_BW_160 || + (rate->bw == RATE_INFO_BW_HE_RU && + rate->he_ru_alloc == NL80211_RATE_INFO_HE_RU_ALLOC_2x996)) result = rates_160M[rate->he_gi]; else if (rate->bw == RATE_INFO_BW_80 || (rate->bw == RATE_INFO_BW_HE_RU && -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] drm/virtio: Fix GEM handle creation UAF
by Zeng Heng 22 Aug '24

22 Aug '24

From: Rob Clark <robdclark(a)chromium.org> stable inclusion from stable-v5.10.164 commit 68bcd063857075d2f9edfed6024387ac377923e2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IALIA1 CVE: CVE-2022-48899 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 52531258318ed59a2dc5a43df2eaf0eb1d65438e ] Userspace can guess the handle value and try to race GEM object creation with handle close, resulting in a use-after-free if we dereference the object after dropping the handle's reference. For that reason, dropping the handle's reference must be done *after* we are done dereferencing the object. Signed-off-by: Rob Clark <robdclark(a)chromium.org> Reviewed-by: Chia-I Wu <olvaffe(a)gmail.com> Fixes: 62fb7a5e1096 ("virtio-gpu: add 3d/virgl support") Cc: stable(a)vger.kernel.org Signed-off-by: Dmitry Osipenko <dmitry.osipenko(a)collabora.com> Link: https://patchwork.freedesktop.org/patch/msgid/20221216233355.542197-2-robdc… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/gpu/drm/virtio/virtgpu_ioctl.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/virtio/virtgpu_ioctl.c b/drivers/gpu/drm/virtio/virtgpu_ioctl.c index 33b8ebab178a..36efa273155d 100644 --- a/drivers/gpu/drm/virtio/virtgpu_ioctl.c +++ b/drivers/gpu/drm/virtio/virtgpu_ioctl.c @@ -279,10 +279,18 @@ static int virtio_gpu_resource_create_ioctl(struct drm_device *dev, void *data, drm_gem_object_release(obj); return ret; } - drm_gem_object_put(obj); rc->res_handle = qobj->hw_res_handle; /* similiar to a VM address */ rc->bo_handle = handle; + + /* + * The handle owns the reference now. But we must drop our + * remaining reference *after* we no longer need to dereference + * the obj. Otherwise userspace could guess the handle and + * race closing it from another thread. + */ + drm_gem_object_put(obj); + return 0; } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] drm/virtio: Fix GEM handle creation UAF
by Zeng Heng 22 Aug '24

22 Aug '24

From: Rob Clark <robdclark(a)chromium.org> stable inclusion from stable-v4.19.270 commit 19ec87d06acfab2313ee82b2a689bf0c154e57ea category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IALIA1 CVE: CVE-2022-48899 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 52531258318ed59a2dc5a43df2eaf0eb1d65438e ] Userspace can guess the handle value and try to race GEM object creation with handle close, resulting in a use-after-free if we dereference the object after dropping the handle's reference. For that reason, dropping the handle's reference must be done *after* we are done dereferencing the object. Signed-off-by: Rob Clark <robdclark(a)chromium.org> Reviewed-by: Chia-I Wu <olvaffe(a)gmail.com> Fixes: 62fb7a5e1096 ("virtio-gpu: add 3d/virgl support") Cc: stable(a)vger.kernel.org Signed-off-by: Dmitry Osipenko <dmitry.osipenko(a)collabora.com> Link: https://patchwork.freedesktop.org/patch/msgid/20221216233355.542197-2-robdc… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/gpu/drm/virtio/virtgpu_ioctl.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/virtio/virtgpu_ioctl.c b/drivers/gpu/drm/virtio/virtgpu_ioctl.c index 8d2f5ded86d6..a539843a03ba 100644 --- a/drivers/gpu/drm/virtio/virtgpu_ioctl.c +++ b/drivers/gpu/drm/virtio/virtgpu_ioctl.c @@ -309,7 +309,6 @@ static int virtio_gpu_resource_create_ioctl(struct drm_device *dev, void *data, } return ret; } - drm_gem_object_put_unlocked(obj); rc->res_handle = res_id; /* similiar to a VM address */ rc->bo_handle = handle; @@ -318,6 +317,15 @@ static int virtio_gpu_resource_create_ioctl(struct drm_device *dev, void *data, virtio_gpu_unref_list(&validate_list); dma_fence_put(&fence->f); } + + /* + * The handle owns the reference now. But we must drop our + * remaining reference *after* we no longer need to dereference + * the obj. Otherwise userspace could guess the handle and + * race closing it from another thread. + */ + drm_gem_object_put_unlocked(obj); + return 0; fail_unref: if (vgdev->has_virgl_3d) { -- 2.25.1

2 1

2024

2023

2022

2021

2020

2019

Kernel August 2024