- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] pci:vga fix race condition in vga_arb_write
by Yuntao Liu 05 Jun '25

05 Jun '25

Offering: HULK hulk inclusion category: bugfix bugzilla: 190653 CVE: NA -------------------------------- Fixes: deb2d2ecd43d ("PCI/GPU: implement VGA arbitration on Linux") The following code has a race condition under concurrency. if (io_state & VGA_RSRC_LEGACY_IO) uc->io_cnt--; in race condition: pre: uc->io_cnt = 1 post: uc->io_cnt = 4294967295 move vga_put code below changing uc->io_cnt code. Signed-off-by: Yuntao Liu <liuyuntao12(a)huawei.com> --- drivers/gpu/vga/vgaarb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/vga/vgaarb.c b/drivers/gpu/vga/vgaarb.c index c61b04555779..41f56e10c1d6 100644 --- a/drivers/gpu/vga/vgaarb.c +++ b/drivers/gpu/vga/vgaarb.c @@ -1123,13 +1123,13 @@ static ssize_t vga_arb_write(struct file *file, const char __user *buf, goto done; } - vga_put(pdev, io_state); - if (io_state & VGA_RSRC_LEGACY_IO) uc->io_cnt--; if (io_state & VGA_RSRC_LEGACY_MEM) uc->mem_cnt--; + vga_put(pdev, io_state); + ret_val = count; goto done; } else if (strncmp(curr_pos, "trylock ", 8) == 0) { -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
by Yuntao Liu 05 Jun '25

05 Jun '25

From: Artemii Karasev <karasev(a)ispras.ru> stable inclusion from stable-v4.19.273 commit 6e1f586ddec48d71016b81acf68ba9f49ca54db8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVYV CVE: CVE-2023-52988 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b9cee506da2b7920b5ea02ccd8e78a907d0ee7aa ] snd_hda_get_connections() can return a negative error code. It may lead to accessing 'conn' array at a negative index. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Artemii Karasev <karasev(a)ispras.ru> Fixes: 30b4503378c9 ("ALSA: hda - Expose secret DAC-AA connection of some VIA codecs") Link: https://lore.kernel.org/r/20230119082259.3634-1-karasev@ispras.ru Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yuntao Liu <liuyuntao12(a)huawei.com> --- sound/pci/hda/patch_via.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/sound/pci/hda/patch_via.c b/sound/pci/hda/patch_via.c index 6b9617aee0e6..a6253e4f44bd 100644 --- a/sound/pci/hda/patch_via.c +++ b/sound/pci/hda/patch_via.c @@ -833,6 +833,9 @@ static int add_secret_dac_path(struct hda_codec *codec) return 0; nums = snd_hda_get_connections(codec, spec->gen.mixer_nid, conn, ARRAY_SIZE(conn) - 1); + if (nums < 0) + return nums; + for (i = 0; i < nums; i++) { if (get_wcaps_type(get_wcaps(codec, conn[i])) == AC_WID_AUD_OUT) return 0; -- 2.34.1

2 1

[PATCH OLK-6.6] SELinux: Add check for the user data passed to kcalloc in hashtab_init
by Cai Xinchen 05 Jun '25

05 Jun '25

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICC1TY -------------------------------- When the user writes some data to the file /sys/fs/selinux/load, there is no check for the user buf passed to kcalloc. Syzkaller shows this warning: WARNING: CPU: 1 PID: 6642 at mm/page_alloc.c __alloc_pages_noprof ___kmalloc_large_node __kmalloc_large_node_noprof __kmalloc_noprof hashtab_init common_read policydb_read security_load_policy sel_write_load vfs_write ksys_write do_syscall_64 This warning can be reproduced by writing this content to /sys/fs/selinux/load 8cff7cf9 08000000 5345204c 696e7578 15000000 e0ff962a 08000000 07000000 4cf523cd 7eec2688 6d70a6b7 c78b496f 1a0a192c ea34ff41 70581a74 3ff0cfb9 7ea0f0d1 70d1fe14 41c2f7c8 ea1c78dd 17a19249 35210081 a83c30ec 4171450b fc1de12c fe1ff342 a887 Add check to prevent the size passed to kcalloc larger than MAX_ORDER after get_order. Fixes: 24def7bb92c1 ("selinux: prepare for inlining of hashtab functions") Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- security/selinux/ss/hashtab.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/security/selinux/ss/hashtab.c b/security/selinux/ss/hashtab.c index ac5cdddfbf78..86ccb8715bd9 100644 --- a/security/selinux/ss/hashtab.c +++ b/security/selinux/ss/hashtab.c @@ -29,6 +29,18 @@ static u32 hashtab_compute_size(u32 nel) return nel == 0 ? 0 : roundup_pow_of_two(nel); } +static bool is_order_out_of_range(u32 size, struct hashtab *h) +{ + size_t bytes; + u32 order; + + if (unlikely(check_mul_overflow(size, sizeof(*h->htable), &bytes))) + return true; + + order = get_order(bytes); + return order > MAX_ORDER; +} + int hashtab_init(struct hashtab *h, u32 nel_hint) { u32 size = hashtab_compute_size(nel_hint); @@ -39,6 +51,9 @@ int hashtab_init(struct hashtab *h, u32 nel_hint) h->htable = NULL; if (size) { + if (is_order_out_of_range(size, h)) + return -ENOMEM; + h->htable = kcalloc(size, sizeof(*h->htable), GFP_KERNEL); if (!h->htable) return -ENOMEM; -- 2.34.1

2 1

[PATCH OLK-5.10] SELinux: Add check for the user data passed to kcalloc in hashtab_init
by Cai Xinchen 05 Jun '25

05 Jun '25

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ICC1TY -------------------------------- When the user writes some data to the file /sys/fs/selinux/load, there is no check for the user buf passed to kcalloc. Syzkaller shows this warning: WARNING: CPU: 1 PID: 6642 at mm/page_alloc.c __alloc_pages_noprof ___kmalloc_large_node __kmalloc_large_node_noprof __kmalloc_noprof hashtab_init common_read policydb_read security_load_policy sel_write_load vfs_write ksys_write do_syscall_64 This warning can be reproduced by writing this content to /sys/fs/selinux/load 8cff7cf9 08000000 5345204c 696e7578 15000000 e0ff962a 08000000 07000000 4cf523cd 7eec2688 6d70a6b7 c78b496f 1a0a192c ea34ff41 70581a74 3ff0cfb9 7ea0f0d1 70d1fe14 41c2f7c8 ea1c78dd 17a19249 35210081 a83c30ec 4171450b fc1de12c fe1ff342 a887 Add check to prevent the size passed to kcalloc larger than or equal MAX_ORDER after get_order. Fixes: 24def7bb92c1 ("selinux: prepare for inlining of hashtab functions") Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> --- security/selinux/ss/hashtab.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/security/selinux/ss/hashtab.c b/security/selinux/ss/hashtab.c index e8960a59586c..91cfb07a3e51 100644 --- a/security/selinux/ss/hashtab.c +++ b/security/selinux/ss/hashtab.c @@ -28,6 +28,18 @@ static u32 hashtab_compute_size(u32 nel) return nel == 0 ? 0 : roundup_pow_of_two(nel); } +static bool is_order_out_of_range(u32 size, struct hashtab *h) +{ + size_t bytes = 0; + u32 order; + + if (unlikely(check_mul_overflow((size_t)size, sizeof(*h->htable), &bytes))) + return true; + + order = (u32)get_order(bytes); + return order >= MAX_ORDER; +} + int hashtab_init(struct hashtab *h, u32 nel_hint) { u32 size = hashtab_compute_size(nel_hint); @@ -38,6 +50,9 @@ int hashtab_init(struct hashtab *h, u32 nel_hint) h->htable = NULL; if (size) { + if (is_order_out_of_range(size, h)) + return -ENOMEM; + h->htable = kcalloc(size, sizeof(*h->htable), GFP_KERNEL); if (!h->htable) return -ENOMEM; -- 2.34.1

2 1

[PATCH OLK-5.10 0/3] CVE-2024-58100
by Chen Zhongjin 05 Jun '25

05 Jun '25

Chen Zhongjin (1): bpf: Fix kabi breakage for changes_pkt_data in struct bpf_prog_aux Eduard Zingerman (2): bpf: check changes_pkt_data property for extension programs bpf: fix null dereference when computing changes_pkt_data of prog w/o subprogs include/linux/bpf.h | 1 + kernel/bpf/verifier.c | 19 +++++++++++++++---- 2 files changed, 16 insertions(+), 4 deletions(-) -- 2.25.1

2 4

[PATCH OLK-6.6 0/3] CVE-2024-58100
by Chen Zhongjin 05 Jun '25

05 Jun '25

Chen Zhongjin (1): bpf: Fix kabi breakage for changes_pkt_data in struct bpf_prog_aux Eduard Zingerman (2): bpf: check changes_pkt_data property for extension programs bpf: fix null dereference when computing changes_pkt_data of prog w/o subprogs include/linux/bpf.h | 1 + kernel/bpf/verifier.c | 19 +++++++++++++++---- 2 files changed, 16 insertions(+), 4 deletions(-) -- 2.25.1

2 4

[PATCH OLK-6.6] iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifo
by Chen Zhongjin 05 Jun '25

05 Jun '25

From: Silvano Seva <s.seva(a)4sigma.it> stable inclusion from stable-v6.6.91 commit 9ce662851380fe2018e36e15c0bdcb1ad177ed95 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC992M CVE: CVE-2025-37969 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- commit 8114ef86e2058e2554111b793596f17bee23fa15 upstream. Prevent st_lsm6dsx_read_tagged_fifo from falling in an infinite loop in case pattern_len is equal to zero and the device FIFO is not empty. Fixes: 801a6e0af0c6 ("iio: imu: st_lsm6dsx: add support to LSM6DSO") Signed-off-by: Silvano Seva <s.seva(a)4sigma.it> Acked-by: Lorenzo Bianconi <lorenzo(a)kernel.org> Link: https://patch.msgid.link/20250311085030.3593-4-s.seva@4sigma.it Cc: <Stable(a)vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c index 56b14afed769..b8119fa4768e 100644 --- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c +++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c @@ -604,6 +604,9 @@ int st_lsm6dsx_read_tagged_fifo(struct st_lsm6dsx_hw *hw) if (!fifo_len) return 0; + if (!pattern_len) + pattern_len = ST_LSM6DSX_TAGGED_SAMPLE_SIZE; + for (read_len = 0; read_len < fifo_len; read_len += pattern_len) { err = st_lsm6dsx_read_block(hw, ST_LSM6DSX_REG_FIFO_OUT_TAG_ADDR, -- 2.25.1

2 1

[PATCH OLK-6.6 V1] pds_core: remove write-after-free of client_id
by Wang Tao 05 Jun '25

05 Jun '25

From: Shannon Nelson <shannon.nelson(a)amd.com> stable inclusion from stable-v6.6.90 commit 9b467c5bcdb45a41d2a49fbb9ffca73d1380e99b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC9921 CVE: CVE-2025-37916 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit dfd76010f8e821b66116dec3c7d90dd2403d1396 ] A use-after-free error popped up in stress testing: [Mon Apr 21 21:21:33 2025] BUG: KFENCE: use-after-free write in pdsc_auxbus_dev_del+0xef/0x160 [pds_core] [Mon Apr 21 21:21:33 2025] Use-after-free write at 0x000000007013ecd1 (in kfence-#47): [Mon Apr 21 21:21:33 2025] pdsc_auxbus_dev_del+0xef/0x160 [pds_core] [Mon Apr 21 21:21:33 2025] pdsc_remove+0xc0/0x1b0 [pds_core] [Mon Apr 21 21:21:33 2025] pci_device_remove+0x24/0x70 [Mon Apr 21 21:21:33 2025] device_release_driver_internal+0x11f/0x180 [Mon Apr 21 21:21:33 2025] driver_detach+0x45/0x80 [Mon Apr 21 21:21:33 2025] bus_remove_driver+0x83/0xe0 [Mon Apr 21 21:21:33 2025] pci_unregister_driver+0x1a/0x80 The actual device uninit usually happens on a separate thread scheduled after this code runs, but there is no guarantee of order of thread execution, so this could be a problem. There's no actual need to clear the client_id at this point, so simply remove the offending code. Fixes: 10659034c622 ("pds_core: add the aux client API") Signed-off-by: Shannon Nelson <shannon.nelson(a)amd.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://patch.msgid.link/20250425203857.71547-1-shannon.nelson@amd.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/net/ethernet/amd/pds_core/auxbus.c [Some optimization patches restructured the method in linux-v6.6.90, but HULK-6.6 did not merge, so there is a conflict.] Signed-off-by: Wang Tao <wangtao554(a)huawei.com> --- drivers/net/ethernet/amd/pds_core/auxbus.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/net/ethernet/amd/pds_core/auxbus.c b/drivers/net/ethernet/amd/pds_core/auxbus.c index fd1a5149c003..c3dae03bb94a 100644 --- a/drivers/net/ethernet/amd/pds_core/auxbus.c +++ b/drivers/net/ethernet/amd/pds_core/auxbus.c @@ -187,7 +187,6 @@ int pdsc_auxbus_dev_del(struct pdsc *cf, struct pdsc *pf) pds_client_unregister(pf, padev->client_id); auxiliary_device_delete(&padev->aux_dev); auxiliary_device_uninit(&padev->aux_dev); - padev->client_id = 0; } pf->vfs[cf->vf_id].padev = NULL; -- 2.34.1

2 1

[openeuler:OLK-6.6 2357/2357] arch/arm64/kernel/idle.c:54:1: sparse: sparse: symbol '__pcpu_scope_contexts' was not declared. Should it be static?
by kernel test robot 05 Jun '25

05 Jun '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 3160da23afe10e66040ac00ed17174cb467c79b3 commit: 7f2e02718bba28c9969b7f8d5d53301abab7f760 [2357/2357] arm64: entry: Support hardware xcall and xint config: arm64-randconfig-r123-20250605 (https://download.01.org/0day-ci/archive/20250605/202506051337.VIeB2SKc-lkp@…) compiler: aarch64-linux-gcc (GCC) 10.5.0 reproduce: (https://download.01.org/0day-ci/archive/20250605/202506051337.VIeB2SKc-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202506051337.VIeB2SKc-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> arch/arm64/kernel/idle.c:54:1: sparse: sparse: symbol '__pcpu_scope_contexts' was not declared. Should it be static? vim +/__pcpu_scope_contexts +54 arch/arm64/kernel/idle.c 53 > 54 DEFINE_PER_CPU_ALIGNED(struct arm_cpuidle_xcall_xint_context, contexts); 55 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 2357/2357] mm/mem_sampling.c:293:1: sparse: sparse: symbol 'mm_damon_mem_sampling' was not declared. Should it be static?
by kernel test robot 05 Jun '25

05 Jun '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 3160da23afe10e66040ac00ed17174cb467c79b3 commit: 2e9ef6c3ea086c85d489898471e527aeb3f7460b [2357/2357] mm/damon/vaddr: Support hardware-assisted memory access sampling config: arm64-randconfig-r123-20250605 (https://download.01.org/0day-ci/archive/20250605/202506051214.xnjA9eFd-lkp@…) compiler: aarch64-linux-gcc (GCC) 10.5.0 reproduce: (https://download.01.org/0day-ci/archive/20250605/202506051214.xnjA9eFd-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202506051214.xnjA9eFd-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) mm/mem_sampling.c:48:33: sparse: sparse: symbol 'mem_sampling_saved_state' was not declared. Should it be static? mm/mem_sampling.c:61:1: sparse: sparse: symbol 'mem_sampling_record_cb_list' was not declared. Should it be static? mm/mem_sampling.c:69:6: sparse: sparse: symbol 'mem_sampling_record_cb_register' was not declared. Should it be static? mm/mem_sampling.c:86:6: sparse: sparse: symbol 'mem_sampling_record_cb_unregister' was not declared. Should it be static? >> mm/mem_sampling.c:293:1: sparse: sparse: symbol 'mm_damon_mem_sampling' was not declared. Should it be static? vim +/mm_damon_mem_sampling +293 mm/mem_sampling.c 292 > 293 DEFINE_STATIC_KEY_FALSE(mm_damon_mem_sampling); 294 #ifdef CONFIG_DAMON_MEM_SAMPLING 295 static void damon_mem_sampling_record_cb(struct mem_sampling_record *record) 296 { 297 struct damon_mem_sampling_fifo *damon_fifo; 298 struct damon_mem_sampling_record domon_record; 299 struct task_struct *task = NULL; 300 struct mm_struct *mm; 301 302 /* Discard kernel address accesses */ 303 if (record->virt_addr & (1UL << 63)) 304 return; 305 306 task = find_get_task_by_vpid((pid_t)record->context_id); 307 if (!task) 308 return; 309 310 mm = get_task_mm(task); 311 put_task_struct(task); 312 if (!mm) 313 return; 314 315 damon_fifo = mm->damon_fifo; 316 mmput(mm); 317 318 domon_record.vaddr = record->virt_addr; 319 320 /* only the proc under monitor now has damon_fifo */ 321 if (damon_fifo) { 322 if (kfifo_is_full(&damon_fifo->rx_kfifo)) 323 return; 324 325 kfifo_in_locked(&damon_fifo->rx_kfifo, &domon_record, 326 sizeof(struct damon_mem_sampling_record), 327 &damon_fifo->rx_kfifo_lock); 328 return; 329 } 330 } 331 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0