- Kernel - mailweb.openeuler.org

[PATCH 0/2] EEVDF null pointer
by Zicheng Qu 04 Nov '25

04 Nov '25

Zicheng Qu (2): EEVDF null pointer reproduction zero_vruntime kernel/sched/debug.c | 8 +- kernel/sched/fair.c | 170 +++++++++++++++++----------- kernel/sched/sched.h | 2 +- null_reproduction_test/Makefile | 9 ++ null_reproduction_test/fullcpu.c | 12 ++ null_reproduction_test/make.sh | 17 +++ null_reproduction_test/test.sh | 34 ++++++ null_reproduction_test/test_sched.c | 141 +++++++++++++++++++++++ 8 files changed, 325 insertions(+), 68 deletions(-) create mode 100644 null_reproduction_test/Makefile create mode 100644 null_reproduction_test/fullcpu.c create mode 100755 null_reproduction_test/make.sh create mode 100755 null_reproduction_test/test.sh create mode 100644 null_reproduction_test/test_sched.c -- 2.34.1

1 2

[openeuler:OLK-6.6 3098/3098] kernel/sched/cpuacct.c:412:18: warning: no previous prototype for 'bpf_cpuacct_kcpustat_cpu_fetch'
by kernel test robot 04 Nov '25

04 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 9b7e6f8aa58e8c131766ecd2c6eb9bd1dce85ca7 commit: 6ed308fc1d6f486c9e3c171b6b80c1c5f0f57df6 [3098/3098] bpf-rvi: cpuacct: Add bpf_cpuacct_kcpustat_cpu_fetch kfunc config: x86_64-randconfig-001-20251104 (https://download.01.org/0day-ci/archive/20251104/202511041308.wdMKtoD8-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251104/202511041308.wdMKtoD8-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511041308.wdMKtoD8-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from kernel/sched/build_utility.c:61: >> kernel/sched/cpuacct.c:412:18: warning: no previous prototype for 'bpf_cpuacct_kcpustat_cpu_fetch' [-Wmissing-prototypes] 412 | __bpf_kfunc void bpf_cpuacct_kcpustat_cpu_fetch(struct kernel_cpustat *dst, | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from kernel/sched/build_utility.c:73: kernel/sched/debug.c:102:12: warning: no previous prototype for 'is_prefer_numa' [-Wmissing-prototypes] 102 | int __weak is_prefer_numa(void) | ^~~~~~~~~~~~~~ vim +/bpf_cpuacct_kcpustat_cpu_fetch +412 kernel/sched/cpuacct.c 410 411 #ifdef CONFIG_BPF_RVI > 412 __bpf_kfunc void bpf_cpuacct_kcpustat_cpu_fetch(struct kernel_cpustat *dst, 413 struct cpuacct *ca, int cpu) 414 { 415 memcpy(dst, per_cpu_ptr(ca->cpustat, cpu), sizeof(struct kernel_cpustat)); 416 } 417 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] misc: tifm: fix possible memory leak in tifm_7xx1_switch_media()
by Quanmin Yan 04 Nov '25

04 Nov '25

From: ruanjinjie <ruanjinjie(a)huawei.com> stable inclusion from stable-v4.19.270 commit 1695b1adcc3a7d985cd22fa3b55761edf3fab50d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ICYBXA CVE: CVE-2022-50349 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit fd2c930cf6a5b9176382c15f9acb1996e76e25ad ] If device_register() returns error in tifm_7xx1_switch_media(), name of kobject which is allocated in dev_set_name() called in device_add() is leaked. Never directly free @dev after calling device_register(), even if it returned an error! Always use put_device() to give up the reference initialized. Fixes: 2428a8fe2261 ("tifm: move common device management tasks from tifm_7xx1 to tifm_core") Signed-off-by: ruanjinjie <ruanjinjie(a)huawei.com> Link: https://lore.kernel.org/r/20221117064725.3478402-1-ruanjinjie@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Quanmin Yan <yanquanmin1(a)huawei.com> --- drivers/misc/tifm_7xx1.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/misc/tifm_7xx1.c b/drivers/misc/tifm_7xx1.c index 9ac95b48ef92..1d33c4facd44 100644 --- a/drivers/misc/tifm_7xx1.c +++ b/drivers/misc/tifm_7xx1.c @@ -194,7 +194,7 @@ static void tifm_7xx1_switch_media(struct work_struct *work) spin_unlock_irqrestore(&fm->lock, flags); } if (sock) - tifm_free_device(&sock->dev); + put_device(&sock->dev); } spin_lock_irqsave(&fm->lock, flags); } -- 2.43.0

2 1

[PATCH OLK-6.6] riscv, bpf: Sign extend struct ops return values properly
by Wang Tao 04 Nov '25

04 Nov '25

From: Hengqi Chen <hengqi.chen(a)gmail.com> mainline inclusion from mainline-v6.18-rc1 commit fd2e08128944a7679e753f920e9eda72057e427c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/ID3WJL CVE: CVE-2025-40079 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The ns_bpf_qdisc selftest triggers a kernel panic: Unable to handle kernel paging request at virtual address ffffffffa38dbf58 Current test_progs pgtable: 4K pagesize, 57-bit VAs, pgdp=0x00000001109cc000 [ffffffffa38dbf58] pgd=000000011fffd801, p4d=000000011fffd401, pud=000000011fffd001, pmd=0000000000000000 Oops [#1] Modules linked in: bpf_testmod(OE) xt_conntrack nls_iso8859_1 [...] [last unloaded: bpf_testmod(OE)] CPU: 1 UID: 0 PID: 23584 Comm: test_progs Tainted: G W OE 6.17.0-rc1-g2465bb83e0b4 #1 NONE Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2024.01+dfsg-1ubuntu5.1 01/01/2024 epc : __qdisc_run+0x82/0x6f0 ra : __qdisc_run+0x6e/0x6f0 epc : ffffffff80bd5c7a ra : ffffffff80bd5c66 sp : ff2000000eecb550 gp : ffffffff82472098 tp : ff60000096895940 t0 : ffffffff8001f180 t1 : ffffffff801e1664 t2 : 0000000000000000 s0 : ff2000000eecb5d0 s1 : ff60000093a6a600 a0 : ffffffffa38dbee8 a1 : 0000000000000001 a2 : ff2000000eecb510 a3 : 0000000000000001 a4 : 0000000000000000 a5 : 0000000000000010 a6 : 0000000000000000 a7 : 0000000000735049 s2 : ffffffffa38dbee8 s3 : 0000000000000040 s4 : ff6000008bcda000 s5 : 0000000000000008 s6 : ff60000093a6a680 s7 : ff60000093a6a6f0 s8 : ff60000093a6a6ac s9 : ff60000093140000 s10: 0000000000000000 s11: ff2000000eecb9d0 t3 : 0000000000000000 t4 : 0000000000ff0000 t5 : 0000000000000000 t6 : ff60000093a6a8b6 status: 0000000200000120 badaddr: ffffffffa38dbf58 cause: 000000000000000d [<ffffffff80bd5c7a>] __qdisc_run+0x82/0x6f0 [<ffffffff80b6fe58>] __dev_queue_xmit+0x4c0/0x1128 [<ffffffff80b80ae0>] neigh_resolve_output+0xd0/0x170 [<ffffffff80d2daf6>] ip6_finish_output2+0x226/0x6c8 [<ffffffff80d31254>] ip6_finish_output+0x10c/0x2a0 [<ffffffff80d31446>] ip6_output+0x5e/0x178 [<ffffffff80d2e232>] ip6_xmit+0x29a/0x608 [<ffffffff80d6f4c6>] inet6_csk_xmit+0xe6/0x140 [<ffffffff80c985e4>] __tcp_transmit_skb+0x45c/0xaa8 [<ffffffff80c995fe>] tcp_connect+0x9ce/0xd10 [<ffffffff80d66524>] tcp_v6_connect+0x4ac/0x5e8 [<ffffffff80cc19b8>] __inet_stream_connect+0xd8/0x318 [<ffffffff80cc1c36>] inet_stream_connect+0x3e/0x68 [<ffffffff80b42b20>] __sys_connect_file+0x50/0x88 [<ffffffff80b42bee>] __sys_connect+0x96/0xc8 [<ffffffff80b42c40>] __riscv_sys_connect+0x20/0x30 [<ffffffff80e5bcae>] do_trap_ecall_u+0x256/0x378 [<ffffffff80e69af2>] handle_exception+0x14a/0x156 Code: 892a 0363 1205 489c 8bc1 c7e5 2d03 084a 2703 080a (2783) 0709 ---[ end trace 0000000000000000 ]--- The bpf_fifo_dequeue prog returns a skb which is a pointer. The pointer is treated as a 32bit value and sign extend to 64bit in epilogue. This behavior is right for most bpf prog types but wrong for struct ops which requires RISC-V ABI. So let's sign extend struct ops return values according to the function model and RISC-V ABI([0]). [0]: https://riscv.org/wp-content/uploads/2024/12/riscv-calling.pdf Fixes: 25ad10658dc1 ("riscv, bpf: Adapt bpf trampoline to optimized riscv ftrace framework") Signed-off-by: Hengqi Chen <hengqi.chen(a)gmail.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Tested-by: Pu Lehui <pulehui(a)huawei.com> Reviewed-by: Pu Lehui <pulehui(a)huawei.com> Link: https://lore.kernel.org/bpf/20250908012448.1695-1-hengqi.chen@gmail.com Conflicts: arch/riscv/net/bpf_jit_comp64.c [Due to differences in the context of the patch modifications, there are no conflicts with the patch changes.] Signed-off-by: Wang Tao <wangtao554(a)huawei.com> --- arch/riscv/net/bpf_jit_comp64.c | 42 ++++++++++++++++++++++++++++++++- 1 file changed, 41 insertions(+), 1 deletion(-) diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c index 16eb4cd11cbd..ea9ce281c336 100644 --- a/arch/riscv/net/bpf_jit_comp64.c +++ b/arch/riscv/net/bpf_jit_comp64.c @@ -565,6 +565,39 @@ static void emit_atomic(u8 rd, u8 rs, s16 off, s32 imm, bool is64, } } +/* + * Sign-extend the register if necessary + */ +static int sign_extend(u8 rd, u8 rs, u8 sz, bool sign, struct rv_jit_context *ctx) +{ + if (!sign && (sz == 1 || sz == 2)) { + if (rd != rs) + emit_mv(rd, rs, ctx); + return 0; + } + + switch (sz) { + case 1: + emit_sextb(rd, rs, ctx); + break; + case 2: + emit_sexth(rd, rs, ctx); + break; + case 4: + emit_sextw(rd, rs, ctx); + break; + case 8: + if (rd != rs) + emit_mv(rd, rs, ctx); + break; + default: + pr_err("bpf-jit: invalid size %d for sign_extend\n", sz); + return -EINVAL; + } + + return 0; +} + #define BPF_FIXUP_OFFSET_MASK GENMASK(26, 0) #define BPF_FIXUP_REG_MASK GENMASK(31, 27) @@ -993,8 +1026,15 @@ static int __arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, restore_args(nregs, args_off, ctx); if (save_ret) { - emit_ld(RV_REG_A0, -retval_off, RV_REG_FP, ctx); emit_ld(regmap[BPF_REG_0], -(retval_off - 8), RV_REG_FP, ctx); + if (is_struct_ops) { + ret = sign_extend(RV_REG_A0, regmap[BPF_REG_0], m->ret_size, + m->ret_flags & BTF_FMODEL_SIGNED_ARG, ctx); + if (ret) + goto out; + } else { + emit_ld(RV_REG_A0, -retval_off, RV_REG_FP, ctx); + } } emit_ld(RV_REG_S1, -sreg_off, RV_REG_FP, ctx); -- 2.34.1

2 1

[PATCH OLK-6.6] padata: Reset next CPU when reorder sequence wraps around
by Wang Tao 04 Nov '25

04 Nov '25

From: Xiao Liang <shaw.leon(a)gmail.com> mainline inclusion from mainline-v6.18-rc1 commit 501302d5cee0d8e8ec2c4a5919c37e0df9abc99b category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID3Y90 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When seq_nr wraps around, the next reorder job with seq 0 is hashed to the first CPU in padata_do_serial(). Correspondingly, need reset pd->cpu to the first one when pd->processed wraps around. Otherwise, if the number of used CPUs is not a power of 2, padata_find_next() will be checking a wrong list, hence deadlock. Fixes: 6fc4dbcf0276 ("padata: Replace delayed timer with immediate workqueue in padata_reorder") Cc: <stable(a)vger.kernel.org> Signed-off-by: Xiao Liang <shaw.leon(a)gmail.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Conflicts: kernel/padata.c [In mainline, commit f954a2d37637 ("padata: switch padata_find_next() to using cpumask_next_wrap()") has change the "cpumask_next_wrap" function.] Signed-off-by: Wang Tao <wangtao554(a)huawei.com> --- kernel/padata.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/kernel/padata.c b/kernel/padata.c index 44ea75bfd868..e87bbefdf0a0 100644 --- a/kernel/padata.c +++ b/kernel/padata.c @@ -307,8 +307,12 @@ static void padata_reorder(struct padata_priv *padata) struct padata_serial_queue *squeue; int cb_cpu; - cpu = cpumask_next_wrap(cpu, pd->cpumask.pcpu, -1, false); processed++; + /* When sequence wraps around, reset to the first CPU. */ + if (unlikely(processed == 0)) + cpu = cpumask_first(pd->cpumask.pcpu); + else + cpu = cpumask_next_wrap(cpu, pd->cpumask.pcpu, -1, false); cb_cpu = padata->cb_cpu; squeue = per_cpu_ptr(pd->squeue, cb_cpu); -- 2.34.1

2 1

[PATCH OLK-5.10] padata: Reset next CPU when reorder sequence wraps around
by Wang Tao 04 Nov '25

04 Nov '25

From: Xiao Liang <shaw.leon(a)gmail.com> stable inclusion from stable-v5.10.246 commit 3c1cb53236a12a3374365990eccfff5336aa63df category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID3Y90 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 501302d5cee0d8e8ec2c4a5919c37e0df9abc99b ] When seq_nr wraps around, the next reorder job with seq 0 is hashed to the first CPU in padata_do_serial(). Correspondingly, need reset pd->cpu to the first one when pd->processed wraps around. Otherwise, if the number of used CPUs is not a power of 2, padata_find_next() will be checking a wrong list, hence deadlock. Fixes: 6fc4dbcf0276 ("padata: Replace delayed timer with immediate workqueue in padata_reorder") Cc: <stable(a)vger.kernel.org> Signed-off-by: Xiao Liang <shaw.leon(a)gmail.com> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> [ moved from padata_reorder() local variables to padata_find_next() using pd->processed and pd->cpu struct members ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Tao <wangtao554(a)huawei.com> --- kernel/padata.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/kernel/padata.c b/kernel/padata.c index d0f6bf1cf18a..a93a269045da 100644 --- a/kernel/padata.c +++ b/kernel/padata.c @@ -295,7 +295,11 @@ static struct padata_priv *padata_find_next(struct parallel_data *pd, if (remove_object) { list_del_init(&padata->list); ++pd->processed; - pd->cpu = cpumask_next_wrap(cpu, pd->cpumask.pcpu, -1, false); + /* When sequence wraps around, reset to the first CPU. */ + if (unlikely(pd->processed == 0)) + pd->cpu = cpumask_first(pd->cpumask.pcpu); + else + pd->cpu = cpumask_next_wrap(cpu, pd->cpumask.pcpu, -1, false); } spin_unlock(&reorder->lock); -- 2.34.1

2 1

[openeuler:OLK-6.6 3098/3098] fs/proc/stat.c:224:17: warning: no previous prototype for 'bpf_get_idle_time'
by kernel test robot 04 Nov '25

04 Nov '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: a29fc03bd0ddaf7388cf31604ef5bd9807585109 commit: 70780f6924c9b58d5a745d4e20e08e9ace28e711 [3098/3098] bpf-rvi: proc: add bpf_get_{idle,iowait}_time kfunc config: x86_64-randconfig-001-20251104 (https://download.01.org/0day-ci/archive/20251104/202511041056.Im8VvChb-lkp@…) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251104/202511041056.Im8VvChb-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202511041056.Im8VvChb-lkp@intel.com/ All warnings (new ones prefixed by >>): >> fs/proc/stat.c:224:17: warning: no previous prototype for 'bpf_get_idle_time' [-Wmissing-prototypes] 224 | __bpf_kfunc u64 bpf_get_idle_time(struct kernel_cpustat *kcs, int cpu) | ^~~~~~~~~~~~~~~~~ >> fs/proc/stat.c:229:17: warning: no previous prototype for 'bpf_get_iowait_time' [-Wmissing-prototypes] 229 | __bpf_kfunc u64 bpf_get_iowait_time(struct kernel_cpustat *kcs, int cpu) | ^~~~~~~~~~~~~~~~~~~ vim +/bpf_get_idle_time +224 fs/proc/stat.c 222 223 #ifdef CONFIG_BPF_RVI > 224 __bpf_kfunc u64 bpf_get_idle_time(struct kernel_cpustat *kcs, int cpu) 225 { 226 return get_idle_time(kcs, cpu); 227 } 228 > 229 __bpf_kfunc u64 bpf_get_iowait_time(struct kernel_cpustat *kcs, int cpu) 230 { 231 return get_iowait_time(kcs, cpu); 232 } 233 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/4] CVE-2025-39981
by Jiacheng Yu 04 Nov '25

04 Nov '25

*** BLURB HERE *** Christian Eggers (1): Bluetooth: MGMT: set_mesh: update LE scan interval and window Luiz Augusto von Dentz (1): Bluetooth: MGMT: Fix possible UAFs Pavel Shpakovskiy (1): Bluetooth: hci_sync: fix set_local_name race condition Roman Smirnov (1): Bluetooth: mgmt: remove NULL check in mgmt_set_connectable_complete() include/net/bluetooth/hci_sync.h | 2 +- net/bluetooth/hci_sync.c | 6 +- net/bluetooth/mgmt.c | 279 ++++++++++++++++++++++--------- net/bluetooth/mgmt_util.c | 46 +++++ net/bluetooth/mgmt_util.h | 3 + 5 files changed, 257 insertions(+), 79 deletions(-) -- 2.43.0

2 5

[PATCH 0/2] EEVDF null pointer
by Zicheng Qu 04 Nov '25

04 Nov '25

Zicheng Qu (2): EEVDF null pointer reproduction zero_vruntime kernel/sched/debug.c | 8 +- kernel/sched/fair.c | 170 +++++++++++++++++----------- kernel/sched/sched.h | 2 +- null_reproduction_test/Makefile | 9 ++ null_reproduction_test/fullcpu.c | 12 ++ null_reproduction_test/make.sh | 17 +++ null_reproduction_test/test.sh | 34 ++++++ null_reproduction_test/test_sched.c | 141 +++++++++++++++++++++++ 8 files changed, 325 insertions(+), 68 deletions(-) create mode 100644 null_reproduction_test/Makefile create mode 100644 null_reproduction_test/fullcpu.c create mode 100755 null_reproduction_test/make.sh create mode 100755 null_reproduction_test/test.sh create mode 100644 null_reproduction_test/test_sched.c -- 2.34.1

1 2

[PATCH openEuler-1.0-LTS] tty: vt: Fix vc_origin buffer copy overflow in fbcon_prepare_logo()
by Chen Jun 04 Nov '25

04 Nov '25

From: Wang ShaoBo <bobo.shaobowang(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/ID4U8F ---------------------------------------------------------------------- I got some KASAN report as below: BUG: KASAN: slab-use-after-free in fbcon_prepare_logo+0x61e/0xc90 Read of size 14 at addr ffff88812c9a4c38 by task syz.0.3549/19016 CPU: 0 PID: 19016 Comm: syz.0.3549 Not tainted 6.6.0+ #80 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x72/0xa0 print_address_description.constprop.0+0x6b/0x3d0 ? fbcon_prepare_logo+0x61e/0xc90 print_report+0xba/0x280 ? fbcon_prepare_logo+0x61e/0xc90 ? kasan_addr_to_slab+0xd/0xa0 ? fbcon_prepare_logo+0x61e/0xc90 kasan_report+0xaf/0xe0 ? fbcon_prepare_logo+0x61e/0xc90 kasan_check_range+0x100/0x1c0 __asan_memcpy+0x23/0x60 fbcon_prepare_logo+0x61e/0xc90 fbcon_init+0xeb9/0x1db0 ? __pfx_drm_fb_helper_set_par+0x10/0x10 visual_init+0x310/0x5c0 do_bind_con_driver.isra.0+0x627/0xbd0 store_bind+0x60b/0x710 ? __pfx_store_bind+0x10/0x10 dev_attr_store+0x5a/0x90 ? __pfx_dev_attr_store+0x10/0x10 sysfs_kf_write+0x145/0x1b0 kernfs_fop_write_iter+0x367/0x580 ? __pfx_sysfs_kf_write+0x10/0x10 new_sync_write+0x1b1/0x2d0 ? __pfx_new_sync_write+0x10/0x10 ? rb_commit+0x121/0x910 ? avc_policy_seqno+0xe/0x20 ? selinux_file_permission+0x129/0x5d0 ? security_file_permission+0xa8/0x700 vfs_write+0x71a/0x960 ksys_write+0x12e/0x260 fbcon_init() -> vc_resize() //success resize vc_origin buffer size=224=7(cols)*2*16(rows) -> bcon_prepare_logo(vc, info, old_cols, old_rows, new_cols, new_rows) //old_cols=256，old_rows=4，new_cols=7，new_rows=16 There happened to be a vc_origin buffer copy overflow error in fbcon_prepare_logo(), scrolling screen down when using old cols after vc resize would trigger out of lower bound of vc_origin buffer. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Wang ShaoBo <bobo.shaobowang(a)huawei.com> Acked-by: Thomas Zimmermann <tzimmermann(a)suse.de> Signed-off-by: Chen Jun <chenjun102(a)huawei.com> --- drivers/video/fbdev/core/fbcon.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c index f5178eefec64..83a4949e2497 100644 --- a/drivers/video/fbdev/core/fbcon.c +++ b/drivers/video/fbdev/core/fbcon.c @@ -592,6 +592,8 @@ static void fbcon_prepare_logo(struct vc_data *vc, struct fb_info *info, /* We can scroll screen down */ r = q - step - cols; for (cnt = rows - logo_lines; cnt > 0; cnt--) { + if (r < (unsigned short *) vc->vc_origin) + break; scr_memcpyw(r + step, r, vc->vc_size_row); r -= cols; } -- 2.22.0

2 1