- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak
by ZhaoLong Wang 23 Apr '24

23 Apr '24

From: Nikita Zhandarovich <n.zhandarovich(a)fintech.ru> mainline inclusion from mainline-v6.9-rc1 commit 3948abaa4e2be938ccdfc289385a27342fb13d43 category: bugfix bugzilla: 189815 CVE: CVE-2024-26901 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- syzbot identified a kernel information leak vulnerability in do_sys_name_to_handle() and issued the following report [1]. [1] "BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:114 [inline] BUG: KMSAN: kernel-infoleak in _copy_to_user+0xbc/0x100 lib/usercopy.c:40 instrument_copy_to_user include/linux/instrumented.h:114 [inline] _copy_to_user+0xbc/0x100 lib/usercopy.c:40 copy_to_user include/linux/uaccess.h:191 [inline] do_sys_name_to_handle fs/fhandle.c:73 [inline] __do_sys_name_to_handle_at fs/fhandle.c:112 [inline] __se_sys_name_to_handle_at+0x949/0xb10 fs/fhandle.c:94 __x64_sys_name_to_handle_at+0xe4/0x140 fs/fhandle.c:94 ... Uninit was created at: slab_post_alloc_hook+0x129/0xa70 mm/slab.h:768 slab_alloc_node mm/slub.c:3478 [inline] __kmem_cache_alloc_node+0x5c9/0x970 mm/slub.c:3517 __do_kmalloc_node mm/slab_common.c:1006 [inline] __kmalloc+0x121/0x3c0 mm/slab_common.c:1020 kmalloc include/linux/slab.h:604 [inline] do_sys_name_to_handle fs/fhandle.c:39 [inline] __do_sys_name_to_handle_at fs/fhandle.c:112 [inline] __se_sys_name_to_handle_at+0x441/0xb10 fs/fhandle.c:94 __x64_sys_name_to_handle_at+0xe4/0x140 fs/fhandle.c:94 ... Bytes 18-19 of 20 are uninitialized Memory access of size 20 starts at ffff888128a46380 Data copied to user address 0000000020000240" Per Chuck Lever's suggestion, use kzalloc() instead of kmalloc() to solve the problem. Fixes: 990d6c2d7aee ("vfs: Add name to file handle conversion support") Suggested-by: Chuck Lever III <chuck.lever(a)oracle.com> Reported-and-tested-by: <syzbot+09b349b3066c2e0b1e96(a)syzkaller.appspotmail.com> Signed-off-by: Nikita Zhandarovich <n.zhandarovich(a)fintech.ru> Link: https://lore.kernel.org/r/20240119153906.4367-1-n.zhandarovich@fintech.ru Reviewed-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Christian Brauner <brauner(a)kernel.org> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- fs/fhandle.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/fhandle.c b/fs/fhandle.c index 0ee727485615..cb78dbfd7cd5 100644 --- a/fs/fhandle.c +++ b/fs/fhandle.c @@ -37,7 +37,7 @@ static long do_sys_name_to_handle(struct path *path, if (f_handle.handle_bytes > MAX_HANDLE_SZ) return -EINVAL; - handle = kmalloc(sizeof(struct file_handle) + f_handle.handle_bytes, + handle = kzalloc(sizeof(struct file_handle) + f_handle.handle_bytes, GFP_KERNEL); if (!handle) return -ENOMEM; -- 2.39.2

2 1

[PATCH OLK-5.10 0/2] CVE-2024-26813
by Liu Mingrui 23 Apr '24

23 Apr '24

CVE-2024-26813 Alex Williamson (2): vfio/platform: Disable virqfds on cleanup vfio/platform: Create persistent IRQ handlers drivers/vfio/platform/vfio_platform_irq.c | 106 +++++++++++++++------- 1 file changed, 72 insertions(+), 34 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS 0/2] CVE-2024-26813
by Liu Mingrui 23 Apr '24

23 Apr '24

CVE-2024-26813 Alex Williamson (2): vfio/platform: Disable virqfds on cleanup vfio/platform: Create persistent IRQ handlers drivers/vfio/platform/vfio_platform_irq.c | 106 +++++++++++++++------- 1 file changed, 72 insertions(+), 34 deletions(-) -- 2.25.1

2 3

[OLK-6.6 0/5] Some bugfixes and cleanups
by Chengchang Tang 23 Apr '24

23 Apr '24

From: Juan Zhou <zhoujuan51(a)h-partners.com> Some bugfixes and cleanups. Juan Zhou (1): RDMA/hns: Fix incorrect variable usage in scc_attr_is_visible() Junxian Huang (1): RDMA/hns: Fix a potential Sleep-in-Atomic-Context wenglianfa (3): RDMA/hns: Add mutex_destroy() to destroy the mutex RDMA/hns : Fix scc_param delay_work to execute after sysfs shutdown RDMA/hns : Fix null pointer when alloc_scc_param() fails drivers/infiniband/hw/hns/hns_roce_bond.c | 2 ++ drivers/infiniband/hw/hns/hns_roce_device.h | 4 +-- drivers/infiniband/hw/hns/hns_roce_main.c | 13 ++++++-- drivers/infiniband/hw/hns/hns_roce_sysfs.c | 36 ++++++++++----------- 4 files changed, 32 insertions(+), 23 deletions(-) -- 2.30.0

1 5

[PATCH openEuler-1.0-LTS V3 0/2] Fix CVE-2024-26869
by Zizhi Wo 23 Apr '24

23 Apr '24

V3: fix one missing issue in do_write_page() V2: fix one missing issue in f2fs_invalidate_blocks() V1: fix main error Chao Yu (2): Revert: "f2fs: check last page index in cached bio to decide submission" f2fs: fix to truncate meta inode pages forcely fs/f2fs/checkpoint.c | 3 +-- fs/f2fs/data.c | 41 ++++++++++++++++++++--------------------- fs/f2fs/f2fs.h | 30 ++++++++++++++++++++++++++++-- fs/f2fs/gc.c | 3 +-- fs/f2fs/node.c | 11 +++++------ fs/f2fs/segment.c | 19 ++++++++----------- include/linux/f2fs_fs.h | 1 + 7 files changed, 64 insertions(+), 44 deletions(-) -- 2.39.2

2 3

[PATCH OLK-5.10 0/2] CVE-2021-47182
by Li Nan 23 Apr '24

23 Apr '24

Damien Le Moal (1): scsi: core: Fix scsi_mode_sense() buffer length handling Hannes Reinecke (1): scsi: core: Reshuffle response handling in scsi_mode_sense() drivers/scsi/scsi_lib.c | 94 +++++++++++++++++++++-------------------- 1 file changed, 49 insertions(+), 45 deletions(-) -- 2.39.2

2 3

[PATCH openEuler-1.0-LTS 0/3] CVE-2021-47182
by Li Nan 23 Apr '24

23 Apr '24

Damien Le Moal (1): scsi: core: Fix scsi_mode_sense() buffer length handling Hannes Reinecke (2): scsi: core: Fixup calling convention for scsi_mode_sense() scsi: core: Reshuffle response handling in scsi_mode_sense() drivers/scsi/scsi_lib.c | 100 ++++++++++++++++-------------- drivers/scsi/scsi_transport_sas.c | 9 ++- drivers/scsi/sd.c | 12 ++-- drivers/scsi/sr.c | 2 +- 4 files changed, 64 insertions(+), 59 deletions(-) -- 2.39.2

2 4

[PATCH openEuler-1.0-LTS V2 0/2] Fix CVE-2024-26869
by Zizhi Wo 23 Apr '24

23 Apr '24

V2: fix one missing issue in f2fs_invalidate_blocks() V1: fix main error Chao Yu (2): Revert: "f2fs: check last page index in cached bio to decide submission" f2fs: fix to truncate meta inode pages forcely fs/f2fs/checkpoint.c | 3 +-- fs/f2fs/data.c | 41 ++++++++++++++++++++--------------------- fs/f2fs/f2fs.h | 30 ++++++++++++++++++++++++++++-- fs/f2fs/gc.c | 3 +-- fs/f2fs/node.c | 11 +++++------ fs/f2fs/segment.c | 16 +++++++--------- include/linux/f2fs_fs.h | 1 + 7 files changed, 63 insertions(+), 42 deletions(-) -- 2.39.2

2 3

[PATCH openEuler-1.0-LTS 0/2] Fix CVE-2024-26869
by Zizhi Wo 23 Apr '24

23 Apr '24

Fix CVE-2024-26869 Chao Yu (2): Revert: "f2fs: check last page index in cached bio to decide submission" f2fs: fix to truncate meta inode pages forcely fs/f2fs/checkpoint.c | 3 +-- fs/f2fs/data.c | 41 ++++++++++++++++++++--------------------- fs/f2fs/f2fs.h | 30 ++++++++++++++++++++++++++++-- fs/f2fs/gc.c | 3 +-- fs/f2fs/node.c | 11 +++++------ fs/f2fs/segment.c | 14 ++++++-------- include/linux/f2fs_fs.h | 1 + 7 files changed, 62 insertions(+), 41 deletions(-) -- 2.39.2

2 3

[openeuler:OLK-5.10] BUILD REGRESSION b05f2de3edcf4fc1b98ced476a06a62b961d3cce
by kernel test robot 23 Apr '24

23 Apr '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: b05f2de3edcf4fc1b98ced476a06a62b961d3cce !6279 Bluetooth: Avoid potential use-after-free in hci_error_reset Error/Warning reports: https://lore.kernel.org/oe-kbuild-all/202404230205.XJi54qVa-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202404230552.HyMsovr7-lkp@intel.com https://lore.kernel.org/oe-kbuild-all/202404230626.ETmTJeuy-lkp@intel.com Error/Warning: (recently discovered and may have been fixed) drivers/char/ipmi/ipmi_bt_sm.c:194:18: error: implicit declaration of function 'acpi_evaluate_integer'; did you mean 'acpi_evaluate_object'? [-Werror=implicit-function-declaration] drivers/ptp/ptp_hisi.c:731:36: warning: 'hisi_ptp_acpi_match' defined but not used [-Wunused-const-variable=] fs/proc/base.c:1454:6: warning: no previous prototype for 'pbha_bit0_hide_file' [-Wmissing-prototypes] Error/Warning ids grouped by kconfigs: gcc_recent_errors |-- arm64-allnoconfig | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_enter | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_exit | |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity | |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains | |-- kernel-sched-core.c:error:root_task_group-undeclared-(first-use-in-this-function) | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit |-- arm64-randconfig-002-20240423 | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_enter | |-- arch-arm64-kernel-ipi_nmi.c:error:implicit-declaration-of-function-printk_safe_exit | |-- arch-arm64-kernel-vdso-ilp32-..-vdso-vgettimeofday.c:warning:no-previous-prototype-for-__kernel_clock_getres | |-- arch-arm64-kernel-vdso-ilp32-..-vdso-vgettimeofday.c:warning:no-previous-prototype-for-__kernel_clock_gettime | |-- arch-arm64-kernel-vdso-ilp32-..-vdso-vgettimeofday.c:warning:no-previous-prototype-for-__kernel_gettimeofday | |-- drivers-char-ipmi-ipmi_bt_sm.c:error:implicit-declaration-of-function-acpi_evaluate_integer | |-- drivers-ptp-ptp_hisi.c:warning:hisi_ptp_acpi_match-defined-but-not-used | |-- fs-proc-base.c:warning:no-previous-prototype-for-pbha_bit0_hide_file | |-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_enter | `-- kernel-workqueue.c:error:implicit-declaration-of-function-printk_safe_exit `-- x86_64-randconfig-076-20240422 |-- kernel-sched-core.c:error:implicit-declaration-of-function-init_auto_affinity |-- kernel-sched-core.c:error:implicit-declaration-of-function-tg_update_affinity_domains `-- kernel-sched-core.c:error:root_task_group-undeclared-(first-use-in-this-function) clang_recent_errors |-- arm64-allyesconfig | |-- Documentation-devicetree-bindings-arm-cpu.yaml:properties:capacity-dmips-mhz:ref-should-not-be-valid-under-const:ref | |-- Documentation-devicetree-bindings-arm-cpu.yaml:title:ARM-CPUs-bindings-should-not-be-valid-under-pattern:(-Bb-inding-Ss-chema) | |-- Documentation-devicetree-bindings-arm-cpus.yaml:examples:cpus-arm-pbha-performance-only-bits-arm-pbha-no-aliases-bits-ncpu-device_type-cpu-compatible-arm-cortex-a57-...-n-is-not-of-type-array | |-- Documentation-devicetree-bindings-arm-cpus.yaml:maintainers-is-a-required-property | |-- description:Display-controller-reference-clock-source-is-not-of-type-object-boolean | |-- description:Display-controller-reference-clock-source-is-too-short | |-- description:Offset-and-length-of-the-memory-mapped-registers-is-too-short | |-- items-is-not-one-of-type-description-dependencies-dependentRequired-dependentSchemas-properties-patternProperties-additionalProperties-unevaluatedProperties-deprecated-required-not-allOf-anyOf-oneOf-r | `-- minItems-is-not-one-of-type-description-dependencies-dependentRequired-dependentSchemas-properties-patternProperties-additionalProperties-unevaluatedProperties-deprecated-required-not-allOf-anyOf-oneO |-- x86_64-allnoconfig | `-- drivers-net-ethernet-mucse-rnpm-rnpm_common.h:linux-version.h-not-needed. `-- x86_64-allyesconfig |-- drivers-net-ethernet-bzwx-nce-comm-txrx.c:fatal-error:ne6x_trace.h-file-not-found |-- drivers-net-ethernet-bzwx-nce-ne6x-ne6x.h:fatal-error:reg.h-file-not-found `-- drivers-net-ethernet-bzwx-nce-ne6x_vf-ne6xvf.h:fatal-error:reg.h-file-not-found elapsed time: 727m configs tested: 35 configs skipped: 149 tested configs: arm64 allmodconfig clang arm64 allnoconfig gcc arm64 defconfig gcc arm64 randconfig-001-20240423 clang arm64 randconfig-002-20240423 gcc arm64 randconfig-003-20240423 clang arm64 randconfig-004-20240423 clang x86_64 allnoconfig clang x86_64 allyesconfig clang x86_64 buildonly-randconfig-001-20240422 clang x86_64 buildonly-randconfig-002-20240422 gcc x86_64 buildonly-randconfig-003-20240422 gcc x86_64 buildonly-randconfig-004-20240422 clang x86_64 buildonly-randconfig-005-20240422 gcc x86_64 buildonly-randconfig-006-20240422 clang x86_64 defconfig gcc x86_64 randconfig-001-20240422 clang x86_64 randconfig-002-20240422 gcc x86_64 randconfig-003-20240422 clang x86_64 randconfig-004-20240422 gcc x86_64 randconfig-005-20240422 gcc x86_64 randconfig-006-20240422 clang x86_64 randconfig-011-20240422 gcc x86_64 randconfig-012-20240422 clang x86_64 randconfig-013-20240422 gcc x86_64 randconfig-014-20240422 clang x86_64 randconfig-015-20240422 gcc x86_64 randconfig-016-20240422 gcc x86_64 randconfig-071-20240422 clang x86_64 randconfig-072-20240422 gcc x86_64 randconfig-073-20240422 gcc x86_64 randconfig-074-20240422 gcc x86_64 randconfig-075-20240422 gcc x86_64 randconfig-076-20240422 gcc x86_64 rhel-8.3-rust clang -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0