- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] btrfs: don't BUG_ON on ENOMEM from btrfs_lookup_extent_info() in walk_down_proc()
by Yifan Qiao 29 Sep '24

29 Sep '24

From: Josef Bacik <josef(a)toxicpanda.com> mainline inclusion from mainline-v6.11-rc1 commit a580fb2c3479d993556e1c31b237c9e5be4944a3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9LZ CVE: CVE-2024-46841 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- We handle errors here properly, ENOMEM isn't fatal, return the error. Signed-off-by: Josef Bacik <josef(a)toxicpanda.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Conflicts: fs/btrfs/extent-tree.c [Context difference.] Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/btrfs/extent-tree.c | 1 - 1 file changed, 1 deletion(-) diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c index ae6625aa2c4a..854c7fa0fc06 100644 --- a/fs/btrfs/extent-tree.c +++ b/fs/btrfs/extent-tree.c @@ -4872,7 +4872,6 @@ static noinline int walk_down_proc(struct btrfs_trans_handle *trans, eb->start, level, 1, &wc->refs[level], &wc->flags[level]); - BUG_ON(ret == -ENOMEM); if (ret) return ret; BUG_ON(wc->refs[level] == 0); -- 2.39.2

2 1

[PATCH OLK-6.6] btrfs: don't BUG_ON on ENOMEM from btrfs_lookup_extent_info() in walk_down_proc()
by Yifan Qiao 29 Sep '24

29 Sep '24

From: Josef Bacik <josef(a)toxicpanda.com> mainline inclusion from mainline-v6.11-rc1 commit a580fb2c3479d993556e1c31b237c9e5be4944a3 bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAU9LZ CVE: CVE-2024-46841 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- We handle errors here properly, ENOMEM isn't fatal, return the error. Signed-off-by: Josef Bacik <josef(a)toxicpanda.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Conflicts: fs/btrfs/extent-tree.c [Context difference.] Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/btrfs/extent-tree.c | 1 - 1 file changed, 1 deletion(-) diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c index 39afb1c46907..c88907111d80 100644 --- a/fs/btrfs/extent-tree.c +++ b/fs/btrfs/extent-tree.c @@ -5150,7 +5150,6 @@ static noinline int walk_down_proc(struct btrfs_trans_handle *trans, eb->start, level, 1, &wc->refs[level], &wc->flags[level]); - BUG_ON(ret == -ENOMEM); if (ret) return ret; BUG_ON(wc->refs[level] == 0); -- 2.39.2

2 1

[PATCH OLK-6.6] drm/amdgpu: Fix the warning division or modulo by zero
by Yifan Qiao 29 Sep '24

29 Sep '24

From: Jesse Zhang <jesse.zhang(a)amd.com> stable inclusion from stable-v6.6.50 commit d116bb921e8b104f45d1f30a473ea99ef4262b9a category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAUA67 CVE: CVE-2024-46806 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1a00f2ac82d6bc6689388c7edcd2a4bd82664f3c ] Checks the partition mode and returns an error for an invalid mode. Signed-off-by: Jesse Zhang <Jesse.Zhang(a)amd.com> Suggested-by: Lijo Lazar <lijo.lazar(a)amd.com> Reviewed-by: Lijo Lazar <lijo.lazar(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c b/drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c index 0284c9198a04..6c6f9d9b5d89 100644 --- a/drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c +++ b/drivers/gpu/drm/amd/amdgpu/aqua_vanjaram.c @@ -500,6 +500,12 @@ static int aqua_vanjaram_switch_partition_mode(struct amdgpu_xcp_mgr *xcp_mgr, if (mode == AMDGPU_AUTO_COMPUTE_PARTITION_MODE) { mode = __aqua_vanjaram_get_auto_mode(xcp_mgr); + if (mode == AMDGPU_UNKNOWN_COMPUTE_PARTITION_MODE) { + dev_err(adev->dev, + "Invalid config, no compatible compute partition mode found, available memory partitions: %d", + adev->gmc.num_mem_partitions); + return -EINVAL; + } } else if (!__aqua_vanjaram_is_valid_mode(xcp_mgr, mode)) { dev_err(adev->dev, "Invalid compute partition mode requested, requested: %s, available memory partitions: %d", -- 2.39.2

2 1

[openeuler:OLK-5.10 22702/30000] drivers/irqchip/irq-mbigen.c:122:11: sparse: sparse: symbol 'vtimer_cpu_mask' was not declared. Should it be static?
by kernel test robot 29 Sep '24

29 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: dc55753ca59725e5130059dc4c520e8a91c655c0 commit: 212e82b2357f9103ddb3b759c37ae518831f701b [22702/30000] mbigen: vtimer mbigen driver support config: arm64-randconfig-r131-20240925 (https://download.01.org/0day-ci/archive/20240929/202409291341.axFxcmaf-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce: (https://download.01.org/0day-ci/archive/20240929/202409291341.axFxcmaf-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409291341.axFxcmaf-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/irqchip/irq-mbigen.c:122:11: sparse: sparse: symbol 'vtimer_cpu_mask' was not declared. Should it be static? drivers/irqchip/irq-mbigen.c:318:34: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected void [noderef] __iomem *base @@ got void *chip_data @@ drivers/irqchip/irq-mbigen.c:318:34: sparse: expected void [noderef] __iomem *base drivers/irqchip/irq-mbigen.c:318:34: sparse: got void *chip_data drivers/irqchip/irq-mbigen.c:330:34: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected void [noderef] __iomem *base @@ got void *chip_data @@ drivers/irqchip/irq-mbigen.c:330:34: sparse: expected void [noderef] __iomem *base drivers/irqchip/irq-mbigen.c:330:34: sparse: got void *chip_data drivers/irqchip/irq-mbigen.c:362:31: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected void [noderef] __iomem *base @@ got void *chip_data @@ drivers/irqchip/irq-mbigen.c:362:31: sparse: expected void [noderef] __iomem *base drivers/irqchip/irq-mbigen.c:362:31: sparse: got void *chip_data drivers/irqchip/irq-mbigen.c:435:65: sparse: sparse: incorrect type in argument 5 (different address spaces) @@ expected void *chip_data @@ got void [noderef] __iomem *base @@ drivers/irqchip/irq-mbigen.c:435:65: sparse: expected void *chip_data drivers/irqchip/irq-mbigen.c:435:65: sparse: got void [noderef] __iomem *base vim +/vtimer_cpu_mask +122 drivers/irqchip/irq-mbigen.c 121 > 122 cpumask_t vtimer_cpu_mask; 123 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-5.10 23323/30000] drivers/ub/urma/ubcore/ubcore_tp.c:392:5: warning: no previous prototype for 'ubcore_modify_tp_state'
by kernel test robot 29 Sep '24

29 Sep '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: dc55753ca59725e5130059dc4c520e8a91c655c0 commit: 329bf7f331286ee5d571d374e31ed50d2877b110 [23323/30000] ubcore: fix the bug of tp negotiation concurrency config: arm64-randconfig-004-20240928 (https://download.01.org/0day-ci/archive/20240929/202409291302.BCi0PcSr-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240929/202409291302.BCi0PcSr-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409291302.BCi0PcSr-lkp@intel.com/ All warnings (new ones prefixed by >>): drivers/ub/urma/ubcore/ubcore_tp.c:66:17: warning: no previous prototype for 'ubcore_get_mtu' [-Wmissing-prototypes] 66 | enum ubcore_mtu ubcore_get_mtu(int mtu) | ^~~~~~~~~~~~~~ >> drivers/ub/urma/ubcore/ubcore_tp.c:392:5: warning: no previous prototype for 'ubcore_modify_tp_state' [-Wmissing-prototypes] 392 | int ubcore_modify_tp_state(struct ubcore_device *dev, struct ubcore_tp *tp, | ^~~~~~~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_tp.c:894:19: warning: no previous prototype for 'ubcore_create_vtp' [-Wmissing-prototypes] 894 | struct ubcore_tp *ubcore_create_vtp(struct ubcore_device *dev, union ubcore_eid *remote_eid, | ^~~~~~~~~~~~~~~~~ drivers/ub/urma/ubcore/ubcore_tp.c:920:5: warning: no previous prototype for 'ubcore_destroy_vtp' [-Wmissing-prototypes] 920 | int ubcore_destroy_vtp(struct ubcore_tp *vtp) | ^~~~~~~~~~~~~~~~~~ vim +/ubcore_modify_tp_state +392 drivers/ub/urma/ubcore/ubcore_tp.c 391 > 392 int ubcore_modify_tp_state(struct ubcore_device *dev, struct ubcore_tp *tp, 393 enum ubcore_tp_state new_state, struct ubcore_tp_attr *attr, union ubcore_tp_attr_mask mask) 394 { 395 if (ubcore_modify_tp_state_check(tp, new_state) != 0) 396 return -1; 397 398 if (tp->state == UBCORE_TP_STATE_ERR && new_state == UBCORE_TP_STATE_ERR) { 399 ubcore_log_info("tp is already in ERR state and tpn = %u", 400 tp->tpn); 401 return 0; 402 } 403 404 if (dev->ops->modify_tp(tp, attr, mask) != 0) { 405 /* tp->peer_ext.addr will be freed when called ubcore_destroy_tp */ 406 ubcore_log_err("Failed to modify tp to %u from state %u and tpn = %u", 407 (uint32_t)new_state, (uint32_t)tp->state, tp->tpn); 408 return -1; 409 } 410 tp->state = new_state; 411 ubcore_log_info("tp state:(%u to %u) with tpn %u, peer_tpn %u", 412 (uint32_t)tp->state, (uint32_t)new_state, tp->tpn, tp->peer_tpn); 413 return 0; 414 } 415 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 20368/23799] drivers/android/binder_alloc_selftest.c:109:19: sparse: sparse: incorrect type in assignment (different address spaces)
by kernel test robot 29 Sep '24

29 Sep '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 3a5093f2913b14c22e19e60b6bf7a4d8ec2e5c69 commit: d549e609b8685eb101a4653249ef7e3fe8bb3e99 [20368/23799] binder: use userspace pointer as base of buffer space config: arm64-randconfig-r133-20240926 (https://download.01.org/0day-ci/archive/20240929/202409291234.x2jnAFD9-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce: (https://download.01.org/0day-ci/archive/20240929/202409291234.x2jnAFD9-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202409291234.x2jnAFD9-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/android/binder_alloc_selftest.c:109:19: sparse: sparse: incorrect type in assignment (different address spaces) @@ expected void *page_addr @@ got void [noderef] <asn:1> *user_data @@ drivers/android/binder_alloc_selftest.c:109:19: sparse: expected void *page_addr drivers/android/binder_alloc_selftest.c:109:19: sparse: got void [noderef] <asn:1> *user_data >> drivers/android/binder_alloc_selftest.c:111:41: sparse: sparse: subtraction of different types can't work (different address spaces) drivers/android/binder_alloc_selftest.c:85: warning: Enum value 'LOOP_END' not described in enum 'buf_end_align_type' vim +109 drivers/android/binder_alloc_selftest.c 100 101 static bool check_buffer_pages_allocated(struct binder_alloc *alloc, 102 struct binder_buffer *buffer, 103 size_t size) 104 { 105 void *page_addr, *end; 106 int page_index; 107 108 end = (void *)PAGE_ALIGN((uintptr_t)buffer->user_data + size); > 109 page_addr = buffer->user_data; 110 for (; page_addr < end; page_addr += PAGE_SIZE) { > 111 page_index = (page_addr - alloc->buffer) / PAGE_SIZE; 112 if (!alloc->pages[page_index].page_ptr || 113 !list_empty(&alloc->pages[page_index].lru)) { 114 pr_err("expect alloc but is %s at page index %d\n", 115 alloc->pages[page_index].page_ptr ? 116 "lru" : "free", page_index); 117 return false; 118 } 119 } 120 return true; 121 } 122 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] drm/amdgpu: fix mc_data out-of-bounds read warning
by He Yujie 29 Sep '24

29 Sep '24

From: Tim Huang <Tim.Huang(a)amd.com> stable inclusion from stable-v4.19.322 commit eb1d4ce2609584eeb7694866f34d4b213caa3af9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARV9S CVE: CVE-2024-46722 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 51dfc0a4d609fe700750a62f41447f01b8c9ea50 ] Clear warning that read mc_data[i-1] may out-of-bounds. Signed-off-by: Tim Huang <Tim.Huang(a)amd.com> Reviewed-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: He Yujie <coka.heyujie(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c index bf872f694f50..653651a5b910 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c @@ -1641,6 +1641,8 @@ int amdgpu_atombios_init_mc_reg_table(struct amdgpu_device *adev, (u32)le32_to_cpu(*((u32 *)reg_data + j)); j++; } else if ((reg_table->mc_reg_address[i].pre_reg_data & LOW_NIBBLE_MASK) == DATA_EQU_PREV) { + if (i == 0) + continue; reg_table->mc_reg_table_entry[num_ranges].mc_data[i] = reg_table->mc_reg_table_entry[num_ranges].mc_data[i - 1]; } -- 2.34.1

2 1

[PATCH OLK-5.10 00/10] sbitmap: backport bugfix patches
by Yu Kuai 29 Sep '24

29 Sep '24

Hugh Dickins (1): sbitmap: fix lockup while swapping Jan Kara (1): sbitmap: Avoid leaving waitqueue in invalid state in __sbq_wake_up() Kemeng Shi (3): sbitmap: correct wake_batch recalculation to avoid potential IO hung blk-mq: wait on correct sbitmap_queue in blk_mq_mark_tag_wait blk-mq: Fix potential io hung for shared sbitmap per tagset Laibin Qiu (2): blk-mq: fix tag_get wait task can't be awakened blk-mq: Fix wrong wakeup batch configuration which will cause hang Li Lingfeng (1): block: Fix lockdep warning in blk_mq_mark_tag_wait Yu Kuai (2): blk-mq: fix potential io hang by wrong 'wake_batch' sbitmap: fix possible io hung due to lost wakeup block/blk-mq-tag.c | 46 +++++++++++++++---- block/blk-mq.c | 12 +++-- include/linux/sbitmap.h | 11 +++++ lib/sbitmap.c | 97 +++++++++++++++++++++++++++++------------ 4 files changed, 128 insertions(+), 38 deletions(-) -- 2.39.2

2 11

[PATCH OLK-5.10] usb: typec: ucsi: Fix null pointer dereference in trace
by Zhang Zekun 29 Sep '24

29 Sep '24

From: Abhishek Pandit-Subedi <abhishekpandit(a)chromium.org> stable inclusion from stable-v5.10.226 commit 7e64cabe81c303bdf6fd26b6a09a3289b33bc870 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARV3B CVE: CVE-2024-46719 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------------ [ Upstream commit 99516f76db48e1a9d54cdfed63c1babcee4e71a5 ] ucsi_register_altmode checks IS_ERR for the alt pointer and treats NULL as valid. When CONFIG_TYPEC_DP_ALTMODE is not enabled, ucsi_register_displayport returns NULL which causes a NULL pointer dereference in trace. Rather than return NULL, call typec_port_register_altmode to register DisplayPort alternate mode as a non-controllable mode when CONFIG_TYPEC_DP_ALTMODE is not enabled. Reviewed-by: Benson Leung <bleung(a)chromium.org> Reviewed-by: Heikki Krogerus <heikki.krogerus(a)linux.intel.com> Signed-off-by: Abhishek Pandit-Subedi <abhishekpandit(a)chromium.org> Signed-off-by: Jameson Thies <jthies(a)google.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Link: https://lore.kernel.org/r/20240510201244.2968152-2-jthies@google.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/usb/typec/ucsi/ucsi.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/typec/ucsi/ucsi.h b/drivers/usb/typec/ucsi/ucsi.h index cc1459b366cc..20995adc6b81 100644 --- a/drivers/usb/typec/ucsi/ucsi.h +++ b/drivers/usb/typec/ucsi/ucsi.h @@ -376,7 +376,7 @@ ucsi_register_displayport(struct ucsi_connector *con, bool override, int offset, struct typec_altmode_desc *desc) { - return NULL; + return typec_port_register_altmode(con->port, desc); } static inline void -- 2.17.1

2 1

[PATCH OLK-5.10] of/irq: Prevent device address out-of-bounds read in interrupt map walk
by Zhang Zekun 29 Sep '24

29 Sep '24

From: Stefan Wiehler <stefan.wiehler(a)nokia.com> stable inclusion from stable-v5.10.226 commit 9d1e9f0876b03d74d44513a0ed3ed15ef8f2fed5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IARWTE CVE: CVE-2024-46743 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------------------------------------- [ Upstream commit b739dffa5d570b411d4bdf4bb9b8dfd6b7d72305 ] When of_irq_parse_raw() is invoked with a device address smaller than the interrupt parent node (from #address-cells property), KASAN detects the following out-of-bounds read when populating the initial match table (dyndbg="func of_irq_parse_* +p"): OF: of_irq_parse_one: dev=/soc@0/picasso/watchdog, index=0 OF: parent=/soc@0/pci@878000000000/gpio0@17,0, intsize=2 OF: intspec=4 OF: of_irq_parse_raw: ipar=/soc@0/pci@878000000000/gpio0@17,0, size=2 OF: -> addrsize=3 ================================================================== BUG: KASAN: slab-out-of-bounds in of_irq_parse_raw+0x2b8/0x8d0 Read of size 4 at addr ffffff81beca5608 by task bash/764 CPU: 1 PID: 764 Comm: bash Tainted: G O 6.1.67-484c613561-nokia_sm_arm64 #1 Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2023.01-12.24.03-dirty 01/01/2023 Call trace: dump_backtrace+0xdc/0x130 show_stack+0x1c/0x30 dump_stack_lvl+0x6c/0x84 print_report+0x150/0x448 kasan_report+0x98/0x140 __asan_load4+0x78/0xa0 of_irq_parse_raw+0x2b8/0x8d0 of_irq_parse_one+0x24c/0x270 parse_interrupts+0xc0/0x120 of_fwnode_add_links+0x100/0x2d0 fw_devlink_parse_fwtree+0x64/0xc0 device_add+0xb38/0xc30 of_device_add+0x64/0x90 of_platform_device_create_pdata+0xd0/0x170 of_platform_bus_create+0x244/0x600 of_platform_notify+0x1b0/0x254 blocking_notifier_call_chain+0x9c/0xd0 __of_changeset_entry_notify+0x1b8/0x230 __of_changeset_apply_notify+0x54/0xe4 of_overlay_fdt_apply+0xc04/0xd94 ... The buggy address belongs to the object at ffffff81beca5600 which belongs to the cache kmalloc-128 of size 128 The buggy address is located 8 bytes inside of 128-byte region [ffffff81beca5600, ffffff81beca5680) The buggy address belongs to the physical page: page:00000000230d3d03 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1beca4 head:00000000230d3d03 order:1 compound_mapcount:0 compound_pincount:0 flags: 0x8000000000010200(slab|head|zone=2) raw: 8000000000010200 0000000000000000 dead000000000122 ffffff810000c300 raw: 0000000000000000 0000000000200020 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffffff81beca5500: 04 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffffff81beca5580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffffff81beca5600: 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffffff81beca5680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffffff81beca5700: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc ================================================================== OF: -> got it ! Prevent the out-of-bounds read by copying the device address into a buffer of sufficient size. Signed-off-by: Stefan Wiehler <stefan.wiehler(a)nokia.com> Link: https://lore.kernel.org/r/20240812100652.3800963-1-stefan.wiehler@nokia.com Signed-off-by: Rob Herring (Arm) <robh(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/of/irq.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/drivers/of/irq.c b/drivers/of/irq.c index 352e14b007e7..ad0cb49e233a 100644 --- a/drivers/of/irq.c +++ b/drivers/of/irq.c @@ -288,7 +288,8 @@ int of_irq_parse_one(struct device_node *device, int index, struct of_phandle_ar struct device_node *p; const __be32 *addr; u32 intsize; - int i, res; + int i, res, addr_len; + __be32 addr_buf[3] = { 0 }; pr_debug("of_irq_parse_one: dev=%pOF, index=%d\n", device, index); @@ -297,13 +298,19 @@ int of_irq_parse_one(struct device_node *device, int index, struct of_phandle_ar return of_irq_parse_oldworld(device, index, out_irq); /* Get the reg property (if any) */ - addr = of_get_property(device, "reg", NULL); + addr = of_get_property(device, "reg", &addr_len); + + /* Prevent out-of-bounds read in case of longer interrupt parent address size */ + if (addr_len > (3 * sizeof(__be32))) + addr_len = 3 * sizeof(__be32); + if (addr) + memcpy(addr_buf, addr, addr_len); /* Try the new-style interrupts-extended first */ res = of_parse_phandle_with_args(device, "interrupts-extended", "#interrupt-cells", index, out_irq); if (!res) - return of_irq_parse_raw(addr, out_irq); + return of_irq_parse_raw(addr_buf, out_irq); /* Look for the interrupt parent. */ p = of_irq_find_parent(device); @@ -333,7 +340,7 @@ int of_irq_parse_one(struct device_node *device, int index, struct of_phandle_ar /* Check if there are any interrupt-map translations to process */ - res = of_irq_parse_raw(addr, out_irq); + res = of_irq_parse_raw(addr_buf, out_irq); out: of_node_put(p); return res; -- 2.17.1

2 1

2025

2024

2023

2022

2021

2020

2019

Kernel