- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] hwmon: (nct6775-core) Fix overflows seen when writing limit attributes
by Li Huafei 28 Dec '24

28 Dec '24

From: Pei Xiao <xiaopei01(a)kylinos.cn> stable inclusion from stable-v6.6.64 commit 685c10269c41d23d7a2b85d3fd6b6345390c8746 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBDHGY CVE: CVE-2024-53159 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 57ee12b6c514146c19b6a159013b48727a012960 ] DIV_ROUND_CLOSEST() after kstrtoul() results in an overflow if a large number such as 18446744073709551615 is provided by the user. Fix it by reordering clamp_val() and DIV_ROUND_CLOSEST() operations. Signed-off-by: Pei Xiao <xiaopei01(a)kylinos.cn> Fixes: c3963bc0a0cf ("hwmon: (nct6775) Split core and platform driver") Message-ID: <7d5084cea33f7c0fd0578c59adfff71f93de94d9.1731375425.git.xiaopei01(a)kylinos.cn> Signed-off-by: Guenter Roeck <linux(a)roeck-us.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Li Huafei <lihuafei1(a)huawei.com> --- drivers/hwmon/nct6775-core.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/drivers/hwmon/nct6775-core.c b/drivers/hwmon/nct6775-core.c index 8da7aa1614d7..16f6b7ba2a5d 100644 --- a/drivers/hwmon/nct6775-core.c +++ b/drivers/hwmon/nct6775-core.c @@ -2878,8 +2878,7 @@ store_target_temp(struct device *dev, struct device_attribute *attr, if (err < 0) return err; - val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), 0, - data->target_temp_mask); + val = DIV_ROUND_CLOSEST(clamp_val(val, 0, data->target_temp_mask * 1000), 1000); mutex_lock(&data->update_lock); data->target_temp[nr] = val; @@ -2959,7 +2958,7 @@ store_temp_tolerance(struct device *dev, struct device_attribute *attr, return err; /* Limit tolerance as needed */ - val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), 0, data->tolerance_mask); + val = DIV_ROUND_CLOSEST(clamp_val(val, 0, data->tolerance_mask * 1000), 1000); mutex_lock(&data->update_lock); data->temp_tolerance[index][nr] = val; @@ -3085,7 +3084,7 @@ store_weight_temp(struct device *dev, struct device_attribute *attr, if (err < 0) return err; - val = clamp_val(DIV_ROUND_CLOSEST(val, 1000), 0, 255); + val = DIV_ROUND_CLOSEST(clamp_val(val, 0, 255000), 1000); mutex_lock(&data->update_lock); data->weight_temp[index][nr] = val; -- 2.25.1

2 1

[PATCH OLK-6.6] firmware_loader: Fix possible resource leak in fw_log_firmware_info()
by dinglongwei 28 Dec '24

28 Dec '24

From: Gaosheng Cui <cuigaosheng1(a)huawei.com> stable inclusion from stable-v6.6.64 commit 789a72498d32f88d24371c10985aceb46397056c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAFY CVE: CVE-2024-53202 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- firmware_loader: Fix possible resource leak in fw_log_firmware_info() [ Upstream commit 369a9c046c2fdfe037f05b43b84c386bdbccc103 ] The alg instance should be released under the exception path, otherwise there may be resource leak here. To mitigate this, free the alg instance with crypto_free_shash when kmalloc fails. Fixes: 02fe26f25325 ("firmware_loader: Add debug message with checksum for FW file") Signed-off-by: Gaosheng Cui <cuigaosheng1(a)huawei.com> Reviewed-by: Amadeusz Sławiński <amadeuszx.slawinski(a)linux.intel.com> Reviewed-by: Russ Weight <russ.weight(a)linux.dev> Link: https://lore.kernel.org/r/20241016110335.3677924-1-cuigaosheng1@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: dinglongwei <dinglongwei1(a)huawei.com> --- drivers/base/firmware_loader/main.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/base/firmware_loader/main.c b/drivers/base/firmware_loader/main.c index 0b18c6b46e65..f3133ba831c5 100644 --- a/drivers/base/firmware_loader/main.c +++ b/drivers/base/firmware_loader/main.c @@ -824,19 +824,18 @@ static void fw_log_firmware_info(const struct firmware *fw, const char *name, st shash->tfm = alg; if (crypto_shash_digest(shash, fw->data, fw->size, sha256buf) < 0) - goto out_shash; + goto out_free; for (int i = 0; i < SHA256_DIGEST_SIZE; i++) sprintf(&outbuf[i * 2], "%02x", sha256buf[i]); outbuf[SHA256_BLOCK_SIZE] = 0; dev_dbg(device, "Loaded FW: %s, sha256: %s\n", name, outbuf); -out_shash: - crypto_free_shash(alg); out_free: kfree(shash); kfree(outbuf); kfree(sha256buf); + crypto_free_shash(alg); } #else static void fw_log_firmware_info(const struct firmware *fw, const char *name, -- 2.22.0

2 1

[openeuler:openEuler-1.0-LTS 1355/1355] include/linux/kern_levels.h:5:25: warning: format '%p' expects argument of type 'void *', but argument 40 has type 'long unsigned int'
by kernel test robot 28 Dec '24

28 Dec '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 773f731853f1368508a0b112047bd9b5a4bb9a5e commit: 2d2fe6b40444bd8f84f674930ac5f98a6314702e [1355/1355] ascend: mm: add an owner for mm_struct config: arm64-randconfig-r133-20241227 (https://download.01.org/0day-ci/archive/20241228/202412281637.7HUx9YuE-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20241228/202412281637.7HUx9YuE-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412281637.7HUx9YuE-lkp@intel.com/ All warnings (new ones prefixed by >>): mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t mm/debug.c:35:9: sparse: sparse: cast from restricted gfp_t In file included from include/linux/printk.h:7, from include/linux/kernel.h:14, from mm/debug.c:9: mm/debug.c: In function 'dump_mm': >> include/linux/kern_levels.h:5:25: warning: format '%p' expects argument of type 'void *', but argument 40 has type 'long unsigned int' [-Wformat=] 5 | #define KERN_SOH "\001" /* ASCII Start Of Header */ | ^~~~~~ include/linux/kern_levels.h:8:25: note: in expansion of macro 'KERN_SOH' 8 | #define KERN_EMERG KERN_SOH "0" /* system is unusable */ | ^~~~~~~~ include/linux/printk.h:342:16: note: in expansion of macro 'KERN_EMERG' 342 | printk(KERN_EMERG pr_fmt(fmt), ##__VA_ARGS__) | ^~~~~~~~~~ mm/debug.c:117:9: note: in expansion of macro 'pr_emerg' 117 | pr_emerg("mm %px mmap %px seqnum %llu task_size %lu\n" | ^~~~~~~~ >> include/linux/kern_levels.h:5:25: warning: format '%lu' expects argument of type 'long unsigned int', but argument 42 has type 'int' [-Wformat=] 5 | #define KERN_SOH "\001" /* ASCII Start Of Header */ | ^~~~~~ include/linux/kern_levels.h:8:25: note: in expansion of macro 'KERN_SOH' 8 | #define KERN_EMERG KERN_SOH "0" /* system is unusable */ | ^~~~~~~~ include/linux/printk.h:342:16: note: in expansion of macro 'KERN_EMERG' 342 | printk(KERN_EMERG pr_fmt(fmt), ##__VA_ARGS__) | ^~~~~~~~~~ mm/debug.c:117:9: note: in expansion of macro 'pr_emerg' 117 | pr_emerg("mm %px mmap %px seqnum %llu task_size %lu\n" | ^~~~~~~~ include/linux/kern_levels.h:5:25: warning: format '%d' expects argument of type 'int', but argument 44 has type 'long unsigned int' [-Wformat=] 5 | #define KERN_SOH "\001" /* ASCII Start Of Header */ | ^~~~~~ include/linux/kern_levels.h:8:25: note: in expansion of macro 'KERN_SOH' 8 | #define KERN_EMERG KERN_SOH "0" /* system is unusable */ | ^~~~~~~~ include/linux/printk.h:342:16: note: in expansion of macro 'KERN_EMERG' 342 | printk(KERN_EMERG pr_fmt(fmt), ##__VA_ARGS__) | ^~~~~~~~~~ mm/debug.c:117:9: note: in expansion of macro 'pr_emerg' 117 | pr_emerg("mm %px mmap %px seqnum %llu task_size %lu\n" | ^~~~~~~~ include/linux/kern_levels.h:5:25: warning: format '%lx' expects argument of type 'long unsigned int', but argument 45 has type 'const long unsigned int *' [-Wformat=] 5 | #define KERN_SOH "\001" /* ASCII Start Of Header */ | ^~~~~~ include/linux/kern_levels.h:8:25: note: in expansion of macro 'KERN_SOH' 8 | #define KERN_EMERG KERN_SOH "0" /* system is unusable */ | ^~~~~~~~ include/linux/printk.h:342:16: note: in expansion of macro 'KERN_EMERG' 342 | printk(KERN_EMERG pr_fmt(fmt), ##__VA_ARGS__) | ^~~~~~~~~~ mm/debug.c:117:9: note: in expansion of macro 'pr_emerg' 117 | pr_emerg("mm %px mmap %px seqnum %llu task_size %lu\n" | ^~~~~~~~ include/linux/kern_levels.h:5:25: warning: format '%p' expects a matching 'void *' argument [-Wformat=] 5 | #define KERN_SOH "\001" /* ASCII Start Of Header */ | ^~~~~~ include/linux/kern_levels.h:8:25: note: in expansion of macro 'KERN_SOH' 8 | #define KERN_EMERG KERN_SOH "0" /* system is unusable */ | ^~~~~~~~ include/linux/printk.h:342:16: note: in expansion of macro 'KERN_EMERG' 342 | printk(KERN_EMERG pr_fmt(fmt), ##__VA_ARGS__) | ^~~~~~~~~~ mm/debug.c:117:9: note: in expansion of macro 'pr_emerg' 117 | pr_emerg("mm %px mmap %px seqnum %llu task_size %lu\n" | ^~~~~~~~ vim +5 include/linux/kern_levels.h 314ba3520e513a Joe Perches 2012-07-30 4 04d2c8c83d0e3a Joe Perches 2012-07-30 @5 #define KERN_SOH "\001" /* ASCII Start Of Header */ 04d2c8c83d0e3a Joe Perches 2012-07-30 6 #define KERN_SOH_ASCII '\001' 04d2c8c83d0e3a Joe Perches 2012-07-30 7 :::::: The code at line 5 was first introduced by commit :::::: 04d2c8c83d0e3ac5f78aeede51babb3236200112 printk: convert the format for KERN_<LEVEL> to a 2 byte pattern :::::: TO: Joe Perches <joe(a)perches.com> :::::: CC: Linus Torvalds <torvalds(a)linux-foundation.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] ocfs2: free inode when ocfs2_get_init_inode() fails
by Jinjie Ruan 28 Dec '24

28 Dec '24

From: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> stable inclusion from stable-v6.6.66 commit a84d507d3290aca249b44ae992af9e10590cc5f6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAN4 CVE: CVE-2024-56630 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 965b5dd1894f4525f38c1b5f99b0106a07dbb5db ] syzbot is reporting busy inodes after unmount, for commit 9c89fe0af826 ("ocfs2: Handle error from dquot_initialize()") forgot to call iput() when new_inode() succeeded and dquot_initialize() failed. Link: https://lkml.kernel.org/r/e68c0224-b7c6-4784-b4fa-a9fc8c675525@I-love.SAKUR… Fixes: 9c89fe0af826 ("ocfs2: Handle error from dquot_initialize()") Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Reported-by: syzbot+0af00f6a2cba2058b5db(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=0af00f6a2cba2058b5db Tested-by: syzbot+0af00f6a2cba2058b5db(a)syzkaller.appspotmail.com Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Jun Piao <piaojun(a)huawei.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- fs/ocfs2/namei.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c index 21b3d5b9be60..4e6d8a3f727d 100644 --- a/fs/ocfs2/namei.c +++ b/fs/ocfs2/namei.c @@ -200,8 +200,10 @@ static struct inode *ocfs2_get_init_inode(struct inode *dir, umode_t mode) mode = mode_strip_sgid(&nop_mnt_idmap, dir, mode); inode_init_owner(&nop_mnt_idmap, inode, dir, mode); status = dquot_initialize(inode); - if (status) + if (status) { + iput(inode); return ERR_PTR(status); + } return inode; } -- 2.34.1

2 1

[PATCH OLK-5.10] ocfs2: free inode when ocfs2_get_init_inode() fails
by Jinjie Ruan 28 Dec '24

28 Dec '24

From: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> stable inclusion from stable-v5.10.231 commit 9c19ea59965ebb482e227532f7bbb01792fb028c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAN4 CVE: CVE-2024-56630 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit 965b5dd1894f4525f38c1b5f99b0106a07dbb5db ] syzbot is reporting busy inodes after unmount, for commit 9c89fe0af826 ("ocfs2: Handle error from dquot_initialize()") forgot to call iput() when new_inode() succeeded and dquot_initialize() failed. Link: https://lkml.kernel.org/r/e68c0224-b7c6-4784-b4fa-a9fc8c675525@I-love.SAKUR… Fixes: 9c89fe0af826 ("ocfs2: Handle error from dquot_initialize()") Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Reported-by: syzbot+0af00f6a2cba2058b5db(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=0af00f6a2cba2058b5db Tested-by: syzbot+0af00f6a2cba2058b5db(a)syzkaller.appspotmail.com Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Jun Piao <piaojun(a)huawei.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- fs/ocfs2/namei.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c index 5c98813b3dca..a1d7f62975bd 100644 --- a/fs/ocfs2/namei.c +++ b/fs/ocfs2/namei.c @@ -201,8 +201,10 @@ static struct inode *ocfs2_get_init_inode(struct inode *dir, umode_t mode) mode = mode_strip_sgid(dir, mode); inode_init_owner(inode, dir, mode); status = dquot_initialize(inode); - if (status) + if (status) { + iput(inode); return ERR_PTR(status); + } return inode; } -- 2.34.1

2 1

[OLK-5.10] ocfs2: free inode when ocfs2_get_init_inode() fails
by Jinjie Ruan 28 Dec '24

28 Dec '24

From: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> stable inclusion from stable-v5.10.231 commit 9c19ea59965ebb482e227532f7bbb01792fb028c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAN4 CVE: CVE-2024-56630 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit 965b5dd1894f4525f38c1b5f99b0106a07dbb5db ] syzbot is reporting busy inodes after unmount, for commit 9c89fe0af826 ("ocfs2: Handle error from dquot_initialize()") forgot to call iput() when new_inode() succeeded and dquot_initialize() failed. Link: https://lkml.kernel.org/r/e68c0224-b7c6-4784-b4fa-a9fc8c675525@I-love.SAKUR… Fixes: 9c89fe0af826 ("ocfs2: Handle error from dquot_initialize()") Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Reported-by: syzbot+0af00f6a2cba2058b5db(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=0af00f6a2cba2058b5db Tested-by: syzbot+0af00f6a2cba2058b5db(a)syzkaller.appspotmail.com Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Jun Piao <piaojun(a)huawei.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- fs/ocfs2/namei.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c index 5c98813b3dca..a1d7f62975bd 100644 --- a/fs/ocfs2/namei.c +++ b/fs/ocfs2/namei.c @@ -201,8 +201,10 @@ static struct inode *ocfs2_get_init_inode(struct inode *dir, umode_t mode) mode = mode_strip_sgid(dir, mode); inode_init_owner(inode, dir, mode); status = dquot_initialize(inode); - if (status) + if (status) { + iput(inode); return ERR_PTR(status); + } return inode; } -- 2.34.1

1 0

[OLK-6.6] ocfs2: free inode when ocfs2_get_init_inode() fails
by Jinjie Ruan 28 Dec '24

28 Dec '24

From: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> stable inclusion from stable-v6.6.66 commit a84d507d3290aca249b44ae992af9e10590cc5f6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAN4 CVE: CVE-2024-56630 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 965b5dd1894f4525f38c1b5f99b0106a07dbb5db ] syzbot is reporting busy inodes after unmount, for commit 9c89fe0af826 ("ocfs2: Handle error from dquot_initialize()") forgot to call iput() when new_inode() succeeded and dquot_initialize() failed. Link: https://lkml.kernel.org/r/e68c0224-b7c6-4784-b4fa-a9fc8c675525@I-love.SAKUR… Fixes: 9c89fe0af826 ("ocfs2: Handle error from dquot_initialize()") Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Reported-by: syzbot+0af00f6a2cba2058b5db(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=0af00f6a2cba2058b5db Tested-by: syzbot+0af00f6a2cba2058b5db(a)syzkaller.appspotmail.com Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Jun Piao <piaojun(a)huawei.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- fs/ocfs2/namei.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c index 21b3d5b9be60..4e6d8a3f727d 100644 --- a/fs/ocfs2/namei.c +++ b/fs/ocfs2/namei.c @@ -200,8 +200,10 @@ static struct inode *ocfs2_get_init_inode(struct inode *dir, umode_t mode) mode = mode_strip_sgid(&nop_mnt_idmap, dir, mode); inode_init_owner(&nop_mnt_idmap, inode, dir, mode); status = dquot_initialize(inode); - if (status) + if (status) { + iput(inode); return ERR_PTR(status); + } return inode; } -- 2.34.1

1 0

[PATCH OLK-6.6 0/2] CVE-2024-53230
by Jinjie Ruan 28 Dec '24

28 Dec '24

CVE-2024-53230. Jinjie Ruan (2): cpufreq: CPPC: Fix possible null-ptr-deref for cppc_get_cpu_cost() cpufreq: CPPC: Fix wrong return value in cppc_get_cpu_cost() drivers/cpufreq/cppc_cpufreq.c | 3 +++ 1 file changed, 3 insertions(+) -- 2.34.1

2 3

[openeuler:openEuler-1.0-LTS 1355/1355] drivers/irqchip/irq-gic-phytium-2500.c:172:29: sparse: sparse: dereference of noderef expression
by kernel test robot 28 Dec '24

28 Dec '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: d7e5d3f944b7f5d2cee0b8e46a829a04dd6066f3 commit: 7981e396b80981a5757aae9b858bb480e940838a [1355/1355] irqchip: phytium-2500: Add interrupt controller driver config: arm64-randconfig-r133-20241227 (https://download.01.org/0day-ci/archive/20241228/202412281248.l2Nmmpui-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20241228/202412281248.l2Nmmpui-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412281248.l2Nmmpui-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/irqchip/irq-gic-phytium-2500.c:172:29: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500.c:194:17: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500.c:271:24: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500.c:290:24: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500.c:140:24: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500.c:510:24: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500.c:796:17: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500.c:797:17: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500.c:983:17: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500.c: In function 'gic_cpumask_select': drivers/irqchip/irq-gic-phytium-2500.c:1112:26: warning: comparison of unsigned expression in '>= 0' is always true [-Wtype-limits] 1112 | if ((skt >= 0) && (skt < MAX_MARS3_SOC_COUNT)) | ^~ drivers/irqchip/irq-gic-phytium-2500.c:1137:26: warning: comparison of unsigned expression in '>= 0' is always true [-Wtype-limits] 1137 | if ((skt >= 0) && (skt < MAX_MARS3_SOC_COUNT)) { | ^~ In file included from arch/arm64/include/asm/cputype.h:125, from arch/arm64/include/asm/cache.h:19, from include/linux/cache.h:6, from include/linux/printk.h:9, from include/linux/kernel.h:14, from include/linux/list.h:9, from include/linux/resource_ext.h:17, from include/linux/acpi.h:26, from drivers/irqchip/irq-gic-phytium-2500.c:22: drivers/irqchip/irq-gic-phytium-2500.c: In function 'gic_cpu_sys_reg_init': arch/arm64/include/asm/sysreg.h:769:9: warning: this statement may fall through [-Wimplicit-fallthrough=] 769 | asm volatile(__msr_s(r, "%x0") : : "rZ" (__val)); 29- | ^~~ arch/arm64/include/asm/arch_gicv3.h:31:41: note: in expansion of macro 'write_sysreg_s' 31 | #define write_gicreg(v, r) write_sysreg_s(v, SYS_ ## r) | ^~~~~~~~~~~~~~ drivers/irqchip/irq-gic-phytium-2500.c:903:25: note: in expansion of macro 'write_gicreg' 903 | write_gicreg(0, ICC_AP0R2_EL1); | ^~~~~~~~~~~~ drivers/irqchip/irq-gic-phytium-2500.c:904:17: note: here 904 | case 6: | ^~~~ arch/arm64/include/asm/sysreg.h:769:9: warning: this statement may fall through [-Wimplicit-fallthrough=] 769 | asm volatile(__msr_s(r, "%x0") : : "rZ" (__val)); 41- | ^~~ arch/arm64/include/asm/arch_gicv3.h:31:41: note: in expansion of macro 'write_sysreg_s' 31 | #define write_gicreg(v, r) write_sysreg_s(v, SYS_ ## r) | ^~~~~~~~~~~~~~ drivers/irqchip/irq-gic-phytium-2500.c:905:25: note: in expansion of macro 'write_gicreg' 905 | write_gicreg(0, ICC_AP0R1_EL1); | ^~~~~~~~~~~~ drivers/irqchip/irq-gic-phytium-2500.c:906:17: note: here 906 | case 5: | ^~~~ arch/arm64/include/asm/sysreg.h:769:9: warning: this statement may fall through [-Wimplicit-fallthrough=] 769 | asm volatile(__msr_s(r, "%x0") : : "rZ" (__val)); 53- | ^~~ arch/arm64/include/asm/arch_gicv3.h:31:41: note: in expansion of macro 'write_sysreg_s' 31 | #define write_gicreg(v, r) write_sysreg_s(v, SYS_ ## r) | ^~~~~~~~~~~~~~ drivers/irqchip/irq-gic-phytium-2500.c:918:17: note: in expansion of macro 'write_gicreg' 918 | write_gicreg(0, ICC_AP1R2_EL1); | ^~~~~~~~~~~~ drivers/irqchip/irq-gic-phytium-2500.c:919:9: note: here 919 | case 6: | ^~~~ arch/arm64/include/asm/sysreg.h:769:9: warning: this statement may fall through [-Wimplicit-fallthrough=] 769 | asm volatile(__msr_s(r, "%x0") : : "rZ" (__val)); 65- | ^~~ arch/arm64/include/asm/arch_gicv3.h:31:41: note: in expansion of macro 'write_sysreg_s' 31 | #define write_gicreg(v, r) write_sysreg_s(v, SYS_ ## r) | ^~~~~~~~~~~~~~ drivers/irqchip/irq-gic-phytium-2500.c:920:17: note: in expansion of macro 'write_gicreg' 920 | write_gicreg(0, ICC_AP1R1_EL1); | ^~~~~~~~~~~~ drivers/irqchip/irq-gic-phytium-2500.c:921:9: note: here 921 | case 5: | ^~~~ -- drivers/irqchip/irq-gic-phytium-2500-its.c:1736:23: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:1736:23: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:2123:15: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:2123:15: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:2318:26: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:2318:26: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:3804:19: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:3804:19: sparse: sparse: dereference of noderef expression >> drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: got restricted __le64 [usertype] >> drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: got restricted __le64 [usertype] >> drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: got restricted __le64 [usertype] >> drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: got restricted __le64 [usertype] >> drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: got restricted __le64 [usertype] >> drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: got restricted __le64 [usertype] >> drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: got restricted __le64 [usertype] >> drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: got restricted __le64 [usertype] >> drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: got restricted __le64 [usertype] >> drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: got restricted __le64 [usertype] >> drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: got restricted __le64 [usertype] >> drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: got restricted __le64 [usertype] >> drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: got restricted __le64 [usertype] >> drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: got restricted __le64 [usertype] >> drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: got restricted __le64 [usertype] >> drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:1736:23: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:1736:23: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:1736:23: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:2123:15: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:2123:15: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:2123:15: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:2148:17: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:2179:31: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:2184:13: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:2194:40: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:2195:17: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:2200:21: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:2253:43: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:2279:9: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:2280:9: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:2315:26: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:2318:26: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:2318:26: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:2318:26: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:2873:26: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:2920:35: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:2952:35: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:3030:26: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:3070:26: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:3804:19: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:3804:19: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:3804:19: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:3809:31: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:3829:13: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c: In function 'its_cpumask_select': drivers/irqchip/irq-gic-phytium-2500-its.c:1169:26: warning: comparison of unsigned expression in '>= 0' is always true [-Wtype-limits] 1169 | if ((skt >= 0) && (skt < MAX_MARS3_SKT_COUNT)) | ^~ drivers/irqchip/irq-gic-phytium-2500-its.c:1195:26: warning: comparison of unsigned expression in '>= 0' is always true [-Wtype-limits] 1195 | if ((skt >= 0) && (skt < MAX_MARS3_SKT_COUNT)) { | ^~ drivers/irqchip/irq-gic-phytium-2500-its.c: In function 'its_cpu_init_collection': drivers/irqchip/irq-gic-phytium-2500-its.c:2289:29: warning: variable 'skt_id' set but not used [-Wunused-but-set-variable] 2289 | unsigned long mpid, skt_id; | ^~~~~~ drivers/irqchip/irq-gic-phytium-2500-its.c:2289:23: warning: variable 'mpid' set but not used [-Wunused-but-set-variable] 2289 | unsigned long mpid, skt_id; | ^~~~ drivers/irqchip/irq-gic-phytium-2500-its.c: In function 'its_cpumask_first': drivers/irqchip/irq-gic-phytium-2500-its.c:2679:26: warning: comparison of unsigned expression in '>= 0' is always true [-Wtype-limits] 2679 | if ((skt >= 0) && (skt < MAX_MARS3_SKT_COUNT)) | ^~ drivers/irqchip/irq-gic-phytium-2500-its.c:2705:26: warning: comparison of unsigned expression in '>= 0' is always true [-Wtype-limits] 2705 | if ((skt >= 0) && (skt < MAX_MARS3_SKT_COUNT)) { | ^~ vim +172 drivers/irqchip/irq-gic-phytium-2500.c 168 169 /* Wait for completion of a redistributor change */ 170 static void gic_redist_wait_for_rwp(void) 171 { > 172 gic_do_wait_for_rwp(gic_data_rdist_rd_base()); 173 } 174 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] ALSA: usb-audio: Fix out of bounds reads when finding clock sources
by Luo Gengkun 28 Dec '24

28 Dec '24

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v6.6.64 commit 74cb86e1006c5437b1d90084d22018da30fddc77 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBDHGG CVE: CVE-2024-53150 Reference: https://git.kernel.org/stable/c/74cb86e1006c5437b1d90084d22018da30fddc77 -------------------------------- commit a3dd4d63eeb452cfb064a13862fb376ab108f6a6 upstream. The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, when a device provides a bogus descriptor with a shorter bLength, the driver might hit out-of-bounds reads. For addressing it, this patch adds sanity checks to the validator functions for the clock descriptor traversal. When the descriptor length is shorter than expected, it's skipped in the loop. For the clock source and clock multiplier descriptors, we can just check bLength against the sizeof() of each descriptor type. OTOH, the clock selector descriptor of UAC2 and UAC3 has an array of bNrInPins elements and two more fields at its tail, hence those have to be checked in addition to the sizeof() check. Reported-by: Benoît Sevens <bsevens(a)google.com> Cc: <stable(a)vger.kernel.org> Link: https://lore.kernel.org/20241121140613.3651-1-bsevens@google.com Link: https://patch.msgid.link/20241125144629.20757-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- sound/usb/clock.c | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) diff --git a/sound/usb/clock.c b/sound/usb/clock.c index a676ad093d18..f0f1e445cc56 100644 --- a/sound/usb/clock.c +++ b/sound/usb/clock.c @@ -36,6 +36,12 @@ union uac23_clock_multiplier_desc { struct uac_clock_multiplier_descriptor v3; }; +/* check whether the descriptor bLength has the minimal length */ +#define DESC_LENGTH_CHECK(p, proto) \ + ((proto) == UAC_VERSION_3 ? \ + ((p)->v3.bLength >= sizeof((p)->v3)) : \ + ((p)->v2.bLength >= sizeof((p)->v2))) + #define GET_VAL(p, proto, field) \ ((proto) == UAC_VERSION_3 ? (p)->v3.field : (p)->v2.field) @@ -58,6 +64,8 @@ static bool validate_clock_source(void *p, int id, int proto) { union uac23_clock_source_desc *cs = p; + if (!DESC_LENGTH_CHECK(cs, proto)) + return false; return GET_VAL(cs, proto, bClockID) == id; } @@ -65,13 +73,27 @@ static bool validate_clock_selector(void *p, int id, int proto) { union uac23_clock_selector_desc *cs = p; - return GET_VAL(cs, proto, bClockID) == id; + if (!DESC_LENGTH_CHECK(cs, proto)) + return false; + if (GET_VAL(cs, proto, bClockID) != id) + return false; + /* additional length check for baCSourceID array (in bNrInPins size) + * and two more fields (which sizes depend on the protocol) + */ + if (proto == UAC_VERSION_3) + return cs->v3.bLength >= sizeof(cs->v3) + cs->v3.bNrInPins + + 4 /* bmControls */ + 2 /* wCSelectorDescrStr */; + else + return cs->v2.bLength >= sizeof(cs->v2) + cs->v2.bNrInPins + + 1 /* bmControls */ + 1 /* iClockSelector */; } static bool validate_clock_multiplier(void *p, int id, int proto) { union uac23_clock_multiplier_desc *cs = p; + if (!DESC_LENGTH_CHECK(cs, proto)) + return false; return GET_VAL(cs, proto, bClockID) == id; } -- 2.34.1

2 1