- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] misc: fastrpc: Fix copy buffer page size
by Liu Kai 25 Mar '25

25 Mar '25

From: Ekansh Gupta <quic_ekangupt(a)quicinc.com> stable inclusion from stable-v6.6.78 commit c0464bad0e85fcd5d47e4297d1e410097c979e55 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC3E CVE: CVE-2025-21734 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e966eae72762ecfdbdb82627e2cda48845b9dd66 upstream. For non-registered buffer, fastrpc driver copies the buffer and pass it to the remote subsystem. There is a problem with current implementation of page size calculation which is not considering the offset in the calculation. This might lead to passing of improper and out-of-bounds page size which could result in memory issue. Calculate page start and page end using the offset adjusted address instead of absolute address. Fixes: 02b45b47fbe8 ("misc: fastrpc: fix remote page size calculation") Cc: stable(a)kernel.org Signed-off-by: Ekansh Gupta <quic_ekangupt(a)quicinc.com> Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla(a)linaro.org> Link: https://lore.kernel.org/r/20250110134239.123603-4-srinivas.kandagatla@linar… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Kai <liukai284(a)huawei.com> --- drivers/misc/fastrpc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c index 4df0d7a0cd11..6c77d56847d8 100644 --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -1015,8 +1015,8 @@ static int fastrpc_get_args(u32 kernel, struct fastrpc_invoke_ctx *ctx) (pkt_size - rlen); pages[i].addr = pages[i].addr & PAGE_MASK; - pg_start = (args & PAGE_MASK) >> PAGE_SHIFT; - pg_end = ((args + len - 1) & PAGE_MASK) >> PAGE_SHIFT; + pg_start = (rpra[i].buf.pv & PAGE_MASK) >> PAGE_SHIFT; + pg_end = ((rpra[i].buf.pv + len - 1) & PAGE_MASK) >> PAGE_SHIFT; pages[i].size = (pg_end - pg_start + 1) * PAGE_SIZE; args = args + mlen; rlen -= mlen; -- 2.34.1

2 1

[PATCH OLK-6.6] s390/ism: add release function for struct device
by Liu Kai 25 Mar '25

25 Mar '25

From: Julian Ruess <julianr(a)linux.ibm.com> stable inclusion from stable-v6.6.80 commit 940d15254d2216b585558bcf36312da50074e711 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBSW0X CVE: CVE-2025-21856 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 915e34d5ad35a6a9e56113f852ade4a730fb88f0 ] According to device_release() in /drivers/base/core.c, a device without a release function is a broken device and must be fixed. The current code directly frees the device after calling device_add() without waiting for other kernel parts to release their references. Thus, a reference could still be held to a struct device, e.g., by sysfs, leading to potential use-after-free issues if a proper release function is not set. Fixes: 8c81ba20349d ("net/smc: De-tangle ism and smc device initialization") Reviewed-by: Alexandra Winter <wintera(a)linux.ibm.com> Reviewed-by: Wenjia Zhang <wenjia(a)linux.ibm.com> Signed-off-by: Julian Ruess <julianr(a)linux.ibm.com> Signed-off-by: Alexandra Winter <wintera(a)linux.ibm.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://patch.msgid.link/20250214120137.563409-1-wintera@linux.ibm.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Kai <liukai284(a)huawei.com> --- drivers/s390/net/ism_drv.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/drivers/s390/net/ism_drv.c b/drivers/s390/net/ism_drv.c index e36e3ea165d3..2f34761e6413 100644 --- a/drivers/s390/net/ism_drv.c +++ b/drivers/s390/net/ism_drv.c @@ -588,6 +588,15 @@ static int ism_dev_init(struct ism_dev *ism) return ret; } +static void ism_dev_release(struct device *dev) +{ + struct ism_dev *ism; + + ism = container_of(dev, struct ism_dev, dev); + + kfree(ism); +} + static int ism_probe(struct pci_dev *pdev, const struct pci_device_id *id) { struct ism_dev *ism; @@ -601,6 +610,7 @@ static int ism_probe(struct pci_dev *pdev, const struct pci_device_id *id) dev_set_drvdata(&pdev->dev, ism); ism->pdev = pdev; ism->dev.parent = &pdev->dev; + ism->dev.release = ism_dev_release; device_initialize(&ism->dev); dev_set_name(&ism->dev, dev_name(&pdev->dev)); ret = device_add(&ism->dev); @@ -637,7 +647,7 @@ static int ism_probe(struct pci_dev *pdev, const struct pci_device_id *id) device_del(&ism->dev); err_dev: dev_set_drvdata(&pdev->dev, NULL); - kfree(ism); + put_device(&ism->dev); return ret; } @@ -682,7 +692,7 @@ static void ism_remove(struct pci_dev *pdev) pci_disable_device(pdev); device_del(&ism->dev); dev_set_drvdata(&pdev->dev, NULL); - kfree(ism); + put_device(&ism->dev); } static struct pci_driver ism_driver = { -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] partitions: mac: fix handling of bogus partition table
by Long Li 25 Mar '25

25 Mar '25

From: Jann Horn <jannh(a)google.com> mainline inclusion from mainline-v6.10-rc2 commit 80e648042e512d5a767da251d44132553fe04ae0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC5K CVE: CVE-2025-21772 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Fix several issues in partition probing: - The bailout for a bad partoffset must use put_dev_sector(), since the preceding read_part_sector() succeeded. - If the partition table claims a silly sector size like 0xfff bytes (which results in partition table entries straddling sector boundaries), bail out instead of accessing out-of-bounds memory. - We must not assume that the partition table contains proper NUL termination - use strnlen() and strncmp() instead of strlen() and strcmp(). Cc: stable(a)vger.kernel.org Signed-off-by: Jann Horn <jannh(a)google.com> Link: https://lore.kernel.org/r/20250214-partition-mac-v1-1-c1c626dffbd5@google.c… Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- block/partitions/mac.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/block/partitions/mac.c b/block/partitions/mac.c index b6095335636c..ca619d852757 100644 --- a/block/partitions/mac.c +++ b/block/partitions/mac.c @@ -51,13 +51,25 @@ int mac_partition(struct parsed_partitions *state) } secsize = be16_to_cpu(md->block_size); put_dev_sector(sect); + + /* + * If the "block size" is not a power of 2, things get weird - we might + * end up with a partition straddling a sector boundary, so we wouldn't + * be able to read a partition entry with read_part_sector(). + * Real block sizes are probably (?) powers of two, so just require + * that. + */ + if (!is_power_of_2(secsize)) + return -1; datasize = round_down(secsize, 512); data = read_part_sector(state, datasize / 512, &sect); if (!data) return -1; partoffset = secsize % 512; - if (partoffset + sizeof(*part) > datasize) + if (partoffset + sizeof(*part) > datasize) { + put_dev_sector(sect); return -1; + } part = (struct mac_partition *) (data + partoffset); if (be16_to_cpu(part->signature) != MAC_PARTITION_MAGIC) { put_dev_sector(sect); @@ -110,8 +122,8 @@ int mac_partition(struct parsed_partitions *state) int i, l; goodness++; - l = strlen(part->name); - if (strcmp(part->name, "/") == 0) + l = strnlen(part->name, sizeof(part->name)); + if (strncmp(part->name, "/", sizeof(part->name)) == 0) goodness++; for (i = 0; i <= l - 4; ++i) { if (strncasecmp(part->name + i, "root", -- 2.39.2

2 1

[PATCH OLK-5.10] partitions: mac: fix handling of bogus partition table
by Long Li 25 Mar '25

25 Mar '25

From: Jann Horn <jannh(a)google.com> mainline inclusion from mainline-v6.10-rc2 commit 80e648042e512d5a767da251d44132553fe04ae0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC5K CVE: CVE-2025-21772 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Fix several issues in partition probing: - The bailout for a bad partoffset must use put_dev_sector(), since the preceding read_part_sector() succeeded. - If the partition table claims a silly sector size like 0xfff bytes (which results in partition table entries straddling sector boundaries), bail out instead of accessing out-of-bounds memory. - We must not assume that the partition table contains proper NUL termination - use strnlen() and strncmp() instead of strlen() and strcmp(). Cc: stable(a)vger.kernel.org Signed-off-by: Jann Horn <jannh(a)google.com> Link: https://lore.kernel.org/r/20250214-partition-mac-v1-1-c1c626dffbd5@google.c… Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- block/partitions/mac.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/block/partitions/mac.c b/block/partitions/mac.c index b6095335636c..ca619d852757 100644 --- a/block/partitions/mac.c +++ b/block/partitions/mac.c @@ -51,13 +51,25 @@ int mac_partition(struct parsed_partitions *state) } secsize = be16_to_cpu(md->block_size); put_dev_sector(sect); + + /* + * If the "block size" is not a power of 2, things get weird - we might + * end up with a partition straddling a sector boundary, so we wouldn't + * be able to read a partition entry with read_part_sector(). + * Real block sizes are probably (?) powers of two, so just require + * that. + */ + if (!is_power_of_2(secsize)) + return -1; datasize = round_down(secsize, 512); data = read_part_sector(state, datasize / 512, &sect); if (!data) return -1; partoffset = secsize % 512; - if (partoffset + sizeof(*part) > datasize) + if (partoffset + sizeof(*part) > datasize) { + put_dev_sector(sect); return -1; + } part = (struct mac_partition *) (data + partoffset); if (be16_to_cpu(part->signature) != MAC_PARTITION_MAGIC) { put_dev_sector(sect); @@ -110,8 +122,8 @@ int mac_partition(struct parsed_partitions *state) int i, l; goodness++; - l = strlen(part->name); - if (strcmp(part->name, "/") == 0) + l = strnlen(part->name, sizeof(part->name)); + if (strncmp(part->name, "/", sizeof(part->name)) == 0) goodness++; for (i = 0; i <= l - 4; ++i) { if (strncasecmp(part->name + i, "root", -- 2.39.2

2 1

[PATCH OLK-6.6] ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callback
by Qi Xi 25 Mar '25

25 Mar '25

From: Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> mainline inclusion from mainline-v6.14-rc1 commit 301c26a018acb94dd537a4418cefa0f654500c6f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBRED3 CVE: CVE-2024-58077 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- commit 1f5664351410 ("ASoC: lower "no backend DAIs enabled for ... Port" log severity") ignores -EINVAL error message on common soc_pcm_ret(). It is used from many functions, ignoring -EINVAL is over-kill. The reason why -EINVAL was ignored was it really should only be used upon invalid parameters coming from userspace and in that case we don't want to log an error since we do not want to give userspace a way to do a denial-of-service attack on the syslog / diskspace. So don't use soc_pcm_ret() on .prepare callback is better idea. Link: https://lore.kernel.org/r/87v7vptzap.wl-kuninori.morimoto.gx@renesas.com Cc: Hans de Goede <hdegoede(a)redhat.com> Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx(a)renesas.com> Link: https://patch.msgid.link/87bjxg8jju.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Qi Xi <xiqi2(a)huawei.com> --- sound/soc/soc-pcm.c | 32 ++++++++++++++++++++++++++++---- 1 file changed, 28 insertions(+), 4 deletions(-) diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c index 511446a30c05..60248a6820aa 100644 --- a/sound/soc/soc-pcm.c +++ b/sound/soc/soc-pcm.c @@ -38,7 +38,6 @@ static inline int _soc_pcm_ret(struct snd_soc_pcm_runtime *rtd, switch (ret) { case -EPROBE_DEFER: case -ENOTSUPP: - case -EINVAL: break; default: dev_err(rtd->dev, @@ -902,7 +901,13 @@ static int __soc_pcm_prepare(struct snd_soc_pcm_runtime *rtd, } out: - return soc_pcm_ret(rtd, ret); + /* + * Don't use soc_pcm_ret() on .prepare callback to lower error log severity + * + * We don't want to log an error since we do not want to give userspace a way to do a + * denial-of-service attack on the syslog / diskspace. + */ + return ret; } /* PCM prepare ops for non-DPCM streams */ @@ -914,6 +919,13 @@ static int soc_pcm_prepare(struct snd_pcm_substream *substream) snd_soc_dpcm_mutex_lock(rtd); ret = __soc_pcm_prepare(rtd, substream); snd_soc_dpcm_mutex_unlock(rtd); + + /* + * Don't use soc_pcm_ret() on .prepare callback to lower error log severity + * + * We don't want to log an error since we do not want to give userspace a way to do a + * denial-of-service attack on the syslog / diskspace. + */ return ret; } @@ -2461,7 +2473,13 @@ int dpcm_be_dai_prepare(struct snd_soc_pcm_runtime *fe, int stream) be->dpcm[stream].state = SND_SOC_DPCM_STATE_PREPARE; } - return soc_pcm_ret(fe, ret); + /* + * Don't use soc_pcm_ret() on .prepare callback to lower error log severity + * + * We don't want to log an error since we do not want to give userspace a way to do a + * denial-of-service attack on the syslog / diskspace. + */ + return ret; } static int dpcm_fe_dai_prepare(struct snd_pcm_substream *substream) @@ -2501,7 +2519,13 @@ static int dpcm_fe_dai_prepare(struct snd_pcm_substream *substream) dpcm_set_fe_update_state(fe, stream, SND_SOC_DPCM_UPDATE_NO); snd_soc_dpcm_mutex_unlock(fe); - return soc_pcm_ret(fe, ret); + /* + * Don't use soc_pcm_ret() on .prepare callback to lower error log severity + * + * We don't want to log an error since we do not want to give userspace a way to do a + * denial-of-service attack on the syslog / diskspace. + */ + return ret; } static int dpcm_run_update_shutdown(struct snd_soc_pcm_runtime *fe, int stream) -- 2.33.0

2 1

[PATCH OLK-6.6 v2 0/3] arm64: entry: Support hardware xint and xcall
by Jinjie Ruan 24 Mar '25

24 Mar '25

Support hardware xint and xcall. Changes in v2: - Reuse irq_is_nmi(). - Reuse the xint set and check logic in xint 1.0. - Introduce fast_handle_xint(). - Rename enable_xint_xcall() to enable_xfunc() and rename test_has_xint_xcall() to test_has_xfunc(). - Fix a typo. - Add a blank line after declarations. - Remove an excess semicolon. Jinjie Ruan (3): genirq: Reuse irq_is_nmi() arm64: entry: Support hardware xint arm64: entry: Support hardware xcall arch/Kconfig | 14 ++-- arch/arm64/Kconfig | 12 ++++ arch/arm64/include/asm/sysreg.h | 7 ++ arch/arm64/kernel/cpufeature.c | 107 ++++++++++++++++++++++++++++- arch/arm64/kernel/entry-common.c | 39 ++++++++--- arch/arm64/kernel/entry.S | 74 ++++++++++++++++++-- arch/arm64/tools/cpucaps | 4 +- drivers/irqchip/irq-gic-v3.c | 89 ++++++++++++++++++++++-- include/linux/irqchip/arm-gic-v3.h | 6 +- kernel/irq/debugfs.c | 6 +- kernel/irq/internals.h | 8 ++- kernel/irq/irqdesc.c | 5 -- kernel/irq/manage.c | 16 ++--- kernel/irq/resend.c | 2 +- 14 files changed, 341 insertions(+), 48 deletions(-) -- 2.34.1

2 4

[PATCH OLK-5.10 0/4] Add cacheline reorganize
by Yue Haibing 24 Mar '25

24 Mar '25

Coco Li (4): cache: enforce cache groups netns-ipv4: reorganize netns_ipv4 fast path variables net-device: reorganize net_device fast path variables tcp: reorganize tcp_sock fast path variables include/linux/cache.h | 25 ++++ include/linux/netdevice.h | 107 +++++++++------- include/linux/tcp.h | 249 ++++++++++++++++++++------------------ include/net/netns/ipv4.h | 45 ++++--- net/core/dev.c | 54 +++++++++ net/core/net_namespace.c | 45 +++++++ net/ipv4/tcp.c | 93 ++++++++++++++ scripts/kernel-doc | 5 + 8 files changed, 450 insertions(+), 173 deletions(-) -- 2.34.1

1 0

[PATCH OLK-5.10 0/4] Add cacheline reorganize
by Yue Haibing 24 Mar '25

24 Mar '25

Coco Li (4): cache: enforce cache groups netns-ipv4: reorganize netns_ipv4 fast path variables net-device: reorganize net_device fast path variables tcp: reorganize tcp_sock fast path variables include/linux/cache.h | 25 ++++ include/linux/netdevice.h | 107 +++++++++------- include/linux/tcp.h | 249 ++++++++++++++++++++------------------ include/net/netns/ipv4.h | 45 ++++--- net/core/dev.c | 54 +++++++++ net/core/net_namespace.c | 45 +++++++ net/ipv4/tcp.c | 93 ++++++++++++++ scripts/kernel-doc | 5 + 8 files changed, 450 insertions(+), 173 deletions(-) -- 2.34.1

1 0

[PATCH OLK-5.10 0/4] Add cacheline reorganize
by Yue Haibing 24 Mar '25

24 Mar '25

Coco Li (4): cache: enforce cache groups netns-ipv4: reorganize netns_ipv4 fast path variables net-device: reorganize net_device fast path variables tcp: reorganize tcp_sock fast path variables include/linux/cache.h | 25 ++++ include/linux/netdevice.h | 107 +++++++++------- include/linux/tcp.h | 249 ++++++++++++++++++++------------------ include/net/netns/ipv4.h | 45 ++++--- net/core/dev.c | 54 +++++++++ net/core/net_namespace.c | 45 +++++++ net/ipv4/tcp.c | 93 ++++++++++++++ scripts/kernel-doc | 5 + 8 files changed, 450 insertions(+), 173 deletions(-) -- 2.34.1

2 5

[PATCH OLK-6.6 0/6] CVE-2024-57952
by Yongjian Sun 24 Mar '25

24 Mar '25

Chuck Lever (5): [Backport] libfs: Return ENOSPC when the directory offset range is exhausted [Backport] Revert "libfs: Add simple_offset_empty()" [Backport] Revert "libfs: fix infinite directory reads for offset dir" [Backport] libfs: Replace simple_offset end-of-directory detection [Backport] libfs: Use d_children list to iterate simple_offset directories Yongjian Sun (1): [Backport] libfs: Fix duplicate directory entry in offset_dir_lookup fs/libfs.c | 164 ++++++++++++++++++++++----------------------- include/linux/fs.h | 1 - mm/shmem.c | 4 +- 3 files changed, 81 insertions(+), 88 deletions(-) -- 2.39.2

2 7