- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] usb: gadget: ncm: Fix handling of zero block length packets
by Wang Hai 30 Jul '24

30 Jul '24

From: Krishna Kurapati <quic_kriskura(a)quicinc.com> stable inclusion from stable-v5.10.215 commit ef846cdbd100f7f9dc045e8bcd7fe4b3a3713c03 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q92E CVE: CVE-2024-35825 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit f90ce1e04cbcc76639d6cba0fdbd820cd80b3c70 upstream. While connecting to a Linux host with CDC_NCM_NTB_DEF_SIZE_TX set to 65536, it has been observed that we receive short packets, which come at interval of 5-10 seconds sometimes and have block length zero but still contain 1-2 valid datagrams present. According to the NCM spec: "If wBlockLength = 0x0000, the block is terminated by a short packet. In this case, the USB transfer must still be shorter than dwNtbInMaxSize or dwNtbOutMaxSize. If exactly dwNtbInMaxSize or dwNtbOutMaxSize bytes are sent, and the size is a multiple of wMaxPacketSize for the given pipe, then no ZLP shall be sent. wBlockLength= 0x0000 must be used with extreme care, because of the possibility that the host and device may get out of sync, and because of test issues. wBlockLength = 0x0000 allows the sender to reduce latency by starting to send a very large NTB, and then shortening it when the sender discovers that there’s not sufficient data to justify sending a large NTB" However, there is a potential issue with the current implementation, as it checks for the occurrence of multiple NTBs in a single giveback by verifying if the leftover bytes to be processed is zero or not. If the block length reads zero, we would process the same NTB infintely because the leftover bytes is never zero and it leads to a crash. Fix this by bailing out if block length reads zero. Cc: stable(a)vger.kernel.org Fixes: 427694cfaafa ("usb: gadget: ncm: Handle decoding of multiple NTB's in unwrap call") Signed-off-by: Krishna Kurapati <quic_kriskura(a)quicinc.com> Reviewed-by: Maciej Żenczykowski <maze(a)google.com> Link: https://lore.kernel.org/r/20240228115441.2105585-1-quic_kriskura@quicinc.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- drivers/usb/gadget/function/f_ncm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c index e3b89b7c1d67..f3410dc25d12 100644 --- a/drivers/usb/gadget/function/f_ncm.c +++ b/drivers/usb/gadget/function/f_ncm.c @@ -1357,7 +1357,7 @@ static int ncm_unwrap_ntb(struct gether *port, if (to_process == 1 && (*(unsigned char *)(ntb_ptr + block_len) == 0x00)) { to_process--; - } else if (to_process > 0) { + } else if ((to_process > 0) && (block_len != 0)) { ntb_ptr = (unsigned char *)(ntb_ptr + block_len); goto parse_ntb; } -- 2.17.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/2] Fix CVE-2024-41069
by Zheng Yejian 30 Jul '24

30 Jul '24

Amadeusz Sławiński (2): ASoC: topology: Fix references to freed memory ASoC: topology: Fix route memory corruption sound/soc/soc-topology.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10 0/2] Fix CVE-2024-41069
by Zheng Yejian 30 Jul '24

30 Jul '24

Amadeusz Sławiński (2): ASoC: topology: Fix references to freed memory ASoC: topology: Fix route memory corruption sound/soc/soc-topology.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6 0/3] Fix CVE-2024-41069
by Zheng Yejian 30 Jul '24

30 Jul '24

Amadeusz Sławiński (3): ASoC: topology: Fix references to freed memory ASoC: topology: Do not assign fields that are already set ASoC: topology: Fix route memory corruption sound/soc/soc-topology.c | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) -- 2.25.1

2 4

[PATCH OLK-5.10] iommu/arm-smmu-v3: Fix the compile warning
by Zhang Zekun 30 Jul '24

30 Jul '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAGJ97 --------------------------------------- Fix the following compile warning: WARNING: modpost: vmlinux.o(.text+0x854620): ... The function arm_smmu_device_probe() references the variable __initdata arm_smmu_v3_plat_info. This is often because arm_smmu_device_probe lacks a __initdata annotation or the annotation of arm_smmu_v3_plat_info is wrong. Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c index c5c25be54fd5..cedc1eda7250 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c @@ -5244,7 +5244,7 @@ static int arm_smmu_device_hw_probe(struct arm_smmu_device *smmu) } #ifdef CONFIG_ACPI -static struct acpi_platform_list arm_smmu_v3_plat_info[] __initdata = { +static struct acpi_platform_list arm_smmu_v3_plat_info[] = { /* HiSilicon Hip09 Platform */ {"HISI ", "HIP09 ", 0, ACPI_SIG_IORT, greater_than_or_equal, "Erratum #162100602", 0}, -- 2.17.1

2 1

[PATCH OLK-6.6] firmware: cs_dsp: Use strnlen() on name fields in V1 wmfw files
by Jinjie Ruan 30 Jul '24

30 Jul '24

From: Richard Fitzgerald <rf(a)opensource.cirrus.com> stable inclusion from stable-v6.6.41 commit 16d76857d6b5426f41b587d0bb925de3f25bfb21 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEMN CVE: CVE-2024-41056 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 680e126ec0400f6daecf0510c5bb97a55779ff03 ] Use strnlen() instead of strlen() on the algorithm and coefficient name string arrays in V1 wmfw files. In V1 wmfw files the name is a NUL-terminated string in a fixed-size array. cs_dsp should protect against overrunning the array if the NUL terminator is missing. Signed-off-by: Richard Fitzgerald <rf(a)opensource.cirrus.com> Fixes: f6bc909e7673 ("firmware: cs_dsp: add driver to support firmware loading on Cirrus Logic DSPs") Link: https://patch.msgid.link/20240708144855.385332-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflicts: drivers/firmware/cirrus/cs_dsp.c [Due to not merge commit 76ea8e13aaefd firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers] Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- drivers/firmware/cirrus/cs_dsp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/firmware/cirrus/cs_dsp.c b/drivers/firmware/cirrus/cs_dsp.c index 79d4254d1f9b..fe0fb7d635f0 100644 --- a/drivers/firmware/cirrus/cs_dsp.c +++ b/drivers/firmware/cirrus/cs_dsp.c @@ -1109,7 +1109,7 @@ static inline void cs_dsp_coeff_parse_alg(struct cs_dsp *dsp, const u8 **data, blk->id = le32_to_cpu(raw->id); blk->name = raw->name; - blk->name_len = strlen(raw->name); + blk->name_len = strnlen(raw->name, ARRAY_SIZE(raw->name)); blk->ncoeff = le32_to_cpu(raw->ncoeff); break; default: @@ -1142,7 +1142,7 @@ static inline void cs_dsp_coeff_parse_coeff(struct cs_dsp *dsp, const u8 **data, blk->offset = le16_to_cpu(raw->hdr.offset); blk->mem_type = le16_to_cpu(raw->hdr.type); blk->name = raw->name; - blk->name_len = strlen(raw->name); + blk->name_len = strnlen(raw->name, ARRAY_SIZE(raw->name)); blk->ctl_type = le16_to_cpu(raw->ctl_type); blk->flags = le16_to_cpu(raw->flags); blk->len = le32_to_cpu(raw->len); -- 2.34.1

2 1

[PATCH] iommu/arm-smmu-v3: Fix the compile warning
by Zhang Zekun 30 Jul '24

30 Jul '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAGJ97 --------------------------------------- Fix the following compile warning: WARNING: modpost: vmlinux.o(.text+0x854620): ... The function arm_smmu_device_probe() references the variable __initdata arm_smmu_v3_plat_info. This is often because arm_smmu_device_probe lacks a __initdata annotation or the annotation of arm_smmu_v3_plat_info is wrong. Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c index c5c25be54fd5..cedc1eda7250 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c @@ -5244,7 +5244,7 @@ static int arm_smmu_device_hw_probe(struct arm_smmu_device *smmu) } #ifdef CONFIG_ACPI -static struct acpi_platform_list arm_smmu_v3_plat_info[] __initdata = { +static struct acpi_platform_list arm_smmu_v3_plat_info[] = { /* HiSilicon Hip09 Platform */ {"HISI ", "HIP09 ", 0, ACPI_SIG_IORT, greater_than_or_equal, "Erratum #162100602", 0}, -- 2.17.1

1 0

[PATCH openEuler-1.0-LTS 0/2] Fix CVE-2024-41069
by Zheng Yejian 30 Jul '24

30 Jul '24

Amadeusz Sławiński (2): ASoC: topology: Fix references to freed memory ASoC: topology: Fix route memory corruption sound/soc/soc-topology.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6 0/1] kvm : add coda feature
by l00500167 30 Jul '24

30 Jul '24

From: JunBin Li <lijunbin4(a)huawei.com> virtCCA feature JunBin Li (1): kvm: add coda feature Signed-off-by: JunBin Li <lijunbin4(a)huawei.com> drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 14 ++++++++++++++ 1 file changed, 14 insertions(+) -- 2.25.1

2 2

[PTACH OLK-6.6 0/4] ext4: improve buffered write with more than one blocks_per_folio part 2
by Zhang Yi 30 Jul '24

30 Jul '24

Drop unnecessary state_lock in ifs, which could improve some (~10%) buffer write performance. I tested it through UnixBench on my x86 and arm64 virtual machine with 50GB ramdisk & xfs filesystem, the results shows below. 1. UnixBench Test on xfs: ./Run -i 1 -c 1 fstime-w Before: x86 File Write 1024 bufsize 2000 maxblocks 524708.0 KBps arm64 File Write 1024 bufsize 2000 maxblocks 801965.0 KBps After: x86 File Write 1024 bufsize 2000 maxblocks 571315.0 KBps arm64 File Write 1024 bufsize 2000 maxblocks 876077.0 KBps 2. Libmacro test in ext4: Before: Running: pwrite_u1k# bin/pwrite -E -C 200 -L -S -W -N pwrite_u1k -s 1k -I 500 -f /var/tmp/libmicro.1240/data prc thr usecs/call samples errors cnt/samp size pwrite_u1k 1 1 0.86016 167 0 200 1024 After: Running: pwrite_u1k# bin/pwrite -E -C 200 -L -S -W -N pwrite_u1k -s 1k -I 500 -f /var/tmp/libmicro.1957/data prc thr usecs/call samples errors cnt/samp size pwrite_u1k 1 1 0.7699 190 0 200 1024 Thanks, Yi. Matthew Wilcox (Oracle) (2): iomap: hold state_lock over call to ifs_set_range_uptodate() iomap: protect read_bytes_pending with the state_lock Zhang Yi (2): iomap: drop unnecessary state_lock when setting ifs uptodate bits iomap: drop unnecessary state_lock when changing ifs dirty bits fs/iomap/buffered-io.c | 73 +++++++++++++++++++++++++----------------- 1 file changed, 43 insertions(+), 30 deletions(-) -- 2.39.2

1 4