- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] net: nexthop: Initialize all fields in dumped nexthops
by Zhengchao Shao 19 Aug '24

19 Aug '24

From: Petr Machata <petrm(a)nvidia.com> stable inclusion from stable-v5.10.224 commit 5cc4d71dda2dd4f1520f40e634a527022e48ccd8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKPWF CVE: CVE-2024-42283 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit 6d745cd0e9720282cd291d36b9db528aea18add2 ] struct nexthop_grp contains two reserved fields that are not initialized by nla_put_nh_group(), and carry garbage. This can be observed e.g. with strace (edited for clarity): # ip nexthop add id 1 dev lo # ip nexthop add id 101 group 1 # strace -e recvmsg ip nexthop get id 101 ... recvmsg(... [{nla_len=12, nla_type=NHA_GROUP}, [{id=1, weight=0, resvd1=0x69, resvd2=0x67}]] ...) = 52 The fields are reserved and therefore not currently used. But as they are, they leak kernel memory, and the fact they are not just zero complicates repurposing of the fields for new ends. Initialize the full structure. Fixes: 430a049190de ("nexthop: Add support for nexthop groups") Signed-off-by: Petr Machata <petrm(a)nvidia.com> Reviewed-by: Ido Schimmel <idosch(a)nvidia.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/ipv4/nexthop.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/net/ipv4/nexthop.c b/net/ipv4/nexthop.c index 7a0102a4b1de..a508fd94b8be 100644 --- a/net/ipv4/nexthop.c +++ b/net/ipv4/nexthop.c @@ -210,9 +210,10 @@ static int nla_put_nh_group(struct sk_buff *skb, struct nh_group *nhg) p = nla_data(nla); for (i = 0; i < nhg->num_nh; ++i) { - p->id = nhg->nh_entries[i].nh->id; - p->weight = nhg->nh_entries[i].weight - 1; - p += 1; + *p++ = (struct nexthop_grp) { + .id = nhg->nh_entries[i].nh->id, + .weight = nhg->nh_entries[i].weight - 1, + }; } return 0; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes
by Liu Chuang 19 Aug '24

19 Aug '24

From: Ma Ke <make24(a)iscas.ac.cn> mainline inclusion from mainline-v6.11-rc1 commit cb520c3f366c77e8d69e4e2e2781a8ce48d98e79 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKPXH CVE: CVE-2024-42310 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- In cdv_intel_lvds_get_modes(), the return value of drm_mode_duplicate() is assigned to mode, which will lead to a NULL pointer dereference on failure of drm_mode_duplicate(). Add a check to avoid npd. Cc: stable(a)vger.kernel.org Fixes: 6a227d5fd6c4 ("gma500: Add support for Cedarview") Signed-off-by: Ma Ke <make24(a)iscas.ac.cn> Signed-off-by: Patrik Jakobsson <patrik.r.jakobsson(a)gmail.com> Link: https://patchwork.freedesktop.org/patch/msgid/20240709113311.37168-1-make24… Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- drivers/gpu/drm/gma500/cdv_intel_lvds.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/gma500/cdv_intel_lvds.c b/drivers/gpu/drm/gma500/cdv_intel_lvds.c index 9c8446184b17..4f96cd10971f 100644 --- a/drivers/gpu/drm/gma500/cdv_intel_lvds.c +++ b/drivers/gpu/drm/gma500/cdv_intel_lvds.c @@ -404,6 +404,9 @@ static int cdv_intel_lvds_get_modes(struct drm_connector *connector) if (mode_dev->panel_fixed_mode != NULL) { struct drm_display_mode *mode = drm_mode_duplicate(dev, mode_dev->panel_fixed_mode); + if (!mode) + return 0; + drm_mode_probed_add(connector, mode); return 1; } -- 2.34.1

2 1

[PATCH v4 OLK-5.10 0/5] Some clean up and bugfix for hisi_hbmdev
by Zhang Zekun 19 Aug '24

19 Aug '24

Remove the acls and memory topo support in hisi_hbmdev. Set demand offlne in the sysfs. v2: The "state" sysfs interface is duplicated with "status" interface, so remove the redundant one. The "hbm_memory" sysfs interface is unused because the acls and memory topology features has been removed. v3 & v4: Fix commit message warning. Zhang Zekun (5): Revert "soc: hisilicon: hisi_hbmdev: Add hbm acls repair and query methods" Revert "soc: hisilicon: hisi_hbmdev: Provide extra memory topology information" soc: hisilicon: Setting the demand_offline in sysfs interface soc/hisilicon: Clean the hbmcache state show sysfs soc/hisilicon: Remove the memdev kobj drivers/soc/hisilicon/Kconfig | 20 +- drivers/soc/hisilicon/hisi_hbmcache.c | 20 +- drivers/soc/hisilicon/hisi_hbmdev.c | 286 ++++---------------------- 3 files changed, 41 insertions(+), 285 deletions(-) -- 2.17.1

2 6

[PATCH v3 OLK-5.10 0/5] Some clean up and bugfix for hisi_hbmdev
by Zhang Zekun 19 Aug '24

19 Aug '24

Remove the acls and memory topo support in hisi_hbmdev. Set demand offlne in the sysfs. v2: The "state" sysfs interface is duplicated with "status" interface, so remove the redundant one. The "hbm_memory" sysfs interface is unused because the acls and memory topology features has been removed. v3: Fix commit message warning. Zhang Zekun (5): Revert "soc: hisilicon: hisi_hbmdev: Add hbm acls repair and query methods" Revert "soc: hisilicon: hisi_hbmdev: Provide extra memory topology information" soc: hisilicon: Setting the demand_offline in sysfs interface soc/hisilicon: Clean the hbmcache state show sysfs soc/hisilicon: Remove the memdev kobj drivers/soc/hisilicon/Kconfig | 20 +- drivers/soc/hisilicon/hisi_hbmcache.c | 20 +- drivers/soc/hisilicon/hisi_hbmdev.c | 286 ++++---------------------- 3 files changed, 41 insertions(+), 285 deletions(-) -- 2.17.1

2 6

[PATCH v2 OLK-5.10 0/5] Some clean up and bugfix for
by Zhang Zekun 19 Aug '24

19 Aug '24

Remove the acls and memory topo support in hisi_hbmdev. Set demand offlne in the sysfs. v2: The "state" sysfs interface is duplicated with "status" interface, so remove the redundant one. The "hbm_memory" sysfs interface is unused because the acls and memory topology features has been removed. Zhang Zekun (5): Revert "soc: hisilicon: hisi_hbmdev: Add hbm acls repair and query methods" Revert "soc: hisilicon: hisi_hbmdev: Provide extra memory topology information" soc: hisilicon: Setting the demand_offline in sysfs interface soc/hisilicon: Clean the hbmcache state show sysfs soc/hisilicon: Remove the memdev kobj drivers/soc/hisilicon/Kconfig | 20 +- drivers/soc/hisilicon/hisi_hbmcache.c | 20 +- drivers/soc/hisilicon/hisi_hbmdev.c | 286 ++++---------------------- 3 files changed, 41 insertions(+), 285 deletions(-) -- 2.17.1

2 6

[PATCH openEuler-22.03-LTS-SP1 v2 0/2] xfs: fix file creation
by Long Li 19 Aug '24

19 Aug '24

This patch set fix file create fail when get wrong longest extent. Zizhi Wo (2): xfs: Fix file creation failure xfs: Fix agf_longest update error fs/xfs/libxfs/xfs_alloc.c | 14 ++++++++++++++ fs/xfs/libxfs/xfs_alloc_btree.c | 13 ++++++++++--- fs/xfs/libxfs/xfs_btree.h | 1 + 3 files changed, 25 insertions(+), 3 deletions(-) -- 2.39.2

2 3

[PATCH openEuler-22.03-LTS-SP1] filelock: Correct the file lock owner in fcntl_setlk64
by Long Li 19 Aug '24

19 Aug '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAKLNT CVE: NA -------------------------------- The locks_remove_posix() function is designed to reliably remove locks when an fcntl/close race is detected. However, it was passing in the wrong filelock owner, resulting in a failure to remove locks. More critically, if the lock removal fails, it could lead to a uaf issue while traversing the locks. Fixes: d985fcea5d18 ("filelock: Fix fcntl/close race recovery compat path") Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/locks.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/locks.c b/fs/locks.c index 6bd1fbe42ada..44b5ea4f3c6c 100644 --- a/fs/locks.c +++ b/fs/locks.c @@ -2676,7 +2676,7 @@ int fcntl_setlk64(unsigned int fd, struct file *filp, unsigned int cmd, f = fcheck(fd); spin_unlock(&current->files->file_lock); if (f != filp) { - locks_remove_posix(filp, &current->files); + locks_remove_posix(filp, current->files); error = -EBADF; } } -- 2.39.2

2 1

[PATCH OLK-5.10] filelock: Correct the file lock owner in fcntl_setlk64
by Long Li 19 Aug '24

19 Aug '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAKLNT CVE: NA -------------------------------- The locks_remove_posix() function is designed to reliably remove locks when an fcntl/close race is detected. However, it was passing in the wrong filelock owner, resulting in a failure to remove locks. More critically, if the lock removal fails, it could lead to a uaf issue while traversing the locks. Fixes: dfbebb5dc268 ("filelock: Fix fcntl/close race recovery compat path") Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/locks.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/locks.c b/fs/locks.c index 5549b5a54ffd..d06e4b8e7ee6 100644 --- a/fs/locks.c +++ b/fs/locks.c @@ -2676,7 +2676,7 @@ int fcntl_setlk64(unsigned int fd, struct file *filp, unsigned int cmd, f = fcheck(fd); spin_unlock(&current->files->file_lock); if (f != filp) { - locks_remove_posix(filp, &current->files); + locks_remove_posix(filp, current->files); error = -EBADF; } } -- 2.39.2

2 1

[PATCH openEuler-22.03-LTS-SP1 0/1] CVE-2023-52868
by Chen Ridong 19 Aug '24

19 Aug '24

CVE-2023-52868 Dan Carpenter (1): thermal: core: prevent potential string overflow drivers/thermal/thermal_core.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) -- 2.34.1

2 2

[openeuler:OLK-5.10] BUILD SUCCESS 9560420db0a5ba1e83686f1520af94df952d515a
by kernel test robot 19 Aug '24

19 Aug '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 9560420db0a5ba1e83686f1520af94df952d515a !10745 jfs: xattr: fix buffer overflow for invalid xattr elapsed time: 725m configs tested: 35 configs skipped: 139 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 defconfig gcc-14.1.0 arm64 randconfig-001-20240818 gcc-14.1.0 arm64 randconfig-002-20240818 gcc-14.1.0 arm64 randconfig-003-20240818 gcc-14.1.0 arm64 randconfig-004-20240818 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240818 clang-18 x86_64 buildonly-randconfig-002-20240818 gcc-12 x86_64 buildonly-randconfig-003-20240818 clang-18 x86_64 buildonly-randconfig-004-20240818 gcc-12 x86_64 buildonly-randconfig-005-20240818 gcc-12 x86_64 buildonly-randconfig-006-20240818 gcc-12 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240818 clang-18 x86_64 randconfig-002-20240818 gcc-12 x86_64 randconfig-003-20240818 gcc-12 x86_64 randconfig-004-20240818 clang-18 x86_64 randconfig-005-20240818 gcc-12 x86_64 randconfig-006-20240818 clang-18 x86_64 randconfig-011-20240818 clang-18 x86_64 randconfig-012-20240818 clang-18 x86_64 randconfig-013-20240818 clang-18 x86_64 randconfig-014-20240818 clang-18 x86_64 randconfig-015-20240818 clang-18 x86_64 randconfig-016-20240818 gcc-12 x86_64 randconfig-071-20240818 clang-18 x86_64 randconfig-072-20240818 clang-18 x86_64 randconfig-073-20240818 clang-18 x86_64 randconfig-074-20240818 clang-18 x86_64 randconfig-075-20240818 gcc-12 x86_64 randconfig-076-20240818 clang-18 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0