- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] HID: core: Sanitize event code and type when mapping input
by Yang Yingliang 08 Jan '21

08 Jan '21

From: Marc Zyngier <maz(a)kernel.org> stable inclusion from linux-4.19.144 commit a47b8511d90528c77346597e2012100dfc28cd8c CVE: CVE-2020-0465 -------------------------------- commit 35556bed836f8dc07ac55f69c8d17dce3e7f0e25 upstream. When calling into hid_map_usage(), the passed event code is blindly stored as is, even if it doesn't fit in the associated bitmap. This event code can come from a variety of sources, including devices masquerading as input devices, only a bit more "programmable". Instead of taking the event code at face value, check that it actually fits the corresponding bitmap, and if it doesn't: - spit out a warning so that we know which device is acting up - NULLify the bitmap pointer so that we catch unexpected uses Code paths that can make use of untrusted inputs can now check that the mapping was indeed correct and bail out if not. Cc: stable(a)vger.kernel.org Signed-off-by: Marc Zyngier <maz(a)kernel.org> Signed-off-by: Benjamin Tissoires <benjamin.tissoires(a)gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/hid/hid-input.c | 4 ++++ drivers/hid/hid-multitouch.c | 2 ++ include/linux/hid.h | 42 +++++++++++++++++++++++++----------- 3 files changed, 35 insertions(+), 13 deletions(-) diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c index dbb0cbe65fc9..0062b37ef98f 100644 --- a/drivers/hid/hid-input.c +++ b/drivers/hid/hid-input.c @@ -1125,6 +1125,10 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel } mapped: + /* Mapping failed, bail out */ + if (!bit) + return; + if (device->driver->input_mapped && device->driver->input_mapped(device, hidinput, field, usage, &bit, &max) < 0) { diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c index f9167d0e095c..dfb2548e0052 100644 --- a/drivers/hid/hid-multitouch.c +++ b/drivers/hid/hid-multitouch.c @@ -841,6 +841,8 @@ static int mt_touch_input_mapping(struct hid_device *hdev, struct hid_input *hi, code = BTN_0 + ((usage->hid - 1) & HID_USAGE); hid_map_usage(hi, usage, bit, max, EV_KEY, code); + if (!*bit) + return -1; input_set_capability(hi->input, EV_KEY, code); return 1; diff --git a/include/linux/hid.h b/include/linux/hid.h index 8b3e5e8a72fb..bbbe6c0e0e26 100644 --- a/include/linux/hid.h +++ b/include/linux/hid.h @@ -956,34 +956,49 @@ static inline void hid_device_io_stop(struct hid_device *hid) { * @max: maximal valid usage->code to consider later (out parameter) * @type: input event type (EV_KEY, EV_REL, ...) * @c: code which corresponds to this usage and type + * + * The value pointed to by @bit will be set to NULL if either @type is + * an unhandled event type, or if @c is out of range for @type. This + * can be used as an error condition. */ static inline void hid_map_usage(struct hid_input *hidinput, struct hid_usage *usage, unsigned long **bit, int *max, - __u8 type, __u16 c) + __u8 type, unsigned int c) { struct input_dev *input = hidinput->input; - - usage->type = type; - usage->code = c; + unsigned long *bmap = NULL; + unsigned int limit = 0; switch (type) { case EV_ABS: - *bit = input->absbit; - *max = ABS_MAX; + bmap = input->absbit; + limit = ABS_MAX; break; case EV_REL: - *bit = input->relbit; - *max = REL_MAX; + bmap = input->relbit; + limit = REL_MAX; break; case EV_KEY: - *bit = input->keybit; - *max = KEY_MAX; + bmap = input->keybit; + limit = KEY_MAX; break; case EV_LED: - *bit = input->ledbit; - *max = LED_MAX; + bmap = input->ledbit; + limit = LED_MAX; break; } + + if (unlikely(c > limit || !bmap)) { + pr_warn_ratelimited("%s: Invalid code %d type %d\n", + input->name, c, type); + *bit = NULL; + return; + } + + usage->type = type; + usage->code = c; + *max = limit; + *bit = bmap; } /** @@ -997,7 +1012,8 @@ static inline void hid_map_usage_clear(struct hid_input *hidinput, __u8 type, __u16 c) { hid_map_usage(hidinput, usage, bit, max, type, c); - clear_bit(c, *bit); + if (*bit) + clear_bit(usage->code, *bit); } /** -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] cfg80211: add missing policy for NL80211_ATTR_STATUS_CODE
by Yang Yingliang 08 Jan '21

08 Jan '21

From: Sergey Matyukevich <sergey.matyukevich.os(a)quantenna.com> stable inclusion from linux-4.19.108 commit 0fb31bd53a5e27394916758173eb748c5e0dbd47 CVE: CVE-2020-27068 -------------------------------- [ Upstream commit ea75080110a4c1fa011b0a73cb8f42227143ee3e ] The nl80211_policy is missing for NL80211_ATTR_STATUS_CODE attribute. As a result, for strictly validated commands, it's assumed to not be supported. Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os(a)quantenna.com> Link: https://lore.kernel.org/r/20200213131608.10541-2-sergey.matyukevich.os@quan… Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- net/wireless/nl80211.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index 5075fd293feb..de9580f13914 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -323,6 +323,7 @@ static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = { [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG }, [NL80211_ATTR_CONTROL_PORT_OVER_NL80211] = { .type = NLA_FLAG }, [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG }, + [NL80211_ATTR_STATUS_CODE] = { .type = NLA_U16 }, [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 }, [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 }, [NL80211_ATTR_PID] = { .type = NLA_U32 }, -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] speakup: Reject setting the speakup line discipline outside of speakup
by Yang Yingliang 08 Jan '21

08 Jan '21

From: Samuel Thibault <samuel.thibault(a)ens-lyon.org> mainline inclusion from mainline-v5.10-rc7 commit f0992098cadb4c9c6a00703b66cafe604e178fea category: bugfix bugzilla: NA CVE: CVE-2020-27830 -------------------------------- Speakup exposing a line discipline allows userland to try to use it, while it is deemed to be useless, and thus uselessly exposes potential bugs. One of them is simply that in such a case if the line sends data, spk_ttyio_receive_buf2 is called and crashes since spk_ttyio_synth is NULL. This change restricts the use of the speakup line discipline to speakup drivers, thus avoiding such kind of issues altogether. Cc: stable(a)vger.kernel.org Reported-by: Shisong Qin <qinshisong1205(a)gmail.com> Signed-off-by: Samuel Thibault <samuel.thibault(a)ens-lyon.org> Tested-by: Shisong Qin <qinshisong1205(a)gmail.com> Link: https://lore.kernel.org/r/20201129193523.hm3f6n5xrn6fiyyc@function Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/accessibility/speakup/spk_ttyio.c [yyl: spk_ttyio.c is in drivers/staging/speakup/ in kernel-4.19] Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/staging/speakup/spk_ttyio.c | 36 ++++++++++++++++++----------- 1 file changed, 23 insertions(+), 13 deletions(-) diff --git a/drivers/staging/speakup/spk_ttyio.c b/drivers/staging/speakup/spk_ttyio.c index 6c754ddf1257..8bc7db55daeb 100644 --- a/drivers/staging/speakup/spk_ttyio.c +++ b/drivers/staging/speakup/spk_ttyio.c @@ -47,27 +47,21 @@ static int spk_ttyio_ldisc_open(struct tty_struct *tty) { struct spk_ldisc_data *ldisc_data; + if (tty != speakup_tty) + /* Somebody tried to use this line discipline outside speakup */ + return -ENODEV; + if (tty->ops->write == NULL) return -EOPNOTSUPP; - mutex_lock(&speakup_tty_mutex); - if (speakup_tty) { - mutex_unlock(&speakup_tty_mutex); - return -EBUSY; - } - speakup_tty = tty; ldisc_data = kmalloc(sizeof(struct spk_ldisc_data), GFP_KERNEL); - if (!ldisc_data) { - speakup_tty = NULL; - mutex_unlock(&speakup_tty_mutex); + if (!ldisc_data) return -ENOMEM; - } sema_init(&ldisc_data->sem, 0); ldisc_data->buf_free = true; - speakup_tty->disc_data = ldisc_data; - mutex_unlock(&speakup_tty_mutex); + tty->disc_data = ldisc_data; return 0; } @@ -187,9 +181,25 @@ static int spk_ttyio_initialise_ldisc(struct spk_synth *synth) tty_unlock(tty); + mutex_lock(&speakup_tty_mutex); + speakup_tty = tty; ret = tty_set_ldisc(tty, N_SPEAKUP); if (ret) - pr_err("speakup: Failed to set N_SPEAKUP on tty\n"); + speakup_tty = NULL; + mutex_unlock(&speakup_tty_mutex); + + if (!ret) + /* Success */ + return 0; + + pr_err("speakup: Failed to set N_SPEAKUP on tty\n"); + + tty_lock(tty); + if (tty->ops->close) + tty->ops->close(tty, NULL); + tty_unlock(tty); + + tty_kclose(tty); return ret; } -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 1/2] tty: Fix ->pgrp locking in tiocspgrp()
by Yang Yingliang 08 Jan '21

08 Jan '21

From: Jann Horn <jannh(a)google.com> mainline inclusion from mainline-v5.10-rc7 commit 54ffccbf053b5b6ca4f6e45094b942fab92a25fc category: bugfix bugzilla: NA CVE: CVE-2020-29661 -------------------------------- tiocspgrp() takes two tty_struct pointers: One to the tty that userspace passed to ioctl() (`tty`) and one to the TTY being changed (`real_tty`). These pointers are different when ioctl() is called with a master fd. To properly lock real_tty->pgrp, we must take real_tty->ctrl_lock. This bug makes it possible for racing ioctl(TIOCSPGRP, ...) calls on both sides of a PTY pair to corrupt the refcount of `struct pid`, leading to use-after-free errors. Fixes: 47f86834bbd4 ("redo locking of tty->pgrp") CC: stable(a)kernel.org Signed-off-by: Jann Horn <jannh(a)google.com> Reviewed-by: Jiri Slaby <jirislaby(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/tty/tty_jobctrl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/tty/tty_jobctrl.c b/drivers/tty/tty_jobctrl.c index c4ecd66fafef..a42dec3c95d0 100644 --- a/drivers/tty/tty_jobctrl.c +++ b/drivers/tty/tty_jobctrl.c @@ -494,10 +494,10 @@ static int tiocspgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t if (session_of_pgrp(pgrp) != task_session(current)) goto out_unlock; retval = 0; - spin_lock_irq(&tty->ctrl_lock); + spin_lock_irq(&real_tty->ctrl_lock); put_pid(real_tty->pgrp); real_tty->pgrp = get_pid(pgrp); - spin_unlock_irq(&tty->ctrl_lock); + spin_unlock_irq(&real_tty->ctrl_lock); out_unlock: rcu_read_unlock(); return retval; -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS] ALSA: rawmidi: Fix racy buffer resize under concurrent accesses
by Yang Yingliang 08 Jan '21

08 Jan '21

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from linux-4.19.124 commit a507658fdb2ad8ca282b0eb42f2a40b805deb1e6 CVE: CVE-2020-27786 -------------------------------- commit c1f6e3c818dd734c30f6a7eeebf232ba2cf3181d upstream. The rawmidi core allows user to resize the runtime buffer via ioctl, and this may lead to UAF when performed during concurrent reads or writes: the read/write functions unlock the runtime lock temporarily during copying form/to user-space, and that's the race window. This patch fixes the hole by introducing a reference counter for the runtime buffer read/write access and returns -EBUSY error when the resize is performed concurrently against read/write. Note that the ref count field is a simple integer instead of refcount_t here, since the all contexts accessing the buffer is basically protected with a spinlock, hence we need no expensive atomic ops. Also, note that this busy check is needed only against read / write functions, and not in receive/transmit callbacks; the race can happen only at the spinlock hole mentioned in the above, while the whole function is protected for receive / transmit callbacks. Reported-by: butt3rflyh4ck <butterflyhuangxx(a)gmail.com> Cc: <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/CAFcO6XMWpUVK_yzzCpp8_XP7+=oUpQvuBeCbMffEDkpe8jWr… Link: https://lore.kernel.org/r/s5heerw3r5z.wl-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- include/sound/rawmidi.h | 1 + sound/core/rawmidi.c | 31 +++++++++++++++++++++++++++---- 2 files changed, 28 insertions(+), 4 deletions(-) diff --git a/include/sound/rawmidi.h b/include/sound/rawmidi.h index 6665cb29e1a2..7a908a81cef4 100644 --- a/include/sound/rawmidi.h +++ b/include/sound/rawmidi.h @@ -76,6 +76,7 @@ struct snd_rawmidi_runtime { size_t avail_min; /* min avail for wakeup */ size_t avail; /* max used buffer for wakeup */ size_t xruns; /* over/underruns counter */ + int buffer_ref; /* buffer reference count */ /* misc */ spinlock_t lock; wait_queue_head_t sleep; diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c index a52d6d16efc4..9b26973fe697 100644 --- a/sound/core/rawmidi.c +++ b/sound/core/rawmidi.c @@ -112,6 +112,17 @@ static void snd_rawmidi_input_event_work(struct work_struct *work) runtime->event(runtime->substream); } +/* buffer refcount management: call with runtime->lock held */ +static inline void snd_rawmidi_buffer_ref(struct snd_rawmidi_runtime *runtime) +{ + runtime->buffer_ref++; +} + +static inline void snd_rawmidi_buffer_unref(struct snd_rawmidi_runtime *runtime) +{ + runtime->buffer_ref--; +} + static int snd_rawmidi_runtime_create(struct snd_rawmidi_substream *substream) { struct snd_rawmidi_runtime *runtime; @@ -661,6 +672,11 @@ static int resize_runtime_buffer(struct snd_rawmidi_runtime *runtime, if (!newbuf) return -ENOMEM; spin_lock_irq(&runtime->lock); + if (runtime->buffer_ref) { + spin_unlock_irq(&runtime->lock); + kvfree(newbuf); + return -EBUSY; + } oldbuf = runtime->buffer; runtime->buffer = newbuf; runtime->buffer_size = params->buffer_size; @@ -960,8 +976,10 @@ static long snd_rawmidi_kernel_read1(struct snd_rawmidi_substream *substream, long result = 0, count1; struct snd_rawmidi_runtime *runtime = substream->runtime; unsigned long appl_ptr; + int err = 0; spin_lock_irqsave(&runtime->lock, flags); + snd_rawmidi_buffer_ref(runtime); while (count > 0 && runtime->avail) { count1 = runtime->buffer_size - runtime->appl_ptr; if (count1 > count) @@ -980,16 +998,19 @@ static long snd_rawmidi_kernel_read1(struct snd_rawmidi_substream *substream, if (userbuf) { spin_unlock_irqrestore(&runtime->lock, flags); if (copy_to_user(userbuf + result, - runtime->buffer + appl_ptr, count1)) { - return result > 0 ? result : -EFAULT; - } + runtime->buffer + appl_ptr, count1)) + err = -EFAULT; spin_lock_irqsave(&runtime->lock, flags); + if (err) + goto out; } result += count1; count -= count1; } + out: + snd_rawmidi_buffer_unref(runtime); spin_unlock_irqrestore(&runtime->lock, flags); - return result; + return result > 0 ? result : err; } long snd_rawmidi_kernel_read(struct snd_rawmidi_substream *substream, @@ -1261,6 +1282,7 @@ static long snd_rawmidi_kernel_write1(struct snd_rawmidi_substream *substream, return -EAGAIN; } } + snd_rawmidi_buffer_ref(runtime); while (count > 0 && runtime->avail > 0) { count1 = runtime->buffer_size - runtime->appl_ptr; if (count1 > count) @@ -1292,6 +1314,7 @@ static long snd_rawmidi_kernel_write1(struct snd_rawmidi_substream *substream, } __end: count1 = runtime->avail < runtime->buffer_size; + snd_rawmidi_buffer_unref(runtime); spin_unlock_irqrestore(&runtime->lock, flags); if (count1) snd_rawmidi_output_trigger(substream, 1); -- 2.25.1

1 0

[PATCH kernel-4.19 1/5] Kconfig: disable KTASK by default
by Yang Yingliang 08 Jan '21

08 Jan '21

hulk inclusion category: bugfix bugzilla: 46923 CVE: NA ---------------------------------------------- Enable KTASK in vfio, if the BAR size of some straight through equipment device is too large, it will cause guest crash on booting. Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Xie XiuQi <xiexiuqi(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- init/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/init/Kconfig b/init/Kconfig index 6880b55901bb..71b09d998413 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -352,7 +352,7 @@ config AUDIT_TREE config KTASK bool "Multithread CPU-intensive kernel work" depends on SMP - default y + default n help Parallelize CPU-intensive kernel work. This feature is designed for big machines that can take advantage of their extra CPUs to speed up -- 2.25.1

1 4

[PATCH kernel-4.19 01/33] irqchip/gic-v3: Fix compiling error on ARM32 with GICv3
by Yang Yingliang 08 Jan '21

08 Jan '21

From: Wei Li <liwei391(a)huawei.com> hulk inclusion category: bugfix bugzilla: NA CVE: NA ---------------------------------------------- /builds/1mHAjaH6WFVPAq6OVOJsJsJKHA2/drivers/irqchip/irq-gic-v3.c: In function 'gic_cpu_init': /builds/1mHAjaH6WFVPAq6OVOJsJsJKHA2/drivers/irqchip/irq-gic-v3.c:888:3: error: implicit declaration of function 'ipi_set_nmi_prio' [-Werror=implicit-function-declaration] 888 | ipi_set_nmi_prio(rbase, GICD_INT_NMI_PRI); | ^~~~~~~~~~~~~~~~ On ARM32, ipi_set_nmi_prio() is not implmented as CONFIG_ARM64_PSEUDO_NMI is not supported. Skip setting the NMI priority of SGIs when initializing. Signed-off-by: Wei Li <liwei391(a)huawei.com> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/irqchip/irq-gic-v3.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c index 6bb787ba1764..14e9c1a5627b 100644 --- a/drivers/irqchip/irq-gic-v3.c +++ b/drivers/irqchip/irq-gic-v3.c @@ -884,8 +884,10 @@ static void gic_cpu_init(void) gic_cpu_config(rbase, gic_redist_wait_for_rwp); +#ifdef CONFIG_ARM64_PSEUDO_NMI if (gic_supports_nmi()) ipi_set_nmi_prio(rbase, GICD_INT_NMI_PRI); +#endif /* initialise system registers */ gic_cpu_sys_reg_init(); -- 2.25.1

1 32

[PATCH kernel-4.19 00/30] backport stable-4.19.165
by Yang Yingliang 08 Jan '21

08 Jan '21

Anant Thazhemadam (2): Bluetooth: hci_h5: close serdev device and free hu in h5_close misc: vmw_vmci: fix kernel info-leak by initializing dbells in vmci_ctx_get_chkpt_doorbells() Boqun Feng (1): fcntl: Fix potential deadlock in send_sig{io, urg}() Christophe Leroy (1): powerpc/bitops: Fix possible undefined behaviour with fls() and fls64() Damien Le Moal (1): null_blk: Fix zone size initialization Dinghao Liu (1): rtc: sun6i: Fix memleak in sun6i_rtc_clk_init Eric Auger (1): vfio/pci: Move dummy_resources_list init in vfio_pci_probe() Eric Biggers (4): fscrypt: add fscrypt_is_nokey_name() ext4: prevent creating duplicate encrypted filenames f2fs: prevent creating duplicate encrypted filenames ubifs: prevent creating duplicate encrypted filenames Greg Kroah-Hartman (1): Linux 4.19.165 Hyeongseok Kim (1): dm verity: skip verity work if I/O error when system is shutting down Jan Kara (2): ext4: don't remount read-only with errors=continue on reboot quota: Don't overflow quota file offsets Jessica Yu (1): module: delay kobject uevent until after module init call Johan Hovold (1): of: fix linker-section match-table corruption Kevin Vigor (1): md/raid10: initialize r10_bio->read_slot before use. Mauro Carvalho Chehab (1): media: gp8psk: initialize stats at power control logic Miroslav Benes (1): module: set MODULE_STATE_GOING state when a module fails to load Paolo Bonzini (2): KVM: SVM: relax conditions for allowing MSR_IA32_SPEC_CTRL accesses KVM: x86: reinstate vendor-agnostic check on SPEC_CTRL cpuid bits Petr Vorel (1): uapi: move constants from <linux/kernel.h> to <linux/const.h> Qinglang Miao (1): powerpc: sysdev: add missing iounmap() on error in mpic_msgr_probe() Rustam Kovhaev (1): reiserfs: add check for an invalid ih_entry_count Souptick Joarder (1): xen/gntdev.c: Mark pages as dirty Takashi Iwai (3): ALSA: seq: Use bool for snd_seq_queue internal flags ALSA: rawmidi: Access runtime->avail always in spinlock ALSA: pcm: Clear the full allocated memory at hw_params Trond Myklebust (1): NFSv4: Fix a pNFS layout related use-after-free race when freeing the inode Makefile | 2 +- arch/powerpc/include/asm/bitops.h | 23 +++++++++++- arch/powerpc/sysdev/mpic_msgr.c | 2 +- arch/x86/kvm/cpuid.h | 14 +++++++ arch/x86/kvm/svm.c | 9 ++--- arch/x86/kvm/vmx.c | 6 +-- drivers/block/null_blk_zoned.c | 20 ++++++---- drivers/bluetooth/hci_h5.c | 8 +++- drivers/md/dm-verity-target.c | 12 +++++- drivers/md/raid10.c | 3 +- drivers/media/usb/dvb-usb/gp8psk.c | 2 +- drivers/misc/vmw_vmci/vmci_context.c | 2 +- drivers/rtc/rtc-sun6i.c | 8 ++-- drivers/vfio/pci/vfio_pci.c | 3 +- drivers/xen/gntdev.c | 17 ++++++--- fs/crypto/hooks.c | 10 ++--- fs/ext4/namei.c | 3 ++ fs/ext4/super.c | 15 +++----- fs/f2fs/f2fs.h | 2 + fs/fcntl.c | 10 +++-- fs/nfs/nfs4super.c | 2 +- fs/nfs/pnfs.c | 33 ++++++++++++++++- fs/nfs/pnfs.h | 5 +++ fs/quota/quota_tree.c | 8 ++-- fs/reiserfs/stree.c | 6 +++ fs/ubifs/dir.c | 17 +++++++-- include/linux/fscrypt_notsupp.h | 5 +++ include/linux/fscrypt_supp.h | 29 +++++++++++++++ include/linux/of.h | 1 + include/uapi/linux/const.h | 5 +++ include/uapi/linux/ethtool.h | 2 +- include/uapi/linux/kernel.h | 9 +---- include/uapi/linux/lightnvm.h | 2 +- include/uapi/linux/mroute6.h | 2 +- include/uapi/linux/netfilter/x_tables.h | 2 +- include/uapi/linux/netlink.h | 2 +- include/uapi/linux/sysctl.h | 2 +- kernel/module.c | 6 ++- sound/core/pcm_native.c | 9 ++++- sound/core/rawmidi.c | 49 ++++++++++++++++++------- sound/core/seq/seq_queue.h | 8 ++-- 41 files changed, 274 insertions(+), 101 deletions(-) -- 2.25.1

1 30

[PATCH] hifc: remove unnecessary __init specifier
by Zhengyuan Liu 04 Jan '21

04 Jan '21

hulk inclusion category: bugfix bugzilla: NA CVE: NA The specifier of __init added to hrd_flashProbe() isn't appropriate. It can cause following building warning: WARNING: drivers/mtd/hisilicon/sfc/hi-sfc.o(.text.unlikely+0x38c): Section mismatch in reference from the \ function flash_map_init() to the function .init.text:hrd_flashProbe() The function flash_map_init() references the function __init hrd_flashProbe(). This is often because flash_map_init lacks a __init annotation or the annotation of hrd_flashProbe is wrong. Fixes: 25d711e7ffb7 ("drivers: add sfc driver to hulk") Signed-off-by: Zhengyuan Liu <liuzhengyuan(a)tj.kylinos.cn> --- drivers/mtd/hisilicon/sfc/hrd_sfc_driver.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/mtd/hisilicon/sfc/hrd_sfc_driver.c b/drivers/mtd/hisilicon/sfc/hrd_sfc_driver.c index 23254e325a85..69fb1b306f0d 100644 --- a/drivers/mtd/hisilicon/sfc/hrd_sfc_driver.c +++ b/drivers/mtd/hisilicon/sfc/hrd_sfc_driver.c @@ -87,8 +87,8 @@ static int _hrd_flashProbe(const char **mtdDrv, struct map_info *map, return HRD_ERR; } -static int __init hrd_flashProbe(const char **mtdDrv, struct map_info *map, - struct resource *sfc_regres, struct mtd_info **mtd) +static int hrd_flashProbe(const char **mtdDrv, struct map_info *map, + struct resource *sfc_regres, struct mtd_info **mtd) { int ret; -- 2.20.1

3 2

[PATCH kernel-4.19 v2] mmap: fix a compiling error for 'MAP_PA32BIT'
by Bixuan Cui 04 Jan '21

04 Jan '21

From: Zhengyuan Liu <liuzhengyuan(a)tj.kylinos.cn> hulk inclusion category: bugfix bugzilla: NA CVE: NA MAP_PA32BIT was defined in uapi/asm-generic/mman.h, that was not automatically included by mm/mmap.c when building on platforms such as mips, and result in following compiling error: mm/mmap.c: In function ‘do_mmap’: mm/mmap.c:1450:14: error: ‘MAP_PA32BIT’ undeclared (first use in this function); did you mean ‘MAP_32BIT’? if (flags & MAP_PA32BIT) ^~~~~~~~~~~ MAP_32BIT mm/mmap.c:1450:14: note: each undeclared identifier is reported only once for each function it appears in make[1]: *** [scripts/Makefile.build:303: mm/mmap.o] Error 1 Fixes: e138253f2b82 ("svm: add support for allocing memory which is within 4G physical address in svm_mmap") Signed-off-by: Zhengyuan Liu <liuzhengyuan(a)tj.kylinos.cn> Signed-off-by: Bixuan Cui <cuibixuan(a)huawei.com> --- arch/alpha/include/uapi/asm/mman.h | 1 + arch/mips/include/uapi/asm/mman.h | 1 + arch/parisc/include/uapi/asm/mman.h | 1 + arch/powerpc/include/uapi/asm/mman.h | 1 + arch/sparc/include/uapi/asm/mman.h | 1 + arch/xtensa/include/uapi/asm/mman.h | 1 + 6 files changed, 6 insertions(+) diff --git a/arch/alpha/include/uapi/asm/mman.h b/arch/alpha/include/uapi/asm/mman.h index f9d4e6b6d4bd..b3acfc00c8ec 100644 --- a/arch/alpha/include/uapi/asm/mman.h +++ b/arch/alpha/include/uapi/asm/mman.h @@ -33,6 +33,7 @@ #define MAP_STACK 0x80000 /* give out an address that is best suited for process/thread stacks */ #define MAP_HUGETLB 0x100000 /* create a huge page mapping */ #define MAP_FIXED_NOREPLACE 0x200000/* MAP_FIXED which doesn't unmap underlying mapping */ +#define MAP_PA32BIT 0x400000 /* physical address is within 4G */ #define MS_ASYNC 1 /* sync memory asynchronously */ #define MS_SYNC 2 /* synchronous memory sync */ diff --git a/arch/mips/include/uapi/asm/mman.h b/arch/mips/include/uapi/asm/mman.h index 3035ca499cd8..72a00c746e78 100644 --- a/arch/mips/include/uapi/asm/mman.h +++ b/arch/mips/include/uapi/asm/mman.h @@ -51,6 +51,7 @@ #define MAP_STACK 0x40000 /* give out an address that is best suited for process/thread stacks */ #define MAP_HUGETLB 0x80000 /* create a huge page mapping */ #define MAP_FIXED_NOREPLACE 0x100000 /* MAP_FIXED which doesn't unmap underlying mapping */ +#define MAP_PA32BIT 0x400000 /* physical address is within 4G */ /* * Flags for msync diff --git a/arch/parisc/include/uapi/asm/mman.h b/arch/parisc/include/uapi/asm/mman.h index 870fbf8c7088..9e989d649e85 100644 --- a/arch/parisc/include/uapi/asm/mman.h +++ b/arch/parisc/include/uapi/asm/mman.h @@ -27,6 +27,7 @@ #define MAP_STACK 0x40000 /* give out an address that is best suited for process/thread stacks */ #define MAP_HUGETLB 0x80000 /* create a huge page mapping */ #define MAP_FIXED_NOREPLACE 0x100000 /* MAP_FIXED which doesn't unmap underlying mapping */ +#define MAP_PA32BIT 0x400000 /* physical address is within 4G */ #define MS_SYNC 1 /* synchronous memory sync */ #define MS_ASYNC 2 /* sync memory asynchronously */ diff --git a/arch/powerpc/include/uapi/asm/mman.h b/arch/powerpc/include/uapi/asm/mman.h index 65065ce32814..95f884ada96f 100644 --- a/arch/powerpc/include/uapi/asm/mman.h +++ b/arch/powerpc/include/uapi/asm/mman.h @@ -29,6 +29,7 @@ #define MAP_NONBLOCK 0x10000 /* do not block on IO */ #define MAP_STACK 0x20000 /* give out an address that is best suited for process/thread stacks */ #define MAP_HUGETLB 0x40000 /* create a huge page mapping */ +#define MAP_PA32BIT 0x400000 /* physical address is within 4G */ /* Override any generic PKEY permission defines */ #define PKEY_DISABLE_EXECUTE 0x4 diff --git a/arch/sparc/include/uapi/asm/mman.h b/arch/sparc/include/uapi/asm/mman.h index f6f99ec65bb3..0d1881b8f30d 100644 --- a/arch/sparc/include/uapi/asm/mman.h +++ b/arch/sparc/include/uapi/asm/mman.h @@ -26,6 +26,7 @@ #define MAP_NONBLOCK 0x10000 /* do not block on IO */ #define MAP_STACK 0x20000 /* give out an address that is best suited for process/thread stacks */ #define MAP_HUGETLB 0x40000 /* create a huge page mapping */ +#define MAP_PA32BIT 0x400000 /* physical address is within 4G */ #endif /* _UAPI__SPARC_MMAN_H__ */ diff --git a/arch/xtensa/include/uapi/asm/mman.h b/arch/xtensa/include/uapi/asm/mman.h index 58f29a9d895d..f584a590bb00 100644 --- a/arch/xtensa/include/uapi/asm/mman.h +++ b/arch/xtensa/include/uapi/asm/mman.h @@ -58,6 +58,7 @@ #define MAP_STACK 0x40000 /* give out an address that is best suited for process/thread stacks */ #define MAP_HUGETLB 0x80000 /* create a huge page mapping */ #define MAP_FIXED_NOREPLACE 0x100000 /* MAP_FIXED which doesn't unmap underlying mapping */ +#define MAP_PA32BIT 0x400000 /* physical address is within 4G */ #ifdef CONFIG_MMAP_ALLOW_UNINITIALIZED # define MAP_UNINITIALIZED 0x4000000 /* For anonymous mmap, memory could be * uninitialized */ -- 2.17.1

3 2

2025

2024

2023

2022

2021

2020

2019

Kernel