- Kernel - mailweb.openeuler.org

[openeuler:openEuler-1.0-LTS 1297/1297] drivers/watchdog/menz69_wdt.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 22 Nov '24

22 Nov '24

Hi Johannes, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 81e029d5dd0cae934243168eee37ef303ebcce38 commit: 81ceed41d0c2b2c9300de7bc30c1451680257f52 [1297/1297] watchdog: add driver for the MEN 16z069 IP-Core config: x86_64-buildonly-randconfig-004-20241117 (https://download.01.org/0day-ci/archive/20241122/202411220134.YWoog3yH-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241122/202411220134.YWoog3yH-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411220134.YWoog3yH-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/watchdog/menz69_wdt.c:10: include/linux/module.h:138:14: warning: 'cleanup_module' specifies less restrictive attribute than its target 'men_z069_driver_exit': 'cold' [-Wmissing-attributes] 138 | void cleanup_module(void) __attribute__((alias(#exitfn))); | ^~~~~~~~~~~~~~ include/linux/device.h:1558:1: note: in expansion of macro 'module_exit' 1558 | module_exit(__driver##_exit); | ^~~~~~~~~~~ include/linux/mcb.h:126:9: note: in expansion of macro 'module_driver' 126 | module_driver(__mcb_driver, mcb_register_driver, mcb_unregister_driver); | ^~~~~~~~~~~~~ drivers/watchdog/menz69_wdt.c:166:1: note: in expansion of macro 'module_mcb_driver' 166 | module_mcb_driver(men_z069_driver); | ^~~~~~~~~~~~~~~~~ In file included from include/linux/mcb.h:15, from drivers/watchdog/menz69_wdt.c:9: drivers/watchdog/menz69_wdt.c:166:19: note: 'cleanup_module' target declared here 166 | module_mcb_driver(men_z069_driver); | ^~~~~~~~~~~~~~~ include/linux/device.h:1554:20: note: in definition of macro 'module_driver' 1554 | static void __exit __driver##_exit(void) \ | ^~~~~~~~ drivers/watchdog/menz69_wdt.c:166:1: note: in expansion of macro 'module_mcb_driver' 166 | module_mcb_driver(men_z069_driver); | ^~~~~~~~~~~~~~~~~ include/linux/module.h:132:13: warning: 'init_module' specifies less restrictive attribute than its target 'men_z069_driver_init': 'cold' [-Wmissing-attributes] 132 | int init_module(void) __attribute__((alias(#initfn))); | ^~~~~~~~~~~ include/linux/device.h:1553:1: note: in expansion of macro 'module_init' 1553 | module_init(__driver##_init); \ | ^~~~~~~~~~~ include/linux/mcb.h:126:9: note: in expansion of macro 'module_driver' 126 | module_driver(__mcb_driver, mcb_register_driver, mcb_unregister_driver); | ^~~~~~~~~~~~~ drivers/watchdog/menz69_wdt.c:166:1: note: in expansion of macro 'module_mcb_driver' 166 | module_mcb_driver(men_z069_driver); | ^~~~~~~~~~~~~~~~~ drivers/watchdog/menz69_wdt.c:166:19: note: 'init_module' target declared here 166 | module_mcb_driver(men_z069_driver); | ^~~~~~~~~~~~~~~ include/linux/device.h:1549:19: note: in definition of macro 'module_driver' 1549 | static int __init __driver##_init(void) \ | ^~~~~~~~ drivers/watchdog/menz69_wdt.c:166:1: note: in expansion of macro 'module_mcb_driver' 166 | module_mcb_driver(men_z069_driver); | ^~~~~~~~~~~~~~~~~ >> drivers/watchdog/menz69_wdt.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] tpm: Lock TPM chip in tpm_pm_suspend() first
by Chen Zhongjin 21 Nov '24

21 Nov '24

From: Jarkko Sakkinen <jarkko(a)kernel.org> mainline inclusion from mainline-v6.12-rc1 commit 9265fed6db601ee2ec47577815387458ef4f047a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5KRG CVE: CVE-2024-53085 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Setting TPM_CHIP_FLAG_SUSPENDED in the end of tpm_pm_suspend() can be racy according, as this leaves window for tpm_hwrng_read() to be called while the operation is in progress. The recent bug report gives also evidence of this behaviour. Aadress this by locking the TPM chip before checking any chip->flags both in tpm_pm_suspend() and tpm_hwrng_read(). Move TPM_CHIP_FLAG_SUSPENDED check inside tpm_get_random() so that it will be always checked only when the lock is reserved. Cc: stable(a)vger.kernel.org # v6.4+ Fixes: 99d464506255 ("tpm: Prevent hwrng from activating during resume") Reported-by: Mike Seo <mikeseohyungjin(a)gmail.com> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=219383 Reviewed-by: Jerry Snitselaar <jsnitsel(a)redhat.com> Tested-by: Mike Seo <mikeseohyungjin(a)gmail.com> Signed-off-by: Jarkko Sakkinen <jarkko(a)kernel.org> Conflicts: drivers/char/tpm/tpm-interface.c [df745e25098d ("tpm: Lazily flush the auth session") is not merged] Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- drivers/char/tpm/tpm-chip.c | 4 ---- drivers/char/tpm/tpm-interface.c | 28 ++++++++++++++++++++-------- 2 files changed, 20 insertions(+), 12 deletions(-) diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c index 42b1062e33cd5..78999f7f248cb 100644 --- a/drivers/char/tpm/tpm-chip.c +++ b/drivers/char/tpm/tpm-chip.c @@ -519,10 +519,6 @@ static int tpm_hwrng_read(struct hwrng *rng, void *data, size_t max, bool wait) { struct tpm_chip *chip = container_of(rng, struct tpm_chip, hwrng); - /* Give back zero bytes, as TPM chip has not yet fully resumed: */ - if (chip->flags & TPM_CHIP_FLAG_SUSPENDED) - return 0; - return tpm_get_random(chip, data, max); } diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c index 66b16d26eecc7..9789aad5dd0df 100644 --- a/drivers/char/tpm/tpm-interface.c +++ b/drivers/char/tpm/tpm-interface.c @@ -394,6 +394,13 @@ int tpm_pm_suspend(struct device *dev) if (!chip) return -ENODEV; + rc = tpm_try_get_ops(chip); + if (rc) { + /* Can be safely set out of locks, as no action cannot race: */ + chip->flags |= TPM_CHIP_FLAG_SUSPENDED; + goto out; + } + if (chip->flags & TPM_CHIP_FLAG_ALWAYS_POWERED) goto suspended; @@ -401,18 +408,16 @@ int tpm_pm_suspend(struct device *dev) !pm_suspend_via_firmware()) goto suspended; - rc = tpm_try_get_ops(chip); - if (!rc) { - if (chip->flags & TPM_CHIP_FLAG_TPM2) - tpm2_shutdown(chip, TPM2_SU_STATE); - else - rc = tpm1_pm_suspend(chip, tpm_suspend_pcr); - - tpm_put_ops(chip); + if (chip->flags & TPM_CHIP_FLAG_TPM2) { + tpm2_shutdown(chip, TPM2_SU_STATE); + goto suspended; } + rc = tpm1_pm_suspend(chip, tpm_suspend_pcr); + suspended: chip->flags |= TPM_CHIP_FLAG_SUSPENDED; + tpm_put_ops(chip); if (rc) dev_err(dev, "Ignoring error %d while suspending\n", rc); @@ -462,11 +467,18 @@ int tpm_get_random(struct tpm_chip *chip, u8 *out, size_t max) if (!chip) return -ENODEV; + /* Give back zero bytes, as TPM chip has not yet fully resumed: */ + if (chip->flags & TPM_CHIP_FLAG_SUSPENDED) { + rc = 0; + goto out; + } + if (chip->flags & TPM_CHIP_FLAG_TPM2) rc = tpm2_get_random(chip, out, max); else rc = tpm1_get_random(chip, out, max); +out: tpm_put_ops(chip); return rc; } -- 2.25.1

2 1

[PATCH OLK-6.6] bpftool: Fix undefined behavior in qsort(NULL, 0, ...)
by Xiaomeng Zhang 21 Nov '24

21 Nov '24

From: Kuan-Wei Chiu <visitorckw(a)gmail.com> stable inclusion from stable-v6.6.55 commit c2d9f9a7837ab29ccae0c42252f17d436bf0a501 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB0MX4 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit f04e2ad394e2755d0bb2d858ecb5598718bf00d5 ] When netfilter has no entry to display, qsort is called with qsort(NULL, 0, ...). This results in undefined behavior, as UBSan reports: net.c:827:2: runtime error: null pointer passed as argument 1, which is declared to never be null Although the C standard does not explicitly state whether calling qsort with a NULL pointer when the size is 0 constitutes undefined behavior, Section 7.1.4 of the C standard (Use of library functions) mentions: "Each of the following statements applies unless explicitly stated otherwise in the detailed descriptions that follow: If an argument to a function has an invalid value (such as a value outside the domain of the function, or a pointer outside the address space of the program, or a null pointer, or a pointer to non-modifiable storage when the corresponding parameter is not const-qualified) or a type (after promotion) not expected by a function with variable number of arguments, the behavior is undefined." To avoid this, add an early return when nf_link_info is NULL to prevent calling qsort with a NULL pointer. Signed-off-by: Kuan-Wei Chiu <visitorckw(a)gmail.com> Signed-off-by: Andrii Nakryiko <andrii(a)kernel.org> Reviewed-by: Quentin Monnet <qmo(a)kernel.org> Link: https://lore.kernel.org/bpf/20240910150207.3179306-1-visitorckw@gmail.com Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wen Zhiwei <wenzhiwei(a)kylinos.cn> --- tools/bpf/bpftool/net.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/tools/bpf/bpftool/net.c b/tools/bpf/bpftool/net.c index fd54ff436493..28e9417a5c2e 100644 --- a/tools/bpf/bpftool/net.c +++ b/tools/bpf/bpftool/net.c @@ -819,6 +819,9 @@ static void show_link_netfilter(void) nf_link_count++; } + if (!nf_link_info) + return; + qsort(nf_link_info, nf_link_count, sizeof(*nf_link_info), netfilter_link_compar); for (id = 0; id < nf_link_count; id++) { -- 2.34.1

2 1

[openeuler:openEuler-1.0-LTS 1297/1297] drivers/hwtracing/intel_th/msu-sink.o: warning: objtool: missing symbol for section .exit.text
by kernel test robot 21 Nov '24

21 Nov '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 81e029d5dd0cae934243168eee37ef303ebcce38 commit: 4d516770f81434cde260d33430626e3880b9902e [1297/1297] intel_th: msu-sink: An example msu buffer "sink" config: x86_64-buildonly-randconfig-005-20241117 (https://download.01.org/0day-ci/archive/20241121/202411212153.Ajpai55I-lkp@…) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241121/202411212153.Ajpai55I-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411212153.Ajpai55I-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/hwtracing/intel_th/msu-sink.o: warning: objtool: missing symbol for section .exit.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] drm/amdgpu: add missing size check in
by Wang Jinchao 21 Nov '24

21 Nov '24

From: Alex Deucher <alexander.deucher(a)amd.com> stable inclusion from stable-v6.1.117 commit 25d7e84343e1235b667cf5226c3934fdf36f0df6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5AT9 CVE: CVE-2024-50282 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- commit 4d75b9468021c73108b4439794d69e892b1d24e3 upstream. Avoid a possible buffer overflow if size is larger than 4K. Reviewed-by: Yang Wang <kevinyang.wang(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> (cherry picked from commit f5d873f5825b40d886d03bd2aede91d4cf002434) Cc: stable(a)vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Jinchao <wangjinchao(a)xfusion.com> --- drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c index 3cca3f07f34d..a8dd63f270c3 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c @@ -419,7 +419,7 @@ static ssize_t amdgpu_debugfs_regs_pcie_write(struct file *f, const char __user ssize_t result = 0; int r; - if (size & 0x3 || *pos & 0x3) + if (size > 4096 || size & 0x3 || *pos & 0x3) return -EINVAL; r = pm_runtime_get_sync(adev_to_drm(adev)->dev); -- 2.47.0

2 1

[PATCH OLK-5.10] bpf: Fix out-of-bounds write in trie_get_next_key()
by Pu Lehui 21 Nov '24

21 Nov '24

From: Byeonguk Jeong <jungbu2855(a)gmail.com> stable inclusion from stable-v5.10.229 commit 590976f921723d53ac199c01d5b7b73a94875e68 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB379Y CVE: CVE-2024-50262 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 13400ac8fb80c57c2bfb12ebd35ee121ce9b4d21 ] trie_get_next_key() allocates a node stack with size trie->max_prefixlen, while it writes (trie->max_prefixlen + 1) nodes to the stack when it has full paths from the root to leaves. For example, consider a trie with max_prefixlen is 8, and the nodes with key 0x00/0, 0x00/1, 0x00/2, ... 0x00/8 inserted. Subsequent calls to trie_get_next_key with _key with .prefixlen = 8 make 9 nodes be written on the node stack with size 8. Fixes: b471f2f1de8b ("bpf: implement MAP_GET_NEXT_KEY command for LPM_TRIE map") Signed-off-by: Byeonguk Jeong <jungbu2855(a)gmail.com> Reviewed-by: Toke Høiland-Jørgensen <toke(a)kernel.org> Tested-by: Hou Tao <houtao1(a)huawei.com> Acked-by: Hou Tao <houtao1(a)huawei.com> Link: https://lore.kernel.org/r/Zxx384ZfdlFYnz6J@localhost.localdomain Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Xiaomeng Zhang <zhangxiaomeng13(a)huawei.com> --- kernel/bpf/lpm_trie.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/bpf/lpm_trie.c b/kernel/bpf/lpm_trie.c index 00e32f2ec3e6..7bbadd9ac3e9 100644 --- a/kernel/bpf/lpm_trie.c +++ b/kernel/bpf/lpm_trie.c @@ -652,7 +652,7 @@ static int trie_get_next_key(struct bpf_map *map, void *_key, void *_next_key) if (!key || key->prefixlen > trie->max_prefixlen) goto find_leftmost; - node_stack = kmalloc_array(trie->max_prefixlen, + node_stack = kmalloc_array(trie->max_prefixlen + 1, sizeof(struct lpm_trie_node *), GFP_ATOMIC | __GFP_NOWARN); if (!node_stack) -- 2.34.1

3 2

[PATCH OLK-5.10] media: s5p-jpeg: prevent buffer overflows
by Wang Jinchao 21 Nov '24

21 Nov '24

From: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> stable inclusion from stable-v5.15.172 commit a930cddfd153b5d4401df0c01effa14c831ff21e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5KQX CVE: CVE-2024-53061 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- commit 14a22762c3daeac59a5a534e124acbb4d7a79b3a upstream. The current logic allows word to be less than 2. If this happens, there will be buffer overflows, as reported by smatch. Add extra checks to prevent it. While here, remove an unused word = 0 assignment. Fixes: 6c96dbbc2aa9 ("[media] s5p-jpeg: add support for 5433") Cc: stable(a)vger.kernel.org Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> Reviewed-by: Jacek Anaszewski <jacek.anaszewski(a)gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Jinchao <wangjinchao(a)xfusion.com> --- drivers/media/platform/s5p-jpeg/jpeg-core.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/drivers/media/platform/s5p-jpeg/jpeg-core.c b/drivers/media/platform/s5p-jpeg/jpeg-core.c index 7d0ab19c38bb..5cfb49ddcbee 100644 --- a/drivers/media/platform/s5p-jpeg/jpeg-core.c +++ b/drivers/media/platform/s5p-jpeg/jpeg-core.c @@ -775,11 +775,14 @@ static void exynos4_jpeg_parse_decode_h_tbl(struct s5p_jpeg_ctx *ctx) (unsigned long)vb2_plane_vaddr(&vb->vb2_buf, 0) + ctx->out_q.sos + 2; jpeg_buffer.curr = 0; - word = 0; - if (get_word_be(&jpeg_buffer, &word)) return; - jpeg_buffer.size = (long)word - 2; + + if (word < 2) + jpeg_buffer.size = 0; + else + jpeg_buffer.size = (long)word - 2; + jpeg_buffer.data += 2; jpeg_buffer.curr = 0; @@ -1058,6 +1061,7 @@ static int get_word_be(struct s5p_jpeg_buffer *buf, unsigned int *word) if (byte == -1) return -1; *word = (unsigned int)byte | temp; + return 0; } @@ -1145,7 +1149,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data *result, if (get_word_be(&jpeg_buffer, &word)) break; length = (long)word - 2; - if (!length) + if (length <= 0) return false; sof = jpeg_buffer.curr; /* after 0xffc0 */ sof_len = length; @@ -1176,7 +1180,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data *result, if (get_word_be(&jpeg_buffer, &word)) break; length = (long)word - 2; - if (!length) + if (length <= 0) return false; if (n_dqt >= S5P_JPEG_MAX_MARKER) return false; @@ -1189,7 +1193,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data *result, if (get_word_be(&jpeg_buffer, &word)) break; length = (long)word - 2; - if (!length) + if (length <= 0) return false; if (n_dht >= S5P_JPEG_MAX_MARKER) return false; @@ -1214,6 +1218,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data *result, if (get_word_be(&jpeg_buffer, &word)) break; length = (long)word - 2; + /* No need to check underflows as skip() does it */ skip(&jpeg_buffer, length); break; } -- 2.47.0

2 1

Subject: [PATCH OLK-5.10] media: s5p-jpeg: prevent buffer overflows
by Wang Jinchao 21 Nov '24

21 Nov '24

From: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> stable inclusion from stable-v5.15.172 commit a930cddfd153b5d4401df0c01effa14c831ff21e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5KQX CVE: CVE-2024-53061 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- commit 14a22762c3daeac59a5a534e124acbb4d7a79b3a upstream. The current logic allows word to be less than 2. If this happens, there will be buffer overflows, as reported by smatch. Add extra checks to prevent it. While here, remove an unused word = 0 assignment. Fixes: 6c96dbbc2aa9 ("[media] s5p-jpeg: add support for 5433") Cc: stable(a)vger.kernel.org Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei(a)kernel.org> Reviewed-by: Jacek Anaszewski <jacek.anaszewski(a)gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Jinchao <wangjinchao(a)xfusion.com> --- drivers/media/platform/s5p-jpeg/jpeg-core.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/drivers/media/platform/s5p-jpeg/jpeg-core.c b/drivers/media/platform/s5p-jpeg/jpeg-core.c index 7d0ab19c38bb..5cfb49ddcbee 100644 --- a/drivers/media/platform/s5p-jpeg/jpeg-core.c +++ b/drivers/media/platform/s5p-jpeg/jpeg-core.c @@ -775,11 +775,14 @@ static void exynos4_jpeg_parse_decode_h_tbl(struct s5p_jpeg_ctx *ctx) (unsigned long)vb2_plane_vaddr(&vb->vb2_buf, 0) + ctx->out_q.sos + 2; jpeg_buffer.curr = 0; - word = 0; - if (get_word_be(&jpeg_buffer, &word)) return; - jpeg_buffer.size = (long)word - 2; + + if (word < 2) + jpeg_buffer.size = 0; + else + jpeg_buffer.size = (long)word - 2; + jpeg_buffer.data += 2; jpeg_buffer.curr = 0; @@ -1058,6 +1061,7 @@ static int get_word_be(struct s5p_jpeg_buffer *buf, unsigned int *word) if (byte == -1) return -1; *word = (unsigned int)byte | temp; + return 0; } @@ -1145,7 +1149,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data *result, if (get_word_be(&jpeg_buffer, &word)) break; length = (long)word - 2; - if (!length) + if (length <= 0) return false; sof = jpeg_buffer.curr; /* after 0xffc0 */ sof_len = length; @@ -1176,7 +1180,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data *result, if (get_word_be(&jpeg_buffer, &word)) break; length = (long)word - 2; - if (!length) + if (length <= 0) return false; if (n_dqt >= S5P_JPEG_MAX_MARKER) return false; @@ -1189,7 +1193,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data *result, if (get_word_be(&jpeg_buffer, &word)) break; length = (long)word - 2; - if (!length) + if (length <= 0) return false; if (n_dht >= S5P_JPEG_MAX_MARKER) return false; @@ -1214,6 +1218,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data *result, if (get_word_be(&jpeg_buffer, &word)) break; length = (long)word - 2; + /* No need to check underflows as skip() does it */ skip(&jpeg_buffer, length); break; } -- 2.47.0

1 0

Subject: [PATCH OLK-6.6] ASoC: dapm: fix bounds checker error in
by Wang Jinchao 21 Nov '24

21 Nov '24

From: Aleksei Vetrov <vvvvvv(a)google.com> stable inclusion from stable-v6.12 commit 2ef9439f7a19fd3d43b288d38b1c6e55b668a4fe category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5KRC CVE: CVE-2024-53045 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- The widgets array in the snd_soc_dapm_widget_list has a __counted_by attribute attached to it, which points to the num_widgets variable. This attribute is used in bounds checking, and if it is not set before the array is filled, then the bounds sanitizer will issue a warning or a kernel panic if CONFIG_UBSAN_TRAP is set. This patch sets the size of the widgets list calculated with list_for_each as the initial value for num_widgets as it is used for allocating memory for the array. It is updated with the actual number of added elements after the array is filled. Signed-off-by: Aleksei Vetrov <vvvvvv(a)google.com> Fixes: 80e698e2df5b ("ASoC: soc-dapm: Annotate struct snd_soc_dapm_widget_list with __counted_by") Link: https://patch.msgid.link/20241028-soc-dapm-bounds-checker-fix-v1-1-262b0394… Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Wang Jinchao <wangjinchao(a)xfusion.com> --- sound/soc/soc-dapm.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c index c34934c31ffe..99521c784a9b 100644 --- a/sound/soc/soc-dapm.c +++ b/sound/soc/soc-dapm.c @@ -1147,6 +1147,8 @@ static int dapm_widget_list_create(struct snd_soc_dapm_widget_list **list, if (*list == NULL) return -ENOMEM; + (*list)->num_widgets = size; + list_for_each_entry(w, widgets, work_list) (*list)->widgets[i++] = w; -- 2.47.0

1 0

Subject: [PATCHOLK-5.10] nfs: Fix KMSAN warning in decode_getfattr_attrs()
by Wang Jinchao 21 Nov '24

21 Nov '24

From: Roberto Sassu <roberto.sassu(a)huawei.com> stable inclusion from stable-v4.19.324 commit 25ffd294fef81a7f3cd9528adf21560c04d98747 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5KQQ CVE: CVE-2024-53066 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ---------------------------------------------------------------------- commit dc270d7159699ad6d11decadfce9633f0f71c1db upstream. Fix the following KMSAN warning: CPU: 1 UID: 0 PID: 7651 Comm: cp Tainted: G B Tainted: [B]=BAD_PAGE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009) ===================================================== ===================================================== BUG: KMSAN: uninit-value in decode_getfattr_attrs+0x2d6d/0x2f90 decode_getfattr_attrs+0x2d6d/0x2f90 decode_getfattr_generic+0x806/0xb00 nfs4_xdr_dec_getattr+0x1de/0x240 rpcauth_unwrap_resp_decode+0xab/0x100 rpcauth_unwrap_resp+0x95/0xc0 call_decode+0x4ff/0xb50 __rpc_execute+0x57b/0x19d0 rpc_execute+0x368/0x5e0 rpc_run_task+0xcfe/0xee0 nfs4_proc_getattr+0x5b5/0x990 __nfs_revalidate_inode+0x477/0xd00 nfs_access_get_cached+0x1021/0x1cc0 nfs_do_access+0x9f/0xae0 nfs_permission+0x1e4/0x8c0 inode_permission+0x356/0x6c0 link_path_walk+0x958/0x1330 path_lookupat+0xce/0x6b0 filename_lookup+0x23e/0x770 vfs_statx+0xe7/0x970 vfs_fstatat+0x1f2/0x2c0 __se_sys_newfstatat+0x67/0x880 __x64_sys_newfstatat+0xbd/0x120 x64_sys_call+0x1826/0x3cf0 do_syscall_64+0xd0/0x1b0 entry_SYSCALL_64_after_hwframe+0x77/0x7f The KMSAN warning is triggered in decode_getfattr_attrs(), when calling decode_attr_mdsthreshold(). It appears that fattr->mdsthreshold is not initialized. Fix the issue by initializing fattr->mdsthreshold to NULL in nfs_fattr_init(). Cc: stable(a)vger.kernel.org # v3.5.x Fixes: 88034c3d88c2 ("NFSv4.1 mdsthreshold attribute xdr") Signed-off-by: Roberto Sassu <roberto.sassu(a)huawei.com> Signed-off-by: Anna Schumaker <anna.schumaker(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Jinchao <wangjinchao(a)xfusion.com> --- fs/nfs/inode.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c index 592b95ab378b..36ce31f20e03 100644 --- a/fs/nfs/inode.c +++ b/fs/nfs/inode.c @@ -1483,6 +1483,7 @@ void nfs_fattr_init(struct nfs_fattr *fattr) fattr->gencount = nfs_inc_attr_generation_counter(); fattr->owner_name = NULL; fattr->group_name = NULL; + fattr->mdsthreshold = NULL; } EXPORT_SYMBOL_GPL(nfs_fattr_init); -- 2.47.0

1 0