- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table()
by Wang Zhaolong 21 Apr '25

21 Apr '25

From: Jiang Liu <gerry(a)linux.alibaba.com> mainline inclusion from mainline-v6.14-rc3 commit 1abb2648698bf10783d2236a6b4a7ca5e8021699 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC78 CVE: CVE-2025-21780 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- It malicious user provides a small pptable through sysfs and then a bigger pptable, it may cause buffer overflow attack in function smu_sys_set_pp_table(). Reviewed-by: Lijo Lazar <lijo.lazar(a)amd.com> Signed-off-by: Jiang Liu <gerry(a)linux.alibaba.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Cc: stable(a)vger.kernel.org Conflicts: drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c [The smu->mutex in the context has not been removed.] Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c index ee27970cfff9..98c9ac875daa 100644 --- a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c +++ b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c @@ -325,12 +325,14 @@ int smu_sys_set_pp_table(struct smu_context *smu, void *buf, size_t size) dev_err(smu->adev->dev, "pp table size not matched !\n"); return -EIO; } mutex_lock(&smu->mutex); - if (!smu_table->hardcode_pptable) + if (!smu_table->hardcode_pptable || smu_table->power_play_table_size < size) { + kfree(smu_table->hardcode_pptable); smu_table->hardcode_pptable = kzalloc(size, GFP_KERNEL); + } if (!smu_table->hardcode_pptable) { ret = -ENOMEM; goto failed; } -- 2.34.3

2 1

[PATCH OLK-6.6 v3 00/18] fs/resctrl: Introduce the resctrl_feat_type
by Zeng Heng 21 Apr '25

21 Apr '25

Compare to v2: Patch 09: Merge the changes related to the impact on the common layer in Patch 10. Patch 18: New patch added. Compare to v1: Patch 5: Update the condition for MPAM to determine whether to perform MBM overflow checking. Patch 15: Split the original patch and merge part of the fix content into Patch 9. Jason Zeng (1): fs/resctrl: Support arch specific struct resctrl_arch_staged_config Zeng Heng (17): arm64/mpam: fix memleak in resctrl_arch_mon_ctx_alloc_no_wait() arm64/mpam: fix impossible condition in get_cpumask_from_cache_id() arm64/mpam: fix impossible condition in resctrl_arch_rmid_read() arm64/mpam: Optimize CSU/MBWU monitor multiplexing fs/resctrl: Determine whether the MBM monitors require overflow checking arm64/mpam: Set the cpbm width of msc class with the minimum arm64/mpam: Correct the judgment condition of the CMAX feature fs/resctrl: Fix kmemleak caused by closid_init() fs/resctrl: Introduce the resctrl_feat_type arm64/mpam: Add mbw_min and cmin features arm64/mpam: Add PRIO feature arm64/mpam: Add CMAX feature arm64/mpam: Add PBM feature arm64/mpam: Add limit feature arm64/mpam: Fix allocated cache size information fs/resctrl: Fix configuration to wrong control group when CDP is enabled arm64/mpam: Add debugging information about CDP monitor value arch/x86/include/asm/resctrl.h | 33 ++ arch/x86/kernel/cpu/resctrl/ctrlmondata.c | 16 +- drivers/platform/mpam/mpam_devices.c | 111 +++++-- drivers/platform/mpam/mpam_internal.h | 25 +- drivers/platform/mpam/mpam_resctrl.c | 355 +++++++++++++++++----- fs/resctrl/ctrlmondata.c | 141 ++++++++- fs/resctrl/monitor.c | 5 +- fs/resctrl/rdtgroup.c | 149 +++++---- include/linux/arm_mpam.h | 11 + include/linux/resctrl.h | 34 ++- include/linux/resctrl_types.h | 20 ++ 11 files changed, 708 insertions(+), 192 deletions(-) -- 2.25.1

2 19

[PATCH openEuler-1.0-LTS 0/1] Fix CVE-2020-36789
by Hongbo Li 21 Apr '25

21 Apr '25

Fix CVE-2020-36789. Hongbo Li (1): can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context drivers/net/can/dev/dev.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH OLK-6.6] ksmbd: validate zero num_subauth before sub_auth is accessed
by Yifan Qiao 21 Apr '25

21 Apr '25

From: Norbert Szetei <norbert(a)doyensec.com> mainline inclusion from mainline-v6.15-rc1 commit bf21e29d78cd2c2371023953d9c82dfef82ebb36 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QOW CVE: CVE-2025-22038 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Access psid->sub_auth[psid->num_subauth - 1] without checking if num_subauth is non-zero leads to an out-of-bounds read. This patch adds a validation step to ensure num_subauth != 0 before sub_auth is accessed. Cc: stable(a)vger.kernel.org Signed-off-by: Norbert Szetei <norbert(a)doyensec.com> Acked-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/smb/server/smbacl.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/fs/smb/server/smbacl.c b/fs/smb/server/smbacl.c index be76e642ca70..4870348f0dd9 100644 --- a/fs/smb/server/smbacl.c +++ b/fs/smb/server/smbacl.c @@ -270,6 +270,11 @@ static int sid_to_id(struct mnt_idmap *idmap, return -EIO; } + if (psid->num_subauth == 0) { + pr_err("%s: zero subauthorities!\n", __func__); + return -EIO; + } + if (sidtype == SIDOWNER) { kuid_t uid; uid_t id; -- 2.39.2

2 1

[PATCH OLK-6.6] ksmbd: fix overflow in dacloffset bounds check
by Yifan Qiao 21 Apr '25

21 Apr '25

From: Norbert Szetei <norbert(a)doyensec.com> mainline inclusion from mainline-v6.15-rc1 commit beff0bc9d69bc8e733f9bca28e2d3df5b3e10e42 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IC1QQK CVE: CVE-2025-22039 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The dacloffset field was originally typed as int and used in an unchecked addition, which could overflow and bypass the existing bounds check in both smb_check_perm_dacl() and smb_inherit_dacl(). This could result in out-of-bounds memory access and a kernel crash when dereferencing the DACL pointer. This patch converts dacloffset to unsigned int and uses check_add_overflow() to validate access to the DACL. Cc: stable(a)vger.kernel.org Signed-off-by: Norbert Szetei <norbert(a)doyensec.com> Acked-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflicts: fs/smb/server/smbacl.c [Just context differences.] Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- fs/smb/server/smbacl.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/fs/smb/server/smbacl.c b/fs/smb/server/smbacl.c index 1c9775f1efa5..0038aed5333e 100644 --- a/fs/smb/server/smbacl.c +++ b/fs/smb/server/smbacl.c @@ -1007,7 +1007,9 @@ int smb_inherit_dacl(struct ksmbd_conn *conn, struct dentry *parent = path->dentry->d_parent; struct mnt_idmap *idmap = mnt_idmap(path->mnt); int inherited_flags = 0, flags = 0, i, ace_cnt = 0, nt_size = 0, pdacl_size; - int rc = 0, num_aces, dacloffset, pntsd_type, pntsd_size, acl_len, aces_size; + int rc = 0, num_aces, pntsd_type, pntsd_size, acl_len, aces_size; + unsigned int dacloffset; + size_t dacl_struct_end; char *aces_base; bool is_dir = S_ISDIR(d_inode(path->dentry)->i_mode); @@ -1015,8 +1017,11 @@ int smb_inherit_dacl(struct ksmbd_conn *conn, parent, &parent_pntsd); if (pntsd_size <= 0) return -ENOENT; + dacloffset = le32_to_cpu(parent_pntsd->dacloffset); - if (!dacloffset || (dacloffset + sizeof(struct smb_acl) > pntsd_size)) { + if (!dacloffset || + check_add_overflow(dacloffset, sizeof(struct smb_acl), &dacl_struct_end) || + dacl_struct_end > (size_t)pntsd_size) { rc = -EINVAL; goto free_parent_pntsd; } @@ -1219,7 +1224,9 @@ int smb_check_perm_dacl(struct ksmbd_conn *conn, const struct path *path, struct smb_ntsd *pntsd = NULL; struct smb_acl *pdacl; struct posix_acl *posix_acls; - int rc = 0, pntsd_size, acl_size, aces_size, pdacl_size, dacl_offset; + int rc = 0, pntsd_size, acl_size, aces_size, pdacl_size; + unsigned int dacl_offset; + size_t dacl_struct_end; struct smb_sid sid; int granted = le32_to_cpu(*pdaccess & ~FILE_MAXIMAL_ACCESS_LE); struct smb_ace *ace; @@ -1238,7 +1245,8 @@ int smb_check_perm_dacl(struct ksmbd_conn *conn, const struct path *path, dacl_offset = le32_to_cpu(pntsd->dacloffset); if (!dacl_offset || - (dacl_offset + sizeof(struct smb_acl) > pntsd_size)) + check_add_overflow(dacl_offset, sizeof(struct smb_acl), &dacl_struct_end) || + dacl_struct_end > (size_t)pntsd_size) goto err_out; pdacl = (struct smb_acl *)((char *)pntsd + le32_to_cpu(pntsd->dacloffset)); -- 2.39.2

2 1

[PATCH OLK-6.6] drm/hyperv: Fix address space leak when Hyper-V DRM device is removed
by Yifan Qiao 21 Apr '25

21 Apr '25

From: Michael Kelley <mhklinux(a)outlook.com> mainline inclusion from mainline-v6.14-rc7 commit aed709355fd05ef747e1af24a1d5d78cd7feb81e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBY42I CVE: CVE-2025-21978 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When a Hyper-V DRM device is probed, the driver allocates MMIO space for the vram, and maps it cacheable. If the device removed, or in the error path for device probing, the MMIO space is released but no unmap is done. Consequently the kernel address space for the mapping is leaked. Fix this by adding iounmap() calls in the device removal path, and in the error path during device probing. Fixes: f1f63cbb705d ("drm/hyperv: Fix an error handling path in hyperv_vmbus_probe()") Fixes: a0ab5abced55 ("drm/hyperv : Removing the restruction of VRAM allocation with PCI bar size") Signed-off-by: Michael Kelley <mhklinux(a)outlook.com> Reviewed-by: Saurabh Sengar <ssengar(a)linux.microsoft.com> Tested-by: Saurabh Sengar <ssengar(a)linux.microsoft.com> Link: https://lore.kernel.org/r/20250210193441.2414-1-mhklinux@outlook.com Signed-off-by: Wei Liu <wei.liu(a)kernel.org> Message-ID: <20250210193441.2414-1-mhklinux(a)outlook.com> Signed-off-by: Yifan Qiao <qiaoyifan4(a)huawei.com> --- drivers/gpu/drm/hyperv/hyperv_drm_drv.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/hyperv/hyperv_drm_drv.c b/drivers/gpu/drm/hyperv/hyperv_drm_drv.c index 8026118c6e03..8a7933f5c6eb 100644 --- a/drivers/gpu/drm/hyperv/hyperv_drm_drv.c +++ b/drivers/gpu/drm/hyperv/hyperv_drm_drv.c @@ -157,6 +157,7 @@ static int hyperv_vmbus_probe(struct hv_device *hdev, return 0; err_free_mmio: + iounmap(hv->vram); vmbus_free_mmio(hv->mem->start, hv->fb_size); err_vmbus_close: vmbus_close(hdev->channel); @@ -175,6 +176,7 @@ static void hyperv_vmbus_remove(struct hv_device *hdev) vmbus_close(hdev->channel); hv_set_drvdata(hdev, NULL); + iounmap(hv->vram); vmbus_free_mmio(hv->mem->start, hv->fb_size); } -- 2.39.2

2 1

[PATCH OLK-6.6 0/5] drm: LoongArch: fix rx550/gfx6/gfx7/gfx8 error
by Hongchen Zhang 21 Apr '25

21 Apr '25

Tianrui Zhao (3): drm/amdgpu: Fix pcie order dislocation drm/amdgpu: make duplicated EOP packet for GFX6 have real content drm/amdgpu: Fix RX550 pcie order dislocation. lvjianmin (2): drm/radeon: repeat the same EOP packet for EOP workaround on CIK drm/amdgpu: make duplicated EOP packet for GFX7/8 have real content drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 5 + drivers/gpu/drm/amd/amdgpu/amdgpu_ih.c | 159 ++++++++++++++++++++++++ drivers/gpu/drm/amd/amdgpu/amdgpu_ih.h | 6 + drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c | 4 + drivers/gpu/drm/amd/amdgpu/amdgpu_irq.h | 3 + drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c | 19 +++ drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c | 13 +- drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 13 +- drivers/gpu/drm/radeon/cik.c | 9 +- 9 files changed, 216 insertions(+), 15 deletions(-) -- 2.33.0

2 6

[PATCH OLK-6.6 0/5] drm: LoongArch: fix rx550/gfx6/gfx7/gfx8 error
by Hongchen Zhang 21 Apr '25

21 Apr '25

Tianrui Zhao (3): drm/amdgpu: Fix pcie order dislocation drm/amdgpu: make duplicated EOP packet for GFX6 have real content drm/amdgpu: Fix RX550 pcie order dislocation. lvjianmin (2): drm/radeon: repeat the same EOP packet for EOP workaround on CIK drm/amdgpu: make duplicated EOP packet for GFX7/8 have real content drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 5 + drivers/gpu/drm/amd/amdgpu/amdgpu_ih.c | 159 ++++++++++++++++++++++++ drivers/gpu/drm/amd/amdgpu/amdgpu_ih.h | 6 + drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c | 4 + drivers/gpu/drm/amd/amdgpu/amdgpu_irq.h | 3 + drivers/gpu/drm/amd/amdgpu/gfx_v6_0.c | 19 +++ drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c | 13 +- drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c | 13 +- drivers/gpu/drm/radeon/cik.c | 9 +- 9 files changed, 216 insertions(+), 15 deletions(-) -- 2.33.0

2 6

[PATCH OLK-6.6 v3 00/18] fs/resctrl: Introduce the resctrl_feat_type
by Zeng Heng 21 Apr '25

21 Apr '25

Compare to v2: Patch 09: Merge the changes related to the impact on the common layer in Patch 10. Patch 18: New patch added. Compare to v1: Patch 5: Update the condition for MPAM to determine whether to perform MBM overflow checking. Patch 15: Split the original patch and merge part of the fix content into Patch 9. Jason Zeng (1): fs/resctrl: Support arch specific struct resctrl_arch_staged_config Zeng Heng (17): arm64/mpam: fix memleak in resctrl_arch_mon_ctx_alloc_no_wait() arm64/mpam: fix impossible condition in get_cpumask_from_cache_id() arm64/mpam: fix impossible condition in resctrl_arch_rmid_read() arm64/mpam: Optimize CSU/MBWU monitor multiplexing fs/resctrl: Determine whether the MBM monitors require overflow checking arm64/mpam: Set the cpbm width of msc class with the minimum arm64/mpam: Correct the judgment condition of the CMAX feature fs/resctrl: Fix kmemleak caused by closid_init() fs/resctrl: Introduce the resctrl_feat_type arm64/mpam: Add mbw_min and cmin features arm64/mpam: Add PRIO feature arm64/mpam: Add CMAX feature arm64/mpam: Add PBM feature arm64/mpam: Add limit feature arm64/mpam: Fix allocated cache size information fs/resctrl: Fix configuration to wrong control group when CDP is enabled arm64/mpam: Add debugging information about CDP monitor value arch/x86/include/asm/resctrl.h | 33 ++ arch/x86/kernel/cpu/resctrl/ctrlmondata.c | 16 +- drivers/platform/mpam/mpam_devices.c | 111 +++++-- drivers/platform/mpam/mpam_internal.h | 25 +- drivers/platform/mpam/mpam_resctrl.c | 355 +++++++++++++++++----- fs/resctrl/ctrlmondata.c | 141 ++++++++- fs/resctrl/monitor.c | 5 +- fs/resctrl/rdtgroup.c | 135 ++++---- include/linux/arm_mpam.h | 11 + include/linux/resctrl.h | 32 +- include/linux/resctrl_types.h | 20 ++ 11 files changed, 692 insertions(+), 192 deletions(-) -- 2.25.1

2 19

[openeuler:OLK-6.6 2139/2139] drivers/cpufreq/cppc_cpufreq.c:852:19: error: dereferencing pointer to incomplete type 'struct fb_ctr_pair'
by kernel test robot 21 Apr '25

21 Apr '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: bf197758b04f43e61ebab66520f1420c1b64853c commit: 12f136b2134d4ded731c3ef23ac08c85b9c0b1fa [2139/2139] cpufreq: CPPC: Keep the target core awake when reading its cpufreq rate config: arm64-randconfig-002-20250421 (https://download.01.org/0day-ci/archive/20250421/202504211352.ik4vkTIa-lkp@…) compiler: aarch64-linux-gcc (GCC) 7.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250421/202504211352.ik4vkTIa-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202504211352.ik4vkTIa-lkp@intel.com/ All errors (new ones prefixed by >>): drivers/cpufreq/cppc_cpufreq.c: In function 'cppc_get_perf_ctrs_pair': >> drivers/cpufreq/cppc_cpufreq.c:852:19: error: dereferencing pointer to incomplete type 'struct fb_ctr_pair' int cpu = fb_ctrs->cpu; ^~ drivers/cpufreq/cppc_cpufreq.c: In function 'cppc_cpufreq_get_rate': drivers/cpufreq/cppc_cpufreq.c:866:9: error: variable 'fb_ctrs' has initializer but incomplete type struct fb_ctr_pair fb_ctrs = { .cpu = cpu, }; ^~~~~~~~~~~ drivers/cpufreq/cppc_cpufreq.c:866:34: error: 'struct fb_ctr_pair' has no member named 'cpu' struct fb_ctr_pair fb_ctrs = { .cpu = cpu, }; ^~~ drivers/cpufreq/cppc_cpufreq.c:866:40: warning: excess elements in struct initializer struct fb_ctr_pair fb_ctrs = { .cpu = cpu, }; ^~~ drivers/cpufreq/cppc_cpufreq.c:866:40: note: (near initialization for 'fb_ctrs') drivers/cpufreq/cppc_cpufreq.c:866:21: error: storage size of 'fb_ctrs' isn't known struct fb_ctr_pair fb_ctrs = { .cpu = cpu, }; ^~~~~~~ drivers/cpufreq/cppc_cpufreq.c:866:21: warning: unused variable 'fb_ctrs' [-Wunused-variable] vim +852 drivers/cpufreq/cppc_cpufreq.c 848 849 static int cppc_get_perf_ctrs_pair(void *val) 850 { 851 struct fb_ctr_pair *fb_ctrs = val; > 852 int cpu = fb_ctrs->cpu; 853 int ret; 854 855 ret = cppc_get_perf_ctrs(cpu, &fb_ctrs->fb_ctrs_t0); 856 if (ret) 857 return ret; 858 859 udelay(2); /* 2usec delay between sampling */ 860 861 return cppc_get_perf_ctrs(cpu, &fb_ctrs->fb_ctrs_t1); 862 } 863 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0