- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] smb: client: fix deadlock in smb2_find_smb_tcon()
by Wang Zhaolong 26 Jun '24

26 Jun '24

From: Enzo Matsumiya <ematsumiya(a)suse.de> mainline inclusion from mainline-v6.10-rc3 commit 02c418774f76a0a36a6195c9dbf8971eb4130a15 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA8AFZ CVE: CVE-2024-39468 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Unlock cifs_tcp_ses_lock before calling cifs_put_smb_ses() to avoid such deadlock. Cc: stable(a)vger.kernel.org Signed-off-by: Enzo Matsumiya <ematsumiya(a)suse.de> Reviewed-by: Shyam Prasad N <sprasad(a)microsoft.com> Reviewed-by: Paulo Alcantara (Red Hat) <pc(a)manguebit.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> --- fs/smb/client/smb2transport.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/smb/client/smb2transport.c b/fs/smb/client/smb2transport.c index 8f346aafc4cf..4ca04e62a993 100644 --- a/fs/smb/client/smb2transport.c +++ b/fs/smb/client/smb2transport.c @@ -216,8 +216,8 @@ smb2_find_smb_tcon(struct TCP_Server_Info *server, __u64 ses_id, __u32 tid) } tcon = smb2_find_smb_sess_tcon_unlocked(ses, tid); if (!tcon) { - cifs_put_smb_ses(ses); spin_unlock(&cifs_tcp_ses_lock); + cifs_put_smb_ses(ses); return NULL; } spin_unlock(&cifs_tcp_ses_lock); -- 2.34.3

2 1

[PATCH OLK-6.6] thermal/drivers/qcom/lmh: Check for SCM availability at probe
by Zheng Yejian 26 Jun '24

26 Jun '24

From: Konrad Dybcio <konrad.dybcio(a)linaro.org> mainline inclusion from mainline-v6.10-rc1 commit d9d3490c48df572edefc0b64655259eefdcbb9be category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA8AE9 CVE: CVE-2024-39466 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- Up until now, the necessary scm availability check has not been performed, leading to possible null pointer dereferences (which did happen for me on RB1). Fix that. Fixes: 53bca371cdf7 ("thermal/drivers/qcom: Add support for LMh driver") Cc: <stable(a)vger.kernel.org> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org> Reviewed-by: Bjorn Andersson <andersson(a)kernel.org> Signed-off-by: Konrad Dybcio <konrad.dybcio(a)linaro.org> Signed-off-by: Daniel Lezcano <daniel.lezcano(a)linaro.org> Link: https://lore.kernel.org/r/20240308-topic-rb1_lmh-v2-2-bac3914b0fe3@linaro.o… Signed-off-by: Zheng Yejian <zhengyejian(a)huaweicloud.com> Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> --- drivers/thermal/qcom/lmh.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/thermal/qcom/lmh.c b/drivers/thermal/qcom/lmh.c index f6edb12ec004..5225b3621a56 100644 --- a/drivers/thermal/qcom/lmh.c +++ b/drivers/thermal/qcom/lmh.c @@ -95,6 +95,9 @@ static int lmh_probe(struct platform_device *pdev) unsigned int enable_alg; u32 node_id; + if (!qcom_scm_is_available()) + return -EPROBE_DEFER; + lmh_data = devm_kzalloc(dev, sizeof(*lmh_data), GFP_KERNEL); if (!lmh_data) return -ENOMEM; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] netlabel: fix out-of-bounds memory accesses
by Yue Haibing 26 Jun '24

26 Jun '24

From: Wang Yufen <wangyufen(a)huawei.com> mainline inclusion from mainline-v5.18-rc1 commit f22881de730ebd472e15bcc2c0d1d46e36a87b9c category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IA8H5C CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- In calipso_map_cat_ntoh(), in the for loop, if the return value of netlbl_bitmap_walk() is equal to (net_clen_bits - 1), when netlbl_bitmap_walk() is called next time, out-of-bounds memory accesses of bitmap[byte_offset] occurs. The bug was found during fuzzing. The following is the fuzzing report BUG: KASAN: slab-out-of-bounds in netlbl_bitmap_walk+0x3c/0xd0 Read of size 1 at addr ffffff8107bf6f70 by task err_OH/252 CPU: 7 PID: 252 Comm: err_OH Not tainted 5.17.0-rc7+ #17 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x21c/0x230 show_stack+0x1c/0x60 dump_stack_lvl+0x64/0x7c print_address_description.constprop.0+0x70/0x2d0 __kasan_report+0x158/0x16c kasan_report+0x74/0x120 __asan_load1+0x80/0xa0 netlbl_bitmap_walk+0x3c/0xd0 calipso_opt_getattr+0x1a8/0x230 calipso_sock_getattr+0x218/0x340 calipso_sock_getattr+0x44/0x60 netlbl_sock_getattr+0x44/0x80 selinux_netlbl_socket_setsockopt+0x138/0x170 selinux_socket_setsockopt+0x4c/0x60 security_socket_setsockopt+0x4c/0x90 __sys_setsockopt+0xbc/0x2b0 __arm64_sys_setsockopt+0x6c/0x84 invoke_syscall+0x64/0x190 el0_svc_common.constprop.0+0x88/0x200 do_el0_svc+0x88/0xa0 el0_svc+0x128/0x1b0 el0t_64_sync_handler+0x9c/0x120 el0t_64_sync+0x16c/0x170 Reported-by: Hulk Robot <hulkci(a)huawei.com> Signed-off-by: Wang Yufen <wangyufen(a)huawei.com> Acked-by: Paul Moore <paul(a)paul-moore.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Yue Haibing <yuehaibing(a)huawei.com> --- net/netlabel/netlabel_kapi.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c index 15fe2120b310..c82a9054a6ca 100644 --- a/net/netlabel/netlabel_kapi.c +++ b/net/netlabel/netlabel_kapi.c @@ -899,6 +899,8 @@ int netlbl_bitmap_walk(const unsigned char *bitmap, u32 bitmap_len, unsigned char bitmask; unsigned char byte; + if (offset >= bitmap_len) + return -1; byte_offset = offset / 8; byte = bitmap[byte_offset]; bit_spot = offset; -- 2.34.1

2 1

[PATCH OLK-6.6] fs/ntfs3: Check 'folio' pointer for NULL
by Wang Zhaolong 26 Jun '24

26 Jun '24

From: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> mainline inclusion from mainline-v6.10-rc1 commit 1cd6c96219c429ebcfa8e79a865277376c563803 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA7D7V CVE: CVE-2024-38625 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- It can be NULL if bmap is called. Fixes: 82cae269cfa95 ("fs/ntfs3: Add initialization of super block") Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- fs/ntfs3/inode.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c index 34f2e16f3f5b..e9314778a9d0 100644 --- a/fs/ntfs3/inode.c +++ b/fs/ntfs3/inode.c @@ -570,13 +570,18 @@ static noinline int ntfs_get_block_vbo(struct inode *inode, u64 vbo, clear_buffer_uptodate(bh); if (is_resident(ni)) { - ni_lock(ni); - err = attr_data_read_resident(ni, &folio->page); - ni_unlock(ni); - - if (!err) - set_buffer_uptodate(bh); + bh->b_blocknr = RESIDENT_LCN; bh->b_size = block_size; + if (!folio) { + err = 0; + } else { + ni_lock(ni); + err = attr_data_read_resident(ni, &folio->page); + ni_unlock(ni); + + if (!err) + set_buffer_uptodate(bh); + } return err; } -- 2.34.3

2 1

[PATCH openEuler-22.03-LTS-SP1] fs/ntfs3: Check 'folio' pointer for NULL
by Wang Zhaolong 26 Jun '24

26 Jun '24

From: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> mainline inclusion from mainline-v6.10-rc1 commit 1cd6c96219c429ebcfa8e79a865277376c563803 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA7D7V CVE: CVE-2024-38625 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- It can be NULL if bmap is called. Fixes: 82cae269cfa95 ("fs/ntfs3: Add initialization of super block") Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Conflicts: fs/ntfs3/inode.c [Page has not converted to a folio yet, and the alternative boot feature has not been merged.] Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- fs/ntfs3/inode.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c index 9bafa3c7a5ff..97caf47507d0 100644 --- a/fs/ntfs3/inode.c +++ b/fs/ntfs3/inode.c @@ -565,13 +565,17 @@ static noinline int ntfs_get_block_vbo(struct inode *inode, u64 vbo, } if (is_resident(ni)) { - ni_lock(ni); - err = attr_data_read_resident(ni, page); - ni_unlock(ni); - - if (!err) - set_buffer_uptodate(bh); bh->b_size = block_size; + if (!page) { + err = 0; + } else { + ni_lock(ni); + err = attr_data_read_resident(ni, page); + ni_unlock(ni); + + if (!err) + set_buffer_uptodate(bh); + } return err; } -- 2.34.3

2 1

[PATCH OLK-5.10] fs/ntfs3: Check 'folio' pointer for NULL
by Wang Zhaolong 26 Jun '24

26 Jun '24

From: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> mainline inclusion from mainline-v6.10-rc1 commit 1cd6c96219c429ebcfa8e79a865277376c563803 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA7D7V CVE: CVE-2024-38625 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- It can be NULL if bmap is called. Fixes: 82cae269cfa95 ("fs/ntfs3: Add initialization of super block") Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Conflicts: fs/ntfs3/inode.c [Page has not converted to a folio yet, and the alternative boot feature has not been merged.] Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- fs/ntfs3/inode.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/fs/ntfs3/inode.c b/fs/ntfs3/inode.c index 9bafa3c7a5ff..97caf47507d0 100644 --- a/fs/ntfs3/inode.c +++ b/fs/ntfs3/inode.c @@ -565,13 +565,17 @@ static noinline int ntfs_get_block_vbo(struct inode *inode, u64 vbo, } if (is_resident(ni)) { - ni_lock(ni); - err = attr_data_read_resident(ni, page); - ni_unlock(ni); - - if (!err) - set_buffer_uptodate(bh); bh->b_size = block_size; + if (!page) { + err = 0; + } else { + ni_lock(ni); + err = attr_data_read_resident(ni, page); + ni_unlock(ni); + + if (!err) + set_buffer_uptodate(bh); + } return err; } -- 2.34.3

2 1

[PATCH OLK-6.6 v2 0/2] CVE-2024-38610
by Xiongfeng Wang 26 Jun '24

26 Jun '24

Christoph Hellwig (1): virt: acrn: stop using follow_pfn David Hildenbrand (1): drivers/virt/acrn: fix PFNMAP PTE checks in acrn_vm_ram_map() drivers/virt/acrn/mm.c | 61 +++++++++++++++++++++++++++++++++--------- 1 file changed, 49 insertions(+), 12 deletions(-) -- 2.20.1

2 3

[PATCH openEuler-22.03-LTS-SP1] fs/ntfs3: Use 64 bit variable to avoid 32 bit overflow
by Wang Zhaolong 26 Jun '24

26 Jun '24

From: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> mainline inclusion from mainline-v6.10-rc1 commit e931f6b630ffb22d66caab202a52aa8cbb10c649 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA7D1W CVE: CVE-2024-38624 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- For example, in the expression: vbo = 2 * vbo + skip Fixes: b46acd6a6a627 ("fs/ntfs3: Add NTFS journal") Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Conflicts: fs/ntfs3/fslog.c [The `r_page` allocation position is changed] Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- fs/ntfs3/fslog.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c index 6489953d4617..e6e38d4c582f 100644 --- a/fs/ntfs3/fslog.c +++ b/fs/ntfs3/fslog.c @@ -1179,7 +1179,8 @@ static int read_log_page(struct ntfs_log *log, u32 vbo, static int log_read_rst(struct ntfs_log *log, u32 l_size, bool first, struct restart_info *info) { - u32 skip, vbo; + u32 skip; + u64 vbo; struct RESTART_HDR *r_page = kmalloc(DefaultLogPageSize, GFP_NOFS); if (!r_page) -- 2.34.3

2 1

[PATCH OLK-5.10] fs/ntfs3: Use 64 bit variable to avoid 32 bit overflow
by Wang Zhaolong 26 Jun '24

26 Jun '24

From: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> mainline inclusion from mainline-v6.10-rc1 commit e931f6b630ffb22d66caab202a52aa8cbb10c649 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA7D1W CVE: CVE-2024-38624 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- For example, in the expression: vbo = 2 * vbo + skip Fixes: b46acd6a6a627 ("fs/ntfs3: Add NTFS journal") Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Conflicts: fs/ntfs3/fslog.c [The `r_page` allocation position is changed] Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- fs/ntfs3/fslog.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c index 6489953d4617..e6e38d4c582f 100644 --- a/fs/ntfs3/fslog.c +++ b/fs/ntfs3/fslog.c @@ -1179,7 +1179,8 @@ static int read_log_page(struct ntfs_log *log, u32 vbo, static int log_read_rst(struct ntfs_log *log, u32 l_size, bool first, struct restart_info *info) { - u32 skip, vbo; + u32 skip; + u64 vbo; struct RESTART_HDR *r_page = kmalloc(DefaultLogPageSize, GFP_NOFS); if (!r_page) -- 2.34.3

2 1

[PATCH OLK-6.6] fs/ntfs3: Use 64 bit variable to avoid 32 bit overflow
by Wang Zhaolong 26 Jun '24

26 Jun '24

From: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> mainline inclusion from mainline-v6.10-rc1 commit e931f6b630ffb22d66caab202a52aa8cbb10c649 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA7D1W CVE: CVE-2024-38624 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- For example, in the expression: vbo = 2 * vbo + skip Fixes: b46acd6a6a627 ("fs/ntfs3: Add NTFS journal") Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- fs/ntfs3/fslog.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/ntfs3/fslog.c b/fs/ntfs3/fslog.c index 855519713bf7..4085fe30bf48 100644 --- a/fs/ntfs3/fslog.c +++ b/fs/ntfs3/fslog.c @@ -1184,7 +1184,8 @@ static int read_log_page(struct ntfs_log *log, u32 vbo, static int log_read_rst(struct ntfs_log *log, bool first, struct restart_info *info) { - u32 skip, vbo; + u32 skip; + u64 vbo; struct RESTART_HDR *r_page = NULL; /* Determine which restart area we are looking for. */ -- 2.34.3

2 1