- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10 0/1] fix CVE-2024-27001 for 5.10
by Wupeng Ma 09 May '24

09 May '24

From: Ma Wupeng <mawupeng1(a)huawei.com> fix CVE-2024-27001 for 5.10. Nikita Zhandarovich (1): comedi: vmk80xx: fix incomplete endpoint checking drivers/staging/comedi/drivers/vmk80xx.c | 35 ++++++++---------------- 1 file changed, 12 insertions(+), 23 deletions(-) -- 2.25.1

2 2

[openeuler:openEuler-1.0-LTS 21328/22325] drivers/scsi/sssraid/sssraid_os.o: warning: objtool: missing symbol for section .init.text
by kernel test robot 09 May '24

09 May '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: c95e10512c79660564907e3ba0c6403dcbd99d18 commit: 2e2a4edd9d4a725c5474dc278b090913d9b5bfd5 [21328/22325] SCSI: SSSRAID: Support 3SNIC 3S5XX serial RAID/HBA controllers config: x86_64-buildonly-randconfig-005-20240509 (https://download.01.org/0day-ci/archive/20240509/202405091039.NCGh5Ism-lkp@…) compiler: gcc-11 (Ubuntu 11.4.0-4ubuntu1) 11.4.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240509/202405091039.NCGh5Ism-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405091039.NCGh5Ism-lkp@intel.com/ All warnings (new ones prefixed by >>): >> drivers/scsi/sssraid/sssraid_os.o: warning: objtool: missing symbol for section .init.text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] sched: programmable: Allow set tag for pid 1.
by Hui Tang 09 May '24

09 May '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9NQM5 CVE: NA -------------------------------- Signed-off-by: Hui Tang <tanghui20(a)huawei.com> --- fs/proc/base.c | 5 ----- 1 file changed, 5 deletions(-) diff --git a/fs/proc/base.c b/fs/proc/base.c index 78f41a207767..d6d3b9f55f46 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -3773,11 +3773,6 @@ static ssize_t pid_tag_write(struct file *file, const char __user *buf, if (!tsk) return -ESRCH; - if (unlikely(tsk->pid == 1)) { - err = -EPERM; - goto out; - } - err = kstrtol_from_user(buf, count, 0, &tag); if (err) goto out; -- 2.34.1

2 1

[PATCH OLK-5.10 0/2] fix CVE-2024-26865
by Zhengchao Shao 09 May '24

09 May '24

Fix CVE-2024-26865. Eric Dumazet (1): tcp: Fix NEW_SYN_RECV handling in inet_twsk_purge() Kuniyuki Iwashima (1): tcp: Clean up kernel listener's reqsk in inet_twsk_purge() net/ipv4/inet_timewait_sock.c | 31 ++++++++++++++++++++----------- 1 file changed, 20 insertions(+), 11 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS v2 0/2] net: ath9k: fix CVE-2024-26897
by Dong Chenchen 09 May '24

09 May '24

fix CVE-2024-26897 Tetsuo Handa (1): ath9k_htc: fix NULL pointer dereference at ath9k_htc_tx_get_packet() Toke Høiland-Jørgensen (1): wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete drivers/net/wireless/ath/ath9k/htc.h | 1 + drivers/net/wireless/ath/ath9k/htc_drv_init.c | 4 ++++ drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 1 + drivers/net/wireless/ath/ath9k/wmi.c | 6 ++++++ 4 files changed, 12 insertions(+) -- 2.25.1

2 3

[PATCH v3 openEuler-1.0-LTS 0/2] Fix CVE-2022-48693
by Li Huafei 09 May '24

09 May '24

v2->v3: - Modify patch format: add 'category' and 'Reference' Liang He (1): soc: brcmstb: pm-arm: Fix refcount leak and __iomem leak bugs Miaoqian Lin (1): soc: bcm: brcmstb: pm: pm-arm: Fix refcount leak in brcmstb_pm_probe drivers/soc/bcm/brcmstb/pm/pm-arm.c | 51 ++++++++++++++++++++++------- 1 file changed, 40 insertions(+), 11 deletions(-) -- 2.25.1

2 3

[PATCH OLK-6.6 0/6] Fixes and cleanups to fs-writeback
by Zhihao Cheng 09 May '24

09 May '24

From: Zhihao Cheng <chengzhihao(a)huaweicloud.com> Kemeng Shi (6): fs/writeback: avoid to writeback non-expired inode in kupdate writeback fs/writeback: bail out if there is no more inodes for IO and queued once fs/writeback: remove unused parameter wb of finish_writeback_work fs/writeback: only calculate dirtied_before when b_io is empty fs/writeback: correct comment of __wakeup_flusher_threads_bdi fs/writeback: remove unnecessary return in writeback_inodes_sb fs/fs-writeback.c | 57 +++++++++++++++++++++++++++-------------------- 1 file changed, 33 insertions(+), 24 deletions(-) -- 2.31.1

2 7

[PATCH openEuler-1.0-LTS V1] nilfs2: fix OOB in nilfs_set_de_type
by Cheng Yu 09 May '24

09 May '24

From: Jeongjun Park <aha310510(a)gmail.com> mainline inclusion from mainline-v6.9-rc5 commit c4a7dc9523b59b3e73fd522c73e95e072f876b16 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L5GD CVE: CVE-2024-26981 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The size of the nilfs_type_by_mode array in the fs/nilfs2/dir.c file is defined as "S_IFMT >> S_SHIFT", but the nilfs_set_de_type() function, which uses this array, specifies the index to read from the array in the same way as "(mode & S_IFMT) >> S_SHIFT". static void nilfs_set_de_type(struct nilfs_dir_entry *de, struct inode *inode) { umode_t mode = inode->i_mode; de->file_type = nilfs_type_by_mode[(mode & S_IFMT)>>S_SHIFT]; // oob } However, when the index is determined this way, an out-of-bounds (OOB) error occurs by referring to an index that is 1 larger than the array size when the condition "mode & S_IFMT == S_IFMT" is satisfied. Therefore, a patch to resize the nilfs_type_by_mode array should be applied to prevent OOB errors. Link: https://lkml.kernel.org/r/20240415182048.7144-1-konishi.ryusuke@gmail.com Reported-by: syzbot+2e22057de05b9f3b30d8(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=2e22057de05b9f3b30d8 Fixes: 2ba466d74ed7 ("nilfs2: directory entry operations") Signed-off-by: Jeongjun Park <aha310510(a)gmail.com> Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Tested-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Cheng Yu <serein.chengyu(a)huawei.com> --- fs/nilfs2/dir.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/nilfs2/dir.c b/fs/nilfs2/dir.c index 81394e22d0a0..eb7de9e2a384 100644 --- a/fs/nilfs2/dir.c +++ b/fs/nilfs2/dir.c @@ -243,7 +243,7 @@ nilfs_filetype_table[NILFS_FT_MAX] = { #define S_SHIFT 12 static unsigned char -nilfs_type_by_mode[S_IFMT >> S_SHIFT] = { +nilfs_type_by_mode[(S_IFMT >> S_SHIFT) + 1] = { [S_IFREG >> S_SHIFT] = NILFS_FT_REG_FILE, [S_IFDIR >> S_SHIFT] = NILFS_FT_DIR, [S_IFCHR >> S_SHIFT] = NILFS_FT_CHRDEV, -- 2.25.1

2 1

[PATCH OLK-5.10] media: edia: dvbdev: fix a use-after-free
by liwei 09 May '24

09 May '24

From: Zhipeng Lu <alexious(a)zju.edu.cn> mainline inclusion from mainline-v6.9-rc1 commit 8c64f4cdf4e6cc5682c52523713af8c39c94e6d5 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L9MA CVE: CVE-2024-27043 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------------ In dvb_register_device, *pdvbdev is set equal to dvbdev, which is freed in several error-handling paths. However, *pdvbdev is not set to NULL after dvbdev's deallocation, causing use-after-frees in many places, for example, in the following call chain: budget_register |-> dvb_dmxdev_init |-> dvb_register_device |-> dvb_dmxdev_release |-> dvb_unregister_device |-> dvb_remove_device |-> dvb_device_put |-> kref_put When calling dvb_unregister_device, dmxdev->dvbdev (i.e. *pdvbdev in dvb_register_device) could point to memory that had been freed in dvb_register_device. Thereafter, this pointer is transferred to kref_put and triggering a use-after-free. Link: https://lore.kernel.org/linux-media/20240203134046.3120099-1-alexious@zju.e… Fixes: b61901024776 ("V4L/DVB (5244): Dvbdev: fix illegal re-usage of fileoperations struct") Signed-off-by: Zhipeng Lu <alexious(a)zju.edu.cn> Signed-off-by: Mauro Carvalho Chehab <mchehab(a)kernel.org> Signed-off-by: liwei <liwei728(a)huawei.com> --- drivers/media/dvb-core/dvbdev.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/media/dvb-core/dvbdev.c b/drivers/media/dvb-core/dvbdev.c index 2ff8a1b776fb..467be48b9004 100644 --- a/drivers/media/dvb-core/dvbdev.c +++ b/drivers/media/dvb-core/dvbdev.c @@ -502,6 +502,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, dvbdevfops = kmemdup(template->fops, sizeof(*dvbdevfops), GFP_KERNEL); if (!dvbdevfops) { kfree(dvbdev); + *pdvbdev = NULL; mutex_unlock(&dvbdev_register_lock); return -ENOMEM; } @@ -510,6 +511,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, if (!new_node) { kfree(dvbdevfops); kfree(dvbdev); + *pdvbdev = NULL; mutex_unlock(&dvbdev_register_lock); return -ENOMEM; } @@ -543,6 +545,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, } list_del (&dvbdev->list_head); kfree(dvbdev); + *pdvbdev = NULL; up_write(&minor_rwsem); mutex_unlock(&dvbdev_register_lock); return -EINVAL; @@ -565,6 +568,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, dvb_media_device_free(dvbdev); list_del (&dvbdev->list_head); kfree(dvbdev); + *pdvbdev = NULL; mutex_unlock(&dvbdev_register_lock); return ret; } @@ -583,6 +587,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, dvb_media_device_free(dvbdev); list_del (&dvbdev->list_head); kfree(dvbdev); + *pdvbdev = NULL; mutex_unlock(&dvbdev_register_lock); return PTR_ERR(clsdev); } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] clk: qcom: gcc-ipq8074: fix terminating of frequency table arrays
by Liu Chuang 09 May '24

09 May '24

From: Gabor Juhos <j4g8y7(a)gmail.com> stable inclusion from stable-v4.19.312 commit e117c6e2d1617520f5f7d7f6f6b395f01d8b5a27 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9NOH8 CVE: CVE-2024-26969 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1040ef5ed95d6fd2628bad387d78a61633e09429 ] The frequency table arrays are supposed to be terminated with an empty element. Add such entry to the end of the arrays where it is missing in order to avoid possible out-of-bound access when the table is traversed by functions like qcom_find_freq() or qcom_find_freq_floor(). Only compile tested. Fixes: 9607f6224b39 ("clk: qcom: ipq8074: add PCIE, USB and SDCC clocks") Signed-off-by: Gabor Juhos <j4g8y7(a)gmail.com> Reviewed-by: Stephen Boyd <sboyd(a)kernel.org> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240229-freq-table-terminator-v1-3-074334f0905c@… Signed-off-by: Bjorn Andersson <andersson(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- drivers/clk/qcom/gcc-ipq8074.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/clk/qcom/gcc-ipq8074.c b/drivers/clk/qcom/gcc-ipq8074.c index 505c6263141d..9a6f0c1159aa 100644 --- a/drivers/clk/qcom/gcc-ipq8074.c +++ b/drivers/clk/qcom/gcc-ipq8074.c @@ -985,6 +985,7 @@ static struct clk_rcg2 pcie0_axi_clk_src = { static const struct freq_tbl ftbl_pcie_aux_clk_src[] = { F(19200000, P_XO, 1, 0, 0), + { } }; static struct clk_rcg2 pcie0_aux_clk_src = { @@ -1090,6 +1091,7 @@ static const struct freq_tbl ftbl_sdcc_ice_core_clk_src[] = { F(19200000, P_XO, 1, 0, 0), F(160000000, P_GPLL0, 5, 0, 0), F(308570000, P_GPLL6, 3.5, 0, 0), + { } }; static struct clk_rcg2 sdcc1_ice_core_clk_src = { -- 2.34.1

2 1