- Kernel - mailweb.openeuler.org

[OLK-5.10] ocfs2: free inode when ocfs2_get_init_inode() fails
by Jinjie Ruan 28 Dec '24

28 Dec '24

From: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> stable inclusion from stable-v5.10.231 commit 9c19ea59965ebb482e227532f7bbb01792fb028c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAN4 CVE: CVE-2024-56630 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------------------------- [ Upstream commit 965b5dd1894f4525f38c1b5f99b0106a07dbb5db ] syzbot is reporting busy inodes after unmount, for commit 9c89fe0af826 ("ocfs2: Handle error from dquot_initialize()") forgot to call iput() when new_inode() succeeded and dquot_initialize() failed. Link: https://lkml.kernel.org/r/e68c0224-b7c6-4784-b4fa-a9fc8c675525@I-love.SAKUR… Fixes: 9c89fe0af826 ("ocfs2: Handle error from dquot_initialize()") Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Reported-by: syzbot+0af00f6a2cba2058b5db(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=0af00f6a2cba2058b5db Tested-by: syzbot+0af00f6a2cba2058b5db(a)syzkaller.appspotmail.com Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Jun Piao <piaojun(a)huawei.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- fs/ocfs2/namei.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c index 5c98813b3dca..a1d7f62975bd 100644 --- a/fs/ocfs2/namei.c +++ b/fs/ocfs2/namei.c @@ -201,8 +201,10 @@ static struct inode *ocfs2_get_init_inode(struct inode *dir, umode_t mode) mode = mode_strip_sgid(dir, mode); inode_init_owner(inode, dir, mode); status = dquot_initialize(inode); - if (status) + if (status) { + iput(inode); return ERR_PTR(status); + } return inode; } -- 2.34.1

1 0

[OLK-6.6] ocfs2: free inode when ocfs2_get_init_inode() fails
by Jinjie Ruan 28 Dec '24

28 Dec '24

From: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> stable inclusion from stable-v6.6.66 commit a84d507d3290aca249b44ae992af9e10590cc5f6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEAN4 CVE: CVE-2024-56630 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 965b5dd1894f4525f38c1b5f99b0106a07dbb5db ] syzbot is reporting busy inodes after unmount, for commit 9c89fe0af826 ("ocfs2: Handle error from dquot_initialize()") forgot to call iput() when new_inode() succeeded and dquot_initialize() failed. Link: https://lkml.kernel.org/r/e68c0224-b7c6-4784-b4fa-a9fc8c675525@I-love.SAKUR… Fixes: 9c89fe0af826 ("ocfs2: Handle error from dquot_initialize()") Signed-off-by: Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> Reported-by: syzbot+0af00f6a2cba2058b5db(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=0af00f6a2cba2058b5db Tested-by: syzbot+0af00f6a2cba2058b5db(a)syzkaller.appspotmail.com Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Jun Piao <piaojun(a)huawei.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- fs/ocfs2/namei.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c index 21b3d5b9be60..4e6d8a3f727d 100644 --- a/fs/ocfs2/namei.c +++ b/fs/ocfs2/namei.c @@ -200,8 +200,10 @@ static struct inode *ocfs2_get_init_inode(struct inode *dir, umode_t mode) mode = mode_strip_sgid(&nop_mnt_idmap, dir, mode); inode_init_owner(&nop_mnt_idmap, inode, dir, mode); status = dquot_initialize(inode); - if (status) + if (status) { + iput(inode); return ERR_PTR(status); + } return inode; } -- 2.34.1

1 0

[PATCH OLK-6.6 0/2] CVE-2024-53230
by Jinjie Ruan 28 Dec '24

28 Dec '24

CVE-2024-53230. Jinjie Ruan (2): cpufreq: CPPC: Fix possible null-ptr-deref for cppc_get_cpu_cost() cpufreq: CPPC: Fix wrong return value in cppc_get_cpu_cost() drivers/cpufreq/cppc_cpufreq.c | 3 +++ 1 file changed, 3 insertions(+) -- 2.34.1

2 3

[openeuler:openEuler-1.0-LTS 1355/1355] drivers/irqchip/irq-gic-phytium-2500.c:172:29: sparse: sparse: dereference of noderef expression
by kernel test robot 28 Dec '24

28 Dec '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: d7e5d3f944b7f5d2cee0b8e46a829a04dd6066f3 commit: 7981e396b80981a5757aae9b858bb480e940838a [1355/1355] irqchip: phytium-2500: Add interrupt controller driver config: arm64-randconfig-r133-20241227 (https://download.01.org/0day-ci/archive/20241228/202412281248.l2Nmmpui-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce: (https://download.01.org/0day-ci/archive/20241228/202412281248.l2Nmmpui-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412281248.l2Nmmpui-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/irqchip/irq-gic-phytium-2500.c:172:29: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500.c:194:17: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500.c:271:24: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500.c:290:24: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500.c:140:24: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500.c:510:24: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500.c:796:17: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500.c:797:17: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500.c:983:17: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500.c: In function 'gic_cpumask_select': drivers/irqchip/irq-gic-phytium-2500.c:1112:26: warning: comparison of unsigned expression in '>= 0' is always true [-Wtype-limits] 1112 | if ((skt >= 0) && (skt < MAX_MARS3_SOC_COUNT)) | ^~ drivers/irqchip/irq-gic-phytium-2500.c:1137:26: warning: comparison of unsigned expression in '>= 0' is always true [-Wtype-limits] 1137 | if ((skt >= 0) && (skt < MAX_MARS3_SOC_COUNT)) { | ^~ In file included from arch/arm64/include/asm/cputype.h:125, from arch/arm64/include/asm/cache.h:19, from include/linux/cache.h:6, from include/linux/printk.h:9, from include/linux/kernel.h:14, from include/linux/list.h:9, from include/linux/resource_ext.h:17, from include/linux/acpi.h:26, from drivers/irqchip/irq-gic-phytium-2500.c:22: drivers/irqchip/irq-gic-phytium-2500.c: In function 'gic_cpu_sys_reg_init': arch/arm64/include/asm/sysreg.h:769:9: warning: this statement may fall through [-Wimplicit-fallthrough=] 769 | asm volatile(__msr_s(r, "%x0") : : "rZ" (__val)); 29- | ^~~ arch/arm64/include/asm/arch_gicv3.h:31:41: note: in expansion of macro 'write_sysreg_s' 31 | #define write_gicreg(v, r) write_sysreg_s(v, SYS_ ## r) | ^~~~~~~~~~~~~~ drivers/irqchip/irq-gic-phytium-2500.c:903:25: note: in expansion of macro 'write_gicreg' 903 | write_gicreg(0, ICC_AP0R2_EL1); | ^~~~~~~~~~~~ drivers/irqchip/irq-gic-phytium-2500.c:904:17: note: here 904 | case 6: | ^~~~ arch/arm64/include/asm/sysreg.h:769:9: warning: this statement may fall through [-Wimplicit-fallthrough=] 769 | asm volatile(__msr_s(r, "%x0") : : "rZ" (__val)); 41- | ^~~ arch/arm64/include/asm/arch_gicv3.h:31:41: note: in expansion of macro 'write_sysreg_s' 31 | #define write_gicreg(v, r) write_sysreg_s(v, SYS_ ## r) | ^~~~~~~~~~~~~~ drivers/irqchip/irq-gic-phytium-2500.c:905:25: note: in expansion of macro 'write_gicreg' 905 | write_gicreg(0, ICC_AP0R1_EL1); | ^~~~~~~~~~~~ drivers/irqchip/irq-gic-phytium-2500.c:906:17: note: here 906 | case 5: | ^~~~ arch/arm64/include/asm/sysreg.h:769:9: warning: this statement may fall through [-Wimplicit-fallthrough=] 769 | asm volatile(__msr_s(r, "%x0") : : "rZ" (__val)); 53- | ^~~ arch/arm64/include/asm/arch_gicv3.h:31:41: note: in expansion of macro 'write_sysreg_s' 31 | #define write_gicreg(v, r) write_sysreg_s(v, SYS_ ## r) | ^~~~~~~~~~~~~~ drivers/irqchip/irq-gic-phytium-2500.c:918:17: note: in expansion of macro 'write_gicreg' 918 | write_gicreg(0, ICC_AP1R2_EL1); | ^~~~~~~~~~~~ drivers/irqchip/irq-gic-phytium-2500.c:919:9: note: here 919 | case 6: | ^~~~ arch/arm64/include/asm/sysreg.h:769:9: warning: this statement may fall through [-Wimplicit-fallthrough=] 769 | asm volatile(__msr_s(r, "%x0") : : "rZ" (__val)); 65- | ^~~ arch/arm64/include/asm/arch_gicv3.h:31:41: note: in expansion of macro 'write_sysreg_s' 31 | #define write_gicreg(v, r) write_sysreg_s(v, SYS_ ## r) | ^~~~~~~~~~~~~~ drivers/irqchip/irq-gic-phytium-2500.c:920:17: note: in expansion of macro 'write_gicreg' 920 | write_gicreg(0, ICC_AP1R1_EL1); | ^~~~~~~~~~~~ drivers/irqchip/irq-gic-phytium-2500.c:921:9: note: here 921 | case 5: | ^~~~ -- drivers/irqchip/irq-gic-phytium-2500-its.c:1736:23: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:1736:23: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:2123:15: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:2123:15: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:2318:26: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:2318:26: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:3804:19: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:3804:19: sparse: sparse: dereference of noderef expression >> drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: got restricted __le64 [usertype] >> drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: got restricted __le64 [usertype] >> drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: got restricted __le64 [usertype] >> drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: got restricted __le64 [usertype] >> drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: got restricted __le64 [usertype] >> drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: got restricted __le64 [usertype] >> drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: got restricted __le64 [usertype] >> drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: got restricted __le64 [usertype] >> drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: got restricted __le64 [usertype] >> drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: got restricted __le64 [usertype] >> drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: got restricted __le64 [usertype] >> drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: got restricted __le64 [usertype] >> drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: got restricted __le64 [usertype] >> drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: got restricted __le64 [usertype] >> drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: got restricted __le64 [usertype] >> drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:431:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:432:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:433:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: sparse: incorrect type in assignment (different base types) @@ expected unsigned long long @@ got restricted __le64 [usertype] @@ drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: expected unsigned long long drivers/irqchip/irq-gic-phytium-2500-its.c:434:25: sparse: got restricted __le64 [usertype] drivers/irqchip/irq-gic-phytium-2500-its.c:1736:23: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:1736:23: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:1736:23: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:2123:15: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:2123:15: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:2123:15: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:2148:17: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:2179:31: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:2184:13: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:2194:40: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:2195:17: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:2200:21: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:2253:43: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:2279:9: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:2280:9: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:2315:26: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:2318:26: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:2318:26: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:2318:26: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:2873:26: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:2920:35: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:2952:35: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:3030:26: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:3070:26: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:3804:19: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:3804:19: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:3804:19: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:3809:31: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c:3829:13: sparse: sparse: dereference of noderef expression drivers/irqchip/irq-gic-phytium-2500-its.c: In function 'its_cpumask_select': drivers/irqchip/irq-gic-phytium-2500-its.c:1169:26: warning: comparison of unsigned expression in '>= 0' is always true [-Wtype-limits] 1169 | if ((skt >= 0) && (skt < MAX_MARS3_SKT_COUNT)) | ^~ drivers/irqchip/irq-gic-phytium-2500-its.c:1195:26: warning: comparison of unsigned expression in '>= 0' is always true [-Wtype-limits] 1195 | if ((skt >= 0) && (skt < MAX_MARS3_SKT_COUNT)) { | ^~ drivers/irqchip/irq-gic-phytium-2500-its.c: In function 'its_cpu_init_collection': drivers/irqchip/irq-gic-phytium-2500-its.c:2289:29: warning: variable 'skt_id' set but not used [-Wunused-but-set-variable] 2289 | unsigned long mpid, skt_id; | ^~~~~~ drivers/irqchip/irq-gic-phytium-2500-its.c:2289:23: warning: variable 'mpid' set but not used [-Wunused-but-set-variable] 2289 | unsigned long mpid, skt_id; | ^~~~ drivers/irqchip/irq-gic-phytium-2500-its.c: In function 'its_cpumask_first': drivers/irqchip/irq-gic-phytium-2500-its.c:2679:26: warning: comparison of unsigned expression in '>= 0' is always true [-Wtype-limits] 2679 | if ((skt >= 0) && (skt < MAX_MARS3_SKT_COUNT)) | ^~ drivers/irqchip/irq-gic-phytium-2500-its.c:2705:26: warning: comparison of unsigned expression in '>= 0' is always true [-Wtype-limits] 2705 | if ((skt >= 0) && (skt < MAX_MARS3_SKT_COUNT)) { | ^~ vim +172 drivers/irqchip/irq-gic-phytium-2500.c 168 169 /* Wait for completion of a redistributor change */ 170 static void gic_redist_wait_for_rwp(void) 171 { > 172 gic_do_wait_for_rwp(gic_data_rdist_rd_base()); 173 } 174 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] ALSA: usb-audio: Fix out of bounds reads when finding clock sources
by Luo Gengkun 28 Dec '24

28 Dec '24

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v6.6.64 commit 74cb86e1006c5437b1d90084d22018da30fddc77 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBDHGG CVE: CVE-2024-53150 Reference: https://git.kernel.org/stable/c/74cb86e1006c5437b1d90084d22018da30fddc77 -------------------------------- commit a3dd4d63eeb452cfb064a13862fb376ab108f6a6 upstream. The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, when a device provides a bogus descriptor with a shorter bLength, the driver might hit out-of-bounds reads. For addressing it, this patch adds sanity checks to the validator functions for the clock descriptor traversal. When the descriptor length is shorter than expected, it's skipped in the loop. For the clock source and clock multiplier descriptors, we can just check bLength against the sizeof() of each descriptor type. OTOH, the clock selector descriptor of UAC2 and UAC3 has an array of bNrInPins elements and two more fields at its tail, hence those have to be checked in addition to the sizeof() check. Reported-by: Benoît Sevens <bsevens(a)google.com> Cc: <stable(a)vger.kernel.org> Link: https://lore.kernel.org/20241121140613.3651-1-bsevens@google.com Link: https://patch.msgid.link/20241125144629.20757-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- sound/usb/clock.c | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) diff --git a/sound/usb/clock.c b/sound/usb/clock.c index a676ad093d18..f0f1e445cc56 100644 --- a/sound/usb/clock.c +++ b/sound/usb/clock.c @@ -36,6 +36,12 @@ union uac23_clock_multiplier_desc { struct uac_clock_multiplier_descriptor v3; }; +/* check whether the descriptor bLength has the minimal length */ +#define DESC_LENGTH_CHECK(p, proto) \ + ((proto) == UAC_VERSION_3 ? \ + ((p)->v3.bLength >= sizeof((p)->v3)) : \ + ((p)->v2.bLength >= sizeof((p)->v2))) + #define GET_VAL(p, proto, field) \ ((proto) == UAC_VERSION_3 ? (p)->v3.field : (p)->v2.field) @@ -58,6 +64,8 @@ static bool validate_clock_source(void *p, int id, int proto) { union uac23_clock_source_desc *cs = p; + if (!DESC_LENGTH_CHECK(cs, proto)) + return false; return GET_VAL(cs, proto, bClockID) == id; } @@ -65,13 +73,27 @@ static bool validate_clock_selector(void *p, int id, int proto) { union uac23_clock_selector_desc *cs = p; - return GET_VAL(cs, proto, bClockID) == id; + if (!DESC_LENGTH_CHECK(cs, proto)) + return false; + if (GET_VAL(cs, proto, bClockID) != id) + return false; + /* additional length check for baCSourceID array (in bNrInPins size) + * and two more fields (which sizes depend on the protocol) + */ + if (proto == UAC_VERSION_3) + return cs->v3.bLength >= sizeof(cs->v3) + cs->v3.bNrInPins + + 4 /* bmControls */ + 2 /* wCSelectorDescrStr */; + else + return cs->v2.bLength >= sizeof(cs->v2) + cs->v2.bNrInPins + + 1 /* bmControls */ + 1 /* iClockSelector */; } static bool validate_clock_multiplier(void *p, int id, int proto) { union uac23_clock_multiplier_desc *cs = p; + if (!DESC_LENGTH_CHECK(cs, proto)) + return false; return GET_VAL(cs, proto, bClockID) == id; } -- 2.34.1

2 1

[PATCH OLK-6.6 0/9] mm: Backport mainline patch
by Liu Shixin 28 Dec '24

28 Dec '24

Patch[8] has context conflict. David Hildenbrand (1): mm: don't install PMD mappings when THPs are disabled by the hw/process/vma Jingbo Xu (2): mm: fix arithmetic for bdi min_ratio mm: fix arithmetic for max_prop_frac when setting max_ratio Kefeng Wang (1): mm: huge_memory: add vma_thp_disabled() and thp_disabled_by_hw() Liu Shixin (4): mm: kmemleak: split __create_object into two functions mm: kmemleak: use mem_pool_free() to free object mm: kmemleak: add __find_and_remove_object() mm/kmemleak: fix partially freeing unknown object warning Xueshi Hu (1): mm/hugetlb: fix nodes huge page allocation when there are surplus pages include/linux/huge_mm.h | 18 ++++++ mm/huge_memory.c | 13 +---- mm/hugetlb.c | 4 +- mm/kmemleak.c | 126 ++++++++++++++++++++++++++++------------ mm/memory.c | 9 +++ mm/page-writeback.c | 4 +- mm/shmem.c | 7 +-- 7 files changed, 124 insertions(+), 57 deletions(-) -- 2.34.1

2 10

[PATCH openEuler-22.03-LTS-SP1] ALSA: usb-audio: Fix out of bounds reads when finding clock sources
by Luo Gengkun 28 Dec '24

28 Dec '24

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v5.10.231 commit 45a92cbc88e4013bfed7fd2ccab3ade45f8e896b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBDHGG CVE: CVE-2024-53150 Reference: https://git.kernel.org/stable/c/45a92cbc88e4013bfed7fd2ccab3ade45f8e896b -------------------------------- commit a3dd4d63eeb452cfb064a13862fb376ab108f6a6 upstream. The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, when a device provides a bogus descriptor with a shorter bLength, the driver might hit out-of-bounds reads. For addressing it, this patch adds sanity checks to the validator functions for the clock descriptor traversal. When the descriptor length is shorter than expected, it's skipped in the loop. For the clock source and clock multiplier descriptors, we can just check bLength against the sizeof() of each descriptor type. OTOH, the clock selector descriptor of UAC2 and UAC3 has an array of bNrInPins elements and two more fields at its tail, hence those have to be checked in addition to the sizeof() check. Reported-by: Benoît Sevens <bsevens(a)google.com> Cc: <stable(a)vger.kernel.org> Link: https://lore.kernel.org/20241121140613.3651-1-bsevens@google.com Link: https://patch.msgid.link/20241125144629.20757-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Benoît Sevens <bsevens(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- sound/usb/clock.c | 32 ++++++++++++++++++++++++++++++-- 1 file changed, 30 insertions(+), 2 deletions(-) diff --git a/sound/usb/clock.c b/sound/usb/clock.c index 95b019f15224..6ccea6d1727f 100644 --- a/sound/usb/clock.c +++ b/sound/usb/clock.c @@ -21,6 +21,10 @@ #include "clock.h" #include "quirks.h" +/* check whether the descriptor bLength has the minimal length */ +#define DESC_LENGTH_CHECK(p) \ + (p->bLength >= sizeof(*p)) + static void *find_uac_clock_desc(struct usb_host_interface *iface, int id, bool (*validator)(void *, int), u8 type) { @@ -38,36 +42,60 @@ static void *find_uac_clock_desc(struct usb_host_interface *iface, int id, static bool validate_clock_source_v2(void *p, int id) { struct uac_clock_source_descriptor *cs = p; + if (!DESC_LENGTH_CHECK(cs)) + return false; return cs->bClockID == id; } static bool validate_clock_source_v3(void *p, int id) { struct uac3_clock_source_descriptor *cs = p; + if (!DESC_LENGTH_CHECK(cs)) + return false; return cs->bClockID == id; } static bool validate_clock_selector_v2(void *p, int id) { struct uac_clock_selector_descriptor *cs = p; - return cs->bClockID == id; + if (!DESC_LENGTH_CHECK(cs)) + return false; + if (cs->bClockID != id) + return false; + /* additional length check for baCSourceID array (in bNrInPins size) + * and two more fields (which sizes depend on the protocol) + */ + return cs->bLength >= sizeof(*cs) + cs->bNrInPins + + 1 /* bmControls */ + 1 /* iClockSelector */; } static bool validate_clock_selector_v3(void *p, int id) { struct uac3_clock_selector_descriptor *cs = p; - return cs->bClockID == id; + if (!DESC_LENGTH_CHECK(cs)) + return false; + if (cs->bClockID != id) + return false; + /* additional length check for baCSourceID array (in bNrInPins size) + * and two more fields (which sizes depend on the protocol) + */ + return cs->bLength >= sizeof(*cs) + cs->bNrInPins + + 4 /* bmControls */ + 2 /* wCSelectorDescrStr */; } static bool validate_clock_multiplier_v2(void *p, int id) { struct uac_clock_multiplier_descriptor *cs = p; + if (!DESC_LENGTH_CHECK(cs)) + return false; return cs->bClockID == id; } static bool validate_clock_multiplier_v3(void *p, int id) { struct uac3_clock_multiplier_descriptor *cs = p; + if (!DESC_LENGTH_CHECK(cs)) + return false; return cs->bClockID == id; } -- 2.34.1

2 1

[PATCH OLK-6.6] ALSA: usb-audio: Fix out of bounds reads when finding clock sources
by Luo Gengkun 28 Dec '24

28 Dec '24

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v6.6.64 commit 74cb86e1006c5437b1d90084d22018da30fddc77 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBDHGG CVE: CVE-2024-53150 Reference: https://git.kernel.org/stable/c/74cb86e1006c5437b1d90084d22018da30fddc77 commit a3dd4d63eeb452cfb064a13862fb376ab108f6a6 upstream. The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, when a device provides a bogus descriptor with a shorter bLength, the driver might hit out-of-bounds reads. For addressing it, this patch adds sanity checks to the validator functions for the clock descriptor traversal. When the descriptor length is shorter than expected, it's skipped in the loop. For the clock source and clock multiplier descriptors, we can just check bLength against the sizeof() of each descriptor type. OTOH, the clock selector descriptor of UAC2 and UAC3 has an array of bNrInPins elements and two more fields at its tail, hence those have to be checked in addition to the sizeof() check. Reported-by: Benoît Sevens <bsevens(a)google.com> Cc: <stable(a)vger.kernel.org> Link: https://lore.kernel.org/20241121140613.3651-1-bsevens@google.com Link: https://patch.msgid.link/20241125144629.20757-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- sound/usb/clock.c | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) diff --git a/sound/usb/clock.c b/sound/usb/clock.c index a676ad093d18..f0f1e445cc56 100644 --- a/sound/usb/clock.c +++ b/sound/usb/clock.c @@ -36,6 +36,12 @@ union uac23_clock_multiplier_desc { struct uac_clock_multiplier_descriptor v3; }; +/* check whether the descriptor bLength has the minimal length */ +#define DESC_LENGTH_CHECK(p, proto) \ + ((proto) == UAC_VERSION_3 ? \ + ((p)->v3.bLength >= sizeof((p)->v3)) : \ + ((p)->v2.bLength >= sizeof((p)->v2))) + #define GET_VAL(p, proto, field) \ ((proto) == UAC_VERSION_3 ? (p)->v3.field : (p)->v2.field) @@ -58,6 +64,8 @@ static bool validate_clock_source(void *p, int id, int proto) { union uac23_clock_source_desc *cs = p; + if (!DESC_LENGTH_CHECK(cs, proto)) + return false; return GET_VAL(cs, proto, bClockID) == id; } @@ -65,13 +73,27 @@ static bool validate_clock_selector(void *p, int id, int proto) { union uac23_clock_selector_desc *cs = p; - return GET_VAL(cs, proto, bClockID) == id; + if (!DESC_LENGTH_CHECK(cs, proto)) + return false; + if (GET_VAL(cs, proto, bClockID) != id) + return false; + /* additional length check for baCSourceID array (in bNrInPins size) + * and two more fields (which sizes depend on the protocol) + */ + if (proto == UAC_VERSION_3) + return cs->v3.bLength >= sizeof(cs->v3) + cs->v3.bNrInPins + + 4 /* bmControls */ + 2 /* wCSelectorDescrStr */; + else + return cs->v2.bLength >= sizeof(cs->v2) + cs->v2.bNrInPins + + 1 /* bmControls */ + 1 /* iClockSelector */; } static bool validate_clock_multiplier(void *p, int id, int proto) { union uac23_clock_multiplier_desc *cs = p; + if (!DESC_LENGTH_CHECK(cs, proto)) + return false; return GET_VAL(cs, proto, bClockID) == id; } -- 2.34.1

2 1

[PATCH OLK-5.10] ALSA: usb-audio: Fix out of bounds reads when finding clock sources
by Luo Gengkun 28 Dec '24

28 Dec '24

From: Takashi Iwai <tiwai(a)suse.de> stable inclusion from stable-v5.10.231 commit 45a92cbc88e4013bfed7fd2ccab3ade45f8e896b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBDHGG CVE: CVE-2024-53150 Reference: https://git.kernel.org/stable/c/45a92cbc88e4013bfed7fd2ccab3ade45f8e896b -------------------------------- commit a3dd4d63eeb452cfb064a13862fb376ab108f6a6 upstream. The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, when a device provides a bogus descriptor with a shorter bLength, the driver might hit out-of-bounds reads. For addressing it, this patch adds sanity checks to the validator functions for the clock descriptor traversal. When the descriptor length is shorter than expected, it's skipped in the loop. For the clock source and clock multiplier descriptors, we can just check bLength against the sizeof() of each descriptor type. OTOH, the clock selector descriptor of UAC2 and UAC3 has an array of bNrInPins elements and two more fields at its tail, hence those have to be checked in addition to the sizeof() check. Reported-by: Benoît Sevens <bsevens(a)google.com> Cc: <stable(a)vger.kernel.org> Link: https://lore.kernel.org/20241121140613.3651-1-bsevens@google.com Link: https://patch.msgid.link/20241125144629.20757-1-tiwai@suse.de Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Benoît Sevens <bsevens(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- sound/usb/clock.c | 32 ++++++++++++++++++++++++++++++-- 1 file changed, 30 insertions(+), 2 deletions(-) diff --git a/sound/usb/clock.c b/sound/usb/clock.c index 95b019f15224..6ccea6d1727f 100644 --- a/sound/usb/clock.c +++ b/sound/usb/clock.c @@ -21,6 +21,10 @@ #include "clock.h" #include "quirks.h" +/* check whether the descriptor bLength has the minimal length */ +#define DESC_LENGTH_CHECK(p) \ + (p->bLength >= sizeof(*p)) + static void *find_uac_clock_desc(struct usb_host_interface *iface, int id, bool (*validator)(void *, int), u8 type) { @@ -38,36 +42,60 @@ static void *find_uac_clock_desc(struct usb_host_interface *iface, int id, static bool validate_clock_source_v2(void *p, int id) { struct uac_clock_source_descriptor *cs = p; + if (!DESC_LENGTH_CHECK(cs)) + return false; return cs->bClockID == id; } static bool validate_clock_source_v3(void *p, int id) { struct uac3_clock_source_descriptor *cs = p; + if (!DESC_LENGTH_CHECK(cs)) + return false; return cs->bClockID == id; } static bool validate_clock_selector_v2(void *p, int id) { struct uac_clock_selector_descriptor *cs = p; - return cs->bClockID == id; + if (!DESC_LENGTH_CHECK(cs)) + return false; + if (cs->bClockID != id) + return false; + /* additional length check for baCSourceID array (in bNrInPins size) + * and two more fields (which sizes depend on the protocol) + */ + return cs->bLength >= sizeof(*cs) + cs->bNrInPins + + 1 /* bmControls */ + 1 /* iClockSelector */; } static bool validate_clock_selector_v3(void *p, int id) { struct uac3_clock_selector_descriptor *cs = p; - return cs->bClockID == id; + if (!DESC_LENGTH_CHECK(cs)) + return false; + if (cs->bClockID != id) + return false; + /* additional length check for baCSourceID array (in bNrInPins size) + * and two more fields (which sizes depend on the protocol) + */ + return cs->bLength >= sizeof(*cs) + cs->bNrInPins + + 4 /* bmControls */ + 2 /* wCSelectorDescrStr */; } static bool validate_clock_multiplier_v2(void *p, int id) { struct uac_clock_multiplier_descriptor *cs = p; + if (!DESC_LENGTH_CHECK(cs)) + return false; return cs->bClockID == id; } static bool validate_clock_multiplier_v3(void *p, int id) { struct uac3_clock_multiplier_descriptor *cs = p; + if (!DESC_LENGTH_CHECK(cs)) + return false; return cs->bClockID == id; } -- 2.34.1

2 1

[openeuler:OLK-5.10 2589/2589] mm/page_counter.o: warning: objtool: page_counter_cancel()+0x84: unreachable instruction
by kernel test robot 28 Dec '24

28 Dec '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 053a6b6f8e4c86200cdb20bc80c063c3bb119859 commit: f330d897aed4d1dfde71f7e42f47063c34e775ae [2589/2589] mm: page_counter: mitigate consequences of a page_counter underflow config: x86_64-buildonly-randconfig-002-20241218 (https://download.01.org/0day-ci/archive/20241228/202412280914.VfeVCWRu-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241228/202412280914.VfeVCWRu-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202412280914.VfeVCWRu-lkp@intel.com/ All warnings (new ones prefixed by >>): >> mm/page_counter.o: warning: objtool: page_counter_cancel()+0x84: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

2025

2024

2023

2022

2021

2020

2019

Kernel