From: Takashi Iwai <tiwai(a)suse.de>
stable inclusion
from stable-v6.6.64
commit 74cb86e1006c5437b1d90084d22018da30fddc77
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBDHGG
CVE: CVE-2024-53150
Reference: https://git.kernel.org/stable/c/74cb86e1006c5437b1d90084d22018da30fddc77
commit a3dd4d63eeb452cfb064a13862fb376ab108f6a6 upstream.
The current USB-audio driver code doesn't check bLength of each
descriptor at traversing for clock descriptors. That is, when a
device provides a bogus descriptor with a shorter bLength, the driver
might hit out-of-bounds reads.
For addressing it, this patch adds sanity checks to the validator
functions for the clock descriptor traversal. When the descriptor
length is shorter than expected, it's skipped in the loop.
For the clock source and clock multiplier descriptors, we can just
check bLength against the sizeof() of each descriptor type.
OTOH, the clock selector descriptor of UAC2 and UAC3 has an array
of bNrInPins elements and two more fields at its tail, hence those
have to be checked in addition to the sizeof() check.
Reported-by: Benoît Sevens <bsevens(a)google.com>
Cc: <stable(a)vger.kernel.org>
Link: https://lore.kernel.org/20241121140613.3651-1-bsevens@google.com
Link: https://patch.msgid.link/20241125144629.20757-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai(a)suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com>
---
sound/usb/clock.c | 24 +++++++++++++++++++++++-
1 file changed, 23 insertions(+), 1 deletion(-)
diff --git a/sound/usb/clock.c b/sound/usb/clock.c
index a676ad093d18..f0f1e445cc56 100644
--- a/sound/usb/clock.c
+++ b/sound/usb/clock.c
@@ -36,6 +36,12 @@ union uac23_clock_multiplier_desc {
struct uac_clock_multiplier_descriptor v3;
};
+/* check whether the descriptor bLength has the minimal length */
+#define DESC_LENGTH_CHECK(p, proto) \
+ ((proto) == UAC_VERSION_3 ? \
+ ((p)->v3.bLength >= sizeof((p)->v3)) : \
+ ((p)->v2.bLength >= sizeof((p)->v2)))
+
#define GET_VAL(p, proto, field) \
((proto) == UAC_VERSION_3 ? (p)->v3.field : (p)->v2.field)
@@ -58,6 +64,8 @@ static bool validate_clock_source(void *p, int id, int proto)
{
union uac23_clock_source_desc *cs = p;
+ if (!DESC_LENGTH_CHECK(cs, proto))
+ return false;
return GET_VAL(cs, proto, bClockID) == id;
}
@@ -65,13 +73,27 @@ static bool validate_clock_selector(void *p, int id, int proto)
{
union uac23_clock_selector_desc *cs = p;
- return GET_VAL(cs, proto, bClockID) == id;
+ if (!DESC_LENGTH_CHECK(cs, proto))
+ return false;
+ if (GET_VAL(cs, proto, bClockID) != id)
+ return false;
+ /* additional length check for baCSourceID array (in bNrInPins size)
+ * and two more fields (which sizes depend on the protocol)
+ */
+ if (proto == UAC_VERSION_3)
+ return cs->v3.bLength >= sizeof(cs->v3) + cs->v3.bNrInPins +
+ 4 /* bmControls */ + 2 /* wCSelectorDescrStr */;
+ else
+ return cs->v2.bLength >= sizeof(cs->v2) + cs->v2.bNrInPins +
+ 1 /* bmControls */ + 1 /* iClockSelector */;
}
static bool validate_clock_multiplier(void *p, int id, int proto)
{
union uac23_clock_multiplier_desc *cs = p;
+ if (!DESC_LENGTH_CHECK(cs, proto))
+ return false;
return GET_VAL(cs, proto, bClockID) == id;
}
--
2.34.1
Hi fangbaoshun,
FYI, the error/warning still remains.
tree: https://gitee.com/openeuler/kernel.git OLK-6.6
head: 16a0cbac6609f8ba10a91a9d52b15bf28243c3ee
commit: 1c3b1095a26ed8bc1aa7ac3d4e8dd3e65964a74b [1667/1667] KVM: SVM: Add KVM_CSV_COMMAND_BATCH command for applying CSV RING_BUFFER mode
config: x86_64-randconfig-102-20241227 (https://download.01.org/0day-ci/archive/20241227/202412270855.zkm1zix6-lkp@…)
compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241227/202412270855.zkm1zix6-lkp@…)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp(a)intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202412270855.zkm1zix6-lkp@intel.com/
All errors (new ones prefixed by >>):
In file included from arch/x86/kvm/svm/sev.c:12:
In file included from include/linux/kvm_host.h:16:
In file included from include/linux/mm.h:2235:
include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion]
522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_"
| ~~~~~~~~~~~ ^ ~~~
>> arch/x86/kvm/svm/sev.c:2200:18: error: no member named 'false' in 'struct hygon_kvm_hooks_table'
2200 | hygon_kvm_hooks.sev_enabled = &sev_enabled;
| ~~~~~~~~~~~~~~~ ^
arch/x86/kvm/svm/sev.c:66:21: note: expanded from macro 'sev_enabled'
66 | #define sev_enabled false
| ^
>> arch/x86/kvm/svm/sev.c:2200:32: error: cannot take the address of an rvalue of type 'int'
2200 | hygon_kvm_hooks.sev_enabled = &sev_enabled;
| ^~~~~~~~~~~~
arch/x86/kvm/svm/sev.c:2198:6: warning: no previous prototype for function 'sev_install_hooks' [-Wmissing-prototypes]
2198 | void sev_install_hooks(void)
| ^
arch/x86/kvm/svm/sev.c:2198:1: note: declare 'static' if the function is not intended to be used outside of this translation unit
2198 | void sev_install_hooks(void)
| ^
| static
2 warnings and 2 errors generated.
vim +2200 arch/x86/kvm/svm/sev.c
2195
2196 #ifdef CONFIG_HYGON_CSV
2197 /* Code to set all of the function and vaiable pointers */
2198 void sev_install_hooks(void)
2199 {
> 2200 hygon_kvm_hooks.sev_enabled = &sev_enabled;
2201 hygon_kvm_hooks.sev_issue_cmd = sev_issue_cmd;
2202 hygon_kvm_hooks.get_num_contig_pages = get_num_contig_pages;
2203 hygon_kvm_hooks.sev_pin_memory = sev_pin_memory;
2204 hygon_kvm_hooks.sev_unpin_memory = sev_unpin_memory;
2205
2206 hygon_kvm_hooks.sev_hooks_installed = true;
2207 }
2208 #endif
2209
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
tree: https://gitee.com/openeuler/kernel.git OLK-6.6
head: 16a0cbac6609f8ba10a91a9d52b15bf28243c3ee
commit: 621647ce254f1d347ae9bc3d328c09cbb2732487 [1667/1667] mm: support periodical memory reclaim
config: loongarch-randconfig-r121-20241227 (https://download.01.org/0day-ci/archive/20241227/202412270644.ScfyxcPp-lkp@…)
compiler: loongarch64-linux-gcc (GCC) 14.2.0
reproduce: (https://download.01.org/0day-ci/archive/20241227/202412270644.ScfyxcPp-lkp@…)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp(a)intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202412270644.ScfyxcPp-lkp@intel.com/
sparse warnings: (new ones prefixed by >>)
>> mm/page_cache_limit.c:35:5: sparse: sparse: symbol 'cache_reclaim_enable_handler' was not declared. Should it be static?
>> mm/page_cache_limit.c:51:5: sparse: sparse: symbol 'cache_reclaim_sysctl_handler' was not declared. Should it be static?
vim +/cache_reclaim_enable_handler +35 mm/page_cache_limit.c
34
> 35 int cache_reclaim_enable_handler(struct ctl_table *table, int write,
36 void *buffer, size_t *length, loff_t *ppos)
37 {
38 int ret;
39
40 ret = proc_dointvec_minmax(table, write, buffer, length, ppos);
41 if (ret || !write)
42 return ret;
43
44 if (should_periodical_reclaim())
45 schedule_delayed_work(&shepherd, round_jiffies_relative(
46 (unsigned long)vm_cache_reclaim_s * HZ));
47
48 return 0;
49 }
50
> 51 int cache_reclaim_sysctl_handler(struct ctl_table *table, int write,
52 void *buffer, size_t *length, loff_t *ppos)
53 {
54 int ret;
55
56 ret = proc_dointvec_minmax(table, write, buffer, length, ppos);
57 if (ret || !write)
58 return ret;
59
60 if (should_periodical_reclaim())
61 mod_delayed_work(system_unbound_wq, &shepherd,
62 round_jiffies_relative(
63 (unsigned long)vm_cache_reclaim_s * HZ));
64
65 return ret;
66 }
67
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
tree: https://gitee.com/openeuler/kernel.git OLK-6.6
head: 16a0cbac6609f8ba10a91a9d52b15bf28243c3ee
commit: 08d91e70564c8af05a673fef3dbae0b2278529fd [1667/1667] i2c: smbus: Add support for Zhaoxin SMBUS controller
config: arm64-randconfig-r111-20241227 (https://download.01.org/0day-ci/archive/20241227/202412270617.vikLQkom-lkp@…)
compiler: aarch64-linux-gcc (GCC) 14.2.0
reproduce: (https://download.01.org/0day-ci/archive/20241227/202412270617.vikLQkom-lkp@…)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp(a)intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202412270617.vikLQkom-lkp@intel.com/
All warnings (new ones prefixed by >>):
>> drivers/i2c/busses/i2c-zhaoxin-smbus.c:367:36: warning: 'zxsmb_acpi_match' defined but not used [-Wunused-const-variable=]
367 | static const struct acpi_device_id zxsmb_acpi_match[] = {
| ^~~~~~~~~~~~~~~~
Kconfig warnings: (for reference only)
WARNING: unmet direct dependencies detected for PGP_PRELOAD
Depends on [n]: CRYPTO [=y] && ASYMMETRIC_KEY_TYPE [=n]
Selected by [y]:
- PGP_PRELOAD_PUBLIC_KEYS [=y] && CRYPTO [=y]
vim +/zxsmb_acpi_match +367 drivers/i2c/busses/i2c-zhaoxin-smbus.c
366
> 367 static const struct acpi_device_id zxsmb_acpi_match[] = {
368 {"SMB3324", 0 },
369 { }
370 };
371 MODULE_DEVICE_TABLE(acpi, zxsmb_acpi_match);
372
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki