- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS 0/1] CVE-2024-42105
by Chen Ridong 08 Aug '24

08 Aug '24

*** BLURB HERE *** Ryusuke Konishi (1): nilfs2: fix inode number range checks fs/nilfs2/nilfs.h | 5 +++-- fs/nilfs2/the_nilfs.c | 6 ++++++ fs/nilfs2/the_nilfs.h | 2 +- 3 files changed, 10 insertions(+), 3 deletions(-) -- 2.34.1

2 2

[PATCH OLK-5.10] wifi: mac80211: mesh: Fix leak of mesh_preq_queue objects
by Yue Haibing 08 Aug '24

08 Aug '24

From: Nicolas Escande <nico.escande(a)gmail.com> stable inclusion from stable-v5.10.221 commit 7518e20a189f8659b8b83969db4d33a4068fcfc3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAD0PK CVE: CVE-2024-40942 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit b7d7f11a291830fdf69d3301075dd0fb347ced84 ] The hwmp code use objects of type mesh_preq_queue, added to a list in ieee80211_if_mesh, to keep track of mpath we need to resolve. If the mpath gets deleted, ex mesh interface is removed, the entries in that list will never get cleaned. Fix this by flushing all corresponding items of the preq_queue in mesh_path_flush_pending(). This should take care of KASAN reports like this: unreferenced object 0xffff00000668d800 (size 128): comm "kworker/u8:4", pid 67, jiffies 4295419552 (age 1836.444s) hex dump (first 32 bytes): 00 1f 05 09 00 00 ff ff 00 d5 68 06 00 00 ff ff ..........h..... 8e 97 ea eb 3e b8 01 00 00 00 00 00 00 00 00 00 ....>........... backtrace: [<000000007302a0b6>] __kmem_cache_alloc_node+0x1e0/0x35c [<00000000049bd418>] kmalloc_trace+0x34/0x80 [<0000000000d792bb>] mesh_queue_preq+0x44/0x2a8 [<00000000c99c3696>] mesh_nexthop_resolve+0x198/0x19c [<00000000926bf598>] ieee80211_xmit+0x1d0/0x1f4 [<00000000fc8c2284>] __ieee80211_subif_start_xmit+0x30c/0x764 [<000000005926ee38>] ieee80211_subif_start_xmit+0x9c/0x7a4 [<000000004c86e916>] dev_hard_start_xmit+0x174/0x440 [<0000000023495647>] __dev_queue_xmit+0xe24/0x111c [<00000000cfe9ca78>] batadv_send_skb_packet+0x180/0x1e4 [<000000007bacc5d5>] batadv_v_elp_periodic_work+0x2f4/0x508 [<00000000adc3cd94>] process_one_work+0x4b8/0xa1c [<00000000b36425d1>] worker_thread+0x9c/0x634 [<0000000005852dd5>] kthread+0x1bc/0x1c4 [<000000005fccd770>] ret_from_fork+0x10/0x20 unreferenced object 0xffff000009051f00 (size 128): comm "kworker/u8:4", pid 67, jiffies 4295419553 (age 1836.440s) hex dump (first 32 bytes): 90 d6 92 0d 00 00 ff ff 00 d8 68 06 00 00 ff ff ..........h..... 36 27 92 e4 02 e0 01 00 00 58 79 06 00 00 ff ff 6'.......Xy..... backtrace: [<000000007302a0b6>] __kmem_cache_alloc_node+0x1e0/0x35c [<00000000049bd418>] kmalloc_trace+0x34/0x80 [<0000000000d792bb>] mesh_queue_preq+0x44/0x2a8 [<00000000c99c3696>] mesh_nexthop_resolve+0x198/0x19c [<00000000926bf598>] ieee80211_xmit+0x1d0/0x1f4 [<00000000fc8c2284>] __ieee80211_subif_start_xmit+0x30c/0x764 [<000000005926ee38>] ieee80211_subif_start_xmit+0x9c/0x7a4 [<000000004c86e916>] dev_hard_start_xmit+0x174/0x440 [<0000000023495647>] __dev_queue_xmit+0xe24/0x111c [<00000000cfe9ca78>] batadv_send_skb_packet+0x180/0x1e4 [<000000007bacc5d5>] batadv_v_elp_periodic_work+0x2f4/0x508 [<00000000adc3cd94>] process_one_work+0x4b8/0xa1c [<00000000b36425d1>] worker_thread+0x9c/0x634 [<0000000005852dd5>] kthread+0x1bc/0x1c4 [<000000005fccd770>] ret_from_fork+0x10/0x20 Fixes: 050ac52cbe1f ("mac80211: code for on-demand Hybrid Wireless Mesh Protocol") Signed-off-by: Nicolas Escande <nico.escande(a)gmail.com> Link: https://msgid.link/20240528142605.1060566-1-nico.escande@gmail.com Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yue Haibing <yuehaibing(a)huawei.com> --- net/mac80211/mesh_pathtbl.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c index d936ef0c17a3..72ecce377d17 100644 --- a/net/mac80211/mesh_pathtbl.c +++ b/net/mac80211/mesh_pathtbl.c @@ -723,10 +723,23 @@ void mesh_path_discard_frame(struct ieee80211_sub_if_data *sdata, */ void mesh_path_flush_pending(struct mesh_path *mpath) { + struct ieee80211_sub_if_data *sdata = mpath->sdata; + struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh; + struct mesh_preq_queue *preq, *tmp; struct sk_buff *skb; while ((skb = skb_dequeue(&mpath->frame_queue)) != NULL) mesh_path_discard_frame(mpath->sdata, skb); + + spin_lock_bh(&ifmsh->mesh_preq_queue_lock); + list_for_each_entry_safe(preq, tmp, &ifmsh->preq_queue.list, list) { + if (ether_addr_equal(mpath->dst, preq->dst)) { + list_del(&preq->list); + kfree(preq); + --ifmsh->preq_queue_len; + } + } + spin_unlock_bh(&ifmsh->mesh_preq_queue_lock); } /** -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] tcp_metrics: validate source addr length
by Yue Haibing 08 Aug '24

08 Aug '24

From: Jakub Kicinski <kuba(a)kernel.org> stable inclusion from stable-v4.19.318 commit 19d997b59fa1fd7a02e770ee0881c0652b9c32c9 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAGRRM CVE: CVE-2024-42154 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 66be40e622e177316ae81717aa30057ba9e61dff ] I don't see anything checking that TCP_METRICS_ATTR_SADDR_IPV4 is at least 4 bytes long, and the policy doesn't have an entry for this attribute at all (neither does it for IPv6 but v6 is manually validated). Reviewed-by: Eric Dumazet <edumazet(a)google.com> Fixes: 3e7013ddf55a ("tcp: metrics: Allow selective get/del of tcp-metrics based on src IP") Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yue Haibing <yuehaibing(a)huawei.com> --- net/ipv4/tcp_metrics.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c index 60619b1f4acd..1bfbb8f8e0b7 100644 --- a/net/ipv4/tcp_metrics.c +++ b/net/ipv4/tcp_metrics.c @@ -624,6 +624,7 @@ static const struct nla_policy tcp_metrics_nl_policy[TCP_METRICS_ATTR_MAX + 1] = [TCP_METRICS_ATTR_ADDR_IPV4] = { .type = NLA_U32, }, [TCP_METRICS_ATTR_ADDR_IPV6] = { .type = NLA_BINARY, .len = sizeof(struct in6_addr), }, + [TCP_METRICS_ATTR_SADDR_IPV4] = { .type = NLA_U32, }, /* Following attributes are not received for GET/DEL, * we keep them for reference */ -- 2.34.1

2 1

[openeuler:OLK-5.10] BUILD SUCCESS 4cb0169858cd0655e7998cf312142f76a0f5e63a
by kernel test robot 08 Aug '24

08 Aug '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-5.10 branch HEAD: 4cb0169858cd0655e7998cf312142f76a0f5e63a !10761 leds: an30259a: Use devm_mutex_init() for mutex initialization elapsed time: 725m configs tested: 35 configs skipped: 137 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 defconfig gcc-14.1.0 arm64 randconfig-001-20240807 gcc-14.1.0 arm64 randconfig-002-20240807 clang-17 arm64 randconfig-003-20240807 clang-15 arm64 randconfig-004-20240807 clang-20 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240808 gcc-12 x86_64 buildonly-randconfig-002-20240808 gcc-12 x86_64 buildonly-randconfig-003-20240808 clang-18 x86_64 buildonly-randconfig-004-20240808 clang-18 x86_64 buildonly-randconfig-005-20240808 clang-18 x86_64 buildonly-randconfig-006-20240808 clang-18 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240808 gcc-12 x86_64 randconfig-002-20240808 clang-18 x86_64 randconfig-003-20240808 gcc-12 x86_64 randconfig-004-20240808 clang-18 x86_64 randconfig-005-20240808 clang-18 x86_64 randconfig-006-20240808 clang-18 x86_64 randconfig-011-20240808 clang-18 x86_64 randconfig-012-20240808 gcc-12 x86_64 randconfig-013-20240808 gcc-12 x86_64 randconfig-014-20240808 clang-18 x86_64 randconfig-015-20240808 gcc-12 x86_64 randconfig-016-20240808 clang-18 x86_64 randconfig-071-20240808 clang-18 x86_64 randconfig-072-20240808 clang-18 x86_64 randconfig-073-20240808 clang-18 x86_64 randconfig-074-20240808 gcc-12 x86_64 randconfig-075-20240808 clang-18 x86_64 randconfig-076-20240808 gcc-12 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6 0/2] dummy_struct_ops selftest failed
by Pu Lehui 08 Aug '24

08 Aug '24

Pu Lehui (2): Revert "[Backport] selftests/bpf: dummy_st_ops should reject 0 for non-nullable params" Revert "[Backport] selftests/bpf: adjust dummy_st_ops_success to detect additional error" .../selftests/bpf/prog_tests/dummy_st_ops.c | 27 ------------------- .../bpf/progs/dummy_st_ops_success.c | 13 ++------- 2 files changed, 2 insertions(+), 38 deletions(-) -- 2.34.1

2 3

[openeuler:openEuler-1.0-LTS] BUILD SUCCESS c84d316d6a7855966d34b7a68685020ba964419f
by kernel test robot 08 Aug '24

08 Aug '24

tree/branch: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS branch HEAD: c84d316d6a7855966d34b7a68685020ba964419f !10700 ethernet: Fix error handling in xemaclite_of_probe Warning reports: https://lore.kernel.org/oe-kbuild-all/202408080045.jCIFyHQH-lkp@intel.com Warning ids grouped by kconfigs: recent_errors |-- arm64-randconfig-001-20240807 | |-- include-linux-rbtree.h:warning:p-may-be-used-uninitialized | `-- include-linux-rbtree.h:warning:parent-may-be-used-uninitialized `-- x86_64-buildonly-randconfig-005-20240807 |-- drivers-net-ethernet-netswift-ngbe-.tmp_ngbe_lib.o:warning:objtool:missing-symbol-for-section-.text `-- drivers-net-ethernet-netswift-ngbe-.tmp_ngbe_sriov.o:warning:objtool:missing-symbol-for-section-.text elapsed time: 726m configs tested: 34 configs skipped: 128 The following configs have been built successfully. More configs may be tested in the coming days. tested configs: arm64 allmodconfig gcc-14.1.0 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240807 gcc-14.1.0 arm64 randconfig-002-20240807 gcc-14.1.0 arm64 randconfig-003-20240807 gcc-14.1.0 arm64 randconfig-004-20240807 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240807 clang-18 x86_64 buildonly-randconfig-002-20240807 clang-18 x86_64 buildonly-randconfig-003-20240807 clang-18 x86_64 buildonly-randconfig-004-20240807 clang-18 x86_64 buildonly-randconfig-005-20240807 clang-18 x86_64 buildonly-randconfig-006-20240807 clang-18 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240807 clang-18 x86_64 randconfig-002-20240807 gcc-12 x86_64 randconfig-003-20240807 clang-18 x86_64 randconfig-004-20240807 gcc-12 x86_64 randconfig-005-20240807 gcc-12 x86_64 randconfig-006-20240807 gcc-12 x86_64 randconfig-011-20240807 clang-18 x86_64 randconfig-012-20240807 gcc-12 x86_64 randconfig-013-20240807 gcc-12 x86_64 randconfig-014-20240807 gcc-12 x86_64 randconfig-015-20240807 clang-18 x86_64 randconfig-016-20240807 clang-18 x86_64 randconfig-071-20240807 clang-18 x86_64 randconfig-072-20240807 clang-18 x86_64 randconfig-073-20240807 gcc-12 x86_64 randconfig-074-20240807 clang-18 x86_64 randconfig-075-20240807 gcc-12 x86_64 randconfig-076-20240807 clang-18 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6] BUILD REGRESSION f6c27c52d818e09203f05ffe8bfc2fe3f0b8a976
by kernel test robot 08 Aug '24

08 Aug '24

tree/branch: https://gitee.com/openeuler/kernel.git OLK-6.6 branch HEAD: f6c27c52d818e09203f05ffe8bfc2fe3f0b8a976 !10772 s390/pkey: Use kfree_sensitive() to fix Coccinelle warnings Error/Warning ids grouped by kconfigs: recent_errors |-- arm64-allmodconfig | |-- arch-arm64-kvm-arm.c:warning:variable-r-is-used-uninitialized-whenever-if-condition-is-false | |-- arch-arm64-kvm-tmi.c:warning:no-previous-prototype-for-function-tmi_tmm_inf_test | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_create_ttt_levels | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_get_num_brps | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_get_num_wrps | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_ipa_limit | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_populate_par_region | |-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_supports_pmu | `-- arch-arm64-kvm-virtcca_cvm.c:warning:no-previous-prototype-for-function-kvm_cvm_supports_sve |-- arm64-randconfig-051-20240807 | |-- arch-arm64-boot-dts-qcom-sa8775p-ride.dtb:ethernet:Unevaluated-properties-are-not-allowed-(-dma-coherent-mdio-phy-handle-phy-mode-power-domains-rx-fifo-depth-rx-queues-config-snps-mtl-rx-config-snps-m | `-- arch-arm64-boot-dts-qcom-sa8775p-ride.dtb:ethernet:Unevaluated-properties-are-not-allowed-(-dma-coherent-phy-handle-phy-mode-power-domains-rx-fifo-depth-rx-queues-config-snps-mtl-rx-config-snps-mtl-tx |-- loongarch-allmodconfig | `-- arch-loongarch-kvm-..-..-..-virt-kvm-kvm_main.c:warning:kvmalloc_array-sizes-specified-with-sizeof-in-the-earlier-argument-and-not-in-the-later-argument |-- loongarch-randconfig-001-20240807 | `-- include-linux-mmzone.h:error:error-Allocator-MAX_ORDER-exceeds-SECTION_SIZE |-- loongarch-randconfig-002-20240807 | `-- include-linux-mmzone.h:error:error-Allocator-MAX_ORDER-exceeds-SECTION_SIZE |-- x86_64-allyesconfig | `-- drivers-gpu-drm-amd-amdgpu-..-amdkfd-kfd_topology.c:warning:stack-frame-size-()-exceeds-limit-()-in-kfd_topology_add_device |-- x86_64-buildonly-randconfig-003-20240807 | `-- kernel-sched-isolation.c:error:use-of-undeclared-identifier-setup_max_cpus |-- x86_64-buildonly-randconfig-004-20240807 | `-- kernel-sched-isolation.c:error:use-of-undeclared-identifier-setup_max_cpus |-- x86_64-buildonly-randconfig-005-20240807 | `-- kernel-sched-isolation.c:error:use-of-undeclared-identifier-setup_max_cpus `-- x86_64-buildonly-randconfig-006-20240807 `-- kernel-sched-isolation.c:error:use-of-undeclared-identifier-setup_max_cpus elapsed time: 722m configs tested: 38 configs skipped: 124 tested configs: arm64 allmodconfig clang-20 arm64 allnoconfig gcc-14.1.0 arm64 randconfig-001-20240807 gcc-14.1.0 arm64 randconfig-002-20240807 clang-17 arm64 randconfig-003-20240807 clang-15 arm64 randconfig-004-20240807 clang-20 loongarch allmodconfig gcc-14.1.0 loongarch allnoconfig gcc-14.1.0 loongarch randconfig-001-20240807 gcc-14.1.0 loongarch randconfig-002-20240807 gcc-14.1.0 x86_64 allnoconfig clang-18 x86_64 allyesconfig clang-18 x86_64 buildonly-randconfig-001-20240807 clang-18 x86_64 buildonly-randconfig-002-20240807 clang-18 x86_64 buildonly-randconfig-003-20240807 clang-18 x86_64 buildonly-randconfig-004-20240807 clang-18 x86_64 buildonly-randconfig-005-20240807 clang-18 x86_64 buildonly-randconfig-006-20240807 clang-18 x86_64 defconfig gcc-11 x86_64 randconfig-001-20240807 clang-18 x86_64 randconfig-002-20240807 gcc-12 x86_64 randconfig-003-20240807 clang-18 x86_64 randconfig-004-20240807 gcc-12 x86_64 randconfig-005-20240807 gcc-12 x86_64 randconfig-006-20240807 gcc-12 x86_64 randconfig-011-20240807 clang-18 x86_64 randconfig-012-20240807 gcc-12 x86_64 randconfig-013-20240807 gcc-12 x86_64 randconfig-014-20240807 gcc-12 x86_64 randconfig-015-20240807 clang-18 x86_64 randconfig-016-20240807 clang-18 x86_64 randconfig-071-20240807 clang-18 x86_64 randconfig-072-20240807 clang-18 x86_64 randconfig-073-20240807 gcc-12 x86_64 randconfig-074-20240807 clang-18 x86_64 randconfig-075-20240807 gcc-12 x86_64 randconfig-076-20240807 clang-18 x86_64 rhel-8.3-rust clang-18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 18554/23462] drivers/net/ethernet/netswift/ngbe/.tmp_ngbe_lib.o: warning: objtool: missing symbol for section .text
by kernel test robot 08 Aug '24

08 Aug '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: c84d316d6a7855966d34b7a68685020ba964419f commit: 206f9c11a8c8b0197da5a26859d96d2ed65f5757 [18554/23462] net: ngbe: Add Netswift Giga NIC driver config: x86_64-buildonly-randconfig-005-20240807 (https://download.01.org/0day-ci/archive/20240808/202408080045.jCIFyHQH-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240808/202408080045.jCIFyHQH-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408080045.jCIFyHQH-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/net/ethernet/netswift/ngbe/ngbe_lib.c:19: drivers/net/ethernet/netswift/ngbe/ngbe.h:764:6: warning: variable 'cur_diff' set but not used [-Wunused-but-set-variable] 764 | u32 cur_diff = 0; | ^ 1 warning generated. >> drivers/net/ethernet/netswift/ngbe/.tmp_ngbe_lib.o: warning: objtool: missing symbol for section .text -- In file included from drivers/net/ethernet/netswift/ngbe/ngbe_sriov.c:30: drivers/net/ethernet/netswift/ngbe/ngbe.h:764:6: warning: variable 'cur_diff' set but not used [-Wunused-but-set-variable] 764 | u32 cur_diff = 0; | ^ 1 warning generated. >> drivers/net/ethernet/netswift/ngbe/.tmp_ngbe_sriov.o: warning: objtool: missing symbol for section .text -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-1.0-LTS] s390/pkey: Wipe sensitive data on failure
by Peng Zhang 07 Aug '24

07 Aug '24

From: Holger Dengler <dengler(a)linux.ibm.com> mainline inclusion from mainline-v6.10-rc1 commit 1d8c270de5eb74245d72325d285894a577a945d9 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGSLY CVE: CVE-2024-42157 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------------------------------------- Wipe sensitive data from stack also if the copy_to_user() fails. Suggested-by: Heiko Carstens <hca(a)linux.ibm.com> Reviewed-by: Harald Freudenberger <freude(a)linux.ibm.com> Reviewed-by: Ingo Franzki <ifranzki(a)linux.ibm.com> Acked-by: Heiko Carstens <hca(a)linux.ibm.com> Signed-off-by: Holger Dengler <dengler(a)linux.ibm.com> Signed-off-by: Alexander Gordeev <agordeev(a)linux.ibm.com> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> --- drivers/s390/crypto/pkey_api.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/s390/crypto/pkey_api.c b/drivers/s390/crypto/pkey_api.c index b16344479959..fa97e666f19e 100644 --- a/drivers/s390/crypto/pkey_api.c +++ b/drivers/s390/crypto/pkey_api.c @@ -1089,7 +1089,7 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd, if (rc) break; if (copy_to_user(ucs, &kcs, sizeof(kcs))) - return -EFAULT; + rc = -EFAULT; memzero_explicit(&kcs, sizeof(kcs)); break; } @@ -1120,7 +1120,7 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd, if (rc) break; if (copy_to_user(ucp, &kcp, sizeof(kcp))) - return -EFAULT; + rc = -EFAULT; memzero_explicit(&kcp, sizeof(kcp)); break; } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] media: dvb-frontends: tda10048: Fix integer overflow
by Yi Yang 07 Aug '24

07 Aug '24

From: Ricardo Ribalda <ribalda(a)chromium.org> stable inclusion from stable-v4.19.318 commit 8167e4d7dc086d4f7ca7897dcff3827e4d22c99a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGSNO CVE: CVE-2024-42223 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 1aa1329a67cc214c3b7bd2a14d1301a795760b07 ] state->xtal_hz can be up to 16M, so it can overflow a 32 bit integer when multiplied by pll_mfactor. Create a new 64 bit variable to hold the calculations. Link: https://lore.kernel.org/linux-media/20240429-fix-cocci-v3-25-3c4865f5a4b0@c… Reported-by: Dan Carpenter <dan.carpenter(a)linaro.org> Signed-off-by: Ricardo Ribalda <ribalda(a)chromium.org> Signed-off-by: Mauro Carvalho Chehab <mchehab(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/media/dvb-frontends/tda10048.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/drivers/media/dvb-frontends/tda10048.c b/drivers/media/dvb-frontends/tda10048.c index c01d60a88af2..9e6a20fcac76 100644 --- a/drivers/media/dvb-frontends/tda10048.c +++ b/drivers/media/dvb-frontends/tda10048.c @@ -422,6 +422,7 @@ static int tda10048_set_if(struct dvb_frontend *fe, u32 bw) struct tda10048_config *config = &state->config; int i; u32 if_freq_khz; + u64 sample_freq; dprintk(1, "%s(bw = %d)\n", __func__, bw); @@ -463,9 +464,11 @@ static int tda10048_set_if(struct dvb_frontend *fe, u32 bw) dprintk(1, "- pll_pfactor = %d\n", state->pll_pfactor); /* Calculate the sample frequency */ - state->sample_freq = state->xtal_hz * (state->pll_mfactor + 45); - state->sample_freq /= (state->pll_nfactor + 1); - state->sample_freq /= (state->pll_pfactor + 4); + sample_freq = state->xtal_hz; + sample_freq *= state->pll_mfactor + 45; + do_div(sample_freq, state->pll_nfactor + 1); + do_div(sample_freq, state->pll_pfactor + 4); + state->sample_freq = sample_freq; dprintk(1, "- sample_freq = %d\n", state->sample_freq); /* Update the I/F */ -- 2.25.1

2 1