- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] i2c: Fix a potential use after free
by Liu Chuang 28 Feb '24

28 Feb '24

From: Xu Wang <vulab(a)iscas.ac.cn> stable inclusion from stable-v4.19.307 commit 23a191b132cd87f746c62f3dc27da33683d85829 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I946KM CVE: CVE-2019-25162 Reference: https://git.kernel.org/stable/c/23a191b132cd87f746c62f3dc27da33683d85829 --------------------------------------------------------------- [ Upstream commit e4c72c06c367758a14f227c847f9d623f1994ecf ] Free the adap structure only after we are done using it. This patch just moves the put_device() down a bit to avoid the use after free. Fixes: 611e12ea0f12 ("i2c: core: manage i2c bus device refcount in i2c_[get|put]_adapter") Signed-off-by: Xu Wang <vulab(a)iscas.ac.cn> [wsa: added comment to the code, added Fixes tag] Signed-off-by: Wolfram Sang <wsa(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/i2c/i2c-core-base.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c index 2a43f4e46af0..9079be0d51d1 100644 --- a/drivers/i2c/i2c-core-base.c +++ b/drivers/i2c/i2c-core-base.c @@ -2273,8 +2273,9 @@ void i2c_put_adapter(struct i2c_adapter *adap) if (!adap) return; - put_device(&adap->dev); module_put(adap->owner); + /* Should be last, otherwise we risk use-after-free with 'adap' */ + put_device(&adap->dev); } EXPORT_SYMBOL(i2c_put_adapter); -- 2.34.1

2 1

[PATCH OLK-5.10 V2 0/2] Remove WQ_FLAG_BOOKMARK flag
by Zizhi Wo 27 Feb '24

27 Feb '24

Fix softlockup by removing the wait_queue flag: WQ_FLAG_BOOKMARK. Matthew Wilcox (Oracle) (2): filemap: remove use of wait bookmarks sched: remove wait bookmarks include/linux/wait.h | 7 ++---- kernel/sched/wait.c | 57 +++++++------------------------------------- mm/filemap.c | 21 +--------------- 3 files changed, 11 insertions(+), 74 deletions(-) -- 2.39.2

2 3

[PATCH] i2c: Fix a potential use after free
by Liu Chuang 27 Feb '24

27 Feb '24

From: Xu Wang <vulab(a)iscas.ac.cn> stable inclusion from stable-v4.19.307 commit 23a191b132cd87f746c62f3dc27da33683d85829 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I946KM CVE: CVE-2019-25162 Reference: https://git.kernel.org/stable/c/23a191b132cd87f746c62f3dc27da33683d85829 --------------------------------------------------------------- [ Upstream commit e4c72c06c367758a14f227c847f9d623f1994ecf ] Free the adap structure only after we are done using it. This patch just moves the put_device() down a bit to avoid the use after free. Fixes: 611e12ea0f12 ("i2c: core: manage i2c bus device refcount in i2c_[get|put]_adapter") Signed-off-by: Xu Wang <vulab(a)iscas.ac.cn> [wsa: added comment to the code, added Fixes tag] Signed-off-by: Wolfram Sang <wsa(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/i2c/i2c-core-base.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c index 2a43f4e46af0..9079be0d51d1 100644 --- a/drivers/i2c/i2c-core-base.c +++ b/drivers/i2c/i2c-core-base.c @@ -2273,8 +2273,9 @@ void i2c_put_adapter(struct i2c_adapter *adap) if (!adap) return; - put_device(&adap->dev); module_put(adap->owner); + /* Should be last, otherwise we risk use-after-free with 'adap' */ + put_device(&adap->dev); } EXPORT_SYMBOL(i2c_put_adapter); -- 2.34.1

1 0

[PATCH openEuler-1.0-LTS] binder: signal epoll threads of self-work
by Zhang Xiaoxu 27 Feb '24

27 Feb '24

From: Carlos Llamas <cmllamas(a)google.com> stable inclusion from stable-v4.19.307 commit dd64bb8329ce0ea27bc557e4160c2688835402ac category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93X0G CVE: CVE-2024-26606 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 97830f3c3088638ff90b20dfba2eb4d487bf14d7 upstream. In (e)poll mode, threads often depend on I/O events to determine when data is ready for consumption. Within binder, a thread may initiate a command via BINDER_WRITE_READ without a read buffer and then make use of epoll_wait() or similar to consume any responses afterwards. It is then crucial that epoll threads are signaled via wakeup when they queue their own work. Otherwise, they risk waiting indefinitely for an event leaving their work unhandled. What is worse, subsequent commands won't trigger a wakeup either as the thread has pending work. Fixes: 457b9a6f09f0 ("Staging: android: add binder driver") Cc: Arve Hjønnevåg <arve(a)android.com> Cc: Martijn Coenen <maco(a)android.com> Cc: Alice Ryhl <aliceryhl(a)google.com> Cc: Steven Moreland <smoreland(a)google.com> Cc: stable(a)vger.kernel.org # v4.19+ Signed-off-by: Carlos Llamas <cmllamas(a)google.com> Link: https://lore.kernel.org/r/20240131215347.1808751-1-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> --- drivers/android/binder.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/android/binder.c b/drivers/android/binder.c index 98c785ebfa5d..f98d84c5c695 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -880,6 +880,16 @@ binder_enqueue_thread_work_ilocked(struct binder_thread *thread, { WARN_ON(!list_empty(&thread->waiting_thread_node)); binder_enqueue_work_ilocked(work, &thread->todo); + + /* (e)poll-based threads require an explicit wakeup signal when + * queuing their own work; they rely on these events to consume + * messages without I/O block. Without it, threads risk waiting + * indefinitely without handling the work. + */ + if (thread->looper & BINDER_LOOPER_STATE_POLL && + thread->pid == current->pid && !thread->process_todo) + wake_up_interruptible_sync(&thread->wait); + thread->process_todo = true; } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/2] CVE-2023-52451
by Lin Yujun 27 Feb '24

27 Feb '24

*** BLURB HERE *** Laurent Dufour (1): powerpc/pseries/memhotplug: Quieten some DLPAR operations Nathan Lynch (1): powerpc/pseries/memhp: Fix access beyond end of drmem array .../platforms/pseries/hotplug-memory.c | 21 ++++++++++--------- 1 file changed, 11 insertions(+), 10 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] block: add check that partition length needs to be aligned with block size
by Li Lingfeng 27 Feb '24

27 Feb '24

From: Min Li <min15.li(a)samsung.com> mainline inclusion from mainline-v6.8-rc1 commit 6f64f866aa1ae6975c95d805ed51d7e9433a0016 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93EC9 CVE: CVE-2023-52458 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Before calling add partition or resize partition, there is no check on whether the length is aligned with the logical block size. If the logical block size of the disk is larger than 512 bytes, then the partition size maybe not the multiple of the logical block size, and when the last sector is read, bio_truncate() will adjust the bio size, resulting in an IO error if the size of the read command is smaller than the logical block size.If integrity data is supported, this will also result in a null pointer dereference when calling bio_integrity_free. Cc: <stable(a)vger.kernel.org> Signed-off-by: Min Li <min15.li(a)samsung.com> Reviewed-by: Damien Le Moal <dlemoal(a)kernel.org> Reviewed-by: Chaitanya Kulkarni <kch(a)nvidia.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Link: https://lore.kernel.org/r/20230629142517.121241-1-min15.li@samsung.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflict: block/ioctl.c commit 1a721de8489f ("block: don't add or resize partition on the disk with GENHD_FL_NO_PART") from mainline add check of GENHD_FL_NO_PART; commit 5fb889f587fa ("compat_ioctl: block: simplify compat_blkpg_ioctl()") from mainline remove blkpg_ioctl_arg; commit 1ae011cf0aa0 ("block: Fix the partition start may overflow in add_partition()") from hulk add check of start and length. Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- block/ioctl.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/block/ioctl.c b/block/ioctl.c index 9d0eeb1b0bbd..1d2b7f701288 100644 --- a/block/ioctl.c +++ b/block/ioctl.c @@ -16,7 +16,7 @@ static int blkpg_ioctl(struct block_device *bdev, struct blkpg_ioctl_arg __user { struct blkpg_ioctl_arg a; struct blkpg_partition p; - long long start, length; + sector_t start, length; if (!capable(CAP_SYS_ADMIN)) return -EACCES; @@ -35,6 +35,9 @@ static int blkpg_ioctl(struct block_device *bdev, struct blkpg_ioctl_arg __user if (p.start < 0 || p.length <= 0 || p.start + p.length < 0) return -EINVAL; + /* Check that the partition is aligned to the block size */ + if (!IS_ALIGNED(p.start | p.length, bdev_logical_block_size(bdev))) + return -EINVAL; start = p.start >> SECTOR_SHIFT; length = p.length >> SECTOR_SHIFT; @@ -54,9 +57,6 @@ static int blkpg_ioctl(struct block_device *bdev, struct blkpg_ioctl_arg __user switch (a.op) { case BLKPG_ADD_PARTITION: - /* check if partition is aligned to blocksize */ - if (p.start & (bdev_logical_block_size(bdev) - 1)) - return -EINVAL; return bdev_add_partition(bdev, p.pno, start, length); case BLKPG_RESIZE_PARTITION: return bdev_resize_partition(bdev, p.pno, start, length); -- 2.31.1

2 1

[PATCH] i2c: Fix a potential use after free
by Liu Chuang 27 Feb '24

27 Feb '24

From: Xu Wang <vulab(a)iscas.ac.cn> stable inclusion from stable-v4.19.307 commit 23a191b132cd87f746c62f3dc27da33683d85829 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I946KM CVE: CVE-2019-25162 --------------------------------------------------------------- [ Upstream commit e4c72c06c367758a14f227c847f9d623f1994ecf ] Free the adap structure only after we are done using it. This patch just moves the put_device() down a bit to avoid the use after free. Fixes: 611e12ea0f12 ("i2c: core: manage i2c bus device refcount in i2c_[get|put]_adapter") Signed-off-by: Xu Wang <vulab(a)iscas.ac.cn> [wsa: added comment to the code, added Fixes tag] Signed-off-by: Wolfram Sang <wsa(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/i2c/i2c-core-base.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c index 2a43f4e46af0..9079be0d51d1 100644 --- a/drivers/i2c/i2c-core-base.c +++ b/drivers/i2c/i2c-core-base.c @@ -2273,8 +2273,9 @@ void i2c_put_adapter(struct i2c_adapter *adap) if (!adap) return; - put_device(&adap->dev); module_put(adap->owner); + /* Should be last, otherwise we risk use-after-free with 'adap' */ + put_device(&adap->dev); } EXPORT_SYMBOL(i2c_put_adapter); -- 2.34.1

1 0

[PATCH OLK-5.10] KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache
by Jinjie Ruan 27 Feb '24

27 Feb '24

From: Oliver Upton <oliver.upton(a)linux.dev> stable inclusion from stable-v5.10.209 commit ba7be666740847d967822bed15500656b26bc703 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93EEI CVE: CVE-2024-26598 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- There is a potential UAF scenario in the case of an LPI translation cache hit racing with an operation that invalidates the cache, such as a DISCARD ITS command. The root of the problem is that vgic_its_check_cache() does not elevate the refcount on the vgic_irq before dropping the lock that serializes refcount changes. Have vgic_its_check_cache() raise the refcount on the returned vgic_irq and add the corresponding decrement after queueing the interrupt. Cc: stable(a)vger.kernel.org Signed-off-by: Oliver Upton <oliver.upton(a)linux.dev> Signed-off-by: Marc Zyngier <maz(a)kernel.org> Link: https://lore.kernel.org/r/20240104183233.3560639-1-oliver.upton@linux.dev --- arch/arm64/kvm/vgic/vgic-its.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/arch/arm64/kvm/vgic/vgic-its.c b/arch/arm64/kvm/vgic/vgic-its.c index ee3b9df60a59..9c7bd5a8aa35 100644 --- a/arch/arm64/kvm/vgic/vgic-its.c +++ b/arch/arm64/kvm/vgic/vgic-its.c @@ -601,7 +601,11 @@ static struct vgic_irq *vgic_its_check_cache(struct kvm *kvm, phys_addr_t db, cacheid = cpu % LPI_TRANS_CACHES_NUM; raw_spin_lock_irqsave(&dist->lpi_translation_cache[cacheid].lpi_cache_lock, flags); + irq = __vgic_its_check_cache(dist, db, devid, eventid, cacheid); + if (irq) + vgic_get_irq_kref(irq); + raw_spin_unlock_irqrestore(&dist->lpi_translation_cache[cacheid].lpi_cache_lock, flags); return irq; @@ -778,6 +782,7 @@ static int vgic_its_trigger_msi(struct kvm *kvm, struct vgic_its *its, raw_spin_lock_irqsave(&irq->irq_lock, flags); irq->pending_latch = true; vgic_queue_irq_unlock(kvm, irq, flags); + vgic_put_irq(kvm, irq); return 0; } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache
by Jinjie Ruan 27 Feb '24

27 Feb '24

From: Oliver Upton <oliver.upton(a)linux.dev> stable inclusion from stable-v5.10.209 commit ba7be666740847d967822bed15500656b26bc703 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I93EEI CVE: CVE-2024-26598 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- There is a potential UAF scenario in the case of an LPI translation cache hit racing with an operation that invalidates the cache, such as a DISCARD ITS command. The root of the problem is that vgic_its_check_cache() does not elevate the refcount on the vgic_irq before dropping the lock that serializes refcount changes. Have vgic_its_check_cache() raise the refcount on the returned vgic_irq and add the corresponding decrement after queueing the interrupt. Cc: stable(a)vger.kernel.org Signed-off-by: Oliver Upton <oliver.upton(a)linux.dev> Signed-off-by: Marc Zyngier <maz(a)kernel.org> Link: https://lore.kernel.org/r/20240104183233.3560639-1-oliver.upton@linux.dev Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- virt/kvm/arm/vgic/vgic-its.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/virt/kvm/arm/vgic/vgic-its.c b/virt/kvm/arm/vgic/vgic-its.c index e9a571673d87..392e02fca470 100644 --- a/virt/kvm/arm/vgic/vgic-its.c +++ b/virt/kvm/arm/vgic/vgic-its.c @@ -613,7 +613,11 @@ static struct vgic_irq *vgic_its_check_cache(struct kvm *kvm, phys_addr_t db, cacheid = cpu % LPI_TRANS_CACHES_NUM; raw_spin_lock_irqsave(&dist->lpi_translation_cache[cacheid].lpi_cache_lock, flags); + irq = __vgic_its_check_cache(dist, db, devid, eventid, cacheid); + if (irq) + vgic_get_irq_kref(irq); + raw_spin_unlock_irqrestore(&dist->lpi_translation_cache[cacheid].lpi_cache_lock, flags); return irq; @@ -809,6 +813,7 @@ int vgic_its_inject_cached_translation(struct kvm *kvm, struct kvm_msi *msi) raw_spin_lock_irqsave(&irq->irq_lock, flags); irq->pending_latch = true; vgic_queue_irq_unlock(kvm, irq, flags); + vgic_put_irq(kvm, irq); return 0; } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] Revert "memcg: fix a UAF problem in drain_all_stock()"
by GONG, Ruiqi 27 Feb '24

27 Feb '24

hulk inclusion category: bugfix bugzilla: 189183, https://gitee.com/openeuler/kernel/issues/I7Z1ZU CVE: NA -------------------------------- This reverts commit 616e708277a2 ("memcg: fix a UAF problem in drain_all_stock()"), which was produced based on HULK-7.5 and later was found to be not suitable for HULK-8.1/4.19. Signed-off-by: GONG, Ruiqi <gongruiqi1(a)huawei.com> --- mm/memcontrol.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 29d430885b1a..7dc68b1792ef 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -2232,7 +2232,8 @@ static void drain_all_stock(struct mem_cgroup *root_memcg) rcu_read_lock(); memcg = stock->cached; - if (memcg && mem_cgroup_is_descendant(memcg, root_memcg)) + if (memcg && stock->nr_pages && + mem_cgroup_is_descendant(memcg, root_memcg)) flush = true; rcu_read_unlock(); -- 2.25.1

2 1

2024

2023

2022

2021

2020

2019

Kernel