- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS 0/4] openeuler lts backport
by Xiaomeng Zhang 16 Aug '24

16 Aug '24

Haifeng Xu (1): perf/core: Fix missing wakeup when waiting for context reference Jeff Johnson (1): tracing: Add MODULE_DESCRIPTION() to preemptirq_delay_test Rik van Riel (1): fs/proc: fix softlockup in __read_vmcore Steven Rostedt (1): ASoC: tracing: Export SND_SOC_DAPM_DIR_OUT to its value fs/proc/vmcore.c | 2 ++ include/trace/events/asoc.h | 2 ++ kernel/events/core.c | 13 +++++++++++++ kernel/trace/preemptirq_delay_test.c | 1 + 4 files changed, 18 insertions(+) -- 2.34.1

2 5

[PATCH openEuler-22.03-LTS-SP1 0/2] Fix CVE-2024-36880
by Yi Yang 16 Aug '24

16 Aug '24

Fix CVE-2024-36880 for openEuler-22.03-LTS-SP1 Johan Hovold (2): Bluetooth: qca: add missing firmware sanity checks Bluetooth: qca: fix firmware check error path drivers/bluetooth/btqca.c | 36 ++++++++++++++++++++++++++++++------ 1 file changed, 30 insertions(+), 6 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10 0/2] Fix CVE-2024-36880
by Yi Yang 16 Aug '24

16 Aug '24

Fix CVE-2024-36880 for OLK-5.10 Johan Hovold (2): Bluetooth: qca: add missing firmware sanity checks Bluetooth: qca: fix firmware check error path drivers/bluetooth/btqca.c | 36 ++++++++++++++++++++++++++++++------ 1 file changed, 30 insertions(+), 6 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-22.03-LTS-SP1 0/1] CVE-2023-52868
by Chen Ridong 16 Aug '24

16 Aug '24

*** BLURB HERE *** Dan Carpenter (1): thermal: core: prevent potential string overflow drivers/thermal/thermal_core.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) -- 2.34.1

2 2

[openeuler:openEuler-1.0-LTS 9263/23498] drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dml1_display_rq_dlg_calc.o: warning: objtool: dml1_rq_dlg_get_dlg_params()+0x2f1c: unreachable instruction
by kernel test robot 16 Aug '24

16 Aug '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: c75f813072b1d42cc638d175e1a8e84835f383ee commit: f25433cb156a967d9b426ebaadf197c2369398e7 [9263/23498] drm/amd/display: readd -msse2 to prevent Clang from emitting libcalls to undefined SW FP routines config: x86_64-randconfig-104-20240816 (https://download.01.org/0day-ci/archive/20240816/202408161225.VySIKip3-lkp@…) compiler: clang version 18.1.5 (https://github.com/llvm/llvm-project 617a15a9eac96088ae5e9134248d8236e34b91b1) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240816/202408161225.VySIKip3-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202408161225.VySIKip3-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dml1_display_rq_dlg_calc.c:26: In file included from drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dml1_display_rq_dlg_calc.h:29: In file included from drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dml_common_defs.h:29: In file included from drivers/gpu/drm/amd/amdgpu/../display/dc/dm_services.h:35: In file included from drivers/gpu/drm/amd/amdgpu/../display/dc/dm_services_types.h:29: In file included from drivers/gpu/drm/amd/amdgpu/../display/dc/os_types.h:31: In file included from include/drm/drmP.h:62: In file included from arch/x86/include/asm/pgalloc.h:7: include/linux/pagemap.h:401:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 401 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 1 warning generated. >> drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dml1_display_rq_dlg_calc.o: warning: objtool: dml1_rq_dlg_get_dlg_params()+0x2f1c: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH openEuler-22.03-LTS-SP1 0/4] Fix CVE-2024-36031
by Yi Yang 16 Aug '24

16 Aug '24

Fix CVE-2024-36031 for openEuler-22.03-LTS-SP1 David Howells (2): keys, dns: Allow key types (eg. DNS) to be reclaimed immediately on expiry keys, dns: Fix size check of V1 server-list header Edward Adam Davis (1): keys, dns: Fix missing size check of V1 server-list header Silvio Gissi (1): keys: Fix overwrite of key expiration on instantiation include/linux/key-type.h | 1 + net/dns_resolver/dns_key.c | 25 ++++++++++++++++--------- security/keys/gc.c | 31 +++++++++++++++++++++---------- security/keys/internal.h | 11 ++++++++++- security/keys/key.c | 16 ++++++---------- security/keys/proc.c | 2 +- 6 files changed, 55 insertions(+), 31 deletions(-) -- 2.25.1

2 5

[PATCH openEuler-22.03-LTS-SP1] usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()
by Zeng Heng 16 Aug '24

16 Aug '24

From: Lee Jones <lee(a)kernel.org> mainline inclusion from mainline-v6.10 commit 6d3c721e686ea6c59e18289b400cc95c76e927e0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAILHF CVE: CVE-2024-42236 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Userspace provided string 's' could trivially have the length zero. Left unchecked this will firstly result in an OOB read in the form `if (str[0 - 1] == '\n') followed closely by an OOB write in the form `str[0 - 1] = '\0'`. There is already a validating check to catch strings that are too long. Let's supply an additional check for invalid strings that are too short. Signed-off-by: Lee Jones <lee(a)kernel.org> Cc: stable <stable(a)kernel.org> Link: https://lore.kernel.org/r/20240705074339.633717-1-lee@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: dengquan <dengquan9(a)huawei.com> --- drivers/usb/gadget/configfs.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c index d51ea1c052f2..6bb69a4e6470 100644 --- a/drivers/usb/gadget/configfs.c +++ b/drivers/usb/gadget/configfs.c @@ -104,9 +104,12 @@ static int usb_string_copy(const char *s, char **s_copy) int ret; char *str; char *copy = *s_copy; + ret = strlen(s); if (ret > USB_MAX_STRING_LEN) return -EOVERFLOW; + if (ret < 1) + return -EINVAL; if (copy) { str = copy; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()
by Zeng Heng 16 Aug '24

16 Aug '24

From: Lee Jones <lee(a)kernel.org> mainline inclusion from mainline-v6.10 commit 6d3c721e686ea6c59e18289b400cc95c76e927e0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAILHF CVE: CVE-2024-42236 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Userspace provided string 's' could trivially have the length zero. Left unchecked this will firstly result in an OOB read in the form `if (str[0 - 1] == '\n') followed closely by an OOB write in the form `str[0 - 1] = '\0'`. There is already a validating check to catch strings that are too long. Let's supply an additional check for invalid strings that are too short. Signed-off-by: Lee Jones <lee(a)kernel.org> Cc: stable <stable(a)kernel.org> Link: https://lore.kernel.org/r/20240705074339.633717-1-lee@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: dengquan <dengquan9(a)huawei.com> --- drivers/usb/gadget/configfs.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c index c85e64c0c39e..39a483b66484 100644 --- a/drivers/usb/gadget/configfs.c +++ b/drivers/usb/gadget/configfs.c @@ -114,9 +114,12 @@ static int usb_string_copy(const char *s, char **s_copy) int ret; char *str; char *copy = *s_copy; + ret = strlen(s); if (ret > 126) return -EOVERFLOW; + if (ret < 1) + return -EINVAL; str = kstrdup(s, GFP_KERNEL); if (!str) -- 2.25.1

2 1

[PATCH OLK-5.10] usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()
by Zeng Heng 16 Aug '24

16 Aug '24

From: Lee Jones <lee(a)kernel.org> mainline inclusion from mainline-v6.10 commit 6d3c721e686ea6c59e18289b400cc95c76e927e0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAILHF CVE: CVE-2024-42236 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Userspace provided string 's' could trivially have the length zero. Left unchecked this will firstly result in an OOB read in the form `if (str[0 - 1] == '\n') followed closely by an OOB write in the form `str[0 - 1] = '\0'`. There is already a validating check to catch strings that are too long. Let's supply an additional check for invalid strings that are too short. Signed-off-by: Lee Jones <lee(a)kernel.org> Cc: stable <stable(a)kernel.org> Link: https://lore.kernel.org/r/20240705074339.633717-1-lee@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: dengquan <dengquan9(a)huawei.com> --- drivers/usb/gadget/configfs.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c index d51ea1c052f2..6bb69a4e6470 100644 --- a/drivers/usb/gadget/configfs.c +++ b/drivers/usb/gadget/configfs.c @@ -104,9 +104,12 @@ static int usb_string_copy(const char *s, char **s_copy) int ret; char *str; char *copy = *s_copy; + ret = strlen(s); if (ret > USB_MAX_STRING_LEN) return -EOVERFLOW; + if (ret < 1) + return -EINVAL; if (copy) { str = copy; -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] sched/cputime: Fix mul_u64_u64_div_u64() precision for cputime
by Zheng Zucheng 16 Aug '24

16 Aug '24

mainline inclusion from mainline-v6.11-rc2 commit 77baa5bafcbe1b2a15ef9c37232c21279c95481c category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IAIN7D Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In extreme test scenarios: the 14th field utime in /proc/xx/stat is greater than sum_exec_runtime, utime = 18446744073709518790 ns, rtime = 135989749728000 ns In cputime_adjust() process, stime is greater than rtime due to mul_u64_u64_div_u64() precision problem. before call mul_u64_u64_div_u64(), stime = 175136586720000, rtime = 135989749728000, utime = 1416780000. after call mul_u64_u64_div_u64(), stime = 135989949653530 unsigned reversion occurs because rtime is less than stime. utime = rtime - stime = 135989749728000 - 135989949653530 = -199925530 = (u64)18446744073709518790 Trigger condition: 1). User task run in kernel mode most of time 2). ARM64 architecture 3). TICK_CPU_ACCOUNTING=y CONFIG_VIRT_CPU_ACCOUNTING_NATIVE is not set Fix mul_u64_u64_div_u64() conversion precision by reset stime to rtime Fixes: 3dc167ba5729 ("sched/cputime: Improve cputime_adjust()") Signed-off-by: Zheng Zucheng <zhengzucheng(a)huawei.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Cc: <stable(a)vger.kernel.org> Link: https://lkml.kernel.org/r/20240726023235.217771-1-zhengzucheng@huawei.com Signed-off-by: Zheng Zucheng <zhengzucheng(a)huawei.com> Conflicts: kernel/sched/cputime.c [mul_u64_u64_div_u64 is replaced by scale_stime, No functional impact.] Signed-off-by: Zheng Zucheng <zhengzucheng(a)huawei.com> --- kernel/sched/cputime.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/kernel/sched/cputime.c b/kernel/sched/cputime.c index 0df2448eb5d1..4055f2008cc6 100644 --- a/kernel/sched/cputime.c +++ b/kernel/sched/cputime.c @@ -728,6 +728,12 @@ void cputime_adjust(struct task_cputime *curr, struct prev_cputime *prev, } stime = scale_stime(stime, rtime, stime + utime); + /* + * Because mul_u64_u64_div_u64() can approximate on some + * achitectures; enforce the constraint that: a*b/(b+c) <= a. + */ + if (unlikely(stime > rtime)) + stime = rtime; update: /* -- 2.34.1

2 1