- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10 0/1] fix CVE-2024-38621
by Liao Chen 25 Jun '24

25 Jun '24

media: stk1160: fix bounds checking in stk1160_copy_video() Dan Carpenter (1): media: stk1160: fix bounds checking in stk1160_copy_video() drivers/media/usb/stk1160/stk1160-video.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-1.0-LTS 0/1] CVE-2022-48715
by Chen Ridong 25 Jun '24

25 Jun '24

*** BLURB HERE *** John Meneghini (1): scsi: bnx2fc: Make bnx2fc_recv_frame() mp safe drivers/scsi/bnx2fc/bnx2fc_fcoe.c | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) -- 2.34.1

2 2

[PATCH v2 OLK-6.6] ASoC: mediatek: Assign dummy when codec not specified for a DAI link
by liwei 25 Jun '24

25 Jun '24

From: AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> mainline inclusion from mainline-v6.10-rc1 commit 5f39231888c63f0a7708abc86b51b847476379d8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA6SG2 CVE: CVE-2024-38551 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- MediaTek sound card drivers are checking whether a DAI link is present and used on a board to assign the correct parameters and this is done by checking the codec DAI names at probe time. If no real codec is present, assign the dummy codec to the DAI link to avoid NULL pointer during string comparison. Fixes: 4302187d955f ("ASoC: mediatek: common: add soundcard driver common code") Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> Link: https://msgid.link/r/20240313110147.1267793-5-angelogioacchino.delregno@col… Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: liwei <liwei728(a)huawei.com> --- sound/soc/mediatek/common/mtk-soundcard-driver.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/sound/soc/mediatek/common/mtk-soundcard-driver.c b/sound/soc/mediatek/common/mtk-soundcard-driver.c index a58e1e3674de..000a086a8cf4 100644 --- a/sound/soc/mediatek/common/mtk-soundcard-driver.c +++ b/sound/soc/mediatek/common/mtk-soundcard-driver.c @@ -22,7 +22,11 @@ static int set_card_codec_info(struct snd_soc_card *card, codec_node = of_get_child_by_name(sub_node, "codec"); if (!codec_node) { - dev_dbg(dev, "%s no specified codec\n", dai_link->name); + dev_dbg(dev, "%s no specified codec: setting dummy.\n", dai_link->name); + + dai_link->codecs = &snd_soc_dummy_dlc; + dai_link->num_codecs = 1; + dai_link->dynamic = 1; return 0; } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/1] fix CVE-2024-38621
by Liao Chen 25 Jun '24

25 Jun '24

media: stk1160: fix bounds checking in stk1160_copy_video() Dan Carpenter (1): media: stk1160: fix bounds checking in stk1160_copy_video() drivers/media/usb/stk1160/stk1160-video.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) -- 2.34.1

2 2

[PATCH OLK-5.10] cvm: delete dead code and resolve macro definition holes
by Ju Fu 25 Jun '24

25 Jun '24

virtcca inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I9TM0T -------------------------------- delete dead code and resolve macro definition holes Signed-off-by: Ju Fu <fuju1(a)huawei.com> --- arch/arm64/include/asm/kvm_tmi.h | 34 ++++++++++---------------------- arch/arm64/kvm/cvm.c | 1 - arch/arm64/kvm/tmi.c | 26 +----------------------- 3 files changed, 11 insertions(+), 50 deletions(-) diff --git a/arch/arm64/include/asm/kvm_tmi.h b/arch/arm64/include/asm/kvm_tmi.h index b89680f31..eef64936f 100644 --- a/arch/arm64/include/asm/kvm_tmi.h +++ b/arch/arm64/include/asm/kvm_tmi.h @@ -206,28 +206,24 @@ struct tmi_tec_run { * always invoked by the Normal world, forward by SPMD and handled by the * TMM. */ -#define TMI_FNUM_VERSION U(0x260) +#define TMI_FNUM_VERSION_REQ U(0x260) #define TMI_FNUM_MEM_INFO_SHOW U(0x261) #define TMI_FNUM_DATA_CREATE U(0x262) #define TMI_FNUM_DATA_DESTROY U(0x263) #define TMI_FNUM_CVM_ACTIVATE U(0x264) #define TMI_FNUM_CVM_CREATE U(0x265) #define TMI_FNUM_CVM_DESTROY U(0x266) -#define TMI_FNUM_TEC_CREATE U(0x27A) -#define TMI_FNUM_TEC_DESTROY U(0x27B) -#define TMI_FNUM_TEC_ENTER U(0x27C) -#define TMI_FNUM_TTT_CREATE U(0x27D) -#define TMI_FNUM_TTT_MAP_UNPROTECTED U(0x27F) -#define TMI_FNUM_TTT_MAP_PROTECTED U(0x280) -#define TMI_FNUM_TTT_UNMAP_UNPROTECTED U(0x282) -#define TMI_FNUM_TTT_UNMAP_PROTECTED U(0x283) -#define TMI_FNUM_PSCI_COMPLETE U(0x284) -#define TMI_FNUM_FEATURES U(0x285) -#define TMI_FNUM_TTT_MAP_RANGE U(0x286) -#define TMI_FNUM_TTT_UNMAP_RANGE U(0x287) +#define TMI_FNUM_TEC_CREATE U(0x267) +#define TMI_FNUM_TEC_DESTROY U(0x268) +#define TMI_FNUM_TEC_ENTER U(0x269) +#define TMI_FNUM_TTT_CREATE U(0x26A) +#define TMI_FNUM_PSCI_COMPLETE U(0x26B) +#define TMI_FNUM_FEATURES U(0x26C) +#define TMI_FNUM_TTT_MAP_RANGE U(0x26D) +#define TMI_FNUM_TTT_UNMAP_RANGE U(0x26E) /* TMI SMC64 PIDs handled by the SPMD */ -#define TMI_TMM_VESION TMI_FID(SMC_64, TMI_FNUM_VERSION) +#define TMI_TMM_VERSION_REQ TMI_FID(SMC_64, TMI_FNUM_VERSION_REQ) #define TMI_TMM_DATA_CREATE TMI_FID(SMC_64, TMI_FNUM_DATA_CREATE) #define TMI_TMM_DATA_DESTROY TMI_FID(SMC_64, TMI_FNUM_DATA_DESTROY) #define TMI_TMM_CVM_ACTIVATE TMI_FID(SMC_64, TMI_FNUM_CVM_ACTIVATE) @@ -237,10 +233,6 @@ struct tmi_tec_run { #define TMI_TMM_TEC_DESTROY TMI_FID(SMC_64, TMI_FNUM_TEC_DESTROY) #define TMI_TMM_TEC_ENTER TMI_FID(SMC_64, TMI_FNUM_TEC_ENTER) #define TMI_TMM_TTT_CREATE TMI_FID(SMC_64, TMI_FNUM_TTT_CREATE) -#define TMI_TMM_TTT_MAP_UNPROTECTED TMI_FID(SMC_64, TMI_FNUM_TTT_MAP_UNPROTECTED) -#define TMI_TMM_TTT_MAP_PROTECTED TMI_FID(SMC_64, TMI_FNUM_TTT_MAP_PROTECTED) -#define TMI_TMM_TTT_UNMAP_UNPROTECTED TMI_FID(SMC_64, TMI_FNUM_TTT_UNMAP_UNPROTECTED) -#define TMI_TMM_TTT_UNMAP_PROTECTED TMI_FID(SMC_64, TMI_FNUM_TTT_UNMAP_PROTECTED) #define TMI_TMM_PSCI_COMPLETE TMI_FID(SMC_64, TMI_FNUM_PSCI_COMPLETE) #define TMI_TMM_FEATURES TMI_FID(SMC_64, TMI_FNUM_FEATURES) #define TMI_TMM_MEM_INFO_SHOW TMI_FID(SMC_64, TMI_FNUM_MEM_INFO_SHOW) @@ -331,8 +323,6 @@ static inline bool is_armv8_4_sel2_present(void) ID_AA64PFR0_SEL2_MASK) == 1UL; } -u64 phys_to_cvm_phys(u64 phys); - u64 tmi_version(void); u64 tmi_data_create(u64 data, u64 rd, u64 map_addr, u64 src, u64 level); u64 tmi_data_destroy(u64 rd, u64 map_addr, u64 level); @@ -343,14 +333,10 @@ u64 tmi_tec_create(u64 numa_set, u64 rd, u64 mpidr, u64 params_ptr); u64 tmi_tec_destroy(u64 tec); u64 tmi_tec_enter(u64 tec, u64 run_ptr); u64 tmi_ttt_create(u64 numa_set, u64 rd, u64 map_addr, u64 level); -u64 tmi_ttt_map_unprotected(u64 rd, u64 map_addr, u64 level, u64 ttte); -u64 tmi_ttt_unmap_unprotected(u64 rd, u64 map_addr, u64 level, u64 ns); -u64 tmi_ttt_unmap_protected(u64 rd, u64 map_addr, u64 level); u64 tmi_psci_complete(u64 calling_tec, u64 target_tec); u64 tmi_features(u64 index); u64 tmi_ttt_map_range(u64 rd, u64 map_addr, u64 size, u64 cur_node, u64 target_node); u64 tmi_ttt_unmap_range(u64 rd, u64 map_addr, u64 size, u64 node_id); - u64 tmi_mem_info_show(u64 mem_info_addr); void kvm_cvm_vcpu_put(struct kvm_vcpu *vcpu); diff --git a/arch/arm64/kvm/cvm.c b/arch/arm64/kvm/cvm.c index 73b8daede..08fad30d1 100644 --- a/arch/arm64/kvm/cvm.c +++ b/arch/arm64/kvm/cvm.c @@ -171,7 +171,6 @@ int kvm_arm_create_cvm(struct kvm *kvm) pgd_sz = kvm_pgd_pages(pgt->ia_bits, pgt->start_level); - cvm->params->measurement_algo = 0; cvm->params->ttt_level_start = kvm->arch.mmu.pgt->start_level; cvm->params->ttt_num_start = pgd_sz; cvm->params->s2sz = VTCR_EL2_IPA(kvm->arch.vtcr); diff --git a/arch/arm64/kvm/tmi.c b/arch/arm64/kvm/tmi.c index 1fcf1a8cc..888f1a4a2 100644 --- a/arch/arm64/kvm/tmi.c +++ b/arch/arm64/kvm/tmi.c @@ -10,7 +10,7 @@ u64 tmi_version(void) { struct arm_smccc_res res; - arm_smccc_1_1_smc(TMI_TMM_VESION, &res); + arm_smccc_1_1_smc(TMI_TMM_VERSION_REQ, &res); return res.a1; } @@ -86,30 +86,6 @@ u64 tmi_ttt_create(u64 numa_set, u64 rd, u64 map_addr, u64 level) return res.a1; } -u64 tmi_ttt_map_unprotected(u64 rd, u64 map_addr, u64 level, u64 ttte) -{ - struct arm_smccc_res res; - - arm_smccc_1_1_smc(TMI_TMM_TTT_MAP_UNPROTECTED, rd, map_addr, level, ttte, &res); - return res.a1; -} - -u64 tmi_ttt_unmap_unprotected(u64 rd, u64 map_addr, u64 level, u64 ns) -{ - struct arm_smccc_res res; - - arm_smccc_1_1_smc(TMI_TMM_TTT_UNMAP_UNPROTECTED, rd, map_addr, level, ns, &res); - return res.a1; -} - -u64 tmi_ttt_unmap_protected(u64 rd, u64 map_addr, u64 level) -{ - struct arm_smccc_res res; - - arm_smccc_1_1_smc(TMI_TMM_TTT_UNMAP_PROTECTED, rd, map_addr, level, &res); - return res.a1; -} - u64 tmi_psci_complete(u64 calling_tec, u64 target_tec) { struct arm_smccc_res res; -- 2.25.1.windows.1

2 1

[PATCH OLK-6.6] ASoC: mediatek: Assign dummy when codec not specified for a DAI link
by liwei 25 Jun '24

25 Jun '24

From: AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> mainline inclusion from mainline-v6.10-rc1 commit 5f39231888c63f0a7708abc86b51b847476379d8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IA6SG2 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- MediaTek sound card drivers are checking whether a DAI link is present and used on a board to assign the correct parameters and this is done by checking the codec DAI names at probe time. If no real codec is present, assign the dummy codec to the DAI link to avoid NULL pointer during string comparison. Fixes: 4302187d955f ("ASoC: mediatek: common: add soundcard driver common code") Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com> Link: https://msgid.link/r/20240313110147.1267793-5-angelogioacchino.delregno@col… Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: liwei <liwei728(a)huawei.com> --- sound/soc/mediatek/common/mtk-soundcard-driver.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/sound/soc/mediatek/common/mtk-soundcard-driver.c b/sound/soc/mediatek/common/mtk-soundcard-driver.c index a58e1e3674de..000a086a8cf4 100644 --- a/sound/soc/mediatek/common/mtk-soundcard-driver.c +++ b/sound/soc/mediatek/common/mtk-soundcard-driver.c @@ -22,7 +22,11 @@ static int set_card_codec_info(struct snd_soc_card *card, codec_node = of_get_child_by_name(sub_node, "codec"); if (!codec_node) { - dev_dbg(dev, "%s no specified codec\n", dai_link->name); + dev_dbg(dev, "%s no specified codec: setting dummy.\n", dai_link->name); + + dai_link->codecs = &snd_soc_dummy_dlc; + dai_link->num_codecs = 1; + dai_link->dynamic = 1; return 0; } -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1] hid: cp2112: Fix duplicate workqueue initialization
by Yuan Can 25 Jun '24

25 Jun '24

From: Danny Kaehn <danny.kaehn(a)plexus.com> stable inclusion from stable-v5.15.139 commit df0daac2709473531d6a3472997cc65301ac06d6 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RFR6 CVE: CVE-2023-52853 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Previously the cp2112 driver called INIT_DELAYED_WORK within cp2112_gpio_irq_startup, resulting in duplicate initilizations of the workqueue on subsequent IRQ startups following an initial request. This resulted in a warning in set_work_data in workqueue.c, as well as a rare NULL dereference within process_one_work in workqueue.c. Initialize the workqueue within _probe instead. Fixes: 13de9cca514e ("HID: cp2112: add IRQ chip handling") Signed-off-by: Danny Kaehn <danny.kaehn(a)plexus.com> Signed-off-by: Jiri Kosina <jkosina(a)suse.cz> Conflicts: drivers/hid/hid-cp2112.c [Fix context] Signed-off-by: Yuan Can <yuancan(a)huawei.com> --- drivers/hid/hid-cp2112.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/hid/hid-cp2112.c b/drivers/hid/hid-cp2112.c index 172f20e88c6c..966504eea1bc 100644 --- a/drivers/hid/hid-cp2112.c +++ b/drivers/hid/hid-cp2112.c @@ -1157,8 +1157,6 @@ static unsigned int cp2112_gpio_irq_startup(struct irq_data *d) struct gpio_chip *gc = irq_data_get_irq_chip_data(d); struct cp2112_device *dev = gpiochip_get_data(gc); - INIT_DELAYED_WORK(&dev->gpio_poll_worker, cp2112_gpio_poll_callback); - if (!dev->gpio_poll) { dev->gpio_poll = true; schedule_delayed_work(&dev->gpio_poll_worker, 0); @@ -1353,6 +1351,8 @@ static int cp2112_probe(struct hid_device *hdev, const struct hid_device_id *id) girq->default_type = IRQ_TYPE_NONE; girq->handler = handle_simple_irq; + INIT_DELAYED_WORK(&dev->gpio_poll_worker, cp2112_gpio_poll_callback); + ret = gpiochip_add_data(&dev->gc, dev); if (ret < 0) { hid_err(hdev, "error registering gpio chip\n"); -- 2.17.1

2 1

[OLK-6.6] RDMA/hns: Fix some mutex UAF
by Chengchang Tang 25 Jun '24

25 Jun '24

From: wenglianfa <wenglianfa(a)huawei.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IA5Z6R ---------------------------------------------------------------------- umem_unfree_list_mutex and mtr_unfree_list_mutex may be used after being destroyed. To fix it, The mutex is destroyed after it is used for the last time. Fixes: a91843046b2a ("RDMA/hns: Fix sleeping in spin_lock critical section") Signed-off-by: wenglianfa <wenglianfa(a)huawei.com> Signed-off-by: Guofeng Yue <yueguofeng(a)h-partners.com> --- drivers/infiniband/hw/hns/hns_roce_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c b/drivers/infiniband/hw/hns/hns_roce_main.c index 424dcf69d3b8..3628dbb250ab 100644 --- a/drivers/infiniband/hw/hns/hns_roce_main.c +++ b/drivers/infiniband/hw/hns/hns_roce_main.c @@ -1503,9 +1503,9 @@ void hns_roce_exit(struct hns_roce_dev *hr_dev, bool bond_cleanup) if (hr_dev->hw->hw_exit) hr_dev->hw->hw_exit(hr_dev); - hns_roce_teardown_hca(hr_dev); hns_roce_free_unfree_umem(hr_dev); hns_roce_free_unfree_mtr(hr_dev); + hns_roce_teardown_hca(hr_dev); hns_roce_cleanup_hem(hr_dev); if (hr_dev->cmd_mod) -- 2.33.0

1 0

[PATCH openEuler-22.03-LTS-SP1 0/2] CVE-2022-48703
by Pu Lehui 25 Jun '24

25 Jun '24

Lee, Chun-Yi (1): thermal/int340x_thermal: handle data_vault when the value is ZERO_SIZE_PTR Rafael J. Wysocki (1): thermal: int340x_thermal: Consolidate priv->data_vault checks drivers/thermal/intel/int340x_thermal/int3400_thermal.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10 0/2] CVE-2022-48703
by Pu Lehui 25 Jun '24

25 Jun '24

Lee, Chun-Yi (1): thermal/int340x_thermal: handle data_vault when the value is ZERO_SIZE_PTR Rafael J. Wysocki (1): thermal: int340x_thermal: Consolidate priv->data_vault checks drivers/thermal/intel/int340x_thermal/int3400_thermal.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) -- 2.34.1

2 3